sys/netgraph7/bluetooth/socket/ng_btsocket_rfcomm.c

   1 /*
   2  * ng_btsocket_rfcomm.c
   3  */
   4
   5 /*-
   6  * Copyright (c) 2001-2003 Maksim Yevmenkin <m_evmenkin@yahoo.com>
   7  * All rights reserved.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  28  * SUCH DAMAGE.
  29  *
  30  * $Id: ng_btsocket_rfcomm.c,v 1.28 2003/09/14 23:29:06 max Exp $
  31  * $FreeBSD: src/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c,v 1.27 2007/10/29 19:06:47 emax Exp $
  32  */
  33
  34 #include <sys/param.h>
  35 #include <sys/systm.h>
  36 #include <sys/bitstring.h>
  37 #include <sys/domain.h>
  38 #include <sys/endian.h>
  39 #include <sys/errno.h>
  40 #include <sys/filedesc.h>
  41 #include <sys/kernel.h>
  42 #include <sys/lock.h>
  43 #include <sys/malloc.h>
  44 #include <sys/mbuf.h>
  45 #include <sys/mutex.h>
  46 #include <sys/proc.h>
  47 #include <sys/protosw.h>
  48 #include <sys/queue.h>
  49 #include <sys/socket.h>
  50 #include <sys/socketvar.h>
  51 #include <sys/sysctl.h>
  52 #include <sys/taskqueue.h>
  53 #include <sys/uio.h>
  54 #include "ng_message.h"
  55 #include "netgraph.h"
  56 #include "bluetooth/include/ng_bluetooth.h"
  57 #include "bluetooth/include/ng_hci.h"
  58 #include "bluetooth/include/ng_l2cap.h"
  59 #include "bluetooth/include/ng_btsocket.h"
  60 #include "bluetooth/include/ng_btsocket_l2cap.h"
  61 #include "bluetooth/include/ng_btsocket_rfcomm.h"
  62
  63 /* MALLOC define */
  64 #ifdef NG_SEPARATE_MALLOC
  65 MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_RFCOMM, "netgraph_btsocks_rfcomm",
  66                 "Netgraph Bluetooth RFCOMM sockets");
  67 #else
  68 #define M_NETGRAPH_BTSOCKET_RFCOMM M_NETGRAPH
  69 #endif /* NG_SEPARATE_MALLOC */
  70
  71 /* Debug */
  72 #define NG_BTSOCKET_RFCOMM_INFO \
  73         if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_INFO_LEVEL) \
  74                 printf
  75
  76 #define NG_BTSOCKET_RFCOMM_WARN \
  77         if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_WARN_LEVEL) \
  78                 printf
  79
  80 #define NG_BTSOCKET_RFCOMM_ERR \
  81         if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_ERR_LEVEL) \
  82                 printf
  83
  84 #define NG_BTSOCKET_RFCOMM_ALERT \
  85         if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_ALERT_LEVEL) \
  86                 printf
  87
  88 #define ALOT    0x7fff
  89
  90 /* Local prototypes */
  91 static void ng_btsocket_rfcomm_upcall
  92         (struct socket *so, void *arg, int waitflag);
  93 static void ng_btsocket_rfcomm_sessions_task
  94         (void *ctx, int pending);
  95 static void ng_btsocket_rfcomm_session_task
  96         (ng_btsocket_rfcomm_session_p s);
  97 #define ng_btsocket_rfcomm_task_wakeup() \
  98         taskqueue_enqueue(taskqueue_swi_giant, &ng_btsocket_rfcomm_task)
  99
 100 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_connect_ind
 101         (ng_btsocket_rfcomm_session_p s, int channel);
 102 static void ng_btsocket_rfcomm_connect_cfm
 103         (ng_btsocket_rfcomm_session_p s);
 104
 105 static int ng_btsocket_rfcomm_session_create
 106         (ng_btsocket_rfcomm_session_p *sp, struct socket *l2so,
 107          bdaddr_p src, bdaddr_p dst, struct thread *td);
 108 static int ng_btsocket_rfcomm_session_accept
 109         (ng_btsocket_rfcomm_session_p s0);
 110 static int ng_btsocket_rfcomm_session_connect
 111         (ng_btsocket_rfcomm_session_p s);
 112 static int ng_btsocket_rfcomm_session_receive
 113         (ng_btsocket_rfcomm_session_p s);
 114 static int ng_btsocket_rfcomm_session_send
 115         (ng_btsocket_rfcomm_session_p s);
 116 static void ng_btsocket_rfcomm_session_clean
 117         (ng_btsocket_rfcomm_session_p s);
 118 static void ng_btsocket_rfcomm_session_process_pcb
 119         (ng_btsocket_rfcomm_session_p s);
 120 static ng_btsocket_rfcomm_session_p ng_btsocket_rfcomm_session_by_addr
 121         (bdaddr_p src, bdaddr_p dst);
 122
 123 static int ng_btsocket_rfcomm_receive_frame
 124         (ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
 125 static int ng_btsocket_rfcomm_receive_sabm
 126         (ng_btsocket_rfcomm_session_p s, int dlci);
 127 static int ng_btsocket_rfcomm_receive_disc
 128         (ng_btsocket_rfcomm_session_p s, int dlci);
 129 static int ng_btsocket_rfcomm_receive_ua
 130         (ng_btsocket_rfcomm_session_p s, int dlci);
 131 static int ng_btsocket_rfcomm_receive_dm
 132         (ng_btsocket_rfcomm_session_p s, int dlci);
 133 static int ng_btsocket_rfcomm_receive_uih
 134         (ng_btsocket_rfcomm_session_p s, int dlci, int pf, struct mbuf *m0);
 135 static int ng_btsocket_rfcomm_receive_mcc
 136         (ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
 137 static int ng_btsocket_rfcomm_receive_test
 138         (ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
 139 static int ng_btsocket_rfcomm_receive_fc
 140         (ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
 141 static int ng_btsocket_rfcomm_receive_msc
 142         (ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
 143 static int ng_btsocket_rfcomm_receive_rpn
 144         (ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
 145 static int ng_btsocket_rfcomm_receive_rls
 146         (ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
 147 static int ng_btsocket_rfcomm_receive_pn
 148         (ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
 149 static void ng_btsocket_rfcomm_set_pn
 150         (ng_btsocket_rfcomm_pcb_p pcb, u_int8_t cr, u_int8_t flow_control,
 151          u_int8_t credits, u_int16_t mtu);
 152
 153 static int ng_btsocket_rfcomm_send_command
 154         (ng_btsocket_rfcomm_session_p s, u_int8_t type, u_int8_t dlci);
 155 static int ng_btsocket_rfcomm_send_uih
 156         (ng_btsocket_rfcomm_session_p s, u_int8_t address, u_int8_t pf,
 157          u_int8_t credits, struct mbuf *data);
 158 static int ng_btsocket_rfcomm_send_msc
 159         (ng_btsocket_rfcomm_pcb_p pcb);
 160 static int ng_btsocket_rfcomm_send_pn
 161         (ng_btsocket_rfcomm_pcb_p pcb);
 162 static int ng_btsocket_rfcomm_send_credits
 163         (ng_btsocket_rfcomm_pcb_p pcb);
 164
 165 static int ng_btsocket_rfcomm_pcb_send
 166         (ng_btsocket_rfcomm_pcb_p pcb, int limit);
 167 static void ng_btsocket_rfcomm_pcb_kill
 168         (ng_btsocket_rfcomm_pcb_p pcb, int error);
 169 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_pcb_by_dlci
 170         (ng_btsocket_rfcomm_session_p s, int dlci);
 171 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_pcb_listener
 172         (bdaddr_p src, int channel);
 173
 174 static void ng_btsocket_rfcomm_timeout
 175         (ng_btsocket_rfcomm_pcb_p pcb);
 176 static void ng_btsocket_rfcomm_untimeout
 177         (ng_btsocket_rfcomm_pcb_p pcb);
 178 static void ng_btsocket_rfcomm_process_timeout
 179         (void *xpcb);
 180
 181 static struct mbuf * ng_btsocket_rfcomm_prepare_packet
 182         (struct sockbuf *sb, int length);
 183
 184 /* Globals */
 185 extern int                                      ifqmaxlen;
 186 static u_int32_t                                ng_btsocket_rfcomm_debug_level;
 187 static u_int32_t                                ng_btsocket_rfcomm_timo;
 188 struct task                                     ng_btsocket_rfcomm_task;
 189 static LIST_HEAD(, ng_btsocket_rfcomm_session)  ng_btsocket_rfcomm_sessions;
 190 static struct mtx                               ng_btsocket_rfcomm_sessions_mtx;
 191 static LIST_HEAD(, ng_btsocket_rfcomm_pcb)      ng_btsocket_rfcomm_sockets;
 192 static struct mtx                               ng_btsocket_rfcomm_sockets_mtx;
 193
 194 /* Sysctl tree */
 195 SYSCTL_DECL(_net_bluetooth_rfcomm_sockets);
 196 SYSCTL_NODE(_net_bluetooth_rfcomm_sockets, OID_AUTO, stream, CTLFLAG_RW,
 197         0, "Bluetooth STREAM RFCOMM sockets family");
 198 SYSCTL_INT(_net_bluetooth_rfcomm_sockets_stream, OID_AUTO, debug_level,
 199         CTLFLAG_RW,
 200         &ng_btsocket_rfcomm_debug_level, NG_BTSOCKET_INFO_LEVEL,
 201         "Bluetooth STREAM RFCOMM sockets debug level");
 202 SYSCTL_INT(_net_bluetooth_rfcomm_sockets_stream, OID_AUTO, timeout,
 203         CTLFLAG_RW,
 204         &ng_btsocket_rfcomm_timo, 60,
 205         "Bluetooth STREAM RFCOMM sockets timeout");
 206
 207 /*****************************************************************************
 208  *****************************************************************************
 209  **                              RFCOMM CRC
 210  *****************************************************************************
 211  *****************************************************************************/
 212
 213 static u_int8_t ng_btsocket_rfcomm_crc_table[256] = {
 214         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 215         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 216         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 217         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 218
 219         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 220         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 221         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 222         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 223
 224         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 225         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 226         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 227         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 228
 229         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 230         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 231         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 232         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 233
 234         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 235         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 236         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 237         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 238
 239         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 240         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 241         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 242         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 243
 244         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 245         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 246         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 247         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 248
 249         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 250         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 251         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 252         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 253 };
 254
 255 /* CRC */
 256 static u_int8_t
 257 ng_btsocket_rfcomm_crc(u_int8_t *data, int length)
 258 {
 259         u_int8_t        crc = 0xff;
 260
 261         while (length --)
 262                 crc = ng_btsocket_rfcomm_crc_table[crc ^ *data++];
 263
 264         return (crc);
 265 } /* ng_btsocket_rfcomm_crc */
 266
 267 /* FCS on 2 bytes */
 268 static u_int8_t
 269 ng_btsocket_rfcomm_fcs2(u_int8_t *data)
 270 {
 271         return (0xff - ng_btsocket_rfcomm_crc(data, 2));
 272 } /* ng_btsocket_rfcomm_fcs2 */
 273
 274 /* FCS on 3 bytes */
 275 static u_int8_t
 276 ng_btsocket_rfcomm_fcs3(u_int8_t *data)
 277 {
 278         return (0xff - ng_btsocket_rfcomm_crc(data, 3));
 279 } /* ng_btsocket_rfcomm_fcs3 */
 280
 281 /*
 282  * Check FCS
 283  *
 284  * From Bluetooth spec
 285  *
 286  * "... In 07.10, the frame check sequence (FCS) is calculated on different
 287  * sets of fields for different frame types. These are the fields that the
 288  * FCS are calculated on:
 289  *
 290  * For SABM, DISC, UA, DM frames: on Address, Control and length field.
 291  * For UIH frames: on Address and Control field.
 292  *
 293  * (This is stated here for clarification, and to set the standard for RFCOMM;
 294  * the fields included in FCS calculation have actually changed in version
 295  * 7.0.0 of TS 07.10, but RFCOMM will not change the FCS calculation scheme
 296  * from the one above.) ..."
 297  */
 298
 299 static int
 300 ng_btsocket_rfcomm_check_fcs(u_int8_t *data, int type, u_int8_t fcs)
 301 {
 302         if (type != RFCOMM_FRAME_UIH)
 303                 return (ng_btsocket_rfcomm_fcs3(data) != fcs);
 304
 305         return (ng_btsocket_rfcomm_fcs2(data) != fcs);
 306 } /* ng_btsocket_rfcomm_check_fcs */
 307
 308 /*****************************************************************************
 309  *****************************************************************************
 310  **                              Socket interface
 311  *****************************************************************************
 312  *****************************************************************************/
 313
 314 /*
 315  * Initialize everything
 316  */
 317
 318 void
 319 ng_btsocket_rfcomm_init(void)
 320 {
 321         ng_btsocket_rfcomm_debug_level = NG_BTSOCKET_WARN_LEVEL;
 322         ng_btsocket_rfcomm_timo = 60;
 323
 324         /* RFCOMM task */
 325         TASK_INIT(&ng_btsocket_rfcomm_task, 0,
 326                 ng_btsocket_rfcomm_sessions_task, NULL);
 327
 328         /* RFCOMM sessions list */
 329         LIST_INIT(&ng_btsocket_rfcomm_sessions);
 330         mtx_init(&ng_btsocket_rfcomm_sessions_mtx,
 331                 "btsocks_rfcomm_sessions_mtx", NULL, MTX_DEF);
 332
 333         /* RFCOMM sockets list */
 334         LIST_INIT(&ng_btsocket_rfcomm_sockets);
 335         mtx_init(&ng_btsocket_rfcomm_sockets_mtx,
 336                 "btsocks_rfcomm_sockets_mtx", NULL, MTX_DEF);
 337 } /* ng_btsocket_rfcomm_init */
 338
 339 /*
 340  * Abort connection on socket
 341  */
 342
 343 void
 344 ng_btsocket_rfcomm_abort(struct socket *so)
 345 {
 346
 347         so->so_error = ECONNABORTED;
 348         (void)ng_btsocket_rfcomm_disconnect(so);
 349 } /* ng_btsocket_rfcomm_abort */
 350
 351 void
 352 ng_btsocket_rfcomm_close(struct socket *so)
 353 {
 354
 355         (void)ng_btsocket_rfcomm_disconnect(so);
 356 } /* ng_btsocket_rfcomm_close */
 357
 358 /*
 359  * Accept connection on socket. Nothing to do here, socket must be connected
 360  * and ready, so just return peer address and be done with it.
