1 /*
2  * ng_l2cap_main.c
3  */
4 
5 /*-
6  * Copyright (c) Maksim Yevmenkin <m_evmenkin@yahoo.com>
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  * $Id: ng_l2cap_main.c,v 1.2 2003/04/28 21:44:59 max Exp $
31  * $FreeBSD$
32  */
33 
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/kernel.h>
37 #include <sys/malloc.h>
38 #include <sys/mbuf.h>
39 #include <sys/queue.h>
40 #include <netgraph/ng_message.h>
41 #include <netgraph/netgraph.h>
42 #include <netgraph/ng_parse.h>
43 #include <netgraph/bluetooth/include/ng_bluetooth.h>
44 #include <netgraph/bluetooth/include/ng_hci.h>
45 #include <netgraph/bluetooth/include/ng_l2cap.h>
46 #include <netgraph/bluetooth/l2cap/ng_l2cap_var.h>
47 #include <netgraph/bluetooth/l2cap/ng_l2cap_cmds.h>
48 #include <netgraph/bluetooth/l2cap/ng_l2cap_evnt.h>
49 #include <netgraph/bluetooth/l2cap/ng_l2cap_llpi.h>
50 #include <netgraph/bluetooth/l2cap/ng_l2cap_ulpi.h>
51 #include <netgraph/bluetooth/l2cap/ng_l2cap_misc.h>
52 #include <netgraph/bluetooth/l2cap/ng_l2cap_prse.h>
53 
54 /******************************************************************************
55  ******************************************************************************
56  **  This node implements Link Layer Control and Adaptation Protocol (L2CAP)
57  ******************************************************************************
58  ******************************************************************************/
59 
60 /* MALLOC define */
61 #ifdef NG_SEPARATE_MALLOC
62 MALLOC_DEFINE(M_NETGRAPH_L2CAP, "netgraph_l2cap",
63 	"Netgraph Bluetooth L2CAP node");
64 #else
65 #define M_NETGRAPH_L2CAP M_NETGRAPH
66 #endif /* NG_SEPARATE_MALLOC */
67 
68 /* Netgraph node methods */
69 static	ng_constructor_t	ng_l2cap_constructor;
70 static	ng_shutdown_t		ng_l2cap_shutdown;
71 static	ng_newhook_t		ng_l2cap_newhook;
72 static	ng_connect_t		ng_l2cap_connect;
73 static	ng_disconnect_t		ng_l2cap_disconnect;
74 static	ng_rcvmsg_t		ng_l2cap_lower_rcvmsg;
75 static	ng_rcvmsg_t		ng_l2cap_upper_rcvmsg;
76 static	ng_rcvmsg_t		ng_l2cap_default_rcvmsg;
77 static	ng_rcvdata_t		ng_l2cap_rcvdata;
78 
79 /* Netgraph node type descriptor */
80 static	struct ng_type typestruct = {
81 	.version =	NG_ABI_VERSION,
82 	.name =		NG_L2CAP_NODE_TYPE,
83 	.constructor =	ng_l2cap_constructor,
84 	.rcvmsg =	ng_l2cap_default_rcvmsg,
85 	.shutdown =	ng_l2cap_shutdown,
86 	.newhook =	ng_l2cap_newhook,
87 	.connect =	ng_l2cap_connect,
88 	.rcvdata =	ng_l2cap_rcvdata,
89 	.disconnect =	ng_l2cap_disconnect,
90 	.cmdlist =	ng_l2cap_cmdlist,
91 };
92 NETGRAPH_INIT(l2cap, &typestruct);
93 MODULE_VERSION(ng_l2cap, NG_BLUETOOTH_VERSION);
94 MODULE_DEPEND(ng_l2cap, ng_bluetooth, NG_BLUETOOTH_VERSION,
95         NG_BLUETOOTH_VERSION, NG_BLUETOOTH_VERSION);
96 
97 /*****************************************************************************
98  *****************************************************************************
99  **                   Netgraph methods implementation
100  *****************************************************************************
101  *****************************************************************************/
102 
103 static void ng_l2cap_cleanup          (ng_l2cap_p);
104 static void ng_l2cap_destroy_channels (ng_l2cap_p);
