net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/errno.h>
  30 #include <linux/kernel.h>
  31 #include <linux/sched.h>
  32 #include <linux/signal.h>
  33 #include <linux/init.h>
  34 #include <linux/wait.h>
  35 #include <linux/device.h>
  36 #include <linux/net.h>
  37 #include <linux/mutex.h>
  38 #include <linux/kthread.h>
  39
  40 #include <net/sock.h>
  41 #include <asm/uaccess.h>
  42 #include <asm/unaligned.h>
  43
  44 #include <net/bluetooth/bluetooth.h>
  45 #include <net/bluetooth/hci_core.h>
  46 #include <net/bluetooth/l2cap.h>
  47 #include <net/bluetooth/rfcomm.h>
  48
  49 #define VERSION "1.10"
  50
  51 static int disable_cfc = 0;
  52 static int channel_mtu = -1;
  53 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  54
  55 static struct task_struct *rfcomm_thread;
  56
  57 static DEFINE_MUTEX(rfcomm_mutex);
  58 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  59 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  60
  61 static unsigned long rfcomm_event;
  62
  63 static LIST_HEAD(session_list);
  64
  65 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  66 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  67 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  68 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  69 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  70 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  71 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  72 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  73 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  74 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  75
  76 static void rfcomm_process_connect(struct rfcomm_session *s);
  77
  78 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
  79 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  80 static void rfcomm_session_del(struct rfcomm_session *s);
  81
  82 /* ---- RFCOMM frame parsing macros ---- */
  83 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  84 #define __get_channel(b)  ((b & 0xf8) >> 3)
  85 #define __get_dir(b)      ((b & 0x04) >> 2)
  86 #define __get_type(b)     ((b & 0xef))
  87
  88 #define __test_ea(b)      ((b & 0x01))
  89 #define __test_cr(b)      ((b & 0x02))
  90 #define __test_pf(b)      ((b & 0x10))
  91
  92 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  93 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  94 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  95 #define __srv_channel(dlci)    (dlci >> 1)
  96 #define __dir(dlci)            (dlci & 0x01)
  97
  98 #define __len8(len)       (((len) << 1) | 1)
  99 #define __len16(len)      ((len) << 1)
 100
 101 /* MCC macros */
 102 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 103 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 104 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 105
 106 /* RPN macros */
 107 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 108 #define __get_rpn_data_bits(line) ((line) & 0x3)
 109 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 110 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 111
 112 static inline void rfcomm_schedule(uint event)
 113 {
 114         if (!rfcomm_thread)
 115                 return;
 116         //set_bit(event, &rfcomm_event);
 117         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
 118         wake_up_process(rfcomm_thread);
 119 }
 120
 121 static inline void rfcomm_session_put(struct rfcomm_session *s)
 122 {
 123         if (atomic_dec_and_test(&s->refcnt))
 124                 rfcomm_session_del(s);
 125 }
 126
 127 /* ---- RFCOMM FCS computation ---- */
 128
 129 /* reversed, 8-bit, poly=0x07 */
 130 static unsigned char rfcomm_crc_table[256] = {
 131         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 132         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 133         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 134         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 135
 136         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 137         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 138         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 139         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 140
 141         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 142         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 143         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 144         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 145
 146         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 147         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 148         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 149         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 150
 151         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 152         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 153         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 154         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 155
 156         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 157         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 158         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 159         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 160
 161         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 162         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 163         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 164         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 165
 166         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 167         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 168         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 169         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 170 };
 171
 172 /* CRC on 2 bytes */
 173 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 174
 175 /* FCS on 2 bytes */
 176 static inline u8 __fcs(u8 *data)
 177 {
 178         return (0xff - __crc(data));
 179 }
 180
 181 /* FCS on 3 bytes */
 182 static inline u8 __fcs2(u8 *data)
 183 {
 184         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 185 }
 186
 187 /* Check FCS */
 188 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 189 {
 190         u8 f = __crc(data);
 191
 192         if (type != RFCOMM_UIH)
 193                 f = rfcomm_crc_table[f ^ data[2]];
 194
 195         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 196 }
 197
 198 /* ---- L2CAP callbacks ---- */
 199 static void rfcomm_l2state_change(struct sock *sk)
 200 {
 201         BT_DBG("%p state %d", sk, sk->sk_state);
 202         rfcomm_schedule(RFCOMM_SCHED_STATE);
 203 }
 204
 205 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 206 {
 207         BT_DBG("%p bytes %d", sk, bytes);
 208         rfcomm_schedule(RFCOMM_SCHED_RX);
 209 }
 210
 211 static int rfcomm_l2sock_create(struct socket **sock)
 212 {
 213         int err;
 214
 215         BT_DBG("");
 216
 217         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 218         if (!err) {
 219                 struct sock *sk = (*sock)->sk;
 220                 sk->sk_data_ready   = rfcomm_l2data_ready;
 221                 sk->sk_state_change = rfcomm_l2state_change;
 222         }
 223         return err;
 224 }
 225
 226 static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
 227 {
 228         struct sock *sk = d->session->sock->sk;
 229         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 230
 231         if (d->link_mode & RFCOMM_LM_SECURE)
 232                 return hci_conn_security(conn->hcon, BT_SECURITY_HIGH);
 233
 234         if (d->link_mode & RFCOMM_LM_ENCRYPT)
 235                 return hci_conn_security(conn->hcon, BT_SECURITY_MEDIUM);
 236
 237         if (d->link_mode & RFCOMM_LM_AUTH)
 238                 return hci_conn_security(conn->hcon, BT_SECURITY_LOW);
 239
 240         return 1;
 241 }
 242
 243 /* ---- RFCOMM DLCs ---- */
 244 static void rfcomm_dlc_timeout(unsigned long arg)
 245 {
 246         struct rfcomm_dlc *d = (void *) arg;
 247
 248         BT_DBG("dlc %p state %ld", d, d->state);
 249
 250         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 251         rfcomm_dlc_put(d);
 252         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 253 }
 254
 255 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 256 {
 257         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 258
 259         if (!mod_timer(&d->timer, jiffies + timeout))
 260                 rfcomm_dlc_hold(d);
 261 }
 262
 263 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 264 {
 265         BT_DBG("dlc %p state %ld", d, d->state);
 266
 267         if (timer_pending(&d->timer) && del_timer(&d->timer))
 268                 rfcomm_dlc_put(d);
 269 }
 270
 271 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 272 {
 273         BT_DBG("%p", d);
 274
