net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/debugfs.h>
  30 #include <linux/kthread.h>
  31 #include <asm/unaligned.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35 #include <net/bluetooth/l2cap.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define VERSION "1.11"
  39
  40 static bool disable_cfc;
  41 static bool l2cap_ertm;
  42 static int channel_mtu = -1;
  43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  44
  45 static struct task_struct *rfcomm_thread;
  46
  47 static DEFINE_MUTEX(rfcomm_mutex);
  48 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  50
  51
  52 static LIST_HEAD(session_list);
  53
  54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  64
  65 static void rfcomm_process_connect(struct rfcomm_session *s);
  66
  67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
  68                                                         bdaddr_t *dst,
  69                                                         u8 sec_level,
  70                                                         int *err);
  71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  72 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
  73
  74 /* ---- RFCOMM frame parsing macros ---- */
  75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  76 #define __get_channel(b)  ((b & 0xf8) >> 3)
  77 #define __get_dir(b)      ((b & 0x04) >> 2)
  78 #define __get_type(b)     ((b & 0xef))
  79
  80 #define __test_ea(b)      ((b & 0x01))
  81 #define __test_cr(b)      (!!(b & 0x02))
  82 #define __test_pf(b)      (!!(b & 0x10))
  83
  84 #define __session_dir(s)  ((s)->initiator ? 0x00 : 0x01)
  85
  86 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  87 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  88 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  89 #define __srv_channel(dlci)    (dlci >> 1)
  90 #define __dir(dlci)            (dlci & 0x01)
  91
  92 #define __len8(len)       (((len) << 1) | 1)
  93 #define __len16(len)      ((len) << 1)
  94
  95 /* MCC macros */
  96 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
  97 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
  98 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
  99
 100 /* RPN macros */
 101 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 102 #define __get_rpn_data_bits(line) ((line) & 0x3)
 103 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 104 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 105
 106 static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
 107
 108 static void rfcomm_schedule(void)
 109 {
 110         wake_up_all(&rfcomm_wq);
 111 }
 112
 113 /* ---- RFCOMM FCS computation ---- */
 114
 115 /* reversed, 8-bit, poly=0x07 */
 116 static unsigned char rfcomm_crc_table[256] = {
 117         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 118         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 119         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 120         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 121
 122         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 123         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 124         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 125         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 126
 127         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 128         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 129         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 130         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 131
 132         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 133         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 134         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 135         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 136
 137         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 138         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 139         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 140         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 141
 142         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 143         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 144         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 145         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 146
 147         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 148         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 149         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 150         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 151
 152         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 153         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 154         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 155         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 156 };
 157
 158 /* CRC on 2 bytes */
 159 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 160
 161 /* FCS on 2 bytes */
 162 static inline u8 __fcs(u8 *data)
 163 {
 164         return 0xff - __crc(data);
 165 }
 166
 167 /* FCS on 3 bytes */
 168 static inline u8 __fcs2(u8 *data)
 169 {
 170         return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
 171 }
 172
 173 /* Check FCS */
 174 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 175 {
 176         u8 f = __crc(data);
 177
 178         if (type != RFCOMM_UIH)
 179                 f = rfcomm_crc_table[f ^ data[2]];
 180
 181         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 182 }
 183
 184 /* ---- L2CAP callbacks ---- */
 185 static void rfcomm_l2state_change(struct sock *sk)
 186 {
 187         BT_DBG("%p state %d", sk, sk->sk_state);
 188         rfcomm_schedule();
 189 }
 190
 191 static void rfcomm_l2data_ready(struct sock *sk)
 192 {
 193         BT_DBG("%p", sk);
 194         rfcomm_schedule();
 195 }
 196
 197 static int rfcomm_l2sock_create(struct socket **sock)
 198 {
 199         int err;
 200
 201         BT_DBG("");
 202
 203         err = sock_create_kern(&init_net, PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 204         if (!err) {
 205                 struct sock *sk = (*sock)->sk;
 206                 sk->sk_data_ready   = rfcomm_l2data_ready;
 207                 sk->sk_state_change = rfcomm_l2state_change;
 208         }
 209         return err;
 210 }
 211
 212 static int rfcomm_check_security(struct rfcomm_dlc *d)
 213 {
 214         struct sock *sk = d->session->sock->sk;
 215         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 216
 217         __u8 auth_type;
 218
 219         switch (d->sec_level) {
 220         case BT_SECURITY_HIGH:
 221         case BT_SECURITY_FIPS:
 222                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
 223                 break;
 224         case BT_SECURITY_MEDIUM:
 225                 auth_type = HCI_AT_GENERAL_BONDING;
 226                 break;
 227         default:
 228                 auth_type = HCI_AT_NO_BONDING;
 229                 break;
 230         }
 231
 232         return hci_conn_security(conn->hcon, d->sec_level, auth_type,
 233                                  d->out);
 234 }
 235
 236 static void rfcomm_session_timeout(struct timer_list *t)
 237 {
 238         struct rfcomm_session *s = from_timer(s, t, timer);
 239
 240         BT_DBG("session %p state %ld", s, s->state);
 241
 242         set_bit(RFCOMM_TIMED_OUT, &s->flags);
 243         rfcomm_schedule();
 244 }
 245
 246 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 247 {
 248         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 249
 250         mod_timer(&s->timer, jiffies + timeout);
 251 }
 252
 253 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 254 {
 255         BT_DBG("session %p state %ld", s, s->state);
 256
 257         del_timer_sync(&s->timer);
 258 }
 259
 260 /* ---- RFCOMM DLCs ---- */
 261 static void rfcomm_dlc_timeout(struct timer_list *t)
 262 {
 263         struct rfcomm_dlc *d = from_timer(d, t, timer);
 264
 265         BT_DBG("dlc %p state %ld", d, d->state);
 266
 267         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 268         rfcomm_dlc_put(d);
 269         rfcomm_schedule();
 270 }
 271
 272 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 273 {
 274         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 275
 276         if (!mod_timer(&d->timer, jiffies + timeout))
 277                 rfcomm_dlc_hold(d);
 278 }
 279
 280 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 281 {
 282         BT_DBG("dlc %p state %ld", d, d->state);
 283
 284         if (del_timer(&d->timer))
 285                 rfcomm_dlc_put(d);
 286 }
 287
 288 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 289 {
 290         BT_DBG("%p", d);
 291
 292         d->state      = BT_OPEN;
 293         d->flags      = 0;
 294         d->mscex      = 0;
 295         d->sec_level  = BT_SECURITY_LOW;
 296         d->mtu        = RFCOMM_DEFAULT_MTU;
 297         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 298
 299         d->cfc        = RFCOMM_CFC_DISABLED;
 300         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 301 }
 302
 303 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 304 {
