net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/kernel.h>
  31 #include <linux/sched.h>
  32 #include <linux/signal.h>
  33 #include <linux/init.h>
  34 #include <linux/wait.h>
  35 #include <linux/device.h>
  36 #include <linux/net.h>
  37 #include <linux/mutex.h>
  38 #include <linux/kthread.h>
  39
  40 #include <net/sock.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/unaligned.h>
  43
  44 #include <net/bluetooth/bluetooth.h>
  45 #include <net/bluetooth/hci_core.h>
  46 #include <net/bluetooth/l2cap.h>
  47 #include <net/bluetooth/rfcomm.h>
  48
  49 #define VERSION "1.11"
  50
  51 static int disable_cfc = 0;
  52 static int channel_mtu = -1;
  53 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  54 static int l2cap_ertm = 0;
  55
  56 static struct task_struct *rfcomm_thread;
  57
  58 static DEFINE_MUTEX(rfcomm_mutex);
  59 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  60 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  61
  62 static unsigned long rfcomm_event;
  63
  64 static LIST_HEAD(session_list);
  65
  66 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  67 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  68 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  69 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  70 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  71 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  72 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  73 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  74 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  75 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  76
  77 static void rfcomm_process_connect(struct rfcomm_session *s);
  78
  79 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
  80 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  81 static void rfcomm_session_del(struct rfcomm_session *s);
  82
  83 /* ---- RFCOMM frame parsing macros ---- */
  84 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  85 #define __get_channel(b)  ((b & 0xf8) >> 3)
  86 #define __get_dir(b)      ((b & 0x04) >> 2)
  87 #define __get_type(b)     ((b & 0xef))
  88
  89 #define __test_ea(b)      ((b & 0x01))
  90 #define __test_cr(b)      ((b & 0x02))
  91 #define __test_pf(b)      ((b & 0x10))
  92
  93 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  94 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  95 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  96 #define __srv_channel(dlci)    (dlci >> 1)
  97 #define __dir(dlci)            (dlci & 0x01)
  98
  99 #define __len8(len)       (((len) << 1) | 1)
 100 #define __len16(len)      ((len) << 1)
 101
 102 /* MCC macros */
 103 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 104 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 105 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 106
 107 /* RPN macros */
 108 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 109 #define __get_rpn_data_bits(line) ((line) & 0x3)
 110 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 111 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 112
 113 static inline void rfcomm_schedule(uint event)
 114 {
 115         if (!rfcomm_thread)
 116                 return;
 117         //set_bit(event, &rfcomm_event);
 118         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
 119         wake_up_process(rfcomm_thread);
 120 }
 121
 122 static inline void rfcomm_session_put(struct rfcomm_session *s)
 123 {
 124         if (atomic_dec_and_test(&s->refcnt))
 125                 rfcomm_session_del(s);
 126 }
 127
 128 /* ---- RFCOMM FCS computation ---- */
 129
 130 /* reversed, 8-bit, poly=0x07 */
 131 static unsigned char rfcomm_crc_table[256] = {
 132         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 133         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 134         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 135         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 136
 137         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 138         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 139         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 140         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 141
 142         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 143         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 144         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 145         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 146
 147         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 148         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 149         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 150         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 151
 152         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 153         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 154         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 155         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 156
 157         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 158         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 159         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 160         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 161
 162         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 163         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 164         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 165         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 166
 167         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 168         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 169         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 170         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 171 };
 172
 173 /* CRC on 2 bytes */
 174 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 175
 176 /* FCS on 2 bytes */
 177 static inline u8 __fcs(u8 *data)
 178 {
 179         return (0xff - __crc(data));
 180 }
 181
 182 /* FCS on 3 bytes */
 183 static inline u8 __fcs2(u8 *data)
 184 {
 185         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 186 }
 187
 188 /* Check FCS */
 189 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 190 {
 191         u8 f = __crc(data);
 192
 193         if (type != RFCOMM_UIH)
 194                 f = rfcomm_crc_table[f ^ data[2]];
 195
 196         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 197 }
 198
 199 /* ---- L2CAP callbacks ---- */
 200 static void rfcomm_l2state_change(struct sock *sk)
 201 {
 202         BT_DBG("%p state %d", sk, sk->sk_state);
 203         rfcomm_schedule(RFCOMM_SCHED_STATE);
 204 }
 205
 206 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 207 {
 208         BT_DBG("%p bytes %d", sk, bytes);
 209         rfcomm_schedule(RFCOMM_SCHED_RX);
 210 }
 211
 212 static int rfcomm_l2sock_create(struct socket **sock)
 213 {
 214         int err;
 215
 216         BT_DBG("");
 217
 218         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 219         if (!err) {
 220                 struct sock *sk = (*sock)->sk;
 221                 sk->sk_data_ready   = rfcomm_l2data_ready;
 222                 sk->sk_state_change = rfcomm_l2state_change;
 223         }
 224         return err;
 225 }
 226
 227 static inline int rfcomm_check_security(struct rfcomm_dlc *d)
 228 {
 229         struct sock *sk = d->session->sock->sk;
 230         __u8 auth_type;
 231
 232         switch (d->sec_level) {
 233         case BT_SECURITY_HIGH:
 234                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
 235                 break;
 236         case BT_SECURITY_MEDIUM:
 237                 auth_type = HCI_AT_GENERAL_BONDING;
 238                 break;
 239         default:
 240                 auth_type = HCI_AT_NO_BONDING;
 241                 break;
 242         }
 243
 244         return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level,
 245                                                                 auth_type);
 246 }
 247
 248 static void rfcomm_session_timeout(unsigned long arg)
 249 {
 250         struct rfcomm_session *s = (void *) arg;
 251
 252         BT_DBG("session %p state %ld", s, s->state);
 253
 254         set_bit(RFCOMM_TIMED_OUT, &s->flags);
 255         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 256 }
 257
 258 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 259 {
 260         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 261
 262         if (!mod_timer(&s->timer, jiffies + timeout))
 263                 rfcomm_session_hold(s);
 264 }
 265
 266 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 267 {
 268         BT_DBG("session %p state %ld", s, s->state);
 269
 270         if (timer_pending(&s->timer) && del_timer(&s->timer))
 271                 rfcomm_session_put(s);
 272 }
 273
 274 /* ---- RFCOMM DLCs ---- */
 275 static void rfcomm_dlc_timeout(unsigned long arg)
 276 {
 277         struct rfcomm_dlc *d = (void *) arg;
 278
 279         BT_DBG("dlc %p state %ld", d, d->state);
 280
 281         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 282         rfcomm_dlc_put(d);
 283         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 284 }
 285
 286 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 287 {
 288         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 289
 290         if (!mod_timer(&d->timer, jiffies + timeout))
 291                 rfcomm_dlc_hold(d);
 292 }
 293
