root/netbt/rfcomm_session.c

DEFINITIONS

1. rfcomm_init
2. rfcomm_session_alloc
3. rfcomm_session_free
4. rfcomm_session_lookup
5. rfcomm_session_timeout
6. rfcomm_session_connecting
7. rfcomm_session_connected
8. rfcomm_session_disconnected
9. rfcomm_session_newconn
10. rfcomm_session_complete
11. rfcomm_session_linkmode
12. rfcomm_session_input
13. rfcomm_session_recv_sabm
14. rfcomm_session_recv_disc
15. rfcomm_session_recv_ua
16. rfcomm_session_recv_dm
17. rfcomm_session_recv_uih
18. rfcomm_session_recv_mcc
19. rfcomm_session_recv_mcc_test
20. rfcomm_session_recv_mcc_fcon
21. rfcomm_session_recv_mcc_fcoff
22. rfcomm_session_recv_mcc_msc
23. rfcomm_session_recv_mcc_rpn
24. rfcomm_session_recv_mcc_rls
25. rfcomm_session_recv_mcc_pn
26. rfcomm_session_recv_mcc_nsc
27. rfcomm_session_send_frame
28. rfcomm_session_send_uih
29. rfcomm_session_send_mcc

    1 /*      $OpenBSD: rfcomm_session.c,v 1.1 2007/06/01 02:46:12 uwe Exp $  */
    2 /*      $NetBSD: rfcomm_session.c,v 1.9 2007/04/21 06:15:23 plunky Exp $        */
    4 /*-
    5  * Copyright (c) 2006 Itronix Inc.
    6  * All rights reserved.
    7  *
    8  * Written by Iain Hibbert for Itronix Inc.
    9  *
   10  * Redistribution and use in source and binary forms, with or without
   11  * modification, are permitted provided that the following conditions
   12  * are met:
   13  * 1. Redistributions of source code must retain the above copyright
   14  *    notice, this list of conditions and the following disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  * 3. The name of Itronix Inc. may not be used to endorse
   19  *    or promote products derived from this software without specific
   20  *    prior written permission.
   21  *
   22  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
   23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
   25  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
   26  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
   27  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
   28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
   29  * ON ANY THEORY OF LIABILITY, WHETHER IN
   30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
   31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   32  * POSSIBILITY OF SUCH DAMAGE.
   33  */
   35 #include <sys/cdefs.h>
   37 #include <sys/param.h>
   38 #include <sys/kernel.h>
   39 #include <sys/mbuf.h>
   40 #include <sys/proc.h>
   41 #include <sys/systm.h>
   42 #include <sys/types.h>
   44 #include <netbt/bluetooth.h>
   45 #include <netbt/hci.h>
   46 #include <netbt/l2cap.h>
   47 #include <netbt/rfcomm.h>
   49 /******************************************************************************
   50  *
   51  * RFCOMM Multiplexer Sessions sit directly on L2CAP channels, and can
   52  * multiplex up to 30 incoming and 30 outgoing connections.
   53  * Only one Multiplexer is allowed between any two devices.
   54  */
   56 static void rfcomm_session_timeout(void *);
   57 static void rfcomm_session_recv_sabm(struct rfcomm_session *, int);
   58 static void rfcomm_session_recv_disc(struct rfcomm_session *, int);
   59 static void rfcomm_session_recv_ua(struct rfcomm_session *, int);
   60 static void rfcomm_session_recv_dm(struct rfcomm_session *, int);
   61 static void rfcomm_session_recv_uih(struct rfcomm_session *, int, int, struct mbuf *, int);
   62 static void rfcomm_session_recv_mcc(struct rfcomm_session *, struct mbuf *);
   63 static void rfcomm_session_recv_mcc_test(struct rfcomm_session *, int, struct mbuf *);
   64 static void rfcomm_session_recv_mcc_fcon(struct rfcomm_session *, int);
   65 static void rfcomm_session_recv_mcc_fcoff(struct rfcomm_session *, int);
   66 static void rfcomm_session_recv_mcc_msc(struct rfcomm_session *, int, struct mbuf *);
   67 static void rfcomm_session_recv_mcc_rpn(struct rfcomm_session *, int, struct mbuf *);
   68 static void rfcomm_session_recv_mcc_rls(struct rfcomm_session *, int, struct mbuf *);
   69 static void rfcomm_session_recv_mcc_pn(struct rfcomm_session *, int, struct mbuf *);
   70 static void rfcomm_session_recv_mcc_nsc(struct rfcomm_session *, int, struct mbuf *);
   72 /* L2CAP callbacks */
   73 static void rfcomm_session_connecting(void *);
   74 static void rfcomm_session_connected(void *);
   75 static void rfcomm_session_disconnected(void *, int);
   76 static void *rfcomm_session_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
   77 static void rfcomm_session_complete(void *, int);
   78 static void rfcomm_session_linkmode(void *, int);
   79 static void rfcomm_session_input(void *, struct mbuf *);
   81 static const struct btproto rfcomm_session_proto = {
rfcomm_session_connecting,
rfcomm_session_connected,
rfcomm_session_disconnected,
rfcomm_session_newconn,
rfcomm_session_complete,
rfcomm_session_linkmode,
rfcomm_session_input,
   89 };
   91 struct rfcomm_session_list
rfcomm_session_active = LIST_HEAD_INITIALIZER(rfcomm_session_active);
   94 struct rfcomm_session_list
rfcomm_session_listen = LIST_HEAD_INITIALIZER(rfcomm_session_listen);
   97 struct pool rfcomm_credit_pool;
   99 /*
  100  * RFCOMM System Parameters (see section 5.3)
  101  */
  102 int rfcomm_mtu_default = 127;   /* bytes */
  103 int rfcomm_ack_timeout = 20;    /* seconds */
  104 int rfcomm_mcc_timeout = 20;    /* seconds */
  106 /*
  107  * Reversed CRC table as per TS 07.10 Annex B.3.5
  108  */
  109 static const uint8_t crctable[256] = {  /* reversed, 8-bit, poly=0x07 */
  110         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
  111         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
  112         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
  113         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
  115         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
  116         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
  117         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
  118         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
  120         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
  121         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
  122         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
  123         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
  125         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
  126         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
  127         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
  128         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
  130         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
  131         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
  132         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
  133         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
  135         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
  136         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
  137         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
  138         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
  140         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
  141         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
  142         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
  143         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
  145         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
  146         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
  147         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
  148         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
  149 };
  151 #define FCS(f, d)       crctable[(f) ^ (d)]
  153 /*
  154  * rfcomm_init()
  155  *
  156  * initialize the "credit pool".
