Annotation of sys/netbt/rfcomm_session.c, Revision 1.1.1.1
1.1 nbrk 1: /* $OpenBSD: rfcomm_session.c,v 1.1 2007/06/01 02:46:12 uwe Exp $ */
2: /* $NetBSD: rfcomm_session.c,v 1.9 2007/04/21 06:15:23 plunky Exp $ */
3:
4: /*-
5: * Copyright (c) 2006 Itronix Inc.
6: * All rights reserved.
7: *
8: * Written by Iain Hibbert for Itronix Inc.
9: *
10: * Redistribution and use in source and binary forms, with or without
11: * modification, are permitted provided that the following conditions
12: * are met:
13: * 1. Redistributions of source code must retain the above copyright
14: * notice, this list of conditions and the following disclaimer.
15: * 2. Redistributions in binary form must reproduce the above copyright
16: * notice, this list of conditions and the following disclaimer in the
17: * documentation and/or other materials provided with the distribution.
18: * 3. The name of Itronix Inc. may not be used to endorse
19: * or promote products derived from this software without specific
20: * prior written permission.
21: *
22: * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
23: * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24: * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25: * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
26: * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
27: * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28: * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
29: * ON ANY THEORY OF LIABILITY, WHETHER IN
30: * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31: * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32: * POSSIBILITY OF SUCH DAMAGE.
33: */
34:
35: #include <sys/cdefs.h>
36:
37: #include <sys/param.h>
38: #include <sys/kernel.h>
39: #include <sys/mbuf.h>
40: #include <sys/proc.h>
41: #include <sys/systm.h>
42: #include <sys/types.h>
43:
44: #include <netbt/bluetooth.h>
45: #include <netbt/hci.h>
46: #include <netbt/l2cap.h>
47: #include <netbt/rfcomm.h>
48:
49: /******************************************************************************
50: *
51: * RFCOMM Multiplexer Sessions sit directly on L2CAP channels, and can
52: * multiplex up to 30 incoming and 30 outgoing connections.
53: * Only one Multiplexer is allowed between any two devices.
54: */
55:
56: static void rfcomm_session_timeout(void *);
57: static void rfcomm_session_recv_sabm(struct rfcomm_session *, int);
58: static void rfcomm_session_recv_disc(struct rfcomm_session *, int);
59: static void rfcomm_session_recv_ua(struct rfcomm_session *, int);
60: static void rfcomm_session_recv_dm(struct rfcomm_session *, int);
61: static void rfcomm_session_recv_uih(struct rfcomm_session *, int, int, struct mbuf *, int);
62: static void rfcomm_session_recv_mcc(struct rfcomm_session *, struct mbuf *);
63: static void rfcomm_session_recv_mcc_test(struct rfcomm_session *, int, struct mbuf *);
64: static void rfcomm_session_recv_mcc_fcon(struct rfcomm_session *, int);
65: static void rfcomm_session_recv_mcc_fcoff(struct rfcomm_session *, int);
66: static void rfcomm_session_recv_mcc_msc(struct rfcomm_session *, int, struct mbuf *);
67: static void rfcomm_session_recv_mcc_rpn(struct rfcomm_session *, int, struct mbuf *);
68: static void rfcomm_session_recv_mcc_rls(struct rfcomm_session *, int, struct mbuf *);
69: static void rfcomm_session_recv_mcc_pn(struct rfcomm_session *, int, struct mbuf *);
70: static void rfcomm_session_recv_mcc_nsc(struct rfcomm_session *, int, struct mbuf *);
71:
72: /* L2CAP callbacks */
73: static void rfcomm_session_connecting(void *);
74: static void rfcomm_session_connected(void *);
75: static void rfcomm_session_disconnected(void *, int);
76: static void *rfcomm_session_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
77: static void rfcomm_session_complete(void *, int);
78: static void rfcomm_session_linkmode(void *, int);
79: static void rfcomm_session_input(void *, struct mbuf *);
80:
81: static const struct btproto rfcomm_session_proto = {
82: rfcomm_session_connecting,
83: rfcomm_session_connected,
84: rfcomm_session_disconnected,
85: rfcomm_session_newconn,
86: rfcomm_session_complete,
87: rfcomm_session_linkmode,
88: rfcomm_session_input,
89: };
90:
91: struct rfcomm_session_list
92: rfcomm_session_active = LIST_HEAD_INITIALIZER(rfcomm_session_active);
93:
94: struct rfcomm_session_list
95: rfcomm_session_listen = LIST_HEAD_INITIALIZER(rfcomm_session_listen);
96:
97: struct pool rfcomm_credit_pool;
98:
99: /*
100: * RFCOMM System Parameters (see section 5.3)
101: */
102: int rfcomm_mtu_default = 127; /* bytes */
103: int rfcomm_ack_timeout = 20; /* seconds */
104: int rfcomm_mcc_timeout = 20; /* seconds */
105:
106: /*
107: * Reversed CRC table as per TS 07.10 Annex B.3.5
108: */
109: static const uint8_t crctable[256] = { /* reversed, 8-bit, poly=0x07 */
110: 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
111: 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
112: 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
113: 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
114:
115: 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
116: 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
117: 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
118: 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
119:
120: 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
121: 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
122: 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
123: 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
124:
125: 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
126: 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
127: 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
128: 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
129:
130: 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
131: 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
132: 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
133: 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
134:
135: 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
136: 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
137: 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
138: 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
139:
140: 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
141: 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
142: 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
143: 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
144:
145: 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
146: 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
147: 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
148: 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
149: };
150:
151: #define FCS(f, d) crctable[(f) ^ (d)]
152:
153: /*
154: * rfcomm_init()
155: *
156: * initialize the "credit pool".
157: */
158: void
159: rfcomm_init(void)
160: {
161: pool_init(&rfcomm_credit_pool, 0, 0, 0, 0, "rfcomm_credit", NULL);
162: }
163:
164: /*
165: * rfcomm_session_alloc(list, sockaddr)
166: *
167: * allocate a new session and fill in the blanks, then
168: * attach session to front of specified list (active or listen)
169: */
170: struct rfcomm_session *
171: rfcomm_session_alloc(struct rfcomm_session_list *list,
172: struct sockaddr_bt *laddr)
173: {
174: struct rfcomm_session *rs;
175: int err;
176:
177: rs = malloc(sizeof(*rs), M_BLUETOOTH, M_NOWAIT);
178: if (rs == NULL)
179: return NULL;
180: bzero(rs, sizeof *rs);
181:
182: rs->rs_state = RFCOMM_SESSION_CLOSED;
183:
184: timeout_set(&rs->rs_timeout, rfcomm_session_timeout, rs);
185:
186: SIMPLEQ_INIT(&rs->rs_credits);
187: LIST_INIT(&rs->rs_dlcs);
188:
189: err = l2cap_attach(&rs->rs_l2cap, &rfcomm_session_proto, rs);
190: if (err) {
191: free(rs, M_BLUETOOTH);
192: return NULL;
193: }
194:
195: (void)l2cap_getopt(rs->rs_l2cap, SO_L2CAP_OMTU, &rs->rs_mtu);
196:
197: if (laddr->bt_psm == L2CAP_PSM_ANY)
198: laddr->bt_psm = L2CAP_PSM_RFCOMM;
199:
200: (void)l2cap_bind(rs->rs_l2cap, laddr);
201:
202: LIST_INSERT_HEAD(list, rs, rs_next);
203:
204: return rs;
205: }
206:
207: /*
208: * rfcomm_session_free(rfcomm_session)
209: *
210: * release a session, including any cleanup
211: */
212: void
213: rfcomm_session_free(struct rfcomm_session *rs)
214: {
215: struct rfcomm_credit *credit;
216:
217: KASSERT(rs != NULL);
218: KASSERT(LIST_EMPTY(&rs->rs_dlcs));
219:
220: rs->rs_state = RFCOMM_SESSION_CLOSED;
221:
222: /*
223: * If the callout is already invoked we have no way to stop it,
224: * but it will call us back right away (there are no DLC's) so
225: * not to worry.
