Version:  2.0.40 2.2.26 2.4.37 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17

Linux/net/bluetooth/rfcomm/core.c

  1 /*
  2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
  3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
  4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
  5 
  6    This program is free software; you can redistribute it and/or modify
  7    it under the terms of the GNU General Public License version 2 as
  8    published by the Free Software Foundation;
  9 
 10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
 13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
 14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
 15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 18 
 19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
 20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
 21    SOFTWARE IS DISCLAIMED.
 22 */
 23 
 24 /*
 25  * Bluetooth RFCOMM core.
 26  */
 27 
 28 #include <linux/module.h>
 29 #include <linux/debugfs.h>
 30 #include <linux/kthread.h>
 31 #include <asm/unaligned.h>
 32 
 33 #include <net/bluetooth/bluetooth.h>
 34 #include <net/bluetooth/hci_core.h>
 35 #include <net/bluetooth/l2cap.h>
 36 #include <net/bluetooth/rfcomm.h>
 37 
 38 #define VERSION "1.11"
 39 
 40 static bool disable_cfc;
 41 static bool l2cap_ertm;
 42 static int channel_mtu = -1;
 43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
 44 
 45 static struct task_struct *rfcomm_thread;
 46 
 47 static DEFINE_MUTEX(rfcomm_mutex);
 48 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
 49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
 50 
 51 
 52 static LIST_HEAD(session_list);
 53 
 54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
 55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
 56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
 57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
 58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
 59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
 60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
 61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
 62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
 63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
 64 
 65 static void rfcomm_process_connect(struct rfcomm_session *s);
 66 
 67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 68                                                         bdaddr_t *dst,
 69                                                         u8 sec_level,
 70                                                         int *err);
 71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
 72 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
 73 
 74 /* ---- RFCOMM frame parsing macros ---- */
 75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
 76 #define __get_channel(b)  ((b & 0xf8) >> 3)
 77 #define __get_dir(b)      ((b & 0x04) >> 2)
 78 #define __get_type(b)     ((b & 0xef))
 79 
 80 #define __test_ea(b)      ((b & 0x01))
 81 #define __test_cr(b)      ((b & 0x02))
 82 #define __test_pf(b)      ((b & 0x10))
 83 
 84 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 85 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
 86 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
 87 #define __srv_channel(dlci)    (dlci >> 1)
 88 #define __dir(dlci)            (dlci & 0x01)
 89 
 90 #define __len8(len)       (((len) << 1) | 1)
 91 #define __len16(len)      ((len) << 1)
 92 
 93 /* MCC macros */
 94 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 95 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 96 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 97 
 98 /* RPN macros */
 99 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
100 #define __get_rpn_data_bits(line) ((line) & 0x3)
101 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
102 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
103 
104 static void rfcomm_schedule(void)
105 {
106         if (!rfcomm_thread)
107                 return;
108         wake_up_process(rfcomm_thread);
109 }
110 
111 /* ---- RFCOMM FCS computation ---- */
112 
113 /* reversed, 8-bit, poly=0x07 */
114 static unsigned char rfcomm_crc_table[256] = {
115         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
116         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
117         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
118         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
119 
120         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
121         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
122         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
123         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
124 
125         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
126         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
127         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
128         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
129 
130         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
131         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
132         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
133         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
134 
135         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
136         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
137         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
138         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
139 
140         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
141         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
142         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
143         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
144 
145         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
146         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
147         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
148         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
149 
150         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
151         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
152         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
153         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
154 };
155 
156 /* CRC on 2 bytes */
157 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
158 
159 /* FCS on 2 bytes */
160 static inline u8 __fcs(u8 *data)
161 {
162         return 0xff - __crc(data);
163 }
164 
165 /* FCS on 3 bytes */
166 static inline u8 __fcs2(u8 *data)
167 {
168         return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
169 }
170 
171 /* Check FCS */
172 static inline int __check_fcs(u8 *data, int type, u8 fcs)
173 {
174         u8 f = __crc(data);
175 
176         if (type != RFCOMM_UIH)
177                 f = rfcomm_crc_table[f ^ data[2]];
178 
179         return rfcomm_crc_table[f ^ fcs] != 0xcf;
180 }
181 
182 /* ---- L2CAP callbacks ---- */
183 static void rfcomm_l2state_change(struct sock *sk)
184 {
185         BT_DBG("%p state %d", sk, sk->sk_state);
186         rfcomm_schedule();
187 }
188 
189 static void rfcomm_l2data_ready(struct sock *sk)
190 {
191         BT_DBG("%p", sk);
192         rfcomm_schedule();
193 }
194 
195 static int rfcomm_l2sock_create(struct socket **sock)
196 {
197         int err;
198 
199         BT_DBG("");
200 
201         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
202         if (!err) {
203                 struct sock *sk = (*sock)->sk;
204                 sk->sk_data_ready   = rfcomm_l2data_ready;
205                 sk->sk_state_change = rfcomm_l2state_change;
206         }
207         return err;
208 }
209 
210 static int rfcomm_check_security(struct rfcomm_dlc *d)
211 {
212         struct sock *sk = d->session->sock->sk;
213         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
214 
215         __u8 auth_type;
216 
217         switch (d->sec_level) {
218         case BT_SECURITY_HIGH:
219         case BT_SECURITY_FIPS:
220                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
221                 break;
222         case BT_SECURITY_MEDIUM:
223                 auth_type = HCI_AT_GENERAL_BONDING;
224                 break;
225         default:
226                 auth_type = HCI_AT_NO_BONDING;
227                 break;
228         }
229 
230         return hci_conn_security(conn->hcon, d->sec_level, auth_type,
231                                  d->out);
232 }
233 
234 static void rfcomm_session_timeout(unsigned long arg)
235 {
236         struct rfcomm_session *s = (void *) arg;
237 
238         BT_DBG("session %p state %ld", s, s->state);
239 
240         set_bit(RFCOMM_TIMED_OUT, &s->flags);
241         rfcomm_schedule();
242 }
243 
244 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
245 {
246         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
247 
248         mod_timer(&s->timer, jiffies + timeout);
249 }
250 
251 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
252 {
253         BT_DBG("session %p state %ld", s, s->state);
254 
255         del_timer_sync(&s->timer);
256 }
257 
258 /* ---- RFCOMM DLCs ---- */
259 static void rfcomm_dlc_timeout(unsigned long arg)
260 {
261         struct rfcomm_dlc *d = (void *) arg;
262 
263         BT_DBG("dlc %p state %ld", d, d->state);
264 
265         set_bit(RFCOMM_TIMED_OUT, &d->flags);
266         rfcomm_dlc_put(d);
267         rfcomm_schedule();
268 }
269 
270 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
271 {
272         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
273 
274         if (!mod_timer(&d->timer, jiffies + timeout))
275                 rfcomm_dlc_hold(d);
276 }
277 
278 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
279 {
280         BT_DBG("dlc %p state %ld", d, d->state);
281 
282         if (del_timer(&d->timer))
283                 rfcomm_dlc_put(d);
284 }
285 
286 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
287 {
288         BT_DBG("%p", d);
289 
290         d->state      = BT_OPEN;
291         d->flags      = 0;
292         d->mscex      = 0;
293         d->sec_level  = BT_SECURITY_LOW;
294         d->mtu        = RFCOMM_DEFAULT_MTU;
295         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
296 
297         d->cfc        = RFCOMM_CFC_DISABLED;
298         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
299 }
300 
301 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
