1 /*
2  * ng_btsocket_rfcomm.c
3  */
4 
5 /*-
6  * Copyright (c) 2001-2003 Maksim Yevmenkin <m_evmenkin@yahoo.com>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * $Id: ng_btsocket_rfcomm.c,v 1.28 2003/09/14 23:29:06 max Exp $
31  * $FreeBSD: src/sys/netgraph/bluetooth/socket/ng_btsocket_rfcomm.c,v 1.27 2007/10/29 19:06:47 emax Exp $
32  */
33 
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/bitstring.h>
37 #include <sys/domain.h>
38 #include <sys/endian.h>
39 #include <sys/errno.h>
40 #include <sys/filedesc.h>
41 #include <sys/kernel.h>
42 #include <sys/lock.h>
43 #include <sys/malloc.h>
44 #include <sys/mbuf.h>
45 #include <sys/mutex.h>
46 #include <sys/proc.h>
47 #include <sys/protosw.h>
48 #include <sys/queue.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/sysctl.h>
52 #include <sys/taskqueue.h>
53 #include <sys/uio.h>
54 #include "ng_message.h"
55 #include "netgraph.h"
56 #include "bluetooth/include/ng_bluetooth.h"
57 #include "bluetooth/include/ng_hci.h"
58 #include "bluetooth/include/ng_l2cap.h"
59 #include "bluetooth/include/ng_btsocket.h"
60 #include "bluetooth/include/ng_btsocket_l2cap.h"
61 #include "bluetooth/include/ng_btsocket_rfcomm.h"
62 
63 /* MALLOC define */
64 #ifdef NG_SEPARATE_MALLOC
65 MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_RFCOMM, "netgraph_btsocks_rfcomm",
66 		"Netgraph Bluetooth RFCOMM sockets");
67 #else
68 #define M_NETGRAPH_BTSOCKET_RFCOMM M_NETGRAPH
69 #endif /* NG_SEPARATE_MALLOC */
70 
71 /* Debug */
72 #define NG_BTSOCKET_RFCOMM_INFO \
73 	if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_INFO_LEVEL) \
74 		printf
75 
76 #define NG_BTSOCKET_RFCOMM_WARN \
77 	if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_WARN_LEVEL) \
78 		printf
79 
80 #define NG_BTSOCKET_RFCOMM_ERR \
81 	if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_ERR_LEVEL) \
82 		printf
83 
84 #define NG_BTSOCKET_RFCOMM_ALERT \
85 	if (ng_btsocket_rfcomm_debug_level >= NG_BTSOCKET_ALERT_LEVEL) \
86 		printf
87 
88 #define	ALOT	0x7fff
89 
90 /* Local prototypes */
91 static void ng_btsocket_rfcomm_upcall
92 	(struct socket *so, void *arg, int waitflag);
93 static void ng_btsocket_rfcomm_sessions_task
94 	(void *ctx, int pending);
95 static void ng_btsocket_rfcomm_session_task
96 	(ng_btsocket_rfcomm_session_p s);
97 #define ng_btsocket_rfcomm_task_wakeup() \
98 	taskqueue_enqueue(taskqueue_swi_giant, &ng_btsocket_rfcomm_task)
99 
100 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_connect_ind
101 	(ng_btsocket_rfcomm_session_p s, int channel);
102 static void ng_btsocket_rfcomm_connect_cfm
103 	(ng_btsocket_rfcomm_session_p s);
104 
105 static int ng_btsocket_rfcomm_session_create
106 	(ng_btsocket_rfcomm_session_p *sp, struct socket *l2so,
107 	 bdaddr_p src, bdaddr_p dst, struct thread *td);
108 static int ng_btsocket_rfcomm_session_accept
109 	(ng_btsocket_rfcomm_session_p s0);
110 static int ng_btsocket_rfcomm_session_connect
111 	(ng_btsocket_rfcomm_session_p s);
112 static int ng_btsocket_rfcomm_session_receive
113 	(ng_btsocket_rfcomm_session_p s);
114 static int ng_btsocket_rfcomm_session_send
115 	(ng_btsocket_rfcomm_session_p s);
116 static void ng_btsocket_rfcomm_session_clean
117 	(ng_btsocket_rfcomm_session_p s);
118 static void ng_btsocket_rfcomm_session_process_pcb
119 	(ng_btsocket_rfcomm_session_p s);
120 static ng_btsocket_rfcomm_session_p ng_btsocket_rfcomm_session_by_addr
121 	(bdaddr_p src, bdaddr_p dst);
122 
123 static int ng_btsocket_rfcomm_receive_frame
124 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
125 static int ng_btsocket_rfcomm_receive_sabm
126 	(ng_btsocket_rfcomm_session_p s, int dlci);
127 static int ng_btsocket_rfcomm_receive_disc
128 	(ng_btsocket_rfcomm_session_p s, int dlci);
129 static int ng_btsocket_rfcomm_receive_ua
130 	(ng_btsocket_rfcomm_session_p s, int dlci);
131 static int ng_btsocket_rfcomm_receive_dm
132 	(ng_btsocket_rfcomm_session_p s, int dlci);
133 static int ng_btsocket_rfcomm_receive_uih
134 	(ng_btsocket_rfcomm_session_p s, int dlci, int pf, struct mbuf *m0);
135 static int ng_btsocket_rfcomm_receive_mcc
136 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
137 static int ng_btsocket_rfcomm_receive_test
138 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
139 static int ng_btsocket_rfcomm_receive_fc
140 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
141 static int ng_btsocket_rfcomm_receive_msc
142 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
143 static int ng_btsocket_rfcomm_receive_rpn
144 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
145 static int ng_btsocket_rfcomm_receive_rls
146 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
147 static int ng_btsocket_rfcomm_receive_pn
148 	(ng_btsocket_rfcomm_session_p s, struct mbuf *m0);
149 static void ng_btsocket_rfcomm_set_pn
150 	(ng_btsocket_rfcomm_pcb_p pcb, u_int8_t cr, u_int8_t flow_control,
151 	 u_int8_t credits, u_int16_t mtu);
152 
153 static int ng_btsocket_rfcomm_send_command
154 	(ng_btsocket_rfcomm_session_p s, u_int8_t type, u_int8_t dlci);
155 static int ng_btsocket_rfcomm_send_uih
156 	(ng_btsocket_rfcomm_session_p s, u_int8_t address, u_int8_t pf,
157 	 u_int8_t credits, struct mbuf *data);
158 static int ng_btsocket_rfcomm_send_msc
159 	(ng_btsocket_rfcomm_pcb_p pcb);
160 static int ng_btsocket_rfcomm_send_pn
161 	(ng_btsocket_rfcomm_pcb_p pcb);
162 static int ng_btsocket_rfcomm_send_credits
163 	(ng_btsocket_rfcomm_pcb_p pcb);
164 
165 static int ng_btsocket_rfcomm_pcb_send
166 	(ng_btsocket_rfcomm_pcb_p pcb, int limit);
167 static void ng_btsocket_rfcomm_pcb_kill
168 	(ng_btsocket_rfcomm_pcb_p pcb, int error);
169 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_pcb_by_dlci
170 	(ng_btsocket_rfcomm_session_p s, int dlci);
171 static ng_btsocket_rfcomm_pcb_p ng_btsocket_rfcomm_pcb_listener
172 	(bdaddr_p src, int channel);
173 
174 static void ng_btsocket_rfcomm_timeout
175 	(ng_btsocket_rfcomm_pcb_p pcb);
176 static void ng_btsocket_rfcomm_untimeout
177 	(ng_btsocket_rfcomm_pcb_p pcb);
178 static void ng_btsocket_rfcomm_process_timeout
179 	(void *xpcb);
180 
181 static struct mbuf * ng_btsocket_rfcomm_prepare_packet
182 	(struct sockbuf *sb, int length);
183 
184 /* Globals */
185 extern int					ifqmaxlen;
186 static u_int32_t				ng_btsocket_rfcomm_debug_level;
187 static u_int32_t				ng_btsocket_rfcomm_timo;
188 struct task					ng_btsocket_rfcomm_task;
189 static LIST_HEAD(, ng_btsocket_rfcomm_session)	ng_btsocket_rfcomm_sessions;
190 static struct mtx				ng_btsocket_rfcomm_sessions_mtx;
191 static LIST_HEAD(, ng_btsocket_rfcomm_pcb)	ng_btsocket_rfcomm_sockets;
192 static struct mtx				ng_btsocket_rfcomm_sockets_mtx;
193 
194 /* Sysctl tree */
195 SYSCTL_DECL(_net_bluetooth_rfcomm_sockets);
196 SYSCTL_NODE(_net_bluetooth_rfcomm_sockets, OID_AUTO, stream, CTLFLAG_RW,
197 	0, "Bluetooth STREAM RFCOMM sockets family");
198 SYSCTL_INT(_net_bluetooth_rfcomm_sockets_stream, OID_AUTO, debug_level,
199 	CTLFLAG_RW,
200 	&ng_btsocket_rfcomm_debug_level, NG_BTSOCKET_INFO_LEVEL,
201 	"Bluetooth STREAM RFCOMM sockets debug level");
202 SYSCTL_INT(_net_bluetooth_rfcomm_sockets_stream, OID_AUTO, timeout,
203 	CTLFLAG_RW,
204 	&ng_btsocket_rfcomm_timo, 60,
205 	"Bluetooth STREAM RFCOMM sockets timeout");
206 
207 /*****************************************************************************
208  *****************************************************************************
209  **                              RFCOMM CRC
210  *****************************************************************************
211  *****************************************************************************/
212 
213 static u_int8_t	ng_btsocket_rfcomm_crc_table[256] = {
214 	0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
215 	0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
216 	0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
217 	0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
218 
219 	0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
220 	0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
221 	0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
222 	0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
223 
224 	0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
225 	0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
226 	0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
227 	0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
228 
229 	0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
230 	0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
231 	0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
232 	0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
233 
234 	0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
235 	0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
236 	0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
237 	0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
238 
239 	0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
240 	0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
241 	0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
242 	0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
243 
244 	0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
245 	0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
246 	0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
247 	0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
248 
249 	0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
250 	0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
251 	0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
252 	0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
253 };
254 
255 /* CRC */
256 static u_int8_t
257 ng_btsocket_rfcomm_crc(u_int8_t *data, int length)
258 {
259 	u_int8_t	crc = 0xff;
260 
261 	while (length --)
262 		crc = ng_btsocket_rfcomm_crc_table[crc ^ *data++];
263 
264 	return (crc);
265 } /* ng_btsocket_rfcomm_crc */
266 
267 /* FCS on 2 bytes */
268 static u_int8_t
269 ng_btsocket_rfcomm_fcs2(u_int8_t *data)
270 {
271 	return (0xff - ng_btsocket_rfcomm_crc(data, 2));
272 } /* ng_btsocket_rfcomm_fcs2 */
273 
274 /* FCS on 3 bytes */
275 static u_int8_t
276 ng_btsocket_rfcomm_fcs3(u_int8_t *data)
277 {
278 	return (0xff - ng_btsocket_rfcomm_crc(data, 3));
279 } /* ng_btsocket_rfcomm_fcs3 */
280 
281 /*
282  * Check FCS
283  *
284  * From Bluetooth spec
285  *
286  * "... In 07.10, the frame check sequence (FCS) is calculated on different
287  * sets of fields for different frame types. These are the fields that the
288  * FCS are calculated on:
289  *
290  * For SABM, DISC, UA, DM frames: on Address, Control and length field.
291  * For UIH frames: on Address and Control field.
292  *
293  * (This is stated here for clarification, and to set the standard for RFCOMM;
294  * the fields included in FCS calculation have actually changed in version
295  * 7.0.0 of TS 07.10, but RFCOMM will not change the FCS calculation scheme
296  * from the one above.) ..."
297  */
298 
299 static int
300 ng_btsocket_rfcomm_check_fcs(u_int8_t *data, int type, u_int8_t fcs)
301 {
302 	if (type != RFCOMM_FRAME_UIH)
303 		return (ng_btsocket_rfcomm_fcs3(data) != fcs);
304 
305 	return (ng_btsocket_rfcomm_fcs2(data) != fcs);
306 } /* ng_btsocket_rfcomm_check_fcs */
307 
308 /*****************************************************************************
309  *****************************************************************************
310  **                              Socket interface
311  *****************************************************************************
312  *****************************************************************************/
313 
314 /*
315  * Initialize everything
316  */
317 
318 void
319 ng_btsocket_rfcomm_init(void)
320 {
321 	ng_btsocket_rfcomm_debug_level = NG_BTSOCKET_WARN_LEVEL;
322 	ng_btsocket_rfcomm_timo = 60;
323 
324 	/* RFCOMM task */
325 	TASK_INIT(&ng_btsocket_rfcomm_task, 0,
326 		ng_btsocket_rfcomm_sessions_task, NULL);
327 
328 	/* RFCOMM sessions list */
329 	LIST_INIT(&ng_btsocket_rfcomm_sessions);
330 	mtx_init(&ng_btsocket_rfcomm_sessions_mtx,
331 		"btsocks_rfcomm_sessions_mtx", NULL, MTX_DEF);
332 
333 	/* RFCOMM sockets list */
334 	LIST_INIT(&ng_btsocket_rfcomm_sockets);
335 	mtx_init(&ng_btsocket_rfcomm_sockets_mtx,
336 		"btsocks_rfcomm_sockets_mtx", NULL, MTX_DEF);
337 } /* ng_btsocket_rfcomm_init */
338 
339 /*
340  * Abort connection on socket
341  */
342 
343 void
344 ng_btsocket_rfcomm_abort(struct socket *so)
345 {
346 
347 	so->so_error = ECONNABORTED;
348 	(void)ng_btsocket_rfcomm_disconnect(so);
349 } /* ng_btsocket_rfcomm_abort */
350 
351 void
352 ng_btsocket_rfcomm_close(struct socket *so)
353 {
354 
355 	(void)ng_btsocket_rfcomm_disconnect(so);
356 } /* ng_btsocket_rfcomm_close */
357 
358 /*
359  * Accept connection on socket. Nothing to do here, socket must be connected
360  * and ready, so just return peer address and be done with it.
361  */
362 
363 int
364 ng_btsocket_rfcomm_accept(struct socket *so, struct sockaddr **nam)
365 {
366 	return (ng_btsocket_rfcomm_peeraddr(so, nam));
367 } /* ng_btsocket_rfcomm_accept */
368 
369 /*
370  * Create and attach new socket
371  */
372 
373 int
374 ng_btsocket_rfcomm_attach(struct socket *so, int proto, struct thread *td)
375 {
376 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
377 	int				error;
378 
379 	/* Check socket and protocol */
380 	if (so->so_type != SOCK_STREAM)
381 		return (ESOCKTNOSUPPORT);
382 
383 #if 0 /* XXX sonewconn() calls "pru_attach" with proto == 0 */
384 	if (proto != 0)
385 		if (proto != BLUETOOTH_PROTO_RFCOMM)
386 			return (EPROTONOSUPPORT);
387 #endif /* XXX */
388 
389 	if (pcb != NULL)
390 		return (EISCONN);
391 
392 	/* Reserve send and receive space if it is not reserved yet */
393 	if ((so->so_snd.sb_hiwat == 0) || (so->so_rcv.sb_hiwat == 0)) {
394 		error = soreserve(so, NG_BTSOCKET_RFCOMM_SENDSPACE,
395 					NG_BTSOCKET_RFCOMM_RECVSPACE);
396 		if (error != 0)
397 			return (error);
398 	}
399 
400 	/* Allocate the PCB */
401         pcb = kmalloc(sizeof(*pcb), M_NETGRAPH_BTSOCKET_RFCOMM,
402 		      M_WAITOK | M_NULLOK | M_ZERO);
403         if (pcb == NULL)
404                 return (ENOMEM);
405 
406 	/* Link the PCB and the socket */
407 	so->so_pcb = (caddr_t) pcb;
408 	pcb->so = so;
409 
410 	/* Initialize PCB */
411 	pcb->state = NG_BTSOCKET_RFCOMM_DLC_CLOSED;
412 	pcb->flags = NG_BTSOCKET_RFCOMM_DLC_CFC;
413 
414 	pcb->lmodem =
415 	pcb->rmodem = (RFCOMM_MODEM_RTC | RFCOMM_MODEM_RTR | RFCOMM_MODEM_DV);
416 
417 	pcb->mtu = RFCOMM_DEFAULT_MTU;
418 	pcb->tx_cred = 0;
419 	pcb->rx_cred = RFCOMM_DEFAULT_CREDITS;
420 
421 	mtx_init(&pcb->pcb_mtx, "btsocks_rfcomm_pcb_mtx", NULL, MTX_DEF);
422 	callout_handle_init(&pcb->timo);
423 
424 	/* Add the PCB to the list */
425 	mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
426 	LIST_INSERT_HEAD(&ng_btsocket_rfcomm_sockets, pcb, next);
427 	mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
428 
429         return (0);
430 } /* ng_btsocket_rfcomm_attach */
431 
432 /*
433  * Bind socket
434  */
435 
436 int
437 ng_btsocket_rfcomm_bind(struct socket *so, struct sockaddr *nam,
438 		struct thread *td)
439 {
440 	ng_btsocket_rfcomm_pcb_t	*pcb = so2rfcomm_pcb(so), *pcb1;
441 	struct sockaddr_rfcomm		*sa = (struct sockaddr_rfcomm *) nam;
442 
443 	if (pcb == NULL)
444 		return (EINVAL);
445 
446 	/* Verify address */
447 	if (sa == NULL)
448 		return (EINVAL);
449 	if (sa->rfcomm_family != AF_BLUETOOTH)
450 		return (EAFNOSUPPORT);
451 	if (sa->rfcomm_len != sizeof(*sa))
452 		return (EINVAL);
453 	if (sa->rfcomm_channel > 30)
454 		return (EINVAL);
455 
456 	mtx_lock(&pcb->pcb_mtx);
457 
458 	if (sa->rfcomm_channel != 0) {
459 		mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
460 
461 		LIST_FOREACH(pcb1, &ng_btsocket_rfcomm_sockets, next) {
462 			if (pcb1->channel == sa->rfcomm_channel &&
463 			    bcmp(&pcb1->src, &sa->rfcomm_bdaddr,
464 					sizeof(pcb1->src)) == 0) {
465 				mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
466 				mtx_unlock(&pcb->pcb_mtx);
467 
468 				return (EADDRINUSE);
469 			}
470 		}
471 
472 		mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
473 	}
474 
475 	bcopy(&sa->rfcomm_bdaddr, &pcb->src, sizeof(pcb->src));
476 	pcb->channel = sa->rfcomm_channel;
477 
478 	mtx_unlock(&pcb->pcb_mtx);
479 
480 	return (0);
481 } /* ng_btsocket_rfcomm_bind */
482 
483 /*
484  * Connect socket
485  */
486 
487 int
488 ng_btsocket_rfcomm_connect(struct socket *so, struct sockaddr *nam,
489 		struct thread *td)
490 {
491 	ng_btsocket_rfcomm_pcb_t	*pcb = so2rfcomm_pcb(so);
492 	struct sockaddr_rfcomm		*sa = (struct sockaddr_rfcomm *) nam;
493 	ng_btsocket_rfcomm_session_t	*s = NULL;
494 	struct socket			*l2so = NULL;
495 	int				 dlci, error = 0;
496 
497 	if (pcb == NULL)
498 		return (EINVAL);
499 
500 	/* Verify address */
501 	if (sa == NULL)
502 		return (EINVAL);
503 	if (sa->rfcomm_family != AF_BLUETOOTH)
504 		return (EAFNOSUPPORT);
505 	if (sa->rfcomm_len != sizeof(*sa))
506 		return (EINVAL);
507 	if (sa->rfcomm_channel > 30)
508 		return (EINVAL);
509 	if (sa->rfcomm_channel == 0 ||
510 	    bcmp(&sa->rfcomm_bdaddr, NG_HCI_BDADDR_ANY, sizeof(bdaddr_t)) == 0)
511 		return (EDESTADDRREQ);
512 
513 	/*
514 	 * XXX FIXME - This is FUBAR. socreate() will call soalloc(1), i.e.
