net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/kernel.h>
  31 #include <linux/sched.h>
  32 #include <linux/signal.h>
  33 #include <linux/init.h>
  34 #include <linux/wait.h>
  35 #include <linux/device.h>
  36 #include <linux/net.h>
  37 #include <linux/mutex.h>
  38 #include <linux/kthread.h>
  39
  40 #include <net/sock.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/unaligned.h>
  43
  44 #include <net/bluetooth/bluetooth.h>
  45 #include <net/bluetooth/hci_core.h>
  46 #include <net/bluetooth/l2cap.h>
  47 #include <net/bluetooth/rfcomm.h>
  48
  49 #define VERSION "1.11"
  50
  51 static int disable_cfc = 0;
  52 static int channel_mtu = -1;
  53 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  54 static int l2cap_ertm = 0;
  55
  56 static struct task_struct *rfcomm_thread;
  57
  58 static DEFINE_MUTEX(rfcomm_mutex);
  59 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  60 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  61
  62 static unsigned long rfcomm_event;
  63
  64 static LIST_HEAD(session_list);
  65
  66 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  67 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  68 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  69 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  70 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  71 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  72 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  73 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  74 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  75 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  76
  77 static void rfcomm_process_connect(struct rfcomm_session *s);
  78
  79 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
  80 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  81 static void rfcomm_session_del(struct rfcomm_session *s);
  82
  83 /* ---- RFCOMM frame parsing macros ---- */
  84 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  85 #define __get_channel(b)  ((b & 0xf8) >> 3)
  86 #define __get_dir(b)      ((b & 0x04) >> 2)
  87 #define __get_type(b)     ((b & 0xef))
  88
  89 #define __test_ea(b)      ((b & 0x01))
  90 #define __test_cr(b)      ((b & 0x02))
  91 #define __test_pf(b)      ((b & 0x10))
  92
  93 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  94 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  95 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  96 #define __srv_channel(dlci)    (dlci >> 1)
  97 #define __dir(dlci)            (dlci & 0x01)
  98
  99 #define __len8(len)       (((len) << 1) | 1)
 100 #define __len16(len)      ((len) << 1)
 101
 102 /* MCC macros */
 103 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 104 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 105 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 106
 107 /* RPN macros */
 108 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 109 #define __get_rpn_data_bits(line) ((line) & 0x3)
 110 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 111 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 112
 113 static inline void rfcomm_schedule(uint event)
 114 {
 115         if (!rfcomm_thread)
 116                 return;
 117         //set_bit(event, &rfcomm_event);
 118         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
 119         wake_up_process(rfcomm_thread);
 120 }
 121
 122 static inline void rfcomm_session_put(struct rfcomm_session *s)
 123 {
 124         if (atomic_dec_and_test(&s->refcnt))
 125                 rfcomm_session_del(s);
 126 }
 127
 128 /* ---- RFCOMM FCS computation ---- */
 129
 130 /* reversed, 8-bit, poly=0x07 */
 131 static unsigned char rfcomm_crc_table[256] = {
 132         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 133         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 134         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 135         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 136
 137         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 138         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 139         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 140         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 141
 142         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 143         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 144         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 145         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 146
 147         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 148         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 149         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 150         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 151
 152         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 153         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 154         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 155         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 156
 157         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 158         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 159         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 160         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 161
 162         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 163         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 164         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 165         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 166
 167         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 168         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 169         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 170         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 171 };
 172
 173 /* CRC on 2 bytes */
 174 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 175
 176 /* FCS on 2 bytes */
 177 static inline u8 __fcs(u8 *data)
 178 {
 179         return (0xff - __crc(data));
 180 }
 181
 182 /* FCS on 3 bytes */
 183 static inline u8 __fcs2(u8 *data)
 184 {
 185         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 186 }
 187
 188 /* Check FCS */
 189 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 190 {
 191         u8 f = __crc(data);
 192
 193         if (type != RFCOMM_UIH)
 194                 f = rfcomm_crc_table[f ^ data[2]];
 195
 196         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 197 }
 198
 199 /* ---- L2CAP callbacks ---- */
 200 static void rfcomm_l2state_change(struct sock *sk)
 201 {
 202         BT_DBG("%p state %d", sk, sk->sk_state);
 203         rfcomm_schedule(RFCOMM_SCHED_STATE);
 204 }
 205
 206 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 207 {
 208         BT_DBG("%p bytes %d", sk, bytes);
 209         rfcomm_schedule(RFCOMM_SCHED_RX);
 210 }
 211
 212 static int rfcomm_l2sock_create(struct socket **sock)
 213 {
 214         int err;
 215
 216         BT_DBG("");
 217
 218         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 219         if (!err) {
 220                 struct sock *sk = (*sock)->sk;
 221                 sk->sk_data_ready   = rfcomm_l2data_ready;
 222                 sk->sk_state_change = rfcomm_l2state_change;
 223         }
 224         return err;
 225 }
 226
 227 static inline int rfcomm_check_security(struct rfcomm_dlc *d)
 228 {
 229         struct sock *sk = d->session->sock->sk;
 230         __u8 auth_type;
 231
 232         switch (d->sec_level) {
 233         case BT_SECURITY_HIGH:
 234                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
 235                 break;
 236         case BT_SECURITY_MEDIUM:
 237                 auth_type = HCI_AT_GENERAL_BONDING;
 238                 break;
 239         default:
 240                 auth_type = HCI_AT_NO_BONDING;
 241                 break;
 242         }
 243
 244         return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level,
 245                                                                 auth_type);
 246 }
 247
 248 static void rfcomm_session_timeout(unsigned long arg)
 249 {
 250         struct rfcomm_session *s = (void *) arg;
 251
 252         BT_DBG("session %p state %ld", s, s->state);
 253
 254         set_bit(RFCOMM_TIMED_OUT, &s->flags);
 255         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 256 }
 257
 258 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 259 {
 260         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 261
 262         if (!mod_timer(&s->timer, jiffies + timeout))
 263                 rfcomm_session_hold(s);
 264 }
 265
 266 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 267 {
 268         BT_DBG("session %p state %ld", s, s->state);
 269
 270         if (timer_pending(&s->timer) && del_timer(&s->timer))
 271                 rfcomm_session_put(s);
 272 }
 273
 274 /* ---- RFCOMM DLCs ---- */
 275 static void rfcomm_dlc_timeout(unsigned long arg)
 276 {
 277         struct rfcomm_dlc *d = (void *) arg;
 278
 279         BT_DBG("dlc %p state %ld", d, d->state);
 280
 281         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 282         rfcomm_dlc_put(d);
 283         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 284 }
 285
 286 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 287 {
 288         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 289
 290         if (!mod_timer(&d->timer, jiffies + timeout))
 291                 rfcomm_dlc_hold(d);
 292 }
 293
