net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  *
  27  * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
  28  */
  29
  30 #include <linux/module.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/signal.h>
  35 #include <linux/init.h>
  36 #include <linux/wait.h>
  37 #include <linux/device.h>
  38 #include <linux/net.h>
  39 #include <linux/mutex.h>
  40
  41 #include <net/sock.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47 #include <net/bluetooth/l2cap.h>
  48 #include <net/bluetooth/rfcomm.h>
  49
  50 #ifndef CONFIG_BT_RFCOMM_DEBUG
  51 #undef  BT_DBG
  52 #define BT_DBG(D...)
  53 #endif
  54
  55 #define VERSION "1.8"
  56
  57 static int disable_cfc = 0;
  58 static int channel_mtu = -1;
  59 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  60
  61 static struct task_struct *rfcomm_thread;
  62
  63 static DEFINE_MUTEX(rfcomm_mutex);
  64 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  65 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  66
  67 static unsigned long rfcomm_event;
  68
  69 static LIST_HEAD(session_list);
  70 static atomic_t terminate, running;
  71
  72 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  73 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  74 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  75 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  76 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  77 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  78 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  79 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  80 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  81 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  82
  83 static void rfcomm_process_connect(struct rfcomm_session *s);
  84
  85 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
  86 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  87 static void rfcomm_session_del(struct rfcomm_session *s);
  88
  89 /* ---- RFCOMM frame parsing macros ---- */
  90 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  91 #define __get_channel(b)  ((b & 0xf8) >> 3)
  92 #define __get_dir(b)      ((b & 0x04) >> 2)
  93 #define __get_type(b)     ((b & 0xef))
  94
  95 #define __test_ea(b)      ((b & 0x01))
  96 #define __test_cr(b)      ((b & 0x02))
  97 #define __test_pf(b)      ((b & 0x10))
  98
  99 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 100 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
 101 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
 102 #define __srv_channel(dlci)    (dlci >> 1)
 103 #define __dir(dlci)            (dlci & 0x01)
 104
 105 #define __len8(len)       (((len) << 1) | 1)
 106 #define __len16(len)      ((len) << 1)
 107
 108 /* MCC macros */
 109 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 110 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 111 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 112
 113 /* RPN macros */
 114 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 115 #define __get_rpn_data_bits(line) ((line) & 0x3)
 116 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 117 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 118
 119 static inline void rfcomm_schedule(uint event)
 120 {
 121         if (!rfcomm_thread)
 122                 return;
 123         //set_bit(event, &rfcomm_event);
 124         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
 125         wake_up_process(rfcomm_thread);
 126 }
 127
 128 static inline void rfcomm_session_put(struct rfcomm_session *s)
 129 {
 130         if (atomic_dec_and_test(&s->refcnt))
 131                 rfcomm_session_del(s);
 132 }
 133
 134 /* ---- RFCOMM FCS computation ---- */
 135
 136 /* reversed, 8-bit, poly=0x07 */
 137 static unsigned char rfcomm_crc_table[256] = {
 138         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 139         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 140         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 141         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 142
 143         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 144         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 145         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 146         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 147
 148         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 149         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 150         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 151         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 152
 153         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 154         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 155         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 156         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 157
 158         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 159         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 160         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 161         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 162
 163         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 164         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 165         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 166         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 167
 168         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 169         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 170         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 171         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 172
 173         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 174         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 175         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 176         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 177 };
 178
 179 /* CRC on 2 bytes */
 180 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 181
 182 /* FCS on 2 bytes */
 183 static inline u8 __fcs(u8 *data)
 184 {
 185         return (0xff - __crc(data));
 186 }
 187
 188 /* FCS on 3 bytes */
 189 static inline u8 __fcs2(u8 *data)
 190 {
 191         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 192 }
 193
 194 /* Check FCS */
 195 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 196 {
 197         u8 f = __crc(data);
 198
 199         if (type != RFCOMM_UIH)
 200                 f = rfcomm_crc_table[f ^ data[2]];
 201
 202         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 203 }
 204
 205 /* ---- L2CAP callbacks ---- */
 206 static void rfcomm_l2state_change(struct sock *sk)
 207 {
 208         BT_DBG("%p state %d", sk, sk->sk_state);
 209         rfcomm_schedule(RFCOMM_SCHED_STATE);
 210 }
 211
 212 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 213 {
 214         BT_DBG("%p bytes %d", sk, bytes);
 215         rfcomm_schedule(RFCOMM_SCHED_RX);
 216 }
 217
 218 static int rfcomm_l2sock_create(struct socket **sock)
 219 {
 220         int err;
 221
 222         BT_DBG("");
 223
 224         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 225         if (!err) {
 226                 struct sock *sk = (*sock)->sk;
 227                 sk->sk_data_ready   = rfcomm_l2data_ready;
 228                 sk->sk_state_change = rfcomm_l2state_change;
 229         }
 230         return err;
 231 }
 232
 233 /* ---- RFCOMM DLCs ---- */
 234 static void rfcomm_dlc_timeout(unsigned long arg)
 235 {
 236         struct rfcomm_dlc *d = (void *) arg;
 237
 238         BT_DBG("dlc %p state %ld", d, d->state);
 239
 240         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 241         rfcomm_dlc_put(d);
 242         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 243 }
 244
 245 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 246 {
 247         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 248
 249         if (!mod_timer(&d->timer, jiffies + timeout))
 250                 rfcomm_dlc_hold(d);
 251 }
 252
 253 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 254 {
 255         BT_DBG("dlc %p state %ld", d, d->state);
 256
 257         if (timer_pending(&d->timer) && del_timer(&d->timer))
 258                 rfcomm_dlc_put(d);
 259 }