105 
106 /*
107  * Create new instance of L2CAP node
108  */
109 
110 static int
111 ng_l2cap_constructor(node_p node)
112 {
113 	ng_l2cap_p	l2cap = NULL;
114 
115 	/* Create new L2CAP node */
116 	l2cap = malloc(sizeof(*l2cap), M_NETGRAPH_L2CAP, M_WAITOK | M_ZERO);
117 
118 	l2cap->node = node;
119 	l2cap->debug = NG_L2CAP_WARN_LEVEL;
120 	l2cap->discon_timo = 5; /* sec */
121 
122 	LIST_INIT(&l2cap->con_list);
123 	LIST_INIT(&l2cap->chan_list);
124 
125 	NG_NODE_SET_PRIVATE(node, l2cap);
126 	NG_NODE_FORCE_WRITER(node);
127 
128 	return (0);
129 } /* ng_l2cap_constructor */
130 
131 /*
132  * Shutdown L2CAP node
133  */
134 
135 static int
136 ng_l2cap_shutdown(node_p node)
137 {
138 	ng_l2cap_p	l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
139 
140 	NG_NODE_SET_PRIVATE(node, NULL);
141 	NG_NODE_UNREF(node);
142 
143 	/* Clean up L2CAP node. Delete all connection, channels and commands */
144 	l2cap->node = NULL;
145 	ng_l2cap_cleanup(l2cap);
146 
147 	bzero(l2cap, sizeof(*l2cap));
148 	free(l2cap, M_NETGRAPH_L2CAP);
149 
150 	return (0);
151 } /* ng_l2cap_shutdown */
152 
153 /*
154  * Give our OK for a hook to be added. HCI layer is connected to the HCI
155  * (NG_L2CAP_HOOK_HCI) hook. As per specification L2CAP layer MUST provide
156  * Procol/Service Multiplexing, so the L2CAP node provides separate hooks
157  * for SDP (NG_L2CAP_HOOK_SDP), RFCOMM (NG_L2CAP_HOOK_RFCOMM) and TCP
158  * (NG_L2CAP_HOOK_TCP) protcols. Unknown PSM will be forwarded to
159  * NG_L2CAP_HOOK_ORPHAN hook. Control node/application is connected to
160  * control (NG_L2CAP_HOOK_CTL) hook.
161  */
162 
163 static int
164 ng_l2cap_newhook(node_p node, hook_p hook, char const *name)
165 {
166 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
167 	hook_p		*h = NULL;
168 
169 	if (strcmp(name, NG_L2CAP_HOOK_HCI) == 0)
170 		h = &l2cap->hci;
171 	else if (strcmp(name, NG_L2CAP_HOOK_L2C) == 0)
172 		h = &l2cap->l2c;
173 	else if (strcmp(name, NG_L2CAP_HOOK_CTL) == 0)
174 		h = &l2cap->ctl;
175 	else
176 		return (EINVAL);
177 
178 	if (*h != NULL)
179 		return (EISCONN);
180 
181 	*h = hook;
182 
183 	return (0);
184 } /* ng_l2cap_newhook */
185 
186 /*
187  * Give our final OK to connect hook. Nothing to do here.
188  */
189 
190 static int
191 ng_l2cap_connect(hook_p hook)
192 {
193 	ng_l2cap_p	l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
194 	int		error = 0;
195 
196 	if (hook == l2cap->hci)
197 		NG_HOOK_SET_RCVMSG(hook, ng_l2cap_lower_rcvmsg);
198 	else
199 	if (hook == l2cap->l2c || hook == l2cap->ctl) {
200 		NG_HOOK_SET_RCVMSG(hook, ng_l2cap_upper_rcvmsg);
201 
202 		/* Send delayed notification to the upper layer */
203 		error = ng_send_fn(l2cap->node, hook, ng_l2cap_send_hook_info,
204 				NULL, 0);
205 	} else
206 		error = EINVAL;
207 
208 	return (error);
209 } /* ng_l2cap_connect */
210 
211 /*
212  * Disconnect the hook. For downstream hook we must notify upper layers.
213  *
214  * XXX For upstream hooks this is really ugly :( Hook was disconnected and it
215  * XXX is now too late to do anything. For now we just clean up our own mess
216  * XXX and remove all channels that use disconnected upstream hook. If we don't
217  * XXX do that then L2CAP node can get out of sync with upper layers.