 294 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 295 {
 296         BT_DBG("dlc %p state %ld", d, d->state);
 297
 298         if (timer_pending(&d->timer) && del_timer(&d->timer))
 299                 rfcomm_dlc_put(d);
 300 }
 301
 302 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 303 {
 304         BT_DBG("%p", d);
 305
 306         d->state      = BT_OPEN;
 307         d->flags      = 0;
 308         d->mscex      = 0;
 309         d->mtu        = RFCOMM_DEFAULT_MTU;
 310         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 311
 312         d->cfc        = RFCOMM_CFC_DISABLED;
 313         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 314 }
 315
 316 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 317 {
 318         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 319
 320         if (!d)
 321                 return NULL;
 322
 323         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 324
 325         skb_queue_head_init(&d->tx_queue);
 326         spin_lock_init(&d->lock);
 327         atomic_set(&d->refcnt, 1);
 328
 329         rfcomm_dlc_clear_state(d);
 330
 331         BT_DBG("%p", d);
 332
 333         return d;
 334 }
 335
 336 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 337 {
 338         BT_DBG("%p", d);
 339
 340         skb_queue_purge(&d->tx_queue);
 341         kfree(d);
 342 }
 343
 344 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 345 {
 346         BT_DBG("dlc %p session %p", d, s);
 347
 348         rfcomm_session_hold(s);
 349
 350         rfcomm_session_clear_timer(s);
 351         rfcomm_dlc_hold(d);
 352         list_add(&d->list, &s->dlcs);
 353         d->session = s;
 354 }
 355
 356 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 357 {
 358         struct rfcomm_session *s = d->session;
 359
 360         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 361
 362         list_del(&d->list);
 363         d->session = NULL;
 364         rfcomm_dlc_put(d);
 365
 366         if (list_empty(&s->dlcs))
 367                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
 368
 369         rfcomm_session_put(s);
 370 }
 371
 372 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 373 {
 374         struct rfcomm_dlc *d;
 375         struct list_head *p;
 376
 377         list_for_each(p, &s->dlcs) {
 378                 d = list_entry(p, struct rfcomm_dlc, list);
 379                 if (d->dlci == dlci)
 380                         return d;
 381         }
 382         return NULL;
 383 }
 384
 385 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 386 {
 387         struct rfcomm_session *s;
 388         int err = 0;
 389         u8 dlci;
 390
 391         BT_DBG("dlc %p state %ld %s %s channel %d",
 392                         d, d->state, batostr(src), batostr(dst), channel);
 393
 394         if (channel < 1 || channel > 30)
 395                 return -EINVAL;
 396
 397         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 398                 return 0;
 399
 400         s = rfcomm_session_get(src, dst);
 401         if (!s) {
 402                 s = rfcomm_session_create(src, dst, &err);
 403                 if (!s)
 404                         return err;
 405         }
 406
 407         dlci = __dlci(!s->initiator, channel);
 408
 409         /* Check if DLCI already exists */
 410         if (rfcomm_dlc_get(s, dlci))
 411                 return -EBUSY;
 412
 413         rfcomm_dlc_clear_state(d);
 414
 415         d->dlci     = dlci;
 416         d->addr     = __addr(s->initiator, dlci);
 417         d->priority = 7;
 418
 419         d->state = BT_CONFIG;
 420         rfcomm_dlc_link(s, d);
 421
 422         d->out = 1;
 423
 424         d->mtu = s->mtu;
 425         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 426
 427         if (s->state == BT_CONNECTED) {
 428                 if (rfcomm_check_security(d))
 429                         rfcomm_send_pn(s, 1, d);
 430                 else
 431                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 432         }
 433
 434         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 435
 436         return 0;
 437 }
 438
 439 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 440 {
 441         int r;
 442
 443         rfcomm_lock();
 444
 445         r = __rfcomm_dlc_open(d, src, dst, channel);
 446
 447         rfcomm_unlock();
 448         return r;
 449 }
 450
 451 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 452 {
 453         struct rfcomm_session *s = d->session;
 454         if (!s)
 455                 return 0;
 456
 457         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 458                         d, d->state, d->dlci, err, s);
 459
 460         switch (d->state) {
 461         case BT_CONNECT:
 462         case BT_CONFIG:
 463                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 464                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 465                         rfcomm_schedule(RFCOMM_SCHED_AUTH);
 466                         break;
 467                 }
 468                 /* Fall through */
 469
 470         case BT_CONNECTED:
 471                 d->state = BT_DISCONN;
 472                 if (skb_queue_empty(&d->tx_queue)) {
 473                         rfcomm_send_disc(s, d->dlci);
 474                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 475                 } else {
 476                         rfcomm_queue_disc(d);
 477                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 478                 }
 479                 break;
 480
 481         case BT_OPEN:
 482         case BT_CONNECT2:
 483                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 484                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 485                         rfcomm_schedule(RFCOMM_SCHED_AUTH);
 486                         break;
 487                 }
 488                 /* Fall through */
 489
 490         default:
 491                 rfcomm_dlc_clear_timer(d);
 492
 493                 rfcomm_dlc_lock(d);
 494                 d->state = BT_CLOSED;
 495                 d->state_change(d, err);
 496                 rfcomm_dlc_unlock(d);
 497
 498                 skb_queue_purge(&d->tx_queue);
 499                 rfcomm_dlc_unlink(d);
 500         }
 501
 502         return 0;
 503 }
 504
 505 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 506 {
 507         int r;
 508
 509         rfcomm_lock();
 510
 511         r = __rfcomm_dlc_close(d, err);
 512
 513         rfcomm_unlock();
 514         return r;
 515 }
 516
 517 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 518 {
 519         int len = skb->len;
 520
 521         if (d->state != BT_CONNECTED)
 522                 return -ENOTCONN;
 523
 524         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 525
 526         if (len > d->mtu)
 527                 return -EINVAL;
 528
 529         rfcomm_make_uih(skb, d->addr);
 530         skb_queue_tail(&d->tx_queue, skb);
 531
 532         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 533                 rfcomm_schedule(RFCOMM_SCHED_TX);
 534         return len;
 535 }
 536
 537 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 538 {
 539         BT_DBG("dlc %p state %ld", d, d->state);
 540
 541         if (!d->cfc) {
 542                 d->v24_sig |= RFCOMM_V24_FC;
 543                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 544         }
 545         rfcomm_schedule(RFCOMM_SCHED_TX);
 546 }
 547
 548 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 549 {
 550         BT_DBG("dlc %p state %ld", d, d->state);
 551
 552         if (!d->cfc) {
 553                 d->v24_sig &= ~RFCOMM_V24_FC;
 554                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 555         }
 556         rfcomm_schedule(RFCOMM_SCHED_TX);
 557 }
 558
 559 /*
 560    Set/get modem status functions use _local_ status i.e. what we report
 561    to the other side.
 562    Remote status is provided by dlc->modem_status() callback.
 563  */
 564 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 565 {
 566         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 567                         d, d->state, v24_sig);
 568
 569         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 570                 v24_sig |= RFCOMM_V24_FC;
 571         else
 572                 v24_sig &= ~RFCOMM_V24_FC;
 573
 574         d->v24_sig = v24_sig;
 575
 576         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 577                 rfcomm_schedule(RFCOMM_SCHED_TX);
 578
 579         return 0;
 580 }
 581
 582 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 583 {
 584         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 585                         d, d->state, d->v24_sig);
 586
 587         *v24_sig = d->v24_sig;
 588         return 0;
 589 }
 590
 591 /* ---- RFCOMM sessions ---- */
 592 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 593 {
 594         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 595
 596         if (!s)
 597                 return NULL;
 598
 599         BT_DBG("session %p sock %p", s, sock);
 600
 601         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
 602
 603         INIT_LIST_HEAD(&s->dlcs);
 604         s->state = state;
 605         s->sock  = sock;
 606
 607         s->mtu = RFCOMM_DEFAULT_MTU;
 608         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 609
 610         /* Do not increment module usage count for listening sessions.
