]> bbs.cooldavid.org Git - net-next-2.6.git/blame - net/bluetooth/rfcomm/core.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
net: return operator cleanup
[net-next-2.6.git] / net / bluetooth / rfcomm / core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
8e87d142
YH		 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 21 SOFTWARE IS DISCLAIMED.
22*/
23
1da177e4
LT		 24/*
25 * Bluetooth RFCOMM core.
1da177e4
LT		 26 */
27
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/errno.h>
30#include <linux/kernel.h>
31#include <linux/sched.h>
32#include <linux/signal.h>
33#include <linux/init.h>
34#include <linux/wait.h>
be9d1227 35#include <linux/device.h>
aef7d97c
MH		 36#include <linux/debugfs.h>
37#include <linux/seq_file.h>
1da177e4 38#include <linux/net.h>
4a3e2f71 39#include <linux/mutex.h>
a524eccc 40#include <linux/kthread.h>
5a0e3ad6 41#include <linux/slab.h>
4a3e2f71 42
1da177e4
LT		 43#include <net/sock.h>
44#include <asm/uaccess.h>
45#include <asm/unaligned.h>
46
47#include <net/bluetooth/bluetooth.h>
48#include <net/bluetooth/hci_core.h>
49#include <net/bluetooth/l2cap.h>
50#include <net/bluetooth/rfcomm.h>
51
5f9018af 52#define VERSION "1.11"
56f3a40a 53
7c2660b0 54static int disable_cfc = 0;
98bcd08b 55static int channel_mtu = -1;
56f3a40a 56static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
eae38eed 57static int l2cap_ertm = 0;
56f3a40a 58
1da177e4
LT		 59static struct task_struct *rfcomm_thread;
60
4a3e2f71
AV		 61static DEFINE_MUTEX(rfcomm_mutex);
62#define rfcomm_lock() mutex_lock(&rfcomm_mutex)
63#define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
1da177e4
LT		 64
65static unsigned long rfcomm_event;
66
67static LIST_HEAD(session_list);
1da177e4
LT		 68
69static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
70static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
71static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
72static int rfcomm_queue_disc(struct rfcomm_dlc *d);
73static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
74static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
75static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
76static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
77static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
78static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
79
80static void rfcomm_process_connect(struct rfcomm_session *s);
81
82static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
83static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
84static void rfcomm_session_del(struct rfcomm_session *s);
85
86/* ---- RFCOMM frame parsing macros ---- */
87#define __get_dlci(b) ((b & 0xfc) >> 2)
88#define __get_channel(b) ((b & 0xf8) >> 3)
89#define __get_dir(b) ((b & 0x04) >> 2)
90#define __get_type(b) ((b & 0xef))
91
92#define __test_ea(b) ((b & 0x01))
93#define __test_cr(b) ((b & 0x02))
94#define __test_pf(b) ((b & 0x10))
95
96#define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
97#define __ctrl(type, pf) (((type & 0xef) | (pf << 4)))
98#define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir)
99#define __srv_channel(dlci) (dlci >> 1)
100#define __dir(dlci) (dlci & 0x01)
101
102#define __len8(len) (((len) << 1) | 1)
103#define __len16(len) ((len) << 1)
104
105/* MCC macros */
106#define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01))
107#define __get_mcc_type(b) ((b & 0xfc) >> 2)
108#define __get_mcc_len(b) ((b & 0xfe) >> 1)
109
110/* RPN macros */
3a5e903c 111#define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
1da177e4
LT		 112#define __get_rpn_data_bits(line) ((line) & 0x3)
113#define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
3a5e903c 114#define __get_rpn_parity(line) (((line) >> 3) & 0x7)
1da177e4
LT		 115
116static inline void rfcomm_schedule(uint event)
117{
118 if (!rfcomm_thread)
119 return;
120 //set_bit(event, &rfcomm_event);
121 set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
122 wake_up_process(rfcomm_thread);
123}
124
125static inline void rfcomm_session_put(struct rfcomm_session *s)
126{
127 if (atomic_dec_and_test(&s->refcnt))
128 rfcomm_session_del(s);
129}
130
131/* ---- RFCOMM FCS computation ---- */
132
408c1ce2 133/* reversed, 8-bit, poly=0x07 */
8e87d142 134static unsigned char rfcomm_crc_table[256] = {
408c1ce2
MH		 135 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
136 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
137 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
138 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
139
140 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
141 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
142 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
143 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
144
145 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
146 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
147 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
148 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
149
150 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
151 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
152 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
153 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
154
155 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
156 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
157 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
158 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
159
160 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
161 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
162 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
163 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
164
165 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
166 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
167 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
168 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
169
170 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
171 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
172 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
173 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
174};
175
1da177e4
LT		 176/* CRC on 2 bytes */
177#define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
178
8e87d142 179/* FCS on 2 bytes */
1da177e4
LT		 180static inline u8 __fcs(u8 *data)
181{
a02cec21 182 return 0xff - __crc(data);
1da177e4
LT		 183}
184
8e87d142 185/* FCS on 3 bytes */
1da177e4
LT		 186static inline u8 __fcs2(u8 *data)
187{
a02cec21 188 return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
1da177e4
LT		 189}
190
191/* Check FCS */
192static inline int __check_fcs(u8 *data, int type, u8 fcs)
193{
194 u8 f = __crc(data);
195
196 if (type != RFCOMM_UIH)
197 f = rfcomm_crc_table[f ^ data[2]];
198
199 return rfcomm_crc_table[f ^ fcs] != 0xcf;
200}
201
202/* ---- L2CAP callbacks ---- */
203static void rfcomm_l2state_change(struct sock *sk)
204{
205 BT_DBG("%p state %d", sk, sk->sk_state);
206 rfcomm_schedule(RFCOMM_SCHED_STATE);
207}
208
209static void rfcomm_l2data_ready(struct sock *sk, int bytes)
210{
211 BT_DBG("%p bytes %d", sk, bytes);
212 rfcomm_schedule(RFCOMM_SCHED_RX);
213}
214
215static int rfcomm_l2sock_create(struct socket **sock)
216{
217 int err;
218
219 BT_DBG("");
220
221 err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
222 if (!err) {
223 struct sock *sk = (*sock)->sk;
224 sk->sk_data_ready = rfcomm_l2data_ready;
225 sk->sk_state_change = rfcomm_l2state_change;
226 }
227 return err;
228}
229
9f2c8a03 230static inline int rfcomm_check_security(struct rfcomm_dlc *d)
77db1980
MH		 231{
232 struct sock *sk = d->session->sock->sk;
0684e5f9
MH		 233 __u8 auth_type;
234
235 switch (d->sec_level) {
236 case BT_SECURITY_HIGH:
237 auth_type = HCI_AT_GENERAL_BONDING_MITM;
238 break;
239 case BT_SECURITY_MEDIUM:
240 auth_type = HCI_AT_GENERAL_BONDING;
241 break;
242 default:
243 auth_type = HCI_AT_NO_BONDING;
244 break;
245 }
77db1980 246
0684e5f9
MH		 247 return hci_conn_security(l2cap_pi(sk)->conn->hcon, d->sec_level,
248 auth_type);
77db1980
MH		 249}
250
9e726b17
LAD		 251static void rfcomm_session_timeout(unsigned long arg)
252{
253 struct rfcomm_session *s = (void *) arg;
254
255 BT_DBG("session %p state %ld", s, s->state);
256
257 set_bit(RFCOMM_TIMED_OUT, &s->flags);
9e726b17
LAD		 258 rfcomm_schedule(RFCOMM_SCHED_TIMEO);
259}
260
261static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
262{
263 BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
264
265 if (!mod_timer(&s->timer, jiffies + timeout))
266 rfcomm_session_hold(s);
267}
268
