Version:  2.0.40 2.2.26 2.4.37 2.6.39 3.0 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15

Linux/net/bluetooth/rfcomm/core.c

  1 /*
  2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
  3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
  4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
  5 
  6    This program is free software; you can redistribute it and/or modify
  7    it under the terms of the GNU General Public License version 2 as
  8    published by the Free Software Foundation;
  9 
 10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
 13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
 14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
 15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 18 
 19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
 20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
 21    SOFTWARE IS DISCLAIMED.
 22 */
 23 
 24 /*
 25  * Bluetooth RFCOMM core.
 26  */
 27 
 28 #include <linux/module.h>
 29 #include <linux/debugfs.h>
 30 #include <linux/kthread.h>
 31 #include <asm/unaligned.h>
 32 
 33 #include <net/bluetooth/bluetooth.h>
 34 #include <net/bluetooth/hci_core.h>
 35 #include <net/bluetooth/l2cap.h>
 36 #include <net/bluetooth/rfcomm.h>
 37 
 38 #define VERSION "1.11"
 39 
 40 static bool disable_cfc;
 41 static bool l2cap_ertm;
 42 static int channel_mtu = -1;
 43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
 44 
 45 static struct task_struct *rfcomm_thread;
 46 
 47 static DEFINE_MUTEX(rfcomm_mutex);
 48 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
 49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
 50 
 51 
 52 static LIST_HEAD(session_list);
 53 
 54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
 55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
 56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
 57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
 58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
 59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
 60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
 61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
 62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
 63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
 64 
 65 static void rfcomm_process_connect(struct rfcomm_session *s);
 66 
 67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 68                                                         bdaddr_t *dst,
 69                                                         u8 sec_level,
 70                                                         int *err);
 71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
 72 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
 73 
 74 /* ---- RFCOMM frame parsing macros ---- */
 75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
 76 #define __get_channel(b)  ((b & 0xf8) >> 3)
 77 #define __get_dir(b)      ((b & 0x04) >> 2)
 78 #define __get_type(b)     ((b & 0xef))
 79 
 80 #define __test_ea(b)      ((b & 0x01))
 81 #define __test_cr(b)      ((b & 0x02))
 82 #define __test_pf(b)      ((b & 0x10))
 83 
 84 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 85 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
 86 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
 87 #define __srv_channel(dlci)    (dlci >> 1)
 88 #define __dir(dlci)            (dlci & 0x01)
 89 
 90 #define __len8(len)       (((len) << 1) | 1)
 91 #define __len16(len)      ((len) << 1)
 92 
 93 /* MCC macros */
 94 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 95 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 96 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 97 
 98 /* RPN macros */
 99 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
100 #define __get_rpn_data_bits(line) ((line) & 0x3)
101 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
102 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
103 
104 static void rfcomm_schedule(void)
105 {
106         if (!rfcomm_thread)
107                 return;
108         wake_up_process(rfcomm_thread);
109 }
110 
111 /* ---- RFCOMM FCS computation ---- */
112 
113 /* reversed, 8-bit, poly=0x07 */
114 static unsigned char rfcomm_crc_table[256] = {
115         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
116         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
117         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
118         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
119 
120         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
121         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
122         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
123         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
124 
125         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
126         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
127         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
128         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
129 
130         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
131         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
132         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
133         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
134 
135         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
136         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
137         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
138         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
139 
140         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
141         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
142         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
143         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
144 
145         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
146         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
147         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
148         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
149 
150         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
151         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
152         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
153         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
154 };
155 
156 /* CRC on 2 bytes */
157 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
158 
159 /* FCS on 2 bytes */
160 static inline u8 __fcs(u8 *data)
161 {
162         return 0xff - __crc(data);
163 }
164 
165 /* FCS on 3 bytes */
166 static inline u8 __fcs2(u8 *data)
167 {
168         return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
169 }
170 
171 /* Check FCS */
172 static inline int __check_fcs(u8 *data, int type, u8 fcs)
173 {
174         u8 f = __crc(data);
175 
176         if (type != RFCOMM_UIH)
177                 f = rfcomm_crc_table[f ^ data[2]];
178 
179         return rfcomm_crc_table[f ^ fcs] != 0xcf;
180 }
181 
182 /* ---- L2CAP callbacks ---- */
183 static void rfcomm_l2state_change(struct sock *sk)
184 {
185         BT_DBG("%p state %d", sk, sk->sk_state);
186         rfcomm_schedule();
187 }
188 
189 static void rfcomm_l2data_ready(struct sock *sk)
190 {
191         BT_DBG("%p", sk);
192         rfcomm_schedule();
193 }
194 
195 static int rfcomm_l2sock_create(struct socket **sock)
196 {
197         int err;
198 
199         BT_DBG("");
200 
201         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
202         if (!err) {
203                 struct sock *sk = (*sock)->sk;
204                 sk->sk_data_ready   = rfcomm_l2data_ready;
205                 sk->sk_state_change = rfcomm_l2state_change;
206         }
207         return err;
208 }
209 
210 static int rfcomm_check_security(struct rfcomm_dlc *d)
211 {
212         struct sock *sk = d->session->sock->sk;
213         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
214 
215         __u8 auth_type;
216 
217         switch (d->sec_level) {
218         case BT_SECURITY_HIGH:
219         case BT_SECURITY_FIPS:
220                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
221                 break;
222         case BT_SECURITY_MEDIUM:
223                 auth_type = HCI_AT_GENERAL_BONDING;
224                 break;
225         default:
226                 auth_type = HCI_AT_NO_BONDING;
227                 break;
228         }
229 
230         return hci_conn_security(conn->hcon, d->sec_level, auth_type);
231 }
232 
233 static void rfcomm_session_timeout(unsigned long arg)
234 {
235         struct rfcomm_session *s = (void *) arg;
236 
237         BT_DBG("session %p state %ld", s, s->state);
238 
239         set_bit(RFCOMM_TIMED_OUT, &s->flags);
240         rfcomm_schedule();
241 }
242 
243 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
244 {
245         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
246 
247         mod_timer(&s->timer, jiffies + timeout);
248 }
249 
250 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
251 {
252         BT_DBG("session %p state %ld", s, s->state);
253 
254         del_timer_sync(&s->timer);
255 }
256 
257 /* ---- RFCOMM DLCs ---- */
258 static void rfcomm_dlc_timeout(unsigned long arg)
259 {
260         struct rfcomm_dlc *d = (void *) arg;
261 
262         BT_DBG("dlc %p state %ld", d, d->state);
263 
264         set_bit(RFCOMM_TIMED_OUT, &d->flags);
265         rfcomm_dlc_put(d);
266         rfcomm_schedule();
267 }
268 
269 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
270 {
271         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
272 
273         if (!mod_timer(&d->timer, jiffies + timeout))
274                 rfcomm_dlc_hold(d);
275 }
276 
277 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
278 {
279         BT_DBG("dlc %p state %ld", d, d->state);
280 
281         if (del_timer(&d->timer))
282                 rfcomm_dlc_put(d);
283 }
284 
285 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
286 {
287         BT_DBG("%p", d);
288 
289         d->state      = BT_OPEN;
290         d->flags      = 0;
291         d->mscex      = 0;
292         d->sec_level  = BT_SECURITY_LOW;
293         d->mtu        = RFCOMM_DEFAULT_MTU;
294         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
295 
296         d->cfc        = RFCOMM_CFC_DISABLED;
297         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
298 }
299 
300 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
301 {
