1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 /* 22 * Bluetooth RFCOMM core. 23 */ 24 25 #include <linux/module.h> 26 #include <linux/debugfs.h> 27 #include <linux/kthread.h> 28 #include <linux/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 #include <net/bluetooth/rfcomm.h> 34 35 #include <trace/events/sock.h> 36 37 #define VERSION "1.11" 38 39 static bool disable_cfc; 40 static bool l2cap_ertm; 41 static int channel_mtu = -1; 42 43 static struct task_struct *rfcomm_thread; 44 45 static DEFINE_MUTEX(rfcomm_mutex); 46 #define rfcomm_lock() mutex_lock(&rfcomm_mutex) 47 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex) 48 49 50 static LIST_HEAD(session_list); 51 52 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len); 53 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci); 54 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci); 55 static int rfcomm_queue_disc(struct rfcomm_dlc *d); 56 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type); 57 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d); 58 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig); 59 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len); 60 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits); 61 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr); 62 63 static void rfcomm_process_connect(struct rfcomm_session *s); 64 65 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, 66 bdaddr_t *dst, 67 u8 sec_level, 68 int *err); 69 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst); 70 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s); 71 72 /* ---- RFCOMM frame parsing macros ---- */ 73 #define __get_dlci(b) ((b & 0xfc) >> 2) 74 #define __get_type(b) ((b & 0xef)) 75 76 #define __test_ea(b) ((b & 0x01)) 77 #define __test_cr(b) (!!(b & 0x02)) 78 #define __test_pf(b) (!!(b & 0x10)) 79 80 #define __session_dir(s) ((s)->initiator ? 0x00 : 0x01) 81 82 #define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01) 83 #define __ctrl(type, pf) (((type & 0xef) | (pf << 4))) 84 #define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir) 85 #define __srv_channel(dlci) (dlci >> 1) 86 87 #define __len8(len) (((len) << 1) | 1) 88 #define __len16(len) ((len) << 1) 89 90 /* MCC macros */ 91 #define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01)) 92 #define __get_mcc_type(b) ((b & 0xfc) >> 2) 93 #define __get_mcc_len(b) ((b & 0xfe) >> 1) 94 95 /* RPN macros */ 96 #define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3)) 97 #define __get_rpn_data_bits(line) ((line) & 0x3) 98 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1) 99 #define __get_rpn_parity(line) (((line) >> 3) & 0x7) 100 101 static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq); 102 103 static void rfcomm_schedule(void) 104 { 105 wake_up_all(&rfcomm_wq); 106 } 107 108 /* ---- RFCOMM FCS computation ---- */ 109 110 /* reversed, 8-bit, poly=0x07 */ 111 static unsigned char rfcomm_crc_table[256] = { 112 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75, 113 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b, 114 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69, 115 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67, 116 117 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d, 118 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43, 119 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51, 120 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f, 121 122 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05, 123 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b, 124 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19, 125 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17, 126 127 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d, 128 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33, 129 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21, 130 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f, 131 132 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95, 133 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b, 134 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89, 135 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87, 136 137 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad, 138 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3, 139 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1, 140 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf, 141 142 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5, 143 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb, 144 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9, 145 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7, 146 147 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd, 148 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3, 149 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1, 150 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf 151 }; 152 153 /* CRC on 2 bytes */ 154 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]]) 155 156 /* FCS on 2 bytes */ 157 static inline u8 __fcs(u8 *data) 158 { 159 return 0xff - __crc(data); 160 } 161 162 /* FCS on 3 bytes */ 163 static inline u8 __fcs2(u8 *data) 164 { 165 return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]]; 166 } 167 168 /* Check FCS */ 169 static inline int __check_fcs(u8 *data, int type, u8 fcs) 170 { 171 u8 f = __crc(data); 172 173 if (type != RFCOMM_UIH) 174 f = rfcomm_crc_table[f ^ data[2]]; 175 176 return rfcomm_crc_table[f ^ fcs] != 0xcf; 177 } 178 179 /* ---- L2CAP callbacks ---- */ 180 static void rfcomm_l2state_change(struct sock *sk) 181 { 182 BT_DBG("%p state %d", sk, sk->sk_state); 183 rfcomm_schedule(); 184 } 185 186 static void rfcomm_l2data_ready(struct sock *sk) 187 { 188 trace_sk_data_ready(sk); 189 190 BT_DBG("%p", sk); 191 rfcomm_schedule(); 192 } 193 194 static int rfcomm_l2sock_create(struct socket **sock) 195 { 196 int err; 197 198 BT_DBG(""); 199 200 err = sock_create_kern(&init_net, PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock); 201 if (!err) { 202 struct sock *sk = (*sock)->sk; 203 sk->sk_data_ready = rfcomm_l2data_ready; 204 sk->sk_state_change = rfcomm_l2state_change; 205 } 206 return err; 207 } 208 209 static int rfcomm_check_security(struct rfcomm_dlc *d) 210 { 211 struct sock *sk = d->session->sock->sk; 212 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 213 214 __u8 auth_type; 215 216 switch (d->sec_level) { 217 case BT_SECURITY_HIGH: 218 case BT_SECURITY_FIPS: 219 auth_type = HCI_AT_GENERAL_BONDING_MITM; 220 break; 221 case BT_SECURITY_MEDIUM: 222 auth_type = HCI_AT_GENERAL_BONDING; 223 break; 224 default: 225 auth_type = HCI_AT_NO_BONDING; 226 break; 227 } 228 229 return hci_conn_security(conn->hcon, d->sec_level, auth_type, 230 d->out); 231 } 232 233 static void rfcomm_session_timeout(struct timer_list *t) 234 { 235 struct rfcomm_session *s = timer_container_of(s, t, timer); 236 237 BT_DBG("session %p state %ld", s, s->state); 238 239 set_bit(RFCOMM_TIMED_OUT, &s->flags); 240 rfcomm_schedule(); 241 } 242 243 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout) 244 { 245 BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout); 246 247 mod_timer(&s->timer, jiffies + timeout); 248 } 249 250 static void rfcomm_session_clear_timer(struct rfcomm_session *s) 251 { 252 BT_DBG("session %p state %ld", s, s->state); 253 254 timer_delete_sync(&s->timer); 