515 	 * soalloc() is allowed to sleep in MALLOC. This creates "could sleep"
516 	 * WITNESS warnings. To work around this problem we will create L2CAP
517 	 * socket first and then check if we actually need it. Note that we
518 	 * will not check for errors in socreate() because if we failed to
519 	 * create L2CAP socket at this point we still might have already open
520 	 * session.
521 	 */
522 
523 	error = socreate(PF_BLUETOOTH, &l2so, SOCK_SEQPACKET,
524 			BLUETOOTH_PROTO_L2CAP, td->td_ucred, td);
525 
526 	/*
527 	 * Look for session between "pcb->src" and "sa->rfcomm_bdaddr" (dst)
528 	 */
529 
530 	mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
531 
532 	s = ng_btsocket_rfcomm_session_by_addr(&pcb->src, &sa->rfcomm_bdaddr);
533 	if (s == NULL) {
534 		/*
535 		 * We need to create new RFCOMM session. Check if we have L2CAP
536 		 * socket. If l2so == NULL then error has the error code from
537 		 * socreate()
538 		 */
539 
540 		if (l2so == NULL) {
541 			mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
542 			return (error);
543 		}
544 
545 		error = ng_btsocket_rfcomm_session_create(&s, l2so,
546 				&pcb->src, &sa->rfcomm_bdaddr, td);
547 		if (error != 0) {
548 			mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
549 			soclose(l2so);
550 
551 			return (error);
552 		}
553 	} else if (l2so != NULL)
554 		soclose(l2so); /* we don't need new L2CAP socket */
555 
556 	/*
557 	 * Check if we already have the same DLCI the the same session
558 	 */
559 
560 	mtx_lock(&s->session_mtx);
561 	mtx_lock(&pcb->pcb_mtx);
562 
563 	dlci = RFCOMM_MKDLCI(!INITIATOR(s), sa->rfcomm_channel);
564 
565 	if (ng_btsocket_rfcomm_pcb_by_dlci(s, dlci) != NULL) {
566 		mtx_unlock(&pcb->pcb_mtx);
567 		mtx_unlock(&s->session_mtx);
568 		mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
569 
570 		return (EBUSY);
571 	}
572 
573 	/*
574 	 * Check session state and if its not acceptable then refuse connection
575 	 */
576 
577 	switch (s->state) {
578 	case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
579 	case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
580 	case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
581 		/*
582 		 * Update destination address and channel and attach
583 		 * DLC to the session
584 		 */
585 
586 		bcopy(&sa->rfcomm_bdaddr, &pcb->dst, sizeof(pcb->dst));
587 		pcb->channel = sa->rfcomm_channel;
588 		pcb->dlci = dlci;
589 
590 		LIST_INSERT_HEAD(&s->dlcs, pcb, session_next);
591 		pcb->session = s;
592 
593 		ng_btsocket_rfcomm_timeout(pcb);
594 		soisconnecting(pcb->so);
595 
596 		if (s->state == NG_BTSOCKET_RFCOMM_SESSION_OPEN) {
597 			pcb->mtu = s->mtu;
598 			bcopy(&so2l2cap_pcb(s->l2so)->src, &pcb->src,
599 				sizeof(pcb->src));
600 
601 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONFIGURING;
602 
603 			error = ng_btsocket_rfcomm_send_pn(pcb);
604 			if (error == 0)
605 				error = ng_btsocket_rfcomm_task_wakeup();
606 		} else
607 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT;
608 		break;
609 
610 	default:
611 		error = ECONNRESET;
612 		break;
613 	}
614 
615 	mtx_unlock(&pcb->pcb_mtx);
616 	mtx_unlock(&s->session_mtx);
617 	mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
618 
619 	return (error);
620 } /* ng_btsocket_rfcomm_connect */
621 
622 /*
623  * Process ioctl's calls on socket.
624  * XXX FIXME this should provide interface to the RFCOMM multiplexor channel
625  */
626 
627 int
628 ng_btsocket_rfcomm_control(struct socket *so, u_long cmd, caddr_t data,
629 		struct ifnet *ifp, struct thread *td)
630 {
631 	return (EINVAL);
632 } /* ng_btsocket_rfcomm_control */
633 
634 /*
635  * Process getsockopt/setsockopt system calls
636  */
637 
638 int
639 ng_btsocket_rfcomm_ctloutput(struct socket *so, struct sockopt *sopt)
640 {
641 	ng_btsocket_rfcomm_pcb_p		pcb = so2rfcomm_pcb(so);
642 	struct ng_btsocket_rfcomm_fc_info	fcinfo;
643 	int					error = 0;
644 
645 	if (pcb == NULL)
646 		return (EINVAL);
647 	if (sopt->sopt_level != SOL_RFCOMM)
648 		return (0);
649 
650 	mtx_lock(&pcb->pcb_mtx);
651 
652 	switch (sopt->sopt_dir) {
653 	case SOPT_GET:
654 		switch (sopt->sopt_name) {
655 		case SO_RFCOMM_MTU:
656 			error = sooptcopyout(sopt, &pcb->mtu, sizeof(pcb->mtu));
657 			break;
658 
659 		case SO_RFCOMM_FC_INFO:
660 			fcinfo.lmodem = pcb->lmodem;
661 			fcinfo.rmodem = pcb->rmodem;
662 			fcinfo.tx_cred = pcb->tx_cred;
663 			fcinfo.rx_cred = pcb->rx_cred;
664 			fcinfo.cfc = (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)?
665 				1 : 0;
666 			fcinfo.reserved = 0;
667 
668 			error = sooptcopyout(sopt, &fcinfo, sizeof(fcinfo));
669 			break;
670 
671 		default:
672 			error = ENOPROTOOPT;
673 			break;
674 		}
675 		break;
676 
677 	case SOPT_SET:
678 		switch (sopt->sopt_name) {
679 		default:
680 			error = ENOPROTOOPT;
681 			break;
682 		}
683 		break;
684 
685 	default:
686 		error = EINVAL;
687 		break;
688 	}
689 
690 	mtx_unlock(&pcb->pcb_mtx);
691 
692 	return (error);
693 } /* ng_btsocket_rfcomm_ctloutput */
694 
695 /*
696  * Detach and destroy socket
697  */
698 
699 void
700 ng_btsocket_rfcomm_detach(struct socket *so)
701 {
702 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
703 
704 	KASSERT(pcb != NULL, ("ng_btsocket_rfcomm_detach: pcb == NULL"));
705 
706 	mtx_lock(&pcb->pcb_mtx);
707 
708 	so->so_pcb = NULL;
709 
710 	switch (pcb->state) {
711 	case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
712 	case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
713 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
714 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
715 		/* XXX What to do with pending request? */
716 		if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
717 			ng_btsocket_rfcomm_untimeout(pcb);
718 
719 		if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT)
720 			pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_DETACHED;
721 		else
722 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
723 
724 		ng_btsocket_rfcomm_task_wakeup();
725 		break;
726 
727 	case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
728 		ng_btsocket_rfcomm_task_wakeup();
729 		break;
730 	}
731 
732 	while (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CLOSED)
733 		msleep(&pcb->state, &pcb->pcb_mtx, PZERO, "rf_det", 0);
734 
735 	if (pcb->session != NULL)
736 		panic("%s: pcb->session != NULL", __func__);
737 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
738 		panic("%s: timeout on closed DLC, flags=%#x",
739 			__func__, pcb->flags);
740 
741 	mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
742 	LIST_REMOVE(pcb, next);
743 	mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
744 
745 	mtx_unlock(&pcb->pcb_mtx);
746 
747 	mtx_destroy(&pcb->pcb_mtx);
748 	bzero(pcb, sizeof(*pcb));
749 	kfree(pcb, M_NETGRAPH_BTSOCKET_RFCOMM);
750 
751 	soisdisconnected(so);
752 	sofree(so);		/* for so_pcb = NULL */
753 } /* ng_btsocket_rfcomm_detach */
754 
755 /*
756  * Disconnect socket
757  */
758 
759 int
760 ng_btsocket_rfcomm_disconnect(struct socket *so)
761 {
762 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
763 
764 	if (pcb == NULL)
765 		return (EINVAL);
766 
767 	mtx_lock(&pcb->pcb_mtx);
768 
769 	if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING) {
770 		mtx_unlock(&pcb->pcb_mtx);
771 		return (EINPROGRESS);
772 	}
773 
774 	/* XXX What to do with pending request? */
775 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
776 		ng_btsocket_rfcomm_untimeout(pcb);
777 
778 	switch (pcb->state) {
779 	case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING: /* XXX can we get here? */
780 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTING: /* XXX can we get here? */
781 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
782 
783 		/*
784 		 * Just change DLC state and enqueue RFCOMM task. It will
785 		 * queue and send DISC on the DLC.
786 		 */
787 
788 		pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
789 		soisdisconnecting(so);
790 
791 		ng_btsocket_rfcomm_task_wakeup();
792 		break;
793 
794 	case NG_BTSOCKET_RFCOMM_DLC_CLOSED:
795 	case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
796 		break;
797 
798 	default:
799 		panic("%s: Invalid DLC state=%d, flags=%#x",
800 			__func__, pcb->state, pcb->flags);
801 		break;
802 	}
803 
804 	mtx_unlock(&pcb->pcb_mtx);
805 
806 	return (0);
807 } /* ng_btsocket_rfcomm_disconnect */
808 
809 /*
810  * Listen on socket. First call to listen() will create listening RFCOMM session
811  */
812 
813 int
814 ng_btsocket_rfcomm_listen(struct socket *so, int backlog, struct thread *td)
815 {
816 	ng_btsocket_rfcomm_pcb_p	 pcb = so2rfcomm_pcb(so), pcb1;
817 	ng_btsocket_rfcomm_session_p	 s = NULL;
818 	struct socket			*l2so = NULL;
819 	int				 error, socreate_error, usedchannels;
820 
821 	if (pcb == NULL)
822 		return (EINVAL);
823 	if (pcb->channel > 30)
824 		return (EADDRNOTAVAIL);
825 
826 	usedchannels = 0;
827 
828 	mtx_lock(&pcb->pcb_mtx);
829 
830 	if (pcb->channel == 0) {
831 		mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
832 
833 		LIST_FOREACH(pcb1, &ng_btsocket_rfcomm_sockets, next)
834 			if (pcb1->channel != 0 &&
835 			    bcmp(&pcb1->src, &pcb->src, sizeof(pcb->src)) == 0)
836 				usedchannels |= (1 << (pcb1->channel - 1));
837 
838 		for (pcb->channel = 30; pcb->channel > 0; pcb->channel --)
839 			if (!(usedchannels & (1 << (pcb->channel - 1))))
840 				break;
841 
842 		if (pcb->channel == 0) {
843 			mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
844 			mtx_unlock(&pcb->pcb_mtx);
845 
846 			return (EADDRNOTAVAIL);
847 		}
848 
849 		mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
850 	}
851 
852 	mtx_unlock(&pcb->pcb_mtx);
853 
854 	/*
855 	 * XXX FIXME - This is FUBAR. socreate() will call soalloc(1), i.e.
856 	 * soalloc() is allowed to sleep in MALLOC. This creates "could sleep"
857 	 * WITNESS warnings. To work around this problem we will create L2CAP
858 	 * socket first and then check if we actually need it. Note that we
859 	 * will not check for errors in socreate() because if we failed to
860 	 * create L2CAP socket at this point we still might have already open
861 	 * session.
862 	 */
863 
864 	socreate_error = socreate(PF_BLUETOOTH, &l2so, SOCK_SEQPACKET,
865 			BLUETOOTH_PROTO_L2CAP, td->td_ucred, td);
866 
867 	/*
868 	 * Transition the socket and session into the LISTENING state.  Check
869 	 * for collisions first, as there can only be one.
870 	 */
871 	mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
872 	SOCK_LOCK(so);
873 	error = solisten_proto_check(so);
874 	SOCK_UNLOCK(so);
875 	if (error != 0)
876 		goto out;
877 
878 	LIST_FOREACH(s, &ng_btsocket_rfcomm_sessions, next)
879 		if (s->state == NG_BTSOCKET_RFCOMM_SESSION_LISTENING)
880 			break;
881 
882 	if (s == NULL) {
883 		/*
884 		 * We need to create default RFCOMM session. Check if we have
885 		 * L2CAP socket. If l2so == NULL then error has the error code
886 		 * from socreate()
887 		 */
888 		if (l2so == NULL) {
889 			error = socreate_error;
890 			goto out;
891 		}
892 
893 		/*
894 		 * Create default listen RFCOMM session. The default RFCOMM
895 		 * session will listen on ANY address.
896 		 *
897 		 * XXX FIXME Note that currently there is no way to adjust MTU
898 		 * for the default session.
899 		 */
900 		error = ng_btsocket_rfcomm_session_create(&s, l2so,
901 					NG_HCI_BDADDR_ANY, NULL, td);
902 		if (error != 0)
903 			goto out;
904 		l2so = NULL;
905 	}
906 	SOCK_LOCK(so);
907 	solisten_proto(so, backlog);
908 	SOCK_UNLOCK(so);
909 out:
910 	mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
911 	/*
912 	 * If we still have an l2so reference here, it's unneeded, so release
913 	 * it.
914 	 */
915 	if (l2so != NULL)
916 		soclose(l2so);
917 	return (error);
918 } /* ng_btsocket_listen */
919 
920 /*
921  * Get peer address
922  */
923 
924 int
925 ng_btsocket_rfcomm_peeraddr(struct socket *so, struct sockaddr **nam)
926 {
927 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
928 	struct sockaddr_rfcomm		sa;
929 
930 	if (pcb == NULL)
931 		return (EINVAL);
932 
933 	bcopy(&pcb->dst, &sa.rfcomm_bdaddr, sizeof(sa.rfcomm_bdaddr));
934 	sa.rfcomm_channel = pcb->channel;
935 	sa.rfcomm_len = sizeof(sa);
936 	sa.rfcomm_family = AF_BLUETOOTH;
937 
938 	*nam = sodupsockaddr((struct sockaddr *) &sa, M_WAITOK | M_NULLOK);
939 
940 	return ((*nam == NULL)? ENOMEM : 0);
941 } /* ng_btsocket_rfcomm_peeraddr */
942 
943 /*
944  * Send data to socket
945  */
946 
947 int
948 ng_btsocket_rfcomm_send(struct socket *so, int flags, struct mbuf *m,
949 		struct sockaddr *nam, struct mbuf *control, struct thread *td)
950 {
951 	ng_btsocket_rfcomm_pcb_t	*pcb = so2rfcomm_pcb(so);
952 	int				 error = 0;
953 
954 	/* Check socket and input */
955 	if (pcb == NULL || m == NULL || control != NULL) {
956 		error = EINVAL;
957 		goto drop;
958 	}
959 
960 	mtx_lock(&pcb->pcb_mtx);
961 
962 	/* Make sure DLC is connected */
963 	if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
964 		mtx_unlock(&pcb->pcb_mtx);
965 		error = ENOTCONN;
966 		goto drop;
967 	}
968 
969 	/* Put the packet on the socket's send queue and wakeup RFCOMM task */
970 	sbappend(&pcb->so->so_snd, m);
971 	m = NULL;
972 
973 	if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_SENDING)) {
974 		pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_SENDING;
975 		error = ng_btsocket_rfcomm_task_wakeup();
976 	}
977 
978 	mtx_unlock(&pcb->pcb_mtx);
979 drop:
980 	NG_FREE_M(m); /* checks for != NULL */
981 	NG_FREE_M(control);
982 
983 	return (error);
984 } /* ng_btsocket_rfcomm_send */
985 
986 /*
987  * Get socket address
988  */
989 
990 int
991 ng_btsocket_rfcomm_sockaddr(struct socket *so, struct sockaddr **nam)
992 {
993 	ng_btsocket_rfcomm_pcb_p	pcb = so2rfcomm_pcb(so);
994 	struct sockaddr_rfcomm		sa;
995 
996 	if (pcb == NULL)
997 		return (EINVAL);
998 
999 	bcopy(&pcb->src, &sa.rfcomm_bdaddr, sizeof(sa.rfcomm_bdaddr));
1000 	sa.rfcomm_channel = pcb->channel;
1001 	sa.rfcomm_len = sizeof(sa);
1002 	sa.rfcomm_family = AF_BLUETOOTH;
1003 
1004 	*nam = sodupsockaddr((struct sockaddr *) &sa, M_WAITOK | M_NULLOK);
1005 
1006 	return ((*nam == NULL)? ENOMEM : 0);
1007 } /* ng_btsocket_rfcomm_sockaddr */
1008 
1009 /*
1010  * Upcall function for L2CAP sockets. Enqueue RFCOMM task.
