net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/kernel.h>
  31 #include <linux/sched.h>
  32 #include <linux/signal.h>
  33 #include <linux/init.h>
  34 #include <linux/wait.h>
  35 #include <linux/device.h>
  36 #include <linux/net.h>
  37 #include <linux/mutex.h>
  38 #include <linux/kthread.h>
  39
  40 #include <net/sock.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/unaligned.h>
  43
  44 #include <net/bluetooth/bluetooth.h>
  45 #include <net/bluetooth/hci_core.h>
  46 #include <net/bluetooth/l2cap.h>
  47 #include <net/bluetooth/rfcomm.h>
  48
  49 #define VERSION "1.11"
  50
  51 static int disable_cfc = 0;
  52 static int channel_mtu = -1;
  53 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  54 static int l2cap_ertm = 0;
  55
  56 static struct task_struct *rfcomm_thread;
  57
  58 static DEFINE_MUTEX(rfcomm_mutex);
  59 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  60 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  61
  62 static unsigned long rfcomm_event;
  63
  64 static LIST_HEAD(session_list);
  65
  66 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  67 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  68 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  69 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  70 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  71 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  72 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  73 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  74 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  75 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  76
  77 static void rfcomm_process_connect(struct rfcomm_session *s);
  78
  79 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
  80 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  81 static void rfcomm_session_del(struct rfcomm_session *s);
  82
  83 /* ---- RFCOMM frame parsing macros ---- */
  84 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  85 #define __get_channel(b)  ((b & 0xf8) >> 3)
  86 #define __get_dir(b)      ((b & 0x04) >> 2)
  87 #define __get_type(b)     ((b & 0xef))
  88
  89 #define __test_ea(b)      ((b & 0x01))
  90 #define __test_cr(b)      ((b & 0x02))
  91 #define __test_pf(b)      ((b & 0x10))
  92
  93 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  94 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  95 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  96 #define __srv_channel(dlci)    (dlci >> 1)
  97 #define __dir(dlci)            (dlci & 0x01)
  98
  99 #define __len8(len)       (((len) << 1) | 1)
 100 #define __len16(len)      ((len) << 1)
 101
 102 /* MCC macros */
 103 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 104 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 105 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 106
 107 /* RPN macros */
 108 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 109 #define __get_rpn_data_bits(line) ((line) & 0x3)
 110 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 111 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 112
 113 static inline void rfcomm_schedule(uint event)
 114 {
 115         if (!rfcomm_thread)
 116                 return;
 117         //set_bit(event, &rfcomm_event);
 118         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
 119         wake_up_process(rfcomm_thread);
 120 }
 121
 122 static inline void rfcomm_session_put(struct rfcomm_session *s)
 123 {
 124         if (atomic_dec_and_test(&s->refcnt))
 125                 rfcomm_session_del(s);
 126 }
 127
 128 /* ---- RFCOMM FCS computation ---- */
 129
 130 /* reversed, 8-bit, poly=0x07 */
 131 static unsigned char rfcomm_crc_table[256] = {
 132         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 133         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 134         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 135         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 136
 137         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 138         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 139         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 140         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 141
 142         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 143         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 144         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 145         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 146
 147         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 148         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 149         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 150         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 151
 152         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 153         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 154         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 155         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 156
 157         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 158         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 159         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 160         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 161
 162         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 163         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 164         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 165         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 166
 167         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 168         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 169         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 170         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 171 };
 172
 173 /* CRC on 2 bytes */
 174 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 175
 176 /* FCS on 2 bytes */
 177 static inline u8 __fcs(u8 *data)
 178 {
 179         return (0xff - __crc(data));
 180 }
 181
 182 /* FCS on 3 bytes */
 183 static inline u8 __fcs2(u8 *data)
 184 {
 185         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 186 }
 187
 188 /* Check FCS */
 189 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 190 {
 191         u8 f = __crc(data);
 192
 193         if (type != RFCOMM_UIH)
 194                 f = rfcomm_crc_table[f ^ data[2]];
 195
 196         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 197 }
 198
 199 /* ---- L2CAP callbacks ---- */
 200 static void rfcomm_l2state_change(struct sock *sk)
 201 {
 202         BT_DBG("%p state %d", sk, sk->sk_state);
 203         rfcomm_schedule(RFCOMM_SCHED_STATE);
 204 }
 205
 206 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 207 {
 208         BT_DBG("%p bytes %d", sk, bytes);
 209         rfcomm_schedule(RFCOMM_SCHED_RX);
 210 }
 211
 212 static int rfcomm_l2sock_create(struct socket **sock)
 213 {
 214         int err;
 215
 216         BT_DBG("");
 217
 218         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 219         if (!err) {
 220                 struct sock *sk = (*sock)->sk;
 221                 sk->sk_data_ready   = rfcomm_l2data_ready;
 222                 sk->sk_state_change = rfcomm_l2state_change;
 223         }
 224         return err;
 225 }
 226
 227 static inline int rfcomm_check_security(struct rfcomm_dlc *d)
 228 {
 229         struct sock *sk = d->session->sock->sk;
 230         __u8 auth_type;
 231
 232         switch (d->sec_level) {
 233         case BT_SECURITY_HIGH:
 234                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
 235                 break;
 236         case BT_SECURITY_MEDIUM:
 237                 auth_type = HCI_AT_GENERAL_BONDING;
 238                 break;
 239         default:
 240                 auth_type = HCI_AT_NO_BONDING;
 241                 break;
 242         }
 243
 244         return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level,
 245                                                                 auth_type);
 246 }
 247
 248 static void rfcomm_session_timeout(unsigned long arg)
 249 {
 250         struct rfcomm_session *s = (void *) arg;
 251
 252         BT_DBG("session %p state %ld", s, s->state);
 253
 254         set_bit(RFCOMM_TIMED_OUT, &s->flags);
 255         rfcomm_session_put(s);
 256         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 257 }
 258
 259 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 260 {
 261         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 262
 263         if (!mod_timer(&s->timer, jiffies + timeout))
 264                 rfcomm_session_hold(s);
 265 }
 266
 267 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 268 {
 269         BT_DBG("session %p state %ld", s, s->state);
 270
 271         if (timer_pending(&s->timer) && del_timer(&s->timer))
 272                 rfcomm_session_put(s);
 273 }
 274
 275 /* ---- RFCOMM DLCs ---- */
 276 static void rfcomm_dlc_timeout(unsigned long arg)
 277 {
 278         struct rfcomm_dlc *d = (void *) arg;
 279
 280         BT_DBG("dlc %p state %ld", d, d->state);
 281
 282         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 283         rfcomm_dlc_put(d);
 284         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 285 }
 286
 287 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 288 {
 289         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 290
 291         if (!mod_timer(&d->timer, jiffies + timeout))
 292                 rfcomm_dlc_hold(d);