 361  */
 362
 363 int
 364 ng_btsocket_rfcomm_accept(struct socket *so, struct sockaddr **nam)
 365 {
 366         return (ng_btsocket_rfcomm_peeraddr(so, nam));
 367 } /* ng_btsocket_rfcomm_accept */
 368
 369 /*
 370  * Create and attach new socket
 371  */
 372
 373 int
 374 ng_btsocket_rfcomm_attach(struct socket *so, int proto, struct thread *td)
 375 {
 376         ng_btsocket_rfcomm_pcb_p        pcb = so2rfcomm_pcb(so);
 377         int                             error;
 378
 379         /* Check socket and protocol */
 380         if (so->so_type != SOCK_STREAM)
 381                 return (ESOCKTNOSUPPORT);
 382
 383 #if 0 /* XXX sonewconn() calls "pru_attach" with proto == 0 */
 384         if (proto != 0)
 385                 if (proto != BLUETOOTH_PROTO_RFCOMM)
 386                         return (EPROTONOSUPPORT);
 387 #endif /* XXX */
 388
 389         if (pcb != NULL)
 390                 return (EISCONN);
 391
 392         /* Reserve send and receive space if it is not reserved yet */
 393         if ((so->so_snd.sb_hiwat == 0) || (so->so_rcv.sb_hiwat == 0)) {
 394                 error = soreserve(so, NG_BTSOCKET_RFCOMM_SENDSPACE,
 395                                         NG_BTSOCKET_RFCOMM_RECVSPACE);
 396                 if (error != 0)
 397                         return (error);
 398         }
 399
 400         /* Allocate the PCB */
 401         pcb = kmalloc(sizeof(*pcb), M_NETGRAPH_BTSOCKET_RFCOMM,
 402                       M_WAITOK | M_NULLOK | M_ZERO);
 403         if (pcb == NULL)
 404                 return (ENOMEM);
 405
 406         /* Link the PCB and the socket */
 407         so->so_pcb = (caddr_t) pcb;
 408         pcb->so = so;
 409
 410         /* Initialize PCB */
 411         pcb->state = NG_BTSOCKET_RFCOMM_DLC_CLOSED;
 412         pcb->flags = NG_BTSOCKET_RFCOMM_DLC_CFC;
 413
 414         pcb->lmodem =
 415         pcb->rmodem = (RFCOMM_MODEM_RTC | RFCOMM_MODEM_RTR | RFCOMM_MODEM_DV);
 416
 417         pcb->mtu = RFCOMM_DEFAULT_MTU;
 418         pcb->tx_cred = 0;
 419         pcb->rx_cred = RFCOMM_DEFAULT_CREDITS;
 420
 421         mtx_init(&pcb->pcb_mtx, "btsocks_rfcomm_pcb_mtx", NULL, MTX_DEF);
 422         callout_handle_init(&pcb->timo);
 423
 424         /* Add the PCB to the list */
 425         mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
 426         LIST_INSERT_HEAD(&ng_btsocket_rfcomm_sockets, pcb, next);
 427         mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
 428
 429         return (0);
 430 } /* ng_btsocket_rfcomm_attach */
 431
 432 /*
 433  * Bind socket
 434  */
 435
 436 int
 437 ng_btsocket_rfcomm_bind(struct socket *so, struct sockaddr *nam,
 438                 struct thread *td)
 439 {
 440         ng_btsocket_rfcomm_pcb_t        *pcb = so2rfcomm_pcb(so), *pcb1;
 441         struct sockaddr_rfcomm          *sa = (struct sockaddr_rfcomm *) nam;
 442
 443         if (pcb == NULL)
 444                 return (EINVAL);
 445
 446         /* Verify address */
 447         if (sa == NULL)
 448                 return (EINVAL);
 449         if (sa->rfcomm_family != AF_BLUETOOTH)
 450                 return (EAFNOSUPPORT);
 451         if (sa->rfcomm_len != sizeof(*sa))
 452                 return (EINVAL);
 453         if (sa->rfcomm_channel > 30)
 454                 return (EINVAL);
 455
 456         mtx_lock(&pcb->pcb_mtx);
 457
 458         if (sa->rfcomm_channel != 0) {
 459                 mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
 460
 461                 LIST_FOREACH(pcb1, &ng_btsocket_rfcomm_sockets, next) {
 462                         if (pcb1->channel == sa->rfcomm_channel &&
 463                             bcmp(&pcb1->src, &sa->rfcomm_bdaddr,
 464                                         sizeof(pcb1->src)) == 0) {
 465                                 mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
 466                                 mtx_unlock(&pcb->pcb_mtx);
 467
 468                                 return (EADDRINUSE);
 469                         }
 470                 }
 471
 472                 mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
 473         }
 474
 475         bcopy(&sa->rfcomm_bdaddr, &pcb->src, sizeof(pcb->src));
 476         pcb->channel = sa->rfcomm_channel;
 477
 478         mtx_unlock(&pcb->pcb_mtx);
 479
 480         return (0);
 481 } /* ng_btsocket_rfcomm_bind */
 482
 483 /*
 484  * Connect socket
 485  */
 486
 487 int
 488 ng_btsocket_rfcomm_connect(struct socket *so, struct sockaddr *nam,
 489                 struct thread *td)
 490 {
 491         ng_btsocket_rfcomm_pcb_t        *pcb = so2rfcomm_pcb(so);
 492         struct sockaddr_rfcomm          *sa = (struct sockaddr_rfcomm *) nam;
 493         ng_btsocket_rfcomm_session_t    *s = NULL;
 494         struct socket                   *l2so = NULL;
 495         int                              dlci, error = 0;
 496
 497         if (pcb == NULL)
 498                 return (EINVAL);
 499
 500         /* Verify address */
 501         if (sa == NULL)
 502                 return (EINVAL);
 503         if (sa->rfcomm_family != AF_BLUETOOTH)
 504                 return (EAFNOSUPPORT);
 505         if (sa->rfcomm_len != sizeof(*sa))
 506                 return (EINVAL);
 507         if (sa->rfcomm_channel > 30)
 508                 return (EINVAL);
 509         if (sa->rfcomm_channel == 0 ||
 510             bcmp(&sa->rfcomm_bdaddr, NG_HCI_BDADDR_ANY, sizeof(bdaddr_t)) == 0)
 511                 return (EDESTADDRREQ);
 512
 513         /*
 514          * XXX FIXME - This is FUBAR. socreate() will call soalloc(1), i.e.
 515          * soalloc() is allowed to sleep in MALLOC. This creates "could sleep"
 516          * WITNESS warnings. To work around this problem we will create L2CAP
 517          * socket first and then check if we actually need it. Note that we
 518          * will not check for errors in socreate() because if we failed to
 519          * create L2CAP socket at this point we still might have already open
 520          * session.
 521          */
 522
 523         error = socreate(PF_BLUETOOTH, &l2so, SOCK_SEQPACKET,
 524                         BLUETOOTH_PROTO_L2CAP, td->td_ucred, td);
 525
 526         /*
 527          * Look for session between "pcb->src" and "sa->rfcomm_bdaddr" (dst)
 528          */
 529
 530         mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
 531
 532         s = ng_btsocket_rfcomm_session_by_addr(&pcb->src, &sa->rfcomm_bdaddr);
 533         if (s == NULL) {
 534                 /*
 535                  * We need to create new RFCOMM session. Check if we have L2CAP
 536                  * socket. If l2so == NULL then error has the error code from
 537                  * socreate()
 538                  */
 539
 540                 if (l2so == NULL) {
 541                         mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
 542                         return (error);
 543                 }
 544
 545                 error = ng_btsocket_rfcomm_session_create(&s, l2so,
 546                                 &pcb->src, &sa->rfcomm_bdaddr, td);
 547                 if (error != 0) {
 548                         mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
 549                         soclose(l2so);
 550
 551                         return (error);
 552                 }
 553         } else if (l2so != NULL)
 554                 soclose(l2so); /* we don't need new L2CAP socket */
 555
 556         /*
 557          * Check if we already have the same DLCI the the same session
 558          */
 559
 560         mtx_lock(&s->session_mtx);
 561         mtx_lock(&pcb->pcb_mtx);
 562
 563         dlci = RFCOMM_MKDLCI(!INITIATOR(s), sa->rfcomm_channel);
 564
 565         if (ng_btsocket_rfcomm_pcb_by_dlci(s, dlci) != NULL) {
 566                 mtx_unlock(&pcb->pcb_mtx);
 567                 mtx_unlock(&s->session_mtx);
 568                 mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
 569
 570                 return (EBUSY);
 571         }
 572
 573         /*
 574          * Check session state and if its not acceptable then refuse connection
 575          */
 576
 577         switch (s->state) {
 578         case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
 579         case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
 580         case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
 581                 /*
 582                  * Update destination address and channel and attach
 583                  * DLC to the session
 584                  */
 585
 586                 bcopy(&sa->rfcomm_bdaddr, &pcb->dst, sizeof(pcb->dst));
 587                 pcb->channel = sa->rfcomm_channel;
 588                 pcb->dlci = dlci;
 589
 590                 LIST_INSERT_HEAD(&s->dlcs, pcb, session_next);
 591                 pcb->session = s;
 592
 593                 ng_btsocket_rfcomm_timeout(pcb);
 594                 soisconnecting(pcb->so);
 595
 596                 if (s->state == NG_BTSOCKET_RFCOMM_SESSION_OPEN) {
 597                         pcb->mtu = s->mtu;
 598                         bcopy(&so2l2cap_pcb(s->l2so)->src, &pcb->src,
 599                                 sizeof(pcb->src));
 600
 601                         pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONFIGURING;
 602
 603                         error = ng_btsocket_rfcomm_send_pn(pcb);
 604                         if (error == 0)
 605                                 error = ng_btsocket_rfcomm_task_wakeup();
 606                 } else
 607                         pcb->state = NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT;
 608                 break;
 609
 610         default:
 611                 error = ECONNRESET;
 612                 break;
 613         }
 614
 615         mtx_unlock(&pcb->pcb_mtx);
 616         mtx_unlock(&s->session_mtx);
 617         mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
 618
 619         return (error);
 620 } /* ng_btsocket_rfcomm_connect */
 621
 622 /*
 623  * Process ioctl's calls on socket.
 624  * XXX FIXME this should provide interface to the RFCOMM multiplexor channel
 625  */
 626
 627 int
 628 ng_btsocket_rfcomm_control(struct socket *so, u_long cmd, caddr_t data,
 629                 struct ifnet *ifp, struct thread *td)
 630 {
 631         return (EINVAL);
 632 } /* ng_btsocket_rfcomm_control */
 633
 634 /*
 635  * Process getsockopt/setsockopt system calls
 636  */
 637
 638 int
 639 ng_btsocket_rfcomm_ctloutput(struct socket *so, struct sockopt *sopt)
 640 {
 641         ng_btsocket_rfcomm_pcb_p                pcb = so2rfcomm_pcb(so);
 642         struct ng_btsocket_rfcomm_fc_info       fcinfo;
 643         int                                     error = 0;
 644
 645         if (pcb == NULL)
 646                 return (EINVAL);
 647         if (sopt->sopt_level != SOL_RFCOMM)
 648                 return (0);
 649
 650         mtx_lock(&pcb->pcb_mtx);
 651
 652         switch (sopt->sopt_dir) {
 653         case SOPT_GET:
 654                 switch (sopt->sopt_name) {
 655                 case SO_RFCOMM_MTU:
 656                         error = sooptcopyout(sopt, &pcb->mtu, sizeof(pcb->mtu));
 657                         break;
 658
 659                 case SO_RFCOMM_FC_INFO:
 660                         fcinfo.lmodem = pcb->lmodem;
 661                         fcinfo.rmodem = pcb->rmodem;
 662                         fcinfo.tx_cred = pcb->tx_cred;
 663                         fcinfo.rx_cred = pcb->rx_cred;
 664                         fcinfo.cfc = (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)?
 665                                 1 : 0;
 666                         fcinfo.reserved = 0;
 667
 668                         error = sooptcopyout(sopt, &fcinfo, sizeof(fcinfo));
 669                         break;
 670
 671                 default:
 672                         error = ENOPROTOOPT;
 673                         break;
 674                 }
 675                 break;
 676
 677         case SOPT_SET:
 678                 switch (sopt->sopt_name) {
 679                 default:
 680                         error = ENOPROTOOPT;
 681                         break;
 682                 }
 683                 break;
 684
 685         default:
 686                 error = EINVAL;
 687                 break;
 688         }
 689
 690         mtx_unlock(&pcb->pcb_mtx);
 691
 692         return (error);
 693 } /* ng_btsocket_rfcomm_ctloutput */
 694
 695 /*
 696  * Detach and destroy socket
 697  */
 698
 699 void
 700 ng_btsocket_rfcomm_detach(struct socket *so)
 701 {
 702         ng_btsocket_rfcomm_pcb_p        pcb = so2rfcomm_pcb(so);
 703
 704         KASSERT(pcb != NULL, ("ng_btsocket_rfcomm_detach: pcb == NULL"));
 705
 706         mtx_lock(&pcb->pcb_mtx);
 707
 708         so->so_pcb = NULL;
 709
 710         switch (pcb->state) {
 711         case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
 712         case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
 713         case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
 714         case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
 715                 /* XXX What to do with pending request? */
 716                 if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
 717                         ng_btsocket_rfcomm_untimeout(pcb);
 718
 719                 if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT)
 720                         pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_DETACHED;
 721                 else
 722                         pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
 723
 724                 ng_btsocket_rfcomm_task_wakeup();
 725                 break;
 726
 727         case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
 728                 ng_btsocket_rfcomm_task_wakeup();
 729                 break;
 730         }
 731
 732         while (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CLOSED)
 733                 msleep(&pcb->state, &pcb->pcb_mtx, PZERO, "rf_det", 0);
 734
 735         if (pcb->session != NULL)
 736                 panic("%s: pcb->session != NULL", __func__);
 737         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
 738                 panic("%s: timeout on closed DLC, flags=%#x",
 739                         __func__, pcb->flags);
 740
 741         mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
 742         LIST_REMOVE(pcb, next);
 743         mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
 744
 745         mtx_unlock(&pcb->pcb_mtx);
 746
 747         mtx_destroy(&pcb->pcb_mtx);
 748         bzero(pcb, sizeof(*pcb));
 749         kfree(pcb, M_NETGRAPH_BTSOCKET_RFCOMM);
 750
 751         soisdisconnected(so);
 752         sofree(so);             /* for so_pcb = NULL */
 753 } /* ng_btsocket_rfcomm_detach */
 754
 755 /*
 756  * Disconnect socket
 757  */
 758
 759 int
 760 ng_btsocket_rfcomm_disconnect(struct socket *so)
 761 {
 762         ng_btsocket_rfcomm_pcb_p        pcb = so2rfcomm_pcb(so);
 763
 764         if (pcb == NULL)
 765                 return (EINVAL);
 766
 767         mtx_lock(&pcb->pcb_mtx);
 768
 769         if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING) {
 770                 mtx_unlock(&pcb->pcb_mtx);
 771                 return (EINPROGRESS);
 772         }
 773
 774         /* XXX What to do with pending request? */
 775         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
 776                 ng_btsocket_rfcomm_untimeout(pcb);
 777
 778         switch (pcb->state) {
 779         case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING: /* XXX can we get here? */
 780         case NG_BTSOCKET_RFCOMM_DLC_CONNECTING: /* XXX can we get here? */
 781         case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
 782
 783                 /*
 784                  * Just change DLC state and enqueue RFCOMM task. It will
 785                  * queue and send DISC on the DLC.
 786                  */
 787
 788                 pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
 789                 soisdisconnecting(so);
 790
 791                 ng_btsocket_rfcomm_task_wakeup();
 792                 break;
 793
 794         case NG_BTSOCKET_RFCOMM_DLC_CLOSED:
 795         case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
 796                 break;
 797
 798         default:
 799                 panic("%s: Invalid DLC state=%d, flags=%#x",
 800                         __func__, pcb->state, pcb->flags);
 801                 break;
 802         }
 803
 804         mtx_unlock(&pcb->pcb_mtx);
 805
 806         return (0);
 807 } /* ng_btsocket_rfcomm_disconnect */
 808
 809 /*
 810  * Listen on socket. First call to listen() will create listening RFCOMM session
 811  */
 812
 813 int
 814 ng_btsocket_rfcomm_listen(struct socket *so, int backlog, struct thread *td)
 815 {
 816         ng_btsocket_rfcomm_pcb_p         pcb = so2rfcomm_pcb(so), pcb1;
 817         ng_btsocket_rfcomm_session_p     s = NULL;
 818         struct socket                   *l2so = NULL;
 819         int                              error, socreate_error, usedchannels;
 820
 821         if (pcb == NULL)
 822                 return (EINVAL);
 823         if (pcb->channel > 30)
 824                 return (EADDRNOTAVAIL);
 825
 826         usedchannels = 0;
 827
 828         mtx_lock(&pcb->pcb_mtx);
 829
 830         if (pcb->channel == 0) {
 831                 mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
 832
 833                 LIST_FOREACH(pcb1, &ng_btsocket_rfcomm_sockets, next)
 834                         if (pcb1->channel != 0 &&
 835                             bcmp(&pcb1->src, &pcb->src, sizeof(pcb->src)) == 0)
 836                                 usedchannels |= (1 << (pcb1->channel - 1));
 837
 838                 for (pcb->channel = 30; pcb->channel > 0; pcb->channel --)
 839                         if (!(usedchannels & (1 << (pcb->channel - 1))))
 840                                 break;
 841
 842                 if (pcb->channel == 0) {
 843                         mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
 844                         mtx_unlock(&pcb->pcb_mtx);
 845
 846                         return (EADDRNOTAVAIL);
 847                 }
 848
 849                 mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
 850         }
 851
 852         mtx_unlock(&pcb->pcb_mtx);
 853
 854         /*
 855          * XXX FIXME - This is FUBAR. socreate() will call soalloc(1), i.e.
 856          * soalloc() is allowed to sleep in MALLOC. This creates "could sleep"
 857          * WITNESS warnings. To work around this problem we will create L2CAP
 858          * socket first and then check if we actually need it. Note that we
 859          * will not check for errors in socreate() because if we failed to
 860          * create L2CAP socket at this point we still might have already open
 861          * session.
 862          */
 863
 864         socreate_error = socreate(PF_BLUETOOTH, &l2so, SOCK_SEQPACKET,
 865                         BLUETOOTH_PROTO_L2CAP, td->td_ucred, td);
 866
 867         /*
 868          * Transition the socket and session into the LISTENING state.  Check
 869          * for collisions first, as there can only be one.
 870          */
 871         mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
 872         SOCK_LOCK(so);
 873         error = solisten_proto_check(so);
 874         SOCK_UNLOCK(so);
 875         if (error != 0)
 876                 goto out;
 877
 878         LIST_FOREACH(s, &ng_btsocket_rfcomm_sessions, next)
 879                 if (s->state == NG_BTSOCKET_RFCOMM_SESSION_LISTENING)
 880                         break;
 881
 882         if (s == NULL) {
 883                 /*
 884                  * We need to create default RFCOMM session. Check if we have
 885                  * L2CAP socket. If l2so == NULL then error has the error code
 886                  * from socreate()
 887                  */
 888                 if (l2so == NULL) {
 889                         error = socreate_error;
 890                         goto out;
 891                 }
 892
 893                 /*
 894                  * Create default listen RFCOMM session. The default RFCOMM
 895                  * session will listen on ANY address.
 896                  *
 897                  * XXX FIXME Note that currently there is no way to adjust MTU
 898                  * for the default session.
 899                  */
 900                 error = ng_btsocket_rfcomm_session_create(&s, l2so,
 901                                         NG_HCI_BDADDR_ANY, NULL, td);
 902                 if (error != 0)
 903                         goto out;
 904                 l2so = NULL;
 905         }
 906         SOCK_LOCK(so);
 907         solisten_proto(so, backlog);
 908         SOCK_UNLOCK(so);
 909 out:
 910         mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
 911         /*
 912          * If we still have an l2so reference here, it's unneeded, so release
 913          * it.