1011  */
1012 
1013 static void
1014 ng_btsocket_rfcomm_upcall(struct socket *so, void *arg, int waitflag)
1015 {
1016 	int	error;
1017 
1018 	if (so == NULL)
1019 		panic("%s: so == NULL", __func__);
1020 
1021 	if ((error = ng_btsocket_rfcomm_task_wakeup()) != 0)
1022 		NG_BTSOCKET_RFCOMM_ALERT(
1023 "%s: Could not enqueue RFCOMM task, error=%d\n", __func__, error);
1024 } /* ng_btsocket_rfcomm_upcall */
1025 
1026 /*
1027  * RFCOMM task. Will handle all RFCOMM sessions in one pass.
1028  * XXX FIXME does not scale very well
1029  */
1030 
1031 static void
1032 ng_btsocket_rfcomm_sessions_task(void *ctx, int pending)
1033 {
1034 	ng_btsocket_rfcomm_session_p	s = NULL, s_next = NULL;
1035 
1036 	mtx_lock(&ng_btsocket_rfcomm_sessions_mtx);
1037 
1038 	for (s = LIST_FIRST(&ng_btsocket_rfcomm_sessions); s != NULL; ) {
1039 		mtx_lock(&s->session_mtx);
1040 		s_next = LIST_NEXT(s, next);
1041 
1042 		ng_btsocket_rfcomm_session_task(s);
1043 
1044 		if (s->state == NG_BTSOCKET_RFCOMM_SESSION_CLOSED) {
1045 			/* Unlink and clean the session */
1046 			LIST_REMOVE(s, next);
1047 
1048 			NG_BT_MBUFQ_DRAIN(&s->outq);
1049 			if (!LIST_EMPTY(&s->dlcs))
1050 				panic("%s: DLC list is not empty", __func__);
1051 
1052 			/* Close L2CAP socket */
1053 			s->l2so->so_upcallarg = NULL;
1054 			s->l2so->so_upcall = NULL;
1055 			SOCKBUF_LOCK(&s->l2so->so_rcv);
1056 			s->l2so->so_rcv.sb_flags &= ~SB_UPCALL;
1057 			SOCKBUF_UNLOCK(&s->l2so->so_rcv);
1058 			SOCKBUF_LOCK(&s->l2so->so_snd);
1059 			s->l2so->so_snd.sb_flags &= ~SB_UPCALL;
1060 			SOCKBUF_UNLOCK(&s->l2so->so_snd);
1061 			soclose(s->l2so);
1062 
1063 			mtx_unlock(&s->session_mtx);
1064 
1065 			mtx_destroy(&s->session_mtx);
1066 			bzero(s, sizeof(*s));
1067 			kfree(s, M_NETGRAPH_BTSOCKET_RFCOMM);
1068 		} else
1069 			mtx_unlock(&s->session_mtx);
1070 
1071 		s = s_next;
1072 	}
1073 
1074 	mtx_unlock(&ng_btsocket_rfcomm_sessions_mtx);
1075 } /* ng_btsocket_rfcomm_sessions_task */
1076 
1077 /*
1078  * Process RFCOMM session. Will handle all RFCOMM sockets in one pass.
1079  */
1080 
1081 static void
1082 ng_btsocket_rfcomm_session_task(ng_btsocket_rfcomm_session_p s)
1083 {
1084 	mtx_assert(&s->session_mtx, MA_OWNED);
1085 
1086 	if (s->l2so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1087 		NG_BTSOCKET_RFCOMM_INFO(
1088 "%s: L2CAP connection has been terminated, so=%p, so_state=%#x, so_count=%d, " \
1089 "state=%d, flags=%#x\n", __func__, s->l2so, s->l2so->so_state,
1090 			s->l2so->so_count, s->state, s->flags);
1091 
1092 		s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1093 		ng_btsocket_rfcomm_session_clean(s);
1094 	}
1095 
1096 	/* Now process upcall */
1097 	switch (s->state) {
1098 	/* Try to accept new L2CAP connection(s) */
1099 	case NG_BTSOCKET_RFCOMM_SESSION_LISTENING:
1100 		while (ng_btsocket_rfcomm_session_accept(s) == 0)
1101 			;
1102 		break;
1103 
1104 	/* Process the results of the L2CAP connect */
1105 	case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
1106 		ng_btsocket_rfcomm_session_process_pcb(s);
1107 
1108 		if (ng_btsocket_rfcomm_session_connect(s) != 0) {
1109 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1110 			ng_btsocket_rfcomm_session_clean(s);
1111 		}
1112 		break;
1113 
1114 	/* Try to receive/send more data */
1115 	case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
1116 	case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
1117 	case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
1118 		ng_btsocket_rfcomm_session_process_pcb(s);
1119 
1120 		if (ng_btsocket_rfcomm_session_receive(s) != 0) {
1121 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1122 			ng_btsocket_rfcomm_session_clean(s);
1123 		} else if (ng_btsocket_rfcomm_session_send(s) != 0) {
1124 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1125 			ng_btsocket_rfcomm_session_clean(s);
1126 		}
1127 		break;
1128 
1129 	case NG_BTSOCKET_RFCOMM_SESSION_CLOSED:
1130 		break;
1131 
1132 	default:
1133 		panic("%s: Invalid session state=%d, flags=%#x",
1134 			__func__, s->state, s->flags);
1135 		break;
1136 	}
1137 } /* ng_btsocket_rfcomm_session_task */
1138 
1139 /*
1140  * Process RFCOMM connection indicator. Caller must hold s->session_mtx
1141  */
1142 
1143 static ng_btsocket_rfcomm_pcb_p
1144 ng_btsocket_rfcomm_connect_ind(ng_btsocket_rfcomm_session_p s, int channel)
1145 {
1146 	ng_btsocket_rfcomm_pcb_p	 pcb = NULL, pcb1 = NULL;
1147 	ng_btsocket_l2cap_pcb_p		 l2pcb = NULL;
1148 	struct socket			*so1 = NULL;
1149 
1150 	mtx_assert(&s->session_mtx, MA_OWNED);
1151 
1152 	/*
1153 	 * Try to find RFCOMM socket that listens on given source address
1154 	 * and channel. This will return the best possible match.
1155 	 */
1156 
1157 	l2pcb = so2l2cap_pcb(s->l2so);
1158 	pcb = ng_btsocket_rfcomm_pcb_listener(&l2pcb->src, channel);
1159 	if (pcb == NULL)
1160 		return (NULL);
1161 
1162 	/*
1163 	 * Check the pending connections queue and if we have space then
1164 	 * create new socket and set proper source and destination address,
1165 	 * and channel.
1166 	 */
1167 
1168 	mtx_lock(&pcb->pcb_mtx);
1169 
1170 	if (pcb->so->so_qlen <= pcb->so->so_qlimit)
1171 		so1 = sonewconn(pcb->so, 0);
1172 
1173 	mtx_unlock(&pcb->pcb_mtx);
1174 
1175 	if (so1 == NULL)
1176 		return (NULL);
1177 
1178 	/*
1179 	 * If we got here than we have created new socket. So complete the
1180 	 * connection. Set source and destination address from the session.
1181 	 */
1182 
1183 	pcb1 = so2rfcomm_pcb(so1);
1184 	if (pcb1 == NULL)
1185 		panic("%s: pcb1 == NULL", __func__);
1186 
1187 	mtx_lock(&pcb1->pcb_mtx);
1188 
1189 	bcopy(&l2pcb->src, &pcb1->src, sizeof(pcb1->src));
1190 	bcopy(&l2pcb->dst, &pcb1->dst, sizeof(pcb1->dst));
1191 	pcb1->channel = channel;
1192 
1193 	/* Link new DLC to the session. We already hold s->session_mtx */
1194 	LIST_INSERT_HEAD(&s->dlcs, pcb1, session_next);
1195 	pcb1->session = s;
1196 
1197 	mtx_unlock(&pcb1->pcb_mtx);
1198 
1199 	return (pcb1);
1200 } /* ng_btsocket_rfcomm_connect_ind */
1201 
1202 /*
1203  * Process RFCOMM connect confirmation. Caller must hold s->session_mtx.
1204  */
1205 
1206 static void
1207 ng_btsocket_rfcomm_connect_cfm(ng_btsocket_rfcomm_session_p s)
1208 {
1209 	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
1210 	int				error;
1211 
1212 	mtx_assert(&s->session_mtx, MA_OWNED);
1213 
1214 	/*
1215 	 * Wake up all waiting sockets and send PN request for each of them.
1216 	 * Note that timeout already been set in ng_btsocket_rfcomm_connect()
1217 	 *
1218 	 * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1219 	 * will unlink DLC from the session
1220 	 */
1221 
1222 	for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1223 		mtx_lock(&pcb->pcb_mtx);
1224 		pcb_next = LIST_NEXT(pcb, session_next);
1225 
1226 		if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT) {
1227 			pcb->mtu = s->mtu;
1228 			bcopy(&so2l2cap_pcb(s->l2so)->src, &pcb->src,
1229 				sizeof(pcb->src));
1230 
1231 			error = ng_btsocket_rfcomm_send_pn(pcb);
1232 			if (error == 0)
1233 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONFIGURING;
1234 			else
1235 				ng_btsocket_rfcomm_pcb_kill(pcb, error);
1236 		}
1237 
1238 		mtx_unlock(&pcb->pcb_mtx);
1239 		pcb = pcb_next;
1240 	}
1241 } /* ng_btsocket_rfcomm_connect_cfm */
1242 
1243 /*****************************************************************************
1244  *****************************************************************************
1245  **                              RFCOMM sessions
1246  *****************************************************************************
1247  *****************************************************************************/
1248 
1249 /*
1250  * Create new RFCOMM session. That function WILL NOT take ownership over l2so.
1251  * Caller MUST free l2so if function failed.
1252  */
1253 
1254 static int
1255 ng_btsocket_rfcomm_session_create(ng_btsocket_rfcomm_session_p *sp,
1256 		struct socket *l2so, bdaddr_p src, bdaddr_p dst,
1257 		struct thread *td)
1258 {
1259 	ng_btsocket_rfcomm_session_p	s = NULL;
1260 	struct sockaddr_l2cap		l2sa;
1261 	struct sockopt			l2sopt;
1262 	int				error;
1263 	u_int16_t			mtu;
1264 
1265 	mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1266 
1267 	/* Allocate the RFCOMM session */
1268         s = kmalloc(sizeof(*s), M_NETGRAPH_BTSOCKET_RFCOMM,
1269 		    M_WAITOK | M_NULLOK | M_ZERO);
1270         if (s == NULL)
1271                 return (ENOMEM);
1272 
1273 	/* Set defaults */
1274 	s->mtu = RFCOMM_DEFAULT_MTU;
1275 	s->flags = 0;
1276 	s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1277 	NG_BT_MBUFQ_INIT(&s->outq, ifqmaxlen);
1278 
1279 	/*
1280 	 * XXX Mark session mutex as DUPOK to prevent "duplicated lock of
1281 	 * the same type" message. When accepting new L2CAP connection
1282 	 * ng_btsocket_rfcomm_session_accept() holds both session mutexes
1283 	 * for "old" (accepting) session and "new" (created) session.
1284 	 */
1285 
1286 	mtx_init(&s->session_mtx, "btsocks_rfcomm_session_mtx", NULL,
1287 		MTX_DEF|MTX_DUPOK);
1288 
1289 	LIST_INIT(&s->dlcs);
1290 
1291 	/* Prepare L2CAP socket */
1292 	l2so->so_upcallarg = NULL;
1293 	l2so->so_upcall = ng_btsocket_rfcomm_upcall;
1294 	SOCKBUF_LOCK(&l2so->so_rcv);
1295 	l2so->so_rcv.sb_flags |= SB_UPCALL;
1296 	SOCKBUF_UNLOCK(&l2so->so_rcv);
1297 	SOCKBUF_LOCK(&l2so->so_snd);
1298 	l2so->so_snd.sb_flags |= SB_UPCALL;
1299 	SOCKBUF_UNLOCK(&l2so->so_snd);
1300 	sosetstate(l2so, SS_NBIO);
1301 	s->l2so = l2so;
1302 
1303 	mtx_lock(&s->session_mtx);
1304 
1305 	/*
1306 	 * "src" == NULL and "dst" == NULL means just create session.
1307 	 * caller must do the rest
1308 	 */
1309 
1310 	if (src == NULL && dst == NULL)
1311 		goto done;
1312 
1313 	/*
1314 	 * Set incoming MTU on L2CAP socket. It is RFCOMM session default MTU
1315 	 * plus 5 bytes: RFCOMM frame header, one extra byte for length and one
1316 	 * extra byte for credits.
1317 	 */
1318 
1319 	mtu = s->mtu + sizeof(struct rfcomm_frame_hdr) + 1 + 1;
1320 
1321 	l2sopt.sopt_dir = SOPT_SET;
1322 	l2sopt.sopt_level = SOL_L2CAP;
1323 	l2sopt.sopt_name = SO_L2CAP_IMTU;
1324 	l2sopt.sopt_val = (void *) &mtu;
1325 	l2sopt.sopt_valsize = sizeof(mtu);
1326 	l2sopt.sopt_td = NULL;
1327 
1328 	error = sosetopt(s->l2so, &l2sopt);
1329 	if (error != 0)
1330 		goto bad;
1331 
1332 	/* Bind socket to "src" address */
1333 	l2sa.l2cap_len = sizeof(l2sa);
1334 	l2sa.l2cap_family = AF_BLUETOOTH;
1335 	l2sa.l2cap_psm = (dst == NULL)? htole16(NG_L2CAP_PSM_RFCOMM) : 0;
1336 	bcopy(src, &l2sa.l2cap_bdaddr, sizeof(l2sa.l2cap_bdaddr));
1337 
1338 	error = sobind(s->l2so, (struct sockaddr *) &l2sa, td);
1339 	if (error != 0)
1340 		goto bad;
1341 
1342 	/* If "dst" is not NULL then initiate connect(), otherwise listen() */
1343 	if (dst == NULL) {
1344 		s->flags = 0;
1345 		s->state = NG_BTSOCKET_RFCOMM_SESSION_LISTENING;
1346 
1347 		error = solisten(s->l2so, 10, td);
1348 		if (error != 0)
1349 			goto bad;
1350 	} else {
1351 		s->flags = NG_BTSOCKET_RFCOMM_SESSION_INITIATOR;
1352 		s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTING;
1353 
1354 		l2sa.l2cap_len = sizeof(l2sa);
1355 		l2sa.l2cap_family = AF_BLUETOOTH;
1356 		l2sa.l2cap_psm = htole16(NG_L2CAP_PSM_RFCOMM);
1357 	        bcopy(dst, &l2sa.l2cap_bdaddr, sizeof(l2sa.l2cap_bdaddr));
1358 
1359 		error = soconnect(s->l2so, (struct sockaddr *) &l2sa, td);
1360 		if (error != 0)
1361 			goto bad;
1362 	}
1363 
1364 done:
1365 	LIST_INSERT_HEAD(&ng_btsocket_rfcomm_sessions, s, next);
1366 	*sp = s;
1367 
1368 	mtx_unlock(&s->session_mtx);
1369 
1370 	return (0);
1371 
1372 bad:
1373 	mtx_unlock(&s->session_mtx);
1374 
1375 	/* Return L2CAP socket back to its original state */
1376 	l2so->so_upcallarg = NULL;
1377 	l2so->so_upcall = NULL;
1378 	SOCKBUF_LOCK(&l2so->so_rcv);
1379 	l2so->so_rcv.sb_flags &= ~SB_UPCALL;
1380 	SOCKBUF_UNLOCK(&l2so->so_rcv);
1381 	SOCKBUF_LOCK(&l2so->so_snd);
1382 	l2so->so_snd.sb_flags &= ~SB_UPCALL;
1383 	SOCKBUF_UNLOCK(&l2so->so_snd);
1384 	soclrstate(l2so, SS_NBIO);
1385 
1386 	mtx_destroy(&s->session_mtx);
1387 	bzero(s, sizeof(*s));
1388 	kfree(s, M_NETGRAPH_BTSOCKET_RFCOMM);
1389 
1390 	return (error);
1391 } /* ng_btsocket_rfcomm_session_create */
1392 
1393 /*
1394  * Process accept() on RFCOMM session
1395  * XXX FIXME locking for "l2so"?
