sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c

   1 /*
   2  * ng_btsocket_hci_raw.c
   3  */
   4
   5 /*-
   6  * Copyright (c) 2001-2002 Maksim Yevmenkin <m_evmenkin@yahoo.com>
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  *
  30  * $Id: ng_btsocket_hci_raw.c,v 1.14 2003/09/14 23:29:06 max Exp $
  31  * $FreeBSD$
  32  */
  33
  34 #include <sys/param.h>
  35 #include <sys/systm.h>
  36 #include <sys/bitstring.h>
  37 #include <sys/domain.h>
  38 #include <sys/endian.h>
  39 #include <sys/errno.h>
  40 #include <sys/filedesc.h>
  41 #include <sys/ioccom.h>
  42 #include <sys/kernel.h>
  43 #include <sys/lock.h>
  44 #include <sys/malloc.h>
  45 #include <sys/mbuf.h>
  46 #include <sys/mutex.h>
  47 #include <sys/priv.h>
  48 #include <sys/protosw.h>
  49 #include <sys/queue.h>
  50 #include <sys/socket.h>
  51 #include <sys/socketvar.h>
  52 #include <sys/sysctl.h>
  53 #include <sys/taskqueue.h>
  54 #include <netgraph/ng_message.h>
  55 #include <netgraph/netgraph.h>
  56 #include <netgraph/bluetooth/include/ng_bluetooth.h>
  57 #include <netgraph/bluetooth/include/ng_hci.h>
  58 #include <netgraph/bluetooth/include/ng_l2cap.h>
  59 #include <netgraph/bluetooth/include/ng_btsocket.h>
  60 #include <netgraph/bluetooth/include/ng_btsocket_hci_raw.h>
  61
  62 /* MALLOC define */
  63 #ifdef NG_SEPARATE_MALLOC
  64 MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_HCI_RAW, "netgraph_btsocks_hci_raw",
  65         "Netgraph Bluetooth raw HCI sockets");
  66 #else
  67 #define M_NETGRAPH_BTSOCKET_HCI_RAW M_NETGRAPH
  68 #endif /* NG_SEPARATE_MALLOC */
  69
  70 /* Netgraph node methods */
  71 static ng_constructor_t ng_btsocket_hci_raw_node_constructor;
  72 static ng_rcvmsg_t      ng_btsocket_hci_raw_node_rcvmsg;
  73 static ng_shutdown_t    ng_btsocket_hci_raw_node_shutdown;
  74 static ng_newhook_t     ng_btsocket_hci_raw_node_newhook;
  75 static ng_connect_t     ng_btsocket_hci_raw_node_connect;
  76 static ng_rcvdata_t     ng_btsocket_hci_raw_node_rcvdata;
  77 static ng_disconnect_t  ng_btsocket_hci_raw_node_disconnect;
  78
  79 static void             ng_btsocket_hci_raw_input (void *, int);
  80 static void             ng_btsocket_hci_raw_output(node_p, hook_p, void *, int);
  81 static void             ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p,
  82                                                    struct mbuf **,
  83                                                    struct mbuf *);
  84 static int              ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p,
  85                                                    struct mbuf *, int);
  86
  87 #define ng_btsocket_hci_raw_wakeup_input_task() \
  88         taskqueue_enqueue(taskqueue_swi, &ng_btsocket_hci_raw_task)
  89
  90 /* Security filter */
  91 struct ng_btsocket_hci_raw_sec_filter {
  92         bitstr_t        bit_decl(events, 0xff);
  93         bitstr_t        bit_decl(commands[0x3f], 0x3ff);
  94 };
  95
  96 /* Netgraph type descriptor */
  97 static struct ng_type typestruct = {
  98         .version =      NG_ABI_VERSION,
  99         .name =         NG_BTSOCKET_HCI_RAW_NODE_TYPE,
 100         .constructor =  ng_btsocket_hci_raw_node_constructor,
 101         .rcvmsg =       ng_btsocket_hci_raw_node_rcvmsg,
 102         .shutdown =     ng_btsocket_hci_raw_node_shutdown,
 103         .newhook =      ng_btsocket_hci_raw_node_newhook,
 104         .connect =      ng_btsocket_hci_raw_node_connect,
 105         .rcvdata =      ng_btsocket_hci_raw_node_rcvdata,
 106         .disconnect =   ng_btsocket_hci_raw_node_disconnect,
 107 };
 108
 109 /* Globals */
 110 static u_int32_t                                ng_btsocket_hci_raw_debug_level;
 111 static u_int32_t                                ng_btsocket_hci_raw_ioctl_timeout;
 112 static node_p                                   ng_btsocket_hci_raw_node;
 113 static struct ng_bt_itemq                       ng_btsocket_hci_raw_queue;
 114 static struct mtx                               ng_btsocket_hci_raw_queue_mtx;
 115 static struct task                              ng_btsocket_hci_raw_task;
 116 static LIST_HEAD(, ng_btsocket_hci_raw_pcb)     ng_btsocket_hci_raw_sockets;
 117 static struct mtx                               ng_btsocket_hci_raw_sockets_mtx;
 118 static u_int32_t                                ng_btsocket_hci_raw_token;
 119 static struct mtx                               ng_btsocket_hci_raw_token_mtx;
 120 static struct ng_btsocket_hci_raw_sec_filter    *ng_btsocket_hci_raw_sec_filter;
 121 static struct timeval                           ng_btsocket_hci_raw_lasttime;
 122 static int                                      ng_btsocket_hci_raw_curpps;
 123
 124 /* Sysctl tree */
 125 SYSCTL_DECL(_net_bluetooth_hci_sockets);
 126 SYSCTL_NODE(_net_bluetooth_hci_sockets, OID_AUTO, raw, CTLFLAG_RW,
 127         0, "Bluetooth raw HCI sockets family");
 128 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, debug_level, CTLFLAG_RW,
 129         &ng_btsocket_hci_raw_debug_level, NG_BTSOCKET_WARN_LEVEL,
 130         "Bluetooth raw HCI sockets debug level");
 131 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, ioctl_timeout, CTLFLAG_RW,
 132         &ng_btsocket_hci_raw_ioctl_timeout, 5,
 133         "Bluetooth raw HCI sockets ioctl timeout");
 134 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_len, CTLFLAG_RD,
 135         &ng_btsocket_hci_raw_queue.len, 0,
 136         "Bluetooth raw HCI sockets input queue length");
 137 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_maxlen, CTLFLAG_RD,
 138         &ng_btsocket_hci_raw_queue.maxlen, 0,
 139         "Bluetooth raw HCI sockets input queue max. length");
 140 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_drops, CTLFLAG_RD,
 141         &ng_btsocket_hci_raw_queue.drops, 0,
 142         "Bluetooth raw HCI sockets input queue drops");
 143
 144 /* Debug */
 145 #define NG_BTSOCKET_HCI_RAW_INFO \
 146         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_INFO_LEVEL && \
 147             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
 148                 printf
 149
 150 #define NG_BTSOCKET_HCI_RAW_WARN \
 151         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_WARN_LEVEL && \
 152             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
 153                 printf
 154
 155 #define NG_BTSOCKET_HCI_RAW_ERR \
 156         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ERR_LEVEL && \
 157             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
 158                 printf
 159
 160 #define NG_BTSOCKET_HCI_RAW_ALERT \
 161         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ALERT_LEVEL && \
 162             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
 163                 printf
 164
 165 /****************************************************************************
 166  ****************************************************************************
 167  **                          Netgraph specific
 168  ****************************************************************************
 169  ****************************************************************************/
 170
 171 /*
 172  * Netgraph node constructor. Do not allow to create node of this type.
 173  */
 174
 175 static int
 176 ng_btsocket_hci_raw_node_constructor(node_p node)
 177 {
 178         return (EINVAL);
 179 } /* ng_btsocket_hci_raw_node_constructor */
 180
 181 /*
 182  * Netgraph node destructor. Just let old node go and create new fresh one.
