Version:  2.0.40 2.2.26 2.4.37 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 4.0

Linux/net/bluetooth/rfcomm/core.c

  1 /*
  2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
  3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
  4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
  5 
  6    This program is free software; you can redistribute it and/or modify
  7    it under the terms of the GNU General Public License version 2 as
  8    published by the Free Software Foundation;
  9 
 10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
 13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
 14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
 15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 18 
 19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
 20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
 21    SOFTWARE IS DISCLAIMED.
 22 */
 23 
 24 /*
 25  * Bluetooth RFCOMM core.
 26  */
 27 
 28 #include <linux/module.h>
 29 #include <linux/debugfs.h>
 30 #include <linux/kthread.h>
 31 #include <asm/unaligned.h>
 32 
 33 #include <net/bluetooth/bluetooth.h>
 34 #include <net/bluetooth/hci_core.h>
 35 #include <net/bluetooth/l2cap.h>
 36 #include <net/bluetooth/rfcomm.h>
 37 
 38 #define VERSION "1.11"
 39 
 40 static bool disable_cfc;
 41 static bool l2cap_ertm;
 42 static int channel_mtu = -1;
 43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
 44 
 45 static struct task_struct *rfcomm_thread;
 46 
 47 static DEFINE_MUTEX(rfcomm_mutex);
 48 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
 49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
 50 
 51 
 52 static LIST_HEAD(session_list);
 53 
 54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
 55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
 56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
 57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
 58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
 59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
 60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
 61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
 62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
 63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
 64 
 65 static void rfcomm_process_connect(struct rfcomm_session *s);
 66 
 67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 68                                                         bdaddr_t *dst,
 69                                                         u8 sec_level,
 70                                                         int *err);
 71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
 72 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
 73 
 74 /* ---- RFCOMM frame parsing macros ---- */
 75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
 76 #define __get_channel(b)  ((b & 0xf8) >> 3)
 77 #define __get_dir(b)      ((b & 0x04) >> 2)
 78 #define __get_type(b)     ((b & 0xef))
 79 
 80 #define __test_ea(b)      ((b & 0x01))
 81 #define __test_cr(b)      (!!(b & 0x02))
 82 #define __test_pf(b)      (!!(b & 0x10))
 83 
 84 #define __session_dir(s)  ((s)->initiator ? 0x00 : 0x01)
 85 
 86 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 87 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
 88 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
 89 #define __srv_channel(dlci)    (dlci >> 1)
 90 #define __dir(dlci)            (dlci & 0x01)
 91 
 92 #define __len8(len)       (((len) << 1) | 1)
 93 #define __len16(len)      ((len) << 1)
 94 
 95 /* MCC macros */
 96 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 97 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 98 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 99 
100 /* RPN macros */
101 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
102 #define __get_rpn_data_bits(line) ((line) & 0x3)
103 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
104 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
105 
106 static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
107 
108 static void rfcomm_schedule(void)
109 {
110         wake_up_all(&rfcomm_wq);
111 }
112 
113 /* ---- RFCOMM FCS computation ---- */
114 
115 /* reversed, 8-bit, poly=0x07 */
116 static unsigned char rfcomm_crc_table[256] = {
117         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
118         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
119         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
120         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
121 
122         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
123         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
124         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
125         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
126 
127         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
128         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
129         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
130         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
131 
132         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
133         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
134         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
135         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
136 
137         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
138         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
139         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
140         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
141 
142         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
143         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
144         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
145         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
146 
147         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
148         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
149         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
150         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
151 
152         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
153         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
154         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
155         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
156 };
157 
158 /* CRC on 2 bytes */
159 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
160 
161 /* FCS on 2 bytes */
162 static inline u8 __fcs(u8 *data)
163 {
164         return 0xff - __crc(data);
165 }
166 
167 /* FCS on 3 bytes */
168 static inline u8 __fcs2(u8 *data)
169 {
170         return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
171 }
172 
173 /* Check FCS */
174 static inline int __check_fcs(u8 *data, int type, u8 fcs)
175 {
176         u8 f = __crc(data);
177 
178         if (type != RFCOMM_UIH)
179                 f = rfcomm_crc_table[f ^ data[2]];
180 
181         return rfcomm_crc_table[f ^ fcs] != 0xcf;
182 }
183 
184 /* ---- L2CAP callbacks ---- */
185 static void rfcomm_l2state_change(struct sock *sk)
186 {
187         BT_DBG("%p state %d", sk, sk->sk_state);
188         rfcomm_schedule();
189 }
190 
191 static void rfcomm_l2data_ready(struct sock *sk)
192 {
193         BT_DBG("%p", sk);
194         rfcomm_schedule();
195 }
196 
197 static int rfcomm_l2sock_create(struct socket **sock)
198 {
199         int err;
200 
201         BT_DBG("");
202 
203         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
204         if (!err) {
205                 struct sock *sk = (*sock)->sk;
206                 sk->sk_data_ready   = rfcomm_l2data_ready;
207                 sk->sk_state_change = rfcomm_l2state_change;
208         }
209         return err;
210 }
211 
212 static int rfcomm_check_security(struct rfcomm_dlc *d)
213 {
214         struct sock *sk = d->session->sock->sk;
215         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
216 
217         __u8 auth_type;
218 
219         switch (d->sec_level) {
220         case BT_SECURITY_HIGH:
221         case BT_SECURITY_FIPS:
222                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
223                 break;
224         case BT_SECURITY_MEDIUM:
225                 auth_type = HCI_AT_GENERAL_BONDING;
226                 break;
227         default:
228                 auth_type = HCI_AT_NO_BONDING;
229                 break;
230         }
231 
232         return hci_conn_security(conn->hcon, d->sec_level, auth_type,
233                                  d->out);
234 }
235 
236 static void rfcomm_session_timeout(unsigned long arg)
237 {
238         struct rfcomm_session *s = (void *) arg;
239 
240         BT_DBG("session %p state %ld", s, s->state);
241 
242         set_bit(RFCOMM_TIMED_OUT, &s->flags);
243         rfcomm_schedule();
244 }
245 
246 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
247 {
248         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
249 
250         mod_timer(&s->timer, jiffies + timeout);
251 }
252 
253 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
254 {
255         BT_DBG("session %p state %ld", s, s->state);
256 
257         del_timer_sync(&s->timer);
258 }
259 
260 /* ---- RFCOMM DLCs ---- */
261 static void rfcomm_dlc_timeout(unsigned long arg)
262 {
263         struct rfcomm_dlc *d = (void *) arg;
264 
265         BT_DBG("dlc %p state %ld", d, d->state);
266 
267         set_bit(RFCOMM_TIMED_OUT, &d->flags);
268         rfcomm_dlc_put(d);
269         rfcomm_schedule();
270 }
271 
272 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
273 {
274         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
275 
276         if (!mod_timer(&d->timer, jiffies + timeout))
277                 rfcomm_dlc_hold(d);
278 }
279 
280 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
281 {
282         BT_DBG("dlc %p state %ld", d, d->state);
283 
284         if (del_timer(&d->timer))
285                 rfcomm_dlc_put(d);
286 }
287 
288 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
289 {
290         BT_DBG("%p", d);
291 
292         d->state      = BT_OPEN;
293         d->flags      = 0;
294         d->mscex      = 0;
295         d->sec_level  = BT_SECURITY_LOW;
296         d->mtu        = RFCOMM_DEFAULT_MTU;
297         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
298 
299         d->cfc        = RFCOMM_CFC_DISABLED;
300         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
301 }
302 
