net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * Bluetooth RFCOMM core.
  26  */
  27
  28 #include <linux/module.h>
  29 #include <linux/debugfs.h>
  30 #include <linux/kthread.h>
  31 #include <asm/unaligned.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35 #include <net/bluetooth/l2cap.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define VERSION "1.11"
  39
  40 static bool disable_cfc;
  41 static bool l2cap_ertm;
  42 static int channel_mtu = -1;
  43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
  44
  45 static struct task_struct *rfcomm_thread;
  46
  47 static DEFINE_MUTEX(rfcomm_mutex);
  48 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
  49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
  50
  51
  52 static LIST_HEAD(session_list);
  53
  54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  64
  65 static void rfcomm_process_connect(struct rfcomm_session *s);
  66
  67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
  68                                                         bdaddr_t *dst,
  69                                                         u8 sec_level,
  70                                                         int *err);
  71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  72 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
  73
  74 /* ---- RFCOMM frame parsing macros ---- */
  75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  76 #define __get_channel(b)  ((b & 0xf8) >> 3)
  77 #define __get_dir(b)      ((b & 0x04) >> 2)
  78 #define __get_type(b)     ((b & 0xef))
  79
  80 #define __test_ea(b)      ((b & 0x01))
  81 #define __test_cr(b)      (!!(b & 0x02))
  82 #define __test_pf(b)      (!!(b & 0x10))
  83
  84 #define __session_dir(s)  ((s)->initiator ? 0x00 : 0x01)
  85
  86 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  87 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  88 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  89 #define __srv_channel(dlci)    (dlci >> 1)
  90 #define __dir(dlci)            (dlci & 0x01)
  91
  92 #define __len8(len)       (((len) << 1) | 1)
  93 #define __len16(len)      ((len) << 1)
  94
  95 /* MCC macros */
  96 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
  97 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
  98 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
  99
 100 /* RPN macros */
 101 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 102 #define __get_rpn_data_bits(line) ((line) & 0x3)
 103 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 104 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 105
 106 static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
 107
 108 static void rfcomm_schedule(void)
 109 {
 110         wake_up_all(&rfcomm_wq);
 111 }
 112
 113 /* ---- RFCOMM FCS computation ---- */
 114
 115 /* reversed, 8-bit, poly=0x07 */
 116 static unsigned char rfcomm_crc_table[256] = {
 117         0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 118         0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 119         0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 120         0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 121
 122         0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 123         0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 124         0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 125         0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 126
 127         0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 128         0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 129         0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 130         0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 131
 132         0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 133         0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 134         0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 135         0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 136
 137         0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 138         0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 139         0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 140         0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 141
 142         0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 143         0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 144         0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 145         0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 146
 147         0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 148         0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 149         0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 150         0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 151
 152         0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 153         0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 154         0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 155         0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 156 };
 157
 158 /* CRC on 2 bytes */
 159 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 160
 161 /* FCS on 2 bytes */
 162 static inline u8 __fcs(u8 *data)
 163 {
 164         return 0xff - __crc(data);
 165 }
 166
 167 /* FCS on 3 bytes */
 168 static inline u8 __fcs2(u8 *data)
 169 {
 170         return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
 171 }
 172
 173 /* Check FCS */
 174 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 175 {
 176         u8 f = __crc(data);
 177
 178         if (type != RFCOMM_UIH)
 179                 f = rfcomm_crc_table[f ^ data[2]];
 180
 181         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 182 }
 183
 184 /* ---- L2CAP callbacks ---- */
 185 static void rfcomm_l2state_change(struct sock *sk)
 186 {
 187         BT_DBG("%p state %d", sk, sk->sk_state);
 188         rfcomm_schedule();
 189 }
 190
 191 static void rfcomm_l2data_ready(struct sock *sk)
 192 {
 193         BT_DBG("%p", sk);
 194         rfcomm_schedule();
 195 }
 196
 197 static int rfcomm_l2sock_create(struct socket **sock)
 198 {
 199         int err;
 200
 201         BT_DBG("");
 202
 203         err = sock_create_kern(&init_net, PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 204         if (!err) {
 205                 struct sock *sk = (*sock)->sk;
 206                 sk->sk_data_ready   = rfcomm_l2data_ready;
 207                 sk->sk_state_change = rfcomm_l2state_change;
 208         }
 209         return err;
 210 }
 211
 212 static int rfcomm_check_security(struct rfcomm_dlc *d)
 213 {
 214         struct sock *sk = d->session->sock->sk;
 215         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 216
 217         __u8 auth_type;
 218
 219         switch (d->sec_level) {
 220         case BT_SECURITY_HIGH:
 221         case BT_SECURITY_FIPS:
 222                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
 223                 break;
 224         case BT_SECURITY_MEDIUM:
 225                 auth_type = HCI_AT_GENERAL_BONDING;
 226                 break;
 227         default:
 228                 auth_type = HCI_AT_NO_BONDING;
 229                 break;
 230         }
 231
 232         return hci_conn_security(conn->hcon, d->sec_level, auth_type,
 233                                  d->out);
 234 }
 235
 236 static void rfcomm_session_timeout(struct timer_list *t)
 237 {
 238         struct rfcomm_session *s = from_timer(s, t, timer);
 239
 240         BT_DBG("session %p state %ld", s, s->state);
 241
 242         set_bit(RFCOMM_TIMED_OUT, &s->flags);
 243         rfcomm_schedule();
 244 }
 245
 246 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 247 {
 248         BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 249
 250         mod_timer(&s->timer, jiffies + timeout);
 251 }
 252
 253 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 254 {
 255         BT_DBG("session %p state %ld", s, s->state);
 256
 257         del_timer_sync(&s->timer);
 258 }
 259
 260 /* ---- RFCOMM DLCs ---- */
 261 static void rfcomm_dlc_timeout(struct timer_list *t)
 262 {
 263         struct rfcomm_dlc *d = from_timer(d, t, timer);
 264
 265         BT_DBG("dlc %p state %ld", d, d->state);
 266
 267         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 268         rfcomm_dlc_put(d);
 269         rfcomm_schedule();
 270 }
 271
 272 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 273 {
 274         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 275
 276         if (!mod_timer(&d->timer, jiffies + timeout))
 277                 rfcomm_dlc_hold(d);
 278 }
 279
 280 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 281 {
 282         BT_DBG("dlc %p state %ld", d, d->state);
 283
 284         if (del_timer(&d->timer))
 285                 rfcomm_dlc_put(d);
 286 }
 287
 288 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 289 {
 290         BT_DBG("%p", d);
 291
 292         d->state      = BT_OPEN;
 293         d->flags      = 0;
 294         d->mscex      = 0;
 295         d->sec_level  = BT_SECURITY_LOW;
 296         d->mtu        = RFCOMM_DEFAULT_MTU;
 297         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 298
 299         d->cfc        = RFCOMM_CFC_DISABLED;
 300         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 301 }
 302
 303 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 304 {
 305         struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 306
 307         if (!d)
 308                 return NULL;
 309
 310         timer_setup(&d->timer, rfcomm_dlc_timeout, 0);
 311
 312         skb_queue_head_init(&d->tx_queue);
 313         mutex_init(&d->lock);
 314         refcount_set(&d->refcnt, 1);
 315
 316         rfcomm_dlc_clear_state(d);
 317
 318         BT_DBG("%p", d);
 319
 320         return d;