302         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
303 
304         if (!d)
305                 return NULL;
306 
307         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
308 
309         skb_queue_head_init(&d->tx_queue);
310         spin_lock_init(&d->lock);
311         atomic_set(&d->refcnt, 1);
312 
313         rfcomm_dlc_clear_state(d);
314 
315         BT_DBG("%p", d);
316 
317         return d;
318 }
319 
320 void rfcomm_dlc_free(struct rfcomm_dlc *d)
321 {
322         BT_DBG("%p", d);
323 
324         skb_queue_purge(&d->tx_queue);
325         kfree(d);
326 }
327 
328 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
329 {
330         BT_DBG("dlc %p session %p", d, s);
331 
332         rfcomm_session_clear_timer(s);
333         rfcomm_dlc_hold(d);
334         list_add(&d->list, &s->dlcs);
335         d->session = s;
336 }
337 
338 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
339 {
340         struct rfcomm_session *s = d->session;
341 
342         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
343 
344         list_del(&d->list);
345         d->session = NULL;
346         rfcomm_dlc_put(d);
347 
348         if (list_empty(&s->dlcs))
349                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
350 }
351 
352 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
353 {
354         struct rfcomm_dlc *d;
355 
356         list_for_each_entry(d, &s->dlcs, list)
357                 if (d->dlci == dlci)
358                         return d;
359 
360         return NULL;
361 }
362 
363 static int rfcomm_check_channel(u8 channel)
364 {
365         return channel < 1 || channel > 30;
366 }
367 
368 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
369 {
370         struct rfcomm_session *s;
371         int err = 0;
372         u8 dlci;
373 
374         BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
375                d, d->state, src, dst, channel);
376 
377         if (rfcomm_check_channel(channel))
378                 return -EINVAL;
379 
380         if (d->state != BT_OPEN && d->state != BT_CLOSED)
381                 return 0;
382 
383         s = rfcomm_session_get(src, dst);
384         if (!s) {
385                 s = rfcomm_session_create(src, dst, d->sec_level, &err);
386                 if (!s)
387                         return err;
388         }
389 
390         dlci = __dlci(!s->initiator, channel);
391 
392         /* Check if DLCI already exists */
393         if (rfcomm_dlc_get(s, dlci))
394                 return -EBUSY;
395 
396         rfcomm_dlc_clear_state(d);
397 
398         d->dlci     = dlci;
399         d->addr     = __addr(s->initiator, dlci);
400         d->priority = 7;
401 
402         d->state = BT_CONFIG;
403         rfcomm_dlc_link(s, d);
404 
405         d->out = 1;
406 
407         d->mtu = s->mtu;
408         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
409 
410         if (s->state == BT_CONNECTED) {
411                 if (rfcomm_check_security(d))
412                         rfcomm_send_pn(s, 1, d);
413                 else
414                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
415         }
416 
417         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
418 
419         return 0;
420 }
421 
422 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
423 {
424         int r;
425 
426         rfcomm_lock();
427 
428         r = __rfcomm_dlc_open(d, src, dst, channel);
429 
430         rfcomm_unlock();
431         return r;
432 }
433 
434 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
435 {
436         struct rfcomm_session *s = d->session;
437 
438         d->state = BT_DISCONN;
439         if (skb_queue_empty(&d->tx_queue)) {
440                 rfcomm_send_disc(s, d->dlci);
441                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
442         } else {
443                 rfcomm_queue_disc(d);
444                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
445         }
446 }
447 
448 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
449 {
450         struct rfcomm_session *s = d->session;
451         if (!s)
452                 return 0;
453 
454         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
455                         d, d->state, d->dlci, err, s);
456 
457         switch (d->state) {
458         case BT_CONNECT:
459         case BT_CONFIG:
460         case BT_OPEN:
461         case BT_CONNECT2:
462                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
463                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
464                         rfcomm_schedule();
465                         return 0;
466                 }
467         }
468 
469         switch (d->state) {
470         case BT_CONNECT:
471         case BT_CONNECTED:
472                 __rfcomm_dlc_disconn(d);
473                 break;
474 
475         case BT_CONFIG:
476                 if (s->state != BT_BOUND) {
477                         __rfcomm_dlc_disconn(d);
478                         break;
479                 }
480                 /* if closing a dlc in a session that hasn't been started,
481                  * just close and unlink the dlc
482                  */
483 
484         default:
485                 rfcomm_dlc_clear_timer(d);
486 
487                 rfcomm_dlc_lock(d);
488                 d->state = BT_CLOSED;
489                 d->state_change(d, err);
490                 rfcomm_dlc_unlock(d);
491 
492                 skb_queue_purge(&d->tx_queue);
493                 rfcomm_dlc_unlink(d);
494         }
495 
496         return 0;
497 }
498 
499 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
500 {
501         int r = 0;
502         struct rfcomm_dlc *d_list;
503         struct rfcomm_session *s, *s_list;
504 
505         BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
506 
507         rfcomm_lock();
508 
509         s = d->session;
510         if (!s)
511                 goto no_session;
512 
513         /* after waiting on the mutex check the session still exists
514          * then check the dlc still exists
515          */
516         list_for_each_entry(s_list, &session_list, list) {
517                 if (s_list == s) {
518                         list_for_each_entry(d_list, &s->dlcs, list) {
519                                 if (d_list == d) {
520                                         r = __rfcomm_dlc_close(d, err);
521                                         break;
522                                 }
523                         }
524                         break;
525                 }
526         }
527 
528 no_session:
529         rfcomm_unlock();
530         return r;
531 }
532 
533 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
534 {
535         struct rfcomm_session *s;
536         struct rfcomm_dlc *dlc = NULL;
537         u8 dlci;
538 
539         if (rfcomm_check_channel(channel))
540                 return ERR_PTR(-EINVAL);
541 
542         rfcomm_lock();
543         s = rfcomm_session_get(src, dst);
544         if (s) {
545                 dlci = __dlci(!s->initiator, channel);
546                 dlc = rfcomm_dlc_get(s, dlci);
547         }
548         rfcomm_unlock();
549         return dlc;
550 }
551 
552 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
553 {
554         int len = skb->len;
555 
556         if (d->state != BT_CONNECTED)
557                 return -ENOTCONN;
558 
559         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
560 
561         if (len > d->mtu)
562                 return -EINVAL;
563 
564         rfcomm_make_uih(skb, d->addr);
565         skb_queue_tail(&d->tx_queue, skb);
566 
567         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
568                 rfcomm_schedule();
569         return len;
570 }
571 
572 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
573 {
574         int len = skb->len;
575 
576         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
577 
578         rfcomm_make_uih(skb, d->addr);
579         skb_queue_tail(&d->tx_queue, skb);
580 
581         if (d->state == BT_CONNECTED &&
582             !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
583                 rfcomm_schedule();
584 }
585 
586 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
587 {
588         BT_DBG("dlc %p state %ld", d, d->state);
589 
590         if (!d->cfc) {
591                 d->v24_sig |= RFCOMM_V24_FC;
592                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
593         }
594         rfcomm_schedule();
595 }
596 
597 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
598 {
599         BT_DBG("dlc %p state %ld", d, d->state);
600 
601         if (!d->cfc) {
602                 d->v24_sig &= ~RFCOMM_V24_FC;
603                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
604         }
605         rfcomm_schedule();
606 }
607 
608 /*
609    Set/get modem status functions use _local_ status i.e. what we report
610    to the other side.
611    Remote status is provided by dlc->modem_status() callback.
612  */
613 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
614 {
615         BT_DBG("dlc %p state %ld v24_sig 0x%x",
616                         d, d->state, v24_sig);
617 
618         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
619                 v24_sig |= RFCOMM_V24_FC;
620         else
621                 v24_sig &= ~RFCOMM_V24_FC;
622 
623         d->v24_sig = v24_sig;
624 
625         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
626                 rfcomm_schedule();
627 
628         return 0;
629 }
630 
631 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
632 {
633         BT_DBG("dlc %p state %ld v24_sig 0x%x",
634                         d, d->state, d->v24_sig);
635 
636         *v24_sig = d->v24_sig;
637         return 0;
638 }
639 
640 /* ---- RFCOMM sessions ---- */
641 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
642 {
643         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
644 
645         if (!s)
646                 return NULL;
647 
648         BT_DBG("session %p sock %p", s, sock);
649 
650         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
651 
652         INIT_LIST_HEAD(&s->dlcs);
653         s->state = state;
654         s->sock  = sock;
655 
656         s->mtu = RFCOMM_DEFAULT_MTU;
657         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
658 
659         /* Do not increment module usage count for listening sessions.
