1/* 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License version 2 as 8 published by the Free Software Foundation; 9 10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 21 SOFTWARE IS DISCLAIMED. 22*/ 23 24/* 25 * Bluetooth RFCOMM core. 26 * 27 * $Id: core.c,v 1.1.1.1 2007/08/03 18:53:50 Exp $ 28 */ 29 30#include <linux/module.h> 31#include <linux/errno.h> 32#include <linux/kernel.h> 33#include <linux/sched.h> 34#include <linux/signal.h> 35#include <linux/init.h> 36#include <linux/wait.h> 37#include <linux/device.h> 38#include <linux/net.h> 39#include <linux/mutex.h> 40 41#include <net/sock.h> 42#include <asm/uaccess.h> 43#include <asm/unaligned.h> 44 45#include <net/bluetooth/bluetooth.h> 46#include <net/bluetooth/hci_core.h> 47#include <net/bluetooth/l2cap.h> 48#include <net/bluetooth/rfcomm.h> 49 50#ifndef CONFIG_BT_RFCOMM_DEBUG 51#undef BT_DBG 52#define BT_DBG(D...) 53#endif 54 55#define VERSION "1.8" 56 57static int disable_cfc = 0; 58static int channel_mtu = -1; 59static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU; 60 61static struct task_struct *rfcomm_thread; 62 63static DEFINE_MUTEX(rfcomm_mutex); 64#define rfcomm_lock() mutex_lock(&rfcomm_mutex) 65#define rfcomm_unlock() mutex_unlock(&rfcomm_mutex) 66 67static unsigned long rfcomm_event; 68 69static LIST_HEAD(session_list); 70static atomic_t terminate, running; 71 72static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len); 73static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci); 74static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci); 75static int rfcomm_queue_disc(struct rfcomm_dlc *d); 76static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type); 77static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d); 78static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig); 79static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len); 80static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits); 81static void rfcomm_make_uih(struct sk_buff *skb, u8 addr); 82 83static void rfcomm_process_connect(struct rfcomm_session *s); 84 85static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err); 86static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst); 87static void rfcomm_session_del(struct rfcomm_session *s); 88 89/* ---- RFCOMM frame parsing macros ---- */ 90#define __get_dlci(b) ((b & 0xfc) >> 2) 91#define __get_channel(b) ((b & 0xf8) >> 3) 92#define __get_dir(b) ((b & 0x04) >> 2) 93#define __get_type(b) ((b & 0xef)) 94 95#define __test_ea(b) ((b & 0x01)) 96#define __test_cr(b) ((b & 0x02)) 97#define __test_pf(b) ((b & 0x10)) 98 99#define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01) 100#define __ctrl(type, pf) (((type & 0xef) | (pf << 4))) 101#define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir) 102#define __srv_channel(dlci) (dlci >> 1) 103#define __dir(dlci) (dlci & 0x01) 104 105#define __len8(len) (((len) << 1) | 1) 106#define __len16(len) ((len) << 1) 107 108/* MCC macros */ 109#define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01)) 110#define __get_mcc_type(b) ((b & 0xfc) >> 2) 111#define __get_mcc_len(b) ((b & 0xfe) >> 1) 112 113/* RPN macros */ 114#define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3)) 115#define __get_rpn_data_bits(line) ((line) & 0x3) 116#define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1) 117#define __get_rpn_parity(line) (((line) >> 3) & 0x7) 118 119static inline void rfcomm_schedule(uint event) 120{ 121 if (!rfcomm_thread) 122 return; 123 //set_bit(event, &rfcomm_event); 124 set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event); 125 wake_up_process(rfcomm_thread); 126} 127 128static inline void rfcomm_session_put(struct rfcomm_session *s) 129{ 130 if (atomic_dec_and_test(&s->refcnt)) 131 rfcomm_session_del(s); 132} 133 134/* ---- RFCOMM FCS computation ---- */ 135 136/* reversed, 8-bit, poly=0x07 */ 137static unsigned char rfcomm_crc_table[256] = { 138 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75, 139 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b, 140 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69, 141 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67, 142 143 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d, 144 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43, 145 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51, 146 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f, 147 148 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05, 149 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b, 150 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19, 151 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17, 152 153 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d, 154 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33, 155 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21, 156 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f, 157 158 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95, 159 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b, 160 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89, 161 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87, 162 163 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad, 164 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3, 165 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1, 166 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf, 167 168 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5, 169 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb, 170 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9, 171 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7, 172 173 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd, 174 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3, 175 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1, 176 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf 177}; 178 179/* CRC on 2 bytes */ 180#define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]]) 181 182/* FCS on 2 bytes */ 183static inline u8 __fcs(u8 *data) 184{ 185 return (0xff - __crc(data)); 186} 187 188/* FCS on 3 bytes */ 189static inline u8 __fcs2(u8 *data) 190{ 191 return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]); 192} 193 194/* Check FCS */ 195static inline int __check_fcs(u8 *data, int type, u8 fcs) 196{ 197 u8 f = __crc(data); 198 199 if (type != RFCOMM_UIH) 200 f = rfcomm_crc_table[f ^ data[2]]; 201 202 return rfcomm_crc_table[f ^ fcs] != 0xcf; 203} 204 205/* ---- L2CAP callbacks ---- */ 206static void rfcomm_l2state_change(struct sock *sk) 207{ 208 BT_DBG("%p state %d", sk, sk->sk_state); 209 rfcomm_schedule(RFCOMM_SCHED_STATE); 210} 211 212static void rfcomm_l2data_ready(struct sock *sk, int