 260
 261 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 262 {
 263         BT_DBG("%p", d);
 264
 265         d->state      = BT_OPEN;
 266         d->flags      = 0;
 267         d->mscex      = 0;
 268         d->mtu        = RFCOMM_DEFAULT_MTU;
 269         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 270
 271         d->cfc        = RFCOMM_CFC_DISABLED;
 272         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 273 }
 274
 275 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 276 {
 277         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 278
 279         if (!d)
 280                 return NULL;
 281
 282         init_timer(&d->timer);
 283         d->timer.function = rfcomm_dlc_timeout;
 284         d->timer.data = (unsigned long) d;
 285
 286         skb_queue_head_init(&d->tx_queue);
 287         spin_lock_init(&d->lock);
 288         atomic_set(&d->refcnt, 1);
 289
 290         rfcomm_dlc_clear_state(d);
 291
 292         BT_DBG("%p", d);
 293
 294         return d;
 295 }
 296
 297 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 298 {
 299         BT_DBG("%p", d);
 300
 301         skb_queue_purge(&d->tx_queue);
 302         kfree(d);
 303 }
 304
 305 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 306 {
 307         BT_DBG("dlc %p session %p", d, s);
 308
 309         rfcomm_session_hold(s);
 310
 311         rfcomm_dlc_hold(d);
 312         list_add(&d->list, &s->dlcs);
 313         d->session = s;
 314 }
 315
 316 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 317 {
 318         struct rfcomm_session *s = d->session;
 319
 320         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 321
 322         list_del(&d->list);
 323         d->session = NULL;
 324         rfcomm_dlc_put(d);
 325
 326         rfcomm_session_put(s);
 327 }
 328
 329 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 330 {
 331         struct rfcomm_dlc *d;
 332         struct list_head *p;
 333
 334         list_for_each(p, &s->dlcs) {
 335                 d = list_entry(p, struct rfcomm_dlc, list);
 336                 if (d->dlci == dlci)
 337                         return d;
 338         }
 339         return NULL;
 340 }
 341
 342 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 343 {
 344         struct rfcomm_session *s;
 345         int err = 0;
 346         u8 dlci;
 347
 348         BT_DBG("dlc %p state %ld %s %s channel %d",
 349                         d, d->state, batostr(src), batostr(dst), channel);
 350
 351         if (channel < 1 || channel > 30)
 352                 return -EINVAL;
 353
 354         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 355                 return 0;
 356
 357         s = rfcomm_session_get(src, dst);
 358         if (!s) {
 359                 s = rfcomm_session_create(src, dst, &err);
 360                 if (!s)
 361                         return err;
 362         }
 363
 364         dlci = __dlci(!s->initiator, channel);
 365
 366         /* Check if DLCI already exists */
 367         if (rfcomm_dlc_get(s, dlci))
 368                 return -EBUSY;
 369
 370         rfcomm_dlc_clear_state(d);
 371
 372         d->dlci     = dlci;
 373         d->addr     = __addr(s->initiator, dlci);
 374         d->priority = 7;
 375
 376         d->state    = BT_CONFIG;
 377         rfcomm_dlc_link(s, d);
 378
 379         d->mtu = s->mtu;
 380         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 381
 382         if (s->state == BT_CONNECTED)
 383                 rfcomm_send_pn(s, 1, d);
 384         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 385         return 0;
 386 }
 387
 388 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 389 {
 390         int r;
 391
 392         rfcomm_lock();
 393
 394         r = __rfcomm_dlc_open(d, src, dst, channel);
 395
 396         rfcomm_unlock();
 397         return r;
 398 }
 399
 400 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 401 {
 402         struct rfcomm_session *s = d->session;
 403         if (!s)
 404                 return 0;
 405
 406         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 407                         d, d->state, d->dlci, err, s);
 408
 409         switch (d->state) {
 410         case BT_CONNECTED:
 411         case BT_CONFIG:
 412         case BT_CONNECT:
 413                 d->state = BT_DISCONN;
 414                 if (skb_queue_empty(&d->tx_queue)) {
 415                         rfcomm_send_disc(s, d->dlci);
 416                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 417                 } else {
 418                         rfcomm_queue_disc(d);
 419                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 420                 }
 421                 break;
 422
 423         default:
 424                 rfcomm_dlc_clear_timer(d);
 425
 426                 rfcomm_dlc_lock(d);
 427                 d->state = BT_CLOSED;
 428                 d->state_change(d, err);
 429                 rfcomm_dlc_unlock(d);
 430
 431                 skb_queue_purge(&d->tx_queue);
 432                 rfcomm_dlc_unlink(d);
 433         }
 434
 435         return 0;
 436 }
 437
 438 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 439 {
 440         int r;
 441
 442         rfcomm_lock();
 443
 444         r = __rfcomm_dlc_close(d, err);
 445
 446         rfcomm_unlock();
 447         return r;
 448 }
 449
 450 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 451 {
 452         int len = skb->len;
 453
 454         if (d->state != BT_CONNECTED)
 455                 return -ENOTCONN;
 456
 457         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 458
 459         if (len > d->mtu)
 460                 return -EINVAL;
 461
 462         rfcomm_make_uih(skb, d->addr);
 463         skb_queue_tail(&d->tx_queue, skb);
 464
 465         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 466                 rfcomm_schedule(RFCOMM_SCHED_TX);
 467         return len;
 468 }
 469
 470 void fastcall __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 471 {
 472         BT_DBG("dlc %p state %ld", d, d->state);
 473
 474         if (!d->cfc) {
 475                 d->v24_sig |= RFCOMM_V24_FC;
 476                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 477         }
 478         rfcomm_schedule(RFCOMM_SCHED_TX);
 479 }
 480
 481 void fastcall __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 482 {
 483         BT_DBG("dlc %p state %ld", d, d->state);
 484
 485         if (!d->cfc) {
 486                 d->v24_sig &= ~RFCOMM_V24_FC;
 487                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 488         }
 489         rfcomm_schedule(RFCOMM_SCHED_TX);
 490 }
 491
 492 /*
 493    Set/get modem status functions use _local_ status i.e. what we report
 494    to the other side.
 495    Remote status is provided by dlc->modem_status() callback.
 496  */
 497 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 498 {
 499         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 500                         d, d->state, v24_sig);
 501
 502         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 503                 v24_sig |= RFCOMM_V24_FC;
 504         else
 505                 v24_sig &= ~RFCOMM_V24_FC;
 506
 507         d->v24_sig = v24_sig;
 508
 509         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 510                 rfcomm_schedule(RFCOMM_SCHED_TX);
 511
 512         return 0;
 513 }
 514
 515 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 516 {
 517         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 518                         d, d->state, d->v24_sig);
 519
 520         *v24_sig = d->v24_sig;
 521         return 0;
 522 }
 523
 524 /* ---- RFCOMM sessions ---- */
 525 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 526 {
 527         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 528
 529         if (!s)
 530                 return NULL;
 531
 532         BT_DBG("session %p sock %p", s, sock);
 533
 534         INIT_LIST_HEAD(&s->dlcs);
 535         s->state = state;
 536         s->sock  = sock;
 537
 538         s->mtu = RFCOMM_DEFAULT_MTU;
 539         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 540
 541         /* Do not increment module usage count for listening sessions.