 183  */
 184
 185 static int
 186 ng_btsocket_hci_raw_node_shutdown(node_p node)
 187 {
 188         int     error = 0;
 189
 190         NG_NODE_UNREF(node);
 191
 192         error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
 193         if (error  != 0) {
 194                 NG_BTSOCKET_HCI_RAW_ALERT(
 195 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
 196
 197                 ng_btsocket_hci_raw_node = NULL;
 198
 199                 return (ENOMEM);
 200         }
 201
 202         error = ng_name_node(ng_btsocket_hci_raw_node,
 203                                 NG_BTSOCKET_HCI_RAW_NODE_TYPE);
 204         if (error != 0) {
 205                 NG_BTSOCKET_HCI_RAW_ALERT(
 206 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
 207
 208                 NG_NODE_UNREF(ng_btsocket_hci_raw_node);
 209                 ng_btsocket_hci_raw_node = NULL;
 210
 211                 return (EINVAL);
 212         }
 213
 214         return (0);
 215 } /* ng_btsocket_hci_raw_node_shutdown */
 216
 217 /*
 218  * Create new hook. Just say "yes"
 219  */
 220
 221 static int
 222 ng_btsocket_hci_raw_node_newhook(node_p node, hook_p hook, char const *name)
 223 {
 224         return (0);
 225 } /* ng_btsocket_hci_raw_node_newhook */
 226
 227 /*
 228  * Connect hook. Just say "yes"
 229  */
 230
 231 static int
 232 ng_btsocket_hci_raw_node_connect(hook_p hook)
 233 {
 234         return (0);
 235 } /* ng_btsocket_hci_raw_node_connect */
 236
 237 /*
 238  * Disconnect hook
 239  */
 240
 241 static int
 242 ng_btsocket_hci_raw_node_disconnect(hook_p hook)
 243 {
 244         return (0);
 245 } /* ng_btsocket_hci_raw_node_disconnect */
 246
 247 /*
 248  * Receive control message.
 249  * Make sure it is a message from HCI node and it is a response.
 250  * Enqueue item and schedule input task.
 251  */
 252
 253 static int
 254 ng_btsocket_hci_raw_node_rcvmsg(node_p node, item_p item, hook_p lasthook)
 255 {
 256         struct ng_mesg  *msg = NGI_MSG(item); /* item still has message */
 257         int              error = 0;
 258
 259         /*
 260          * Check for empty sockets list creates LOR when both sender and
 261          * receiver device are connected to the same host, so remove it
 262          * for now
 263          */
 264
 265         if (msg != NULL &&
 266             (msg->header.typecookie == NGM_HCI_COOKIE ||
 267              msg->header.typecookie == NGM_GENERIC_COOKIE) &&
 268             msg->header.flags & NGF_RESP) {
 269                 if (msg->header.token == 0) {
 270                         NG_FREE_ITEM(item);
 271                         return (0);
 272                 }
 273
 274                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 275                 if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
 276                         NG_BTSOCKET_HCI_RAW_ERR(
 277 "%s: Input queue is full\n", __func__);
 278
 279                         NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
 280                         NG_FREE_ITEM(item);
 281                         error = ENOBUFS;
 282                 } else {
 283                         NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
 284                         error = ng_btsocket_hci_raw_wakeup_input_task();
 285                 }
 286                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 287         } else {
 288                 NG_FREE_ITEM(item);
 289                 error = EINVAL;
 290         }
 291
 292         return (error);
 293 } /* ng_btsocket_hci_raw_node_rcvmsg */
 294
 295 /*
 296  * Receive packet from the one of our hook.
 297  * Prepend every packet with sockaddr_hci and record sender's node name.
 298  * Enqueue item and schedule input task.
 299  */
 300
 301 static int
 302 ng_btsocket_hci_raw_node_rcvdata(hook_p hook, item_p item)
 303 {
 304         struct mbuf     *nam = NULL;
 305         int              error;
 306
 307         /*
 308          * Check for empty sockets list creates LOR when both sender and
 309          * receiver device are connected to the same host, so remove it
 310          * for now
 311          */
 312
 313         MGET(nam, M_DONTWAIT, MT_SONAME);
 314         if (nam != NULL) {
 315                 struct sockaddr_hci     *sa = mtod(nam, struct sockaddr_hci *);
 316
 317                 nam->m_len = sizeof(struct sockaddr_hci);
 318
 319                 sa->hci_len = sizeof(*sa);
 320                 sa->hci_family = AF_BLUETOOTH;
 321                 strlcpy(sa->hci_node, NG_PEER_NODE_NAME(hook),
 322                         sizeof(sa->hci_node));
 323
 324                 NGI_GET_M(item, nam->m_next);
 325                 NGI_M(item) = nam;
 326
 327                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 328                 if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
 329                         NG_BTSOCKET_HCI_RAW_ERR(
 330 "%s: Input queue is full\n", __func__);
 331
 332                         NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
 333                         NG_FREE_ITEM(item);
 334                         error = ENOBUFS;
 335                 } else {
 336                         NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
 337                         error = ng_btsocket_hci_raw_wakeup_input_task();
 338                 }
 339                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 340         } else {
 341                 NG_BTSOCKET_HCI_RAW_ERR(
 342 "%s: Failed to allocate address mbuf\n", __func__);
 343
 344                 NG_FREE_ITEM(item);
 345                 error = ENOBUFS;
 346         }
 347
 348         return (error);
 349 } /* ng_btsocket_hci_raw_node_rcvdata */
 350
 351 /****************************************************************************
 352  ****************************************************************************
 353  **                              Sockets specific
 354  ****************************************************************************
 355  ****************************************************************************/
 356
 357 /*
 358  * Get next token. We need token to avoid theoretical race where process
 359  * submits ioctl() message then interrupts ioctl() and re-submits another
 360  * ioctl() on the same socket *before* first ioctl() complete.
