net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  *
  27  * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
  28  */
  29
  30 #include <linux/module.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/signal.h>
  35 #include <linux/init.h>
  36 #include <linux/wait.h>
  37 #include <linux/device.h>
  38 #include <linux/net.h>
  39 #include <linux/mutex.h>
  40 #include <linux/kthread.h>
  41
  42 #include <net/sock.h>
  43 #include <asm/uaccess.h>
  44 #include <asm/unaligned.h>
  45
  46 #include <net/bluetooth/bluetooth.h>
  47 #include <net/bluetooth/hci_core.h>
  48 #include <net/bluetooth/l2cap.h>
  49 #include <net/bluetooth/rfcomm.h>
  50
  51 #ifndef CONFIG_BT_RFCOMM_DEBUG
  52 #undef  BT_DBG
  53 #define BT_DBG(D...)
  54 #endif
  55
  56 #define VERSION "1.9"
  57
  58 static int disable_cfc = 0;
  59 static int channel_mtu = -1;
  60 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  61
  62 static struct task_struct *rfcomm_thread;
  63
  64 static DEFINE_MUTEX(rfcomm_mutex);
  65 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  66 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  67
  68 static unsigned long rfcomm_event;
  69
  70 static LIST_HEAD(session_list);
  71
  72 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  73 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  74 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  75 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  76 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  77 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  78 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  79 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  80 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  81 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  82
  83 static void rfcomm_process_connect(struct rfcomm_session *s);
  84
  85 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
  86 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  87 static void rfcomm_session_del(struct rfcomm_session *s);
  88
  89 /* ---- RFCOMM frame parsing macros ---- */
  90 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  91 #define __get_channel(b)  ((b & 0xf8) >> 3)
  92 #define __get_dir(b)      ((b & 0x04) >> 2)
  93 #define __get_type(b)     ((b & 0xef))
  94
  95 #define __test_ea(b)      ((b & 0x01))
  96 #define __test_cr(b)      ((b & 0x02))
  97 #define __test_pf(b)      ((b & 0x10))
  98
  99 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 100 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
 101 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
 102 #define __srv_channel(dlci)    (dlci >> 1)
 103 #define __dir(dlci)            (dlci & 0x01)
 104
 105 #define __len8(len)       (((len) << 1) | 1)
 106 #define __len16(len)      ((len) << 1)
 107
 108 /* MCC macros */
 109 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 110 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 111 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 112
 113 /* RPN macros */
 114 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 115 #define __get_rpn_data_bits(line) ((line) & 0x3)
 116 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 117 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 118
 119 static inline void rfcomm_schedule(uint event)
 120 {
 121         if (!rfcomm_thread)
 122                 return;
 123         //set_bit(event, &rfcomm_event);
 124         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
 125         wake_up_process(rfcomm_thread);
 126 }
 127
 128 static inline void rfcomm_session_put(struct rfcomm_session *s)
 129 {
 130         if (atomic_dec_and_test(&s->refcnt))
 131                 rfcomm_session_del(s);
 132 }
 133
 134 /* ---- RFCOMM FCS computation ---- */
 135
 136 /* reversed, 8-bit, poly=0x07 */
 137 static unsigned char rfcomm_crc_table[256] = {
 138         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 139         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 140         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 141         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 142
 143         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 144         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 145         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 146         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 147
 148         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 149         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 150         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 151         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 152
 153         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 154         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 155         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 156         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 157
 158         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 159         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 160         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 161         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 162
 163         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 164         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 165         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 166         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 167
 168         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 169         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 170         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 171         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 172
 173         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 174         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 175         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 176         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 177 };
 178
 179 /* CRC on 2 bytes */
 180 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 181
 182 /* FCS on 2 bytes */
 183 static inline u8 __fcs(u8 *data)
 184 {
 185         return (0xff - __crc(data));
 186 }
 187
 188 /* FCS on 3 bytes */
 189 static inline u8 __fcs2(u8 *data)
 190 {
 191         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 192 }
 193
 194 /* Check FCS */
 195 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 196 {
 197         u8 f = __crc(data);
 198
 199         if (type != RFCOMM_UIH)
 200                 f = rfcomm_crc_table[f ^ data[2]];
 201
 202         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 203 }
 204
 205 /* ---- L2CAP callbacks ---- */
 206 static void rfcomm_l2state_change(struct sock *sk)
 207 {
 208         BT_DBG("%p state %d", sk, sk->sk_state);
 209         rfcomm_schedule(RFCOMM_SCHED_STATE);
 210 }
 211
 212 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 213 {
 214         BT_DBG("%p bytes %d", sk, bytes);
 215         rfcomm_schedule(RFCOMM_SCHED_RX);
 216 }
 217
 218 static int rfcomm_l2sock_create(struct socket **sock)
 219 {
 220         int err;
 221
 222         BT_DBG("");
 223
 224         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 225         if (!err) {
 226                 struct sock *sk = (*sock)->sk;
 227                 sk->sk_data_ready   = rfcomm_l2data_ready;
 228                 sk->sk_state_change = rfcomm_l2state_change;
 229         }
 230         return err;
 231 }
 232
 233 static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
 234 {
 235         struct sock *sk = d->session->sock->sk;
 236
 237         if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
 238                 if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
 239                         return 1;
 240         } else if (d->link_mode & RFCOMM_LM_AUTH) {
 241                 if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
 242                         return 1;
 243         }
 244
 245         return 0;
 246 }
 247
 248 /* ---- RFCOMM DLCs ---- */
 249 static void rfcomm_dlc_timeout(unsigned long arg)
 250 {
 251         struct rfcomm_dlc *d = (void *) arg;
 252
 253         BT_DBG("dlc %p state %ld", d, d->state);
 254
 255         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 256         rfcomm_dlc_put(d);
 257         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 258 }
 259
 260 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 261 {
 262         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 263
 264         if (!mod_timer(&d->timer, jiffies + timeout))
 265                 rfcomm_dlc_hold(d);
