xref: /freebsd/sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c (revision 7aa383846770374466b1dcb2cefd71bde9acf463)
1 /*
2  * ng_btsocket_hci_raw.c
3  */
4 
5 /*-
6  * Copyright (c) 2001-2002 Maksim Yevmenkin <m_evmenkin@yahoo.com>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * $Id: ng_btsocket_hci_raw.c,v 1.14 2003/09/14 23:29:06 max Exp $
31  * $FreeBSD$
32  */
33 
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/bitstring.h>
37 #include <sys/domain.h>
38 #include <sys/endian.h>
39 #include <sys/errno.h>
40 #include <sys/filedesc.h>
41 #include <sys/ioccom.h>
42 #include <sys/kernel.h>
43 #include <sys/lock.h>
44 #include <sys/malloc.h>
45 #include <sys/mbuf.h>
46 #include <sys/mutex.h>
47 #include <sys/priv.h>
48 #include <sys/protosw.h>
49 #include <sys/queue.h>
50 #include <sys/socket.h>
51 #include <sys/socketvar.h>
52 #include <sys/sysctl.h>
53 #include <sys/taskqueue.h>
54 #include <netgraph/ng_message.h>
55 #include <netgraph/netgraph.h>
56 #include <netgraph/bluetooth/include/ng_bluetooth.h>
57 #include <netgraph/bluetooth/include/ng_hci.h>
58 #include <netgraph/bluetooth/include/ng_l2cap.h>
59 #include <netgraph/bluetooth/include/ng_btsocket.h>
60 #include <netgraph/bluetooth/include/ng_btsocket_hci_raw.h>
61 
62 /* MALLOC define */
63 #ifdef NG_SEPARATE_MALLOC
64 MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_HCI_RAW, "netgraph_btsocks_hci_raw",
65 	"Netgraph Bluetooth raw HCI sockets");
66 #else
67 #define M_NETGRAPH_BTSOCKET_HCI_RAW M_NETGRAPH
68 #endif /* NG_SEPARATE_MALLOC */
69 
70 /* Netgraph node methods */
71 static ng_constructor_t	ng_btsocket_hci_raw_node_constructor;
72 static ng_rcvmsg_t	ng_btsocket_hci_raw_node_rcvmsg;
73 static ng_shutdown_t	ng_btsocket_hci_raw_node_shutdown;
74 static ng_newhook_t	ng_btsocket_hci_raw_node_newhook;
75 static ng_connect_t	ng_btsocket_hci_raw_node_connect;
76 static ng_rcvdata_t	ng_btsocket_hci_raw_node_rcvdata;
77 static ng_disconnect_t	ng_btsocket_hci_raw_node_disconnect;
78 
79 static void 		ng_btsocket_hci_raw_input (void *, int);
80 static void 		ng_btsocket_hci_raw_output(node_p, hook_p, void *, int);
81 static void		ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p,
82 						   struct mbuf **,
83 						   struct mbuf *);
84 static int		ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p,
85 						   struct mbuf *, int);
86 
87 #define ng_btsocket_hci_raw_wakeup_input_task() \
88 	taskqueue_enqueue(taskqueue_swi, &ng_btsocket_hci_raw_task)
89 
90 /* Security filter */
91 struct ng_btsocket_hci_raw_sec_filter {
92 	bitstr_t	bit_decl(events, 0xff);
93 	bitstr_t	bit_decl(commands[0x3f], 0x3ff);
94 };
95 
96 /* Netgraph type descriptor */
97 static struct ng_type typestruct = {
98 	.version =	NG_ABI_VERSION,
99 	.name =		NG_BTSOCKET_HCI_RAW_NODE_TYPE,
100 	.constructor =	ng_btsocket_hci_raw_node_constructor,
101 	.rcvmsg =	ng_btsocket_hci_raw_node_rcvmsg,
102 	.shutdown =	ng_btsocket_hci_raw_node_shutdown,
103 	.newhook =	ng_btsocket_hci_raw_node_newhook,
104 	.connect =	ng_btsocket_hci_raw_node_connect,
105 	.rcvdata =	ng_btsocket_hci_raw_node_rcvdata,
106 	.disconnect =	ng_btsocket_hci_raw_node_disconnect,
107 };
108 
109 /* Globals */
110 static u_int32_t				ng_btsocket_hci_raw_debug_level;
111 static u_int32_t				ng_btsocket_hci_raw_ioctl_timeout;
112 static node_p					ng_btsocket_hci_raw_node;
113 static struct ng_bt_itemq			ng_btsocket_hci_raw_queue;
114 static struct mtx				ng_btsocket_hci_raw_queue_mtx;
115 static struct task				ng_btsocket_hci_raw_task;
116 static LIST_HEAD(, ng_btsocket_hci_raw_pcb)	ng_btsocket_hci_raw_sockets;
117 static struct mtx				ng_btsocket_hci_raw_sockets_mtx;
118 static u_int32_t				ng_btsocket_hci_raw_token;
119 static struct mtx				ng_btsocket_hci_raw_token_mtx;
120 static struct ng_btsocket_hci_raw_sec_filter	*ng_btsocket_hci_raw_sec_filter;
121 static struct timeval				ng_btsocket_hci_raw_lasttime;
122 static int					ng_btsocket_hci_raw_curpps;
123 
124 /* Sysctl tree */
125 SYSCTL_DECL(_net_bluetooth_hci_sockets);
126 SYSCTL_NODE(_net_bluetooth_hci_sockets, OID_AUTO, raw, CTLFLAG_RW,
127         0, "Bluetooth raw HCI sockets family");
128 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, debug_level, CTLFLAG_RW,
129         &ng_btsocket_hci_raw_debug_level, NG_BTSOCKET_WARN_LEVEL,
130 	"Bluetooth raw HCI sockets debug level");
131 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, ioctl_timeout, CTLFLAG_RW,
132         &ng_btsocket_hci_raw_ioctl_timeout, 5,
133 	"Bluetooth raw HCI sockets ioctl timeout");
134 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_len, CTLFLAG_RD,
135         &ng_btsocket_hci_raw_queue.len, 0,
136         "Bluetooth raw HCI sockets input queue length");
137 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_maxlen, CTLFLAG_RD,
138         &ng_btsocket_hci_raw_queue.maxlen, 0,
139         "Bluetooth raw HCI sockets input queue max. length");
140 SYSCTL_INT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_drops, CTLFLAG_RD,
141         &ng_btsocket_hci_raw_queue.drops, 0,
142         "Bluetooth raw HCI sockets input queue drops");
143 
144 /* Debug */
145 #define NG_BTSOCKET_HCI_RAW_INFO \
146 	if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_INFO_LEVEL && \
147 	    ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
148 		printf
149 
150 #define NG_BTSOCKET_HCI_RAW_WARN \
151 	if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_WARN_LEVEL && \
152 	    ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
153 		printf
154 
155 #define NG_BTSOCKET_HCI_RAW_ERR \
156 	if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ERR_LEVEL && \
157 	    ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
158 		printf
159 
160 #define NG_BTSOCKET_HCI_RAW_ALERT \
161 	if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ALERT_LEVEL && \
162 	    ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
163 		printf
164 
165 /****************************************************************************
166  ****************************************************************************
167  **                          Netgraph specific
168  ****************************************************************************
169  ****************************************************************************/
170 
171 /*
172  * Netgraph node constructor. Do not allow to create node of this type.
173  */
174 
175 static int
176 ng_btsocket_hci_raw_node_constructor(node_p node)
177 {
178 	return (EINVAL);
179 } /* ng_btsocket_hci_raw_node_constructor */
180 
181 /*
182  * Netgraph node destructor. Just let old node go and create new fresh one.