bytes) 213{ 214 BT_DBG("%p bytes %d", sk, bytes); 215 rfcomm_schedule(RFCOMM_SCHED_RX); 216} 217 218static int rfcomm_l2sock_create(struct socket **sock) 219{ 220 int err; 221 222 BT_DBG(""); 223 224 err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock); 225 if (!err) { 226 struct sock *sk = (*sock)->sk; 227 sk->sk_data_ready = rfcomm_l2data_ready; 228 sk->sk_state_change = rfcomm_l2state_change; 229 } 230 return err; 231} 232 233/* ---- RFCOMM DLCs ---- */ 234static void rfcomm_dlc_timeout(unsigned long arg) 235{ 236 struct rfcomm_dlc *d = (void *) arg; 237 238 BT_DBG("dlc %p state %ld", d, d->state); 239 240 set_bit(RFCOMM_TIMED_OUT, &d->flags); 241 rfcomm_dlc_put(d); 242 rfcomm_schedule(RFCOMM_SCHED_TIMEO); 243} 244 245static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout) 246{ 247 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout); 248 249 if (!mod_timer(&d->timer, jiffies + timeout)) 250 rfcomm_dlc_hold(d); 251} 252 253static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d) 254{ 255 BT_DBG("dlc %p state %ld", d, d->state); 256 257 if (timer_pending(&d->timer) && del_timer(&d->timer)) 258 rfcomm_dlc_put(d); 259} 260 261static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d) 262{ 263 BT_DBG("%p", d); 264 265 d->state = BT_OPEN; 266 d->flags = 0; 267 d->mscex = 0; 268 d->mtu = RFCOMM_DEFAULT_MTU; 269 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV; 270 271 d->cfc = RFCOMM_CFC_DISABLED; 272 d->rx_credits = RFCOMM_DEFAULT_CREDITS; 273} 274 275struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio) 276{ 277 struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio); 278 279 if (!d) 280 return NULL; 281 282 init_timer(&d->timer); 283 d->timer.function = rfcomm_dlc_timeout; 284 d->timer.data = (unsigned long) d; 285 286 skb_queue_head_init(&d->tx_queue); 287 spin_lock_init(&d->lock); 288 atomic_set(&d->refcnt, 1); 289 290 rfcomm_dlc_clear_state(d); 291 292 BT_DBG("%p", d); 293 294 return d; 295} 296 297void rfcomm_dlc_free(struct rfcomm_dlc *d) 298{ 299 BT_DBG("%p", d); 300 301 skb_queue_purge(&d->tx_queue); 302 kfree(d); 303} 304 305static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d) 306{ 307 BT_DBG("dlc %p session %p", d, s); 308 309 rfcomm_session_hold(s); 310 311 rfcomm_dlc_hold(d); 312 list_add(&d->list, &s->dlcs); 313 d->session = s; 314} 315 316static void rfcomm_dlc_unlink(struct rfcomm_dlc *d) 317{ 318 struct rfcomm_session *s = d->session; 319 320 BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s); 321 322 list_del(&d->list); 323 d->session = NULL; 324 rfcomm_dlc_put(d); 325 326 rfcomm_session_put(s); 327} 328 329static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci) 330{ 331 struct rfcomm_dlc *d; 332 struct list_head *p; 333 334 list_for_each(p, &s->dlcs) { 335 d = list_entry(p, struct rfcomm_dlc, list); 336 if (d->dlci == dlci) 337 return d; 338 } 339 return NULL; 340} 341 342static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel) 343{ 344 struct rfcomm_session *s; 345 int err = 0; 346 u8 dlci; 347 348 BT_DBG("dlc %p state %ld %s %s channel %d", 349 d, d->state, batostr(src), batostr(dst), channel); 350 351 if (channel < 1 || channel > 30) 352 return -EINVAL; 353 354 if (d->state != BT_OPEN && d->state != BT_CLOSED) 355 return 0; 356 357 s = rfcomm_session_get(src, dst); 358 if (!s) { 359 s = rfcomm_session_create(src, dst, &err); 360 if (!s) 361 return err; 362 } 363 364 dlci = __dlci(!s->initiator, channel); 365 366 /* Check if DLCI already exists */ 367 if (rfcomm_dlc_get(s, dlci)) 368 return -EBUSY; 369 370 rfcomm_dlc_clear_state(d); 371 372 d->dlci = dlci; 373 d->addr = __addr(s->initiator, dlci); 374 d->priority = 7; 375 376 d->state = BT_CONFIG; 377 rfcomm_dlc_link(s, d); 378 379 d->mtu = s->mtu; 380 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc; 381 382 if (s->state == BT_CONNECTED) 383 rfcomm_send_pn(s, 1, d); 384 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT); 385 return 0; 386} 387 388int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel) 389{ 390 int r; 391 392 rfcomm_lock(); 393 394 r = __rfcomm_dlc_open(d, src, dst, channel); 395 396 rfcomm_unlock(); 397 return r; 398} 399 400static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err) 401{ 402 struct rfcomm_session *s = d->session; 403 if (!s) 404 return 0; 405 406 BT_DBG("dlc %p state %ld dlci %d err %d session %p", 407 d, d->state, d->dlci, err, s); 408 409 switch (d->state) { 410 case BT_CONNECTED: 411 case BT_CONFIG: 412 case BT_CONNECT: 413 d->state = BT_DISCONN; 414 if (skb_queue_empty(&d->tx_queue)) { 415 rfcomm_send_disc(s, d->dlci); 416 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT); 417 } else { 418 rfcomm_queue_disc(d); 419 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2); 420 } 421 break; 422 423 default: 424 rfcomm_dlc_clear_timer(d); 425 426 rfcomm_dlc_lock(d); 427 d->state = BT_CLOSED; 428 d->state_change(d, err); 429 rfcomm_dlc_unlock(d); 430 431 skb_queue_purge(&d->tx_queue); 432 rfcomm_dlc_unlink(d); 433 } 434 435 return 0; 436} 437 438int rfcomm_dlc_close(struct rfcomm_dlc *d, int err) 439{ 440 int r; 441 442 rfcomm_lock(); 443 444 r = __rfcomm_dlc_close(d, err); 445 446 rfcomm_unlock(); 447 return r; 448} 449 450int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb) 451{ 452 int len = skb->len; 453 454 if (d->state != BT_CONNECTED) 455 return -ENOTCONN; 456 457 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); 458 459 if (len > d->mtu) 460 return -EINVAL; 461 462 rfcomm_make_uih(skb, d->addr); 463 skb_queue_tail(&d->tx_queue, skb); 464 465 if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 466 rfcomm_schedule(RFCOMM_SCHED_TX); 467 return len; 468} 469 470void fastcall __rfcomm_dlc_throttle(struct rfcomm_dlc *d) 471{ 472 BT_DBG("dlc %p state %ld", d, d->state); 473 474 if (!d->cfc) { 475 d->v24_sig |= RFCOMM_V24_FC; 476 set_bit(RFCOMM_MSC_PENDING, &d->flags); 477 } 478 rfcomm_schedule(RFCOMM_SCHED_TX); 479} 480 481void fastcall __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d) 482{ 483 BT_DBG("dlc %p state %ld", d, d->state); 484 485 if (!d->cfc) { 486 d->v24_sig &= ~RFCOMM_V24_FC; 487 set_bit(RFCOMM_MSC_PENDING, &d->flags); 488 } 489 rfcomm_schedule(RFCOMM_SCHED_TX); 490} 491 492/* 493 Set/get modem status functions use _local_ status i.e. what we report 494 to the other side. 495 Remote status is provided by dlc->modem_status() callback. 