  157  */
  158 void
rfcomm_init(void)
  160 {
pool_init(&rfcomm_credit_pool, 0, 0, 0, 0, "rfcomm_credit", NULL);
  162 }
  164 /*
  165  * rfcomm_session_alloc(list, sockaddr)
  166  *
  167  * allocate a new session and fill in the blanks, then
  168  * attach session to front of specified list (active or listen)
  169  */
  170 struct rfcomm_session *
rfcomm_session_alloc(struct rfcomm_session_list *list,
  172                         struct sockaddr_bt *laddr)
  173 {
  174         struct rfcomm_session *rs;
  175         int err;
rs = malloc(sizeof(*rs), M_BLUETOOTH, M_NOWAIT);
  178         if (rs == NULL)
  179                 return NULL;
bzero(rs, sizeof *rs);
rs->rs_state = RFCOMM_SESSION_CLOSED;
timeout_set(&rs->rs_timeout, rfcomm_session_timeout, rs);
SIMPLEQ_INIT(&rs->rs_credits);
LIST_INIT(&rs->rs_dlcs);
err = l2cap_attach(&rs->rs_l2cap, &rfcomm_session_proto, rs);
  190         if (err) {
free(rs, M_BLUETOOTH);
  192                 return NULL;
  193         }
  195         (void)l2cap_getopt(rs->rs_l2cap, SO_L2CAP_OMTU, &rs->rs_mtu);
  197         if (laddr->bt_psm == L2CAP_PSM_ANY)
laddr->bt_psm = L2CAP_PSM_RFCOMM;
  200         (void)l2cap_bind(rs->rs_l2cap, laddr);
LIST_INSERT_HEAD(list, rs, rs_next);
  204         return rs;
  205 }
  207 /*
  208  * rfcomm_session_free(rfcomm_session)
  209  *
  210  * release a session, including any cleanup
  211  */
  212 void
rfcomm_session_free(struct rfcomm_session *rs)
  214 {
  215         struct rfcomm_credit *credit;
KASSERT(rs != NULL);
KASSERT(LIST_EMPTY(&rs->rs_dlcs));
rs->rs_state = RFCOMM_SESSION_CLOSED;
  222         /*
  223          * If the callout is already invoked we have no way to stop it,
  224          * but it will call us back right away (there are no DLC's) so
  225          * not to worry.
  226          */
timeout_del(&rs->rs_timeout);
  228         if (timeout_triggered(&rs->rs_timeout))
  229                 return;
  231         /*
  232          * Take care that rfcomm_session_disconnected() doesnt call
  233          * us back either as it will do if the l2cap_channel has not
  234          * been closed when we detach it..
  235          */
  236         if (rs->rs_flags & RFCOMM_SESSION_FREE)
  237                 return;
rs->rs_flags |= RFCOMM_SESSION_FREE;
  241         /* throw away any remaining credit notes */
  242         while ((credit = SIMPLEQ_FIRST(&rs->rs_credits)) != NULL) {
SIMPLEQ_REMOVE_HEAD(&rs->rs_credits, rc_next);
pool_put(&rfcomm_credit_pool, credit);
  245         }
KASSERT(SIMPLEQ_EMPTY(&rs->rs_credits));
  249         /* Goodbye! */
LIST_REMOVE(rs, rs_next);
l2cap_detach(&rs->rs_l2cap);
free(rs, M_BLUETOOTH);
  253 }
  255 /*
  256  * rfcomm_session_lookup(sockaddr, sockaddr)
  257  *
  258  * Find active rfcomm session matching src and dest addresses
  259  * when src is BDADDR_ANY match any local address
  260  */
  261 struct rfcomm_session *
rfcomm_session_lookup(struct sockaddr_bt *src, struct sockaddr_bt *dest)
  263 {
  264         struct rfcomm_session *rs;
  265         struct sockaddr_bt addr;
LIST_FOREACH(rs, &rfcomm_session_active, rs_next) {
  268                 if (rs->rs_state == RFCOMM_SESSION_CLOSED)
  269                         continue;
l2cap_sockaddr(rs->rs_l2cap, &addr);
  273                 if (bdaddr_same(&src->bt_bdaddr, &addr.bt_bdaddr) == 0)
  274                         if (bdaddr_any(&src->bt_bdaddr) == 0)
  275                                 continue;
l2cap_peeraddr(rs->rs_l2cap, &addr);
  279                 if (addr.bt_psm != dest->bt_psm)
  280                         continue;
  282                 if (bdaddr_same(&dest->bt_bdaddr, &addr.bt_bdaddr))
  283                         break;
  284         }
  286         return rs;
  287 }
  289 /*
  290  * rfcomm_session_timeout(rfcomm_session)
  291  *
  292  * Session timeouts are scheduled when a session is left or
  293  * created with no DLCs, and when SABM(0) or DISC(0) are
  294  * sent.
  295  *
  296  * So, if it is in an open state with DLC's attached then
  297  * we leave it alone, otherwise the session is lost.
  298  */
  299 static void
rfcomm_session_timeout(void *arg)
  301 {
  302         struct rfcomm_session *rs = arg;
  303         struct rfcomm_dlc *dlc;
  304         int s;
KASSERT(rs != NULL);
s = splsoftnet();
  310         if (rs->rs_state != RFCOMM_SESSION_OPEN) {
DPRINTF("timeout\n");
rs->rs_state = RFCOMM_SESSION_CLOSED;
  314                 while (!LIST_EMPTY(&rs->rs_dlcs)) {
dlc = LIST_FIRST(&rs->rs_dlcs);
rfcomm_dlc_close(dlc, ETIMEDOUT);
  318                 }
  319         }
  321         if (LIST_EMPTY(&rs->rs_dlcs)) {
DPRINTF("expiring\n");
rfcomm_session_free(rs);
  324         }
splx(s);
  326 }
  328 /***********************************************************************
  329  *
  330  *      RFCOMM Session L2CAP protocol callbacks
  331  *
  332  */
  334 static void
rfcomm_session_connecting(void *arg)
  336 {
  337         /* struct rfcomm_session *rs = arg; */
DPRINTF("Connecting\n");
  340 }
  342 static void
rfcomm_session_connected(void *arg)
  344 {
  345         struct rfcomm_session *rs = arg;
DPRINTF("Connected\n");
  349         /*
  350          * L2CAP is open.
  351          *
  352          * If we are initiator, we can send our SABM(0)
  353          * a timeout should be active?
  354          *
  355          * We must take note of the L2CAP MTU because currently
  356          * the L2CAP implementation can only do Basic Mode.
  357          */
l2cap_getopt(rs->rs_l2cap, SO_L2CAP_OMTU, &rs->rs_mtu);
rs->rs_mtu -= 6; /* (RFCOMM overhead could be this big) */
  361         if (rs->rs_mtu < RFCOMM_MTU_MIN) {
rfcomm_session_disconnected(rs, EINVAL);
  363                 return;
  364         }
  366         if (IS_INITIATOR(rs)) {
  367                 int err;
err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_SABM, 0);
  370                 if (err)
rfcomm_session_disconnected(rs, err);
timeout_add(&rs->rs_timeout, rfcomm_ack_timeout * hz);
  374         }
  375 }
  377 static void
rfcomm_session_disconnected(void *arg, int err)
  379 {
  380         struct rfcomm_session *rs = arg;
  381         struct rfcomm_dlc *dlc;
DPRINTF("Disconnected\n");
rs->rs_state = RFCOMM_SESSION_CLOSED;
  387         while (!LIST_EMPTY(&rs->rs_dlcs)) {
dlc = LIST_FIRST(&rs->rs_dlcs);
rfcomm_dlc_close(dlc, err);
  391         }
rfcomm_session_free(rs);
  394 }
  396 static void *
rfcomm_session_newconn(void *arg, struct sockaddr_bt *laddr,
  398                                 struct sockaddr_bt *raddr)
  399 {
  400         struct rfcomm_session *new, *rs = arg;
DPRINTF("New Connection\n");
  404         /*
  405          * Incoming session connect request. We should return a new
  406          * session pointer if this is acceptable. The L2CAP layer
  407          * passes local and remote addresses, which we must check as
  408          * only one RFCOMM session is allowed between any two devices
  409          */
new = rfcomm_session_lookup(laddr, raddr);
  411         if (new != NULL)
  412                 return NULL;
new = rfcomm_session_alloc(&rfcomm_session_active, laddr);
  415         if (new == NULL)
  416                 return NULL;
new->rs_mtu = rs->rs_mtu;
new->rs_state = RFCOMM_SESSION_WAIT_CONNECT;
  421         /*
  422          * schedule an expiry so that if nothing comes of it we
  423          * can punt.