183  */
184 
185 static int
186 ng_btsocket_hci_raw_node_shutdown(node_p node)
187 {
188 	int	error = 0;
189 
190 	NG_NODE_UNREF(node);
191 
192 	error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
193 	if (error  != 0) {
194 		NG_BTSOCKET_HCI_RAW_ALERT(
195 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
196 
197 		ng_btsocket_hci_raw_node = NULL;
198 
199 		return (ENOMEM);
200         }
201 
202 	error = ng_name_node(ng_btsocket_hci_raw_node,
203 				NG_BTSOCKET_HCI_RAW_NODE_TYPE);
204 	if (error != 0) {
205 		NG_BTSOCKET_HCI_RAW_ALERT(
206 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
207 
208 		NG_NODE_UNREF(ng_btsocket_hci_raw_node);
209 		ng_btsocket_hci_raw_node = NULL;
210 
211 		return (EINVAL);
212 	}
213 
214 	return (0);
215 } /* ng_btsocket_hci_raw_node_shutdown */
216 
217 /*
218  * Create new hook. Just say "yes"
219  */
220 
221 static int
222 ng_btsocket_hci_raw_node_newhook(node_p node, hook_p hook, char const *name)
223 {
224 	return (0);
225 } /* ng_btsocket_hci_raw_node_newhook */
226 
227 /*
228  * Connect hook. Just say "yes"
229  */
230 
231 static int
232 ng_btsocket_hci_raw_node_connect(hook_p hook)
233 {
234 	return (0);
235 } /* ng_btsocket_hci_raw_node_connect */
236 
237 /*
238  * Disconnect hook
239  */
240 
241 static int
242 ng_btsocket_hci_raw_node_disconnect(hook_p hook)
243 {
244 	return (0);
245 } /* ng_btsocket_hci_raw_node_disconnect */
246 
247 /*
248  * Receive control message.
249  * Make sure it is a message from HCI node and it is a response.
250  * Enqueue item and schedule input task.
251  */
252 
253 static int
254 ng_btsocket_hci_raw_node_rcvmsg(node_p node, item_p item, hook_p lasthook)
255 {
256 	struct ng_mesg	*msg = NGI_MSG(item); /* item still has message */
257 	int		 error = 0;
258 
259 	/*
260 	 * Check for empty sockets list creates LOR when both sender and
261 	 * receiver device are connected to the same host, so remove it
262 	 * for now
263 	 */
264 
265 	if (msg != NULL &&
266 	    (msg->header.typecookie == NGM_HCI_COOKIE ||
267 	     msg->header.typecookie == NGM_GENERIC_COOKIE) &&
268 	    msg->header.flags & NGF_RESP) {
269 		if (msg->header.token == 0) {
270 			NG_FREE_ITEM(item);
271 			return (0);
272 		}
273 
274 		mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
275 		if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
276 			NG_BTSOCKET_HCI_RAW_ERR(
277 "%s: Input queue is full\n", __func__);
278 
279 			NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
280 			NG_FREE_ITEM(item);
281 			error = ENOBUFS;
282 		} else {
283 			NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
284 			error = ng_btsocket_hci_raw_wakeup_input_task();
285 		}
286 		mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
287 	} else {
288 		NG_FREE_ITEM(item);
289 		error = EINVAL;
290 	}
291 
292 	return (error);
293 } /* ng_btsocket_hci_raw_node_rcvmsg */
294 
295 /*
296  * Receive packet from the one of our hook.
297  * Prepend every packet with sockaddr_hci and record sender's node name.
298  * Enqueue item and schedule input task.
299  */
300 
301 static int
302 ng_btsocket_hci_raw_node_rcvdata(hook_p hook, item_p item)
303 {
304 	struct mbuf	*nam = NULL;
305 	int		 error;
306 
307 	/*
308 	 * Check for empty sockets list creates LOR when both sender and
309 	 * receiver device are connected to the same host, so remove it
310 	 * for now
311 	 */
312 
313 	MGET(nam, M_DONTWAIT, MT_SONAME);
314 	if (nam != NULL) {
315 		struct sockaddr_hci	*sa = mtod(nam, struct sockaddr_hci *);
316 
317 		nam->m_len = sizeof(struct sockaddr_hci);
318 
319 		sa->hci_len = sizeof(*sa);
320 		sa->hci_family = AF_BLUETOOTH;
321 		strlcpy(sa->hci_node, NG_PEER_NODE_NAME(hook),
322 			sizeof(sa->hci_node));
323 
324 		NGI_GET_M(item, nam->m_next);
325 		NGI_M(item) = nam;
326 
327 		mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
328 		if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
329 			NG_BTSOCKET_HCI_RAW_ERR(
330 "%s: Input queue is full\n", __func__);
331 
332 			NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
333 			NG_FREE_ITEM(item);
334 			error = ENOBUFS;
335 		} else {
336 			NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
337 			error = ng_btsocket_hci_raw_wakeup_input_task();
338 		}
339 		mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
340 	} else {
341 		NG_BTSOCKET_HCI_RAW_ERR(
342 "%s: Failed to allocate address mbuf\n", __func__);
343 
344 		NG_FREE_ITEM(item);
345 		error = ENOBUFS;
346 	}
347 
348 	return (error);
349 } /* ng_btsocket_hci_raw_node_rcvdata */
350 
351 /****************************************************************************
352  ****************************************************************************
353  **                              Sockets specific
354  ****************************************************************************
355  ****************************************************************************/
356 
357 /*
358  * Get next token. We need token to avoid theoretical race where process
359  * submits ioctl() message then interrupts ioctl() and re-submits another
360  * ioctl() on the same socket *before* first ioctl() complete.
361  */
362 
363 static void
364 ng_btsocket_hci_raw_get_token(u_int32_t *token)
365 {
366 	mtx_lock(&ng_btsocket_hci_raw_token_mtx);
367 
368 	if (++ ng_btsocket_hci_raw_token == 0)
369 		ng_btsocket_hci_raw_token = 1;
370 
371 	*token = ng_btsocket_hci_raw_token;
372 
373 	mtx_unlock(&ng_btsocket_hci_raw_token_mtx);
374 } /* ng_btsocket_hci_raw_get_token */
375 
376 /*
377  * Send Netgraph message to the node - do not expect reply
378  */
379 
380 static int
381 ng_btsocket_hci_raw_send_ngmsg(char *path, int cmd, void *arg, int arglen)
382 {
383 	struct ng_mesg	*msg = NULL;
384 	int		 error = 0;
385 
386 	NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, arglen, M_NOWAIT);
387 	if (msg == NULL)
388 		return (ENOMEM);
389 
390 	if (arg != NULL && arglen > 0)
391 		bcopy(arg, msg->data, arglen);
392 
393 	NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
394 
395 	return (error);
396 } /* ng_btsocket_hci_raw_send_ngmsg */
397 
398 /*
399  * Send Netgraph message to the node (no data) and wait for reply
400  */
401 
402 static int
403 ng_btsocket_hci_raw_send_sync_ngmsg(ng_btsocket_hci_raw_pcb_p pcb, char *path,
404 		int cmd, void *rsp, int rsplen)
405 {
406 	struct ng_mesg	*msg = NULL;
407 	int		 error = 0;
408 
409 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
410 
411 	NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, 0, M_NOWAIT);
412 	if (msg == NULL)
413 		return (ENOMEM);
414 
415 	ng_btsocket_hci_raw_get_token(&msg->header.token);
416 	pcb->token = msg->header.token;
417 	pcb->msg = NULL;
418 
419 	NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
420 	if (error != 0) {
421 		pcb->token = 0;
422 		return (error);
423 	}
424 
425 	error = msleep(&pcb->msg, &pcb->pcb_mtx, PZERO|PCATCH, "hcictl",
426 			ng_btsocket_hci_raw_ioctl_timeout * hz);
427 	pcb->token = 0;
428 
429 	if (error != 0)
430 		return (error);
431 
432 	if (pcb->msg != NULL && pcb->msg->header.cmd == cmd)
433 		bcopy(pcb->msg->data, rsp, rsplen);
434 	else
435 		error = EINVAL;
436 
437 	NG_FREE_MSG(pcb->msg); /* checks for != NULL */
438 
439 	return (0);
440 } /* ng_btsocket_hci_raw_send_sync_ngmsg */
441 
442 /*
443  * Create control information for the packet
444  */
445 
446 static void
447 ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf **ctl,
448 		struct mbuf *m)
449 {
450 	int		dir;
451 	struct timeval	tv;
452 
453 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
454 
455 	if (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION) {
456 		dir = (m->m_flags & M_PROTO1)? 1 : 0;
457 		*ctl = sbcreatecontrol((caddr_t) &dir, sizeof(dir),
458 					SCM_HCI_RAW_DIRECTION, SOL_HCI_RAW);
459 		if (*ctl != NULL)
460 			ctl = &((*ctl)->m_next);
461 	}
462 
463 	if (pcb->so->so_options & SO_TIMESTAMP) {
464 		microtime(&tv);
465 		*ctl = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
466 					SCM_TIMESTAMP, SOL_SOCKET);
467 		if (*ctl != NULL)
468 			ctl = &((*ctl)->m_next);
469 	}
470 } /* ng_btsocket_hci_raw_savctl */
471 
472 /*
473  * Raw HCI sockets data input routine
474  */
475 
476 static void
477 ng_btsocket_hci_raw_data_input(struct mbuf *nam)
478 {
479 	ng_btsocket_hci_raw_pcb_p	 pcb = NULL;
480 	struct mbuf			*m0 = NULL, *m = NULL;
481 	struct sockaddr_hci		*sa = NULL;
482 
483 	m0 = nam->m_next;
484 	nam->m_next = NULL;
485 
486 	KASSERT((nam->m_type == MT_SONAME),
487 		("%s: m_type=%d\n", __func__, nam->m_type));
488 	KASSERT((m0->m_flags & M_PKTHDR),
489 		("%s: m_flags=%#x\n", __func__, m0->m_flags));
490 
491 	sa = mtod(nam, struct sockaddr_hci *);
492 
493 	mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
494 
495 	LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
496 
497 		mtx_lock(&pcb->pcb_mtx);
498 
499 		/*
500 		 * If socket was bound then check address and
501 		 *  make sure it matches.