 361  */
 362
 363 static void
 364 ng_btsocket_hci_raw_get_token(u_int32_t *token)
 365 {
 366         mtx_lock(&ng_btsocket_hci_raw_token_mtx);
 367
 368         if (++ ng_btsocket_hci_raw_token == 0)
 369                 ng_btsocket_hci_raw_token = 1;
 370
 371         *token = ng_btsocket_hci_raw_token;
 372
 373         mtx_unlock(&ng_btsocket_hci_raw_token_mtx);
 374 } /* ng_btsocket_hci_raw_get_token */
 375
 376 /*
 377  * Send Netgraph message to the node - do not expect reply
 378  */
 379
 380 static int
 381 ng_btsocket_hci_raw_send_ngmsg(char *path, int cmd, void *arg, int arglen)
 382 {
 383         struct ng_mesg  *msg = NULL;
 384         int              error = 0;
 385
 386         NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, arglen, M_NOWAIT);
 387         if (msg == NULL)
 388                 return (ENOMEM);
 389
 390         if (arg != NULL && arglen > 0)
 391                 bcopy(arg, msg->data, arglen);
 392
 393         NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
 394
 395         return (error);
 396 } /* ng_btsocket_hci_raw_send_ngmsg */
 397
 398 /*
 399  * Send Netgraph message to the node (no data) and wait for reply
 400  */
 401
 402 static int
 403 ng_btsocket_hci_raw_send_sync_ngmsg(ng_btsocket_hci_raw_pcb_p pcb, char *path,
 404                 int cmd, void *rsp, int rsplen)
 405 {
 406         struct ng_mesg  *msg = NULL;
 407         int              error = 0;
 408
 409         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 410
 411         NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, 0, M_NOWAIT);
 412         if (msg == NULL)
 413                 return (ENOMEM);
 414
 415         ng_btsocket_hci_raw_get_token(&msg->header.token);
 416         pcb->token = msg->header.token;
 417         pcb->msg = NULL;
 418
 419         NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
 420         if (error != 0) {
 421                 pcb->token = 0;
 422                 return (error);
 423         }
 424
 425         error = msleep(&pcb->msg, &pcb->pcb_mtx, PZERO|PCATCH, "hcictl",
 426                         ng_btsocket_hci_raw_ioctl_timeout * hz);
 427         pcb->token = 0;
 428
 429         if (error != 0)
 430                 return (error);
 431
 432         if (pcb->msg != NULL && pcb->msg->header.cmd == cmd)
 433                 bcopy(pcb->msg->data, rsp, rsplen);
 434         else
 435                 error = EINVAL;
 436
 437         NG_FREE_MSG(pcb->msg); /* checks for != NULL */
 438
 439         return (0);
 440 } /* ng_btsocket_hci_raw_send_sync_ngmsg */
 441
 442 /*
 443  * Create control information for the packet
 444  */
 445
 446 static void
 447 ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf **ctl,
 448                 struct mbuf *m)
 449 {
 450         int             dir;
 451         struct timeval  tv;
 452
 453         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 454
 455         if (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION) {
 456                 dir = (m->m_flags & M_PROTO1)? 1 : 0;
 457                 *ctl = sbcreatecontrol((caddr_t) &dir, sizeof(dir),
 458                                         SCM_HCI_RAW_DIRECTION, SOL_HCI_RAW);
 459                 if (*ctl != NULL)
 460                         ctl = &((*ctl)->m_next);
 461         }
 462
 463         if (pcb->so->so_options & SO_TIMESTAMP) {
 464                 microtime(&tv);
 465                 *ctl = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
 466                                         SCM_TIMESTAMP, SOL_SOCKET);
 467                 if (*ctl != NULL)
 468                         ctl = &((*ctl)->m_next);
 469         }
 470 } /* ng_btsocket_hci_raw_savctl */
 471
 472 /*
 473  * Raw HCI sockets data input routine
 474  */
 475
 476 static void
 477 ng_btsocket_hci_raw_data_input(struct mbuf *nam)
 478 {
 479         ng_btsocket_hci_raw_pcb_p        pcb = NULL;
 480         struct mbuf                     *m0 = NULL, *m = NULL;
 481         struct sockaddr_hci             *sa = NULL;
 482
 483         m0 = nam->m_next;
 484         nam->m_next = NULL;
 485
 486         KASSERT((nam->m_type == MT_SONAME),
 487                 ("%s: m_type=%d\n", __func__, nam->m_type));
 488         KASSERT((m0->m_flags & M_PKTHDR),
 489                 ("%s: m_flags=%#x\n", __func__, m0->m_flags));
 490
 491         sa = mtod(nam, struct sockaddr_hci *);
 492
 493         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 494
 495         LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
 496
 497                 mtx_lock(&pcb->pcb_mtx);
 498
 499                 /*
 500                  * If socket was bound then check address and
 501                  *  make sure it matches.
 502                  */
 503
 504                 if (pcb->addr.hci_node[0] != 0 &&
 505                     strcmp(sa->hci_node, pcb->addr.hci_node) != 0)
 506                         goto next;
 507
 508                 /*
 509                  * Check packet against filters
 510                  * XXX do we have to call m_pullup() here?
 511                  */
 512
 513                 if (ng_btsocket_hci_raw_filter(pcb, m0, 1) != 0)
 514                         goto next;
 515
 516                 /*
 517                  * Make a copy of the packet, append to the socket's
 518                  * receive queue and wakeup socket. sbappendaddr()
 519                  * will check if socket has enough buffer space.
 520                  */
 521
 522                 m = m_dup(m0, M_DONTWAIT);
 523                 if (m != NULL) {
 524                         struct mbuf     *ctl = NULL;
 525
 526                         ng_btsocket_hci_raw_savctl(pcb, &ctl, m);
 527
 528                         if (sbappendaddr(&pcb->so->so_rcv,
 529                                         (struct sockaddr *) sa, m, ctl))
 530                                 sorwakeup(pcb->so);
 531                         else {
 532                                 NG_BTSOCKET_HCI_RAW_INFO(
 533 "%s: sbappendaddr() failed\n", __func__);
 534
 535                                 NG_FREE_M(m);
 536                                 NG_FREE_M(ctl);
 537                         }
 538                 }
 539 next:
 540                 mtx_unlock(&pcb->pcb_mtx);
 541         }
 542
 543         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 544
 545         NG_FREE_M(nam);
 546         NG_FREE_M(m0);
 547 } /* ng_btsocket_hci_raw_data_input */
 548
 549 /*
 550  * Raw HCI sockets message input routine
 551  */
 552
 553 static void
 554 ng_btsocket_hci_raw_msg_input(struct ng_mesg *msg)
 555 {
 556         ng_btsocket_hci_raw_pcb_p       pcb = NULL;
 557
 558         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 559
 560         LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
 561                 mtx_lock(&pcb->pcb_mtx);
 562
 563                 if (msg->header.token == pcb->token) {
 564                         pcb->msg = msg;
 565                         wakeup(&pcb->msg);
 566
 567                         mtx_unlock(&pcb->pcb_mtx);
 568                         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 569
 570                         return;
 571                 }
 572
 573                 mtx_unlock(&pcb->pcb_mtx);
 574         }
 575
 576         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 577
 578         NG_FREE_MSG(msg); /* checks for != NULL */
 579 } /* ng_btsocket_hci_raw_msg_input */
 580
 581 /*
 582  * Raw HCI sockets input routines
 583  */
 584
 585 static void
 586 ng_btsocket_hci_raw_input(void *context, int pending)
 587 {
 588         item_p  item = NULL;
 589
 590         for (;;) {
 591                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 592                 NG_BT_ITEMQ_DEQUEUE(&ng_btsocket_hci_raw_queue, item);
 593                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 594
 595                 if (item == NULL)
 596                         break;
 597
 598                 switch(item->el_flags & NGQF_TYPE) {
 599                 case NGQF_DATA: {
 600                         struct mbuf     *m = NULL;
 601
 602                         NGI_GET_M(item, m);
 603                         ng_btsocket_hci_raw_data_input(m);
 604                         } break;
 605
 606                 case NGQF_MESG: {
 607                         struct ng_mesg  *msg = NULL;
 608
 609                         NGI_GET_MSG(item, msg);
 610                         ng_btsocket_hci_raw_msg_input(msg);
 611                         } break;
 612
 613                 default:
 614                         KASSERT(0,
 615 ("%s: invalid item type=%ld\n", __func__, (item->el_flags & NGQF_TYPE)));
 616                         break;
 617                 }
 618
 619                 NG_FREE_ITEM(item);
 620         }
 621 } /* ng_btsocket_hci_raw_input */
 622
 623 /*
 624  * Raw HCI sockets output routine
 625  */
 626
 627 static void
 628 ng_btsocket_hci_raw_output(node_p node, hook_p hook, void *arg1, int arg2)
 629 {
 630         struct mbuf             *nam = (struct mbuf *) arg1, *m = NULL;
 631         struct sockaddr_hci     *sa = NULL;
 632         int                      error;
 633
 634         m = nam->m_next;
 635         nam->m_next = NULL;
 636
 637         KASSERT((nam->m_type == MT_SONAME),
 638                 ("%s: m_type=%d\n", __func__, nam->m_type));
 639         KASSERT((m->m_flags & M_PKTHDR),
 640                 ("%s: m_flags=%#x\n", __func__, m->m_flags));
 641
 642         sa = mtod(nam, struct sockaddr_hci *);
 643
 644         /*
 645          * Find downstream hook
 646          * XXX For now access node hook list directly. Should be safe because
 647          * we used ng_send_fn() and we should have exclusive lock on the node.