  424          */
timeout_add(&new->rs_timeout, rfcomm_mcc_timeout * hz);
  427         return new->rs_l2cap;
  428 }
  430 static void
rfcomm_session_complete(void *arg, int count)
  432 {
  433         struct rfcomm_session *rs = arg;
  434         struct rfcomm_credit *credit;
  435         struct rfcomm_dlc *dlc;
  437         /*
  438          * count L2CAP packets are 'complete', meaning that they are cleared
  439          * our buffers (for best effort) or arrived safe (for guaranteed) so
  440          * we can take it off our list and pass the message on, so that
  441          * eventually the data can be removed from the sockbuf
  442          */
  443         while (count-- > 0) {
credit = SIMPLEQ_FIRST(&rs->rs_credits);
  445 #ifdef DIAGNOSTIC
  446                 if (credit == NULL) {
printf("%s: too many packets completed!\n", __func__);
  448                         break;
  449                 }
  450 #endif
dlc = credit->rc_dlc;
  452                 if (dlc != NULL) {
dlc->rd_pending--;
  454                         (*dlc->rd_proto->complete)
  455                                         (dlc->rd_upper, credit->rc_len);
  457                         /*
  458                          * if not using credit flow control, we may push
  459                          * more data now
  460                          */
  461                         if ((rs->rs_flags & RFCOMM_SESSION_CFC) == 0
  462                             && dlc->rd_state == RFCOMM_DLC_OPEN) {
rfcomm_dlc_start(dlc);
  464                         }
  466                         /*
  467                          * When shutdown is indicated, we are just waiting to
  468                          * clear outgoing data.
  469                          */
  470                         if ((dlc->rd_flags & RFCOMM_DLC_SHUTDOWN)
  471                             && dlc->rd_txbuf == NULL && dlc->rd_pending == 0) {
dlc->rd_state = RFCOMM_DLC_WAIT_DISCONNECT;
rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC,
dlc->rd_dlci);
timeout_add(&dlc->rd_timeout,
rfcomm_ack_timeout * hz);
  477                         }
  478                 }
SIMPLEQ_REMOVE_HEAD(&rs->rs_credits, rc_next);
pool_put(&rfcomm_credit_pool, credit);
  482         }
  484         /*
  485          * If session is closed, we are just waiting to clear the queue
  486          */
  487         if (rs->rs_state == RFCOMM_SESSION_CLOSED) {
  488                 if (SIMPLEQ_EMPTY(&rs->rs_credits))
l2cap_disconnect(rs->rs_l2cap, 0);
  490         }
  491 }
  493 /*
  494  * Link Mode changed
  495  *
  496  * This is called when a mode change is complete. Proceed with connections
  497  * where appropriate, or pass the new mode to any active DLCs.
  498  */
  499 static void
rfcomm_session_linkmode(void *arg, int new)
  501 {
  502         struct rfcomm_session *rs = arg;
  503         struct rfcomm_dlc *dlc, *next;
  504         int err, mode = 0;
DPRINTF("auth %s, encrypt %s, secure %s\n",
  507                 (new & L2CAP_LM_AUTH ? "on" : "off"),
  508                 (new & L2CAP_LM_ENCRYPT ? "on" : "off"),
  509                 (new & L2CAP_LM_SECURE ? "on" : "off"));
  511         if (new & L2CAP_LM_AUTH)
mode |= RFCOMM_LM_AUTH;
  514         if (new & L2CAP_LM_ENCRYPT)
mode |= RFCOMM_LM_ENCRYPT;
  517         if (new & L2CAP_LM_SECURE)
mode |= RFCOMM_LM_SECURE;
next = LIST_FIRST(&rs->rs_dlcs);
  521         while ((dlc = next) != NULL) {
next = LIST_NEXT(dlc, rd_next);
  524                 switch (dlc->rd_state) {
  525                 case RFCOMM_DLC_WAIT_SEND_SABM: /* we are connecting */
  526                         if ((mode & dlc->rd_mode) != dlc->rd_mode) {
rfcomm_dlc_close(dlc, ECONNABORTED);
  528                         } else {
err = rfcomm_session_send_frame(rs,
RFCOMM_FRAME_SABM, dlc->rd_dlci);
  531                                 if (err) {
rfcomm_dlc_close(dlc, err);
  533                                 } else {
dlc->rd_state = RFCOMM_DLC_WAIT_RECV_UA;
timeout_add(&dlc->rd_timeout,
rfcomm_ack_timeout * hz);
  537                                         break;
  538                                 }
  539                         }
  541                         /*
  542                          * If we aborted the connection and there are no more DLCs
  543                          * on the session, it is our responsibility to disconnect.
  544                          */
  545                         if (!LIST_EMPTY(&rs->rs_dlcs))
  546                                 break;
rs->rs_state = RFCOMM_SESSION_WAIT_DISCONNECT;
rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC, 0);
timeout_add(&rs->rs_timeout, rfcomm_ack_timeout * hz);
  551                         break;
  553                 case RFCOMM_DLC_WAIT_SEND_UA: /* they are connecting */
  554                         if ((mode & dlc->rd_mode) != dlc->rd_mode) {
rfcomm_session_send_frame(rs,
RFCOMM_FRAME_DM, dlc->rd_dlci);
rfcomm_dlc_close(dlc, ECONNABORTED);
  558                                 break;
  559                         }
err = rfcomm_session_send_frame(rs,
RFCOMM_FRAME_UA, dlc->rd_dlci);
  563                         if (err) {
rfcomm_session_send_frame(rs,
RFCOMM_FRAME_DM, dlc->rd_dlci);
rfcomm_dlc_close(dlc, err);
  567                                 break;
  568                         }
err = rfcomm_dlc_open(dlc);
  571                         if (err) {
rfcomm_session_send_frame(rs,
RFCOMM_FRAME_DM, dlc->rd_dlci);
rfcomm_dlc_close(dlc, err);
  575                                 break;
  576                         }
  578                         break;
  580                 case RFCOMM_DLC_WAIT_RECV_UA:
  581                 case RFCOMM_DLC_OPEN: /* already established */
  582                         (*dlc->rd_proto->linkmode)(dlc->rd_upper, mode);
  583                         break;
  585                 default:
  586                         break;
  587                 }
  588         }
  589 }
  591 /*
  592  * Receive data from L2CAP layer for session. There is always exactly one
  593  * RFCOMM frame contained in each L2CAP frame.