218  * XXX No notification will be sent to remote peer.
219  */
220 
221 static int
222 ng_l2cap_disconnect(hook_p hook)
223 {
224 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
225 	hook_p		*h = NULL;
226 
227 	if (hook == l2cap->hci) {
228 		ng_l2cap_cleanup(l2cap);
229 		h = &l2cap->hci;
230 	} else
231 	if (hook == l2cap->l2c) {
232 		ng_l2cap_destroy_channels(l2cap);
233 		h = &l2cap->l2c;
234 	} else
235 	if (hook == l2cap->ctl)
236 		h = &l2cap->ctl;
237 	else
238 		return (EINVAL);
239 
240 	*h = NULL;
241 
242 	/* Shutdown when all hooks are disconnected */
243 	if (NG_NODE_NUMHOOKS(NG_HOOK_NODE(hook)) == 0 &&
244 	    NG_NODE_IS_VALID(NG_HOOK_NODE(hook)))
245 		ng_rmnode_self(NG_HOOK_NODE(hook));
246 
247 	return (0);
248 } /* ng_l2cap_disconnect */
249 
250 /*
251  * Process control message from lower layer
252  */
253 
254 static int
255 ng_l2cap_lower_rcvmsg(node_p node, item_p item, hook_p lasthook)
256 {
257 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
258 	struct ng_mesg	*msg = NGI_MSG(item); /* item still has message */
259 	int		 error = 0;
260 
261 	switch (msg->header.typecookie) {
262 	case NGM_HCI_COOKIE:
263 		switch (msg->header.cmd) {
264 		/* HCI node is ready */
265 		case NGM_HCI_NODE_UP: {
266 			ng_hci_node_up_ep	*ep = NULL;
267 
268 			if (msg->header.arglen != sizeof(*ep))
269 				error = EMSGSIZE;
270 			else {
271 				ep = (ng_hci_node_up_ep *)(msg->data);
272 
273 				NG_L2CAP_INFO(
274 "%s: %s - HCI node is up, bdaddr: %x:%x:%x:%x:%x:%x, " \
275 "pkt_size=%d bytes, num_pkts=%d\n",	__func__, NG_NODE_NAME(l2cap->node),
276 					ep->bdaddr.b[5], ep->bdaddr.b[4],
277 					ep->bdaddr.b[3], ep->bdaddr.b[2],
278 					ep->bdaddr.b[1], ep->bdaddr.b[0],
279 					ep->pkt_size, ep->num_pkts);
280 
281 				bcopy(&ep->bdaddr, &l2cap->bdaddr,
282 					sizeof(l2cap->bdaddr));
283 				l2cap->pkt_size = ep->pkt_size;
284 				l2cap->num_pkts = ep->num_pkts;
285 
286 				/* Notify upper layers */
287 				ng_l2cap_send_hook_info(l2cap->node,
288 					l2cap->l2c, NULL, 0);
289 				ng_l2cap_send_hook_info(l2cap->node,
290 					l2cap->ctl, NULL, 0);
291 			}
292 			} break;
293 
294 		case NGM_HCI_SYNC_CON_QUEUE: {
295 			ng_hci_sync_con_queue_ep	*ep = NULL;
296 			ng_l2cap_con_p			 con = NULL;
297 
298 			if (msg->header.arglen != sizeof(*ep))
299 				error = EMSGSIZE;
300 			else {
301 				ep = (ng_hci_sync_con_queue_ep *)(msg->data);
302 				con = ng_l2cap_con_by_handle(l2cap,
303 							ep->con_handle);
304 				if (con == NULL)
305 					break;
306 
307 				NG_L2CAP_INFO(
308 "%s: %s - sync HCI connection queue, con_handle=%d, pending=%d, completed=%d\n",
309 					 __func__, NG_NODE_NAME(l2cap->node),
310 					ep->con_handle, con->pending,
311 					ep->completed);
312 
313 				con->pending -= ep->completed;
314 				if (con->pending < 0) {
315 					NG_L2CAP_WARN(
316 "%s: %s - pending packet counter is out of sync! " \
317 "con_handle=%d, pending=%d, completed=%d\n",	__func__,
318 						NG_NODE_NAME(l2cap->node),
319 						con->con_handle, con->pending,
320 						ep->completed);
