net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/debugfs.h>
  30 #include <linux/kthread.h>
  31 #include <asm/unaligned.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35 #include <net/bluetooth/l2cap.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define VERSION "1.11"
  39
  40 static bool disable_cfc;
  41 static bool l2cap_ertm;
  42 static int channel_mtu = -1;
  43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  44
  45 static struct task_struct *rfcomm_thread;
  46
  47 static DEFINE_MUTEX(rfcomm_mutex);
  48 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  50
  51
  52 static LIST_HEAD(session_list);
  53
  54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  64
  65 static void rfcomm_process_connect(struct rfcomm_session *s);
  66
  67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
  68                                                         bdaddr_t *dst,
  69                                                         u8 sec_level,
  70                                                         int *err);
  71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  72 static void rfcomm_session_del(struct rfcomm_session *s);
  73
  74 /* ---- RFCOMM frame parsing macros ---- */
  75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  76 #define __get_channel(b)  ((b & 0xf8) >> 3)
  77 #define __get_dir(b)      ((b & 0x04) >> 2)
  78 #define __get_type(b)     ((b & 0xef))
  79
  80 #define __test_ea(b)      ((b & 0x01))
  81 #define __test_cr(b)      ((b & 0x02))
  82 #define __test_pf(b)      ((b & 0x10))
  83
  84 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  85 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  86 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  87 #define __srv_channel(dlci)    (dlci >> 1)
  88 #define __dir(dlci)            (dlci & 0x01)
  89
  90 #define __len8(len)       (((len) << 1) | 1)
  91 #define __len16(len)      ((len) << 1)
  92
  93 /* MCC macros */
  94 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
  95 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
  96 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
  97
  98 /* RPN macros */
  99 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 100 #define __get_rpn_data_bits(line) ((line) & 0x3)
 101 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 102 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 103
 104 static void rfcomm_schedule(void)
 105 {
 106         if (!rfcomm_thread)
 107                 return;
 108         wake_up_process(rfcomm_thread);
 109 }
 110
 111 static void rfcomm_session_put(struct rfcomm_session *s)
 112 {
 113         if (atomic_dec_and_test(&s->refcnt))
 114                 rfcomm_session_del(s);
 115 }
 116
 117 /* ---- RFCOMM FCS computation ---- */
 118
 119 /* reversed, 8-bit, poly=0x07 */
 120 static unsigned char rfcomm_crc_table[256] = {
 121         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 122         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 123         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 124         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 125
 126         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 127         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 128         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 129         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 130
 131         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 132         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 133         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 134         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 135
 136         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 137         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 138         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 139         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 140
 141         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 142         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 143         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 144         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 145
 146         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 147         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 148         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 149         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 150
 151         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 152         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 153         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 154         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 155
 156         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 157         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 158         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 159         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 160 };
 161
 162 /* CRC on 2 bytes */
 163 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 164
 165 /* FCS on 2 bytes */
 166 static inline u8 __fcs(u8 *data)
 167 {
 168         return 0xff - __crc(data);
 169 }
 170
 171 /* FCS on 3 bytes */
 172 static inline u8 __fcs2(u8 *data)
 173 {
 174         return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
 175 }
 176
 177 /* Check FCS */
 178 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 179 {
 180         u8 f = __crc(data);
 181
 182         if (type != RFCOMM_UIH)
 183                 f = rfcomm_crc_table[f ^ data[2]];
 184
 185         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 186 }
 187
 188 /* ---- L2CAP callbacks ---- */
 189 static void rfcomm_l2state_change(struct sock *sk)
 190 {
 191         BT_DBG("%p state %d", sk, sk->sk_state);
 192         rfcomm_schedule();
 193 }
 194
 195 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 196 {
 197         BT_DBG("%p bytes %d", sk, bytes);
 198         rfcomm_schedule();
 199 }
 200
 201 static int rfcomm_l2sock_create(struct socket **sock)
 202 {
 203         int err;
 204
 205         BT_DBG("");
 206
 207         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 208         if (!err) {
 209                 struct sock *sk = (*sock)->sk;
 210                 sk->sk_data_ready   = rfcomm_l2data_ready;
 211                 sk->sk_state_change = rfcomm_l2state_change;
 212         }
 213         return err;
 214 }
 215
 216 static int rfcomm_check_security(struct rfcomm_dlc *d)
 217 {
 218         struct sock *sk = d->session->sock->sk;
 219         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 220
 221         __u8 auth_type;
 222
 223         switch (d->sec_level) {
 224         case BT_SECURITY_HIGH:
 225                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
 226                 break;
 227         case BT_SECURITY_MEDIUM:
 228                 auth_type = HCI_AT_GENERAL_BONDING;
 229                 break;
 230         default:
 231                 auth_type = HCI_AT_NO_BONDING;
 232                 break;
 233         }
 234
 235         return hci_conn_security(conn->hcon, d->sec_level, auth_type);
 236 }
 237
 238 static void rfcomm_session_timeout(unsigned long arg)
 239 {
 240         struct rfcomm_session *s = (void *) arg;
 241
 242         BT_DBG("session %p state %ld", s, s->state);
 243
 244         set_bit(RFCOMM_TIMED_OUT, &s->flags);
 245         rfcomm_schedule();
 246 }
 247
 248 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 249 {
 250         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 251
 252         if (!mod_timer(&s->timer, jiffies + timeout))
 253                 rfcomm_session_hold(s);
 254 }
 255
 256 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 257 {
 258         BT_DBG("session %p state %ld", s, s->state);
 259
 260         if (timer_pending(&s->timer) && del_timer(&s->timer))
 261                 rfcomm_session_put(s);
 262 }
 263
 264 /* ---- RFCOMM DLCs ---- */
 265 static void rfcomm_dlc_timeout(unsigned long arg)
 266 {
 267         struct rfcomm_dlc *d = (void *) arg;
 268
 269         BT_DBG("dlc %p state %ld", d, d->state);
 270
 271         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 272         rfcomm_dlc_put(d);
 273         rfcomm_schedule();
 274 }
 275
 276 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 277 {
 278         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 279
 280         if (!mod_timer(&d->timer, jiffies + timeout))
 281                 rfcomm_dlc_hold(d);
 282 }
 283
 284 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 285 {
 286         BT_DBG("dlc %p state %ld", d, d->state);
 287
 288         if (timer_pending(&d->timer) && del_timer(&d->timer))
 289                 rfcomm_dlc_put(d);
 290 }
 291
 292 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 293 {
 294         BT_DBG("%p", d);
 295
 296         d->state      = BT_OPEN;
 297         d->flags      = 0;