660          * Otherwise we won't be able to unload the module. */
661         if (state != BT_LISTEN)
662                 if (!try_module_get(THIS_MODULE)) {
663                         kfree(s);
664                         return NULL;
665                 }
666 
667         list_add(&s->list, &session_list);
668 
669         return s;
670 }
671 
672 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
673 {
674         int state = s->state;
675 
676         BT_DBG("session %p state %ld", s, s->state);
677 
678         list_del(&s->list);
679 
680         rfcomm_session_clear_timer(s);
681         sock_release(s->sock);
682         kfree(s);
683 
684         if (state != BT_LISTEN)
685                 module_put(THIS_MODULE);
686 
687         return NULL;
688 }
689 
690 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
691 {
692         struct rfcomm_session *s;
693         struct list_head *p, *n;
694         struct l2cap_chan *chan;
695         list_for_each_safe(p, n, &session_list) {
696                 s = list_entry(p, struct rfcomm_session, list);
697                 chan = l2cap_pi(s->sock->sk)->chan;
698 
699                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
700                     !bacmp(&chan->dst, dst))
701                         return s;
702         }
703         return NULL;
704 }
705 
706 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
707                                                    int err)
708 {
709         struct rfcomm_dlc *d;
710         struct list_head *p, *n;
711 
712         s->state = BT_CLOSED;
713 
714         BT_DBG("session %p state %ld err %d", s, s->state, err);
715 
716         /* Close all dlcs */
717         list_for_each_safe(p, n, &s->dlcs) {
718                 d = list_entry(p, struct rfcomm_dlc, list);
719                 d->state = BT_CLOSED;
720                 __rfcomm_dlc_close(d, err);
721         }
722 
723         rfcomm_session_clear_timer(s);
724         return rfcomm_session_del(s);
725 }
726 
727 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
728                                                         bdaddr_t *dst,
729                                                         u8 sec_level,
730                                                         int *err)
731 {
732         struct rfcomm_session *s = NULL;
733         struct sockaddr_l2 addr;
734         struct socket *sock;
735         struct sock *sk;
736 
737         BT_DBG("%pMR -> %pMR", src, dst);
738 
739         *err = rfcomm_l2sock_create(&sock);
740         if (*err < 0)
741                 return NULL;
742 
743         bacpy(&addr.l2_bdaddr, src);
744         addr.l2_family = AF_BLUETOOTH;
745         addr.l2_psm    = 0;
746         addr.l2_cid    = 0;
747         addr.l2_bdaddr_type = BDADDR_BREDR;
748         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
749         if (*err < 0)
750                 goto failed;
751 
752         /* Set L2CAP options */
753         sk = sock->sk;
754         lock_sock(sk);
755         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
756         l2cap_pi(sk)->chan->sec_level = sec_level;
757         if (l2cap_ertm)
758                 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
759         release_sock(sk);
760 
761         s = rfcomm_session_add(sock, BT_BOUND);
762         if (!s) {
763                 *err = -ENOMEM;
764                 goto failed;
765         }
766 
767         s->initiator = 1;
768 
769         bacpy(&addr.l2_bdaddr, dst);
770         addr.l2_family = AF_BLUETOOTH;
771         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
772         addr.l2_cid    = 0;
773         addr.l2_bdaddr_type = BDADDR_BREDR;
774         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
775         if (*err == 0 || *err == -EINPROGRESS)
776                 return s;
777 
778         return rfcomm_session_del(s);
779 
780 failed:
781         sock_release(sock);
782         return NULL;
783 }
784 
785 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
786 {
787         struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
788         if (src)
789                 bacpy(src, &chan->src);
790         if (dst)
791                 bacpy(dst, &chan->dst);
792 }
793 
794 /* ---- RFCOMM frame sending ---- */
795 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
796 {
797         struct kvec iv = { data, len };
798         struct msghdr msg;
799 
800         BT_DBG("session %p len %d", s, len);
801 
802         memset(&msg, 0, sizeof(msg));
803 
804         return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
805 }
806 
807 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
808 {
809         BT_DBG("%p cmd %u", s, cmd->ctrl);
810 
811         return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
812 }
813 
814 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
815 {
816         struct rfcomm_cmd cmd;
817 
818         BT_DBG("%p dlci %d", s, dlci);
819 
820         cmd.addr = __addr(s->initiator, dlci);
821         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
822         cmd.len  = __len8(0);
823         cmd.fcs  = __fcs2((u8 *) &cmd);
824 
825         return rfcomm_send_cmd(s, &cmd);
826 }
827 
828 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
829 {
830         struct rfcomm_cmd cmd;
831 
832         BT_DBG("%p dlci %d", s, dlci);
833 
834         cmd.addr = __addr(!s->initiator, dlci);
835         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
836         cmd.len  = __len8(0);
837         cmd.fcs  = __fcs2((u8 *) &cmd);
838 
839         return rfcomm_send_cmd(s, &cmd);
840 }
841 
842 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
843 {
844         struct rfcomm_cmd cmd;
845 
846         BT_DBG("%p dlci %d", s, dlci);
847 
848         cmd.addr = __addr(s->initiator, dlci);
849         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
850         cmd.len  = __len8(0);
851         cmd.fcs  = __fcs2((u8 *) &cmd);
852 
853         return rfcomm_send_cmd(s, &cmd);
854 }
855 
856 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
857 {
858         struct rfcomm_cmd *cmd;
859         struct sk_buff *skb;
860 
861         BT_DBG("dlc %p dlci %d", d, d->dlci);
862 
863         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
864         if (!skb)
865                 return -ENOMEM;
866 
867         cmd = (void *) __skb_put(skb, sizeof(*cmd));
868         cmd->addr = d->addr;
869         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
870         cmd->len  = __len8(0);
871         cmd->fcs  = __fcs2((u8 *) cmd);
872 
873         skb_queue_tail(&d->tx_queue, skb);
874         rfcomm_schedule();
875         return 0;
876 }
877 
878 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
879 {
880         struct rfcomm_cmd cmd;
881 
882         BT_DBG("%p dlci %d", s, dlci);
883 
884         cmd.addr = __addr(!s->initiator, dlci);
885         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
886         cmd.len  = __len8(0);
887         cmd.fcs  = __fcs2((u8 *) &cmd);
888 
889         return rfcomm_send_cmd(s, &cmd);
890 }
891 
892 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
893 {
894         struct rfcomm_hdr *hdr;
895         struct rfcomm_mcc *mcc;
896         u8 buf[16], *ptr = buf;
897 
898         BT_DBG("%p cr %d type %d", s, cr, type);
899 
900         hdr = (void *) ptr; ptr += sizeof(*hdr);
901         hdr->addr = __addr(s->initiator, 0);
902         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
903         hdr->len  = __len8(sizeof(*mcc) + 1);
904 
905         mcc = (void *) ptr; ptr += sizeof(*mcc);
906         mcc->type = __mcc_type(cr, RFCOMM_NSC);
907         mcc->len  = __len8(1);
908 
909         /* Type that we didn't like */
910         *ptr = __mcc_type(cr, type); ptr++;
911 
912         *ptr = __fcs(buf); ptr++;
913 
914         return rfcomm_send_frame(s, buf, ptr - buf);
915 }
916 
917 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
918 {
919         struct rfcomm_hdr *hdr;
920         struct rfcomm_mcc *mcc;
921         struct rfcomm_pn  *pn;
922         u8 buf[16], *ptr = buf;
923 
924         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
925 
926         hdr = (void *) ptr; ptr += sizeof(*hdr);
927         hdr->addr = __addr(s->initiator, 0);
928         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
929         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
930 
931         mcc = (void *) ptr; ptr += sizeof(*mcc);
932         mcc->type = __mcc_type(cr, RFCOMM_PN);