255 } 256 257 /* ---- RFCOMM DLCs ---- */ 258 static void rfcomm_dlc_timeout(struct timer_list *t) 259 { 260 struct rfcomm_dlc *d = timer_container_of(d, t, timer); 261 262 BT_DBG("dlc %p state %ld", d, d->state); 263 264 set_bit(RFCOMM_TIMED_OUT, &d->flags); 265 rfcomm_dlc_put(d); 266 rfcomm_schedule(); 267 } 268 269 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout) 270 { 271 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout); 272 273 if (!mod_timer(&d->timer, jiffies + timeout)) 274 rfcomm_dlc_hold(d); 275 } 276 277 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d) 278 { 279 BT_DBG("dlc %p state %ld", d, d->state); 280 281 if (timer_delete(&d->timer)) 282 rfcomm_dlc_put(d); 283 } 284 285 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d) 286 { 287 BT_DBG("%p", d); 288 289 d->state = BT_OPEN; 290 d->flags = 0; 291 d->mscex = 0; 292 d->sec_level = BT_SECURITY_LOW; 293 d->mtu = RFCOMM_DEFAULT_MTU; 294 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV; 295 296 d->cfc = RFCOMM_CFC_DISABLED; 297 d->rx_credits = RFCOMM_DEFAULT_CREDITS; 298 } 299 300 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio) 301 { 302 struct rfcomm_dlc *d = kzalloc_obj(*d, prio); 303 304 if (!d) 305 return NULL; 306 307 timer_setup(&d->timer, rfcomm_dlc_timeout, 0); 308 309 skb_queue_head_init(&d->tx_queue); 310 mutex_init(&d->lock); 311 refcount_set(&d->refcnt, 1); 312 313 rfcomm_dlc_clear_state(d); 314 315 BT_DBG("%p", d); 316 317 return d; 318 } 319 320 void rfcomm_dlc_free(struct rfcomm_dlc *d) 321 { 322 BT_DBG("%p", d); 323 324 skb_queue_purge(&d->tx_queue); 325 kfree(d); 326 } 327 328 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d) 329 { 330 BT_DBG("dlc %p session %p", d, s); 331 332 rfcomm_session_clear_timer(s); 333 rfcomm_dlc_hold(d); 334 list_add(&d->list, &s->dlcs); 335 d->session = s; 336 } 337 338 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d) 339 { 340 struct rfcomm_session *s = d->session; 341 342 BT_DBG("dlc %p refcnt %d session %p", d, refcount_read(&d->refcnt), s); 343 344 list_del(&d->list); 345 d->session = NULL; 346 rfcomm_dlc_put(d); 347 348 if (list_empty(&s->dlcs)) 349 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT); 350 } 351 352 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci) 353 { 354 struct rfcomm_dlc *d; 355 356 list_for_each_entry(d, &s->dlcs, list) 357 if (d->dlci == dlci) 358 return d; 359 360 return NULL; 361 } 362 363 static int rfcomm_check_channel(u8 channel) 364 { 365 return channel < 1 || channel > 30; 366 } 367 368 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel) 369 { 370 struct rfcomm_session *s; 371 int err = 0; 372 u8 dlci; 373 374 BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d", 375 d, d->state, src, dst, channel); 376 377 if (rfcomm_check_channel(channel)) 378 return -EINVAL; 379 380 if (d->state != BT_OPEN && d->state != BT_CLOSED) 381 return 0; 382 383 s = rfcomm_session_get(src, dst); 384 if (!s) { 385 s = rfcomm_session_create(src, dst, d->sec_level, &err); 386 if (!s) 387 return err; 388 } 389 390 dlci = __dlci(__session_dir(s), channel); 391 392 /* Check if DLCI already exists */ 393 if (rfcomm_dlc_get(s, dlci)) 394 return -EBUSY; 395 396 rfcomm_dlc_clear_state(d); 397 398 d->dlci = dlci; 399 d->addr = __addr(s->initiator, dlci); 400 d->priority = 7; 401 402 d->state = BT_CONFIG; 403 rfcomm_dlc_link(s, d); 404 405 d->out = 1; 406 407 d->mtu = s->mtu; 408 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc; 409 410 if (s->state == BT_CONNECTED) { 411 if (rfcomm_check_security(d)) 412 rfcomm_send_pn(s, 1, d); 413 else 414 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 415 } 416 417 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT); 418 419 return 0; 420 } 421 422 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel) 423 { 424 int r; 425 426 rfcomm_lock(); 427 428 r = __rfcomm_dlc_open(d, src, dst, channel); 429 430 rfcomm_unlock(); 431 return r; 432 } 433 434 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d) 435 { 436 struct rfcomm_session *s = d->session; 437 438 d->state = BT_DISCONN; 439 if (skb_queue_empty(&d->tx_queue)) { 440 rfcomm_send_disc(s, d->dlci); 441 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT); 442 } else { 443 rfcomm_queue_disc(d); 444 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2); 445 } 446 } 447 448 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err) 449 { 450 struct rfcomm_session *s = d->session; 451 if (!s) 452 return 0; 453 454 BT_DBG("dlc %p state %ld dlci %d err %d session %p", 455 d, d->state, d->dlci, err, s); 456 457 switch (d->state) { 458 case BT_CONNECT: 459 case BT_CONFIG: 460 case BT_OPEN: 461 case BT_CONNECT2: 462 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 463 set_bit(RFCOMM_AUTH_REJECT, &d->flags); 464 rfcomm_schedule(); 465 return 0; 466 } 467 } 468 469 switch (d->state) { 470 case BT_CONNECT: 471 case BT_CONNECTED: 472 __rfcomm_dlc_disconn(d); 473 break; 474 475 case BT_CONFIG: 476 if (s->state != BT_BOUND) { 477 __rfcomm_dlc_disconn(d); 478 break; 479 } 480 /* if closing a dlc in a session that hasn't been started, 481 * just close and unlink the dlc 482 */ 483 fallthrough; 484 485 default: 486 rfcomm_dlc_clear_timer(d); 487 488 rfcomm_dlc_lock(d); 489 d->state = BT_CLOSED; 490 d->state_change(d, err); 491 rfcomm_dlc_unlock(d); 492 493 skb_queue_purge(&d->tx_queue); 494 rfcomm_dlc_unlink(d); 495 } 496 497 return 0; 498 } 499 500 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err) 501 { 502 int r = 0; 503 struct rfcomm_dlc *d_list; 504 struct rfcomm_session *s, *s_list; 505 506 BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err); 507 508 rfcomm_lock(); 509 510 s = d->session; 511 if (!s) 512 goto no_session; 513 514 /* after waiting on the mutex check the session still exists 515 * then check the dlc still exists 516 */ 517 list_for_each_entry(s_list, &session_list, list) { 518 if (s_list == s) { 519 list_for_each_entry(d_list, &s->dlcs, list) { 520 if (d_list == d) { 521 r = __rfcomm_dlc_close(d, err); 522 break; 523 } 524 } 525 break; 526 } 527 } 528 529 no_session: 530 rfcomm_unlock(); 531 return r; 532 } 533 534 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel) 535 { 536 struct rfcomm_session *s; 537 struct rfcomm_dlc *dlc = NULL; 538 u8 dlci; 539 540 if (rfcomm_check_channel(channel)) 541 return ERR_PTR(-EINVAL); 542 543 rfcomm_lock(); 544 s = rfcomm_session_get(src, dst); 545 if (s) { 546 dlci = __dlci(__session_dir(s), channel); 547 dlc = rfcomm_dlc_get(s, dlci); 548 } 549 rfcomm_unlock(); 550 return dlc; 551 } 552 553 static int rfcomm_dlc_send_frag(struct rfcomm_dlc *d, struct sk_buff *frag) 554 { 555 int len = frag->len; 556 557 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); 558 559 if (len > d->mtu) 560 return -EINVAL; 561 562 rfcomm_make_uih(frag, d->addr); 563 __skb_queue_tail(&d->tx_queue, frag); 564 565 return len; 566 } 567 568 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb) 569 { 570 unsigned long flags; 571 struct sk_buff *frag, *next; 572 int len; 573 574 if (d->state != BT_CONNECTED) 575 return -ENOTCONN; 576 577 frag = skb_shinfo(skb)->frag_list; 578 skb_shinfo(skb)->frag_list = NULL; 579 580 /* Queue all fragments atomically. */ 581 spin_lock_irqsave(&d->tx_queue.lock, flags); 582 583 len = rfcomm_dlc_send_frag(d, skb); 584 if (len < 0 || !frag) 585 goto unlock; 586 587 for (; frag; frag = next) { 588 