 611          * Otherwise we won't be able to unload the module. */
 612         if (state != BT_LISTEN)
 613                 if (!try_module_get(THIS_MODULE)) {
 614                         kfree(s);
 615                         return NULL;
 616                 }
 617
 618         list_add(&s->list, &session_list);
 619
 620         return s;
 621 }
 622
 623 static void rfcomm_session_del(struct rfcomm_session *s)
 624 {
 625         int state = s->state;
 626
 627         BT_DBG("session %p state %ld", s, s->state);
 628
 629         list_del(&s->list);
 630
 631         if (state == BT_CONNECTED)
 632                 rfcomm_send_disc(s, 0);
 633
 634         rfcomm_session_clear_timer(s);
 635         sock_release(s->sock);
 636         kfree(s);
 637
 638         if (state != BT_LISTEN)
 639                 module_put(THIS_MODULE);
 640 }
 641
 642 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 643 {
 644         struct rfcomm_session *s;
 645         struct list_head *p, *n;
 646         struct bt_sock *sk;
 647         list_for_each_safe(p, n, &session_list) {
 648                 s = list_entry(p, struct rfcomm_session, list);
 649                 sk = bt_sk(s->sock->sk);
 650
 651                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 652                                 !bacmp(&sk->dst, dst))
 653                         return s;
 654         }
 655         return NULL;
 656 }
 657
 658 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 659 {
 660         struct rfcomm_dlc *d;
 661         struct list_head *p, *n;
 662
 663         BT_DBG("session %p state %ld err %d", s, s->state, err);
 664
 665         rfcomm_session_hold(s);
 666
 667         s->state = BT_CLOSED;
 668
 669         /* Close all dlcs */
 670         list_for_each_safe(p, n, &s->dlcs) {
 671                 d = list_entry(p, struct rfcomm_dlc, list);
 672                 d->state = BT_CLOSED;
 673                 __rfcomm_dlc_close(d, err);
 674         }
 675
 676         rfcomm_session_clear_timer(s);
 677         rfcomm_session_put(s);
 678 }
 679
 680 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 681 {
 682         struct rfcomm_session *s = NULL;
 683         struct sockaddr_l2 addr;
 684         struct socket *sock;
 685         struct sock *sk;
 686
 687         BT_DBG("%s %s", batostr(src), batostr(dst));
 688
 689         *err = rfcomm_l2sock_create(&sock);
 690         if (*err < 0)
 691                 return NULL;
 692
 693         bacpy(&addr.l2_bdaddr, src);
 694         addr.l2_family = AF_BLUETOOTH;
 695         addr.l2_psm    = 0;
 696         addr.l2_cid    = 0;
 697         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 698         if (*err < 0)
 699                 goto failed;
 700
 701         /* Set L2CAP options */
 702         sk = sock->sk;
 703         lock_sock(sk);
 704         l2cap_pi(sk)->imtu = l2cap_mtu;
 705         if (l2cap_ertm)
 706                 l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
 707         release_sock(sk);
 708
 709         s = rfcomm_session_add(sock, BT_BOUND);
 710         if (!s) {
 711                 *err = -ENOMEM;
 712                 goto failed;
 713         }
 714
 715         s->initiator = 1;
 716
 717         bacpy(&addr.l2_bdaddr, dst);
 718         addr.l2_family = AF_BLUETOOTH;
 719         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
 720         addr.l2_cid    = 0;
 721         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 722         if (*err == 0 || *err == -EINPROGRESS)
 723                 return s;
 724
 725         rfcomm_session_del(s);
 726         return NULL;
 727
 728 failed:
 729         sock_release(sock);
 730         return NULL;
 731 }
 732
 733 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 734 {
 735         struct sock *sk = s->sock->sk;
 736         if (src)
 737                 bacpy(src, &bt_sk(sk)->src);
 738         if (dst)
 739                 bacpy(dst, &bt_sk(sk)->dst);
 740 }
 741
 742 /* ---- RFCOMM frame sending ---- */
 743 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 744 {
 745         struct socket *sock = s->sock;
 746         struct kvec iv = { data, len };
 747         struct msghdr msg;
 748
 749         BT_DBG("session %p len %d", s, len);
 750
 751         memset(&msg, 0, sizeof(msg));
 752
 753         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 754 }
 755
 756 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 757 {
 758         struct rfcomm_cmd cmd;
 759
 760         BT_DBG("%p dlci %d", s, dlci);
 761
 762         cmd.addr = __addr(s->initiator, dlci);
 763         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 764         cmd.len  = __len8(0);
 765         cmd.fcs  = __fcs2((u8 *) &cmd);
 766
 767         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 768 }
 769
 770 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 771 {
 772         struct rfcomm_cmd cmd;
 773
 774         BT_DBG("%p dlci %d", s, dlci);
 775
 776         cmd.addr = __addr(!s->initiator, dlci);
 777         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 778         cmd.len  = __len8(0);
 779         cmd.fcs  = __fcs2((u8 *) &cmd);
 780
 781         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 782 }
 783
 784 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 785 {
 786         struct rfcomm_cmd cmd;
 787
 788         BT_DBG("%p dlci %d", s, dlci);
 789
 790         cmd.addr = __addr(s->initiator, dlci);
 791         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 792         cmd.len  = __len8(0);
 793         cmd.fcs  = __fcs2((u8 *) &cmd);
 794
 795         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 796 }
 797
 798 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 799 {
 800         struct rfcomm_cmd *cmd;
 801         struct sk_buff *skb;
 802
 803         BT_DBG("dlc %p dlci %d", d, d->dlci);
 804
 805         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 806         if (!skb)
 807                 return -ENOMEM;
 808
 809         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 810         cmd->addr = d->addr;
 811         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 812         cmd->len  = __len8(0);
 813         cmd->fcs  = __fcs2((u8 *) cmd);
 814
 815         skb_queue_tail(&d->tx_queue, skb);
 816         rfcomm_schedule(RFCOMM_SCHED_TX);
 817         return 0;
 818 }
 819
 820 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 821 {
 822         struct rfcomm_cmd cmd;
 823
 824         BT_DBG("%p dlci %d", s, dlci);
 825
 826         cmd.addr = __addr(!s->initiator, dlci);
 827         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 828         cmd.len  = __len8(0);
 829         cmd.fcs  = __fcs2((u8 *) &cmd);
 830
 831         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 832 }
 833
 834 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 835 {
 836         struct rfcomm_hdr *hdr;
 837         struct rfcomm_mcc *mcc;
 838         u8 buf[16], *ptr = buf;
 839
 840         BT_DBG("%p cr %d type %d", s, cr, type);
 841
 842         hdr = (void *) ptr; ptr += sizeof(*hdr);
 843         hdr->addr = __addr(s->initiator, 0);
 844         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 845         hdr->len  = __len8(sizeof(*mcc) + 1);
 846
 847         mcc = (void *) ptr; ptr += sizeof(*mcc);
 848         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 849         mcc->len  = __len8(1);
 850
 851         /* Type that we didn't like */
 852         *ptr = __mcc_type(cr, type); ptr++;
 853
 854         *ptr = __fcs(buf); ptr++;
 855
 856         return rfcomm_send_frame(s, buf, ptr - buf);
 857 }
 858
 859 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 860 {
 861         struct rfcomm_hdr *hdr;
 862         struct rfcomm_mcc *mcc;
 863         struct rfcomm_pn  *pn;
 864         u8 buf[16], *ptr = buf;
 865
 866         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 867
 868         hdr = (void *) ptr; ptr += sizeof(*hdr);
 869         hdr->addr = __addr(s->initiator, 0);
 870         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 871         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 872
 873         mcc = (void *) ptr; ptr += sizeof(*mcc);
 874         mcc->type = __mcc_type(cr, RFCOMM_PN);
 875         mcc->len  = __len8(sizeof(*pn));
 876
 877         pn = (void *) ptr; ptr += sizeof(*pn);
 878         pn->dlci        = d->dlci;
