]> bbs.cooldavid.org Git - net-next-2.6.git/blame - net/bluetooth/rfcomm/core.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
bluetooth : use lockdep sub-classes for diffrent bluetooth protocol
[net-next-2.6.git] / net / bluetooth / rfcomm / core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
8e87d142
YH		 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 21 SOFTWARE IS DISCLAIMED.
22*/
23
1da177e4
LT		 24/*
25 * Bluetooth RFCOMM core.
26 *
27 * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
28 */
29
1da177e4
LT		 30#include <linux/module.h>
31#include <linux/errno.h>
32#include <linux/kernel.h>
33#include <linux/sched.h>
34#include <linux/signal.h>
35#include <linux/init.h>
36#include <linux/wait.h>
be9d1227 37#include <linux/device.h>
1da177e4 38#include <linux/net.h>
4a3e2f71 39#include <linux/mutex.h>
a524eccc 40#include <linux/kthread.h>
4a3e2f71 41
1da177e4
LT		 42#include <net/sock.h>
43#include <asm/uaccess.h>
44#include <asm/unaligned.h>
45
46#include <net/bluetooth/bluetooth.h>
47#include <net/bluetooth/hci_core.h>
48#include <net/bluetooth/l2cap.h>
49#include <net/bluetooth/rfcomm.h>
50
1da177e4
LT		 51#ifndef CONFIG_BT_RFCOMM_DEBUG
52#undef BT_DBG
53#define BT_DBG(D...)
54#endif
55
7c2660b0 56#define VERSION "1.8"
56f3a40a 57
7c2660b0 58static int disable_cfc = 0;
98bcd08b 59static int channel_mtu = -1;
56f3a40a
MH		 60static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
61
1da177e4
LT		 62static struct task_struct *rfcomm_thread;
63
4a3e2f71
AV		 64static DEFINE_MUTEX(rfcomm_mutex);
65#define rfcomm_lock() mutex_lock(&rfcomm_mutex)
66#define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
1da177e4
LT		 67
68static unsigned long rfcomm_event;
69
70static LIST_HEAD(session_list);
1da177e4
LT		 71
72static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
73static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
74static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
75static int rfcomm_queue_disc(struct rfcomm_dlc *d);
76static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
77static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
78static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
79static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
80static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
81static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
82
83static void rfcomm_process_connect(struct rfcomm_session *s);
84
85static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
86static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
87static void rfcomm_session_del(struct rfcomm_session *s);
88
89/* ---- RFCOMM frame parsing macros ---- */
90#define __get_dlci(b) ((b & 0xfc) >> 2)
91#define __get_channel(b) ((b & 0xf8) >> 3)
92#define __get_dir(b) ((b & 0x04) >> 2)
93#define __get_type(b) ((b & 0xef))
94
95#define __test_ea(b) ((b & 0x01))
96#define __test_cr(b) ((b & 0x02))
97#define __test_pf(b) ((b & 0x10))
98
99#define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
100#define __ctrl(type, pf) (((type & 0xef) | (pf << 4)))
101#define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir)
102#define __srv_channel(dlci) (dlci >> 1)
103#define __dir(dlci) (dlci & 0x01)
104
105#define __len8(len) (((len) << 1) | 1)
106#define __len16(len) ((len) << 1)
107
108/* MCC macros */
109#define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01))
110#define __get_mcc_type(b) ((b & 0xfc) >> 2)
111#define __get_mcc_len(b) ((b & 0xfe) >> 1)
112
113/* RPN macros */
3a5e903c 114#define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
1da177e4
LT		 115#define __get_rpn_data_bits(line) ((line) & 0x3)
116#define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
3a5e903c 117#define __get_rpn_parity(line) (((line) >> 3) & 0x7)
1da177e4
LT		 118
119static inline void rfcomm_schedule(uint event)
120{
121 if (!rfcomm_thread)
122 return;
123 //set_bit(event, &rfcomm_event);
124 set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
125 wake_up_process(rfcomm_thread);
126}
127
128static inline void rfcomm_session_put(struct rfcomm_session *s)
129{
130 if (atomic_dec_and_test(&s->refcnt))
131 rfcomm_session_del(s);
132}
133
134/* ---- RFCOMM FCS computation ---- */
135
408c1ce2 136/* reversed, 8-bit, poly=0x07 */
8e87d142 137static unsigned char rfcomm_crc_table[256] = {
408c1ce2
MH		 138 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
139 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
140 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
141 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
142
143 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
144 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
145 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
146 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
147
148 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
149 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
150 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
151 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
152
153 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
154 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
155 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
156 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
157
158 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
159 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
160 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
161 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
162
163 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
164 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
165 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
166 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
167
168 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
169 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
170 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
171 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
172
173 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
174 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
175 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
176 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
177};
178
1da177e4
LT		 179/* CRC on 2 bytes */
180#define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
181
8e87d142 182/* FCS on 2 bytes */
1da177e4
LT		 183static inline u8 __fcs(u8 *data)
184{
185 return (0xff - __crc(data));
186}
187
8e87d142 188/* FCS on 3 bytes */
1da177e4
LT		 189static inline u8 __fcs2(u8 *data)
190{
191 return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
192}
193
194/* Check FCS */
195static inline int __check_fcs(u8 *data, int type, u8 fcs)
196{
197 u8 f = __crc(data);
198
199 if (type != RFCOMM_UIH)
200 f = rfcomm_crc_table[f ^ data[2]];
201
202 return rfcomm_crc_table[f ^ fcs] != 0xcf;
203}
204
205/* ---- L2CAP callbacks ---- */
206static void rfcomm_l2state_change(struct sock *sk)
207{
208 BT_DBG("%p state %d", sk, sk->sk_state);
209 rfcomm_schedule(RFCOMM_SCHED_STATE);
210}
211
212static void rfcomm_l2data_ready(struct sock *sk, int bytes)
213{
214 BT_DBG("%p bytes %d", sk, bytes);
215 rfcomm_schedule(RFCOMM_SCHED_RX);
216}
217
218static int rfcomm_l2sock_create(struct socket **sock)
219{
220 int err;
221
222 BT_DBG("");
223
224 err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
225 if (!err) {
226 struct sock *sk = (*sock)->sk;
