net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  *
  27  * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
  28  */
  29
  30 #include <linux/module.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/signal.h>
  35 #include <linux/init.h>
  36 #include <linux/wait.h>
  37 #include <linux/device.h>
  38 #include <linux/net.h>
  39 #include <linux/mutex.h>
  40
  41 #include <net/sock.h>
  42 #include <asm/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47 #include <net/bluetooth/l2cap.h>
  48 #include <net/bluetooth/rfcomm.h>
  49
  50 #ifndef CONFIG_BT_RFCOMM_DEBUG
  51 #undef  BT_DBG
  52 #define BT_DBG(D...)
  53 #endif
  54
  55 #define VERSION "1.8"
  56
  57 static int disable_cfc = 0;
  58 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  59
  60 static struct task_struct *rfcomm_thread;
  61
  62 static DEFINE_MUTEX(rfcomm_mutex);
  63 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  64 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  65
  66 static unsigned long rfcomm_event;
  67
  68 static LIST_HEAD(session_list);
  69 static atomic_t terminate, running;
  70
  71 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  72 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  73 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  74 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  75 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  76 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  77 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  78 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  79 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  80 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  81
  82 static void rfcomm_process_connect(struct rfcomm_session *s);
  83
  84 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
  85 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  86 static void rfcomm_session_del(struct rfcomm_session *s);
  87
  88 /* ---- RFCOMM frame parsing macros ---- */
  89 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  90 #define __get_channel(b)  ((b & 0xf8) >> 3)
  91 #define __get_dir(b)      ((b & 0x04) >> 2)
  92 #define __get_type(b)     ((b & 0xef))
  93
  94 #define __test_ea(b)      ((b & 0x01))
  95 #define __test_cr(b)      ((b & 0x02))
  96 #define __test_pf(b)      ((b & 0x10))
  97
  98 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  99 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
 100 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
 101 #define __srv_channel(dlci)    (dlci >> 1)
 102 #define __dir(dlci)            (dlci & 0x01)
 103
 104 #define __len8(len)       (((len) << 1) | 1)
 105 #define __len16(len)      ((len) << 1)
 106
 107 /* MCC macros */
 108 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 109 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 110 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 111
 112 /* RPN macros */
 113 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 114 #define __get_rpn_data_bits(line) ((line) & 0x3)
 115 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 116 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 117
 118 static inline void rfcomm_schedule(uint event)
 119 {
 120         if (!rfcomm_thread)
 121                 return;
 122         //set_bit(event, &rfcomm_event);
 123         set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
 124         wake_up_process(rfcomm_thread);
 125 }
 126
 127 static inline void rfcomm_session_put(struct rfcomm_session *s)
 128 {
 129         if (atomic_dec_and_test(&s->refcnt))
 130                 rfcomm_session_del(s);
 131 }
 132
 133 /* ---- RFCOMM FCS computation ---- */
 134
 135 /* reversed, 8-bit, poly=0x07 */
 136 static unsigned char rfcomm_crc_table[256] = {
 137         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 138         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 139         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 140         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 141
 142         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 143         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 144         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 145         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 146
 147         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 148         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 149         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 150         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 151
 152         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 153         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 154         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 155         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 156
 157         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 158         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 159         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 160         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 161
 162         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 163         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 164         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 165         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 166
 167         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 168         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 169         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 170         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 171
 172         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 173         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 174         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 175         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 176 };
 177
 178 /* CRC on 2 bytes */
 179 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 180
 181 /* FCS on 2 bytes */
 182 static inline u8 __fcs(u8 *data)
 183 {
 184         return (0xff - __crc(data));
 185 }
 186
 187 /* FCS on 3 bytes */
 188 static inline u8 __fcs2(u8 *data)
 189 {
 190         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 191 }
 192
 193 /* Check FCS */
 194 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 195 {
 196         u8 f = __crc(data);
 197
 198         if (type != RFCOMM_UIH)
 199                 f = rfcomm_crc_table[f ^ data[2]];
 200
 201         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 202 }
 203
 204 /* ---- L2CAP callbacks ---- */
 205 static void rfcomm_l2state_change(struct sock *sk)
 206 {
 207         BT_DBG("%p state %d", sk, sk->sk_state);
 208         rfcomm_schedule(RFCOMM_SCHED_STATE);
 209 }
 210
 211 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 212 {
 213         BT_DBG("%p bytes %d", sk, bytes);
 214         rfcomm_schedule(RFCOMM_SCHED_RX);
 215 }
 216
 217 static int rfcomm_l2sock_create(struct socket **sock)
 218 {
 219         int err;
 220
 221         BT_DBG("");
 222
 223         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 224         if (!err) {
 225                 struct sock *sk = (*sock)->sk;
 226                 sk->sk_data_ready   = rfcomm_l2data_ready;
 227                 sk->sk_state_change = rfcomm_l2state_change;
 228         }
 229         return err;
 230 }
 231
 232 /* ---- RFCOMM DLCs ---- */
 233 static void rfcomm_dlc_timeout(unsigned long arg)
 234 {
 235         struct rfcomm_dlc *d = (void *) arg;
 236
 237         BT_DBG("dlc %p state %ld", d, d->state);
 238
 239         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 240         rfcomm_dlc_put(d);
 241         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 242 }
 243
 244 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 245 {
 246         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 247
 248         if (!mod_timer(&d->timer, jiffies + timeout))
 249                 rfcomm_dlc_hold(d);
 250 }
 251
 252 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 253 {
 254         BT_DBG("dlc %p state %ld", d, d->state);
 255
 256         if (timer_pending(&d->timer) && del_timer(&d->timer))
 257                 rfcomm_dlc_put(d);
 258 }
 259