 879         pn->priority    = d->priority;
 880         pn->ack_timer   = 0;
 881         pn->max_retrans = 0;
 882
 883         if (s->cfc) {
 884                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 885                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 886         } else {
 887                 pn->flow_ctrl = 0;
 888                 pn->credits   = 0;
 889         }
 890
 891         if (cr && channel_mtu >= 0)
 892                 pn->mtu = cpu_to_le16(channel_mtu);
 893         else
 894                 pn->mtu = cpu_to_le16(d->mtu);
 895
 896         *ptr = __fcs(buf); ptr++;
 897
 898         return rfcomm_send_frame(s, buf, ptr - buf);
 899 }
 900
 901 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 902                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 903                         u8 parity, u8 flow_ctrl_settings,
 904                         u8 xon_char, u8 xoff_char, u16 param_mask)
 905 {
 906         struct rfcomm_hdr *hdr;
 907         struct rfcomm_mcc *mcc;
 908         struct rfcomm_rpn *rpn;
 909         u8 buf[16], *ptr = buf;
 910
 911         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 912                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 913                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 914                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 915
 916         hdr = (void *) ptr; ptr += sizeof(*hdr);
 917         hdr->addr = __addr(s->initiator, 0);
 918         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 919         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 920
 921         mcc = (void *) ptr; ptr += sizeof(*mcc);
 922         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 923         mcc->len  = __len8(sizeof(*rpn));
 924
 925         rpn = (void *) ptr; ptr += sizeof(*rpn);
 926         rpn->dlci          = __addr(1, dlci);
 927         rpn->bit_rate      = bit_rate;
 928         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 929         rpn->flow_ctrl     = flow_ctrl_settings;
 930         rpn->xon_char      = xon_char;
 931         rpn->xoff_char     = xoff_char;
 932         rpn->param_mask    = cpu_to_le16(param_mask);
 933
 934         *ptr = __fcs(buf); ptr++;
 935
 936         return rfcomm_send_frame(s, buf, ptr - buf);
 937 }
 938
 939 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 940 {
 941         struct rfcomm_hdr *hdr;
 942         struct rfcomm_mcc *mcc;
 943         struct rfcomm_rls *rls;
 944         u8 buf[16], *ptr = buf;
 945
 946         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 947
 948         hdr = (void *) ptr; ptr += sizeof(*hdr);
 949         hdr->addr = __addr(s->initiator, 0);
 950         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 951         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 952
 953         mcc = (void *) ptr; ptr += sizeof(*mcc);
 954         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 955         mcc->len  = __len8(sizeof(*rls));
 956
 957         rls = (void *) ptr; ptr += sizeof(*rls);
 958         rls->dlci   = __addr(1, dlci);
 959         rls->status = status;
 960
 961         *ptr = __fcs(buf); ptr++;
 962
 963         return rfcomm_send_frame(s, buf, ptr - buf);
 964 }
 965
 966 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 967 {
 968         struct rfcomm_hdr *hdr;
 969         struct rfcomm_mcc *mcc;
 970         struct rfcomm_msc *msc;
 971         u8 buf[16], *ptr = buf;
 972
 973         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 974
 975         hdr = (void *) ptr; ptr += sizeof(*hdr);
 976         hdr->addr = __addr(s->initiator, 0);
 977         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 978         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 979
 980         mcc = (void *) ptr; ptr += sizeof(*mcc);
 981         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 982         mcc->len  = __len8(sizeof(*msc));
 983
 984         msc = (void *) ptr; ptr += sizeof(*msc);
 985         msc->dlci    = __addr(1, dlci);
 986         msc->v24_sig = v24_sig | 0x01;
 987
 988         *ptr = __fcs(buf); ptr++;
 989
 990         return rfcomm_send_frame(s, buf, ptr - buf);
 991 }
 992
 993 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 994 {
 995         struct rfcomm_hdr *hdr;
 996         struct rfcomm_mcc *mcc;
 997         u8 buf[16], *ptr = buf;
 998
 999         BT_DBG("%p cr %d", s, cr);
1000
1001         hdr = (void *) ptr; ptr += sizeof(*hdr);
1002         hdr->addr = __addr(s->initiator, 0);
1003         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1004         hdr->len  = __len8(sizeof(*mcc));
1005
1006         mcc = (void *) ptr; ptr += sizeof(*mcc);
1007         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1008         mcc->len  = __len8(0);
1009
1010         *ptr = __fcs(buf); ptr++;
1011
1012         return rfcomm_send_frame(s, buf, ptr - buf);
1013 }
1014
1015 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1016 {
1017         struct rfcomm_hdr *hdr;
1018         struct rfcomm_mcc *mcc;
1019         u8 buf[16], *ptr = buf;
1020
1021         BT_DBG("%p cr %d", s, cr);
1022
1023         hdr = (void *) ptr; ptr += sizeof(*hdr);
1024         hdr->addr = __addr(s->initiator, 0);
1025         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1026         hdr->len  = __len8(sizeof(*mcc));
1027
1028         mcc = (void *) ptr; ptr += sizeof(*mcc);
1029         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1030         mcc->len  = __len8(0);
1031
1032         *ptr = __fcs(buf); ptr++;
1033
1034         return rfcomm_send_frame(s, buf, ptr - buf);
1035 }
1036
1037 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1038 {
1039         struct socket *sock = s->sock;
1040         struct kvec iv[3];
1041         struct msghdr msg;
1042         unsigned char hdr[5], crc[1];
1043
1044         if (len > 125)
1045                 return -EINVAL;
1046
1047         BT_DBG("%p cr %d", s, cr);
1048
1049         hdr[0] = __addr(s->initiator, 0);
1050         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1051         hdr[2] = 0x01 | ((len + 2) << 1);
1052         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1053         hdr[4] = 0x01 | (len << 1);
1054
1055         crc[0] = __fcs(hdr);
1056
1057         iv[0].iov_base = hdr;
1058         iv[0].iov_len  = 5;
1059         iv[1].iov_base = pattern;
1060         iv[1].iov_len  = len;
1061         iv[2].iov_base = crc;
1062         iv[2].iov_len  = 1;
1063
1064         memset(&msg, 0, sizeof(msg));
1065
1066         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1067 }
1068
1069 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1070 {
1071         struct rfcomm_hdr *hdr;
1072         u8 buf[16], *ptr = buf;
1073
1074         BT_DBG("%p addr %d credits %d", s, addr, credits);
1075
1076         hdr = (void *) ptr; ptr += sizeof(*hdr);
1077         hdr->addr = addr;
1078         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1079         hdr->len  = __len8(0);
1080
1081         *ptr = credits; ptr++;
1082
1083         *ptr = __fcs(buf); ptr++;
1084
1085         return rfcomm_send_frame(s, buf, ptr - buf);
1086 }
1087
1088 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1089 {
1090         struct rfcomm_hdr *hdr;
1091         int len = skb->len;
1092         u8 *crc;
1093
1094         if (len > 127) {
1095                 hdr = (void *) skb_push(skb, 4);
1096                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1097         } else {
1098                 hdr = (void *) skb_push(skb, 3);
1099                 hdr->len = __len8(len);
1100         }
1101         hdr->addr = addr;
1102         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1103
1104         crc = skb_put(skb, 1);
1105         *crc = __fcs((void *) hdr);
1106 }
1107
1108 /* ---- RFCOMM frame reception ---- */
1109 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1110 {
1111         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1112
1113         if (dlci) {
1114                 /* Data channel */
1115                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1116                 if (!d) {
1117                         rfcomm_send_dm(s, dlci);
1118                         return 0;
1119                 }
1120
1121                 switch (d->state) {
1122                 case BT_CONNECT:
1123                         rfcomm_dlc_clear_timer(d);
1124
1125                         rfcomm_dlc_lock(d);
1126                         d->state = BT_CONNECTED;
1127                         d->state_change(d, 0);
1128                         rfcomm_dlc_unlock(d);
1129
1130                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1131                         break;
1132
1133                 case BT_DISCONN:
1134                         d->state = BT_CLOSED;
1135                         __rfcomm_dlc_close(d, 0);
1136
1137                         if (list_empty(&s->dlcs)) {
1138                                 s->state = BT_DISCONN;
1139                                 rfcomm_send_disc(s, 0);
1140                         }
1141
1142                         break;
1143                 }
1144         } else {
1145                 /* Control channel */
1146                 switch (s->state) {
1147                 case BT_CONNECT:
1148                         s->state = BT_CONNECTED;
1149                         rfcomm_process_connect(s);
1150                         break;
1151
1152                 case BT_DISCONN:
1153                         rfcomm_session_put(s);
1154                         break;
1155                 }
1156         }
1157         return 0;
1158 }
1159
1160 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1161 {
1162         int err = 0;
1163
1164         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1165
1166         if (dlci) {
1167                 /* Data DLC */
1168                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1169                 if (d) {
1170                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1171                                 err = ECONNREFUSED;
1172                         else
1173                                 err = ECONNRESET;
1174
1175                         d->state = BT_CLOSED;
1176                         __rfcomm_dlc_close(d, err);
1177                 }
1178         } else {
1179                 if (s->state == BT_CONNECT)
1180                         err = ECONNREFUSED;
1181                 else
1182                         err = ECONNRESET;
1183
1184                 s->state = BT_CLOSED;
1185                 rfcomm_session_close(s, err);
1186         }
1187         return 0;
1188 }
1189
1190 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1191 {
1192         int err = 0;
1193
1194         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1195
1196         if (dlci) {
1197                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1198                 if (d) {
1199                         rfcomm_send_ua(s, dlci);
1200
1201                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1202                                 err = ECONNREFUSED;
1203                         else
1204                                 err = ECONNRESET;
1205
1206                         d->state = BT_CLOSED;
1207                         __rfcomm_dlc_close(d, err);
1208                 } else
1209                         rfcomm_send_dm(s, dlci);
1210
1211         } else {
1212                 rfcomm_send_ua(s, 0);
1213
1214                 if (s->state == BT_CONNECT)
1215                         err = ECONNREFUSED;
1216                 else
1217                         err = ECONNRESET;
1218
1219                 s->state = BT_CLOSED;
1220                 rfcomm_session_close(s, err);
1221         }
1222
1223         return 0;
1224 }
1225
1226 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1227 {
1228         struct sock *sk = d->session->sock->sk;
1229
1230         BT_DBG("dlc %p", d);
1231
1232         rfcomm_send_ua(d->session, d->dlci);
1233
1234         rfcomm_dlc_clear_timer(d);
1235
1236         rfcomm_dlc_lock(d);
1237         d->state = BT_CONNECTED;
1238         d->state_change(d, 0);
1239         rfcomm_dlc_unlock(d);
1240
1241         if (d->role_switch)
1242                 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1243
1244         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1245 }
1246
1247 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1248 {
1249         if (rfcomm_check_security(d)) {
1250                 if (d->defer_setup) {
1251                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1252                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1253
1254                         rfcomm_dlc_lock(d);
1255                         d->state = BT_CONNECT2;
1256                         d->state_change(d, 0);
1257                         rfcomm_dlc_unlock(d);
1258                 } else
1259                         rfcomm_dlc_accept(d);
1260         } else {
1261                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1262                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1263         }
1264 }
1265
1266 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1267 {
1268         struct rfcomm_dlc *d;
1269         u8 channel;
1270
1271         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1272
1273         if (!dlci) {
1274                 rfcomm_send_ua(s, 0);
1275
1276                 if (s->state == BT_OPEN) {
1277                         s->state = BT_CONNECTED;
1278                         rfcomm_process_connect(s);
1279                 }
1280                 return 0;
1281         }
1282
1283         /* Check if DLC exists */
1284         d = rfcomm_dlc_get(s, dlci);
1285         if (d) {
1286                 if (d->state == BT_OPEN) {
1287                         /* DLC was previously opened by PN request */
1288                         rfcomm_check_accept(d);
1289                 }
1290                 return 0;
1291         }
1292
1293         /* Notify socket layer about incoming connection */
1294         channel = __srv_channel(dlci);
1295         if (rfcomm_connect_ind(s, channel, &d)) {
1296                 d->dlci = dlci;
1297                 d->addr = __addr(s->initiator, dlci);
1298                 rfcomm_dlc_link(s, d);
1299
1300                 rfcomm_check_accept(d);
1301         } else {
1302                 rfcomm_send_dm(s, dlci);
1303         }
1304
1305         return 0;
1306 }
1307
1308 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1309 {
1310         struct rfcomm_session *s = d->session;
1311
1312         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1313                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1314
1315         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1316                                                 pn->flow_ctrl == 0xe0) {
1317                 d->cfc = RFCOMM_CFC_ENABLED;
1318                 d->tx_credits = pn->credits;
1319         } else {
1320                 d->cfc = RFCOMM_CFC_DISABLED;
1321                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1322         }
1323
1324         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1325                 s->cfc = d->cfc;
1326
1327         d->priority = pn->priority;
1328
1329         d->mtu = __le16_to_cpu(pn->mtu);
1330
1331         if (cr && d->mtu > s->mtu)
1332                 d->mtu = s->mtu;
1333
1334         return 0;
1335 }
1336
1337 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1338 {
1339         struct rfcomm_pn *pn = (void *) skb->data;
1340         struct rfcomm_dlc *d;
1341         u8 dlci = pn->dlci;
1342
1343         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1344
1345         if (!dlci)
1346                 return 0;
1347
1348         d = rfcomm_dlc_get(s, dlci);
1349         if (d) {
1350                 if (cr) {
1351                         /* PN request */
1352                         rfcomm_apply_pn(d, cr, pn);
1353                         rfcomm_send_pn(s, 0, d);
1354                 } else {
1355                         /* PN response */
1356                         switch (d->state) {
1357                         case BT_CONFIG:
1358                                 rfcomm_apply_pn(d, cr, pn);
1359
1360                                 d->state = BT_CONNECT;
1361                                 rfcomm_send_sabm(s, d->dlci);
1362                                 break;
1363                         }
1364                 }
1365         } else {
1366                 u8 channel = __srv_channel(dlci);
1367
1368                 if (!cr)
1369                         return 0;
1370
1371                 /* PN request for non existing DLC.
