1/*
2 * ng_hci_main.c
3 */
4
5/*-
6 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
7 *
8 * Copyright (c) Maksim Yevmenkin <m_evmenkin@yahoo.com>
9 * All rights reserved.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 *    notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 *    notice, this list of conditions and the following disclaimer in the
18 *    documentation and/or other materials provided with the distribution.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 * $Id: ng_hci_main.c,v 1.2 2003/03/18 00:09:36 max Exp $
33 * $FreeBSD$
34 */
35
36#include <sys/param.h>
37#include <sys/systm.h>
38#include <sys/kernel.h>
39#include <sys/endian.h>
40#include <sys/malloc.h>
41#include <sys/mbuf.h>
42#include <sys/queue.h>
43#include <netgraph/ng_message.h>
44#include <netgraph/netgraph.h>
45#include <netgraph/ng_parse.h>
46#include <netgraph/bluetooth/include/ng_bluetooth.h>
47#include <netgraph/bluetooth/include/ng_hci.h>
48#include <netgraph/bluetooth/hci/ng_hci_var.h>
49#include <netgraph/bluetooth/hci/ng_hci_prse.h>
50#include <netgraph/bluetooth/hci/ng_hci_cmds.h>
51#include <netgraph/bluetooth/hci/ng_hci_evnt.h>
52#include <netgraph/bluetooth/hci/ng_hci_ulpi.h>
53#include <netgraph/bluetooth/hci/ng_hci_misc.h>
54
55/******************************************************************************
56 ******************************************************************************
57 **     This node implements Bluetooth Host Controller Interface (HCI)
58 ******************************************************************************
59 ******************************************************************************/
60
61/* MALLOC define */
62#ifdef NG_SEPARATE_MALLOC
63MALLOC_DEFINE(M_NETGRAPH_HCI, "netgraph_hci", "Netgraph Bluetooth HCI node");
64#else
65#define M_NETGRAPH_HCI M_NETGRAPH
66#endif /* NG_SEPARATE_MALLOC */
67
68/* Netgraph node methods */
69static	ng_constructor_t	ng_hci_constructor;
70static	ng_shutdown_t		ng_hci_shutdown;
71static	ng_newhook_t		ng_hci_newhook;
72static	ng_connect_t		ng_hci_connect;
73static	ng_disconnect_t		ng_hci_disconnect;
74static	ng_rcvmsg_t		ng_hci_default_rcvmsg;
75static	ng_rcvmsg_t		ng_hci_upper_rcvmsg;
76static	ng_rcvdata_t		ng_hci_drv_rcvdata;
77static	ng_rcvdata_t		ng_hci_acl_rcvdata;
78static	ng_rcvdata_t		ng_hci_sco_rcvdata;
79static	ng_rcvdata_t		ng_hci_raw_rcvdata;
80
81/* Netgraph node type descriptor */
82static	struct ng_type		typestruct = {
83	.version =	NG_ABI_VERSION,
84	.name =		NG_HCI_NODE_TYPE,
85	.constructor =	ng_hci_constructor,
86	.rcvmsg =	ng_hci_default_rcvmsg,
87	.shutdown =	ng_hci_shutdown,
88	.newhook =	ng_hci_newhook,
89	.connect =	ng_hci_connect,
90	.rcvdata =	ng_hci_drv_rcvdata,
91	.disconnect =	ng_hci_disconnect,
92	.cmdlist =	ng_hci_cmdlist,
93};
94NETGRAPH_INIT(hci, &typestruct);
95MODULE_VERSION(ng_hci, NG_BLUETOOTH_VERSION);
96MODULE_DEPEND(ng_hci, ng_bluetooth, NG_BLUETOOTH_VERSION,
97	NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
98static int ng_hci_linktype_to_addrtype(int linktype);
99
100static int ng_hci_linktype_to_addrtype(int linktype)
101{
102	switch(linktype){
103	case NG_HCI_LINK_LE_PUBLIC:
104		return BDADDR_LE_PUBLIC;
105	case NG_HCI_LINK_LE_RANDOM:
106		return BDADDR_LE_RANDOM;
107	case NG_HCI_LINK_ACL:
108		/*FALLTHROUGH*/
109	default:
110		return BDADDR_BREDR;
111	}
112	return BDADDR_BREDR;
113}
114/*****************************************************************************
115 *****************************************************************************
116 **                   Netgraph methods implementation
117 *****************************************************************************
118 *****************************************************************************/
119
120/*
121 * Create new instance of HCI node (new unit)
122 */
123
124static int
125ng_hci_constructor(node_p node)
126{
127	ng_hci_unit_p	unit = NULL;
128
129	unit = malloc(sizeof(*unit), M_NETGRAPH_HCI, M_WAITOK | M_ZERO);
130
131	unit->node = node;
132	unit->debug = NG_HCI_WARN_LEVEL;
133
134	unit->link_policy_mask = 0xffff; /* Enable all supported modes */
135	unit->packet_mask = 0xffff; /* Enable all packet types */
136	unit->role_switch = 1; /* Enable role switch (if device supports it) */
137
138	/*
139	 * Set default buffer info
140	 *
141	 * One HCI command
142	 * One ACL packet with max. size of 17 bytes (1 DM1 packet)
143	 * One SCO packet with max. size of 10 bytes (1 HV1 packet)
144	 */
145
146	NG_HCI_BUFF_CMD_SET(unit->buffer, 1);
147	NG_HCI_BUFF_ACL_SET(unit->buffer, 1, 17, 1);
148	NG_HCI_BUFF_SCO_SET(unit->buffer, 1, 10, 1);
149
150	/* Init command queue & command timeout handler */
151	ng_callout_init(&unit->cmd_timo);
152	NG_BT_MBUFQ_INIT(&unit->cmdq, NG_HCI_CMD_QUEUE_LEN);
153
154	/* Init lists */
155	LIST_INIT(&unit->con_list);
156	LIST_INIT(&unit->neighbors);
157
158	/*
159	 * This node has to be a WRITER because both data and messages
160	 * can change node state.