 305         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 306
 307         if (!d)
 308                 return NULL;
 309
 310         timer_setup(&d->timer, rfcomm_dlc_timeout, 0);
 311
 312         skb_queue_head_init(&d->tx_queue);
 313         mutex_init(&d->lock);
 314         refcount_set(&d->refcnt, 1);
 315
 316         rfcomm_dlc_clear_state(d);
 317
 318         BT_DBG("%p", d);
 319
 320         return d;
 321 }
 322
 323 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 324 {
 325         BT_DBG("%p", d);
 326
 327         skb_queue_purge(&d->tx_queue);
 328         kfree(d);
 329 }
 330
 331 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 332 {
 333         BT_DBG("dlc %p session %p", d, s);
 334
 335         rfcomm_session_clear_timer(s);
 336         rfcomm_dlc_hold(d);
 337         list_add(&d->list, &s->dlcs);
 338         d->session = s;
 339 }
 340
 341 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 342 {
 343         struct rfcomm_session *s = d->session;
 344
 345         BT_DBG("dlc %p refcnt %d session %p", d, refcount_read(&d->refcnt), s);
 346
 347         list_del(&d->list);
 348         d->session = NULL;
 349         rfcomm_dlc_put(d);
 350
 351         if (list_empty(&s->dlcs))
 352                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
 353 }
 354
 355 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 356 {
 357         struct rfcomm_dlc *d;
 358
 359         list_for_each_entry(d, &s->dlcs, list)
 360                 if (d->dlci == dlci)
 361                         return d;
 362
 363         return NULL;
 364 }
 365
 366 static int rfcomm_check_channel(u8 channel)
 367 {
 368         return channel < 1 || channel > 30;
 369 }
 370
 371 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 372 {
 373         struct rfcomm_session *s;
 374         int err = 0;
 375         u8 dlci;
 376
 377         BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
 378                d, d->state, src, dst, channel);
 379
 380         if (rfcomm_check_channel(channel))
 381                 return -EINVAL;
 382
 383         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 384                 return 0;
 385
 386         s = rfcomm_session_get(src, dst);
 387         if (!s) {
 388                 s = rfcomm_session_create(src, dst, d->sec_level, &err);
 389                 if (!s)
 390                         return err;
 391         }
 392
 393         dlci = __dlci(__session_dir(s), channel);
 394
 395         /* Check if DLCI already exists */
 396         if (rfcomm_dlc_get(s, dlci))
 397                 return -EBUSY;
 398
 399         rfcomm_dlc_clear_state(d);
 400
 401         d->dlci     = dlci;
 402         d->addr     = __addr(s->initiator, dlci);
 403         d->priority = 7;
 404
 405         d->state = BT_CONFIG;
 406         rfcomm_dlc_link(s, d);
 407
 408         d->out = 1;
 409
 410         d->mtu = s->mtu;
 411         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 412
 413         if (s->state == BT_CONNECTED) {
 414                 if (rfcomm_check_security(d))
 415                         rfcomm_send_pn(s, 1, d);
 416                 else
 417                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 418         }
 419
 420         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 421
 422         return 0;
 423 }
 424
 425 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 426 {
 427         int r;
 428
 429         rfcomm_lock();
 430
 431         r = __rfcomm_dlc_open(d, src, dst, channel);
 432
 433         rfcomm_unlock();
 434         return r;
 435 }
 436
 437 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
 438 {
 439         struct rfcomm_session *s = d->session;
 440
 441         d->state = BT_DISCONN;
 442         if (skb_queue_empty(&d->tx_queue)) {
 443                 rfcomm_send_disc(s, d->dlci);
 444                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 445         } else {
 446                 rfcomm_queue_disc(d);
 447                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 448         }
 449 }
 450
 451 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 452 {
 453         struct rfcomm_session *s = d->session;
 454         if (!s)
 455                 return 0;
 456
 457         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 458                         d, d->state, d->dlci, err, s);
 459
 460         switch (d->state) {
 461         case BT_CONNECT:
 462         case BT_CONFIG:
 463         case BT_OPEN:
 464         case BT_CONNECT2:
 465                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 466                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 467                         rfcomm_schedule();
 468                         return 0;
 469                 }
 470         }
 471
 472         switch (d->state) {
 473         case BT_CONNECT:
 474         case BT_CONNECTED:
 475                 __rfcomm_dlc_disconn(d);
 476                 break;
 477
 478         case BT_CONFIG:
 479                 if (s->state != BT_BOUND) {
 480                         __rfcomm_dlc_disconn(d);
 481                         break;
 482                 }
 483                 /* if closing a dlc in a session that hasn't been started,
 484                  * just close and unlink the dlc
 485                  */
 486                 /* fall through */
 487
 488         default:
 489                 rfcomm_dlc_clear_timer(d);
 490
 491                 rfcomm_dlc_lock(d);
 492                 d->state = BT_CLOSED;
 493                 d->state_change(d, err);
 494                 rfcomm_dlc_unlock(d);
 495
 496                 skb_queue_purge(&d->tx_queue);
 497                 rfcomm_dlc_unlink(d);
 498         }
 499
 500         return 0;
 501 }
 502
 503 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 504 {
 505         int r = 0;
 506         struct rfcomm_dlc *d_list;
 507         struct rfcomm_session *s, *s_list;
 508
 509         BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
 510
 511         rfcomm_lock();
 512
 513         s = d->session;
 514         if (!s)
 515                 goto no_session;
 516
 517         /* after waiting on the mutex check the session still exists
 518          * then check the dlc still exists
 519          */
 520         list_for_each_entry(s_list, &session_list, list) {
 521                 if (s_list == s) {
 522                         list_for_each_entry(d_list, &s->dlcs, list) {
 523                                 if (d_list == d) {
 524                                         r = __rfcomm_dlc_close(d, err);
 525                                         break;
 526                                 }
 527                         }
 528                         break;
 529                 }
 530         }
 531
 532 no_session:
 533         rfcomm_unlock();
 534         return r;
 535 }
 536
 537 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
 538 {
 539         struct rfcomm_session *s;
 540         struct rfcomm_dlc *dlc = NULL;
 541         u8 dlci;
 542
 543         if (rfcomm_check_channel(channel))
 544                 return ERR_PTR(-EINVAL);
 545
 546         rfcomm_lock();
 547         s = rfcomm_session_get(src, dst);
 548         if (s) {
 549                 dlci = __dlci(__session_dir(s), channel);
 550                 dlc = rfcomm_dlc_get(s, dlci);
 551         }
 552         rfcomm_unlock();
 553         return dlc;
 554 }
 555
 556 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 557 {
 558         int len = skb->len;
 559
 560         if (d->state != BT_CONNECTED)
 561                 return -ENOTCONN;
 562
 563         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 564
 565         if (len > d->mtu)
 566                 return -EINVAL;
 567
 568         rfcomm_make_uih(skb, d->addr);
 569         skb_queue_tail(&d->tx_queue, skb);
 570
 571         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 572                 rfcomm_schedule();
 573         return len;
 574 }
 575
 576 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
 577 {
 578         int len = skb->len;
 579
 580         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 581
 582         rfcomm_make_uih(skb, d->addr);
 583         skb_queue_tail(&d->tx_queue, skb);
 584
 585         if (d->state == BT_CONNECTED &&
 586             !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 587                 rfcomm_schedule();
 588 }
 589
 590 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 591 {
 592         BT_DBG("dlc %p state %ld", d, d->state);
 593
 594         if (!d->cfc) {
 595                 d->v24_sig |= RFCOMM_V24_FC;
 596                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 597         }
 598         rfcomm_schedule();
 599 }
 600
 601 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 602 {
 603         BT_DBG("dlc %p state %ld", d, d->state);
 604
 605         if (!d->cfc) {
 606                 d->v24_sig &= ~RFCOMM_V24_FC;
 607                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 608         }
 609         rfcomm_schedule();
 610 }
 611
 612 /*
 613    Set/get modem status functions use _local_ status i.e. what we report
 614    to the other side.