1372                  * Assume incoming connection. */
1373                 if (rfcomm_connect_ind(s, channel, &d)) {
1374                         d->dlci = dlci;
1375                         d->addr = __addr(s->initiator, dlci);
1376                         rfcomm_dlc_link(s, d);
1377
1378                         rfcomm_apply_pn(d, cr, pn);
1379
1380                         d->state = BT_OPEN;
1381                         rfcomm_send_pn(s, 0, d);
1382                 } else {
1383                         rfcomm_send_dm(s, dlci);
1384                 }
1385         }
1386         return 0;
1387 }
1388
1389 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1390 {
1391         struct rfcomm_rpn *rpn = (void *) skb->data;
1392         u8 dlci = __get_dlci(rpn->dlci);
1393
1394         u8 bit_rate  = 0;
1395         u8 data_bits = 0;
1396         u8 stop_bits = 0;
1397         u8 parity    = 0;
1398         u8 flow_ctrl = 0;
1399         u8 xon_char  = 0;
1400         u8 xoff_char = 0;
1401         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1402
1403         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1404                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1405                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1406
1407         if (!cr)
1408                 return 0;
1409
1410         if (len == 1) {
1411                 /* This is a request, return default settings */
1412                 bit_rate  = RFCOMM_RPN_BR_115200;
1413                 data_bits = RFCOMM_RPN_DATA_8;
1414                 stop_bits = RFCOMM_RPN_STOP_1;
1415                 parity    = RFCOMM_RPN_PARITY_NONE;
1416                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1417                 xon_char  = RFCOMM_RPN_XON_CHAR;
1418                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1419                 goto rpn_out;
1420         }
1421
1422         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1423          * no parity, no flow control lines, normal XON/XOFF chars */
1424
1425         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1426                 bit_rate = rpn->bit_rate;
1427                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1428                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1429                         bit_rate = RFCOMM_RPN_BR_115200;
1430                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1431                 }
1432         }
1433
1434         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1435                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1436                 if (data_bits != RFCOMM_RPN_DATA_8) {
1437                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1438                         data_bits = RFCOMM_RPN_DATA_8;
1439                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1440                 }
1441         }
1442
1443         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1444                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1445                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1446                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1447                         stop_bits = RFCOMM_RPN_STOP_1;
1448                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1449                 }
1450         }
1451
1452         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1453                 parity = __get_rpn_parity(rpn->line_settings);
1454                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1455                         BT_DBG("RPN parity mismatch 0x%x", parity);
1456                         parity = RFCOMM_RPN_PARITY_NONE;
1457                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1458                 }
1459         }
1460
1461         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1462                 flow_ctrl = rpn->flow_ctrl;
1463                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1464                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1465                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1466                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1467                 }
1468         }
1469
1470         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1471                 xon_char = rpn->xon_char;
1472                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1473                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1474                         xon_char = RFCOMM_RPN_XON_CHAR;
1475                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1476                 }
1477         }
1478
1479         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1480                 xoff_char = rpn->xoff_char;
1481                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1482                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1483                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1484                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1485                 }
1486         }
1487
1488 rpn_out:
1489         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1490                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1491
1492         return 0;
1493 }
1494
1495 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1496 {
1497         struct rfcomm_rls *rls = (void *) skb->data;
1498         u8 dlci = __get_dlci(rls->dlci);
1499
1500         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1501
1502         if (!cr)
1503                 return 0;
1504
1505         /* We should probably do something with this information here. But
1506          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1507          * mandatory to recognise and respond to RLS */
1508
1509         rfcomm_send_rls(s, 0, dlci, rls->status);
1510
1511         return 0;
1512 }
1513
1514 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1515 {
1516         struct rfcomm_msc *msc = (void *) skb->data;
1517         struct rfcomm_dlc *d;
1518         u8 dlci = __get_dlci(msc->dlci);
1519
1520         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1521
1522         d = rfcomm_dlc_get(s, dlci);
1523         if (!d)
1524                 return 0;
1525
1526         if (cr) {
1527                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1528                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1529                 else
1530                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1531
1532                 rfcomm_dlc_lock(d);
1533
1534                 d->remote_v24_sig = msc->v24_sig;
1535
1536                 if (d->modem_status)
1537                         d->modem_status(d, msc->v24_sig);
1538
1539                 rfcomm_dlc_unlock(d);
1540
1541                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1542
1543                 d->mscex |= RFCOMM_MSCEX_RX;
1544         } else
1545                 d->mscex |= RFCOMM_MSCEX_TX;
1546
1547         return 0;
1548 }
1549
1550 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1551 {
1552         struct rfcomm_mcc *mcc = (void *) skb->data;
1553         u8 type, cr, len;
1554
1555         cr   = __test_cr(mcc->type);
1556         type = __get_mcc_type(mcc->type);
1557         len  = __get_mcc_len(mcc->len);
1558
1559         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1560
1561         skb_pull(skb, 2);
1562
1563         switch (type) {
1564         case RFCOMM_PN:
1565                 rfcomm_recv_pn(s, cr, skb);
1566                 break;
1567
1568         case RFCOMM_RPN:
1569                 rfcomm_recv_rpn(s, cr, len, skb);
1570                 break;
1571
1572         case RFCOMM_RLS:
1573                 rfcomm_recv_rls(s, cr, skb);
1574                 break;
1575
1576         case RFCOMM_MSC:
1577                 rfcomm_recv_msc(s, cr, skb);
1578                 break;
1579
1580         case RFCOMM_FCOFF:
1581                 if (cr) {
1582                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1583                         rfcomm_send_fcoff(s, 0);
1584                 }
1585                 break;
1586
1587         case RFCOMM_FCON:
1588                 if (cr) {
1589                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1590                         rfcomm_send_fcon(s, 0);
1591                 }
1592                 break;
1593
1594         case RFCOMM_TEST:
1595                 if (cr)
1596                         rfcomm_send_test(s, 0, skb->data, skb->len);
1597                 break;
1598
1599         case RFCOMM_NSC:
1600                 break;
1601
1602         default:
1603                 BT_ERR("Unknown control type 0x%02x", type);
1604                 rfcomm_send_nsc(s, cr, type);
1605                 break;
1606         }
1607         return 0;
1608 }
1609
1610 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1611 {
1612         struct rfcomm_dlc *d;
1613
1614         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1615
1616         d = rfcomm_dlc_get(s, dlci);
1617         if (!d) {
1618                 rfcomm_send_dm(s, dlci);
1619                 goto drop;
1620         }
1621
1622         if (pf && d->cfc) {
1623                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1624
1625                 d->tx_credits += credits;
1626                 if (d->tx_credits)
1627                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1628         }
1629
1630         if (skb->len && d->state == BT_CONNECTED) {
1631                 rfcomm_dlc_lock(d);
1632                 d->rx_credits--;
1633                 d->data_ready(d, skb);
1634                 rfcomm_dlc_unlock(d);
1635                 return 0;
1636         }
1637
1638 drop:
1639         kfree_skb(skb);
1640         return 0;
1641 }
1642
1643 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1644 {
1645         struct rfcomm_hdr *hdr = (void *) skb->data;
1646         u8 type, dlci, fcs;
1647
1648         dlci = __get_dlci(hdr->addr);
1649         type = __get_type(hdr->ctrl);
1650
1651         /* Trim FCS */
1652         skb->len--; skb->tail--;
1653         fcs = *(u8 *)skb_tail_pointer(skb);
1654
1655         if (__check_fcs(skb->data, type, fcs)) {
1656                 BT_ERR("bad checksum in packet");
1657                 kfree_skb(skb);
1658                 return -EILSEQ;
1659         }
1660
1661         if (__test_ea(hdr->len))
1662                 skb_pull(skb, 3);
1663         else
1664                 skb_pull(skb, 4);
1665
1666         switch (type) {
1667         case RFCOMM_SABM:
1668                 if (__test_pf(hdr->ctrl))
1669                         rfcomm_recv_sabm(s, dlci);
1670                 break;
1671
1672         case RFCOMM_DISC:
1673                 if (__test_pf(hdr->ctrl))
1674                         rfcomm_recv_disc(s, dlci);
1675                 break;
1676
1677         case RFCOMM_UA:
1678                 if (__test_pf(hdr->ctrl))
1679                         rfcomm_recv_ua(s, dlci);
1680                 break;
1681
1682         case RFCOMM_DM:
1683                 rfcomm_recv_dm(s, dlci);
1684                 break;
1685
1686         case RFCOMM_UIH:
1687                 if (dlci)
1688                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1689
1690                 rfcomm_recv_mcc(s, skb);
1691                 break;
1692
1693         default:
1694                 BT_ERR("Unknown packet type 0x%02x\n", type);
1695                 break;
1696         }
1697         kfree_skb(skb);
1698         return 0;
1699 }
1700
1701 /* ---- Connection and data processing ---- */
1702
1703 static void rfcomm_process_connect(struct rfcomm_session *s)
1704 {
1705         struct rfcomm_dlc *d;
1706         struct list_head *p, *n;
1707
1708         BT_DBG("session %p state %ld", s, s->state);
1709
1710         list_for_each_safe(p, n, &s->dlcs) {
1711                 d = list_entry(p, struct rfcomm_dlc, list);
1712                 if (d->state == BT_CONFIG) {
1713                         d->mtu = s->mtu;
1714                         if (rfcomm_check_security(d)) {
1715                                 rfcomm_send_pn(s, 1, d);
1716                         } else {
1717                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1718                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1719                         }
1720                 }
1721         }
1722 }
1723
1724 /* Send data queued for the DLC.
