projects/linux·blob master · refs

2426 lines · 53.8 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
4 Copyright (C) 2002 Maxim Krasnyansky <[email protected]>
5 Copyright (C) 2002 Marcel Holtmann <[email protected]>
6
7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15
16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
18 SOFTWARE IS DISCLAIMED.
19*/
20
21/*
22 * Bluetooth RFCOMM core.
23 */
24
25#include <linux/module.h>
26#include <linux/debugfs.h>
27#include <linux/kthread.h>
28#include <linux/unaligned.h>
29
30#include <net/bluetooth/bluetooth.h>
31#include <net/bluetooth/hci_core.h>
32#include <net/bluetooth/l2cap.h>
33#include <net/bluetooth/rfcomm.h>
34
35#include <trace/events/sock.h>
36
37#define VERSION "1.11"
38
39static bool disable_cfc;
40static bool l2cap_ertm;
41static int channel_mtu = -1;
42
43static struct task_struct *rfcomm_thread;
44
45static DEFINE_MUTEX(rfcomm_mutex);
46#define rfcomm_lock() mutex_lock(&rfcomm_mutex)
47#define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
48
49
50static LIST_HEAD(session_list);
51
52static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
53static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
54static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
55static int rfcomm_queue_disc(struct rfcomm_dlc *d);
56static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
57static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
58static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
59static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
60static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
61static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
62
63static void rfcomm_process_connect(struct rfcomm_session *s);
64
65static struct socket *rfcomm_session_connect(bdaddr_t *src, bdaddr_t *dst,
66 u8 sec_level, int *err);
67static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state);
68static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
69static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
70
71/* ---- RFCOMM frame parsing macros ---- */
72#define __get_dlci(b) ((b & 0xfc) >> 2)
73#define __get_type(b) ((b & 0xef))
74
75#define __test_ea(b) ((b & 0x01))
76#define __test_cr(b) (!!(b & 0x02))
77#define __test_pf(b) (!!(b & 0x10))
78
79#define __session_dir(s) ((s)->initiator ? 0x00 : 0x01)
80
81#define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
82#define __ctrl(type, pf) (((type & 0xef) | (pf << 4)))
83#define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir)
84#define __srv_channel(dlci) (dlci >> 1)
85
86#define __len8(len) (((len) << 1) | 1)
87#define __len16(len) ((len) << 1)
88
89/* MCC macros */
90#define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01))
91#define __get_mcc_type(b) ((b & 0xfc) >> 2)
92#define __get_mcc_len(b) ((b & 0xfe) >> 1)
93
94/* RPN macros */
95#define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
96#define __get_rpn_data_bits(line) ((line) & 0x3)
97#define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
98#define __get_rpn_parity(line) (((line) >> 3) & 0x7)
99
100static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
101
102static void rfcomm_schedule(void)
103{
104 wake_up_all(&rfcomm_wq);
105}
106
107/* ---- RFCOMM FCS computation ---- */
108
109/* reversed, 8-bit, poly=0x07 */
110static unsigned char rfcomm_crc_table[256] = {
111 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
112 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
113 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
114 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
115
116 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
117 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
118 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
119 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
120
121 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
122 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
123 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
124 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
125
126 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
127 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
128 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
129 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
130
131 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
132 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
133 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
134 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
135
136 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
137 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
138 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
139 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
140
141 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
142 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
143 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
144 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
145
146 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
147 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
148 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
149 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
150};
151
152/* CRC on 2 bytes */
153#define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
154
155/* FCS on 2 bytes */
156static inline u8 __fcs(u8 *data)
157{
158 return 0xff - __crc(data);
159}
160
161/* FCS on 3 bytes */
162static inline u8 __fcs2(u8 *data)
163{
164 return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
165}
166
167/* Check FCS */
168static inline int __check_fcs(u8 *data, int type, u8 fcs)
169{
170 u8 f = __crc(data);
171
172 if (type != RFCOMM_UIH)
173 f = rfcomm_crc_table[f ^ data[2]];
174
175 return rfcomm_crc_table[f ^ fcs] != 0xcf;
176}
177
178/* ---- L2CAP callbacks ---- */
179static void rfcomm_l2state_change(struct sock *sk)
180{
181 BT_DBG("%p state %d", sk, sk->sk_state);
182 rfcomm_schedule();
183}
184
185static void rfcomm_l2data_ready(struct sock *sk)
186{
187 trace_sk_data_ready(sk);
188
189 BT_DBG("%p", sk);
190 rfcomm_schedule();
191}
192
193static int rfcomm_l2sock_create(struct socket **sock)
194{
195 int err;
196
197 BT_DBG("");
198
199 err = sock_create_kern(&init_net, PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
200 if (!err) {
201 struct sock *sk = (*sock)->sk;
202 sk->sk_data_ready = rfcomm_l2data_ready;
203 sk->sk_state_change = rfcomm_l2state_change;
204 }
205 return err;
206}
207
208static int rfcomm_check_security(struct rfcomm_dlc *d)
209{
210 struct sock *sk = d->session->sock->sk;
211 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
212
213 __u8 auth_type;
214
215 switch (d->sec_level) {
216 case BT_SECURITY_HIGH:
217 case BT_SECURITY_FIPS:
218 auth_type = HCI_AT_GENERAL_BONDING_MITM;
219 break;
220 case BT_SECURITY_MEDIUM:
221 auth_type = HCI_AT_GENERAL_BONDING;
222 break;
223 default:
224 auth_type = HCI_AT_NO_BONDING;
225 break;
226 }
227
228 return hci_conn_security(conn->hcon, d->sec_level, auth_type,
229 d->out);
230}
231
232static void rfcomm_session_timeout(struct timer_list *t)
233{
234 struct rfcomm_session *s = timer_container_of(s, t, timer);
235
236 BT_DBG("session %p state %ld", s, s->state);
237
238 set_bit(RFCOMM_TIMED_OUT, &s->flags);
239 rfcomm_schedule();
240}
241
242static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
243{
244 BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
245
246 mod_timer(&s->timer, jiffies + timeout);
247}
248
249static void rfcomm_session_clear_timer(struct rfcomm_session *s)
250{
251 BT_DBG("session %p state %ld", s, s->state);
252
253 timer_delete_sync(&s->timer);
254}
255
256/* ---- RFCOMM DLCs ---- */
257static void rfcomm_dlc_timeout(struct timer_list *t)
258{
259 struct rfcomm_dlc *d = timer_container_of(d, t, timer);
260
261 BT_DBG("dlc %p state %ld", d, d->state);
262
263 set_bit(RFCOMM_TIMED_OUT, &d->flags);
264 rfcomm_dlc_put(d);
265 rfcomm_schedule();
266}
267
268static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
269{
270 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
271
272 if (!mod_timer(&d->timer, jiffies + timeout))
273 rfcomm_dlc_hold(d);
274}
275
276static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
277{
278 BT_DBG("dlc %p state %ld", d, d->state);
279
280 if (timer_delete(&d->timer))
281 rfcomm_dlc_put(d);
282}
283
284static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
285{
286 BT_DBG("%p", d);
287
288 d->state = BT_OPEN;
289 d->flags = 0;
290 d->mscex = 0;
291 d->sec_level = BT_SECURITY_LOW;
292 d->mtu = RFCOMM_DEFAULT_MTU;
293 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
294
295 d->cfc = RFCOMM_CFC_DISABLED;
296 d->rx_credits = RFCOMM_DEFAULT_CREDITS;
297}
298
299struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
300{
301 struct rfcomm_dlc *d = kzalloc_obj(*d, prio);
302
303 if (!d)
304 return NULL;
305
306 timer_setup(&d->timer, rfcomm_dlc_timeout, 0);
307
308 skb_queue_head_init(&d->tx_queue);
309 mutex_init(&d->lock);
310 refcount_set(&d->refcnt, 1);
311
312 rfcomm_dlc_clear_state(d);
313
314 BT_DBG("%p", d);
315
316 return d;
317}
318
319void rfcomm_dlc_free(struct rfcomm_dlc *d)
320{
321 BT_DBG("%p", d);
322
323 skb_queue_purge(&d->tx_queue);
324 kfree(d);
325}
326
327static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
328{
329 BT_DBG("dlc %p session %p", d, s);
330
331 rfcomm_session_clear_timer(s);
332 rfcomm_dlc_hold(d);
333 list_add(&d->list, &s->dlcs);
334 d->session = s;
335}
336
337static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
338{
339 struct rfcomm_session *s = d->session;
340
341 BT_DBG("dlc %p refcnt %d session %p", d, refcount_read(&d->refcnt), s);
342
343 list_del(&d->list);
344 d->session = NULL;
345 rfcomm_dlc_put(d);
346
347 if (list_empty(&s->dlcs))
348 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
349}
350
351static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
352{
353 struct rfcomm_dlc *d;
354
355 list_for_each_entry(d, &s->dlcs, list)
356 if (d->dlci == dlci)
357 return d;
358
359 return NULL;
360}
361
362static int rfcomm_check_channel(u8 channel)
363{
364 return channel < 1 || channel > 30;
365}
366
367static int __rfcomm_dlc_open(struct rfcomm_dlc *d, struct rfcomm_session *s,
368 u8 channel)
369{
370 u8 dlci;
371
372 BT_DBG("dlc %p state %ld session %p channel %d",
373 d, d->state, s, channel);
374
375 if (d->state != BT_OPEN && d->state != BT_CLOSED)
376 return 0;
377
378 dlci = __dlci(__session_dir(s), channel);
379
380 /* Check if DLCI already exists */
381 if (rfcomm_dlc_get(s, dlci))
382 return -EBUSY;
383
384 rfcomm_dlc_clear_state(d);
385
386 d->dlci = dlci;
387 d->addr = __addr(s->initiator, dlci);
388 d->priority = 7;
389
390 d->state = BT_CONFIG;
391 rfcomm_dlc_link(s, d);
392
393 d->out = 1;
394
395 d->mtu = s->mtu;
396 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
397
398 if (s->state == BT_CONNECTED) {
399 if (rfcomm_check_security(d))
400 rfcomm_send_pn(s, 1, d);
401 else
402 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
403 }
404
405 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
406
407 return 0;
408}
409
410int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
411{
412 struct rfcomm_session *s;
413 struct socket *sock;
414 int err;
415
416 BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
417 d, d->state, src, dst, channel);
418
419 if (rfcomm_check_channel(channel))
420 return -EINVAL;
421
422 rfcomm_lock();
423
424 clear_bit(RFCOMM_CLOSED, &d->flags);
425
426 /* Do not page the remote device for a DLC that cannot be opened
427 * anyway. __rfcomm_dlc_open() looks at the state again once the
428 * lock has been re-acquired below.
