1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 /* 22 * Bluetooth RFCOMM core. 23 */ 24 25 #include <linux/module.h> 26 #include <linux/debugfs.h> 27 #include <linux/kthread.h> 28 #include <linux/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/l2cap.h> 33 #include <net/bluetooth/rfcomm.h> 34 35 #include <trace/events/sock.h> 36 37 #define VERSION "1.11" 38 39 static bool disable_cfc; 40 static bool l2cap_ertm; 41 static int channel_mtu = -1; 42 43 static struct task_struct *rfcomm_thread; 44 45 static DEFINE_MUTEX(rfcomm_mutex); 46 #define rfcomm_lock() mutex_lock(&rfcomm_mutex) 47 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex) 48 49 50 static LIST_HEAD(session_list); 51 52 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len); 53 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci); 54 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci); 55 static int rfcomm_queue_disc(struct rfcomm_dlc *d); 56 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type); 57 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d); 58 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig); 59 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len); 60 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits); 61 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr); 62 63 static void rfcomm_process_connect(struct rfcomm_session *s); 64 65 static struct socket *rfcomm_session_connect(bdaddr_t *src, bdaddr_t *dst, 66 u8 sec_level, int *err); 67 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state); 68 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst); 69 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s); 70 71 /* ---- RFCOMM frame parsing macros ---- */ 72 #define __get_dlci(b) ((b & 0xfc) >> 2) 73 #define __get_type(b) ((b & 0xef)) 74 75 #define __test_ea(b) ((b & 0x01)) 76 #define __test_cr(b) (!!(b & 0x02)) 77 #define __test_pf(b) (!!(b & 0x10)) 78 79 #define __session_dir(s) ((s)->initiator ? 0x00 : 0x01) 80 81 #define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01) 82 #define __ctrl(type, pf) (((type & 0xef) | (pf << 4))) 83 #define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir) 84 #define __srv_channel(dlci) (dlci >> 1) 85 86 #define __len8(len) (((len) << 1) | 1) 87 #define __len16(len) ((len) << 1) 88 89 /* MCC macros */ 90 #define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01)) 91 #define __get_mcc_type(b) ((b & 0xfc) >> 2) 92 #define __get_mcc_len(b) ((b & 0xfe) >> 1) 93 94 /* RPN macros */ 95 #define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3)) 96 #define __get_rpn_data_bits(line) ((line) & 0x3) 97 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1) 98 #define __get_rpn_parity(line) (((line) >> 3) & 0x7) 99 100 static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq); 101 102 static void rfcomm_schedule(void) 103 { 104 wake_up_all(&rfcomm_wq); 105 } 106 107 /* ---- RFCOMM FCS computation ---- */ 108 109 /* reversed, 8-bit, poly=0x07 */ 110 static unsigned char rfcomm_crc_table[256] = { 111 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75, 112 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b, 113 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69, 114 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67, 115 116 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d, 117 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43, 118 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51, 119 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f, 120 121 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05, 122 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b, 123 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19, 124 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17, 125 126 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d, 127 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33, 128 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21, 129 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f, 130 131 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95, 132 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b, 133 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89, 134 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87, 135 136 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad, 137 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3, 138 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1, 139 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf, 140 141 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5, 142 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb, 143 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9, 144 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7, 145 146 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd, 147 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3, 148 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1, 149 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf 150 }; 151 152 /* CRC on 2 bytes */ 153 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]]) 154 155 /* FCS on 2 bytes */ 156 static inline u8 __fcs(u8 *data) 157 { 158 return 0xff - __crc(data); 159 } 160 161 /* FCS on 3 bytes */ 162 static inline u8 __fcs2(u8 *data) 163 { 164 return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]]; 165 } 166 167 /* Check FCS */ 168 static inline int __check_fcs(u8 *data, int type, u8 fcs) 169 { 170 u8 f = __crc(data); 171 172 if (type != RFCOMM_UIH) 173 f = rfcomm_crc_table[f ^ data[2]]; 174 175 return rfcomm_crc_table[f ^ fcs] != 0xcf; 176 } 177 178 /* ---- L2CAP callbacks ---- */ 179 static void rfcomm_l2state_change(struct sock *sk) 180 { 181 BT_DBG("%p state %d", sk, sk->sk_state); 182 rfcomm_schedule(); 183 } 184 185 static void rfcomm_l2data_ready(struct sock *sk) 186 { 187 trace_sk_data_ready(sk); 188 189 BT_DBG("%p", sk); 190 rfcomm_schedule(); 191 } 192 193 static int rfcomm_l2sock_create(struct socket **sock) 194 { 195 int err; 196 197 BT_DBG(""); 198 199 err = sock_create_kern(&init_net, PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock); 200 if (!err) { 201 struct sock *sk = (*sock)->sk; 202 sk->sk_data_ready = rfcomm_l2data_ready; 203 sk->sk_state_change = rfcomm_l2state_change; 204 } 205 return err; 206 } 207 208 static int rfcomm_check_security(struct rfcomm_dlc *d) 209 { 210 struct sock *sk = d->session->sock->sk; 211 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 212 213 __u8 auth_type; 214 215 switch (d->sec_level) { 216 case BT_SECURITY_HIGH: 217 case BT_SECURITY_FIPS: 218 auth_type = HCI_AT_GENERAL_BONDING_MITM; 219 break; 220 case BT_SECURITY_MEDIUM: 221 auth_type = HCI_AT_GENERAL_BONDING; 222 break; 223 default: 224 auth_type = HCI_AT_NO_BONDING; 225 break; 226 } 227 228 return hci_conn_security(conn->hcon, d->sec_level, auth_type, 229 d->out); 230 } 231 232 static void rfcomm_session_timeout(struct timer_list *t) 233 { 234 struct rfcomm_session *s = timer_container_of(s, t, timer); 235 236 BT_DBG("session %p state %ld", s, s->state); 237 238 set_bit(RFCOMM_TIMED_OUT, &s->flags); 239 rfcomm_schedule(); 240 } 241 242 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout) 243 { 244 BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout); 245 246 mod_timer(&s->timer, jiffies + timeout); 247 } 248 249 static void rfcomm_session_clear_timer(struct rfcomm_session *s) 250 { 251 BT_DBG("session %p state %ld", s, s->state); 252 253 timer_delete_sync(&s->timer); 254 } 255 256 /* ---- RFCOMM DLCs ---- */ 257 static void rfcomm_dlc_timeout(struct timer_list *t) 258 { 259 struct rfcomm_dlc *d = timer_container_of(d, t, timer); 260 261 BT_DBG("dlc %p state %ld", d, d->state); 262 263 set_bit(RFCOMM_TIMED_OUT, &d->flags); 264 rfcomm_dlc_put(d); 265 rfcomm_schedule(); 266 } 267 268 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout) 269 { 270 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout); 271 272 if (!mod_timer(&d->timer, jiffies + timeout)) 273 rfcomm_dlc_hold(d); 274 } 275 276 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d) 277 { 278 BT_DBG("dlc %p state %ld", d, d->state); 279 280 if (timer_delete(&d->timer)) 281 rfcomm_dlc_put(d); 282 } 283 284 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d) 285 { 286 BT_DBG("%p", d); 287 288 d->state = BT_OPEN; 289 d->flags = 0; 290 d->mscex = 0; 291 d->sec_level = BT_SECURITY_LOW; 292 d->mtu = RFCOMM_DEFAULT_MTU; 293 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV; 294 295 d->cfc = RFCOMM_CFC_DISABLED; 296 d->rx_credits = RFCOMM_DEFAULT_CREDITS; 297 } 298 299 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio) 300 { 301 struct rfcomm_dlc *d = kzalloc_obj(*d, prio); 302 303 if (!d) 304 return NULL; 305 306 timer_setup(&d->timer, rfcomm_dlc_timeout, 0); 307 308 skb_queue_head_init(&d->tx_queue); 309 mutex_init(&d->lock); 310 refcount_set(&d->refcnt, 1); 311 312 rfcomm_dlc_clear_state(d); 313 314 BT_DBG("%p", d); 315 316 return d; 317 } 318 319 void rfcomm_dlc_free(struct rfcomm_dlc *d) 320 { 321 BT_DBG("%p", d); 322 323 skb_queue_purge(&d->tx_queue); 324 kfree(d); 325 } 326 327 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d) 328 { 329 BT_DBG("dlc %p session %p", d, s); 330 331 rfcomm_session_clear_timer(s); 332 rfcomm_dlc_hold(d); 333 list_add(&d->list, &s->dlcs); 334 d->session = s; 335 } 336 337 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d) 338 { 339 struct rfcomm_session *s = d->session; 340 341 BT_DBG("dlc %p refcnt %d session %p", d, refcount_read(&d->refcnt), s); 342 343 list_del(&d->list); 344 d->session = NULL; 345 rfcomm_dlc_put(d); 346 347 if (list_empty(&s->dlcs)) 348 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT); 349 } 350 351 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci) 352 { 353 struct rfcomm_dlc *d; 354 355 list_for_each_entry(d, &s->dlcs, list) 356 if (d->dlci == dlci) 357 return d; 358 359 return NULL; 360 } 361 362 static int rfcomm_check_channel(u8 channel) 363 { 364 return channel < 1 || channel > 30; 365 } 366 367 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, struct rfcomm_session *s, 368 u8 channel) 369 { 370 u8 dlci; 371 372 BT_DBG("dlc %p state %ld session %p channel %d", 373 d, d->state, s, channel); 374 375 if (d->state != BT_OPEN && d->state != BT_CLOSED) 376 return 0; 377 378 dlci = __dlci(__session_dir(s), channel); 379 380 /* Check if DLCI already exists */ 381 if (rfcomm_dlc_get(s, dlci)) 382 return -EBUSY; 383 384 rfcomm_dlc_clear_state(d); 385 386 d->dlci = dlci; 387 d->addr = __addr(s->initiator, dlci); 388 d->priority = 7; 389 390 d->state = BT_CONFIG; 391 rfcomm_dlc_link(s, d); 392 393 d->out = 1; 394 395 d->mtu = s->mtu; 396 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc; 397 398 if (s->state == BT_CONNECTED) { 399 if (rfcomm_check_security(d)) 400 rfcomm_send_pn(s, 1, d); 401 else 402 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 403 } 404 405 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT); 406 407 return 0; 408 } 409 410 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel) 411 { 412 struct rfcomm_session *s; 413 struct socket *sock; 414 int err; 415 416 BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d", 417 d, d->state, src, dst, channel); 418 419 if (rfcomm_check_channel(channel)) 420 return -EINVAL; 421 422 rfcomm_lock(); 423 424 clear_bit(RFCOMM_CLOSED, &d->flags); 425 426 /* Do not page the remote device for a DLC that cannot be opened 427 * anyway. __rfcomm_dlc_open() looks at the state again once the 428 * lock has been re-acquired below. 429 */ 430 if (d->state != BT_OPEN && d->state != BT_CLOSED) { 431 rfcomm_unlock(); 432 return 0; 433 } 434 435 s = rfcomm_session_get(src, dst); 436 if (s) { 437 err = __rfcomm_dlc_open(d, s, channel); 438 rfcomm_unlock(); 439 return err; 440 } 441 rfcomm_unlock(); 442 443 /* There is no session for this pair yet. kernel_connect() ends up in 444 * l2cap_chan_connect(), which takes hdev->lock, and the HCI event 445 * path takes rfcomm_mutex while holding hdev->lock, so the socket has 446 * to be connected with rfcomm_mutex released. 447 */ 448 sock = rfcomm_session_connect(src, dst, d->sec_level, &err); 449 if (!sock) 450 return err; 451 452 rfcomm_lock(); 453 454 /* The DLC may have been closed while the socket was connecting. It 455 * was not on a session, so rfcomm_dlc_close() could only mark it; 456 * attaching it now would leave it with no owner. 457 */ 458 if (test_bit(RFCOMM_CLOSED, &d->flags)) { 459 rfcomm_unlock(); 460 sock_release(sock); 461 return -ECONNRESET; 462 } 463 464 /* Another opener may have added a session for the same pair in the 465 * meantime; that one is used and this socket is dropped. 466 */ 467 s = rfcomm_session_get(src, dst); 468 if (!s) { 469 s = rfcomm_session_add(sock, BT_BOUND); 470 if (s) { 471 s->initiator = 1; 472 sock = NULL; 473 } 474 } 475 476 err = s ? __rfcomm_dlc_open(d, s, channel) : -ENOMEM; 477 478 rfcomm_unlock(); 479 480 if (sock) 481 sock_release(sock); 482 483 /* Over an existing ACL link the connection can complete before the 484 * session reaches the list, and that wakeup is then lost, so let 485 * krfcommd look at the socket state now. 486 */ 487 rfcomm_schedule(); 488 489 return err; 490 } 491 492 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d) 493 { 494 struct rfcomm_session *s = d->session; 495 496 d->state = BT_DISCONN; 497 if (skb_queue_empty(&d->tx_queue)) { 498 rfcomm_send_disc(s, d->dlci); 499 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT); 500 } else { 501 rfcomm_queue_disc(d); 502 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2); 503 } 504 } 505 506 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err) 507 { 508 struct rfcomm_session *s = d->session; 509 if (!s) 510 return 0; 511 512 BT_DBG("dlc %p state %ld dlci %d err %d session %p", 513 d, d->state, d->dlci, err, s); 514 515 switch (d->state) { 516 case BT_CONNECT: 517 case BT_CONFIG: 518 case BT_OPEN: 519 case BT_CONNECT2: 520 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) { 521 set_bit(RFCOMM_AUTH_REJECT, &d->flags); 522 rfcomm_schedule(); 523 return 0; 524 } 525 } 526 527 switch (d->state) { 528 case BT_CONNECT: 529 case BT_CONNECTED: 530 __rfcomm_dlc_disconn(d); 531 break; 532 533 case BT_CONFIG: 534 if (s->state != BT_BOUND) { 535 __rfcomm_dlc_disconn(d); 536 break; 537 } 538 /* if closing a dlc in a session that hasn't been started, 539 * just close and unlink the dlc 540 */ 541 fallthrough; 542 543 default: 544 rfcomm_dlc_clear_timer(d); 545 546 rfcomm_dlc_lock(d); 547 d->state = BT_CLOSED; 548 d->state_change(d, err); 549 rfcomm_dlc_unlock(d); 550 551 skb_queue_purge(&d->tx_queue); 552 rfcomm_dlc_unlink(d); 553 } 554 555 return 0; 556 } 557 558 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err) 559 { 560 int r = 0; 561 struct rfcomm_dlc *d_list; 562 struct rfcomm_session *s, *s_list; 563 564 BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err); 565 566 rfcomm_lock(); 567 568 s = d->session; 569 if (!s) { 570 /* Not on a session yet: rfcomm_dlc_open() may be connecting a 571 * socket for it with rfcomm_mutex released. Leave a mark so 572 * that it does not attach the DLC once it holds the lock again. 