1 /****************************************************************************** 2 * 3 * Copyright (C) 1999-2012 Broadcom Corporation 4 * 5 * Licensed under the Apache License, Version 2.0 (the "License"); 6 * you may not use this file except in compliance with the License. 7 * You may obtain a copy of the License at: 8 * 9 * http://www.apache.org/licenses/LICENSE-2.0 10 * 11 * Unless required by applicable law or agreed to in writing, software 12 * distributed under the License is distributed on an "AS IS" BASIS, 13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14 * See the License for the specific language governing permissions and 15 * limitations under the License. 16 * 17 ******************************************************************************/ 18 19 /***************************************************************************** 20 * 21 * This file contains collection of utility functions used the RFCOMM unit 22 * 23 *****************************************************************************/ 24 25 #include "bt_common.h" 26 #include "bt_target.h" 27 28 #include "bt_utils.h" 29 #include "btm_api.h" 30 #include "btm_int.h" 31 #include "btu.h" 32 #include "osi/include/osi.h" 33 #include "port_api.h" 34 #include "port_ext.h" 35 #include "port_int.h" 36 #include "rfc_int.h" 37 #include "rfcdefs.h" 38 39 #include <string.h> 40 41 extern fixed_queue_t* btu_general_alarm_queue; 42 43 /******************************************************************************* 44 * 45 * Function rfc_calc_fcs 46 * 47 * Description Reversed CRC Table , 8-bit, poly=0x07 48 * (GSM 07.10 TS 101 369 V6.3.0) 49 ******************************************************************************/ 50 static const uint8_t rfc_crctable[] = { 51 0x00, 0x91, 0xE3, 0x72, 0x07, 0x96, 0xE4, 0x75, 0x0E, 0x9F, 0xED, 52 0x7C, 0x09, 0x98, 0xEA, 0x7B, 0x1C, 0x8D, 0xFF, 0x6E, 0x1B, 0x8A, 53 0xF8, 0x69, 0x12, 0x83, 0xF1, 0x60, 0x15, 0x84, 0xF6, 0x67, 0x38, 54 0xA9, 0xDB, 0x4A, 0x3F, 0xAE, 0xDC, 0x4D, 0x36, 0xA7, 0xD5, 0x44, 55 0x31, 0xA0, 0xD2, 0x43, 0x24, 0xB5, 0xC7, 0x56, 0x23, 0xB2, 0xC0, 56 0x51, 0x2A, 0xBB, 0xC9, 0x58, 0x2D, 0xBC, 0xCE, 0x5F, 57 58 0x70, 0xE1, 0x93, 0x02, 0x77, 0xE6, 0x94, 0x05, 0x7E, 0xEF, 0x9D, 59 0x0C, 0x79, 0xE8, 0x9A, 0x0B, 0x6C, 0xFD, 0x8F, 0x1E, 0x6B, 0xFA, 60 0x88, 0x19, 0x62, 0xF3, 0x81, 0x10, 0x65, 0xF4, 0x86, 0x17, 0x48, 61 0xD9, 0xAB, 0x3A, 0x4F, 0xDE, 0xAC, 0x3D, 0x46, 0xD7, 0xA5, 0x34, 62 0x41, 0xD0, 0xA2, 0x33, 0x54, 0xC5, 0xB7, 0x26, 0x53, 0xC2, 0xB0, 63 0x21, 0x5A, 0xCB, 0xB9, 0x28, 0x5D, 0xCC, 0xBE, 0x2F, 64 65 0xE0, 0x71, 0x03, 0x92, 0xE7, 0x76, 0x04, 0x95, 0xEE, 0x7F, 0x0D, 66 0x9C, 0xE9, 0x78, 0x0A, 0x9B, 0xFC, 0x6D, 0x1F, 0x8E, 0xFB, 0x6A, 67 0x18, 0x89, 0xF2, 0x63, 0x11, 0x80, 0xF5, 0x64, 0x16, 0x87, 0xD8, 68 0x49, 0x3B, 0xAA, 0xDF, 0x4E, 0x3C, 0xAD, 0xD6, 0x47, 0x35, 0xA4, 69 0xD1, 0x40, 0x32, 0xA3, 0xC4, 0x55, 0x27, 0xB6, 0xC3, 0x52, 0x20, 70 0xB1, 0xCA, 0x5B, 0x29, 0xB8, 0xCD, 0x5C, 0x2E, 0xBF, 71 72 0x90, 0x01, 0x73, 0xE2, 0x97, 0x06, 0x74, 0xE5, 0x9E, 0x0F, 0x7D, 73 0xEC, 0x99, 0x08, 0x7A, 0xEB, 0x8C, 0x1D, 0x6F, 0xFE, 0x8B, 0x1A, 74 0x68, 0xF9, 0x82, 0x13, 