 914          */
 915         if (l2so != NULL)
 916                 soclose(l2so);
 917         return (error);
 918 } /* ng_btsocket_listen */
 919
 920 /*
 921  * Get peer address
 922  */
 923
 924 int
 925 ng_btsocket_rfcomm_peeraddr(struct socket *so, struct sockaddr **nam)
 926 {
 927         ng_btsocket_rfcomm_pcb_p        pcb = so2rfcomm_pcb(so);
 928         struct sockaddr_rfcomm          sa;
 929
 930         if (pcb == NULL)
 931                 return (EINVAL);
 932
 933         bcopy(&pcb->dst, &sa.rfcomm_bdaddr, sizeof(sa.rfcomm_bdaddr));
 934         sa.rfcomm_channel = pcb->channel;
 935         sa.rfcomm_len = sizeof(sa);
 936         sa.rfcomm_family = AF_BLUETOOTH;
 937
 938         *nam = sodupsockaddr((struct sockaddr *) &sa, M_WAITOK | M_NULLOK);
 939
 940         return ((*nam == NULL)? ENOMEM : 0);
 941 } /* ng_btsocket_rfcomm_peeraddr */
 942
 943 /*
 944  * Send data to socket
 945  */
 946
 947 int
 948 ng_btsocket_rfcomm_send(struct socket *so, int flags, struct mbuf *m,
 949                 struct sockaddr *nam, struct mbuf *control, struct thread *td)
 950 {
 951         ng_btsocket_rfcomm_pcb_t        *pcb = so2rfcomm_pcb(so);
 952         int                              error = 0;
 953
 954         /* Check socket and input */
 955         if (pcb == NULL || m == NULL || control != NULL) {
 956                 error = EINVAL;
 957                 goto drop;
 958         }
 959
 960         mtx_lock(&pcb->pcb_mtx);
 961
 962         /* Make sure DLC is connected */
 963         if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
 964                 mtx_unlock(&pcb->pcb_mtx);
 965                 error = ENOTCONN;
 966                 goto drop;
 967         }
 968
 969         /* Put the packet on the socket's send queue and wakeup RFCOMM task */
 970         sbappend(&pcb->so->so_snd, m);
 971         m = NULL;
 972
 973         if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_SENDING)) {
 974                 pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_SENDING;
 975                 error = ng_btsocket_rfcomm_task_wakeup();
 976         }
 977
 978         mtx_unlock(&pcb->pcb_mtx);
 979 drop:
 980         NG_FREE_M(m); /* checks for != NULL */
 981         NG_FREE_M(control);
 982
 983         return (error);
 984 } /* ng_btsocket_rfcomm_send */
 985
 986 /*
 987  * Get socket address
 988  */
 989
 990 int
 991 ng_btsocket_rfcomm_sockaddr(struct socket *so, struct sockaddr **nam)
 992 {
 993         ng_btsocket_rfcomm_pcb_p        pcb = so2rfcomm_pcb(so);
 994         struct sockaddr_rfcomm          sa;
 995
 996         if (pcb == NULL)
 997                 return (EINVAL);
 998
 999         bcopy(&pcb->src, &sa.rfcomm_bdaddr, sizeof(sa.rfcomm_bdaddr));
1000         sa.rfcomm_channel = pcb->channel;
1001         sa.rfcomm_len = sizeof(sa);
1002         sa.rfcomm_family = AF_BLUETOOTH;
1003
1004         *nam = sodupsockaddr((struct sockaddr *) &sa, M_WAITOK | M_NULLOK);
1005
1006         return ((*nam == NULL)? ENOMEM : 0);
1007 } /* ng_btsocket_rfcomm_sockaddr */
1008
1009 /*
1010  * Upcall function for L2CAP sockets. Enqueue RFCOMM task.
1011  */
1012
1013 static void
1014 ng_btsocket_rfcomm_upcall(struct socket *so, void *arg, int waitflag)
1015 {
1016         int     error;
1017
1018         if (so == NULL)
1019                 panic("%s: so == NULL", __func__);
1020
1021         if ((error = ng_btsocket_rfcomm_task_wakeup()) != 0)
1022                 NG_BTSOCKET_RFCOMM_ALERT(
1023 "%s: Could not enqueue RFCOMM task, error=%d\n", __func__, error);
1024 } /* ng_btsocket_rfcomm_upcall */
1025
1026 /*
1027  * RFCOMM task. Will handle all RFCOMM sessions in one pass.
1028  * XXX FIXME does not scale very well
1029  */
1030
1031 static void
1032 ng_btsocket_rfcomm_sessions_task(void *ctx, int pending)
1033 {
1034         ng_btsocket_rfcomm_session_p    s = NULL, s_next = NULL;
1035
1036         mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
1037
1038         for (s = LIST_FIRST(&ng_btsocket_rfcomm_sessions); s != NULL; ) {
1039                 mtx_lock(&s->session_mtx);
1040                 s_next = LIST_NEXT(s, next);
1041
1042                 ng_btsocket_rfcomm_session_task(s);
1043
1044                 if (s->state == NG_BTSOCKET_RFCOMM_SESSION_CLOSED) {
1045                         /* Unlink and clean the session */
1046                         LIST_REMOVE(s, next);
1047
1048                         NG_BT_MBUFQ_DRAIN(&s->outq);
1049                         if (!LIST_EMPTY(&s->dlcs))
1050                                 panic("%s: DLC list is not empty", __func__);
1051
1052                         /* Close L2CAP socket */
1053                         s->l2so->so_upcallarg = NULL;
1054                         s->l2so->so_upcall = NULL;
1055                         SOCKBUF_LOCK(&s->l2so->so_rcv);
1056                         s->l2so->so_rcv.sb_flags &= ~SB_UPCALL;
1057                         SOCKBUF_UNLOCK(&s->l2so->so_rcv);
1058                         SOCKBUF_LOCK(&s->l2so->so_snd);
1059                         s->l2so->so_snd.sb_flags &= ~SB_UPCALL;
1060                         SOCKBUF_UNLOCK(&s->l2so->so_snd);
1061                         soclose(s->l2so);
1062
1063                         mtx_unlock(&s->session_mtx);
1064
1065                         mtx_destroy(&s->session_mtx);
1066                         bzero(s, sizeof(*s));
1067                         kfree(s, M_NETGRAPH_BTSOCKET_RFCOMM);
1068                 } else
1069                         mtx_unlock(&s->session_mtx);
1070
1071                 s = s_next;
1072         }
1073
1074         mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
1075 } /* ng_btsocket_rfcomm_sessions_task */
1076
1077 /*
1078  * Process RFCOMM session. Will handle all RFCOMM sockets in one pass.
1079  */
1080
1081 static void
1082 ng_btsocket_rfcomm_session_task(ng_btsocket_rfcomm_session_p s)
1083 {
1084         mtx_assert(&s->session_mtx, MA_OWNED);
1085
1086         if (s->l2so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1087                 NG_BTSOCKET_RFCOMM_INFO(
1088 "%s: L2CAP connection has been terminated, so=%p, so_state=%#x, so_count=%d, " \
1089 "state=%d, flags=%#x\n", __func__, s->l2so, s->l2so->so_state,
1090                         s->l2so->so_count, s->state, s->flags);
1091
1092                 s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1093                 ng_btsocket_rfcomm_session_clean(s);
1094         }
1095
1096         /* Now process upcall */
1097         switch (s->state) {
1098         /* Try to accept new L2CAP connection(s) */
1099         case NG_BTSOCKET_RFCOMM_SESSION_LISTENING:
1100                 while (ng_btsocket_rfcomm_session_accept(s) == 0)
1101                         ;
1102                 break;
1103
1104         /* Process the results of the L2CAP connect */
1105         case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
1106                 ng_btsocket_rfcomm_session_process_pcb(s);
1107
1108                 if (ng_btsocket_rfcomm_session_connect(s) != 0) {
1109                         s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1110                         ng_btsocket_rfcomm_session_clean(s);
1111                 }
1112                 break;
1113
1114         /* Try to receive/send more data */
1115         case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
1116         case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
1117         case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
1118                 ng_btsocket_rfcomm_session_process_pcb(s);
1119
1120                 if (ng_btsocket_rfcomm_session_receive(s) != 0) {
1121                         s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1122                         ng_btsocket_rfcomm_session_clean(s);
1123                 } else if (ng_btsocket_rfcomm_session_send(s) != 0) {
1124                         s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1125                         ng_btsocket_rfcomm_session_clean(s);
1126                 }
1127                 break;
1128
1129         case NG_BTSOCKET_RFCOMM_SESSION_CLOSED:
1130                 break;
1131
1132         default:
1133                 panic("%s: Invalid session state=%d, flags=%#x",
1134                         __func__, s->state, s->flags);
1135                 break;
1136         }
1137 } /* ng_btsocket_rfcomm_session_task */
1138
1139 /*
1140  * Process RFCOMM connection indicator. Caller must hold s->session_mtx
1141  */
1142
1143 static ng_btsocket_rfcomm_pcb_p
1144 ng_btsocket_rfcomm_connect_ind(ng_btsocket_rfcomm_session_p s, int channel)
1145 {
1146         ng_btsocket_rfcomm_pcb_p         pcb = NULL, pcb1 = NULL;
1147         ng_btsocket_l2cap_pcb_p          l2pcb = NULL;
1148         struct socket                   *so1 = NULL;
1149
1150         mtx_assert(&s->session_mtx, MA_OWNED);
1151
1152         /*
1153          * Try to find RFCOMM socket that listens on given source address
1154          * and channel. This will return the best possible match.
1155          */
1156
1157         l2pcb = so2l2cap_pcb(s->l2so);
1158         pcb = ng_btsocket_rfcomm_pcb_listener(&l2pcb->src, channel);
1159         if (pcb == NULL)
1160                 return (NULL);
1161
1162         /*
1163          * Check the pending connections queue and if we have space then
1164          * create new socket and set proper source and destination address,
1165          * and channel.
1166          */
1167
1168         mtx_lock(&pcb->pcb_mtx);
1169
1170         if (pcb->so->so_qlen <= pcb->so->so_qlimit)
1171                 so1 = sonewconn(pcb->so, 0);
1172
1173         mtx_unlock(&pcb->pcb_mtx);
1174
1175         if (so1 == NULL)
1176                 return (NULL);
1177
1178         /*
1179          * If we got here than we have created new socket. So complete the
1180          * connection. Set source and destination address from the session.
1181          */
1182
1183         pcb1 = so2rfcomm_pcb(so1);
1184         if (pcb1 == NULL)
1185                 panic("%s: pcb1 == NULL", __func__);
1186
1187         mtx_lock(&pcb1->pcb_mtx);
1188
1189         bcopy(&l2pcb->src, &pcb1->src, sizeof(pcb1->src));
1190         bcopy(&l2pcb->dst, &pcb1->dst, sizeof(pcb1->dst));
1191         pcb1->channel = channel;
1192
1193         /* Link new DLC to the session. We already hold s->session_mtx */
1194         LIST_INSERT_HEAD(&s->dlcs, pcb1, session_next);
1195         pcb1->session = s;
1196
1197         mtx_unlock(&pcb1->pcb_mtx);
1198
1199         return (pcb1);
1200 } /* ng_btsocket_rfcomm_connect_ind */
1201
1202 /*
1203  * Process RFCOMM connect confirmation. Caller must hold s->session_mtx.
1204  */
1205
1206 static void
1207 ng_btsocket_rfcomm_connect_cfm(ng_btsocket_rfcomm_session_p s)
1208 {
1209         ng_btsocket_rfcomm_pcb_p        pcb = NULL, pcb_next = NULL;
1210         int                             error;
1211
1212         mtx_assert(&s->session_mtx, MA_OWNED);
1213
1214         /*
1215          * Wake up all waiting sockets and send PN request for each of them.
1216          * Note that timeout already been set in ng_btsocket_rfcomm_connect()
1217          *
1218          * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1219          * will unlink DLC from the session
1220          */
1221
1222         for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1223                 mtx_lock(&pcb->pcb_mtx);
1224                 pcb_next = LIST_NEXT(pcb, session_next);
1225
1226                 if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT) {
1227                         pcb->mtu = s->mtu;
1228                         bcopy(&so2l2cap_pcb(s->l2so)->src, &pcb->src,
1229                                 sizeof(pcb->src));
1230
1231                         error = ng_btsocket_rfcomm_send_pn(pcb);
1232                         if (error == 0)
1233                                 pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONFIGURING;
1234                         else
1235                                 ng_btsocket_rfcomm_pcb_kill(pcb, error);
1236                 }
1237
1238                 mtx_unlock(&pcb->pcb_mtx);
1239                 pcb = pcb_next;
1240         }
1241 } /* ng_btsocket_rfcomm_connect_cfm */
1242
1243 /*****************************************************************************
1244  *****************************************************************************
1245  **                              RFCOMM sessions
1246  *****************************************************************************
1247  *****************************************************************************/
1248
1249 /*
1250  * Create new RFCOMM session. That function WILL NOT take ownership over l2so.
1251  * Caller MUST free l2so if function failed.
1252  */
1253
1254 static int
1255 ng_btsocket_rfcomm_session_create(ng_btsocket_rfcomm_session_p *sp,
1256                 struct socket *l2so, bdaddr_p src, bdaddr_p dst,
1257                 struct thread *td)
1258 {
1259         ng_btsocket_rfcomm_session_p    s = NULL;
1260         struct sockaddr_l2cap           l2sa;
1261         struct sockopt                  l2sopt;
1262         int                             error;
1263         u_int16_t                       mtu;
1264
1265         mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1266
1267         /* Allocate the RFCOMM session */
1268         s = kmalloc(sizeof(*s), M_NETGRAPH_BTSOCKET_RFCOMM,
1269                     M_WAITOK | M_NULLOK | M_ZERO);
1270         if (s == NULL)
1271                 return (ENOMEM);
1272
1273         /* Set defaults */
1274         s->mtu = RFCOMM_DEFAULT_MTU;
1275         s->flags = 0;
1276         s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1277         NG_BT_MBUFQ_INIT(&s->outq, ifqmaxlen);
1278
1279         /*
1280          * XXX Mark session mutex as DUPOK to prevent "duplicated lock of
1281          * the same type" message. When accepting new L2CAP connection
1282          * ng_btsocket_rfcomm_session_accept() holds both session mutexes
1283          * for "old" (accepting) session and "new" (created) session.
1284          */
1285
1286         mtx_init(&s->session_mtx, "btsocks_rfcomm_session_mtx", NULL,
1287                 MTX_DEF|MTX_DUPOK);
1288
1289         LIST_INIT(&s->dlcs);
1290
1291         /* Prepare L2CAP socket */
1292         l2so->so_upcallarg = NULL;
1293         l2so->so_upcall = ng_btsocket_rfcomm_upcall;
1294         SOCKBUF_LOCK(&l2so->so_rcv);
1295         l2so->so_rcv.sb_flags |= SB_UPCALL;
1296         SOCKBUF_UNLOCK(&l2so->so_rcv);
1297         SOCKBUF_LOCK(&l2so->so_snd);
1298         l2so->so_snd.sb_flags |= SB_UPCALL;
1299         SOCKBUF_UNLOCK(&l2so->so_snd);
1300         sosetstate(l2so, SS_NBIO);
1301         s->l2so = l2so;
1302
1303         mtx_lock(&s->session_mtx);
1304
1305         /*
1306          * "src" == NULL and "dst" == NULL means just create session.
1307          * caller must do the rest
1308          */
1309
1310         if (src == NULL && dst == NULL)
1311                 goto done;
1312
1313         /*
1314          * Set incoming MTU on L2CAP socket. It is RFCOMM session default MTU
1315          * plus 5 bytes: RFCOMM frame header, one extra byte for length and one
1316          * extra byte for credits.
1317          */
1318
1319         mtu = s->mtu + sizeof(struct rfcomm_frame_hdr) + 1 + 1;
1320
1321         l2sopt.sopt_dir = SOPT_SET;
1322         l2sopt.sopt_level = SOL_L2CAP;
1323         l2sopt.sopt_name = SO_L2CAP_IMTU;
1324         l2sopt.sopt_val = (void *) &mtu;
1325         l2sopt.sopt_valsize = sizeof(mtu);
1326         l2sopt.sopt_td = NULL;
1327
1328         error = sosetopt(s->l2so, &l2sopt);
1329         if (error != 0)
1330                 goto bad;
1331
1332         /* Bind socket to "src" address */
1333         l2sa.l2cap_len = sizeof(l2sa);
1334         l2sa.l2cap_family = AF_BLUETOOTH;
1335         l2sa.l2cap_psm = (dst == NULL)? htole16(NG_L2CAP_PSM_RFCOMM) : 0;
1336         bcopy(src, &l2sa.l2cap_bdaddr, sizeof(l2sa.l2cap_bdaddr));
1337
1338         error = sobind(s->l2so, (struct sockaddr *) &l2sa, td);
1339         if (error != 0)
1340                 goto bad;
1341
1342         /* If "dst" is not NULL then initiate connect(), otherwise listen() */
1343         if (dst == NULL) {
1344                 s->flags = 0;
1345                 s->state = NG_BTSOCKET_RFCOMM_SESSION_LISTENING;
1346
1347                 error = solisten(s->l2so, 10, td);
1348                 if (error != 0)
1349                         goto bad;
1350         } else {
1351                 s->flags = NG_BTSOCKET_RFCOMM_SESSION_INITIATOR;
1352                 s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTING;
1353
1354                 l2sa.l2cap_len = sizeof(l2sa);
1355                 l2sa.l2cap_family = AF_BLUETOOTH;
1356                 l2sa.l2cap_psm = htole16(NG_L2CAP_PSM_RFCOMM);
1357                 bcopy(dst, &l2sa.l2cap_bdaddr, sizeof(l2sa.l2cap_bdaddr));
1358
1359                 error = soconnect(s->l2so, (struct sockaddr *) &l2sa, td, TRUE);
1360                 if (error != 0)
1361                         goto bad;
1362         }
1363
1364 done:
1365         LIST_INSERT_HEAD(&ng_btsocket_rfcomm_sessions, s, next);
1366         *sp = s;
1367
1368         mtx_unlock(&s->session_mtx);
1369
1370         return (0);
1371
1372 bad:
1373         mtx_unlock(&s->session_mtx);
1374
1375         /* Return L2CAP socket back to its original state */
1376         l2so->so_upcallarg = NULL;
1377         l2so->so_upcall = NULL;
1378         SOCKBUF_LOCK(&l2so->so_rcv);
1379         l2so->so_rcv.sb_flags &= ~SB_UPCALL;
1380         SOCKBUF_UNLOCK(&l2so->so_rcv);
1381         SOCKBUF_LOCK(&l2so->so_snd);
1382         l2so->so_snd.sb_flags &= ~SB_UPCALL;
1383         SOCKBUF_UNLOCK(&l2so->so_snd);
1384         soclrstate(l2so, SS_NBIO);
1385
1386         mtx_destroy(&s->session_mtx);
1387         bzero(s, sizeof(*s));
1388         kfree(s, M_NETGRAPH_BTSOCKET_RFCOMM);
1389
1390         return (error);
1391 } /* ng_btsocket_rfcomm_session_create */
1392
1393 /*
1394  * Process accept() on RFCOMM session
1395  * XXX FIXME locking for "l2so"?
