sys/netbt/rfcomm_session.c

   1 /* $DragonFly: src/sys/netbt/rfcomm_session.c,v 1.2 2008/03/18 13:41:42 hasso Exp $ */
   2 /* $OpenBSD: src/sys/netbt/rfcomm_session.c,v 1.3 2008/02/24 21:34:48 uwe Exp $ */
   3 /* $NetBSD: rfcomm_session.c,v 1.12 2008/01/31 19:30:23 plunky Exp $ */
   4
   5 /*-
   6  * Copyright (c) 2006 Itronix Inc.
   7  * All rights reserved.
   8  *
   9  * Written by Iain Hibbert for Itronix Inc.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 3. The name of Itronix Inc. may not be used to endorse
  20  *    or promote products derived from this software without specific
  21  *    prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  26  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
  27  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  28  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  29  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  30  * ON ANY THEORY OF LIABILITY, WHETHER IN
  31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 #include <sys/param.h>
  37 #include <sys/kernel.h>
  38 #include <sys/mbuf.h>
  39 #include <sys/proc.h>
  40 #include <sys/systm.h>
  41 #include <sys/types.h>
  42 #include <sys/endian.h>
  43
  44 #include <net/if.h>
  45
  46 #include <netbt/bluetooth.h>
  47 #include <netbt/hci.h>
  48 #include <netbt/l2cap.h>
  49 #include <netbt/rfcomm.h>
  50
  51 /******************************************************************************
  52  *
  53  * RFCOMM Multiplexer Sessions sit directly on L2CAP channels, and can
  54  * multiplex up to 30 incoming and 30 outgoing connections.
  55  * Only one Multiplexer is allowed between any two devices.
  56  */
  57
  58 static void rfcomm_session_recv_sabm(struct rfcomm_session *, int);
  59 static void rfcomm_session_recv_disc(struct rfcomm_session *, int);
  60 static void rfcomm_session_recv_ua(struct rfcomm_session *, int);
  61 static void rfcomm_session_recv_dm(struct rfcomm_session *, int);
  62 static void rfcomm_session_recv_uih(struct rfcomm_session *, int, int, struct mbuf *, int);
  63 static void rfcomm_session_recv_mcc(struct rfcomm_session *, struct mbuf *);
  64 static void rfcomm_session_recv_mcc_test(struct rfcomm_session *, int, struct mbuf *);
  65 static void rfcomm_session_recv_mcc_fcon(struct rfcomm_session *, int);
  66 static void rfcomm_session_recv_mcc_fcoff(struct rfcomm_session *, int);
  67 static void rfcomm_session_recv_mcc_msc(struct rfcomm_session *, int, struct mbuf *);
  68 static void rfcomm_session_recv_mcc_rpn(struct rfcomm_session *, int, struct mbuf *);
  69 static void rfcomm_session_recv_mcc_rls(struct rfcomm_session *, int, struct mbuf *);
  70 static void rfcomm_session_recv_mcc_pn(struct rfcomm_session *, int, struct mbuf *);
  71 static void rfcomm_session_recv_mcc_nsc(struct rfcomm_session *, int, struct mbuf *);
  72
  73 /* L2CAP callbacks */
  74 static void rfcomm_session_connecting(void *);
  75 static void rfcomm_session_connected(void *);
  76 static void rfcomm_session_disconnected(void *, int);
  77 static void *rfcomm_session_newconn(void *, struct sockaddr_bt *, struct sockaddr_bt *);
  78 static void rfcomm_session_complete(void *, int);
  79 static void rfcomm_session_linkmode(void *, int);
  80 static void rfcomm_session_input(void *, struct mbuf *);
  81
  82 static const struct btproto rfcomm_session_proto = {
  83         rfcomm_session_connecting,
  84         rfcomm_session_connected,
  85         rfcomm_session_disconnected,
  86         rfcomm_session_newconn,
  87         rfcomm_session_complete,
  88         rfcomm_session_linkmode,
  89         rfcomm_session_input,
  90 };
  91
  92 struct rfcomm_session_list
  93         rfcomm_session_active = LIST_HEAD_INITIALIZER(rfcomm_session_active);
  94
  95 struct rfcomm_session_list
  96         rfcomm_session_listen = LIST_HEAD_INITIALIZER(rfcomm_session_listen);
  97
  98 vm_zone_t rfcomm_credit_pool;
  99
 100 /*
 101  * RFCOMM System Parameters (see section 5.3)
 102  */
 103 int rfcomm_mtu_default = 127;   /* bytes */
 104 int rfcomm_ack_timeout = 20;    /* seconds */
 105 int rfcomm_mcc_timeout = 20;    /* seconds */
 106
 107 /*
 108  * Reversed CRC table as per TS 07.10 Annex B.3.5
 109  */
 110 static const uint8_t crctable[256] = {  /* reversed, 8-bit, poly=0x07 */
 111         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 112         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 113         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 114         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 115
 116         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 117         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 118         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 119         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 120
 121         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 122         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 123         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 124         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 125
 126         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 127         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 128         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 129         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 130
 131         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 132         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 133         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 134         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 135
 136         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 137         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 138         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 139         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 140
 141         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 142         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 143         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 144         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 145
 146         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 147         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 148         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 149         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 150 };
 151
 152 #define FCS(f, d)       crctable[(f) ^ (d)]
 153
 154 /*
 155  * rfcomm_init()
 156  *
 157  * initialize the "credit pool".
 158  */
 159 void
 160 rfcomm_init(void)
 161 {
 162         rfcomm_credit_pool = zinit("rfcomm_credit",
 163             sizeof(struct rfcomm_credit), 0, 0, 0);
 164 }
 165
 166 /*
 167  * rfcomm_session_alloc(list, sockaddr)
 168  *
 169  * allocate a new session and fill in the blanks, then
 170  * attach session to front of specified list (active or listen)
 171  */
 172 struct rfcomm_session *
 173 rfcomm_session_alloc(struct rfcomm_session_list *list,
 174                         struct sockaddr_bt *laddr)
 175 {
 176         struct rfcomm_session *rs;
 177         int err;
 178
 179         rs = kmalloc(sizeof(*rs), M_BLUETOOTH, M_NOWAIT | M_ZERO);
 180         if (rs == NULL)
 181                 return NULL;
 182
 183         rs->rs_state = RFCOMM_SESSION_CLOSED;
 184
 185         callout_init(&rs->rs_timeout);
 186
 187         STAILQ_INIT(&rs->rs_credits);
 188         LIST_INIT(&rs->rs_dlcs);
 189
 190         err = l2cap_attach(&rs->rs_l2cap, &rfcomm_session_proto, rs);
 191         if (err) {
 192                 kfree(rs, M_BLUETOOTH);
 193                 return NULL;
 194         }
 195
 196         (void)l2cap_getopt(rs->rs_l2cap, SO_L2CAP_OMTU, &rs->rs_mtu);
 197
 198         if (laddr->bt_psm == L2CAP_PSM_ANY)
 199                 laddr->bt_psm = L2CAP_PSM_RFCOMM;
 200
 201         (void)l2cap_bind(rs->rs_l2cap, laddr);
 202
 203         LIST_INSERT_HEAD(list, rs, rs_next);
 204
 205         return rs;
 206 }
 207
 208 /*
 209  * rfcomm_session_free(rfcomm_session)
 210  *
 211  * release a session, including any cleanup
 212  */
 213 void
 214 rfcomm_session_free(struct rfcomm_session *rs)
 215 {
 216         struct rfcomm_credit *credit;
 217
 218         KKASSERT(rs != NULL);
 219         KKASSERT(LIST_EMPTY(&rs->rs_dlcs));
 220
 221         rs->rs_state = RFCOMM_SESSION_CLOSED;
 222
 223         /*
 224          * If the callout is already invoked we have no way to stop it,
 225          * but it will call us back right away (there are no DLC's) so
 226          * not to worry.