 275         d->state      = BT_OPEN;
 276         d->flags      = 0;
 277         d->mscex      = 0;
 278         d->mtu        = RFCOMM_DEFAULT_MTU;
 279         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 280
 281         d->cfc        = RFCOMM_CFC_DISABLED;
 282         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 283 }
 284
 285 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 286 {
 287         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 288
 289         if (!d)
 290                 return NULL;
 291
 292         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 293
 294         skb_queue_head_init(&d->tx_queue);
 295         spin_lock_init(&d->lock);
 296         atomic_set(&d->refcnt, 1);
 297
 298         rfcomm_dlc_clear_state(d);
 299
 300         BT_DBG("%p", d);
 301
 302         return d;
 303 }
 304
 305 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 306 {
 307         BT_DBG("%p", d);
 308
 309         skb_queue_purge(&d->tx_queue);
 310         kfree(d);
 311 }
 312
 313 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 314 {
 315         BT_DBG("dlc %p session %p", d, s);
 316
 317         rfcomm_session_hold(s);
 318
 319         rfcomm_dlc_hold(d);
 320         list_add(&d->list, &s->dlcs);
 321         d->session = s;
 322 }
 323
 324 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 325 {
 326         struct rfcomm_session *s = d->session;
 327
 328         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 329
 330         list_del(&d->list);
 331         d->session = NULL;
 332         rfcomm_dlc_put(d);
 333
 334         rfcomm_session_put(s);
 335 }
 336
 337 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 338 {
 339         struct rfcomm_dlc *d;
 340         struct list_head *p;
 341
 342         list_for_each(p, &s->dlcs) {
 343                 d = list_entry(p, struct rfcomm_dlc, list);
 344                 if (d->dlci == dlci)
 345                         return d;
 346         }
 347         return NULL;
 348 }
 349
 350 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 351 {
 352         struct rfcomm_session *s;
 353         int err = 0;
 354         u8 dlci;
 355
 356         BT_DBG("dlc %p state %ld %s %s channel %d",
 357                         d, d->state, batostr(src), batostr(dst), channel);
 358
 359         if (channel < 1 || channel > 30)
 360                 return -EINVAL;
 361
 362         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 363                 return 0;
 364
 365         s = rfcomm_session_get(src, dst);
 366         if (!s) {
 367                 s = rfcomm_session_create(src, dst, &err);
 368                 if (!s)
 369                         return err;
 370         }
 371
 372         dlci = __dlci(!s->initiator, channel);
 373
 374         /* Check if DLCI already exists */
 375         if (rfcomm_dlc_get(s, dlci))
 376                 return -EBUSY;
 377
 378         rfcomm_dlc_clear_state(d);
 379
 380         d->dlci     = dlci;
 381         d->addr     = __addr(s->initiator, dlci);
 382         d->priority = 7;
 383
 384         d->state = BT_CONFIG;
 385         rfcomm_dlc_link(s, d);
 386
 387         d->out = 1;
 388
 389         d->mtu = s->mtu;
 390         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 391
 392         if (s->state == BT_CONNECTED) {
 393                 if (rfcomm_check_link_mode(d))
 394                         rfcomm_send_pn(s, 1, d);
 395                 else
 396                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 397         }
 398
 399         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 400
 401         return 0;
 402 }
 403
 404 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 405 {
 406         int r;
 407
 408         rfcomm_lock();
 409
 410         r = __rfcomm_dlc_open(d, src, dst, channel);
 411
 412         rfcomm_unlock();
 413         return r;
 414 }
 415
 416 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 417 {
 418         struct rfcomm_session *s = d->session;
 419         if (!s)
 420                 return 0;
 421
 422         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 423                         d, d->state, d->dlci, err, s);
 424
 425         switch (d->state) {
 426         case BT_CONNECT:
 427         case BT_CONFIG:
 428                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 429                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 430                         rfcomm_schedule(RFCOMM_SCHED_AUTH);
 431                         break;
 432                 }
 433                 /* Fall through */
 434
 435         case BT_CONNECTED:
 436                 d->state = BT_DISCONN;
 437                 if (skb_queue_empty(&d->tx_queue)) {
 438                         rfcomm_send_disc(s, d->dlci);
 439                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 440                 } else {
 441                         rfcomm_queue_disc(d);
 442                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 443                 }
 444                 break;
 445
 446         case BT_OPEN:
 447                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 448                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 449                         rfcomm_schedule(RFCOMM_SCHED_AUTH);
 450                         break;
 451                 }
 452                 /* Fall through */
 453
 454         default:
 455                 rfcomm_dlc_clear_timer(d);
 456
 457                 rfcomm_dlc_lock(d);
 458                 d->state = BT_CLOSED;
 459                 d->state_change(d, err);
 460                 rfcomm_dlc_unlock(d);
 461
 462                 skb_queue_purge(&d->tx_queue);
 463                 rfcomm_dlc_unlink(d);
 464         }
 465
 466         return 0;
 467 }
 468
 469 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 470 {
 471         int r;
 472
 473         rfcomm_lock();
 474
 475         r = __rfcomm_dlc_close(d, err);
 476
 477         rfcomm_unlock();
 478         return r;
 479 }
 480
 481 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 482 {
 483         int len = skb->len;
 484
 485         if (d->state != BT_CONNECTED)
 486                 return -ENOTCONN;
 487
 488         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 489
 490         if (len > d->mtu)
 491                 return -EINVAL;
 492
 493         rfcomm_make_uih(skb, d->addr);
 494         skb_queue_tail(&d->tx_queue, skb);
 495
 496         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 497                 rfcomm_schedule(RFCOMM_SCHED_TX);
 498         return len;
 499 }
 500
 501 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 502 {
 503         BT_DBG("dlc %p state %ld", d, d->state);
 504
 505         if (!d->cfc) {
 506                 d->v24_sig |= RFCOMM_V24_FC;
 507                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 508         }
 509         rfcomm_schedule(RFCOMM_SCHED_TX);
 510 }
 511
 512 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 513 {
 514         BT_DBG("dlc %p state %ld", d, d->state);
 515
 516         if (!d->cfc) {
 517                 d->v24_sig &= ~RFCOMM_V24_FC;
 518                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 519         }
 520         rfcomm_schedule(RFCOMM_SCHED_TX);
 521 }
 522
 523 /*
 524    Set/get modem status functions use _local_ status i.e. what we report
 525    to the other side.
 526    Remote status is provided by dlc->modem_status() callback.
 527  */
 528 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 529 {
 530         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 531                         d, d->state, v24_sig);
 532
 533         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 534                 v24_sig |= RFCOMM_V24_FC;
 535         else
 536                 v24_sig &= ~RFCOMM_V24_FC;
 537
 538         d->v24_sig = v24_sig;
 539
 540         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 541                 rfcomm_schedule(RFCOMM_SCHED_TX);
 542
 543         return 0;
 544 }
 545
 546 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 547 {
 548         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 549                         d, d->state, d->v24_sig);
 550
 551         *v24_sig = d->v24_sig;
 552         return 0;
 553 }
 554
 555 /* ---- RFCOMM sessions ---- */
 556 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 557 {
 558         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 559
 560         if (!s)
 561                 return NULL;
 562
 563         BT_DBG("session %p sock %p", s, sock);
 564
 565         INIT_LIST_HEAD(&s->dlcs);
 566         s->state = state;
 567         s->sock  = sock;
 568
 569         s->mtu = RFCOMM_DEFAULT_MTU;
 570         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 571
 572         /* Do not increment module usage count for listening sessions.