1396  */
1397
1398 static int
1399 ng_btsocket_rfcomm_session_accept(ng_btsocket_rfcomm_session_p s0)
1400 {
1401         struct socket                   *l2so = NULL;
1402         struct sockaddr_l2cap           *l2sa = NULL;
1403         ng_btsocket_l2cap_pcb_t         *l2pcb = NULL;
1404         ng_btsocket_rfcomm_session_p     s = NULL;
1405         int                              error = 0;
1406
1407         mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1408         mtx_assert(&s0->session_mtx, MA_OWNED);
1409
1410         /* Check if there is a complete L2CAP connection in the queue */
1411         if ((error = s0->l2so->so_error) != 0) {
1412                 NG_BTSOCKET_RFCOMM_ERR(
1413 "%s: Could not accept connection on L2CAP socket, error=%d\n", __func__, error);
1414                 s0->l2so->so_error = 0;
1415
1416                 return (error);
1417         }
1418
1419         ACCEPT_LOCK();
1420         if (TAILQ_EMPTY(&s0->l2so->so_comp)) {
1421                 ACCEPT_UNLOCK();
1422                 if (s0->l2so->so_rcv.sb_state & SBS_CANTRCVMORE)
1423                         return (ECONNABORTED);
1424                 return (EWOULDBLOCK);
1425         }
1426
1427         /* Accept incoming L2CAP connection */
1428         l2so = TAILQ_FIRST(&s0->l2so->so_comp);
1429         if (l2so == NULL)
1430                 panic("%s: l2so == NULL", __func__);
1431
1432         TAILQ_REMOVE(&s0->l2so->so_comp, l2so, so_list);
1433         s0->l2so->so_qlen --;
1434         l2so->so_qstate &= ~SQ_COMP;
1435         l2so->so_head = NULL;
1436         SOCK_LOCK(l2so);
1437         soref(l2so);
1438         sosetstate(l2so, SS_NBIO);
1439         SOCK_UNLOCK(l2so);
1440         ACCEPT_UNLOCK();
1441
1442         error = soaccept(l2so, (struct sockaddr **) &l2sa);
1443         if (error != 0) {
1444                 NG_BTSOCKET_RFCOMM_ERR(
1445 "%s: soaccept() on L2CAP socket failed, error=%d\n", __func__, error);
1446                 soclose(l2so);
1447
1448                 return (error);
1449         }
1450
1451         /*
1452          * Check if there is already active RFCOMM session between two devices.
1453          * If so then close L2CAP connection. We only support one RFCOMM session
1454          * between each pair of devices. Note that here we assume session in any
1455          * state. The session even could be in the middle of disconnecting.
1456          */
1457
1458         l2pcb = so2l2cap_pcb(l2so);
1459         s = ng_btsocket_rfcomm_session_by_addr(&l2pcb->src, &l2pcb->dst);
1460         if (s == NULL) {
1461                 /* Create a new RFCOMM session */
1462                 error = ng_btsocket_rfcomm_session_create(&s, l2so, NULL, NULL,
1463                                 curthread /* XXX */);
1464                 if (error == 0) {
1465                         mtx_lock(&s->session_mtx);
1466
1467                         s->flags = 0;
1468                         s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTED;
1469
1470                         /*
1471                          * Adjust MTU on incomming connection. Reserve 5 bytes:
1472                          * RFCOMM frame header, one extra byte for length and
1473                          * one extra byte for credits.
1474                          */
1475
1476                         s->mtu = min(l2pcb->imtu, l2pcb->omtu) -
1477                                         sizeof(struct rfcomm_frame_hdr) - 1 - 1;
1478
1479                         mtx_unlock(&s->session_mtx);
1480                 } else {
1481                         NG_BTSOCKET_RFCOMM_ALERT(
1482 "%s: Failed to create new RFCOMM session, error=%d\n", __func__, error);
1483
1484                         soclose(l2so);
1485                 }
1486         } else {
1487                 NG_BTSOCKET_RFCOMM_WARN(
1488 "%s: Rejecting duplicating RFCOMM session between src=%x:%x:%x:%x:%x:%x and " \
1489 "dst=%x:%x:%x:%x:%x:%x, state=%d, flags=%#x\n", __func__,
1490                         l2pcb->src.b[5], l2pcb->src.b[4], l2pcb->src.b[3],
1491                         l2pcb->src.b[2], l2pcb->src.b[1], l2pcb->src.b[0],
1492                         l2pcb->dst.b[5], l2pcb->dst.b[4], l2pcb->dst.b[3],
1493                         l2pcb->dst.b[2], l2pcb->dst.b[1], l2pcb->dst.b[0],
1494                         s->state, s->flags);
1495
1496                 error = EBUSY;
1497                 soclose(l2so);
1498         }
1499
1500         return (error);
1501 } /* ng_btsocket_rfcomm_session_accept */
1502
1503 /*
1504  * Process connect() on RFCOMM session
1505  * XXX FIXME locking for "l2so"?
1506  */
1507
1508 static int
1509 ng_btsocket_rfcomm_session_connect(ng_btsocket_rfcomm_session_p s)
1510 {
1511         ng_btsocket_l2cap_pcb_p l2pcb = so2l2cap_pcb(s->l2so);
1512         int                     error;
1513
1514         mtx_assert(&s->session_mtx, MA_OWNED);
1515
1516         /* First check if connection has failed */
1517         if ((error = s->l2so->so_error) != 0) {
1518                 s->l2so->so_error = 0;
1519
1520                 NG_BTSOCKET_RFCOMM_ERR(
1521 "%s: Could not connect RFCOMM session, error=%d, state=%d, flags=%#x\n",
1522                         __func__, error, s->state, s->flags);
1523
1524                 return (error);
1525         }
1526
1527         /* Is connection still in progress? */
1528         if (s->l2so->so_state & SS_ISCONNECTING)
1529                 return (0);
1530
1531         /*
1532          * If we got here then we are connected. Send SABM on DLCI 0 to
1533          * open multiplexor channel.
1534          */
1535
1536         if (error == 0) {
1537                 s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTED;
1538
1539                 /*
1540                  * Adjust MTU on outgoing connection. Reserve 5 bytes: RFCOMM
1541                  * frame header, one extra byte for length and one extra byte
1542                  * for credits.
1543                  */
1544
1545                 s->mtu = min(l2pcb->imtu, l2pcb->omtu) -
1546                                 sizeof(struct rfcomm_frame_hdr) - 1 - 1;
1547
1548                 error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_SABM,0);
1549                 if (error == 0)
1550                         error = ng_btsocket_rfcomm_task_wakeup();
1551         }
1552
1553         return (error);
1554 }/* ng_btsocket_rfcomm_session_connect */
1555
1556 /*
1557  * Receive data on RFCOMM session
1558  * XXX FIXME locking for "l2so"?
1559  */
1560
1561 static int
1562 ng_btsocket_rfcomm_session_receive(ng_btsocket_rfcomm_session_p s)
1563 {
1564         struct mbuf     *m = NULL;
1565         struct uio       uio;
1566         int              more, flags, error;
1567
1568         mtx_assert(&s->session_mtx, MA_OWNED);
1569
1570         /* Can we read from the L2CAP socket? */
1571         if (!soreadable(s->l2so))
1572                 return (0);
1573
1574         /* First check for error on L2CAP socket */
1575         if ((error = s->l2so->so_error) != 0) {
1576                 s->l2so->so_error = 0;
1577
1578                 NG_BTSOCKET_RFCOMM_ERR(
1579 "%s: Could not receive data from L2CAP socket, error=%d, state=%d, flags=%#x\n",
1580                         __func__, error, s->state, s->flags);
1581
1582                 return (error);
1583         }
1584
1585         /*
1586          * Read all packets from the L2CAP socket.
1587          * XXX FIXME/VERIFY is that correct? For now use m->m_nextpkt as
1588          * indication that there is more packets on the socket's buffer.
1589          * Also what should we use in uio.uio_resid?
1590          * May be s->mtu + sizeof(struct rfcomm_frame_hdr) + 1 + 1?
1591          */
1592
1593         for (more = 1; more; ) {
1594                 /* Try to get next packet from socket */
1595                 bzero(&uio, sizeof(uio));
1596 /*              uio.uio_td = NULL; */
1597                 uio.uio_resid = 1000000000;
1598                 flags = MSG_DONTWAIT;
1599
1600                 m = NULL;
1601                 error = soreceive(s->l2so, NULL, &uio, &m, NULL, &flags);
1602                 if (error != 0) {
1603                         if (error == EWOULDBLOCK)
1604                                 return (0); /* XXX can happen? */
1605
1606                         NG_BTSOCKET_RFCOMM_ERR(
1607 "%s: Could not receive data from L2CAP socket, error=%d\n", __func__, error);
1608
1609                         return (error);
1610                 }
1611
1612                 more = (m->m_nextpkt != NULL);
1613                 m->m_nextpkt = NULL;
1614
1615                 ng_btsocket_rfcomm_receive_frame(s, m);
1616         }
1617
1618         return (0);
1619 } /* ng_btsocket_rfcomm_session_receive */
1620
1621 /*
1622  * Send data on RFCOMM session
1623  * XXX FIXME locking for "l2so"?
1624  */
1625
1626 static int
1627 ng_btsocket_rfcomm_session_send(ng_btsocket_rfcomm_session_p s)
1628 {
1629         struct mbuf     *m = NULL;
1630         int              error;
1631
1632         mtx_assert(&s->session_mtx, MA_OWNED);
1633
1634         /* Send as much as we can from the session queue */
1635         while (sowriteable(s->l2so)) {
1636                 /* Check if socket still OK */
1637                 if ((error = s->l2so->so_error) != 0) {
1638                         s->l2so->so_error = 0;
1639
1640                         NG_BTSOCKET_RFCOMM_ERR(
1641 "%s: Detected error=%d on L2CAP socket, state=%d, flags=%#x\n",
1642                                 __func__, error, s->state, s->flags);
1643
1644                         return (error);
1645                 }
1646
1647                 NG_BT_MBUFQ_DEQUEUE(&s->outq, m);
1648                 if (m == NULL)
1649                         return (0); /* we are done */
1650
1651                 /* Call send function on the L2CAP socket */
1652                 error = (*s->l2so->so_proto->pr_usrreqs->pru_send)(s->l2so,
1653                                 0, m, NULL, NULL, curthread /* XXX */);
1654                 if (error != 0) {
1655                         NG_BTSOCKET_RFCOMM_ERR(
1656 "%s: Could not send data to L2CAP socket, error=%d\n", __func__, error);
1657
1658                         return (error);
1659                 }
1660         }
1661
1662         return (0);
1663 } /* ng_btsocket_rfcomm_session_send */
1664
1665 /*
1666  * Close and disconnect all DLCs for the given session. Caller must hold
1667  * s->sesson_mtx. Will wakeup session.
1668  */
1669
1670 static void
1671 ng_btsocket_rfcomm_session_clean(ng_btsocket_rfcomm_session_p s)
1672 {
1673         ng_btsocket_rfcomm_pcb_p        pcb = NULL, pcb_next = NULL;
1674         int                             error;
1675
1676         mtx_assert(&s->session_mtx, MA_OWNED);
1677
1678         /*
1679          * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1680          * will unlink DLC from the session
1681          */
1682
1683         for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1684                 mtx_lock(&pcb->pcb_mtx);
1685                 pcb_next = LIST_NEXT(pcb, session_next);
1686
1687                 NG_BTSOCKET_RFCOMM_INFO(
1688 "%s: Disconnecting dlci=%d, state=%d, flags=%#x\n",
1689                         __func__, pcb->dlci, pcb->state, pcb->flags);
1690
1691                 if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
1692                         error = ECONNRESET;
1693                 else
1694                         error = ECONNREFUSED;
1695
1696                 ng_btsocket_rfcomm_pcb_kill(pcb, error);
1697
1698                 mtx_unlock(&pcb->pcb_mtx);
1699                 pcb = pcb_next;
1700         }
1701 } /* ng_btsocket_rfcomm_session_clean */
1702
1703 /*
1704  * Process all DLCs on the session. Caller MUST hold s->session_mtx.
1705  */
1706
1707 static void
1708 ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
1709 {
1710         ng_btsocket_rfcomm_pcb_p        pcb = NULL, pcb_next = NULL;
1711         int                             error;
1712
1713         mtx_assert(&s->session_mtx, MA_OWNED);
1714
1715         /*
1716          * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1717          * will unlink DLC from the session
1718          */
1719
1720         for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1721                 mtx_lock(&pcb->pcb_mtx);
1722                 pcb_next = LIST_NEXT(pcb, session_next);
1723
1724                 switch (pcb->state) {
1725
1726                 /*
1727                  * If DLC in W4_CONNECT state then we should check for both
1728                  * timeout and detach.
1729                  */
1730
1731                 case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
1732                         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_DETACHED)
1733                                 ng_btsocket_rfcomm_pcb_kill(pcb, 0);
1734                         else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1735                                 ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1736                         break;
1737
1738                 /*
1739                  * If DLC in CONFIGURING or CONNECTING state then we only
1740                  * should check for timeout. If detach() was called then
1741                  * DLC will be moved into DISCONNECTING state.
1742                  */
1743
1744                 case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
1745                 case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
1746                         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1747                                 ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1748                         break;
1749
1750                 /*
1751                  * If DLC in CONNECTED state then we need to send data (if any)
1752                  * from the socket's send queue. Note that we will send data
1753                  * from either all sockets or none. This may overload session's
1754                  * outgoing queue (but we do not check for that).
1755                  *
1756                  * XXX FIXME need scheduler for RFCOMM sockets
1757                  */
1758
1759                 case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
1760                         error = ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
1761                         if (error != 0)
1762                                 ng_btsocket_rfcomm_pcb_kill(pcb, error);
1763                         break;
1764
1765                 /*
1766                  * If DLC in DISCONNECTING state then we must send DISC frame.
1767                  * Note that if DLC has timeout set then we do not need to
1768                  * resend DISC frame.
1769                  *
1770                  * XXX FIXME need to drain all data from the socket's queue
1771                  * if LINGER option was set
1772                  */
1773
1774                 case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
1775                         if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)) {
1776                                 error = ng_btsocket_rfcomm_send_command(
1777                                                 pcb->session, RFCOMM_FRAME_DISC,
1778                                                 pcb->dlci);
1779                                 if (error == 0)
1780                                         ng_btsocket_rfcomm_timeout(pcb);
1781                                 else
1782                                         ng_btsocket_rfcomm_pcb_kill(pcb, error);
1783                         } else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1784                                 ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1785                         break;
1786
1787 /*              case NG_BTSOCKET_RFCOMM_DLC_CLOSED: */
1788                 default:
1789                         panic("%s: Invalid DLC state=%d, flags=%#x",
1790                                 __func__, pcb->state, pcb->flags);
1791                         break;
1792                 }
1793
1794                 mtx_unlock(&pcb->pcb_mtx);
1795                 pcb = pcb_next;
1796         }
1797 } /* ng_btsocket_rfcomm_session_process_pcb */
1798
1799 /*
1800  * Find RFCOMM session between "src" and "dst".
1801  * Caller MUST hold ng_btsocket_rfcomm_sessions_mtx.
1802  */
1803
1804 static ng_btsocket_rfcomm_session_p
1805 ng_btsocket_rfcomm_session_by_addr(bdaddr_p src, bdaddr_p dst)
1806 {
1807         ng_btsocket_rfcomm_session_p    s = NULL;
1808         ng_btsocket_l2cap_pcb_p         l2pcb = NULL;
1809         int                             any_src;
1810
1811         mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1812
1813         any_src = (bcmp(src, NG_HCI_BDADDR_ANY, sizeof(*src)) == 0);
1814
1815         LIST_FOREACH(s, &ng_btsocket_rfcomm_sessions, next) {
1816                 l2pcb = so2l2cap_pcb(s->l2so);
1817
1818                 if ((any_src || bcmp(&l2pcb->src, src, sizeof(*src)) == 0) &&
1819                     bcmp(&l2pcb->dst, dst, sizeof(*dst)) == 0)
1820                         break;
1821         }
1822
1823         return (s);
1824 } /* ng_btsocket_rfcomm_session_by_addr */
1825
1826 /*****************************************************************************
1827  *****************************************************************************
1828  **                                  RFCOMM
1829  *****************************************************************************
1830  *****************************************************************************/
1831
1832 /*
1833  * Process incoming RFCOMM frame. Caller must hold s->session_mtx.
