kernel/net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/debugfs.h>
  30 #include <linux/kthread.h>
  31 #include <asm/unaligned.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35 #include <net/bluetooth/l2cap.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define VERSION "1.11"
  39
  40 static bool disable_cfc;
  41 static bool l2cap_ertm;
  42 static int channel_mtu = -1;
  43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  44
  45 static struct task_struct *rfcomm_thread;
  46
  47 static DEFINE_MUTEX(rfcomm_mutex);
  48 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  50
  51
  52 static LIST_HEAD(session_list);
  53
  54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  64
  65 static void rfcomm_process_connect(struct rfcomm_session *s);
  66
  67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
  68                                                         bdaddr_t *dst,
  69                                                         u8 sec_level,
  70                                                         int *err);
  71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  72 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
  73
  74 /* ---- RFCOMM frame parsing macros ---- */
  75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  76 #define __get_channel(b)  ((b & 0xf8) >> 3)
  77 #define __get_dir(b)      ((b & 0x04) >> 2)
  78 #define __get_type(b)     ((b & 0xef))
  79
  80 #define __test_ea(b)      ((b & 0x01))
  81 #define __test_cr(b)      (!!(b & 0x02))
  82 #define __test_pf(b)      (!!(b & 0x10))
  83
  84 #define __session_dir(s)  ((s)->initiator ? 0x00 : 0x01)
  85
  86 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  87 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  88 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  89 #define __srv_channel(dlci)    (dlci >> 1)
  90 #define __dir(dlci)            (dlci & 0x01)
  91
  92 #define __len8(len)       (((len) << 1) | 1)
  93 #define __len16(len)      ((len) << 1)
  94
  95 /* MCC macros */
  96 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
  97 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
  98 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
  99
 100 /* RPN macros */
 101 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 102 #define __get_rpn_data_bits(line) ((line) & 0x3)
 103 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 104 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 105
 106 static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
 107
 108 static void rfcomm_schedule(void)
 109 {
 110         wake_up_all(&rfcomm_wq);
 111 }
 112
 113 /* ---- RFCOMM FCS computation ---- */
 114
 115 /* reversed, 8-bit, poly=0x07 */
 116 static unsigned char rfcomm_crc_table[256] = {
 117         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 118         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 119         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 120         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 121
 122         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 123         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 124         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 125         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 126
 127         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 128         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 129         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 130         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 131
 132         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 133         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 134         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 135         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 136
 137         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 138         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 139         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 140         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 141
 142         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 143         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 144         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 145         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 146
 147         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 148         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 149         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 150         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 151
 152         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 153         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 154         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 155         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 156 };
 157
 158 /* CRC on 2 bytes */
 159 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 160
 161 /* FCS on 2 bytes */
 162 static inline u8 __fcs(u8 *data)
 163 {
 164         return 0xff - __crc(data);
 165 }
 166
 167 /* FCS on 3 bytes */
 168 static inline u8 __fcs2(u8 *data)
 169 {
 170         return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
 171 }
 172
 173 /* Check FCS */
 174 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 175 {
 176         u8 f = __crc(data);
 177
 178         if (type != RFCOMM_UIH)
 179                 f = rfcomm_crc_table[f ^ data[2]];
 180
 181         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 182 }
 183
 184 /* ---- L2CAP callbacks ---- */
 185 static void rfcomm_l2state_change(struct sock *sk)
 186 {
 187         BT_DBG("%p state %d", sk, sk->sk_state);
 188         rfcomm_schedule();
 189 }
 190
 191 static void rfcomm_l2data_ready(struct sock *sk)
 192 {
 193         BT_DBG("%p", sk);
 194         rfcomm_schedule();
 195 }
 196
 197 static int rfcomm_l2sock_create(struct socket **sock)
 198 {
 199         int err;
 200
 201         BT_DBG("");
 202
 203         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 204         if (!err) {
 205                 struct sock *sk = (*sock)->sk;
 206                 sk->sk_data_ready   = rfcomm_l2data_ready;
 207                 sk->sk_state_change = rfcomm_l2state_change;
 208         }
 209         return err;
 210 }
 211
 212 static int rfcomm_check_security(struct rfcomm_dlc *d)
 213 {
 214         struct sock *sk = d->session->sock->sk;
 215         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 216
 217         __u8 auth_type;
 218
 219         switch (d->sec_level) {
 220         case BT_SECURITY_HIGH:
 221         case BT_SECURITY_FIPS:
 222                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
 223                 break;
 224         case BT_SECURITY_MEDIUM:
 225                 auth_type = HCI_AT_GENERAL_BONDING;
 226                 break;
 227         default:
 228                 auth_type = HCI_AT_NO_BONDING;
 229                 break;
 230         }
 231
 232         return hci_conn_security(conn->hcon, d->sec_level, auth_type,
 233                                  d->out);
 234 }
 235
 236 static void rfcomm_session_timeout(unsigned long arg)
 237 {
 238         struct rfcomm_session *s = (void *) arg;
 239
 240         BT_DBG("session %p state %ld", s, s->state);
 241
 242         set_bit(RFCOMM_TIMED_OUT, &s->flags);
 243         rfcomm_schedule();
 244 }
 245
 246 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 247 {
 248         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 249
 250         mod_timer(&s->timer, jiffies + timeout);
 251 }
 252
 253 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 254 {
 255         BT_DBG("session %p state %ld", s, s->state);
 256
 257         del_timer_sync(&s->timer);
 258 }
 259
 260 /* ---- RFCOMM DLCs ---- */
 261 static void rfcomm_dlc_timeout(unsigned long arg)
 262 {
 263         struct rfcomm_dlc *d = (void *) arg;
 264
 265         BT_DBG("dlc %p state %ld", d, d->state);
 266
 267         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 268         rfcomm_dlc_put(d);
 269         rfcomm_schedule();
 270 }
 271
 272 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 273 {
 274         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 275
 276         if (!mod_timer(&d->timer, jiffies + timeout))
 277                 rfcomm_dlc_hold(d);
 278 }
 279
 280 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 281 {
 282         BT_DBG("dlc %p state %ld", d, d->state);
 283
 284         if (del_timer(&d->timer))
 285                 rfcomm_dlc_put(d);
 286 }
 287
 288 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 289 {
 290         BT_DBG("%p", d);
 291
 292         d->state      = BT_OPEN;
 293         d->flags      = 0;
 294         d->mscex      = 0;
 295         d->sec_level  = BT_SECURITY_LOW;
 296         d->mtu        = RFCOMM_DEFAULT_MTU;
 297         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 298
 299         d->cfc        = RFCOMM_CFC_DISABLED;
 300         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 301 }
 302
 303 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 304 {
 305         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 306
 307         if (!d)
 308                 return NULL;
 309
 310         setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
 311
 312         skb_queue_head_init(&d->tx_queue);
 313         mutex_init(&d->lock);
 314         atomic_set(&d->refcnt, 1);
 315
 316         rfcomm_dlc_clear_state(d);
 317
 318         BT_DBG("%p", d);
 319
 320         return d;
 321 }
 322
 323 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 324 {
 325         BT_DBG("%p", d);
 326
 327         skb_queue_purge(&d->tx_queue);
 328         kfree(d);
 329 }
 330
 331 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 332 {
 333         BT_DBG("dlc %p session %p", d, s);
 334
 335         rfcomm_session_clear_timer(s);