1725  * Return number of frames left in the queue.
1726  */
1727 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1728 {
1729         struct sk_buff *skb;
1730         int err;
1731
1732         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1733                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1734
1735         /* Send pending MSC */
1736         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1737                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1738
1739         if (d->cfc) {
1740                 /* CFC enabled.
1741                  * Give them some credits */
1742                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1743                                 d->rx_credits <= (d->cfc >> 2)) {
1744                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1745                         d->rx_credits = d->cfc;
1746                 }
1747         } else {
1748                 /* CFC disabled.
1749                  * Give ourselves some credits */
1750                 d->tx_credits = 5;
1751         }
1752
1753         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1754                 return skb_queue_len(&d->tx_queue);
1755
1756         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1757                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1758                 if (err < 0) {
1759                         skb_queue_head(&d->tx_queue, skb);
1760                         break;
1761                 }
1762                 kfree_skb(skb);
1763                 d->tx_credits--;
1764         }
1765
1766         if (d->cfc && !d->tx_credits) {
1767                 /* We're out of TX credits.
1768                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1769                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1770         }
1771
1772         return skb_queue_len(&d->tx_queue);
1773 }
1774
1775 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1776 {
1777         struct rfcomm_dlc *d;
1778         struct list_head *p, *n;
1779
1780         BT_DBG("session %p state %ld", s, s->state);
1781
1782         list_for_each_safe(p, n, &s->dlcs) {
1783                 d = list_entry(p, struct rfcomm_dlc, list);
1784
1785                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1786                         __rfcomm_dlc_close(d, ETIMEDOUT);
1787                         continue;
1788                 }
1789
1790                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1791                         rfcomm_dlc_clear_timer(d);
1792                         if (d->out) {
1793                                 rfcomm_send_pn(s, 1, d);
1794                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1795                         } else {
1796                                 if (d->defer_setup) {
1797                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1798                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1799
1800                                         rfcomm_dlc_lock(d);
1801                                         d->state = BT_CONNECT2;
1802                                         d->state_change(d, 0);
1803                                         rfcomm_dlc_unlock(d);
1804                                 } else
1805                                         rfcomm_dlc_accept(d);
1806                         }
1807                         continue;
1808                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1809                         rfcomm_dlc_clear_timer(d);
1810                         if (!d->out)
1811                                 rfcomm_send_dm(s, d->dlci);
1812                         else
1813                                 d->state = BT_CLOSED;
1814                         __rfcomm_dlc_close(d, ECONNREFUSED);
1815                         continue;
1816                 }
1817
1818                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1819                         continue;
1820
1821                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1822                         continue;
1823
1824                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1825                                                 d->mscex == RFCOMM_MSCEX_OK)
1826                         rfcomm_process_tx(d);
1827         }
1828 }
1829
1830 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1831 {
1832         struct socket *sock = s->sock;
1833         struct sock *sk = sock->sk;
1834         struct sk_buff *skb;
1835
1836         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1837
1838         /* Get data directly from socket receive queue without copying it. */
1839         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1840                 skb_orphan(skb);
1841                 rfcomm_recv_frame(s, skb);
1842         }
1843
1844         if (sk->sk_state == BT_CLOSED) {
1845                 if (!s->initiator)
1846                         rfcomm_session_put(s);
1847
1848                 rfcomm_session_close(s, sk->sk_err);
1849         }
1850 }
1851
1852 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1853 {
1854         struct socket *sock = s->sock, *nsock;
1855         int err;
1856
1857         /* Fast check for a new connection.
1858          * Avoids unnesesary socket allocations. */
1859         if (list_empty(&bt_sk(sock->sk)->accept_q))
1860                 return;
1861
1862         BT_DBG("session %p", s);
1863
1864         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1865         if (err < 0)
1866                 return;
1867
1868         /* Set our callbacks */
1869         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1870         nsock->sk->sk_state_change = rfcomm_l2state_change;
1871
1872         s = rfcomm_session_add(nsock, BT_OPEN);
1873         if (s) {
1874                 rfcomm_session_hold(s);
1875
1876                 /* We should adjust MTU on incoming sessions.
1877                  * L2CAP MTU minus UIH header and FCS. */
1878                 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1879
1880                 rfcomm_schedule(RFCOMM_SCHED_RX);
1881         } else
1882                 sock_release(nsock);
1883 }
1884
1885 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1886 {
1887         struct sock *sk = s->sock->sk;
1888
1889         BT_DBG("%p state %ld", s, s->state);
1890
1891         switch(sk->sk_state) {
1892         case BT_CONNECTED:
1893                 s->state = BT_CONNECT;
1894
1895                 /* We can adjust MTU on outgoing sessions.