 648          */
 649
 650         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 651                 if (hook == NULL || NG_HOOK_NOT_VALID(hook) ||
 652                     NG_NODE_NOT_VALID(NG_PEER_NODE(hook)))
 653                         continue;
 654
 655                 if (strcmp(sa->hci_node, NG_PEER_NODE_NAME(hook)) == 0) {
 656                         NG_SEND_DATA_ONLY(error, hook, m); /* sets m to NULL */
 657                         break;
 658                 }
 659         }
 660
 661         NG_FREE_M(nam); /* check for != NULL */
 662         NG_FREE_M(m);
 663 } /* ng_btsocket_hci_raw_output */
 664
 665 /*
 666  * Check frame against security and socket filters.
 667  * d (direction bit) == 1 means incoming frame.
 668  */
 669
 670 static int
 671 ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf *m, int d)
 672 {
 673         int     type, event, opcode;
 674
 675         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 676
 677         switch ((type = *mtod(m, u_int8_t *))) {
 678         case NG_HCI_CMD_PKT:
 679                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)) {
 680                         opcode = le16toh(mtod(m, ng_hci_cmd_pkt_t *)->opcode);
 681
 682                         if (!bit_test(
 683 ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF(opcode) - 1],
 684 NG_HCI_OCF(opcode) - 1))
 685                                 return (EPERM);
 686                 }
 687
 688                 if (d && !bit_test(pcb->filter.packet_mask, NG_HCI_CMD_PKT - 1))
 689                         return (EPERM);
 690                 break;
 691
 692         case NG_HCI_ACL_DATA_PKT:
 693         case NG_HCI_SCO_DATA_PKT:
 694                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED) ||
 695                     !bit_test(pcb->filter.packet_mask, type - 1) ||
 696                     !d)
 697                         return (EPERM);
 698                 break;
 699
 700         case NG_HCI_EVENT_PKT:
 701                 if (!d)
 702                         return (EINVAL);
 703
 704                 event = mtod(m, ng_hci_event_pkt_t *)->event - 1;
 705
 706                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED))
 707                         if (!bit_test(ng_btsocket_hci_raw_sec_filter->events, event))
 708                                 return (EPERM);
 709
 710                 if (!bit_test(pcb->filter.event_mask, event))
 711                         return (EPERM);
 712                 break;
 713
 714         default:
 715                 return (EINVAL);
 716         }
 717
 718         return (0);
 719 } /* ng_btsocket_hci_raw_filter */
 720
 721 /*
 722  * Initialize everything
 723  */
 724
 725 void
 726 ng_btsocket_hci_raw_init(void)
 727 {
 728         bitstr_t        *f = NULL;
 729         int              error = 0;
 730
 731         ng_btsocket_hci_raw_node = NULL;
 732         ng_btsocket_hci_raw_debug_level = NG_BTSOCKET_WARN_LEVEL;
 733         ng_btsocket_hci_raw_ioctl_timeout = 5;
 734
 735         /* Register Netgraph node type */
 736         error = ng_newtype(&typestruct);
 737         if (error != 0) {
 738                 NG_BTSOCKET_HCI_RAW_ALERT(
 739 "%s: Could not register Netgraph node type, error=%d\n", __func__, error);
 740
 741                 return;
 742         }
 743
 744         /* Create Netgrapg node */
 745         error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
 746         if (error != 0) {
 747                 NG_BTSOCKET_HCI_RAW_ALERT(
 748 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
 749
 750                 ng_btsocket_hci_raw_node = NULL;
 751
 752                 return;
 753         }
 754
 755         error = ng_name_node(ng_btsocket_hci_raw_node,
 756                                 NG_BTSOCKET_HCI_RAW_NODE_TYPE);
 757         if (error != 0) {
 758                 NG_BTSOCKET_HCI_RAW_ALERT(
 759 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
 760
 761                 NG_NODE_UNREF(ng_btsocket_hci_raw_node);
 762                 ng_btsocket_hci_raw_node = NULL;
 763
 764                 return;
 765         }
 766
 767         /* Create input queue */
 768         NG_BT_ITEMQ_INIT(&ng_btsocket_hci_raw_queue, 300);
 769         mtx_init(&ng_btsocket_hci_raw_queue_mtx,
 770                 "btsocks_hci_raw_queue_mtx", NULL, MTX_DEF);
 771         TASK_INIT(&ng_btsocket_hci_raw_task, 0,
 772                 ng_btsocket_hci_raw_input, NULL);
 773
 774         /* Create list of sockets */
 775         LIST_INIT(&ng_btsocket_hci_raw_sockets);
 776         mtx_init(&ng_btsocket_hci_raw_sockets_mtx,
 777                 "btsocks_hci_raw_sockets_mtx", NULL, MTX_DEF);
 778
 779         /* Tokens */
 780         ng_btsocket_hci_raw_token = 0;
 781         mtx_init(&ng_btsocket_hci_raw_token_mtx,
 782                 "btsocks_hci_raw_token_mtx", NULL, MTX_DEF);
 783
 784         /*
 785          * Security filter
 786          * XXX never FREE()ed
 787          */
 788
 789         ng_btsocket_hci_raw_sec_filter = NULL;
 790
 791         MALLOC(ng_btsocket_hci_raw_sec_filter,
 792                 struct ng_btsocket_hci_raw_sec_filter *,
 793                 sizeof(struct ng_btsocket_hci_raw_sec_filter),
 794                 M_NETGRAPH_BTSOCKET_HCI_RAW, M_NOWAIT|M_ZERO);
 795         if (ng_btsocket_hci_raw_sec_filter == NULL) {
 796                 printf("%s: Could not allocate security filter!\n", __func__);
 797                 return;
 798         }
 799
 800         /*
 801          * XXX How paranoid can we get?
 802          *
 803          * Initialize security filter. If bit is set in the mask then
 804          * unprivileged socket is allowed to send (receive) this command
 805          * (event).