 266 }
 267
 268 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 269 {
 270         BT_DBG("dlc %p state %ld", d, d->state);
 271
 272         if (timer_pending(&d->timer) && del_timer(&d->timer))
 273                 rfcomm_dlc_put(d);
 274 }
 275
 276 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 277 {
 278         BT_DBG("%p", d);
 279
 280         d->state      = BT_OPEN;
 281         d->flags      = 0;
 282         d->mscex      = 0;
 283         d->mtu        = RFCOMM_DEFAULT_MTU;
 284         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 285
 286         d->cfc        = RFCOMM_CFC_DISABLED;
 287         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 288 }
 289
 290 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 291 {
 292         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 293
 294         if (!d)
 295                 return NULL;
 296
 297         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 298
 299         skb_queue_head_init(&d->tx_queue);
 300         spin_lock_init(&d->lock);
 301         atomic_set(&d->refcnt, 1);
 302
 303         rfcomm_dlc_clear_state(d);
 304
 305         BT_DBG("%p", d);
 306
 307         return d;
 308 }
 309
 310 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 311 {
 312         BT_DBG("%p", d);
 313
 314         skb_queue_purge(&d->tx_queue);
 315         kfree(d);
 316 }
 317
 318 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 319 {
 320         BT_DBG("dlc %p session %p", d, s);
 321
 322         rfcomm_session_hold(s);
 323
 324         rfcomm_dlc_hold(d);
 325         list_add(&d->list, &s->dlcs);
 326         d->session = s;
 327 }
 328
 329 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 330 {
 331         struct rfcomm_session *s = d->session;
 332
 333         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 334
 335         list_del(&d->list);
 336         d->session = NULL;
 337         rfcomm_dlc_put(d);
 338
 339         rfcomm_session_put(s);
 340 }
 341
 342 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 343 {
 344         struct rfcomm_dlc *d;
 345         struct list_head *p;
 346
 347         list_for_each(p, &s->dlcs) {
 348                 d = list_entry(p, struct rfcomm_dlc, list);
 349                 if (d->dlci == dlci)
 350                         return d;
 351         }
 352         return NULL;
 353 }
 354
 355 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 356 {
 357         struct rfcomm_session *s;
 358         int err = 0;
 359         u8 dlci;
 360
 361         BT_DBG("dlc %p state %ld %s %s channel %d",
 362                         d, d->state, batostr(src), batostr(dst), channel);
 363
 364         if (channel < 1 || channel > 30)
 365                 return -EINVAL;
 366
 367         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 368                 return 0;
 369
 370         s = rfcomm_session_get(src, dst);
 371         if (!s) {
 372                 s = rfcomm_session_create(src, dst, &err);
 373                 if (!s)
 374                         return err;
 375         }
 376
 377         dlci = __dlci(!s->initiator, channel);
 378
 379         /* Check if DLCI already exists */
 380         if (rfcomm_dlc_get(s, dlci))
 381                 return -EBUSY;
 382
 383         rfcomm_dlc_clear_state(d);
 384
 385         d->dlci     = dlci;
 386         d->addr     = __addr(s->initiator, dlci);
 387         d->priority = 7;
 388
 389         d->state = BT_CONFIG;
 390         rfcomm_dlc_link(s, d);
 391
 392         d->out = 1;
 393
 394         d->mtu = s->mtu;
 395         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 396
 397         if (s->state == BT_CONNECTED) {
 398                 if (rfcomm_check_link_mode(d))
 399                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 400                 else
 401                         rfcomm_send_pn(s, 1, d);
 402         }
 403
 404         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 405
 406         return 0;
 407 }
 408
 409 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 410 {
 411         int r;
 412
 413         rfcomm_lock();
 414
 415         r = __rfcomm_dlc_open(d, src, dst, channel);
 416
 417         rfcomm_unlock();
 418         return r;
 419 }
 420
 421 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 422 {
 423         struct rfcomm_session *s = d->session;
 424         if (!s)
 425                 return 0;
 426
 427         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 428                         d, d->state, d->dlci, err, s);
 429
 430         switch (d->state) {
 431         case BT_CONNECTED:
 432         case BT_CONFIG:
 433         case BT_CONNECT:
 434                 d->state = BT_DISCONN;
 435                 if (skb_queue_empty(&d->tx_queue)) {
 436                         rfcomm_send_disc(s, d->dlci);
 437                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 438                 } else {
 439                         rfcomm_queue_disc(d);
 440                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 441                 }
 442                 break;
 443
 444         default:
 445                 rfcomm_dlc_clear_timer(d);
 446
 447                 rfcomm_dlc_lock(d);
 448                 d->state = BT_CLOSED;
 449                 d->state_change(d, err);
 450                 rfcomm_dlc_unlock(d);
 451
 452                 skb_queue_purge(&d->tx_queue);
 453                 rfcomm_dlc_unlink(d);
 454         }
 455
 456         return 0;
 457 }
 458
 459 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 460 {
 461         int r;
 462
 463         rfcomm_lock();
 464
 465         r = __rfcomm_dlc_close(d, err);
 466
 467         rfcomm_unlock();
 468         return r;
 469 }
 470
 471 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 472 {
 473         int len = skb->len;
 474
 475         if (d->state != BT_CONNECTED)
 476                 return -ENOTCONN;
 477
 478         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 479
 480         if (len > d->mtu)
 481                 return -EINVAL;
 482
 483         rfcomm_make_uih(skb, d->addr);
 484         skb_queue_tail(&d->tx_queue, skb);
 485
 486         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 487                 rfcomm_schedule(RFCOMM_SCHED_TX);
 488         return len;
 489 }
 490
 491 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 492 {
 493         BT_DBG("dlc %p state %ld", d, d->state);
 494
 495         if (!d->cfc) {
 496                 d->v24_sig |= RFCOMM_V24_FC;
 497                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 498         }
 499         rfcomm_schedule(RFCOMM_SCHED_TX);
 500 }
 501
 502 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 503 {
 504         BT_DBG("dlc %p state %ld", d, d->state);
 505
 506         if (!d->cfc) {
 507                 d->v24_sig &= ~RFCOMM_V24_FC;
 508                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 509         }
 510         rfcomm_schedule(RFCOMM_SCHED_TX);
 511 }
 512
 513 /*
 514    Set/get modem status functions use _local_ status i.e. what we report
 515    to the other side.
 516    Remote status is provided by dlc->modem_status() callback.
 517  */
 518 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 519 {
 520         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 521                         d, d->state, v24_sig);
 522
 523         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 524                 v24_sig |= RFCOMM_V24_FC;
 525         else
 526                 v24_sig &= ~RFCOMM_V24_FC;
 527
 528         d->v24_sig = v24_sig;
 529
 530         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 531                 rfcomm_schedule(RFCOMM_SCHED_TX);
 532
 533         return 0;
 534 }
 535
 536 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 537 {
 538         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 539                         d, d->state, d->v24_sig);
 540
 541         *v24_sig = d->v24_sig;
 542         return 0;
 543 }
 544
 545 /* ---- RFCOMM sessions ---- */
 546 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 547 {
 548         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 549
 550         if (!s)
 551                 return NULL;
 552
 553         BT_DBG("session %p sock %p", s, sock);
 554
 555         INIT_LIST_HEAD(&s->dlcs);
 556         s->state = state;
 557         s->sock  = sock;
 558
 559         s->mtu = RFCOMM_DEFAULT_MTU;
 560         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 561
 562         /* Do not increment module usage count for listening sessions.