429 */
430 if (d->state != BT_OPEN && d->state != BT_CLOSED) {
431 rfcomm_unlock();
432 return 0;
433 }
434
435 s = rfcomm_session_get(src, dst);
436 if (s) {
437 err = __rfcomm_dlc_open(d, s, channel);
438 rfcomm_unlock();
439 return err;
440 }
441 rfcomm_unlock();
442
443 /* There is no session for this pair yet. kernel_connect() ends up in
444 * l2cap_chan_connect(), which takes hdev->lock, and the HCI event
445 * path takes rfcomm_mutex while holding hdev->lock, so the socket has
446 * to be connected with rfcomm_mutex released.
447 */
448 sock = rfcomm_session_connect(src, dst, d->sec_level, &err);
449 if (!sock)
450 return err;
451
452 rfcomm_lock();
453
454 /* The DLC may have been closed while the socket was connecting. It
455 * was not on a session, so rfcomm_dlc_close() could only mark it;
456 * attaching it now would leave it with no owner.
457 */
458 if (test_bit(RFCOMM_CLOSED, &d->flags)) {
459 rfcomm_unlock();
460 sock_release(sock);
461 return -ECONNRESET;
462 }
463
464 /* Another opener may have added a session for the same pair in the
465 * meantime; that one is used and this socket is dropped.
466 */
467 s = rfcomm_session_get(src, dst);
468 if (!s) {
469 s = rfcomm_session_add(sock, BT_BOUND);
470 if (s) {
471 s->initiator = 1;
472 sock = NULL;
473 }
474 }
475
476 err = s ? __rfcomm_dlc_open(d, s, channel) : -ENOMEM;
477
478 rfcomm_unlock();
479
480 if (sock)
481 sock_release(sock);
482
483 /* Over an existing ACL link the connection can complete before the
484 * session reaches the list, and that wakeup is then lost, so let
485 * krfcommd look at the socket state now.
486 */
487 rfcomm_schedule();
488
489 return err;
490}
491
492static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
493{
494 struct rfcomm_session *s = d->session;
495
496 d->state = BT_DISCONN;
497 if (skb_queue_empty(&d->tx_queue)) {
498 rfcomm_send_disc(s, d->dlci);
499 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
500 } else {
501 rfcomm_queue_disc(d);
502 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
503 }
504}
505
506static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
507{
508 struct rfcomm_session *s = d->session;
509 if (!s)
510 return 0;
511
512 BT_DBG("dlc %p state %ld dlci %d err %d session %p",
513 d, d->state, d->dlci, err, s);
514
515 switch (d->state) {
516 case BT_CONNECT:
517 case BT_CONFIG:
518 case BT_OPEN:
519 case BT_CONNECT2:
520 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
521 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
522 rfcomm_schedule();
523 return 0;
524 }
525 }
526
527 switch (d->state) {
528 case BT_CONNECT:
529 case BT_CONNECTED:
530 __rfcomm_dlc_disconn(d);
531 break;
532
533 case BT_CONFIG:
534 if (s->state != BT_BOUND) {
535 __rfcomm_dlc_disconn(d);
536 break;
537 }
538 /* if closing a dlc in a session that hasn't been started,
539 * just close and unlink the dlc
540 */
541 fallthrough;
542
543 default:
544 rfcomm_dlc_clear_timer(d);
545
546 rfcomm_dlc_lock(d);
547 d->state = BT_CLOSED;
548 d->state_change(d, err);
549 rfcomm_dlc_unlock(d);
550
551 skb_queue_purge(&d->tx_queue);
552 rfcomm_dlc_unlink(d);
553 }
554
555 return 0;
556}
557
558int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
559{
560 int r = 0;
561 struct rfcomm_dlc *d_list;
562 struct rfcomm_session *s, *s_list;
563
564 BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
565
566 rfcomm_lock();
567
568 s = d->session;
569 if (!s) {
570 /* Not on a session yet: rfcomm_dlc_open() may be connecting a
571 * socket for it with rfcomm_mutex released. Leave a mark so
572 * that it does not attach the DLC once it holds the lock again.
573 */
574 set_bit(RFCOMM_CLOSED, &d->flags);
575 goto no_session;
576 }
577
578 /* after waiting on the mutex check the session still exists
579 * then check the dlc still exists
580 */
581 list_for_each_entry(s_list, &session_list, list) {
582 if (s_list == s) {
583 list_for_each_entry(d_list, &s->dlcs, list) {
584 if (d_list == d) {
585 r = __rfcomm_dlc_close(d, err);
586 break;
587 }
588 }
589 break;
590 }
591 }
592
593no_session:
594 rfcomm_unlock();
595 return r;
596}
597
598struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
599{
600 struct rfcomm_session *s;
601 struct rfcomm_dlc *dlc = NULL;
602 u8 dlci;
603
604 if (rfcomm_check_channel(channel))
605 return ERR_PTR(-EINVAL);
606
607 rfcomm_lock();
608 s = rfcomm_session_get(src, dst);
609 if (s) {
610 dlci = __dlci(__session_dir(s), channel);
611 dlc = rfcomm_dlc_get(s, dlci);
612 }
613 rfcomm_unlock();
614 return dlc;
615}
616
617static int rfcomm_dlc_send_frag(struct rfcomm_dlc *d, struct sk_buff *frag)
618{
619 int len = frag->len;
620
621 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
622
623 if (len > d->mtu)
624 return -EINVAL;
625
626 rfcomm_make_uih(frag, d->addr);
627 __skb_queue_tail(&d->tx_queue, frag);
628
629 return len;
630}
631
632int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
633{
634 unsigned long flags;
635 struct sk_buff *frag, *next;
636 int len;
637
638 if (d->state != BT_CONNECTED)
639 return -ENOTCONN;
640
641 frag = skb_shinfo(skb)->frag_list;
642 skb_shinfo(skb)->frag_list = NULL;
643
644 /* Queue all fragments atomically. */
645 spin_lock_irqsave(&d->tx_queue.lock, flags);
646
647 len = rfcomm_dlc_send_frag(d, skb);
648 if (len < 0 || !frag)
649 goto unlock;
650
651 for (; frag; frag = next) {
652 int ret;
653
654 next = frag->next;
655
656 ret = rfcomm_dlc_send_frag(d, frag);
657 if (ret < 0) {
658 dev_kfree_skb_irq(frag);
659 goto unlock;
660 }
661
662 len += ret;
663 }
664
665unlock:
666 spin_unlock_irqrestore(&d->tx_queue.lock, flags);
667
668 if (len > 0 && !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
669 rfcomm_schedule();
670 return len;
671}
672
673void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
674{
675 int len = skb->len;
676
677 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
678
679 rfcomm_make_uih(skb, d->addr);
680 skb_queue_tail(&d->tx_queue, skb);
681
682 if (d->state == BT_CONNECTED &&
683 !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
684 rfcomm_schedule();
685}
686
687void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
688{
689 BT_DBG("dlc %p state %ld", d, d->state);
690
691 if (!d->cfc) {
692 d->v24_sig |= RFCOMM_V24_FC;
693 set_bit(RFCOMM_MSC_PENDING, &d->flags);
694 }
695 rfcomm_schedule();
696}
697
698void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
699{
700 BT_DBG("dlc %p state %ld", d, d->state);
701
702 if (!d->cfc) {
703 d->v24_sig &= ~RFCOMM_V24_FC;
704 set_bit(RFCOMM_MSC_PENDING, &d->flags);
705 }
706 rfcomm_schedule();
707}
708
709/*
710 Set/get modem status functions use _local_ status i.e. what we report
711 to the other side.