 293 }
 294
 295 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 296 {
 297         BT_DBG("dlc %p state %ld", d, d->state);
 298
 299         if (timer_pending(&d->timer) && del_timer(&d->timer))
 300                 rfcomm_dlc_put(d);
 301 }
 302
 303 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 304 {
 305         BT_DBG("%p", d);
 306
 307         d->state      = BT_OPEN;
 308         d->flags      = 0;
 309         d->mscex      = 0;
 310         d->mtu        = RFCOMM_DEFAULT_MTU;
 311         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 312
 313         d->cfc        = RFCOMM_CFC_DISABLED;
 314         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 315 }
 316
 317 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 318 {
 319         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 320
 321         if (!d)
 322                 return NULL;
 323
 324         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 325
 326         skb_queue_head_init(&d->tx_queue);
 327         spin_lock_init(&d->lock);
 328         atomic_set(&d->refcnt, 1);
 329
 330         rfcomm_dlc_clear_state(d);
 331
 332         BT_DBG("%p", d);
 333
 334         return d;
 335 }
 336
 337 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 338 {
 339         BT_DBG("%p", d);
 340
 341         skb_queue_purge(&d->tx_queue);
 342         kfree(d);
 343 }
 344
 345 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 346 {
 347         BT_DBG("dlc %p session %p", d, s);
 348
 349         rfcomm_session_hold(s);
 350
 351         rfcomm_session_clear_timer(s);
 352         rfcomm_dlc_hold(d);
 353         list_add(&d->list, &s->dlcs);
 354         d->session = s;
 355 }
 356
 357 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 358 {
 359         struct rfcomm_session *s = d->session;
 360
 361         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 362
 363         list_del(&d->list);
 364         d->session = NULL;
 365         rfcomm_dlc_put(d);
 366
 367         if (list_empty(&s->dlcs))
 368                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
 369
 370         rfcomm_session_put(s);
 371 }
 372
 373 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 374 {
 375         struct rfcomm_dlc *d;
 376         struct list_head *p;
 377
 378         list_for_each(p, &s->dlcs) {
 379                 d = list_entry(p, struct rfcomm_dlc, list);
 380                 if (d->dlci == dlci)
 381                         return d;
 382         }
 383         return NULL;
 384 }
 385
 386 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 387 {
 388         struct rfcomm_session *s;
 389         int err = 0;
 390         u8 dlci;
 391
 392         BT_DBG("dlc %p state %ld %s %s channel %d",
 393                         d, d->state, batostr(src), batostr(dst), channel);
 394
 395         if (channel < 1 || channel > 30)
 396                 return -EINVAL;
 397
 398         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 399                 return 0;
 400
 401         s = rfcomm_session_get(src, dst);
 402         if (!s) {
 403                 s = rfcomm_session_create(src, dst, &err);
 404                 if (!s)
 405                         return err;
 406         }
 407
 408         dlci = __dlci(!s->initiator, channel);
 409
 410         /* Check if DLCI already exists */
 411         if (rfcomm_dlc_get(s, dlci))
 412                 return -EBUSY;
 413
 414         rfcomm_dlc_clear_state(d);
 415
 416         d->dlci     = dlci;
 417         d->addr     = __addr(s->initiator, dlci);
 418         d->priority = 7;
 419
 420         d->state = BT_CONFIG;
 421         rfcomm_dlc_link(s, d);
 422
 423         d->out = 1;
 424
 425         d->mtu = s->mtu;
 426         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 427
 428         if (s->state == BT_CONNECTED) {
 429                 if (rfcomm_check_security(d))
 430                         rfcomm_send_pn(s, 1, d);
 431                 else
 432                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 433         }
 434
 435         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 436
 437         return 0;
 438 }
 439
 440 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 441 {
 442         int r;
 443
 444         rfcomm_lock();
 445
 446         r = __rfcomm_dlc_open(d, src, dst, channel);
 447
 448         rfcomm_unlock();
 449         return r;
 450 }
 451
 452 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 453 {
 454         struct rfcomm_session *s = d->session;
 455         if (!s)
 456                 return 0;
 457
 458         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 459                         d, d->state, d->dlci, err, s);
 460
 461         switch (d->state) {
 462         case BT_CONNECT:
 463         case BT_CONFIG:
 464                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 465                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 466                         rfcomm_schedule(RFCOMM_SCHED_AUTH);
 467                         break;
 468                 }
 469                 /* Fall through */
 470
 471         case BT_CONNECTED:
 472                 d->state = BT_DISCONN;
 473                 if (skb_queue_empty(&d->tx_queue)) {
 474                         rfcomm_send_disc(s, d->dlci);
 475                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 476                 } else {
 477                         rfcomm_queue_disc(d);
 478                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 479                 }
 480                 break;
 481
 482         case BT_OPEN:
 483         case BT_CONNECT2:
 484                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 485                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 486                         rfcomm_schedule(RFCOMM_SCHED_AUTH);
 487                         break;
 488                 }
 489                 /* Fall through */
 490
 491         default:
 492                 rfcomm_dlc_clear_timer(d);
 493
 494                 rfcomm_dlc_lock(d);
 495                 d->state = BT_CLOSED;
 496                 d->state_change(d, err);
 497                 rfcomm_dlc_unlock(d);
 498
 499                 skb_queue_purge(&d->tx_queue);
 500                 rfcomm_dlc_unlink(d);
 501         }
 502
 503         return 0;
 504 }
 505
 506 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 507 {
 508         int r;
 509
 510         rfcomm_lock();
 511
 512         r = __rfcomm_dlc_close(d, err);
 513
 514         rfcomm_unlock();
 515         return r;
 516 }
 517
 518 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 519 {
 520         int len = skb->len;
 521
 522         if (d->state != BT_CONNECTED)
 523                 return -ENOTCONN;
 524
 525         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 526
 527         if (len > d->mtu)
 528                 return -EINVAL;
 529
 530         rfcomm_make_uih(skb, d->addr);
 531         skb_queue_tail(&d->tx_queue, skb);
 532
 533         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 534                 rfcomm_schedule(RFCOMM_SCHED_TX);
 535         return len;
 536 }
 537
 538 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 539 {
 540         BT_DBG("dlc %p state %ld", d, d->state);
 541
 542         if (!d->cfc) {
 543                 d->v24_sig |= RFCOMM_V24_FC;
 544                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 545         }
 546         rfcomm_schedule(RFCOMM_SCHED_TX);
 547 }
 548
 549 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 550 {
 551         BT_DBG("dlc %p state %ld", d, d->state);
 552
 553         if (!d->cfc) {
 554                 d->v24_sig &= ~RFCOMM_V24_FC;
 555                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 556         }
 557         rfcomm_schedule(RFCOMM_SCHED_TX);
 558 }
 559
 560 /*
 561    Set/get modem status functions use _local_ status i.e. what we report
 562    to the other side.
 563    Remote status is provided by dlc->modem_status() callback.
 564  */
 565 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 566 {
 567         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 568                         d, d->state, v24_sig);
 569
 570         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 571                 v24_sig |= RFCOMM_V24_FC;
 572         else
 573                 v24_sig &= ~RFCOMM_V24_FC;
 574
 575         d->v24_sig = v24_sig;
 576
 577         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 578                 rfcomm_schedule(RFCOMM_SCHED_TX);
 579
 580         return 0;
 581 }
 582
 583 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 584 {
 585         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 586                         d, d->state, d->v24_sig);
 587
 588         *v24_sig = d->v24_sig;
 589         return 0;
 590 }
 591
 592 /* ---- RFCOMM sessions ---- */
 593 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 594 {
 595         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 596
 597         if (!s)
 598                 return NULL;
 599
 600         BT_DBG("session %p sock %p", s, sock);
 601
 602         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
 603
 604         INIT_LIST_HEAD(&s->dlcs);
 605         s->state = state;
 606         s->sock  = sock;
 607
 608         s->mtu = RFCOMM_DEFAULT_MTU;
 609         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 610
 611         /* Do not increment module usage count for listening sessions.
