xref: /openbmc/linux/net/bluetooth/rfcomm/core.c (revision c819e2cf)
1 /*
2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5 
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License version 2 as
8    published by the Free Software Foundation;
9 
10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 
19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21    SOFTWARE IS DISCLAIMED.
22 */
23 
24 /*
25  * Bluetooth RFCOMM core.
26  */
27 
28 #include <linux/module.h>
29 #include <linux/debugfs.h>
30 #include <linux/kthread.h>
31 #include <asm/unaligned.h>
32 
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
36 #include <net/bluetooth/rfcomm.h>
37 
38 #define VERSION "1.11"
39 
40 static bool disable_cfc;
41 static bool l2cap_ertm;
42 static int channel_mtu = -1;
43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
44 
45 static struct task_struct *rfcomm_thread;
46 
47 static DEFINE_MUTEX(rfcomm_mutex);
48 #define rfcomm_lock()	mutex_lock(&rfcomm_mutex)
49 #define rfcomm_unlock()	mutex_unlock(&rfcomm_mutex)
50 
51 
52 static LIST_HEAD(session_list);
53 
54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
64 
65 static void rfcomm_process_connect(struct rfcomm_session *s);
66 
67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
68 							bdaddr_t *dst,
69 							u8 sec_level,
70 							int *err);
71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
72 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
73 
74 /* ---- RFCOMM frame parsing macros ---- */
75 #define __get_dlci(b)     ((b & 0xfc) >> 2)
76 #define __get_channel(b)  ((b & 0xf8) >> 3)
77 #define __get_dir(b)      ((b & 0x04) >> 2)
78 #define __get_type(b)     ((b & 0xef))
79 
80 #define __test_ea(b)      ((b & 0x01))
81 #define __test_cr(b)      (!!(b & 0x02))
82 #define __test_pf(b)      (!!(b & 0x10))
83 
84 #define __session_dir(s)  ((s)->initiator ? 0x00 : 0x01)
85 
86 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
87 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
88 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
89 #define __srv_channel(dlci)    (dlci >> 1)
90 #define __dir(dlci)            (dlci & 0x01)
91 
92 #define __len8(len)       (((len) << 1) | 1)
93 #define __len16(len)      ((len) << 1)
94 
95 /* MCC macros */
96 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
97 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
98 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
99 
100 /* RPN macros */
101 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
102 #define __get_rpn_data_bits(line) ((line) & 0x3)
103 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
104 #define __get_rpn_parity(line)    (((line) >> 3) & 0x7)
105 
106 static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
107 
108 static void rfcomm_schedule(void)
109 {
110 	wake_up_all(&rfcomm_wq);
111 }
112 
113 /* ---- RFCOMM FCS computation ---- */
114 
115 /* reversed, 8-bit, poly=0x07 */
116 static unsigned char rfcomm_crc_table[256] = {
117 	0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
118 	0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
119 	0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
120 	0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
121 
122 	0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
123 	0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
124 	0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
125 	0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
126 
127 	0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
128 	0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
129 	0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
130 	0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
131 
132 	0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
133 	0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
134 	0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
135 	0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
136 
137 	0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
138 	0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
139 	0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
140 	0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
141 
142 	0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
143 	0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
144 	0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
145 	0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
146 
147 	0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
148 	0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
149 	0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
150 	0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
151 
152 	0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
153 	0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
154 	0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
155 	0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
156 };
157 
158 /* CRC on 2 bytes */
159 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
160 
161 /* FCS on 2 bytes */
162 static inline u8 __fcs(u8 *data)
163 {
164 	return 0xff - __crc(data);
165 }
166 
167 /* FCS on 3 bytes */
168 static inline u8 __fcs2(u8 *data)
169 {
170 	return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
171 }
172 
173 /* Check FCS */
174 static inline int __check_fcs(u8 *data, int type, u8 fcs)
175 {
176 	u8 f = __crc(data);
177 
178 	if (type != RFCOMM_UIH)
179 		f = rfcomm_crc_table[f ^ data[2]];
180 
181 	return rfcomm_crc_table[f ^ fcs] != 0xcf;
182 }
183 
184 /* ---- L2CAP callbacks ---- */
185 static void rfcomm_l2state_change(struct sock *sk)
186 {
187 	BT_DBG("%p state %d", sk, sk->sk_state);
188 	rfcomm_schedule();
189 }
190 
191 static void rfcomm_l2data_ready(struct sock *sk)
192 {
193 	BT_DBG("%p", sk);
194 	rfcomm_schedule();
195 }
196 
197 static int rfcomm_l2sock_create(struct socket **sock)
198 {
199 	int err;
200 
201 	BT_DBG("");
202 
203 	err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
204 	if (!err) {
205 		struct sock *sk = (*sock)->sk;
206 		sk->sk_data_ready   = rfcomm_l2data_ready;
207 		sk->sk_state_change = rfcomm_l2state_change;
208 	}
209 	return err;
210 }
211 
212 static int rfcomm_check_security(struct rfcomm_dlc *d)
213 {
214 	struct sock *sk = d->session->sock->sk;
215 	struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
216 
217 	__u8 auth_type;
218 
219 	switch (d->sec_level) {
220 	case BT_SECURITY_HIGH:
221 	case BT_SECURITY_FIPS:
222 		auth_type = HCI_AT_GENERAL_BONDING_MITM;
223 		break;
224 	case BT_SECURITY_MEDIUM:
225 		auth_type = HCI_AT_GENERAL_BONDING;
226 		break;
227 	default:
228 		auth_type = HCI_AT_NO_BONDING;
229 		break;
230 	}
231 
232 	return hci_conn_security(conn->hcon, d->sec_level, auth_type,
233 				 d->out);
234 }
235 
236 static void rfcomm_session_timeout(unsigned long arg)
237 {
238 	struct rfcomm_session *s = (void *) arg;
239 
240 	BT_DBG("session %p state %ld", s, s->state);
241 
242 	set_bit(RFCOMM_TIMED_OUT, &s->flags);
243 	rfcomm_schedule();
244 }
245 
246 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
247 {
248 	BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
249 
250 	mod_timer(&s->timer, jiffies + timeout);
251 }
252 
253 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
254 {
255 	BT_DBG("session %p state %ld", s, s->state);
256 
257 	del_timer_sync(&s->timer);
258 }
259 
260 /* ---- RFCOMM DLCs ---- */
261 static void rfcomm_dlc_timeout(unsigned long arg)
262 {
263 	struct rfcomm_dlc *d = (void *) arg;
264 
265 	BT_DBG("dlc %p state %ld", d, d->state);
266 
267 	set_bit(RFCOMM_TIMED_OUT, &d->flags);
268 	rfcomm_dlc_put(d);
269 	rfcomm_schedule();
270 }
271 
272 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
273 {
274 	BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
275 
276 	if (!mod_timer(&d->timer, jiffies + timeout))
277 		rfcomm_dlc_hold(d);
278 }
279 
280 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
281 {
282 	BT_DBG("dlc %p state %ld", d, d->state);
283 
284 	if (del_timer(&d->timer))
285 		rfcomm_dlc_put(d);
286 }
287 
288 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
289 {
290 	BT_DBG("%p", d);
291 
292 	d->state      = BT_OPEN;
293 	d->flags      = 0;
294 	d->mscex      = 0;
295 	d->sec_level  = BT_SECURITY_LOW;
296 	d->mtu        = RFCOMM_DEFAULT_MTU;
297 	d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
298 
299 	d->cfc        = RFCOMM_CFC_DISABLED;
300 	d->rx_credits = RFCOMM_DEFAULT_CREDITS;