712 Remote status is provided by dlc->modem_status() callback.
713 */
714int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
715{
716 BT_DBG("dlc %p state %ld v24_sig 0x%x",
717 d, d->state, v24_sig);
718
719 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
720 v24_sig |= RFCOMM_V24_FC;
721 else
722 v24_sig &= ~RFCOMM_V24_FC;
723
724 d->v24_sig = v24_sig;
725
726 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
727 rfcomm_schedule();
728
729 return 0;
730}
731
732int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
733{
734 BT_DBG("dlc %p state %ld v24_sig 0x%x",
735 d, d->state, d->v24_sig);
736
737 *v24_sig = d->v24_sig;
738 return 0;
739}
740
741/* ---- RFCOMM sessions ---- */
742static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
743{
744 struct rfcomm_session *s = kzalloc_obj(*s);
745
746 if (!s)
747 return NULL;
748
749 BT_DBG("session %p sock %p", s, sock);
750
751 timer_setup(&s->timer, rfcomm_session_timeout, 0);
752
753 INIT_LIST_HEAD(&s->dlcs);
754 s->state = state;
755 s->sock = sock;
756
757 s->mtu = RFCOMM_DEFAULT_MTU;
758 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
759
760 /* Do not increment module usage count for listening sessions.
761 * Otherwise we won't be able to unload the module. */
762 if (state != BT_LISTEN)
763 if (!try_module_get(THIS_MODULE)) {
764 kfree(s);
765 return NULL;
766 }
767
768 list_add(&s->list, &session_list);
769
770 return s;
771}
772
773static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
774{
775 int state = s->state;
776
777 BT_DBG("session %p state %ld", s, s->state);
778
779 list_del(&s->list);
780
781 rfcomm_session_clear_timer(s);
782 sock_release(s->sock);
783 kfree(s);
784
785 if (state != BT_LISTEN)
786 module_put(THIS_MODULE);
787
788 return NULL;
789}
790
791static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
792{
793 struct rfcomm_session *s, *n;
794 struct l2cap_chan *chan;
795 list_for_each_entry_safe(s, n, &session_list, list) {
796 chan = l2cap_pi(s->sock->sk)->chan;
797
798 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
799 !bacmp(&chan->dst, dst))
800 return s;
801 }
802 return NULL;
803}
804
805static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
806 int err)
807{
808 struct rfcomm_dlc *d, *n;
809
810 s->state = BT_CLOSED;
811
812 BT_DBG("session %p state %ld err %d", s, s->state, err);
813
814 /* Close all dlcs */
815 list_for_each_entry_safe(d, n, &s->dlcs, list) {
816 d->state = BT_CLOSED;
817 __rfcomm_dlc_close(d, err);
818 }
819
820 rfcomm_session_clear_timer(s);
821 return rfcomm_session_del(s);
822}
823
824/* Creates the L2CAP socket a new session will run on and starts connecting
825 * it. Must be called with rfcomm_mutex released.
826 */
827static struct socket *rfcomm_session_connect(bdaddr_t *src, bdaddr_t *dst,
828 u8 sec_level, int *err)
829{
830 struct sockaddr_l2 addr;
831 struct socket *sock;
832 struct sock *sk;
833
834 BT_DBG("%pMR -> %pMR", src, dst);
835
836 *err = rfcomm_l2sock_create(&sock);
837 if (*err < 0)
838 return NULL;
839
840 bacpy(&addr.l2_bdaddr, src);
841 addr.l2_family = AF_BLUETOOTH;
842 addr.l2_psm = 0;
843 addr.l2_cid = 0;
844 addr.l2_bdaddr_type = BDADDR_BREDR;
845 *err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr));
846 if (*err < 0)
847 goto failed;
848
849 /* Set L2CAP options */
850 sk = sock->sk;
851 lock_sock(sk);
852 /* Set MTU to 0 so L2CAP can auto select the MTU */
853 l2cap_pi(sk)->chan->imtu = 0;
854 l2cap_pi(sk)->chan->sec_level = sec_level;
855 if (l2cap_ertm)
856 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
857 release_sock(sk);
858
859 bacpy(&addr.l2_bdaddr, dst);
860 addr.l2_family = AF_BLUETOOTH;
861 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM);
862 addr.l2_cid = 0;
863 addr.l2_bdaddr_type = BDADDR_BREDR;
864 *err = kernel_connect(sock, (struct sockaddr_unsized *)&addr, sizeof(addr), O_NONBLOCK);
865 if (*err && *err != -EINPROGRESS)
866 goto failed;
867
868 return sock;
869
870failed:
871 sock_release(sock);
872 return NULL;
873}
874
875void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
876{
877 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
878 if (src)
879 bacpy(src, &chan->src);
880 if (dst)
881 bacpy(dst, &chan->dst);
882}
883
884/* ---- RFCOMM frame sending ---- */
885static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
886{
887 struct kvec iv = { data, len };
888 struct msghdr msg;
889
890 BT_DBG("session %p len %d", s, len);
891
892 memset(&msg, 0, sizeof(msg));
893
894 return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
895}
896
897static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
898{
899 BT_DBG("%p cmd %u", s, cmd->ctrl);
900
901 return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
902}
903
904static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
905{
906 struct rfcomm_cmd cmd;
907
908 BT_DBG("%p dlci %d", s, dlci);
909
910 cmd.addr = __addr(s->initiator, dlci);
911 cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
912 cmd.len = __len8(0);
913 cmd.fcs = __fcs2((u8 *) &cmd);
914
915 return rfcomm_send_cmd(s, &cmd);
916}
917
918static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
919{
920 struct rfcomm_cmd cmd;
921
922 BT_DBG("%p dlci %d", s, dlci);
923
924 cmd.addr = __addr(!s->initiator, dlci);
925 cmd.ctrl = __ctrl(RFCOMM_UA, 1);
926 cmd.len = __len8(0);
927 cmd.fcs = __fcs2((u8 *) &cmd);
928
929 return rfcomm_send_cmd(s, &cmd);
930}
931
932static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
933{
934 struct rfcomm_cmd cmd;
935
936 BT_DBG("%p dlci %d", s, dlci);
937
938 cmd.addr = __addr(s->initiator, dlci);
939 cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
940 cmd.len = __len8(0);
941 cmd.fcs = __fcs2((u8 *) &cmd);
942
943 return rfcomm_send_cmd(s, &cmd);
944}
945
946static int rfcomm_queue_disc(struct rfcomm_dlc *d)
947{
948 struct rfcomm_cmd *cmd;
949 struct sk_buff *skb;
950
951 BT_DBG("dlc %p dlci %d", d, d->dlci);
952
953 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
954 if (!skb)
955 return -ENOMEM;
956
957 cmd = __skb_put(skb, sizeof(*cmd));
958 cmd->addr = d->addr;
959 cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
960 cmd->len = __len8(0);
961 cmd->fcs = __fcs2((u8 *) cmd);
962
963 skb_queue_tail(&d->tx_queue, skb);
964 rfcomm_schedule();
965 return 0;
966}
967
968static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
969{
970 struct rfcomm_cmd cmd;
971
972 BT_DBG("%p dlci %d", s, dlci);
973
974 cmd.addr = __addr(!s->initiator, dlci);
975 cmd.ctrl = __ctrl(RFCOMM_DM, 1);
976 cmd.len = __len8(0);
977 cmd.fcs = __fcs2((u8 *) &cmd);
978
979 return rfcomm_send_cmd(s, &cmd);
980}
981
982static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
983{
984 struct rfcomm_hdr *hdr;
985 struct rfcomm_mcc *mcc;
986 u8 buf[16], *ptr = buf;
987
988 BT_DBG("%p cr %d type %d", s, cr, type);
989
990 hdr = (void *) ptr; ptr += sizeof(*hdr);
991 hdr->addr = __addr(s->initiator, 0);
992 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
993 hdr->len = __len8(sizeof(*mcc) + 1);
994
995 mcc = (void *) ptr; ptr += sizeof(*mcc);
996 mcc->type = __mcc_type(0, RFCOMM_NSC);
997 mcc->len = __len8(1);
998
999 /* Type that we didn't like */
1000 *ptr = __mcc_type(cr, type); ptr++;
1001
1002 *ptr = __fcs(buf); ptr++;
