1/*
2 * ng_btsocket_l2cap.c
3 */
4
5/*-
6 * Copyright (c) 2001-2002 Maksim Yevmenkin <m_evmenkin@yahoo.com>
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * $Id: ng_btsocket_l2cap.c,v 1.16 2003/09/14 23:29:06 max Exp $
31 * $FreeBSD$
32 */
33
34#include <sys/param.h>
35#include <sys/systm.h>
36#include <sys/bitstring.h>
37#include <sys/domain.h>
38#include <sys/endian.h>
39#include <sys/errno.h>
40#include <sys/filedesc.h>
41#include <sys/ioccom.h>
42#include <sys/kernel.h>
43#include <sys/lock.h>
44#include <sys/malloc.h>
45#include <sys/mbuf.h>
46#include <sys/mutex.h>
47#include <sys/protosw.h>
48#include <sys/queue.h>
49#include <sys/socket.h>
50#include <sys/socketvar.h>
51#include <sys/sysctl.h>
52#include <sys/taskqueue.h>
53
54#include <net/vnet.h>
55
56#include <netgraph/ng_message.h>
57#include <netgraph/netgraph.h>
58#include <netgraph/bluetooth/include/ng_bluetooth.h>
59#include <netgraph/bluetooth/include/ng_hci.h>
60#include <netgraph/bluetooth/include/ng_l2cap.h>
61#include <netgraph/bluetooth/include/ng_btsocket.h>
62#include <netgraph/bluetooth/include/ng_btsocket_l2cap.h>
63
64/* MALLOC define */
65#ifdef NG_SEPARATE_MALLOC
66static MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_L2CAP, "netgraph_btsocks_l2cap",
67		"Netgraph Bluetooth L2CAP sockets");
68#else
69#define M_NETGRAPH_BTSOCKET_L2CAP M_NETGRAPH
70#endif /* NG_SEPARATE_MALLOC */
71
72/* Netgraph node methods */
73static ng_constructor_t	ng_btsocket_l2cap_node_constructor;
74static ng_rcvmsg_t	ng_btsocket_l2cap_node_rcvmsg;
75static ng_shutdown_t	ng_btsocket_l2cap_node_shutdown;
76static ng_newhook_t	ng_btsocket_l2cap_node_newhook;
77static ng_connect_t	ng_btsocket_l2cap_node_connect;
78static ng_rcvdata_t	ng_btsocket_l2cap_node_rcvdata;
79static ng_disconnect_t	ng_btsocket_l2cap_node_disconnect;
80
81static void		ng_btsocket_l2cap_input   (void *, int);
82static void		ng_btsocket_l2cap_rtclean (void *, int);
83
84/* Netgraph type descriptor */
85static struct ng_type	typestruct = {
86	.version =	NG_ABI_VERSION,
87	.name =		NG_BTSOCKET_L2CAP_NODE_TYPE,
88	.constructor =	ng_btsocket_l2cap_node_constructor,
89	.rcvmsg =	ng_btsocket_l2cap_node_rcvmsg,
90	.shutdown =	ng_btsocket_l2cap_node_shutdown,
91	.newhook =	ng_btsocket_l2cap_node_newhook,
92	.connect =	ng_btsocket_l2cap_node_connect,
93	.rcvdata =	ng_btsocket_l2cap_node_rcvdata,
94	.disconnect =	ng_btsocket_l2cap_node_disconnect,
95};
96
97/* Globals */
98extern int					ifqmaxlen;
99static u_int32_t				ng_btsocket_l2cap_debug_level;
100static node_p					ng_btsocket_l2cap_node;
101static struct ng_bt_itemq			ng_btsocket_l2cap_queue;
102static struct mtx				ng_btsocket_l2cap_queue_mtx;
103static struct task				ng_btsocket_l2cap_queue_task;
104static LIST_HEAD(, ng_btsocket_l2cap_pcb)	ng_btsocket_l2cap_sockets;
105static struct mtx				ng_btsocket_l2cap_sockets_mtx;
106static LIST_HEAD(, ng_btsocket_l2cap_rtentry)	ng_btsocket_l2cap_rt;
107static struct mtx				ng_btsocket_l2cap_rt_mtx;
108static struct task				ng_btsocket_l2cap_rt_task;
109static struct timeval				ng_btsocket_l2cap_lasttime;
110static int					ng_btsocket_l2cap_curpps;
111
112/* Sysctl tree */
113SYSCTL_DECL(_net_bluetooth_l2cap_sockets);
114static SYSCTL_NODE(_net_bluetooth_l2cap_sockets, OID_AUTO, seq, CTLFLAG_RW,
115	0, "Bluetooth SEQPACKET L2CAP sockets family");
116SYSCTL_UINT(_net_bluetooth_l2cap_sockets_seq, OID_AUTO, debug_level,
117	CTLFLAG_RW,
118	&ng_btsocket_l2cap_debug_level, NG_BTSOCKET_WARN_LEVEL,
119	"Bluetooth SEQPACKET L2CAP sockets debug level");
120SYSCTL_UINT(_net_bluetooth_l2cap_sockets_seq, OID_AUTO, queue_len,
121	CTLFLAG_RD,
122	&ng_btsocket_l2cap_queue.len, 0,
123	"Bluetooth SEQPACKET L2CAP sockets input queue length");
124SYSCTL_UINT(_net_bluetooth_l2cap_sockets_seq, OID_AUTO, queue_maxlen,
125	CTLFLAG_RD,
126	&ng_btsocket_l2cap_queue.maxlen, 0,
127	"Bluetooth SEQPACKET L2CAP sockets input queue max. length");
128SYSCTL_UINT(_net_bluetooth_l2cap_sockets_seq, OID_AUTO, queue_drops,
129	CTLFLAG_RD,
130	&ng_btsocket_l2cap_queue.drops, 0,
131	"Bluetooth SEQPACKET L2CAP sockets input queue drops");
132
133/* Debug */
134#define NG_BTSOCKET_L2CAP_INFO \
135	if (ng_btsocket_l2cap_debug_level >= NG_BTSOCKET_INFO_LEVEL && \
136	    ppsratecheck(&ng_btsocket_l2cap_lasttime, &ng_btsocket_l2cap_curpps, 1)) \
137		printf
138
139#define NG_BTSOCKET_L2CAP_WARN \
140	if (ng_btsocket_l2cap_debug_level >= NG_BTSOCKET_WARN_LEVEL && \
141	    ppsratecheck(&ng_btsocket_l2cap_lasttime, &ng_btsocket_l2cap_curpps, 1)) \
142		printf
143
144#define NG_BTSOCKET_L2CAP_ERR \
145	if (ng_btsocket_l2cap_debug_level >= NG_BTSOCKET_ERR_LEVEL && \
146	    ppsratecheck(&ng_btsocket_l2cap_lasttime, &ng_btsocket_l2cap_curpps, 1)) \
147		printf
148
149#define NG_BTSOCKET_L2CAP_ALERT \
150	if (ng_btsocket_l2cap_debug_level >= NG_BTSOCKET_ALERT_LEVEL && \
151	    ppsratecheck(&ng_btsocket_l2cap_lasttime, &ng_btsocket_l2cap_curpps, 1)) \
152		printf
153
154/*
155 * Netgraph message processing routines
156 */
157
158static int ng_btsocket_l2cap_process_l2ca_con_req_rsp
159	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
160static int ng_btsocket_l2cap_process_l2ca_con_rsp_rsp
161	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
162static int ng_btsocket_l2cap_process_l2ca_con_ind
163	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
164
165static int ng_btsocket_l2cap_process_l2ca_cfg_req_rsp
166	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
167static int ng_btsocket_l2cap_process_l2ca_cfg_rsp_rsp
168	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
169static int ng_btsocket_l2cap_process_l2ca_cfg_ind
170	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
171
172static int ng_btsocket_l2cap_process_l2ca_discon_rsp
173	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
174static int ng_btsocket_l2cap_process_l2ca_discon_ind
175	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
176
177static int ng_btsocket_l2cap_process_l2ca_write_rsp
178	(struct ng_mesg *, ng_btsocket_l2cap_rtentry_p);
179
180/*
181 * Send L2CA_xxx messages to the lower layer
182 */
183
184static int  ng_btsocket_l2cap_send_l2ca_con_req
185	(ng_btsocket_l2cap_pcb_p);
186static int  ng_btsocket_l2cap_send_l2ca_con_rsp_req
187	(u_int32_t, ng_btsocket_l2cap_rtentry_p, bdaddr_p, int, int, int, int);
188static int  ng_btsocket_l2cap_send_l2ca_cfg_req
189	(ng_btsocket_l2cap_pcb_p);
190static int  ng_btsocket_l2cap_send_l2ca_cfg_rsp
191	(ng_btsocket_l2cap_pcb_p);
192static int  ng_btsocket_l2cap_send_l2ca_discon_req
193	(u_int32_t, ng_btsocket_l2cap_pcb_p);
194
195static int ng_btsocket_l2cap_send2
196	(ng_btsocket_l2cap_pcb_p);
197
198/*
199 * Timeout processing routines
200 */
201
202static void ng_btsocket_l2cap_timeout         (ng_btsocket_l2cap_pcb_p);
203static void ng_btsocket_l2cap_untimeout       (ng_btsocket_l2cap_pcb_p);
204static void ng_btsocket_l2cap_process_timeout (void *);
205
206/*
207 * Other stuff
208 */
209
210static ng_btsocket_l2cap_pcb_p     ng_btsocket_l2cap_pcb_by_addr(bdaddr_p, int);
211static ng_btsocket_l2cap_pcb_p     ng_btsocket_l2cap_pcb_by_token(u_int32_t);
212static ng_btsocket_l2cap_pcb_p     ng_btsocket_l2cap_pcb_by_cid (bdaddr_p, int,int);
213static int                         ng_btsocket_l2cap_result2errno(int);
214
215static int ng_btsock_l2cap_addrtype_to_linktype(int addrtype);
216
217#define ng_btsocket_l2cap_wakeup_input_task() \
218	taskqueue_enqueue(taskqueue_swi_giant, &ng_btsocket_l2cap_queue_task)
219
220#define ng_btsocket_l2cap_wakeup_route_task() \
221	taskqueue_enqueue(taskqueue_swi_giant, &ng_btsocket_l2cap_rt_task)
222
223
224
225int ng_btsock_l2cap_addrtype_to_linktype(int addrtype)
226{
227	switch(addrtype){
228	case BDADDR_LE_PUBLIC:
229		return NG_HCI_LINK_LE_PUBLIC;
230	case BDADDR_LE_RANDOM:
231		return NG_HCI_LINK_LE_RANDOM;
232	default:
233		return NG_HCI_LINK_ACL;
234	}
235}
236
237
238/*****************************************************************************
239 *****************************************************************************
240 **                        Netgraph node interface
241 *****************************************************************************
242 *****************************************************************************/
243
244/*
245 * Netgraph node constructor. Do not allow to create node of this type.
246 */
247
248static int
249ng_btsocket_l2cap_node_constructor(node_p node)
250{
251	return (EINVAL);
252} /* ng_btsocket_l2cap_node_constructor */
253
254/*
255 * Do local shutdown processing. Let old node go and create new fresh one.
256 */
257
258static int
259ng_btsocket_l2cap_node_shutdown(node_p node)
260{
261	int	error = 0;
262
263	NG_NODE_UNREF(node);
264
265	/* Create new node */
266	error = ng_make_node_common(&typestruct, &ng_btsocket_l2cap_node);
267	if (error != 0) {
268		NG_BTSOCKET_L2CAP_ALERT(
269"%s: Could not create Netgraph node, error=%d\n", __func__, error);
270
271		ng_btsocket_l2cap_node = NULL;
272
273		return (error);
274	}
275
276	error = ng_name_node(ng_btsocket_l2cap_node,
277				NG_BTSOCKET_L2CAP_NODE_TYPE);
278	if (error != 0) {
279		NG_BTSOCKET_L2CAP_ALERT(
280"%s: Could not name Netgraph node, error=%d\n", __func__, error);
281
282		NG_NODE_UNREF(ng_btsocket_l2cap_node);
283		ng_btsocket_l2cap_node = NULL;
284
285		return (error);
286	}
287
288	return (0);
289} /* ng_btsocket_l2cap_node_shutdown */
290
291/*
292 * We allow any hook to be connected to the node.
293 */
294
295static int
296ng_btsocket_l2cap_node_newhook(node_p node, hook_p hook, char const *name)
297{
298	return (0);
299} /* ng_btsocket_l2cap_node_newhook */
300
301/*
302 * Just say "YEP, that's OK by me!"
303 */
304
305static int
306ng_btsocket_l2cap_node_connect(hook_p hook)
307{
308	NG_HOOK_SET_PRIVATE(hook, NULL);
309	NG_HOOK_REF(hook); /* Keep extra reference to the hook */
310
311#if 0
312	NG_HOOK_FORCE_QUEUE(NG_HOOK_PEER(hook));
313	NG_HOOK_FORCE_QUEUE(hook);
314#endif
315
316	return (0);
317} /* ng_btsocket_l2cap_node_connect */
318
319/*
320 * Hook disconnection. Schedule route cleanup task
321 */
322
323static int
324ng_btsocket_l2cap_node_disconnect(hook_p hook)
325{
326	/*
327	 * If hook has private information than we must have this hook in
328	 * the routing table and must schedule cleaning for the routing table.
329	 * Otherwise hook was connected but we never got "hook_info" message,
330	 * so we have never added this hook to the routing table and it save
331	 * to just delete it.