303 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
304 {
305         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
306 
307         if (!d)
308                 return NULL;
309 
310         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
311 
312         skb_queue_head_init(&d->tx_queue);
313         mutex_init(&d->lock);
314         atomic_set(&d->refcnt, 1);
315 
316         rfcomm_dlc_clear_state(d);
317 
318         BT_DBG("%p", d);
319 
320         return d;
321 }
322 
323 void rfcomm_dlc_free(struct rfcomm_dlc *d)
324 {
325         BT_DBG("%p", d);
326 
327         skb_queue_purge(&d->tx_queue);
328         kfree(d);
329 }
330 
331 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
332 {
333         BT_DBG("dlc %p session %p", d, s);
334 
335         rfcomm_session_clear_timer(s);
336         rfcomm_dlc_hold(d);
337         list_add(&d->list, &s->dlcs);
338         d->session = s;
339 }
340 
341 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
342 {
343         struct rfcomm_session *s = d->session;
344 
345         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
346 
347         list_del(&d->list);
348         d->session = NULL;
349         rfcomm_dlc_put(d);
350 
351         if (list_empty(&s->dlcs))
352                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
353 }
354 
355 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
356 {
357         struct rfcomm_dlc *d;
358 
359         list_for_each_entry(d, &s->dlcs, list)
360                 if (d->dlci == dlci)
361                         return d;
362 
363         return NULL;
364 }
365 
366 static int rfcomm_check_channel(u8 channel)
367 {
368         return channel < 1 || channel > 30;
369 }
370 
371 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
372 {
373         struct rfcomm_session *s;
374         int err = 0;
375         u8 dlci;
376 
377         BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
378                d, d->state, src, dst, channel);
379 
380         if (rfcomm_check_channel(channel))
381                 return -EINVAL;
382 
383         if (d->state != BT_OPEN && d->state != BT_CLOSED)
384                 return 0;
385 
386         s = rfcomm_session_get(src, dst);
387         if (!s) {
388                 s = rfcomm_session_create(src, dst, d->sec_level, &err);
389                 if (!s)
390                         return err;
391         }
392 
393         dlci = __dlci(__session_dir(s), channel);
394 
395         /* Check if DLCI already exists */
396         if (rfcomm_dlc_get(s, dlci))
397                 return -EBUSY;
398 
399         rfcomm_dlc_clear_state(d);
400 
401         d->dlci     = dlci;
402         d->addr     = __addr(s->initiator, dlci);
403         d->priority = 7;
404 
405         d->state = BT_CONFIG;
406         rfcomm_dlc_link(s, d);
407 
408         d->out = 1;
409 
410         d->mtu = s->mtu;
411         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
412 
413         if (s->state == BT_CONNECTED) {
414                 if (rfcomm_check_security(d))
415                         rfcomm_send_pn(s, 1, d);
416                 else
417                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
418         }
419 
420         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
421 
422         return 0;
423 }
424 
425 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
426 {
427         int r;
428 
429         rfcomm_lock();
430 
431         r = __rfcomm_dlc_open(d, src, dst, channel);
432 
433         rfcomm_unlock();
434         return r;
435 }
436 
437 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
438 {
439         struct rfcomm_session *s = d->session;
440 
441         d->state = BT_DISCONN;
442         if (skb_queue_empty(&d->tx_queue)) {
443                 rfcomm_send_disc(s, d->dlci);
444                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
445         } else {
446                 rfcomm_queue_disc(d);
447                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
448         }
449 }
450 
451 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
452 {
453         struct rfcomm_session *s = d->session;
454         if (!s)
455                 return 0;
456 
457         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
458                         d, d->state, d->dlci, err, s);
459 
460         switch (d->state) {
461         case BT_CONNECT:
462         case BT_CONFIG:
463         case BT_OPEN:
464         case BT_CONNECT2:
465                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
466                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
467                         rfcomm_schedule();
468                         return 0;
469                 }
470         }
471 
472         switch (d->state) {
473         case BT_CONNECT:
474         case BT_CONNECTED:
475                 __rfcomm_dlc_disconn(d);
476                 break;
477 
478         case BT_CONFIG:
479                 if (s->state != BT_BOUND) {
480                         __rfcomm_dlc_disconn(d);
481                         break;
482                 }
483                 /* if closing a dlc in a session that hasn't been started,
484                  * just close and unlink the dlc
485                  */
486 
487         default:
488                 rfcomm_dlc_clear_timer(d);
489 
490                 rfcomm_dlc_lock(d);
491                 d->state = BT_CLOSED;
492                 d->state_change(d, err);
493                 rfcomm_dlc_unlock(d);
494 
495                 skb_queue_purge(&d->tx_queue);
496                 rfcomm_dlc_unlink(d);
497         }
498 
499         return 0;
500 }
501 
502 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
503 {
504         int r = 0;
505         struct rfcomm_dlc *d_list;
506         struct rfcomm_session *s, *s_list;
507 
508         BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
509 
510         rfcomm_lock();
511 
512         s = d->session;
513         if (!s)
514                 goto no_session;
515 
516         /* after waiting on the mutex check the session still exists
517          * then check the dlc still exists
518          */
519         list_for_each_entry(s_list, &session_list, list) {
520                 if (s_list == s) {
521                         list_for_each_entry(d_list, &s->dlcs, list) {
522                                 if (d_list == d) {
523                                         r = __rfcomm_dlc_close(d, err);
524                                         break;
525                                 }
526                         }
527                         break;
528                 }
529         }
530 
531 no_session:
532         rfcomm_unlock();
533         return r;
534 }
535 
536 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
537 {
538         struct rfcomm_session *s;
539         struct rfcomm_dlc *dlc = NULL;
540         u8 dlci;
541 
542         if (rfcomm_check_channel(channel))
543                 return ERR_PTR(-EINVAL);
544 
545         rfcomm_lock();
546         s = rfcomm_session_get(src, dst);
547         if (s) {
548                 dlci = __dlci(__session_dir(s), channel);
549                 dlc = rfcomm_dlc_get(s, dlci);
550         }
551         rfcomm_unlock();
552         return dlc;
553 }
554 
555 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
556 {
557         int len = skb->len;
558 
559         if (d->state != BT_CONNECTED)
560                 return -ENOTCONN;
561 
562         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
563 
564         if (len > d->mtu)
565                 return -EINVAL;
566 
567         rfcomm_make_uih(skb, d->addr);
568         skb_queue_tail(&d->tx_queue, skb);
569 
570         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
571                 rfcomm_schedule();
572         return len;
573 }
574 
575 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
576 {
577         int len = skb->len;
578 
579         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
580 
581         rfcomm_make_uih(skb, d->addr);
582         skb_queue_tail(&d->tx_queue, skb);
583 
584         if (d->state == BT_CONNECTED &&
585             !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
586                 rfcomm_schedule();
587 }
588 
589 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
590 {
591         BT_DBG("dlc %p state %ld", d, d->state);
592 
593         if (!d->cfc) {
594                 d->v24_sig |= RFCOMM_V24_FC;
595                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
596         }
597         rfcomm_schedule();
598 }
599 
600 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
601 {
602         BT_DBG("dlc %p state %ld", d, d->state);
603 
604         if (!d->cfc) {
605                 d->v24_sig &= ~RFCOMM_V24_FC;
606                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
607         }
608         rfcomm_schedule();
609 }
610 
611 /*
612    Set/get modem status functions use _local_ status i.e. what we report
613    to the other side.
614    Remote status is provided by dlc->modem_status() callback.
615  */
616 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
617 {
618         BT_DBG("dlc %p state %ld v24_sig 0x%x",
619                         d, d->state, v24_sig);
620 
621         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
622                 v24_sig |= RFCOMM_V24_FC;
623         else
624                 v24_sig &= ~RFCOMM_V24_FC;
625 
626         d->v24_sig = v24_sig;
627 
628         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
629                 rfcomm_schedule();
630 
631         return 0;
632 }
633 
634 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
635 {
636         BT_DBG("dlc %p state %ld v24_sig 0x%x",
637                         d, d->state, d->v24_sig);
638 
639         *v24_sig = d->v24_sig;
640         return 0;
641 }
642 
643 /* ---- RFCOMM sessions ---- */
644 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
645 {
646         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
647 
648         if (!s)
649                 return NULL;
650 
651         BT_DBG("session %p sock %p", s, sock);
652 
653         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
654 
655         INIT_LIST_HEAD(&s->dlcs);
656         s->state = state;
657         s->sock  = sock;
658 
659         s->mtu = RFCOMM_DEFAULT_MTU;
660         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
661 
662         /* Do not increment module usage count for listening sessions.