 542          * Otherwise we won't be able to unload the module. */
 543         if (state != BT_LISTEN)
 544                 if (!try_module_get(THIS_MODULE)) {
 545                         kfree(s);
 546                         return NULL;
 547                 }
 548
 549         list_add(&s->list, &session_list);
 550
 551         return s;
 552 }
 553
 554 static void rfcomm_session_del(struct rfcomm_session *s)
 555 {
 556         int state = s->state;
 557
 558         BT_DBG("session %p state %ld", s, s->state);
 559
 560         list_del(&s->list);
 561
 562         if (state == BT_CONNECTED)
 563                 rfcomm_send_disc(s, 0);
 564
 565         sock_release(s->sock);
 566         kfree(s);
 567
 568         if (state != BT_LISTEN)
 569                 module_put(THIS_MODULE);
 570 }
 571
 572 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 573 {
 574         struct rfcomm_session *s;
 575         struct list_head *p, *n;
 576         struct bt_sock *sk;
 577         list_for_each_safe(p, n, &session_list) {
 578                 s = list_entry(p, struct rfcomm_session, list);
 579                 sk = bt_sk(s->sock->sk);
 580
 581                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 582                                 !bacmp(&sk->dst, dst))
 583                         return s;
 584         }
 585         return NULL;
 586 }
 587
 588 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 589 {
 590         struct rfcomm_dlc *d;
 591         struct list_head *p, *n;
 592
 593         BT_DBG("session %p state %ld err %d", s, s->state, err);
 594
 595         rfcomm_session_hold(s);
 596
 597         s->state = BT_CLOSED;
 598
 599         /* Close all dlcs */
 600         list_for_each_safe(p, n, &s->dlcs) {
 601                 d = list_entry(p, struct rfcomm_dlc, list);
 602                 d->state = BT_CLOSED;
 603                 __rfcomm_dlc_close(d, err);
 604         }
 605
 606         rfcomm_session_put(s);
 607 }
 608
 609 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 610 {
 611         struct rfcomm_session *s = NULL;
 612         struct sockaddr_l2 addr;
 613         struct socket *sock;
 614         struct sock *sk;
 615
 616         BT_DBG("%s %s", batostr(src), batostr(dst));
 617
 618         *err = rfcomm_l2sock_create(&sock);
 619         if (*err < 0)
 620                 return NULL;
 621
 622         bacpy(&addr.l2_bdaddr, src);
 623         addr.l2_family = AF_BLUETOOTH;
 624         addr.l2_psm    = 0;
 625         *err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 626         if (*err < 0)
 627                 goto failed;
 628
 629         /* Set L2CAP options */
 630         sk = sock->sk;
 631         lock_sock(sk);
 632         l2cap_pi(sk)->imtu = l2cap_mtu;
 633         release_sock(sk);
 634
 635         s = rfcomm_session_add(sock, BT_BOUND);
 636         if (!s) {
 637                 *err = -ENOMEM;
 638                 goto failed;
 639         }
 640
 641         s->initiator = 1;
 642
 643         bacpy(&addr.l2_bdaddr, dst);
 644         addr.l2_family = AF_BLUETOOTH;
 645         addr.l2_psm    = htobs(RFCOMM_PSM);
 646         *err = sock->ops->connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 647         if (*err == 0 || *err == -EINPROGRESS)
 648                 return s;
 649
 650         rfcomm_session_del(s);
 651         return NULL;
 652
 653 failed:
 654         sock_release(sock);
 655         return NULL;
 656 }
 657
 658 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 659 {
 660         struct sock *sk = s->sock->sk;
 661         if (src)
 662                 bacpy(src, &bt_sk(sk)->src);
 663         if (dst)
 664                 bacpy(dst, &bt_sk(sk)->dst);
 665 }
 666
 667 /* ---- RFCOMM frame sending ---- */
 668 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 669 {
 670         struct socket *sock = s->sock;
 671         struct kvec iv = { data, len };
 672         struct msghdr msg;
 673
 674         BT_DBG("session %p len %d", s, len);
 675
 676         memset(&msg, 0, sizeof(msg));
 677
 678         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 679 }
 680
 681 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 682 {
 683         struct rfcomm_cmd cmd;
 684
 685         BT_DBG("%p dlci %d", s, dlci);
 686
 687         cmd.addr = __addr(s->initiator, dlci);
 688         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 689         cmd.len  = __len8(0);
 690         cmd.fcs  = __fcs2((u8 *) &cmd);
 691
 692         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 693 }
 694
 695 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 696 {
 697         struct rfcomm_cmd cmd;
 698
 699         BT_DBG("%p dlci %d", s, dlci);
 700
 701         cmd.addr = __addr(!s->initiator, dlci);
 702         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 703         cmd.len  = __len8(0);
 704         cmd.fcs  = __fcs2((u8 *) &cmd);
 705
 706         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 707 }
 708
 709 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 710 {
 711         struct rfcomm_cmd cmd;
 712
 713         BT_DBG("%p dlci %d", s, dlci);
 714
 715         cmd.addr = __addr(s->initiator, dlci);
 716         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 717         cmd.len  = __len8(0);
 718         cmd.fcs  = __fcs2((u8 *) &cmd);
 719
 720         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 721 }
 722
 723 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 724 {
 725         struct rfcomm_cmd *cmd;
 726         struct sk_buff *skb;
 727
 728         BT_DBG("dlc %p dlci %d", d, d->dlci);
 729
 730         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 731         if (!skb)
 732                 return -ENOMEM;
 733
 734         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 735         cmd->addr = d->addr;
 736         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 737         cmd->len  = __len8(0);
 738         cmd->fcs  = __fcs2((u8 *) cmd);
 739
 740         skb_queue_tail(&d->tx_queue, skb);
 741         rfcomm_schedule(RFCOMM_SCHED_TX);
 742         return 0;
 743 }
 744
 745 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 746 {
 747         struct rfcomm_cmd cmd;
 748
 749         BT_DBG("%p dlci %d", s, dlci);
 750
 751         cmd.addr = __addr(!s->initiator, dlci);
 752         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 753         cmd.len  = __len8(0);
 754         cmd.fcs  = __fcs2((u8 *) &cmd);
 755
 756         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 757 }
 758
 759 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 760 {
 761         struct rfcomm_hdr *hdr;
 762         struct rfcomm_mcc *mcc;
 763         u8 buf[16], *ptr = buf;
 764
 765         BT_DBG("%p cr %d type %d", s, cr, type);
 766
 767         hdr = (void *) ptr; ptr += sizeof(*hdr);
 768         hdr->addr = __addr(s->initiator, 0);
 769         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 770         hdr->len  = __len8(sizeof(*mcc) + 1);
 771
 772         mcc = (void *) ptr; ptr += sizeof(*mcc);
 773         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 774         mcc->len  = __len8(1);
 775
 776         /* Type that we didn't like */
 777         *ptr = __mcc_type(cr, type); ptr++;
 778
 779         *ptr = __fcs(buf); ptr++;
 780
 781         return rfcomm_send_frame(s, buf, ptr - buf);
 782 }
 783
 784 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 785 {
 786         struct rfcomm_hdr *hdr;
 787         struct rfcomm_mcc *mcc;
 788         struct rfcomm_pn  *pn;
 789         u8 buf[16], *ptr = buf;
 790
 791         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 792
 793         hdr = (void *) ptr; ptr += sizeof(*hdr);
 794         hdr->addr = __addr(s->initiator, 0);
 795         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 796         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 797
 798         mcc = (void *) ptr; ptr += sizeof(*mcc);
 799         mcc->type = __mcc_type(cr, RFCOMM_PN);
 800         mcc->len  = __len8(sizeof(*pn));
 801
 802         pn = (void *) ptr; ptr += sizeof(*pn);
 803         pn->dlci        = d->dlci;
 804         pn->priority    = d->priority;
 805         pn->ack_timer   = 0;
 806         pn->max_retrans = 0;
 807