int ret; 589 590 next = frag->next; 591 592 ret = rfcomm_dlc_send_frag(d, frag); 593 if (ret < 0) { 594 dev_kfree_skb_irq(frag); 595 goto unlock; 596 } 597 598 len += ret; 599 } 600 601 unlock: 602 spin_unlock_irqrestore(&d->tx_queue.lock, flags); 603 604 if (len > 0 && !test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 605 rfcomm_schedule(); 606 return len; 607 } 608 609 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb) 610 { 611 int len = skb->len; 612 613 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); 614 615 rfcomm_make_uih(skb, d->addr); 616 skb_queue_tail(&d->tx_queue, skb); 617 618 if (d->state == BT_CONNECTED && 619 !test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 620 rfcomm_schedule(); 621 } 622 623 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d) 624 { 625 BT_DBG("dlc %p state %ld", d, d->state); 626 627 if (!d->cfc) { 628 d->v24_sig |= RFCOMM_V24_FC; 629 set_bit(RFCOMM_MSC_PENDING, &d->flags); 630 } 631 rfcomm_schedule(); 632 } 633 634 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d) 635 { 636 BT_DBG("dlc %p state %ld", d, d->state); 637 638 if (!d->cfc) { 639 d->v24_sig &= ~RFCOMM_V24_FC; 640 set_bit(RFCOMM_MSC_PENDING, &d->flags); 641 } 642 rfcomm_schedule(); 643 } 644 645 /* 646 Set/get modem status functions use _local_ status i.e. what we report 647 to the other side. 648 Remote status is provided by dlc->modem_status() callback. 649 */ 650 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig) 651 { 652 BT_DBG("dlc %p state %ld v24_sig 0x%x", 653 d, d->state, v24_sig); 654 655 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags)) 656 v24_sig |= RFCOMM_V24_FC; 657 else 658 v24_sig &= ~RFCOMM_V24_FC; 659 660 d->v24_sig = v24_sig; 661 662 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags)) 663 rfcomm_schedule(); 664 665 return 0; 666 } 667 668 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig) 669 { 670 BT_DBG("dlc %p state %ld v24_sig 0x%x", 671 d, d->state, d->v24_sig); 672 673 *v24_sig = d->v24_sig; 674 return 0; 675 } 676 677 /* ---- RFCOMM sessions ---- */ 678 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state) 679 { 680 struct rfcomm_session *s = kzalloc_obj(*s); 681 682 if (!s) 683 return NULL; 684 685 BT_DBG("session %p sock %p", s, sock); 686 687 timer_setup(&s->timer, rfcomm_session_timeout, 0); 688 689 INIT_LIST_HEAD(&s->dlcs); 690 s->state = state; 691 s->sock = sock; 692 693 s->mtu = RFCOMM_DEFAULT_MTU; 694 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN; 695 696 /* Do not increment module usage count for listening sessions. 697 * Otherwise we won't be able to unload the module. */ 698 if (state != BT_LISTEN) 699 if (!try_module_get(THIS_MODULE)) { 700 kfree(s); 701 return NULL; 702 } 703 704 list_add(&s->list, &session_list); 705 706 return s; 707 } 708 709 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s) 710 { 711 int state = s->state; 712 713 BT_DBG("session %p state %ld", s, s->state); 714 715 list_del(&s->list); 716 717 rfcomm_session_clear_timer(s); 718 sock_release(s->sock); 719 kfree(s); 720 721 if (state != BT_LISTEN) 722 module_put(THIS_MODULE); 723 724 return NULL; 725 } 726 727 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst) 728 { 729 struct rfcomm_session *s, *n; 730 struct l2cap_chan *chan; 731 list_for_each_entry_safe(s, n, &session_list, list) { 732 chan = l2cap_pi(s->sock->sk)->chan; 733 734 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) && 735 !bacmp(&chan->dst, dst)) 736 return s; 737 } 738 return NULL; 739 } 740 741 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s, 742 int err) 743 { 744 struct rfcomm_dlc *d, *n; 745 746 s->state = BT_CLOSED; 747 748 BT_DBG("session %p state %ld err %d", s, s->state, err); 749 750 /* Close all dlcs */ 751 list_for_each_entry_safe(d, n, &s->dlcs, list) { 752 d->state = BT_CLOSED; 753 __rfcomm_dlc_close(d, err); 754 } 755 756 rfcomm_session_clear_timer(s); 757 return rfcomm_session_del(s); 758 } 759 760 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, 761 bdaddr_t *dst, 762 u8 sec_level, 763 int *err) 764 { 765 struct rfcomm_session *s = NULL; 766 struct sockaddr_l2 addr; 767 struct socket *sock; 768 struct sock *sk; 769 770 BT_DBG("%pMR -> %pMR", src, dst); 771 772 *err = rfcomm_l2sock_create(&sock); 773 if (*err < 0) 774 return NULL; 775 776 bacpy(&addr.l2_bdaddr, src); 777 addr.l2_family = AF_BLUETOOTH; 778 addr.l2_psm = 0; 779 addr.l2_cid = 0; 780 addr.l2_bdaddr_type = BDADDR_BREDR; 781 *err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr)); 782 if (*err < 0) 783 goto failed; 784 785 /* Set L2CAP options */ 786 sk = sock->sk; 787 lock_sock(sk); 788 /* Set MTU to 0 so L2CAP can auto select the MTU */ 789 l2cap_pi(sk)->chan->imtu = 0; 790 l2cap_pi(sk)->chan->sec_level = sec_level; 791 if (l2cap_ertm) 792 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM; 793 release_sock(sk); 794 795 s = rfcomm_session_add(sock, BT_BOUND); 796 if (!s) { 797 *err = -ENOMEM; 798 goto failed; 799 } 800 801 s->initiator = 1; 802 803 bacpy(&addr.l2_bdaddr, dst); 804 addr.l2_family = AF_BLUETOOTH; 805 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM); 806 addr.l2_cid = 0; 807 addr.l2_bdaddr_type = BDADDR_BREDR; 808 *err = kernel_connect(sock, (struct sockaddr_unsized *)&addr, sizeof(addr), O_NONBLOCK); 809 if (*err == 0 || *err == -EINPROGRESS) 810 return s; 811 812 return rfcomm_session_del(s); 813 814 failed: 815 sock_release(sock); 816 return NULL; 817 } 818 819 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst) 820 { 821 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan; 822 if (src) 823 bacpy(src, &chan->src); 824 if (dst) 825 bacpy(dst, &chan->dst); 826 } 827 828 /* ---- RFCOMM frame sending ---- */ 829 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len) 830 { 831 struct kvec iv = { data, len }; 832 struct msghdr msg; 833 834 BT_DBG("session %p len %d", s, len); 835 836 memset(&msg, 0, sizeof(msg)); 837 838 return kernel_sendmsg(s->sock, &msg, &iv, 1, len); 839 } 840 841 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd) 842 { 843 BT_DBG("%p cmd %u", s, cmd->ctrl); 844 845 return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd)); 846 } 847 848 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci) 849 { 850 struct rfcomm_cmd cmd; 851 852 BT_DBG("%p dlci %d", s, dlci); 853 854 cmd.addr = __addr(s->initiator, dlci); 855 cmd.ctrl = __ctrl(RFCOMM_SABM, 1); 856 cmd.len = __len8(0); 857 cmd.fcs = __fcs2((u8 *) &cmd); 858 859 return rfcomm_send_cmd(s, &cmd); 860 } 861 862 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci) 863 { 864 struct rfcomm_cmd cmd; 865 866 BT_DBG("%p dlci %d", s, dlci); 867 868 cmd.addr = __addr(!s->initiator, dlci); 869 cmd.ctrl = __ctrl(RFCOMM_UA, 1); 870 cmd.len = __len8(0); 871 cmd.fcs = __fcs2((u8 *) &cmd); 872 873 return rfcomm_send_cmd(s, &cmd); 874 } 875 876 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci) 877 { 878 struct rfcomm_cmd cmd; 879 880 BT_DBG("%p dlci %d", s, dlci); 881 882 cmd.addr = __addr(s->initiator, dlci); 883 cmd.ctrl = __ctrl(RFCOMM_DISC, 1); 884 cmd.len = __len8(0); 885 cmd.fcs = __fcs2((u8 *) &cmd); 886 887 return rfcomm_send_cmd(s, &cmd); 888 } 889 890 static int rfcomm_queue_disc(struct rfcomm_dlc *d) 891 { 892 struct rfcomm_cmd *cmd; 893 struct sk_buff *skb; 894 895 BT_DBG("dlc %p dlci %d", d, d->dlci); 896 897 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL); 898 if (!skb) 899 return -ENOMEM; 900 901 cmd = __skb_put(skb, sizeof(*cmd)); 902 cmd->addr = d->addr; 903 cmd->ctrl = __ctrl(RFCOMM_DISC, 1); 904 cmd->len = __len8(0); 905 cmd->fcs = __fcs2((u8 *) cmd); 906 907 skb_queue_tail(&d->tx_queue, skb); 908 rfcomm_schedule(); 909 return 0; 910 } 911 912 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci) 913 { 914 struct rfcomm_cmd cmd; 915 916 BT_DBG("%p dlci %d", s, dlci); 917 918 cmd.addr = __addr(!s->initiator, dlci); 919 cmd.ctrl = __ctrl(RFCOMM_DM, 1); 920 cmd.len = __len8(0); 921 cmd.fcs = __fcs2((u8 *) &cmd); 922 923 return rfcomm_send_cmd(s, &cmd); 924 } 925 926 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type) 927 { 928 struct rfcomm_hdr *hdr; 929 struct rfcomm_mcc *mcc; 930 u8 buf[16], *ptr = buf; 931 932 BT_DBG("%p cr %d type %d", s, cr, type); 933 934 hdr = (void *) ptr; ptr += sizeof(*hdr); 935 hdr->addr = __addr(s->initiator, 0); 936 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 937 hdr->len = __len8(sizeof(*mcc) + 1); 938 939 mcc = (void *) ptr; ptr += sizeof(*mcc); 940 mcc->type = __mcc_type(0, RFCOMM_NSC); 941 mcc->len = __len8(1); 942 943 /* Type that we didn't like */ 944 *ptr = __mcc_type(cr, type); ptr++; 945 946 *ptr = __fcs(buf); ptr++; 947 948 return rfcomm_send_frame(s, buf, ptr - buf); 949 } 950 951 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d) 952 { 953 struct rfcomm_hdr *hdr; 954 struct rfcomm_mcc *mcc; 955 struct rfcomm_pn *pn; 956 u8 buf[16], *ptr = buf; 957 958 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu); 959 960 hdr = (void *) ptr; ptr += sizeof(*hdr); 961 hdr->addr = __addr(s->initiator, 0); 962 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 963 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn)); 964 965 mcc = (void *) ptr; ptr += sizeof(*mcc); 966 mcc->type = __mcc_type(cr, RFCOMM_PN); 967 mcc->len = __len8(sizeof(*pn)); 968 969 pn = (void *) ptr; ptr += sizeof(*pn); 970 pn->dlci = d->dlci; 971 pn->priority = d->priority; 972 pn->ack_timer = 0; 973 pn->max_retrans = 0; 974 975 if (s->cfc) { 976 pn->flow_ctrl = cr ? 0xf0 : 0xe0; 977 pn->credits = RFCOMM_DEFAULT_CREDITS; 978 } else { 979 pn->flow_ctrl = 0; 980 pn->credits = 0; 981 } 982 983 if (cr && channel_mtu >= 0) 984 pn->mtu = cpu_to_le16(channel_mtu); 985 else 986 pn->mtu = cpu_to_le16(d->mtu); 987 988 *ptr = __fcs(buf); ptr++; 989 990 return rfcomm_send_frame(s, buf, ptr - buf); 991 } 992 993 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci, 994 u8 bit_rate, u8 data_bits, u8 stop_bits, 995 u8 parity, u8 flow_ctrl_settings, 996 u8 xon_char, u8 xoff_char, u16 param_mask) 997 { 998 struct rfcomm_hdr *hdr; 999 struct rfcomm_mcc *mcc; 1000 struct rfcomm_rpn *rpn; 1001 u8 buf[16], *ptr = buf; 1002 1003 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x" 1004 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x", 1005 s, cr, dlci, bit_rate, data_bits, stop_bits, parity, 1006 flow_ctrl_settings, xon_char, xoff_char, param_mask); 1007 1008 hdr = (void *) ptr; ptr += sizeof(*hdr); 1009 hdr->addr = __addr(s->initiator, 0); 1010 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1011 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn)); 1012 1013 mcc = (void *) ptr; ptr += sizeof(*mcc); 1014 mcc->type = __mcc_type(cr, RFCOMM_RPN); 1015 mcc->len = __len8(sizeof(*rpn)); 1016 1017 rpn = (void *) ptr; ptr += sizeof(*rpn); 1018 rpn->dlci = __addr(1, dlci); 1019 rpn->bit_rate = bit_rate; 1020 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity); 1021 rpn->flow_ctrl = flow_ctrl_settings; 1022 rpn->xon_char = xon_char; 1023 rpn->xoff_char = xoff_char; 1024 rpn->param_mask = cpu_to_le16(param_mask); 1025 1026 *ptr = __fcs(buf); ptr++; 1027 1028 return rfcomm_send_frame(s, buf, ptr - buf); 1029 } 1030 1031 int rfcomm_dlc_send_rpn(struct rfcomm_dlc *d, u8 bit_rate, u8 data_bits, 1032 u8 stop_bits, u8 parity, u8 flow_ctrl_settings, 1033 u8 xon_char, u8 xoff_char, u16 param_mask) 1034 { 1035 int err = -ENOTCONN; 1036 1037 rfcomm_lock(); 1038 if (d->session) 1039 err = rfcomm_send_rpn(d->session, 1, d->dlci, bit_rate, 1040 data_bits, stop_bits, parity, 1041 flow_ctrl_settings, xon_char, xoff_char, 1042 param_mask); 1043 rfcomm_unlock(); 1044 1045 return err; 1046 } 1047 1048 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status) 1049 { 1050 struct rfcomm_hdr *hdr; 1051 struct rfcomm_mcc *mcc; 1052 struct rfcomm_rls *rls; 1053 u8 buf[16], *ptr = buf; 1054 1055 BT_DBG("%p cr %d status 0x%x", s, cr, status); 1056 1057 hdr = (void *) ptr; ptr += sizeof(*hdr); 1058 hdr->addr = __addr(s->initiator, 0); 1059 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1060 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls)); 1061 1062 mcc = (void *) ptr; ptr += sizeof(*mcc); 1063 mcc->type = __mcc_type(cr, RFCOMM_RLS); 1064 mcc->len = __len8(sizeof(*rls)); 1065 1066 rls = (void *) ptr; ptr += sizeof(*rls); 1067 rls->dlci = __addr(1, dlci); 1068 rls->status = status; 1069 1070 *ptr = __fcs(buf); ptr++; 1071 1072 return rfcomm_send_frame(s, buf, ptr - buf); 1073 } 1074 1075 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig) 1076 { 1077 struct rfcomm_hdr *hdr; 1078 struct rfcomm_mcc *mcc; 1079 struct rfcomm_msc *msc; 1080 u8 buf[16], *ptr = buf; 1081 1082 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig); 1083 1084 hdr = (void *) ptr; ptr += sizeof(*hdr); 1085 hdr->addr = __addr(s->initiator, 0); 1086 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1087 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc)); 1088 1089 mcc = (void *) ptr; ptr += sizeof(*mcc); 1090 mcc->type = __mcc_type(cr, RFCOMM_MSC); 1091 mcc->len = __len8(sizeof(*msc)); 1092 1093 msc = (void *) ptr; ptr += sizeof(*msc); 1094 msc->dlci = __addr(1, dlci); 1095 msc->v24_sig = v24_sig | 0x01; 1096 1097 *ptr = __fcs(buf); ptr++; 1098 1099 return rfcomm_send_frame(s, buf, ptr - buf); 1100 } 1101 1102 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr) 1103 { 1104 struct rfcomm_hdr *hdr; 1105 struct rfcomm_mcc *mcc; 1106 u8 buf[16], *ptr = buf; 1107 1108 BT_DBG("%p cr %d", s, cr); 1109 1110 hdr = (void *) ptr; ptr += sizeof(*hdr); 1111 hdr->addr = __addr(s->initiator, 0); 1112 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1113 hdr->len = __len8(sizeof(*mcc)); 1114 1115 mcc = (void *) ptr; ptr += sizeof(*mcc); 1116 mcc->type = __mcc_type(cr, RFCOMM_FCOFF); 1117 mcc->len = __len8(0); 1118 1119 *ptr = __fcs(buf); ptr++; 1120 1121 return rfcomm_send_frame(s, buf, ptr - buf); 1122 } 1123 1124 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr) 1125 { 1126 struct rfcomm_hdr *hdr; 1127 struct rfcomm_mcc *mcc; 1128 u8 buf[16], *ptr = buf; 1129 1130 BT_DBG("%p cr %d", s, cr); 1131 1132 hdr = (void *) ptr; ptr += sizeof(*hdr); 1133 hdr->addr = __addr(s->initiator, 0); 1134 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1135 hdr->len = __len8(sizeof(*mcc)); 1136 1137 mcc = (void *) ptr; ptr += sizeof(*mcc); 1138 mcc->type = __mcc_type(cr, RFCOMM_FCON); 1139 mcc->len = __len8(0); 1140 1141 *ptr = __fcs(buf); ptr++; 1142 1143 return rfcomm_send_frame(s, buf, ptr - buf); 1144 } 1145 1146 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len) 1147 { 1148 struct socket *sock = s->sock; 1149 struct kvec iv[3]; 1150 struct msghdr msg; 1151 unsigned char hdr[5], crc[1]; 1152 1153 if (len > 125) 1154 return -EINVAL; 1155 1156 BT_DBG("%p cr %d", s, cr); 1157 1158 hdr[0] = __addr(s->initiator, 0); 1159 