?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ipv6: Remove some pointless conditionals before kfree_skb()
[linux/fpc-iii.git] / net / bluetooth / rfcomm / core.c
blobacd84fd524b856c25cf1f7c40560c3a6726d7236
1 /*
2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22 */
23
24 /*
25 * Bluetooth RFCOMM core.
26 */
27
28 #include <linux/module.h>
29 #include <linux/errno.h>
30 #include <linux/kernel.h>
31 #include <linux/sched.h>
32 #include <linux/signal.h>
33 #include <linux/init.h>
34 #include <linux/wait.h>
35 #include <linux/device.h>
36 #include <linux/net.h>
37 #include <linux/mutex.h>
38 #include <linux/kthread.h>
39
40 #include <net/sock.h>
41 #include <asm/uaccess.h>
42 #include <asm/unaligned.h>
43
44 #include <net/bluetooth/bluetooth.h>
45 #include <net/bluetooth/hci_core.h>
46 #include <net/bluetooth/l2cap.h>
47 #include <net/bluetooth/rfcomm.h>
48
49 #define VERSION "1.10"
50
51 static int disable_cfc = 0;
52 static int channel_mtu = -1;
53 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
54
55 static struct task_struct *rfcomm_thread;
56
57 static DEFINE_MUTEX(rfcomm_mutex);
58 #define rfcomm_lock() mutex_lock(&rfcomm_mutex)
59 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
60
61 static unsigned long rfcomm_event;
62
63 static LIST_HEAD(session_list);
64
65 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
66 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
67 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
68 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
69 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
70 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
71 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
72 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
73 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
74 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
75
76 static void rfcomm_process_connect(struct rfcomm_session *s);
77
78 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
79 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
80 static void rfcomm_session_del(struct rfcomm_session *s);
81
82 /* ---- RFCOMM frame parsing macros ---- */
83 #define __get_dlci(b) ((b & 0xfc) >> 2)
84 #define __get_channel(b) ((b & 0xf8) >> 3)
85 #define __get_dir(b) ((b & 0x04) >> 2)
86 #define __get_type(b) ((b & 0xef))
87
88 #define __test_ea(b) ((b & 0x01))
89 #define __test_cr(b) ((b & 0x02))
90 #define __test_pf(b) ((b & 0x10))
91
92 #define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
93 #define __ctrl(type, pf) (((type & 0xef) | (pf << 4)))
94 #define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir)
95 #define __srv_channel(dlci) (dlci >> 1)
96 #define __dir(dlci) (dlci & 0x01)
97
98 #define __len8(len) (((len) << 1) | 1)
99 #define __len16(len) ((len) << 1)
100
101 /* MCC macros */
102 #define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01))
103 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
104 #define __get_mcc_len(b) ((b & 0xfe) >> 1)
105
106 /* RPN macros */
107 #define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
108 #define __get_rpn_data_bits(line) ((line) & 0x3)
109 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
110 #define __get_rpn_parity(line) (((line) >> 3) & 0x7)
111
112 static inline void rfcomm_schedule(uint event)
113 {
114 if (!rfcomm_thread)
115 return;
116 //set_bit(event, &rfcomm_event);
117 set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
118 wake_up_process(rfcomm_thread);
119 }
120
121 static inline void rfcomm_session_put(struct rfcomm_session *s)
122 {
123 if (atomic_dec_and_test(&s->refcnt))
124 rfcomm_session_del(s);
125 }
126
127 /* ---- RFCOMM FCS computation ---- */
128
129 /* reversed, 8-bit, poly=0x07 */
130 static unsigned char rfcomm_crc_table[256] = {
131 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
132 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
133 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
134 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
135
136 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
137 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
138 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
139 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
140
141 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
142 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
143 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