 806          */
 807
 808         /* Enable all events */
 809         memset(&ng_btsocket_hci_raw_sec_filter->events, 0xff,
 810                 sizeof(ng_btsocket_hci_raw_sec_filter->events)/
 811                         sizeof(ng_btsocket_hci_raw_sec_filter->events[0]));
 812
 813         /* Disable some critical events */
 814         f = ng_btsocket_hci_raw_sec_filter->events;
 815         bit_clear(f, NG_HCI_EVENT_RETURN_LINK_KEYS - 1);
 816         bit_clear(f, NG_HCI_EVENT_LINK_KEY_NOTIFICATION - 1);
 817         bit_clear(f, NG_HCI_EVENT_VENDOR - 1);
 818
 819         /* Commands - Link control */
 820         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_CONTROL-1];
 821         bit_set(f, NG_HCI_OCF_INQUIRY - 1);
 822         bit_set(f, NG_HCI_OCF_INQUIRY_CANCEL - 1);
 823         bit_set(f, NG_HCI_OCF_PERIODIC_INQUIRY - 1);
 824         bit_set(f, NG_HCI_OCF_EXIT_PERIODIC_INQUIRY - 1);
 825         bit_set(f, NG_HCI_OCF_REMOTE_NAME_REQ - 1);
 826         bit_set(f, NG_HCI_OCF_READ_REMOTE_FEATURES - 1);
 827         bit_set(f, NG_HCI_OCF_READ_REMOTE_VER_INFO - 1);
 828         bit_set(f, NG_HCI_OCF_READ_CLOCK_OFFSET - 1);
 829
 830         /* Commands - Link policy */
 831         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_POLICY-1];
 832         bit_set(f, NG_HCI_OCF_ROLE_DISCOVERY - 1);
 833         bit_set(f, NG_HCI_OCF_READ_LINK_POLICY_SETTINGS - 1);
 834
 835         /* Commands - Host controller and baseband */
 836         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_HC_BASEBAND-1];
 837         bit_set(f, NG_HCI_OCF_READ_PIN_TYPE - 1);
 838         bit_set(f, NG_HCI_OCF_READ_LOCAL_NAME - 1);
 839         bit_set(f, NG_HCI_OCF_READ_CON_ACCEPT_TIMO - 1);
 840         bit_set(f, NG_HCI_OCF_READ_PAGE_TIMO - 1);
 841         bit_set(f, NG_HCI_OCF_READ_SCAN_ENABLE - 1);
 842         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_ACTIVITY - 1);
 843         bit_set(f, NG_HCI_OCF_READ_INQUIRY_SCAN_ACTIVITY - 1);
 844         bit_set(f, NG_HCI_OCF_READ_AUTH_ENABLE - 1);
 845         bit_set(f, NG_HCI_OCF_READ_ENCRYPTION_MODE - 1);
 846         bit_set(f, NG_HCI_OCF_READ_UNIT_CLASS - 1);
 847         bit_set(f, NG_HCI_OCF_READ_VOICE_SETTINGS - 1);
 848         bit_set(f, NG_HCI_OCF_READ_AUTO_FLUSH_TIMO - 1);
 849         bit_set(f, NG_HCI_OCF_READ_NUM_BROADCAST_RETRANS - 1);
 850         bit_set(f, NG_HCI_OCF_READ_HOLD_MODE_ACTIVITY - 1);
 851         bit_set(f, NG_HCI_OCF_READ_XMIT_LEVEL - 1);
 852         bit_set(f, NG_HCI_OCF_READ_SCO_FLOW_CONTROL - 1);
 853         bit_set(f, NG_HCI_OCF_READ_LINK_SUPERVISION_TIMO - 1);
 854         bit_set(f, NG_HCI_OCF_READ_SUPPORTED_IAC_NUM - 1);
 855         bit_set(f, NG_HCI_OCF_READ_IAC_LAP - 1);
 856         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_PERIOD - 1);
 857         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN - 1);
 858
 859         /* Commands - Informational */
 860         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_INFO - 1];
 861         bit_set(f, NG_HCI_OCF_READ_LOCAL_VER - 1);
 862         bit_set(f, NG_HCI_OCF_READ_LOCAL_FEATURES - 1);
 863         bit_set(f, NG_HCI_OCF_READ_BUFFER_SIZE - 1);
 864         bit_set(f, NG_HCI_OCF_READ_COUNTRY_CODE - 1);
 865         bit_set(f, NG_HCI_OCF_READ_BDADDR - 1);
 866
 867         /* Commands - Status */
 868         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_STATUS - 1];
 869         bit_set(f, NG_HCI_OCF_READ_FAILED_CONTACT_CNTR - 1);
 870         bit_set(f, NG_HCI_OCF_GET_LINK_QUALITY - 1);
 871         bit_set(f, NG_HCI_OCF_READ_RSSI - 1);
 872
 873         /* Commands - Testing */
 874         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_TESTING - 1];
 875         bit_set(f, NG_HCI_OCF_READ_LOOPBACK_MODE - 1);
 876 } /* ng_btsocket_hci_raw_init */
 877
 878 /*
 879  * Abort connection on socket
 880  */
 881
 882 void
 883 ng_btsocket_hci_raw_abort(struct socket *so)
 884 {
 885 } /* ng_btsocket_hci_raw_abort */
 886
 887 void
 888 ng_btsocket_hci_raw_close(struct socket *so)
 889 {
 890 } /* ng_btsocket_hci_raw_close */
 891
 892 /*
 893  * Create new raw HCI socket
 894  */
 895
 896 int
 897 ng_btsocket_hci_raw_attach(struct socket *so, int proto, struct thread *td)
 898 {
 899         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
 900         int                             error = 0;
 901
 902         if (pcb != NULL)
 903                 return (EISCONN);
 904
 905         if (ng_btsocket_hci_raw_node == NULL)
 906                 return (EPROTONOSUPPORT);
 907         if (proto != BLUETOOTH_PROTO_HCI)
 908                 return (EPROTONOSUPPORT);
 909         if (so->so_type != SOCK_RAW)
 910                 return (ESOCKTNOSUPPORT);
 911
 912         error = soreserve(so, NG_BTSOCKET_HCI_RAW_SENDSPACE,
 913                                 NG_BTSOCKET_HCI_RAW_RECVSPACE);
 914         if (error != 0)
 915                 return (error);
 916
 917         MALLOC(pcb, ng_btsocket_hci_raw_pcb_p, sizeof(*pcb),
 918                 M_NETGRAPH_BTSOCKET_HCI_RAW, M_NOWAIT|M_ZERO);
 919         if (pcb == NULL)
 920                 return (ENOMEM);
 921
 922         so->so_pcb = (caddr_t) pcb;
 923         pcb->so = so;
 924
 925         if (priv_check(td, PRIV_NETBLUETOOTH_RAW) == 0)
 926                 pcb->flags |= NG_BTSOCKET_HCI_RAW_PRIVILEGED;
 927
 928         /*
 929          * Set default socket filter. By default socket only accepts HCI
 930          * Command_Complete and Command_Status event packets.
 931          */
 932
 933         bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_COMPL - 1);
 934         bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_STATUS - 1);
 935
 936         mtx_init(&pcb->pcb_mtx, "btsocks_hci_raw_pcb_mtx", NULL, MTX_DEF);
 937
 938         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 939         LIST_INSERT_HEAD(&ng_btsocket_hci_raw_sockets, pcb, next);
 940         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 941
 942         return (0);
 943 } /* ng_btsocket_hci_raw_attach */
 944
 945 /*
 946  * Bind raw HCI socket
 947  */
 948
 949 int
 950 ng_btsocket_hci_raw_bind(struct socket *so, struct sockaddr *nam,
 951                 struct thread *td)
 952 {
 953         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
 954         struct sockaddr_hci             *sa = (struct sockaddr_hci *) nam;
 955
 956         if (pcb == NULL)
 957                 return (EINVAL);
 958         if (ng_btsocket_hci_raw_node == NULL)
 959                 return (EINVAL);
 960
 961         if (sa == NULL)
 962                 return (EINVAL);
 963         if (sa->hci_family != AF_BLUETOOTH)
 964                 return (EAFNOSUPPORT);
 965         if (sa->hci_len != sizeof(*sa))
 966                 return (EINVAL);
 967         if (sa->hci_node[0] == 0)
 968                 return (EINVAL);
 969
 970         mtx_lock(&pcb->pcb_mtx);
 971         bcopy(sa, &pcb->addr, sizeof(pcb->addr));
 972         mtx_unlock(&pcb->pcb_mtx);
 973
 974         return (0);
 975 } /* ng_btsocket_hci_raw_bind */
 976
 977 /*
 978  * Connect raw HCI socket
 979  */
 980
 981 int
 982 ng_btsocket_hci_raw_connect(struct socket *so, struct sockaddr *nam,
 983                 struct thread *td)
 984 {
 985         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
 986         struct sockaddr_hci             *sa = (struct sockaddr_hci *) nam;
 987
 988         if (pcb == NULL)
 989                 return (EINVAL);
 990         if (ng_btsocket_hci_raw_node == NULL)
 991                 return (EINVAL);
 992
 993         if (sa == NULL)
 994                 return (EINVAL);
 995         if (sa->hci_family != AF_BLUETOOTH)
 996                 return (EAFNOSUPPORT);
 997         if (sa->hci_len != sizeof(*sa))
 998                 return (EINVAL);
 999         if (sa->hci_node[0] == 0)
1000                 return (EDESTADDRREQ);
1001
1002         mtx_lock(&pcb->pcb_mtx);
1003
1004         if (bcmp(sa, &pcb->addr, sizeof(pcb->addr)) != 0) {
1005                 mtx_unlock(&pcb->pcb_mtx);
1006                 return (EADDRNOTAVAIL);
1007         }
1008
1009         soisconnected(so);
1010
1011         mtx_unlock(&pcb->pcb_mtx);
1012
1013         return (0);
1014 } /* ng_btsocket_hci_raw_connect */
1015
1016 /*
1017  * Process ioctl on socket
1018  */
1019
1020 int
1021 ng_btsocket_hci_raw_control(struct socket *so, u_long cmd, caddr_t data,
1022                 struct ifnet *ifp, struct thread *td)