hdr[1] = __ctrl(RFCOMM_UIH, 0); 1160 hdr[2] = 0x01 | ((len + 2) << 1); 1161 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2); 1162 hdr[4] = 0x01 | (len << 1); 1163 1164 crc[0] = __fcs(hdr); 1165 1166 iv[0].iov_base = hdr; 1167 iv[0].iov_len = 5; 1168 iv[1].iov_base = pattern; 1169 iv[1].iov_len = len; 1170 iv[2].iov_base = crc; 1171 iv[2].iov_len = 1; 1172 1173 memset(&msg, 0, sizeof(msg)); 1174 1175 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len); 1176 } 1177 1178 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits) 1179 { 1180 struct rfcomm_hdr *hdr; 1181 u8 buf[16], *ptr = buf; 1182 1183 BT_DBG("%p addr %d credits %d", s, addr, credits); 1184 1185 hdr = (void *) ptr; ptr += sizeof(*hdr); 1186 hdr->addr = addr; 1187 hdr->ctrl = __ctrl(RFCOMM_UIH, 1); 1188 hdr->len = __len8(0); 1189 1190 *ptr = credits; ptr++; 1191 1192 *ptr = __fcs(buf); ptr++; 1193 1194 return rfcomm_send_frame(s, buf, ptr - buf); 1195 } 1196 1197 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr) 1198 { 1199 struct rfcomm_hdr *hdr; 1200 int len = skb->len; 1201 u8 *crc; 1202 1203 if (len > 127) { 1204 hdr = skb_push(skb, 4); 1205 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len); 1206 } else { 1207 hdr = skb_push(skb, 3); 1208 hdr->len = __len8(len); 1209 } 1210 hdr->addr = addr; 1211 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1212 1213 crc = skb_put(skb, 1); 1214 *crc = __fcs((void *) hdr); 1215 } 1216 1217 /* ---- RFCOMM frame reception ---- */ 1218 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci) 1219 { 1220 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1221 1222 if (dlci) { 1223 /* Data channel */ 1224 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1225 if (!d) { 1226 rfcomm_send_dm(s, dlci); 1227 return s; 1228 } 1229 1230 switch (d->state) { 1231 case BT_CONNECT: 1232 rfcomm_dlc_clear_timer(d); 1233 1234 rfcomm_dlc_lock(d); 1235 d->state = BT_CONNECTED; 1236 d->state_change(d, 0); 1237 rfcomm_dlc_unlock(d); 1238 1239 rfcomm_send_msc(s, 1, dlci, d->v24_sig); 1240 break; 1241 1242 case BT_DISCONN: 1243 d->state = BT_CLOSED; 1244 __rfcomm_dlc_close(d, 0); 1245 1246 if (list_empty(&s->dlcs)) { 1247 s->state = BT_DISCONN; 1248 rfcomm_send_disc(s, 0); 1249 rfcomm_session_clear_timer(s); 1250 } 1251 1252 break; 1253 } 1254 } else { 1255 /* Control channel */ 1256 switch (s->state) { 1257 case BT_CONNECT: 1258 s->state = BT_CONNECTED; 1259 rfcomm_process_connect(s); 1260 break; 1261 1262 case BT_DISCONN: 1263 s = rfcomm_session_close(s, ECONNRESET); 1264 break; 1265 } 1266 } 1267 return s; 1268 } 1269 1270 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci) 1271 { 1272 int err = 0; 1273 1274 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1275 1276 if (dlci) { 1277 /* Data DLC */ 1278 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1279 if (d) { 1280 if (d->state == BT_CONNECT || d->state == BT_CONFIG) 1281 err = ECONNREFUSED; 1282 else 1283 err = ECONNRESET; 1284 1285 d->state = BT_CLOSED; 1286 __rfcomm_dlc_close(d, err); 1287 } 1288 } else { 1289 if (s->state == BT_CONNECT) 1290 err = ECONNREFUSED; 1291 else 1292 err = ECONNRESET; 1293 1294 s = rfcomm_session_close(s, err); 1295 } 1296 return s; 1297 } 1298 1299 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s, 1300 u8 dlci) 1301 { 1302 int err = 0; 1303 1304 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1305 1306 if (dlci) { 1307 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1308 if (d) { 1309 rfcomm_send_ua(s, dlci); 1310 1311 if (d->state == BT_CONNECT || d->state == BT_CONFIG) 1312 err = ECONNREFUSED; 1313 else 1314 err = ECONNRESET; 1315 1316 d->state = BT_CLOSED; 1317 __rfcomm_dlc_close(d, err); 1318 } else 1319 rfcomm_send_dm(s, dlci); 1320 1321 } else { 1322 rfcomm_send_ua(s, 0); 1323 1324 if (s->state == BT_CONNECT) 1325 err = ECONNREFUSED; 1326 else 1327 err = ECONNRESET; 1328 1329 s = rfcomm_session_close(s, err); 1330 } 1331 return s; 1332 } 1333 1334 /* Must be called with rfcomm_mutex held, so that the session cannot be 1335 * unlinked from under us. 1336 */ 1337 static void __rfcomm_dlc_accept(struct rfcomm_dlc *d) 1338 { 1339 struct sock *sk = d->session->sock->sk; 1340 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 1341 1342 BT_DBG("dlc %p", d); 1343 1344 rfcomm_send_ua(d->session, d->dlci); 1345 1346 rfcomm_dlc_clear_timer(d); 1347 1348 rfcomm_dlc_lock(d); 1349 d->state = BT_CONNECTED; 1350 d->state_change(d, 0); 1351 rfcomm_dlc_unlock(d); 1352 1353 if (d->role_switch) 1354 hci_conn_switch_role(conn->hcon, 0x00); 1355 1356 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 1357 } 1358 1359 void rfcomm_dlc_accept(struct rfcomm_dlc *d) 1360 { 1361 rfcomm_lock(); 1362 1363 /* rfcomm_recv_disc() sets the dlc state to BT_CLOSED before calling 1364 * __rfcomm_dlc_close(), so the RFCOMM_DEFER_SETUP handshake there is 1365 * skipped and the session can already be unlinked by the time the 1366 * deferred accept runs from rfcomm_sock_recvmsg(). 1367 */ 1368 if (d->session) 1369 __rfcomm_dlc_accept(d); 1370 1371 rfcomm_unlock(); 1372 } 1373 1374 static void rfcomm_check_accept(struct rfcomm_dlc *d) 1375 { 1376 if (rfcomm_check_security(d)) { 1377 if (d->defer_setup) { 1378 set_bit(RFCOMM_DEFER_SETUP, &d->flags); 1379 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1380 1381 rfcomm_dlc_lock(d); 1382 d->state = BT_CONNECT2; 1383 d->state_change(d, 0); 1384 rfcomm_dlc_unlock(d); 1385 } else 1386 __rfcomm_dlc_accept(d); 1387 } else { 1388 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 1389 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1390 } 1391 } 1392 1393 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci) 1394 { 1395 struct rfcomm_dlc *d; 1396 u8 channel; 1397 1398 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1399 1400 if (!dlci) { 1401 rfcomm_send_ua(s, 0); 1402 1403 if (s->state == BT_OPEN) { 1404 s->state = BT_CONNECTED; 1405 rfcomm_process_connect(s); 1406 } 1407 return 0; 1408 } 1409 1410 /* Check if DLC exists */ 1411 d = rfcomm_dlc_get(s, dlci); 1412 if (d) { 1413 if (d->state == BT_OPEN) { 1414 /* DLC was previously opened by PN request */ 1415 rfcomm_check_accept(d); 1416 } 1417 return 0; 1418 } 1419 1420 /* Notify socket layer about incoming connection */ 1421 channel = __srv_channel(dlci); 1422 if (rfcomm_connect_ind(s, channel, &d)) { 1423 d->dlci = dlci; 1424 d->addr = __addr(s->initiator, dlci); 1425 rfcomm_dlc_link(s, d); 1426 1427 rfcomm_check_accept(d); 1428 } else { 1429 rfcomm_send_dm(s, dlci); 1430 } 1431 1432 return 0; 1433 } 1434 1435 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn) 1436 { 1437 struct rfcomm_session *s = d->session; 1438 1439 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d", 1440 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits); 1441 1442 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) || 1443 pn->flow_ctrl == 0xe0) { 1444 d->cfc = RFCOMM_CFC_ENABLED; 1445 d->tx_credits = pn->credits; 1446 } else { 1447 d->cfc = RFCOMM_CFC_DISABLED; 1448 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1449 } 1450 1451 if (s->cfc == RFCOMM_CFC_UNKNOWN) 1452 s->cfc = d->cfc; 1453 1454 d->priority = pn->priority; 1455 1456 d->mtu = __le16_to_cpu(pn->mtu); 1457 1458 /* MTU 0 causes an infinite loop when fragmenting in sendmsg */ 1459 if (!d->mtu) 1460 d->mtu = RFCOMM_DEFAULT_MTU; 1461 1462 if (cr && d->mtu > s->mtu) 1463 d->mtu = s->mtu; 1464 1465 