1834  * XXX FIXME check frame length
1835  */
1836
1837 static int
1838 ng_btsocket_rfcomm_receive_frame(ng_btsocket_rfcomm_session_p s,
1839                 struct mbuf *m0)
1840 {
1841         struct rfcomm_frame_hdr *hdr = NULL;
1842         struct mbuf             *m = NULL;
1843         u_int16_t                length;
1844         u_int8_t                 dlci, type;
1845         int                      error = 0;
1846
1847         mtx_assert(&s->session_mtx, MA_OWNED);
1848
1849         /* Pullup as much as we can into first mbuf (for direct access) */
1850         length = min(m0->m_pkthdr.len, MHLEN);
1851         if (m0->m_len < length) {
1852                 if ((m0 = m_pullup(m0, length)) == NULL) {
1853                         NG_BTSOCKET_RFCOMM_ALERT(
1854 "%s: m_pullup(%d) failed\n", __func__, length);
1855
1856                         return (ENOBUFS);
1857                 }
1858         }
1859
1860         hdr = mtod(m0, struct rfcomm_frame_hdr *);
1861         dlci = RFCOMM_DLCI(hdr->address);
1862         type = RFCOMM_TYPE(hdr->control);
1863
1864         /* Test EA bit in length. If not set then we have 2 bytes of length */
1865         if (!RFCOMM_EA(hdr->length)) {
1866                 bcopy(&hdr->length, &length, sizeof(length));
1867                 length = le16toh(length) >> 1;
1868                 m_adj(m0, sizeof(*hdr) + 1);
1869         } else {
1870                 length = hdr->length >> 1;
1871                 m_adj(m0, sizeof(*hdr));
1872         }
1873
1874         NG_BTSOCKET_RFCOMM_INFO(
1875 "%s: Got frame type=%#x, dlci=%d, length=%d, cr=%d, pf=%d, len=%d\n",
1876                 __func__, type, dlci, length, RFCOMM_CR(hdr->address),
1877                 RFCOMM_PF(hdr->control), m0->m_pkthdr.len);
1878
1879         /*
1880          * Get FCS (the last byte in the frame)
1881          * XXX this will not work if mbuf chain ends with empty mbuf.
1882          * XXX let's hope it never happens :)
1883          */
1884
1885         for (m = m0; m->m_next != NULL; m = m->m_next)
1886                 ;
1887         if (m->m_len <= 0)
1888                 panic("%s: Empty mbuf at the end of the chain, len=%d",
1889                         __func__, m->m_len);
1890
1891         /*
1892          * Check FCS. We only need to calculate FCS on first 2 or 3 bytes
1893          * and already m_pullup'ed mbuf chain, so it should be safe.
1894          */
1895
1896         if (ng_btsocket_rfcomm_check_fcs((u_int8_t *) hdr, type, m->m_data[m->m_len - 1])) {
1897                 NG_BTSOCKET_RFCOMM_ERR(
1898 "%s: Invalid RFCOMM packet. Bad checksum\n", __func__);
1899                 NG_FREE_M(m0);
1900
1901                 return (EINVAL);
1902         }
1903
1904         m_adj(m0, -1); /* Trim FCS byte */
1905
1906         /*
1907          * Process RFCOMM frame.
1908          *
1909          * From TS 07.10 spec
1910          *
1911          * "... In the case where a SABM or DISC command with the P bit set
1912          * to 0 is received then the received frame shall be discarded..."
1913          *
1914          * "... If a unsolicited DM response is received then the frame shall
1915          * be processed irrespective of the P/F setting... "
1916          *
1917          * "... The station may transmit response frames with the F bit set
1918          * to 0 at any opportunity on an asynchronous basis. However, in the
1919          * case where a UA response is received with the F bit set to 0 then
1920          * the received frame shall be discarded..."
1921          *
1922          * From Bluetooth spec
1923          *
1924          * "... When credit based flow control is being used, the meaning of
1925          * the P/F bit in the control field of the RFCOMM header is redefined
1926          * for UIH frames..."
1927          */
1928
1929         switch (type) {
1930         case RFCOMM_FRAME_SABM:
1931                 if (RFCOMM_PF(hdr->control))
1932                         error = ng_btsocket_rfcomm_receive_sabm(s, dlci);
1933                 break;
1934
1935         case RFCOMM_FRAME_DISC:
1936                 if (RFCOMM_PF(hdr->control))
1937                         error = ng_btsocket_rfcomm_receive_disc(s, dlci);
1938                 break;
1939
1940         case RFCOMM_FRAME_UA:
1941                 if (RFCOMM_PF(hdr->control))
1942                         error = ng_btsocket_rfcomm_receive_ua(s, dlci);
1943                 break;
1944
1945         case RFCOMM_FRAME_DM:
1946                 error = ng_btsocket_rfcomm_receive_dm(s, dlci);
1947                 break;
1948
1949         case RFCOMM_FRAME_UIH:
1950                 if (dlci == 0)
1951                         error = ng_btsocket_rfcomm_receive_mcc(s, m0);
1952                 else
1953                         error = ng_btsocket_rfcomm_receive_uih(s, dlci,
1954                                         RFCOMM_PF(hdr->control), m0);
1955
1956                 return (error);
1957                 /* NOT REACHED */
1958
1959         default:
1960                 NG_BTSOCKET_RFCOMM_ERR(
1961 "%s: Invalid RFCOMM packet. Unknown type=%#x\n", __func__, type);
1962                 error = EINVAL;
1963                 break;
1964         }
1965
1966         NG_FREE_M(m0);
1967
1968         return (error);
1969 } /* ng_btsocket_rfcomm_receive_frame */
1970
1971 /*
1972  * Process RFCOMM SABM frame
1973  */
1974
1975 static int
1976 ng_btsocket_rfcomm_receive_sabm(ng_btsocket_rfcomm_session_p s, int dlci)
1977 {
1978         ng_btsocket_rfcomm_pcb_p        pcb = NULL;
1979         int                             error = 0;
1980
1981         mtx_assert(&s->session_mtx, MA_OWNED);
1982
1983         NG_BTSOCKET_RFCOMM_INFO(
1984 "%s: Got SABM, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
1985                 __func__, s->state, s->flags, s->mtu, dlci);
1986
1987         /* DLCI == 0 means open multiplexor channel */
1988         if (dlci == 0) {
1989                 switch (s->state) {
1990                 case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
1991                 case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
1992                         error = ng_btsocket_rfcomm_send_command(s,
1993                                         RFCOMM_FRAME_UA, dlci);
1994                         if (error == 0) {
1995                                 s->state = NG_BTSOCKET_RFCOMM_SESSION_OPEN;
1996                                 ng_btsocket_rfcomm_connect_cfm(s);
1997                         } else {
1998                                 s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1999                                 ng_btsocket_rfcomm_session_clean(s);
2000                         }
2001                         break;
2002
2003                 default:
2004                         NG_BTSOCKET_RFCOMM_WARN(
2005 "%s: Got SABM for session in invalid state state=%d, flags=%#x\n",
2006                                 __func__, s->state, s->flags);
2007                         error = EINVAL;
2008                         break;
2009                 }
2010
2011                 return (error);
2012         }
2013
2014         /* Make sure multiplexor channel is open */
2015         if (s->state != NG_BTSOCKET_RFCOMM_SESSION_OPEN) {
2016                 NG_BTSOCKET_RFCOMM_ERR(
2017 "%s: Got SABM for dlci=%d with mulitplexor channel closed, state=%d, " \
2018 "flags=%#x\n",          __func__, dlci, s->state, s->flags);
2019
2020                 return (EINVAL);
2021         }
2022
2023         /*
2024          * Check if we have this DLCI. This might happen when remote
2025          * peer uses PN command before actual open (SABM) happens.
2026          */
2027
2028         pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2029         if (pcb != NULL) {
2030                 mtx_lock(&pcb->pcb_mtx);
2031
2032                 if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTING) {
2033                         NG_BTSOCKET_RFCOMM_ERR(
2034 "%s: Got SABM for dlci=%d in invalid state=%d, flags=%#x\n",
2035                                 __func__, dlci, pcb->state, pcb->flags);
2036                         mtx_unlock(&pcb->pcb_mtx);
2037
2038                         return (ENOENT);
2039                 }
2040
2041                 ng_btsocket_rfcomm_untimeout(pcb);
2042
2043                 error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_UA,dlci);
2044                 if (error == 0)
2045                         error = ng_btsocket_rfcomm_send_msc(pcb);
2046
2047                 if (error == 0) {
2048                         pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2049                         soisconnected(pcb->so);
2050                 } else
2051                         ng_btsocket_rfcomm_pcb_kill(pcb, error);
2052
2053                 mtx_unlock(&pcb->pcb_mtx);
2054
2055                 return (error);
2056         }
2057
2058         /*
2059          * We do not have requested DLCI, so it must be an incoming connection
2060          * with default parameters. Try to accept it.
2061          */
2062
2063         pcb = ng_btsocket_rfcomm_connect_ind(s, RFCOMM_SRVCHANNEL(dlci));
2064         if (pcb != NULL) {
2065                 mtx_lock(&pcb->pcb_mtx);
2066
2067                 pcb->dlci = dlci;
2068
2069                 error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_UA,dlci);
2070                 if (error == 0)
2071                         error = ng_btsocket_rfcomm_send_msc(pcb);
2072
2073                 if (error == 0) {
2074                         pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2075                         soisconnected(pcb->so);
2076                 } else
2077                         ng_btsocket_rfcomm_pcb_kill(pcb, error);
2078
2079                 mtx_unlock(&pcb->pcb_mtx);
2080         } else
2081                 /* Nobody is listen()ing on the requested DLCI */
2082                 error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2083
2084         return (error);
2085 } /* ng_btsocket_rfcomm_receive_sabm */
2086
2087 /*
2088  * Process RFCOMM DISC frame
2089  */
2090
2091 static int
2092 ng_btsocket_rfcomm_receive_disc(ng_btsocket_rfcomm_session_p s, int dlci)
2093 {
2094         ng_btsocket_rfcomm_pcb_p        pcb = NULL;
2095         int                             error = 0;
2096
2097         mtx_assert(&s->session_mtx, MA_OWNED);
2098
2099         NG_BTSOCKET_RFCOMM_INFO(
2100 "%s: Got DISC, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2101                 __func__, s->state, s->flags, s->mtu, dlci);
2102
2103         /* DLCI == 0 means close multiplexor channel */
2104         if (dlci == 0) {
2105                 /* XXX FIXME assume that remote side will close the socket */
2106                 error = ng_btsocket_rfcomm_send_command(s, RFCOMM_FRAME_UA, 0);
2107                 if (error == 0) {
2108                         if (s->state == NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING)
2109                                 s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED; /* XXX */
2110                         else
2111                                 s->state = NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING;
2112                 } else
2113                         s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED; /* XXX */
2114
2115                 ng_btsocket_rfcomm_session_clean(s);
2116         } else {
2117                 pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2118                 if (pcb != NULL) {
2119                         int     err;
2120
2121                         mtx_lock(&pcb->pcb_mtx);
2122
2123                         NG_BTSOCKET_RFCOMM_INFO(
2124 "%s: Got DISC for dlci=%d, state=%d, flags=%#x\n",
2125                                 __func__, dlci, pcb->state, pcb->flags);
2126
2127                         error = ng_btsocket_rfcomm_send_command(s,
2128                                         RFCOMM_FRAME_UA, dlci);
2129
2130                         if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
2131                                 err = 0;
2132                         else
2133                                 err = ECONNREFUSED;
2134
2135                         ng_btsocket_rfcomm_pcb_kill(pcb, err);
2136
2137                         mtx_unlock(&pcb->pcb_mtx);
2138                 } else {
2139                         NG_BTSOCKET_RFCOMM_WARN(
2140 "%s: Got DISC for non-existing dlci=%d\n", __func__, dlci);
2141
2142                         error = ng_btsocket_rfcomm_send_command(s,
2143                                         RFCOMM_FRAME_DM, dlci);
2144                 }
2145         }
2146
2147         return (error);
2148 } /* ng_btsocket_rfcomm_receive_disc */
2149
2150 /*
2151  * Process RFCOMM UA frame
2152  */
2153
2154 static int
2155 ng_btsocket_rfcomm_receive_ua(ng_btsocket_rfcomm_session_p s, int dlci)
2156 {
2157         ng_btsocket_rfcomm_pcb_p        pcb = NULL;
2158         int                             error = 0;
2159
2160         mtx_assert(&s->session_mtx, MA_OWNED);
2161
2162         NG_BTSOCKET_RFCOMM_INFO(
2163 "%s: Got UA, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2164                 __func__, s->state, s->flags, s->mtu, dlci);
2165
2166         /* dlci == 0 means multiplexor channel */
2167         if (dlci == 0) {
2168                 switch (s->state) {
2169                 case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
2170                         s->state = NG_BTSOCKET_RFCOMM_SESSION_OPEN;
2171                         ng_btsocket_rfcomm_connect_cfm(s);
2172                         break;
2173
2174                 case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
2175                         s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
2176                         ng_btsocket_rfcomm_session_clean(s);
2177                         break;
2178
2179                 default:
2180                         NG_BTSOCKET_RFCOMM_WARN(
2181 "%s: Got UA for session in invalid state=%d(%d), flags=%#x, mtu=%d\n",
2182                                 __func__, s->state, INITIATOR(s), s->flags,
2183                                 s->mtu);
2184                         error = ENOENT;
2185                         break;
2186                 }
2187
2188                 return (error);
2189         }
2190
2191         /* Check if we have this DLCI */
2192         pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2193         if (pcb != NULL) {
2194                 mtx_lock(&pcb->pcb_mtx);
2195
2196                 NG_BTSOCKET_RFCOMM_INFO(
2197 "%s: Got UA for dlci=%d, state=%d, flags=%#x\n",
2198                         __func__, dlci, pcb->state, pcb->flags);
2199
2200                 switch (pcb->state) {
2201                 case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
2202                         ng_btsocket_rfcomm_untimeout(pcb);
2203
2204                         error = ng_btsocket_rfcomm_send_msc(pcb);
2205                         if (error == 0) {
2206                                 pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2207                                 soisconnected(pcb->so);
2208                         }
2209                         break;
2210
2211                 case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
2212                         ng_btsocket_rfcomm_pcb_kill(pcb, 0);
2213                         break;
2214
2215                 default:
2216                         NG_BTSOCKET_RFCOMM_WARN(
2217 "%s: Got UA for dlci=%d in invalid state=%d, flags=%#x\n",
2218                                 __func__, dlci, pcb->state, pcb->flags);
2219                         error = ENOENT;
2220                         break;
2221                 }
2222
2223                 mtx_unlock(&pcb->pcb_mtx);
2224         } else {
2225                 NG_BTSOCKET_RFCOMM_WARN(
2226 "%s: Got UA for non-existing dlci=%d\n", __func__, dlci);
2227
2228                 error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2229         }
2230
2231         return (error);
2232 } /* ng_btsocket_rfcomm_receive_ua */
2233
2234 /*
2235  * Process RFCOMM DM frame
2236  */
2237
2238 static int
2239 ng_btsocket_rfcomm_receive_dm(ng_btsocket_rfcomm_session_p s, int dlci)
2240 {
2241         ng_btsocket_rfcomm_pcb_p        pcb = NULL;
2242         int                             error;
2243
2244         mtx_assert(&s->session_mtx, MA_OWNED);
2245
2246         NG_BTSOCKET_RFCOMM_INFO(
2247 "%s: Got DM, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2248                 __func__, s->state, s->flags, s->mtu, dlci);
2249
2250         /* DLCI == 0 means multiplexor channel */
2251         if (dlci == 0) {
2252                 /* Disconnect all dlc's on the session */
2253                 s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
2254                 ng_btsocket_rfcomm_session_clean(s);
2255         } else {
2256                 pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2257                 if (pcb != NULL) {
2258                         mtx_lock(&pcb->pcb_mtx);
2259
2260                         NG_BTSOCKET_RFCOMM_INFO(
2261 "%s: Got DM for dlci=%d, state=%d, flags=%#x\n",
2262                                 __func__, dlci, pcb->state, pcb->flags);
2263
2264                         if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
2265                                 error = ECONNRESET;
2266                         else
2267                                 error = ECONNREFUSED;
2268
2269                         ng_btsocket_rfcomm_pcb_kill(pcb, error);
2270
2271                         mtx_unlock(&pcb->pcb_mtx);
2272                 } else
2273                         NG_BTSOCKET_RFCOMM_WARN(
2274 "%s: Got DM for non-existing dlci=%d\n", __func__, dlci);
2275         }
2276
2277         return (0);
2278 } /* ng_btsocket_rfcomm_receive_dm */
2279
2280 /*
2281  * Process RFCOMM UIH frame (data)
2282  */
2283
2284 static int
2285 ng_btsocket_rfcomm_receive_uih(ng_btsocket_rfcomm_session_p s, int dlci,
2286                 int pf, struct mbuf *m0)
2287 {
2288         ng_btsocket_rfcomm_pcb_p        pcb = NULL;
2289         int                             error = 0;
2290
2291         mtx_assert(&s->session_mtx, MA_OWNED);
2292
2293         NG_BTSOCKET_RFCOMM_INFO(
2294 "%s: Got UIH, session state=%d, flags=%#x, mtu=%d, dlci=%d, pf=%d, len=%d\n",
2295                 __func__, s->state, s->flags, s->mtu, dlci, pf,
2296                 m0->m_pkthdr.len);
2297
2298         /* XXX should we do it here? Check for session flow control */
2299         if (s->flags & NG_BTSOCKET_RFCOMM_SESSION_LFC) {
2300                 NG_BTSOCKET_RFCOMM_WARN(
2301 "%s: Got UIH with session flow control asserted, state=%d, flags=%#x\n",
2302                         __func__, s->state, s->flags);
2303                 goto drop;
2304         }
2305
2306         /* Check if we have this dlci */
2307         pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2308         if (pcb == NULL) {
2309                 NG_BTSOCKET_RFCOMM_WARN(
2310 "%s: Got UIH for non-existing dlci=%d\n", __func__, dlci);
2311                 error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2312                 goto drop;
2313         }
2314
2315         mtx_lock(&pcb->pcb_mtx);
2316
2317         /* Check dlci state */
2318         if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
2319                 NG_BTSOCKET_RFCOMM_WARN(
2320 "%s: Got UIH for dlci=%d in invalid state=%d, flags=%#x\n",
2321                         __func__, dlci, pcb->state, pcb->flags);
2322                 error = EINVAL;
2323                 goto drop1;
2324         }
2325
2326         /* Check dlci flow control */
2327         if (((pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) && pcb->rx_cred <= 0) ||
2328              (pcb->lmodem & RFCOMM_MODEM_FC)) {
2329                 NG_BTSOCKET_RFCOMM_ERR(
2330 "%s: Got UIH for dlci=%d with asserted flow control, state=%d, " \
2331 "flags=%#x, rx_cred=%d, lmodem=%#x\n",
2332                         __func__, dlci, pcb->state, pcb->flags,
2333                         pcb->rx_cred, pcb->lmodem);
2334                 goto drop1;
2335         }
2336
2337         /* Did we get any credits? */
2338         if ((pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) && pf) {
2339                 NG_BTSOCKET_RFCOMM_INFO(
2340 "%s: Got %d more credits for dlci=%d, state=%d, flags=%#x, " \
2341 "rx_cred=%d, tx_cred=%d\n",
2342                         __func__, *mtod(m0, u_int8_t *), dlci, pcb->state,
2343                         pcb->flags, pcb->rx_cred, pcb->tx_cred);
2344
2345                 pcb->tx_cred += *mtod(m0, u_int8_t *);
2346                 m_adj(m0, 1);
2347
2348                 /* Send more from the DLC. XXX check for errors? */
2349                 ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
2350         }
2351
2352         /* OK the of the rest of the mbuf is the data */
2353         if (m0->m_pkthdr.len > 0) {
2354                 /* If we are using credit flow control decrease rx_cred here */
2355                 if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2356                         /* Give remote peer more credits (if needed) */
2357                         if (-- pcb->rx_cred <= RFCOMM_MAX_CREDITS / 2)
2358                                 ng_btsocket_rfcomm_send_credits(pcb);
2359                         else
2360                                 NG_BTSOCKET_RFCOMM_INFO(
2361 "%s: Remote side still has credits, dlci=%d, state=%d, flags=%#x, " \
2362 "rx_cred=%d, tx_cred=%d\n",             __func__, dlci, pcb->state, pcb->flags,
2363                                         pcb->rx_cred, pcb->tx_cred);
2364                 }
2365
2366                 /* Check packet against mtu on dlci */
2367                 if (m0->m_pkthdr.len > pcb->mtu) {
2368                         NG_BTSOCKET_RFCOMM_ERR(
2369 "%s: Got oversized UIH for dlci=%d, state=%d, flags=%#x, mtu=%d, len=%d\n",
2370                                 __func__, dlci, pcb->state, pcb->flags,
2371                                 pcb->mtu, m0->m_pkthdr.len);
2372
2373                         error = EMSGSIZE;
2374                 } else if (m0->m_pkthdr.len > sbspace(&pcb->so->so_rcv)) {
2375
2376                         /*
2377                          * This is really bad. Receive queue on socket does
2378                          * not have enough space for the packet. We do not
2379                          * have any other choice but drop the packet.