 260 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 261 {
 262         BT_DBG("%p", d);
 263
 264         d->state      = BT_OPEN;
 265         d->flags      = 0;
 266         d->mscex      = 0;
 267         d->mtu        = RFCOMM_DEFAULT_MTU;
 268         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 269
 270         d->cfc        = RFCOMM_CFC_DISABLED;
 271         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 272 }
 273
 274 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 275 {
 276         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 277
 278         if (!d)
 279                 return NULL;
 280
 281         init_timer(&d->timer);
 282         d->timer.function = rfcomm_dlc_timeout;
 283         d->timer.data = (unsigned long) d;
 284
 285         skb_queue_head_init(&d->tx_queue);
 286         spin_lock_init(&d->lock);
 287         atomic_set(&d->refcnt, 1);
 288
 289         rfcomm_dlc_clear_state(d);
 290
 291         BT_DBG("%p", d);
 292
 293         return d;
 294 }
 295
 296 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 297 {
 298         BT_DBG("%p", d);
 299
 300         skb_queue_purge(&d->tx_queue);
 301         kfree(d);
 302 }
 303
 304 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 305 {
 306         BT_DBG("dlc %p session %p", d, s);
 307
 308         rfcomm_session_hold(s);
 309
 310         rfcomm_dlc_hold(d);
 311         list_add(&d->list, &s->dlcs);
 312         d->session = s;
 313 }
 314
 315 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 316 {
 317         struct rfcomm_session *s = d->session;
 318
 319         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 320
 321         list_del(&d->list);
 322         d->session = NULL;
 323         rfcomm_dlc_put(d);
 324
 325         rfcomm_session_put(s);
 326 }
 327
 328 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 329 {
 330         struct rfcomm_dlc *d;
 331         struct list_head *p;
 332
 333         list_for_each(p, &s->dlcs) {
 334                 d = list_entry(p, struct rfcomm_dlc, list);
 335                 if (d->dlci == dlci)
 336                         return d;
 337         }
 338         return NULL;
 339 }
 340
 341 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 342 {
 343         struct rfcomm_session *s;
 344         int err = 0;
 345         u8 dlci;
 346
 347         BT_DBG("dlc %p state %ld %s %s channel %d",
 348                         d, d->state, batostr(src), batostr(dst), channel);
 349
 350         if (channel < 1 || channel > 30)
 351                 return -EINVAL;
 352
 353         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 354                 return 0;
 355
 356         s = rfcomm_session_get(src, dst);
 357         if (!s) {
 358                 s = rfcomm_session_create(src, dst, &err);
 359                 if (!s)
 360                         return err;
 361         }
 362
 363         dlci = __dlci(!s->initiator, channel);
 364
 365         /* Check if DLCI already exists */
 366         if (rfcomm_dlc_get(s, dlci))
 367                 return -EBUSY;
 368
 369         rfcomm_dlc_clear_state(d);
 370
 371         d->dlci     = dlci;
 372         d->addr     = __addr(s->initiator, dlci);
 373         d->priority = 7;
 374
 375         d->state    = BT_CONFIG;
 376         rfcomm_dlc_link(s, d);
 377
 378         d->mtu = s->mtu;
 379         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 380
 381         if (s->state == BT_CONNECTED)
 382                 rfcomm_send_pn(s, 1, d);
 383         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 384         return 0;
 385 }
 386
 387 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 388 {
 389         int r;
 390
 391         rfcomm_lock();
 392
 393         r = __rfcomm_dlc_open(d, src, dst, channel);
 394
 395         rfcomm_unlock();
 396         return r;
 397 }
 398
 399 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 400 {
 401         struct rfcomm_session *s = d->session;
 402         if (!s)
 403                 return 0;
 404
 405         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 406                         d, d->state, d->dlci, err, s);
 407
 408         switch (d->state) {
 409         case BT_CONNECTED:
 410         case BT_CONFIG:
 411         case BT_CONNECT:
 412                 d->state = BT_DISCONN;
 413                 if (skb_queue_empty(&d->tx_queue)) {
 414                         rfcomm_send_disc(s, d->dlci);
 415                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 416                 } else {
 417                         rfcomm_queue_disc(d);
 418                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 419                 }
 420                 break;
 421
 422         default:
 423                 rfcomm_dlc_clear_timer(d);
 424
 425                 rfcomm_dlc_lock(d);
 426                 d->state = BT_CLOSED;
 427                 d->state_change(d, err);
 428                 rfcomm_dlc_unlock(d);
 429
 430                 skb_queue_purge(&d->tx_queue);
 431                 rfcomm_dlc_unlink(d);
 432         }
 433
 434         return 0;
 435 }
 436
 437 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 438 {
 439         int r;
 440
 441         rfcomm_lock();
 442
 443         r = __rfcomm_dlc_close(d, err);
 444
 445         rfcomm_unlock();
 446         return r;
 447 }
 448
 449 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 450 {
 451         int len = skb->len;
 452
 453         if (d->state != BT_CONNECTED)
 454                 return -ENOTCONN;
 455
 456         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 457
 458         if (len > d->mtu)
 459                 return -EINVAL;
 460
 461         rfcomm_make_uih(skb, d->addr);
 462         skb_queue_tail(&d->tx_queue, skb);
 463
 464         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 465                 rfcomm_schedule(RFCOMM_SCHED_TX);
 466         return len;
 467 }
 468
 469 void fastcall __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 470 {
 471         BT_DBG("dlc %p state %ld", d, d->state);
 472
 473         if (!d->cfc) {
 474                 d->v24_sig |= RFCOMM_V24_FC;
 475                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 476         }
 477         rfcomm_schedule(RFCOMM_SCHED_TX);
 478 }
 479
 480 void fastcall __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 481 {
 482         BT_DBG("dlc %p state %ld", d, d->state);
 483
 484         if (!d->cfc) {
 485                 d->v24_sig &= ~RFCOMM_V24_FC;
 486                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 487         }
 488         rfcomm_schedule(RFCOMM_SCHED_TX);
 489 }
 490
 491 /*
 492    Set/get modem status functions use _local_ status i.e. what we report
 493    to the other side.
 494    Remote status is provided by dlc->modem_status() callback.
 495  */
 496 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 497 {
 498         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 499                         d, d->state, v24_sig);
 500
 501         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 502                 v24_sig |= RFCOMM_V24_FC;
 503         else
 504                 v24_sig &= ~RFCOMM_V24_FC;
 505
 506         d->v24_sig = v24_sig;
 507
 508         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 509                 rfcomm_schedule(RFCOMM_SCHED_TX);
 510
 511         return 0;
 512 }
 513
 514 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 515 {
 516         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 517                         d, d->state, d->v24_sig);
 518
 519         *v24_sig = d->v24_sig;
 520         return 0;
 521 }
 522
 523 /* ---- RFCOMM sessions ---- */
 524 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 525 {
 526         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 527
 528         if (!s)
 529                 return NULL;
 530
 531         BT_DBG("session %p sock %p", s, sock);
 532
 533         INIT_LIST_HEAD(&s->dlcs);
 534         s->state = state;
 535         s->sock  = sock;
 536
 537         s->mtu = RFCOMM_DEFAULT_MTU;
 538         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 539
 540         /* Do not increment module usage count for listening sessions.