269static void rfcomm_session_clear_timer(struct rfcomm_session *s)
270{
271 BT_DBG("session %p state %ld", s, s->state);
272
273 if (timer_pending(&s->timer) && del_timer(&s->timer))
274 rfcomm_session_put(s);
275}
276
1da177e4
LT		 277/* ---- RFCOMM DLCs ---- */
278static void rfcomm_dlc_timeout(unsigned long arg)
279{
280 struct rfcomm_dlc *d = (void *) arg;
281
282 BT_DBG("dlc %p state %ld", d, d->state);
283
284 set_bit(RFCOMM_TIMED_OUT, &d->flags);
285 rfcomm_dlc_put(d);
286 rfcomm_schedule(RFCOMM_SCHED_TIMEO);
287}
288
289static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
290{
291 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
292
293 if (!mod_timer(&d->timer, jiffies + timeout))
294 rfcomm_dlc_hold(d);
295}
296
297static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
298{
299 BT_DBG("dlc %p state %ld", d, d->state);
300
301 if (timer_pending(&d->timer) && del_timer(&d->timer))
302 rfcomm_dlc_put(d);
303}
304
305static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
306{
307 BT_DBG("%p", d);
308
309 d->state = BT_OPEN;
310 d->flags = 0;
311 d->mscex = 0;
312 d->mtu = RFCOMM_DEFAULT_MTU;
313 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
314
315 d->cfc = RFCOMM_CFC_DISABLED;
316 d->rx_credits = RFCOMM_DEFAULT_CREDITS;
317}
318
dd0fc66f 319struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
1da177e4 320{
25ea6db0
MH		 321 struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
322
1da177e4
LT		 323 if (!d)
324 return NULL;
1da177e4 325
b24b8a24 326 setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
1da177e4
LT		 327
328 skb_queue_head_init(&d->tx_queue);
329 spin_lock_init(&d->lock);
330 atomic_set(&d->refcnt, 1);
331
332 rfcomm_dlc_clear_state(d);
8e87d142 333
1da177e4 334 BT_DBG("%p", d);
25ea6db0 335
1da177e4
LT		 336 return d;
337}
338
339void rfcomm_dlc_free(struct rfcomm_dlc *d)
340{
341 BT_DBG("%p", d);
342
343 skb_queue_purge(&d->tx_queue);
344 kfree(d);
345}
346
347static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
348{
349 BT_DBG("dlc %p session %p", d, s);
350
351 rfcomm_session_hold(s);
352
9e726b17 353 rfcomm_session_clear_timer(s);
1da177e4
LT		 354 rfcomm_dlc_hold(d);
355 list_add(&d->list, &s->dlcs);
356 d->session = s;
357}
358
359static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
360{
361 struct rfcomm_session *s = d->session;
362
363 BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
364
365 list_del(&d->list);
366 d->session = NULL;
367 rfcomm_dlc_put(d);
368
9e726b17
LAD		 369 if (list_empty(&s->dlcs))
370 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
371
1da177e4
LT		 372 rfcomm_session_put(s);
373}
374
375static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
376{
377 struct rfcomm_dlc *d;
378 struct list_head *p;
379
380 list_for_each(p, &s->dlcs) {
381 d = list_entry(p, struct rfcomm_dlc, list);
382 if (d->dlci == dlci)
383 return d;
384 }
385 return NULL;
386}
387
388static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
389{
390 struct rfcomm_session *s;
391 int err = 0;
392 u8 dlci;
393
8e87d142 394 BT_DBG("dlc %p state %ld %s %s channel %d",
1da177e4
LT		 395 d, d->state, batostr(src), batostr(dst), channel);
396
397 if (channel < 1 || channel > 30)
398 return -EINVAL;
399
400 if (d->state != BT_OPEN && d->state != BT_CLOSED)
401 return 0;
402
403 s = rfcomm_session_get(src, dst);
404 if (!s) {
405 s = rfcomm_session_create(src, dst, &err);
406 if (!s)
407 return err;
408 }
409
410 dlci = __dlci(!s->initiator, channel);
411
412 /* Check if DLCI already exists */
413 if (rfcomm_dlc_get(s, dlci))
414 return -EBUSY;
415
416 rfcomm_dlc_clear_state(d);
417
418 d->dlci = dlci;
419 d->addr = __addr(s->initiator, dlci);
420 d->priority = 7;
421
77db1980 422 d->state = BT_CONFIG;
1da177e4
LT		 423 rfcomm_dlc_link(s, d);
424
77db1980
MH		 425 d->out = 1;
426
1da177e4
LT		 427 d->mtu = s->mtu;
428 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
429
77db1980 430 if (s->state == BT_CONNECTED) {
9f2c8a03 431 if (rfcomm_check_security(d))
77db1980 432 rfcomm_send_pn(s, 1, d);
8c1b2355
MH		 433 else
434 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
77db1980
MH		 435 }
436
1da177e4 437 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
77db1980 438
1da177e4
LT		 439 return 0;
440}
441
442int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
443{
444 int r;
445
446 rfcomm_lock();
447
448 r = __rfcomm_dlc_open(d, src, dst, channel);
449
450 rfcomm_unlock();
451 return r;
452}
453
454static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
455{
456 struct rfcomm_session *s = d->session;
457 if (!s)
458 return 0;
459
460 BT_DBG("dlc %p state %ld dlci %d err %d session %p",
461 d, d->state, d->dlci, err, s);
462
463 switch (d->state) {
1da177e4 464 case BT_CONNECT:
bb23c0ab
MH		 465 case BT_CONFIG:
466 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
467 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
468 rfcomm_schedule(RFCOMM_SCHED_AUTH);
469 break;
470 }
471 /* Fall through */
472
473 case BT_CONNECTED:
1da177e4
LT		 474 d->state = BT_DISCONN;
475 if (skb_queue_empty(&d->tx_queue)) {
476 rfcomm_send_disc(s, d->dlci);
477 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
478 } else {
479 rfcomm_queue_disc(d);
480 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
481 }
482 break;
483
bb23c0ab 484 case BT_OPEN:
8bf47941 485 case BT_CONNECT2:
bb23c0ab
MH		 486 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
487 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
488 rfcomm_schedule(RFCOMM_SCHED_AUTH);
489 break;
490 }
491 /* Fall through */
492
1da177e4
LT		 493 default:
494 rfcomm_dlc_clear_timer(d);
495
496 rfcomm_dlc_lock(d);
497 d->state = BT_CLOSED;
1905f6c7 498 d->state_change(d, err);
4c8411f8 499 rfcomm_dlc_unlock(d);
1da177e4
LT		 500
501 skb_queue_purge(&d->tx_queue);
1da177e4
LT		 502 rfcomm_dlc_unlink(d);
503 }
504
505 return 0;
506}
507
508int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
509{
510 int r;
511
512 rfcomm_lock();
513
514 r = __rfcomm_dlc_close(d, err);
515
516 rfcomm_unlock();
517 return r;
518}
519
520int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
521{
522 int len = skb->len;
523
524 if (d->state != BT_CONNECTED)
525 return -ENOTCONN;
526
527 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
528
529 if (len > d->mtu)
530 return -EINVAL;
531
532 rfcomm_make_uih(skb, d->addr);
533 skb_queue_tail(&d->tx_queue, skb);
534
535 if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
536 rfcomm_schedule(RFCOMM_SCHED_TX);
537 return len;
538}
539
b5606c2d 540void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
1da177e4
LT		 541{
542 BT_DBG("dlc %p state %ld", d, d->state);
543
544 if (!d->cfc) {
545 d->v24_sig |= RFCOMM_V24_FC;
546 set_bit(RFCOMM_MSC_PENDING, &d->flags);
547 }
548 rfcomm_schedule(RFCOMM_SCHED_TX);
549}
550
b5606c2d 551void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
1da177e4
LT		 552{
553 BT_DBG("dlc %p state %ld", d, d->state);
554
555 if (!d->cfc) {
556 d->v24_sig &= ~RFCOMM_V24_FC;
557 set_bit(RFCOMM_MSC_PENDING, &d->flags);
558 }
559 rfcomm_schedule(RFCOMM_SCHED_TX);
560}
561
8e87d142 562/*
1da177e4
LT		 563 Set/get modem status functions use _local_ status i.e. what we report
564 to the other side.
565 Remote status is provided by dlc->modem_status() callback.
566 */
567int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
568{
8e87d142 569 BT_DBG("dlc %p state %ld v24_sig 0x%x",
1da177e4
LT		 570 d, d->state, v24_sig);
571
572 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
573 v24_sig |= RFCOMM_V24_FC;
574 else
575 v24_sig &= ~RFCOMM_V24_FC;
8e87d142 576
1da177e4
LT		 577 d->v24_sig = v24_sig;
578
579 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
580 rfcomm_schedule(RFCOMM_SCHED_TX);
581
582 return 0;
583}
584
585int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
586{
8e87d142 587 BT_DBG("dlc %p state %ld v24_sig 0x%x",
1da177e4
LT		 588 d, d->state, d->v24_sig);
589
590 *v24_sig = d->v24_sig;
591 return 0;
592}
593
594/* ---- RFCOMM sessions ---- */
595static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
596{
25ea6db0
MH		 597 struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
598
1da177e4
LT		 599 if (!s)
600 return NULL;
1da177e4
LT		 601
602 BT_DBG("session %p sock %p", s, sock);
603
9e726b17
LAD		 604 setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
605
1da177e4
LT		 606 INIT_LIST_HEAD(&s->dlcs);
607 s->state = state;
608 s->sock = sock;
609
610 s->mtu = RFCOMM_DEFAULT_MTU;
7c2660b0 611 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
1da177e4
LT		 612
613 /* Do not increment module usage count for listening sessions.