933         mcc->len  = __len8(sizeof(*pn));
934 
935         pn = (void *) ptr; ptr += sizeof(*pn);
936         pn->dlci        = d->dlci;
937         pn->priority    = d->priority;
938         pn->ack_timer   = 0;
939         pn->max_retrans = 0;
940 
941         if (s->cfc) {
942                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
943                 pn->credits = RFCOMM_DEFAULT_CREDITS;
944         } else {
945                 pn->flow_ctrl = 0;
946                 pn->credits   = 0;
947         }
948 
949         if (cr && channel_mtu >= 0)
950                 pn->mtu = cpu_to_le16(channel_mtu);
951         else
952                 pn->mtu = cpu_to_le16(d->mtu);
953 
954         *ptr = __fcs(buf); ptr++;
955 
956         return rfcomm_send_frame(s, buf, ptr - buf);
957 }
958 
959 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
960                         u8 bit_rate, u8 data_bits, u8 stop_bits,
961                         u8 parity, u8 flow_ctrl_settings,
962                         u8 xon_char, u8 xoff_char, u16 param_mask)
963 {
964         struct rfcomm_hdr *hdr;
965         struct rfcomm_mcc *mcc;
966         struct rfcomm_rpn *rpn;
967         u8 buf[16], *ptr = buf;
968 
969         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
970                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
971                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
972                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
973 
974         hdr = (void *) ptr; ptr += sizeof(*hdr);
975         hdr->addr = __addr(s->initiator, 0);
976         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
977         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
978 
979         mcc = (void *) ptr; ptr += sizeof(*mcc);
980         mcc->type = __mcc_type(cr, RFCOMM_RPN);
981         mcc->len  = __len8(sizeof(*rpn));
982 
983         rpn = (void *) ptr; ptr += sizeof(*rpn);
984         rpn->dlci          = __addr(1, dlci);
985         rpn->bit_rate      = bit_rate;
986         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
987         rpn->flow_ctrl     = flow_ctrl_settings;
988         rpn->xon_char      = xon_char;
989         rpn->xoff_char     = xoff_char;
990         rpn->param_mask    = cpu_to_le16(param_mask);
991 
992         *ptr = __fcs(buf); ptr++;
993 
994         return rfcomm_send_frame(s, buf, ptr - buf);
995 }
996 
997 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
998 {
999         struct rfcomm_hdr *hdr;
1000         struct rfcomm_mcc *mcc;
1001         struct rfcomm_rls *rls;
1002         u8 buf[16], *ptr = buf;
1003 
1004         BT_DBG("%p cr %d status 0x%x", s, cr, status);
1005 
1006         hdr = (void *) ptr; ptr += sizeof(*hdr);
1007         hdr->addr = __addr(s->initiator, 0);
1008         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1009         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
1010 
1011         mcc = (void *) ptr; ptr += sizeof(*mcc);
1012         mcc->type = __mcc_type(cr, RFCOMM_RLS);
1013         mcc->len  = __len8(sizeof(*rls));
1014 
1015         rls = (void *) ptr; ptr += sizeof(*rls);
1016         rls->dlci   = __addr(1, dlci);
1017         rls->status = status;
1018 
1019         *ptr = __fcs(buf); ptr++;
1020 
1021         return rfcomm_send_frame(s, buf, ptr - buf);
1022 }
1023 
1024 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1025 {
1026         struct rfcomm_hdr *hdr;
1027         struct rfcomm_mcc *mcc;
1028         struct rfcomm_msc *msc;
1029         u8 buf[16], *ptr = buf;
1030 
1031         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1032 
1033         hdr = (void *) ptr; ptr += sizeof(*hdr);
1034         hdr->addr = __addr(s->initiator, 0);
1035         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1036         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
1037 
1038         mcc = (void *) ptr; ptr += sizeof(*mcc);
1039         mcc->type = __mcc_type(cr, RFCOMM_MSC);
1040         mcc->len  = __len8(sizeof(*msc));
1041 
1042         msc = (void *) ptr; ptr += sizeof(*msc);
1043         msc->dlci    = __addr(1, dlci);
1044         msc->v24_sig = v24_sig | 0x01;
1045 
1046         *ptr = __fcs(buf); ptr++;
1047 
1048         return rfcomm_send_frame(s, buf, ptr - buf);
1049 }
1050 
1051 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1052 {
1053         struct rfcomm_hdr *hdr;
1054         struct rfcomm_mcc *mcc;
1055         u8 buf[16], *ptr = buf;
1056 
1057         BT_DBG("%p cr %d", s, cr);
1058 
1059         hdr = (void *) ptr; ptr += sizeof(*hdr);
1060         hdr->addr = __addr(s->initiator, 0);
1061         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1062         hdr->len  = __len8(sizeof(*mcc));
1063 
1064         mcc = (void *) ptr; ptr += sizeof(*mcc);
1065         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1066         mcc->len  = __len8(0);
1067 
1068         *ptr = __fcs(buf); ptr++;
1069 
1070         return rfcomm_send_frame(s, buf, ptr - buf);
1071 }
1072 
1073 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1074 {
1075         struct rfcomm_hdr *hdr;
1076         struct rfcomm_mcc *mcc;
1077         u8 buf[16], *ptr = buf;
1078 
1079         BT_DBG("%p cr %d", s, cr);
1080 
1081         hdr = (void *) ptr; ptr += sizeof(*hdr);
1082         hdr->addr = __addr(s->initiator, 0);
1083         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1084         hdr->len  = __len8(sizeof(*mcc));
1085 
1086         mcc = (void *) ptr; ptr += sizeof(*mcc);
1087         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1088         mcc->len  = __len8(0);
1089 
1090         *ptr = __fcs(buf); ptr++;
1091 
1092         return rfcomm_send_frame(s, buf, ptr - buf);
1093 }
1094 
1095 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1096 {
1097         struct socket *sock = s->sock;
1098         struct kvec iv[3];
1099         struct msghdr msg;
1100         unsigned char hdr[5], crc[1];
1101 
1102         if (len > 125)
1103                 return -EINVAL;
1104 
1105         BT_DBG("%p cr %d", s, cr);
1106 
1107         hdr[0] = __addr(s->initiator, 0);
1108         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1109         hdr[2] = 0x01 | ((len + 2) << 1);
1110         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1111         hdr[4] = 0x01 | (len << 1);
1112 
1113         crc[0] = __fcs(hdr);
1114 
1115         iv[0].iov_base = hdr;
1116         iv[0].iov_len  = 5;
1117         iv[1].iov_base = pattern;
1118         iv[1].iov_len  = len;
1119         iv[2].iov_base = crc;
1120         iv[2].iov_len  = 1;
1121 
1122         memset(&msg, 0, sizeof(msg));
1123 
1124         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1125 }
1126 
1127 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1128 {
1129         struct rfcomm_hdr *hdr;
1130         u8 buf[16], *ptr = buf;
1131 
1132         BT_DBG("%p addr %d credits %d", s, addr, credits);
1133 
1134         hdr = (void *) ptr; ptr += sizeof(*hdr);
1135         hdr->addr = addr;
1136         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1137         hdr->len  = __len8(0);
1138 
1139         *ptr = credits; ptr++;
1140 
1141         *ptr = __fcs(buf); ptr++;
1142 
1143         return rfcomm_send_frame(s, buf, ptr - buf);
1144 }
1145 
1146 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1147 {
1148         struct rfcomm_hdr *hdr;
1149         int len = skb->len;
1150         u8 *crc;
1151 
1152         if (len > 127) {
1153                 hdr = (void *) skb_push(skb, 4);
1154                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1155         } else {
1156                 hdr = (void *) skb_push(skb, 3);
1157                 hdr->len = __len8(len);
1158         }
1159         hdr->addr = addr;
1160         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1161 
1162         crc = skb_put(skb, 1);
1163         *crc = __fcs((void *) hdr);
1164 }
1165 
1166 /* ---- RFCOMM frame reception ---- */
1167 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1168 {
1169         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1170 
1171         if (dlci) {
1172                 /* Data channel */
1173                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1174                 if (!d) {
1175                         rfcomm_send_dm(s, dlci);
1176                         return s;
1177                 }
1178 
1179                 switch (d->state) {
1180                 case BT_CONNECT:
1181                         rfcomm_dlc_clear_timer(d);