301 }
302 
303 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
304 {
305 	struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
306 
307 	if (!d)
308 		return NULL;
309 
310 	setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
311 
312 	skb_queue_head_init(&d->tx_queue);
313 	mutex_init(&d->lock);
314 	atomic_set(&d->refcnt, 1);
315 
316 	rfcomm_dlc_clear_state(d);
317 
318 	BT_DBG("%p", d);
319 
320 	return d;
321 }
322 
323 void rfcomm_dlc_free(struct rfcomm_dlc *d)
324 {
325 	BT_DBG("%p", d);
326 
327 	skb_queue_purge(&d->tx_queue);
328 	kfree(d);
329 }
330 
331 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
332 {
333 	BT_DBG("dlc %p session %p", d, s);
334 
335 	rfcomm_session_clear_timer(s);
336 	rfcomm_dlc_hold(d);
337 	list_add(&d->list, &s->dlcs);
338 	d->session = s;
339 }
340 
341 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
342 {
343 	struct rfcomm_session *s = d->session;
344 
345 	BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
346 
347 	list_del(&d->list);
348 	d->session = NULL;
349 	rfcomm_dlc_put(d);
350 
351 	if (list_empty(&s->dlcs))
352 		rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
353 }
354 
355 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
356 {
357 	struct rfcomm_dlc *d;
358 
359 	list_for_each_entry(d, &s->dlcs, list)
360 		if (d->dlci == dlci)
361 			return d;
362 
363 	return NULL;
364 }
365 
366 static int rfcomm_check_channel(u8 channel)
367 {
368 	return channel < 1 || channel > 30;
369 }
370 
371 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
372 {
373 	struct rfcomm_session *s;
374 	int err = 0;
375 	u8 dlci;
376 
377 	BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
378 	       d, d->state, src, dst, channel);
379 
380 	if (rfcomm_check_channel(channel))
381 		return -EINVAL;
382 
383 	if (d->state != BT_OPEN && d->state != BT_CLOSED)
384 		return 0;
385 
386 	s = rfcomm_session_get(src, dst);
387 	if (!s) {
388 		s = rfcomm_session_create(src, dst, d->sec_level, &err);
389 		if (!s)
390 			return err;
391 	}
392 
393 	dlci = __dlci(__session_dir(s), channel);
394 
395 	/* Check if DLCI already exists */
396 	if (rfcomm_dlc_get(s, dlci))
397 		return -EBUSY;
398 
399 	rfcomm_dlc_clear_state(d);
400 
401 	d->dlci     = dlci;
402 	d->addr     = __addr(s->initiator, dlci);
403 	d->priority = 7;
404 
405 	d->state = BT_CONFIG;
406 	rfcomm_dlc_link(s, d);
407 
408 	d->out = 1;
409 
410 	d->mtu = s->mtu;
411 	d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
412 
413 	if (s->state == BT_CONNECTED) {
414 		if (rfcomm_check_security(d))
415 			rfcomm_send_pn(s, 1, d);
416 		else
417 			set_bit(RFCOMM_AUTH_PENDING, &d->flags);
418 	}
419 
420 	rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
421 
422 	return 0;
423 }
424 
425 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
426 {
427 	int r;
428 
429 	rfcomm_lock();
430 
431 	r = __rfcomm_dlc_open(d, src, dst, channel);
432 
433 	rfcomm_unlock();
434 	return r;
435 }
436 
437 static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
438 {
439 	struct rfcomm_session *s = d->session;
440 
441 	d->state = BT_DISCONN;
442 	if (skb_queue_empty(&d->tx_queue)) {
443 		rfcomm_send_disc(s, d->dlci);
444 		rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
445 	} else {
446 		rfcomm_queue_disc(d);
447 		rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
448 	}
449 }
450 
451 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
452 {
453 	struct rfcomm_session *s = d->session;
454 	if (!s)
455 		return 0;
456 
457 	BT_DBG("dlc %p state %ld dlci %d err %d session %p",
458 			d, d->state, d->dlci, err, s);
459 
460 	switch (d->state) {
461 	case BT_CONNECT:
462 	case BT_CONFIG:
463 	case BT_OPEN:
464 	case BT_CONNECT2:
465 		if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
466 			set_bit(RFCOMM_AUTH_REJECT, &d->flags);
467 			rfcomm_schedule();
468 			return 0;
469 		}
470 	}
471 
472 	switch (d->state) {
473 	case BT_CONNECT:
474 	case BT_CONNECTED:
475 		__rfcomm_dlc_disconn(d);
476 		break;
477 
478 	case BT_CONFIG:
479 		if (s->state != BT_BOUND) {
480 			__rfcomm_dlc_disconn(d);
481 			break;
482 		}
483 		/* if closing a dlc in a session that hasn't been started,
484 		 * just close and unlink the dlc
485 		 */
486 
487 	default:
488 		rfcomm_dlc_clear_timer(d);
489 
490 		rfcomm_dlc_lock(d);
491 		d->state = BT_CLOSED;
492 		d->state_change(d, err);
493 		rfcomm_dlc_unlock(d);
494 
495 		skb_queue_purge(&d->tx_queue);
496 		rfcomm_dlc_unlink(d);
497 	}
498 
499 	return 0;
500 }
501 
502 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
503 {
504 	int r = 0;
505 	struct rfcomm_dlc *d_list;
506 	struct rfcomm_session *s, *s_list;
507 
508 	BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
509 
510 	rfcomm_lock();
511 
512 	s = d->session;
513 	if (!s)
514 		goto no_session;
515 
516 	/* after waiting on the mutex check the session still exists
517 	 * then check the dlc still exists
518 	 */
519 	list_for_each_entry(s_list, &session_list, list) {
520 		if (s_list == s) {
521 			list_for_each_entry(d_list, &s->dlcs, list) {
522 				if (d_list == d) {
523 					r = __rfcomm_dlc_close(d, err);
524 					break;
525 				}
526 			}
527 			break;
528 		}
529 	}
530 
531 no_session:
532 	rfcomm_unlock();
533 	return r;
534 }
535 
536 struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
537 {
538 	struct rfcomm_session *s;
539 	struct rfcomm_dlc *dlc = NULL;
540 	u8 dlci;
541 
542 	if (rfcomm_check_channel(channel))
543 		return ERR_PTR(-EINVAL);
544 
545 	rfcomm_lock();
546 	s = rfcomm_session_get(src, dst);
547 	if (s) {
548 		dlci = __dlci(__session_dir(s), channel);
549 		dlc = rfcomm_dlc_get(s, dlci);
550 	}
551 	rfcomm_unlock();
552 	return dlc;
553 }
554 
555 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
556 {
557 	int len = skb->len;
558 
559 	if (d->state != BT_CONNECTED)
560 		return -ENOTCONN;
561 
562 	BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
563 
564 	if (len > d->mtu)
565 		return -EINVAL;
566 
567 	rfcomm_make_uih(skb, d->addr);
568 	skb_queue_tail(&d->tx_queue, skb);
569 
570 	if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
571 		rfcomm_schedule();
572 	return len;
573 }
574 
575 void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
576 {
577 	int len = skb->len;
578 
579 	BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
580 
581 	rfcomm_make_uih(skb, d->addr);
582 	skb_queue_tail(&d->tx_queue, skb);
583 
584 	if (d->state == BT_CONNECTED &&
585 	    !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
586 		rfcomm_schedule();
587 }
588 
589 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
590 {
591 	BT_DBG("dlc %p state %ld", d, d->state);
592 
593 	if (!d->cfc) {
594 		d->v24_sig |= RFCOMM_V24_FC;
595 		set_bit(RFCOMM_MSC_PENDING, &d->flags);
596 	}
597 	rfcomm_schedule();
598 }
599 
600 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
601 {
602 	BT_DBG("dlc %p state %ld", d, d->state);
603 
604 	if (!d->cfc) {
605 		d->v24_sig &= ~RFCOMM_V24_FC;
606 		set_bit(RFCOMM_MSC_PENDING, &d->flags);
607 	}
608 	rfcomm_schedule();
609 }
610 
611 /*
612    Set/get modem status functions use _local_ status i.e. what we report
613    to the other side.
614    Remote status is provided by dlc->modem_status() callback.
615  */
616 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
617 {
618 	BT_DBG("dlc %p state %ld v24_sig 0x%x",
619 			d, d->state, v24_sig);
620 
621 	if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
622 		v24_sig |= RFCOMM_V24_FC;
623 	else
624 		v24_sig &= ~RFCOMM_V24_FC;
625 
626 	d->v24_sig = v24_sig;
627 
628 	if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
629 		rfcomm_schedule();
630 
631 	return 0;
632 }
633 
634 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
635 {
636 	BT_DBG("dlc %p state %ld v24_sig 0x%x",
637 			d, d->state, d->v24_sig);
638 
639 	*v24_sig = d->v24_sig;
640 	return 0;
641 }
642 
643 /* ---- RFCOMM sessions ---- */
644 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
645 {
646 	struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
647 
648 	if (!s)
649 		return NULL;
650 
651 	BT_DBG("session %p sock %p", s, sock);
652 
653 	setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
654 
655 	INIT_LIST_HEAD(&s->dlcs);
656 	s->state = state;
657 	s->sock  = sock;
658 
659 	s->mtu = RFCOMM_DEFAULT_MTU;
660 	s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
661 
662 	/* Do not increment module usage count for listening sessions.