502 		 */
503 
504 		if (pcb->addr.hci_node[0] != 0 &&
505 		    strcmp(sa->hci_node, pcb->addr.hci_node) != 0)
506 			goto next;
507 
508 		/*
509 		 * Check packet against filters
510 		 * XXX do we have to call m_pullup() here?
511 		 */
512 
513 		if (ng_btsocket_hci_raw_filter(pcb, m0, 1) != 0)
514 			goto next;
515 
516 		/*
517 		 * Make a copy of the packet, append to the socket's
518 		 * receive queue and wakeup socket. sbappendaddr()
519 		 * will check if socket has enough buffer space.
520 		 */
521 
522 		m = m_dup(m0, M_DONTWAIT);
523 		if (m != NULL) {
524 			struct mbuf	*ctl = NULL;
525 
526 			ng_btsocket_hci_raw_savctl(pcb, &ctl, m);
527 
528 			if (sbappendaddr(&pcb->so->so_rcv,
529 					(struct sockaddr *) sa, m, ctl))
530 				sorwakeup(pcb->so);
531 			else {
532 				NG_BTSOCKET_HCI_RAW_INFO(
533 "%s: sbappendaddr() failed\n", __func__);
534 
535 				NG_FREE_M(m);
536 				NG_FREE_M(ctl);
537 			}
538 		}
539 next:
540 		mtx_unlock(&pcb->pcb_mtx);
541 	}
542 
543 	mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
544 
545 	NG_FREE_M(nam);
546 	NG_FREE_M(m0);
547 } /* ng_btsocket_hci_raw_data_input */
548 
549 /*
550  * Raw HCI sockets message input routine
551  */
552 
553 static void
554 ng_btsocket_hci_raw_msg_input(struct ng_mesg *msg)
555 {
556 	ng_btsocket_hci_raw_pcb_p	pcb = NULL;
557 
558 	mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
559 
560 	LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
561 		mtx_lock(&pcb->pcb_mtx);
562 
563 		if (msg->header.token == pcb->token) {
564 			pcb->msg = msg;
565 			wakeup(&pcb->msg);
566 
567 			mtx_unlock(&pcb->pcb_mtx);
568 			mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
569 
570 			return;
571 		}
572 
573 		mtx_unlock(&pcb->pcb_mtx);
574 	}
575 
576 	mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
577 
578 	NG_FREE_MSG(msg); /* checks for != NULL */
579 } /* ng_btsocket_hci_raw_msg_input */
580 
581 /*
582  * Raw HCI sockets input routines
583  */
584 
585 static void
586 ng_btsocket_hci_raw_input(void *context, int pending)
587 {
588 	item_p	item = NULL;
589 
590 	for (;;) {
591 		mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
592 		NG_BT_ITEMQ_DEQUEUE(&ng_btsocket_hci_raw_queue, item);
593 		mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
594 
595 		if (item == NULL)
596 			break;
597 
598 		switch(item->el_flags & NGQF_TYPE) {
599 		case NGQF_DATA: {
600 			struct mbuf	*m = NULL;
601 
602 			NGI_GET_M(item, m);
603 			ng_btsocket_hci_raw_data_input(m);
604 			} break;
605 
606 		case NGQF_MESG: {
607 			struct ng_mesg	*msg = NULL;
608 
609 			NGI_GET_MSG(item, msg);
610 			ng_btsocket_hci_raw_msg_input(msg);
611 			} break;
612 
613 		default:
614 			KASSERT(0,
615 ("%s: invalid item type=%ld\n", __func__, (item->el_flags & NGQF_TYPE)));
616 			break;
617 		}
618 
619 		NG_FREE_ITEM(item);
620 	}
621 } /* ng_btsocket_hci_raw_input */
622 
623 /*
624  * Raw HCI sockets output routine
625  */
626 
627 static void
628 ng_btsocket_hci_raw_output(node_p node, hook_p hook, void *arg1, int arg2)
629 {
630 	struct mbuf		*nam = (struct mbuf *) arg1, *m = NULL;
631 	struct sockaddr_hci	*sa = NULL;
632 	int			 error;
633 
634 	m = nam->m_next;
635 	nam->m_next = NULL;
636 
637 	KASSERT((nam->m_type == MT_SONAME),
638 		("%s: m_type=%d\n", __func__, nam->m_type));
639 	KASSERT((m->m_flags & M_PKTHDR),
640 		("%s: m_flags=%#x\n", __func__, m->m_flags));
641 
642 	sa = mtod(nam, struct sockaddr_hci *);
643 
644 	/*
645 	 * Find downstream hook
646 	 * XXX For now access node hook list directly. Should be safe because
647 	 * we used ng_send_fn() and we should have exclusive lock on the node.
648 	 */
649 
650 	LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
651 		if (hook == NULL || NG_HOOK_NOT_VALID(hook) ||
652 		    NG_NODE_NOT_VALID(NG_PEER_NODE(hook)))
653 			continue;
654 
655 		if (strcmp(sa->hci_node, NG_PEER_NODE_NAME(hook)) == 0) {
656 			NG_SEND_DATA_ONLY(error, hook, m); /* sets m to NULL */
657 			break;
658 		}
659 	}
660 
661 	NG_FREE_M(nam); /* check for != NULL */
662 	NG_FREE_M(m);
663 } /* ng_btsocket_hci_raw_output */
664 
665 /*
666  * Check frame against security and socket filters.
667  * d (direction bit) == 1 means incoming frame.