 563          * Otherwise we won't be able to unload the module. */
 564         if (state != BT_LISTEN)
 565                 if (!try_module_get(THIS_MODULE)) {
 566                         kfree(s);
 567                         return NULL;
 568                 }
 569
 570         list_add(&s->list, &session_list);
 571
 572         return s;
 573 }
 574
 575 static void rfcomm_session_del(struct rfcomm_session *s)
 576 {
 577         int state = s->state;
 578
 579         BT_DBG("session %p state %ld", s, s->state);
 580
 581         list_del(&s->list);
 582
 583         if (state == BT_CONNECTED)
 584                 rfcomm_send_disc(s, 0);
 585
 586         sock_release(s->sock);
 587         kfree(s);
 588
 589         if (state != BT_LISTEN)
 590                 module_put(THIS_MODULE);
 591 }
 592
 593 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 594 {
 595         struct rfcomm_session *s;
 596         struct list_head *p, *n;
 597         struct bt_sock *sk;
 598         list_for_each_safe(p, n, &session_list) {
 599                 s = list_entry(p, struct rfcomm_session, list);
 600                 sk = bt_sk(s->sock->sk);
 601
 602                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 603                                 !bacmp(&sk->dst, dst))
 604                         return s;
 605         }
 606         return NULL;
 607 }
 608
 609 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 610 {
 611         struct rfcomm_dlc *d;
 612         struct list_head *p, *n;
 613
 614         BT_DBG("session %p state %ld err %d", s, s->state, err);
 615
 616         rfcomm_session_hold(s);
 617
 618         s->state = BT_CLOSED;
 619
 620         /* Close all dlcs */
 621         list_for_each_safe(p, n, &s->dlcs) {
 622                 d = list_entry(p, struct rfcomm_dlc, list);
 623                 d->state = BT_CLOSED;
 624                 __rfcomm_dlc_close(d, err);
 625         }
 626
 627         rfcomm_session_put(s);
 628 }
 629
 630 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 631 {
 632         struct rfcomm_session *s = NULL;
 633         struct sockaddr_l2 addr;
 634         struct socket *sock;
 635         struct sock *sk;
 636
 637         BT_DBG("%s %s", batostr(src), batostr(dst));
 638
 639         *err = rfcomm_l2sock_create(&sock);
 640         if (*err < 0)
 641                 return NULL;
 642
 643         bacpy(&addr.l2_bdaddr, src);
 644         addr.l2_family = AF_BLUETOOTH;
 645         addr.l2_psm    = 0;
 646         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 647         if (*err < 0)
 648                 goto failed;
 649
 650         /* Set L2CAP options */
 651         sk = sock->sk;
 652         lock_sock(sk);
 653         l2cap_pi(sk)->imtu = l2cap_mtu;
 654         release_sock(sk);
 655
 656         s = rfcomm_session_add(sock, BT_BOUND);
 657         if (!s) {
 658                 *err = -ENOMEM;
 659                 goto failed;
 660         }
 661
 662         s->initiator = 1;
 663
 664         bacpy(&addr.l2_bdaddr, dst);
 665         addr.l2_family = AF_BLUETOOTH;
 666         addr.l2_psm    = htobs(RFCOMM_PSM);
 667         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 668         if (*err == 0 || *err == -EINPROGRESS)
 669                 return s;
 670
 671         rfcomm_session_del(s);
 672         return NULL;
 673
 674 failed:
 675         sock_release(sock);
 676         return NULL;
 677 }
 678
 679 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 680 {
 681         struct sock *sk = s->sock->sk;
 682         if (src)
 683                 bacpy(src, &bt_sk(sk)->src);
 684         if (dst)
 685                 bacpy(dst, &bt_sk(sk)->dst);
 686 }
 687
 688 /* ---- RFCOMM frame sending ---- */
 689 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 690 {
 691         struct socket *sock = s->sock;
 692         struct kvec iv = { data, len };
 693         struct msghdr msg;
 694
 695         BT_DBG("session %p len %d", s, len);
 696
 697         memset(&msg, 0, sizeof(msg));
 698
 699         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 700 }
 701
 702 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 703 {
 704         struct rfcomm_cmd cmd;
 705
 706         BT_DBG("%p dlci %d", s, dlci);
 707
 708         cmd.addr = __addr(s->initiator, dlci);
 709         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 710         cmd.len  = __len8(0);
 711         cmd.fcs  = __fcs2((u8 *) &cmd);
 712
 713         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 714 }
 715
 716 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 717 {
 718         struct rfcomm_cmd cmd;
 719
 720         BT_DBG("%p dlci %d", s, dlci);
 721
 722         cmd.addr = __addr(!s->initiator, dlci);
 723         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 724         cmd.len  = __len8(0);
 725         cmd.fcs  = __fcs2((u8 *) &cmd);
 726
 727         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 728 }
 729
 730 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 731 {
 732         struct rfcomm_cmd cmd;
 733
 734         BT_DBG("%p dlci %d", s, dlci);
 735
 736         cmd.addr = __addr(s->initiator, dlci);
 737         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 738         cmd.len  = __len8(0);
 739         cmd.fcs  = __fcs2((u8 *) &cmd);
 740
 741         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 742 }
 743
 744 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 745 {
 746         struct rfcomm_cmd *cmd;
 747         struct sk_buff *skb;
 748
 749         BT_DBG("dlc %p dlci %d", d, d->dlci);
 750
 751         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 752         if (!skb)
 753                 return -ENOMEM;
 754
 755         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 756         cmd->addr = d->addr;
 757         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 758         cmd->len  = __len8(0);
 759         cmd->fcs  = __fcs2((u8 *) cmd);
 760
 761         skb_queue_tail(&d->tx_queue, skb);
 762         rfcomm_schedule(RFCOMM_SCHED_TX);
 763         return 0;
 764 }
 765
 766 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 767 {
 768         struct rfcomm_cmd cmd;
 769
 770         BT_DBG("%p dlci %d", s, dlci);
 771
 772         cmd.addr = __addr(!s->initiator, dlci);
 773         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 774         cmd.len  = __len8(0);
 775         cmd.fcs  = __fcs2((u8 *) &cmd);
 776
 777         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 778 }
 779
 780 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 781 {
 782         struct rfcomm_hdr *hdr;
 783         struct rfcomm_mcc *mcc;
 784         u8 buf[16], *ptr = buf;
 785
 786         BT_DBG("%p cr %d type %d", s, cr, type);
 787
 788         hdr = (void *) ptr; ptr += sizeof(*hdr);
 789         hdr->addr = __addr(s->initiator, 0);
 790         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 791         hdr->len  = __len8(sizeof(*mcc) + 1);
 792
 793         mcc = (void *) ptr; ptr += sizeof(*mcc);
 794         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 795         mcc->len  = __len8(1);
 796
 797         /* Type that we didn't like */
 798         *ptr = __mcc_type(cr, type); ptr++;
 799
 800         *ptr = __fcs(buf); ptr++;
 801
 802         return rfcomm_send_frame(s, buf, ptr - buf);
 803 }
 804
 805 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 806 {
 807         struct rfcomm_hdr *hdr;
 808         struct rfcomm_mcc *mcc;
 809         struct rfcomm_pn  *pn;
 810         u8 buf[16], *ptr = buf;
 811
 812         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 813
 814         hdr = (void *) ptr; ptr += sizeof(*hdr);
 815         hdr->addr = __addr(s->initiator, 0);
 816         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 817         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 818
 819         mcc = (void *) ptr; ptr += sizeof(*mcc);
 820         mcc->type = __mcc_type(cr, RFCOMM_PN);
 821         mcc->len  = __len8(sizeof(*pn));
 822
 823         pn = (void *) ptr; ptr += sizeof(*pn);
 824         pn->dlci        = d->dlci;
 825         pn->priority    = d->priority;