663 	 * Otherwise we won't be able to unload the module. */
664 	if (state != BT_LISTEN)
665 		if (!try_module_get(THIS_MODULE)) {
666 			kfree(s);
667 			return NULL;
668 		}
669 
670 	list_add(&s->list, &session_list);
671 
672 	return s;
673 }
674 
675 static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
676 {
677 	int state = s->state;
678 
679 	BT_DBG("session %p state %ld", s, s->state);
680 
681 	list_del(&s->list);
682 
683 	rfcomm_session_clear_timer(s);
684 	sock_release(s->sock);
685 	kfree(s);
686 
687 	if (state != BT_LISTEN)
688 		module_put(THIS_MODULE);
689 
690 	return NULL;
691 }
692 
693 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
694 {
695 	struct rfcomm_session *s;
696 	struct list_head *p, *n;
697 	struct l2cap_chan *chan;
698 	list_for_each_safe(p, n, &session_list) {
699 		s = list_entry(p, struct rfcomm_session, list);
700 		chan = l2cap_pi(s->sock->sk)->chan;
701 
702 		if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
703 		    !bacmp(&chan->dst, dst))
704 			return s;
705 	}
706 	return NULL;
707 }
708 
709 static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
710 						   int err)
711 {
712 	struct rfcomm_dlc *d;
713 	struct list_head *p, *n;
714 
715 	s->state = BT_CLOSED;
716 
717 	BT_DBG("session %p state %ld err %d", s, s->state, err);
718 
719 	/* Close all dlcs */
720 	list_for_each_safe(p, n, &s->dlcs) {
721 		d = list_entry(p, struct rfcomm_dlc, list);
722 		d->state = BT_CLOSED;
723 		__rfcomm_dlc_close(d, err);
724 	}
725 
726 	rfcomm_session_clear_timer(s);
727 	return rfcomm_session_del(s);
728 }
729 
730 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
731 							bdaddr_t *dst,
732 							u8 sec_level,
733 							int *err)
734 {
735 	struct rfcomm_session *s = NULL;
736 	struct sockaddr_l2 addr;
737 	struct socket *sock;
738 	struct sock *sk;
739 
740 	BT_DBG("%pMR -> %pMR", src, dst);
741 
742 	*err = rfcomm_l2sock_create(&sock);
743 	if (*err < 0)
744 		return NULL;
745 
746 	bacpy(&addr.l2_bdaddr, src);
747 	addr.l2_family = AF_BLUETOOTH;
748 	addr.l2_psm    = 0;
749 	addr.l2_cid    = 0;
750 	addr.l2_bdaddr_type = BDADDR_BREDR;
751 	*err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
752 	if (*err < 0)
753 		goto failed;
754 
755 	/* Set L2CAP options */
756 	sk = sock->sk;
757 	lock_sock(sk);
758 	l2cap_pi(sk)->chan->imtu = l2cap_mtu;
759 	l2cap_pi(sk)->chan->sec_level = sec_level;
760 	if (l2cap_ertm)
761 		l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
762 	release_sock(sk);
763 
764 	s = rfcomm_session_add(sock, BT_BOUND);
765 	if (!s) {
766 		*err = -ENOMEM;
767 		goto failed;
768 	}
769 
770 	s->initiator = 1;
771 
772 	bacpy(&addr.l2_bdaddr, dst);
773 	addr.l2_family = AF_BLUETOOTH;
774 	addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
775 	addr.l2_cid    = 0;
776 	addr.l2_bdaddr_type = BDADDR_BREDR;
777 	*err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
778 	if (*err == 0 || *err == -EINPROGRESS)
779 		return s;
780 
781 	return rfcomm_session_del(s);
782 
783 failed:
784 	sock_release(sock);
785 	return NULL;
786 }
787 
788 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
789 {
790 	struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
791 	if (src)
792 		bacpy(src, &chan->src);
793 	if (dst)
794 		bacpy(dst, &chan->dst);
795 }
796 
797 /* ---- RFCOMM frame sending ---- */
798 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
799 {
800 	struct kvec iv = { data, len };
801 	struct msghdr msg;
802 
803 	BT_DBG("session %p len %d", s, len);
804 
805 	memset(&msg, 0, sizeof(msg));
806 
807 	return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
808 }
809 
810 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
811 {
812 	BT_DBG("%p cmd %u", s, cmd->ctrl);
813 
814 	return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
815 }
816 
817 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
818 {
819 	struct rfcomm_cmd cmd;
820 
821 	BT_DBG("%p dlci %d", s, dlci);
822 
823 	cmd.addr = __addr(s->initiator, dlci);
824 	cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
825 	cmd.len  = __len8(0);
826 	cmd.fcs  = __fcs2((u8 *) &cmd);
827 
828 	return rfcomm_send_cmd(s, &cmd);
829 }
830 
831 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
832 {
833 	struct rfcomm_cmd cmd;
834 
835 	BT_DBG("%p dlci %d", s, dlci);
836 
837 	cmd.addr = __addr(!s->initiator, dlci);
838 	cmd.ctrl = __ctrl(RFCOMM_UA, 1);
839 	cmd.len  = __len8(0);
840 	cmd.fcs  = __fcs2((u8 *) &cmd);
841 
842 	return rfcomm_send_cmd(s, &cmd);
843 }
844 
845 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
846 {
847 	struct rfcomm_cmd cmd;
848 
849 	BT_DBG("%p dlci %d", s, dlci);
850 
851 	cmd.addr = __addr(s->initiator, dlci);
852 	cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
853 	cmd.len  = __len8(0);
854 	cmd.fcs  = __fcs2((u8 *) &cmd);
855 
856 	return rfcomm_send_cmd(s, &cmd);
857 }
858 
859 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
860 {
861 	struct rfcomm_cmd *cmd;
862 	struct sk_buff *skb;
863 
864 	BT_DBG("dlc %p dlci %d", d, d->dlci);
865 
866 	skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
867 	if (!skb)
868 		return -ENOMEM;
869 
870 	cmd = (void *) __skb_put(skb, sizeof(*cmd));
871 	cmd->addr = d->addr;
872 	cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
873 	cmd->len  = __len8(0);
874 	cmd->fcs  = __fcs2((u8 *) cmd);
875 
876 	skb_queue_tail(&d->tx_queue, skb);
877 	rfcomm_schedule();
878 	return 0;
879 }
880 
881 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
882 {
883 	struct rfcomm_cmd cmd;
884 
885 	BT_DBG("%p dlci %d", s, dlci);
886 
887 	cmd.addr = __addr(!s->initiator, dlci);
888 	cmd.ctrl = __ctrl(RFCOMM_DM, 1);
889 	cmd.len  = __len8(0);
890 	cmd.fcs  = __fcs2((u8 *) &cmd);
891 
892 	return rfcomm_send_cmd(s, &cmd);
893 }
894 
895 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
896 {
897 	struct rfcomm_hdr *hdr;
898 	struct rfcomm_mcc *mcc;
899 	u8 buf[16], *ptr = buf;
900 
901 	BT_DBG("%p cr %d type %d", s, cr, type);
902 
903 	hdr = (void *) ptr; ptr += sizeof(*hdr);
904 	hdr->addr = __addr(s->initiator, 0);
905 	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
906 	hdr->len  = __len8(sizeof(*mcc) + 1);
907 
908 	mcc = (void *) ptr; ptr += sizeof(*mcc);
909 	mcc->type = __mcc_type(0, RFCOMM_NSC);
910 	mcc->len  = __len8(1);
911 
912 	/* Type that we didn't like */
913 	*ptr = __mcc_type(cr, type); ptr++;
914 
915 	*ptr = __fcs(buf); ptr++;
916 
917 	return rfcomm_send_frame(s, buf, ptr - buf);
918 }
919 
920 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
921 {
922 	struct rfcomm_hdr *hdr;
923 	struct rfcomm_mcc *mcc;
924 	struct rfcomm_pn  *pn;
925 	u8 buf[16], *ptr = buf;
926 
927 	BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
928 
929 	hdr = (void *) ptr; ptr += sizeof(*hdr);
