sys/netgraph7/bluetooth/socket/ng_btsocket_hci_raw.c

   1 /*
   2  * ng_btsocket_hci_raw.c
   3  */
   4
   5 /*-
   6  * Copyright (c) 2001-2002 Maksim Yevmenkin <m_evmenkin@yahoo.com>
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  *
  30  * $Id: ng_btsocket_hci_raw.c,v 1.14 2003/09/14 23:29:06 max Exp $
  31  * $FreeBSD: src/sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c,v 1.23 2006/11/06 13:42:04 rwatson Exp $
  32  */
  33
  34 #include <sys/param.h>
  35 #include <sys/systm.h>
  36 #include <sys/bitstring.h>
  37 #include <sys/domain.h>
  38 #include <sys/endian.h>
  39 #include <sys/errno.h>
  40 #include <sys/filedesc.h>
  41 #include <sys/kernel.h>
  42 #include <sys/lock.h>
  43 #include <sys/malloc.h>
  44 #include <sys/mbuf.h>
  45 #include <sys/mutex.h>
  46 #include <sys/priv.h>
  47 #include <sys/protosw.h>
  48 #include <sys/queue.h>
  49 #include <sys/socket.h>
  50 #include <sys/socketvar.h>
  51 #include <sys/sysctl.h>
  52 #include <sys/taskqueue.h>
  53 #include "ng_message.h"
  54 #include "netgraph.h"
  55 #include "bluetooth/include/ng_bluetooth.h"
  56 #include "bluetooth/include/ng_hci.h"
  57 #include "bluetooth/include/ng_l2cap.h"
  58 #include "bluetooth/include/ng_btsocket.h"
  59 #include "bluetooth/include/ng_btsocket_hci_raw.h"
  60
  61 /* MALLOC define */
  62 #ifdef NG_SEPARATE_MALLOC
  63 MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_HCI_RAW, "netgraph_btsocks_hci_raw",
  64         "Netgraph Bluetooth raw HCI sockets");
  65 #else
  66 #define M_NETGRAPH_BTSOCKET_HCI_RAW M_NETGRAPH
  67 #endif /* NG_SEPARATE_MALLOC */
  68
  69 /* Netgraph node methods */
  70 static ng_constructor_t ng_btsocket_hci_raw_node_constructor;
  71 static ng_rcvmsg_t      ng_btsocket_hci_raw_node_rcvmsg;
  72 static ng_shutdown_t    ng_btsocket_hci_raw_node_shutdown;
  73 static ng_newhook_t     ng_btsocket_hci_raw_node_newhook;
  74 static ng_connect_t     ng_btsocket_hci_raw_node_connect;
  75 static ng_rcvdata_t     ng_btsocket_hci_raw_node_rcvdata;
  76 static ng_disconnect_t  ng_btsocket_hci_raw_node_disconnect;
  77
  78 static void             ng_btsocket_hci_raw_input (void *, int);
  79 static void             ng_btsocket_hci_raw_output(node_p, hook_p, void *, int);
  80 static void             ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p,
  81                                                    struct mbuf **,
  82                                                    struct mbuf *);
  83 static int              ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p,
  84                                                    struct mbuf *, int);
  85
  86 #define ng_btsocket_hci_raw_wakeup_input_task() \
  87         taskqueue_enqueue(taskqueue_swi, &ng_btsocket_hci_raw_task)
  88
  89 /* Security filter */
  90 struct ng_btsocket_hci_raw_sec_filter {
  91         bitstr_t        bit_decl(events, 0xff);
  92         bitstr_t        bit_decl(commands[0x3f], 0x3ff);
  93 };
  94
  95 /* Netgraph type descriptor */
  96 static struct ng_type typestruct = {
  97         .version =      NG_ABI_VERSION,
  98         .name =         NG_BTSOCKET_HCI_RAW_NODE_TYPE,
  99         .constructor =  ng_btsocket_hci_raw_node_constructor,
 100         .rcvmsg =       ng_btsocket_hci_raw_node_rcvmsg,
 101         .shutdown =     ng_btsocket_hci_raw_node_shutdown,
 102         .newhook =      ng_btsocket_hci_raw_node_newhook,
 103         .connect =      ng_btsocket_hci_raw_node_connect,
 104         .rcvdata =      ng_btsocket_hci_raw_node_rcvdata,
 105         .disconnect =   ng_btsocket_hci_raw_node_disconnect,
 106 };
 107
 108 /* Globals */
 109 extern int                                      ifqmaxlen;
 110 static u_int32_t                                ng_btsocket_hci_raw_debug_level;
 111 static u_int32_t                                ng_btsocket_hci_raw_ioctl_timeout;
 112 static node_p                                   ng_btsocket_hci_raw_node;
 113 static struct ng_bt_itemq                       ng_btsocket_hci_raw_queue;
 114 static struct mtx                               ng_btsocket_hci_raw_queue_mtx;
 115 static struct task                              ng_btsocket_hci_raw_task;
 116 static LIST_HEAD(, ng_btsocket_hci_raw_pcb)     ng_btsocket_hci_raw_sockets;
 117 static struct mtx                               ng_btsocket_hci_raw_sockets_mtx;
 118 static u_int32_t                                ng_btsocket_hci_raw_token;
 119 static struct mtx                               ng_btsocket_hci_raw_token_mtx;
 120 static struct ng_btsocket_hci_raw_sec_filter    *ng_btsocket_hci_raw_sec_filter;
 121
 122 /* Sysctl tree */
 123 SYSCTL_DECL(_net_bluetooth_hci_sockets);
 124 SYSCTL_NODE(_net_bluetooth_hci_sockets, OID_AUTO, raw, CTLFLAG_RW,
 125         0, "Bluetooth raw HCI sockets family");
 126 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, debug_level, CTLFLAG_RW,
 127         &ng_btsocket_hci_raw_debug_level, NG_BTSOCKET_WARN_LEVEL,
 128         "Bluetooth raw HCI sockets debug level");
 129 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, ioctl_timeout, CTLFLAG_RW,
 130         &ng_btsocket_hci_raw_ioctl_timeout, 5,
 131         "Bluetooth raw HCI sockets ioctl timeout");
 132 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_len, CTLFLAG_RD,
 133         &ng_btsocket_hci_raw_queue.len, 0,
 134         "Bluetooth raw HCI sockets input queue length");
 135 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_maxlen, CTLFLAG_RD,
 136         &ng_btsocket_hci_raw_queue.maxlen, 0,
 137         "Bluetooth raw HCI sockets input queue max. length");
 138 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_drops, CTLFLAG_RD,
 139         &ng_btsocket_hci_raw_queue.drops, 0,
 140         "Bluetooth raw HCI sockets input queue drops");
 141
 142 /* Debug */
 143 #define NG_BTSOCKET_HCI_RAW_INFO \
 144         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_INFO_LEVEL) \
 145                 kprintf
 146
 147 #define NG_BTSOCKET_HCI_RAW_WARN \
 148         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_WARN_LEVEL) \
 149                 kprintf
 150
 151 #define NG_BTSOCKET_HCI_RAW_ERR \
 152         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ERR_LEVEL) \
 153                 kprintf
 154
 155 #define NG_BTSOCKET_HCI_RAW_ALERT \
 156         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ALERT_LEVEL) \
 157                 kprintf
 158
 159 /****************************************************************************
 160  ****************************************************************************
 161  **                          Netgraph specific
 162  ****************************************************************************
 163  ****************************************************************************/
 164
 165 /*
 166  * Netgraph node constructor. Do not allow to create node of this type.
 167  */
 168
 169 static int
 170 ng_btsocket_hci_raw_node_constructor(node_p node)
 171 {
 172         return (EINVAL);
 173 } /* ng_btsocket_hci_raw_node_constructor */
 174
 175 /*
 176  * Netgraph node destructor. Just let old node go and create new fresh one.