 808         if (s->cfc) {
 809                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 810                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 811         } else {
 812                 pn->flow_ctrl = 0;
 813                 pn->credits   = 0;
 814         }
 815
 816         if (cr && channel_mtu >= 0)
 817                 pn->mtu = htobs(channel_mtu);
 818         else
 819                 pn->mtu = htobs(d->mtu);
 820
 821         *ptr = __fcs(buf); ptr++;
 822
 823         return rfcomm_send_frame(s, buf, ptr - buf);
 824 }
 825
 826 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 827                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 828                         u8 parity, u8 flow_ctrl_settings,
 829                         u8 xon_char, u8 xoff_char, u16 param_mask)
 830 {
 831         struct rfcomm_hdr *hdr;
 832         struct rfcomm_mcc *mcc;
 833         struct rfcomm_rpn *rpn;
 834         u8 buf[16], *ptr = buf;
 835
 836         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 837                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 838                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 839                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 840
 841         hdr = (void *) ptr; ptr += sizeof(*hdr);
 842         hdr->addr = __addr(s->initiator, 0);
 843         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 844         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 845
 846         mcc = (void *) ptr; ptr += sizeof(*mcc);
 847         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 848         mcc->len  = __len8(sizeof(*rpn));
 849
 850         rpn = (void *) ptr; ptr += sizeof(*rpn);
 851         rpn->dlci          = __addr(1, dlci);
 852         rpn->bit_rate      = bit_rate;
 853         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 854         rpn->flow_ctrl     = flow_ctrl_settings;
 855         rpn->xon_char      = xon_char;
 856         rpn->xoff_char     = xoff_char;
 857         rpn->param_mask    = cpu_to_le16(param_mask);
 858
 859         *ptr = __fcs(buf); ptr++;
 860
 861         return rfcomm_send_frame(s, buf, ptr - buf);
 862 }
 863
 864 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 865 {
 866         struct rfcomm_hdr *hdr;
 867         struct rfcomm_mcc *mcc;
 868         struct rfcomm_rls *rls;
 869         u8 buf[16], *ptr = buf;
 870
 871         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 872
 873         hdr = (void *) ptr; ptr += sizeof(*hdr);
 874         hdr->addr = __addr(s->initiator, 0);
 875         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 876         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 877
 878         mcc = (void *) ptr; ptr += sizeof(*mcc);
 879         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 880         mcc->len  = __len8(sizeof(*rls));
 881
 882         rls = (void *) ptr; ptr += sizeof(*rls);
 883         rls->dlci   = __addr(1, dlci);
 884         rls->status = status;
 885
 886         *ptr = __fcs(buf); ptr++;
 887
 888         return rfcomm_send_frame(s, buf, ptr - buf);
 889 }
 890
 891 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 892 {
 893         struct rfcomm_hdr *hdr;
 894         struct rfcomm_mcc *mcc;
 895         struct rfcomm_msc *msc;
 896         u8 buf[16], *ptr = buf;
 897
 898         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 899
 900         hdr = (void *) ptr; ptr += sizeof(*hdr);
 901         hdr->addr = __addr(s->initiator, 0);
 902         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 903         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 904
 905         mcc = (void *) ptr; ptr += sizeof(*mcc);
 906         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 907         mcc->len  = __len8(sizeof(*msc));
 908
 909         msc = (void *) ptr; ptr += sizeof(*msc);
 910         msc->dlci    = __addr(1, dlci);
 911         msc->v24_sig = v24_sig | 0x01;
 912
 913         *ptr = __fcs(buf); ptr++;
 914
 915         return rfcomm_send_frame(s, buf, ptr - buf);
 916 }
 917
 918 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 919 {
 920         struct rfcomm_hdr *hdr;
 921         struct rfcomm_mcc *mcc;
 922         u8 buf[16], *ptr = buf;
 923
 924         BT_DBG("%p cr %d", s, cr);
 925
 926         hdr = (void *) ptr; ptr += sizeof(*hdr);
 927         hdr->addr = __addr(s->initiator, 0);
 928         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 929         hdr->len  = __len8(sizeof(*mcc));
 930
 931         mcc = (void *) ptr; ptr += sizeof(*mcc);
 932         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
 933         mcc->len  = __len8(0);
 934
 935         *ptr = __fcs(buf); ptr++;
 936
 937         return rfcomm_send_frame(s, buf, ptr - buf);
 938 }
 939
 940 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
 941 {
 942         struct rfcomm_hdr *hdr;
 943         struct rfcomm_mcc *mcc;
 944         u8 buf[16], *ptr = buf;
 945
 946         BT_DBG("%p cr %d", s, cr);
 947
 948         hdr = (void *) ptr; ptr += sizeof(*hdr);
 949         hdr->addr = __addr(s->initiator, 0);
 950         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 951         hdr->len  = __len8(sizeof(*mcc));
 952
 953         mcc = (void *) ptr; ptr += sizeof(*mcc);
 954         mcc->type = __mcc_type(cr, RFCOMM_FCON);
 955         mcc->len  = __len8(0);
 956
 957         *ptr = __fcs(buf); ptr++;
 958
 959         return rfcomm_send_frame(s, buf, ptr - buf);
 960 }
 961
 962 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
 963 {
 964         struct socket *sock = s->sock;
 965         struct kvec iv[3];
 966         struct msghdr msg;
 967         unsigned char hdr[5], crc[1];
 968
 969         if (len > 125)
 970                 return -EINVAL;
 971
 972         BT_DBG("%p cr %d", s, cr);
 973
 974         hdr[0] = __addr(s->initiator, 0);
 975         hdr[1] = __ctrl(RFCOMM_UIH, 0);
 976         hdr[2] = 0x01 | ((len + 2) << 1);
 977         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
 978         hdr[4] = 0x01 | (len << 1);
 979
 980         crc[0] = __fcs(hdr);
 981
 982         iv[0].iov_base = hdr;
 983         iv[0].iov_len  = 5;
 984         iv[1].iov_base = pattern;
 985         iv[1].iov_len  = len;
 986         iv[2].iov_base = crc;
 987         iv[2].iov_len  = 1;
 988
 989         memset(&msg, 0, sizeof(msg));
 990
 991         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
 992 }
 993
 994 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
 995 {
 996         struct rfcomm_hdr *hdr;
 997         u8 buf[16], *ptr = buf;
 998
 999         BT_DBG("%p addr %d credits %d", s, addr, credits);
1000
1001         hdr = (void *) ptr; ptr += sizeof(*hdr);
1002         hdr->addr = addr;
1003         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1004         hdr->len  = __len8(0);
1005
1006         *ptr = credits; ptr++;
1007
1008         *ptr = __fcs(buf); ptr++;
1009
1010         return rfcomm_send_frame(s, buf, ptr - buf);
1011 }
1012
1013 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1014 {
1015         struct rfcomm_hdr *hdr;
1016         int len = skb->len;
1017         u8 *crc;
1018
1019         if (len > 127) {
1020                 hdr = (void *) skb_push(skb, 4);
1021                 put_unaligned(htobs(__len16(len)), (__le16 *) &hdr->len);
1022         } else {
1023                 hdr = (void *) skb_push(skb, 3);
1024                 hdr->len = __len8(len);
1025         }
1026         hdr->addr = addr;
1027         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1028
1029         crc = skb_put(skb, 1);
1030         *crc = __fcs((void *) hdr);
1031 }
1032
1033 /* ---- RFCOMM frame reception ---- */
1034 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1035 {
1036         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1037
1038         if (dlci) {
1039                 /* Data channel */
1040                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1041                 if (!d) {
1042                         rfcomm_send_dm(s, dlci);
1043                         return 0;
1044                 }
1045
1046                 switch (d->state) {
1047                 case BT_CONNECT:
1048                         rfcomm_dlc_clear_timer(d);