 615    Remote status is provided by dlc->modem_status() callback.
 616  */
 617 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 618 {
 619         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 620                         d, d->state, v24_sig);
 621
 622         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 623                 v24_sig |= RFCOMM_V24_FC;
 624         else
 625                 v24_sig &= ~RFCOMM_V24_FC;
 626
 627         d->v24_sig = v24_sig;
 628
 629         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 630                 rfcomm_schedule();
 631
 632         return 0;
 633 }
 634
 635 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 636 {
 637         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 638                         d, d->state, d->v24_sig);
 639
 640         *v24_sig = d->v24_sig;
 641         return 0;
 642 }
 643
 644 /* ---- RFCOMM sessions ---- */
 645 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 646 {
 647         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 648
 649         if (!s)
 650                 return NULL;
 651
 652         BT_DBG("session %p sock %p", s, sock);
 653
 654         timer_setup(&s->timer, rfcomm_session_timeout, 0);
 655
 656         INIT_LIST_HEAD(&s->dlcs);
 657         s->state = state;
 658         s->sock  = sock;
 659
 660         s->mtu = RFCOMM_DEFAULT_MTU;
 661         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 662
 663         /* Do not increment module usage count for listening sessions.
 664          * Otherwise we won't be able to unload the module. */
 665         if (state != BT_LISTEN)
 666                 if (!try_module_get(THIS_MODULE)) {
 667                         kfree(s);
 668                         return NULL;
 669                 }
 670
 671         list_add(&s->list, &session_list);
 672
 673         return s;
 674 }
 675
 676 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
 677 {
 678         int state = s->state;
 679
 680         BT_DBG("session %p state %ld", s, s->state);
 681
 682         list_del(&s->list);
 683
 684         rfcomm_session_clear_timer(s);
 685         sock_release(s->sock);
 686         kfree(s);
 687
 688         if (state != BT_LISTEN)
 689                 module_put(THIS_MODULE);
 690
 691         return NULL;
 692 }
 693
 694 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 695 {
 696         struct rfcomm_session *s, *n;
 697         struct l2cap_chan *chan;
 698         list_for_each_entry_safe(s, n, &session_list, list) {
 699                 chan = l2cap_pi(s->sock->sk)->chan;
 700
 701                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
 702                     !bacmp(&chan->dst, dst))
 703                         return s;
 704         }
 705         return NULL;
 706 }
 707
 708 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
 709                                                    int err)
 710 {
 711         struct rfcomm_dlc *d, *n;
 712
 713         s->state = BT_CLOSED;
 714
 715         BT_DBG("session %p state %ld err %d", s, s->state, err);
 716
 717         /* Close all dlcs */
 718         list_for_each_entry_safe(d, n, &s->dlcs, list) {
 719                 d->state = BT_CLOSED;
 720                 __rfcomm_dlc_close(d, err);
 721         }
 722
 723         rfcomm_session_clear_timer(s);
 724         return rfcomm_session_del(s);
 725 }
 726
 727 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 728                                                         bdaddr_t *dst,
 729                                                         u8 sec_level,
 730                                                         int *err)
 731 {
 732         struct rfcomm_session *s = NULL;
 733         struct sockaddr_l2 addr;
 734         struct socket *sock;
 735         struct sock *sk;
 736
 737         BT_DBG("%pMR -> %pMR", src, dst);
 738
 739         *err = rfcomm_l2sock_create(&sock);
 740         if (*err < 0)
 741                 return NULL;
 742
 743         bacpy(&addr.l2_bdaddr, src);
 744         addr.l2_family = AF_BLUETOOTH;
 745         addr.l2_psm    = 0;
 746         addr.l2_cid    = 0;
 747         addr.l2_bdaddr_type = BDADDR_BREDR;
 748         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 749         if (*err < 0)
 750                 goto failed;
 751
 752         /* Set L2CAP options */
 753         sk = sock->sk;
 754         lock_sock(sk);
 755         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
 756         l2cap_pi(sk)->chan->sec_level = sec_level;
 757         if (l2cap_ertm)
 758                 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
 759         release_sock(sk);
 760
 761         s = rfcomm_session_add(sock, BT_BOUND);
 762         if (!s) {
 763                 *err = -ENOMEM;
 764                 goto failed;
 765         }
 766
 767         s->initiator = 1;
 768
 769         bacpy(&addr.l2_bdaddr, dst);
 770         addr.l2_family = AF_BLUETOOTH;
 771         addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
 772         addr.l2_cid    = 0;
 773         addr.l2_bdaddr_type = BDADDR_BREDR;
 774         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 775         if (*err == 0 || *err == -EINPROGRESS)
 776                 return s;
 777
 778         return rfcomm_session_del(s);
 779
 780 failed:
 781         sock_release(sock);
 782         return NULL;
 783 }
 784
 785 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 786 {
 787         struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
 788         if (src)
 789                 bacpy(src, &chan->src);
 790         if (dst)
 791                 bacpy(dst, &chan->dst);
 792 }
 793
 794 /* ---- RFCOMM frame sending ---- */
 795 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 796 {
 797         struct kvec iv = { data, len };
 798         struct msghdr msg;
 799
 800         BT_DBG("session %p len %d", s, len);
 801
 802         memset(&msg, 0, sizeof(msg));
 803
 804         return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
 805 }
 806
 807 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
 808 {
 809         BT_DBG("%p cmd %u", s, cmd->ctrl);
 810
 811         return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
 812 }
 813
 814 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 815 {
 816         struct rfcomm_cmd cmd;
 817
 818         BT_DBG("%p dlci %d", s, dlci);
 819
 820         cmd.addr = __addr(s->initiator, dlci);
 821         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 822         cmd.len  = __len8(0);
 823         cmd.fcs  = __fcs2((u8 *) &cmd);
 824
 825         return rfcomm_send_cmd(s, &cmd);
 826 }
 827
 828 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 829 {
 830         struct rfcomm_cmd cmd;
 831
 832         BT_DBG("%p dlci %d", s, dlci);
 833
 834         cmd.addr = __addr(!s->initiator, dlci);
 835         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 836         cmd.len  = __len8(0);
 837         cmd.fcs  = __fcs2((u8 *) &cmd);
 838
 839         return rfcomm_send_cmd(s, &cmd);
 840 }
 841
 842 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 843 {
 844         struct rfcomm_cmd cmd;
 845
 846         BT_DBG("%p dlci %d", s, dlci);
 847
 848         cmd.addr = __addr(s->initiator, dlci);
 849         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 850         cmd.len  = __len8(0);
 851         cmd.fcs  = __fcs2((u8 *) &cmd);
 852
 853         return rfcomm_send_cmd(s, &cmd);
 854 }
 855
 856 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 857 {
 858         struct rfcomm_cmd *cmd;
 859         struct sk_buff *skb;
 860
 861         BT_DBG("dlc %p dlci %d", d, d->dlci);
 862
 863         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 864         if (!skb)
 865                 return -ENOMEM;
 866
 867         cmd = __skb_put(skb, sizeof(*cmd));
 868         cmd->addr = d->addr;
 869         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 870         cmd->len  = __len8(0);
 871         cmd->fcs  = __fcs2((u8 *) cmd);
 872
 873         skb_queue_tail(&d->tx_queue, skb);
 874         rfcomm_schedule();
 875         return 0;
 876 }
 877
 878 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 879 {
 880         struct rfcomm_cmd cmd;
 881
 882         BT_DBG("%p dlci %d", s, dlci);
 883
 884         cmd.addr = __addr(!s->initiator, dlci);
 885         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 886         cmd.len  = __len8(0);
 887         cmd.fcs  = __fcs2((u8 *) &cmd);
 888
 889         return rfcomm_send_cmd(s, &cmd);
 890 }
 891
 892 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 893 {
 894         struct rfcomm_hdr *hdr;
 895         struct rfcomm_mcc *mcc;
 896         u8 buf[16], *ptr = buf;
 897
 898         BT_DBG("%p cr %d type %d", s, cr, type);
 899
 900         hdr = (void *) ptr; ptr += sizeof(*hdr);
 901         hdr->addr = __addr(s->initiator, 0);
 902         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 903         hdr->len  = __len8(sizeof(*mcc) + 1);