663          * Otherwise we won't be able to unload the module. */
664         if (state != BT_LISTEN)
665                 if (!try_module_get(THIS_MODULE)) {
666                         kfree(s);
667                         return NULL;
668                 }
669 
670         list_add(&s->list, &session_list);
671 
672         return s;
673 }
674 
675 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
676 {
677         int state = s->state;
678 
679         BT_DBG("session %p state %ld", s, s->state);
680 
681         list_del(&s->list);
682 
683         rfcomm_session_clear_timer(s);
684         sock_release(s->sock);
685         kfree(s);
686 
687         if (state != BT_LISTEN)
688                 module_put(THIS_MODULE);
689 
690         return NULL;
691 }
692 
693 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
694 {
695         struct rfcomm_session *s;
696         struct list_head *p, *n;
697         struct l2cap_chan *chan;
698         list_for_each_safe(p, n, &session_list) {
699                 s = list_entry(p, struct rfcomm_session, list);
700                 chan = l2cap_pi(s->sock->sk)->chan;
701 
702                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
703                     !bacmp(&chan->dst, dst))
704                         return s;
705         }
706         return NULL;
707 }
708 
709 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
710                                                    int err)
711 {
712         struct rfcomm_dlc *d;
713         struct list_head *p, *n;
714 
715         s->state = BT_CLOSED;
716 
717         BT_DBG("session %p state %ld err %d", s, s->state, err);
718 
719         /* Close all dlcs */
720         list_for_each_safe(p, n, &s->dlcs) {
721                 d = list_entry(p, struct rfcomm_dlc, list);
722                 d->state = BT_CLOSED;
723                 __rfcomm_dlc_close(d, err);
724         }
725 
726         rfcomm_session_clear_timer(s);
727         return rfcomm_session_del(s);
728 }
729 
730 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
731                                                         bdaddr_t *dst,
732                                                         u8 sec_level,
733                                                         int *err)
734 {
735         struct rfcomm_session *s = NULL;
736         struct sockaddr_l2 addr;
737         struct socket *sock;
738         struct sock *sk;
739 
740         BT_DBG("%pMR -> %pMR", src, dst);
741 
742         *err = rfcomm_l2sock_create(&sock);
743         if (*err < 0)
744                 return NULL;
745 
746         bacpy(&addr.l2_bdaddr, src);
747         addr.l2_family = AF_BLUETOOTH;
748         addr.l2_psm    = 0;
749         addr.l2_cid    = 0;
750         addr.l2_bdaddr_type = BDADDR_BREDR;
751         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
752         if (*err < 0)
753                 goto failed;
754 
755         /* Set L2CAP options */
756         sk = sock->sk;
757         lock_sock(sk);
758         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
759         l2cap_pi(sk)->chan->sec_level = sec_level;
760         if (l2cap_ertm)
761                 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
762         release_sock(sk);
763 
764         s = rfcomm_session_add(sock, BT_BOUND);
765         if (!s) {
766                 *err = -ENOMEM;
767                 goto failed;
768         }
769 
770         s->initiator = 1;
771 
772         bacpy(&addr.l2_bdaddr, dst);
773         addr.l2_family = AF_BLUETOOTH;
774         addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
775         addr.l2_cid    = 0;
776         addr.l2_bdaddr_type = BDADDR_BREDR;
777         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
778         if (*err == 0 || *err == -EINPROGRESS)
779                 return s;
780 
781         return rfcomm_session_del(s);
782 
783 failed:
784         sock_release(sock);
785         return NULL;
786 }
787 
788 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
789 {
790         struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
791         if (src)
792                 bacpy(src, &chan->src);
793         if (dst)
794                 bacpy(dst, &chan->dst);
795 }
796 
797 /* ---- RFCOMM frame sending ---- */
798 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
799 {
800         struct kvec iv = { data, len };
801         struct msghdr msg;
802 
803         BT_DBG("session %p len %d", s, len);
804 
805         memset(&msg, 0, sizeof(msg));
806 
807         return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
808 }
809 
810 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
811 {
812         BT_DBG("%p cmd %u", s, cmd->ctrl);
813 
814         return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
815 }
816 
817 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
818 {
819         struct rfcomm_cmd cmd;
820 
821         BT_DBG("%p dlci %d", s, dlci);
822 
823         cmd.addr = __addr(s->initiator, dlci);
824         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
825         cmd.len  = __len8(0);
826         cmd.fcs  = __fcs2((u8 *) &cmd);
827 
828         return rfcomm_send_cmd(s, &cmd);
829 }
830 
831 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
832 {
833         struct rfcomm_cmd cmd;
834 
835         BT_DBG("%p dlci %d", s, dlci);
836 
837         cmd.addr = __addr(!s->initiator, dlci);
838         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
839         cmd.len  = __len8(0);
840         cmd.fcs  = __fcs2((u8 *) &cmd);
841 
842         return rfcomm_send_cmd(s, &cmd);
843 }
844 
845 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
846 {
847         struct rfcomm_cmd cmd;
848 
849         BT_DBG("%p dlci %d", s, dlci);
850 
851         cmd.addr = __addr(s->initiator, dlci);
852         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
853         cmd.len  = __len8(0);
854         cmd.fcs  = __fcs2((u8 *) &cmd);
855 
856         return rfcomm_send_cmd(s, &cmd);
857 }
858 
859 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
860 {
861         struct rfcomm_cmd *cmd;
862         struct sk_buff *skb;
863 
864         BT_DBG("dlc %p dlci %d", d, d->dlci);
865 
866         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
867         if (!skb)
868                 return -ENOMEM;
869 
870         cmd = (void *) __skb_put(skb, sizeof(*cmd));
871         cmd->addr = d->addr;
872         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
873         cmd->len  = __len8(0);
874         cmd->fcs  = __fcs2((u8 *) cmd);
875 
876         skb_queue_tail(&d->tx_queue, skb);
877         rfcomm_schedule();
878         return 0;
879 }
880 
881 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
882 {
883         struct rfcomm_cmd cmd;
884 
885         BT_DBG("%p dlci %d", s, dlci);
886 
887         cmd.addr = __addr(!s->initiator, dlci);
888         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
889         cmd.len  = __len8(0);
890         cmd.fcs  = __fcs2((u8 *) &cmd);
891 
892         return rfcomm_send_cmd(s, &cmd);
893 }
894 
895 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
896 {
897         struct rfcomm_hdr *hdr;
898         struct rfcomm_mcc *mcc;
899         u8 buf[16], *ptr = buf;
900 
901         BT_DBG("%p cr %d type %d", s, cr, type);
902 
903         hdr = (void *) ptr; ptr += sizeof(*hdr);
904         hdr->addr = __addr(s->initiator, 0);
905         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
906         hdr->len  = __len8(sizeof(*mcc) + 1);
907 
908         mcc = (void *) ptr; ptr += sizeof(*mcc);
909         mcc->type = __mcc_type(0, RFCOMM_NSC);
910         mcc->len  = __len8(1);
911 
912         /* Type that we didn't like */
913         *ptr = __mcc_type(cr, type); ptr++;
914 
915         *ptr = __fcs(buf); ptr++;
916 
917         return rfcomm_send_frame(s, buf, ptr - buf);
918 }
919 
920 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
921 {
922         struct rfcomm_hdr *hdr;
923         struct rfcomm_mcc *mcc;
924         struct rfcomm_pn  *pn;
925         u8 buf[16], *ptr = buf;
926 
927         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
928 
929         hdr = (void *) ptr; ptr += sizeof(*hdr);
930         hdr->addr = __addr(s->initiator, 0);
931         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
932         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
933 
934         mcc = (void *) ptr; ptr += sizeof(*mcc);
935         mcc->type = __mcc_type(cr, RFCOMM_PN);
