xref: /freebsd/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c (revision dd41de95a84d979615a2ef11df6850622bf6184e)
1 /*
2  * ng_btsocket_rfcomm.c
3  */
4 
5 /*-
6  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
7  *
8  * Copyright (c) 2001-2003 Maksim Yevmenkin <m_evmenkin@yahoo.com>
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  * $Id: ng_btsocket_rfcomm.c,v 1.28 2003/09/14 23:29:06 max Exp $
33  * $FreeBSD$
34  */
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/bitstring.h>
39 #include <sys/domain.h>
40 #include <sys/endian.h>
41 #include <sys/errno.h>
42 #include <sys/filedesc.h>
43 #include <sys/ioccom.h>
44 #include <sys/kernel.h>
45 #include <sys/lock.h>
46 #include <sys/malloc.h>
47 #include <sys/mbuf.h>
48 #include <sys/mutex.h>
49 #include <sys/proc.h>
50 #include <sys/protosw.h>
51 #include <sys/queue.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/sysctl.h>
55 #include <sys/taskqueue.h>
56 #include <sys/uio.h>
57 
58 #include <net/vnet.h>
59 
60 #include <netgraph/ng_message.h>
61 #include <netgraph/netgraph.h>
62 #include <netgraph/bluetooth/include/ng_bluetooth.h>
63 #include <netgraph/bluetooth/include/ng_hci.h>
64 #include <netgraph/bluetooth/include/ng_l2cap.h>
65 #include <netgraph/bluetooth/include/ng_btsocket.h>
66 #include <netgraph/bluetooth/include/ng_btsocket_l2cap.h>
67 #include <netgraph/bluetooth/include/ng_btsocket_rfcomm.h>
68 
69 /* MALLOC define */
70 #ifdef NG_SEPARATE_MALLOC
71 static MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_RFCOMM, "netgraph_btsocks_rfcomm",
72 		"Netgraph Bluetooth RFCOMM sockets");
73 #else
74 #define M_NETGRAPH_BTSOCKET_RFCOMM M_NETGRAPH
75 #endif /* NG_SEPARATE_MALLOC */
76 
77 /* Debug */
78 #define NG_BTSOCKET_RFCOMM_INFO \
79 	if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_INFO_LEVEL && \
80 	    ppsratecheck(&ng_btsocket_rfcomm_lasttime, &ng_btsocket_rfcomm_curpps, 1)) \
81 		printf
82 
83 #define NG_BTSOCKET_RFCOMM_WARN \
84 	if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_WARN_LEVEL && \
85 	    ppsratecheck(&ng_btsocket_rfcomm_lasttime, &ng_btsocket_rfcomm_curpps, 1)) \
86 		printf
87 
88 #define NG_BTSOCKET_RFCOMM_ERR \
89 	if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_ERR_LEVEL && \
90 	    ppsratecheck(&ng_btsocket_rfcomm_lasttime, &ng_btsocket_rfcomm_curpps, 1)) \
91 		printf
92 
93 #define NG_BTSOCKET_RFCOMM_ALERT \
94 	if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_ALERT_LEVEL && \
95 	    ppsratecheck(&ng_btsocket_rfcomm_lasttime, &ng_btsocket_rfcomm_curpps, 1)) \
96 		printf
97 
98 #define	ALOT	0x7fff
99 
100 /* Local prototypes */
101 static int ng_btsocket_rfcomm_upcall
102 	(struct socket *so, void *arg, int waitflag);
103 static void ng_btsocket_rfcomm_sessions_task
104 	(void *ctx, int pending);
105 static void ng_btsocket_rfcomm_session_task
106 	(ng_btsocket_rfcomm_session_p s);
107 #define ng_btsocket_rfcomm_task_wakeup() \
108 	taskqueue_enqueue(taskqueue_swi_giant, &ng_btsocket_rfcomm_task)
109 
110 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_connect_ind
111 	(ng_btsocket_rfcomm_session_p s, int channel);
112 static void ng_btsocket_rfcomm_connect_cfm
113 	(ng_btsocket_rfcomm_session_p s);
114 
115 static int ng_btsocket_rfcomm_session_create
116 	(ng_btsocket_rfcomm_session_p *sp, struct socket *l2so,
117 	 bdaddr_p src, bdaddr_p dst, struct thread *td);
118 static int ng_btsocket_rfcomm_session_accept
119 	(ng_btsocket_rfcomm_session_p s0);
120 static int ng_btsocket_rfcomm_session_connect
121 	(ng_btsocket_rfcomm_session_p s);
122 static int ng_btsocket_rfcomm_session_receive
123 	(ng_btsocket_rfcomm_session_p s);
124 static int ng_btsocket_rfcomm_session_send
125 	(ng_btsocket_rfcomm_session_p s);
126 static void ng_btsocket_rfcomm_session_clean
127 	(ng_btsocket_rfcomm_session_p s);
128 static void ng_btsocket_rfcomm_session_process_pcb
129 	(ng_btsocket_rfcomm_session_p s);
130 static ng_btsocket_rfcomm_session_p ng_btsocket_rfcomm_session_by_addr
131 	(bdaddr_p src, bdaddr_p dst);
132 
133 static int ng_btsocket_rfcomm_receive_frame
134 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
135 static int ng_btsocket_rfcomm_receive_sabm
136 	(ng_btsocket_rfcomm_session_p s, int dlci);
137 static int ng_btsocket_rfcomm_receive_disc
138 	(ng_btsocket_rfcomm_session_p s, int dlci);
139 static int ng_btsocket_rfcomm_receive_ua
140 	(ng_btsocket_rfcomm_session_p s, int dlci);
141 static int ng_btsocket_rfcomm_receive_dm
142 	(ng_btsocket_rfcomm_session_p s, int dlci);
143 static int ng_btsocket_rfcomm_receive_uih
144 	(ng_btsocket_rfcomm_session_p s, int dlci, int pf, struct mbuf *m0);
145 static int ng_btsocket_rfcomm_receive_mcc
146 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
147 static int ng_btsocket_rfcomm_receive_test
148 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
149 static int ng_btsocket_rfcomm_receive_fc
150 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
151 static int ng_btsocket_rfcomm_receive_msc
152 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
153 static int ng_btsocket_rfcomm_receive_rpn
154 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
155 static int ng_btsocket_rfcomm_receive_rls
156 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
157 static int ng_btsocket_rfcomm_receive_pn
158 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
159 static void ng_btsocket_rfcomm_set_pn
160 	(ng_btsocket_rfcomm_pcb_p pcb, u_int8_t cr, u_int8_t flow_control,
161 	 u_int8_t credits, u_int16_t mtu);
162 
163 static int ng_btsocket_rfcomm_send_command
164 	(ng_btsocket_rfcomm_session_p s, u_int8_t type, u_int8_t dlci);
165 static int ng_btsocket_rfcomm_send_uih
166 	(ng_btsocket_rfcomm_session_p s, u_int8_t address, u_int8_t pf,
167 	 u_int8_t credits, struct mbuf *data);
168 static int ng_btsocket_rfcomm_send_msc
169 	(ng_btsocket_rfcomm_pcb_p pcb);
170 static int ng_btsocket_rfcomm_send_pn
171 	(ng_btsocket_rfcomm_pcb_p pcb);
172 static int ng_btsocket_rfcomm_send_credits
173 	(ng_btsocket_rfcomm_pcb_p pcb);
174 
175 static int ng_btsocket_rfcomm_pcb_send
176 	(ng_btsocket_rfcomm_pcb_p pcb, int limit);
177 static void ng_btsocket_rfcomm_pcb_kill
178 	(ng_btsocket_rfcomm_pcb_p pcb, int error);
179 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_pcb_by_dlci
180 	(ng_btsocket_rfcomm_session_p s, int dlci);
181 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_pcb_listener
182 	(bdaddr_p src, int channel);
183 
184 static void ng_btsocket_rfcomm_timeout
185 	(ng_btsocket_rfcomm_pcb_p pcb);
186 static void ng_btsocket_rfcomm_untimeout
187 	(ng_btsocket_rfcomm_pcb_p pcb);
188 static void ng_btsocket_rfcomm_process_timeout
189 	(void *xpcb);
190 
191 static struct mbuf * ng_btsocket_rfcomm_prepare_packet
192 	(struct sockbuf *sb, int length);
193 
194 /* Globals */
195 extern int					ifqmaxlen;
196 static u_int32_t				ng_btsocket_rfcomm_debug_level;
197 static u_int32_t				ng_btsocket_rfcomm_timo;
198 struct task					ng_btsocket_rfcomm_task;
199 static LIST_HEAD(, ng_btsocket_rfcomm_session)	ng_btsocket_rfcomm_sessions;
200 static struct mtx				ng_btsocket_rfcomm_sessions_mtx;
201 static LIST_HEAD(, ng_btsocket_rfcomm_pcb)	ng_btsocket_rfcomm_sockets;
202 static struct mtx				ng_btsocket_rfcomm_sockets_mtx;
203 static struct timeval				ng_btsocket_rfcomm_lasttime;
204 static int					ng_btsocket_rfcomm_curpps;
205 
206 /* Sysctl tree */
207 SYSCTL_DECL(_net_bluetooth_rfcomm_sockets);
208 static SYSCTL_NODE(_net_bluetooth_rfcomm_sockets, OID_AUTO, stream,
209     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
210     "Bluetooth STREAM RFCOMM sockets family");
211 SYSCTL_UINT(_net_bluetooth_rfcomm_sockets_stream, OID_AUTO, debug_level,
212 	CTLFLAG_RW,
213 	&ng_btsocket_rfcomm_debug_level, NG_BTSOCKET_INFO_LEVEL,
214 	"Bluetooth STREAM RFCOMM sockets debug level");
215 SYSCTL_UINT(_net_bluetooth_rfcomm_sockets_stream, OID_AUTO, timeout,
216 	CTLFLAG_RW,
217 	&ng_btsocket_rfcomm_timo, 60,
218 	"Bluetooth STREAM RFCOMM sockets timeout");
219 
220 /*****************************************************************************
221  *****************************************************************************
222  **                              RFCOMM CRC
223  *****************************************************************************
224  *****************************************************************************/
225 
226 static u_int8_t	ng_btsocket_rfcomm_crc_table[256] = {
227 	0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
228 	0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
229 	0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
230 	0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
231 
232 	0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
233 	0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
234 	0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
235 	0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
236 
237 	0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
238 	0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
239 	0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
240 	0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
241 
242 	0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
243 	0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
244 	0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
245 	0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
246 
247 	0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
248 	0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
249 	0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
250 	0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
251 
252 	0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
253 	0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
254 	0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
255 	0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
256 
257 	0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
258 	0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
259 	0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
260 	0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
261 
262 	0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
263 	0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
264 	0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
265 	0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
266 };
267 
268 /* CRC */
269 static u_int8_t
270 ng_btsocket_rfcomm_crc(u_int8_t *data, int length)
271 {
272 	u_int8_t	crc = 0xff;
273 
274 	while (length --)
275 		crc = ng_btsocket_rfcomm_crc_table[crc ^ *data++];
276 
277 	return (crc);
278 } /* ng_btsocket_rfcomm_crc */
279 
280 /* FCS on 2 bytes */
281 static u_int8_t
282 ng_btsocket_rfcomm_fcs2(u_int8_t *data)
283 {
284 	return (0xff - ng_btsocket_rfcomm_crc(data, 2));
285 } /* ng_btsocket_rfcomm_fcs2 */
286 
287 /* FCS on 3 bytes */
288 static u_int8_t
289 ng_btsocket_rfcomm_fcs3(u_int8_t *data)
290 {
291 	return (0xff - ng_btsocket_rfcomm_crc(data, 3));
292 } /* ng_btsocket_rfcomm_fcs3 */
293 
294 /*
295  * Check FCS
296  *
297  * From Bluetooth spec
298  *
299  * "... In 07.10, the frame check sequence (FCS) is calculated on different
300  * sets of fields for different frame types. These are the fields that the
301  * FCS are calculated on:
302  *
303  * For SABM, DISC, UA, DM frames: on Address, Control and length field.
304  * For UIH frames: on Address and Control field.
305  *
306  * (This is stated here for clarification, and to set the standard for RFCOMM;
307  * the fields included in FCS calculation have actually changed in version
308  * 7.0.0 of TS 07.10, but RFCOMM will not change the FCS calculation scheme
309  * from the one above.) ..."
310  */
311 
312 static int
313 ng_btsocket_rfcomm_check_fcs(u_int8_t *data, int type, u_int8_t fcs)
314 {
315 	if (type != RFCOMM_FRAME_UIH)
316 		return (ng_btsocket_rfcomm_fcs3(data) != fcs);
317 
318 	return (ng_btsocket_rfcomm_fcs2(data) != fcs);
319 } /* ng_btsocket_rfcomm_check_fcs */
320 
321 /*****************************************************************************
322  *****************************************************************************
323  **                              Socket interface
324  *****************************************************************************
325  *****************************************************************************/
326 
327 /*
328  * Initialize everything
329  */
330 
331 void
332 ng_btsocket_rfcomm_init(void)
333 {
334 
335 	/* Skip initialization of globals for non-default instances. */
336 	if (!IS_DEFAULT_VNET(curvnet))
337 		return;
338 
339 	ng_btsocket_rfcomm_debug_level = NG_BTSOCKET_WARN_LEVEL;
340 	ng_btsocket_rfcomm_timo = 60;
341 
342 	/* RFCOMM task */
343 	TASK_INIT(&ng_btsocket_rfcomm_task, 0,
344 		ng_btsocket_rfcomm_sessions_task, NULL);
345 
346 	/* RFCOMM sessions list */
347 	LIST_INIT(&ng_btsocket_rfcomm_sessions);
348 	mtx_init(&ng_btsocket_rfcomm_sessions_mtx,
349 		"btsocks_rfcomm_sessions_mtx", NULL, MTX_DEF);
350 
351 	/* RFCOMM sockets list */
352 	LIST_INIT(&ng_btsocket_rfcomm_sockets);
353 	mtx_init(&ng_btsocket_rfcomm_sockets_mtx,
354 		"btsocks_rfcomm_sockets_mtx", NULL, MTX_DEF);
355 } /* ng_btsocket_rfcomm_init */
356 
357 /*
358  * Abort connection on socket
359  */
360 
361 void
362 ng_btsocket_rfcomm_abort(struct socket *so)
363 {
364 
365 	so->so_error = ECONNABORTED;
366 	(void)ng_btsocket_rfcomm_disconnect(so);
367 } /* ng_btsocket_rfcomm_abort */
368 
369 void
370 ng_btsocket_rfcomm_close(struct socket *so)
371 {
372 
373 	(void)ng_btsocket_rfcomm_disconnect(so);
374 } /* ng_btsocket_rfcomm_close */
375 
376 /*
377  * Accept connection on socket. Nothing to do here, socket must be connected
378  * and ready, so just return peer address and be done with it.
