Version:  2.6.34 2.6.35 2.6.36 2.6.37 2.6.38 2.6.39 3.0 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 3.11 3.12 3.13 3.14

Linux/net/bluetooth/rfcomm/core.c

  1 /*
  2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
  3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
  4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
  5 
  6    This program is free software; you can redistribute it and/or modify
  7    it under the terms of the GNU General Public License version 2 as
  8    published by the Free Software Foundation;
  9 
 10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
 13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
 14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
 15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 18 
 19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
 20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
 21    SOFTWARE IS DISCLAIMED.
 22 */
 23 
 24 /*
 25  * Bluetooth RFCOMM core.
 26  */
 27 
 28 #include <linux/module.h>
 29 #include <linux/debugfs.h>
 30 #include <linux/kthread.h>
 31 #include <asm/unaligned.h>
 32 
 33 #include <net/bluetooth/bluetooth.h>
 34 #include <net/bluetooth/hci_core.h>
 35 #include <net/bluetooth/l2cap.h>
 36 #include <net/bluetooth/rfcomm.h>
 37 
 38 #define VERSION "1.11"
 39 
 40 static bool disable_cfc;
 41 static bool l2cap_ertm;
 42 static int channel_mtu = -1;
 43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
 44 
 45 static struct task_struct *rfcomm_thread;
 46 
 47 static DEFINE_MUTEX(rfcomm_mutex);
 48 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
 49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
 50 
 51 
 52 static LIST_HEAD(session_list);
 53 
 54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
 55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
 56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
 57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
 58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
 59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
 60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
 61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
 62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
 63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
 64 
 65 static void rfcomm_process_connect(struct rfcomm_session *s);
 66 
 67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 68                                                         bdaddr_t *dst,
 69                                                         u8 sec_level,
 70                                                         int *err);
 71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
 72 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
 73 
 74 /* ---- RFCOMM frame parsing macros ---- */
 75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
 76 #define __get_channel(b)  ((b & 0xf8) >> 3)
 77 #define __get_dir(b)      ((b & 0x04) >> 2)
 78 #define __get_type(b)     ((b & 0xef))
 79 
 80 #define __test_ea(b)      ((b & 0x01))
 81 #define __test_cr(b)      ((b & 0x02))
 82 #define __test_pf(b)      ((b & 0x10))
 83 
 84 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
 85 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
 86 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
 87 #define __srv_channel(dlci)    (dlci >> 1)
 88 #define __dir(dlci)            (dlci & 0x01)
 89 
 90 #define __len8(len)       (((len) << 1) | 1)
 91 #define __len16(len)      ((len) << 1)
 92 
 93 /* MCC macros */
 94 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 95 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 96 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 97 
 98 /* RPN macros */
 99 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
100 #define __get_rpn_data_bits(line) ((line) & 0x3)
101 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
102 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
103 
104 static void rfcomm_schedule(void)
105 {
106         if (!rfcomm_thread)
107                 return;
108         wake_up_process(rfcomm_thread);
109 }
110 
111 /* ---- RFCOMM FCS computation ---- */
112 
113 /* reversed, 8-bit, poly=0x07 */
114 static unsigned char rfcomm_crc_table[256] = {
115         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
116         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
117         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
118         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
119 
120         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
121         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
122         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
123         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
124 
125         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
126         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
127         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
128         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
129 
130         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
131         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
132         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
133         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
134 
135         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
136         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
137         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
138         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
139 
140         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
141         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
142         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
143         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
144 
145         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
146         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
147         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
148         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
149 
150         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
151         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
152         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
153         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
154 };
155 
156 /* CRC on 2 bytes */
157 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
158 
159 /* FCS on 2 bytes */
160 static inline u8 __fcs(u8 *data)
161 {
162         return 0xff - __crc(data);
163 }
164 
165 /* FCS on 3 bytes */
166 static inline u8 __fcs2(u8 *data)
167 {
168         return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
169 }
170 
171 /* Check FCS */
172 static inline int __check_fcs(u8 *data, int type, u8 fcs)
173 {
174         u8 f = __crc(data);
175 
176         if (type != RFCOMM_UIH)
177                 f = rfcomm_crc_table[f ^ data[2]];
178 
179         return rfcomm_crc_table[f ^ fcs] != 0xcf;
180 }
181 
182 /* ---- L2CAP callbacks ---- */
183 static void rfcomm_l2state_change(struct sock *sk)
184 {
185         BT_DBG("%p state %d", sk, sk->sk_state);
186         rfcomm_schedule();
187 }
188 
189 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
190 {
191         BT_DBG("%p bytes %d", sk, bytes);
192         rfcomm_schedule();
193 }
194 
195 static int rfcomm_l2sock_create(struct socket **sock)
196 {
197         int err;
198 
199         BT_DBG("");
200 
201         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
202         if (!err) {
203                 struct sock *sk = (*sock)->sk;
204                 sk->sk_data_ready   = rfcomm_l2data_ready;
205                 sk->sk_state_change = rfcomm_l2state_change;
206         }
207         return err;
208 }
209 
210 static int rfcomm_check_security(struct rfcomm_dlc *d)
211 {
212         struct sock *sk = d->session->sock->sk;
213         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
214 
215         __u8 auth_type;
216 
217         switch (d->sec_level) {
218         case BT_SECURITY_HIGH:
219                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
220                 break;
221         case BT_SECURITY_MEDIUM:
222                 auth_type = HCI_AT_GENERAL_BONDING;
223                 break;
224         default:
225                 auth_type = HCI_AT_NO_BONDING;
226                 break;
227         }
228 
229         return hci_conn_security(conn->hcon, d->sec_level, auth_type);
230 }
231 
232 static void rfcomm_session_timeout(unsigned long arg)
233 {
234         struct rfcomm_session *s = (void *) arg;
235 
236         BT_DBG("session %p state %ld", s, s->state);
237 
238         set_bit(RFCOMM_TIMED_OUT, &s->flags);
239         rfcomm_schedule();
240 }
241 
242 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
243 {
244         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
245 
246         mod_timer(&s->timer, jiffies + timeout);
247 }
248 
249 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
250 {
251         BT_DBG("session %p state %ld", s, s->state);
252 
253         del_timer_sync(&s->timer);
254 }
255 
256 /* ---- RFCOMM DLCs ---- */
257 static void rfcomm_dlc_timeout(unsigned long arg)
258 {
259         struct rfcomm_dlc *d = (void *) arg;
260 
261         BT_DBG("dlc %p state %ld", d, d->state);
262 
263         set_bit(RFCOMM_TIMED_OUT, &d->flags);
264         rfcomm_dlc_put(d);
265         rfcomm_schedule();
266 }
267 
268 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
269 {
270         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
271 
272         if (!mod_timer(&d->timer, jiffies + timeout))
273                 rfcomm_dlc_hold(d);
274 }
275 
276 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
277 {
278         BT_DBG("dlc %p state %ld", d, d->state);