227 sk->sk_data_ready = rfcomm_l2data_ready;
228 sk->sk_state_change = rfcomm_l2state_change;
229 }
230 return err;
231}
232
233/* ---- RFCOMM DLCs ---- */
234static void rfcomm_dlc_timeout(unsigned long arg)
235{
236 struct rfcomm_dlc *d = (void *) arg;
237
238 BT_DBG("dlc %p state %ld", d, d->state);
239
240 set_bit(RFCOMM_TIMED_OUT, &d->flags);
241 rfcomm_dlc_put(d);
242 rfcomm_schedule(RFCOMM_SCHED_TIMEO);
243}
244
245static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
246{
247 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
248
249 if (!mod_timer(&d->timer, jiffies + timeout))
250 rfcomm_dlc_hold(d);
251}
252
253static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
254{
255 BT_DBG("dlc %p state %ld", d, d->state);
256
257 if (timer_pending(&d->timer) && del_timer(&d->timer))
258 rfcomm_dlc_put(d);
259}
260
261static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
262{
263 BT_DBG("%p", d);
264
265 d->state = BT_OPEN;
266 d->flags = 0;
267 d->mscex = 0;
268 d->mtu = RFCOMM_DEFAULT_MTU;
269 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
270
271 d->cfc = RFCOMM_CFC_DISABLED;
272 d->rx_credits = RFCOMM_DEFAULT_CREDITS;
273}
274
dd0fc66f 275struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
1da177e4 276{
25ea6db0
MH		 277 struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
278
1da177e4
LT		 279 if (!d)
280 return NULL;
1da177e4 281
b24b8a24 282 setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
1da177e4
LT		 283
284 skb_queue_head_init(&d->tx_queue);
285 spin_lock_init(&d->lock);
286 atomic_set(&d->refcnt, 1);
287
288 rfcomm_dlc_clear_state(d);
8e87d142 289
1da177e4 290 BT_DBG("%p", d);
25ea6db0 291
1da177e4
LT		 292 return d;
293}
294
295void rfcomm_dlc_free(struct rfcomm_dlc *d)
296{
297 BT_DBG("%p", d);
298
299 skb_queue_purge(&d->tx_queue);
300 kfree(d);
301}
302
303static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
304{
305 BT_DBG("dlc %p session %p", d, s);
306
307 rfcomm_session_hold(s);
308
309 rfcomm_dlc_hold(d);
310 list_add(&d->list, &s->dlcs);
311 d->session = s;
312}
313
314static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
315{
316 struct rfcomm_session *s = d->session;
317
318 BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
319
320 list_del(&d->list);
321 d->session = NULL;
322 rfcomm_dlc_put(d);
323
324 rfcomm_session_put(s);
325}
326
327static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
328{
329 struct rfcomm_dlc *d;
330 struct list_head *p;
331
332 list_for_each(p, &s->dlcs) {
333 d = list_entry(p, struct rfcomm_dlc, list);
334 if (d->dlci == dlci)
335 return d;
336 }
337 return NULL;
338}
339
340static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
341{
342 struct rfcomm_session *s;
343 int err = 0;
344 u8 dlci;
345
8e87d142 346 BT_DBG("dlc %p state %ld %s %s channel %d",
1da177e4
LT		 347 d, d->state, batostr(src), batostr(dst), channel);
348
349 if (channel < 1 || channel > 30)
350 return -EINVAL;
351
352 if (d->state != BT_OPEN && d->state != BT_CLOSED)
353 return 0;
354
355 s = rfcomm_session_get(src, dst);
356 if (!s) {
357 s = rfcomm_session_create(src, dst, &err);
358 if (!s)
359 return err;
360 }
361
362 dlci = __dlci(!s->initiator, channel);
363
364 /* Check if DLCI already exists */
365 if (rfcomm_dlc_get(s, dlci))
366 return -EBUSY;
367
368 rfcomm_dlc_clear_state(d);
369
370 d->dlci = dlci;
371 d->addr = __addr(s->initiator, dlci);
372 d->priority = 7;
373
374 d->state = BT_CONFIG;
375 rfcomm_dlc_link(s, d);
376
377 d->mtu = s->mtu;
378 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
379
380 if (s->state == BT_CONNECTED)
381 rfcomm_send_pn(s, 1, d);
382 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
383 return 0;
384}
385
386int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
387{
388 int r;
389
390 rfcomm_lock();
391
392 r = __rfcomm_dlc_open(d, src, dst, channel);
393
394 rfcomm_unlock();
395 return r;
396}
397
398static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
399{
400 struct rfcomm_session *s = d->session;
401 if (!s)
402 return 0;
403
404 BT_DBG("dlc %p state %ld dlci %d err %d session %p",
405 d, d->state, d->dlci, err, s);
406
407 switch (d->state) {
408 case BT_CONNECTED:
409 case BT_CONFIG:
410 case BT_CONNECT:
411 d->state = BT_DISCONN;
412 if (skb_queue_empty(&d->tx_queue)) {
413 rfcomm_send_disc(s, d->dlci);
414 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
415 } else {
416 rfcomm_queue_disc(d);
417 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
418 }
419 break;
420
421 default:
422 rfcomm_dlc_clear_timer(d);
423
424 rfcomm_dlc_lock(d);
425 d->state = BT_CLOSED;
426 d->state_change(d, err);
427 rfcomm_dlc_unlock(d);
428
429 skb_queue_purge(&d->tx_queue);
1da177e4
LT		 430 rfcomm_dlc_unlink(d);
431 }
432
433 return 0;
434}
435
436int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
437{
438 int r;
439
440 rfcomm_lock();
441
442 r = __rfcomm_dlc_close(d, err);
443
444 rfcomm_unlock();
445 return r;
446}
447
448int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
449{
450 int len = skb->len;
451
452 if (d->state != BT_CONNECTED)
453 return -ENOTCONN;
454
455 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
456
457 if (len > d->mtu)
458 return -EINVAL;
459
460 rfcomm_make_uih(skb, d->addr);
461 skb_queue_tail(&d->tx_queue, skb);
462
463 if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
464 rfcomm_schedule(RFCOMM_SCHED_TX);
465 return len;
466}
467
b5606c2d 468void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
1da177e4
LT		 469{
470 BT_DBG("dlc %p state %ld", d, d->state);
471
472 if (!d->cfc) {
473 d->v24_sig |= RFCOMM_V24_FC;
474 set_bit(RFCOMM_MSC_PENDING, &d->flags);
475 }
476 rfcomm_schedule(RFCOMM_SCHED_TX);
477}
478
b5606c2d 479void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
1da177e4
LT		 480{
481 BT_DBG("dlc %p state %ld", d, d->state);
482
483 if (!d->cfc) {
484 d->v24_sig &= ~RFCOMM_V24_FC;
485 set_bit(RFCOMM_MSC_PENDING, &d->flags);
486 }
487 rfcomm_schedule(RFCOMM_SCHED_TX);
488}
489
8e87d142 490/*
1da177e4
LT		 491 Set/get modem status functions use _local_ status i.e. what we report
492 to the other side.
493 Remote status is provided by dlc->modem_status() callback.
494 */
495int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
496{
8e87d142 497 BT_DBG("dlc %p state %ld v24_sig 0x%x",
1da177e4
LT		 498 d, d->state, v24_sig);
499
500 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
501 v24_sig |= RFCOMM_V24_FC;
502 else
503 v24_sig &= ~RFCOMM_V24_FC;
8e87d142 504
1da177e4
LT		 505 d->v24_sig = v24_sig;
506
507 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
508 rfcomm_schedule(RFCOMM_SCHED_TX);
509
510 return 0;
511}
512
513int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
514{
8e87d142 515 BT_DBG("dlc %p state %ld v24_sig 0x%x",
1da177e4
LT		 516 d, d->state, d->v24_sig);
517
518 *v24_sig = d->v24_sig;
519 return 0;
520}
521
522/* ---- RFCOMM sessions ---- */
523static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
524{
25ea6db0
MH		 525 struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
526
1da177e4
LT		 527 if (!s)
528 return NULL;
1da177e4
LT		 529
530 BT_DBG("session %p sock %p", s, sock);
531
532 INIT_LIST_HEAD(&s->dlcs);
533 s->state = state;
534 s->sock = sock;
535
536 s->mtu = RFCOMM_DEFAULT_MTU;
7c2660b0 537 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
1da177e4
LT		 538
539 /* Do not increment module usage count for listening sessions.
