net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  *
  27  * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
  28  */
  29
  30 #include <linux/module.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/signal.h>
  35 #include <linux/init.h>
  36 #include <linux/wait.h>
  37 #include <linux/device.h>
  38 #include <linux/net.h>
  39 #include <linux/mutex.h>
  40 #include <linux/kthread.h>
  41
  42 #include <net/sock.h>
  43 #include <asm/uaccess.h>
  44 #include <asm/unaligned.h>
  45
  46 #include <net/bluetooth/bluetooth.h>
  47 #include <net/bluetooth/hci_core.h>
  48 #include <net/bluetooth/l2cap.h>
  49 #include <net/bluetooth/rfcomm.h>
  50
  51 #ifndef CONFIG_BT_RFCOMM_DEBUG
  52 #undef  BT_DBG
  53 #define BT_DBG(D...)
  54 #endif
  55
  56 #define VERSION "1.8"
  57
  58 static int disable_cfc = 0;
  59 static int channel_mtu = -1;
  60 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  61
  62 static struct task_struct *rfcomm_thread;
  63
  64 static DEFINE_MUTEX(rfcomm_mutex);
  65 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  66 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  67
  68 static unsigned long rfcomm_event;
  69
  70 static LIST_HEAD(session_list);
  71
  72 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  73 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  74 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  75 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  76 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  77 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  78 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  79 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  80 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  81 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  82
  83 static void rfcomm_process_connect(struct rfcomm_session *s);
  84
  85 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
  86 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  87 static void rfcomm_session_del(struct rfcomm_session *s);
  88
  89 /* ---- RFCOMM frame parsing macros ---- */
  90 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  91 #define __get_channel(b)  ((b & 0xf8) >> 3)
  92 #define __get_dir(b)      ((b & 0x04) >> 2)
  93 #define __get_type(b)     ((b & 0xef))
  94
  95 #define __test_ea(b)      ((b & 0x01))
  96 #define __test_cr(b)      ((b & 0x02))
  97 #define __test_pf(b)      ((b & 0x10))
  98
  99 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 100 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
 101 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
 102 #define __srv_channel(dlci)    (dlci >> 1)
 103 #define __dir(dlci)            (dlci & 0x01)
 104
 105 #define __len8(len)       (((len) << 1) | 1)
 106 #define __len16(len)      ((len) << 1)
 107
 108 /* MCC macros */
 109 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 110 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 111 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 112
 113 /* RPN macros */
 114 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 115 #define __get_rpn_data_bits(line) ((line) & 0x3)
 116 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 117 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 118
 119 static inline void rfcomm_schedule(uint event)
 120 {
 121         if (!rfcomm_thread)
 122                 return;
 123         //set_bit(event, &rfcomm_event);
 124         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
 125         wake_up_process(rfcomm_thread);
 126 }
 127
 128 static inline void rfcomm_session_put(struct rfcomm_session *s)
 129 {
 130         if (atomic_dec_and_test(&s->refcnt))
 131                 rfcomm_session_del(s);
 132 }
 133
 134 /* ---- RFCOMM FCS computation ---- */
 135
 136 /* reversed, 8-bit, poly=0x07 */
 137 static unsigned char rfcomm_crc_table[256] = {
 138         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 139         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 140         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 141         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 142
 143         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 144         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 145         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 146         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 147
 148         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 149         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 150         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 151         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 152
 153         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 154         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 155         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 156         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 157
 158         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 159         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 160         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 161         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 162
 163         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 164         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 165         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 166         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 167
 168         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 169         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 170         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 171         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 172
 173         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 174         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 175         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 176         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 177 };
 178
 179 /* CRC on 2 bytes */
 180 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 181
 182 /* FCS on 2 bytes */
 183 static inline u8 __fcs(u8 *data)
 184 {
 185         return (0xff - __crc(data));
 186 }
 187
 188 /* FCS on 3 bytes */
 189 static inline u8 __fcs2(u8 *data)
 190 {
 191         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 192 }
 193
 194 /* Check FCS */
 195 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 196 {
 197         u8 f = __crc(data);
 198
 199         if (type != RFCOMM_UIH)
 200                 f = rfcomm_crc_table[f ^ data[2]];
 201
 202         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 203 }
 204
 205 /* ---- L2CAP callbacks ---- */
 206 static void rfcomm_l2state_change(struct sock *sk)
 207 {
 208         BT_DBG("%p state %d", sk, sk->sk_state);
 209         rfcomm_schedule(RFCOMM_SCHED_STATE);
 210 }
 211
 212 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 213 {
 214         BT_DBG("%p bytes %d", sk, bytes);
 215         rfcomm_schedule(RFCOMM_SCHED_RX);
 216 }
 217
 218 static int rfcomm_l2sock_create(struct socket **sock)
 219 {
 220         int err;
 221
 222         BT_DBG("");
 223
 224         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 225         if (!err) {
 226                 struct sock *sk = (*sock)->sk;
 227                 sk->sk_data_ready   = rfcomm_l2data_ready;
 228                 sk->sk_state_change = rfcomm_l2state_change;
 229         }
 230         return err;
 231 }
 232
 233 /* ---- RFCOMM DLCs ---- */
 234 static void rfcomm_dlc_timeout(unsigned long arg)
 235 {
 236         struct rfcomm_dlc *d = (void *) arg;
 237
 238         BT_DBG("dlc %p state %ld", d, d->state);
 239
 240         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 241         rfcomm_dlc_put(d);
 242         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 243 }
 244
 245 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 246 {
 247         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 248
 249         if (!mod_timer(&d->timer, jiffies + timeout))
 250                 rfcomm_dlc_hold(d);
 251 }
 252
 253 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 254 {
 255         BT_DBG("dlc %p state %ld", d, d->state);
 256
