1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 /* 22 * Bluetooth RFCOMM core. 23 */ 24 25 #include <linux/module.h> 26 #include <linux/debugfs.h> 27 #include <linux/kthread.h> 28 #include <linux/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 #include <net/bluetooth/rfcomm.h> 34 35 #include <trace/events/sock.h> 36 37 #define VERSION "1.11" 38 39 static bool disable_cfc; 40 static bool l2cap_ertm; 41 static int channel_mtu = -1; 42 43 static struct task_struct *rfcomm_thread; 44 45 static DEFINE_MUTEX(rfcomm_mutex); 46 #define rfcomm_lock() mutex_lock(&rfcomm_mutex) 47 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex) 48 49 50 static LIST_HEAD(session_list); 51 52 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len); 53 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci); 54 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci); 55 static int rfcomm_queue_disc(struct rfcomm_dlc *d); 56 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type); 57 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d); 58 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig); 59 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len); 60 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits); 61 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr); 62 63 static void rfcomm_process_connect(struct rfcomm_session *s); 64 65 static struct socket *rfcomm_session_connect(bdaddr_t *src, bdaddr_t *dst, 66 u8 sec_level, int *err); 67 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state); 68 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst); 69 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s); 70 71 /* ---- RFCOMM frame parsing macros ---- */ 72 #define __get_dlci(b) ((b & 0xfc) >> 2) 73 #define __get_type(b) ((b & 0xef)) 74 75 #define __test_ea(b) ((b & 0x01)) 76 #define __test_cr(b) (!!(b & 0x02)) 77 #define __test_pf(b) (!!(b & 0x10)) 78 79 #define __session_dir(s) ((s)->initiator ? 0x00 : 0x01) 80 81 #define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01) 82 #define __ctrl(type, pf) (((type & 0xef) | (pf << 4))) 83 #define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir) 84 #define __srv_channel(dlci) (dlci >> 1) 85 86 #define __len8(len) (((len) << 1) | 1) 87 #define __len16(len) ((len) << 1) 88 89 /* MCC macros */ 90 #define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01)) 91 #define __get_mcc_type(b) ((b & 0xfc) >> 2) 92 #define __get_mcc_len(b) ((b & 0xfe) >> 1) 93 94 /* RPN macros */ 95 #define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3)) 96 #define __get_rpn_data_bits(line) ((line) & 0x3) 97 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1) 98 #define __get_rpn_parity(line) (((line) >> 3) & 0x7) 99 100 static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq); 101 102 static void rfcomm_schedule(void) 103 { 104 wake_up_all(&rfcomm_wq); 105 } 106 107 /* ---- RFCOMM FCS computation ---- */ 108 109 /* reversed, 8-bit, poly=0x07 */ 110 static unsigned char rfcomm_crc_table[256] = { 111 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75, 112 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b, 113 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69, 114 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67, 115 116 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d, 117 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43, 118 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51, 119 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f, 120 121 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05, 122 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b, 123 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19, 124 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17, 125 126 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d, 127 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33, 128 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21, 129 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f, 130 131 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95, 132 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b, 133 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89, 134 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87, 135 136 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad, 137 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3, 138 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1, 139 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf, 140 141 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5, 142 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb, 143 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9, 144 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7, 145 146 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd, 147 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3, 148 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1, 149 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf 150 }; 151 152 /* CRC on 2 bytes */ 153 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]]) 154 155 /* FCS on 2 bytes */ 156 static inline u8 __fcs(u8 *data) 157 { 158 return 0xff - __crc(data); 159 } 160 161 /* FCS on 3 bytes */ 162 static inline u8 __fcs2(u8 *data) 163 { 164 return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]]; 165 } 166 167 /* Check FCS */ 168 static inline int __check_fcs(u8 *data, int type, u8 fcs) 169 { 170 u8 f = __crc(data); 171 172 if (type != RFCOMM_UIH) 173 f = rfcomm_crc_table[f ^ data[2]]; 174 175 return rfcomm_crc_table[f ^ fcs] != 0xcf; 176 } 177 178 /* ---- L2CAP callbacks ---- */ 179 static void rfcomm_l2state_change(struct sock *sk) 180 { 181 BT_DBG("%p state %d", sk, sk->sk_state); 182 rfcomm_schedule(); 183 } 184 185 static void rfcomm_l2data_ready(struct sock *sk) 186 { 187 trace_sk_data_ready(sk); 188 189 BT_DBG("%p", sk); 190 rfcomm_schedule(); 191 } 192 193 static int rfcomm_l2sock_create(struct socket **sock) 194 { 195 int err; 196 197 BT_DBG(""); 198 199 err = sock_create_kern(&init_net, PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock); 200 if (!err) { 201 struct sock *sk = (*sock)->sk; 202 sk->sk_data_ready = rfcomm_l2data_ready; 203 sk->sk_state_change = rfcomm_l2state_change; 204 } 205 return err; 206 } 207 208 static int rfcomm_check_security(struct rfcomm_dlc *d) 209 { 210 struct sock *sk = d->session->sock->sk; 211 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 212 213 __u8 auth_type; 214 215 switch (d->sec_level) { 216 case BT_SECURITY_HIGH: 217 case BT_SECURITY_FIPS: 218 auth_type = HCI_AT_GENERAL_BONDING_MITM; 219 break; 220 case BT_SECURITY_MEDIUM: 221 auth_type = HCI_AT_GENERAL_BONDING; 222 break; 223 default: 224 auth_type = HCI_AT_NO_BONDING; 225 break; 226 } 227 228 return hci_conn_security(conn->hcon, d->sec_level, auth_type, 229 d->out); 230 } 231 232 static void rfcomm_session_timeout(struct timer_list *t) 233 { 234 struct rfcomm_session *s = timer_container_of(s, t, timer); 235 236 BT_DBG("session %p state %ld", s, s->state); 237 238 set_bit(RFCOMM_TIMED_OUT, &s->flags); 239 rfcomm_schedule(); 240 } 241 242 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout) 243 { 244 BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout); 245 246 mod_timer(&s->timer, jiffies + timeout); 247 } 248 249 static void rfcomm_session_clear_timer(struct rfcomm_session *s) 250 { 251 BT_DBG("session %p state %ld", s, s->state); 252 253 timer_delete_sync(&s->timer); 254 } 255 256 /* ---- RFCOMM DLCs ---- */ 257 static void rfcomm_dlc_timeout(struct timer_list *t) 258 { 259 struct rfcomm_dlc *d = timer_container_of(d, t, timer); 260 261 BT_DBG("dlc %p state %ld", d, d->state); 262 263 set_bit(RFCOMM_TIMED_OUT, &d->flags); 264 rfcomm_dlc_put(d); 265 rfcomm_schedule(); 266 } 267 268 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout) 269 { 270 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout); 271 272 if (!mod_timer(&d->timer, jiffies + timeout)) 273 rfcomm_dlc_hold(d); 274 } 275 276 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d) 277 { 278 BT_DBG("dlc %p state %ld", d, d->state); 279 280 if (timer_delete(&d->timer)) 281 rfcomm_dlc_put(d); 282 } 283 284 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d) 285 { 286 BT_DBG("%p", d); 287 288 d->state = BT_OPEN; 289 d->flags = 0; 290 d->mscex = 0; 291 d->sec_level = BT_SECURITY_LOW; 292 d->mtu = RFCOMM_DEFAULT_MTU; 293 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV; 294 295 d->cfc = RFCOMM_CFC_DISABLED; 296 d->rx_credits = RFCOMM_DEFAULT_CREDITS; 297 } 298 299 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio) 300 { 301 struct rfcomm_dlc *d = kzalloc_obj(*d, prio); 302 303 if (!d) 304 return NULL; 305 306 timer_setup(&d->timer, rfcomm_dlc_timeout, 0); 307 308 skb_queue_head_init(&d->tx_queue); 309 mutex_init(&d->lock); 310 refcount_set(&d->refcnt, 1); 311 312 rfcomm_dlc_clear_state(d); 313 314 BT_DBG("%p", d); 315 316 return d; 317 } 318 319 void rfcomm_dlc_free(struct rfcomm_dlc *d) 320 { 321 BT_DBG("%p", d); 322 323 skb_queue_purge(&d->tx_queue); 324 kfree(d); 325 } 326 327 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d) 328 { 329 BT_DBG("dlc %p session %p", d, s); 330 331 rfcomm_session_clear_timer(s); 332 rfcomm_dlc_hold(d); 333 list_add(&d->list, &s->dlcs); 334 d->session = s; 335 } 336 337 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d) 338 { 339 struct rfcomm_session *s = d->session; 340 341 BT_DBG("dlc %p refcnt %d session %p", d, refcount_read(&d->refcnt), s); 342 343 list_del(&d->list); 344 d->session = NULL; 345 rfcomm_dlc_put(d); 346 347 if (list_empty(&s->dlcs)) 348 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT); 349 } 350 351 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci) 352 { 353 struct rfcomm_dlc *d; 354 355 list_for_each_entry(d, &s->dlcs, list) 356 if (d->dlci == dlci) 357 return d; 358 359 return NULL; 360 } 361 362 static int rfcomm_check_channel(u8 channel) 363 { 364 return channel < 1 || channel > 30; 365 } 366 367 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, struct rfcomm_session *s, 368 u8 channel) 369 { 370 u8 dlci; 371 372 BT_DBG("dlc %p state %ld session %p channel %d", 373 d, d->state, s, channel); 374 375 if (d->state != BT_OPEN && d->state != BT_CLOSED) 376 return 0; 377 378 dlci = __dlci(__session_dir(s), channel); 379 380 /* Check if DLCI already exists */ 381 if (rfcomm_dlc_get(s, dlci)) 382 return -EBUSY; 383 384 rfcomm_dlc_clear_state(d); 385 386 d->dlci = dlci; 387 d->addr = __addr(s->initiator, dlci); 388 d->priority = 7; 389 390 d->state = BT_CONFIG; 391 rfcomm_dlc_link(s, d); 392 393 d->out = 1; 394 395 d->mtu = s->mtu; 396 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc; 397 398 if (s->state == BT_CONNECTED) { 399 if (rfcomm_check_security(d)) 400 rfcomm_send_pn(s, 1, d); 401 else 402 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 403 } 404 405 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT); 406 407 return 0; 408 } 409 410 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel) 411 { 412 struct rfcomm_session *s; 413 struct socket *sock; 414 int err; 415 416 BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d", 417 d, d->state, src, dst, channel); 418 419 if (rfcomm_check_channel(channel)) 420 return -EINVAL; 421 422 rfcomm_lock(); 423 424 clear_bit(RFCOMM_CLOSED, &d->flags); 425 426 /* Do not page the remote device for a DLC that cannot be opened 427 * anyway. __rfcomm_dlc_open() looks at the state again once the 428 * lock has been re-acquired below. 429 */ 430 if (d->state != BT_OPEN && d->state != BT_CLOSED) { 431 rfcomm_unlock(); 432 return 0; 433 } 434 435 s = rfcomm_session_get(src, dst); 436 if (s) { 437 err = __rfcomm_dlc_open(d, s, channel); 438 rfcomm_unlock(); 439 return err; 440 } 441 rfcomm_unlock(); 442 443 /* There is no session for this pair yet. kernel_connect() ends up in 444 * l2cap_chan_connect(), which takes hdev->lock, and the HCI event 445 * path takes rfcomm_mutex while holding hdev->lock, so the socket has 446 * to be connected with rfcomm_mutex released. 447 */ 448 sock = rfcomm_session_connect(src, dst, d->sec_level, &err); 449 if (!sock) 450 return err; 451 452 rfcomm_lock(); 453 454 /* The DLC may have been closed while the socket was connecting. It 455 * was not on a session, so rfcomm_dlc_close() could only mark it; 456 * attaching it now would leave it with no owner. 457 */ 458 if (test_bit(RFCOMM_CLOSED, &d->flags)) { 459 rfcomm_unlock(); 460 sock_release(sock); 461 return -ECONNRESET; 462 } 463 464 /* Another opener may have added a session for the same pair in the 465 * meantime; that one is used and this socket is dropped. 466 */ 467 s = rfcomm_session_get(src, dst); 468 if (!s) { 469 s = rfcomm_session_add(sock, BT_BOUND); 470 if (s) { 471 s->initiator = 1; 472 sock = NULL; 473 } 474 } 475 476 err = s ? __rfcomm_dlc_open(d, s, channel) : -ENOMEM; 477 478 rfcomm_unlock(); 479 480 if (sock) 481 sock_release(sock); 482 483 /* Over an existing ACL link the connection can complete before the 484 * session reaches the list, and that wakeup is then lost, so let 485 * krfcommd look at the socket state now. 486 */ 487 rfcomm_schedule(); 488 489 return err; 490 } 491 492 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d) 493 { 494 struct rfcomm_session *s = d->session; 495 496 d->state = BT_DISCONN; 497 if (skb_queue_empty(&d->tx_queue)) { 498 rfcomm_send_disc(s, d->dlci); 499 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT); 500 } else { 501 rfcomm_queue_disc(d); 502 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2); 503 } 504 } 505 506 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err) 507 { 508 struct rfcomm_session *s = d->session; 509 if (!s) 510 return 0; 511 512 BT_DBG("dlc %p state %ld dlci %d err %d session %p", 513 d, d->state, d->dlci, err, s); 514 515 switch (d->state) { 516 case BT_CONNECT: 517 case BT_CONFIG: 518 case BT_OPEN: 519 case BT_CONNECT2: 520 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 521 set_bit(RFCOMM_AUTH_REJECT, &d->flags); 522 rfcomm_schedule(); 523 return 0; 524 } 525 } 526 527 switch (d->state) { 528 case BT_CONNECT: 529 case BT_CONNECTED: 530 __rfcomm_dlc_disconn(d); 531 break; 532 533 case BT_CONFIG: 534 if (s->state != BT_BOUND) { 535 __rfcomm_dlc_disconn(d); 536 break; 537 } 538 /* if closing a dlc in a session that hasn't been started, 539 * just close and unlink the dlc 540 */ 541 fallthrough; 542 543 default: 544 rfcomm_dlc_clear_timer(d); 545 546 rfcomm_dlc_lock(d); 547 d->state = BT_CLOSED; 548 d->state_change(d, err); 549 rfcomm_dlc_unlock(d); 550 551 skb_queue_purge(&d->tx_queue); 552 rfcomm_dlc_unlink(d); 553 } 554 555 return 0; 556 } 557 558 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err) 559 { 560 int r = 0; 561 struct rfcomm_dlc *d_list; 562 struct rfcomm_session *s, *s_list; 563 564 BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err); 565 566 rfcomm_lock(); 567 568 s = d->session; 569 if (!s) { 570 /* Not on a session yet: rfcomm_dlc_open() may be connecting a 571 * socket for it with rfcomm_mutex released. Leave a mark so 572 * that it does not attach the DLC once it holds the lock again. 