614 * Otherwise we won't be able to unload the module. */
615 if (state != BT_LISTEN)
616 if (!try_module_get(THIS_MODULE)) {
617 kfree(s);
618 return NULL;
619 }
620
621 list_add(&s->list, &session_list);
622
623 return s;
624}
625
626static void rfcomm_session_del(struct rfcomm_session *s)
627{
628 int state = s->state;
629
630 BT_DBG("session %p state %ld", s, s->state);
631
632 list_del(&s->list);
633
634 if (state == BT_CONNECTED)
635 rfcomm_send_disc(s, 0);
636
9e726b17 637 rfcomm_session_clear_timer(s);
1da177e4
LT		 638 sock_release(s->sock);
639 kfree(s);
640
641 if (state != BT_LISTEN)
642 module_put(THIS_MODULE);
643}
644
645static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
646{
647 struct rfcomm_session *s;
648 struct list_head *p, *n;
649 struct bt_sock *sk;
650 list_for_each_safe(p, n, &session_list) {
651 s = list_entry(p, struct rfcomm_session, list);
8e87d142 652 sk = bt_sk(s->sock->sk);
1da177e4
LT		 653
654 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
655 !bacmp(&sk->dst, dst))
656 return s;
657 }
658 return NULL;
659}
660
661static void rfcomm_session_close(struct rfcomm_session *s, int err)
662{
663 struct rfcomm_dlc *d;
664 struct list_head *p, *n;
665
666 BT_DBG("session %p state %ld err %d", s, s->state, err);
667
668 rfcomm_session_hold(s);
669
670 s->state = BT_CLOSED;
671
672 /* Close all dlcs */
673 list_for_each_safe(p, n, &s->dlcs) {
674 d = list_entry(p, struct rfcomm_dlc, list);
675 d->state = BT_CLOSED;
676 __rfcomm_dlc_close(d, err);
677 }
678
9e726b17 679 rfcomm_session_clear_timer(s);
1da177e4
LT		 680 rfcomm_session_put(s);
681}
682
683static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
684{
685 struct rfcomm_session *s = NULL;
686 struct sockaddr_l2 addr;
687 struct socket *sock;
688 struct sock *sk;
689
690 BT_DBG("%s %s", batostr(src), batostr(dst));
691
692 *err = rfcomm_l2sock_create(&sock);
693 if (*err < 0)
694 return NULL;
695
696 bacpy(&addr.l2_bdaddr, src);
697 addr.l2_family = AF_BLUETOOTH;
698 addr.l2_psm = 0;
37e62f55 699 addr.l2_cid = 0;
48db9ca4 700 *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1da177e4
LT		 701 if (*err < 0)
702 goto failed;
703
704 /* Set L2CAP options */
705 sk = sock->sk;
706 lock_sock(sk);
56f3a40a 707 l2cap_pi(sk)->imtu = l2cap_mtu;
eae38eed
MH		 708 if (l2cap_ertm)
709 l2cap_pi(sk)->mode = L2CAP_MODE_ERTM;
1da177e4
LT		 710 release_sock(sk);
711
712 s = rfcomm_session_add(sock, BT_BOUND);
713 if (!s) {
714 *err = -ENOMEM;
715 goto failed;
716 }
717
1da177e4
LT		 718 s->initiator = 1;
719
720 bacpy(&addr.l2_bdaddr, dst);
721 addr.l2_family = AF_BLUETOOTH;
b4324b5d 722 addr.l2_psm = cpu_to_le16(RFCOMM_PSM);
37e62f55 723 addr.l2_cid = 0;
48db9ca4 724 *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
b4c612a4 725 if (*err == 0 || *err == -EINPROGRESS)
1da177e4
LT		 726 return s;
727
728 rfcomm_session_del(s);
729 return NULL;
730
731failed:
732 sock_release(sock);
733 return NULL;
734}
735
736void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
737{
738 struct sock *sk = s->sock->sk;
739 if (src)
740 bacpy(src, &bt_sk(sk)->src);
741 if (dst)
742 bacpy(dst, &bt_sk(sk)->dst);
743}
744
745/* ---- RFCOMM frame sending ---- */
746static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
747{
748 struct socket *sock = s->sock;
749 struct kvec iv = { data, len };
750 struct msghdr msg;
751
752 BT_DBG("session %p len %d", s, len);
753
754 memset(&msg, 0, sizeof(msg));
755
756 return kernel_sendmsg(sock, &msg, &iv, 1, len);
757}
758
759static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
760{
761 struct rfcomm_cmd cmd;
762
763 BT_DBG("%p dlci %d", s, dlci);
764
765 cmd.addr = __addr(s->initiator, dlci);
766 cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
767 cmd.len = __len8(0);
768 cmd.fcs = __fcs2((u8 *) &cmd);
769
770 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
771}
772
773static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
774{
775 struct rfcomm_cmd cmd;
776
777 BT_DBG("%p dlci %d", s, dlci);
778
779 cmd.addr = __addr(!s->initiator, dlci);
780 cmd.ctrl = __ctrl(RFCOMM_UA, 1);
781 cmd.len = __len8(0);
782 cmd.fcs = __fcs2((u8 *) &cmd);
783
784 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
785}
786
787static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
788{
789 struct rfcomm_cmd cmd;
790
791 BT_DBG("%p dlci %d", s, dlci);
792
793 cmd.addr = __addr(s->initiator, dlci);
794 cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
795 cmd.len = __len8(0);
796 cmd.fcs = __fcs2((u8 *) &cmd);
797
798 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
799}
800
801static int rfcomm_queue_disc(struct rfcomm_dlc *d)
802{
803 struct rfcomm_cmd *cmd;
804 struct sk_buff *skb;
805
806 BT_DBG("dlc %p dlci %d", d, d->dlci);
807
808 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
809 if (!skb)
810 return -ENOMEM;
811
812 cmd = (void *) __skb_put(skb, sizeof(*cmd));
813 cmd->addr = d->addr;
814 cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
815 cmd->len = __len8(0);
816 cmd->fcs = __fcs2((u8 *) cmd);
817
818 skb_queue_tail(&d->tx_queue, skb);
819 rfcomm_schedule(RFCOMM_SCHED_TX);
820 return 0;
821}
822
823static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
824{
825 struct rfcomm_cmd cmd;
826
827 BT_DBG("%p dlci %d", s, dlci);
828
829 cmd.addr = __addr(!s->initiator, dlci);
830 cmd.ctrl = __ctrl(RFCOMM_DM, 1);
831 cmd.len = __len8(0);
832 cmd.fcs = __fcs2((u8 *) &cmd);
833
834 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
835}
836
837static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
838{
839 struct rfcomm_hdr *hdr;
840 struct rfcomm_mcc *mcc;
841 u8 buf[16], *ptr = buf;
842
843 BT_DBG("%p cr %d type %d", s, cr, type);
844
845 hdr = (void *) ptr; ptr += sizeof(*hdr);
846 hdr->addr = __addr(s->initiator, 0);
847 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
848 hdr->len = __len8(sizeof(*mcc) + 1);
849
850 mcc = (void *) ptr; ptr += sizeof(*mcc);
851 mcc->type = __mcc_type(cr, RFCOMM_NSC);
852 mcc->len = __len8(1);
853
854 /* Type that we didn't like */
855 *ptr = __mcc_type(cr, type); ptr++;
856
857 *ptr = __fcs(buf); ptr++;
858
859 return rfcomm_send_frame(s, buf, ptr - buf);
860}
861
862static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
863{
864 struct rfcomm_hdr *hdr;
865 struct rfcomm_mcc *mcc;
866 struct rfcomm_pn *pn;
867 u8 buf[16], *ptr = buf;
868
869 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
870
871 hdr = (void *) ptr; ptr += sizeof(*hdr);
872 hdr->addr = __addr(s->initiator, 0);
873 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
874 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn));
875
876 mcc = (void *) ptr; ptr += sizeof(*mcc);