 826         pn->ack_timer   = 0;
 827         pn->max_retrans = 0;
 828
 829         if (s->cfc) {
 830                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 831                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 832         } else {
 833                 pn->flow_ctrl = 0;
 834                 pn->credits   = 0;
 835         }
 836
 837         if (cr && channel_mtu >= 0)
 838                 pn->mtu = htobs(channel_mtu);
 839         else
 840                 pn->mtu = htobs(d->mtu);
 841
 842         *ptr = __fcs(buf); ptr++;
 843
 844         return rfcomm_send_frame(s, buf, ptr - buf);
 845 }
 846
 847 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 848                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 849                         u8 parity, u8 flow_ctrl_settings,
 850                         u8 xon_char, u8 xoff_char, u16 param_mask)
 851 {
 852         struct rfcomm_hdr *hdr;
 853         struct rfcomm_mcc *mcc;
 854         struct rfcomm_rpn *rpn;
 855         u8 buf[16], *ptr = buf;
 856
 857         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 858                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 859                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 860                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 861
 862         hdr = (void *) ptr; ptr += sizeof(*hdr);
 863         hdr->addr = __addr(s->initiator, 0);
 864         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 865         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 866
 867         mcc = (void *) ptr; ptr += sizeof(*mcc);
 868         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 869         mcc->len  = __len8(sizeof(*rpn));
 870
 871         rpn = (void *) ptr; ptr += sizeof(*rpn);
 872         rpn->dlci          = __addr(1, dlci);
 873         rpn->bit_rate      = bit_rate;
 874         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 875         rpn->flow_ctrl     = flow_ctrl_settings;
 876         rpn->xon_char      = xon_char;
 877         rpn->xoff_char     = xoff_char;
 878         rpn->param_mask    = cpu_to_le16(param_mask);
 879
 880         *ptr = __fcs(buf); ptr++;
 881
 882         return rfcomm_send_frame(s, buf, ptr - buf);
 883 }
 884
 885 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 886 {
 887         struct rfcomm_hdr *hdr;
 888         struct rfcomm_mcc *mcc;
 889         struct rfcomm_rls *rls;
 890         u8 buf[16], *ptr = buf;
 891
 892         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 893
 894         hdr = (void *) ptr; ptr += sizeof(*hdr);
 895         hdr->addr = __addr(s->initiator, 0);
 896         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 897         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 898
 899         mcc = (void *) ptr; ptr += sizeof(*mcc);
 900         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 901         mcc->len  = __len8(sizeof(*rls));
 902
 903         rls = (void *) ptr; ptr += sizeof(*rls);
 904         rls->dlci   = __addr(1, dlci);
 905         rls->status = status;
 906
 907         *ptr = __fcs(buf); ptr++;
 908
 909         return rfcomm_send_frame(s, buf, ptr - buf);
 910 }
 911
 912 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 913 {
 914         struct rfcomm_hdr *hdr;
 915         struct rfcomm_mcc *mcc;
 916         struct rfcomm_msc *msc;
 917         u8 buf[16], *ptr = buf;
 918
 919         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 920
 921         hdr = (void *) ptr; ptr += sizeof(*hdr);
 922         hdr->addr = __addr(s->initiator, 0);
 923         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 924         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 925
 926         mcc = (void *) ptr; ptr += sizeof(*mcc);
 927         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 928         mcc->len  = __len8(sizeof(*msc));
 929
 930         msc = (void *) ptr; ptr += sizeof(*msc);
 931         msc->dlci    = __addr(1, dlci);
 932         msc->v24_sig = v24_sig | 0x01;
 933
 934         *ptr = __fcs(buf); ptr++;
 935
 936         return rfcomm_send_frame(s, buf, ptr - buf);
 937 }
 938
 939 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 940 {
 941         struct rfcomm_hdr *hdr;
 942         struct rfcomm_mcc *mcc;
 943         u8 buf[16], *ptr = buf;
 944
 945         BT_DBG("%p cr %d", s, cr);
 946
 947         hdr = (void *) ptr; ptr += sizeof(*hdr);
 948         hdr->addr = __addr(s->initiator, 0);
 949         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 950         hdr->len  = __len8(sizeof(*mcc));
 951
 952         mcc = (void *) ptr; ptr += sizeof(*mcc);
 953         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
 954         mcc->len  = __len8(0);
 955
 956         *ptr = __fcs(buf); ptr++;
 957
 958         return rfcomm_send_frame(s, buf, ptr - buf);
 959 }
 960
 961 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
 962 {
 963         struct rfcomm_hdr *hdr;
 964         struct rfcomm_mcc *mcc;
 965         u8 buf[16], *ptr = buf;
 966
 967         BT_DBG("%p cr %d", s, cr);
 968
 969         hdr = (void *) ptr; ptr += sizeof(*hdr);
 970         hdr->addr = __addr(s->initiator, 0);
 971         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 972         hdr->len  = __len8(sizeof(*mcc));
 973
 974         mcc = (void *) ptr; ptr += sizeof(*mcc);
 975         mcc->type = __mcc_type(cr, RFCOMM_FCON);
 976         mcc->len  = __len8(0);
 977
 978         *ptr = __fcs(buf); ptr++;
 979
 980         return rfcomm_send_frame(s, buf, ptr - buf);
 981 }
 982
 983 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
 984 {
 985         struct socket *sock = s->sock;
 986         struct kvec iv[3];
 987         struct msghdr msg;
 988         unsigned char hdr[5], crc[1];
 989
 990         if (len > 125)
 991                 return -EINVAL;
 992
 993         BT_DBG("%p cr %d", s, cr);
 994
 995         hdr[0] = __addr(s->initiator, 0);
 996         hdr[1] = __ctrl(RFCOMM_UIH, 0);
 997         hdr[2] = 0x01 | ((len + 2) << 1);
 998         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
 999         hdr[4] = 0x01 | (len << 1);
1000
1001         crc[0] = __fcs(hdr);
1002
1003         iv[0].iov_base = hdr;
1004         iv[0].iov_len  = 5;
1005         iv[1].iov_base = pattern;
1006         iv[1].iov_len  = len;
1007         iv[2].iov_base = crc;
1008         iv[2].iov_len  = 1;
1009
1010         memset(&msg, 0, sizeof(msg));
1011
1012         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1013 }
1014
1015 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1016 {
1017         struct rfcomm_hdr *hdr;
1018         u8 buf[16], *ptr = buf;
1019
1020         BT_DBG("%p addr %d credits %d", s, addr, credits);
1021
1022         hdr = (void *) ptr; ptr += sizeof(*hdr);
1023         hdr->addr = addr;
1024         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1025         hdr->len  = __len8(0);
1026
1027         *ptr = credits; ptr++;
1028
1029         *ptr = __fcs(buf); ptr++;
1030
1031         return rfcomm_send_frame(s, buf, ptr - buf);
1032 }
1033
1034 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1035 {
1036         struct rfcomm_hdr *hdr;
1037         int len = skb->len;
1038         u8 *crc;
1039
1040         if (len > 127) {
1041                 hdr = (void *) skb_push(skb, 4);
1042                 put_unaligned(htobs(__len16(len)), (__le16 *) &hdr->len);
1043         } else {
1044                 hdr = (void *) skb_push(skb, 3);
1045                 hdr->len = __len8(len);
1046         }
1047         hdr->addr = addr;
1048         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1049
1050         crc = skb_put(skb, 1);
1051         *crc = __fcs((void *) hdr);
1052 }
1053
1054 /* ---- RFCOMM frame reception ---- */
1055 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1056 {
1057         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1058
1059         if (dlci) {
1060                 /* Data channel */
1061                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1062                 if (!d) {
1063                         rfcomm_send_dm(s, dlci);
1064                         return 0;