161	 */
162
163	NG_NODE_FORCE_WRITER(node);
164	NG_NODE_SET_PRIVATE(node, unit);
165
166	return (0);
167} /* ng_hci_constructor */
168
169/*
170 * Destroy the node
171 */
172
173static int
174ng_hci_shutdown(node_p node)
175{
176	ng_hci_unit_p	unit = (ng_hci_unit_p) NG_NODE_PRIVATE(node);
177
178	NG_NODE_SET_PRIVATE(node, NULL);
179	NG_NODE_UNREF(node);
180
181	unit->node = NULL;
182	ng_hci_unit_clean(unit, 0x16 /* Connection terminated by local host */);
183
184	NG_BT_MBUFQ_DESTROY(&unit->cmdq);
185
186	bzero(unit, sizeof(*unit));
187	free(unit, M_NETGRAPH_HCI);
188
189	return (0);
190} /* ng_hci_shutdown */
191
192/*
193 * Give our OK for a hook to be added. Unit driver is connected to the driver
194 * (NG_HCI_HOOK_DRV) hook. Upper layer protocols are connected to appropriate
195 * (NG_HCI_HOOK_ACL or NG_HCI_HOOK_SCO) hooks.
196 */
197
198static int
199ng_hci_newhook(node_p node, hook_p hook, char const *name)
200{
201	ng_hci_unit_p	 unit = (ng_hci_unit_p) NG_NODE_PRIVATE(node);
202	hook_p		*h = NULL;
203
204	if (strcmp(name, NG_HCI_HOOK_DRV) == 0)
205		h = &unit->drv;
206	else if (strcmp(name, NG_HCI_HOOK_ACL) == 0)
207		h = &unit->acl;
208	else if (strcmp(name, NG_HCI_HOOK_SCO) == 0)
209		h = &unit->sco;
210	else if (strcmp(name, NG_HCI_HOOK_RAW) == 0)
211		h = &unit->raw;
212	else
213		return (EINVAL);
214
215	if (*h != NULL)
216		return (EISCONN);
217
218	*h = hook;
219
220	return (0);
221} /* ng_hci_newhook */
222
223/*
224 * Give our final OK to connect hook
225 */
226
227static int
228ng_hci_connect(hook_p hook)
229{
230	ng_hci_unit_p	unit = (ng_hci_unit_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
231
232	if (hook != unit->drv) {
233		if (hook == unit->acl) {
234			NG_HOOK_SET_RCVMSG(hook, ng_hci_upper_rcvmsg);
235			NG_HOOK_SET_RCVDATA(hook, ng_hci_acl_rcvdata);
236		} else if (hook == unit->sco) {
237			NG_HOOK_SET_RCVMSG(hook, ng_hci_upper_rcvmsg);
238			NG_HOOK_SET_RCVDATA(hook, ng_hci_sco_rcvdata);
239		} else
240			NG_HOOK_SET_RCVDATA(hook, ng_hci_raw_rcvdata);
241
242		/* Send delayed notification to the upper layers */
243		if (hook != unit->raw)
244			ng_send_fn(unit->node, hook, ng_hci_node_is_up, NULL,0);
245	} else
246		unit->state |= NG_HCI_UNIT_CONNECTED;
247
248	return (0);
249} /* ng_hci_connect */
250
251/*
252 * Disconnect the hook
253 */
254
255static int
256ng_hci_disconnect(hook_p hook)
257{
258	ng_hci_unit_p	 unit = (ng_hci_unit_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
259
260	if (hook == unit->acl)
261		unit->acl = NULL;
262	else if (hook == unit->sco)
263		unit->sco = NULL;
264	else if (hook == unit->raw)
265		unit->raw = NULL;
266	else if (hook == unit->drv) {
267		unit->drv = NULL;
268
269		/* Connection terminated by local host */
270		ng_hci_unit_clean(unit, 0x16);
271		unit->state &= ~(NG_HCI_UNIT_CONNECTED|NG_HCI_UNIT_INITED);
272	} else
273		return (EINVAL);
274
275	/* Shutdown when all hooks are disconnected */
276	if ((NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0) &&
277	    (NG_NODE_IS_VALID(NG_HOOK_NODE(hook))))
278		ng_rmnode_self(NG_HOOK_NODE(hook));
279
280	return (0);
281} /* ng_hci_disconnect */
282
283/*
284 * Default control message processing routine. Control message could be:
285 *
286 * 1) GENERIC Netgraph messages
287 *
288 * 2) Control message directed to the node itself.