1182 
1183                         rfcomm_dlc_lock(d);
1184                         d->state = BT_CONNECTED;
1185                         d->state_change(d, 0);
1186                         rfcomm_dlc_unlock(d);
1187 
1188                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1189                         break;
1190 
1191                 case BT_DISCONN:
1192                         d->state = BT_CLOSED;
1193                         __rfcomm_dlc_close(d, 0);
1194 
1195                         if (list_empty(&s->dlcs)) {
1196                                 s->state = BT_DISCONN;
1197                                 rfcomm_send_disc(s, 0);
1198                                 rfcomm_session_clear_timer(s);
1199                         }
1200 
1201                         break;
1202                 }
1203         } else {
1204                 /* Control channel */
1205                 switch (s->state) {
1206                 case BT_CONNECT:
1207                         s->state = BT_CONNECTED;
1208                         rfcomm_process_connect(s);
1209                         break;
1210 
1211                 case BT_DISCONN:
1212                         s = rfcomm_session_close(s, ECONNRESET);
1213                         break;
1214                 }
1215         }
1216         return s;
1217 }
1218 
1219 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1220 {
1221         int err = 0;
1222 
1223         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1224 
1225         if (dlci) {
1226                 /* Data DLC */
1227                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1228                 if (d) {
1229                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1230                                 err = ECONNREFUSED;
1231                         else
1232                                 err = ECONNRESET;
1233 
1234                         d->state = BT_CLOSED;
1235                         __rfcomm_dlc_close(d, err);
1236                 }
1237         } else {
1238                 if (s->state == BT_CONNECT)
1239                         err = ECONNREFUSED;
1240                 else
1241                         err = ECONNRESET;
1242 
1243                 s = rfcomm_session_close(s, err);
1244         }
1245         return s;
1246 }
1247 
1248 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1249                                                u8 dlci)
1250 {
1251         int err = 0;
1252 
1253         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1254 
1255         if (dlci) {
1256                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1257                 if (d) {
1258                         rfcomm_send_ua(s, dlci);
1259 
1260                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1261                                 err = ECONNREFUSED;
1262                         else
1263                                 err = ECONNRESET;
1264 
1265                         d->state = BT_CLOSED;
1266                         __rfcomm_dlc_close(d, err);
1267                 } else
1268                         rfcomm_send_dm(s, dlci);
1269 
1270         } else {
1271                 rfcomm_send_ua(s, 0);
1272 
1273                 if (s->state == BT_CONNECT)
1274                         err = ECONNREFUSED;
1275                 else
1276                         err = ECONNRESET;
1277 
1278                 s = rfcomm_session_close(s, err);
1279         }
1280         return s;
1281 }
1282 
1283 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1284 {
1285         struct sock *sk = d->session->sock->sk;
1286         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1287 
1288         BT_DBG("dlc %p", d);
1289 
1290         rfcomm_send_ua(d->session, d->dlci);
1291 
1292         rfcomm_dlc_clear_timer(d);
1293 
1294         rfcomm_dlc_lock(d);
1295         d->state = BT_CONNECTED;
1296         d->state_change(d, 0);
1297         rfcomm_dlc_unlock(d);
1298 
1299         if (d->role_switch)
1300                 hci_conn_switch_role(conn->hcon, 0x00);
1301 
1302         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1303 }
1304 
1305 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1306 {
1307         if (rfcomm_check_security(d)) {
1308                 if (d->defer_setup) {
1309                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1310                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1311 
1312                         rfcomm_dlc_lock(d);
1313                         d->state = BT_CONNECT2;
1314                         d->state_change(d, 0);
1315                         rfcomm_dlc_unlock(d);
1316                 } else
1317                         rfcomm_dlc_accept(d);
1318         } else {
1319                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1320                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1321         }
1322 }
1323 
1324 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1325 {
1326         struct rfcomm_dlc *d;
1327         u8 channel;
1328 
1329         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1330 
1331         if (!dlci) {
1332                 rfcomm_send_ua(s, 0);
1333 
1334                 if (s->state == BT_OPEN) {
1335                         s->state = BT_CONNECTED;
1336                         rfcomm_process_connect(s);
1337                 }
1338                 return 0;
1339         }
1340 
1341         /* Check if DLC exists */
1342         d = rfcomm_dlc_get(s, dlci);
1343         if (d) {
1344                 if (d->state == BT_OPEN) {
1345                         /* DLC was previously opened by PN request */
1346                         rfcomm_check_accept(d);
1347                 }
1348                 return 0;
1349         }
1350 
1351         /* Notify socket layer about incoming connection */
1352         channel = __srv_channel(dlci);
1353         if (rfcomm_connect_ind(s, channel, &d)) {
1354                 d->dlci = dlci;
1355                 d->addr = __addr(s->initiator, dlci);
1356                 rfcomm_dlc_link(s, d);
1357 
1358                 rfcomm_check_accept(d);
1359         } else {
1360                 rfcomm_send_dm(s, dlci);
1361         }
1362 
1363         return 0;
1364 }
1365 
1366 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1367 {
1368         struct rfcomm_session *s = d->session;
1369 
1370         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1371                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1372 
1373         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1374                                                 pn->flow_ctrl == 0xe0) {
1375                 d->cfc = RFCOMM_CFC_ENABLED;
1376                 d->tx_credits = pn->credits;
1377         } else {
1378                 d->cfc = RFCOMM_CFC_DISABLED;
1379                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1380         }
1381 
1382         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1383                 s->cfc = d->cfc;
1384 
1385         d->priority = pn->priority;
1386 
1387         d->mtu = __le16_to_cpu(pn->mtu);
1388 
1389         if (cr && d->mtu > s->mtu)
1390                 d->mtu = s->mtu;
1391 
1392         return 0;
1393 }
1394 
1395 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1396 {
1397         struct rfcomm_pn *pn = (void *) skb->data;
1398         struct rfcomm_dlc *d;
1399         u8 dlci = pn->dlci;
1400 
1401         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1402 
1403         if (!dlci)
1404                 return 0;
1405 
1406         d = rfcomm_dlc_get(s, dlci);
1407         if (d) {
1408                 if (cr) {
1409                         /* PN request */
1410                         rfcomm_apply_pn(d, cr, pn);
1411                         rfcomm_send_pn(s, 0, d);
1412                 } else {
1413                         /* PN response */
1414                         switch (d->state) {
1415                         case BT_CONFIG:
1416                                 rfcomm_apply_pn(d, cr, pn);
1417 
1418                                 d->state = BT_CONNECT;
1419                                 rfcomm_send_sabm(s, d->dlci);
1420                                 break;
1421                         }
1422                 }
1423         } else {
1424                 u8 channel = __srv_channel(dlci);
1425 
1426                 if (!cr)
1427                         return 0;
1428 
1429                 /* PN request for non existing DLC.