 904
 905         mcc = (void *) ptr; ptr += sizeof(*mcc);
 906         mcc->type = __mcc_type(0, RFCOMM_NSC);
 907         mcc->len  = __len8(1);
 908
 909         /* Type that we didn't like */
 910         *ptr = __mcc_type(cr, type); ptr++;
 911
 912         *ptr = __fcs(buf); ptr++;
 913
 914         return rfcomm_send_frame(s, buf, ptr - buf);
 915 }
 916
 917 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 918 {
 919         struct rfcomm_hdr *hdr;
 920         struct rfcomm_mcc *mcc;
 921         struct rfcomm_pn  *pn;
 922         u8 buf[16], *ptr = buf;
 923
 924         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 925
 926         hdr = (void *) ptr; ptr += sizeof(*hdr);
 927         hdr->addr = __addr(s->initiator, 0);
 928         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 929         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 930
 931         mcc = (void *) ptr; ptr += sizeof(*mcc);
 932         mcc->type = __mcc_type(cr, RFCOMM_PN);
 933         mcc->len  = __len8(sizeof(*pn));
 934
 935         pn = (void *) ptr; ptr += sizeof(*pn);
 936         pn->dlci        = d->dlci;
 937         pn->priority    = d->priority;
 938         pn->ack_timer   = 0;
 939         pn->max_retrans = 0;
 940
 941         if (s->cfc) {
 942                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 943                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 944         } else {
 945                 pn->flow_ctrl = 0;
 946                 pn->credits   = 0;
 947         }
 948
 949         if (cr && channel_mtu >= 0)
 950                 pn->mtu = cpu_to_le16(channel_mtu);
 951         else
 952                 pn->mtu = cpu_to_le16(d->mtu);
 953
 954         *ptr = __fcs(buf); ptr++;
 955
 956         return rfcomm_send_frame(s, buf, ptr - buf);
 957 }
 958
 959 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 960                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 961                         u8 parity, u8 flow_ctrl_settings,
 962                         u8 xon_char, u8 xoff_char, u16 param_mask)
 963 {
 964         struct rfcomm_hdr *hdr;
 965         struct rfcomm_mcc *mcc;
 966         struct rfcomm_rpn *rpn;
 967         u8 buf[16], *ptr = buf;
 968
 969         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 970                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 971                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 972                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 973
 974         hdr = (void *) ptr; ptr += sizeof(*hdr);
 975         hdr->addr = __addr(s->initiator, 0);
 976         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 977         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 978
 979         mcc = (void *) ptr; ptr += sizeof(*mcc);
 980         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 981         mcc->len  = __len8(sizeof(*rpn));
 982
 983         rpn = (void *) ptr; ptr += sizeof(*rpn);
 984         rpn->dlci          = __addr(1, dlci);
 985         rpn->bit_rate      = bit_rate;
 986         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 987         rpn->flow_ctrl     = flow_ctrl_settings;
 988         rpn->xon_char      = xon_char;
 989         rpn->xoff_char     = xoff_char;
 990         rpn->param_mask    = cpu_to_le16(param_mask);
 991
 992         *ptr = __fcs(buf); ptr++;
 993
 994         return rfcomm_send_frame(s, buf, ptr - buf);
 995 }
 996
 997 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 998 {
 999         struct rfcomm_hdr *hdr;
1000         struct rfcomm_mcc *mcc;
1001         struct rfcomm_rls *rls;
1002         u8 buf[16], *ptr = buf;
1003
1004         BT_DBG("%p cr %d status 0x%x", s, cr, status);
1005
1006         hdr = (void *) ptr; ptr += sizeof(*hdr);
1007         hdr->addr = __addr(s->initiator, 0);
1008         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1009         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
1010
1011         mcc = (void *) ptr; ptr += sizeof(*mcc);
1012         mcc->type = __mcc_type(cr, RFCOMM_RLS);
1013         mcc->len  = __len8(sizeof(*rls));
1014
1015         rls = (void *) ptr; ptr += sizeof(*rls);
1016         rls->dlci   = __addr(1, dlci);
1017         rls->status = status;
1018
1019         *ptr = __fcs(buf); ptr++;
1020
1021         return rfcomm_send_frame(s, buf, ptr - buf);
1022 }
1023
1024 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1025 {
1026         struct rfcomm_hdr *hdr;
1027         struct rfcomm_mcc *mcc;
1028         struct rfcomm_msc *msc;
1029         u8 buf[16], *ptr = buf;
1030
1031         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1032
1033         hdr = (void *) ptr; ptr += sizeof(*hdr);
1034         hdr->addr = __addr(s->initiator, 0);
1035         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1036         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
1037
1038         mcc = (void *) ptr; ptr += sizeof(*mcc);
1039         mcc->type = __mcc_type(cr, RFCOMM_MSC);
1040         mcc->len  = __len8(sizeof(*msc));
1041
1042         msc = (void *) ptr; ptr += sizeof(*msc);
1043         msc->dlci    = __addr(1, dlci);
1044         msc->v24_sig = v24_sig | 0x01;
1045
1046         *ptr = __fcs(buf); ptr++;
1047
1048         return rfcomm_send_frame(s, buf, ptr - buf);
1049 }
1050
1051 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1052 {
1053         struct rfcomm_hdr *hdr;
1054         struct rfcomm_mcc *mcc;
1055         u8 buf[16], *ptr = buf;
1056
1057         BT_DBG("%p cr %d", s, cr);
1058
1059         hdr = (void *) ptr; ptr += sizeof(*hdr);
1060         hdr->addr = __addr(s->initiator, 0);
1061         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1062         hdr->len  = __len8(sizeof(*mcc));
1063
1064         mcc = (void *) ptr; ptr += sizeof(*mcc);
1065         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1066         mcc->len  = __len8(0);
1067
1068         *ptr = __fcs(buf); ptr++;
1069
1070         return rfcomm_send_frame(s, buf, ptr - buf);
1071 }
1072
1073 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1074 {
1075         struct rfcomm_hdr *hdr;
1076         struct rfcomm_mcc *mcc;
1077         u8 buf[16], *ptr = buf;
1078
1079         BT_DBG("%p cr %d", s, cr);
1080
1081         hdr = (void *) ptr; ptr += sizeof(*hdr);
1082         hdr->addr = __addr(s->initiator, 0);
1083         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1084         hdr->len  = __len8(sizeof(*mcc));
1085
1086         mcc = (void *) ptr; ptr += sizeof(*mcc);
1087         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1088         mcc->len  = __len8(0);
1089
1090         *ptr = __fcs(buf); ptr++;
1091
1092         return rfcomm_send_frame(s, buf, ptr - buf);
1093 }
1094
1095 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1096 {
1097         struct socket *sock = s->sock;
1098         struct kvec iv[3];
1099         struct msghdr msg;
1100         unsigned char hdr[5], crc[1];
1101
1102         if (len > 125)
1103                 return -EINVAL;
1104
1105         BT_DBG("%p cr %d", s, cr);
1106
1107         hdr[0] = __addr(s->initiator, 0);
1108         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1109         hdr[2] = 0x01 | ((len + 2) << 1);
1110         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1111         hdr[4] = 0x01 | (len << 1);
1112
1113         crc[0] = __fcs(hdr);
1114
1115         iv[0].iov_base = hdr;
1116         iv[0].iov_len  = 5;
1117         iv[1].iov_base = pattern;
1118         iv[1].iov_len  = len;
1119         iv[2].iov_base = crc;
1120         iv[2].iov_len  = 1;
1121
1122         memset(&msg, 0, sizeof(msg));
1123
1124         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1125 }
1126
1127 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1128 {
1129         struct rfcomm_hdr *hdr;
1130         u8 buf[16], *ptr = buf;
1131
1132         BT_DBG("%p addr %d credits %d", s, addr, credits);
1133
1134         hdr = (void *) ptr; ptr += sizeof(*hdr);
1135         hdr->addr = addr;
1136         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1137         hdr->len  = __len8(0);
1138
1139         *ptr = credits; ptr++;
1140
1141         *ptr = __fcs(buf); ptr++;
1142
1143         return rfcomm_send_frame(s, buf, ptr - buf);
1144 }
1145
1146 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1147 {
1148         struct rfcomm_hdr *hdr;
1149         int len = skb->len;
1150         u8 *crc;
1151
1152         if (len > 127) {
1153                 hdr = skb_push(skb, 4);
1154                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1155         } else {
1156                 hdr = skb_push(skb, 3);
1157                 hdr->len = __len8(len);
1158         }
1159         hdr->addr = addr;
1160         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1161
1162         crc = skb_put(skb, 1);
1163         *crc = __fcs((void *) hdr);
1164 }
1165
1166 /* ---- RFCOMM frame reception ---- */