540 * Otherwise we won't be able to unload the module. */
541 if (state != BT_LISTEN)
542 if (!try_module_get(THIS_MODULE)) {
543 kfree(s);
544 return NULL;
545 }
546
547 list_add(&s->list, &session_list);
548
549 return s;
550}
551
552static void rfcomm_session_del(struct rfcomm_session *s)
553{
554 int state = s->state;
555
556 BT_DBG("session %p state %ld", s, s->state);
557
558 list_del(&s->list);
559
560 if (state == BT_CONNECTED)
561 rfcomm_send_disc(s, 0);
562
563 sock_release(s->sock);
564 kfree(s);
565
566 if (state != BT_LISTEN)
567 module_put(THIS_MODULE);
568}
569
570static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
571{
572 struct rfcomm_session *s;
573 struct list_head *p, *n;
574 struct bt_sock *sk;
575 list_for_each_safe(p, n, &session_list) {
576 s = list_entry(p, struct rfcomm_session, list);
8e87d142 577 sk = bt_sk(s->sock->sk);
1da177e4
LT		 578
579 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
580 !bacmp(&sk->dst, dst))
581 return s;
582 }
583 return NULL;
584}
585
586static void rfcomm_session_close(struct rfcomm_session *s, int err)
587{
588 struct rfcomm_dlc *d;
589 struct list_head *p, *n;
590
591 BT_DBG("session %p state %ld err %d", s, s->state, err);
592
593 rfcomm_session_hold(s);
594
595 s->state = BT_CLOSED;
596
597 /* Close all dlcs */
598 list_for_each_safe(p, n, &s->dlcs) {
599 d = list_entry(p, struct rfcomm_dlc, list);
600 d->state = BT_CLOSED;
601 __rfcomm_dlc_close(d, err);
602 }
603
604 rfcomm_session_put(s);
605}
606
607static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
608{
609 struct rfcomm_session *s = NULL;
610 struct sockaddr_l2 addr;
611 struct socket *sock;
612 struct sock *sk;
613
614 BT_DBG("%s %s", batostr(src), batostr(dst));
615
616 *err = rfcomm_l2sock_create(&sock);
617 if (*err < 0)
618 return NULL;
619
620 bacpy(&addr.l2_bdaddr, src);
621 addr.l2_family = AF_BLUETOOTH;
622 addr.l2_psm = 0;
48db9ca4 623 *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1da177e4
LT		 624 if (*err < 0)
625 goto failed;
626
627 /* Set L2CAP options */
628 sk = sock->sk;
629 lock_sock(sk);
56f3a40a 630 l2cap_pi(sk)->imtu = l2cap_mtu;
1da177e4
LT		 631 release_sock(sk);
632
633 s = rfcomm_session_add(sock, BT_BOUND);
634 if (!s) {
635 *err = -ENOMEM;
636 goto failed;
637 }
638
1da177e4
LT		 639 s->initiator = 1;
640
641 bacpy(&addr.l2_bdaddr, dst);
642 addr.l2_family = AF_BLUETOOTH;
643 addr.l2_psm = htobs(RFCOMM_PSM);
48db9ca4 644 *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
b4c612a4 645 if (*err == 0 || *err == -EINPROGRESS)
1da177e4
LT		 646 return s;
647
648 rfcomm_session_del(s);
649 return NULL;
650
651failed:
652 sock_release(sock);
653 return NULL;
654}
655
656void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
657{
658 struct sock *sk = s->sock->sk;
659 if (src)
660 bacpy(src, &bt_sk(sk)->src);
661 if (dst)
662 bacpy(dst, &bt_sk(sk)->dst);
663}
664
665/* ---- RFCOMM frame sending ---- */
666static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
667{
668 struct socket *sock = s->sock;
669 struct kvec iv = { data, len };
670 struct msghdr msg;
671
672 BT_DBG("session %p len %d", s, len);
673
674 memset(&msg, 0, sizeof(msg));
675
676 return kernel_sendmsg(sock, &msg, &iv, 1, len);
677}
678
679static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
680{
681 struct rfcomm_cmd cmd;
682
683 BT_DBG("%p dlci %d", s, dlci);
684
685 cmd.addr = __addr(s->initiator, dlci);
686 cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
687 cmd.len = __len8(0);
688 cmd.fcs = __fcs2((u8 *) &cmd);
689
690 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
691}
692
693static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
694{
695 struct rfcomm_cmd cmd;
696
697 BT_DBG("%p dlci %d", s, dlci);
698
699 cmd.addr = __addr(!s->initiator, dlci);
700 cmd.ctrl = __ctrl(RFCOMM_UA, 1);
701 cmd.len = __len8(0);
702 cmd.fcs = __fcs2((u8 *) &cmd);
703
704 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
705}
706
707static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
708{
709 struct rfcomm_cmd cmd;
710
711 BT_DBG("%p dlci %d", s, dlci);
712
713 cmd.addr = __addr(s->initiator, dlci);
714 cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
715 cmd.len = __len8(0);
716 cmd.fcs = __fcs2((u8 *) &cmd);
717
718 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
719}
720
721static int rfcomm_queue_disc(struct rfcomm_dlc *d)
722{
723 struct rfcomm_cmd *cmd;
724 struct sk_buff *skb;
725
726 BT_DBG("dlc %p dlci %d", d, d->dlci);
727
728 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
729 if (!skb)
730 return -ENOMEM;
731
732 cmd = (void *) __skb_put(skb, sizeof(*cmd));
733 cmd->addr = d->addr;
734 cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
735 cmd->len = __len8(0);
736 cmd->fcs = __fcs2((u8 *) cmd);
737
738 skb_queue_tail(&d->tx_queue, skb);
739 rfcomm_schedule(RFCOMM_SCHED_TX);
740 return 0;
741}
742
743static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
744{
745 struct rfcomm_cmd cmd;
746
747 BT_DBG("%p dlci %d", s, dlci);
748
749 cmd.addr = __addr(!s->initiator, dlci);
750 cmd.ctrl = __ctrl(RFCOMM_DM, 1);
751 cmd.len = __len8(0);
752 cmd.fcs = __fcs2((u8 *) &cmd);
753
754 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
755}
756
757static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
758{
759 struct rfcomm_hdr *hdr;
760 struct rfcomm_mcc *mcc;
761 u8 buf[16], *ptr = buf;
762
763 BT_DBG("%p cr %d type %d", s, cr, type);
764
765 hdr = (void *) ptr; ptr += sizeof(*hdr);
766 hdr->addr = __addr(s->initiator, 0);
767 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
768 hdr->len = __len8(sizeof(*mcc) + 1);
769
770 mcc = (void *) ptr; ptr += sizeof(*mcc);
771 mcc->type = __mcc_type(cr, RFCOMM_NSC);
772 mcc->len = __len8(1);
773
774 /* Type that we didn't like */
775 *ptr = __mcc_type(cr, type); ptr++;
776
777 *ptr = __fcs(buf); ptr++;
778
779 return rfcomm_send_frame(s, buf, ptr - buf);
780}
781
782static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
783{
784 struct rfcomm_hdr *hdr;
785 struct rfcomm_mcc *mcc;
786 struct rfcomm_pn *pn;
787 u8 buf[16], *ptr = buf;
788
789 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
790
791 hdr = (void *) ptr; ptr += sizeof(*hdr);
792 hdr->addr = __addr(s->initiator, 0);
793 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
794 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn));
795
796 mcc = (void *) ptr; ptr += sizeof(*mcc);
797 mcc->type = __mcc_type(cr, RFCOMM_PN);
798 mcc->len = __len8(sizeof(*pn));