279 
280         if (del_timer(&d->timer))
281                 rfcomm_dlc_put(d);
282 }
283 
284 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
285 {
286         BT_DBG("%p", d);
287 
288         d->state      = BT_OPEN;
289         d->flags      = 0;
290         d->mscex      = 0;
291         d->sec_level  = BT_SECURITY_LOW;
292         d->mtu        = RFCOMM_DEFAULT_MTU;
293         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
294 
295         d->cfc        = RFCOMM_CFC_DISABLED;
296         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
297 }
298 
299 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
300 {
301         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
302 
303         if (!d)
304                 return NULL;
305 
306         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
307 
308         skb_queue_head_init(&d->tx_queue);
309         spin_lock_init(&d->lock);
310         atomic_set(&d->refcnt, 1);
311 
312         rfcomm_dlc_clear_state(d);
313 
314         BT_DBG("%p", d);
315 
316         return d;
317 }
318 
319 void rfcomm_dlc_free(struct rfcomm_dlc *d)
320 {
321         BT_DBG("%p", d);
322 
323         skb_queue_purge(&d->tx_queue);
324         kfree(d);
325 }
326 
327 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
328 {
329         BT_DBG("dlc %p session %p", d, s);
330 
331         rfcomm_session_clear_timer(s);
332         rfcomm_dlc_hold(d);
333         list_add(&d->list, &s->dlcs);
334         d->session = s;
335 }
336 
337 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
338 {
339         struct rfcomm_session *s = d->session;
340 
341         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
342 
343         list_del(&d->list);
344         d->session = NULL;
345         rfcomm_dlc_put(d);
346 
347         if (list_empty(&s->dlcs))
348                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
349 }
350 
351 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
352 {
353         struct rfcomm_dlc *d;
354 
355         list_for_each_entry(d, &s->dlcs, list)
356                 if (d->dlci == dlci)
357                         return d;
358 
359         return NULL;
360 }
361 
362 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
363 {
364         struct rfcomm_session *s;
365         int err = 0;
366         u8 dlci;
367 
368         BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
369                d, d->state, src, dst, channel);
370 
371         if (channel < 1 || channel > 30)
372                 return -EINVAL;
373 
374         if (d->state != BT_OPEN && d->state != BT_CLOSED)
375                 return 0;
376 
377         s = rfcomm_session_get(src, dst);
378         if (!s) {
379                 s = rfcomm_session_create(src, dst, d->sec_level, &err);
380                 if (!s)
381                         return err;
382         }
383 
384         dlci = __dlci(!s->initiator, channel);
385 
386         /* Check if DLCI already exists */
387         if (rfcomm_dlc_get(s, dlci))
388                 return -EBUSY;
389 
390         rfcomm_dlc_clear_state(d);
391 
392         d->dlci     = dlci;
393         d->addr     = __addr(s->initiator, dlci);
394         d->priority = 7;
395 
396         d->state = BT_CONFIG;
397         rfcomm_dlc_link(s, d);
398 
399         d->out = 1;
400 
401         d->mtu = s->mtu;
402         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
403 
404         if (s->state == BT_CONNECTED) {
405                 if (rfcomm_check_security(d))
406                         rfcomm_send_pn(s, 1, d);
407                 else
408                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
409         }
410 
411         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
412 
413         return 0;
414 }
415 
416 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
417 {
418         int r;
419 
420         rfcomm_lock();
421 
422         r = __rfcomm_dlc_open(d, src, dst, channel);
423 
424         rfcomm_unlock();
425         return r;
426 }
427 
428 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
429 {
430         struct rfcomm_session *s = d->session;
431         if (!s)
432                 return 0;
433 
434         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
435                         d, d->state, d->dlci, err, s);
436 
437         switch (d->state) {
438         case BT_CONNECT:
439         case BT_CONFIG:
440                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
441                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
442                         rfcomm_schedule();
443                         break;
444                 }
445                 /* Fall through */
446 
447         case BT_CONNECTED:
448                 d->state = BT_DISCONN;
449                 if (skb_queue_empty(&d->tx_queue)) {
450                         rfcomm_send_disc(s, d->dlci);
451                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
452                 } else {
453                         rfcomm_queue_disc(d);
454                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
455                 }
456                 break;
457 
458         case BT_OPEN:
459         case BT_CONNECT2:
460                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
461                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
462                         rfcomm_schedule();
463                         break;
464                 }
465                 /* Fall through */
466 
467         default:
468                 rfcomm_dlc_clear_timer(d);
469 
470                 rfcomm_dlc_lock(d);
471                 d->state = BT_CLOSED;
472                 d->state_change(d, err);
473                 rfcomm_dlc_unlock(d);
474 
475                 skb_queue_purge(&d->tx_queue);
476                 rfcomm_dlc_unlink(d);
477         }
478 
479         return 0;
480 }
481 
482 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
483 {
484         int r = 0;
485         struct rfcomm_dlc *d_list;
486         struct rfcomm_session *s, *s_list;
487 
488         BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
489 
490         rfcomm_lock();
491 
492         s = d->session;
493         if (!s)
494                 goto no_session;
495 
496         /* after waiting on the mutex check the session still exists
497          * then check the dlc still exists
498          */
499         list_for_each_entry(s_list, &session_list, list) {
500                 if (s_list == s) {
501                         list_for_each_entry(d_list, &s->dlcs, list) {
502                                 if (d_list == d) {
503                                         r = __rfcomm_dlc_close(d, err);
504                                         break;
505                                 }
506                         }
507                         break;
508                 }
509         }
510 
511 no_session:
512         rfcomm_unlock();
513         return r;
514 }
515 
516 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
517 {
518         int len = skb->len;
519 
520         if (d->state != BT_CONNECTED)
521                 return -ENOTCONN;
522 
523         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
524 
525         if (len > d->mtu)
526                 return -EINVAL;
527 
528         rfcomm_make_uih(skb, d->addr);
529         skb_queue_tail(&d->tx_queue, skb);
530 
531         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
532                 rfcomm_schedule();
533         return len;
534 }
535 
536 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
537 {
538         BT_DBG("dlc %p state %ld", d, d->state);
539 
540         if (!d->cfc) {
541                 d->v24_sig |= RFCOMM_V24_FC;
542                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
543         }
544         rfcomm_schedule();
545 }
546 
547 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
548 {
549         BT_DBG("dlc %p state %ld", d, d->state);
550 
551         if (!d->cfc) {
552                 d->v24_sig &= ~RFCOMM_V24_FC;
553                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
554         }
555         rfcomm_schedule();
556 }
557 
558 /*
559    Set/get modem status functions use _local_ status i.e. what we report
560    to the other side.
561    Remote status is provided by dlc->modem_status() callback.
562  */
563 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
564 {
565         BT_DBG("dlc %p state %ld v24_sig 0x%x",
566                         d, d->state, v24_sig);
567 
568         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
569                 v24_sig |= RFCOMM_V24_FC;
570         else
571                 v24_sig &= ~RFCOMM_V24_FC;
572 
573         d->v24_sig = v24_sig;
574 
575         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
576                 rfcomm_schedule();
577 
578         return 0;
579 }
580 
581 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
582 {
583         BT_DBG("dlc %p state %ld v24_sig 0x%x",
584                         d, d->state, d->v24_sig);
585 
586         *v24_sig = d->v24_sig;
587         return 0;
588 }
589 
590 /* ---- RFCOMM sessions ---- */
591 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
592 {
593         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
594 
595         if (!s)
596                 return NULL;
597 
598         BT_DBG("session %p sock %p", s, sock);
599 
600         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
601 
602         INIT_LIST_HEAD(&s->dlcs);
603         s->state = state;
604         s->sock  = sock;
605 
606         s->mtu = RFCOMM_DEFAULT_MTU;
607         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
608 
609         /* Do not increment module usage count for listening sessions.