 257         if (timer_pending(&d->timer) && del_timer(&d->timer))
 258                 rfcomm_dlc_put(d);
 259 }
 260
 261 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 262 {
 263         BT_DBG("%p", d);
 264
 265         d->state      = BT_OPEN;
 266         d->flags      = 0;
 267         d->mscex      = 0;
 268         d->mtu        = RFCOMM_DEFAULT_MTU;
 269         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 270
 271         d->cfc        = RFCOMM_CFC_DISABLED;
 272         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 273 }
 274
 275 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 276 {
 277         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 278
 279         if (!d)
 280                 return NULL;
 281
 282         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 283
 284         skb_queue_head_init(&d->tx_queue);
 285         spin_lock_init(&d->lock);
 286         atomic_set(&d->refcnt, 1);
 287
 288         rfcomm_dlc_clear_state(d);
 289
 290         BT_DBG("%p", d);
 291
 292         return d;
 293 }
 294
 295 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 296 {
 297         BT_DBG("%p", d);
 298
 299         skb_queue_purge(&d->tx_queue);
 300         kfree(d);
 301 }
 302
 303 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 304 {
 305         BT_DBG("dlc %p session %p", d, s);
 306
 307         rfcomm_session_hold(s);
 308
 309         rfcomm_dlc_hold(d);
 310         list_add(&d->list, &s->dlcs);
 311         d->session = s;
 312 }
 313
 314 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 315 {
 316         struct rfcomm_session *s = d->session;
 317
 318         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 319
 320         list_del(&d->list);
 321         d->session = NULL;
 322         rfcomm_dlc_put(d);
 323
 324         rfcomm_session_put(s);
 325 }
 326
 327 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 328 {
 329         struct rfcomm_dlc *d;
 330         struct list_head *p;
 331
 332         list_for_each(p, &s->dlcs) {
 333                 d = list_entry(p, struct rfcomm_dlc, list);
 334                 if (d->dlci == dlci)
 335                         return d;
 336         }
 337         return NULL;
 338 }
 339
 340 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 341 {
 342         struct rfcomm_session *s;
 343         int err = 0;
 344         u8 dlci;
 345
 346         BT_DBG("dlc %p state %ld %s %s channel %d",
 347                         d, d->state, batostr(src), batostr(dst), channel);
 348
 349         if (channel < 1 || channel > 30)
 350                 return -EINVAL;
 351
 352         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 353                 return 0;
 354
 355         s = rfcomm_session_get(src, dst);
 356         if (!s) {
 357                 s = rfcomm_session_create(src, dst, &err);
 358                 if (!s)
 359                         return err;
 360         }
 361
 362         dlci = __dlci(!s->initiator, channel);
 363
 364         /* Check if DLCI already exists */
 365         if (rfcomm_dlc_get(s, dlci))
 366                 return -EBUSY;
 367
 368         rfcomm_dlc_clear_state(d);
 369
 370         d->dlci     = dlci;
 371         d->addr     = __addr(s->initiator, dlci);
 372         d->priority = 7;
 373
 374         d->state    = BT_CONFIG;
 375         rfcomm_dlc_link(s, d);
 376
 377         d->mtu = s->mtu;
 378         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 379
 380         if (s->state == BT_CONNECTED)
 381                 rfcomm_send_pn(s, 1, d);
 382         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 383         return 0;
 384 }
 385
 386 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 387 {
 388         int r;
 389
 390         rfcomm_lock();
 391
 392         r = __rfcomm_dlc_open(d, src, dst, channel);
 393
 394         rfcomm_unlock();
 395         return r;
 396 }
 397
 398 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 399 {
 400         struct rfcomm_session *s = d->session;
 401         if (!s)
 402                 return 0;
 403
 404         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 405                         d, d->state, d->dlci, err, s);
 406
 407         switch (d->state) {
 408         case BT_CONNECTED:
 409         case BT_CONFIG:
 410         case BT_CONNECT:
 411                 d->state = BT_DISCONN;
 412                 if (skb_queue_empty(&d->tx_queue)) {
 413                         rfcomm_send_disc(s, d->dlci);
 414                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 415                 } else {
 416                         rfcomm_queue_disc(d);
 417                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 418                 }
 419                 break;
 420
 421         default:
 422                 rfcomm_dlc_clear_timer(d);
 423
 424                 rfcomm_dlc_lock(d);
 425                 d->state = BT_CLOSED;
 426                 rfcomm_dlc_unlock(d);
 427                 d->state_change(d, err);
 428
 429                 skb_queue_purge(&d->tx_queue);
 430                 rfcomm_dlc_unlink(d);
 431         }
 432
 433         return 0;
 434 }
 435
 436 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 437 {
 438         int r;
 439
 440         rfcomm_lock();
 441
 442         r = __rfcomm_dlc_close(d, err);
 443
 444         rfcomm_unlock();
 445         return r;
 446 }
 447
 448 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 449 {
 450         int len = skb->len;
 451
 452         if (d->state != BT_CONNECTED)
 453                 return -ENOTCONN;
 454
 455         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 456
 457         if (len > d->mtu)
 458                 return -EINVAL;
 459
 460         rfcomm_make_uih(skb, d->addr);
 461         skb_queue_tail(&d->tx_queue, skb);
 462
 463         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 464                 rfcomm_schedule(RFCOMM_SCHED_TX);
 465         return len;
 466 }
 467
 468 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 469 {
 470         BT_DBG("dlc %p state %ld", d, d->state);
 471
 472         if (!d->cfc) {
 473                 d->v24_sig |= RFCOMM_V24_FC;
 474                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 475         }
 476         rfcomm_schedule(RFCOMM_SCHED_TX);
 477 }
 478
 479 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 480 {
 481         BT_DBG("dlc %p state %ld", d, d->state);
 482
 483         if (!d->cfc) {
 484                 d->v24_sig &= ~RFCOMM_V24_FC;
 485                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 486         }
 487         rfcomm_schedule(RFCOMM_SCHED_TX);
 488 }
 489
 490 /*
 491    Set/get modem status functions use _local_ status i.e. what we report
 492    to the other side.
 493    Remote status is provided by dlc->modem_status() callback.
 494  */
 495 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 496 {
 497         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 498                         d, d->state, v24_sig);
 499
 500         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 501                 v24_sig |= RFCOMM_V24_FC;
 502         else
 503                 v24_sig &= ~RFCOMM_V24_FC;
 504
 505         d->v24_sig = v24_sig;
 506
 507         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 508                 rfcomm_schedule(RFCOMM_SCHED_TX);
 509
 510         return 0;
 511 }
 512
 513 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 514 {
 515         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 516                         d, d->state, d->v24_sig);
 517
 518         *v24_sig = d->v24_sig;
 519         return 0;
 520 }
 521
 522 /* ---- RFCOMM sessions ---- */
 523 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 524 {
 525         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 526
 527         if (!s)
 528                 return NULL;
 529
 530         BT_DBG("session %p sock %p", s, sock);
 531
 532         INIT_LIST_HEAD(&s->dlcs);
 533         s->state = state;
 534         s->sock  = sock;
 535
 536         s->mtu = RFCOMM_DEFAULT_MTU;
 537         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 538
 539         /* Do not increment module usage count for listening sessions.