1003
1004 return rfcomm_send_frame(s, buf, ptr - buf);
1005}
1006
1007static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
1008{
1009 struct rfcomm_hdr *hdr;
1010 struct rfcomm_mcc *mcc;
1011 struct rfcomm_pn *pn;
1012 u8 buf[16], *ptr = buf;
1013
1014 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
1015
1016 hdr = (void *) ptr; ptr += sizeof(*hdr);
1017 hdr->addr = __addr(s->initiator, 0);
1018 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1019 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn));
1020
1021 mcc = (void *) ptr; ptr += sizeof(*mcc);
1022 mcc->type = __mcc_type(cr, RFCOMM_PN);
1023 mcc->len = __len8(sizeof(*pn));
1024
1025 pn = (void *) ptr; ptr += sizeof(*pn);
1026 pn->dlci = d->dlci;
1027 pn->priority = d->priority;
1028 pn->ack_timer = 0;
1029 pn->max_retrans = 0;
1030
1031 if (s->cfc) {
1032 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
1033 pn->credits = RFCOMM_DEFAULT_CREDITS;
1034 } else {
1035 pn->flow_ctrl = 0;
1036 pn->credits = 0;
1037 }
1038
1039 if (cr && channel_mtu >= 0)
1040 pn->mtu = cpu_to_le16(channel_mtu);
1041 else
1042 pn->mtu = cpu_to_le16(d->mtu);
1043
1044 *ptr = __fcs(buf); ptr++;
1045
1046 return rfcomm_send_frame(s, buf, ptr - buf);
1047}
1048
1049int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
1050 u8 bit_rate, u8 data_bits, u8 stop_bits,
1051 u8 parity, u8 flow_ctrl_settings,
1052 u8 xon_char, u8 xoff_char, u16 param_mask)
1053{
1054 struct rfcomm_hdr *hdr;
1055 struct rfcomm_mcc *mcc;
1056 struct rfcomm_rpn *rpn;
1057 u8 buf[16], *ptr = buf;
1058
1059 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
1060 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
1061 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
1062 flow_ctrl_settings, xon_char, xoff_char, param_mask);
1063
1064 hdr = (void *) ptr; ptr += sizeof(*hdr);
1065 hdr->addr = __addr(s->initiator, 0);
1066 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1067 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn));
1068
1069 mcc = (void *) ptr; ptr += sizeof(*mcc);
1070 mcc->type = __mcc_type(cr, RFCOMM_RPN);
1071 mcc->len = __len8(sizeof(*rpn));
1072
1073 rpn = (void *) ptr; ptr += sizeof(*rpn);
1074 rpn->dlci = __addr(1, dlci);
1075 rpn->bit_rate = bit_rate;
1076 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
1077 rpn->flow_ctrl = flow_ctrl_settings;
1078 rpn->xon_char = xon_char;
1079 rpn->xoff_char = xoff_char;
1080 rpn->param_mask = cpu_to_le16(param_mask);
1081
1082 *ptr = __fcs(buf); ptr++;
1083
1084 return rfcomm_send_frame(s, buf, ptr - buf);
1085}
1086
1087int rfcomm_dlc_send_rpn(struct rfcomm_dlc *d, u8 bit_rate, u8 data_bits,
1088 u8 stop_bits, u8 parity, u8 flow_ctrl_settings,
1089 u8 xon_char, u8 xoff_char, u16 param_mask)
1090{
1091 int err = -ENOTCONN;
1092
1093 rfcomm_lock();
1094 if (d->session)
1095 err = rfcomm_send_rpn(d->session, 1, d->dlci, bit_rate,
1096 data_bits, stop_bits, parity,
1097 flow_ctrl_settings, xon_char, xoff_char,
1098 param_mask);
1099 rfcomm_unlock();
1100
1101 return err;
1102}
1103
1104static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
1105{
1106 struct rfcomm_hdr *hdr;
1107 struct rfcomm_mcc *mcc;
1108 struct rfcomm_rls *rls;
1109 u8 buf[16], *ptr = buf;
1110
1111 BT_DBG("%p cr %d status 0x%x", s, cr, status);
1112
1113 hdr = (void *) ptr; ptr += sizeof(*hdr);
1114 hdr->addr = __addr(s->initiator, 0);
1115 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1116 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls));
1117
1118 mcc = (void *) ptr; ptr += sizeof(*mcc);
1119 mcc->type = __mcc_type(cr, RFCOMM_RLS);
1120 mcc->len = __len8(sizeof(*rls));
1121
1122 rls = (void *) ptr; ptr += sizeof(*rls);
1123 rls->dlci = __addr(1, dlci);
1124 rls->status = status;
1125
1126 *ptr = __fcs(buf); ptr++;
1127
1128 return rfcomm_send_frame(s, buf, ptr - buf);
1129}
1130
1131static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1132{
1133 struct rfcomm_hdr *hdr;
1134 struct rfcomm_mcc *mcc;
1135 struct rfcomm_msc *msc;
1136 u8 buf[16], *ptr = buf;
1137
1138 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1139
1140 hdr = (void *) ptr; ptr += sizeof(*hdr);
1141 hdr->addr = __addr(s->initiator, 0);
1142 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1143 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc));
1144
1145 mcc = (void *) ptr; ptr += sizeof(*mcc);
1146 mcc->type = __mcc_type(cr, RFCOMM_MSC);
1147 mcc->len = __len8(sizeof(*msc));
1148
1149 msc = (void *) ptr; ptr += sizeof(*msc);
1150 msc->dlci = __addr(1, dlci);
1151 msc->v24_sig = v24_sig | 0x01;
1152
1153 *ptr = __fcs(buf); ptr++;
1154
1155 return rfcomm_send_frame(s, buf, ptr - buf);
1156}
1157
1158static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1159{
1160 struct rfcomm_hdr *hdr;
1161 struct rfcomm_mcc *mcc;
1162 u8 buf[16], *ptr = buf;
1163
1164 BT_DBG("%p cr %d", s, cr);
1165
1166 hdr = (void *) ptr; ptr += sizeof(*hdr);
1167 hdr->addr = __addr(s->initiator, 0);
1168 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1169 hdr->len = __len8(sizeof(*mcc));
1170
1171 mcc = (void *) ptr; ptr += sizeof(*mcc);
1172 mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1173 mcc->len = __len8(0);
1174
1175 *ptr = __fcs(buf); ptr++;
1176
1177 return rfcomm_send_frame(s, buf, ptr - buf);
1178}
1179
1180static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1181{
1182 struct rfcomm_hdr *hdr;
1183 struct rfcomm_mcc *mcc;
1184 u8 buf[16], *ptr = buf;
1185
1186 BT_DBG("%p cr %d", s, cr);
1187
1188 hdr = (void *) ptr; ptr += sizeof(*hdr);
1189 hdr->addr = __addr(s->initiator, 0);
1190 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1191 hdr->len = __len8(sizeof(*mcc));
1192
1193 mcc = (void *) ptr; ptr += sizeof(*mcc);
1194 mcc->type = __mcc_type(cr, RFCOMM_FCON);
1195 mcc->len = __len8(0);
1196
1197 *ptr = __fcs(buf); ptr++;
1198
1199 return rfcomm_send_frame(s, buf, ptr - buf);
1200}
1201
1202static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1203{
1204 struct socket *sock = s->sock;
1205 struct kvec iv[3];
1206 struct msghdr msg;
1207 unsigned char hdr[5], crc[1];
1208
1209 if (len > 125)
1210 return -EINVAL;
1211
1212 BT_DBG("%p cr %d", s, cr);
1213
1214 hdr[0] = __addr(s->initiator, 0);
1215 hdr[1] = __ctrl(RFCOMM_UIH, 0);
1216 hdr[2] = 0x01 | ((len + 2) << 1);
1217 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1218 hdr[4] = 0x01 | (len << 1);
1219
1220 crc[0] = __fcs(hdr);
1221
1222 iv[0].iov_base = hdr;
1223 iv[0].iov_len = 5;
1224 iv[1].iov_base = pattern;
1225 iv[1].iov_len = len;
1226 iv[2].iov_base = crc;
1227 iv[2].iov_len = 1;
1228
1229 memset(&msg, 0, sizeof(msg));
1230
1231 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1232}
1233
1234static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1235{
1236 struct rfcomm_hdr *hdr;
1237 u8 buf[16], *ptr = buf;
1238
1239 BT_DBG("%p addr %d credits %d", s, addr, credits);
1240
1241 hdr = (void *) ptr; ptr += sizeof(*hdr);
1242 hdr->addr = addr;
1243 hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1244 hdr->len = __len8(0);
1245
1246 *ptr = credits; ptr++;
1247
1248 *ptr = __fcs(buf); ptr++;
1249
1250 return rfcomm_send_frame(s, buf, ptr - buf);
1251}
1252
1253static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1254{