 298         d->mscex      = 0;
 299         d->sec_level  = BT_SECURITY_LOW;
 300         d->mtu        = RFCOMM_DEFAULT_MTU;
 301         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 302
 303         d->cfc        = RFCOMM_CFC_DISABLED;
 304         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 305 }
 306
 307 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 308 {
 309         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 310
 311         if (!d)
 312                 return NULL;
 313
 314         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 315
 316         skb_queue_head_init(&d->tx_queue);
 317         spin_lock_init(&d->lock);
 318         atomic_set(&d->refcnt, 1);
 319
 320         rfcomm_dlc_clear_state(d);
 321
 322         BT_DBG("%p", d);
 323
 324         return d;
 325 }
 326
 327 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 328 {
 329         BT_DBG("%p", d);
 330
 331         skb_queue_purge(&d->tx_queue);
 332         kfree(d);
 333 }
 334
 335 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 336 {
 337         BT_DBG("dlc %p session %p", d, s);
 338
 339         rfcomm_session_hold(s);
 340
 341         rfcomm_session_clear_timer(s);
 342         rfcomm_dlc_hold(d);
 343         list_add(&d->list, &s->dlcs);
 344         d->session = s;
 345 }
 346
 347 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 348 {
 349         struct rfcomm_session *s = d->session;
 350
 351         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 352
 353         list_del(&d->list);
 354         d->session = NULL;
 355         rfcomm_dlc_put(d);
 356
 357         if (list_empty(&s->dlcs))
 358                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
 359
 360         rfcomm_session_put(s);
 361 }
 362
 363 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 364 {
 365         struct rfcomm_dlc *d;
 366
 367         list_for_each_entry(d, &s->dlcs, list)
 368                 if (d->dlci == dlci)
 369                         return d;
 370
 371         return NULL;
 372 }
 373
 374 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 375 {
 376         struct rfcomm_session *s;
 377         int err = 0;
 378         u8 dlci;
 379
 380         BT_DBG("dlc %p state %ld %s %s channel %d",
 381                         d, d->state, batostr(src), batostr(dst), channel);
 382
 383         if (channel < 1 || channel > 30)
 384                 return -EINVAL;
 385
 386         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 387                 return 0;
 388
 389         s = rfcomm_session_get(src, dst);
 390         if (!s) {
 391                 s = rfcomm_session_create(src, dst, d->sec_level, &err);
 392                 if (!s)
 393                         return err;
 394         }
 395
 396         dlci = __dlci(!s->initiator, channel);
 397
 398         /* Check if DLCI already exists */
 399         if (rfcomm_dlc_get(s, dlci))
 400                 return -EBUSY;
 401
 402         rfcomm_dlc_clear_state(d);
 403
 404         d->dlci     = dlci;
 405         d->addr     = __addr(s->initiator, dlci);
 406         d->priority = 7;
 407
 408         d->state = BT_CONFIG;
 409         rfcomm_dlc_link(s, d);
 410
 411         d->out = 1;
 412
 413         d->mtu = s->mtu;
 414         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 415
 416         if (s->state == BT_CONNECTED) {
 417                 if (rfcomm_check_security(d))
 418                         rfcomm_send_pn(s, 1, d);
 419                 else
 420                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 421         }
 422
 423         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 424
 425         return 0;
 426 }
 427
 428 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 429 {
 430         int r;
 431
 432         rfcomm_lock();
 433
 434         r = __rfcomm_dlc_open(d, src, dst, channel);
 435
 436         rfcomm_unlock();
 437         return r;
 438 }
 439
 440 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 441 {
 442         struct rfcomm_session *s = d->session;
 443         if (!s)
 444                 return 0;
 445
 446         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 447                         d, d->state, d->dlci, err, s);
 448
 449         switch (d->state) {
 450         case BT_CONNECT:
 451         case BT_CONFIG:
 452                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 453                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 454                         rfcomm_schedule();
 455                         break;
 456                 }
 457                 /* Fall through */
 458
 459         case BT_CONNECTED:
 460                 d->state = BT_DISCONN;
 461                 if (skb_queue_empty(&d->tx_queue)) {
 462                         rfcomm_send_disc(s, d->dlci);
 463                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 464                 } else {
 465                         rfcomm_queue_disc(d);
 466                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 467                 }
 468                 break;
 469
 470         case BT_OPEN:
 471         case BT_CONNECT2:
 472                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 473                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 474                         rfcomm_schedule();
 475                         break;
 476                 }
 477                 /* Fall through */
 478
 479         default:
 480                 rfcomm_dlc_clear_timer(d);
 481
 482                 rfcomm_dlc_lock(d);
 483                 d->state = BT_CLOSED;
 484                 d->state_change(d, err);
 485                 rfcomm_dlc_unlock(d);
 486
 487                 skb_queue_purge(&d->tx_queue);
 488                 rfcomm_dlc_unlink(d);
 489         }
 490
 491         return 0;
 492 }
 493
 494 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 495 {
 496         int r;
 497
 498         rfcomm_lock();
 499
 500         r = __rfcomm_dlc_close(d, err);
 501
 502         rfcomm_unlock();
 503         return r;
 504 }
 505
 506 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 507 {
 508         int len = skb->len;
 509
 510         if (d->state != BT_CONNECTED)
 511                 return -ENOTCONN;
 512
 513         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 514
 515         if (len > d->mtu)
 516                 return -EINVAL;
 517
 518         rfcomm_make_uih(skb, d->addr);
 519         skb_queue_tail(&d->tx_queue, skb);
 520
 521         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 522                 rfcomm_schedule();
 523         return len;
 524 }
 525
 526 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 527 {
 528         BT_DBG("dlc %p state %ld", d, d->state);
 529
 530         if (!d->cfc) {
 531                 d->v24_sig |= RFCOMM_V24_FC;
 532                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 533         }
 534         rfcomm_schedule();
 535 }
 536
 537 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 538 {
 539         BT_DBG("dlc %p state %ld", d, d->state);
 540
 541         if (!d->cfc) {
 542                 d->v24_sig &= ~RFCOMM_V24_FC;
 543                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 544         }
 545         rfcomm_schedule();
 546 }
 547
 548 /*
 549    Set/get modem status functions use _local_ status i.e. what we report
 550    to the other side.
 551    Remote status is provided by dlc->modem_status() callback.
 552  */
 553 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 554 {
 555         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 556                         d, d->state, v24_sig);
 557
 558         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 559                 v24_sig |= RFCOMM_V24_FC;
 560         else
 561                 v24_sig &= ~RFCOMM_V24_FC;
 562
 563         d->v24_sig = v24_sig;
 564
 565         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 566                 rfcomm_schedule();
 567
 568         return 0;
 569 }
 570
 571 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 572 {
 573         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 574                         d, d->state, d->v24_sig);
 575
 576         *v24_sig = d->v24_sig;
 577         return 0;
 578 }
 579
 580 /* ---- RFCOMM sessions ---- */
 581 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 582 {
 583         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 584
 585         if (!s)
 586                 return NULL;
 587
 588         BT_DBG("session %p sock %p", s, sock);
 589
 590         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
 591
 592         INIT_LIST_HEAD(&s->dlcs);
 593         s->state = state;
 594         s->sock  = sock;
 595
 596         s->mtu = RFCOMM_DEFAULT_MTU;
 597         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 598
 599         /* Do not increment module usage count for listening sessions.
