1/*
   2   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6   This program is free software; you can redistribute it and/or modify
   7   it under the terms of the GNU General Public License version 2 as
   8   published by the Free Software Foundation;
   9
  10   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21   SOFTWARE IS DISCLAIMED.
  22*/
  23
  24/*
  25 * Bluetooth RFCOMM core.
  26 */
  27
  28#include <linux/module.h>
 
 
 
 
 
 
 
  29#include <linux/debugfs.h>
 
 
 
  30#include <linux/kthread.h>
 
 
 
 
  31#include <asm/unaligned.h>
  32
  33#include <net/bluetooth/bluetooth.h>
  34#include <net/bluetooth/hci_core.h>
  35#include <net/bluetooth/l2cap.h>
  36#include <net/bluetooth/rfcomm.h>
  37
  38#include <trace/events/sock.h>
  39
  40#define VERSION "1.11"
  41
  42static bool disable_cfc;
  43static bool l2cap_ertm;
  44static int channel_mtu = -1;
 
  45
  46static struct task_struct *rfcomm_thread;
  47
  48static DEFINE_MUTEX(rfcomm_mutex);
  49#define rfcomm_lock()	mutex_lock(&rfcomm_mutex)
  50#define rfcomm_unlock()	mutex_unlock(&rfcomm_mutex)
  51
  52
  53static LIST_HEAD(session_list);
  54
  55static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  56static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  57static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  58static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  59static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  60static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  61static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  62static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  63static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  64static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  65
  66static void rfcomm_process_connect(struct rfcomm_session *s);
  67
  68static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
  69							bdaddr_t *dst,
  70							u8 sec_level,
  71							int *err);
  72static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
  73static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
  74
  75/* ---- RFCOMM frame parsing macros ---- */
  76#define __get_dlci(b)     ((b & 0xfc) >> 2)
 
 
  77#define __get_type(b)     ((b & 0xef))
  78
  79#define __test_ea(b)      ((b & 0x01))
  80#define __test_cr(b)      (!!(b & 0x02))
  81#define __test_pf(b)      (!!(b & 0x10))
  82
  83#define __session_dir(s)  ((s)->initiator ? 0x00 : 0x01)
  84
  85#define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  86#define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  87#define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  88#define __srv_channel(dlci)    (dlci >> 1)
 
  89
  90#define __len8(len)       (((len) << 1) | 1)
  91#define __len16(len)      ((len) << 1)
  92
  93/* MCC macros */
  94#define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
  95#define __get_mcc_type(b) ((b & 0xfc) >> 2)
  96#define __get_mcc_len(b)  ((b & 0xfe) >> 1)
  97
  98/* RPN macros */
  99#define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
 100#define __get_rpn_data_bits(line) ((line) & 0x3)
 101#define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 102#define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
 103
 104static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
 
 
 
 
 
 105
 106static void rfcomm_schedule(void)
 107{
 108	wake_up_all(&rfcomm_wq);
 
 109}
 110
 111/* ---- RFCOMM FCS computation ---- */
 112
 113/* reversed, 8-bit, poly=0x07 */
 114static unsigned char rfcomm_crc_table[256] = {
 115	0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
 116	0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
 117	0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
 118	0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
 119
 120	0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
 121	0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
 122	0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
 123	0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
 124
 125	0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
 126	0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
 127	0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
 128	0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
 129
 130	0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
 131	0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
 132	0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
 133	0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
 134
 135	0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
 136	0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
 137	0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
 138	0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
 139
 140	0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
 141	0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
 142	0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
 143	0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
 144
 145	0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
 146	0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
 147	0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
 148	0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
 149
 150	0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
 151	0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
 152	0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
 153	0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
 154};
 155
 156/* CRC on 2 bytes */
 157#define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 158
 159/* FCS on 2 bytes */
 160static inline u8 __fcs(u8 *data)
 161{
 162	return 0xff - __crc(data);
 163}
 164
 165/* FCS on 3 bytes */
 166static inline u8 __fcs2(u8 *data)
 167{
 168	return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
 169}
 170
 171/* Check FCS */
 172static inline int __check_fcs(u8 *data, int type, u8 fcs)
 173{
 174	u8 f = __crc(data);
 175
 176	if (type != RFCOMM_UIH)
 177		f = rfcomm_crc_table[f ^ data[2]];
 178
 179	return rfcomm_crc_table[f ^ fcs] != 0xcf;
 180}
 181
 182/* ---- L2CAP callbacks ---- */
 183static void rfcomm_l2state_change(struct sock *sk)
 184{
 185	BT_DBG("%p state %d", sk, sk->sk_state);
 186	rfcomm_schedule();
 187}
 188
 189static void rfcomm_l2data_ready(struct sock *sk)
 190{
 191	trace_sk_data_ready(sk);
 192
 193	BT_DBG("%p", sk);
 194	rfcomm_schedule();
 195}
 196
 197static int rfcomm_l2sock_create(struct socket **sock)
 198{
 199	int err;
 200
 201	BT_DBG("");
 202
 203	err = sock_create_kern(&init_net, PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 204	if (!err) {
 205		struct sock *sk = (*sock)->sk;
 206		sk->sk_data_ready   = rfcomm_l2data_ready;
 207		sk->sk_state_change = rfcomm_l2state_change;
 208	}
 209	return err;
 210}
 211
 212static int rfcomm_check_security(struct rfcomm_dlc *d)
 213{
 214	struct sock *sk = d->session->sock->sk;
 215	struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 216
 217	__u8 auth_type;
 218
 219	switch (d->sec_level) {
 220	case BT_SECURITY_HIGH:
 221	case BT_SECURITY_FIPS:
 222		auth_type = HCI_AT_GENERAL_BONDING_MITM;
 223		break;
 224	case BT_SECURITY_MEDIUM:
 225		auth_type = HCI_AT_GENERAL_BONDING;
 226		break;
 227	default:
 228		auth_type = HCI_AT_NO_BONDING;
 229		break;
 230	}
 231
 232	return hci_conn_security(conn->hcon, d->sec_level, auth_type,
 233				 d->out);
 234}
 235
 236static void rfcomm_session_timeout(struct timer_list *t)
 237{
 238	struct rfcomm_session *s = from_timer(s, t, timer);
 239
 240	BT_DBG("session %p state %ld", s, s->state);
 241
 242	set_bit(RFCOMM_TIMED_OUT, &s->flags);
 243	rfcomm_schedule();
 244}
 245
 246static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
 247{
 248	BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
 249
 250	mod_timer(&s->timer, jiffies + timeout);
 
 251}
 252
 253static void rfcomm_session_clear_timer(struct rfcomm_session *s)
 254{
 255	BT_DBG("session %p state %ld", s, s->state);
 256
 257	del_timer_sync(&s->timer);
 
 258}
 259
 260/* ---- RFCOMM DLCs ---- */
 261static void rfcomm_dlc_timeout(struct timer_list *t)
 262{
 263	struct rfcomm_dlc *d = from_timer(d, t, timer);
 264
 265	BT_DBG("dlc %p state %ld", d, d->state);
 266
 267	set_bit(RFCOMM_TIMED_OUT, &d->flags);
 268	rfcomm_dlc_put(d);
 269	rfcomm_schedule();
 270}
 271
 272static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 273{
 274	BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 275
 276	if (!mod_timer(&d->timer, jiffies + timeout))
 277		rfcomm_dlc_hold(d);
 278}
 279
 280static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 281{
 282	BT_DBG("dlc %p state %ld", d, d->state);
 283
 284	if (del_timer(&d->timer))
 285		rfcomm_dlc_put(d);
 286}
 287
 288static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 289{
 290	BT_DBG("%p", d);
 291
 292	d->state      = BT_OPEN;
 293	d->flags      = 0;
 294	d->mscex      = 0;
 295	d->sec_level  = BT_SECURITY_LOW;
 296	d->mtu        = RFCOMM_DEFAULT_MTU;
 297	d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 298
 299	d->cfc        = RFCOMM_CFC_DISABLED;
 300	d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 301}
 302
 303struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
 304{
 305	struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
 306
 307	if (!d)
 308		return NULL;
 309
 310	timer_setup(&d->timer, rfcomm_dlc_timeout, 0);
 311
 312	skb_queue_head_init(&d->tx_queue);
 313	mutex_init(&d->lock);
 314	refcount_set(&d->refcnt, 1);
 315
 316	rfcomm_dlc_clear_state(d);
 317
 318	BT_DBG("%p", d);
 319
 320	return d;
 321}
 322
 323void rfcomm_dlc_free(struct rfcomm_dlc *d)
 324{
 325	BT_DBG("%p", d);
 326
 327	skb_queue_purge(&d->tx_queue);
 328	kfree(d);
 329}
 330
 331static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 332{
 333	BT_DBG("dlc %p session %p", d, s);
 334
 