 177  */
 178
 179 static int
 180 ng_btsocket_hci_raw_node_shutdown(node_p node)
 181 {
 182         int     error = 0;
 183
 184         NG_NODE_UNREF(node);
 185
 186         error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
 187         if (error  != 0) {
 188                 NG_BTSOCKET_HCI_RAW_ALERT(
 189 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
 190
 191                 ng_btsocket_hci_raw_node = NULL;
 192
 193                 return (ENOMEM);
 194         }
 195
 196         error = ng_name_node(ng_btsocket_hci_raw_node,
 197                                 NG_BTSOCKET_HCI_RAW_NODE_TYPE);
 198         if (error != 0) {
 199                 NG_BTSOCKET_HCI_RAW_ALERT(
 200 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
 201
 202                 NG_NODE_UNREF(ng_btsocket_hci_raw_node);
 203                 ng_btsocket_hci_raw_node = NULL;
 204
 205                 return (EINVAL);
 206         }
 207
 208         return (0);
 209 } /* ng_btsocket_hci_raw_node_shutdown */
 210
 211 /*
 212  * Create new hook. Just say "yes"
 213  */
 214
 215 static int
 216 ng_btsocket_hci_raw_node_newhook(node_p node, hook_p hook, char const *name)
 217 {
 218         return (0);
 219 } /* ng_btsocket_hci_raw_node_newhook */
 220
 221 /*
 222  * Connect hook. Just say "yes"
 223  */
 224
 225 static int
 226 ng_btsocket_hci_raw_node_connect(hook_p hook)
 227 {
 228         return (0);
 229 } /* ng_btsocket_hci_raw_node_connect */
 230
 231 /*
 232  * Disconnect hook
 233  */
 234
 235 static int
 236 ng_btsocket_hci_raw_node_disconnect(hook_p hook)
 237 {
 238         return (0);
 239 } /* ng_btsocket_hci_raw_node_disconnect */
 240
 241 /*
 242  * Receive control message.
 243  * Make sure it is a message from HCI node and it is a response.
 244  * Enqueue item and schedule input task.
 245  */
 246
 247 static int
 248 ng_btsocket_hci_raw_node_rcvmsg(node_p node, item_p item, hook_p lasthook)
 249 {
 250         struct ng_mesg  *msg = NGI_MSG(item); /* item still has message */
 251         int              error = 0;
 252
 253         /*
 254          * Check for empty sockets list creates LOR when both sender and
 255          * receiver device are connected to the same host, so remove it
 256          * for now
 257          */
 258
 259         if (msg != NULL &&
 260             (msg->header.typecookie == NGM_HCI_COOKIE ||
 261              msg->header.typecookie == NGM_GENERIC_COOKIE) &&
 262             msg->header.flags & NGF_RESP) {
 263                 if (msg->header.token == 0) {
 264                         NG_FREE_ITEM(item);
 265                         return (0);
 266                 }
 267
 268                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 269                 if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
 270                         NG_BTSOCKET_HCI_RAW_ERR(
 271 "%s: Input queue is full\n", __func__);
 272
 273                         NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
 274                         NG_FREE_ITEM(item);
 275                         error = ENOBUFS;
 276                 } else {
 277                         NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
 278                         error = ng_btsocket_hci_raw_wakeup_input_task();
 279                 }
 280                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 281         } else {
 282                 NG_FREE_ITEM(item);
 283                 error = EINVAL;
 284         }
 285
 286         return (error);
 287 } /* ng_btsocket_hci_raw_node_rcvmsg */
 288
 289 /*
 290  * Receive packet from the one of our hook.
 291  * Prepend every packet with sockaddr_hci and record sender's node name.
 292  * Enqueue item and schedule input task.
 293  */
 294
 295 static int
 296 ng_btsocket_hci_raw_node_rcvdata(hook_p hook, item_p item)
 297 {
 298         struct mbuf     *nam = NULL;
 299         int              error;
 300
 301         /*
 302          * Check for empty sockets list creates LOR when both sender and
 303          * receiver device are connected to the same host, so remove it
 304          * for now
 305          */
 306
 307         MGET(nam, MB_DONTWAIT, MT_SONAME);
 308         if (nam != NULL) {
 309                 struct sockaddr_hci     *sa = mtod(nam, struct sockaddr_hci *);
 310
 311                 nam->m_len = sizeof(struct sockaddr_hci);
 312
 313                 sa->hci_len = sizeof(*sa);
 314                 sa->hci_family = AF_BLUETOOTH;
 315                 strlcpy(sa->hci_node, NG_PEER_NODE_NAME(hook),
 316                         sizeof(sa->hci_node));
 317
 318                 NGI_GET_M(item, nam->m_next);
 319                 NGI_M(item) = nam;
 320
 321                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 322                 if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
 323                         NG_BTSOCKET_HCI_RAW_ERR(
 324 "%s: Input queue is full\n", __func__);
 325
 326                         NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
 327                         NG_FREE_ITEM(item);
 328                         error = ENOBUFS;
 329                 } else {
 330                         NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
 331                         error = ng_btsocket_hci_raw_wakeup_input_task();
 332                 }
 333                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 334         } else {
 335                 NG_BTSOCKET_HCI_RAW_ERR(
 336 "%s: Failed to allocate address mbuf\n", __func__);
 337
 338                 NG_FREE_ITEM(item);
 339                 error = ENOBUFS;
 340         }
 341
 342         return (error);
 343 } /* ng_btsocket_hci_raw_node_rcvdata */
 344
 345 /****************************************************************************
 346  ****************************************************************************
 347  **                              Sockets specific
 348  ****************************************************************************
 349  ****************************************************************************/
 350
 351 /*
 352  * Get next token. We need token to avoid theoretical race where process
 353  * submits ioctl() message then interrupts ioctl() and re-submits another
 354  * ioctl() on the same socket *before* first ioctl() complete.