 612          * Otherwise we won't be able to unload the module. */
 613         if (state != BT_LISTEN)
 614                 if (!try_module_get(THIS_MODULE)) {
 615                         kfree(s);
 616                         return NULL;
 617                 }
 618
 619         list_add(&s->list, &session_list);
 620
 621         return s;
 622 }
 623
 624 static void rfcomm_session_del(struct rfcomm_session *s)
 625 {
 626         int state = s->state;
 627
 628         BT_DBG("session %p state %ld", s, s->state);
 629
 630         list_del(&s->list);
 631
 632         if (state == BT_CONNECTED)
 633                 rfcomm_send_disc(s, 0);
 634
 635         rfcomm_session_clear_timer(s);
 636         sock_release(s->sock);
 637         kfree(s);
 638
 639         if (state != BT_LISTEN)
 640                 module_put(THIS_MODULE);
 641 }
 642
 643 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 644 {
 645         struct rfcomm_session *s;
 646         struct list_head *p, *n;
 647         struct bt_sock *sk;
 648         list_for_each_safe(p, n, &session_list) {
 649                 s = list_entry(p, struct rfcomm_session, list);
 650                 sk = bt_sk(s->sock->sk);
 651
 652                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 653                                 !bacmp(&sk->dst, dst))
 654                         return s;
 655         }
 656         return NULL;
 657 }
 658
 659 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 660 {
 661         struct rfcomm_dlc *d;
 662         struct list_head *p, *n;
 663
 664         BT_DBG("session %p state %ld err %d", s, s->state, err);
 665
 666         rfcomm_session_hold(s);
 667
 668         s->state = BT_CLOSED;
 669
 670         /* Close all dlcs */
 671         list_for_each_safe(p, n, &s->dlcs) {
 672                 d = list_entry(p, struct rfcomm_dlc, list);
 673                 d->state = BT_CLOSED;
 674                 __rfcomm_dlc_close(d, err);
 675         }
 676
 677         rfcomm_session_clear_timer(s);
 678         rfcomm_session_put(s);
 679 }
 680
 681 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 682 {
 683         struct rfcomm_session *s = NULL;
 684         struct sockaddr_l2 addr;
 685         struct socket *sock;
 686         struct sock *sk;
 687
 688         BT_DBG("%s %s", batostr(src), batostr(dst));
 689
 690         *err = rfcomm_l2sock_create(&sock);
 691         if (*err < 0)
 692                 return NULL;
 693
 694         bacpy(&addr.l2_bdaddr, src);
 695         addr.l2_family = AF_BLUETOOTH;
 696         addr.l2_psm    = 0;
 697         addr.l2_cid    = 0;
 698         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 699         if (*err < 0)
 700                 goto failed;
 701
 702         /* Set L2CAP options */
 703         sk = sock->sk;
 704         lock_sock(sk);
 705         l2cap_pi(sk)->imtu = l2cap_mtu;
 706         if (l2cap_ertm)
 707                 l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
 708         release_sock(sk);
 709
 710         s = rfcomm_session_add(sock, BT_BOUND);
 711         if (!s) {
 712                 *err = -ENOMEM;
 713                 goto failed;
 714         }
 715
 716         s->initiator = 1;
 717
 718         bacpy(&addr.l2_bdaddr, dst);
 719         addr.l2_family = AF_BLUETOOTH;
 720         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
 721         addr.l2_cid    = 0;
 722         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 723         if (*err == 0 || *err == -EINPROGRESS)
 724                 return s;
 725
 726         rfcomm_session_del(s);
 727         return NULL;
 728
 729 failed:
 730         sock_release(sock);
 731         return NULL;
 732 }
 733
 734 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 735 {
 736         struct sock *sk = s->sock->sk;
 737         if (src)
 738                 bacpy(src, &bt_sk(sk)->src);
 739         if (dst)
 740                 bacpy(dst, &bt_sk(sk)->dst);
 741 }
 742
 743 /* ---- RFCOMM frame sending ---- */
 744 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 745 {
 746         struct socket *sock = s->sock;
 747         struct kvec iv = { data, len };
 748         struct msghdr msg;
 749
 750         BT_DBG("session %p len %d", s, len);
 751
 752         memset(&msg, 0, sizeof(msg));
 753
 754         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 755 }
 756
 757 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 758 {
 759         struct rfcomm_cmd cmd;
 760
 761         BT_DBG("%p dlci %d", s, dlci);
 762
 763         cmd.addr = __addr(s->initiator, dlci);
 764         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 765         cmd.len  = __len8(0);
 766         cmd.fcs  = __fcs2((u8 *) &cmd);
 767
 768         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 769 }
 770
 771 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 772 {
 773         struct rfcomm_cmd cmd;
 774
 775         BT_DBG("%p dlci %d", s, dlci);
 776
 777         cmd.addr = __addr(!s->initiator, dlci);
 778         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 779         cmd.len  = __len8(0);
 780         cmd.fcs  = __fcs2((u8 *) &cmd);
 781
 782         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 783 }
 784
 785 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 786 {
 787         struct rfcomm_cmd cmd;
 788
 789         BT_DBG("%p dlci %d", s, dlci);
 790
 791         cmd.addr = __addr(s->initiator, dlci);
 792         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 793         cmd.len  = __len8(0);
 794         cmd.fcs  = __fcs2((u8 *) &cmd);
 795
 796         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 797 }
 798
 799 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 800 {
 801         struct rfcomm_cmd *cmd;
 802         struct sk_buff *skb;
 803
 804         BT_DBG("dlc %p dlci %d", d, d->dlci);
 805
 806         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 807         if (!skb)
 808                 return -ENOMEM;
 809
 810         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 811         cmd->addr = d->addr;
 812         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 813         cmd->len  = __len8(0);
 814         cmd->fcs  = __fcs2((u8 *) cmd);
 815
 816         skb_queue_tail(&d->tx_queue, skb);
 817         rfcomm_schedule(RFCOMM_SCHED_TX);
 818         return 0;
 819 }
 820
 821 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 822 {
 823         struct rfcomm_cmd cmd;
 824
 825         BT_DBG("%p dlci %d", s, dlci);
 826
 827         cmd.addr = __addr(!s->initiator, dlci);
 828         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 829         cmd.len  = __len8(0);
 830         cmd.fcs  = __fcs2((u8 *) &cmd);
 831
 832         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 833 }
 834
 835 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 836 {
 837         struct rfcomm_hdr *hdr;
 838         struct rfcomm_mcc *mcc;
 839         u8 buf[16], *ptr = buf;
 840
 841         BT_DBG("%p cr %d type %d", s, cr, type);
 842
 843         hdr = (void *) ptr; ptr += sizeof(*hdr);
 844         hdr->addr = __addr(s->initiator, 0);
 845         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 846         hdr->len  = __len8(sizeof(*mcc) + 1);
 847
 848         mcc = (void *) ptr; ptr += sizeof(*mcc);
 849         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 850         mcc->len  = __len8(1);
 851
 852         /* Type that we didn't like */
 853         *ptr = __mcc_type(cr, type); ptr++;
 854
 855         *ptr = __fcs(buf); ptr++;
 856
 857         return rfcomm_send_frame(s, buf, ptr - buf);
 858 }
 859
 860 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 861 {
 862         struct rfcomm_hdr *hdr;
 863         struct rfcomm_mcc *mcc;
 864         struct rfcomm_pn  *pn;
 865         u8 buf[16], *ptr = buf;
 866
 867         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 868
 869         hdr = (void *) ptr; ptr += sizeof(*hdr);
 870         hdr->addr = __addr(s->initiator, 0);
 871         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 872         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 873
 874         mcc = (void *) ptr; ptr += sizeof(*mcc);
 875         mcc->type = __mcc_type(cr, RFCOMM_PN);
 876         mcc->len  = __len8(sizeof(*pn));
 877
 878         pn = (void *) ptr; ptr += sizeof(*pn);
 879         pn->dlci        = d->dlci;
