1 /*
2  * ng_l2cap_main.c
3  */
4 
5 /*-
6  * Copyright (c) Maksim Yevmenkin <m_evmenkin@yahoo.com>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * $Id: ng_l2cap_main.c,v 1.2 2003/04/28 21:44:59 max Exp $
31  * $FreeBSD: src/sys/netgraph/bluetooth/l2cap/ng_l2cap_main.c,v 1.5 2005/01/07 01:45:43 imp Exp $
32  * $DragonFly: src/sys/netgraph7/bluetooth/l2cap/ng_l2cap_main.c,v 1.2 2008/06/26 23:05:40 dillon Exp $
33  */
34 
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/kernel.h>
38 #include <sys/malloc.h>
39 #include <sys/mbuf.h>
40 #include <sys/queue.h>
41 #include "ng_message.h"
42 #include "netgraph.h"
43 #include "ng_parse.h"
44 #include "bluetooth/include/ng_bluetooth.h"
45 #include "bluetooth/include/ng_hci.h"
46 #include "bluetooth/include/ng_l2cap.h"
47 #include "bluetooth/l2cap/ng_l2cap_var.h"
48 #include "bluetooth/l2cap/ng_l2cap_cmds.h"
49 #include "bluetooth/l2cap/ng_l2cap_evnt.h"
50 #include "bluetooth/l2cap/ng_l2cap_llpi.h"
51 #include "bluetooth/l2cap/ng_l2cap_ulpi.h"
52 #include "bluetooth/l2cap/ng_l2cap_misc.h"
53 #include "bluetooth/l2cap/ng_l2cap_prse.h"
54 
55 /******************************************************************************
56  ******************************************************************************
57  **  This node implements Link Layer Control and Adaptation Protocol (L2CAP)
58  ******************************************************************************
59  ******************************************************************************/
60 
61 /* MALLOC define */
62 #ifdef NG_SEPARATE_MALLOC
63 MALLOC_DEFINE(M_NETGRAPH_L2CAP, "netgraph_l2cap",
64 	"Netgraph Bluetooth L2CAP node");
65 #else
66 #define M_NETGRAPH_L2CAP M_NETGRAPH
67 #endif /* NG_SEPARATE_MALLOC */
68 
69 /* Netgraph node methods */
70 static	ng_constructor_t	ng_l2cap_constructor;
71 static	ng_shutdown_t		ng_l2cap_shutdown;
72 static	ng_newhook_t		ng_l2cap_newhook;
73 static	ng_connect_t		ng_l2cap_connect;
74 static	ng_disconnect_t		ng_l2cap_disconnect;
75 static	ng_rcvmsg_t		ng_l2cap_lower_rcvmsg;
76 static	ng_rcvmsg_t		ng_l2cap_upper_rcvmsg;
77 static	ng_rcvmsg_t		ng_l2cap_default_rcvmsg;
78 static	ng_rcvdata_t		ng_l2cap_rcvdata;
79 
80 /* Netgraph node type descriptor */
81 static	struct ng_type typestruct = {
82 	.version =	NG_ABI_VERSION,
83 	.name =		NG_L2CAP_NODE_TYPE,
84 	.constructor =	ng_l2cap_constructor,
85 	.rcvmsg =	ng_l2cap_default_rcvmsg,
86 	.shutdown =	ng_l2cap_shutdown,
87 	.newhook =	ng_l2cap_newhook,
88 	.connect =	ng_l2cap_connect,
89 	.rcvdata =	ng_l2cap_rcvdata,
90 	.disconnect =	ng_l2cap_disconnect,
91 	.cmdlist =	ng_l2cap_cmdlist,
92 };
93 NETGRAPH_INIT(l2cap, &typestruct);
94 MODULE_VERSION(ng_l2cap, NG_BLUETOOTH_VERSION);
95 MODULE_DEPEND(ng_l2cap, ng_bluetooth, NG_BLUETOOTH_VERSION,
96         NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
97 
98 /*****************************************************************************
99  *****************************************************************************
100  **                   Netgraph methods implementation
101  *****************************************************************************