 600          * Otherwise we won't be able to unload the module. */
 601         if (state != BT_LISTEN)
 602                 if (!try_module_get(THIS_MODULE)) {
 603                         kfree(s);
 604                         return NULL;
 605                 }
 606
 607         list_add(&s->list, &session_list);
 608
 609         return s;
 610 }
 611
 612 static void rfcomm_session_del(struct rfcomm_session *s)
 613 {
 614         int state = s->state;
 615
 616         BT_DBG("session %p state %ld", s, s->state);
 617
 618         list_del(&s->list);
 619
 620         if (state == BT_CONNECTED)
 621                 rfcomm_send_disc(s, 0);
 622
 623         rfcomm_session_clear_timer(s);
 624         sock_release(s->sock);
 625         kfree(s);
 626
 627         if (state != BT_LISTEN)
 628                 module_put(THIS_MODULE);
 629 }
 630
 631 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 632 {
 633         struct rfcomm_session *s;
 634         struct list_head *p, *n;
 635         struct bt_sock *sk;
 636         list_for_each_safe(p, n, &session_list) {
 637                 s = list_entry(p, struct rfcomm_session, list);
 638                 sk = bt_sk(s->sock->sk);
 639
 640                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 641                                 !bacmp(&sk->dst, dst))
 642                         return s;
 643         }
 644         return NULL;
 645 }
 646
 647 static void rfcomm_session_close(struct rfcomm_session *s, int err)
 648 {
 649         struct rfcomm_dlc *d;
 650         struct list_head *p, *n;
 651
 652         BT_DBG("session %p state %ld err %d", s, s->state, err);
 653
 654         rfcomm_session_hold(s);
 655
 656         s->state = BT_CLOSED;
 657
 658         /* Close all dlcs */
 659         list_for_each_safe(p, n, &s->dlcs) {
 660                 d = list_entry(p, struct rfcomm_dlc, list);
 661                 d->state = BT_CLOSED;
 662                 __rfcomm_dlc_close(d, err);
 663         }
 664
 665         rfcomm_session_clear_timer(s);
 666         rfcomm_session_put(s);
 667 }
 668
 669 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 670                                                         bdaddr_t *dst,
 671                                                         u8 sec_level,
 672                                                         int *err)
 673 {
 674         struct rfcomm_session *s = NULL;
 675         struct sockaddr_l2 addr;
 676         struct socket *sock;
 677         struct sock *sk;
 678
 679         BT_DBG("%s %s", batostr(src), batostr(dst));
 680
 681         *err = rfcomm_l2sock_create(&sock);
 682         if (*err < 0)
 683                 return NULL;
 684
 685         bacpy(&addr.l2_bdaddr, src);
 686         addr.l2_family = AF_BLUETOOTH;
 687         addr.l2_psm    = 0;
 688         addr.l2_cid    = 0;
 689         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 690         if (*err < 0)
 691                 goto failed;
 692
 693         /* Set L2CAP options */
 694         sk = sock->sk;
 695         lock_sock(sk);
 696         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
 697         l2cap_pi(sk)->chan->sec_level = sec_level;
 698         if (l2cap_ertm)
 699                 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
 700         release_sock(sk);
 701
 702         s = rfcomm_session_add(sock, BT_BOUND);
 703         if (!s) {
 704                 *err = -ENOMEM;
 705                 goto failed;
 706         }
 707
 708         s->initiator = 1;
 709
 710         bacpy(&addr.l2_bdaddr, dst);
 711         addr.l2_family = AF_BLUETOOTH;
 712         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
 713         addr.l2_cid    = 0;
 714         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 715         if (*err == 0 || *err == -EINPROGRESS)
 716                 return s;
 717
 718         rfcomm_session_del(s);
 719         return NULL;
 720
 721 failed:
 722         sock_release(sock);
 723         return NULL;
 724 }
 725
 726 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 727 {
 728         struct sock *sk = s->sock->sk;
 729         if (src)
 730                 bacpy(src, &bt_sk(sk)->src);
 731         if (dst)
 732                 bacpy(dst, &bt_sk(sk)->dst);
 733 }
 734
 735 /* ---- RFCOMM frame sending ---- */
 736 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 737 {
 738         struct kvec iv = { data, len };
 739         struct msghdr msg;
 740
 741         BT_DBG("session %p len %d", s, len);
 742
 743         memset(&msg, 0, sizeof(msg));
 744
 745         return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
 746 }
 747
 748 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
 749 {
 750         BT_DBG("%p cmd %u", s, cmd->ctrl);
 751
 752         return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
 753 }
 754
 755 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 756 {
 757         struct rfcomm_cmd cmd;
 758
 759         BT_DBG("%p dlci %d", s, dlci);
 760
 761         cmd.addr = __addr(s->initiator, dlci);
 762         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 763         cmd.len  = __len8(0);
 764         cmd.fcs  = __fcs2((u8 *) &cmd);
 765
 766         return rfcomm_send_cmd(s, &cmd);
 767 }
 768
 769 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 770 {
 771         struct rfcomm_cmd cmd;
 772
 773         BT_DBG("%p dlci %d", s, dlci);
 774
 775         cmd.addr = __addr(!s->initiator, dlci);
 776         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 777         cmd.len  = __len8(0);
 778         cmd.fcs  = __fcs2((u8 *) &cmd);
 779
 780         return rfcomm_send_cmd(s, &cmd);
 781 }
 782
 783 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 784 {
 785         struct rfcomm_cmd cmd;
 786
 787         BT_DBG("%p dlci %d", s, dlci);
 788
 789         cmd.addr = __addr(s->initiator, dlci);
 790         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 791         cmd.len  = __len8(0);
 792         cmd.fcs  = __fcs2((u8 *) &cmd);
 793
 794         return rfcomm_send_cmd(s, &cmd);
 795 }
 796
 797 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 798 {
 799         struct rfcomm_cmd *cmd;
 800         struct sk_buff *skb;
 801
 802         BT_DBG("dlc %p dlci %d", d, d->dlci);
 803
 804         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 805         if (!skb)
 806                 return -ENOMEM;
 807
 808         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 809         cmd->addr = d->addr;
 810         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 811         cmd->len  = __len8(0);
 812         cmd->fcs  = __fcs2((u8 *) cmd);
 813
 814         skb_queue_tail(&d->tx_queue, skb);
 815         rfcomm_schedule();
 816         return 0;
 817 }
 818
 819 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 820 {
 821         struct rfcomm_cmd cmd;
 822
 823         BT_DBG("%p dlci %d", s, dlci);
 824
 825         cmd.addr = __addr(!s->initiator, dlci);
 826         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 827         cmd.len  = __len8(0);
 828         cmd.fcs  = __fcs2((u8 *) &cmd);
 829
 830         return rfcomm_send_cmd(s, &cmd);
 831 }
 832
 833 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 834 {
 835         struct rfcomm_hdr *hdr;
 836         struct rfcomm_mcc *mcc;
 837         u8 buf[16], *ptr = buf;
 838
 839         BT_DBG("%p cr %d type %d", s, cr, type);
 840
 841         hdr = (void *) ptr; ptr += sizeof(*hdr);
 842         hdr->addr = __addr(s->initiator, 0);
 843         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 844         hdr->len  = __len8(sizeof(*mcc) + 1);
 845
 846         mcc = (void *) ptr; ptr += sizeof(*mcc);
 847         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 848         mcc->len  = __len8(1);
 849
 850         /* Type that we didn't like */
 851         *ptr = __mcc_type(cr, type); ptr++;
 852
 853         *ptr = __fcs(buf); ptr++;
 854
 855         return rfcomm_send_frame(s, buf, ptr - buf);
 856 }
 857
 858 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 859 {
 860         struct rfcomm_hdr *hdr;
 861         struct rfcomm_mcc *mcc;
 862         struct rfcomm_pn  *pn;
 863         u8 buf[16], *ptr = buf;
 864
 865         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 866
 867         hdr = (void *) ptr; ptr += sizeof(*hdr);
 868         hdr->addr = __addr(s->initiator, 0);
 869         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 870         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 871
 872         mcc = (void *) ptr; ptr += sizeof(*mcc);
 873         mcc->type = __mcc_type(cr, RFCOMM_PN);
 874         mcc->len  = __len8(sizeof(*pn));
 875
 876         pn = (void *) ptr; ptr += sizeof(*pn);
 877         pn->dlci        = d->dlci;
 878         pn->priority    = d->priority;
 879         pn->ack_timer   = 0;
 880         pn->max_retrans = 0;
 881
 882         if (s->cfc) {
 883                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 884                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 885         } else {
 886                 pn->flow_ctrl = 0;
 887                 pn->credits   = 0;
 888         }
 889
 890         if (cr && channel_mtu >= 0)
 891                 pn->mtu = cpu_to_le16(channel_mtu);
 892         else
 893                 pn->mtu = cpu_to_le16(d->mtu);
 894
 895         *ptr = __fcs(buf); ptr++;
 896
 897         return rfcomm_send_frame(s, buf, ptr - buf);
 898 }
 899