1049
1050                         rfcomm_dlc_lock(d);
1051                         d->state = BT_CONNECTED;
1052                         d->state_change(d, 0);
1053                         rfcomm_dlc_unlock(d);
1054
1055                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1056                         break;
1057
1058                 case BT_DISCONN:
1059                         d->state = BT_CLOSED;
1060                         __rfcomm_dlc_close(d, 0);
1061                         break;
1062                 }
1063         } else {
1064                 /* Control channel */
1065                 switch (s->state) {
1066                 case BT_CONNECT:
1067                         s->state = BT_CONNECTED;
1068                         rfcomm_process_connect(s);
1069                         break;
1070                 }
1071         }
1072         return 0;
1073 }
1074
1075 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1076 {
1077         int err = 0;
1078
1079         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1080
1081         if (dlci) {
1082                 /* Data DLC */
1083                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1084                 if (d) {
1085                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1086                                 err = ECONNREFUSED;
1087                         else
1088                                 err = ECONNRESET;
1089
1090                         d->state = BT_CLOSED;
1091                         __rfcomm_dlc_close(d, err);
1092                 }
1093         } else {
1094                 if (s->state == BT_CONNECT)
1095                         err = ECONNREFUSED;
1096                 else
1097                         err = ECONNRESET;
1098
1099                 s->state = BT_CLOSED;
1100                 rfcomm_session_close(s, err);
1101         }
1102         return 0;
1103 }
1104
1105 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1106 {
1107         int err = 0;
1108
1109         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1110
1111         if (dlci) {
1112                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1113                 if (d) {
1114                         rfcomm_send_ua(s, dlci);
1115
1116                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1117                                 err = ECONNREFUSED;
1118                         else
1119                                 err = ECONNRESET;
1120
1121                         d->state = BT_CLOSED;
1122                         __rfcomm_dlc_close(d, err);
1123                 } else
1124                         rfcomm_send_dm(s, dlci);
1125
1126         } else {
1127                 rfcomm_send_ua(s, 0);
1128
1129                 if (s->state == BT_CONNECT)
1130                         err = ECONNREFUSED;
1131                 else
1132                         err = ECONNRESET;
1133
1134                 s->state = BT_CLOSED;
1135                 rfcomm_session_close(s, err);
1136         }
1137
1138         return 0;
1139 }
1140
1141 static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
1142 {
1143         struct sock *sk = d->session->sock->sk;
1144
1145         if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
1146                 if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
1147                         return 1;
1148         } else if (d->link_mode & RFCOMM_LM_AUTH) {
1149                 if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
1150                         return 1;
1151         }
1152
1153         return 0;
1154 }
1155
1156 static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1157 {
1158         struct sock *sk = d->session->sock->sk;
1159
1160         BT_DBG("dlc %p", d);
1161
1162         rfcomm_send_ua(d->session, d->dlci);
1163
1164         rfcomm_dlc_lock(d);
1165         d->state = BT_CONNECTED;
1166         d->state_change(d, 0);
1167         rfcomm_dlc_unlock(d);
1168
1169         if (d->link_mode & RFCOMM_LM_MASTER)
1170                 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1171
1172         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1173 }
1174
1175 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1176 {
1177         struct rfcomm_dlc *d;
1178         u8 channel;
1179
1180         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1181
1182         if (!dlci) {
1183                 rfcomm_send_ua(s, 0);
1184
1185                 if (s->state == BT_OPEN) {
1186                         s->state = BT_CONNECTED;
1187                         rfcomm_process_connect(s);
1188                 }
1189                 return 0;
1190         }
1191
1192         /* Check if DLC exists */
1193         d = rfcomm_dlc_get(s, dlci);
1194         if (d) {
1195                 if (d->state == BT_OPEN) {
1196                         /* DLC was previously opened by PN request */
1197                         if (rfcomm_check_link_mode(d)) {
1198                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1199                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1200                                 return 0;
1201                         }
1202
1203                         rfcomm_dlc_accept(d);
1204                 }
1205                 return 0;
1206         }
1207
1208         /* Notify socket layer about incoming connection */
1209         channel = __srv_channel(dlci);
1210         if (rfcomm_connect_ind(s, channel, &d)) {
1211                 d->dlci = dlci;
1212                 d->addr = __addr(s->initiator, dlci);
1213                 rfcomm_dlc_link(s, d);
1214
1215                 if (rfcomm_check_link_mode(d)) {
1216                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1217                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1218                         return 0;
1219                 }
1220
1221                 rfcomm_dlc_accept(d);
1222         } else {
1223                 rfcomm_send_dm(s, dlci);
1224         }
1225
1226         return 0;
1227 }
1228
1229 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1230 {
1231         struct rfcomm_session *s = d->session;
1232
1233         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1234                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1235
1236         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1237                                                 pn->flow_ctrl == 0xe0) {
1238                 d->cfc = RFCOMM_CFC_ENABLED;
1239                 d->tx_credits = pn->credits;
1240         } else {
1241                 d->cfc = RFCOMM_CFC_DISABLED;
1242                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1243         }
1244
1245         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1246                 s->cfc = d->cfc;
1247
1248         d->priority = pn->priority;
1249
1250         d->mtu = btohs(pn->mtu);
1251
1252         if (cr && d->mtu > s->mtu)
1253                 d->mtu = s->mtu;
1254
1255         return 0;
1256 }
1257
1258 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1259 {
1260         struct rfcomm_pn *pn = (void *) skb->data;
1261         struct rfcomm_dlc *d;
1262         u8 dlci = pn->dlci;
1263
1264         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1265
1266         if (!dlci)
1267                 return 0;
1268
1269         d = rfcomm_dlc_get(s, dlci);
1270         if (d) {
1271                 if (cr) {
1272                         /* PN request */
1273                         rfcomm_apply_pn(d, cr, pn);
1274                         rfcomm_send_pn(s, 0, d);
1275                 } else {
1276                         /* PN response */
1277                         switch (d->state) {
1278                         case BT_CONFIG:
1279                                 rfcomm_apply_pn(d, cr, pn);
1280
1281                                 d->state = BT_CONNECT;
1282                                 rfcomm_send_sabm(s, d->dlci);
1283                                 break;
1284                         }
1285                 }
1286         } else {
1287                 u8 channel = __srv_channel(dlci);
1288
1289                 if (!cr)
1290                         return 0;
1291
1292                 /* PN request for non existing DLC.