289 */
290
291static int
292ng_hci_default_rcvmsg(node_p node, item_p item, hook_p lasthook)
293{
294	ng_hci_unit_p	 unit = (ng_hci_unit_p) NG_NODE_PRIVATE(node);
295	struct ng_mesg	*msg = NULL, *rsp = NULL;
296	int		 error = 0;
297
298	NGI_GET_MSG(item, msg);
299
300	switch (msg->header.typecookie) {
301	case NGM_GENERIC_COOKIE:
302		switch (msg->header.cmd) {
303		case NGM_TEXT_STATUS: {
304			int	cmd_avail,
305				acl_total, acl_avail, acl_size,
306				sco_total, sco_avail, sco_size;
307
308			NG_MKRESPONSE(rsp, msg, NG_TEXTRESPONSE, M_NOWAIT);
309			if (rsp == NULL) {
310				error = ENOMEM;
311				break;
312			}
313
314			NG_HCI_BUFF_CMD_GET(unit->buffer, cmd_avail);
315
316			NG_HCI_BUFF_ACL_AVAIL(unit->buffer, acl_avail);
317			NG_HCI_BUFF_ACL_TOTAL(unit->buffer, acl_total);
318			NG_HCI_BUFF_ACL_SIZE(unit->buffer, acl_size);
319
320			NG_HCI_BUFF_SCO_AVAIL(unit->buffer, sco_avail);
321			NG_HCI_BUFF_SCO_TOTAL(unit->buffer, sco_total);
322			NG_HCI_BUFF_SCO_SIZE(unit->buffer, sco_size);
323
324			snprintf(rsp->data, NG_TEXTRESPONSE,
325				"bdaddr %x:%x:%x:%x:%x:%x\n" \
326				"Hooks  %s %s %s %s\n" \
327				"State  %#x\n" \
328				"Queue  cmd:%d\n" \
329				"Buffer cmd:%d,acl:%d,%d,%d,sco:%d,%d,%d",
330				unit->bdaddr.b[5], unit->bdaddr.b[4],
331				unit->bdaddr.b[3], unit->bdaddr.b[2],
332				unit->bdaddr.b[1], unit->bdaddr.b[0],
333				(unit->drv != NULL)? NG_HCI_HOOK_DRV : "",
334				(unit->acl != NULL)? NG_HCI_HOOK_ACL : "",
335				(unit->sco != NULL)? NG_HCI_HOOK_SCO : "",
336				(unit->raw != NULL)? NG_HCI_HOOK_RAW : "",
337				unit->state,
338				NG_BT_MBUFQ_LEN(&unit->cmdq),
339				cmd_avail,
340				acl_avail, acl_total, acl_size,
341				sco_avail, sco_total, sco_size);
342			} break;
343
344		default:
345			error = EINVAL;
346			break;
347		}
348		break;
349
350	case NGM_HCI_COOKIE:
351		switch (msg->header.cmd) {
352		/* Get current node state */
353		case NGM_HCI_NODE_GET_STATE:
354			NG_MKRESPONSE(rsp, msg, sizeof(unit->state), M_NOWAIT);
355			if (rsp == NULL) {
356				error = ENOMEM;
357				break;
358			}
359
360			*((ng_hci_node_state_ep *)(rsp->data)) = unit->state;
361			break;
362
363		/* Turn INITED bit - node initialized */
364		case NGM_HCI_NODE_INIT:
365			if (bcmp(&unit->bdaddr, NG_HCI_BDADDR_ANY,
366					sizeof(bdaddr_t)) == 0) {
367				error = ENXIO;
368				break;
369			}
370
371			unit->state |= NG_HCI_UNIT_INITED;
372
373			ng_hci_node_is_up(unit->node, unit->acl, NULL, 0);
374			ng_hci_node_is_up(unit->node, unit->sco, NULL, 0);
375			break;
376
377		/* Get node debug level */
378		case NGM_HCI_NODE_GET_DEBUG:
379			NG_MKRESPONSE(rsp, msg, sizeof(unit->debug), M_NOWAIT);
380			if (rsp == NULL) {
381				error = ENOMEM;
382				break;
383			}
384
385			*((ng_hci_node_debug_ep *)(rsp->data)) = unit->debug;
386			break;
387
388		/* Set node debug level */
389		case NGM_HCI_NODE_SET_DEBUG:
390			if (msg->header.arglen != sizeof(ng_hci_node_debug_ep)){
391				error = EMSGSIZE;
392				break;
393			}
394
395			unit->debug = *((ng_hci_node_debug_ep *)(msg->data));
396			break;
397
398		/* Get buffer info */
399		case NGM_HCI_NODE_GET_BUFFER: {
400			ng_hci_node_buffer_ep	*ep = NULL;
401
402			NG_MKRESPONSE(rsp, msg, sizeof(ng_hci_node_buffer_ep),
403				M_NOWAIT);
404			if (rsp == NULL) {
405				error = ENOMEM;
406				break;
407			}
408
409			ep = (ng_hci_node_buffer_ep *)(rsp->data);
410
411			NG_HCI_BUFF_CMD_GET(unit->buffer, ep->cmd_free);
412			NG_HCI_BUFF_ACL_AVAIL(unit->buffer, ep->acl_free);
413			NG_HCI_BUFF_ACL_TOTAL(unit->buffer, ep->acl_pkts);
414			NG_HCI_BUFF_ACL_SIZE(unit->buffer, ep->acl_size);
415			NG_HCI_BUFF_SCO_AVAIL(unit->buffer, ep->sco_free);