332	 */
333
334	if (NG_HOOK_PRIVATE(hook) != NULL)
335		return (ng_btsocket_l2cap_wakeup_route_task());
336
337	NG_HOOK_UNREF(hook); /* Remove extra reference */
338
339	return (0);
340} /* ng_btsocket_l2cap_node_disconnect */
341
342/*
343 * Process incoming messages
344 */
345
346static int
347ng_btsocket_l2cap_node_rcvmsg(node_p node, item_p item, hook_p hook)
348{
349	struct ng_mesg	*msg = NGI_MSG(item); /* item still has message */
350	int		 error = 0;
351
352	if (msg != NULL && msg->header.typecookie == NGM_L2CAP_COOKIE) {
353		mtx_lock(&ng_btsocket_l2cap_queue_mtx);
354		if (NG_BT_ITEMQ_FULL(&ng_btsocket_l2cap_queue)) {
355			NG_BTSOCKET_L2CAP_ERR(
356"%s: Input queue is full (msg)\n", __func__);
357
358			NG_BT_ITEMQ_DROP(&ng_btsocket_l2cap_queue);
359			NG_FREE_ITEM(item);
360			error = ENOBUFS;
361		} else {
362			if (hook != NULL) {
363				NG_HOOK_REF(hook);
364				NGI_SET_HOOK(item, hook);
365			}
366
367			NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_l2cap_queue, item);
368			error = ng_btsocket_l2cap_wakeup_input_task();
369		}
370		mtx_unlock(&ng_btsocket_l2cap_queue_mtx);
371	} else {
372		NG_FREE_ITEM(item);
373		error = EINVAL;
374	}
375
376	return (error);
377} /* ng_btsocket_l2cap_node_rcvmsg */
378
379/*
380 * Receive data on a hook
381 */
382
383static int
384ng_btsocket_l2cap_node_rcvdata(hook_p hook, item_p item)
385{
386	int	error = 0;
387
388	mtx_lock(&ng_btsocket_l2cap_queue_mtx);
389	if (NG_BT_ITEMQ_FULL(&ng_btsocket_l2cap_queue)) {
390		NG_BTSOCKET_L2CAP_ERR(
391"%s: Input queue is full (data)\n", __func__);
392
393		NG_BT_ITEMQ_DROP(&ng_btsocket_l2cap_queue);
394		NG_FREE_ITEM(item);
395		error = ENOBUFS;
396	} else {
397		NG_HOOK_REF(hook);
398		NGI_SET_HOOK(item, hook);
399
400		NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_l2cap_queue, item);
401		error = ng_btsocket_l2cap_wakeup_input_task();
402	}
403	mtx_unlock(&ng_btsocket_l2cap_queue_mtx);
404
405	return (error);
406} /* ng_btsocket_l2cap_node_rcvdata */
407
408/*
409 * Process L2CA_Connect respose. Socket layer must have initiated connection,
410 * so we have to have a socket associated with message token.
411 */
412
413static int
414ng_btsocket_l2cap_process_l2ca_con_req_rsp(struct ng_mesg *msg,
415		ng_btsocket_l2cap_rtentry_p rt)
416{
417	ng_l2cap_l2ca_con_op	*op = NULL;
418	ng_btsocket_l2cap_pcb_t	*pcb = NULL;
419	int			 error = 0;
420
421	if (msg->header.arglen != sizeof(*op))
422		return (EMSGSIZE);
423
424	op = (ng_l2cap_l2ca_con_op *)(msg->data);
425
426	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
427
428	/* Look for the socket with the token */
429	pcb = ng_btsocket_l2cap_pcb_by_token(msg->header.token);
430	if (pcb == NULL) {
431		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
432		return (ENOENT);
433	}
434
435	mtx_lock(&pcb->pcb_mtx);
436
437	NG_BTSOCKET_L2CAP_INFO(
438"%s: Got L2CA_Connect response, token=%d, src bdaddr=%x:%x:%x:%x:%x:%x, " \
439"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, result=%d, status=%d, " \
440"state=%d\n",	__func__, msg->header.token,
441		pcb->src.b[5], pcb->src.b[4], pcb->src.b[3],
442		pcb->src.b[2], pcb->src.b[1], pcb->src.b[0],
443		pcb->dst.b[5], pcb->dst.b[4], pcb->dst.b[3],
444		pcb->dst.b[2], pcb->dst.b[1], pcb->dst.b[0],
445		pcb->psm, op->lcid, op->result, op->status,
446		pcb->state);
447
448	if (pcb->state != NG_BTSOCKET_L2CAP_CONNECTING) {
449		mtx_unlock(&pcb->pcb_mtx);
450		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
451
452		return (ENOENT);
453	}
454
455	ng_btsocket_l2cap_untimeout(pcb);
456
457	if (op->result == NG_L2CAP_PENDING) {
458		ng_btsocket_l2cap_timeout(pcb);
459		mtx_unlock(&pcb->pcb_mtx);
460		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
461
462		return (0);
463	}
464
465	if (op->result == NG_L2CAP_SUCCESS){
466		if((pcb->idtype == NG_L2CAP_L2CA_IDTYPE_ATT)||
467		   (pcb->idtype == NG_L2CAP_L2CA_IDTYPE_SMP)){
468			pcb->encryption = op->encryption;					pcb->cid = op->lcid;
469			if(pcb->need_encrypt && !(pcb->encryption)){
470				ng_btsocket_l2cap_timeout(pcb);
471				pcb->state = NG_BTSOCKET_L2CAP_W4_ENC_CHANGE;
472			}else{
473				pcb->state = NG_BTSOCKET_L2CAP_OPEN;
474				soisconnected(pcb->so);
475			}
476		}else{
477			/*
478			 * Channel is now open, so update local channel ID and
479			 * start configuration process. Source and destination
480			 * addresses as well as route must be already set.
481			 */
482
483			pcb->cid = op->lcid;
484			pcb->encryption = op->encryption;
485			error = ng_btsocket_l2cap_send_l2ca_cfg_req(pcb);
486			if (error != 0) {
487				/* Send disconnect request with "zero" token */
488				ng_btsocket_l2cap_send_l2ca_discon_req(0, pcb);
489
490				/* ... and close the socket */
491				pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
492				soisdisconnected(pcb->so);
493			} else {
494				pcb->cfg_state = NG_BTSOCKET_L2CAP_CFG_IN_SENT;
495				pcb->state = NG_BTSOCKET_L2CAP_CONFIGURING;
496
497				ng_btsocket_l2cap_timeout(pcb);
498			}
499		}
500	} else {
501		/*
502		 * We have failed to open connection, so convert result
503		 * code to "errno" code and disconnect the socket. Channel
504		 * already has been closed.
505		 */
506
507		pcb->so->so_error = ng_btsocket_l2cap_result2errno(op->result);
508		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
509		soisdisconnected(pcb->so);
510	}
511	mtx_unlock(&pcb->pcb_mtx);
512	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
513
514	return (error);
515} /* ng_btsocket_l2cap_process_l2ca_con_req_rsp */
516
517/*
518 * Process L2CA_ConnectRsp response
519 */
520
521static int
522ng_btsocket_l2cap_process_l2ca_con_rsp_rsp(struct ng_mesg *msg,
523		ng_btsocket_l2cap_rtentry_p rt)
524{
525	ng_l2cap_l2ca_con_rsp_op	*op = NULL;
526	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
527
528	if (msg->header.arglen != sizeof(*op))
529		return (EMSGSIZE);
530
531	op = (ng_l2cap_l2ca_con_rsp_op *)(msg->data);
532
533	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
534
535	/* Look for the socket with the token */
536	pcb = ng_btsocket_l2cap_pcb_by_token(msg->header.token);
537	if (pcb == NULL) {
538		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
539		return (ENOENT);
540	}
541
542	mtx_lock(&pcb->pcb_mtx);
543
544	NG_BTSOCKET_L2CAP_INFO(
545"%s: Got L2CA_ConnectRsp response, token=%d, src bdaddr=%x:%x:%x:%x:%x:%x, " \
546"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, result=%d, state=%d\n",
547		__func__, msg->header.token,
548		pcb->src.b[5], pcb->src.b[4], pcb->src.b[3],
549		pcb->src.b[2], pcb->src.b[1], pcb->src.b[0],
550		pcb->dst.b[5], pcb->dst.b[4], pcb->dst.b[3],
551		pcb->dst.b[2], pcb->dst.b[1], pcb->dst.b[0],
552		pcb->psm, pcb->cid, op->result, pcb->state);
553
554	if (pcb->state != NG_BTSOCKET_L2CAP_CONNECTING) {
555		mtx_unlock(&pcb->pcb_mtx);
556		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
557
558		return (ENOENT);
559	}
560
561	ng_btsocket_l2cap_untimeout(pcb);
562
563	/* Check the result and disconnect the socket on failure */
564	if (op->result != NG_L2CAP_SUCCESS) {
565		/* Close the socket - channel already closed */
566		pcb->so->so_error = ng_btsocket_l2cap_result2errno(op->result);
567		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
568		soisdisconnected(pcb->so);
569	} else {
570		/* Move to CONFIGURING state and wait for CONFIG_IND */
571		pcb->cfg_state = 0;
572		pcb->state = NG_BTSOCKET_L2CAP_CONFIGURING;
573		ng_btsocket_l2cap_timeout(pcb);
574	}
575
576	mtx_unlock(&pcb->pcb_mtx);
577	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
578
579	return (0);
580} /* ng_btsocket_process_l2ca_con_rsp_rsp */
581
582/*
583 * Process L2CA_Connect indicator. Find socket that listens on address
584 * and PSM. Find exact or closest match. Create new socket and initiate
585 * connection.
586 */
587
588static int
589ng_btsocket_l2cap_process_l2ca_con_ind(struct ng_mesg *msg,
590		ng_btsocket_l2cap_rtentry_p rt)
591{
592	ng_l2cap_l2ca_con_ind_ip	*ip = NULL;
593	ng_btsocket_l2cap_pcb_t		*pcb = NULL, *pcb1 = NULL;
594	int				 error = 0;
595	u_int32_t			 token = 0;
596	u_int16_t			 result = 0;
597
598	if (msg->header.arglen != sizeof(*ip))
599		return (EMSGSIZE);
600
601	ip = (ng_l2cap_l2ca_con_ind_ip *)(msg->data);
602
603	NG_BTSOCKET_L2CAP_INFO(
604"%s: Got L2CA_Connect indicator, src bdaddr=%x:%x:%x:%x:%x:%x, " \
605"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, ident=%d\n",
606		__func__,
607		rt->src.b[5], rt->src.b[4], rt->src.b[3],
608		rt->src.b[2], rt->src.b[1], rt->src.b[0],
609		ip->bdaddr.b[5], ip->bdaddr.b[4], ip->bdaddr.b[3],
610		ip->bdaddr.b[2], ip->bdaddr.b[1], ip->bdaddr.b[0],
611		ip->psm, ip->lcid, ip->ident);
612
613	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
614
615	pcb = ng_btsocket_l2cap_pcb_by_addr(&rt->src, ip->psm);
616	if (pcb != NULL) {
617		struct socket	*so1 = NULL;
618
619		mtx_lock(&pcb->pcb_mtx);
620
621		/*
622		 * First check the pending connections queue and if we have
623		 * space then create new socket and set proper source address.
624		 */
625
626		if (pcb->so->so_qlen <= pcb->so->so_qlimit) {
627			CURVNET_SET(pcb->so->so_vnet);
628			so1 = sonewconn(pcb->so, 0);
629			CURVNET_RESTORE();
630		}
631
632		if (so1 == NULL) {
633			result = NG_L2CAP_NO_RESOURCES;
634			goto respond;
635		}
636
637		/*
638		 * If we got here than we have created new socket. So complete
639		 * connection. If we we listening on specific address then copy
640		 * source address from listening socket, otherwise copy source
641		 * address from hook's routing information.
642		 */
643
644		pcb1 = so2l2cap_pcb(so1);
645		KASSERT((pcb1 != NULL),
646("%s: pcb1 == NULL\n", __func__));
647
648 		mtx_lock(&pcb1->pcb_mtx);
649
650		if (bcmp(&pcb->src, NG_HCI_BDADDR_ANY, sizeof(pcb->src)) != 0)
651			bcopy(&pcb->src, &pcb1->src, sizeof(pcb1->src));
652		else
653			bcopy(&rt->src, &pcb1->src, sizeof(pcb1->src));
654
655		pcb1->flags &= ~NG_BTSOCKET_L2CAP_CLIENT;
656
657		bcopy(&ip->bdaddr, &pcb1->dst, sizeof(pcb1->dst));
658		pcb1->psm = ip->psm;
659		pcb1->cid = ip->lcid;
660		pcb1->rt = rt;
661
662		/* Copy socket settings */
663		pcb1->imtu = pcb->imtu;
664		bcopy(&pcb->oflow, &pcb1->oflow, sizeof(pcb1->oflow));
665		pcb1->flush_timo = pcb->flush_timo;
666
667		token = pcb1->token;
668	} else
669		/* Nobody listens on requested BDADDR/PSM */
670		result = NG_L2CAP_PSM_NOT_SUPPORTED;
671
672respond:
673	error = ng_btsocket_l2cap_send_l2ca_con_rsp_req(token, rt,
674							&ip->bdaddr,
675							ip->ident, ip->lcid,
676							result,ip->linktype);
677	if (pcb1 != NULL) {
678		if (error != 0) {
679			pcb1->so->so_error = error;
680			pcb1->state = NG_BTSOCKET_L2CAP_CLOSED;
681			soisdisconnected(pcb1->so);
682		} else {
683			pcb1->state = NG_BTSOCKET_L2CAP_CONNECTING;
684			soisconnecting(pcb1->so);
685
686			ng_btsocket_l2cap_timeout(pcb1);
687		}
688
689		mtx_unlock(&pcb1->pcb_mtx);
690	}
691
692	if (pcb != NULL)
693		mtx_unlock(&pcb->pcb_mtx);
694
695	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
696
697	return (error);
698} /* ng_btsocket_l2cap_process_l2ca_con_ind */
699/*Encryption Change*/
700static int ng_btsocket_l2cap_process_l2ca_enc_change(struct ng_mesg *msg, ng_btsocket_l2cap_rtentry_p rt)
701{
702	ng_l2cap_l2ca_enc_chg_op	*op = NULL;
703	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
704
705
706	if (msg->header.arglen != sizeof(*op))
707		return (EMSGSIZE);
708
709	op = (ng_l2cap_l2ca_enc_chg_op *)(msg->data);
710
711	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
712
713	pcb = ng_btsocket_l2cap_pcb_by_cid(&rt->src, op->lcid,
714					   op->idtype);
715	if (pcb == NULL) {
716		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
717		return (ENOENT);
718	}
719
720	mtx_lock(&pcb->pcb_mtx);
721	pcb->encryption = op->result;
722
723	if(pcb->need_encrypt){
724		ng_btsocket_l2cap_untimeout(pcb);
725		if(pcb->state != NG_BTSOCKET_L2CAP_W4_ENC_CHANGE){
726			NG_BTSOCKET_L2CAP_WARN("%s: Invalid pcb status %d",
727					       __func__, pcb->state);
728		}else if(pcb->encryption){
729			pcb->state = NG_BTSOCKET_L2CAP_OPEN;
730			soisconnected(pcb->so);
731		}else{
732			pcb->so->so_error = EPERM;
733			ng_btsocket_l2cap_send_l2ca_discon_req(0, pcb);
734			pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
735			soisdisconnected(pcb->so);
736		}
737	}
738	mtx_unlock(&pcb->pcb_mtx);
739	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
740
741	return 0;
742}
743/*
744 * Process L2CA_Config response
745 */
746
747static int
748ng_btsocket_l2cap_process_l2ca_cfg_req_rsp(struct ng_mesg *msg,
749		ng_btsocket_l2cap_rtentry_p rt)
750{
751	ng_l2cap_l2ca_cfg_op	*op = NULL;
752	ng_btsocket_l2cap_pcb_p	 pcb = NULL;
753
754	if (msg->header.arglen != sizeof(*op))
755		return (EMSGSIZE);
756
757	op = (ng_l2cap_l2ca_cfg_op *)(msg->data);
758
759	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
760
761	/*
762	 * Socket must have issued a Configure request, so we must have a
763	 * socket that wants to be configured. Use Netgraph message token
764	 * to find it
765	 */
766
767	pcb = ng_btsocket_l2cap_pcb_by_token(msg->header.token);
768	if (pcb == NULL) {
769		/*
770		 * XXX FIXME what to do here? We could not find a
771		 * socket with requested token. We even can not send
772		 * Disconnect, because we do not know channel ID
773		 */
774
775		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
776		return (ENOENT);
777	}
778
779	mtx_lock(&pcb->pcb_mtx);
780
781        NG_BTSOCKET_L2CAP_INFO(
782"%s: Got L2CA_Config response, token=%d, src bdaddr=%x:%x:%x:%x:%x:%x, " \
783"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, result=%d, state=%d, " \
784"cfg_state=%x\n",
785		__func__, msg->header.token,
786		pcb->src.b[5], pcb->src.b[4], pcb->src.b[3],
787		pcb->src.b[2], pcb->src.b[1], pcb->src.b[0],
788		pcb->dst.b[5], pcb->dst.b[4], pcb->dst.b[3],
789		pcb->dst.b[2], pcb->dst.b[1], pcb->dst.b[0],
790		pcb->psm, pcb->cid, op->result, pcb->state, pcb->cfg_state);
791
792	if (pcb->state != NG_BTSOCKET_L2CAP_CONFIGURING) {
793		mtx_unlock(&pcb->pcb_mtx);
794		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
795
796		return (ENOENT);
797	}
798
799	if (op->result == NG_L2CAP_SUCCESS) {
800		/*
801		 * XXX FIXME Actually set flush and link timeout.