1065                 }
1066
1067                 switch (d->state) {
1068                 case BT_CONNECT:
1069                         rfcomm_dlc_clear_timer(d);
1070
1071                         rfcomm_dlc_lock(d);
1072                         d->state = BT_CONNECTED;
1073                         d->state_change(d, 0);
1074                         rfcomm_dlc_unlock(d);
1075
1076                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1077                         break;
1078
1079                 case BT_DISCONN:
1080                         d->state = BT_CLOSED;
1081                         __rfcomm_dlc_close(d, 0);
1082
1083                         if (list_empty(&s->dlcs)) {
1084                                 s->state = BT_DISCONN;
1085                                 rfcomm_send_disc(s, 0);
1086                         }
1087
1088                         break;
1089                 }
1090         } else {
1091                 /* Control channel */
1092                 switch (s->state) {
1093                 case BT_CONNECT:
1094                         s->state = BT_CONNECTED;
1095                         rfcomm_process_connect(s);
1096                         break;
1097
1098                 case BT_DISCONN:
1099                         rfcomm_session_put(s);
1100                         break;
1101                 }
1102         }
1103         return 0;
1104 }
1105
1106 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1107 {
1108         int err = 0;
1109
1110         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1111
1112         if (dlci) {
1113                 /* Data DLC */
1114                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1115                 if (d) {
1116                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1117                                 err = ECONNREFUSED;
1118                         else
1119                                 err = ECONNRESET;
1120
1121                         d->state = BT_CLOSED;
1122                         __rfcomm_dlc_close(d, err);
1123                 }
1124         } else {
1125                 if (s->state == BT_CONNECT)
1126                         err = ECONNREFUSED;
1127                 else
1128                         err = ECONNRESET;
1129
1130                 s->state = BT_CLOSED;
1131                 rfcomm_session_close(s, err);
1132         }
1133         return 0;
1134 }
1135
1136 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1137 {
1138         int err = 0;
1139
1140         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1141
1142         if (dlci) {
1143                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1144                 if (d) {
1145                         rfcomm_send_ua(s, dlci);
1146
1147                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1148                                 err = ECONNREFUSED;
1149                         else
1150                                 err = ECONNRESET;
1151
1152                         d->state = BT_CLOSED;
1153                         __rfcomm_dlc_close(d, err);
1154                 } else
1155                         rfcomm_send_dm(s, dlci);
1156
1157         } else {
1158                 rfcomm_send_ua(s, 0);
1159
1160                 if (s->state == BT_CONNECT)
1161                         err = ECONNREFUSED;
1162                 else
1163                         err = ECONNRESET;
1164
1165                 s->state = BT_CLOSED;
1166                 rfcomm_session_close(s, err);
1167         }
1168
1169         return 0;
1170 }
1171
1172 static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1173 {
1174         struct sock *sk = d->session->sock->sk;
1175
1176         BT_DBG("dlc %p", d);
1177
1178         rfcomm_send_ua(d->session, d->dlci);
1179
1180         rfcomm_dlc_lock(d);
1181         d->state = BT_CONNECTED;
1182         d->state_change(d, 0);
1183         rfcomm_dlc_unlock(d);
1184
1185         if (d->link_mode & RFCOMM_LM_MASTER)
1186                 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1187
1188         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1189 }
1190
1191 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1192 {
1193         struct rfcomm_dlc *d;
1194         u8 channel;
1195
1196         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1197
1198         if (!dlci) {
1199                 rfcomm_send_ua(s, 0);
1200
1201                 if (s->state == BT_OPEN) {
1202                         s->state = BT_CONNECTED;
1203                         rfcomm_process_connect(s);
1204                 }
1205                 return 0;
1206         }
1207
1208         /* Check if DLC exists */
1209         d = rfcomm_dlc_get(s, dlci);
1210         if (d) {
1211                 if (d->state == BT_OPEN) {
1212                         /* DLC was previously opened by PN request */
1213                         if (rfcomm_check_link_mode(d)) {
1214                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1215                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1216                         } else
1217                                 rfcomm_dlc_accept(d);
1218                 }
1219                 return 0;
1220         }
1221
1222         /* Notify socket layer about incoming connection */
1223         channel = __srv_channel(dlci);
1224         if (rfcomm_connect_ind(s, channel, &d)) {
1225                 d->dlci = dlci;
1226                 d->addr = __addr(s->initiator, dlci);
1227                 rfcomm_dlc_link(s, d);
1228
1229                 if (rfcomm_check_link_mode(d)) {
1230                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1231                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1232                 } else
1233                         rfcomm_dlc_accept(d);
1234         } else {
1235                 rfcomm_send_dm(s, dlci);
1236         }
1237
1238         return 0;
1239 }
1240
1241 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1242 {
1243         struct rfcomm_session *s = d->session;
1244
1245         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1246                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1247
1248         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1249                                                 pn->flow_ctrl == 0xe0) {
1250                 d->cfc = RFCOMM_CFC_ENABLED;
1251                 d->tx_credits = pn->credits;
1252         } else {
1253                 d->cfc = RFCOMM_CFC_DISABLED;
1254                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1255         }
1256
1257         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1258                 s->cfc = d->cfc;
1259
1260         d->priority = pn->priority;
1261
1262         d->mtu = btohs(pn->mtu);
1263
1264         if (cr && d->mtu > s->mtu)
1265                 d->mtu = s->mtu;
1266
1267         return 0;
1268 }
1269
1270 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1271 {
1272         struct rfcomm_pn *pn = (void *) skb->data;
1273         struct rfcomm_dlc *d;
1274         u8 dlci = pn->dlci;
1275
1276         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1277
1278         if (!dlci)
1279                 return 0;
1280
1281         d = rfcomm_dlc_get(s, dlci);
1282         if (d) {
1283                 if (cr) {
1284                         /* PN request */
1285                         rfcomm_apply_pn(d, cr, pn);
1286                         rfcomm_send_pn(s, 0, d);
1287                 } else {
1288                         /* PN response */
1289                         switch (d->state) {
1290                         case BT_CONFIG:
1291                                 rfcomm_apply_pn(d, cr, pn);
1292
1293                                 d->state = BT_CONNECT;
1294                                 rfcomm_send_sabm(s, d->dlci);
1295                                 break;
1296                         }
1297                 }
1298         } else {
1299                 u8 channel = __srv_channel(dlci);
1300
1301                 if (!cr)
1302                         return 0;
1303
1304                 /* PN request for non existing DLC.