 541          * Otherwise we won't be able to unload the module. */
 542         if (state != BT_LISTEN)
 543                 if (!try_module_get(THIS_MODULE)) {
 544                         kfree(s);
 545                         return NULL;
 546                 }
 547
 548         list_add(&s->list, &session_list);
 549
 550         return s;
 551 }
 552
 553 static void rfcomm_session_del(struct rfcomm_session *s)
 554 {
 555         int state = s->state;
 556
 557         BT_DBG("session %p state %ld", s, s->state);
 558
 559         list_del(&s->list);
 560
 561         if (state == BT_CONNECTED)
 562                 rfcomm_send_disc(s, 0);
 563
 564         sock_release(s->sock);
 565         kfree(s);
 566
 567         if (state != BT_LISTEN)
 568                 module_put(THIS_MODULE);
 569 }
 570
 571 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 572 {
 573         struct rfcomm_session *s;
 574         struct list_head *p, *n;
 575         struct bt_sock *sk;
 576         list_for_each_safe(p, n, &session_list) {
 577                 s = list_entry(p, struct rfcomm_session, list);
 578                 sk = bt_sk(s->sock->sk);
 579
 580                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 581                                 !bacmp(&sk->dst, dst))
 582                         return s;
 583         }
 584         return NULL;
 585 }
 586
 587 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 588 {
 589         struct rfcomm_dlc *d;
 590         struct list_head *p, *n;
 591
 592         BT_DBG("session %p state %ld err %d", s, s->state, err);
 593
 594         rfcomm_session_hold(s);
 595
 596         s->state = BT_CLOSED;
 597
 598         /* Close all dlcs */
 599         list_for_each_safe(p, n, &s->dlcs) {
 600                 d = list_entry(p, struct rfcomm_dlc, list);
 601                 d->state = BT_CLOSED;
 602                 __rfcomm_dlc_close(d, err);
 603         }
 604
 605         rfcomm_session_put(s);
 606 }
 607
 608 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 609 {
 610         struct rfcomm_session *s = NULL;
 611         struct sockaddr_l2 addr;
 612         struct socket *sock;
 613         struct sock *sk;
 614
 615         BT_DBG("%s %s", batostr(src), batostr(dst));
 616
 617         *err = rfcomm_l2sock_create(&sock);
 618         if (*err < 0)
 619                 return NULL;
 620
 621         bacpy(&addr.l2_bdaddr, src);
 622         addr.l2_family = AF_BLUETOOTH;
 623         addr.l2_psm    = 0;
 624         *err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 625         if (*err < 0)
 626                 goto failed;
 627
 628         /* Set L2CAP options */
 629         sk = sock->sk;
 630         lock_sock(sk);
 631         l2cap_pi(sk)->imtu = l2cap_mtu;
 632         release_sock(sk);
 633
 634         s = rfcomm_session_add(sock, BT_BOUND);
 635         if (!s) {
 636                 *err = -ENOMEM;
 637                 goto failed;
 638         }
 639
 640         s->initiator = 1;
 641
 642         bacpy(&addr.l2_bdaddr, dst);
 643         addr.l2_family = AF_BLUETOOTH;
 644         addr.l2_psm    = htobs(RFCOMM_PSM);
 645         *err = sock->ops->connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 646         if (*err == 0 || *err == -EAGAIN)
 647                 return s;
 648
 649         rfcomm_session_del(s);
 650         return NULL;
 651
 652 failed:
 653         sock_release(sock);
 654         return NULL;
 655 }
 656
 657 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 658 {
 659         struct sock *sk = s->sock->sk;
 660         if (src)
 661                 bacpy(src, &bt_sk(sk)->src);
 662         if (dst)
 663                 bacpy(dst, &bt_sk(sk)->dst);
 664 }
 665
 666 /* ---- RFCOMM frame sending ---- */
 667 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 668 {
 669         struct socket *sock = s->sock;
 670         struct kvec iv = { data, len };
 671         struct msghdr msg;
 672
 673         BT_DBG("session %p len %d", s, len);
 674
 675         memset(&msg, 0, sizeof(msg));
 676
 677         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 678 }
 679
 680 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 681 {
 682         struct rfcomm_cmd cmd;
 683
 684         BT_DBG("%p dlci %d", s, dlci);
 685
 686         cmd.addr = __addr(s->initiator, dlci);
 687         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 688         cmd.len  = __len8(0);
 689         cmd.fcs  = __fcs2((u8 *) &cmd);
 690
 691         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 692 }
 693
 694 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 695 {
 696         struct rfcomm_cmd cmd;
 697
 698         BT_DBG("%p dlci %d", s, dlci);
 699
 700         cmd.addr = __addr(!s->initiator, dlci);
 701         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 702         cmd.len  = __len8(0);
 703         cmd.fcs  = __fcs2((u8 *) &cmd);
 704
 705         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 706 }
 707
 708 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 709 {
 710         struct rfcomm_cmd cmd;
 711
 712         BT_DBG("%p dlci %d", s, dlci);
 713
 714         cmd.addr = __addr(s->initiator, dlci);
 715         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 716         cmd.len  = __len8(0);
 717         cmd.fcs  = __fcs2((u8 *) &cmd);
 718
 719         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 720 }
 721
 722 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 723 {
 724         struct rfcomm_cmd *cmd;
 725         struct sk_buff *skb;
 726
 727         BT_DBG("dlc %p dlci %d", d, d->dlci);
 728
 729         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 730         if (!skb)
 731                 return -ENOMEM;
 732
 733         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 734         cmd->addr = d->addr;
 735         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 736         cmd->len  = __len8(0);
 737         cmd->fcs  = __fcs2((u8 *) cmd);
 738
 739         skb_queue_tail(&d->tx_queue, skb);
 740         rfcomm_schedule(RFCOMM_SCHED_TX);
 741         return 0;
 742 }
 743
 744 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 745 {
 746         struct rfcomm_cmd cmd;
 747
 748         BT_DBG("%p dlci %d", s, dlci);
 749
 750         cmd.addr = __addr(!s->initiator, dlci);
 751         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 752         cmd.len  = __len8(0);
 753         cmd.fcs  = __fcs2((u8 *) &cmd);
 754
 755         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 756 }
 757
 758 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 759 {
 760         struct rfcomm_hdr *hdr;
 761         struct rfcomm_mcc *mcc;
 762         u8 buf[16], *ptr = buf;
 763
 764         BT_DBG("%p cr %d type %d", s, cr, type);
 765
 766         hdr = (void *) ptr; ptr += sizeof(*hdr);
 767         hdr->addr = __addr(s->initiator, 0);
 768         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 769         hdr->len  = __len8(sizeof(*mcc) + 1);
 770
 771         mcc = (void *) ptr; ptr += sizeof(*mcc);
 772         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 773         mcc->len  = __len8(1);
 774
 775         /* Type that we didn't like */
 776         *ptr = __mcc_type(cr, type); ptr++;
 777
 778         *ptr = __fcs(buf); ptr++;
 779
 780         return rfcomm_send_frame(s, buf, ptr - buf);
 781 }
 782
 783 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 784 {
 785         struct rfcomm_hdr *hdr;
 786         struct rfcomm_mcc *mcc;
 787         struct rfcomm_pn  *pn;
 788         u8 buf[16], *ptr = buf;
 789
 790         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 791
 792         hdr = (void *) ptr; ptr += sizeof(*hdr);
 793         hdr->addr = __addr(s->initiator, 0);
 794         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 795         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 796
 797         mcc = (void *) ptr; ptr += sizeof(*mcc);
 798         mcc->type = __mcc_type(cr, RFCOMM_PN);
 799         mcc->len  = __len8(sizeof(*pn));
 800
 801         pn = (void *) ptr; ptr += sizeof(*pn);
 802         pn->dlci        = d->dlci;
 803         pn->priority    = d->priority;