573 */ 574 set_bit(RFCOMM_CLOSED, &d->flags); 575 goto no_session; 576 } 577 578 /* after waiting on the mutex check the session still exists 579 * then check the dlc still exists 580 */ 581 list_for_each_entry(s_list, &session_list, list) { 582 if (s_list == s) { 583 list_for_each_entry(d_list, &s->dlcs, list) { 584 if (d_list == d) { 585 r = __rfcomm_dlc_close(d, err); 586 break; 587 } 588 } 589 break; 590 } 591 } 592 593 no_session: 594 rfcomm_unlock(); 595 return r; 596 } 597 598 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel) 599 { 600 struct rfcomm_session *s; 601 struct rfcomm_dlc *dlc = NULL; 602 u8 dlci; 603 604 if (rfcomm_check_channel(channel)) 605 return ERR_PTR(-EINVAL); 606 607 rfcomm_lock(); 608 s = rfcomm_session_get(src, dst); 609 if (s) { 610 dlci = __dlci(__session_dir(s), channel); 611 dlc = rfcomm_dlc_get(s, dlci); 612 } 613 rfcomm_unlock(); 614 return dlc; 615 } 616 617 static int rfcomm_dlc_send_frag(struct rfcomm_dlc *d, struct sk_buff *frag) 618 { 619 int len = frag->len; 620 621 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); 622 623 if (len > d->mtu) 624 return -EINVAL; 625 626 rfcomm_make_uih(frag, d->addr); 627 __skb_queue_tail(&d->tx_queue, frag); 628 629 return len; 630 } 631 632 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb) 633 { 634 unsigned long flags; 635 struct sk_buff *frag, *next; 636 int len; 637 638 if (d->state != BT_CONNECTED) 639 return -ENOTCONN; 640 641 frag = skb_shinfo(skb)->frag_list; 642 skb_shinfo(skb)->frag_list = NULL; 643 644 /* Queue all fragments atomically. */ 645 spin_lock_irqsave(&d->tx_queue.lock, flags); 646 647 len = rfcomm_dlc_send_frag(d, skb); 648 if (len < 0 || !frag) 649 goto unlock; 650 651 for (; frag; frag = next) { 652 int ret; 653 654 next = frag->next; 655 656 ret = rfcomm_dlc_send_frag(d, frag); 657 if (ret < 0) { 658 dev_kfree_skb_irq(frag); 659 goto unlock; 660 } 661 662 len += ret; 663 } 664 665 unlock: 666 spin_unlock_irqrestore(&d->tx_queue.lock, flags); 667 668 if (len > 0 && !test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 669 rfcomm_schedule(); 670 return len; 671 } 672 673 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb) 674 { 675 int len = skb->len; 676 677 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); 678 679 rfcomm_make_uih(skb, d->addr); 680 skb_queue_tail(&d->tx_queue, skb); 681 682 if (d->state == BT_CONNECTED && 683 !test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 684 rfcomm_schedule(); 685 } 686 687 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d) 688 { 689 BT_DBG("dlc %p state %ld", d, d->state); 690 691 if (!d->cfc) { 692 d->v24_sig |= RFCOMM_V24_FC; 693 set_bit(RFCOMM_MSC_PENDING, &d->flags); 694 } 695 rfcomm_schedule(); 696 } 697 698 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d) 699 { 700 BT_DBG("dlc %p state %ld", d, d->state); 701 702 if (!d->cfc) { 703 d->v24_sig &= ~RFCOMM_V24_FC; 704 set_bit(RFCOMM_MSC_PENDING, &d->flags); 705 } 706 rfcomm_schedule(); 707 } 708 709 /* 710 Set/get modem status functions use _local_ status i.e. what we report 711 to the other side. 712 Remote status is provided by dlc->modem_status() callback. 713 */ 714 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig) 715 { 716 BT_DBG("dlc %p state %ld v24_sig 0x%x", 717 d, d->state, v24_sig); 718 719 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags)) 720 v24_sig |= RFCOMM_V24_FC; 721 else 722 v24_sig &= ~RFCOMM_V24_FC; 723 724 d->v24_sig = v24_sig; 725 726 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags)) 727 rfcomm_schedule(); 728 729 return 0; 730 } 731 732 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig) 733 { 734 BT_DBG("dlc %p state %ld v24_sig 0x%x", 735 d, d->state, d->v24_sig); 736 737 *v24_sig = d->v24_sig; 738 return 0; 739 } 740 741 /* ---- RFCOMM sessions ---- */ 742 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state) 743 { 744 struct rfcomm_session *s = kzalloc_obj(*s); 745 746 if (!s) 747 return NULL; 748 749 BT_DBG("session %p sock %p", s, sock); 750 751 timer_setup(&s->timer, rfcomm_session_timeout, 0); 752 753 INIT_LIST_HEAD(&s->dlcs); 754 s->state = state; 755 s->sock = sock; 756 757 s->mtu = RFCOMM_DEFAULT_MTU; 758 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN; 759 760 /* Do not increment module usage count for listening sessions. 761 * Otherwise we won't be able to unload the module. */ 762 if (state != BT_LISTEN) 763 if (!try_module_get(THIS_MODULE)) { 764 kfree(s); 765 return NULL; 766 } 767 768 list_add(&s->list, &session_list); 769 770 return s; 771 } 772 773 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s) 774 { 775 int state = s->state; 776 777 BT_DBG("session %p state %ld", s, s->state); 778 779 list_del(&s->list); 780 781 rfcomm_session_clear_timer(s); 782 sock_release(s->sock); 783 kfree(s); 784 785 if (state != BT_LISTEN) 786 module_put(THIS_MODULE); 787 788 return NULL; 789 } 790 791 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst) 792 { 793 struct rfcomm_session *s, *n; 794 struct l2cap_chan *chan; 795 list_for_each_entry_safe(s, n, &session_list, list) { 796 chan = l2cap_pi(s->sock->sk)->chan; 797 798 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) && 799 !bacmp(&chan->dst, dst)) 800 return s; 801 } 802 return NULL; 803 } 804 805 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s, 806 int err) 807 { 808 struct rfcomm_dlc *d, *n; 809 810 s->state = BT_CLOSED; 811 812 BT_DBG("session %p state %ld err %d", s, s->state, err); 813 814 /* Close all dlcs */ 815 list_for_each_entry_safe(d, n, &s->dlcs, list) { 816 d->state = BT_CLOSED; 817 __rfcomm_dlc_close(d, err); 818 } 819 820 rfcomm_session_clear_timer(s); 821 return rfcomm_session_del(s); 822 } 823 824 /* Creates the L2CAP socket a new session will run on and starts connecting 825 * it. Must be called with rfcomm_mutex released. 826 */ 827 static struct socket *rfcomm_session_connect(bdaddr_t *src, bdaddr_t *dst, 828 u8 sec_level, int *err) 829 { 830 struct sockaddr_l2 addr; 831 struct socket *sock; 832 struct sock *sk; 833 834 BT_DBG("%pMR -> %pMR", src, dst); 835 836 *err = rfcomm_l2sock_create(&sock); 837 if (*err < 0) 838 return NULL; 839 840 bacpy(&addr.l2_bdaddr, src); 841 addr.l2_family = AF_BLUETOOTH; 842 addr.l2_psm = 0; 843 addr.l2_cid = 0; 844 addr.l2_bdaddr_type = BDADDR_BREDR; 845 *err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr)); 846 if (*err < 0) 847 goto failed; 848 849 /* Set L2CAP options */ 850 sk = sock->sk; 851 lock_sock(sk); 852 /* Set MTU to 0 so L2CAP can auto select the MTU */ 853 l2cap_pi(sk)->chan->imtu = 0; 854 l2cap_pi(sk)->chan->sec_level = sec_level; 855 if (l2cap_ertm) 856 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM; 857 release_sock(sk); 858 859 bacpy(&addr.l2_bdaddr, dst); 860 addr.l2_family = AF_BLUETOOTH; 861 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM); 862 addr.l2_cid = 0; 863 addr.l2_bdaddr_type = BDADDR_BREDR; 864 *err = kernel_connect(sock, (struct sockaddr_unsized *)&addr, sizeof(addr), O_NONBLOCK); 865 if (*err && *err != -EINPROGRESS) 866 goto failed; 867 868 return sock; 869 870 failed: 871 sock_release(sock); 872 return NULL; 873 } 874 875 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst) 876 { 877 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan; 878 if (src) 879 bacpy(src, &chan->src); 880 if (dst) 881 bacpy(dst, &chan->dst); 882 } 883 884 /* ---- RFCOMM frame sending ---- */ 885 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len) 886 { 887 struct kvec iv = { data, len }; 888 struct msghdr msg; 889 890 BT_DBG("session %p len %d", s, len); 891 892 memset(&msg, 0, sizeof(msg)); 893 894 return kernel_sendmsg(s->sock, &msg, &iv, 1, len); 895 } 896 897 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd) 898 { 899 BT_DBG("%p cmd %u", s, cmd->ctrl); 900 901 return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd)); 