102  *****************************************************************************/
103 
104 static void ng_l2cap_cleanup          (ng_l2cap_p);
105 static void ng_l2cap_destroy_channels (ng_l2cap_p);
106 
107 /*
108  * Create new instance of L2CAP node
109  */
110 
111 static int
112 ng_l2cap_constructor(node_p node)
113 {
114 	ng_l2cap_p	l2cap = NULL;
115 
116 	/* Create new L2CAP node */
117 	MALLOC(l2cap, ng_l2cap_p, sizeof(*l2cap),
118 		M_NETGRAPH_L2CAP, M_WAITOK | M_NULLOK | M_ZERO);
119 	if (l2cap == NULL)
120 		return (ENOMEM);
121 
122 	l2cap->node = node;
123 	l2cap->debug = NG_L2CAP_WARN_LEVEL;
124 	l2cap->discon_timo = 5; /* sec */
125 
126 	LIST_INIT(&l2cap->con_list);
127 	LIST_INIT(&l2cap->chan_list);
128 
129 	NG_NODE_SET_PRIVATE(node, l2cap);
130 	NG_NODE_FORCE_WRITER(node);
131 
132 	return (0);
133 } /* ng_l2cap_constructor */
134 
135 /*
136  * Shutdown L2CAP node
137  */
138 
139 static int
140 ng_l2cap_shutdown(node_p node)
141 {
142 	ng_l2cap_p	l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
143 
144 	NG_NODE_SET_PRIVATE(node, NULL);
145 	NG_NODE_UNREF(node);
146 
147 	/* Clean up L2CAP node. Delete all connection, channels and commands */
148 	l2cap->node = NULL;
149 	ng_l2cap_cleanup(l2cap);
150 
151 	bzero(l2cap, sizeof(*l2cap));
152 	FREE(l2cap, M_NETGRAPH_L2CAP);
153 
154 	return (0);
155 } /* ng_l2cap_shutdown */
156 
157 /*
158  * Give our OK for a hook to be added. HCI layer is connected to the HCI
159  * (NG_L2CAP_HOOK_HCI) hook. As per specification L2CAP layer MUST provide
160  * Procol/Service Multiplexing, so the L2CAP node provides separate hooks
161  * for SDP (NG_L2CAP_HOOK_SDP), RFCOMM (NG_L2CAP_HOOK_RFCOMM) and TCP
162  * (NG_L2CAP_HOOK_TCP) protcols. Unknown PSM will be forwarded to
163  * NG_L2CAP_HOOK_ORPHAN hook. Control node/application is connected to
164  * control (NG_L2CAP_HOOK_CTL) hook.
165  */
166 
167 static int
168 ng_l2cap_newhook(node_p node, hook_p hook, char const *name)
169 {
170 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
171 	hook_p		*h = NULL;
172 
173 	if (strcmp(name, NG_L2CAP_HOOK_HCI) == 0)
174 		h = &l2cap->hci;
175 	else if (strcmp(name, NG_L2CAP_HOOK_L2C) == 0)
176 		h = &l2cap->l2c;
177 	else if (strcmp(name, NG_L2CAP_HOOK_CTL) == 0)
178 		h = &l2cap->ctl;
179 	else
180 		return (EINVAL);
181 
182 	if (*h != NULL)
183 		return (EISCONN);
184 
185 	*h = hook;
186 
187 	return (0);
188 } /* ng_l2cap_newhook */
189 
190 /*
191  * Give our final OK to connect hook. Nothing to do here.
192  */
193 
194 static int
195 ng_l2cap_connect(hook_p hook)
196 {
197 	ng_l2cap_p	l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
198 	int		error = 0;
199 
200 	if (hook == l2cap->hci)
201 		NG_HOOK_SET_RCVMSG(hook, ng_l2cap_lower_rcvmsg);
202 	else
203 	if (hook == l2cap->l2c || hook == l2cap->ctl) {
204 		NG_HOOK_SET_RCVMSG(hook, ng_l2cap_upper_rcvmsg);
205 
206 		/* Send delayed notification to the upper layer */
207 		error = ng_send_fn(l2cap->node, hook, ng_l2cap_send_hook_info,
208 				NULL, 0);
209 	} else
210 		error = EINVAL;
211 
212 	return (error);
213 } /* ng_l2cap_connect */
214 
215 /*
216  * Disconnect the hook. For downstream hook we must notify upper layers.