321 
322 					con->pending = 0;
323 				}
324 
325 				ng_l2cap_lp_deliver(con);
326 			}
327 			} break;
328 
329 		/* LP_ConnectCfm[Neg] */
330 		case NGM_HCI_LP_CON_CFM:
331 			error = ng_l2cap_lp_con_cfm(l2cap, msg);
332 			break;
333 
334 		/* LP_ConnectInd */
335 		case NGM_HCI_LP_CON_IND:
336 			error = ng_l2cap_lp_con_ind(l2cap, msg);
337 			break;
338 
339 		/* LP_DisconnectInd */
340 		case NGM_HCI_LP_DISCON_IND:
341 			error = ng_l2cap_lp_discon_ind(l2cap, msg);
342 			break;
343 
344 		/* LP_QoSSetupCfm[Neg] */
345 		case NGM_HCI_LP_QOS_CFM:
346 			error = ng_l2cap_lp_qos_cfm(l2cap, msg);
347 			break;
348 
349 		/* LP_OoSViolationInd */
350 		case NGM_HCI_LP_QOS_IND:
351 			error = ng_l2cap_lp_qos_ind(l2cap, msg);
352 			break;
353 
354 		default:
355 			error = EINVAL;
356 			break;
357 		}
358 		break;
359 
360 	default:
361 		return (ng_l2cap_default_rcvmsg(node, item, lasthook));
362 		/* NOT REACHED */
363 	}
364 
365 	NG_FREE_ITEM(item);
366 
367 	return (error);
368 } /* ng_l2cap_lower_rcvmsg */
369 
370 /*
371  * Process control message from upper layer
372  */
373 
374 static int
375 ng_l2cap_upper_rcvmsg(node_p node, item_p item, hook_p lasthook)
376 {
377 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
378 	struct ng_mesg	*msg = NGI_MSG(item); /* item still has message */
379 	int		 error = 0;
380 
381 	switch (msg->header.typecookie) {
382 	case NGM_L2CAP_COOKIE:
383 		switch (msg->header.cmd) {
384 		/* L2CA_Connect */
385 		case NGM_L2CAP_L2CA_CON:
386 			error = ng_l2cap_l2ca_con_req(l2cap, msg);
387 			break;
388 
389 		/* L2CA_ConnectRsp */
390 		case NGM_L2CAP_L2CA_CON_RSP:
391 			error = ng_l2cap_l2ca_con_rsp_req(l2cap, msg);
392 			break;
393 
394 		/* L2CA_Config */
395 		case NGM_L2CAP_L2CA_CFG:
396 			error = ng_l2cap_l2ca_cfg_req(l2cap, msg);
397 			break;
398 
399 		/* L2CA_ConfigRsp */
400 		case NGM_L2CAP_L2CA_CFG_RSP:
401 			error = ng_l2cap_l2ca_cfg_rsp_req(l2cap, msg);
402 			break;
403 
404 		/* L2CA_Disconnect */
405 		case NGM_L2CAP_L2CA_DISCON:
406 			error = ng_l2cap_l2ca_discon_req(l2cap, msg);
407 			break;
408 
409 		/* L2CA_GroupCreate */
410 		case NGM_L2CAP_L2CA_GRP_CREATE:
411 			error = ng_l2cap_l2ca_grp_create(l2cap, msg);
412 			break;
413 
414 		/* L2CA_GroupClose */
415 		case NGM_L2CAP_L2CA_GRP_CLOSE:
416 			error = ng_l2cap_l2ca_grp_close(l2cap, msg);
417 			break;
418 
419 		/* L2CA_GroupAddMember */
420 		case NGM_L2CAP_L2CA_GRP_ADD_MEMBER:
421 			error = ng_l2cap_l2ca_grp_add_member_req(l2cap, msg);
422 			break;
423 
424 		/* L2CA_GroupDeleteMember */
425 		case NGM_L2CAP_L2CA_GRP_REM_MEMBER:
426 			error = ng_l2cap_l2ca_grp_rem_member(l2cap, msg);
427 			break;
428 
429 		/* L2CA_GroupMembership */
430 		case NGM_L2CAP_L2CA_GRP_MEMBERSHIP:
431 			error = ng_l2cap_l2ca_grp_get_members(l2cap, msg);
432 			break;
433 
434 		/* L2CA_Ping */
435 		case NGM_L2CAP_L2CA_PING:
436 			error = ng_l2cap_l2ca_ping_req(l2cap, msg);
437 			break;
438 
439 		/* L2CA_GetInfo */
440 		case NGM_L2CAP_L2CA_GET_INFO:
441 			error = ng_l2cap_l2ca_get_info_req(l2cap, msg);