1255 struct rfcomm_hdr *hdr;
1256 int len = skb->len;
1257 u8 *crc;
1258
1259 if (len > 127) {
1260 hdr = skb_push(skb, 4);
1261 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1262 } else {
1263 hdr = skb_push(skb, 3);
1264 hdr->len = __len8(len);
1265 }
1266 hdr->addr = addr;
1267 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1268
1269 crc = skb_put(skb, 1);
1270 *crc = __fcs((void *) hdr);
1271}
1272
1273/* ---- RFCOMM frame reception ---- */
1274static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1275{
1276 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1277
1278 if (dlci) {
1279 /* Data channel */
1280 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1281 if (!d) {
1282 rfcomm_send_dm(s, dlci);
1283 return s;
1284 }
1285
1286 switch (d->state) {
1287 case BT_CONNECT:
1288 rfcomm_dlc_clear_timer(d);
1289
1290 rfcomm_dlc_lock(d);
1291 d->state = BT_CONNECTED;
1292 d->state_change(d, 0);
1293 rfcomm_dlc_unlock(d);
1294
1295 rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1296 break;
1297
1298 case BT_DISCONN:
1299 d->state = BT_CLOSED;
1300 __rfcomm_dlc_close(d, 0);
1301
1302 if (list_empty(&s->dlcs)) {
1303 s->state = BT_DISCONN;
1304 rfcomm_send_disc(s, 0);
1305 rfcomm_session_clear_timer(s);
1306 }
1307
1308 break;
1309 }
1310 } else {
1311 /* Control channel */
1312 switch (s->state) {
1313 case BT_CONNECT:
1314 s->state = BT_CONNECTED;
1315 rfcomm_process_connect(s);
1316 break;
1317
1318 case BT_DISCONN:
1319 s = rfcomm_session_close(s, ECONNRESET);
1320 break;
1321 }
1322 }
1323 return s;
1324}
1325
1326static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1327{
1328 int err = 0;
1329
1330 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1331
1332 if (dlci) {
1333 /* Data DLC */
1334 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1335 if (d) {
1336 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1337 err = ECONNREFUSED;
1338 else
1339 err = ECONNRESET;
1340
1341 d->state = BT_CLOSED;
1342 __rfcomm_dlc_close(d, err);
1343 }
1344 } else {
1345 if (s->state == BT_CONNECT)
1346 err = ECONNREFUSED;
1347 else
1348 err = ECONNRESET;
1349
1350 s = rfcomm_session_close(s, err);
1351 }
1352 return s;
1353}
1354
1355static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1356 u8 dlci)
1357{
1358 int err = 0;
1359
1360 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1361
1362 if (dlci) {
1363 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1364 if (d) {
1365 rfcomm_send_ua(s, dlci);
1366
1367 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1368 err = ECONNREFUSED;
1369 else
1370 err = ECONNRESET;
1371
1372 d->state = BT_CLOSED;
1373 __rfcomm_dlc_close(d, err);
1374 } else
1375 rfcomm_send_dm(s, dlci);
1376
1377 } else {
1378 rfcomm_send_ua(s, 0);
1379
1380 if (s->state == BT_CONNECT)
1381 err = ECONNREFUSED;
1382 else
1383 err = ECONNRESET;
1384
1385 s = rfcomm_session_close(s, err);
1386 }
1387 return s;
1388}
1389
1390/* Must be called with rfcomm_mutex held, so that the session cannot be
1391 * unlinked from under us.
1392 */
1393static void __rfcomm_dlc_accept(struct rfcomm_dlc *d)
1394{
1395 struct sock *sk = d->session->sock->sk;
1396 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1397
1398 BT_DBG("dlc %p", d);
1399
1400 rfcomm_send_ua(d->session, d->dlci);
1401
1402 rfcomm_dlc_clear_timer(d);
1403
1404 rfcomm_dlc_lock(d);
1405 d->state = BT_CONNECTED;
1406 d->state_change(d, 0);
1407 rfcomm_dlc_unlock(d);
1408
1409 if (d->role_switch)
1410 hci_conn_switch_role(conn->hcon, 0x00);
1411
1412 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1413}
1414
1415void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1416{
1417 rfcomm_lock();
1418
1419 /* rfcomm_recv_disc() sets the dlc state to BT_CLOSED before calling
1420 * __rfcomm_dlc_close(), so the RFCOMM_DEFER_SETUP handshake there is
1421 * skipped and the session can already be unlinked by the time the
1422 * deferred accept runs from rfcomm_sock_recvmsg().
1423 */
1424 if (d->session)
1425 __rfcomm_dlc_accept(d);
1426
1427 rfcomm_unlock();
1428}
1429
1430static void rfcomm_check_accept(struct rfcomm_dlc *d)
1431{
1432 if (rfcomm_check_security(d)) {
1433 if (d->defer_setup) {
1434 set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1435 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1436
1437 rfcomm_dlc_lock(d);
1438 d->state = BT_CONNECT2;
1439 d->state_change(d, 0);
1440 rfcomm_dlc_unlock(d);
1441 } else
1442 __rfcomm_dlc_accept(d);
1443 } else {
1444 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1445 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1446 }
1447}
1448
1449static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1450{
1451 struct rfcomm_dlc *d;
1452 u8 channel;
1453
1454 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1455
1456 if (!dlci) {
1457 rfcomm_send_ua(s, 0);
1458
1459 if (s->state == BT_OPEN) {
1460 s->state = BT_CONNECTED;
1461 rfcomm_process_connect(s);
1462 }
1463 return 0;
1464 }
1465
1466 /* Check if DLC exists */
1467 d = rfcomm_dlc_get(s, dlci);
1468 if (d) {
1469 if (d->state == BT_OPEN) {
1470 /* DLC was previously opened by PN request */
1471 rfcomm_check_accept(d);
1472 }
1473 return 0;
1474 }
1475
1476 /* Notify socket layer about incoming connection */
1477 channel = __srv_channel(dlci);
1478 if (rfcomm_connect_ind(s, channel, &d)) {
1479 d->dlci = dlci;
1480 d->addr = __addr(s->initiator, dlci);
1481 rfcomm_dlc_link(s, d);
1482
1483 rfcomm_check_accept(d);
1484 } else {
1485 rfcomm_send_dm(s, dlci);
1486 }
1487
1488 return 0;
1489}
1490
1491static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1492{
1493 struct rfcomm_session *s = d->session;
1494
1495 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1496 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1497
1498 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1499 pn->flow_ctrl == 0xe0) {
1500 d->cfc = RFCOMM_CFC_ENABLED;
1501 d->tx_credits = pn->credits;
1502 } else {
1503 d->cfc = RFCOMM_CFC_DISABLED;
1504 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1505 }
1506
1507 if (s->cfc == RFCOMM_CFC_UNKNOWN)
1508 s->cfc = d->cfc;
1509
1510 d->priority = pn->priority;
1511
1512 d->mtu = __le16_to_cpu(pn->mtu);
1513
1514 /* MTU 0 causes an infinite loop when fragmenting in sendmsg */
1515 if (!d->mtu)
1516 d->mtu = RFCOMM_DEFAULT_MTU;
1517
1518 if (cr && d->mtu > s->mtu)
1519 d->mtu = s->mtu;
1520
1521 return 0;
1522}
1523
1524static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1525{
1526 struct rfcomm_pn *pn;
1527 struct rfcomm_dlc *d;
1528 u8 dlci;
1529
1530 pn = skb_pull_data(skb, sizeof(*pn));
1531 if (!pn)
1532 return -EILSEQ;
1533
1534 dlci = pn->dlci;
1535 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1536
1537 if (!dlci)
1538 return 0;
1539
1540 d = rfcomm_dlc_get(s, dlci);
1541 if (d) {
1542 if (cr) {
1543 /* PN request */
1544 rfcomm_apply_pn(d, cr, pn);
1545 rfcomm_send_pn(s, 0, d);
1546 } else {
1547 /* PN response */
1548 switch (d->state) {
1549 case BT_CONFIG:
1550 rfcomm_apply_pn(d, cr, pn);
1551
1552 d->state = BT_CONNECT;
1553 rfcomm_send_sabm(s, d->dlci);
1554 break;
1555 }
1556 }
1557 } else {
1558 u8 channel = __srv_channel(dlci);
1559
1560 if (!cr)
1561 return 0;
1562
1563 /* PN request for non existing DLC.