217  *
218  * XXX For upstream hooks this is really ugly :( Hook was disconnected and it
219  * XXX is now too late to do anything. For now we just clean up our own mess
220  * XXX and remove all channels that use disconnected upstream hook. If we don't
221  * XXX do that then L2CAP node can get out of sync with upper layers.
222  * XXX No notification will be sent to remote peer.
223  */
224 
225 static int
226 ng_l2cap_disconnect(hook_p hook)
227 {
228 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
229 	hook_p		*h = NULL;
230 
231 	if (hook == l2cap->hci) {
232 		ng_l2cap_cleanup(l2cap);
233 		h = &l2cap->hci;
234 	} else
235 	if (hook == l2cap->l2c) {
236 		ng_l2cap_destroy_channels(l2cap);
237 		h = &l2cap->l2c;
238 	} else
239 	if (hook == l2cap->ctl)
240 		h = &l2cap->ctl;
241 	else
242 		return (EINVAL);
243 
244 	*h = NULL;
245 
246 	/* Shutdown when all hooks are disconnected */
247 	if (NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0 &&
248 	    NG_NODE_IS_VALID(NG_HOOK_NODE(hook)))
249 		ng_rmnode_self(NG_HOOK_NODE(hook));
250 
251 	return (0);
252 } /* ng_l2cap_disconnect */
253 
254 /*
255  * Process control message from lower layer
256  */
257 
258 static int
259 ng_l2cap_lower_rcvmsg(node_p node, item_p item, hook_p lasthook)
260 {
261 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
262 	struct ng_mesg	*msg = NGI_MSG(item); /* item still has message */
263 	int		 error = 0;
264 
265 	switch (msg->header.typecookie) {
266 	case NGM_HCI_COOKIE:
267 		switch (msg->header.cmd) {
268 		/* HCI node is ready */
269 		case NGM_HCI_NODE_UP: {
270 			ng_hci_node_up_ep	*ep = NULL;
271 
272 			if (msg->header.arglen != sizeof(*ep))
273 				error = EMSGSIZE;
274 			else {
275 				ep = (ng_hci_node_up_ep *)(msg->data);
276 
277 				NG_L2CAP_INFO(
278 "%s: %s - HCI node is up, bdaddr: %x:%x:%x:%x:%x:%x, " \
279 "pkt_size=%d bytes, num_pkts=%d\n",	__func__, NG_NODE_NAME(l2cap->node),
280 					ep->bdaddr.b[5], ep->bdaddr.b[4],
281 					ep->bdaddr.b[3], ep->bdaddr.b[2],
282 					ep->bdaddr.b[1], ep->bdaddr.b[0],
283 					ep->pkt_size, ep->num_pkts);
284 
285 				bcopy(&ep->bdaddr, &l2cap->bdaddr,
286 					sizeof(l2cap->bdaddr));
287 				l2cap->pkt_size = ep->pkt_size;
288 				l2cap->num_pkts = ep->num_pkts;
289 
290 				/* Notify upper layers */
291 				ng_l2cap_send_hook_info(l2cap->node,
292 					l2cap->l2c, NULL, 0);
293 				ng_l2cap_send_hook_info(l2cap->node,
294 					l2cap->ctl, NULL, 0);
295 			}
296 			} break;
297 
298 		case NGM_HCI_SYNC_CON_QUEUE: {
299 			ng_hci_sync_con_queue_ep	*ep = NULL;
300 			ng_l2cap_con_p			 con = NULL;
301 
302 			if (msg->header.arglen != sizeof(*ep))
303 				error = EMSGSIZE;
304 			else {