226: */
227: timeout_del(&rs->rs_timeout);
228: if (timeout_triggered(&rs->rs_timeout))
229: return;
230:
231: /*
232: * Take care that rfcomm_session_disconnected() doesnt call
233: * us back either as it will do if the l2cap_channel has not
234: * been closed when we detach it..
235: */
236: if (rs->rs_flags & RFCOMM_SESSION_FREE)
237: return;
238:
239: rs->rs_flags |= RFCOMM_SESSION_FREE;
240:
241: /* throw away any remaining credit notes */
242: while ((credit = SIMPLEQ_FIRST(&rs->rs_credits)) != NULL) {
243: SIMPLEQ_REMOVE_HEAD(&rs->rs_credits, rc_next);
244: pool_put(&rfcomm_credit_pool, credit);
245: }
246:
247: KASSERT(SIMPLEQ_EMPTY(&rs->rs_credits));
248:
249: /* Goodbye! */
250: LIST_REMOVE(rs, rs_next);
251: l2cap_detach(&rs->rs_l2cap);
252: free(rs, M_BLUETOOTH);
253: }
254:
255: /*
256: * rfcomm_session_lookup(sockaddr, sockaddr)
257: *
258: * Find active rfcomm session matching src and dest addresses
259: * when src is BDADDR_ANY match any local address
260: */
261: struct rfcomm_session *
262: rfcomm_session_lookup(struct sockaddr_bt *src, struct sockaddr_bt *dest)
263: {
264: struct rfcomm_session *rs;
265: struct sockaddr_bt addr;
266:
267: LIST_FOREACH(rs, &rfcomm_session_active, rs_next) {
268: if (rs->rs_state == RFCOMM_SESSION_CLOSED)
269: continue;
270:
271: l2cap_sockaddr(rs->rs_l2cap, &addr);
272:
273: if (bdaddr_same(&src->bt_bdaddr, &addr.bt_bdaddr) == 0)
274: if (bdaddr_any(&src->bt_bdaddr) == 0)
275: continue;
276:
277: l2cap_peeraddr(rs->rs_l2cap, &addr);
278:
279: if (addr.bt_psm != dest->bt_psm)
280: continue;
281:
282: if (bdaddr_same(&dest->bt_bdaddr, &addr.bt_bdaddr))
283: break;
284: }
285:
286: return rs;
287: }
288:
289: /*
290: * rfcomm_session_timeout(rfcomm_session)
291: *
292: * Session timeouts are scheduled when a session is left or
293: * created with no DLCs, and when SABM(0) or DISC(0) are
294: * sent.
295: *
296: * So, if it is in an open state with DLC's attached then
297: * we leave it alone, otherwise the session is lost.
298: */
299: static void
300: rfcomm_session_timeout(void *arg)
301: {
302: struct rfcomm_session *rs = arg;
303: struct rfcomm_dlc *dlc;
304: int s;
305:
306: KASSERT(rs != NULL);
307:
308: s = splsoftnet();
309:
310: if (rs->rs_state != RFCOMM_SESSION_OPEN) {
311: DPRINTF("timeout\n");
312: rs->rs_state = RFCOMM_SESSION_CLOSED;
313:
314: while (!LIST_EMPTY(&rs->rs_dlcs)) {
315: dlc = LIST_FIRST(&rs->rs_dlcs);
316:
317: rfcomm_dlc_close(dlc, ETIMEDOUT);
318: }
319: }
320:
321: if (LIST_EMPTY(&rs->rs_dlcs)) {
322: DPRINTF("expiring\n");
323: rfcomm_session_free(rs);
324: }
325: splx(s);
326: }
327:
328: /***********************************************************************
329: *
330: * RFCOMM Session L2CAP protocol callbacks
331: *
332: */
333:
334: static void
335: rfcomm_session_connecting(void *arg)
336: {
337: /* struct rfcomm_session *rs = arg; */
338:
339: DPRINTF("Connecting\n");
340: }
341:
342: static void
343: rfcomm_session_connected(void *arg)
344: {
345: struct rfcomm_session *rs = arg;
346:
347: DPRINTF("Connected\n");
348:
349: /*
350: * L2CAP is open.
351: *
352: * If we are initiator, we can send our SABM(0)
353: * a timeout should be active?
354: *
355: * We must take note of the L2CAP MTU because currently
356: * the L2CAP implementation can only do Basic Mode.
357: */
358: l2cap_getopt(rs->rs_l2cap, SO_L2CAP_OMTU, &rs->rs_mtu);
359:
360: rs->rs_mtu -= 6; /* (RFCOMM overhead could be this big) */
361: if (rs->rs_mtu < RFCOMM_MTU_MIN) {
362: rfcomm_session_disconnected(rs, EINVAL);
363: return;
364: }
365:
366: if (IS_INITIATOR(rs)) {
367: int err;
368:
369: err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_SABM, 0);
370: if (err)
371: rfcomm_session_disconnected(rs, err);
372:
373: timeout_add(&rs->rs_timeout, rfcomm_ack_timeout * hz);
374: }
375: }
376:
377: static void
378: rfcomm_session_disconnected(void *arg, int err)
379: {
380: struct rfcomm_session *rs = arg;
381: struct rfcomm_dlc *dlc;
382:
383: DPRINTF("Disconnected\n");
384:
385: rs->rs_state = RFCOMM_SESSION_CLOSED;
386:
387: while (!LIST_EMPTY(&rs->rs_dlcs)) {
388: dlc = LIST_FIRST(&rs->rs_dlcs);
389:
390: rfcomm_dlc_close(dlc, err);
391: }
392:
393: rfcomm_session_free(rs);
394: }
395:
396: static void *
397: rfcomm_session_newconn(void *arg, struct sockaddr_bt *laddr,
398: struct sockaddr_bt *raddr)
399: {
400: struct rfcomm_session *new, *rs = arg;
401:
402: DPRINTF("New Connection\n");
403:
404: /*
405: * Incoming session connect request. We should return a new
406: * session pointer if this is acceptable. The L2CAP layer
407: * passes local and remote addresses, which we must check as
408: * only one RFCOMM session is allowed between any two devices
409: */
410: new = rfcomm_session_lookup(laddr, raddr);
411: if (new != NULL)
412: return NULL;
413:
414: new = rfcomm_session_alloc(&rfcomm_session_active, laddr);
415: if (new == NULL)
416: return NULL;
417:
418: new->rs_mtu = rs->rs_mtu;
419: new->rs_state = RFCOMM_SESSION_WAIT_CONNECT;
420:
421: /*
422: * schedule an expiry so that if nothing comes of it we
423: * can punt.