936         mcc->len  = __len8(sizeof(*pn));
937 
938         pn = (void *) ptr; ptr += sizeof(*pn);
939         pn->dlci        = d->dlci;
940         pn->priority    = d->priority;
941         pn->ack_timer   = 0;
942         pn->max_retrans = 0;
943 
944         if (s->cfc) {
945                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
946                 pn->credits = RFCOMM_DEFAULT_CREDITS;
947         } else {
948                 pn->flow_ctrl = 0;
949                 pn->credits   = 0;
950         }
951 
952         if (cr && channel_mtu >= 0)
953                 pn->mtu = cpu_to_le16(channel_mtu);
954         else
955                 pn->mtu = cpu_to_le16(d->mtu);
956 
957         *ptr = __fcs(buf); ptr++;
958 
959         return rfcomm_send_frame(s, buf, ptr - buf);
960 }
961 
962 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
963                         u8 bit_rate, u8 data_bits, u8 stop_bits,
964                         u8 parity, u8 flow_ctrl_settings,
965                         u8 xon_char, u8 xoff_char, u16 param_mask)
966 {
967         struct rfcomm_hdr *hdr;
968         struct rfcomm_mcc *mcc;
969         struct rfcomm_rpn *rpn;
970         u8 buf[16], *ptr = buf;
971 
972         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
973                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
974                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
975                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
976 
977         hdr = (void *) ptr; ptr += sizeof(*hdr);
978         hdr->addr = __addr(s->initiator, 0);
979         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
980         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
981 
982         mcc = (void *) ptr; ptr += sizeof(*mcc);
983         mcc->type = __mcc_type(cr, RFCOMM_RPN);
984         mcc->len  = __len8(sizeof(*rpn));
985 
986         rpn = (void *) ptr; ptr += sizeof(*rpn);
987         rpn->dlci          = __addr(1, dlci);
988         rpn->bit_rate      = bit_rate;
989         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
990         rpn->flow_ctrl     = flow_ctrl_settings;
991         rpn->xon_char      = xon_char;
992         rpn->xoff_char     = xoff_char;
993         rpn->param_mask    = cpu_to_le16(param_mask);
994 
995         *ptr = __fcs(buf); ptr++;
996 
997         return rfcomm_send_frame(s, buf, ptr - buf);
998 }
999 
1000 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
1001 {
1002         struct rfcomm_hdr *hdr;
1003         struct rfcomm_mcc *mcc;
1004         struct rfcomm_rls *rls;
1005         u8 buf[16], *ptr = buf;
1006 
1007         BT_DBG("%p cr %d status 0x%x", s, cr, status);
1008 
1009         hdr = (void *) ptr; ptr += sizeof(*hdr);
1010         hdr->addr = __addr(s->initiator, 0);
1011         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1012         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
1013 
1014         mcc = (void *) ptr; ptr += sizeof(*mcc);
1015         mcc->type = __mcc_type(cr, RFCOMM_RLS);
1016         mcc->len  = __len8(sizeof(*rls));
1017 
1018         rls = (void *) ptr; ptr += sizeof(*rls);
1019         rls->dlci   = __addr(1, dlci);
1020         rls->status = status;
1021 
1022         *ptr = __fcs(buf); ptr++;
1023 
1024         return rfcomm_send_frame(s, buf, ptr - buf);
1025 }
1026 
1027 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1028 {
1029         struct rfcomm_hdr *hdr;
1030         struct rfcomm_mcc *mcc;
1031         struct rfcomm_msc *msc;
1032         u8 buf[16], *ptr = buf;
1033 
1034         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1035 
1036         hdr = (void *) ptr; ptr += sizeof(*hdr);
1037         hdr->addr = __addr(s->initiator, 0);
1038         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1039         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
1040 
1041         mcc = (void *) ptr; ptr += sizeof(*mcc);
1042         mcc->type = __mcc_type(cr, RFCOMM_MSC);
1043         mcc->len  = __len8(sizeof(*msc));
1044 
1045         msc = (void *) ptr; ptr += sizeof(*msc);
1046         msc->dlci    = __addr(1, dlci);
1047         msc->v24_sig = v24_sig | 0x01;
1048 
1049         *ptr = __fcs(buf); ptr++;
1050 
1051         return rfcomm_send_frame(s, buf, ptr - buf);
1052 }
1053 
1054 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1055 {
1056         struct rfcomm_hdr *hdr;
1057         struct rfcomm_mcc *mcc;
1058         u8 buf[16], *ptr = buf;
1059 
1060         BT_DBG("%p cr %d", s, cr);
1061 
1062         hdr = (void *) ptr; ptr += sizeof(*hdr);
1063         hdr->addr = __addr(s->initiator, 0);
1064         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1065         hdr->len  = __len8(sizeof(*mcc));
1066 
1067         mcc = (void *) ptr; ptr += sizeof(*mcc);
1068         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1069         mcc->len  = __len8(0);
1070 
1071         *ptr = __fcs(buf); ptr++;
1072 
1073         return rfcomm_send_frame(s, buf, ptr - buf);
1074 }
1075 
1076 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1077 {
1078         struct rfcomm_hdr *hdr;
1079         struct rfcomm_mcc *mcc;
1080         u8 buf[16], *ptr = buf;
1081 
1082         BT_DBG("%p cr %d", s, cr);
1083 
1084         hdr = (void *) ptr; ptr += sizeof(*hdr);
1085         hdr->addr = __addr(s->initiator, 0);
1086         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1087         hdr->len  = __len8(sizeof(*mcc));
1088 
1089         mcc = (void *) ptr; ptr += sizeof(*mcc);
1090         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1091         mcc->len  = __len8(0);
1092 
1093         *ptr = __fcs(buf); ptr++;
1094 
1095         return rfcomm_send_frame(s, buf, ptr - buf);
1096 }
1097 
1098 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1099 {
1100         struct socket *sock = s->sock;
1101         struct kvec iv[3];
1102         struct msghdr msg;
1103         unsigned char hdr[5], crc[1];
1104 
1105         if (len > 125)
1106                 return -EINVAL;
1107 
1108         BT_DBG("%p cr %d", s, cr);
1109 
1110         hdr[0] = __addr(s->initiator, 0);
1111         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1112         hdr[2] = 0x01 | ((len + 2) << 1);
1113         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1114         hdr[4] = 0x01 | (len << 1);
1115 
1116         crc[0] = __fcs(hdr);
1117 
1118         iv[0].iov_base = hdr;
1119         iv[0].iov_len  = 5;
1120         iv[1].iov_base = pattern;
1121         iv[1].iov_len  = len;
1122         iv[2].iov_base = crc;
1123         iv[2].iov_len  = 1;
1124 
1125         memset(&msg, 0, sizeof(msg));
1126 
1127         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1128 }
1129 
1130 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1131 {
1132         struct rfcomm_hdr *hdr;
1133         u8 buf[16], *ptr = buf;
1134 
1135         BT_DBG("%p addr %d credits %d", s, addr, credits);
1136 
1137         hdr = (void *) ptr; ptr += sizeof(*hdr);
1138         hdr->addr = addr;
1139         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1140         hdr->len  = __len8(0);
1141 
1142         *ptr = credits; ptr++;
1143 
1144         *ptr = __fcs(buf); ptr++;
1145 
1146         return rfcomm_send_frame(s, buf, ptr - buf);
1147 }
1148 
1149 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1150 {
1151         struct rfcomm_hdr *hdr;
1152         int len = skb->len;
1153         u8 *crc;
1154 
1155         if (len > 127) {
1156                 hdr = (void *) skb_push(skb, 4);
1157                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1158         } else {
1159                 hdr = (void *) skb_push(skb, 3);
1160                 hdr->len = __len8(len);
1161         }
1162         hdr->addr = addr;
1163         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1164 
1165         crc = skb_put(skb, 1);
1166         *crc = __fcs((void *) hdr);
1167 }
1168 
1169 /* ---- RFCOMM frame reception ---- */
1170 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1171 {
1172         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1173 
1174         if (dlci) {
1175                 /* Data channel */
1176                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1177                 if (!d) {
1178                         rfcomm_send_dm(s, dlci);
1179                         return s;
1180                 }
1181 
1182                 switch (d->state) {
1183                 case BT_CONNECT:
1184                         rfcomm_dlc_clear_timer(d);