668  */
669 
670 static int
671 ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf *m, int d)
672 {
673 	int	type, event, opcode;
674 
675 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
676 
677 	switch ((type = *mtod(m, u_int8_t *))) {
678 	case NG_HCI_CMD_PKT:
679 		if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)) {
680 			opcode = le16toh(mtod(m, ng_hci_cmd_pkt_t *)->opcode);
681 
682 			if (!bit_test(
683 ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF(opcode) - 1],
684 NG_HCI_OCF(opcode) - 1))
685 				return (EPERM);
686 		}
687 
688 		if (d && !bit_test(pcb->filter.packet_mask, NG_HCI_CMD_PKT - 1))
689 			return (EPERM);
690 		break;
691 
692 	case NG_HCI_ACL_DATA_PKT:
693 	case NG_HCI_SCO_DATA_PKT:
694 		if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED) ||
695 		    !bit_test(pcb->filter.packet_mask, type - 1) ||
696 		    !d)
697 			return (EPERM);
698 		break;
699 
700 	case NG_HCI_EVENT_PKT:
701 		if (!d)
702 			return (EINVAL);
703 
704 		event = mtod(m, ng_hci_event_pkt_t *)->event - 1;
705 
706 		if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED))
707 			if (!bit_test(ng_btsocket_hci_raw_sec_filter->events, event))
708 				return (EPERM);
709 
710 		if (!bit_test(pcb->filter.event_mask, event))
711 			return (EPERM);
712 		break;
713 
714 	default:
715 		return (EINVAL);
716 	}
717 
718 	return (0);
719 } /* ng_btsocket_hci_raw_filter */
720 
721 /*
722  * Initialize everything
723  */
724 
725 void
726 ng_btsocket_hci_raw_init(void)
727 {
728 	bitstr_t	*f = NULL;
729 	int		 error = 0;
730 
731 	ng_btsocket_hci_raw_node = NULL;
732 	ng_btsocket_hci_raw_debug_level = NG_BTSOCKET_WARN_LEVEL;
733 	ng_btsocket_hci_raw_ioctl_timeout = 5;
734 
735 	/* Register Netgraph node type */
736 	error = ng_newtype(&typestruct);
737 	if (error != 0) {
738 		NG_BTSOCKET_HCI_RAW_ALERT(
739 "%s: Could not register Netgraph node type, error=%d\n", __func__, error);
740 
741 		return;
742 	}
743 
744 	/* Create Netgrapg node */
745 	error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
746 	if (error != 0) {
747 		NG_BTSOCKET_HCI_RAW_ALERT(
748 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
749 
750 		ng_btsocket_hci_raw_node = NULL;
751 
752 		return;
753         }
754 
755 	error = ng_name_node(ng_btsocket_hci_raw_node,
756 				NG_BTSOCKET_HCI_RAW_NODE_TYPE);
757 	if (error != 0) {
758 		NG_BTSOCKET_HCI_RAW_ALERT(
759 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
760 
761 		NG_NODE_UNREF(ng_btsocket_hci_raw_node);
762 		ng_btsocket_hci_raw_node = NULL;
763 
764 		return;
765 	}
766 
767 	/* Create input queue */
768 	NG_BT_ITEMQ_INIT(&ng_btsocket_hci_raw_queue, 300);
769 	mtx_init(&ng_btsocket_hci_raw_queue_mtx,
770 		"btsocks_hci_raw_queue_mtx", NULL, MTX_DEF);
771 	TASK_INIT(&ng_btsocket_hci_raw_task, 0,
772 		ng_btsocket_hci_raw_input, NULL);
773 
774 	/* Create list of sockets */
775 	LIST_INIT(&ng_btsocket_hci_raw_sockets);
776 	mtx_init(&ng_btsocket_hci_raw_sockets_mtx,
777 		"btsocks_hci_raw_sockets_mtx", NULL, MTX_DEF);
778 
779 	/* Tokens */
780 	ng_btsocket_hci_raw_token = 0;
781 	mtx_init(&ng_btsocket_hci_raw_token_mtx,
782 		"btsocks_hci_raw_token_mtx", NULL, MTX_DEF);
783 
784 	/*
785 	 * Security filter
786 	 * XXX never free()ed
787 	 */
788 	ng_btsocket_hci_raw_sec_filter =
789 	    malloc(sizeof(struct ng_btsocket_hci_raw_sec_filter),
790 		M_NETGRAPH_BTSOCKET_HCI_RAW, M_NOWAIT|M_ZERO);
791 	if (ng_btsocket_hci_raw_sec_filter == NULL) {
792 		printf("%s: Could not allocate security filter!\n", __func__);
793 		return;
794 	}
795 
796 	/*
797 	 * XXX How paranoid can we get?
798 	 *
799 	 * Initialize security filter. If bit is set in the mask then
800 	 * unprivileged socket is allowed to send (receive) this command
801 	 * (event).
802 	 */
803 
804 	/* Enable all events */
805 	memset(&ng_btsocket_hci_raw_sec_filter->events, 0xff,
806 		sizeof(ng_btsocket_hci_raw_sec_filter->events)/
807 			sizeof(ng_btsocket_hci_raw_sec_filter->events[0]));
808 
809 	/* Disable some critical events */
810 	f = ng_btsocket_hci_raw_sec_filter->events;
811 	bit_clear(f, NG_HCI_EVENT_RETURN_LINK_KEYS - 1);
812 	bit_clear(f, NG_HCI_EVENT_LINK_KEY_NOTIFICATION - 1);
813 	bit_clear(f, NG_HCI_EVENT_VENDOR - 1);
814 
815 	/* Commands - Link control */
816 	f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_CONTROL-1];
817 	bit_set(f, NG_HCI_OCF_INQUIRY - 1);
818 	bit_set(f, NG_HCI_OCF_INQUIRY_CANCEL - 1);
819 	bit_set(f, NG_HCI_OCF_PERIODIC_INQUIRY - 1);
820 	bit_set(f, NG_HCI_OCF_EXIT_PERIODIC_INQUIRY - 1);
821 	bit_set(f, NG_HCI_OCF_REMOTE_NAME_REQ - 1);
822 	bit_set(f, NG_HCI_OCF_READ_REMOTE_FEATURES - 1);
823 	bit_set(f, NG_HCI_OCF_READ_REMOTE_VER_INFO - 1);
824 	bit_set(f, NG_HCI_OCF_READ_CLOCK_OFFSET - 1);
825 
826 	/* Commands - Link policy */
827 	f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_POLICY-1];
828 	bit_set(f, NG_HCI_OCF_ROLE_DISCOVERY - 1);
829 	bit_set(f, NG_HCI_OCF_READ_LINK_POLICY_SETTINGS - 1);
830 
831 	/* Commands - Host controller and baseband */
832 	f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_HC_BASEBAND-1];
833 	bit_set(f, NG_HCI_OCF_READ_PIN_TYPE - 1);
834 	bit_set(f, NG_HCI_OCF_READ_LOCAL_NAME - 1);
835 	bit_set(f, NG_HCI_OCF_READ_CON_ACCEPT_TIMO - 1);
836 	bit_set(f, NG_HCI_OCF_READ_PAGE_TIMO - 1);
837 	bit_set(f, NG_HCI_OCF_READ_SCAN_ENABLE - 1);
838 	bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_ACTIVITY - 1);
839 	bit_set(f, NG_HCI_OCF_READ_INQUIRY_SCAN_ACTIVITY - 1);
840 	bit_set(f, NG_HCI_OCF_READ_AUTH_ENABLE - 1);
841 	bit_set(f, NG_HCI_OCF_READ_ENCRYPTION_MODE - 1);
842 	bit_set(f, NG_HCI_OCF_READ_UNIT_CLASS - 1);
843 	bit_set(f, NG_HCI_OCF_READ_VOICE_SETTINGS - 1);
844 	bit_set(f, NG_HCI_OCF_READ_AUTO_FLUSH_TIMO - 1);