 294 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 295 {
 296         BT_DBG("dlc %p state %ld", d, d->state);
 297
 298         if (timer_pending(&d->timer) && del_timer(&d->timer))
 299                 rfcomm_dlc_put(d);
 300 }
 301
 302 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 303 {
 304         BT_DBG("%p", d);
 305
 306         d->state      = BT_OPEN;
 307         d->flags      = 0;
 308         d->mscex      = 0;
 309         d->mtu        = RFCOMM_DEFAULT_MTU;
 310         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 311
 312         d->cfc        = RFCOMM_CFC_DISABLED;
 313         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 314 }
 315
 316 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 317 {
 318         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 319
 320         if (!d)
 321                 return NULL;
 322
 323         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 324
 325         skb_queue_head_init(&d->tx_queue);
 326         spin_lock_init(&d->lock);
 327         atomic_set(&d->refcnt, 1);
 328
 329         rfcomm_dlc_clear_state(d);
 330
 331         BT_DBG("%p", d);
 332
 333         return d;
 334 }
 335
 336 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 337 {
 338         BT_DBG("%p", d);
 339
 340         skb_queue_purge(&d->tx_queue);
 341         kfree(d);
 342 }
 343
 344 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 345 {
 346         BT_DBG("dlc %p session %p", d, s);
 347
 348         rfcomm_session_hold(s);
 349
 350         rfcomm_session_clear_timer(s);
 351         rfcomm_dlc_hold(d);
 352         list_add(&d->list, &s->dlcs);
 353         d->session = s;
 354 }
 355
 356 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 357 {
 358         struct rfcomm_session *s = d->session;
 359
 360         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 361
 362         list_del(&d->list);
 363         d->session = NULL;
 364         rfcomm_dlc_put(d);
 365
 366         if (list_empty(&s->dlcs))
 367                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
 368
 369         rfcomm_session_put(s);
 370 }
 371
 372 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 373 {
 374         struct rfcomm_dlc *d;
 375         struct list_head *p;
 376
 377         list_for_each(p, &s->dlcs) {
 378                 d = list_entry(p, struct rfcomm_dlc, list);
 379                 if (d->dlci == dlci)
 380                         return d;
 381         }
 382         return NULL;
 383 }
 384
 385 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 386 {
 387         struct rfcomm_session *s;
 388         int err = 0;
 389         u8 dlci;
 390
 391         BT_DBG("dlc %p state %ld %s %s channel %d",
 392                         d, d->state, batostr(src), batostr(dst), channel);
 393
 394         if (channel < 1 || channel > 30)
 395                 return -EINVAL;
 396
 397         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 398                 return 0;
 399
 400         s = rfcomm_session_get(src, dst);
 401         if (!s) {
 402                 s = rfcomm_session_create(src, dst, &err);
 403                 if (!s)
 404                         return err;
 405         }
 406
 407         dlci = __dlci(!s->initiator, channel);
 408
 409         /* Check if DLCI already exists */
 410         if (rfcomm_dlc_get(s, dlci))
 411                 return -EBUSY;
 412
 413         rfcomm_dlc_clear_state(d);
 414
 415         d->dlci     = dlci;
 416         d->addr     = __addr(s->initiator, dlci);
 417         d->priority = 7;
 418
 419         d->state = BT_CONFIG;
 420         rfcomm_dlc_link(s, d);
 421
 422         d->out = 1;
 423
 424         d->mtu = s->mtu;
 425         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 426
 427         if (s->state == BT_CONNECTED) {
 428                 if (rfcomm_check_security(d))
 429                         rfcomm_send_pn(s, 1, d);
 430                 else
 431                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 432         }
 433
 434         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 435
 436         return 0;
 437 }
 438
 439 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 440 {
 441         int r;
 442
 443         rfcomm_lock();
 444
 445         r = __rfcomm_dlc_open(d, src, dst, channel);
 446
 447         rfcomm_unlock();
 448         return r;
 449 }
 450
 451 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 452 {
 453         struct rfcomm_session *s = d->session;
 454         if (!s)
 455                 return 0;
 456
 457         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 458                         d, d->state, d->dlci, err, s);
 459
 460         switch (d->state) {
 461         case BT_CONNECT:
 462         case BT_CONFIG:
 463                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 464                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 465                         rfcomm_schedule(RFCOMM_SCHED_AUTH);
 466                         break;
 467                 }
 468                 /* Fall through */
 469
 470         case BT_CONNECTED:
 471                 d->state = BT_DISCONN;
 472                 if (skb_queue_empty(&d->tx_queue)) {
 473                         rfcomm_send_disc(s, d->dlci);
 474                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 475                 } else {
 476                         rfcomm_queue_disc(d);
 477                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 478                 }
 479                 break;
 480
 481         case BT_OPEN:
 482         case BT_CONNECT2:
 483                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 484                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 485                         rfcomm_schedule(RFCOMM_SCHED_AUTH);
 486                         break;
 487                 }
 488                 /* Fall through */
 489
 490         default:
 491                 rfcomm_dlc_clear_timer(d);
 492
 493                 rfcomm_dlc_lock(d);
 494                 d->state = BT_CLOSED;
 495                 d->state_change(d, err);
 496                 rfcomm_dlc_unlock(d);
 497
 498                 skb_queue_purge(&d->tx_queue);
 499                 rfcomm_dlc_unlink(d);
 500         }
 501
 502         return 0;
 503 }
 504
 505 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 506 {
 507         int r;
 508
 509         rfcomm_lock();
 510
 511         r = __rfcomm_dlc_close(d, err);
 512
 513         rfcomm_unlock();
 514         return r;
 515 }
 516
 517 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 518 {
 519         int len = skb->len;
 520
 521         if (d->state != BT_CONNECTED)
 522                 return -ENOTCONN;
 523
 524         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 525
 526         if (len > d->mtu)
 527                 return -EINVAL;
 528
 529         rfcomm_make_uih(skb, d->addr);
 530         skb_queue_tail(&d->tx_queue, skb);
 531
 532         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 533                 rfcomm_schedule(RFCOMM_SCHED_TX);
 534         return len;
 535 }
 536
 537 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 538 {
 539         BT_DBG("dlc %p state %ld", d, d->state);
 540
 541         if (!d->cfc) {
 542                 d->v24_sig |= RFCOMM_V24_FC;
 543                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 544         }
 545         rfcomm_schedule(RFCOMM_SCHED_TX);
 546 }
 547
 548 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 549 {
 550         BT_DBG("dlc %p state %ld", d, d->state);
 551
 552         if (!d->cfc) {
 553                 d->v24_sig &= ~RFCOMM_V24_FC;
 554                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 555         }
 556         rfcomm_schedule(RFCOMM_SCHED_TX);
 557 }
 558
 559 /*
 560    Set/get modem status functions use _local_ status i.e. what we report
 561    to the other side.
 562    Remote status is provided by dlc->modem_status() callback.
 563  */
 564 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 565 {
 566         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 567                         d, d->state, v24_sig);
 568
 569         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 570                 v24_sig |= RFCOMM_V24_FC;
 571         else
 572                 v24_sig &= ~RFCOMM_V24_FC;
 573
 574         d->v24_sig = v24_sig;
 575
 576         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 577                 rfcomm_schedule(RFCOMM_SCHED_TX);
 578
 579         return 0;
 580 }
 581
 582 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 583 {
 584         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 585                         d, d->state, d->v24_sig);
 586
 587         *v24_sig = d->v24_sig;
 588         return 0;
 589 }
 590
 591 /* ---- RFCOMM sessions ---- */
 592 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 593 {
 594         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 595
 596         if (!s)
 597                 return NULL;
 598
 599         BT_DBG("session %p sock %p", s, sock);
 600
 601         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
 602
 603         INIT_LIST_HEAD(&s->dlcs);
 604         s->state = state;
 605         s->sock  = sock;
 606
 607         s->mtu = RFCOMM_DEFAULT_MTU;
 608         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 609
 610         /* Do not increment module usage count for listening sessions.