305 				ep = (ng_hci_sync_con_queue_ep *)(msg->data);
306 				con = ng_l2cap_con_by_handle(l2cap,
307 							ep->con_handle);
308 				if (con == NULL)
309 					break;
310 
311 				NG_L2CAP_INFO(
312 "%s: %s - sync HCI connection queue, con_handle=%d, pending=%d, completed=%d\n",
313 					 __func__, NG_NODE_NAME(l2cap->node),
314 					ep->con_handle, con->pending,
315 					ep->completed);
316 
317 				con->pending -= ep->completed;
318 				if (con->pending < 0) {
319 					NG_L2CAP_WARN(
320 "%s: %s - pending packet counter is out of sync! " \
321 "con_handle=%d, pending=%d, completed=%d\n",	__func__,
322 						NG_NODE_NAME(l2cap->node),
323 						con->con_handle, con->pending,
324 						ep->completed);
325 
326 					con->pending = 0;
327 				}
328 
329 				ng_l2cap_lp_deliver(con);
330 			}
331 			} break;
332 
333 		/* LP_ConnectCfm[Neg] */
334 		case NGM_HCI_LP_CON_CFM:
335 			error = ng_l2cap_lp_con_cfm(l2cap, msg);
336 			break;
337 
338 		/* LP_ConnectInd */
339 		case NGM_HCI_LP_CON_IND:
340 			error = ng_l2cap_lp_con_ind(l2cap, msg);
341 			break;
342 
343 		/* LP_DisconnectInd */
344 		case NGM_HCI_LP_DISCON_IND:
345 			error = ng_l2cap_lp_discon_ind(l2cap, msg);
346 			break;
347 
348 		/* LP_QoSSetupCfm[Neg] */
349 		case NGM_HCI_LP_QOS_CFM:
350 			error = ng_l2cap_lp_qos_cfm(l2cap, msg);
351 			break;
352 
353 		/* LP_OoSViolationInd */
354 		case NGM_HCI_LP_QOS_IND:
355 			error = ng_l2cap_lp_qos_ind(l2cap, msg);
356 			break;
357 
358 		default:
359 			error = EINVAL;
360 			break;
361 		}
362 		break;
363 
364 	default:
365 		return (ng_l2cap_default_rcvmsg(node, item, lasthook));
366 		/* NOT REACHED */
367 	}
368 
369 	NG_FREE_ITEM(item);
370 
371 	return (error);
372 } /* ng_l2cap_lower_rcvmsg */
373 
374 /*
375  * Process control message from upper layer
376  */
377 
378 static int
379 ng_l2cap_upper_rcvmsg(node_p node, item_p item, hook_p lasthook)
380 {
381 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
382 	struct ng_mesg	*msg = NGI_MSG(item); /* item still has message */
383 	int		 error = 0;
384 
385 	switch (msg->header.typecookie) {
386 	case NGM_L2CAP_COOKIE:
387 		switch (msg->header.cmd) {
388 		/* L2CA_Connect */
389 		case NGM_L2CAP_L2CA_CON:
390 			error = ng_l2cap_l2ca_con_req(l2cap, msg);
391 			break;
392 
393 		/* L2CA_ConnectRsp */
394 		case NGM_L2CAP_L2CA_CON_RSP:
395 			error = ng_l2cap_l2ca_con_rsp_req(l2cap, msg);
396 			break;
397 
398 		/* L2CA_Config */
399 		case NGM_L2CAP_L2CA_CFG:
400 			error = ng_l2cap_l2ca_cfg_req(l2cap, msg);
401 			break;
402 
403 		/* L2CA_ConfigRsp */
404 		case NGM_L2CAP_L2CA_CFG_RSP:
405 			error = ng_l2cap_l2ca_cfg_rsp_req(l2cap, msg);
406 			break;
407 
408 		/* L2CA_Disconnect */