1185 
1186                         rfcomm_dlc_lock(d);
1187                         d->state = BT_CONNECTED;
1188                         d->state_change(d, 0);
1189                         rfcomm_dlc_unlock(d);
1190 
1191                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1192                         break;
1193 
1194                 case BT_DISCONN:
1195                         d->state = BT_CLOSED;
1196                         __rfcomm_dlc_close(d, 0);
1197 
1198                         if (list_empty(&s->dlcs)) {
1199                                 s->state = BT_DISCONN;
1200                                 rfcomm_send_disc(s, 0);
1201                                 rfcomm_session_clear_timer(s);
1202                         }
1203 
1204                         break;
1205                 }
1206         } else {
1207                 /* Control channel */
1208                 switch (s->state) {
1209                 case BT_CONNECT:
1210                         s->state = BT_CONNECTED;
1211                         rfcomm_process_connect(s);
1212                         break;
1213 
1214                 case BT_DISCONN:
1215                         s = rfcomm_session_close(s, ECONNRESET);
1216                         break;
1217                 }
1218         }
1219         return s;
1220 }
1221 
1222 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1223 {
1224         int err = 0;
1225 
1226         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1227 
1228         if (dlci) {
1229                 /* Data DLC */
1230                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1231                 if (d) {
1232                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1233                                 err = ECONNREFUSED;
1234                         else
1235                                 err = ECONNRESET;
1236 
1237                         d->state = BT_CLOSED;
1238                         __rfcomm_dlc_close(d, err);
1239                 }
1240         } else {
1241                 if (s->state == BT_CONNECT)
1242                         err = ECONNREFUSED;
1243                 else
1244                         err = ECONNRESET;
1245 
1246                 s = rfcomm_session_close(s, err);
1247         }
1248         return s;
1249 }
1250 
1251 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1252                                                u8 dlci)
1253 {
1254         int err = 0;
1255 
1256         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1257 
1258         if (dlci) {
1259                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1260                 if (d) {
1261                         rfcomm_send_ua(s, dlci);
1262 
1263                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1264                                 err = ECONNREFUSED;
1265                         else
1266                                 err = ECONNRESET;
1267 
1268                         d->state = BT_CLOSED;
1269                         __rfcomm_dlc_close(d, err);
1270                 } else
1271                         rfcomm_send_dm(s, dlci);
1272 
1273         } else {
1274                 rfcomm_send_ua(s, 0);
1275 
1276                 if (s->state == BT_CONNECT)
1277                         err = ECONNREFUSED;
1278                 else
1279                         err = ECONNRESET;
1280 
1281                 s = rfcomm_session_close(s, err);
1282         }
1283         return s;
1284 }
1285 
1286 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1287 {
1288         struct sock *sk = d->session->sock->sk;
1289         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1290 
1291         BT_DBG("dlc %p", d);
1292 
1293         rfcomm_send_ua(d->session, d->dlci);
1294 
1295         rfcomm_dlc_clear_timer(d);
1296 
1297         rfcomm_dlc_lock(d);
1298         d->state = BT_CONNECTED;
1299         d->state_change(d, 0);
1300         rfcomm_dlc_unlock(d);
1301 
1302         if (d->role_switch)
1303                 hci_conn_switch_role(conn->hcon, 0x00);
1304 
1305         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1306 }
1307 
1308 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1309 {
1310         if (rfcomm_check_security(d)) {
1311                 if (d->defer_setup) {
1312                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1313                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1314 
1315                         rfcomm_dlc_lock(d);
1316                         d->state = BT_CONNECT2;
1317                         d->state_change(d, 0);
1318                         rfcomm_dlc_unlock(d);
1319                 } else
1320                         rfcomm_dlc_accept(d);
1321         } else {
1322                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1323                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1324         }
1325 }
1326 
1327 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1328 {
1329         struct rfcomm_dlc *d;
1330         u8 channel;
1331 
1332         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1333 
1334         if (!dlci) {
1335                 rfcomm_send_ua(s, 0);
1336 
1337                 if (s->state == BT_OPEN) {
1338                         s->state = BT_CONNECTED;
1339                         rfcomm_process_connect(s);
1340                 }
1341                 return 0;
1342         }
1343 
1344         /* Check if DLC exists */
1345         d = rfcomm_dlc_get(s, dlci);
1346         if (d) {
1347                 if (d->state == BT_OPEN) {
1348                         /* DLC was previously opened by PN request */
1349                         rfcomm_check_accept(d);
1350                 }
1351                 return 0;
1352         }
1353 
1354         /* Notify socket layer about incoming connection */
1355         channel = __srv_channel(dlci);
1356         if (rfcomm_connect_ind(s, channel, &d)) {
1357                 d->dlci = dlci;
1358                 d->addr = __addr(s->initiator, dlci);
1359                 rfcomm_dlc_link(s, d);
1360 
1361                 rfcomm_check_accept(d);
1362         } else {
1363                 rfcomm_send_dm(s, dlci);
1364         }
1365 
1366         return 0;
1367 }
1368 
1369 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1370 {
1371         struct rfcomm_session *s = d->session;
1372 
1373         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1374                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1375 
1376         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1377                                                 pn->flow_ctrl == 0xe0) {
1378                 d->cfc = RFCOMM_CFC_ENABLED;
1379                 d->tx_credits = pn->credits;
1380         } else {
1381                 d->cfc = RFCOMM_CFC_DISABLED;
1382                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1383         }
1384 
1385         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1386                 s->cfc = d->cfc;
1387 
1388         d->priority = pn->priority;
1389 
1390         d->mtu = __le16_to_cpu(pn->mtu);
1391 
1392         if (cr && d->mtu > s->mtu)
1393                 d->mtu = s->mtu;
1394 
1395         return 0;
1396 }
1397 
1398 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1399 {
1400         struct rfcomm_pn *pn = (void *) skb->data;
1401         struct rfcomm_dlc *d;
1402         u8 dlci = pn->dlci;
1403 
1404         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1405 
1406         if (!dlci)
1407                 return 0;
1408 
1409         d = rfcomm_dlc_get(s, dlci);
1410         if (d) {
1411                 if (cr) {
1412                         /* PN request */
1413                         rfcomm_apply_pn(d, cr, pn);
1414                         rfcomm_send_pn(s, 0, d);
1415                 } else {
1416                         /* PN response */
1417                         switch (d->state) {
1418                         case BT_CONFIG:
1419                                 rfcomm_apply_pn(d, cr, pn);
1420 
1421                                 d->state = BT_CONNECT;
1422                                 rfcomm_send_sabm(s, d->dlci);
1423                                 break;
1424                         }
1425                 }
1426         } else {
1427                 u8 channel = __srv_channel(dlci);
1428 
1429                 if (!cr)
1430                         return 0;
1431 
1432                 /* PN request for non existing DLC.