802		 * Set QoS here if required. Resolve conficts (flush_timo).
803		 * Save incoming MTU (peer's outgoing MTU) and outgoing flow
804		 * spec.
805		 */
806
807		pcb->imtu = op->imtu;
808		bcopy(&op->oflow, &pcb->oflow, sizeof(pcb->oflow));
809		pcb->flush_timo = op->flush_timo;
810
811		/*
812		 * We have configured incoming side, so record it and check
813		 * if configuration is complete. If complete then mark socket
814		 * as connected, otherwise wait for the peer.
815		 */
816
817		pcb->cfg_state &= ~NG_BTSOCKET_L2CAP_CFG_IN_SENT;
818		pcb->cfg_state |= NG_BTSOCKET_L2CAP_CFG_IN;
819
820		if (pcb->cfg_state == NG_BTSOCKET_L2CAP_CFG_BOTH) {
821			/* Configuration complete - mark socket as open */
822			ng_btsocket_l2cap_untimeout(pcb);
823			pcb->state = NG_BTSOCKET_L2CAP_OPEN;
824			soisconnected(pcb->so);
825		}
826	} else {
827		/*
828		 * Something went wrong. Could be unacceptable parameters,
829		 * reject or unknown option. That's too bad, but we will
830		 * not negotiate. Send Disconnect and close the channel.
831		 */
832
833		ng_btsocket_l2cap_untimeout(pcb);
834
835		switch (op->result) {
836		case NG_L2CAP_UNACCEPTABLE_PARAMS:
837		case NG_L2CAP_UNKNOWN_OPTION:
838			pcb->so->so_error = EINVAL;
839			break;
840
841		default:
842			pcb->so->so_error = ECONNRESET;
843			break;
844		}
845
846		/* Send disconnect with "zero" token */
847		ng_btsocket_l2cap_send_l2ca_discon_req(0, pcb);
848
849		/* ... and close the socket */
850		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
851		soisdisconnected(pcb->so);
852	}
853
854	mtx_unlock(&pcb->pcb_mtx);
855	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
856
857	return (0);
858} /* ng_btsocket_l2cap_process_l2ca_cfg_req_rsp */
859
860/*
861 * Process L2CA_ConfigRsp response
862 */
863
864static int
865ng_btsocket_l2cap_process_l2ca_cfg_rsp_rsp(struct ng_mesg *msg,
866		ng_btsocket_l2cap_rtentry_p rt)
867{
868	ng_l2cap_l2ca_cfg_rsp_op	*op = NULL;
869	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
870	int				 error = 0;
871
872	if (msg->header.arglen != sizeof(*op))
873		return (EMSGSIZE);
874
875	op = (ng_l2cap_l2ca_cfg_rsp_op *)(msg->data);
876
877	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
878
879	/* Look for the socket with the token */
880	pcb = ng_btsocket_l2cap_pcb_by_token(msg->header.token);
881	if (pcb == NULL) {
882		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
883		return (ENOENT);
884	}
885
886	mtx_lock(&pcb->pcb_mtx);
887
888        NG_BTSOCKET_L2CAP_INFO(
889"%s: Got L2CA_ConfigRsp response, token=%d, src bdaddr=%x:%x:%x:%x:%x:%x, " \
890"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, result=%d, state=%d, " \
891"cfg_state=%x\n",
892		__func__, msg->header.token,
893		pcb->src.b[5], pcb->src.b[4], pcb->src.b[3],
894		pcb->src.b[2], pcb->src.b[1], pcb->src.b[0],
895		pcb->dst.b[5], pcb->dst.b[4], pcb->dst.b[3],
896		pcb->dst.b[2], pcb->dst.b[1], pcb->dst.b[0],
897		pcb->psm, pcb->cid, op->result, pcb->state, pcb->cfg_state);
898
899	if (pcb->state != NG_BTSOCKET_L2CAP_CONFIGURING) {
900		mtx_unlock(&pcb->pcb_mtx);
901		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
902
903		return (ENOENT);
904	}
905
906	/* Check the result and disconnect socket of failure */
907	if (op->result != NG_L2CAP_SUCCESS)
908		goto disconnect;
909
910	/*
911	 * Now we done with remote side configuration. Configure local
912	 * side if we have not done it yet.
913	 */
914
915	pcb->cfg_state &= ~NG_BTSOCKET_L2CAP_CFG_OUT_SENT;
916	pcb->cfg_state |= NG_BTSOCKET_L2CAP_CFG_OUT;
917
918	if (pcb->cfg_state == NG_BTSOCKET_L2CAP_CFG_BOTH) {
919		/* Configuration complete - mask socket as open */
920		ng_btsocket_l2cap_untimeout(pcb);
921		pcb->state = NG_BTSOCKET_L2CAP_OPEN;
922		soisconnected(pcb->so);
923	} else {
924		if (!(pcb->cfg_state & NG_BTSOCKET_L2CAP_CFG_IN_SENT)) {
925			/* Send L2CA_Config request - incoming path */
926			error = ng_btsocket_l2cap_send_l2ca_cfg_req(pcb);
927			if (error != 0)
928				goto disconnect;
929
930			pcb->cfg_state |= NG_BTSOCKET_L2CAP_CFG_IN_SENT;
931		}
932	}
933
934	mtx_unlock(&pcb->pcb_mtx);
935	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
936
937	return (error);
938
939disconnect:
940	ng_btsocket_l2cap_untimeout(pcb);
941
942	/* Send disconnect with "zero" token */
943	ng_btsocket_l2cap_send_l2ca_discon_req(0, pcb);
944
945	/* ... and close the socket */
946	pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
947	soisdisconnected(pcb->so);
948
949	mtx_unlock(&pcb->pcb_mtx);
950	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
951
952	return (error);
953} /* ng_btsocket_l2cap_process_l2ca_cfg_rsp_rsp */
954
955/*
956 * Process L2CA_Config indicator
957 */
958
959static int
960ng_btsocket_l2cap_process_l2ca_cfg_ind(struct ng_mesg *msg,
961		ng_btsocket_l2cap_rtentry_p rt)
962{
963	ng_l2cap_l2ca_cfg_ind_ip	*ip = NULL;
964	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
965	int				 error = 0;
966
967	if (msg->header.arglen != sizeof(*ip))
968		return (EMSGSIZE);
969
970	ip = (ng_l2cap_l2ca_cfg_ind_ip *)(msg->data);
971
972	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
973
974	/* Check for the open socket that has given channel ID */
975	pcb = ng_btsocket_l2cap_pcb_by_cid(&rt->src, ip->lcid,
976					   NG_L2CAP_L2CA_IDTYPE_BREDR);
977	if (pcb == NULL) {
978		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
979		return (ENOENT);
980	}
981
982	mtx_lock(&pcb->pcb_mtx);
983
984        NG_BTSOCKET_L2CAP_INFO(
985"%s: Got L2CA_Config indicator, src bdaddr=%x:%x:%x:%x:%x:%x, " \
986"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, state=%d, cfg_state=%x\n",
987		__func__,
988		pcb->src.b[5], pcb->src.b[4], pcb->src.b[3],
989		pcb->src.b[2], pcb->src.b[1], pcb->src.b[0],
990		pcb->dst.b[5], pcb->dst.b[4], pcb->dst.b[3],
991		pcb->dst.b[2], pcb->dst.b[1], pcb->dst.b[0],
992		pcb->psm, pcb->cid, pcb->state, pcb->cfg_state);
993
994	/* XXX FIXME re-configuration on open socket */
995 	if (pcb->state != NG_BTSOCKET_L2CAP_CONFIGURING) {
996		mtx_unlock(&pcb->pcb_mtx);
997		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
998
999		return (ENOENT);
1000	}
1001
1002	/*
1003	 * XXX FIXME Actually set flush and link timeout. Set QoS here if
1004	 * required. Resolve conficts (flush_timo). Note outgoing MTU (peer's
1005	 * incoming MTU) and incoming flow spec.
1006	 */
1007
1008	pcb->omtu = ip->omtu;
1009	bcopy(&ip->iflow, &pcb->iflow, sizeof(pcb->iflow));
1010	pcb->flush_timo = ip->flush_timo;
1011
1012	/*
1013	 * Send L2CA_Config response to our peer and check for the errors,
1014	 * if any send disconnect to close the channel.
1015	 */
1016
1017	if (!(pcb->cfg_state & NG_BTSOCKET_L2CAP_CFG_OUT_SENT)) {
1018		error = ng_btsocket_l2cap_send_l2ca_cfg_rsp(pcb);
1019		if (error != 0) {
1020			ng_btsocket_l2cap_untimeout(pcb);
1021
1022			pcb->so->so_error = error;
1023
1024			/* Send disconnect with "zero" token */
1025			ng_btsocket_l2cap_send_l2ca_discon_req(0, pcb);
1026
1027			/* ... and close the socket */
1028			pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
1029			soisdisconnected(pcb->so);
1030		} else
1031			pcb->cfg_state |= NG_BTSOCKET_L2CAP_CFG_OUT_SENT;
1032	}
1033
1034	mtx_unlock(&pcb->pcb_mtx);
1035	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1036
1037	return (error);
1038} /* ng_btsocket_l2cap_process_l2cap_cfg_ind */
1039
1040/*
1041 * Process L2CA_Disconnect response
1042 */
1043
1044static int
1045ng_btsocket_l2cap_process_l2ca_discon_rsp(struct ng_mesg *msg,
1046		ng_btsocket_l2cap_rtentry_p rt)
1047{
1048	ng_l2cap_l2ca_discon_op	*op = NULL;
1049	ng_btsocket_l2cap_pcb_t	*pcb = NULL;
1050
1051	/* Check message */
1052	if (msg->header.arglen != sizeof(*op))
1053		return (EMSGSIZE);
1054
1055	op = (ng_l2cap_l2ca_discon_op *)(msg->data);
1056
1057	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
1058
1059	/*
1060	 * Socket layer must have issued L2CA_Disconnect request, so there
1061	 * must be a socket that wants to be disconnected. Use Netgraph
1062	 * message token to find it.
1063	 */
1064
1065	pcb = ng_btsocket_l2cap_pcb_by_token(msg->header.token);
1066	if (pcb == NULL) {
1067		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1068		return (0);
1069	}
1070
1071	mtx_lock(&pcb->pcb_mtx);
1072
1073	/* XXX Close socket no matter what op->result says */
1074	if (pcb->state != NG_BTSOCKET_L2CAP_CLOSED) {
1075       		NG_BTSOCKET_L2CAP_INFO(
1076"%s: Got L2CA_Disconnect response, token=%d, src bdaddr=%x:%x:%x:%x:%x:%x, " \
1077"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, result=%d, state=%d\n",
1078			__func__, msg->header.token,
1079			pcb->src.b[5], pcb->src.b[4], pcb->src.b[3],
1080			pcb->src.b[2], pcb->src.b[1], pcb->src.b[0],
1081			pcb->dst.b[5], pcb->dst.b[4], pcb->dst.b[3],
1082			pcb->dst.b[2], pcb->dst.b[1], pcb->dst.b[0],
1083			pcb->psm, pcb->cid, op->result, pcb->state);
1084
1085		ng_btsocket_l2cap_untimeout(pcb);
1086
1087		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
1088		soisdisconnected(pcb->so);
1089	}
1090
1091	mtx_unlock(&pcb->pcb_mtx);
1092	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1093
1094	return (0);
1095} /* ng_btsocket_l2cap_process_l2ca_discon_rsp */
1096
1097/*
1098 * Process L2CA_Disconnect indicator
1099 */
1100
1101static int
1102ng_btsocket_l2cap_process_l2ca_discon_ind(struct ng_mesg *msg,
1103		ng_btsocket_l2cap_rtentry_p rt)
1104{
1105	ng_l2cap_l2ca_discon_ind_ip	*ip = NULL;
1106	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
1107
1108	/* Check message */
1109	if (msg->header.arglen != sizeof(*ip))
1110		return (EMSGSIZE);
1111
1112	ip = (ng_l2cap_l2ca_discon_ind_ip *)(msg->data);
1113
1114	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
1115
1116	/* Look for the socket with given channel ID */
1117	pcb = ng_btsocket_l2cap_pcb_by_cid(&rt->src, ip->lcid,
1118					   ip->idtype);
1119	if (pcb == NULL) {
1120		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1121		return (0);
1122	}
1123
1124	/*
1125	 * Channel has already been destroyed, so disconnect the socket
1126	 * and be done with it. If there was any pending request we can
1127	 * not do anything here anyway.