144 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
145
146 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
147 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
148 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
149 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
150
151 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
152 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
153 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
154 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
155
156 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
157 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
158 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
159 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
160
161 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
162 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
163 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
164 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
165
166 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
167 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
168 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
169 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
170 };
171
172 /* CRC on 2 bytes */
173 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
174
175 /* FCS on 2 bytes */
176 static inline u8 __fcs(u8 *data)
177 {
178 return (0xff - __crc(data));
179 }
180
181 /* FCS on 3 bytes */
182 static inline u8 __fcs2(u8 *data)
183 {
184 return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
185 }
186
187 /* Check FCS */
188 static inline int __check_fcs(u8 *data, int type, u8 fcs)
189 {
190 u8 f = __crc(data);
191
192 if (type != RFCOMM_UIH)
193 f = rfcomm_crc_table[f ^ data[2]];
194
195 return rfcomm_crc_table[f ^ fcs] != 0xcf;
196 }
197
198 /* ---- L2CAP callbacks ---- */
199 static void rfcomm_l2state_change(struct sock *sk)
200 {
201 BT_DBG("%p state %d", sk, sk->sk_state);
202 rfcomm_schedule(RFCOMM_SCHED_STATE);
203 }
204
205 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
206 {
207 BT_DBG("%p bytes %d", sk, bytes);
208 rfcomm_schedule(RFCOMM_SCHED_RX);
209 }
210
211 static int rfcomm_l2sock_create(struct socket **sock)
212 {
213 int err;
214
215 BT_DBG("");
216
217 err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
218 if (!err) {
219 struct sock *sk = (*sock)->sk;
220 sk->sk_data_ready = rfcomm_l2data_ready;
221 sk->sk_state_change = rfcomm_l2state_change;
222 }
223 return err;
224 }
225
226 static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
227 {
228 struct sock *sk = d->session->sock->sk;
229
230 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
231 if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
232 return 1;
233 } else if (d->link_mode & RFCOMM_LM_AUTH) {
234 if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
235 return 1;
236 }
237
238 return 0;
239 }
240
241 /* ---- RFCOMM DLCs ---- */
242 static void rfcomm_dlc_timeout(unsigned long arg)
243 {
244 struct rfcomm_dlc *d = (void *) arg;
245
246 BT_DBG("dlc %p state %ld", d, d->state);
247
248 set_bit(RFCOMM_TIMED_OUT, &d->flags);
249 rfcomm_dlc_put(d);
250 rfcomm_schedule(RFCOMM_SCHED_TIMEO);
251 }
252
253 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
254 {
255 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
256
257 if (!mod_timer(&d->timer, jiffies + timeout))
258 rfcomm_dlc_hold(d);
259 }
260
261 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
262 {
263 BT_DBG("dlc %p state %ld", d, d->state);
264
265 if (timer_pending(&d->timer) && del_timer(&d->timer))
266 rfcomm_dlc_put(d);
267 }
268
269 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
270 {
271 BT_DBG("%p", d);
272
273 d->state = BT_OPEN;
274 d->flags = 0;
275 d->mscex = 0;
276 d->mtu = RFCOMM_DEFAULT_MTU;
277 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
278
279 d->cfc = RFCOMM_CFC_DISABLED;
280 d->rx_credits = RFCOMM_DEFAULT_CREDITS;
281 }
282
283 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
284 {
285 struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
286
287 if (!d)
288 return NULL;
289
290 setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
291
292 skb_queue_head_init(&d->tx_queue);
293 spin_lock_init(&d->lock);
294 atomic_set(&d->refcnt, 1);
295
296 rfcomm_dlc_clear_state(d);
297
298 BT_DBG("%p", d);
299
300 return d;
301 }
302
303 void rfcomm_dlc_free(struct rfcomm_dlc *d)