 321 }
 322
 323 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 324 {
 325         BT_DBG("%p", d);
 326
 327         skb_queue_purge(&d->tx_queue);
 328         kfree(d);
 329 }
 330
 331 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 332 {
 333         BT_DBG("dlc %p session %p", d, s);
 334
 335         rfcomm_session_clear_timer(s);
 336         rfcomm_dlc_hold(d);
 337         list_add(&d->list, &s->dlcs);
 338         d->session = s;
 339 }
 340
 341 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 342 {
 343         struct rfcomm_session *s = d->session;
 344
 345         BT_DBG("dlc %p refcnt %d session %p", d, refcount_read(&d->refcnt), s);
 346
 347         list_del(&d->list);
 348         d->session = NULL;
 349         rfcomm_dlc_put(d);
 350
 351         if (list_empty(&s->dlcs))
 352                 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
 353 }
 354
 355 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 356 {
 357         struct rfcomm_dlc *d;
 358
 359         list_for_each_entry(d, &s->dlcs, list)
 360                 if (d->dlci == dlci)
 361                         return d;
 362
 363         return NULL;
 364 }
 365
 366 static int rfcomm_check_channel(u8 channel)
 367 {
 368         return channel < 1 || channel > 30;
 369 }
 370
 371 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 372 {
 373         struct rfcomm_session *s;
 374         int err = 0;
 375         u8 dlci;
 376
 377         BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
 378                d, d->state, src, dst, channel);
 379
 380         if (rfcomm_check_channel(channel))
 381                 return -EINVAL;
 382
 383         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 384                 return 0;
 385
 386         s = rfcomm_session_get(src, dst);
 387         if (!s) {
 388                 s = rfcomm_session_create(src, dst, d->sec_level, &err);
 389                 if (!s)
 390                         return err;
 391         }
 392
 393         dlci = __dlci(__session_dir(s), channel);
 394
 395         /* Check if DLCI already exists */
 396         if (rfcomm_dlc_get(s, dlci))
 397                 return -EBUSY;
 398
 399         rfcomm_dlc_clear_state(d);
 400
 401         d->dlci     = dlci;
 402         d->addr     = __addr(s->initiator, dlci);
 403         d->priority = 7;
 404
 405         d->state = BT_CONFIG;
 406         rfcomm_dlc_link(s, d);
 407
 408         d->out = 1;
 409
 410         d->mtu = s->mtu;
 411         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 412
 413         if (s->state == BT_CONNECTED) {
 414                 if (rfcomm_check_security(d))
 415                         rfcomm_send_pn(s, 1, d);
 416                 else
 417                         set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 418         }
 419
 420         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 421
 422         return 0;
 423 }
 424
 425 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 426 {
 427         int r;
 428
 429         rfcomm_lock();
 430
 431         r = __rfcomm_dlc_open(d, src, dst, channel);
 432
 433         rfcomm_unlock();
 434         return r;
 435 }
 436
 437 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
 438 {
 439         struct rfcomm_session *s = d->session;
 440
 441         d->state = BT_DISCONN;
 442         if (skb_queue_empty(&d->tx_queue)) {
 443                 rfcomm_send_disc(s, d->dlci);
 444                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 445         } else {
 446                 rfcomm_queue_disc(d);
 447                 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 448         }
 449 }
 450
 451 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 452 {
 453         struct rfcomm_session *s = d->session;
 454         if (!s)
 455                 return 0;
 456
 457         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 458                         d, d->state, d->dlci, err, s);
 459
 460         switch (d->state) {
 461         case BT_CONNECT:
 462         case BT_CONFIG:
 463         case BT_OPEN:
 464         case BT_CONNECT2:
 465                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 466                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 467                         rfcomm_schedule();
 468                         return 0;
 469                 }
 470         }
 471
 472         switch (d->state) {
 473         case BT_CONNECT:
 474         case BT_CONNECTED:
 475                 __rfcomm_dlc_disconn(d);
 476                 break;
 477
 478         case BT_CONFIG:
 479                 if (s->state != BT_BOUND) {
 480                         __rfcomm_dlc_disconn(d);
 481                         break;
 482                 }
 483                 /* if closing a dlc in a session that hasn't been started,
 484                  * just close and unlink the dlc
 485                  */
 486
 487         default:
 488                 rfcomm_dlc_clear_timer(d);
 489
 490                 rfcomm_dlc_lock(d);
 491                 d->state = BT_CLOSED;
 492                 d->state_change(d, err);
 493                 rfcomm_dlc_unlock(d);
 494
 495                 skb_queue_purge(&d->tx_queue);
 496                 rfcomm_dlc_unlink(d);
 497         }
 498
 499         return 0;
 500 }
 501
 502 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 503 {
 504         int r = 0;
 505         struct rfcomm_dlc *d_list;
 506         struct rfcomm_session *s, *s_list;
 507
 508         BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
 509
 510         rfcomm_lock();
 511
 512         s = d->session;
 513         if (!s)
 514                 goto no_session;
 515
 516         /* after waiting on the mutex check the session still exists
 517          * then check the dlc still exists
 518          */
 519         list_for_each_entry(s_list, &session_list, list) {
 520                 if (s_list == s) {
 521                         list_for_each_entry(d_list, &s->dlcs, list) {
 522                                 if (d_list == d) {
 523                                         r = __rfcomm_dlc_close(d, err);
 524                                         break;
 525                                 }
 526                         }
 527                         break;
 528                 }
 529         }
 530
 531 no_session:
 532         rfcomm_unlock();
 533         return r;
 534 }
 535
 536 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
 537 {
 538         struct rfcomm_session *s;
 539         struct rfcomm_dlc *dlc = NULL;
 540         u8 dlci;
 541
 542         if (rfcomm_check_channel(channel))
 543                 return ERR_PTR(-EINVAL);
 544
 545         rfcomm_lock();
 546         s = rfcomm_session_get(src, dst);
 547         if (s) {
 548                 dlci = __dlci(__session_dir(s), channel);
 549                 dlc = rfcomm_dlc_get(s, dlci);
 550         }
 551         rfcomm_unlock();
 552         return dlc;
 553 }
 554
 555 static int rfcomm_dlc_send_frag(struct rfcomm_dlc *d, struct sk_buff *frag)
 556 {
 557         int len = frag->len;
 558
 559         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 560
 561         if (len > d->mtu)
 562                 return -EINVAL;
 563
 564         rfcomm_make_uih(frag, d->addr);
 565         __skb_queue_tail(&d->tx_queue, frag);
 566
 567         return len;
 568 }
 569
 570 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 571 {
 572         unsigned long flags;
 573         struct sk_buff *frag, *next;
 574         int len;
 575
 576         if (d->state != BT_CONNECTED)
 577                 return -ENOTCONN;
 578
 579         frag = skb_shinfo(skb)->frag_list;
 580         skb_shinfo(skb)->frag_list = NULL;
 581
 582         /* Queue all fragments atomically. */
 583         spin_lock_irqsave(&d->tx_queue.lock, flags);
 584
 585         len = rfcomm_dlc_send_frag(d, skb);
 586         if (len < 0 || !frag)
 587                 goto unlock;
 588
 589         for (; frag; frag = next) {
 590                 int ret;
 591
 592                 next = frag->next;
 593
 594                 ret = rfcomm_dlc_send_frag(d, frag);
 595                 if (ret < 0) {
 596                         kfree_skb(frag);
 597                         goto unlock;
 598                 }
 599
 600                 len += ret;
 601         }
 602
 603 unlock:
 604         spin_unlock_irqrestore(&d->tx_queue.lock, flags);
 605
 606         if (len > 0 && !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 607                 rfcomm_schedule();
 608         return len;
 609 }
 610
 611 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
 612 {
 613         int len = skb->len;
 614
 615         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 616
 617         rfcomm_make_uih(skb, d->addr);
 618         skb_queue_tail(&d->tx_queue, skb);
 619
 620         if (d->state == BT_CONNECTED &&
 621             !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 622                 rfcomm_schedule();
 623 }
 624
 625 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 626 {
 627         BT_DBG("dlc %p state %ld", d, d->state);
 628
 629         if (!d->cfc) {
 630                 d->v24_sig |= RFCOMM_V24_FC;
 631                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 632         }
 633         rfcomm_schedule();
 634 }
 635
 636 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 637 {
 638         BT_DBG("dlc %p state %ld", d, d->state);
 639
 640         if (!d->cfc) {
 641                 d->v24_sig &= ~RFCOMM_V24_FC;
 642                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 643         }
 644         rfcomm_schedule();
 645 }
 646
 647 /*
 648    Set/get modem status functions use _local_ status i.e. what we report
 649    to the other side.