379  */
380 
381 int
382 ng_btsocket_rfcomm_accept(struct socket *so, struct sockaddr **nam)
383 {
384 	return (ng_btsocket_rfcomm_peeraddr(so, nam));
385 } /* ng_btsocket_rfcomm_accept */
386 
387 /*
388  * Create and attach new socket
389  */
390 
391 int
392 ng_btsocket_rfcomm_attach(struct socket *so, int proto, struct thread *td)
393 {
394 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
395 	int				error;
396 
397 	/* Check socket and protocol */
398 	if (so->so_type != SOCK_STREAM)
399 		return (ESOCKTNOSUPPORT);
400 
401 #if 0 /* XXX sonewconn() calls "pru_attach" with proto == 0 */
402 	if (proto != 0)
403 		if (proto != BLUETOOTH_PROTO_RFCOMM)
404 			return (EPROTONOSUPPORT);
405 #endif /* XXX */
406 
407 	if (pcb != NULL)
408 		return (EISCONN);
409 
410 	/* Reserve send and receive space if it is not reserved yet */
411 	if ((so->so_snd.sb_hiwat == 0) || (so->so_rcv.sb_hiwat == 0)) {
412 		error = soreserve(so, NG_BTSOCKET_RFCOMM_SENDSPACE,
413 					NG_BTSOCKET_RFCOMM_RECVSPACE);
414 		if (error != 0)
415 			return (error);
416 	}
417 
418 	/* Allocate the PCB */
419         pcb = malloc(sizeof(*pcb),
420 		M_NETGRAPH_BTSOCKET_RFCOMM, M_NOWAIT | M_ZERO);
421         if (pcb == NULL)
422                 return (ENOMEM);
423 
424 	/* Link the PCB and the socket */
425 	so->so_pcb = (caddr_t) pcb;
426 	pcb->so = so;
427 
428 	/* Initialize PCB */
429 	pcb->state = NG_BTSOCKET_RFCOMM_DLC_CLOSED;
430 	pcb->flags = NG_BTSOCKET_RFCOMM_DLC_CFC;
431 
432 	pcb->lmodem =
433 	pcb->rmodem = (RFCOMM_MODEM_RTC | RFCOMM_MODEM_RTR | RFCOMM_MODEM_DV);
434 
435 	pcb->mtu = RFCOMM_DEFAULT_MTU;
436 	pcb->tx_cred = 0;
437 	pcb->rx_cred = RFCOMM_DEFAULT_CREDITS;
438 
439 	mtx_init(&pcb->pcb_mtx, "btsocks_rfcomm_pcb_mtx", NULL, MTX_DEF);
440 	callout_init_mtx(&pcb->timo, &pcb->pcb_mtx, 0);
441 
442 	/* Add the PCB to the list */
443 	mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
444 	LIST_INSERT_HEAD(&ng_btsocket_rfcomm_sockets, pcb, next);
445 	mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
446 
447         return (0);
448 } /* ng_btsocket_rfcomm_attach */
449 
450 /*
451  * Bind socket
452  */
453 
454 int
455 ng_btsocket_rfcomm_bind(struct socket *so, struct sockaddr *nam,
456 		struct thread *td)
457 {
458 	ng_btsocket_rfcomm_pcb_t	*pcb = so2rfcomm_pcb(so), *pcb1;
459 	struct sockaddr_rfcomm		*sa = (struct sockaddr_rfcomm *) nam;
460 
461 	if (pcb == NULL)
462 		return (EINVAL);
463 
464 	/* Verify address */
465 	if (sa == NULL)
466 		return (EINVAL);
467 	if (sa->rfcomm_family != AF_BLUETOOTH)
468 		return (EAFNOSUPPORT);
469 	if (sa->rfcomm_len != sizeof(*sa))
470 		return (EINVAL);
471 	if (sa->rfcomm_channel > 30)
472 		return (EINVAL);
473 
474 	mtx_lock(&pcb->pcb_mtx);
475 
476 	if (sa->rfcomm_channel != 0) {
477 		mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
478 
479 		LIST_FOREACH(pcb1, &ng_btsocket_rfcomm_sockets, next) {
480 			if (pcb1->channel == sa->rfcomm_channel &&
481 			    bcmp(&pcb1->src, &sa->rfcomm_bdaddr,
482 					sizeof(pcb1->src)) == 0) {
483 				mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
484 				mtx_unlock(&pcb->pcb_mtx);
485 
486 				return (EADDRINUSE);
487 			}
488 		}
489 
490 		mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
491 	}
492 
493 	bcopy(&sa->rfcomm_bdaddr, &pcb->src, sizeof(pcb->src));
494 	pcb->channel = sa->rfcomm_channel;
495 
496 	mtx_unlock(&pcb->pcb_mtx);
497 
498 	return (0);
499 } /* ng_btsocket_rfcomm_bind */
500 
501 /*
502  * Connect socket
503  */
504 
505 int
506 ng_btsocket_rfcomm_connect(struct socket *so, struct sockaddr *nam,
507 		struct thread *td)
508 {
509 	ng_btsocket_rfcomm_pcb_t	*pcb = so2rfcomm_pcb(so);
510 	struct sockaddr_rfcomm		*sa = (struct sockaddr_rfcomm *) nam;
511 	ng_btsocket_rfcomm_session_t	*s = NULL;
512 	struct socket			*l2so = NULL;
513 	int				 dlci, error = 0;
514 
515 	if (pcb == NULL)
516 		return (EINVAL);
517 
518 	/* Verify address */
519 	if (sa == NULL)
520 		return (EINVAL);
521 	if (sa->rfcomm_family != AF_BLUETOOTH)
522 		return (EAFNOSUPPORT);
523 	if (sa->rfcomm_len != sizeof(*sa))
524 		return (EINVAL);
525 	if (sa->rfcomm_channel > 30)
526 		return (EINVAL);
527 	if (sa->rfcomm_channel == 0 ||
528 	    bcmp(&sa->rfcomm_bdaddr, NG_HCI_BDADDR_ANY, sizeof(bdaddr_t)) == 0)
529 		return (EDESTADDRREQ);
530 
531 	/*
532 	 * Note that we will not check for errors in socreate() because
533 	 * if we failed to create L2CAP socket at this point we still
534 	 * might have already open session.
535 	 */
536 
537 	error = socreate(PF_BLUETOOTH, &l2so, SOCK_SEQPACKET,
538 			BLUETOOTH_PROTO_L2CAP, td->td_ucred, td);
539 
540 	/*
541 	 * Look for session between "pcb->src" and "sa->rfcomm_bdaddr" (dst)
542 	 */
543 
544 	mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
545 
546 	s = ng_btsocket_rfcomm_session_by_addr(&pcb->src, &sa->rfcomm_bdaddr);
547 	if (s == NULL) {
548 		/*
549 		 * We need to create new RFCOMM session. Check if we have L2CAP
550 		 * socket. If l2so == NULL then error has the error code from
551 		 * socreate()
552 		 */
553 
554 		if (l2so == NULL) {
555 			mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
556 			return (error);
557 		}
558 
559 		error = ng_btsocket_rfcomm_session_create(&s, l2so,
560 				&pcb->src, &sa->rfcomm_bdaddr, td);
561 		if (error != 0) {
562 			mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
563 			soclose(l2so);
564 
565 			return (error);
566 		}
567 	} else if (l2so != NULL)
568 		soclose(l2so); /* we don't need new L2CAP socket */
569 
570 	/*
571 	 * Check if we already have the same DLCI the same session
572 	 */
573 
574 	mtx_lock(&s->session_mtx);
575 	mtx_lock(&pcb->pcb_mtx);
576 
577 	dlci = RFCOMM_MKDLCI(!INITIATOR(s), sa->rfcomm_channel);
578 
579 	if (ng_btsocket_rfcomm_pcb_by_dlci(s, dlci) != NULL) {
580 		mtx_unlock(&pcb->pcb_mtx);
581 		mtx_unlock(&s->session_mtx);
582 		mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
583 
584 		return (EBUSY);
585 	}
586 
587 	/*
588 	 * Check session state and if its not acceptable then refuse connection
589 	 */
590 
591 	switch (s->state) {
592 	case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
593 	case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
594 	case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
595 		/*
596 		 * Update destination address and channel and attach
597 		 * DLC to the session
598 		 */
599 
600 		bcopy(&sa->rfcomm_bdaddr, &pcb->dst, sizeof(pcb->dst));
601 		pcb->channel = sa->rfcomm_channel;
602 		pcb->dlci = dlci;
603 
604 		LIST_INSERT_HEAD(&s->dlcs, pcb, session_next);
605 		pcb->session = s;
606 
607 		ng_btsocket_rfcomm_timeout(pcb);
608 		soisconnecting(pcb->so);
609 
610 		if (s->state == NG_BTSOCKET_RFCOMM_SESSION_OPEN) {
611 			pcb->mtu = s->mtu;
612 			bcopy(&so2l2cap_pcb(s->l2so)->src, &pcb->src,
613 				sizeof(pcb->src));
614 
615 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONFIGURING;
616 
617 			error = ng_btsocket_rfcomm_send_pn(pcb);
618 			if (error == 0)
619 				error = ng_btsocket_rfcomm_task_wakeup();
620 		} else
621 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT;
622 		break;
623 
624 	default:
625 		error = ECONNRESET;
626 		break;
627 	}
628 
629 	mtx_unlock(&pcb->pcb_mtx);
630 	mtx_unlock(&s->session_mtx);
631 	mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
632 
633 	return (error);
634 } /* ng_btsocket_rfcomm_connect */
635 
636 /*
637  * Process ioctl's calls on socket.
638  * XXX FIXME this should provide interface to the RFCOMM multiplexor channel
639  */
640 
641 int
642 ng_btsocket_rfcomm_control(struct socket *so, u_long cmd, caddr_t data,
643 		struct ifnet *ifp, struct thread *td)
644 {
645 	return (EINVAL);
646 } /* ng_btsocket_rfcomm_control */
647 
648 /*
649  * Process getsockopt/setsockopt system calls
650  */
651 
652 int
653 ng_btsocket_rfcomm_ctloutput(struct socket *so, struct sockopt *sopt)
654 {
655 	ng_btsocket_rfcomm_pcb_p		pcb = so2rfcomm_pcb(so);
656 	struct ng_btsocket_rfcomm_fc_info	fcinfo;
657 	int					error = 0;
658 
659 	if (pcb == NULL)
660 		return (EINVAL);
661 	if (sopt->sopt_level != SOL_RFCOMM)
662 		return (0);
663 
664 	mtx_lock(&pcb->pcb_mtx);
665 
666 	switch (sopt->sopt_dir) {
667 	case SOPT_GET:
668 		switch (sopt->sopt_name) {
669 		case SO_RFCOMM_MTU:
670 			error = sooptcopyout(sopt, &pcb->mtu, sizeof(pcb->mtu));
671 			break;
672 
673 		case SO_RFCOMM_FC_INFO:
674 			fcinfo.lmodem = pcb->lmodem;
675 			fcinfo.rmodem = pcb->rmodem;
676 			fcinfo.tx_cred = pcb->tx_cred;
677 			fcinfo.rx_cred = pcb->rx_cred;
678 			fcinfo.cfc = (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)?
679 				1 : 0;
680 			fcinfo.reserved = 0;
681 
682 			error = sooptcopyout(sopt, &fcinfo, sizeof(fcinfo));
683 			break;
684 
685 		default:
686 			error = ENOPROTOOPT;
687 			break;
688 		}
689 		break;
690 
691 	case SOPT_SET:
692 		switch (sopt->sopt_name) {
693 		default:
694 			error = ENOPROTOOPT;
695 			break;
696 		}
697 		break;
698 
699 	default:
700 		error = EINVAL;
701 		break;
702 	}
703 
704 	mtx_unlock(&pcb->pcb_mtx);
705 
706 	return (error);
707 } /* ng_btsocket_rfcomm_ctloutput */
708 
709 /*
710  * Detach and destroy socket
711  */
712 
713 void
714 ng_btsocket_rfcomm_detach(struct socket *so)
715 {
716 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
717 
718 	KASSERT(pcb != NULL, ("ng_btsocket_rfcomm_detach: pcb == NULL"));
719 
720 	mtx_lock(&pcb->pcb_mtx);
721 
722 	switch (pcb->state) {
723 	case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
724 	case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
725 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
726 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
727 		/* XXX What to do with pending request? */
728 		if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
729 			ng_btsocket_rfcomm_untimeout(pcb);
730 
731 		if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT)
732 			pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_DETACHED;
733 		else
734 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
735 
736 		ng_btsocket_rfcomm_task_wakeup();
737 		break;
738 
739 	case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
740 		ng_btsocket_rfcomm_task_wakeup();
741 		break;
742 	}
743 
744 	while (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CLOSED)
745 		msleep(&pcb->state, &pcb->pcb_mtx, PZERO, "rf_det", 0);
746 
747 	if (pcb->session != NULL)
748 		panic("%s: pcb->session != NULL\n", __func__);
749 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
750 		panic("%s: timeout on closed DLC, flags=%#x\n",
751 			__func__, pcb->flags);
752 
753 	mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
754 	LIST_REMOVE(pcb, next);
755 	mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
756 
757 	mtx_unlock(&pcb->pcb_mtx);
758 
759 	mtx_destroy(&pcb->pcb_mtx);
760 	bzero(pcb, sizeof(*pcb));
761 	free(pcb, M_NETGRAPH_BTSOCKET_RFCOMM);
762 
763 	soisdisconnected(so);
764 	so->so_pcb = NULL;
765 } /* ng_btsocket_rfcomm_detach */
766 
767 /*
768  * Disconnect socket
769  */
770 
771 int
772 ng_btsocket_rfcomm_disconnect(struct socket *so)
773 {
774 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
775 
776 	if (pcb == NULL)
777 		return (EINVAL);
778 
779 	mtx_lock(&pcb->pcb_mtx);
780 
781 	if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING) {
782 		mtx_unlock(&pcb->pcb_mtx);
783 		return (EINPROGRESS);
784 	}
785 
786 	/* XXX What to do with pending request? */
787 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
788 		ng_btsocket_rfcomm_untimeout(pcb);
789 
790 	switch (pcb->state) {
791 	case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING: /* XXX can we get here? */
792 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTING: /* XXX can we get here? */
793 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
794 
795 		/*
796 		 * Just change DLC state and enqueue RFCOMM task. It will
797 		 * queue and send DISC on the DLC.
798 		 */
799 
800 		pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
801 		soisdisconnecting(so);
802 
803 		ng_btsocket_rfcomm_task_wakeup();
804 		break;
805 
806 	case NG_BTSOCKET_RFCOMM_DLC_CLOSED:
807 	case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
808 		break;
809 
810 	default:
811 		panic("%s: Invalid DLC state=%d, flags=%#x\n",
812 			__func__, pcb->state, pcb->flags);
813 		break;
814 	}
815 
816 	mtx_unlock(&pcb->pcb_mtx);
817 
818 	return (0);
819 } /* ng_btsocket_rfcomm_disconnect */
820 
821 /*
822  * Listen on socket. First call to listen() will create listening RFCOMM session
823  */
824 
825 int
826 ng_btsocket_rfcomm_listen(struct socket *so, int backlog, struct thread *td)
827 {
828 	ng_btsocket_rfcomm_pcb_p	 pcb = so2rfcomm_pcb(so), pcb1;
829 	ng_btsocket_rfcomm_session_p	 s = NULL;
830 	struct socket			*l2so = NULL;
831 	int				 error, socreate_error, usedchannels;
832 
833 	if (pcb == NULL)
834 		return (EINVAL);
835 	if (pcb->channel > 30)
836 		return (EADDRNOTAVAIL);
837 
838 	usedchannels = 0;
839 
840 	mtx_lock(&pcb->pcb_mtx);
841 
842 	if (pcb->channel == 0) {
843 		mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
844 
845 		LIST_FOREACH(pcb1, &ng_btsocket_rfcomm_sockets, next)
846 			if (pcb1->channel != 0 &&
847 			    bcmp(&pcb1->src, &pcb->src, sizeof(pcb->src)) == 0)
848 				usedchannels |= (1 << (pcb1->channel - 1));
849 
850 		for (pcb->channel = 30; pcb->channel > 0; pcb->channel --)
851 			if (!(usedchannels & (1 << (pcb->channel - 1))))
852 				break;
853 
854 		if (pcb->channel == 0) {
855 			mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
856 			mtx_unlock(&pcb->pcb_mtx);
857 
858 			return (EADDRNOTAVAIL);
859 		}
860 
861 		mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
862 	}
863 
864 	mtx_unlock(&pcb->pcb_mtx);
865 
866 	/*
867 	 * Note that we will not check for errors in socreate() because
868 	 * if we failed to create L2CAP socket at this point we still
869 	 * might have already open session.
870 	 */
871 
872 	socreate_error = socreate(PF_BLUETOOTH, &l2so, SOCK_SEQPACKET,
873 			BLUETOOTH_PROTO_L2CAP, td->td_ucred, td);
874 
875 	/*
876 	 * Transition the socket and session into the LISTENING state.  Check
877 	 * for collisions first, as there can only be one.
878 	 */
879 	mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
880 	SOCK_LOCK(so);
881 	error = solisten_proto_check(so);
882 	SOCK_UNLOCK(so);
883 	if (error != 0)
884 		goto out;
885 
886 	LIST_FOREACH(s, &ng_btsocket_rfcomm_sessions, next)
887 		if (s->state == NG_BTSOCKET_RFCOMM_SESSION_LISTENING)
888 			break;
889 
890 	if (s == NULL) {
891 		/*
892 		 * We need to create default RFCOMM session. Check if we have
893 		 * L2CAP socket. If l2so == NULL then error has the error code
894 		 * from socreate()
895 		 */
896 		if (l2so == NULL) {
897 			error = socreate_error;
898 			goto out;
899 		}
900 
901 		/*
902 		 * Create default listen RFCOMM session. The default RFCOMM
903 		 * session will listen on ANY address.
904 		 *
905 		 * XXX FIXME Note that currently there is no way to adjust MTU
906 		 * for the default session.
907 		 */
908 		error = ng_btsocket_rfcomm_session_create(&s, l2so,
909 					NG_HCI_BDADDR_ANY, NULL, td);
910 		if (error != 0)
911 			goto out;
912 		l2so = NULL;
913 	}
914 	SOCK_LOCK(so);
915 	solisten_proto(so, backlog);
916 	SOCK_UNLOCK(so);
917 out:
918 	mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
919 	/*
920 	 * If we still have an l2so reference here, it's unneeded, so release
921 	 * it.