442 			break;
443 
444 		/* L2CA_EnableCLT */
445 		case NGM_L2CAP_L2CA_ENABLE_CLT:
446 			error = ng_l2cap_l2ca_enable_clt(l2cap, msg);
447 			break;
448 
449 		default:
450 			return (ng_l2cap_default_rcvmsg(node, item, lasthook));
451 			/* NOT REACHED */
452 		}
453 		break;
454 
455 	default:
456 		return (ng_l2cap_default_rcvmsg(node, item, lasthook));
457 		/* NOT REACHED */
458 	}
459 
460 	NG_FREE_ITEM(item);
461 
462 	return (error);
463 } /* ng_l2cap_upper_rcvmsg */
464 
465 /*
466  * Default control message processing routine
467  */
468 
469 static int
470 ng_l2cap_default_rcvmsg(node_p node, item_p item, hook_p lasthook)
471 {
472 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(node);
473 	struct ng_mesg	*msg = NULL, *rsp = NULL;
474 	int		 error = 0;
475 
476 	/* Detach and process message */
477 	NGI_GET_MSG(item, msg);
478 
479 	switch (msg->header.typecookie) {
480 	case NGM_GENERIC_COOKIE:
481 		switch (msg->header.cmd) {
482 		case NGM_TEXT_STATUS:
483 			NG_MKRESPONSE(rsp, msg, NG_TEXTRESPONSE, M_NOWAIT);
484 			if (rsp == NULL)
485 				error = ENOMEM;
486 			else
487 				snprintf(rsp->data, NG_TEXTRESPONSE,
488 					"bdaddr %x:%x:%x:%x:%x:%x, " \
489 					"pkt_size %d\n" \
490 					"Hooks %s %s %s\n" \
491 					"Flags %#x\n",
492 					l2cap->bdaddr.b[5], l2cap->bdaddr.b[4],
493 					l2cap->bdaddr.b[3], l2cap->bdaddr.b[2],
494 					l2cap->bdaddr.b[1], l2cap->bdaddr.b[0],
495 					l2cap->pkt_size,
496 					(l2cap->hci != NULL)?
497 						NG_L2CAP_HOOK_HCI : "",
498 					(l2cap->l2c != NULL)?
499 						NG_L2CAP_HOOK_L2C : "",
500 					(l2cap->ctl != NULL)?
501 						NG_L2CAP_HOOK_CTL : "",
502 					l2cap->flags);
503 			break;
504 
505 		default:
506 			error = EINVAL;
507 			break;
508 		}
509 		break;
510 
511 	/* Messages from the upper layer or directed to the local node */
512 	case NGM_L2CAP_COOKIE:
513 		switch (msg->header.cmd) {
514 		/* Get node flags */
515 		case NGM_L2CAP_NODE_GET_FLAGS:
516 			NG_MKRESPONSE(rsp, msg, sizeof(ng_l2cap_node_flags_ep),
517 				M_NOWAIT);
518 			if (rsp == NULL)
519 				error = ENOMEM;
520 			else
521 				*((ng_l2cap_node_flags_ep *)(rsp->data)) =
522 					l2cap->flags;
523 			break;
524 
525 		/* Get node debug */
526 		case NGM_L2CAP_NODE_GET_DEBUG:
527 			NG_MKRESPONSE(rsp, msg, sizeof(ng_l2cap_node_debug_ep),
528 				M_NOWAIT);
529 			if (rsp == NULL)
530 				error = ENOMEM;
531 			else
532 				*((ng_l2cap_node_debug_ep *)(rsp->data)) =
533 					l2cap->debug;
534 			break;
535 
536 		/* Set node debug */
537 		case NGM_L2CAP_NODE_SET_DEBUG:
538 			if (msg->header.arglen !=
539 					sizeof(ng_l2cap_node_debug_ep))
540 				error = EMSGSIZE;
541 			else
542 				l2cap->debug =
543 					*((ng_l2cap_node_debug_ep *)(msg->data));
544 			break;
545 
546 		/* Get connection list */
547 		case NGM_L2CAP_NODE_GET_CON_LIST: {
548 			ng_l2cap_con_p			 con = NULL;
549 			ng_l2cap_node_con_list_ep	*e1 = NULL;
550 			ng_l2cap_node_con_ep		*e2 = NULL;
551 			int				 n = 0;
552 
553 			/* Count number of connections */