 355  */
 356
 357 static void
 358 ng_btsocket_hci_raw_get_token(u_int32_t *token)
 359 {
 360         mtx_lock(&ng_btsocket_hci_raw_token_mtx);
 361
 362         if (++ ng_btsocket_hci_raw_token == 0)
 363                 ng_btsocket_hci_raw_token = 1;
 364
 365         *token = ng_btsocket_hci_raw_token;
 366
 367         mtx_unlock(&ng_btsocket_hci_raw_token_mtx);
 368 } /* ng_btsocket_hci_raw_get_token */
 369
 370 /*
 371  * Send Netgraph message to the node - do not expect reply
 372  */
 373
 374 static int
 375 ng_btsocket_hci_raw_send_ngmsg(char *path, int cmd, void *arg, int arglen)
 376 {
 377         struct ng_mesg  *msg = NULL;
 378         int              error = 0;
 379
 380         NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, arglen, M_WAITOK | M_NULLOK);
 381         if (msg == NULL)
 382                 return (ENOMEM);
 383
 384         if (arg != NULL && arglen > 0)
 385                 bcopy(arg, msg->data, arglen);
 386
 387         NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
 388
 389         return (error);
 390 } /* ng_btsocket_hci_raw_send_ngmsg */
 391
 392 /*
 393  * Send Netgraph message to the node (no data) and wait for reply
 394  */
 395
 396 static int
 397 ng_btsocket_hci_raw_send_sync_ngmsg(ng_btsocket_hci_raw_pcb_p pcb, char *path,
 398                 int cmd, void *rsp, int rsplen)
 399 {
 400         struct ng_mesg  *msg = NULL;
 401         int              error = 0;
 402
 403         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 404
 405         NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, 0, M_WAITOK | M_NULLOK);
 406         if (msg == NULL)
 407                 return (ENOMEM);
 408
 409         ng_btsocket_hci_raw_get_token(&msg->header.token);
 410         pcb->token = msg->header.token;
 411         pcb->msg = NULL;
 412
 413         NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
 414         if (error != 0) {
 415                 pcb->token = 0;
 416                 return (error);
 417         }
 418
 419         error = msleep(&pcb->msg, &pcb->pcb_mtx, PZERO|PCATCH, "hcictl",
 420                         ng_btsocket_hci_raw_ioctl_timeout * hz);
 421         pcb->token = 0;
 422
 423         if (error != 0)
 424                 return (error);
 425
 426         if (pcb->msg != NULL && pcb->msg->header.cmd == cmd)
 427                 bcopy(pcb->msg->data, rsp, rsplen);
 428         else
 429                 error = EINVAL;
 430
 431         NG_FREE_MSG(pcb->msg); /* checks for != NULL */
 432
 433         return (0);
 434 } /* ng_btsocket_hci_raw_send_sync_ngmsg */
 435
 436 /*
 437  * Create control information for the packet
 438  */
 439
 440 static void
 441 ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf **ctl,
 442                 struct mbuf *m)
 443 {
 444         int             dir;
 445         struct timeval  tv;
 446
 447         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 448
 449         if (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION) {
 450                 dir = (m->m_flags & M_PROTO1)? 1 : 0;
 451                 *ctl = sbcreatecontrol((caddr_t) &dir, sizeof(dir),
 452                                         SCM_HCI_RAW_DIRECTION, SOL_HCI_RAW);
 453                 if (*ctl != NULL)
 454                         ctl = &((*ctl)->m_next);
 455         }
 456
 457         if (pcb->so->so_options & SO_TIMESTAMP) {
 458                 microtime(&tv);
 459                 *ctl = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
 460                                         SCM_TIMESTAMP, SOL_SOCKET);
 461                 if (*ctl != NULL)
 462                         ctl = &((*ctl)->m_next);
 463         }
 464 } /* ng_btsocket_hci_raw_savctl */
 465
 466 /*
 467  * Raw HCI sockets data input routine
 468  */
 469
 470 static void
 471 ng_btsocket_hci_raw_data_input(struct mbuf *nam)
 472 {
 473         ng_btsocket_hci_raw_pcb_p        pcb = NULL;
 474         struct mbuf                     *m0 = NULL, *m = NULL;
 475         struct sockaddr_hci             *sa = NULL;
 476
 477         m0 = nam->m_next;
 478         nam->m_next = NULL;
 479
 480         KASSERT((nam->m_type == MT_SONAME),
 481                 ("%s: m_type=%d\n", __func__, nam->m_type));
 482         KASSERT((m0->m_flags & M_PKTHDR),
 483                 ("%s: m_flags=%#x\n", __func__, m0->m_flags));
 484
 485         sa = mtod(nam, struct sockaddr_hci *);
 486
 487         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 488
 489         LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
 490
 491                 mtx_lock(&pcb->pcb_mtx);
 492
 493                 /*
 494                  * If socket was bound then check address and
 495                  *  make sure it matches.
 496                  */
 497
 498                 if (pcb->addr.hci_node[0] != 0 &&
 499                     strcmp(sa->hci_node, pcb->addr.hci_node) != 0)
 500                         goto next;
 501
 502                 /*
 503                  * Check packet against filters
 504                  * XXX do we have to call m_pullup() here?
 505                  */
 506
 507                 if (ng_btsocket_hci_raw_filter(pcb, m0, 1) != 0)
 508                         goto next;
 509
 510                 /*
 511                  * Make a copy of the packet, append to the socket's
 512                  * receive queue and wakeup socket. sbappendaddr()
 513                  * will check if socket has enough buffer space.
 514                  */
 515
 516                 m = m_dup(m0, MB_DONTWAIT);
 517                 if (m != NULL) {
 518                         struct mbuf     *ctl = NULL;
 519
 520                         ng_btsocket_hci_raw_savctl(pcb, &ctl, m);
 521
 522                         if (sbappendaddr(&pcb->so->so_rcv,
 523                                         (struct sockaddr *) sa, m, ctl))
 524                                 sorwakeup(pcb->so);
 525                         else {
 526                                 NG_BTSOCKET_HCI_RAW_INFO(
 527 "%s: sbappendaddr() failed\n", __func__);
 528
 529                                 NG_FREE_M(m);
 530                                 NG_FREE_M(ctl);
 531                         }
 532                 }
 533 next:
 534                 mtx_unlock(&pcb->pcb_mtx);
 535         }
 536
 537         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 538
 539         NG_FREE_M(nam);
 540         NG_FREE_M(m0);
 541 } /* ng_btsocket_hci_raw_data_input */
 542
 543 /*
 544  * Raw HCI sockets message input routine
 545  */
 546
 547 static void
 548 ng_btsocket_hci_raw_msg_input(struct ng_mesg *msg)
 549 {
 550         ng_btsocket_hci_raw_pcb_p       pcb = NULL;
 551
 552         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 553
 554         LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
 555                 mtx_lock(&pcb->pcb_mtx);
 556
 557                 if (msg->header.token == pcb->token) {
 558                         pcb->msg = msg;
 559                         wakeup(&pcb->msg);
 560
 561                         mtx_unlock(&pcb->pcb_mtx);
 562                         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 563
 564                         return;
 565                 }
 566
 567                 mtx_unlock(&pcb->pcb_mtx);
 568         }
 569
 570         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 571
 572         NG_FREE_MSG(msg); /* checks for != NULL */
 573 } /* ng_btsocket_hci_raw_msg_input */
 574
 575 /*
 576  * Raw HCI sockets input routines
 577  */
 578
 579 static void
 580 ng_btsocket_hci_raw_input(void *context, int pending)
 581 {
 582         item_p  item = NULL;
 583
 584         for (;;) {
 585                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 586                 NG_BT_ITEMQ_DEQUEUE(&ng_btsocket_hci_raw_queue, item);
 587                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 588
 589                 if (item == NULL)
 590                         break;
 591
 592                 switch(item->el_flags & NGQF_TYPE) {
 593                 case NGQF_DATA: {
 594                         struct mbuf     *m = NULL;
 595
 596                         NGI_GET_M(item, m);
 597                         ng_btsocket_hci_raw_data_input(m);
 598                         } break;
 599
 600                 case NGQF_MESG: {
 601                         struct ng_mesg  *msg = NULL;
 602
 603                         NGI_GET_MSG(item, msg);
 604                         ng_btsocket_hci_raw_msg_input(msg);
 605                         } break;
 606
 607                 default:
 608                         KASSERT(0,
 609 ("%s: invalid item type=%ld\n", __func__, (item->el_flags & NGQF_TYPE)));
 610                         break;
 611                 }
 612
 613                 NG_FREE_ITEM(item);
 614         }
 615 } /* ng_btsocket_hci_raw_input */
 616
 617 /*
 618  * Raw HCI sockets output routine
 619  */
 620
 621 static void
 622 ng_btsocket_hci_raw_output(node_p node, hook_p hook, void *arg1, int arg2)
 623 {
 624         struct mbuf             *nam = (struct mbuf *) arg1, *m = NULL;
 625         struct sockaddr_hci     *sa = NULL;
 626         int                      error;
 627
 628         m = nam->m_next;
 629         nam->m_next = NULL;
 630
 631         KASSERT((nam->m_type == MT_SONAME),
 632                 ("%s: m_type=%d\n", __func__, nam->m_type));
 633         KASSERT((m->m_flags & M_PKTHDR),
 634                 ("%s: m_flags=%#x\n", __func__, m->m_flags));
 635
 636         sa = mtod(nam, struct sockaddr_hci *);
 637
 638         /*
 639          * Find downstream hook
 640          * XXX For now access node hook list directly. Should be safe because
 641          * we used ng_send_fn() and we should have exclusive lock on the node.