1430                  * Assume incoming connection. */
1431                 if (rfcomm_connect_ind(s, channel, &d)) {
1432                         d->dlci = dlci;
1433                         d->addr = __addr(s->initiator, dlci);
1434                         rfcomm_dlc_link(s, d);
1435 
1436                         rfcomm_apply_pn(d, cr, pn);
1437 
1438                         d->state = BT_OPEN;
1439                         rfcomm_send_pn(s, 0, d);
1440                 } else {
1441                         rfcomm_send_dm(s, dlci);
1442                 }
1443         }
1444         return 0;
1445 }
1446 
1447 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1448 {
1449         struct rfcomm_rpn *rpn = (void *) skb->data;
1450         u8 dlci = __get_dlci(rpn->dlci);
1451 
1452         u8 bit_rate  = 0;
1453         u8 data_bits = 0;
1454         u8 stop_bits = 0;
1455         u8 parity    = 0;
1456         u8 flow_ctrl = 0;
1457         u8 xon_char  = 0;
1458         u8 xoff_char = 0;
1459         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1460 
1461         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1462                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1463                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1464 
1465         if (!cr)
1466                 return 0;
1467 
1468         if (len == 1) {
1469                 /* This is a request, return default (according to ETSI TS 07.10) settings */
1470                 bit_rate  = RFCOMM_RPN_BR_9600;
1471                 data_bits = RFCOMM_RPN_DATA_8;
1472                 stop_bits = RFCOMM_RPN_STOP_1;
1473                 parity    = RFCOMM_RPN_PARITY_NONE;
1474                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1475                 xon_char  = RFCOMM_RPN_XON_CHAR;
1476                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1477                 goto rpn_out;
1478         }
1479 
1480         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1481          * no parity, no flow control lines, normal XON/XOFF chars */
1482 
1483         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1484                 bit_rate = rpn->bit_rate;
1485                 if (bit_rate > RFCOMM_RPN_BR_230400) {
1486                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1487                         bit_rate = RFCOMM_RPN_BR_9600;
1488                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1489                 }
1490         }
1491 
1492         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1493                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1494                 if (data_bits != RFCOMM_RPN_DATA_8) {
1495                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1496                         data_bits = RFCOMM_RPN_DATA_8;
1497                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1498                 }
1499         }
1500 
1501         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1502                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1503                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1504                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1505                         stop_bits = RFCOMM_RPN_STOP_1;
1506                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1507                 }
1508         }
1509 
1510         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1511                 parity = __get_rpn_parity(rpn->line_settings);
1512                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1513                         BT_DBG("RPN parity mismatch 0x%x", parity);
1514                         parity = RFCOMM_RPN_PARITY_NONE;
1515                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1516                 }
1517         }
1518 
1519         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1520                 flow_ctrl = rpn->flow_ctrl;
1521                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1522                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1523                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1524                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1525                 }
1526         }
1527 
1528         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1529                 xon_char = rpn->xon_char;
1530                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1531                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1532                         xon_char = RFCOMM_RPN_XON_CHAR;
1533                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1534                 }
1535         }
1536 
1537         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1538                 xoff_char = rpn->xoff_char;
1539                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1540                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1541                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1542                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1543                 }
1544         }
1545 
1546 rpn_out:
1547         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1548                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1549 
1550         return 0;
1551 }
1552 
1553 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1554 {
1555         struct rfcomm_rls *rls = (void *) skb->data;
1556         u8 dlci = __get_dlci(rls->dlci);
1557 
1558         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1559 
1560         if (!cr)
1561                 return 0;
1562 
1563         /* We should probably do something with this information here. But
1564          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1565          * mandatory to recognise and respond to RLS */
1566 
1567         rfcomm_send_rls(s, 0, dlci, rls->status);
1568 
1569         return 0;
1570 }
1571 
1572 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1573 {
1574         struct rfcomm_msc *msc = (void *) skb->data;
1575         struct rfcomm_dlc *d;
1576         u8 dlci = __get_dlci(msc->dlci);
1577 
1578         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1579 
1580         d = rfcomm_dlc_get(s, dlci);
1581         if (!d)
1582                 return 0;
1583 
1584         if (cr) {
1585                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1586                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1587                 else
1588                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1589 
1590                 rfcomm_dlc_lock(d);
1591 
1592                 d->remote_v24_sig = msc->v24_sig;
1593 
1594                 if (d->modem_status)
1595                         d->modem_status(d, msc->v24_sig);
1596 
1597                 rfcomm_dlc_unlock(d);
1598 
1599                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1600 
1601                 d->mscex |= RFCOMM_MSCEX_RX;
1602         } else
1603                 d->mscex |= RFCOMM_MSCEX_TX;
1604 
1605         return 0;
1606 }
1607 
1608 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1609 {
1610         struct rfcomm_mcc *mcc = (void *) skb->data;
1611         u8 type, cr, len;
1612 
1613         cr   = __test_cr(mcc->type);
1614         type = __get_mcc_type(mcc->type);
1615         len  = __get_mcc_len(mcc->len);
1616 
1617         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1618 
1619         skb_pull(skb, 2);
1620 
1621         switch (type) {
1622         case RFCOMM_PN:
1623                 rfcomm_recv_pn(s, cr, skb);
1624                 break;
1625 
1626         case RFCOMM_RPN:
1627                 rfcomm_recv_rpn(s, cr, len, skb);
1628                 break;
1629 
1630         case RFCOMM_RLS:
1631                 rfcomm_recv_rls(s, cr, skb);
1632                 break;
1633 
1634         case RFCOMM_MSC:
1635                 rfcomm_recv_msc(s, cr, skb);
1636                 break;
1637 
1638         case RFCOMM_FCOFF:
1639                 if (cr) {
1640                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1641                         rfcomm_send_fcoff(s, 0);
1642                 }
1643                 break;
1644 
1645         case RFCOMM_FCON:
1646                 if (cr) {
1647                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1648                         rfcomm_send_fcon(s, 0);
1649                 }
1650                 break;
1651 
1652         case RFCOMM_TEST:
1653                 if (cr)
1654                         rfcomm_send_test(s, 0, skb->data, skb->len);
1655                 break;
1656 
1657         case RFCOMM_NSC:
1658                 break;
1659 
1660         default:
1661                 BT_ERR("Unknown control type 0x%02x", type);
1662                 rfcomm_send_nsc(s, cr, type);
1663                 break;
1664         }
1665         return 0;
1666 }
1667 
1668 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1669 {
1670         struct rfcomm_dlc *d;
1671 
1672         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1673 
1674         d = rfcomm_dlc_get(s, dlci);
1675         if (!d) {
1676                 rfcomm_send_dm(s, dlci);
1677                 goto drop;
1678         }
1679 
1680         if (pf && d->cfc) {
1681                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1682 
1683                 d->tx_credits += credits;
1684                 if (d->tx_credits)
1685                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1686         }
1687 
1688         if (skb->len && d->state == BT_CONNECTED) {
1689                 rfcomm_dlc_lock(d);
1690                 d->rx_credits--;
1691                 d->data_ready(d, skb);
1692                 rfcomm_dlc_unlock(d);
1693                 return 0;
1694         }
1695 
1696 drop:
1697         kfree_skb(skb);
1698         return 0;
1699 }
1700 
1701 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1702                                                 struct sk_buff *skb)
1703 {
1704         struct rfcomm_hdr *hdr = (void *) skb->data;
1705         u8 type, dlci, fcs;
1706 
1707         if (!s) {
1708                 /* no session, so free socket data */
1709                 kfree_skb(skb);
1710                 return s;
1711         }
1712 
1713         dlci = __get_dlci(hdr->addr);
1714         type = __get_type(hdr->ctrl);
1715 
1716         /* Trim FCS */
1717         skb->len--; skb->tail--;
1718         fcs = *(u8 *)skb_tail_pointer(skb);
1719 
1720         if (__check_fcs(skb->data, type, fcs)) {
1721                 BT_ERR("bad checksum in packet");
1722                 kfree_skb(skb);
1723                 return s;
1724         }
1725 
1726         if (__test_ea(hdr->len))
1727                 skb_pull(skb, 3);
1728         else
1729                 skb_pull(skb, 4);
1730 
1731         switch (type) {
1732         case RFCOMM_SABM:
1733                 if (__test_pf(hdr->ctrl))
1734                         rfcomm_recv_sabm(s, dlci);
1735                 break;
1736 
1737         case RFCOMM_DISC:
1738                 if (__test_pf(hdr->ctrl))
1739                         s = rfcomm_recv_disc(s, dlci);
1740                 break;
1741 
1742         case RFCOMM_UA:
1743                 if (__test_pf(hdr->ctrl))
1744                         s = rfcomm_recv_ua(s, dlci);
1745                 break;
1746 
1747         case RFCOMM_DM:
1748                 s = rfcomm_recv_dm(s, dlci);
1749                 break;
1750 
1751         case RFCOMM_UIH:
1752                 if (dlci) {
1753                         rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1754                         return s;
1755                 }
1756                 rfcomm_recv_mcc(s, skb);
1757                 break;
1758 
1759         default:
1760                 BT_ERR("Unknown packet type 0x%02x", type);
1761                 break;
1762         }
1763         kfree_skb(skb);
1764         return s;
1765 }
1766 
1767 /* ---- Connection and data processing ---- */
1768 
1769 static void rfcomm_process_connect(struct rfcomm_session *s)
1770 {
1771         struct rfcomm_dlc *d;
1772         struct list_head *p, *n;
1773 
1774         BT_DBG("session %p state %ld", s, s->state);
1775 
1776         list_for_each_safe(p, n, &s->dlcs) {
1777                 d = list_entry(p, struct rfcomm_dlc, list);
1778                 if (d->state == BT_CONFIG) {
1779                         d->mtu = s->mtu;
1780                         if (rfcomm_check_security(d)) {
1781                                 rfcomm_send_pn(s, 1, d);
1782                         } else {
1783                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1784                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1785                         }
1786                 }
1787         }
1788 }
1789 
1790 /* Send data queued for the DLC.