1564 * Assume incoming connection. */
1565 if (rfcomm_connect_ind(s, channel, &d)) {
1566 d->dlci = dlci;
1567 d->addr = __addr(s->initiator, dlci);
1568 rfcomm_dlc_link(s, d);
1569
1570 rfcomm_apply_pn(d, cr, pn);
1571
1572 d->state = BT_OPEN;
1573 rfcomm_send_pn(s, 0, d);
1574 } else {
1575 rfcomm_send_dm(s, dlci);
1576 }
1577 }
1578 return 0;
1579}
1580
1581static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1582{
1583 struct rfcomm_rpn *rpn;
1584 u8 dlci;
1585
1586 u8 bit_rate = 0;
1587 u8 data_bits = 0;
1588 u8 stop_bits = 0;
1589 u8 parity = 0;
1590 u8 flow_ctrl = 0;
1591 u8 xon_char = 0;
1592 u8 xoff_char = 0;
1593 u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1594
1595 if (len == 1) {
1596 rpn = skb_pull_data(skb, 1);
1597 if (!rpn)
1598 return -EILSEQ;
1599
1600 dlci = __get_dlci(rpn->dlci);
1601
1602 if (!cr)
1603 return 0;
1604
1605 bit_rate = RFCOMM_RPN_BR_9600;
1606 data_bits = RFCOMM_RPN_DATA_8;
1607 stop_bits = RFCOMM_RPN_STOP_1;
1608 parity = RFCOMM_RPN_PARITY_NONE;
1609 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1610 xon_char = RFCOMM_RPN_XON_CHAR;
1611 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1612 goto rpn_out;
1613 }
1614
1615 rpn = skb_pull_data(skb, sizeof(*rpn));
1616 if (!rpn)
1617 return -EILSEQ;
1618
1619 dlci = __get_dlci(rpn->dlci);
1620
1621 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1622 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1623 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1624
1625 if (!cr)
1626 return 0;
1627
1628 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1629 * no parity, no flow control lines, normal XON/XOFF chars */
1630
1631 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1632 bit_rate = rpn->bit_rate;
1633 if (bit_rate > RFCOMM_RPN_BR_230400) {
1634 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1635 bit_rate = RFCOMM_RPN_BR_9600;
1636 rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1637 }
1638 }
1639
1640 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1641 data_bits = __get_rpn_data_bits(rpn->line_settings);
1642 if (data_bits != RFCOMM_RPN_DATA_8) {
1643 BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1644 data_bits = RFCOMM_RPN_DATA_8;
1645 rpn_mask ^= RFCOMM_RPN_PM_DATA;
1646 }
1647 }
1648
1649 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1650 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1651 if (stop_bits != RFCOMM_RPN_STOP_1) {
1652 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1653 stop_bits = RFCOMM_RPN_STOP_1;
1654 rpn_mask ^= RFCOMM_RPN_PM_STOP;
1655 }
1656 }
1657
1658 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1659 parity = __get_rpn_parity(rpn->line_settings);
1660 if (parity != RFCOMM_RPN_PARITY_NONE) {
1661 BT_DBG("RPN parity mismatch 0x%x", parity);
1662 parity = RFCOMM_RPN_PARITY_NONE;
1663 rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1664 }
1665 }
1666
1667 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1668 flow_ctrl = rpn->flow_ctrl;
1669 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1670 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1671 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1672 rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1673 }
1674 }
1675
1676 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1677 xon_char = rpn->xon_char;
1678 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1679 BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1680 xon_char = RFCOMM_RPN_XON_CHAR;
1681 rpn_mask ^= RFCOMM_RPN_PM_XON;
1682 }
1683 }
1684
1685 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1686 xoff_char = rpn->xoff_char;
1687 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1688 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1689 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1690 rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1691 }
1692 }
1693
1694rpn_out:
1695 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1696 parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1697
1698 return 0;
1699}
1700
1701static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1702{
1703 struct rfcomm_rls *rls;
1704 u8 dlci;
1705
1706 rls = skb_pull_data(skb, sizeof(*rls));
1707 if (!rls)
1708 return -EILSEQ;
1709
1710 dlci = __get_dlci(rls->dlci);
1711 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1712
1713 if (!cr)
1714 return 0;
1715
1716 /* We should probably do something with this information here. But
1717 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1718 * mandatory to recognise and respond to RLS */
1719
1720 rfcomm_send_rls(s, 0, dlci, rls->status);
1721
1722 return 0;
1723}
1724
1725static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1726{
1727 struct rfcomm_msc *msc;
1728 struct rfcomm_dlc *d;
1729 u8 dlci;
1730
1731 msc = skb_pull_data(skb, sizeof(*msc));
1732 if (!msc)
1733 return -EILSEQ;
1734
1735 dlci = __get_dlci(msc->dlci);
1736 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1737
1738 d = rfcomm_dlc_get(s, dlci);
1739 if (!d)
1740 return 0;
1741
1742 if (cr) {
1743 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1744 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1745 else
1746 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1747
1748 rfcomm_dlc_lock(d);
1749
1750 d->remote_v24_sig = msc->v24_sig;
1751
1752 if (d->modem_status)
1753 d->modem_status(d, msc->v24_sig);
1754
1755 rfcomm_dlc_unlock(d);
1756
1757 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1758
1759 d->mscex |= RFCOMM_MSCEX_RX;
1760 } else
1761 d->mscex |= RFCOMM_MSCEX_TX;
1762
1763 return 0;
1764}
1765
1766static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1767{
1768 struct rfcomm_mcc *mcc;
1769 u8 type, cr, len;
1770
1771 mcc = skb_pull_data(skb, sizeof(*mcc));
1772 if (!mcc)
1773 return -EILSEQ;
1774
1775 cr = __test_cr(mcc->type);
1776 type = __get_mcc_type(mcc->type);
1777 len = __get_mcc_len(mcc->len);
1778
1779 BT_DBG("%p type 0x%x cr %d", s, type, cr);
1780
1781 switch (type) {
1782 case RFCOMM_PN:
1783 rfcomm_recv_pn(s, cr, skb);
1784 break;
1785
1786 case RFCOMM_RPN:
1787 rfcomm_recv_rpn(s, cr, len, skb);
1788 break;
1789
1790 case RFCOMM_RLS:
1791 rfcomm_recv_rls(s, cr, skb);
1792 break;
1793
1794 case RFCOMM_MSC:
1795 rfcomm_recv_msc(s, cr, skb);
1796 break;
1797
1798 case RFCOMM_FCOFF:
1799 if (cr) {
1800 set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1801 rfcomm_send_fcoff(s, 0);
1802 }
1803 break;
1804
1805 case RFCOMM_FCON:
1806 if (cr) {
1807 clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1808 rfcomm_send_fcon(s, 0);
1809 }
1810 break;
1811
1812 case RFCOMM_TEST:
1813 if (cr)
1814 rfcomm_send_test(s, 0, skb->data, skb->len);
1815 break;
1816
1817 case RFCOMM_NSC:
1818 break;
1819
1820 default:
1821 BT_ERR("Unknown control type 0x%02x", type);
1822 rfcomm_send_nsc(s, cr, type);
1823 break;
1824 }
1825 return 0;
1826}
1827
1828static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1829{
1830 struct rfcomm_dlc *d;
1831
1832 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1833