1293                  * Assume incoming connection. */
1294                 if (rfcomm_connect_ind(s, channel, &d)) {
1295                         d->dlci = dlci;
1296                         d->addr = __addr(s->initiator, dlci);
1297                         rfcomm_dlc_link(s, d);
1298
1299                         rfcomm_apply_pn(d, cr, pn);
1300
1301                         d->state = BT_OPEN;
1302                         rfcomm_send_pn(s, 0, d);
1303                 } else {
1304                         rfcomm_send_dm(s, dlci);
1305                 }
1306         }
1307         return 0;
1308 }
1309
1310 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1311 {
1312         struct rfcomm_rpn *rpn = (void *) skb->data;
1313         u8 dlci = __get_dlci(rpn->dlci);
1314
1315         u8 bit_rate  = 0;
1316         u8 data_bits = 0;
1317         u8 stop_bits = 0;
1318         u8 parity    = 0;
1319         u8 flow_ctrl = 0;
1320         u8 xon_char  = 0;
1321         u8 xoff_char = 0;
1322         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1323
1324         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1325                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1326                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1327
1328         if (!cr)
1329                 return 0;
1330
1331         if (len == 1) {
1332                 /* This is a request, return default settings */
1333                 bit_rate  = RFCOMM_RPN_BR_115200;
1334                 data_bits = RFCOMM_RPN_DATA_8;
1335                 stop_bits = RFCOMM_RPN_STOP_1;
1336                 parity    = RFCOMM_RPN_PARITY_NONE;
1337                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1338                 xon_char  = RFCOMM_RPN_XON_CHAR;
1339                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1340                 goto rpn_out;
1341         }
1342
1343         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1344          * no parity, no flow control lines, normal XON/XOFF chars */
1345
1346         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1347                 bit_rate = rpn->bit_rate;
1348                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1349                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1350                         bit_rate = RFCOMM_RPN_BR_115200;
1351                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1352                 }
1353         }
1354
1355         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1356                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1357                 if (data_bits != RFCOMM_RPN_DATA_8) {
1358                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1359                         data_bits = RFCOMM_RPN_DATA_8;
1360                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1361                 }
1362         }
1363
1364         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1365                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1366                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1367                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1368                         stop_bits = RFCOMM_RPN_STOP_1;
1369                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1370                 }
1371         }
1372
1373         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1374                 parity = __get_rpn_parity(rpn->line_settings);
1375                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1376                         BT_DBG("RPN parity mismatch 0x%x", parity);
1377                         parity = RFCOMM_RPN_PARITY_NONE;
1378                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1379                 }
1380         }
1381
1382         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1383                 flow_ctrl = rpn->flow_ctrl;
1384                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1385                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1386                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1387                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1388                 }
1389         }
1390
1391         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1392                 xon_char = rpn->xon_char;
1393                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1394                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1395                         xon_char = RFCOMM_RPN_XON_CHAR;
1396                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1397                 }
1398         }
1399
1400         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1401                 xoff_char = rpn->xoff_char;
1402                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1403                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1404                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1405                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1406                 }
1407         }
1408
1409 rpn_out:
1410         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1411                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1412
1413         return 0;
1414 }
1415
1416 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1417 {
1418         struct rfcomm_rls *rls = (void *) skb->data;
1419         u8 dlci = __get_dlci(rls->dlci);
1420
1421         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1422
1423         if (!cr)
1424                 return 0;
1425
1426         /* We should probably do something with this information here. But
1427          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1428          * mandatory to recognise and respond to RLS */
1429
1430         rfcomm_send_rls(s, 0, dlci, rls->status);
1431
1432         return 0;
1433 }
1434
1435 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1436 {
1437         struct rfcomm_msc *msc = (void *) skb->data;
1438         struct rfcomm_dlc *d;
1439         u8 dlci = __get_dlci(msc->dlci);
1440
1441         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1442
1443         d = rfcomm_dlc_get(s, dlci);
1444         if (!d)
1445                 return 0;
1446
1447         if (cr) {
1448                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1449                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1450                 else
1451                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1452
1453                 rfcomm_dlc_lock(d);
1454                 if (d->modem_status)
1455                         d->modem_status(d, msc->v24_sig);
1456                 rfcomm_dlc_unlock(d);
1457
1458                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1459
1460                 d->mscex |= RFCOMM_MSCEX_RX;
1461         } else
1462                 d->mscex |= RFCOMM_MSCEX_TX;
1463
1464         return 0;
1465 }
1466
1467 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1468 {
1469         struct rfcomm_mcc *mcc = (void *) skb->data;
1470         u8 type, cr, len;
1471
1472         cr   = __test_cr(mcc->type);
1473         type = __get_mcc_type(mcc->type);
1474         len  = __get_mcc_len(mcc->len);
1475
1476         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1477
1478         skb_pull(skb, 2);
1479
1480         switch (type) {
1481         case RFCOMM_PN:
1482                 rfcomm_recv_pn(s, cr, skb);
1483                 break;
1484
1485         case RFCOMM_RPN:
1486                 rfcomm_recv_rpn(s, cr, len, skb);
1487                 break;
1488
1489         case RFCOMM_RLS:
1490                 rfcomm_recv_rls(s, cr, skb);
1491                 break;
1492
1493         case RFCOMM_MSC:
1494                 rfcomm_recv_msc(s, cr, skb);
1495                 break;
1496
1497         case RFCOMM_FCOFF:
1498                 if (cr) {
1499                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1500                         rfcomm_send_fcoff(s, 0);
1501                 }
1502                 break;
1503
1504         case RFCOMM_FCON:
1505                 if (cr) {
1506                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1507                         rfcomm_send_fcon(s, 0);
1508                 }
1509                 break;
1510
1511         case RFCOMM_TEST:
1512                 if (cr)
1513                         rfcomm_send_test(s, 0, skb->data, skb->len);
1514                 break;
1515
1516         case RFCOMM_NSC:
1517                 break;
1518
1519         default:
1520                 BT_ERR("Unknown control type 0x%02x", type);
1521                 rfcomm_send_nsc(s, cr, type);
1522                 break;
1523         }
1524         return 0;
1525 }
1526
1527 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1528 {
1529         struct rfcomm_dlc *d;
1530
1531         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1532
1533         d = rfcomm_dlc_get(s, dlci);
1534         if (!d) {
1535                 rfcomm_send_dm(s, dlci);
1536                 goto drop;
1537         }
1538
1539         if (pf && d->cfc) {
1540                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1541
1542                 d->tx_credits += credits;
1543                 if (d->tx_credits)
1544                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1545         }
1546
1547         if (skb->len && d->state == BT_CONNECTED) {
1548                 rfcomm_dlc_lock(d);
1549                 d->rx_credits--;
1550                 d->data_ready(d, skb);
1551                 rfcomm_dlc_unlock(d);
1552                 return 0;
1553         }
1554
1555 drop:
1556         kfree_skb(skb);
1557         return 0;
1558 }
1559
1560 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1561 {
1562         struct rfcomm_hdr *hdr = (void *) skb->data;
1563         u8 type, dlci, fcs;
1564
1565         dlci = __get_dlci(hdr->addr);
1566         type = __get_type(hdr->ctrl);
1567
1568         /* Trim FCS */
1569         skb->len--; skb->tail--;
1570         fcs = *(u8 *) skb->tail;
1571
1572         if (__check_fcs(skb->data, type, fcs)) {
1573                 BT_ERR("bad checksum in packet");
1574                 kfree_skb(skb);
1575                 return -EILSEQ;
1576         }
1577
1578         if (__test_ea(hdr->len))
1579                 skb_pull(skb, 3);
1580         else
1581                 skb_pull(skb, 4);
1582
1583         switch (type) {
1584         case RFCOMM_SABM:
1585                 if (__test_pf(hdr->ctrl))
1586                         rfcomm_recv_sabm(s, dlci);
1587                 break;
1588
1589         case RFCOMM_DISC:
1590                 if (__test_pf(hdr->ctrl))
1591                         rfcomm_recv_disc(s, dlci);
1592                 break;
1593
1594         case RFCOMM_UA:
1595                 if (__test_pf(hdr->ctrl))
1596                         rfcomm_recv_ua(s, dlci);
1597                 break;
1598
1599         case RFCOMM_DM:
1600                 rfcomm_recv_dm(s, dlci);
1601                 break;
1602
1603         case RFCOMM_UIH:
1604                 if (dlci)
1605                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1606
1607                 rfcomm_recv_mcc(s, skb);
1608                 break;
1609
1610         default:
1611                 BT_ERR("Unknown packet type 0x%02x\n", type);
1612                 break;
1613         }
1614         kfree_skb(skb);
1615         return 0;
1616 }
1617
1618 /* ---- Connection and data processing ---- */
1619
1620 static void rfcomm_process_connect(struct rfcomm_session *s)
1621 {
1622         struct rfcomm_dlc *d;
1623         struct list_head *p, *n;
1624
1625         BT_DBG("session %p state %ld", s, s->state);
1626
1627         list_for_each_safe(p, n, &s->dlcs) {
1628                 d = list_entry(p, struct rfcomm_dlc, list);
1629                 if (d->state == BT_CONFIG) {
1630                         d->mtu = s->mtu;
1631                         rfcomm_send_pn(s, 1, d);
1632                 }
1633         }
1634 }
1635
1636 /* Send data queued for the DLC.