554 			LIST_FOREACH(con, &l2cap->con_list, next)
555 				n++;
556 			if (n > NG_L2CAP_MAX_CON_NUM)
557 				n = NG_L2CAP_MAX_CON_NUM;
558 
559 			/* Prepare response */
560 			NG_MKRESPONSE(rsp, msg,
561 				sizeof(*e1) + n * sizeof(*e2), M_NOWAIT);
562 			if (rsp == NULL) {
563 				error = ENOMEM;
564 				break;
565 			}
566 
567 			e1 = (ng_l2cap_node_con_list_ep *)(rsp->data);
568 			e2 = (ng_l2cap_node_con_ep *)(e1 + 1);
569 
570 			e1->num_connections = n;
571 
572 			LIST_FOREACH(con, &l2cap->con_list, next) {
573 				e2->state = con->state;
574 
575 				e2->flags = con->flags;
576 				if (con->tx_pkt != NULL)
577 					e2->flags |= NG_L2CAP_CON_TX;
578 				if (con->rx_pkt != NULL)
579 					e2->flags |= NG_L2CAP_CON_RX;
580 
581 				e2->pending = con->pending;
582 
583 				e2->con_handle = con->con_handle;
584 				bcopy(&con->remote, &e2->remote,
585 					sizeof(e2->remote));
586 
587 				e2 ++;
588 				if (--n <= 0)
589 					break;
590 			}
591 			} break;
592 
593 		/* Get channel list */
594 		case NGM_L2CAP_NODE_GET_CHAN_LIST: {
595 			ng_l2cap_chan_p			 ch = NULL;
596 			ng_l2cap_node_chan_list_ep	*e1 = NULL;
597 			ng_l2cap_node_chan_ep		*e2 = NULL;
598 			int				 n = 0;
599 
600 			/* Count number of channels */
601 			LIST_FOREACH(ch, &l2cap->chan_list, next)
602 				n ++;
603 			if (n > NG_L2CAP_MAX_CHAN_NUM)
604 				n = NG_L2CAP_MAX_CHAN_NUM;
605 
606 			/* Prepare response */
607 			NG_MKRESPONSE(rsp, msg,
608 				sizeof(ng_l2cap_node_chan_list_ep) +
609 				n * sizeof(ng_l2cap_node_chan_ep), M_NOWAIT);
610 			if (rsp == NULL) {
611 				error = ENOMEM;
612 				break;
613 			}
614 
615 			e1 = (ng_l2cap_node_chan_list_ep *)(rsp->data);
616 			e2 = (ng_l2cap_node_chan_ep *)(e1 + 1);
617 
618 			e1->num_channels = n;
619 
620 			LIST_FOREACH(ch, &l2cap->chan_list, next) {
621 				e2->state = ch->state;
622 
623 				e2->scid = ch->scid;
624 				e2->dcid = ch->dcid;
625 
626 				e2->imtu = ch->imtu;
627 				e2->omtu = ch->omtu;
628 
629 				e2->psm = ch->psm;
630 				bcopy(&ch->con->remote, &e2->remote,
631 					sizeof(e2->remote));
632 
633 				e2 ++;
634 				if (--n <= 0)
635 					break;
636 			}
637 			} break;
638 
639 		case NGM_L2CAP_NODE_GET_AUTO_DISCON_TIMO:
640 			NG_MKRESPONSE(rsp, msg,
641 				sizeof(ng_l2cap_node_auto_discon_ep), M_NOWAIT);
642 			if (rsp == NULL)
643 				error = ENOMEM;
644 			else
645 				*((ng_l2cap_node_auto_discon_ep *)(rsp->data)) =
646 					l2cap->discon_timo;
647 			break;
648 
649 		case NGM_L2CAP_NODE_SET_AUTO_DISCON_TIMO:
650 			if (msg->header.arglen !=
651 					sizeof(ng_l2cap_node_auto_discon_ep))
652 				error = EMSGSIZE;
653 			else
654 				l2cap->discon_timo =
655 					*((ng_l2cap_node_auto_discon_ep *)
656 							(msg->data));
657 			break;
658 
659 		default:
660 			error = EINVAL;
661 			break;
662 		}
663 		break;
664 
665 	default:
666 		error = EINVAL;
667 		break;
668 	}
669 
670 	NG_RESPOND_MSG(error, node, item, rsp);
671 	NG_FREE_MSG(msg);
672 
673 	return (error);
674 } /* ng_l2cap_rcvmsg */
675 
676 /*
677  * Process data packet from one of our hooks.