496 */ 497int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig) 498{ 499 BT_DBG("dlc %p state %ld v24_sig 0x%x", 500 d, d->state, v24_sig); 501 502 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags)) 503 v24_sig |= RFCOMM_V24_FC; 504 else 505 v24_sig &= ~RFCOMM_V24_FC; 506 507 d->v24_sig = v24_sig; 508 509 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags)) 510 rfcomm_schedule(RFCOMM_SCHED_TX); 511 512 return 0; 513} 514 515int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig) 516{ 517 BT_DBG("dlc %p state %ld v24_sig 0x%x", 518 d, d->state, d->v24_sig); 519 520 *v24_sig = d->v24_sig; 521 return 0; 522} 523 524/* ---- RFCOMM sessions ---- */ 525static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state) 526{ 527 struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL); 528 529 if (!s) 530 return NULL; 531 532 BT_DBG("session %p sock %p", s, sock); 533 534 INIT_LIST_HEAD(&s->dlcs); 535 s->state = state; 536 s->sock = sock; 537 538 s->mtu = RFCOMM_DEFAULT_MTU; 539 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN; 540 541 /* Do not increment module usage count for listening sessions. 542 * Otherwise we won't be able to unload the module. */ 543 if (state != BT_LISTEN) 544 if (!try_module_get(THIS_MODULE)) { 545 kfree(s); 546 return NULL; 547 } 548 549 list_add(&s->list, &session_list); 550 551 return s; 552} 553 554static void rfcomm_session_del(struct rfcomm_session *s) 555{ 556 int state = s->state; 557 558 BT_DBG("session %p state %ld", s, s->state); 559 560 list_del(&s->list); 561 562 if (state == BT_CONNECTED) 563 rfcomm_send_disc(s, 0); 564 565 sock_release(s->sock); 566 kfree(s); 567 568 if (state != BT_LISTEN) 569 module_put(THIS_MODULE); 570} 571 572static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst) 573{ 574 struct rfcomm_session *s; 575 struct list_head *p, *n; 576 struct bt_sock *sk; 577 list_for_each_safe(p, n, &session_list) { 578 s = list_entry(p, struct rfcomm_session, list); 579 sk = bt_sk(s->sock->sk); 580 581 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) && 582 !bacmp(&sk->dst, dst)) 583 return s; 584 } 585 return NULL; 586} 587 588static void rfcomm_session_close(struct rfcomm_session *s, int err) 589{ 590 struct rfcomm_dlc *d; 591 struct list_head *p, *n; 592 593 BT_DBG("session %p state %ld err %d", s, s->state, err); 594 595 rfcomm_session_hold(s); 596 597 s->state = BT_CLOSED; 598 599 /* Close all dlcs */ 600 list_for_each_safe(p, n, &s->dlcs) { 601 d = list_entry(p, struct rfcomm_dlc, list); 602 d->state = BT_CLOSED; 603 __rfcomm_dlc_close(d, err); 604 } 605 606 rfcomm_session_put(s); 607} 608 609static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err) 610{ 611 struct rfcomm_session *s = NULL; 612 struct sockaddr_l2 addr; 613 struct socket *sock; 614 struct sock *sk; 615 616 BT_DBG("%s %s", batostr(src), batostr(dst)); 617 618 *err = rfcomm_l2sock_create(&sock); 619 if (*err < 0) 620 return NULL; 621 622 bacpy(&addr.l2_bdaddr, src); 623 addr.l2_family = AF_BLUETOOTH; 624 addr.l2_psm = 0; 625 *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr)); 626 if (*err < 0) 627 goto failed; 628 629 /* Set L2CAP options */ 630 sk = sock->sk; 631 lock_sock(sk); 632 l2cap_pi(sk)->imtu = l2cap_mtu; 633 release_sock(sk); 634 635 s = rfcomm_session_add(sock, BT_BOUND); 636 if (!s) { 637 *err = -ENOMEM; 638 goto failed; 639 } 640 641 s->initiator = 1; 642 643 bacpy(&addr.l2_bdaddr, dst); 644 addr.l2_family = AF_BLUETOOTH; 645 addr.l2_psm = htobs(RFCOMM_PSM); 646 *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK); 647 if (*err == 0 || *err == -EINPROGRESS) 648 return s; 649 650 rfcomm_session_del(s); 651 return NULL; 652 653failed: 654 sock_release(sock); 655 return NULL; 656} 657 658void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst) 659{ 660 struct sock *sk = s->sock->sk; 661 if (src) 662 bacpy(src, &bt_sk(sk)->src); 663 if (dst) 664 bacpy(dst, &bt_sk(sk)->dst); 665} 666 667/* ---- RFCOMM frame sending ---- */ 668static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len) 669{ 670 struct socket *sock = s->sock; 671 struct kvec iv = { data, len }; 672 struct msghdr msg; 673 674 BT_DBG("session %p len %d", s, len); 675 676 memset(&msg, 0, sizeof(msg)); 677 678 return kernel_sendmsg(sock, &msg, &iv, 1, len); 679} 680 681static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci) 682{ 683 struct rfcomm_cmd cmd; 684 685 BT_DBG("%p dlci %d", s, dlci); 686 687 cmd.addr = __addr(s->initiator, dlci); 688 cmd.ctrl = __ctrl(RFCOMM_SABM, 1); 689 cmd.len = __len8(0); 690 cmd.fcs = __fcs2((u8 *) &cmd); 691 692 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd)); 693} 694 695static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci) 696{ 697 struct rfcomm_cmd cmd; 698 699 BT_DBG("%p dlci %d", s, dlci); 700 701 cmd.addr = __addr(!s->initiator, dlci); 702 cmd.ctrl = __ctrl(RFCOMM_UA, 1); 703 cmd.len = __len8(0); 704 cmd.fcs = __fcs2((u8 *) &cmd); 705 706 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd)); 707} 708 709static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci) 710{ 711 struct rfcomm_cmd cmd; 712 713 BT_DBG("%p dlci %d", s, dlci); 714 715 cmd.addr = __addr(s->initiator, dlci); 716 cmd.ctrl = __ctrl(RFCOMM_DISC, 1); 717 cmd.len = __len8(0); 718 cmd.fcs = __fcs2((u8 *) &cmd); 719 720 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd)); 721} 722 723static int rfcomm_queue_disc(struct rfcomm_dlc *d) 724{ 725 struct rfcomm_cmd *cmd; 726 struct sk_buff *skb; 727 728 BT_DBG("dlc %p dlci %d", d, d->dlci); 729 730 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL); 731 if (!skb) 732 return -ENOMEM; 733 734 cmd = (void *) __skb_put(skb, sizeof(*cmd)); 735 cmd->addr = d->addr; 736 cmd->ctrl = __ctrl(RFCOMM_DISC, 1); 737 cmd->len = __len8(0); 738 cmd->fcs = __fcs2((u8 *) cmd); 739 740 skb_queue_tail(&d->tx_queue, skb); 741 rfcomm_schedule(RFCOMM_SCHED_TX); 742 return 0; 743} 744 745static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci) 746{ 747 struct rfcomm_cmd cmd; 748 749 BT_DBG("%p dlci %d", s, dlci); 750 751 cmd.addr = __addr(!s->initiator, dlci); 752 cmd.ctrl = __ctrl(RFCOMM_DM, 1); 753 cmd.len = __len8(0); 754 cmd.fcs = __fcs2((u8 *) &cmd); 755 756 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd)); 757} 758 759static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type) 760{ 761 struct rfcomm_hdr *hdr; 762 struct rfcomm_mcc *mcc; 763 u8 buf[16], *ptr = buf; 764 765 BT_DBG("%p cr %d type %d", s, cr, type); 766 767 hdr = (void *) ptr; ptr += sizeof(*hdr); 768 hdr->addr = __addr(s->initiator, 0); 769 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 770 hdr->len = __len8(sizeof(*mcc) + 1); 771 772 mcc = (void *) ptr; ptr += sizeof(*mcc); 773 mcc->type = __mcc_type(cr, RFCOMM_NSC); 774 mcc->len = __len8(1); 775 776 /* Type that we didn't like */ 777 *ptr = __mcc_type(cr, type); ptr++; 778 779 *ptr = __fcs(buf); ptr++; 780 781 return rfcomm_send_frame(s, buf, ptr - buf); 782} 783 784static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d) 785{ 786 struct rfcomm_hdr *hdr; 787 struct rfcomm_mcc *mcc; 788 struct rfcomm_pn *pn; 789 u8 buf[16], *ptr = buf; 790 791 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu); 792 793 hdr = (void *) ptr; ptr += sizeof(*hdr); 794 hdr->addr = __addr(s->initiator, 0); 795 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 796 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn)); 797 798 mcc = (void *) ptr; ptr += sizeof(*mcc); 799 mcc->type = __mcc_type(cr, RFCOMM_PN); 800 mcc->len = __len8(sizeof(*pn)); 801 802 pn = (void *) ptr; ptr += sizeof(*pn); 803 pn->dlci = d->dlci; 804 pn->priority = d->priority; 805 pn->ack_timer = 0; 806 pn->max_retrans = 0; 807 808 if (s->cfc) { 809 pn->flow_ctrl = cr ? 