  594  */
  595 static void
rfcomm_session_input(void *arg, struct mbuf *m)
  597 {
  598         struct rfcomm_session *rs = arg;
  599         int dlci, len, type, pf;
uint8_t fcs, b;
KASSERT(m != NULL);
KASSERT(rs != NULL);
  605         /*
  606          * UIH frames: FCS is only calculated on address and control fields
  607          * For other frames: FCS is calculated on address, control and length
  608          * Length may extend to two octets
  609          */
fcs = 0xff;
  612         if (m->m_pkthdr.len < 4) {
DPRINTF("short frame (%d), discarded\n", m->m_pkthdr.len);
  614                 goto done;
  615         }
  617         /* address - one octet */
m_copydata(m, 0, 1, &b);
m_adj(m, 1);
fcs = FCS(fcs, b);
dlci = RFCOMM_DLCI(b);
  623         /* control - one octet */
m_copydata(m, 0, 1, &b);
m_adj(m, 1);
fcs = FCS(fcs, b);
type = RFCOMM_TYPE(b);
pf = RFCOMM_PF(b);
  630         /* length - may be two octets */
m_copydata(m, 0, 1, &b);
m_adj(m, 1);
  633         if (type != RFCOMM_FRAME_UIH)
fcs = FCS(fcs, b);
len = (b >> 1) & 0x7f;
  637         if (RFCOMM_EA(b) == 0) {
  638                 if (m->m_pkthdr.len < 2) {
DPRINTF("short frame (%d, EA = 0), discarded\n",
m->m_pkthdr.len);
  641                         goto done;
  642                 }
m_copydata(m, 0, 1, &b);
m_adj(m, 1);
  646                 if (type != RFCOMM_FRAME_UIH)
fcs = FCS(fcs, b);
len |= (b << 7);
  650         }
  652         /* FCS byte is last octet in frame */
m_copydata(m, m->m_pkthdr.len - 1, 1, &b);
m_adj(m, -1);
fcs = FCS(fcs, b);
  657         if (fcs != 0xcf) {
DPRINTF("Bad FCS value (%#2.2x), frame discarded\n", fcs);
  659                 goto done;
  660         }
DPRINTFN(10, "dlci %d, type %2.2x, len = %d\n", dlci, type, len);
  664         switch (type) {
  665         case RFCOMM_FRAME_SABM:
  666                 if (pf)
rfcomm_session_recv_sabm(rs, dlci);
  668                 break;
  670         case RFCOMM_FRAME_DISC:
  671                 if (pf)
rfcomm_session_recv_disc(rs, dlci);
  673                 break;
  675         case RFCOMM_FRAME_UA:
  676                 if (pf)
rfcomm_session_recv_ua(rs, dlci);
  678                 break;
  680         case RFCOMM_FRAME_DM:
rfcomm_session_recv_dm(rs, dlci);
  682                 break;
  684         case RFCOMM_FRAME_UIH:
rfcomm_session_recv_uih(rs, dlci, pf, m, len);
  686                 return; /* (no release) */
  688         default:
UNKNOWN(type);
  690                 break;
  691         }
done:
m_freem(m);
  695 }
  697 /***********************************************************************
  698  *
  699  *      RFCOMM Session receive processing
  700  */
  702 /*
  703  * rfcomm_session_recv_sabm(rfcomm_session, dlci)
  704  *
  705  * Set Asyncrhonous Balanced Mode - open the channel.
  706  */
  707 static void
rfcomm_session_recv_sabm(struct rfcomm_session *rs, int dlci)
  709 {
  710         struct rfcomm_dlc *dlc;
  711         int err;
DPRINTFN(5, "SABM(%d)\n", dlci);
  715         if (dlci == 0) {        /* Open Session */
rs->rs_state = RFCOMM_SESSION_OPEN;
rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, 0);
LIST_FOREACH(dlc, &rs->rs_dlcs, rd_next) {
  719                         if (dlc->rd_state == RFCOMM_DLC_WAIT_SESSION)
rfcomm_dlc_connect(dlc);
  721                 }
  722                 return;
  723         }
  725         if (rs->rs_state != RFCOMM_SESSION_OPEN) {
DPRINTF("session was not even open!\n");
  727                 return;
  728         }
  730         /* validate direction bit */
  731         if ((IS_INITIATOR(rs) && !RFCOMM_DIRECTION(dlci))
  732             || (!IS_INITIATOR(rs) && RFCOMM_DIRECTION(dlci))) {
DPRINTF("Invalid direction bit on DLCI\n");
  734                 return;
  735         }
  737         /*
  738          * look for our DLC - this may exist if we received PN
  739          * already, or we may have to fabricate a new one.
  740          */
dlc = rfcomm_dlc_lookup(rs, dlci);
  742         if (dlc == NULL) {
dlc = rfcomm_dlc_newconn(rs, dlci);
  744                 if (dlc == NULL)
  745                         return; /* (DM is sent) */
  746         }
  748         /*
  749          * ..but if this DLC is not waiting to connect, they did
  750          * something wrong, ignore it.
  751          */
  752         if (dlc->rd_state != RFCOMM_DLC_WAIT_CONNECT)
  753                 return;
  755         /* set link mode */
err = rfcomm_dlc_setmode(dlc);
  757         if (err == EINPROGRESS) {
dlc->rd_state = RFCOMM_DLC_WAIT_SEND_UA;
  759                 (*dlc->rd_proto->connecting)(dlc->rd_upper);
  760                 return;
  761         }
  762         if (err)
  763                 goto close;
err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, dlci);
  766         if (err)
  767                 goto close;
  769         /* and mark it open */
err = rfcomm_dlc_open(dlc);
  771         if (err)
  772                 goto close;
  774         return;
close:
rfcomm_dlc_close(dlc, err);
  778 }
  780 /*
  781  * Receive Disconnect Command
  782  */
  783 static void
rfcomm_session_recv_disc(struct rfcomm_session *rs, int dlci)
  785 {
  786         struct rfcomm_dlc *dlc;
DPRINTFN(5, "DISC(%d)\n", dlci);
  790         if (dlci == 0) {
  791                 /*
  792                  * Disconnect Session
  793                  *
  794                  * We set the session state to CLOSED so that when
  795                  * the UA frame is clear the session will be closed
  796                  * automatically. We wont bother to close any DLC's
  797                  * just yet as there should be none. In the unlikely
  798                  * event that something is left, it will get flushed
  799                  * out as the session goes down.
  800                  */
rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, 0);
rs->rs_state = RFCOMM_SESSION_CLOSED;
  803                 return;
  804         }
dlc = rfcomm_dlc_lookup(rs, dlci);
  807         if (dlc == NULL) {
rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM, dlci);
  809                 return;
  810         }
rfcomm_dlc_close(dlc, ECONNRESET);
rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, dlci);
  814 }
  816 /*
  817  * Receive Unnumbered Acknowledgement Response
  818  *
  819  * This should be a response to a DISC or SABM frame that we
  820  * have previously sent. If unexpected, ignore it.
  821  */
  822 static void
rfcomm_session_recv_ua(struct rfcomm_session *rs, int dlci)
  824 {
  825         struct rfcomm_dlc *dlc;
DPRINTFN(5, "UA(%d)\n", dlci);
  829         if (dlci == 0) {
  830                 switch (rs->rs_state) {
  831                 case RFCOMM_SESSION_WAIT_CONNECT:       /* We sent SABM */
timeout_del(&rs->rs_timeout);
rs->rs_state = RFCOMM_SESSION_OPEN;
LIST_FOREACH(dlc, &rs->rs_dlcs, rd_next) {
  835                                 if (dlc->rd_state == RFCOMM_DLC_WAIT_SESSION)
rfcomm_dlc_connect(dlc);
  837                         }
  838                         break;
  840                 case RFCOMM_SESSION_WAIT_DISCONNECT:    /* We sent DISC */
timeout_del(&rs->rs_timeout);
rs->rs_state = RFCOMM_SESSION_CLOSED;
l2cap_disconnect(rs->rs_l2cap, 0);
  844                         break;
  846                 default:
DPRINTF("Received spurious UA(0)!\n");
  848                         break;
  849                 }
  851                 return;
  852         }
  854         /*
  855          * If we have no DLC on this dlci, we may have aborted
  856          * without shutting down properly, so check if the session
  857          * needs disconnecting.