 650    Remote status is provided by dlc->modem_status() callback.
 651  */
 652 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 653 {
 654         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 655                         d, d->state, v24_sig);
 656
 657         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 658                 v24_sig |= RFCOMM_V24_FC;
 659         else
 660                 v24_sig &= ~RFCOMM_V24_FC;
 661
 662         d->v24_sig = v24_sig;
 663
 664         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 665                 rfcomm_schedule();
 666
 667         return 0;
 668 }
 669
 670 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 671 {
 672         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 673                         d, d->state, d->v24_sig);
 674
 675         *v24_sig = d->v24_sig;
 676         return 0;
 677 }
 678
 679 /* ---- RFCOMM sessions ---- */
 680 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 681 {
 682         struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 683
 684         if (!s)
 685                 return NULL;
 686
 687         BT_DBG("session %p sock %p", s, sock);
 688
 689         timer_setup(&s->timer, rfcomm_session_timeout, 0);
 690
 691         INIT_LIST_HEAD(&s->dlcs);
 692         s->state = state;
 693         s->sock  = sock;
 694
 695         s->mtu = RFCOMM_DEFAULT_MTU;
 696         s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 697
 698         /* Do not increment module usage count for listening sessions.
 699          * Otherwise we won't be able to unload the module. */
 700         if (state != BT_LISTEN)
 701                 if (!try_module_get(THIS_MODULE)) {
 702                         kfree(s);
 703                         return NULL;
 704                 }
 705
 706         list_add(&s->list, &session_list);
 707
 708         return s;
 709 }
 710
 711 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
 712 {
 713         int state = s->state;
 714
 715         BT_DBG("session %p state %ld", s, s->state);
 716
 717         list_del(&s->list);
 718
 719         rfcomm_session_clear_timer(s);
 720         sock_release(s->sock);
 721         kfree(s);
 722
 723         if (state != BT_LISTEN)
 724                 module_put(THIS_MODULE);
 725
 726         return NULL;
 727 }
 728
 729 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 730 {
 731         struct rfcomm_session *s, *n;
 732         struct l2cap_chan *chan;
 733         list_for_each_entry_safe(s, n, &session_list, list) {
 734                 chan = l2cap_pi(s->sock->sk)->chan;
 735
 736                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
 737                     !bacmp(&chan->dst, dst))
 738                         return s;
 739         }
 740         return NULL;
 741 }
 742
 743 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
 744                                                    int err)
 745 {
 746         struct rfcomm_dlc *d, *n;
 747
 748         s->state = BT_CLOSED;
 749
 750         BT_DBG("session %p state %ld err %d", s, s->state, err);
 751
 752         /* Close all dlcs */
 753         list_for_each_entry_safe(d, n, &s->dlcs, list) {
 754                 d->state = BT_CLOSED;
 755                 __rfcomm_dlc_close(d, err);
 756         }
 757
 758         rfcomm_session_clear_timer(s);
 759         return rfcomm_session_del(s);
 760 }
 761
 762 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 763                                                         bdaddr_t *dst,
 764                                                         u8 sec_level,
 765                                                         int *err)
 766 {
 767         struct rfcomm_session *s = NULL;
 768         struct sockaddr_l2 addr;
 769         struct socket *sock;
 770         struct sock *sk;
 771
 772         BT_DBG("%pMR -> %pMR", src, dst);
 773
 774         *err = rfcomm_l2sock_create(&sock);
 775         if (*err < 0)
 776                 return NULL;
 777
 778         bacpy(&addr.l2_bdaddr, src);
 779         addr.l2_family = AF_BLUETOOTH;
 780         addr.l2_psm    = 0;
 781         addr.l2_cid    = 0;
 782         addr.l2_bdaddr_type = BDADDR_BREDR;
 783         *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 784         if (*err < 0)
 785                 goto failed;
 786
 787         /* Set L2CAP options */
 788         sk = sock->sk;
 789         lock_sock(sk);
 790         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
 791         l2cap_pi(sk)->chan->sec_level = sec_level;
 792         if (l2cap_ertm)
 793                 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
 794         release_sock(sk);
 795
 796         s = rfcomm_session_add(sock, BT_BOUND);
 797         if (!s) {
 798                 *err = -ENOMEM;
 799                 goto failed;
 800         }
 801
 802         s->initiator = 1;
 803
 804         bacpy(&addr.l2_bdaddr, dst);
 805         addr.l2_family = AF_BLUETOOTH;
 806         addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
 807         addr.l2_cid    = 0;
 808         addr.l2_bdaddr_type = BDADDR_BREDR;
 809         *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 810         if (*err == 0 || *err == -EINPROGRESS)
 811                 return s;
 812
 813         return rfcomm_session_del(s);
 814
 815 failed:
 816         sock_release(sock);
 817         return NULL;
 818 }
 819
 820 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 821 {
 822         struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
 823         if (src)
 824                 bacpy(src, &chan->src);
 825         if (dst)
 826                 bacpy(dst, &chan->dst);
 827 }
 828
 829 /* ---- RFCOMM frame sending ---- */
 830 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 831 {
 832         struct kvec iv = { data, len };
 833         struct msghdr msg;
 834
 835         BT_DBG("session %p len %d", s, len);
 836
 837         memset(&msg, 0, sizeof(msg));
 838
 839         return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
 840 }
 841
 842 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
 843 {
 844         BT_DBG("%p cmd %u", s, cmd->ctrl);
 845
 846         return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
 847 }
 848
 849 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 850 {
 851         struct rfcomm_cmd cmd;
 852
 853         BT_DBG("%p dlci %d", s, dlci);
 854
 855         cmd.addr = __addr(s->initiator, dlci);
 856         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 857         cmd.len  = __len8(0);
 858         cmd.fcs  = __fcs2((u8 *) &cmd);
 859
 860         return rfcomm_send_cmd(s, &cmd);
 861 }
 862
 863 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 864 {
 865         struct rfcomm_cmd cmd;
 866
 867         BT_DBG("%p dlci %d", s, dlci);
 868
 869         cmd.addr = __addr(!s->initiator, dlci);
 870         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 871         cmd.len  = __len8(0);
 872         cmd.fcs  = __fcs2((u8 *) &cmd);
 873
 874         return rfcomm_send_cmd(s, &cmd);
 875 }
 876
 877 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 878 {
 879         struct rfcomm_cmd cmd;
 880
 881         BT_DBG("%p dlci %d", s, dlci);
 882
 883         cmd.addr = __addr(s->initiator, dlci);
 884         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 885         cmd.len  = __len8(0);
 886         cmd.fcs  = __fcs2((u8 *) &cmd);
 887
 888         return rfcomm_send_cmd(s, &cmd);
 889 }
 890
 891 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 892 {
 893         struct rfcomm_cmd *cmd;
 894         struct sk_buff *skb;
 895
 896         BT_DBG("dlc %p dlci %d", d, d->dlci);
 897
 898         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 899         if (!skb)
 900                 return -ENOMEM;
 901
 902         cmd = __skb_put(skb, sizeof(*cmd));
 903         cmd->addr = d->addr;
 904         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 905         cmd->len  = __len8(0);
 906         cmd->fcs  = __fcs2((u8 *) cmd);
 907
 908         skb_queue_tail(&d->tx_queue, skb);
 909         rfcomm_schedule();
 910         return 0;
 911 }
 912
 913 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 914 {
 915         struct rfcomm_cmd cmd;
 916
 917         BT_DBG("%p dlci %d", s, dlci);
 918
 919         cmd.addr = __addr(!s->initiator, dlci);
 920         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 921         cmd.len  = __len8(0);
 922         cmd.fcs  = __fcs2((u8 *) &cmd);
 923
 924         return rfcomm_send_cmd(s, &cmd);
 925 }
 926
 927 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 928 {
 929         struct rfcomm_hdr *hdr;
 930         struct rfcomm_mcc *mcc;
 931         u8 buf[16], *ptr = buf;
 932
 933         BT_DBG("%p cr %d type %d", s, cr, type);
 934
 935         hdr = (void *) ptr; ptr += sizeof(*hdr);
 936         hdr->addr = __addr(s->initiator, 0);
 937         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 938         hdr->len  = __len8(sizeof(*mcc) + 1);