 900 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 901                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 902                         u8 parity, u8 flow_ctrl_settings,
 903                         u8 xon_char, u8 xoff_char, u16 param_mask)
 904 {
 905         struct rfcomm_hdr *hdr;
 906         struct rfcomm_mcc *mcc;
 907         struct rfcomm_rpn *rpn;
 908         u8 buf[16], *ptr = buf;
 909
 910         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 911                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 912                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 913                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 914
 915         hdr = (void *) ptr; ptr += sizeof(*hdr);
 916         hdr->addr = __addr(s->initiator, 0);
 917         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 918         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 919
 920         mcc = (void *) ptr; ptr += sizeof(*mcc);
 921         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 922         mcc->len  = __len8(sizeof(*rpn));
 923
 924         rpn = (void *) ptr; ptr += sizeof(*rpn);
 925         rpn->dlci          = __addr(1, dlci);
 926         rpn->bit_rate      = bit_rate;
 927         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 928         rpn->flow_ctrl     = flow_ctrl_settings;
 929         rpn->xon_char      = xon_char;
 930         rpn->xoff_char     = xoff_char;
 931         rpn->param_mask    = cpu_to_le16(param_mask);
 932
 933         *ptr = __fcs(buf); ptr++;
 934
 935         return rfcomm_send_frame(s, buf, ptr - buf);
 936 }
 937
 938 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 939 {
 940         struct rfcomm_hdr *hdr;
 941         struct rfcomm_mcc *mcc;
 942         struct rfcomm_rls *rls;
 943         u8 buf[16], *ptr = buf;
 944
 945         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 946
 947         hdr = (void *) ptr; ptr += sizeof(*hdr);
 948         hdr->addr = __addr(s->initiator, 0);
 949         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 950         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 951
 952         mcc = (void *) ptr; ptr += sizeof(*mcc);
 953         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 954         mcc->len  = __len8(sizeof(*rls));
 955
 956         rls = (void *) ptr; ptr += sizeof(*rls);
 957         rls->dlci   = __addr(1, dlci);
 958         rls->status = status;
 959
 960         *ptr = __fcs(buf); ptr++;
 961
 962         return rfcomm_send_frame(s, buf, ptr - buf);
 963 }
 964
 965 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 966 {
 967         struct rfcomm_hdr *hdr;
 968         struct rfcomm_mcc *mcc;
 969         struct rfcomm_msc *msc;
 970         u8 buf[16], *ptr = buf;
 971
 972         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 973
 974         hdr = (void *) ptr; ptr += sizeof(*hdr);
 975         hdr->addr = __addr(s->initiator, 0);
 976         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 977         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 978
 979         mcc = (void *) ptr; ptr += sizeof(*mcc);
 980         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 981         mcc->len  = __len8(sizeof(*msc));
 982
 983         msc = (void *) ptr; ptr += sizeof(*msc);
 984         msc->dlci    = __addr(1, dlci);
 985         msc->v24_sig = v24_sig | 0x01;
 986
 987         *ptr = __fcs(buf); ptr++;
 988
 989         return rfcomm_send_frame(s, buf, ptr - buf);
 990 }
 991
 992 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 993 {
 994         struct rfcomm_hdr *hdr;
 995         struct rfcomm_mcc *mcc;
 996         u8 buf[16], *ptr = buf;
 997
 998         BT_DBG("%p cr %d", s, cr);
 999
1000         hdr = (void *) ptr; ptr += sizeof(*hdr);
1001         hdr->addr = __addr(s->initiator, 0);
1002         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1003         hdr->len  = __len8(sizeof(*mcc));
1004
1005         mcc = (void *) ptr; ptr += sizeof(*mcc);
1006         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1007         mcc->len  = __len8(0);
1008
1009         *ptr = __fcs(buf); ptr++;
1010
1011         return rfcomm_send_frame(s, buf, ptr - buf);
1012 }
1013
1014 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1015 {
1016         struct rfcomm_hdr *hdr;
1017         struct rfcomm_mcc *mcc;
1018         u8 buf[16], *ptr = buf;
1019
1020         BT_DBG("%p cr %d", s, cr);
1021
1022         hdr = (void *) ptr; ptr += sizeof(*hdr);
1023         hdr->addr = __addr(s->initiator, 0);
1024         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1025         hdr->len  = __len8(sizeof(*mcc));
1026
1027         mcc = (void *) ptr; ptr += sizeof(*mcc);
1028         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1029         mcc->len  = __len8(0);
1030
1031         *ptr = __fcs(buf); ptr++;
1032
1033         return rfcomm_send_frame(s, buf, ptr - buf);
1034 }
1035
1036 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1037 {
1038         struct socket *sock = s->sock;
1039         struct kvec iv[3];
1040         struct msghdr msg;
1041         unsigned char hdr[5], crc[1];
1042
1043         if (len > 125)
1044                 return -EINVAL;
1045
1046         BT_DBG("%p cr %d", s, cr);
1047
1048         hdr[0] = __addr(s->initiator, 0);
1049         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1050         hdr[2] = 0x01 | ((len + 2) << 1);
1051         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1052         hdr[4] = 0x01 | (len << 1);
1053
1054         crc[0] = __fcs(hdr);
1055
1056         iv[0].iov_base = hdr;
1057         iv[0].iov_len  = 5;
1058         iv[1].iov_base = pattern;
1059         iv[1].iov_len  = len;
1060         iv[2].iov_base = crc;
1061         iv[2].iov_len  = 1;
1062
1063         memset(&msg, 0, sizeof(msg));
1064
1065         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1066 }
1067
1068 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1069 {
1070         struct rfcomm_hdr *hdr;
1071         u8 buf[16], *ptr = buf;
1072
1073         BT_DBG("%p addr %d credits %d", s, addr, credits);
1074
1075         hdr = (void *) ptr; ptr += sizeof(*hdr);
1076         hdr->addr = addr;
1077         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1078         hdr->len  = __len8(0);
1079
1080         *ptr = credits; ptr++;
1081
1082         *ptr = __fcs(buf); ptr++;
1083
1084         return rfcomm_send_frame(s, buf, ptr - buf);
1085 }
1086
1087 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1088 {
1089         struct rfcomm_hdr *hdr;
1090         int len = skb->len;
1091         u8 *crc;
1092
1093         if (len > 127) {
1094                 hdr = (void *) skb_push(skb, 4);
1095                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1096         } else {
1097                 hdr = (void *) skb_push(skb, 3);
1098                 hdr->len = __len8(len);
1099         }
1100         hdr->addr = addr;
1101         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1102
1103         crc = skb_put(skb, 1);
1104         *crc = __fcs((void *) hdr);
1105 }
1106
1107 /* ---- RFCOMM frame reception ---- */
1108 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1109 {
1110         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1111
1112         if (dlci) {
1113                 /* Data channel */
1114                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1115                 if (!d) {
1116                         rfcomm_send_dm(s, dlci);
1117                         return 0;
1118                 }
1119
1120                 switch (d->state) {
1121                 case BT_CONNECT:
1122                         rfcomm_dlc_clear_timer(d);
1123
1124                         rfcomm_dlc_lock(d);
1125                         d->state = BT_CONNECTED;
1126                         d->state_change(d, 0);
1127                         rfcomm_dlc_unlock(d);
1128
1129                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1130                         break;
1131
1132                 case BT_DISCONN:
1133                         d->state = BT_CLOSED;
1134                         __rfcomm_dlc_close(d, 0);
1135
1136                         if (list_empty(&s->dlcs)) {
1137                                 s->state = BT_DISCONN;
1138                                 rfcomm_send_disc(s, 0);
1139                                 rfcomm_session_clear_timer(s);
1140                         }
1141
1142                         break;
1143                 }
1144         } else {
1145                 /* Control channel */
1146                 switch (s->state) {
1147                 case BT_CONNECT:
1148                         s->state = BT_CONNECTED;
1149                         rfcomm_process_connect(s);
1150                         break;
1151
1152                 case BT_DISCONN:
1153                         /* rfcomm_session_put is called later so don't do
1154                          * anything here otherwise we will mess up the session
1155                          * reference counter:
1156                          *
1157                          * (a) when we are the initiator dlc_unlink will drive
1158                          * the reference counter to 0 (there is no initial put
1159                          * after session_add)
1160                          *
1161                          * (b) when we are not the initiator rfcomm_rx_process
1162                          * will explicitly call put to balance the initial hold
1163                          * done after session add.