799
800 pn = (void *) ptr; ptr += sizeof(*pn);
801 pn->dlci = d->dlci;
802 pn->priority = d->priority;
803 pn->ack_timer = 0;
804 pn->max_retrans = 0;
805
806 if (s->cfc) {
807 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
808 pn->credits = RFCOMM_DEFAULT_CREDITS;
809 } else {
810 pn->flow_ctrl = 0;
811 pn->credits = 0;
812 }
813
98bcd08b
MH		 814 if (cr && channel_mtu >= 0)
815 pn->mtu = htobs(channel_mtu);
816 else
817 pn->mtu = htobs(d->mtu);
1da177e4
LT		 818
819 *ptr = __fcs(buf); ptr++;
820
821 return rfcomm_send_frame(s, buf, ptr - buf);
822}
823
3a5e903c
S		 824int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
825 u8 bit_rate, u8 data_bits, u8 stop_bits,
8e87d142 826 u8 parity, u8 flow_ctrl_settings,
3a5e903c 827 u8 xon_char, u8 xoff_char, u16 param_mask)
1da177e4
LT		 828{
829 struct rfcomm_hdr *hdr;
830 struct rfcomm_mcc *mcc;
831 struct rfcomm_rpn *rpn;
832 u8 buf[16], *ptr = buf;
833
834 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
8e87d142
YH		 835 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
836 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
3a5e903c 837 flow_ctrl_settings, xon_char, xoff_char, param_mask);
1da177e4
LT		 838
839 hdr = (void *) ptr; ptr += sizeof(*hdr);
840 hdr->addr = __addr(s->initiator, 0);
841 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
842 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn));
843
844 mcc = (void *) ptr; ptr += sizeof(*mcc);
845 mcc->type = __mcc_type(cr, RFCOMM_RPN);
846 mcc->len = __len8(sizeof(*rpn));
847
848 rpn = (void *) ptr; ptr += sizeof(*rpn);
849 rpn->dlci = __addr(1, dlci);
850 rpn->bit_rate = bit_rate;
851 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
852 rpn->flow_ctrl = flow_ctrl_settings;
853 rpn->xon_char = xon_char;
854 rpn->xoff_char = xoff_char;
e8db8c99 855 rpn->param_mask = cpu_to_le16(param_mask);
1da177e4
LT		 856
857 *ptr = __fcs(buf); ptr++;
858
859 return rfcomm_send_frame(s, buf, ptr - buf);
860}
861
862static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
863{
864 struct rfcomm_hdr *hdr;
865 struct rfcomm_mcc *mcc;
866 struct rfcomm_rls *rls;
867 u8 buf[16], *ptr = buf;
868
869 BT_DBG("%p cr %d status 0x%x", s, cr, status);
870
871 hdr = (void *) ptr; ptr += sizeof(*hdr);
872 hdr->addr = __addr(s->initiator, 0);
873 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
874 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls));
875
876 mcc = (void *) ptr; ptr += sizeof(*mcc);
877 mcc->type = __mcc_type(cr, RFCOMM_RLS);
878 mcc->len = __len8(sizeof(*rls));
879
880 rls = (void *) ptr; ptr += sizeof(*rls);
881 rls->dlci = __addr(1, dlci);
882 rls->status = status;
883
884 *ptr = __fcs(buf); ptr++;
885
886 return rfcomm_send_frame(s, buf, ptr - buf);
887}
888
889static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
890{
891 struct rfcomm_hdr *hdr;
892 struct rfcomm_mcc *mcc;
893 struct rfcomm_msc *msc;
894 u8 buf[16], *ptr = buf;
895
896 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
897
898 hdr = (void *) ptr; ptr += sizeof(*hdr);
899 hdr->addr = __addr(s->initiator, 0);
900 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
901 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc));
902
903 mcc = (void *) ptr; ptr += sizeof(*mcc);
904 mcc->type = __mcc_type(cr, RFCOMM_MSC);
905 mcc->len = __len8(sizeof(*msc));
906
907 msc = (void *) ptr; ptr += sizeof(*msc);
908 msc->dlci = __addr(1, dlci);
909 msc->v24_sig = v24_sig | 0x01;
910
911 *ptr = __fcs(buf); ptr++;
912
913 return rfcomm_send_frame(s, buf, ptr - buf);
914}
915
916static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
917{
918 struct rfcomm_hdr *hdr;
919 struct rfcomm_mcc *mcc;
920 u8 buf[16], *ptr = buf;
921
922 BT_DBG("%p cr %d", s, cr);
923
924 hdr = (void *) ptr; ptr += sizeof(*hdr);
925 hdr->addr = __addr(s->initiator, 0);
926 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
927 hdr->len = __len8(sizeof(*mcc));
928
929 mcc = (void *) ptr; ptr += sizeof(*mcc);
930 mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
931 mcc->len = __len8(0);
932
933 *ptr = __fcs(buf); ptr++;
934
935 return rfcomm_send_frame(s, buf, ptr - buf);
936}
937
938static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
939{
940 struct rfcomm_hdr *hdr;
941 struct rfcomm_mcc *mcc;
942 u8 buf[16], *ptr = buf;
943
944 BT_DBG("%p cr %d", s, cr);
945
946 hdr = (void *) ptr; ptr += sizeof(*hdr);
947 hdr->addr = __addr(s->initiator, 0);
948 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
949 hdr->len = __len8(sizeof(*mcc));
950
951 mcc = (void *) ptr; ptr += sizeof(*mcc);
952 mcc->type = __mcc_type(cr, RFCOMM_FCON);
953 mcc->len = __len8(0);
954
955 *ptr = __fcs(buf); ptr++;
956
957 return rfcomm_send_frame(s, buf, ptr - buf);
958}
959
960static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
961{
962 struct socket *sock = s->sock;
963 struct kvec iv[3];
964 struct msghdr msg;
965 unsigned char hdr[5], crc[1];
966
967 if (len > 125)
968 return -EINVAL;
969
970 BT_DBG("%p cr %d", s, cr);
971
972 hdr[0] = __addr(s->initiator, 0);
973 hdr[1] = __ctrl(RFCOMM_UIH, 0);
974 hdr[2] = 0x01 | ((len + 2) << 1);
975 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
976 hdr[4] = 0x01 | (len << 1);
977
978 crc[0] = __fcs(hdr);
979
980 iv[0].iov_base = hdr;
981 iv[0].iov_len = 5;
982 iv[1].iov_base = pattern;
983 iv[1].iov_len = len;
984 iv[2].iov_base = crc;
985 iv[2].iov_len = 1;
986
987 memset(&msg, 0, sizeof(msg));
988
989 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
990}
991
992static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
993{
994 struct rfcomm_hdr *hdr;
995 u8 buf[16], *ptr = buf;
996
997 BT_DBG("%p addr %d credits %d", s, addr, credits);
998
999 hdr = (void *) ptr; ptr += sizeof(*hdr);
1000 hdr->addr = addr;
1001 hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1002 hdr->len = __len8(0);
1003
1004 *ptr = credits; ptr++;
1005
1006 *ptr = __fcs(buf); ptr++;
1007
1008 return rfcomm_send_frame(s, buf, ptr - buf);
1009}
1010
1011static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1012{
1013 struct rfcomm_hdr *hdr;
1014 int len = skb->len;
1015 u8 *crc;
1016
1017 if (len > 127) {
1018 hdr = (void *) skb_push(skb, 4);
6ba9c755 1019 put_unaligned(htobs(__len16(len)), (__le16 *) &hdr->len);
1da177e4
LT		 1020 } else {
1021 hdr = (void *) skb_push(skb, 3);
1022 hdr->len = __len8(len);
1023 }
1024 hdr->addr = addr;
1025 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1026
1027 crc = skb_put(skb, 1);
1028 *crc = __fcs((void *) hdr);