 336         rfcomm_dlc_hold(d);
 337         list_add(&d->list, &s->dlcs);
 338         d->session = s;
 339 }
 340
 341 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 342 {
 343         struct rfcomm_session *s = d->session;
 344
 345         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 346
 347         list_del(&d->list);
 348         d->session = NULL;
 349         rfcomm_dlc_put(d);
 350
 351         if (list_empty(&s->dlcs))
 352                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
 353 }
 354
 355 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 356 {
 357         struct rfcomm_dlc *d;
 358
 359         list_for_each_entry(d, &s->dlcs, list)
 360                 if (d->dlci == dlci)
 361                         return d;
 362
 363         return NULL;
 364 }
 365
 366 static int rfcomm_check_channel(u8 channel)
 367 {
 368         return channel < 1 || channel > 30;
 369 }
 370
 371 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 372 {
 373         struct rfcomm_session *s;
 374         int err = 0;
 375         u8 dlci;
 376
 377         BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
 378                d, d->state, src, dst, channel);
 379
 380         if (rfcomm_check_channel(channel))
 381                 return -EINVAL;
 382
 383         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 384                 return 0;
 385
 386         s = rfcomm_session_get(src, dst);
 387         if (!s) {
 388                 s = rfcomm_session_create(src, dst, d->sec_level, &err);
 389                 if (!s)
 390                         return err;
 391         }
 392
 393         dlci = __dlci(__session_dir(s), channel);
 394
 395         /* Check if DLCI already exists */
 396         if (rfcomm_dlc_get(s, dlci))
 397                 return -EBUSY;
 398
 399         rfcomm_dlc_clear_state(d);
 400
 401         d->dlci     = dlci;
 402         d->addr     = __addr(s->initiator, dlci);
 403         d->priority = 7;
 404
 405         d->state = BT_CONFIG;
 406         rfcomm_dlc_link(s, d);
 407
 408         d->out = 1;
 409
 410         d->mtu = s->mtu;
 411         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 412
 413         if (s->state == BT_CONNECTED) {
 414                 if (rfcomm_check_security(d))
 415                         rfcomm_send_pn(s, 1, d);
 416                 else
 417                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 418         }
 419
 420         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 421
 422         return 0;
 423 }
 424
 425 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 426 {
 427         int r;
 428
 429         rfcomm_lock();
 430
 431         r = __rfcomm_dlc_open(d, src, dst, channel);
 432
 433         rfcomm_unlock();
 434         return r;
 435 }
 436
 437 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
 438 {
 439         struct rfcomm_session *s = d->session;
 440
 441         d->state = BT_DISCONN;
 442         if (skb_queue_empty(&d->tx_queue)) {
 443                 rfcomm_send_disc(s, d->dlci);
 444                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 445         } else {
 446                 rfcomm_queue_disc(d);
 447                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 448         }
 449 }
 450
 451 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 452 {
 453         struct rfcomm_session *s = d->session;
 454         if (!s)
 455                 return 0;
 456
 457         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 458                         d, d->state, d->dlci, err, s);
 459
 460         switch (d->state) {
 461         case BT_CONNECT:
 462         case BT_CONFIG:
 463         case BT_OPEN:
 464         case BT_CONNECT2:
 465                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 466                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 467                         rfcomm_schedule();
 468                         return 0;
 469                 }
 470         }
 471
 472         switch (d->state) {
 473         case BT_CONNECT:
 474         case BT_CONNECTED:
 475                 __rfcomm_dlc_disconn(d);
 476                 break;
 477
 478         case BT_CONFIG:
 479                 if (s->state != BT_BOUND) {
 480                         __rfcomm_dlc_disconn(d);
 481                         break;
 482                 }
 483                 /* if closing a dlc in a session that hasn't been started,
 484                  * just close and unlink the dlc
 485                  */
 486
 487         default:
 488                 rfcomm_dlc_clear_timer(d);
 489
 490                 rfcomm_dlc_lock(d);
 491                 d->state = BT_CLOSED;
 492                 d->state_change(d, err);
 493                 rfcomm_dlc_unlock(d);
 494
 495                 skb_queue_purge(&d->tx_queue);
 496                 rfcomm_dlc_unlink(d);
 497         }
 498
 499         return 0;
 500 }
 501
 502 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 503 {
 504         int r = 0;
 505         struct rfcomm_dlc *d_list;
 506         struct rfcomm_session *s, *s_list;
 507
 508         BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
 509
 510         rfcomm_lock();
 511
 512         s = d->session;
 513         if (!s)
 514                 goto no_session;
 515
 516         /* after waiting on the mutex check the session still exists
 517          * then check the dlc still exists
 518          */
 519         list_for_each_entry(s_list, &session_list, list) {
 520                 if (s_list == s) {
 521                         list_for_each_entry(d_list, &s->dlcs, list) {
 522                                 if (d_list == d) {
 523                                         r = __rfcomm_dlc_close(d, err);
 524                                         break;
 525                                 }
 526                         }
 527                         break;
 528                 }
 529         }
 530
 531 no_session:
 532         rfcomm_unlock();
 533         return r;
 534 }
 535
 536 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
 537 {
 538         struct rfcomm_session *s;
 539         struct rfcomm_dlc *dlc = NULL;
 540         u8 dlci;
 541
 542         if (rfcomm_check_channel(channel))
 543                 return ERR_PTR(-EINVAL);
 544
 545         rfcomm_lock();
 546         s = rfcomm_session_get(src, dst);
 547         if (s) {
 548                 dlci = __dlci(__session_dir(s), channel);
 549                 dlc = rfcomm_dlc_get(s, dlci);
 550         }
 551         rfcomm_unlock();
 552         return dlc;
 553 }
 554
 555 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 556 {
 557         int len = skb->len;
 558
 559         if (d->state != BT_CONNECTED)
 560                 return -ENOTCONN;
 561
 562         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 563
 564         if (len > d->mtu)
 565                 return -EINVAL;
 566
 567         rfcomm_make_uih(skb, d->addr);
 568         skb_queue_tail(&d->tx_queue, skb);
 569
 570         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 571                 rfcomm_schedule();
 572         return len;
 573 }
 574
 575 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
 576 {
 577         int len = skb->len;
 578
 579         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 580
 581         rfcomm_make_uih(skb, d->addr);
 582         skb_queue_tail(&d->tx_queue, skb);
 583
 584         if (d->state == BT_CONNECTED &&
 585             !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 586                 rfcomm_schedule();
 587 }
 588
 589 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 590 {
 591         BT_DBG("dlc %p state %ld", d, d->state);
 592
 593         if (!d->cfc) {
 594                 d->v24_sig |= RFCOMM_V24_FC;
 595                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 596         }
 597         rfcomm_schedule();
 598 }
 599
 600 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 601 {
 602         BT_DBG("dlc %p state %ld", d, d->state);
 603
 604         if (!d->cfc) {
 605                 d->v24_sig &= ~RFCOMM_V24_FC;
 606                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 607         }
 608         rfcomm_schedule();
 609 }
 610
 611 /*
 612    Set/get modem status functions use _local_ status i.e. what we report
 613    to the other side.
 614    Remote status is provided by dlc->modem_status() callback.
 615  */
 616 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 617 {
 618         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 619                         d, d->state, v24_sig);
 620
 621         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 622                 v24_sig |= RFCOMM_V24_FC;
 623         else
 624                 v24_sig &= ~RFCOMM_V24_FC;
 625
 626         d->v24_sig = v24_sig;
 627
 628         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 629                 rfcomm_schedule();
 630
 631         return 0;
 632 }
 633
 634 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 635 {
 636         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 637                         d, d->state, d->v24_sig);
 638
 639         *v24_sig = d->v24_sig;
 640         return 0;
 641 }
 642
 643 /* ---- RFCOMM sessions ---- */
 644 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 645 {
 646         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 647
 648         if (!s)
 649                 return NULL;
 650
 651         BT_DBG("session %p sock %p", s, sock);
 652
 653         setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
 654
 655         INIT_LIST_HEAD(&s->dlcs);
 656         s->state = state;
 657         s->sock  = sock;
 658
 659         s->mtu = RFCOMM_DEFAULT_MTU;
 660         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 661
 662         /* Do not increment module usage count for listening sessions.