302 {
303         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
304 
305         if (!d)
306                 return NULL;
307 
308         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
309 
310         skb_queue_head_init(&d->tx_queue);
311         mutex_init(&d->lock);
312         atomic_set(&d->refcnt, 1);
313 
314         rfcomm_dlc_clear_state(d);
315 
316         BT_DBG("%p", d);
317 
318         return d;
319 }
320 
321 void rfcomm_dlc_free(struct rfcomm_dlc *d)
322 {
323         BT_DBG("%p", d);
324 
325         skb_queue_purge(&d->tx_queue);
326         kfree(d);
327 }
328 
329 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
330 {
331         BT_DBG("dlc %p session %p", d, s);
332 
333         rfcomm_session_clear_timer(s);
334         rfcomm_dlc_hold(d);
335         list_add(&d->list, &s->dlcs);
336         d->session = s;
337 }
338 
339 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
340 {
341         struct rfcomm_session *s = d->session;
342 
343         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
344 
345         list_del(&d->list);
346         d->session = NULL;
347         rfcomm_dlc_put(d);
348 
349         if (list_empty(&s->dlcs))
350                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
351 }
352 
353 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
354 {
355         struct rfcomm_dlc *d;
356 
357         list_for_each_entry(d, &s->dlcs, list)
358                 if (d->dlci == dlci)
359                         return d;
360 
361         return NULL;
362 }
363 
364 static int rfcomm_check_channel(u8 channel)
365 {
366         return channel < 1 || channel > 30;
367 }
368 
369 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
370 {
371         struct rfcomm_session *s;
372         int err = 0;
373         u8 dlci;
374 
375         BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
376                d, d->state, src, dst, channel);
377 
378         if (rfcomm_check_channel(channel))
379                 return -EINVAL;
380 
381         if (d->state != BT_OPEN && d->state != BT_CLOSED)
382                 return 0;
383 
384         s = rfcomm_session_get(src, dst);
385         if (!s) {
386                 s = rfcomm_session_create(src, dst, d->sec_level, &err);
387                 if (!s)
388                         return err;
389         }
390 
391         dlci = __dlci(!s->initiator, channel);
392 
393         /* Check if DLCI already exists */
394         if (rfcomm_dlc_get(s, dlci))
395                 return -EBUSY;
396 
397         rfcomm_dlc_clear_state(d);
398 
399         d->dlci     = dlci;
400         d->addr     = __addr(s->initiator, dlci);
401         d->priority = 7;
402 
403         d->state = BT_CONFIG;
404         rfcomm_dlc_link(s, d);
405 
406         d->out = 1;
407 
408         d->mtu = s->mtu;
409         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
410 
411         if (s->state == BT_CONNECTED) {
412                 if (rfcomm_check_security(d))
413                         rfcomm_send_pn(s, 1, d);
414                 else
415                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
416         }
417 
418         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
419 
420         return 0;
421 }
422 
423 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
424 {
425         int r;
426 
427         rfcomm_lock();
428 
429         r = __rfcomm_dlc_open(d, src, dst, channel);
430 
431         rfcomm_unlock();
432         return r;
433 }
434 
435 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
436 {
437         struct rfcomm_session *s = d->session;
438 
439         d->state = BT_DISCONN;
440         if (skb_queue_empty(&d->tx_queue)) {
441                 rfcomm_send_disc(s, d->dlci);
442                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
443         } else {
444                 rfcomm_queue_disc(d);
445                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
446         }
447 }
448 
449 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
450 {
451         struct rfcomm_session *s = d->session;
452         if (!s)
453                 return 0;
454 
455         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
456                         d, d->state, d->dlci, err, s);
457 
458         switch (d->state) {
459         case BT_CONNECT:
460         case BT_CONFIG:
461         case BT_OPEN:
462         case BT_CONNECT2:
463                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
464                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
465                         rfcomm_schedule();
466                         return 0;
467                 }
468         }
469 
470         switch (d->state) {
471         case BT_CONNECT:
472         case BT_CONNECTED:
473                 __rfcomm_dlc_disconn(d);
474                 break;
475 
476         case BT_CONFIG:
477                 if (s->state != BT_BOUND) {
478                         __rfcomm_dlc_disconn(d);
479                         break;
480                 }
481                 /* if closing a dlc in a session that hasn't been started,
482                  * just close and unlink the dlc
483                  */
484 
485         default:
486                 rfcomm_dlc_clear_timer(d);
487 
488                 rfcomm_dlc_lock(d);
489                 d->state = BT_CLOSED;
490                 d->state_change(d, err);
491                 rfcomm_dlc_unlock(d);
492 
493                 skb_queue_purge(&d->tx_queue);
494                 rfcomm_dlc_unlink(d);
495         }
496 
497         return 0;
498 }
499 
500 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
501 {
502         int r = 0;
503         struct rfcomm_dlc *d_list;
504         struct rfcomm_session *s, *s_list;
505 
506         BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
507 
508         rfcomm_lock();
509 
510         s = d->session;
511         if (!s)
512                 goto no_session;
513 
514         /* after waiting on the mutex check the session still exists
515          * then check the dlc still exists
516          */
517         list_for_each_entry(s_list, &session_list, list) {
518                 if (s_list == s) {
519                         list_for_each_entry(d_list, &s->dlcs, list) {
520                                 if (d_list == d) {
521                                         r = __rfcomm_dlc_close(d, err);
522                                         break;
523                                 }
524                         }
525                         break;
526                 }
527         }
528 
529 no_session:
530         rfcomm_unlock();
531         return r;
532 }
533 
534 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
535 {
536         struct rfcomm_session *s;
537         struct rfcomm_dlc *dlc = NULL;
538         u8 dlci;
539 
540         if (rfcomm_check_channel(channel))
541                 return ERR_PTR(-EINVAL);
542 
543         rfcomm_lock();
544         s = rfcomm_session_get(src, dst);
545         if (s) {
546                 dlci = __dlci(!s->initiator, channel);
547                 dlc = rfcomm_dlc_get(s, dlci);
548         }
549         rfcomm_unlock();
550         return dlc;
551 }
552 
553 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
554 {
555         int len = skb->len;
556 
557         if (d->state != BT_CONNECTED)
558                 return -ENOTCONN;
559 
560         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
561 
562         if (len > d->mtu)
563                 return -EINVAL;
564 
565         rfcomm_make_uih(skb, d->addr);
566         skb_queue_tail(&d->tx_queue, skb);
567 
568         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
569                 rfcomm_schedule();
570         return len;
571 }
572 
573 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
574 {
575         int len = skb->len;
576 
577         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
578 
579         rfcomm_make_uih(skb, d->addr);
580         skb_queue_tail(&d->tx_queue, skb);
581 
582         if (d->state == BT_CONNECTED &&
583             !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
584                 rfcomm_schedule();
585 }
586 
587 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
588 {
589         BT_DBG("dlc %p state %ld", d, d->state);
590 
591         if (!d->cfc) {
592                 d->v24_sig |= RFCOMM_V24_FC;
593                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
594         }
595         rfcomm_schedule();
596 }
597 
598 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
599 {
600         BT_DBG("dlc %p state %ld", d, d->state);
601 
602         if (!d->cfc) {
603                 d->v24_sig &= ~RFCOMM_V24_FC;
604                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
605         }
606         rfcomm_schedule();
607 }
608 
609 /*
610    Set/get modem status functions use _local_ status i.e. what we report
611    to the other side.
612    Remote status is provided by dlc->modem_status() callback.
613  */
614 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
615 {
616         BT_DBG("dlc %p state %ld v24_sig 0x%x",
617                         d, d->state, v24_sig);
618 
619         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
620                 v24_sig |= RFCOMM_V24_FC;
621         else
622                 v24_sig &= ~RFCOMM_V24_FC;
623 
624         d->v24_sig = v24_sig;
625 
626         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
627                 rfcomm_schedule();
628 
629         return 0;
630 }
631 
632 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
633 {
634         BT_DBG("dlc %p state %ld v24_sig 0x%x",
635                         d, d->state, d->v24_sig);
636 
637         *v24_sig = d->v24_sig;
638         return 0;
639 }
640 
641 /* ---- RFCOMM sessions ---- */
642 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
643 {
644         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
645 
646         if (!s)
647                 return NULL;
648 
649         BT_DBG("session %p sock %p", s, sock);
650 
651         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
652 
653         INIT_LIST_HEAD(&s->dlcs);
654         s->state = state;
655         s->sock  = sock;
656 
657         s->mtu = RFCOMM_DEFAULT_MTU;
658         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
659 
660         /* Do not increment module usage count for listening sessions.