1305                  * Assume incoming connection. */
1306                 if (rfcomm_connect_ind(s, channel, &d)) {
1307                         d->dlci = dlci;
1308                         d->addr = __addr(s->initiator, dlci);
1309                         rfcomm_dlc_link(s, d);
1310
1311                         rfcomm_apply_pn(d, cr, pn);
1312
1313                         d->state = BT_OPEN;
1314                         rfcomm_send_pn(s, 0, d);
1315                 } else {
1316                         rfcomm_send_dm(s, dlci);
1317                 }
1318         }
1319         return 0;
1320 }
1321
1322 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1323 {
1324         struct rfcomm_rpn *rpn = (void *) skb->data;
1325         u8 dlci = __get_dlci(rpn->dlci);
1326
1327         u8 bit_rate  = 0;
1328         u8 data_bits = 0;
1329         u8 stop_bits = 0;
1330         u8 parity    = 0;
1331         u8 flow_ctrl = 0;
1332         u8 xon_char  = 0;
1333         u8 xoff_char = 0;
1334         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1335
1336         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1337                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1338                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1339
1340         if (!cr)
1341                 return 0;
1342
1343         if (len == 1) {
1344                 /* This is a request, return default settings */
1345                 bit_rate  = RFCOMM_RPN_BR_115200;
1346                 data_bits = RFCOMM_RPN_DATA_8;
1347                 stop_bits = RFCOMM_RPN_STOP_1;
1348                 parity    = RFCOMM_RPN_PARITY_NONE;
1349                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1350                 xon_char  = RFCOMM_RPN_XON_CHAR;
1351                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1352                 goto rpn_out;
1353         }
1354
1355         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1356          * no parity, no flow control lines, normal XON/XOFF chars */
1357
1358         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1359                 bit_rate = rpn->bit_rate;
1360                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1361                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1362                         bit_rate = RFCOMM_RPN_BR_115200;
1363                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1364                 }
1365         }
1366
1367         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1368                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1369                 if (data_bits != RFCOMM_RPN_DATA_8) {
1370                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1371                         data_bits = RFCOMM_RPN_DATA_8;
1372                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1373                 }
1374         }
1375
1376         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1377                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1378                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1379                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1380                         stop_bits = RFCOMM_RPN_STOP_1;
1381                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1382                 }
1383         }
1384
1385         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1386                 parity = __get_rpn_parity(rpn->line_settings);
1387                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1388                         BT_DBG("RPN parity mismatch 0x%x", parity);
1389                         parity = RFCOMM_RPN_PARITY_NONE;
1390                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1391                 }
1392         }
1393
1394         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1395                 flow_ctrl = rpn->flow_ctrl;
1396                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1397                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1398                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1399                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1400                 }
1401         }
1402
1403         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1404                 xon_char = rpn->xon_char;
1405                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1406                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1407                         xon_char = RFCOMM_RPN_XON_CHAR;
1408                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1409                 }
1410         }
1411
1412         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1413                 xoff_char = rpn->xoff_char;
1414                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1415                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1416                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1417                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1418                 }
1419         }
1420
1421 rpn_out:
1422         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1423                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1424
1425         return 0;
1426 }
1427
1428 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1429 {
1430         struct rfcomm_rls *rls = (void *) skb->data;
1431         u8 dlci = __get_dlci(rls->dlci);
1432
1433         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1434
1435         if (!cr)
1436                 return 0;
1437
1438         /* We should probably do something with this information here. But
1439          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1440          * mandatory to recognise and respond to RLS */
1441
1442         rfcomm_send_rls(s, 0, dlci, rls->status);
1443
1444         return 0;
1445 }
1446
1447 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1448 {
1449         struct rfcomm_msc *msc = (void *) skb->data;
1450         struct rfcomm_dlc *d;
1451         u8 dlci = __get_dlci(msc->dlci);
1452
1453         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1454
1455         d = rfcomm_dlc_get(s, dlci);
1456         if (!d)
1457                 return 0;
1458
1459         if (cr) {
1460                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1461                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1462                 else
1463                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1464
1465                 rfcomm_dlc_lock(d);
1466
1467                 d->remote_v24_sig = msc->v24_sig;
1468
1469                 if (d->modem_status)
1470                         d->modem_status(d, msc->v24_sig);
1471
1472                 rfcomm_dlc_unlock(d);
1473
1474                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1475
1476                 d->mscex |= RFCOMM_MSCEX_RX;
1477         } else
1478                 d->mscex |= RFCOMM_MSCEX_TX;
1479
1480         return 0;
1481 }
1482
1483 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1484 {
1485         struct rfcomm_mcc *mcc = (void *) skb->data;
1486         u8 type, cr, len;
1487
1488         cr   = __test_cr(mcc->type);
1489         type = __get_mcc_type(mcc->type);
1490         len  = __get_mcc_len(mcc->len);
1491
1492         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1493
1494         skb_pull(skb, 2);
1495
1496         switch (type) {
1497         case RFCOMM_PN:
1498                 rfcomm_recv_pn(s, cr, skb);
1499                 break;
1500
1501         case RFCOMM_RPN:
1502                 rfcomm_recv_rpn(s, cr, len, skb);
1503                 break;
1504
1505         case RFCOMM_RLS:
1506                 rfcomm_recv_rls(s, cr, skb);
1507                 break;
1508
1509         case RFCOMM_MSC:
1510                 rfcomm_recv_msc(s, cr, skb);
1511                 break;
1512
1513         case RFCOMM_FCOFF:
1514                 if (cr) {
1515                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1516                         rfcomm_send_fcoff(s, 0);
1517                 }
1518                 break;
1519
1520         case RFCOMM_FCON:
1521                 if (cr) {
1522                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1523                         rfcomm_send_fcon(s, 0);
1524                 }
1525                 break;
1526
1527         case RFCOMM_TEST:
1528                 if (cr)
1529                         rfcomm_send_test(s, 0, skb->data, skb->len);
1530                 break;
1531
1532         case RFCOMM_NSC:
1533                 break;
1534
1535         default:
1536                 BT_ERR("Unknown control type 0x%02x", type);
1537                 rfcomm_send_nsc(s, cr, type);
1538                 break;
1539         }
1540         return 0;
1541 }
1542
1543 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1544 {
1545         struct rfcomm_dlc *d;
1546
1547         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1548
1549         d = rfcomm_dlc_get(s, dlci);
1550         if (!d) {
1551                 rfcomm_send_dm(s, dlci);
1552                 goto drop;
1553         }
1554
1555         if (pf && d->cfc) {
1556                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1557
1558                 d->tx_credits += credits;
1559                 if (d->tx_credits)
1560                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1561         }
1562
1563         if (skb->len && d->state == BT_CONNECTED) {
1564                 rfcomm_dlc_lock(d);
1565                 d->rx_credits--;
1566                 d->data_ready(d, skb);
1567                 rfcomm_dlc_unlock(d);
1568                 return 0;
1569         }
1570
1571 drop:
1572         kfree_skb(skb);
1573         return 0;
1574 }
1575
1576 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1577 {
1578         struct rfcomm_hdr *hdr = (void *) skb->data;
1579         u8 type, dlci, fcs;
1580
1581         dlci = __get_dlci(hdr->addr);
1582         type = __get_type(hdr->ctrl);
1583
1584         /* Trim FCS */
1585         skb->len--; skb->tail--;
1586         fcs = *(u8 *)skb_tail_pointer(skb);
1587
1588         if (__check_fcs(skb->data, type, fcs)) {
1589                 BT_ERR("bad checksum in packet");
1590                 kfree_skb(skb);
1591                 return -EILSEQ;
1592         }
1593
1594         if (__test_ea(hdr->len))
1595                 skb_pull(skb, 3);
1596         else
1597                 skb_pull(skb, 4);
1598
1599         switch (type) {
1600         case RFCOMM_SABM:
1601                 if (__test_pf(hdr->ctrl))
1602                         rfcomm_recv_sabm(s, dlci);
1603                 break;
1604
1605         case RFCOMM_DISC:
1606                 if (__test_pf(hdr->ctrl))
1607                         rfcomm_recv_disc(s, dlci);
1608                 break;
1609
1610         case RFCOMM_UA:
1611                 if (__test_pf(hdr->ctrl))
1612                         rfcomm_recv_ua(s, dlci);
1613                 break;
1614
1615         case RFCOMM_DM:
1616                 rfcomm_recv_dm(s, dlci);
1617                 break;
1618
1619         case RFCOMM_UIH:
1620                 if (dlci)
1621                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1622
1623                 rfcomm_recv_mcc(s, skb);
1624                 break;
1625
1626         default:
1627                 BT_ERR("Unknown packet type 0x%02x\n", type);
1628                 break;
1629         }
1630         kfree_skb(skb);
1631         return 0;
1632 }
1633
1634 /* ---- Connection and data processing ---- */
1635
1636 static void rfcomm_process_connect(struct rfcomm_session *s)
1637 {
1638         struct rfcomm_dlc *d;
1639         struct list_head *p, *n;
1640
1641         BT_DBG("session %p state %ld", s, s->state);
1642
1643         list_for_each_safe(p, n, &s->dlcs) {
1644                 d = list_entry(p, struct rfcomm_dlc, list);
1645                 if (d->state == BT_CONFIG) {
1646                         d->mtu = s->mtu;
1647                         if (rfcomm_check_link_mode(d)) {
1648                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1649                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1650                         } else
1651                                 rfcomm_send_pn(s, 1, d);
1652                 }
1653         }
1654 }
1655
1656 /* Send data queued for the DLC.