 573          * Otherwise we won't be able to unload the module. */
 574         if (state != BT_LISTEN)
 575                 if (!try_module_get(THIS_MODULE)) {
 576                         kfree(s);
 577                         return NULL;
 578                 }
 579
 580         list_add(&s->list, &session_list);
 581
 582         return s;
 583 }
 584
 585 static void rfcomm_session_del(struct rfcomm_session *s)
 586 {
 587         int state = s->state;
 588
 589         BT_DBG("session %p state %ld", s, s->state);
 590
 591         list_del(&s->list);
 592
 593         if (state == BT_CONNECTED)
 594                 rfcomm_send_disc(s, 0);
 595
 596         sock_release(s->sock);
 597         kfree(s);
 598
 599         if (state != BT_LISTEN)
 600                 module_put(THIS_MODULE);
 601 }
 602
 603 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 604 {
 605         struct rfcomm_session *s;
 606         struct list_head *p, *n;
 607         struct bt_sock *sk;
 608         list_for_each_safe(p, n, &session_list) {
 609                 s = list_entry(p, struct rfcomm_session, list);
 610                 sk = bt_sk(s->sock->sk);
 611
 612                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 613                                 !bacmp(&sk->dst, dst))
 614                         return s;
 615         }
 616         return NULL;
 617 }
 618
 619 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 620 {
 621         struct rfcomm_dlc *d;
 622         struct list_head *p, *n;
 623
 624         BT_DBG("session %p state %ld err %d", s, s->state, err);
 625
 626         rfcomm_session_hold(s);
 627
 628         s->state = BT_CLOSED;
 629
 630         /* Close all dlcs */
 631         list_for_each_safe(p, n, &s->dlcs) {
 632                 d = list_entry(p, struct rfcomm_dlc, list);
 633                 d->state = BT_CLOSED;
 634                 __rfcomm_dlc_close(d, err);
 635         }
 636
 637         rfcomm_session_put(s);
 638 }
 639
 640 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 641 {
 642         struct rfcomm_session *s = NULL;
 643         struct sockaddr_l2 addr;
 644         struct socket *sock;
 645         struct sock *sk;
 646
 647         BT_DBG("%s %s", batostr(src), batostr(dst));
 648
 649         *err = rfcomm_l2sock_create(&sock);
 650         if (*err < 0)
 651                 return NULL;
 652
 653         bacpy(&addr.l2_bdaddr, src);
 654         addr.l2_family = AF_BLUETOOTH;
 655         addr.l2_psm    = 0;
 656         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 657         if (*err < 0)
 658                 goto failed;
 659
 660         /* Set L2CAP options */
 661         sk = sock->sk;
 662         lock_sock(sk);
 663         l2cap_pi(sk)->imtu = l2cap_mtu;
 664         release_sock(sk);
 665
 666         s = rfcomm_session_add(sock, BT_BOUND);
 667         if (!s) {
 668                 *err = -ENOMEM;
 669                 goto failed;
 670         }
 671
 672         s->initiator = 1;
 673
 674         bacpy(&addr.l2_bdaddr, dst);
 675         addr.l2_family = AF_BLUETOOTH;
 676         addr.l2_psm    = htobs(RFCOMM_PSM);
 677         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 678         if (*err == 0 || *err == -EINPROGRESS)
 679                 return s;
 680
 681         rfcomm_session_del(s);
 682         return NULL;
 683
 684 failed:
 685         sock_release(sock);
 686         return NULL;
 687 }
 688
 689 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 690 {
 691         struct sock *sk = s->sock->sk;
 692         if (src)
 693                 bacpy(src, &bt_sk(sk)->src);
 694         if (dst)
 695                 bacpy(dst, &bt_sk(sk)->dst);
 696 }
 697
 698 /* ---- RFCOMM frame sending ---- */
 699 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 700 {
 701         struct socket *sock = s->sock;
 702         struct kvec iv = { data, len };
 703         struct msghdr msg;
 704
 705         BT_DBG("session %p len %d", s, len);
 706
 707         memset(&msg, 0, sizeof(msg));
 708
 709         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 710 }
 711
 712 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 713 {
 714         struct rfcomm_cmd cmd;
 715
 716         BT_DBG("%p dlci %d", s, dlci);
 717
 718         cmd.addr = __addr(s->initiator, dlci);
 719         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 720         cmd.len  = __len8(0);
 721         cmd.fcs  = __fcs2((u8 *) &cmd);
 722
 723         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 724 }
 725
 726 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 727 {
 728         struct rfcomm_cmd cmd;
 729
 730         BT_DBG("%p dlci %d", s, dlci);
 731
 732         cmd.addr = __addr(!s->initiator, dlci);
 733         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 734         cmd.len  = __len8(0);
 735         cmd.fcs  = __fcs2((u8 *) &cmd);
 736
 737         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 738 }
 739
 740 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 741 {
 742         struct rfcomm_cmd cmd;
 743
 744         BT_DBG("%p dlci %d", s, dlci);
 745
 746         cmd.addr = __addr(s->initiator, dlci);
 747         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 748         cmd.len  = __len8(0);
 749         cmd.fcs  = __fcs2((u8 *) &cmd);
 750
 751         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 752 }
 753
 754 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 755 {
 756         struct rfcomm_cmd *cmd;
 757         struct sk_buff *skb;
 758
 759         BT_DBG("dlc %p dlci %d", d, d->dlci);
 760
 761         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 762         if (!skb)
 763                 return -ENOMEM;
 764
 765         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 766         cmd->addr = d->addr;
 767         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 768         cmd->len  = __len8(0);
 769         cmd->fcs  = __fcs2((u8 *) cmd);
 770
 771         skb_queue_tail(&d->tx_queue, skb);
 772         rfcomm_schedule(RFCOMM_SCHED_TX);
 773         return 0;
 774 }
 775
 776 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 777 {
 778         struct rfcomm_cmd cmd;
 779
 780         BT_DBG("%p dlci %d", s, dlci);
 781
 782         cmd.addr = __addr(!s->initiator, dlci);
 783         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 784         cmd.len  = __len8(0);
 785         cmd.fcs  = __fcs2((u8 *) &cmd);
 786
 787         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 788 }
 789
 790 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 791 {
 792         struct rfcomm_hdr *hdr;
 793         struct rfcomm_mcc *mcc;
 794         u8 buf[16], *ptr = buf;
 795
 796         BT_DBG("%p cr %d type %d", s, cr, type);
 797
 798         hdr = (void *) ptr; ptr += sizeof(*hdr);
 799         hdr->addr = __addr(s->initiator, 0);
 800         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 801         hdr->len  = __len8(sizeof(*mcc) + 1);
 802
 803         mcc = (void *) ptr; ptr += sizeof(*mcc);
 804         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 805         mcc->len  = __len8(1);
 806
 807         /* Type that we didn't like */
 808         *ptr = __mcc_type(cr, type); ptr++;
 809
 810         *ptr = __fcs(buf); ptr++;
 811
 812         return rfcomm_send_frame(s, buf, ptr - buf);
 813 }
 814
 815 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 816 {
 817         struct rfcomm_hdr *hdr;
 818         struct rfcomm_mcc *mcc;
 819         struct rfcomm_pn  *pn;
 820         u8 buf[16], *ptr = buf;
 821
 822         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 823
 824         hdr = (void *) ptr; ptr += sizeof(*hdr);
 825         hdr->addr = __addr(s->initiator, 0);
 826         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 827         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 828
 829         mcc = (void *) ptr; ptr += sizeof(*mcc);
 830         mcc->type = __mcc_type(cr, RFCOMM_PN);
 831         mcc->len  = __len8(sizeof(*pn));
 832
 833         pn = (void *) ptr; ptr += sizeof(*pn);
 834         pn->dlci        = d->dlci;
 835         pn->priority    = d->priority;
 836         pn->ack_timer   = 0;