 
 335	rfcomm_session_clear_timer(s);
 336	rfcomm_dlc_hold(d);
 337	list_add(&d->list, &s->dlcs);
 338	d->session = s;
 339}
 340
 341static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 342{
 343	struct rfcomm_session *s = d->session;
 344
 345	BT_DBG("dlc %p refcnt %d session %p", d, refcount_read(&d->refcnt), s);
 346
 347	list_del(&d->list);
 348	d->session = NULL;
 349	rfcomm_dlc_put(d);
 350
 351	if (list_empty(&s->dlcs))
 352		rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
 
 
 353}
 354
 355static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 356{
 357	struct rfcomm_dlc *d;
 358
 359	list_for_each_entry(d, &s->dlcs, list)
 360		if (d->dlci == dlci)
 361			return d;
 362
 363	return NULL;
 364}
 365
 366static int rfcomm_check_channel(u8 channel)
 367{
 368	return channel < 1 || channel > 30;
 369}
 370
 371static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 372{
 373	struct rfcomm_session *s;
 374	int err = 0;
 375	u8 dlci;
 376
 377	BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
 378	       d, d->state, src, dst, channel);
 379
 380	if (rfcomm_check_channel(channel))
 381		return -EINVAL;
 382
 383	if (d->state != BT_OPEN && d->state != BT_CLOSED)
 384		return 0;
 385
 386	s = rfcomm_session_get(src, dst);
 387	if (!s) {
 388		s = rfcomm_session_create(src, dst, d->sec_level, &err);
 389		if (!s)
 390			return err;
 391	}
 392
 393	dlci = __dlci(__session_dir(s), channel);
 394
 395	/* Check if DLCI already exists */
 396	if (rfcomm_dlc_get(s, dlci))
 397		return -EBUSY;
 398
 399	rfcomm_dlc_clear_state(d);
 400
 401	d->dlci     = dlci;
 402	d->addr     = __addr(s->initiator, dlci);
 403	d->priority = 7;
 404
 405	d->state = BT_CONFIG;
 406	rfcomm_dlc_link(s, d);
 407
 408	d->out = 1;
 409
 410	d->mtu = s->mtu;
 411	d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 412
 413	if (s->state == BT_CONNECTED) {
 414		if (rfcomm_check_security(d))
 415			rfcomm_send_pn(s, 1, d);
 416		else
 417			set_bit(RFCOMM_AUTH_PENDING, &d->flags);
 418	}
 419
 420	rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 421
 422	return 0;
 423}
 424
 425int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 426{
 427	int r;
 428
 429	rfcomm_lock();
 430
 431	r = __rfcomm_dlc_open(d, src, dst, channel);
 432
 433	rfcomm_unlock();
 434	return r;
 435}
 436
 437static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
 438{
 439	struct rfcomm_session *s = d->session;
 440
 441	d->state = BT_DISCONN;
 442	if (skb_queue_empty(&d->tx_queue)) {
 443		rfcomm_send_disc(s, d->dlci);
 444		rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 445	} else {
 446		rfcomm_queue_disc(d);
 447		rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 448	}
 449}
 450
 451static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 452{
 453	struct rfcomm_session *s = d->session;
 454	if (!s)
 455		return 0;
 456
 457	BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 458			d, d->state, d->dlci, err, s);
 459
 460	switch (d->state) {
 461	case BT_CONNECT:
 462	case BT_CONFIG:
 463	case BT_OPEN:
 464	case BT_CONNECT2:
 465		if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 466			set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 467			rfcomm_schedule();
 468			return 0;
 469		}
 470	}
 471
 472	switch (d->state) {
 473	case BT_CONNECT:
 474	case BT_CONNECTED:
 475		__rfcomm_dlc_disconn(d);
 
 
 
 
 
 
 
 476		break;
 477
 478	case BT_CONFIG:
 479		if (s->state != BT_BOUND) {
 480			__rfcomm_dlc_disconn(d);
 
 
 481			break;
 482		}
 483		/* if closing a dlc in a session that hasn't been started,
 484		 * just close and unlink the dlc
 485		 */
 486		fallthrough;
 487
 488	default:
 489		rfcomm_dlc_clear_timer(d);
 490
 491		rfcomm_dlc_lock(d);
 492		d->state = BT_CLOSED;
 493		d->state_change(d, err);
 494		rfcomm_dlc_unlock(d);
 495
 496		skb_queue_purge(&d->tx_queue);
 497		rfcomm_dlc_unlink(d);
 498	}
 499
 500	return 0;
 501}
 502
 503int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 504{
 505	int r = 0;
 506	struct rfcomm_dlc *d_list;
 507	struct rfcomm_session *s, *s_list;
 508
 509	BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
 510
 511	rfcomm_lock();
 512
 513	s = d->session;
 514	if (!s)
 515		goto no_session;
 516
 517	/* after waiting on the mutex check the session still exists
 518	 * then check the dlc still exists
 519	 */
 520	list_for_each_entry(s_list, &session_list, list) {
 521		if (s_list == s) {
 522			list_for_each_entry(d_list, &s->dlcs, list) {
 523				if (d_list == d) {
 524					r = __rfcomm_dlc_close(d, err);
 525					break;
 526				}
 527			}
 528			break;
 529		}
 530	}
 531
 532no_session:
 533	rfcomm_unlock();
 534	return r;
 535}
 536
 537struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
 538{
 539	struct rfcomm_session *s;
 540	struct rfcomm_dlc *dlc = NULL;
 541	u8 dlci;
 542
 543	if (rfcomm_check_channel(channel))
 544		return ERR_PTR(-EINVAL);
 545
 546	rfcomm_lock();
 547	s = rfcomm_session_get(src, dst);
 548	if (s) {
 549		dlci = __dlci(__session_dir(s), channel);
 550		dlc = rfcomm_dlc_get(s, dlci);
 551	}
 552	rfcomm_unlock();
 553	return dlc;
 554}
 555
 556static int rfcomm_dlc_send_frag(struct rfcomm_dlc *d, struct sk_buff *frag)
 557{
 558	int len = frag->len;
 559
 560	BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 561
 562	if (len > d->mtu)
 563		return -EINVAL;
 564
 565	rfcomm_make_uih(frag, d->addr);
 566	__skb_queue_tail(&d->tx_queue, frag);
 567
 568	return len;
 569}
 570
 571int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 572{
 573	unsigned long flags;
 574	struct sk_buff *frag, *next;
 575	int len;
 576
 577	if (d->state != BT_CONNECTED)
 578		return -ENOTCONN;
 579
 580	frag = skb_shinfo(skb)->frag_list;
 581	skb_shinfo(skb)->frag_list = NULL;
 582
 583	/* Queue all fragments atomically. */
 584	spin_lock_irqsave(&d->tx_queue.lock, flags);
 585
 586	len = rfcomm_dlc_send_frag(d, skb);
 587	if (len < 0 || !frag)
 588		goto unlock;
 589
 590	for (; frag; frag = next) {
 591		int ret;
 592
 593		next = frag->next;
 594
 595		ret = rfcomm_dlc_send_frag(d, frag);
 596		if (ret < 0) {
 597			dev_kfree_skb_irq(frag);
 598			goto unlock;
 599		}
 600
 601		len += ret;
 602	}
 603
 604unlock:
 605	spin_unlock_irqrestore(&d->tx_queue.lock, flags);
 606
 607	if (len > 0 && !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 608		rfcomm_schedule();
 609	return len;
 610}
 611
 612void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
 613{
 614	int len = skb->len;
 615
 616	BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 617
 