409 		case NGM_L2CAP_L2CA_DISCON:
410 			error = ng_l2cap_l2ca_discon_req(l2cap, msg);
411 			break;
412 
413 		/* L2CA_GroupCreate */
414 		case NGM_L2CAP_L2CA_GRP_CREATE:
415 			error = ng_l2cap_l2ca_grp_create(l2cap, msg);
416 			break;
417 
418 		/* L2CA_GroupClose */
419 		case NGM_L2CAP_L2CA_GRP_CLOSE:
420 			error = ng_l2cap_l2ca_grp_close(l2cap, msg);
421 			break;
422 
423 		/* L2CA_GroupAddMember */
424 		case NGM_L2CAP_L2CA_GRP_ADD_MEMBER:
425 			error = ng_l2cap_l2ca_grp_add_member_req(l2cap, msg);
426 			break;
427 
428 		/* L2CA_GroupDeleteMember */
429 		case NGM_L2CAP_L2CA_GRP_REM_MEMBER:
430 			error = ng_l2cap_l2ca_grp_rem_member(l2cap, msg);
431 			break;
432 
433 		/* L2CA_GroupMembership */
434 		case NGM_L2CAP_L2CA_GRP_MEMBERSHIP:
435 			error = ng_l2cap_l2ca_grp_get_members(l2cap, msg);
436 			break;
437 
438 		/* L2CA_Ping */
439 		case NGM_L2CAP_L2CA_PING:
440 			error = ng_l2cap_l2ca_ping_req(l2cap, msg);
441 			break;
442 
443 		/* L2CA_GetInfo */
444 		case NGM_L2CAP_L2CA_GET_INFO:
445 			error = ng_l2cap_l2ca_get_info_req(l2cap, msg);
446 			break;
447 
448 		/* L2CA_EnableCLT */
449 		case NGM_L2CAP_L2CA_ENABLE_CLT:
450 			error = ng_l2cap_l2ca_enable_clt(l2cap, msg);
451 			break;
452 
453 		default:
454 			return (ng_l2cap_default_rcvmsg(node, item, lasthook));
455 			/* NOT REACHED */
456 		}
457 		break;
458 
459 	default:
460 		return (ng_l2cap_default_rcvmsg(node, item, lasthook));
461 		/* NOT REACHED */
462 	}
463 
464 	NG_FREE_ITEM(item);
465 
466 	return (error);
467 } /* ng_l2cap_upper_rcvmsg */
468 
469 /*
470  * Default control message processing routine
471  */
472 
473 static int
474 ng_l2cap_default_rcvmsg(node_p node, item_p item, hook_p lasthook)
475 {
476 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
477 	struct ng_mesg	*msg = NULL, *rsp = NULL;
478 	int		 error = 0;
479 
480 	/* Detach and process message */
481 	NGI_GET_MSG(item, msg);
482 
483 	switch (msg->header.typecookie) {
484 	case NGM_GENERIC_COOKIE:
485 		switch (msg->header.cmd) {
486 		case NGM_TEXT_STATUS:
487 			NG_MKRESPONSE(rsp, msg, NG_TEXTRESPONSE, M_WAITOK | M_NULLOK);
488 			if (rsp == NULL)
489 				error = ENOMEM;
490 			else
491 				snprintf(rsp->data, NG_TEXTRESPONSE,
492 					"bdaddr %x:%x:%x:%x:%x:%x, " \
493 					"pkt_size %d\n" \
494 					"Hooks %s %s %s\n" \
495 					"Flags %#x\n",
496 					l2cap->bdaddr.b[5], l2cap->bdaddr.b[4],
497 					l2cap->bdaddr.b[3], l2cap->bdaddr.b[2],
498 					l2cap->bdaddr.b[1], l2cap->bdaddr.b[0],
499 					l2cap->pkt_size,
500 					(l2cap->hci != NULL)?
501 						NG_L2CAP_HOOK_HCI : "",
502 					(l2cap->l2c != NULL)?
503 						NG_L2CAP_HOOK_L2C : "",
504 					(l2cap->ctl != NULL)?