 611          * Otherwise we won't be able to unload the module. */
 612         if (state != BT_LISTEN)
 613                 if (!try_module_get(THIS_MODULE)) {
 614                         kfree(s);
 615                         return NULL;
 616                 }
 617
 618         list_add(&s->list, &session_list);
 619
 620         return s;
 621 }
 622
 623 static void rfcomm_session_del(struct rfcomm_session *s)
 624 {
 625         int state = s->state;
 626
 627         BT_DBG("session %p state %ld", s, s->state);
 628
 629         list_del(&s->list);
 630
 631         if (state == BT_CONNECTED)
 632                 rfcomm_send_disc(s, 0);
 633
 634         rfcomm_session_clear_timer(s);
 635         sock_release(s->sock);
 636         kfree(s);
 637
 638         if (state != BT_LISTEN)
 639                 module_put(THIS_MODULE);
 640 }
 641
 642 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 643 {
 644         struct rfcomm_session *s;
 645         struct list_head *p, *n;
 646         struct bt_sock *sk;
 647         list_for_each_safe(p, n, &session_list) {
 648                 s = list_entry(p, struct rfcomm_session, list);
 649                 sk = bt_sk(s->sock->sk);
 650
 651                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 652                                 !bacmp(&sk->dst, dst))
 653                         return s;
 654         }
 655         return NULL;
 656 }
 657
 658 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 659 {
 660         struct rfcomm_dlc *d;
 661         struct list_head *p, *n;
 662
 663         BT_DBG("session %p state %ld err %d", s, s->state, err);
 664
 665         rfcomm_session_hold(s);
 666
 667         s->state = BT_CLOSED;
 668
 669         /* Close all dlcs */
 670         list_for_each_safe(p, n, &s->dlcs) {
 671                 d = list_entry(p, struct rfcomm_dlc, list);
 672                 d->state = BT_CLOSED;
 673                 __rfcomm_dlc_close(d, err);
 674         }
 675
 676         rfcomm_session_clear_timer(s);
 677         rfcomm_session_put(s);
 678 }
 679
 680 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 681 {
 682         struct rfcomm_session *s = NULL;
 683         struct sockaddr_l2 addr;
 684         struct socket *sock;
 685         struct sock *sk;
 686
 687         BT_DBG("%s %s", batostr(src), batostr(dst));
 688
 689         *err = rfcomm_l2sock_create(&sock);
 690         if (*err < 0)
 691                 return NULL;
 692
 693         bacpy(&addr.l2_bdaddr, src);
 694         addr.l2_family = AF_BLUETOOTH;
 695         addr.l2_psm    = 0;
 696         addr.l2_cid    = 0;
 697         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 698         if (*err < 0)
 699                 goto failed;
 700
 701         /* Set L2CAP options */
 702         sk = sock->sk;
 703         lock_sock(sk);
 704         l2cap_pi(sk)->imtu = l2cap_mtu;
 705         if (l2cap_ertm)
 706                 l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
 707         release_sock(sk);
 708
 709         s = rfcomm_session_add(sock, BT_BOUND);
 710         if (!s) {
 711                 *err = -ENOMEM;
 712                 goto failed;
 713         }
 714
 715         s->initiator = 1;
 716
 717         bacpy(&addr.l2_bdaddr, dst);
 718         addr.l2_family = AF_BLUETOOTH;
 719         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
 720         addr.l2_cid    = 0;
 721         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 722         if (*err == 0 || *err == -EINPROGRESS)
 723                 return s;
 724
 725         rfcomm_session_del(s);
 726         return NULL;
 727
 728 failed:
 729         sock_release(sock);
 730         return NULL;
 731 }
 732
 733 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 734 {
 735         struct sock *sk = s->sock->sk;
 736         if (src)
 737                 bacpy(src, &bt_sk(sk)->src);
 738         if (dst)
 739                 bacpy(dst, &bt_sk(sk)->dst);
 740 }
 741
 742 /* ---- RFCOMM frame sending ---- */
 743 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 744 {
 745         struct socket *sock = s->sock;
 746         struct kvec iv = { data, len };
 747         struct msghdr msg;
 748
 749         BT_DBG("session %p len %d", s, len);
 750
 751         memset(&msg, 0, sizeof(msg));
 752
 753         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 754 }
 755
 756 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 757 {
 758         struct rfcomm_cmd cmd;
 759
 760         BT_DBG("%p dlci %d", s, dlci);
 761
 762         cmd.addr = __addr(s->initiator, dlci);
 763         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 764         cmd.len  = __len8(0);
 765         cmd.fcs  = __fcs2((u8 *) &cmd);
 766
 767         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 768 }
 769
 770 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 771 {
 772         struct rfcomm_cmd cmd;
 773
 774         BT_DBG("%p dlci %d", s, dlci);
 775
 776         cmd.addr = __addr(!s->initiator, dlci);
 777         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 778         cmd.len  = __len8(0);
 779         cmd.fcs  = __fcs2((u8 *) &cmd);
 780
 781         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 782 }
 783
 784 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 785 {
 786         struct rfcomm_cmd cmd;
 787
 788         BT_DBG("%p dlci %d", s, dlci);
 789
 790         cmd.addr = __addr(s->initiator, dlci);
 791         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 792         cmd.len  = __len8(0);
 793         cmd.fcs  = __fcs2((u8 *) &cmd);
 794
 795         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 796 }
 797
 798 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 799 {
 800         struct rfcomm_cmd *cmd;
 801         struct sk_buff *skb;
 802
 803         BT_DBG("dlc %p dlci %d", d, d->dlci);
 804
 805         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 806         if (!skb)
 807                 return -ENOMEM;
 808
 809         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 810         cmd->addr = d->addr;
 811         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 812         cmd->len  = __len8(0);
 813         cmd->fcs  = __fcs2((u8 *) cmd);
 814
 815         skb_queue_tail(&d->tx_queue, skb);
 816         rfcomm_schedule(RFCOMM_SCHED_TX);
 817         return 0;
 818 }
 819
 820 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 821 {
 822         struct rfcomm_cmd cmd;
 823
 824         BT_DBG("%p dlci %d", s, dlci);
 825
 826         cmd.addr = __addr(!s->initiator, dlci);
 827         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 828         cmd.len  = __len8(0);
 829         cmd.fcs  = __fcs2((u8 *) &cmd);
 830
 831         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 832 }
 833
 834 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 835 {
 836         struct rfcomm_hdr *hdr;
 837         struct rfcomm_mcc *mcc;
 838         u8 buf[16], *ptr = buf;
 839
 840         BT_DBG("%p cr %d type %d", s, cr, type);
 841
 842         hdr = (void *) ptr; ptr += sizeof(*hdr);
 843         hdr->addr = __addr(s->initiator, 0);
 844         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 845         hdr->len  = __len8(sizeof(*mcc) + 1);
 846
 847         mcc = (void *) ptr; ptr += sizeof(*mcc);
 848         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 849         mcc->len  = __len8(1);
 850
 851         /* Type that we didn't like */
 852         *ptr = __mcc_type(cr, type); ptr++;
 853
 854         *ptr = __fcs(buf); ptr++;
 855
 856         return rfcomm_send_frame(s, buf, ptr - buf);
 857 }
 858
 859 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 860 {
 861         struct rfcomm_hdr *hdr;
 862         struct rfcomm_mcc *mcc;
 863         struct rfcomm_pn  *pn;
 864         u8 buf[16], *ptr = buf;
 865
 866         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 867
 868         hdr = (void *) ptr; ptr += sizeof(*hdr);
 869         hdr->addr = __addr(s->initiator, 0);
 870         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 871         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 872
 873         mcc = (void *) ptr; ptr += sizeof(*mcc);
 874         mcc->type = __mcc_type(cr, RFCOMM_PN);
 875         mcc->len  = __len8(sizeof(*pn));
 876
 877         pn = (void *) ptr; ptr += sizeof(*pn);
 878         pn->dlci        = d->dlci;
 879         pn->priority    = d->priority;
 880         pn->ack_timer   = 0;