 939
 940         mcc = (void *) ptr; ptr += sizeof(*mcc);
 941         mcc->type = __mcc_type(0, RFCOMM_NSC);
 942         mcc->len  = __len8(1);
 943
 944         /* Type that we didn't like */
 945         *ptr = __mcc_type(cr, type); ptr++;
 946
 947         *ptr = __fcs(buf); ptr++;
 948
 949         return rfcomm_send_frame(s, buf, ptr - buf);
 950 }
 951
 952 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 953 {
 954         struct rfcomm_hdr *hdr;
 955         struct rfcomm_mcc *mcc;
 956         struct rfcomm_pn  *pn;
 957         u8 buf[16], *ptr = buf;
 958
 959         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 960
 961         hdr = (void *) ptr; ptr += sizeof(*hdr);
 962         hdr->addr = __addr(s->initiator, 0);
 963         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 964         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 965
 966         mcc = (void *) ptr; ptr += sizeof(*mcc);
 967         mcc->type = __mcc_type(cr, RFCOMM_PN);
 968         mcc->len  = __len8(sizeof(*pn));
 969
 970         pn = (void *) ptr; ptr += sizeof(*pn);
 971         pn->dlci        = d->dlci;
 972         pn->priority    = d->priority;
 973         pn->ack_timer   = 0;
 974         pn->max_retrans = 0;
 975
 976         if (s->cfc) {
 977                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 978                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 979         } else {
 980                 pn->flow_ctrl = 0;
 981                 pn->credits   = 0;
 982         }
 983
 984         if (cr && channel_mtu >= 0)
 985                 pn->mtu = cpu_to_le16(channel_mtu);
 986         else
 987                 pn->mtu = cpu_to_le16(d->mtu);
 988
 989         *ptr = __fcs(buf); ptr++;
 990
 991         return rfcomm_send_frame(s, buf, ptr - buf);
 992 }
 993
 994 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 995                         u8 bit_rate, u8 data_bits, u8 stop_bits,
 996                         u8 parity, u8 flow_ctrl_settings,
 997                         u8 xon_char, u8 xoff_char, u16 param_mask)
 998 {
 999         struct rfcomm_hdr *hdr;
1000         struct rfcomm_mcc *mcc;
1001         struct rfcomm_rpn *rpn;
1002         u8 buf[16], *ptr = buf;
1003
1004         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
1005                         " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
1006                 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
1007                 flow_ctrl_settings, xon_char, xoff_char, param_mask);
1008
1009         hdr = (void *) ptr; ptr += sizeof(*hdr);
1010         hdr->addr = __addr(s->initiator, 0);
1011         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1012         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
1013
1014         mcc = (void *) ptr; ptr += sizeof(*mcc);
1015         mcc->type = __mcc_type(cr, RFCOMM_RPN);
1016         mcc->len  = __len8(sizeof(*rpn));
1017
1018         rpn = (void *) ptr; ptr += sizeof(*rpn);
1019         rpn->dlci          = __addr(1, dlci);
1020         rpn->bit_rate      = bit_rate;
1021         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
1022         rpn->flow_ctrl     = flow_ctrl_settings;
1023         rpn->xon_char      = xon_char;
1024         rpn->xoff_char     = xoff_char;
1025         rpn->param_mask    = cpu_to_le16(param_mask);
1026
1027         *ptr = __fcs(buf); ptr++;
1028
1029         return rfcomm_send_frame(s, buf, ptr - buf);
1030 }
1031
1032 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
1033 {
1034         struct rfcomm_hdr *hdr;
1035         struct rfcomm_mcc *mcc;
1036         struct rfcomm_rls *rls;
1037         u8 buf[16], *ptr = buf;
1038
1039         BT_DBG("%p cr %d status 0x%x", s, cr, status);
1040
1041         hdr = (void *) ptr; ptr += sizeof(*hdr);
1042         hdr->addr = __addr(s->initiator, 0);
1043         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1044         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
1045
1046         mcc = (void *) ptr; ptr += sizeof(*mcc);
1047         mcc->type = __mcc_type(cr, RFCOMM_RLS);
1048         mcc->len  = __len8(sizeof(*rls));
1049
1050         rls = (void *) ptr; ptr += sizeof(*rls);
1051         rls->dlci   = __addr(1, dlci);
1052         rls->status = status;
1053
1054         *ptr = __fcs(buf); ptr++;
1055
1056         return rfcomm_send_frame(s, buf, ptr - buf);
1057 }
1058
1059 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1060 {
1061         struct rfcomm_hdr *hdr;
1062         struct rfcomm_mcc *mcc;
1063         struct rfcomm_msc *msc;
1064         u8 buf[16], *ptr = buf;
1065
1066         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1067
1068         hdr = (void *) ptr; ptr += sizeof(*hdr);
1069         hdr->addr = __addr(s->initiator, 0);
1070         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1071         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
1072
1073         mcc = (void *) ptr; ptr += sizeof(*mcc);
1074         mcc->type = __mcc_type(cr, RFCOMM_MSC);
1075         mcc->len  = __len8(sizeof(*msc));
1076
1077         msc = (void *) ptr; ptr += sizeof(*msc);
1078         msc->dlci    = __addr(1, dlci);
1079         msc->v24_sig = v24_sig | 0x01;
1080
1081         *ptr = __fcs(buf); ptr++;
1082
1083         return rfcomm_send_frame(s, buf, ptr - buf);
1084 }
1085
1086 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1087 {
1088         struct rfcomm_hdr *hdr;
1089         struct rfcomm_mcc *mcc;
1090         u8 buf[16], *ptr = buf;
1091
1092         BT_DBG("%p cr %d", s, cr);
1093
1094         hdr = (void *) ptr; ptr += sizeof(*hdr);
1095         hdr->addr = __addr(s->initiator, 0);
1096         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1097         hdr->len  = __len8(sizeof(*mcc));
1098
1099         mcc = (void *) ptr; ptr += sizeof(*mcc);
1100         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1101         mcc->len  = __len8(0);
1102
1103         *ptr = __fcs(buf); ptr++;
1104
1105         return rfcomm_send_frame(s, buf, ptr - buf);
1106 }
1107
1108 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1109 {
1110         struct rfcomm_hdr *hdr;
1111         struct rfcomm_mcc *mcc;
1112         u8 buf[16], *ptr = buf;
1113
1114         BT_DBG("%p cr %d", s, cr);
1115
1116         hdr = (void *) ptr; ptr += sizeof(*hdr);
1117         hdr->addr = __addr(s->initiator, 0);
1118         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1119         hdr->len  = __len8(sizeof(*mcc));
1120
1121         mcc = (void *) ptr; ptr += sizeof(*mcc);
1122         mcc->type = __mcc_type(cr, RFCOMM_FCON);
1123         mcc->len  = __len8(0);
1124
1125         *ptr = __fcs(buf); ptr++;
1126
1127         return rfcomm_send_frame(s, buf, ptr - buf);
1128 }
1129
1130 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1131 {
1132         struct socket *sock = s->sock;
1133         struct kvec iv[3];
1134         struct msghdr msg;
1135         unsigned char hdr[5], crc[1];
1136
1137         if (len > 125)
1138                 return -EINVAL;
1139
1140         BT_DBG("%p cr %d", s, cr);
1141
1142         hdr[0] = __addr(s->initiator, 0);
1143         hdr[1] = __ctrl(RFCOMM_UIH, 0);
1144         hdr[2] = 0x01 | ((len + 2) << 1);
1145         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1146         hdr[4] = 0x01 | (len << 1);
1147
1148         crc[0] = __fcs(hdr);
1149
1150         iv[0].iov_base = hdr;
1151         iv[0].iov_len  = 5;
1152         iv[1].iov_base = pattern;
1153         iv[1].iov_len  = len;
1154         iv[2].iov_base = crc;
1155         iv[2].iov_len  = 1;
1156
1157         memset(&msg, 0, sizeof(msg));
1158
1159         return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1160 }
1161
1162 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1163 {
1164         struct rfcomm_hdr *hdr;
1165         u8 buf[16], *ptr = buf;
1166
1167         BT_DBG("%p addr %d credits %d", s, addr, credits);
1168
1169         hdr = (void *) ptr; ptr += sizeof(*hdr);
1170         hdr->addr = addr;
1171         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1172         hdr->len  = __len8(0);
1173
1174         *ptr = credits; ptr++;
1175
1176         *ptr = __fcs(buf); ptr++;
1177
1178         return rfcomm_send_frame(s, buf, ptr - buf);
1179 }
1180
1181 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1182 {
1183         struct rfcomm_hdr *hdr;
1184         int len = skb->len;
1185         u8 *crc;
1186
1187         if (len > 127) {
1188                 hdr = skb_push(skb, 4);
1189                 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1190         } else {
1191                 hdr = skb_push(skb, 3);
1192                 hdr->len = __len8(len);
1193         }
1194         hdr->addr = addr;
1195         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1196
1197         crc = skb_put(skb, 1);
1198         *crc = __fcs((void *) hdr);
1199 }
1200
1201 /* ---- RFCOMM frame reception ---- */