661          * Otherwise we won't be able to unload the module. */
662         if (state != BT_LISTEN)
663                 if (!try_module_get(THIS_MODULE)) {
664                         kfree(s);
665                         return NULL;
666                 }
667 
668         list_add(&s->list, &session_list);
669 
670         return s;
671 }
672 
673 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
674 {
675         int state = s->state;
676 
677         BT_DBG("session %p state %ld", s, s->state);
678 
679         list_del(&s->list);
680 
681         rfcomm_session_clear_timer(s);
682         sock_release(s->sock);
683         kfree(s);
684 
685         if (state != BT_LISTEN)
686                 module_put(THIS_MODULE);
687 
688         return NULL;
689 }
690 
691 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
692 {
693         struct rfcomm_session *s;
694         struct list_head *p, *n;
695         struct l2cap_chan *chan;
696         list_for_each_safe(p, n, &session_list) {
697                 s = list_entry(p, struct rfcomm_session, list);
698                 chan = l2cap_pi(s->sock->sk)->chan;
699 
700                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
701                     !bacmp(&chan->dst, dst))
702                         return s;
703         }
704         return NULL;
705 }
706 
707 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
708                                                    int err)
709 {
710         struct rfcomm_dlc *d;
711         struct list_head *p, *n;
712 
713         s->state = BT_CLOSED;
714 
715         BT_DBG("session %p state %ld err %d", s, s->state, err);
716 
717         /* Close all dlcs */
718         list_for_each_safe(p, n, &s->dlcs) {
719                 d = list_entry(p, struct rfcomm_dlc, list);
720                 d->state = BT_CLOSED;
721                 __rfcomm_dlc_close(d, err);
722         }
723 
724         rfcomm_session_clear_timer(s);
725         return rfcomm_session_del(s);
726 }
727 
728 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
729                                                         bdaddr_t *dst,
730                                                         u8 sec_level,
731                                                         int *err)
732 {
733         struct rfcomm_session *s = NULL;
734         struct sockaddr_l2 addr;
735         struct socket *sock;
736         struct sock *sk;
737 
738         BT_DBG("%pMR -> %pMR", src, dst);
739 
740         *err = rfcomm_l2sock_create(&sock);
741         if (*err < 0)
742                 return NULL;
743 
744         bacpy(&addr.l2_bdaddr, src);
745         addr.l2_family = AF_BLUETOOTH;
746         addr.l2_psm    = 0;
747         addr.l2_cid    = 0;
748         addr.l2_bdaddr_type = BDADDR_BREDR;
749         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
750         if (*err < 0)
751                 goto failed;
752 
753         /* Set L2CAP options */
754         sk = sock->sk;
755         lock_sock(sk);
756         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
757         l2cap_pi(sk)->chan->sec_level = sec_level;
758         if (l2cap_ertm)
759                 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
760         release_sock(sk);
761 
762         s = rfcomm_session_add(sock, BT_BOUND);
763         if (!s) {
764                 *err = -ENOMEM;
765                 goto failed;
766         }
767 
768         s->initiator = 1;
769 
770         bacpy(&addr.l2_bdaddr, dst);
771         addr.l2_family = AF_BLUETOOTH;
772         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
773         addr.l2_cid    = 0;
774         addr.l2_bdaddr_type = BDADDR_BREDR;
775         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
776         if (*err == 0 || *err == -EINPROGRESS)
777                 return s;
778 
779         return rfcomm_session_del(s);
780 
781 failed:
782         sock_release(sock);
783         return NULL;
784 }
785 
786 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
787 {
788         struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
789         if (src)
790                 bacpy(src, &chan->src);
791         if (dst)
792                 bacpy(dst, &chan->dst);
793 }
794 
795 /* ---- RFCOMM frame sending ---- */
796 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
797 {
798         struct kvec iv = { data, len };
799         struct msghdr msg;
800 
801         BT_DBG("session %p len %d", s, len);
802 
803         memset(&msg, 0, sizeof(msg));
804 
805         return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
806 }
807 
808 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
809 {
810         BT_DBG("%p cmd %u", s, cmd->ctrl);
811 
812         return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
813 }
814 
815 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
816 {
817         struct rfcomm_cmd cmd;
818 
819         BT_DBG("%p dlci %d", s, dlci);
820 
821         cmd.addr = __addr(s->initiator, dlci);
822         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
823         cmd.len  = __len8(0);
824         cmd.fcs  = __fcs2((u8 *) &cmd);
825 
826         return rfcomm_send_cmd(s, &cmd);
827 }
828 
829 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
830 {
831         struct rfcomm_cmd cmd;
832 
833         BT_DBG("%p dlci %d", s, dlci);
834 
835         cmd.addr = __addr(!s->initiator, dlci);
836         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
837         cmd.len  = __len8(0);
838         cmd.fcs  = __fcs2((u8 *) &cmd);
839 
840         return rfcomm_send_cmd(s, &cmd);
841 }
842 
843 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
844 {
845         struct rfcomm_cmd cmd;
846 
847         BT_DBG("%p dlci %d", s, dlci);
848 
849         cmd.addr = __addr(s->initiator, dlci);
850         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
851         cmd.len  = __len8(0);
852         cmd.fcs  = __fcs2((u8 *) &cmd);
853 
854         return rfcomm_send_cmd(s, &cmd);
855 }
856 
857 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
858 {
859         struct rfcomm_cmd *cmd;
860         struct sk_buff *skb;
861 
862         BT_DBG("dlc %p dlci %d", d, d->dlci);
863 
864         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
865         if (!skb)
866                 return -ENOMEM;
867 
868         cmd = (void *) __skb_put(skb, sizeof(*cmd));
869         cmd->addr = d->addr;
870         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
871         cmd->len  = __len8(0);
872         cmd->fcs  = __fcs2((u8 *) cmd);
873 
874         skb_queue_tail(&d->tx_queue, skb);
875         rfcomm_schedule();
876         return 0;
877 }
878 
879 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
880 {
881         struct rfcomm_cmd cmd;
882 
883         BT_DBG("%p dlci %d", s, dlci);
884 
885         cmd.addr = __addr(!s->initiator, dlci);
886         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
887         cmd.len  = __len8(0);
888         cmd.fcs  = __fcs2((u8 *) &cmd);
889 
890         return rfcomm_send_cmd(s, &cmd);
891 }
892 
893 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
894 {
895         struct rfcomm_hdr *hdr;
896         struct rfcomm_mcc *mcc;
897         u8 buf[16], *ptr = buf;
898 
899         BT_DBG("%p cr %d type %d", s, cr, type);
900 
901         hdr = (void *) ptr; ptr += sizeof(*hdr);
902         hdr->addr = __addr(s->initiator, 0);
903         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
904         hdr->len  = __len8(sizeof(*mcc) + 1);
905 
906         mcc = (void *) ptr; ptr += sizeof(*mcc);
907         mcc->type = __mcc_type(cr, RFCOMM_NSC);
908         mcc->len  = __len8(1);
909 
910         /* Type that we didn't like */
911         *ptr = __mcc_type(cr, type); ptr++;
912 
913         *ptr = __fcs(buf); ptr++;
914 
915         return rfcomm_send_frame(s, buf, ptr - buf);
916 }
917 
918 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
919 {
920         struct rfcomm_hdr *hdr;
921         struct rfcomm_mcc *mcc;
922         struct rfcomm_pn  *pn;
923         u8 buf[16], *ptr = buf;
924 
925         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
926 
927         hdr = (void *) ptr; ptr += sizeof(*hdr);
928         hdr->addr = __addr(s->initiator, 0);
929         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
930         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
931 
932         mcc = (void *) ptr; ptr += sizeof(*mcc);
933         mcc->type = __mcc_type(cr, RFCOMM_PN);