902 } 903 904 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci) 905 { 906 struct rfcomm_cmd cmd; 907 908 BT_DBG("%p dlci %d", s, dlci); 909 910 cmd.addr = __addr(s->initiator, dlci); 911 cmd.ctrl = __ctrl(RFCOMM_SABM, 1); 912 cmd.len = __len8(0); 913 cmd.fcs = __fcs2((u8 *) &cmd); 914 915 return rfcomm_send_cmd(s, &cmd); 916 } 917 918 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci) 919 { 920 struct rfcomm_cmd cmd; 921 922 BT_DBG("%p dlci %d", s, dlci); 923 924 cmd.addr = __addr(!s->initiator, dlci); 925 cmd.ctrl = __ctrl(RFCOMM_UA, 1); 926 cmd.len = __len8(0); 927 cmd.fcs = __fcs2((u8 *) &cmd); 928 929 return rfcomm_send_cmd(s, &cmd); 930 } 931 932 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci) 933 { 934 struct rfcomm_cmd cmd; 935 936 BT_DBG("%p dlci %d", s, dlci); 937 938 cmd.addr = __addr(s->initiator, dlci); 939 cmd.ctrl = __ctrl(RFCOMM_DISC, 1); 940 cmd.len = __len8(0); 941 cmd.fcs = __fcs2((u8 *) &cmd); 942 943 return rfcomm_send_cmd(s, &cmd); 944 } 945 946 static int rfcomm_queue_disc(struct rfcomm_dlc *d) 947 { 948 struct rfcomm_cmd *cmd; 949 struct sk_buff *skb; 950 951 BT_DBG("dlc %p dlci %d", d, d->dlci); 952 953 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL); 954 if (!skb) 955 return -ENOMEM; 956 957 cmd = __skb_put(skb, sizeof(*cmd)); 958 cmd->addr = d->addr; 959 cmd->ctrl = __ctrl(RFCOMM_DISC, 1); 960 cmd->len = __len8(0); 961 cmd->fcs = __fcs2((u8 *) cmd); 962 963 skb_queue_tail(&d->tx_queue, skb); 964 rfcomm_schedule(); 965 return 0; 966 } 967 968 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci) 969 { 970 struct rfcomm_cmd cmd; 971 972 BT_DBG("%p dlci %d", s, dlci); 973 974 cmd.addr = __addr(!s->initiator, dlci); 975 cmd.ctrl = __ctrl(RFCOMM_DM, 1); 976 cmd.len = __len8(0); 977 cmd.fcs = __fcs2((u8 *) &cmd); 978 979 return rfcomm_send_cmd(s, &cmd); 980 } 981 982 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type) 983 { 984 struct rfcomm_hdr *hdr; 985 struct rfcomm_mcc *mcc; 986 u8 buf[16], *ptr = buf; 987 988 BT_DBG("%p cr %d type %d", s, cr, type); 989 990 hdr = (void *) ptr; ptr += sizeof(*hdr); 991 hdr->addr = __addr(s->initiator, 0); 992 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 993 hdr->len = __len8(sizeof(*mcc) + 1); 994 995 mcc = (void *) ptr; ptr += sizeof(*mcc); 996 mcc->type = __mcc_type(0, RFCOMM_NSC); 997 mcc->len = __len8(1); 998 999 /* Type that we didn't like */ 1000 *ptr = __mcc_type(cr, type); ptr++; 1001 1002 *ptr = __fcs(buf); ptr++; 1003 1004 return rfcomm_send_frame(s, buf, ptr - buf); 1005 } 1006 1007 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d) 1008 { 1009 struct rfcomm_hdr *hdr; 1010 struct rfcomm_mcc *mcc; 1011 struct rfcomm_pn *pn; 1012 u8 buf[16], *ptr = buf; 1013 1014 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu); 1015 1016 hdr = (void *) ptr; ptr += sizeof(*hdr); 1017 hdr->addr = __addr(s->initiator, 0); 1018 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1019 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn)); 1020 1021 mcc = (void *) ptr; ptr += sizeof(*mcc); 1022 mcc->type = __mcc_type(cr, RFCOMM_PN); 1023 mcc->len = __len8(sizeof(*pn)); 1024 1025 pn = (void *) ptr; ptr += sizeof(*pn); 1026 pn->dlci = d->dlci; 1027 pn->priority = d->priority; 1028 pn->ack_timer = 0; 1029 pn->max_retrans = 0; 1030 1031 if (s->cfc) { 1032 pn->flow_ctrl = cr ? 0xf0 : 0xe0; 1033 pn->credits = RFCOMM_DEFAULT_CREDITS; 1034 } else { 1035 pn->flow_ctrl = 0; 1036 pn->credits = 0; 1037 } 1038 1039 if (cr && channel_mtu >= 0) 1040 pn->mtu = cpu_to_le16(channel_mtu); 1041 else 1042 pn->mtu = cpu_to_le16(d->mtu); 1043 1044 *ptr = __fcs(buf); ptr++; 1045 1046 return rfcomm_send_frame(s, buf, ptr - buf); 1047 } 1048 1049 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci, 1050 u8 bit_rate, u8 data_bits, u8 stop_bits, 1051 u8 parity, u8 flow_ctrl_settings, 1052 u8 xon_char, u8 xoff_char, u16 param_mask) 1053 { 1054 struct rfcomm_hdr *hdr; 1055 struct rfcomm_mcc *mcc; 1056 struct rfcomm_rpn *rpn; 1057 u8 buf[16], *ptr = buf; 1058 1059 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x" 1060 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x", 1061 s, cr, dlci, bit_rate, data_bits, stop_bits, parity, 1062 flow_ctrl_settings, xon_char, xoff_char, param_mask); 1063 1064 hdr = (void *) ptr; ptr += sizeof(*hdr); 1065 hdr->addr = __addr(s->initiator, 0); 1066 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1067 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn)); 1068 1069 mcc = (void *) ptr; ptr += sizeof(*mcc); 1070 mcc->type = __mcc_type(cr, RFCOMM_RPN); 1071 mcc->len = __len8(sizeof(*rpn)); 1072 1073 rpn = (void *) ptr; ptr += sizeof(*rpn); 1074 rpn->dlci = __addr(1, dlci); 1075 rpn->bit_rate = bit_rate; 1076 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity); 1077 rpn->flow_ctrl = flow_ctrl_settings; 1078 rpn->xon_char = xon_char; 1079 rpn->xoff_char = xoff_char; 1080 rpn->param_mask = cpu_to_le16(param_mask); 1081 1082 *ptr = __fcs(buf); ptr++; 1083 1084 return rfcomm_send_frame(s, buf, ptr - buf); 1085 } 1086 1087 int rfcomm_dlc_send_rpn(struct rfcomm_dlc *d, u8 bit_rate, u8 data_bits, 1088 u8 stop_bits, u8 parity, u8 flow_ctrl_settings, 1089 u8 xon_char, u8 xoff_char, u16 param_mask) 1090 { 1091 int err = -ENOTCONN; 1092 1093 rfcomm_lock(); 1094 if (d->session) 1095 err = rfcomm_send_rpn(d->session, 1, d->dlci, bit_rate, 1096 data_bits, stop_bits, parity, 1097 flow_ctrl_settings, xon_char, xoff_char, 1098 param_mask); 1099 rfcomm_unlock(); 1100 1101 return err; 1102 } 1103 1104 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status) 1105 { 1106 struct rfcomm_hdr *hdr; 1107 struct rfcomm_mcc *mcc; 1108 struct rfcomm_rls *rls; 1109 u8 buf[16], *ptr = buf; 1110 1111 BT_DBG("%p cr %d status 0x%x", s, cr, status); 1112 1113 hdr = (void *) ptr; ptr += sizeof(*hdr); 1114 hdr->addr = __addr(s->initiator, 0); 1115 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1116 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls)); 1117 1118 mcc = (void *) ptr; ptr += sizeof(*mcc); 1119 mcc->type = __mcc_type(cr, RFCOMM_RLS); 1120 mcc->len = __len8(sizeof(*rls)); 1121 1122 rls = (void *) ptr; ptr += sizeof(*rls); 1123 rls->dlci = __addr(1, dlci); 1124 rls->status = status; 1125 1126 *ptr = __fcs(buf); ptr++; 1127 1128 return rfcomm_send_frame(s, buf, ptr - buf); 1129 } 1130 1131 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig) 1132 { 1133 struct rfcomm_hdr *hdr; 1134 struct rfcomm_mcc *mcc; 1135 struct rfcomm_msc *msc; 1136 u8 buf[16], *ptr = buf; 1137 1138 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig); 1139 1140 hdr = (void *) ptr; ptr += sizeof(*hdr); 1141 hdr->addr = __addr(s->initiator, 0); 1142 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1143 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc)); 1144 1145 mcc = (void *) ptr; ptr += sizeof(*mcc); 1146 mcc->type = __mcc_type(cr, RFCOMM_MSC); 1147 mcc->len = __len8(sizeof(*msc)); 1148 1149 msc = (void *) ptr; ptr += sizeof(*msc); 1150 msc->dlci = __addr(1, dlci); 1151 msc->v24_sig = v24_sig | 0x01; 1152 1153 *ptr = __fcs(buf); ptr++; 1154 1155 return rfcomm_send_frame(s, buf, ptr - buf); 1156 } 1157 1158 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr) 1159 { 1160 struct rfcomm_hdr *hdr; 1161 struct rfcomm_mcc *mcc; 1162 u8 buf[16], *ptr = buf; 1163 1164 BT_DBG("%p cr %d", s, cr); 1165 1166 hdr = (void *) ptr; ptr += sizeof(*hdr); 1167 hdr->addr = __addr(s->initiator, 0); 1168 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1169 hdr->len = __len8(sizeof(*mcc)); 1170 1171 mcc = (void *) ptr; ptr += sizeof(*mcc); 1172 mcc->type = __mcc_type(cr, RFCOMM_FCOFF); 1173 mcc->len = __len8(0); 1174 1175 *ptr = __fcs(buf); ptr++; 1176 1177 return rfcomm_send_frame(s, buf, ptr - buf); 1178 } 1179 1180 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr) 1181 { 1182 struct rfcomm_hdr *hdr; 1183 struct rfcomm_mcc *mcc; 1184 u8 buf[16], *ptr = buf; 1185 1186 BT_DBG("%p cr %d", s, cr); 1187 1188 hdr = (void *) ptr; ptr += sizeof(*hdr); 1189 hdr->addr = __addr(s->initiator, 0); 1190 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1191 hdr->len = __len8(sizeof(*mcc)); 1192 1193 mcc = (void *) ptr; ptr += sizeof(*mcc); 1194 mcc->type = __mcc_type(cr, RFCOMM_FCON); 1195 mcc->len = __len8(0); 1196 1197 *ptr = __fcs(buf); ptr++; 1198 1199 return rfcomm_send_frame(s, buf, ptr - buf); 1200 } 1201 1202 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len) 1203 { 1204 struct socket *sock = s->sock; 1205 struct kvec iv[3]; 1206 struct msghdr msg; 1207 unsigned char hdr[5], crc[1]; 1208 1209 if (len > 125) 1210 return -EINVAL; 1211 1212 BT_DBG("%p cr %d", s, cr); 1213 1214 hdr[0] = __addr(s->initiator, 0); 1215 hdr[1] = __ctrl(RFCOMM_UIH, 0); 1216 hdr[2] = 0x01 | ((len + 2) << 1); 1217 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2); 1218 hdr[4] = 0x01 | (len << 1); 1219 1220 crc[0] = __fcs(hdr); 1221 1222 iv[0].iov_base = hdr; 1223 iv[0].iov_len = 5; 1224 iv[1].iov_base = pattern; 1225 iv[1].iov_len = len; 1226 iv[2].iov_base = crc; 1227 iv[2].iov_len = 1; 1228 1229 memset(&msg, 0, sizeof(msg)); 1230 1231 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len); 1232 } 1233 1234 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits) 1235 { 1236 struct rfcomm_hdr *hdr; 1237 u8 buf[16], *ptr = buf; 1238 1239 BT_DBG("%p addr %d credits %d", s, addr, credits); 1240 1241 hdr = (void *) ptr; ptr += sizeof(*hdr); 1242 hdr->addr = addr; 1243 hdr->ctrl = __ctrl(RFCOMM_UIH, 1); 1244 hdr->len = __len8(0); 1245 1246 *ptr = credits; ptr++; 1247 1248 *ptr = __fcs(buf); ptr++; 1249 1250 return rfcomm_send_frame(s, buf, ptr - buf); 1251 } 1252 1253 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr) 1254 { 1255 struct rfcomm_hdr *hdr; 1256 int len = skb->len; 1257 u8 *crc; 1258 1259 if (len > 127) { 1260 hdr = skb_push(skb, 4); 1261 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len); 1262 } else { 1263 hdr = skb_push(skb, 3); 1264 hdr->len = __len8(len); 1265 } 1266 hdr->addr = addr; 1267 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1268 1269 crc = skb_put(skb, 1); 1270 *crc = __fcs((void *) hdr); 1271 } 1272 1273 /* ---- RFCOMM frame reception ---- */ 1274 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci) 1275 { 1276 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1277 1278 if (dlci) { 1279 /* Data channel */ 1280 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1281 if (!d) { 1282 rfcomm_send_dm(s, dlci); 1283 return s; 1284 } 1285 1286 switch (d->state) { 1287 case BT_CONNECT: 1288 rfcomm_dlc_clear_timer(d); 1289 1290 rfcomm_dlc_lock(d); 1291 d->state = BT_CONNECTED; 1292 d->state_change(d, 0); 1293 rfcomm_dlc_unlock(d); 1294 1295 rfcomm_send_msc(s, 1, dlci, d->v24_sig); 1296 break; 1297 1298 case BT_DISCONN: 1299 d->state = BT_CLOSED; 1300 __rfcomm_dlc_close(d, 0); 1301 1302 if (list_empty(&s->dlcs)) { 1303 s->state = BT_DISCONN; 1304 rfcomm_send_disc(s, 0); 1305 rfcomm_session_clear_timer(s); 1306 } 1307 1308 break; 1309 } 1310 } else { 1311 /* Control channel */ 1312 switch (s->state) { 1313 case BT_CONNECT: 1314 s->state = BT_CONNECTED; 1315 rfcomm_process_connect(s); 1316 break; 1317 1318 case BT_DISCONN: 1319 s = rfcomm_session_close(s, ECONNRESET); 1320 break; 1321 } 1322 } 1323 return s; 1324 } 1325 1326 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci) 1327 { 1328 int err = 0; 1329 1330 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1331 1332 if (dlci) { 1333 /* Data DLC */ 1334 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1335 if (d) { 1336 if (d->state == BT_CONNECT || d->state == BT_CONFIG) 1337 err = ECONNREFUSED; 1338 else 1339 err = ECONNRESET; 1340 1341 d->state = BT_CLOSED; 1342 __rfcomm_dlc_close(d, err); 1343 } 1344 } else { 1345 if (s->state == BT_CONNECT) 1346 err = ECONNREFUSED; 1347 else 1348 err = ECONNRESET; 1349 1350 s = rfcomm_session_close(s, err); 1351 } 1352 return s; 1353 } 1354 1355 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s, 1356 u8 dlci) 1357 { 1358 int err = 0; 1359 1360 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1361 1362 if (dlci) { 1363 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1364 if (d) { 1365 rfcomm_send_ua(s, dlci); 1366 1367 if (d->state == BT_CONNECT || d->state == BT_CONFIG) 1368 err = ECONNREFUSED; 1369 else 1370 err = ECONNRESET; 1371 1372 d->state = BT_CLOSED; 1373 __rfcomm_dlc_close(d, err); 1374 } else 1375 rfcomm_send_dm(s, dlci); 1376 1377 } else { 1378 rfcomm_send_ua(s, 0); 1379 1380 if (s->state == BT_CONNECT) 1381 err = ECONNREFUSED; 1382 else 1383 err = ECONNRESET; 1384 1385 s = rfcomm_session_close(s, err); 1386 } 1387 return s; 1388 } 1389 1390 /* Must be called with rfcomm_mutex held, so that the session cannot be 1391 * unlinked from under us. 1392 */ 1393 static void __rfcomm_dlc_accept(struct rfcomm_dlc *d) 1394 { 1395 struct sock *sk = d->session->sock->sk; 1396 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 1397 1398 BT_DBG("dlc %p", d); 1399 1400 rfcomm_send_ua(d->session, d->dlci); 1401 1402 rfcomm_dlc_clear_timer(d); 1403 1404 rfcomm_dlc_lock(d); 1405 d->state = BT_CONNECTED; 1406 d->state_change(d, 0); 1407 rfcomm_dlc_unlock(d); 1408 1409 if (d->role_switch) 1410 hci_conn_switch_role(conn->hcon, 0x00); 1411 1412 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 1413 } 1414 1415 void rfcomm_dlc_accept(struct rfcomm_dlc *d) 1416 { 1417 rfcomm_lock(); 1418 1419 /* rfcomm_recv_disc() sets the dlc state to BT_CLOSED before calling 1420 * __rfcomm_dlc_close(), so the RFCOMM_DEFER_SETUP handshake there is 1421 * skipped and the session can already be unlinked by the time the 1422 * deferred accept runs from rfcomm_sock_recvmsg(). 1423 */ 1424 if (d->session) 1425 __rfcomm_dlc_accept(d); 1426 1427 rfcomm_unlock(); 1428 } 1429 1430 static void rfcomm_check_accept(struct rfcomm_dlc *d) 1431 { 1432 if (rfcomm_check_security(d)) { 1433 if (d->defer_setup) { 1434 set_bit(RFCOMM_DEFER_SETUP, &d->flags); 1435 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1436 1437 rfcomm_dlc_lock(d); 1438 d->state = BT_CONNECT2; 1439 d->state_change(d, 0); 1440 rfcomm_dlc_unlock(d); 1441 } else 1442 __rfcomm_dlc_accept(d); 1443 } else { 1444 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 1445 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1446 } 1447 } 1448 1449 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci) 1450 { 1451 struct rfcomm_dlc *d; 1452 u8 channel; 1453 1454 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1455 1456 if (!dlci) { 1457 rfcomm_send_ua(s, 0); 1458 1459 if (s->state == BT_OPEN) { 1460 s->state = BT_CONNECTED; 1461 rfcomm_process_connect(s); 1462 } 1463 return 0; 1464 } 1465 1466 /* Check if DLC exists */ 1467 d = rfcomm_dlc_get(s, dlci); 1468 if (d) { 1469 if (d->state == BT_OPEN) { 1470 /* DLC was previously opened by PN request */ 1471 rfcomm_check_accept(d); 1472 } 1473 return 0; 1474 } 1475 1476 /* Notify socket layer about incoming connection */ 1477 channel = __srv_channel(dlci); 1478 if (rfcomm_connect_ind(s, channel, &d)) { 1479 d->dlci = dlci; 1480 d->addr = __addr(s->initiator, dlci); 1481 rfcomm_dlc_link(s, d); 1482 1483 rfcomm_check_accept(d); 1484 } else { 1485 rfcomm_send_dm(s, dlci); 1486 } 1487 1488 return 0; 1489 } 1490 1491 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn) 1492 { 1493 