 540          * Otherwise we won't be able to unload the module. */
 541         if (state != BT_LISTEN)
 542                 if (!try_module_get(THIS_MODULE)) {
 543                         kfree(s);
 544                         return NULL;
 545                 }
 546
 547         list_add(&s->list, &session_list);
 548
 549         return s;
 550 }
 551
 552 static void rfcomm_session_del(struct rfcomm_session *s)
 553 {
 554         int state = s->state;
 555
 556         BT_DBG("session %p state %ld", s, s->state);
 557
 558         list_del(&s->list);
 559
 560         if (state == BT_CONNECTED)
 561                 rfcomm_send_disc(s, 0);
 562
 563         sock_release(s->sock);
 564         kfree(s);
 565
 566         if (state != BT_LISTEN)
 567                 module_put(THIS_MODULE);
 568 }
 569
 570 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 571 {
 572         struct rfcomm_session *s;
 573         struct list_head *p, *n;
 574         struct bt_sock *sk;
 575         list_for_each_safe(p, n, &session_list) {
 576                 s = list_entry(p, struct rfcomm_session, list);
 577                 sk = bt_sk(s->sock->sk);
 578
 579                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 580                                 !bacmp(&sk->dst, dst))
 581                         return s;
 582         }
 583         return NULL;
 584 }
 585
 586 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 587 {
 588         struct rfcomm_dlc *d;
 589         struct list_head *p, *n;
 590
 591         BT_DBG("session %p state %ld err %d", s, s->state, err);
 592
 593         rfcomm_session_hold(s);
 594
 595         s->state = BT_CLOSED;
 596
 597         /* Close all dlcs */
 598         list_for_each_safe(p, n, &s->dlcs) {
 599                 d = list_entry(p, struct rfcomm_dlc, list);
 600                 d->state = BT_CLOSED;
 601                 __rfcomm_dlc_close(d, err);
 602         }
 603
 604         rfcomm_session_put(s);
 605 }
 606
 607 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 608 {
 609         struct rfcomm_session *s = NULL;
 610         struct sockaddr_l2 addr;
 611         struct socket *sock;
 612         struct sock *sk;
 613
 614         BT_DBG("%s %s", batostr(src), batostr(dst));
 615
 616         *err = rfcomm_l2sock_create(&sock);
 617         if (*err < 0)
 618                 return NULL;
 619
 620         bacpy(&addr.l2_bdaddr, src);
 621         addr.l2_family = AF_BLUETOOTH;
 622         addr.l2_psm    = 0;
 623         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 624         if (*err < 0)
 625                 goto failed;
 626
 627         /* Set L2CAP options */
 628         sk = sock->sk;
 629         lock_sock(sk);
 630         l2cap_pi(sk)->imtu = l2cap_mtu;
 631         release_sock(sk);
 632
 633         s = rfcomm_session_add(sock, BT_BOUND);
 634         if (!s) {
 635                 *err = -ENOMEM;
 636                 goto failed;
 637         }
 638
 639         s->initiator = 1;
 640
 641         bacpy(&addr.l2_bdaddr, dst);
 642         addr.l2_family = AF_BLUETOOTH;
 643         addr.l2_psm    = htobs(RFCOMM_PSM);
 644         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 645         if (*err == 0 || *err == -EINPROGRESS)
 646                 return s;
 647
 648         rfcomm_session_del(s);
 649         return NULL;
 650
 651 failed:
 652         sock_release(sock);
 653         return NULL;
 654 }
 655
 656 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 657 {
 658         struct sock *sk = s->sock->sk;
 659         if (src)
 660                 bacpy(src, &bt_sk(sk)->src);
 661         if (dst)
 662                 bacpy(dst, &bt_sk(sk)->dst);
 663 }
 664
 665 /* ---- RFCOMM frame sending ---- */
 666 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 667 {
 668         struct socket *sock = s->sock;
 669         struct kvec iv = { data, len };
 670         struct msghdr msg;
 671
 672         BT_DBG("session %p len %d", s, len);
 673
 674         memset(&msg, 0, sizeof(msg));
 675
 676         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 677 }
 678
 679 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 680 {
 681         struct rfcomm_cmd cmd;
 682
 683         BT_DBG("%p dlci %d", s, dlci);
 684
 685         cmd.addr = __addr(s->initiator, dlci);
 686         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 687         cmd.len  = __len8(0);
 688         cmd.fcs  = __fcs2((u8 *) &cmd);
 689
 690         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 691 }
 692
 693 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 694 {
 695         struct rfcomm_cmd cmd;
 696
 697         BT_DBG("%p dlci %d", s, dlci);
 698
 699         cmd.addr = __addr(!s->initiator, dlci);
 700         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 701         cmd.len  = __len8(0);
 702         cmd.fcs  = __fcs2((u8 *) &cmd);
 703
 704         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 705 }
 706
 707 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 708 {
 709         struct rfcomm_cmd cmd;
 710
 711         BT_DBG("%p dlci %d", s, dlci);
 712
 713         cmd.addr = __addr(s->initiator, dlci);
 714         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 715         cmd.len  = __len8(0);
 716         cmd.fcs  = __fcs2((u8 *) &cmd);
 717
 718         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 719 }
 720
 721 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 722 {
 723         struct rfcomm_cmd *cmd;
 724         struct sk_buff *skb;
 725
 726         BT_DBG("dlc %p dlci %d", d, d->dlci);
 727
 728         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 729         if (!skb)
 730                 return -ENOMEM;
 731
 732         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 733         cmd->addr = d->addr;
 734         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 735         cmd->len  = __len8(0);
 736         cmd->fcs  = __fcs2((u8 *) cmd);
 737
 738         skb_queue_tail(&d->tx_queue, skb);
 739         rfcomm_schedule(RFCOMM_SCHED_TX);
 740         return 0;
 741 }
 742
 743 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 744 {
 745         struct rfcomm_cmd cmd;
 746
 747         BT_DBG("%p dlci %d", s, dlci);
 748
 749         cmd.addr = __addr(!s->initiator, dlci);
 750         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 751         cmd.len  = __len8(0);
 752         cmd.fcs  = __fcs2((u8 *) &cmd);
 753
 754         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 755 }
 756
 757 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 758 {
 759         struct rfcomm_hdr *hdr;
 760         struct rfcomm_mcc *mcc;
 761         u8 buf[16], *ptr = buf;
 762
 763         BT_DBG("%p cr %d type %d", s, cr, type);
 764
 765         hdr = (void *) ptr; ptr += sizeof(*hdr);
 766         hdr->addr = __addr(s->initiator, 0);
 767         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 768         hdr->len  = __len8(sizeof(*mcc) + 1);
 769
 770         mcc = (void *) ptr; ptr += sizeof(*mcc);
 771         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 772         mcc->len  = __len8(1);
 773
 774         /* Type that we didn't like */
 775         *ptr = __mcc_type(cr, type); ptr++;
 776
 777         *ptr = __fcs(buf); ptr++;
 778
 779         return rfcomm_send_frame(s, buf, ptr - buf);
 780 }
 781
 782 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 783 {
 784         struct rfcomm_hdr *hdr;
 785         struct rfcomm_mcc *mcc;
 786         struct rfcomm_pn  *pn;
 787         u8 buf[16], *ptr = buf;
 788
 789         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 790
 791         hdr = (void *) ptr; ptr += sizeof(*hdr);
 792         hdr->addr = __addr(s->initiator, 0);
 793         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 794         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 795
 796         mcc = (void *) ptr; ptr += sizeof(*mcc);
 797         mcc->type = __mcc_type(cr, RFCOMM_PN);
 798         mcc->len  = __len8(sizeof(*pn));
 799
 800         pn = (void *) ptr; ptr += sizeof(*pn);
 801         pn->dlci        = d->dlci;
 802         pn->priority    = d->priority;
 803         pn->ack_timer   = 0;
 804         pn->max_retrans = 0;
 805
 806         if (s->cfc) {
 807                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 808                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 809         } else {