1029}
1030
1031/* ---- RFCOMM frame reception ---- */
1032static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1033{
1034 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1035
1036 if (dlci) {
1037 /* Data channel */
1038 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1039 if (!d) {
1040 rfcomm_send_dm(s, dlci);
1041 return 0;
1042 }
1043
1044 switch (d->state) {
1045 case BT_CONNECT:
1046 rfcomm_dlc_clear_timer(d);
1047
1048 rfcomm_dlc_lock(d);
1049 d->state = BT_CONNECTED;
1050 d->state_change(d, 0);
1051 rfcomm_dlc_unlock(d);
1052
1053 rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1054 break;
1055
1056 case BT_DISCONN:
1057 d->state = BT_CLOSED;
1058 __rfcomm_dlc_close(d, 0);
9cf5b0ea
MH		 1059
1060 if (list_empty(&s->dlcs)) {
1061 s->state = BT_DISCONN;
1062 rfcomm_send_disc(s, 0);
1063 }
1064
1da177e4
LT		 1065 break;
1066 }
1067 } else {
1068 /* Control channel */
1069 switch (s->state) {
1070 case BT_CONNECT:
1071 s->state = BT_CONNECTED;
1072 rfcomm_process_connect(s);
1073 break;
9cf5b0ea
MH		 1074
1075 case BT_DISCONN:
1076 rfcomm_session_put(s);
1077 break;
1da177e4
LT		 1078 }
1079 }
1080 return 0;
1081}
1082
1083static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1084{
1085 int err = 0;
1086
1087 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1088
1089 if (dlci) {
1090 /* Data DLC */
1091 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1092 if (d) {
1093 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1094 err = ECONNREFUSED;
1095 else
1096 err = ECONNRESET;
1097
1098 d->state = BT_CLOSED;
1099 __rfcomm_dlc_close(d, err);
1100 }
1101 } else {
1102 if (s->state == BT_CONNECT)
1103 err = ECONNREFUSED;
1104 else
1105 err = ECONNRESET;
1106
1107 s->state = BT_CLOSED;
1108 rfcomm_session_close(s, err);
1109 }
1110 return 0;
1111}
1112
1113static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1114{
1115 int err = 0;
1116
1117 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1118
1119 if (dlci) {
1120 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1121 if (d) {
1122 rfcomm_send_ua(s, dlci);
1123
1124 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1125 err = ECONNREFUSED;
1126 else
1127 err = ECONNRESET;
1128
1129 d->state = BT_CLOSED;
1130 __rfcomm_dlc_close(d, err);
8e87d142 1131 } else
1da177e4 1132 rfcomm_send_dm(s, dlci);
8e87d142 1133
1da177e4
LT		 1134 } else {
1135 rfcomm_send_ua(s, 0);
1136
1137 if (s->state == BT_CONNECT)
1138 err = ECONNREFUSED;
1139 else
1140 err = ECONNRESET;
1141
1142 s->state = BT_CLOSED;
1143 rfcomm_session_close(s, err);
1144 }
1145
1146 return 0;
1147}
1148
1149static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
1150{
1151 struct sock *sk = d->session->sock->sk;
1152
1153 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
1154 if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
1155 return 1;
1156 } else if (d->link_mode & RFCOMM_LM_AUTH) {
1157 if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
1158 return 1;
1159 }
1160
1161 return 0;
1162}
1163
1164static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1165{
300b9397
MH		 1166 struct sock *sk = d->session->sock->sk;
1167
1da177e4
LT		 1168 BT_DBG("dlc %p", d);
1169
1170 rfcomm_send_ua(d->session, d->dlci);
1171
1172 rfcomm_dlc_lock(d);
1173 d->state = BT_CONNECTED;
1174 d->state_change(d, 0);
1175 rfcomm_dlc_unlock(d);
1176
300b9397
MH		 1177 if (d->link_mode & RFCOMM_LM_MASTER)
1178 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1179
1da177e4
LT		 1180 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1181}
1182
1183static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1184{
1185 struct rfcomm_dlc *d;
1186 u8 channel;
1187
1188 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1189
1190 if (!dlci) {
1191 rfcomm_send_ua(s, 0);
1192
1193 if (s->state == BT_OPEN) {
1194 s->state = BT_CONNECTED;
1195 rfcomm_process_connect(s);
1196 }
1197 return 0;
1198 }
1199
1200 /* Check if DLC exists */
1201 d = rfcomm_dlc_get(s, dlci);
1202 if (d) {
1203 if (d->state == BT_OPEN) {
1204 /* DLC was previously opened by PN request */
1205 if (rfcomm_check_link_mode(d)) {
1206 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1207 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1208 return 0;
1209 }
1210
1211 rfcomm_dlc_accept(d);
1212 }
1213 return 0;
1214 }
1215
1216 /* Notify socket layer about incoming connection */
1217 channel = __srv_channel(dlci);
1218 if (rfcomm_connect_ind(s, channel, &d)) {
1219 d->dlci = dlci;
1220 d->addr = __addr(s->initiator, dlci);
1221 rfcomm_dlc_link(s, d);
1222
1223 if (rfcomm_check_link_mode(d)) {
1224 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1225 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1226 return 0;
1227 }
1228
1229 rfcomm_dlc_accept(d);
1230 } else {
1231 rfcomm_send_dm(s, dlci);
1232 }
1233
1234 return 0;
1235}
1236
1237static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1238{
1239 struct rfcomm_session *s = d->session;
1240
8e87d142 1241 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1da177e4
LT		 1242 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1243
7c2660b0
MH		 1244 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1245 pn->flow_ctrl == 0xe0) {
1246 d->cfc = RFCOMM_CFC_ENABLED;
1da177e4
LT		 1247 d->tx_credits = pn->credits;
1248 } else {
7c2660b0 1249 d->cfc = RFCOMM_CFC_DISABLED;
1da177e4
LT		 1250 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1251 }
1252
7c2660b0
MH		 1253 if (s->cfc == RFCOMM_CFC_UNKNOWN)
1254 s->cfc = d->cfc;
1255
1da177e4
LT		 1256 d->priority = pn->priority;
1257
98bcd08b
MH		 1258 d->mtu = btohs(pn->mtu);
1259
1260 if (cr && d->mtu > s->mtu)
1261 d->mtu = s->mtu;
1da177e4
LT		 1262
1263 return 0;
1264}
1265
1266static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1267{
1268 struct rfcomm_pn *pn = (void *) skb->data;
1269 struct rfcomm_dlc *d;
1270 u8 dlci = pn->dlci;
1271
1272 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1273
1274 if (!dlci)
1275 return 0;
1276
1277 d = rfcomm_dlc_get(s, dlci);
1278 if (d) {
1279 if (cr) {
1280 /* PN request */
1281 rfcomm_apply_pn(d, cr, pn);
1282 rfcomm_send_pn(s, 0, d);
1283 } else {
1284 /* PN response */
1285 switch (d->state) {
1286 case BT_CONFIG:
1287 rfcomm_apply_pn(d, cr, pn);
1288
1289 d->state = BT_CONNECT;
1290 rfcomm_send_sabm(s, d->dlci);
1291 break;
1292 }
1293 }
1294 } else {
1295 u8 channel = __srv_channel(dlci);
1296
1297 if (!cr)
1298 return 0;
1299
1300 /* PN request for non existing DLC.