573 */ 574 set_bit(RFCOMM_CLOSED, &d->flags); 575 goto no_session; 576 } 577 578 /* after waiting on the mutex check the session still exists 579 * then check the dlc still exists 580 */ 581 list_for_each_entry(s_list, &session_list, list) { 582 if (s_list == s) { 583 list_for_each_entry(d_list, &s->dlcs, list) { 584 if (d_list == d) { 585 r = __rfcomm_dlc_close(d, err); 586 break; 587 } 588 } 589 break; 590 } 591 } 592 593 no_session: 594 rfcomm_unlock(); 595 return r; 596 } 597 598 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel) 599 { 600 struct rfcomm_session *s; 601 struct rfcomm_dlc *dlc = NULL; 602 u8 dlci; 603 604 if (rfcomm_check_channel(channel)) 605 return ERR_PTR(-EINVAL); 606 607 rfcomm_lock(); 608 s = rfcomm_session_get(src, dst); 609 if (s) { 610 dlci = __dlci(__session_dir(s), channel); 611 dlc = rfcomm_dlc_get(s, dlci); 612 } 613 rfcomm_unlock(); 614 return dlc; 615 } 616 617 static int rfcomm_dlc_send_frag(struct rfcomm_dlc *d, struct sk_buff *frag) 618 { 619 int len = frag->len; 620 621 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); 622 623 if (len > d->mtu) 624 return -EINVAL; 625 626 rfcomm_make_uih(frag, d->addr); 627 __skb_queue_tail(&d->tx_queue, frag); 628 629 return len; 630 } 631 632 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb) 633 { 634 unsigned long flags; 635 struct sk_buff *frag, *next; 636 int len; 637 638 if (d->state != BT_CONNECTED) 639 return -ENOTCONN; 640 641 frag = skb_shinfo(skb)->frag_list; 642 skb_shinfo(skb)->frag_list = NULL; 643 644 /* Queue all fragments atomically. */ 645 spin_lock_irqsave(&d->tx_queue.lock, flags); 646 647 len = rfcomm_dlc_send_frag(d, skb); 648 if (len < 0 || !frag) 649 goto unlock; 650 651 for (; frag; frag = next) { 652 int ret; 653 654 next = frag->next; 655 656 ret = rfcomm_dlc_send_frag(d, frag); 657 if (ret < 0) { 658 dev_kfree_skb_irq(frag); 659 goto unlock; 660 } 661 662 len += ret; 663 } 664 665 unlock: 666 spin_unlock_irqrestore(&d->tx_queue.lock, flags); 667 668 if (len > 0 && !test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 669 rfcomm_schedule(); 670 return len; 671 } 672 673 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb) 674 { 675 int len = skb->len; 676 677 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); 678 679 rfcomm_make_uih(skb, d->addr); 680 skb_queue_tail(&d->tx_queue, skb); 681 682 if (d->state == BT_CONNECTED && 683 !test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 684 rfcomm_schedule(); 685 } 686 687 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d) 688 { 689 BT_DBG("dlc %p state %ld", d, d->state); 690 691 if (!d->cfc) { 692 d->v24_sig |= RFCOMM_V24_FC; 693 set_bit(RFCOMM_MSC_PENDING, &d->flags); 694 } 695 rfcomm_schedule(); 696 } 697 698 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d) 699 { 700 BT_DBG("dlc %p state %ld", d, d->state); 701 702 if (!d->cfc) { 703 d->v24_sig &= ~RFCOMM_V24_FC; 704 set_bit(RFCOMM_MSC_PENDING, &d->flags); 705 } 706 rfcomm_schedule(); 707 } 708 709 /* 710 Set/get modem status functions use _local_ status i.e. what we report 711 to the other side. 712 Remote status is provided by dlc->modem_status() callback. 713 */ 714 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig) 715 { 716 BT_DBG("dlc %p state %ld v24_sig 0x%x", 717 d, d->state, v24_sig); 718 719 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags)) 720 v24_sig |= RFCOMM_V24_FC; 721 else 722 v24_sig &= ~RFCOMM_V24_FC; 723 724 d->v24_sig = v24_sig; 725 726 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags)) 727 rfcomm_schedule(); 728 729 return 0; 730 } 731 732 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig) 733 { 734 BT_DBG("dlc %p state %ld v24_sig 0x%x", 735 d, d->state, d->v24_sig); 736 737 *v24_sig = d->v24_sig; 738 return 0; 739 } 740 741 /* ---- RFCOMM sessions ---- */ 742 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state) 743 { 744 struct rfcomm_session *s = kzalloc_obj(*s); 745 746 if (!s) 747 return NULL; 748 749 BT_DBG("session %p sock %p", s, sock); 750 751 timer_setup(&s->timer, rfcomm_session_timeout, 0); 752 753 INIT_LIST_HEAD(&s->dlcs); 754 s->state = state; 755 s->sock = sock; 756 757 s->mtu = RFCOMM_DEFAULT_MTU; 758 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN; 759 760 /* Do not increment module usage count for listening sessions. 761 * Otherwise we won't be able to unload the module. */ 762 if (state != BT_LISTEN) 763 if (!try_module_get(THIS_MODULE)) { 764 kfree(s); 765 return NULL; 766 } 767 768 list_add(&s->list, &session_list); 769 770 return s; 771 } 772 773 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s) 774 { 775 int state = s->state; 776 777 BT_DBG("session %p state %ld", s, s->state); 778 779 list_del(&s->list); 780 781 rfcomm_session_clear_timer(s); 782 sock_release(s->sock); 783 kfree(s); 784 785 if (state != BT_LISTEN) 786 module_put(THIS_MODULE); 787 788 return NULL; 789 } 790 791 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst) 792 { 793 struct rfcomm_session *s, *n; 794 struct l2cap_chan *chan; 795 list_for_each_entry_safe(s, n, &session_list, list) { 796 chan = l2cap_pi(s->sock->sk)->chan; 797 798 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) && 799 !bacmp(&chan->dst, dst)) 800 return s; 801 } 802 return NULL; 803 } 804 805 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s, 806 int err) 807 { 808 struct rfcomm_dlc *d, *n; 809 810 s->state = BT_CLOSED; 811 812 BT_DBG("session %p state %ld err %d", s, s->state, err); 813 814 /* Close all dlcs */ 815 list_for_each_entry_safe(d, n, &s->dlcs, list) { 816 d->state = BT_CLOSED; 817 __rfcomm_dlc_close(d, err); 818 } 819 820 rfcomm_session_clear_timer(s); 821 return rfcomm_session_del(s); 822 } 823 824 /* Creates the L2CAP socket a new session will run on and starts connecting 825 * it. Must be called with rfcomm_mutex released. 826 */ 827 static struct socket *rfcomm_session_connect(bdaddr_t *src, bdaddr_t *dst, 828 u8 sec_level, int *err) 829 { 830 struct sockaddr_l2 addr; 831 struct socket *sock; 832 struct sock *sk; 833 834 BT_DBG("%pMR -> %pMR", src, dst); 835 836 *err = rfcomm_l2sock_create(&sock); 837 if (*err < 0) 838 return NULL; 839 840 bacpy(&addr.l2_bdaddr, src); 841 addr.l2_family = AF_BLUETOOTH; 842 addr.l2_psm = 0; 843 addr.l2_cid = 0; 844 addr.l2_bdaddr_type = BDADDR_BREDR; 845 *err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr)); 846 if (*err < 0) 847 goto failed; 848 849 /* Set L2CAP options */ 850 sk = sock->sk; 851 lock_sock(sk); 852 /* Set MTU to 0 so L2CAP can auto select the MTU */ 853 l2cap_pi(sk)->chan->imtu = 0; 854 l2cap_pi(sk)->chan->sec_level = sec_level; 855 if (l2cap_ertm) 856 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM; 857 release_sock(sk); 858 859 bacpy(&addr.l2_bdaddr, dst); 860 addr.l2_family = AF_BLUETOOTH; 861 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM); 862 addr.l2_cid = 0; 863 addr.l2_bdaddr_type = BDADDR_BREDR; 864 *err = kernel_connect(sock, (struct sockaddr_unsized *)&addr, sizeof(addr), O_NONBLOCK); 865 if (*err && *err != -EINPROGRESS) 866 goto failed; 867 868 return sock; 869 870 failed: 871 sock_release(sock); 872 return NULL; 873 } 874 875 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst) 876 { 877 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan; 878 if (src) 879 bacpy(src, &chan->src); 880 if (dst) 881 bacpy(dst, &chan->dst); 882 } 883 884 /* ---- RFCOMM frame sending ---- */ 885 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len) 886 { 887 struct kvec iv = { data, len }; 888 struct msghdr msg; 889 890 BT_DBG("session %p len %d", s, len); 891 892 memset(&msg, 0, sizeof(msg)); 893 894 return kernel_sendmsg(s->sock, &msg, &iv, 1, len); 895 } 896 897 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd) 898 { 899 BT_DBG("%p cmd %u", s, cmd->ctrl); 900 901 