 804         pn->ack_timer   = 0;
 805         pn->max_retrans = 0;
 806
 807         if (s->cfc) {
 808                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 809                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 810         } else {
 811                 pn->flow_ctrl = 0;
 812                 pn->credits   = 0;
 813         }
 814
 815         pn->mtu = htobs(d->mtu);
 816
 817         *ptr = __fcs(buf); ptr++;
 818
 819         return rfcomm_send_frame(s, buf, ptr - buf);
 820 }
 821
 822 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 823                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 824                         u8 parity, u8 flow_ctrl_settings,
 825                         u8 xon_char, u8 xoff_char, u16 param_mask)
 826 {
 827         struct rfcomm_hdr *hdr;
 828         struct rfcomm_mcc *mcc;
 829         struct rfcomm_rpn *rpn;
 830         u8 buf[16], *ptr = buf;
 831
 832         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 833                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 834                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 835                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 836
 837         hdr = (void *) ptr; ptr += sizeof(*hdr);
 838         hdr->addr = __addr(s->initiator, 0);
 839         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 840         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 841
 842         mcc = (void *) ptr; ptr += sizeof(*mcc);
 843         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 844         mcc->len  = __len8(sizeof(*rpn));
 845
 846         rpn = (void *) ptr; ptr += sizeof(*rpn);
 847         rpn->dlci          = __addr(1, dlci);
 848         rpn->bit_rate      = bit_rate;
 849         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 850         rpn->flow_ctrl     = flow_ctrl_settings;
 851         rpn->xon_char      = xon_char;
 852         rpn->xoff_char     = xoff_char;
 853         rpn->param_mask    = param_mask;
 854
 855         *ptr = __fcs(buf); ptr++;
 856
 857         return rfcomm_send_frame(s, buf, ptr - buf);
 858 }
 859
 860 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 861 {
 862         struct rfcomm_hdr *hdr;
 863         struct rfcomm_mcc *mcc;
 864         struct rfcomm_rls *rls;
 865         u8 buf[16], *ptr = buf;
 866
 867         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 868
 869         hdr = (void *) ptr; ptr += sizeof(*hdr);
 870         hdr->addr = __addr(s->initiator, 0);
 871         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 872         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 873
 874         mcc = (void *) ptr; ptr += sizeof(*mcc);
 875         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 876         mcc->len  = __len8(sizeof(*rls));
 877
 878         rls = (void *) ptr; ptr += sizeof(*rls);
 879         rls->dlci   = __addr(1, dlci);
 880         rls->status = status;
 881
 882         *ptr = __fcs(buf); ptr++;
 883
 884         return rfcomm_send_frame(s, buf, ptr - buf);
 885 }
 886
 887 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 888 {
 889         struct rfcomm_hdr *hdr;
 890         struct rfcomm_mcc *mcc;
 891         struct rfcomm_msc *msc;
 892         u8 buf[16], *ptr = buf;
 893
 894         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 895
 896         hdr = (void *) ptr; ptr += sizeof(*hdr);
 897         hdr->addr = __addr(s->initiator, 0);
 898         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 899         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 900
 901         mcc = (void *) ptr; ptr += sizeof(*mcc);
 902         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 903         mcc->len  = __len8(sizeof(*msc));
 904
 905         msc = (void *) ptr; ptr += sizeof(*msc);
 906         msc->dlci    = __addr(1, dlci);
 907         msc->v24_sig = v24_sig | 0x01;
 908
 909         *ptr = __fcs(buf); ptr++;
 910
 911         return rfcomm_send_frame(s, buf, ptr - buf);
 912 }
 913
 914 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 915 {
 916         struct rfcomm_hdr *hdr;
 917         struct rfcomm_mcc *mcc;
 918         u8 buf[16], *ptr = buf;
 919
 920         BT_DBG("%p cr %d", s, cr);
 921
 922         hdr = (void *) ptr; ptr += sizeof(*hdr);
 923         hdr->addr = __addr(s->initiator, 0);
 924         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 925         hdr->len  = __len8(sizeof(*mcc));
 926
 927         mcc = (void *) ptr; ptr += sizeof(*mcc);
 928         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
 929         mcc->len  = __len8(0);
 930
 931         *ptr = __fcs(buf); ptr++;
 932
 933         return rfcomm_send_frame(s, buf, ptr - buf);
 934 }
 935
 936 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
 937 {
 938         struct rfcomm_hdr *hdr;
 939         struct rfcomm_mcc *mcc;
 940         u8 buf[16], *ptr = buf;
 941
 942         BT_DBG("%p cr %d", s, cr);
 943
 944         hdr = (void *) ptr; ptr += sizeof(*hdr);
 945         hdr->addr = __addr(s->initiator, 0);
 946         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 947         hdr->len  = __len8(sizeof(*mcc));
 948
 949         mcc = (void *) ptr; ptr += sizeof(*mcc);
 950         mcc->type = __mcc_type(cr, RFCOMM_FCON);
 951         mcc->len  = __len8(0);
 952
 953         *ptr = __fcs(buf); ptr++;
 954
 955         return rfcomm_send_frame(s, buf, ptr - buf);
 956 }
 957
 958 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
 959 {
 960         struct socket *sock = s->sock;
 961         struct kvec iv[3];
 962         struct msghdr msg;
 963         unsigned char hdr[5], crc[1];
 964
 965         if (len > 125)
 966                 return -EINVAL;
 967
 968         BT_DBG("%p cr %d", s, cr);
 969
 970         hdr[0] = __addr(s->initiator, 0);
 971         hdr[1] = __ctrl(RFCOMM_UIH, 0);
 972         hdr[2] = 0x01 | ((len + 2) << 1);
 973         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
 974         hdr[4] = 0x01 | (len << 1);
 975
 976         crc[0] = __fcs(hdr);
 977
 978         iv[0].iov_base = hdr;
 979         iv[0].iov_len  = 5;
 980         iv[1].iov_base = pattern;
 981         iv[1].iov_len  = len;
 982         iv[2].iov_base = crc;
 983         iv[2].iov_len  = 1;
 984
 985         memset(&msg, 0, sizeof(msg));
 986
 987         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
 988 }
 989
 990 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
 991 {
 992         struct rfcomm_hdr *hdr;
 993         u8 buf[16], *ptr = buf;
 994
 995         BT_DBG("%p addr %d credits %d", s, addr, credits);
 996
 997         hdr = (void *) ptr; ptr += sizeof(*hdr);
 998         hdr->addr = addr;
 999         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1000         hdr->len  = __len8(0);
1001
1002         *ptr = credits; ptr++;
1003
1004         *ptr = __fcs(buf); ptr++;
1005
1006         return rfcomm_send_frame(s, buf, ptr - buf);
1007 }
1008
1009 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1010 {
1011         struct rfcomm_hdr *hdr;
1012         int len = skb->len;
1013         u8 *crc;
1014
1015         if (len > 127) {
1016                 hdr = (void *) skb_push(skb, 4);
1017                 put_unaligned(htobs(__len16(len)), (u16 *) &hdr->len);
1018         } else {
1019                 hdr = (void *) skb_push(skb, 3);
1020                 hdr->len = __len8(len);
1021         }
1022         hdr->addr = addr;
1023         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1024
1025         crc = skb_put(skb, 1);
1026         *crc = __fcs((void *) hdr);
1027 }
1028
1029 /* ---- RFCOMM frame reception ---- */
1030 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1031 {
1032         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1033
1034         if (dlci) {
1035                 /* Data channel */
1036                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1037                 if (!d) {
1038                         rfcomm_send_dm(s, dlci);
1039                         return 0;
1040                 }
1041
1042                 switch (d->state) {
1043                 case BT_CONNECT:
1044                         rfcomm_dlc_clear_timer(d);