1301 * Assume incoming connection. */
1302 if (rfcomm_connect_ind(s, channel, &d)) {
1303 d->dlci = dlci;
1304 d->addr = __addr(s->initiator, dlci);
1305 rfcomm_dlc_link(s, d);
1306
1307 rfcomm_apply_pn(d, cr, pn);
1308
1309 d->state = BT_OPEN;
1310 rfcomm_send_pn(s, 0, d);
1311 } else {
1312 rfcomm_send_dm(s, dlci);
1313 }
1314 }
1315 return 0;
1316}
1317
1318static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1319{
1320 struct rfcomm_rpn *rpn = (void *) skb->data;
1321 u8 dlci = __get_dlci(rpn->dlci);
1322
1323 u8 bit_rate = 0;
1324 u8 data_bits = 0;
1325 u8 stop_bits = 0;
1326 u8 parity = 0;
1327 u8 flow_ctrl = 0;
1328 u8 xon_char = 0;
1329 u8 xoff_char = 0;
1330 u16 rpn_mask = RFCOMM_RPN_PM_ALL;
3a5e903c
S		 1331
1332 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1333 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1334 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1335
1336 if (!cr)
1da177e4 1337 return 0;
3a5e903c 1338
1da177e4 1339 if (len == 1) {
3a5e903c 1340 /* This is a request, return default settings */
1da177e4
LT		 1341 bit_rate = RFCOMM_RPN_BR_115200;
1342 data_bits = RFCOMM_RPN_DATA_8;
1343 stop_bits = RFCOMM_RPN_STOP_1;
1344 parity = RFCOMM_RPN_PARITY_NONE;
1345 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1346 xon_char = RFCOMM_RPN_XON_CHAR;
1347 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1da177e4
LT		 1348 goto rpn_out;
1349 }
3a5e903c
S		 1350
1351 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1352 * no parity, no flow control lines, normal XON/XOFF chars */
1353
e8db8c99 1354 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1da177e4
LT		 1355 bit_rate = rpn->bit_rate;
1356 if (bit_rate != RFCOMM_RPN_BR_115200) {
1357 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1358 bit_rate = RFCOMM_RPN_BR_115200;
1359 rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1360 }
1361 }
3a5e903c 1362
e8db8c99 1363 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1da177e4
LT		 1364 data_bits = __get_rpn_data_bits(rpn->line_settings);
1365 if (data_bits != RFCOMM_RPN_DATA_8) {
1366 BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1367 data_bits = RFCOMM_RPN_DATA_8;
1368 rpn_mask ^= RFCOMM_RPN_PM_DATA;
1369 }
1370 }
3a5e903c 1371
e8db8c99 1372 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1da177e4
LT		 1373 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1374 if (stop_bits != RFCOMM_RPN_STOP_1) {
1375 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1376 stop_bits = RFCOMM_RPN_STOP_1;
1377 rpn_mask ^= RFCOMM_RPN_PM_STOP;
1378 }
1379 }
3a5e903c 1380
e8db8c99 1381 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1da177e4
LT		 1382 parity = __get_rpn_parity(rpn->line_settings);
1383 if (parity != RFCOMM_RPN_PARITY_NONE) {
1384 BT_DBG("RPN parity mismatch 0x%x", parity);
1385 parity = RFCOMM_RPN_PARITY_NONE;
1386 rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1387 }
1388 }
3a5e903c 1389
e8db8c99 1390 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1da177e4
LT		 1391 flow_ctrl = rpn->flow_ctrl;
1392 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1393 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1394 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1395 rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1396 }
1397 }
3a5e903c 1398
e8db8c99 1399 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1da177e4
LT		 1400 xon_char = rpn->xon_char;
1401 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1402 BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1403 xon_char = RFCOMM_RPN_XON_CHAR;
1404 rpn_mask ^= RFCOMM_RPN_PM_XON;
1405 }
1406 }
3a5e903c 1407
e8db8c99 1408 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1da177e4
LT		 1409 xoff_char = rpn->xoff_char;
1410 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1411 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1412 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1413 rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1414 }
1415 }
1416
1417rpn_out:
3a5e903c
S		 1418 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1419 parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1da177e4
LT		 1420
1421 return 0;
1422}
1423
1424static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1425{
1426 struct rfcomm_rls *rls = (void *) skb->data;
1427 u8 dlci = __get_dlci(rls->dlci);
1428
1429 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
3a5e903c 1430
1da177e4
LT		 1431 if (!cr)
1432 return 0;
1433
3a5e903c
S		 1434 /* We should probably do something with this information here. But
1435 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1436 * mandatory to recognise and respond to RLS */
1da177e4
LT		 1437
1438 rfcomm_send_rls(s, 0, dlci, rls->status);
1439
1440 return 0;
1441}
1442
1443static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1444{
1445 struct rfcomm_msc *msc = (void *) skb->data;
1446 struct rfcomm_dlc *d;
1447 u8 dlci = __get_dlci(msc->dlci);
1448
1449 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1450
1451 d = rfcomm_dlc_get(s, dlci);
3a5e903c 1452 if (!d)
1da177e4
LT		 1453 return 0;
1454
1455 if (cr) {
1456 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1457 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1458 else
1459 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
3a5e903c 1460
1da177e4
LT		 1461 rfcomm_dlc_lock(d);
1462 if (d->modem_status)
1463 d->modem_status(d, msc->v24_sig);
1464 rfcomm_dlc_unlock(d);
8e87d142 1465
1da177e4
LT		 1466 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1467
1468 d->mscex |= RFCOMM_MSCEX_RX;
3a5e903c 1469 } else
1da177e4
LT		 1470 d->mscex |= RFCOMM_MSCEX_TX;
1471
1472 return 0;
1473}
1474
1475static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1476{
1477 struct rfcomm_mcc *mcc = (void *) skb->data;
1478 u8 type, cr, len;
1479
1480 cr = __test_cr(mcc->type);
1481 type = __get_mcc_type(mcc->type);
1482 len = __get_mcc_len(mcc->len);
1483
1484 BT_DBG("%p type 0x%x cr %d", s, type, cr);
1485
1486 skb_pull(skb, 2);
1487
1488 switch (type) {
1489 case RFCOMM_PN:
1490 rfcomm_recv_pn(s, cr, skb);
1491 break;
1492
1493 case RFCOMM_RPN:
1494 rfcomm_recv_rpn(s, cr, len, skb);
1495 break;
1496
1497 case RFCOMM_RLS:
1498 rfcomm_recv_rls(s, cr, skb);
1499 break;
1500
1501 case RFCOMM_MSC:
1502 rfcomm_recv_msc(s, cr, skb);
1503 break;
1504
1505 case RFCOMM_FCOFF:
1506 if (cr) {
1507 set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1508 rfcomm_send_fcoff(s, 0);
1509 }
1510 break;
1511
1512 case RFCOMM_FCON:
1513 if (cr) {
1514 clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1515 rfcomm_send_fcon(s, 0);
1516 }
1517 break;
1518
1519 case RFCOMM_TEST:
1520 if (cr)
1521 rfcomm_send_test(s, 0, skb->data, skb->len);
1522 break;
1523
1524 case RFCOMM_NSC:
1525 break;
1526
1527 default:
1528 BT_ERR("Unknown control type 0x%02x", type);
1529 rfcomm_send_nsc(s, cr, type);
1530 break;
1531 }
1532 return 0;
1533}
1534
1535static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1536{
1537 struct rfcomm_dlc *d;
1538
1539 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1540
1541 d = rfcomm_dlc_get(s, dlci);
1542 if (!d) {
1543 rfcomm_send_dm(s, dlci);
1544 goto drop;
1545 }
1546
1547 if (pf && d->cfc) {
1548 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1549
1550 d->tx_credits += credits;
1551 if (d->tx_credits)
1552 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1553 }
1554
1555 if (skb->len && d->state == BT_CONNECTED) {
1556 rfcomm_dlc_lock(d);
1557 d->rx_credits--;
1558 d->data_ready(d, skb);
1559 rfcomm_dlc_unlock(d);
1560 return 0;
1561 }
1562
1563drop:
1564 kfree_skb(skb);
1565 return 0;
1566}
1567
1568static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1569{
1570 struct rfcomm_hdr *hdr = (void *) skb->data;
1571 u8 type, dlci, fcs;
1572
1573 dlci = __get_dlci(hdr->addr);
1574 type = __get_type(hdr->ctrl);
1575
1576 /* Trim FCS */
1577 skb->len--; skb->tail--;
27a884dc 1578 fcs = *(u8 *)skb_tail_pointer(skb);
1da177e4
LT		 1579
1580 if (__check_fcs(skb->data, type, fcs)) {
1581 BT_ERR("bad checksum in packet");
1582 kfree_skb(skb);
1583 return -EILSEQ;
1584 }
1585
1586 if (__test_ea(hdr->len))
1587 skb_pull(skb, 3);
1588 else
1589 skb_pull(skb, 4);
1590
1591 switch (type) {
1592 case RFCOMM_SABM:
1593 if (__test_pf(hdr->ctrl))
1594 rfcomm_recv_sabm(s, dlci);
1595 break;
1596
1597 case RFCOMM_DISC:
1598 if (__test_pf(hdr->ctrl))
1599 rfcomm_recv_disc(s, dlci);
1600 break;
1601
1602 case RFCOMM_UA:
1603 if (__test_pf(hdr->ctrl))
1604 rfcomm_recv_ua(s, dlci);
1605 break;
1606
1607 case RFCOMM_DM:
1608 rfcomm_recv_dm(s, dlci);
1609 break;
1610
1611 case RFCOMM_UIH:
1612 if (dlci)
1613 return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1614
1615 rfcomm_recv_mcc(s, skb);
1616 break;
1617
1618 default:
1619 BT_ERR("Unknown packet type 0x%02x\n", type);
1620 break;
1621 }
1622 kfree_skb(skb);
1623 return 0;
1624}
1625
1626/* ---- Connection and data processing ---- */
1627
1628static void rfcomm_process_connect(struct rfcomm_session *s)
1629{
1630 struct rfcomm_dlc *d;
1631 struct list_head *p, *n;
1632
1633 BT_DBG("session %p state %ld", s, s->state);
1634
1635 list_for_each_safe(p, n, &s->dlcs) {
1636 d = list_entry(p, struct rfcomm_dlc, list);
1637 if (d->state == BT_CONFIG) {
1638 d->mtu = s->mtu;
1639 rfcomm_send_pn(s, 1, d);
1640 }
1641 }
1642}
1643
1644/* Send data queued for the DLC.