0xf0 : 0xe0; 810 pn->credits = RFCOMM_DEFAULT_CREDITS; 811 } else { 812 pn->flow_ctrl = 0; 813 pn->credits = 0; 814 } 815 816 if (cr && channel_mtu >= 0) 817 pn->mtu = htobs(channel_mtu); 818 else 819 pn->mtu = htobs(d->mtu); 820 821 *ptr = __fcs(buf); ptr++; 822 823 return rfcomm_send_frame(s, buf, ptr - buf); 824} 825 826int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci, 827 u8 bit_rate, u8 data_bits, u8 stop_bits, 828 u8 parity, u8 flow_ctrl_settings, 829 u8 xon_char, u8 xoff_char, u16 param_mask) 830{ 831 struct rfcomm_hdr *hdr; 832 struct rfcomm_mcc *mcc; 833 struct rfcomm_rpn *rpn; 834 u8 buf[16], *ptr = buf; 835 836 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x" 837 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x", 838 s, cr, dlci, bit_rate, data_bits, stop_bits, parity, 839 flow_ctrl_settings, xon_char, xoff_char, param_mask); 840 841 hdr = (void *) ptr; ptr += sizeof(*hdr); 842 hdr->addr = __addr(s->initiator, 0); 843 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 844 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn)); 845 846 mcc = (void *) ptr; ptr += sizeof(*mcc); 847 mcc->type = __mcc_type(cr, RFCOMM_RPN); 848 mcc->len = __len8(sizeof(*rpn)); 849 850 rpn = (void *) ptr; ptr += sizeof(*rpn); 851 rpn->dlci = __addr(1, dlci); 852 rpn->bit_rate = bit_rate; 853 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity); 854 rpn->flow_ctrl = flow_ctrl_settings; 855 rpn->xon_char = xon_char; 856 rpn->xoff_char = xoff_char; 857 rpn->param_mask = cpu_to_le16(param_mask); 858 859 *ptr = __fcs(buf); ptr++; 860 861 return rfcomm_send_frame(s, buf, ptr - buf); 862} 863 864static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status) 865{ 866 struct rfcomm_hdr *hdr; 867 struct rfcomm_mcc *mcc; 868 struct rfcomm_rls *rls; 869 u8 buf[16], *ptr = buf; 870 871 BT_DBG("%p cr %d status 0x%x", s, cr, status); 872 873 hdr = (void *) ptr; ptr += sizeof(*hdr); 874 hdr->addr = __addr(s->initiator, 0); 875 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 876 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls)); 877 878 mcc = (void *) ptr; ptr += sizeof(*mcc); 879 mcc->type = __mcc_type(cr, RFCOMM_RLS); 880 mcc->len = __len8(sizeof(*rls)); 881 882 rls = (void *) ptr; ptr += sizeof(*rls); 883 rls->dlci = __addr(1, dlci); 884 rls->status = status; 885 886 *ptr = __fcs(buf); ptr++; 887 888 return rfcomm_send_frame(s, buf, ptr - buf); 889} 890 891static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig) 892{ 893 struct rfcomm_hdr *hdr; 894 struct rfcomm_mcc *mcc; 895 struct rfcomm_msc *msc; 896 u8 buf[16], *ptr = buf; 897 898 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig); 899 900 hdr = (void *) ptr; ptr += sizeof(*hdr); 901 hdr->addr = __addr(s->initiator, 0); 902 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 903 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc)); 904 905 mcc = (void *) ptr; ptr += sizeof(*mcc); 906 mcc->type = __mcc_type(cr, RFCOMM_MSC); 907 mcc->len = __len8(sizeof(*msc)); 908 909 msc = (void *) ptr; ptr += sizeof(*msc); 910 msc->dlci = __addr(1, dlci); 911 msc->v24_sig = v24_sig | 0x01; 912 913 *ptr = __fcs(buf); ptr++; 914 915 return rfcomm_send_frame(s, buf, ptr - buf); 916} 917 918static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr) 919{ 920 struct rfcomm_hdr *hdr; 921 struct rfcomm_mcc *mcc; 922 u8 buf[16], *ptr = buf; 923 924 BT_DBG("%p cr %d", s, cr); 925 926 hdr = (void *) ptr; ptr += sizeof(*hdr); 927 hdr->addr = __addr(s->initiator, 0); 928 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 929 hdr->len = __len8(sizeof(*mcc)); 930 931 mcc = (void *) ptr; ptr += sizeof(*mcc); 932 mcc->type = __mcc_type(cr, RFCOMM_FCOFF); 933 mcc->len = __len8(0); 934 935 *ptr = __fcs(buf); ptr++; 936 937 return rfcomm_send_frame(s, buf, ptr - buf); 938} 939 940static int rfcomm_send_fcon(struct rfcomm_session *s, int cr) 941{ 942 struct rfcomm_hdr *hdr; 943 struct rfcomm_mcc *mcc; 944 u8 buf[16], *ptr = buf; 945 946 BT_DBG("%p cr %d", s, cr); 947 948 hdr = (void *) ptr; ptr += sizeof(*hdr); 949 hdr->addr = __addr(s->initiator, 0); 950 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 951 hdr->len = __len8(sizeof(*mcc)); 952 953 mcc = (void *) ptr; ptr += sizeof(*mcc); 954 mcc->type = __mcc_type(cr, RFCOMM_FCON); 955 mcc->len = __len8(0); 956 957 *ptr = __fcs(buf); ptr++; 958 959 return rfcomm_send_frame(s, buf, ptr - buf); 960} 961 962static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len) 963{ 964 struct socket *sock = s->sock; 965 struct kvec iv[3]; 966 struct msghdr msg; 967 unsigned char hdr[5], crc[1]; 968 969 if (len > 125) 970 return -EINVAL; 971 972 BT_DBG("%p cr %d", s, cr); 973 974 hdr[0] = __addr(s->initiator, 0); 975 hdr[1] = __ctrl(RFCOMM_UIH, 0); 976 hdr[2] = 0x01 | ((len + 2) << 1); 977 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2); 978 hdr[4] = 0x01 | (len << 1); 979 980 crc[0] = __fcs(hdr); 981 982 iv[0].iov_base = hdr; 983 iv[0].iov_len = 5; 984 iv[1].iov_base = pattern; 985 iv[1].iov_len = len; 986 iv[2].iov_base = crc; 987 iv[2].iov_len = 1; 988 989 memset(&msg, 0, sizeof(msg)); 990 991 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len); 992} 993 994static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits) 995{ 996 struct rfcomm_hdr *hdr; 997 u8 buf[16], *ptr = buf; 998 999 BT_DBG("%p addr %d credits %d", s, addr, credits); 1000 1001 hdr = (void *) ptr; ptr += sizeof(*hdr); 1002 hdr->addr = addr; 1003 hdr->ctrl = __ctrl(RFCOMM_UIH, 1); 1004 hdr->len = __len8(0); 1005 1006 *ptr = credits; ptr++; 1007 1008 *ptr = __fcs(buf); ptr++; 1009 1010 return rfcomm_send_frame(s, buf, ptr - buf); 1011} 1012 1013static void rfcomm_make_uih(struct sk_buff *skb, u8 addr) 1014{ 1015 struct rfcomm_hdr *hdr; 1016 int len = skb->len; 1017 u8 *crc; 1018 1019 if (len > 127) { 1020 hdr = (void *) skb_push(skb, 4); 1021 put_unaligned(htobs(__len16(len)), (__le16 *) &hdr->len); 1022 } else { 1023 hdr = (void *) skb_push(skb, 3); 1024 hdr->len = __len8(len); 1025 } 1026 hdr->addr = addr; 1027 hdr->ctrl = __ctrl(RFCOMM_UIH, 0); 1028 1029 crc = skb_put(skb, 1); 1030 *crc = __fcs((void *) hdr); 1031} 1032 1033/* ---- RFCOMM frame reception ---- */ 1034static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci) 1035{ 1036 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1037 1038 if (dlci) { 1039 /* Data channel */ 1040 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1041 if (!d) { 1042 rfcomm_send_dm(s, dlci); 1043 return 0; 1044 } 1045 1046 switch (d->state) { 1047 case BT_CONNECT: 1048 rfcomm_dlc_clear_timer(d); 1049 1050 rfcomm_dlc_lock(d); 1051 d->state = BT_CONNECTED; 1052 d->state_change(d, 0); 1053 rfcomm_dlc_unlock(d); 1054 1055 rfcomm_send_msc(s, 1, dlci, d->v24_sig); 1056 break; 1057 1058 case BT_DISCONN: 1059 d->state = BT_CLOSED; 1060 __rfcomm_dlc_close(d, 0); 1061 1062 if (list_empty(&s->dlcs)) { 1063 s->state = BT_DISCONN; 1064 rfcomm_send_disc(s, 0); 1065 } 1066 1067 break; 1068 } 1069 } else { 1070 /* Control channel */ 1071 switch (s->state) { 1072 case BT_CONNECT: 1073 s->state = BT_CONNECTED; 1074 rfcomm_process_connect(s); 1075 break; 1076 1077 case BT_DISCONN: 1078 rfcomm_session_put(s); 1079 break; 1080 } 1081 } 1082 return 0; 1083} 1084 1085static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci) 1086{ 1087 int err = 0; 1088 1089 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1090 1091 if (dlci) { 1092 /* Data DLC */ 1093 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1094 if (d) { 1095 if (d->state == BT_CONNECT || d->state == BT_CONFIG) 1096 err = ECONNREFUSED; 1097 else 1098 err = ECONNRESET; 1099 1100 d->state = BT_CLOSED; 1101 __rfcomm_dlc_close(d, err); 1102 } 1103 } else { 1104 if (s->state == BT_CONNECT) 1105 err = ECONNREFUSED; 1106 else 1107 err = ECONNRESET; 1108 1109 s->state = BT_CLOSED; 1110 rfcomm_session_close(s, err); 1111 } 1112 return 0; 1113} 1114 1115static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci) 1116{ 1117 int err = 0; 1118 1119 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1120 1121 if (dlci) { 1122 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci); 1123 if (d) { 1124 rfcomm_send_ua(s, dlci); 1125 1126 if (d->state == BT_CONNECT || d->state == BT_CONFIG) 1127 err = ECONNREFUSED; 1128 else 1129 err = ECONNRESET; 1130 1131 d->state = BT_CLOSED; 1132 __rfcomm_dlc_close(d, err); 1133 } else 1134 rfcomm_send_dm(s, dlci); 1135 1136 } else { 1137 rfcomm_send_ua(s, 0); 1138 1139 if (s->state == BT_CONNECT) 1140 err = ECONNREFUSED; 1141 else 1142 err = ECONNRESET; 1143 1144 s->state = BT_CLOSED; 1145 rfcomm_session_close(s, err); 1146 } 1147 1148 return 0; 1149} 1150 1151static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d) 1152{ 1153 struct sock *sk = d->session->sock->sk; 1154 1155 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) { 1156 if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon)) 1157 return 1; 1158 } else if (d->link_mode & RFCOMM_LM_AUTH) { 1159 if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon)) 1160 return 1; 1161 } 1162 1163 return 0; 1164} 1165 1166static void rfcomm_dlc_accept(struct rfcomm_dlc *d) 1167{ 1168 struct sock *sk = d->session->sock->sk; 1169 1170 BT_DBG("dlc %p", d); 1171 1172 rfcomm_send_ua(d->session, d->dlci); 1173 1174 rfcomm_dlc_lock(d); 1175 d->state = BT_CONNECTED; 1176 d->state_change(d, 0); 1177 rfcomm_dlc_unlock(d); 1178 1179 if (d->link_mode & RFCOMM_LM_MASTER) 1180 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00); 1181 1182 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 1183} 1184 1185static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci) 1186{ 1187 struct rfcomm_dlc *d; 1188 u8 channel; 1189 1190 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1191 1192 if (!dlci) { 1193 rfcomm_send_ua(s, 0); 1194 1195 if (s->state == BT_OPEN) { 1196 s->state = BT_CONNECTED; 1197 rfcomm_process_connect(s); 1198 } 1199 return 0; 1200 } 1201 1202 /* Check if DLC exists */ 1203 d = rfcomm_dlc_get(s, dlci); 1204 if (d) { 1205 if (d->state == BT_OPEN) { 1206 /* DLC was previously opened by PN request */ 1207 if (rfcomm_check_link_mode(d)) { 1208 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 1209 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1210 return 0; 1211 } 1212 1213 rfcomm_dlc_accept(d); 1214 } 1215 return 0; 1216 } 1217 1218 /* Notify socket layer about incoming connection */ 1219 channel = __srv_channel(dlci); 1220 if (rfcomm_connect_ind(s, channel, &d)) { 1221 d->dlci = dlci; 1222 d->addr = __addr(s->initiator, dlci); 1223 rfcomm_dlc_link(s, d); 1224 1225 if (rfcomm_check_link_mode(d)) { 1226 set_bit(RFCOMM_AUTH_PENDING, &d->flags); 1227 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT); 1228 return 0; 1229 } 1230 1231 rfcomm_dlc_accept(d); 1232 } else { 1233 rfcomm_send_dm(s, dlci); 1234 } 1235 1236 return 0; 1237} 1238 1239static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn) 1240{ 1241 struct rfcomm_session *s = d->session; 1242 1243 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d", 1244 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits); 1245 1246 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) || 1247 pn->flow_ctrl == 0xe0) { 1248 d->cfc = RFCOMM_CFC_ENABLED; 1249 d->tx_credits = pn->credits; 1250 } else { 1251 d->cfc = RFCOMM_CFC_DISABLED; 1252 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1253 } 1254 1255 if (s->cfc == RFCOMM_CFC_UNKNOWN) 1256 s->cfc = d->cfc; 1257 1258 d->priority = pn->priority; 1259 1260 d->mtu = btohs(pn->mtu); 1261 1262 if (cr && d->mtu > s->mtu) 1263 d->mtu = s->mtu; 1264 1265 return 0; 1266} 1267 1268static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1269{ 1270 struct rfcomm_pn *pn = (void *) skb->data; 1271 struct rfcomm_dlc *d; 1272 u8 dlci = pn->dlci; 1273 1274 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci); 1275 1276 if (!dlci) 1277 return 0; 1278 1279 d = rfcomm_dlc_get(s, dlci); 1280 if (d) { 1281 if (cr) { 1282 /* PN request */ 1283 rfcomm_apply_pn(d, cr, pn); 1284 rfcomm_send_pn(s, 0, d); 1285 } else { 1286 /* PN response */ 1287 switch (d->state) { 1288 case BT_CONFIG: 1289 rfcomm_apply_pn(d, cr, pn); 1290 1291 d->state = BT_CONNECT; 1292 rfcomm_send_sabm(s, d->dlci); 1293 break; 1294 } 1295 } 1296 } else { 1297 u8 channel = __srv_channel(dlci); 1298 1299 if (!cr) 1300 return 0; 1301 1302 /* PN request for non existing DLC. 1303 * Assume incoming connection. */ 1304 if (rfcomm_connect_ind(s, channel, &d)) { 1305 d->dlci = dlci; 1306 d->addr = __addr(s->initiator, dlci); 1307 rfcomm_dlc_link(s, d); 1308 1309 rfcomm_apply_pn(d, cr, pn); 1310 1311 d->state = BT_OPEN; 1312 rfcomm_send_pn(s, 0, d); 1313 } else { 1314 rfcomm_send_dm(s, dlci); 1315 } 1316 } 1317 return 0; 1318} 1319 1320static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb) 1321{ 1322 struct