 
 
 618	rfcomm_make_uih(skb, d->addr);
 619	skb_queue_tail(&d->tx_queue, skb);
 620
 621	if (d->state == BT_CONNECTED &&
 622	    !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 623		rfcomm_schedule();
 
 624}
 625
 626void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 627{
 628	BT_DBG("dlc %p state %ld", d, d->state);
 629
 630	if (!d->cfc) {
 631		d->v24_sig |= RFCOMM_V24_FC;
 632		set_bit(RFCOMM_MSC_PENDING, &d->flags);
 633	}
 634	rfcomm_schedule();
 635}
 636
 637void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 638{
 639	BT_DBG("dlc %p state %ld", d, d->state);
 640
 641	if (!d->cfc) {
 642		d->v24_sig &= ~RFCOMM_V24_FC;
 643		set_bit(RFCOMM_MSC_PENDING, &d->flags);
 644	}
 645	rfcomm_schedule();
 646}
 647
 648/*
 649   Set/get modem status functions use _local_ status i.e. what we report
 650   to the other side.
 651   Remote status is provided by dlc->modem_status() callback.
 652 */
 653int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 654{
 655	BT_DBG("dlc %p state %ld v24_sig 0x%x",
 656			d, d->state, v24_sig);
 657
 658	if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 659		v24_sig |= RFCOMM_V24_FC;
 660	else
 661		v24_sig &= ~RFCOMM_V24_FC;
 662
 663	d->v24_sig = v24_sig;
 664
 665	if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 666		rfcomm_schedule();
 667
 668	return 0;
 669}
 670
 671int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 672{
 673	BT_DBG("dlc %p state %ld v24_sig 0x%x",
 674			d, d->state, d->v24_sig);
 675
 676	*v24_sig = d->v24_sig;
 677	return 0;
 678}
 679
 680/* ---- RFCOMM sessions ---- */
 681static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 682{
 683	struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
 684
 685	if (!s)
 686		return NULL;
 687
 688	BT_DBG("session %p sock %p", s, sock);
 689
 690	timer_setup(&s->timer, rfcomm_session_timeout, 0);
 691
 692	INIT_LIST_HEAD(&s->dlcs);
 693	s->state = state;
 694	s->sock  = sock;
 695
 696	s->mtu = RFCOMM_DEFAULT_MTU;
 697	s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
 698
 699	/* Do not increment module usage count for listening sessions.
 700	 * Otherwise we won't be able to unload the module. */
 701	if (state != BT_LISTEN)
 702		if (!try_module_get(THIS_MODULE)) {
 703			kfree(s);
 704			return NULL;
 705		}
 706
 707	list_add(&s->list, &session_list);
 708
 709	return s;
 710}
 711
 712static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
 713{
 714	int state = s->state;
 715
 716	BT_DBG("session %p state %ld", s, s->state);
 717
 718	list_del(&s->list);
 719
 
 
 
 720	rfcomm_session_clear_timer(s);
 721	sock_release(s->sock);
 722	kfree(s);
 723
 724	if (state != BT_LISTEN)
 725		module_put(THIS_MODULE);
 726
 727	return NULL;
 728}
 729
 730static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 731{
 732	struct rfcomm_session *s, *n;
 733	struct l2cap_chan *chan;
 734	list_for_each_entry_safe(s, n, &session_list, list) {
 735		chan = l2cap_pi(s->sock->sk)->chan;
 
 
 736
 737		if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
 738		    !bacmp(&chan->dst, dst))
 739			return s;
 740	}
 741	return NULL;
 742}
 743
 744static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
 745						   int err)
 746{
 747	struct rfcomm_dlc *d, *n;
 748
 749	s->state = BT_CLOSED;
 750
 751	BT_DBG("session %p state %ld err %d", s, s->state, err);
 752
 
 
 
 
 753	/* Close all dlcs */
 754	list_for_each_entry_safe(d, n, &s->dlcs, list) {
 
 755		d->state = BT_CLOSED;
 756		__rfcomm_dlc_close(d, err);
 757	}
 758
 759	rfcomm_session_clear_timer(s);
 760	return rfcomm_session_del(s);
 761}
 762
 763static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
 764							bdaddr_t *dst,
 765							u8 sec_level,
 766							int *err)
 767{
 768	struct rfcomm_session *s = NULL;
 769	struct sockaddr_l2 addr;
 770	struct socket *sock;
 771	struct sock *sk;
 772
 773	BT_DBG("%pMR -> %pMR", src, dst);
 774
 775	*err = rfcomm_l2sock_create(&sock);
 776	if (*err < 0)
 777		return NULL;
 778
 779	bacpy(&addr.l2_bdaddr, src);
 780	addr.l2_family = AF_BLUETOOTH;
 781	addr.l2_psm    = 0;
 782	addr.l2_cid    = 0;
 783	addr.l2_bdaddr_type = BDADDR_BREDR;
 784	*err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 785	if (*err < 0)
 786		goto failed;
 787
 788	/* Set L2CAP options */
 789	sk = sock->sk;
 790	lock_sock(sk);
 791	/* Set MTU to 0 so L2CAP can auto select the MTU */
 792	l2cap_pi(sk)->chan->imtu = 0;
 793	l2cap_pi(sk)->chan->sec_level = sec_level;
 794	if (l2cap_ertm)
 795		l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
 796	release_sock(sk);
 797
 798	s = rfcomm_session_add(sock, BT_BOUND);
 799	if (!s) {
 800		*err = -ENOMEM;
 801		goto failed;
 802	}
 803
 804	s->initiator = 1;
 805
 806	bacpy(&addr.l2_bdaddr, dst);
 807	addr.l2_family = AF_BLUETOOTH;
 808	addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
 809	addr.l2_cid    = 0;
 810	addr.l2_bdaddr_type = BDADDR_BREDR;
 811	*err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 812	if (*err == 0 || *err == -EINPROGRESS)
 813		return s;
 814
 815	return rfcomm_session_del(s);
 