 642          */
 643
 644         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 645                 if (hook == NULL || NG_HOOK_NOT_VALID(hook) ||
 646                     NG_NODE_NOT_VALID(NG_PEER_NODE(hook)))
 647                         continue;
 648
 649                 if (strcmp(sa->hci_node, NG_PEER_NODE_NAME(hook)) == 0) {
 650                         NG_SEND_DATA_ONLY(error, hook, m); /* sets m to NULL */
 651                         break;
 652                 }
 653         }
 654
 655         NG_FREE_M(nam); /* check for != NULL */
 656         NG_FREE_M(m);
 657 } /* ng_btsocket_hci_raw_output */
 658
 659 /*
 660  * Check frame against security and socket filters.
 661  * d (direction bit) == 1 means incoming frame.
 662  */
 663
 664 static int
 665 ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf *m, int d)
 666 {
 667         int     type, event, opcode;
 668
 669         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 670
 671         switch ((type = *mtod(m, u_int8_t *))) {
 672         case NG_HCI_CMD_PKT:
 673                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)) {
 674                         opcode = le16toh(mtod(m, ng_hci_cmd_pkt_t *)->opcode);
 675
 676                         if (!bit_test(
 677 ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF(opcode) - 1],
 678 NG_HCI_OCF(opcode) - 1))
 679                                 return (EPERM);
 680                 }
 681
 682                 if (d && !bit_test(pcb->filter.packet_mask, NG_HCI_CMD_PKT - 1))
 683                         return (EPERM);
 684                 break;
 685
 686         case NG_HCI_ACL_DATA_PKT:
 687         case NG_HCI_SCO_DATA_PKT:
 688                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED) ||
 689                     !bit_test(pcb->filter.packet_mask, type - 1) ||
 690                     !d)
 691                         return (EPERM);
 692                 break;
 693
 694         case NG_HCI_EVENT_PKT:
 695                 if (!d)
 696                         return (EINVAL);
 697
 698                 event = mtod(m, ng_hci_event_pkt_t *)->event - 1;
 699
 700                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED))
 701                         if (!bit_test(ng_btsocket_hci_raw_sec_filter->events, event))
 702                                 return (EPERM);
 703
 704                 if (!bit_test(pcb->filter.event_mask, event))
 705                         return (EPERM);
 706                 break;
 707
 708         default:
 709                 return (EINVAL);
 710         }
 711
 712         return (0);
 713 } /* ng_btsocket_hci_raw_filter */
 714
 715 /*
 716  * Initialize everything
 717  */
 718
 719 void
 720 ng_btsocket_hci_raw_init(void)
 721 {
 722         bitstr_t        *f = NULL;
 723         int              error = 0;
 724
 725         ng_btsocket_hci_raw_node = NULL;
 726         ng_btsocket_hci_raw_debug_level = NG_BTSOCKET_WARN_LEVEL;
 727         ng_btsocket_hci_raw_ioctl_timeout = 5;
 728
 729         /* Register Netgraph node type */
 730         error = ng_newtype(&typestruct);
 731         if (error != 0) {
 732                 NG_BTSOCKET_HCI_RAW_ALERT(
 733 "%s: Could not register Netgraph node type, error=%d\n", __func__, error);
 734
 735                 return;
 736         }
 737
 738         /* Create Netgrapg node */
 739         error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
 740         if (error != 0) {
 741                 NG_BTSOCKET_HCI_RAW_ALERT(
 742 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
 743
 744                 ng_btsocket_hci_raw_node = NULL;
 745
 746                 return;
 747         }
 748
 749         error = ng_name_node(ng_btsocket_hci_raw_node,
 750                                 NG_BTSOCKET_HCI_RAW_NODE_TYPE);
 751         if (error != 0) {
 752                 NG_BTSOCKET_HCI_RAW_ALERT(
 753 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
 754
 755                 NG_NODE_UNREF(ng_btsocket_hci_raw_node);
 756                 ng_btsocket_hci_raw_node = NULL;
 757
 758                 return;
 759         }
 760
 761         /* Create input queue */
 762         NG_BT_ITEMQ_INIT(&ng_btsocket_hci_raw_queue, ifqmaxlen);
 763         mtx_init(&ng_btsocket_hci_raw_queue_mtx,
 764                 "btsocks_hci_raw_queue_mtx", NULL, MTX_DEF);
 765         TASK_INIT(&ng_btsocket_hci_raw_task, 0,
 766                 ng_btsocket_hci_raw_input, NULL);
 767
 768         /* Create list of sockets */
 769         LIST_INIT(&ng_btsocket_hci_raw_sockets);
 770         mtx_init(&ng_btsocket_hci_raw_sockets_mtx,
 771                 "btsocks_hci_raw_sockets_mtx", NULL, MTX_DEF);
 772
 773         /* Tokens */
 774         ng_btsocket_hci_raw_token = 0;
 775         mtx_init(&ng_btsocket_hci_raw_token_mtx,
 776                 "btsocks_hci_raw_token_mtx", NULL, MTX_DEF);
 777
 778         /*
 779          * Security filter
 780          * XXX never FREE()ed
 781          */
 782
 783         ng_btsocket_hci_raw_sec_filter = NULL;
 784
 785         ng_btsocket_hci_raw_sec_filter = kmalloc(sizeof(struct ng_btsocket_hci_raw_sec_filter),
 786                                                  M_NETGRAPH_BTSOCKET_HCI_RAW,
 787                                                  M_WAITOK | M_NULLOK | M_ZERO);
 788         if (ng_btsocket_hci_raw_sec_filter == NULL) {
 789                 kprintf("%s: Could not allocate security filter!\n", __func__);
 790                 return;
 791         }
 792
 793         /*
 794          * XXX How paranoid can we get?
 795          *
 796          * Initialize security filter. If bit is set in the mask then
 797          * unprivileged socket is allowed to send (receive) this command
 798          * (event).