304 {
305 BT_DBG("%p", d);
306
307 skb_queue_purge(&d->tx_queue);
308 kfree(d);
309 }
310
311 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
312 {
313 BT_DBG("dlc %p session %p", d, s);
314
315 rfcomm_session_hold(s);
316
317 rfcomm_dlc_hold(d);
318 list_add(&d->list, &s->dlcs);
319 d->session = s;
320 }
321
322 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
323 {
324 struct rfcomm_session *s = d->session;
325
326 BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
327
328 list_del(&d->list);
329 d->session = NULL;
330 rfcomm_dlc_put(d);
331
332 rfcomm_session_put(s);
333 }
334
335 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
336 {
337 struct rfcomm_dlc *d;
338 struct list_head *p;
339
340 list_for_each(p, &s->dlcs) {
341 d = list_entry(p, struct rfcomm_dlc, list);
342 if (d->dlci == dlci)
343 return d;
344 }
345 return NULL;
346 }
347
348 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
349 {
350 struct rfcomm_session *s;
351 int err = 0;
352 u8 dlci;
353
354 BT_DBG("dlc %p state %ld %s %s channel %d",
355 d, d->state, batostr(src), batostr(dst), channel);
356
357 if (channel < 1 || channel > 30)
358 return -EINVAL;
359
360 if (d->state != BT_OPEN && d->state != BT_CLOSED)
361 return 0;
362
363 s = rfcomm_session_get(src, dst);
364 if (!s) {
365 s = rfcomm_session_create(src, dst, &err);
366 if (!s)
367 return err;
368 }
369
370 dlci = __dlci(!s->initiator, channel);
371
372 /* Check if DLCI already exists */
373 if (rfcomm_dlc_get(s, dlci))
374 return -EBUSY;
375
376 rfcomm_dlc_clear_state(d);
377
378 d->dlci = dlci;
379 d->addr = __addr(s->initiator, dlci);
380 d->priority = 7;
381
382 d->state = BT_CONFIG;
383 rfcomm_dlc_link(s, d);
384
385 d->out = 1;
386
387 d->mtu = s->mtu;
388 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
389
390 if (s->state == BT_CONNECTED) {
391 if (rfcomm_check_link_mode(d))
392 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
393 else
394 rfcomm_send_pn(s, 1, d);
395 }
396
397 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
398
399 return 0;
400 }
401
402 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
403 {
404 int r;
405
406 rfcomm_lock();
407
408 r = __rfcomm_dlc_open(d, src, dst, channel);
409
410 rfcomm_unlock();
411 return r;
412 }
413
414 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
415 {
416 struct rfcomm_session *s = d->session;
417 if (!s)
418 return 0;
419
420 BT_DBG("dlc %p state %ld dlci %d err %d session %p",
421 d, d->state, d->dlci, err, s);
422
423 switch (d->state) {
424 case BT_CONNECTED:
425 case BT_CONFIG:
426 case BT_CONNECT:
427 d->state = BT_DISCONN;
428 if (skb_queue_empty(&d->tx_queue)) {
429 rfcomm_send_disc(s, d->dlci);
430 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
431 } else {
432 rfcomm_queue_disc(d);
433 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
434 }
435 break;
436
437 default:
438 rfcomm_dlc_clear_timer(d);
439
440 rfcomm_dlc_lock(d);
441 d->state = BT_CLOSED;
442 d->state_change(d, err);
443 rfcomm_dlc_unlock(d);
444
445 skb_queue_purge(&d->tx_queue);
446 rfcomm_dlc_unlink(d);
447 }
448
449 return 0;
450 }
451
452 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
453 {
454 int r;
455
456 rfcomm_lock();
457
458 r = __rfcomm_dlc_close(d, err);
459
460 rfcomm_unlock();
461 return r;
462 }
463
464 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
465 {
466 int len = skb->len;
467
468 if (d->state != BT_CONNECTED)
469 return -ENOTCONN;
470
471 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
472
473 if (len > d->mtu)
474 return -EINVAL;
475
476 rfcomm_make_uih(skb, d->addr);
477 skb_queue_tail(&d->tx_queue, skb);
478
479 if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
480 rfcomm_schedule(RFCOMM_SCHED_TX);
481 return len;
482 }
483
484 void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
485 {
486 BT_DBG("dlc %p state %ld", d, d->state);
487
488 if (!d->cfc) {
489 d->v24_sig |= RFCOMM_V24_FC;
490 set_bit(RFCOMM_MSC_PENDING, &d->flags);
491 }
492 rfcomm_schedule(RFCOMM_SCHED_TX);
493 }
494
495 void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
496 {
497 BT_DBG("dlc %p state %ld", d, d->state);
498
499 if (!d->cfc) {
500 d->v24_sig &= ~RFCOMM_V24_FC;
501 set_bit(RFCOMM_MSC_PENDING, &d->flags);
502 }
503 rfcomm_schedule(RFCOMM_SCHED_TX);
504 }
505
506 /*
507 Set/get modem status functions use _local_ status i.e. what we report
508 to the other side.