 816
 817failed:
 818	sock_release(sock);
 819	return NULL;
 820}
 821
 822void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 823{
 824	struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
 825	if (src)
 826		bacpy(src, &chan->src);
 827	if (dst)
 828		bacpy(dst, &chan->dst);
 829}
 830
 831/* ---- RFCOMM frame sending ---- */
 832static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 833{
 834	struct kvec iv = { data, len };
 835	struct msghdr msg;
 836
 837	BT_DBG("session %p len %d", s, len);
 838
 839	memset(&msg, 0, sizeof(msg));
 840
 841	return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
 842}
 843
 844static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
 845{
 846	BT_DBG("%p cmd %u", s, cmd->ctrl);
 847
 848	return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
 849}
 850
 851static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 852{
 853	struct rfcomm_cmd cmd;
 854
 855	BT_DBG("%p dlci %d", s, dlci);
 856
 857	cmd.addr = __addr(s->initiator, dlci);
 858	cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 859	cmd.len  = __len8(0);
 860	cmd.fcs  = __fcs2((u8 *) &cmd);
 861
 862	return rfcomm_send_cmd(s, &cmd);
 863}
 864
 865static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 866{
 867	struct rfcomm_cmd cmd;
 868
 869	BT_DBG("%p dlci %d", s, dlci);
 870
 871	cmd.addr = __addr(!s->initiator, dlci);
 872	cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 873	cmd.len  = __len8(0);
 874	cmd.fcs  = __fcs2((u8 *) &cmd);
 875
 876	return rfcomm_send_cmd(s, &cmd);
 877}
 878
 879static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 880{
 881	struct rfcomm_cmd cmd;
 882
 883	BT_DBG("%p dlci %d", s, dlci);
 884
 885	cmd.addr = __addr(s->initiator, dlci);
 886	cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 887	cmd.len  = __len8(0);
 888	cmd.fcs  = __fcs2((u8 *) &cmd);
 889
 890	return rfcomm_send_cmd(s, &cmd);
 891}
 892
 893static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 894{
 895	struct rfcomm_cmd *cmd;
 896	struct sk_buff *skb;
 897
 898	BT_DBG("dlc %p dlci %d", d, d->dlci);
 899
 900	skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 901	if (!skb)
 902		return -ENOMEM;
 903
 904	cmd = __skb_put(skb, sizeof(*cmd));
 905	cmd->addr = d->addr;
 906	cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 907	cmd->len  = __len8(0);
 908	cmd->fcs  = __fcs2((u8 *) cmd);
 909
 910	skb_queue_tail(&d->tx_queue, skb);
 911	rfcomm_schedule();
 912	return 0;
 913}
 914
 915static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 916{
 917	struct rfcomm_cmd cmd;
 918
 919	BT_DBG("%p dlci %d", s, dlci);
 920
 921	cmd.addr = __addr(!s->initiator, dlci);
 922	cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 923	cmd.len  = __len8(0);
 924	cmd.fcs  = __fcs2((u8 *) &cmd);
 925
 926	return rfcomm_send_cmd(s, &cmd);
 927}
 928
 929static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 930{
 931	struct rfcomm_hdr *hdr;
 932	struct rfcomm_mcc *mcc;
 933	u8 buf[16], *ptr = buf;
 934
 935	BT_DBG("%p cr %d type %d", s, cr, type);
 936
 937	hdr = (void *) ptr; ptr += sizeof(*hdr);
 938	hdr->addr = __addr(s->initiator, 0);
 939	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 940	hdr->len  = __len8(sizeof(*mcc) + 1);
 941
 942	mcc = (void *) ptr; ptr += sizeof(*mcc);
 943	mcc->type = __mcc_type(0, RFCOMM_NSC);
 944	mcc->len  = __len8(1);
 945
 946	/* Type that we didn't like */
 947	*ptr = __mcc_type(cr, type); ptr++;
 948
 949	*ptr = __fcs(buf); ptr++;
 950
 951	return rfcomm_send_frame(s, buf, ptr - buf);
 952}
 953
 954static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 955{
 956	struct rfcomm_hdr *hdr;
 957	struct rfcomm_mcc *mcc;
 958	struct rfcomm_pn  *pn;
 959	u8 buf[16], *ptr = buf;
 960
 961	BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 962
 963	hdr = (void *) ptr; ptr += sizeof(*hdr);
 964	hdr->addr = __addr(s->initiator, 0);
 965	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 966	hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 967
 968	mcc = (void *) ptr; ptr += sizeof(*mcc);
 969	mcc->type = __mcc_type(cr, RFCOMM_PN);
 970	mcc->len  = __len8(sizeof(*pn));
 971
 972	pn = (void *) ptr; ptr += sizeof(*pn);
 973	pn->dlci        = d->dlci;
 974	pn->priority    = d->priority;
 975	pn->ack_timer   = 0;
 976	pn->max_retrans = 0;
 977
 978	if (s->cfc) {
 979		pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 980		pn->credits = RFCOMM_DEFAULT_CREDITS;
 981	} else {
 982		pn->flow_ctrl = 0;
 983		pn->credits   = 0;
 984	}
 985
 986	if (cr && channel_mtu >= 0)
 987		pn->mtu = cpu_to_le16(channel_mtu);
 988	else
 989		pn->mtu = cpu_to_le16(d->mtu);
 990
 991	*ptr = __fcs(buf); ptr++;
 992
 993	return rfcomm_send_frame(s, buf, ptr - buf);
 994}
 995
 996int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 997			u8 bit_rate, u8 data_bits, u8 stop_bits,
 998			u8 parity, u8 flow_ctrl_settings,
 999			u8 xon_char, u8 xoff_char, u16 param_mask)
1000{
1001	struct rfcomm_hdr *hdr;
1002	struct rfcomm_mcc *mcc;
1003	struct rfcomm_rpn *rpn;
1004	u8 buf[16], *ptr = buf;
1005
1006	BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
1007			" flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
1008		s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
1009		flow_ctrl_settings, xon_char, xoff_char, param_mask);
1010
1011	hdr = (void *) ptr; ptr += sizeof(*hdr);
1012	hdr->addr = __addr(s->initiator, 0);
1013	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1014	hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
1015
1016	mcc = (void *) ptr; ptr += sizeof(*mcc);
1017	mcc->type = __mcc_type(cr, RFCOMM_RPN);
1018	mcc->len  = __len8(sizeof(*rpn));
1019
1020	rpn = (void *) ptr; ptr += sizeof(*rpn);
1021	rpn->dlci          = __addr(1, dlci);
1022	rpn->bit_rate      = bit_rate;
1023	rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
1024	rpn->flow_ctrl     = flow_ctrl_settings;
1025	rpn->xon_char      = xon_char;
1026	rpn->xoff_char     = xoff_char;
1027	rpn->param_mask    = cpu_to_le16(param_mask);
1028
1029	*ptr = __fcs(buf); ptr++;
1030
1031	return rfcomm_send_frame(s, buf, ptr - buf);
1032}
1033
1034static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
1035{
1036	struct rfcomm_hdr *hdr;
1037	struct rfcomm_mcc *mcc;
1038	struct rfcomm_rls *rls;
1039	u8 buf[16], *ptr = buf;
1040
1041	BT_DBG("%p cr %d status 0x%x", s, cr, status);
1042
1043	hdr = (void *) ptr; ptr += sizeof(*hdr);
1044	hdr->addr = __addr(s->initiator, 0);
1045	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1046	hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
1047
1048	mcc = (void *) ptr; ptr += sizeof(*mcc);
1049	mcc->type = __mcc_type(cr, RFCOMM_RLS);
1050	mcc->len  = __len8(sizeof(*rls));
1051
1052	rls = (void *) ptr; ptr += sizeof(*rls);
1053	rls->dlci   = __addr(1, dlci);
1054	rls->status = status;
1055
1056	*ptr = __fcs(buf); ptr++;
1057
1058	return rfcomm_send_frame(s, buf, ptr - buf);
1059}
1060
1061static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1062{
1063	struct rfcomm_hdr *hdr;
1064	struct rfcomm_mcc *mcc;
1065	struct rfcomm_msc *msc;
1066	u8 buf[16], *ptr = buf;
1067
1068	BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1069
1070	hdr = (void *) ptr; ptr += sizeof(*hdr);
1071	hdr->addr = __addr(s->initiator, 0);
1072	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1073	hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
1074
1075	mcc = (void *) ptr; ptr += sizeof(*mcc);
1076	mcc->type = __mcc_type(cr, RFCOMM_MSC);
1077	mcc->len  = __len8(sizeof(*msc));
1078
1079	msc = (void *) ptr; ptr += sizeof(*msc);
1080	msc->dlci    = __addr(1, dlci);
1081	msc->v24_sig = v24_sig | 0x01;
1082
1083	*ptr = __fcs(buf); ptr++;
1084
1085	return rfcomm_send_frame(s, buf, ptr - buf);
1086}
1087
1088static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1089{
1090	struct rfcomm_hdr *hdr;
1091	struct rfcomm_mcc *mcc;
1092	u8 buf[16], *ptr = buf;
1093
1094	BT_DBG("%p cr %d", s, cr);
1095
1096	hdr = (void *) ptr; ptr += sizeof(*hdr);
1097	hdr->addr = __addr(s->initiator, 0);
1098	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1099	hdr->len  = __len8(sizeof(*mcc));
1100
1101	mcc = (void *) ptr; ptr += sizeof(*mcc);
1102	mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1103	mcc->len  = __len8(0);
1104
1105	*ptr = __fcs(buf); ptr++;
1106
1107	return rfcomm_send_frame(s, buf, ptr - buf);
1108}
1109
1110static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1111{
1112	struct rfcomm_hdr *hdr;
1113	struct rfcomm_mcc *mcc;
1114	u8 buf[16], *ptr = buf;
1115
1116	BT_DBG("%p cr %d", s, cr);
1117
1118	hdr = (void *) ptr; ptr += sizeof(*hdr);
1119	hdr->addr = __addr(s->initiator, 0);
1120	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1121	hdr->len  = __len8(sizeof(*mcc));
1122
1123	mcc = (void *) ptr; ptr += sizeof(*mcc);
1124	mcc->type = __mcc_type(cr, RFCOMM_FCON);
1125	mcc->len  = __len8(0);
1126
1127	*ptr = __fcs(buf); ptr++;
1128
1129	return rfcomm_send_frame(s, buf, ptr - buf);
1130}
1131
1132static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1133{
1134	struct socket *sock = s->sock;
1135	struct kvec iv[3];
1136	struct msghdr msg;
1137	unsigned char hdr[5], crc[1];
1138
1139	if (len > 125)
1140		return -EINVAL;
1141
1142	BT_DBG("%p cr %d", s, cr);
1143
1144	hdr[0] = __addr(s->initiator, 0);
1145	hdr[1] = __ctrl(RFCOMM_UIH, 0);
1146	hdr[2] = 0x01 | ((len + 2) << 1);
1147	hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1148	hdr[4] = 0x01 | (len << 1);
1149
1150	crc[0] = __fcs(hdr);
1151
1152	iv[0].iov_base = hdr;
1153	iv[0].iov_len  = 5;
1154	iv[1].iov_base = pattern;
1155	iv[1].iov_len  = len;
1156	iv[2].iov_base = crc;
1157	iv[2].iov_len  = 1;
1158
1159	memset(&msg, 0, sizeof(msg));
1160
1161	return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1162}
1163
1164static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1165{
1166	struct rfcomm_hdr *hdr;
1167	u8 buf[16], *ptr = buf;
1168
1169	BT_DBG("%p addr %d credits %d", s, addr, credits);
1170
1171	hdr = (void *) ptr; ptr += sizeof(*hdr);
1172	hdr->addr = addr;
1173	hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1174	hdr->len  = __len8(0);
1175
1176	*ptr = credits; ptr++;
1177
1178	*ptr = __fcs(buf); ptr++;
1179
1180	return rfcomm_send_frame(s, buf, ptr - buf);
1181}
1182
1183static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1184{
1185	struct rfcomm_hdr *hdr;
1186	int len = skb->len;
1187	u8 *crc;
1188
1189	if (len > 127) {
1190		hdr = skb_push(skb, 4);
1191		put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1192	} else {
1193		hdr = skb_push(skb, 3);
1194		hdr->len = __len8(len);
1195	}
1196	hdr->addr = addr;
1197	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1198
1199	crc = skb_put(skb, 1);
1200	*crc = __fcs((void *) hdr);
1201}
1202
1203/* ---- RFCOMM frame reception ---- */
1204static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1205{
1206	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1207
1208	if (dlci) {
1209		/* Data channel */
1210		struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1211		if (!d) {
1212			rfcomm_send_dm(s, dlci);
1213			return s;
1214		}
1215
1216		switch (d->state) {
1217		case BT_CONNECT:
1218			rfcomm_dlc_clear_timer(d);
1219
1220			rfcomm_dlc_lock(d);
1221			d->state = BT_CONNECTED;
1222			d->state_change(d, 0);
1223			rfcomm_dlc_unlock(d);
1224
1225			rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1226			break;
1227
1228		case BT_DISCONN:
1229			d->state = BT_CLOSED;
1230			__rfcomm_dlc_close(d, 0);
1231
1232			if (list_empty(&s->dlcs)) {
1233				s->state = BT_DISCONN;
1234				rfcomm_send_disc(s, 0);
1235				rfcomm_session_clear_timer(s);
1236			}
1237
1238			break;
1239		}
1240	} else {
1241		/* Control channel */
1242		switch (s->state) {
1243		case BT_CONNECT:
1244			s->state = BT_CONNECTED;
1245			rfcomm_process_connect(s);
1246			break;
1247
1248		case BT_DISCONN:
1249			s = rfcomm_session_close(s, ECONNRESET);
 