2380                          */
2381
2382                         NG_BTSOCKET_RFCOMM_ERR(
2383 "%s: Not enough space in socket receive queue. Dropping UIH for dlci=%d, " \
2384 "state=%d, flags=%#x, len=%d, space=%ld\n",
2385                                 __func__, dlci, pcb->state, pcb->flags,
2386                                 m0->m_pkthdr.len, sbspace(&pcb->so->so_rcv));
2387
2388                         error = ENOBUFS;
2389                 } else {
2390                         /* Append packet to the socket receive queue */
2391                         sbappend(&pcb->so->so_rcv, m0);
2392                         m0 = NULL;
2393
2394                         sorwakeup(pcb->so);
2395                 }
2396         }
2397 drop1:
2398         mtx_unlock(&pcb->pcb_mtx);
2399 drop:
2400         NG_FREE_M(m0); /* checks for != NULL */
2401
2402         return (error);
2403 } /* ng_btsocket_rfcomm_receive_uih */
2404
2405 /*
2406  * Process RFCOMM MCC command (Multiplexor)
2407  *
2408  * From TS 07.10 spec
2409  *
2410  * "5.4.3.1 Information Data
2411  *
2412  *  ...The frames (UIH) sent by the initiating station have the C/R bit set
2413  *  to 1 and those sent by the responding station have the C/R bit set to 0..."
2414  *
2415  * "5.4.6.2 Operating procedures
2416  *
2417  *  Messages always exist in pairs; a command message and a corresponding
2418  *  response message. If the C/R bit is set to 1 the message is a command,
2419  *  if it is set to 0 the message is a response...
2420  *
2421  *  ...
2422  *
2423  *  NOTE: Notice that when UIH frames are used to convey information on DLCI 0
2424  *  there are at least two different fields that contain a C/R bit, and the
2425  *  bits are set of different form. The C/R bit in the Type field shall be set
2426  *  as it is stated above, while the C/R bit in the Address field (see subclause
2427  *  5.2.1.2) shall be set as it is described in subclause 5.4.3.1."
2428  */
2429
2430 static int
2431 ng_btsocket_rfcomm_receive_mcc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2432 {
2433         struct rfcomm_mcc_hdr   *hdr = NULL;
2434         u_int8_t                 cr, type, length;
2435
2436         mtx_assert(&s->session_mtx, MA_OWNED);
2437
2438         /*
2439          * We can access data directly in the first mbuf, because we have
2440          * m_pullup()'ed mbuf chain in ng_btsocket_rfcomm_receive_frame().
2441          * All MCC commands should fit into single mbuf (except probably TEST).
2442          */
2443
2444         hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2445         cr = RFCOMM_CR(hdr->type);
2446         type = RFCOMM_MCC_TYPE(hdr->type);
2447         length = RFCOMM_MCC_LENGTH(hdr->length);
2448
2449         /* Check MCC frame length */
2450         if (sizeof(*hdr) + length != m0->m_pkthdr.len) {
2451                 NG_BTSOCKET_RFCOMM_ERR(
2452 "%s: Invalid MCC frame length=%d, len=%d\n",
2453                         __func__, length, m0->m_pkthdr.len);
2454                 NG_FREE_M(m0);
2455
2456                 return (EMSGSIZE);
2457         }
2458
2459         switch (type) {
2460         case RFCOMM_MCC_TEST:
2461                 return (ng_btsocket_rfcomm_receive_test(s, m0));
2462                 /* NOT REACHED */
2463
2464         case RFCOMM_MCC_FCON:
2465         case RFCOMM_MCC_FCOFF:
2466                 return (ng_btsocket_rfcomm_receive_fc(s, m0));
2467                 /* NOT REACHED */
2468
2469         case RFCOMM_MCC_MSC:
2470                 return (ng_btsocket_rfcomm_receive_msc(s, m0));
2471                 /* NOT REACHED */
2472
2473         case RFCOMM_MCC_RPN:
2474                 return (ng_btsocket_rfcomm_receive_rpn(s, m0));
2475                 /* NOT REACHED */
2476
2477         case RFCOMM_MCC_RLS:
2478                 return (ng_btsocket_rfcomm_receive_rls(s, m0));
2479                 /* NOT REACHED */
2480
2481         case RFCOMM_MCC_PN:
2482                 return (ng_btsocket_rfcomm_receive_pn(s, m0));
2483                 /* NOT REACHED */
2484
2485         case RFCOMM_MCC_NSC:
2486                 NG_BTSOCKET_RFCOMM_ERR(
2487 "%s: Got MCC NSC, type=%#x, cr=%d, length=%d, session state=%d, flags=%#x, " \
2488 "mtu=%d, len=%d\n",     __func__, RFCOMM_MCC_TYPE(*((u_int8_t *)(hdr + 1))), cr,
2489                          length, s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2490                 NG_FREE_M(m0);
2491                 break;
2492
2493         default:
2494                 NG_BTSOCKET_RFCOMM_ERR(
2495 "%s: Got unknown MCC, type=%#x, cr=%d, length=%d, session state=%d, " \
2496 "flags=%#x, mtu=%d, len=%d\n",
2497                         __func__, type, cr, length, s->state, s->flags,
2498                         s->mtu, m0->m_pkthdr.len);
2499
2500                 /* Reuse mbuf to send NSC */
2501                 hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2502                 m0->m_pkthdr.len = m0->m_len = sizeof(*hdr);
2503
2504                 /* Create MCC NSC header */
2505                 hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_NSC);
2506                 hdr->length = RFCOMM_MKLEN8(1);
2507
2508                 /* Put back MCC command type we did not like */
2509                 m0->m_data[m0->m_len] = RFCOMM_MKMCC_TYPE(cr, type);
2510                 m0->m_pkthdr.len ++;
2511                 m0->m_len ++;
2512
2513                 /* Send UIH frame */
2514                 return (ng_btsocket_rfcomm_send_uih(s,
2515                                 RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0));
2516                 /* NOT REACHED */
2517         }
2518
2519         return (0);
2520 } /* ng_btsocket_rfcomm_receive_mcc */
2521
2522 /*
2523  * Receive RFCOMM TEST MCC command
2524  */
2525
2526 static int
2527 ng_btsocket_rfcomm_receive_test(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2528 {
2529         struct rfcomm_mcc_hdr   *hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2530         int                      error = 0;
2531
2532         mtx_assert(&s->session_mtx, MA_OWNED);
2533
2534         NG_BTSOCKET_RFCOMM_INFO(
2535 "%s: Got MCC TEST, cr=%d, length=%d, session state=%d, flags=%#x, mtu=%d, " \
2536 "len=%d\n",     __func__, RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2537                 s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2538
2539         if (RFCOMM_CR(hdr->type)) {
2540                 hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_TEST);
2541                 error = ng_btsocket_rfcomm_send_uih(s,
2542                                 RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2543         } else
2544                 NG_FREE_M(m0); /* XXX ignore response */
2545
2546         return (error);
2547 } /* ng_btsocket_rfcomm_receive_test */
2548
2549 /*
2550  * Receive RFCOMM FCON/FCOFF MCC command
2551  */
2552
2553 static int
2554 ng_btsocket_rfcomm_receive_fc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2555 {
2556         struct rfcomm_mcc_hdr   *hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2557         u_int8_t                 type = RFCOMM_MCC_TYPE(hdr->type);
2558         int                      error = 0;
2559
2560         mtx_assert(&s->session_mtx, MA_OWNED);
2561
2562         /*
2563          * Turn ON/OFF aggregate flow on the entire session. When remote peer
2564          * asserted flow control no transmission shall occur except on dlci 0
2565          * (control channel).
2566          */
2567
2568         NG_BTSOCKET_RFCOMM_INFO(
2569 "%s: Got MCC FC%s, cr=%d, length=%d, session state=%d, flags=%#x, mtu=%d, " \
2570 "len=%d\n",     __func__, (type == RFCOMM_MCC_FCON)? "ON" : "OFF",
2571                 RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2572                 s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2573
2574         if (RFCOMM_CR(hdr->type)) {
2575                 if (type == RFCOMM_MCC_FCON)
2576                         s->flags &= ~NG_BTSOCKET_RFCOMM_SESSION_RFC;
2577                 else
2578                         s->flags |= NG_BTSOCKET_RFCOMM_SESSION_RFC;
2579
2580                 hdr->type = RFCOMM_MKMCC_TYPE(0, type);
2581                 error = ng_btsocket_rfcomm_send_uih(s,
2582                                 RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2583         } else
2584                 NG_FREE_M(m0); /* XXX ignore response */
2585
2586         return (error);
2587 } /* ng_btsocket_rfcomm_receive_fc  */
2588
2589 /*
2590  * Receive RFCOMM MSC MCC command
2591  */
2592
2593 static int
2594 ng_btsocket_rfcomm_receive_msc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2595 {
2596         struct rfcomm_mcc_hdr           *hdr = mtod(m0, struct rfcomm_mcc_hdr*);
2597         struct rfcomm_mcc_msc           *msc = (struct rfcomm_mcc_msc *)(hdr+1);
2598         ng_btsocket_rfcomm_pcb_t        *pcb = NULL;
2599         int                              error = 0;
2600
2601         mtx_assert(&s->session_mtx, MA_OWNED);
2602
2603         NG_BTSOCKET_RFCOMM_INFO(
2604 "%s: Got MCC MSC, dlci=%d, cr=%d, length=%d, session state=%d, flags=%#x, " \
2605 "mtu=%d, len=%d\n",
2606                 __func__,  RFCOMM_DLCI(msc->address), RFCOMM_CR(hdr->type),
2607                 RFCOMM_MCC_LENGTH(hdr->length), s->state, s->flags,
2608                 s->mtu, m0->m_pkthdr.len);
2609
2610         if (RFCOMM_CR(hdr->type)) {
2611                 pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, RFCOMM_DLCI(msc->address));
2612                 if (pcb == NULL) {
2613                         NG_BTSOCKET_RFCOMM_WARN(
2614 "%s: Got MSC command for non-existing dlci=%d\n",
2615                                 __func__, RFCOMM_DLCI(msc->address));
2616                         NG_FREE_M(m0);
2617
2618                         return (ENOENT);
2619                 }
2620
2621                 mtx_lock(&pcb->pcb_mtx);
2622
2623                 if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTING &&
2624                     pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
2625                         NG_BTSOCKET_RFCOMM_WARN(
2626 "%s: Got MSC on dlci=%d in invalid state=%d\n",
2627                                 __func__, RFCOMM_DLCI(msc->address),
2628                                 pcb->state);
2629
2630                         mtx_unlock(&pcb->pcb_mtx);
2631                         NG_FREE_M(m0);
2632
2633                         return (EINVAL);
2634                 }
2635
2636                 pcb->rmodem = msc->modem; /* Update remote port signals */
2637
2638                 hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_MSC);
2639                 error = ng_btsocket_rfcomm_send_uih(s,
2640                                 RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2641
2642 #if 0 /* YYY */
2643                 /* Send more data from DLC. XXX check for errors? */
2644                 if (!(pcb->rmodem & RFCOMM_MODEM_FC) &&
2645                     !(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC))
2646                         ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
2647 #endif /* YYY */
2648
2649                 mtx_unlock(&pcb->pcb_mtx);
2650         } else
2651                 NG_FREE_M(m0); /* XXX ignore response */
2652
2653         return (error);
2654 } /* ng_btsocket_rfcomm_receive_msc */
2655
2656 /*
2657  * Receive RFCOMM RPN MCC command
2658  * XXX FIXME do we need htole16/le16toh for RPN param_mask?
2659  */
2660
2661 static int
2662 ng_btsocket_rfcomm_receive_rpn(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2663 {
2664         struct rfcomm_mcc_hdr   *hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2665         struct rfcomm_mcc_rpn   *rpn = (struct rfcomm_mcc_rpn *)(hdr + 1);
2666         int                      error = 0;
2667         u_int16_t                param_mask;
2668         u_int8_t                 bit_rate, data_bits, stop_bits, parity,
2669                                  flow_control, xon_char, xoff_char;
2670
2671         mtx_assert(&s->session_mtx, MA_OWNED);
2672
2673         NG_BTSOCKET_RFCOMM_INFO(
2674 "%s: Got MCC RPN, dlci=%d, cr=%d, length=%d, session state=%d, flags=%#x, " \
2675 "mtu=%d, len=%d\n",
2676                 __func__, RFCOMM_DLCI(rpn->dlci), RFCOMM_CR(hdr->type),
2677                 RFCOMM_MCC_LENGTH(hdr->length), s->state, s->flags,
2678                 s->mtu, m0->m_pkthdr.len);
2679
2680         if (RFCOMM_CR(hdr->type)) {
2681                 param_mask = RFCOMM_RPN_PM_ALL;
2682
2683                 if (RFCOMM_MCC_LENGTH(hdr->length) == 1) {
2684                         /* Request - return default setting */
2685                         bit_rate = RFCOMM_RPN_BR_115200;
2686                         data_bits = RFCOMM_RPN_DATA_8;
2687                         stop_bits = RFCOMM_RPN_STOP_1;
2688                         parity = RFCOMM_RPN_PARITY_NONE;
2689                         flow_control = RFCOMM_RPN_FLOW_NONE;
2690                         xon_char = RFCOMM_RPN_XON_CHAR;
2691                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
2692                 } else {
2693                         /*
2694                          * Ignore/accept bit_rate, 8 bits, 1 stop bit, no
2695                          * parity, no flow control lines, default XON/XOFF
2696                          * chars.