 227          */
 228         callout_stop(&rs->rs_timeout);
 229         if (callout_active(&rs->rs_timeout))
 230                 return;
 231
 232         /*
 233          * Take care that rfcomm_session_disconnected() doesnt call
 234          * us back either as it will do if the l2cap_channel has not
 235          * been closed when we detach it..
 236          */
 237         if (rs->rs_flags & RFCOMM_SESSION_FREE)
 238                 return;
 239
 240         rs->rs_flags |= RFCOMM_SESSION_FREE;
 241
 242         /* throw away any remaining credit notes */
 243         while ((credit = STAILQ_FIRST(&rs->rs_credits)) != NULL) {
 244                 STAILQ_REMOVE_HEAD(&rs->rs_credits, rc_next);
 245                 zfree(rfcomm_credit_pool, credit);
 246         }
 247
 248         KKASSERT(STAILQ_EMPTY(&rs->rs_credits));
 249
 250         /* Goodbye! */
 251         LIST_REMOVE(rs, rs_next);
 252         l2cap_detach(&rs->rs_l2cap);
 253         kfree(rs, M_BLUETOOTH);
 254 }
 255
 256 /*
 257  * rfcomm_session_lookup(sockaddr, sockaddr)
 258  *
 259  * Find active rfcomm session matching src and dest addresses
 260  * when src is BDADDR_ANY match any local address
 261  */
 262 struct rfcomm_session *
 263 rfcomm_session_lookup(struct sockaddr_bt *src, struct sockaddr_bt *dest)
 264 {
 265         struct rfcomm_session *rs;
 266         struct sockaddr_bt addr;
 267
 268         LIST_FOREACH(rs, &rfcomm_session_active, rs_next) {
 269                 if (rs->rs_state == RFCOMM_SESSION_CLOSED)
 270                         continue;
 271
 272                 l2cap_sockaddr(rs->rs_l2cap, &addr);
 273
 274                 if (bdaddr_same(&src->bt_bdaddr, &addr.bt_bdaddr) == 0)
 275                         if (bdaddr_any(&src->bt_bdaddr) == 0)
 276                                 continue;
 277
 278                 l2cap_peeraddr(rs->rs_l2cap, &addr);
 279
 280                 if (addr.bt_psm != dest->bt_psm)
 281                         continue;
 282
 283                 if (bdaddr_same(&dest->bt_bdaddr, &addr.bt_bdaddr))
 284                         break;
 285         }
 286
 287         return rs;
 288 }
 289
 290 /*
 291  * rfcomm_session_timeout(rfcomm_session)
 292  *
 293  * Session timeouts are scheduled when a session is left or
 294  * created with no DLCs, and when SABM(0) or DISC(0) are
 295  * sent.
 296  *
 297  * So, if it is in an open state with DLC's attached then
 298  * we leave it alone, otherwise the session is lost.
 299  */
 300 void
 301 rfcomm_session_timeout(void *arg)
 302 {
 303         struct rfcomm_session *rs = arg;
 304         struct rfcomm_dlc *dlc;
 305
 306         KKASSERT(rs != NULL);
 307
 308         crit_enter();
 309
 310         if (rs->rs_state != RFCOMM_SESSION_OPEN) {
 311                 DPRINTF("timeout\n");
 312                 rs->rs_state = RFCOMM_SESSION_CLOSED;
 313
 314                 while (!LIST_EMPTY(&rs->rs_dlcs)) {
 315                         dlc = LIST_FIRST(&rs->rs_dlcs);
 316
 317                         rfcomm_dlc_close(dlc, ETIMEDOUT);
 318                 }
 319         }
 320
 321         if (LIST_EMPTY(&rs->rs_dlcs)) {
 322                 DPRINTF("expiring\n");
 323                 rfcomm_session_free(rs);
 324         }
 325         crit_exit();
 326 }
 327
 328 /***********************************************************************
 329  *
 330  *      RFCOMM Session L2CAP protocol callbacks
 331  *
 332  */
 333
 334 static void
 335 rfcomm_session_connecting(void *arg)
 336 {
 337         /* struct rfcomm_session *rs = arg; */
 338
 339         DPRINTF("Connecting\n");
 340 }
 341
 342 static void
 343 rfcomm_session_connected(void *arg)
 344 {
 345         struct rfcomm_session *rs = arg;
 346
 347         DPRINTF("Connected\n");
 348
 349         /*
 350          * L2CAP is open.
 351          *
 352          * If we are initiator, we can send our SABM(0)
 353          * a timeout should be active?
 354          *
 355          * We must take note of the L2CAP MTU because currently
 356          * the L2CAP implementation can only do Basic Mode.
 357          */
 358         l2cap_getopt(rs->rs_l2cap, SO_L2CAP_OMTU, &rs->rs_mtu);
 359
 360         rs->rs_mtu -= 6; /* (RFCOMM overhead could be this big) */
 361         if (rs->rs_mtu < RFCOMM_MTU_MIN) {
 362                 rfcomm_session_disconnected(rs, EINVAL);
 363                 return;
 364         }
 365
 366         if (IS_INITIATOR(rs)) {
 367                 int err;
 368
 369                 err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_SABM, 0);
 370                 if (err)
 371                         rfcomm_session_disconnected(rs, err);
 372
 373                 callout_reset(&rs->rs_timeout, rfcomm_ack_timeout * hz,
 374                     rfcomm_session_timeout, rs);
 375         }
 376 }
 377
 378 static void
 379 rfcomm_session_disconnected(void *arg, int err)
 380 {
 381         struct rfcomm_session *rs = arg;
 382         struct rfcomm_dlc *dlc;
 383
 384         DPRINTF("Disconnected\n");
 385
 386         rs->rs_state = RFCOMM_SESSION_CLOSED;
 387
 388         while (!LIST_EMPTY(&rs->rs_dlcs)) {
 389                 dlc = LIST_FIRST(&rs->rs_dlcs);
 390
 391                 rfcomm_dlc_close(dlc, err);
 392         }
 393
 394         rfcomm_session_free(rs);
 395 }
 396
 397 static void *
 398 rfcomm_session_newconn(void *arg, struct sockaddr_bt *laddr,
 399                                 struct sockaddr_bt *raddr)
 400 {
 401         struct rfcomm_session *new, *rs = arg;
 402
 403         DPRINTF("New Connection\n");
 404
 405         /*
 406          * Incoming session connect request. We should return a new
 407          * session pointer if this is acceptable. The L2CAP layer
 408          * passes local and remote addresses, which we must check as
 409          * only one RFCOMM session is allowed between any two devices
 410          */
 411         new = rfcomm_session_lookup(laddr, raddr);
 412         if (new != NULL)
 413                 return NULL;
 414
 415         new = rfcomm_session_alloc(&rfcomm_session_active, laddr);
 416         if (new == NULL)
 417                 return NULL;
 418
 419         new->rs_mtu = rs->rs_mtu;
 420         new->rs_state = RFCOMM_SESSION_WAIT_CONNECT;
 421
 422         /*
 423          * schedule an expiry so that if nothing comes of it we
 424          * can punt.
 425          */
 426         callout_reset(&rs->rs_timeout, rfcomm_mcc_timeout * hz,
 427             rfcomm_session_timeout, rs);
 428
 429         return new->rs_l2cap;
 430 }
 431
 432 static void
 433 rfcomm_session_complete(void *arg, int count)
 434 {
 435         struct rfcomm_session *rs = arg;
 436         struct rfcomm_credit *credit;
 437         struct rfcomm_dlc *dlc;
 438
 439         /*
 440          * count L2CAP packets are 'complete', meaning that they are cleared
 441          * our buffers (for best effort) or arrived safe (for guaranteed) so
 442          * we can take it off our list and pass the message on, so that
 443          * eventually the data can be removed from the sockbuf
 444          */
 445         while (count-- > 0) {
 446                 credit = STAILQ_FIRST(&rs->rs_credits);
 447 #ifdef DIAGNOSTIC
 448                 if (credit == NULL) {
 449                         kprintf("%s: too many packets completed!\n", __func__);
 450                         break;
 451                 }
 452 #endif
 453                 dlc = credit->rc_dlc;
 454                 if (dlc != NULL) {
 455                         dlc->rd_pending--;
 456                         (*dlc->rd_proto->complete)
 457                                         (dlc->rd_upper, credit->rc_len);
 458
 459                         /*
 460                          * if not using credit flow control, we may push
 461                          * more data now
 462                          */
 463                         if ((rs->rs_flags & RFCOMM_SESSION_CFC) == 0
 464                             && dlc->rd_state == RFCOMM_DLC_OPEN) {
 465                                 rfcomm_dlc_start(dlc);
 466                         }
 467
 468                         /*
 469                          * When shutdown is indicated, we are just waiting to
 470                          * clear outgoing data.