922 	 */
923 	if (l2so != NULL)
924 		soclose(l2so);
925 	return (error);
926 } /* ng_btsocket_listen */
927 
928 /*
929  * Get peer address
930  */
931 
932 int
933 ng_btsocket_rfcomm_peeraddr(struct socket *so, struct sockaddr **nam)
934 {
935 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
936 	struct sockaddr_rfcomm		sa;
937 
938 	if (pcb == NULL)
939 		return (EINVAL);
940 
941 	bcopy(&pcb->dst, &sa.rfcomm_bdaddr, sizeof(sa.rfcomm_bdaddr));
942 	sa.rfcomm_channel = pcb->channel;
943 	sa.rfcomm_len = sizeof(sa);
944 	sa.rfcomm_family = AF_BLUETOOTH;
945 
946 	*nam = sodupsockaddr((struct sockaddr *) &sa, M_NOWAIT);
947 
948 	return ((*nam == NULL)? ENOMEM : 0);
949 } /* ng_btsocket_rfcomm_peeraddr */
950 
951 /*
952  * Send data to socket
953  */
954 
955 int
956 ng_btsocket_rfcomm_send(struct socket *so, int flags, struct mbuf *m,
957 		struct sockaddr *nam, struct mbuf *control, struct thread *td)
958 {
959 	ng_btsocket_rfcomm_pcb_t	*pcb = so2rfcomm_pcb(so);
960 	int				 error = 0;
961 
962 	/* Check socket and input */
963 	if (pcb == NULL || m == NULL || control != NULL) {
964 		error = EINVAL;
965 		goto drop;
966 	}
967 
968 	mtx_lock(&pcb->pcb_mtx);
969 
970 	/* Make sure DLC is connected */
971 	if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
972 		mtx_unlock(&pcb->pcb_mtx);
973 		error = ENOTCONN;
974 		goto drop;
975 	}
976 
977 	/* Put the packet on the socket's send queue and wakeup RFCOMM task */
978 	sbappend(&pcb->so->so_snd, m, flags);
979 	m = NULL;
980 
981 	if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_SENDING)) {
982 		pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_SENDING;
983 		error = ng_btsocket_rfcomm_task_wakeup();
984 	}
985 
986 	mtx_unlock(&pcb->pcb_mtx);
987 drop:
988 	NG_FREE_M(m); /* checks for != NULL */
989 	NG_FREE_M(control);
990 
991 	return (error);
992 } /* ng_btsocket_rfcomm_send */
993 
994 /*
995  * Get socket address
996  */
997 
998 int
999 ng_btsocket_rfcomm_sockaddr(struct socket *so, struct sockaddr **nam)
1000 {
1001 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
1002 	struct sockaddr_rfcomm		sa;
1003 
1004 	if (pcb == NULL)
1005 		return (EINVAL);
1006 
1007 	bcopy(&pcb->src, &sa.rfcomm_bdaddr, sizeof(sa.rfcomm_bdaddr));
1008 	sa.rfcomm_channel = pcb->channel;
1009 	sa.rfcomm_len = sizeof(sa);
1010 	sa.rfcomm_family = AF_BLUETOOTH;
1011 
1012 	*nam = sodupsockaddr((struct sockaddr *) &sa, M_NOWAIT);
1013 
1014 	return ((*nam == NULL)? ENOMEM : 0);
1015 } /* ng_btsocket_rfcomm_sockaddr */
1016 
1017 /*
1018  * Upcall function for L2CAP sockets. Enqueue RFCOMM task.
1019  */
1020 
1021 static int
1022 ng_btsocket_rfcomm_upcall(struct socket *so, void *arg, int waitflag)
1023 {
1024 	int	error;
1025 
1026 	if (so == NULL)
1027 		panic("%s: so == NULL\n", __func__);
1028 
1029 	if ((error = ng_btsocket_rfcomm_task_wakeup()) != 0)
1030 		NG_BTSOCKET_RFCOMM_ALERT(
1031 "%s: Could not enqueue RFCOMM task, error=%d\n", __func__, error);
1032 	return (SU_OK);
1033 } /* ng_btsocket_rfcomm_upcall */
1034 
1035 /*
1036  * RFCOMM task. Will handle all RFCOMM sessions in one pass.
1037  * XXX FIXME does not scale very well
1038  */
1039 
1040 static void
1041 ng_btsocket_rfcomm_sessions_task(void *ctx, int pending)
1042 {
1043 	ng_btsocket_rfcomm_session_p	s = NULL, s_next = NULL;
1044 
1045 	mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
1046 
1047 	for (s = LIST_FIRST(&ng_btsocket_rfcomm_sessions); s != NULL; ) {
1048 		mtx_lock(&s->session_mtx);
1049 		s_next = LIST_NEXT(s, next);
1050 
1051 		ng_btsocket_rfcomm_session_task(s);
1052 
1053 		if (s->state == NG_BTSOCKET_RFCOMM_SESSION_CLOSED) {
1054 			/* Unlink and clean the session */
1055 			LIST_REMOVE(s, next);
1056 
1057 			NG_BT_MBUFQ_DRAIN(&s->outq);
1058 			if (!LIST_EMPTY(&s->dlcs))
1059 				panic("%s: DLC list is not empty\n", __func__);
1060 
1061 			/* Close L2CAP socket */
1062 			SOCKBUF_LOCK(&s->l2so->so_rcv);
1063 			soupcall_clear(s->l2so, SO_RCV);
1064 			SOCKBUF_UNLOCK(&s->l2so->so_rcv);
1065 			SOCKBUF_LOCK(&s->l2so->so_snd);
1066 			soupcall_clear(s->l2so, SO_SND);
1067 			SOCKBUF_UNLOCK(&s->l2so->so_snd);
1068 			soclose(s->l2so);
1069 
1070 			mtx_unlock(&s->session_mtx);
1071 
1072 			mtx_destroy(&s->session_mtx);
1073 			bzero(s, sizeof(*s));
1074 			free(s, M_NETGRAPH_BTSOCKET_RFCOMM);
1075 		} else
1076 			mtx_unlock(&s->session_mtx);
1077 
1078 		s = s_next;
1079 	}
1080 
1081 	mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
1082 } /* ng_btsocket_rfcomm_sessions_task */
1083 
1084 /*
1085  * Process RFCOMM session. Will handle all RFCOMM sockets in one pass.
1086  */
1087 
1088 static void
1089 ng_btsocket_rfcomm_session_task(ng_btsocket_rfcomm_session_p s)
1090 {
1091 	mtx_assert(&s->session_mtx, MA_OWNED);
1092 
1093 	if (s->l2so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1094 		NG_BTSOCKET_RFCOMM_INFO(
1095 "%s: L2CAP connection has been terminated, so=%p, so_state=%#x, so_count=%d, " \
1096 "state=%d, flags=%#x\n", __func__, s->l2so, s->l2so->so_state,
1097 			s->l2so->so_count, s->state, s->flags);
1098 
1099 		s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1100 		ng_btsocket_rfcomm_session_clean(s);
1101 	}
1102 
1103 	/* Now process upcall */
1104 	switch (s->state) {
1105 	/* Try to accept new L2CAP connection(s) */
1106 	case NG_BTSOCKET_RFCOMM_SESSION_LISTENING:
1107 		while (ng_btsocket_rfcomm_session_accept(s) == 0)
1108 			;
1109 		break;
1110 
1111 	/* Process the results of the L2CAP connect */
1112 	case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
1113 		ng_btsocket_rfcomm_session_process_pcb(s);
1114 
1115 		if (ng_btsocket_rfcomm_session_connect(s) != 0) {
1116 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1117 			ng_btsocket_rfcomm_session_clean(s);
1118 		}
1119 		break;
1120 
1121 	/* Try to receive/send more data */
1122 	case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
1123 	case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
1124 	case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
1125 		ng_btsocket_rfcomm_session_process_pcb(s);
1126 
1127 		if (ng_btsocket_rfcomm_session_receive(s) != 0) {
1128 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1129 			ng_btsocket_rfcomm_session_clean(s);
1130 		} else if (ng_btsocket_rfcomm_session_send(s) != 0) {
1131 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1132 			ng_btsocket_rfcomm_session_clean(s);
1133 		}
1134 		break;
1135 
1136 	case NG_BTSOCKET_RFCOMM_SESSION_CLOSED:
1137 		break;
1138 
1139 	default:
1140 		panic("%s: Invalid session state=%d, flags=%#x\n",
1141 			__func__, s->state, s->flags);
1142 		break;
1143 	}
1144 } /* ng_btsocket_rfcomm_session_task */
1145 
1146 /*
1147  * Process RFCOMM connection indicator. Caller must hold s->session_mtx
1148  */
1149 
1150 static ng_btsocket_rfcomm_pcb_p
1151 ng_btsocket_rfcomm_connect_ind(ng_btsocket_rfcomm_session_p s, int channel)
1152 {
1153 	ng_btsocket_rfcomm_pcb_p	 pcb = NULL, pcb1 = NULL;
1154 	ng_btsocket_l2cap_pcb_p		 l2pcb = NULL;
1155 	struct socket			*so1;
1156 
1157 	mtx_assert(&s->session_mtx, MA_OWNED);
1158 
1159 	/*
1160 	 * Try to find RFCOMM socket that listens on given source address
1161 	 * and channel. This will return the best possible match.
1162 	 */
1163 
1164 	l2pcb = so2l2cap_pcb(s->l2so);
1165 	pcb = ng_btsocket_rfcomm_pcb_listener(&l2pcb->src, channel);
1166 	if (pcb == NULL)
1167 		return (NULL);
1168 
1169 	/*
1170 	 * Check the pending connections queue and if we have space then
1171 	 * create new socket and set proper source and destination address,
1172 	 * and channel.
1173 	 */
1174 
1175 	mtx_lock(&pcb->pcb_mtx);
1176 
1177 	CURVNET_SET(pcb->so->so_vnet);
1178 	so1 = sonewconn(pcb->so, 0);
1179 	CURVNET_RESTORE();
1180 
1181 	mtx_unlock(&pcb->pcb_mtx);
1182 
1183 	if (so1 == NULL)
1184 		return (NULL);
1185 
1186 	/*
1187 	 * If we got here than we have created new socket. So complete the
1188 	 * connection. Set source and destination address from the session.
1189 	 */
1190 
1191 	pcb1 = so2rfcomm_pcb(so1);
1192 	if (pcb1 == NULL)
1193 		panic("%s: pcb1 == NULL\n", __func__);
1194 
1195 	mtx_lock(&pcb1->pcb_mtx);
1196 
1197 	bcopy(&l2pcb->src, &pcb1->src, sizeof(pcb1->src));
1198 	bcopy(&l2pcb->dst, &pcb1->dst, sizeof(pcb1->dst));
1199 	pcb1->channel = channel;
1200 
1201 	/* Link new DLC to the session. We already hold s->session_mtx */
1202 	LIST_INSERT_HEAD(&s->dlcs, pcb1, session_next);
1203 	pcb1->session = s;
1204 
1205 	mtx_unlock(&pcb1->pcb_mtx);
1206 
1207 	return (pcb1);
1208 } /* ng_btsocket_rfcomm_connect_ind */
1209 
1210 /*
1211  * Process RFCOMM connect confirmation. Caller must hold s->session_mtx.
1212  */
1213 
1214 static void
1215 ng_btsocket_rfcomm_connect_cfm(ng_btsocket_rfcomm_session_p s)
1216 {
1217 	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
1218 	int				error;
1219 
1220 	mtx_assert(&s->session_mtx, MA_OWNED);
1221 
1222 	/*
1223 	 * Wake up all waiting sockets and send PN request for each of them.
1224 	 * Note that timeout already been set in ng_btsocket_rfcomm_connect()
1225 	 *
1226 	 * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1227 	 * will unlink DLC from the session
1228 	 */
1229 
1230 	for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1231 		mtx_lock(&pcb->pcb_mtx);
1232 		pcb_next = LIST_NEXT(pcb, session_next);
1233 
1234 		if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT) {
1235 			pcb->mtu = s->mtu;
1236 			bcopy(&so2l2cap_pcb(s->l2so)->src, &pcb->src,
1237 				sizeof(pcb->src));
1238 
1239 			error = ng_btsocket_rfcomm_send_pn(pcb);
1240 			if (error == 0)
1241 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONFIGURING;
1242 			else
1243 				ng_btsocket_rfcomm_pcb_kill(pcb, error);
1244 		}
1245 
1246 		mtx_unlock(&pcb->pcb_mtx);
1247 		pcb = pcb_next;
1248 	}
1249 } /* ng_btsocket_rfcomm_connect_cfm */
1250 
1251 /*****************************************************************************
1252  *****************************************************************************
1253  **                              RFCOMM sessions
1254  *****************************************************************************
1255  *****************************************************************************/
1256 
1257 /*
1258  * Create new RFCOMM session. That function WILL NOT take ownership over l2so.
1259  * Caller MUST free l2so if function failed.
1260  */
1261 
1262 static int
1263 ng_btsocket_rfcomm_session_create(ng_btsocket_rfcomm_session_p *sp,
1264 		struct socket *l2so, bdaddr_p src, bdaddr_p dst,
1265 		struct thread *td)
1266 {
1267 	ng_btsocket_rfcomm_session_p	s = NULL;
1268 	struct sockaddr_l2cap		l2sa;
1269 	struct sockopt			l2sopt;
1270 	int				error;
1271 	u_int16_t			mtu;
1272 
1273 	mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1274 
1275 	/* Allocate the RFCOMM session */
1276         s = malloc(sizeof(*s),
1277 		M_NETGRAPH_BTSOCKET_RFCOMM, M_NOWAIT | M_ZERO);
1278         if (s == NULL)
1279                 return (ENOMEM);
1280 
1281 	/* Set defaults */
1282 	s->mtu = RFCOMM_DEFAULT_MTU;
1283 	s->flags = 0;
1284 	s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1285 	NG_BT_MBUFQ_INIT(&s->outq, ifqmaxlen);
1286 
1287 	/*
1288 	 * XXX Mark session mutex as DUPOK to prevent "duplicated lock of
1289 	 * the same type" message. When accepting new L2CAP connection
1290 	 * ng_btsocket_rfcomm_session_accept() holds both session mutexes
1291 	 * for "old" (accepting) session and "new" (created) session.
1292 	 */
1293 
1294 	mtx_init(&s->session_mtx, "btsocks_rfcomm_session_mtx", NULL,
1295 		MTX_DEF|MTX_DUPOK);
1296 
1297 	LIST_INIT(&s->dlcs);
1298 
1299 	/* Prepare L2CAP socket */
1300 	SOCKBUF_LOCK(&l2so->so_rcv);
1301 	soupcall_set(l2so, SO_RCV, ng_btsocket_rfcomm_upcall, NULL);
1302 	SOCKBUF_UNLOCK(&l2so->so_rcv);
1303 	SOCKBUF_LOCK(&l2so->so_snd);
1304 	soupcall_set(l2so, SO_SND, ng_btsocket_rfcomm_upcall, NULL);
1305 	SOCKBUF_UNLOCK(&l2so->so_snd);
1306 	l2so->so_state |= SS_NBIO;
1307 	s->l2so = l2so;
1308 
1309 	mtx_lock(&s->session_mtx);
1310 
1311 	/*
1312 	 * "src" == NULL and "dst" == NULL means just create session.
1313 	 * caller must do the rest
1314 	 */
1315 
1316 	if (src == NULL && dst == NULL)
1317 		goto done;
1318 
1319 	/*
1320 	 * Set incoming MTU on L2CAP socket. It is RFCOMM session default MTU
1321 	 * plus 5 bytes: RFCOMM frame header, one extra byte for length and one
1322 	 * extra byte for credits.
1323 	 */
1324 
1325 	mtu = s->mtu + sizeof(struct rfcomm_frame_hdr) + 1 + 1;
1326 
1327 	l2sopt.sopt_dir = SOPT_SET;
1328 	l2sopt.sopt_level = SOL_L2CAP;
1329 	l2sopt.sopt_name = SO_L2CAP_IMTU;
1330 	l2sopt.sopt_val = (void *) &mtu;
1331 	l2sopt.sopt_valsize = sizeof(mtu);
1332 	l2sopt.sopt_td = NULL;
1333 
1334 	error = sosetopt(s->l2so, &l2sopt);
1335 	if (error != 0)
1336 		goto bad;
1337 
1338 	/* Bind socket to "src" address */
1339 	l2sa.l2cap_len = sizeof(l2sa);
1340 	l2sa.l2cap_family = AF_BLUETOOTH;
1341 	l2sa.l2cap_psm = (dst == NULL)? htole16(NG_L2CAP_PSM_RFCOMM) : 0;
1342 	bcopy(src, &l2sa.l2cap_bdaddr, sizeof(l2sa.l2cap_bdaddr));
1343 	l2sa.l2cap_cid = 0;
1344 	l2sa.l2cap_bdaddr_type = BDADDR_BREDR;
1345 
1346 	error = sobind(s->l2so, (struct sockaddr *) &l2sa, td);
1347 	if (error != 0)
1348 		goto bad;
1349 
1350 	/* If "dst" is not NULL then initiate connect(), otherwise listen() */
1351 	if (dst == NULL) {
1352 		s->flags = 0;
1353 		s->state = NG_BTSOCKET_RFCOMM_SESSION_LISTENING;
1354 
1355 		error = solisten(s->l2so, 10, td);
1356 		if (error != 0)
1357 			goto bad;
1358 	} else {
1359 		s->flags = NG_BTSOCKET_RFCOMM_SESSION_INITIATOR;
1360 		s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTING;
1361 
1362 		l2sa.l2cap_len = sizeof(l2sa);
1363 		l2sa.l2cap_family = AF_BLUETOOTH;
1364 		l2sa.l2cap_psm = htole16(NG_L2CAP_PSM_RFCOMM);
1365 	        bcopy(dst, &l2sa.l2cap_bdaddr, sizeof(l2sa.l2cap_bdaddr));
1366 		l2sa.l2cap_cid = 0;
1367 		l2sa.l2cap_bdaddr_type = BDADDR_BREDR;
1368 
1369 		error = soconnect(s->l2so, (struct sockaddr *) &l2sa, td);
1370 		if (error != 0)
1371 			goto bad;
1372 	}
1373 
1374 done:
1375 	LIST_INSERT_HEAD(&ng_btsocket_rfcomm_sessions, s, next);
1376 	*sp = s;
1377 
1378 	mtx_unlock(&s->session_mtx);
1379 
1380 	return (0);
1381 
1382 bad:
1383 	mtx_unlock(&s->session_mtx);
1384 
1385 	/* Return L2CAP socket back to its original state */
1386 	SOCKBUF_LOCK(&l2so->so_rcv);
1387 	soupcall_clear(s->l2so, SO_RCV);
1388 	SOCKBUF_UNLOCK(&l2so->so_rcv);
1389 	SOCKBUF_LOCK(&l2so->so_snd);
1390 	soupcall_clear(s->l2so, SO_SND);
1391 	SOCKBUF_UNLOCK(&l2so->so_snd);
1392 	l2so->so_state &= ~SS_NBIO;
1393 
1394 	mtx_destroy(&s->session_mtx);
1395 	bzero(s, sizeof(*s));
1396 	free(s, M_NETGRAPH_BTSOCKET_RFCOMM);
1397 
1398 	return (error);
1399 } /* ng_btsocket_rfcomm_session_create */
1400 
1401 /*
1402  * Process accept() on RFCOMM session
1403  * XXX FIXME locking for "l2so"?