1167 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1168 {
1169         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1170
1171         if (dlci) {
1172                 /* Data channel */
1173                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1174                 if (!d) {
1175                         rfcomm_send_dm(s, dlci);
1176                         return s;
1177                 }
1178
1179                 switch (d->state) {
1180                 case BT_CONNECT:
1181                         rfcomm_dlc_clear_timer(d);
1182
1183                         rfcomm_dlc_lock(d);
1184                         d->state = BT_CONNECTED;
1185                         d->state_change(d, 0);
1186                         rfcomm_dlc_unlock(d);
1187
1188                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1189                         break;
1190
1191                 case BT_DISCONN:
1192                         d->state = BT_CLOSED;
1193                         __rfcomm_dlc_close(d, 0);
1194
1195                         if (list_empty(&s->dlcs)) {
1196                                 s->state = BT_DISCONN;
1197                                 rfcomm_send_disc(s, 0);
1198                                 rfcomm_session_clear_timer(s);
1199                         }
1200
1201                         break;
1202                 }
1203         } else {
1204                 /* Control channel */
1205                 switch (s->state) {
1206                 case BT_CONNECT:
1207                         s->state = BT_CONNECTED;
1208                         rfcomm_process_connect(s);
1209                         break;
1210
1211                 case BT_DISCONN:
1212                         s = rfcomm_session_close(s, ECONNRESET);
1213                         break;
1214                 }
1215         }
1216         return s;
1217 }
1218
1219 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1220 {
1221         int err = 0;
1222
1223         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1224
1225         if (dlci) {
1226                 /* Data DLC */
1227                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1228                 if (d) {
1229                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1230                                 err = ECONNREFUSED;
1231                         else
1232                                 err = ECONNRESET;
1233
1234                         d->state = BT_CLOSED;
1235                         __rfcomm_dlc_close(d, err);
1236                 }
1237         } else {
1238                 if (s->state == BT_CONNECT)
1239                         err = ECONNREFUSED;
1240                 else
1241                         err = ECONNRESET;
1242
1243                 s = rfcomm_session_close(s, err);
1244         }
1245         return s;
1246 }
1247
1248 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1249                                                u8 dlci)
1250 {
1251         int err = 0;
1252
1253         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1254
1255         if (dlci) {
1256                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1257                 if (d) {
1258                         rfcomm_send_ua(s, dlci);
1259
1260                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1261                                 err = ECONNREFUSED;
1262                         else
1263                                 err = ECONNRESET;
1264
1265                         d->state = BT_CLOSED;
1266                         __rfcomm_dlc_close(d, err);
1267                 } else
1268                         rfcomm_send_dm(s, dlci);
1269
1270         } else {
1271                 rfcomm_send_ua(s, 0);
1272
1273                 if (s->state == BT_CONNECT)
1274                         err = ECONNREFUSED;
1275                 else
1276                         err = ECONNRESET;
1277
1278                 s = rfcomm_session_close(s, err);
1279         }
1280         return s;
1281 }
1282
1283 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1284 {
1285         struct sock *sk = d->session->sock->sk;
1286         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1287
1288         BT_DBG("dlc %p", d);
1289
1290         rfcomm_send_ua(d->session, d->dlci);
1291
1292         rfcomm_dlc_clear_timer(d);
1293
1294         rfcomm_dlc_lock(d);
1295         d->state = BT_CONNECTED;
1296         d->state_change(d, 0);
1297         rfcomm_dlc_unlock(d);
1298
1299         if (d->role_switch)
1300                 hci_conn_switch_role(conn->hcon, 0x00);
1301
1302         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1303 }
1304
1305 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1306 {
1307         if (rfcomm_check_security(d)) {
1308                 if (d->defer_setup) {
1309                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1310                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1311
1312                         rfcomm_dlc_lock(d);
1313                         d->state = BT_CONNECT2;
1314                         d->state_change(d, 0);
1315                         rfcomm_dlc_unlock(d);
1316                 } else
1317                         rfcomm_dlc_accept(d);
1318         } else {
1319                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1320                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1321         }
1322 }
1323
1324 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1325 {
1326         struct rfcomm_dlc *d;
1327         u8 channel;
1328
1329         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1330
1331         if (!dlci) {
1332                 rfcomm_send_ua(s, 0);
1333
1334                 if (s->state == BT_OPEN) {
1335                         s->state = BT_CONNECTED;
1336                         rfcomm_process_connect(s);
1337                 }
1338                 return 0;
1339         }
1340
1341         /* Check if DLC exists */
1342         d = rfcomm_dlc_get(s, dlci);
1343         if (d) {
1344                 if (d->state == BT_OPEN) {
1345                         /* DLC was previously opened by PN request */
1346                         rfcomm_check_accept(d);
1347                 }
1348                 return 0;
1349         }
1350
1351         /* Notify socket layer about incoming connection */
1352         channel = __srv_channel(dlci);
1353         if (rfcomm_connect_ind(s, channel, &d)) {
1354                 d->dlci = dlci;
1355                 d->addr = __addr(s->initiator, dlci);
1356                 rfcomm_dlc_link(s, d);
1357
1358                 rfcomm_check_accept(d);
1359         } else {
1360                 rfcomm_send_dm(s, dlci);
1361         }
1362
1363         return 0;
1364 }
1365
1366 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1367 {
1368         struct rfcomm_session *s = d->session;
1369
1370         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1371                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1372
1373         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1374                                                 pn->flow_ctrl == 0xe0) {
1375                 d->cfc = RFCOMM_CFC_ENABLED;
1376                 d->tx_credits = pn->credits;
1377         } else {
1378                 d->cfc = RFCOMM_CFC_DISABLED;
1379                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1380         }
1381
1382         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1383                 s->cfc = d->cfc;
1384
1385         d->priority = pn->priority;
1386
1387         d->mtu = __le16_to_cpu(pn->mtu);
1388
1389         if (cr && d->mtu > s->mtu)
1390                 d->mtu = s->mtu;
1391
1392         return 0;
1393 }
1394
1395 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1396 {
1397         struct rfcomm_pn *pn = (void *) skb->data;
1398         struct rfcomm_dlc *d;
1399         u8 dlci = pn->dlci;
1400
1401         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1402
1403         if (!dlci)
1404                 return 0;
1405
1406         d = rfcomm_dlc_get(s, dlci);
1407         if (d) {
1408                 if (cr) {
1409                         /* PN request */
1410                         rfcomm_apply_pn(d, cr, pn);
1411                         rfcomm_send_pn(s, 0, d);
1412                 } else {
1413                         /* PN response */
1414                         switch (d->state) {
1415                         case BT_CONFIG:
1416                                 rfcomm_apply_pn(d, cr, pn);
1417
1418                                 d->state = BT_CONNECT;
1419                                 rfcomm_send_sabm(s, d->dlci);
1420                                 break;
1421                         }
1422                 }
1423         } else {
1424                 u8 channel = __srv_channel(dlci);
1425
1426                 if (!cr)
1427                         return 0;
1428
1429                 /* PN request for non existing DLC.