struct rfcomm_session *s = d->session; 1494 1495 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d", 1496 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits); 1497 1498 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) || 1499 pn->flow_ctrl == 0xe0) { 1500 d->cfc = RFCOMM_CFC_ENABLED; 1501 d->tx_credits = pn->credits; 1502 } else { 1503 d->cfc = RFCOMM_CFC_DISABLED; 1504 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1505 } 1506 1507 if (s->cfc == RFCOMM_CFC_UNKNOWN) 1508 s->cfc = d->cfc; 1509 1510 d->priority = pn->priority; 1511 1512 d->mtu = __le16_to_cpu(pn->mtu); 1513 1514 /* MTU 0 causes an infinite loop when fragmenting in sendmsg */ 1515 if (!d->mtu) 1516 d->mtu = RFCOMM_DEFAULT_MTU; 1517 1518 if (cr && d->mtu > s->mtu) 1519 d->mtu = s->mtu; 1520 1521 return 0; 1522 } 1523 1524 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1525 { 1526 struct rfcomm_pn *pn; 1527 struct rfcomm_dlc *d; 1528 u8 dlci; 1529 1530 pn = skb_pull_data(skb, sizeof(*pn)); 1531 if (!pn) 1532 return -EILSEQ; 1533 1534 dlci = pn->dlci; 1535 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1536 1537 if (!dlci) 1538 return 0; 1539 1540 d = rfcomm_dlc_get(s, dlci); 1541 if (d) { 1542 if (cr) { 1543 /* PN request */ 1544 rfcomm_apply_pn(d, cr, pn); 1545 rfcomm_send_pn(s, 0, d); 1546 } else { 1547 /* PN response */ 1548 switch (d->state) { 1549 case BT_CONFIG: 1550 rfcomm_apply_pn(d, cr, pn); 1551 1552 d->state = BT_CONNECT; 1553 rfcomm_send_sabm(s, d->dlci); 1554 break; 1555 } 1556 } 1557 } else { 1558 u8 channel = __srv_channel(dlci); 1559 1560 if (!cr) 1561 return 0; 1562 1563 /* PN request for non existing DLC. 1564 * Assume incoming connection. */ 1565 if (rfcomm_connect_ind(s, channel, &d)) { 1566 d->dlci = dlci; 1567 d->addr = __addr(s->initiator, dlci); 1568 rfcomm_dlc_link(s, d); 1569 1570 rfcomm_apply_pn(d, cr, pn); 1571 1572 d->state = BT_OPEN; 1573 rfcomm_send_pn(s, 0, d); 1574 } else { 1575 rfcomm_send_dm(s, dlci); 1576 } 1577 } 1578 return 0; 1579 } 1580 1581 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb) 1582 { 1583 struct rfcomm_rpn *rpn; 1584 u8 dlci; 1585 1586 u8 bit_rate = 0; 1587 u8 data_bits = 0; 1588 u8 stop_bits = 0; 1589 u8 parity = 0; 1590 u8 flow_ctrl = 0; 1591 u8 xon_char = 0; 1592 u8 xoff_char = 0; 1593 u16 rpn_mask = RFCOMM_RPN_PM_ALL; 1594 1595 if (len == 1) { 1596 rpn = skb_pull_data(skb, 1); 1597 if (!rpn) 1598 return -EILSEQ; 1599 1600 dlci = __get_dlci(rpn->dlci); 1601 1602 if (!cr) 1603 return 0; 1604 1605 bit_rate = RFCOMM_RPN_BR_9600; 1606 data_bits = RFCOMM_RPN_DATA_8; 1607 stop_bits = RFCOMM_RPN_STOP_1; 1608 parity = RFCOMM_RPN_PARITY_NONE; 1609 flow_ctrl = RFCOMM_RPN_FLOW_NONE; 1610 xon_char = RFCOMM_RPN_XON_CHAR; 1611 xoff_char = RFCOMM_RPN_XOFF_CHAR; 1612 goto rpn_out; 1613 } 1614 1615 rpn = skb_pull_data(skb, sizeof(*rpn)); 1616 if (!rpn) 1617 return -EILSEQ; 1618 1619 dlci = __get_dlci(rpn->dlci); 1620 1621 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x", 1622 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl, 1623 rpn->xon_char, rpn->xoff_char, rpn->param_mask); 1624 1625 if (!cr) 1626 return 0; 1627 1628 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit, 1629 * no parity, no flow control lines, normal XON/XOFF chars */ 1630 1631 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) { 1632 bit_rate = rpn->bit_rate; 1633 if (bit_rate > RFCOMM_RPN_BR_230400) { 1634 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate); 1635 bit_rate = RFCOMM_RPN_BR_9600; 1636 rpn_mask ^= RFCOMM_RPN_PM_BITRATE; 1637 } 1638 } 1639 1640 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) { 1641 data_bits = __get_rpn_data_bits(rpn->line_settings); 1642 if (data_bits != RFCOMM_RPN_DATA_8) { 1643 BT_DBG("RPN data bits mismatch 0x%x", data_bits); 1644 data_bits = RFCOMM_RPN_DATA_8; 1645 rpn_mask ^= RFCOMM_RPN_PM_DATA; 1646 } 1647 } 1648 1649 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) { 1650 stop_bits = __get_rpn_stop_bits(rpn->line_settings); 1651 if (stop_bits != RFCOMM_RPN_STOP_1) { 1652 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits); 1653 stop_bits = RFCOMM_RPN_STOP_1; 1654 rpn_mask ^= RFCOMM_RPN_PM_STOP; 1655 } 1656 } 1657 1658 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) { 1659 parity = __get_rpn_parity(rpn->line_settings); 1660 if (parity != RFCOMM_RPN_PARITY_NONE) { 1661 BT_DBG("RPN parity mismatch 0x%x", parity); 1662 parity = RFCOMM_RPN_PARITY_NONE; 1663 rpn_mask ^= RFCOMM_RPN_PM_PARITY; 1664 } 1665 } 1666 1667 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) { 1668 flow_ctrl = rpn->flow_ctrl; 1669 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) { 1670 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl); 1671 flow_ctrl = RFCOMM_RPN_FLOW_NONE; 1672 rpn_mask ^= RFCOMM_RPN_PM_FLOW; 1673 } 1674 } 1675 1676 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) { 1677 xon_char = rpn->xon_char; 1678 if (xon_char != RFCOMM_RPN_XON_CHAR) { 1679 BT_DBG("RPN XON char mismatch 0x%x", xon_char); 1680 xon_char = RFCOMM_RPN_XON_CHAR; 1681 rpn_mask ^= RFCOMM_RPN_PM_XON; 1682 } 1683 } 1684 1685 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) { 1686 xoff_char = rpn->xoff_char; 1687 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) { 1688 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char); 1689 xoff_char = RFCOMM_RPN_XOFF_CHAR; 1690 rpn_mask ^= RFCOMM_RPN_PM_XOFF; 1691 } 1692 } 1693 1694 rpn_out: 1695 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits, 1696 parity, flow_ctrl, xon_char, xoff_char, rpn_mask); 1697 1698 return 0; 1699 } 1700 1701 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1702 { 1703 struct rfcomm_rls *rls; 1704 u8 dlci; 1705 1706 rls = skb_pull_data(skb, sizeof(*rls)); 1707 if (!rls) 1708 return -EILSEQ; 1709 1710 dlci = __get_dlci(rls->dlci); 1711 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status); 1712 1713 if (!cr) 1714 return 0; 1715 1716 /* We should probably do something with this information here. But 1717 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's 1718 * mandatory to recognise and respond to RLS */ 1719 1720 rfcomm_send_rls(s, 0, dlci, rls->status); 1721 1722 return 0; 1723 } 1724 1725 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1726 { 1727 struct rfcomm_msc *msc; 1728 struct rfcomm_dlc *d; 1729 u8 dlci; 1730 1731 msc = skb_pull_data(skb, sizeof(*msc)); 1732 if (!msc) 1733 return -EILSEQ; 1734 1735 dlci = __get_dlci(msc->dlci); 1736 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig); 1737 1738 d = rfcomm_dlc_get(s, dlci); 1739 if (!d) 1740 return 0; 1741 1742 if (cr) { 1743 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc) 1744 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1745 else 1746 clear_bit(RFCOMM_TX_THROTTLED, &d->flags); 1747 1748 rfcomm_dlc_lock(d); 1749 1750 d->remote_v24_sig = msc->v24_sig; 1751 1752 if (d->modem_status) 1753 d->modem_status(d, msc->v24_sig); 1754 1755 rfcomm_dlc_unlock(d); 1756 1757 rfcomm_send_msc(s, 0, dlci, msc->v24_sig); 1758 1759 d->mscex |= RFCOMM_MSCEX_RX; 1760 } else 1761 d->mscex |= RFCOMM_MSCEX_TX; 1762 1763 return 0; 1764 } 1765 1766 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb) 1767 { 1768 struct rfcomm_mcc *mcc; 1769 u8 type, cr, len; 1770 1771 mcc = skb_pull_data(skb, sizeof(*mcc)); 1772 if (!mcc) 1773 return -EILSEQ; 1774 1775 cr = __test_cr(mcc->type); 1776 type = __get_mcc_type(mcc->type); 1777 len = __get_mcc_len(mcc->len); 1778 1779 BT_DBG("%p type 0x%x cr %d", s, type, cr); 1780 1781 switch (type) { 1782 case RFCOMM_PN: 1783 rfcomm_recv_pn(s, cr, skb); 1784 break; 1785 1786 case RFCOMM_RPN: 1787 rfcomm_recv_rpn(s, cr, len, skb); 1788 break; 1789 1790 case