1657  * Return number of frames left in the queue.
1658  */
1659 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1660 {
1661         struct sk_buff *skb;
1662         int err;
1663
1664         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1665                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1666
1667         /* Send pending MSC */
1668         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1669                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1670
1671         if (d->cfc) {
1672                 /* CFC enabled.
1673                  * Give them some credits */
1674                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1675                                 d->rx_credits <= (d->cfc >> 2)) {
1676                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1677                         d->rx_credits = d->cfc;
1678                 }
1679         } else {
1680                 /* CFC disabled.
1681                  * Give ourselves some credits */
1682                 d->tx_credits = 5;
1683         }
1684
1685         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1686                 return skb_queue_len(&d->tx_queue);
1687
1688         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1689                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1690                 if (err < 0) {
1691                         skb_queue_head(&d->tx_queue, skb);
1692                         break;
1693                 }
1694                 kfree_skb(skb);
1695                 d->tx_credits--;
1696         }
1697
1698         if (d->cfc && !d->tx_credits) {
1699                 /* We're out of TX credits.
1700                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1701                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1702         }
1703
1704         return skb_queue_len(&d->tx_queue);
1705 }
1706
1707 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1708 {
1709         struct rfcomm_dlc *d;
1710         struct list_head *p, *n;
1711
1712         BT_DBG("session %p state %ld", s, s->state);
1713
1714         list_for_each_safe(p, n, &s->dlcs) {
1715                 d = list_entry(p, struct rfcomm_dlc, list);
1716
1717                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1718                         __rfcomm_dlc_close(d, ETIMEDOUT);
1719                         continue;
1720                 }
1721
1722                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1723                         rfcomm_dlc_clear_timer(d);
1724                         if (d->out) {
1725                                 rfcomm_send_pn(s, 1, d);
1726                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1727                         } else
1728                                 rfcomm_dlc_accept(d);
1729                         if (d->link_mode & RFCOMM_LM_SECURE) {
1730                                 struct sock *sk = s->sock->sk;
1731                                 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
1732                         }
1733                         continue;
1734                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1735                         rfcomm_dlc_clear_timer(d);
1736                         if (!d->out)
1737                                 rfcomm_send_dm(s, d->dlci);
1738                         else
1739                                 d->state = BT_CLOSED;
1740                         __rfcomm_dlc_close(d, ECONNREFUSED);
1741                         continue;
1742                 }
1743
1744                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1745                         continue;
1746
1747                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1748                                                 d->mscex == RFCOMM_MSCEX_OK)
1749                         rfcomm_process_tx(d);
1750         }
1751 }
1752
1753 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1754 {
1755         struct socket *sock = s->sock;
1756         struct sock *sk = sock->sk;
1757         struct sk_buff *skb;
1758
1759         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1760
1761         /* Get data directly from socket receive queue without copying it. */
1762         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1763                 skb_orphan(skb);
1764                 rfcomm_recv_frame(s, skb);
1765         }
1766
1767         if (sk->sk_state == BT_CLOSED) {
1768                 if (!s->initiator)
1769                         rfcomm_session_put(s);
1770
1771                 rfcomm_session_close(s, sk->sk_err);
1772         }
1773 }
1774
1775 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1776 {
1777         struct socket *sock = s->sock, *nsock;
1778         int err;
1779
1780         /* Fast check for a new connection.
1781          * Avoids unnesesary socket allocations. */
1782         if (list_empty(&bt_sk(sock->sk)->accept_q))
1783                 return;
1784
1785         BT_DBG("session %p", s);
1786
1787         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1788         if (err < 0)
1789                 return;
1790
1791         __module_get(nsock->ops->owner);
1792
1793         /* Set our callbacks */
1794         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1795         nsock->sk->sk_state_change = rfcomm_l2state_change;
1796
1797         s = rfcomm_session_add(nsock, BT_OPEN);
1798         if (s) {
1799                 rfcomm_session_hold(s);
1800
1801                 /* We should adjust MTU on incoming sessions.
1802                  * L2CAP MTU minus UIH header and FCS. */
1803                 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1804
1805                 rfcomm_schedule(RFCOMM_SCHED_RX);
1806         } else
1807                 sock_release(nsock);
1808 }
1809
1810 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1811 {
1812         struct sock *sk = s->sock->sk;
1813
1814         BT_DBG("%p state %ld", s, s->state);
1815
1816         switch(sk->sk_state) {
1817         case BT_CONNECTED:
1818                 s->state = BT_CONNECT;
1819
1820                 /* We can adjust MTU on outgoing sessions.