424: */
425: timeout_add(&new->rs_timeout, rfcomm_mcc_timeout * hz);
426:
427: return new->rs_l2cap;
428: }
429:
430: static void
431: rfcomm_session_complete(void *arg, int count)
432: {
433: struct rfcomm_session *rs = arg;
434: struct rfcomm_credit *credit;
435: struct rfcomm_dlc *dlc;
436:
437: /*
438: * count L2CAP packets are 'complete', meaning that they are cleared
439: * our buffers (for best effort) or arrived safe (for guaranteed) so
440: * we can take it off our list and pass the message on, so that
441: * eventually the data can be removed from the sockbuf
442: */
443: while (count-- > 0) {
444: credit = SIMPLEQ_FIRST(&rs->rs_credits);
445: #ifdef DIAGNOSTIC
446: if (credit == NULL) {
447: printf("%s: too many packets completed!\n", __func__);
448: break;
449: }
450: #endif
451: dlc = credit->rc_dlc;
452: if (dlc != NULL) {
453: dlc->rd_pending--;
454: (*dlc->rd_proto->complete)
455: (dlc->rd_upper, credit->rc_len);
456:
457: /*
458: * if not using credit flow control, we may push
459: * more data now
460: */
461: if ((rs->rs_flags & RFCOMM_SESSION_CFC) == 0
462: && dlc->rd_state == RFCOMM_DLC_OPEN) {
463: rfcomm_dlc_start(dlc);
464: }
465:
466: /*
467: * When shutdown is indicated, we are just waiting to
468: * clear outgoing data.
469: */
470: if ((dlc->rd_flags & RFCOMM_DLC_SHUTDOWN)
471: && dlc->rd_txbuf == NULL && dlc->rd_pending == 0) {
472: dlc->rd_state = RFCOMM_DLC_WAIT_DISCONNECT;
473: rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC,
474: dlc->rd_dlci);
475: timeout_add(&dlc->rd_timeout,
476: rfcomm_ack_timeout * hz);
477: }
478: }
479:
480: SIMPLEQ_REMOVE_HEAD(&rs->rs_credits, rc_next);
481: pool_put(&rfcomm_credit_pool, credit);
482: }
483:
484: /*
485: * If session is closed, we are just waiting to clear the queue
486: */
487: if (rs->rs_state == RFCOMM_SESSION_CLOSED) {
488: if (SIMPLEQ_EMPTY(&rs->rs_credits))
489: l2cap_disconnect(rs->rs_l2cap, 0);
490: }
491: }
492:
493: /*
494: * Link Mode changed
495: *
496: * This is called when a mode change is complete. Proceed with connections
497: * where appropriate, or pass the new mode to any active DLCs.
498: */
499: static void
500: rfcomm_session_linkmode(void *arg, int new)
501: {
502: struct rfcomm_session *rs = arg;
503: struct rfcomm_dlc *dlc, *next;
504: int err, mode = 0;
505:
506: DPRINTF("auth %s, encrypt %s, secure %s\n",
507: (new & L2CAP_LM_AUTH ? "on" : "off"),
508: (new & L2CAP_LM_ENCRYPT ? "on" : "off"),
509: (new & L2CAP_LM_SECURE ? "on" : "off"));
510:
511: if (new & L2CAP_LM_AUTH)
512: mode |= RFCOMM_LM_AUTH;
513:
514: if (new & L2CAP_LM_ENCRYPT)
515: mode |= RFCOMM_LM_ENCRYPT;
516:
517: if (new & L2CAP_LM_SECURE)
518: mode |= RFCOMM_LM_SECURE;
519:
520: next = LIST_FIRST(&rs->rs_dlcs);
521: while ((dlc = next) != NULL) {
522: next = LIST_NEXT(dlc, rd_next);
523:
524: switch (dlc->rd_state) {
525: case RFCOMM_DLC_WAIT_SEND_SABM: /* we are connecting */
526: if ((mode & dlc->rd_mode) != dlc->rd_mode) {
527: rfcomm_dlc_close(dlc, ECONNABORTED);
528: } else {
529: err = rfcomm_session_send_frame(rs,
530: RFCOMM_FRAME_SABM, dlc->rd_dlci);
531: if (err) {
532: rfcomm_dlc_close(dlc, err);
533: } else {
534: dlc->rd_state = RFCOMM_DLC_WAIT_RECV_UA;
535: timeout_add(&dlc->rd_timeout,
536: rfcomm_ack_timeout * hz);
537: break;
538: }
539: }
540:
541: /*
542: * If we aborted the connection and there are no more DLCs
543: * on the session, it is our responsibility to disconnect.
544: */
545: if (!LIST_EMPTY(&rs->rs_dlcs))
546: break;
547:
548: rs->rs_state = RFCOMM_SESSION_WAIT_DISCONNECT;
549: rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC, 0);
550: timeout_add(&rs->rs_timeout, rfcomm_ack_timeout * hz);
551: break;
552:
553: case RFCOMM_DLC_WAIT_SEND_UA: /* they are connecting */
554: if ((mode & dlc->rd_mode) != dlc->rd_mode) {
555: rfcomm_session_send_frame(rs,
556: RFCOMM_FRAME_DM, dlc->rd_dlci);
557: rfcomm_dlc_close(dlc, ECONNABORTED);
558: break;
559: }
560:
561: err = rfcomm_session_send_frame(rs,
562: RFCOMM_FRAME_UA, dlc->rd_dlci);
563: if (err) {
564: rfcomm_session_send_frame(rs,
565: RFCOMM_FRAME_DM, dlc->rd_dlci);
566: rfcomm_dlc_close(dlc, err);
567: break;
568: }
569:
570: err = rfcomm_dlc_open(dlc);
571: if (err) {
572: rfcomm_session_send_frame(rs,
573: RFCOMM_FRAME_DM, dlc->rd_dlci);
574: rfcomm_dlc_close(dlc, err);
575: break;
576: }
577:
578: break;
579:
580: case RFCOMM_DLC_WAIT_RECV_UA:
581: case RFCOMM_DLC_OPEN: /* already established */
582: (*dlc->rd_proto->linkmode)(dlc->rd_upper, mode);
583: break;
584:
585: default:
586: break;
587: }
588: }
589: }
590:
591: /*
592: * Receive data from L2CAP layer for session. There is always exactly one
593: * RFCOMM frame contained in each L2CAP frame.
594: */
595: static void
596: rfcomm_session_input(void *arg, struct mbuf *m)
597: {
598: struct rfcomm_session *rs = arg;
599: int dlci, len, type, pf;
600: uint8_t fcs, b;
601:
602: KASSERT(m != NULL);
603: KASSERT(rs != NULL);
604:
605: /*
606: * UIH frames: FCS is only calculated on address and control fields
607: * For other frames: FCS is calculated on address, control and length
608: * Length may extend to two octets
609: */
610: fcs = 0xff;
611:
612: if (m->m_pkthdr.len < 4) {
613: DPRINTF("short frame (%d), discarded\n", m->m_pkthdr.len);
614: goto done;
615: }
616:
617: /* address - one octet */
618: m_copydata(m, 0, 1, &b);
619: m_adj(m, 1);
620: fcs = FCS(fcs, b);
621: dlci = RFCOMM_DLCI(b);
622:
623: /* control - one octet */
624: m_copydata(m, 0, 1, &b);
625: m_adj(m, 1);
626: fcs = FCS(fcs, b);
627: type = RFCOMM_TYPE(b);
628: pf = RFCOMM_PF(b);
629:
630: /* length - may be two octets */
631: m_copydata(m, 0, 1, &b);
632: m_adj(m, 1);
633: if (type != RFCOMM_FRAME_UIH)
634: fcs = FCS(fcs, b);
635: len = (b >> 1) & 0x7f;
636:
637: if (RFCOMM_EA(b) == 0) {
638: if (m->m_pkthdr.len < 2) {
639: DPRINTF("short frame (%d, EA = 0), discarded\n",
640: m->m_pkthdr.len);
641: goto done;
642: }
643:
644: m_copydata(m, 0, 1, &b);
645: m_adj(m, 1);
646: if (type != RFCOMM_FRAME_UIH)
647: fcs = FCS(fcs, b);
648:
649: len |= (b << 7);
650: }
651:
652: /* FCS byte is last octet in frame */
653: m_copydata(m, m->m_pkthdr.len - 1, 1, &b);
654: m_adj(m, -1);
655: fcs = FCS(fcs, b);
656:
657: if (fcs != 0xcf) {
658: DPRINTF("Bad FCS value (%#2.2x), frame discarded\n", fcs);
659: goto done;
660: }
661:
662: DPRINTFN(10, "dlci %d, type %2.2x, len = %d\n", dlci, type, len);
663:
664: switch (type) {
665: case RFCOMM_FRAME_SABM:
666: if (pf)
667: rfcomm_session_recv_sabm(rs, dlci);
668: break;
669:
670: case RFCOMM_FRAME_DISC:
671: if (pf)
672: rfcomm_session_recv_disc(rs, dlci);
673: break;
674:
675: case RFCOMM_FRAME_UA:
676: if (pf)
677: rfcomm_session_recv_ua(rs, dlci);
678: break;
679:
680: case RFCOMM_FRAME_DM:
681: rfcomm_session_recv_dm(rs, dlci);
682: break;
683:
684: case RFCOMM_FRAME_UIH:
685: rfcomm_session_recv_uih(rs, dlci, pf, m, len);
686: return; /* (no release) */
687:
688: default:
689: UNKNOWN(type);
690: break;
691: }
692:
693: done:
694: m_freem(m);
695: }
696:
697: /***********************************************************************
698: *
699: * RFCOMM Session receive processing
700: */
701:
702: /*
703: * rfcomm_session_recv_sabm(rfcomm_session, dlci)
704: *
705: * Set Asyncrhonous Balanced Mode - open the channel.