 663          * Otherwise we won't be able to unload the module. */
 664         if (state != BT_LISTEN)
 665                 if (!try_module_get(THIS_MODULE)) {
 666                         kfree(s);
 667                         return NULL;
 668                 }
 669
 670         list_add(&s->list, &session_list);
 671
 672         return s;
 673 }
 674
 675 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
 676 {
 677         int state = s->state;
 678
 679         BT_DBG("session %p state %ld", s, s->state);
 680
 681         list_del(&s->list);
 682
 683         rfcomm_session_clear_timer(s);
 684         sock_release(s->sock);
 685         kfree(s);
 686
 687         if (state != BT_LISTEN)
 688                 module_put(THIS_MODULE);
 689
 690         return NULL;
 691 }
 692
 693 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 694 {
 695         struct rfcomm_session *s;
 696         struct list_head *p, *n;
 697         struct l2cap_chan *chan;
 698         list_for_each_safe(p, n, &session_list) {
 699                 s = list_entry(p, struct rfcomm_session, list);
 700                 chan = l2cap_pi(s->sock->sk)->chan;
 701
 702                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
 703                     !bacmp(&chan->dst, dst))
 704                         return s;
 705         }
 706         return NULL;
 707 }
 708
 709 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
 710                                                    int err)
 711 {
 712         struct rfcomm_dlc *d;
 713         struct list_head *p, *n;
 714
 715         s->state = BT_CLOSED;
 716
 717         BT_DBG("session %p state %ld err %d", s, s->state, err);
 718
 719         /* Close all dlcs */
 720         list_for_each_safe(p, n, &s->dlcs) {
 721                 d = list_entry(p, struct rfcomm_dlc, list);
 722                 d->state = BT_CLOSED;
 723                 __rfcomm_dlc_close(d, err);
 724         }
 725
 726         rfcomm_session_clear_timer(s);
 727         return rfcomm_session_del(s);
 728 }
 729
 730 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 731                                                         bdaddr_t *dst,
 732                                                         u8 sec_level,
 733                                                         int *err)
 734 {
 735         struct rfcomm_session *s = NULL;
 736         struct sockaddr_l2 addr;
 737         struct socket *sock;
 738         struct sock *sk;
 739
 740         BT_DBG("%pMR -> %pMR", src, dst);
 741
 742         *err = rfcomm_l2sock_create(&sock);
 743         if (*err < 0)
 744                 return NULL;
 745
 746         bacpy(&addr.l2_bdaddr, src);
 747         addr.l2_family = AF_BLUETOOTH;
 748         addr.l2_psm    = 0;
 749         addr.l2_cid    = 0;
 750         addr.l2_bdaddr_type = BDADDR_BREDR;
 751         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 752         if (*err < 0)
 753                 goto failed;
 754
 755         /* Set L2CAP options */
 756         sk = sock->sk;
 757         lock_sock(sk);
 758         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
 759         l2cap_pi(sk)->chan->sec_level = sec_level;
 760         if (l2cap_ertm)
 761                 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
 762         release_sock(sk);
 763
 764         s = rfcomm_session_add(sock, BT_BOUND);
 765         if (!s) {
 766                 *err = -ENOMEM;
 767                 goto failed;
 768         }
 769
 770         s->initiator = 1;
 771
 772         bacpy(&addr.l2_bdaddr, dst);
 773         addr.l2_family = AF_BLUETOOTH;
 774         addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
 775         addr.l2_cid    = 0;
 776         addr.l2_bdaddr_type = BDADDR_BREDR;
 777         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 778         if (*err == 0 || *err == -EINPROGRESS)
 779                 return s;
 780
 781         return rfcomm_session_del(s);
 782
 783 failed:
 784         sock_release(sock);
 785         return NULL;
 786 }
 787
 788 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 789 {
 790         struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
 791         if (src)
 792                 bacpy(src, &chan->src);
 793         if (dst)
 794                 bacpy(dst, &chan->dst);
 795 }
 796
 797 /* ---- RFCOMM frame sending ---- */
 798 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 799 {
 800         struct kvec iv = { data, len };
 801         struct msghdr msg;
 802
 803         BT_DBG("session %p len %d", s, len);
 804
 805         memset(&msg, 0, sizeof(msg));
 806
 807         return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
 808 }
 809
 810 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
 811 {
 812         BT_DBG("%p cmd %u", s, cmd->ctrl);
 813
 814         return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
 815 }
 816
 817 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 818 {
 819         struct rfcomm_cmd cmd;
 820
 821         BT_DBG("%p dlci %d", s, dlci);
 822
 823         cmd.addr = __addr(s->initiator, dlci);
 824         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 825         cmd.len  = __len8(0);
 826         cmd.fcs  = __fcs2((u8 *) &cmd);
 827
 828         return rfcomm_send_cmd(s, &cmd);
 829 }
 830
 831 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 832 {
 833         struct rfcomm_cmd cmd;
 834
 835         BT_DBG("%p dlci %d", s, dlci);
 836
 837         cmd.addr = __addr(!s->initiator, dlci);
 838         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 839         cmd.len  = __len8(0);
 840         cmd.fcs  = __fcs2((u8 *) &cmd);
 841
 842         return rfcomm_send_cmd(s, &cmd);
 843 }
 844
 845 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 846 {
 847         struct rfcomm_cmd cmd;
 848
 849         BT_DBG("%p dlci %d", s, dlci);
 850
 851         cmd.addr = __addr(s->initiator, dlci);
 852         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 853         cmd.len  = __len8(0);
 854         cmd.fcs  = __fcs2((u8 *) &cmd);
 855
 856         return rfcomm_send_cmd(s, &cmd);
 857 }
 858
 859 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 860 {
 861         struct rfcomm_cmd *cmd;
 862         struct sk_buff *skb;
 863
 864         BT_DBG("dlc %p dlci %d", d, d->dlci);
 865
 866         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 867         if (!skb)
 868                 return -ENOMEM;
 869
 870         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 871         cmd->addr = d->addr;
 872         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 873         cmd->len  = __len8(0);
 874         cmd->fcs  = __fcs2((u8 *) cmd);
 875
 876         skb_queue_tail(&d->tx_queue, skb);
 877         rfcomm_schedule();
 878         return 0;
 879 }
 880
 881 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 882 {
 883         struct rfcomm_cmd cmd;
 884
 885         BT_DBG("%p dlci %d", s, dlci);
 886
 887         cmd.addr = __addr(!s->initiator, dlci);
 888         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 889         cmd.len  = __len8(0);
 890         cmd.fcs  = __fcs2((u8 *) &cmd);
 891
 892         return rfcomm_send_cmd(s, &cmd);
 893 }
 894
 895 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 896 {
 897         struct rfcomm_hdr *hdr;
 898         struct rfcomm_mcc *mcc;
 899         u8 buf[16], *ptr = buf;
 900
 901         BT_DBG("%p cr %d type %d", s, cr, type);
 902
 903         hdr = (void *) ptr; ptr += sizeof(*hdr);
 904         hdr->addr = __addr(s->initiator, 0);
 905         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 906         hdr->len  = __len8(sizeof(*mcc) + 1);
 907
 908         mcc = (void *) ptr; ptr += sizeof(*mcc);
 909         mcc->type = __mcc_type(0, RFCOMM_NSC);
 910         mcc->len  = __len8(1);
 911
 912         /* Type that we didn't like */
 913         *ptr = __mcc_type(cr, type); ptr++;
 914
 915         *ptr = __fcs(buf); ptr++;
 916
 917         return rfcomm_send_frame(s, buf, ptr - buf);
 918 }
 919
 920 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 921 {
 922         struct rfcomm_hdr *hdr;
 923         struct rfcomm_mcc *mcc;
 924         struct rfcomm_pn  *pn;
 925         u8 buf[16], *ptr = buf;
 926
 927         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 928
 929         hdr = (void *) ptr; ptr += sizeof(*hdr);
 930         hdr->addr = __addr(s->initiator, 0);
 931         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 932         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 933