 471                          */
 472                         if ((dlc->rd_flags & RFCOMM_DLC_SHUTDOWN)
 473                             && dlc->rd_txbuf == NULL && dlc->rd_pending == 0) {
 474                                 dlc->rd_state = RFCOMM_DLC_WAIT_DISCONNECT;
 475                                 rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC,
 476                                                             dlc->rd_dlci);
 477                                 callout_reset(&dlc->rd_timeout,
 478                                     rfcomm_ack_timeout * hz,
 479                                     rfcomm_dlc_timeout, dlc);
 480                         }
 481                 }
 482
 483                 STAILQ_REMOVE_HEAD(&rs->rs_credits, rc_next);
 484                 zfree(rfcomm_credit_pool, credit);
 485         }
 486
 487         /*
 488          * If session is closed, we are just waiting to clear the queue
 489          */
 490         if (rs->rs_state == RFCOMM_SESSION_CLOSED) {
 491                 if (STAILQ_EMPTY(&rs->rs_credits))
 492                         l2cap_disconnect(rs->rs_l2cap, 0);
 493         }
 494 }
 495
 496 /*
 497  * Link Mode changed
 498  *
 499  * This is called when a mode change is complete. Proceed with connections
 500  * where appropriate, or pass the new mode to any active DLCs.
 501  */
 502 static void
 503 rfcomm_session_linkmode(void *arg, int new)
 504 {
 505         struct rfcomm_session *rs = arg;
 506         struct rfcomm_dlc *dlc, *next;
 507         int err, mode = 0;
 508
 509         DPRINTF("auth %s, encrypt %s, secure %s\n",
 510                 (new & L2CAP_LM_AUTH ? "on" : "off"),
 511                 (new & L2CAP_LM_ENCRYPT ? "on" : "off"),
 512                 (new & L2CAP_LM_SECURE ? "on" : "off"));
 513
 514         if (new & L2CAP_LM_AUTH)
 515                 mode |= RFCOMM_LM_AUTH;
 516
 517         if (new & L2CAP_LM_ENCRYPT)
 518                 mode |= RFCOMM_LM_ENCRYPT;
 519
 520         if (new & L2CAP_LM_SECURE)
 521                 mode |= RFCOMM_LM_SECURE;
 522
 523         next = LIST_FIRST(&rs->rs_dlcs);
 524         while ((dlc = next) != NULL) {
 525                 next = LIST_NEXT(dlc, rd_next);
 526
 527                 switch (dlc->rd_state) {
 528                 case RFCOMM_DLC_WAIT_SEND_SABM: /* we are connecting */
 529                         if ((mode & dlc->rd_mode) != dlc->rd_mode) {
 530                                 rfcomm_dlc_close(dlc, ECONNABORTED);
 531                         } else {
 532                                 err = rfcomm_session_send_frame(rs,
 533                                             RFCOMM_FRAME_SABM, dlc->rd_dlci);
 534                                 if (err) {
 535                                         rfcomm_dlc_close(dlc, err);
 536                                 } else {
 537                                         dlc->rd_state = RFCOMM_DLC_WAIT_RECV_UA;
 538                                         callout_reset(&dlc->rd_timeout,
 539                                             rfcomm_ack_timeout * hz,
 540                                             rfcomm_dlc_timeout, dlc);
 541
 542                                         break;
 543                                 }
 544                         }
 545
 546                         /*
 547                          * If we aborted the connection and there are no more DLCs
 548                          * on the session, it is our responsibility to disconnect.
 549                          */
 550                         if (!LIST_EMPTY(&rs->rs_dlcs))
 551                                 break;
 552
 553                         rs->rs_state = RFCOMM_SESSION_WAIT_DISCONNECT;
 554                         rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC, 0);
 555                         callout_reset(&rs->rs_timeout, rfcomm_ack_timeout * hz,
 556                             rfcomm_session_timeout, rs);
 557                         break;
 558
 559                 case RFCOMM_DLC_WAIT_SEND_UA: /* they are connecting */
 560                         if ((mode & dlc->rd_mode) != dlc->rd_mode) {
 561                                 rfcomm_session_send_frame(rs,
 562                                             RFCOMM_FRAME_DM, dlc->rd_dlci);
 563                                 rfcomm_dlc_close(dlc, ECONNABORTED);
 564                                 break;
 565                         }
 566
 567                         err = rfcomm_session_send_frame(rs,
 568                                             RFCOMM_FRAME_UA, dlc->rd_dlci);
 569                         if (err) {
 570                                 rfcomm_session_send_frame(rs,
 571                                                 RFCOMM_FRAME_DM, dlc->rd_dlci);
 572                                 rfcomm_dlc_close(dlc, err);
 573                                 break;
 574                         }
 575
 576                         err = rfcomm_dlc_open(dlc);
 577                         if (err) {
 578                                 rfcomm_session_send_frame(rs,
 579                                                 RFCOMM_FRAME_DM, dlc->rd_dlci);
 580                                 rfcomm_dlc_close(dlc, err);
 581                                 break;
 582                         }
 583
 584                         break;
 585
 586                 case RFCOMM_DLC_WAIT_RECV_UA:
 587                 case RFCOMM_DLC_OPEN: /* already established */
 588                         (*dlc->rd_proto->linkmode)(dlc->rd_upper, mode);
 589                         break;
 590
 591                 default:
 592                         break;
 593                 }
 594         }
 595 }
 596
 597 /*
 598  * Receive data from L2CAP layer for session. There is always exactly one
 599  * RFCOMM frame contained in each L2CAP frame.