return 0; 1466 } 1467 1468 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1469 { 1470 struct rfcomm_pn *pn; 1471 struct rfcomm_dlc *d; 1472 u8 dlci; 1473 1474 pn = skb_pull_data(skb, sizeof(*pn)); 1475 if (!pn) 1476 return -EILSEQ; 1477 1478 dlci = pn->dlci; 1479 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1480 1481 if (!dlci) 1482 return 0; 1483 1484 d = rfcomm_dlc_get(s, dlci); 1485 if (d) { 1486 if (cr) { 1487 /* PN request */ 1488 rfcomm_apply_pn(d, cr, pn); 1489 rfcomm_send_pn(s, 0, d); 1490 } else { 1491 /* PN response */ 1492 switch (d->state) { 1493 case BT_CONFIG: 1494 rfcomm_apply_pn(d, cr, pn); 1495 1496 d->state = BT_CONNECT; 1497 rfcomm_send_sabm(s, d->dlci); 1498 break; 1499 } 1500 } 1501 } else { 1502 u8 channel = __srv_channel(dlci); 1503 1504 if (!cr) 1505 return 0; 1506 1507 /* PN request for non existing DLC. 1508 * Assume incoming connection. */ 1509 if (rfcomm_connect_ind(s, channel, &d)) { 1510 d->dlci = dlci; 1511 d->addr = __addr(s->initiator, dlci); 1512 rfcomm_dlc_link(s, d); 1513 1514 rfcomm_apply_pn(d, cr, pn); 1515 1516 d->state = BT_OPEN; 1517 rfcomm_send_pn(s, 0, d); 1518 } else { 1519 rfcomm_send_dm(s, dlci); 1520 } 1521 } 1522 return 0; 1523 } 1524 1525 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb) 1526 { 1527 struct rfcomm_rpn *rpn; 1528 u8 dlci; 1529 1530 u8 bit_rate = 0; 1531 u8 data_bits = 0; 1532 u8 stop_bits = 0; 1533 u8 parity = 0; 1534 u8 flow_ctrl = 0; 1535 u8 xon_char = 0; 1536 u8 xoff_char = 0; 1537 u16 rpn_mask = RFCOMM_RPN_PM_ALL; 1538 1539 if (len == 1) { 1540 rpn = skb_pull_data(skb, 1); 1541 if (!rpn) 1542 return -EILSEQ; 1543 1544 dlci = __get_dlci(rpn->dlci); 1545 1546 if (!cr) 1547 return 0; 1548 1549 bit_rate = RFCOMM_RPN_BR_9600; 1550 data_bits = RFCOMM_RPN_DATA_8; 1551 stop_bits = RFCOMM_RPN_STOP_1; 1552 parity = RFCOMM_RPN_PARITY_NONE; 1553 flow_ctrl = RFCOMM_RPN_FLOW_NONE; 1554 xon_char = RFCOMM_RPN_XON_CHAR; 1555 xoff_char = RFCOMM_RPN_XOFF_CHAR; 1556 goto rpn_out; 1557 } 1558 1559 rpn = skb_pull_data(skb, sizeof(*rpn)); 1560 if (!rpn) 1561 return -EILSEQ; 1562 1563 dlci = __get_dlci(rpn->dlci); 1564 1565 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x", 1566 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl, 1567 rpn->xon_char, rpn->xoff_char, rpn->param_mask); 1568 1569 if (!cr) 1570 return 0; 1571 1572 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit, 1573 * no parity, no flow control lines, normal XON/XOFF chars */ 1574 1575 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) { 1576 bit_rate = rpn->bit_rate; 1577 if (bit_rate > RFCOMM_RPN_BR_230400) { 1578 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate); 1579 bit_rate = RFCOMM_RPN_BR_9600; 1580 rpn_mask ^= RFCOMM_RPN_PM_BITRATE; 1581 } 1582 } 1583 1584 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) { 1585 data_bits = __get_rpn_data_bits(rpn->line_settings); 1586 if (data_bits != RFCOMM_RPN_DATA_8) { 1587 BT_DBG("RPN data bits mismatch 0x%x", data_bits); 1588 data_bits = RFCOMM_RPN_DATA_8; 1589 rpn_mask ^= RFCOMM_RPN_PM_DATA; 1590 } 1591 } 1592 1593 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) { 1594 stop_bits = __get_rpn_stop_bits(rpn->line_settings); 1595 if (stop_bits != RFCOMM_RPN_STOP_1) { 1596 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits); 1597 stop_bits = RFCOMM_RPN_STOP_1; 1598 rpn_mask ^= RFCOMM_RPN_PM_STOP; 1599 } 1600 } 1601 1602 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) { 1603 parity = __get_rpn_parity(rpn->line_settings); 1604 if (parity != RFCOMM_RPN_PARITY_NONE) { 1605 BT_DBG("RPN parity mismatch 0x%x", parity); 1606 parity = RFCOMM_RPN_PARITY_NONE; 1607 rpn_mask ^= RFCOMM_RPN_PM_PARITY; 1608 } 1609 } 1610 1611 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) { 1612 flow_ctrl = rpn->flow_ctrl; 1613 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) { 1614 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl); 1615 flow_ctrl = RFCOMM_RPN_FLOW_NONE; 1616 rpn_mask ^= RFCOMM_RPN_PM_FLOW; 1617 } 1618 } 1619 1620 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) { 1621 xon_char = rpn->xon_char; 1622 if (xon_char != RFCOMM_RPN_XON_CHAR) { 1623 BT_DBG("RPN XON char mismatch 0x%x", xon_char); 1624 xon_char = RFCOMM_RPN_XON_CHAR; 1625 rpn_mask ^= RFCOMM_RPN_PM_XON; 1626 } 1627 } 1628 1629 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) { 1630 xoff_char = rpn->xoff_char; 1631 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) { 1632 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char); 1633 xoff_char = RFCOMM_RPN_XOFF_CHAR; 1634 rpn_mask ^= RFCOMM_RPN_PM_XOFF; 1635 } 1636 } 1637 1638 rpn_out: 1639 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits, 1640 parity, flow_ctrl, xon_char, xoff_char, rpn_mask); 1641 1642 return 0; 1643 } 1644 1645 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1646 { 1647 struct rfcomm_rls *rls; 1648 u8 dlci; 1649 1650 rls = skb_pull_data(skb, sizeof(*rls)); 1651 if (!rls) 1652 return -EILSEQ; 1653 1654 dlci = __get_dlci(rls->dlci); 1655 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status); 1656 1657 if (!cr) 1658 return 0; 1659 1660 /* We should probably do something with this information here. But 1661 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's 1662 * mandatory to recognise and respond to RLS */ 1663 1664 rfcomm_send_rls(s, 0, dlci, rls->status); 1665 1666 return 0; 1667 } 1668 1669 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1670 { 1671 struct rfcomm_msc *msc; 1672 struct rfcomm_dlc *d; 1673 u8 dlci; 1674 1675 msc = skb_pull_data(skb, sizeof(*msc)); 1676 if (!msc) 1677 return -EILSEQ; 1678 1679 dlci = __get_dlci(msc->dlci); 1680 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig); 1681 1682 d = rfcomm_dlc_get(s, dlci); 1683 if (!d) 1684 return 0; 1685 1686 if (cr) { 1687 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc) 1688 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1689 else 1690 clear_bit(RFCOMM_TX_THROTTLED, &d->flags); 1691 1692 rfcomm_dlc_lock(d); 1693 1694 d->remote_v24_sig = msc->v24_sig; 1695 1696 if (d->modem_status) 1697 d->modem_status(d, msc->v24_sig); 1698 1699 rfcomm_dlc_unlock(d); 1700 1701 rfcomm_send_msc(s, 0, dlci, msc->v24_sig); 1702 1703 d->mscex |= RFCOMM_MSCEX_RX; 1704 } else 1705 d->mscex |= RFCOMM_MSCEX_TX; 1706 1707 return 0; 1708 } 1709 1710 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb) 1711 { 1712 struct rfcomm_mcc *mcc; 1713 u8 type, cr, len; 1714 1715 mcc = skb_pull_data(skb, sizeof(*mcc)); 1716 if (!mcc) 1717 return -EILSEQ; 1718 1719 cr = __test_cr(mcc->type); 1720 type = __get_mcc_type(mcc->type); 1721 len = __get_mcc_len(mcc->len); 1722 1723 BT_DBG("%p type 0x%x cr %d", s, type, cr); 1724 1725 switch (type) { 1726 case RFCOMM_PN: 1727 rfcomm_recv_pn(s, cr, skb); 1728 break; 1729 1730 case RFCOMM_RPN: 1731 rfcomm_recv_rpn(s, cr, len, skb); 1732 break; 1733 1734 case RFCOMM_RLS: 1735 rfcomm_recv_rls(s, cr, skb); 1736 break; 1737 1738 case RFCOMM_MSC: 1739 rfcomm_recv_msc(s, cr, skb); 1740 break; 1741 1742 case RFCOMM_FCOFF: 1743 if (cr) { 1744 set_bit(RFCOMM_TX_THROTTLED, &s->flags); 1745 rfcomm_send_fcoff(s, 0); 1746 } 1747 break; 1748 1749 case RFCOMM_FCON: 1750 if (cr) { 1751 clear_bit(RFCOMM_TX_THROTTLED, &s->flags); 1752 rfcomm_send_fcon(s, 0); 1753 } 1754 break; 1755 1756 case RFCOMM_TEST: 1757 if (cr) 1758 rfcomm_send_test(s, 0, skb->data, skb->len); 1759 break; 1760 1761 case