0x61, 0xF0, 0x85, 0x14, 0x66, 0xF7, 0xA8, 75 0x39, 0x4B, 0xDA, 0xAF, 0x3E, 0x4C, 0xDD, 0xA6, 0x37, 0x45, 0xD4, 76 0xA1, 0x30, 0x42, 0xD3, 0xB4, 0x25, 0x57, 0xC6, 0xB3, 0x22, 0x50, 77 0xC1, 0xBA, 0x2B, 0x59, 0xC8, 0xBD, 0x2C, 0x5E, 0xCF}; 78 79 /******************************************************************************* 80 * 81 * Function rfc_calc_fcs 82 * 83 * Description This function calculate FCS for the RFCOMM frame 84 * (GSM 07.10 TS 101 369 V6.3.0) 85 * 86 * Input len - number of bytes in the message 87 * p - points to message 88 * 89 ******************************************************************************/ 90 uint8_t rfc_calc_fcs(uint16_t len, uint8_t* p) { 91 uint8_t fcs = 0xFF; 92 93 while (len--) { 94 fcs = rfc_crctable[fcs ^ *p++]; 95 } 96 97 /* Ones compliment */ 98 return (0xFF - fcs); 99 } 100 101 /******************************************************************************* 102 * 103 * Function rfc_check_fcs 104 * 105 * Description This function checks FCS for the RFCOMM frame 106 * (GSM 07.10 TS 101 369 V6.3.0) 107 * 108 * Input len - number of bytes in the message 109 * p - points to message 110 * received_fcs - received FCS 111 * 112 ******************************************************************************/ 113 bool rfc_check_fcs(uint16_t len, uint8_t* p, uint8_t received_fcs) { 114 uint8_t fcs = 0xFF; 115 116 while (len--) { 117 fcs = rfc_crctable[fcs ^ *p++]; 118 } 119 120 /* Ones compliment */ 121 fcs = rfc_crctable[fcs ^ received_fcs]; 122 123 /*0xCF is the reversed order of 11110011.*/ 124 return (fcs == 0xCF); 125 } 126 127 /******************************************************************************* 128 * 129 * Function rfc_alloc_multiplexer_channel 130 * 131 * Description This function returns existing or new control block for 132 * the BD_ADDR. 133 * 134 ******************************************************************************/ 135 tRFC_MCB* rfc_alloc_multiplexer_channel(BD_ADDR bd_addr, bool is_initiator) { 136 int i, j; 137 tRFC_MCB* p_mcb = NULL; 138 RFCOMM_TRACE_DEBUG( 139 "rfc_alloc_multiplexer_channel: bd_addr:%02x:%02x:%02x:%02x:%02x:%02x", 140 bd_addr[0], bd_addr[1], bd_addr[2], bd_addr[3], bd_addr[4], bd_addr[5]); 141 RFCOMM_TRACE_DEBUG("rfc_alloc_multiplexer_channel:is_initiator:%d", 142 is_initiator); 143 144 for (i = 0; i < MAX_BD_CONNECTIONS; i++) { 145 RFCOMM_TRACE_DEBUG( 146 "rfc_alloc_multiplexer_channel rfc_cb.port.rfc_mcb[%d].state:%d", i, 147 rfc_cb.port.rfc_mcb[i].state); 148 RFCOMM_TRACE_DEBUG( 149 "(rfc_cb.port.rfc_mcb[i].bd_addr:%02x:%02x:%02x:%02x:%02x:%02x", 150 rfc_cb.port.rfc_mcb[i].bd_addr[0], rfc_cb.port.rfc_mcb[i].bd_addr[1], 151 rfc_cb.port.rfc_mcb[i].bd_addr[2], rfc_cb.port.rfc_mcb[i].bd_addr[3], 152 rfc_cb.port.rfc_mcb[i].bd_addr[4], rfc_cb.port.rfc_mcb[i].bd_addr[5]); 153 154 if ((rfc_cb.port.rfc_mcb[i].state != RFC_MX_STATE_IDLE) && 155 (!memcmp(rfc_cb.port.rfc_mcb[i].bd_addr, bd_addr, BD_ADDR_LEN))) { 156 /* Multiplexer channel found do not change anything */ 157 /* If there was an inactivity timer running stop it now */ 158 if (rfc_cb.port.rfc_mcb[i].state == RFC_MX_STATE_CONNECTED) 159 