 600  */
 601 static void
 602 rfcomm_session_input(void *arg, struct mbuf *m)
 603 {
 604         struct rfcomm_session *rs = arg;
 605         int dlci, len, type, pf;
 606         uint8_t fcs, b;
 607
 608         KKASSERT(m != NULL);
 609         KKASSERT(rs != NULL);
 610
 611         /*
 612          * UIH frames: FCS is only calculated on address and control fields
 613          * For other frames: FCS is calculated on address, control and length
 614          * Length may extend to two octets
 615          */
 616         fcs = 0xff;
 617
 618         if (m->m_pkthdr.len < 4) {
 619                 DPRINTF("short frame (%d), discarded\n", m->m_pkthdr.len);
 620                 goto done;
 621         }
 622
 623         /* address - one octet */
 624         m_copydata(m, 0, 1, &b);
 625         m_adj(m, 1);
 626         fcs = FCS(fcs, b);
 627         dlci = RFCOMM_DLCI(b);
 628
 629         /* control - one octet */
 630         m_copydata(m, 0, 1, &b);
 631         m_adj(m, 1);
 632         fcs = FCS(fcs, b);
 633         type = RFCOMM_TYPE(b);
 634         pf = RFCOMM_PF(b);
 635
 636         /* length - may be two octets */
 637         m_copydata(m, 0, 1, &b);
 638         m_adj(m, 1);
 639         if (type != RFCOMM_FRAME_UIH)
 640                 fcs = FCS(fcs, b);
 641         len = (b >> 1) & 0x7f;
 642
 643         if (RFCOMM_EA(b) == 0) {
 644                 if (m->m_pkthdr.len < 2) {
 645                         DPRINTF("short frame (%d, EA = 0), discarded\n",
 646                                 m->m_pkthdr.len);
 647                         goto done;
 648                 }
 649
 650                 m_copydata(m, 0, 1, &b);
 651                 m_adj(m, 1);
 652                 if (type != RFCOMM_FRAME_UIH)
 653                         fcs = FCS(fcs, b);
 654
 655                 len |= (b << 7);
 656         }
 657
 658         /* FCS byte is last octet in frame */
 659         m_copydata(m, m->m_pkthdr.len - 1, 1, &b);
 660         m_adj(m, -1);
 661         fcs = FCS(fcs, b);
 662
 663         if (fcs != 0xcf) {
 664                 DPRINTF("Bad FCS value (%#2.2x), frame discarded\n", fcs);
 665                 goto done;
 666         }
 667
 668         DPRINTFN(10, "dlci %d, type %2.2x, len = %d\n", dlci, type, len);
 669
 670         switch (type) {
 671         case RFCOMM_FRAME_SABM:
 672                 if (pf)
 673                         rfcomm_session_recv_sabm(rs, dlci);
 674                 break;
 675
 676         case RFCOMM_FRAME_DISC:
 677                 if (pf)
 678                         rfcomm_session_recv_disc(rs, dlci);
 679                 break;
 680
 681         case RFCOMM_FRAME_UA:
 682                 if (pf)
 683                         rfcomm_session_recv_ua(rs, dlci);
 684                 break;
 685
 686         case RFCOMM_FRAME_DM:
 687                 rfcomm_session_recv_dm(rs, dlci);
 688                 break;
 689
 690         case RFCOMM_FRAME_UIH:
 691                 rfcomm_session_recv_uih(rs, dlci, pf, m, len);
 692                 return; /* (no release) */
 693
 694         default:
 695                 UNKNOWN(type);
 696                 break;
 697         }
 698
 699 done:
 700         m_freem(m);
 701 }
 702
 703 /***********************************************************************
 704  *
 705  *      RFCOMM Session receive processing
 706  */
 707
 708 /*
 709  * rfcomm_session_recv_sabm(rfcomm_session, dlci)
 710  *
 711  * Set Asyncrhonous Balanced Mode - open the channel.
 712  */
 713 static void
 714 rfcomm_session_recv_sabm(struct rfcomm_session *rs, int dlci)
 715 {
 716         struct rfcomm_dlc *dlc;
 717         int err;
 718
 719         DPRINTFN(5, "SABM(%d)\n", dlci);
 720
 721         if (dlci == 0) {        /* Open Session */
 722                 rs->rs_state = RFCOMM_SESSION_OPEN;
 723                 rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, 0);
 724                 LIST_FOREACH(dlc, &rs->rs_dlcs, rd_next) {
 725                         if (dlc->rd_state == RFCOMM_DLC_WAIT_SESSION)
 726                                 rfcomm_dlc_connect(dlc);
 727                 }
 728                 return;
 729         }
 730
 731         if (rs->rs_state != RFCOMM_SESSION_OPEN) {
 732                 DPRINTF("session was not even open!\n");
 733                 return;
 734         }
 735
 736         /* validate direction bit */
 737         if ((IS_INITIATOR(rs) && !RFCOMM_DIRECTION(dlci))
 738             || (!IS_INITIATOR(rs) && RFCOMM_DIRECTION(dlci))) {
 739                 DPRINTF("Invalid direction bit on DLCI\n");
 740                 return;
 741         }
 742
 743         /*
 744          * look for our DLC - this may exist if we received PN
 745          * already, or we may have to fabricate a new one.
 746          */
 747         dlc = rfcomm_dlc_lookup(rs, dlci);
 748         if (dlc == NULL) {
 749                 dlc = rfcomm_dlc_newconn(rs, dlci);
 750                 if (dlc == NULL)
 751                         return; /* (DM is sent) */
 752         }
 753
 754         /*
 755          * ..but if this DLC is not waiting to connect, they did
 756          * something wrong, ignore it.
 757          */
 758         if (dlc->rd_state != RFCOMM_DLC_WAIT_CONNECT)
 759                 return;
 760
 761         /* set link mode */
 762         err = rfcomm_dlc_setmode(dlc);
 763         if (err == EINPROGRESS) {
 764                 dlc->rd_state = RFCOMM_DLC_WAIT_SEND_UA;
 765                 (*dlc->rd_proto->connecting)(dlc->rd_upper);
 766                 return;
 767         }
 768         if (err)
 769                 goto close;
 770
 771         err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, dlci);
 772         if (err)
 773                 goto close;
 774
 775         /* and mark it open */
 776         err = rfcomm_dlc_open(dlc);
 777         if (err)
 778                 goto close;
 779
 780         return;
 781
 782 close:
 783         rfcomm_dlc_close(dlc, err);
 784 }
 785
 786 /*
 787  * Receive Disconnect Command
 788  */
 789 static void
 790 rfcomm_session_recv_disc(struct rfcomm_session *rs, int dlci)
 791 {
 792         struct rfcomm_dlc *dlc;
 793
 794         DPRINTFN(5, "DISC(%d)\n", dlci);
 795
 796         if (dlci == 0) {
 797                 /*
 798                  * Disconnect Session
 799                  *
 800                  * We set the session state to CLOSED so that when
 801                  * the UA frame is clear the session will be closed
 802                  * automatically. We wont bother to close any DLC's
 803                  * just yet as there should be none. In the unlikely
 804                  * event that something is left, it will get flushed
 805                  * out as the session goes down.
 806                  */
 807                 rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, 0);
 808                 rs->rs_state = RFCOMM_SESSION_CLOSED;
 809                 return;
 810         }
 811
 812         dlc = rfcomm_dlc_lookup(rs, dlci);
 813         if (dlc == NULL) {
 814                 rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM, dlci);
 815                 return;
 816         }
 817
 818         rfcomm_dlc_close(dlc, ECONNRESET);
 819         rfcomm_session_send_frame(rs, RFCOMM_FRAME_UA, dlci);
 820 }
 821
 822 /*
 823  * Receive Unnumbered Acknowledgement Response
 824  *
 825  * This should be a response to a DISC or SABM frame that we
 826  * have previously sent. If unexpected, ignore it.
 827  */
 828 static void
 829 rfcomm_session_recv_ua(struct rfcomm_session *rs, int dlci)
 830 {
 831         struct rfcomm_dlc *dlc;
 832
 833         DPRINTFN(5, "UA(%d)\n", dlci);
 834
 835         if (dlci == 0) {
 836                 switch (rs->rs_state) {
 837                 case RFCOMM_SESSION_WAIT_CONNECT:       /* We sent SABM */
 838                         callout_stop(&rs->rs_timeout);
 839                         rs->rs_state = RFCOMM_SESSION_OPEN;
 840                         LIST_FOREACH(dlc, &rs->rs_dlcs, rd_next) {
 841                                 if (dlc->rd_state == RFCOMM_DLC_WAIT_SESSION)
 842                                         rfcomm_dlc_connect(dlc);
 843                         }
 844                         break;
 845
 846                 case RFCOMM_SESSION_WAIT_DISCONNECT:    /* We sent DISC */
 847                         callout_stop(&rs->rs_timeout);
 848                         rs->rs_state = RFCOMM_SESSION_CLOSED;
 849                         l2cap_disconnect(rs->rs_l2cap, 0);
 850                         break;
 851
 852                 default:
 853                         DPRINTF("Received spurious UA(0)!\n");
 854                         break;
 855                 }
 856
 857                 return;
 858         }
 859
 860         /*
 861          * If we have no DLC on this dlci, we may have aborted
 862          * without shutting down properly, so check if the session
 863          * needs disconnecting.