2697                          */
2698
2699                         bit_rate = rpn->bit_rate;
2700                         rpn->param_mask = le16toh(rpn->param_mask); /* XXX */
2701
2702                         data_bits = RFCOMM_RPN_DATA_BITS(rpn->line_settings);
2703                         if (rpn->param_mask & RFCOMM_RPN_PM_DATA &&
2704                             data_bits != RFCOMM_RPN_DATA_8) {
2705                                 data_bits = RFCOMM_RPN_DATA_8;
2706                                 param_mask ^= RFCOMM_RPN_PM_DATA;
2707                         }
2708
2709                         stop_bits = RFCOMM_RPN_STOP_BITS(rpn->line_settings);
2710                         if (rpn->param_mask & RFCOMM_RPN_PM_STOP &&
2711                             stop_bits != RFCOMM_RPN_STOP_1) {
2712                                 stop_bits = RFCOMM_RPN_STOP_1;
2713                                 param_mask ^= RFCOMM_RPN_PM_STOP;
2714                         }
2715
2716                         parity = RFCOMM_RPN_PARITY(rpn->line_settings);
2717                         if (rpn->param_mask & RFCOMM_RPN_PM_PARITY &&
2718                             parity != RFCOMM_RPN_PARITY_NONE) {
2719                                 parity = RFCOMM_RPN_PARITY_NONE;
2720                                 param_mask ^= RFCOMM_RPN_PM_PARITY;
2721                         }
2722
2723                         flow_control = rpn->flow_control;
2724                         if (rpn->param_mask & RFCOMM_RPN_PM_FLOW &&
2725                             flow_control != RFCOMM_RPN_FLOW_NONE) {
2726                                 flow_control = RFCOMM_RPN_FLOW_NONE;
2727                                 param_mask ^= RFCOMM_RPN_PM_FLOW;
2728                         }
2729
2730                         xon_char = rpn->xon_char;
2731                         if (rpn->param_mask & RFCOMM_RPN_PM_XON &&
2732                             xon_char != RFCOMM_RPN_XON_CHAR) {
2733                                 xon_char = RFCOMM_RPN_XON_CHAR;
2734                                 param_mask ^= RFCOMM_RPN_PM_XON;
2735                         }
2736
2737                         xoff_char = rpn->xoff_char;
2738                         if (rpn->param_mask & RFCOMM_RPN_PM_XOFF &&
2739                             xoff_char != RFCOMM_RPN_XOFF_CHAR) {
2740                                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
2741                                 param_mask ^= RFCOMM_RPN_PM_XOFF;
2742                         }
2743                 }
2744
2745                 rpn->bit_rate = bit_rate;
2746                 rpn->line_settings = RFCOMM_MKRPN_LINE_SETTINGS(data_bits,
2747                                                 stop_bits, parity);
2748                 rpn->flow_control = flow_control;
2749                 rpn->xon_char = xon_char;
2750                 rpn->xoff_char = xoff_char;
2751                 rpn->param_mask = htole16(param_mask); /* XXX */
2752
2753                 m0->m_pkthdr.len = m0->m_len = sizeof(*hdr) + sizeof(*rpn);
2754
2755                 hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_RPN);
2756                 error = ng_btsocket_rfcomm_send_uih(s,
2757                                 RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2758         } else
2759                 NG_FREE_M(m0); /* XXX ignore response */
2760
2761         return (error);
2762 } /* ng_btsocket_rfcomm_receive_rpn */
2763
2764 /*
2765  * Receive RFCOMM RLS MCC command
2766  */
2767
2768 static int
2769 ng_btsocket_rfcomm_receive_rls(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2770 {
2771         struct rfcomm_mcc_hdr   *hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2772         struct rfcomm_mcc_rls   *rls = (struct rfcomm_mcc_rls *)(hdr + 1);
2773         int                      error = 0;
2774
2775         mtx_assert(&s->session_mtx, MA_OWNED);
2776
2777         /*
2778          * XXX FIXME Do we have to do anything else here? Remote peer tries to
2779          * tell us something about DLCI. Just report what we have received and
2780          * return back received values as required by TS 07.10 spec.
2781          */
2782
2783         NG_BTSOCKET_RFCOMM_INFO(
2784 "%s: Got MCC RLS, dlci=%d, status=%#x, cr=%d, length=%d, session state=%d, " \
2785 "flags=%#x, mtu=%d, len=%d\n",
2786                 __func__, RFCOMM_DLCI(rls->address), rls->status,
2787                 RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2788                 s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2789
2790         if (RFCOMM_CR(hdr->type)) {
2791                 if (rls->status & 0x1)
2792                         NG_BTSOCKET_RFCOMM_ERR(
2793 "%s: Got RLS dlci=%d, error=%#x\n", __func__, RFCOMM_DLCI(rls->address),
2794                                 rls->status >> 1);
2795
2796                 hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_RLS);
2797                 error = ng_btsocket_rfcomm_send_uih(s,
2798                                 RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2799         } else
2800                 NG_FREE_M(m0); /* XXX ignore responses */
2801
2802         return (error);
2803 } /* ng_btsocket_rfcomm_receive_rls */
2804
2805 /*
2806  * Receive RFCOMM PN MCC command
2807  */
2808
2809 static int
2810 ng_btsocket_rfcomm_receive_pn(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2811 {
2812         struct rfcomm_mcc_hdr           *hdr = mtod(m0, struct rfcomm_mcc_hdr*);
2813         struct rfcomm_mcc_pn            *pn = (struct rfcomm_mcc_pn *)(hdr+1);
2814         ng_btsocket_rfcomm_pcb_t        *pcb = NULL;
2815         int                              error = 0;
2816
2817         mtx_assert(&s->session_mtx, MA_OWNED);
2818
2819         NG_BTSOCKET_RFCOMM_INFO(
2820 "%s: Got MCC PN, dlci=%d, cr=%d, length=%d, flow_control=%#x, priority=%d, " \
2821 "ack_timer=%d, mtu=%d, max_retrans=%d, credits=%d, session state=%d, " \
2822 "flags=%#x, session mtu=%d, len=%d\n",
2823                 __func__, pn->dlci, RFCOMM_CR(hdr->type),
2824                 RFCOMM_MCC_LENGTH(hdr->length), pn->flow_control, pn->priority,
2825                 pn->ack_timer, le16toh(pn->mtu), pn->max_retrans, pn->credits,
2826                 s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2827
2828         if (pn->dlci == 0) {
2829                 NG_BTSOCKET_RFCOMM_ERR("%s: Zero dlci in MCC PN\n", __func__);
2830                 NG_FREE_M(m0);
2831
2832                 return (EINVAL);
2833         }
2834
2835         /* Check if we have this dlci */
2836         pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, pn->dlci);
2837         if (pcb != NULL) {
2838                 mtx_lock(&pcb->pcb_mtx);
2839
2840                 if (RFCOMM_CR(hdr->type)) {
2841                         /* PN Request */
2842                         ng_btsocket_rfcomm_set_pn(pcb, 1, pn->flow_control,
2843                                 pn->credits, pn->mtu);
2844
2845                         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2846                                 pn->flow_control = 0xe0;
2847                                 pn->credits = RFCOMM_DEFAULT_CREDITS;
2848                         } else {
2849                                 pn->flow_control = 0;
2850                                 pn->credits = 0;
2851                         }
2852
2853                         hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_PN);
2854                         error = ng_btsocket_rfcomm_send_uih(s,
2855                                         RFCOMM_MKADDRESS(INITIATOR(s), 0),
2856                                         0, 0, m0);
2857                 } else {
2858                         /* PN Response - proceed with SABM. Timeout still set */
2859                         if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONFIGURING) {
2860                                 ng_btsocket_rfcomm_set_pn(pcb, 0,
2861                                         pn->flow_control, pn->credits, pn->mtu);
2862
2863                                 pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTING;
2864                                 error = ng_btsocket_rfcomm_send_command(s,
2865                                                 RFCOMM_FRAME_SABM, pn->dlci);
2866                         } else
2867                                 NG_BTSOCKET_RFCOMM_WARN(
2868 "%s: Got PN response for dlci=%d in invalid state=%d\n",
2869                                         __func__, pn->dlci, pcb->state);
2870
2871                         NG_FREE_M(m0);
2872                 }
2873
2874                 mtx_unlock(&pcb->pcb_mtx);
2875         } else if (RFCOMM_CR(hdr->type)) {
2876                 /* PN request to non-existing dlci - incomming connection */
2877                 pcb = ng_btsocket_rfcomm_connect_ind(s,
2878                                 RFCOMM_SRVCHANNEL(pn->dlci));
2879                 if (pcb != NULL) {
2880                         mtx_lock(&pcb->pcb_mtx);
2881
2882                         pcb->dlci = pn->dlci;
2883
2884                         ng_btsocket_rfcomm_set_pn(pcb, 1, pn->flow_control,
2885                                 pn->credits, pn->mtu);
2886
2887                         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2888                                 pn->flow_control = 0xe0;
2889                                 pn->credits = RFCOMM_DEFAULT_CREDITS;
2890                         } else {
2891                                 pn->flow_control = 0;
2892                                 pn->credits = 0;
2893                         }
2894
2895                         hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_PN);
2896                         error = ng_btsocket_rfcomm_send_uih(s,
2897                                         RFCOMM_MKADDRESS(INITIATOR(s), 0),
2898                                         0, 0, m0);
2899
2900                         if (error == 0) {
2901                                 ng_btsocket_rfcomm_timeout(pcb);
2902                                 pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTING;
2903                                 soisconnecting(pcb->so);
2904                         } else
2905                                 ng_btsocket_rfcomm_pcb_kill(pcb, error);
2906
2907                         mtx_unlock(&pcb->pcb_mtx);
2908                 } else {
2909                         /* Nobody is listen()ing on this channel */
2910                         error = ng_btsocket_rfcomm_send_command(s,
2911                                         RFCOMM_FRAME_DM, pn->dlci);
2912                         NG_FREE_M(m0);
2913                 }
2914         } else
2915                 NG_FREE_M(m0); /* XXX ignore response to non-existing dlci */
2916
2917         return (error);
2918 } /* ng_btsocket_rfcomm_receive_pn */
2919
2920 /*
2921  * Set PN parameters for dlci. Caller must hold pcb->pcb_mtx.
2922  *
2923  * From Bluetooth spec.
2924  *
2925  * "... The CL1 - CL4 field is completely redefined. (In TS07.10 this defines
2926  *  the convergence layer to use, which is not applicable to RFCOMM. In RFCOMM,
2927  *  in Bluetooth versions up to 1.0B, this field was forced to 0).
2928  *
2929  *  In the PN request sent prior to a DLC establishment, this field must contain
2930  *  the value 15 (0xF), indicating support of credit based flow control in the
2931  *  sender. See Table 5.3 below. If the PN response contains any other value
2932  *  than 14 (0xE) in this field, it is inferred that the peer RFCOMM entity is
2933  *  not supporting the credit based flow control feature. (This is only possible
2934  *  if the peer RFCOMM implementation is only conforming to Bluetooth version
2935  *  1.0B.) If a PN request is sent on an already open DLC, then this field must
2936  *  contain the value zero; it is not possible to set initial credits  more
2937  *  than once per DLC activation. A responding implementation must set this
2938  *  field in the PN response to 14 (0xE), if (and only if) the value in the PN
2939  *  request was 15..."
2940  */
2941
2942 static void
2943 ng_btsocket_rfcomm_set_pn(ng_btsocket_rfcomm_pcb_p pcb, u_int8_t cr,
2944                 u_int8_t flow_control, u_int8_t credits, u_int16_t mtu)
2945 {
2946         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
2947
2948         pcb->mtu = le16toh(mtu);
2949
2950         if (cr) {
2951                 if (flow_control == 0xf0) {
2952                         pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_CFC;
2953                         pcb->tx_cred = credits;
2954                 } else {
2955                         pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_CFC;
2956                         pcb->tx_cred = 0;
2957                 }
2958         } else {
2959                 if (flow_control == 0xe0) {
2960                         pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_CFC;
2961                         pcb->tx_cred = credits;
2962                 } else {
2963                         pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_CFC;
2964                         pcb->tx_cred = 0;
2965                 }
2966         }
2967
2968         NG_BTSOCKET_RFCOMM_INFO(
2969 "%s: cr=%d, dlci=%d, state=%d, flags=%#x, mtu=%d, rx_cred=%d, tx_cred=%d\n",
2970                 __func__, cr, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
2971                 pcb->rx_cred, pcb->tx_cred);
2972 } /* ng_btsocket_rfcomm_set_pn */
2973
2974 /*
2975  * Send RFCOMM SABM/DISC/UA/DM frames. Caller must hold s->session_mtx
2976  */
2977
2978 static int
2979 ng_btsocket_rfcomm_send_command(ng_btsocket_rfcomm_session_p s,
2980                 u_int8_t type, u_int8_t dlci)
2981 {
2982         struct rfcomm_cmd_hdr   *hdr = NULL;
2983         struct mbuf             *m = NULL;
2984         int                      cr;
2985
2986         mtx_assert(&s->session_mtx, MA_OWNED);
2987
2988         NG_BTSOCKET_RFCOMM_INFO(
2989 "%s: Sending command type %#x, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2990                 __func__, type, s->state, s->flags, s->mtu, dlci);
2991
2992         switch (type) {
2993         case RFCOMM_FRAME_SABM:
2994         case RFCOMM_FRAME_DISC:
2995                 cr = INITIATOR(s);
2996                 break;
2997
2998         case RFCOMM_FRAME_UA:
2999         case RFCOMM_FRAME_DM:
3000                 cr = !INITIATOR(s);
3001                 break;
3002
3003         default:
3004                 panic("%s: Invalid frame type=%#x", __func__, type);
3005                 return (EINVAL);
3006                 /* NOT REACHED */
3007         }
3008
3009         MGETHDR(m, MB_DONTWAIT, MT_DATA);
3010         if (m == NULL)
3011                 return (ENOBUFS);
3012
3013         m->m_pkthdr.len = m->m_len = sizeof(*hdr);
3014
3015         hdr = mtod(m, struct rfcomm_cmd_hdr *);
3016         hdr->address = RFCOMM_MKADDRESS(cr, dlci);
3017         hdr->control = RFCOMM_MKCONTROL(type, 1);
3018         hdr->length = RFCOMM_MKLEN8(0);
3019         hdr->fcs = ng_btsocket_rfcomm_fcs3((u_int8_t *) hdr);
3020
3021         NG_BT_MBUFQ_ENQUEUE(&s->outq, m);
3022
3023         return (0);
3024 } /* ng_btsocket_rfcomm_send_command */
3025
3026 /*
3027  * Send RFCOMM UIH frame. Caller must hold s->session_mtx
3028  */
3029
3030 static int
3031 ng_btsocket_rfcomm_send_uih(ng_btsocket_rfcomm_session_p s, u_int8_t address,
3032                 u_int8_t pf, u_int8_t credits, struct mbuf *data)
3033 {
3034         struct rfcomm_frame_hdr *hdr = NULL;
3035         struct mbuf             *m = NULL, *mcrc = NULL;
3036         u_int16_t                length;
3037
3038         mtx_assert(&s->session_mtx, MA_OWNED);
3039
3040         MGETHDR(m, MB_DONTWAIT, MT_DATA);
3041         if (m == NULL) {
3042                 NG_FREE_M(data);
3043                 return (ENOBUFS);
3044         }
3045         m->m_pkthdr.len = m->m_len = sizeof(*hdr);
3046
3047         MGET(mcrc, MB_DONTWAIT, MT_DATA);
3048         if (mcrc == NULL) {
3049                 NG_FREE_M(data);
3050                 return (ENOBUFS);
3051         }
3052         mcrc->m_len = 1;
3053
3054         /* Fill UIH frame header */
3055         hdr = mtod(m, struct rfcomm_frame_hdr *);
3056         hdr->address = address;
3057         hdr->control = RFCOMM_MKCONTROL(RFCOMM_FRAME_UIH, pf);
3058
3059         /* Calculate FCS */
3060         mcrc->m_data[0] = ng_btsocket_rfcomm_fcs2((u_int8_t *) hdr);
3061
3062         /* Put length back */
3063         length = (data != NULL)? data->m_pkthdr.len : 0;
3064         if (length > 127) {
3065                 u_int16_t       l = htole16(RFCOMM_MKLEN16(length));
3066
3067                 bcopy(&l, &hdr->length, sizeof(l));
3068                 m->m_pkthdr.len ++;
3069                 m->m_len ++;
3070         } else
3071                 hdr->length = RFCOMM_MKLEN8(length);
3072
3073         if (pf) {
3074                 m->m_data[m->m_len] = credits;
3075                 m->m_pkthdr.len ++;
3076                 m->m_len ++;
3077         }
3078
3079         /* Add payload */
3080         if (data != NULL) {
3081                 m_cat(m, data);
3082                 m->m_pkthdr.len += length;
3083         }
3084
3085         /* Put FCS back */
3086         m_cat(m, mcrc);
3087         m->m_pkthdr.len ++;
3088
3089         NG_BTSOCKET_RFCOMM_INFO(
3090 "%s: Sending UIH state=%d, flags=%#x, address=%d, length=%d, pf=%d, " \
3091 "credits=%d, len=%d\n",
3092                 __func__, s->state, s->flags, address, length, pf, credits,
3093                 m->m_pkthdr.len);
3094
3095         NG_BT_MBUFQ_ENQUEUE(&s->outq, m);
3096
3097         return (0);
3098 } /* ng_btsocket_rfcomm_send_uih */
3099
3100 /*
3101  * Send MSC request. Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3102  */
3103
3104 static int
3105 ng_btsocket_rfcomm_send_msc(ng_btsocket_rfcomm_pcb_p pcb)
3106 {
3107         struct mbuf             *m = NULL;
3108         struct rfcomm_mcc_hdr   *hdr = NULL;
3109         struct rfcomm_mcc_msc   *msc = NULL;
3110
3111         mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3112         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3113
3114         MGETHDR(m, MB_DONTWAIT, MT_DATA);
3115         if (m == NULL)
3116                 return (ENOBUFS);