934         mcc->len  = __len8(sizeof(*pn));
935 
936         pn = (void *) ptr; ptr += sizeof(*pn);
937         pn->dlci        = d->dlci;
938         pn->priority    = d->priority;
939         pn->ack_timer   = 0;
940         pn->max_retrans = 0;
941 
942         if (s->cfc) {
943                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
944                 pn->credits = RFCOMM_DEFAULT_CREDITS;
945         } else {
946                 pn->flow_ctrl = 0;
947                 pn->credits   = 0;
948         }
949 
950         if (cr && channel_mtu >= 0)
951                 pn->mtu = cpu_to_le16(channel_mtu);
952         else
953                 pn->mtu = cpu_to_le16(d->mtu);
954 
955         *ptr = __fcs(buf); ptr++;
956 
957         return rfcomm_send_frame(s, buf, ptr - buf);
958 }
959 
960 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
961                         u8 bit_rate, u8 data_bits, u8 stop_bits,
962                         u8 parity, u8 flow_ctrl_settings,
963                         u8 xon_char, u8 xoff_char, u16 param_mask)
964 {
965         struct rfcomm_hdr *hdr;
966         struct rfcomm_mcc *mcc;
967         struct rfcomm_rpn *rpn;
968         u8 buf[16], *ptr = buf;
969 
970         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
971                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
972                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
973                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
974 
975         hdr = (void *) ptr; ptr += sizeof(*hdr);
976         hdr->addr = __addr(s->initiator, 0);
977         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
978         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
979 
980         mcc = (void *) ptr; ptr += sizeof(*mcc);
981         mcc->type = __mcc_type(cr, RFCOMM_RPN);
982         mcc->len  = __len8(sizeof(*rpn));
983 
984         rpn = (void *) ptr; ptr += sizeof(*rpn);
985         rpn->dlci          = __addr(1, dlci);
986         rpn->bit_rate      = bit_rate;
987         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
988         rpn->flow_ctrl     = flow_ctrl_settings;
989         rpn->xon_char      = xon_char;
990         rpn->xoff_char     = xoff_char;
991         rpn->param_mask    = cpu_to_le16(param_mask);
992 
993         *ptr = __fcs(buf); ptr++;
994 
995         return rfcomm_send_frame(s, buf, ptr - buf);
996 }
997 
998 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
999 {
1000         struct rfcomm_hdr *hdr;
1001         struct rfcomm_mcc *mcc;
1002         struct rfcomm_rls *rls;
1003         u8 buf[16], *ptr = buf;
1004 
1005         BT_DBG("%p cr %d status 0x%x", s, cr, status);
1006 
1007         hdr = (void *) ptr; ptr += sizeof(*hdr);
1008         hdr->addr = __addr(s->initiator, 0);
1009         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1010         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
1011 
1012         mcc = (void *) ptr; ptr += sizeof(*mcc);
1013         mcc->type = __mcc_type(cr, RFCOMM_RLS);
1014         mcc->len  = __len8(sizeof(*rls));
1015 
1016         rls = (void *) ptr; ptr += sizeof(*rls);
1017         rls->dlci   = __addr(1, dlci);
1018         rls->status = status;
1019 
1020         *ptr = __fcs(buf); ptr++;
1021 
1022         return rfcomm_send_frame(s, buf, ptr - buf);
1023 }
1024 
1025 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1026 {
1027         struct rfcomm_hdr *hdr;
1028         struct rfcomm_mcc *mcc;
1029         struct rfcomm_msc *msc;
1030         u8 buf[16], *ptr = buf;
1031 
1032         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1033 
1034         hdr = (void *) ptr; ptr += sizeof(*hdr);
1035         hdr->addr = __addr(s->initiator, 0);
1036         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1037         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
1038 
1039         mcc = (void *) ptr; ptr += sizeof(*mcc);
1040         mcc->type = __mcc_type(cr, RFCOMM_MSC);
1041         mcc->len  = __len8(sizeof(*msc));
1042 
1043         msc = (void *) ptr; ptr += sizeof(*msc);
1044         msc->dlci    = __addr(1, dlci);
1045         msc->v24_sig = v24_sig | 0x01;
1046 
1047         *ptr = __fcs(buf); ptr++;
1048 
1049         return rfcomm_send_frame(s, buf, ptr - buf);
1050 }
1051 
1052 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1053 {
1054         struct rfcomm_hdr *hdr;
1055         struct rfcomm_mcc *mcc;
1056         u8 buf[16], *ptr = buf;
1057 
1058         BT_DBG("%p cr %d", s, cr);
1059 
1060         hdr = (void *) ptr; ptr += sizeof(*hdr);
1061         hdr->addr = __addr(s->initiator, 0);
1062         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1063         hdr->len  = __len8(sizeof(*mcc));
1064 
1065         mcc = (void *) ptr; ptr += sizeof(*mcc);
1066         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1067         mcc->len  = __len8(0);
1068 
1069         *ptr = __fcs(buf); ptr++;
1070 
1071         return rfcomm_send_frame(s, buf, ptr - buf);
1072 }
1073 
1074 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1075 {
1076         struct rfcomm_hdr *hdr;
1077         struct rfcomm_mcc *mcc;
1078         u8 buf[16], *ptr = buf;
1079 
1080         BT_DBG("%p cr %d", s, cr);
1081 
1082         hdr = (void *) ptr; ptr += sizeof(*hdr);
1083         hdr->addr = __addr(s->initiator, 0);
1084         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1085         hdr->len  = __len8(sizeof(*mcc));
1086 
1087         mcc = (void *) ptr; ptr += sizeof(*mcc);
1088         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1089         mcc->len  = __len8(0);
1090 
1091         *ptr = __fcs(buf); ptr++;
1092 
1093         return rfcomm_send_frame(s, buf, ptr - buf);
1094 }
1095 
1096 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1097 {
1098         struct socket *sock = s->sock;
1099         struct kvec iv[3];
1100         struct msghdr msg;
1101         unsigned char hdr[5], crc[1];
1102 
1103         if (len > 125)
1104                 return -EINVAL;
1105 
1106         BT_DBG("%p cr %d", s, cr);
1107 
1108         hdr[0] = __addr(s->initiator, 0);
1109         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1110         hdr[2] = 0x01 | ((len + 2) << 1);
1111         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1112         hdr[4] = 0x01 | (len << 1);
1113 
1114         crc[0] = __fcs(hdr);
1115 
1116         iv[0].iov_base = hdr;
1117         iv[0].iov_len  = 5;
1118         iv[1].iov_base = pattern;
1119         iv[1].iov_len  = len;
1120         iv[2].iov_base = crc;
1121         iv[2].iov_len  = 1;
1122 
1123         memset(&msg, 0, sizeof(msg));
1124 
1125         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1126 }
1127 
1128 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1129 {
1130         struct rfcomm_hdr *hdr;
1131         u8 buf[16], *ptr = buf;
1132 
1133         BT_DBG("%p addr %d credits %d", s, addr, credits);
1134 
1135         hdr = (void *) ptr; ptr += sizeof(*hdr);
1136         hdr->addr = addr;
1137         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1138         hdr->len  = __len8(0);
1139 
1140         *ptr = credits; ptr++;
1141 
1142         *ptr = __fcs(buf); ptr++;
1143 
1144         return rfcomm_send_frame(s, buf, ptr - buf);
1145 }
1146 
1147 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1148 {
1149         struct rfcomm_hdr *hdr;
1150         int len = skb->len;
1151         u8 *crc;
1152 
1153         if (len > 127) {
1154                 hdr = (void *) skb_push(skb, 4);
1155                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1156         } else {
1157                 hdr = (void *) skb_push(skb, 3);
1158                 hdr->len = __len8(len);
1159         }
1160         hdr->addr = addr;
1161         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1162 
1163         crc = skb_put(skb, 1);
1164         *crc = __fcs((void *) hdr);
1165 }
1166 
1167 /* ---- RFCOMM frame reception ---- */
1168 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1169 {
1170         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1171 
1172         if (dlci) {
1173                 /* Data channel */
1174                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1175                 if (!d) {
1176                         rfcomm_send_dm(s, dlci);
1177                         return s;
1178                 }
1179 
1180                 switch (d->state) {
1181                 case BT_CONNECT:
1182                         rfcomm_dlc_clear_timer(d);