rfc_timer_stop(&rfc_cb.port.rfc_mcb[i]); 160 RFCOMM_TRACE_DEBUG( 161 "rfc_alloc_multiplexer_channel:is_initiator:%d, found, state:%d, " 162 "p_mcb:%p", 163 is_initiator, rfc_cb.port.rfc_mcb[i].state, &rfc_cb.port.rfc_mcb[i]); 164 return (&rfc_cb.port.rfc_mcb[i]); 165 } 166 } 167 168 /* connection with bd_addr does not exist */ 169 for (i = 0, j = rfc_cb.rfc.last_mux + 1; i < MAX_BD_CONNECTIONS; i++, j++) { 170 if (j >= MAX_BD_CONNECTIONS) j = 0; 171 172 p_mcb = &rfc_cb.port.rfc_mcb[j]; 173 if (rfc_cb.port.rfc_mcb[j].state == RFC_MX_STATE_IDLE) { 174 /* New multiplexer control block */ 175 alarm_free(p_mcb->mcb_timer); 176 fixed_queue_free(p_mcb->cmd_q, NULL); 177 memset(p_mcb, 0, sizeof(tRFC_MCB)); 178 memcpy(p_mcb->bd_addr, bd_addr, BD_ADDR_LEN); 179 RFCOMM_TRACE_DEBUG( 180 "rfc_alloc_multiplexer_channel:is_initiator:%d, create new p_mcb:%p, " 181 "index:%d", 182 is_initiator, &rfc_cb.port.rfc_mcb[j], j); 183 184 p_mcb->mcb_timer = alarm_new("rfcomm_mcb.mcb_timer"); 185 p_mcb->cmd_q = fixed_queue_new(SIZE_MAX); 186 187 p_mcb->is_initiator = is_initiator; 188 189 rfc_timer_start(p_mcb, RFC_MCB_INIT_INACT_TIMER); 190 191 rfc_cb.rfc.last_mux = (uint8_t)j; 192 return (p_mcb); 193 } 194 } 195 return (NULL); 196 } 197 198 /******************************************************************************* 199 * 200 * Function rfc_release_multiplexer_channel 201 * 202 * Description Release a multiplexer control block 203 * 204 ******************************************************************************/ 205 void rfc_release_multiplexer_channel(tRFC_MCB* p_mcb) { 206 /* Remove the MCB from the mapping table */ 207 rfc_save_lcid_mcb(NULL, p_mcb->lcid); 208 209 /* Remove the MCB from the ports */ 210 for (int i = 0; i < MAX_RFC_PORTS; i++) { 211 if (rfc_cb.port.port[i].rfc.p_mcb == p_mcb) 212 rfc_cb.port.port[i].rfc.p_mcb = NULL; 213 } 214 215 rfc_timer_stop(p_mcb); 216 alarm_free(p_mcb->mcb_timer); 217 218 fixed_queue_free(p_mcb->cmd_q, osi_free); 219 220 memset(p_mcb, 0, sizeof(tRFC_MCB)); 221 p_mcb->state = RFC_MX_STATE_IDLE; 222 } 223 224 /******************************************************************************* 225 * 226 * Function rfc_timer_start 227 * 228 * Description Start RFC Timer 229 * 230 ******************************************************************************/ 231 void rfc_timer_start(tRFC_MCB* p_mcb, uint16_t timeout) { 232 RFCOMM_TRACE_EVENT("%s - timeout:%d seconds", __func__, timeout); 233 234 period_ms_t interval_ms = timeout * 1000; 235 alarm_set_on_queue(p_mcb->mcb_timer, interval_ms, rfcomm_mcb_timer_timeout, 236 p_mcb, btu_general_alarm_queue); 237 } 238 239 /******************************************************************************* 240 * 241 * Function rfc_timer_stop 242 * 243 * Description Stop RFC Timer 244 * 245 ******************************************************************************/ 246 void rfc_timer_stop(tRFC_MCB* p_mcb) { 247 RFCOMM_TRACE_EVENT("%s", __func__); 248 249 alarm_cancel(p_mcb->mcb_timer); 250 } 251 252 /******************************************************************************* 253 * 254 * Function rfc_port_timer_start 