 880         pn->priority    = d->priority;
 881         pn->ack_timer   = 0;
 882         pn->max_retrans = 0;
 883
 884         if (s->cfc) {
 885                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 886                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 887         } else {
 888                 pn->flow_ctrl = 0;
 889                 pn->credits   = 0;
 890         }
 891
 892         if (cr && channel_mtu >= 0)
 893                 pn->mtu = cpu_to_le16(channel_mtu);
 894         else
 895                 pn->mtu = cpu_to_le16(d->mtu);
 896
 897         *ptr = __fcs(buf); ptr++;
 898
 899         return rfcomm_send_frame(s, buf, ptr - buf);
 900 }
 901
 902 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 903                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 904                         u8 parity, u8 flow_ctrl_settings,
 905                         u8 xon_char, u8 xoff_char, u16 param_mask)
 906 {
 907         struct rfcomm_hdr *hdr;
 908         struct rfcomm_mcc *mcc;
 909         struct rfcomm_rpn *rpn;
 910         u8 buf[16], *ptr = buf;
 911
 912         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 913                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 914                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 915                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 916
 917         hdr = (void *) ptr; ptr += sizeof(*hdr);
 918         hdr->addr = __addr(s->initiator, 0);
 919         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 920         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 921
 922         mcc = (void *) ptr; ptr += sizeof(*mcc);
 923         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 924         mcc->len  = __len8(sizeof(*rpn));
 925
 926         rpn = (void *) ptr; ptr += sizeof(*rpn);
 927         rpn->dlci          = __addr(1, dlci);
 928         rpn->bit_rate      = bit_rate;
 929         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 930         rpn->flow_ctrl     = flow_ctrl_settings;
 931         rpn->xon_char      = xon_char;
 932         rpn->xoff_char     = xoff_char;
 933         rpn->param_mask    = cpu_to_le16(param_mask);
 934
 935         *ptr = __fcs(buf); ptr++;
 936
 937         return rfcomm_send_frame(s, buf, ptr - buf);
 938 }
 939
 940 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 941 {
 942         struct rfcomm_hdr *hdr;
 943         struct rfcomm_mcc *mcc;
 944         struct rfcomm_rls *rls;
 945         u8 buf[16], *ptr = buf;
 946
 947         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 948
 949         hdr = (void *) ptr; ptr += sizeof(*hdr);
 950         hdr->addr = __addr(s->initiator, 0);
 951         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 952         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 953
 954         mcc = (void *) ptr; ptr += sizeof(*mcc);
 955         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 956         mcc->len  = __len8(sizeof(*rls));
 957
 958         rls = (void *) ptr; ptr += sizeof(*rls);
 959         rls->dlci   = __addr(1, dlci);
 960         rls->status = status;
 961
 962         *ptr = __fcs(buf); ptr++;
 963
 964         return rfcomm_send_frame(s, buf, ptr - buf);
 965 }
 966
 967 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 968 {
 969         struct rfcomm_hdr *hdr;
 970         struct rfcomm_mcc *mcc;
 971         struct rfcomm_msc *msc;
 972         u8 buf[16], *ptr = buf;
 973
 974         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 975
 976         hdr = (void *) ptr; ptr += sizeof(*hdr);
 977         hdr->addr = __addr(s->initiator, 0);
 978         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 979         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 980
 981         mcc = (void *) ptr; ptr += sizeof(*mcc);
 982         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 983         mcc->len  = __len8(sizeof(*msc));
 984
 985         msc = (void *) ptr; ptr += sizeof(*msc);
 986         msc->dlci    = __addr(1, dlci);
 987         msc->v24_sig = v24_sig | 0x01;
 988
 989         *ptr = __fcs(buf); ptr++;
 990
 991         return rfcomm_send_frame(s, buf, ptr - buf);
 992 }
 993
 994 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 995 {
 996         struct rfcomm_hdr *hdr;
 997         struct rfcomm_mcc *mcc;
 998         u8 buf[16], *ptr = buf;
 999
1000         BT_DBG("%p cr %d", s, cr);
1001
1002         hdr = (void *) ptr; ptr += sizeof(*hdr);
1003         hdr->addr = __addr(s->initiator, 0);
1004         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1005         hdr->len  = __len8(sizeof(*mcc));
1006
1007         mcc = (void *) ptr; ptr += sizeof(*mcc);
1008         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1009         mcc->len  = __len8(0);
1010
1011         *ptr = __fcs(buf); ptr++;
1012
1013         return rfcomm_send_frame(s, buf, ptr - buf);
1014 }
1015
1016 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1017 {
1018         struct rfcomm_hdr *hdr;
1019         struct rfcomm_mcc *mcc;
1020         u8 buf[16], *ptr = buf;
1021
1022         BT_DBG("%p cr %d", s, cr);
1023
1024         hdr = (void *) ptr; ptr += sizeof(*hdr);
1025         hdr->addr = __addr(s->initiator, 0);
1026         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1027         hdr->len  = __len8(sizeof(*mcc));
1028
1029         mcc = (void *) ptr; ptr += sizeof(*mcc);
1030         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1031         mcc->len  = __len8(0);
1032
1033         *ptr = __fcs(buf); ptr++;
1034
1035         return rfcomm_send_frame(s, buf, ptr - buf);
1036 }
1037
1038 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1039 {
1040         struct socket *sock = s->sock;
1041         struct kvec iv[3];
1042         struct msghdr msg;
1043         unsigned char hdr[5], crc[1];
1044
1045         if (len > 125)
1046                 return -EINVAL;
1047
1048         BT_DBG("%p cr %d", s, cr);
1049
1050         hdr[0] = __addr(s->initiator, 0);
1051         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1052         hdr[2] = 0x01 | ((len + 2) << 1);
1053         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1054         hdr[4] = 0x01 | (len << 1);
1055
1056         crc[0] = __fcs(hdr);
1057
1058         iv[0].iov_base = hdr;
1059         iv[0].iov_len  = 5;
1060         iv[1].iov_base = pattern;
1061         iv[1].iov_len  = len;
1062         iv[2].iov_base = crc;
1063         iv[2].iov_len  = 1;
1064
1065         memset(&msg, 0, sizeof(msg));
1066
1067         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1068 }
1069
1070 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1071 {
1072         struct rfcomm_hdr *hdr;
1073         u8 buf[16], *ptr = buf;
1074
1075         BT_DBG("%p addr %d credits %d", s, addr, credits);
1076
1077         hdr = (void *) ptr; ptr += sizeof(*hdr);
1078         hdr->addr = addr;
1079         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1080         hdr->len  = __len8(0);
1081
1082         *ptr = credits; ptr++;
1083
1084         *ptr = __fcs(buf); ptr++;
1085
1086         return rfcomm_send_frame(s, buf, ptr - buf);
1087 }
1088
1089 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1090 {
1091         struct rfcomm_hdr *hdr;
1092         int len = skb->len;
1093         u8 *crc;
1094
1095         if (len > 127) {
1096                 hdr = (void *) skb_push(skb, 4);
1097                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1098         } else {
1099                 hdr = (void *) skb_push(skb, 3);
1100                 hdr->len = __len8(len);
1101         }
1102         hdr->addr = addr;
1103         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1104
1105         crc = skb_put(skb, 1);
1106         *crc = __fcs((void *) hdr);
1107 }
1108
1109 /* ---- RFCOMM frame reception ---- */
1110 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1111 {
1112         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1113
1114         if (dlci) {
1115                 /* Data channel */
1116                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1117                 if (!d) {
1118                         rfcomm_send_dm(s, dlci);
1119                         return 0;
1120                 }
1121
1122                 switch (d->state) {
1123                 case BT_CONNECT:
1124                         rfcomm_dlc_clear_timer(d);
1125
1126                         rfcomm_dlc_lock(d);
1127                         d->state = BT_CONNECTED;
1128                         d->state_change(d, 0);
1129                         rfcomm_dlc_unlock(d);
1130
1131                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1132                         break;
1133
1134                 case BT_DISCONN:
1135                         d->state = BT_CLOSED;
1136                         __rfcomm_dlc_close(d, 0);
1137
1138                         if (list_empty(&s->dlcs)) {
1139                                 s->state = BT_DISCONN;
1140                                 rfcomm_send_disc(s, 0);
1141                         }
1142
1143                         break;
1144                 }
1145         } else {
1146                 /* Control channel */
1147                 switch (s->state) {
1148                 case BT_CONNECT:
1149                         s->state = BT_CONNECTED;
1150                         rfcomm_process_connect(s);
1151                         break;
1152
1153                 case BT_DISCONN:
1154                         rfcomm_session_put(s);
1155                         break;
1156                 }
1157         }
1158         return 0;
1159 }
1160
1161 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1162 {
1163         int err = 0;
1164
1165         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1166
1167         if (dlci) {
1168                 /* Data DLC */
1169                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1170                 if (d) {
1171                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1172                                 err = ECONNREFUSED;
1173                         else
1174                                 err = ECONNRESET;
1175
1176                         d->state = BT_CLOSED;
1177                         __rfcomm_dlc_close(d, err);
1178                 }
1179         } else {
1180                 if (s->state == BT_CONNECT)
1181                         err = ECONNREFUSED;
1182                 else
1183                         err = ECONNRESET;
1184
1185                 s->state = BT_CLOSED;
1186                 rfcomm_session_close(s, err);
1187         }
1188         return 0;
1189 }
1190
1191 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1192 {
1193         int err = 0;
1194
1195         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1196
1197         if (dlci) {
1198                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1199                 if (d) {
1200                         rfcomm_send_ua(s, dlci);
1201
1202                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1203                                 err = ECONNREFUSED;
1204                         else
1205                                 err = ECONNRESET;
1206
1207                         d->state = BT_CLOSED;
1208                         __rfcomm_dlc_close(d, err);
1209                 } else
1210                         rfcomm_send_dm(s, dlci);
1211
1212         } else {
1213                 rfcomm_send_ua(s, 0);
1214
1215                 if (s->state == BT_CONNECT)
1216                         err = ECONNREFUSED;
1217                 else
1218                         err = ECONNRESET;
1219
1220                 s->state = BT_CLOSED;
1221                 rfcomm_session_close(s, err);
1222         }
1223
1224         return 0;
1225 }
1226
1227 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1228 {
1229         struct sock *sk = d->session->sock->sk;
1230
1231         BT_DBG("dlc %p", d);
1232
1233         rfcomm_send_ua(d->session, d->dlci);
1234
1235         rfcomm_dlc_clear_timer(d);
1236
1237         rfcomm_dlc_lock(d);
1238         d->state = BT_CONNECTED;
1239         d->state_change(d, 0);
1240         rfcomm_dlc_unlock(d);
1241
1242         if (d->role_switch)
1243                 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1244
1245         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1246 }
1247
1248 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1249 {
1250         if (rfcomm_check_security(d)) {
1251                 if (d->defer_setup) {
1252                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1253                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1254
1255                         rfcomm_dlc_lock(d);
1256                         d->state = BT_CONNECT2;
1257                         d->state_change(d, 0);
1258                         rfcomm_dlc_unlock(d);
1259                 } else
1260                         rfcomm_dlc_accept(d);
1261         } else {
1262                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1263                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1264         }
1265 }
1266
1267 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1268 {
1269         struct rfcomm_dlc *d;
1270         u8 channel;
1271
1272         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1273
1274         if (!dlci) {
1275                 rfcomm_send_ua(s, 0);
1276
1277                 if (s->state == BT_OPEN) {
1278                         s->state = BT_CONNECTED;
1279                         rfcomm_process_connect(s);
1280                 }
1281                 return 0;
1282         }
1283
1284         /* Check if DLC exists */
1285         d = rfcomm_dlc_get(s, dlci);
1286         if (d) {
1287                 if (d->state == BT_OPEN) {
1288                         /* DLC was previously opened by PN request */
1289                         rfcomm_check_accept(d);
1290                 }
1291                 return 0;
1292         }
1293
1294         /* Notify socket layer about incoming connection */
1295         channel = __srv_channel(dlci);
1296         if (rfcomm_connect_ind(s, channel, &d)) {
1297                 d->dlci = dlci;
1298                 d->addr = __addr(s->initiator, dlci);
1299                 rfcomm_dlc_link(s, d);
1300
1301                 rfcomm_check_accept(d);
1302         } else {
1303                 rfcomm_send_dm(s, dlci);
1304         }
1305
1306         return 0;
1307 }
1308
1309 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1310 {
1311         struct rfcomm_session *s = d->session;
1312
1313         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1314                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1315
1316         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1317                                                 pn->flow_ctrl == 0xe0) {
1318                 d->cfc = RFCOMM_CFC_ENABLED;
1319                 d->tx_credits = pn->credits;
1320         } else {
1321                 d->cfc = RFCOMM_CFC_DISABLED;
1322                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1323         }
1324
1325         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1326                 s->cfc = d->cfc;
1327
1328         d->priority = pn->priority;
1329
1330         d->mtu = __le16_to_cpu(pn->mtu);
1331
1332         if (cr && d->mtu > s->mtu)
1333                 d->mtu = s->mtu;
1334
1335         return 0;
1336 }
1337
1338 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1339 {
1340         struct rfcomm_pn *pn = (void *) skb->data;
1341         struct rfcomm_dlc *d;
1342         u8 dlci = pn->dlci;
1343
1344         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1345
1346         if (!dlci)
1347                 return 0;
1348
1349         d = rfcomm_dlc_get(s, dlci);
1350         if (d) {
1351                 if (cr) {
1352                         /* PN request */
1353                         rfcomm_apply_pn(d, cr, pn);
1354                         rfcomm_send_pn(s, 0, d);
1355                 } else {
1356                         /* PN response */
1357                         switch (d->state) {
1358                         case BT_CONFIG:
1359                                 rfcomm_apply_pn(d, cr, pn);
1360
1361                                 d->state = BT_CONNECT;
1362                                 rfcomm_send_sabm(s, d->dlci);
1363                                 break;
1364                         }
1365                 }
1366         } else {
1367                 u8 channel = __srv_channel(dlci);
1368
1369                 if (!cr)
1370                         return 0;
1371
1372                 /* PN request for non existing DLC.