1128	 */
1129
1130	mtx_lock(&pcb->pcb_mtx);
1131
1132       	NG_BTSOCKET_L2CAP_INFO(
1133"%s: Got L2CA_Disconnect indicator, src bdaddr=%x:%x:%x:%x:%x:%x, " \
1134"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, state=%d\n",
1135		__func__,
1136		pcb->src.b[5], pcb->src.b[4], pcb->src.b[3],
1137		pcb->src.b[2], pcb->src.b[1], pcb->src.b[0],
1138		pcb->dst.b[5], pcb->dst.b[4], pcb->dst.b[3],
1139		pcb->dst.b[2], pcb->dst.b[1], pcb->dst.b[0],
1140		pcb->psm, pcb->cid, pcb->state);
1141
1142	if (pcb->flags & NG_BTSOCKET_L2CAP_TIMO)
1143		ng_btsocket_l2cap_untimeout(pcb);
1144
1145	pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
1146	soisdisconnected(pcb->so);
1147
1148	mtx_unlock(&pcb->pcb_mtx);
1149	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1150
1151	return (0);
1152} /* ng_btsocket_l2cap_process_l2ca_discon_ind */
1153
1154/*
1155 * Process L2CA_Write response
1156 */
1157
1158static int
1159ng_btsocket_l2cap_process_l2ca_write_rsp(struct ng_mesg *msg,
1160		ng_btsocket_l2cap_rtentry_p rt)
1161{
1162	ng_l2cap_l2ca_write_op	*op = NULL;
1163	ng_btsocket_l2cap_pcb_t	*pcb = NULL;
1164
1165	/* Check message */
1166	if (msg->header.arglen != sizeof(*op))
1167		return (EMSGSIZE);
1168
1169	op = (ng_l2cap_l2ca_write_op *)(msg->data);
1170
1171	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
1172
1173	/* Look for the socket with given token */
1174	pcb = ng_btsocket_l2cap_pcb_by_token(msg->header.token);
1175	if (pcb == NULL) {
1176		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1177		return (ENOENT);
1178	}
1179
1180	mtx_lock(&pcb->pcb_mtx);
1181
1182       	NG_BTSOCKET_L2CAP_INFO(
1183"%s: Got L2CA_Write response, src bdaddr=%x:%x:%x:%x:%x:%x, " \
1184"dst bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, lcid=%d, result=%d, length=%d, " \
1185"state=%d\n",		__func__,
1186			pcb->src.b[5], pcb->src.b[4], pcb->src.b[3],
1187			pcb->src.b[2], pcb->src.b[1], pcb->src.b[0],
1188			pcb->dst.b[5], pcb->dst.b[4], pcb->dst.b[3],
1189			pcb->dst.b[2], pcb->dst.b[1], pcb->dst.b[0],
1190			pcb->psm, pcb->cid, op->result, op->length,
1191			pcb->state);
1192
1193	if (pcb->state != NG_BTSOCKET_L2CAP_OPEN) {
1194		mtx_unlock(&pcb->pcb_mtx);
1195		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1196
1197		return (ENOENT);
1198	}
1199
1200	ng_btsocket_l2cap_untimeout(pcb);
1201
1202	/*
1203 	 * Check if we have more data to send
1204 	 */
1205	sbdroprecord(&pcb->so->so_snd);
1206	if (sbavail(&pcb->so->so_snd) > 0) {
1207		if (ng_btsocket_l2cap_send2(pcb) == 0)
1208			ng_btsocket_l2cap_timeout(pcb);
1209		else
1210			sbdroprecord(&pcb->so->so_snd); /* XXX */
1211	}
1212
1213	/*
1214	 * Now set the result, drop packet from the socket send queue and
1215	 * ask for more (wakeup sender)
1216	 */
1217
1218	pcb->so->so_error = ng_btsocket_l2cap_result2errno(op->result);
1219	sowwakeup(pcb->so);
1220
1221	mtx_unlock(&pcb->pcb_mtx);
1222	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1223
1224	return (0);
1225} /* ng_btsocket_l2cap_process_l2ca_write_rsp */
1226
1227/*
1228 * Send L2CA_Connect request
1229 */
1230
1231static int
1232ng_btsocket_l2cap_send_l2ca_con_req(ng_btsocket_l2cap_pcb_p pcb)
1233{
1234	struct ng_mesg		*msg = NULL;
1235	ng_l2cap_l2ca_con_ip	*ip = NULL;
1236	int			 error = 0;
1237
1238	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
1239
1240	if (pcb->rt == NULL ||
1241	    pcb->rt->hook == NULL || NG_HOOK_NOT_VALID(pcb->rt->hook))
1242		return (ENETDOWN);
1243
1244	NG_MKMESSAGE(msg, NGM_L2CAP_COOKIE, NGM_L2CAP_L2CA_CON,
1245		sizeof(*ip), M_NOWAIT);
1246	if (msg == NULL)
1247		return (ENOMEM);
1248
1249	msg->header.token = pcb->token;
1250
1251	ip = (ng_l2cap_l2ca_con_ip *)(msg->data);
1252	bcopy(&pcb->dst, &ip->bdaddr, sizeof(ip->bdaddr));
1253	ip->psm = pcb->psm;
1254	ip->linktype = ng_btsock_l2cap_addrtype_to_linktype(pcb->dsttype);
1255	ip->idtype = pcb->idtype;
1256	NG_SEND_MSG_HOOK(error, ng_btsocket_l2cap_node, msg,pcb->rt->hook, 0);
1257
1258	return (error);
1259} /* ng_btsocket_l2cap_send_l2ca_con_req */
1260
1261/*
1262 * Send L2CA_Connect response
1263 */
1264
1265static int
1266ng_btsocket_l2cap_send_l2ca_con_rsp_req(u_int32_t token,
1267		ng_btsocket_l2cap_rtentry_p rt, bdaddr_p dst, int ident,
1268					int lcid, int result, int linktype)
1269{
1270	struct ng_mesg			*msg = NULL;
1271	ng_l2cap_l2ca_con_rsp_ip	*ip = NULL;
1272	int				 error = 0;
1273
1274	if (rt == NULL || rt->hook == NULL || NG_HOOK_NOT_VALID(rt->hook))
1275		return (ENETDOWN);
1276
1277	NG_MKMESSAGE(msg, NGM_L2CAP_COOKIE, NGM_L2CAP_L2CA_CON_RSP,
1278		sizeof(*ip), M_NOWAIT);
1279	if (msg == NULL)
1280		return (ENOMEM);
1281
1282	msg->header.token = token;
1283
1284	ip = (ng_l2cap_l2ca_con_rsp_ip *)(msg->data);
1285	bcopy(dst, &ip->bdaddr, sizeof(ip->bdaddr));
1286	ip->ident = ident;
1287	ip->lcid = lcid;
1288	ip->linktype = linktype;
1289	ip->result = result;
1290	ip->status = 0;
1291
1292	NG_SEND_MSG_HOOK(error, ng_btsocket_l2cap_node, msg, rt->hook, 0);
1293
1294	return (error);
1295} /* ng_btsocket_l2cap_send_l2ca_con_rsp_req */
1296
1297/*
1298 * Send L2CA_Config request
1299 */
1300
1301static int
1302ng_btsocket_l2cap_send_l2ca_cfg_req(ng_btsocket_l2cap_pcb_p pcb)
1303{
1304	struct ng_mesg		*msg = NULL;
1305	ng_l2cap_l2ca_cfg_ip	*ip = NULL;
1306	int			 error = 0;
1307
1308	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
1309
1310	if (pcb->rt == NULL ||
1311	    pcb->rt->hook == NULL || NG_HOOK_NOT_VALID(pcb->rt->hook))
1312		return (ENETDOWN);
1313
1314	NG_MKMESSAGE(msg, NGM_L2CAP_COOKIE, NGM_L2CAP_L2CA_CFG,
1315		sizeof(*ip), M_NOWAIT);
1316	if (msg == NULL)
1317		return (ENOMEM);
1318
1319	msg->header.token = pcb->token;
1320
1321	ip = (ng_l2cap_l2ca_cfg_ip *)(msg->data);
1322	ip->lcid = pcb->cid;
1323	ip->imtu = pcb->imtu;
1324	bcopy(&pcb->oflow, &ip->oflow, sizeof(ip->oflow));
1325	ip->flush_timo = pcb->flush_timo;
1326	ip->link_timo = pcb->link_timo;
1327
1328	NG_SEND_MSG_HOOK(error, ng_btsocket_l2cap_node, msg,pcb->rt->hook, 0);
1329
1330	return (error);
1331} /* ng_btsocket_l2cap_send_l2ca_cfg_req */
1332
1333/*
1334 * Send L2CA_Config response
1335 */
1336
1337static int
1338ng_btsocket_l2cap_send_l2ca_cfg_rsp(ng_btsocket_l2cap_pcb_p pcb)
1339{
1340	struct ng_mesg			*msg = NULL;
1341	ng_l2cap_l2ca_cfg_rsp_ip	*ip = NULL;
1342	int				 error = 0;
1343
1344	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
1345
1346	if (pcb->rt == NULL ||
1347	    pcb->rt->hook == NULL || NG_HOOK_NOT_VALID(pcb->rt->hook))
1348		return (ENETDOWN);
1349
1350	NG_MKMESSAGE(msg, NGM_L2CAP_COOKIE, NGM_L2CAP_L2CA_CFG_RSP,
1351		sizeof(*ip), M_NOWAIT);
1352	if (msg == NULL)
1353		return (ENOMEM);
1354
1355	msg->header.token = pcb->token;
1356
1357	ip = (ng_l2cap_l2ca_cfg_rsp_ip *)(msg->data);
1358	ip->lcid = pcb->cid;
1359	ip->omtu = pcb->omtu;
1360	bcopy(&pcb->iflow, &ip->iflow, sizeof(ip->iflow));
1361
1362	NG_SEND_MSG_HOOK(error, ng_btsocket_l2cap_node, msg, pcb->rt->hook, 0);
1363
1364	return (error);
1365} /* ng_btsocket_l2cap_send_l2ca_cfg_rsp */
1366
1367/*
1368 * Send L2CA_Disconnect request
1369 */
1370
1371static int
1372ng_btsocket_l2cap_send_l2ca_discon_req(u_int32_t token,
1373		ng_btsocket_l2cap_pcb_p pcb)
1374{
1375	struct ng_mesg		*msg = NULL;
1376	ng_l2cap_l2ca_discon_ip	*ip = NULL;
1377	int			 error = 0;
1378
1379	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
1380
1381	if (pcb->rt == NULL ||
1382	    pcb->rt->hook == NULL || NG_HOOK_NOT_VALID(pcb->rt->hook))
1383		return (ENETDOWN);
1384
1385	NG_MKMESSAGE(msg, NGM_L2CAP_COOKIE, NGM_L2CAP_L2CA_DISCON,
1386		sizeof(*ip), M_NOWAIT);
1387	if (msg == NULL)
1388		return (ENOMEM);
1389
1390	msg->header.token = token;
1391
1392	ip = (ng_l2cap_l2ca_discon_ip *)(msg->data);
1393	ip->lcid = pcb->cid;
1394	ip->idtype = pcb->idtype;
1395
1396	NG_SEND_MSG_HOOK(error, ng_btsocket_l2cap_node, msg,pcb->rt->hook, 0);
1397
1398	return (error);
1399} /* ng_btsocket_l2cap_send_l2ca_discon_req */
1400
1401/*****************************************************************************
1402 *****************************************************************************
1403 **                              Socket interface
1404 *****************************************************************************
1405 *****************************************************************************/
1406
1407/*
1408 * L2CAP sockets data input routine
1409 */
1410
1411static void
1412ng_btsocket_l2cap_data_input(struct mbuf *m, hook_p hook)
1413{
1414	ng_l2cap_hdr_t			*hdr = NULL;
1415	ng_l2cap_clt_hdr_t		*clt_hdr = NULL;
1416	ng_btsocket_l2cap_pcb_t		*pcb = NULL;
1417	ng_btsocket_l2cap_rtentry_t	*rt = NULL;
1418	uint16_t idtype;
1419
1420	if (hook == NULL) {
1421		NG_BTSOCKET_L2CAP_ALERT(
1422"%s: Invalid source hook for L2CAP data packet\n", __func__);
1423		goto drop;
1424	}
1425
1426	rt = (ng_btsocket_l2cap_rtentry_t *) NG_HOOK_PRIVATE(hook);
1427	if (rt == NULL) {
1428		NG_BTSOCKET_L2CAP_ALERT(
1429"%s: Could not find out source bdaddr for L2CAP data packet\n", __func__);
1430		goto drop;
1431	}
1432
1433	m = m_pullup(m, sizeof(uint16_t));
1434	idtype = *mtod(m, uint16_t *);
1435	m_adj(m, sizeof(uint16_t));
1436
1437	/* Make sure we can access header */
1438	if (m->m_pkthdr.len < sizeof(*hdr)) {
1439		NG_BTSOCKET_L2CAP_ERR(
1440"%s: L2CAP data packet too small, len=%d\n", __func__, m->m_pkthdr.len);
1441		goto drop;
1442	}
1443
1444	if (m->m_len < sizeof(*hdr)) {
1445		m = m_pullup(m, sizeof(*hdr));
1446		if (m == NULL)
1447			goto drop;
1448	}
1449
1450	/* Strip L2CAP packet header and verify packet length */
1451	hdr = mtod(m, ng_l2cap_hdr_t *);
1452	m_adj(m, sizeof(*hdr));
1453
1454	if (hdr->length != m->m_pkthdr.len) {
1455		NG_BTSOCKET_L2CAP_ERR(
1456"%s: Bad L2CAP data packet length, len=%d, length=%d\n",
1457			__func__, m->m_pkthdr.len, hdr->length);
1458		goto drop;
1459	}
1460
1461	/*
1462	 * Now process packet. Two cases:
1463	 *
1464	 * 1) Normal packet (cid != 2) then find connected socket and append
1465	 *    mbuf to the socket queue. Wakeup socket.
1466	 *
1467	 * 2) Broadcast packet (cid == 2) then find all sockets that connected
1468	 *    to the given PSM and have SO_BROADCAST bit set and append mbuf
1469	 *    to the socket queue. Wakeup socket.