 
 
 
 
 
 
 
 
 
 
1250			break;
1251		}
1252	}
1253	return s;
1254}
1255
1256static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1257{
1258	int err = 0;
1259
1260	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1261
1262	if (dlci) {
1263		/* Data DLC */
1264		struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1265		if (d) {
1266			if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1267				err = ECONNREFUSED;
1268			else
1269				err = ECONNRESET;
1270
1271			d->state = BT_CLOSED;
1272			__rfcomm_dlc_close(d, err);
1273		}
1274	} else {
1275		if (s->state == BT_CONNECT)
1276			err = ECONNREFUSED;
1277		else
1278			err = ECONNRESET;
1279
1280		s = rfcomm_session_close(s, err);
 
1281	}
1282	return s;
1283}
1284
1285static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1286					       u8 dlci)
1287{
1288	int err = 0;
1289
1290	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1291
1292	if (dlci) {
1293		struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1294		if (d) {
1295			rfcomm_send_ua(s, dlci);
1296
1297			if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1298				err = ECONNREFUSED;
1299			else
1300				err = ECONNRESET;
1301
1302			d->state = BT_CLOSED;
1303			__rfcomm_dlc_close(d, err);
1304		} else
1305			rfcomm_send_dm(s, dlci);
1306
1307	} else {
1308		rfcomm_send_ua(s, 0);
1309
1310		if (s->state == BT_CONNECT)
1311			err = ECONNREFUSED;
1312		else
1313			err = ECONNRESET;
1314
1315		s = rfcomm_session_close(s, err);
 
1316	}
1317	return s;
 