 934         mcc = (void *) ptr; ptr += sizeof(*mcc);
 935         mcc->type = __mcc_type(cr, RFCOMM_PN);
 936         mcc->len  = __len8(sizeof(*pn));
 937
 938         pn = (void *) ptr; ptr += sizeof(*pn);
 939         pn->dlci        = d->dlci;
 940         pn->priority    = d->priority;
 941         pn->ack_timer   = 0;
 942         pn->max_retrans = 0;
 943
 944         if (s->cfc) {
 945                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 946                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 947         } else {
 948                 pn->flow_ctrl = 0;
 949                 pn->credits   = 0;
 950         }
 951
 952         if (cr && channel_mtu >= 0)
 953                 pn->mtu = cpu_to_le16(channel_mtu);
 954         else
 955                 pn->mtu = cpu_to_le16(d->mtu);
 956
 957         *ptr = __fcs(buf); ptr++;
 958
 959         return rfcomm_send_frame(s, buf, ptr - buf);
 960 }
 961
 962 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 963                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 964                         u8 parity, u8 flow_ctrl_settings,
 965                         u8 xon_char, u8 xoff_char, u16 param_mask)
 966 {
 967         struct rfcomm_hdr *hdr;
 968         struct rfcomm_mcc *mcc;
 969         struct rfcomm_rpn *rpn;
 970         u8 buf[16], *ptr = buf;
 971
 972         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 973                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 974                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 975                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
 976
 977         hdr = (void *) ptr; ptr += sizeof(*hdr);
 978         hdr->addr = __addr(s->initiator, 0);
 979         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 980         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 981
 982         mcc = (void *) ptr; ptr += sizeof(*mcc);
 983         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 984         mcc->len  = __len8(sizeof(*rpn));
 985
 986         rpn = (void *) ptr; ptr += sizeof(*rpn);
 987         rpn->dlci          = __addr(1, dlci);
 988         rpn->bit_rate      = bit_rate;
 989         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 990         rpn->flow_ctrl     = flow_ctrl_settings;
 991         rpn->xon_char      = xon_char;
 992         rpn->xoff_char     = xoff_char;
 993         rpn->param_mask    = cpu_to_le16(param_mask);
 994
 995         *ptr = __fcs(buf); ptr++;
 996
 997         return rfcomm_send_frame(s, buf, ptr - buf);
 998 }
 999
1000 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
1001 {
1002         struct rfcomm_hdr *hdr;
1003         struct rfcomm_mcc *mcc;
1004         struct rfcomm_rls *rls;
1005         u8 buf[16], *ptr = buf;
1006
1007         BT_DBG("%p cr %d status 0x%x", s, cr, status);
1008
1009         hdr = (void *) ptr; ptr += sizeof(*hdr);
1010         hdr->addr = __addr(s->initiator, 0);
1011         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1012         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
1013
1014         mcc = (void *) ptr; ptr += sizeof(*mcc);
1015         mcc->type = __mcc_type(cr, RFCOMM_RLS);
1016         mcc->len  = __len8(sizeof(*rls));
1017
1018         rls = (void *) ptr; ptr += sizeof(*rls);
1019         rls->dlci   = __addr(1, dlci);
1020         rls->status = status;
1021
1022         *ptr = __fcs(buf); ptr++;
1023
1024         return rfcomm_send_frame(s, buf, ptr - buf);
1025 }
1026
1027 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1028 {
1029         struct rfcomm_hdr *hdr;
1030         struct rfcomm_mcc *mcc;
1031         struct rfcomm_msc *msc;
1032         u8 buf[16], *ptr = buf;
1033
1034         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1035
1036         hdr = (void *) ptr; ptr += sizeof(*hdr);
1037         hdr->addr = __addr(s->initiator, 0);
1038         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1039         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
1040
1041         mcc = (void *) ptr; ptr += sizeof(*mcc);
1042         mcc->type = __mcc_type(cr, RFCOMM_MSC);
1043         mcc->len  = __len8(sizeof(*msc));
1044
1045         msc = (void *) ptr; ptr += sizeof(*msc);
1046         msc->dlci    = __addr(1, dlci);
1047         msc->v24_sig = v24_sig | 0x01;
1048
1049         *ptr = __fcs(buf); ptr++;
1050
1051         return rfcomm_send_frame(s, buf, ptr - buf);
1052 }
1053
1054 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1055 {
1056         struct rfcomm_hdr *hdr;
1057         struct rfcomm_mcc *mcc;
1058         u8 buf[16], *ptr = buf;
1059
1060         BT_DBG("%p cr %d", s, cr);
1061
1062         hdr = (void *) ptr; ptr += sizeof(*hdr);
1063         hdr->addr = __addr(s->initiator, 0);
1064         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1065         hdr->len  = __len8(sizeof(*mcc));
1066
1067         mcc = (void *) ptr; ptr += sizeof(*mcc);
1068         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1069         mcc->len  = __len8(0);
1070
1071         *ptr = __fcs(buf); ptr++;
1072
1073         return rfcomm_send_frame(s, buf, ptr - buf);
1074 }
1075
1076 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1077 {
1078         struct rfcomm_hdr *hdr;
1079         struct rfcomm_mcc *mcc;
1080         u8 buf[16], *ptr = buf;
1081
1082         BT_DBG("%p cr %d", s, cr);
1083
1084         hdr = (void *) ptr; ptr += sizeof(*hdr);
1085         hdr->addr = __addr(s->initiator, 0);
1086         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1087         hdr->len  = __len8(sizeof(*mcc));
1088
1089         mcc = (void *) ptr; ptr += sizeof(*mcc);
1090         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1091         mcc->len  = __len8(0);
1092
1093         *ptr = __fcs(buf); ptr++;
1094
1095         return rfcomm_send_frame(s, buf, ptr - buf);
1096 }
1097
1098 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1099 {
1100         struct socket *sock = s->sock;
1101         struct kvec iv[3];
1102         struct msghdr msg;
1103         unsigned char hdr[5], crc[1];
1104
1105         if (len > 125)
1106                 return -EINVAL;
1107
1108         BT_DBG("%p cr %d", s, cr);
1109
1110         hdr[0] = __addr(s->initiator, 0);
1111         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1112         hdr[2] = 0x01 | ((len + 2) << 1);
1113         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1114         hdr[4] = 0x01 | (len << 1);
1115
1116         crc[0] = __fcs(hdr);
1117
1118         iv[0].iov_base = hdr;
1119         iv[0].iov_len  = 5;
1120         iv[1].iov_base = pattern;
1121         iv[1].iov_len  = len;
1122         iv[2].iov_base = crc;
1123         iv[2].iov_len  = 1;
1124
1125         memset(&msg, 0, sizeof(msg));
1126
1127         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1128 }
1129
1130 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1131 {
1132         struct rfcomm_hdr *hdr;
1133         u8 buf[16], *ptr = buf;
1134
1135         BT_DBG("%p addr %d credits %d", s, addr, credits);
1136
1137         hdr = (void *) ptr; ptr += sizeof(*hdr);
1138         hdr->addr = addr;
1139         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1140         hdr->len  = __len8(0);
1141
1142         *ptr = credits; ptr++;
1143
1144         *ptr = __fcs(buf); ptr++;
1145
1146         return rfcomm_send_frame(s, buf, ptr - buf);
1147 }
1148
1149 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1150 {
1151         struct rfcomm_hdr *hdr;
1152         int len = skb->len;
1153         u8 *crc;
1154
1155         if (len > 127) {
1156                 hdr = (void *) skb_push(skb, 4);
1157                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1158         } else {
1159                 hdr = (void *) skb_push(skb, 3);
1160                 hdr->len = __len8(len);
1161         }
1162         hdr->addr = addr;
1163         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1164
1165         crc = skb_put(skb, 1);
1166         *crc = __fcs((void *) hdr);
1167 }
1168
1169 /* ---- RFCOMM frame reception ---- */
1170 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1171 {
1172         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1173
1174         if (dlci) {
1175                 /* Data channel */
1176                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1177                 if (!d) {
1178                         rfcomm_send_dm(s, dlci);
1179                         return s;
1180                 }
1181