RFCOMM_RLS: 1791 rfcomm_recv_rls(s, cr, skb); 1792 break; 1793 1794 case RFCOMM_MSC: 1795 rfcomm_recv_msc(s, cr, skb); 1796 break; 1797 1798 case RFCOMM_FCOFF: 1799 if (cr) { 1800 set_bit(RFCOMM_TX_THROTTLED, &s->flags); 1801 rfcomm_send_fcoff(s, 0); 1802 } 1803 break; 1804 1805 case RFCOMM_FCON: 1806 if (cr) { 1807 clear_bit(RFCOMM_TX_THROTTLED, &s->flags); 1808 rfcomm_send_fcon(s, 0); 1809 } 1810 break; 1811 1812 case RFCOMM_TEST: 1813 if (cr) 1814 rfcomm_send_test(s, 0, skb->data, skb->len); 1815 break; 1816 1817 case RFCOMM_NSC: 1818 break; 1819 1820 default: 1821 BT_ERR("Unknown control type 0x%02x", type); 1822 rfcomm_send_nsc(s, cr, type); 1823 break; 1824 } 1825 return 0; 1826 } 1827 1828 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb) 1829 { 1830 struct rfcomm_dlc *d; 1831 1832 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf); 1833 1834 d = rfcomm_dlc_get(s, dlci); 1835 if (!d) { 1836 rfcomm_send_dm(s, dlci); 1837 goto drop; 1838 } 1839 1840 if (pf && d->cfc) { 1841 u8 *credits = skb_pull_data(skb, 1); 1842 1843 if (!credits) 1844 goto drop; 1845 1846 d->tx_credits += *credits; 1847 if (d->tx_credits) 1848 clear_bit(RFCOMM_TX_THROTTLED, &d->flags); 1849 } 1850 1851 if (skb->len && d->state == BT_CONNECTED) { 1852 rfcomm_dlc_lock(d); 1853 d->rx_credits--; 1854 d->data_ready(d, skb); 1855 rfcomm_dlc_unlock(d); 1856 return 0; 1857 } 1858 1859 drop: 1860 kfree_skb(skb); 1861 return 0; 1862 } 1863 1864 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s, 1865 struct sk_buff *skb) 1866 { 1867 struct rfcomm_hdr *hdr = (void *) skb->data; 1868 u8 type, dlci, fcs; 1869 1870 if (!s) { 1871 /* no session, so free socket data */ 1872 kfree_skb(skb); 1873 return s; 1874 } 1875 1876 if (skb->len < sizeof(*hdr) + 1 || 1877 (!__test_ea(hdr->len) && skb->len < sizeof(*hdr) + 2)) { 1878 kfree_skb(skb); 1879 return s; 1880 } 1881 1882 dlci = __get_dlci(hdr->addr); 1883 type = __get_type(hdr->ctrl); 1884 1885 /* Trim FCS */ 1886 skb->len--; skb->tail--; 1887 fcs = *(u8 *)skb_tail_pointer(skb); 1888 1889 if (__check_fcs(skb->data, type, fcs)) { 1890 BT_ERR("bad checksum in packet"); 1891 kfree_skb(skb); 1892 return s; 1893 } 1894 1895 if (__test_ea(hdr->len)) 1896 skb_pull(skb, 3); 1897 else 1898 skb_pull(skb, 4); 1899 1900 switch (type) { 1901 case RFCOMM_SABM: 1902 if (__test_pf(hdr->ctrl)) 1903 rfcomm_recv_sabm(s, dlci); 1904 break; 1905 1906 case RFCOMM_DISC: 1907 if (__test_pf(hdr->ctrl)) 1908 s = rfcomm_recv_disc(s, dlci); 1909 break; 1910 1911 case RFCOMM_UA: 1912 if (__test_pf(hdr->ctrl)) 1913 s = rfcomm_recv_ua(s, dlci); 1914 break; 1915 1916 case RFCOMM_DM: 1917 s = rfcomm_recv_dm(s, dlci); 1918 break; 1919 1920 case RFCOMM_UIH: 1921 if (dlci) { 1922 rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb); 1923 return s; 1924 } 1925 rfcomm_recv_mcc(s, skb); 1926 break; 1927 1928 default: 1929 BT_ERR("Unknown packet type 0x%02x", type); 1930 break; 1931 } 1932 kfree_skb(skb); 1933 return s; 1934 } 1935 1936 /* ---- Connection and data processing ---- */ 1937 1938 static void rfcomm_process_connect(struct rfcomm_session *s) 1939 { 1940 struct rfcomm_dlc *d, *n; 1941 1942 BT_DBG("session %p state %ld", s, s->state); 1943 1944 list_for_each_entry_safe(d, n, &s->dlcs, list) { 1945 if (d->state == BT_CONFIG) { 1946 d->mtu = s->mtu; 1947 if (rfcomm_check_security(d)) { 1948 rfcomm_send_pn(s, 1, d); 1949 } else { 1950 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 1951 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1952 } 1953 } 1954 } 1955 } 1956 1957 /* Send data queued for the DLC. 1958 * Return number of frames left in the queue. 1959 */ 1960 static int rfcomm_process_tx(struct rfcomm_dlc *d) 1961 { 1962 struct sk_buff *skb; 1963 int err; 1964 1965 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d", 1966 d, d->state, d->cfc, d->rx_credits, d->tx_credits); 1967 1968 /* Send pending MSC */ 1969 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags)) 1970 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 1971 1972 if (d->cfc) { 1973 /* CFC enabled. 1974 * Give them some credits */ 1975 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) && 1976 d->rx_credits <= (d->cfc >> 2)) { 1977 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits); 1978 d->rx_credits = d->cfc; 1979 } 1980 } else { 1981 /* CFC disabled. 1982 * Give ourselves some credits */ 1983 d->tx_credits = 5; 1984 } 1985 1986 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 1987 return skb_queue_len(&d->tx_queue); 1988 1989 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) { 1990 err = rfcomm_send_frame(d->session, skb->data, skb->len); 1991 if (err < 0) { 1992 skb_queue_head(&d->tx_queue, skb); 1993 break; 1994 } 1995 kfree_skb(skb); 1996 d->tx_credits--; 1997 } 1998 1999 if (d->cfc && !d->tx_credits) { 2000 /* We're out of TX credits. 2001 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */ 2002 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 2003 } 2004 2005 return skb_queue_len(&d->tx_queue); 2006 } 2007 2008 static void rfcomm_process_dlcs(struct rfcomm_session *s) 2009 { 2010 struct rfcomm_dlc *d, *n; 2011 2012 BT_DBG("session %p state %ld", s, s->state); 2013 2014 list_for_each_entry_safe(d, n, &s->dlcs, list) { 2015 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) { 2016 __rfcomm_dlc_close(d, ETIMEDOUT); 2017 continue; 2018 } 2019 2020 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) { 2021 __rfcomm_dlc_close(d, ECONNREFUSED); 2022 continue; 2023 } 2024 2025 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) { 2026 rfcomm_dlc_clear_timer(d); 2027 if (d->out) { 2028 rfcomm_send_pn(s, 1, d); 2029 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT); 2030 } else { 2031 if (d->defer_setup) { 2032 set_bit(RFCOMM_DEFER_SETUP, &d->flags); 2033 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 2034 2035 rfcomm_dlc_lock(d); 2036 d->state = BT_CONNECT2; 2037 d->state_change(d, 0); 2038 rfcomm_dlc_unlock(d); 2039 } else 2040 __rfcomm_dlc_accept(d); 2041 } 2042 continue; 2043 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) { 2044 rfcomm_dlc_clear_timer(d); 2045 if (!d->out) 2046 rfcomm_send_dm(s, d->dlci); 2047 else 2048 d->state = BT_CLOSED; 2049 __rfcomm_dlc_close(d, ECONNREFUSED); 2050 continue; 2051 } 2052 2053 if (test_bit(RFCOMM_SEC_PENDING, &d->flags)) 2054 continue; 2055 2056 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags)) 2057 continue; 2058 2059 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) && 2060 d->mscex == RFCOMM_MSCEX_OK) 2061 rfcomm_process_tx(d); 2062 } 2063 } 2064 2065 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) 2066 { 2067 struct socket *sock = s->sock; 2068 struct sock *sk = sock->sk; 2069 struct sk_buff *skb; 2070 2071 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue)); 2072 2073 /* Get data directly from socket receive queue without copying it. */ 2074 while ((skb = skb_dequeue(&sk->sk_receive_queue))) { 2075 skb_orphan(skb); 2076 if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { 2077 s = rfcomm_recv_frame(s, skb); 2078 if (!s) 2079 break; 2080 } else { 2081 kfree_skb(skb); 2082 } 2083 } 2084 2085 if (s && (sk->sk_state == BT_CLOSED)) 2086 s = rfcomm_session_close(s, sk->sk_err); 2087 2088 return s; 2089 } 2090 2091 static void rfcomm_accept_connection(struct rfcomm_session *s) 2092 { 2093 struct socket *sock = s->sock, *nsock; 2094 int err; 2095 2096 /* Fast check for a new connection. 2097 * Avoids unnecessary socket allocations. 