 881         pn->max_retrans = 0;
 882
 883         if (s->cfc) {
 884                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 885                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 886         } else {
 887                 pn->flow_ctrl = 0;
 888                 pn->credits   = 0;
 889         }
 890
 891         if (cr && channel_mtu >= 0)
 892                 pn->mtu = cpu_to_le16(channel_mtu);
 893         else
 894                 pn->mtu = cpu_to_le16(d->mtu);
 895
 896         *ptr = __fcs(buf); ptr++;
 897
 898         return rfcomm_send_frame(s, buf, ptr - buf);
 899 }
 900
 901 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 902                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 903                         u8 parity, u8 flow_ctrl_settings,
 904                         u8 xon_char, u8 xoff_char, u16 param_mask)
 905 {
 906         struct rfcomm_hdr *hdr;
 907         struct rfcomm_mcc *mcc;
 908         struct rfcomm_rpn *rpn;
 909         u8 buf[16], *ptr = buf;
 910
 911         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 912                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 913                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 914                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 915
 916         hdr = (void *) ptr; ptr += sizeof(*hdr);
 917         hdr->addr = __addr(s->initiator, 0);
 918         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 919         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 920
 921         mcc = (void *) ptr; ptr += sizeof(*mcc);
 922         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 923         mcc->len  = __len8(sizeof(*rpn));
 924
 925         rpn = (void *) ptr; ptr += sizeof(*rpn);
 926         rpn->dlci          = __addr(1, dlci);
 927         rpn->bit_rate      = bit_rate;
 928         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 929         rpn->flow_ctrl     = flow_ctrl_settings;
 930         rpn->xon_char      = xon_char;
 931         rpn->xoff_char     = xoff_char;
 932         rpn->param_mask    = cpu_to_le16(param_mask);
 933
 934         *ptr = __fcs(buf); ptr++;
 935
 936         return rfcomm_send_frame(s, buf, ptr - buf);
 937 }
 938
 939 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 940 {
 941         struct rfcomm_hdr *hdr;
 942         struct rfcomm_mcc *mcc;
 943         struct rfcomm_rls *rls;
 944         u8 buf[16], *ptr = buf;
 945
 946         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 947
 948         hdr = (void *) ptr; ptr += sizeof(*hdr);
 949         hdr->addr = __addr(s->initiator, 0);
 950         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 951         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 952
 953         mcc = (void *) ptr; ptr += sizeof(*mcc);
 954         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 955         mcc->len  = __len8(sizeof(*rls));
 956
 957         rls = (void *) ptr; ptr += sizeof(*rls);
 958         rls->dlci   = __addr(1, dlci);
 959         rls->status = status;
 960
 961         *ptr = __fcs(buf); ptr++;
 962
 963         return rfcomm_send_frame(s, buf, ptr - buf);
 964 }
 965
 966 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 967 {
 968         struct rfcomm_hdr *hdr;
 969         struct rfcomm_mcc *mcc;
 970         struct rfcomm_msc *msc;
 971         u8 buf[16], *ptr = buf;
 972
 973         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 974
 975         hdr = (void *) ptr; ptr += sizeof(*hdr);
 976         hdr->addr = __addr(s->initiator, 0);
 977         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 978         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 979
 980         mcc = (void *) ptr; ptr += sizeof(*mcc);
 981         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 982         mcc->len  = __len8(sizeof(*msc));
 983
 984         msc = (void *) ptr; ptr += sizeof(*msc);
 985         msc->dlci    = __addr(1, dlci);
 986         msc->v24_sig = v24_sig | 0x01;
 987
 988         *ptr = __fcs(buf); ptr++;
 989
 990         return rfcomm_send_frame(s, buf, ptr - buf);
 991 }
 992
 993 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 994 {
 995         struct rfcomm_hdr *hdr;
 996         struct rfcomm_mcc *mcc;
 997         u8 buf[16], *ptr = buf;
 998
 999         BT_DBG("%p cr %d", s, cr);
1000
1001         hdr = (void *) ptr; ptr += sizeof(*hdr);
1002         hdr->addr = __addr(s->initiator, 0);
1003         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1004         hdr->len  = __len8(sizeof(*mcc));
1005
1006         mcc = (void *) ptr; ptr += sizeof(*mcc);
1007         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1008         mcc->len  = __len8(0);
1009
1010         *ptr = __fcs(buf); ptr++;
1011
1012         return rfcomm_send_frame(s, buf, ptr - buf);
1013 }
1014
1015 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1016 {
1017         struct rfcomm_hdr *hdr;
1018         struct rfcomm_mcc *mcc;
1019         u8 buf[16], *ptr = buf;
1020
1021         BT_DBG("%p cr %d", s, cr);
1022
1023         hdr = (void *) ptr; ptr += sizeof(*hdr);
1024         hdr->addr = __addr(s->initiator, 0);
1025         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1026         hdr->len  = __len8(sizeof(*mcc));
1027
1028         mcc = (void *) ptr; ptr += sizeof(*mcc);
1029         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1030         mcc->len  = __len8(0);
1031
1032         *ptr = __fcs(buf); ptr++;
1033
1034         return rfcomm_send_frame(s, buf, ptr - buf);
1035 }
1036
1037 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1038 {
1039         struct socket *sock = s->sock;
1040         struct kvec iv[3];
1041         struct msghdr msg;
1042         unsigned char hdr[5], crc[1];
1043
1044         if (len > 125)
1045                 return -EINVAL;
1046
1047         BT_DBG("%p cr %d", s, cr);
1048
1049         hdr[0] = __addr(s->initiator, 0);
1050         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1051         hdr[2] = 0x01 | ((len + 2) << 1);
1052         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1053         hdr[4] = 0x01 | (len << 1);
1054
1055         crc[0] = __fcs(hdr);
1056
1057         iv[0].iov_base = hdr;
1058         iv[0].iov_len  = 5;
1059         iv[1].iov_base = pattern;
1060         iv[1].iov_len  = len;
1061         iv[2].iov_base = crc;
1062         iv[2].iov_len  = 1;
1063
1064         memset(&msg, 0, sizeof(msg));
1065
1066         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1067 }
1068
1069 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1070 {
1071         struct rfcomm_hdr *hdr;
1072         u8 buf[16], *ptr = buf;
1073
1074         BT_DBG("%p addr %d credits %d", s, addr, credits);
1075
1076         hdr = (void *) ptr; ptr += sizeof(*hdr);
1077         hdr->addr = addr;
1078         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1079         hdr->len  = __len8(0);
1080
1081         *ptr = credits; ptr++;
1082
1083         *ptr = __fcs(buf); ptr++;
1084
1085         return rfcomm_send_frame(s, buf, ptr - buf);
1086 }
1087
1088 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1089 {
1090         struct rfcomm_hdr *hdr;
1091         int len = skb->len;
1092         u8 *crc;
1093
1094         if (len > 127) {
1095                 hdr = (void *) skb_push(skb, 4);
1096                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1097         } else {
1098                 hdr = (void *) skb_push(skb, 3);
1099                 hdr->len = __len8(len);
1100         }
1101         hdr->addr = addr;
1102         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1103
1104         crc = skb_put(skb, 1);
1105         *crc = __fcs((void *) hdr);
1106 }
1107
1108 /* ---- RFCOMM frame reception ---- */
1109 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1110 {
1111         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1112
1113         if (dlci) {
1114                 /* Data channel */
1115                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1116                 if (!d) {
1117                         rfcomm_send_dm(s, dlci);
1118                         return 0;
1119                 }
1120
1121                 switch (d->state) {
1122                 case BT_CONNECT:
1123                         rfcomm_dlc_clear_timer(d);
1124
1125                         rfcomm_dlc_lock(d);
1126                         d->state = BT_CONNECTED;