1318}
1319
1320void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1321{
1322	struct sock *sk = d->session->sock->sk;
1323	struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1324
1325	BT_DBG("dlc %p", d);
1326
1327	rfcomm_send_ua(d->session, d->dlci);
1328
1329	rfcomm_dlc_clear_timer(d);
1330
1331	rfcomm_dlc_lock(d);
1332	d->state = BT_CONNECTED;
1333	d->state_change(d, 0);
1334	rfcomm_dlc_unlock(d);
1335
1336	if (d->role_switch)
1337		hci_conn_switch_role(conn->hcon, 0x00);
1338
1339	rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1340}
1341
1342static void rfcomm_check_accept(struct rfcomm_dlc *d)
1343{
1344	if (rfcomm_check_security(d)) {
1345		if (d->defer_setup) {
1346			set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1347			rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1348
1349			rfcomm_dlc_lock(d);
1350			d->state = BT_CONNECT2;
1351			d->state_change(d, 0);
1352			rfcomm_dlc_unlock(d);
1353		} else
1354			rfcomm_dlc_accept(d);
1355	} else {
1356		set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1357		rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1358	}
1359}
1360
1361static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1362{
1363	struct rfcomm_dlc *d;
1364	u8 channel;
1365
1366	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1367
1368	if (!dlci) {
1369		rfcomm_send_ua(s, 0);
1370
1371		if (s->state == BT_OPEN) {
1372			s->state = BT_CONNECTED;
1373			rfcomm_process_connect(s);
1374		}
1375		return 0;
1376	}
1377
1378	/* Check if DLC exists */
1379	d = rfcomm_dlc_get(s, dlci);
1380	if (d) {
1381		if (d->state == BT_OPEN) {
1382			/* DLC was previously opened by PN request */
1383			rfcomm_check_accept(d);
1384		}
1385		return 0;
1386	}
1387
1388	/* Notify socket layer about incoming connection */
1389	channel = __srv_channel(dlci);
1390	if (rfcomm_connect_ind(s, channel, &d)) {
1391		d->dlci = dlci;
1392		d->addr = __addr(s->initiator, dlci);
1393		rfcomm_dlc_link(s, d);
1394
1395		rfcomm_check_accept(d);
1396	} else {
1397		rfcomm_send_dm(s, dlci);
1398	}
1399
1400	return 0;
1401}
1402
1403static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1404{
1405	struct rfcomm_session *s = d->session;
1406
1407	BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1408			d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1409
1410	if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1411						pn->flow_ctrl == 0xe0) {
1412		d->cfc = RFCOMM_CFC_ENABLED;
1413		d->tx_credits = pn->credits;
1414	} else {
1415		d->cfc = RFCOMM_CFC_DISABLED;
1416		set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1417	}
1418
1419	if (s->cfc == RFCOMM_CFC_UNKNOWN)
1420		s->cfc = d->cfc;
1421
1422	d->priority = pn->priority;
1423
1424	d->mtu = __le16_to_cpu(pn->mtu);
1425
1426	if (cr && d->mtu > s->mtu)
1427		d->mtu = s->mtu;
1428
1429	return 0;
1430}
1431
1432static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1433{
1434	struct rfcomm_pn *pn = (void *) skb->data;
1435	struct rfcomm_dlc *d;
1436	u8 dlci = pn->dlci;
1437
1438	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1439
1440	if (!dlci)
1441		return 0;
1442
1443	d = rfcomm_dlc_get(s, dlci);
1444	if (d) {
1445		if (cr) {
1446			/* PN request */
1447			rfcomm_apply_pn(d, cr, pn);
1448			rfcomm_send_pn(s, 0, d);
1449		} else {
1450			/* PN response */
1451			switch (d->state) {
1452			case BT_CONFIG:
1453				rfcomm_apply_pn(d, cr, pn);
1454
1455				d->state = BT_CONNECT;
1456				rfcomm_send_sabm(s, d->dlci);
1457				break;
1458			}
1459		}
1460	} else {
1461		u8 channel = __srv_channel(dlci);
1462
1463		if (!cr)
1464			return 0;
1465
1466		/* PN request for non existing DLC.
1467		 * Assume incoming connection. */
1468		if (rfcomm_connect_ind(s, channel, &d)) {
1469			d->dlci = dlci;
1470			d->addr = __addr(s->initiator, dlci);
1471			rfcomm_dlc_link(s, d);
1472
1473			rfcomm_apply_pn(d, cr, pn);
1474
1475			d->state = BT_OPEN;
1476			rfcomm_send_pn(s, 0, d);
1477		} else {
1478			rfcomm_send_dm(s, dlci);
1479		}
1480	}
1481	return 0;
1482}
1483
1484static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1485{
1486	struct rfcomm_rpn *rpn = (void *) skb->data;
1487	u8 dlci = __get_dlci(rpn->dlci);
1488
1489	u8 bit_rate  = 0;
1490	u8 data_bits = 0;
1491	u8 stop_bits = 0;
1492	u8 parity    = 0;
1493	u8 flow_ctrl = 0;
1494	u8 xon_char  = 0;
1495	u8 xoff_char = 0;
1496	u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1497
1498	BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1499		dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1500		rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1501
1502	if (!cr)
1503		return 0;
1504
1505	if (len == 1) {
1506		/* This is a request, return default (according to ETSI TS 07.10) settings */
1507		bit_rate  = RFCOMM_RPN_BR_9600;
1508		data_bits = RFCOMM_RPN_DATA_8;
1509		stop_bits = RFCOMM_RPN_STOP_1;
1510		parity    = RFCOMM_RPN_PARITY_NONE;
1511		flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1512		xon_char  = RFCOMM_RPN_XON_CHAR;
1513		xoff_char = RFCOMM_RPN_XOFF_CHAR;
1514		goto rpn_out;
1515	}
1516
1517	/* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1518	 * no parity, no flow control lines, normal XON/XOFF chars */
1519
1520	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1521		bit_rate = rpn->bit_rate;
1522		if (bit_rate > RFCOMM_RPN_BR_230400) {
1523			BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1524			bit_rate = RFCOMM_RPN_BR_9600;
1525			rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1526		}
1527	}
1528
1529	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1530		data_bits = __get_rpn_data_bits(rpn->line_settings);
1531		if (data_bits != RFCOMM_RPN_DATA_8) {
1532			BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1533			data_bits = RFCOMM_RPN_DATA_8;
1534			rpn_mask ^= RFCOMM_RPN_PM_DATA;
1535		}
1536	}
1537
1538	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1539		stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1540		if (stop_bits != RFCOMM_RPN_STOP_1) {
1541			BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1542			stop_bits = RFCOMM_RPN_STOP_1;
1543			rpn_mask ^= RFCOMM_RPN_PM_STOP;
1544		}
1545	}
1546
1547	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1548		parity = __get_rpn_parity(rpn->line_settings);
1549		if (parity != RFCOMM_RPN_PARITY_NONE) {
1550			BT_DBG("RPN parity mismatch 0x%x", parity);
1551			parity = RFCOMM_RPN_PARITY_NONE;
1552			rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1553		}
1554	}
1555
1556	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1557		flow_ctrl = rpn->flow_ctrl;
1558		if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1559			BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1560			flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1561			rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1562		}
1563	}
1564
1565	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1566		xon_char = rpn->xon_char;
1567		if (xon_char != RFCOMM_RPN_XON_CHAR) {
1568			BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1569			xon_char = RFCOMM_RPN_XON_CHAR;
1570			rpn_mask ^= RFCOMM_RPN_PM_XON;
1571		}
1572	}
1573
1574	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1575		xoff_char = rpn->xoff_char;
1576		if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1577			BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1578			xoff_char = RFCOMM_RPN_XOFF_CHAR;
1579			rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1580		}
1581	}
1582
1583rpn_out:
1584	rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1585			parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1586
1587	return 0;
1588}
1589
1590static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1591{
1592	struct rfcomm_rls *rls = (void *) skb->data;
1593	u8 dlci = __get_dlci(rls->dlci);
1594
1595	BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1596
1597	if (!cr)
1598		return 0;
1599
1600	/* We should probably do something with this information here. But
1601	 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1602	 * mandatory to recognise and respond to RLS */
1603
1604	rfcomm_send_rls(s, 0, dlci, rls->status);
1605
1606	return 0;
1607}
1608
1609static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1610{
1611	struct rfcomm_msc *msc = (void *) skb->data;
1612	struct rfcomm_dlc *d;
1613	u8 dlci = __get_dlci(msc->dlci);
1614
1615	BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1616
1617	d = rfcomm_dlc_get(s, dlci);
1618	if (!d)
1619		return 0;
1620
1621	if (cr) {
1622		if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1623			set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1624		else
1625			clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1626
1627		rfcomm_dlc_lock(d);
1628
1629		d->remote_v24_sig = msc->v24_sig;
1630
1631		if (d->modem_status)
1632			d->modem_status(d, msc->v24_sig);
1633
1634		rfcomm_dlc_unlock(d);
1635
1636		rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1637
1638		d->mscex |= RFCOMM_MSCEX_RX;
1639	} else
1640		d->mscex |= RFCOMM_MSCEX_TX;
1641
1642	return 0;
1643}
1644
1645static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1646{
1647	struct rfcomm_mcc *mcc = (void *) skb->data;
1648	u8 type, cr, len;
1649
1650	cr   = __test_cr(mcc->type);
1651	type = __get_mcc_type(mcc->type);
1652	len  = __get_mcc_len(mcc->len);
1653
1654	BT_DBG("%p type 0x%x cr %d", s, type, cr);
1655
1656	skb_pull(skb, 2);
1657
1658	switch (type) {
1659	case RFCOMM_PN:
1660		rfcomm_recv_pn(s, cr, skb);
1661		break;
1662
1663	case RFCOMM_RPN:
1664		rfcomm_recv_rpn(s, cr, len, skb);
1665		break;
1666
1667	case RFCOMM_RLS:
1668		rfcomm_recv_rls(s, cr, skb);
1669		break;
1670
1671	case RFCOMM_MSC:
1672		rfcomm_recv_msc(s, cr, skb);
1673		break;
1674
1675	case RFCOMM_FCOFF:
1676		if (cr) {
1677			set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1678			rfcomm_send_fcoff(s, 0);
1679		}
1680		break;
1681
1682	case RFCOMM_FCON:
1683		if (cr) {
1684			clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1685			rfcomm_send_fcon(s, 0);
1686		}
1687		break;
1688
1689	case RFCOMM_TEST:
1690		if (cr)
1691			rfcomm_send_test(s, 0, skb->data, skb->len);
1692		break;
1693
1694	case RFCOMM_NSC:
1695		break;
1696
1697	default:
1698		BT_ERR("Unknown control type 0x%02x", type);
1699		rfcomm_send_nsc(s, cr, type);
1700		break;
1701	}
1702	return 0;
1703}
1704
1705static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1706{
1707	struct rfcomm_dlc *d;
1708
1709	BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1710
1711	d = rfcomm_dlc_get(s, dlci);
1712	if (!d) {
1713		rfcomm_send_dm(s, dlci);
1714		goto drop;
1715	}
1716
1717	if (pf && d->cfc) {
1718		u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1719
1720		d->tx_credits += credits;
1721		if (d->tx_credits)
1722			clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1723	}
1724
1725	if (skb->len && d->state == BT_CONNECTED) {
1726		rfcomm_dlc_lock(d);
1727		d->rx_credits--;
1728		d->data_ready(d, skb);
1729		rfcomm_dlc_unlock(d);
1730		return 0;
1731	}
1732
1733drop:
1734	kfree_skb(skb);
1735	return 0;
1736}
1737
1738static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1739						struct sk_buff *skb)
1740{
1741	struct rfcomm_hdr *hdr = (void *) skb->data;
1742	u8 type, dlci, fcs;
1743
1744	if (!s) {
1745		/* no session, so free socket data */
1746		kfree_skb(skb);
1747		return s;
1748	}
1749
1750	dlci = __get_dlci(hdr->addr);
1751	type = __get_type(hdr->ctrl);
1752
1753	/* Trim FCS */
1754	skb->len--; skb->tail--;
1755	fcs = *(u8 *)skb_tail_pointer(skb);
1756
1757	if (__check_fcs(skb->data, type, fcs)) {
1758		BT_ERR("bad checksum in packet");
1759		kfree_skb(skb);
1760		return s;
1761	}
1762
1763	if (__test_ea(hdr->len))
1764		skb_pull(skb, 3);
1765	else
1766		skb_pull(skb, 4);
1767
1768	switch (type) {
1769	case RFCOMM_SABM:
1770		if (__test_pf(hdr->ctrl))
1771			rfcomm_recv_sabm(s, dlci);
1772		break;
1773
1774	case RFCOMM_DISC:
1775		if (__test_pf(hdr->ctrl))
1776			s = rfcomm_recv_disc(s, dlci);
1777		break;
1778
1779	case RFCOMM_UA:
1780		if (__test_pf(hdr->ctrl))
1781			s = rfcomm_recv_ua(s, dlci);
1782		break;
1783
1784	case RFCOMM_DM:
1785		s = rfcomm_recv_dm(s, dlci);
1786		break;
1787
1788	case RFCOMM_UIH:
1789		if (dlci) {
1790			rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1791			return s;
1792		}
1793		rfcomm_recv_mcc(s, skb);
1794		break;
1795
1796	default:
1797		BT_ERR("Unknown packet type 0x%02x", type);
1798		break;
1799	}
1800	kfree_skb(skb);
1801	return s;
1802}
1803
1804/* ---- Connection and data processing ---- */
1805
1806static void rfcomm_process_connect(struct rfcomm_session *s)
1807{
1808	struct rfcomm_dlc *d, *n;
 