3117
3118         m->m_pkthdr.len = m->m_len = sizeof(*hdr) + sizeof(*msc);
3119
3120         hdr = mtod(m, struct rfcomm_mcc_hdr *);
3121         msc = (struct rfcomm_mcc_msc *)(hdr + 1);
3122
3123         hdr->type = RFCOMM_MKMCC_TYPE(1, RFCOMM_MCC_MSC);
3124         hdr->length = RFCOMM_MKLEN8(sizeof(*msc));
3125
3126         msc->address = RFCOMM_MKADDRESS(1, pcb->dlci);
3127         msc->modem = pcb->lmodem;
3128
3129         NG_BTSOCKET_RFCOMM_INFO(
3130 "%s: Sending MSC dlci=%d, state=%d, flags=%#x, address=%d, modem=%#x\n",
3131                 __func__, pcb->dlci, pcb->state, pcb->flags, msc->address,
3132                 msc->modem);
3133
3134         return (ng_btsocket_rfcomm_send_uih(pcb->session,
3135                         RFCOMM_MKADDRESS(INITIATOR(pcb->session), 0), 0, 0, m));
3136 } /* ng_btsocket_rfcomm_send_msc */
3137
3138 /*
3139  * Send PN request. Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3140  */
3141
3142 static int
3143 ng_btsocket_rfcomm_send_pn(ng_btsocket_rfcomm_pcb_p pcb)
3144 {
3145         struct mbuf             *m = NULL;
3146         struct rfcomm_mcc_hdr   *hdr = NULL;
3147         struct rfcomm_mcc_pn    *pn = NULL;
3148
3149         mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3150         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3151
3152         MGETHDR(m, MB_DONTWAIT, MT_DATA);
3153         if (m == NULL)
3154                 return (ENOBUFS);
3155
3156         m->m_pkthdr.len = m->m_len = sizeof(*hdr) + sizeof(*pn);
3157
3158         hdr = mtod(m, struct rfcomm_mcc_hdr *);
3159         pn = (struct rfcomm_mcc_pn *)(hdr + 1);
3160
3161         hdr->type = RFCOMM_MKMCC_TYPE(1, RFCOMM_MCC_PN);
3162         hdr->length = RFCOMM_MKLEN8(sizeof(*pn));
3163
3164         pn->dlci = pcb->dlci;
3165
3166         /*
3167          * Set default DLCI priority as described in GSM 07.10
3168          * (ETSI TS 101 369) clause 5.6 page 42
3169          */
3170
3171         pn->priority = (pcb->dlci < 56)? (((pcb->dlci >> 3) << 3) + 7) : 61;
3172         pn->ack_timer = 0;
3173         pn->mtu = htole16(pcb->mtu);
3174         pn->max_retrans = 0;
3175
3176         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
3177                 pn->flow_control = 0xf0;
3178                 pn->credits = pcb->rx_cred;
3179         } else {
3180                 pn->flow_control = 0;
3181                 pn->credits = 0;
3182         }
3183
3184         NG_BTSOCKET_RFCOMM_INFO(
3185 "%s: Sending PN dlci=%d, state=%d, flags=%#x, mtu=%d, flow_control=%#x, " \
3186 "credits=%d\n", __func__, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
3187                 pn->flow_control, pn->credits);
3188
3189         return (ng_btsocket_rfcomm_send_uih(pcb->session,
3190                         RFCOMM_MKADDRESS(INITIATOR(pcb->session), 0), 0, 0, m));
3191 } /* ng_btsocket_rfcomm_send_pn */
3192
3193 /*
3194  * Calculate and send credits based on available space in receive buffer
3195  */
3196
3197 static int
3198 ng_btsocket_rfcomm_send_credits(ng_btsocket_rfcomm_pcb_p pcb)
3199 {
3200         int             error = 0;
3201         u_int8_t        credits;
3202
3203         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3204         mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3205
3206         NG_BTSOCKET_RFCOMM_INFO(
3207 "%s: Sending more credits, dlci=%d, state=%d, flags=%#x, mtu=%d, " \
3208 "space=%ld, tx_cred=%d, rx_cred=%d\n",
3209                 __func__, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
3210                 sbspace(&pcb->so->so_rcv), pcb->tx_cred, pcb->rx_cred);
3211
3212         credits = sbspace(&pcb->so->so_rcv) / pcb->mtu;
3213         if (credits > 0) {
3214                 if (pcb->rx_cred + credits > RFCOMM_MAX_CREDITS)
3215                         credits = RFCOMM_MAX_CREDITS - pcb->rx_cred;
3216
3217                 error = ng_btsocket_rfcomm_send_uih(
3218                                 pcb->session,
3219                                 RFCOMM_MKADDRESS(INITIATOR(pcb->session),
3220                                         pcb->dlci), 1, credits, NULL);
3221                 if (error == 0) {
3222                         pcb->rx_cred += credits;
3223
3224                         NG_BTSOCKET_RFCOMM_INFO(
3225 "%s: Gave remote side %d more credits, dlci=%d, state=%d, flags=%#x, " \
3226 "rx_cred=%d, tx_cred=%d\n",     __func__, credits, pcb->dlci, pcb->state,
3227                                 pcb->flags, pcb->rx_cred, pcb->tx_cred);
3228                 } else
3229                         NG_BTSOCKET_RFCOMM_ERR(
3230 "%s: Could not send credits, error=%d, dlci=%d, state=%d, flags=%#x, " \
3231 "mtu=%d, space=%ld, tx_cred=%d, rx_cred=%d\n",
3232                                 __func__, error, pcb->dlci, pcb->state,
3233                                 pcb->flags, pcb->mtu, sbspace(&pcb->so->so_rcv),
3234                                 pcb->tx_cred, pcb->rx_cred);
3235         }
3236
3237         return (error);
3238 } /* ng_btsocket_rfcomm_send_credits */
3239
3240 /*****************************************************************************
3241  *****************************************************************************
3242  **                              RFCOMM DLCs
3243  *****************************************************************************
3244  *****************************************************************************/
3245
3246 /*
3247  * Send data from socket send buffer
3248  * Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3249  */
3250
3251 static int
3252 ng_btsocket_rfcomm_pcb_send(ng_btsocket_rfcomm_pcb_p pcb, int limit)
3253 {
3254         struct mbuf     *m = NULL;
3255         int              sent, length, error;
3256
3257         mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3258         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3259
3260         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)
3261                 limit = min(limit, pcb->tx_cred);
3262         else if (!(pcb->rmodem & RFCOMM_MODEM_FC))
3263                 limit = min(limit, RFCOMM_MAX_CREDITS); /* XXX ??? */
3264         else
3265                 limit = 0;
3266
3267         if (limit == 0) {
3268                 NG_BTSOCKET_RFCOMM_INFO(
3269 "%s: Could not send - remote flow control asserted, dlci=%d, flags=%#x, " \
3270 "rmodem=%#x, tx_cred=%d\n",
3271                         __func__, pcb->dlci, pcb->flags, pcb->rmodem,
3272                         pcb->tx_cred);
3273
3274                 return (0);
3275         }
3276
3277         for (error = 0, sent = 0; sent < limit; sent ++) {
3278                 length = min(pcb->mtu, pcb->so->so_snd.sb_cc);
3279                 if (length == 0)
3280                         break;
3281
3282                 /* Get the chunk from the socket's send buffer */
3283                 m = ng_btsocket_rfcomm_prepare_packet(&pcb->so->so_snd, length);
3284                 if (m == NULL) {
3285                         error = ENOBUFS;
3286                         break;
3287                 }
3288
3289                 sbdrop(&pcb->so->so_snd, length);
3290
3291                 error = ng_btsocket_rfcomm_send_uih(pcb->session,
3292                                 RFCOMM_MKADDRESS(INITIATOR(pcb->session),
3293                                         pcb->dlci), 0, 0, m);
3294                 if (error != 0)
3295                         break;
3296         }
3297
3298         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)
3299                 pcb->tx_cred -= sent;
3300
3301         if (error == 0 && sent > 0) {
3302                 pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_SENDING;
3303                 sowwakeup(pcb->so);
3304         }
3305
3306         return (error);
3307 } /* ng_btsocket_rfcomm_pcb_send */
3308
3309 /*
3310  * Unlink and disconnect DLC. If ng_btsocket_rfcomm_pcb_kill() returns
3311  * non zero value than socket has no reference and has to be detached.
3312  * Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3313  */
3314
3315 static void
3316 ng_btsocket_rfcomm_pcb_kill(ng_btsocket_rfcomm_pcb_p pcb, int error)
3317 {
3318         ng_btsocket_rfcomm_session_p    s = pcb->session;
3319
3320         NG_BTSOCKET_RFCOMM_INFO(
3321 "%s: Killing DLC, so=%p, dlci=%d, state=%d, flags=%#x, error=%d\n",
3322                 __func__, pcb->so, pcb->dlci, pcb->state, pcb->flags, error);
3323
3324         if (pcb->session == NULL)
3325                 panic("%s: DLC without session, pcb=%p, state=%d, flags=%#x",
3326                         __func__, pcb, pcb->state, pcb->flags);
3327
3328         mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3329         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3330
3331         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
3332                 ng_btsocket_rfcomm_untimeout(pcb);
3333
3334         /* Detach DLC from the session. Does not matter which state DLC in */
3335         LIST_REMOVE(pcb, session_next);
3336         pcb->session = NULL;
3337
3338         /* Change DLC state and wakeup all sleepers */
3339         pcb->state = NG_BTSOCKET_RFCOMM_DLC_CLOSED;
3340         pcb->so->so_error = error;
3341         soisdisconnected(pcb->so);
3342         wakeup(&pcb->state);
3343
3344         /* Check if we have any DLCs left on the session */
3345         if (LIST_EMPTY(&s->dlcs) && INITIATOR(s)) {
3346                 NG_BTSOCKET_RFCOMM_INFO(
3347 "%s: Disconnecting session, state=%d, flags=%#x, mtu=%d\n",
3348                         __func__, s->state, s->flags, s->mtu);
3349
3350                 switch (s->state) {
3351                 case NG_BTSOCKET_RFCOMM_SESSION_CLOSED:
3352                 case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
3353                         /*
3354                          * Do not have to do anything here. We can get here
3355                          * when L2CAP connection was terminated or we have
3356                          * received DISC on multiplexor channel
3357                          */
3358                         break;
3359
3360                 case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
3361                         /* Send DISC on multiplexor channel */
3362                         error = ng_btsocket_rfcomm_send_command(s,
3363                                         RFCOMM_FRAME_DISC, 0);
3364                         if (error == 0) {
3365                                 s->state = NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING;
3366                                 break;
3367                         }
3368                         /* FALL THROUGH */
3369
3370                 case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
3371                 case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
3372                         s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
3373                         break;
3374
3375 /*              case NG_BTSOCKET_RFCOMM_SESSION_LISTENING: */
3376                 default:
3377                         panic("%s: Invalid session state=%d, flags=%#x",
3378                                 __func__, s->state, s->flags);
3379                         break;
3380                 }
3381
3382                 ng_btsocket_rfcomm_task_wakeup();
3383         }
3384 } /* ng_btsocket_rfcomm_pcb_kill */
3385
3386 /*
3387  * Look for given dlci for given RFCOMM session. Caller must hold s->session_mtx
3388  */
3389
3390 static ng_btsocket_rfcomm_pcb_p
3391 ng_btsocket_rfcomm_pcb_by_dlci(ng_btsocket_rfcomm_session_p s, int dlci)
3392 {
3393         ng_btsocket_rfcomm_pcb_p        pcb = NULL;
3394
3395         mtx_assert(&s->session_mtx, MA_OWNED);
3396
3397         LIST_FOREACH(pcb, &s->dlcs, session_next)
3398                 if (pcb->dlci == dlci)
3399                         break;
3400
3401         return (pcb);
3402 } /* ng_btsocket_rfcomm_pcb_by_dlci */
3403
3404 /*
3405  * Look for socket that listens on given src address and given channel
3406  */
3407
3408 static ng_btsocket_rfcomm_pcb_p
3409 ng_btsocket_rfcomm_pcb_listener(bdaddr_p src, int channel)
3410 {
3411         ng_btsocket_rfcomm_pcb_p        pcb = NULL, pcb1 = NULL;
3412
3413         mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
3414
3415         LIST_FOREACH(pcb, &ng_btsocket_rfcomm_sockets, next) {
3416                 if (pcb->channel != channel ||
3417                     !(pcb->so->so_options & SO_ACCEPTCONN))
3418                         continue;
3419
3420                 if (bcmp(&pcb->src, src, sizeof(*src)) == 0)
3421                         break;
3422
3423                 if (bcmp(&pcb->src, NG_HCI_BDADDR_ANY, sizeof(bdaddr_t)) == 0)
3424                         pcb1 = pcb;
3425         }
3426
3427         mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
3428
3429         return ((pcb != NULL)? pcb : pcb1);
3430 } /* ng_btsocket_rfcomm_pcb_listener */
3431
3432 /*****************************************************************************
3433  *****************************************************************************
3434  **                              Misc. functions
3435  *****************************************************************************
3436  *****************************************************************************/
3437
3438 /*
3439  *  Set timeout. Caller MUST hold pcb_mtx
3440  */
3441
3442 static void
3443 ng_btsocket_rfcomm_timeout(ng_btsocket_rfcomm_pcb_p pcb)
3444 {
3445         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3446
3447         if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)) {
3448                 pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_TIMO;
3449                 pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3450                 pcb->timo = timeout(ng_btsocket_rfcomm_process_timeout, pcb,
3451                                         ng_btsocket_rfcomm_timo * hz);
3452         } else
3453                 panic("%s: Duplicated socket timeout?!", __func__);
3454 } /* ng_btsocket_rfcomm_timeout */
3455
3456 /*
3457  *  Unset pcb timeout. Caller MUST hold pcb_mtx
3458  */
3459
3460 static void
3461 ng_btsocket_rfcomm_untimeout(ng_btsocket_rfcomm_pcb_p pcb)
3462 {
3463         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3464
3465         if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO) {
3466                 untimeout(ng_btsocket_rfcomm_process_timeout, pcb, pcb->timo);
3467                 pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMO;
3468                 pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3469         } else
3470                 panic("%s: No socket timeout?!", __func__);
3471 } /* ng_btsocket_rfcomm_timeout */
3472
3473 /*
3474  * Process pcb timeout
3475  */
3476
3477 static void
3478 ng_btsocket_rfcomm_process_timeout(void *xpcb)
3479 {
3480         ng_btsocket_rfcomm_pcb_p        pcb = (ng_btsocket_rfcomm_pcb_p) xpcb;
3481
3482         mtx_lock(&pcb->pcb_mtx);
3483
3484         NG_BTSOCKET_RFCOMM_INFO(
3485 "%s: Timeout, so=%p, dlci=%d, state=%d, flags=%#x\n",
3486                 __func__, pcb->so, pcb->dlci, pcb->state, pcb->flags);
3487
3488         pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMO;
3489         pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3490
3491         switch (pcb->state) {
3492         case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
3493         case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
3494                 pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
3495                 break;
3496
3497         case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
3498         case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
3499                 break;
3500
3501         default:
3502                 panic(
3503 "%s: DLC timeout in invalid state, dlci=%d, state=%d, flags=%#x\n",
3504                         __func__, pcb->dlci, pcb->state, pcb->flags);
3505                 break;
3506         }
3507
3508         ng_btsocket_rfcomm_task_wakeup();
3509
3510         mtx_unlock(&pcb->pcb_mtx);
3511 } /* ng_btsocket_rfcomm_process_timeout */
3512
3513 /*
3514  * Get up to length bytes from the socket buffer
3515  */
3516
3517 static struct mbuf *
3518 ng_btsocket_rfcomm_prepare_packet(struct sockbuf *sb, int length)
3519 {
3520         struct mbuf     *top = NULL, *m = NULL, *n = NULL, *nextpkt = NULL;
3521         int              mlen, noff, len;
3522
3523         MGETHDR(top, MB_DONTWAIT, MT_DATA);
3524         if (top == NULL)
3525                 return (NULL);
3526
3527         top->m_pkthdr.len = length;
3528         top->m_len = 0;
3529         mlen = MHLEN;
3530
3531         m = top;
3532         n = sb->sb_mb;
3533         nextpkt = n->m_nextpkt;
3534         noff = 0;
3535
3536         while (length > 0 && n != NULL) {
3537                 len = min(mlen - m->m_len, n->m_len - noff);
3538                 if (len > length)
3539                         len = length;
3540
3541                 bcopy(mtod(n, caddr_t)+noff, mtod(m, caddr_t)+m->m_len, len);
3542                 m->m_len += len;
3543                 noff += len;
3544                 length -= len;
3545
3546                 if (length > 0 && m->m_len == mlen) {
3547                         MGET(m->m_next, MB_DONTWAIT, MT_DATA);
3548                         if (m->m_next == NULL) {
3549                                 NG_FREE_M(top);
3550                                 return (NULL);
3551                         }
3552
3553                         m = m->m_next;
3554                         m->m_len = 0;
3555                         mlen = MLEN;
3556                 }
3557
3558                 if (noff == n->m_len) {
3559                         noff = 0;
3560                         n = n->m_next;
3561
3562                         if (n == NULL)
3563                                 n = nextpkt;
3564
3565                         nextpkt = (n != NULL)? n->m_nextpkt : NULL;
3566                 }
3567         }
3568
3569         if (length < 0)
3570                 panic("%s: length=%d", __func__, length);
3571         if (length > 0 && n == NULL)
3572                 panic("%s: bogus length=%d, n=%p", __func__, length, n);
3573
3574         return (top);
3575 } /* ng_btsocket_rfcomm_prepare_packet */
3576