1645 * Return number of frames left in the queue.
1646 */
1647static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1648{
1649 struct sk_buff *skb;
1650 int err;
1651
8e87d142 1652 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1da177e4
LT		 1653 d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1654
1655 /* Send pending MSC */
1656 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
8e87d142 1657 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1da177e4
LT		 1658
1659 if (d->cfc) {
8e87d142 1660 /* CFC enabled.
1da177e4
LT		 1661 * Give them some credits */
1662 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
8e87d142 1663 d->rx_credits <= (d->cfc >> 2)) {
1da177e4
LT		 1664 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1665 d->rx_credits = d->cfc;
1666 }
1667 } else {
1668 /* CFC disabled.
1669 * Give ourselves some credits */
1670 d->tx_credits = 5;
1671 }
1672
1673 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1674 return skb_queue_len(&d->tx_queue);
1675
1676 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1677 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1678 if (err < 0) {
1679 skb_queue_head(&d->tx_queue, skb);
1680 break;
1681 }
1682 kfree_skb(skb);
1683 d->tx_credits--;
1684 }
1685
1686 if (d->cfc && !d->tx_credits) {
1687 /* We're out of TX credits.
1688 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1689 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1690 }
1691
1692 return skb_queue_len(&d->tx_queue);
1693}
1694
1695static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1696{
1697 struct rfcomm_dlc *d;
1698 struct list_head *p, *n;
1699
1700 BT_DBG("session %p state %ld", s, s->state);
1701
1702 list_for_each_safe(p, n, &s->dlcs) {
1703 d = list_entry(p, struct rfcomm_dlc, list);
1704
1705 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1706 __rfcomm_dlc_close(d, ETIMEDOUT);
1707 continue;
1708 }
1709
1710 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1711 rfcomm_dlc_clear_timer(d);
1712 rfcomm_dlc_accept(d);
1713 if (d->link_mode & RFCOMM_LM_SECURE) {
1714 struct sock *sk = s->sock->sk;
1715 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
1716 }
1717 continue;
1718 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1719 rfcomm_dlc_clear_timer(d);
1720 rfcomm_send_dm(s, d->dlci);
1721 __rfcomm_dlc_close(d, ECONNREFUSED);
1722 continue;
1723 }
1724
1725 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1726 continue;
1727
1728 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1729 d->mscex == RFCOMM_MSCEX_OK)
1730 rfcomm_process_tx(d);
1731 }
1732}
1733
1734static inline void rfcomm_process_rx(struct rfcomm_session *s)
1735{
1736 struct socket *sock = s->sock;
1737 struct sock *sk = sock->sk;
1738 struct sk_buff *skb;
1739
1740 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1741
1742 /* Get data directly from socket receive queue without copying it. */
1743 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1744 skb_orphan(skb);
1745 rfcomm_recv_frame(s, skb);
1746 }
1747
1748 if (sk->sk_state == BT_CLOSED) {
1749 if (!s->initiator)
1750 rfcomm_session_put(s);
1751
1752 rfcomm_session_close(s, sk->sk_err);
1753 }
1754}
1755
1756static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1757{
1758 struct socket *sock = s->sock, *nsock;
1759 int err;
1760
1761 /* Fast check for a new connection.
1762 * Avoids unnesesary socket allocations. */
1763 if (list_empty(&bt_sk(sock->sk)->accept_q))
1764 return;
1765
1766 BT_DBG("session %p", s);
1767
48db9ca4
MH		 1768 err = kernel_accept(sock, &nsock, O_NONBLOCK);
1769 if (err < 0)
1da177e4
LT		 1770 return;
1771
1da177e4
LT		 1772 __module_get(nsock->ops->owner);
1773
1da177e4
LT		 1774 /* Set our callbacks */
1775 nsock->sk->sk_data_ready = rfcomm_l2data_ready;
1776 nsock->sk->sk_state_change = rfcomm_l2state_change;
1777
1778 s = rfcomm_session_add(nsock, BT_OPEN);
1779 if (s) {
1780 rfcomm_session_hold(s);
98bcd08b
MH		 1781
1782 /* We should adjust MTU on incoming sessions.
1783 * L2CAP MTU minus UIH header and FCS. */
1784 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1785
1da177e4
LT		 1786 rfcomm_schedule(RFCOMM_SCHED_RX);
1787 } else
1788 sock_release(nsock);
1789}
1790
1791static inline void rfcomm_check_connection(struct rfcomm_session *s)
1792{
1793 struct sock *sk = s->sock->sk;
1794
1795 BT_DBG("%p state %ld", s, s->state);
1796
1797 switch(sk->sk_state) {
1798 case BT_CONNECTED:
1799 s->state = BT_CONNECT;
1800
1801 /* We can adjust MTU on outgoing sessions.