1433                  * Assume incoming connection. */
1434                 if (rfcomm_connect_ind(s, channel, &d)) {
1435                         d->dlci = dlci;
1436                         d->addr = __addr(s->initiator, dlci);
1437                         rfcomm_dlc_link(s, d);
1438 
1439                         rfcomm_apply_pn(d, cr, pn);
1440 
1441                         d->state = BT_OPEN;
1442                         rfcomm_send_pn(s, 0, d);
1443                 } else {
1444                         rfcomm_send_dm(s, dlci);
1445                 }
1446         }
1447         return 0;
1448 }
1449 
1450 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1451 {
1452         struct rfcomm_rpn *rpn = (void *) skb->data;
1453         u8 dlci = __get_dlci(rpn->dlci);
1454 
1455         u8 bit_rate  = 0;
1456         u8 data_bits = 0;
1457         u8 stop_bits = 0;
1458         u8 parity    = 0;
1459         u8 flow_ctrl = 0;
1460         u8 xon_char  = 0;
1461         u8 xoff_char = 0;
1462         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1463 
1464         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1465                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1466                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1467 
1468         if (!cr)
1469                 return 0;
1470 
1471         if (len == 1) {
1472                 /* This is a request, return default (according to ETSI TS 07.10) settings */
1473                 bit_rate  = RFCOMM_RPN_BR_9600;
1474                 data_bits = RFCOMM_RPN_DATA_8;
1475                 stop_bits = RFCOMM_RPN_STOP_1;
1476                 parity    = RFCOMM_RPN_PARITY_NONE;
1477                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1478                 xon_char  = RFCOMM_RPN_XON_CHAR;
1479                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1480                 goto rpn_out;
1481         }
1482 
1483         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1484          * no parity, no flow control lines, normal XON/XOFF chars */
1485 
1486         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1487                 bit_rate = rpn->bit_rate;
1488                 if (bit_rate > RFCOMM_RPN_BR_230400) {
1489                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1490                         bit_rate = RFCOMM_RPN_BR_9600;
1491                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1492                 }
1493         }
1494 
1495         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1496                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1497                 if (data_bits != RFCOMM_RPN_DATA_8) {
1498                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1499                         data_bits = RFCOMM_RPN_DATA_8;
1500                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1501                 }
1502         }
1503 
1504         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1505                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1506                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1507                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1508                         stop_bits = RFCOMM_RPN_STOP_1;
1509                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1510                 }
1511         }
1512 
1513         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1514                 parity = __get_rpn_parity(rpn->line_settings);
1515                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1516                         BT_DBG("RPN parity mismatch 0x%x", parity);
1517                         parity = RFCOMM_RPN_PARITY_NONE;
1518                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1519                 }
1520         }
1521 
1522         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1523                 flow_ctrl = rpn->flow_ctrl;
1524                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1525                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1526                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1527                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1528                 }
1529         }
1530 
1531         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1532                 xon_char = rpn->xon_char;
1533                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1534                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1535                         xon_char = RFCOMM_RPN_XON_CHAR;
1536                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1537                 }
1538         }
1539 
1540         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1541                 xoff_char = rpn->xoff_char;
1542                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1543                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1544                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1545                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1546                 }
1547         }
1548 
1549 rpn_out:
1550         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1551                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1552 
1553         return 0;
1554 }
1555 
1556 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1557 {
1558         struct rfcomm_rls *rls = (void *) skb->data;
1559         u8 dlci = __get_dlci(rls->dlci);
1560 
1561         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1562 
1563         if (!cr)
1564                 return 0;
1565 
1566         /* We should probably do something with this information here. But
1567          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1568          * mandatory to recognise and respond to RLS */
1569 
1570         rfcomm_send_rls(s, 0, dlci, rls->status);
1571 
1572         return 0;
1573 }
1574 
1575 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1576 {
1577         struct rfcomm_msc *msc = (void *) skb->data;
1578         struct rfcomm_dlc *d;
1579         u8 dlci = __get_dlci(msc->dlci);
1580 
1581         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1582 
1583         d = rfcomm_dlc_get(s, dlci);
1584         if (!d)
1585                 return 0;
1586 
1587         if (cr) {
1588                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1589                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1590                 else
1591                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1592 
1593                 rfcomm_dlc_lock(d);
1594 
1595                 d->remote_v24_sig = msc->v24_sig;
1596 
1597                 if (d->modem_status)
1598                         d->modem_status(d, msc->v24_sig);
1599 
1600                 rfcomm_dlc_unlock(d);
1601 
1602                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1603 
1604                 d->mscex |= RFCOMM_MSCEX_RX;
1605         } else
1606                 d->mscex |= RFCOMM_MSCEX_TX;
1607 
1608         return 0;
1609 }
1610 
1611 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1612 {
1613         struct rfcomm_mcc *mcc = (void *) skb->data;
1614         u8 type, cr, len;
1615 
1616         cr   = __test_cr(mcc->type);
1617         type = __get_mcc_type(mcc->type);
1618         len  = __get_mcc_len(mcc->len);
1619 
1620         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1621 
1622         skb_pull(skb, 2);
1623 
1624         switch (type) {
1625         case RFCOMM_PN:
1626                 rfcomm_recv_pn(s, cr, skb);
1627                 break;
1628 
1629         case RFCOMM_RPN:
1630                 rfcomm_recv_rpn(s, cr, len, skb);
1631                 break;
1632 
1633         case RFCOMM_RLS:
1634                 rfcomm_recv_rls(s, cr, skb);
1635                 break;
1636 
1637         case RFCOMM_MSC:
1638                 rfcomm_recv_msc(s, cr, skb);
1639                 break;
1640 
1641         case RFCOMM_FCOFF:
1642                 if (cr) {
1643                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1644                         rfcomm_send_fcoff(s, 0);
1645                 }
1646                 break;
1647 
1648         case RFCOMM_FCON:
1649                 if (cr) {
1650                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1651                         rfcomm_send_fcon(s, 0);
1652                 }
1653                 break;
1654 
1655         case RFCOMM_TEST:
1656                 if (cr)
1657                         rfcomm_send_test(s, 0, skb->data, skb->len);
1658                 break;
1659 
1660         case RFCOMM_NSC:
1661                 break;
1662 
1663         default:
1664                 BT_ERR("Unknown control type 0x%02x", type);
1665                 rfcomm_send_nsc(s, cr, type);
1666                 break;
1667         }
1668         return 0;
1669 }
1670 
1671 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1672 {
1673         struct rfcomm_dlc *d;
1674 
1675         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1676 
1677         d = rfcomm_dlc_get(s, dlci);
1678         if (!d) {
1679                 rfcomm_send_dm(s, dlci);
1680                 goto drop;
1681         }
1682 
1683         if (pf && d->cfc) {
1684                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1685 
1686                 d->tx_credits += credits;
1687                 if (d->tx_credits)
1688                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1689         }
1690 
1691         if (skb->len && d->state == BT_CONNECTED) {
1692                 rfcomm_dlc_lock(d);
1693                 d->rx_credits--;
1694                 d->data_ready(d, skb);
1695                 rfcomm_dlc_unlock(d);
1696                 return 0;
1697         }
1698 
1699 drop:
1700         kfree_skb(skb);
1701         return 0;
1702 }
1703 
1704 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1705                                                 struct sk_buff *skb)
1706 {
1707         struct rfcomm_hdr *hdr = (void *) skb->data;
1708         u8 type, dlci, fcs;
1709 
1710         if (!s) {
1711                 /* no session, so free socket data */
1712                 kfree_skb(skb);
1713                 return s;
1714         }
1715 
1716         dlci = __get_dlci(hdr->addr);
1717         type = __get_type(hdr->ctrl);
1718 
1719         /* Trim FCS */
1720         skb->len--; skb->tail--;
1721         fcs = *(u8 *)skb_tail_pointer(skb);
1722 
1723         if (__check_fcs(skb->data, type, fcs)) {
1724                 BT_ERR("bad checksum in packet");
1725                 kfree_skb(skb);
1726                 return s;
1727         }
1728 
1729         if (__test_ea(hdr->len))
1730                 skb_pull(skb, 3);
1731         else
1732                 skb_pull(skb, 4);
1733 
1734         switch (type) {
1735         case RFCOMM_SABM:
1736                 if (__test_pf(hdr->ctrl))
1737                         rfcomm_recv_sabm(s, dlci);
1738                 break;
1739 
1740         case RFCOMM_DISC:
1741                 if (__test_pf(hdr->ctrl))
1742                         s = rfcomm_recv_disc(s, dlci);
1743                 break;
1744 
1745         case RFCOMM_UA:
1746                 if (__test_pf(hdr->ctrl))
1747                         s = rfcomm_recv_ua(s, dlci);
1748                 break;
1749 
1750         case RFCOMM_DM:
1751                 s = rfcomm_recv_dm(s, dlci);
1752                 break;
1753 
1754         case RFCOMM_UIH:
1755                 if (dlci) {
1756                         rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1757                         return s;
1758                 }
1759                 rfcomm_recv_mcc(s, skb);
1760                 break;
1761 
1762         default:
1763                 BT_ERR("Unknown packet type 0x%02x", type);
1764                 break;
1765         }
1766         kfree_skb(skb);
1767         return s;
1768 }
1769 
1770 /* ---- Connection and data processing ---- */
1771 
1772 static void rfcomm_process_connect(struct rfcomm_session *s)
1773 {
1774         struct rfcomm_dlc *d;
1775         struct list_head *p, *n;
1776 
1777         BT_DBG("session %p state %ld", s, s->state);
1778 
1779         list_for_each_safe(p, n, &s->dlcs) {
1780                 d = list_entry(p, struct rfcomm_dlc, list);
1781                 if (d->state == BT_CONFIG) {
1782                         d->mtu = s->mtu;
1783                         if (rfcomm_check_security(d)) {
1784                                 rfcomm_send_pn(s, 1, d);
1785                         } else {
1786                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1787                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1788                         }
1789                 }
1790         }
1791 }
1792 
1793 /* Send data queued for the DLC.