505 						NG_L2CAP_HOOK_CTL : "",
506 					l2cap->flags);
507 			break;
508 
509 		default:
510 			error = EINVAL;
511 			break;
512 		}
513 		break;
514 
515 	/* Messages from the upper layer or directed to the local node */
516 	case NGM_L2CAP_COOKIE:
517 		switch (msg->header.cmd) {
518 		/* Get node flags */
519 		case NGM_L2CAP_NODE_GET_FLAGS:
520 			NG_MKRESPONSE(rsp, msg, sizeof(ng_l2cap_node_flags_ep),
521 				M_WAITOK | M_NULLOK);
522 			if (rsp == NULL)
523 				error = ENOMEM;
524 			else
525 				*((ng_l2cap_node_flags_ep *)(rsp->data)) =
526 					l2cap->flags;
527 			break;
528 
529 		/* Get node debug */
530 		case NGM_L2CAP_NODE_GET_DEBUG:
531 			NG_MKRESPONSE(rsp, msg, sizeof(ng_l2cap_node_debug_ep),
532 				M_WAITOK | M_NULLOK);
533 			if (rsp == NULL)
534 				error = ENOMEM;
535 			else
536 				*((ng_l2cap_node_debug_ep *)(rsp->data)) =
537 					l2cap->debug;
538 			break;
539 
540 		/* Set node debug */
541 		case NGM_L2CAP_NODE_SET_DEBUG:
542 			if (msg->header.arglen !=
543 					sizeof(ng_l2cap_node_debug_ep))
544 				error = EMSGSIZE;
545 			else
546 				l2cap->debug =
547 					*((ng_l2cap_node_debug_ep *)(msg->data));
548 			break;
549 
550 		/* Get connection list */
551 		case NGM_L2CAP_NODE_GET_CON_LIST: {
552 			ng_l2cap_con_p			 con = NULL;
553 			ng_l2cap_node_con_list_ep	*e1 = NULL;
554 			ng_l2cap_node_con_ep		*e2 = NULL;
555 			int				 n = 0;
556 
557 			/* Count number of connections */
558 			LIST_FOREACH(con, &l2cap->con_list, next)
559 				n++;
560 			if (n > NG_L2CAP_MAX_CON_NUM)
561 				n = NG_L2CAP_MAX_CON_NUM;
562 
563 			/* Prepare response */
564 			NG_MKRESPONSE(rsp, msg,
565 				sizeof(*e1) + n * sizeof(*e2), M_WAITOK | M_NULLOK);
566 			if (rsp == NULL) {
567 				error = ENOMEM;
568 				break;
569 			}
570 
571 			e1 = (ng_l2cap_node_con_list_ep *)(rsp->data);
572 			e2 = (ng_l2cap_node_con_ep *)(e1 + 1);
573 
574 			e1->num_connections = n;
575 
576 			LIST_FOREACH(con, &l2cap->con_list, next) {
577 				e2->state = con->state;
578 
579 				e2->flags = con->flags;
580 				if (con->tx_pkt != NULL)
581 					e2->flags |= NG_L2CAP_CON_TX;
582 				if (con->rx_pkt != NULL)
583 					e2->flags |= NG_L2CAP_CON_RX;
584 
585 				e2->pending = con->pending;
586 
587 				e2->con_handle = con->con_handle;
588 				bcopy(&con->remote, &e2->remote,
589 					sizeof(e2->remote));
590 
591 				e2 ++;
592 				if (--n <= 0)
593 					break;
594 			}
595 			} break;
596 
597 		/* Get channel list */
598 		case NGM_L2CAP_NODE_GET_CHAN_LIST: {
599 			ng_l2cap_chan_p			 ch = NULL;
600 			ng_l2cap_node_chan_list_ep	*e1 = NULL;
601 			ng_l2cap_node_chan_ep		*e2 = NULL;
602 			int				 n = 0;
603 
604 			/* Count number of channels */
605 			LIST_FOREACH(ch, &l2cap->chan_list, next)
606 				n ++;
607 			if (n > NG_L2CAP_MAX_CHAN_NUM)
608 				n = NG_L2CAP_MAX_CHAN_NUM;
609 
610 			/* Prepare response */
611 			NG_MKRESPONSE(rsp, msg,
612 				sizeof(ng_l2cap_node_chan_list_ep) +
613 				n * sizeof(ng_l2cap_node_chan_ep), M_WAITOK | M_NULLOK);
614 			if (rsp == NULL) {
615 				error = ENOMEM;
616 				break;
617 			}
618 
619 			e1 = (ng_l2cap_node_chan_list_ep *)(rsp->data);
620 			e2 = (ng_l2cap_node_chan_ep *)(e1 + 1);
621 
622 			e1->num_channels = n;
623 
624 			LIST_FOREACH(ch, &l2cap->chan_list, next) {
625 				e2->state = ch->state;
626 
627 				e2->scid = ch->scid;
628 				e2->dcid = ch->dcid;
629 
630 				e2->imtu = ch->imtu;
631 				e2->omtu = ch->omtu;
632 
633 				e2->psm = ch->psm;
634 				bcopy(&ch->con->remote, &e2->remote,
635 					sizeof(e2->remote));
636 
637 				e2 ++;
638 				if (--n <= 0)
639 					break;
640 			}
641 			} break;
642 
643 		case NGM_L2CAP_NODE_GET_AUTO_DISCON_TIMO:
644 			NG_MKRESPONSE(rsp, msg,
645 				sizeof(ng_l2cap_node_auto_discon_ep), M_WAITOK | M_NULLOK);
646 			if (rsp == NULL)
647 				error = ENOMEM;
648 			else
649 				*((ng_l2cap_node_auto_discon_ep *)(rsp->data)) =
650 					l2cap->discon_timo;
651 			break;
652 
653 		case NGM_L2CAP_NODE_SET_AUTO_DISCON_TIMO:
654 			if (msg->header.arglen !=
655 					sizeof(ng_l2cap_node_auto_discon_ep))
656 				error = EMSGSIZE;
657 			else
658 				l2cap->discon_timo =
659 					*((ng_l2cap_node_auto_discon_ep *)
660 							(msg->data));
661 			break;
662 
663 		default:
664 			error = EINVAL;
665 			break;
666 		}
667 		break;
668 
669 	default:
670 		error = EINVAL;
671 		break;
672 	}
673 
674 	NG_RESPOND_MSG(error, node, item, rsp);
675 	NG_FREE_MSG(msg);
676 
677 	return (error);
678 } /* ng_l2cap_rcvmsg */
679 
680 /*
681  * Process data packet from one of our hooks.