877 mcc->type = __mcc_type(cr, RFCOMM_PN);
878 mcc->len = __len8(sizeof(*pn));
879
880 pn = (void *) ptr; ptr += sizeof(*pn);
881 pn->dlci = d->dlci;
882 pn->priority = d->priority;
883 pn->ack_timer = 0;
884 pn->max_retrans = 0;
885
886 if (s->cfc) {
887 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
888 pn->credits = RFCOMM_DEFAULT_CREDITS;
889 } else {
890 pn->flow_ctrl = 0;
891 pn->credits = 0;
892 }
893
98bcd08b 894 if (cr && channel_mtu >= 0)
b4324b5d 895 pn->mtu = cpu_to_le16(channel_mtu);
98bcd08b 896 else
b4324b5d 897 pn->mtu = cpu_to_le16(d->mtu);
1da177e4
LT		 898
899 *ptr = __fcs(buf); ptr++;
900
901 return rfcomm_send_frame(s, buf, ptr - buf);
902}
903
3a5e903c
S		 904int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
905 u8 bit_rate, u8 data_bits, u8 stop_bits,
8e87d142 906 u8 parity, u8 flow_ctrl_settings,
3a5e903c 907 u8 xon_char, u8 xoff_char, u16 param_mask)
1da177e4
LT		 908{
909 struct rfcomm_hdr *hdr;
910 struct rfcomm_mcc *mcc;
911 struct rfcomm_rpn *rpn;
912 u8 buf[16], *ptr = buf;
913
914 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
8e87d142
YH		 915 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
916 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
3a5e903c 917 flow_ctrl_settings, xon_char, xoff_char, param_mask);
1da177e4
LT		 918
919 hdr = (void *) ptr; ptr += sizeof(*hdr);
920 hdr->addr = __addr(s->initiator, 0);
921 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
922 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn));
923
924 mcc = (void *) ptr; ptr += sizeof(*mcc);
925 mcc->type = __mcc_type(cr, RFCOMM_RPN);
926 mcc->len = __len8(sizeof(*rpn));
927
928 rpn = (void *) ptr; ptr += sizeof(*rpn);
929 rpn->dlci = __addr(1, dlci);
930 rpn->bit_rate = bit_rate;
931 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
932 rpn->flow_ctrl = flow_ctrl_settings;
933 rpn->xon_char = xon_char;
934 rpn->xoff_char = xoff_char;
e8db8c99 935 rpn->param_mask = cpu_to_le16(param_mask);
1da177e4
LT		 936
937 *ptr = __fcs(buf); ptr++;
938
939 return rfcomm_send_frame(s, buf, ptr - buf);
940}
941
942static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
943{
944 struct rfcomm_hdr *hdr;
945 struct rfcomm_mcc *mcc;
946 struct rfcomm_rls *rls;
947 u8 buf[16], *ptr = buf;
948
949 BT_DBG("%p cr %d status 0x%x", s, cr, status);
950
951 hdr = (void *) ptr; ptr += sizeof(*hdr);
952 hdr->addr = __addr(s->initiator, 0);
953 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
954 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls));
955
956 mcc = (void *) ptr; ptr += sizeof(*mcc);
957 mcc->type = __mcc_type(cr, RFCOMM_RLS);
958 mcc->len = __len8(sizeof(*rls));
959
960 rls = (void *) ptr; ptr += sizeof(*rls);
961 rls->dlci = __addr(1, dlci);
962 rls->status = status;
963
964 *ptr = __fcs(buf); ptr++;
965
966 return rfcomm_send_frame(s, buf, ptr - buf);
967}
968
969static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
970{
971 struct rfcomm_hdr *hdr;
972 struct rfcomm_mcc *mcc;
973 struct rfcomm_msc *msc;
974 u8 buf[16], *ptr = buf;
975
976 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
977
978 hdr = (void *) ptr; ptr += sizeof(*hdr);
979 hdr->addr = __addr(s->initiator, 0);
980 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
981 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc));
982
983 mcc = (void *) ptr; ptr += sizeof(*mcc);
984 mcc->type = __mcc_type(cr, RFCOMM_MSC);
985 mcc->len = __len8(sizeof(*msc));
986
987 msc = (void *) ptr; ptr += sizeof(*msc);
988 msc->dlci = __addr(1, dlci);
989 msc->v24_sig = v24_sig | 0x01;
990
991 *ptr = __fcs(buf); ptr++;
992
993 return rfcomm_send_frame(s, buf, ptr - buf);
994}
995
996static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
997{
998 struct rfcomm_hdr *hdr;
999 struct rfcomm_mcc *mcc;
1000 u8 buf[16], *ptr = buf;
1001
1002 BT_DBG("%p cr %d", s, cr);
1003
1004 hdr = (void *) ptr; ptr += sizeof(*hdr);
1005 hdr->addr = __addr(s->initiator, 0);
1006 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1007 hdr->len = __len8(sizeof(*mcc));
1008
1009 mcc = (void *) ptr; ptr += sizeof(*mcc);
1010 mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1011 mcc->len = __len8(0);
1012
1013 *ptr = __fcs(buf); ptr++;
1014
1015 return rfcomm_send_frame(s, buf, ptr - buf);
1016}
1017
1018static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1019{
1020 struct rfcomm_hdr *hdr;
1021 struct rfcomm_mcc *mcc;
1022 u8 buf[16], *ptr = buf;
1023
1024 BT_DBG("%p cr %d", s, cr);
1025
1026 hdr = (void *) ptr; ptr += sizeof(*hdr);
1027 hdr->addr = __addr(s->initiator, 0);
1028 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1029 hdr->len = __len8(sizeof(*mcc));
1030
1031 mcc = (void *) ptr; ptr += sizeof(*mcc);
1032 mcc->type = __mcc_type(cr, RFCOMM_FCON);
1033 mcc->len = __len8(0);
1034
1035 *ptr = __fcs(buf); ptr++;
1036
1037 return rfcomm_send_frame(s, buf, ptr - buf);
1038}
1039
1040static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1041{
1042 struct socket *sock = s->sock;
1043 struct kvec iv[3];
1044 struct msghdr msg;
1045 unsigned char hdr[5], crc[1];
1046
1047 if (len > 125)
1048 return -EINVAL;
1049
1050 BT_DBG("%p cr %d", s, cr);
1051
1052 hdr[0] = __addr(s->initiator, 0);
1053 hdr[1] = __ctrl(RFCOMM_UIH, 0);
1054 hdr[2] = 0x01 | ((len + 2) << 1);
1055 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1056 hdr[4] = 0x01 | (len << 1);
1057
1058 crc[0] = __fcs(hdr);
1059
1060 iv[0].iov_base = hdr;
1061 iv[0].iov_len = 5;
1062 iv[1].iov_base = pattern;
1063 iv[1].iov_len = len;
1064 iv[2].iov_base = crc;
1065 iv[2].iov_len = 1;
1066
1067 memset(&msg, 0, sizeof(msg));
1068
1069 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1070}
1071
1072static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1073{
1074 struct rfcomm_hdr *hdr;
1075 u8 buf[16], *ptr = buf;
1076
1077 BT_DBG("%p addr %d credits %d", s, addr, credits);
1078
1079 hdr = (void *) ptr; ptr += sizeof(*hdr);
1080 hdr->addr = addr;
1081 hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1082 hdr->len = __len8(0);
1083
1084 *ptr = credits; ptr++;
1085
1086 *ptr = __fcs(buf); ptr++;
1087
1088 return rfcomm_send_frame(s, buf, ptr - buf);
1089}
1090
1091static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1092{
1093 struct rfcomm_hdr *hdr;
1094 int len = skb->len;
1095 u8 *crc;
1096
1097 if (len > 127) {
1098 hdr = (void *) skb_push(skb, 4);
b4324b5d 1099 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1da177e4
LT		 1100 } else {
1101 hdr = (void *) skb_push(skb, 3);
1102 hdr->len = __len8(len);
1103 }
1104 hdr->addr = addr;
1105 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1106
1107 crc = skb_put(skb, 1);
1108 *crc = __fcs((void *) hdr);
1109}
1110