1430                  * Assume incoming connection. */
1431                 if (rfcomm_connect_ind(s, channel, &d)) {
1432                         d->dlci = dlci;
1433                         d->addr = __addr(s->initiator, dlci);
1434                         rfcomm_dlc_link(s, d);
1435
1436                         rfcomm_apply_pn(d, cr, pn);
1437
1438                         d->state = BT_OPEN;
1439                         rfcomm_send_pn(s, 0, d);
1440                 } else {
1441                         rfcomm_send_dm(s, dlci);
1442                 }
1443         }
1444         return 0;
1445 }
1446
1447 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1448 {
1449         struct rfcomm_rpn *rpn = (void *) skb->data;
1450         u8 dlci = __get_dlci(rpn->dlci);
1451
1452         u8 bit_rate  = 0;
1453         u8 data_bits = 0;
1454         u8 stop_bits = 0;
1455         u8 parity    = 0;
1456         u8 flow_ctrl = 0;
1457         u8 xon_char  = 0;
1458         u8 xoff_char = 0;
1459         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1460
1461         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1462                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1463                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1464
1465         if (!cr)
1466                 return 0;
1467
1468         if (len == 1) {
1469                 /* This is a request, return default (according to ETSI TS 07.10) settings */
1470                 bit_rate  = RFCOMM_RPN_BR_9600;
1471                 data_bits = RFCOMM_RPN_DATA_8;
1472                 stop_bits = RFCOMM_RPN_STOP_1;
1473                 parity    = RFCOMM_RPN_PARITY_NONE;
1474                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1475                 xon_char  = RFCOMM_RPN_XON_CHAR;
1476                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1477                 goto rpn_out;
1478         }
1479
1480         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1481          * no parity, no flow control lines, normal XON/XOFF chars */
1482
1483         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1484                 bit_rate = rpn->bit_rate;
1485                 if (bit_rate > RFCOMM_RPN_BR_230400) {
1486                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1487                         bit_rate = RFCOMM_RPN_BR_9600;
1488                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1489                 }
1490         }
1491
1492         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1493                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1494                 if (data_bits != RFCOMM_RPN_DATA_8) {
1495                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1496                         data_bits = RFCOMM_RPN_DATA_8;
1497                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1498                 }
1499         }
1500
1501         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1502                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1503                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1504                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1505                         stop_bits = RFCOMM_RPN_STOP_1;
1506                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1507                 }
1508         }
1509
1510         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1511                 parity = __get_rpn_parity(rpn->line_settings);
1512                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1513                         BT_DBG("RPN parity mismatch 0x%x", parity);
1514                         parity = RFCOMM_RPN_PARITY_NONE;
1515                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1516                 }
1517         }
1518
1519         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1520                 flow_ctrl = rpn->flow_ctrl;
1521                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1522                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1523                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1524                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1525                 }
1526         }
1527
1528         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1529                 xon_char = rpn->xon_char;
1530                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1531                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1532                         xon_char = RFCOMM_RPN_XON_CHAR;
1533                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1534                 }
1535         }
1536
1537         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1538                 xoff_char = rpn->xoff_char;
1539                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1540                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1541                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1542                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1543                 }
1544         }
1545
1546 rpn_out:
1547         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1548                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1549
1550         return 0;
1551 }
1552
1553 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1554 {
1555         struct rfcomm_rls *rls = (void *) skb->data;
1556         u8 dlci = __get_dlci(rls->dlci);
1557
1558         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1559
1560         if (!cr)
1561                 return 0;
1562
1563         /* We should probably do something with this information here. But
1564          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1565          * mandatory to recognise and respond to RLS */
1566
1567         rfcomm_send_rls(s, 0, dlci, rls->status);
1568
1569         return 0;
1570 }
1571
1572 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1573 {
1574         struct rfcomm_msc *msc = (void *) skb->data;
1575         struct rfcomm_dlc *d;
1576         u8 dlci = __get_dlci(msc->dlci);
1577
1578         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1579
1580         d = rfcomm_dlc_get(s, dlci);
1581         if (!d)
1582                 return 0;
1583
1584         if (cr) {
1585                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1586                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1587                 else
1588                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1589
1590                 rfcomm_dlc_lock(d);
1591
1592                 d->remote_v24_sig = msc->v24_sig;
1593
1594                 if (d->modem_status)
1595                         d->modem_status(d, msc->v24_sig);
1596
1597                 rfcomm_dlc_unlock(d);
1598
1599                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1600
1601                 d->mscex |= RFCOMM_MSCEX_RX;
1602         } else
1603                 d->mscex |= RFCOMM_MSCEX_TX;
1604
1605         return 0;
1606 }
1607
1608 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1609 {
1610         struct rfcomm_mcc *mcc = (void *) skb->data;
1611         u8 type, cr, len;
1612
1613         cr   = __test_cr(mcc->type);
1614         type = __get_mcc_type(mcc->type);
1615         len  = __get_mcc_len(mcc->len);
1616
1617         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1618
1619         skb_pull(skb, 2);
1620
1621         switch (type) {
1622         case RFCOMM_PN:
1623                 rfcomm_recv_pn(s, cr, skb);
1624                 break;
1625
1626         case RFCOMM_RPN:
1627                 rfcomm_recv_rpn(s, cr, len, skb);
1628                 break;
1629
1630         case RFCOMM_RLS:
1631                 rfcomm_recv_rls(s, cr, skb);
1632                 break;
1633
1634         case RFCOMM_MSC:
1635                 rfcomm_recv_msc(s, cr, skb);
1636                 break;
1637
1638         case RFCOMM_FCOFF:
1639                 if (cr) {
1640                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1641                         rfcomm_send_fcoff(s, 0);
1642                 }
1643                 break;
1644
1645         case RFCOMM_FCON:
1646                 if (cr) {
1647                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1648                         rfcomm_send_fcon(s, 0);
1649                 }
1650                 break;
1651
1652         case RFCOMM_TEST:
1653                 if (cr)
1654                         rfcomm_send_test(s, 0, skb->data, skb->len);
1655                 break;
1656
1657         case RFCOMM_NSC:
1658                 break;
1659
1660         default:
1661                 BT_ERR("Unknown control type 0x%02x", type);
1662                 rfcomm_send_nsc(s, cr, type);
1663                 break;
1664         }
1665         return 0;
1666 }
1667
1668 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1669 {
1670         struct rfcomm_dlc *d;
1671
1672         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1673
1674         d = rfcomm_dlc_get(s, dlci);
1675         if (!d) {
1676                 rfcomm_send_dm(s, dlci);
1677                 goto drop;
1678         }
1679
1680         if (pf && d->cfc) {
1681                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1682
1683                 d->tx_credits += credits;
1684                 if (d->tx_credits)
1685                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1686         }
1687
1688         if (skb->len && d->state == BT_CONNECTED) {
1689                 rfcomm_dlc_lock(d);
1690                 d->rx_credits--;
1691                 d->data_ready(d, skb);
1692                 rfcomm_dlc_unlock(d);
1693                 return 0;
1694         }
1695