1470	 */
1471
1472	NG_BTSOCKET_L2CAP_INFO(
1473"%s: Received L2CAP data packet: src bdaddr=%x:%x:%x:%x:%x:%x, " \
1474"dcid=%d, length=%d\n",
1475		__func__,
1476		rt->src.b[5], rt->src.b[4], rt->src.b[3],
1477		rt->src.b[2], rt->src.b[1], rt->src.b[0],
1478		hdr->dcid, hdr->length);
1479
1480	if ((hdr->dcid >= NG_L2CAP_FIRST_CID) ||
1481	    (idtype == NG_L2CAP_L2CA_IDTYPE_ATT)||
1482	    (idtype == NG_L2CAP_L2CA_IDTYPE_SMP)
1483	    ){
1484
1485		mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
1486
1487		/* Normal packet: find connected socket */
1488		pcb = ng_btsocket_l2cap_pcb_by_cid(&rt->src, hdr->dcid,idtype);
1489		if (pcb == NULL) {
1490			mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1491			goto drop;
1492		}
1493
1494		mtx_lock(&pcb->pcb_mtx);
1495
1496		if (pcb->state != NG_BTSOCKET_L2CAP_OPEN) {
1497			NG_BTSOCKET_L2CAP_ERR(
1498"%s: No connected socket found, src bdaddr=%x:%x:%x:%x:%x:%x, dcid=%d, " \
1499"state=%d\n",			__func__,
1500				rt->src.b[5], rt->src.b[4], rt->src.b[3],
1501				rt->src.b[2], rt->src.b[1], rt->src.b[0],
1502				hdr->dcid, pcb->state);
1503
1504			mtx_unlock(&pcb->pcb_mtx);
1505			mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1506			goto drop;
1507		}
1508
1509		/* Check packet size against socket's incoming MTU */
1510		if (hdr->length > pcb->imtu) {
1511			NG_BTSOCKET_L2CAP_ERR(
1512"%s: L2CAP data packet too big, src bdaddr=%x:%x:%x:%x:%x:%x, " \
1513"dcid=%d, length=%d, imtu=%d\n",
1514				__func__,
1515				rt->src.b[5], rt->src.b[4], rt->src.b[3],
1516				rt->src.b[2], rt->src.b[1], rt->src.b[0],
1517				hdr->dcid, hdr->length, pcb->imtu);
1518
1519			mtx_unlock(&pcb->pcb_mtx);
1520			mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1521			goto drop;
1522		}
1523
1524		/* Check if we have enough space in socket receive queue */
1525		if (m->m_pkthdr.len > sbspace(&pcb->so->so_rcv)) {
1526
1527			/*
1528			 * This is really bad. Receive queue on socket does
1529			 * not have enough space for the packet. We do not
1530			 * have any other choice but drop the packet. L2CAP
1531			 * does not provide any flow control.
1532			 */
1533
1534			NG_BTSOCKET_L2CAP_ERR(
1535"%s: Not enough space in socket receive queue. Dropping L2CAP data packet, " \
1536"src bdaddr=%x:%x:%x:%x:%x:%x, dcid=%d, len=%d, space=%ld\n",
1537				__func__,
1538				rt->src.b[5], rt->src.b[4], rt->src.b[3],
1539				rt->src.b[2], rt->src.b[1], rt->src.b[0],
1540				hdr->dcid, m->m_pkthdr.len,
1541				sbspace(&pcb->so->so_rcv));
1542
1543			mtx_unlock(&pcb->pcb_mtx);
1544			mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1545			goto drop;
1546		}
1547
1548		/* Append packet to the socket receive queue and wakeup */
1549		sbappendrecord(&pcb->so->so_rcv, m);
1550		m = NULL;
1551
1552		sorwakeup(pcb->so);
1553
1554		mtx_unlock(&pcb->pcb_mtx);
1555		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1556	} else if (hdr->dcid == NG_L2CAP_CLT_CID) {
1557		/* Broadcast packet: give packet to all sockets  */
1558
1559		/* Check packet size against connectionless MTU */
1560		if (hdr->length > NG_L2CAP_MTU_DEFAULT) {
1561			NG_BTSOCKET_L2CAP_ERR(
1562"%s: Connectionless L2CAP data packet too big, " \
1563"src bdaddr=%x:%x:%x:%x:%x:%x, length=%d\n",
1564				__func__,
1565				rt->src.b[5], rt->src.b[4], rt->src.b[3],
1566				rt->src.b[2], rt->src.b[1], rt->src.b[0],
1567				hdr->length);
1568			goto drop;
1569		}
1570
1571		/* Make sure we can access connectionless header */
1572		if (m->m_pkthdr.len < sizeof(*clt_hdr)) {
1573			NG_BTSOCKET_L2CAP_ERR(
1574"%s: Can not get L2CAP connectionless packet header, " \
1575"src bdaddr=%x:%x:%x:%x:%x:%x, length=%d\n",
1576				__func__,
1577				rt->src.b[5], rt->src.b[4], rt->src.b[3],
1578				rt->src.b[2], rt->src.b[1], rt->src.b[0],
1579				hdr->length);
1580			goto drop;
1581		}
1582
1583		if (m->m_len < sizeof(*clt_hdr)) {
1584			m = m_pullup(m, sizeof(*clt_hdr));
1585			if (m == NULL)
1586				goto drop;
1587		}
1588
1589		/* Strip connectionless header and deliver packet */
1590		clt_hdr = mtod(m, ng_l2cap_clt_hdr_t *);
1591		m_adj(m, sizeof(*clt_hdr));
1592
1593		NG_BTSOCKET_L2CAP_INFO(
1594"%s: Got L2CAP connectionless data packet, " \
1595"src bdaddr=%x:%x:%x:%x:%x:%x, psm=%d, length=%d\n",
1596			__func__,
1597			rt->src.b[5], rt->src.b[4], rt->src.b[3],
1598			rt->src.b[2], rt->src.b[1], rt->src.b[0],
1599			clt_hdr->psm, hdr->length);
1600
1601		mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
1602
1603		LIST_FOREACH(pcb, &ng_btsocket_l2cap_sockets, next) {
1604			struct mbuf	*copy = NULL;
1605
1606			mtx_lock(&pcb->pcb_mtx);
1607
1608			if (bcmp(&rt->src, &pcb->src, sizeof(pcb->src)) != 0 ||
1609			    pcb->psm != clt_hdr->psm ||
1610			    pcb->state != NG_BTSOCKET_L2CAP_OPEN ||
1611			    (pcb->so->so_options & SO_BROADCAST) == 0 ||
1612			    m->m_pkthdr.len > sbspace(&pcb->so->so_rcv))
1613				goto next;
1614
1615			/*
1616			 * Create a copy of the packet and append it to the
1617			 * socket's queue. If m_dup() failed - no big deal
1618			 * it is a broadcast traffic after all
1619			 */
1620
1621			copy = m_dup(m, M_NOWAIT);
1622			if (copy != NULL) {
1623				sbappendrecord(&pcb->so->so_rcv, copy);
1624				sorwakeup(pcb->so);
1625			}
1626next:
1627			mtx_unlock(&pcb->pcb_mtx);
1628		}
1629
1630		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1631	}
1632drop:
1633	NG_FREE_M(m); /* checks for m != NULL */
1634} /* ng_btsocket_l2cap_data_input */
1635
1636/*
1637 * L2CAP sockets default message input routine
1638 */
1639
1640static void
1641ng_btsocket_l2cap_default_msg_input(struct ng_mesg *msg, hook_p hook)
1642{
1643	switch (msg->header.cmd) {
1644	case NGM_L2CAP_NODE_HOOK_INFO: {
1645		ng_btsocket_l2cap_rtentry_t	*rt = NULL;
1646		ng_l2cap_node_hook_info_ep *ep =
1647		  (ng_l2cap_node_hook_info_ep *)msg->data;
1648		if (hook == NULL || msg->header.arglen != sizeof(*ep))
1649			break;
1650
1651		if (bcmp(&ep->addr, NG_HCI_BDADDR_ANY, sizeof(bdaddr_t)) == 0)
1652			break;
1653
1654		mtx_lock(&ng_btsocket_l2cap_rt_mtx);
1655
1656		rt = (ng_btsocket_l2cap_rtentry_t *) NG_HOOK_PRIVATE(hook);
1657		if (rt == NULL) {
1658			rt = malloc(sizeof(*rt),
1659				M_NETGRAPH_BTSOCKET_L2CAP, M_NOWAIT|M_ZERO);
1660			if (rt == NULL) {
1661				mtx_unlock(&ng_btsocket_l2cap_rt_mtx);
1662				break;
1663			}
1664
1665			LIST_INSERT_HEAD(&ng_btsocket_l2cap_rt, rt, next);
1666
1667			NG_HOOK_SET_PRIVATE(hook, rt);
1668		}
1669
1670		bcopy(&ep->addr, &rt->src, sizeof(rt->src));
1671		rt->hook = hook;
1672
1673		mtx_unlock(&ng_btsocket_l2cap_rt_mtx);
1674
1675		NG_BTSOCKET_L2CAP_INFO(
1676"%s: Updating hook \"%s\", src bdaddr=%x:%x:%x:%x:%x:%x\n",
1677			__func__, NG_HOOK_NAME(hook),
1678			rt->src.b[5], rt->src.b[4], rt->src.b[3],
1679			rt->src.b[2], rt->src.b[1], rt->src.b[0]);
1680		} break;
1681
1682	default:
1683		NG_BTSOCKET_L2CAP_WARN(
1684"%s: Unknown message, cmd=%d\n", __func__, msg->header.cmd);
1685		break;
1686	}
1687
1688	NG_FREE_MSG(msg); /* Checks for msg != NULL */
1689} /* ng_btsocket_l2cap_default_msg_input */
1690
1691/*
1692 * L2CAP sockets L2CA message input routine
1693 */
1694
1695static void
1696ng_btsocket_l2cap_l2ca_msg_input(struct ng_mesg *msg, hook_p hook)
1697{
1698	ng_btsocket_l2cap_rtentry_p	rt = NULL;
1699
1700	if (hook == NULL) {
1701		NG_BTSOCKET_L2CAP_ALERT(
1702"%s: Invalid source hook for L2CA message\n", __func__);
1703		goto drop;
1704	}
1705
1706	rt = (ng_btsocket_l2cap_rtentry_p) NG_HOOK_PRIVATE(hook);
1707	if (rt == NULL) {
1708		NG_BTSOCKET_L2CAP_ALERT(
1709"%s: Could not find out source bdaddr for L2CA message\n", __func__);
1710		goto drop;
1711	}
1712
1713	switch (msg->header.cmd) {
1714	case NGM_L2CAP_L2CA_CON: /* L2CA_Connect response */
1715		ng_btsocket_l2cap_process_l2ca_con_req_rsp(msg, rt);
1716		break;
1717
1718	case NGM_L2CAP_L2CA_CON_RSP: /* L2CA_ConnectRsp response */
1719		ng_btsocket_l2cap_process_l2ca_con_rsp_rsp(msg, rt);
1720		break;
1721
1722	case NGM_L2CAP_L2CA_CON_IND: /* L2CA_Connect indicator */
1723		ng_btsocket_l2cap_process_l2ca_con_ind(msg, rt);
1724		break;
1725
1726	case NGM_L2CAP_L2CA_CFG: /* L2CA_Config response */
1727		ng_btsocket_l2cap_process_l2ca_cfg_req_rsp(msg, rt);
1728		break;
1729
1730	case NGM_L2CAP_L2CA_CFG_RSP: /* L2CA_ConfigRsp response */
1731		ng_btsocket_l2cap_process_l2ca_cfg_rsp_rsp(msg, rt);
1732		break;
1733
1734	case NGM_L2CAP_L2CA_CFG_IND: /* L2CA_Config indicator */
1735		ng_btsocket_l2cap_process_l2ca_cfg_ind(msg, rt);
1736		break;
1737
1738	case NGM_L2CAP_L2CA_DISCON: /* L2CA_Disconnect response */
1739		ng_btsocket_l2cap_process_l2ca_discon_rsp(msg, rt);
1740		break;
1741
1742	case NGM_L2CAP_L2CA_DISCON_IND: /* L2CA_Disconnect indicator */
1743		ng_btsocket_l2cap_process_l2ca_discon_ind(msg, rt);
1744		break;
1745
1746	case NGM_L2CAP_L2CA_WRITE: /* L2CA_Write response */
1747		ng_btsocket_l2cap_process_l2ca_write_rsp(msg, rt);
1748		break;
1749	case NGM_L2CAP_L2CA_ENC_CHANGE:
1750		ng_btsocket_l2cap_process_l2ca_enc_change(msg, rt);
1751
1752		break;
1753	/* XXX FIXME add other L2CA messages */
1754
1755	default:
1756		NG_BTSOCKET_L2CAP_WARN(
1757"%s: Unknown L2CA message, cmd=%d\n", __func__, msg->header.cmd);
1758		break;
1759	}
1760drop:
1761	NG_FREE_MSG(msg);
1762} /* ng_btsocket_l2cap_l2ca_msg_input */
1763
1764/*
1765 * L2CAP sockets input routine
1766 */
1767
1768static void
1769ng_btsocket_l2cap_input(void *context, int pending)
1770{
1771	item_p	item = NULL;
1772	hook_p	hook = NULL;
1773
1774	for (;;) {
1775		mtx_lock(&ng_btsocket_l2cap_queue_mtx);
1776		NG_BT_ITEMQ_DEQUEUE(&ng_btsocket_l2cap_queue, item);
1777		mtx_unlock(&ng_btsocket_l2cap_queue_mtx);
1778
1779		if (item == NULL)
1780			break;
1781
1782		NGI_GET_HOOK(item, hook);
1783		if (hook != NULL && NG_HOOK_NOT_VALID(hook))
1784			goto drop;
1785
1786		switch(item->el_flags & NGQF_TYPE) {
1787		case NGQF_DATA: {
1788			struct mbuf     *m = NULL;
1789
1790			NGI_GET_M(item, m);
1791			ng_btsocket_l2cap_data_input(m, hook);
1792			} break;
1793
1794		case NGQF_MESG: {
1795			struct ng_mesg  *msg = NULL;
1796
1797			NGI_GET_MSG(item, msg);
1798
1799			switch (msg->header.cmd) {
1800			case NGM_L2CAP_L2CA_CON:
1801			case NGM_L2CAP_L2CA_CON_RSP:
1802			case NGM_L2CAP_L2CA_CON_IND:
1803			case NGM_L2CAP_L2CA_CFG:
1804			case NGM_L2CAP_L2CA_CFG_RSP:
1805			case NGM_L2CAP_L2CA_CFG_IND:
1806			case NGM_L2CAP_L2CA_DISCON:
1807			case NGM_L2CAP_L2CA_DISCON_IND:
1808			case NGM_L2CAP_L2CA_WRITE:
1809			case NGM_L2CAP_L2CA_ENC_CHANGE:
1810			/* XXX FIXME add other L2CA messages */
1811				ng_btsocket_l2cap_l2ca_msg_input(msg, hook);
1812				break;
1813
1814			default:
1815				ng_btsocket_l2cap_default_msg_input(msg, hook);
1816				break;
1817			}
1818			} break;
1819
1820		default:
1821			KASSERT(0,
1822("%s: invalid item type=%ld\n", __func__, (item->el_flags & NGQF_TYPE)));
1823			break;
1824		}
1825drop:
1826		if (hook != NULL)
1827			NG_HOOK_UNREF(hook);
1828
1829		NG_FREE_ITEM(item);
1830	}
1831} /* ng_btsocket_l2cap_input */
1832
1833/*
1834 * Route cleanup task. Gets scheduled when hook is disconnected. Here we
1835 * will find all sockets that use "invalid" hook and disconnect them.