 837         pn->max_retrans = 0;
 838
 839         if (s->cfc) {
 840                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 841                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 842         } else {
 843                 pn->flow_ctrl = 0;
 844                 pn->credits   = 0;
 845         }
 846
 847         if (cr && channel_mtu >= 0)
 848                 pn->mtu = htobs(channel_mtu);
 849         else
 850                 pn->mtu = htobs(d->mtu);
 851
 852         *ptr = __fcs(buf); ptr++;
 853
 854         return rfcomm_send_frame(s, buf, ptr - buf);
 855 }
 856
 857 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 858                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 859                         u8 parity, u8 flow_ctrl_settings,
 860                         u8 xon_char, u8 xoff_char, u16 param_mask)
 861 {
 862         struct rfcomm_hdr *hdr;
 863         struct rfcomm_mcc *mcc;
 864         struct rfcomm_rpn *rpn;
 865         u8 buf[16], *ptr = buf;
 866
 867         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 868                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 869                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 870                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 871
 872         hdr = (void *) ptr; ptr += sizeof(*hdr);
 873         hdr->addr = __addr(s->initiator, 0);
 874         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 875         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 876
 877         mcc = (void *) ptr; ptr += sizeof(*mcc);
 878         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 879         mcc->len  = __len8(sizeof(*rpn));
 880
 881         rpn = (void *) ptr; ptr += sizeof(*rpn);
 882         rpn->dlci          = __addr(1, dlci);
 883         rpn->bit_rate      = bit_rate;
 884         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 885         rpn->flow_ctrl     = flow_ctrl_settings;
 886         rpn->xon_char      = xon_char;
 887         rpn->xoff_char     = xoff_char;
 888         rpn->param_mask    = cpu_to_le16(param_mask);
 889
 890         *ptr = __fcs(buf); ptr++;
 891
 892         return rfcomm_send_frame(s, buf, ptr - buf);
 893 }
 894
 895 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 896 {
 897         struct rfcomm_hdr *hdr;
 898         struct rfcomm_mcc *mcc;
 899         struct rfcomm_rls *rls;
 900         u8 buf[16], *ptr = buf;
 901
 902         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 903
 904         hdr = (void *) ptr; ptr += sizeof(*hdr);
 905         hdr->addr = __addr(s->initiator, 0);
 906         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 907         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 908
 909         mcc = (void *) ptr; ptr += sizeof(*mcc);
 910         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 911         mcc->len  = __len8(sizeof(*rls));
 912
 913         rls = (void *) ptr; ptr += sizeof(*rls);
 914         rls->dlci   = __addr(1, dlci);
 915         rls->status = status;
 916
 917         *ptr = __fcs(buf); ptr++;
 918
 919         return rfcomm_send_frame(s, buf, ptr - buf);
 920 }
 921
 922 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 923 {
 924         struct rfcomm_hdr *hdr;
 925         struct rfcomm_mcc *mcc;
 926         struct rfcomm_msc *msc;
 927         u8 buf[16], *ptr = buf;
 928
 929         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 930
 931         hdr = (void *) ptr; ptr += sizeof(*hdr);
 932         hdr->addr = __addr(s->initiator, 0);
 933         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 934         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 935
 936         mcc = (void *) ptr; ptr += sizeof(*mcc);
 937         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 938         mcc->len  = __len8(sizeof(*msc));
 939
 940         msc = (void *) ptr; ptr += sizeof(*msc);
 941         msc->dlci    = __addr(1, dlci);
 942         msc->v24_sig = v24_sig | 0x01;
 943
 944         *ptr = __fcs(buf); ptr++;
 945
 946         return rfcomm_send_frame(s, buf, ptr - buf);
 947 }
 948
 949 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 950 {
 951         struct rfcomm_hdr *hdr;
 952         struct rfcomm_mcc *mcc;
 953         u8 buf[16], *ptr = buf;
 954
 955         BT_DBG("%p cr %d", s, cr);
 956
 957         hdr = (void *) ptr; ptr += sizeof(*hdr);
 958         hdr->addr = __addr(s->initiator, 0);
 959         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 960         hdr->len  = __len8(sizeof(*mcc));
 961
 962         mcc = (void *) ptr; ptr += sizeof(*mcc);
 963         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
 964         mcc->len  = __len8(0);
 965
 966         *ptr = __fcs(buf); ptr++;
 967
 968         return rfcomm_send_frame(s, buf, ptr - buf);
 969 }
 970
 971 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
 972 {
 973         struct rfcomm_hdr *hdr;
 974         struct rfcomm_mcc *mcc;
 975         u8 buf[16], *ptr = buf;
 976
 977         BT_DBG("%p cr %d", s, cr);
 978
 979         hdr = (void *) ptr; ptr += sizeof(*hdr);
 980         hdr->addr = __addr(s->initiator, 0);
 981         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 982         hdr->len  = __len8(sizeof(*mcc));
 983
 984         mcc = (void *) ptr; ptr += sizeof(*mcc);
 985         mcc->type = __mcc_type(cr, RFCOMM_FCON);
 986         mcc->len  = __len8(0);
 987
 988         *ptr = __fcs(buf); ptr++;
 989
 990         return rfcomm_send_frame(s, buf, ptr - buf);
 991 }
 992
 993 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
 994 {
 995         struct socket *sock = s->sock;
 996         struct kvec iv[3];
 997         struct msghdr msg;
 998         unsigned char hdr[5], crc[1];
 999
1000         if (len > 125)
1001                 return -EINVAL;
1002
1003         BT_DBG("%p cr %d", s, cr);
1004
1005         hdr[0] = __addr(s->initiator, 0);
1006         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1007         hdr[2] = 0x01 | ((len + 2) << 1);
1008         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1009         hdr[4] = 0x01 | (len << 1);
1010
1011         crc[0] = __fcs(hdr);
1012
1013         iv[0].iov_base = hdr;
1014         iv[0].iov_len  = 5;
1015         iv[1].iov_base = pattern;
1016         iv[1].iov_len  = len;
1017         iv[2].iov_base = crc;
1018         iv[2].iov_len  = 1;
1019
1020         memset(&msg, 0, sizeof(msg));
1021
1022         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1023 }
1024
1025 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1026 {
1027         struct rfcomm_hdr *hdr;
1028         u8 buf[16], *ptr = buf;
1029
1030         BT_DBG("%p addr %d credits %d", s, addr, credits);
1031
1032         hdr = (void *) ptr; ptr += sizeof(*hdr);
1033         hdr->addr = addr;
1034         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1035         hdr->len  = __len8(0);
1036
1037         *ptr = credits; ptr++;
1038
1039         *ptr = __fcs(buf); ptr++;
1040
1041         return rfcomm_send_frame(s, buf, ptr - buf);
1042 }
1043
1044 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1045 {
1046         struct rfcomm_hdr *hdr;
1047         int len = skb->len;
1048         u8 *crc;
1049
1050         if (len > 127) {
1051                 hdr = (void *) skb_push(skb, 4);
1052                 put_unaligned(htobs(__len16(len)), (__le16 *) &hdr->len);
1053         } else {
1054                 hdr = (void *) skb_push(skb, 3);
1055                 hdr->len = __len8(len);
1056         }
1057         hdr->addr = addr;
1058         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1059
1060         crc = skb_put(skb, 1);
1061         *crc = __fcs((void *) hdr);
1062 }
1063
1064 /* ---- RFCOMM frame reception ---- */
1065 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1066 {
1067         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1068
1069         if (dlci) {
1070                 /* Data channel */
1071                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1072                 if (!d) {
1073                         rfcomm_send_dm(s, dlci);
1074                         return 0;
1075                 }
1076