1696 drop:
1697         kfree_skb(skb);
1698         return 0;
1699 }
1700
1701 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1702                                                 struct sk_buff *skb)
1703 {
1704         struct rfcomm_hdr *hdr = (void *) skb->data;
1705         u8 type, dlci, fcs;
1706
1707         if (!s) {
1708                 /* no session, so free socket data */
1709                 kfree_skb(skb);
1710                 return s;
1711         }
1712
1713         dlci = __get_dlci(hdr->addr);
1714         type = __get_type(hdr->ctrl);
1715
1716         /* Trim FCS */
1717         skb->len--; skb->tail--;
1718         fcs = *(u8 *)skb_tail_pointer(skb);
1719
1720         if (__check_fcs(skb->data, type, fcs)) {
1721                 BT_ERR("bad checksum in packet");
1722                 kfree_skb(skb);
1723                 return s;
1724         }
1725
1726         if (__test_ea(hdr->len))
1727                 skb_pull(skb, 3);
1728         else
1729                 skb_pull(skb, 4);
1730
1731         switch (type) {
1732         case RFCOMM_SABM:
1733                 if (__test_pf(hdr->ctrl))
1734                         rfcomm_recv_sabm(s, dlci);
1735                 break;
1736
1737         case RFCOMM_DISC:
1738                 if (__test_pf(hdr->ctrl))
1739                         s = rfcomm_recv_disc(s, dlci);
1740                 break;
1741
1742         case RFCOMM_UA:
1743                 if (__test_pf(hdr->ctrl))
1744                         s = rfcomm_recv_ua(s, dlci);
1745                 break;
1746
1747         case RFCOMM_DM:
1748                 s = rfcomm_recv_dm(s, dlci);
1749                 break;
1750
1751         case RFCOMM_UIH:
1752                 if (dlci) {
1753                         rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1754                         return s;
1755                 }
1756                 rfcomm_recv_mcc(s, skb);
1757                 break;
1758
1759         default:
1760                 BT_ERR("Unknown packet type 0x%02x", type);
1761                 break;
1762         }
1763         kfree_skb(skb);
1764         return s;
1765 }
1766
1767 /* ---- Connection and data processing ---- */
1768
1769 static void rfcomm_process_connect(struct rfcomm_session *s)
1770 {
1771         struct rfcomm_dlc *d, *n;
1772
1773         BT_DBG("session %p state %ld", s, s->state);
1774
1775         list_for_each_entry_safe(d, n, &s->dlcs, list) {
1776                 if (d->state == BT_CONFIG) {
1777                         d->mtu = s->mtu;
1778                         if (rfcomm_check_security(d)) {
1779                                 rfcomm_send_pn(s, 1, d);
1780                         } else {
1781                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1782                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1783                         }
1784                 }
1785         }
1786 }
1787
1788 /* Send data queued for the DLC.
1789  * Return number of frames left in the queue.
1790  */
1791 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1792 {
1793         struct sk_buff *skb;
1794         int err;
1795
1796         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1797                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1798
1799         /* Send pending MSC */
1800         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1801                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1802
1803         if (d->cfc) {
1804                 /* CFC enabled.
1805                  * Give them some credits */
1806                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1807                                 d->rx_credits <= (d->cfc >> 2)) {
1808                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1809                         d->rx_credits = d->cfc;
1810                 }
1811         } else {
1812                 /* CFC disabled.
1813                  * Give ourselves some credits */
1814                 d->tx_credits = 5;
1815         }
1816
1817         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1818                 return skb_queue_len(&d->tx_queue);
1819
1820         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1821                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1822                 if (err < 0) {
1823                         skb_queue_head(&d->tx_queue, skb);
1824                         break;
1825                 }
1826                 kfree_skb(skb);
1827                 d->tx_credits--;
1828         }
1829
1830         if (d->cfc && !d->tx_credits) {
1831                 /* We're out of TX credits.
1832                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1833                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1834         }
1835
1836         return skb_queue_len(&d->tx_queue);
1837 }
1838
1839 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1840 {
1841         struct rfcomm_dlc *d, *n;
1842
1843         BT_DBG("session %p state %ld", s, s->state);
1844
1845         list_for_each_entry_safe(d, n, &s->dlcs, list) {
1846                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1847                         __rfcomm_dlc_close(d, ETIMEDOUT);
1848                         continue;
1849                 }
1850
1851                 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1852                         __rfcomm_dlc_close(d, ECONNREFUSED);
1853                         continue;
1854                 }
1855
1856                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1857                         rfcomm_dlc_clear_timer(d);
1858                         if (d->out) {
1859                                 rfcomm_send_pn(s, 1, d);
1860                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1861                         } else {
1862                                 if (d->defer_setup) {
1863                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1864                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1865
1866                                         rfcomm_dlc_lock(d);
1867                                         d->state = BT_CONNECT2;
1868                                         d->state_change(d, 0);
1869                                         rfcomm_dlc_unlock(d);
1870                                 } else
1871                                         rfcomm_dlc_accept(d);
1872                         }
1873                         continue;
1874                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1875                         rfcomm_dlc_clear_timer(d);
1876                         if (!d->out)
1877                                 rfcomm_send_dm(s, d->dlci);
1878                         else
1879                                 d->state = BT_CLOSED;
1880                         __rfcomm_dlc_close(d, ECONNREFUSED);
1881                         continue;
1882                 }
1883
1884                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1885                         continue;
1886
1887                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1888                         continue;
1889
1890                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1891                                                 d->mscex == RFCOMM_MSCEX_OK)
1892                         rfcomm_process_tx(d);
1893         }
1894 }
1895
1896 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1897 {
1898         struct socket *sock = s->sock;
1899         struct sock *sk = sock->sk;
1900         struct sk_buff *skb;
1901
1902         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1903
1904         /* Get data directly from socket receive queue without copying it. */
1905         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1906                 skb_orphan(skb);
1907                 if (!skb_linearize(skb)) {
1908                         s = rfcomm_recv_frame(s, skb);
1909                         if (!s)
1910                                 break;
1911                 } else {
1912                         kfree_skb(skb);
1913                 }
1914         }
1915
1916         if (s && (sk->sk_state == BT_CLOSED))
1917                 s = rfcomm_session_close(s, sk->sk_err);
1918
1919         return s;
1920 }
1921
1922 static void rfcomm_accept_connection(struct rfcomm_session *s)
1923 {
1924         struct socket *sock = s->sock, *nsock;
1925         int err;
1926
1927         /* Fast check for a new connection.
1928          * Avoids unnesesary socket allocations. */
1929         if (list_empty(&bt_sk(sock->sk)->accept_q))
1930                 return;
1931
1932         BT_DBG("session %p", s);
1933
1934         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1935         if (err < 0)
1936                 return;
1937
1938         /* Set our callbacks */
1939         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1940         nsock->sk->sk_state_change = rfcomm_l2state_change;
1941
1942         s = rfcomm_session_add(nsock, BT_OPEN);
1943         if (s) {
1944                 /* We should adjust MTU on incoming sessions.
1945                  * L2CAP MTU minus UIH header and FCS. */
1946                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1947                                 l2cap_pi(nsock->sk)->chan->imtu) - 5;
1948
1949                 rfcomm_schedule();
1950         } else
1951                 sock_release(nsock);
1952 }
1953
1954 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1955 {
1956         struct sock *sk = s->sock->sk;
1957
1958         BT_DBG("%p state %ld", s, s->state);
1959
1960         switch (sk->sk_state) {
1961         case BT_CONNECTED:
1962                 s->state = BT_CONNECT;
1963
1964                 /* We can adjust MTU on outgoing sessions.