 810                 pn->flow_ctrl = 0;
 811                 pn->credits   = 0;
 812         }
 813
 814         if (cr && channel_mtu >= 0)
 815                 pn->mtu = htobs(channel_mtu);
 816         else
 817                 pn->mtu = htobs(d->mtu);
 818
 819         *ptr = __fcs(buf); ptr++;
 820
 821         return rfcomm_send_frame(s, buf, ptr - buf);
 822 }
 823
 824 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 825                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 826                         u8 parity, u8 flow_ctrl_settings,
 827                         u8 xon_char, u8 xoff_char, u16 param_mask)
 828 {
 829         struct rfcomm_hdr *hdr;
 830         struct rfcomm_mcc *mcc;
 831         struct rfcomm_rpn *rpn;
 832         u8 buf[16], *ptr = buf;
 833
 834         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 835                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 836                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 837                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 838
 839         hdr = (void *) ptr; ptr += sizeof(*hdr);
 840         hdr->addr = __addr(s->initiator, 0);
 841         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 842         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 843
 844         mcc = (void *) ptr; ptr += sizeof(*mcc);
 845         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 846         mcc->len  = __len8(sizeof(*rpn));
 847
 848         rpn = (void *) ptr; ptr += sizeof(*rpn);
 849         rpn->dlci          = __addr(1, dlci);
 850         rpn->bit_rate      = bit_rate;
 851         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 852         rpn->flow_ctrl     = flow_ctrl_settings;
 853         rpn->xon_char      = xon_char;
 854         rpn->xoff_char     = xoff_char;
 855         rpn->param_mask    = cpu_to_le16(param_mask);
 856
 857         *ptr = __fcs(buf); ptr++;
 858
 859         return rfcomm_send_frame(s, buf, ptr - buf);
 860 }
 861
 862 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 863 {
 864         struct rfcomm_hdr *hdr;
 865         struct rfcomm_mcc *mcc;
 866         struct rfcomm_rls *rls;
 867         u8 buf[16], *ptr = buf;
 868
 869         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 870
 871         hdr = (void *) ptr; ptr += sizeof(*hdr);
 872         hdr->addr = __addr(s->initiator, 0);
 873         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 874         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 875
 876         mcc = (void *) ptr; ptr += sizeof(*mcc);
 877         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 878         mcc->len  = __len8(sizeof(*rls));
 879
 880         rls = (void *) ptr; ptr += sizeof(*rls);
 881         rls->dlci   = __addr(1, dlci);
 882         rls->status = status;
 883
 884         *ptr = __fcs(buf); ptr++;
 885
 886         return rfcomm_send_frame(s, buf, ptr - buf);
 887 }
 888
 889 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 890 {
 891         struct rfcomm_hdr *hdr;
 892         struct rfcomm_mcc *mcc;
 893         struct rfcomm_msc *msc;
 894         u8 buf[16], *ptr = buf;
 895
 896         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 897
 898         hdr = (void *) ptr; ptr += sizeof(*hdr);
 899         hdr->addr = __addr(s->initiator, 0);
 900         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 901         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 902
 903         mcc = (void *) ptr; ptr += sizeof(*mcc);
 904         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 905         mcc->len  = __len8(sizeof(*msc));
 906
 907         msc = (void *) ptr; ptr += sizeof(*msc);
 908         msc->dlci    = __addr(1, dlci);
 909         msc->v24_sig = v24_sig | 0x01;
 910
 911         *ptr = __fcs(buf); ptr++;
 912
 913         return rfcomm_send_frame(s, buf, ptr - buf);
 914 }
 915
 916 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 917 {
 918         struct rfcomm_hdr *hdr;
 919         struct rfcomm_mcc *mcc;
 920         u8 buf[16], *ptr = buf;
 921
 922         BT_DBG("%p cr %d", s, cr);
 923
 924         hdr = (void *) ptr; ptr += sizeof(*hdr);
 925         hdr->addr = __addr(s->initiator, 0);
 926         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 927         hdr->len  = __len8(sizeof(*mcc));
 928
 929         mcc = (void *) ptr; ptr += sizeof(*mcc);
 930         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
 931         mcc->len  = __len8(0);
 932
 933         *ptr = __fcs(buf); ptr++;
 934
 935         return rfcomm_send_frame(s, buf, ptr - buf);
 936 }
 937
 938 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
 939 {
 940         struct rfcomm_hdr *hdr;
 941         struct rfcomm_mcc *mcc;
 942         u8 buf[16], *ptr = buf;
 943
 944         BT_DBG("%p cr %d", s, cr);
 945
 946         hdr = (void *) ptr; ptr += sizeof(*hdr);
 947         hdr->addr = __addr(s->initiator, 0);
 948         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 949         hdr->len  = __len8(sizeof(*mcc));
 950
 951         mcc = (void *) ptr; ptr += sizeof(*mcc);
 952         mcc->type = __mcc_type(cr, RFCOMM_FCON);
 953         mcc->len  = __len8(0);
 954
 955         *ptr = __fcs(buf); ptr++;
 956
 957         return rfcomm_send_frame(s, buf, ptr - buf);
 958 }
 959
 960 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
 961 {
 962         struct socket *sock = s->sock;
 963         struct kvec iv[3];
 964         struct msghdr msg;
 965         unsigned char hdr[5], crc[1];
 966
 967         if (len > 125)
 968                 return -EINVAL;
 969
 970         BT_DBG("%p cr %d", s, cr);
 971
 972         hdr[0] = __addr(s->initiator, 0);
 973         hdr[1] = __ctrl(RFCOMM_UIH, 0);
 974         hdr[2] = 0x01 | ((len + 2) << 1);
 975         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
 976         hdr[4] = 0x01 | (len << 1);
 977
 978         crc[0] = __fcs(hdr);
 979
 980         iv[0].iov_base = hdr;
 981         iv[0].iov_len  = 5;
 982         iv[1].iov_base = pattern;
 983         iv[1].iov_len  = len;
 984         iv[2].iov_base = crc;
 985         iv[2].iov_len  = 1;
 986
 987         memset(&msg, 0, sizeof(msg));
 988
 989         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
 990 }
 991
 992 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
 993 {
 994         struct rfcomm_hdr *hdr;
 995         u8 buf[16], *ptr = buf;
 996
 997         BT_DBG("%p addr %d credits %d", s, addr, credits);
 998
 999         hdr = (void *) ptr; ptr += sizeof(*hdr);
1000         hdr->addr = addr;
1001         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1002         hdr->len  = __len8(0);
1003
1004         *ptr = credits; ptr++;
1005
1006         *ptr = __fcs(buf); ptr++;
1007
1008         return rfcomm_send_frame(s, buf, ptr - buf);
1009 }
1010
1011 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1012 {
1013         struct rfcomm_hdr *hdr;
1014         int len = skb->len;
1015         u8 *crc;
1016
1017         if (len > 127) {
1018                 hdr = (void *) skb_push(skb, 4);
1019                 put_unaligned(htobs(__len16(len)), (__le16 *) &hdr->len);
1020         } else {
1021                 hdr = (void *) skb_push(skb, 3);
1022                 hdr->len = __len8(len);
1023         }
1024         hdr->addr = addr;
1025         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1026
1027         crc = skb_put(skb, 1);
1028         *crc = __fcs((void *) hdr);
1029 }
1030
1031 /* ---- RFCOMM frame reception ---- */
1032 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1033 {
1034         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1035
1036         if (dlci) {
1037                 /* Data channel */
1038                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1039                 if (!d) {
1040                         rfcomm_send_dm(s, dlci);
1041                         return 0;
1042                 }
1043
1044                 switch (d->state) {
1045                 case BT_CONNECT:
1046                         rfcomm_dlc_clear_timer(d);
1047
1048                         rfcomm_dlc_lock(d);
1049                         d->state = BT_CONNECTED;
1050                         d->state_change(d, 0);
1051                         rfcomm_dlc_unlock(d);
1052