509 Remote status is provided by dlc->modem_status() callback.
510 */
511 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
512 {
513 BT_DBG("dlc %p state %ld v24_sig 0x%x",
514 d, d->state, v24_sig);
515
516 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
517 v24_sig |= RFCOMM_V24_FC;
518 else
519 v24_sig &= ~RFCOMM_V24_FC;
520
521 d->v24_sig = v24_sig;
522
523 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
524 rfcomm_schedule(RFCOMM_SCHED_TX);
525
526 return 0;
527 }
528
529 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
530 {
531 BT_DBG("dlc %p state %ld v24_sig 0x%x",
532 d, d->state, d->v24_sig);
533
534 *v24_sig = d->v24_sig;
535 return 0;
536 }
537
538 /* ---- RFCOMM sessions ---- */
539 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
540 {
541 struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
542
543 if (!s)
544 return NULL;
545
546 BT_DBG("session %p sock %p", s, sock);
547
548 INIT_LIST_HEAD(&s->dlcs);
549 s->state = state;
550 s->sock = sock;
551
552 s->mtu = RFCOMM_DEFAULT_MTU;
553 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
554
555 /* Do not increment module usage count for listening sessions.
556 * Otherwise we won't be able to unload the module. */
557 if (state != BT_LISTEN)
558 if (!try_module_get(THIS_MODULE)) {
559 kfree(s);
560 return NULL;
561 }
562
563 list_add(&s->list, &session_list);
564
565 return s;
566 }
567
568 static void rfcomm_session_del(struct rfcomm_session *s)
569 {
570 int state = s->state;
571
572 BT_DBG("session %p state %ld", s, s->state);
573
574 list_del(&s->list);
575
576 if (state == BT_CONNECTED)
577 rfcomm_send_disc(s, 0);
578
579 sock_release(s->sock);
580 kfree(s);
581
582 if (state != BT_LISTEN)
583 module_put(THIS_MODULE);
584 }
585
586 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
587 {
588 struct rfcomm_session *s;
589 struct list_head *p, *n;
590 struct bt_sock *sk;
591 list_for_each_safe(p, n, &session_list) {
592 s = list_entry(p, struct rfcomm_session, list);
593 sk = bt_sk(s->sock->sk);
594
595 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
596 !bacmp(&sk->dst, dst))
597 return s;
598 }
599 return NULL;
600 }
601
602 static void rfcomm_session_close(struct rfcomm_session *s, int err)
603 {
604 struct rfcomm_dlc *d;
605 struct list_head *p, *n;
606
607 BT_DBG("session %p state %ld err %d", s, s->state, err);
608
609 rfcomm_session_hold(s);
610
611 s->state = BT_CLOSED;
612
613 /* Close all dlcs */
614 list_for_each_safe(p, n, &s->dlcs) {
615 d = list_entry(p, struct rfcomm_dlc, list);
616 d->state = BT_CLOSED;
617 __rfcomm_dlc_close(d, err);
618 }
619
620 rfcomm_session_put(s);
621 }
622
623 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
624 {
625 struct rfcomm_session *s = NULL;
626 struct sockaddr_l2 addr;
627 struct socket *sock;
628 struct sock *sk;
629
630 BT_DBG("%s %s", batostr(src), batostr(dst));
631
632 *err = rfcomm_l2sock_create(&sock);
633 if (*err < 0)
634 return NULL;
635
636 bacpy(&addr.l2_bdaddr, src);
637 addr.l2_family = AF_BLUETOOTH;
638 addr.l2_psm = 0;
639 *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
640 if (*err < 0)
641 goto failed;
642
643 /* Set L2CAP options */
644 sk = sock->sk;
645 lock_sock(sk);
646 l2cap_pi(sk)->imtu = l2cap_mtu;
647 release_sock(sk);
648
649 s = rfcomm_session_add(sock, BT_BOUND);
650 if (!s) {
651 *err = -ENOMEM;
652 goto failed;
653 }
654
655 s->initiator = 1;
656
657 bacpy(&addr.l2_bdaddr, dst);
658 addr.l2_family = AF_BLUETOOTH;
659 addr.l2_psm = htobs(RFCOMM_PSM);
660 *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
661 if (*err == 0 || *err == -EINPROGRESS)
662 return s;
663
664 rfcomm_session_del(s);
665 return NULL;
666
667 failed:
668 sock_release(sock);
669 return NULL;
670 }
671
672 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
673 {
674 struct sock *sk = s->sock->sk;
675 if (src)
676 bacpy(src, &bt_sk(sk)->src);
677 if (dst)
678 bacpy(dst, &bt_sk(sk)->dst);
679 }
680
681 /* ---- RFCOMM frame sending ---- */
682 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
683 {
684 struct socket *sock = s->sock;
685 struct kvec iv = { data, len };
686 struct msghdr msg;
687
688 BT_DBG("session %p len %d", s, len);
689
690 memset(&msg, 0, sizeof(msg));
691
692 return kernel_sendmsg(sock, &msg, &iv, 1, len);
693 }
694
695 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
696 {
697 struct rfcomm_cmd cmd;
698
699 BT_DBG("%p dlci %d", s, dlci);
700
701 cmd.addr = __addr(s->initiator, dlci);
702 cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
703 cmd.len = __len8(0);
704 cmd.fcs = __fcs2((u8 *) &cmd);
705
706 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
707 }
708
709 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
710 {
711 struct rfcomm_cmd cmd;
712
713 BT_DBG("%p dlci %d", s, dlci);
714
715 cmd.addr = __addr(!s->initiator, dlci);
716 cmd.ctrl = __ctrl(RFCOMM_UA, 1);
717 cmd.len = __len8(0);
718 cmd.fcs = __fcs2((u8 *) &cmd);
719
720 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
721 }
722
723 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
724 {
725 struct rfcomm_cmd cmd;
726
727 BT_DBG("%p dlci %d", s, dlci);
728
729 cmd.addr = __addr(s->initiator, dlci);
730 cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
731 cmd.len = __len8(0);
732 cmd.fcs = __fcs2((u8 *) &cmd);
733
734 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
735 }
736
737 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
738 {
739 struct rfcomm_cmd *cmd;
740 struct sk_buff *skb;
741
742 BT_DBG("dlc %p dlci %d", d, d->dlci);
743
744 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
745 if (!skb)
746 return -ENOMEM;
747
748 cmd = (void *) __skb_put(skb, sizeof(*cmd));
749 cmd->addr = d->addr;
750 cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
751 cmd->len = __len8(0);
752 cmd->fcs = __fcs2((u8 *) cmd);
753
754 skb_queue_tail(&d->tx_queue, skb);
755 rfcomm_schedule(RFCOMM_SCHED_TX);
756 return 0;
757 }
758
759 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
760 {
761 struct rfcomm_cmd cmd;
762
763 BT_DBG("%p dlci %d", s, dlci);
764
765 cmd.addr = __addr(!s->initiator, dlci);
766 cmd.ctrl = __ctrl(RFCOMM_DM, 1);
767 cmd.len = __len8(0);
768 cmd.fcs = __fcs2((u8 *) &cmd);
769
770 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
771 }
772
773 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
774 {
775 struct rfcomm_hdr *hdr;
776 struct rfcomm_mcc *mcc;
777 u8 buf[16], *ptr = buf;
778
779 BT_DBG("%p cr %d type %d", s, cr, type);
780
781 hdr = (void *) ptr; ptr += sizeof(*hdr);
782 hdr->addr = __addr(s->initiator, 0);
783 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
784 hdr->len = __len8(sizeof(*mcc) + 1);
785
786 mcc = (void *) ptr; ptr += sizeof(*mcc);
787 mcc->type = __mcc_type(cr, RFCOMM_NSC);
788 mcc->len = __len8(1);
789
790 /* Type that we didn't like */
791 *ptr = __mcc_type(cr, type); ptr++;
792
793 *ptr = __fcs(buf); ptr++;
794
795 return rfcomm_send_frame(s, buf, ptr - buf);
796 }
797
798 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
799 {
800 struct rfcomm_hdr *hdr;
801 struct rfcomm_mcc *mcc;
802 struct rfcomm_pn *pn;
803 u8 buf[16], *ptr = buf;
804
805 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
806
807 hdr = (void *) ptr; ptr += sizeof(*hdr);
808 hdr->addr = __addr(s->initiator, 0);
809 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
810 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn));