610          * Otherwise we won't be able to unload the module. */
611         if (state != BT_LISTEN)
612                 if (!try_module_get(THIS_MODULE)) {
613                         kfree(s);
614                         return NULL;
615                 }
616 
617         list_add(&s->list, &session_list);
618 
619         return s;
620 }
621 
622 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
623 {
624         int state = s->state;
625 
626         BT_DBG("session %p state %ld", s, s->state);
627 
628         list_del(&s->list);
629 
630         rfcomm_session_clear_timer(s);
631         sock_release(s->sock);
632         kfree(s);
633 
634         if (state != BT_LISTEN)
635                 module_put(THIS_MODULE);
636 
637         return NULL;
638 }
639 
640 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
641 {
642         struct rfcomm_session *s;
643         struct list_head *p, *n;
644         struct l2cap_chan *chan;
645         list_for_each_safe(p, n, &session_list) {
646                 s = list_entry(p, struct rfcomm_session, list);
647                 chan = l2cap_pi(s->sock->sk)->chan;
648 
649                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
650                     !bacmp(&chan->dst, dst))
651                         return s;
652         }
653         return NULL;
654 }
655 
656 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
657                                                    int err)
658 {
659         struct rfcomm_dlc *d;
660         struct list_head *p, *n;
661 
662         s->state = BT_CLOSED;
663 
664         BT_DBG("session %p state %ld err %d", s, s->state, err);
665 
666         /* Close all dlcs */
667         list_for_each_safe(p, n, &s->dlcs) {
668                 d = list_entry(p, struct rfcomm_dlc, list);
669                 d->state = BT_CLOSED;
670                 __rfcomm_dlc_close(d, err);
671         }
672 
673         rfcomm_session_clear_timer(s);
674         return rfcomm_session_del(s);
675 }
676 
677 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
678                                                         bdaddr_t *dst,
679                                                         u8 sec_level,
680                                                         int *err)
681 {
682         struct rfcomm_session *s = NULL;
683         struct sockaddr_l2 addr;
684         struct socket *sock;
685         struct sock *sk;
686 
687         BT_DBG("%pMR -> %pMR", src, dst);
688 
689         *err = rfcomm_l2sock_create(&sock);
690         if (*err < 0)
691                 return NULL;
692 
693         bacpy(&addr.l2_bdaddr, src);
694         addr.l2_family = AF_BLUETOOTH;
695         addr.l2_psm    = 0;
696         addr.l2_cid    = 0;
697         addr.l2_bdaddr_type = BDADDR_BREDR;
698         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
699         if (*err < 0)
700                 goto failed;
701 
702         /* Set L2CAP options */
703         sk = sock->sk;
704         lock_sock(sk);
705         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
706         l2cap_pi(sk)->chan->sec_level = sec_level;
707         if (l2cap_ertm)
708                 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
709         release_sock(sk);
710 
711         s = rfcomm_session_add(sock, BT_BOUND);
712         if (!s) {
713                 *err = -ENOMEM;
714                 goto failed;
715         }
716 
717         s->initiator = 1;
718 
719         bacpy(&addr.l2_bdaddr, dst);
720         addr.l2_family = AF_BLUETOOTH;
721         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
722         addr.l2_cid    = 0;
723         addr.l2_bdaddr_type = BDADDR_BREDR;
724         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
725         if (*err == 0 || *err == -EINPROGRESS)
726                 return s;
727 
728         return rfcomm_session_del(s);
729 
730 failed:
731         sock_release(sock);
732         return NULL;
733 }
734 
735 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
736 {
737         struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
738         if (src)
739                 bacpy(src, &chan->src);
740         if (dst)
741                 bacpy(dst, &chan->dst);
742 }
743 
744 /* ---- RFCOMM frame sending ---- */
745 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
746 {
747         struct kvec iv = { data, len };
748         struct msghdr msg;
749 
750         BT_DBG("session %p len %d", s, len);
751 
752         memset(&msg, 0, sizeof(msg));
753 
754         return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
755 }
756 
757 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
758 {
759         BT_DBG("%p cmd %u", s, cmd->ctrl);
760 
761         return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
762 }
763 
764 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
765 {
766         struct rfcomm_cmd cmd;
767 
768         BT_DBG("%p dlci %d", s, dlci);
769 
770         cmd.addr = __addr(s->initiator, dlci);
771         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
772         cmd.len  = __len8(0);
773         cmd.fcs  = __fcs2((u8 *) &cmd);
774 
775         return rfcomm_send_cmd(s, &cmd);
776 }
777 
778 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
779 {
780         struct rfcomm_cmd cmd;
781 
782         BT_DBG("%p dlci %d", s, dlci);
783 
784         cmd.addr = __addr(!s->initiator, dlci);
785         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
786         cmd.len  = __len8(0);
787         cmd.fcs  = __fcs2((u8 *) &cmd);
788 
789         return rfcomm_send_cmd(s, &cmd);
790 }
791 
792 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
793 {
794         struct rfcomm_cmd cmd;
795 
796         BT_DBG("%p dlci %d", s, dlci);
797 
798         cmd.addr = __addr(s->initiator, dlci);
799         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
800         cmd.len  = __len8(0);
801         cmd.fcs  = __fcs2((u8 *) &cmd);
802 
803         return rfcomm_send_cmd(s, &cmd);
804 }
805 
806 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
807 {
808         struct rfcomm_cmd *cmd;
809         struct sk_buff *skb;
810 
811         BT_DBG("dlc %p dlci %d", d, d->dlci);
812 
813         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
814         if (!skb)
815                 return -ENOMEM;
816 
817         cmd = (void *) __skb_put(skb, sizeof(*cmd));
818         cmd->addr = d->addr;
819         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
820         cmd->len  = __len8(0);
821         cmd->fcs  = __fcs2((u8 *) cmd);
822 
823         skb_queue_tail(&d->tx_queue, skb);
824         rfcomm_schedule();
825         return 0;
826 }
827 
828 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
829 {
830         struct rfcomm_cmd cmd;
831 
832         BT_DBG("%p dlci %d", s, dlci);
833 
834         cmd.addr = __addr(!s->initiator, dlci);
835         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
836         cmd.len  = __len8(0);
837         cmd.fcs  = __fcs2((u8 *) &cmd);
838 
839         return rfcomm_send_cmd(s, &cmd);
840 }
841 
842 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
843 {
844         struct rfcomm_hdr *hdr;
845         struct rfcomm_mcc *mcc;
846         u8 buf[16], *ptr = buf;
847 
848         BT_DBG("%p cr %d type %d", s, cr, type);
849 
850         hdr = (void *) ptr; ptr += sizeof(*hdr);
851         hdr->addr = __addr(s->initiator, 0);
852         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
853         hdr->len  = __len8(sizeof(*mcc) + 1);
854 
855         mcc = (void *) ptr; ptr += sizeof(*mcc);
856         mcc->type = __mcc_type(cr, RFCOMM_NSC);
857         mcc->len  = __len8(1);
858 
859         /* Type that we didn't like */
860         *ptr = __mcc_type(cr, type); ptr++;
861 
862         *ptr = __fcs(buf); ptr++;
863 
864         return rfcomm_send_frame(s, buf, ptr - buf);
865 }
866 
867 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
868 {
869         struct rfcomm_hdr *hdr;
870         struct rfcomm_mcc *mcc;
871         struct rfcomm_pn  *pn;
872         u8 buf[16], *ptr = buf;
873 
874         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
875 
876         hdr = (void *) ptr; ptr += sizeof(*hdr);
877         hdr->addr = __addr(s->initiator, 0);
878         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
879         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
880 
881         mcc = (void *) ptr; ptr += sizeof(*mcc);
882         mcc->type = __mcc_type(cr, RFCOMM_PN);