1183 
1184                         rfcomm_dlc_lock(d);
1185                         d->state = BT_CONNECTED;
1186                         d->state_change(d, 0);
1187                         rfcomm_dlc_unlock(d);
1188 
1189                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1190                         break;
1191 
1192                 case BT_DISCONN:
1193                         d->state = BT_CLOSED;
1194                         __rfcomm_dlc_close(d, 0);
1195 
1196                         if (list_empty(&s->dlcs)) {
1197                                 s->state = BT_DISCONN;
1198                                 rfcomm_send_disc(s, 0);
1199                                 rfcomm_session_clear_timer(s);
1200                         }
1201 
1202                         break;
1203                 }
1204         } else {
1205                 /* Control channel */
1206                 switch (s->state) {
1207                 case BT_CONNECT:
1208                         s->state = BT_CONNECTED;
1209                         rfcomm_process_connect(s);
1210                         break;
1211 
1212                 case BT_DISCONN:
1213                         s = rfcomm_session_close(s, ECONNRESET);
1214                         break;
1215                 }
1216         }
1217         return s;
1218 }
1219 
1220 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1221 {
1222         int err = 0;
1223 
1224         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1225 
1226         if (dlci) {
1227                 /* Data DLC */
1228                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1229                 if (d) {
1230                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1231                                 err = ECONNREFUSED;
1232                         else
1233                                 err = ECONNRESET;
1234 
1235                         d->state = BT_CLOSED;
1236                         __rfcomm_dlc_close(d, err);
1237                 }
1238         } else {
1239                 if (s->state == BT_CONNECT)
1240                         err = ECONNREFUSED;
1241                 else
1242                         err = ECONNRESET;
1243 
1244                 s = rfcomm_session_close(s, err);
1245         }
1246         return s;
1247 }
1248 
1249 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1250                                                u8 dlci)
1251 {
1252         int err = 0;
1253 
1254         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1255 
1256         if (dlci) {
1257                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1258                 if (d) {
1259                         rfcomm_send_ua(s, dlci);
1260 
1261                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1262                                 err = ECONNREFUSED;
1263                         else
1264                                 err = ECONNRESET;
1265 
1266                         d->state = BT_CLOSED;
1267                         __rfcomm_dlc_close(d, err);
1268                 } else
1269                         rfcomm_send_dm(s, dlci);
1270 
1271         } else {
1272                 rfcomm_send_ua(s, 0);
1273 
1274                 if (s->state == BT_CONNECT)
1275                         err = ECONNREFUSED;
1276                 else
1277                         err = ECONNRESET;
1278 
1279                 s = rfcomm_session_close(s, err);
1280         }
1281         return s;
1282 }
1283 
1284 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1285 {
1286         struct sock *sk = d->session->sock->sk;
1287         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1288 
1289         BT_DBG("dlc %p", d);
1290 
1291         rfcomm_send_ua(d->session, d->dlci);
1292 
1293         rfcomm_dlc_clear_timer(d);
1294 
1295         rfcomm_dlc_lock(d);
1296         d->state = BT_CONNECTED;
1297         d->state_change(d, 0);
1298         rfcomm_dlc_unlock(d);
1299 
1300         if (d->role_switch)
1301                 hci_conn_switch_role(conn->hcon, 0x00);
1302 
1303         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1304 }
1305 
1306 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1307 {
1308         if (rfcomm_check_security(d)) {
1309                 if (d->defer_setup) {
1310                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1311                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1312 
1313                         rfcomm_dlc_lock(d);
1314                         d->state = BT_CONNECT2;
1315                         d->state_change(d, 0);
1316                         rfcomm_dlc_unlock(d);
1317                 } else
1318                         rfcomm_dlc_accept(d);
1319         } else {
1320                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1321                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1322         }
1323 }
1324 
1325 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1326 {
1327         struct rfcomm_dlc *d;
1328         u8 channel;
1329 
1330         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1331 
1332         if (!dlci) {
1333                 rfcomm_send_ua(s, 0);
1334 
1335                 if (s->state == BT_OPEN) {
1336                         s->state = BT_CONNECTED;
1337                         rfcomm_process_connect(s);
1338                 }
1339                 return 0;
1340         }
1341 
1342         /* Check if DLC exists */
1343         d = rfcomm_dlc_get(s, dlci);
1344         if (d) {
1345                 if (d->state == BT_OPEN) {
1346                         /* DLC was previously opened by PN request */
1347                         rfcomm_check_accept(d);
1348                 }
1349                 return 0;
1350         }
1351 
1352         /* Notify socket layer about incoming connection */
1353         channel = __srv_channel(dlci);
1354         if (rfcomm_connect_ind(s, channel, &d)) {
1355                 d->dlci = dlci;
1356                 d->addr = __addr(s->initiator, dlci);
1357                 rfcomm_dlc_link(s, d);
1358 
1359                 rfcomm_check_accept(d);
1360         } else {
1361                 rfcomm_send_dm(s, dlci);
1362         }
1363 
1364         return 0;
1365 }
1366 
1367 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1368 {
1369         struct rfcomm_session *s = d->session;
1370 
1371         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1372                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1373 
1374         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1375                                                 pn->flow_ctrl == 0xe0) {
1376                 d->cfc = RFCOMM_CFC_ENABLED;
1377                 d->tx_credits = pn->credits;
1378         } else {
1379                 d->cfc = RFCOMM_CFC_DISABLED;
1380                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1381         }
1382 
1383         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1384                 s->cfc = d->cfc;
1385 
1386         d->priority = pn->priority;
1387 
1388         d->mtu = __le16_to_cpu(pn->mtu);
1389 
1390         if (cr && d->mtu > s->mtu)
1391                 d->mtu = s->mtu;
1392 
1393         return 0;
1394 }
1395 
1396 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1397 {
1398         struct rfcomm_pn *pn = (void *) skb->data;
1399         struct rfcomm_dlc *d;
1400         u8 dlci = pn->dlci;
1401 
1402         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1403 
1404         if (!dlci)
1405                 return 0;
1406 
1407         d = rfcomm_dlc_get(s, dlci);
1408         if (d) {
1409                 if (cr) {
1410                         /* PN request */
1411                         rfcomm_apply_pn(d, cr, pn);
1412                         rfcomm_send_pn(s, 0, d);
1413                 } else {
1414                         /* PN response */
1415                         switch (d->state) {
1416                         case BT_CONFIG:
1417                                 rfcomm_apply_pn(d, cr, pn);
1418 
1419                                 d->state = BT_CONNECT;
1420                                 rfcomm_send_sabm(s, d->dlci);
1421                                 break;
1422                         }
1423                 }
1424         } else {
1425                 u8 channel = __srv_channel(dlci);
1426 
1427                 if (!cr)
1428                         return 0;
1429 
1430                 /* PN request for non existing DLC.