1373                  * Assume incoming connection. */
1374                 if (rfcomm_connect_ind(s, channel, &d)) {
1375                         d->dlci = dlci;
1376                         d->addr = __addr(s->initiator, dlci);
1377                         rfcomm_dlc_link(s, d);
1378
1379                         rfcomm_apply_pn(d, cr, pn);
1380
1381                         d->state = BT_OPEN;
1382                         rfcomm_send_pn(s, 0, d);
1383                 } else {
1384                         rfcomm_send_dm(s, dlci);
1385                 }
1386         }
1387         return 0;
1388 }
1389
1390 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1391 {
1392         struct rfcomm_rpn *rpn = (void *) skb->data;
1393         u8 dlci = __get_dlci(rpn->dlci);
1394
1395         u8 bit_rate  = 0;
1396         u8 data_bits = 0;
1397         u8 stop_bits = 0;
1398         u8 parity    = 0;
1399         u8 flow_ctrl = 0;
1400         u8 xon_char  = 0;
1401         u8 xoff_char = 0;
1402         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1403
1404         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1405                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1406                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1407
1408         if (!cr)
1409                 return 0;
1410
1411         if (len == 1) {
1412                 /* This is a request, return default settings */
1413                 bit_rate  = RFCOMM_RPN_BR_115200;
1414                 data_bits = RFCOMM_RPN_DATA_8;
1415                 stop_bits = RFCOMM_RPN_STOP_1;
1416                 parity    = RFCOMM_RPN_PARITY_NONE;
1417                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1418                 xon_char  = RFCOMM_RPN_XON_CHAR;
1419                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1420                 goto rpn_out;
1421         }
1422
1423         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1424          * no parity, no flow control lines, normal XON/XOFF chars */
1425
1426         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1427                 bit_rate = rpn->bit_rate;
1428                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1429                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1430                         bit_rate = RFCOMM_RPN_BR_115200;
1431                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1432                 }
1433         }
1434
1435         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1436                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1437                 if (data_bits != RFCOMM_RPN_DATA_8) {
1438                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1439                         data_bits = RFCOMM_RPN_DATA_8;
1440                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1441                 }
1442         }
1443
1444         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1445                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1446                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1447                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1448                         stop_bits = RFCOMM_RPN_STOP_1;
1449                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1450                 }
1451         }
1452
1453         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1454                 parity = __get_rpn_parity(rpn->line_settings);
1455                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1456                         BT_DBG("RPN parity mismatch 0x%x", parity);
1457                         parity = RFCOMM_RPN_PARITY_NONE;
1458                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1459                 }
1460         }
1461
1462         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1463                 flow_ctrl = rpn->flow_ctrl;
1464                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1465                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1466                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1467                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1468                 }
1469         }
1470
1471         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1472                 xon_char = rpn->xon_char;
1473                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1474                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1475                         xon_char = RFCOMM_RPN_XON_CHAR;
1476                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1477                 }
1478         }
1479
1480         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1481                 xoff_char = rpn->xoff_char;
1482                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1483                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1484                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1485                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1486                 }
1487         }
1488
1489 rpn_out:
1490         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1491                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1492
1493         return 0;
1494 }
1495
1496 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1497 {
1498         struct rfcomm_rls *rls = (void *) skb->data;
1499         u8 dlci = __get_dlci(rls->dlci);
1500
1501         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1502
1503         if (!cr)
1504                 return 0;
1505
1506         /* We should probably do something with this information here. But
1507          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1508          * mandatory to recognise and respond to RLS */
1509
1510         rfcomm_send_rls(s, 0, dlci, rls->status);
1511
1512         return 0;
1513 }
1514
1515 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1516 {
1517         struct rfcomm_msc *msc = (void *) skb->data;
1518         struct rfcomm_dlc *d;
1519         u8 dlci = __get_dlci(msc->dlci);
1520
1521         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1522
1523         d = rfcomm_dlc_get(s, dlci);
1524         if (!d)
1525                 return 0;
1526
1527         if (cr) {
1528                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1529                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1530                 else
1531                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1532
1533                 rfcomm_dlc_lock(d);
1534
1535                 d->remote_v24_sig = msc->v24_sig;
1536
1537                 if (d->modem_status)
1538                         d->modem_status(d, msc->v24_sig);
1539
1540                 rfcomm_dlc_unlock(d);
1541
1542                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1543
1544                 d->mscex |= RFCOMM_MSCEX_RX;
1545         } else
1546                 d->mscex |= RFCOMM_MSCEX_TX;
1547
1548         return 0;
1549 }
1550
1551 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1552 {
1553         struct rfcomm_mcc *mcc = (void *) skb->data;
1554         u8 type, cr, len;
1555
1556         cr   = __test_cr(mcc->type);
1557         type = __get_mcc_type(mcc->type);
1558         len  = __get_mcc_len(mcc->len);
1559
1560         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1561
1562         skb_pull(skb, 2);
1563
1564         switch (type) {
1565         case RFCOMM_PN:
1566                 rfcomm_recv_pn(s, cr, skb);
1567                 break;
1568
1569         case RFCOMM_RPN:
1570                 rfcomm_recv_rpn(s, cr, len, skb);
1571                 break;
1572
1573         case RFCOMM_RLS:
1574                 rfcomm_recv_rls(s, cr, skb);
1575                 break;
1576
1577         case RFCOMM_MSC:
1578                 rfcomm_recv_msc(s, cr, skb);
1579                 break;
1580
1581         case RFCOMM_FCOFF:
1582                 if (cr) {
1583                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1584                         rfcomm_send_fcoff(s, 0);
1585                 }
1586                 break;
1587
1588         case RFCOMM_FCON:
1589                 if (cr) {
1590                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1591                         rfcomm_send_fcon(s, 0);
1592                 }
1593                 break;
1594
1595         case RFCOMM_TEST:
1596                 if (cr)
1597                         rfcomm_send_test(s, 0, skb->data, skb->len);
1598                 break;
1599
1600         case RFCOMM_NSC:
1601                 break;
1602
1603         default:
1604                 BT_ERR("Unknown control type 0x%02x", type);
1605                 rfcomm_send_nsc(s, cr, type);
1606                 break;
1607         }
1608         return 0;
1609 }
1610
1611 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1612 {
1613         struct rfcomm_dlc *d;
1614
1615         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1616
1617         d = rfcomm_dlc_get(s, dlci);
1618         if (!d) {
1619                 rfcomm_send_dm(s, dlci);
1620                 goto drop;
1621         }
1622
1623         if (pf && d->cfc) {
1624                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1625
1626                 d->tx_credits += credits;
1627                 if (d->tx_credits)
1628                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1629         }
1630
1631         if (skb->len && d->state == BT_CONNECTED) {
1632                 rfcomm_dlc_lock(d);
1633                 d->rx_credits--;
1634                 d->data_ready(d, skb);
1635                 rfcomm_dlc_unlock(d);
1636                 return 0;
1637         }
1638
1639 drop:
1640         kfree_skb(skb);
1641         return 0;
1642 }
1643
1644 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1645 {
1646         struct rfcomm_hdr *hdr = (void *) skb->data;
1647         u8 type, dlci, fcs;
1648
1649         dlci = __get_dlci(hdr->addr);
1650         type = __get_type(hdr->ctrl);
1651
1652         /* Trim FCS */
1653         skb->len--; skb->tail--;
1654         fcs = *(u8 *)skb_tail_pointer(skb);
1655
1656         if (__check_fcs(skb->data, type, fcs)) {
1657                 BT_ERR("bad checksum in packet");
1658                 kfree_skb(skb);
1659                 return -EILSEQ;
1660         }
1661
1662         if (__test_ea(hdr->len))
1663                 skb_pull(skb, 3);
1664         else
1665                 skb_pull(skb, 4);
1666
1667         switch (type) {
1668         case RFCOMM_SABM:
1669                 if (__test_pf(hdr->ctrl))
1670                         rfcomm_recv_sabm(s, dlci);
1671                 break;
1672
1673         case RFCOMM_DISC:
1674                 if (__test_pf(hdr->ctrl))
1675                         rfcomm_recv_disc(s, dlci);
1676                 break;
1677
1678         case RFCOMM_UA:
1679                 if (__test_pf(hdr->ctrl))
1680                         rfcomm_recv_ua(s, dlci);
1681                 break;
1682
1683         case RFCOMM_DM:
1684                 rfcomm_recv_dm(s, dlci);
1685                 break;
1686
1687         case RFCOMM_UIH:
1688                 if (dlci)
1689                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1690
1691                 rfcomm_recv_mcc(s, skb);
1692                 break;
1693
1694         default:
1695                 BT_ERR("Unknown packet type 0x%02x\n", type);
1696                 break;
1697         }
1698         kfree_skb(skb);
1699         return 0;
1700 }
1701
1702 /* ---- Connection and data processing ---- */
1703
1704 static void rfcomm_process_connect(struct rfcomm_session *s)
1705 {
1706         struct rfcomm_dlc *d;
1707         struct list_head *p, *n;
1708
1709         BT_DBG("session %p state %ld", s, s->state);
1710
1711         list_for_each_safe(p, n, &s->dlcs) {
1712                 d = list_entry(p, struct rfcomm_dlc, list);
1713                 if (d->state == BT_CONFIG) {
1714                         d->mtu = s->mtu;
1715                         if (rfcomm_check_security(d)) {
1716                                 rfcomm_send_pn(s, 1, d);
1717                         } else {
1718                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1719                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1720                         }
1721                 }
1722         }
1723 }
1724
1725 /* Send data queued for the DLC.