1053                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1054                         break;
1055
1056                 case BT_DISCONN:
1057                         d->state = BT_CLOSED;
1058                         __rfcomm_dlc_close(d, 0);
1059
1060                         if (list_empty(&s->dlcs)) {
1061                                 s->state = BT_DISCONN;
1062                                 rfcomm_send_disc(s, 0);
1063                         }
1064
1065                         break;
1066                 }
1067         } else {
1068                 /* Control channel */
1069                 switch (s->state) {
1070                 case BT_CONNECT:
1071                         s->state = BT_CONNECTED;
1072                         rfcomm_process_connect(s);
1073                         break;
1074
1075                 case BT_DISCONN:
1076                         rfcomm_session_put(s);
1077                         break;
1078                 }
1079         }
1080         return 0;
1081 }
1082
1083 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1084 {
1085         int err = 0;
1086
1087         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1088
1089         if (dlci) {
1090                 /* Data DLC */
1091                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1092                 if (d) {
1093                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1094                                 err = ECONNREFUSED;
1095                         else
1096                                 err = ECONNRESET;
1097
1098                         d->state = BT_CLOSED;
1099                         __rfcomm_dlc_close(d, err);
1100                 }
1101         } else {
1102                 if (s->state == BT_CONNECT)
1103                         err = ECONNREFUSED;
1104                 else
1105                         err = ECONNRESET;
1106
1107                 s->state = BT_CLOSED;
1108                 rfcomm_session_close(s, err);
1109         }
1110         return 0;
1111 }
1112
1113 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1114 {
1115         int err = 0;
1116
1117         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1118
1119         if (dlci) {
1120                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1121                 if (d) {
1122                         rfcomm_send_ua(s, dlci);
1123
1124                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1125                                 err = ECONNREFUSED;
1126                         else
1127                                 err = ECONNRESET;
1128
1129                         d->state = BT_CLOSED;
1130                         __rfcomm_dlc_close(d, err);
1131                 } else
1132                         rfcomm_send_dm(s, dlci);
1133
1134         } else {
1135                 rfcomm_send_ua(s, 0);
1136
1137                 if (s->state == BT_CONNECT)
1138                         err = ECONNREFUSED;
1139                 else
1140                         err = ECONNRESET;
1141
1142                 s->state = BT_CLOSED;
1143                 rfcomm_session_close(s, err);
1144         }
1145
1146         return 0;
1147 }
1148
1149 static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
1150 {
1151         struct sock *sk = d->session->sock->sk;
1152
1153         if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
1154                 if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
1155                         return 1;
1156         } else if (d->link_mode & RFCOMM_LM_AUTH) {
1157                 if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
1158                         return 1;
1159         }
1160
1161         return 0;
1162 }
1163
1164 static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1165 {
1166         struct sock *sk = d->session->sock->sk;
1167
1168         BT_DBG("dlc %p", d);
1169
1170         rfcomm_send_ua(d->session, d->dlci);
1171
1172         rfcomm_dlc_lock(d);
1173         d->state = BT_CONNECTED;
1174         d->state_change(d, 0);
1175         rfcomm_dlc_unlock(d);
1176
1177         if (d->link_mode & RFCOMM_LM_MASTER)
1178                 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1179
1180         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1181 }
1182
1183 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1184 {
1185         struct rfcomm_dlc *d;
1186         u8 channel;
1187
1188         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1189
1190         if (!dlci) {
1191                 rfcomm_send_ua(s, 0);
1192
1193                 if (s->state == BT_OPEN) {
1194                         s->state = BT_CONNECTED;
1195                         rfcomm_process_connect(s);
1196                 }
1197                 return 0;
1198         }
1199
1200         /* Check if DLC exists */
1201         d = rfcomm_dlc_get(s, dlci);
1202         if (d) {
1203                 if (d->state == BT_OPEN) {
1204                         /* DLC was previously opened by PN request */
1205                         if (rfcomm_check_link_mode(d)) {
1206                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1207                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1208                                 return 0;
1209                         }
1210
1211                         rfcomm_dlc_accept(d);
1212                 }
1213                 return 0;
1214         }
1215
1216         /* Notify socket layer about incoming connection */
1217         channel = __srv_channel(dlci);
1218         if (rfcomm_connect_ind(s, channel, &d)) {
1219                 d->dlci = dlci;
1220                 d->addr = __addr(s->initiator, dlci);
1221                 rfcomm_dlc_link(s, d);
1222
1223                 if (rfcomm_check_link_mode(d)) {
1224                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1225                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1226                         return 0;
1227                 }
1228
1229                 rfcomm_dlc_accept(d);
1230         } else {
1231                 rfcomm_send_dm(s, dlci);
1232         }
1233
1234         return 0;
1235 }
1236
1237 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1238 {
1239         struct rfcomm_session *s = d->session;
1240
1241         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1242                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1243
1244         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1245                                                 pn->flow_ctrl == 0xe0) {
1246                 d->cfc = RFCOMM_CFC_ENABLED;
1247                 d->tx_credits = pn->credits;
1248         } else {
1249                 d->cfc = RFCOMM_CFC_DISABLED;
1250                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1251         }
1252
1253         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1254                 s->cfc = d->cfc;
1255
1256         d->priority = pn->priority;
1257
1258         d->mtu = btohs(pn->mtu);
1259
1260         if (cr && d->mtu > s->mtu)
1261                 d->mtu = s->mtu;
1262
1263         return 0;
1264 }
1265
1266 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1267 {
1268         struct rfcomm_pn *pn = (void *) skb->data;
1269         struct rfcomm_dlc *d;
1270         u8 dlci = pn->dlci;
1271
1272         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1273
1274         if (!dlci)
1275                 return 0;
1276
1277         d = rfcomm_dlc_get(s, dlci);
1278         if (d) {
1279                 if (cr) {
1280                         /* PN request */
1281                         rfcomm_apply_pn(d, cr, pn);
1282                         rfcomm_send_pn(s, 0, d);
1283                 } else {
1284                         /* PN response */
1285                         switch (d->state) {
1286                         case BT_CONFIG:
1287                                 rfcomm_apply_pn(d, cr, pn);
1288
1289                                 d->state = BT_CONNECT;
1290                                 rfcomm_send_sabm(s, d->dlci);
1291                                 break;
1292                         }
1293                 }
1294         } else {
1295                 u8 channel = __srv_channel(dlci);
1296
1297                 if (!cr)
1298                         return 0;
1299
1300                 /* PN request for non existing DLC.