1023 {
1024         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1025         char                             path[NG_NODESIZ + 1];
1026         struct ng_mesg                  *msg = NULL;
1027         int                              error = 0;
1028
1029         if (pcb == NULL)
1030                 return (EINVAL);
1031         if (ng_btsocket_hci_raw_node == NULL)
1032                 return (EINVAL);
1033
1034         mtx_lock(&pcb->pcb_mtx);
1035
1036         /* Check if we have device name */
1037         if (pcb->addr.hci_node[0] == 0) {
1038                 mtx_unlock(&pcb->pcb_mtx);
1039                 return (EHOSTUNREACH);
1040         }
1041
1042         /* Check if we have pending ioctl() */
1043         if (pcb->token != 0) {
1044                 mtx_unlock(&pcb->pcb_mtx);
1045                 return (EBUSY);
1046         }
1047
1048         snprintf(path, sizeof(path), "%s:", pcb->addr.hci_node);
1049
1050         switch (cmd) {
1051         case SIOC_HCI_RAW_NODE_GET_STATE: {
1052                 struct ng_btsocket_hci_raw_node_state   *p =
1053                         (struct ng_btsocket_hci_raw_node_state *) data;
1054
1055                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1056                                 NGM_HCI_NODE_GET_STATE,
1057                                 &p->state, sizeof(p->state));
1058                 } break;
1059
1060         case SIOC_HCI_RAW_NODE_INIT:
1061                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1062                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1063                                         NGM_HCI_NODE_INIT, NULL, 0);
1064                 else
1065                         error = EPERM;
1066                 break;
1067
1068         case SIOC_HCI_RAW_NODE_GET_DEBUG: {
1069                 struct ng_btsocket_hci_raw_node_debug   *p =
1070                         (struct ng_btsocket_hci_raw_node_debug *) data;
1071
1072                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1073                                 NGM_HCI_NODE_GET_DEBUG,
1074                                 &p->debug, sizeof(p->debug));
1075                 } break;
1076
1077         case SIOC_HCI_RAW_NODE_SET_DEBUG: {
1078                 struct ng_btsocket_hci_raw_node_debug   *p =
1079                         (struct ng_btsocket_hci_raw_node_debug *) data;
1080
1081                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1082                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1083                                         NGM_HCI_NODE_SET_DEBUG, &p->debug,
1084                                         sizeof(p->debug));
1085                 else
1086                         error = EPERM;
1087                 } break;
1088
1089         case SIOC_HCI_RAW_NODE_GET_BUFFER: {
1090                 struct ng_btsocket_hci_raw_node_buffer  *p =
1091                         (struct ng_btsocket_hci_raw_node_buffer *) data;
1092
1093                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1094                                 NGM_HCI_NODE_GET_BUFFER,
1095                                 &p->buffer, sizeof(p->buffer));
1096                 } break;
1097
1098         case SIOC_HCI_RAW_NODE_GET_BDADDR: {
1099                 struct ng_btsocket_hci_raw_node_bdaddr  *p =
1100                         (struct ng_btsocket_hci_raw_node_bdaddr *) data;
1101
1102                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1103                                 NGM_HCI_NODE_GET_BDADDR,
1104                                 &p->bdaddr, sizeof(p->bdaddr));
1105                 } break;
1106
1107         case SIOC_HCI_RAW_NODE_GET_FEATURES: {
1108                 struct ng_btsocket_hci_raw_node_features        *p =
1109                         (struct ng_btsocket_hci_raw_node_features *) data;
1110
1111                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1112                                 NGM_HCI_NODE_GET_FEATURES,
1113                                 &p->features, sizeof(p->features));
1114                 } break;
1115
1116         case SIOC_HCI_RAW_NODE_GET_STAT: {
1117                 struct ng_btsocket_hci_raw_node_stat    *p =
1118                         (struct ng_btsocket_hci_raw_node_stat *) data;
1119
1120                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1121                                 NGM_HCI_NODE_GET_STAT,
1122                                 &p->stat, sizeof(p->stat));
1123                 } break;
1124
1125         case SIOC_HCI_RAW_NODE_RESET_STAT:
1126                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1127                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1128                                         NGM_HCI_NODE_RESET_STAT, NULL, 0);
1129                 else
1130                         error = EPERM;
1131                 break;
1132
1133         case SIOC_HCI_RAW_NODE_FLUSH_NEIGHBOR_CACHE:
1134                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1135                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1136                                         NGM_HCI_NODE_FLUSH_NEIGHBOR_CACHE,
1137                                         NULL, 0);
1138                 else
1139                         error = EPERM;
1140                 break;
1141
1142         case SIOC_HCI_RAW_NODE_GET_NEIGHBOR_CACHE:  {
1143                 struct ng_btsocket_hci_raw_node_neighbor_cache  *p =
1144                         (struct ng_btsocket_hci_raw_node_neighbor_cache *) data;
1145                 ng_hci_node_get_neighbor_cache_ep               *p1 = NULL;
1146                 ng_hci_node_neighbor_cache_entry_ep             *p2 = NULL;
1147
1148                 if (p->num_entries <= 0 ||
1149                     p->num_entries > NG_HCI_MAX_NEIGHBOR_NUM ||
1150                     p->entries == NULL) {
1151                         error = EINVAL;
1152                         break;
1153                 }
1154
1155                 NG_MKMESSAGE(msg, NGM_HCI_COOKIE,
1156                         NGM_HCI_NODE_GET_NEIGHBOR_CACHE, 0, M_NOWAIT);
1157                 if (msg == NULL) {
1158                         error = ENOMEM;
1159                         break;
1160                 }
1161                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1162                 pcb->token = msg->header.token;
1163                 pcb->msg = NULL;
1164
1165                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1166                 if (error != 0) {
1167                         pcb->token = 0;
1168                         break;
1169                 }
1170
1171                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1172                                 PZERO|PCATCH, "hcictl",
1173                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1174                 pcb->token = 0;
1175
1176                 if (error != 0)
1177                         break;
1178
1179                 if (pcb->msg != NULL &&
1180                     pcb->msg->header.cmd == NGM_HCI_NODE_GET_NEIGHBOR_CACHE) {
1181                         /* Return data back to user space */
1182                         p1 = (ng_hci_node_get_neighbor_cache_ep *)
1183                                 (pcb->msg->data);
1184                         p2 = (ng_hci_node_neighbor_cache_entry_ep *)
1185                                 (p1 + 1);
1186
1187                         p->num_entries = min(p->num_entries, p1->num_entries);
1188                         if (p->num_entries > 0)
1189                                 error = copyout((caddr_t) p2,
1190                                                 (caddr_t) p->entries,
1191                                                 p->num_entries * sizeof(*p2));
1192                 } else
1193                         error = EINVAL;
1194
1195                 NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1196                 }break;
1197
1198         case SIOC_HCI_RAW_NODE_GET_CON_LIST: {
1199                 struct ng_btsocket_hci_raw_con_list     *p =
1200                         (struct ng_btsocket_hci_raw_con_list *) data;
1201                 ng_hci_node_con_list_ep                 *p1 = NULL;
1202                 ng_hci_node_con_ep                      *p2 = NULL;
1203
1204                 if (p->num_connections == 0 ||
1205                     p->num_connections > NG_HCI_MAX_CON_NUM ||