706: */
707: static void
708: rfcomm_session_recv_sabm(struct rfcomm_session *rs, int dlci)
709: {
710: struct rfcomm_dlc *dlc;
711: int err;
712:
713: DPRINTFN(5, "SABM(%d)\n", dlci);
714:
715: if (dlci == 0) { /* Open Session */
716: rs->rs_state = RFCOMM_SESSION_OPEN;
717: rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, 0);
718: LIST_FOREACH(dlc, &rs->rs_dlcs, rd_next) {
719: if (dlc->rd_state == RFCOMM_DLC_WAIT_SESSION)
720: rfcomm_dlc_connect(dlc);
721: }
722: return;
723: }
724:
725: if (rs->rs_state != RFCOMM_SESSION_OPEN) {
726: DPRINTF("session was not even open!\n");
727: return;
728: }
729:
730: /* validate direction bit */
731: if ((IS_INITIATOR(rs) && !RFCOMM_DIRECTION(dlci))
732: || (!IS_INITIATOR(rs) && RFCOMM_DIRECTION(dlci))) {
733: DPRINTF("Invalid direction bit on DLCI\n");
734: return;
735: }
736:
737: /*
738: * look for our DLC - this may exist if we received PN
739: * already, or we may have to fabricate a new one.
740: */
741: dlc = rfcomm_dlc_lookup(rs, dlci);
742: if (dlc == NULL) {
743: dlc = rfcomm_dlc_newconn(rs, dlci);
744: if (dlc == NULL)
745: return; /* (DM is sent) */
746: }
747:
748: /*
749: * ..but if this DLC is not waiting to connect, they did
750: * something wrong, ignore it.
751: */
752: if (dlc->rd_state != RFCOMM_DLC_WAIT_CONNECT)
753: return;
754:
755: /* set link mode */
756: err = rfcomm_dlc_setmode(dlc);
757: if (err == EINPROGRESS) {
758: dlc->rd_state = RFCOMM_DLC_WAIT_SEND_UA;
759: (*dlc->rd_proto->connecting)(dlc->rd_upper);
760: return;
761: }
762: if (err)
763: goto close;
764:
765: err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, dlci);
766: if (err)
767: goto close;
768:
769: /* and mark it open */
770: err = rfcomm_dlc_open(dlc);
771: if (err)
772: goto close;
773:
774: return;
775:
776: close:
777: rfcomm_dlc_close(dlc, err);
778: }
779:
780: /*
781: * Receive Disconnect Command
782: */
783: static void
784: rfcomm_session_recv_disc(struct rfcomm_session *rs, int dlci)
785: {
786: struct rfcomm_dlc *dlc;
787:
788: DPRINTFN(5, "DISC(%d)\n", dlci);
789:
790: if (dlci == 0) {
791: /*
792: * Disconnect Session
793: *
794: * We set the session state to CLOSED so that when
795: * the UA frame is clear the session will be closed
796: * automatically. We wont bother to close any DLC's
797: * just yet as there should be none. In the unlikely
798: * event that something is left, it will get flushed
799: * out as the session goes down.
800: */
801: rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, 0);
802: rs->rs_state = RFCOMM_SESSION_CLOSED;
803: return;
804: }
805:
806: dlc = rfcomm_dlc_lookup(rs, dlci);
807: if (dlc == NULL) {
808: rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM, dlci);
809: return;
810: }
811:
812: rfcomm_dlc_close(dlc, ECONNRESET);
813: rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, dlci);
814: }
815:
816: /*
817: * Receive Unnumbered Acknowledgement Response
818: *
819: * This should be a response to a DISC or SABM frame that we
820: * have previously sent. If unexpected, ignore it.
821: */
822: static void
823: rfcomm_session_recv_ua(struct rfcomm_session *rs, int dlci)
824: {
825: struct rfcomm_dlc *dlc;
826:
827: DPRINTFN(5, "UA(%d)\n", dlci);
828:
829: if (dlci == 0) {
830: switch (rs->rs_state) {
831: case RFCOMM_SESSION_WAIT_CONNECT: /* We sent SABM */
832: timeout_del(&rs->rs_timeout);
833: rs->rs_state = RFCOMM_SESSION_OPEN;
834: LIST_FOREACH(dlc, &rs->rs_dlcs, rd_next) {
835: if (dlc->rd_state == RFCOMM_DLC_WAIT_SESSION)
836: rfcomm_dlc_connect(dlc);
837: }
838: break;
839:
840: case RFCOMM_SESSION_WAIT_DISCONNECT: /* We sent DISC */
841: timeout_del(&rs->rs_timeout);
842: rs->rs_state = RFCOMM_SESSION_CLOSED;
843: l2cap_disconnect(rs->rs_l2cap, 0);
844: break;
845:
846: default:
847: DPRINTF("Received spurious UA(0)!\n");
848: break;
849: }
850:
851: return;
852: }
853:
854: /*
855: * If we have no DLC on this dlci, we may have aborted
856: * without shutting down properly, so check if the session
857: * needs disconnecting.
858: */
859: dlc = rfcomm_dlc_lookup(rs, dlci);
860: if (dlc == NULL)
861: goto check;
862:
863: switch (dlc->rd_state) {
864: case RFCOMM_DLC_WAIT_RECV_UA: /* We sent SABM */
865: rfcomm_dlc_open(dlc);
866: return;
867:
868: case RFCOMM_DLC_WAIT_DISCONNECT: /* We sent DISC */
869: rfcomm_dlc_close(dlc, 0);
870: break;
871:
872: default:
873: DPRINTF("Received spurious UA(%d)!\n", dlci);
874: return;
875: }
876:
877: check: /* last one out turns out the light */
878: if (LIST_EMPTY(&rs->rs_dlcs)) {
879: rs->rs_state = RFCOMM_SESSION_WAIT_DISCONNECT;
880: rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC, 0);
881: timeout_add(&rs->rs_timeout, rfcomm_ack_timeout * hz);
882: }
883: }
884:
885: /*
886: * Receive Disconnected Mode Response
887: *
888: * If this does not apply to a known DLC then we may ignore it.