930 	hdr->addr = __addr(s->initiator, 0);
931 	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
932 	hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
933 
934 	mcc = (void *) ptr; ptr += sizeof(*mcc);
935 	mcc->type = __mcc_type(cr, RFCOMM_PN);
936 	mcc->len  = __len8(sizeof(*pn));
937 
938 	pn = (void *) ptr; ptr += sizeof(*pn);
939 	pn->dlci        = d->dlci;
940 	pn->priority    = d->priority;
941 	pn->ack_timer   = 0;
942 	pn->max_retrans = 0;
943 
944 	if (s->cfc) {
945 		pn->flow_ctrl = cr ? 0xf0 : 0xe0;
946 		pn->credits = RFCOMM_DEFAULT_CREDITS;
947 	} else {
948 		pn->flow_ctrl = 0;
949 		pn->credits   = 0;
950 	}
951 
952 	if (cr && channel_mtu >= 0)
953 		pn->mtu = cpu_to_le16(channel_mtu);
954 	else
955 		pn->mtu = cpu_to_le16(d->mtu);
956 
957 	*ptr = __fcs(buf); ptr++;
958 
959 	return rfcomm_send_frame(s, buf, ptr - buf);
960 }
961 
962 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
963 			u8 bit_rate, u8 data_bits, u8 stop_bits,
964 			u8 parity, u8 flow_ctrl_settings,
965 			u8 xon_char, u8 xoff_char, u16 param_mask)
966 {
967 	struct rfcomm_hdr *hdr;
968 	struct rfcomm_mcc *mcc;
969 	struct rfcomm_rpn *rpn;
970 	u8 buf[16], *ptr = buf;
971 
972 	BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
973 			" flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
974 		s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
975 		flow_ctrl_settings, xon_char, xoff_char, param_mask);
976 
977 	hdr = (void *) ptr; ptr += sizeof(*hdr);
978 	hdr->addr = __addr(s->initiator, 0);
979 	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
980 	hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
981 
982 	mcc = (void *) ptr; ptr += sizeof(*mcc);
983 	mcc->type = __mcc_type(cr, RFCOMM_RPN);
984 	mcc->len  = __len8(sizeof(*rpn));
985 
986 	rpn = (void *) ptr; ptr += sizeof(*rpn);
987 	rpn->dlci          = __addr(1, dlci);
988 	rpn->bit_rate      = bit_rate;
989 	rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
990 	rpn->flow_ctrl     = flow_ctrl_settings;
991 	rpn->xon_char      = xon_char;
992 	rpn->xoff_char     = xoff_char;
993 	rpn->param_mask    = cpu_to_le16(param_mask);
994 
995 	*ptr = __fcs(buf); ptr++;
996 
997 	return rfcomm_send_frame(s, buf, ptr - buf);
998 }
999 
1000 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
1001 {
1002 	struct rfcomm_hdr *hdr;
1003 	struct rfcomm_mcc *mcc;
1004 	struct rfcomm_rls *rls;
1005 	u8 buf[16], *ptr = buf;
1006 
1007 	BT_DBG("%p cr %d status 0x%x", s, cr, status);
1008 
1009 	hdr = (void *) ptr; ptr += sizeof(*hdr);
1010 	hdr->addr = __addr(s->initiator, 0);
1011 	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1012 	hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
1013 
1014 	mcc = (void *) ptr; ptr += sizeof(*mcc);
1015 	mcc->type = __mcc_type(cr, RFCOMM_RLS);
1016 	mcc->len  = __len8(sizeof(*rls));
1017 
1018 	rls = (void *) ptr; ptr += sizeof(*rls);
1019 	rls->dlci   = __addr(1, dlci);
1020 	rls->status = status;
1021 
1022 	*ptr = __fcs(buf); ptr++;
1023 
1024 	return rfcomm_send_frame(s, buf, ptr - buf);
1025 }
1026 
1027 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1028 {
1029 	struct rfcomm_hdr *hdr;
1030 	struct rfcomm_mcc *mcc;
1031 	struct rfcomm_msc *msc;
1032 	u8 buf[16], *ptr = buf;
1033 
1034 	BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1035 
1036 	hdr = (void *) ptr; ptr += sizeof(*hdr);
1037 	hdr->addr = __addr(s->initiator, 0);
1038 	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1039 	hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
1040 
1041 	mcc = (void *) ptr; ptr += sizeof(*mcc);
1042 	mcc->type = __mcc_type(cr, RFCOMM_MSC);
1043 	mcc->len  = __len8(sizeof(*msc));
1044 
1045 	msc = (void *) ptr; ptr += sizeof(*msc);
1046 	msc->dlci    = __addr(1, dlci);
1047 	msc->v24_sig = v24_sig | 0x01;
1048 
1049 	*ptr = __fcs(buf); ptr++;
1050 
1051 	return rfcomm_send_frame(s, buf, ptr - buf);
1052 }
1053 
1054 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1055 {
1056 	struct rfcomm_hdr *hdr;
1057 	struct rfcomm_mcc *mcc;
1058 	u8 buf[16], *ptr = buf;
1059 
1060 	BT_DBG("%p cr %d", s, cr);
1061 
1062 	hdr = (void *) ptr; ptr += sizeof(*hdr);
1063 	hdr->addr = __addr(s->initiator, 0);
1064 	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1065 	hdr->len  = __len8(sizeof(*mcc));
1066 
1067 	mcc = (void *) ptr; ptr += sizeof(*mcc);
1068 	mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1069 	mcc->len  = __len8(0);
1070 
1071 	*ptr = __fcs(buf); ptr++;
1072 
1073 	return rfcomm_send_frame(s, buf, ptr - buf);
1074 }
1075 
1076 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1077 {
1078 	struct rfcomm_hdr *hdr;
1079 	struct rfcomm_mcc *mcc;
1080 	u8 buf[16], *ptr = buf;
1081 
1082 	BT_DBG("%p cr %d", s, cr);
1083 
1084 	hdr = (void *) ptr; ptr += sizeof(*hdr);
1085 	hdr->addr = __addr(s->initiator, 0);
1086 	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1087 	hdr->len  = __len8(sizeof(*mcc));
1088 
1089 	mcc = (void *) ptr; ptr += sizeof(*mcc);
1090 	mcc->type = __mcc_type(cr, RFCOMM_FCON);
1091 	mcc->len  = __len8(0);
1092 
1093 	*ptr = __fcs(buf); ptr++;
1094 
1095 	return rfcomm_send_frame(s, buf, ptr - buf);
1096 }
1097 
1098 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1099 {
1100 	struct socket *sock = s->sock;
1101 	struct kvec iv[3];
1102 	struct msghdr msg;
1103 	unsigned char hdr[5], crc[1];
1104 
1105 	if (len > 125)
1106 		return -EINVAL;
1107 
1108 	BT_DBG("%p cr %d", s, cr);
1109 
1110 	hdr[0] = __addr(s->initiator, 0);
1111 	hdr[1] = __ctrl(RFCOMM_UIH, 0);
1112 	hdr[2] = 0x01 | ((len + 2) << 1);
1113 	hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1114 	hdr[4] = 0x01 | (len << 1);
1115 
1116 	crc[0] = __fcs(hdr);
1117 
1118 	iv[0].iov_base = hdr;
1119 	iv[0].iov_len  = 5;
1120 	iv[1].iov_base = pattern;
1121 	iv[1].iov_len  = len;
1122 	iv[2].iov_base = crc;
1123 	iv[2].iov_len  = 1;
1124 
1125 	memset(&msg, 0, sizeof(msg));
1126 
1127 	return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1128 }
1129 
1130 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1131 {
1132 	struct rfcomm_hdr *hdr;
1133 	u8 buf[16], *ptr = buf;
1134 
1135 	BT_DBG("%p addr %d credits %d", s, addr, credits);
1136 
1137 	hdr = (void *) ptr; ptr += sizeof(*hdr);
1138 	hdr->addr = addr;
1139 	hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1140 	hdr->len  = __len8(0);
1141 
1142 	*ptr = credits; ptr++;
1143 
1144 	*ptr = __fcs(buf); ptr++;
1145 
1146 	return rfcomm_send_frame(s, buf, ptr - buf);
1147 }
1148 
1149 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1150 {
1151 	struct rfcomm_hdr *hdr;
1152 	int len = skb->len;
1153 	u8 *crc;
1154 
1155 	if (len > 127) {
1156 		hdr = (void *) skb_push(skb, 4);
1157 		put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1158 	} else {