1206                     p->connections == NULL) {
1207                         error = EINVAL;
1208                         break;
1209                 }
1210
1211                 NG_MKMESSAGE(msg, NGM_HCI_COOKIE, NGM_HCI_NODE_GET_CON_LIST,
1212                         0, M_NOWAIT);
1213                 if (msg == NULL) {
1214                         error = ENOMEM;
1215                         break;
1216                 }
1217                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1218                 pcb->token = msg->header.token;
1219                 pcb->msg = NULL;
1220
1221                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1222                 if (error != 0) {
1223                         pcb->token = 0;
1224                         break;
1225                 }
1226
1227                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1228                                 PZERO|PCATCH, "hcictl",
1229                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1230                 pcb->token = 0;
1231
1232                 if (error != 0)
1233                         break;
1234
1235                 if (pcb->msg != NULL &&
1236                     pcb->msg->header.cmd == NGM_HCI_NODE_GET_CON_LIST) {
1237                         /* Return data back to user space */
1238                         p1 = (ng_hci_node_con_list_ep *)(pcb->msg->data);
1239                         p2 = (ng_hci_node_con_ep *)(p1 + 1);
1240
1241                         p->num_connections = min(p->num_connections,
1242                                                 p1->num_connections);
1243                         if (p->num_connections > 0)
1244                                 error = copyout((caddr_t) p2,
1245                                         (caddr_t) p->connections,
1246                                         p->num_connections * sizeof(*p2));
1247                 } else
1248                         error = EINVAL;
1249
1250                 NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1251                 } break;
1252
1253         case SIOC_HCI_RAW_NODE_GET_LINK_POLICY_MASK: {
1254                 struct ng_btsocket_hci_raw_node_link_policy_mask        *p =
1255                         (struct ng_btsocket_hci_raw_node_link_policy_mask *)
1256                                 data;
1257
1258                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1259                                 NGM_HCI_NODE_GET_LINK_POLICY_SETTINGS_MASK,
1260                                 &p->policy_mask, sizeof(p->policy_mask));
1261                 } break;
1262
1263         case SIOC_HCI_RAW_NODE_SET_LINK_POLICY_MASK: {
1264                 struct ng_btsocket_hci_raw_node_link_policy_mask        *p =
1265                         (struct ng_btsocket_hci_raw_node_link_policy_mask *)
1266                                 data;
1267
1268                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1269                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1270                                         NGM_HCI_NODE_SET_LINK_POLICY_SETTINGS_MASK,
1271                                         &p->policy_mask,
1272                                         sizeof(p->policy_mask));
1273                 else
1274                         error = EPERM;
1275                 } break;
1276
1277         case SIOC_HCI_RAW_NODE_GET_PACKET_MASK: {
1278                 struct ng_btsocket_hci_raw_node_packet_mask     *p =
1279                         (struct ng_btsocket_hci_raw_node_packet_mask *) data;
1280
1281                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1282                                 NGM_HCI_NODE_GET_PACKET_MASK,
1283                                 &p->packet_mask, sizeof(p->packet_mask));
1284                 } break;
1285
1286         case SIOC_HCI_RAW_NODE_SET_PACKET_MASK: {
1287                 struct ng_btsocket_hci_raw_node_packet_mask     *p =
1288                         (struct ng_btsocket_hci_raw_node_packet_mask *) data;
1289
1290                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1291                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1292                                         NGM_HCI_NODE_SET_PACKET_MASK,
1293                                         &p->packet_mask,
1294                                         sizeof(p->packet_mask));
1295                 else
1296                         error = EPERM;
1297                 } break;
1298
1299         case SIOC_HCI_RAW_NODE_GET_ROLE_SWITCH: {
1300                 struct ng_btsocket_hci_raw_node_role_switch     *p =
1301                         (struct ng_btsocket_hci_raw_node_role_switch *) data;
1302
1303                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1304                                 NGM_HCI_NODE_GET_ROLE_SWITCH,
1305                                 &p->role_switch, sizeof(p->role_switch));
1306                 } break;
1307
1308         case SIOC_HCI_RAW_NODE_SET_ROLE_SWITCH: {
1309                 struct ng_btsocket_hci_raw_node_role_switch     *p =
1310                         (struct ng_btsocket_hci_raw_node_role_switch *) data;
1311
1312                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1313                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1314                                         NGM_HCI_NODE_SET_ROLE_SWITCH,
1315                                         &p->role_switch,
1316                                         sizeof(p->role_switch));
1317                 else
1318                         error = EPERM;
1319                 } break;
1320
1321         case SIOC_HCI_RAW_NODE_LIST_NAMES: {
1322                 struct ng_btsocket_hci_raw_node_list_names      *nl =
1323                         (struct ng_btsocket_hci_raw_node_list_names *) data;
1324                 struct nodeinfo                                 *ni = nl->names;
1325
1326                 if (nl->num_names == 0) {
1327                         error = EINVAL;
1328                         break;
1329                 }
1330
1331                 NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_LISTNAMES,
1332                         0, M_NOWAIT);
1333                 if (msg == NULL) {
1334                         error = ENOMEM;
1335                         break;
1336                 }
1337                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1338                 pcb->token = msg->header.token;
1339                 pcb->msg = NULL;
1340
1341                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, ".:", 0);
1342                 if (error != 0) {
1343                         pcb->token = 0;
1344                         break;
1345                 }
1346
1347                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1348                                 PZERO|PCATCH, "hcictl",
1349                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1350                 pcb->token = 0;
1351
1352                 if (error != 0)
1353                         break;
1354
1355                 if (pcb->msg != NULL && pcb->msg->header.cmd == NGM_LISTNAMES) {
1356                         /* Return data back to user space */
1357                         struct namelist *nl1 = (struct namelist *) pcb->msg->data;
1358                         struct nodeinfo *ni1 = &nl1->nodeinfo[0];
1359
1360                         while (nl->num_names > 0 && nl1->numnames > 0) {
1361                                 if (strcmp(ni1->type, NG_HCI_NODE_TYPE) == 0) {
1362                                         error = copyout((caddr_t) ni1,
1363                                                         (caddr_t) ni,
1364                                                         sizeof(*ni));
1365                                         if (error != 0)
1366                                                 break;
1367
1368                                         nl->num_names --;
1369                                         ni ++;
1370                                 }
1371
1372                                 nl1->numnames --;
1373                                 ni1 ++;
1374                         }
1375
1376                         nl->num_names = ni - nl->names;
1377                 } else
1378                         error = EINVAL;
1379
1380                 NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1381                 } break;