1202 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1203 {
1204         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1205
1206         if (dlci) {
1207                 /* Data channel */
1208                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1209                 if (!d) {
1210                         rfcomm_send_dm(s, dlci);
1211                         return s;
1212                 }
1213
1214                 switch (d->state) {
1215                 case BT_CONNECT:
1216                         rfcomm_dlc_clear_timer(d);
1217
1218                         rfcomm_dlc_lock(d);
1219                         d->state = BT_CONNECTED;
1220                         d->state_change(d, 0);
1221                         rfcomm_dlc_unlock(d);
1222
1223                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1224                         break;
1225
1226                 case BT_DISCONN:
1227                         d->state = BT_CLOSED;
1228                         __rfcomm_dlc_close(d, 0);
1229
1230                         if (list_empty(&s->dlcs)) {
1231                                 s->state = BT_DISCONN;
1232                                 rfcomm_send_disc(s, 0);
1233                                 rfcomm_session_clear_timer(s);
1234                         }
1235
1236                         break;
1237                 }
1238         } else {
1239                 /* Control channel */
1240                 switch (s->state) {
1241                 case BT_CONNECT:
1242                         s->state = BT_CONNECTED;
1243                         rfcomm_process_connect(s);
1244                         break;
1245
1246                 case BT_DISCONN:
1247                         s = rfcomm_session_close(s, ECONNRESET);
1248                         break;
1249                 }
1250         }
1251         return s;
1252 }
1253
1254 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1255 {
1256         int err = 0;
1257
1258         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1259
1260         if (dlci) {
1261                 /* Data DLC */
1262                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1263                 if (d) {
1264                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1265                                 err = ECONNREFUSED;
1266                         else
1267                                 err = ECONNRESET;
1268
1269                         d->state = BT_CLOSED;
1270                         __rfcomm_dlc_close(d, err);
1271                 }
1272         } else {
1273                 if (s->state == BT_CONNECT)
1274                         err = ECONNREFUSED;
1275                 else
1276                         err = ECONNRESET;
1277
1278                 s = rfcomm_session_close(s, err);
1279         }
1280         return s;
1281 }
1282
1283 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1284                                                u8 dlci)
1285 {
1286         int err = 0;
1287
1288         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1289
1290         if (dlci) {
1291                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1292                 if (d) {
1293                         rfcomm_send_ua(s, dlci);
1294
1295                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1296                                 err = ECONNREFUSED;
1297                         else
1298                                 err = ECONNRESET;
1299
1300                         d->state = BT_CLOSED;
1301                         __rfcomm_dlc_close(d, err);
1302                 } else
1303                         rfcomm_send_dm(s, dlci);
1304
1305         } else {
1306                 rfcomm_send_ua(s, 0);
1307
1308                 if (s->state == BT_CONNECT)
1309                         err = ECONNREFUSED;
1310                 else
1311                         err = ECONNRESET;
1312
1313                 s = rfcomm_session_close(s, err);
1314         }
1315         return s;
1316 }
1317
1318 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1319 {
1320         struct sock *sk = d->session->sock->sk;
1321         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1322
1323         BT_DBG("dlc %p", d);
1324
1325         rfcomm_send_ua(d->session, d->dlci);
1326
1327         rfcomm_dlc_clear_timer(d);
1328
1329         rfcomm_dlc_lock(d);
1330         d->state = BT_CONNECTED;
1331         d->state_change(d, 0);
1332         rfcomm_dlc_unlock(d);
1333
1334         if (d->role_switch)
1335                 hci_conn_switch_role(conn->hcon, 0x00);
1336
1337         rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1338 }
1339
1340 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1341 {
1342         if (rfcomm_check_security(d)) {
1343                 if (d->defer_setup) {
1344                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1345                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1346
1347                         rfcomm_dlc_lock(d);
1348                         d->state = BT_CONNECT2;
1349                         d->state_change(d, 0);
1350                         rfcomm_dlc_unlock(d);
1351                 } else
1352                         rfcomm_dlc_accept(d);
1353         } else {
1354                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1355                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1356         }
1357 }
1358
1359 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1360 {
1361         struct rfcomm_dlc *d;
1362         u8 channel;
1363
1364         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1365
1366         if (!dlci) {
1367                 rfcomm_send_ua(s, 0);
1368
1369                 if (s->state == BT_OPEN) {
1370                         s->state = BT_CONNECTED;
1371                         rfcomm_process_connect(s);
1372                 }
1373                 return 0;
1374         }
1375
1376         /* Check if DLC exists */
1377         d = rfcomm_dlc_get(s, dlci);
1378         if (d) {
1379                 if (d->state == BT_OPEN) {
1380                         /* DLC was previously opened by PN request */
1381                         rfcomm_check_accept(d);
1382                 }
1383                 return 0;
1384         }
1385
1386         /* Notify socket layer about incoming connection */
1387         channel = __srv_channel(dlci);
1388         if (rfcomm_connect_ind(s, channel, &d)) {
1389                 d->dlci = dlci;
1390                 d->addr = __addr(s->initiator, dlci);
1391                 rfcomm_dlc_link(s, d);
1392
1393                 rfcomm_check_accept(d);
1394         } else {
1395                 rfcomm_send_dm(s, dlci);
1396         }
1397
1398         return 0;
1399 }
1400
1401 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1402 {
1403         struct rfcomm_session *s = d->session;
1404
1405         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1406                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1407
1408         if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1409                                                 pn->flow_ctrl == 0xe0) {
1410                 d->cfc = RFCOMM_CFC_ENABLED;
1411                 d->tx_credits = pn->credits;
1412         } else {
1413                 d->cfc = RFCOMM_CFC_DISABLED;
1414                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1415         }
1416
1417         if (s->cfc == RFCOMM_CFC_UNKNOWN)
1418                 s->cfc = d->cfc;
1419
1420         d->priority = pn->priority;
1421
1422         d->mtu = __le16_to_cpu(pn->mtu);
1423
1424         if (cr && d->mtu > s->mtu)
1425                 d->mtu = s->mtu;
1426
1427         return 0;
1428 }
1429
1430 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1431 {
1432         struct rfcomm_pn *pn = (void *) skb->data;
1433         struct rfcomm_dlc *d;
1434         u8 dlci = pn->dlci;
1435
1436         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1437
1438         if (!dlci)
1439                 return 0;
1440
1441         d = rfcomm_dlc_get(s, dlci);
1442         if (d) {
1443                 if (cr) {
1444                         /* PN request */
1445                         rfcomm_apply_pn(d, cr, pn);
1446                         rfcomm_send_pn(s, 0, d);
1447                 } else {
1448                         /* PN response */
1449                         switch (d->state) {
1450                         case BT_CONFIG:
1451                                 rfcomm_apply_pn(d, cr, pn);
1452
1453                                 d->state = BT_CONNECT;
1454                                 rfcomm_send_sabm(s, d->dlci);
1455                                 break;
1456                         }
1457                 }
1458         } else {
1459                 u8 channel = __srv_channel(dlci);
1460
1461                 if (!cr)
1462                         return 0;
1463
1464                 /* PN request for non existing DLC.