1404  */
1405 
1406 static int
1407 ng_btsocket_rfcomm_session_accept(ng_btsocket_rfcomm_session_p s0)
1408 {
1409 	struct socket			*l2so;
1410 	struct sockaddr_l2cap		*l2sa = NULL;
1411 	ng_btsocket_l2cap_pcb_t		*l2pcb = NULL;
1412 	ng_btsocket_rfcomm_session_p	 s = NULL;
1413 	int				 error;
1414 
1415 	mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1416 	mtx_assert(&s0->session_mtx, MA_OWNED);
1417 
1418 	SOLISTEN_LOCK(s0->l2so);
1419 	error = solisten_dequeue(s0->l2so, &l2so, 0);
1420 	if (error == EWOULDBLOCK)
1421 		return (error);
1422 	if (error) {
1423 		NG_BTSOCKET_RFCOMM_ERR(
1424 "%s: Could not accept connection on L2CAP socket, error=%d\n", __func__, error);
1425 		return (error);
1426 	}
1427 
1428 	error = soaccept(l2so, (struct sockaddr **) &l2sa);
1429 	if (error != 0) {
1430 		NG_BTSOCKET_RFCOMM_ERR(
1431 "%s: soaccept() on L2CAP socket failed, error=%d\n", __func__, error);
1432 		soclose(l2so);
1433 
1434 		return (error);
1435 	}
1436 
1437 	/*
1438 	 * Check if there is already active RFCOMM session between two devices.
1439 	 * If so then close L2CAP connection. We only support one RFCOMM session
1440 	 * between each pair of devices. Note that here we assume session in any
1441 	 * state. The session even could be in the middle of disconnecting.
1442 	 */
1443 
1444 	l2pcb = so2l2cap_pcb(l2so);
1445 	s = ng_btsocket_rfcomm_session_by_addr(&l2pcb->src, &l2pcb->dst);
1446 	if (s == NULL) {
1447 		/* Create a new RFCOMM session */
1448 		error = ng_btsocket_rfcomm_session_create(&s, l2so, NULL, NULL,
1449 				curthread /* XXX */);
1450 		if (error == 0) {
1451 			mtx_lock(&s->session_mtx);
1452 
1453 			s->flags = 0;
1454 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTED;
1455 
1456 			/*
1457 			 * Adjust MTU on incoming connection. Reserve 5 bytes:
1458 			 * RFCOMM frame header, one extra byte for length and
1459 			 * one extra byte for credits.
1460 			 */
1461 
1462 			s->mtu = min(l2pcb->imtu, l2pcb->omtu) -
1463 					sizeof(struct rfcomm_frame_hdr) - 1 - 1;
1464 
1465 			mtx_unlock(&s->session_mtx);
1466 		} else {
1467 			NG_BTSOCKET_RFCOMM_ALERT(
1468 "%s: Failed to create new RFCOMM session, error=%d\n", __func__, error);
1469 
1470 			soclose(l2so);
1471 		}
1472 	} else {
1473 		NG_BTSOCKET_RFCOMM_WARN(
1474 "%s: Rejecting duplicating RFCOMM session between src=%x:%x:%x:%x:%x:%x and " \
1475 "dst=%x:%x:%x:%x:%x:%x, state=%d, flags=%#x\n",	__func__,
1476 			l2pcb->src.b[5], l2pcb->src.b[4], l2pcb->src.b[3],
1477 			l2pcb->src.b[2], l2pcb->src.b[1], l2pcb->src.b[0],
1478 			l2pcb->dst.b[5], l2pcb->dst.b[4], l2pcb->dst.b[3],
1479 			l2pcb->dst.b[2], l2pcb->dst.b[1], l2pcb->dst.b[0],
1480 			s->state, s->flags);
1481 
1482 		error = EBUSY;
1483 		soclose(l2so);
1484 	}
1485 
1486 	return (error);
1487 } /* ng_btsocket_rfcomm_session_accept */
1488 
1489 /*
1490  * Process connect() on RFCOMM session
1491  * XXX FIXME locking for "l2so"?
1492  */
1493 
1494 static int
1495 ng_btsocket_rfcomm_session_connect(ng_btsocket_rfcomm_session_p s)
1496 {
1497 	ng_btsocket_l2cap_pcb_p	l2pcb = so2l2cap_pcb(s->l2so);
1498 	int			error;
1499 
1500 	mtx_assert(&s->session_mtx, MA_OWNED);
1501 
1502 	/* First check if connection has failed */
1503 	if ((error = s->l2so->so_error) != 0) {
1504 		s->l2so->so_error = 0;
1505 
1506 		NG_BTSOCKET_RFCOMM_ERR(
1507 "%s: Could not connect RFCOMM session, error=%d, state=%d, flags=%#x\n",
1508 			__func__, error, s->state, s->flags);
1509 
1510 		return (error);
1511 	}
1512 
1513 	/* Is connection still in progress? */
1514 	if (s->l2so->so_state & SS_ISCONNECTING)
1515 		return (0);
1516 
1517 	/*
1518 	 * If we got here then we are connected. Send SABM on DLCI 0 to
1519 	 * open multiplexor channel.
1520 	 */
1521 
1522 	if (error == 0) {
1523 		s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTED;
1524 
1525 		/*
1526 		 * Adjust MTU on outgoing connection. Reserve 5 bytes: RFCOMM
1527 		 * frame header, one extra byte for length and one extra byte
1528 		 * for credits.
1529 		 */
1530 
1531 		s->mtu = min(l2pcb->imtu, l2pcb->omtu) -
1532 				sizeof(struct rfcomm_frame_hdr) - 1 - 1;
1533 
1534 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_SABM,0);
1535 		if (error == 0)
1536 			error = ng_btsocket_rfcomm_task_wakeup();
1537 	}
1538 
1539 	return (error);
1540 }/* ng_btsocket_rfcomm_session_connect */
1541 
1542 /*
1543  * Receive data on RFCOMM session
1544  * XXX FIXME locking for "l2so"?
1545  */
1546 
1547 static int
1548 ng_btsocket_rfcomm_session_receive(ng_btsocket_rfcomm_session_p s)
1549 {
1550 	struct mbuf	*m = NULL;
1551 	struct uio	 uio;
1552 	int		 more, flags, error;
1553 
1554 	mtx_assert(&s->session_mtx, MA_OWNED);
1555 
1556 	/* Can we read from the L2CAP socket? */
1557 	if (!soreadable(s->l2so))
1558 		return (0);
1559 
1560 	/* First check for error on L2CAP socket */
1561 	if ((error = s->l2so->so_error) != 0) {
1562 		s->l2so->so_error = 0;
1563 
1564 		NG_BTSOCKET_RFCOMM_ERR(
1565 "%s: Could not receive data from L2CAP socket, error=%d, state=%d, flags=%#x\n",
1566 			__func__, error, s->state, s->flags);
1567 
1568 		return (error);
1569 	}
1570 
1571 	/*
1572 	 * Read all packets from the L2CAP socket.
1573 	 * XXX FIXME/VERIFY is that correct? For now use m->m_nextpkt as
1574 	 * indication that there is more packets on the socket's buffer.
1575 	 * Also what should we use in uio.uio_resid?
1576 	 * May be s->mtu + sizeof(struct rfcomm_frame_hdr) + 1 + 1?
1577 	 */
1578 
1579 	for (more = 1; more; ) {
1580 		/* Try to get next packet from socket */
1581 		bzero(&uio, sizeof(uio));
1582 /*		uio.uio_td = NULL; */
1583 		uio.uio_resid = 1000000000;
1584 		flags = MSG_DONTWAIT;
1585 
1586 		m = NULL;
1587 		error = soreceive(s->l2so, NULL, &uio, &m,
1588 		    (struct mbuf **) NULL, &flags);
1589 		if (error != 0) {
1590 			if (error == EWOULDBLOCK)
1591 				return (0); /* XXX can happen? */
1592 
1593 			NG_BTSOCKET_RFCOMM_ERR(
1594 "%s: Could not receive data from L2CAP socket, error=%d\n", __func__, error);
1595 
1596 			return (error);
1597 		}
1598 
1599 		more = (m->m_nextpkt != NULL);
1600 		m->m_nextpkt = NULL;
1601 
1602 		ng_btsocket_rfcomm_receive_frame(s, m);
1603 	}
1604 
1605 	return (0);
1606 } /* ng_btsocket_rfcomm_session_receive */
1607 
1608 /*
1609  * Send data on RFCOMM session
1610  * XXX FIXME locking for "l2so"?
1611  */
1612 
1613 static int
1614 ng_btsocket_rfcomm_session_send(ng_btsocket_rfcomm_session_p s)
1615 {
1616 	struct mbuf	*m = NULL;
1617 	int		 error;
1618 
1619 	mtx_assert(&s->session_mtx, MA_OWNED);
1620 
1621 	/* Send as much as we can from the session queue */
1622 	while (sowriteable(s->l2so)) {
1623 		/* Check if socket still OK */
1624 		if ((error = s->l2so->so_error) != 0) {
1625 			s->l2so->so_error = 0;
1626 
1627 			NG_BTSOCKET_RFCOMM_ERR(
1628 "%s: Detected error=%d on L2CAP socket, state=%d, flags=%#x\n",
1629 				__func__, error, s->state, s->flags);
1630 
1631 			return (error);
1632 		}
1633 
1634 		NG_BT_MBUFQ_DEQUEUE(&s->outq, m);
1635 		if (m == NULL)
1636 			return (0); /* we are done */
1637 
1638 		/* Call send function on the L2CAP socket */
1639 		error = (*s->l2so->so_proto->pr_usrreqs->pru_send)(s->l2so,
1640 				0, m, NULL, NULL, curthread /* XXX */);
1641 		if (error != 0) {
1642 			NG_BTSOCKET_RFCOMM_ERR(
1643 "%s: Could not send data to L2CAP socket, error=%d\n", __func__, error);
1644 
1645 			return (error);
1646 		}
1647 	}
1648 
1649 	return (0);
1650 } /* ng_btsocket_rfcomm_session_send */
1651 
1652 /*
1653  * Close and disconnect all DLCs for the given session. Caller must hold
1654  * s->sesson_mtx. Will wakeup session.
1655  */
1656 
1657 static void
1658 ng_btsocket_rfcomm_session_clean(ng_btsocket_rfcomm_session_p s)
1659 {
1660 	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
1661 	int				error;
1662 
1663 	mtx_assert(&s->session_mtx, MA_OWNED);
1664 
1665 	/*
1666 	 * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1667 	 * will unlink DLC from the session
1668 	 */
1669 
1670 	for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1671 		mtx_lock(&pcb->pcb_mtx);
1672 		pcb_next = LIST_NEXT(pcb, session_next);
1673 
1674 		NG_BTSOCKET_RFCOMM_INFO(
1675 "%s: Disconnecting dlci=%d, state=%d, flags=%#x\n",
1676 			__func__, pcb->dlci, pcb->state, pcb->flags);
1677 
1678 		if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
1679 			error = ECONNRESET;
1680 		else
1681 			error = ECONNREFUSED;
1682 
1683 		ng_btsocket_rfcomm_pcb_kill(pcb, error);
1684 
1685 		mtx_unlock(&pcb->pcb_mtx);
1686 		pcb = pcb_next;
1687 	}
1688 } /* ng_btsocket_rfcomm_session_clean */
1689 
1690 /*
1691  * Process all DLCs on the session. Caller MUST hold s->session_mtx.
1692  */
1693 
1694 static void
1695 ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
1696 {
1697 	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
1698 	int				error;
1699 
1700 	mtx_assert(&s->session_mtx, MA_OWNED);
1701 
1702 	/*
1703 	 * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1704 	 * will unlink DLC from the session
1705 	 */
1706 
1707 	for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1708 		mtx_lock(&pcb->pcb_mtx);
1709 		pcb_next = LIST_NEXT(pcb, session_next);
1710 
1711 		switch (pcb->state) {
1712 		/*
1713 		 * If DLC in W4_CONNECT state then we should check for both
1714 		 * timeout and detach.
1715 		 */
1716 
1717 		case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
1718 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_DETACHED)
1719 				ng_btsocket_rfcomm_pcb_kill(pcb, 0);
1720 			else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1721 				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1722 			break;
1723 
1724 		/*
1725 		 * If DLC in CONFIGURING or CONNECTING state then we only
1726 		 * should check for timeout. If detach() was called then
1727 		 * DLC will be moved into DISCONNECTING state.
1728 		 */
1729 
1730 		case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
1731 		case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
1732 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1733 				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1734 			break;
1735 
1736 		/*
1737 		 * If DLC in CONNECTED state then we need to send data (if any)
1738 		 * from the socket's send queue. Note that we will send data
1739 		 * from either all sockets or none. This may overload session's
1740 		 * outgoing queue (but we do not check for that).
1741 		 *
1742  		 * XXX FIXME need scheduler for RFCOMM sockets
1743 		 */
1744 
1745 		case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
1746 			error = ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
1747 			if (error != 0)
1748 				ng_btsocket_rfcomm_pcb_kill(pcb, error);
1749 			break;
1750 
1751 		/*
1752 		 * If DLC in DISCONNECTING state then we must send DISC frame.
1753 		 * Note that if DLC has timeout set then we do not need to
1754 		 * resend DISC frame.
1755 		 *
1756 		 * XXX FIXME need to drain all data from the socket's queue
1757 		 * if LINGER option was set
1758 		 */
1759 
1760 		case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
1761 			if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)) {
1762 				error = ng_btsocket_rfcomm_send_command(
1763 						pcb->session, RFCOMM_FRAME_DISC,
1764 						pcb->dlci);
1765 				if (error == 0)
1766 					ng_btsocket_rfcomm_timeout(pcb);
1767 				else
1768 					ng_btsocket_rfcomm_pcb_kill(pcb, error);
1769 			} else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1770 				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1771 			break;
1772 
1773 /*		case NG_BTSOCKET_RFCOMM_DLC_CLOSED: */
1774 		default:
1775 			panic("%s: Invalid DLC state=%d, flags=%#x\n",
1776 				__func__, pcb->state, pcb->flags);
1777 			break;
1778 		}
1779 
1780 		mtx_unlock(&pcb->pcb_mtx);
1781 		pcb = pcb_next;
1782 	}
1783 } /* ng_btsocket_rfcomm_session_process_pcb */
1784 
1785 /*
1786  * Find RFCOMM session between "src" and "dst".
1787  * Caller MUST hold ng_btsocket_rfcomm_sessions_mtx.
1788  */
1789 
1790 static ng_btsocket_rfcomm_session_p
1791 ng_btsocket_rfcomm_session_by_addr(bdaddr_p src, bdaddr_p dst)
1792 {
1793 	ng_btsocket_rfcomm_session_p	s = NULL;
1794 	ng_btsocket_l2cap_pcb_p		l2pcb = NULL;
1795 	int				any_src;
1796 
1797 	mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1798 
1799 	any_src = (bcmp(src, NG_HCI_BDADDR_ANY, sizeof(*src)) == 0);
1800 
1801 	LIST_FOREACH(s, &ng_btsocket_rfcomm_sessions, next) {
1802 		l2pcb = so2l2cap_pcb(s->l2so);
1803 
1804 		if ((any_src || bcmp(&l2pcb->src, src, sizeof(*src)) == 0) &&
1805 		    bcmp(&l2pcb->dst, dst, sizeof(*dst)) == 0)
1806 			break;
1807 	}
1808 
1809 	return (s);
1810 } /* ng_btsocket_rfcomm_session_by_addr */
1811 
1812 /*****************************************************************************
1813  *****************************************************************************
1814  **                                  RFCOMM
1815  *****************************************************************************
1816  *****************************************************************************/
1817 
1818 /*
1819  * Process incoming RFCOMM frame. Caller must hold s->session_mtx.
1820  * XXX FIXME check frame length
1821  */
1822 
1823 static int
1824 ng_btsocket_rfcomm_receive_frame(ng_btsocket_rfcomm_session_p s,
1825 		struct mbuf *m0)
1826 {
1827 	struct rfcomm_frame_hdr	*hdr = NULL;
1828 	struct mbuf		*m = NULL;
1829 	u_int16_t		 length;
1830 	u_int8_t		 dlci, type;
1831 	int			 error = 0;
1832 
1833 	mtx_assert(&s->session_mtx, MA_OWNED);
1834 
1835 	/* Pullup as much as we can into first mbuf (for direct access) */
1836 	length = min(m0->m_pkthdr.len, MHLEN);
1837 	if (m0->m_len < length) {
1838 		if ((m0 = m_pullup(m0, length)) == NULL) {
1839 			NG_BTSOCKET_RFCOMM_ALERT(
1840 "%s: m_pullup(%d) failed\n", __func__, length);
1841 
1842 			return (ENOBUFS);
1843 		}
1844 	}
1845 
1846 	hdr = mtod(m0, struct rfcomm_frame_hdr *);
1847 	dlci = RFCOMM_DLCI(hdr->address);
1848 	type = RFCOMM_TYPE(hdr->control);
1849 
1850 	/* Test EA bit in length. If not set then we have 2 bytes of length */
1851 	if (!RFCOMM_EA(hdr->length)) {
1852 		bcopy(&hdr->length, &length, sizeof(length));
1853 		length = le16toh(length) >> 1;
1854 		m_adj(m0, sizeof(*hdr) + 1);
1855 	} else {
1856 		length = hdr->length >> 1;
1857 		m_adj(m0, sizeof(*hdr));
1858 	}
1859 
1860 	NG_BTSOCKET_RFCOMM_INFO(
1861 "%s: Got frame type=%#x, dlci=%d, length=%d, cr=%d, pf=%d, len=%d\n",
1862 		__func__, type, dlci, length, RFCOMM_CR(hdr->address),
1863 		RFCOMM_PF(hdr->control), m0->m_pkthdr.len);
1864 
1865 	/*
1866 	 * Get FCS (the last byte in the frame)
1867 	 * XXX this will not work if mbuf chain ends with empty mbuf.