1301                  * Assume incoming connection. */
1302                 if (rfcomm_connect_ind(s, channel, &d)) {
1303                         d->dlci = dlci;
1304                         d->addr = __addr(s->initiator, dlci);
1305                         rfcomm_dlc_link(s, d);
1306
1307                         rfcomm_apply_pn(d, cr, pn);
1308
1309                         d->state = BT_OPEN;
1310                         rfcomm_send_pn(s, 0, d);
1311                 } else {
1312                         rfcomm_send_dm(s, dlci);
1313                 }
1314         }
1315         return 0;
1316 }
1317
1318 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1319 {
1320         struct rfcomm_rpn *rpn = (void *) skb->data;
1321         u8 dlci = __get_dlci(rpn->dlci);
1322
1323         u8 bit_rate  = 0;
1324         u8 data_bits = 0;
1325         u8 stop_bits = 0;
1326         u8 parity    = 0;
1327         u8 flow_ctrl = 0;
1328         u8 xon_char  = 0;
1329         u8 xoff_char = 0;
1330         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1331
1332         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1333                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1334                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1335
1336         if (!cr)
1337                 return 0;
1338
1339         if (len == 1) {
1340                 /* This is a request, return default settings */
1341                 bit_rate  = RFCOMM_RPN_BR_115200;
1342                 data_bits = RFCOMM_RPN_DATA_8;
1343                 stop_bits = RFCOMM_RPN_STOP_1;
1344                 parity    = RFCOMM_RPN_PARITY_NONE;
1345                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1346                 xon_char  = RFCOMM_RPN_XON_CHAR;
1347                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1348                 goto rpn_out;
1349         }
1350
1351         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1352          * no parity, no flow control lines, normal XON/XOFF chars */
1353
1354         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1355                 bit_rate = rpn->bit_rate;
1356                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1357                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1358                         bit_rate = RFCOMM_RPN_BR_115200;
1359                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1360                 }
1361         }
1362
1363         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1364                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1365                 if (data_bits != RFCOMM_RPN_DATA_8) {
1366                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1367                         data_bits = RFCOMM_RPN_DATA_8;
1368                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1369                 }
1370         }
1371
1372         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1373                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1374                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1375                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1376                         stop_bits = RFCOMM_RPN_STOP_1;
1377                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1378                 }
1379         }
1380
1381         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1382                 parity = __get_rpn_parity(rpn->line_settings);
1383                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1384                         BT_DBG("RPN parity mismatch 0x%x", parity);
1385                         parity = RFCOMM_RPN_PARITY_NONE;
1386                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1387                 }
1388         }
1389
1390         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1391                 flow_ctrl = rpn->flow_ctrl;
1392                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1393                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1394                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1395                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1396                 }
1397         }
1398
1399         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1400                 xon_char = rpn->xon_char;
1401                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1402                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1403                         xon_char = RFCOMM_RPN_XON_CHAR;
1404                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1405                 }
1406         }
1407
1408         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1409                 xoff_char = rpn->xoff_char;
1410                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1411                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1412                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1413                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1414                 }
1415         }
1416
1417 rpn_out:
1418         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1419                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1420
1421         return 0;
1422 }
1423
1424 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1425 {
1426         struct rfcomm_rls *rls = (void *) skb->data;
1427         u8 dlci = __get_dlci(rls->dlci);
1428
1429         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1430
1431         if (!cr)
1432                 return 0;
1433
1434         /* We should probably do something with this information here. But
1435          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1436          * mandatory to recognise and respond to RLS */
1437
1438         rfcomm_send_rls(s, 0, dlci, rls->status);
1439
1440         return 0;
1441 }
1442
1443 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1444 {
1445         struct rfcomm_msc *msc = (void *) skb->data;
1446         struct rfcomm_dlc *d;
1447         u8 dlci = __get_dlci(msc->dlci);
1448
1449         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1450
1451         d = rfcomm_dlc_get(s, dlci);
1452         if (!d)
1453                 return 0;
1454
1455         if (cr) {
1456                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1457                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1458                 else
1459                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1460
1461                 rfcomm_dlc_lock(d);
1462                 if (d->modem_status)
1463                         d->modem_status(d, msc->v24_sig);
1464                 rfcomm_dlc_unlock(d);
1465
1466                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1467
1468                 d->mscex |= RFCOMM_MSCEX_RX;
1469         } else
1470                 d->mscex |= RFCOMM_MSCEX_TX;
1471
1472         return 0;
1473 }
1474
1475 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1476 {
1477         struct rfcomm_mcc *mcc = (void *) skb->data;
1478         u8 type, cr, len;
1479
1480         cr   = __test_cr(mcc->type);
1481         type = __get_mcc_type(mcc->type);
1482         len  = __get_mcc_len(mcc->len);
1483
1484         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1485
1486         skb_pull(skb, 2);
1487
1488         switch (type) {
1489         case RFCOMM_PN:
1490                 rfcomm_recv_pn(s, cr, skb);
1491                 break;
1492
1493         case RFCOMM_RPN:
1494                 rfcomm_recv_rpn(s, cr, len, skb);
1495                 break;
1496
1497         case RFCOMM_RLS:
1498                 rfcomm_recv_rls(s, cr, skb);
1499                 break;
1500
1501         case RFCOMM_MSC:
1502                 rfcomm_recv_msc(s, cr, skb);
1503                 break;
1504
1505         case RFCOMM_FCOFF:
1506                 if (cr) {
1507                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1508                         rfcomm_send_fcoff(s, 0);
1509                 }
1510                 break;
1511
1512         case RFCOMM_FCON:
1513                 if (cr) {
1514                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1515                         rfcomm_send_fcon(s, 0);
1516                 }
1517                 break;
1518
1519         case RFCOMM_TEST:
1520                 if (cr)
1521                         rfcomm_send_test(s, 0, skb->data, skb->len);
1522                 break;
1523
1524         case RFCOMM_NSC:
1525                 break;
1526
1527         default:
1528                 BT_ERR("Unknown control type 0x%02x", type);
1529                 rfcomm_send_nsc(s, cr, type);
1530                 break;
1531         }
1532         return 0;
1533 }
1534
1535 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1536 {
1537         struct rfcomm_dlc *d;
1538
1539         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1540
1541         d = rfcomm_dlc_get(s, dlci);
1542         if (!d) {
1543                 rfcomm_send_dm(s, dlci);
1544                 goto drop;
1545         }
1546
1547         if (pf && d->cfc) {
1548                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1549
1550                 d->tx_credits += credits;
1551                 if (d->tx_credits)
1552                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1553         }
1554
1555         if (skb->len && d->state == BT_CONNECTED) {
1556                 rfcomm_dlc_lock(d);
1557                 d->rx_credits--;
1558                 d->data_ready(d, skb);
1559                 rfcomm_dlc_unlock(d);
1560                 return 0;
1561         }
1562
1563 drop:
1564         kfree_skb(skb);
1565         return 0;
1566 }
1567
1568 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1569 {
1570         struct rfcomm_hdr *hdr = (void *) skb->data;
1571         u8 type, dlci, fcs;
1572
1573         dlci = __get_dlci(hdr->addr);
1574         type = __get_type(hdr->ctrl);
1575
1576         /* Trim FCS */
1577         skb->len--; skb->tail--;
1578         fcs = *(u8 *)skb_tail_pointer(skb);
1579
1580         if (__check_fcs(skb->data, type, fcs)) {
1581                 BT_ERR("bad checksum in packet");
1582                 kfree_skb(skb);
1583                 return -EILSEQ;
1584         }
1585
1586         if (__test_ea(hdr->len))
1587                 skb_pull(skb, 3);
1588         else
1589                 skb_pull(skb, 4);
1590
1591         switch (type) {
1592         case RFCOMM_SABM:
1593                 if (__test_pf(hdr->ctrl))
1594                         rfcomm_recv_sabm(s, dlci);
1595                 break;
1596
1597         case RFCOMM_DISC:
1598                 if (__test_pf(hdr->ctrl))
1599                         rfcomm_recv_disc(s, dlci);
1600                 break;
1601
1602         case RFCOMM_UA:
1603                 if (__test_pf(hdr->ctrl))
1604                         rfcomm_recv_ua(s, dlci);
1605                 break;
1606
1607         case RFCOMM_DM:
1608                 rfcomm_recv_dm(s, dlci);
1609                 break;
1610
1611         case RFCOMM_UIH:
1612                 if (dlci)
1613                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1614
1615                 rfcomm_recv_mcc(s, skb);
1616                 break;
1617
1618         default:
1619                 BT_ERR("Unknown packet type 0x%02x\n", type);
1620                 break;
1621         }
1622         kfree_skb(skb);
1623         return 0;
1624 }
1625
1626 /* ---- Connection and data processing ---- */
1627
1628 static void rfcomm_process_connect(struct rfcomm_session *s)
1629 {
1630         struct rfcomm_dlc *d;
1631         struct list_head *p, *n;
1632
1633         BT_DBG("session %p state %ld", s, s->state);
1634
1635         list_for_each_safe(p, n, &s->dlcs) {
1636                 d = list_entry(p, struct rfcomm_dlc, list);
1637                 if (d->state == BT_CONFIG) {
1638                         d->mtu = s->mtu;
1639                         rfcomm_send_pn(s, 1, d);
1640                 }
1641         }
1642 }
1643
1644 /* Send data queued for the DLC.