1465                  * Assume incoming connection. */
1466                 if (rfcomm_connect_ind(s, channel, &d)) {
1467                         d->dlci = dlci;
1468                         d->addr = __addr(s->initiator, dlci);
1469                         rfcomm_dlc_link(s, d);
1470
1471                         rfcomm_apply_pn(d, cr, pn);
1472
1473                         d->state = BT_OPEN;
1474                         rfcomm_send_pn(s, 0, d);
1475                 } else {
1476                         rfcomm_send_dm(s, dlci);
1477                 }
1478         }
1479         return 0;
1480 }
1481
1482 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1483 {
1484         struct rfcomm_rpn *rpn = (void *) skb->data;
1485         u8 dlci = __get_dlci(rpn->dlci);
1486
1487         u8 bit_rate  = 0;
1488         u8 data_bits = 0;
1489         u8 stop_bits = 0;
1490         u8 parity    = 0;
1491         u8 flow_ctrl = 0;
1492         u8 xon_char  = 0;
1493         u8 xoff_char = 0;
1494         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1495
1496         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1497                 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1498                 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1499
1500         if (!cr)
1501                 return 0;
1502
1503         if (len == 1) {
1504                 /* This is a request, return default (according to ETSI TS 07.10) settings */
1505                 bit_rate  = RFCOMM_RPN_BR_9600;
1506                 data_bits = RFCOMM_RPN_DATA_8;
1507                 stop_bits = RFCOMM_RPN_STOP_1;
1508                 parity    = RFCOMM_RPN_PARITY_NONE;
1509                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1510                 xon_char  = RFCOMM_RPN_XON_CHAR;
1511                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1512                 goto rpn_out;
1513         }
1514
1515         /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1516          * no parity, no flow control lines, normal XON/XOFF chars */
1517
1518         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1519                 bit_rate = rpn->bit_rate;
1520                 if (bit_rate > RFCOMM_RPN_BR_230400) {
1521                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1522                         bit_rate = RFCOMM_RPN_BR_9600;
1523                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1524                 }
1525         }
1526
1527         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1528                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1529                 if (data_bits != RFCOMM_RPN_DATA_8) {
1530                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1531                         data_bits = RFCOMM_RPN_DATA_8;
1532                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1533                 }
1534         }
1535
1536         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1537                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1538                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1539                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1540                         stop_bits = RFCOMM_RPN_STOP_1;
1541                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1542                 }
1543         }
1544
1545         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1546                 parity = __get_rpn_parity(rpn->line_settings);
1547                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1548                         BT_DBG("RPN parity mismatch 0x%x", parity);
1549                         parity = RFCOMM_RPN_PARITY_NONE;
1550                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1551                 }
1552         }
1553
1554         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1555                 flow_ctrl = rpn->flow_ctrl;
1556                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1557                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1558                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1559                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1560                 }
1561         }
1562
1563         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1564                 xon_char = rpn->xon_char;
1565                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1566                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1567                         xon_char = RFCOMM_RPN_XON_CHAR;
1568                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1569                 }
1570         }
1571
1572         if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1573                 xoff_char = rpn->xoff_char;
1574                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1575                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1576                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1577                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1578                 }
1579         }
1580
1581 rpn_out:
1582         rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1583                         parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1584
1585         return 0;
1586 }
1587
1588 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1589 {
1590         struct rfcomm_rls *rls = (void *) skb->data;
1591         u8 dlci = __get_dlci(rls->dlci);
1592
1593         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1594
1595         if (!cr)
1596                 return 0;
1597
1598         /* We should probably do something with this information here. But
1599          * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1600          * mandatory to recognise and respond to RLS */
1601
1602         rfcomm_send_rls(s, 0, dlci, rls->status);
1603
1604         return 0;
1605 }
1606
1607 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1608 {
1609         struct rfcomm_msc *msc = (void *) skb->data;
1610         struct rfcomm_dlc *d;
1611         u8 dlci = __get_dlci(msc->dlci);
1612
1613         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1614
1615         d = rfcomm_dlc_get(s, dlci);
1616         if (!d)
1617                 return 0;
1618
1619         if (cr) {
1620                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1621                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1622                 else
1623                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1624
1625                 rfcomm_dlc_lock(d);
1626
1627                 d->remote_v24_sig = msc->v24_sig;
1628
1629                 if (d->modem_status)
1630                         d->modem_status(d, msc->v24_sig);
1631
1632                 rfcomm_dlc_unlock(d);
1633
1634                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1635
1636                 d->mscex |= RFCOMM_MSCEX_RX;
1637         } else
1638                 d->mscex |= RFCOMM_MSCEX_TX;
1639
1640         return 0;
1641 }
1642
1643 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1644 {
1645         struct rfcomm_mcc *mcc = (void *) skb->data;
1646         u8 type, cr, len;
1647
1648         cr   = __test_cr(mcc->type);
1649         type = __get_mcc_type(mcc->type);
1650         len  = __get_mcc_len(mcc->len);
1651
1652         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1653
1654         skb_pull(skb, 2);
1655
1656         switch (type) {
1657         case RFCOMM_PN:
1658                 rfcomm_recv_pn(s, cr, skb);
1659                 break;
1660
1661         case RFCOMM_RPN:
1662                 rfcomm_recv_rpn(s, cr, len, skb);
1663                 break;
1664
1665         case RFCOMM_RLS:
1666                 rfcomm_recv_rls(s, cr, skb);
1667                 break;
1668
1669         case RFCOMM_MSC:
1670                 rfcomm_recv_msc(s, cr, skb);
1671                 break;
1672
1673         case RFCOMM_FCOFF:
1674                 if (cr) {
1675                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1676                         rfcomm_send_fcoff(s, 0);
1677                 }
1678                 break;
1679
1680         case RFCOMM_FCON:
1681                 if (cr) {
1682                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1683                         rfcomm_send_fcon(s, 0);
1684                 }
1685                 break;
1686
1687         case RFCOMM_TEST:
1688                 if (cr)
1689                         rfcomm_send_test(s, 0, skb->data, skb->len);
1690                 break;
1691
1692         case RFCOMM_NSC:
1693                 break;
1694
1695         default:
1696                 BT_ERR("Unknown control type 0x%02x", type);
1697                 rfcomm_send_nsc(s, cr, type);
1698                 break;
1699         }
1700         return 0;
1701 }
1702
1703 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1704 {
1705         struct rfcomm_dlc *d;
1706
1707         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1708
1709         d = rfcomm_dlc_get(s, dlci);
1710         if (!d) {
1711                 rfcomm_send_dm(s, dlci);
1712                 goto drop;
1713         }
1714
1715         if (pf && d->cfc) {
1716                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1717
1718                 d->tx_credits += credits;
1719                 if (d->tx_credits)
1720                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1721         }
1722
1723         if (skb->len && d->state == BT_CONNECTED) {
1724                 rfcomm_dlc_lock(d);
1725                 d->rx_credits--;
1726                 d->data_ready(d, skb);
1727                 rfcomm_dlc_unlock(d);
1728                 return 0;
1729         }
1730
1731 drop:
1732         kfree_skb(skb);