1965                  * L2CAP MTU minus UIH header and FCS. */
1966                 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1967
1968                 rfcomm_send_sabm(s, 0);
1969                 break;
1970
1971         case BT_CLOSED:
1972                 s = rfcomm_session_close(s, sk->sk_err);
1973                 break;
1974         }
1975         return s;
1976 }
1977
1978 static void rfcomm_process_sessions(void)
1979 {
1980         struct rfcomm_session *s, *n;
1981
1982         rfcomm_lock();
1983
1984         list_for_each_entry_safe(s, n, &session_list, list) {
1985                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1986                         s->state = BT_DISCONN;
1987                         rfcomm_send_disc(s, 0);
1988                         continue;
1989                 }
1990
1991                 switch (s->state) {
1992                 case BT_LISTEN:
1993                         rfcomm_accept_connection(s);
1994                         continue;
1995
1996                 case BT_BOUND:
1997                         s = rfcomm_check_connection(s);
1998                         break;
1999
2000                 default:
2001                         s = rfcomm_process_rx(s);
2002                         break;
2003                 }
2004
2005                 if (s)
2006                         rfcomm_process_dlcs(s);
2007         }
2008
2009         rfcomm_unlock();
2010 }
2011
2012 static int rfcomm_add_listener(bdaddr_t *ba)
2013 {
2014         struct sockaddr_l2 addr;
2015         struct socket *sock;
2016         struct sock *sk;
2017         struct rfcomm_session *s;
2018         int    err = 0;
2019
2020         /* Create socket */
2021         err = rfcomm_l2sock_create(&sock);
2022         if (err < 0) {
2023                 BT_ERR("Create socket failed %d", err);
2024                 return err;
2025         }
2026
2027         /* Bind socket */
2028         bacpy(&addr.l2_bdaddr, ba);
2029         addr.l2_family = AF_BLUETOOTH;
2030         addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
2031         addr.l2_cid    = 0;
2032         addr.l2_bdaddr_type = BDADDR_BREDR;
2033         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
2034         if (err < 0) {
2035                 BT_ERR("Bind failed %d", err);
2036                 goto failed;
2037         }
2038
2039         /* Set L2CAP options */
2040         sk = sock->sk;
2041         lock_sock(sk);
2042         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2043         release_sock(sk);
2044
2045         /* Start listening on the socket */
2046         err = kernel_listen(sock, 10);
2047         if (err) {
2048                 BT_ERR("Listen failed %d", err);
2049                 goto failed;
2050         }
2051
2052         /* Add listening session */
2053         s = rfcomm_session_add(sock, BT_LISTEN);
2054         if (!s) {
2055                 err = -ENOMEM;
2056                 goto failed;
2057         }
2058
2059         return 0;
2060 failed:
2061         sock_release(sock);
2062         return err;
2063 }
2064
2065 static void rfcomm_kill_listener(void)
2066 {
2067         struct rfcomm_session *s, *n;
2068
2069         BT_DBG("");
2070
2071         list_for_each_entry_safe(s, n, &session_list, list)
2072                 rfcomm_session_del(s);
2073 }
2074
2075 static int rfcomm_run(void *unused)
2076 {
2077         DEFINE_WAIT_FUNC(wait, woken_wake_function);
2078         BT_DBG("");
2079
2080         set_user_nice(current, -10);
2081
2082         rfcomm_add_listener(BDADDR_ANY);
2083
2084         add_wait_queue(&rfcomm_wq, &wait);
2085         while (!kthread_should_stop()) {
2086
2087                 /* Process stuff */
2088                 rfcomm_process_sessions();
2089
2090                 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2091         }
2092         remove_wait_queue(&rfcomm_wq, &wait);
2093
2094         rfcomm_kill_listener();
2095
2096         return 0;
2097 }
2098
2099 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2100 {
2101         struct rfcomm_session *s;
2102         struct rfcomm_dlc *d, *n;
2103
2104         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2105
2106         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2107         if (!s)
2108                 return;
2109
2110         list_for_each_entry_safe(d, n, &s->dlcs, list) {
2111                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2112                         rfcomm_dlc_clear_timer(d);
2113                         if (status || encrypt == 0x00) {
2114                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2115                                 continue;
2116                         }
2117                 }
2118
2119                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2120                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2121                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2122                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2123                                 continue;
2124                         } else if (d->sec_level == BT_SECURITY_HIGH ||
2125                                    d->sec_level == BT_SECURITY_FIPS) {
2126                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2127                                 continue;
2128                         }
2129                 }
2130
2131                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2132                         continue;
2133
2134                 if (!status && hci_conn_check_secure(conn, d->sec_level))
2135                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2136                 else
2137                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2138         }
2139
2140         rfcomm_schedule();
2141 }
2142
2143 static struct hci_cb rfcomm_cb = {
2144         .name           = "RFCOMM",
2145         .security_cfm   = rfcomm_security_cfm
2146 };
2147
2148 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2149 {
2150         struct rfcomm_session *s;
2151
2152         rfcomm_lock();
2153
2154         list_for_each_entry(s, &session_list, list) {
2155                 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2156                 struct rfcomm_dlc *d;
2157                 list_for_each_entry(d, &s->dlcs, list) {
2158                         seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2159                                    &chan->src, &chan->dst,
2160                                    d->state, d->dlci, d->mtu,
2161                                    d->rx_credits, d->tx_credits);
2162                 }
2163         }
2164
2165         rfcomm_unlock();
2166
2167         return 0;
2168 }
2169
2170 DEFINE_SHOW_ATTRIBUTE(rfcomm_dlc_debugfs);
2171
2172 static struct dentry *rfcomm_dlc_debugfs;
2173
2174 /* ---- Initialization ---- */
2175 static int __init rfcomm_init(void)
2176 {
2177         int err;
2178
2179         hci_register_cb(&rfcomm_cb);
2180
2181         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2182         if (IS_ERR(rfcomm_thread)) {
2183                 err = PTR_ERR(rfcomm_thread);
2184                 goto unregister;
2185         }
2186
2187         err = rfcomm_init_ttys();
2188         if (err < 0)
2189                 goto stop;
2190
2191         err = rfcomm_init_sockets();
2192         if (err < 0)
2193                 goto cleanup;
2194
2195         BT_INFO("RFCOMM ver %s", VERSION);
2196
2197         if (IS_ERR_OR_NULL(bt_debugfs))
2198                 return 0;
2199
2200         rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2201                                                  bt_debugfs, NULL,
2202                                                  &rfcomm_dlc_debugfs_fops);
2203
2204         return 0;
2205
2206 cleanup:
2207         rfcomm_cleanup_ttys();
2208
2209 stop:
2210         kthread_stop(rfcomm_thread);
2211
2212 unregister:
2213         hci_unregister_cb(&rfcomm_cb);
2214
2215         return err;
2216 }
2217
2218 static void __exit rfcomm_exit(void)
2219 {
2220         debugfs_remove(rfcomm_dlc_debugfs);
2221
2222         hci_unregister_cb(&rfcomm_cb);
2223
2224         kthread_stop(rfcomm_thread);
2225
2226         rfcomm_cleanup_ttys();
2227
2228         rfcomm_cleanup_sockets();
2229 }
2230
2231 module_init(rfcomm_init);
2232 module_exit(rfcomm_exit);
2233
2234 module_param(disable_cfc, bool, 0644);
2235 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2236
2237 module_param(channel_mtu, int, 0644);
2238 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2239
2240 module_param(l2cap_mtu, uint, 0644);
2241 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2242
2243 module_param(l2cap_ertm, bool, 0644);
2244 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2245
2246 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2247 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2248 MODULE_VERSION(VERSION);
2249 MODULE_LICENSE("GPL");
2250 MODULE_ALIAS("bt-proto-3");