1821                  * L2CAP MTU minus UIH header and FCS. */
1822                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1823
1824                 rfcomm_send_sabm(s, 0);
1825                 break;
1826
1827         case BT_CLOSED:
1828                 s->state = BT_CLOSED;
1829                 rfcomm_session_close(s, sk->sk_err);
1830                 break;
1831         }
1832 }
1833
1834 static inline void rfcomm_process_sessions(void)
1835 {
1836         struct list_head *p, *n;
1837
1838         rfcomm_lock();
1839
1840         list_for_each_safe(p, n, &session_list) {
1841                 struct rfcomm_session *s;
1842                 s = list_entry(p, struct rfcomm_session, list);
1843
1844                 if (s->state == BT_LISTEN) {
1845                         rfcomm_accept_connection(s);
1846                         continue;
1847                 }
1848
1849                 rfcomm_session_hold(s);
1850
1851                 switch (s->state) {
1852                 case BT_BOUND:
1853                         rfcomm_check_connection(s);
1854                         break;
1855
1856                 default:
1857                         rfcomm_process_rx(s);
1858                         break;
1859                 }
1860
1861                 rfcomm_process_dlcs(s);
1862
1863                 rfcomm_session_put(s);
1864         }
1865
1866         rfcomm_unlock();
1867 }
1868
1869 static int rfcomm_add_listener(bdaddr_t *ba)
1870 {
1871         struct sockaddr_l2 addr;
1872         struct socket *sock;
1873         struct sock *sk;
1874         struct rfcomm_session *s;
1875         int    err = 0;
1876
1877         /* Create socket */
1878         err = rfcomm_l2sock_create(&sock);
1879         if (err < 0) {
1880                 BT_ERR("Create socket failed %d", err);
1881                 return err;
1882         }
1883
1884         /* Bind socket */
1885         bacpy(&addr.l2_bdaddr, ba);
1886         addr.l2_family = AF_BLUETOOTH;
1887         addr.l2_psm    = htobs(RFCOMM_PSM);
1888         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1889         if (err < 0) {
1890                 BT_ERR("Bind failed %d", err);
1891                 goto failed;
1892         }
1893
1894         /* Set L2CAP options */
1895         sk = sock->sk;
1896         lock_sock(sk);
1897         l2cap_pi(sk)->imtu = l2cap_mtu;
1898         release_sock(sk);
1899
1900         /* Start listening on the socket */
1901         err = kernel_listen(sock, 10);
1902         if (err) {
1903                 BT_ERR("Listen failed %d", err);
1904                 goto failed;
1905         }
1906
1907         /* Add listening session */
1908         s = rfcomm_session_add(sock, BT_LISTEN);
1909         if (!s)
1910                 goto failed;
1911
1912         rfcomm_session_hold(s);
1913         return 0;
1914 failed:
1915         sock_release(sock);
1916         return err;
1917 }
1918
1919 static void rfcomm_kill_listener(void)
1920 {
1921         struct rfcomm_session *s;
1922         struct list_head *p, *n;
1923
1924         BT_DBG("");
1925
1926         list_for_each_safe(p, n, &session_list) {
1927                 s = list_entry(p, struct rfcomm_session, list);
1928                 rfcomm_session_del(s);
1929         }
1930 }
1931
1932 static int rfcomm_run(void *unused)
1933 {
1934         BT_DBG("");
1935
1936         set_user_nice(current, -10);
1937
1938         rfcomm_add_listener(BDADDR_ANY);
1939
1940         while (!kthread_should_stop()) {
1941                 set_current_state(TASK_INTERRUPTIBLE);
1942                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1943                         /* No pending events. Let's sleep.
1944                          * Incoming connections and data will wake us up. */
1945                         schedule();
1946                 }
1947                 set_current_state(TASK_RUNNING);
1948
1949                 /* Process stuff */
1950                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1951                 rfcomm_process_sessions();
1952         }
1953
1954         rfcomm_kill_listener();
1955
1956         return 0;
1957 }
1958
1959 static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
1960 {
1961         struct rfcomm_session *s;
1962         struct rfcomm_dlc *d;
1963         struct list_head *p, *n;
1964
1965         BT_DBG("conn %p status 0x%02x", conn, status);
1966
1967         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1968         if (!s)
1969                 return;
1970
1971         rfcomm_session_hold(s);
1972
1973         list_for_each_safe(p, n, &s->dlcs) {
1974                 d = list_entry(p, struct rfcomm_dlc, list);
1975
1976                 if ((d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) &&
1977                                 !(conn->link_mode & HCI_LM_ENCRYPT) && !status)
1978                         continue;
1979
1980                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1981                         continue;
1982
1983                 if (!status)
1984                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1985                 else
1986                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1987         }
1988
1989         rfcomm_session_put(s);
1990
1991         rfcomm_schedule(RFCOMM_SCHED_AUTH);
1992 }
1993
1994 static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1995 {
1996         struct rfcomm_session *s;
1997         struct rfcomm_dlc *d;
1998         struct list_head *p, *n;
1999
2000         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2001
2002         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2003         if (!s)
2004                 return;
2005
2006         rfcomm_session_hold(s);
2007
2008         list_for_each_safe(p, n, &s->dlcs) {
2009                 d = list_entry(p, struct rfcomm_dlc, list);
2010
2011                 if ((d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) &&
2012                                         (d->state == BT_CONNECTED ||
2013                                                 d->state == BT_CONFIG) &&
2014                                                 !status && encrypt == 0x00) {
2015                         __rfcomm_dlc_close(d, ECONNREFUSED);
2016                         continue;
2017                 }
2018
2019                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2020                         continue;
2021
2022                 if (!status && encrypt)
2023                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2024                 else
2025                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2026         }
2027
2028         rfcomm_session_put(s);
2029
2030         rfcomm_schedule(RFCOMM_SCHED_AUTH);
2031 }
2032
2033 static struct hci_cb rfcomm_cb = {
2034         .name           = "RFCOMM",
2035         .auth_cfm       = rfcomm_auth_cfm,
2036         .encrypt_cfm    = rfcomm_encrypt_cfm
2037 };
2038
2039 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2040 {
2041         struct rfcomm_session *s;
2042         struct list_head *pp, *p;
2043         char *str = buf;
2044
2045         rfcomm_lock();
2046
2047         list_for_each(p, &session_list) {
2048                 s = list_entry(p, struct rfcomm_session, list);
2049                 list_for_each(pp, &s->dlcs) {
2050                         struct sock *sk = s->sock->sk;
2051                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2052
2053                         str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2054                                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2055                                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2056                 }
2057         }
2058
2059         rfcomm_unlock();
2060
2061         return (str - buf);
2062 }
2063
2064 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2065
2066 /* ---- Initialization ---- */
2067 static int __init rfcomm_init(void)
2068 {
2069         l2cap_load();
2070
2071         hci_register_cb(&rfcomm_cb);
2072
2073         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2074         if (IS_ERR(rfcomm_thread)) {
2075                 hci_unregister_cb(&rfcomm_cb);
2076                 return PTR_ERR(rfcomm_thread);
2077         }
2078
2079         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2080                 BT_ERR("Failed to create RFCOMM info file");
2081
2082         rfcomm_init_sockets();
2083
2084 #ifdef CONFIG_BT_RFCOMM_TTY
2085         rfcomm_init_ttys();
2086 #endif
2087
2088         BT_INFO("RFCOMM ver %s", VERSION);
2089
2090         return 0;
2091 }
2092
2093 static void __exit rfcomm_exit(void)
2094 {
2095         class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2096
2097         hci_unregister_cb(&rfcomm_cb);
2098
2099         kthread_stop(rfcomm_thread);
2100
2101 #ifdef CONFIG_BT_RFCOMM_TTY
2102         rfcomm_cleanup_ttys();
2103 #endif
2104
2105         rfcomm_cleanup_sockets();
2106 }
2107
2108 module_init(rfcomm_init);
2109 module_exit(rfcomm_exit);
2110
2111 module_param(disable_cfc, bool, 0644);
2112 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2113
2114 module_param(channel_mtu, int, 0644);
2115 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2116
2117 module_param(l2cap_mtu, uint, 0644);
2118 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2119
2120 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
2121 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2122 MODULE_VERSION(VERSION);
2123 MODULE_LICENSE("GPL");
2124 MODULE_ALIAS("bt-proto-3");