1164                          */
1165                         break;
1166                 }
1167         }
1168         return 0;
1169 }
1170
1171 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1172 {
1173         int err = 0;
1174
1175         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1176
1177         if (dlci) {
1178                 /* Data DLC */
1179                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1180                 if (d) {
1181                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1182                                 err = ECONNREFUSED;
1183                         else
1184                                 err = ECONNRESET;
1185
1186                         d->state = BT_CLOSED;
1187                         __rfcomm_dlc_close(d, err);
1188                 }
1189         } else {
1190                 if (s->state == BT_CONNECT)
1191                         err = ECONNREFUSED;
1192                 else
1193                         err = ECONNRESET;
1194
1195                 s->state = BT_CLOSED;
1196                 rfcomm_session_close(s, err);
1197         }
1198         return 0;
1199 }
1200
1201 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1202 {
1203         int err = 0;
1204
1205         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1206
1207         if (dlci) {
1208                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1209                 if (d) {
1210                         rfcomm_send_ua(s, dlci);
1211
1212                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1213                                 err = ECONNREFUSED;
1214                         else
1215                                 err = ECONNRESET;
1216
1217                         d->state = BT_CLOSED;
1218                         __rfcomm_dlc_close(d, err);
1219                 } else
1220                         rfcomm_send_dm(s, dlci);
1221
1222         } else {
1223                 rfcomm_send_ua(s, 0);
1224
1225                 if (s->state == BT_CONNECT)
1226                         err = ECONNREFUSED;
1227                 else
1228                         err = ECONNRESET;
1229
1230                 s->state = BT_CLOSED;
1231                 rfcomm_session_close(s, err);
1232         }
1233
1234         return 0;
1235 }
1236
1237 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1238 {
1239         struct sock *sk = d->session->sock->sk;
1240         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1241
1242         BT_DBG("dlc %p", d);
1243
1244         rfcomm_send_ua(d->session, d->dlci);
1245
1246         rfcomm_dlc_clear_timer(d);
1247
1248         rfcomm_dlc_lock(d);
1249         d->state = BT_CONNECTED;
1250         d->state_change(d, 0);
1251         rfcomm_dlc_unlock(d);
1252
1253         if (d->role_switch)
1254                 hci_conn_switch_role(conn->hcon, 0x00);
1255
1256         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1257 }
1258
1259 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1260 {
1261         if (rfcomm_check_security(d)) {
1262                 if (d->defer_setup) {
1263                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1264                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1265
1266                         rfcomm_dlc_lock(d);
1267                         d->state = BT_CONNECT2;
1268                         d->state_change(d, 0);
1269                         rfcomm_dlc_unlock(d);
1270                 } else
1271                         rfcomm_dlc_accept(d);
1272         } else {
1273                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1274                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1275         }
1276 }
1277
1278 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1279 {
1280         struct rfcomm_dlc *d;
1281         u8 channel;
1282
1283         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1284
1285         if (!dlci) {
1286                 rfcomm_send_ua(s, 0);
1287
1288                 if (s->state == BT_OPEN) {
1289                         s->state = BT_CONNECTED;
1290                         rfcomm_process_connect(s);
1291                 }
1292                 return 0;
1293         }
1294
1295         /* Check if DLC exists */
1296         d = rfcomm_dlc_get(s, dlci);
1297         if (d) {
1298                 if (d->state == BT_OPEN) {
1299                         /* DLC was previously opened by PN request */
1300                         rfcomm_check_accept(d);
1301                 }
1302                 return 0;
1303         }
1304
1305         /* Notify socket layer about incoming connection */
1306         channel = __srv_channel(dlci);
1307         if (rfcomm_connect_ind(s, channel, &d)) {
1308                 d->dlci = dlci;
1309                 d->addr = __addr(s->initiator, dlci);
1310                 rfcomm_dlc_link(s, d);
1311
1312                 rfcomm_check_accept(d);
1313         } else {
1314                 rfcomm_send_dm(s, dlci);
1315         }
1316
1317         return 0;
1318 }
1319
1320 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1321 {
1322         struct rfcomm_session *s = d->session;
1323
1324         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1325                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1326
1327         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1328                                                 pn->flow_ctrl == 0xe0) {
1329                 d->cfc = RFCOMM_CFC_ENABLED;
1330                 d->tx_credits = pn->credits;
1331         } else {
1332                 d->cfc = RFCOMM_CFC_DISABLED;
1333                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1334         }
1335
1336         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1337                 s->cfc = d->cfc;
1338
1339         d->priority = pn->priority;
1340
1341         d->mtu = __le16_to_cpu(pn->mtu);
1342
1343         if (cr && d->mtu > s->mtu)
1344                 d->mtu = s->mtu;
1345
1346         return 0;
1347 }
1348
1349 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1350 {
1351         struct rfcomm_pn *pn = (void *) skb->data;
1352         struct rfcomm_dlc *d;
1353         u8 dlci = pn->dlci;
1354
1355         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1356
1357         if (!dlci)
1358                 return 0;
1359
1360         d = rfcomm_dlc_get(s, dlci);
1361         if (d) {
1362                 if (cr) {
1363                         /* PN request */
1364                         rfcomm_apply_pn(d, cr, pn);
1365                         rfcomm_send_pn(s, 0, d);
1366                 } else {
1367                         /* PN response */
1368                         switch (d->state) {
1369                         case BT_CONFIG:
1370                                 rfcomm_apply_pn(d, cr, pn);
1371
1372                                 d->state = BT_CONNECT;
1373                                 rfcomm_send_sabm(s, d->dlci);
1374                                 break;
1375                         }
1376                 }
1377         } else {
1378                 u8 channel = __srv_channel(dlci);
1379
1380                 if (!cr)
1381                         return 0;
1382
1383                 /* PN request for non existing DLC.