1396  */
1397 
1398 static int
1399 ng_btsocket_rfcomm_session_accept(ng_btsocket_rfcomm_session_p s0)
1400 {
1401 	struct socket			*l2so = NULL;
1402 	struct sockaddr_l2cap		*l2sa = NULL;
1403 	ng_btsocket_l2cap_pcb_t		*l2pcb = NULL;
1404 	ng_btsocket_rfcomm_session_p	 s = NULL;
1405 	int				 error = 0;
1406 
1407 	mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1408 	mtx_assert(&s0->session_mtx, MA_OWNED);
1409 
1410 	/* Check if there is a complete L2CAP connection in the queue */
1411 	if ((error = s0->l2so->so_error) != 0) {
1412 		NG_BTSOCKET_RFCOMM_ERR(
1413 "%s: Could not accept connection on L2CAP socket, error=%d\n", __func__, error);
1414 		s0->l2so->so_error = 0;
1415 
1416 		return (error);
1417 	}
1418 
1419 	ACCEPT_LOCK();
1420 	if (TAILQ_EMPTY(&s0->l2so->so_comp)) {
1421 		ACCEPT_UNLOCK();
1422 		if (s0->l2so->so_rcv.sb_state & SBS_CANTRCVMORE)
1423 			return (ECONNABORTED);
1424 		return (EWOULDBLOCK);
1425 	}
1426 
1427 	/* Accept incoming L2CAP connection */
1428 	l2so = TAILQ_FIRST(&s0->l2so->so_comp);
1429 	if (l2so == NULL)
1430 		panic("%s: l2so == NULL", __func__);
1431 
1432 	TAILQ_REMOVE(&s0->l2so->so_comp, l2so, so_list);
1433 	s0->l2so->so_qlen --;
1434 	l2so->so_qstate &= ~SQ_COMP;
1435 	l2so->so_head = NULL;
1436 	SOCK_LOCK(l2so);
1437 	soref(l2so);
1438 	sosetstate(l2so, SS_NBIO);
1439 	SOCK_UNLOCK(l2so);
1440 	ACCEPT_UNLOCK();
1441 
1442 	error = soaccept(l2so, (struct sockaddr **) &l2sa);
1443 	if (error != 0) {
1444 		NG_BTSOCKET_RFCOMM_ERR(
1445 "%s: soaccept() on L2CAP socket failed, error=%d\n", __func__, error);
1446 		soclose(l2so);
1447 
1448 		return (error);
1449 	}
1450 
1451 	/*
1452 	 * Check if there is already active RFCOMM session between two devices.
1453 	 * If so then close L2CAP connection. We only support one RFCOMM session
1454 	 * between each pair of devices. Note that here we assume session in any
1455 	 * state. The session even could be in the middle of disconnecting.
1456 	 */
1457 
1458 	l2pcb = so2l2cap_pcb(l2so);
1459 	s = ng_btsocket_rfcomm_session_by_addr(&l2pcb->src, &l2pcb->dst);
1460 	if (s == NULL) {
1461 		/* Create a new RFCOMM session */
1462 		error = ng_btsocket_rfcomm_session_create(&s, l2so, NULL, NULL,
1463 				curthread /* XXX */);
1464 		if (error == 0) {
1465 			mtx_lock(&s->session_mtx);
1466 
1467 			s->flags = 0;
1468 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTED;
1469 
1470 			/*
1471 			 * Adjust MTU on incomming connection. Reserve 5 bytes:
1472 			 * RFCOMM frame header, one extra byte for length and
1473 			 * one extra byte for credits.
1474 			 */
1475 
1476 			s->mtu = min(l2pcb->imtu, l2pcb->omtu) -
1477 					sizeof(struct rfcomm_frame_hdr) - 1 - 1;
1478 
1479 			mtx_unlock(&s->session_mtx);
1480 		} else {
1481 			NG_BTSOCKET_RFCOMM_ALERT(
1482 "%s: Failed to create new RFCOMM session, error=%d\n", __func__, error);
1483 
1484 			soclose(l2so);
1485 		}
1486 	} else {
1487 		NG_BTSOCKET_RFCOMM_WARN(
1488 "%s: Rejecting duplicating RFCOMM session between src=%x:%x:%x:%x:%x:%x and " \
1489 "dst=%x:%x:%x:%x:%x:%x, state=%d, flags=%#x\n",	__func__,
1490 			l2pcb->src.b[5], l2pcb->src.b[4], l2pcb->src.b[3],
1491 			l2pcb->src.b[2], l2pcb->src.b[1], l2pcb->src.b[0],
1492 			l2pcb->dst.b[5], l2pcb->dst.b[4], l2pcb->dst.b[3],
1493 			l2pcb->dst.b[2], l2pcb->dst.b[1], l2pcb->dst.b[0],
1494 			s->state, s->flags);
1495 
1496 		error = EBUSY;
1497 		soclose(l2so);
1498 	}
1499 
1500 	return (error);
1501 } /* ng_btsocket_rfcomm_session_accept */
1502 
1503 /*
1504  * Process connect() on RFCOMM session
1505  * XXX FIXME locking for "l2so"?
1506  */
1507 
1508 static int
1509 ng_btsocket_rfcomm_session_connect(ng_btsocket_rfcomm_session_p s)
1510 {
1511 	ng_btsocket_l2cap_pcb_p	l2pcb = so2l2cap_pcb(s->l2so);
1512 	int			error;
1513 
1514 	mtx_assert(&s->session_mtx, MA_OWNED);
1515 
1516 	/* First check if connection has failed */
1517 	if ((error = s->l2so->so_error) != 0) {
1518 		s->l2so->so_error = 0;
1519 
1520 		NG_BTSOCKET_RFCOMM_ERR(
1521 "%s: Could not connect RFCOMM session, error=%d, state=%d, flags=%#x\n",
1522 			__func__, error, s->state, s->flags);
1523 
1524 		return (error);
1525 	}
1526 
1527 	/* Is connection still in progress? */
1528 	if (s->l2so->so_state & SS_ISCONNECTING)
1529 		return (0);
1530 
1531 	/*
1532 	 * If we got here then we are connected. Send SABM on DLCI 0 to
1533 	 * open multiplexor channel.
1534 	 */
1535 
1536 	if (error == 0) {
1537 		s->state = NG_BTSOCKET_RFCOMM_SESSION_CONNECTED;
1538 
1539 		/*
1540 		 * Adjust MTU on outgoing connection. Reserve 5 bytes: RFCOMM
1541 		 * frame header, one extra byte for length and one extra byte
1542 		 * for credits.
1543 		 */
1544 
1545 		s->mtu = min(l2pcb->imtu, l2pcb->omtu) -
1546 				sizeof(struct rfcomm_frame_hdr) - 1 - 1;
1547 
1548 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_SABM,0);
1549 		if (error == 0)
1550 			error = ng_btsocket_rfcomm_task_wakeup();
1551 	}
1552 
1553 	return (error);
1554 }/* ng_btsocket_rfcomm_session_connect */
1555 
1556 /*
1557  * Receive data on RFCOMM session
1558  * XXX FIXME locking for "l2so"?
1559  */
1560 
1561 static int
1562 ng_btsocket_rfcomm_session_receive(ng_btsocket_rfcomm_session_p s)
1563 {
1564 	struct mbuf	*m = NULL;
1565 	struct uio	 uio;
1566 	int		 more, flags, error;
1567 
1568 	mtx_assert(&s->session_mtx, MA_OWNED);
1569 
1570 	/* Can we read from the L2CAP socket? */
1571 	if (!soreadable(s->l2so))
1572 		return (0);
1573 
1574 	/* First check for error on L2CAP socket */
1575 	if ((error = s->l2so->so_error) != 0) {
1576 		s->l2so->so_error = 0;
1577 
1578 		NG_BTSOCKET_RFCOMM_ERR(
1579 "%s: Could not receive data from L2CAP socket, error=%d, state=%d, flags=%#x\n",
1580 			__func__, error, s->state, s->flags);
1581 
1582 		return (error);
1583 	}
1584 
1585 	/*
1586 	 * Read all packets from the L2CAP socket.
1587 	 * XXX FIXME/VERIFY is that correct? For now use m->m_nextpkt as
1588 	 * indication that there is more packets on the socket's buffer.
1589 	 * Also what should we use in uio.uio_resid?
1590 	 * May be s->mtu + sizeof(struct rfcomm_frame_hdr) + 1 + 1?
1591 	 */
1592 
1593 	for (more = 1; more; ) {
1594 		/* Try to get next packet from socket */
1595 		bzero(&uio, sizeof(uio));
1596 /*		uio.uio_td = NULL; */
1597 		uio.uio_resid = 1000000000;
1598 		flags = MSG_DONTWAIT;
1599 
1600 		m = NULL;
1601 		error = soreceive(s->l2so, NULL, &uio, &m, NULL, &flags);
1602 		if (error != 0) {
1603 			if (error == EWOULDBLOCK)
1604 				return (0); /* XXX can happen? */
1605 
1606 			NG_BTSOCKET_RFCOMM_ERR(
1607 "%s: Could not receive data from L2CAP socket, error=%d\n", __func__, error);
1608 
1609 			return (error);
1610 		}
1611 
1612 		more = (m->m_nextpkt != NULL);
1613 		m->m_nextpkt = NULL;
1614 
1615 		ng_btsocket_rfcomm_receive_frame(s, m);
1616 	}
1617 
1618 	return (0);
1619 } /* ng_btsocket_rfcomm_session_receive */
1620 
1621 /*
1622  * Send data on RFCOMM session
1623  * XXX FIXME locking for "l2so"?
1624  */
1625 
1626 static int
1627 ng_btsocket_rfcomm_session_send(ng_btsocket_rfcomm_session_p s)
1628 {
1629 	struct mbuf	*m = NULL;
1630 	int		 error;
1631 
1632 	mtx_assert(&s->session_mtx, MA_OWNED);
1633 
1634 	/* Send as much as we can from the session queue */
1635 	while (sowriteable(s->l2so)) {
1636 		/* Check if socket still OK */
1637 		if ((error = s->l2so->so_error) != 0) {
1638 			s->l2so->so_error = 0;
1639 
1640 			NG_BTSOCKET_RFCOMM_ERR(
1641 "%s: Detected error=%d on L2CAP socket, state=%d, flags=%#x\n",
1642 				__func__, error, s->state, s->flags);
1643 
1644 			return (error);
1645 		}
1646 
1647 		NG_BT_MBUFQ_DEQUEUE(&s->outq, m);
1648 		if (m == NULL)
1649 			return (0); /* we are done */
1650 
1651 		/* Call send function on the L2CAP socket */
1652 		error = (*s->l2so->so_proto->pr_usrreqs->pru_send)(s->l2so,
1653 				0, m, NULL, NULL, curthread /* XXX */);
1654 		if (error != 0) {
1655 			NG_BTSOCKET_RFCOMM_ERR(
1656 "%s: Could not send data to L2CAP socket, error=%d\n", __func__, error);
1657 
1658 			return (error);
1659 		}
1660 	}
1661 
1662 	return (0);
1663 } /* ng_btsocket_rfcomm_session_send */
1664 
1665 /*
1666  * Close and disconnect all DLCs for the given session. Caller must hold
1667  * s->sesson_mtx. Will wakeup session.
1668  */
1669 
1670 static void
1671 ng_btsocket_rfcomm_session_clean(ng_btsocket_rfcomm_session_p s)
1672 {
1673 	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
1674 	int				error;
1675 
1676 	mtx_assert(&s->session_mtx, MA_OWNED);
1677 
1678 	/*
1679 	 * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1680 	 * will unlink DLC from the session
1681 	 */
1682 
1683 	for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1684 		mtx_lock(&pcb->pcb_mtx);
1685 		pcb_next = LIST_NEXT(pcb, session_next);
1686 
1687 		NG_BTSOCKET_RFCOMM_INFO(
1688 "%s: Disconnecting dlci=%d, state=%d, flags=%#x\n",
1689 			__func__, pcb->dlci, pcb->state, pcb->flags);
1690 
1691 		if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
1692 			error = ECONNRESET;
1693 		else
1694 			error = ECONNREFUSED;
1695 
1696 		ng_btsocket_rfcomm_pcb_kill(pcb, error);
1697 
1698 		mtx_unlock(&pcb->pcb_mtx);
1699 		pcb = pcb_next;
1700 	}
1701 } /* ng_btsocket_rfcomm_session_clean */
1702 
1703 /*
1704  * Process all DLCs on the session. Caller MUST hold s->session_mtx.
1705  */
1706 
1707 static void
1708 ng_btsocket_rfcomm_session_process_pcb(ng_btsocket_rfcomm_session_p s)
1709 {
1710 	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb_next = NULL;
1711 	int				error;
1712 
1713 	mtx_assert(&s->session_mtx, MA_OWNED);
1714 
1715 	/*
1716 	 * Note: cannot use LIST_FOREACH because ng_btsocket_rfcomm_pcb_kill
1717 	 * will unlink DLC from the session
1718 	 */
1719 
1720 	for (pcb = LIST_FIRST(&s->dlcs); pcb != NULL; ) {
1721 		mtx_lock(&pcb->pcb_mtx);
1722 		pcb_next = LIST_NEXT(pcb, session_next);
1723 
1724 		switch (pcb->state) {
1725 
1726 		/*
1727 		 * If DLC in W4_CONNECT state then we should check for both
1728 		 * timeout and detach.
1729 		 */
1730 
1731 		case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
1732 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_DETACHED)
1733 				ng_btsocket_rfcomm_pcb_kill(pcb, 0);
1734 			else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1735 				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1736 			break;
1737 
1738 		/*
1739 		 * If DLC in CONFIGURING or CONNECTING state then we only
1740 		 * should check for timeout. If detach() was called then
1741 		 * DLC will be moved into DISCONNECTING state.
1742 		 */
1743 
1744 		case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
1745 		case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
1746 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1747 				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1748 			break;
1749 
1750 		/*
1751 		 * If DLC in CONNECTED state then we need to send data (if any)
1752 		 * from the socket's send queue. Note that we will send data
1753 		 * from either all sockets or none. This may overload session's
1754 		 * outgoing queue (but we do not check for that).
1755 		 *
1756  		 * XXX FIXME need scheduler for RFCOMM sockets
1757 		 */
1758 
1759 		case NG_BTSOCKET_RFCOMM_DLC_CONNECTED:
1760 			error = ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
1761 			if (error != 0)
1762 				ng_btsocket_rfcomm_pcb_kill(pcb, error);
1763 			break;
1764 
1765 		/*
1766 		 * If DLC in DISCONNECTING state then we must send DISC frame.
1767 		 * Note that if DLC has timeout set then we do not need to
1768 		 * resend DISC frame.
1769 		 *
1770 		 * XXX FIXME need to drain all data from the socket's queue
1771 		 * if LINGER option was set
1772 		 */
1773 
1774 		case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
1775 			if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)) {
1776 				error = ng_btsocket_rfcomm_send_command(
1777 						pcb->session, RFCOMM_FRAME_DISC,
1778 						pcb->dlci);
1779 				if (error == 0)
1780 					ng_btsocket_rfcomm_timeout(pcb);
1781 				else
1782 					ng_btsocket_rfcomm_pcb_kill(pcb, error);
1783 			} else if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT)
1784 				ng_btsocket_rfcomm_pcb_kill(pcb, ETIMEDOUT);
1785 			break;
1786 
1787 /*		case NG_BTSOCKET_RFCOMM_DLC_CLOSED: */
1788 		default:
1789 			panic("%s: Invalid DLC state=%d, flags=%#x",
1790 				__func__, pcb->state, pcb->flags);
1791 			break;
1792 		}
1793 
1794 		mtx_unlock(&pcb->pcb_mtx);
1795 		pcb = pcb_next;
1796 	}
1797 } /* ng_btsocket_rfcomm_session_process_pcb */
1798 
1799 /*
1800  * Find RFCOMM session between "src" and "dst".
1801  * Caller MUST hold ng_btsocket_rfcomm_sessions_mtx.
1802  */
1803 
1804 static ng_btsocket_rfcomm_session_p
1805 ng_btsocket_rfcomm_session_by_addr(bdaddr_p src, bdaddr_p dst)
1806 {
1807 	ng_btsocket_rfcomm_session_p	s = NULL;
1808 	ng_btsocket_l2cap_pcb_p		l2pcb = NULL;
1809 	int				any_src;
1810 
1811 	mtx_assert(&ng_btsocket_rfcomm_sessions_mtx, MA_OWNED);
1812 
1813 	any_src = (bcmp(src, NG_HCI_BDADDR_ANY, sizeof(*src)) == 0);
1814 
1815 	LIST_FOREACH(s, &ng_btsocket_rfcomm_sessions, next) {
1816 		l2pcb = so2l2cap_pcb(s->l2so);
1817 
1818 		if ((any_src || bcmp(&l2pcb->src, src, sizeof(*src)) == 0) &&
1819 		    bcmp(&l2pcb->dst, dst, sizeof(*dst)) == 0)
1820 			break;
1821 	}
1822 
1823 	return (s);
1824 } /* ng_btsocket_rfcomm_session_by_addr */
1825 
1826 /*****************************************************************************
1827  *****************************************************************************
1828  **                                  RFCOMM
1829  *****************************************************************************
1830  *****************************************************************************/
1831 
1832 /*
1833  * Process incoming RFCOMM frame. Caller must hold s->session_mtx.
1834  * XXX FIXME check frame length
1835  */
1836 
1837 static int
1838 ng_btsocket_rfcomm_receive_frame(ng_btsocket_rfcomm_session_p s,
1839 		struct mbuf *m0)
1840 {
1841 	struct rfcomm_frame_hdr	*hdr = NULL;
1842 	struct mbuf		*m = NULL;
1843 	u_int16_t		 length;
1844 	u_int8_t		 dlci, type;
1845 	int			 error = 0;
1846 
1847 	mtx_assert(&s->session_mtx, MA_OWNED);
1848 
1849 	/* Pullup as much as we can into first mbuf (for direct access) */
1850 	length = min(m0->m_pkthdr.len, MHLEN);
1851 	if (m0->m_len < length) {
1852 		if ((m0 = m_pullup(m0, length)) == NULL) {
1853 			NG_BTSOCKET_RFCOMM_ALERT(
1854 "%s: m_pullup(%d) failed\n", __func__, length);
1855 
1856 			return (ENOBUFS);
1857 		}
1858 	}
1859 
1860 	hdr = mtod(m0, struct rfcomm_frame_hdr *);
1861 	dlci = RFCOMM_DLCI(hdr->address);
1862 	type = RFCOMM_TYPE(hdr->control);
1863 
1864 	/* Test EA bit in length. If not set then we have 2 bytes of length */
1865 	if (!RFCOMM_EA(hdr->length)) {
1866 		bcopy(&hdr->length, &length, sizeof(length));
1867 		length = le16toh(length) >> 1;
1868 		m_adj(m0, sizeof(*hdr) + 1);
1869 	} else {
1870 		length = hdr->length >> 1;
1871 		m_adj(m0, sizeof(*hdr));
1872 	}
1873 
1874 	NG_BTSOCKET_RFCOMM_INFO(
1875 "%s: Got frame type=%#x, dlci=%d, length=%d, cr=%d, pf=%d, len=%d\n",
1876 		__func__, type, dlci, length, RFCOMM_CR(hdr->address),
1877 		RFCOMM_PF(hdr->control), m0->m_pkthdr.len);
1878 
1879 	/*
1880 	 * Get FCS (the last byte in the frame)
1881 	 * XXX this will not work if mbuf chain ends with empty mbuf.