1077                 switch (d->state) {
1078                 case BT_CONNECT:
1079                         rfcomm_dlc_clear_timer(d);
1080
1081                         rfcomm_dlc_lock(d);
1082                         d->state = BT_CONNECTED;
1083                         d->state_change(d, 0);
1084                         rfcomm_dlc_unlock(d);
1085
1086                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1087                         break;
1088
1089                 case BT_DISCONN:
1090                         d->state = BT_CLOSED;
1091                         __rfcomm_dlc_close(d, 0);
1092
1093                         if (list_empty(&s->dlcs)) {
1094                                 s->state = BT_DISCONN;
1095                                 rfcomm_send_disc(s, 0);
1096                         }
1097
1098                         break;
1099                 }
1100         } else {
1101                 /* Control channel */
1102                 switch (s->state) {
1103                 case BT_CONNECT:
1104                         s->state = BT_CONNECTED;
1105                         rfcomm_process_connect(s);
1106                         break;
1107
1108                 case BT_DISCONN:
1109                         rfcomm_session_put(s);
1110                         break;
1111                 }
1112         }
1113         return 0;
1114 }
1115
1116 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1117 {
1118         int err = 0;
1119
1120         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1121
1122         if (dlci) {
1123                 /* Data DLC */
1124                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1125                 if (d) {
1126                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1127                                 err = ECONNREFUSED;
1128                         else
1129                                 err = ECONNRESET;
1130
1131                         d->state = BT_CLOSED;
1132                         __rfcomm_dlc_close(d, err);
1133                 }
1134         } else {
1135                 if (s->state == BT_CONNECT)
1136                         err = ECONNREFUSED;
1137                 else
1138                         err = ECONNRESET;
1139
1140                 s->state = BT_CLOSED;
1141                 rfcomm_session_close(s, err);
1142         }
1143         return 0;
1144 }
1145
1146 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1147 {
1148         int err = 0;
1149
1150         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1151
1152         if (dlci) {
1153                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1154                 if (d) {
1155                         rfcomm_send_ua(s, dlci);
1156
1157                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1158                                 err = ECONNREFUSED;
1159                         else
1160                                 err = ECONNRESET;
1161
1162                         d->state = BT_CLOSED;
1163                         __rfcomm_dlc_close(d, err);
1164                 } else
1165                         rfcomm_send_dm(s, dlci);
1166
1167         } else {
1168                 rfcomm_send_ua(s, 0);
1169
1170                 if (s->state == BT_CONNECT)
1171                         err = ECONNREFUSED;
1172                 else
1173                         err = ECONNRESET;
1174
1175                 s->state = BT_CLOSED;
1176                 rfcomm_session_close(s, err);
1177         }
1178
1179         return 0;
1180 }
1181
1182 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1183 {
1184         struct sock *sk = d->session->sock->sk;
1185
1186         BT_DBG("dlc %p", d);
1187
1188         rfcomm_send_ua(d->session, d->dlci);
1189
1190         rfcomm_dlc_lock(d);
1191         d->state = BT_CONNECTED;
1192         d->state_change(d, 0);
1193         rfcomm_dlc_unlock(d);
1194
1195         if (d->link_mode & RFCOMM_LM_MASTER)
1196                 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1197
1198         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1199 }
1200
1201 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1202 {
1203         if (rfcomm_check_link_mode(d)) {
1204                 if (d->defer_setup) {
1205                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1206                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1207                 } else
1208                         rfcomm_dlc_accept(d);
1209         } else {
1210                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1211                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1212         }
1213 }
1214
1215 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1216 {
1217         struct rfcomm_dlc *d;
1218         u8 channel;
1219
1220         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1221
1222         if (!dlci) {
1223                 rfcomm_send_ua(s, 0);
1224
1225                 if (s->state == BT_OPEN) {
1226                         s->state = BT_CONNECTED;
1227                         rfcomm_process_connect(s);
1228                 }
1229                 return 0;
1230         }
1231
1232         /* Check if DLC exists */
1233         d = rfcomm_dlc_get(s, dlci);
1234         if (d) {
1235                 if (d->state == BT_OPEN) {
1236                         /* DLC was previously opened by PN request */
1237                         rfcomm_check_accept(d);
1238                 }
1239                 return 0;
1240         }
1241
1242         /* Notify socket layer about incoming connection */
1243         channel = __srv_channel(dlci);
1244         if (rfcomm_connect_ind(s, channel, &d)) {
1245                 d->dlci = dlci;
1246                 d->addr = __addr(s->initiator, dlci);
1247                 rfcomm_dlc_link(s, d);
1248
1249                 rfcomm_check_accept(d);
1250         } else {
1251                 rfcomm_send_dm(s, dlci);
1252         }
1253
1254         return 0;
1255 }
1256
1257 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1258 {
1259         struct rfcomm_session *s = d->session;
1260
1261         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1262                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1263
1264         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1265                                                 pn->flow_ctrl == 0xe0) {
1266                 d->cfc = RFCOMM_CFC_ENABLED;
1267                 d->tx_credits = pn->credits;
1268         } else {
1269                 d->cfc = RFCOMM_CFC_DISABLED;
1270                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1271         }
1272
1273         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1274                 s->cfc = d->cfc;
1275
1276         d->priority = pn->priority;
1277
1278         d->mtu = btohs(pn->mtu);
1279
1280         if (cr && d->mtu > s->mtu)
1281                 d->mtu = s->mtu;
1282
1283         return 0;
1284 }
1285
1286 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1287 {
1288         struct rfcomm_pn *pn = (void *) skb->data;
1289         struct rfcomm_dlc *d;
1290         u8 dlci = pn->dlci;
1291
1292         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1293
1294         if (!dlci)
1295                 return 0;
1296
1297         d = rfcomm_dlc_get(s, dlci);
1298         if (d) {
1299                 if (cr) {
1300                         /* PN request */
1301                         rfcomm_apply_pn(d, cr, pn);
1302                         rfcomm_send_pn(s, 0, d);
1303                 } else {
1304                         /* PN response */
1305                         switch (d->state) {
1306                         case BT_CONFIG:
1307                                 rfcomm_apply_pn(d, cr, pn);
1308
1309                                 d->state = BT_CONNECT;
1310                                 rfcomm_send_sabm(s, d->dlci);
1311                                 break;
1312                         }
1313                 }
1314         } else {
1315                 u8 channel = __srv_channel(dlci);
1316
1317                 if (!cr)
1318                         return 0;
1319
1320                 /* PN request for non existing DLC.