1791  * Return number of frames left in the queue.
1792  */
1793 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1794 {
1795         struct sk_buff *skb;
1796         int err;
1797 
1798         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1799                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1800 
1801         /* Send pending MSC */
1802         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1803                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1804 
1805         if (d->cfc) {
1806                 /* CFC enabled.
1807                  * Give them some credits */
1808                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1809                                 d->rx_credits <= (d->cfc >> 2)) {
1810                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1811                         d->rx_credits = d->cfc;
1812                 }
1813         } else {
1814                 /* CFC disabled.
1815                  * Give ourselves some credits */
1816                 d->tx_credits = 5;
1817         }
1818 
1819         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1820                 return skb_queue_len(&d->tx_queue);
1821 
1822         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1823                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1824                 if (err < 0) {
1825                         skb_queue_head(&d->tx_queue, skb);
1826                         break;
1827                 }
1828                 kfree_skb(skb);
1829                 d->tx_credits--;
1830         }
1831 
1832         if (d->cfc && !d->tx_credits) {
1833                 /* We're out of TX credits.
1834                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1835                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1836         }
1837 
1838         return skb_queue_len(&d->tx_queue);
1839 }
1840 
1841 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1842 {
1843         struct rfcomm_dlc *d;
1844         struct list_head *p, *n;
1845 
1846         BT_DBG("session %p state %ld", s, s->state);
1847 
1848         list_for_each_safe(p, n, &s->dlcs) {
1849                 d = list_entry(p, struct rfcomm_dlc, list);
1850 
1851                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1852                         __rfcomm_dlc_close(d, ETIMEDOUT);
1853                         continue;
1854                 }
1855 
1856                 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1857                         __rfcomm_dlc_close(d, ECONNREFUSED);
1858                         continue;
1859                 }
1860 
1861                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1862                         rfcomm_dlc_clear_timer(d);
1863                         if (d->out) {
1864                                 rfcomm_send_pn(s, 1, d);
1865                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1866                         } else {
1867                                 if (d->defer_setup) {
1868                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1869                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1870 
1871                                         rfcomm_dlc_lock(d);
1872                                         d->state = BT_CONNECT2;
1873                                         d->state_change(d, 0);
1874                                         rfcomm_dlc_unlock(d);
1875                                 } else
1876                                         rfcomm_dlc_accept(d);
1877                         }
1878                         continue;
1879                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1880                         rfcomm_dlc_clear_timer(d);
1881                         if (!d->out)
1882                                 rfcomm_send_dm(s, d->dlci);
1883                         else
1884                                 d->state = BT_CLOSED;
1885                         __rfcomm_dlc_close(d, ECONNREFUSED);
1886                         continue;
1887                 }
1888 
1889                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1890                         continue;
1891 
1892                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1893                         continue;
1894 
1895                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1896                                                 d->mscex == RFCOMM_MSCEX_OK)
1897                         rfcomm_process_tx(d);
1898         }
1899 }
1900 
1901 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1902 {
1903         struct socket *sock = s->sock;
1904         struct sock *sk = sock->sk;
1905         struct sk_buff *skb;
1906 
1907         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1908 
1909         /* Get data directly from socket receive queue without copying it. */
1910         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1911                 skb_orphan(skb);
1912                 if (!skb_linearize(skb))
1913                         s = rfcomm_recv_frame(s, skb);
1914                 else
1915                         kfree_skb(skb);
1916         }
1917 
1918         if (s && (sk->sk_state == BT_CLOSED))
1919                 s = rfcomm_session_close(s, sk->sk_err);
1920 
1921         return s;
1922 }
1923 
1924 static void rfcomm_accept_connection(struct rfcomm_session *s)
1925 {
1926         struct socket *sock = s->sock, *nsock;
1927         int err;
1928 
1929         /* Fast check for a new connection.
1930          * Avoids unnesesary socket allocations. */
1931         if (list_empty(&bt_sk(sock->sk)->accept_q))
1932                 return;
1933 
1934         BT_DBG("session %p", s);
1935 
1936         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1937         if (err < 0)
1938                 return;
1939 
1940         /* Set our callbacks */
1941         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1942         nsock->sk->sk_state_change = rfcomm_l2state_change;
1943 
1944         s = rfcomm_session_add(nsock, BT_OPEN);
1945         if (s) {
1946                 /* We should adjust MTU on incoming sessions.
1947                  * L2CAP MTU minus UIH header and FCS. */
1948                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1949                                 l2cap_pi(nsock->sk)->chan->imtu) - 5;
1950 
1951                 rfcomm_schedule();
1952         } else
1953                 sock_release(nsock);
1954 }
1955 
1956 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1957 {
1958         struct sock *sk = s->sock->sk;
1959 
1960         BT_DBG("%p state %ld", s, s->state);
1961 
1962         switch (sk->sk_state) {
1963         case BT_CONNECTED:
1964                 s->state = BT_CONNECT;
1965 
1966                 /* We can adjust MTU on outgoing sessions.