1159 		hdr = (void *) skb_push(skb, 3);
1160 		hdr->len = __len8(len);
1161 	}
1162 	hdr->addr = addr;
1163 	hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1164 
1165 	crc = skb_put(skb, 1);
1166 	*crc = __fcs((void *) hdr);
1167 }
1168 
1169 /* ---- RFCOMM frame reception ---- */
1170 static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1171 {
1172 	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1173 
1174 	if (dlci) {
1175 		/* Data channel */
1176 		struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1177 		if (!d) {
1178 			rfcomm_send_dm(s, dlci);
1179 			return s;
1180 		}
1181 
1182 		switch (d->state) {
1183 		case BT_CONNECT:
1184 			rfcomm_dlc_clear_timer(d);
1185 
1186 			rfcomm_dlc_lock(d);
1187 			d->state = BT_CONNECTED;
1188 			d->state_change(d, 0);
1189 			rfcomm_dlc_unlock(d);
1190 
1191 			rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1192 			break;
1193 
1194 		case BT_DISCONN:
1195 			d->state = BT_CLOSED;
1196 			__rfcomm_dlc_close(d, 0);
1197 
1198 			if (list_empty(&s->dlcs)) {
1199 				s->state = BT_DISCONN;
1200 				rfcomm_send_disc(s, 0);
1201 				rfcomm_session_clear_timer(s);
1202 			}
1203 
1204 			break;
1205 		}
1206 	} else {
1207 		/* Control channel */
1208 		switch (s->state) {
1209 		case BT_CONNECT:
1210 			s->state = BT_CONNECTED;
1211 			rfcomm_process_connect(s);
1212 			break;
1213 
1214 		case BT_DISCONN:
1215 			s = rfcomm_session_close(s, ECONNRESET);
1216 			break;
1217 		}
1218 	}
1219 	return s;
1220 }
1221 
1222 static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1223 {
1224 	int err = 0;
1225 
1226 	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1227 
1228 	if (dlci) {
1229 		/* Data DLC */
1230 		struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1231 		if (d) {
1232 			if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1233 				err = ECONNREFUSED;
1234 			else
1235 				err = ECONNRESET;
1236 
1237 			d->state = BT_CLOSED;
1238 			__rfcomm_dlc_close(d, err);
1239 		}
1240 	} else {
1241 		if (s->state == BT_CONNECT)
1242 			err = ECONNREFUSED;
1243 		else
1244 			err = ECONNRESET;
1245 
1246 		s = rfcomm_session_close(s, err);
1247 	}
1248 	return s;
1249 }
1250 
1251 static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1252 					       u8 dlci)
1253 {
1254 	int err = 0;
1255 
1256 	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1257 
1258 	if (dlci) {
1259 		struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1260 		if (d) {
1261 			rfcomm_send_ua(s, dlci);
1262 
1263 			if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1264 				err = ECONNREFUSED;
1265 			else
1266 				err = ECONNRESET;
1267 
1268 			d->state = BT_CLOSED;
1269 			__rfcomm_dlc_close(d, err);
1270 		} else
1271 			rfcomm_send_dm(s, dlci);
1272 
1273 	} else {
1274 		rfcomm_send_ua(s, 0);
1275 
1276 		if (s->state == BT_CONNECT)
1277 			err = ECONNREFUSED;
1278 		else
1279 			err = ECONNRESET;
1280 
1281 		s = rfcomm_session_close(s, err);
1282 	}
1283 	return s;
1284 }
1285 
1286 void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1287 {
1288 	struct sock *sk = d->session->sock->sk;
1289 	struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1290 
1291 	BT_DBG("dlc %p", d);
1292 
1293 	rfcomm_send_ua(d->session, d->dlci);
1294 
1295 	rfcomm_dlc_clear_timer(d);
1296 
1297 	rfcomm_dlc_lock(d);
1298 	d->state = BT_CONNECTED;
1299 	d->state_change(d, 0);
1300 	rfcomm_dlc_unlock(d);
1301 
1302 	if (d->role_switch)
1303 		hci_conn_switch_role(conn->hcon, 0x00);
1304 
1305 	rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1306 }
1307 
1308 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1309 {
1310 	if (rfcomm_check_security(d)) {
1311 		if (d->defer_setup) {
1312 			set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1313 			rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1314 
1315 			rfcomm_dlc_lock(d);
1316 			d->state = BT_CONNECT2;
1317 			d->state_change(d, 0);
1318 			rfcomm_dlc_unlock(d);
1319 		} else
1320 			rfcomm_dlc_accept(d);
1321 	} else {
1322 		set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1323 		rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1324 	}
1325 }
1326 
1327 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1328 {
1329 	struct rfcomm_dlc *d;
1330 	u8 channel;
1331 
1332 	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1333 
1334 	if (!dlci) {
1335 		rfcomm_send_ua(s, 0);
1336 
1337 		if (s->state == BT_OPEN) {
1338 			s->state = BT_CONNECTED;
1339 			rfcomm_process_connect(s);
1340 		}
1341 		return 0;
1342 	}
1343 
1344 	/* Check if DLC exists */
1345 	d = rfcomm_dlc_get(s, dlci);
1346 	if (d) {
1347 		if (d->state == BT_OPEN) {
1348 			/* DLC was previously opened by PN request */
1349 			rfcomm_check_accept(d);
1350 		}
1351 		return 0;
1352 	}
1353 
1354 	/* Notify socket layer about incoming connection */
1355 	channel = __srv_channel(dlci);
1356 	if (rfcomm_connect_ind(s, channel, &d)) {
1357 		d->dlci = dlci;
1358 		d->addr = __addr(s->initiator, dlci);
1359 		rfcomm_dlc_link(s, d);
1360 
1361 		rfcomm_check_accept(d);
1362 	} else {
1363 		rfcomm_send_dm(s, dlci);
1364 	}
1365 
1366 	return 0;
1367 }
1368 
1369 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1370 {
1371 	struct rfcomm_session *s = d->session;
1372 
1373 	BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1374 			d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1375 
1376 	if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1377 						pn->flow_ctrl == 0xe0) {
1378 		d->cfc = RFCOMM_CFC_ENABLED;
1379 		d->tx_credits = pn->credits;
1380 	} else {
1381 		d->cfc = RFCOMM_CFC_DISABLED;
1382 		set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1383 	}
1384 
1385 	if (s->cfc == RFCOMM_CFC_UNKNOWN)
1386 		s->cfc = d->cfc;
1387 
1388 	d->priority = pn->priority;
1389 
1390 	d->mtu = __le16_to_cpu(pn->mtu);
1391 
1392 	if (cr && d->mtu > s->mtu)
1393 		d->mtu = s->mtu;
1394 
1395 	return 0;
1396 }
1397 
1398 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1399 {
1400 	struct rfcomm_pn *pn = (void *) skb->data;
1401 	struct rfcomm_dlc *d;
1402 	u8 dlci = pn->dlci;
1403 
1404 	BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1405 
1406 	if (!dlci)
1407 		return 0;
1408 
1409 	d = rfcomm_dlc_get(s, dlci);
1410 	if (d) {
1411 		if (cr) {
1412 			/* PN request */
1413 			rfcomm_apply_pn(d, cr, pn);
1414 			rfcomm_send_pn(s, 0, d);
1415 		} else {
1416 			/* PN response */
1417 			switch (d->state) {
1418 			case BT_CONFIG:
1419 				rfcomm_apply_pn(d, cr, pn);
1420 
1421 				d->state = BT_CONNECT;
1422 				rfcomm_send_sabm(s, d->dlci);
1423 				break;
1424 			}
1425 		}
1426 	} else {
1427 		u8 channel = __srv_channel(dlci);
1428 
1429 		if (!cr)
1430 			return 0;
1431 
1432 		/* PN request for non existing DLC.