  858          */
dlc = rfcomm_dlc_lookup(rs, dlci);
  860         if (dlc == NULL)
  861                 goto check;
  863         switch (dlc->rd_state) {
  864         case RFCOMM_DLC_WAIT_RECV_UA:           /* We sent SABM */
rfcomm_dlc_open(dlc);
  866                 return;
  868         case RFCOMM_DLC_WAIT_DISCONNECT:        /* We sent DISC */
rfcomm_dlc_close(dlc, 0);
  870                 break;
  872         default:
DPRINTF("Received spurious UA(%d)!\n", dlci);
  874                 return;
  875         }
check:  /* last one out turns out the light */
  878         if (LIST_EMPTY(&rs->rs_dlcs)) {
rs->rs_state = RFCOMM_SESSION_WAIT_DISCONNECT;
rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC, 0);
timeout_add(&rs->rs_timeout, rfcomm_ack_timeout * hz);
  882         }
  883 }
  885 /*
  886  * Receive Disconnected Mode Response
  887  *
  888  * If this does not apply to a known DLC then we may ignore it.
  889  */
  890 static void
rfcomm_session_recv_dm(struct rfcomm_session *rs, int dlci)
  892 {
  893         struct rfcomm_dlc *dlc;
DPRINTFN(5, "DM(%d)\n", dlci);
dlc = rfcomm_dlc_lookup(rs, dlci);
  898         if (dlc == NULL)
  899                 return;
  901         if (dlc->rd_state == RFCOMM_DLC_WAIT_CONNECT)
rfcomm_dlc_close(dlc, ECONNREFUSED);
  903         else
rfcomm_dlc_close(dlc, ECONNRESET);
  905 }
  907 /*
  908  * Receive Unnumbered Information with Header check (MCC or data packet)
  909  */
  910 static void
rfcomm_session_recv_uih(struct rfcomm_session *rs, int dlci,
  912                         int pf, struct mbuf *m, int len)
  913 {
  914         struct rfcomm_dlc *dlc;
uint8_t credits = 0;
DPRINTFN(10, "UIH(%d)\n", dlci);
  919         if (dlci == 0) {
rfcomm_session_recv_mcc(rs, m);
  921                 return;
  922         }
  924         if (m->m_pkthdr.len != len + pf) {
DPRINTF("Bad Frame Length (%d), frame discarded\n",
m->m_pkthdr.len);
  928                 goto discard;
  929         }
dlc = rfcomm_dlc_lookup(rs, dlci);
  932         if (dlc == NULL) {
DPRINTF("UIH received for non existent DLC, discarded\n");
rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM, dlci);
  935                 goto discard;
  936         }
  938         if (dlc->rd_state != RFCOMM_DLC_OPEN) {
DPRINTF("non-open DLC (state = %d), discarded\n",
dlc->rd_state);
  941                 goto discard;
  942         }
  944         /* if PF is set, credits were included */
  945         if (rs->rs_flags & RFCOMM_SESSION_CFC) {
  946                 if (pf != 0) {
  947                         if (m->m_pkthdr.len < sizeof(credits)) {
DPRINTF("Bad PF value, UIH discarded\n");
  949                                 goto discard;
  950                         }
m_copydata(m, 0, sizeof(credits), &credits);
m_adj(m, sizeof(credits));
dlc->rd_txcred += credits;
  957                         if (credits > 0 && dlc->rd_txbuf != NULL)
rfcomm_dlc_start(dlc);
  959                 }
  961                 if (len == 0)
  962                         goto discard;
  964                 if (dlc->rd_rxcred == 0) {
DPRINTF("Credit limit reached, UIH discarded\n");
  966                         goto discard;
  967                 }
  969                 if (len > dlc->rd_rxsize) {
DPRINTF("UIH frame exceeds rxsize, discarded\n");
  971                         goto discard;
  972                 }
dlc->rd_rxcred--;
dlc->rd_rxsize -= len;
  976         }
  978         (*dlc->rd_proto->input)(dlc->rd_upper, m);
  979         return;
discard:
m_freem(m);
  983 }
  985 /*
  986  * Receive Multiplexer Control Command
  987  */
  988 static void
rfcomm_session_recv_mcc(struct rfcomm_session *rs, struct mbuf *m)
  990 {
  991         int type, cr, len;
uint8_t b;
  994         /*
  995          * Extract MCC header.
  996          *
  997          * Fields are variable length using extension bit = 1 to signify the
  998          * last octet in the sequence.
  999          *
 1000          * Only single octet types are defined in TS 07.10/RFCOMM spec
 1001          *
 1002          * Length can realistically only use 15 bits (max RFCOMM MTU)
 1003          */
 1004         if (m->m_pkthdr.len < sizeof(b)) {
DPRINTF("Short MCC header, discarded\n");
 1006                 goto release;
 1007         }
m_copydata(m, 0, sizeof(b), &b);
m_adj(m, sizeof(b));
 1012         if (RFCOMM_EA(b) == 0) {        /* verify no extensions */
DPRINTF("MCC type EA = 0, discarded\n");
 1014                 goto release;
 1015         }
type = RFCOMM_MCC_TYPE(b);
cr = RFCOMM_CR(b);
len = 0;
 1021         do {
 1022                 if (m->m_pkthdr.len < sizeof(b)) {
DPRINTF("Short MCC header, discarded\n");
 1024                         goto release;
 1025                 }
m_copydata(m, 0, sizeof(b), &b);
m_adj(m, sizeof(b));
len = (len << 7) | (b >> 1);
len = min(len, RFCOMM_MTU_MAX);
 1032         } while (RFCOMM_EA(b) == 0);
 1034         if (len != m->m_pkthdr.len) {
DPRINTF("Incorrect MCC length, discarded\n");
 1036                 goto release;
 1037         }
DPRINTFN(2, "MCC %s type %2.2x (%d bytes)\n",
 1040                 (cr ? "command" : "response"), type, len);
 1042         /*
 1043          * pass to command handler
 1044          */
 1045         switch(type) {
 1046         case RFCOMM_MCC_TEST:   /* Test */
rfcomm_session_recv_mcc_test(rs, cr, m);
 1048                 break;
 1050         case RFCOMM_MCC_FCON:   /* Flow Control On */
rfcomm_session_recv_mcc_fcon(rs, cr);
 1052                 break;
 1054         case RFCOMM_MCC_FCOFF:  /* Flow Control Off */
rfcomm_session_recv_mcc_fcoff(rs, cr);
 1056                 break;
 1058         case RFCOMM_MCC_MSC:    /* Modem Status Command */
rfcomm_session_recv_mcc_msc(rs, cr, m);
 1060                 break;
 1062         case RFCOMM_MCC_RPN:    /* Remote Port Negotiation */
rfcomm_session_recv_mcc_rpn(rs, cr, m);
 1064                 break;
 1066         case RFCOMM_MCC_RLS:    /* Remote Line Status */
rfcomm_session_recv_mcc_rls(rs, cr, m);
 1068                 break;
 1070         case RFCOMM_MCC_PN:     /* Parameter Negotiation */
rfcomm_session_recv_mcc_pn(rs, cr, m);