845 	bit_set(f, NG_HCI_OCF_READ_NUM_BROADCAST_RETRANS - 1);
846 	bit_set(f, NG_HCI_OCF_READ_HOLD_MODE_ACTIVITY - 1);
847 	bit_set(f, NG_HCI_OCF_READ_XMIT_LEVEL - 1);
848 	bit_set(f, NG_HCI_OCF_READ_SCO_FLOW_CONTROL - 1);
849 	bit_set(f, NG_HCI_OCF_READ_LINK_SUPERVISION_TIMO - 1);
850 	bit_set(f, NG_HCI_OCF_READ_SUPPORTED_IAC_NUM - 1);
851 	bit_set(f, NG_HCI_OCF_READ_IAC_LAP - 1);
852 	bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_PERIOD - 1);
853 	bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN - 1);
854 
855 	/* Commands - Informational */
856 	f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_INFO - 1];
857 	bit_set(f, NG_HCI_OCF_READ_LOCAL_VER - 1);
858 	bit_set(f, NG_HCI_OCF_READ_LOCAL_FEATURES - 1);
859 	bit_set(f, NG_HCI_OCF_READ_BUFFER_SIZE - 1);
860 	bit_set(f, NG_HCI_OCF_READ_COUNTRY_CODE - 1);
861 	bit_set(f, NG_HCI_OCF_READ_BDADDR - 1);
862 
863 	/* Commands - Status */
864 	f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_STATUS - 1];
865 	bit_set(f, NG_HCI_OCF_READ_FAILED_CONTACT_CNTR - 1);
866 	bit_set(f, NG_HCI_OCF_GET_LINK_QUALITY - 1);
867 	bit_set(f, NG_HCI_OCF_READ_RSSI - 1);
868 
869 	/* Commands - Testing */
870 	f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_TESTING - 1];
871 	bit_set(f, NG_HCI_OCF_READ_LOOPBACK_MODE - 1);
872 } /* ng_btsocket_hci_raw_init */
873 
874 /*
875  * Abort connection on socket
876  */
877 
878 void
879 ng_btsocket_hci_raw_abort(struct socket *so)
880 {
881 } /* ng_btsocket_hci_raw_abort */
882 
883 void
884 ng_btsocket_hci_raw_close(struct socket *so)
885 {
886 } /* ng_btsocket_hci_raw_close */
887 
888 /*
889  * Create new raw HCI socket
890  */
891 
892 int
893 ng_btsocket_hci_raw_attach(struct socket *so, int proto, struct thread *td)
894 {
895 	ng_btsocket_hci_raw_pcb_p	pcb = so2hci_raw_pcb(so);
896 	int				error = 0;
897 
898 	if (pcb != NULL)
899 		return (EISCONN);
900 
901 	if (ng_btsocket_hci_raw_node == NULL)
902 		return (EPROTONOSUPPORT);
903 	if (proto != BLUETOOTH_PROTO_HCI)
904 		return (EPROTONOSUPPORT);
905 	if (so->so_type != SOCK_RAW)
906 		return (ESOCKTNOSUPPORT);
907 
908 	error = soreserve(so, NG_BTSOCKET_HCI_RAW_SENDSPACE,
909 				NG_BTSOCKET_HCI_RAW_RECVSPACE);
910 	if (error != 0)
911 		return (error);
912 
913 	pcb = malloc(sizeof(*pcb),
914 		M_NETGRAPH_BTSOCKET_HCI_RAW, M_NOWAIT|M_ZERO);
915 	if (pcb == NULL)
916 		return (ENOMEM);
917 
918 	so->so_pcb = (caddr_t) pcb;
919 	pcb->so = so;
920 
921 	if (priv_check(td, PRIV_NETBLUETOOTH_RAW) == 0)
922 		pcb->flags |= NG_BTSOCKET_HCI_RAW_PRIVILEGED;
923 
924 	/*
925 	 * Set default socket filter. By default socket only accepts HCI
926 	 * Command_Complete and Command_Status event packets.
927 	 */
928 
929 	bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_COMPL - 1);
930 	bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_STATUS - 1);
931 
932 	mtx_init(&pcb->pcb_mtx, "btsocks_hci_raw_pcb_mtx", NULL, MTX_DEF);
933 
934 	mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
935 	LIST_INSERT_HEAD(&ng_btsocket_hci_raw_sockets, pcb, next);
936 	mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
937 
938 	return (0);
939 } /* ng_btsocket_hci_raw_attach */
940 
941 /*
942  * Bind raw HCI socket
943  */
944 
945 int
946 ng_btsocket_hci_raw_bind(struct socket *so, struct sockaddr *nam,
947 		struct thread *td)
948 {
949 	ng_btsocket_hci_raw_pcb_p	 pcb = so2hci_raw_pcb(so);
950 	struct sockaddr_hci		*sa = (struct sockaddr_hci *) nam;
951 
952 	if (pcb == NULL)
953 		return (EINVAL);
954 	if (ng_btsocket_hci_raw_node == NULL)
955 		return (EINVAL);
956 
957 	if (sa == NULL)
958 		return (EINVAL);
959 	if (sa->hci_family != AF_BLUETOOTH)
960 		return (EAFNOSUPPORT);
961 	if (sa->hci_len != sizeof(*sa))
962 		return (EINVAL);
963 	if (sa->hci_node[0] == 0)
964 		return (EINVAL);
965 
966 	mtx_lock(&pcb->pcb_mtx);
967 	bcopy(sa, &pcb->addr, sizeof(pcb->addr));
968 	mtx_unlock(&pcb->pcb_mtx);
969 
970 	return (0);
971 } /* ng_btsocket_hci_raw_bind */
972 
973 /*
974  * Connect raw HCI socket
975  */
976 
977 int
978 ng_btsocket_hci_raw_connect(struct socket *so, struct sockaddr *nam,
979 		struct thread *td)
980 {
981 	ng_btsocket_hci_raw_pcb_p	 pcb = so2hci_raw_pcb(so);
982 	struct sockaddr_hci		*sa = (struct sockaddr_hci *) nam;
983 
984 	if (pcb == NULL)
985 		return (EINVAL);
986 	if (ng_btsocket_hci_raw_node == NULL)
987 		return (EINVAL);
988 
989 	if (sa == NULL)
990 		return (EINVAL);
991 	if (sa->hci_family != AF_BLUETOOTH)
992 		return (EAFNOSUPPORT);
993 	if (sa->hci_len != sizeof(*sa))
994 		return (EINVAL);
995 	if (sa->hci_node[0] == 0)
996 		return (EDESTADDRREQ);
997 
998 	mtx_lock(&pcb->pcb_mtx);
999 
1000 	if (bcmp(sa, &pcb->addr, sizeof(pcb->addr)) != 0) {
1001 		mtx_unlock(&pcb->pcb_mtx);
1002 		return (EADDRNOTAVAIL);
1003 	}
1004 
1005 	soisconnected(so);
1006 
1007 	mtx_unlock(&pcb->pcb_mtx);
1008 
1009 	return (0);
1010 } /* ng_btsocket_hci_raw_connect */
1011 
1012 /*
1013  * Process ioctl on socket
1014  */
1015 
1016 int
1017 ng_btsocket_hci_raw_control(struct socket *so, u_long cmd, caddr_t data,
1018 		struct ifnet *ifp, struct thread *td)
1019 {
1020 	ng_btsocket_hci_raw_pcb_p	 pcb = so2hci_raw_pcb(so);
1021 	char				 path[NG_NODESIZ + 1];
1022 	struct ng_mesg			*msg = NULL;
1023 	int				 error = 0;
1024 
1025 	if (pcb == NULL)
1026 		return (EINVAL);
1027 	if (ng_btsocket_hci_raw_node == NULL)
1028 		return (EINVAL);
1029 
1030 	mtx_lock(&pcb->pcb_mtx);
1031 
1032 	/* Check if we have device name */
1033 	if (pcb->addr.hci_node[0] == 0) {
1034 		mtx_unlock(&pcb->pcb_mtx);
1035 		return (EHOSTUNREACH);
1036 	}
1037 
1038 	/* Check if we have pending ioctl() */
1039 	if (pcb->token != 0) {
1040 		mtx_unlock(&pcb->pcb_mtx);