rfcomm_rpn *rpn = (void *) skb->data; 1323 u8 dlci = __get_dlci(rpn->dlci); 1324 1325 u8 bit_rate = 0; 1326 u8 data_bits = 0; 1327 u8 stop_bits = 0; 1328 u8 parity = 0; 1329 u8 flow_ctrl = 0; 1330 u8 xon_char = 0; 1331 u8 xoff_char = 0; 1332 u16 rpn_mask = RFCOMM_RPN_PM_ALL; 1333 1334 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x", 1335 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl, 1336 rpn->xon_char, rpn->xoff_char, rpn->param_mask); 1337 1338 if (!cr) 1339 return 0; 1340 1341 if (len == 1) { 1342 /* This is a request, return default settings */ 1343 bit_rate = RFCOMM_RPN_BR_115200; 1344 data_bits = RFCOMM_RPN_DATA_8; 1345 stop_bits = RFCOMM_RPN_STOP_1; 1346 parity = RFCOMM_RPN_PARITY_NONE; 1347 flow_ctrl = RFCOMM_RPN_FLOW_NONE; 1348 xon_char = RFCOMM_RPN_XON_CHAR; 1349 xoff_char = RFCOMM_RPN_XOFF_CHAR; 1350 goto rpn_out; 1351 } 1352 1353 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit, 1354 * no parity, no flow control lines, normal XON/XOFF chars */ 1355 1356 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) { 1357 bit_rate = rpn->bit_rate; 1358 if (bit_rate != RFCOMM_RPN_BR_115200) { 1359 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate); 1360 bit_rate = RFCOMM_RPN_BR_115200; 1361 rpn_mask ^= RFCOMM_RPN_PM_BITRATE; 1362 } 1363 } 1364 1365 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) { 1366 data_bits = __get_rpn_data_bits(rpn->line_settings); 1367 if (data_bits != RFCOMM_RPN_DATA_8) { 1368 BT_DBG("RPN data bits mismatch 0x%x", data_bits); 1369 data_bits = RFCOMM_RPN_DATA_8; 1370 rpn_mask ^= RFCOMM_RPN_PM_DATA; 1371 } 1372 } 1373 1374 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) { 1375 stop_bits = __get_rpn_stop_bits(rpn->line_settings); 1376 if (stop_bits != RFCOMM_RPN_STOP_1) { 1377 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits); 1378 stop_bits = RFCOMM_RPN_STOP_1; 1379 rpn_mask ^= RFCOMM_RPN_PM_STOP; 1380 } 1381 } 1382 1383 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) { 1384 parity = __get_rpn_parity(rpn->line_settings); 1385 if (parity != RFCOMM_RPN_PARITY_NONE) { 1386 BT_DBG("RPN parity mismatch 0x%x", parity); 1387 parity = RFCOMM_RPN_PARITY_NONE; 1388 rpn_mask ^= RFCOMM_RPN_PM_PARITY; 1389 } 1390 } 1391 1392 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) { 1393 flow_ctrl = rpn->flow_ctrl; 1394 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) { 1395 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl); 1396 flow_ctrl = RFCOMM_RPN_FLOW_NONE; 1397 rpn_mask ^= RFCOMM_RPN_PM_FLOW; 1398 } 1399 } 1400 1401 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) { 1402 xon_char = rpn->xon_char; 1403 if (xon_char != RFCOMM_RPN_XON_CHAR) { 1404 BT_DBG("RPN XON char mismatch 0x%x", xon_char); 1405 xon_char = RFCOMM_RPN_XON_CHAR; 1406 rpn_mask ^= RFCOMM_RPN_PM_XON; 1407 } 1408 } 1409 1410 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) { 1411 xoff_char = rpn->xoff_char; 1412 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) { 1413 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char); 1414 xoff_char = RFCOMM_RPN_XOFF_CHAR; 1415 rpn_mask ^= RFCOMM_RPN_PM_XOFF; 1416 } 1417 } 1418 1419rpn_out: 1420 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits, 1421 parity, flow_ctrl, xon_char, xoff_char, rpn_mask); 1422 1423 return 0; 1424} 1425 1426static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1427{ 1428 struct rfcomm_rls *rls = (void *) skb->data; 1429 u8 dlci = __get_dlci(rls->dlci); 1430 1431 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status); 1432 1433 if (!cr) 1434 return 0; 1435 1436 /* We should probably do something with this information here. But 1437 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's 1438 * mandatory to recognise and respond to RLS */ 1439 1440 rfcomm_send_rls(s, 0, dlci, rls->status); 1441 1442 return 0; 1443} 1444 1445static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb) 1446{ 1447 struct rfcomm_msc *msc = (void *) skb->data; 1448 struct rfcomm_dlc *d; 1449 u8 dlci = __get_dlci(msc->dlci); 1450 1451 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig); 1452 1453 d = rfcomm_dlc_get(s, dlci); 1454 if (!d) 1455 return 0; 1456 1457 if (cr) { 1458 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc) 1459 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1460 else 1461 clear_bit(RFCOMM_TX_THROTTLED, &d->flags); 1462 1463 rfcomm_dlc_lock(d); 1464 if (d->modem_status) 1465 d->modem_status(d, msc->v24_sig); 1466 rfcomm_dlc_unlock(d); 1467 1468 rfcomm_send_msc(s, 0, dlci, msc->v24_sig); 1469 1470 d->mscex |= RFCOMM_MSCEX_RX; 1471 } else 1472 d->mscex |= RFCOMM_MSCEX_TX; 1473 1474 return 0; 1475} 1476 1477static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb) 1478{ 1479 struct rfcomm_mcc *mcc = (void *) skb->data; 1480 u8 type, cr, len; 1481 1482 cr = __test_cr(mcc->type); 1483 type = __get_mcc_type(mcc->type); 1484 len = __get_mcc_len(mcc->len); 1485 1486 BT_DBG("%p type 0x%x cr %d", s, type, cr); 1487 1488 skb_pull(skb, 2); 1489 1490 switch (type) { 1491 case RFCOMM_PN: 1492 rfcomm_recv_pn(s, cr, skb); 1493 break; 1494 1495 case RFCOMM_RPN: 1496 rfcomm_recv_rpn(s, cr, len, skb); 1497 break; 1498 1499 case RFCOMM_RLS: 1500 rfcomm_recv_rls(s, cr, skb); 1501 break; 1502 1503 case RFCOMM_MSC: 1504 rfcomm_recv_msc(s, cr, skb); 1505 break; 1506 1507 case RFCOMM_FCOFF: 1508 if (cr) { 1509 set_bit(RFCOMM_TX_THROTTLED, &s->flags); 1510 rfcomm_send_fcoff(s, 0); 1511 } 1512 break; 1513 1514 case RFCOMM_FCON: 1515 if (cr) { 1516 clear_bit(RFCOMM_TX_THROTTLED, &s->flags); 1517 rfcomm_send_fcon(s, 0); 1518 } 1519 break; 1520 1521 case RFCOMM_TEST: 1522 if (cr) 1523 rfcomm_send_test(s, 0, skb->data, skb->len); 1524 break; 1525 1526 case RFCOMM_NSC: 1527 break; 1528 1529 default: 1530 BT_ERR("Unknown control type 0x%02x", type); 1531 rfcomm_send_nsc(s, cr, type); 1532 break; 1533 } 1534 return 0; 1535} 1536 1537static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb) 1538{ 1539 struct rfcomm_dlc *d; 1540 1541 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf); 1542 1543 d = rfcomm_dlc_get(s, dlci); 1544 if (!d) { 1545 rfcomm_send_dm(s, dlci); 1546 goto drop; 1547 } 1548 1549 if (pf && d->cfc) { 1550 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1); 1551 1552 d->tx_credits += credits; 1553 if (d->tx_credits) 1554 clear_bit(RFCOMM_TX_THROTTLED, &d->flags); 1555 } 1556 1557 if (skb->len && d->state == BT_CONNECTED) { 1558 rfcomm_dlc_lock(d); 1559 d->rx_credits--; 1560 d->data_ready(d, skb); 1561 rfcomm_dlc_unlock(d); 1562 return 0; 1563 } 1564 1565drop: 1566 kfree_skb(skb); 1567 return 0; 1568} 1569 1570static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb) 1571{ 1572 struct rfcomm_hdr *hdr = (void *) skb->data; 1573 u8 