 1072                 break;
 1074         case RFCOMM_MCC_NSC:    /* Non Supported Command */
rfcomm_session_recv_mcc_nsc(rs, cr, m);
 1076                 break;
 1078         default:
b = RFCOMM_MKMCC_TYPE(cr, type);
rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_NSC, &b, sizeof(b));
 1081         }
release:
m_freem(m);
 1085 }
 1087 /*
 1088  * process TEST command/response
 1089  */
 1090 static void
rfcomm_session_recv_mcc_test(struct rfcomm_session *rs, int cr, struct mbuf *m)
 1092 {
 1093         void *data;
 1094         int len;
 1096         if (cr == 0)    /* ignore ack */
 1097                 return;
 1099         /*
 1100          * we must send all the data they included back as is
 1101          */
len = m->m_pkthdr.len;
 1104         if (len > RFCOMM_MTU_MAX)
 1105                 return;
data = malloc(len, M_BLUETOOTH, M_NOWAIT);
 1108         if (data == NULL)
 1109                 return;
m_copydata(m, 0, len, data);
rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_TEST, data, len);
free(data, M_BLUETOOTH);
 1114 }
 1116 /*
 1117  * process Flow Control ON command/response
 1118  */
 1119 static void
rfcomm_session_recv_mcc_fcon(struct rfcomm_session *rs, int cr)
 1121 {
 1123         if (cr == 0)    /* ignore ack */
 1124                 return;
rs->rs_flags |= RFCOMM_SESSION_RFC;
rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_FCON, NULL, 0);
 1128 }
 1130 /*
 1131  * process Flow Control OFF command/response
 1132  */
 1133 static void
rfcomm_session_recv_mcc_fcoff(struct rfcomm_session *rs, int cr)
 1135 {
 1137         if (cr == 0)    /* ignore ack */
 1138                 return;
rs->rs_flags &= ~RFCOMM_SESSION_RFC;
rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_FCOFF, NULL, 0);
 1142 }
 1144 /*
 1145  * process Modem Status Command command/response
 1146  */
 1147 static void
rfcomm_session_recv_mcc_msc(struct rfcomm_session *rs, int cr, struct mbuf *m)
 1149 {
 1150         struct rfcomm_mcc_msc msc;      /* (3 octets) */
 1151         struct rfcomm_dlc *dlc;
 1152         int len = 0;
 1154         /* [ADDRESS] */
 1155         if (m->m_pkthdr.len < sizeof(msc.address))
 1156                 return;
m_copydata(m, 0, sizeof(msc.address), &msc.address);
m_adj(m, sizeof(msc.address));
len += sizeof(msc.address);
dlc = rfcomm_dlc_lookup(rs, RFCOMM_DLCI(msc.address));
 1164         if (cr == 0) {  /* ignore acks */
 1165                 if (dlc != NULL)
timeout_del(&dlc->rd_timeout);
 1168                 return;
 1169         }
 1171         if (dlc == NULL) {
rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM,
RFCOMM_DLCI(msc.address));
 1174                 return;
 1175         }
 1177         /* [SIGNALS] */
 1178         if (m->m_pkthdr.len < sizeof(msc.modem))
 1179                 return;
m_copydata(m, 0, sizeof(msc.modem), &msc.modem);
m_adj(m, sizeof(msc.modem));
len += sizeof(msc.modem);
dlc->rd_rmodem = msc.modem;
 1186         /* XXX how do we signal this upstream? */
 1188         if (RFCOMM_EA(msc.modem) == 0) {
 1189                 if (m->m_pkthdr.len < sizeof(msc.brk))
 1190                         return;
m_copydata(m, 0, sizeof(msc.brk), &msc.brk);
m_adj(m, sizeof(msc.brk));
len += sizeof(msc.brk);
 1196                 /* XXX how do we signal this upstream? */
 1197         }
rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_MSC, &msc, len);
 1200 }
 1202 /*
 1203  * process Remote Port Negotiation command/response
 1204  */
 1205 static void
rfcomm_session_recv_mcc_rpn(struct rfcomm_session *rs, int cr, struct mbuf *m)
 1207 {
 1208         struct rfcomm_mcc_rpn rpn;
uint16_t mask;
 1211         if (cr == 0)    /* ignore ack */
 1212                 return;
 1214         /* default values */
rpn.bit_rate = RFCOMM_RPN_BR_9600;
rpn.line_settings = RFCOMM_RPN_8_N_1;
rpn.flow_control = RFCOMM_RPN_FLOW_NONE;
rpn.xon_char = RFCOMM_RPN_XON_CHAR;
rpn.xoff_char = RFCOMM_RPN_XOFF_CHAR;
 1221         if (m->m_pkthdr.len == sizeof(rpn)) {
m_copydata(m, 0, sizeof(rpn), (caddr_t)&rpn);
rpn.param_mask = RFCOMM_RPN_PM_ALL;
 1224         } else if (m->m_pkthdr.len == 1) {
m_copydata(m, 0, 1, (caddr_t)&rpn);
rpn.param_mask = letoh16(rpn.param_mask);
 1227         } else {
DPRINTF("Bad RPN length (%d)\n", m->m_pkthdr.len);
 1229                 return;
 1230         }
mask = 0;
 1234         if (rpn.param_mask & RFCOMM_RPN_PM_RATE)
mask |= RFCOMM_RPN_PM_RATE;
 1237         if (rpn.param_mask & RFCOMM_RPN_PM_DATA
 1238             && RFCOMM_RPN_DATA_BITS(rpn.line_settings) == RFCOMM_RPN_DATA_8)
mask |= RFCOMM_RPN_PM_DATA;
 1241         if (rpn.param_mask & RFCOMM_RPN_PM_STOP
 1242             && RFCOMM_RPN_STOP_BITS(rpn.line_settings) == RFCOMM_RPN_STOP_1)
mask |= RFCOMM_RPN_PM_STOP;
 1245         if (rpn.param_mask & RFCOMM_RPN_PM_PARITY
 1246             && RFCOMM_RPN_PARITY(rpn.line_settings) == RFCOMM_RPN_PARITY_NONE)
mask |= RFCOMM_RPN_PM_PARITY;
 1249         if (rpn.param_mask & RFCOMM_RPN_PM_XON
 1250             && rpn.xon_char == RFCOMM_RPN_XON_CHAR)
mask |= RFCOMM_RPN_PM_XON;
 1253         if (rpn.param_mask & RFCOMM_RPN_PM_XOFF
 1254             && rpn.xoff_char == RFCOMM_RPN_XOFF_CHAR)
mask |= RFCOMM_RPN_PM_XOFF;
 1257         if (rpn.param_mask & RFCOMM_RPN_PM_FLOW
 1258             && rpn.flow_control == RFCOMM_RPN_FLOW_NONE)
mask |= RFCOMM_RPN_PM_FLOW;
rpn.param_mask = htole16(mask);
rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_RPN, &rpn, sizeof(rpn));
 1264 }
 1266 /*
 1267  * process Remote Line Status command/response
 1268  */
 1269 static void
rfcomm_session_recv_mcc_rls(struct rfcomm_session *rs, int cr, struct mbuf *m)
 1271 {
 1272         struct rfcomm_mcc_rls rls;
 1274         if (cr == 0)    /* ignore ack */
 1275                 return;
 1277         if (m->m_pkthdr.len != sizeof(rls)) {
DPRINTF("Bad RLS length %d\n", m->m_pkthdr.len);
 1279                 return;
 1280         }
m_copydata(m, 0, sizeof(rls), (caddr_t)&rls);
 1284         /*
 1285          * So far as I can tell, we just send back what
 1286          * they sent us. This signifies errors that seem
 1287          * irrelevent for RFCOMM over L2CAP.