 799          */
 800
 801         /* Enable all events */
 802         memset(&ng_btsocket_hci_raw_sec_filter->events, 0xff,
 803                 sizeof(ng_btsocket_hci_raw_sec_filter->events)/
 804                         sizeof(ng_btsocket_hci_raw_sec_filter->events[0]));
 805
 806         /* Disable some critical events */
 807         f = ng_btsocket_hci_raw_sec_filter->events;
 808         bit_clear(f, NG_HCI_EVENT_RETURN_LINK_KEYS - 1);
 809         bit_clear(f, NG_HCI_EVENT_LINK_KEY_NOTIFICATION - 1);
 810         bit_clear(f, NG_HCI_EVENT_VENDOR - 1);
 811
 812         /* Commands - Link control */
 813         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_CONTROL-1];
 814         bit_set(f, NG_HCI_OCF_INQUIRY - 1);
 815         bit_set(f, NG_HCI_OCF_INQUIRY_CANCEL - 1);
 816         bit_set(f, NG_HCI_OCF_PERIODIC_INQUIRY - 1);
 817         bit_set(f, NG_HCI_OCF_EXIT_PERIODIC_INQUIRY - 1);
 818         bit_set(f, NG_HCI_OCF_REMOTE_NAME_REQ - 1);
 819         bit_set(f, NG_HCI_OCF_READ_REMOTE_FEATURES - 1);
 820         bit_set(f, NG_HCI_OCF_READ_REMOTE_VER_INFO - 1);
 821         bit_set(f, NG_HCI_OCF_READ_CLOCK_OFFSET - 1);
 822
 823         /* Commands - Link policy */
 824         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_POLICY-1];
 825         bit_set(f, NG_HCI_OCF_ROLE_DISCOVERY - 1);
 826         bit_set(f, NG_HCI_OCF_READ_LINK_POLICY_SETTINGS - 1);
 827
 828         /* Commands - Host controller and baseband */
 829         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_HC_BASEBAND-1];
 830         bit_set(f, NG_HCI_OCF_READ_PIN_TYPE - 1);
 831         bit_set(f, NG_HCI_OCF_READ_LOCAL_NAME - 1);
 832         bit_set(f, NG_HCI_OCF_READ_CON_ACCEPT_TIMO - 1);
 833         bit_set(f, NG_HCI_OCF_READ_PAGE_TIMO - 1);
 834         bit_set(f, NG_HCI_OCF_READ_SCAN_ENABLE - 1);
 835         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_ACTIVITY - 1);
 836         bit_set(f, NG_HCI_OCF_READ_INQUIRY_SCAN_ACTIVITY - 1);
 837         bit_set(f, NG_HCI_OCF_READ_AUTH_ENABLE - 1);
 838         bit_set(f, NG_HCI_OCF_READ_ENCRYPTION_MODE - 1);
 839         bit_set(f, NG_HCI_OCF_READ_UNIT_CLASS - 1);
 840         bit_set(f, NG_HCI_OCF_READ_VOICE_SETTINGS - 1);
 841         bit_set(f, NG_HCI_OCF_READ_AUTO_FLUSH_TIMO - 1);
 842         bit_set(f, NG_HCI_OCF_READ_NUM_BROADCAST_RETRANS - 1);
 843         bit_set(f, NG_HCI_OCF_READ_HOLD_MODE_ACTIVITY - 1);
 844         bit_set(f, NG_HCI_OCF_READ_XMIT_LEVEL - 1);
 845         bit_set(f, NG_HCI_OCF_READ_SCO_FLOW_CONTROL - 1);
 846         bit_set(f, NG_HCI_OCF_READ_LINK_SUPERVISION_TIMO - 1);
 847         bit_set(f, NG_HCI_OCF_READ_SUPPORTED_IAC_NUM - 1);
 848         bit_set(f, NG_HCI_OCF_READ_IAC_LAP - 1);
 849         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_PERIOD - 1);
 850         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN - 1);
 851
 852         /* Commands - Informational */
 853         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_INFO - 1];
 854         bit_set(f, NG_HCI_OCF_READ_LOCAL_VER - 1);
 855         bit_set(f, NG_HCI_OCF_READ_LOCAL_FEATURES - 1);
 856         bit_set(f, NG_HCI_OCF_READ_BUFFER_SIZE - 1);
 857         bit_set(f, NG_HCI_OCF_READ_COUNTRY_CODE - 1);
 858         bit_set(f, NG_HCI_OCF_READ_BDADDR - 1);
 859
 860         /* Commands - Status */
 861         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_STATUS - 1];
 862         bit_set(f, NG_HCI_OCF_READ_FAILED_CONTACT_CNTR - 1);
 863         bit_set(f, NG_HCI_OCF_GET_LINK_QUALITY - 1);
 864         bit_set(f, NG_HCI_OCF_READ_RSSI - 1);
 865
 866         /* Commands - Testing */
 867         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_TESTING - 1];
 868         bit_set(f, NG_HCI_OCF_READ_LOOPBACK_MODE - 1);
 869 } /* ng_btsocket_hci_raw_init */
 870
 871 /*
 872  * Abort connection on socket
 873  */
 874
 875 void
 876 ng_btsocket_hci_raw_abort(struct socket *so)
 877 {
 878 } /* ng_btsocket_hci_raw_abort */
 879
 880 void
 881 ng_btsocket_hci_raw_close(struct socket *so)
 882 {
 883 } /* ng_btsocket_hci_raw_close */
 884
 885 /*
 886  * Create new raw HCI socket
 887  */
 888
 889 int
 890 ng_btsocket_hci_raw_attach(struct socket *so, int proto, struct thread *td)
 891 {
 892         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
 893         int                             error = 0;
 894
 895         if (pcb != NULL)
 896                 return (EISCONN);
 897
 898         if (ng_btsocket_hci_raw_node == NULL)
 899                 return (EPROTONOSUPPORT);
 900         if (proto != BLUETOOTH_PROTO_HCI)
 901                 return (EPROTONOSUPPORT);
 902         if (so->so_type != SOCK_RAW)
 903                 return (ESOCKTNOSUPPORT);
 904
 905         error = soreserve(so, NG_BTSOCKET_HCI_RAW_SENDSPACE,
 906                                 NG_BTSOCKET_HCI_RAW_RECVSPACE);
 907         if (error != 0)
 908                 return (error);
 909
 910         pcb = kmalloc(sizeof(*pcb), M_NETGRAPH_BTSOCKET_HCI_RAW,
 911                       M_WAITOK | M_NULLOK | M_ZERO);
 912         if (pcb == NULL)
 913                 return (ENOMEM);
 914
 915         so->so_pcb = (caddr_t) pcb;
 916         pcb->so = so;
 917
 918         if (priv_check(td, PRIV_NETBLUETOOTH_RAW) == 0)
 919                 pcb->flags |= NG_BTSOCKET_HCI_RAW_PRIVILEGED;
 920
 921         /*
 922          * Set default socket filter. By default socket only accepts HCI
 923          * Command_Complete and Command_Status event packets.
 924          */
 925
 926         bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_COMPL - 1);
 927         bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_STATUS - 1);
 928
 929         mtx_init(&pcb->pcb_mtx, "btsocks_hci_raw_pcb_mtx", NULL, MTX_DEF);
 930
 931         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 932         LIST_INSERT_HEAD(&ng_btsocket_hci_raw_sockets, pcb, next);
 933         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 934
 935         return (0);
 936 } /* ng_btsocket_hci_raw_attach */
 937
 938 /*
 939  * Bind raw HCI socket
 940  */
 941
 942 int
 943 ng_btsocket_hci_raw_bind(struct socket *so, struct sockaddr *nam,
 944                 struct thread *td)
 945 {
 946         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
 947         struct sockaddr_hci             *sa = (struct sockaddr_hci *) nam;
 948
 949         if (pcb == NULL)
 950                 return (EINVAL);
 951         if (ng_btsocket_hci_raw_node == NULL)
 952                 return (EINVAL);
 953
 954         if (sa == NULL)
 955                 return (EINVAL);
 956         if (sa->hci_family != AF_BLUETOOTH)
 957                 return (EAFNOSUPPORT);
 958         if (sa->hci_len != sizeof(*sa))
 959                 return (EINVAL);
 960         if (sa->hci_node[0] == 0)
 961                 return (EINVAL);
 962
 963         mtx_lock(&pcb->pcb_mtx);
 964         bcopy(sa, &pcb->addr, sizeof(pcb->addr));
 965         mtx_unlock(&pcb->pcb_mtx);
 966
 967         return (0);
 968 } /* ng_btsocket_hci_raw_bind */
 969
 970 /*
 971  * Connect raw HCI socket
 972  */
 973
 974 int
 975 ng_btsocket_hci_raw_connect(struct socket *so, struct sockaddr *nam,
 976                 struct thread *td)
 977 {
 978         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
 979         struct sockaddr_hci             *sa = (struct sockaddr_hci *) nam;
 980
 981         if (pcb == NULL)
 982                 return (EINVAL);
 983         if (ng_btsocket_hci_raw_node == NULL)
 984                 return (EINVAL);
 985
 986         if (sa == NULL)
 987                 return (EINVAL);
 988         if (sa->hci_family != AF_BLUETOOTH)
 989                 return (EAFNOSUPPORT);
 990         if (sa->hci_len != sizeof(*sa))
 991                 return (EINVAL);
 992         if (sa->hci_node[0] == 0)
 993                 return (EDESTADDRREQ);
 994
 995         mtx_lock(&pcb->pcb_mtx);
 996
 997         if (bcmp(sa, &pcb->addr, sizeof(pcb->addr)) != 0) {
 998                 mtx_unlock(&pcb->pcb_mtx);
 999                 return (EADDRNOTAVAIL);
1000         }
1001
1002         soisconnected(so);
1003
1004         mtx_unlock(&pcb->pcb_mtx);
1005
1006         return (0);
1007 } /* ng_btsocket_hci_raw_connect */
1008
1009 /*
1010  * Process ioctl on socket
1011  */
1012
1013 int
1014 ng_btsocket_hci_raw_control(struct socket *so, u_long cmd, caddr_t data,
1015                 struct ifnet *ifp, struct thread *td)
1016 {