1433 		 * Assume incoming connection. */
1434 		if (rfcomm_connect_ind(s, channel, &d)) {
1435 			d->dlci = dlci;
1436 			d->addr = __addr(s->initiator, dlci);
1437 			rfcomm_dlc_link(s, d);
1438 
1439 			rfcomm_apply_pn(d, cr, pn);
1440 
1441 			d->state = BT_OPEN;
1442 			rfcomm_send_pn(s, 0, d);
1443 		} else {
1444 			rfcomm_send_dm(s, dlci);
1445 		}
1446 	}
1447 	return 0;
1448 }
1449 
1450 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1451 {
1452 	struct rfcomm_rpn *rpn = (void *) skb->data;
1453 	u8 dlci = __get_dlci(rpn->dlci);
1454 
1455 	u8 bit_rate  = 0;
1456 	u8 data_bits = 0;
1457 	u8 stop_bits = 0;
1458 	u8 parity    = 0;
1459 	u8 flow_ctrl = 0;
1460 	u8 xon_char  = 0;
1461 	u8 xoff_char = 0;
1462 	u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1463 
1464 	BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1465 		dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1466 		rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1467 
1468 	if (!cr)
1469 		return 0;
1470 
1471 	if (len == 1) {
1472 		/* This is a request, return default (according to ETSI TS 07.10) settings */
1473 		bit_rate  = RFCOMM_RPN_BR_9600;
1474 		data_bits = RFCOMM_RPN_DATA_8;
1475 		stop_bits = RFCOMM_RPN_STOP_1;
1476 		parity    = RFCOMM_RPN_PARITY_NONE;
1477 		flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1478 		xon_char  = RFCOMM_RPN_XON_CHAR;
1479 		xoff_char = RFCOMM_RPN_XOFF_CHAR;
1480 		goto rpn_out;
1481 	}
1482 
1483 	/* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1484 	 * no parity, no flow control lines, normal XON/XOFF chars */
1485 
1486 	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1487 		bit_rate = rpn->bit_rate;
1488 		if (bit_rate > RFCOMM_RPN_BR_230400) {
1489 			BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1490 			bit_rate = RFCOMM_RPN_BR_9600;
1491 			rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1492 		}
1493 	}
1494 
1495 	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1496 		data_bits = __get_rpn_data_bits(rpn->line_settings);
1497 		if (data_bits != RFCOMM_RPN_DATA_8) {
1498 			BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1499 			data_bits = RFCOMM_RPN_DATA_8;
1500 			rpn_mask ^= RFCOMM_RPN_PM_DATA;
1501 		}
1502 	}
1503 
1504 	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1505 		stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1506 		if (stop_bits != RFCOMM_RPN_STOP_1) {
1507 			BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1508 			stop_bits = RFCOMM_RPN_STOP_1;
1509 			rpn_mask ^= RFCOMM_RPN_PM_STOP;
1510 		}
1511 	}
1512 
1513 	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1514 		parity = __get_rpn_parity(rpn->line_settings);
1515 		if (parity != RFCOMM_RPN_PARITY_NONE) {
1516 			BT_DBG("RPN parity mismatch 0x%x", parity);
1517 			parity = RFCOMM_RPN_PARITY_NONE;
1518 			rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1519 		}
1520 	}
1521 
1522 	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1523 		flow_ctrl = rpn->flow_ctrl;
1524 		if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1525 			BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1526 			flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1527 			rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1528 		}
1529 	}
1530 
1531 	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1532 		xon_char = rpn->xon_char;
1533 		if (xon_char != RFCOMM_RPN_XON_CHAR) {
1534 			BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1535 			xon_char = RFCOMM_RPN_XON_CHAR;
1536 			rpn_mask ^= RFCOMM_RPN_PM_XON;
1537 		}
1538 	}
1539 
1540 	if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1541 		xoff_char = rpn->xoff_char;
1542 		if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1543 			BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1544 			xoff_char = RFCOMM_RPN_XOFF_CHAR;
1545 			rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1546 		}
1547 	}
1548 
1549 rpn_out:
1550 	rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1551 			parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1552 
1553 	return 0;
1554 }
1555 
1556 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1557 {
1558 	struct rfcomm_rls *rls = (void *) skb->data;
1559 	u8 dlci = __get_dlci(rls->dlci);
1560 
1561 	BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1562 
1563 	if (!cr)
1564 		return 0;
1565 
1566 	/* We should probably do something with this information here. But
1567 	 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1568 	 * mandatory to recognise and respond to RLS */
1569 
1570 	rfcomm_send_rls(s, 0, dlci, rls->status);
1571 
1572 	return 0;
1573 }
1574 
1575 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1576 {
1577 	struct rfcomm_msc *msc = (void *) skb->data;
1578 	struct rfcomm_dlc *d;
1579 	u8 dlci = __get_dlci(msc->dlci);
1580 
1581 	BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1582 
1583 	d = rfcomm_dlc_get(s, dlci);
1584 	if (!d)
1585 		return 0;
1586 
1587 	if (cr) {
1588 		if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1589 			set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1590 		else
1591 			clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1592 
1593 		rfcomm_dlc_lock(d);
1594 
1595 		d->remote_v24_sig = msc->v24_sig;
1596 
1597 		if (d->modem_status)
1598 			d->modem_status(d, msc->v24_sig);
1599 
1600 		rfcomm_dlc_unlock(d);
1601 
1602 		rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1603 
1604 		d->mscex |= RFCOMM_MSCEX_RX;
1605 	} else
1606 		d->mscex |= RFCOMM_MSCEX_TX;
1607 
1608 	return 0;
1609 }
1610 
1611 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1612 {
1613 	struct rfcomm_mcc *mcc = (void *) skb->data;
1614 	u8 type, cr, len;
1615 
1616 	cr   = __test_cr(mcc->type);
1617 	type = __get_mcc_type(mcc->type);
1618 	len  = __get_mcc_len(mcc->len);
1619 
1620 	BT_DBG("%p type 0x%x cr %d", s, type, cr);
1621 
1622 	skb_pull(skb, 2);
1623 
1624 	switch (type) {
1625 	case RFCOMM_PN:
1626 		rfcomm_recv_pn(s, cr, skb);
1627 		break;
1628 
1629 	case RFCOMM_RPN:
1630 		rfcomm_recv_rpn(s, cr, len, skb);
1631 		break;
1632 
1633 	case RFCOMM_RLS:
1634 		rfcomm_recv_rls(s, cr, skb);
1635 		break;
1636 
1637 	case RFCOMM_MSC:
1638 		rfcomm_recv_msc(s, cr, skb);
1639 		break;
1640 
1641 	case RFCOMM_FCOFF:
1642 		if (cr) {
1643 			set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1644 			rfcomm_send_fcoff(s, 0);
1645 		}
1646 		break;
1647 
1648 	case RFCOMM_FCON:
1649 		if (cr) {
1650 			clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1651 			rfcomm_send_fcon(s, 0);
1652 		}
1653 		break;
1654 
1655 	case RFCOMM_TEST:
1656 		if (cr)
1657 			rfcomm_send_test(s, 0, skb->data, skb->len);
1658 		break;
1659 
1660 	case RFCOMM_NSC:
1661 		break;
1662 
1663 	default:
1664 		BT_ERR("Unknown control type 0x%02x", type);
1665 		rfcomm_send_nsc(s, cr, type);
1666 		break;
1667 	}
1668 	return 0;
1669 }
1670 
1671 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1672 {
1673 	struct rfcomm_dlc *d;
1674 
1675 	BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1676 
1677 	d = rfcomm_dlc_get(s, dlci);
1678 	if (!d) {
1679 		rfcomm_send_dm(s, dlci);
1680 		goto drop;
1681 	}
1682 
1683 	if (pf && d->cfc) {
1684 		u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1685 
1686 		d->tx_credits += credits;
1687 		if (d->tx_credits)
1688 			clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1689 	}
1690 
1691 	if (skb->len && d->state == BT_CONNECTED) {
1692 		rfcomm_dlc_lock(d);
1693 		d->rx_credits--;
1694 		d->data_ready(d, skb);
1695 		rfcomm_dlc_unlock(d);
1696 		return 0;
1697 	}
1698 
1699 drop:
1700 	kfree_skb(skb);
1701 	return 0;
1702 }
1703 
1704 static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1705 						struct sk_buff *skb)
1706 {
1707 	struct rfcomm_hdr *hdr = (void *) skb->data;
1708 	u8 type, dlci, fcs;
1709 
1710 	if (!s) {
1711 		/* no session, so free socket data */
1712 		kfree_skb(skb);
1713 		return s;
1714 	}
1715 
1716 	dlci = __get_dlci(hdr->addr);
1717 	type = __get_type(hdr->ctrl);
1718 
1719 	/* Trim FCS */
1720 	skb->len--; skb->tail--;
1721 	fcs = *(u8 *)skb_tail_pointer(skb);
1722 
1723 	if (__check_fcs(skb->data, type, fcs)) {
1724 		BT_ERR("bad checksum in packet");
1725 		kfree_skb(skb);
1726 		return s;
1727 	}
1728 
1729 	if (__test_ea(hdr->len))
1730 		skb_pull(skb, 3);
1731 	else
1732 		skb_pull(skb, 4);
1733 
1734 	switch (type) {
1735 	case RFCOMM_SABM:
1736 		if (__test_pf(hdr->ctrl))
1737 			rfcomm_recv_sabm(s, dlci);
1738 		break;
1739 
1740 	case RFCOMM_DISC:
1741 		if (__test_pf(hdr->ctrl))
1742 			s = rfcomm_recv_disc(s, dlci);
1743 		break;
1744 
1745 	case RFCOMM_UA:
1746 		if (__test_pf(hdr->ctrl))
1747 			s = rfcomm_recv_ua(s, dlci);
1748 		break;
1749 
1750 	case RFCOMM_DM:
1751 		s = rfcomm_recv_dm(s, dlci);
1752 		break;
1753 
1754 	case RFCOMM_UIH:
1755 		if (dlci) {
1756 			rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1757 			return s;
1758 		}
1759 		rfcomm_recv_mcc(s, skb);
1760 		break;
1761 
1762 	default:
1763 		BT_ERR("Unknown packet type 0x%02x", type);
1764 		break;
1765 	}
1766 	kfree_skb(skb);
1767 	return s;
1768 }
1769 
1770 /* ---- Connection and data processing ---- */
1771 
1772 static void rfcomm_process_connect(struct rfcomm_session *s)
1773 {
1774 	struct rfcomm_dlc *d;
1775 	struct list_head *p, *n;
1776 
1777 	BT_DBG("session %p state %ld", s, s->state);
1778 
1779 	list_for_each_safe(p, n, &s->dlcs) {
1780 		d = list_entry(p, struct rfcomm_dlc, list);
1781 		if (d->state == BT_CONFIG) {
1782 			d->mtu = s->mtu;
1783 			if (rfcomm_check_security(d)) {
1784 				rfcomm_send_pn(s, 1, d);
1785 			} else {
1786 				set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1787 				rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1788 			}
1789 		}
1790 	}
1791 }
1792 
1793 /* Send data queued for the DLC.