1384                  * Assume incoming connection. */
1385                 if (rfcomm_connect_ind(s, channel, &d)) {
1386                         d->dlci = dlci;
1387                         d->addr = __addr(s->initiator, dlci);
1388                         rfcomm_dlc_link(s, d);
1389
1390                         rfcomm_apply_pn(d, cr, pn);
1391
1392                         d->state = BT_OPEN;
1393                         rfcomm_send_pn(s, 0, d);
1394                 } else {
1395                         rfcomm_send_dm(s, dlci);
1396                 }
1397         }
1398         return 0;
1399 }
1400
1401 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1402 {
1403         struct rfcomm_rpn *rpn = (void *) skb->data;
1404         u8 dlci = __get_dlci(rpn->dlci);
1405
1406         u8 bit_rate  = 0;
1407         u8 data_bits = 0;
1408         u8 stop_bits = 0;
1409         u8 parity    = 0;
1410         u8 flow_ctrl = 0;
1411         u8 xon_char  = 0;
1412         u8 xoff_char = 0;
1413         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1414
1415         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1416                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1417                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1418
1419         if (!cr)
1420                 return 0;
1421
1422         if (len == 1) {
1423                 /* This is a request, return default (according to ETSI TS 07.10) settings */
1424                 bit_rate  = RFCOMM_RPN_BR_9600;
1425                 data_bits = RFCOMM_RPN_DATA_8;
1426                 stop_bits = RFCOMM_RPN_STOP_1;
1427                 parity    = RFCOMM_RPN_PARITY_NONE;
1428                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1429                 xon_char  = RFCOMM_RPN_XON_CHAR;
1430                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1431                 goto rpn_out;
1432         }
1433
1434         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1435          * no parity, no flow control lines, normal XON/XOFF chars */
1436
1437         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1438                 bit_rate = rpn->bit_rate;
1439                 if (bit_rate > RFCOMM_RPN_BR_230400) {
1440                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1441                         bit_rate = RFCOMM_RPN_BR_9600;
1442                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1443                 }
1444         }
1445
1446         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1447                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1448                 if (data_bits != RFCOMM_RPN_DATA_8) {
1449                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1450                         data_bits = RFCOMM_RPN_DATA_8;
1451                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1452                 }
1453         }
1454
1455         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1456                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1457                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1458                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1459                         stop_bits = RFCOMM_RPN_STOP_1;
1460                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1461                 }
1462         }
1463
1464         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1465                 parity = __get_rpn_parity(rpn->line_settings);
1466                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1467                         BT_DBG("RPN parity mismatch 0x%x", parity);
1468                         parity = RFCOMM_RPN_PARITY_NONE;
1469                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1470                 }
1471         }
1472
1473         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1474                 flow_ctrl = rpn->flow_ctrl;
1475                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1476                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1477                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1478                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1479                 }
1480         }
1481
1482         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1483                 xon_char = rpn->xon_char;
1484                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1485                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1486                         xon_char = RFCOMM_RPN_XON_CHAR;
1487                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1488                 }
1489         }
1490
1491         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1492                 xoff_char = rpn->xoff_char;
1493                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1494                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1495                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1496                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1497                 }
1498         }
1499
1500 rpn_out:
1501         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1502                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1503
1504         return 0;
1505 }
1506
1507 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1508 {
1509         struct rfcomm_rls *rls = (void *) skb->data;
1510         u8 dlci = __get_dlci(rls->dlci);
1511
1512         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1513
1514         if (!cr)
1515                 return 0;
1516
1517         /* We should probably do something with this information here. But
1518          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1519          * mandatory to recognise and respond to RLS */
1520
1521         rfcomm_send_rls(s, 0, dlci, rls->status);
1522
1523         return 0;
1524 }
1525
1526 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1527 {
1528         struct rfcomm_msc *msc = (void *) skb->data;
1529         struct rfcomm_dlc *d;
1530         u8 dlci = __get_dlci(msc->dlci);
1531
1532         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1533
1534         d = rfcomm_dlc_get(s, dlci);
1535         if (!d)
1536                 return 0;
1537
1538         if (cr) {
1539                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1540                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1541                 else
1542                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1543
1544                 rfcomm_dlc_lock(d);
1545
1546                 d->remote_v24_sig = msc->v24_sig;
1547
1548                 if (d->modem_status)
1549                         d->modem_status(d, msc->v24_sig);
1550
1551                 rfcomm_dlc_unlock(d);
1552
1553                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1554
1555                 d->mscex |= RFCOMM_MSCEX_RX;
1556         } else
1557                 d->mscex |= RFCOMM_MSCEX_TX;
1558
1559         return 0;
1560 }
1561
1562 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1563 {
1564         struct rfcomm_mcc *mcc = (void *) skb->data;
1565         u8 type, cr, len;
1566
1567         cr   = __test_cr(mcc->type);
1568         type = __get_mcc_type(mcc->type);
1569         len  = __get_mcc_len(mcc->len);
1570
1571         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1572
1573         skb_pull(skb, 2);
1574
1575         switch (type) {
1576         case RFCOMM_PN:
1577                 rfcomm_recv_pn(s, cr, skb);
1578                 break;
1579
1580         case RFCOMM_RPN:
1581                 rfcomm_recv_rpn(s, cr, len, skb);
1582                 break;
1583
1584         case RFCOMM_RLS:
1585                 rfcomm_recv_rls(s, cr, skb);
1586                 break;
1587
1588         case RFCOMM_MSC:
1589                 rfcomm_recv_msc(s, cr, skb);
1590                 break;
1591
1592         case RFCOMM_FCOFF:
1593                 if (cr) {
1594                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1595                         rfcomm_send_fcoff(s, 0);
1596                 }
1597                 break;
1598
1599         case RFCOMM_FCON:
1600                 if (cr) {
1601                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1602                         rfcomm_send_fcon(s, 0);
1603                 }
1604                 break;
1605
1606         case RFCOMM_TEST:
1607                 if (cr)
1608                         rfcomm_send_test(s, 0, skb->data, skb->len);
1609                 break;
1610
1611         case RFCOMM_NSC:
1612                 break;
1613
1614         default:
1615                 BT_ERR("Unknown control type 0x%02x", type);
1616                 rfcomm_send_nsc(s, cr, type);
1617                 break;
1618         }
1619         return 0;
1620 }
1621
1622 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1623 {
1624         struct rfcomm_dlc *d;
1625
1626         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1627
1628         d = rfcomm_dlc_get(s, dlci);
1629         if (!d) {
1630                 rfcomm_send_dm(s, dlci);
1631                 goto drop;
1632         }
1633
1634         if (pf && d->cfc) {
1635                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1636
1637                 d->tx_credits += credits;
1638                 if (d->tx_credits)
1639                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1640         }
1641
1642         if (skb->len && d->state == BT_CONNECTED) {
1643                 rfcomm_dlc_lock(d);
1644                 d->rx_credits--;
1645                 d->data_ready(d, skb);
1646                 rfcomm_dlc_unlock(d);
1647                 return 0;
1648         }
1649
1650 drop:
1651         kfree_skb(skb);
1652         return 0;
1653 }
1654
1655 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1656 {
1657         struct rfcomm_hdr *hdr = (void *) skb->data;
1658         u8 type, dlci, fcs;
1659
1660         dlci = __get_dlci(hdr->addr);
1661         type = __get_type(hdr->ctrl);
1662
1663         /* Trim FCS */
1664         skb->len--; skb->tail--;
1665         fcs = *(u8 *)skb_tail_pointer(skb);
1666
1667         if (__check_fcs(skb->data, type, fcs)) {
1668                 BT_ERR("bad checksum in packet");
1669                 kfree_skb(skb);
1670                 return -EILSEQ;
1671         }
1672
1673         if (__test_ea(hdr->len))
1674                 skb_pull(skb, 3);
1675         else
1676                 skb_pull(skb, 4);
1677
1678         switch (type) {
1679         case RFCOMM_SABM:
1680                 if (__test_pf(hdr->ctrl))
1681                         rfcomm_recv_sabm(s, dlci);
1682                 break;
1683
1684         case RFCOMM_DISC:
1685                 if (__test_pf(hdr->ctrl))
1686                         rfcomm_recv_disc(s, dlci);
1687                 break;
1688
1689         case RFCOMM_UA:
1690                 if (__test_pf(hdr->ctrl))
1691                         rfcomm_recv_ua(s, dlci);
1692                 break;
1693
1694         case RFCOMM_DM:
1695                 rfcomm_recv_dm(s, dlci);
1696                 break;
1697
1698         case RFCOMM_UIH:
1699                 if (dlci)
1700                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1701
1702                 rfcomm_recv_mcc(s, skb);
1703                 break;
1704
1705         default:
1706                 BT_ERR("Unknown packet type 0x%02x", type);
1707                 break;
1708         }
1709         kfree_skb(skb);
1710         return 0;
1711 }
1712
1713 /* ---- Connection and data processing ---- */
1714
1715 static void rfcomm_process_connect(struct rfcomm_session *s)
1716 {
1717         struct rfcomm_dlc *d;
1718         struct list_head *p, *n;
1719
1720         BT_DBG("session %p state %ld", s, s->state);
1721
1722         list_for_each_safe(p, n, &s->dlcs) {
1723                 d = list_entry(p, struct rfcomm_dlc, list);
1724                 if (d->state == BT_CONFIG) {
1725                         d->mtu = s->mtu;
1726                         if (rfcomm_check_security(d)) {
1727                                 rfcomm_send_pn(s, 1, d);
1728                         } else {
1729                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1730                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1731                         }
1732                 }
1733         }
1734 }
1735
1736 /* Send data queued for the DLC.