1802 * L2CAP MTU minus UIH header and FCS. */
1803 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1804
1805 rfcomm_send_sabm(s, 0);
1806 break;
1807
1808 case BT_CLOSED:
1809 s->state = BT_CLOSED;
1810 rfcomm_session_close(s, sk->sk_err);
1811 break;
1812 }
1813}
1814
1815static inline void rfcomm_process_sessions(void)
1816{
1817 struct list_head *p, *n;
1818
1819 rfcomm_lock();
1820
1821 list_for_each_safe(p, n, &session_list) {
1822 struct rfcomm_session *s;
1823 s = list_entry(p, struct rfcomm_session, list);
1824
1825 if (s->state == BT_LISTEN) {
1826 rfcomm_accept_connection(s);
1827 continue;
1828 }
1829
1830 rfcomm_session_hold(s);
1831
1832 switch (s->state) {
1833 case BT_BOUND:
1834 rfcomm_check_connection(s);
1835 break;
1836
1837 default:
1838 rfcomm_process_rx(s);
1839 break;
1840 }
1841
1842 rfcomm_process_dlcs(s);
1843
1844 rfcomm_session_put(s);
1845 }
1846
1847 rfcomm_unlock();
1848}
1849
1da177e4
LT		 1850static int rfcomm_add_listener(bdaddr_t *ba)
1851{
1852 struct sockaddr_l2 addr;
1853 struct socket *sock;
1854 struct sock *sk;
1855 struct rfcomm_session *s;
1856 int err = 0;
1857
1858 /* Create socket */
1859 err = rfcomm_l2sock_create(&sock);
8e87d142 1860 if (err < 0) {
1da177e4
LT		 1861 BT_ERR("Create socket failed %d", err);
1862 return err;
1863 }
1864
1865 /* Bind socket */
1866 bacpy(&addr.l2_bdaddr, ba);
1867 addr.l2_family = AF_BLUETOOTH;
1868 addr.l2_psm = htobs(RFCOMM_PSM);
48db9ca4 1869 err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1da177e4
LT		 1870 if (err < 0) {
1871 BT_ERR("Bind failed %d", err);
1872 goto failed;
1873 }
1874
1875 /* Set L2CAP options */
1876 sk = sock->sk;
1877 lock_sock(sk);
56f3a40a 1878 l2cap_pi(sk)->imtu = l2cap_mtu;
1da177e4
LT		 1879 release_sock(sk);
1880
1881 /* Start listening on the socket */
48db9ca4 1882 err = kernel_listen(sock, 10);
1da177e4
LT		 1883 if (err) {
1884 BT_ERR("Listen failed %d", err);
1885 goto failed;
1886 }
1887
1888 /* Add listening session */
1889 s = rfcomm_session_add(sock, BT_LISTEN);
1890 if (!s)
1891 goto failed;
1892
1893 rfcomm_session_hold(s);
1894 return 0;
1895failed:
1896 sock_release(sock);
1897 return err;
1898}
1899
1900static void rfcomm_kill_listener(void)
1901{
1902 struct rfcomm_session *s;
1903 struct list_head *p, *n;
1904
1905 BT_DBG("");
1906
1907 list_for_each_safe(p, n, &session_list) {
1908 s = list_entry(p, struct rfcomm_session, list);
1909 rfcomm_session_del(s);
1910 }
1911}
1912
1913static int rfcomm_run(void *unused)
1914{
a524eccc 1915 BT_DBG("");
1da177e4 1916
1da177e4 1917 set_user_nice(current, -10);
1da177e4 1918
1da177e4
LT		 1919 rfcomm_add_listener(BDADDR_ANY);
1920
a524eccc
MH		 1921 while (!kthread_should_stop()) {
1922 set_current_state(TASK_INTERRUPTIBLE);
1923 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1924 /* No pending events. Let's sleep.
1925 * Incoming connections and data will wake us up. */
1926 schedule();
1927 }
1928 set_current_state(TASK_RUNNING);
1929
1930 /* Process stuff */
1931 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1932 rfcomm_process_sessions();
1933 }
1da177e4
LT		 1934
1935 rfcomm_kill_listener();
1936
1da177e4
LT		 1937 return 0;
1938}
1939
1940static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
1941{
1942 struct rfcomm_session *s;
1943 struct rfcomm_dlc *d;
1944 struct list_head *p, *n;
1945
1946 BT_DBG("conn %p status 0x%02x", conn, status);
1947
1948 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1949 if (!s)
1950 return;
1951
1952 rfcomm_session_hold(s);
1953
1954 list_for_each_safe(p, n, &s->dlcs) {
1955 d = list_entry(p, struct rfcomm_dlc, list);
1956
1957 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE))
1958 continue;
1959
1960 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1961 continue;
1962
1963 if (!status)
1964 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1965 else
1966 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1967 }
1968
1969 rfcomm_session_put(s);
1970
1971 rfcomm_schedule(RFCOMM_SCHED_AUTH);
1972}
1973
1974static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1975{
1976 struct rfcomm_session *s;
1977 struct rfcomm_dlc *d;
1978 struct list_head *p, *n;
1979
1980 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
1981
1982 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1983 if (!s)
1984 return;
1985
1986 rfcomm_session_hold(s);
1987
1988 list_for_each_safe(p, n, &s->dlcs) {
1989 d = list_entry(p, struct rfcomm_dlc, list);
1990
1991 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1992 continue;
1993
1994 if (!status && encrypt)
1995 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1996 else
1997 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1998 }
1999
2000 rfcomm_session_put(s);
2001
2002 rfcomm_schedule(RFCOMM_SCHED_AUTH);
2003}
2004
2005static struct hci_cb rfcomm_cb = {
2006 .name = "RFCOMM",
2007 .auth_cfm = rfcomm_auth_cfm,
2008 .encrypt_cfm = rfcomm_encrypt_cfm
2009};
2010
be9d1227 2011static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
1da177e4
LT		 2012{
2013 struct rfcomm_session *s;
2014 struct list_head *pp, *p;
be9d1227 2015 char *str = buf;
1da177e4
LT		 2016
2017 rfcomm_lock();
2018
2019 list_for_each(p, &session_list) {
2020 s = list_entry(p, struct rfcomm_session, list);
be9d1227
MH		 2021 list_for_each(pp, &s->dlcs) {
2022 struct sock *sk = s->sock->sk;
2023 struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
1da177e4 2024
be9d1227
MH		 2025 str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2026 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2027 d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
1da177e4
LT		 2028 }
2029 }
1da177e4 2030
1da177e4 2031 rfcomm_unlock();
1da177e4 2032
be9d1227 2033 return (str - buf);
1da177e4
LT		 2034}
2035
be9d1227 2036static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
1da177e4
LT		 2037
2038/* ---- Initialization ---- */
2039static int __init rfcomm_init(void)
2040{
2041 l2cap_load();
2042
2043 hci_register_cb(&rfcomm_cb);
2044
a524eccc
MH		 2045 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2046 if (IS_ERR(rfcomm_thread)) {
2047 hci_unregister_cb(&rfcomm_cb);
2048 return PTR_ERR(rfcomm_thread);
2049 }
1da177e4 2050
df5c37ea
MH		 2051 if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2052 BT_ERR("Failed to create RFCOMM info file");
1da177e4
LT		 2053
2054 rfcomm_init_sockets();
2055
2056#ifdef CONFIG_BT_RFCOMM_TTY
2057 rfcomm_init_ttys();
2058#endif
2059
be9d1227
MH		 2060 BT_INFO("RFCOMM ver %s", VERSION);
2061
1da177e4
LT		 2062 return 0;
2063}
2064
2065static void __exit rfcomm_exit(void)
2066{
a91f2e39 2067 class_remove_file(bt_class, &class_attr_rfcomm_dlc);
be9d1227 2068
1da177e4
LT		 2069 hci_unregister_cb(&rfcomm_cb);
2070
a524eccc 2071 kthread_stop(rfcomm_thread);
1da177e4
LT		 2072
2073#ifdef CONFIG_BT_RFCOMM_TTY
2074 rfcomm_cleanup_ttys();
2075#endif
2076
2077 rfcomm_cleanup_sockets();
1da177e4
LT		 2078}
2079
2080module_init(rfcomm_init);
2081module_exit(rfcomm_exit);
2082
7c2660b0
MH		 2083module_param(disable_cfc, bool, 0644);
2084MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2085
98bcd08b
MH		 2086module_param(channel_mtu, int, 0644);
2087MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2088
56f3a40a
MH		 2089module_param(l2cap_mtu, uint, 0644);
2090MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2091
1da177e4
LT		 2092MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
2093MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2094MODULE_VERSION(VERSION);
2095MODULE_LICENSE("GPL");
2096MODULE_ALIAS("bt-proto-3");
Clone of davem's net-next-2.6 tree