1041 		return (EBUSY);
1042 	}
1043 
1044 	snprintf(path, sizeof(path), "%s:", pcb->addr.hci_node);
1045 
1046 	switch (cmd) {
1047 	case SIOC_HCI_RAW_NODE_GET_STATE: {
1048 		struct ng_btsocket_hci_raw_node_state	*p =
1049 			(struct ng_btsocket_hci_raw_node_state *) data;
1050 
1051 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1052 				NGM_HCI_NODE_GET_STATE,
1053 				&p->state, sizeof(p->state));
1054 		} break;
1055 
1056 	case SIOC_HCI_RAW_NODE_INIT:
1057 		if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1058 			error = ng_btsocket_hci_raw_send_ngmsg(path,
1059 					NGM_HCI_NODE_INIT, NULL, 0);
1060 		else
1061 			error = EPERM;
1062 		break;
1063 
1064 	case SIOC_HCI_RAW_NODE_GET_DEBUG: {
1065 		struct ng_btsocket_hci_raw_node_debug	*p =
1066 			(struct ng_btsocket_hci_raw_node_debug *) data;
1067 
1068 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1069 				NGM_HCI_NODE_GET_DEBUG,
1070 				&p->debug, sizeof(p->debug));
1071 		} break;
1072 
1073 	case SIOC_HCI_RAW_NODE_SET_DEBUG: {
1074 		struct ng_btsocket_hci_raw_node_debug	*p =
1075 			(struct ng_btsocket_hci_raw_node_debug *) data;
1076 
1077 		if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1078 			error = ng_btsocket_hci_raw_send_ngmsg(path,
1079 					NGM_HCI_NODE_SET_DEBUG, &p->debug,
1080 					sizeof(p->debug));
1081 		else
1082 			error = EPERM;
1083 		} break;
1084 
1085 	case SIOC_HCI_RAW_NODE_GET_BUFFER: {
1086 		struct ng_btsocket_hci_raw_node_buffer	*p =
1087 			(struct ng_btsocket_hci_raw_node_buffer *) data;
1088 
1089 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1090 				NGM_HCI_NODE_GET_BUFFER,
1091 				&p->buffer, sizeof(p->buffer));
1092 		} break;
1093 
1094 	case SIOC_HCI_RAW_NODE_GET_BDADDR: {
1095 		struct ng_btsocket_hci_raw_node_bdaddr	*p =
1096 			(struct ng_btsocket_hci_raw_node_bdaddr *) data;
1097 
1098 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1099 				NGM_HCI_NODE_GET_BDADDR,
1100 				&p->bdaddr, sizeof(p->bdaddr));
1101 		} break;
1102 
1103 	case SIOC_HCI_RAW_NODE_GET_FEATURES: {
1104 		struct ng_btsocket_hci_raw_node_features	*p =
1105 			(struct ng_btsocket_hci_raw_node_features *) data;
1106 
1107 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1108 				NGM_HCI_NODE_GET_FEATURES,
1109 				&p->features, sizeof(p->features));
1110 		} break;
1111 
1112 	case SIOC_HCI_RAW_NODE_GET_STAT: {
1113 		struct ng_btsocket_hci_raw_node_stat	*p =
1114 			(struct ng_btsocket_hci_raw_node_stat *) data;
1115 
1116 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1117 				NGM_HCI_NODE_GET_STAT,
1118 				&p->stat, sizeof(p->stat));
1119 		} break;
1120 
1121 	case SIOC_HCI_RAW_NODE_RESET_STAT:
1122 		if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1123 			error = ng_btsocket_hci_raw_send_ngmsg(path,
1124 					NGM_HCI_NODE_RESET_STAT, NULL, 0);
1125 		else
1126 			error = EPERM;
1127 		break;
1128 
1129 	case SIOC_HCI_RAW_NODE_FLUSH_NEIGHBOR_CACHE:
1130 		if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1131 			error = ng_btsocket_hci_raw_send_ngmsg(path,
1132 					NGM_HCI_NODE_FLUSH_NEIGHBOR_CACHE,
1133 					NULL, 0);
1134 		else
1135 			error = EPERM;
1136 		break;
1137 
1138 	case SIOC_HCI_RAW_NODE_GET_NEIGHBOR_CACHE:  {
1139 		struct ng_btsocket_hci_raw_node_neighbor_cache	*p =
1140 			(struct ng_btsocket_hci_raw_node_neighbor_cache *) data;
1141 		ng_hci_node_get_neighbor_cache_ep		*p1 = NULL;
1142 		ng_hci_node_neighbor_cache_entry_ep		*p2 = NULL;
1143 
1144 		if (p->num_entries <= 0 ||
1145 		    p->num_entries > NG_HCI_MAX_NEIGHBOR_NUM ||
1146 		    p->entries == NULL) {
1147 			error = EINVAL;
1148 			break;
1149 		}
1150 
1151 		NG_MKMESSAGE(msg, NGM_HCI_COOKIE,
1152 			NGM_HCI_NODE_GET_NEIGHBOR_CACHE, 0, M_NOWAIT);
1153 		if (msg == NULL) {
1154 			error = ENOMEM;
1155 			break;
1156 		}
1157 		ng_btsocket_hci_raw_get_token(&msg->header.token);
1158 		pcb->token = msg->header.token;
1159 		pcb->msg = NULL;
1160 
1161 		NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1162 		if (error != 0) {
1163 			pcb->token = 0;
1164 			break;
1165 		}
1166 
1167 		error = msleep(&pcb->msg, &pcb->pcb_mtx,
1168 				PZERO|PCATCH, "hcictl",
1169 				ng_btsocket_hci_raw_ioctl_timeout * hz);
1170 		pcb->token = 0;
1171 
1172 		if (error != 0)
1173 			break;
1174 
1175 		if (pcb->msg != NULL &&
1176 		    pcb->msg->header.cmd == NGM_HCI_NODE_GET_NEIGHBOR_CACHE) {
1177 			/* Return data back to user space */
1178 			p1 = (ng_hci_node_get_neighbor_cache_ep *)
1179 				(pcb->msg->data);
1180 			p2 = (ng_hci_node_neighbor_cache_entry_ep *)
1181 				(p1 + 1);
1182 
1183 			p->num_entries = min(p->num_entries, p1->num_entries);
1184 			if (p->num_entries > 0)
1185 				error = copyout((caddr_t) p2,
1186 						(caddr_t) p->entries,
1187 						p->num_entries * sizeof(*p2));
1188 		} else
1189 			error = EINVAL;
1190 
1191 		NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1192 		}break;
1193 
1194 	case SIOC_HCI_RAW_NODE_GET_CON_LIST: {
1195 		struct ng_btsocket_hci_raw_con_list	*p =
1196 			(struct ng_btsocket_hci_raw_con_list *) data;
1197 		ng_hci_node_con_list_ep			*p1 = NULL;
1198 		ng_hci_node_con_ep			*p2 = NULL;
1199 
1200 		if (p->num_connections == 0 ||
1201 		    p->num_connections > NG_HCI_MAX_CON_NUM ||
1202 		    p->connections == NULL) {
1203 			error = EINVAL;
1204 			break;
1205 		}
1206 
1207 		NG_MKMESSAGE(msg, NGM_HCI_COOKIE, NGM_HCI_NODE_GET_CON_LIST,
1208 			0, M_NOWAIT);
1209 		if (msg == NULL) {
1210 			error = ENOMEM;
1211 			break;
1212 		}
1213 		ng_btsocket_hci_raw_get_token(&msg->header.token);
1214 		pcb->token = msg->header.token;
1215 		pcb->msg = NULL;
1216 
1217 		NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1218 		if (error != 0) {
1219 			pcb->token = 0;