1637  * Return number of frames left in the queue.
1638  */
1639 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1640 {
1641         struct sk_buff *skb;
1642         int err;
1643
1644         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1645                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1646
1647         /* Send pending MSC */
1648         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1649                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1650
1651         if (d->cfc) {
1652                 /* CFC enabled.
1653                  * Give them some credits */
1654                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1655                                 d->rx_credits <= (d->cfc >> 2)) {
1656                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1657                         d->rx_credits = d->cfc;
1658                 }
1659         } else {
1660                 /* CFC disabled.
1661                  * Give ourselves some credits */
1662                 d->tx_credits = 5;
1663         }
1664
1665         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1666                 return skb_queue_len(&d->tx_queue);
1667
1668         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1669                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1670                 if (err < 0) {
1671                         skb_queue_head(&d->tx_queue, skb);
1672                         break;
1673                 }
1674                 kfree_skb(skb);
1675                 d->tx_credits--;
1676         }
1677
1678         if (d->cfc && !d->tx_credits) {
1679                 /* We're out of TX credits.
1680                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1681                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1682         }
1683
1684         return skb_queue_len(&d->tx_queue);
1685 }
1686
1687 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1688 {
1689         struct rfcomm_dlc *d;
1690         struct list_head *p, *n;
1691
1692         BT_DBG("session %p state %ld", s, s->state);
1693
1694         list_for_each_safe(p, n, &s->dlcs) {
1695                 d = list_entry(p, struct rfcomm_dlc, list);
1696
1697                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1698                         __rfcomm_dlc_close(d, ETIMEDOUT);
1699                         continue;
1700                 }
1701
1702                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1703                         rfcomm_dlc_clear_timer(d);
1704                         rfcomm_dlc_accept(d);
1705                         if (d->link_mode & RFCOMM_LM_SECURE) {
1706                                 struct sock *sk = s->sock->sk;
1707                                 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
1708                         }
1709                         continue;
1710                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1711                         rfcomm_dlc_clear_timer(d);
1712                         rfcomm_send_dm(s, d->dlci);
1713                         __rfcomm_dlc_close(d, ECONNREFUSED);
1714                         continue;
1715                 }
1716
1717                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1718                         continue;
1719
1720                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1721                                 d->mscex == RFCOMM_MSCEX_OK)
1722                         rfcomm_process_tx(d);
1723         }
1724 }
1725
1726 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1727 {
1728         struct socket *sock = s->sock;
1729         struct sock *sk = sock->sk;
1730         struct sk_buff *skb;
1731
1732         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1733
1734         /* Get data directly from socket receive queue without copying it. */
1735         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1736                 skb_orphan(skb);
1737                 rfcomm_recv_frame(s, skb);
1738         }
1739
1740         if (sk->sk_state == BT_CLOSED) {
1741                 if (!s->initiator)
1742                         rfcomm_session_put(s);
1743
1744                 rfcomm_session_close(s, sk->sk_err);
1745         }
1746 }
1747
1748 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1749 {
1750         struct socket *sock = s->sock, *nsock;
1751         int err;
1752
1753         /* Fast check for a new connection.
1754          * Avoids unnesesary socket allocations. */
1755         if (list_empty(&bt_sk(sock->sk)->accept_q))
1756                 return;
1757
1758         BT_DBG("session %p", s);
1759
1760         if (sock_create_lite(PF_BLUETOOTH, sock->type, BTPROTO_L2CAP, &nsock))
1761                 return;
1762
1763         nsock->ops  = sock->ops;
1764
1765         __module_get(nsock->ops->owner);
1766
1767         err = sock->ops->accept(sock, nsock, O_NONBLOCK);
1768         if (err < 0) {
1769                 sock_release(nsock);
1770                 return;
1771         }
1772
1773         /* Set our callbacks */
1774         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1775         nsock->sk->sk_state_change = rfcomm_l2state_change;
1776
1777         s = rfcomm_session_add(nsock, BT_OPEN);
1778         if (s) {
1779                 rfcomm_session_hold(s);
1780
1781                 /* We should adjust MTU on incoming sessions.
1782                  * L2CAP MTU minus UIH header and FCS. */
1783                 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1784
1785                 rfcomm_schedule(RFCOMM_SCHED_RX);
1786         } else
1787                 sock_release(nsock);
1788 }
1789
1790 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1791 {
1792         struct sock *sk = s->sock->sk;
1793
1794         BT_DBG("%p state %ld", s, s->state);
1795
1796         switch(sk->sk_state) {
1797         case BT_CONNECTED:
1798                 s->state = BT_CONNECT;
1799
1800                 /* We can adjust MTU on outgoing sessions.
1801                  * L2CAP MTU minus UIH header and FCS. */
1802                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1803
1804                 rfcomm_send_sabm(s, 0);
1805                 break;
1806
1807         case BT_CLOSED:
1808                 s->state = BT_CLOSED;
1809                 rfcomm_session_close(s, sk->sk_err);
1810                 break;
1811         }
1812 }
1813
1814 static inline void rfcomm_process_sessions(void)
1815 {
1816         struct list_head *p, *n;
1817
1818         rfcomm_lock();
1819
1820         list_for_each_safe(p, n, &session_list) {
1821                 struct rfcomm_session *s;
1822                 s = list_entry(p, struct rfcomm_session, list);
1823
1824                 if (s->state == BT_LISTEN) {
1825                         rfcomm_accept_connection(s);
1826                         continue;
1827                 }
1828
1829                 rfcomm_session_hold(s);
1830
1831                 switch (s->state) {
1832                 case BT_BOUND:
1833                         rfcomm_check_connection(s);
1834                         break;
1835
1836                 default:
1837                         rfcomm_process_rx(s);
1838                         break;
1839                 }
1840
1841                 rfcomm_process_dlcs(s);
1842
1843                 rfcomm_session_put(s);
1844         }
1845
1846         rfcomm_unlock();
1847 }
1848
1849 static void rfcomm_worker(void)
1850 {
1851         BT_DBG("");
1852
1853         while (!atomic_read(&terminate)) {
1854                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1855                         /* No pending events. Let's sleep.