1809
1810	BT_DBG("session %p state %ld", s, s->state);
1811
1812	list_for_each_entry_safe(d, n, &s->dlcs, list) {
 
1813		if (d->state == BT_CONFIG) {
1814			d->mtu = s->mtu;
1815			if (rfcomm_check_security(d)) {
1816				rfcomm_send_pn(s, 1, d);
1817			} else {
1818				set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1819				rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1820			}
1821		}
1822	}
1823}
1824
1825/* Send data queued for the DLC.
1826 * Return number of frames left in the queue.
1827 */
1828static int rfcomm_process_tx(struct rfcomm_dlc *d)
1829{
1830	struct sk_buff *skb;
1831	int err;
1832
1833	BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1834			d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1835
1836	/* Send pending MSC */
1837	if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1838		rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1839
1840	if (d->cfc) {
1841		/* CFC enabled.
1842		 * Give them some credits */
1843		if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1844				d->rx_credits <= (d->cfc >> 2)) {
1845			rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1846			d->rx_credits = d->cfc;
1847		}
1848	} else {
1849		/* CFC disabled.
1850		 * Give ourselves some credits */
1851		d->tx_credits = 5;
1852	}
1853
1854	if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1855		return skb_queue_len(&d->tx_queue);
1856
1857	while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1858		err = rfcomm_send_frame(d->session, skb->data, skb->len);
1859		if (err < 0) {
1860			skb_queue_head(&d->tx_queue, skb);
1861			break;
1862		}
1863		kfree_skb(skb);
1864		d->tx_credits--;
1865	}
1866
1867	if (d->cfc && !d->tx_credits) {
1868		/* We're out of TX credits.
1869		 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1870		set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1871	}
1872
1873	return skb_queue_len(&d->tx_queue);
1874}
1875
1876static void rfcomm_process_dlcs(struct rfcomm_session *s)
1877{
1878	struct rfcomm_dlc *d, *n;
 
1879
1880	BT_DBG("session %p state %ld", s, s->state);
1881
1882	list_for_each_entry_safe(d, n, &s->dlcs, list) {
 
 
1883		if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1884			__rfcomm_dlc_close(d, ETIMEDOUT);
1885			continue;
1886		}
1887
1888		if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1889			__rfcomm_dlc_close(d, ECONNREFUSED);
1890			continue;
1891		}
1892
1893		if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1894			rfcomm_dlc_clear_timer(d);
1895			if (d->out) {
1896				rfcomm_send_pn(s, 1, d);
1897				rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1898			} else {
1899				if (d->defer_setup) {
1900					set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1901					rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1902
1903					rfcomm_dlc_lock(d);
1904					d->state = BT_CONNECT2;
1905					d->state_change(d, 0);
1906					rfcomm_dlc_unlock(d);
1907				} else
1908					rfcomm_dlc_accept(d);
1909			}
1910			continue;
1911		} else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1912			rfcomm_dlc_clear_timer(d);
1913			if (!d->out)
1914				rfcomm_send_dm(s, d->dlci);
1915			else
1916				d->state = BT_CLOSED;
1917			__rfcomm_dlc_close(d, ECONNREFUSED);
1918			continue;
1919		}
1920
1921		if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1922			continue;
1923
1924		if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1925			continue;
1926
1927		if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1928						d->mscex == RFCOMM_MSCEX_OK)
1929			rfcomm_process_tx(d);
1930	}
1931}
1932
1933static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1934{
1935	struct socket *sock = s->sock;
1936	struct sock *sk = sock->sk;
1937	struct sk_buff *skb;
1938
1939	BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1940
1941	/* Get data directly from socket receive queue without copying it. */
1942	while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1943		skb_orphan(skb);
1944		if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) {
1945			s = rfcomm_recv_frame(s, skb);
1946			if (!s)
1947				break;
1948		} else {
1949			kfree_skb(skb);
1950		}
1951	}
1952
1953	if (s && (sk->sk_state == BT_CLOSED))
1954		s = rfcomm_session_close(s, sk->sk_err);
 
1955
1956	return s;
 
1957}
1958
1959static void rfcomm_accept_connection(struct rfcomm_session *s)
1960{
1961	struct socket *sock = s->sock, *nsock;
1962	int err;
1963
1964	/* Fast check for a new connection.
1965	 * Avoids unnesesary socket allocations. */
1966	if (list_empty(&bt_sk(sock->sk)->accept_q))
1967		return;
1968
1969	BT_DBG("session %p", s);
1970
1971	err = kernel_accept(sock, &nsock, O_NONBLOCK);
1972	if (err < 0)
1973		return;
1974
1975	/* Set our callbacks */
1976	nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1977	nsock->sk->sk_state_change = rfcomm_l2state_change;
1978
1979	s = rfcomm_session_add(nsock, BT_OPEN);
1980	if (s) {
 
 
1981		/* We should adjust MTU on incoming sessions.
1982		 * L2CAP MTU minus UIH header and FCS. */
1983		s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1984				l2cap_pi(nsock->sk)->chan->imtu) - 5;
1985
1986		rfcomm_schedule();
1987	} else
1988		sock_release(nsock);
1989}
1990
1991static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1992{
1993	struct sock *sk = s->sock->sk;
1994
1995	BT_DBG("%p state %ld", s, s->state);
1996
1997	switch (sk->sk_state) {
1998	case BT_CONNECTED:
1999		s->state = BT_CONNECT;
2000
2001		/* We can adjust MTU on outgoing sessions.
2002		 * L2CAP MTU minus UIH header and FCS. */
2003		s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
2004
2005		rfcomm_send_sabm(s, 0);
2006		break;
2007
2008	case BT_CLOSED:
2009		s = rfcomm_session_close(s, sk->sk_err);
 