1182                 switch (d->state) {
1183                 case BT_CONNECT:
1184                         rfcomm_dlc_clear_timer(d);
1185
1186                         rfcomm_dlc_lock(d);
1187                         d->state = BT_CONNECTED;
1188                         d->state_change(d, 0);
1189                         rfcomm_dlc_unlock(d);
1190
1191                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1192                         break;
1193
1194                 case BT_DISCONN:
1195                         d->state = BT_CLOSED;
1196                         __rfcomm_dlc_close(d, 0);
1197
1198                         if (list_empty(&s->dlcs)) {
1199                                 s->state = BT_DISCONN;
1200                                 rfcomm_send_disc(s, 0);
1201                                 rfcomm_session_clear_timer(s);
1202                         }
1203
1204                         break;
1205                 }
1206         } else {
1207                 /* Control channel */
1208                 switch (s->state) {
1209                 case BT_CONNECT:
1210                         s->state = BT_CONNECTED;
1211                         rfcomm_process_connect(s);
1212                         break;
1213
1214                 case BT_DISCONN:
1215                         s = rfcomm_session_close(s, ECONNRESET);
1216                         break;
1217                 }
1218         }
1219         return s;
1220 }
1221
1222 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1223 {
1224         int err = 0;
1225
1226         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1227
1228         if (dlci) {
1229                 /* Data DLC */
1230                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1231                 if (d) {
1232                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1233                                 err = ECONNREFUSED;
1234                         else
1235                                 err = ECONNRESET;
1236
1237                         d->state = BT_CLOSED;
1238                         __rfcomm_dlc_close(d, err);
1239                 }
1240         } else {
1241                 if (s->state == BT_CONNECT)
1242                         err = ECONNREFUSED;
1243                 else
1244                         err = ECONNRESET;
1245
1246                 s = rfcomm_session_close(s, err);
1247         }
1248         return s;
1249 }
1250
1251 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1252                                                u8 dlci)
1253 {
1254         int err = 0;
1255
1256         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1257
1258         if (dlci) {
1259                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1260                 if (d) {
1261                         rfcomm_send_ua(s, dlci);
1262
1263                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1264                                 err = ECONNREFUSED;
1265                         else
1266                                 err = ECONNRESET;
1267
1268                         d->state = BT_CLOSED;
1269                         __rfcomm_dlc_close(d, err);
1270                 } else
1271                         rfcomm_send_dm(s, dlci);
1272
1273         } else {
1274                 rfcomm_send_ua(s, 0);
1275
1276                 if (s->state == BT_CONNECT)
1277                         err = ECONNREFUSED;
1278                 else
1279                         err = ECONNRESET;
1280
1281                 s = rfcomm_session_close(s, err);
1282         }
1283         return s;
1284 }
1285
1286 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1287 {
1288         struct sock *sk = d->session->sock->sk;
1289         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1290
1291         BT_DBG("dlc %p", d);
1292
1293         rfcomm_send_ua(d->session, d->dlci);
1294
1295         rfcomm_dlc_clear_timer(d);
1296
1297         rfcomm_dlc_lock(d);
1298         d->state = BT_CONNECTED;
1299         d->state_change(d, 0);
1300         rfcomm_dlc_unlock(d);
1301
1302         if (d->role_switch)
1303                 hci_conn_switch_role(conn->hcon, 0x00);
1304
1305         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1306 }
1307
1308 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1309 {
1310         if (rfcomm_check_security(d)) {
1311                 if (d->defer_setup) {
1312                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1313                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1314
1315                         rfcomm_dlc_lock(d);
1316                         d->state = BT_CONNECT2;
1317                         d->state_change(d, 0);
1318                         rfcomm_dlc_unlock(d);
1319                 } else
1320                         rfcomm_dlc_accept(d);
1321         } else {
1322                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1323                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1324         }
1325 }
1326
1327 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1328 {
1329         struct rfcomm_dlc *d;
1330         u8 channel;
1331
1332         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1333
1334         if (!dlci) {
1335                 rfcomm_send_ua(s, 0);
1336
1337                 if (s->state == BT_OPEN) {
1338                         s->state = BT_CONNECTED;
1339                         rfcomm_process_connect(s);
1340                 }
1341                 return 0;
1342         }
1343
1344         /* Check if DLC exists */
1345         d = rfcomm_dlc_get(s, dlci);
1346         if (d) {
1347                 if (d->state == BT_OPEN) {
1348                         /* DLC was previously opened by PN request */
1349                         rfcomm_check_accept(d);
1350                 }
1351                 return 0;
1352         }
1353
1354         /* Notify socket layer about incoming connection */
1355         channel = __srv_channel(dlci);
1356         if (rfcomm_connect_ind(s, channel, &d)) {
1357                 d->dlci = dlci;
1358                 d->addr = __addr(s->initiator, dlci);
1359                 rfcomm_dlc_link(s, d);
1360
1361                 rfcomm_check_accept(d);
1362         } else {
1363                 rfcomm_send_dm(s, dlci);
1364         }
1365
1366         return 0;
1367 }
1368
1369 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1370 {
1371         struct rfcomm_session *s = d->session;
1372
1373         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1374                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1375
1376         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1377                                                 pn->flow_ctrl == 0xe0) {
1378                 d->cfc = RFCOMM_CFC_ENABLED;
1379                 d->tx_credits = pn->credits;
1380         } else {
1381                 d->cfc = RFCOMM_CFC_DISABLED;
1382                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1383         }
1384
1385         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1386                 s->cfc = d->cfc;
1387
1388         d->priority = pn->priority;
1389
1390         d->mtu = __le16_to_cpu(pn->mtu);
1391
1392         if (cr && d->mtu > s->mtu)
1393                 d->mtu = s->mtu;
1394
1395         return 0;
1396 }
1397
1398 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1399 {
1400         struct rfcomm_pn *pn = (void *) skb->data;
1401         struct rfcomm_dlc *d;
1402         u8 dlci = pn->dlci;
1403
1404         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1405
1406         if (!dlci)
1407                 return 0;
1408
1409         d = rfcomm_dlc_get(s, dlci);
1410         if (d) {
1411                 if (cr) {
1412                         /* PN request */
1413                         rfcomm_apply_pn(d, cr, pn);
1414                         rfcomm_send_pn(s, 0, d);
1415                 } else {
1416                         /* PN response */
1417                         switch (d->state) {
1418                         case BT_CONFIG:
1419                                 rfcomm_apply_pn(d, cr, pn);
1420
1421                                 d->state = BT_CONNECT;
1422                                 rfcomm_send_sabm(s, d->dlci);
1423                                 break;
1424                         }
1425                 }
1426         } else {
1427                 u8 channel = __srv_channel(dlci);
1428
1429                 if (!cr)
1430                         return 0;
1431
1432                 /* PN request for non existing DLC.