1127                         d->state_change(d, 0);
1128                         rfcomm_dlc_unlock(d);
1129
1130                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1131                         break;
1132
1133                 case BT_DISCONN:
1134                         d->state = BT_CLOSED;
1135                         __rfcomm_dlc_close(d, 0);
1136
1137                         if (list_empty(&s->dlcs)) {
1138                                 s->state = BT_DISCONN;
1139                                 rfcomm_send_disc(s, 0);
1140                         }
1141
1142                         break;
1143                 }
1144         } else {
1145                 /* Control channel */
1146                 switch (s->state) {
1147                 case BT_CONNECT:
1148                         s->state = BT_CONNECTED;
1149                         rfcomm_process_connect(s);
1150                         break;
1151
1152                 case BT_DISCONN:
1153                         /* When socket is closed and we are not RFCOMM
1154                          * initiator rfcomm_process_rx already calls
1155                          * rfcomm_session_put() */
1156                         if (s->sock->sk->sk_state != BT_CLOSED)
1157                                 rfcomm_session_put(s);
1158                         break;
1159                 }
1160         }
1161         return 0;
1162 }
1163
1164 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1165 {
1166         int err = 0;
1167
1168         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1169
1170         if (dlci) {
1171                 /* Data DLC */
1172                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1173                 if (d) {
1174                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1175                                 err = ECONNREFUSED;
1176                         else
1177                                 err = ECONNRESET;
1178
1179                         d->state = BT_CLOSED;
1180                         __rfcomm_dlc_close(d, err);
1181                 }
1182         } else {
1183                 if (s->state == BT_CONNECT)
1184                         err = ECONNREFUSED;
1185                 else
1186                         err = ECONNRESET;
1187
1188                 s->state = BT_CLOSED;
1189                 rfcomm_session_close(s, err);
1190         }
1191         return 0;
1192 }
1193
1194 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1195 {
1196         int err = 0;
1197
1198         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1199
1200         if (dlci) {
1201                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1202                 if (d) {
1203                         rfcomm_send_ua(s, dlci);
1204
1205                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1206                                 err = ECONNREFUSED;
1207                         else
1208                                 err = ECONNRESET;
1209
1210                         d->state = BT_CLOSED;
1211                         __rfcomm_dlc_close(d, err);
1212                 } else
1213                         rfcomm_send_dm(s, dlci);
1214
1215         } else {
1216                 rfcomm_send_ua(s, 0);
1217
1218                 if (s->state == BT_CONNECT)
1219                         err = ECONNREFUSED;
1220                 else
1221                         err = ECONNRESET;
1222
1223                 s->state = BT_CLOSED;
1224                 rfcomm_session_close(s, err);
1225         }
1226
1227         return 0;
1228 }
1229
1230 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1231 {
1232         struct sock *sk = d->session->sock->sk;
1233
1234         BT_DBG("dlc %p", d);
1235
1236         rfcomm_send_ua(d->session, d->dlci);
1237
1238         rfcomm_dlc_clear_timer(d);
1239
1240         rfcomm_dlc_lock(d);
1241         d->state = BT_CONNECTED;
1242         d->state_change(d, 0);
1243         rfcomm_dlc_unlock(d);
1244
1245         if (d->role_switch)
1246                 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1247
1248         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1249 }
1250
1251 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1252 {
1253         if (rfcomm_check_security(d)) {
1254                 if (d->defer_setup) {
1255                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1256                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1257
1258                         rfcomm_dlc_lock(d);
1259                         d->state = BT_CONNECT2;
1260                         d->state_change(d, 0);
1261                         rfcomm_dlc_unlock(d);
1262                 } else
1263                         rfcomm_dlc_accept(d);
1264         } else {
1265                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1266                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1267         }
1268 }
1269
1270 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1271 {
1272         struct rfcomm_dlc *d;
1273         u8 channel;
1274
1275         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1276
1277         if (!dlci) {
1278                 rfcomm_send_ua(s, 0);
1279
1280                 if (s->state == BT_OPEN) {
1281                         s->state = BT_CONNECTED;
1282                         rfcomm_process_connect(s);
1283                 }
1284                 return 0;
1285         }
1286
1287         /* Check if DLC exists */
1288         d = rfcomm_dlc_get(s, dlci);
1289         if (d) {
1290                 if (d->state == BT_OPEN) {
1291                         /* DLC was previously opened by PN request */
1292                         rfcomm_check_accept(d);
1293                 }
1294                 return 0;
1295         }
1296
1297         /* Notify socket layer about incoming connection */
1298         channel = __srv_channel(dlci);
1299         if (rfcomm_connect_ind(s, channel, &d)) {
1300                 d->dlci = dlci;
1301                 d->addr = __addr(s->initiator, dlci);
1302                 rfcomm_dlc_link(s, d);
1303
1304                 rfcomm_check_accept(d);
1305         } else {
1306                 rfcomm_send_dm(s, dlci);
1307         }
1308
1309         return 0;
1310 }
1311
1312 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1313 {
1314         struct rfcomm_session *s = d->session;
1315
1316         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1317                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1318
1319         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1320                                                 pn->flow_ctrl == 0xe0) {
1321                 d->cfc = RFCOMM_CFC_ENABLED;
1322                 d->tx_credits = pn->credits;
1323         } else {
1324                 d->cfc = RFCOMM_CFC_DISABLED;
1325                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1326         }
1327
1328         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1329                 s->cfc = d->cfc;
1330
1331         d->priority = pn->priority;
1332
1333         d->mtu = __le16_to_cpu(pn->mtu);
1334
1335         if (cr && d->mtu > s->mtu)
1336                 d->mtu = s->mtu;
1337
1338         return 0;
1339 }
1340
1341 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1342 {
1343         struct rfcomm_pn *pn = (void *) skb->data;
1344         struct rfcomm_dlc *d;
1345         u8 dlci = pn->dlci;
1346
1347         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1348
1349         if (!dlci)
1350                 return 0;
1351
1352         d = rfcomm_dlc_get(s, dlci);
1353         if (d) {
1354                 if (cr) {
1355                         /* PN request */
1356                         rfcomm_apply_pn(d, cr, pn);
1357                         rfcomm_send_pn(s, 0, d);
1358                 } else {
1359                         /* PN response */
1360                         switch (d->state) {
1361                         case BT_CONFIG:
1362                                 rfcomm_apply_pn(d, cr, pn);
1363
1364                                 d->state = BT_CONNECT;
1365                                 rfcomm_send_sabm(s, d->dlci);
1366                                 break;
1367                         }
1368                 }
1369         } else {
1370                 u8 channel = __srv_channel(dlci);
1371
1372                 if (!cr)
1373                         return 0;
1374
1375                 /* PN request for non existing DLC.