2010		break;
2011	}
2012	return s;
2013}
2014
2015static void rfcomm_process_sessions(void)
2016{
2017	struct rfcomm_session *s, *n;
2018
2019	rfcomm_lock();
2020
2021	list_for_each_entry_safe(s, n, &session_list, list) {
 
 
 
2022		if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
2023			s->state = BT_DISCONN;
2024			rfcomm_send_disc(s, 0);
 
2025			continue;
2026		}
2027
2028		switch (s->state) {
2029		case BT_LISTEN:
2030			rfcomm_accept_connection(s);
2031			continue;
 
 
 
2032
 
2033		case BT_BOUND:
2034			s = rfcomm_check_connection(s);
2035			break;
2036
2037		default:
2038			s = rfcomm_process_rx(s);
2039			break;
2040		}
2041
2042		if (s)
2043			rfcomm_process_dlcs(s);
 
2044	}
2045
2046	rfcomm_unlock();
2047}
2048
2049static int rfcomm_add_listener(bdaddr_t *ba)
2050{
2051	struct sockaddr_l2 addr;
2052	struct socket *sock;
2053	struct sock *sk;
2054	struct rfcomm_session *s;
2055	int    err = 0;
2056
2057	/* Create socket */
2058	err = rfcomm_l2sock_create(&sock);
2059	if (err < 0) {
2060		BT_ERR("Create socket failed %d", err);
2061		return err;
2062	}
2063
2064	/* Bind socket */
2065	bacpy(&addr.l2_bdaddr, ba);
2066	addr.l2_family = AF_BLUETOOTH;
2067	addr.l2_psm    = cpu_to_le16(L2CAP_PSM_RFCOMM);
2068	addr.l2_cid    = 0;
2069	addr.l2_bdaddr_type = BDADDR_BREDR;
2070	err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
2071	if (err < 0) {
2072		BT_ERR("Bind failed %d", err);
2073		goto failed;
2074	}
2075
2076	/* Set L2CAP options */
2077	sk = sock->sk;
2078	lock_sock(sk);
2079	/* Set MTU to 0 so L2CAP can auto select the MTU */
2080	l2cap_pi(sk)->chan->imtu = 0;
2081	release_sock(sk);
2082
2083	/* Start listening on the socket */
2084	err = kernel_listen(sock, 10);
2085	if (err) {
2086		BT_ERR("Listen failed %d", err);
2087		goto failed;
2088	}
2089
2090	/* Add listening session */
2091	s = rfcomm_session_add(sock, BT_LISTEN);
2092	if (!s) {
2093		err = -ENOMEM;
2094		goto failed;
2095	}
2096
 
2097	return 0;
2098failed:
2099	sock_release(sock);
2100	return err;
2101}
2102
2103static void rfcomm_kill_listener(void)
2104{
2105	struct rfcomm_session *s, *n;
 
2106
2107	BT_DBG("");
2108
2109	list_for_each_entry_safe(s, n, &session_list, list)
 
2110		rfcomm_session_del(s);
 
2111}
2112
2113static int rfcomm_run(void *unused)
2114{
2115	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2116	BT_DBG("");
2117
2118	set_user_nice(current, -10);
2119
2120	rfcomm_add_listener(BDADDR_ANY);
2121
2122	add_wait_queue(&rfcomm_wq, &wait);
2123	while (!kthread_should_stop()) {
 
 
 
2124
2125		/* Process stuff */
2126		rfcomm_process_sessions();
2127
2128		wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2129	}
2130	remove_wait_queue(&rfcomm_wq, &wait);
2131
2132	rfcomm_kill_listener();
2133
2134	return 0;
2135}
2136
2137static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2138{
2139	struct rfcomm_session *s;
2140	struct rfcomm_dlc *d, *n;
 
2141
2142	BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2143
2144	s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2145	if (!s)
2146		return;
2147
2148	list_for_each_entry_safe(d, n, &s->dlcs, list) {
 
 
 
 
2149		if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2150			rfcomm_dlc_clear_timer(d);
2151			if (status || encrypt == 0x00) {
2152				set_bit(RFCOMM_ENC_DROP, &d->flags);
2153				continue;
2154			}
2155		}
2156
2157		if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2158			if (d->sec_level == BT_SECURITY_MEDIUM) {
2159				set_bit(RFCOMM_SEC_PENDING, &d->flags);
2160				rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2161				continue;
2162			} else if (d->sec_level == BT_SECURITY_HIGH ||
2163				   d->sec_level == BT_SECURITY_FIPS) {
2164				set_bit(RFCOMM_ENC_DROP, &d->flags);
2165				continue;
2166			}
2167		}
2168
2169		if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2170			continue;
2171
2172		if (!status && hci_conn_check_secure(conn, d->sec_level))
2173			set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2174		else
2175			set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2176	}
2177
 
 
2178	rfcomm_schedule();
2179}
2180
2181static struct hci_cb rfcomm_cb = {
2182	.name		= "RFCOMM",
2183	.security_cfm	= rfcomm_security_cfm
2184};
2185
2186static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2187{
2188	struct rfcomm_session *s;
2189
2190	rfcomm_lock();
2191
2192	list_for_each_entry(s, &session_list, list) {
2193		struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2194		struct rfcomm_dlc *d;
2195		list_for_each_entry(d, &s->dlcs, list) {
2196			seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2197				   &chan->src, &chan->dst,
2198				   d->state, d->dlci, d->mtu,
2199				   d->rx_credits, d->tx_credits);
 
 
 
2200		}
2201	}
2202
2203	rfcomm_unlock();
2204
2205	return 0;
2206}
2207
2208DEFINE_SHOW_ATTRIBUTE(rfcomm_dlc_debugfs);
 
 
 
 
 
 
 
 
 
 
2209
2210static struct dentry *rfcomm_dlc_debugfs;
2211
2212/* ---- Initialization ---- */
2213static int __init rfcomm_init(void)
2214{
2215	int err;
2216
2217	hci_register_cb(&rfcomm_cb);
2218
2219	rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2220	if (IS_ERR(rfcomm_thread)) {
2221		err = PTR_ERR(rfcomm_thread);
2222		goto unregister;
2223	}
2224
 
 
 
 
 
 
 
2225	err = rfcomm_init_ttys();
2226	if (err < 0)
2227		goto stop;
2228
2229	err = rfcomm_init_sockets();
2230	if (err < 0)
2231		goto cleanup;
2232
2233	BT_INFO("RFCOMM ver %s", VERSION);
2234
2235	if (IS_ERR_OR_NULL(bt_debugfs))
2236		return 0;
2237
2238	rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2239						 bt_debugfs, NULL,
2240						 &rfcomm_dlc_debugfs_fops);
2241
2242	return 0;
2243
2244cleanup:
2245	rfcomm_cleanup_ttys();
2246
2247stop:
2248	kthread_stop(rfcomm_thread);
2249
2250unregister:
2251	hci_unregister_cb(&rfcomm_cb);
2252
2253	return err;
2254}
2255
2256static void __exit rfcomm_exit(void)
2257{
2258	debugfs_remove(rfcomm_dlc_debugfs);
2259
2260	hci_unregister_cb(&rfcomm_cb);
2261
2262	kthread_stop(rfcomm_thread);
2263
2264	rfcomm_cleanup_ttys();
2265
2266	rfcomm_cleanup_sockets();
2267}
2268
2269module_init(rfcomm_init);
2270module_exit(rfcomm_exit);
2271
2272module_param(disable_cfc, bool, 0644);
2273MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2274
2275module_param(channel_mtu, int, 0644);
2276MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
 
 
 
2277
2278module_param(l2cap_ertm, bool, 0644);
2279MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2280
2281MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2282MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2283MODULE_VERSION(VERSION);
2284MODULE_LICENSE("GPL");
2285MODULE_ALIAS("bt-proto-3");