883         mcc->len  = __len8(sizeof(*pn));
884 
885         pn = (void *) ptr; ptr += sizeof(*pn);
886         pn->dlci        = d->dlci;
887         pn->priority    = d->priority;
888         pn->ack_timer   = 0;
889         pn->max_retrans = 0;
890 
891         if (s->cfc) {
892                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
893                 pn->credits = RFCOMM_DEFAULT_CREDITS;
894         } else {
895                 pn->flow_ctrl = 0;
896                 pn->credits   = 0;
897         }
898 
899         if (cr && channel_mtu >= 0)
900                 pn->mtu = cpu_to_le16(channel_mtu);
901         else
902                 pn->mtu = cpu_to_le16(d->mtu);
903 
904         *ptr = __fcs(buf); ptr++;
905 
906         return rfcomm_send_frame(s, buf, ptr - buf);
907 }
908 
909 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
910                         u8 bit_rate, u8 data_bits, u8 stop_bits,
911                         u8 parity, u8 flow_ctrl_settings,
912                         u8 xon_char, u8 xoff_char, u16 param_mask)
913 {
914         struct rfcomm_hdr *hdr;
915         struct rfcomm_mcc *mcc;
916         struct rfcomm_rpn *rpn;
917         u8 buf[16], *ptr = buf;
918 
919         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
920                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
921                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
922                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
923 
924         hdr = (void *) ptr; ptr += sizeof(*hdr);
925         hdr->addr = __addr(s->initiator, 0);
926         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
927         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
928 
929         mcc = (void *) ptr; ptr += sizeof(*mcc);
930         mcc->type = __mcc_type(cr, RFCOMM_RPN);
931         mcc->len  = __len8(sizeof(*rpn));
932 
933         rpn = (void *) ptr; ptr += sizeof(*rpn);
934         rpn->dlci          = __addr(1, dlci);
935         rpn->bit_rate      = bit_rate;
936         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
937         rpn->flow_ctrl     = flow_ctrl_settings;
938         rpn->xon_char      = xon_char;
939         rpn->xoff_char     = xoff_char;
940         rpn->param_mask    = cpu_to_le16(param_mask);
941 
942         *ptr = __fcs(buf); ptr++;
943 
944         return rfcomm_send_frame(s, buf, ptr - buf);
945 }
946 
947 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
948 {
949         struct rfcomm_hdr *hdr;
950         struct rfcomm_mcc *mcc;
951         struct rfcomm_rls *rls;
952         u8 buf[16], *ptr = buf;
953 
954         BT_DBG("%p cr %d status 0x%x", s, cr, status);
955 
956         hdr = (void *) ptr; ptr += sizeof(*hdr);
957         hdr->addr = __addr(s->initiator, 0);
958         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
959         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
960 
961         mcc = (void *) ptr; ptr += sizeof(*mcc);
962         mcc->type = __mcc_type(cr, RFCOMM_RLS);
963         mcc->len  = __len8(sizeof(*rls));
964 
965         rls = (void *) ptr; ptr += sizeof(*rls);
966         rls->dlci   = __addr(1, dlci);
967         rls->status = status;
968 
969         *ptr = __fcs(buf); ptr++;
970 
971         return rfcomm_send_frame(s, buf, ptr - buf);
972 }
973 
974 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
975 {
976         struct rfcomm_hdr *hdr;
977         struct rfcomm_mcc *mcc;
978         struct rfcomm_msc *msc;
979         u8 buf[16], *ptr = buf;
980 
981         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
982 
983         hdr = (void *) ptr; ptr += sizeof(*hdr);
984         hdr->addr = __addr(s->initiator, 0);
985         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
986         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
987 
988         mcc = (void *) ptr; ptr += sizeof(*mcc);
989         mcc->type = __mcc_type(cr, RFCOMM_MSC);
990         mcc->len  = __len8(sizeof(*msc));
991 
992         msc = (void *) ptr; ptr += sizeof(*msc);
993         msc->dlci    = __addr(1, dlci);
994         msc->v24_sig = v24_sig | 0x01;
995 
996         *ptr = __fcs(buf); ptr++;
997 
998         return rfcomm_send_frame(s, buf, ptr - buf);
999 }
1000 
1001 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1002 {
1003         struct rfcomm_hdr *hdr;
1004         struct rfcomm_mcc *mcc;
1005         u8 buf[16], *ptr = buf;
1006 
1007         BT_DBG("%p cr %d", s, cr);
1008 
1009         hdr = (void *) ptr; ptr += sizeof(*hdr);
1010         hdr->addr = __addr(s->initiator, 0);
1011         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1012         hdr->len  = __len8(sizeof(*mcc));
1013 
1014         mcc = (void *) ptr; ptr += sizeof(*mcc);
1015         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1016         mcc->len  = __len8(0);
1017 
1018         *ptr = __fcs(buf); ptr++;
1019 
1020         return rfcomm_send_frame(s, buf, ptr - buf);
1021 }
1022 
1023 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1024 {
1025         struct rfcomm_hdr *hdr;
1026         struct rfcomm_mcc *mcc;
1027         u8 buf[16], *ptr = buf;
1028 
1029         BT_DBG("%p cr %d", s, cr);
1030 
1031         hdr = (void *) ptr; ptr += sizeof(*hdr);
1032         hdr->addr = __addr(s->initiator, 0);
1033         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1034         hdr->len  = __len8(sizeof(*mcc));
1035 
1036         mcc = (void *) ptr; ptr += sizeof(*mcc);
1037         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1038         mcc->len  = __len8(0);
1039 
1040         *ptr = __fcs(buf); ptr++;
1041 
1042         return rfcomm_send_frame(s, buf, ptr - buf);
1043 }
1044 
1045 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1046 {
1047         struct socket *sock = s->sock;
1048         struct kvec iv[3];
1049         struct msghdr msg;
1050         unsigned char hdr[5], crc[1];
1051 
1052         if (len > 125)
1053                 return -EINVAL;
1054 
1055         BT_DBG("%p cr %d", s, cr);
1056 
1057         hdr[0] = __addr(s->initiator, 0);
1058         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1059         hdr[2] = 0x01 | ((len + 2) << 1);
1060         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1061         hdr[4] = 0x01 | (len << 1);
1062 
1063         crc[0] = __fcs(hdr);
1064 
1065         iv[0].iov_base = hdr;
1066         iv[0].iov_len  = 5;
1067         iv[1].iov_base = pattern;
1068         iv[1].iov_len  = len;
1069         iv[2].iov_base = crc;
1070         iv[2].iov_len  = 1;
1071 
1072         memset(&msg, 0, sizeof(msg));
1073 
1074         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1075 }
1076 
1077 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1078 {
1079         struct rfcomm_hdr *hdr;
1080         u8 buf[16], *ptr = buf;
1081 
1082         BT_DBG("%p addr %d credits %d", s, addr, credits);
1083 
1084         hdr = (void *) ptr; ptr += sizeof(*hdr);
1085         hdr->addr = addr;
1086         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1087         hdr->len  = __len8(0);
1088 
1089         *ptr = credits; ptr++;
1090 
1091         *ptr = __fcs(buf); ptr++;
1092 
1093         return rfcomm_send_frame(s, buf, ptr - buf);
1094 }
1095 
1096 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1097 {
1098         struct rfcomm_hdr *hdr;
1099         int len = skb->len;
1100         u8 *crc;
1101 
1102         if (len > 127) {
1103                 hdr = (void *) skb_push(skb, 4);
1104                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1105         } else {
1106                 hdr = (void *) skb_push(skb, 3);
1107                 hdr->len = __len8(len);
1108         }
1109         hdr->addr = addr;
1110         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1111 
1112         crc = skb_put(skb, 1);
1113         *crc = __fcs((void *) hdr);
1114 }
1115 
1116 /* ---- RFCOMM frame reception ---- */
1117 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1118 {
1119         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1120 
1121         if (dlci) {
1122                 /* Data channel */
1123                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1124                 if (!d) {
1125                         rfcomm_send_dm(s, dlci);
1126                         return s;
1127                 }
1128 
1129                 switch (d->state) {
1130                 case BT_CONNECT:
1131                         rfcomm_dlc_clear_timer(d);
1132 