1794  * Return number of frames left in the queue.
1795  */
1796 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1797 {
1798 	struct sk_buff *skb;
1799 	int err;
1800 
1801 	BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1802 			d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1803 
1804 	/* Send pending MSC */
1805 	if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1806 		rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1807 
1808 	if (d->cfc) {
1809 		/* CFC enabled.
1810 		 * Give them some credits */
1811 		if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1812 				d->rx_credits <= (d->cfc >> 2)) {
1813 			rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1814 			d->rx_credits = d->cfc;
1815 		}
1816 	} else {
1817 		/* CFC disabled.
1818 		 * Give ourselves some credits */
1819 		d->tx_credits = 5;
1820 	}
1821 
1822 	if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1823 		return skb_queue_len(&d->tx_queue);
1824 
1825 	while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1826 		err = rfcomm_send_frame(d->session, skb->data, skb->len);
1827 		if (err < 0) {
1828 			skb_queue_head(&d->tx_queue, skb);
1829 			break;
1830 		}
1831 		kfree_skb(skb);
1832 		d->tx_credits--;
1833 	}
1834 
1835 	if (d->cfc && !d->tx_credits) {
1836 		/* We're out of TX credits.
1837 		 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1838 		set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1839 	}
1840 
1841 	return skb_queue_len(&d->tx_queue);
1842 }
1843 
1844 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1845 {
1846 	struct rfcomm_dlc *d;
1847 	struct list_head *p, *n;
1848 
1849 	BT_DBG("session %p state %ld", s, s->state);
1850 
1851 	list_for_each_safe(p, n, &s->dlcs) {
1852 		d = list_entry(p, struct rfcomm_dlc, list);
1853 
1854 		if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1855 			__rfcomm_dlc_close(d, ETIMEDOUT);
1856 			continue;
1857 		}
1858 
1859 		if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1860 			__rfcomm_dlc_close(d, ECONNREFUSED);
1861 			continue;
1862 		}
1863 
1864 		if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1865 			rfcomm_dlc_clear_timer(d);
1866 			if (d->out) {
1867 				rfcomm_send_pn(s, 1, d);
1868 				rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1869 			} else {
1870 				if (d->defer_setup) {
1871 					set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1872 					rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1873 
1874 					rfcomm_dlc_lock(d);
1875 					d->state = BT_CONNECT2;
1876 					d->state_change(d, 0);
1877 					rfcomm_dlc_unlock(d);
1878 				} else
1879 					rfcomm_dlc_accept(d);
1880 			}
1881 			continue;
1882 		} else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1883 			rfcomm_dlc_clear_timer(d);
1884 			if (!d->out)
1885 				rfcomm_send_dm(s, d->dlci);
1886 			else
1887 				d->state = BT_CLOSED;
1888 			__rfcomm_dlc_close(d, ECONNREFUSED);
1889 			continue;
1890 		}
1891 
1892 		if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1893 			continue;
1894 
1895 		if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1896 			continue;
1897 
1898 		if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1899 						d->mscex == RFCOMM_MSCEX_OK)
1900 			rfcomm_process_tx(d);
1901 	}
1902 }
1903 
1904 static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1905 {
1906 	struct socket *sock = s->sock;
1907 	struct sock *sk = sock->sk;
1908 	struct sk_buff *skb;
1909 
1910 	BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1911 
1912 	/* Get data directly from socket receive queue without copying it. */
1913 	while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1914 		skb_orphan(skb);
1915 		if (!skb_linearize(skb)) {
1916 			s = rfcomm_recv_frame(s, skb);
1917 			if (!s)
1918 				break;
1919 		} else {
1920 			kfree_skb(skb);
1921 		}
1922 	}
1923 
1924 	if (s && (sk->sk_state == BT_CLOSED))
1925 		s = rfcomm_session_close(s, sk->sk_err);
1926 
1927 	return s;
1928 }
1929 
1930 static void rfcomm_accept_connection(struct rfcomm_session *s)
1931 {
1932 	struct socket *sock = s->sock, *nsock;
1933 	int err;
1934 
1935 	/* Fast check for a new connection.
1936 	 * Avoids unnesesary socket allocations. */
1937 	if (list_empty(&bt_sk(sock->sk)->accept_q))
1938 		return;
1939 
1940 	BT_DBG("session %p", s);
1941 
1942 	err = kernel_accept(sock, &nsock, O_NONBLOCK);
1943 	if (err < 0)
1944 		return;
1945 
1946 	/* Set our callbacks */
1947 	nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1948 	nsock->sk->sk_state_change = rfcomm_l2state_change;
1949 
1950 	s = rfcomm_session_add(nsock, BT_OPEN);
1951 	if (s) {
1952 		/* We should adjust MTU on incoming sessions.
1953 		 * L2CAP MTU minus UIH header and FCS. */
1954 		s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1955 				l2cap_pi(nsock->sk)->chan->imtu) - 5;
1956 
1957 		rfcomm_schedule();
1958 	} else
1959 		sock_release(nsock);
1960 }
1961 
1962 static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1963 {
1964 	struct sock *sk = s->sock->sk;
1965 
1966 	BT_DBG("%p state %ld", s, s->state);
1967 
1968 	switch (sk->sk_state) {
1969 	case BT_CONNECTED:
1970 		s->state = BT_CONNECT;
1971 
1972 		/* We can adjust MTU on outgoing sessions.