255 * 256 * Description Start RFC Timer 257 * 258 ******************************************************************************/ 259 void rfc_port_timer_start(tPORT* p_port, uint16_t timeout) { 260 RFCOMM_TRACE_EVENT("%s - timeout:%d seconds", __func__, timeout); 261 262 period_ms_t interval_ms = timeout * 1000; 263 alarm_set_on_queue(p_port->rfc.port_timer, interval_ms, 264 rfcomm_port_timer_timeout, p_port, 265 btu_general_alarm_queue); 266 } 267 268 /******************************************************************************* 269 * 270 * Function rfc_port_timer_stop 271 * 272 * Description Stop RFC Timer 273 * 274 ******************************************************************************/ 275 void rfc_port_timer_stop(tPORT* p_port) { 276 RFCOMM_TRACE_EVENT("%s", __func__); 277 278 alarm_cancel(p_port->rfc.port_timer); 279 } 280 281 /******************************************************************************* 282 * 283 * Function rfc_check_mcb_active 284 * 285 * Description Check if there are any opened ports on the MCB if not 286 * start MCB Inact timer. 287 * 288 * Returns void 289 * 290 ******************************************************************************/ 291 void rfc_check_mcb_active(tRFC_MCB* p_mcb) { 292 uint16_t i; 293 294 for (i = 0; i < RFCOMM_MAX_DLCI; i++) { 295 if (p_mcb->port_inx[i] != 0) { 296 p_mcb->is_disc_initiator = false; 297 return; 298 } 299 } 300 /* The last port was DISCed. On the client side start disconnecting Mx */ 301 /* On the server side start inactivity timer */ 302 if (p_mcb->is_disc_initiator) { 303 p_mcb->is_disc_initiator = false; 304 rfc_mx_sm_execute(p_mcb, RFC_MX_EVENT_CLOSE_REQ, NULL); 305 } else 306 rfc_timer_start(p_mcb, RFC_MCB_RELEASE_INACT_TIMER); 307 } 308 309 void rfcomm_port_timer_timeout(void* data) { 310 tPORT* p_port = (tPORT*)data; 311 312 rfc_port_sm_execute(p_port, RFC_EVENT_TIMEOUT, NULL); 313 } 314 315 void rfcomm_mcb_timer_timeout(void* data) { 316 tRFC_MCB* p_mcb = (tRFC_MCB*)data; 317 318 rfc_mx_sm_execute(p_mcb, RFC_EVENT_TIMEOUT, NULL); 319 } 320 321 /******************************************************************************* 322 * 323 * Function rfc_sec_check_complete 324 * 325 * Description The function called when Security Manager finishes 326 * verification of the service side connection 327 * 328 * Returns void 329 * 330 ******************************************************************************/ 331 void rfc_sec_check_complete(UNUSED_ATTR BD_ADDR bd_addr, 332 UNUSED_ATTR tBT_TRANSPORT transport, 333 void* p_ref_data, uint8_t res) { 334 tPORT* p_port = (tPORT*)p_ref_data; 335 336 /* Verify that PORT is still waiting for Security to complete */ 337 if (!p_port->in_use || 338 ((p_port->rfc.state != RFC_STATE_ORIG_WAIT_SEC_CHECK) && 339 (p_port->rfc.state != RFC_STATE_TERM_WAIT_SEC_CHECK))) 340 return; 341 342 rfc_port_sm_execute((tPORT*)p_ref_data, RFC_EVENT_SEC_COMPLETE, &res); 343 } 344 345 /******************************************************************************* 346 * 347 * Function rfc_port_closed 348 * 349 * Description The function is called when port is released based on the 350 * event received from the lower layer, typically L2CAP 351 * connection down, DISC, or DM frame. 