416			NG_HCI_BUFF_SCO_TOTAL(unit->buffer, ep->sco_pkts);
417			NG_HCI_BUFF_SCO_SIZE(unit->buffer, ep->sco_size);
418			} break;
419
420		/* Get BDADDR */
421		case NGM_HCI_NODE_GET_BDADDR:
422			NG_MKRESPONSE(rsp, msg, sizeof(bdaddr_t), M_NOWAIT);
423			if (rsp == NULL) {
424				error = ENOMEM;
425				break;
426			}
427
428			bcopy(&unit->bdaddr, rsp->data, sizeof(bdaddr_t));
429			break;
430
431		/* Get features */
432		case NGM_HCI_NODE_GET_FEATURES:
433			NG_MKRESPONSE(rsp,msg,sizeof(unit->features),M_NOWAIT);
434			if (rsp == NULL) {
435				error = ENOMEM;
436				break;
437			}
438
439			bcopy(&unit->features,rsp->data,sizeof(unit->features));
440			break;
441
442		/* Get stat */
443		case NGM_HCI_NODE_GET_STAT:
444			NG_MKRESPONSE(rsp, msg, sizeof(unit->stat), M_NOWAIT);
445			if (rsp == NULL) {
446				error = ENOMEM;
447				break;
448			}
449
450			bcopy(&unit->stat, rsp->data, sizeof(unit->stat));
451			break;
452
453		/* Reset stat */
454		case NGM_HCI_NODE_RESET_STAT:
455			NG_HCI_STAT_RESET(unit->stat);
456			break;
457
458		/* Clean up neighbors list */
459		case NGM_HCI_NODE_FLUSH_NEIGHBOR_CACHE:
460			ng_hci_flush_neighbor_cache(unit);
461			break;
462
463		/* Get neighbor cache entries */
464		case NGM_HCI_NODE_GET_NEIGHBOR_CACHE: {
465			ng_hci_neighbor_p			 n = NULL;
466			ng_hci_node_get_neighbor_cache_ep	*e1 = NULL;
467			ng_hci_node_neighbor_cache_entry_ep	*e2 = NULL;
468			int					 s = 0;
469
470			/* Look for the fresh entries in the cache */
471			for (n = LIST_FIRST(&unit->neighbors); n != NULL; ) {
472				ng_hci_neighbor_p	nn = LIST_NEXT(n, next);
473
474				if (ng_hci_neighbor_stale(n))
475					ng_hci_free_neighbor(n);
476				else
477					s ++;
478
479				n = nn;
480			}
481			if (s > NG_HCI_MAX_NEIGHBOR_NUM)
482				s = NG_HCI_MAX_NEIGHBOR_NUM;
483
484			/* Prepare response */
485			NG_MKRESPONSE(rsp, msg, sizeof(*e1) + s * sizeof(*e2),
486				M_NOWAIT);
487			if (rsp == NULL) {
488				error = ENOMEM;
489				break;
490			}
491
492			e1 = (ng_hci_node_get_neighbor_cache_ep *)(rsp->data);
493			e2 = (ng_hci_node_neighbor_cache_entry_ep *)(e1 + 1);
494
495			e1->num_entries = s;
496
497			LIST_FOREACH(n, &unit->neighbors, next) {
498				e2->page_scan_rep_mode = n->page_scan_rep_mode;
499				e2->page_scan_mode = n->page_scan_mode;
500				e2->clock_offset = n->clock_offset;
501				e2->addrtype =
502					ng_hci_linktype_to_addrtype(n->addrtype);
503				e2->extinq_size = n->extinq_size;
504				bcopy(&n->bdaddr, &e2->bdaddr,
505					sizeof(e2->bdaddr));
506				bcopy(&n->features, &e2->features,
507					sizeof(e2->features));
508				bcopy(&n->extinq_data, &e2->extinq_data,
509				      n->extinq_size);
510				e2 ++;
511				if (--s <= 0)
512					break;
513			}
514			} break;
515
516		/* Get connection list */
517		case NGM_HCI_NODE_GET_CON_LIST: {
518			ng_hci_unit_con_p	 c = NULL;
519			ng_hci_node_con_list_ep	*e1 = NULL;
520			ng_hci_node_con_ep	*e2 = NULL;
521			int			 s = 0;
522
523			/* Count number of connections in the list */
524			LIST_FOREACH(c, &unit->con_list, next)
525				s ++;
526			if (s > NG_HCI_MAX_CON_NUM)
527				s = NG_HCI_MAX_CON_NUM;
528
529			/* Prepare response */
530			NG_MKRESPONSE(rsp, msg, sizeof(*e1) + s * sizeof(*e2),
531				M_NOWAIT);
532			if (rsp == NULL) {
533				error = ENOMEM;
534				break;
535			}
536
537			e1 = (ng_hci_node_con_list_ep *)(rsp->data);
538			e2 = (ng_hci_node_con_ep *)(e1 + 1);
539
540			e1->num_connections = s;
541
542			LIST_FOREACH(c, &unit->con_list, next) {
543				e2->link_type = c->link_type;
544				e2->encryption_mode= c->encryption_mode;
545				e2->mode = c->mode;
546				e2->role = c->role;
547
548				e2->state = c->state;
549
550				e2->pending = c->pending;