return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd)); 902 } 903 904 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci) 905 { 906 struct rfcomm_cmd cmd; 907 908 BT_DBG("%p dlci %d", s, dlci); 909 910 cmd.addr = __addr(s->initiator, dlci); 911 cmd.ctrl = __ctrl(RFCOMM_SABM, 1); 912 cmd.len = __len8(0); 913 cmd.fcs = __fcs2((u8 *) &cmd); 914 915 return rfcomm_send_cmd(s, &cmd); 916 } 917 918 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci) 919 { 920 struct rfcomm_cmd cmd; 921 922 BT_DBG("%p dlci %d", s, dlci); 923 924 cmd.addr = __addr(!s->initiator, dlci); 925 cmd.ctrl = __ctrl(RFCOMM_UA, 1); 926 cmd.len = __len8(0); 927 cmd.fcs = __fcs2((u8 *) &cmd); 928 929 return rfcomm_send_cmd(s, &cmd); 930 } 931 932 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci) 933 { 934 struct rfcomm_cmd cmd; 935 936 BT_DBG("%p dlci %d", s, dlci); 937 938 cmd.addr = __addr(s->initiator, dlci); 939 cmd.ctrl = __ctrl(RFCOMM_DISC, 1); 940 cmd.len = __len8(0); 941 cmd.fcs = __fcs2((u8 *) &cmd); 942 943 return rfcomm_send_cmd(s, &cmd); 944 } 945 946 static int rfcomm_queue_disc(struct rfcomm_dlc *d) 947 { 948 struct rfcomm_cmd *cmd; 949 struct sk_buff *skb; 950 951 BT_DBG("dlc %p dlci %d", d, d->dlci); 952 953 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL); 954 if (!skb) 955 return -ENOMEM; 956 957 cmd = __skb_put(skb, sizeof(*cmd)); 958 cmd->addr = d->addr; 959 cmd->ctrl = __ctrl(RFCOMM_DISC, 1); 960 cmd->len = __len8(0); 961 cmd->fcs = __fcs2((u8 *) cmd); 962 963 skb_queue_tail(&d->tx_queue, skb); 964 rfcomm_schedule(); 965 return 0; 966 } 967 968 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci) 969 { 970 struct rfcomm_cmd cmd; 971 972 BT_DBG("%p dlci %d", s, dlci); 973 974 cmd.addr = __addr(!s->initiator, dlci); 975 cmd.ctrl = __ctrl(RFCOMM_DM, 1); 976 cmd.len = __len8(0); 977 cmd.fcs = __fcs2((u8 *) &cmd); 978 979 return rfcomm_send_cmd(s, &cmd); 980 } 981 982 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type) 983 { 984 struct rfcomm_hdr *hdr; 985 struct rfcomm_mcc *mcc; 986 u8 buf[16], *ptr = buf; 987 988 BT_DBG("%p cr %d type %d", s, cr, type); 989 990 hdr = (void *) ptr; ptr += sizeof(*hdr); 991 hdr->addr = __addr(s->initiator, 0); 992 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 993 hdr->len = __len8(sizeof(*mcc) + 1); 994 995 mcc = (void *) ptr; ptr += sizeof(*mcc); 996 mcc->type = __mcc_type(0, RFCOMM_NSC); 997 mcc->len = __len8(1); 998 999 /* Type that we didn't like */ 1000 *ptr = __mcc_type(cr, type); ptr++; 1001 1002 *ptr = __fcs(buf); ptr++; 1003 1004 return rfcomm_send_frame(s, buf, ptr - buf); 1005 } 1006 1007 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d) 1008 { 1009 struct rfcomm_hdr *hdr; 1010 struct rfcomm_mcc *mcc; 1011 struct rfcomm_pn *pn; 1012 u8 buf[16], *ptr = buf; 1013 1014 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu); 1015 1016 hdr = (void *) ptr; ptr += sizeof(*hdr); 1017 hdr->addr = __addr(s->initiator, 0); 1018 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1019 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn)); 1020 1021 mcc = (void *) ptr; ptr += sizeof(*mcc); 1022 mcc->type = __mcc_type(cr, RFCOMM_PN); 1023 mcc->len = __len8(sizeof(*pn)); 1024 1025 pn = (void *) ptr; ptr += sizeof(*pn); 1026 pn->dlci = d->dlci; 1027 pn->priority = d->priority; 1028 pn->ack_timer = 0; 1029 pn->max_retrans = 0; 1030 1031 if (s->cfc) { 1032 pn->flow_ctrl = cr ? 0xf0 : 0xe0; 1033 pn->credits = RFCOMM_DEFAULT_CREDITS; 1034 } else { 1035 pn->flow_ctrl = 0; 1036 pn->credits = 0; 1037 } 1038 1039 if (cr && channel_mtu >= 0) 1040 pn->mtu = cpu_to_le16(channel_mtu); 1041 else 1042 pn->mtu = cpu_to_le16(d->mtu); 1043 1044 *ptr = __fcs(buf); ptr++; 1045 1046 return rfcomm_send_frame(s, buf, ptr - buf); 1047 } 1048 1049 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci, 1050 u8 bit_rate, u8 data_bits, u8 stop_bits, 1051 u8 parity, u8 flow_ctrl_settings, 1052 u8 xon_char, u8 xoff_char, u16 param_mask) 1053 { 1054 struct rfcomm_hdr *hdr; 1055 struct rfcomm_mcc *mcc; 1056 struct rfcomm_rpn *rpn; 1057 u8 buf[16], *ptr = buf; 1058 1059 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x" 1060 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x", 1061 s, cr, dlci, bit_rate, data_bits, stop_bits, parity, 1062 flow_ctrl_settings, xon_char, xoff_char, param_mask); 1063 1064 hdr = (void *) ptr; ptr += sizeof(*hdr); 1065 hdr->addr = __addr(s->initiator, 0); 1066 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1067 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn)); 1068 1069 mcc = (void *) ptr; ptr += sizeof(*mcc); 1070 mcc->type = __mcc_type(cr, RFCOMM_RPN); 1071 mcc->len = __len8(sizeof(*rpn)); 1072 1073 rpn = (void *) ptr; ptr += sizeof(*rpn); 1074 rpn->dlci = __addr(1, dlci); 1075 rpn->bit_rate = bit_rate; 1076 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity); 1077 rpn->flow_ctrl = flow_ctrl_settings; 1078 rpn->xon_char = xon_char; 1079 rpn->xoff_char = xoff_char; 1080 rpn->param_mask = cpu_to_le16(param_mask); 1081 1082 *ptr = __fcs(buf); ptr++; 1083 1084 return rfcomm_send_frame(s, buf, ptr - buf); 1085 } 1086 1087 int rfcomm_dlc_send_rpn(struct rfcomm_dlc *d, u8 bit_rate, u8 data_bits, 1088 u8 stop_bits, u8 parity, u8 flow_ctrl_settings, 1089 u8 xon_char, u8 xoff_char, u16 param_mask) 1090 { 1091 int err = -ENOTCONN; 1092 1093 rfcomm_lock(); 1094 if (d->session) 1095 err = rfcomm_send_rpn(d->session, 1, d->dlci, bit_rate, 1096 data_bits, stop_bits, parity, 1097 flow_ctrl_settings, xon_char, xoff_char, 1098 param_mask); 1099 rfcomm_unlock(); 1100 1101 return err; 1102 } 1103 1104 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status) 1105 { 1106 struct rfcomm_hdr *hdr; 1107 struct rfcomm_mcc *mcc; 1108 struct rfcomm_rls *rls; 1109 u8 buf[16], *ptr = buf; 1110 1111 BT_DBG("%p cr %d status 0x%x", s, cr, status); 1112 1113 hdr = (void *) ptr; ptr += sizeof(*hdr); 1114 hdr->addr = __addr(s->initiator, 0); 1115 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1116 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls)); 1117 1118 mcc = (void *) ptr; ptr += sizeof(*mcc); 1119 mcc->type = __mcc_type(cr, RFCOMM_RLS); 1120 mcc->len = __len8(sizeof(*rls)); 1121 1122 rls = (void *) ptr; ptr += sizeof(*rls); 1123 rls->dlci = __addr(1, dlci); 1124 rls->status = status; 1125 1126 *ptr = __fcs(buf); ptr++; 1127 1128 return rfcomm_send_frame(s, buf, ptr - buf); 1129 } 1130 1131 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig) 1132 { 1133 struct rfcomm_hdr *hdr; 1134 struct rfcomm_mcc *mcc; 1135 struct rfcomm_msc *msc; 1136 u8 buf[16], *ptr = buf; 1137 1138 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig); 1139 1140 hdr = (void *) ptr; ptr += sizeof(*hdr); 1141 hdr->addr = __addr(s->initiator, 0); 1142 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1143 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc)); 1144 1145 mcc = (void *) ptr; ptr += sizeof(*mcc); 1146 mcc->type = __mcc_type(cr, RFCOMM_MSC); 1147 mcc->len = __len8(sizeof(*msc)); 1148 1149 msc = (void *) ptr; ptr += sizeof(*msc); 1150 msc->dlci = __addr(1, dlci); 1151 msc->v24_sig = v24_sig | 0x01; 1152 1153 *ptr = __fcs(buf); ptr++; 1154 1155 return rfcomm_send_frame(s, buf, ptr - buf); 1156 } 1157 1158 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr) 1159 { 1160 struct rfcomm_hdr *hdr; 1161 struct rfcomm_mcc *mcc; 1162 u8 buf[16], *ptr = buf; 1163 1164 BT_DBG("%p cr %d", s, cr); 1165 1166 hdr = (void *) ptr; ptr += sizeof(*hdr); 1167 hdr->addr = __addr(s->initiator, 0); 1168 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1169 hdr->len = __len8(sizeof(*mcc)); 1170 1171 mcc = (void *) ptr; ptr += sizeof(*mcc); 1172 mcc->type = __mcc_type(cr, RFCOMM_FCOFF); 1173 mcc->len = __len8(0); 1174 1175 *ptr = __fcs(buf); ptr++; 1176 1177 return rfcomm_send_frame(s, buf, ptr - buf); 1178 } 1179 1180 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr) 1181 { 1182 struct rfcomm_hdr *hdr; 1183 struct rfcomm_mcc *mcc; 1184 u8 buf[16], *ptr = buf; 1185 1186 BT_DBG("%p cr %d", s, cr); 1187 1188 hdr = (void *) ptr; ptr += sizeof(*hdr); 1189 hdr->addr = __addr(s->initiator, 0); 1190 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1191 hdr->len = __len8(sizeof(*mcc)); 1192 1193 mcc = (void *) ptr; ptr += sizeof(*mcc); 1194 mcc->type = __mcc_type(cr, RFCOMM_FCON); 1195 mcc->len = __len8(0); 1196 1197 *ptr = __fcs(buf); ptr++; 1198 1199 return rfcomm_send_frame(s, buf, ptr - buf); 1200 } 1201 1202 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len) 1203 { 1204 struct socket *sock = s->sock; 1205 struct kvec iv[3]; 1206 struct msghdr msg; 1207 unsigned char hdr[5], crc[1]; 1208 1209 if (len > 125) 1210 return -EINVAL; 1211 1212 BT_DBG("%p cr %d", s, cr); 1213 1214 hdr[0] = __addr(s->initiator, 0); 1215 hdr[1] = __ctrl(RFCOMM_UIH, 0); 1216 hdr[2] = 0x01 | ((len + 2) << 1); 1217 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2); 1218 hdr[4] = 0x01 | (len << 1); 1219 1220 crc[0] = __fcs(hdr); 1221 1222 iv[0].iov_base = hdr; 1223 iv[0].iov_len = 5; 1224 iv[1].iov_base = pattern; 1225 iv[1].iov_len = len; 1226 iv[2].iov_base = crc; 1227 iv[2].iov_len = 1; 1228 1229 memset(&msg, 0, sizeof(msg)); 1230 1231 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len); 1232 } 1233 1234 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits) 1235 { 1236 struct rfcomm_hdr *hdr; 1237 u8 buf[16], *ptr = buf; 1238 1239 BT_DBG("%p addr %d credits %d", s, addr, credits); 1240 1241 hdr = (void *) ptr; ptr += sizeof(*hdr); 1242 hdr->addr = addr; 1243 hdr->ctrl = __ctrl(RFCOMM_UIH, 1); 1244 hdr->len = __len8(0); 1245 1246 *ptr = credits; ptr++; 1247 1248 *ptr = __fcs(buf); ptr++; 1249 1250 return rfcomm_send_frame(s, buf, ptr - buf); 1251 } 1252 1253 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr) 1254 { 1255 struct rfcomm_hdr *hdr; 1256 int len = skb->len; 1257 u8 *crc; 1258 1259 if (len > 127) { 1260 hdr = skb_push(skb, 4); 1261 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len); 1262 } else { 1263 hdr = skb_push(skb, 3); 1264 hdr->len = __len8(len); 1265 } 1266 hdr->addr = addr; 1267 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1268 1269 crc = skb_put(skb, 1); 1270 *crc = __fcs((void *) hdr); 1271 } 1272 1273 /* ---- RFCOMM frame reception ---- */ 1274 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci) 1275 { 1276 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1277 1278 if (dlci) { 1279 /* Data channel */ 1280 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1281 if (!d) { 1282 rfcomm_send_dm(s, dlci); 1283 return s; 1284 } 1285 1286 switch (d->state) { 1287 case BT_CONNECT: 1288 rfcomm_dlc_clear_timer(d); 1289 1290 rfcomm_dlc_lock(d); 1291 d->state = BT_CONNECTED; 1292 d->state_change(d, 0); 1293 rfcomm_dlc_unlock(d); 1294 1295 rfcomm_send_msc(s, 1, dlci, d->v24_sig); 1296 break; 1297 1298 case BT_DISCONN: 1299 d->state = BT_CLOSED; 1300 __rfcomm_dlc_close(d, 0); 1301 1302 if (list_empty(&s->dlcs)) { 1303 s->state = BT_DISCONN; 1304 rfcomm_send_disc(s, 0); 1305 rfcomm_session_clear_timer(s); 1306 } 1307 1308 break; 1309 } 1310 } else { 1311 /* Control channel */ 1312 switch (s->state) { 1313 case BT_CONNECT: 1314 s->state = BT_CONNECTED; 1315 rfcomm_process_connect(s); 1316 break; 1317 1318 case BT_DISCONN: 1319 s = rfcomm_session_close(s, ECONNRESET); 1320 break; 1321 } 1322 } 1323 return s; 1324 } 1325 1326 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci) 1327 { 1328 int err = 0; 1329 1330 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1331 1332 if (dlci) { 1333 /* Data DLC */ 1334 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1335 if (d) { 1336 if (d->state == BT_CONNECT || d->state == BT_CONFIG) 1337 err = ECONNREFUSED; 1338 else 1339 err = ECONNRESET; 1340 1341 d->state = BT_CLOSED; 1342 __rfcomm_dlc_close(d, err); 1343 } 1344 } else { 1345 if (s->state == BT_CONNECT) 1346 err = ECONNREFUSED; 1347 else 1348 err = ECONNRESET; 1349 1350 s = rfcomm_session_close(s, err); 1351 } 1352 return s; 1353 } 1354 1355 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s, 1356 u8 dlci) 1357 { 1358 int err = 0; 1359 1360 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1361 1362 if (dlci) { 1363 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1364 if (d) { 1365 rfcomm_send_ua(s, dlci); 1366 1367 if (d->state == BT_CONNECT || d->state == BT_CONFIG) 1368 err = ECONNREFUSED; 1369 else 1370 err = ECONNRESET; 1371 1372 d->state = BT_CLOSED; 1373 __rfcomm_dlc_close(d, err); 1374 } else 1375 rfcomm_send_dm(s, dlci); 1376 1377 } else { 1378 rfcomm_send_ua(s, 0); 1379 1380 if (s->state == BT_CONNECT) 1381 err = ECONNREFUSED; 1382 else 1383 err = ECONNRESET; 1384 1385 s = rfcomm_session_close(s, err); 1386 } 1387 return s; 1388 } 1389 1390 /* Must be called with rfcomm_mutex held, so that the session cannot be 1391 * unlinked from under us. 1392 */ 1393 static void __rfcomm_dlc_accept(struct rfcomm_dlc *d) 1394 { 1395 struct sock *sk = d->session->sock->sk; 1396 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 1397 1398 BT_DBG("dlc %p", d); 1399 1400 rfcomm_send_ua(d->session, d->dlci); 1401 1402 rfcomm_dlc_clear_timer(d); 1403 1404 rfcomm_dlc_lock(d); 1405 d->state = BT_CONNECTED; 1406 d->state_change(d, 0); 1407 rfcomm_dlc_unlock(d); 1408 1409 if (d->role_switch) 1410 hci_conn_switch_role(conn->hcon, 0x00); 1411 1412 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 1413 } 1414 1415 void rfcomm_dlc_accept(struct rfcomm_dlc *d) 1416 { 1417 rfcomm_lock(); 1418 1419 /* rfcomm_recv_disc() sets the dlc state to BT_CLOSED before calling 1420 * __rfcomm_dlc_close(), so the RFCOMM_DEFER_SETUP handshake there is 1421 * skipped and the session can already be unlinked by the time the 1422 * deferred accept runs from rfcomm_sock_recvmsg(). 1423 */ 1424 if (d->session) 1425 __rfcomm_dlc_accept(d); 1426 1427 rfcomm_unlock(); 1428 } 1429 1430 static void rfcomm_check_accept(struct rfcomm_dlc *d) 1431 { 1432 if (rfcomm_check_security(d)) { 1433 if (d->defer_setup) { 1434 set_bit(RFCOMM_DEFER_SETUP, &d->flags); 1435 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1436 1437 rfcomm_dlc_lock(d); 1438 d->state = BT_CONNECT2; 1439 d->state_change(d, 0); 1440 rfcomm_dlc_unlock(d); 1441 } else 1442 __rfcomm_dlc_accept(d); 1443 } else { 1444 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 1445 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1446 } 1447 } 1448 1449 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci) 1450 { 1451 struct rfcomm_dlc *d; 1452 u8 channel; 1453 1454 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1455 1456 if (!dlci) { 1457 rfcomm_send_ua(s, 0); 1458 1459 if (s->state == BT_OPEN) { 1460 s->state = BT_CONNECTED; 1461 rfcomm_process_connect(s); 1462 } 1463 return 0; 1464 } 1465 1466 /* Check if DLC exists */ 1467 d = rfcomm_dlc_get(s, dlci); 1468 if (d) { 1469 if (d->state == BT_OPEN) { 1470 /* DLC was previously opened by PN request */ 1471 rfcomm_check_accept(d); 1472 } 1473 return 0; 1474 } 1475 1476 /* Notify socket layer about incoming connection */ 1477 channel = __srv_channel(dlci); 1478 if (rfcomm_connect_ind(s, channel, &d)) { 1479 d->dlci = dlci; 1480 d->addr = __addr(s->initiator, dlci); 1481 rfcomm_dlc_link(s, d); 1482 1483 rfcomm_check_accept(d); 1484 } else { 1485 rfcomm_send_dm(s, dlci); 1486 } 1487 1488 return 0; 1489 } 1490 1491 