1133                         rfcomm_dlc_lock(d);
1134                         d->state = BT_CONNECTED;
1135                         d->state_change(d, 0);
1136                         rfcomm_dlc_unlock(d);
1137 
1138                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1139                         break;
1140 
1141                 case BT_DISCONN:
1142                         d->state = BT_CLOSED;
1143                         __rfcomm_dlc_close(d, 0);
1144 
1145                         if (list_empty(&s->dlcs)) {
1146                                 s->state = BT_DISCONN;
1147                                 rfcomm_send_disc(s, 0);
1148                                 rfcomm_session_clear_timer(s);
1149                         }
1150 
1151                         break;
1152                 }
1153         } else {
1154                 /* Control channel */
1155                 switch (s->state) {
1156                 case BT_CONNECT:
1157                         s->state = BT_CONNECTED;
1158                         rfcomm_process_connect(s);
1159                         break;
1160 
1161                 case BT_DISCONN:
1162                         s = rfcomm_session_close(s, ECONNRESET);
1163                         break;
1164                 }
1165         }
1166         return s;
1167 }
1168 
1169 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1170 {
1171         int err = 0;
1172 
1173         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1174 
1175         if (dlci) {
1176                 /* Data DLC */
1177                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1178                 if (d) {
1179                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1180                                 err = ECONNREFUSED;
1181                         else
1182                                 err = ECONNRESET;
1183 
1184                         d->state = BT_CLOSED;
1185                         __rfcomm_dlc_close(d, err);
1186                 }
1187         } else {
1188                 if (s->state == BT_CONNECT)
1189                         err = ECONNREFUSED;
1190                 else
1191                         err = ECONNRESET;
1192 
1193                 s = rfcomm_session_close(s, err);
1194         }
1195         return s;
1196 }
1197 
1198 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1199                                                u8 dlci)
1200 {
1201         int err = 0;
1202 
1203         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1204 
1205         if (dlci) {
1206                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1207                 if (d) {
1208                         rfcomm_send_ua(s, dlci);
1209 
1210                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1211                                 err = ECONNREFUSED;
1212                         else
1213                                 err = ECONNRESET;
1214 
1215                         d->state = BT_CLOSED;
1216                         __rfcomm_dlc_close(d, err);
1217                 } else
1218                         rfcomm_send_dm(s, dlci);
1219 
1220         } else {
1221                 rfcomm_send_ua(s, 0);
1222 
1223                 if (s->state == BT_CONNECT)
1224                         err = ECONNREFUSED;
1225                 else
1226                         err = ECONNRESET;
1227 
1228                 s = rfcomm_session_close(s, err);
1229         }
1230         return s;
1231 }
1232 
1233 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1234 {
1235         struct sock *sk = d->session->sock->sk;
1236         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1237 
1238         BT_DBG("dlc %p", d);
1239 
1240         rfcomm_send_ua(d->session, d->dlci);
1241 
1242         rfcomm_dlc_clear_timer(d);
1243 
1244         rfcomm_dlc_lock(d);
1245         d->state = BT_CONNECTED;
1246         d->state_change(d, 0);
1247         rfcomm_dlc_unlock(d);
1248 
1249         if (d->role_switch)
1250                 hci_conn_switch_role(conn->hcon, 0x00);
1251 
1252         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1253 }
1254 
1255 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1256 {
1257         if (rfcomm_check_security(d)) {
1258                 if (d->defer_setup) {
1259                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1260                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1261 
1262                         rfcomm_dlc_lock(d);
1263                         d->state = BT_CONNECT2;
1264                         d->state_change(d, 0);
1265                         rfcomm_dlc_unlock(d);
1266                 } else
1267                         rfcomm_dlc_accept(d);
1268         } else {
1269                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1270                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1271         }
1272 }
1273 
1274 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1275 {
1276         struct rfcomm_dlc *d;
1277         u8 channel;
1278 
1279         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1280 
1281         if (!dlci) {
1282                 rfcomm_send_ua(s, 0);
1283 
1284                 if (s->state == BT_OPEN) {
1285                         s->state = BT_CONNECTED;
1286                         rfcomm_process_connect(s);
1287                 }
1288                 return 0;
1289         }
1290 
1291         /* Check if DLC exists */
1292         d = rfcomm_dlc_get(s, dlci);
1293         if (d) {
1294                 if (d->state == BT_OPEN) {
1295                         /* DLC was previously opened by PN request */
1296                         rfcomm_check_accept(d);
1297                 }
1298                 return 0;
1299         }
1300 
1301         /* Notify socket layer about incoming connection */
1302         channel = __srv_channel(dlci);
1303         if (rfcomm_connect_ind(s, channel, &d)) {
1304                 d->dlci = dlci;
1305                 d->addr = __addr(s->initiator, dlci);
1306                 rfcomm_dlc_link(s, d);
1307 
1308                 rfcomm_check_accept(d);
1309         } else {
1310                 rfcomm_send_dm(s, dlci);
1311         }
1312 
1313         return 0;
1314 }
1315 
1316 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1317 {
1318         struct rfcomm_session *s = d->session;
1319 
1320         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1321                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1322 
1323         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1324                                                 pn->flow_ctrl == 0xe0) {
1325                 d->cfc = RFCOMM_CFC_ENABLED;
1326                 d->tx_credits = pn->credits;
1327         } else {
1328                 d->cfc = RFCOMM_CFC_DISABLED;
1329                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1330         }
1331 
1332         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1333                 s->cfc = d->cfc;
1334 
1335         d->priority = pn->priority;
1336 
1337         d->mtu = __le16_to_cpu(pn->mtu);
1338 
1339         if (cr && d->mtu > s->mtu)
1340                 d->mtu = s->mtu;
1341 
1342         return 0;
1343 }
1344 
1345 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1346 {
1347         struct rfcomm_pn *pn = (void *) skb->data;
1348         struct rfcomm_dlc *d;
1349         u8 dlci = pn->dlci;
1350 
1351         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1352 
1353         if (!dlci)
1354                 return 0;
1355 
1356         d = rfcomm_dlc_get(s, dlci);
1357         if (d) {
1358                 if (cr) {
1359                         /* PN request */
1360                         rfcomm_apply_pn(d, cr, pn);
1361                         rfcomm_send_pn(s, 0, d);
1362                 } else {
1363                         /* PN response */
1364                         switch (d->state) {
1365                         case BT_CONFIG:
1366                                 rfcomm_apply_pn(d, cr, pn);
1367 
1368                                 d->state = BT_CONNECT;
1369                                 rfcomm_send_sabm(s, d->dlci);
1370                                 break;
1371                         }
1372                 }
1373         } else {
1374                 u8 channel = __srv_channel(dlci);
1375 
1376                 if (!cr)
1377                         return 0;
1378 
1379                 /* PN request for non existing DLC.