1967                  * L2CAP MTU minus UIH header and FCS. */
1968                 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1969 
1970                 rfcomm_send_sabm(s, 0);
1971                 break;
1972 
1973         case BT_CLOSED:
1974                 s = rfcomm_session_close(s, sk->sk_err);
1975                 break;
1976         }
1977         return s;
1978 }
1979 
1980 static void rfcomm_process_sessions(void)
1981 {
1982         struct list_head *p, *n;
1983 
1984         rfcomm_lock();
1985 
1986         list_for_each_safe(p, n, &session_list) {
1987                 struct rfcomm_session *s;
1988                 s = list_entry(p, struct rfcomm_session, list);
1989 
1990                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1991                         s->state = BT_DISCONN;
1992                         rfcomm_send_disc(s, 0);
1993                         continue;
1994                 }
1995 
1996                 switch (s->state) {
1997                 case BT_LISTEN:
1998                         rfcomm_accept_connection(s);
1999                         continue;
2000 
2001                 case BT_BOUND:
2002                         s = rfcomm_check_connection(s);
2003                         break;
2004 
2005                 default:
2006                         s = rfcomm_process_rx(s);
2007                         break;
2008                 }
2009 
2010                 if (s)
2011                         rfcomm_process_dlcs(s);
2012         }
2013 
2014         rfcomm_unlock();
2015 }
2016 
2017 static int rfcomm_add_listener(bdaddr_t *ba)
2018 {
2019         struct sockaddr_l2 addr;
2020         struct socket *sock;
2021         struct sock *sk;
2022         struct rfcomm_session *s;
2023         int    err = 0;
2024 
2025         /* Create socket */
2026         err = rfcomm_l2sock_create(&sock);
2027         if (err < 0) {
2028                 BT_ERR("Create socket failed %d", err);
2029                 return err;
2030         }
2031 
2032         /* Bind socket */
2033         bacpy(&addr.l2_bdaddr, ba);
2034         addr.l2_family = AF_BLUETOOTH;
2035         addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
2036         addr.l2_cid    = 0;
2037         addr.l2_bdaddr_type = BDADDR_BREDR;
2038         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
2039         if (err < 0) {
2040                 BT_ERR("Bind failed %d", err);
2041                 goto failed;
2042         }
2043 
2044         /* Set L2CAP options */
2045         sk = sock->sk;
2046         lock_sock(sk);
2047         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2048         release_sock(sk);
2049 
2050         /* Start listening on the socket */
2051         err = kernel_listen(sock, 10);
2052         if (err) {
2053                 BT_ERR("Listen failed %d", err);
2054                 goto failed;
2055         }
2056 
2057         /* Add listening session */
2058         s = rfcomm_session_add(sock, BT_LISTEN);
2059         if (!s) {
2060                 err = -ENOMEM;
2061                 goto failed;
2062         }
2063 
2064         return 0;
2065 failed:
2066         sock_release(sock);
2067         return err;
2068 }
2069 
2070 static void rfcomm_kill_listener(void)
2071 {
2072         struct rfcomm_session *s;
2073         struct list_head *p, *n;
2074 
2075         BT_DBG("");
2076 
2077         list_for_each_safe(p, n, &session_list) {
2078                 s = list_entry(p, struct rfcomm_session, list);
2079                 rfcomm_session_del(s);
2080         }
2081 }
2082 
2083 static int rfcomm_run(void *unused)
2084 {
2085         BT_DBG("");
2086 
2087         set_user_nice(current, -10);
2088 
2089         rfcomm_add_listener(BDADDR_ANY);
2090 
2091         while (1) {
2092                 set_current_state(TASK_INTERRUPTIBLE);
2093 
2094                 if (kthread_should_stop())
2095                         break;
2096 
2097                 /* Process stuff */
2098                 rfcomm_process_sessions();
2099 
2100                 schedule();
2101         }
2102         __set_current_state(TASK_RUNNING);
2103 
2104         rfcomm_kill_listener();
2105 
2106         return 0;
2107 }
2108 
2109 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2110 {
2111         struct rfcomm_session *s;
2112         struct rfcomm_dlc *d;
2113         struct list_head *p, *n;
2114 
2115         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2116 
2117         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2118         if (!s)
2119                 return;
2120 
2121         list_for_each_safe(p, n, &s->dlcs) {
2122                 d = list_entry(p, struct rfcomm_dlc, list);
2123 
2124                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2125                         rfcomm_dlc_clear_timer(d);
2126                         if (status || encrypt == 0x00) {
2127                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2128                                 continue;
2129                         }
2130                 }
2131 
2132                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2133                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2134                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2135                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2136                                 continue;
2137                         } else if (d->sec_level == BT_SECURITY_HIGH ||
2138                                    d->sec_level == BT_SECURITY_FIPS) {
2139                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2140                                 continue;
2141                         }
2142                 }
2143 
2144                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2145                         continue;
2146 
2147                 if (!status && hci_conn_check_secure(conn, d->sec_level))
2148                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2149                 else
2150                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2151         }
2152 
2153         rfcomm_schedule();
2154 }
2155 
2156 static struct hci_cb rfcomm_cb = {
2157         .name           = "RFCOMM",
2158         .security_cfm   = rfcomm_security_cfm
2159 };
2160 
2161 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2162 {
2163         struct rfcomm_session *s;
2164 
2165         rfcomm_lock();
2166 
2167         list_for_each_entry(s, &session_list, list) {
2168                 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2169                 struct rfcomm_dlc *d;
2170                 list_for_each_entry(d, &s->dlcs, list) {
2171                         seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2172                                    &chan->src, &chan->dst,
2173                                    d->state, d->dlci, d->mtu,
2174                                    d->rx_credits, d->tx_credits);
2175                 }
2176         }
2177 
2178         rfcomm_unlock();
2179 
2180         return 0;
2181 }
2182 
2183 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2184 {
2185         return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2186 }
2187 
2188 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2189         .open           = rfcomm_dlc_debugfs_open,
2190         .read           = seq_read,
2191         .llseek         = seq_lseek,
2192         .release        = single_release,
2193 };
2194 
2195 static struct dentry *rfcomm_dlc_debugfs;
2196 
2197 /* ---- Initialization ---- */
2198 static int __init rfcomm_init(void)
2199 {
2200         int err;
2201 
2202         hci_register_cb(&rfcomm_cb);
2203 
2204         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2205         if (IS_ERR(rfcomm_thread)) {
2206                 err = PTR_ERR(rfcomm_thread);
2207                 goto unregister;
2208         }
2209 
2210         err = rfcomm_init_ttys();
2211         if (err < 0)
2212                 goto stop;
2213 
2214         err = rfcomm_init_sockets();
2215         if (err < 0)
2216                 goto cleanup;
2217 
2218         BT_INFO("RFCOMM ver %s", VERSION);
2219 
2220         if (IS_ERR_OR_NULL(bt_debugfs))
2221                 return 0;
2222 
2223         rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2224                                                  bt_debugfs, NULL,
2225                                                  &rfcomm_dlc_debugfs_fops);
2226 
2227         return 0;
2228 
2229 cleanup:
2230         rfcomm_cleanup_ttys();
2231 
2232 stop:
2233         kthread_stop(rfcomm_thread);
2234 
2235 unregister:
2236         hci_unregister_cb(&rfcomm_cb);
2237 
2238         return err;
2239 }
2240 
2241 static void __exit rfcomm_exit(void)
2242 {
2243         debugfs_remove(rfcomm_dlc_debugfs);
2244 
2245         hci_unregister_cb(&rfcomm_cb);
2246 
2247         kthread_stop(rfcomm_thread);
2248 
2249         rfcomm_cleanup_ttys();
2250 
2251         rfcomm_cleanup_sockets();
2252 }
2253 
2254 module_init(rfcomm_init);
2255 module_exit(rfcomm_exit);
2256 
2257 module_param(disable_cfc, bool, 0644);
2258 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2259 
2260 module_param(channel_mtu, int, 0644);
2261 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2262 
2263 module_param(l2cap_mtu, uint, 0644);
2264 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2265 
2266 module_param(l2cap_ertm, bool, 0644);
2267 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2268 
2269 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2270 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2271 MODULE_VERSION(VERSION);
2272 MODULE_LICENSE("GPL");
2273 MODULE_ALIAS("bt-proto-3");
2274 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us