1868 	 * XXX let's hope it never happens :)
1869 	 */
1870 
1871 	for (m = m0; m->m_next != NULL; m = m->m_next)
1872 		;
1873 	if (m->m_len <= 0)
1874 		panic("%s: Empty mbuf at the end of the chain, len=%d\n",
1875 			__func__, m->m_len);
1876 
1877 	/*
1878 	 * Check FCS. We only need to calculate FCS on first 2 or 3 bytes
1879 	 * and already m_pullup'ed mbuf chain, so it should be safe.
1880 	 */
1881 
1882 	if (ng_btsocket_rfcomm_check_fcs((u_int8_t *) hdr, type, m->m_data[m->m_len - 1])) {
1883 		NG_BTSOCKET_RFCOMM_ERR(
1884 "%s: Invalid RFCOMM packet. Bad checksum\n", __func__);
1885 		NG_FREE_M(m0);
1886 
1887 		return (EINVAL);
1888 	}
1889 
1890 	m_adj(m0, -1); /* Trim FCS byte */
1891 
1892 	/*
1893 	 * Process RFCOMM frame.
1894 	 *
1895 	 * From TS 07.10 spec
1896 	 *
1897 	 * "... In the case where a SABM or DISC command with the P bit set
1898 	 * to 0 is received then the received frame shall be discarded..."
1899  	 *
1900 	 * "... If a unsolicited DM response is received then the frame shall
1901 	 * be processed irrespective of the P/F setting... "
1902 	 *
1903 	 * "... The station may transmit response frames with the F bit set
1904 	 * to 0 at any opportunity on an asynchronous basis. However, in the
1905 	 * case where a UA response is received with the F bit set to 0 then
1906 	 * the received frame shall be discarded..."
1907 	 *
1908 	 * From Bluetooth spec
1909 	 *
1910 	 * "... When credit based flow control is being used, the meaning of
1911 	 * the P/F bit in the control field of the RFCOMM header is redefined
1912 	 * for UIH frames..."
1913 	 */
1914 
1915 	switch (type) {
1916 	case RFCOMM_FRAME_SABM:
1917 		if (RFCOMM_PF(hdr->control))
1918 			error = ng_btsocket_rfcomm_receive_sabm(s, dlci);
1919 		break;
1920 
1921 	case RFCOMM_FRAME_DISC:
1922 		if (RFCOMM_PF(hdr->control))
1923 			error = ng_btsocket_rfcomm_receive_disc(s, dlci);
1924 		break;
1925 
1926 	case RFCOMM_FRAME_UA:
1927 		if (RFCOMM_PF(hdr->control))
1928 			error = ng_btsocket_rfcomm_receive_ua(s, dlci);
1929 		break;
1930 
1931 	case RFCOMM_FRAME_DM:
1932 		error = ng_btsocket_rfcomm_receive_dm(s, dlci);
1933 		break;
1934 
1935 	case RFCOMM_FRAME_UIH:
1936 		if (dlci == 0)
1937 			error = ng_btsocket_rfcomm_receive_mcc(s, m0);
1938 		else
1939 			error = ng_btsocket_rfcomm_receive_uih(s, dlci,
1940 					RFCOMM_PF(hdr->control), m0);
1941 
1942 		return (error);
1943 		/* NOT REACHED */
1944 
1945 	default:
1946 		NG_BTSOCKET_RFCOMM_ERR(
1947 "%s: Invalid RFCOMM packet. Unknown type=%#x\n", __func__, type);
1948 		error = EINVAL;
1949 		break;
1950 	}
1951 
1952 	NG_FREE_M(m0);
1953 
1954 	return (error);
1955 } /* ng_btsocket_rfcomm_receive_frame */
1956 
1957 /*
1958  * Process RFCOMM SABM frame
1959  */
1960 
1961 static int
1962 ng_btsocket_rfcomm_receive_sabm(ng_btsocket_rfcomm_session_p s, int dlci)
1963 {
1964 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
1965 	int				error = 0;
1966 
1967 	mtx_assert(&s->session_mtx, MA_OWNED);
1968 
1969 	NG_BTSOCKET_RFCOMM_INFO(
1970 "%s: Got SABM, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
1971 		__func__, s->state, s->flags, s->mtu, dlci);
1972 
1973 	/* DLCI == 0 means open multiplexor channel */
1974 	if (dlci == 0) {
1975 		switch (s->state) {
1976 		case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
1977 		case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
1978 			error = ng_btsocket_rfcomm_send_command(s,
1979 					RFCOMM_FRAME_UA, dlci);
1980 			if (error == 0) {
1981 				s->state = NG_BTSOCKET_RFCOMM_SESSION_OPEN;
1982 				ng_btsocket_rfcomm_connect_cfm(s);
1983 			} else {
1984 				s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1985 				ng_btsocket_rfcomm_session_clean(s);
1986 			}
1987 			break;
1988 
1989 		default:
1990 			NG_BTSOCKET_RFCOMM_WARN(
1991 "%s: Got SABM for session in invalid state state=%d, flags=%#x\n",
1992 				__func__, s->state, s->flags);
1993 			error = EINVAL;
1994 			break;
1995 		}
1996 
1997 		return (error);
1998 	}
1999 
2000 	/* Make sure multiplexor channel is open */
2001 	if (s->state != NG_BTSOCKET_RFCOMM_SESSION_OPEN) {
2002 		NG_BTSOCKET_RFCOMM_ERR(
2003 "%s: Got SABM for dlci=%d with mulitplexor channel closed, state=%d, " \
2004 "flags=%#x\n",		__func__, dlci, s->state, s->flags);
2005 
2006 		return (EINVAL);
2007 	}
2008 
2009 	/*
2010 	 * Check if we have this DLCI. This might happen when remote
2011 	 * peer uses PN command before actual open (SABM) happens.
2012 	 */
2013 
2014 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2015 	if (pcb != NULL) {
2016 		mtx_lock(&pcb->pcb_mtx);
2017 
2018 		if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTING) {
2019 			NG_BTSOCKET_RFCOMM_ERR(
2020 "%s: Got SABM for dlci=%d in invalid state=%d, flags=%#x\n",
2021 				__func__, dlci, pcb->state, pcb->flags);
2022 			mtx_unlock(&pcb->pcb_mtx);
2023 
2024 			return (ENOENT);
2025 		}
2026 
2027 		ng_btsocket_rfcomm_untimeout(pcb);
2028 
2029 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_UA,dlci);
2030 		if (error == 0)
2031 			error = ng_btsocket_rfcomm_send_msc(pcb);
2032 
2033 		if (error == 0) {
2034 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2035 			soisconnected(pcb->so);
2036 		} else
2037 			ng_btsocket_rfcomm_pcb_kill(pcb, error);
2038 
2039 		mtx_unlock(&pcb->pcb_mtx);
2040 
2041 		return (error);
2042 	}
2043 
2044 	/*
2045 	 * We do not have requested DLCI, so it must be an incoming connection
2046 	 * with default parameters. Try to accept it.
2047 	 */
2048 
2049 	pcb = ng_btsocket_rfcomm_connect_ind(s, RFCOMM_SRVCHANNEL(dlci));
2050 	if (pcb != NULL) {
2051 		mtx_lock(&pcb->pcb_mtx);
2052 
2053 		pcb->dlci = dlci;
2054 
2055 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_UA,dlci);
2056 		if (error == 0)
2057 			error = ng_btsocket_rfcomm_send_msc(pcb);
2058 
2059 		if (error == 0) {
2060 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2061 			soisconnected(pcb->so);
2062 		} else
2063 			ng_btsocket_rfcomm_pcb_kill(pcb, error);
2064 
2065 		mtx_unlock(&pcb->pcb_mtx);
2066 	} else
2067 		/* Nobody is listen()ing on the requested DLCI */
2068 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2069 
2070 	return (error);
2071 } /* ng_btsocket_rfcomm_receive_sabm */
2072 
2073 /*
2074  * Process RFCOMM DISC frame
2075  */
2076 
2077 static int
2078 ng_btsocket_rfcomm_receive_disc(ng_btsocket_rfcomm_session_p s, int dlci)
2079 {
2080 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
2081 	int				error = 0;
2082 
2083 	mtx_assert(&s->session_mtx, MA_OWNED);
2084 
2085 	NG_BTSOCKET_RFCOMM_INFO(
2086 "%s: Got DISC, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2087 		__func__, s->state, s->flags, s->mtu, dlci);
2088 
2089 	/* DLCI == 0 means close multiplexor channel */
2090 	if (dlci == 0) {
2091 		/* XXX FIXME assume that remote side will close the socket */
2092 		error = ng_btsocket_rfcomm_send_command(s, RFCOMM_FRAME_UA, 0);
2093 		if (error == 0) {
2094 			if (s->state == NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING)
2095 				s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED; /* XXX */
2096 			else
2097 				s->state = NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING;
2098 		} else
2099 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED; /* XXX */
2100 
2101 		ng_btsocket_rfcomm_session_clean(s);
2102 	} else {
2103 		pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2104 		if (pcb != NULL) {
2105 			int	err;
2106 
2107 			mtx_lock(&pcb->pcb_mtx);
2108 
2109 			NG_BTSOCKET_RFCOMM_INFO(
2110 "%s: Got DISC for dlci=%d, state=%d, flags=%#x\n",
2111 				__func__, dlci, pcb->state, pcb->flags);
2112 
2113 			error = ng_btsocket_rfcomm_send_command(s,
2114 					RFCOMM_FRAME_UA, dlci);
2115 
2116 			if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
2117 				err = 0;
2118 			else
2119 				err = ECONNREFUSED;
2120 
2121 			ng_btsocket_rfcomm_pcb_kill(pcb, err);
2122 
2123 			mtx_unlock(&pcb->pcb_mtx);
2124 		} else {
2125 			NG_BTSOCKET_RFCOMM_WARN(
2126 "%s: Got DISC for non-existing dlci=%d\n", __func__, dlci);
2127 
2128 			error = ng_btsocket_rfcomm_send_command(s,
2129 					RFCOMM_FRAME_DM, dlci);
2130 		}
2131 	}
2132 
2133 	return (error);
2134 } /* ng_btsocket_rfcomm_receive_disc */
2135 
2136 /*
2137  * Process RFCOMM UA frame
2138  */
2139 
2140 static int
2141 ng_btsocket_rfcomm_receive_ua(ng_btsocket_rfcomm_session_p s, int dlci)
2142 {
2143 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
2144 	int				error = 0;
2145 
2146 	mtx_assert(&s->session_mtx, MA_OWNED);
2147 
2148 	NG_BTSOCKET_RFCOMM_INFO(
2149 "%s: Got UA, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2150 		__func__, s->state, s->flags, s->mtu, dlci);
2151 
2152 	/* dlci == 0 means multiplexor channel */
2153 	if (dlci == 0) {
2154 		switch (s->state) {
2155 		case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
2156 			s->state = NG_BTSOCKET_RFCOMM_SESSION_OPEN;
2157 			ng_btsocket_rfcomm_connect_cfm(s);
2158 			break;
2159 
2160 		case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
2161 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
2162 			ng_btsocket_rfcomm_session_clean(s);
2163 			break;
2164 
2165 		default:
2166 			NG_BTSOCKET_RFCOMM_WARN(
2167 "%s: Got UA for session in invalid state=%d(%d), flags=%#x, mtu=%d\n",
2168 				__func__, s->state, INITIATOR(s), s->flags,
2169 				s->mtu);
2170 			error = ENOENT;
2171 			break;
2172 		}
2173 
2174 		return (error);
2175 	}
2176 
2177 	/* Check if we have this DLCI */
2178 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2179 	if (pcb != NULL) {
2180 		mtx_lock(&pcb->pcb_mtx);
2181 
2182 		NG_BTSOCKET_RFCOMM_INFO(
2183 "%s: Got UA for dlci=%d, state=%d, flags=%#x\n",
2184 			__func__, dlci, pcb->state, pcb->flags);
2185 
2186 		switch (pcb->state) {
2187 		case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
2188 			ng_btsocket_rfcomm_untimeout(pcb);
2189 
2190 			error = ng_btsocket_rfcomm_send_msc(pcb);
2191 			if (error == 0) {
2192 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2193 				soisconnected(pcb->so);
2194 			}
2195 			break;
2196 
2197 		case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
2198 			ng_btsocket_rfcomm_pcb_kill(pcb, 0);
2199 			break;
2200 
2201 		default:
2202 			NG_BTSOCKET_RFCOMM_WARN(
2203 "%s: Got UA for dlci=%d in invalid state=%d, flags=%#x\n",
2204 				__func__, dlci, pcb->state, pcb->flags);
2205 			error = ENOENT;
2206 			break;
2207 		}
2208 
2209 		mtx_unlock(&pcb->pcb_mtx);
2210 	} else {
2211 		NG_BTSOCKET_RFCOMM_WARN(
2212 "%s: Got UA for non-existing dlci=%d\n", __func__, dlci);
2213 
2214 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2215 	}
2216 
2217 	return (error);
2218 } /* ng_btsocket_rfcomm_receive_ua */
2219 
2220 /*
2221  * Process RFCOMM DM frame
2222  */
2223 
2224 static int
2225 ng_btsocket_rfcomm_receive_dm(ng_btsocket_rfcomm_session_p s, int dlci)
2226 {
2227 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
2228 	int				error;
2229 
2230 	mtx_assert(&s->session_mtx, MA_OWNED);
2231 
2232 	NG_BTSOCKET_RFCOMM_INFO(
2233 "%s: Got DM, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2234 		__func__, s->state, s->flags, s->mtu, dlci);
2235 
2236 	/* DLCI == 0 means multiplexor channel */
2237 	if (dlci == 0) {
2238 		/* Disconnect all dlc's on the session */
2239 		s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
2240 		ng_btsocket_rfcomm_session_clean(s);
2241 	} else {
2242 		pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2243 		if (pcb != NULL) {
2244 			mtx_lock(&pcb->pcb_mtx);
2245 
2246 			NG_BTSOCKET_RFCOMM_INFO(
2247 "%s: Got DM for dlci=%d, state=%d, flags=%#x\n",
2248 				__func__, dlci, pcb->state, pcb->flags);
2249 
2250 			if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
2251 				error = ECONNRESET;
2252 			else
2253 				error = ECONNREFUSED;
2254 
2255 			ng_btsocket_rfcomm_pcb_kill(pcb, error);
2256 
2257 			mtx_unlock(&pcb->pcb_mtx);
2258 		} else
2259 			NG_BTSOCKET_RFCOMM_WARN(
2260 "%s: Got DM for non-existing dlci=%d\n", __func__, dlci);
2261 	}
2262 
2263 	return (0);
2264 } /* ng_btsocket_rfcomm_receive_dm */
2265 
2266 /*
2267  * Process RFCOMM UIH frame (data)
2268  */
2269 
2270 static int
2271 ng_btsocket_rfcomm_receive_uih(ng_btsocket_rfcomm_session_p s, int dlci,
2272 		int pf, struct mbuf *m0)
2273 {
2274 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
2275 	int				error = 0;
2276 
2277 	mtx_assert(&s->session_mtx, MA_OWNED);
2278 
2279 	NG_BTSOCKET_RFCOMM_INFO(
2280 "%s: Got UIH, session state=%d, flags=%#x, mtu=%d, dlci=%d, pf=%d, len=%d\n",
2281 		__func__, s->state, s->flags, s->mtu, dlci, pf,
2282 		m0->m_pkthdr.len);
2283 
2284 	/* XXX should we do it here? Check for session flow control */
2285 	if (s->flags & NG_BTSOCKET_RFCOMM_SESSION_LFC) {
2286 		NG_BTSOCKET_RFCOMM_WARN(
2287 "%s: Got UIH with session flow control asserted, state=%d, flags=%#x\n",
2288 			__func__, s->state, s->flags);
2289 		goto drop;
2290 	}
2291 
2292 	/* Check if we have this dlci */
2293 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2294 	if (pcb == NULL) {
2295 		NG_BTSOCKET_RFCOMM_WARN(
2296 "%s: Got UIH for non-existing dlci=%d\n", __func__, dlci);
2297 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2298 		goto drop;
2299 	}
2300 
2301 	mtx_lock(&pcb->pcb_mtx);
2302 
2303 	/* Check dlci state */
2304 	if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
2305 		NG_BTSOCKET_RFCOMM_WARN(
2306 "%s: Got UIH for dlci=%d in invalid state=%d, flags=%#x\n",
2307 			__func__, dlci, pcb->state, pcb->flags);
2308 		error = EINVAL;
2309 		goto drop1;
2310 	}
2311 
2312 	/* Check dlci flow control */
2313 	if (((pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) && pcb->rx_cred <= 0) ||
2314 	     (pcb->lmodem & RFCOMM_MODEM_FC)) {
2315 		NG_BTSOCKET_RFCOMM_ERR(
2316 "%s: Got UIH for dlci=%d with asserted flow control, state=%d, " \
2317 "flags=%#x, rx_cred=%d, lmodem=%#x\n",
2318 			__func__, dlci, pcb->state, pcb->flags,
2319 			pcb->rx_cred, pcb->lmodem);
2320 		goto drop1;
2321 	}
2322 
2323 	/* Did we get any credits? */
2324 	if ((pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) && pf) {
2325 		NG_BTSOCKET_RFCOMM_INFO(
2326 "%s: Got %d more credits for dlci=%d, state=%d, flags=%#x, " \
2327 "rx_cred=%d, tx_cred=%d\n",
2328 			__func__, *mtod(m0, u_int8_t *), dlci, pcb->state,
2329 			pcb->flags, pcb->rx_cred, pcb->tx_cred);
2330 
2331 		pcb->tx_cred += *mtod(m0, u_int8_t *);
2332 		m_adj(m0, 1);
2333 
2334 		/* Send more from the DLC. XXX check for errors? */
2335 		ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
2336 	}
2337 
2338 	/* OK the of the rest of the mbuf is the data */
2339 	if (m0->m_pkthdr.len > 0) {
2340 		/* If we are using credit flow control decrease rx_cred here */
2341 		if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2342 			/* Give remote peer more credits (if needed) */
2343 			if (-- pcb->rx_cred <= RFCOMM_MAX_CREDITS / 2)
2344 				ng_btsocket_rfcomm_send_credits(pcb);
2345 			else
2346 				NG_BTSOCKET_RFCOMM_INFO(
2347 "%s: Remote side still has credits, dlci=%d, state=%d, flags=%#x, " \
2348 "rx_cred=%d, tx_cred=%d\n",		__func__, dlci, pcb->state, pcb->flags,
2349 					pcb->rx_cred, pcb->tx_cred);
2350 		}
2351 
2352 		/* Check packet against mtu on dlci */
2353 		if (m0->m_pkthdr.len > pcb->mtu) {
2354 			NG_BTSOCKET_RFCOMM_ERR(
2355 "%s: Got oversized UIH for dlci=%d, state=%d, flags=%#x, mtu=%d, len=%d\n",
2356 				__func__, dlci, pcb->state, pcb->flags,
2357 				pcb->mtu, m0->m_pkthdr.len);
2358 
2359 			error = EMSGSIZE;
2360 		} else if (m0->m_pkthdr.len > sbspace(&pcb->so->so_rcv)) {
2361 			/*
2362 			 * This is really bad. Receive queue on socket does
2363 			 * not have enough space for the packet. We do not
2364 			 * have any other choice but drop the packet.