1836 */
1837
1838static void
1839ng_btsocket_l2cap_rtclean(void *context, int pending)
1840{
1841	ng_btsocket_l2cap_pcb_p		pcb = NULL, pcb_next = NULL;
1842	ng_btsocket_l2cap_rtentry_p	rt = NULL;
1843
1844	mtx_lock(&ng_btsocket_l2cap_rt_mtx);
1845	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
1846
1847	/*
1848	 * First disconnect all sockets that use "invalid" hook
1849	 */
1850
1851	for (pcb = LIST_FIRST(&ng_btsocket_l2cap_sockets); pcb != NULL; ) {
1852		mtx_lock(&pcb->pcb_mtx);
1853		pcb_next = LIST_NEXT(pcb, next);
1854
1855		if (pcb->rt != NULL &&
1856		    pcb->rt->hook != NULL && NG_HOOK_NOT_VALID(pcb->rt->hook)) {
1857			if (pcb->flags & NG_BTSOCKET_L2CAP_TIMO)
1858				ng_btsocket_l2cap_untimeout(pcb);
1859
1860			pcb->so->so_error = ENETDOWN;
1861			pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
1862			soisdisconnected(pcb->so);
1863
1864			pcb->token = 0;
1865			pcb->cid = 0;
1866			pcb->rt = NULL;
1867		}
1868
1869		mtx_unlock(&pcb->pcb_mtx);
1870		pcb = pcb_next;
1871	}
1872
1873	/*
1874	 * Now cleanup routing table
1875	 */
1876
1877	for (rt = LIST_FIRST(&ng_btsocket_l2cap_rt); rt != NULL; ) {
1878		ng_btsocket_l2cap_rtentry_p	rt_next = LIST_NEXT(rt, next);
1879
1880		if (rt->hook != NULL && NG_HOOK_NOT_VALID(rt->hook)) {
1881			LIST_REMOVE(rt, next);
1882
1883			NG_HOOK_SET_PRIVATE(rt->hook, NULL);
1884			NG_HOOK_UNREF(rt->hook); /* Remove extra reference */
1885
1886			bzero(rt, sizeof(*rt));
1887			free(rt, M_NETGRAPH_BTSOCKET_L2CAP);
1888		}
1889
1890		rt = rt_next;
1891	}
1892
1893	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
1894	mtx_unlock(&ng_btsocket_l2cap_rt_mtx);
1895} /* ng_btsocket_l2cap_rtclean */
1896
1897/*
1898 * Initialize everything
1899 */
1900
1901void
1902ng_btsocket_l2cap_init(void)
1903{
1904	int	error = 0;
1905
1906	/* Skip initialization of globals for non-default instances. */
1907	if (!IS_DEFAULT_VNET(curvnet))
1908		return;
1909
1910	ng_btsocket_l2cap_node = NULL;
1911	ng_btsocket_l2cap_debug_level = NG_BTSOCKET_WARN_LEVEL;
1912
1913	/* Register Netgraph node type */
1914	error = ng_newtype(&typestruct);
1915	if (error != 0) {
1916		NG_BTSOCKET_L2CAP_ALERT(
1917"%s: Could not register Netgraph node type, error=%d\n", __func__, error);
1918
1919                return;
1920	}
1921
1922	/* Create Netgrapg node */
1923	error = ng_make_node_common(&typestruct, &ng_btsocket_l2cap_node);
1924	if (error != 0) {
1925		NG_BTSOCKET_L2CAP_ALERT(
1926"%s: Could not create Netgraph node, error=%d\n", __func__, error);
1927
1928		ng_btsocket_l2cap_node = NULL;
1929
1930		return;
1931	}
1932
1933	error = ng_name_node(ng_btsocket_l2cap_node,
1934				NG_BTSOCKET_L2CAP_NODE_TYPE);
1935	if (error != 0) {
1936		NG_BTSOCKET_L2CAP_ALERT(
1937"%s: Could not name Netgraph node, error=%d\n", __func__, error);
1938
1939		NG_NODE_UNREF(ng_btsocket_l2cap_node);
1940		ng_btsocket_l2cap_node = NULL;
1941
1942		return;
1943	}
1944
1945	/* Create input queue */
1946	NG_BT_ITEMQ_INIT(&ng_btsocket_l2cap_queue, ifqmaxlen);
1947	mtx_init(&ng_btsocket_l2cap_queue_mtx,
1948		"btsocks_l2cap_queue_mtx", NULL, MTX_DEF);
1949	TASK_INIT(&ng_btsocket_l2cap_queue_task, 0,
1950		ng_btsocket_l2cap_input, NULL);
1951
1952	/* Create list of sockets */
1953	LIST_INIT(&ng_btsocket_l2cap_sockets);
1954	mtx_init(&ng_btsocket_l2cap_sockets_mtx,
1955		"btsocks_l2cap_sockets_mtx", NULL, MTX_DEF);
1956
1957	/* Routing table */
1958	LIST_INIT(&ng_btsocket_l2cap_rt);
1959	mtx_init(&ng_btsocket_l2cap_rt_mtx,
1960		"btsocks_l2cap_rt_mtx", NULL, MTX_DEF);
1961	TASK_INIT(&ng_btsocket_l2cap_rt_task, 0,
1962		ng_btsocket_l2cap_rtclean, NULL);
1963} /* ng_btsocket_l2cap_init */
1964
1965/*
1966 * Abort connection on socket
1967 */
1968
1969void
1970ng_btsocket_l2cap_abort(struct socket *so)
1971{
1972	so->so_error = ECONNABORTED;
1973
1974	(void)ng_btsocket_l2cap_disconnect(so);
1975} /* ng_btsocket_l2cap_abort */
1976
1977void
1978ng_btsocket_l2cap_close(struct socket *so)
1979{
1980
1981	(void)ng_btsocket_l2cap_disconnect(so);
1982} /* ng_btsocket_l2cap_close */
1983
1984/*
1985 * Accept connection on socket. Nothing to do here, socket must be connected
1986 * and ready, so just return peer address and be done with it.
1987 */
1988
1989int
1990ng_btsocket_l2cap_accept(struct socket *so, struct sockaddr **nam)
1991{
1992	if (ng_btsocket_l2cap_node == NULL)
1993		return (EINVAL);
1994
1995	return (ng_btsocket_l2cap_peeraddr(so, nam));
1996} /* ng_btsocket_l2cap_accept */
1997
1998/*
1999 * Create and attach new socket
2000 */
2001
2002int
2003ng_btsocket_l2cap_attach(struct socket *so, int proto, struct thread *td)
2004{
2005	static u_int32_t	token = 0;
2006	ng_btsocket_l2cap_pcb_p	pcb = so2l2cap_pcb(so);
2007	int			error;
2008
2009	/* Check socket and protocol */
2010	if (ng_btsocket_l2cap_node == NULL)
2011		return (EPROTONOSUPPORT);
2012	if (so->so_type != SOCK_SEQPACKET)
2013		return (ESOCKTNOSUPPORT);
2014
2015#if 0 /* XXX sonewconn() calls "pru_attach" with proto == 0 */
2016	if (proto != 0)
2017		if (proto != BLUETOOTH_PROTO_L2CAP)
2018			return (EPROTONOSUPPORT);
2019#endif /* XXX */
2020
2021	if (pcb != NULL)
2022		return (EISCONN);
2023
2024	/* Reserve send and receive space if it is not reserved yet */
2025	if ((so->so_snd.sb_hiwat == 0) || (so->so_rcv.sb_hiwat == 0)) {
2026		error = soreserve(so, NG_BTSOCKET_L2CAP_SENDSPACE,
2027					NG_BTSOCKET_L2CAP_RECVSPACE);
2028		if (error != 0)
2029			return (error);
2030	}
2031
2032	/* Allocate the PCB */
2033        pcb = malloc(sizeof(*pcb),
2034		M_NETGRAPH_BTSOCKET_L2CAP, M_NOWAIT | M_ZERO);
2035        if (pcb == NULL)
2036                return (ENOMEM);
2037
2038	/* Link the PCB and the socket */
2039	so->so_pcb = (caddr_t) pcb;
2040	pcb->so = so;
2041	pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
2042
2043	/* Initialize PCB */
2044	pcb->imtu = pcb->omtu = NG_L2CAP_MTU_DEFAULT;
2045
2046	/* Default flow */
2047	pcb->iflow.flags = 0x0;
2048	pcb->iflow.service_type = NG_HCI_SERVICE_TYPE_BEST_EFFORT;
2049	pcb->iflow.token_rate = 0xffffffff; /* maximum */
2050	pcb->iflow.token_bucket_size = 0xffffffff; /* maximum */
2051	pcb->iflow.peak_bandwidth = 0x00000000; /* maximum */
2052	pcb->iflow.latency = 0xffffffff; /* don't care */
2053	pcb->iflow.delay_variation = 0xffffffff; /* don't care */
2054
2055	bcopy(&pcb->iflow, &pcb->oflow, sizeof(pcb->oflow));
2056
2057	pcb->flush_timo = NG_L2CAP_FLUSH_TIMO_DEFAULT;
2058	pcb->link_timo = NG_L2CAP_LINK_TIMO_DEFAULT;
2059
2060	/*
2061	 * XXX Mark PCB mutex as DUPOK to prevent "duplicated lock of
2062	 * the same type" message. When accepting new L2CAP connection
2063	 * ng_btsocket_l2cap_process_l2ca_con_ind() holds both PCB mutexes
2064	 * for "old" (accepting) PCB and "new" (created) PCB.
2065	 */
2066
2067	mtx_init(&pcb->pcb_mtx, "btsocks_l2cap_pcb_mtx", NULL,
2068		MTX_DEF|MTX_DUPOK);
2069	callout_init_mtx(&pcb->timo, &pcb->pcb_mtx, 0);
2070
2071        /*
2072	 * Add the PCB to the list
2073	 *
2074	 * XXX FIXME VERY IMPORTANT!
2075	 *
2076	 * This is totally FUBAR. We could get here in two cases:
2077	 *
2078	 * 1) When user calls socket()
2079	 * 2) When we need to accept new incoming connection and call
2080	 *    sonewconn()
2081	 *
2082	 * In the first case we must acquire ng_btsocket_l2cap_sockets_mtx.
2083	 * In the second case we hold ng_btsocket_l2cap_sockets_mtx already.
2084	 * So we now need to distinguish between these cases. From reading
2085	 * /sys/kern/uipc_socket.c we can find out that sonewconn() calls
2086	 * pru_attach with proto == 0 and td == NULL. For now use this fact
2087	 * to figure out if we were called from socket() or from sonewconn().
2088	 */
2089
2090	if (td != NULL)
2091		mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
2092	else
2093		mtx_assert(&ng_btsocket_l2cap_sockets_mtx, MA_OWNED);
2094
2095	/* Set PCB token. Use ng_btsocket_l2cap_sockets_mtx for protection */
2096	if (++ token == 0)
2097		token ++;
2098
2099	pcb->token = token;
2100
2101	LIST_INSERT_HEAD(&ng_btsocket_l2cap_sockets, pcb, next);
2102
2103	if (td != NULL)
2104		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
2105
2106        return (0);
2107} /* ng_btsocket_l2cap_attach */
2108
2109/*
2110 * Bind socket
2111 */
2112
2113int
2114ng_btsocket_l2cap_bind(struct socket *so, struct sockaddr *nam,
2115		struct thread *td)
2116{
2117	ng_btsocket_l2cap_pcb_t	*pcb = NULL;
2118	struct sockaddr_l2cap	*sa = (struct sockaddr_l2cap *) nam;
2119	int			 psm, error = 0;
2120
2121	if (ng_btsocket_l2cap_node == NULL)
2122		return (EINVAL);
2123
2124	/* Verify address */
2125	if (sa == NULL)
2126		return (EINVAL);
2127	if (sa->l2cap_family != AF_BLUETOOTH)
2128		return (EAFNOSUPPORT);
2129	/*For the time being, Not support LE binding.*/
2130	if ((sa->l2cap_len != sizeof(*sa))&&
2131	    (sa->l2cap_len != sizeof(struct sockaddr_l2cap_compat)))
2132		return (EINVAL);
2133
2134	psm = le16toh(sa->l2cap_psm);
2135
2136	/*
2137	 * Check if other socket has this address already (look for exact
2138	 * match PSM and bdaddr) and assign socket address if it's available.
2139	 *
2140	 * Note: socket can be bound to ANY PSM (zero) thus allowing several
2141	 * channels with the same PSM between the same pair of BD_ADDR'es.
2142	 */
2143
2144	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
2145
2146	LIST_FOREACH(pcb, &ng_btsocket_l2cap_sockets, next)
2147		if (psm != 0 && psm == pcb->psm &&
2148		    bcmp(&pcb->src, &sa->l2cap_bdaddr, sizeof(bdaddr_t)) == 0)
2149			break;
2150
2151	if (pcb == NULL) {
2152		/* Set socket address */
2153		pcb = so2l2cap_pcb(so);
2154		if (pcb != NULL) {
2155			bcopy(&sa->l2cap_bdaddr, &pcb->src, sizeof(pcb->src));
2156			pcb->psm = psm;
2157		} else
2158			error = EINVAL;
2159	} else
2160		error = EADDRINUSE;
2161
2162	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
2163
2164	return (error);
2165} /* ng_btsocket_l2cap_bind */
2166
2167/*
2168 * Connect socket
2169 */
2170
2171int
2172ng_btsocket_l2cap_connect(struct socket *so, struct sockaddr *nam,
2173		struct thread *td)
2174{
2175	ng_btsocket_l2cap_pcb_t		*pcb = so2l2cap_pcb(so);
2176	struct sockaddr_l2cap_compat	*sal = (struct sockaddr_l2cap_compat *) nam;
2177	struct sockaddr_l2cap *sa  = (struct sockaddr_l2cap *)nam;
2178	struct sockaddr_l2cap  ba;
2179	ng_btsocket_l2cap_rtentry_t	*rt = NULL;
2180	int				 have_src, error = 0;
2181	int idtype = NG_L2CAP_L2CA_IDTYPE_BREDR;
2182	/* Check socket */
2183	if (pcb == NULL)
2184		return (EINVAL);
2185	if (ng_btsocket_l2cap_node == NULL)
2186		return (EINVAL);
2187	if (pcb->state == NG_BTSOCKET_L2CAP_CONNECTING)
2188		return (EINPROGRESS);
2189
2190	/* Verify address */
2191	if (sa == NULL)
2192		return (EINVAL);
2193	if (sa->l2cap_family != AF_BLUETOOTH)
2194		return (EAFNOSUPPORT);
2195	if (sa->l2cap_len == sizeof(*sal)){
2196		bcopy(sal, &ba, sizeof(*sal));
2197		sa = &ba;
2198		sa->l2cap_len = sizeof(*sa);
2199		sa->l2cap_bdaddr_type = BDADDR_BREDR;
2200	}
2201	if (sa->l2cap_len != sizeof(*sa))
2202		return (EINVAL);
2203	if ((sa->l2cap_psm &&  sa->l2cap_cid))
2204		return EINVAL;
2205	if (bcmp(&sa->l2cap_bdaddr, NG_HCI_BDADDR_ANY, sizeof(bdaddr_t)) == 0)
2206		return (EDESTADDRREQ);
2207	if((sa->l2cap_bdaddr_type == BDADDR_BREDR)&&
2208	   (sa->l2cap_psm == 0))
2209		return EDESTADDRREQ;
2210	if(sa->l2cap_bdaddr_type != BDADDR_BREDR){
2211		if(sa->l2cap_cid == NG_L2CAP_ATT_CID){
2212			idtype = NG_L2CAP_L2CA_IDTYPE_ATT;
2213		}else if (sa->l2cap_cid == NG_L2CAP_SMP_CID){
2214			idtype =NG_L2CAP_L2CA_IDTYPE_SMP;
2215		}else{
2216			//if cid == 0 idtype = NG_L2CAP_L2CA_IDTYPE_LE;
2217			// Not supported yet
2218			return EINVAL;
2219		}
2220	}
2221	if (pcb->psm != 0 && pcb->psm != le16toh(sa->l2cap_psm))
2222		return (EINVAL);
2223	/*
2224	 * Routing. Socket should be bound to some source address. The source
2225	 * address can be ANY. Destination address must be set and it must not
2226	 * be ANY. If source address is ANY then find first rtentry that has
2227	 * src != dst.