1431                  * Assume incoming connection. */
1432                 if (rfcomm_connect_ind(s, channel, &d)) {
1433                         d->dlci = dlci;
1434                         d->addr = __addr(s->initiator, dlci);
1435                         rfcomm_dlc_link(s, d);
1436 
1437                         rfcomm_apply_pn(d, cr, pn);
1438 
1439                         d->state = BT_OPEN;
1440                         rfcomm_send_pn(s, 0, d);
1441                 } else {
1442                         rfcomm_send_dm(s, dlci);
1443                 }
1444         }
1445         return 0;
1446 }
1447 
1448 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1449 {
1450         struct rfcomm_rpn *rpn = (void *) skb->data;
1451         u8 dlci = __get_dlci(rpn->dlci);
1452 
1453         u8 bit_rate  = 0;
1454         u8 data_bits = 0;
1455         u8 stop_bits = 0;
1456         u8 parity    = 0;
1457         u8 flow_ctrl = 0;
1458         u8 xon_char  = 0;
1459         u8 xoff_char = 0;
1460         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1461 
1462         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1463                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1464                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1465 
1466         if (!cr)
1467                 return 0;
1468 
1469         if (len == 1) {
1470                 /* This is a request, return default (according to ETSI TS 07.10) settings */
1471                 bit_rate  = RFCOMM_RPN_BR_9600;
1472                 data_bits = RFCOMM_RPN_DATA_8;
1473                 stop_bits = RFCOMM_RPN_STOP_1;
1474                 parity    = RFCOMM_RPN_PARITY_NONE;
1475                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1476                 xon_char  = RFCOMM_RPN_XON_CHAR;
1477                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1478                 goto rpn_out;
1479         }
1480 
1481         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1482          * no parity, no flow control lines, normal XON/XOFF chars */
1483 
1484         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1485                 bit_rate = rpn->bit_rate;
1486                 if (bit_rate > RFCOMM_RPN_BR_230400) {
1487                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1488                         bit_rate = RFCOMM_RPN_BR_9600;
1489                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1490                 }
1491         }
1492 
1493         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1494                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1495                 if (data_bits != RFCOMM_RPN_DATA_8) {
1496                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1497                         data_bits = RFCOMM_RPN_DATA_8;
1498                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1499                 }
1500         }
1501 
1502         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1503                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1504                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1505                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1506                         stop_bits = RFCOMM_RPN_STOP_1;
1507                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1508                 }
1509         }
1510 
1511         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1512                 parity = __get_rpn_parity(rpn->line_settings);
1513                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1514                         BT_DBG("RPN parity mismatch 0x%x", parity);
1515                         parity = RFCOMM_RPN_PARITY_NONE;
1516                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1517                 }
1518         }
1519 
1520         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1521                 flow_ctrl = rpn->flow_ctrl;
1522                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1523                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1524                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1525                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1526                 }
1527         }
1528 
1529         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1530                 xon_char = rpn->xon_char;
1531                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1532                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1533                         xon_char = RFCOMM_RPN_XON_CHAR;
1534                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1535                 }
1536         }
1537 
1538         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1539                 xoff_char = rpn->xoff_char;
1540                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1541                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1542                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1543                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1544                 }
1545         }
1546 
1547 rpn_out:
1548         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1549                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1550 
1551         return 0;
1552 }
1553 
1554 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1555 {
1556         struct rfcomm_rls *rls = (void *) skb->data;
1557         u8 dlci = __get_dlci(rls->dlci);
1558 
1559         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1560 
1561         if (!cr)
1562                 return 0;
1563 
1564         /* We should probably do something with this information here. But
1565          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1566          * mandatory to recognise and respond to RLS */
1567 
1568         rfcomm_send_rls(s, 0, dlci, rls->status);
1569 
1570         return 0;
1571 }
1572 
1573 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1574 {
1575         struct rfcomm_msc *msc = (void *) skb->data;
1576         struct rfcomm_dlc *d;
1577         u8 dlci = __get_dlci(msc->dlci);
1578 
1579         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1580 
1581         d = rfcomm_dlc_get(s, dlci);
1582         if (!d)
1583                 return 0;
1584 
1585         if (cr) {
1586                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1587                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1588                 else
1589                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1590 
1591                 rfcomm_dlc_lock(d);
1592 
1593                 d->remote_v24_sig = msc->v24_sig;
1594 
1595                 if (d->modem_status)
1596                         d->modem_status(d, msc->v24_sig);
1597 
1598                 rfcomm_dlc_unlock(d);
1599 
1600                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1601 
1602                 d->mscex |= RFCOMM_MSCEX_RX;
1603         } else
1604                 d->mscex |= RFCOMM_MSCEX_TX;
1605 
1606         return 0;
1607 }
1608 
1609 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1610 {
1611         struct rfcomm_mcc *mcc = (void *) skb->data;
1612         u8 type, cr, len;
1613 
1614         cr   = __test_cr(mcc->type);
1615         type = __get_mcc_type(mcc->type);
1616         len  = __get_mcc_len(mcc->len);
1617 
1618         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1619 
1620         skb_pull(skb, 2);
1621 
1622         switch (type) {
1623         case RFCOMM_PN:
1624                 rfcomm_recv_pn(s, cr, skb);
1625                 break;
1626 
1627         case RFCOMM_RPN:
1628                 rfcomm_recv_rpn(s, cr, len, skb);
1629                 break;
1630 
1631         case RFCOMM_RLS:
1632                 rfcomm_recv_rls(s, cr, skb);
1633                 break;
1634 
1635         case RFCOMM_MSC:
1636                 rfcomm_recv_msc(s, cr, skb);
1637                 break;
1638 
1639         case RFCOMM_FCOFF:
1640                 if (cr) {
1641                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1642                         rfcomm_send_fcoff(s, 0);
1643                 }
1644                 break;
1645 
1646         case RFCOMM_FCON:
1647                 if (cr) {
1648                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1649                         rfcomm_send_fcon(s, 0);
1650                 }
1651                 break;
1652 
1653         case RFCOMM_TEST:
1654                 if (cr)
1655                         rfcomm_send_test(s, 0, skb->data, skb->len);
1656                 break;
1657 
1658         case RFCOMM_NSC:
1659                 break;
1660 
1661         default:
1662                 BT_ERR("Unknown control type 0x%02x", type);
1663                 rfcomm_send_nsc(s, cr, type);
1664                 break;
1665         }
1666         return 0;
1667 }
1668 
1669 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1670 {
1671         struct rfcomm_dlc *d;
1672 
1673         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1674 
1675         d = rfcomm_dlc_get(s, dlci);
1676         if (!d) {
1677                 rfcomm_send_dm(s, dlci);
1678                 goto drop;
1679         }
1680 
1681         if (pf && d->cfc) {
1682                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1683 
1684                 d->tx_credits += credits;
1685                 if (d->tx_credits)
1686                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1687         }
1688 
1689         if (skb->len && d->state == BT_CONNECTED) {
1690                 rfcomm_dlc_lock(d);
1691                 d->rx_credits--;
1692                 d->data_ready(d, skb);
1693                 rfcomm_dlc_unlock(d);
1694                 return 0;
1695         }
1696 
1697 drop:
1698         kfree_skb(skb);
1699         return 0;
1700 }
1701 
1702 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1703                                                 struct sk_buff *skb)
1704 {
1705         struct rfcomm_hdr *hdr = (void *) skb->data;
1706         u8 type, dlci, fcs;
1707 
1708         if (!s) {
1709                 /* no session, so free socket data */
1710                 kfree_skb(skb);
1711                 return s;
1712         }
1713 
1714         dlci = __get_dlci(hdr->addr);
1715         type = __get_type(hdr->ctrl);
1716 
1717         /* Trim FCS */
1718         skb->len--; skb->tail--;
1719         fcs = *(u8 *)skb_tail_pointer(skb);
1720 
1721         if (__check_fcs(skb->data, type, fcs)) {
1722                 BT_ERR("bad checksum in packet");
1723                 kfree_skb(skb);
1724                 return s;
1725         }
1726 
1727         if (__test_ea(hdr->len))
1728                 skb_pull(skb, 3);
1729         else
1730                 skb_pull(skb, 4);
1731 
1732         switch (type) {
1733         case RFCOMM_SABM:
1734                 if (__test_pf(hdr->ctrl))
1735                         rfcomm_recv_sabm(s, dlci);
1736                 break;
1737 
1738         case RFCOMM_DISC:
1739                 if (__test_pf(hdr->ctrl))
1740                         s = rfcomm_recv_disc(s, dlci);
1741                 break;
1742 
1743         case RFCOMM_UA:
1744                 if (__test_pf(hdr->ctrl))
1745                         s = rfcomm_recv_ua(s, dlci);
1746                 break;
1747 
1748         case RFCOMM_DM:
1749                 s = rfcomm_recv_dm(s, dlci);
1750                 break;
1751 
1752         case RFCOMM_UIH:
1753                 if (dlci) {
1754                         rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1755                         return s;
1756                 }
1757                 rfcomm_recv_mcc(s, skb);
1758                 break;
1759 
1760         default:
1761                 BT_ERR("Unknown packet type 0x%02x", type);
1762                 break;
1763         }
1764         kfree_skb(skb);
1765         return s;
1766 }
1767 
1768 /* ---- Connection and data processing ---- */
1769 
1770 static void rfcomm_process_connect(struct rfcomm_session *s)
1771 {
1772         struct rfcomm_dlc *d;
1773         struct list_head *p, *n;
1774 
1775         BT_DBG("session %p state %ld", s, s->state);
1776 
1777         list_for_each_safe(p, n, &s->dlcs) {
1778                 d = list_entry(p, struct rfcomm_dlc, list);
1779                 if (d->state == BT_CONFIG) {
1780                         d->mtu = s->mtu;
1781                         if (rfcomm_check_security(d)) {
1782                                 rfcomm_send_pn(s, 1, d);
1783                         } else {
1784                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1785                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1786                         }
1787                 }
1788         }
1789 }
1790 
1791 /* Send data queued for the DLC.