1433                  * Assume incoming connection. */
1434                 if (rfcomm_connect_ind(s, channel, &d)) {
1435                         d->dlci = dlci;
1436                         d->addr = __addr(s->initiator, dlci);
1437                         rfcomm_dlc_link(s, d);
1438
1439                         rfcomm_apply_pn(d, cr, pn);
1440
1441                         d->state = BT_OPEN;
1442                         rfcomm_send_pn(s, 0, d);
1443                 } else {
1444                         rfcomm_send_dm(s, dlci);
1445                 }
1446         }
1447         return 0;
1448 }
1449
1450 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1451 {
1452         struct rfcomm_rpn *rpn = (void *) skb->data;
1453         u8 dlci = __get_dlci(rpn->dlci);
1454
1455         u8 bit_rate  = 0;
1456         u8 data_bits = 0;
1457         u8 stop_bits = 0;
1458         u8 parity    = 0;
1459         u8 flow_ctrl = 0;
1460         u8 xon_char  = 0;
1461         u8 xoff_char = 0;
1462         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1463
1464         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1465                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1466                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1467
1468         if (!cr)
1469                 return 0;
1470
1471         if (len == 1) {
1472                 /* This is a request, return default (according to ETSI TS 07.10) settings */
1473                 bit_rate  = RFCOMM_RPN_BR_9600;
1474                 data_bits = RFCOMM_RPN_DATA_8;
1475                 stop_bits = RFCOMM_RPN_STOP_1;
1476                 parity    = RFCOMM_RPN_PARITY_NONE;
1477                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1478                 xon_char  = RFCOMM_RPN_XON_CHAR;
1479                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1480                 goto rpn_out;
1481         }
1482
1483         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1484          * no parity, no flow control lines, normal XON/XOFF chars */
1485
1486         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1487                 bit_rate = rpn->bit_rate;
1488                 if (bit_rate > RFCOMM_RPN_BR_230400) {
1489                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1490                         bit_rate = RFCOMM_RPN_BR_9600;
1491                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1492                 }
1493         }
1494
1495         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1496                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1497                 if (data_bits != RFCOMM_RPN_DATA_8) {
1498                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1499                         data_bits = RFCOMM_RPN_DATA_8;
1500                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1501                 }
1502         }
1503
1504         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1505                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1506                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1507                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1508                         stop_bits = RFCOMM_RPN_STOP_1;
1509                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1510                 }
1511         }
1512
1513         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1514                 parity = __get_rpn_parity(rpn->line_settings);
1515                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1516                         BT_DBG("RPN parity mismatch 0x%x", parity);
1517                         parity = RFCOMM_RPN_PARITY_NONE;
1518                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1519                 }
1520         }
1521
1522         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1523                 flow_ctrl = rpn->flow_ctrl;
1524                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1525                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1526                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1527                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1528                 }
1529         }
1530
1531         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1532                 xon_char = rpn->xon_char;
1533                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1534                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1535                         xon_char = RFCOMM_RPN_XON_CHAR;
1536                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1537                 }
1538         }
1539
1540         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1541                 xoff_char = rpn->xoff_char;
1542                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1543                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1544                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1545                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1546                 }
1547         }
1548
1549 rpn_out:
1550         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1551                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1552
1553         return 0;
1554 }
1555
1556 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1557 {
1558         struct rfcomm_rls *rls = (void *) skb->data;
1559         u8 dlci = __get_dlci(rls->dlci);
1560
1561         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1562
1563         if (!cr)
1564                 return 0;
1565
1566         /* We should probably do something with this information here. But
1567          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1568          * mandatory to recognise and respond to RLS */
1569
1570         rfcomm_send_rls(s, 0, dlci, rls->status);
1571
1572         return 0;
1573 }
1574
1575 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1576 {
1577         struct rfcomm_msc *msc = (void *) skb->data;
1578         struct rfcomm_dlc *d;
1579         u8 dlci = __get_dlci(msc->dlci);
1580
1581         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1582
1583         d = rfcomm_dlc_get(s, dlci);
1584         if (!d)
1585                 return 0;
1586
1587         if (cr) {
1588                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1589                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1590                 else
1591                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1592
1593                 rfcomm_dlc_lock(d);
1594
1595                 d->remote_v24_sig = msc->v24_sig;
1596
1597                 if (d->modem_status)
1598                         d->modem_status(d, msc->v24_sig);
1599
1600                 rfcomm_dlc_unlock(d);
1601
1602                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1603
1604                 d->mscex |= RFCOMM_MSCEX_RX;
1605         } else
1606                 d->mscex |= RFCOMM_MSCEX_TX;
1607
1608         return 0;
1609 }
1610
1611 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1612 {
1613         struct rfcomm_mcc *mcc = (void *) skb->data;
1614         u8 type, cr, len;
1615
1616         cr   = __test_cr(mcc->type);
1617         type = __get_mcc_type(mcc->type);
1618         len  = __get_mcc_len(mcc->len);
1619
1620         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1621
1622         skb_pull(skb, 2);
1623
1624         switch (type) {
1625         case RFCOMM_PN:
1626                 rfcomm_recv_pn(s, cr, skb);
1627                 break;
1628
1629         case RFCOMM_RPN:
1630                 rfcomm_recv_rpn(s, cr, len, skb);
1631                 break;
1632
1633         case RFCOMM_RLS:
1634                 rfcomm_recv_rls(s, cr, skb);
1635                 break;
1636
1637         case RFCOMM_MSC:
1638                 rfcomm_recv_msc(s, cr, skb);
1639                 break;
1640
1641         case RFCOMM_FCOFF:
1642                 if (cr) {
1643                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1644                         rfcomm_send_fcoff(s, 0);
1645                 }
1646                 break;
1647
1648         case RFCOMM_FCON:
1649                 if (cr) {
1650                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1651                         rfcomm_send_fcon(s, 0);
1652                 }
1653                 break;
1654
1655         case RFCOMM_TEST:
1656                 if (cr)
1657                         rfcomm_send_test(s, 0, skb->data, skb->len);
1658                 break;
1659
1660         case RFCOMM_NSC:
1661                 break;
1662
1663         default:
1664                 BT_ERR("Unknown control type 0x%02x", type);
1665                 rfcomm_send_nsc(s, cr, type);
1666                 break;
1667         }
1668         return 0;
1669 }
1670
1671 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1672 {
1673         struct rfcomm_dlc *d;
1674
1675         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1676
1677         d = rfcomm_dlc_get(s, dlci);
1678         if (!d) {
1679                 rfcomm_send_dm(s, dlci);
1680                 goto drop;
1681         }
1682
1683         if (pf && d->cfc) {
1684                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1685
1686                 d->tx_credits += credits;
1687                 if (d->tx_credits)
1688                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1689         }
1690
1691         if (skb->len && d->state == BT_CONNECTED) {
1692                 rfcomm_dlc_lock(d);
1693                 d->rx_credits--;
1694                 d->data_ready(d, skb);
1695                 rfcomm_dlc_unlock(d);
1696                 return 0;
1697         }
1698
1699 drop:
1700         kfree_skb(skb);
1701         return 0;
1702 }
1703
1704 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1705                                                 struct sk_buff *skb)
1706 {
1707         struct rfcomm_hdr *hdr = (void *) skb->data;
1708         u8 type, dlci, fcs;
1709
1710         if (!s) {
1711                 /* no session, so free socket data */
1712                 kfree_skb(skb);
1713                 return s;
1714         }
1715
1716         dlci = __get_dlci(hdr->addr);
1717         type = __get_type(hdr->ctrl);
1718
1719         /* Trim FCS */
1720         skb->len--; skb->tail--;
1721         fcs = *(u8 *)skb_tail_pointer(skb);
1722
1723         if (__check_fcs(skb->data, type, fcs)) {
1724                 BT_ERR("bad checksum in packet");
1725                 kfree_skb(skb);
1726                 return s;
1727         }
1728
1729         if (__test_ea(hdr->len))
1730                 skb_pull(skb, 3);
1731         else
1732                 skb_pull(skb, 4);
1733
1734         switch (type) {
1735         case RFCOMM_SABM:
1736                 if (__test_pf(hdr->ctrl))
1737                         rfcomm_recv_sabm(s, dlci);
1738                 break;
1739
1740         case RFCOMM_DISC:
1741                 if (__test_pf(hdr->ctrl))
1742                         s = rfcomm_recv_disc(s, dlci);
1743                 break;
1744
1745         case RFCOMM_UA:
1746                 if (__test_pf(hdr->ctrl))
1747                         s = rfcomm_recv_ua(s, dlci);
1748                 break;
1749
1750         case RFCOMM_DM:
1751                 s = rfcomm_recv_dm(s, dlci);
1752                 break;
1753
1754         case RFCOMM_UIH:
1755                 if (dlci) {
1756                         rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1757                         return s;
1758                 }
1759                 rfcomm_recv_mcc(s, skb);
1760                 break;
1761
1762         default:
1763                 BT_ERR("Unknown packet type 0x%02x", type);
1764                 break;
1765         }
1766         kfree_skb(skb);
1767         return s;
1768 }
1769
1770 /* ---- Connection and data processing ---- */
1771
1772 static void rfcomm_process_connect(struct rfcomm_session *s)
1773 {
1774         struct rfcomm_dlc *d;
1775         struct list_head *p, *n;
1776
1777         BT_DBG("session %p state %ld", s, s->state);
1778
1779         list_for_each_safe(p, n, &s->dlcs) {
1780                 d = list_entry(p, struct rfcomm_dlc, list);
1781                 if (d->state == BT_CONFIG) {
1782                         d->mtu = s->mtu;
1783                         if (rfcomm_check_security(d)) {
1784                                 rfcomm_send_pn(s, 1, d);
1785                         } else {
1786                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1787                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1788                         }
1789                 }
1790         }
1791 }
1792
1793 /* Send data queued for the DLC.