1380                  * Assume incoming connection. */
1381                 if (rfcomm_connect_ind(s, channel, &d)) {
1382                         d->dlci = dlci;
1383                         d->addr = __addr(s->initiator, dlci);
1384                         rfcomm_dlc_link(s, d);
1385 
1386                         rfcomm_apply_pn(d, cr, pn);
1387 
1388                         d->state = BT_OPEN;
1389                         rfcomm_send_pn(s, 0, d);
1390                 } else {
1391                         rfcomm_send_dm(s, dlci);
1392                 }
1393         }
1394         return 0;
1395 }
1396 
1397 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1398 {
1399         struct rfcomm_rpn *rpn = (void *) skb->data;
1400         u8 dlci = __get_dlci(rpn->dlci);
1401 
1402         u8 bit_rate  = 0;
1403         u8 data_bits = 0;
1404         u8 stop_bits = 0;
1405         u8 parity    = 0;
1406         u8 flow_ctrl = 0;
1407         u8 xon_char  = 0;
1408         u8 xoff_char = 0;
1409         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1410 
1411         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1412                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1413                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1414 
1415         if (!cr)
1416                 return 0;
1417 
1418         if (len == 1) {
1419                 /* This is a request, return default (according to ETSI TS 07.10) settings */
1420                 bit_rate  = RFCOMM_RPN_BR_9600;
1421                 data_bits = RFCOMM_RPN_DATA_8;
1422                 stop_bits = RFCOMM_RPN_STOP_1;
1423                 parity    = RFCOMM_RPN_PARITY_NONE;
1424                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1425                 xon_char  = RFCOMM_RPN_XON_CHAR;
1426                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1427                 goto rpn_out;
1428         }
1429 
1430         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1431          * no parity, no flow control lines, normal XON/XOFF chars */
1432 
1433         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1434                 bit_rate = rpn->bit_rate;
1435                 if (bit_rate > RFCOMM_RPN_BR_230400) {
1436                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1437                         bit_rate = RFCOMM_RPN_BR_9600;
1438                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1439                 }
1440         }
1441 
1442         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1443                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1444                 if (data_bits != RFCOMM_RPN_DATA_8) {
1445                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1446                         data_bits = RFCOMM_RPN_DATA_8;
1447                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1448                 }
1449         }
1450 
1451         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1452                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1453                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1454                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1455                         stop_bits = RFCOMM_RPN_STOP_1;
1456                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1457                 }
1458         }
1459 
1460         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1461                 parity = __get_rpn_parity(rpn->line_settings);
1462                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1463                         BT_DBG("RPN parity mismatch 0x%x", parity);
1464                         parity = RFCOMM_RPN_PARITY_NONE;
1465                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1466                 }
1467         }
1468 
1469         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1470                 flow_ctrl = rpn->flow_ctrl;
1471                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1472                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1473                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1474                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1475                 }
1476         }
1477 
1478         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1479                 xon_char = rpn->xon_char;
1480                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1481                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1482                         xon_char = RFCOMM_RPN_XON_CHAR;
1483                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1484                 }
1485         }
1486 
1487         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1488                 xoff_char = rpn->xoff_char;
1489                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1490                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1491                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1492                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1493                 }
1494         }
1495 
1496 rpn_out:
1497         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1498                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1499 
1500         return 0;
1501 }
1502 
1503 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1504 {
1505         struct rfcomm_rls *rls = (void *) skb->data;
1506         u8 dlci = __get_dlci(rls->dlci);
1507 
1508         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1509 
1510         if (!cr)
1511                 return 0;
1512 
1513         /* We should probably do something with this information here. But
1514          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1515          * mandatory to recognise and respond to RLS */
1516 
1517         rfcomm_send_rls(s, 0, dlci, rls->status);
1518 
1519         return 0;
1520 }
1521 
1522 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1523 {
1524         struct rfcomm_msc *msc = (void *) skb->data;
1525         struct rfcomm_dlc *d;
1526         u8 dlci = __get_dlci(msc->dlci);
1527 
1528         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1529 
1530         d = rfcomm_dlc_get(s, dlci);
1531         if (!d)
1532                 return 0;
1533 
1534         if (cr) {
1535                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1536                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1537                 else
1538                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1539 
1540                 rfcomm_dlc_lock(d);
1541 
1542                 d->remote_v24_sig = msc->v24_sig;
1543 
1544                 if (d->modem_status)
1545                         d->modem_status(d, msc->v24_sig);
1546 
1547                 rfcomm_dlc_unlock(d);
1548 
1549                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1550 
1551                 d->mscex |= RFCOMM_MSCEX_RX;
1552         } else
1553                 d->mscex |= RFCOMM_MSCEX_TX;
1554 
1555         return 0;
1556 }
1557 
1558 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1559 {
1560         struct rfcomm_mcc *mcc = (void *) skb->data;
1561         u8 type, cr, len;
1562 
1563         cr   = __test_cr(mcc->type);
1564         type = __get_mcc_type(mcc->type);
1565         len  = __get_mcc_len(mcc->len);
1566 
1567         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1568 
1569         skb_pull(skb, 2);
1570 
1571         switch (type) {
1572         case RFCOMM_PN:
1573                 rfcomm_recv_pn(s, cr, skb);
1574                 break;
1575 
1576         case RFCOMM_RPN:
1577                 rfcomm_recv_rpn(s, cr, len, skb);
1578                 break;
1579 
1580         case RFCOMM_RLS:
1581                 rfcomm_recv_rls(s, cr, skb);
1582                 break;
1583 
1584         case RFCOMM_MSC:
1585                 rfcomm_recv_msc(s, cr, skb);
1586                 break;
1587 
1588         case RFCOMM_FCOFF:
1589                 if (cr) {
1590                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1591                         rfcomm_send_fcoff(s, 0);
1592                 }
1593                 break;
1594 
1595         case RFCOMM_FCON:
1596                 if (cr) {
1597                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1598                         rfcomm_send_fcon(s, 0);
1599                 }
1600                 break;
1601 
1602         case RFCOMM_TEST:
1603                 if (cr)
1604                         rfcomm_send_test(s, 0, skb->data, skb->len);
1605                 break;
1606 
1607         case RFCOMM_NSC:
1608                 break;
1609 
1610         default:
1611                 BT_ERR("Unknown control type 0x%02x", type);
1612                 rfcomm_send_nsc(s, cr, type);
1613                 break;
1614         }
1615         return 0;
1616 }
1617 
1618 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1619 {
1620         struct rfcomm_dlc *d;
1621 
1622         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1623 
1624         d = rfcomm_dlc_get(s, dlci);
1625         if (!d) {
1626                 rfcomm_send_dm(s, dlci);
1627                 goto drop;
1628         }
1629 
1630         if (pf && d->cfc) {
1631                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1632 
1633                 d->tx_credits += credits;
1634                 if (d->tx_credits)
1635                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1636         }
1637 
1638         if (skb->len && d->state == BT_CONNECTED) {
1639                 rfcomm_dlc_lock(d);
1640                 d->rx_credits--;
1641                 d->data_ready(d, skb);
1642                 rfcomm_dlc_unlock(d);
1643                 return 0;
1644         }
1645 
1646 drop:
1647         kfree_skb(skb);
1648         return 0;
1649 }
1650 
1651 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1652                                                 struct sk_buff *skb)
1653 {
1654         struct rfcomm_hdr *hdr = (void *) skb->data;
1655         u8 type, dlci, fcs;
1656 
1657         if (!s) {
1658                 /* no session, so free socket data */
1659                 kfree_skb(skb);
1660                 return s;
1661         }
1662 
1663         dlci = __get_dlci(hdr->addr);
1664         type = __get_type(hdr->ctrl);
1665 
1666         /* Trim FCS */
1667         skb->len--; skb->tail--;
1668         fcs = *(u8 *)skb_tail_pointer(skb);
1669 
1670         if (__check_fcs(skb->data, type, fcs)) {
1671                 BT_ERR("bad checksum in packet");
1672                 kfree_skb(skb);
1673                 return s;
1674         }
1675 
1676         if (__test_ea(hdr->len))
1677                 skb_pull(skb, 3);
1678         else
1679                 skb_pull(skb, 4);
1680 
1681         switch (type) {
1682         case RFCOMM_SABM:
1683                 if (__test_pf(hdr->ctrl))
1684                         rfcomm_recv_sabm(s, dlci);
1685                 break;
1686 
1687         case RFCOMM_DISC:
1688                 if (__test_pf(hdr->ctrl))
1689                         s = rfcomm_recv_disc(s, dlci);
1690                 break;
1691 
1692         case RFCOMM_UA:
1693                 if (__test_pf(hdr->ctrl))
1694                         s = rfcomm_recv_ua(s, dlci);
1695                 break;
1696 
1697         case RFCOMM_DM:
1698                 s = rfcomm_recv_dm(s, dlci);
1699                 break;
1700 
1701         case RFCOMM_UIH:
1702                 if (dlci) {
1703                         rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1704                         return s;
1705                 }
1706                 rfcomm_recv_mcc(s, skb);
1707                 break;
1708 
1709         default:
1710                 BT_ERR("Unknown packet type 0x%02x", type);
1711                 break;
1712         }
1713         kfree_skb(skb);
1714         return s;
1715 }
1716 
1717 /* ---- Connection and data processing ---- */
1718 
1719 static void rfcomm_process_connect(struct rfcomm_session *s)
1720 {
1721         struct rfcomm_dlc *d;
1722         struct list_head *p, *n;
1723 
1724         BT_DBG("session %p state %ld", s, s->state);
1725 
1726         list_for_each_safe(p, n, &s->dlcs) {
1727                 d = list_entry(p, struct rfcomm_dlc, list);
1728                 if (d->state == BT_CONFIG) {
1729                         d->mtu = s->mtu;
1730                         if (rfcomm_check_security(d)) {
1731                                 rfcomm_send_pn(s, 1, d);
1732                         } else {
1733                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1734                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1735                         }
1736                 }
1737         }
1738 }
1739 
1740 /* Send data queued for the DLC.