1973 		 * L2CAP MTU minus UIH header and FCS. */
1974 		s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1975 
1976 		rfcomm_send_sabm(s, 0);
1977 		break;
1978 
1979 	case BT_CLOSED:
1980 		s = rfcomm_session_close(s, sk->sk_err);
1981 		break;
1982 	}
1983 	return s;
1984 }
1985 
1986 static void rfcomm_process_sessions(void)
1987 {
1988 	struct list_head *p, *n;
1989 
1990 	rfcomm_lock();
1991 
1992 	list_for_each_safe(p, n, &session_list) {
1993 		struct rfcomm_session *s;
1994 		s = list_entry(p, struct rfcomm_session, list);
1995 
1996 		if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1997 			s->state = BT_DISCONN;
1998 			rfcomm_send_disc(s, 0);
1999 			continue;
2000 		}
2001 
2002 		switch (s->state) {
2003 		case BT_LISTEN:
2004 			rfcomm_accept_connection(s);
2005 			continue;
2006 
2007 		case BT_BOUND:
2008 			s = rfcomm_check_connection(s);
2009 			break;
2010 
2011 		default:
2012 			s = rfcomm_process_rx(s);
2013 			break;
2014 		}
2015 
2016 		if (s)
2017 			rfcomm_process_dlcs(s);
2018 	}
2019 
2020 	rfcomm_unlock();
2021 }
2022 
2023 static int rfcomm_add_listener(bdaddr_t *ba)
2024 {
2025 	struct sockaddr_l2 addr;
2026 	struct socket *sock;
2027 	struct sock *sk;
2028 	struct rfcomm_session *s;
2029 	int    err = 0;
2030 
2031 	/* Create socket */
2032 	err = rfcomm_l2sock_create(&sock);
2033 	if (err < 0) {
2034 		BT_ERR("Create socket failed %d", err);
2035 		return err;
2036 	}
2037 
2038 	/* Bind socket */
2039 	bacpy(&addr.l2_bdaddr, ba);
2040 	addr.l2_family = AF_BLUETOOTH;
2041 	addr.l2_psm    = cpu_to_le16(RFCOMM_PSM);
2042 	addr.l2_cid    = 0;
2043 	addr.l2_bdaddr_type = BDADDR_BREDR;
2044 	err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
2045 	if (err < 0) {
2046 		BT_ERR("Bind failed %d", err);
2047 		goto failed;
2048 	}
2049 
2050 	/* Set L2CAP options */
2051 	sk = sock->sk;
2052 	lock_sock(sk);
2053 	l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2054 	release_sock(sk);
2055 
2056 	/* Start listening on the socket */
2057 	err = kernel_listen(sock, 10);
2058 	if (err) {
2059 		BT_ERR("Listen failed %d", err);
2060 		goto failed;
2061 	}
2062 
2063 	/* Add listening session */
2064 	s = rfcomm_session_add(sock, BT_LISTEN);
2065 	if (!s) {
2066 		err = -ENOMEM;
2067 		goto failed;
2068 	}
2069 
2070 	return 0;
2071 failed:
2072 	sock_release(sock);
2073 	return err;
2074 }
2075 
2076 static void rfcomm_kill_listener(void)
2077 {
2078 	struct rfcomm_session *s;
2079 	struct list_head *p, *n;
2080 
2081 	BT_DBG("");
2082 
2083 	list_for_each_safe(p, n, &session_list) {
2084 		s = list_entry(p, struct rfcomm_session, list);
2085 		rfcomm_session_del(s);
2086 	}
2087 }
2088 
2089 static int rfcomm_run(void *unused)
2090 {
2091 	DEFINE_WAIT_FUNC(wait, woken_wake_function);
2092 	BT_DBG("");
2093 
2094 	set_user_nice(current, -10);
2095 
2096 	rfcomm_add_listener(BDADDR_ANY);
2097 
2098 	add_wait_queue(&rfcomm_wq, &wait);
2099 	while (!kthread_should_stop()) {
2100 
2101 		/* Process stuff */
2102 		rfcomm_process_sessions();
2103 
2104 		wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
2105 	}
2106 	remove_wait_queue(&rfcomm_wq, &wait);
2107 
2108 	rfcomm_kill_listener();
2109 
2110 	return 0;
2111 }
2112 
2113 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2114 {
2115 	struct rfcomm_session *s;
2116 	struct rfcomm_dlc *d;
2117 	struct list_head *p, *n;
2118 
2119 	BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2120 
2121 	s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2122 	if (!s)
2123 		return;
2124 
2125 	list_for_each_safe(p, n, &s->dlcs) {
2126 		d = list_entry(p, struct rfcomm_dlc, list);
2127 
2128 		if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2129 			rfcomm_dlc_clear_timer(d);
2130 			if (status || encrypt == 0x00) {
2131 				set_bit(RFCOMM_ENC_DROP, &d->flags);
2132 				continue;
2133 			}
2134 		}
2135 
2136 		if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2137 			if (d->sec_level == BT_SECURITY_MEDIUM) {
2138 				set_bit(RFCOMM_SEC_PENDING, &d->flags);
2139 				rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2140 				continue;
2141 			} else if (d->sec_level == BT_SECURITY_HIGH ||
2142 				   d->sec_level == BT_SECURITY_FIPS) {
2143 				set_bit(RFCOMM_ENC_DROP, &d->flags);
2144 				continue;
2145 			}
2146 		}
2147 
2148 		if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2149 			continue;
2150 
2151 		if (!status && hci_conn_check_secure(conn, d->sec_level))
2152 			set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2153 		else
2154 			set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2155 	}
2156 
2157 	rfcomm_schedule();
2158 }
2159 
2160 static struct hci_cb rfcomm_cb = {
2161 	.name		= "RFCOMM",
2162 	.security_cfm	= rfcomm_security_cfm
2163 };
2164 
2165 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2166 {
2167 	struct rfcomm_session *s;
2168 
2169 	rfcomm_lock();
2170 
2171 	list_for_each_entry(s, &session_list, list) {
2172 		struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
2173 		struct rfcomm_dlc *d;
2174 		list_for_each_entry(d, &s->dlcs, list) {
2175 			seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
2176 				   &chan->src, &chan->dst,
2177 				   d->state, d->dlci, d->mtu,
2178 				   d->rx_credits, d->tx_credits);
2179 		}
2180 	}
2181 
2182 	rfcomm_unlock();
2183 
2184 	return 0;
2185 }
2186 
2187 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2188 {
2189 	return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2190 }
2191 
2192 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2193 	.open		= rfcomm_dlc_debugfs_open,
2194 	.read		= seq_read,
2195 	.llseek		= seq_lseek,
2196 	.release	= single_release,
2197 };
2198 
2199 static struct dentry *rfcomm_dlc_debugfs;
2200 
2201 /* ---- Initialization ---- */
2202 static int __init rfcomm_init(void)
2203 {
2204 	int err;
2205 
2206 	hci_register_cb(&rfcomm_cb);
2207 
2208 	rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2209 	if (IS_ERR(rfcomm_thread)) {
2210 		err = PTR_ERR(rfcomm_thread);
2211 		goto unregister;
2212 	}
2213 
2214 	err = rfcomm_init_ttys();
2215 	if (err < 0)
2216 		goto stop;
2217 
2218 	err = rfcomm_init_sockets();
2219 	if (err < 0)
2220 		goto cleanup;
2221 
2222 	BT_INFO("RFCOMM ver %s", VERSION);
2223 
2224 	if (IS_ERR_OR_NULL(bt_debugfs))
2225 		return 0;
2226 
2227 	rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2228 						 bt_debugfs, NULL,
2229 						 &rfcomm_dlc_debugfs_fops);
2230 
2231 	return 0;
2232 
2233 cleanup:
2234 	rfcomm_cleanup_ttys();
2235 
2236 stop:
2237 	kthread_stop(rfcomm_thread);
2238 
2239 unregister:
2240 	hci_unregister_cb(&rfcomm_cb);
2241 
2242 	return err;
2243 }
2244 
2245 static void __exit rfcomm_exit(void)
2246 {
2247 	debugfs_remove(rfcomm_dlc_debugfs);
2248 
2249 	hci_unregister_cb(&rfcomm_cb);
2250 
2251 	kthread_stop(rfcomm_thread);
2252 
2253 	rfcomm_cleanup_ttys();
2254 
2255 	rfcomm_cleanup_sockets();
2256 }
2257 
2258 module_init(rfcomm_init);
2259 module_exit(rfcomm_exit);
2260 
2261 module_param(disable_cfc, bool, 0644);
2262 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2263 
2264 module_param(channel_mtu, int, 0644);
2265 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2266 
2267 module_param(l2cap_mtu, uint, 0644);
2268 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2269 
2270 module_param(l2cap_ertm, bool, 0644);
2271 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2272 
2273 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2274 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2275 MODULE_VERSION(VERSION);
2276 MODULE_LICENSE("GPL");
2277 MODULE_ALIAS("bt-proto-3");
2278