678  *
679  * From the HCI hook we expect to receive ACL data packets. ACL data packets
680  * gets re-assembled into one L2CAP packet (according to length) and then gets
681  * processed.
682  *
683  * NOTE: We expect to receive L2CAP packet header in the first fragment.
684  *       Otherwise we WILL NOT be able to get length of the L2CAP packet.
685  *
686  * Signaling L2CAP packets (destination channel ID == 0x1) are processed within
687  * the node. Connectionless data packets (destination channel ID == 0x2) will
688  * be forwarded to appropriate upstream hook unless it is not connected or
689  * connectionless traffic for the specified PSM was disabled.
690  *
691  * From the upstream hooks we expect to receive data packets. These data
692  * packets will be converted into L2CAP data packets. The length of each
693  * L2CAP packet must not exceed channel's omtu (our peer's imtu). Then
694  * these L2CAP packets will be converted to ACL data packets (according to
695  * HCI layer MTU) and sent to lower layer.
696  *
697  * No data is expected from the control hook.
698  */
699 
700 static int
701 ng_l2cap_rcvdata(hook_p hook, item_p item)
702 {
703 	ng_l2cap_p	 l2cap = (ng_l2cap_p) NG_NODE_PRIVATE(NG_HOOK_NODE(hook));
704 	struct mbuf	*m = NULL;
705 	int		 error = 0;
706 
707 	/* Detach mbuf, discard item and process data */
708 	NGI_GET_M(item, m);
709 	NG_FREE_ITEM(item);
710 
711 	if (hook == l2cap->hci)
712 		error = ng_l2cap_lp_receive(l2cap, m);
713 	else if (hook == l2cap->l2c)
714 		error = ng_l2cap_l2ca_write_req(l2cap, m);
715 	else {
716 		NG_FREE_M(m);
717 		error = EINVAL;
718 	}
719 
720 	return (error);
721 } /* ng_l2cap_rcvdata */
722 
723 /*
724  * Clean all connections, channels and commands for the L2CAP node
725  */
726 
727 static void
728 ng_l2cap_cleanup(ng_l2cap_p l2cap)
729 {
730 	ng_l2cap_con_p	con = NULL;
731 
732 	/* Clean up connection and channels */
733 	while (!LIST_EMPTY(&l2cap->con_list)) {
734 		con = LIST_FIRST(&l2cap->con_list);
735 
736 		if (con->flags & NG_L2CAP_CON_LP_TIMO)
737 			ng_l2cap_lp_untimeout(con);
738 		else if (con->flags & NG_L2CAP_CON_AUTO_DISCON_TIMO)
739 			ng_l2cap_discon_untimeout(con);
740 
741 		/* Connection terminated by local host */
742 		ng_l2cap_con_fail(con, 0x16);
743 	}
744 } /* ng_l2cap_cleanup */
745 
746 /*
747  * Destroy all channels that use specified upstream hook
748  */
749 
750 static void
751 ng_l2cap_destroy_channels(ng_l2cap_p l2cap)
752 {
753 	while (!LIST_EMPTY(&l2cap->chan_list))
754 		ng_l2cap_free_chan(LIST_FIRST(&l2cap->chan_list));
755 } /* ng_l2cap_destroy_channels_by_hook */
756 
757