551				e2->queue_len = NG_BT_ITEMQ_LEN(&c->conq);
552
553				e2->con_handle = c->con_handle;
554				bcopy(&c->bdaddr, &e2->bdaddr,
555					sizeof(e2->bdaddr));
556
557				e2 ++;
558				if (--s <= 0)
559					break;
560			}
561			} break;
562
563		/* Get link policy settings mask */
564		case NGM_HCI_NODE_GET_LINK_POLICY_SETTINGS_MASK:
565			NG_MKRESPONSE(rsp, msg, sizeof(unit->link_policy_mask),
566				M_NOWAIT);
567			if (rsp == NULL) {
568				error = ENOMEM;
569				break;
570			}
571
572			*((ng_hci_node_link_policy_mask_ep *)(rsp->data)) =
573				unit->link_policy_mask;
574			break;
575
576		/* Set link policy settings mask */
577		case NGM_HCI_NODE_SET_LINK_POLICY_SETTINGS_MASK:
578			if (msg->header.arglen !=
579				sizeof(ng_hci_node_link_policy_mask_ep)) {
580				error = EMSGSIZE;
581				break;
582			}
583
584			unit->link_policy_mask =
585				*((ng_hci_node_link_policy_mask_ep *)
586					(msg->data));
587			break;
588
589		/* Get packet mask */
590		case NGM_HCI_NODE_GET_PACKET_MASK:
591			NG_MKRESPONSE(rsp, msg, sizeof(unit->packet_mask),
592				M_NOWAIT);
593			if (rsp == NULL) {
594				error = ENOMEM;
595				break;
596			}
597
598			*((ng_hci_node_packet_mask_ep *)(rsp->data)) =
599				unit->packet_mask;
600			break;
601
602		/* Set packet mask */
603		case NGM_HCI_NODE_SET_PACKET_MASK:
604			if (msg->header.arglen !=
605					sizeof(ng_hci_node_packet_mask_ep)) {
606				error = EMSGSIZE;
607				break;
608			}
609
610			unit->packet_mask =
611				*((ng_hci_node_packet_mask_ep *)(msg->data));
612			break;
613
614		/* Get role switch */
615		case NGM_HCI_NODE_GET_ROLE_SWITCH:
616			NG_MKRESPONSE(rsp, msg, sizeof(unit->role_switch),
617				M_NOWAIT);
618			if (rsp == NULL) {
619				error = ENOMEM;
620				break;
621			}
622
623			*((ng_hci_node_role_switch_ep *)(rsp->data)) =
624				unit->role_switch;
625			break;
626
627		/* Set role switch */
628		case NGM_HCI_NODE_SET_ROLE_SWITCH:
629			if (msg->header.arglen !=
630					sizeof(ng_hci_node_role_switch_ep)) {
631				error = EMSGSIZE;
632				break;
633			}
634
635			unit->role_switch =
636				*((ng_hci_node_role_switch_ep *)(msg->data));
637			break;
638
639		default:
640			error = EINVAL;
641			break;
642		}
643		break;
644
645	default:
646		error = EINVAL;
647		break;
648	}
649
650	/* NG_RESPOND_MSG should take care of "item" and "rsp" */
651	NG_RESPOND_MSG(error, node, item, rsp);
652	NG_FREE_MSG(msg);
653
654	return (error);
655} /* ng_hci_default_rcvmsg */
656
657/*
658 * Process control message from upstream hooks (ACL and SCO).
659 * Handle LP_xxx messages here, give everything else to default routine.
660 */
661
662static int
663ng_hci_upper_rcvmsg(node_p node, item_p item, hook_p lasthook)
664{
665	ng_hci_unit_p	unit = (ng_hci_unit_p) NG_NODE_PRIVATE(node);
666	int		error = 0;
667
668	switch (NGI_MSG(item)->header.typecookie) {
669	case NGM_HCI_COOKIE:
670		switch (NGI_MSG(item)->header.cmd) {
671		case NGM_HCI_LP_CON_REQ:
672			error = ng_hci_lp_con_req(unit, item, lasthook);
673			break;
674
675		case NGM_HCI_LP_DISCON_REQ: /* XXX not defined by specs */
676			error = ng_hci_lp_discon_req(unit, item, lasthook);
677			break;
678
679		case NGM_HCI_LP_CON_RSP:
680			error = ng_hci_lp_con_rsp(unit, item, lasthook);
681			break;
682
683		case NGM_HCI_LP_QOS_REQ:
684			error = ng_hci_lp_qos_req(unit, item, lasthook);
685			break;
686
687		default:
688			error = ng_hci_default_rcvmsg(node, item, lasthook);
689			break;
690		}
691		break;
692
693	default:
694		error = ng_hci_default_rcvmsg(node, item, lasthook);
695		break;
696	}
697
698	return (error);
699} /* ng_hci_upper_rcvmsg */
700
701/*
702 * Process data packet from the driver hook.