1045
1046                         rfcomm_dlc_lock(d);
1047                         d->state = BT_CONNECTED;
1048                         d->state_change(d, 0);
1049                         rfcomm_dlc_unlock(d);
1050
1051                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1052                         break;
1053
1054                 case BT_DISCONN:
1055                         d->state = BT_CLOSED;
1056                         __rfcomm_dlc_close(d, 0);
1057                         break;
1058                 }
1059         } else {
1060                 /* Control channel */
1061                 switch (s->state) {
1062                 case BT_CONNECT:
1063                         s->state = BT_CONNECTED;
1064                         rfcomm_process_connect(s);
1065                         break;
1066                 }
1067         }
1068         return 0;
1069 }
1070
1071 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1072 {
1073         int err = 0;
1074
1075         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1076
1077         if (dlci) {
1078                 /* Data DLC */
1079                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1080                 if (d) {
1081                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1082                                 err = ECONNREFUSED;
1083                         else
1084                                 err = ECONNRESET;
1085
1086                         d->state = BT_CLOSED;
1087                         __rfcomm_dlc_close(d, err);
1088                 }
1089         } else {
1090                 if (s->state == BT_CONNECT)
1091                         err = ECONNREFUSED;
1092                 else
1093                         err = ECONNRESET;
1094
1095                 s->state = BT_CLOSED;
1096                 rfcomm_session_close(s, err);
1097         }
1098         return 0;
1099 }
1100
1101 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1102 {
1103         int err = 0;
1104
1105         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1106
1107         if (dlci) {
1108                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1109                 if (d) {
1110                         rfcomm_send_ua(s, dlci);
1111
1112                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1113                                 err = ECONNREFUSED;
1114                         else
1115                                 err = ECONNRESET;
1116
1117                         d->state = BT_CLOSED;
1118                         __rfcomm_dlc_close(d, err);
1119                 } else
1120                         rfcomm_send_dm(s, dlci);
1121
1122         } else {
1123                 rfcomm_send_ua(s, 0);
1124
1125                 if (s->state == BT_CONNECT)
1126                         err = ECONNREFUSED;
1127                 else
1128                         err = ECONNRESET;
1129
1130                 s->state = BT_CLOSED;
1131                 rfcomm_session_close(s, err);
1132         }
1133
1134         return 0;
1135 }
1136
1137 static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
1138 {
1139         struct sock *sk = d->session->sock->sk;
1140
1141         if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
1142                 if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
1143                         return 1;
1144         } else if (d->link_mode & RFCOMM_LM_AUTH) {
1145                 if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
1146                         return 1;
1147         }
1148
1149         return 0;
1150 }
1151
1152 static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1153 {
1154         struct sock *sk = d->session->sock->sk;
1155
1156         BT_DBG("dlc %p", d);
1157
1158         rfcomm_send_ua(d->session, d->dlci);
1159
1160         rfcomm_dlc_lock(d);
1161         d->state = BT_CONNECTED;
1162         d->state_change(d, 0);
1163         rfcomm_dlc_unlock(d);
1164
1165         if (d->link_mode & RFCOMM_LM_MASTER)
1166                 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1167
1168         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1169 }
1170
1171 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1172 {
1173         struct rfcomm_dlc *d;
1174         u8 channel;
1175
1176         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1177
1178         if (!dlci) {
1179                 rfcomm_send_ua(s, 0);
1180
1181                 if (s->state == BT_OPEN) {
1182                         s->state = BT_CONNECTED;
1183                         rfcomm_process_connect(s);
1184                 }
1185                 return 0;
1186         }
1187
1188         /* Check if DLC exists */
1189         d = rfcomm_dlc_get(s, dlci);
1190         if (d) {
1191                 if (d->state == BT_OPEN) {
1192                         /* DLC was previously opened by PN request */
1193                         if (rfcomm_check_link_mode(d)) {
1194                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1195                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1196                                 return 0;
1197                         }
1198
1199                         rfcomm_dlc_accept(d);
1200                 }
1201                 return 0;
1202         }
1203
1204         /* Notify socket layer about incoming connection */
1205         channel = __srv_channel(dlci);
1206         if (rfcomm_connect_ind(s, channel, &d)) {
1207                 d->dlci = dlci;
1208                 d->addr = __addr(s->initiator, dlci);
1209                 rfcomm_dlc_link(s, d);
1210
1211                 if (rfcomm_check_link_mode(d)) {
1212                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1213                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1214                         return 0;
1215                 }
1216
1217                 rfcomm_dlc_accept(d);
1218         } else {
1219                 rfcomm_send_dm(s, dlci);
1220         }
1221
1222         return 0;
1223 }
1224
1225 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1226 {
1227         struct rfcomm_session *s = d->session;
1228
1229         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1230                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1231
1232         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1233                                                 pn->flow_ctrl == 0xe0) {
1234                 d->cfc = RFCOMM_CFC_ENABLED;
1235                 d->tx_credits = pn->credits;
1236         } else {
1237                 d->cfc = RFCOMM_CFC_DISABLED;
1238                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1239         }
1240
1241         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1242                 s->cfc = d->cfc;
1243
1244         d->priority = pn->priority;
1245
1246         d->mtu = s->mtu = btohs(pn->mtu);
1247
1248         return 0;
1249 }
1250
1251 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1252 {
1253         struct rfcomm_pn *pn = (void *) skb->data;
1254         struct rfcomm_dlc *d;
1255         u8 dlci = pn->dlci;
1256
1257         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1258
1259         if (!dlci)
1260                 return 0;
1261
1262         d = rfcomm_dlc_get(s, dlci);
1263         if (d) {
1264                 if (cr) {
1265                         /* PN request */
1266                         rfcomm_apply_pn(d, cr, pn);
1267                         rfcomm_send_pn(s, 0, d);
1268                 } else {
1269                         /* PN response */
1270                         switch (d->state) {
1271                         case BT_CONFIG:
1272                                 rfcomm_apply_pn(d, cr, pn);
1273
1274                                 d->state = BT_CONNECT;
1275                                 rfcomm_send_sabm(s, d->dlci);
1276                                 break;
1277                         }
1278                 }
1279         } else {
1280                 u8 channel = __srv_channel(dlci);
1281
1282                 if (!cr)
1283                         return 0;
1284
1285                 /* PN request for non existing DLC.