1017         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1018         char                             path[NG_NODESIZ + 1];
1019         struct ng_mesg                  *msg = NULL;
1020         int                              error = 0;
1021
1022         if (pcb == NULL)
1023                 return (EINVAL);
1024         if (ng_btsocket_hci_raw_node == NULL)
1025                 return (EINVAL);
1026
1027         mtx_lock(&pcb->pcb_mtx);
1028
1029         /* Check if we have device name */
1030         if (pcb->addr.hci_node[0] == 0) {
1031                 mtx_unlock(&pcb->pcb_mtx);
1032                 return (EHOSTUNREACH);
1033         }
1034
1035         /* Check if we have pending ioctl() */
1036         if (pcb->token != 0) {
1037                 mtx_unlock(&pcb->pcb_mtx);
1038                 return (EBUSY);
1039         }
1040
1041         ksnprintf(path, sizeof(path), "%s:", pcb->addr.hci_node);
1042
1043         switch (cmd) {
1044         case SIOC_HCI_RAW_NODE_GET_STATE: {
1045                 struct ng_btsocket_hci_raw_node_state   *p =
1046                         (struct ng_btsocket_hci_raw_node_state *) data;
1047
1048                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1049                                 NGM_HCI_NODE_GET_STATE,
1050                                 &p->state, sizeof(p->state));
1051                 } break;
1052
1053         case SIOC_HCI_RAW_NODE_INIT:
1054                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1055                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1056                                         NGM_HCI_NODE_INIT, NULL, 0);
1057                 else
1058                         error = EPERM;
1059                 break;
1060
1061         case SIOC_HCI_RAW_NODE_GET_DEBUG: {
1062                 struct ng_btsocket_hci_raw_node_debug   *p =
1063                         (struct ng_btsocket_hci_raw_node_debug *) data;
1064
1065                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1066                                 NGM_HCI_NODE_GET_DEBUG,
1067                                 &p->debug, sizeof(p->debug));
1068                 } break;
1069
1070         case SIOC_HCI_RAW_NODE_SET_DEBUG: {
1071                 struct ng_btsocket_hci_raw_node_debug   *p =
1072                         (struct ng_btsocket_hci_raw_node_debug *) data;
1073
1074                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1075                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1076                                         NGM_HCI_NODE_SET_DEBUG, &p->debug,
1077                                         sizeof(p->debug));
1078                 else
1079                         error = EPERM;
1080                 } break;
1081
1082         case SIOC_HCI_RAW_NODE_GET_BUFFER: {
1083                 struct ng_btsocket_hci_raw_node_buffer  *p =
1084                         (struct ng_btsocket_hci_raw_node_buffer *) data;
1085
1086                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1087                                 NGM_HCI_NODE_GET_BUFFER,
1088                                 &p->buffer, sizeof(p->buffer));
1089                 } break;
1090
1091         case SIOC_HCI_RAW_NODE_GET_BDADDR: {
1092                 struct ng_btsocket_hci_raw_node_bdaddr  *p =
1093                         (struct ng_btsocket_hci_raw_node_bdaddr *) data;
1094
1095                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1096                                 NGM_HCI_NODE_GET_BDADDR,
1097                                 &p->bdaddr, sizeof(p->bdaddr));
1098                 } break;
1099
1100         case SIOC_HCI_RAW_NODE_GET_FEATURES: {
1101                 struct ng_btsocket_hci_raw_node_features        *p =
1102                         (struct ng_btsocket_hci_raw_node_features *) data;
1103
1104                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1105                                 NGM_HCI_NODE_GET_FEATURES,
1106                                 &p->features, sizeof(p->features));
1107                 } break;
1108
1109         case SIOC_HCI_RAW_NODE_GET_STAT: {
1110                 struct ng_btsocket_hci_raw_node_stat    *p =
1111                         (struct ng_btsocket_hci_raw_node_stat *) data;
1112
1113                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1114                                 NGM_HCI_NODE_GET_STAT,
1115                                 &p->stat, sizeof(p->stat));
1116                 } break;
1117
1118         case SIOC_HCI_RAW_NODE_RESET_STAT:
1119                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1120                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1121                                         NGM_HCI_NODE_RESET_STAT, NULL, 0);
1122                 else
1123                         error = EPERM;
1124                 break;
1125
1126         case SIOC_HCI_RAW_NODE_FLUSH_NEIGHBOR_CACHE:
1127                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1128                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1129                                         NGM_HCI_NODE_FLUSH_NEIGHBOR_CACHE,
1130                                         NULL, 0);
1131                 else
1132                         error = EPERM;
1133                 break;
1134
1135         case SIOC_HCI_RAW_NODE_GET_NEIGHBOR_CACHE:  {
1136                 struct ng_btsocket_hci_raw_node_neighbor_cache  *p =
1137                         (struct ng_btsocket_hci_raw_node_neighbor_cache *) data;
1138                 ng_hci_node_get_neighbor_cache_ep               *p1 = NULL;
1139                 ng_hci_node_neighbor_cache_entry_ep             *p2 = NULL;
1140
1141                 if (p->num_entries <= 0 ||
1142                     p->num_entries > NG_HCI_MAX_NEIGHBOR_NUM ||
1143                     p->entries == NULL) {
1144                         error = EINVAL;
1145                         break;
1146                 }
1147
1148                 NG_MKMESSAGE(msg, NGM_HCI_COOKIE,
1149                         NGM_HCI_NODE_GET_NEIGHBOR_CACHE, 0, M_WAITOK | M_NULLOK);
1150                 if (msg == NULL) {
1151                         error = ENOMEM;
1152                         break;
1153                 }
1154                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1155                 pcb->token = msg->header.token;
1156                 pcb->msg = NULL;
1157
1158                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1159                 if (error != 0) {
1160                         pcb->token = 0;
1161                         break;
1162                 }
1163
1164                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1165                                 PZERO|PCATCH, "hcictl",
1166                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1167                 pcb->token = 0;
1168
1169                 if (error != 0)
1170                         break;
1171
1172                 if (pcb->msg != NULL &&
1173                     pcb->msg->header.cmd == NGM_HCI_NODE_GET_NEIGHBOR_CACHE) {
1174                         /* Return data back to user space */
1175                         p1 = (ng_hci_node_get_neighbor_cache_ep *)
1176                                 (pcb->msg->data);
1177                         p2 = (ng_hci_node_neighbor_cache_entry_ep *)
1178                                 (p1 + 1);
1179
1180                         p->num_entries = min(p->num_entries, p1->num_entries);
1181                         if (p->num_entries > 0)
1182                                 error = copyout((caddr_t) p2,
1183                                                 (caddr_t) p->entries,
1184                                                 p->num_entries * sizeof(*p2));
1185                 } else
1186                         error = EINVAL;
1187
1188                 NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1189                 }break;
1190
1191         case SIOC_HCI_RAW_NODE_GET_CON_LIST: {
1192                 struct ng_btsocket_hci_raw_con_list     *p =
1193                         (struct ng_btsocket_hci_raw_con_list *) data;
1194                 ng_hci_node_con_list_ep                 *p1 = NULL;
1195                 ng_hci_node_con_ep                      *p2 = NULL;
1196
1197                 if (p->num_connections == 0 ||
1198                     p->num_connections > NG_HCI_MAX_CON_NUM ||