1111/* ---- RFCOMM frame reception ---- */
1112static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1113{
1114 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1115
1116 if (dlci) {
1117 /* Data channel */
1118 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1119 if (!d) {
1120 rfcomm_send_dm(s, dlci);
1121 return 0;
1122 }
1123
1124 switch (d->state) {
1125 case BT_CONNECT:
1126 rfcomm_dlc_clear_timer(d);
1127
1128 rfcomm_dlc_lock(d);
1129 d->state = BT_CONNECTED;
1130 d->state_change(d, 0);
1131 rfcomm_dlc_unlock(d);
1132
1133 rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1134 break;
1135
1136 case BT_DISCONN:
1137 d->state = BT_CLOSED;
1138 __rfcomm_dlc_close(d, 0);
9cf5b0ea
MH		 1139
1140 if (list_empty(&s->dlcs)) {
1141 s->state = BT_DISCONN;
1142 rfcomm_send_disc(s, 0);
1143 }
1144
1da177e4
LT		 1145 break;
1146 }
1147 } else {
1148 /* Control channel */
1149 switch (s->state) {
1150 case BT_CONNECT:
1151 s->state = BT_CONNECTED;
1152 rfcomm_process_connect(s);
1153 break;
9cf5b0ea
MH		 1154
1155 case BT_DISCONN:
6c2718da
NP		 1156 /* When socket is closed and we are not RFCOMM
1157 * initiator rfcomm_process_rx already calls
1158 * rfcomm_session_put() */
1159 if (s->sock->sk->sk_state != BT_CLOSED)
1160 rfcomm_session_put(s);
9cf5b0ea 1161 break;
1da177e4
LT		 1162 }
1163 }
1164 return 0;
1165}
1166
1167static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1168{
1169 int err = 0;
1170
1171 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1172
1173 if (dlci) {
1174 /* Data DLC */
1175 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1176 if (d) {
1177 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1178 err = ECONNREFUSED;
1179 else
1180 err = ECONNRESET;
1181
1182 d->state = BT_CLOSED;
1183 __rfcomm_dlc_close(d, err);
1184 }
1185 } else {
1186 if (s->state == BT_CONNECT)
1187 err = ECONNREFUSED;
1188 else
1189 err = ECONNRESET;
1190
1191 s->state = BT_CLOSED;
1192 rfcomm_session_close(s, err);
1193 }
1194 return 0;
1195}
1196
1197static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1198{
1199 int err = 0;
1200
1201 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1202
1203 if (dlci) {
1204 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1205 if (d) {
1206 rfcomm_send_ua(s, dlci);
1207
1208 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1209 err = ECONNREFUSED;
1210 else
1211 err = ECONNRESET;
1212
1213 d->state = BT_CLOSED;
1214 __rfcomm_dlc_close(d, err);
8e87d142 1215 } else
1da177e4 1216 rfcomm_send_dm(s, dlci);
8e87d142 1217
1da177e4
LT		 1218 } else {
1219 rfcomm_send_ua(s, 0);
1220
1221 if (s->state == BT_CONNECT)
1222 err = ECONNREFUSED;
1223 else
1224 err = ECONNRESET;
1225
1226 s->state = BT_CLOSED;
1227 rfcomm_session_close(s, err);
1228 }
1229
1230 return 0;
1231}
1232
bb23c0ab 1233void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1da177e4 1234{
300b9397
MH		 1235 struct sock *sk = d->session->sock->sk;
1236
1da177e4
LT		 1237 BT_DBG("dlc %p", d);
1238
1239 rfcomm_send_ua(d->session, d->dlci);
1240
e2139b32
JH		 1241 rfcomm_dlc_clear_timer(d);
1242
1da177e4
LT		 1243 rfcomm_dlc_lock(d);
1244 d->state = BT_CONNECTED;
1245 d->state_change(d, 0);
1246 rfcomm_dlc_unlock(d);
1247
9f2c8a03 1248 if (d->role_switch)
300b9397
MH		 1249 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1250
1da177e4
LT		 1251 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1252}
1253
bb23c0ab
MH		 1254static void rfcomm_check_accept(struct rfcomm_dlc *d)
1255{
9f2c8a03 1256 if (rfcomm_check_security(d)) {
bb23c0ab
MH		 1257 if (d->defer_setup) {
1258 set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1259 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
8bf47941
MH		 1260
1261 rfcomm_dlc_lock(d);
1262 d->state = BT_CONNECT2;
1263 d->state_change(d, 0);
1264 rfcomm_dlc_unlock(d);
bb23c0ab
MH		 1265 } else
1266 rfcomm_dlc_accept(d);
8c1b2355
MH		 1267 } else {
1268 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1269 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
bb23c0ab
MH		 1270 }
1271}
1272
1da177e4
LT		 1273static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1274{
1275 struct rfcomm_dlc *d;
1276 u8 channel;
1277
1278 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1279
1280 if (!dlci) {
1281 rfcomm_send_ua(s, 0);
1282
1283 if (s->state == BT_OPEN) {
1284 s->state = BT_CONNECTED;
1285 rfcomm_process_connect(s);
1286 }
1287 return 0;
1288 }
1289
1290 /* Check if DLC exists */
1291 d = rfcomm_dlc_get(s, dlci);
1292 if (d) {
1293 if (d->state == BT_OPEN) {
1294 /* DLC was previously opened by PN request */
bb23c0ab 1295 rfcomm_check_accept(d);
1da177e4
LT		 1296 }
1297 return 0;
1298 }
1299
1300 /* Notify socket layer about incoming connection */
1301 channel = __srv_channel(dlci);
1302 if (rfcomm_connect_ind(s, channel, &d)) {
1303 d->dlci = dlci;
1304 d->addr = __addr(s->initiator, dlci);
1305 rfcomm_dlc_link(s, d);
1306
bb23c0ab 1307 rfcomm_check_accept(d);
1da177e4
LT		 1308 } else {
1309 rfcomm_send_dm(s, dlci);
1310 }
1311
1312 return 0;
1313}
1314
1315static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1316{
1317 struct rfcomm_session *s = d->session;
1318
8e87d142 1319 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1da177e4
LT		 1320 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1321
7c2660b0
MH		 1322 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1323 pn->flow_ctrl == 0xe0) {
1324 d->cfc = RFCOMM_CFC_ENABLED;
1da177e4
LT		 1325 d->tx_credits = pn->credits;
1326 } else {
7c2660b0 1327 d->cfc = RFCOMM_CFC_DISABLED;
1da177e4
LT		 1328 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1329 }
1330
7c2660b0
MH		 1331 if (s->cfc == RFCOMM_CFC_UNKNOWN)
1332 s->cfc = d->cfc;
1333
1da177e4
LT		 1334 d->priority = pn->priority;
1335
b4324b5d 1336 d->mtu = __le16_to_cpu(pn->mtu);
98bcd08b
MH		 1337
1338 if (cr && d->mtu > s->mtu)
1339 d->mtu = s->mtu;
1da177e4
LT		 1340
1341 return 0;
1342}
1343
1344static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1345{
1346 struct rfcomm_pn *pn = (void *) skb->data;
1347 struct rfcomm_dlc *d;
1348 u8 dlci = pn->dlci;
1349
1350 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1351
1352 if (!dlci)
1353 return 0;
1354
1355 d = rfcomm_dlc_get(s, dlci);
1356 if (d) {
1357 if (cr) {
1358 /* PN request */
1359 rfcomm_apply_pn(d, cr, pn);
1360 rfcomm_send_pn(s, 0, d);
1361 } else {
1362 /* PN response */
1363 switch (d->state) {
1364 case BT_CONFIG:
1365 rfcomm_apply_pn(d, cr, pn);
1366
1367 d->state = BT_CONNECT;
1368 rfcomm_send_sabm(s, d->dlci);
1369 break;
1370 }
1371 }
1372 } else {
1373 u8 channel = __srv_channel(dlci);
1374
1375 if (!cr)
1376 return 0;
1377
1378 /* PN request for non existing DLC.