889: */
890: static void
891: rfcomm_session_recv_dm(struct rfcomm_session *rs, int dlci)
892: {
893: struct rfcomm_dlc *dlc;
894:
895: DPRINTFN(5, "DM(%d)\n", dlci);
896:
897: dlc = rfcomm_dlc_lookup(rs, dlci);
898: if (dlc == NULL)
899: return;
900:
901: if (dlc->rd_state == RFCOMM_DLC_WAIT_CONNECT)
902: rfcomm_dlc_close(dlc, ECONNREFUSED);
903: else
904: rfcomm_dlc_close(dlc, ECONNRESET);
905: }
906:
907: /*
908: * Receive Unnumbered Information with Header check (MCC or data packet)
909: */
910: static void
911: rfcomm_session_recv_uih(struct rfcomm_session *rs, int dlci,
912: int pf, struct mbuf *m, int len)
913: {
914: struct rfcomm_dlc *dlc;
915: uint8_t credits = 0;
916:
917: DPRINTFN(10, "UIH(%d)\n", dlci);
918:
919: if (dlci == 0) {
920: rfcomm_session_recv_mcc(rs, m);
921: return;
922: }
923:
924: if (m->m_pkthdr.len != len + pf) {
925: DPRINTF("Bad Frame Length (%d), frame discarded\n",
926: m->m_pkthdr.len);
927:
928: goto discard;
929: }
930:
931: dlc = rfcomm_dlc_lookup(rs, dlci);
932: if (dlc == NULL) {
933: DPRINTF("UIH received for non existent DLC, discarded\n");
934: rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM, dlci);
935: goto discard;
936: }
937:
938: if (dlc->rd_state != RFCOMM_DLC_OPEN) {
939: DPRINTF("non-open DLC (state = %d), discarded\n",
940: dlc->rd_state);
941: goto discard;
942: }
943:
944: /* if PF is set, credits were included */
945: if (rs->rs_flags & RFCOMM_SESSION_CFC) {
946: if (pf != 0) {
947: if (m->m_pkthdr.len < sizeof(credits)) {
948: DPRINTF("Bad PF value, UIH discarded\n");
949: goto discard;
950: }
951:
952: m_copydata(m, 0, sizeof(credits), &credits);
953: m_adj(m, sizeof(credits));
954:
955: dlc->rd_txcred += credits;
956:
957: if (credits > 0 && dlc->rd_txbuf != NULL)
958: rfcomm_dlc_start(dlc);
959: }
960:
961: if (len == 0)
962: goto discard;
963:
964: if (dlc->rd_rxcred == 0) {
965: DPRINTF("Credit limit reached, UIH discarded\n");
966: goto discard;
967: }
968:
969: if (len > dlc->rd_rxsize) {
970: DPRINTF("UIH frame exceeds rxsize, discarded\n");
971: goto discard;
972: }
973:
974: dlc->rd_rxcred--;
975: dlc->rd_rxsize -= len;
976: }
977:
978: (*dlc->rd_proto->input)(dlc->rd_upper, m);
979: return;
980:
981: discard:
982: m_freem(m);
983: }
984:
985: /*
986: * Receive Multiplexer Control Command
987: */
988: static void
989: rfcomm_session_recv_mcc(struct rfcomm_session *rs, struct mbuf *m)
990: {
991: int type, cr, len;
992: uint8_t b;
993:
994: /*
995: * Extract MCC header.
996: *
997: * Fields are variable length using extension bit = 1 to signify the
998: * last octet in the sequence.
999: *
1000: * Only single octet types are defined in TS 07.10/RFCOMM spec
1001: *
1002: * Length can realistically only use 15 bits (max RFCOMM MTU)
1003: */
1004: if (m->m_pkthdr.len < sizeof(b)) {
1005: DPRINTF("Short MCC header, discarded\n");
1006: goto release;
1007: }
1008:
1009: m_copydata(m, 0, sizeof(b), &b);
1010: m_adj(m, sizeof(b));
1011:
1012: if (RFCOMM_EA(b) == 0) { /* verify no extensions */
1013: DPRINTF("MCC type EA = 0, discarded\n");
1014: goto release;
1015: }
1016:
1017: type = RFCOMM_MCC_TYPE(b);
1018: cr = RFCOMM_CR(b);
1019:
1020: len = 0;
1021: do {
1022: if (m->m_pkthdr.len < sizeof(b)) {
1023: DPRINTF("Short MCC header, discarded\n");
1024: goto release;
1025: }
1026:
1027: m_copydata(m, 0, sizeof(b), &b);
1028: m_adj(m, sizeof(b));
1029:
1030: len = (len << 7) | (b >> 1);
1031: len = min(len, RFCOMM_MTU_MAX);
1032: } while (RFCOMM_EA(b) == 0);
1033:
1034: if (len != m->m_pkthdr.len) {
1035: DPRINTF("Incorrect MCC length, discarded\n");
1036: goto release;
1037: }
1038:
1039: DPRINTFN(2, "MCC %s type %2.2x (%d bytes)\n",
1040: (cr ? "command" : "response"), type, len);
1041:
1042: /*
1043: * pass to command handler
1044: */
1045: switch(type) {
1046: case RFCOMM_MCC_TEST: /* Test */
1047: rfcomm_session_recv_mcc_test(rs, cr, m);
1048: break;
1049:
1050: case RFCOMM_MCC_FCON: /* Flow Control On */
1051: rfcomm_session_recv_mcc_fcon(rs, cr);
1052: break;
1053:
1054: case RFCOMM_MCC_FCOFF: /* Flow Control Off */
1055: rfcomm_session_recv_mcc_fcoff(rs, cr);
1056: break;
1057:
1058: case RFCOMM_MCC_MSC: /* Modem Status Command */
1059: rfcomm_session_recv_mcc_msc(rs, cr, m);
1060: break;
1061:
1062: case RFCOMM_MCC_RPN: /* Remote Port Negotiation */
1063: rfcomm_session_recv_mcc_rpn(rs, cr, m);
1064: break;
1065:
1066: case RFCOMM_MCC_RLS: /* Remote Line Status */
1067: rfcomm_session_recv_mcc_rls(rs, cr, m);
1068: break;
1069:
1070: case RFCOMM_MCC_PN: /* Parameter Negotiation */
1071: rfcomm_session_recv_mcc_pn(rs, cr, m);
1072: break;
1073:
1074: case RFCOMM_MCC_NSC: /* Non Supported Command */
1075: rfcomm_session_recv_mcc_nsc(rs, cr, m);
1076: break;
1077:
1078: default:
1079: b = RFCOMM_MKMCC_TYPE(cr, type);
1080: rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_NSC, &b, sizeof(b));
1081: }
1082:
1083: release:
1084: m_freem(m);
1085: }
1086:
1087: /*
1088: * process TEST command/response
1089: */
1090: static void
1091: rfcomm_session_recv_mcc_test(struct rfcomm_session *rs, int cr, struct mbuf *m)
1092: {
1093: void *data;
1094: int len;
1095:
1096: if (cr == 0) /* ignore ack */
1097: return;
1098:
1099: /*
1100: * we must send all the data they included back as is
1101: */
1102:
1103: len = m->m_pkthdr.len;
1104: if (len > RFCOMM_MTU_MAX)
1105: return;
1106:
1107: data = malloc(len, M_BLUETOOTH, M_NOWAIT);
1108: if (data == NULL)
1109: return;
1110:
1111: m_copydata(m, 0, len, data);
1112: rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_TEST, data, len);
1113: free(data, M_BLUETOOTH);
1114: }
1115:
1116: /*
1117: * process Flow Control ON command/response
1118: */
1119: static void
1120: rfcomm_session_recv_mcc_fcon(struct rfcomm_session *rs, int cr)
1121: {
1122:
1123: if (cr == 0) /* ignore ack */
1124: return;
1125:
1126: rs->rs_flags |= RFCOMM_SESSION_RFC;
1127: rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_FCON, NULL, 0);
1128: }
1129:
1130: /*
1131: * process Flow Control OFF command/response
1132: */
1133: static void
1134: rfcomm_session_recv_mcc_fcoff(struct rfcomm_session *rs, int cr)
1135: {
1136:
1137: if (cr == 0) /* ignore ack */
1138: return;
1139:
1140: rs->rs_flags &= ~RFCOMM_SESSION_RFC;
1141: rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_FCOFF, NULL, 0);
1142: }
1143:
1144: /*
1145: * process Modem Status Command command/response
1146: */
1147: static void
1148: rfcomm_session_recv_mcc_msc(struct rfcomm_session *rs, int cr, struct mbuf *m)
1149: {
1150: struct rfcomm_mcc_msc msc; /* (3 octets) */
1151: struct rfcomm_dlc *dlc;
1152: int len = 0;
1153:
1154: /* [ADDRESS] */
1155: if (m->m_pkthdr.len < sizeof(msc.address))
1156: return;
1157:
1158: m_copydata(m, 0, sizeof(msc.address), &msc.address);
1159: m_adj(m, sizeof(msc.address));
1160: len += sizeof(msc.address);
1161:
1162: dlc = rfcomm_dlc_lookup(rs, RFCOMM_DLCI(msc.address));
1163:
1164: if (cr == 0) { /* ignore acks */
1165: if (dlc != NULL)
1166: timeout_del(&dlc->rd_timeout);
1167:
1168: return;
1169: }
1170:
1171: if (dlc == NULL) {
1172: rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM,
1173: RFCOMM_DLCI(msc.address));
1174: return;
1175: }
1176:
1177: /* [SIGNALS] */
1178: if (m->m_pkthdr.len < sizeof(msc.modem))
1179: return;
1180:
1181: m_copydata(m, 0, sizeof(msc.modem), &msc.modem);
1182: m_adj(m, sizeof(msc.modem));
1183: len += sizeof(msc.modem);
1184:
1185: dlc->rd_rmodem = msc.modem;
1186: /* XXX how do we signal this upstream? */
1187:
1188: if (RFCOMM_EA(msc.modem) == 0) {
1189: if (m->m_pkthdr.len < sizeof(msc.brk))
1190: return;
1191:
1192: m_copydata(m, 0, sizeof(msc.brk), &msc.brk);
1193: m_adj(m, sizeof(msc.brk));
1194: len += sizeof(msc.brk);
1195:
1196: /* XXX how do we signal this upstream? */
1197: }
1198:
1199: rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_MSC, &msc, len);
1200: }
1201:
1202: /*
1203: * process Remote Port Negotiation command/response
1204: */
1205: static void
1206: rfcomm_session_recv_mcc_rpn(struct rfcomm_session *rs, int cr, struct mbuf *m)
1207: {
1208: struct rfcomm_mcc_rpn rpn;
1209: uint16_t mask;
1210:
1211: if (cr == 0) /* ignore ack */
1212: return;
1213:
1214: /* default values */
1215: rpn.bit_rate = RFCOMM_RPN_BR_9600;
1216: rpn.line_settings = RFCOMM_RPN_8_N_1;
1217: rpn.flow_control = RFCOMM_RPN_FLOW_NONE;
1218: rpn.xon_char = RFCOMM_RPN_XON_CHAR;
1219: rpn.xoff_char = RFCOMM_RPN_XOFF_CHAR;
1220:
1221: if (m->m_pkthdr.len == sizeof(rpn)) {
1222: m_copydata(m, 0, sizeof(rpn), (caddr_t)&rpn);
1223: rpn.param_mask = RFCOMM_RPN_PM_ALL;
1224: } else if (m->m_pkthdr.len == 1) {
1225: m_copydata(m, 0, 1, (caddr_t)&rpn);
1226: rpn.param_mask = letoh16(rpn.param_mask);
1227: } else {
1228: DPRINTF("Bad RPN length (%d)\n", m->m_pkthdr.len);
1229: return;
1230: }
1231:
1232: mask = 0;
1233:
1234: if (rpn.param_mask & RFCOMM_RPN_PM_RATE)
1235: mask |= RFCOMM_RPN_PM_RATE;
1236:
1237: if (rpn.param_mask & RFCOMM_RPN_PM_DATA
1238: && RFCOMM_RPN_DATA_BITS(rpn.line_settings) == RFCOMM_RPN_DATA_8)
1239: mask |= RFCOMM_RPN_PM_DATA;
1240:
1241: if (rpn.param_mask & RFCOMM_RPN_PM_STOP
1242: && RFCOMM_RPN_STOP_BITS(rpn.line_settings) == RFCOMM_RPN_STOP_1)
1243: mask |= RFCOMM_RPN_PM_STOP;
1244:
1245: if (rpn.param_mask & RFCOMM_RPN_PM_PARITY
1246: && RFCOMM_RPN_PARITY(rpn.line_settings) == RFCOMM_RPN_PARITY_NONE)
1247: mask |= RFCOMM_RPN_PM_PARITY;
1248:
1249: if (rpn.param_mask & RFCOMM_RPN_PM_XON
1250: && rpn.xon_char == RFCOMM_RPN_XON_CHAR)
1251: mask |= RFCOMM_RPN_PM_XON;
1252:
1253: if (rpn.param_mask & RFCOMM_RPN_PM_XOFF
1254: && rpn.xoff_char == RFCOMM_RPN_XOFF_CHAR)
1255: mask |= RFCOMM_RPN_PM_XOFF;
1256:
1257: if (rpn.param_mask & RFCOMM_RPN_PM_FLOW
1258: && rpn.flow_control == RFCOMM_RPN_FLOW_NONE)
1259: mask |= RFCOMM_RPN_PM_FLOW;
1260:
1261: rpn.param_mask = htole16(mask);
1262:
1263: rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_RPN, &rpn, sizeof(rpn));
1264: }
1265:
1266: /*
1267: * process Remote Line Status command/response
1268: */
1269: static void
1270: rfcomm_session_recv_mcc_rls(struct rfcomm_session *rs, int cr, struct mbuf *m)
1271: {
1272: struct rfcomm_mcc_rls rls;
1273:
1274: if (cr == 0) /* ignore ack */
1275: return;
1276:
1277: if (m->m_pkthdr.len != sizeof(rls)) {
1278: DPRINTF("Bad RLS length %d\n", m->m_pkthdr.len);
1279: return;
1280: }
1281:
1282: m_copydata(m, 0, sizeof(rls), (caddr_t)&rls);
1283:
1284: /*
1285: * So far as I can tell, we just send back what
1286: * they sent us. This signifies errors that seem
1287: * irrelevent for RFCOMM over L2CAP.