RFCOMM_NSC: 1762 break; 1763 1764 default: 1765 BT_ERR("Unknown control type 0x%02x", type); 1766 rfcomm_send_nsc(s, cr, type); 1767 break; 1768 } 1769 return 0; 1770 } 1771 1772 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb) 1773 { 1774 struct rfcomm_dlc *d; 1775 1776 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf); 1777 1778 d = rfcomm_dlc_get(s, dlci); 1779 if (!d) { 1780 rfcomm_send_dm(s, dlci); 1781 goto drop; 1782 } 1783 1784 if (pf && d->cfc) { 1785 u8 *credits = skb_pull_data(skb, 1); 1786 1787 if (!credits) 1788 goto drop; 1789 1790 d->tx_credits += *credits; 1791 if (d->tx_credits) 1792 clear_bit(RFCOMM_TX_THROTTLED, &d->flags); 1793 } 1794 1795 if (skb->len && d->state == BT_CONNECTED) { 1796 rfcomm_dlc_lock(d); 1797 d->rx_credits--; 1798 d->data_ready(d, skb); 1799 rfcomm_dlc_unlock(d); 1800 return 0; 1801 } 1802 1803 drop: 1804 kfree_skb(skb); 1805 return 0; 1806 } 1807 1808 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s, 1809 struct sk_buff *skb) 1810 { 1811 struct rfcomm_hdr *hdr = (void *) skb->data; 1812 u8 type, dlci, fcs; 1813 1814 if (!s) { 1815 /* no session, so free socket data */ 1816 kfree_skb(skb); 1817 return s; 1818 } 1819 1820 if (skb->len < sizeof(*hdr) + 1 || 1821 (!__test_ea(hdr->len) && skb->len < sizeof(*hdr) + 2)) { 1822 kfree_skb(skb); 1823 return s; 1824 } 1825 1826 dlci = __get_dlci(hdr->addr); 1827 type = __get_type(hdr->ctrl); 1828 1829 /* Trim FCS */ 1830 skb->len--; skb->tail--; 1831 fcs = *(u8 *)skb_tail_pointer(skb); 1832 1833 if (__check_fcs(skb->data, type, fcs)) { 1834 BT_ERR("bad checksum in packet"); 1835 kfree_skb(skb); 1836 return s; 1837 } 1838 1839 if (__test_ea(hdr->len)) 1840 skb_pull(skb, 3); 1841 else 1842 skb_pull(skb, 4); 1843 1844 switch (type) { 1845 case RFCOMM_SABM: 1846 if (__test_pf(hdr->ctrl)) 1847 rfcomm_recv_sabm(s, dlci); 1848 break; 1849 1850 case RFCOMM_DISC: 1851 if (__test_pf(hdr->ctrl)) 1852 s = rfcomm_recv_disc(s, dlci); 1853 break; 1854 1855 case RFCOMM_UA: 1856 if (__test_pf(hdr->ctrl)) 1857 s = rfcomm_recv_ua(s, dlci); 1858 break; 1859 1860 case RFCOMM_DM: 1861 s = rfcomm_recv_dm(s, dlci); 1862 break; 1863 1864 case RFCOMM_UIH: 1865 if (dlci) { 1866 rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb); 1867 return s; 1868 } 1869 rfcomm_recv_mcc(s, skb); 1870 break; 1871 1872 default: 1873 BT_ERR("Unknown packet type 0x%02x", type); 1874 break; 1875 } 1876 kfree_skb(skb); 1877 return s; 1878 } 1879 1880 /* ---- Connection and data processing ---- */ 1881 1882 static void rfcomm_process_connect(struct rfcomm_session *s) 1883 { 1884 struct rfcomm_dlc *d, *n; 1885 1886 BT_DBG("session %p state %ld", s, s->state); 1887 1888 list_for_each_entry_safe(d, n, &s->dlcs, list) { 1889 if (d->state == BT_CONFIG) { 1890 d->mtu = s->mtu; 1891 if (rfcomm_check_security(d)) { 1892 rfcomm_send_pn(s, 1, d); 1893 } else { 1894 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 1895 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1896 } 1897 } 1898 } 1899 } 1900 1901 /* Send data queued for the DLC. 1902 * Return number of frames left in the queue. 1903 */ 1904 static int rfcomm_process_tx(struct rfcomm_dlc *d) 1905 { 1906 struct sk_buff *skb; 1907 int err; 1908 1909 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d", 1910 d, d->state, d->cfc, d->rx_credits, d->tx_credits); 1911 1912 /* Send pending MSC */ 1913 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags)) 1914 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 1915 1916 if (d->cfc) { 1917 /* CFC enabled. 1918 * Give them some credits */ 1919 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) && 1920 d->rx_credits <= (d->cfc >> 2)) { 1921 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits); 1922 d->rx_credits = d->cfc; 1923 } 1924 } else { 1925 /* CFC disabled. 1926 * Give ourselves some credits */ 1927 d->tx_credits = 5; 1928 } 1929 1930 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 1931 return skb_queue_len(&d->tx_queue); 1932 1933 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) { 1934 err = rfcomm_send_frame(d->session, skb->data, skb->len); 1935 if (err < 0) { 1936 skb_queue_head(&d->tx_queue, skb); 1937 break; 1938 } 1939 kfree_skb(skb); 1940 d->tx_credits--; 1941 } 1942 1943 if (d->cfc && !d->tx_credits) { 1944 /* We're out of TX credits. 1945 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */ 1946 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1947 } 1948 1949 return skb_queue_len(&d->tx_queue); 1950 } 1951 1952 static void rfcomm_process_dlcs(struct rfcomm_session *s) 1953 { 1954 struct rfcomm_dlc *d, *n; 1955 1956 BT_DBG("session %p state %ld", s, s->state); 1957 1958 list_for_each_entry_safe(d, n, &s->dlcs, list) { 1959 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) { 1960 __rfcomm_dlc_close(d, ETIMEDOUT); 1961 continue; 1962 } 1963 1964 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) { 1965 __rfcomm_dlc_close(d, ECONNREFUSED); 1966 continue; 1967 } 1968 1969 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) { 1970 rfcomm_dlc_clear_timer(d); 1971 if (d->out) { 1972 rfcomm_send_pn(s, 1, d); 1973 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT); 1974 } else { 1975 if (d->defer_setup) { 1976 set_bit(RFCOMM_DEFER_SETUP, &d->flags); 1977 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1978 1979 rfcomm_dlc_lock(d); 1980 d->state = BT_CONNECT2; 1981 d->state_change(d, 0); 1982 rfcomm_dlc_unlock(d); 1983 } else 1984 __rfcomm_dlc_accept(d); 1985 } 1986 continue; 1987 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) { 1988 rfcomm_dlc_clear_timer(d); 1989 if (!d->out) 1990 rfcomm_send_dm(s, d->dlci); 1991 else 1992 d->state = BT_CLOSED; 1993 __rfcomm_dlc_close(d, ECONNREFUSED); 1994 continue; 1995 } 1996 1997 if (test_bit(RFCOMM_SEC_PENDING, &d->flags)) 1998 continue; 1999 2000 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags)) 2001 continue; 2002 2003 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) && 2004 d->mscex == RFCOMM_MSCEX_OK) 2005 rfcomm_process_tx(d); 2006 } 2007 } 2008 2009 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) 2010 { 2011 struct socket *sock = s->sock; 2012 struct sock *sk = sock->sk; 2013 struct sk_buff *skb; 2014 2015 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue)); 2016 2017 /* Get data directly from socket receive queue without copying it. */ 2018 while ((skb = skb_dequeue(&sk->sk_receive_queue))) { 2019 skb_orphan(skb); 2020 if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { 2021 s = rfcomm_recv_frame(s, skb); 2022 if (!s) 2023 break; 2024 } else { 2025 kfree_skb(skb); 2026 } 2027 } 2028 2029 if (s && (sk->sk_state == BT_CLOSED)) 2030 s = rfcomm_session_close(s, sk->sk_err); 2031 2032 return s; 2033 } 2034 2035 static void rfcomm_accept_connection(struct rfcomm_session *s) 2036 { 2037 struct socket *sock = s->sock, *nsock; 2038 int err; 2039 2040 /* Fast check for a new connection. 2041 * Avoids unnecessary socket allocations. 2042 */ 2043 if (list_empty(&bt_sk(sock->sk)->accept_q)) 2044 return; 2045 2046 BT_DBG("session %p", s); 2047 2048 err = kernel_accept(sock, &nsock, O_NONBLOCK); 2049 if (err < 0) 2050 return; 2051 2052 /* Set our callbacks */ 2053 nsock->sk->sk_data_ready = rfcomm_l2data_ready; 2054 nsock->sk->sk_state_change = rfcomm_l2state_change; 2055 2056 s = rfcomm_session_add(nsock, BT_OPEN); 2057 if (s) { 2058 /* We should adjust MTU on incoming sessions. 