1379 * Assume incoming connection. */
1380 if (rfcomm_connect_ind(s, channel, &d)) {
1381 d->dlci = dlci;
1382 d->addr = __addr(s->initiator, dlci);
1383 rfcomm_dlc_link(s, d);
1384
1385 rfcomm_apply_pn(d, cr, pn);
1386
1387 d->state = BT_OPEN;
1388 rfcomm_send_pn(s, 0, d);
1389 } else {
1390 rfcomm_send_dm(s, dlci);
1391 }
1392 }
1393 return 0;
1394}
1395
1396static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1397{
1398 struct rfcomm_rpn *rpn = (void *) skb->data;
1399 u8 dlci = __get_dlci(rpn->dlci);
1400
1401 u8 bit_rate = 0;
1402 u8 data_bits = 0;
1403 u8 stop_bits = 0;
1404 u8 parity = 0;
1405 u8 flow_ctrl = 0;
1406 u8 xon_char = 0;
1407 u8 xoff_char = 0;
1408 u16 rpn_mask = RFCOMM_RPN_PM_ALL;
3a5e903c
S		 1409
1410 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1411 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1412 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1413
1414 if (!cr)
1da177e4 1415 return 0;
3a5e903c 1416
1da177e4 1417 if (len == 1) {
3a5e903c 1418 /* This is a request, return default settings */
1da177e4
LT		 1419 bit_rate = RFCOMM_RPN_BR_115200;
1420 data_bits = RFCOMM_RPN_DATA_8;
1421 stop_bits = RFCOMM_RPN_STOP_1;
1422 parity = RFCOMM_RPN_PARITY_NONE;
1423 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1424 xon_char = RFCOMM_RPN_XON_CHAR;
1425 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1da177e4
LT		 1426 goto rpn_out;
1427 }
3a5e903c
S		 1428
1429 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1430 * no parity, no flow control lines, normal XON/XOFF chars */
1431
e8db8c99 1432 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1da177e4
LT		 1433 bit_rate = rpn->bit_rate;
1434 if (bit_rate != RFCOMM_RPN_BR_115200) {
1435 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1436 bit_rate = RFCOMM_RPN_BR_115200;
1437 rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1438 }
1439 }
3a5e903c 1440
e8db8c99 1441 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1da177e4
LT		 1442 data_bits = __get_rpn_data_bits(rpn->line_settings);
1443 if (data_bits != RFCOMM_RPN_DATA_8) {
1444 BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1445 data_bits = RFCOMM_RPN_DATA_8;
1446 rpn_mask ^= RFCOMM_RPN_PM_DATA;
1447 }
1448 }
3a5e903c 1449
e8db8c99 1450 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1da177e4
LT		 1451 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1452 if (stop_bits != RFCOMM_RPN_STOP_1) {
1453 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1454 stop_bits = RFCOMM_RPN_STOP_1;
1455 rpn_mask ^= RFCOMM_RPN_PM_STOP;
1456 }
1457 }
3a5e903c 1458
e8db8c99 1459 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1da177e4
LT		 1460 parity = __get_rpn_parity(rpn->line_settings);
1461 if (parity != RFCOMM_RPN_PARITY_NONE) {
1462 BT_DBG("RPN parity mismatch 0x%x", parity);
1463 parity = RFCOMM_RPN_PARITY_NONE;
1464 rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1465 }
1466 }
3a5e903c 1467
e8db8c99 1468 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1da177e4
LT		 1469 flow_ctrl = rpn->flow_ctrl;
1470 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1471 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1472 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1473 rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1474 }
1475 }
3a5e903c 1476
e8db8c99 1477 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1da177e4
LT		 1478 xon_char = rpn->xon_char;
1479 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1480 BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1481 xon_char = RFCOMM_RPN_XON_CHAR;
1482 rpn_mask ^= RFCOMM_RPN_PM_XON;
1483 }
1484 }
3a5e903c 1485
e8db8c99 1486 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1da177e4
LT		 1487 xoff_char = rpn->xoff_char;
1488 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1489 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1490 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1491 rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1492 }
1493 }
1494
1495rpn_out:
3a5e903c
S		 1496 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1497 parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1da177e4
LT		 1498
1499 return 0;
1500}
1501
1502static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1503{
1504 struct rfcomm_rls *rls = (void *) skb->data;
1505 u8 dlci = __get_dlci(rls->dlci);
1506
1507 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
3a5e903c 1508
1da177e4
LT		 1509 if (!cr)
1510 return 0;
1511
3a5e903c
S		 1512 /* We should probably do something with this information here. But
1513 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1514 * mandatory to recognise and respond to RLS */
1da177e4
LT		 1515
1516 rfcomm_send_rls(s, 0, dlci, rls->status);
1517
1518 return 0;
1519}
1520
1521static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1522{
1523 struct rfcomm_msc *msc = (void *) skb->data;
1524 struct rfcomm_dlc *d;
1525 u8 dlci = __get_dlci(msc->dlci);
1526
1527 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1528
1529 d = rfcomm_dlc_get(s, dlci);
3a5e903c 1530 if (!d)
1da177e4
LT		 1531 return 0;
1532
1533 if (cr) {
1534 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1535 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1536 else
1537 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
3a5e903c 1538
1da177e4 1539 rfcomm_dlc_lock(d);
8b6b3da7
MH		 1540
1541 d->remote_v24_sig = msc->v24_sig;
1542
1da177e4
LT		 1543 if (d->modem_status)
1544 d->modem_status(d, msc->v24_sig);
8b6b3da7 1545
1da177e4 1546 rfcomm_dlc_unlock(d);
8e87d142 1547
1da177e4
LT		 1548 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1549
1550 d->mscex |= RFCOMM_MSCEX_RX;
3a5e903c 1551 } else
1da177e4
LT		 1552 d->mscex |= RFCOMM_MSCEX_TX;
1553
1554 return 0;
1555}
1556
1557static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1558{
1559 struct rfcomm_mcc *mcc = (void *) skb->data;
1560 u8 type, cr, len;
1561
1562 cr = __test_cr(mcc->type);
1563 type = __get_mcc_type(mcc->type);
1564 len = __get_mcc_len(mcc->len);
1565
1566 BT_DBG("%p type 0x%x cr %d", s, type, cr);
1567
1568 skb_pull(skb, 2);
1569
1570 switch (type) {
1571 case RFCOMM_PN:
1572 rfcomm_recv_pn(s, cr, skb);
1573 break;
1574
1575 case RFCOMM_RPN:
1576 rfcomm_recv_rpn(s, cr, len, skb);
1577 break;
1578
1579 case RFCOMM_RLS:
1580 rfcomm_recv_rls(s, cr, skb);
1581 break;
1582
1583 case RFCOMM_MSC:
1584 rfcomm_recv_msc(s, cr, skb);
1585 break;
1586
1587 case RFCOMM_FCOFF:
1588 if (cr) {
1589 set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1590 rfcomm_send_fcoff(s, 0);
1591 }
1592 break;
1593
1594 case RFCOMM_FCON:
1595 if (cr) {
1596 clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1597 rfcomm_send_fcon(s, 0);
1598 }
1599 break;
1600
1601 case RFCOMM_TEST:
1602 if (cr)
1603 rfcomm_send_test(s, 0, skb->data, skb->len);
1604 break;
1605
1606 case RFCOMM_NSC:
1607 break;
1608
1609 default:
1610 BT_ERR("Unknown control type 0x%02x", type);
1611 rfcomm_send_nsc(s, cr, type);
1612 break;
1613 }
1614 return 0;
1615}
1616
1617static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1618{
1619 struct rfcomm_dlc *d;
1620
1621 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1622
1623 d = rfcomm_dlc_get(s, dlci);
1624 if (!d) {
1625 rfcomm_send_dm(s, dlci);
1626 goto drop;
1627 }
1628
1629 if (pf && d->cfc) {
1630 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1631
1632 d->tx_credits += credits;
1633 if (d->tx_credits)
1634 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1635 }
1636
1637 if (skb->len && d->state == BT_CONNECTED) {
1638 rfcomm_dlc_lock(d);
1639 d->rx_credits--;
1640 d->data_ready(d, skb);
1641 rfcomm_dlc_unlock(d);
1642 return 0;
1643 }
1644
1645drop:
1646 kfree_skb(skb);
1647 return 0;
1648}
1649
1650static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1651{
1652 struct rfcomm_hdr *hdr = (void *) skb->data;
1653 u8 type, dlci, fcs;
1654
1655 dlci = __get_dlci(hdr->addr);
1656 type = __get_type(hdr->ctrl);
1657
1658 /* Trim FCS */
1659 skb->len--; skb->tail--;
27a884dc 1660 fcs = *(u8 *)skb_tail_pointer(skb);
1da177e4
LT		 1661
1662 if (__check_fcs(skb->data, type, fcs)) {
1663 BT_ERR("bad checksum in packet");
1664 kfree_skb(skb);
1665 return -EILSEQ;
1666 }
1667
1668 if (__test_ea(hdr->len))
1669 skb_pull(skb, 3);
1670 else
1671 skb_pull(skb, 4);
1672
1673 switch (type) {
1674 case RFCOMM_SABM:
1675 if (__test_pf(hdr->ctrl))
1676 rfcomm_recv_sabm(s, dlci);
1677 break;
1678
1679 case RFCOMM_DISC:
1680 if (__test_pf(hdr->ctrl))
1681 rfcomm_recv_disc(s, dlci);
1682 break;
1683
1684 case RFCOMM_UA:
1685 if (__test_pf(hdr->ctrl))
1686 rfcomm_recv_ua(s, dlci);
1687 break;
1688
1689 case RFCOMM_DM:
1690 rfcomm_recv_dm(s, dlci);
1691 break;
1692
1693 case RFCOMM_UIH:
1694 if (dlci)
1695 return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1696
1697 rfcomm_recv_mcc(s, skb);
1698 break;
1699
1700 default:
1701 BT_ERR("Unknown packet type 0x%02x\n", type);
1702 break;
1703 }
1704 kfree_skb(skb);
1705 return 0;
1706}
1707
1708/* ---- Connection and data processing ---- */
1709
1710static void rfcomm_process_connect(struct rfcomm_session *s)
1711{
1712 struct rfcomm_dlc *d;
1713 struct list_head *p, *n;
1714
1715 BT_DBG("session %p state %ld", s, s->state);
1716
1717 list_for_each_safe(p, n, &s->dlcs) {
1718 d = list_entry(p, struct rfcomm_dlc, list);
1719 if (d->state == BT_CONFIG) {
1720 d->mtu = s->mtu;
9f2c8a03 1721 if (rfcomm_check_security(d)) {
8c1b2355
MH		 1722 rfcomm_send_pn(s, 1, d);
1723 } else {
77db1980
MH		 1724 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1725 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
8c1b2355 1726 }
1da177e4
LT		 1727 }
1728 }
1729}
1730
1731/* Send data queued for the DLC.