1288: */
1289: rls.address |= 0x03; /* EA = 1, CR = 1 */
1290: rls.status &= 0x0f; /* only 4 bits valid */
1291:
1292: rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_RLS, &rls, sizeof(rls));
1293: }
1294:
1295: /*
1296: * process Parameter Negotiation command/response
1297: */
1298: static void
1299: rfcomm_session_recv_mcc_pn(struct rfcomm_session *rs, int cr, struct mbuf *m)
1300: {
1301: struct rfcomm_dlc *dlc;
1302: struct rfcomm_mcc_pn pn;
1303: int err;
1304:
1305: if (m->m_pkthdr.len != sizeof(pn)) {
1306: DPRINTF("Bad PN length %d\n", m->m_pkthdr.len);
1307: return;
1308: }
1309:
1310: m_copydata(m, 0, sizeof(pn), (caddr_t)&pn);
1311:
1312: pn.dlci &= 0x3f;
1313: pn.mtu = letoh16(pn.mtu);
1314:
1315: dlc = rfcomm_dlc_lookup(rs, pn.dlci);
1316: if (cr) { /* Command */
1317: /*
1318: * If there is no DLC present, this is a new
1319: * connection so attempt to make one
1320: */
1321: if (dlc == NULL) {
1322: dlc = rfcomm_dlc_newconn(rs, pn.dlci);
1323: if (dlc == NULL)
1324: return; /* (DM is sent) */
1325: }
1326:
1327: /* accept any valid MTU, and offer it back */
1328: pn.mtu = min(pn.mtu, RFCOMM_MTU_MAX);
1329: pn.mtu = min(pn.mtu, rs->rs_mtu);
1330: pn.mtu = max(pn.mtu, RFCOMM_MTU_MIN);
1331: dlc->rd_mtu = pn.mtu;
1332: pn.mtu = htole16(pn.mtu);
1333:
1334: /* credits are only set before DLC is open */
1335: if (dlc->rd_state == RFCOMM_DLC_WAIT_CONNECT
1336: && (pn.flow_control & 0xf0) == 0xf0) {
1337: rs->rs_flags |= RFCOMM_SESSION_CFC;
1338: dlc->rd_txcred = pn.credits & 0x07;
1339:
1340: dlc->rd_rxcred = (dlc->rd_rxsize / dlc->rd_mtu);
1341: dlc->rd_rxcred = min(dlc->rd_rxcred,
1342: RFCOMM_CREDITS_DEFAULT);
1343:
1344: pn.flow_control = 0xe0;
1345: pn.credits = dlc->rd_rxcred;
1346: } else {
1347: pn.flow_control = 0x00;
1348: pn.credits = 0x00;
1349: }
1350:
1351: /* unused fields must be ignored and set to zero */
1352: pn.ack_timer = 0;
1353: pn.max_retrans = 0;
1354:
1355: /* send our response */
1356: err = rfcomm_session_send_mcc(rs, 0,
1357: RFCOMM_MCC_PN, &pn, sizeof(pn));
1358: if (err)
1359: goto close;
1360:
1361: } else { /* Response */
1362: /* ignore responses with no matching DLC */
1363: if (dlc == NULL)
1364: return;
1365:
1366: timeout_del(&dlc->rd_timeout);
1367:
1368: if (pn.mtu > RFCOMM_MTU_MAX || pn.mtu > dlc->rd_mtu) {
1369: dlc->rd_state = RFCOMM_DLC_WAIT_DISCONNECT;
1370: err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC,
1371: pn.dlci);
1372: if (err)
1373: goto close;
1374:
1375: timeout_add(&dlc->rd_timeout,
1376: rfcomm_ack_timeout * hz);
1377: return;
1378: }
1379: dlc->rd_mtu = pn.mtu;
1380:
1381: /* if DLC is not waiting to connect, we are done */
1382: if (dlc->rd_state != RFCOMM_DLC_WAIT_CONNECT)
1383: return;
1384:
1385: /* set initial credits according to RFCOMM spec */
1386: if ((pn.flow_control & 0xf0) == 0xe0) {
1387: rs->rs_flags |= RFCOMM_SESSION_CFC;
1388: dlc->rd_txcred = (pn.credits & 0x07);
1389: }
1390:
1391: timeout_add(&dlc->rd_timeout, rfcomm_ack_timeout * hz);
1392:
1393: /* set link mode */
1394: err = rfcomm_dlc_setmode(dlc);
1395: if (err == EINPROGRESS) {
1396: dlc->rd_state = RFCOMM_DLC_WAIT_SEND_SABM;
1397: (*dlc->rd_proto->connecting)(dlc->rd_upper);
1398: return;
1399: }
1400: if (err)
1401: goto close;
1402:
1403: /* we can proceed now */
1404: err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_SABM, pn.dlci);
1405: if (err)
1406: goto close;
1407:
1408: dlc->rd_state = RFCOMM_DLC_WAIT_RECV_UA;
1409: }
1410: return;
1411:
1412: close:
1413: rfcomm_dlc_close(dlc, err);
1414: }
1415:
1416: /*
1417: * process Non Supported Command command/response
1418: */
1419: static void
1420: rfcomm_session_recv_mcc_nsc(struct rfcomm_session *rs,
1421: int cr, struct mbuf *m)
1422: {
1423: struct rfcomm_dlc *dlc, *next;
1424:
1425: /*
1426: * Since we did nothing that is not mandatory,
1427: * we just abort the whole session..
1428: */
1429:
1430: next = LIST_FIRST(&rs->rs_dlcs);
1431: while ((dlc = next) != NULL) {
1432: next = LIST_NEXT(dlc, rd_next);
1433: rfcomm_dlc_close(dlc, ECONNABORTED);
1434: }
1435:
1436: rfcomm_session_free(rs);
1437: }
1438:
1439: /***********************************************************************
1440: *
1441: * RFCOMM Session outward frame/uih/mcc building
1442: */
1443:
1444: /*
1445: * SABM/DISC/DM/UA frames are all minimal and mostly identical.
1446: */
1447: int
1448: rfcomm_session_send_frame(struct rfcomm_session *rs, int type, int dlci)
1449: {
1450: struct rfcomm_cmd_hdr *hdr;
1451: struct rfcomm_credit *credit;
1452: struct mbuf *m;
1453: uint8_t fcs, cr;
1454:
1455: credit = pool_get(&rfcomm_credit_pool, PR_NOWAIT);
1456: if (credit == NULL)
1457: return ENOMEM;
1458:
1459: m = m_gethdr(M_DONTWAIT, MT_DATA);
1460: if (m == NULL) {
1461: pool_put(&rfcomm_credit_pool, credit);
1462: return ENOMEM;
1463: }
1464:
1465: /*
1466: * The CR (command/response) bit identifies the frame either as a
1467: * commmand or a response and is used along with the DLCI to form
1468: * the address. Commands contain the non-initiator address, whereas
1469: * responses contain the initiator address, so the CR value is
1470: * also dependent on the session direction.
1471: */
1472: if (type == RFCOMM_FRAME_UA || type == RFCOMM_FRAME_DM)
1473: cr = IS_INITIATOR(rs) ? 0 : 1;
1474: else
1475: cr = IS_INITIATOR(rs) ? 1 : 0;
1476:
1477: hdr = mtod(m, struct rfcomm_cmd_hdr *);
1478: hdr->address = RFCOMM_MKADDRESS(cr, dlci);
1479: hdr->control = RFCOMM_MKCONTROL(type, 1); /* PF = 1 */
1480: hdr->length = (0x00 << 1) | 0x01; /* len = 0x00, EA = 1 */
1481:
1482: fcs = 0xff;
1483: fcs = FCS(fcs, hdr->address);
1484: fcs = FCS(fcs, hdr->control);
1485: fcs = FCS(fcs, hdr->length);
1486: fcs = 0xff - fcs; /* ones complement */
1487: hdr->fcs = fcs;
1488:
1489: m->m_pkthdr.len = m->m_len = sizeof(struct rfcomm_cmd_hdr);
1490:
1491: /* empty credit note */
1492: credit->rc_dlc = NULL;
1493: credit->rc_len = m->m_pkthdr.len;
1494: SIMPLEQ_INSERT_TAIL(&rs->rs_credits, credit, rc_next);
1495:
1496: DPRINTFN(5, "dlci %d type %2.2x (%d bytes, fcs=%#2.2x)\n",
1497: dlci, type, m->m_pkthdr.len, fcs);
1498:
1499: return l2cap_send(rs->rs_l2cap, m);
1500: }
1501:
1502: /*
1503: * rfcomm_session_send_uih(rfcomm_session, rfcomm_dlc, credits, mbuf)
1504: *
1505: * UIH frame is per DLC data or Multiplexer Control Commands
1506: * when no DLC is given. Data mbuf is optional (just credits
1507: * will be sent in that case)
1508: */
1509: int
1510: rfcomm_session_send_uih(struct rfcomm_session *rs, struct rfcomm_dlc *dlc,
1511: int credits, struct mbuf *m)
1512: {
1513: struct rfcomm_credit *credit;
1514: struct mbuf *m0 = NULL;
1515: int err, len;
1516: uint8_t fcs, *hdr;
1517:
1518: KASSERT(rs != NULL);
1519:
1520: len = (m == NULL) ? 0 : m->m_pkthdr.len;
1521: KASSERT(!(credits == 0 && len == 0));
1522:
1523: /*
1524: * Make a credit note for the completion notification
1525: */
1526: credit = pool_get(&rfcomm_credit_pool, PR_NOWAIT);
1527: if (credit == NULL)
1528: goto nomem;
1529:
1530: credit->rc_len = len;
1531: credit->rc_dlc = dlc;
1532:
1533: /*
1534: * Wrap UIH frame information around payload.