1794  * Return number of frames left in the queue.
1795  */
1796 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1797 {
1798         struct sk_buff *skb;
1799         int err;
1800
1801         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1802                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1803
1804         /* Send pending MSC */
1805         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1806                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1807
1808         if (d->cfc) {
1809                 /* CFC enabled.
1810                  * Give them some credits */
1811                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1812                                 d->rx_credits <= (d->cfc >> 2)) {
1813                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1814                         d->rx_credits = d->cfc;
1815                 }
1816         } else {
1817                 /* CFC disabled.
1818                  * Give ourselves some credits */
1819                 d->tx_credits = 5;
1820         }
1821
1822         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1823                 return skb_queue_len(&d->tx_queue);
1824
1825         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1826                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1827                 if (err < 0) {
1828                         skb_queue_head(&d->tx_queue, skb);
1829                         break;
1830                 }
1831                 kfree_skb(skb);
1832                 d->tx_credits--;
1833         }
1834
1835         if (d->cfc && !d->tx_credits) {
1836                 /* We're out of TX credits.
1837                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1838                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1839         }
1840
1841         return skb_queue_len(&d->tx_queue);
1842 }
1843
1844 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1845 {
1846         struct rfcomm_dlc *d;
1847         struct list_head *p, *n;
1848
1849         BT_DBG("session %p state %ld", s, s->state);
1850
1851         list_for_each_safe(p, n, &s->dlcs) {
1852                 d = list_entry(p, struct rfcomm_dlc, list);
1853
1854                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1855                         __rfcomm_dlc_close(d, ETIMEDOUT);
1856                         continue;
1857                 }
1858
1859                 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1860                         __rfcomm_dlc_close(d, ECONNREFUSED);
1861                         continue;
1862                 }
1863
1864                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1865                         rfcomm_dlc_clear_timer(d);
1866                         if (d->out) {
1867                                 rfcomm_send_pn(s, 1, d);
1868                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1869                         } else {
1870                                 if (d->defer_setup) {
1871                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1872                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1873
1874                                         rfcomm_dlc_lock(d);
1875                                         d->state = BT_CONNECT2;
1876                                         d->state_change(d, 0);
1877                                         rfcomm_dlc_unlock(d);
1878                                 } else
1879                                         rfcomm_dlc_accept(d);
1880                         }
1881                         continue;
1882                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1883                         rfcomm_dlc_clear_timer(d);
1884                         if (!d->out)
1885                                 rfcomm_send_dm(s, d->dlci);
1886                         else
1887                                 d->state = BT_CLOSED;
1888                         __rfcomm_dlc_close(d, ECONNREFUSED);
1889                         continue;
1890                 }
1891
1892                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1893                         continue;
1894
1895                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1896                         continue;
1897
1898                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1899                                                 d->mscex == RFCOMM_MSCEX_OK)
1900                         rfcomm_process_tx(d);
1901         }
1902 }
1903
1904 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1905 {
1906         struct socket *sock = s->sock;
1907         struct sock *sk = sock->sk;
1908         struct sk_buff *skb;
1909
1910         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1911
1912         /* Get data directly from socket receive queue without copying it. */
1913         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1914                 skb_orphan(skb);
1915                 if (!skb_linearize(skb)) {
1916                         s = rfcomm_recv_frame(s, skb);
1917                         if (!s)
1918                                 break;
1919                 } else {
1920                         kfree_skb(skb);
1921                 }
1922         }
1923
1924         if (s && (sk->sk_state == BT_CLOSED))
1925                 s = rfcomm_session_close(s, sk->sk_err);
1926
1927         return s;
1928 }
1929
1930 static void rfcomm_accept_connection(struct rfcomm_session *s)
1931 {
1932         struct socket *sock = s->sock, *nsock;
1933         int err;
1934
1935         /* Fast check for a new connection.
1936          * Avoids unnesesary socket allocations. */
1937         if (list_empty(&bt_sk(sock->sk)->accept_q))
1938                 return;
1939
1940         BT_DBG("session %p", s);
1941
1942         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1943         if (err < 0)
1944                 return;
1945
1946         /* Set our callbacks */
1947         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1948         nsock->sk->sk_state_change = rfcomm_l2state_change;
1949
1950         s = rfcomm_session_add(nsock, BT_OPEN);
1951         if (s) {
1952                 /* We should adjust MTU on incoming sessions.
1953                  * L2CAP MTU minus UIH header and FCS. */
1954                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1955                                 l2cap_pi(nsock->sk)->chan->imtu) - 5;
1956
1957                 rfcomm_schedule();
1958         } else
1959                 sock_release(nsock);
1960 }
1961
1962 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1963 {
1964         struct sock *sk = s->sock->sk;
1965
1966         BT_DBG("%p state %ld", s, s->state);
1967
1968         switch (sk->sk_state) {
1969         case BT_CONNECTED:
1970                 s->state = BT_CONNECT;
1971
1972                 /* We can adjust MTU on outgoing sessions.