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn) 1492 { 1493 struct rfcomm_session *s = d->session; 1494 1495 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d", 1496 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits); 1497 1498 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) || 1499 pn->flow_ctrl == 0xe0) { 1500 d->cfc = RFCOMM_CFC_ENABLED; 1501 d->tx_credits = pn->credits; 1502 } else { 1503 d->cfc = RFCOMM_CFC_DISABLED; 1504 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1505 } 1506 1507 if (s->cfc == RFCOMM_CFC_UNKNOWN) 1508 s->cfc = d->cfc; 1509 1510 d->priority = pn->priority; 1511 1512 d->mtu = __le16_to_cpu(pn->mtu); 1513 1514 /* MTU 0 causes an infinite loop when fragmenting in sendmsg */ 1515 if (!d->mtu) 1516 d->mtu = RFCOMM_DEFAULT_MTU; 1517 1518 if (cr && d->mtu > s->mtu) 1519 d->mtu = s->mtu; 1520 1521 return 0; 1522 } 1523 1524 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1525 { 1526 struct rfcomm_pn *pn; 1527 struct rfcomm_dlc *d; 1528 u8 dlci; 1529 1530 pn = skb_pull_data(skb, sizeof(*pn)); 1531 if (!pn) 1532 return -EILSEQ; 1533 1534 dlci = pn->dlci; 1535 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1536 1537 if (!dlci) 1538 return 0; 1539 1540 d = rfcomm_dlc_get(s, dlci); 1541 if (d) { 1542 if (cr) { 1543 /* PN request */ 1544 rfcomm_apply_pn(d, cr, pn); 1545 rfcomm_send_pn(s, 0, d); 1546 } else { 1547 /* PN response */ 1548 switch (d->state) { 1549 case BT_CONFIG: 1550 rfcomm_apply_pn(d, cr, pn); 1551 1552 d->state = BT_CONNECT; 1553 rfcomm_send_sabm(s, d->dlci); 1554 break; 1555 } 1556 } 1557 } else { 1558 u8 channel = __srv_channel(dlci); 1559 1560 if (!cr) 1561 return 0; 1562 1563 /* PN request for non existing DLC. 1564 * Assume incoming connection. */ 1565 if (rfcomm_connect_ind(s, channel, &d)) { 1566 d->dlci = dlci; 1567 d->addr = __addr(s->initiator, dlci); 1568 rfcomm_dlc_link(s, d); 1569 1570 rfcomm_apply_pn(d, cr, pn); 1571 1572 d->state = BT_OPEN; 1573 rfcomm_send_pn(s, 0, d); 1574 } else { 1575 rfcomm_send_dm(s, dlci); 1576 } 1577 } 1578 return 0; 1579 } 1580 1581 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb) 1582 { 1583 struct rfcomm_rpn *rpn; 1584 u8 dlci; 1585 1586 u8 bit_rate = 0; 1587 u8 data_bits = 0; 1588 u8 stop_bits = 0; 1589 u8 parity = 0; 1590 u8 flow_ctrl = 0; 1591 u8 xon_char = 0; 1592 u8 xoff_char = 0; 1593 u16 rpn_mask = RFCOMM_RPN_PM_ALL; 1594 1595 if (len == 1) { 1596 rpn = skb_pull_data(skb, 1); 1597 if (!rpn) 1598 return -EILSEQ; 1599 1600 dlci = __get_dlci(rpn->dlci); 1601 1602 if (!cr) 1603 return 0; 1604 1605 bit_rate = RFCOMM_RPN_BR_9600; 1606 data_bits = RFCOMM_RPN_DATA_8; 1607 stop_bits = RFCOMM_RPN_STOP_1; 1608 parity = RFCOMM_RPN_PARITY_NONE; 1609 flow_ctrl = RFCOMM_RPN_FLOW_NONE; 1610 xon_char = RFCOMM_RPN_XON_CHAR; 1611 xoff_char = RFCOMM_RPN_XOFF_CHAR; 1612 goto rpn_out; 1613 } 1614 1615 rpn = skb_pull_data(skb, sizeof(*rpn)); 1616 if (!rpn) 1617 return -EILSEQ; 1618 1619 dlci = __get_dlci(rpn->dlci); 1620 1621 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x", 1622 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl, 1623 rpn->xon_char, rpn->xoff_char, rpn->param_mask); 1624 1625 if (!cr) 1626 return 0; 1627 1628 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit, 1629 * no parity, no flow control lines, normal XON/XOFF chars */ 1630 1631 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) { 1632 bit_rate = rpn->bit_rate; 1633 if (bit_rate > RFCOMM_RPN_BR_230400) { 1634 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate); 1635 bit_rate = RFCOMM_RPN_BR_9600; 1636 rpn_mask ^= RFCOMM_RPN_PM_BITRATE; 1637 } 1638 } 1639 1640 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) { 1641 data_bits = __get_rpn_data_bits(rpn->line_settings); 1642 if (data_bits != RFCOMM_RPN_DATA_8) { 1643 BT_DBG("RPN data bits mismatch 0x%x", data_bits); 1644 data_bits = RFCOMM_RPN_DATA_8; 1645 rpn_mask ^= RFCOMM_RPN_PM_DATA; 1646 } 1647 } 1648 1649 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) { 1650 stop_bits = __get_rpn_stop_bits(rpn->line_settings); 1651 if (stop_bits != RFCOMM_RPN_STOP_1) { 1652 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits); 1653 stop_bits = RFCOMM_RPN_STOP_1; 1654 rpn_mask ^= RFCOMM_RPN_PM_STOP; 1655 } 1656 } 1657 1658 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) { 1659 parity = __get_rpn_parity(rpn->line_settings); 1660 if (parity != RFCOMM_RPN_PARITY_NONE) { 1661 BT_DBG("RPN parity mismatch 0x%x", parity); 1662 parity = RFCOMM_RPN_PARITY_NONE; 1663 rpn_mask ^= RFCOMM_RPN_PM_PARITY; 1664 } 1665 } 1666 1667 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) { 1668 flow_ctrl = rpn->flow_ctrl; 1669 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) { 1670 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl); 1671 flow_ctrl = RFCOMM_RPN_FLOW_NONE; 1672 rpn_mask ^= RFCOMM_RPN_PM_FLOW; 1673 } 1674 } 1675 1676 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) { 1677 xon_char = rpn->xon_char; 1678 if (xon_char != RFCOMM_RPN_XON_CHAR) { 1679 BT_DBG("RPN XON char mismatch 0x%x", xon_char); 1680 xon_char = RFCOMM_RPN_XON_CHAR; 1681 rpn_mask ^= RFCOMM_RPN_PM_XON; 1682 } 1683 } 1684 1685 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) { 1686 xoff_char = rpn->xoff_char; 1687 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) { 1688 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char); 1689 xoff_char = RFCOMM_RPN_XOFF_CHAR; 1690 rpn_mask ^= RFCOMM_RPN_PM_XOFF; 1691 } 1692 } 1693 1694 rpn_out: 1695 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits, 1696 parity, flow_ctrl, xon_char, xoff_char, rpn_mask); 1697 1698 return 0; 1699 } 1700 1701 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1702 { 1703 struct rfcomm_rls *rls; 1704 u8 dlci; 1705 1706 rls = skb_pull_data(skb, sizeof(*rls)); 1707 if (!rls) 1708 return -EILSEQ; 1709 1710 dlci = __get_dlci(rls->dlci); 1711 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status); 1712 1713 if (!cr) 1714 return 0; 1715 1716 /* We should probably do something with this information here. But 1717 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's 1718 * mandatory to recognise and respond to RLS */ 1719 1720 rfcomm_send_rls(s, 0, dlci, rls->status); 1721 1722 return 0; 1723 } 1724 1725 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1726 { 1727 struct rfcomm_msc *msc; 1728 struct rfcomm_dlc *d; 1729 u8 dlci; 1730 1731 msc = skb_pull_data(skb, sizeof(*msc)); 1732 if (!msc) 1733 return -EILSEQ; 1734 1735 dlci = __get_dlci(msc->dlci); 1736 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig); 1737 1738 d = rfcomm_dlc_get(s, dlci); 1739 if (!d) 1740 return 0; 1741 1742 if (cr) { 1743 assign_bit(RFCOMM_TX_THROTTLED, &d->flags, 1744 msc->v24_sig & RFCOMM_V24_FC && !d->cfc); 1745 1746 rfcomm_dlc_lock(d); 1747 1748 d->remote_v24_sig = msc->v24_sig; 1749 1750 if (d->modem_status) 1751 d->modem_status(d, msc->v24_sig); 1752 1753 rfcomm_dlc_unlock(d); 1754 1755 rfcomm_send_msc(s, 0, dlci, msc->v24_sig); 1756 1757 d->mscex |= RFCOMM_MSCEX_RX; 1758 } else 1759 d->mscex |= RFCOMM_MSCEX_TX; 1760 1761 return 0; 1762 } 1763 1764 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb) 1765 { 1766 struct rfcomm_mcc *mcc; 1767 u8 type, cr, len; 1768 1769 mcc = skb_pull_data(skb, sizeof(*mcc)); 1770 if (!mcc) 1771 return -EILSEQ; 1772 1773 cr = __test_cr(mcc->type); 1774 type = __get_mcc_type(mcc->type); 1775 len = __get_mcc_len(mcc->len); 1776 1777 BT_DBG("%p type 0x%x cr %d", s, type, cr); 1778 1779 switch (type) { 1780 case RFCOMM_PN: 1781 rfcomm_recv_pn(s, cr, skb); 1782 break; 1783 1784 case RFCOMM_RPN: 1785 rfcomm_recv_rpn(s, cr, len, skb); 1786 break; 1787 1788 case RFCOMM_RLS: 1789 rfcomm_recv_rls(s, cr, skb); 