2059 * L2CAP MTU minus UIH header and FCS. */ 2060 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu, 2061 l2cap_pi(nsock->sk)->chan->imtu) - 5; 2062 2063 rfcomm_schedule(); 2064 } else 2065 sock_release(nsock); 2066 } 2067 2068 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s) 2069 { 2070 struct sock *sk = s->sock->sk; 2071 2072 BT_DBG("%p state %ld", s, s->state); 2073 2074 switch (sk->sk_state) { 2075 case BT_CONNECTED: 2076 s->state = BT_CONNECT; 2077 2078 /* We can adjust MTU on outgoing sessions. 2079 * L2CAP MTU minus UIH header and FCS. */ 2080 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5; 2081 2082 rfcomm_send_sabm(s, 0); 2083 break; 2084 2085 case BT_CLOSED: 2086 s = rfcomm_session_close(s, sk->sk_err); 2087 break; 2088 } 2089 return s; 2090 } 2091 2092 static void rfcomm_process_sessions(void) 2093 { 2094 struct rfcomm_session *s, *n; 2095 2096 rfcomm_lock(); 2097 2098 list_for_each_entry_safe(s, n, &session_list, list) { 2099 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) { 2100 s->state = BT_DISCONN; 2101 rfcomm_send_disc(s, 0); 2102 continue; 2103 } 2104 2105 switch (s->state) { 2106 case BT_LISTEN: 2107 rfcomm_accept_connection(s); 2108 continue; 2109 2110 case BT_BOUND: 2111 s = rfcomm_check_connection(s); 2112 break; 2113 2114 default: 2115 s = rfcomm_process_rx(s); 2116 break; 2117 } 2118 2119 if (s) 2120 rfcomm_process_dlcs(s); 2121 } 2122 2123 rfcomm_unlock(); 2124 } 2125 2126 static int rfcomm_add_listener(bdaddr_t *ba) 2127 { 2128 struct sockaddr_l2 addr; 2129 struct socket *sock; 2130 struct sock *sk; 2131 struct rfcomm_session *s; 2132 int err = 0; 2133 2134 /* Create socket */ 2135 err = rfcomm_l2sock_create(&sock); 2136 if (err < 0) { 2137 BT_ERR("Create socket failed %d", err); 2138 return err; 2139 } 2140 2141 /* Bind socket */ 2142 bacpy(&addr.l2_bdaddr, ba); 2143 addr.l2_family = AF_BLUETOOTH; 2144 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM); 2145 addr.l2_cid = 0; 2146 addr.l2_bdaddr_type = BDADDR_BREDR; 2147 err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr)); 2148 if (err < 0) { 2149 BT_ERR("Bind failed %d", err); 2150 goto failed; 2151 } 2152 2153 /* Set L2CAP options */ 2154 sk = sock->sk; 2155 lock_sock(sk); 2156 /* Set MTU to 0 so L2CAP can auto select the MTU */ 2157 l2cap_pi(sk)->chan->imtu = 0; 2158 release_sock(sk); 2159 2160 /* Start listening on the socket */ 2161 err = kernel_listen(sock, 10); 2162 if (err) { 2163 BT_ERR("Listen failed %d", err); 2164 goto failed; 2165 } 2166 2167 /* Add listening session */ 2168 s = rfcomm_session_add(sock, BT_LISTEN); 2169 if (!s) { 2170 err = -ENOMEM; 2171 goto failed; 2172 } 2173 2174 return 0; 2175 failed: 2176 sock_release(sock); 2177 return err; 2178 } 2179 2180 static void rfcomm_kill_listener(void) 2181 { 2182 struct rfcomm_session *s, *n; 2183 2184 BT_DBG(""); 2185 2186 rfcomm_lock(); 2187 list_for_each_entry_safe(s, n, &session_list, list) 2188 rfcomm_session_del(s); 2189 rfcomm_unlock(); 2190 } 2191 2192 static int rfcomm_run(void *unused) 2193 { 2194 DEFINE_WAIT_FUNC(wait, woken_wake_function); 2195 BT_DBG(""); 2196 2197 set_user_nice(current, -10); 2198 2199 rfcomm_add_listener(BDADDR_ANY); 2200 2201 add_wait_queue(&rfcomm_wq, &wait); 2202 while (!kthread_should_stop()) { 2203 2204 /* Process stuff */ 2205 rfcomm_process_sessions(); 2206 2207 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 2208 } 2209 remove_wait_queue(&rfcomm_wq, &wait); 2210 2211 rfcomm_kill_listener(); 2212 2213 return 0; 2214 } 2215 2216 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) 2217 { 2218 struct rfcomm_session *s; 2219 struct rfcomm_dlc *d, *n; 2220 2221 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt); 2222 2223 rfcomm_lock(); 2224 2225 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst); 2226 if (!s) { 2227 rfcomm_unlock(); 2228 return; 2229 } 2230 2231 list_for_each_entry_safe(d, n, &s->dlcs, list) { 2232 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) { 2233 rfcomm_dlc_clear_timer(d); 2234 if (status || encrypt == 0x00) { 2235 set_bit(RFCOMM_ENC_DROP, &d->flags); 2236 continue; 2237 } 2238 } 2239 2240 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) { 2241 if (d->sec_level == BT_SECURITY_MEDIUM) { 2242 set_bit(RFCOMM_SEC_PENDING, &d->flags); 2243 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 2244 continue; 2245 } else if (d->sec_level == BT_SECURITY_HIGH || 2246 d->sec_level == BT_SECURITY_FIPS) { 2247 set_bit(RFCOMM_ENC_DROP, &d->flags); 2248 continue; 2249 } 2250 } 2251 2252 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags)) 2253 continue; 2254 2255 if (!status && hci_conn_check_secure(conn, d->sec_level)) 2256 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags); 2257 else 2258 set_bit(RFCOMM_AUTH_REJECT, &d->flags); 2259 } 2260 2261 rfcomm_unlock(); 2262 2263 rfcomm_schedule(); 2264 } 2265 2266 static struct hci_cb rfcomm_cb = { 2267 .name = "RFCOMM", 2268 .security_cfm = rfcomm_security_cfm 2269 }; 2270 2271 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x) 2272 { 2273 struct rfcomm_session *s; 2274 2275 rfcomm_lock(); 2276 2277 list_for_each_entry(s, &session_list, list) { 2278 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan; 2279 struct rfcomm_dlc *d; 2280 list_for_each_entry(d, &s->dlcs, list) { 2281 seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n", 2282 &chan->src, &chan->dst, 2283 d->state, d->dlci, d->mtu, 2284 d->rx_credits, d->tx_credits); 2285 } 2286 } 2287 2288 rfcomm_unlock(); 2289 2290 return 0; 2291 } 2292 2293 DEFINE_SHOW_ATTRIBUTE(rfcomm_dlc_debugfs); 2294 2295 static struct dentry *rfcomm_dlc_debugfs; 2296 2297 /* ---- Initialization ---- */ 2298 static int __init rfcomm_init(void) 2299 { 2300 int err; 2301 2302 hci_register_cb(&rfcomm_cb); 2303 2304 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd"); 2305 if (IS_ERR(rfcomm_thread)) { 2306 err = PTR_ERR(rfcomm_thread); 2307 goto unregister; 2308 } 2309 2310 err = rfcomm_init_ttys(); 2311 if (err < 0) 2312 goto stop; 2313 2314 err = rfcomm_init_sockets(); 2315 if (err < 0) 2316 goto cleanup; 2317 2318 BT_INFO("RFCOMM ver %s", VERSION); 2319 2320 if (IS_ERR_OR_NULL(bt_debugfs)) 2321 return 0; 2322 2323 rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444, 2324 bt_debugfs, NULL, 2325 &rfcomm_dlc_debugfs_fops); 2326 2327 return 0; 2328 2329 cleanup: 2330 rfcomm_cleanup_ttys(); 2331 2332 stop: 2333 kthread_stop(rfcomm_thread); 2334 2335 unregister: 2336 hci_unregister_cb(&rfcomm_cb); 2337 2338 return err; 2339 } 2340 2341 static void __exit rfcomm_exit(void) 2342 { 2343 debugfs_remove(rfcomm_dlc_debugfs); 2344 2345 hci_unregister_cb(&rfcomm_cb); 2346 2347 kthread_stop(rfcomm_thread); 2348 2349 rfcomm_cleanup_ttys(); 2350 2351 rfcomm_cleanup_sockets(); 2352 } 2353 2354 module_init(rfcomm_init); 2355 module_exit(rfcomm_exit); 2356 2357 module_param(disable_cfc, bool, 0644); 2358 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control"); 2359 2360 module_param(channel_mtu, int, 0644); 2361 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel"); 2362 2363 module_param(l2cap_ertm, bool, 0644); 2364 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection"); 2365 2366 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 2367 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION); 2368 MODULE_VERSION(VERSION); 2369 MODULE_LICENSE("GPL"); 2370 MODULE_ALIAS("bt-proto-3"); 2371