682  *
683  * From the HCI hook we expect to receive ACL data packets. ACL data packets
684  * gets re-assembled into one L2CAP packet (according to length) and then gets
685  * processed.
686  *
687  * NOTE: We expect to receive L2CAP packet header in the first fragment.
688  *       Otherwise we WILL NOT be able to get length of the L2CAP packet.
689  *
690  * Signaling L2CAP packets (destination channel ID == 0x1) are processed within
691  * the node. Connectionless data packets (destination channel ID == 0x2) will
692  * be forwarded to appropriate upstream hook unless it is not connected or
693  * connectionless traffic for the specified PSM was disabled.
694  *
695  * From the upstream hooks we expect to receive data packets. These data
696  * packets will be converted into L2CAP data packets. The length of each
697  * L2CAP packet must not exceed channel's omtu (our peer's imtu). Then
698  * these L2CAP packets will be converted to ACL data packets (according to
699  * HCI layer MTU) and sent to lower layer.
700  *
701  * No data is expected from the control hook.
702  */
703 
704 static int
705 ng_l2cap_rcvdata(hook_p hook, item_p item)
706 {
707 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
708 	struct mbuf	*m = NULL;
709 	int		 error = 0;
710 
711 	/* Detach mbuf, discard item and process data */
712 	NGI_GET_M(item, m);
713 	NG_FREE_ITEM(item);
714 
715 	if (hook == l2cap->hci)
716 		error = ng_l2cap_lp_receive(l2cap, m);
717 	else if (hook == l2cap->l2c)
718 		error = ng_l2cap_l2ca_write_req(l2cap, m);
719 	else {
720 		NG_FREE_M(m);
721 		error = EINVAL;
722 	}
723 
724 	return (error);
725 } /* ng_l2cap_rcvdata */
726 
727 /*
728  * Clean all connections, channels and commands for the L2CAP node
729  */
730 
731 static void
732 ng_l2cap_cleanup(ng_l2cap_p l2cap)
733 {
734 	ng_l2cap_con_p	con = NULL;
735 
736 	/* Clean up connection and channels */
737 	while (!LIST_EMPTY(&l2cap->con_list)) {
738 		con = LIST_FIRST(&l2cap->con_list);
739 
740 		if (con->flags & NG_L2CAP_CON_LP_TIMO)
741 			ng_l2cap_lp_untimeout(con);
742 		else if (con->flags & NG_L2CAP_CON_AUTO_DISCON_TIMO)
743 			ng_l2cap_discon_untimeout(con);
744 
745 		/* Connection terminated by local host */
746 		ng_l2cap_con_fail(con, 0x16);
747 	}
748 } /* ng_l2cap_cleanup */
749 
750 /*
751  * Destroy all channels that use specified upstream hook
752  */
753 
754 static void
755 ng_l2cap_destroy_channels(ng_l2cap_p l2cap)
756 {
757 	while (!LIST_EMPTY(&l2cap->chan_list))
758 		ng_l2cap_free_chan(LIST_FIRST(&l2cap->chan_list));
759 } /* ng_l2cap_destroy_channels_by_hook */
760 
761