1733         return 0;
1734 }
1735
1736 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1737                                                 struct sk_buff *skb)
1738 {
1739         struct rfcomm_hdr *hdr = (void *) skb->data;
1740         u8 type, dlci, fcs;
1741
1742         if (!s) {
1743                 /* no session, so free socket data */
1744                 kfree_skb(skb);
1745                 return s;
1746         }
1747
1748         dlci = __get_dlci(hdr->addr);
1749         type = __get_type(hdr->ctrl);
1750
1751         /* Trim FCS */
1752         skb->len--; skb->tail--;
1753         fcs = *(u8 *)skb_tail_pointer(skb);
1754
1755         if (__check_fcs(skb->data, type, fcs)) {
1756                 BT_ERR("bad checksum in packet");
1757                 kfree_skb(skb);
1758                 return s;
1759         }
1760
1761         if (__test_ea(hdr->len))
1762                 skb_pull(skb, 3);
1763         else
1764                 skb_pull(skb, 4);
1765
1766         switch (type) {
1767         case RFCOMM_SABM:
1768                 if (__test_pf(hdr->ctrl))
1769                         rfcomm_recv_sabm(s, dlci);
1770                 break;
1771
1772         case RFCOMM_DISC:
1773                 if (__test_pf(hdr->ctrl))
1774                         s = rfcomm_recv_disc(s, dlci);
1775                 break;
1776
1777         case RFCOMM_UA:
1778                 if (__test_pf(hdr->ctrl))
1779                         s = rfcomm_recv_ua(s, dlci);
1780                 break;
1781
1782         case RFCOMM_DM:
1783                 s = rfcomm_recv_dm(s, dlci);
1784                 break;
1785
1786         case RFCOMM_UIH:
1787                 if (dlci) {
1788                         rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1789                         return s;
1790                 }
1791                 rfcomm_recv_mcc(s, skb);
1792                 break;
1793
1794         default:
1795                 BT_ERR("Unknown packet type 0x%02x", type);
1796                 break;
1797         }
1798         kfree_skb(skb);
1799         return s;
1800 }
1801
1802 /* ---- Connection and data processing ---- */
1803
1804 static void rfcomm_process_connect(struct rfcomm_session *s)
1805 {
1806         struct rfcomm_dlc *d, *n;
1807
1808         BT_DBG("session %p state %ld", s, s->state);
1809
1810         list_for_each_entry_safe(d, n, &s->dlcs, list) {
1811                 if (d->state == BT_CONFIG) {
1812                         d->mtu = s->mtu;
1813                         if (rfcomm_check_security(d)) {
1814                                 rfcomm_send_pn(s, 1, d);
1815                         } else {
1816                                 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1817                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1818                         }
1819                 }
1820         }
1821 }
1822
1823 /* Send data queued for the DLC.
1824  * Return number of frames left in the queue.
1825  */
1826 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1827 {
1828         struct sk_buff *skb;
1829         int err;
1830
1831         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1832                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1833
1834         /* Send pending MSC */
1835         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1836                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1837
1838         if (d->cfc) {
1839                 /* CFC enabled.
1840                  * Give them some credits */
1841                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1842                                 d->rx_credits <= (d->cfc >> 2)) {
1843                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1844                         d->rx_credits = d->cfc;
1845                 }
1846         } else {
1847                 /* CFC disabled.
1848                  * Give ourselves some credits */
1849                 d->tx_credits = 5;
1850         }
1851
1852         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1853                 return skb_queue_len(&d->tx_queue);
1854
1855         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1856                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1857                 if (err < 0) {
1858                         skb_queue_head(&d->tx_queue, skb);
1859                         break;
1860                 }
1861                 kfree_skb(skb);
1862                 d->tx_credits--;
1863         }
1864
1865         if (d->cfc && !d->tx_credits) {
1866                 /* We're out of TX credits.
1867                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1868                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1869         }
1870
1871         return skb_queue_len(&d->tx_queue);
1872 }
1873
1874 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1875 {
1876         struct rfcomm_dlc *d, *n;
1877
1878         BT_DBG("session %p state %ld", s, s->state);
1879
1880         list_for_each_entry_safe(d, n, &s->dlcs, list) {
1881                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1882                         __rfcomm_dlc_close(d, ETIMEDOUT);
1883                         continue;
1884                 }
1885
1886                 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1887                         __rfcomm_dlc_close(d, ECONNREFUSED);
1888                         continue;
1889                 }
1890
1891                 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1892                         rfcomm_dlc_clear_timer(d);
1893                         if (d->out) {
1894                                 rfcomm_send_pn(s, 1, d);
1895                                 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1896                         } else {
1897                                 if (d->defer_setup) {
1898                                         set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1899                                         rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1900
1901                                         rfcomm_dlc_lock(d);
1902                                         d->state = BT_CONNECT2;
1903                                         d->state_change(d, 0);
1904                                         rfcomm_dlc_unlock(d);
1905                                 } else
1906                                         rfcomm_dlc_accept(d);
1907                         }
1908                         continue;
1909                 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1910                         rfcomm_dlc_clear_timer(d);
1911                         if (!d->out)
1912                                 rfcomm_send_dm(s, d->dlci);
1913                         else
1914                                 d->state = BT_CLOSED;
1915                         __rfcomm_dlc_close(d, ECONNREFUSED);
1916                         continue;
1917                 }
1918
1919                 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1920                         continue;
1921
1922                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1923                         continue;
1924
1925                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1926                                                 d->mscex == RFCOMM_MSCEX_OK)
1927                         rfcomm_process_tx(d);
1928         }
1929 }
1930
1931 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1932 {
1933         struct socket *sock = s->sock;
1934         struct sock *sk = sock->sk;
1935         struct sk_buff *skb;
1936
1937         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1938
1939         /* Get data directly from socket receive queue without copying it. */
1940         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1941                 skb_orphan(skb);
1942                 if (!skb_linearize(skb)) {
1943                         s = rfcomm_recv_frame(s, skb);
1944                         if (!s)
1945                                 break;
1946                 } else {
1947                         kfree_skb(skb);
1948                 }
1949         }
1950
1951         if (s && (sk->sk_state == BT_CLOSED))
1952                 s = rfcomm_session_close(s, sk->sk_err);
1953
1954         return s;
1955 }
1956
1957 static void rfcomm_accept_connection(struct rfcomm_session *s)
1958 {
1959         struct socket *sock = s->sock, *nsock;
1960         int err;
1961
1962         /* Fast check for a new connection.
1963          * Avoids unnesesary socket allocations. */
1964         if (list_empty(&bt_sk(sock->sk)->accept_q))
1965                 return;
1966
1967         BT_DBG("session %p", s);
1968
1969         err = kernel_accept(sock, &nsock, O_NONBLOCK);
1970         if (err < 0)
1971                 return;
1972
1973         /* Set our callbacks */
1974         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1975         nsock->sk->sk_state_change = rfcomm_l2state_change;
1976
1977         s = rfcomm_session_add(nsock, BT_OPEN);
1978         if (s) {
1979                 /* We should adjust MTU on incoming sessions.
1980                  * L2CAP MTU minus UIH header and FCS. */
1981                 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1982                                 l2cap_pi(nsock->sk)->chan->imtu) - 5;
1983
1984                 rfcomm_schedule();
1985         } else
1986                 sock_release(nsock);
1987 }
1988
1989 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1990 {
1991         struct sock *sk = s->sock->sk;
1992
1993         BT_DBG("%p state %ld", s, s->state);
1994
1995         switch (sk->sk_state) {
1996         case BT_CONNECTED:
1997                 s->state = BT_CONNECT;
1998
1999                 /* We can adjust MTU on outgoing sessions.