1732 * Return number of frames left in the queue.
1733 */
1734static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1735{
1736 struct sk_buff *skb;
1737 int err;
1738
8e87d142 1739 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1da177e4
LT		 1740 d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1741
1742 /* Send pending MSC */
1743 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
8e87d142 1744 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1da177e4
LT		 1745
1746 if (d->cfc) {
8e87d142 1747 /* CFC enabled.
1da177e4
LT		 1748 * Give them some credits */
1749 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
8e87d142 1750 d->rx_credits <= (d->cfc >> 2)) {
1da177e4
LT		 1751 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1752 d->rx_credits = d->cfc;
1753 }
1754 } else {
1755 /* CFC disabled.
1756 * Give ourselves some credits */
1757 d->tx_credits = 5;
1758 }
1759
1760 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1761 return skb_queue_len(&d->tx_queue);
1762
1763 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1764 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1765 if (err < 0) {
1766 skb_queue_head(&d->tx_queue, skb);
1767 break;
1768 }
1769 kfree_skb(skb);
1770 d->tx_credits--;
1771 }
1772
1773 if (d->cfc && !d->tx_credits) {
1774 /* We're out of TX credits.
1775 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1776 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1777 }
1778
1779 return skb_queue_len(&d->tx_queue);
1780}
1781
1782static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1783{
1784 struct rfcomm_dlc *d;
1785 struct list_head *p, *n;
1786
1787 BT_DBG("session %p state %ld", s, s->state);
1788
1789 list_for_each_safe(p, n, &s->dlcs) {
1790 d = list_entry(p, struct rfcomm_dlc, list);
1791
1792 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1793 __rfcomm_dlc_close(d, ETIMEDOUT);
1794 continue;
1795 }
1796
1797 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1798 rfcomm_dlc_clear_timer(d);
77db1980
MH		 1799 if (d->out) {
1800 rfcomm_send_pn(s, 1, d);
1801 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
bb23c0ab
MH		 1802 } else {
1803 if (d->defer_setup) {
1804 set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1805 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
8bf47941
MH		 1806
1807 rfcomm_dlc_lock(d);
1808 d->state = BT_CONNECT2;
1809 d->state_change(d, 0);
1810 rfcomm_dlc_unlock(d);
bb23c0ab
MH		 1811 } else
1812 rfcomm_dlc_accept(d);
1813 }
1da177e4
LT		 1814 continue;
1815 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1816 rfcomm_dlc_clear_timer(d);
77db1980
MH		 1817 if (!d->out)
1818 rfcomm_send_dm(s, d->dlci);
1819 else
1820 d->state = BT_CLOSED;
1da177e4
LT		 1821 __rfcomm_dlc_close(d, ECONNREFUSED);
1822 continue;
1823 }
1824
6e1031a4
JG		 1825 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1826 continue;
1827
1da177e4
LT		 1828 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1829 continue;
1830
1831 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
77db1980 1832 d->mscex == RFCOMM_MSCEX_OK)
1da177e4
LT		 1833 rfcomm_process_tx(d);
1834 }
1835}
1836
1837static inline void rfcomm_process_rx(struct rfcomm_session *s)
1838{
1839 struct socket *sock = s->sock;
1840 struct sock *sk = sock->sk;
1841 struct sk_buff *skb;
1842
1843 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1844
1845 /* Get data directly from socket receive queue without copying it. */
1846 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1847 skb_orphan(skb);
1848 rfcomm_recv_frame(s, skb);
1849 }
1850
1851 if (sk->sk_state == BT_CLOSED) {
1852 if (!s->initiator)
1853 rfcomm_session_put(s);
1854
1855 rfcomm_session_close(s, sk->sk_err);
1856 }
1857}
1858
1859static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1860{
1861 struct socket *sock = s->sock, *nsock;
1862 int err;
1863
1864 /* Fast check for a new connection.
1865 * Avoids unnesesary socket allocations. */
1866 if (list_empty(&bt_sk(sock->sk)->accept_q))
1867 return;
1868
1869 BT_DBG("session %p", s);
1870
48db9ca4
MH		 1871 err = kernel_accept(sock, &nsock, O_NONBLOCK);
1872 if (err < 0)
1da177e4
LT		 1873 return;
1874
1da177e4
LT		 1875 /* Set our callbacks */
1876 nsock->sk->sk_data_ready = rfcomm_l2data_ready;
1877 nsock->sk->sk_state_change = rfcomm_l2state_change;
1878
1879 s = rfcomm_session_add(nsock, BT_OPEN);
1880 if (s) {
1881 rfcomm_session_hold(s);
98bcd08b
MH		 1882
1883 /* We should adjust MTU on incoming sessions.
1884 * L2CAP MTU minus UIH header and FCS. */
1885 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1886
1da177e4
LT		 1887 rfcomm_schedule(RFCOMM_SCHED_RX);
1888 } else
1889 sock_release(nsock);
1890}
1891
1892static inline void rfcomm_check_connection(struct rfcomm_session *s)
1893{
1894 struct sock *sk = s->sock->sk;
1895
1896 BT_DBG("%p state %ld", s, s->state);
1897
1898 switch(sk->sk_state) {
1899 case BT_CONNECTED:
1900 s->state = BT_CONNECT;
1901
1902 /* We can adjust MTU on outgoing sessions.