703 * We expect HCI events, ACL or SCO data packets.
704 */
705
706static int
707ng_hci_drv_rcvdata(hook_p hook, item_p item)
708{
709	ng_hci_unit_p	 unit = (ng_hci_unit_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
710	struct mbuf	*m = NULL;
711	int		 error = 0;
712
713	/* Process packet */
714	m = NGI_M(item); /* item still has mbuf, just peeking */
715	m->m_flags |= M_PROTO1; /* mark as incoming packet */
716
717	NG_HCI_STAT_BYTES_RECV(unit->stat, m->m_pkthdr.len);
718
719	/* Give copy packet to RAW hook */
720	ng_hci_mtap(unit, m);
721
722	/*
723	 * XXX XXX XXX
724	 * Lower layer drivers MUST NOT send mbuf chain with empty mbuf at
725	 * the beginning of the chain. HCI layer WILL NOT call m_pullup() here.
726	 */
727
728	switch (*mtod(m, u_int8_t *)) {
729	case NG_HCI_ACL_DATA_PKT:
730		NG_HCI_STAT_ACL_RECV(unit->stat);
731
732		if ((unit->state & NG_HCI_UNIT_READY) != NG_HCI_UNIT_READY ||
733		    unit->acl == NULL || NG_HOOK_NOT_VALID(unit->acl)) {
734			NG_HCI_WARN(
735"%s: %s - could not forward HCI ACL data packet, state=%#x, hook=%p\n",
736				__func__, NG_NODE_NAME(unit->node),
737				unit->state, unit->acl);
738
739			NG_FREE_ITEM(item);
740		} else
741			NG_FWD_ITEM_HOOK(error, item, unit->acl);
742		break;
743
744	case NG_HCI_SCO_DATA_PKT:
745		NG_HCI_STAT_SCO_RECV(unit->stat);
746
747		if ((unit->state & NG_HCI_UNIT_READY) != NG_HCI_UNIT_READY ||
748		    unit->sco == NULL || NG_HOOK_NOT_VALID(unit->sco)) {
749			NG_HCI_INFO(
750"%s: %s - could not forward HCI SCO data packet, state=%#x, hook=%p\n",
751				__func__, NG_NODE_NAME(unit->node),
752				unit->state, unit->sco);
753
754			NG_FREE_ITEM(item);
755		} else
756			NG_FWD_ITEM_HOOK(error, item, unit->sco);
757		break;
758
759	case NG_HCI_EVENT_PKT:
760		NG_HCI_STAT_EVNT_RECV(unit->stat);
761
762		/* Detach mbuf, discard item and process event */
763		NGI_GET_M(item, m);
764		NG_FREE_ITEM(item);
765
766		error = ng_hci_process_event(unit, m);
767		break;
768
769	default:
770		NG_HCI_ALERT(
771"%s: %s - got unknown HCI packet type=%#x\n",
772			__func__, NG_NODE_NAME(unit->node),
773			*mtod(m, u_int8_t *));
774
775		NG_FREE_ITEM(item);
776
777		error = EINVAL;
778		break;
779	}
780
781	return (error);
782} /* ng_hci_drv_rcvdata */
783
784/*
785 * Process data packet from ACL upstream hook.
786 * We expect valid HCI ACL data packets.
787 */
788
789static int
790ng_hci_acl_rcvdata(hook_p hook, item_p item)
791{
792	ng_hci_unit_p		 unit = (ng_hci_unit_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
793	struct mbuf		*m = NULL;
794	ng_hci_unit_con_p	 con = NULL;
795	u_int16_t		 con_handle;
796	int			 size, error = 0;
797
798	NG_HCI_BUFF_ACL_SIZE(unit->buffer, size);
799	/* Check packet */
800	NGI_GET_M(item, m);
801
802	if (*mtod(m, u_int8_t *) != NG_HCI_ACL_DATA_PKT) {
803		NG_HCI_ALERT(
804"%s: %s - invalid HCI data packet type=%#x\n",
805			__func__, NG_NODE_NAME(unit->node),
806			*mtod(m, u_int8_t *));
807
808		error = EINVAL;
809		goto drop;
810	}
811	if (m->m_pkthdr.len < sizeof(ng_hci_acldata_pkt_t) ||
812	    m->m_pkthdr.len > sizeof(ng_hci_acldata_pkt_t) + size) {
813		NG_HCI_ALERT(
814"%s: %s - invalid HCI ACL data packet, len=%d, mtu=%d\n",
815			__func__, NG_NODE_NAME(unit->node),
816			m->m_pkthdr.len, size);
817
818		error = EMSGSIZE;
819		goto drop;
820	}
821
822	NG_HCI_M_PULLUP(m, sizeof(ng_hci_acldata_pkt_t));
823	if (m == NULL) {
824		error = ENOBUFS;
825		goto drop;
826	}
827
828	con_handle = NG_HCI_CON_HANDLE(le16toh(
829			mtod(m, ng_hci_acldata_pkt_t *)->con_handle));
830	size = le16toh(mtod(m, ng_hci_acldata_pkt_t *)->length);
831
832	if (m->m_pkthdr.len != sizeof(ng_hci_acldata_pkt_t) + size) {