1790 break; 1791 1792 case RFCOMM_MSC: 1793 rfcomm_recv_msc(s, cr, skb); 1794 break; 1795 1796 case RFCOMM_FCOFF: 1797 if (cr) { 1798 set_bit(RFCOMM_TX_THROTTLED, &s->flags); 1799 rfcomm_send_fcoff(s, 0); 1800 } 1801 break; 1802 1803 case RFCOMM_FCON: 1804 if (cr) { 1805 clear_bit(RFCOMM_TX_THROTTLED, &s->flags); 1806 rfcomm_send_fcon(s, 0); 1807 } 1808 break; 1809 1810 case RFCOMM_TEST: 1811 if (cr) 1812 rfcomm_send_test(s, 0, skb->data, skb->len); 1813 break; 1814 1815 case RFCOMM_NSC: 1816 break; 1817 1818 default: 1819 BT_ERR("Unknown control type 0x%02x", type); 1820 rfcomm_send_nsc(s, cr, type); 1821 break; 1822 } 1823 return 0; 1824 } 1825 1826 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb) 1827 { 1828 struct rfcomm_dlc *d; 1829 1830 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf); 1831 1832 d = rfcomm_dlc_get(s, dlci); 1833 if (!d) { 1834 rfcomm_send_dm(s, dlci); 1835 goto drop; 1836 } 1837 1838 if (pf && d->cfc) { 1839 u8 *credits = skb_pull_data(skb, 1); 1840 1841 if (!credits) 1842 goto drop; 1843 1844 d->tx_credits += *credits; 1845 if (d->tx_credits) 1846 clear_bit(RFCOMM_TX_THROTTLED, &d->flags); 1847 } 1848 1849 if (skb->len && d->state == BT_CONNECTED) { 1850 rfcomm_dlc_lock(d); 1851 d->rx_credits--; 1852 d->data_ready(d, skb); 1853 rfcomm_dlc_unlock(d); 1854 return 0; 1855 } 1856 1857 drop: 1858 kfree_skb(skb); 1859 return 0; 1860 } 1861 1862 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s, 1863 struct sk_buff *skb) 1864 { 1865 struct rfcomm_hdr *hdr = (void *) skb->data; 1866 u8 type, dlci, fcs; 1867 1868 if (!s) { 1869 /* no session, so free socket data */ 1870 kfree_skb(skb); 1871 return s; 1872 } 1873 1874 if (skb->len < sizeof(*hdr) + 1 || 1875 (!__test_ea(hdr->len) && skb->len < sizeof(*hdr) + 2)) { 1876 kfree_skb(skb); 1877 return s; 1878 } 1879 1880 dlci = __get_dlci(hdr->addr); 1881 type = __get_type(hdr->ctrl); 1882 1883 /* Trim FCS */ 1884 skb->len--; skb->tail--; 1885 fcs = *(u8 *)skb_tail_pointer(skb); 1886 1887 if (__check_fcs(skb->data, type, fcs)) { 1888 BT_ERR("bad checksum in packet"); 1889 kfree_skb(skb); 1890 return s; 1891 } 1892 1893 if (__test_ea(hdr->len)) 1894 skb_pull(skb, 3); 1895 else 1896 skb_pull(skb, 4); 1897 1898 switch (type) { 1899 case RFCOMM_SABM: 1900 if (__test_pf(hdr->ctrl)) 1901 rfcomm_recv_sabm(s, dlci); 1902 break; 1903 1904 case RFCOMM_DISC: 1905 if (__test_pf(hdr->ctrl)) 1906 s = rfcomm_recv_disc(s, dlci); 1907 break; 1908 1909 case RFCOMM_UA: 1910 if (__test_pf(hdr->ctrl)) 1911 s = rfcomm_recv_ua(s, dlci); 1912 break; 1913 1914 case RFCOMM_DM: 1915 s = rfcomm_recv_dm(s, dlci); 1916 break; 1917 1918 case RFCOMM_UIH: 1919 if (dlci) { 1920 rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb); 1921 return s; 1922 } 1923 rfcomm_recv_mcc(s, skb); 1924 break; 1925 1926 default: 1927 BT_ERR("Unknown packet type 0x%02x", type); 1928 break; 1929 } 1930 kfree_skb(skb); 1931 return s; 1932 } 1933 1934 /* ---- Connection and data processing ---- */ 1935 1936 static void rfcomm_process_connect(struct rfcomm_session *s) 1937 { 1938 struct rfcomm_dlc *d, *n; 1939 1940 BT_DBG("session %p state %ld", s, s->state); 1941 1942 list_for_each_entry_safe(d, n, &s->dlcs, list) { 1943 if (d->state == BT_CONFIG) { 1944 d->mtu = s->mtu; 1945 if (rfcomm_check_security(d)) { 1946 rfcomm_send_pn(s, 1, d); 1947 } else { 1948 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 1949 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1950 } 1951 } 1952 } 1953 } 1954 1955 /* Send data queued for the DLC. 1956 * Return number of frames left in the queue. 1957 */ 1958 static int rfcomm_process_tx(struct rfcomm_dlc *d) 1959 { 1960 struct sk_buff *skb; 1961 int err; 1962 1963 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d", 1964 d, d->state, d->cfc, d->rx_credits, d->tx_credits); 1965 1966 /* Send pending MSC */ 1967 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags)) 1968 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 1969 1970 if (d->cfc) { 1971 /* CFC enabled. 1972 * Give them some credits */ 1973 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) && 1974 d->rx_credits <= (d->cfc >> 2)) { 1975 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits); 1976 d->rx_credits = d->cfc; 1977 } 1978 } else { 1979 /* CFC disabled. 1980 * Give ourselves some credits */ 1981 d->tx_credits = 5; 1982 } 1983 1984 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 1985 return skb_queue_len(&d->tx_queue); 1986 1987 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) { 1988 err = rfcomm_send_frame(d->session, skb->data, skb->len); 1989 if (err < 0) { 1990 skb_queue_head(&d->tx_queue, skb); 1991 break; 1992 } 1993 kfree_skb(skb); 1994 d->tx_credits--; 1995 } 1996 1997 if (d->cfc && !d->tx_credits) { 1998 /* We're out of TX credits. 1999 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */ 2000 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 2001 } 2002 2003 return skb_queue_len(&d->tx_queue); 2004 } 2005 2006 static void rfcomm_process_dlcs(struct rfcomm_session *s) 2007 { 2008 struct rfcomm_dlc *d, *n; 2009 2010 BT_DBG("session %p state %ld", s, s->state); 2011 2012 list_for_each_entry_safe(d, n, &s->dlcs, list) { 2013 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) { 2014 __rfcomm_dlc_close(d, ETIMEDOUT); 2015 continue; 2016 } 2017 2018 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) { 2019 __rfcomm_dlc_close(d, ECONNREFUSED); 2020 continue; 2021 } 2022 2023 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) { 2024 rfcomm_dlc_clear_timer(d); 2025 if (d->out) { 2026 rfcomm_send_pn(s, 1, d); 2027 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT); 2028 } else { 2029 if (d->defer_setup) { 2030 set_bit(RFCOMM_DEFER_SETUP, &d->flags); 2031 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 2032 2033 rfcomm_dlc_lock(d); 2034 d->state = BT_CONNECT2; 2035 d->state_change(d, 0); 2036 rfcomm_dlc_unlock(d); 2037 } else 2038 __rfcomm_dlc_accept(d); 2039 } 2040 continue; 2041 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) { 2042 rfcomm_dlc_clear_timer(d); 2043 if (!d->out) 2044 rfcomm_send_dm(s, d->dlci); 2045 else 2046 d->state = BT_CLOSED; 2047 __rfcomm_dlc_close(d, ECONNREFUSED); 2048 continue; 2049 } 2050 2051 if (test_bit(RFCOMM_SEC_PENDING, &d->flags)) 2052 continue; 2053 2054 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags)) 2055 continue; 2056 2057 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) && 2058 d->mscex == RFCOMM_MSCEX_OK) 2059 rfcomm_process_tx(d); 2060 } 2061 } 2062 2063 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s) 2064 { 2065 struct socket *sock = s->sock; 2066 struct sock *sk = sock->sk; 2067 struct sk_buff *skb; 2068 2069 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue)); 2070 2071 /* Get data directly from socket receive queue without copying it. */ 2072 while ((skb = skb_dequeue(&sk->sk_receive_queue))) { 2073 skb_orphan(skb); 2074 if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) { 2075 s = rfcomm_recv_frame(s, skb); 2076 if (!s) 2077 break; 2078 } else { 2079 kfree_skb(skb); 2080 } 2081 } 2082 2083 if (s && (sk->sk_state == BT_CLOSED)) 2084 s = rfcomm_session_close(s, sk->sk_err); 2085 2086 return s; 2087 } 2088 2089 static void rfcomm_accept_connection(struct rfcomm_session *s) 2090 { 2091 struct socket *sock = s->sock, *nsock; 2092 int err; 2093 2094 /* Fast check for a new connection. 2095 * Avoids unnecessary socket allocations. 