1737  * Return number of frames left in the queue.
1738  */
1739 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1740 {
1741         struct sk_buff *skb;
1742         int err;
1743
1744         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1745                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1746
1747         /* Send pending MSC */
1748         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1749                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1750
1751         if (d->cfc) {
1752                 /* CFC enabled.
1753                  * Give them some credits */
1754                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1755                                 d->rx_credits <= (d->cfc >> 2)) {
1756                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1757                         d->rx_credits = d->cfc;
1758                 }
1759         } else {
1760                 /* CFC disabled.
1761                  * Give ourselves some credits */
1762                 d->tx_credits = 5;
1763         }
1764
1765         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1766                 return skb_queue_len(&d->tx_queue);
1767
1768         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1769                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1770                 if (err < 0) {
1771                         skb_queue_head(&d->tx_queue, skb);
1772                         break;
1773                 }
1774                 kfree_skb(skb);
1775                 d->tx_credits--;
1776         }
1777
1778         if (d->cfc && !d->tx_credits) {
1779                 /* We're out of TX credits.
1780                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1781                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1782         }
1783
1784         return skb_queue_len(&d->tx_queue);
1785 }
1786
1787 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1788 {
1789         struct rfcomm_dlc *d;
1790         struct list_head *p, *n;
1791
1792         BT_DBG("session %p state %ld", s, s->state);
1793
1794         list_for_each_safe(p, n, &s->dlcs) {
1795                 d = list_entry(p, struct rfcomm_dlc, list);
1796
1797                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1798                         __rfcomm_dlc_close(d, ETIMEDOUT);
1799                         continue;
1800                 }
1801
1802                 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1803                         __rfcomm_dlc_close(d, ECONNREFUSED);
1804                         continue;
1805                 }
1806
1807                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1808                         rfcomm_dlc_clear_timer(d);
1809                         if (d->out) {
1810                                 rfcomm_send_pn(s, 1, d);
1811                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1812                         } else {
1813                                 if (d->defer_setup) {
1814                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1815                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1816
1817                                         rfcomm_dlc_lock(d);
1818                                         d->state = BT_CONNECT2;
1819                                         d->state_change(d, 0);
1820                                         rfcomm_dlc_unlock(d);
1821                                 } else
1822                                         rfcomm_dlc_accept(d);
1823                         }
1824                         continue;
1825                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1826                         rfcomm_dlc_clear_timer(d);
1827                         if (!d->out)
1828                                 rfcomm_send_dm(s, d->dlci);
1829                         else
1830                                 d->state = BT_CLOSED;
1831                         __rfcomm_dlc_close(d, ECONNREFUSED);
1832                         continue;
1833                 }
1834
1835                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1836                         continue;
1837
1838                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1839                         continue;
1840
1841                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1842                                                 d->mscex == RFCOMM_MSCEX_OK)
1843                         rfcomm_process_tx(d);
1844         }
1845 }
1846
1847 static void rfcomm_process_rx(struct rfcomm_session *s)
1848 {
1849         struct socket *sock = s->sock;
1850         struct sock *sk = sock->sk;
1851         struct sk_buff *skb;
1852
1853         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1854
1855         /* Get data directly from socket receive queue without copying it. */
1856         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1857                 skb_orphan(skb);
1858                 if (!skb_linearize(skb))
1859                         rfcomm_recv_frame(s, skb);
1860                 else
1861                         kfree_skb(skb);
1862         }
1863
1864         if (sk->sk_state == BT_CLOSED) {
1865                 if (!s->initiator)
1866                         rfcomm_session_put(s);
1867
1868                 rfcomm_session_close(s, sk->sk_err);
1869         }
1870 }
1871
1872 static void rfcomm_accept_connection(struct rfcomm_session *s)
1873 {
1874         struct socket *sock = s->sock, *nsock;
1875         int err;
1876
1877         /* Fast check for a new connection.
1878          * Avoids unnesesary socket allocations. */
1879         if (list_empty(&bt_sk(sock->sk)->accept_q))
1880                 return;
1881
1882         BT_DBG("session %p", s);
1883
1884         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1885         if (err < 0)
1886                 return;
1887
1888         /* Set our callbacks */
1889         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1890         nsock->sk->sk_state_change = rfcomm_l2state_change;
1891
1892         s = rfcomm_session_add(nsock, BT_OPEN);
1893         if (s) {
1894                 rfcomm_session_hold(s);
1895
1896                 /* We should adjust MTU on incoming sessions.
1897                  * L2CAP MTU minus UIH header and FCS. */
1898                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1899                                 l2cap_pi(nsock->sk)->chan->imtu) - 5;
1900
1901                 rfcomm_schedule();
1902         } else
1903                 sock_release(nsock);
1904 }
1905
1906 static void rfcomm_check_connection(struct rfcomm_session *s)
1907 {
1908         struct sock *sk = s->sock->sk;
1909
1910         BT_DBG("%p state %ld", s, s->state);
1911
1912         switch (sk->sk_state) {
1913         case BT_CONNECTED:
1914                 s->state = BT_CONNECT;
1915
1916                 /* We can adjust MTU on outgoing sessions.