833		NG_HCI_ALERT(
834"%s: %s - invalid HCI ACL data packet size, len=%d, length=%d\n",
835			__func__, NG_NODE_NAME(unit->node),
836			m->m_pkthdr.len, size);
837
838		error = EMSGSIZE;
839		goto drop;
840	}
841
842	/* Queue packet */
843	con = ng_hci_con_by_handle(unit, con_handle);
844	if (con == NULL) {
845		NG_HCI_ERR(
846"%s: %s - unexpected HCI ACL data packet. Connection does not exists, " \
847"con_handle=%d\n",	__func__, NG_NODE_NAME(unit->node), con_handle);
848
849		error = ENOENT;
850		goto drop;
851	}
852
853	if (con->link_type == NG_HCI_LINK_SCO) {
854		NG_HCI_ERR(
855"%s: %s - unexpected HCI ACL data packet. Not ACL link, con_handle=%d, " \
856"link_type=%d\n",	__func__, NG_NODE_NAME(unit->node),
857			con_handle, con->link_type);
858
859		error = EINVAL;
860		goto drop;
861	}
862
863	if (con->state != NG_HCI_CON_OPEN) {
864		NG_HCI_ERR(
865"%s: %s - unexpected HCI ACL data packet. Invalid connection state=%d, " \
866"con_handle=%d\n",	 __func__, NG_NODE_NAME(unit->node),
867			con->state, con_handle);
868
869		error = EHOSTDOWN;
870		goto drop;
871	}
872
873	if (NG_BT_ITEMQ_FULL(&con->conq)) {
874		NG_HCI_ALERT(
875"%s: %s - dropping HCI ACL data packet, con_handle=%d, len=%d, queue_len=%d\n",
876			 __func__, NG_NODE_NAME(unit->node), con_handle,
877			m->m_pkthdr.len, NG_BT_ITEMQ_LEN(&con->conq));
878
879		NG_BT_ITEMQ_DROP(&con->conq);
880
881		error = ENOBUFS;
882		goto drop;
883	}
884
885	/* Queue item and schedule data transfer */
886	NGI_M(item) = m;
887	NG_BT_ITEMQ_ENQUEUE(&con->conq, item);
888	item = NULL;
889	m = NULL;
890
891	ng_hci_send_data(unit);
892drop:
893	if (item != NULL)
894		NG_FREE_ITEM(item);
895
896	NG_FREE_M(m); /* NG_FREE_M() checks for m != NULL */
897
898	return (error);
899} /* ng_hci_acl_rcvdata */
900
901/*
902 * Process data packet from SCO upstream hook.
903 * We expect valid HCI SCO data packets
904 */
905
906static int
907ng_hci_sco_rcvdata(hook_p hook, item_p item)
908{
909	ng_hci_unit_p		 unit = (ng_hci_unit_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
910	struct mbuf		*m = NULL;
911	ng_hci_unit_con_p	 con = NULL;
912	u_int16_t		 con_handle;
913	int			 size, error = 0;
914
915	NG_HCI_BUFF_SCO_SIZE(unit->buffer, size);
916
917	/* Check packet */
918	NGI_GET_M(item, m);
919
920	if (*mtod(m, u_int8_t *) != NG_HCI_SCO_DATA_PKT) {
921		NG_HCI_ALERT(
922"%s: %s - invalid HCI data packet type=%#x\n",
923			__func__, NG_NODE_NAME(unit->node),
924			*mtod(m, u_int8_t *));
925
926		error = EINVAL;
927		goto drop;
928	}
929
930	if (m->m_pkthdr.len < sizeof(ng_hci_scodata_pkt_t) ||
931	    m->m_pkthdr.len > sizeof(ng_hci_scodata_pkt_t) + size) {
932		NG_HCI_ALERT(
933"%s: %s - invalid HCI SCO data packet, len=%d, mtu=%d\n",
934			__func__, NG_NODE_NAME(unit->node),
935			m->m_pkthdr.len, size);
936
937		error = EMSGSIZE;
938		goto drop;
939	}
940
941	NG_HCI_M_PULLUP(m, sizeof(ng_hci_scodata_pkt_t));
942	if (m == NULL) {
943		error = ENOBUFS;
944		goto drop;
945	}
946
947	con_handle = NG_HCI_CON_HANDLE(le16toh(
948			mtod(m, ng_hci_scodata_pkt_t *)->con_handle));
949	size = mtod(m, ng_hci_scodata_pkt_t *)->length;
950
951	if (m->m_pkthdr.len != sizeof(ng_hci_scodata_pkt_t) + size) {
952		NG_HCI_ALERT(
953"%s: %s - invalid HCI SCO data packet size, len=%d, length=%d\n",
954			__func__, NG_NODE_NAME(unit->node),
955			m->m_pkthdr.len, size);
956
957		error = EMSGSIZE;
958		goto drop;
959	}
960
961	/* Queue packet */
962	con = ng_hci_con_by_handle(unit, con_handle);
963	if (con == NULL) {
964		NG_HCI_ERR(
965"%s: %s - unexpected HCI SCO data packet. Connection does not exists, " \