1794  * Return number of frames left in the queue.
1795  */
1796 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1797 {
1798         struct sk_buff *skb;
1799         int err;
1800 
1801         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1802                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1803 
1804         /* Send pending MSC */
1805         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1806                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1807 
1808         if (d->cfc) {
1809                 /* CFC enabled.
1810                  * Give them some credits */
1811                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1812                                 d->rx_credits <= (d->cfc >> 2)) {
1813                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1814                         d->rx_credits = d->cfc;
1815                 }
1816         } else {
1817                 /* CFC disabled.
1818                  * Give ourselves some credits */
1819                 d->tx_credits = 5;
1820         }
1821 
1822         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1823                 return skb_queue_len(&d->tx_queue);
1824 
1825         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1826                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1827                 if (err < 0) {
1828                         skb_queue_head(&d->tx_queue, skb);
1829                         break;
1830                 }
1831                 kfree_skb(skb);
1832                 d->tx_credits--;
1833         }
1834 
1835         if (d->cfc && !d->tx_credits) {
1836                 /* We're out of TX credits.
1837                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1838                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1839         }
1840 
1841         return skb_queue_len(&d->tx_queue);
1842 }
1843 
1844 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1845 {
1846         struct rfcomm_dlc *d;
1847         struct list_head *p, *n;
1848 
1849         BT_DBG("session %p state %ld", s, s->state);
1850 
1851         list_for_each_safe(p, n, &s->dlcs) {
1852                 d = list_entry(p, struct rfcomm_dlc, list);
1853 
1854                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1855                         __rfcomm_dlc_close(d, ETIMEDOUT);
1856                         continue;
1857                 }
1858 
1859                 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1860                         __rfcomm_dlc_close(d, ECONNREFUSED);
1861                         continue;
1862                 }
1863 
1864                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1865                         rfcomm_dlc_clear_timer(d);
1866                         if (d->out) {
1867                                 rfcomm_send_pn(s, 1, d);
1868                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1869                         } else {
1870                                 if (d->defer_setup) {
1871                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1872                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1873 
1874                                         rfcomm_dlc_lock(d);
1875                                         d->state = BT_CONNECT2;
1876                                         d->state_change(d, 0);
1877                                         rfcomm_dlc_unlock(d);
1878                                 } else
1879                                         rfcomm_dlc_accept(d);
1880                         }
1881                         continue;
1882                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1883                         rfcomm_dlc_clear_timer(d);
1884                         if (!d->out)
1885                                 rfcomm_send_dm(s, d->dlci);
1886                         else
1887                                 d->state = BT_CLOSED;
1888                         __rfcomm_dlc_close(d, ECONNREFUSED);
1889                         continue;
1890                 }
1891 
1892                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1893                         continue;
1894 
1895                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1896                         continue;
1897 
1898                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1899                                                 d->mscex == RFCOMM_MSCEX_OK)
1900                         rfcomm_process_tx(d);
1901         }
1902 }
1903 
1904 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1905 {
1906         struct socket *sock = s->sock;
1907         struct sock *sk = sock->sk;
1908         struct sk_buff *skb;
1909 
1910         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1911 
1912         /* Get data directly from socket receive queue without copying it. */
1913         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1914                 skb_orphan(skb);
1915                 if (!skb_linearize(skb)) {
1916                         s = rfcomm_recv_frame(s, skb);
1917                         if (!s)
1918                                 break;
1919                 } else {
1920                         kfree_skb(skb);
1921                 }
1922         }
1923 
1924         if (s && (sk->sk_state == BT_CLOSED))
1925                 s = rfcomm_session_close(s, sk->sk_err);
1926 
1927         return s;
1928 }
1929 
1930 static void rfcomm_accept_connection(struct rfcomm_session *s)
1931 {
1932         struct socket *sock = s->sock, *nsock;
1933         int err;
1934 
1935         /* Fast check for a new connection.
1936          * Avoids unnesesary socket allocations. */
1937         if (list_empty(&bt_sk(sock->sk)->accept_q))
1938                 return;
1939 
1940         BT_DBG("session %p", s);
1941 
1942         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1943         if (err < 0)
1944                 return;
1945 
1946         /* Set our callbacks */
1947         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1948         nsock->sk->sk_state_change = rfcomm_l2state_change;
1949 
1950         s = rfcomm_session_add(nsock, BT_OPEN);
1951         if (s) {
1952                 /* We should adjust MTU on incoming sessions.
1953                  * L2CAP MTU minus UIH header and FCS. */
1954                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1955                                 l2cap_pi(nsock->sk)->chan->imtu) - 5;
1956 
1957                 rfcomm_schedule();
1958         } else
1959                 sock_release(nsock);
1960 }
1961 
1962 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1963 {
1964         struct sock *sk = s->sock->sk;
1965 
1966         BT_DBG("%p state %ld", s, s->state);
1967 
1968         switch (sk->sk_state) {
1969         case BT_CONNECTED:
1970                 s->state = BT_CONNECT;
1971 
1972                 /* We can adjust MTU on outgoing sessions.