2228	 */
2229
2230	mtx_lock(&ng_btsocket_l2cap_rt_mtx);
2231	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
2232	mtx_lock(&pcb->pcb_mtx);
2233
2234	/* Send destination address and PSM */
2235	bcopy(&sa->l2cap_bdaddr, &pcb->dst, sizeof(pcb->dst));
2236	pcb->psm = le16toh(sa->l2cap_psm);
2237	pcb->dsttype = sa->l2cap_bdaddr_type;
2238	pcb->cid = 0;
2239	pcb->idtype = idtype;
2240	pcb->rt = NULL;
2241	have_src = bcmp(&pcb->src, NG_HCI_BDADDR_ANY, sizeof(pcb->src));
2242
2243	LIST_FOREACH(rt, &ng_btsocket_l2cap_rt, next) {
2244		if (rt->hook == NULL || NG_HOOK_NOT_VALID(rt->hook))
2245			continue;
2246
2247		/* Match src and dst */
2248		if (have_src) {
2249			if (bcmp(&pcb->src, &rt->src, sizeof(rt->src)) == 0)
2250				break;
2251		} else {
2252			if (bcmp(&pcb->dst, &rt->src, sizeof(rt->src)) != 0)
2253				break;
2254		}
2255	}
2256
2257	if (rt != NULL) {
2258		pcb->rt = rt;
2259
2260		if (!have_src){
2261			bcopy(&rt->src, &pcb->src, sizeof(pcb->src));
2262			pcb->srctype =
2263			  (sa->l2cap_bdaddr_type == BDADDR_BREDR)?
2264			  BDADDR_BREDR : BDADDR_LE_PUBLIC;
2265		}
2266	} else
2267		error = EHOSTUNREACH;
2268
2269	/*
2270	 * Send L2CA_Connect request
2271	 */
2272
2273	if (error == 0) {
2274		error = ng_btsocket_l2cap_send_l2ca_con_req(pcb);
2275		if (error == 0) {
2276			pcb->flags |= NG_BTSOCKET_L2CAP_CLIENT;
2277			pcb->state = NG_BTSOCKET_L2CAP_CONNECTING;
2278			soisconnecting(pcb->so);
2279
2280			ng_btsocket_l2cap_timeout(pcb);
2281		}
2282	}
2283
2284	mtx_unlock(&pcb->pcb_mtx);
2285	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
2286	mtx_unlock(&ng_btsocket_l2cap_rt_mtx);
2287
2288	return (error);
2289} /* ng_btsocket_l2cap_connect */
2290
2291/*
2292 * Process ioctl's calls on socket
2293 */
2294
2295int
2296ng_btsocket_l2cap_control(struct socket *so, u_long cmd, caddr_t data,
2297		struct ifnet *ifp, struct thread *td)
2298{
2299	return (EINVAL);
2300} /* ng_btsocket_l2cap_control */
2301
2302/*
2303 * Process getsockopt/setsockopt system calls
2304 */
2305
2306int
2307ng_btsocket_l2cap_ctloutput(struct socket *so, struct sockopt *sopt)
2308{
2309	ng_btsocket_l2cap_pcb_p	pcb = so2l2cap_pcb(so);
2310	int			error = 0;
2311	ng_l2cap_cfg_opt_val_t	v;
2312
2313	if (pcb == NULL)
2314		return (EINVAL);
2315	if (ng_btsocket_l2cap_node == NULL)
2316		return (EINVAL);
2317
2318	if (sopt->sopt_level != SOL_L2CAP)
2319		return (0);
2320
2321	mtx_lock(&pcb->pcb_mtx);
2322
2323	switch (sopt->sopt_dir) {
2324	case SOPT_GET:
2325		switch (sopt->sopt_name) {
2326		case SO_L2CAP_IMTU: /* get incoming MTU */
2327			error = sooptcopyout(sopt, &pcb->imtu,
2328						sizeof(pcb->imtu));
2329			break;
2330
2331		case SO_L2CAP_OMTU: /* get outgoing (peer incoming) MTU */
2332			error = sooptcopyout(sopt, &pcb->omtu,
2333						sizeof(pcb->omtu));
2334			break;
2335
2336		case SO_L2CAP_IFLOW: /* get incoming flow spec. */
2337			error = sooptcopyout(sopt, &pcb->iflow,
2338						sizeof(pcb->iflow));
2339			break;
2340
2341		case SO_L2CAP_OFLOW: /* get outgoing flow spec. */
2342			error = sooptcopyout(sopt, &pcb->oflow,
2343						sizeof(pcb->oflow));
2344			break;
2345
2346		case SO_L2CAP_FLUSH: /* get flush timeout */
2347			error = sooptcopyout(sopt, &pcb->flush_timo,
2348						sizeof(pcb->flush_timo));
2349			break;
2350		case SO_L2CAP_ENCRYPTED: /* get encrypt required */
2351			error = sooptcopyout(sopt, &pcb->need_encrypt,
2352						sizeof(pcb->need_encrypt));
2353			break;
2354
2355
2356		default:
2357			error = ENOPROTOOPT;
2358			break;
2359		}
2360		break;
2361
2362	case SOPT_SET:
2363		/*
2364		 * XXX
2365		 * We do not allow to change these parameters while socket is
2366		 * connected or we are in the process of creating a connection.
2367		 * May be this should indicate re-configuration of the open
2368		 * channel?
2369		 */
2370
2371		if (pcb->state != NG_BTSOCKET_L2CAP_CLOSED) {
2372			error = EACCES;
2373			break;
2374		}
2375
2376		switch (sopt->sopt_name) {
2377		case SO_L2CAP_IMTU: /* set incoming MTU */
2378			error = sooptcopyin(sopt, &v, sizeof(v), sizeof(v.mtu));
2379			if (error == 0)
2380				pcb->imtu = v.mtu;
2381			break;
2382
2383		case SO_L2CAP_OFLOW: /* set outgoing flow spec. */
2384			error = sooptcopyin(sopt, &v, sizeof(v),sizeof(v.flow));
2385			if (error == 0)
2386				bcopy(&v.flow, &pcb->oflow, sizeof(pcb->oflow));
2387			break;
2388
2389		case SO_L2CAP_FLUSH: /* set flush timeout */
2390			error = sooptcopyin(sopt, &v, sizeof(v),
2391						sizeof(v.flush_timo));
2392			if (error == 0)
2393				pcb->flush_timo = v.flush_timo;
2394			break;
2395		case SO_L2CAP_ENCRYPTED: /*set connect encryption opt*/
2396			if((pcb->state != NG_BTSOCKET_L2CAP_OPEN) &&
2397			   (pcb->state != NG_BTSOCKET_L2CAP_W4_ENC_CHANGE)){
2398				error = sooptcopyin(sopt, &v, sizeof(v),
2399						    sizeof(v.encryption));
2400				if(error == 0)
2401					pcb->need_encrypt = (v.encryption)?1:0;
2402			}else{
2403				error = EINVAL;
2404			}
2405			break;
2406		default:
2407			error = ENOPROTOOPT;
2408			break;
2409		}
2410		break;
2411
2412	default:
2413		error = EINVAL;
2414		break;
2415	}
2416
2417	mtx_unlock(&pcb->pcb_mtx);
2418
2419	return (error);
2420} /* ng_btsocket_l2cap_ctloutput */
2421
2422/*
2423 * Detach and destroy socket
2424 */
2425
2426void
2427ng_btsocket_l2cap_detach(struct socket *so)
2428{
2429	ng_btsocket_l2cap_pcb_p	pcb = so2l2cap_pcb(so);
2430
2431	KASSERT(pcb != NULL, ("ng_btsocket_l2cap_detach: pcb == NULL"));
2432
2433	if (ng_btsocket_l2cap_node == NULL)
2434		return;
2435
2436	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
2437	mtx_lock(&pcb->pcb_mtx);
2438
2439	/* XXX what to do with pending request? */
2440	if (pcb->flags & NG_BTSOCKET_L2CAP_TIMO)
2441		ng_btsocket_l2cap_untimeout(pcb);
2442
2443	if (pcb->state != NG_BTSOCKET_L2CAP_CLOSED &&
2444	    pcb->state != NG_BTSOCKET_L2CAP_DISCONNECTING)
2445		/* Send disconnect request with "zero" token */
2446		ng_btsocket_l2cap_send_l2ca_discon_req(0, pcb);
2447
2448	pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
2449
2450	LIST_REMOVE(pcb, next);
2451
2452	mtx_unlock(&pcb->pcb_mtx);
2453	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
2454
2455	mtx_destroy(&pcb->pcb_mtx);
2456	bzero(pcb, sizeof(*pcb));
2457	free(pcb, M_NETGRAPH_BTSOCKET_L2CAP);
2458
2459	soisdisconnected(so);
2460	so->so_pcb = NULL;
2461} /* ng_btsocket_l2cap_detach */
2462
2463/*
2464 * Disconnect socket
2465 */
2466
2467int
2468ng_btsocket_l2cap_disconnect(struct socket *so)
2469{
2470	ng_btsocket_l2cap_pcb_p	pcb = so2l2cap_pcb(so);
2471	int			error = 0;
2472
2473	if (pcb == NULL)
2474		return (EINVAL);
2475	if (ng_btsocket_l2cap_node == NULL)
2476		return (EINVAL);
2477
2478	mtx_lock(&pcb->pcb_mtx);
2479
2480	if (pcb->state == NG_BTSOCKET_L2CAP_DISCONNECTING) {
2481		mtx_unlock(&pcb->pcb_mtx);
2482		return (EINPROGRESS);
2483	}
2484
2485	if (pcb->state != NG_BTSOCKET_L2CAP_CLOSED) {
2486		/* XXX FIXME what to do with pending request? */
2487		if (pcb->flags & NG_BTSOCKET_L2CAP_TIMO)
2488			ng_btsocket_l2cap_untimeout(pcb);
2489
2490		error = ng_btsocket_l2cap_send_l2ca_discon_req(pcb->token, pcb);
2491		if (error == 0) {
2492			pcb->state = NG_BTSOCKET_L2CAP_DISCONNECTING;
2493			soisdisconnecting(so);
2494
2495			ng_btsocket_l2cap_timeout(pcb);
2496		}
2497
2498		/* XXX FIXME what to do if error != 0 */
2499	}
2500
2501	mtx_unlock(&pcb->pcb_mtx);
2502
2503	return (error);
2504} /* ng_btsocket_l2cap_disconnect */
2505
2506/*
2507 * Listen on socket
2508 */
2509
2510int
2511ng_btsocket_l2cap_listen(struct socket *so, int backlog, struct thread *td)
2512{
2513	ng_btsocket_l2cap_pcb_p	pcb = so2l2cap_pcb(so);
2514	int error;
2515
2516	SOCK_LOCK(so);
2517	error = solisten_proto_check(so);
2518	if (error != 0)
2519		goto out;
2520	if (pcb == NULL) {
2521		error = EINVAL;
2522		goto out;
2523	}
2524	if (ng_btsocket_l2cap_node == NULL) {
2525		error = EINVAL;
2526		goto out;
2527	}
2528	if (pcb->psm == 0) {
2529		error = EADDRNOTAVAIL;
2530		goto out;
2531	}
2532	solisten_proto(so, backlog);
2533out:
2534	SOCK_UNLOCK(so);
2535	return (error);
2536} /* ng_btsocket_listen */
2537
2538/*
2539 * Get peer address
2540 */
2541
2542int
2543ng_btsocket_l2cap_peeraddr(struct socket *so, struct sockaddr **nam)
2544{
2545	ng_btsocket_l2cap_pcb_p	pcb = so2l2cap_pcb(so);
2546	struct sockaddr_l2cap	sa;
2547
2548	if (pcb == NULL)
2549		return (EINVAL);
2550	if (ng_btsocket_l2cap_node == NULL)
2551		return (EINVAL);
2552
2553	bcopy(&pcb->dst, &sa.l2cap_bdaddr, sizeof(sa.l2cap_bdaddr));
2554	sa.l2cap_psm = htole16(pcb->psm);
2555	sa.l2cap_len = sizeof(sa);
2556	sa.l2cap_family = AF_BLUETOOTH;
2557	switch(pcb->idtype){
2558	case NG_L2CAP_L2CA_IDTYPE_ATT:
2559		sa.l2cap_cid = NG_L2CAP_ATT_CID;
2560		break;
2561	case NG_L2CAP_L2CA_IDTYPE_SMP:
2562		sa.l2cap_cid = NG_L2CAP_SMP_CID;
2563		break;
2564	default:
2565		sa.l2cap_cid = 0;
2566		break;
2567	}
2568	sa.l2cap_bdaddr_type = pcb->dsttype;
2569	*nam = sodupsockaddr((struct sockaddr *) &sa, M_NOWAIT);
2570
2571	return ((*nam == NULL)? ENOMEM : 0);
2572} /* ng_btsocket_l2cap_peeraddr */
2573
2574/*
2575 * Send data to socket
2576 */
2577
2578int
2579ng_btsocket_l2cap_send(struct socket *so, int flags, struct mbuf *m,
2580		struct sockaddr *nam, struct mbuf *control, struct thread *td)
2581{
2582	ng_btsocket_l2cap_pcb_t	*pcb = so2l2cap_pcb(so);
2583	int			 error = 0;
2584
2585	if (ng_btsocket_l2cap_node == NULL) {
2586		error = ENETDOWN;
2587		goto drop;
2588	}
2589
2590	/* Check socket and input */
2591	if (pcb == NULL || m == NULL || control != NULL) {
2592		error = EINVAL;
2593		goto drop;
2594	}
2595
2596	mtx_lock(&pcb->pcb_mtx);
2597
2598	/* Make sure socket is connected */
2599	if (pcb->state != NG_BTSOCKET_L2CAP_OPEN) {
2600		mtx_unlock(&pcb->pcb_mtx);
2601		error = ENOTCONN;
2602		goto drop;
2603	}
2604
2605	/* Check route */
2606	if (pcb->rt == NULL ||
2607	    pcb->rt->hook == NULL || NG_HOOK_NOT_VALID(pcb->rt->hook)) {
2608		mtx_unlock(&pcb->pcb_mtx);
2609		error = ENETDOWN;
2610		goto drop;
2611	}
2612
2613	/* Check packet size against outgoing (peer's incoming) MTU) */
2614	if (m->m_pkthdr.len > pcb->omtu) {
2615		NG_BTSOCKET_L2CAP_ERR(
2616"%s: Packet too big, len=%d, omtu=%d\n", __func__, m->m_pkthdr.len, pcb->omtu);
2617
2618		mtx_unlock(&pcb->pcb_mtx);
2619		error = EMSGSIZE;
2620		goto drop;
2621	}
2622
2623	/*
2624	 * First put packet on socket send queue. Then check if we have
2625	 * pending timeout. If we do not have timeout then we must send
2626	 * packet and schedule timeout. Otherwise do nothing and wait for
2627	 * L2CA_WRITE_RSP.