1896                  * L2CAP MTU minus UIH header and FCS. */
1897                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1898
1899                 rfcomm_send_sabm(s, 0);
1900                 break;
1901
1902         case BT_CLOSED:
1903                 s->state = BT_CLOSED;
1904                 rfcomm_session_close(s, sk->sk_err);
1905                 break;
1906         }
1907 }
1908
1909 static inline void rfcomm_process_sessions(void)
1910 {
1911         struct list_head *p, *n;
1912
1913         rfcomm_lock();
1914
1915         list_for_each_safe(p, n, &session_list) {
1916                 struct rfcomm_session *s;
1917                 s = list_entry(p, struct rfcomm_session, list);
1918
1919                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1920                         s->state = BT_DISCONN;
1921                         rfcomm_send_disc(s, 0);
1922                         rfcomm_session_put(s);
1923                         continue;
1924                 }
1925
1926                 if (s->state == BT_LISTEN) {
1927                         rfcomm_accept_connection(s);
1928                         continue;
1929                 }
1930
1931                 rfcomm_session_hold(s);
1932
1933                 switch (s->state) {
1934                 case BT_BOUND:
1935                         rfcomm_check_connection(s);
1936                         break;
1937
1938                 default:
1939                         rfcomm_process_rx(s);
1940                         break;
1941                 }
1942
1943                 rfcomm_process_dlcs(s);
1944
1945                 rfcomm_session_put(s);
1946         }
1947
1948         rfcomm_unlock();
1949 }
1950
1951 static int rfcomm_add_listener(bdaddr_t *ba)
1952 {
1953         struct sockaddr_l2 addr;
1954         struct socket *sock;
1955         struct sock *sk;
1956         struct rfcomm_session *s;
1957         int    err = 0;
1958
1959         /* Create socket */
1960         err = rfcomm_l2sock_create(&sock);
1961         if (err < 0) {
1962                 BT_ERR("Create socket failed %d", err);
1963                 return err;
1964         }
1965
1966         /* Bind socket */
1967         bacpy(&addr.l2_bdaddr, ba);
1968         addr.l2_family = AF_BLUETOOTH;
1969         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
1970         addr.l2_cid    = 0;
1971         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1972         if (err < 0) {
1973                 BT_ERR("Bind failed %d", err);
1974                 goto failed;
1975         }
1976
1977         /* Set L2CAP options */
1978         sk = sock->sk;
1979         lock_sock(sk);
1980         l2cap_pi(sk)->imtu = l2cap_mtu;
1981         release_sock(sk);
1982
1983         /* Start listening on the socket */
1984         err = kernel_listen(sock, 10);
1985         if (err) {
1986                 BT_ERR("Listen failed %d", err);
1987                 goto failed;
1988         }
1989
1990         /* Add listening session */
1991         s = rfcomm_session_add(sock, BT_LISTEN);
1992         if (!s)
1993                 goto failed;
1994
1995         rfcomm_session_hold(s);
1996         return 0;
1997 failed:
1998         sock_release(sock);
1999         return err;
2000 }
2001
2002 static void rfcomm_kill_listener(void)
2003 {
2004         struct rfcomm_session *s;
2005         struct list_head *p, *n;
2006
2007         BT_DBG("");
2008
2009         list_for_each_safe(p, n, &session_list) {
2010                 s = list_entry(p, struct rfcomm_session, list);
2011                 rfcomm_session_del(s);
2012         }
2013 }
2014
2015 static int rfcomm_run(void *unused)
2016 {
2017         BT_DBG("");
2018
2019         set_user_nice(current, -10);
2020
2021         rfcomm_add_listener(BDADDR_ANY);
2022
2023         while (!kthread_should_stop()) {
2024                 set_current_state(TASK_INTERRUPTIBLE);
2025                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
2026                         /* No pending events. Let's sleep.
2027                          * Incoming connections and data will wake us up. */
2028                         schedule();
2029                 }
2030                 set_current_state(TASK_RUNNING);
2031
2032                 /* Process stuff */
2033                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
2034                 rfcomm_process_sessions();
2035         }
2036
2037         rfcomm_kill_listener();
2038
2039         return 0;
2040 }
2041
2042 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2043 {
2044         struct rfcomm_session *s;
2045         struct rfcomm_dlc *d;
2046         struct list_head *p, *n;
2047
2048         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2049
2050         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2051         if (!s)
2052                 return;
2053
2054         rfcomm_session_hold(s);
2055
2056         list_for_each_safe(p, n, &s->dlcs) {
2057                 d = list_entry(p, struct rfcomm_dlc, list);
2058
2059                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2060                         rfcomm_dlc_clear_timer(d);
2061                         if (status || encrypt == 0x00) {
2062                                 __rfcomm_dlc_close(d, ECONNREFUSED);
2063                                 continue;
2064                         }
2065                 }
2066
2067                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2068                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2069                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2070                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2071                                 continue;
2072                         } else if (d->sec_level == BT_SECURITY_HIGH) {
2073                                 __rfcomm_dlc_close(d, ECONNREFUSED);
2074                                 continue;
2075                         }
2076                 }
2077
2078                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2079                         continue;
2080
2081                 if (!status)
2082                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2083                 else
2084                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2085         }
2086
2087         rfcomm_session_put(s);
2088
2089         rfcomm_schedule(RFCOMM_SCHED_AUTH);
2090 }
2091
2092 static struct hci_cb rfcomm_cb = {
2093         .name           = "RFCOMM",
2094         .security_cfm   = rfcomm_security_cfm
2095 };
2096
2097 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2098 {
2099         struct rfcomm_session *s;
2100         struct list_head *pp, *p;
2101         char *str = buf;
2102
2103         rfcomm_lock();
2104
2105         list_for_each(p, &session_list) {
2106                 s = list_entry(p, struct rfcomm_session, list);
2107                 list_for_each(pp, &s->dlcs) {
2108                         struct sock *sk = s->sock->sk;
2109                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2110
2111                         str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2112                                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2113                                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2114                 }
2115         }
2116
2117         rfcomm_unlock();
2118
2119         return (str - buf);
2120 }
2121
2122 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2123
2124 /* ---- Initialization ---- */
2125 static int __init rfcomm_init(void)
2126 {
2127         int err;
2128
2129         l2cap_load();
2130
2131         hci_register_cb(&rfcomm_cb);
2132
2133         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2134         if (IS_ERR(rfcomm_thread)) {
2135                 err = PTR_ERR(rfcomm_thread);
2136                 goto unregister;
2137         }
2138
2139         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2140                 BT_ERR("Failed to create RFCOMM info file");
2141
2142         err = rfcomm_init_ttys();
2143         if (err < 0)
2144                 goto stop;
2145
2146         err = rfcomm_init_sockets();
2147         if (err < 0)
2148                 goto cleanup;
2149
2150         BT_INFO("RFCOMM ver %s", VERSION);
2151
2152         return 0;
2153
2154 cleanup:
2155         rfcomm_cleanup_ttys();
2156
2157 stop:
2158         kthread_stop(rfcomm_thread);
2159
2160 unregister:
2161         hci_unregister_cb(&rfcomm_cb);
2162
2163         return err;
2164 }
2165
2166 static void __exit rfcomm_exit(void)
2167 {
2168         class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2169
2170         hci_unregister_cb(&rfcomm_cb);
2171
2172         kthread_stop(rfcomm_thread);
2173
2174         rfcomm_cleanup_ttys();
2175
2176         rfcomm_cleanup_sockets();
2177 }
2178
2179 module_init(rfcomm_init);
2180 module_exit(rfcomm_exit);
2181
2182 module_param(disable_cfc, bool, 0644);
2183 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2184
2185 module_param(channel_mtu, int, 0644);
2186 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2187
2188 module_param(l2cap_mtu, uint, 0644);
2189 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2190
2191 module_param(l2cap_ertm, bool, 0644);
2192 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2193
2194 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2195 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2196 MODULE_VERSION(VERSION);
2197 MODULE_LICENSE("GPL");
2198 MODULE_ALIAS("bt-proto-3");