1792  * Return number of frames left in the queue.
1793  */
1794 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1795 {
1796         struct sk_buff *skb;
1797         int err;
1798 
1799         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1800                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1801 
1802         /* Send pending MSC */
1803         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1804                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1805 
1806         if (d->cfc) {
1807                 /* CFC enabled.
1808                  * Give them some credits */
1809                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1810                                 d->rx_credits <= (d->cfc >> 2)) {
1811                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1812                         d->rx_credits = d->cfc;
1813                 }
1814         } else {
1815                 /* CFC disabled.
1816                  * Give ourselves some credits */
1817                 d->tx_credits = 5;
1818         }
1819 
1820         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1821                 return skb_queue_len(&d->tx_queue);
1822 
1823         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1824                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1825                 if (err < 0) {
1826                         skb_queue_head(&d->tx_queue, skb);
1827                         break;
1828                 }
1829                 kfree_skb(skb);
1830                 d->tx_credits--;
1831         }
1832 
1833         if (d->cfc && !d->tx_credits) {
1834                 /* We're out of TX credits.
1835                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1836                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1837         }
1838 
1839         return skb_queue_len(&d->tx_queue);
1840 }
1841 
1842 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1843 {
1844         struct rfcomm_dlc *d;
1845         struct list_head *p, *n;
1846 
1847         BT_DBG("session %p state %ld", s, s->state);
1848 
1849         list_for_each_safe(p, n, &s->dlcs) {
1850                 d = list_entry(p, struct rfcomm_dlc, list);
1851 
1852                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1853                         __rfcomm_dlc_close(d, ETIMEDOUT);
1854                         continue;
1855                 }
1856 
1857                 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1858                         __rfcomm_dlc_close(d, ECONNREFUSED);
1859                         continue;
1860                 }
1861 
1862                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1863                         rfcomm_dlc_clear_timer(d);
1864                         if (d->out) {
1865                                 rfcomm_send_pn(s, 1, d);
1866                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1867                         } else {
1868                                 if (d->defer_setup) {
1869                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1870                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1871 
1872                                         rfcomm_dlc_lock(d);
1873                                         d->state = BT_CONNECT2;
1874                                         d->state_change(d, 0);
1875                                         rfcomm_dlc_unlock(d);
1876                                 } else
1877                                         rfcomm_dlc_accept(d);
1878                         }
1879                         continue;
1880                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1881                         rfcomm_dlc_clear_timer(d);
1882                         if (!d->out)
1883                                 rfcomm_send_dm(s, d->dlci);
1884                         else
1885                                 d->state = BT_CLOSED;
1886                         __rfcomm_dlc_close(d, ECONNREFUSED);
1887                         continue;
1888                 }
1889 
1890                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1891                         continue;
1892 
1893                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1894                         continue;
1895 
1896                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1897                                                 d->mscex == RFCOMM_MSCEX_OK)
1898                         rfcomm_process_tx(d);
1899         }
1900 }
1901 
1902 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1903 {
1904         struct socket *sock = s->sock;
1905         struct sock *sk = sock->sk;
1906         struct sk_buff *skb;
1907 
1908         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1909 
1910         /* Get data directly from socket receive queue without copying it. */
1911         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1912                 skb_orphan(skb);
1913                 if (!skb_linearize(skb)) {
1914                         s = rfcomm_recv_frame(s, skb);
1915                         if (!s)
1916                                 break;
1917                 } else {
1918                         kfree_skb(skb);
1919                 }
1920         }
1921 
1922         if (s && (sk->sk_state == BT_CLOSED))
1923                 s = rfcomm_session_close(s, sk->sk_err);
1924 
1925         return s;
1926 }
1927 
1928 static void rfcomm_accept_connection(struct rfcomm_session *s)
1929 {
1930         struct socket *sock = s->sock, *nsock;
1931         int err;
1932 
1933         /* Fast check for a new connection.
1934          * Avoids unnesesary socket allocations. */
1935         if (list_empty(&bt_sk(sock->sk)->accept_q))
1936                 return;
1937 
1938         BT_DBG("session %p", s);
1939 
1940         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1941         if (err < 0)
1942                 return;
1943 
1944         /* Set our callbacks */
1945         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1946         nsock->sk->sk_state_change = rfcomm_l2state_change;
1947 
1948         s = rfcomm_session_add(nsock, BT_OPEN);
1949         if (s) {
1950                 /* We should adjust MTU on incoming sessions.
1951                  * L2CAP MTU minus UIH header and FCS. */
1952                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1953                                 l2cap_pi(nsock->sk)->chan->imtu) - 5;
1954 
1955                 rfcomm_schedule();
1956         } else
1957                 sock_release(nsock);
1958 }
1959 
1960 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1961 {
1962         struct sock *sk = s->sock->sk;
1963 
1964         BT_DBG("%p state %ld", s, s->state);
1965 
1966         switch (sk->sk_state) {
1967         case BT_CONNECTED:
1968                 s->state = BT_CONNECT;
1969 
1970                 /* We can adjust MTU on outgoing sessions.