1376                  * Assume incoming connection. */
1377                 if (rfcomm_connect_ind(s, channel, &d)) {
1378                         d->dlci = dlci;
1379                         d->addr = __addr(s->initiator, dlci);
1380                         rfcomm_dlc_link(s, d);
1381
1382                         rfcomm_apply_pn(d, cr, pn);
1383
1384                         d->state = BT_OPEN;
1385                         rfcomm_send_pn(s, 0, d);
1386                 } else {
1387                         rfcomm_send_dm(s, dlci);
1388                 }
1389         }
1390         return 0;
1391 }
1392
1393 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1394 {
1395         struct rfcomm_rpn *rpn = (void *) skb->data;
1396         u8 dlci = __get_dlci(rpn->dlci);
1397
1398         u8 bit_rate  = 0;
1399         u8 data_bits = 0;
1400         u8 stop_bits = 0;
1401         u8 parity    = 0;
1402         u8 flow_ctrl = 0;
1403         u8 xon_char  = 0;
1404         u8 xoff_char = 0;
1405         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1406
1407         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1408                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1409                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1410
1411         if (!cr)
1412                 return 0;
1413
1414         if (len == 1) {
1415                 /* This is a request, return default settings */
1416                 bit_rate  = RFCOMM_RPN_BR_115200;
1417                 data_bits = RFCOMM_RPN_DATA_8;
1418                 stop_bits = RFCOMM_RPN_STOP_1;
1419                 parity    = RFCOMM_RPN_PARITY_NONE;
1420                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1421                 xon_char  = RFCOMM_RPN_XON_CHAR;
1422                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1423                 goto rpn_out;
1424         }
1425
1426         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1427          * no parity, no flow control lines, normal XON/XOFF chars */
1428
1429         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1430                 bit_rate = rpn->bit_rate;
1431                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1432                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1433                         bit_rate = RFCOMM_RPN_BR_115200;
1434                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1435                 }
1436         }
1437
1438         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1439                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1440                 if (data_bits != RFCOMM_RPN_DATA_8) {
1441                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1442                         data_bits = RFCOMM_RPN_DATA_8;
1443                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1444                 }
1445         }
1446
1447         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1448                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1449                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1450                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1451                         stop_bits = RFCOMM_RPN_STOP_1;
1452                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1453                 }
1454         }
1455
1456         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1457                 parity = __get_rpn_parity(rpn->line_settings);
1458                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1459                         BT_DBG("RPN parity mismatch 0x%x", parity);
1460                         parity = RFCOMM_RPN_PARITY_NONE;
1461                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1462                 }
1463         }
1464
1465         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1466                 flow_ctrl = rpn->flow_ctrl;
1467                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1468                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1469                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1470                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1471                 }
1472         }
1473
1474         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1475                 xon_char = rpn->xon_char;
1476                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1477                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1478                         xon_char = RFCOMM_RPN_XON_CHAR;
1479                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1480                 }
1481         }
1482
1483         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1484                 xoff_char = rpn->xoff_char;
1485                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1486                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1487                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1488                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1489                 }
1490         }
1491
1492 rpn_out:
1493         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1494                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1495
1496         return 0;
1497 }
1498
1499 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1500 {
1501         struct rfcomm_rls *rls = (void *) skb->data;
1502         u8 dlci = __get_dlci(rls->dlci);
1503
1504         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1505
1506         if (!cr)
1507                 return 0;
1508
1509         /* We should probably do something with this information here. But
1510          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1511          * mandatory to recognise and respond to RLS */
1512
1513         rfcomm_send_rls(s, 0, dlci, rls->status);
1514
1515         return 0;
1516 }
1517
1518 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1519 {
1520         struct rfcomm_msc *msc = (void *) skb->data;
1521         struct rfcomm_dlc *d;
1522         u8 dlci = __get_dlci(msc->dlci);
1523
1524         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1525
1526         d = rfcomm_dlc_get(s, dlci);
1527         if (!d)
1528                 return 0;
1529
1530         if (cr) {
1531                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1532                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1533                 else
1534                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1535
1536                 rfcomm_dlc_lock(d);
1537
1538                 d->remote_v24_sig = msc->v24_sig;
1539
1540                 if (d->modem_status)
1541                         d->modem_status(d, msc->v24_sig);
1542
1543                 rfcomm_dlc_unlock(d);
1544
1545                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1546
1547                 d->mscex |= RFCOMM_MSCEX_RX;
1548         } else
1549                 d->mscex |= RFCOMM_MSCEX_TX;
1550
1551         return 0;
1552 }
1553
1554 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1555 {
1556         struct rfcomm_mcc *mcc = (void *) skb->data;
1557         u8 type, cr, len;
1558
1559         cr   = __test_cr(mcc->type);
1560         type = __get_mcc_type(mcc->type);
1561         len  = __get_mcc_len(mcc->len);
1562
1563         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1564
1565         skb_pull(skb, 2);
1566
1567         switch (type) {
1568         case RFCOMM_PN:
1569                 rfcomm_recv_pn(s, cr, skb);
1570                 break;
1571
1572         case RFCOMM_RPN:
1573                 rfcomm_recv_rpn(s, cr, len, skb);
1574                 break;
1575
1576         case RFCOMM_RLS:
1577                 rfcomm_recv_rls(s, cr, skb);
1578                 break;
1579
1580         case RFCOMM_MSC:
1581                 rfcomm_recv_msc(s, cr, skb);
1582                 break;
1583
1584         case RFCOMM_FCOFF:
1585                 if (cr) {
1586                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1587                         rfcomm_send_fcoff(s, 0);
1588                 }
1589                 break;
1590
1591         case RFCOMM_FCON:
1592                 if (cr) {
1593                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1594                         rfcomm_send_fcon(s, 0);
1595                 }
1596                 break;
1597
1598         case RFCOMM_TEST:
1599                 if (cr)
1600                         rfcomm_send_test(s, 0, skb->data, skb->len);
1601                 break;
1602
1603         case RFCOMM_NSC:
1604                 break;
1605
1606         default:
1607                 BT_ERR("Unknown control type 0x%02x", type);
1608                 rfcomm_send_nsc(s, cr, type);
1609                 break;
1610         }
1611         return 0;
1612 }
1613
1614 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1615 {
1616         struct rfcomm_dlc *d;
1617
1618         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1619
1620         d = rfcomm_dlc_get(s, dlci);
1621         if (!d) {
1622                 rfcomm_send_dm(s, dlci);
1623                 goto drop;
1624         }
1625
1626         if (pf && d->cfc) {
1627                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1628
1629                 d->tx_credits += credits;
1630                 if (d->tx_credits)
1631                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1632         }
1633
1634         if (skb->len && d->state == BT_CONNECTED) {
1635                 rfcomm_dlc_lock(d);
1636                 d->rx_credits--;
1637                 d->data_ready(d, skb);
1638                 rfcomm_dlc_unlock(d);
1639                 return 0;
1640         }
1641
1642 drop:
1643         kfree_skb(skb);
1644         return 0;
1645 }
1646
1647 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1648 {
1649         struct rfcomm_hdr *hdr = (void *) skb->data;
1650         u8 type, dlci, fcs;
1651
1652         dlci = __get_dlci(hdr->addr);
1653         type = __get_type(hdr->ctrl);
1654
1655         /* Trim FCS */
1656         skb->len--; skb->tail--;
1657         fcs = *(u8 *)skb_tail_pointer(skb);
1658
1659         if (__check_fcs(skb->data, type, fcs)) {
1660                 BT_ERR("bad checksum in packet");
1661                 kfree_skb(skb);
1662                 return -EILSEQ;
1663         }
1664
1665         if (__test_ea(hdr->len))
1666                 skb_pull(skb, 3);
1667         else
1668                 skb_pull(skb, 4);
1669
1670         switch (type) {
1671         case RFCOMM_SABM:
1672                 if (__test_pf(hdr->ctrl))
1673                         rfcomm_recv_sabm(s, dlci);
1674                 break;
1675
1676         case RFCOMM_DISC:
1677                 if (__test_pf(hdr->ctrl))
1678                         rfcomm_recv_disc(s, dlci);
1679                 break;
1680
1681         case RFCOMM_UA:
1682                 if (__test_pf(hdr->ctrl))
1683                         rfcomm_recv_ua(s, dlci);
1684                 break;
1685
1686         case RFCOMM_DM:
1687                 rfcomm_recv_dm(s, dlci);
1688                 break;
1689
1690         case RFCOMM_UIH:
1691                 if (dlci)
1692                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1693
1694                 rfcomm_recv_mcc(s, skb);
1695                 break;
1696
1697         default:
1698                 BT_ERR("Unknown packet type 0x%02x\n", type);
1699                 break;
1700         }
1701         kfree_skb(skb);
1702         return 0;
1703 }
1704
1705 /* ---- Connection and data processing ---- */
1706
1707 static void rfcomm_process_connect(struct rfcomm_session *s)
1708 {
1709         struct rfcomm_dlc *d;
1710         struct list_head *p, *n;
1711
1712         BT_DBG("session %p state %ld", s, s->state);
1713
1714         list_for_each_safe(p, n, &s->dlcs) {
1715                 d = list_entry(p, struct rfcomm_dlc, list);
1716                 if (d->state == BT_CONFIG) {
1717                         d->mtu = s->mtu;
1718                         if (rfcomm_check_security(d)) {
1719                                 rfcomm_send_pn(s, 1, d);
1720                         } else {
1721                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1722                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1723                         }
1724                 }
1725         }
1726 }
1727
1728 /* Send data queued for the DLC.