 1288          */
rls.address |= 0x03;    /* EA = 1, CR = 1 */
rls.status &= 0x0f;     /* only 4 bits valid */
rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_RLS, &rls, sizeof(rls));
 1293 }
 1295 /*
 1296  * process Parameter Negotiation command/response
 1297  */
 1298 static void
rfcomm_session_recv_mcc_pn(struct rfcomm_session *rs, int cr, struct mbuf *m)
 1300 {
 1301         struct rfcomm_dlc *dlc;
 1302         struct rfcomm_mcc_pn pn;
 1303         int err;
 1305         if (m->m_pkthdr.len != sizeof(pn)) {
DPRINTF("Bad PN length %d\n", m->m_pkthdr.len);
 1307                 return;
 1308         }
m_copydata(m, 0, sizeof(pn), (caddr_t)&pn);
pn.dlci &= 0x3f;
pn.mtu = letoh16(pn.mtu);
dlc = rfcomm_dlc_lookup(rs, pn.dlci);
 1316         if (cr) {       /* Command */
 1317                 /*
 1318                  * If there is no DLC present, this is a new
 1319                  * connection so attempt to make one
 1320                  */
 1321                 if (dlc == NULL) {
dlc = rfcomm_dlc_newconn(rs, pn.dlci);
 1323                         if (dlc == NULL)
 1324                                 return; /* (DM is sent) */
 1325                 }
 1327                 /* accept any valid MTU, and offer it back */
pn.mtu = min(pn.mtu, RFCOMM_MTU_MAX);
pn.mtu = min(pn.mtu, rs->rs_mtu);
pn.mtu = max(pn.mtu, RFCOMM_MTU_MIN);
dlc->rd_mtu = pn.mtu;
pn.mtu = htole16(pn.mtu);
 1334                 /* credits are only set before DLC is open */
 1335                 if (dlc->rd_state == RFCOMM_DLC_WAIT_CONNECT
 1336                     && (pn.flow_control & 0xf0) == 0xf0) {
rs->rs_flags |= RFCOMM_SESSION_CFC;
dlc->rd_txcred = pn.credits & 0x07;
dlc->rd_rxcred = (dlc->rd_rxsize / dlc->rd_mtu);
dlc->rd_rxcred = min(dlc->rd_rxcred,
RFCOMM_CREDITS_DEFAULT);
pn.flow_control = 0xe0;
pn.credits = dlc->rd_rxcred;
 1346                 } else {
pn.flow_control = 0x00;
pn.credits = 0x00;
 1349                 }
 1351                 /* unused fields must be ignored and set to zero */
pn.ack_timer = 0;
pn.max_retrans = 0;
 1355                 /* send our response */
err = rfcomm_session_send_mcc(rs, 0,
RFCOMM_MCC_PN, &pn, sizeof(pn));
 1358                 if (err)
 1359                         goto close;
 1361         } else {        /* Response */
 1362                 /* ignore responses with no matching DLC */
 1363                 if (dlc == NULL)
 1364                         return;
timeout_del(&dlc->rd_timeout);
 1368                 if (pn.mtu > RFCOMM_MTU_MAX || pn.mtu > dlc->rd_mtu) {
dlc->rd_state = RFCOMM_DLC_WAIT_DISCONNECT;
err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC,
pn.dlci);
 1372                         if (err)
 1373                                 goto close;
timeout_add(&dlc->rd_timeout,
rfcomm_ack_timeout * hz);
 1377                         return;
 1378                 }
dlc->rd_mtu = pn.mtu;
 1381                 /* if DLC is not waiting to connect, we are done */
 1382                 if (dlc->rd_state != RFCOMM_DLC_WAIT_CONNECT)
 1383                         return;
 1385                 /* set initial credits according to RFCOMM spec */
 1386                 if ((pn.flow_control & 0xf0) == 0xe0) {
rs->rs_flags |= RFCOMM_SESSION_CFC;
dlc->rd_txcred = (pn.credits & 0x07);
 1389                 }
timeout_add(&dlc->rd_timeout, rfcomm_ack_timeout * hz);
 1393                 /* set link mode */
err = rfcomm_dlc_setmode(dlc);
 1395                 if (err == EINPROGRESS) {
dlc->rd_state = RFCOMM_DLC_WAIT_SEND_SABM;
 1397                         (*dlc->rd_proto->connecting)(dlc->rd_upper);
 1398                         return;
 1399                 }
 1400                 if (err)
 1401                         goto close;
 1403                 /* we can proceed now */
err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_SABM, pn.dlci);
 1405                 if (err)
 1406                         goto close;
dlc->rd_state = RFCOMM_DLC_WAIT_RECV_UA;
 1409         }
 1410         return;
close:
rfcomm_dlc_close(dlc, err);
 1414 }
 1416 /*
 1417  * process Non Supported Command command/response
 1418  */
 1419 static void
rfcomm_session_recv_mcc_nsc(struct rfcomm_session *rs,
 1421     int cr, struct mbuf *m)
 1422 {
 1423         struct rfcomm_dlc *dlc, *next;
 1425         /*
 1426          * Since we did nothing that is not mandatory,
 1427          * we just abort the whole session..
 1428          */
next = LIST_FIRST(&rs->rs_dlcs);
 1431         while ((dlc = next) != NULL) {
next = LIST_NEXT(dlc, rd_next);
rfcomm_dlc_close(dlc, ECONNABORTED);
 1434         }
rfcomm_session_free(rs);
 1437 }
 1439 /***********************************************************************
 1440  *
 1441  *      RFCOMM Session outward frame/uih/mcc building
 1442  */
 1444 /*
 1445  * SABM/DISC/DM/UA frames are all minimal and mostly identical.
 1446  */
 1447 int
rfcomm_session_send_frame(struct rfcomm_session *rs, int type, int dlci)
 1449 {
 1450         struct rfcomm_cmd_hdr *hdr;
 1451         struct rfcomm_credit *credit;
 1452         struct mbuf *m;
uint8_t fcs, cr;
credit = pool_get(&rfcomm_credit_pool, PR_NOWAIT);
 1456         if (credit == NULL)
 1457                 return ENOMEM;
m = m_gethdr(M_DONTWAIT, MT_DATA);
 1460         if (m == NULL) {
pool_put(&rfcomm_credit_pool, credit);
 1462                 return ENOMEM;
 1463         }
 1465         /*
 1466          * The CR (command/response) bit identifies the frame either as a
 1467          * commmand or a response and is used along with the DLCI to form
 1468          * the address. Commands contain the non-initiator address, whereas
 1469          * responses contain the initiator address, so the CR value is
 1470          * also dependent on the session direction.