1645  * Return number of frames left in the queue.
1646  */
1647 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1648 {
1649         struct sk_buff *skb;
1650         int err;
1651
1652         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1653                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1654
1655         /* Send pending MSC */
1656         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1657                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1658
1659         if (d->cfc) {
1660                 /* CFC enabled.
1661                  * Give them some credits */
1662                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1663                                 d->rx_credits <= (d->cfc >> 2)) {
1664                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1665                         d->rx_credits = d->cfc;
1666                 }
1667         } else {
1668                 /* CFC disabled.
1669                  * Give ourselves some credits */
1670                 d->tx_credits = 5;
1671         }
1672
1673         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1674                 return skb_queue_len(&d->tx_queue);
1675
1676         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1677                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1678                 if (err < 0) {
1679                         skb_queue_head(&d->tx_queue, skb);
1680                         break;
1681                 }
1682                 kfree_skb(skb);
1683                 d->tx_credits--;
1684         }
1685
1686         if (d->cfc && !d->tx_credits) {
1687                 /* We're out of TX credits.
1688                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1689                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1690         }
1691
1692         return skb_queue_len(&d->tx_queue);
1693 }
1694
1695 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1696 {
1697         struct rfcomm_dlc *d;
1698         struct list_head *p, *n;
1699
1700         BT_DBG("session %p state %ld", s, s->state);
1701
1702         list_for_each_safe(p, n, &s->dlcs) {
1703                 d = list_entry(p, struct rfcomm_dlc, list);
1704
1705                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1706                         __rfcomm_dlc_close(d, ETIMEDOUT);
1707                         continue;
1708                 }
1709
1710                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1711                         rfcomm_dlc_clear_timer(d);
1712                         rfcomm_dlc_accept(d);
1713                         if (d->link_mode & RFCOMM_LM_SECURE) {
1714                                 struct sock *sk = s->sock->sk;
1715                                 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
1716                         }
1717                         continue;
1718                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1719                         rfcomm_dlc_clear_timer(d);
1720                         rfcomm_send_dm(s, d->dlci);
1721                         __rfcomm_dlc_close(d, ECONNREFUSED);
1722                         continue;
1723                 }
1724
1725                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1726                         continue;
1727
1728                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1729                                 d->mscex == RFCOMM_MSCEX_OK)
1730                         rfcomm_process_tx(d);
1731         }
1732 }
1733
1734 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1735 {
1736         struct socket *sock = s->sock;
1737         struct sock *sk = sock->sk;
1738         struct sk_buff *skb;
1739
1740         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1741
1742         /* Get data directly from socket receive queue without copying it. */
1743         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1744                 skb_orphan(skb);
1745                 rfcomm_recv_frame(s, skb);
1746         }
1747
1748         if (sk->sk_state == BT_CLOSED) {
1749                 if (!s->initiator)
1750                         rfcomm_session_put(s);
1751
1752                 rfcomm_session_close(s, sk->sk_err);
1753         }
1754 }
1755
1756 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1757 {
1758         struct socket *sock = s->sock, *nsock;
1759         int err;
1760
1761         /* Fast check for a new connection.
1762          * Avoids unnesesary socket allocations. */
1763         if (list_empty(&bt_sk(sock->sk)->accept_q))
1764                 return;
1765
1766         BT_DBG("session %p", s);
1767
1768         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1769         if (err < 0)
1770                 return;
1771
1772         __module_get(nsock->ops->owner);
1773
1774         /* Set our callbacks */
1775         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1776         nsock->sk->sk_state_change = rfcomm_l2state_change;
1777
1778         s = rfcomm_session_add(nsock, BT_OPEN);
1779         if (s) {
1780                 rfcomm_session_hold(s);
1781
1782                 /* We should adjust MTU on incoming sessions.
1783                  * L2CAP MTU minus UIH header and FCS. */
1784                 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1785
1786                 rfcomm_schedule(RFCOMM_SCHED_RX);
1787         } else
1788                 sock_release(nsock);
1789 }
1790
1791 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1792 {
1793         struct sock *sk = s->sock->sk;
1794
1795         BT_DBG("%p state %ld", s, s->state);
1796
1797         switch(sk->sk_state) {
1798         case BT_CONNECTED:
1799                 s->state = BT_CONNECT;
1800
1801                 /* We can adjust MTU on outgoing sessions.