type, dlci, fcs; 1574 1575 dlci = __get_dlci(hdr->addr); 1576 type = __get_type(hdr->ctrl); 1577 1578 /* Trim FCS */ 1579 skb->len--; skb->tail--; 1580 fcs = *(u8 *)skb_tail_pointer(skb); 1581 1582 if (__check_fcs(skb->data, type, fcs)) { 1583 BT_ERR("bad checksum in packet"); 1584 kfree_skb(skb); 1585 return -EILSEQ; 1586 } 1587 1588 if (__test_ea(hdr->len)) 1589 skb_pull(skb, 3); 1590 else 1591 skb_pull(skb, 4); 1592 1593 switch (type) { 1594 case RFCOMM_SABM: 1595 if (__test_pf(hdr->ctrl)) 1596 rfcomm_recv_sabm(s, dlci); 1597 break; 1598 1599 case RFCOMM_DISC: 1600 if (__test_pf(hdr->ctrl)) 1601 rfcomm_recv_disc(s, dlci); 1602 break; 1603 1604 case RFCOMM_UA: 1605 if (__test_pf(hdr->ctrl)) 1606 rfcomm_recv_ua(s, dlci); 1607 break; 1608 1609 case RFCOMM_DM: 1610 rfcomm_recv_dm(s, dlci); 1611 break; 1612 1613 case RFCOMM_UIH: 1614 if (dlci) 1615 return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb); 1616 1617 rfcomm_recv_mcc(s, skb); 1618 break; 1619 1620 default: 1621 BT_ERR("Unknown packet type 0x%02x\n", type); 1622 break; 1623 } 1624 kfree_skb(skb); 1625 return 0; 1626} 1627 1628/* ---- Connection and data processing ---- */ 1629 1630static void rfcomm_process_connect(struct rfcomm_session *s) 1631{ 1632 struct rfcomm_dlc *d; 1633 struct list_head *p, *n; 1634 1635 BT_DBG("session %p state %ld", s, s->state); 1636 1637 list_for_each_safe(p, n, &s->dlcs) { 1638 d = list_entry(p, struct rfcomm_dlc, list); 1639 if (d->state == BT_CONFIG) { 1640 d->mtu = s->mtu; 1641 rfcomm_send_pn(s, 1, d); 1642 } 1643 } 1644} 1645 1646/* Send data queued for the DLC. 1647 * Return number of frames left in the queue. 1648 */ 1649static inline int rfcomm_process_tx(struct rfcomm_dlc *d) 1650{ 1651 struct sk_buff *skb; 1652 int err; 1653 1654 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d", 1655 d, d->state, d->cfc, d->rx_credits, d->tx_credits); 1656 1657 /* Send pending MSC */ 1658 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags)) 1659 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig); 1660 1661 if (d->cfc) { 1662 /* CFC enabled. 1663 * Give them some credits */ 1664 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) && 1665 d->rx_credits <= (d->cfc >> 2)) { 1666 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits); 1667 d->rx_credits = d->cfc; 1668 } 1669 } else { 1670 /* CFC disabled. 1671 * Give ourselves some credits */ 1672 d->tx_credits = 5; 1673 } 1674 1675 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags)) 1676 return skb_queue_len(&d->tx_queue); 1677 1678 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) { 1679 err = rfcomm_send_frame(d->session, skb->data, skb->len); 1680 if (err < 0) { 1681 skb_queue_head(&d->tx_queue, skb); 1682 break; 1683 } 1684 kfree_skb(skb); 1685 d->tx_credits--; 1686 } 1687 1688 if (d->cfc && !d->tx_credits) { 1689 /* We're out of TX credits. 1690 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */ 1691 set_bit(RFCOMM_TX_THROTTLED, &d->flags); 1692 } 1693 1694 return skb_queue_len(&d->tx_queue); 1695} 1696 1697static inline void rfcomm_process_dlcs(struct rfcomm_session *s) 1698{ 1699 struct rfcomm_dlc *d; 1700 struct list_head *p, *n; 1701 1702 BT_DBG("session %p state %ld", s, s->state); 1703 1704 list_for_each_safe(p, n, &s->dlcs) { 1705 d = list_entry(p, struct rfcomm_dlc, list); 1706 1707 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) { 1708 __rfcomm_dlc_close(d, ETIMEDOUT); 1709 continue; 1710 } 1711 1712 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) { 1713 rfcomm_dlc_clear_timer(d); 1714 rfcomm_dlc_accept(d); 1715 if (d->link_mode & RFCOMM_LM_SECURE) { 1716 struct sock *sk = s->sock->sk; 1717 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon); 1718 } 1719 continue; 1720 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) { 1721 rfcomm_dlc_clear_timer(d); 1722 rfcomm_send_dm(s, d->dlci); 1723 __rfcomm_dlc_close(d, ECONNREFUSED); 1724 continue; 1725 } 1726 1727 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags)) 1728 continue; 1729 1730 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) && 1731 d->mscex == RFCOMM_MSCEX_OK) 1732 rfcomm_process_tx(d); 1733 } 1734} 1735 1736static inline void rfcomm_process_rx(struct rfcomm_session *s) 1737{ 1738 struct socket *sock = s->sock; 1739 struct sock *sk = sock->sk; 1740 struct sk_buff *skb; 1741 1742 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue)); 1743 1744 /* Get data directly from socket receive queue without copying it. */ 1745 while ((skb = skb_dequeue(&sk->sk_receive_queue))) { 1746 skb_orphan(skb); 1747 rfcomm_recv_frame(s, skb); 1748 } 1749 1750 if (sk->sk_state == BT_CLOSED) { 1751 if (!s->initiator) 1752 rfcomm_session_put(s); 1753 1754 rfcomm_session_close(s, sk->sk_err); 1755 } 1756} 1757 1758static inline void rfcomm_accept_connection(struct rfcomm_session *s) 1759{ 1760 struct socket *sock = s->sock, *nsock; 1761 int err; 1762 1763 /* Fast check for a new connection. 1764 * Avoids unnesesary socket allocations. */ 1765 if (list_empty(&bt_sk(sock->sk)->accept_q)) 1766 return; 1767 1768 BT_DBG("session %p", s); 1769 1770 err = kernel_accept(sock, &nsock, O_NONBLOCK); 1771 if (err < 0) 1772 return; 1773 1774 __module_get(nsock->ops->owner); 1775 1776 /* Set our callbacks */ 1777 nsock->sk->sk_data_ready = rfcomm_l2data_ready; 1778 nsock->sk->sk_state_change = rfcomm_l2state_change; 1779 1780 s = rfcomm_session_add(nsock, BT_OPEN); 1781 if (s) { 1782 rfcomm_session_hold(s); 1783 1784 /* We should adjust MTU on incoming sessions. 1785 * L2CAP MTU minus UIH header and FCS. */ 1786 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5; 1787 1788 rfcomm_schedule(RFCOMM_SCHED_RX); 1789 } else 1790 sock_release(nsock); 1791} 1792 1793static inline void rfcomm_check_connection(struct rfcomm_session *s) 1794{ 1795 struct sock *sk = s->sock->sk; 1796 1797 BT_DBG("%p state %ld", s, s->state); 1798 1799 switch(sk->sk_state) { 1800 case BT_CONNECTED: 1801 s->state = BT_CONNECT; 1802 1803 /* We can adjust MTU on outgoing sessions. 1804 * L2CAP MTU minus UIH header and FCS. */ 1805 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5; 1806 1807 rfcomm_send_sabm(s, 0); 1808 break; 1809 1810 case BT_CLOSED: 1811 s->state = BT_CLOSED; 1812 rfcomm_session_close(s, sk->sk_err); 1813 break; 1814 } 1815} 1816 1817static inline void rfcomm_process_sessions(void) 1818{ 1819 struct list_head *p, *n; 1820 1821 rfcomm_lock(); 1822 1823 list_for_each_safe(p, n, &session_list) { 1824 struct rfcomm_session *s; 1825 s = list_entry(p, struct rfcomm_session, list); 1826 1827 if (s->state == BT_LISTEN) { 1828 rfcomm_accept_connection(s); 1829 continue; 1830 } 1831 1832 rfcomm_session_hold(s); 1833 1834 switch (s->state) { 1835 case BT_BOUND: 1836 rfcomm_check_connection(s); 1837 break; 1838 1839 default: 1840 rfcomm_process_rx(s); 1841 break; 1842 } 1843 1844 rfcomm_process_dlcs(s); 1845 1846 rfcomm_session_put(s); 1847 } 1848 1849 rfcomm_unlock(); 1850} 1851 1852static void rfcomm_worker(void) 1853{ 1854 BT_DBG(""); 1855 1856 while (!atomic_read(&terminate)) { 1857 set_current_state(TASK_INTERRUPTIBLE); 1858 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) { 1859 /* No pending events. Let's sleep. 