 1471          */
 1472         if (type == RFCOMM_FRAME_UA || type == RFCOMM_FRAME_DM)
cr = IS_INITIATOR(rs) ? 0 : 1;
 1474         else
cr = IS_INITIATOR(rs) ? 1 : 0;
hdr = mtod(m, struct rfcomm_cmd_hdr *);
hdr->address = RFCOMM_MKADDRESS(cr, dlci);
hdr->control = RFCOMM_MKCONTROL(type, 1);   /* PF = 1 */
hdr->length = (0x00 << 1) | 0x01;           /* len = 0x00, EA = 1 */
fcs = 0xff;
fcs = FCS(fcs, hdr->address);
fcs = FCS(fcs, hdr->control);
fcs = FCS(fcs, hdr->length);
fcs = 0xff - fcs;       /* ones complement */
hdr->fcs = fcs;
m->m_pkthdr.len = m->m_len = sizeof(struct rfcomm_cmd_hdr);
 1491         /* empty credit note */
credit->rc_dlc = NULL;
credit->rc_len = m->m_pkthdr.len;
SIMPLEQ_INSERT_TAIL(&rs->rs_credits, credit, rc_next);
DPRINTFN(5, "dlci %d type %2.2x (%d bytes, fcs=%#2.2x)\n",
dlci, type, m->m_pkthdr.len, fcs);
 1499         return l2cap_send(rs->rs_l2cap, m);
 1500 }
 1502 /*
 1503  * rfcomm_session_send_uih(rfcomm_session, rfcomm_dlc, credits, mbuf)
 1504  *
 1505  * UIH frame is per DLC data or Multiplexer Control Commands
 1506  * when no DLC is given. Data mbuf is optional (just credits
 1507  * will be sent in that case)
 1508  */
 1509 int
rfcomm_session_send_uih(struct rfcomm_session *rs, struct rfcomm_dlc *dlc,
 1511                         int credits, struct mbuf *m)
 1512 {
 1513         struct rfcomm_credit *credit;
 1514         struct mbuf *m0 = NULL;
 1515         int err, len;
uint8_t fcs, *hdr;
KASSERT(rs != NULL);
len = (m == NULL) ? 0 : m->m_pkthdr.len;
KASSERT(!(credits == 0 && len == 0));
 1523         /*
 1524          * Make a credit note for the completion notification
 1525          */
credit = pool_get(&rfcomm_credit_pool, PR_NOWAIT);
 1527         if (credit == NULL)
 1528                 goto nomem;
credit->rc_len = len;
credit->rc_dlc = dlc;
 1533         /*
 1534          * Wrap UIH frame information around payload.
 1535          *
 1536          * [ADDRESS] [CONTROL] [LENGTH] [CREDITS] [...] [FCS]
 1537          *
 1538          * Address is one octet.
 1539          * Control is one octet.
 1540          * Length is one or two octets.
 1541          * Credits may be one octet.
 1542          *
 1543          * FCS is one octet and calculated on address and
 1544          *      control octets only.
 1545          *
 1546          * If there are credits to be sent, we will set the PF
 1547          * flag and include them in the frame.
 1548          */
m0 = m_gethdr(M_DONTWAIT, MT_DATA);
 1550         if (m0 == NULL)
 1551                 goto nomem;
MH_ALIGN(m0, 5);        /* (max 5 header octets) */
hdr = mtod(m0, uint8_t *);
 1556         /* CR bit is set according to the initiator of the session */
 1557         *hdr = RFCOMM_MKADDRESS((IS_INITIATOR(rs) ? 1 : 0),
 1558                                 (dlc ? dlc->rd_dlci : 0));
fcs = FCS(0xff, *hdr);
hdr++;
 1562         /* PF bit is set if credits are being sent */
 1563         *hdr = RFCOMM_MKCONTROL(RFCOMM_FRAME_UIH, (credits > 0 ? 1 : 0));
fcs = FCS(fcs, *hdr);
hdr++;
 1567         if (len < (1 << 7)) {
 1568                 *hdr++ = ((len << 1) & 0xfe) | 0x01;    /* 7 bits, EA = 1 */
 1569         } else {
 1570                 *hdr++ = ((len << 1) & 0xfe);           /* 7 bits, EA = 0 */
 1571                 *hdr++ = ((len >> 7) & 0xff);           /* 8 bits, no EA */
 1572         }
 1574         if (credits > 0)
 1575                 *hdr++ = (uint8_t)credits;
m0->m_len = hdr - mtod(m0, uint8_t *);
 1579         /* Append payload */
m0->m_next = m;
m = NULL;
m0->m_pkthdr.len = m0->m_len + len;
 1585         /* Append FCS */
fcs = 0xff - fcs;       /* ones complement */
len = m0->m_pkthdr.len;
m_copyback(m0, len, sizeof(fcs), &fcs);
 1589         if (m0->m_pkthdr.len != len + sizeof(fcs))
 1590                 goto nomem;
DPRINTFN(10, "dlci %d, pktlen %d (%d data, %d credits), fcs=%#2.2x\n",
dlc ? dlc->rd_dlci : 0, m0->m_pkthdr.len, credit->rc_len,
credits, fcs);
 1596         /*
 1597          * UIH frame ready to go..
 1598          */
err = l2cap_send(rs->rs_l2cap, m0);
 1600         if (err)
 1601                 goto fail;
SIMPLEQ_INSERT_TAIL(&rs->rs_credits, credit, rc_next);
 1604         return 0;
nomem:
err = ENOMEM;
 1609         if (m0 != NULL)
m_freem(m0);
 1612         if (m != NULL)
m_freem(m);
fail:
 1616         if (credit != NULL)
pool_put(&rfcomm_credit_pool, credit);
 1619         return err;
 1620 }
 1622 /*
 1623  * send Multiplexer Control Command (or Response) on session
 1624  */
 1625 int
rfcomm_session_send_mcc(struct rfcomm_session *rs, int cr,
uint8_t type, void *data, int len)
 1628 {
 1629         struct mbuf *m;
uint8_t *hdr;
 1631         int hlen;
m = m_gethdr(M_DONTWAIT, MT_DATA);
 1634         if (m == NULL)
 1635                 return ENOMEM;
hdr = mtod(m, uint8_t *);
 1639         /*
 1640          * Technically the type field can extend past one octet, but none
 1641          * currently defined will do that.
 1642          */
 1643         *hdr++ = RFCOMM_MKMCC_TYPE(cr, type);
 1645         /*
 1646          * In the frame, the max length size is 2 octets (15 bits) whereas
 1647          * no max length size is specified for MCC commands. We must allow
 1648          * for 3 octets since for MCC frames we use 7 bits + EA in each.
 1649          *
 1650          * Only test data can possibly be that big.
 1651          *
 1652          * XXX Should we check this against the MTU?
 1653          */
 1654         if (len < (1 << 7)) {
 1655                 *hdr++ = ((len << 1) & 0xfe) | 0x01;    /* 7 bits, EA = 1 */
 1656         } else if (len < (1 << 14)) {
 1657                 *hdr++ = ((len << 1) & 0xfe);           /* 7 bits, EA = 0 */
 1658                 *hdr++ = ((len >> 6) & 0xfe) | 0x01;    /* 7 bits, EA = 1 */
 1659         } else if (len < (1 << 15)) {
 1660                 *hdr++ = ((len << 1) & 0xfe);           /* 7 bits, EA = 0 */
 1661                 *hdr++ = ((len >> 6) & 0xfe);           /* 7 bits, EA = 0 */
 1662                 *hdr++ = ((len >> 13) & 0x02) | 0x01;   /* 1 bit,  EA = 1 */
 1663         } else {
DPRINTF("incredible length! (%d)\n", len);
m_freem(m);
 1666                 return EMSGSIZE;
 1667         }
 1669         /*
 1670          * add command data (to same mbuf if possible)
 1671          */
hlen = hdr - mtod(m, uint8_t *);
 1674         if (len > 0) {
m->m_pkthdr.len = m->m_len = MHLEN;
m_copyback(m, hlen, len, data);
 1677                 if (m->m_pkthdr.len != max(MHLEN, hlen + len)) {
m_freem(m);
 1679                         return ENOMEM;
 1680                 }
 1681         }
m->m_pkthdr.len = hlen + len;
m->m_len = min(MHLEN, m->m_pkthdr.len);
DPRINTFN(5, "%s type %2.2x len %d\n",
 1687                 (cr ? "command" : "response"), type, m->m_pkthdr.len);
 1689         return rfcomm_session_send_uih(rs, NULL, 0, m);
 1690 }