1321                  * Assume incoming connection. */
1322                 if (rfcomm_connect_ind(s, channel, &d)) {
1323                         d->dlci = dlci;
1324                         d->addr = __addr(s->initiator, dlci);
1325                         rfcomm_dlc_link(s, d);
1326
1327                         rfcomm_apply_pn(d, cr, pn);
1328
1329                         d->state = BT_OPEN;
1330                         rfcomm_send_pn(s, 0, d);
1331                 } else {
1332                         rfcomm_send_dm(s, dlci);
1333                 }
1334         }
1335         return 0;
1336 }
1337
1338 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1339 {
1340         struct rfcomm_rpn *rpn = (void *) skb->data;
1341         u8 dlci = __get_dlci(rpn->dlci);
1342
1343         u8 bit_rate  = 0;
1344         u8 data_bits = 0;
1345         u8 stop_bits = 0;
1346         u8 parity    = 0;
1347         u8 flow_ctrl = 0;
1348         u8 xon_char  = 0;
1349         u8 xoff_char = 0;
1350         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1351
1352         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1353                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1354                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1355
1356         if (!cr)
1357                 return 0;
1358
1359         if (len == 1) {
1360                 /* This is a request, return default settings */
1361                 bit_rate  = RFCOMM_RPN_BR_115200;
1362                 data_bits = RFCOMM_RPN_DATA_8;
1363                 stop_bits = RFCOMM_RPN_STOP_1;
1364                 parity    = RFCOMM_RPN_PARITY_NONE;
1365                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1366                 xon_char  = RFCOMM_RPN_XON_CHAR;
1367                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1368                 goto rpn_out;
1369         }
1370
1371         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1372          * no parity, no flow control lines, normal XON/XOFF chars */
1373
1374         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1375                 bit_rate = rpn->bit_rate;
1376                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1377                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1378                         bit_rate = RFCOMM_RPN_BR_115200;
1379                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1380                 }
1381         }
1382
1383         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1384                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1385                 if (data_bits != RFCOMM_RPN_DATA_8) {
1386                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1387                         data_bits = RFCOMM_RPN_DATA_8;
1388                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1389                 }
1390         }
1391
1392         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1393                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1394                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1395                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1396                         stop_bits = RFCOMM_RPN_STOP_1;
1397                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1398                 }
1399         }
1400
1401         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1402                 parity = __get_rpn_parity(rpn->line_settings);
1403                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1404                         BT_DBG("RPN parity mismatch 0x%x", parity);
1405                         parity = RFCOMM_RPN_PARITY_NONE;
1406                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1407                 }
1408         }
1409
1410         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1411                 flow_ctrl = rpn->flow_ctrl;
1412                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1413                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1414                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1415                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1416                 }
1417         }
1418
1419         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1420                 xon_char = rpn->xon_char;
1421                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1422                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1423                         xon_char = RFCOMM_RPN_XON_CHAR;
1424                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1425                 }
1426         }
1427
1428         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1429                 xoff_char = rpn->xoff_char;
1430                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1431                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1432                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1433                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1434                 }
1435         }
1436
1437 rpn_out:
1438         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1439                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1440
1441         return 0;
1442 }
1443
1444 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1445 {
1446         struct rfcomm_rls *rls = (void *) skb->data;
1447         u8 dlci = __get_dlci(rls->dlci);
1448
1449         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1450
1451         if (!cr)
1452                 return 0;
1453
1454         /* We should probably do something with this information here. But
1455          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1456          * mandatory to recognise and respond to RLS */
1457
1458         rfcomm_send_rls(s, 0, dlci, rls->status);
1459
1460         return 0;
1461 }
1462
1463 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1464 {
1465         struct rfcomm_msc *msc = (void *) skb->data;
1466         struct rfcomm_dlc *d;
1467         u8 dlci = __get_dlci(msc->dlci);
1468
1469         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1470
1471         d = rfcomm_dlc_get(s, dlci);
1472         if (!d)
1473                 return 0;
1474
1475         if (cr) {
1476                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1477                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1478                 else
1479                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1480
1481                 rfcomm_dlc_lock(d);
1482
1483                 d->remote_v24_sig = msc->v24_sig;
1484
1485                 if (d->modem_status)
1486                         d->modem_status(d, msc->v24_sig);
1487
1488                 rfcomm_dlc_unlock(d);
1489
1490                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1491
1492                 d->mscex |= RFCOMM_MSCEX_RX;
1493         } else
1494                 d->mscex |= RFCOMM_MSCEX_TX;
1495
1496         return 0;
1497 }
1498
1499 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1500 {
1501         struct rfcomm_mcc *mcc = (void *) skb->data;
1502         u8 type, cr, len;
1503
1504         cr   = __test_cr(mcc->type);
1505         type = __get_mcc_type(mcc->type);
1506         len  = __get_mcc_len(mcc->len);
1507
1508         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1509
1510         skb_pull(skb, 2);
1511
1512         switch (type) {
1513         case RFCOMM_PN:
1514                 rfcomm_recv_pn(s, cr, skb);
1515                 break;
1516
1517         case RFCOMM_RPN:
1518                 rfcomm_recv_rpn(s, cr, len, skb);
1519                 break;
1520
1521         case RFCOMM_RLS:
1522                 rfcomm_recv_rls(s, cr, skb);
1523                 break;
1524
1525         case RFCOMM_MSC:
1526                 rfcomm_recv_msc(s, cr, skb);
1527                 break;
1528
1529         case RFCOMM_FCOFF:
1530                 if (cr) {
1531                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1532                         rfcomm_send_fcoff(s, 0);
1533                 }
1534                 break;
1535
1536         case RFCOMM_FCON:
1537                 if (cr) {
1538                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1539                         rfcomm_send_fcon(s, 0);
1540                 }
1541                 break;
1542
1543         case RFCOMM_TEST:
1544                 if (cr)
1545                         rfcomm_send_test(s, 0, skb->data, skb->len);
1546                 break;
1547
1548         case RFCOMM_NSC:
1549                 break;
1550
1551         default:
1552                 BT_ERR("Unknown control type 0x%02x", type);
1553                 rfcomm_send_nsc(s, cr, type);
1554                 break;
1555         }
1556         return 0;
1557 }
1558
1559 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1560 {
1561         struct rfcomm_dlc *d;
1562
1563         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1564
1565         d = rfcomm_dlc_get(s, dlci);
1566         if (!d) {
1567                 rfcomm_send_dm(s, dlci);
1568                 goto drop;
1569         }
1570
1571         if (pf && d->cfc) {
1572                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1573
1574                 d->tx_credits += credits;
1575                 if (d->tx_credits)
1576                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1577         }