2628	 */
2629
2630	sbappendrecord(&pcb->so->so_snd, m);
2631	m = NULL;
2632
2633	if (!(pcb->flags & NG_BTSOCKET_L2CAP_TIMO)) {
2634		error = ng_btsocket_l2cap_send2(pcb);
2635		if (error == 0)
2636			ng_btsocket_l2cap_timeout(pcb);
2637		else
2638			sbdroprecord(&pcb->so->so_snd); /* XXX */
2639	}
2640
2641	mtx_unlock(&pcb->pcb_mtx);
2642drop:
2643	NG_FREE_M(m); /* checks for != NULL */
2644	NG_FREE_M(control);
2645
2646	return (error);
2647} /* ng_btsocket_l2cap_send */
2648
2649/*
2650 * Send first packet in the socket queue to the L2CAP layer
2651 */
2652
2653static int
2654ng_btsocket_l2cap_send2(ng_btsocket_l2cap_pcb_p pcb)
2655{
2656	struct	mbuf		*m = NULL;
2657	ng_l2cap_l2ca_hdr_t	*hdr = NULL;
2658	int			 error = 0;
2659
2660	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
2661
2662	if (sbavail(&pcb->so->so_snd) == 0)
2663		return (EINVAL); /* XXX */
2664
2665	m = m_dup(pcb->so->so_snd.sb_mb, M_NOWAIT);
2666	if (m == NULL)
2667		return (ENOBUFS);
2668
2669	/* Create L2CA packet header */
2670	M_PREPEND(m, sizeof(*hdr), M_NOWAIT);
2671	if (m != NULL)
2672		if (m->m_len < sizeof(*hdr))
2673			m = m_pullup(m, sizeof(*hdr));
2674
2675	if (m == NULL) {
2676		NG_BTSOCKET_L2CAP_ERR(
2677"%s: Failed to create L2CA packet header\n", __func__);
2678
2679		return (ENOBUFS);
2680	}
2681
2682	hdr = mtod(m, ng_l2cap_l2ca_hdr_t *);
2683	hdr->token = pcb->token;
2684	hdr->length = m->m_pkthdr.len - sizeof(*hdr);
2685	hdr->lcid = pcb->cid;
2686	hdr->idtype = pcb->idtype;
2687	NG_BTSOCKET_L2CAP_INFO(
2688"%s: Sending packet: len=%d, length=%d, lcid=%d, token=%d, state=%d\n",
2689		__func__, m->m_pkthdr.len, hdr->length, hdr->lcid,
2690		hdr->token, pcb->state);
2691
2692	/*
2693	 * If we got here than we have successfully creates new L2CAP
2694	 * data packet and now we can send it to the L2CAP layer
2695	 */
2696
2697	NG_SEND_DATA_ONLY(error, pcb->rt->hook, m);
2698
2699	return (error);
2700} /* ng_btsocket_l2cap_send2 */
2701
2702/*
2703 * Get socket address
2704 */
2705
2706int
2707ng_btsocket_l2cap_sockaddr(struct socket *so, struct sockaddr **nam)
2708{
2709	ng_btsocket_l2cap_pcb_p	pcb = so2l2cap_pcb(so);
2710	struct sockaddr_l2cap	sa;
2711
2712	if (pcb == NULL)
2713		return (EINVAL);
2714	if (ng_btsocket_l2cap_node == NULL)
2715		return (EINVAL);
2716
2717	bcopy(&pcb->src, &sa.l2cap_bdaddr, sizeof(sa.l2cap_bdaddr));
2718	sa.l2cap_psm = htole16(pcb->psm);
2719	sa.l2cap_len = sizeof(sa);
2720	sa.l2cap_family = AF_BLUETOOTH;
2721	sa.l2cap_cid = 0;
2722	sa.l2cap_bdaddr_type = pcb->srctype;
2723
2724	*nam = sodupsockaddr((struct sockaddr *) &sa, M_NOWAIT);
2725
2726	return ((*nam == NULL)? ENOMEM : 0);
2727} /* ng_btsocket_l2cap_sockaddr */
2728
2729/*****************************************************************************
2730 *****************************************************************************
2731 **                              Misc. functions
2732 *****************************************************************************
2733 *****************************************************************************/
2734
2735/*
2736 * Look for the socket that listens on given PSM and bdaddr. Returns exact or
2737 * close match (if any). Caller must hold ng_btsocket_l2cap_sockets_mtx.
2738 */
2739
2740static ng_btsocket_l2cap_pcb_p
2741ng_btsocket_l2cap_pcb_by_addr(bdaddr_p bdaddr, int psm)
2742{
2743	ng_btsocket_l2cap_pcb_p	p = NULL, p1 = NULL;
2744
2745	mtx_assert(&ng_btsocket_l2cap_sockets_mtx, MA_OWNED);
2746
2747	LIST_FOREACH(p, &ng_btsocket_l2cap_sockets, next) {
2748		if (p->so == NULL || !(p->so->so_options & SO_ACCEPTCONN) ||
2749		    p->psm != psm)
2750			continue;
2751
2752		if (bcmp(&p->src, bdaddr, sizeof(p->src)) == 0)
2753			break;
2754
2755		if (bcmp(&p->src, NG_HCI_BDADDR_ANY, sizeof(p->src)) == 0)
2756			p1 = p;
2757	}
2758
2759	return ((p != NULL)? p : p1);
2760} /* ng_btsocket_l2cap_pcb_by_addr */
2761
2762/*
2763 * Look for the socket that has given token.
2764 * Caller must hold ng_btsocket_l2cap_sockets_mtx.
2765 */
2766
2767static ng_btsocket_l2cap_pcb_p
2768ng_btsocket_l2cap_pcb_by_token(u_int32_t token)
2769{
2770	ng_btsocket_l2cap_pcb_p	p = NULL;
2771
2772	if (token == 0)
2773		return (NULL);
2774
2775	mtx_assert(&ng_btsocket_l2cap_sockets_mtx, MA_OWNED);
2776
2777	LIST_FOREACH(p, &ng_btsocket_l2cap_sockets, next)
2778		if (p->token == token)
2779			break;
2780
2781	return (p);
2782} /* ng_btsocket_l2cap_pcb_by_token */
2783
2784/*
2785 * Look for the socket that assigned to given source address and channel ID.
2786 * Caller must hold ng_btsocket_l2cap_sockets_mtx
2787 */
2788
2789static ng_btsocket_l2cap_pcb_p
2790ng_btsocket_l2cap_pcb_by_cid(bdaddr_p src, int cid, int idtype)
2791{
2792	ng_btsocket_l2cap_pcb_p	p = NULL;
2793
2794	mtx_assert(&ng_btsocket_l2cap_sockets_mtx, MA_OWNED);
2795
2796	LIST_FOREACH(p, &ng_btsocket_l2cap_sockets, next){
2797		if (p->cid == cid &&
2798		    bcmp(src, &p->src, sizeof(p->src)) == 0&&
2799		    p->idtype == idtype)
2800			break;
2801
2802	}
2803	return (p);
2804} /* ng_btsocket_l2cap_pcb_by_cid */
2805
2806/*
2807 * Set timeout on socket
2808 */
2809
2810static void
2811ng_btsocket_l2cap_timeout(ng_btsocket_l2cap_pcb_p pcb)
2812{
2813	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
2814
2815	if (!(pcb->flags & NG_BTSOCKET_L2CAP_TIMO)) {
2816		pcb->flags |= NG_BTSOCKET_L2CAP_TIMO;
2817		callout_reset(&pcb->timo, bluetooth_l2cap_ertx_timeout(),
2818		    ng_btsocket_l2cap_process_timeout, pcb);
2819	} else
2820		KASSERT(0,
2821("%s: Duplicated socket timeout?!\n", __func__));
2822} /* ng_btsocket_l2cap_timeout */
2823
2824/*
2825 * Unset timeout on socket
2826 */
2827
2828static void
2829ng_btsocket_l2cap_untimeout(ng_btsocket_l2cap_pcb_p pcb)
2830{
2831	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
2832
2833	if (pcb->flags & NG_BTSOCKET_L2CAP_TIMO) {
2834		callout_stop(&pcb->timo);
2835		pcb->flags &= ~NG_BTSOCKET_L2CAP_TIMO;
2836	} else
2837		KASSERT(0,
2838("%s: No socket timeout?!\n", __func__));
2839} /* ng_btsocket_l2cap_untimeout */
2840
2841/*
2842 * Process timeout on socket
2843 */
2844
2845static void
2846ng_btsocket_l2cap_process_timeout(void *xpcb)
2847{
2848	ng_btsocket_l2cap_pcb_p	pcb = (ng_btsocket_l2cap_pcb_p) xpcb;
2849
2850	mtx_assert(&pcb->pcb_mtx, MA_OWNED);
2851
2852	pcb->flags &= ~NG_BTSOCKET_L2CAP_TIMO;
2853	pcb->so->so_error = ETIMEDOUT;
2854
2855	switch (pcb->state) {
2856	case NG_BTSOCKET_L2CAP_CONNECTING:
2857	case NG_BTSOCKET_L2CAP_CONFIGURING:
2858	case NG_BTSOCKET_L2CAP_W4_ENC_CHANGE:
2859		/* Send disconnect request with "zero" token */
2860		if (pcb->cid != 0)
2861			ng_btsocket_l2cap_send_l2ca_discon_req(0, pcb);
2862
2863		/* ... and close the socket */
2864		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
2865		soisdisconnected(pcb->so);
2866		break;
2867
2868	case NG_BTSOCKET_L2CAP_OPEN:
2869		/* Send timeout - drop packet and wakeup sender */
2870		sbdroprecord(&pcb->so->so_snd);
2871		sowwakeup(pcb->so);
2872		break;
2873
2874	case NG_BTSOCKET_L2CAP_DISCONNECTING:
2875		/* Disconnect timeout - disconnect the socket anyway */
2876		pcb->state = NG_BTSOCKET_L2CAP_CLOSED;
2877		soisdisconnected(pcb->so);
2878		break;
2879
2880	default:
2881		NG_BTSOCKET_L2CAP_ERR(
2882"%s: Invalid socket state=%d\n", __func__, pcb->state);
2883		break;
2884	}
2885} /* ng_btsocket_l2cap_process_timeout */
2886
2887/*
2888 * Translate HCI/L2CAP error code into "errno" code
2889 * XXX Note: Some L2CAP and HCI error codes have the same value, but
2890 *     different meaning
2891 */
2892
2893static int
2894ng_btsocket_l2cap_result2errno(int result)
2895{
2896	switch (result) {
2897	case 0x00: /* No error */
2898		return (0);
2899
2900	case 0x01: /* Unknown HCI command */
2901		return (ENODEV);
2902
2903	case 0x02: /* No connection */
2904		return (ENOTCONN);
2905
2906	case 0x03: /* Hardware failure */
2907		return (EIO);
2908
2909	case 0x04: /* Page timeout */
2910		return (EHOSTDOWN);
2911
2912	case 0x05: /* Authentication failure */
2913	case 0x06: /* Key missing */
2914	case 0x18: /* Pairing not allowed */
2915	case 0x21: /* Role change not allowed */
2916	case 0x24: /* LMP PSU not allowed */
2917	case 0x25: /* Encryption mode not acceptable */
2918	case 0x26: /* Unit key used */
2919		return (EACCES);
2920
2921	case 0x07: /* Memory full */
2922		return (ENOMEM);
2923
2924	case 0x08:   /* Connection timeout */
2925	case 0x10:   /* Host timeout */
2926	case 0x22:   /* LMP response timeout */
2927	case 0xee:   /* HCI timeout */
2928	case 0xeeee: /* L2CAP timeout */
2929		return (ETIMEDOUT);
2930
2931	case 0x09: /* Max number of connections */
2932	case 0x0a: /* Max number of SCO connections to a unit */
2933		return (EMLINK);
2934
2935	case 0x0b: /* ACL connection already exists */
2936		return (EEXIST);
2937
2938	case 0x0c: /* Command disallowed */
2939		return (EBUSY);
2940
2941	case 0x0d: /* Host rejected due to limited resources */
2942	case 0x0e: /* Host rejected due to securiity reasons */
2943	case 0x0f: /* Host rejected due to remote unit is a personal unit */
2944	case 0x1b: /* SCO offset rejected */
2945	case 0x1c: /* SCO interval rejected */
2946	case 0x1d: /* SCO air mode rejected */
2947		return (ECONNREFUSED);
2948
2949	case 0x11: /* Unsupported feature or parameter value */
2950	case 0x19: /* Unknown LMP PDU */
2951	case 0x1a: /* Unsupported remote feature */
2952	case 0x20: /* Unsupported LMP parameter value */
2953	case 0x27: /* QoS is not supported */
2954	case 0x29: /* Paring with unit key not supported */
2955		return (EOPNOTSUPP);
2956
2957	case 0x12: /* Invalid HCI command parameter */
2958	case 0x1e: /* Invalid LMP parameters */
2959		return (EINVAL);
2960
2961	case 0x13: /* Other end terminated connection: User ended connection */
2962	case 0x14: /* Other end terminated connection: Low resources */
2963	case 0x15: /* Other end terminated connection: About to power off */
2964		return (ECONNRESET);
2965
2966	case 0x16: /* Connection terminated by local host */
2967		return (ECONNABORTED);
2968
2969#if 0 /* XXX not yet */
2970	case 0x17: /* Repeated attempts */
2971	case 0x1f: /* Unspecified error */
2972	case 0x23: /* LMP error transaction collision */
2973	case 0x28: /* Instant passed */
2974#endif
2975	}
2976
2977	return (ENOSYS);
2978} /* ng_btsocket_l2cap_result2errno */
2979
2980