1286                  * Assume incoming connection. */
1287                 if (rfcomm_connect_ind(s, channel, &d)) {
1288                         d->dlci = dlci;
1289                         d->addr = __addr(s->initiator, dlci);
1290                         rfcomm_dlc_link(s, d);
1291
1292                         rfcomm_apply_pn(d, cr, pn);
1293
1294                         d->state = BT_OPEN;
1295                         rfcomm_send_pn(s, 0, d);
1296                 } else {
1297                         rfcomm_send_dm(s, dlci);
1298                 }
1299         }
1300         return 0;
1301 }
1302
1303 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1304 {
1305         struct rfcomm_rpn *rpn = (void *) skb->data;
1306         u8 dlci = __get_dlci(rpn->dlci);
1307
1308         u8 bit_rate  = 0;
1309         u8 data_bits = 0;
1310         u8 stop_bits = 0;
1311         u8 parity    = 0;
1312         u8 flow_ctrl = 0;
1313         u8 xon_char  = 0;
1314         u8 xoff_char = 0;
1315         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1316
1317         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1318                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1319                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1320
1321         if (!cr)
1322                 return 0;
1323
1324         if (len == 1) {
1325                 /* This is a request, return default settings */
1326                 bit_rate  = RFCOMM_RPN_BR_115200;
1327                 data_bits = RFCOMM_RPN_DATA_8;
1328                 stop_bits = RFCOMM_RPN_STOP_1;
1329                 parity    = RFCOMM_RPN_PARITY_NONE;
1330                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1331                 xon_char  = RFCOMM_RPN_XON_CHAR;
1332                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1333                 goto rpn_out;
1334         }
1335
1336         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1337          * no parity, no flow control lines, normal XON/XOFF chars */
1338
1339         if (rpn->param_mask & RFCOMM_RPN_PM_BITRATE) {
1340                 bit_rate = rpn->bit_rate;
1341                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1342                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1343                         bit_rate = RFCOMM_RPN_BR_115200;
1344                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1345                 }
1346         }
1347
1348         if (rpn->param_mask & RFCOMM_RPN_PM_DATA) {
1349                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1350                 if (data_bits != RFCOMM_RPN_DATA_8) {
1351                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1352                         data_bits = RFCOMM_RPN_DATA_8;
1353                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1354                 }
1355         }
1356
1357         if (rpn->param_mask & RFCOMM_RPN_PM_STOP) {
1358                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1359                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1360                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1361                         stop_bits = RFCOMM_RPN_STOP_1;
1362                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1363                 }
1364         }
1365
1366         if (rpn->param_mask & RFCOMM_RPN_PM_PARITY) {
1367                 parity = __get_rpn_parity(rpn->line_settings);
1368                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1369                         BT_DBG("RPN parity mismatch 0x%x", parity);
1370                         parity = RFCOMM_RPN_PARITY_NONE;
1371                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1372                 }
1373         }
1374
1375         if (rpn->param_mask & RFCOMM_RPN_PM_FLOW) {
1376                 flow_ctrl = rpn->flow_ctrl;
1377                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1378                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1379                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1380                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1381                 }
1382         }
1383
1384         if (rpn->param_mask & RFCOMM_RPN_PM_XON) {
1385                 xon_char = rpn->xon_char;
1386                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1387                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1388                         xon_char = RFCOMM_RPN_XON_CHAR;
1389                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1390                 }
1391         }
1392
1393         if (rpn->param_mask & RFCOMM_RPN_PM_XOFF) {
1394                 xoff_char = rpn->xoff_char;
1395                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1396                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1397                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1398                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1399                 }
1400         }
1401
1402 rpn_out:
1403         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1404                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1405
1406         return 0;
1407 }
1408
1409 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1410 {
1411         struct rfcomm_rls *rls = (void *) skb->data;
1412         u8 dlci = __get_dlci(rls->dlci);
1413
1414         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1415
1416         if (!cr)
1417                 return 0;
1418
1419         /* We should probably do something with this information here. But
1420          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1421          * mandatory to recognise and respond to RLS */
1422
1423         rfcomm_send_rls(s, 0, dlci, rls->status);
1424
1425         return 0;
1426 }
1427
1428 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1429 {
1430         struct rfcomm_msc *msc = (void *) skb->data;
1431         struct rfcomm_dlc *d;
1432         u8 dlci = __get_dlci(msc->dlci);
1433
1434         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1435
1436         d = rfcomm_dlc_get(s, dlci);
1437         if (!d)
1438                 return 0;
1439
1440         if (cr) {
1441                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1442                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1443                 else
1444                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1445
1446                 rfcomm_dlc_lock(d);
1447                 if (d->modem_status)
1448                         d->modem_status(d, msc->v24_sig);
1449                 rfcomm_dlc_unlock(d);
1450
1451                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1452
1453                 d->mscex |= RFCOMM_MSCEX_RX;
1454         } else
1455                 d->mscex |= RFCOMM_MSCEX_TX;
1456
1457         return 0;
1458 }
1459
1460 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1461 {
1462         struct rfcomm_mcc *mcc = (void *) skb->data;
1463         u8 type, cr, len;
1464
1465         cr   = __test_cr(mcc->type);
1466         type = __get_mcc_type(mcc->type);
1467         len  = __get_mcc_len(mcc->len);
1468
1469         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1470
1471         skb_pull(skb, 2);
1472
1473         switch (type) {
1474         case RFCOMM_PN:
1475                 rfcomm_recv_pn(s, cr, skb);
1476                 break;
1477
1478         case RFCOMM_RPN:
1479                 rfcomm_recv_rpn(s, cr, len, skb);
1480                 break;
1481
1482         case RFCOMM_RLS:
1483                 rfcomm_recv_rls(s, cr, skb);
1484                 break;
1485
1486         case RFCOMM_MSC:
1487                 rfcomm_recv_msc(s, cr, skb);
1488                 break;
1489
1490         case RFCOMM_FCOFF:
1491                 if (cr) {
1492                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1493                         rfcomm_send_fcoff(s, 0);
1494                 }
1495                 break;
1496
1497         case RFCOMM_FCON:
1498                 if (cr) {
1499                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1500                         rfcomm_send_fcon(s, 0);
1501                 }
1502                 break;
1503
1504         case RFCOMM_TEST:
1505                 if (cr)
1506                         rfcomm_send_test(s, 0, skb->data, skb->len);
1507                 break;
1508
1509         case RFCOMM_NSC:
1510                 break;
1511
1512         default:
1513                 BT_ERR("Unknown control type 0x%02x", type);
1514                 rfcomm_send_nsc(s, cr, type);
1515                 break;
1516         }
1517         return 0;
1518 }
1519
1520 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1521 {
1522         struct rfcomm_dlc *d;
1523
1524         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1525
1526         d = rfcomm_dlc_get(s, dlci);
1527         if (!d) {
1528                 rfcomm_send_dm(s, dlci);
1529                 goto drop;
1530         }
1531
1532         if (pf && d->cfc) {
1533                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1534
1535                 d->tx_credits += credits;
1536                 if (d->tx_credits)
1537                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1538         }
1539
1540         if (skb->len && d->state == BT_CONNECTED) {
1541                 rfcomm_dlc_lock(d);
1542                 d->rx_credits--;
1543                 d->data_ready(d, skb);
1544                 rfcomm_dlc_unlock(d);
1545                 return 0;
1546         }
1547
1548 drop:
1549         kfree_skb(skb);
1550         return 0;
1551 }
1552
1553 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1554 {
1555         struct rfcomm_hdr *hdr = (void *) skb->data;
1556         u8 type, dlci, fcs;
1557
1558         dlci = __get_dlci(hdr->addr);
1559         type = __get_type(hdr->ctrl);
1560
1561         /* Trim FCS */
1562         skb->len--; skb->tail--;
1563         fcs = *(u8 *) skb->tail;
1564
1565         if (__check_fcs(skb->data, type, fcs)) {
1566                 BT_ERR("bad checksum in packet");
1567                 kfree_skb(skb);
1568                 return -EILSEQ;
1569         }
1570
1571         if (__test_ea(hdr->len))
1572                 skb_pull(skb, 3);
1573         else
1574                 skb_pull(skb, 4);
1575
1576         switch (type) {
1577         case RFCOMM_SABM:
1578                 if (__test_pf(hdr->ctrl))
1579                         rfcomm_recv_sabm(s, dlci);
1580                 break;
1581
1582         case RFCOMM_DISC:
1583                 if (__test_pf(hdr->ctrl))
1584                         rfcomm_recv_disc(s, dlci);
1585                 break;
1586
1587         case RFCOMM_UA:
1588                 if (__test_pf(hdr->ctrl))
1589                         rfcomm_recv_ua(s, dlci);
1590                 break;
1591
1592         case RFCOMM_DM:
1593                 rfcomm_recv_dm(s, dlci);
1594                 break;
1595
1596         case RFCOMM_UIH:
1597                 if (dlci)
1598                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1599
1600                 rfcomm_recv_mcc(s, skb);
1601                 break;
1602
1603         default:
1604                 BT_ERR("Unknown packet type 0x%02x\n", type);
1605                 break;
1606         }
1607         kfree_skb(skb);
1608         return 0;
1609 }
1610
1611 /* ---- Connection and data processing ---- */
1612
1613 static void rfcomm_process_connect(struct rfcomm_session *s)
1614 {
1615         struct rfcomm_dlc *d;
1616         struct list_head *p, *n;
1617
1618         BT_DBG("session %p state %ld", s, s->state);
1619
1620         list_for_each_safe(p, n, &s->dlcs) {
1621                 d = list_entry(p, struct rfcomm_dlc, list);
1622                 if (d->state == BT_CONFIG) {
1623                         d->mtu = s->mtu;
1624                         rfcomm_send_pn(s, 1, d);
1625                 }
1626         }
1627 }
1628
1629 /* Send data queued for the DLC.