1220 			break;
1221 		}
1222 
1223 		error = msleep(&pcb->msg, &pcb->pcb_mtx,
1224 				PZERO|PCATCH, "hcictl",
1225 				ng_btsocket_hci_raw_ioctl_timeout * hz);
1226 		pcb->token = 0;
1227 
1228 		if (error != 0)
1229 			break;
1230 
1231 		if (pcb->msg != NULL &&
1232 		    pcb->msg->header.cmd == NGM_HCI_NODE_GET_CON_LIST) {
1233 			/* Return data back to user space */
1234 			p1 = (ng_hci_node_con_list_ep *)(pcb->msg->data);
1235 			p2 = (ng_hci_node_con_ep *)(p1 + 1);
1236 
1237 			p->num_connections = min(p->num_connections,
1238 						p1->num_connections);
1239 			if (p->num_connections > 0)
1240 				error = copyout((caddr_t) p2,
1241 					(caddr_t) p->connections,
1242 					p->num_connections * sizeof(*p2));
1243 		} else
1244 			error = EINVAL;
1245 
1246 		NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1247 		} break;
1248 
1249 	case SIOC_HCI_RAW_NODE_GET_LINK_POLICY_MASK: {
1250 		struct ng_btsocket_hci_raw_node_link_policy_mask	*p =
1251 			(struct ng_btsocket_hci_raw_node_link_policy_mask *)
1252 				data;
1253 
1254 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1255 				NGM_HCI_NODE_GET_LINK_POLICY_SETTINGS_MASK,
1256 				&p->policy_mask, sizeof(p->policy_mask));
1257 		} break;
1258 
1259 	case SIOC_HCI_RAW_NODE_SET_LINK_POLICY_MASK: {
1260 		struct ng_btsocket_hci_raw_node_link_policy_mask	*p =
1261 			(struct ng_btsocket_hci_raw_node_link_policy_mask *)
1262 				data;
1263 
1264 		if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1265 			error = ng_btsocket_hci_raw_send_ngmsg(path,
1266 					NGM_HCI_NODE_SET_LINK_POLICY_SETTINGS_MASK,
1267 					&p->policy_mask,
1268 					sizeof(p->policy_mask));
1269 		else
1270 			error = EPERM;
1271 		} break;
1272 
1273 	case SIOC_HCI_RAW_NODE_GET_PACKET_MASK: {
1274 		struct ng_btsocket_hci_raw_node_packet_mask	*p =
1275 			(struct ng_btsocket_hci_raw_node_packet_mask *) data;
1276 
1277 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1278 				NGM_HCI_NODE_GET_PACKET_MASK,
1279 				&p->packet_mask, sizeof(p->packet_mask));
1280 		} break;
1281 
1282 	case SIOC_HCI_RAW_NODE_SET_PACKET_MASK: {
1283 		struct ng_btsocket_hci_raw_node_packet_mask	*p =
1284 			(struct ng_btsocket_hci_raw_node_packet_mask *) data;
1285 
1286 		if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1287 			error = ng_btsocket_hci_raw_send_ngmsg(path,
1288 					NGM_HCI_NODE_SET_PACKET_MASK,
1289 					&p->packet_mask,
1290 					sizeof(p->packet_mask));
1291 		else
1292 			error = EPERM;
1293 		} break;
1294 
1295 	case SIOC_HCI_RAW_NODE_GET_ROLE_SWITCH: {
1296 		struct ng_btsocket_hci_raw_node_role_switch	*p =
1297 			(struct ng_btsocket_hci_raw_node_role_switch *) data;
1298 
1299 		error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1300 				NGM_HCI_NODE_GET_ROLE_SWITCH,
1301 				&p->role_switch, sizeof(p->role_switch));
1302 		} break;
1303 
1304 	case SIOC_HCI_RAW_NODE_SET_ROLE_SWITCH: {
1305 		struct ng_btsocket_hci_raw_node_role_switch	*p =
1306 			(struct ng_btsocket_hci_raw_node_role_switch *) data;
1307 
1308 		if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1309 			error = ng_btsocket_hci_raw_send_ngmsg(path,
1310 					NGM_HCI_NODE_SET_ROLE_SWITCH,
1311 					&p->role_switch,
1312 					sizeof(p->role_switch));
1313 		else
1314 			error = EPERM;
1315 		} break;
1316 
1317 	case SIOC_HCI_RAW_NODE_LIST_NAMES: {
1318 		struct ng_btsocket_hci_raw_node_list_names	*nl =
1319 			(struct ng_btsocket_hci_raw_node_list_names *) data;
1320 		struct nodeinfo					*ni = nl->names;
1321 
1322 		if (nl->num_names == 0) {
1323 			error = EINVAL;
1324 			break;
1325 		}
1326 
1327 		NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_LISTNAMES,
1328 			0, M_NOWAIT);
1329 		if (msg == NULL) {
1330 			error = ENOMEM;
1331 			break;
1332 		}
1333 		ng_btsocket_hci_raw_get_token(&msg->header.token);
1334 		pcb->token = msg->header.token;
1335 		pcb->msg = NULL;
1336 
1337 		NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, ".:", 0);
1338 		if (error != 0) {
1339 			pcb->token = 0;
1340 			break;
1341 		}
1342 
1343 		error = msleep(&pcb->msg, &pcb->pcb_mtx,
1344 				PZERO|PCATCH, "hcictl",
1345 				ng_btsocket_hci_raw_ioctl_timeout * hz);
1346 		pcb->token = 0;
1347 
1348 		if (error != 0)
1349 			break;
1350 
1351 		if (pcb->msg != NULL && pcb->msg->header.cmd == NGM_LISTNAMES) {
1352 			/* Return data back to user space */
1353 			struct namelist	*nl1 = (struct namelist *) pcb->msg->data;
1354 			struct nodeinfo	*ni1 = &nl1->nodeinfo[0];
1355 
1356 			while (nl->num_names > 0 && nl1->numnames > 0) {
1357 				if (strcmp(ni1->type, NG_HCI_NODE_TYPE) == 0) {
1358 					error = copyout((caddr_t) ni1,
1359 							(caddr_t) ni,
1360 							sizeof(*ni));
1361 					if (error != 0)
1362 						break;
1363 
1364 					nl->num_names --;
1365 					ni ++;
1366 				}
1367 
1368 				nl1->numnames --;
1369 				ni1 ++;
1370 			}
1371 
1372 			nl->num_names = ni - nl->names;
1373 		} else
1374 			error = EINVAL;
1375 
1376 		NG_FREE_MSG(pcb->msg); /* checks for != NULL */
1377 		} break;
1378 
1379 	default:
1380 		error = EINVAL;
1381 		break;
1382 	}
1383 
1384 	mtx_unlock(&pcb->pcb_mtx);
1385 
1386 	return (error);
1387 } /* ng_btsocket_hci_raw_control */
1388 
1389 /*
1390  * Process getsockopt/setsockopt system calls
1391  */
1392 
1393 int
1394 ng_btsocket_hci_raw_ctloutput(struct socket *so, struct sockopt *sopt)
1395 {
1396 	ng_btsocket_hci_raw_pcb_p		pcb = so2hci_raw_pcb(so);
1397 	struct ng_btsocket_hci_raw_filter	filter;
1398 	int					error = 0, dir;
1399 
1400 	if (pcb == NULL)
1401 		return (EINVAL);
1402 	if (ng_btsocket_hci_raw_node == NULL)
1403 		return (EINVAL);
1404 
1405 	if (sopt->sopt_level != SOL_HCI_RAW)
1406 		return (0);
1407 
1408 	mtx_lock(&pcb->pcb_mtx);
1409 