1199                     p->connections == NULL) {
1200                         error = EINVAL;
1201                         break;
1202                 }
1203
1204                 NG_MKMESSAGE(msg, NGM_HCI_COOKIE, NGM_HCI_NODE_GET_CON_LIST,
1205                         0, M_WAITOK | M_NULLOK);
1206                 if (msg == NULL) {
1207                         error = ENOMEM;
1208                         break;
1209                 }
1210                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1211                 pcb->token = msg->header.token;
1212                 pcb->msg = NULL;
1213
1214                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1215                 if (error != 0) {
1216                         pcb->token = 0;
1217                         break;
1218                 }
1219
1220                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1221                                 PZERO|PCATCH, "hcictl",
1222                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1223                 pcb->token = 0;
1224
1225                 if (error != 0)
1226                         break;
1227
1228                 if (pcb->msg != NULL &&
1229                     pcb->msg->header.cmd == NGM_HCI_NODE_GET_CON_LIST) {
1230                         /* Return data back to user space */
1231                         p1 = (ng_hci_node_con_list_ep *)(pcb->msg->data);
1232                         p2 = (ng_hci_node_con_ep *)(p1 + 1);
1233
1234                         p->num_connections = min(p->num_connections,
1235                                                 p1->num_connections);
1236                         if (p->num_connections > 0)
1237                                 error = copyout((caddr_t) p2,
1238                                         (caddr_t) p->connections,
1239                                         p->num_connections * sizeof(*p2));
1240                 } else
1241                         error = EINVAL;
1242
1243                 NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1244                 } break;
1245
1246         case SIOC_HCI_RAW_NODE_GET_LINK_POLICY_MASK: {
1247                 struct ng_btsocket_hci_raw_node_link_policy_mask        *p =
1248                         (struct ng_btsocket_hci_raw_node_link_policy_mask *)
1249                                 data;
1250
1251                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1252                                 NGM_HCI_NODE_GET_LINK_POLICY_SETTINGS_MASK,
1253                                 &p->policy_mask, sizeof(p->policy_mask));
1254                 } break;
1255
1256         case SIOC_HCI_RAW_NODE_SET_LINK_POLICY_MASK: {
1257                 struct ng_btsocket_hci_raw_node_link_policy_mask        *p =
1258                         (struct ng_btsocket_hci_raw_node_link_policy_mask *)
1259                                 data;
1260
1261                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1262                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1263                                         NGM_HCI_NODE_SET_LINK_POLICY_SETTINGS_MASK,
1264                                         &p->policy_mask,
1265                                         sizeof(p->policy_mask));
1266                 else
1267                         error = EPERM;
1268                 } break;
1269
1270         case SIOC_HCI_RAW_NODE_GET_PACKET_MASK: {
1271                 struct ng_btsocket_hci_raw_node_packet_mask     *p =
1272                         (struct ng_btsocket_hci_raw_node_packet_mask *) data;
1273
1274                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1275                                 NGM_HCI_NODE_GET_PACKET_MASK,
1276                                 &p->packet_mask, sizeof(p->packet_mask));
1277                 } break;
1278
1279         case SIOC_HCI_RAW_NODE_SET_PACKET_MASK: {
1280                 struct ng_btsocket_hci_raw_node_packet_mask     *p =
1281                         (struct ng_btsocket_hci_raw_node_packet_mask *) data;
1282
1283                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1284                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1285                                         NGM_HCI_NODE_SET_PACKET_MASK,
1286                                         &p->packet_mask,
1287                                         sizeof(p->packet_mask));
1288                 else
1289                         error = EPERM;
1290                 } break;
1291
1292         case SIOC_HCI_RAW_NODE_GET_ROLE_SWITCH: {
1293                 struct ng_btsocket_hci_raw_node_role_switch     *p =
1294                         (struct ng_btsocket_hci_raw_node_role_switch *) data;
1295
1296                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1297                                 NGM_HCI_NODE_GET_ROLE_SWITCH,
1298                                 &p->role_switch, sizeof(p->role_switch));
1299                 } break;
1300
1301         case SIOC_HCI_RAW_NODE_SET_ROLE_SWITCH: {
1302                 struct ng_btsocket_hci_raw_node_role_switch     *p =
1303                         (struct ng_btsocket_hci_raw_node_role_switch *) data;
1304
1305                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1306                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1307                                         NGM_HCI_NODE_SET_ROLE_SWITCH,
1308                                         &p->role_switch,
1309                                         sizeof(p->role_switch));
1310                 else
1311                         error = EPERM;
1312                 } break;
1313
1314         case SIOC_HCI_RAW_NODE_LIST_NAMES: {
1315                 struct ng_btsocket_hci_raw_node_list_names      *nl =
1316                         (struct ng_btsocket_hci_raw_node_list_names *) data;
1317                 struct nodeinfo                                 *ni = nl->names;
1318
1319                 if (nl->num_names == 0) {
1320                         error = EINVAL;
1321                         break;
1322                 }
1323
1324                 NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_LISTNAMES,
1325                         0, M_WAITOK | M_NULLOK);
1326                 if (msg == NULL) {
1327                         error = ENOMEM;
1328                         break;
1329                 }
1330                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1331                 pcb->token = msg->header.token;
1332                 pcb->msg = NULL;
1333
1334                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, ".:", 0);
1335                 if (error != 0) {
1336                         pcb->token = 0;
1337                         break;
1338                 }
1339
1340                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1341                                 PZERO|PCATCH, "hcictl",
1342                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1343                 pcb->token = 0;
1344
1345                 if (error != 0)
1346                         break;
1347
1348                 if (pcb->msg != NULL && pcb->msg->header.cmd == NGM_LISTNAMES) {
1349                         /* Return data back to user space */
1350                         struct namelist *nl1 = (struct namelist *) pcb->msg->data;
1351                         struct nodeinfo *ni1 = &nl1->nodeinfo[0];
1352
1353                         while (nl->num_names > 0 && nl1->numnames > 0) {
1354                                 if (strcmp(ni1->type, NG_HCI_NODE_TYPE) == 0) {
1355                                         error = copyout((caddr_t) ni1,
1356                                                         (caddr_t) ni,
1357                                                         sizeof(*ni));
1358                                         if (error != 0)
1359                                                 break;
1360
1361                                         nl->num_names --;
1362                                         ni ++;
1363                                 }
1364
1365                                 nl1->numnames --;
1366                                 ni1 ++;
1367                         }
1368
1369                         nl->num_names = ni - nl->names;
1370                 } else
1371                         error = EINVAL;
1372
1373                 NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1374                 } break;
1375