2098 */ 2099 if (list_empty(&bt_sk(sock->sk)->accept_q)) 2100 return; 2101 2102 BT_DBG("session %p", s); 2103 2104 err = kernel_accept(sock, &nsock, O_NONBLOCK); 2105 if (err < 0) 2106 return; 2107 2108 /* Set our callbacks */ 2109 nsock->sk->sk_data_ready = rfcomm_l2data_ready; 2110 nsock->sk->sk_state_change = rfcomm_l2state_change; 2111 2112 s = rfcomm_session_add(nsock, BT_OPEN); 2113 if (s) { 2114 /* We should adjust MTU on incoming sessions. 2115 * L2CAP MTU minus UIH header and FCS. */ 2116 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu, 2117 l2cap_pi(nsock->sk)->chan->imtu) - 5; 2118 2119 rfcomm_schedule(); 2120 } else 2121 sock_release(nsock); 2122 } 2123 2124 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s) 2125 { 2126 struct sock *sk = s->sock->sk; 2127 2128 BT_DBG("%p state %ld", s, s->state); 2129 2130 switch (sk->sk_state) { 2131 case BT_CONNECTED: 2132 s->state = BT_CONNECT; 2133 2134 /* We can adjust MTU on outgoing sessions. 2135 * L2CAP MTU minus UIH header and FCS. */ 2136 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5; 2137 2138 rfcomm_send_sabm(s, 0); 2139 break; 2140 2141 case BT_CLOSED: 2142 s = rfcomm_session_close(s, sk->sk_err); 2143 break; 2144 } 2145 return s; 2146 } 2147 2148 static void rfcomm_process_sessions(void) 2149 { 2150 struct rfcomm_session *s, *n; 2151 2152 rfcomm_lock(); 2153 2154 list_for_each_entry_safe(s, n, &session_list, list) { 2155 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) { 2156 s->state = BT_DISCONN; 2157 rfcomm_send_disc(s, 0); 2158 continue; 2159 } 2160 2161 switch (s->state) { 2162 case BT_LISTEN: 2163 rfcomm_accept_connection(s); 2164 continue; 2165 2166 case BT_BOUND: 2167 s = rfcomm_check_connection(s); 2168 break; 2169 2170 default: 2171 s = rfcomm_process_rx(s); 2172 break; 2173 } 2174 2175 if (s) 2176 rfcomm_process_dlcs(s); 2177 } 2178 2179 rfcomm_unlock(); 2180 } 2181 2182 static int rfcomm_add_listener(bdaddr_t *ba) 2183 { 2184 struct sockaddr_l2 addr; 2185 struct socket *sock; 2186 struct sock *sk; 2187 struct rfcomm_session *s; 2188 int err = 0; 2189 2190 /* Create socket */ 2191 err = rfcomm_l2sock_create(&sock); 2192 if (err < 0) { 2193 BT_ERR("Create socket failed %d", err); 2194 return err; 2195 } 2196 2197 /* Bind socket */ 2198 bacpy(&addr.l2_bdaddr, ba); 2199 addr.l2_family = AF_BLUETOOTH; 2200 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM); 2201 addr.l2_cid = 0; 2202 addr.l2_bdaddr_type = BDADDR_BREDR; 2203 err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr)); 2204 if (err < 0) { 2205 BT_ERR("Bind failed %d", err); 2206 goto failed; 2207 } 2208 2209 /* Set L2CAP options */ 2210 sk = sock->sk; 2211 lock_sock(sk); 2212 /* Set MTU to 0 so L2CAP can auto select the MTU */ 2213 l2cap_pi(sk)->chan->imtu = 0; 2214 release_sock(sk); 2215 2216 /* Start listening on the socket */ 2217 err = kernel_listen(sock, 10); 2218 if (err) { 2219 BT_ERR("Listen failed %d", err); 2220 goto failed; 2221 } 2222 2223 /* Add listening session */ 2224 s = rfcomm_session_add(sock, BT_LISTEN); 2225 if (!s) { 2226 err = -ENOMEM; 2227 goto failed; 2228 } 2229 2230 return 0; 2231 failed: 2232 sock_release(sock); 2233 return err; 2234 } 2235 2236 static void rfcomm_kill_listener(void) 2237 { 2238 struct rfcomm_session *s, *n; 2239 2240 BT_DBG(""); 2241 2242 rfcomm_lock(); 2243 list_for_each_entry_safe(s, n, &session_list, list) 2244 rfcomm_session_del(s); 2245 rfcomm_unlock(); 2246 } 2247 2248 static int rfcomm_run(void *unused) 2249 { 2250 DEFINE_WAIT_FUNC(wait, woken_wake_function); 2251 BT_DBG(""); 2252 2253 set_user_nice(current, -10); 2254 2255 rfcomm_add_listener(BDADDR_ANY); 2256 2257 add_wait_queue(&rfcomm_wq, &wait); 2258 while (!kthread_should_stop()) { 2259 2260 /* Process stuff */ 2261 rfcomm_process_sessions(); 2262 2263 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 2264 } 2265 remove_wait_queue(&rfcomm_wq, &wait); 2266 2267 rfcomm_kill_listener(); 2268 2269 return 0; 2270 } 2271 2272 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) 2273 { 2274 struct rfcomm_session *s; 2275 struct rfcomm_dlc *d, *n; 2276 2277 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt); 2278 2279 rfcomm_lock(); 2280 2281 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst); 2282 if (!s) { 2283 rfcomm_unlock(); 2284 return; 2285 } 2286 2287 list_for_each_entry_safe(d, n, &s->dlcs, list) { 2288 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) { 2289 rfcomm_dlc_clear_timer(d); 2290 if (status || encrypt == 0x00) { 2291 set_bit(RFCOMM_ENC_DROP, &d->flags); 2292 continue; 2293 } 2294 } 2295 2296 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) { 2297 if (d->sec_level == BT_SECURITY_MEDIUM) { 2298 set_bit(RFCOMM_SEC_PENDING, &d->flags); 2299 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 2300 continue; 2301 } else if (d->sec_level == BT_SECURITY_HIGH || 2302 d->sec_level == BT_SECURITY_FIPS) { 2303 set_bit(RFCOMM_ENC_DROP, &d->flags); 2304 continue; 2305 } 2306 } 2307 2308 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags)) 2309 continue; 2310 2311 if (!status && hci_conn_check_secure(conn, d->sec_level)) 2312 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags); 2313 else 2314 set_bit(RFCOMM_AUTH_REJECT, &d->flags); 2315 } 2316 2317 rfcomm_unlock(); 2318 2319 rfcomm_schedule(); 2320 } 2321 2322 static struct hci_cb rfcomm_cb = { 2323 .name = "RFCOMM", 2324 .security_cfm = rfcomm_security_cfm 2325 }; 2326 2327 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x) 2328 { 2329 struct rfcomm_session *s; 2330 2331 rfcomm_lock(); 2332 2333 list_for_each_entry(s, &session_list, list) { 2334 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan; 2335 struct rfcomm_dlc *d; 2336 list_for_each_entry(d, &s->dlcs, list) { 2337 seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n", 2338 &chan->src, &chan->dst, 2339 d->state, d->dlci, d->mtu, 2340 d->rx_credits, d->tx_credits); 2341 } 2342 } 2343 2344 rfcomm_unlock(); 2345 2346 return 0; 2347 } 2348 2349 DEFINE_SHOW_ATTRIBUTE(rfcomm_dlc_debugfs); 2350 2351 static struct dentry *rfcomm_dlc_debugfs; 2352 2353 /* ---- Initialization ---- */ 2354 static int __init rfcomm_init(void) 2355 { 2356 int err; 2357 2358 hci_register_cb(&rfcomm_cb); 2359 2360 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd"); 2361 if (IS_ERR(rfcomm_thread)) { 2362 err = PTR_ERR(rfcomm_thread); 2363 goto unregister; 2364 } 2365 2366 err = rfcomm_init_ttys(); 2367 if (err < 0) 2368 goto stop; 2369 2370 err = rfcomm_init_sockets(); 2371 if (err < 0) 2372 goto cleanup; 2373 2374 BT_INFO("RFCOMM ver %s", VERSION); 2375 2376 if (IS_ERR_OR_NULL(bt_debugfs)) 2377 return 0; 2378 2379 rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444, 2380 bt_debugfs, NULL, 2381 &rfcomm_dlc_debugfs_fops); 2382 2383 return 0; 2384 2385 cleanup: 2386 rfcomm_cleanup_ttys(); 2387 2388 stop: 2389 kthread_stop(rfcomm_thread); 2390 2391 unregister: 2392 hci_unregister_cb(&rfcomm_cb); 2393 2394 return err; 2395 } 2396 2397 static void __exit rfcomm_exit(void) 2398 { 2399 debugfs_remove(rfcomm_dlc_debugfs); 2400 2401 hci_unregister_cb(&rfcomm_cb); 2402 2403 kthread_stop(rfcomm_thread); 2404 2405 rfcomm_cleanup_ttys(); 2406 2407 rfcomm_cleanup_sockets(); 2408 } 2409 2410 module_init(rfcomm_init); 2411 module_exit(rfcomm_exit); 2412 2413 module_param(disable_cfc, bool, 0644); 2414 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control"); 2415 2416 module_param(channel_mtu, int, 0644); 2417 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel"); 2418 2419 module_param(l2cap_ertm, bool, 0644); 2420 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection"); 2421 2422 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 2423 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION); 2424 MODULE_VERSION(VERSION); 2425 MODULE_LICENSE("GPL"); 2426 MODULE_ALIAS("bt-proto-3"); 2427