2096 */ 2097 if (list_empty(&bt_sk(sock->sk)->accept_q)) 2098 return; 2099 2100 BT_DBG("session %p", s); 2101 2102 err = kernel_accept(sock, &nsock, O_NONBLOCK); 2103 if (err < 0) 2104 return; 2105 2106 /* Set our callbacks */ 2107 nsock->sk->sk_data_ready = rfcomm_l2data_ready; 2108 nsock->sk->sk_state_change = rfcomm_l2state_change; 2109 2110 s = rfcomm_session_add(nsock, BT_OPEN); 2111 if (s) { 2112 /* We should adjust MTU on incoming sessions. 2113 * L2CAP MTU minus UIH header and FCS. */ 2114 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu, 2115 l2cap_pi(nsock->sk)->chan->imtu) - 5; 2116 2117 rfcomm_schedule(); 2118 } else 2119 sock_release(nsock); 2120 } 2121 2122 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s) 2123 { 2124 struct sock *sk = s->sock->sk; 2125 2126 BT_DBG("%p state %ld", s, s->state); 2127 2128 switch (sk->sk_state) { 2129 case BT_CONNECTED: 2130 s->state = BT_CONNECT; 2131 2132 /* We can adjust MTU on outgoing sessions. 2133 * L2CAP MTU minus UIH header and FCS. */ 2134 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5; 2135 2136 rfcomm_send_sabm(s, 0); 2137 break; 2138 2139 case BT_CLOSED: 2140 s = rfcomm_session_close(s, sk->sk_err); 2141 break; 2142 } 2143 return s; 2144 } 2145 2146 static void rfcomm_process_sessions(void) 2147 { 2148 struct rfcomm_session *s, *n; 2149 2150 rfcomm_lock(); 2151 2152 list_for_each_entry_safe(s, n, &session_list, list) { 2153 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) { 2154 s->state = BT_DISCONN; 2155 rfcomm_send_disc(s, 0); 2156 continue; 2157 } 2158 2159 switch (s->state) { 2160 case BT_LISTEN: 2161 rfcomm_accept_connection(s); 2162 continue; 2163 2164 case BT_BOUND: 2165 s = rfcomm_check_connection(s); 2166 break; 2167 2168 default: 2169 s = rfcomm_process_rx(s); 2170 break; 2171 } 2172 2173 if (s) 2174 rfcomm_process_dlcs(s); 2175 } 2176 2177 rfcomm_unlock(); 2178 } 2179 2180 static int rfcomm_add_listener(bdaddr_t *ba) 2181 { 2182 struct sockaddr_l2 addr; 2183 struct socket *sock; 2184 struct sock *sk; 2185 struct rfcomm_session *s; 2186 int err = 0; 2187 2188 /* Create socket */ 2189 err = rfcomm_l2sock_create(&sock); 2190 if (err < 0) { 2191 BT_ERR("Create socket failed %d", err); 2192 return err; 2193 } 2194 2195 /* Bind socket */ 2196 bacpy(&addr.l2_bdaddr, ba); 2197 addr.l2_family = AF_BLUETOOTH; 2198 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM); 2199 addr.l2_cid = 0; 2200 addr.l2_bdaddr_type = BDADDR_BREDR; 2201 err = kernel_bind(sock, (struct sockaddr_unsized *)&addr, sizeof(addr)); 2202 if (err < 0) { 2203 BT_ERR("Bind failed %d", err); 2204 goto failed; 2205 } 2206 2207 /* Set L2CAP options */ 2208 sk = sock->sk; 2209 lock_sock(sk); 2210 /* Set MTU to 0 so L2CAP can auto select the MTU */ 2211 l2cap_pi(sk)->chan->imtu = 0; 2212 release_sock(sk); 2213 2214 /* Start listening on the socket */ 2215 err = kernel_listen(sock, 10); 2216 if (err) { 2217 BT_ERR("Listen failed %d", err); 2218 goto failed; 2219 } 2220 2221 /* Add listening session */ 2222 s = rfcomm_session_add(sock, BT_LISTEN); 2223 if (!s) { 2224 err = -ENOMEM; 2225 goto failed; 2226 } 2227 2228 return 0; 2229 failed: 2230 sock_release(sock); 2231 return err; 2232 } 2233 2234 static void rfcomm_kill_listener(void) 2235 { 2236 struct rfcomm_session *s, *n; 2237 2238 BT_DBG(""); 2239 2240 rfcomm_lock(); 2241 list_for_each_entry_safe(s, n, &session_list, list) 2242 rfcomm_session_del(s); 2243 rfcomm_unlock(); 2244 } 2245 2246 static int rfcomm_run(void *unused) 2247 { 2248 DEFINE_WAIT_FUNC(wait, woken_wake_function); 2249 BT_DBG(""); 2250 2251 set_user_nice(current, -10); 2252 2253 rfcomm_add_listener(BDADDR_ANY); 2254 2255 add_wait_queue(&rfcomm_wq, &wait); 2256 while (!kthread_should_stop()) { 2257 2258 /* Process stuff */ 2259 rfcomm_process_sessions(); 2260 2261 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 2262 } 2263 remove_wait_queue(&rfcomm_wq, &wait); 2264 2265 rfcomm_kill_listener(); 2266 2267 return 0; 2268 } 2269 2270 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt) 2271 { 2272 struct rfcomm_session *s; 2273 struct rfcomm_dlc *d, *n; 2274 2275 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt); 2276 2277 rfcomm_lock(); 2278 2279 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst); 2280 if (!s) { 2281 rfcomm_unlock(); 2282 return; 2283 } 2284 2285 list_for_each_entry_safe(d, n, &s->dlcs, list) { 2286 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) { 2287 rfcomm_dlc_clear_timer(d); 2288 if (status || encrypt == 0x00) { 2289 set_bit(RFCOMM_ENC_DROP, &d->flags); 2290 continue; 2291 } 2292 } 2293 2294 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) { 2295 if (d->sec_level == BT_SECURITY_MEDIUM) { 2296 set_bit(RFCOMM_SEC_PENDING, &d->flags); 2297 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 2298 continue; 2299 } else if (d->sec_level == BT_SECURITY_HIGH || 2300 d->sec_level == BT_SECURITY_FIPS) { 2301 set_bit(RFCOMM_ENC_DROP, &d->flags); 2302 continue; 2303 } 2304 } 2305 2306 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags)) 2307 continue; 2308 2309 if (!status && hci_conn_check_secure(conn, d->sec_level)) 2310 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags); 2311 else 2312 set_bit(RFCOMM_AUTH_REJECT, &d->flags); 2313 } 2314 2315 rfcomm_unlock(); 2316 2317 rfcomm_schedule(); 2318 } 2319 2320 static struct hci_cb rfcomm_cb = { 2321 .name = "RFCOMM", 2322 .security_cfm = rfcomm_security_cfm 2323 }; 2324 2325 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x) 2326 { 2327 struct rfcomm_session *s; 2328 2329 rfcomm_lock(); 2330 2331 list_for_each_entry(s, &session_list, list) { 2332 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan; 2333 struct rfcomm_dlc *d; 2334 list_for_each_entry(d, &s->dlcs, list) { 2335 seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n", 2336 &chan->src, &chan->dst, 2337 d->state, d->dlci, d->mtu, 2338 d->rx_credits, d->tx_credits); 2339 } 2340 } 2341 2342 rfcomm_unlock(); 2343 2344 return 0; 2345 } 2346 2347 DEFINE_SHOW_ATTRIBUTE(rfcomm_dlc_debugfs); 2348 2349 static struct dentry *rfcomm_dlc_debugfs; 2350 2351 /* ---- Initialization ---- */ 2352 static int __init rfcomm_init(void) 2353 { 2354 int err; 2355 2356 hci_register_cb(&rfcomm_cb); 2357 2358 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd"); 2359 if (IS_ERR(rfcomm_thread)) { 2360 err = PTR_ERR(rfcomm_thread); 2361 goto unregister; 2362 } 2363 2364 err = rfcomm_init_ttys(); 2365 if (err < 0) 2366 goto stop; 2367 2368 err = rfcomm_init_sockets(); 2369 if (err < 0) 2370 goto cleanup; 2371 2372 BT_INFO("RFCOMM ver %s", VERSION); 2373 2374 if (IS_ERR_OR_NULL(bt_debugfs)) 2375 return 0; 2376 2377 rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444, 2378 bt_debugfs, NULL, 2379 &rfcomm_dlc_debugfs_fops); 2380 2381 return 0; 2382 2383 cleanup: 2384 rfcomm_cleanup_ttys(); 2385 2386 stop: 2387 kthread_stop(rfcomm_thread); 2388 2389 unregister: 2390 hci_unregister_cb(&rfcomm_cb); 2391 2392 return err; 2393 } 2394 2395 static void __exit rfcomm_exit(void) 2396 { 2397 debugfs_remove(rfcomm_dlc_debugfs); 2398 2399 hci_unregister_cb(&rfcomm_cb); 2400 2401 kthread_stop(rfcomm_thread); 2402 2403 rfcomm_cleanup_ttys(); 2404 2405 rfcomm_cleanup_sockets(); 2406 } 2407 2408 module_init(rfcomm_init); 2409 module_exit(rfcomm_exit); 2410 2411 module_param(disable_cfc, bool, 0644); 2412 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control"); 2413 2414 module_param(channel_mtu, int, 0644); 2415 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel"); 2416 2417 module_param(l2cap_ertm, bool, 0644); 2418 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection"); 2419 2420 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 2421 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION); 2422 MODULE_VERSION(VERSION); 2423 MODULE_LICENSE("GPL"); 2424 MODULE_ALIAS("bt-proto-3"); 2425