1973                  * L2CAP MTU minus UIH header and FCS. */
1974                 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1975 
1976                 rfcomm_send_sabm(s, 0);
1977                 break;
1978 
1979         case BT_CLOSED:
1980                 s = rfcomm_session_close(s, sk->sk_err);
1981                 break;
1982         }
1983         return s;
1984 }
1985 
1986 static void rfcomm_process_sessions(void)
1987 {
1988         struct list_head *p, *n;
1989 
1990         rfcomm_lock();
1991 
1992         list_for_each_safe(p, n, &session_list) {
1993                 struct rfcomm_session *s;
1994                 s = list_entry(p, struct rfcomm_session, list);
1995 
1996                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1997                         s->state = BT_DISCONN;
1998                         rfcomm_send_disc(s, 0);
1999                         continue;
2000                 }
2001 
2002                 switch (s->state) {
2003                 case BT_LISTEN:
2004                         rfcomm_accept_connection(s);
2005                         continue;
2006 
2007                 case BT_BOUND:
2008                         s = rfcomm_check_connection(s);
2009                         break;
2010 
2011                 default:
2012                         s = rfcomm_process_rx(s);
2013                         break;
2014                 }
2015 
2016                 if (s)
2017                         rfcomm_process_dlcs(s);
2018         }
2019 
2020         rfcomm_unlock();
2021 }
2022 
2023 static int rfcomm_add_listener(bdaddr_t *ba)
2024 {
2025         struct sockaddr_l2 addr;
2026         struct socket *sock;
2027         struct sock *sk;
2028         struct rfcomm_session *s;
2029         int    err = 0;
2030 
2031         /* Create socket */
2032         err = rfcomm_l2sock_create(&sock);
2033         if (err < 0) {
2034                 BT_ERR("Create socket failed %d", err);
2035                 return err;
2036         }
2037 
2038         /* Bind socket */
2039         bacpy(&addr.l2_bdaddr, ba);
2040         addr.l2_family = AF_BLUETOOTH;
2041         addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
2042         addr.l2_cid    = 0;
2043         addr.l2_bdaddr_type = BDADDR_BREDR;
2044         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
2045         if (err < 0) {
2046                 BT_ERR("Bind failed %d", err);
2047                 goto failed;
2048         }
2049 
2050         /* Set L2CAP options */
2051         sk = sock->sk;
2052         lock_sock(sk);
2053         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2054         release_sock(sk);
2055 
2056         /* Start listening on the socket */
2057         err = kernel_listen(sock, 10);
2058         if (err) {
2059                 BT_ERR("Listen failed %d", err);
2060                 goto failed;
2061         }
2062 
2063         /* Add listening session */
2064         s = rfcomm_session_add(sock, BT_LISTEN);
2065         if (!s) {
2066                 err = -ENOMEM;
2067                 goto failed;
2068         }
2069 
2070         return 0;
2071 failed:
2072         sock_release(sock);
2073         return err;
2074 }
2075 
2076 static void rfcomm_kill_listener(void)
2077 {
2078         struct rfcomm_session *s;
2079         struct list_head *p, *n;
2080 
2081         BT_DBG("");
2082 
2083         list_for_each_safe(p, n, &session_list) {
2084                 s = list_entry(p, struct rfcomm_session, list);
2085                 rfcomm_session_del(s);
2086         }
2087 }
2088 
2089 static int rfcomm_run(void *unused)
2090 {
2091         DEFINE_WAIT_FUNC(wait, woken_wake_function);
2092         BT_DBG("");
2093 
2094         set_user_nice(current, -10);
2095 
2096         rfcomm_add_listener(BDADDR_ANY);
2097 
2098         add_wait_queue(&rfcomm_wq, &wait);
2099         while (!kthread_should_stop()) {
2100 
2101                 /* Process stuff */
2102                 rfcomm_process_sessions();
2103 
2104                 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2105         }
2106         remove_wait_queue(&rfcomm_wq, &wait);
2107 
2108         rfcomm_kill_listener();
2109 
2110         return 0;
2111 }
2112 
2113 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2114 {
2115         struct rfcomm_session *s;
2116         struct rfcomm_dlc *d;
2117         struct list_head *p, *n;
2118 
2119         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2120 
2121         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2122         if (!s)
2123                 return;
2124 
2125         list_for_each_safe(p, n, &s->dlcs) {
2126                 d = list_entry(p, struct rfcomm_dlc, list);
2127 
2128                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2129                         rfcomm_dlc_clear_timer(d);
2130                         if (status || encrypt == 0x00) {
2131                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2132                                 continue;
2133                         }
2134                 }
2135 
2136                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2137                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2138                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2139                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2140                                 continue;
2141                         } else if (d->sec_level == BT_SECURITY_HIGH ||
2142                                    d->sec_level == BT_SECURITY_FIPS) {
2143                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2144                                 continue;
2145                         }
2146                 }
2147 
2148                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2149                         continue;
2150 
2151                 if (!status && hci_conn_check_secure(conn, d->sec_level))
2152                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2153                 else
2154                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2155         }
2156 
2157         rfcomm_schedule();
2158 }
2159 
2160 static struct hci_cb rfcomm_cb = {
2161         .name           = "RFCOMM",
2162         .security_cfm   = rfcomm_security_cfm
2163 };
2164 
2165 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2166 {
2167         struct rfcomm_session *s;
2168 
2169         rfcomm_lock();
2170 
2171         list_for_each_entry(s, &session_list, list) {
2172                 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2173                 struct rfcomm_dlc *d;
2174                 list_for_each_entry(d, &s->dlcs, list) {
2175                         seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2176                                    &chan->src, &chan->dst,
2177                                    d->state, d->dlci, d->mtu,
2178                                    d->rx_credits, d->tx_credits);
2179                 }
2180         }
2181 
2182         rfcomm_unlock();
2183 
2184         return 0;
2185 }
2186 
2187 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2188 {
2189         return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2190 }
2191 
2192 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2193         .open           = rfcomm_dlc_debugfs_open,
2194         .read           = seq_read,
2195         .llseek         = seq_lseek,
2196         .release        = single_release,
2197 };
2198 
2199 static struct dentry *rfcomm_dlc_debugfs;
2200 
2201 /* ---- Initialization ---- */
2202 static int __init rfcomm_init(void)
2203 {
2204         int err;
2205 
2206         hci_register_cb(&rfcomm_cb);
2207 
2208         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2209         if (IS_ERR(rfcomm_thread)) {
2210                 err = PTR_ERR(rfcomm_thread);
2211                 goto unregister;
2212         }
2213 
2214         err = rfcomm_init_ttys();
2215         if (err < 0)
2216                 goto stop;
2217 
2218         err = rfcomm_init_sockets();
2219         if (err < 0)
2220                 goto cleanup;
2221 
2222         BT_INFO("RFCOMM ver %s", VERSION);
2223 
2224         if (IS_ERR_OR_NULL(bt_debugfs))
2225                 return 0;
2226 
2227         rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2228                                                  bt_debugfs, NULL,
2229                                                  &rfcomm_dlc_debugfs_fops);
2230 
2231         return 0;
2232 
2233 cleanup:
2234         rfcomm_cleanup_ttys();
2235 
2236 stop:
2237         kthread_stop(rfcomm_thread);
2238 
2239 unregister:
2240         hci_unregister_cb(&rfcomm_cb);
2241 
2242         return err;
2243 }
2244 
2245 static void __exit rfcomm_exit(void)
2246 {
2247         debugfs_remove(rfcomm_dlc_debugfs);
2248 
2249         hci_unregister_cb(&rfcomm_cb);
2250 
2251         kthread_stop(rfcomm_thread);
2252 
2253         rfcomm_cleanup_ttys();
2254 
2255         rfcomm_cleanup_sockets();
2256 }
2257 
2258 module_init(rfcomm_init);
2259 module_exit(rfcomm_exit);
2260 
2261 module_param(disable_cfc, bool, 0644);
2262 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2263 
2264 module_param(channel_mtu, int, 0644);
2265 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2266 
2267 module_param(l2cap_mtu, uint, 0644);
2268 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2269 
2270 module_param(l2cap_ertm, bool, 0644);
2271 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2272 
2273 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2274 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2275 MODULE_VERSION(VERSION);
2276 MODULE_LICENSE("GPL");
2277 MODULE_ALIAS("bt-proto-3");
2278 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us