 864          */
 865         dlc = rfcomm_dlc_lookup(rs, dlci);
 866         if (dlc == NULL)
 867                 goto check;
 868
 869         switch (dlc->rd_state) {
 870         case RFCOMM_DLC_WAIT_RECV_UA:           /* We sent SABM */
 871                 rfcomm_dlc_open(dlc);
 872                 return;
 873
 874         case RFCOMM_DLC_WAIT_DISCONNECT:        /* We sent DISC */
 875                 rfcomm_dlc_close(dlc, 0);
 876                 break;
 877
 878         default:
 879                 DPRINTF("Received spurious UA(%d)!\n", dlci);
 880                 return;
 881         }
 882
 883 check:  /* last one out turns out the light */
 884         if (LIST_EMPTY(&rs->rs_dlcs)) {
 885                 rs->rs_state = RFCOMM_SESSION_WAIT_DISCONNECT;
 886                 rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC, 0);
 887                 callout_reset(&rs->rs_timeout, rfcomm_ack_timeout*hz,rfcomm_session_timeout,rs);
 888         }
 889 }
 890
 891 /*
 892  * Receive Disconnected Mode Response
 893  *
 894  * If this does not apply to a known DLC then we may ignore it.
 895  */
 896 static void
 897 rfcomm_session_recv_dm(struct rfcomm_session *rs, int dlci)
 898 {
 899         struct rfcomm_dlc *dlc;
 900
 901         DPRINTFN(5, "DM(%d)\n", dlci);
 902
 903         dlc = rfcomm_dlc_lookup(rs, dlci);
 904         if (dlc == NULL)
 905                 return;
 906
 907         if (dlc->rd_state == RFCOMM_DLC_WAIT_CONNECT)
 908                 rfcomm_dlc_close(dlc, ECONNREFUSED);
 909         else
 910                 rfcomm_dlc_close(dlc, ECONNRESET);
 911 }
 912
 913 /*
 914  * Receive Unnumbered Information with Header check (MCC or data packet)
 915  */
 916 static void
 917 rfcomm_session_recv_uih(struct rfcomm_session *rs, int dlci,
 918                         int pf, struct mbuf *m, int len)
 919 {
 920         struct rfcomm_dlc *dlc;
 921         uint8_t credits = 0;
 922
 923         DPRINTFN(10, "UIH(%d)\n", dlci);
 924
 925         if (dlci == 0) {
 926                 rfcomm_session_recv_mcc(rs, m);
 927                 return;
 928         }
 929
 930         if (m->m_pkthdr.len != len + pf) {
 931                 DPRINTF("Bad Frame Length (%d), frame discarded\n",
 932                             m->m_pkthdr.len);
 933
 934                 goto discard;
 935         }
 936
 937         dlc = rfcomm_dlc_lookup(rs, dlci);
 938         if (dlc == NULL) {
 939                 DPRINTF("UIH received for non existent DLC, discarded\n");
 940                 rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM, dlci);
 941                 goto discard;
 942         }
 943
 944         if (dlc->rd_state != RFCOMM_DLC_OPEN) {
 945                 DPRINTF("non-open DLC (state = %d), discarded\n",
 946                                 dlc->rd_state);
 947                 goto discard;
 948         }
 949
 950         /* if PF is set, credits were included */
 951         if (rs->rs_flags & RFCOMM_SESSION_CFC) {
 952                 if (pf != 0) {
 953                         if (m->m_pkthdr.len < sizeof(credits)) {
 954                                 DPRINTF("Bad PF value, UIH discarded\n");
 955                                 goto discard;
 956                         }
 957
 958                         m_copydata(m, 0, sizeof(credits), &credits);
 959                         m_adj(m, sizeof(credits));
 960
 961                         dlc->rd_txcred += credits;
 962
 963                         if (credits > 0 && dlc->rd_txbuf != NULL)
 964                                 rfcomm_dlc_start(dlc);
 965                 }
 966
 967                 if (len == 0)
 968                         goto discard;
 969
 970                 if (dlc->rd_rxcred == 0) {
 971                         DPRINTF("Credit limit reached, UIH discarded\n");
 972                         goto discard;
 973                 }
 974
 975                 if (len > dlc->rd_rxsize) {
 976                         DPRINTF("UIH frame exceeds rxsize, discarded\n");
 977                         goto discard;
 978                 }
 979
 980                 dlc->rd_rxcred--;
 981                 dlc->rd_rxsize -= len;
 982         }
 983
 984         (*dlc->rd_proto->input)(dlc->rd_upper, m);
 985         return;
 986
 987 discard:
 988         m_freem(m);
 989 }
 990
 991 /*
 992  * Receive Multiplexer Control Command
 993  */
 994 static void
 995 rfcomm_session_recv_mcc(struct rfcomm_session *rs, struct mbuf *m)
 996 {
 997         int type, cr, len;
 998         uint8_t b;
 999
1000         /*
1001          * Extract MCC header.
1002          *
1003          * Fields are variable length using extension bit = 1 to signify the
1004          * last octet in the sequence.
1005          *
1006          * Only single octet types are defined in TS 07.10/RFCOMM spec
1007          *
1008          * Length can realistically only use 15 bits (max RFCOMM MTU)
1009          */
1010         if (m->m_pkthdr.len < sizeof(b)) {
1011                 DPRINTF("Short MCC header, discarded\n");
1012                 goto release;
1013         }
1014
1015         m_copydata(m, 0, sizeof(b), &b);
1016         m_adj(m, sizeof(b));
1017
1018         if (RFCOMM_EA(b) == 0) {        /* verify no extensions */
1019                 DPRINTF("MCC type EA = 0, discarded\n");
1020                 goto release;
1021         }
1022
1023         type = RFCOMM_MCC_TYPE(b);
1024         cr = RFCOMM_CR(b);
1025
1026         len = 0;
1027         do {
1028                 if (m->m_pkthdr.len < sizeof(b)) {
1029                         DPRINTF("Short MCC header, discarded\n");
1030                         goto release;
1031                 }
1032
1033                 m_copydata(m, 0, sizeof(b), &b);
1034                 m_adj(m, sizeof(b));
1035
1036                 len = (len << 7) | (b >> 1);
1037                 len = min(len, RFCOMM_MTU_MAX);
1038         } while (RFCOMM_EA(b) == 0);
1039
1040         if (len != m->m_pkthdr.len) {
1041                 DPRINTF("Incorrect MCC length, discarded\n");
1042                 goto release;
1043         }
1044
1045         DPRINTFN(2, "MCC %s type %2.2x (%d bytes)\n",
1046                 (cr ? "command" : "response"), type, len);
1047
1048         /*
1049          * pass to command handler
1050          */
1051         switch(type) {
1052         case RFCOMM_MCC_TEST:   /* Test */
1053                 rfcomm_session_recv_mcc_test(rs, cr, m);
1054                 break;
1055
1056         case RFCOMM_MCC_FCON:   /* Flow Control On */
1057                 rfcomm_session_recv_mcc_fcon(rs, cr);
1058                 break;
1059
1060         case RFCOMM_MCC_FCOFF:  /* Flow Control Off */
1061                 rfcomm_session_recv_mcc_fcoff(rs, cr);
1062                 break;
1063
1064         case RFCOMM_MCC_MSC:    /* Modem Status Command */
1065                 rfcomm_session_recv_mcc_msc(rs, cr, m);
1066                 break;
1067
1068         case RFCOMM_MCC_RPN:    /* Remote Port Negotiation */
1069                 rfcomm_session_recv_mcc_rpn(rs, cr, m);
1070                 break;
1071
1072         case RFCOMM_MCC_RLS:    /* Remote Line Status */
1073                 rfcomm_session_recv_mcc_rls(rs, cr, m);
1074                 break;
1075