1729  * Return number of frames left in the queue.
1730  */
1731 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1732 {
1733         struct sk_buff *skb;
1734         int err;
1735
1736         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1737                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1738
1739         /* Send pending MSC */
1740         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1741                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1742
1743         if (d->cfc) {
1744                 /* CFC enabled.
1745                  * Give them some credits */
1746                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1747                                 d->rx_credits <= (d->cfc >> 2)) {
1748                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1749                         d->rx_credits = d->cfc;
1750                 }
1751         } else {
1752                 /* CFC disabled.
1753                  * Give ourselves some credits */
1754                 d->tx_credits = 5;
1755         }
1756
1757         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1758                 return skb_queue_len(&d->tx_queue);
1759
1760         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1761                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1762                 if (err < 0) {
1763                         skb_queue_head(&d->tx_queue, skb);
1764                         break;
1765                 }
1766                 kfree_skb(skb);
1767                 d->tx_credits--;
1768         }
1769
1770         if (d->cfc && !d->tx_credits) {
1771                 /* We're out of TX credits.
1772                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1773                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1774         }
1775
1776         return skb_queue_len(&d->tx_queue);
1777 }
1778
1779 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1780 {
1781         struct rfcomm_dlc *d;
1782         struct list_head *p, *n;
1783
1784         BT_DBG("session %p state %ld", s, s->state);
1785
1786         list_for_each_safe(p, n, &s->dlcs) {
1787                 d = list_entry(p, struct rfcomm_dlc, list);
1788
1789                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1790                         __rfcomm_dlc_close(d, ETIMEDOUT);
1791                         continue;
1792                 }
1793
1794                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1795                         rfcomm_dlc_clear_timer(d);
1796                         if (d->out) {
1797                                 rfcomm_send_pn(s, 1, d);
1798                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1799                         } else {
1800                                 if (d->defer_setup) {
1801                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1802                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1803
1804                                         rfcomm_dlc_lock(d);
1805                                         d->state = BT_CONNECT2;
1806                                         d->state_change(d, 0);
1807                                         rfcomm_dlc_unlock(d);
1808                                 } else
1809                                         rfcomm_dlc_accept(d);
1810                         }
1811                         continue;
1812                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1813                         rfcomm_dlc_clear_timer(d);
1814                         if (!d->out)
1815                                 rfcomm_send_dm(s, d->dlci);
1816                         else
1817                                 d->state = BT_CLOSED;
1818                         __rfcomm_dlc_close(d, ECONNREFUSED);
1819                         continue;
1820                 }
1821
1822                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1823                         continue;
1824
1825                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1826                         continue;
1827
1828                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1829                                                 d->mscex == RFCOMM_MSCEX_OK)
1830                         rfcomm_process_tx(d);
1831         }
1832 }
1833
1834 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1835 {
1836         struct socket *sock = s->sock;
1837         struct sock *sk = sock->sk;
1838         struct sk_buff *skb;
1839
1840         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1841
1842         /* Get data directly from socket receive queue without copying it. */
1843         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1844                 skb_orphan(skb);
1845                 rfcomm_recv_frame(s, skb);
1846         }
1847
1848         if (sk->sk_state == BT_CLOSED) {
1849                 if (!s->initiator)
1850                         rfcomm_session_put(s);
1851
1852                 rfcomm_session_close(s, sk->sk_err);
1853         }
1854 }
1855
1856 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1857 {
1858         struct socket *sock = s->sock, *nsock;
1859         int err;
1860
1861         /* Fast check for a new connection.
1862          * Avoids unnesesary socket allocations. */
1863         if (list_empty(&bt_sk(sock->sk)->accept_q))
1864                 return;
1865
1866         BT_DBG("session %p", s);
1867
1868         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1869         if (err < 0)
1870                 return;
1871
1872         /* Set our callbacks */
1873         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1874         nsock->sk->sk_state_change = rfcomm_l2state_change;
1875
1876         s = rfcomm_session_add(nsock, BT_OPEN);
1877         if (s) {
1878                 rfcomm_session_hold(s);
1879
1880                 /* We should adjust MTU on incoming sessions.
1881                  * L2CAP MTU minus UIH header and FCS. */
1882                 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1883
1884                 rfcomm_schedule(RFCOMM_SCHED_RX);
1885         } else
1886                 sock_release(nsock);
1887 }
1888
1889 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1890 {
1891         struct sock *sk = s->sock->sk;
1892
1893         BT_DBG("%p state %ld", s, s->state);
1894
1895         switch(sk->sk_state) {
1896         case BT_CONNECTED:
1897                 s->state = BT_CONNECT;
1898
1899                 /* We can adjust MTU on outgoing sessions.