1802                  * L2CAP MTU minus UIH header and FCS. */
1803                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1804
1805                 rfcomm_send_sabm(s, 0);
1806                 break;
1807
1808         case BT_CLOSED:
1809                 s->state = BT_CLOSED;
1810                 rfcomm_session_close(s, sk->sk_err);
1811                 break;
1812         }
1813 }
1814
1815 static inline void rfcomm_process_sessions(void)
1816 {
1817         struct list_head *p, *n;
1818
1819         rfcomm_lock();
1820
1821         list_for_each_safe(p, n, &session_list) {
1822                 struct rfcomm_session *s;
1823                 s = list_entry(p, struct rfcomm_session, list);
1824
1825                 if (s->state == BT_LISTEN) {
1826                         rfcomm_accept_connection(s);
1827                         continue;
1828                 }
1829
1830                 rfcomm_session_hold(s);
1831
1832                 switch (s->state) {
1833                 case BT_BOUND:
1834                         rfcomm_check_connection(s);
1835                         break;
1836
1837                 default:
1838                         rfcomm_process_rx(s);
1839                         break;
1840                 }
1841
1842                 rfcomm_process_dlcs(s);
1843
1844                 rfcomm_session_put(s);
1845         }
1846
1847         rfcomm_unlock();
1848 }
1849
1850 static int rfcomm_add_listener(bdaddr_t *ba)
1851 {
1852         struct sockaddr_l2 addr;
1853         struct socket *sock;
1854         struct sock *sk;
1855         struct rfcomm_session *s;
1856         int    err = 0;
1857
1858         /* Create socket */
1859         err = rfcomm_l2sock_create(&sock);
1860         if (err < 0) {
1861                 BT_ERR("Create socket failed %d", err);
1862                 return err;
1863         }
1864
1865         /* Bind socket */
1866         bacpy(&addr.l2_bdaddr, ba);
1867         addr.l2_family = AF_BLUETOOTH;
1868         addr.l2_psm    = htobs(RFCOMM_PSM);
1869         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1870         if (err < 0) {
1871                 BT_ERR("Bind failed %d", err);
1872                 goto failed;
1873         }
1874
1875         /* Set L2CAP options */
1876         sk = sock->sk;
1877         lock_sock(sk);
1878         l2cap_pi(sk)->imtu = l2cap_mtu;
1879         release_sock(sk);
1880
1881         /* Start listening on the socket */
1882         err = kernel_listen(sock, 10);
1883         if (err) {
1884                 BT_ERR("Listen failed %d", err);
1885                 goto failed;
1886         }
1887
1888         /* Add listening session */
1889         s = rfcomm_session_add(sock, BT_LISTEN);
1890         if (!s)
1891                 goto failed;
1892
1893         rfcomm_session_hold(s);
1894         return 0;
1895 failed:
1896         sock_release(sock);
1897         return err;
1898 }
1899
1900 static void rfcomm_kill_listener(void)
1901 {
1902         struct rfcomm_session *s;
1903         struct list_head *p, *n;
1904
1905         BT_DBG("");
1906
1907         list_for_each_safe(p, n, &session_list) {
1908                 s = list_entry(p, struct rfcomm_session, list);
1909                 rfcomm_session_del(s);
1910         }
1911 }
1912
1913 static int rfcomm_run(void *unused)
1914 {
1915         BT_DBG("");
1916
1917         set_user_nice(current, -10);
1918
1919         rfcomm_add_listener(BDADDR_ANY);
1920
1921         while (!kthread_should_stop()) {
1922                 set_current_state(TASK_INTERRUPTIBLE);
1923                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1924                         /* No pending events. Let's sleep.
1925                          * Incoming connections and data will wake us up. */
1926                         schedule();
1927                 }
1928                 set_current_state(TASK_RUNNING);
1929
1930                 /* Process stuff */
1931                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1932                 rfcomm_process_sessions();
1933         }
1934
1935         rfcomm_kill_listener();
1936
1937         return 0;
1938 }
1939
1940 static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
1941 {
1942         struct rfcomm_session *s;
1943         struct rfcomm_dlc *d;
1944         struct list_head *p, *n;
1945
1946         BT_DBG("conn %p status 0x%02x", conn, status);
1947
1948         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1949         if (!s)
1950                 return;
1951
1952         rfcomm_session_hold(s);
1953
1954         list_for_each_safe(p, n, &s->dlcs) {
1955                 d = list_entry(p, struct rfcomm_dlc, list);
1956
1957                 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE))
1958                         continue;
1959
1960                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1961                         continue;
1962
1963                 if (!status)
1964                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1965                 else
1966                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1967         }
1968
1969         rfcomm_session_put(s);
1970
1971         rfcomm_schedule(RFCOMM_SCHED_AUTH);
1972 }
1973
1974 static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1975 {
1976         struct rfcomm_session *s;
1977         struct rfcomm_dlc *d;
1978         struct list_head *p, *n;
1979
1980         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
1981
1982         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1983         if (!s)
1984                 return;
1985
1986         rfcomm_session_hold(s);
1987
1988         list_for_each_safe(p, n, &s->dlcs) {
1989                 d = list_entry(p, struct rfcomm_dlc, list);
1990
1991                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1992                         continue;
1993
1994                 if (!status && encrypt)
1995                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1996                 else
1997                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1998         }
1999
2000         rfcomm_session_put(s);
2001
2002         rfcomm_schedule(RFCOMM_SCHED_AUTH);
2003 }
2004
2005 static struct hci_cb rfcomm_cb = {
2006         .name           = "RFCOMM",
2007         .auth_cfm       = rfcomm_auth_cfm,
2008         .encrypt_cfm    = rfcomm_encrypt_cfm
2009 };
2010
2011 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2012 {
2013         struct rfcomm_session *s;
2014         struct list_head *pp, *p;
2015         char *str = buf;
2016
2017         rfcomm_lock();
2018
2019         list_for_each(p, &session_list) {
2020                 s = list_entry(p, struct rfcomm_session, list);
2021                 list_for_each(pp, &s->dlcs) {
2022                         struct sock *sk = s->sock->sk;
2023                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2024
2025                         str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2026                                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2027                                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2028                 }
2029         }
2030
2031         rfcomm_unlock();
2032
2033         return (str - buf);
2034 }
2035
2036 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2037
2038 /* ---- Initialization ---- */
2039 static int __init rfcomm_init(void)
2040 {
2041         l2cap_load();
2042
2043         hci_register_cb(&rfcomm_cb);
2044
2045         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2046         if (IS_ERR(rfcomm_thread)) {
2047                 hci_unregister_cb(&rfcomm_cb);
2048                 return PTR_ERR(rfcomm_thread);
2049         }
2050
2051         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2052                 BT_ERR("Failed to create RFCOMM info file");
2053
2054         rfcomm_init_sockets();
2055
2056 #ifdef CONFIG_BT_RFCOMM_TTY
2057         rfcomm_init_ttys();
2058 #endif
2059
2060         BT_INFO("RFCOMM ver %s", VERSION);
2061
2062         return 0;
2063 }
2064
2065 static void __exit rfcomm_exit(void)
2066 {
2067         class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2068
2069         hci_unregister_cb(&rfcomm_cb);
2070
2071         kthread_stop(rfcomm_thread);
2072
2073 #ifdef CONFIG_BT_RFCOMM_TTY
2074         rfcomm_cleanup_ttys();
2075 #endif
2076
2077         rfcomm_cleanup_sockets();
2078 }
2079
2080 module_init(rfcomm_init);
2081 module_exit(rfcomm_exit);
2082
2083 module_param(disable_cfc, bool, 0644);
2084 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2085
2086 module_param(channel_mtu, int, 0644);
2087 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2088
2089 module_param(l2cap_mtu, uint, 0644);
2090 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2091
2092 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
2093 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2094 MODULE_VERSION(VERSION);
2095 MODULE_LICENSE("GPL");
2096 MODULE_ALIAS("bt-proto-3");