1726  * Return number of frames left in the queue.
1727  */
1728 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1729 {
1730         struct sk_buff *skb;
1731         int err;
1732
1733         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1734                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1735
1736         /* Send pending MSC */
1737         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1738                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1739
1740         if (d->cfc) {
1741                 /* CFC enabled.
1742                  * Give them some credits */
1743                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1744                                 d->rx_credits <= (d->cfc >> 2)) {
1745                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1746                         d->rx_credits = d->cfc;
1747                 }
1748         } else {
1749                 /* CFC disabled.
1750                  * Give ourselves some credits */
1751                 d->tx_credits = 5;
1752         }
1753
1754         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1755                 return skb_queue_len(&d->tx_queue);
1756
1757         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1758                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1759                 if (err < 0) {
1760                         skb_queue_head(&d->tx_queue, skb);
1761                         break;
1762                 }
1763                 kfree_skb(skb);
1764                 d->tx_credits--;
1765         }
1766
1767         if (d->cfc && !d->tx_credits) {
1768                 /* We're out of TX credits.
1769                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1770                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1771         }
1772
1773         return skb_queue_len(&d->tx_queue);
1774 }
1775
1776 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1777 {
1778         struct rfcomm_dlc *d;
1779         struct list_head *p, *n;
1780
1781         BT_DBG("session %p state %ld", s, s->state);
1782
1783         list_for_each_safe(p, n, &s->dlcs) {
1784                 d = list_entry(p, struct rfcomm_dlc, list);
1785
1786                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1787                         __rfcomm_dlc_close(d, ETIMEDOUT);
1788                         continue;
1789                 }
1790
1791                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1792                         rfcomm_dlc_clear_timer(d);
1793                         if (d->out) {
1794                                 rfcomm_send_pn(s, 1, d);
1795                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1796                         } else {
1797                                 if (d->defer_setup) {
1798                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1799                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1800
1801                                         rfcomm_dlc_lock(d);
1802                                         d->state = BT_CONNECT2;
1803                                         d->state_change(d, 0);
1804                                         rfcomm_dlc_unlock(d);
1805                                 } else
1806                                         rfcomm_dlc_accept(d);
1807                         }
1808                         continue;
1809                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1810                         rfcomm_dlc_clear_timer(d);
1811                         if (!d->out)
1812                                 rfcomm_send_dm(s, d->dlci);
1813                         else
1814                                 d->state = BT_CLOSED;
1815                         __rfcomm_dlc_close(d, ECONNREFUSED);
1816                         continue;
1817                 }
1818
1819                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1820                         continue;
1821
1822                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1823                         continue;
1824
1825                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1826                                                 d->mscex == RFCOMM_MSCEX_OK)
1827                         rfcomm_process_tx(d);
1828         }
1829 }
1830
1831 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1832 {
1833         struct socket *sock = s->sock;
1834         struct sock *sk = sock->sk;
1835         struct sk_buff *skb;
1836
1837         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1838
1839         /* Get data directly from socket receive queue without copying it. */
1840         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1841                 skb_orphan(skb);
1842                 rfcomm_recv_frame(s, skb);
1843         }
1844
1845         if (sk->sk_state == BT_CLOSED) {
1846                 if (!s->initiator)
1847                         rfcomm_session_put(s);
1848
1849                 rfcomm_session_close(s, sk->sk_err);
1850         }
1851 }
1852
1853 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1854 {
1855         struct socket *sock = s->sock, *nsock;
1856         int err;
1857
1858         /* Fast check for a new connection.
1859          * Avoids unnesesary socket allocations. */
1860         if (list_empty(&bt_sk(sock->sk)->accept_q))
1861                 return;
1862
1863         BT_DBG("session %p", s);
1864
1865         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1866         if (err < 0)
1867                 return;
1868
1869         /* Set our callbacks */
1870         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1871         nsock->sk->sk_state_change = rfcomm_l2state_change;
1872
1873         s = rfcomm_session_add(nsock, BT_OPEN);
1874         if (s) {
1875                 rfcomm_session_hold(s);
1876
1877                 /* We should adjust MTU on incoming sessions.
1878                  * L2CAP MTU minus UIH header and FCS. */
1879                 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1880
1881                 rfcomm_schedule(RFCOMM_SCHED_RX);
1882         } else
1883                 sock_release(nsock);
1884 }
1885
1886 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1887 {
1888         struct sock *sk = s->sock->sk;
1889
1890         BT_DBG("%p state %ld", s, s->state);
1891
1892         switch(sk->sk_state) {
1893         case BT_CONNECTED:
1894                 s->state = BT_CONNECT;
1895
1896                 /* We can adjust MTU on outgoing sessions.