1741  * Return number of frames left in the queue.
1742  */
1743 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1744 {
1745         struct sk_buff *skb;
1746         int err;
1747 
1748         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1749                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1750 
1751         /* Send pending MSC */
1752         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1753                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1754 
1755         if (d->cfc) {
1756                 /* CFC enabled.
1757                  * Give them some credits */
1758                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1759                                 d->rx_credits <= (d->cfc >> 2)) {
1760                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1761                         d->rx_credits = d->cfc;
1762                 }
1763         } else {
1764                 /* CFC disabled.
1765                  * Give ourselves some credits */
1766                 d->tx_credits = 5;
1767         }
1768 
1769         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1770                 return skb_queue_len(&d->tx_queue);
1771 
1772         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1773                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1774                 if (err < 0) {
1775                         skb_queue_head(&d->tx_queue, skb);
1776                         break;
1777                 }
1778                 kfree_skb(skb);
1779                 d->tx_credits--;
1780         }
1781 
1782         if (d->cfc && !d->tx_credits) {
1783                 /* We're out of TX credits.
1784                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1785                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1786         }
1787 
1788         return skb_queue_len(&d->tx_queue);
1789 }
1790 
1791 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1792 {
1793         struct rfcomm_dlc *d;
1794         struct list_head *p, *n;
1795 
1796         BT_DBG("session %p state %ld", s, s->state);
1797 
1798         list_for_each_safe(p, n, &s->dlcs) {
1799                 d = list_entry(p, struct rfcomm_dlc, list);
1800 
1801                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1802                         __rfcomm_dlc_close(d, ETIMEDOUT);
1803                         continue;
1804                 }
1805 
1806                 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1807                         __rfcomm_dlc_close(d, ECONNREFUSED);
1808                         continue;
1809                 }
1810 
1811                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1812                         rfcomm_dlc_clear_timer(d);
1813                         if (d->out) {
1814                                 rfcomm_send_pn(s, 1, d);
1815                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1816                         } else {
1817                                 if (d->defer_setup) {
1818                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1819                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1820 
1821                                         rfcomm_dlc_lock(d);
1822                                         d->state = BT_CONNECT2;
1823                                         d->state_change(d, 0);
1824                                         rfcomm_dlc_unlock(d);
1825                                 } else
1826                                         rfcomm_dlc_accept(d);
1827                         }
1828                         continue;
1829                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1830                         rfcomm_dlc_clear_timer(d);
1831                         if (!d->out)
1832                                 rfcomm_send_dm(s, d->dlci);
1833                         else
1834                                 d->state = BT_CLOSED;
1835                         __rfcomm_dlc_close(d, ECONNREFUSED);
1836                         continue;
1837                 }
1838 
1839                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1840                         continue;
1841 
1842                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1843                         continue;
1844 
1845                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1846                                                 d->mscex == RFCOMM_MSCEX_OK)
1847                         rfcomm_process_tx(d);
1848         }
1849 }
1850 
1851 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1852 {
1853         struct socket *sock = s->sock;
1854         struct sock *sk = sock->sk;
1855         struct sk_buff *skb;
1856 
1857         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1858 
1859         /* Get data directly from socket receive queue without copying it. */
1860         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1861                 skb_orphan(skb);
1862                 if (!skb_linearize(skb))
1863                         s = rfcomm_recv_frame(s, skb);
1864                 else
1865                         kfree_skb(skb);
1866         }
1867 
1868         if (s && (sk->sk_state == BT_CLOSED))
1869                 s = rfcomm_session_close(s, sk->sk_err);
1870 
1871         return s;
1872 }
1873 
1874 static void rfcomm_accept_connection(struct rfcomm_session *s)
1875 {
1876         struct socket *sock = s->sock, *nsock;
1877         int err;
1878 
1879         /* Fast check for a new connection.
1880          * Avoids unnesesary socket allocations. */
1881         if (list_empty(&bt_sk(sock->sk)->accept_q))
1882                 return;
1883 
1884         BT_DBG("session %p", s);
1885 
1886         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1887         if (err < 0)
1888                 return;
1889 
1890         /* Set our callbacks */
1891         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1892         nsock->sk->sk_state_change = rfcomm_l2state_change;
1893 
1894         s = rfcomm_session_add(nsock, BT_OPEN);
1895         if (s) {
1896                 /* We should adjust MTU on incoming sessions.
1897                  * L2CAP MTU minus UIH header and FCS. */
1898                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1899                                 l2cap_pi(nsock->sk)->chan->imtu) - 5;
1900 
1901                 rfcomm_schedule();
1902         } else
1903                 sock_release(nsock);
1904 }
1905 
1906 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1907 {
1908         struct sock *sk = s->sock->sk;
1909 
1910         BT_DBG("%p state %ld", s, s->state);
1911 
1912         switch (sk->sk_state) {
1913         case BT_CONNECTED:
1914                 s->state = BT_CONNECT;
1915 
1916                 /* We can adjust MTU on outgoing sessions.