1882 	 * XXX let's hope it never happens :)
1883 	 */
1884 
1885 	for (m = m0; m->m_next != NULL; m = m->m_next)
1886 		;
1887 	if (m->m_len <= 0)
1888 		panic("%s: Empty mbuf at the end of the chain, len=%d",
1889 			__func__, m->m_len);
1890 
1891 	/*
1892 	 * Check FCS. We only need to calculate FCS on first 2 or 3 bytes
1893 	 * and already m_pullup'ed mbuf chain, so it should be safe.
1894 	 */
1895 
1896 	if (ng_btsocket_rfcomm_check_fcs((u_int8_t *) hdr, type, m->m_data[m->m_len - 1])) {
1897 		NG_BTSOCKET_RFCOMM_ERR(
1898 "%s: Invalid RFCOMM packet. Bad checksum\n", __func__);
1899 		NG_FREE_M(m0);
1900 
1901 		return (EINVAL);
1902 	}
1903 
1904 	m_adj(m0, -1); /* Trim FCS byte */
1905 
1906 	/*
1907 	 * Process RFCOMM frame.
1908 	 *
1909 	 * From TS 07.10 spec
1910 	 *
1911 	 * "... In the case where a SABM or DISC command with the P bit set
1912 	 * to 0 is received then the received frame shall be discarded..."
1913  	 *
1914 	 * "... If a unsolicited DM response is received then the frame shall
1915 	 * be processed irrespective of the P/F setting... "
1916 	 *
1917 	 * "... The station may transmit response frames with the F bit set
1918 	 * to 0 at any opportunity on an asynchronous basis. However, in the
1919 	 * case where a UA response is received with the F bit set to 0 then
1920 	 * the received frame shall be discarded..."
1921 	 *
1922 	 * From Bluetooth spec
1923 	 *
1924 	 * "... When credit based flow control is being used, the meaning of
1925 	 * the P/F bit in the control field of the RFCOMM header is redefined
1926 	 * for UIH frames..."
1927 	 */
1928 
1929 	switch (type) {
1930 	case RFCOMM_FRAME_SABM:
1931 		if (RFCOMM_PF(hdr->control))
1932 			error = ng_btsocket_rfcomm_receive_sabm(s, dlci);
1933 		break;
1934 
1935 	case RFCOMM_FRAME_DISC:
1936 		if (RFCOMM_PF(hdr->control))
1937 			error = ng_btsocket_rfcomm_receive_disc(s, dlci);
1938 		break;
1939 
1940 	case RFCOMM_FRAME_UA:
1941 		if (RFCOMM_PF(hdr->control))
1942 			error = ng_btsocket_rfcomm_receive_ua(s, dlci);
1943 		break;
1944 
1945 	case RFCOMM_FRAME_DM:
1946 		error = ng_btsocket_rfcomm_receive_dm(s, dlci);
1947 		break;
1948 
1949 	case RFCOMM_FRAME_UIH:
1950 		if (dlci == 0)
1951 			error = ng_btsocket_rfcomm_receive_mcc(s, m0);
1952 		else
1953 			error = ng_btsocket_rfcomm_receive_uih(s, dlci,
1954 					RFCOMM_PF(hdr->control), m0);
1955 
1956 		return (error);
1957 		/* NOT REACHED */
1958 
1959 	default:
1960 		NG_BTSOCKET_RFCOMM_ERR(
1961 "%s: Invalid RFCOMM packet. Unknown type=%#x\n", __func__, type);
1962 		error = EINVAL;
1963 		break;
1964 	}
1965 
1966 	NG_FREE_M(m0);
1967 
1968 	return (error);
1969 } /* ng_btsocket_rfcomm_receive_frame */
1970 
1971 /*
1972  * Process RFCOMM SABM frame
1973  */
1974 
1975 static int
1976 ng_btsocket_rfcomm_receive_sabm(ng_btsocket_rfcomm_session_p s, int dlci)
1977 {
1978 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
1979 	int				error = 0;
1980 
1981 	mtx_assert(&s->session_mtx, MA_OWNED);
1982 
1983 	NG_BTSOCKET_RFCOMM_INFO(
1984 "%s: Got SABM, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
1985 		__func__, s->state, s->flags, s->mtu, dlci);
1986 
1987 	/* DLCI == 0 means open multiplexor channel */
1988 	if (dlci == 0) {
1989 		switch (s->state) {
1990 		case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
1991 		case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
1992 			error = ng_btsocket_rfcomm_send_command(s,
1993 					RFCOMM_FRAME_UA, dlci);
1994 			if (error == 0) {
1995 				s->state = NG_BTSOCKET_RFCOMM_SESSION_OPEN;
1996 				ng_btsocket_rfcomm_connect_cfm(s);
1997 			} else {
1998 				s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
1999 				ng_btsocket_rfcomm_session_clean(s);
2000 			}
2001 			break;
2002 
2003 		default:
2004 			NG_BTSOCKET_RFCOMM_WARN(
2005 "%s: Got SABM for session in invalid state state=%d, flags=%#x\n",
2006 				__func__, s->state, s->flags);
2007 			error = EINVAL;
2008 			break;
2009 		}
2010 
2011 		return (error);
2012 	}
2013 
2014 	/* Make sure multiplexor channel is open */
2015 	if (s->state != NG_BTSOCKET_RFCOMM_SESSION_OPEN) {
2016 		NG_BTSOCKET_RFCOMM_ERR(
2017 "%s: Got SABM for dlci=%d with mulitplexor channel closed, state=%d, " \
2018 "flags=%#x\n",		__func__, dlci, s->state, s->flags);
2019 
2020 		return (EINVAL);
2021 	}
2022 
2023 	/*
2024 	 * Check if we have this DLCI. This might happen when remote
2025 	 * peer uses PN command before actual open (SABM) happens.
2026 	 */
2027 
2028 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2029 	if (pcb != NULL) {
2030 		mtx_lock(&pcb->pcb_mtx);
2031 
2032 		if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTING) {
2033 			NG_BTSOCKET_RFCOMM_ERR(
2034 "%s: Got SABM for dlci=%d in invalid state=%d, flags=%#x\n",
2035 				__func__, dlci, pcb->state, pcb->flags);
2036 			mtx_unlock(&pcb->pcb_mtx);
2037 
2038 			return (ENOENT);
2039 		}
2040 
2041 		ng_btsocket_rfcomm_untimeout(pcb);
2042 
2043 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_UA,dlci);
2044 		if (error == 0)
2045 			error = ng_btsocket_rfcomm_send_msc(pcb);
2046 
2047 		if (error == 0) {
2048 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2049 			soisconnected(pcb->so);
2050 		} else
2051 			ng_btsocket_rfcomm_pcb_kill(pcb, error);
2052 
2053 		mtx_unlock(&pcb->pcb_mtx);
2054 
2055 		return (error);
2056 	}
2057 
2058 	/*
2059 	 * We do not have requested DLCI, so it must be an incoming connection
2060 	 * with default parameters. Try to accept it.
2061 	 */
2062 
2063 	pcb = ng_btsocket_rfcomm_connect_ind(s, RFCOMM_SRVCHANNEL(dlci));
2064 	if (pcb != NULL) {
2065 		mtx_lock(&pcb->pcb_mtx);
2066 
2067 		pcb->dlci = dlci;
2068 
2069 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_UA,dlci);
2070 		if (error == 0)
2071 			error = ng_btsocket_rfcomm_send_msc(pcb);
2072 
2073 		if (error == 0) {
2074 			pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2075 			soisconnected(pcb->so);
2076 		} else
2077 			ng_btsocket_rfcomm_pcb_kill(pcb, error);
2078 
2079 		mtx_unlock(&pcb->pcb_mtx);
2080 	} else
2081 		/* Nobody is listen()ing on the requested DLCI */
2082 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2083 
2084 	return (error);
2085 } /* ng_btsocket_rfcomm_receive_sabm */
2086 
2087 /*
2088  * Process RFCOMM DISC frame
2089  */
2090 
2091 static int
2092 ng_btsocket_rfcomm_receive_disc(ng_btsocket_rfcomm_session_p s, int dlci)
2093 {
2094 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
2095 	int				error = 0;
2096 
2097 	mtx_assert(&s->session_mtx, MA_OWNED);
2098 
2099 	NG_BTSOCKET_RFCOMM_INFO(
2100 "%s: Got DISC, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2101 		__func__, s->state, s->flags, s->mtu, dlci);
2102 
2103 	/* DLCI == 0 means close multiplexor channel */
2104 	if (dlci == 0) {
2105 		/* XXX FIXME assume that remote side will close the socket */
2106 		error = ng_btsocket_rfcomm_send_command(s, RFCOMM_FRAME_UA, 0);
2107 		if (error == 0) {
2108 			if (s->state == NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING)
2109 				s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED; /* XXX */
2110 			else
2111 				s->state = NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING;
2112 		} else
2113 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED; /* XXX */
2114 
2115 		ng_btsocket_rfcomm_session_clean(s);
2116 	} else {
2117 		pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2118 		if (pcb != NULL) {
2119 			int	err;
2120 
2121 			mtx_lock(&pcb->pcb_mtx);
2122 
2123 			NG_BTSOCKET_RFCOMM_INFO(
2124 "%s: Got DISC for dlci=%d, state=%d, flags=%#x\n",
2125 				__func__, dlci, pcb->state, pcb->flags);
2126 
2127 			error = ng_btsocket_rfcomm_send_command(s,
2128 					RFCOMM_FRAME_UA, dlci);
2129 
2130 			if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
2131 				err = 0;
2132 			else
2133 				err = ECONNREFUSED;
2134 
2135 			ng_btsocket_rfcomm_pcb_kill(pcb, err);
2136 
2137 			mtx_unlock(&pcb->pcb_mtx);
2138 		} else {
2139 			NG_BTSOCKET_RFCOMM_WARN(
2140 "%s: Got DISC for non-existing dlci=%d\n", __func__, dlci);
2141 
2142 			error = ng_btsocket_rfcomm_send_command(s,
2143 					RFCOMM_FRAME_DM, dlci);
2144 		}
2145 	}
2146 
2147 	return (error);
2148 } /* ng_btsocket_rfcomm_receive_disc */
2149 
2150 /*
2151  * Process RFCOMM UA frame
2152  */
2153 
2154 static int
2155 ng_btsocket_rfcomm_receive_ua(ng_btsocket_rfcomm_session_p s, int dlci)
2156 {
2157 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
2158 	int				error = 0;
2159 
2160 	mtx_assert(&s->session_mtx, MA_OWNED);
2161 
2162 	NG_BTSOCKET_RFCOMM_INFO(
2163 "%s: Got UA, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2164 		__func__, s->state, s->flags, s->mtu, dlci);
2165 
2166 	/* dlci == 0 means multiplexor channel */
2167 	if (dlci == 0) {
2168 		switch (s->state) {
2169 		case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
2170 			s->state = NG_BTSOCKET_RFCOMM_SESSION_OPEN;
2171 			ng_btsocket_rfcomm_connect_cfm(s);
2172 			break;
2173 
2174 		case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
2175 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
2176 			ng_btsocket_rfcomm_session_clean(s);
2177 			break;
2178 
2179 		default:
2180 			NG_BTSOCKET_RFCOMM_WARN(
2181 "%s: Got UA for session in invalid state=%d(%d), flags=%#x, mtu=%d\n",
2182 				__func__, s->state, INITIATOR(s), s->flags,
2183 				s->mtu);
2184 			error = ENOENT;
2185 			break;
2186 		}
2187 
2188 		return (error);
2189 	}
2190 
2191 	/* Check if we have this DLCI */
2192 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2193 	if (pcb != NULL) {
2194 		mtx_lock(&pcb->pcb_mtx);
2195 
2196 		NG_BTSOCKET_RFCOMM_INFO(
2197 "%s: Got UA for dlci=%d, state=%d, flags=%#x\n",
2198 			__func__, dlci, pcb->state, pcb->flags);
2199 
2200 		switch (pcb->state) {
2201 		case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
2202 			ng_btsocket_rfcomm_untimeout(pcb);
2203 
2204 			error = ng_btsocket_rfcomm_send_msc(pcb);
2205 			if (error == 0) {
2206 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTED;
2207 				soisconnected(pcb->so);
2208 			}
2209 			break;
2210 
2211 		case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
2212 			ng_btsocket_rfcomm_pcb_kill(pcb, 0);
2213 			break;
2214 
2215 		default:
2216 			NG_BTSOCKET_RFCOMM_WARN(
2217 "%s: Got UA for dlci=%d in invalid state=%d, flags=%#x\n",
2218 				__func__, dlci, pcb->state, pcb->flags);
2219 			error = ENOENT;
2220 			break;
2221 		}
2222 
2223 		mtx_unlock(&pcb->pcb_mtx);
2224 	} else {
2225 		NG_BTSOCKET_RFCOMM_WARN(
2226 "%s: Got UA for non-existing dlci=%d\n", __func__, dlci);
2227 
2228 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2229 	}
2230 
2231 	return (error);
2232 } /* ng_btsocket_rfcomm_receive_ua */
2233 
2234 /*
2235  * Process RFCOMM DM frame
2236  */
2237 
2238 static int
2239 ng_btsocket_rfcomm_receive_dm(ng_btsocket_rfcomm_session_p s, int dlci)
2240 {
2241 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
2242 	int				error;
2243 
2244 	mtx_assert(&s->session_mtx, MA_OWNED);
2245 
2246 	NG_BTSOCKET_RFCOMM_INFO(
2247 "%s: Got DM, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2248 		__func__, s->state, s->flags, s->mtu, dlci);
2249 
2250 	/* DLCI == 0 means multiplexor channel */
2251 	if (dlci == 0) {
2252 		/* Disconnect all dlc's on the session */
2253 		s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
2254 		ng_btsocket_rfcomm_session_clean(s);
2255 	} else {
2256 		pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2257 		if (pcb != NULL) {
2258 			mtx_lock(&pcb->pcb_mtx);
2259 
2260 			NG_BTSOCKET_RFCOMM_INFO(
2261 "%s: Got DM for dlci=%d, state=%d, flags=%#x\n",
2262 				__func__, dlci, pcb->state, pcb->flags);
2263 
2264 			if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONNECTED)
2265 				error = ECONNRESET;
2266 			else
2267 				error = ECONNREFUSED;
2268 
2269 			ng_btsocket_rfcomm_pcb_kill(pcb, error);
2270 
2271 			mtx_unlock(&pcb->pcb_mtx);
2272 		} else
2273 			NG_BTSOCKET_RFCOMM_WARN(
2274 "%s: Got DM for non-existing dlci=%d\n", __func__, dlci);
2275 	}
2276 
2277 	return (0);
2278 } /* ng_btsocket_rfcomm_receive_dm */
2279 
2280 /*
2281  * Process RFCOMM UIH frame (data)
2282  */
2283 
2284 static int
2285 ng_btsocket_rfcomm_receive_uih(ng_btsocket_rfcomm_session_p s, int dlci,
2286 		int pf, struct mbuf *m0)
2287 {
2288 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
2289 	int				error = 0;
2290 
2291 	mtx_assert(&s->session_mtx, MA_OWNED);
2292 
2293 	NG_BTSOCKET_RFCOMM_INFO(
2294 "%s: Got UIH, session state=%d, flags=%#x, mtu=%d, dlci=%d, pf=%d, len=%d\n",
2295 		__func__, s->state, s->flags, s->mtu, dlci, pf,
2296 		m0->m_pkthdr.len);
2297 
2298 	/* XXX should we do it here? Check for session flow control */
2299 	if (s->flags & NG_BTSOCKET_RFCOMM_SESSION_LFC) {
2300 		NG_BTSOCKET_RFCOMM_WARN(
2301 "%s: Got UIH with session flow control asserted, state=%d, flags=%#x\n",
2302 			__func__, s->state, s->flags);
2303 		goto drop;
2304 	}
2305 
2306 	/* Check if we have this dlci */
2307 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, dlci);
2308 	if (pcb == NULL) {
2309 		NG_BTSOCKET_RFCOMM_WARN(
2310 "%s: Got UIH for non-existing dlci=%d\n", __func__, dlci);
2311 		error = ng_btsocket_rfcomm_send_command(s,RFCOMM_FRAME_DM,dlci);
2312 		goto drop;
2313 	}
2314 
2315 	mtx_lock(&pcb->pcb_mtx);
2316 
2317 	/* Check dlci state */
2318 	if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
2319 		NG_BTSOCKET_RFCOMM_WARN(
2320 "%s: Got UIH for dlci=%d in invalid state=%d, flags=%#x\n",
2321 			__func__, dlci, pcb->state, pcb->flags);
2322 		error = EINVAL;
2323 		goto drop1;
2324 	}
2325 
2326 	/* Check dlci flow control */
2327 	if (((pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) && pcb->rx_cred <= 0) ||
2328 	     (pcb->lmodem & RFCOMM_MODEM_FC)) {
2329 		NG_BTSOCKET_RFCOMM_ERR(
2330 "%s: Got UIH for dlci=%d with asserted flow control, state=%d, " \
2331 "flags=%#x, rx_cred=%d, lmodem=%#x\n",
2332 			__func__, dlci, pcb->state, pcb->flags,
2333 			pcb->rx_cred, pcb->lmodem);
2334 		goto drop1;
2335 	}
2336 
2337 	/* Did we get any credits? */
2338 	if ((pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) && pf) {
2339 		NG_BTSOCKET_RFCOMM_INFO(
2340 "%s: Got %d more credits for dlci=%d, state=%d, flags=%#x, " \
2341 "rx_cred=%d, tx_cred=%d\n",
2342 			__func__, *mtod(m0, u_int8_t *), dlci, pcb->state,
2343 			pcb->flags, pcb->rx_cred, pcb->tx_cred);
2344 
2345 		pcb->tx_cred += *mtod(m0, u_int8_t *);
2346 		m_adj(m0, 1);
2347 
2348 		/* Send more from the DLC. XXX check for errors? */
2349 		ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
2350 	}
2351 
2352 	/* OK the of the rest of the mbuf is the data */
2353 	if (m0->m_pkthdr.len > 0) {
2354 		/* If we are using credit flow control decrease rx_cred here */
2355 		if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2356 			/* Give remote peer more credits (if needed) */
2357 			if (-- pcb->rx_cred <= RFCOMM_MAX_CREDITS / 2)
2358 				ng_btsocket_rfcomm_send_credits(pcb);
2359 			else
2360 				NG_BTSOCKET_RFCOMM_INFO(
2361 "%s: Remote side still has credits, dlci=%d, state=%d, flags=%#x, " \
2362 "rx_cred=%d, tx_cred=%d\n",		__func__, dlci, pcb->state, pcb->flags,
2363 					pcb->rx_cred, pcb->tx_cred);
2364 		}
2365 
2366 		/* Check packet against mtu on dlci */
2367 		if (m0->m_pkthdr.len > pcb->mtu) {
2368 			NG_BTSOCKET_RFCOMM_ERR(
2369 "%s: Got oversized UIH for dlci=%d, state=%d, flags=%#x, mtu=%d, len=%d\n",
2370 				__func__, dlci, pcb->state, pcb->flags,
2371 				pcb->mtu, m0->m_pkthdr.len);
2372 
2373 			error = EMSGSIZE;
2374 		} else if (m0->m_pkthdr.len > sbspace(&pcb->so->so_rcv)) {
2375 
2376 			/*
2377 			 * This is really bad. Receive queue on socket does
2378 			 * not have enough space for the packet. We do not
2379 			 * have any other choice but drop the packet.