2365 			 */
2366 
2367 			NG_BTSOCKET_RFCOMM_ERR(
2368 "%s: Not enough space in socket receive queue. Dropping UIH for dlci=%d, " \
2369 "state=%d, flags=%#x, len=%d, space=%ld\n",
2370 				__func__, dlci, pcb->state, pcb->flags,
2371 				m0->m_pkthdr.len, sbspace(&pcb->so->so_rcv));
2372 
2373 			error = ENOBUFS;
2374 		} else {
2375 			/* Append packet to the socket receive queue */
2376 			sbappend(&pcb->so->so_rcv, m0, 0);
2377 			m0 = NULL;
2378 
2379 			sorwakeup(pcb->so);
2380 		}
2381 	}
2382 drop1:
2383 	mtx_unlock(&pcb->pcb_mtx);
2384 drop:
2385 	NG_FREE_M(m0); /* checks for != NULL */
2386 
2387 	return (error);
2388 } /* ng_btsocket_rfcomm_receive_uih */
2389 
2390 /*
2391  * Process RFCOMM MCC command (Multiplexor)
2392  *
2393  * From TS 07.10 spec
2394  *
2395  * "5.4.3.1 Information Data
2396  *
2397  *  ...The frames (UIH) sent by the initiating station have the C/R bit set
2398  *  to 1 and those sent by the responding station have the C/R bit set to 0..."
2399  *
2400  * "5.4.6.2 Operating procedures
2401  *
2402  *  Messages always exist in pairs; a command message and a corresponding
2403  *  response message. If the C/R bit is set to 1 the message is a command,
2404  *  if it is set to 0 the message is a response...
2405  *
2406  *  ...
2407  *
2408  *  NOTE: Notice that when UIH frames are used to convey information on DLCI 0
2409  *  there are at least two different fields that contain a C/R bit, and the
2410  *  bits are set of different form. The C/R bit in the Type field shall be set
2411  *  as it is stated above, while the C/R bit in the Address field (see subclause
2412  *  5.2.1.2) shall be set as it is described in subclause 5.4.3.1."
2413  */
2414 
2415 static int
2416 ng_btsocket_rfcomm_receive_mcc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2417 {
2418 	struct rfcomm_mcc_hdr	*hdr = NULL;
2419 	u_int8_t		 cr, type, length;
2420 
2421 	mtx_assert(&s->session_mtx, MA_OWNED);
2422 
2423 	/*
2424 	 * We can access data directly in the first mbuf, because we have
2425 	 * m_pullup()'ed mbuf chain in ng_btsocket_rfcomm_receive_frame().
2426 	 * All MCC commands should fit into single mbuf (except probably TEST).
2427 	 */
2428 
2429 	hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2430 	cr = RFCOMM_CR(hdr->type);
2431 	type = RFCOMM_MCC_TYPE(hdr->type);
2432 	length = RFCOMM_MCC_LENGTH(hdr->length);
2433 
2434 	/* Check MCC frame length */
2435 	if (sizeof(*hdr) + length != m0->m_pkthdr.len) {
2436 		NG_BTSOCKET_RFCOMM_ERR(
2437 "%s: Invalid MCC frame length=%d, len=%d\n",
2438 			__func__, length, m0->m_pkthdr.len);
2439 		NG_FREE_M(m0);
2440 
2441 		return (EMSGSIZE);
2442 	}
2443 
2444 	switch (type) {
2445 	case RFCOMM_MCC_TEST:
2446 		return (ng_btsocket_rfcomm_receive_test(s, m0));
2447 		/* NOT REACHED */
2448 
2449 	case RFCOMM_MCC_FCON:
2450 	case RFCOMM_MCC_FCOFF:
2451 		return (ng_btsocket_rfcomm_receive_fc(s, m0));
2452 		/* NOT REACHED */
2453 
2454 	case RFCOMM_MCC_MSC:
2455 		return (ng_btsocket_rfcomm_receive_msc(s, m0));
2456 		/* NOT REACHED */
2457 
2458 	case RFCOMM_MCC_RPN:
2459 		return (ng_btsocket_rfcomm_receive_rpn(s, m0));
2460 		/* NOT REACHED */
2461 
2462 	case RFCOMM_MCC_RLS:
2463 		return (ng_btsocket_rfcomm_receive_rls(s, m0));
2464 		/* NOT REACHED */
2465 
2466 	case RFCOMM_MCC_PN:
2467 		return (ng_btsocket_rfcomm_receive_pn(s, m0));
2468 		/* NOT REACHED */
2469 
2470 	case RFCOMM_MCC_NSC:
2471 		NG_BTSOCKET_RFCOMM_ERR(
2472 "%s: Got MCC NSC, type=%#x, cr=%d, length=%d, session state=%d, flags=%#x, " \
2473 "mtu=%d, len=%d\n",	__func__, RFCOMM_MCC_TYPE(*((u_int8_t *)(hdr + 1))), cr,
2474 			 length, s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2475 		NG_FREE_M(m0);
2476 		break;
2477 
2478 	default:
2479 		NG_BTSOCKET_RFCOMM_ERR(
2480 "%s: Got unknown MCC, type=%#x, cr=%d, length=%d, session state=%d, " \
2481 "flags=%#x, mtu=%d, len=%d\n",
2482 			__func__, type, cr, length, s->state, s->flags,
2483 			s->mtu, m0->m_pkthdr.len);
2484 
2485 		/* Reuse mbuf to send NSC */
2486 		hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2487 		m0->m_pkthdr.len = m0->m_len = sizeof(*hdr);
2488 
2489 		/* Create MCC NSC header */
2490 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_NSC);
2491 		hdr->length = RFCOMM_MKLEN8(1);
2492 
2493 		/* Put back MCC command type we did not like */
2494 		m0->m_data[m0->m_len] = RFCOMM_MKMCC_TYPE(cr, type);
2495 		m0->m_pkthdr.len ++;
2496 		m0->m_len ++;
2497 
2498 		/* Send UIH frame */
2499 		return (ng_btsocket_rfcomm_send_uih(s,
2500 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0));
2501 		/* NOT REACHED */
2502 	}
2503 
2504 	return (0);
2505 } /* ng_btsocket_rfcomm_receive_mcc */
2506 
2507 /*
2508  * Receive RFCOMM TEST MCC command
2509  */
2510 
2511 static int
2512 ng_btsocket_rfcomm_receive_test(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2513 {
2514 	struct rfcomm_mcc_hdr	*hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2515 	int			 error = 0;
2516 
2517 	mtx_assert(&s->session_mtx, MA_OWNED);
2518 
2519 	NG_BTSOCKET_RFCOMM_INFO(
2520 "%s: Got MCC TEST, cr=%d, length=%d, session state=%d, flags=%#x, mtu=%d, " \
2521 "len=%d\n",	__func__, RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2522 		s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2523 
2524 	if (RFCOMM_CR(hdr->type)) {
2525 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_TEST);
2526 		error = ng_btsocket_rfcomm_send_uih(s,
2527 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2528 	} else
2529 		NG_FREE_M(m0); /* XXX ignore response */
2530 
2531 	return (error);
2532 } /* ng_btsocket_rfcomm_receive_test */
2533 
2534 /*
2535  * Receive RFCOMM FCON/FCOFF MCC command
2536  */
2537 
2538 static int
2539 ng_btsocket_rfcomm_receive_fc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2540 {
2541 	struct rfcomm_mcc_hdr	*hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2542 	u_int8_t		 type = RFCOMM_MCC_TYPE(hdr->type);
2543 	int			 error = 0;
2544 
2545 	mtx_assert(&s->session_mtx, MA_OWNED);
2546 
2547 	/*
2548 	 * Turn ON/OFF aggregate flow on the entire session. When remote peer
2549 	 * asserted flow control no transmission shall occur except on dlci 0
2550 	 * (control channel).
2551 	 */
2552 
2553 	NG_BTSOCKET_RFCOMM_INFO(
2554 "%s: Got MCC FC%s, cr=%d, length=%d, session state=%d, flags=%#x, mtu=%d, " \
2555 "len=%d\n",	__func__, (type == RFCOMM_MCC_FCON)? "ON" : "OFF",
2556 		RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2557 		s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2558 
2559 	if (RFCOMM_CR(hdr->type)) {
2560 		if (type == RFCOMM_MCC_FCON)
2561 			s->flags &= ~NG_BTSOCKET_RFCOMM_SESSION_RFC;
2562 		else
2563 			s->flags |= NG_BTSOCKET_RFCOMM_SESSION_RFC;
2564 
2565 		hdr->type = RFCOMM_MKMCC_TYPE(0, type);
2566 		error = ng_btsocket_rfcomm_send_uih(s,
2567 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2568 	} else
2569 		NG_FREE_M(m0); /* XXX ignore response */
2570 
2571 	return (error);
2572 } /* ng_btsocket_rfcomm_receive_fc  */
2573 
2574 /*
2575  * Receive RFCOMM MSC MCC command
2576  */
2577 
2578 static int
2579 ng_btsocket_rfcomm_receive_msc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2580 {
2581 	struct rfcomm_mcc_hdr		*hdr = mtod(m0, struct rfcomm_mcc_hdr*);
2582 	struct rfcomm_mcc_msc		*msc = (struct rfcomm_mcc_msc *)(hdr+1);
2583 	ng_btsocket_rfcomm_pcb_t	*pcb = NULL;
2584 	int				 error = 0;
2585 
2586 	mtx_assert(&s->session_mtx, MA_OWNED);
2587 
2588 	NG_BTSOCKET_RFCOMM_INFO(
2589 "%s: Got MCC MSC, dlci=%d, cr=%d, length=%d, session state=%d, flags=%#x, " \
2590 "mtu=%d, len=%d\n",
2591 		__func__,  RFCOMM_DLCI(msc->address), RFCOMM_CR(hdr->type),
2592 		RFCOMM_MCC_LENGTH(hdr->length), s->state, s->flags,
2593 		s->mtu, m0->m_pkthdr.len);
2594 
2595 	if (RFCOMM_CR(hdr->type)) {
2596 		pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, RFCOMM_DLCI(msc->address));
2597 		if (pcb == NULL) {
2598 			NG_BTSOCKET_RFCOMM_WARN(
2599 "%s: Got MSC command for non-existing dlci=%d\n",
2600 				__func__, RFCOMM_DLCI(msc->address));
2601 			NG_FREE_M(m0);
2602 
2603 			return (ENOENT);
2604 		}
2605 
2606 		mtx_lock(&pcb->pcb_mtx);
2607 
2608 		if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTING &&
2609 		    pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
2610 			NG_BTSOCKET_RFCOMM_WARN(
2611 "%s: Got MSC on dlci=%d in invalid state=%d\n",
2612 				__func__, RFCOMM_DLCI(msc->address),
2613 				pcb->state);
2614 
2615 			mtx_unlock(&pcb->pcb_mtx);
2616 			NG_FREE_M(m0);
2617 
2618 			return (EINVAL);
2619 		}
2620 
2621 		pcb->rmodem = msc->modem; /* Update remote port signals */
2622 
2623 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_MSC);
2624 		error = ng_btsocket_rfcomm_send_uih(s,
2625 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2626 
2627 #if 0 /* YYY */
2628 		/* Send more data from DLC. XXX check for errors? */
2629 		if (!(pcb->rmodem & RFCOMM_MODEM_FC) &&
2630 		    !(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC))
2631 			ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
2632 #endif /* YYY */
2633 
2634 		mtx_unlock(&pcb->pcb_mtx);
2635 	} else
2636 		NG_FREE_M(m0); /* XXX ignore response */
2637 
2638 	return (error);
2639 } /* ng_btsocket_rfcomm_receive_msc */
2640 
2641 /*
2642  * Receive RFCOMM RPN MCC command
2643  * XXX FIXME do we need htole16/le16toh for RPN param_mask?
2644  */
2645 
2646 static int
2647 ng_btsocket_rfcomm_receive_rpn(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2648 {
2649 	struct rfcomm_mcc_hdr	*hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2650 	struct rfcomm_mcc_rpn	*rpn = (struct rfcomm_mcc_rpn *)(hdr + 1);
2651 	int			 error = 0;
2652 	u_int16_t		 param_mask;
2653 	u_int8_t		 bit_rate, data_bits, stop_bits, parity,
2654 				 flow_control, xon_char, xoff_char;
2655 
2656 	mtx_assert(&s->session_mtx, MA_OWNED);
2657 
2658 	NG_BTSOCKET_RFCOMM_INFO(
2659 "%s: Got MCC RPN, dlci=%d, cr=%d, length=%d, session state=%d, flags=%#x, " \
2660 "mtu=%d, len=%d\n",
2661 		__func__, RFCOMM_DLCI(rpn->dlci), RFCOMM_CR(hdr->type),
2662 		RFCOMM_MCC_LENGTH(hdr->length), s->state, s->flags,
2663 		s->mtu, m0->m_pkthdr.len);
2664 
2665 	if (RFCOMM_CR(hdr->type)) {
2666 		param_mask = RFCOMM_RPN_PM_ALL;
2667 
2668 		if (RFCOMM_MCC_LENGTH(hdr->length) == 1) {
2669 			/* Request - return default setting */
2670 			bit_rate = RFCOMM_RPN_BR_115200;
2671 			data_bits = RFCOMM_RPN_DATA_8;
2672 			stop_bits = RFCOMM_RPN_STOP_1;
2673 			parity = RFCOMM_RPN_PARITY_NONE;
2674 			flow_control = RFCOMM_RPN_FLOW_NONE;
2675 			xon_char = RFCOMM_RPN_XON_CHAR;
2676 			xoff_char = RFCOMM_RPN_XOFF_CHAR;
2677                 } else {
2678 			/*
2679 			 * Ignore/accept bit_rate, 8 bits, 1 stop bit, no
2680 			 * parity, no flow control lines, default XON/XOFF
2681 			 * chars.