2000                  * L2CAP MTU minus UIH header and FCS. */
2001                 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
2002
2003                 rfcomm_send_sabm(s, 0);
2004                 break;
2005
2006         case BT_CLOSED:
2007                 s = rfcomm_session_close(s, sk->sk_err);
2008                 break;
2009         }
2010         return s;
2011 }
2012
2013 static void rfcomm_process_sessions(void)
2014 {
2015         struct rfcomm_session *s, *n;
2016
2017         rfcomm_lock();
2018
2019         list_for_each_entry_safe(s, n, &session_list, list) {
2020                 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
2021                         s->state = BT_DISCONN;
2022                         rfcomm_send_disc(s, 0);
2023                         continue;
2024                 }
2025
2026                 switch (s->state) {
2027                 case BT_LISTEN:
2028                         rfcomm_accept_connection(s);
2029                         continue;
2030
2031                 case BT_BOUND:
2032                         s = rfcomm_check_connection(s);
2033                         break;
2034
2035                 default:
2036                         s = rfcomm_process_rx(s);
2037                         break;
2038                 }
2039
2040                 if (s)
2041                         rfcomm_process_dlcs(s);
2042         }
2043
2044         rfcomm_unlock();
2045 }
2046
2047 static int rfcomm_add_listener(bdaddr_t *ba)
2048 {
2049         struct sockaddr_l2 addr;
2050         struct socket *sock;
2051         struct sock *sk;
2052         struct rfcomm_session *s;
2053         int    err = 0;
2054
2055         /* Create socket */
2056         err = rfcomm_l2sock_create(&sock);
2057         if (err < 0) {
2058                 BT_ERR("Create socket failed %d", err);
2059                 return err;
2060         }
2061
2062         /* Bind socket */
2063         bacpy(&addr.l2_bdaddr, ba);
2064         addr.l2_family = AF_BLUETOOTH;
2065         addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
2066         addr.l2_cid    = 0;
2067         addr.l2_bdaddr_type = BDADDR_BREDR;
2068         err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
2069         if (err < 0) {
2070                 BT_ERR("Bind failed %d", err);
2071                 goto failed;
2072         }
2073
2074         /* Set L2CAP options */
2075         sk = sock->sk;
2076         lock_sock(sk);
2077         l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2078         release_sock(sk);
2079
2080         /* Start listening on the socket */
2081         err = kernel_listen(sock, 10);
2082         if (err) {
2083                 BT_ERR("Listen failed %d", err);
2084                 goto failed;
2085         }
2086
2087         /* Add listening session */
2088         s = rfcomm_session_add(sock, BT_LISTEN);
2089         if (!s) {
2090                 err = -ENOMEM;
2091                 goto failed;
2092         }
2093
2094         return 0;
2095 failed:
2096         sock_release(sock);
2097         return err;
2098 }
2099
2100 static void rfcomm_kill_listener(void)
2101 {
2102         struct rfcomm_session *s, *n;
2103
2104         BT_DBG("");
2105
2106         list_for_each_entry_safe(s, n, &session_list, list)
2107                 rfcomm_session_del(s);
2108 }
2109
2110 static int rfcomm_run(void *unused)
2111 {
2112         DEFINE_WAIT_FUNC(wait, woken_wake_function);
2113         BT_DBG("");
2114
2115         set_user_nice(current, -10);
2116
2117         rfcomm_add_listener(BDADDR_ANY);
2118
2119         add_wait_queue(&rfcomm_wq, &wait);
2120         while (!kthread_should_stop()) {
2121
2122                 /* Process stuff */
2123                 rfcomm_process_sessions();
2124
2125                 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2126         }
2127         remove_wait_queue(&rfcomm_wq, &wait);
2128
2129         rfcomm_kill_listener();
2130
2131         return 0;
2132 }
2133
2134 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2135 {
2136         struct rfcomm_session *s;
2137         struct rfcomm_dlc *d, *n;
2138
2139         BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2140
2141         s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2142         if (!s)
2143                 return;
2144
2145         list_for_each_entry_safe(d, n, &s->dlcs, list) {
2146                 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2147                         rfcomm_dlc_clear_timer(d);
2148                         if (status || encrypt == 0x00) {
2149                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2150                                 continue;
2151                         }
2152                 }
2153
2154                 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2155                         if (d->sec_level == BT_SECURITY_MEDIUM) {
2156                                 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2157                                 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2158                                 continue;
2159                         } else if (d->sec_level == BT_SECURITY_HIGH ||
2160                                    d->sec_level == BT_SECURITY_FIPS) {
2161                                 set_bit(RFCOMM_ENC_DROP, &d->flags);
2162                                 continue;
2163                         }
2164                 }
2165
2166                 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2167                         continue;
2168
2169                 if (!status && hci_conn_check_secure(conn, d->sec_level))
2170                         set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2171                 else
2172                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2173         }
2174
2175         rfcomm_schedule();
2176 }
2177
2178 static struct hci_cb rfcomm_cb = {
2179         .name           = "RFCOMM",
2180         .security_cfm   = rfcomm_security_cfm
2181 };
2182
2183 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2184 {
2185         struct rfcomm_session *s;
2186
2187         rfcomm_lock();
2188
2189         list_for_each_entry(s, &session_list, list) {
2190                 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2191                 struct rfcomm_dlc *d;
2192                 list_for_each_entry(d, &s->dlcs, list) {
2193                         seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2194                                    &chan->src, &chan->dst,
2195                                    d->state, d->dlci, d->mtu,
2196                                    d->rx_credits, d->tx_credits);
2197                 }
2198         }
2199
2200         rfcomm_unlock();
2201
2202         return 0;
2203 }
2204
2205 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2206 {
2207         return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2208 }
2209
2210 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2211         .open           = rfcomm_dlc_debugfs_open,
2212         .read           = seq_read,
2213         .llseek         = seq_lseek,
2214         .release        = single_release,
2215 };
2216
2217 static struct dentry *rfcomm_dlc_debugfs;
2218
2219 /* ---- Initialization ---- */
2220 static int __init rfcomm_init(void)
2221 {
2222         int err;
2223
2224         hci_register_cb(&rfcomm_cb);
2225
2226         rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2227         if (IS_ERR(rfcomm_thread)) {
2228                 err = PTR_ERR(rfcomm_thread);
2229                 goto unregister;
2230         }
2231
2232         err = rfcomm_init_ttys();
2233         if (err < 0)
2234                 goto stop;
2235
2236         err = rfcomm_init_sockets();
2237         if (err < 0)
2238                 goto cleanup;
2239
2240         BT_INFO("RFCOMM ver %s", VERSION);
2241
2242         if (IS_ERR_OR_NULL(bt_debugfs))
2243                 return 0;
2244
2245         rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2246                                                  bt_debugfs, NULL,
2247                                                  &rfcomm_dlc_debugfs_fops);
2248
2249         return 0;
2250
2251 cleanup:
2252         rfcomm_cleanup_ttys();
2253
2254 stop:
2255         kthread_stop(rfcomm_thread);
2256
2257 unregister:
2258         hci_unregister_cb(&rfcomm_cb);
2259
2260         return err;
2261 }
2262
2263 static void __exit rfcomm_exit(void)
2264 {
2265         debugfs_remove(rfcomm_dlc_debugfs);
2266
2267         hci_unregister_cb(&rfcomm_cb);
2268
2269         kthread_stop(rfcomm_thread);
2270
2271         rfcomm_cleanup_ttys();
2272
2273         rfcomm_cleanup_sockets();
2274 }
2275
2276 module_init(rfcomm_init);
2277 module_exit(rfcomm_exit);
2278
2279 module_param(disable_cfc, bool, 0644);
2280 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2281
2282 module_param(channel_mtu, int, 0644);
2283 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2284
2285 module_param(l2cap_mtu, uint, 0644);
2286 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2287
2288 module_param(l2cap_ertm, bool, 0644);
2289 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2290
2291 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2292 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2293 MODULE_VERSION(VERSION);
2294 MODULE_LICENSE("GPL");
2295 MODULE_ALIAS("bt-proto-3");