1410 	switch (sopt->sopt_dir) {
1411 	case SOPT_GET:
1412 		switch (sopt->sopt_name) {
1413 		case SO_HCI_RAW_FILTER:
1414 			error = sooptcopyout(sopt, &pcb->filter,
1415 						sizeof(pcb->filter));
1416 			break;
1417 
1418 		case SO_HCI_RAW_DIRECTION:
1419 			dir = (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION)?1:0;
1420 			error = sooptcopyout(sopt, &dir, sizeof(dir));
1421 			break;
1422 
1423 		default:
1424 			error = EINVAL;
1425 			break;
1426 		}
1427 		break;
1428 
1429 	case SOPT_SET:
1430 		switch (sopt->sopt_name) {
1431 		case SO_HCI_RAW_FILTER:
1432 			error = sooptcopyin(sopt, &filter, sizeof(filter),
1433 						sizeof(filter));
1434 			if (error == 0)
1435 				bcopy(&filter, &pcb->filter,
1436 						sizeof(pcb->filter));
1437 			break;
1438 
1439 		case SO_HCI_RAW_DIRECTION:
1440 			error = sooptcopyin(sopt, &dir, sizeof(dir),
1441 						sizeof(dir));
1442 			if (error != 0)
1443 				break;
1444 
1445 			if (dir)
1446 				pcb->flags |= NG_BTSOCKET_HCI_RAW_DIRECTION;
1447 			else
1448 				pcb->flags &= ~NG_BTSOCKET_HCI_RAW_DIRECTION;
1449 			break;
1450 
1451 		default:
1452 			error = EINVAL;
1453 			break;
1454 		}
1455 		break;
1456 
1457 	default:
1458 		error = EINVAL;
1459 		break;
1460 	}
1461 
1462 	mtx_unlock(&pcb->pcb_mtx);
1463 
1464 	return (error);
1465 } /* ng_btsocket_hci_raw_ctloutput */
1466 
1467 /*
1468  * Detach raw HCI socket
1469  */
1470 
1471 void
1472 ng_btsocket_hci_raw_detach(struct socket *so)
1473 {
1474 	ng_btsocket_hci_raw_pcb_p	pcb = so2hci_raw_pcb(so);
1475 
1476 	KASSERT(pcb != NULL, ("ng_btsocket_hci_raw_detach: pcb == NULL"));
1477 
1478 	if (ng_btsocket_hci_raw_node == NULL)
1479 		return;
1480 
1481 	mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
1482 	mtx_lock(&pcb->pcb_mtx);
1483 
1484 	LIST_REMOVE(pcb, next);
1485 
1486 	mtx_unlock(&pcb->pcb_mtx);
1487 	mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
1488 
1489 	mtx_destroy(&pcb->pcb_mtx);
1490 
1491 	bzero(pcb, sizeof(*pcb));
1492 	free(pcb, M_NETGRAPH_BTSOCKET_HCI_RAW);
1493 
1494 	so->so_pcb = NULL;
1495 } /* ng_btsocket_hci_raw_detach */
1496 
1497 /*
1498  * Disconnect raw HCI socket
1499  */
1500 
1501 int
1502 ng_btsocket_hci_raw_disconnect(struct socket *so)
1503 {
1504 	ng_btsocket_hci_raw_pcb_p	 pcb = so2hci_raw_pcb(so);
1505 
1506 	if (pcb == NULL)
1507 		return (EINVAL);
1508 	if (ng_btsocket_hci_raw_node == NULL)
1509 		return (EINVAL);
1510 
1511 	mtx_lock(&pcb->pcb_mtx);
1512 	soisdisconnected(so);
1513 	mtx_unlock(&pcb->pcb_mtx);
1514 
1515 	return (0);
1516 } /* ng_btsocket_hci_raw_disconnect */
1517 
1518 /*
1519  * Get socket peer's address
1520  */
1521 
1522 int
1523 ng_btsocket_hci_raw_peeraddr(struct socket *so, struct sockaddr **nam)
1524 {
1525 	return (ng_btsocket_hci_raw_sockaddr(so, nam));
1526 } /* ng_btsocket_hci_raw_peeraddr */
1527 
1528 /*
1529  * Send data
1530  */
1531 
1532 int
1533 ng_btsocket_hci_raw_send(struct socket *so, int flags, struct mbuf *m,
1534 		struct sockaddr *sa, struct mbuf *control, struct thread *td)
1535 {
1536 	ng_btsocket_hci_raw_pcb_p	 pcb = so2hci_raw_pcb(so);
1537 	struct mbuf			*nam = NULL;
1538 	int				 error = 0;
1539 
1540 	if (ng_btsocket_hci_raw_node == NULL) {
1541 		error = ENETDOWN;
1542 		goto drop;
1543 	}
1544 	if (pcb == NULL) {
1545 		error = EINVAL;
1546 		goto drop;
1547 	}
1548 	if (control != NULL) {
1549 		error = EINVAL;
1550 		goto drop;
1551 	}
1552 
1553 	if (m->m_pkthdr.len < sizeof(ng_hci_cmd_pkt_t) ||
1554 	    m->m_pkthdr.len > sizeof(ng_hci_cmd_pkt_t) + NG_HCI_CMD_PKT_SIZE) {
1555 		error = EMSGSIZE;
1556 		goto drop;
1557 	}
1558 
1559 	if (m->m_len < sizeof(ng_hci_cmd_pkt_t)) {
1560 		if ((m = m_pullup(m, sizeof(ng_hci_cmd_pkt_t))) == NULL) {
1561 			error = ENOBUFS;
1562 			goto drop;
1563 		}
1564 	}
1565 	if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
1566 		error = ENOTSUP;
1567 		goto drop;
1568 	}
1569 
1570 	mtx_lock(&pcb->pcb_mtx);
1571 
1572 	error = ng_btsocket_hci_raw_filter(pcb, m, 0);
1573 	if (error != 0) {
1574 		mtx_unlock(&pcb->pcb_mtx);
1575 		goto drop;
1576 	}
1577 
1578 	if (sa == NULL) {
1579 		if (pcb->addr.hci_node[0] == 0) {
1580 			mtx_unlock(&pcb->pcb_mtx);
1581 			error = EDESTADDRREQ;
1582 			goto drop;
1583 		}
1584 
1585 		sa = (struct sockaddr *) &pcb->addr;
1586 	}
1587 
1588 	MGET(nam, M_DONTWAIT, MT_SONAME);
1589 	if (nam == NULL) {
1590 		mtx_unlock(&pcb->pcb_mtx);
1591 		error = ENOBUFS;
1592 		goto drop;
1593 	}
1594 
1595 	nam->m_len = sizeof(struct sockaddr_hci);
1596 	bcopy(sa,mtod(nam, struct sockaddr_hci *),sizeof(struct sockaddr_hci));
1597 
1598 	nam->m_next = m;
1599 	m = NULL;
1600 
1601 	mtx_unlock(&pcb->pcb_mtx);
1602 
1603 	return (ng_send_fn(ng_btsocket_hci_raw_node, NULL,
1604 				ng_btsocket_hci_raw_output, nam, 0));
1605 drop:
1606 	NG_FREE_M(control); /* NG_FREE_M checks for != NULL */
1607 	NG_FREE_M(nam);
1608 	NG_FREE_M(m);
1609 
1610 	return (error);
1611 } /* ng_btsocket_hci_raw_send */
1612 
1613 /*
1614  * Get socket address
1615  */
1616 
1617 int
1618 ng_btsocket_hci_raw_sockaddr(struct socket *so, struct sockaddr **nam)
1619 {
1620 	ng_btsocket_hci_raw_pcb_p	pcb = so2hci_raw_pcb(so);
1621 	struct sockaddr_hci		sa;
1622 
1623 	if (pcb == NULL)
1624 		return (EINVAL);
1625 	if (ng_btsocket_hci_raw_node == NULL)
1626 		return (EINVAL);
1627 
1628 	bzero(&sa, sizeof(sa));
1629 	sa.hci_len = sizeof(sa);
1630 	sa.hci_family = AF_BLUETOOTH;
1631 
1632 	mtx_lock(&pcb->pcb_mtx);
1633 	strlcpy(sa.hci_node, pcb->addr.hci_node, sizeof(sa.hci_node));
1634 	mtx_unlock(&pcb->pcb_mtx);
1635 
1636 	*nam = sodupsockaddr((struct sockaddr *) &sa, M_NOWAIT);
1637 
1638 	return ((*nam == NULL)? ENOMEM : 0);
1639 } /* ng_btsocket_hci_raw_sockaddr */
1640 
1641