2682 			 */
2683 
2684 			bit_rate = rpn->bit_rate;
2685 			rpn->param_mask = le16toh(rpn->param_mask); /* XXX */
2686 
2687 			data_bits = RFCOMM_RPN_DATA_BITS(rpn->line_settings);
2688 			if (rpn->param_mask & RFCOMM_RPN_PM_DATA &&
2689 			    data_bits != RFCOMM_RPN_DATA_8) {
2690 				data_bits = RFCOMM_RPN_DATA_8;
2691 				param_mask ^= RFCOMM_RPN_PM_DATA;
2692 			}
2693 
2694 			stop_bits = RFCOMM_RPN_STOP_BITS(rpn->line_settings);
2695 			if (rpn->param_mask & RFCOMM_RPN_PM_STOP &&
2696 			    stop_bits != RFCOMM_RPN_STOP_1) {
2697 				stop_bits = RFCOMM_RPN_STOP_1;
2698 				param_mask ^= RFCOMM_RPN_PM_STOP;
2699 			}
2700 
2701 			parity = RFCOMM_RPN_PARITY(rpn->line_settings);
2702 			if (rpn->param_mask & RFCOMM_RPN_PM_PARITY &&
2703 			    parity != RFCOMM_RPN_PARITY_NONE) {
2704 				parity = RFCOMM_RPN_PARITY_NONE;
2705 				param_mask ^= RFCOMM_RPN_PM_PARITY;
2706 			}
2707 
2708 			flow_control = rpn->flow_control;
2709 			if (rpn->param_mask & RFCOMM_RPN_PM_FLOW &&
2710 			    flow_control != RFCOMM_RPN_FLOW_NONE) {
2711 				flow_control = RFCOMM_RPN_FLOW_NONE;
2712 				param_mask ^= RFCOMM_RPN_PM_FLOW;
2713 			}
2714 
2715 			xon_char = rpn->xon_char;
2716 			if (rpn->param_mask & RFCOMM_RPN_PM_XON &&
2717 			    xon_char != RFCOMM_RPN_XON_CHAR) {
2718 				xon_char = RFCOMM_RPN_XON_CHAR;
2719 				param_mask ^= RFCOMM_RPN_PM_XON;
2720 			}
2721 
2722 			xoff_char = rpn->xoff_char;
2723 			if (rpn->param_mask & RFCOMM_RPN_PM_XOFF &&
2724 			    xoff_char != RFCOMM_RPN_XOFF_CHAR) {
2725 				xoff_char = RFCOMM_RPN_XOFF_CHAR;
2726 				param_mask ^= RFCOMM_RPN_PM_XOFF;
2727 			}
2728 		}
2729 
2730 		rpn->bit_rate = bit_rate;
2731 		rpn->line_settings = RFCOMM_MKRPN_LINE_SETTINGS(data_bits,
2732 						stop_bits, parity);
2733 		rpn->flow_control = flow_control;
2734 		rpn->xon_char = xon_char;
2735 		rpn->xoff_char = xoff_char;
2736 		rpn->param_mask = htole16(param_mask); /* XXX */
2737 
2738 		m0->m_pkthdr.len = m0->m_len = sizeof(*hdr) + sizeof(*rpn);
2739 
2740 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_RPN);
2741 		error = ng_btsocket_rfcomm_send_uih(s,
2742 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2743 	} else
2744 		NG_FREE_M(m0); /* XXX ignore response */
2745 
2746 	return (error);
2747 } /* ng_btsocket_rfcomm_receive_rpn */
2748 
2749 /*
2750  * Receive RFCOMM RLS MCC command
2751  */
2752 
2753 static int
2754 ng_btsocket_rfcomm_receive_rls(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2755 {
2756 	struct rfcomm_mcc_hdr	*hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2757 	struct rfcomm_mcc_rls	*rls = (struct rfcomm_mcc_rls *)(hdr + 1);
2758 	int			 error = 0;
2759 
2760 	mtx_assert(&s->session_mtx, MA_OWNED);
2761 
2762 	/*
2763 	 * XXX FIXME Do we have to do anything else here? Remote peer tries to
2764 	 * tell us something about DLCI. Just report what we have received and
2765 	 * return back received values as required by TS 07.10 spec.
2766 	 */
2767 
2768 	NG_BTSOCKET_RFCOMM_INFO(
2769 "%s: Got MCC RLS, dlci=%d, status=%#x, cr=%d, length=%d, session state=%d, " \
2770 "flags=%#x, mtu=%d, len=%d\n",
2771 		__func__, RFCOMM_DLCI(rls->address), rls->status,
2772 		RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2773 		s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2774 
2775 	if (RFCOMM_CR(hdr->type)) {
2776 		if (rls->status & 0x1)
2777 			NG_BTSOCKET_RFCOMM_ERR(
2778 "%s: Got RLS dlci=%d, error=%#x\n", __func__, RFCOMM_DLCI(rls->address),
2779 				rls->status >> 1);
2780 
2781 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_RLS);
2782 		error = ng_btsocket_rfcomm_send_uih(s,
2783 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2784 	} else
2785 		NG_FREE_M(m0); /* XXX ignore responses */
2786 
2787 	return (error);
2788 } /* ng_btsocket_rfcomm_receive_rls */
2789 
2790 /*
2791  * Receive RFCOMM PN MCC command
2792  */
2793 
2794 static int
2795 ng_btsocket_rfcomm_receive_pn(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2796 {
2797 	struct rfcomm_mcc_hdr		*hdr = mtod(m0, struct rfcomm_mcc_hdr*);
2798 	struct rfcomm_mcc_pn		*pn = (struct rfcomm_mcc_pn *)(hdr+1);
2799 	ng_btsocket_rfcomm_pcb_t	*pcb = NULL;
2800 	int				 error = 0;
2801 
2802 	mtx_assert(&s->session_mtx, MA_OWNED);
2803 
2804 	NG_BTSOCKET_RFCOMM_INFO(
2805 "%s: Got MCC PN, dlci=%d, cr=%d, length=%d, flow_control=%#x, priority=%d, " \
2806 "ack_timer=%d, mtu=%d, max_retrans=%d, credits=%d, session state=%d, " \
2807 "flags=%#x, session mtu=%d, len=%d\n",
2808 		__func__, pn->dlci, RFCOMM_CR(hdr->type),
2809 		RFCOMM_MCC_LENGTH(hdr->length), pn->flow_control, pn->priority,
2810 		pn->ack_timer, le16toh(pn->mtu), pn->max_retrans, pn->credits,
2811 		s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2812 
2813 	if (pn->dlci == 0) {
2814 		NG_BTSOCKET_RFCOMM_ERR("%s: Zero dlci in MCC PN\n", __func__);
2815 		NG_FREE_M(m0);
2816 
2817 		return (EINVAL);
2818 	}
2819 
2820 	/* Check if we have this dlci */
2821 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, pn->dlci);
2822 	if (pcb != NULL) {
2823 		mtx_lock(&pcb->pcb_mtx);
2824 
2825 		if (RFCOMM_CR(hdr->type)) {
2826 			/* PN Request */
2827 			ng_btsocket_rfcomm_set_pn(pcb, 1, pn->flow_control,
2828 				pn->credits, pn->mtu);
2829 
2830 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2831 				pn->flow_control = 0xe0;
2832 				pn->credits = RFCOMM_DEFAULT_CREDITS;
2833 			} else {
2834 				pn->flow_control = 0;
2835 				pn->credits = 0;
2836 			}
2837 
2838 			hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_PN);
2839 			error = ng_btsocket_rfcomm_send_uih(s,
2840 					RFCOMM_MKADDRESS(INITIATOR(s), 0),
2841 					0, 0, m0);
2842 		} else {
2843 			/* PN Response - proceed with SABM. Timeout still set */
2844 			if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONFIGURING) {
2845 				ng_btsocket_rfcomm_set_pn(pcb, 0,
2846 					pn->flow_control, pn->credits, pn->mtu);
2847 
2848 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTING;
2849 				error = ng_btsocket_rfcomm_send_command(s,
2850 						RFCOMM_FRAME_SABM, pn->dlci);
2851 			} else
2852 				NG_BTSOCKET_RFCOMM_WARN(
2853 "%s: Got PN response for dlci=%d in invalid state=%d\n",
2854 					__func__, pn->dlci, pcb->state);
2855 
2856 			NG_FREE_M(m0);
2857 		}
2858 
2859 		mtx_unlock(&pcb->pcb_mtx);
2860 	} else if (RFCOMM_CR(hdr->type)) {
2861 		/* PN request to non-existing dlci - incoming connection */
2862 		pcb = ng_btsocket_rfcomm_connect_ind(s,
2863 				RFCOMM_SRVCHANNEL(pn->dlci));
2864 		if (pcb != NULL) {
2865 			mtx_lock(&pcb->pcb_mtx);
2866 
2867 			pcb->dlci = pn->dlci;
2868 
2869 			ng_btsocket_rfcomm_set_pn(pcb, 1, pn->flow_control,
2870 				pn->credits, pn->mtu);
2871 
2872 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2873 				pn->flow_control = 0xe0;
2874 				pn->credits = RFCOMM_DEFAULT_CREDITS;
2875 			} else {
2876 				pn->flow_control = 0;
2877 				pn->credits = 0;
2878 			}
2879 
2880 			hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_PN);
2881 			error = ng_btsocket_rfcomm_send_uih(s,
2882 					RFCOMM_MKADDRESS(INITIATOR(s), 0),
2883 					0, 0, m0);
2884 
2885 			if (error == 0) {
2886 				ng_btsocket_rfcomm_timeout(pcb);
2887 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTING;
2888 				soisconnecting(pcb->so);
2889 			} else
2890 				ng_btsocket_rfcomm_pcb_kill(pcb, error);
2891 
2892 			mtx_unlock(&pcb->pcb_mtx);
2893 		} else {
2894 			/* Nobody is listen()ing on this channel */
2895 			error = ng_btsocket_rfcomm_send_command(s,
2896 					RFCOMM_FRAME_DM, pn->dlci);
2897 			NG_FREE_M(m0);
2898 		}
2899 	} else
2900 		NG_FREE_M(m0); /* XXX ignore response to non-existing dlci */
2901 
2902 	return (error);
2903 } /* ng_btsocket_rfcomm_receive_pn */
2904 
2905 /*
2906  * Set PN parameters for dlci. Caller must hold pcb->pcb_mtx.
2907  *
2908  * From Bluetooth spec.
2909  *
2910  * "... The CL1 - CL4 field is completely redefined. (In TS07.10 this defines
2911  *  the convergence layer to use, which is not applicable to RFCOMM. In RFCOMM,
2912  *  in Bluetooth versions up to 1.0B, this field was forced to 0).
2913  *
2914  *  In the PN request sent prior to a DLC establishment, this field must contain
2915  *  the value 15 (0xF), indicating support of credit based flow control in the
2916  *  sender. See Table 5.3 below. If the PN response contains any other value
2917  *  than 14 (0xE) in this field, it is inferred that the peer RFCOMM entity is
2918  *  not supporting the credit based flow control feature. (This is only possible
2919  *  if the peer RFCOMM implementation is only conforming to Bluetooth version
2920  *  1.0B.) If a PN request is sent on an already open DLC, then this field must
2921  *  contain the value zero; it is not possible to set initial credits  more
2922  *  than once per DLC activation. A responding implementation must set this
2923  *  field in the PN response to 14 (0xE), if (and only if) the value in the PN
2924  *  request was 15..."
2925  */
2926 
2927 static void
2928 ng_btsocket_rfcomm_set_pn(ng_btsocket_rfcomm_pcb_p pcb, u_int8_t cr,
2929 		u_int8_t flow_control, u_int8_t credits, u_int16_t mtu)
2930 {
2931 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
2932 
2933 	pcb->mtu = le16toh(mtu);
2934 
2935 	if (cr) {
2936 		if (flow_control == 0xf0) {
2937 			pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_CFC;
2938 			pcb->tx_cred = credits;
2939 		} else {
2940 			pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_CFC;
2941 			pcb->tx_cred = 0;
2942 		}
2943 	} else {
2944 		if (flow_control == 0xe0) {
2945 			pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_CFC;
2946 			pcb->tx_cred = credits;
2947 		} else {
2948 			pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_CFC;
2949 			pcb->tx_cred = 0;
2950 		}
2951 	}
2952 
2953 	NG_BTSOCKET_RFCOMM_INFO(
2954 "%s: cr=%d, dlci=%d, state=%d, flags=%#x, mtu=%d, rx_cred=%d, tx_cred=%d\n",
2955 		__func__, cr, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
2956 		pcb->rx_cred, pcb->tx_cred);
2957 } /* ng_btsocket_rfcomm_set_pn */
2958 
2959 /*
2960  * Send RFCOMM SABM/DISC/UA/DM frames. Caller must hold s->session_mtx
2961  */
2962 
2963 static int
2964 ng_btsocket_rfcomm_send_command(ng_btsocket_rfcomm_session_p s,
2965 		u_int8_t type, u_int8_t dlci)
2966 {
2967 	struct rfcomm_cmd_hdr	*hdr = NULL;
2968 	struct mbuf		*m = NULL;
2969 	int			 cr;
2970 
2971 	mtx_assert(&s->session_mtx, MA_OWNED);
2972 
2973 	NG_BTSOCKET_RFCOMM_INFO(
2974 "%s: Sending command type %#x, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2975 		__func__, type, s->state, s->flags, s->mtu, dlci);
2976 
2977 	switch (type) {
2978 	case RFCOMM_FRAME_SABM:
2979 	case RFCOMM_FRAME_DISC:
2980 		cr = INITIATOR(s);
2981 		break;
2982 
2983 	case RFCOMM_FRAME_UA:
2984 	case RFCOMM_FRAME_DM:
2985 		cr = !INITIATOR(s);
2986 		break;
2987 
2988 	default:
2989 		panic("%s: Invalid frame type=%#x\n", __func__, type);
2990 		return (EINVAL);
2991 		/* NOT REACHED */
2992 	}
2993 
2994 	MGETHDR(m, M_NOWAIT, MT_DATA);
2995 	if (m == NULL)
2996 		return (ENOBUFS);
2997 
2998 	m->m_pkthdr.len = m->m_len = sizeof(*hdr);
2999 
3000 	hdr = mtod(m, struct rfcomm_cmd_hdr *);
3001 	hdr->address = RFCOMM_MKADDRESS(cr, dlci);
3002 	hdr->control = RFCOMM_MKCONTROL(type, 1);
3003 	hdr->length = RFCOMM_MKLEN8(0);
3004 	hdr->fcs = ng_btsocket_rfcomm_fcs3((u_int8_t *) hdr);
3005 
3006 	NG_BT_MBUFQ_ENQUEUE(&s->outq, m);
3007 
3008 	return (0);
3009 } /* ng_btsocket_rfcomm_send_command */
3010 
3011 /*
3012  * Send RFCOMM UIH frame. Caller must hold s->session_mtx
3013  */
3014 
3015 static int
3016 ng_btsocket_rfcomm_send_uih(ng_btsocket_rfcomm_session_p s, u_int8_t address,
3017 		u_int8_t pf, u_int8_t credits, struct mbuf *data)
3018 {
3019 	struct rfcomm_frame_hdr	*hdr = NULL;
3020 	struct mbuf		*m = NULL, *mcrc = NULL;
3021 	u_int16_t		 length;
3022 
3023 	mtx_assert(&s->session_mtx, MA_OWNED);
3024 
3025 	MGETHDR(m, M_NOWAIT, MT_DATA);
3026 	if (m == NULL) {
3027 		NG_FREE_M(data);
3028 		return (ENOBUFS);
3029 	}
3030 	m->m_pkthdr.len = m->m_len = sizeof(*hdr);
3031 
3032 	MGET(mcrc, M_NOWAIT, MT_DATA);
3033 	if (mcrc == NULL) {
3034 		NG_FREE_M(data);
3035 		return (ENOBUFS);
3036 	}
3037 	mcrc->m_len = 1;
3038 
3039 	/* Fill UIH frame header */
3040 	hdr = mtod(m, struct rfcomm_frame_hdr *);
3041 	hdr->address = address;
3042 	hdr->control = RFCOMM_MKCONTROL(RFCOMM_FRAME_UIH, pf);
3043 
3044 	/* Calculate FCS */
3045 	mcrc->m_data[0] = ng_btsocket_rfcomm_fcs2((u_int8_t *) hdr);
3046 
3047 	/* Put length back */
3048 	length = (data != NULL)? data->m_pkthdr.len : 0;
3049 	if (length > 127) {
3050 		u_int16_t	l = htole16(RFCOMM_MKLEN16(length));
3051 
3052 		bcopy(&l, &hdr->length, sizeof(l));
3053 		m->m_pkthdr.len ++;
3054 		m->m_len ++;
3055 	} else
3056 		hdr->length = RFCOMM_MKLEN8(length);
3057 
3058 	if (pf) {
3059 		m->m_data[m->m_len] = credits;
3060 		m->m_pkthdr.len ++;
3061 		m->m_len ++;
3062 	}
3063 
3064 	/* Add payload */
3065 	if (data != NULL) {
3066 		m_cat(m, data);
3067 		m->m_pkthdr.len += length;
3068 	}
3069 
3070 	/* Put FCS back */
3071 	m_cat(m, mcrc);
3072 	m->m_pkthdr.len ++;
3073 
3074 	NG_BTSOCKET_RFCOMM_INFO(
3075 "%s: Sending UIH state=%d, flags=%#x, address=%d, length=%d, pf=%d, " \
3076 "credits=%d, len=%d\n",
3077 		__func__, s->state, s->flags, address, length, pf, credits,
3078 		m->m_pkthdr.len);
3079 
3080 	NG_BT_MBUFQ_ENQUEUE(&s->outq, m);
3081 
3082 	return (0);
3083 } /* ng_btsocket_rfcomm_send_uih */
3084 
3085 /*
3086  * Send MSC request. Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3087  */
3088 
3089 static int
3090 ng_btsocket_rfcomm_send_msc(ng_btsocket_rfcomm_pcb_p pcb)
3091 {
3092 	struct mbuf		*m = NULL;
3093 	struct rfcomm_mcc_hdr	*hdr = NULL;
3094 	struct rfcomm_mcc_msc	*msc = NULL;
3095 
3096 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3097 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3098 
3099 	MGETHDR(m, M_NOWAIT, MT_DATA);
3100 	if (m == NULL)
3101 		return (ENOBUFS);
3102 
3103 	m->m_pkthdr.len = m->m_len = sizeof(*hdr) + sizeof(*msc);
3104 
3105 	hdr = mtod(m, struct rfcomm_mcc_hdr *);
3106 	msc = (struct rfcomm_mcc_msc *)(hdr + 1);
3107 
3108 	hdr->type = RFCOMM_MKMCC_TYPE(1, RFCOMM_MCC_MSC);
3109 	hdr->length = RFCOMM_MKLEN8(sizeof(*msc));
3110 
3111 	msc->address = RFCOMM_MKADDRESS(1, pcb->dlci);
3112 	msc->modem = pcb->lmodem;
3113 
3114 	NG_BTSOCKET_RFCOMM_INFO(
3115 "%s: Sending MSC dlci=%d, state=%d, flags=%#x, address=%d, modem=%#x\n",