1382
1383         default:
1384                 error = EINVAL;
1385                 break;
1386         }
1387
1388         mtx_unlock(&pcb->pcb_mtx);
1389
1390         return (error);
1391 } /* ng_btsocket_hci_raw_control */
1392
1393 /*
1394  * Process getsockopt/setsockopt system calls
1395  */
1396
1397 int
1398 ng_btsocket_hci_raw_ctloutput(struct socket *so, struct sockopt *sopt)
1399 {
1400         ng_btsocket_hci_raw_pcb_p               pcb = so2hci_raw_pcb(so);
1401         struct ng_btsocket_hci_raw_filter       filter;
1402         int                                     error = 0, dir;
1403
1404         if (pcb == NULL)
1405                 return (EINVAL);
1406         if (ng_btsocket_hci_raw_node == NULL)
1407                 return (EINVAL);
1408
1409         if (sopt->sopt_level != SOL_HCI_RAW)
1410                 return (0);
1411
1412         mtx_lock(&pcb->pcb_mtx);
1413
1414         switch (sopt->sopt_dir) {
1415         case SOPT_GET:
1416                 switch (sopt->sopt_name) {
1417                 case SO_HCI_RAW_FILTER:
1418                         error = sooptcopyout(sopt, &pcb->filter,
1419                                                 sizeof(pcb->filter));
1420                         break;
1421
1422                 case SO_HCI_RAW_DIRECTION:
1423                         dir = (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION)?1:0;
1424                         error = sooptcopyout(sopt, &dir, sizeof(dir));
1425                         break;
1426
1427                 default:
1428                         error = EINVAL;
1429                         break;
1430                 }
1431                 break;
1432
1433         case SOPT_SET:
1434                 switch (sopt->sopt_name) {
1435                 case SO_HCI_RAW_FILTER:
1436                         error = sooptcopyin(sopt, &filter, sizeof(filter),
1437                                                 sizeof(filter));
1438                         if (error == 0)
1439                                 bcopy(&filter, &pcb->filter,
1440                                                 sizeof(pcb->filter));
1441                         break;
1442
1443                 case SO_HCI_RAW_DIRECTION:
1444                         error = sooptcopyin(sopt, &dir, sizeof(dir),
1445                                                 sizeof(dir));
1446                         if (error != 0)
1447                                 break;
1448
1449                         if (dir)
1450                                 pcb->flags |= NG_BTSOCKET_HCI_RAW_DIRECTION;
1451                         else
1452                                 pcb->flags &= ~NG_BTSOCKET_HCI_RAW_DIRECTION;
1453                         break;
1454
1455                 default:
1456                         error = EINVAL;
1457                         break;
1458                 }
1459                 break;
1460
1461         default:
1462                 error = EINVAL;
1463                 break;
1464         }
1465
1466         mtx_unlock(&pcb->pcb_mtx);
1467
1468         return (error);
1469 } /* ng_btsocket_hci_raw_ctloutput */
1470
1471 /*
1472  * Detach raw HCI socket
1473  */
1474
1475 void
1476 ng_btsocket_hci_raw_detach(struct socket *so)
1477 {
1478         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
1479
1480         KASSERT(pcb != NULL, ("ng_btsocket_hci_raw_detach: pcb == NULL"));
1481
1482         if (ng_btsocket_hci_raw_node == NULL)
1483                 return;
1484
1485         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
1486         mtx_lock(&pcb->pcb_mtx);
1487
1488         LIST_REMOVE(pcb, next);
1489
1490         mtx_unlock(&pcb->pcb_mtx);
1491         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
1492
1493         mtx_destroy(&pcb->pcb_mtx);
1494
1495         bzero(pcb, sizeof(*pcb));
1496         FREE(pcb, M_NETGRAPH_BTSOCKET_HCI_RAW);
1497
1498         so->so_pcb = NULL;
1499 } /* ng_btsocket_hci_raw_detach */
1500
1501 /*
1502  * Disconnect raw HCI socket
1503  */
1504
1505 int
1506 ng_btsocket_hci_raw_disconnect(struct socket *so)
1507 {
1508         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1509
1510         if (pcb == NULL)
1511                 return (EINVAL);
1512         if (ng_btsocket_hci_raw_node == NULL)
1513                 return (EINVAL);
1514
1515         mtx_lock(&pcb->pcb_mtx);
1516         soisdisconnected(so);
1517         mtx_unlock(&pcb->pcb_mtx);
1518
1519         return (0);
1520 } /* ng_btsocket_hci_raw_disconnect */
1521
1522 /*
1523  * Get socket peer's address
1524  */
1525
1526 int
1527 ng_btsocket_hci_raw_peeraddr(struct socket *so, struct sockaddr **nam)
1528 {
1529         return (ng_btsocket_hci_raw_sockaddr(so, nam));
1530 } /* ng_btsocket_hci_raw_peeraddr */
1531
1532 /*
1533  * Send data
1534  */
1535
1536 int
1537 ng_btsocket_hci_raw_send(struct socket *so, int flags, struct mbuf *m,
1538                 struct sockaddr *sa, struct mbuf *control, struct thread *td)
1539 {
1540         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1541         struct mbuf                     *nam = NULL;
1542         int                              error = 0;
1543
1544         if (ng_btsocket_hci_raw_node == NULL) {
1545                 error = ENETDOWN;
1546                 goto drop;
1547         }
1548         if (pcb == NULL) {
1549                 error = EINVAL;
1550                 goto drop;
1551         }
1552         if (control != NULL) {
1553                 error = EINVAL;
1554                 goto drop;
1555         }
1556
1557         if (m->m_pkthdr.len < sizeof(ng_hci_cmd_pkt_t) ||
1558             m->m_pkthdr.len > sizeof(ng_hci_cmd_pkt_t) + NG_HCI_CMD_PKT_SIZE) {
1559                 error = EMSGSIZE;
1560                 goto drop;
1561         }
1562
1563         if (m->m_len < sizeof(ng_hci_cmd_pkt_t)) {
1564                 if ((m = m_pullup(m, sizeof(ng_hci_cmd_pkt_t))) == NULL) {
1565                         error = ENOBUFS;
1566                         goto drop;
1567                 }
1568         }
1569         if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
1570                 error = ENOTSUP;
1571                 goto drop;
1572         }
1573
1574         mtx_lock(&pcb->pcb_mtx);
1575
1576         error = ng_btsocket_hci_raw_filter(pcb, m, 0);
1577         if (error != 0) {
1578                 mtx_unlock(&pcb->pcb_mtx);
1579                 goto drop;
1580         }
1581
1582         if (sa == NULL) {
1583                 if (pcb->addr.hci_node[0] == 0) {
1584                         mtx_unlock(&pcb->pcb_mtx);
1585                         error = EDESTADDRREQ;
1586                         goto drop;
1587                 }
1588
1589                 sa = (struct sockaddr *) &pcb->addr;
1590         }
1591
1592         MGET(nam, M_DONTWAIT, MT_SONAME);
1593         if (nam == NULL) {
1594                 mtx_unlock(&pcb->pcb_mtx);
1595                 error = ENOBUFS;
1596                 goto drop;
1597         }
1598
1599         nam->m_len = sizeof(struct sockaddr_hci);
1600         bcopy(sa,mtod(nam, struct sockaddr_hci *),sizeof(struct sockaddr_hci));
1601
1602         nam->m_next = m;
1603         m = NULL;
1604
1605         mtx_unlock(&pcb->pcb_mtx);
1606
1607         return (ng_send_fn(ng_btsocket_hci_raw_node, NULL,
1608                                 ng_btsocket_hci_raw_output, nam, 0));
1609 drop:
1610         NG_FREE_M(control); /* NG_FREE_M checks for != NULL */
1611         NG_FREE_M(nam);
1612         NG_FREE_M(m);
1613
1614         return (error);
1615 } /* ng_btsocket_hci_raw_send */
1616
1617 /*
1618  * Get socket address
1619  */
1620
1621 int
1622 ng_btsocket_hci_raw_sockaddr(struct socket *so, struct sockaddr **nam)
1623 {
1624         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
1625         struct sockaddr_hci             sa;
1626
1627         if (pcb == NULL)
1628                 return (EINVAL);
1629         if (ng_btsocket_hci_raw_node == NULL)
1630                 return (EINVAL);
1631
1632         bzero(&sa, sizeof(sa));
1633         sa.hci_len = sizeof(sa);
1634         sa.hci_family = AF_BLUETOOTH;
1635
1636         mtx_lock(&pcb->pcb_mtx);
1637         strlcpy(sa.hci_node, pcb->addr.hci_node, sizeof(sa.hci_node));
1638         mtx_unlock(&pcb->pcb_mtx);
1639
1640         *nam = sodupsockaddr((struct sockaddr *) &sa, M_NOWAIT);
1641
1642         return ((*nam == NULL)? ENOMEM : 0);
1643 } /* ng_btsocket_hci_raw_sockaddr */
1644