1630  * Return number of frames left in the queue.
1631  */
1632 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1633 {
1634         struct sk_buff *skb;
1635         int err;
1636
1637         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1638                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1639
1640         /* Send pending MSC */
1641         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1642                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1643
1644         if (d->cfc) {
1645                 /* CFC enabled.
1646                  * Give them some credits */
1647                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1648                                 d->rx_credits <= (d->cfc >> 2)) {
1649                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1650                         d->rx_credits = d->cfc;
1651                 }
1652         } else {
1653                 /* CFC disabled.
1654                  * Give ourselves some credits */
1655                 d->tx_credits = 5;
1656         }
1657
1658         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1659                 return skb_queue_len(&d->tx_queue);
1660
1661         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1662                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1663                 if (err < 0) {
1664                         skb_queue_head(&d->tx_queue, skb);
1665                         break;
1666                 }
1667                 kfree_skb(skb);
1668                 d->tx_credits--;
1669         }
1670
1671         if (d->cfc && !d->tx_credits) {
1672                 /* We're out of TX credits.
1673                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1674                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1675         }
1676
1677         return skb_queue_len(&d->tx_queue);
1678 }
1679
1680 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1681 {
1682         struct rfcomm_dlc *d;
1683         struct list_head *p, *n;
1684
1685         BT_DBG("session %p state %ld", s, s->state);
1686
1687         list_for_each_safe(p, n, &s->dlcs) {
1688                 d = list_entry(p, struct rfcomm_dlc, list);
1689
1690                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1691                         __rfcomm_dlc_close(d, ETIMEDOUT);
1692                         continue;
1693                 }
1694
1695                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1696                         rfcomm_dlc_clear_timer(d);
1697                         rfcomm_dlc_accept(d);
1698                         if (d->link_mode & RFCOMM_LM_SECURE) {
1699                                 struct sock *sk = s->sock->sk;
1700                                 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
1701                         }
1702                         continue;
1703                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1704                         rfcomm_dlc_clear_timer(d);
1705                         rfcomm_send_dm(s, d->dlci);
1706                         __rfcomm_dlc_close(d, ECONNREFUSED);
1707                         continue;
1708                 }
1709
1710                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1711                         continue;
1712
1713                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1714                                 d->mscex == RFCOMM_MSCEX_OK)
1715                         rfcomm_process_tx(d);
1716         }
1717 }
1718
1719 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1720 {
1721         struct socket *sock = s->sock;
1722         struct sock *sk = sock->sk;
1723         struct sk_buff *skb;
1724
1725         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1726
1727         /* Get data directly from socket receive queue without copying it. */
1728         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1729                 skb_orphan(skb);
1730                 rfcomm_recv_frame(s, skb);
1731         }
1732
1733         if (sk->sk_state == BT_CLOSED) {
1734                 if (!s->initiator)
1735                         rfcomm_session_put(s);
1736
1737                 rfcomm_session_close(s, sk->sk_err);
1738         }
1739 }
1740
1741 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1742 {
1743         struct socket *sock = s->sock, *nsock;
1744         int err;
1745
1746         /* Fast check for a new connection.
1747          * Avoids unnesesary socket allocations. */
1748         if (list_empty(&bt_sk(sock->sk)->accept_q))
1749                 return;
1750
1751         BT_DBG("session %p", s);
1752
1753         if (sock_create_lite(PF_BLUETOOTH, sock->type, BTPROTO_L2CAP, &nsock))
1754                 return;
1755
1756         nsock->ops  = sock->ops;
1757
1758         __module_get(nsock->ops->owner);
1759
1760         err = sock->ops->accept(sock, nsock, O_NONBLOCK);
1761         if (err < 0) {
1762                 sock_release(nsock);
1763                 return;
1764         }
1765
1766         /* Set our callbacks */
1767         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1768         nsock->sk->sk_state_change = rfcomm_l2state_change;
1769
1770         s = rfcomm_session_add(nsock, BT_OPEN);
1771         if (s) {
1772                 rfcomm_session_hold(s);
1773                 rfcomm_schedule(RFCOMM_SCHED_RX);
1774         } else
1775                 sock_release(nsock);
1776 }
1777
1778 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1779 {
1780         struct sock *sk = s->sock->sk;
1781
1782         BT_DBG("%p state %ld", s, s->state);
1783
1784         switch(sk->sk_state) {
1785         case BT_CONNECTED:
1786                 s->state = BT_CONNECT;
1787
1788                 /* We can adjust MTU on outgoing sessions.
1789                  * L2CAP MTU minus UIH header and FCS. */
1790                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1791
1792                 rfcomm_send_sabm(s, 0);
1793                 break;
1794
1795         case BT_CLOSED:
1796                 s->state = BT_CLOSED;
1797                 rfcomm_session_close(s, sk->sk_err);
1798                 break;
1799         }
1800 }
1801
1802 static inline void rfcomm_process_sessions(void)
1803 {
1804         struct list_head *p, *n;
1805
1806         rfcomm_lock();
1807
1808         list_for_each_safe(p, n, &session_list) {
1809                 struct rfcomm_session *s;
1810                 s = list_entry(p, struct rfcomm_session, list);
1811
1812                 if (s->state == BT_LISTEN) {
1813                         rfcomm_accept_connection(s);
1814                         continue;
1815                 }
1816
1817                 rfcomm_session_hold(s);
1818
1819                 switch (s->state) {
1820                 case BT_BOUND:
1821                         rfcomm_check_connection(s);
1822                         break;
1823
1824                 default:
1825                         rfcomm_process_rx(s);
1826                         break;
1827                 }
1828
1829                 rfcomm_process_dlcs(s);
1830
1831                 rfcomm_session_put(s);
1832         }
1833
1834         rfcomm_unlock();
1835 }
1836
1837 static void rfcomm_worker(void)
1838 {
1839         BT_DBG("");
1840
1841         while (!atomic_read(&terminate)) {
1842                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1843                         /* No pending events. Let's sleep.