1917                  * L2CAP MTU minus UIH header and FCS. */
1918                 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1919
1920                 rfcomm_send_sabm(s, 0);
1921                 break;
1922
1923         case BT_CLOSED:
1924                 s->state = BT_CLOSED;
1925                 rfcomm_session_close(s, sk->sk_err);
1926                 break;
1927         }
1928 }
1929
1930 static void rfcomm_process_sessions(void)
1931 {
1932         struct list_head *p, *n;
1933
1934         rfcomm_lock();
1935
1936         list_for_each_safe(p, n, &session_list) {
1937                 struct rfcomm_session *s;
1938                 s = list_entry(p, struct rfcomm_session, list);
1939
1940                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1941                         s->state = BT_DISCONN;
1942                         rfcomm_send_disc(s, 0);
1943                         rfcomm_session_put(s);
1944                         continue;
1945                 }
1946
1947                 if (s->state == BT_LISTEN) {
1948                         rfcomm_accept_connection(s);
1949                         continue;
1950                 }
1951
1952                 rfcomm_session_hold(s);
1953
1954                 switch (s->state) {
1955                 case BT_BOUND:
1956                         rfcomm_check_connection(s);
1957                         break;
1958
1959                 default:
1960                         rfcomm_process_rx(s);
1961                         break;
1962                 }
1963
1964                 rfcomm_process_dlcs(s);
1965
1966                 rfcomm_session_put(s);
1967         }
1968
1969         rfcomm_unlock();
1970 }
1971
1972 static int rfcomm_add_listener(bdaddr_t *ba)
1973 {
1974         struct sockaddr_l2 addr;
1975         struct socket *sock;
1976         struct sock *sk;
1977         struct rfcomm_session *s;
1978         int    err = 0;
1979
1980         /* Create socket */
1981         err = rfcomm_l2sock_create(&sock);
1982         if (err < 0) {
1983                 BT_ERR("Create socket failed %d", err);
1984                 return err;
1985         }
1986
1987         /* Bind socket */
1988         bacpy(&addr.l2_bdaddr, ba);
1989         addr.l2_family = AF_BLUETOOTH;
1990         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
1991         addr.l2_cid    = 0;
1992         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1993         if (err < 0) {
1994                 BT_ERR("Bind failed %d", err);
1995                 goto failed;
1996         }
1997
1998         /* Set L2CAP options */
1999         sk = sock->sk;
2000         lock_sock(sk);
2001         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2002         release_sock(sk);
2003
2004         /* Start listening on the socket */
2005         err = kernel_listen(sock, 10);
2006         if (err) {
2007                 BT_ERR("Listen failed %d", err);
2008                 goto failed;
2009         }
2010
2011         /* Add listening session */
2012         s = rfcomm_session_add(sock, BT_LISTEN);
2013         if (!s)
2014                 goto failed;
2015
2016         rfcomm_session_hold(s);
2017         return 0;
2018 failed:
2019         sock_release(sock);
2020         return err;
2021 }
2022
2023 static void rfcomm_kill_listener(void)
2024 {
2025         struct rfcomm_session *s;
2026         struct list_head *p, *n;
2027
2028         BT_DBG("");
2029
2030         list_for_each_safe(p, n, &session_list) {
2031                 s = list_entry(p, struct rfcomm_session, list);
2032                 rfcomm_session_del(s);
2033         }
2034 }
2035
2036 static int rfcomm_run(void *unused)
2037 {
2038         BT_DBG("");
2039
2040         set_user_nice(current, -10);
2041
2042         rfcomm_add_listener(BDADDR_ANY);
2043
2044         while (1) {
2045                 set_current_state(TASK_INTERRUPTIBLE);
2046
2047                 if (kthread_should_stop())
2048                         break;
2049
2050                 /* Process stuff */
2051                 rfcomm_process_sessions();
2052
2053                 schedule();
2054         }
2055         __set_current_state(TASK_RUNNING);
2056
2057         rfcomm_kill_listener();
2058
2059         return 0;
2060 }
2061
2062 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2063 {
2064         struct rfcomm_session *s;
2065         struct rfcomm_dlc *d;
2066         struct list_head *p, *n;
2067
2068         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2069
2070         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2071         if (!s)
2072                 return;
2073
2074         rfcomm_session_hold(s);
2075
2076         list_for_each_safe(p, n, &s->dlcs) {
2077                 d = list_entry(p, struct rfcomm_dlc, list);
2078
2079                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2080                         rfcomm_dlc_clear_timer(d);
2081                         if (status || encrypt == 0x00) {
2082                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2083                                 continue;
2084                         }
2085                 }
2086
2087                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2088                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2089                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2090                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2091                                 continue;
2092                         } else if (d->sec_level == BT_SECURITY_HIGH) {
2093                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2094                                 continue;
2095                         }
2096                 }
2097
2098                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2099                         continue;
2100
2101                 if (!status && hci_conn_check_secure(conn, d->sec_level))
2102                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2103                 else
2104                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2105         }
2106
2107         rfcomm_session_put(s);
2108
2109         rfcomm_schedule();
2110 }
2111
2112 static struct hci_cb rfcomm_cb = {
2113         .name           = "RFCOMM",
2114         .security_cfm   = rfcomm_security_cfm
2115 };
2116
2117 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2118 {
2119         struct rfcomm_session *s;
2120
2121         rfcomm_lock();
2122
2123         list_for_each_entry(s, &session_list, list) {
2124                 struct rfcomm_dlc *d;
2125                 list_for_each_entry(d, &s->dlcs, list) {
2126                         struct sock *sk = s->sock->sk;
2127
2128                         seq_printf(f, "%s %s %ld %d %d %d %d\n",
2129                                                 batostr(&bt_sk(sk)->src),
2130                                                 batostr(&bt_sk(sk)->dst),
2131                                                 d->state, d->dlci, d->mtu,
2132                                                 d->rx_credits, d->tx_credits);
2133                 }
2134         }
2135
2136         rfcomm_unlock();
2137
2138         return 0;
2139 }
2140
2141 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2142 {
2143         return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2144 }
2145
2146 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2147         .open           = rfcomm_dlc_debugfs_open,
2148         .read           = seq_read,
2149         .llseek         = seq_lseek,
2150         .release        = single_release,
2151 };
2152
2153 static struct dentry *rfcomm_dlc_debugfs;
2154
2155 /* ---- Initialization ---- */
2156 static int __init rfcomm_init(void)
2157 {
2158         int err;
2159
2160         hci_register_cb(&rfcomm_cb);
2161
2162         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2163         if (IS_ERR(rfcomm_thread)) {
2164                 err = PTR_ERR(rfcomm_thread);
2165                 goto unregister;
2166         }
2167
2168         if (bt_debugfs) {
2169                 rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2170                                 bt_debugfs, NULL, &rfcomm_dlc_debugfs_fops);
2171                 if (!rfcomm_dlc_debugfs)
2172                         BT_ERR("Failed to create RFCOMM debug file");
2173         }
2174
2175         err = rfcomm_init_ttys();
2176         if (err < 0)
2177                 goto stop;
2178
2179         err = rfcomm_init_sockets();
2180         if (err < 0)
2181                 goto cleanup;
2182
2183         BT_INFO("RFCOMM ver %s", VERSION);
2184
2185         return 0;
2186
2187 cleanup:
2188         rfcomm_cleanup_ttys();
2189
2190 stop:
2191         kthread_stop(rfcomm_thread);
2192
2193 unregister:
2194         hci_unregister_cb(&rfcomm_cb);
2195
2196         return err;
2197 }
2198
2199 static void __exit rfcomm_exit(void)
2200 {
2201         debugfs_remove(rfcomm_dlc_debugfs);
2202
2203         hci_unregister_cb(&rfcomm_cb);
2204
2205         kthread_stop(rfcomm_thread);
2206
2207         rfcomm_cleanup_ttys();
2208
2209         rfcomm_cleanup_sockets();
2210 }
2211
2212 module_init(rfcomm_init);
2213 module_exit(rfcomm_exit);
2214
2215 module_param(disable_cfc, bool, 0644);
2216 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2217
2218 module_param(channel_mtu, int, 0644);
2219 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2220
2221 module_param(l2cap_mtu, uint, 0644);
2222 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2223
2224 module_param(l2cap_ertm, bool, 0644);
2225 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2226
2227 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2228 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2229 MODULE_VERSION(VERSION);
2230 MODULE_LICENSE("GPL");
2231 MODULE_ALIAS("bt-proto-3");