1973                  * L2CAP MTU minus UIH header and FCS. */
1974                 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1975
1976                 rfcomm_send_sabm(s, 0);
1977                 break;
1978
1979         case BT_CLOSED:
1980                 s = rfcomm_session_close(s, sk->sk_err);
1981                 break;
1982         }
1983         return s;
1984 }
1985
1986 static void rfcomm_process_sessions(void)
1987 {
1988         struct list_head *p, *n;
1989
1990         rfcomm_lock();
1991
1992         list_for_each_safe(p, n, &session_list) {
1993                 struct rfcomm_session *s;
1994                 s = list_entry(p, struct rfcomm_session, list);
1995
1996                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1997                         s->state = BT_DISCONN;
1998                         rfcomm_send_disc(s, 0);
1999                         continue;
2000                 }
2001
2002                 switch (s->state) {
2003                 case BT_LISTEN:
2004                         rfcomm_accept_connection(s);
2005                         continue;
2006
2007                 case BT_BOUND:
2008                         s = rfcomm_check_connection(s);
2009                         break;
2010
2011                 default:
2012                         s = rfcomm_process_rx(s);
2013                         break;
2014                 }
2015
2016                 if (s)
2017                         rfcomm_process_dlcs(s);
2018         }
2019
2020         rfcomm_unlock();
2021 }
2022
2023 static int rfcomm_add_listener(bdaddr_t *ba)
2024 {
2025         struct sockaddr_l2 addr;
2026         struct socket *sock;
2027         struct sock *sk;
2028         struct rfcomm_session *s;
2029         int    err = 0;
2030
2031         /* Create socket */
2032         err = rfcomm_l2sock_create(&sock);
2033         if (err < 0) {
2034                 BT_ERR("Create socket failed %d", err);
2035                 return err;
2036         }
2037
2038         /* Bind socket */
2039         bacpy(&addr.l2_bdaddr, ba);
2040         addr.l2_family = AF_BLUETOOTH;
2041         addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
2042         addr.l2_cid    = 0;
2043         addr.l2_bdaddr_type = BDADDR_BREDR;
2044         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
2045         if (err < 0) {
2046                 BT_ERR("Bind failed %d", err);
2047                 goto failed;
2048         }
2049
2050         /* Set L2CAP options */
2051         sk = sock->sk;
2052         lock_sock(sk);
2053         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2054         release_sock(sk);
2055
2056         /* Start listening on the socket */
2057         err = kernel_listen(sock, 10);
2058         if (err) {
2059                 BT_ERR("Listen failed %d", err);
2060                 goto failed;
2061         }
2062
2063         /* Add listening session */
2064         s = rfcomm_session_add(sock, BT_LISTEN);
2065         if (!s) {
2066                 err = -ENOMEM;
2067                 goto failed;
2068         }
2069
2070         return 0;
2071 failed:
2072         sock_release(sock);
2073         return err;
2074 }
2075
2076 static void rfcomm_kill_listener(void)
2077 {
2078         struct rfcomm_session *s;
2079         struct list_head *p, *n;
2080
2081         BT_DBG("");
2082
2083         list_for_each_safe(p, n, &session_list) {
2084                 s = list_entry(p, struct rfcomm_session, list);
2085                 rfcomm_session_del(s);
2086         }
2087 }
2088
2089 static int rfcomm_run(void *unused)
2090 {
2091         DEFINE_WAIT_FUNC(wait, woken_wake_function);
2092         BT_DBG("");
2093
2094         set_user_nice(current, -10);
2095
2096         rfcomm_add_listener(BDADDR_ANY);
2097
2098         add_wait_queue(&rfcomm_wq, &wait);
2099         while (!kthread_should_stop()) {
2100
2101                 /* Process stuff */
2102                 rfcomm_process_sessions();
2103
2104                 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2105         }
2106         remove_wait_queue(&rfcomm_wq, &wait);
2107
2108         rfcomm_kill_listener();
2109
2110         return 0;
2111 }
2112
2113 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2114 {
2115         struct rfcomm_session *s;
2116         struct rfcomm_dlc *d;
2117         struct list_head *p, *n;
2118
2119         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2120
2121         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2122         if (!s)
2123                 return;
2124
2125         list_for_each_safe(p, n, &s->dlcs) {
2126                 d = list_entry(p, struct rfcomm_dlc, list);
2127
2128                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2129                         rfcomm_dlc_clear_timer(d);
2130                         if (status || encrypt == 0x00) {
2131                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2132                                 continue;
2133                         }
2134                 }
2135
2136                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2137                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2138                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2139                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2140                                 continue;
2141                         } else if (d->sec_level == BT_SECURITY_HIGH ||
2142                                    d->sec_level == BT_SECURITY_FIPS) {
2143                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2144                                 continue;
2145                         }
2146                 }
2147
2148                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2149                         continue;
2150
2151                 if (!status && hci_conn_check_secure(conn, d->sec_level))
2152                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2153                 else
2154                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2155         }
2156
2157         rfcomm_schedule();
2158 }
2159
2160 static struct hci_cb rfcomm_cb = {
2161         .name           = "RFCOMM",
2162         .security_cfm   = rfcomm_security_cfm
2163 };
2164
2165 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2166 {
2167         struct rfcomm_session *s;
2168
2169         rfcomm_lock();
2170
2171         list_for_each_entry(s, &session_list, list) {
2172                 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2173                 struct rfcomm_dlc *d;
2174                 list_for_each_entry(d, &s->dlcs, list) {
2175                         seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2176                                    &chan->src, &chan->dst,
2177                                    d->state, d->dlci, d->mtu,
2178                                    d->rx_credits, d->tx_credits);
2179                 }
2180         }
2181
2182         rfcomm_unlock();
2183
2184         return 0;
2185 }
2186
2187 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2188 {
2189         return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2190 }
2191
2192 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2193         .open           = rfcomm_dlc_debugfs_open,
2194         .read           = seq_read,
2195         .llseek         = seq_lseek,
2196         .release        = single_release,
2197 };
2198
2199 static struct dentry *rfcomm_dlc_debugfs;
2200
2201 /* ---- Initialization ---- */
2202 static int __init rfcomm_init(void)
2203 {
2204         int err;
2205
2206         hci_register_cb(&rfcomm_cb);
2207
2208         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2209         if (IS_ERR(rfcomm_thread)) {
2210                 err = PTR_ERR(rfcomm_thread);
2211                 goto unregister;
2212         }
2213
2214         err = rfcomm_init_ttys();
2215         if (err < 0)
2216                 goto stop;
2217
2218         err = rfcomm_init_sockets();
2219         if (err < 0)
2220                 goto cleanup;
2221
2222         BT_INFO("RFCOMM ver %s", VERSION);
2223
2224         if (IS_ERR_OR_NULL(bt_debugfs))
2225                 return 0;
2226
2227         rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2228                                                  bt_debugfs, NULL,
2229                                                  &rfcomm_dlc_debugfs_fops);
2230
2231         return 0;
2232
2233 cleanup:
2234         rfcomm_cleanup_ttys();
2235
2236 stop:
2237         kthread_stop(rfcomm_thread);
2238
2239 unregister:
2240         hci_unregister_cb(&rfcomm_cb);
2241
2242         return err;
2243 }
2244
2245 static void __exit rfcomm_exit(void)
2246 {
2247         debugfs_remove(rfcomm_dlc_debugfs);
2248
2249         hci_unregister_cb(&rfcomm_cb);
2250
2251         kthread_stop(rfcomm_thread);
2252
2253         rfcomm_cleanup_ttys();
2254
2255         rfcomm_cleanup_sockets();
2256 }
2257
2258 module_init(rfcomm_init);
2259 module_exit(rfcomm_exit);
2260
2261 module_param(disable_cfc, bool, 0644);
2262 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2263
2264 module_param(channel_mtu, int, 0644);
2265 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2266
2267 module_param(l2cap_mtu, uint, 0644);
2268 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2269
2270 module_param(l2cap_ertm, bool, 0644);
2271 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2272
2273 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2274 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2275 MODULE_VERSION(VERSION);
2276 MODULE_LICENSE("GPL");
2277 MODULE_ALIAS("bt-proto-3");