1844                          * Incoming connections and data will wake us up. */
1845                         set_current_state(TASK_INTERRUPTIBLE);
1846                         schedule();
1847                 }
1848
1849                 /* Process stuff */
1850                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1851                 rfcomm_process_sessions();
1852         }
1853         set_current_state(TASK_RUNNING);
1854         return;
1855 }
1856
1857 static int rfcomm_add_listener(bdaddr_t *ba)
1858 {
1859         struct sockaddr_l2 addr;
1860         struct socket *sock;
1861         struct sock *sk;
1862         struct rfcomm_session *s;
1863         int    err = 0;
1864
1865         /* Create socket */
1866         err = rfcomm_l2sock_create(&sock);
1867         if (err < 0) {
1868                 BT_ERR("Create socket failed %d", err);
1869                 return err;
1870         }
1871
1872         /* Bind socket */
1873         bacpy(&addr.l2_bdaddr, ba);
1874         addr.l2_family = AF_BLUETOOTH;
1875         addr.l2_psm    = htobs(RFCOMM_PSM);
1876         err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1877         if (err < 0) {
1878                 BT_ERR("Bind failed %d", err);
1879                 goto failed;
1880         }
1881
1882         /* Set L2CAP options */
1883         sk = sock->sk;
1884         lock_sock(sk);
1885         l2cap_pi(sk)->imtu = l2cap_mtu;
1886         release_sock(sk);
1887
1888         /* Start listening on the socket */
1889         err = sock->ops->listen(sock, 10);
1890         if (err) {
1891                 BT_ERR("Listen failed %d", err);
1892                 goto failed;
1893         }
1894
1895         /* Add listening session */
1896         s = rfcomm_session_add(sock, BT_LISTEN);
1897         if (!s)
1898                 goto failed;
1899
1900         rfcomm_session_hold(s);
1901         return 0;
1902 failed:
1903         sock_release(sock);
1904         return err;
1905 }
1906
1907 static void rfcomm_kill_listener(void)
1908 {
1909         struct rfcomm_session *s;
1910         struct list_head *p, *n;
1911
1912         BT_DBG("");
1913
1914         list_for_each_safe(p, n, &session_list) {
1915                 s = list_entry(p, struct rfcomm_session, list);
1916                 rfcomm_session_del(s);
1917         }
1918 }
1919
1920 static int rfcomm_run(void *unused)
1921 {
1922         rfcomm_thread = current;
1923
1924         atomic_inc(&running);
1925
1926         daemonize("krfcommd");
1927         set_user_nice(current, -10);
1928         current->flags |= PF_NOFREEZE;
1929
1930         BT_DBG("");
1931
1932         rfcomm_add_listener(BDADDR_ANY);
1933
1934         rfcomm_worker();
1935
1936         rfcomm_kill_listener();
1937
1938         atomic_dec(&running);
1939         return 0;
1940 }
1941
1942 static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
1943 {
1944         struct rfcomm_session *s;
1945         struct rfcomm_dlc *d;
1946         struct list_head *p, *n;
1947
1948         BT_DBG("conn %p status 0x%02x", conn, status);
1949
1950         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1951         if (!s)
1952                 return;
1953
1954         rfcomm_session_hold(s);
1955
1956         list_for_each_safe(p, n, &s->dlcs) {
1957                 d = list_entry(p, struct rfcomm_dlc, list);
1958
1959                 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE))
1960                         continue;
1961
1962                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1963                         continue;
1964
1965                 if (!status)
1966                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1967                 else
1968                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1969         }
1970
1971         rfcomm_session_put(s);
1972
1973         rfcomm_schedule(RFCOMM_SCHED_AUTH);
1974 }
1975
1976 static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1977 {
1978         struct rfcomm_session *s;
1979         struct rfcomm_dlc *d;
1980         struct list_head *p, *n;
1981
1982         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
1983
1984         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1985         if (!s)
1986                 return;
1987
1988         rfcomm_session_hold(s);
1989
1990         list_for_each_safe(p, n, &s->dlcs) {
1991                 d = list_entry(p, struct rfcomm_dlc, list);
1992
1993                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1994                         continue;
1995
1996                 if (!status && encrypt)
1997                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1998                 else
1999                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2000         }
2001
2002         rfcomm_session_put(s);
2003
2004         rfcomm_schedule(RFCOMM_SCHED_AUTH);
2005 }
2006
2007 static struct hci_cb rfcomm_cb = {
2008         .name           = "RFCOMM",
2009         .auth_cfm       = rfcomm_auth_cfm,
2010         .encrypt_cfm    = rfcomm_encrypt_cfm
2011 };
2012
2013 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2014 {
2015         struct rfcomm_session *s;
2016         struct list_head *pp, *p;
2017         char *str = buf;
2018
2019         rfcomm_lock();
2020
2021         list_for_each(p, &session_list) {
2022                 s = list_entry(p, struct rfcomm_session, list);
2023                 list_for_each(pp, &s->dlcs) {
2024                         struct sock *sk = s->sock->sk;
2025                         struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2026
2027                         str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2028                                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2029                                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2030                 }
2031         }
2032
2033         rfcomm_unlock();
2034
2035         return (str - buf);
2036 }
2037
2038 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2039
2040 /* ---- Initialization ---- */
2041 static int __init rfcomm_init(void)
2042 {
2043         l2cap_load();
2044
2045         hci_register_cb(&rfcomm_cb);
2046
2047         kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
2048
2049         class_create_file(bt_class, &class_attr_rfcomm_dlc);
2050
2051         rfcomm_init_sockets();
2052
2053 #ifdef CONFIG_BT_RFCOMM_TTY
2054         rfcomm_init_ttys();
2055 #endif
2056
2057         BT_INFO("RFCOMM ver %s", VERSION);
2058
2059         return 0;
2060 }
2061
2062 static void __exit rfcomm_exit(void)
2063 {
2064         class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2065
2066         hci_unregister_cb(&rfcomm_cb);
2067
2068         /* Terminate working thread.
2069          * ie. Set terminate flag and wake it up */
2070         atomic_inc(&terminate);
2071         rfcomm_schedule(RFCOMM_SCHED_STATE);
2072
2073         /* Wait until thread is running */
2074         while (atomic_read(&running))
2075                 schedule();
2076
2077 #ifdef CONFIG_BT_RFCOMM_TTY
2078         rfcomm_cleanup_ttys();
2079 #endif
2080
2081         rfcomm_cleanup_sockets();
2082 }
2083
2084 module_init(rfcomm_init);
2085 module_exit(rfcomm_exit);
2086
2087 module_param(disable_cfc, bool, 0644);
2088 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2089
2090 module_param(l2cap_mtu, uint, 0644);
2091 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2092
2093 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
2094 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2095 MODULE_VERSION(VERSION);
2096 MODULE_LICENSE("GPL");
2097 MODULE_ALIAS("bt-proto-3");