1076         case RFCOMM_MCC_PN:     /* Parameter Negotiation */
1077                 rfcomm_session_recv_mcc_pn(rs, cr, m);
1078                 break;
1079
1080         case RFCOMM_MCC_NSC:    /* Non Supported Command */
1081                 rfcomm_session_recv_mcc_nsc(rs, cr, m);
1082                 break;
1083
1084         default:
1085                 b = RFCOMM_MKMCC_TYPE(cr, type);
1086                 rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_NSC, &b, sizeof(b));
1087         }
1088
1089 release:
1090         m_freem(m);
1091 }
1092
1093 /*
1094  * process TEST command/response
1095  */
1096 static void
1097 rfcomm_session_recv_mcc_test(struct rfcomm_session *rs, int cr, struct mbuf *m)
1098 {
1099         void *data;
1100         int len;
1101
1102         if (cr == 0)    /* ignore ack */
1103                 return;
1104
1105         /*
1106          * we must send all the data they included back as is
1107          */
1108
1109         len = m->m_pkthdr.len;
1110         if (len > RFCOMM_MTU_MAX)
1111                 return;
1112
1113         data = kmalloc(len, M_BLUETOOTH, M_NOWAIT);
1114         if (data == NULL)
1115                 return;
1116
1117         m_copydata(m, 0, len, data);
1118         rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_TEST, data, len);
1119         kfree(data, M_BLUETOOTH);
1120 }
1121
1122 /*
1123  * process Flow Control ON command/response
1124  */
1125 static void
1126 rfcomm_session_recv_mcc_fcon(struct rfcomm_session *rs, int cr)
1127 {
1128
1129         if (cr == 0)    /* ignore ack */
1130                 return;
1131
1132         rs->rs_flags |= RFCOMM_SESSION_RFC;
1133         rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_FCON, NULL, 0);
1134 }
1135
1136 /*
1137  * process Flow Control OFF command/response
1138  */
1139 static void
1140 rfcomm_session_recv_mcc_fcoff(struct rfcomm_session *rs, int cr)
1141 {
1142         if (cr == 0)    /* ignore ack */
1143                 return;
1144
1145         rs->rs_flags &= ~RFCOMM_SESSION_RFC;
1146         rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_FCOFF, NULL, 0);
1147 }
1148
1149 /*
1150  * process Modem Status Command command/response
1151  */
1152 static void
1153 rfcomm_session_recv_mcc_msc(struct rfcomm_session *rs, int cr, struct mbuf *m)
1154 {
1155         struct rfcomm_mcc_msc msc;      /* (3 octets) */
1156         struct rfcomm_dlc *dlc;
1157         int len = 0;
1158
1159         /* [ADDRESS] */
1160         if (m->m_pkthdr.len < sizeof(msc.address))
1161                 return;
1162
1163         m_copydata(m, 0, sizeof(msc.address), &msc.address);
1164         m_adj(m, sizeof(msc.address));
1165         len += sizeof(msc.address);
1166
1167         dlc = rfcomm_dlc_lookup(rs, RFCOMM_DLCI(msc.address));
1168
1169         if (cr == 0) {  /* ignore acks */
1170                 if (dlc != NULL)
1171                         callout_stop(&dlc->rd_timeout);
1172
1173                 return;
1174         }
1175
1176         if (dlc == NULL) {
1177                 rfcomm_session_send_frame(rs, RFCOMM_FRAME_DM,
1178                                                 RFCOMM_DLCI(msc.address));
1179                 return;
1180         }
1181
1182         /* [SIGNALS] */
1183         if (m->m_pkthdr.len < sizeof(msc.modem))
1184                 return;
1185
1186         m_copydata(m, 0, sizeof(msc.modem), &msc.modem);
1187         m_adj(m, sizeof(msc.modem));
1188         len += sizeof(msc.modem);
1189
1190         dlc->rd_rmodem = msc.modem;
1191         /* XXX how do we signal this upstream? */
1192
1193         if (RFCOMM_EA(msc.modem) == 0) {
1194                 if (m->m_pkthdr.len < sizeof(msc.brk))
1195                         return;
1196
1197                 m_copydata(m, 0, sizeof(msc.brk), &msc.brk);
1198                 m_adj(m, sizeof(msc.brk));
1199                 len += sizeof(msc.brk);
1200
1201                 /* XXX how do we signal this upstream? */
1202         }
1203
1204         rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_MSC, &msc, len);
1205 }
1206
1207 /*
1208  * process Remote Port Negotiation command/response
1209  */
1210 static void
1211 rfcomm_session_recv_mcc_rpn(struct rfcomm_session *rs, int cr, struct mbuf *m)
1212 {
1213         struct rfcomm_mcc_rpn rpn;
1214         uint16_t mask;
1215
1216         if (cr == 0)    /* ignore ack */
1217                 return;
1218
1219         /* default values */
1220         rpn.bit_rate = RFCOMM_RPN_BR_9600;
1221         rpn.line_settings = RFCOMM_RPN_8_N_1;
1222         rpn.flow_control = RFCOMM_RPN_FLOW_NONE;
1223         rpn.xon_char = RFCOMM_RPN_XON_CHAR;
1224         rpn.xoff_char = RFCOMM_RPN_XOFF_CHAR;
1225
1226         if (m->m_pkthdr.len == sizeof(rpn)) {
1227                 m_copydata(m, 0, sizeof(rpn), (caddr_t)&rpn);
1228                 rpn.param_mask = RFCOMM_RPN_PM_ALL;
1229         } else if (m->m_pkthdr.len == 1) {
1230                 m_copydata(m, 0, 1, (caddr_t)&rpn);
1231                 rpn.param_mask = letoh16(rpn.param_mask);
1232         } else {
1233                 DPRINTF("Bad RPN length (%d)\n", m->m_pkthdr.len);
1234                 return;
1235         }
1236
1237         mask = 0;
1238
1239         if (rpn.param_mask & RFCOMM_RPN_PM_RATE)
1240                 mask |= RFCOMM_RPN_PM_RATE;
1241
1242         if (rpn.param_mask & RFCOMM_RPN_PM_DATA
1243             && RFCOMM_RPN_DATA_BITS(rpn.line_settings) == RFCOMM_RPN_DATA_8)
1244                 mask |= RFCOMM_RPN_PM_DATA;
1245
1246         if (rpn.param_mask & RFCOMM_RPN_PM_STOP
1247             && RFCOMM_RPN_STOP_BITS(rpn.line_settings) == RFCOMM_RPN_STOP_1)
1248                 mask |= RFCOMM_RPN_PM_STOP;
1249
1250         if (rpn.param_mask & RFCOMM_RPN_PM_PARITY
1251             && RFCOMM_RPN_PARITY(rpn.line_settings) == RFCOMM_RPN_PARITY_NONE)
1252                 mask |= RFCOMM_RPN_PM_PARITY;
1253
1254         if (rpn.param_mask & RFCOMM_RPN_PM_XON
1255             && rpn.xon_char == RFCOMM_RPN_XON_CHAR)
1256                 mask |= RFCOMM_RPN_PM_XON;
1257
1258         if (rpn.param_mask & RFCOMM_RPN_PM_XOFF
1259             && rpn.xoff_char == RFCOMM_RPN_XOFF_CHAR)
1260                 mask |= RFCOMM_RPN_PM_XOFF;
1261
1262         if (rpn.param_mask & RFCOMM_RPN_PM_FLOW
1263             && rpn.flow_control == RFCOMM_RPN_FLOW_NONE)
1264                 mask |= RFCOMM_RPN_PM_FLOW;
1265
1266         rpn.param_mask = htole16(mask);
1267
1268         rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_RPN, &rpn, sizeof(rpn));
1269 }
1270
1271 /*
1272  * process Remote Line Status command/response
1273  */
1274 static void
1275 rfcomm_session_recv_mcc_rls(struct rfcomm_session *rs, int cr, struct mbuf *m)
1276 {
1277         struct rfcomm_mcc_rls rls;
1278
1279         if (cr == 0)    /* ignore ack */
1280                 return;
1281
1282         if (m->m_pkthdr.len != sizeof(rls)) {
1283                 DPRINTF("Bad RLS length %d\n", m->m_pkthdr.len);
1284                 return;
1285         }
1286
1287         m_copydata(m, 0, sizeof(rls), (caddr_t)&rls);
1288
1289         /*
1290          * So far as I can tell, we just send back what
1291          * they sent us. This signifies errors that seem
1292          * irrelevent for RFCOMM over L2CAP.