1376         default:
1377                 error = EINVAL;
1378                 break;
1379         }
1380
1381         mtx_unlock(&pcb->pcb_mtx);
1382
1383         return (error);
1384 } /* ng_btsocket_hci_raw_control */
1385
1386 /*
1387  * Process getsockopt/setsockopt system calls
1388  */
1389
1390 int
1391 ng_btsocket_hci_raw_ctloutput(struct socket *so, struct sockopt *sopt)
1392 {
1393         ng_btsocket_hci_raw_pcb_p               pcb = so2hci_raw_pcb(so);
1394         struct ng_btsocket_hci_raw_filter       filter;
1395         int                                     error = 0, dir;
1396
1397         if (pcb == NULL)
1398                 return (EINVAL);
1399         if (ng_btsocket_hci_raw_node == NULL)
1400                 return (EINVAL);
1401
1402         if (sopt->sopt_level != SOL_HCI_RAW)
1403                 return (0);
1404
1405         mtx_lock(&pcb->pcb_mtx);
1406
1407         switch (sopt->sopt_dir) {
1408         case SOPT_GET:
1409                 switch (sopt->sopt_name) {
1410                 case SO_HCI_RAW_FILTER:
1411                         error = sooptcopyout(sopt, &pcb->filter,
1412                                                 sizeof(pcb->filter));
1413                         break;
1414
1415                 case SO_HCI_RAW_DIRECTION:
1416                         dir = (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION)?1:0;
1417                         error = sooptcopyout(sopt, &dir, sizeof(dir));
1418                         break;
1419
1420                 default:
1421                         error = EINVAL;
1422                         break;
1423                 }
1424                 break;
1425
1426         case SOPT_SET:
1427                 switch (sopt->sopt_name) {
1428                 case SO_HCI_RAW_FILTER:
1429                         error = sooptcopyin(sopt, &filter, sizeof(filter),
1430                                                 sizeof(filter));
1431                         if (error == 0)
1432                                 bcopy(&filter, &pcb->filter,
1433                                                 sizeof(pcb->filter));
1434                         break;
1435
1436                 case SO_HCI_RAW_DIRECTION:
1437                         error = sooptcopyin(sopt, &dir, sizeof(dir),
1438                                                 sizeof(dir));
1439                         if (error != 0)
1440                                 break;
1441
1442                         if (dir)
1443                                 pcb->flags |= NG_BTSOCKET_HCI_RAW_DIRECTION;
1444                         else
1445                                 pcb->flags &= ~NG_BTSOCKET_HCI_RAW_DIRECTION;
1446                         break;
1447
1448                 default:
1449                         error = EINVAL;
1450                         break;
1451                 }
1452                 break;
1453
1454         default:
1455                 error = EINVAL;
1456                 break;
1457         }
1458
1459         mtx_unlock(&pcb->pcb_mtx);
1460
1461         return (error);
1462 } /* ng_btsocket_hci_raw_ctloutput */
1463
1464 /*
1465  * Detach raw HCI socket
1466  */
1467
1468 void
1469 ng_btsocket_hci_raw_detach(struct socket *so)
1470 {
1471         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
1472
1473         KASSERT(pcb != NULL, ("ng_btsocket_hci_raw_detach: pcb == NULL"));
1474
1475         if (ng_btsocket_hci_raw_node == NULL)
1476                 return;
1477
1478         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
1479         mtx_lock(&pcb->pcb_mtx);
1480
1481         LIST_REMOVE(pcb, next);
1482
1483         mtx_unlock(&pcb->pcb_mtx);
1484         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
1485
1486         mtx_destroy(&pcb->pcb_mtx);
1487
1488         bzero(pcb, sizeof(*pcb));
1489         kfree(pcb, M_NETGRAPH_BTSOCKET_HCI_RAW);
1490
1491         so->so_pcb = NULL;
1492 } /* ng_btsocket_hci_raw_detach */
1493
1494 /*
1495  * Disconnect raw HCI socket
1496  */
1497
1498 int
1499 ng_btsocket_hci_raw_disconnect(struct socket *so)
1500 {
1501         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1502
1503         if (pcb == NULL)
1504                 return (EINVAL);
1505         if (ng_btsocket_hci_raw_node == NULL)
1506                 return (EINVAL);
1507
1508         mtx_lock(&pcb->pcb_mtx);
1509         soisdisconnected(so);
1510         mtx_unlock(&pcb->pcb_mtx);
1511
1512         return (0);
1513 } /* ng_btsocket_hci_raw_disconnect */
1514
1515 /*
1516  * Get socket peer's address
1517  */
1518
1519 int
1520 ng_btsocket_hci_raw_peeraddr(struct socket *so, struct sockaddr **nam)
1521 {
1522         return (ng_btsocket_hci_raw_sockaddr(so, nam));
1523 } /* ng_btsocket_hci_raw_peeraddr */
1524
1525 /*
1526  * Send data
1527  */
1528
1529 int
1530 ng_btsocket_hci_raw_send(struct socket *so, int flags, struct mbuf *m,
1531                 struct sockaddr *sa, struct mbuf *control, struct thread *td)
1532 {
1533         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1534         struct mbuf                     *nam = NULL;
1535         int                              error = 0;
1536
1537         if (ng_btsocket_hci_raw_node == NULL) {
1538                 error = ENETDOWN;
1539                 goto drop;
1540         }
1541         if (pcb == NULL) {
1542                 error = EINVAL;
1543                 goto drop;
1544         }
1545         if (control != NULL) {
1546                 error = EINVAL;
1547                 goto drop;
1548         }
1549
1550         if (m->m_pkthdr.len < sizeof(ng_hci_cmd_pkt_t) ||
1551             m->m_pkthdr.len > sizeof(ng_hci_cmd_pkt_t) + NG_HCI_CMD_PKT_SIZE) {
1552                 error = EMSGSIZE;
1553                 goto drop;
1554         }
1555
1556         if (m->m_len < sizeof(ng_hci_cmd_pkt_t)) {
1557                 if ((m = m_pullup(m, sizeof(ng_hci_cmd_pkt_t))) == NULL) {
1558                         error = ENOBUFS;
1559                         goto drop;
1560                 }
1561         }
1562         if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
1563                 error = ENOTSUP;
1564                 goto drop;
1565         }
1566
1567         mtx_lock(&pcb->pcb_mtx);
1568
1569         error = ng_btsocket_hci_raw_filter(pcb, m, 0);
1570         if (error != 0) {
1571                 mtx_unlock(&pcb->pcb_mtx);
1572                 goto drop;
1573         }
1574
1575         if (sa == NULL) {
1576                 if (pcb->addr.hci_node[0] == 0) {
1577                         mtx_unlock(&pcb->pcb_mtx);
1578                         error = EDESTADDRREQ;
1579                         goto drop;
1580                 }
1581
1582                 sa = (struct sockaddr *) &pcb->addr;
1583         }
1584
1585         MGET(nam, MB_DONTWAIT, MT_SONAME);
1586         if (nam == NULL) {
1587                 mtx_unlock(&pcb->pcb_mtx);
1588                 error = ENOBUFS;
1589                 goto drop;
1590         }
1591
1592         nam->m_len = sizeof(struct sockaddr_hci);
1593         bcopy(sa,mtod(nam, struct sockaddr_hci *),sizeof(struct sockaddr_hci));
1594
1595         nam->m_next = m;
1596         m = NULL;
1597
1598         mtx_unlock(&pcb->pcb_mtx);
1599
1600         return (ng_send_fn(ng_btsocket_hci_raw_node, NULL,
1601                                 ng_btsocket_hci_raw_output, nam, 0));
1602 drop:
1603         NG_FREE_M(control); /* NG_FREE_M checks for != NULL */
1604         NG_FREE_M(nam);
1605         NG_FREE_M(m);
1606
1607         return (error);
1608 } /* ng_btsocket_hci_raw_send */
1609
1610 /*
1611  * Get socket address
1612  */
1613
1614 int
1615 ng_btsocket_hci_raw_sockaddr(struct socket *so, struct sockaddr **nam)
1616 {
1617         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
1618         struct sockaddr_hci             sa;
1619
1620         if (pcb == NULL)
1621                 return (EINVAL);
1622         if (ng_btsocket_hci_raw_node == NULL)
1623                 return (EINVAL);
1624
1625         bzero(&sa, sizeof(sa));
1626         sa.hci_len = sizeof(sa);
1627         sa.hci_family = AF_BLUETOOTH;
1628
1629         mtx_lock(&pcb->pcb_mtx);
1630         strlcpy(sa.hci_node, pcb->addr.hci_node, sizeof(sa.hci_node));
1631         mtx_unlock(&pcb->pcb_mtx);
1632
1633         *nam = sodupsockaddr((struct sockaddr *) &sa, M_WAITOK | M_NULLOK);
1634
1635         return ((*nam == NULL)? ENOMEM : 0);
1636 } /* ng_btsocket_hci_raw_sockaddr */
1637