1578
1579         if (skb->len && d->state == BT_CONNECTED) {
1580                 rfcomm_dlc_lock(d);
1581                 d->rx_credits--;
1582                 d->data_ready(d, skb);
1583                 rfcomm_dlc_unlock(d);
1584                 return 0;
1585         }
1586
1587 drop:
1588         kfree_skb(skb);
1589         return 0;
1590 }
1591
1592 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1593 {
1594         struct rfcomm_hdr *hdr = (void *) skb->data;
1595         u8 type, dlci, fcs;
1596
1597         dlci = __get_dlci(hdr->addr);
1598         type = __get_type(hdr->ctrl);
1599
1600         /* Trim FCS */
1601         skb->len--; skb->tail--;
1602         fcs = *(u8 *)skb_tail_pointer(skb);
1603
1604         if (__check_fcs(skb->data, type, fcs)) {
1605                 BT_ERR("bad checksum in packet");
1606                 kfree_skb(skb);
1607                 return -EILSEQ;
1608         }
1609
1610         if (__test_ea(hdr->len))
1611                 skb_pull(skb, 3);
1612         else
1613                 skb_pull(skb, 4);
1614
1615         switch (type) {
1616         case RFCOMM_SABM:
1617                 if (__test_pf(hdr->ctrl))
1618                         rfcomm_recv_sabm(s, dlci);
1619                 break;
1620
1621         case RFCOMM_DISC:
1622                 if (__test_pf(hdr->ctrl))
1623                         rfcomm_recv_disc(s, dlci);
1624                 break;
1625
1626         case RFCOMM_UA:
1627                 if (__test_pf(hdr->ctrl))
1628                         rfcomm_recv_ua(s, dlci);
1629                 break;
1630
1631         case RFCOMM_DM:
1632                 rfcomm_recv_dm(s, dlci);
1633                 break;
1634
1635         case RFCOMM_UIH:
1636                 if (dlci)
1637                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1638
1639                 rfcomm_recv_mcc(s, skb);
1640                 break;
1641
1642         default:
1643                 BT_ERR("Unknown packet type 0x%02x\n", type);
1644                 break;
1645         }
1646         kfree_skb(skb);
1647         return 0;
1648 }
1649
1650 /* ---- Connection and data processing ---- */
1651
1652 static void rfcomm_process_connect(struct rfcomm_session *s)
1653 {
1654         struct rfcomm_dlc *d;
1655         struct list_head *p, *n;
1656
1657         BT_DBG("session %p state %ld", s, s->state);
1658
1659         list_for_each_safe(p, n, &s->dlcs) {
1660                 d = list_entry(p, struct rfcomm_dlc, list);
1661                 if (d->state == BT_CONFIG) {
1662                         d->mtu = s->mtu;
1663                         if (rfcomm_check_link_mode(d)) {
1664                                 rfcomm_send_pn(s, 1, d);
1665                         } else {
1666                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1667                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1668                         }
1669                 }
1670         }
1671 }
1672
1673 /* Send data queued for the DLC.
1674  * Return number of frames left in the queue.
1675  */
1676 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1677 {
1678         struct sk_buff *skb;
1679         int err;
1680
1681         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1682                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1683
1684         /* Send pending MSC */
1685         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1686                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1687
1688         if (d->cfc) {
1689                 /* CFC enabled.
1690                  * Give them some credits */
1691                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1692                                 d->rx_credits <= (d->cfc >> 2)) {
1693                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1694                         d->rx_credits = d->cfc;
1695                 }
1696         } else {
1697                 /* CFC disabled.
1698                  * Give ourselves some credits */
1699                 d->tx_credits = 5;
1700         }
1701
1702         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1703                 return skb_queue_len(&d->tx_queue);
1704
1705         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1706                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1707                 if (err < 0) {
1708                         skb_queue_head(&d->tx_queue, skb);
1709                         break;
1710                 }
1711                 kfree_skb(skb);
1712                 d->tx_credits--;
1713         }
1714
1715         if (d->cfc && !d->tx_credits) {
1716                 /* We're out of TX credits.
1717                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1718                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1719         }
1720
1721         return skb_queue_len(&d->tx_queue);
1722 }
1723
1724 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1725 {
1726         struct rfcomm_dlc *d;
1727         struct list_head *p, *n;
1728
1729         BT_DBG("session %p state %ld", s, s->state);
1730
1731         list_for_each_safe(p, n, &s->dlcs) {
1732                 d = list_entry(p, struct rfcomm_dlc, list);
1733
1734                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1735                         __rfcomm_dlc_close(d, ETIMEDOUT);
1736                         continue;
1737                 }
1738
1739                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1740                         rfcomm_dlc_clear_timer(d);
1741                         if (d->out) {
1742                                 rfcomm_send_pn(s, 1, d);
1743                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1744                         } else {
1745                                 if (d->defer_setup) {
1746                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1747                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1748                                 } else
1749                                         rfcomm_dlc_accept(d);
1750                         }
1751                         if (d->link_mode & RFCOMM_LM_SECURE) {
1752                                 struct sock *sk = s->sock->sk;
1753                                 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
1754                         }
1755                         continue;
1756                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1757                         rfcomm_dlc_clear_timer(d);
1758                         if (!d->out)
1759                                 rfcomm_send_dm(s, d->dlci);
1760                         else
1761                                 d->state = BT_CLOSED;
1762                         __rfcomm_dlc_close(d, ECONNREFUSED);
1763                         continue;
1764                 }
1765
1766                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1767                         continue;
1768
1769                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1770                                                 d->mscex == RFCOMM_MSCEX_OK)
1771                         rfcomm_process_tx(d);
1772         }
1773 }
1774
1775 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1776 {
1777         struct socket *sock = s->sock;
1778         struct sock *sk = sock->sk;
1779         struct sk_buff *skb;
1780
1781         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1782
1783         /* Get data directly from socket receive queue without copying it. */
1784         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1785                 skb_orphan(skb);
1786                 rfcomm_recv_frame(s, skb);
1787         }
1788
1789         if (sk->sk_state == BT_CLOSED) {
1790                 if (!s->initiator)
1791                         rfcomm_session_put(s);
1792
1793                 rfcomm_session_close(s, sk->sk_err);
1794         }
1795 }
1796
1797 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1798 {
1799         struct socket *sock = s->sock, *nsock;
1800         int err;
1801
1802         /* Fast check for a new connection.
1803          * Avoids unnesesary socket allocations. */
1804         if (list_empty(&bt_sk(sock->sk)->accept_q))
1805                 return;
1806
1807         BT_DBG("session %p", s);
1808
1809         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1810         if (err < 0)
1811                 return;
1812
1813         /* Set our callbacks */
1814         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1815         nsock->sk->sk_state_change = rfcomm_l2state_change;
1816
1817         s = rfcomm_session_add(nsock, BT_OPEN);
1818         if (s) {
1819                 rfcomm_session_hold(s);
1820
1821                 /* We should adjust MTU on incoming sessions.
1822                  * L2CAP MTU minus UIH header and FCS. */
1823                 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1824
1825                 rfcomm_schedule(RFCOMM_SCHED_RX);
1826         } else
1827                 sock_release(nsock);
1828 }
1829
1830 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1831 {
1832         struct sock *sk = s->sock->sk;
1833
1834         BT_DBG("%p state %ld", s, s->state);
1835
1836         switch(sk->sk_state) {
1837         case BT_CONNECTED:
1838                 s->state = BT_CONNECT;
1839
1840                 /* We can adjust MTU on outgoing sessions.