1900                  * L2CAP MTU minus UIH header and FCS. */
1901                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1902
1903                 rfcomm_send_sabm(s, 0);
1904                 break;
1905
1906         case BT_CLOSED:
1907                 s->state = BT_CLOSED;
1908                 rfcomm_session_close(s, sk->sk_err);
1909                 break;
1910         }
1911 }
1912
1913 static inline void rfcomm_process_sessions(void)
1914 {
1915         struct list_head *p, *n;
1916
1917         rfcomm_lock();
1918
1919         list_for_each_safe(p, n, &session_list) {
1920                 struct rfcomm_session *s;
1921                 s = list_entry(p, struct rfcomm_session, list);
1922
1923                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1924                         s->state = BT_DISCONN;
1925                         rfcomm_send_disc(s, 0);
1926                         rfcomm_session_put(s);
1927                         continue;
1928                 }
1929
1930                 if (s->state == BT_LISTEN) {
1931                         rfcomm_accept_connection(s);
1932                         continue;
1933                 }
1934
1935                 rfcomm_session_hold(s);
1936
1937                 switch (s->state) {
1938                 case BT_BOUND:
1939                         rfcomm_check_connection(s);
1940                         break;
1941
1942                 default:
1943                         rfcomm_process_rx(s);
1944                         break;
1945                 }
1946
1947                 rfcomm_process_dlcs(s);
1948
1949                 rfcomm_session_put(s);
1950         }
1951
1952         rfcomm_unlock();
1953 }
1954
1955 static int rfcomm_add_listener(bdaddr_t *ba)
1956 {
1957         struct sockaddr_l2 addr;
1958         struct socket *sock;
1959         struct sock *sk;
1960         struct rfcomm_session *s;
1961         int    err = 0;
1962
1963         /* Create socket */
1964         err = rfcomm_l2sock_create(&sock);
1965         if (err < 0) {
1966                 BT_ERR("Create socket failed %d", err);
1967                 return err;
1968         }
1969
1970         /* Bind socket */
1971         bacpy(&addr.l2_bdaddr, ba);
1972         addr.l2_family = AF_BLUETOOTH;
1973         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
1974         addr.l2_cid    = 0;
1975         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1976         if (err < 0) {
1977                 BT_ERR("Bind failed %d", err);
1978                 goto failed;
1979         }
1980
1981         /* Set L2CAP options */
1982         sk = sock->sk;
1983         lock_sock(sk);
1984         l2cap_pi(sk)->imtu = l2cap_mtu;
1985         release_sock(sk);
1986
1987         /* Start listening on the socket */
1988         err = kernel_listen(sock, 10);
1989         if (err) {
1990                 BT_ERR("Listen failed %d", err);
1991                 goto failed;
1992         }
1993
1994         /* Add listening session */
1995         s = rfcomm_session_add(sock, BT_LISTEN);
1996         if (!s)
1997                 goto failed;
1998
1999         rfcomm_session_hold(s);
2000         return 0;
2001 failed:
2002         sock_release(sock);
2003         return err;
2004 }
2005
2006 static void rfcomm_kill_listener(void)
2007 {
2008         struct rfcomm_session *s;
2009         struct list_head *p, *n;
2010
2011         BT_DBG("");
2012
2013         list_for_each_safe(p, n, &session_list) {
2014                 s = list_entry(p, struct rfcomm_session, list);
2015                 rfcomm_session_del(s);
2016         }
2017 }
2018
2019 static int rfcomm_run(void *unused)
2020 {
2021         BT_DBG("");
2022
2023         set_user_nice(current, -10);
2024
2025         rfcomm_add_listener(BDADDR_ANY);
2026
2027         while (!kthread_should_stop()) {
2028                 set_current_state(TASK_INTERRUPTIBLE);
2029                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
2030                         /* No pending events. Let's sleep.
2031                          * Incoming connections and data will wake us up. */
2032                         schedule();
2033                 }
2034                 set_current_state(TASK_RUNNING);
2035
2036                 /* Process stuff */
2037                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
2038                 rfcomm_process_sessions();
2039         }
2040
2041         rfcomm_kill_listener();
2042
2043         return 0;
2044 }
2045
2046 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2047 {
2048         struct rfcomm_session *s;
2049         struct rfcomm_dlc *d;
2050         struct list_head *p, *n;
2051
2052         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2053
2054         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2055         if (!s)
2056                 return;
2057
2058         rfcomm_session_hold(s);
2059
2060         list_for_each_safe(p, n, &s->dlcs) {
2061                 d = list_entry(p, struct rfcomm_dlc, list);
2062
2063                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2064                         rfcomm_dlc_clear_timer(d);
2065                         if (status || encrypt == 0x00) {
2066                                 __rfcomm_dlc_close(d, ECONNREFUSED);
2067                                 continue;
2068                         }
2069                 }
2070
2071                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2072                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2073                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2074                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2075                                 continue;
2076                         } else if (d->sec_level == BT_SECURITY_HIGH) {
2077                                 __rfcomm_dlc_close(d, ECONNREFUSED);
2078                                 continue;
2079                         }
2080                 }
2081
2082                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2083                         continue;
2084
2085                 if (!status)
2086                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2087                 else
2088                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2089         }
2090
2091         rfcomm_session_put(s);
2092
2093         rfcomm_schedule(RFCOMM_SCHED_AUTH);
2094 }
2095
2096 static struct hci_cb rfcomm_cb = {
2097         .name           = "RFCOMM",
2098         .security_cfm   = rfcomm_security_cfm
2099 };
2100
2101 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2102 {
2103         struct rfcomm_session *s;
2104         struct list_head *pp, *p;
2105         char *str = buf;
2106
2107         rfcomm_lock();
2108
2109         list_for_each(p, &session_list) {
2110                 s = list_entry(p, struct rfcomm_session, list);
2111                 list_for_each(pp, &s->dlcs) {
2112                         struct sock *sk = s->sock->sk;
2113                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2114
2115                         str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2116                                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2117                                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2118                 }
2119         }
2120
2121         rfcomm_unlock();
2122
2123         return (str - buf);
2124 }
2125
2126 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2127
2128 /* ---- Initialization ---- */
2129 static int __init rfcomm_init(void)
2130 {
2131         int err;
2132
2133         l2cap_load();
2134
2135         hci_register_cb(&rfcomm_cb);
2136
2137         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2138         if (IS_ERR(rfcomm_thread)) {
2139                 err = PTR_ERR(rfcomm_thread);
2140                 goto unregister;
2141         }
2142
2143         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2144                 BT_ERR("Failed to create RFCOMM info file");
2145
2146         err = rfcomm_init_ttys();
2147         if (err < 0)
2148                 goto stop;
2149
2150         err = rfcomm_init_sockets();
2151         if (err < 0)
2152                 goto cleanup;
2153
2154         BT_INFO("RFCOMM ver %s", VERSION);
2155
2156         return 0;
2157
2158 cleanup:
2159         rfcomm_cleanup_ttys();
2160
2161 stop:
2162         kthread_stop(rfcomm_thread);
2163
2164 unregister:
2165         hci_unregister_cb(&rfcomm_cb);
2166
2167         return err;
2168 }
2169
2170 static void __exit rfcomm_exit(void)
2171 {
2172         class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2173
2174         hci_unregister_cb(&rfcomm_cb);
2175
2176         kthread_stop(rfcomm_thread);
2177
2178         rfcomm_cleanup_ttys();
2179
2180         rfcomm_cleanup_sockets();
2181 }
2182
2183 module_init(rfcomm_init);
2184 module_exit(rfcomm_exit);
2185
2186 module_param(disable_cfc, bool, 0644);
2187 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2188
2189 module_param(channel_mtu, int, 0644);
2190 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2191
2192 module_param(l2cap_mtu, uint, 0644);
2193 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2194
2195 module_param(l2cap_ertm, bool, 0644);
2196 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2197
2198 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2199 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2200 MODULE_VERSION(VERSION);
2201 MODULE_LICENSE("GPL");
2202 MODULE_ALIAS("bt-proto-3");