352 * 353 * Returns void 354 * 355 ******************************************************************************/ 356 void rfc_port_closed(tPORT* p_port) { 357 tRFC_MCB* p_mcb = p_port->rfc.p_mcb; 358 359 RFCOMM_TRACE_DEBUG("rfc_port_closed"); 360 361 rfc_port_timer_stop(p_port); 362 363 p_port->rfc.state = RFC_STATE_CLOSED; 364 365 /* If multiplexer channel was up mark it as down */ 366 if (p_mcb) { 367 p_mcb->port_inx[p_port->dlci] = 0; 368 369 /* If there are no more ports opened on this MCB release it */ 370 rfc_check_mcb_active(p_mcb); 371 } 372 373 /* Notify port that RFC connection is gone */ 374 port_rfc_closed(p_port, PORT_CLOSED); 375 } 376 377 /******************************************************************************* 378 * 379 * Function rfc_inc_credit 380 * 381 * Description The function is called when a credit is received in a UIH 382 * frame. It increments the TX credit count, and if data 383 * flow had halted, it restarts it. 384 * 385 * Returns void 386 * 387 ******************************************************************************/ 388 void rfc_inc_credit(tPORT* p_port, uint8_t credit) { 389 if (p_port->rfc.p_mcb->flow == PORT_FC_CREDIT) { 390 p_port->credit_tx += credit; 391 392 RFCOMM_TRACE_EVENT("rfc_inc_credit:%d", p_port->credit_tx); 393 394 if (p_port->tx.peer_fc == true) 395 PORT_FlowInd(p_port->rfc.p_mcb, p_port->dlci, true); 396 } 397 } 398 399 /******************************************************************************* 400 * 401 * Function rfc_dec_credit 402 * 403 * Description The function is called when a UIH frame of user data is 404 * sent. It decrements the credit count. If credit count 405 * Reaches zero, peer_fc is set. 406 * 407 * Returns void 408 * 409 ******************************************************************************/ 410 void rfc_dec_credit(tPORT* p_port) { 411 if (p_port->rfc.p_mcb->flow == PORT_FC_CREDIT) { 412 if (p_port->credit_tx > 0) p_port->credit_tx--; 413 414 if (p_port->credit_tx == 0) p_port->tx.peer_fc = true; 415 } 416 } 417 418 /******************************************************************************* 419 * 420 * Function rfc_check_send_cmd 421 * 422 * Description This function is called to send an RFCOMM command message 423 * or to handle the RFCOMM command message queue. 424 * 425 * Returns void 426 * 427 ******************************************************************************/ 428 void rfc_check_send_cmd(tRFC_MCB* p_mcb, BT_HDR* p_buf) { 429 /* if passed a buffer queue it */ 430 if (p_buf != NULL) { 431 if (p_mcb->cmd_q == NULL) { 432 RFCOMM_TRACE_ERROR( 433 "%s: empty queue: p_mcb = %p p_mcb->lcid = %u cached p_mcb = %p", 434 __func__, p_mcb, p_mcb->lcid, rfc_find_lcid_mcb(p_mcb->lcid)); 435 } 436 fixed_queue_enqueue(p_mcb->cmd_q, p_buf); 437 } 438 439 /* handle queue if L2CAP not congested */ 440 while (p_mcb->l2cap_congested == false) { 441 BT_HDR* p = (BT_HDR*)fixed_queue_try_dequeue(p_mcb->cmd_q); 442 if (p == NULL) break; 443 L2CA_DataWrite(p_mcb->lcid, p); 444 } 445 } 446