1860 * Incoming connections and data will wake us up. */ 1861 schedule(); 1862 } 1863 set_current_state(TASK_RUNNING); 1864 1865 /* Process stuff */ 1866 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event); 1867 rfcomm_process_sessions(); 1868 } 1869 return; 1870} 1871 1872static int rfcomm_add_listener(bdaddr_t *ba) 1873{ 1874 struct sockaddr_l2 addr; 1875 struct socket *sock; 1876 struct sock *sk; 1877 struct rfcomm_session *s; 1878 int err = 0; 1879 1880 /* Create socket */ 1881 err = rfcomm_l2sock_create(&sock); 1882 if (err < 0) { 1883 BT_ERR("Create socket failed %d", err); 1884 return err; 1885 } 1886 1887 /* Bind socket */ 1888 bacpy(&addr.l2_bdaddr, ba); 1889 addr.l2_family = AF_BLUETOOTH; 1890 addr.l2_psm = htobs(RFCOMM_PSM); 1891 err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr)); 1892 if (err < 0) { 1893 BT_ERR("Bind failed %d", err); 1894 goto failed; 1895 } 1896 1897 /* Set L2CAP options */ 1898 sk = sock->sk; 1899 lock_sock(sk); 1900 l2cap_pi(sk)->imtu = l2cap_mtu; 1901 release_sock(sk); 1902 1903 /* Start listening on the socket */ 1904 err = kernel_listen(sock, 10); 1905 if (err) { 1906 BT_ERR("Listen failed %d", err); 1907 goto failed; 1908 } 1909 1910 /* Add listening session */ 1911 s = rfcomm_session_add(sock, BT_LISTEN); 1912 if (!s) 1913 goto failed; 1914 1915 rfcomm_session_hold(s); 1916 return 0; 1917failed: 1918 sock_release(sock); 1919 return err; 1920} 1921 1922static void rfcomm_kill_listener(void) 1923{ 1924 struct rfcomm_session *s; 1925 struct list_head *p, *n; 1926 1927 BT_DBG(""); 1928 1929 list_for_each_safe(p, n, &session_list) { 1930 s = list_entry(p, struct rfcomm_session, list); 1931 rfcomm_session_del(s); 1932 } 1933} 1934 1935static int rfcomm_run(void *unused) 1936{ 1937 rfcomm_thread = current; 1938 1939 atomic_inc(&running); 1940 1941 daemonize("krfcommd"); 1942 set_user_nice(current, -10); 1943 current->flags |= PF_NOFREEZE; 1944 1945 BT_DBG(""); 1946 1947 rfcomm_add_listener(BDADDR_ANY); 1948 1949 rfcomm_worker(); 1950 1951 rfcomm_kill_listener(); 1952 1953 atomic_dec(&running); 1954 return 0; 1955} 1956 1957static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status) 1958{ 1959 struct rfcomm_session *s; 1960 struct rfcomm_dlc *d; 1961 struct list_head *p, *n; 1962 1963 BT_DBG("conn %p status 0x%02x", conn, status); 1964 1965 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst); 1966 if (!s) 1967 return; 1968 1969 rfcomm_session_hold(s); 1970 1971 list_for_each_safe(p, n, &s->dlcs) { 1972 d = list_entry(p, struct rfcomm_dlc, list); 1973 1974 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) 1975 continue; 1976 1977 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags)) 1978 continue; 1979 1980 if (!status) 1981 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags); 1982 else 1983 set_bit(RFCOMM_AUTH_REJECT, &d->flags); 1984 } 1985 1986 rfcomm_session_put(s); 1987 1988 rfcomm_schedule(RFCOMM_SCHED_AUTH); 1989} 1990 1991static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt) 1992{ 1993 struct rfcomm_session *s; 1994 struct rfcomm_dlc *d; 1995 struct list_head *p, *n; 1996 1997 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt); 1998 1999 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst); 2000 if (!s) 2001 return; 2002 2003 rfcomm_session_hold(s); 2004 2005 list_for_each_safe(p, n, &s->dlcs) { 2006 d = list_entry(p, struct rfcomm_dlc, list); 2007 2008 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags)) 2009 continue; 2010 2011 if (!status && encrypt) 2012 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags); 2013 else 2014 set_bit(RFCOMM_AUTH_REJECT, &d->flags); 2015 } 2016 2017 rfcomm_session_put(s); 2018 2019 rfcomm_schedule(RFCOMM_SCHED_AUTH); 2020} 2021 2022static struct hci_cb rfcomm_cb = { 2023 .name = "RFCOMM", 2024 .auth_cfm = rfcomm_auth_cfm, 2025 .encrypt_cfm = rfcomm_encrypt_cfm 2026}; 2027 2028static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf) 2029{ 2030 struct rfcomm_session *s; 2031 struct list_head *pp, *p; 2032 char *str = buf; 2033 2034 rfcomm_lock(); 2035 2036 list_for_each(p, &session_list) { 2037 s = list_entry(p, struct rfcomm_session, list); 2038 list_for_each(pp, &s->dlcs) { 2039 struct sock *sk = s->sock->sk; 2040 struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list); 2041 2042 str += sprintf(str, "%s %s %ld %d %d %d %d\n", 2043 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst), 2044 d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits); 2045 } 2046 } 2047 2048 rfcomm_unlock(); 2049 2050 return (str - buf); 2051} 2052 2053static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL); 2054 2055/* ---- Initialization ---- */ 2056static int __init rfcomm_init(void) 2057{ 2058 l2cap_load(); 2059 2060 hci_register_cb(&rfcomm_cb); 2061 2062 kernel_thread(rfcomm_run, NULL, CLONE_KERNEL); 2063 2064 if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0) 2065 BT_ERR("Failed to create RFCOMM info file"); 2066 2067 rfcomm_init_sockets(); 2068 2069#ifdef CONFIG_BT_RFCOMM_TTY 2070 rfcomm_init_ttys(); 2071#endif 2072 2073 BT_INFO("RFCOMM ver %s", VERSION); 2074 2075 return 0; 2076} 2077 2078static void __exit rfcomm_exit(void) 2079{ 2080 class_remove_file(bt_class, &class_attr_rfcomm_dlc); 2081 2082 hci_unregister_cb(&rfcomm_cb); 2083 2084 /* Terminate working thread. 2085 * ie. Set terminate flag and wake it up */ 2086 atomic_inc(&terminate); 2087 rfcomm_schedule(RFCOMM_SCHED_STATE); 2088 2089 /* Wait until thread is running */ 2090 while (atomic_read(&running)) 2091 schedule(); 2092 2093#ifdef CONFIG_BT_RFCOMM_TTY 2094 rfcomm_cleanup_ttys(); 2095#endif 2096 2097 rfcomm_cleanup_sockets(); 2098} 2099 2100module_init(rfcomm_init); 2101module_exit(rfcomm_exit); 2102 2103module_param(disable_cfc, bool, 0644); 2104MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control"); 2105 2106module_param(channel_mtu, int, 0644); 2107MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel"); 2108 2109module_param(l2cap_mtu, uint, 0644); 2110MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection"); 2111 2112MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 2113MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION); 2114MODULE_VERSION(VERSION); 2115MODULE_LICENSE("GPL"); 2116MODULE_ALIAS("bt-proto-3"); 2117