1897                  * L2CAP MTU minus UIH header and FCS. */
1898                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1899
1900                 rfcomm_send_sabm(s, 0);
1901                 break;
1902
1903         case BT_CLOSED:
1904                 s->state = BT_CLOSED;
1905                 rfcomm_session_close(s, sk->sk_err);
1906                 break;
1907         }
1908 }
1909
1910 static inline void rfcomm_process_sessions(void)
1911 {
1912         struct list_head *p, *n;
1913
1914         rfcomm_lock();
1915
1916         list_for_each_safe(p, n, &session_list) {
1917                 struct rfcomm_session *s;
1918                 s = list_entry(p, struct rfcomm_session, list);
1919
1920                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1921                         s->state = BT_DISCONN;
1922                         rfcomm_send_disc(s, 0);
1923                         continue;
1924                 }
1925
1926                 if (s->state == BT_LISTEN) {
1927                         rfcomm_accept_connection(s);
1928                         continue;
1929                 }
1930
1931                 rfcomm_session_hold(s);
1932
1933                 switch (s->state) {
1934                 case BT_BOUND:
1935                         rfcomm_check_connection(s);
1936                         break;
1937
1938                 default:
1939                         rfcomm_process_rx(s);
1940                         break;
1941                 }
1942
1943                 rfcomm_process_dlcs(s);
1944
1945                 rfcomm_session_put(s);
1946         }
1947
1948         rfcomm_unlock();
1949 }
1950
1951 static int rfcomm_add_listener(bdaddr_t *ba)
1952 {
1953         struct sockaddr_l2 addr;
1954         struct socket *sock;
1955         struct sock *sk;
1956         struct rfcomm_session *s;
1957         int    err = 0;
1958
1959         /* Create socket */
1960         err = rfcomm_l2sock_create(&sock);
1961         if (err < 0) {
1962                 BT_ERR("Create socket failed %d", err);
1963                 return err;
1964         }
1965
1966         /* Bind socket */
1967         bacpy(&addr.l2_bdaddr, ba);
1968         addr.l2_family = AF_BLUETOOTH;
1969         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
1970         addr.l2_cid    = 0;
1971         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1972         if (err < 0) {
1973                 BT_ERR("Bind failed %d", err);
1974                 goto failed;
1975         }
1976
1977         /* Set L2CAP options */
1978         sk = sock->sk;
1979         lock_sock(sk);
1980         l2cap_pi(sk)->imtu = l2cap_mtu;
1981         release_sock(sk);
1982
1983         /* Start listening on the socket */
1984         err = kernel_listen(sock, 10);
1985         if (err) {
1986                 BT_ERR("Listen failed %d", err);
1987                 goto failed;
1988         }
1989
1990         /* Add listening session */
1991         s = rfcomm_session_add(sock, BT_LISTEN);
1992         if (!s)
1993                 goto failed;
1994
1995         rfcomm_session_hold(s);
1996         return 0;
1997 failed:
1998         sock_release(sock);
1999         return err;
2000 }
2001
2002 static void rfcomm_kill_listener(void)
2003 {
2004         struct rfcomm_session *s;
2005         struct list_head *p, *n;
2006
2007         BT_DBG("");
2008
2009         list_for_each_safe(p, n, &session_list) {
2010                 s = list_entry(p, struct rfcomm_session, list);
2011                 rfcomm_session_del(s);
2012         }
2013 }
2014
2015 static int rfcomm_run(void *unused)
2016 {
2017         BT_DBG("");
2018
2019         set_user_nice(current, -10);
2020
2021         rfcomm_add_listener(BDADDR_ANY);
2022
2023         while (!kthread_should_stop()) {
2024                 set_current_state(TASK_INTERRUPTIBLE);
2025                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
2026                         /* No pending events. Let's sleep.
2027                          * Incoming connections and data will wake us up. */
2028                         schedule();
2029                 }
2030                 set_current_state(TASK_RUNNING);
2031
2032                 /* Process stuff */
2033                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
2034                 rfcomm_process_sessions();
2035         }
2036
2037         rfcomm_kill_listener();
2038
2039         return 0;
2040 }
2041
2042 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2043 {
2044         struct rfcomm_session *s;
2045         struct rfcomm_dlc *d;
2046         struct list_head *p, *n;
2047
2048         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2049
2050         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2051         if (!s)
2052                 return;
2053
2054         rfcomm_session_hold(s);
2055
2056         list_for_each_safe(p, n, &s->dlcs) {
2057                 d = list_entry(p, struct rfcomm_dlc, list);
2058
2059                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2060                         rfcomm_dlc_clear_timer(d);
2061                         if (status || encrypt == 0x00) {
2062                                 __rfcomm_dlc_close(d, ECONNREFUSED);
2063                                 continue;
2064                         }
2065                 }
2066
2067                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2068                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2069                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2070                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2071                                 continue;
2072                         } else if (d->sec_level == BT_SECURITY_HIGH) {
2073                                 __rfcomm_dlc_close(d, ECONNREFUSED);
2074                                 continue;
2075                         }
2076                 }
2077
2078                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2079                         continue;
2080
2081                 if (!status)
2082                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2083                 else
2084                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2085         }
2086
2087         rfcomm_session_put(s);
2088
2089         rfcomm_schedule(RFCOMM_SCHED_AUTH);
2090 }
2091
2092 static struct hci_cb rfcomm_cb = {
2093         .name           = "RFCOMM",
2094         .security_cfm   = rfcomm_security_cfm
2095 };
2096
2097 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2098 {
2099         struct rfcomm_session *s;
2100         struct list_head *pp, *p;
2101         char *str = buf;
2102
2103         rfcomm_lock();
2104
2105         list_for_each(p, &session_list) {
2106                 s = list_entry(p, struct rfcomm_session, list);
2107                 list_for_each(pp, &s->dlcs) {
2108                         struct sock *sk = s->sock->sk;
2109                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2110
2111                         str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2112                                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2113                                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2114                 }
2115         }
2116
2117         rfcomm_unlock();
2118
2119         return (str - buf);
2120 }
2121
2122 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2123
2124 /* ---- Initialization ---- */
2125 static int __init rfcomm_init(void)
2126 {
2127         int err;
2128
2129         l2cap_load();
2130
2131         hci_register_cb(&rfcomm_cb);
2132
2133         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2134         if (IS_ERR(rfcomm_thread)) {
2135                 err = PTR_ERR(rfcomm_thread);
2136                 goto unregister;
2137         }
2138
2139         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2140                 BT_ERR("Failed to create RFCOMM info file");
2141
2142         err = rfcomm_init_ttys();
2143         if (err < 0)
2144                 goto stop;
2145
2146         err = rfcomm_init_sockets();
2147         if (err < 0)
2148                 goto cleanup;
2149
2150         BT_INFO("RFCOMM ver %s", VERSION);
2151
2152         return 0;
2153
2154 cleanup:
2155         rfcomm_cleanup_ttys();
2156
2157 stop:
2158         kthread_stop(rfcomm_thread);
2159
2160 unregister:
2161         hci_unregister_cb(&rfcomm_cb);
2162
2163         return err;
2164 }
2165
2166 static void __exit rfcomm_exit(void)
2167 {
2168         class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2169
2170         hci_unregister_cb(&rfcomm_cb);
2171
2172         kthread_stop(rfcomm_thread);
2173
2174         rfcomm_cleanup_ttys();
2175
2176         rfcomm_cleanup_sockets();
2177 }
2178
2179 module_init(rfcomm_init);
2180 module_exit(rfcomm_exit);
2181
2182 module_param(disable_cfc, bool, 0644);
2183 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2184
2185 module_param(channel_mtu, int, 0644);
2186 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2187
2188 module_param(l2cap_mtu, uint, 0644);
2189 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2190
2191 module_param(l2cap_ertm, bool, 0644);
2192 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2193
2194 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2195 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2196 MODULE_VERSION(VERSION);
2197 MODULE_LICENSE("GPL");
2198 MODULE_ALIAS("bt-proto-3");