966"con_handle=%d\n",	__func__, NG_NODE_NAME(unit->node), con_handle);
967
968		error = ENOENT;
969		goto drop;
970	}
971
972	if (con->link_type != NG_HCI_LINK_SCO) {
973		NG_HCI_ERR(
974"%s: %s - unexpected HCI SCO data packet. Not SCO link, con_handle=%d, " \
975"link_type=%d\n",	__func__, NG_NODE_NAME(unit->node),
976			con_handle, con->link_type);
977
978		error = EINVAL;
979		goto drop;
980	}
981
982	if (con->state != NG_HCI_CON_OPEN) {
983		NG_HCI_ERR(
984"%s: %s - unexpected HCI SCO data packet. Invalid connection state=%d, " \
985"con_handle=%d\n",	__func__, NG_NODE_NAME(unit->node),
986			con->state, con_handle);
987
988		error = EHOSTDOWN;
989		goto drop;
990	}
991
992	if (NG_BT_ITEMQ_FULL(&con->conq)) {
993		NG_HCI_ALERT(
994"%s: %s - dropping HCI SCO data packet, con_handle=%d, len=%d, queue_len=%d\n",
995			__func__, NG_NODE_NAME(unit->node), con_handle,
996			m->m_pkthdr.len, NG_BT_ITEMQ_LEN(&con->conq));
997
998		NG_BT_ITEMQ_DROP(&con->conq);
999
1000		error = ENOBUFS;
1001		goto drop;
1002	}
1003
1004	/* Queue item and schedule data transfer */
1005	NGI_M(item) = m;
1006	NG_BT_ITEMQ_ENQUEUE(&con->conq, item);
1007	item = NULL;
1008	m = NULL;
1009
1010	ng_hci_send_data(unit);
1011drop:
1012	if (item != NULL)
1013		NG_FREE_ITEM(item);
1014
1015	NG_FREE_M(m); /* NG_FREE_M() checks for m != NULL */
1016
1017	return (error);
1018} /* ng_hci_sco_rcvdata */
1019
1020/*
1021 * Process data packet from uptream RAW hook.
1022 * We expect valid HCI command packets.
1023 */
1024
1025static int
1026ng_hci_raw_rcvdata(hook_p hook, item_p item)
1027{
1028	ng_hci_unit_p	 unit = (ng_hci_unit_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
1029	struct mbuf	*m = NULL;
1030	int		 error = 0;
1031
1032	NGI_GET_M(item, m);
1033	NG_FREE_ITEM(item);
1034
1035	/* Check packet */
1036	if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
1037		NG_HCI_ALERT(
1038"%s: %s - invalid HCI command packet type=%#x\n",
1039			__func__, NG_NODE_NAME(unit->node),
1040			*mtod(m, u_int8_t *));
1041
1042		error = EINVAL;
1043		goto drop;
1044	}
1045
1046	if (m->m_pkthdr.len < sizeof(ng_hci_cmd_pkt_t)) {
1047		NG_HCI_ALERT(
1048"%s: %s - invalid HCI command packet len=%d\n",
1049			__func__, NG_NODE_NAME(unit->node), m->m_pkthdr.len);
1050
1051		error = EMSGSIZE;
1052		goto drop;
1053	}
1054
1055	NG_HCI_M_PULLUP(m, sizeof(ng_hci_cmd_pkt_t));
1056	if (m == NULL) {
1057		error = ENOBUFS;
1058		goto drop;
1059	}
1060
1061	if (m->m_pkthdr.len !=
1062	    mtod(m, ng_hci_cmd_pkt_t *)->length + sizeof(ng_hci_cmd_pkt_t)) {
1063		NG_HCI_ALERT(
1064"%s: %s - invalid HCI command packet size, len=%d, length=%d\n",
1065			__func__, NG_NODE_NAME(unit->node), m->m_pkthdr.len,
1066			mtod(m, ng_hci_cmd_pkt_t *)->length);
1067
1068		error = EMSGSIZE;
1069		goto drop;
1070	}
1071
1072	if (mtod(m, ng_hci_cmd_pkt_t *)->opcode == 0) {
1073		NG_HCI_ALERT(
1074"%s: %s - invalid HCI command opcode\n",
1075			__func__, NG_NODE_NAME(unit->node));
1076
1077		error = EINVAL;
1078		goto drop;
1079	}
1080
1081	if (NG_BT_MBUFQ_FULL(&unit->cmdq)) {
1082		NG_HCI_ALERT(
1083"%s: %s - dropping HCI command packet, len=%d, queue_len=%d\n",
1084			__func__, NG_NODE_NAME(unit->node), m->m_pkthdr.len,
1085			NG_BT_MBUFQ_LEN(&unit->cmdq));
1086
1087		NG_BT_MBUFQ_DROP(&unit->cmdq);
1088
1089		error = ENOBUFS;
1090		goto drop;
1091	}
1092
1093	/* Queue and send command */
1094	NG_BT_MBUFQ_ENQUEUE(&unit->cmdq, m);
1095	m = NULL;
1096
1097	if (!(unit->state & NG_HCI_UNIT_COMMAND_PENDING))
1098		error = ng_hci_send_command(unit);
1099drop:
1100	NG_FREE_M(m); /* NG_FREE_M() checks for m != NULL */
1101
1102	return (error);
1103} /* ng_hci_raw_rcvdata */
1104