1834 d = rfcomm_dlc_get(s, dlci);
1835 if (!d) {
1836 rfcomm_send_dm(s, dlci);
1837 goto drop;
1838 }
1839
1840 if (pf && d->cfc) {
1841 u8 *credits = skb_pull_data(skb, 1);
1842
1843 if (!credits)
1844 goto drop;
1845
1846 d->tx_credits += *credits;
1847 if (d->tx_credits)
1848 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1849 }
1850
1851 if (skb->len && d->state == BT_CONNECTED) {
1852 rfcomm_dlc_lock(d);
1853 d->rx_credits--;
1854 d->data_ready(d, skb);
1855 rfcomm_dlc_unlock(d);
1856 return 0;
1857 }
1858
1859drop:
1860 kfree_skb(skb);
1861 return 0;
1862}
1863
1864static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1865 struct sk_buff *skb)
1866{
1867 struct rfcomm_hdr *hdr = (void *) skb->data;
1868 u8 type, dlci, fcs;
1869
1870 if (!s) {
1871 /* no session, so free socket data */
1872 kfree_skb(skb);
1873 return s;
1874 }
1875
1876 if (skb->len < sizeof(*hdr) + 1 ||
1877 (!__test_ea(hdr->len) && skb->len < sizeof(*hdr) + 2)) {
1878 kfree_skb(skb);
1879 return s;
1880 }
1881
1882 dlci = __get_dlci(hdr->addr);
1883 type = __get_type(hdr->ctrl);
1884
1885 /* Trim FCS */
1886 skb->len--; skb->tail--;
1887 fcs = *(u8 *)skb_tail_pointer(skb);
1888
1889 if (__check_fcs(skb->data, type, fcs)) {
1890 BT_ERR("bad checksum in packet");
1891 kfree_skb(skb);
1892 return s;
1893 }
1894
1895 if (__test_ea(hdr->len))
1896 skb_pull(skb, 3);
1897 else
1898 skb_pull(skb, 4);
1899
1900 switch (type) {
1901 case RFCOMM_SABM:
1902 if (__test_pf(hdr->ctrl))
1903 rfcomm_recv_sabm(s, dlci);
1904 break;
1905
1906 case RFCOMM_DISC:
1907 if (__test_pf(hdr->ctrl))
1908 s = rfcomm_recv_disc(s, dlci);
1909 break;
1910
1911 case RFCOMM_UA:
1912 if (__test_pf(hdr->ctrl))
1913 s = rfcomm_recv_ua(s, dlci);
1914 break;
1915
1916 case RFCOMM_DM:
1917 s = rfcomm_recv_dm(s, dlci);
1918 break;
1919
1920 case RFCOMM_UIH:
1921 if (dlci) {
1922 rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1923 return s;
1924 }
1925 rfcomm_recv_mcc(s, skb);
1926 break;
1927
1928 default:
1929 BT_ERR("Unknown packet type 0x%02x", type);
1930 break;
1931 }
1932 kfree_skb(skb);
1933 return s;
1934}
1935
1936/* ---- Connection and data processing ---- */
1937
1938static void rfcomm_process_connect(struct rfcomm_session *s)
1939{
1940 struct rfcomm_dlc *d, *n;
1941
1942 BT_DBG("session %p state %ld", s, s->state);
1943
1944 list_for_each_entry_safe(d, n, &s->dlcs, list) {
1945 if (d->state == BT_CONFIG) {
1946 d->mtu = s->mtu;
1947 if (rfcomm_check_security(d)) {
1948 rfcomm_send_pn(s, 1, d);
1949 } else {
1950 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1951 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1952 }
1953 }
1954 }
1955}
1956
1957/* Send data queued for the DLC.
1958 * Return number of frames left in the queue.
1959 */
1960static int rfcomm_process_tx(struct rfcomm_dlc *d)
1961{
1962 struct sk_buff *skb;
1963 int err;
1964
1965 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1966 d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1967
1968 /* Send pending MSC */
1969 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1970 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1971
1972 if (d->cfc) {
1973 /* CFC enabled.
1974 * Give them some credits */
1975 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1976 d->rx_credits <= (d->cfc >> 2)) {
1977 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1978 d->rx_credits = d->cfc;
1979 }
1980 } else {
1981 /* CFC disabled.
1982 * Give ourselves some credits */
1983 d->tx_credits = 5;
1984 }
1985
1986 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1987 return skb_queue_len(&d->tx_queue);
1988
1989 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1990 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1991 if (err < 0) {
1992 skb_queue_head(&d->tx_queue, skb);
1993 break;
1994 }
1995 kfree_skb(skb);
1996 d->tx_credits--;
1997 }
1998
1999 if (d->cfc && !d->tx_credits) {
2000 /* We're out of TX credits.
2001 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
2002 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
2003 }
2004
2005 return skb_queue_len(&d->tx_queue);
2006}
2007
2008static void rfcomm_process_dlcs(struct rfcomm_session *s)
2009{
2010 struct rfcomm_dlc *d, *n;
2011
2012 BT_DBG("session %p state %ld", s, s->state);
2013
2014 list_for_each_entry_safe(d, n, &s->dlcs, list) {
2015 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
2016 __rfcomm_dlc_close(d, ETIMEDOUT);
2017 continue;
2018 }
2019
2020 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
2021 __rfcomm_dlc_close(d, ECONNREFUSED);
2022 continue;
2023 }
2024
2025 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
2026 rfcomm_dlc_clear_timer(d);
2027 if (d->out) {
2028 rfcomm_send_pn(s, 1, d);
2029 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
2030 } else {
2031 if (d->defer_setup) {
2032 set_bit(RFCOMM_DEFER_SETUP, &d->flags);
2033 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2034
2035 rfcomm_dlc_lock(d);
2036 d->state = BT_CONNECT2;
2037 d->state_change(d, 0);
2038 rfcomm_dlc_unlock(d);
2039 } else
2040 __rfcomm_dlc_accept(d);
2041 }
2042 continue;
2043 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
2044 rfcomm_dlc_clear_timer(d);
2045 if (!d->out)
2046 rfcomm_send_dm(s, d->dlci);
2047 else
2048 d->state = BT_CLOSED;
2049 __rfcomm_dlc_close(d, ECONNREFUSED);
2050 continue;
2051 }
2052
2053 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
2054 continue;
2055
2056 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
2057 continue;
2058
2059 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
2060 d->mscex == RFCOMM_MSCEX_OK)
2061 rfcomm_process_tx(d);
2062 }
2063}
2064
2065static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
2066{
2067 struct socket *sock = s->sock;
2068 struct sock *sk = sock->sk;
2069 struct sk_buff *skb;
2070
2071 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
2072
2073 /* Get data directly from socket receive queue without copying it. */
2074 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
2075 skb_orphan(skb);
2076 if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) {
2077 s = rfcomm_recv_frame(s, skb);
2078 if (!s)
2079 break;
2080 } else {
2081 kfree_skb(skb);
2082 }
2083 }
2084
2085 if (s && (sk->sk_state == BT_CLOSED))
2086 s = rfcomm_session_close(s, sk->sk_err);
2087
2088 return s;
2089}
2090
2091static void rfcomm_accept_connection(struct rfcomm_session *s)
2092{
2093 struct socket *sock = s->sock, *nsock;
2094 int err;
2095
2096 /* Fast check for a new connection.
2097 * Avoids unnecessary socket allocations.
2098 */
2099 if (list_empty(&bt_sk(sock->sk)->accept_q))
2100 return;
2101
2102 BT_DBG("session %p", s);
2103
2104 err = kernel_accept(sock, &nsock, O_NONBLOCK);
2105 if (err < 0)
2106 return;
2107
2108 /* Set our callbacks */
2109 nsock->sk->sk_data_ready = rfcomm_l2data_ready;
2110 nsock->sk->sk_state_change = rfcomm_l2state_change;
2111
2112 s = rfcomm_session_add(nsock, BT_OPEN);
2113 if (s) {
2114 /* We should adjust MTU on incoming sessions.