1293          */
1294         rls.address |= 0x03;    /* EA = 1, CR = 1 */
1295         rls.status &= 0x0f;     /* only 4 bits valid */
1296
1297         rfcomm_session_send_mcc(rs, 0, RFCOMM_MCC_RLS, &rls, sizeof(rls));
1298 }
1299
1300 /*
1301  * process Parameter Negotiation command/response
1302  */
1303 static void
1304 rfcomm_session_recv_mcc_pn(struct rfcomm_session *rs, int cr, struct mbuf *m)
1305 {
1306         struct rfcomm_dlc *dlc;
1307         struct rfcomm_mcc_pn pn;
1308         int err;
1309
1310         if (m->m_pkthdr.len != sizeof(pn)) {
1311                 DPRINTF("Bad PN length %d\n", m->m_pkthdr.len);
1312                 return;
1313         }
1314
1315         m_copydata(m, 0, sizeof(pn), (caddr_t)&pn);
1316
1317         pn.dlci &= 0x3f;
1318         pn.mtu = letoh16(pn.mtu);
1319
1320         dlc = rfcomm_dlc_lookup(rs, pn.dlci);
1321         if (cr) {       /* Command */
1322                 /*
1323                  * If there is no DLC present, this is a new
1324                  * connection so attempt to make one
1325                  */
1326                 if (dlc == NULL) {
1327                         dlc = rfcomm_dlc_newconn(rs, pn.dlci);
1328                         if (dlc == NULL)
1329                                 return; /* (DM is sent) */
1330                 }
1331
1332                 /* accept any valid MTU, and offer it back */
1333                 pn.mtu = min(pn.mtu, RFCOMM_MTU_MAX);
1334                 pn.mtu = min(pn.mtu, rs->rs_mtu);
1335                 pn.mtu = max(pn.mtu, RFCOMM_MTU_MIN);
1336                 dlc->rd_mtu = pn.mtu;
1337                 pn.mtu = htole16(pn.mtu);
1338
1339                 /* credits are only set before DLC is open */
1340                 if (dlc->rd_state == RFCOMM_DLC_WAIT_CONNECT
1341                     && (pn.flow_control & 0xf0) == 0xf0) {
1342                         rs->rs_flags |= RFCOMM_SESSION_CFC;
1343                         dlc->rd_txcred = pn.credits & 0x07;
1344
1345                         dlc->rd_rxcred = (dlc->rd_rxsize / dlc->rd_mtu);
1346                         dlc->rd_rxcred = min(dlc->rd_rxcred,
1347                                                 RFCOMM_CREDITS_DEFAULT);
1348
1349                         pn.flow_control = 0xe0;
1350                         pn.credits = dlc->rd_rxcred;
1351                 } else {
1352                         pn.flow_control = 0x00;
1353                         pn.credits = 0x00;
1354                 }
1355
1356                 /* unused fields must be ignored and set to zero */
1357                 pn.ack_timer = 0;
1358                 pn.max_retrans = 0;
1359
1360                 /* send our response */
1361                 err = rfcomm_session_send_mcc(rs, 0,
1362                                         RFCOMM_MCC_PN, &pn, sizeof(pn));
1363                 if (err)
1364                         goto close;
1365
1366         } else {        /* Response */
1367                 /* ignore responses with no matching DLC */
1368                 if (dlc == NULL)
1369                         return;
1370
1371                 callout_stop(&dlc->rd_timeout);
1372
1373                 if (pn.mtu > RFCOMM_MTU_MAX || pn.mtu > dlc->rd_mtu) {
1374                         dlc->rd_state = RFCOMM_DLC_WAIT_DISCONNECT;
1375                         err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_DISC,
1376                                                         pn.dlci);
1377                         if (err)
1378                                 goto close;
1379
1380                         callout_reset(&dlc->rd_timeout, rfcomm_ack_timeout * hz,
1381                                     rfcomm_dlc_timeout, dlc);
1382                         return;
1383                 }
1384                 dlc->rd_mtu = pn.mtu;
1385
1386                 /* if DLC is not waiting to connect, we are done */
1387                 if (dlc->rd_state != RFCOMM_DLC_WAIT_CONNECT)
1388                         return;
1389
1390                 /* set initial credits according to RFCOMM spec */
1391                 if ((pn.flow_control & 0xf0) == 0xe0) {
1392                         rs->rs_flags |= RFCOMM_SESSION_CFC;
1393                         dlc->rd_txcred = (pn.credits & 0x07);
1394                 }
1395
1396                 callout_reset(&dlc->rd_timeout, rfcomm_ack_timeout * hz,
1397                                     rfcomm_dlc_timeout, dlc);
1398
1399                 /* set link mode */
1400                 err = rfcomm_dlc_setmode(dlc);
1401                 if (err == EINPROGRESS) {
1402                         dlc->rd_state = RFCOMM_DLC_WAIT_SEND_SABM;
1403                         (*dlc->rd_proto->connecting)(dlc->rd_upper);
1404                         return;
1405                 }
1406                 if (err)
1407                         goto close;
1408
1409                 /* we can proceed now */
1410                 err = rfcomm_session_send_frame(rs, RFCOMM_FRAME_SABM, pn.dlci);
1411                 if (err)
1412                         goto close;
1413
1414                 dlc->rd_state = RFCOMM_DLC_WAIT_RECV_UA;
1415         }
1416         return;
1417
1418 close:
1419         rfcomm_dlc_close(dlc, err);
1420 }
1421
1422 /*
1423  * process Non Supported Command command/response
1424  */
1425 static void
1426 rfcomm_session_recv_mcc_nsc(struct rfcomm_session *rs,
1427     int cr, struct mbuf *m)
1428 {
1429         struct rfcomm_dlc *dlc, *next;
1430
1431         /*
1432          * Since we did nothing that is not mandatory,
1433          * we just abort the whole session..
1434          */
1435
1436         next = LIST_FIRST(&rs->rs_dlcs);
1437         while ((dlc = next) != NULL) {
1438                 next = LIST_NEXT(dlc, rd_next);
1439                 rfcomm_dlc_close(dlc, ECONNABORTED);
1440         }
1441
1442         rfcomm_session_free(rs);
1443 }
1444
1445 /***********************************************************************
1446  *
1447  *      RFCOMM Session outward frame/uih/mcc building
1448  */
1449
1450 /*
1451  * SABM/DISC/DM/UA frames are all minimal and mostly identical.
1452  */
1453 int
1454 rfcomm_session_send_frame(struct rfcomm_session *rs, int type, int dlci)
1455 {
1456         struct rfcomm_cmd_hdr *hdr;
1457         struct rfcomm_credit *credit;
1458         struct mbuf *m;
1459         uint8_t fcs, cr;
1460
1461         credit = zalloc(rfcomm_credit_pool);
1462         if (credit == NULL)
1463                 return ENOMEM;
1464
1465         m = m_gethdr(MB_DONTWAIT, MT_DATA);
1466         if (m == NULL) {
1467                 zfree(rfcomm_credit_pool, credit);
1468                 return ENOMEM;
1469         }
1470
1471         /*
1472          * The CR (command/response) bit identifies the frame either as a
1473          * commmand or a response and is used along with the DLCI to form
1474          * the address. Commands contain the non-initiator address, whereas
1475          * responses contain the initiator address, so the CR value is
1476          * also dependent on the session direction.