2380 			 */
2381 
2382 			NG_BTSOCKET_RFCOMM_ERR(
2383 "%s: Not enough space in socket receive queue. Dropping UIH for dlci=%d, " \
2384 "state=%d, flags=%#x, len=%d, space=%ld\n",
2385 				__func__, dlci, pcb->state, pcb->flags,
2386 				m0->m_pkthdr.len, sbspace(&pcb->so->so_rcv));
2387 
2388 			error = ENOBUFS;
2389 		} else {
2390 			/* Append packet to the socket receive queue */
2391 			sbappend(&pcb->so->so_rcv, m0);
2392 			m0 = NULL;
2393 
2394 			sorwakeup(pcb->so);
2395 		}
2396 	}
2397 drop1:
2398 	mtx_unlock(&pcb->pcb_mtx);
2399 drop:
2400 	NG_FREE_M(m0); /* checks for != NULL */
2401 
2402 	return (error);
2403 } /* ng_btsocket_rfcomm_receive_uih */
2404 
2405 /*
2406  * Process RFCOMM MCC command (Multiplexor)
2407  *
2408  * From TS 07.10 spec
2409  *
2410  * "5.4.3.1 Information Data
2411  *
2412  *  ...The frames (UIH) sent by the initiating station have the C/R bit set
2413  *  to 1 and those sent by the responding station have the C/R bit set to 0..."
2414  *
2415  * "5.4.6.2 Operating procedures
2416  *
2417  *  Messages always exist in pairs; a command message and a corresponding
2418  *  response message. If the C/R bit is set to 1 the message is a command,
2419  *  if it is set to 0 the message is a response...
2420  *
2421  *  ...
2422  *
2423  *  NOTE: Notice that when UIH frames are used to convey information on DLCI 0
2424  *  there are at least two different fields that contain a C/R bit, and the
2425  *  bits are set of different form. The C/R bit in the Type field shall be set
2426  *  as it is stated above, while the C/R bit in the Address field (see subclause
2427  *  5.2.1.2) shall be set as it is described in subclause 5.4.3.1."
2428  */
2429 
2430 static int
2431 ng_btsocket_rfcomm_receive_mcc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2432 {
2433 	struct rfcomm_mcc_hdr	*hdr = NULL;
2434 	u_int8_t		 cr, type, length;
2435 
2436 	mtx_assert(&s->session_mtx, MA_OWNED);
2437 
2438 	/*
2439 	 * We can access data directly in the first mbuf, because we have
2440 	 * m_pullup()'ed mbuf chain in ng_btsocket_rfcomm_receive_frame().
2441 	 * All MCC commands should fit into single mbuf (except probably TEST).
2442 	 */
2443 
2444 	hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2445 	cr = RFCOMM_CR(hdr->type);
2446 	type = RFCOMM_MCC_TYPE(hdr->type);
2447 	length = RFCOMM_MCC_LENGTH(hdr->length);
2448 
2449 	/* Check MCC frame length */
2450 	if (sizeof(*hdr) + length != m0->m_pkthdr.len) {
2451 		NG_BTSOCKET_RFCOMM_ERR(
2452 "%s: Invalid MCC frame length=%d, len=%d\n",
2453 			__func__, length, m0->m_pkthdr.len);
2454 		NG_FREE_M(m0);
2455 
2456 		return (EMSGSIZE);
2457 	}
2458 
2459 	switch (type) {
2460 	case RFCOMM_MCC_TEST:
2461 		return (ng_btsocket_rfcomm_receive_test(s, m0));
2462 		/* NOT REACHED */
2463 
2464 	case RFCOMM_MCC_FCON:
2465 	case RFCOMM_MCC_FCOFF:
2466 		return (ng_btsocket_rfcomm_receive_fc(s, m0));
2467 		/* NOT REACHED */
2468 
2469 	case RFCOMM_MCC_MSC:
2470 		return (ng_btsocket_rfcomm_receive_msc(s, m0));
2471 		/* NOT REACHED */
2472 
2473 	case RFCOMM_MCC_RPN:
2474 		return (ng_btsocket_rfcomm_receive_rpn(s, m0));
2475 		/* NOT REACHED */
2476 
2477 	case RFCOMM_MCC_RLS:
2478 		return (ng_btsocket_rfcomm_receive_rls(s, m0));
2479 		/* NOT REACHED */
2480 
2481 	case RFCOMM_MCC_PN:
2482 		return (ng_btsocket_rfcomm_receive_pn(s, m0));
2483 		/* NOT REACHED */
2484 
2485 	case RFCOMM_MCC_NSC:
2486 		NG_BTSOCKET_RFCOMM_ERR(
2487 "%s: Got MCC NSC, type=%#x, cr=%d, length=%d, session state=%d, flags=%#x, " \
2488 "mtu=%d, len=%d\n",	__func__, RFCOMM_MCC_TYPE(*((u_int8_t *)(hdr + 1))), cr,
2489 			 length, s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2490 		NG_FREE_M(m0);
2491 		break;
2492 
2493 	default:
2494 		NG_BTSOCKET_RFCOMM_ERR(
2495 "%s: Got unknown MCC, type=%#x, cr=%d, length=%d, session state=%d, " \
2496 "flags=%#x, mtu=%d, len=%d\n",
2497 			__func__, type, cr, length, s->state, s->flags,
2498 			s->mtu, m0->m_pkthdr.len);
2499 
2500 		/* Reuse mbuf to send NSC */
2501 		hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2502 		m0->m_pkthdr.len = m0->m_len = sizeof(*hdr);
2503 
2504 		/* Create MCC NSC header */
2505 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_NSC);
2506 		hdr->length = RFCOMM_MKLEN8(1);
2507 
2508 		/* Put back MCC command type we did not like */
2509 		m0->m_data[m0->m_len] = RFCOMM_MKMCC_TYPE(cr, type);
2510 		m0->m_pkthdr.len ++;
2511 		m0->m_len ++;
2512 
2513 		/* Send UIH frame */
2514 		return (ng_btsocket_rfcomm_send_uih(s,
2515 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0));
2516 		/* NOT REACHED */
2517 	}
2518 
2519 	return (0);
2520 } /* ng_btsocket_rfcomm_receive_mcc */
2521 
2522 /*
2523  * Receive RFCOMM TEST MCC command
2524  */
2525 
2526 static int
2527 ng_btsocket_rfcomm_receive_test(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2528 {
2529 	struct rfcomm_mcc_hdr	*hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2530 	int			 error = 0;
2531 
2532 	mtx_assert(&s->session_mtx, MA_OWNED);
2533 
2534 	NG_BTSOCKET_RFCOMM_INFO(
2535 "%s: Got MCC TEST, cr=%d, length=%d, session state=%d, flags=%#x, mtu=%d, " \
2536 "len=%d\n",	__func__, RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2537 		s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2538 
2539 	if (RFCOMM_CR(hdr->type)) {
2540 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_TEST);
2541 		error = ng_btsocket_rfcomm_send_uih(s,
2542 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2543 	} else
2544 		NG_FREE_M(m0); /* XXX ignore response */
2545 
2546 	return (error);
2547 } /* ng_btsocket_rfcomm_receive_test */
2548 
2549 /*
2550  * Receive RFCOMM FCON/FCOFF MCC command
2551  */
2552 
2553 static int
2554 ng_btsocket_rfcomm_receive_fc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2555 {
2556 	struct rfcomm_mcc_hdr	*hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2557 	u_int8_t		 type = RFCOMM_MCC_TYPE(hdr->type);
2558 	int			 error = 0;
2559 
2560 	mtx_assert(&s->session_mtx, MA_OWNED);
2561 
2562 	/*
2563 	 * Turn ON/OFF aggregate flow on the entire session. When remote peer
2564 	 * asserted flow control no transmission shall occur except on dlci 0
2565 	 * (control channel).
2566 	 */
2567 
2568 	NG_BTSOCKET_RFCOMM_INFO(
2569 "%s: Got MCC FC%s, cr=%d, length=%d, session state=%d, flags=%#x, mtu=%d, " \
2570 "len=%d\n",	__func__, (type == RFCOMM_MCC_FCON)? "ON" : "OFF",
2571 		RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2572 		s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2573 
2574 	if (RFCOMM_CR(hdr->type)) {
2575 		if (type == RFCOMM_MCC_FCON)
2576 			s->flags &= ~NG_BTSOCKET_RFCOMM_SESSION_RFC;
2577 		else
2578 			s->flags |= NG_BTSOCKET_RFCOMM_SESSION_RFC;
2579 
2580 		hdr->type = RFCOMM_MKMCC_TYPE(0, type);
2581 		error = ng_btsocket_rfcomm_send_uih(s,
2582 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2583 	} else
2584 		NG_FREE_M(m0); /* XXX ignore response */
2585 
2586 	return (error);
2587 } /* ng_btsocket_rfcomm_receive_fc  */
2588 
2589 /*
2590  * Receive RFCOMM MSC MCC command
2591  */
2592 
2593 static int
2594 ng_btsocket_rfcomm_receive_msc(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2595 {
2596 	struct rfcomm_mcc_hdr		*hdr = mtod(m0, struct rfcomm_mcc_hdr*);
2597 	struct rfcomm_mcc_msc		*msc = (struct rfcomm_mcc_msc *)(hdr+1);
2598 	ng_btsocket_rfcomm_pcb_t	*pcb = NULL;
2599 	int				 error = 0;
2600 
2601 	mtx_assert(&s->session_mtx, MA_OWNED);
2602 
2603 	NG_BTSOCKET_RFCOMM_INFO(
2604 "%s: Got MCC MSC, dlci=%d, cr=%d, length=%d, session state=%d, flags=%#x, " \
2605 "mtu=%d, len=%d\n",
2606 		__func__,  RFCOMM_DLCI(msc->address), RFCOMM_CR(hdr->type),
2607 		RFCOMM_MCC_LENGTH(hdr->length), s->state, s->flags,
2608 		s->mtu, m0->m_pkthdr.len);
2609 
2610 	if (RFCOMM_CR(hdr->type)) {
2611 		pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, RFCOMM_DLCI(msc->address));
2612 		if (pcb == NULL) {
2613 			NG_BTSOCKET_RFCOMM_WARN(
2614 "%s: Got MSC command for non-existing dlci=%d\n",
2615 				__func__, RFCOMM_DLCI(msc->address));
2616 			NG_FREE_M(m0);
2617 
2618 			return (ENOENT);
2619 		}
2620 
2621 		mtx_lock(&pcb->pcb_mtx);
2622 
2623 		if (pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTING &&
2624 		    pcb->state != NG_BTSOCKET_RFCOMM_DLC_CONNECTED) {
2625 			NG_BTSOCKET_RFCOMM_WARN(
2626 "%s: Got MSC on dlci=%d in invalid state=%d\n",
2627 				__func__, RFCOMM_DLCI(msc->address),
2628 				pcb->state);
2629 
2630 			mtx_unlock(&pcb->pcb_mtx);
2631 			NG_FREE_M(m0);
2632 
2633 			return (EINVAL);
2634 		}
2635 
2636 		pcb->rmodem = msc->modem; /* Update remote port signals */
2637 
2638 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_MSC);
2639 		error = ng_btsocket_rfcomm_send_uih(s,
2640 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2641 
2642 #if 0 /* YYY */
2643 		/* Send more data from DLC. XXX check for errors? */
2644 		if (!(pcb->rmodem & RFCOMM_MODEM_FC) &&
2645 		    !(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC))
2646 			ng_btsocket_rfcomm_pcb_send(pcb, ALOT);
2647 #endif /* YYY */
2648 
2649 		mtx_unlock(&pcb->pcb_mtx);
2650 	} else
2651 		NG_FREE_M(m0); /* XXX ignore response */
2652 
2653 	return (error);
2654 } /* ng_btsocket_rfcomm_receive_msc */
2655 
2656 /*
2657  * Receive RFCOMM RPN MCC command
2658  * XXX FIXME do we need htole16/le16toh for RPN param_mask?
2659  */
2660 
2661 static int
2662 ng_btsocket_rfcomm_receive_rpn(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2663 {
2664 	struct rfcomm_mcc_hdr	*hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2665 	struct rfcomm_mcc_rpn	*rpn = (struct rfcomm_mcc_rpn *)(hdr + 1);
2666 	int			 error = 0;
2667 	u_int16_t		 param_mask;
2668 	u_int8_t		 bit_rate, data_bits, stop_bits, parity,
2669 				 flow_control, xon_char, xoff_char;
2670 
2671 	mtx_assert(&s->session_mtx, MA_OWNED);
2672 
2673 	NG_BTSOCKET_RFCOMM_INFO(
2674 "%s: Got MCC RPN, dlci=%d, cr=%d, length=%d, session state=%d, flags=%#x, " \
2675 "mtu=%d, len=%d\n",
2676 		__func__, RFCOMM_DLCI(rpn->dlci), RFCOMM_CR(hdr->type),
2677 		RFCOMM_MCC_LENGTH(hdr->length), s->state, s->flags,
2678 		s->mtu, m0->m_pkthdr.len);
2679 
2680 	if (RFCOMM_CR(hdr->type)) {
2681 		param_mask = RFCOMM_RPN_PM_ALL;
2682 
2683 		if (RFCOMM_MCC_LENGTH(hdr->length) == 1) {
2684 			/* Request - return default setting */
2685 			bit_rate = RFCOMM_RPN_BR_115200;
2686 			data_bits = RFCOMM_RPN_DATA_8;
2687 			stop_bits = RFCOMM_RPN_STOP_1;
2688 			parity = RFCOMM_RPN_PARITY_NONE;
2689 			flow_control = RFCOMM_RPN_FLOW_NONE;
2690 			xon_char = RFCOMM_RPN_XON_CHAR;
2691 			xoff_char = RFCOMM_RPN_XOFF_CHAR;
2692                 } else {
2693 			/*
2694 			 * Ignore/accept bit_rate, 8 bits, 1 stop bit, no
2695 			 * parity, no flow control lines, default XON/XOFF
2696 			 * chars.
2697 			 */
2698 
2699 			bit_rate = rpn->bit_rate;
2700 			rpn->param_mask = le16toh(rpn->param_mask); /* XXX */
2701 
2702 			data_bits = RFCOMM_RPN_DATA_BITS(rpn->line_settings);
2703 			if (rpn->param_mask & RFCOMM_RPN_PM_DATA &&
2704 			    data_bits != RFCOMM_RPN_DATA_8) {
2705 				data_bits = RFCOMM_RPN_DATA_8;
2706 				param_mask ^= RFCOMM_RPN_PM_DATA;
2707 			}
2708 
2709 			stop_bits = RFCOMM_RPN_STOP_BITS(rpn->line_settings);
2710 			if (rpn->param_mask & RFCOMM_RPN_PM_STOP &&
2711 			    stop_bits != RFCOMM_RPN_STOP_1) {
2712 				stop_bits = RFCOMM_RPN_STOP_1;
2713 				param_mask ^= RFCOMM_RPN_PM_STOP;
2714 			}
2715 
2716 			parity = RFCOMM_RPN_PARITY(rpn->line_settings);
2717 			if (rpn->param_mask & RFCOMM_RPN_PM_PARITY &&
2718 			    parity != RFCOMM_RPN_PARITY_NONE) {
2719 				parity = RFCOMM_RPN_PARITY_NONE;
2720 				param_mask ^= RFCOMM_RPN_PM_PARITY;
2721 			}
2722 
2723 			flow_control = rpn->flow_control;
2724 			if (rpn->param_mask & RFCOMM_RPN_PM_FLOW &&
2725 			    flow_control != RFCOMM_RPN_FLOW_NONE) {
2726 				flow_control = RFCOMM_RPN_FLOW_NONE;
2727 				param_mask ^= RFCOMM_RPN_PM_FLOW;
2728 			}
2729 
2730 			xon_char = rpn->xon_char;
2731 			if (rpn->param_mask & RFCOMM_RPN_PM_XON &&
2732 			    xon_char != RFCOMM_RPN_XON_CHAR) {
2733 				xon_char = RFCOMM_RPN_XON_CHAR;
2734 				param_mask ^= RFCOMM_RPN_PM_XON;
2735 			}
2736 
2737 			xoff_char = rpn->xoff_char;
2738 			if (rpn->param_mask & RFCOMM_RPN_PM_XOFF &&
2739 			    xoff_char != RFCOMM_RPN_XOFF_CHAR) {
2740 				xoff_char = RFCOMM_RPN_XOFF_CHAR;
2741 				param_mask ^= RFCOMM_RPN_PM_XOFF;
2742 			}
2743 		}
2744 
2745 		rpn->bit_rate = bit_rate;
2746 		rpn->line_settings = RFCOMM_MKRPN_LINE_SETTINGS(data_bits,
2747 						stop_bits, parity);
2748 		rpn->flow_control = flow_control;
2749 		rpn->xon_char = xon_char;
2750 		rpn->xoff_char = xoff_char;
2751 		rpn->param_mask = htole16(param_mask); /* XXX */
2752 
2753 		m0->m_pkthdr.len = m0->m_len = sizeof(*hdr) + sizeof(*rpn);
2754 
2755 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_RPN);
2756 		error = ng_btsocket_rfcomm_send_uih(s,
2757 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2758 	} else
2759 		NG_FREE_M(m0); /* XXX ignore response */
2760 
2761 	return (error);
2762 } /* ng_btsocket_rfcomm_receive_rpn */
2763 
2764 /*
2765  * Receive RFCOMM RLS MCC command
2766  */
2767 
2768 static int
2769 ng_btsocket_rfcomm_receive_rls(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2770 {
2771 	struct rfcomm_mcc_hdr	*hdr = mtod(m0, struct rfcomm_mcc_hdr *);
2772 	struct rfcomm_mcc_rls	*rls = (struct rfcomm_mcc_rls *)(hdr + 1);
2773 	int			 error = 0;
2774 
2775 	mtx_assert(&s->session_mtx, MA_OWNED);
2776 
2777 	/*
2778 	 * XXX FIXME Do we have to do anything else here? Remote peer tries to
2779 	 * tell us something about DLCI. Just report what we have received and
2780 	 * return back received values as required by TS 07.10 spec.