2115 * L2CAP MTU minus UIH header and FCS. */
2116 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
2117 l2cap_pi(nsock->sk)->chan->imtu) - 5;
2118
2119 rfcomm_schedule();
2120 } else
2121 sock_release(nsock);
2122}
2123
2124static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
2125{
2126 struct sock *sk = s->sock->sk;
2127
2128 BT_DBG("%p state %ld", s, s->state);
2129
2130 switch (sk->sk_state) {
2131 case BT_CONNECTED:
2132 s->state = BT_CONNECT;
2133
2134 /* We can adjust MTU on outgoing sessions.
2135 * L2CAP MTU minus UIH header and FCS. */
2136 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
2137
2138 rfcomm_send_sabm(s, 0);
2139 break;
2140
2141 case BT_CLOSED:
2142 s = rfcomm_session_close(s, sk->sk_err);
2143 break;
2144 }
2145 return s;
2146}
2147
2148static void rfcomm_process_sessions(void)
2149{
2150 struct rfcomm_session *s, *n;
2151
2152 rfcomm_lock();
2153
2154 list_for_each_entry_safe(s, n, &session_list, list) {
2155 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
2156 s->state = BT_DISCONN;
2157 rfcomm_send_disc(s, 0);
2158 continue;
2159 }
2160
2161 switch (s->state) {
2162 case BT_LISTEN:
2163 rfcomm_accept_connection(s);
2164 continue;
2165
2166 case BT_BOUND:
2167 s = rfcomm_check_connection(s);
2168 break;
2169
2170 default:
2171 s = rfcomm_process_rx(s);
2172 break;
2173 }
2174
2175 if (s)
2176 rfcomm_process_dlcs(s);
2177 }
2178
2179 rfcomm_unlock();
2180}
2181
2182static int rfcomm_add_listener(bdaddr_t *ba)
2183{
2184 struct sockaddr_l2 addr;
2185 struct socket *sock;
2186 struct sock *sk;
2187 struct rfcomm_session *s;
2188 int err = 0;
2189
2190 /* Create socket */
2191 err = rfcomm_l2sock_create(&sock);
2192 if (err < 0) {
2193 BT_ERR("Create socket failed %d", err);
2194 return err;
2195 }
2196
2197 /* Bind socket */
2198 bacpy(&addr.l2_bdaddr, ba);
2199 addr.l2_family = AF_BLUETOOTH;
2200 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM);
2201 addr.l2_cid = 0;
2202 addr.l2_bdaddr_type = BDADDR_BREDR;
2203 err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr));
2204 if (err < 0) {
2205 BT_ERR("Bind failed %d", err);
2206 goto failed;
2207 }
2208
2209 /* Set L2CAP options */
2210 sk = sock->sk;
2211 lock_sock(sk);
2212 /* Set MTU to 0 so L2CAP can auto select the MTU */
2213 l2cap_pi(sk)->chan->imtu = 0;
2214 release_sock(sk);
2215
2216 /* Start listening on the socket */
2217 err = kernel_listen(sock, 10);
2218 if (err) {
2219 BT_ERR("Listen failed %d", err);
2220 goto failed;
2221 }
2222
2223 /* Add listening session */
2224 s = rfcomm_session_add(sock, BT_LISTEN);
2225 if (!s) {
2226 err = -ENOMEM;
2227 goto failed;
2228 }
2229
2230 return 0;
2231failed:
2232 sock_release(sock);
2233 return err;
2234}
2235
2236static void rfcomm_kill_listener(void)
2237{
2238 struct rfcomm_session *s, *n;
2239
2240 BT_DBG("");
2241
2242 rfcomm_lock();
2243 list_for_each_entry_safe(s, n, &session_list, list)
2244 rfcomm_session_del(s);
2245 rfcomm_unlock();
2246}
2247
2248static int rfcomm_run(void *unused)
2249{
2250 DEFINE_WAIT_FUNC(wait, woken_wake_function);
2251 BT_DBG("");
2252
2253 set_user_nice(current, -10);
2254
2255 rfcomm_add_listener(BDADDR_ANY);
2256
2257 add_wait_queue(&rfcomm_wq, &wait);
2258 while (!kthread_should_stop()) {
2259
2260 /* Process stuff */
2261 rfcomm_process_sessions();
2262
2263 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2264 }
2265 remove_wait_queue(&rfcomm_wq, &wait);
2266
2267 rfcomm_kill_listener();
2268
2269 return 0;
2270}
2271
2272static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2273{
2274 struct rfcomm_session *s;
2275 struct rfcomm_dlc *d, *n;
2276
2277 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2278
2279 rfcomm_lock();
2280
2281 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2282 if (!s) {
2283 rfcomm_unlock();
2284 return;
2285 }
2286
2287 list_for_each_entry_safe(d, n, &s->dlcs, list) {
2288 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2289 rfcomm_dlc_clear_timer(d);
2290 if (status || encrypt == 0x00) {
2291 set_bit(RFCOMM_ENC_DROP, &d->flags);
2292 continue;
2293 }
2294 }
2295
2296 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2297 if (d->sec_level == BT_SECURITY_MEDIUM) {
2298 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2299 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2300 continue;
2301 } else if (d->sec_level == BT_SECURITY_HIGH ||
2302 d->sec_level == BT_SECURITY_FIPS) {
2303 set_bit(RFCOMM_ENC_DROP, &d->flags);
2304 continue;
2305 }
2306 }
2307
2308 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2309 continue;
2310
2311 if (!status && hci_conn_check_secure(conn, d->sec_level))
2312 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2313 else
2314 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2315 }
2316
2317 rfcomm_unlock();
2318
2319 rfcomm_schedule();
2320}
2321
2322static struct hci_cb rfcomm_cb = {
2323 .name = "RFCOMM",
2324 .security_cfm = rfcomm_security_cfm
2325};
2326
2327static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2328{
2329 struct rfcomm_session *s;
2330
2331 rfcomm_lock();
2332
2333 list_for_each_entry(s, &session_list, list) {
2334 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2335 struct rfcomm_dlc *d;
2336 list_for_each_entry(d, &s->dlcs, list) {
2337 seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2338 &chan->src, &chan->dst,
2339 d->state, d->dlci, d->mtu,
2340 d->rx_credits, d->tx_credits);
2341 }
2342 }
2343
2344 rfcomm_unlock();
2345
2346 return 0;
2347}
2348
2349DEFINE_SHOW_ATTRIBUTE(rfcomm_dlc_debugfs);
2350
2351static struct dentry *rfcomm_dlc_debugfs;
2352
2353/* ---- Initialization ---- */
2354static int __init rfcomm_init(void)
2355{
2356 int err;
2357
2358 hci_register_cb(&rfcomm_cb);
2359
2360 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2361 if (IS_ERR(rfcomm_thread)) {
2362 err = PTR_ERR(rfcomm_thread);
2363 goto unregister;
2364 }
2365
2366 err = rfcomm_init_ttys();
2367 if (err < 0)
2368 goto stop;
2369
2370 err = rfcomm_init_sockets();
2371 if (err < 0)
2372 goto cleanup;
2373
2374 BT_INFO("RFCOMM ver %s", VERSION);
2375
2376 if (IS_ERR_OR_NULL(bt_debugfs))
2377 return 0;
2378
2379 rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2380 bt_debugfs, NULL,
2381 &rfcomm_dlc_debugfs_fops);
2382
2383 return 0;
2384
2385cleanup:
2386 rfcomm_cleanup_ttys();
2387
2388stop:
2389 kthread_stop(rfcomm_thread);
2390
2391unregister:
2392 hci_unregister_cb(&rfcomm_cb);
2393
2394 return err;
2395}
2396
2397static void __exit rfcomm_exit(void)
2398{
2399 debugfs_remove(rfcomm_dlc_debugfs);
2400
2401 hci_unregister_cb(&rfcomm_cb);
2402
2403 kthread_stop(rfcomm_thread);
2404
2405 rfcomm_cleanup_ttys();
2406
2407 rfcomm_cleanup_sockets();
2408}
2409
2410module_init(rfcomm_init);
2411module_exit(rfcomm_exit);
2412
2413module_param(disable_cfc, bool, 0644);
2414MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2415
2416module_param(channel_mtu, int, 0644);
2417MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2418
2419module_param(l2cap_ertm, bool, 0644);
2420MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2421
2422MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
2423MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2424MODULE_VERSION(VERSION);
2425MODULE_LICENSE("GPL");
2426MODULE_ALIAS("bt-proto-3");