1917                  * L2CAP MTU minus UIH header and FCS. */
1918                 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1919 
1920                 rfcomm_send_sabm(s, 0);
1921                 break;
1922 
1923         case BT_CLOSED:
1924                 s = rfcomm_session_close(s, sk->sk_err);
1925                 break;
1926         }
1927         return s;
1928 }
1929 
1930 static void rfcomm_process_sessions(void)
1931 {
1932         struct list_head *p, *n;
1933 
1934         rfcomm_lock();
1935 
1936         list_for_each_safe(p, n, &session_list) {
1937                 struct rfcomm_session *s;
1938                 s = list_entry(p, struct rfcomm_session, list);
1939 
1940                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1941                         s->state = BT_DISCONN;
1942                         rfcomm_send_disc(s, 0);
1943                         continue;
1944                 }
1945 
1946                 if (s->state == BT_LISTEN) {
1947                         rfcomm_accept_connection(s);
1948                         continue;
1949                 }
1950 
1951                 switch (s->state) {
1952                 case BT_BOUND:
1953                         s = rfcomm_check_connection(s);
1954                         break;
1955 
1956                 default:
1957                         s = rfcomm_process_rx(s);
1958                         break;
1959                 }
1960 
1961                 if (s)
1962                         rfcomm_process_dlcs(s);
1963         }
1964 
1965         rfcomm_unlock();
1966 }
1967 
1968 static int rfcomm_add_listener(bdaddr_t *ba)
1969 {
1970         struct sockaddr_l2 addr;
1971         struct socket *sock;
1972         struct sock *sk;
1973         struct rfcomm_session *s;
1974         int    err = 0;
1975 
1976         /* Create socket */
1977         err = rfcomm_l2sock_create(&sock);
1978         if (err < 0) {
1979                 BT_ERR("Create socket failed %d", err);
1980                 return err;
1981         }
1982 
1983         /* Bind socket */
1984         bacpy(&addr.l2_bdaddr, ba);
1985         addr.l2_family = AF_BLUETOOTH;
1986         addr.l2_psm    = __constant_cpu_to_le16(RFCOMM_PSM);
1987         addr.l2_cid    = 0;
1988         addr.l2_bdaddr_type = BDADDR_BREDR;
1989         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1990         if (err < 0) {
1991                 BT_ERR("Bind failed %d", err);
1992                 goto failed;
1993         }
1994 
1995         /* Set L2CAP options */
1996         sk = sock->sk;
1997         lock_sock(sk);
1998         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
1999         release_sock(sk);
2000 
2001         /* Start listening on the socket */
2002         err = kernel_listen(sock, 10);
2003         if (err) {
2004                 BT_ERR("Listen failed %d", err);
2005                 goto failed;
2006         }
2007 
2008         /* Add listening session */
2009         s = rfcomm_session_add(sock, BT_LISTEN);
2010         if (!s) {
2011                 err = -ENOMEM;
2012                 goto failed;
2013         }
2014 
2015         return 0;
2016 failed:
2017         sock_release(sock);
2018         return err;
2019 }
2020 
2021 static void rfcomm_kill_listener(void)
2022 {
2023         struct rfcomm_session *s;
2024         struct list_head *p, *n;
2025 
2026         BT_DBG("");
2027 
2028         list_for_each_safe(p, n, &session_list) {
2029                 s = list_entry(p, struct rfcomm_session, list);
2030                 rfcomm_session_del(s);
2031         }
2032 }
2033 
2034 static int rfcomm_run(void *unused)
2035 {
2036         BT_DBG("");
2037 
2038         set_user_nice(current, -10);
2039 
2040         rfcomm_add_listener(BDADDR_ANY);
2041 
2042         while (1) {
2043                 set_current_state(TASK_INTERRUPTIBLE);
2044 
2045                 if (kthread_should_stop())
2046                         break;
2047 
2048                 /* Process stuff */
2049                 rfcomm_process_sessions();
2050 
2051                 schedule();
2052         }
2053         __set_current_state(TASK_RUNNING);
2054 
2055         rfcomm_kill_listener();
2056 
2057         return 0;
2058 }
2059 
2060 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2061 {
2062         struct rfcomm_session *s;
2063         struct rfcomm_dlc *d;
2064         struct list_head *p, *n;
2065 
2066         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2067 
2068         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2069         if (!s)
2070                 return;
2071 
2072         list_for_each_safe(p, n, &s->dlcs) {
2073                 d = list_entry(p, struct rfcomm_dlc, list);
2074 
2075                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2076                         rfcomm_dlc_clear_timer(d);
2077                         if (status || encrypt == 0x00) {
2078                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2079                                 continue;
2080                         }
2081                 }
2082 
2083                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2084                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2085                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2086                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2087                                 continue;
2088                         } else if (d->sec_level == BT_SECURITY_HIGH) {
2089                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2090                                 continue;
2091                         }
2092                 }
2093 
2094                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2095                         continue;
2096 
2097                 if (!status && hci_conn_check_secure(conn, d->sec_level))
2098                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2099                 else
2100                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2101         }
2102 
2103         rfcomm_schedule();
2104 }
2105 
2106 static struct hci_cb rfcomm_cb = {
2107         .name           = "RFCOMM",
2108         .security_cfm   = rfcomm_security_cfm
2109 };
2110 
2111 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2112 {
2113         struct rfcomm_session *s;
2114 
2115         rfcomm_lock();
2116 
2117         list_for_each_entry(s, &session_list, list) {
2118                 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2119                 struct rfcomm_dlc *d;
2120                 list_for_each_entry(d, &s->dlcs, list) {
2121                         seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2122                                    &chan->src, &chan->dst,
2123                                    d->state, d->dlci, d->mtu,
2124                                    d->rx_credits, d->tx_credits);
2125                 }
2126         }
2127 
2128         rfcomm_unlock();
2129 
2130         return 0;
2131 }
2132 
2133 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2134 {
2135         return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2136 }
2137 
2138 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2139         .open           = rfcomm_dlc_debugfs_open,
2140         .read           = seq_read,
2141         .llseek         = seq_lseek,
2142         .release        = single_release,
2143 };
2144 
2145 static struct dentry *rfcomm_dlc_debugfs;
2146 
2147 /* ---- Initialization ---- */
2148 static int __init rfcomm_init(void)
2149 {
2150         int err;
2151 
2152         hci_register_cb(&rfcomm_cb);
2153 
2154         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2155         if (IS_ERR(rfcomm_thread)) {
2156                 err = PTR_ERR(rfcomm_thread);
2157                 goto unregister;
2158         }
2159 
2160         err = rfcomm_init_ttys();
2161         if (err < 0)
2162                 goto stop;
2163 
2164         err = rfcomm_init_sockets();
2165         if (err < 0)
2166                 goto cleanup;
2167 
2168         BT_INFO("RFCOMM ver %s", VERSION);
2169 
2170         if (IS_ERR_OR_NULL(bt_debugfs))
2171                 return 0;
2172 
2173         rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2174                                                  bt_debugfs, NULL,
2175                                                  &rfcomm_dlc_debugfs_fops);
2176 
2177         return 0;
2178 
2179 cleanup:
2180         rfcomm_cleanup_ttys();
2181 
2182 stop:
2183         kthread_stop(rfcomm_thread);
2184 
2185 unregister:
2186         hci_unregister_cb(&rfcomm_cb);
2187 
2188         return err;
2189 }
2190 
2191 static void __exit rfcomm_exit(void)
2192 {
2193         debugfs_remove(rfcomm_dlc_debugfs);
2194 
2195         hci_unregister_cb(&rfcomm_cb);
2196 
2197         kthread_stop(rfcomm_thread);
2198 
2199         rfcomm_cleanup_ttys();
2200 
2201         rfcomm_cleanup_sockets();
2202 }
2203 
2204 module_init(rfcomm_init);
2205 module_exit(rfcomm_exit);
2206 
2207 module_param(disable_cfc, bool, 0644);
2208 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2209 
2210 module_param(channel_mtu, int, 0644);
2211 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2212 
2213 module_param(l2cap_mtu, uint, 0644);
2214 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2215 
2216 module_param(l2cap_ertm, bool, 0644);
2217 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2218 
2219 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2220 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2221 MODULE_VERSION(VERSION);
2222 MODULE_LICENSE("GPL");
2223 MODULE_ALIAS("bt-proto-3");
2224 

This page was automatically generated by LXR 0.3.1 (source).  •  Linux is a registered trademark of Linus Torvalds  •  Contact us