1535: *
1536: * [ADDRESS] [CONTROL] [LENGTH] [CREDITS] [...] [FCS]
1537: *
1538: * Address is one octet.
1539: * Control is one octet.
1540: * Length is one or two octets.
1541: * Credits may be one octet.
1542: *
1543: * FCS is one octet and calculated on address and
1544: * control octets only.
1545: *
1546: * If there are credits to be sent, we will set the PF
1547: * flag and include them in the frame.
1548: */
1549: m0 = m_gethdr(M_DONTWAIT, MT_DATA);
1550: if (m0 == NULL)
1551: goto nomem;
1552:
1553: MH_ALIGN(m0, 5); /* (max 5 header octets) */
1554: hdr = mtod(m0, uint8_t *);
1555:
1556: /* CR bit is set according to the initiator of the session */
1557: *hdr = RFCOMM_MKADDRESS((IS_INITIATOR(rs) ? 1 : 0),
1558: (dlc ? dlc->rd_dlci : 0));
1559: fcs = FCS(0xff, *hdr);
1560: hdr++;
1561:
1562: /* PF bit is set if credits are being sent */
1563: *hdr = RFCOMM_MKCONTROL(RFCOMM_FRAME_UIH, (credits > 0 ? 1 : 0));
1564: fcs = FCS(fcs, *hdr);
1565: hdr++;
1566:
1567: if (len < (1 << 7)) {
1568: *hdr++ = ((len << 1) & 0xfe) | 0x01; /* 7 bits, EA = 1 */
1569: } else {
1570: *hdr++ = ((len << 1) & 0xfe); /* 7 bits, EA = 0 */
1571: *hdr++ = ((len >> 7) & 0xff); /* 8 bits, no EA */
1572: }
1573:
1574: if (credits > 0)
1575: *hdr++ = (uint8_t)credits;
1576:
1577: m0->m_len = hdr - mtod(m0, uint8_t *);
1578:
1579: /* Append payload */
1580: m0->m_next = m;
1581: m = NULL;
1582:
1583: m0->m_pkthdr.len = m0->m_len + len;
1584:
1585: /* Append FCS */
1586: fcs = 0xff - fcs; /* ones complement */
1587: len = m0->m_pkthdr.len;
1588: m_copyback(m0, len, sizeof(fcs), &fcs);
1589: if (m0->m_pkthdr.len != len + sizeof(fcs))
1590: goto nomem;
1591:
1592: DPRINTFN(10, "dlci %d, pktlen %d (%d data, %d credits), fcs=%#2.2x\n",
1593: dlc ? dlc->rd_dlci : 0, m0->m_pkthdr.len, credit->rc_len,
1594: credits, fcs);
1595:
1596: /*
1597: * UIH frame ready to go..
1598: */
1599: err = l2cap_send(rs->rs_l2cap, m0);
1600: if (err)
1601: goto fail;
1602:
1603: SIMPLEQ_INSERT_TAIL(&rs->rs_credits, credit, rc_next);
1604: return 0;
1605:
1606: nomem:
1607: err = ENOMEM;
1608:
1609: if (m0 != NULL)
1610: m_freem(m0);
1611:
1612: if (m != NULL)
1613: m_freem(m);
1614:
1615: fail:
1616: if (credit != NULL)
1617: pool_put(&rfcomm_credit_pool, credit);
1618:
1619: return err;
1620: }
1621:
1622: /*
1623: * send Multiplexer Control Command (or Response) on session
1624: */
1625: int
1626: rfcomm_session_send_mcc(struct rfcomm_session *rs, int cr,
1627: uint8_t type, void *data, int len)
1628: {
1629: struct mbuf *m;
1630: uint8_t *hdr;
1631: int hlen;
1632:
1633: m = m_gethdr(M_DONTWAIT, MT_DATA);
1634: if (m == NULL)
1635: return ENOMEM;
1636:
1637: hdr = mtod(m, uint8_t *);
1638:
1639: /*
1640: * Technically the type field can extend past one octet, but none
1641: * currently defined will do that.
1642: */
1643: *hdr++ = RFCOMM_MKMCC_TYPE(cr, type);
1644:
1645: /*
1646: * In the frame, the max length size is 2 octets (15 bits) whereas
1647: * no max length size is specified for MCC commands. We must allow
1648: * for 3 octets since for MCC frames we use 7 bits + EA in each.
1649: *
1650: * Only test data can possibly be that big.
1651: *
1652: * XXX Should we check this against the MTU?
1653: */
1654: if (len < (1 << 7)) {
1655: *hdr++ = ((len << 1) & 0xfe) | 0x01; /* 7 bits, EA = 1 */
1656: } else if (len < (1 << 14)) {
1657: *hdr++ = ((len << 1) & 0xfe); /* 7 bits, EA = 0 */
1658: *hdr++ = ((len >> 6) & 0xfe) | 0x01; /* 7 bits, EA = 1 */
1659: } else if (len < (1 << 15)) {
1660: *hdr++ = ((len << 1) & 0xfe); /* 7 bits, EA = 0 */
1661: *hdr++ = ((len >> 6) & 0xfe); /* 7 bits, EA = 0 */
1662: *hdr++ = ((len >> 13) & 0x02) | 0x01; /* 1 bit, EA = 1 */
1663: } else {
1664: DPRINTF("incredible length! (%d)\n", len);
1665: m_freem(m);
1666: return EMSGSIZE;
1667: }
1668:
1669: /*
1670: * add command data (to same mbuf if possible)
1671: */
1672: hlen = hdr - mtod(m, uint8_t *);
1673:
1674: if (len > 0) {
1675: m->m_pkthdr.len = m->m_len = MHLEN;
1676: m_copyback(m, hlen, len, data);
1677: if (m->m_pkthdr.len != max(MHLEN, hlen + len)) {
1678: m_freem(m);
1679: return ENOMEM;
1680: }
1681: }
1682:
1683: m->m_pkthdr.len = hlen + len;
1684: m->m_len = min(MHLEN, m->m_pkthdr.len);
1685:
1686: DPRINTFN(5, "%s type %2.2x len %d\n",
1687: (cr ? "command" : "response"), type, m->m_pkthdr.len);
1688:
1689: return rfcomm_session_send_uih(rs, NULL, 0, m);
1690: }
CVSweb
![[BACK]](/icons/back.gif){kind=icon}
Return to rfcomm_session.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / netbt