1841                  * L2CAP MTU minus UIH header and FCS. */
1842                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1843
1844                 rfcomm_send_sabm(s, 0);
1845                 break;
1846
1847         case BT_CLOSED:
1848                 s->state = BT_CLOSED;
1849                 rfcomm_session_close(s, sk->sk_err);
1850                 break;
1851         }
1852 }
1853
1854 static inline void rfcomm_process_sessions(void)
1855 {
1856         struct list_head *p, *n;
1857
1858         rfcomm_lock();
1859
1860         list_for_each_safe(p, n, &session_list) {
1861                 struct rfcomm_session *s;
1862                 s = list_entry(p, struct rfcomm_session, list);
1863
1864                 if (s->state == BT_LISTEN) {
1865                         rfcomm_accept_connection(s);
1866                         continue;
1867                 }
1868
1869                 rfcomm_session_hold(s);
1870
1871                 switch (s->state) {
1872                 case BT_BOUND:
1873                         rfcomm_check_connection(s);
1874                         break;
1875
1876                 default:
1877                         rfcomm_process_rx(s);
1878                         break;
1879                 }
1880
1881                 rfcomm_process_dlcs(s);
1882
1883                 rfcomm_session_put(s);
1884         }
1885
1886         rfcomm_unlock();
1887 }
1888
1889 static int rfcomm_add_listener(bdaddr_t *ba)
1890 {
1891         struct sockaddr_l2 addr;
1892         struct socket *sock;
1893         struct sock *sk;
1894         struct rfcomm_session *s;
1895         int    err = 0;
1896
1897         /* Create socket */
1898         err = rfcomm_l2sock_create(&sock);
1899         if (err < 0) {
1900                 BT_ERR("Create socket failed %d", err);
1901                 return err;
1902         }
1903
1904         /* Bind socket */
1905         bacpy(&addr.l2_bdaddr, ba);
1906         addr.l2_family = AF_BLUETOOTH;
1907         addr.l2_psm    = htobs(RFCOMM_PSM);
1908         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1909         if (err < 0) {
1910                 BT_ERR("Bind failed %d", err);
1911                 goto failed;
1912         }
1913
1914         /* Set L2CAP options */
1915         sk = sock->sk;
1916         lock_sock(sk);
1917         l2cap_pi(sk)->imtu = l2cap_mtu;
1918         release_sock(sk);
1919
1920         /* Start listening on the socket */
1921         err = kernel_listen(sock, 10);
1922         if (err) {
1923                 BT_ERR("Listen failed %d", err);
1924                 goto failed;
1925         }
1926
1927         /* Add listening session */
1928         s = rfcomm_session_add(sock, BT_LISTEN);
1929         if (!s)
1930                 goto failed;
1931
1932         rfcomm_session_hold(s);
1933         return 0;
1934 failed:
1935         sock_release(sock);
1936         return err;
1937 }
1938
1939 static void rfcomm_kill_listener(void)
1940 {
1941         struct rfcomm_session *s;
1942         struct list_head *p, *n;
1943
1944         BT_DBG("");
1945
1946         list_for_each_safe(p, n, &session_list) {
1947                 s = list_entry(p, struct rfcomm_session, list);
1948                 rfcomm_session_del(s);
1949         }
1950 }
1951
1952 static int rfcomm_run(void *unused)
1953 {
1954         BT_DBG("");
1955
1956         set_user_nice(current, -10);
1957
1958         rfcomm_add_listener(BDADDR_ANY);
1959
1960         while (!kthread_should_stop()) {
1961                 set_current_state(TASK_INTERRUPTIBLE);
1962                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1963                         /* No pending events. Let's sleep.
1964                          * Incoming connections and data will wake us up. */
1965                         schedule();
1966                 }
1967                 set_current_state(TASK_RUNNING);
1968
1969                 /* Process stuff */
1970                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1971                 rfcomm_process_sessions();
1972         }
1973
1974         rfcomm_kill_listener();
1975
1976         return 0;
1977 }
1978
1979 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1980 {
1981         struct rfcomm_session *s;
1982         struct rfcomm_dlc *d;
1983         struct list_head *p, *n;
1984
1985         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
1986
1987         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1988         if (!s)
1989                 return;
1990
1991         rfcomm_session_hold(s);
1992
1993         list_for_each_safe(p, n, &s->dlcs) {
1994                 d = list_entry(p, struct rfcomm_dlc, list);
1995
1996                 if (!status && encrypt == 0x00 &&
1997                                 (d->link_mode & RFCOMM_LM_ENCRYPT) &&
1998                                         (d->state == BT_CONNECTED ||
1999                                                 d->state == BT_CONFIG)) {
2000                         __rfcomm_dlc_close(d, ECONNREFUSED);
2001                         continue;
2002                 }
2003
2004                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2005                         continue;
2006
2007                 if (!status)
2008                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2009                 else
2010                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2011         }
2012
2013         rfcomm_session_put(s);
2014
2015         rfcomm_schedule(RFCOMM_SCHED_AUTH);
2016 }
2017
2018 static struct hci_cb rfcomm_cb = {
2019         .name           = "RFCOMM",
2020         .security_cfm   = rfcomm_security_cfm
2021 };
2022
2023 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2024 {
2025         struct rfcomm_session *s;
2026         struct list_head *pp, *p;
2027         char *str = buf;
2028
2029         rfcomm_lock();
2030
2031         list_for_each(p, &session_list) {
2032                 s = list_entry(p, struct rfcomm_session, list);
2033                 list_for_each(pp, &s->dlcs) {
2034                         struct sock *sk = s->sock->sk;
2035                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2036
2037                         str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2038                                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2039                                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2040                 }
2041         }
2042
2043         rfcomm_unlock();
2044
2045         return (str - buf);
2046 }
2047
2048 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2049
2050 /* ---- Initialization ---- */
2051 static int __init rfcomm_init(void)
2052 {
2053         l2cap_load();
2054
2055         hci_register_cb(&rfcomm_cb);
2056
2057         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2058         if (IS_ERR(rfcomm_thread)) {
2059                 hci_unregister_cb(&rfcomm_cb);
2060                 return PTR_ERR(rfcomm_thread);
2061         }
2062
2063         if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2064                 BT_ERR("Failed to create RFCOMM info file");
2065
2066         rfcomm_init_sockets();
2067
2068 #ifdef CONFIG_BT_RFCOMM_TTY
2069         rfcomm_init_ttys();
2070 #endif
2071
2072         BT_INFO("RFCOMM ver %s", VERSION);
2073
2074         return 0;
2075 }
2076
2077 static void __exit rfcomm_exit(void)
2078 {
2079         class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2080
2081         hci_unregister_cb(&rfcomm_cb);
2082
2083         kthread_stop(rfcomm_thread);
2084
2085 #ifdef CONFIG_BT_RFCOMM_TTY
2086         rfcomm_cleanup_ttys();
2087 #endif
2088
2089         rfcomm_cleanup_sockets();
2090 }
2091
2092 module_init(rfcomm_init);
2093 module_exit(rfcomm_exit);
2094
2095 module_param(disable_cfc, bool, 0644);
2096 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2097
2098 module_param(channel_mtu, int, 0644);
2099 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2100
2101 module_param(l2cap_mtu, uint, 0644);
2102 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2103
2104 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2105 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2106 MODULE_VERSION(VERSION);
2107 MODULE_LICENSE("GPL");
2108 MODULE_ALIAS("bt-proto-3");