2781 	 */
2782 
2783 	NG_BTSOCKET_RFCOMM_INFO(
2784 "%s: Got MCC RLS, dlci=%d, status=%#x, cr=%d, length=%d, session state=%d, " \
2785 "flags=%#x, mtu=%d, len=%d\n",
2786 		__func__, RFCOMM_DLCI(rls->address), rls->status,
2787 		RFCOMM_CR(hdr->type), RFCOMM_MCC_LENGTH(hdr->length),
2788 		s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2789 
2790 	if (RFCOMM_CR(hdr->type)) {
2791 		if (rls->status & 0x1)
2792 			NG_BTSOCKET_RFCOMM_ERR(
2793 "%s: Got RLS dlci=%d, error=%#x\n", __func__, RFCOMM_DLCI(rls->address),
2794 				rls->status >> 1);
2795 
2796 		hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_RLS);
2797 		error = ng_btsocket_rfcomm_send_uih(s,
2798 				RFCOMM_MKADDRESS(INITIATOR(s), 0), 0, 0, m0);
2799 	} else
2800 		NG_FREE_M(m0); /* XXX ignore responses */
2801 
2802 	return (error);
2803 } /* ng_btsocket_rfcomm_receive_rls */
2804 
2805 /*
2806  * Receive RFCOMM PN MCC command
2807  */
2808 
2809 static int
2810 ng_btsocket_rfcomm_receive_pn(ng_btsocket_rfcomm_session_p s, struct mbuf *m0)
2811 {
2812 	struct rfcomm_mcc_hdr		*hdr = mtod(m0, struct rfcomm_mcc_hdr*);
2813 	struct rfcomm_mcc_pn		*pn = (struct rfcomm_mcc_pn *)(hdr+1);
2814 	ng_btsocket_rfcomm_pcb_t	*pcb = NULL;
2815 	int				 error = 0;
2816 
2817 	mtx_assert(&s->session_mtx, MA_OWNED);
2818 
2819 	NG_BTSOCKET_RFCOMM_INFO(
2820 "%s: Got MCC PN, dlci=%d, cr=%d, length=%d, flow_control=%#x, priority=%d, " \
2821 "ack_timer=%d, mtu=%d, max_retrans=%d, credits=%d, session state=%d, " \
2822 "flags=%#x, session mtu=%d, len=%d\n",
2823 		__func__, pn->dlci, RFCOMM_CR(hdr->type),
2824 		RFCOMM_MCC_LENGTH(hdr->length), pn->flow_control, pn->priority,
2825 		pn->ack_timer, le16toh(pn->mtu), pn->max_retrans, pn->credits,
2826 		s->state, s->flags, s->mtu, m0->m_pkthdr.len);
2827 
2828 	if (pn->dlci == 0) {
2829 		NG_BTSOCKET_RFCOMM_ERR("%s: Zero dlci in MCC PN\n", __func__);
2830 		NG_FREE_M(m0);
2831 
2832 		return (EINVAL);
2833 	}
2834 
2835 	/* Check if we have this dlci */
2836 	pcb = ng_btsocket_rfcomm_pcb_by_dlci(s, pn->dlci);
2837 	if (pcb != NULL) {
2838 		mtx_lock(&pcb->pcb_mtx);
2839 
2840 		if (RFCOMM_CR(hdr->type)) {
2841 			/* PN Request */
2842 			ng_btsocket_rfcomm_set_pn(pcb, 1, pn->flow_control,
2843 				pn->credits, pn->mtu);
2844 
2845 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2846 				pn->flow_control = 0xe0;
2847 				pn->credits = RFCOMM_DEFAULT_CREDITS;
2848 			} else {
2849 				pn->flow_control = 0;
2850 				pn->credits = 0;
2851 			}
2852 
2853 			hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_PN);
2854 			error = ng_btsocket_rfcomm_send_uih(s,
2855 					RFCOMM_MKADDRESS(INITIATOR(s), 0),
2856 					0, 0, m0);
2857 		} else {
2858 			/* PN Response - proceed with SABM. Timeout still set */
2859 			if (pcb->state == NG_BTSOCKET_RFCOMM_DLC_CONFIGURING) {
2860 				ng_btsocket_rfcomm_set_pn(pcb, 0,
2861 					pn->flow_control, pn->credits, pn->mtu);
2862 
2863 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTING;
2864 				error = ng_btsocket_rfcomm_send_command(s,
2865 						RFCOMM_FRAME_SABM, pn->dlci);
2866 			} else
2867 				NG_BTSOCKET_RFCOMM_WARN(
2868 "%s: Got PN response for dlci=%d in invalid state=%d\n",
2869 					__func__, pn->dlci, pcb->state);
2870 
2871 			NG_FREE_M(m0);
2872 		}
2873 
2874 		mtx_unlock(&pcb->pcb_mtx);
2875 	} else if (RFCOMM_CR(hdr->type)) {
2876 		/* PN request to non-existing dlci - incomming connection */
2877 		pcb = ng_btsocket_rfcomm_connect_ind(s,
2878 				RFCOMM_SRVCHANNEL(pn->dlci));
2879 		if (pcb != NULL) {
2880 			mtx_lock(&pcb->pcb_mtx);
2881 
2882 			pcb->dlci = pn->dlci;
2883 
2884 			ng_btsocket_rfcomm_set_pn(pcb, 1, pn->flow_control,
2885 				pn->credits, pn->mtu);
2886 
2887 			if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
2888 				pn->flow_control = 0xe0;
2889 				pn->credits = RFCOMM_DEFAULT_CREDITS;
2890 			} else {
2891 				pn->flow_control = 0;
2892 				pn->credits = 0;
2893 			}
2894 
2895 			hdr->type = RFCOMM_MKMCC_TYPE(0, RFCOMM_MCC_PN);
2896 			error = ng_btsocket_rfcomm_send_uih(s,
2897 					RFCOMM_MKADDRESS(INITIATOR(s), 0),
2898 					0, 0, m0);
2899 
2900 			if (error == 0) {
2901 				ng_btsocket_rfcomm_timeout(pcb);
2902 				pcb->state = NG_BTSOCKET_RFCOMM_DLC_CONNECTING;
2903 				soisconnecting(pcb->so);
2904 			} else
2905 				ng_btsocket_rfcomm_pcb_kill(pcb, error);
2906 
2907 			mtx_unlock(&pcb->pcb_mtx);
2908 		} else {
2909 			/* Nobody is listen()ing on this channel */
2910 			error = ng_btsocket_rfcomm_send_command(s,
2911 					RFCOMM_FRAME_DM, pn->dlci);
2912 			NG_FREE_M(m0);
2913 		}
2914 	} else
2915 		NG_FREE_M(m0); /* XXX ignore response to non-existing dlci */
2916 
2917 	return (error);
2918 } /* ng_btsocket_rfcomm_receive_pn */
2919 
2920 /*
2921  * Set PN parameters for dlci. Caller must hold pcb->pcb_mtx.
2922  *
2923  * From Bluetooth spec.
2924  *
2925  * "... The CL1 - CL4 field is completely redefined. (In TS07.10 this defines
2926  *  the convergence layer to use, which is not applicable to RFCOMM. In RFCOMM,
2927  *  in Bluetooth versions up to 1.0B, this field was forced to 0).
2928  *
2929  *  In the PN request sent prior to a DLC establishment, this field must contain
2930  *  the value 15 (0xF), indicating support of credit based flow control in the
2931  *  sender. See Table 5.3 below. If the PN response contains any other value
2932  *  than 14 (0xE) in this field, it is inferred that the peer RFCOMM entity is
2933  *  not supporting the credit based flow control feature. (This is only possible
2934  *  if the peer RFCOMM implementation is only conforming to Bluetooth version
2935  *  1.0B.) If a PN request is sent on an already open DLC, then this field must
2936  *  contain the value zero; it is not possible to set initial credits  more
2937  *  than once per DLC activation. A responding implementation must set this
2938  *  field in the PN response to 14 (0xE), if (and only if) the value in the PN
2939  *  request was 15..."
2940  */
2941 
2942 static void
2943 ng_btsocket_rfcomm_set_pn(ng_btsocket_rfcomm_pcb_p pcb, u_int8_t cr,
2944 		u_int8_t flow_control, u_int8_t credits, u_int16_t mtu)
2945 {
2946 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
2947 
2948 	pcb->mtu = le16toh(mtu);
2949 
2950 	if (cr) {
2951 		if (flow_control == 0xf0) {
2952 			pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_CFC;
2953 			pcb->tx_cred = credits;
2954 		} else {
2955 			pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_CFC;
2956 			pcb->tx_cred = 0;
2957 		}
2958 	} else {
2959 		if (flow_control == 0xe0) {
2960 			pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_CFC;
2961 			pcb->tx_cred = credits;
2962 		} else {
2963 			pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_CFC;
2964 			pcb->tx_cred = 0;
2965 		}
2966 	}
2967 
2968 	NG_BTSOCKET_RFCOMM_INFO(
2969 "%s: cr=%d, dlci=%d, state=%d, flags=%#x, mtu=%d, rx_cred=%d, tx_cred=%d\n",
2970 		__func__, cr, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
2971 		pcb->rx_cred, pcb->tx_cred);
2972 } /* ng_btsocket_rfcomm_set_pn */
2973 
2974 /*
2975  * Send RFCOMM SABM/DISC/UA/DM frames. Caller must hold s->session_mtx
2976  */
2977 
2978 static int
2979 ng_btsocket_rfcomm_send_command(ng_btsocket_rfcomm_session_p s,
2980 		u_int8_t type, u_int8_t dlci)
2981 {
2982 	struct rfcomm_cmd_hdr	*hdr = NULL;
2983 	struct mbuf		*m = NULL;
2984 	int			 cr;
2985 
2986 	mtx_assert(&s->session_mtx, MA_OWNED);
2987 
2988 	NG_BTSOCKET_RFCOMM_INFO(
2989 "%s: Sending command type %#x, session state=%d, flags=%#x, mtu=%d, dlci=%d\n",
2990 		__func__, type, s->state, s->flags, s->mtu, dlci);
2991 
2992 	switch (type) {
2993 	case RFCOMM_FRAME_SABM:
2994 	case RFCOMM_FRAME_DISC:
2995 		cr = INITIATOR(s);
2996 		break;
2997 
2998 	case RFCOMM_FRAME_UA:
2999 	case RFCOMM_FRAME_DM:
3000 		cr = !INITIATOR(s);
3001 		break;
3002 
3003 	default:
3004 		panic("%s: Invalid frame type=%#x", __func__, type);
3005 		return (EINVAL);
3006 		/* NOT REACHED */
3007 	}
3008 
3009 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
3010 	if (m == NULL)
3011 		return (ENOBUFS);
3012 
3013 	m->m_pkthdr.len = m->m_len = sizeof(*hdr);
3014 
3015 	hdr = mtod(m, struct rfcomm_cmd_hdr *);
3016 	hdr->address = RFCOMM_MKADDRESS(cr, dlci);
3017 	hdr->control = RFCOMM_MKCONTROL(type, 1);
3018 	hdr->length = RFCOMM_MKLEN8(0);
3019 	hdr->fcs = ng_btsocket_rfcomm_fcs3((u_int8_t *) hdr);
3020 
3021 	NG_BT_MBUFQ_ENQUEUE(&s->outq, m);
3022 
3023 	return (0);
3024 } /* ng_btsocket_rfcomm_send_command */
3025 
3026 /*
3027  * Send RFCOMM UIH frame. Caller must hold s->session_mtx
3028  */
3029 
3030 static int
3031 ng_btsocket_rfcomm_send_uih(ng_btsocket_rfcomm_session_p s, u_int8_t address,
3032 		u_int8_t pf, u_int8_t credits, struct mbuf *data)
3033 {
3034 	struct rfcomm_frame_hdr	*hdr = NULL;
3035 	struct mbuf		*m = NULL, *mcrc = NULL;
3036 	u_int16_t		 length;
3037 
3038 	mtx_assert(&s->session_mtx, MA_OWNED);
3039 
3040 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
3041 	if (m == NULL) {
3042 		NG_FREE_M(data);
3043 		return (ENOBUFS);
3044 	}
3045 	m->m_pkthdr.len = m->m_len = sizeof(*hdr);
3046 
3047 	MGET(mcrc, MB_DONTWAIT, MT_DATA);
3048 	if (mcrc == NULL) {
3049 		NG_FREE_M(data);
3050 		return (ENOBUFS);
3051 	}
3052 	mcrc->m_len = 1;
3053 
3054 	/* Fill UIH frame header */
3055 	hdr = mtod(m, struct rfcomm_frame_hdr *);
3056 	hdr->address = address;
3057 	hdr->control = RFCOMM_MKCONTROL(RFCOMM_FRAME_UIH, pf);
3058 
3059 	/* Calculate FCS */
3060 	mcrc->m_data[0] = ng_btsocket_rfcomm_fcs2((u_int8_t *) hdr);
3061 
3062 	/* Put length back */
3063 	length = (data != NULL)? data->m_pkthdr.len : 0;
3064 	if (length > 127) {
3065 		u_int16_t	l = htole16(RFCOMM_MKLEN16(length));
3066 
3067 		bcopy(&l, &hdr->length, sizeof(l));
3068 		m->m_pkthdr.len ++;
3069 		m->m_len ++;
3070 	} else
3071 		hdr->length = RFCOMM_MKLEN8(length);
3072 
3073 	if (pf) {
3074 		m->m_data[m->m_len] = credits;
3075 		m->m_pkthdr.len ++;
3076 		m->m_len ++;
3077 	}
3078 
3079 	/* Add payload */
3080 	if (data != NULL) {
3081 		m_cat(m, data);
3082 		m->m_pkthdr.len += length;
3083 	}
3084 
3085 	/* Put FCS back */
3086 	m_cat(m, mcrc);
3087 	m->m_pkthdr.len ++;
3088 
3089 	NG_BTSOCKET_RFCOMM_INFO(
3090 "%s: Sending UIH state=%d, flags=%#x, address=%d, length=%d, pf=%d, " \
3091 "credits=%d, len=%d\n",
3092 		__func__, s->state, s->flags, address, length, pf, credits,
3093 		m->m_pkthdr.len);
3094 
3095 	NG_BT_MBUFQ_ENQUEUE(&s->outq, m);
3096 
3097 	return (0);
3098 } /* ng_btsocket_rfcomm_send_uih */
3099 
3100 /*
3101  * Send MSC request. Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3102  */
3103 
3104 static int
3105 ng_btsocket_rfcomm_send_msc(ng_btsocket_rfcomm_pcb_p pcb)
3106 {
3107 	struct mbuf		*m = NULL;
3108 	struct rfcomm_mcc_hdr	*hdr = NULL;
3109 	struct rfcomm_mcc_msc	*msc = NULL;
3110 
3111 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3112 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3113 
3114 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
3115 	if (m == NULL)
3116 		return (ENOBUFS);
3117 
3118 	m->m_pkthdr.len = m->m_len = sizeof(*hdr) + sizeof(*msc);
3119 
3120 	hdr = mtod(m, struct rfcomm_mcc_hdr *);
3121 	msc = (struct rfcomm_mcc_msc *)(hdr + 1);
3122 
3123 	hdr->type = RFCOMM_MKMCC_TYPE(1, RFCOMM_MCC_MSC);
3124 	hdr->length = RFCOMM_MKLEN8(sizeof(*msc));
3125 
3126 	msc->address = RFCOMM_MKADDRESS(1, pcb->dlci);
3127 	msc->modem = pcb->lmodem;
3128 
3129 	NG_BTSOCKET_RFCOMM_INFO(
3130 "%s: Sending MSC dlci=%d, state=%d, flags=%#x, address=%d, modem=%#x\n",
3131 		__func__, pcb->dlci, pcb->state, pcb->flags, msc->address,
3132 		msc->modem);
3133 
3134 	return (ng_btsocket_rfcomm_send_uih(pcb->session,
3135 			RFCOMM_MKADDRESS(INITIATOR(pcb->session), 0), 0, 0, m));
3136 } /* ng_btsocket_rfcomm_send_msc */
3137 
3138 /*
3139  * Send PN request. Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3140  */
3141 
3142 static int
3143 ng_btsocket_rfcomm_send_pn(ng_btsocket_rfcomm_pcb_p pcb)
3144 {
3145 	struct mbuf		*m = NULL;
3146 	struct rfcomm_mcc_hdr	*hdr = NULL;
3147 	struct rfcomm_mcc_pn	*pn = NULL;
3148 
3149 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3150 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3151 
3152 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
3153 	if (m == NULL)
3154 		return (ENOBUFS);
3155 
3156 	m->m_pkthdr.len = m->m_len = sizeof(*hdr) + sizeof(*pn);
3157 
3158 	hdr = mtod(m, struct rfcomm_mcc_hdr *);
3159 	pn = (struct rfcomm_mcc_pn *)(hdr + 1);
3160 
3161 	hdr->type = RFCOMM_MKMCC_TYPE(1, RFCOMM_MCC_PN);
3162 	hdr->length = RFCOMM_MKLEN8(sizeof(*pn));
3163 
3164 	pn->dlci = pcb->dlci;
3165 
3166 	/*
3167 	 * Set default DLCI priority as described in GSM 07.10
3168 	 * (ETSI TS 101 369) clause 5.6 page 42
3169 	 */
3170 
3171 	pn->priority = (pcb->dlci < 56)? (((pcb->dlci >> 3) << 3) + 7) : 61;
3172 	pn->ack_timer = 0;
3173 	pn->mtu = htole16(pcb->mtu);
3174 	pn->max_retrans = 0;
3175 