1903 * L2CAP MTU minus UIH header and FCS. */
1904 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1905
1906 rfcomm_send_sabm(s, 0);
1907 break;
1908
1909 case BT_CLOSED:
1910 s->state = BT_CLOSED;
1911 rfcomm_session_close(s, sk->sk_err);
1912 break;
1913 }
1914}
1915
1916static inline void rfcomm_process_sessions(void)
1917{
1918 struct list_head *p, *n;
1919
1920 rfcomm_lock();
1921
1922 list_for_each_safe(p, n, &session_list) {
1923 struct rfcomm_session *s;
1924 s = list_entry(p, struct rfcomm_session, list);
1925
9e726b17
LAD		 1926 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1927 s->state = BT_DISCONN;
1928 rfcomm_send_disc(s, 0);
485f1eff 1929 rfcomm_session_put(s);
9e726b17
LAD		 1930 continue;
1931 }
1932
1da177e4
LT		 1933 if (s->state == BT_LISTEN) {
1934 rfcomm_accept_connection(s);
1935 continue;
1936 }
1937
1938 rfcomm_session_hold(s);
1939
1940 switch (s->state) {
1941 case BT_BOUND:
1942 rfcomm_check_connection(s);
1943 break;
1944
1945 default:
1946 rfcomm_process_rx(s);
1947 break;
1948 }
1949
1950 rfcomm_process_dlcs(s);
1951
1952 rfcomm_session_put(s);
1953 }
1954
1955 rfcomm_unlock();
1956}
1957
1da177e4
LT		 1958static int rfcomm_add_listener(bdaddr_t *ba)
1959{
1960 struct sockaddr_l2 addr;
1961 struct socket *sock;
1962 struct sock *sk;
1963 struct rfcomm_session *s;
1964 int err = 0;
1965
1966 /* Create socket */
1967 err = rfcomm_l2sock_create(&sock);
8e87d142 1968 if (err < 0) {
1da177e4
LT		 1969 BT_ERR("Create socket failed %d", err);
1970 return err;
1971 }
1972
1973 /* Bind socket */
1974 bacpy(&addr.l2_bdaddr, ba);
1975 addr.l2_family = AF_BLUETOOTH;
b4324b5d 1976 addr.l2_psm = cpu_to_le16(RFCOMM_PSM);
37e62f55 1977 addr.l2_cid = 0;
48db9ca4 1978 err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1da177e4
LT		 1979 if (err < 0) {
1980 BT_ERR("Bind failed %d", err);
1981 goto failed;
1982 }
1983
1984 /* Set L2CAP options */
1985 sk = sock->sk;
1986 lock_sock(sk);
56f3a40a 1987 l2cap_pi(sk)->imtu = l2cap_mtu;
1da177e4
LT		 1988 release_sock(sk);
1989
1990 /* Start listening on the socket */
48db9ca4 1991 err = kernel_listen(sock, 10);
1da177e4
LT		 1992 if (err) {
1993 BT_ERR("Listen failed %d", err);
1994 goto failed;
1995 }
1996
1997 /* Add listening session */
1998 s = rfcomm_session_add(sock, BT_LISTEN);
1999 if (!s)
2000 goto failed;
2001
2002 rfcomm_session_hold(s);
2003 return 0;
2004failed:
2005 sock_release(sock);
2006 return err;
2007}
2008
2009static void rfcomm_kill_listener(void)
2010{
2011 struct rfcomm_session *s;
2012 struct list_head *p, *n;
2013
2014 BT_DBG("");
2015
2016 list_for_each_safe(p, n, &session_list) {
2017 s = list_entry(p, struct rfcomm_session, list);
2018 rfcomm_session_del(s);
2019 }
2020}
2021
2022static int rfcomm_run(void *unused)
2023{
a524eccc 2024 BT_DBG("");
1da177e4 2025
1da177e4 2026 set_user_nice(current, -10);
1da177e4 2027
1da177e4
LT		 2028 rfcomm_add_listener(BDADDR_ANY);
2029
a524eccc
MH		 2030 while (!kthread_should_stop()) {
2031 set_current_state(TASK_INTERRUPTIBLE);
2032 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
2033 /* No pending events. Let's sleep.
2034 * Incoming connections and data will wake us up. */
2035 schedule();
2036 }
2037 set_current_state(TASK_RUNNING);
2038
2039 /* Process stuff */
2040 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
2041 rfcomm_process_sessions();
2042 }
1da177e4
LT		 2043
2044 rfcomm_kill_listener();
2045
1da177e4
LT		 2046 return 0;
2047}
2048
8c1b2355 2049static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1da177e4
LT		 2050{
2051 struct rfcomm_session *s;
2052 struct rfcomm_dlc *d;
2053 struct list_head *p, *n;
2054
2055 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2056
2057 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2058 if (!s)
2059 return;
2060
2061 rfcomm_session_hold(s);
2062
2063 list_for_each_safe(p, n, &s->dlcs) {
2064 d = list_entry(p, struct rfcomm_dlc, list);
2065
8c84b830
MH		 2066 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2067 rfcomm_dlc_clear_timer(d);
2068 if (status || encrypt == 0x00) {
2069 __rfcomm_dlc_close(d, ECONNREFUSED);
2070 continue;
2071 }
2072 }
2073
2074 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2075 if (d->sec_level == BT_SECURITY_MEDIUM) {
2076 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2077 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2078 continue;
2079 } else if (d->sec_level == BT_SECURITY_HIGH) {
2080 __rfcomm_dlc_close(d, ECONNREFUSED);
2081 continue;
2082 }
9719f8af
MH		 2083 }
2084
1da177e4
LT		 2085 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2086 continue;
2087
8c1b2355 2088 if (!status)
1da177e4
LT		 2089 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2090 else
2091 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2092 }
2093
2094 rfcomm_session_put(s);
2095
2096 rfcomm_schedule(RFCOMM_SCHED_AUTH);
2097}
2098
2099static struct hci_cb rfcomm_cb = {
2100 .name = "RFCOMM",
8c1b2355 2101 .security_cfm = rfcomm_security_cfm
1da177e4
LT		 2102};
2103
aef7d97c 2104static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
1da177e4
LT		 2105{
2106 struct rfcomm_session *s;
2107 struct list_head *pp, *p;
1da177e4
LT		 2108
2109 rfcomm_lock();
2110
2111 list_for_each(p, &session_list) {
2112 s = list_entry(p, struct rfcomm_session, list);
be9d1227
MH		 2113 list_for_each(pp, &s->dlcs) {
2114 struct sock *sk = s->sock->sk;
2115 struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
1da177e4 2116
aef7d97c
MH		 2117 seq_printf(f, "%s %s %ld %d %d %d %d\n",
2118 batostr(&bt_sk(sk)->src),
2119 batostr(&bt_sk(sk)->dst),
2120 d->state, d->dlci, d->mtu,
2121 d->rx_credits, d->tx_credits);
1da177e4
LT		 2122 }
2123 }
1da177e4 2124
1da177e4 2125 rfcomm_unlock();
1da177e4 2126
aef7d97c
MH		 2127 return 0;
2128}
2129
2130static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2131{
2132 return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
1da177e4
LT		 2133}
2134
aef7d97c
MH		 2135static const struct file_operations rfcomm_dlc_debugfs_fops = {
2136 .open = rfcomm_dlc_debugfs_open,
2137 .read = seq_read,
2138 .llseek = seq_lseek,
2139 .release = single_release,
2140};
2141
2142static struct dentry *rfcomm_dlc_debugfs;
1da177e4
LT		 2143
2144/* ---- Initialization ---- */
2145static int __init rfcomm_init(void)
2146{
52d18347 2147 int err;
af0d3b10 2148
1da177e4
LT		 2149 l2cap_load();
2150
2151 hci_register_cb(&rfcomm_cb);
2152
a524eccc
MH		 2153 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2154 if (IS_ERR(rfcomm_thread)) {
52d18347
MH		 2155 err = PTR_ERR(rfcomm_thread);
2156 goto unregister;
a524eccc 2157 }
1da177e4 2158
aef7d97c
MH		 2159 if (bt_debugfs) {
2160 rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2161 bt_debugfs, NULL, &rfcomm_dlc_debugfs_fops);
2162 if (!rfcomm_dlc_debugfs)
2163 BT_ERR("Failed to create RFCOMM debug file");
2164 }
1da177e4 2165
52d18347
MH		 2166 err = rfcomm_init_ttys();
2167 if (err < 0)
2168 goto stop;
1da177e4 2169
52d18347
MH		 2170 err = rfcomm_init_sockets();
2171 if (err < 0)
2172 goto cleanup;
1da177e4 2173
be9d1227
MH		 2174 BT_INFO("RFCOMM ver %s", VERSION);
2175
1da177e4 2176 return 0;
af0d3b10 2177
52d18347 2178cleanup:
af0d3b10 2179 rfcomm_cleanup_ttys();
52d18347
MH		 2180
2181stop:
af0d3b10 2182 kthread_stop(rfcomm_thread);
52d18347
MH		 2183
2184unregister:
af0d3b10
DY		 2185 hci_unregister_cb(&rfcomm_cb);
2186
52d18347 2187 return err;
1da177e4
LT		 2188}
2189
2190static void __exit rfcomm_exit(void)
2191{
aef7d97c 2192 debugfs_remove(rfcomm_dlc_debugfs);
be9d1227 2193
1da177e4
LT		 2194 hci_unregister_cb(&rfcomm_cb);
2195
a524eccc 2196 kthread_stop(rfcomm_thread);
1da177e4 2197
1da177e4 2198 rfcomm_cleanup_ttys();
1da177e4
LT		 2199
2200 rfcomm_cleanup_sockets();
1da177e4
LT		 2201}
2202
2203module_init(rfcomm_init);
2204module_exit(rfcomm_exit);
2205
7c2660b0
MH		 2206module_param(disable_cfc, bool, 0644);
2207MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2208
98bcd08b
MH		 2209module_param(channel_mtu, int, 0644);
2210MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2211
56f3a40a
MH		 2212module_param(l2cap_mtu, uint, 0644);
2213MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2214
eae38eed
MH		 2215module_param(l2cap_ertm, bool, 0644);
2216MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2217
63fbd24e 2218MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1da177e4
LT		 2219MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2220MODULE_VERSION(VERSION);
2221MODULE_LICENSE("GPL");
2222MODULE_ALIAS("bt-proto-3");
Clone of davem's net-next-2.6 tree