3116 		__func__, pcb->dlci, pcb->state, pcb->flags, msc->address,
3117 		msc->modem);
3118 
3119 	return (ng_btsocket_rfcomm_send_uih(pcb->session,
3120 			RFCOMM_MKADDRESS(INITIATOR(pcb->session), 0), 0, 0, m));
3121 } /* ng_btsocket_rfcomm_send_msc */
3122 
3123 /*
3124  * Send PN request. Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3125  */
3126 
3127 static int
3128 ng_btsocket_rfcomm_send_pn(ng_btsocket_rfcomm_pcb_p pcb)
3129 {
3130 	struct mbuf		*m = NULL;
3131 	struct rfcomm_mcc_hdr	*hdr = NULL;
3132 	struct rfcomm_mcc_pn	*pn = NULL;
3133 
3134 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3135 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3136 
3137 	MGETHDR(m, M_NOWAIT, MT_DATA);
3138 	if (m == NULL)
3139 		return (ENOBUFS);
3140 
3141 	m->m_pkthdr.len = m->m_len = sizeof(*hdr) + sizeof(*pn);
3142 
3143 	hdr = mtod(m, struct rfcomm_mcc_hdr *);
3144 	pn = (struct rfcomm_mcc_pn *)(hdr + 1);
3145 
3146 	hdr->type = RFCOMM_MKMCC_TYPE(1, RFCOMM_MCC_PN);
3147 	hdr->length = RFCOMM_MKLEN8(sizeof(*pn));
3148 
3149 	pn->dlci = pcb->dlci;
3150 
3151 	/*
3152 	 * Set default DLCI priority as described in GSM 07.10
3153 	 * (ETSI TS 101 369) clause 5.6 page 42
3154 	 */
3155 
3156 	pn->priority = (pcb->dlci < 56)? (((pcb->dlci >> 3) << 3) + 7) : 61;
3157 	pn->ack_timer = 0;
3158 	pn->mtu = htole16(pcb->mtu);
3159 	pn->max_retrans = 0;
3160 
3161 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
3162 		pn->flow_control = 0xf0;
3163 		pn->credits = pcb->rx_cred;
3164 	} else {
3165 		pn->flow_control = 0;
3166 		pn->credits = 0;
3167 	}
3168 
3169 	NG_BTSOCKET_RFCOMM_INFO(
3170 "%s: Sending PN dlci=%d, state=%d, flags=%#x, mtu=%d, flow_control=%#x, " \
3171 "credits=%d\n",	__func__, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
3172 		pn->flow_control, pn->credits);
3173 
3174 	return (ng_btsocket_rfcomm_send_uih(pcb->session,
3175 			RFCOMM_MKADDRESS(INITIATOR(pcb->session), 0), 0, 0, m));
3176 } /* ng_btsocket_rfcomm_send_pn */
3177 
3178 /*
3179  * Calculate and send credits based on available space in receive buffer
3180  */
3181 
3182 static int
3183 ng_btsocket_rfcomm_send_credits(ng_btsocket_rfcomm_pcb_p pcb)
3184 {
3185 	int		error = 0;
3186 	u_int8_t	credits;
3187 
3188 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3189 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3190 
3191 	NG_BTSOCKET_RFCOMM_INFO(
3192 "%s: Sending more credits, dlci=%d, state=%d, flags=%#x, mtu=%d, " \
3193 "space=%ld, tx_cred=%d, rx_cred=%d\n",
3194 		__func__, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
3195 		sbspace(&pcb->so->so_rcv), pcb->tx_cred, pcb->rx_cred);
3196 
3197 	credits = sbspace(&pcb->so->so_rcv) / pcb->mtu;
3198 	if (credits > 0) {
3199 		if (pcb->rx_cred + credits > RFCOMM_MAX_CREDITS)
3200 			credits = RFCOMM_MAX_CREDITS - pcb->rx_cred;
3201 
3202 		error = ng_btsocket_rfcomm_send_uih(
3203 				pcb->session,
3204 				RFCOMM_MKADDRESS(INITIATOR(pcb->session),
3205 					pcb->dlci), 1, credits, NULL);
3206 		if (error == 0) {
3207 			pcb->rx_cred += credits;
3208 
3209 			NG_BTSOCKET_RFCOMM_INFO(
3210 "%s: Gave remote side %d more credits, dlci=%d, state=%d, flags=%#x, " \
3211 "rx_cred=%d, tx_cred=%d\n",	__func__, credits, pcb->dlci, pcb->state,
3212 				pcb->flags, pcb->rx_cred, pcb->tx_cred);
3213 		} else
3214 			NG_BTSOCKET_RFCOMM_ERR(
3215 "%s: Could not send credits, error=%d, dlci=%d, state=%d, flags=%#x, " \
3216 "mtu=%d, space=%ld, tx_cred=%d, rx_cred=%d\n",
3217 				__func__, error, pcb->dlci, pcb->state,
3218 				pcb->flags, pcb->mtu, sbspace(&pcb->so->so_rcv),
3219 				pcb->tx_cred, pcb->rx_cred);
3220 	}
3221 
3222 	return (error);
3223 } /* ng_btsocket_rfcomm_send_credits */
3224 
3225 /*****************************************************************************
3226  *****************************************************************************
3227  **                              RFCOMM DLCs
3228  *****************************************************************************
3229  *****************************************************************************/
3230 
3231 /*
3232  * Send data from socket send buffer
3233  * Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3234  */
3235 
3236 static int
3237 ng_btsocket_rfcomm_pcb_send(ng_btsocket_rfcomm_pcb_p pcb, int limit)
3238 {
3239 	struct mbuf	*m = NULL;
3240 	int		 sent, length, error;
3241 
3242 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3243 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3244 
3245 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)
3246 		limit = min(limit, pcb->tx_cred);
3247 	else if (!(pcb->rmodem & RFCOMM_MODEM_FC))
3248 		limit = min(limit, RFCOMM_MAX_CREDITS); /* XXX ??? */
3249 	else
3250 		limit = 0;
3251 
3252 	if (limit == 0) {
3253 		NG_BTSOCKET_RFCOMM_INFO(
3254 "%s: Could not send - remote flow control asserted, dlci=%d, flags=%#x, " \
3255 "rmodem=%#x, tx_cred=%d\n",
3256 			__func__, pcb->dlci, pcb->flags, pcb->rmodem,
3257 			pcb->tx_cred);
3258 
3259 		return (0);
3260 	}
3261 
3262 	for (error = 0, sent = 0; sent < limit; sent ++) {
3263 		length = min(pcb->mtu, sbavail(&pcb->so->so_snd));
3264 		if (length == 0)
3265 			break;
3266 
3267 		/* Get the chunk from the socket's send buffer */
3268 		m = ng_btsocket_rfcomm_prepare_packet(&pcb->so->so_snd, length);
3269 		if (m == NULL) {
3270 			error = ENOBUFS;
3271 			break;
3272 		}
3273 
3274 		sbdrop(&pcb->so->so_snd, length);
3275 
3276 		error = ng_btsocket_rfcomm_send_uih(pcb->session,
3277 				RFCOMM_MKADDRESS(INITIATOR(pcb->session),
3278 					pcb->dlci), 0, 0, m);
3279 		if (error != 0)
3280 			break;
3281 	}
3282 
3283 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)
3284 		pcb->tx_cred -= sent;
3285 
3286 	if (error == 0 && sent > 0) {
3287 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_SENDING;
3288 		sowwakeup(pcb->so);
3289 	}
3290 
3291 	return (error);
3292 } /* ng_btsocket_rfcomm_pcb_send */
3293 
3294 /*
3295  * Unlink and disconnect DLC. If ng_btsocket_rfcomm_pcb_kill() returns
3296  * non zero value than socket has no reference and has to be detached.
3297  * Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3298  */
3299 
3300 static void
3301 ng_btsocket_rfcomm_pcb_kill(ng_btsocket_rfcomm_pcb_p pcb, int error)
3302 {
3303 	ng_btsocket_rfcomm_session_p	s = pcb->session;
3304 
3305 	NG_BTSOCKET_RFCOMM_INFO(
3306 "%s: Killing DLC, so=%p, dlci=%d, state=%d, flags=%#x, error=%d\n",
3307 		__func__, pcb->so, pcb->dlci, pcb->state, pcb->flags, error);
3308 
3309 	if (pcb->session == NULL)
3310 		panic("%s: DLC without session, pcb=%p, state=%d, flags=%#x\n",
3311 			__func__, pcb, pcb->state, pcb->flags);
3312 
3313 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3314 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3315 
3316 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
3317 		ng_btsocket_rfcomm_untimeout(pcb);
3318 
3319 	/* Detach DLC from the session. Does not matter which state DLC in */
3320 	LIST_REMOVE(pcb, session_next);
3321 	pcb->session = NULL;
3322 
3323 	/* Change DLC state and wakeup all sleepers */
3324 	pcb->state = NG_BTSOCKET_RFCOMM_DLC_CLOSED;
3325 	pcb->so->so_error = error;
3326 	soisdisconnected(pcb->so);
3327 	wakeup(&pcb->state);
3328 
3329 	/* Check if we have any DLCs left on the session */
3330 	if (LIST_EMPTY(&s->dlcs) && INITIATOR(s)) {
3331 		NG_BTSOCKET_RFCOMM_INFO(
3332 "%s: Disconnecting session, state=%d, flags=%#x, mtu=%d\n",
3333 			__func__, s->state, s->flags, s->mtu);
3334 
3335 		switch (s->state) {
3336 		case NG_BTSOCKET_RFCOMM_SESSION_CLOSED:
3337 		case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
3338 			/*
3339 			 * Do not have to do anything here. We can get here
3340 			 * when L2CAP connection was terminated or we have
3341 			 * received DISC on multiplexor channel
3342 			 */
3343 			break;
3344 
3345 		case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
3346 			/* Send DISC on multiplexor channel */
3347 			error = ng_btsocket_rfcomm_send_command(s,
3348 					RFCOMM_FRAME_DISC, 0);
3349 			if (error == 0) {
3350 				s->state = NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING;
3351 				break;
3352 			}
3353 			/* FALL THROUGH */
3354 
3355 		case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
3356 		case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
3357 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
3358 			break;
3359 
3360 /*		case NG_BTSOCKET_RFCOMM_SESSION_LISTENING: */
3361 		default:
3362 			panic("%s: Invalid session state=%d, flags=%#x\n",
3363 				__func__, s->state, s->flags);
3364 			break;
3365 		}
3366 
3367 		ng_btsocket_rfcomm_task_wakeup();
3368 	}
3369 } /* ng_btsocket_rfcomm_pcb_kill */
3370 
3371 /*
3372  * Look for given dlci for given RFCOMM session. Caller must hold s->session_mtx
3373  */
3374 
3375 static ng_btsocket_rfcomm_pcb_p
3376 ng_btsocket_rfcomm_pcb_by_dlci(ng_btsocket_rfcomm_session_p s, int dlci)
3377 {
3378 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
3379 
3380 	mtx_assert(&s->session_mtx, MA_OWNED);
3381 
3382 	LIST_FOREACH(pcb, &s->dlcs, session_next)
3383 		if (pcb->dlci == dlci)
3384 			break;
3385 
3386 	return (pcb);
3387 } /* ng_btsocket_rfcomm_pcb_by_dlci */
3388 
3389 /*
3390  * Look for socket that listens on given src address and given channel
3391  */
3392 
3393 static ng_btsocket_rfcomm_pcb_p
3394 ng_btsocket_rfcomm_pcb_listener(bdaddr_p src, int channel)
3395 {
3396 	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb1 = NULL;
3397 
3398 	mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
3399 
3400 	LIST_FOREACH(pcb, &ng_btsocket_rfcomm_sockets, next) {
3401 		if (pcb->channel != channel ||
3402 		    !(pcb->so->so_options & SO_ACCEPTCONN))
3403 			continue;
3404 
3405 		if (bcmp(&pcb->src, src, sizeof(*src)) == 0)
3406 			break;
3407 
3408 		if (bcmp(&pcb->src, NG_HCI_BDADDR_ANY, sizeof(bdaddr_t)) == 0)
3409 			pcb1 = pcb;
3410 	}
3411 
3412 	mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
3413 
3414 	return ((pcb != NULL)? pcb : pcb1);
3415 } /* ng_btsocket_rfcomm_pcb_listener */
3416 
3417 /*****************************************************************************
3418  *****************************************************************************
3419  **                              Misc. functions
3420  *****************************************************************************
3421  *****************************************************************************/
3422 
3423 /*
3424  *  Set timeout. Caller MUST hold pcb_mtx
3425  */
3426 
3427 static void
3428 ng_btsocket_rfcomm_timeout(ng_btsocket_rfcomm_pcb_p pcb)
3429 {
3430 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3431 
3432 	if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)) {
3433 		pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_TIMO;
3434 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3435 		callout_reset(&pcb->timo, ng_btsocket_rfcomm_timo * hz,
3436 		    ng_btsocket_rfcomm_process_timeout, pcb);
3437 	} else
3438 		panic("%s: Duplicated socket timeout?!\n", __func__);
3439 } /* ng_btsocket_rfcomm_timeout */
3440 
3441 /*
3442  *  Unset pcb timeout. Caller MUST hold pcb_mtx
3443  */
3444 
3445 static void
3446 ng_btsocket_rfcomm_untimeout(ng_btsocket_rfcomm_pcb_p pcb)
3447 {
3448 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3449 
3450 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO) {
3451 		callout_stop(&pcb->timo);
3452 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMO;
3453 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3454 	} else
3455 		panic("%s: No socket timeout?!\n", __func__);
3456 } /* ng_btsocket_rfcomm_timeout */
3457 
3458 /*
3459  * Process pcb timeout
3460  */
3461 
3462 static void
3463 ng_btsocket_rfcomm_process_timeout(void *xpcb)
3464 {
3465 	ng_btsocket_rfcomm_pcb_p	pcb = (ng_btsocket_rfcomm_pcb_p) xpcb;
3466 
3467 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3468 
3469 	NG_BTSOCKET_RFCOMM_INFO(
3470 "%s: Timeout, so=%p, dlci=%d, state=%d, flags=%#x\n",
3471 		__func__, pcb->so, pcb->dlci, pcb->state, pcb->flags);
3472 
3473 	pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMO;
3474 	pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3475 
3476 	switch (pcb->state) {
3477 	case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
3478 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
3479 		pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
3480 		break;
3481 
3482 	case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
3483 	case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
3484 		break;
3485 
3486 	default:
3487 		panic(
3488 "%s: DLC timeout in invalid state, dlci=%d, state=%d, flags=%#x\n",
3489 			__func__, pcb->dlci, pcb->state, pcb->flags);
3490 		break;
3491 	}
3492 
3493 	ng_btsocket_rfcomm_task_wakeup();
3494 } /* ng_btsocket_rfcomm_process_timeout */
3495 
3496 /*
3497  * Get up to length bytes from the socket buffer
3498  */
3499 
3500 static struct mbuf *
3501 ng_btsocket_rfcomm_prepare_packet(struct sockbuf *sb, int length)
3502 {
3503 	struct mbuf	*top = NULL, *m = NULL, *n = NULL, *nextpkt = NULL;
3504 	int		 mlen, noff, len;
3505 
3506 	MGETHDR(top, M_NOWAIT, MT_DATA);
3507 	if (top == NULL)
3508 		return (NULL);
3509 
3510 	top->m_pkthdr.len = length;
3511 	top->m_len = 0;
3512 	mlen = MHLEN;
3513 
3514 	m = top;
3515 	n = sb->sb_mb;
3516 	nextpkt = n->m_nextpkt;
3517 	noff = 0;
3518 
3519 	while (length > 0 && n != NULL) {
3520 		len = min(mlen - m->m_len, n->m_len - noff);
3521 		if (len > length)
3522 			len = length;
3523 
3524 		bcopy(mtod(n, caddr_t)+noff, mtod(m, caddr_t)+m->m_len, len);
3525 		m->m_len += len;
3526 		noff += len;
3527 		length -= len;
3528 
3529 		if (length > 0 && m->m_len == mlen) {
3530 			MGET(m->m_next, M_NOWAIT, MT_DATA);
3531 			if (m->m_next == NULL) {
3532 				NG_FREE_M(top);
3533 				return (NULL);
3534 			}
3535 
3536 			m = m->m_next;
3537 			m->m_len = 0;
3538 			mlen = MLEN;
3539 		}
3540 
3541 		if (noff == n->m_len) {
3542 			noff = 0;
3543 			n = n->m_next;
3544 
3545 			if (n == NULL)
3546 				n = nextpkt;
3547 
3548 			nextpkt = (n != NULL)? n->m_nextpkt : NULL;
3549 		}
3550 	}
3551 
3552 	if (length < 0)
3553 		panic("%s: length=%d\n", __func__, length);
3554 	if (length > 0 && n == NULL)
3555 		panic("%s: bogus length=%d, n=%p\n", __func__, length, n);
3556 
3557 	return (top);
3558 } /* ng_btsocket_rfcomm_prepare_packet */
3559