1971                  * L2CAP MTU minus UIH header and FCS. */
1972                 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1973 
1974                 rfcomm_send_sabm(s, 0);
1975                 break;
1976 
1977         case BT_CLOSED:
1978                 s = rfcomm_session_close(s, sk->sk_err);
1979                 break;
1980         }
1981         return s;
1982 }
1983 
1984 static void rfcomm_process_sessions(void)
1985 {
1986         struct list_head *p, *n;
1987 
1988         rfcomm_lock();
1989 
1990         list_for_each_safe(p, n, &session_list) {
1991                 struct rfcomm_session *s;
1992                 s = list_entry(p, struct rfcomm_session, list);
1993 
1994                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1995                         s->state = BT_DISCONN;
1996                         rfcomm_send_disc(s, 0);
1997                         continue;
1998                 }
1999 
2000                 switch (s->state) {
2001                 case BT_LISTEN:
2002                         rfcomm_accept_connection(s);
2003                         continue;
2004 
2005                 case BT_BOUND:
2006                         s = rfcomm_check_connection(s);
2007                         break;
2008 
2009                 default:
2010                         s = rfcomm_process_rx(s);
2011                         break;
2012                 }
2013 
2014                 if (s)
2015                         rfcomm_process_dlcs(s);
2016         }
2017 
2018         rfcomm_unlock();
2019 }
2020 
2021 static int rfcomm_add_listener(bdaddr_t *ba)
2022 {
2023         struct sockaddr_l2 addr;
2024         struct socket *sock;
2025         struct sock *sk;
2026         struct rfcomm_session *s;
2027         int    err = 0;
2028 
2029         /* Create socket */
2030         err = rfcomm_l2sock_create(&sock);
2031         if (err < 0) {
2032                 BT_ERR("Create socket failed %d", err);
2033                 return err;
2034         }
2035 
2036         /* Bind socket */
2037         bacpy(&addr.l2_bdaddr, ba);
2038         addr.l2_family = AF_BLUETOOTH;
2039         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
2040         addr.l2_cid    = 0;
2041         addr.l2_bdaddr_type = BDADDR_BREDR;
2042         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
2043         if (err < 0) {
2044                 BT_ERR("Bind failed %d", err);
2045                 goto failed;
2046         }
2047 
2048         /* Set L2CAP options */
2049         sk = sock->sk;
2050         lock_sock(sk);
2051         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2052         release_sock(sk);
2053 
2054         /* Start listening on the socket */
2055         err = kernel_listen(sock, 10);
2056         if (err) {
2057                 BT_ERR("Listen failed %d", err);
2058                 goto failed;
2059         }
2060 
2061         /* Add listening session */
2062         s = rfcomm_session_add(sock, BT_LISTEN);
2063         if (!s) {
2064                 err = -ENOMEM;
2065                 goto failed;
2066         }
2067 
2068         return 0;
2069 failed:
2070         sock_release(sock);
2071         return err;
2072 }
2073 
2074 static void rfcomm_kill_listener(void)
2075 {
2076         struct rfcomm_session *s;
2077         struct list_head *p, *n;
2078 
2079         BT_DBG("");
2080 
2081         list_for_each_safe(p, n, &session_list) {
2082                 s = list_entry(p, struct rfcomm_session, list);
2083                 rfcomm_session_del(s);
2084         }
2085 }
2086 
2087 static int rfcomm_run(void *unused)
2088 {
2089         BT_DBG("");
2090 
2091         set_user_nice(current, -10);
2092 
2093         rfcomm_add_listener(BDADDR_ANY);
2094 
2095         while (1) {
2096                 set_current_state(TASK_INTERRUPTIBLE);
2097 
2098                 if (kthread_should_stop())
2099                         break;
2100 
2101                 /* Process stuff */
2102                 rfcomm_process_sessions();
2103 
2104                 schedule();
2105         }
2106         __set_current_state(TASK_RUNNING);
2107 
2108         rfcomm_kill_listener();
2109 
2110         return 0;
2111 }
2112 
2113 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2114 {
2115         struct rfcomm_session *s;
2116         struct rfcomm_dlc *d;
2117         struct list_head *p, *n;
2118 
2119         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2120 
2121         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2122         if (!s)
2123                 return;
2124 
2125         list_for_each_safe(p, n, &s->dlcs) {
2126                 d = list_entry(p, struct rfcomm_dlc, list);
2127 
2128                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2129                         rfcomm_dlc_clear_timer(d);
2130                         if (status || encrypt == 0x00) {
2131                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2132                                 continue;
2133                         }
2134                 }
2135 
2136                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2137                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2138                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2139                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2140                                 continue;
2141                         } else if (d->sec_level == BT_SECURITY_HIGH ||
2142                                    d->sec_level == BT_SECURITY_FIPS) {
2143                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2144                                 continue;
2145                         }
2146                 }
2147 
2148                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2149                         continue;
2150 
2151                 if (!status && hci_conn_check_secure(conn, d->sec_level))
2152                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2153                 else
2154                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2155         }
2156 
2157         rfcomm_schedule();
2158 }
2159 
2160 static struct hci_cb rfcomm_cb = {
2161         .name           = "RFCOMM",
2162         .security_cfm   = rfcomm_security_cfm
2163 };
2164 
2165 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2166 {
2167         struct rfcomm_session *s;
2168 
2169         rfcomm_lock();
2170 
2171         list_for_each_entry(s, &session_list, list) {
2172                 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2173                 struct rfcomm_dlc *d;
2174                 list_for_each_entry(d, &s->dlcs, list) {
2175                         seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2176                                    &chan->src, &chan->dst,
2177                                    d->state, d->dlci, d->mtu,
2178                                    d->rx_credits, d->tx_credits);
2179                 }
2180         }
2181 
2182         rfcomm_unlock();
2183 
2184         return 0;
2185 }
2186 
2187 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2188 {
2189         return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2190 }
2191 
2192 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2193         .open           = rfcomm_dlc_debugfs_open,
2194         .read           = seq_read,
2195         .llseek         = seq_lseek,
2196         .release        = single_release,
2197 };
2198 
2199 static struct dentry *rfcomm_dlc_debugfs;
2200 
2201 /* ---- Initialization ---- */
2202 static int __init rfcomm_init(void)
2203 {
2204         int err;
2205 
2206         hci_register_cb(&rfcomm_cb);
2207 
2208         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2209         if (IS_ERR(rfcomm_thread)) {
2210                 err = PTR_ERR(rfcomm_thread);
2211                 goto unregister;
2212         }
2213 
2214         err = rfcomm_init_ttys();
2215         if (err < 0)
2216                 goto stop;
2217 
2218         err = rfcomm_init_sockets();
2219         if (err < 0)
2220                 goto cleanup;
2221 
2222         BT_INFO("RFCOMM ver %s", VERSION);
2223 
2224         if (IS_ERR_OR_NULL(bt_debugfs))
2225                 return 0;
2226 
2227         rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2228                                                  bt_debugfs, NULL,
2229                                                  &rfcomm_dlc_debugfs_fops);
2230 
2231         return 0;
2232 
2233 cleanup:
2234         rfcomm_cleanup_ttys();
2235 
2236 stop:
2237         kthread_stop(rfcomm_thread);
2238 
2239 unregister:
2240         hci_unregister_cb(&rfcomm_cb);
2241 
2242         return err;
2243 }
2244 
2245 static void __exit rfcomm_exit(void)
2246 {
2247         debugfs_remove(rfcomm_dlc_debugfs);
2248 
2249         hci_unregister_cb(&rfcomm_cb);
2250 
2251         kthread_stop(rfcomm_thread);
2252 
2253         rfcomm_cleanup_ttys();
2254 
2255         rfcomm_cleanup_sockets();
2256 }
2257 
2258 module_init(rfcomm_init);
2259 module_exit(rfcomm_exit);
2260 
2261 module_param(disable_cfc, bool, 0644);
2262 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2263 
2264 module_param(channel_mtu, int, 0644);
2265 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2266 
2267 module_param(l2cap_mtu, uint, 0644);
2268 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2269 
2270 module_param(l2cap_ertm, bool, 0644);
2271 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2272 
2273 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2274 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2275 MODULE_VERSION(VERSION);
2276 MODULE_LICENSE("GPL");
2277 MODULE_ALIAS("bt-proto-3");
2278 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us