1856                          * Incoming connections and data will wake us up. */
1857                         set_current_state(TASK_INTERRUPTIBLE);
1858                         schedule();
1859                 }
1860
1861                 /* Process stuff */
1862                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1863                 rfcomm_process_sessions();
1864         }
1865         set_current_state(TASK_RUNNING);
1866         return;
1867 }
1868
1869 static int rfcomm_add_listener(bdaddr_t *ba)
1870 {
1871         struct sockaddr_l2 addr;
1872         struct socket *sock;
1873         struct sock *sk;
1874         struct rfcomm_session *s;
1875         int    err = 0;
1876
1877         /* Create socket */
1878         err = rfcomm_l2sock_create(&sock);
1879         if (err < 0) {
1880                 BT_ERR("Create socket failed %d", err);
1881                 return err;
1882         }
1883
1884         /* Bind socket */
1885         bacpy(&addr.l2_bdaddr, ba);
1886         addr.l2_family = AF_BLUETOOTH;
1887         addr.l2_psm    = htobs(RFCOMM_PSM);
1888         err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1889         if (err < 0) {
1890                 BT_ERR("Bind failed %d", err);
1891                 goto failed;
1892         }
1893
1894         /* Set L2CAP options */
1895         sk = sock->sk;
1896         lock_sock(sk);
1897         l2cap_pi(sk)->imtu = l2cap_mtu;
1898         release_sock(sk);
1899
1900         /* Start listening on the socket */
1901         err = sock->ops->listen(sock, 10);
1902         if (err) {
1903                 BT_ERR("Listen failed %d", err);
1904                 goto failed;
1905         }
1906
1907         /* Add listening session */
1908         s = rfcomm_session_add(sock, BT_LISTEN);
1909         if (!s)
1910                 goto failed;
1911
1912         rfcomm_session_hold(s);
1913         return 0;
1914 failed:
1915         sock_release(sock);
1916         return err;
1917 }
1918
1919 static void rfcomm_kill_listener(void)
1920 {
1921         struct rfcomm_session *s;
1922         struct list_head *p, *n;
1923
1924         BT_DBG("");
1925
1926         list_for_each_safe(p, n, &session_list) {
1927                 s = list_entry(p, struct rfcomm_session, list);
1928                 rfcomm_session_del(s);
1929         }
1930 }
1931
1932 static int rfcomm_run(void *unused)
1933 {
1934         rfcomm_thread = current;
1935
1936         atomic_inc(&running);
1937
1938         daemonize("krfcommd");
1939         set_user_nice(current, -10);
1940         current->flags |= PF_NOFREEZE;
1941
1942         BT_DBG("");
1943
1944         rfcomm_add_listener(BDADDR_ANY);
1945
1946         rfcomm_worker();
1947
1948         rfcomm_kill_listener();
1949
1950         atomic_dec(&running);
1951         return 0;
1952 }
1953
1954 static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
1955 {
1956         struct rfcomm_session *s;
1957         struct rfcomm_dlc *d;
1958         struct list_head *p, *n;
1959
1960         BT_DBG("conn %p status 0x%02x", conn, status);
1961
1962         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1963         if (!s)
1964                 return;
1965
1966         rfcomm_session_hold(s);
1967
1968         list_for_each_safe(p, n, &s->dlcs) {
1969                 d = list_entry(p, struct rfcomm_dlc, list);
1970
1971                 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE))
1972                         continue;
1973
1974                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1975                         continue;
1976
1977                 if (!status)
1978                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1979                 else
1980                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1981         }
1982
1983         rfcomm_session_put(s);
1984
1985         rfcomm_schedule(RFCOMM_SCHED_AUTH);
1986 }
1987
1988 static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1989 {
1990         struct rfcomm_session *s;
1991         struct rfcomm_dlc *d;
1992         struct list_head *p, *n;
1993
1994         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
1995
1996         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1997         if (!s)
1998                 return;
1999
2000         rfcomm_session_hold(s);
2001
2002         list_for_each_safe(p, n, &s->dlcs) {
2003                 d = list_entry(p, struct rfcomm_dlc, list);
2004
2005                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2006                         continue;
2007
2008                 if (!status && encrypt)
2009                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2010                 else
2011                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2012         }
2013
2014         rfcomm_session_put(s);
2015
2016         rfcomm_schedule(RFCOMM_SCHED_AUTH);
2017 }
2018
2019 static struct hci_cb rfcomm_cb = {
2020         .name           = "RFCOMM",
2021         .auth_cfm       = rfcomm_auth_cfm,
2022         .encrypt_cfm    = rfcomm_encrypt_cfm
2023 };
2024
2025 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2026 {
2027         struct rfcomm_session *s;
2028         struct list_head *pp, *p;
2029         char *str = buf;
2030
2031         rfcomm_lock();
2032
2033         list_for_each(p, &session_list) {
2034                 s = list_entry(p, struct rfcomm_session, list);
2035                 list_for_each(pp, &s->dlcs) {
2036                         struct sock *sk = s->sock->sk;
2037                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2038
2039                         str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2040                                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2041                                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2042                 }
2043         }
2044
2045         rfcomm_unlock();
2046
2047         return (str - buf);
2048 }
2049
2050 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2051
2052 /* ---- Initialization ---- */
2053 static int __init rfcomm_init(void)
2054 {
2055         l2cap_load();
2056
2057         hci_register_cb(&rfcomm_cb);
2058
2059         kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
2060
2061         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2062                 BT_ERR("Failed to create RFCOMM info file");
2063
2064         rfcomm_init_sockets();
2065
2066 #ifdef CONFIG_BT_RFCOMM_TTY
2067         rfcomm_init_ttys();
2068 #endif
2069
2070         BT_INFO("RFCOMM ver %s", VERSION);
2071
2072         return 0;
2073 }
2074
2075 static void __exit rfcomm_exit(void)
2076 {
2077         class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2078
2079         hci_unregister_cb(&rfcomm_cb);
2080
2081         /* Terminate working thread.
2082          * ie. Set terminate flag and wake it up */
2083         atomic_inc(&terminate);
2084         rfcomm_schedule(RFCOMM_SCHED_STATE);
2085
2086         /* Wait until thread is running */
2087         while (atomic_read(&running))
2088                 schedule();
2089
2090 #ifdef CONFIG_BT_RFCOMM_TTY
2091         rfcomm_cleanup_ttys();
2092 #endif
2093
2094         rfcomm_cleanup_sockets();
2095 }
2096
2097 module_init(rfcomm_init);
2098 module_exit(rfcomm_exit);
2099
2100 module_param(disable_cfc, bool, 0644);
2101 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2102
2103 module_param(channel_mtu, int, 0644);
2104 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2105
2106 module_param(l2cap_mtu, uint, 0644);
2107 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2108
2109 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
2110 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2111 MODULE_VERSION(VERSION);
2112 MODULE_LICENSE("GPL");
2113 MODULE_ALIAS("bt-proto-3");