1477          */
1478         if (type == RFCOMM_FRAME_UA || type == RFCOMM_FRAME_DM)
1479                 cr = IS_INITIATOR(rs) ? 0 : 1;
1480         else
1481                 cr = IS_INITIATOR(rs) ? 1 : 0;
1482
1483         hdr = mtod(m, struct rfcomm_cmd_hdr *);
1484         hdr->address = RFCOMM_MKADDRESS(cr, dlci);
1485         hdr->control = RFCOMM_MKCONTROL(type, 1);   /* PF = 1 */
1486         hdr->length = (0x00 << 1) | 0x01;           /* len = 0x00, EA = 1 */
1487
1488         fcs = 0xff;
1489         fcs = FCS(fcs, hdr->address);
1490         fcs = FCS(fcs, hdr->control);
1491         fcs = FCS(fcs, hdr->length);
1492         fcs = 0xff - fcs;       /* ones complement */
1493         hdr->fcs = fcs;
1494
1495         m->m_pkthdr.len = m->m_len = sizeof(struct rfcomm_cmd_hdr);
1496
1497         /* empty credit note */
1498         credit->rc_dlc = NULL;
1499         credit->rc_len = m->m_pkthdr.len;
1500         STAILQ_INSERT_TAIL(&rs->rs_credits, credit, rc_next);
1501
1502         DPRINTFN(5, "dlci %d type %2.2x (%d bytes, fcs=%#2.2x)\n",
1503                 dlci, type, m->m_pkthdr.len, fcs);
1504
1505         return l2cap_send(rs->rs_l2cap, m);
1506 }
1507
1508 /*
1509  * rfcomm_session_send_uih(rfcomm_session, rfcomm_dlc, credits, mbuf)
1510  *
1511  * UIH frame is per DLC data or Multiplexer Control Commands
1512  * when no DLC is given. Data mbuf is optional (just credits
1513  * will be sent in that case)
1514  */
1515 int
1516 rfcomm_session_send_uih(struct rfcomm_session *rs, struct rfcomm_dlc *dlc,
1517                         int credits, struct mbuf *m)
1518 {
1519         struct rfcomm_credit *credit;
1520         struct mbuf *m0 = NULL;
1521         int err, len;
1522         uint8_t fcs, *hdr;
1523
1524         KKASSERT(rs != NULL);
1525
1526         len = (m == NULL) ? 0 : m->m_pkthdr.len;
1527         KKASSERT(!(credits == 0 && len == 0));
1528
1529         /*
1530          * Make a credit note for the completion notification
1531          */
1532         credit = zalloc(rfcomm_credit_pool);
1533         if (credit == NULL)
1534                 goto nomem;
1535
1536         credit->rc_len = len;
1537         credit->rc_dlc = dlc;
1538
1539         /*
1540          * Wrap UIH frame information around payload.
1541          *
1542          * [ADDRESS] [CONTROL] [LENGTH] [CREDITS] [...] [FCS]
1543          *
1544          * Address is one octet.
1545          * Control is one octet.
1546          * Length is one or two octets.
1547          * Credits may be one octet.
1548          *
1549          * FCS is one octet and calculated on address and
1550          *      control octets only.
1551          *
1552          * If there are credits to be sent, we will set the PF
1553          * flag and include them in the frame.
1554          */
1555         m0 = m_gethdr(MB_DONTWAIT, MT_DATA);
1556         if (m0 == NULL)
1557                 goto nomem;
1558
1559         MH_ALIGN(m0, 5);        /* (max 5 header octets) */
1560         hdr = mtod(m0, uint8_t *);
1561
1562         /* CR bit is set according to the initiator of the session */
1563         *hdr = RFCOMM_MKADDRESS((IS_INITIATOR(rs) ? 1 : 0),
1564                                 (dlc ? dlc->rd_dlci : 0));
1565         fcs = FCS(0xff, *hdr);
1566         hdr++;
1567
1568         /* PF bit is set if credits are being sent */
1569         *hdr = RFCOMM_MKCONTROL(RFCOMM_FRAME_UIH, (credits > 0 ? 1 : 0));
1570         fcs = FCS(fcs, *hdr);
1571         hdr++;
1572
1573         if (len < (1 << 7)) {
1574                 *hdr++ = ((len << 1) & 0xfe) | 0x01;    /* 7 bits, EA = 1 */
1575         } else {
1576                 *hdr++ = ((len << 1) & 0xfe);           /* 7 bits, EA = 0 */
1577                 *hdr++ = ((len >> 7) & 0xff);           /* 8 bits, no EA */
1578         }
1579
1580         if (credits > 0)
1581                 *hdr++ = (uint8_t)credits;
1582
1583         m0->m_len = hdr - mtod(m0, uint8_t *);
1584
1585         /* Append payload */
1586         m0->m_next = m;
1587         m = NULL;
1588
1589         m0->m_pkthdr.len = m0->m_len + len;
1590
1591         /* Append FCS */
1592         fcs = 0xff - fcs;       /* ones complement */
1593         len = m0->m_pkthdr.len;
1594         m_copyback(m0, len, sizeof(fcs), &fcs);
1595         if (m0->m_pkthdr.len != len + sizeof(fcs))
1596                 goto nomem;
1597
1598         DPRINTFN(10, "dlci %d, pktlen %d (%d data, %d credits), fcs=%#2.2x\n",
1599                 dlc ? dlc->rd_dlci : 0, m0->m_pkthdr.len, credit->rc_len,
1600                 credits, fcs);
1601
1602         /*
1603          * UIH frame ready to go..
1604          */
1605         err = l2cap_send(rs->rs_l2cap, m0);
1606         if (err)
1607                 goto fail;
1608
1609         STAILQ_INSERT_TAIL(&rs->rs_credits, credit, rc_next);
1610         return 0;
1611
1612 nomem:
1613         err = ENOMEM;
1614
1615         if (m0 != NULL)
1616                 m_freem(m0);
1617
1618         if (m != NULL)
1619                 m_freem(m);
1620
1621 fail:
1622         if (credit != NULL)
1623                 zfree(rfcomm_credit_pool, credit);
1624
1625         return err;
1626 }
1627
1628 /*
1629  * send Multiplexer Control Command (or Response) on session
1630  */
1631 int
1632 rfcomm_session_send_mcc(struct rfcomm_session *rs, int cr,
1633                         uint8_t type, void *data, int len)
1634 {
1635         struct mbuf *m;
1636         uint8_t *hdr;
1637         int hlen;
1638
1639         m = m_gethdr(MB_DONTWAIT, MT_DATA);
1640         if (m == NULL)
1641                 return ENOMEM;
1642
1643         hdr = mtod(m, uint8_t *);
1644
1645         /*
1646          * Technically the type field can extend past one octet, but none
1647          * currently defined will do that.
1648          */
1649         *hdr++ = RFCOMM_MKMCC_TYPE(cr, type);
1650
1651         /*
1652          * In the frame, the max length size is 2 octets (15 bits) whereas
1653          * no max length size is specified for MCC commands. We must allow
1654          * for 3 octets since for MCC frames we use 7 bits + EA in each.
1655          *
1656          * Only test data can possibly be that big.
1657          *
1658          * XXX Should we check this against the MTU?
1659          */
1660         if (len < (1 << 7)) {
1661                 *hdr++ = ((len << 1) & 0xfe) | 0x01;    /* 7 bits, EA = 1 */
1662         } else if (len < (1 << 14)) {
1663                 *hdr++ = ((len << 1) & 0xfe);           /* 7 bits, EA = 0 */
1664                 *hdr++ = ((len >> 6) & 0xfe) | 0x01;    /* 7 bits, EA = 1 */
1665         } else if (len < (1 << 15)) {
1666                 *hdr++ = ((len << 1) & 0xfe);           /* 7 bits, EA = 0 */
1667                 *hdr++ = ((len >> 6) & 0xfe);           /* 7 bits, EA = 0 */
1668                 *hdr++ = ((len >> 13) & 0x02) | 0x01;   /* 1 bit,  EA = 1 */
1669         } else {
1670                 DPRINTF("incredible length! (%d)\n", len);
1671                 m_freem(m);
1672                 return EMSGSIZE;
1673         }
1674
1675         /*
1676          * add command data (to same mbuf if possible)
1677          */
1678         hlen = hdr - mtod(m, uint8_t *);
1679
1680         if (len > 0) {
1681                 m->m_pkthdr.len = m->m_len = MHLEN;
1682                 m_copyback(m, hlen, len, data);
1683                 if (m->m_pkthdr.len != max(MHLEN, hlen + len)) {
1684                         m_freem(m);
1685                         return ENOMEM;
1686                 }
1687         }
1688
1689         m->m_pkthdr.len = hlen + len;
1690         m->m_len = min(MHLEN, m->m_pkthdr.len);
1691
1692         DPRINTFN(5, "%s type %2.2x len %d\n",
1693                 (cr ? "command" : "response"), type, m->m_pkthdr.len);
1694
1695         return rfcomm_session_send_uih(rs, NULL, 0, m);
1696 }