3176 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC) {
3177 		pn->flow_control = 0xf0;
3178 		pn->credits = pcb->rx_cred;
3179 	} else {
3180 		pn->flow_control = 0;
3181 		pn->credits = 0;
3182 	}
3183 
3184 	NG_BTSOCKET_RFCOMM_INFO(
3185 "%s: Sending PN dlci=%d, state=%d, flags=%#x, mtu=%d, flow_control=%#x, " \
3186 "credits=%d\n",	__func__, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
3187 		pn->flow_control, pn->credits);
3188 
3189 	return (ng_btsocket_rfcomm_send_uih(pcb->session,
3190 			RFCOMM_MKADDRESS(INITIATOR(pcb->session), 0), 0, 0, m));
3191 } /* ng_btsocket_rfcomm_send_pn */
3192 
3193 /*
3194  * Calculate and send credits based on available space in receive buffer
3195  */
3196 
3197 static int
3198 ng_btsocket_rfcomm_send_credits(ng_btsocket_rfcomm_pcb_p pcb)
3199 {
3200 	int		error = 0;
3201 	u_int8_t	credits;
3202 
3203 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3204 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3205 
3206 	NG_BTSOCKET_RFCOMM_INFO(
3207 "%s: Sending more credits, dlci=%d, state=%d, flags=%#x, mtu=%d, " \
3208 "space=%ld, tx_cred=%d, rx_cred=%d\n",
3209 		__func__, pcb->dlci, pcb->state, pcb->flags, pcb->mtu,
3210 		sbspace(&pcb->so->so_rcv), pcb->tx_cred, pcb->rx_cred);
3211 
3212 	credits = sbspace(&pcb->so->so_rcv) / pcb->mtu;
3213 	if (credits > 0) {
3214 		if (pcb->rx_cred + credits > RFCOMM_MAX_CREDITS)
3215 			credits = RFCOMM_MAX_CREDITS - pcb->rx_cred;
3216 
3217 		error = ng_btsocket_rfcomm_send_uih(
3218 				pcb->session,
3219 				RFCOMM_MKADDRESS(INITIATOR(pcb->session),
3220 					pcb->dlci), 1, credits, NULL);
3221 		if (error == 0) {
3222 			pcb->rx_cred += credits;
3223 
3224 			NG_BTSOCKET_RFCOMM_INFO(
3225 "%s: Gave remote side %d more credits, dlci=%d, state=%d, flags=%#x, " \
3226 "rx_cred=%d, tx_cred=%d\n",	__func__, credits, pcb->dlci, pcb->state,
3227 				pcb->flags, pcb->rx_cred, pcb->tx_cred);
3228 		} else
3229 			NG_BTSOCKET_RFCOMM_ERR(
3230 "%s: Could not send credits, error=%d, dlci=%d, state=%d, flags=%#x, " \
3231 "mtu=%d, space=%ld, tx_cred=%d, rx_cred=%d\n",
3232 				__func__, error, pcb->dlci, pcb->state,
3233 				pcb->flags, pcb->mtu, sbspace(&pcb->so->so_rcv),
3234 				pcb->tx_cred, pcb->rx_cred);
3235 	}
3236 
3237 	return (error);
3238 } /* ng_btsocket_rfcomm_send_credits */
3239 
3240 /*****************************************************************************
3241  *****************************************************************************
3242  **                              RFCOMM DLCs
3243  *****************************************************************************
3244  *****************************************************************************/
3245 
3246 /*
3247  * Send data from socket send buffer
3248  * Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3249  */
3250 
3251 static int
3252 ng_btsocket_rfcomm_pcb_send(ng_btsocket_rfcomm_pcb_p pcb, int limit)
3253 {
3254 	struct mbuf	*m = NULL;
3255 	int		 sent, length, error;
3256 
3257 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3258 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3259 
3260 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)
3261 		limit = min(limit, pcb->tx_cred);
3262 	else if (!(pcb->rmodem & RFCOMM_MODEM_FC))
3263 		limit = min(limit, RFCOMM_MAX_CREDITS); /* XXX ??? */
3264 	else
3265 		limit = 0;
3266 
3267 	if (limit == 0) {
3268 		NG_BTSOCKET_RFCOMM_INFO(
3269 "%s: Could not send - remote flow control asserted, dlci=%d, flags=%#x, " \
3270 "rmodem=%#x, tx_cred=%d\n",
3271 			__func__, pcb->dlci, pcb->flags, pcb->rmodem,
3272 			pcb->tx_cred);
3273 
3274 		return (0);
3275 	}
3276 
3277 	for (error = 0, sent = 0; sent < limit; sent ++) {
3278 		length = min(pcb->mtu, pcb->so->so_snd.sb_cc);
3279 		if (length == 0)
3280 			break;
3281 
3282 		/* Get the chunk from the socket's send buffer */
3283 		m = ng_btsocket_rfcomm_prepare_packet(&pcb->so->so_snd, length);
3284 		if (m == NULL) {
3285 			error = ENOBUFS;
3286 			break;
3287 		}
3288 
3289 		sbdrop(&pcb->so->so_snd, length);
3290 
3291 		error = ng_btsocket_rfcomm_send_uih(pcb->session,
3292 				RFCOMM_MKADDRESS(INITIATOR(pcb->session),
3293 					pcb->dlci), 0, 0, m);
3294 		if (error != 0)
3295 			break;
3296 	}
3297 
3298 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_CFC)
3299 		pcb->tx_cred -= sent;
3300 
3301 	if (error == 0 && sent > 0) {
3302 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_SENDING;
3303 		sowwakeup(pcb->so);
3304 	}
3305 
3306 	return (error);
3307 } /* ng_btsocket_rfcomm_pcb_send */
3308 
3309 /*
3310  * Unlink and disconnect DLC. If ng_btsocket_rfcomm_pcb_kill() returns
3311  * non zero value than socket has no reference and has to be detached.
3312  * Caller must hold pcb->pcb_mtx and pcb->session->session_mtx
3313  */
3314 
3315 static void
3316 ng_btsocket_rfcomm_pcb_kill(ng_btsocket_rfcomm_pcb_p pcb, int error)
3317 {
3318 	ng_btsocket_rfcomm_session_p	s = pcb->session;
3319 
3320 	NG_BTSOCKET_RFCOMM_INFO(
3321 "%s: Killing DLC, so=%p, dlci=%d, state=%d, flags=%#x, error=%d\n",
3322 		__func__, pcb->so, pcb->dlci, pcb->state, pcb->flags, error);
3323 
3324 	if (pcb->session == NULL)
3325 		panic("%s: DLC without session, pcb=%p, state=%d, flags=%#x",
3326 			__func__, pcb, pcb->state, pcb->flags);
3327 
3328 	mtx_assert(&pcb->session->session_mtx, MA_OWNED);
3329 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3330 
3331 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)
3332 		ng_btsocket_rfcomm_untimeout(pcb);
3333 
3334 	/* Detach DLC from the session. Does not matter which state DLC in */
3335 	LIST_REMOVE(pcb, session_next);
3336 	pcb->session = NULL;
3337 
3338 	/* Change DLC state and wakeup all sleepers */
3339 	pcb->state = NG_BTSOCKET_RFCOMM_DLC_CLOSED;
3340 	pcb->so->so_error = error;
3341 	soisdisconnected(pcb->so);
3342 	wakeup(&pcb->state);
3343 
3344 	/* Check if we have any DLCs left on the session */
3345 	if (LIST_EMPTY(&s->dlcs) && INITIATOR(s)) {
3346 		NG_BTSOCKET_RFCOMM_INFO(
3347 "%s: Disconnecting session, state=%d, flags=%#x, mtu=%d\n",
3348 			__func__, s->state, s->flags, s->mtu);
3349 
3350 		switch (s->state) {
3351 		case NG_BTSOCKET_RFCOMM_SESSION_CLOSED:
3352 		case NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING:
3353 			/*
3354 			 * Do not have to do anything here. We can get here
3355 			 * when L2CAP connection was terminated or we have
3356 			 * received DISC on multiplexor channel
3357 			 */
3358 			break;
3359 
3360 		case NG_BTSOCKET_RFCOMM_SESSION_OPEN:
3361 			/* Send DISC on multiplexor channel */
3362 			error = ng_btsocket_rfcomm_send_command(s,
3363 					RFCOMM_FRAME_DISC, 0);
3364 			if (error == 0) {
3365 				s->state = NG_BTSOCKET_RFCOMM_SESSION_DISCONNECTING;
3366 				break;
3367 			}
3368 			/* FALL THROUGH */
3369 
3370 		case NG_BTSOCKET_RFCOMM_SESSION_CONNECTING:
3371 		case NG_BTSOCKET_RFCOMM_SESSION_CONNECTED:
3372 			s->state = NG_BTSOCKET_RFCOMM_SESSION_CLOSED;
3373 			break;
3374 
3375 /*		case NG_BTSOCKET_RFCOMM_SESSION_LISTENING: */
3376 		default:
3377 			panic("%s: Invalid session state=%d, flags=%#x",
3378 				__func__, s->state, s->flags);
3379 			break;
3380 		}
3381 
3382 		ng_btsocket_rfcomm_task_wakeup();
3383 	}
3384 } /* ng_btsocket_rfcomm_pcb_kill */
3385 
3386 /*
3387  * Look for given dlci for given RFCOMM session. Caller must hold s->session_mtx
3388  */
3389 
3390 static ng_btsocket_rfcomm_pcb_p
3391 ng_btsocket_rfcomm_pcb_by_dlci(ng_btsocket_rfcomm_session_p s, int dlci)
3392 {
3393 	ng_btsocket_rfcomm_pcb_p	pcb = NULL;
3394 
3395 	mtx_assert(&s->session_mtx, MA_OWNED);
3396 
3397 	LIST_FOREACH(pcb, &s->dlcs, session_next)
3398 		if (pcb->dlci == dlci)
3399 			break;
3400 
3401 	return (pcb);
3402 } /* ng_btsocket_rfcomm_pcb_by_dlci */
3403 
3404 /*
3405  * Look for socket that listens on given src address and given channel
3406  */
3407 
3408 static ng_btsocket_rfcomm_pcb_p
3409 ng_btsocket_rfcomm_pcb_listener(bdaddr_p src, int channel)
3410 {
3411 	ng_btsocket_rfcomm_pcb_p	pcb = NULL, pcb1 = NULL;
3412 
3413 	mtx_lock(&ng_btsocket_rfcomm_sockets_mtx);
3414 
3415 	LIST_FOREACH(pcb, &ng_btsocket_rfcomm_sockets, next) {
3416 		if (pcb->channel != channel ||
3417 		    !(pcb->so->so_options & SO_ACCEPTCONN))
3418 			continue;
3419 
3420 		if (bcmp(&pcb->src, src, sizeof(*src)) == 0)
3421 			break;
3422 
3423 		if (bcmp(&pcb->src, NG_HCI_BDADDR_ANY, sizeof(bdaddr_t)) == 0)
3424 			pcb1 = pcb;
3425 	}
3426 
3427 	mtx_unlock(&ng_btsocket_rfcomm_sockets_mtx);
3428 
3429 	return ((pcb != NULL)? pcb : pcb1);
3430 } /* ng_btsocket_rfcomm_pcb_listener */
3431 
3432 /*****************************************************************************
3433  *****************************************************************************
3434  **                              Misc. functions
3435  *****************************************************************************
3436  *****************************************************************************/
3437 
3438 /*
3439  *  Set timeout. Caller MUST hold pcb_mtx
3440  */
3441 
3442 static void
3443 ng_btsocket_rfcomm_timeout(ng_btsocket_rfcomm_pcb_p pcb)
3444 {
3445 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3446 
3447 	if (!(pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO)) {
3448 		pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_TIMO;
3449 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3450 		pcb->timo = timeout(ng_btsocket_rfcomm_process_timeout, pcb,
3451 					ng_btsocket_rfcomm_timo * hz);
3452 	} else
3453 		panic("%s: Duplicated socket timeout?!", __func__);
3454 } /* ng_btsocket_rfcomm_timeout */
3455 
3456 /*
3457  *  Unset pcb timeout. Caller MUST hold pcb_mtx
3458  */
3459 
3460 static void
3461 ng_btsocket_rfcomm_untimeout(ng_btsocket_rfcomm_pcb_p pcb)
3462 {
3463 	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
3464 
3465 	if (pcb->flags & NG_BTSOCKET_RFCOMM_DLC_TIMO) {
3466 		untimeout(ng_btsocket_rfcomm_process_timeout, pcb, pcb->timo);
3467 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMO;
3468 		pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3469 	} else
3470 		panic("%s: No socket timeout?!", __func__);
3471 } /* ng_btsocket_rfcomm_timeout */
3472 
3473 /*
3474  * Process pcb timeout
3475  */
3476 
3477 static void
3478 ng_btsocket_rfcomm_process_timeout(void *xpcb)
3479 {
3480 	ng_btsocket_rfcomm_pcb_p	pcb = (ng_btsocket_rfcomm_pcb_p) xpcb;
3481 
3482 	mtx_lock(&pcb->pcb_mtx);
3483 
3484 	NG_BTSOCKET_RFCOMM_INFO(
3485 "%s: Timeout, so=%p, dlci=%d, state=%d, flags=%#x\n",
3486 		__func__, pcb->so, pcb->dlci, pcb->state, pcb->flags);
3487 
3488 	pcb->flags &= ~NG_BTSOCKET_RFCOMM_DLC_TIMO;
3489 	pcb->flags |= NG_BTSOCKET_RFCOMM_DLC_TIMEDOUT;
3490 
3491 	switch (pcb->state) {
3492 	case NG_BTSOCKET_RFCOMM_DLC_CONFIGURING:
3493 	case NG_BTSOCKET_RFCOMM_DLC_CONNECTING:
3494 		pcb->state = NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING;
3495 		break;
3496 
3497 	case NG_BTSOCKET_RFCOMM_DLC_W4_CONNECT:
3498 	case NG_BTSOCKET_RFCOMM_DLC_DISCONNECTING:
3499 		break;
3500 
3501 	default:
3502 		panic(
3503 "%s: DLC timeout in invalid state, dlci=%d, state=%d, flags=%#x\n",
3504 			__func__, pcb->dlci, pcb->state, pcb->flags);
3505 		break;
3506 	}
3507 
3508 	ng_btsocket_rfcomm_task_wakeup();
3509 
3510 	mtx_unlock(&pcb->pcb_mtx);
3511 } /* ng_btsocket_rfcomm_process_timeout */
3512 
3513 /*
3514  * Get up to length bytes from the socket buffer
3515  */
3516 
3517 static struct mbuf *
3518 ng_btsocket_rfcomm_prepare_packet(struct sockbuf *sb, int length)
3519 {
3520 	struct mbuf	*top = NULL, *m = NULL, *n = NULL, *nextpkt = NULL;
3521 	int		 mlen, noff, len;
3522 
3523 	MGETHDR(top, MB_DONTWAIT, MT_DATA);
3524 	if (top == NULL)
3525 		return (NULL);
3526 
3527 	top->m_pkthdr.len = length;
3528 	top->m_len = 0;
3529 	mlen = MHLEN;
3530 
3531 	m = top;
3532 	n = sb->sb_mb;
3533 	nextpkt = n->m_nextpkt;
3534 	noff = 0;
3535 
3536 	while (length > 0 && n != NULL) {
3537 		len = min(mlen - m->m_len, n->m_len - noff);
3538 		if (len > length)
3539 			len = length;
3540 
3541 		bcopy(mtod(n, caddr_t)+noff, mtod(m, caddr_t)+m->m_len, len);
3542 		m->m_len += len;
3543 		noff += len;
3544 		length -= len;
3545 
3546 		if (length > 0 && m->m_len == mlen) {
3547 			MGET(m->m_next, MB_DONTWAIT, MT_DATA);
3548 			if (m->m_next == NULL) {
3549 				NG_FREE_M(top);
3550 				return (NULL);
3551 			}
3552 
3553 			m = m->m_next;
3554 			m->m_len = 0;
3555 			mlen = MLEN;
3556 		}
3557 
3558 		if (noff == n->m_len) {
3559 			noff = 0;
3560 			n = n->m_next;
3561 
3562 			if (n == NULL)
3563 				n = nextpkt;
3564 
3565 			nextpkt = (n != NULL)? n->m_nextpkt : NULL;
3566 		}
3567 	}
3568 
3569 	if (length < 0)
3570 		panic("%s: length=%d", __func__, length);
3571 	if (length > 0 && n == NULL)
3572 		panic("%s: bogus length=%d, n=%p", __func__, length, n);
3573 
3574 	return (top);
3575 } /* ng_btsocket_rfcomm_prepare_packet */
3576 
3577