811
812 mcc = (void *) ptr; ptr += sizeof(*mcc);
813 mcc->type = __mcc_type(cr, RFCOMM_PN);
814 mcc->len = __len8(sizeof(*pn));
815
816 pn = (void *) ptr; ptr += sizeof(*pn);
817 pn->dlci = d->dlci;
818 pn->priority = d->priority;
819 pn->ack_timer = 0;
820 pn->max_retrans = 0;
821
822 if (s->cfc) {
823 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
824 pn->credits = RFCOMM_DEFAULT_CREDITS;
825 } else {
826 pn->flow_ctrl = 0;
827 pn->credits = 0;
828 }
829
830 if (cr && channel_mtu >= 0)
831 pn->mtu = htobs(channel_mtu);
832 else
833 pn->mtu = htobs(d->mtu);
834
835 *ptr = __fcs(buf); ptr++;
836
837 return rfcomm_send_frame(s, buf, ptr - buf);
838 }
839
840 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
841 u8 bit_rate, u8 data_bits, u8 stop_bits,
842 u8 parity, u8 flow_ctrl_settings,
843 u8 xon_char, u8 xoff_char, u16 param_mask)
844 {
845 struct rfcomm_hdr *hdr;
846 struct rfcomm_mcc *mcc;
847 struct rfcomm_rpn *rpn;
848 u8 buf[16], *ptr = buf;
849
850 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
851 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
852 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
853 flow_ctrl_settings, xon_char, xoff_char, param_mask);
854
855 hdr = (void *) ptr; ptr += sizeof(*hdr);
856 hdr->addr = __addr(s->initiator, 0);
857 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
858 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn));
859
860 mcc = (void *) ptr; ptr += sizeof(*mcc);
861 mcc->type = __mcc_type(cr, RFCOMM_RPN);
862 mcc->len = __len8(sizeof(*rpn));
863
864 rpn = (void *) ptr; ptr += sizeof(*rpn);
865 rpn->dlci = __addr(1, dlci);
866 rpn->bit_rate = bit_rate;
867 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
868 rpn->flow_ctrl = flow_ctrl_settings;
869 rpn->xon_char = xon_char;
870 rpn->xoff_char = xoff_char;
871 rpn->param_mask = cpu_to_le16(param_mask);
872
873 *ptr = __fcs(buf); ptr++;
874
875 return rfcomm_send_frame(s, buf, ptr - buf);
876 }
877
878 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
879 {
880 struct rfcomm_hdr *hdr;
881 struct rfcomm_mcc *mcc;
882 struct rfcomm_rls *rls;
883 u8 buf[16], *ptr = buf;
884
885 BT_DBG("%p cr %d status 0x%x", s, cr, status);
886
887 hdr = (void *) ptr; ptr += sizeof(*hdr);
888 hdr->addr = __addr(s->initiator, 0);
889 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
890 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls));
891
892 mcc = (void *) ptr; ptr += sizeof(*mcc);
893 mcc->type = __mcc_type(cr, RFCOMM_RLS);
894 mcc->len = __len8(sizeof(*rls));
895
896 rls = (void *) ptr; ptr += sizeof(*rls);
897 rls->dlci = __addr(1, dlci);
898 rls->status = status;
899
900 *ptr = __fcs(buf); ptr++;
901
902 return rfcomm_send_frame(s, buf, ptr - buf);
903 }
904
905 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
906 {
907 struct rfcomm_hdr *hdr;
908 struct rfcomm_mcc *mcc;
909 struct rfcomm_msc *msc;
910 u8 buf[16], *ptr = buf;
911
912 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
913
914 hdr = (void *) ptr; ptr += sizeof(*hdr);
915 hdr->addr = __addr(s->initiator, 0);
916 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
917 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc));
918
919 mcc = (void *) ptr; ptr += sizeof(*mcc);
920 mcc->type = __mcc_type(cr, RFCOMM_MSC);
921 mcc->len = __len8(sizeof(*msc));
922
923 msc = (void *) ptr; ptr += sizeof(*msc);
924 msc->dlci = __addr(1, dlci);
925 msc->v24_sig = v24_sig | 0x01;
926
927 *ptr = __fcs(buf); ptr++;
928
929 return rfcomm_send_frame(s, buf, ptr - buf);
930 }
931
932 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
933 {
934 struct rfcomm_hdr *hdr;
935 struct rfcomm_mcc *mcc;
936 u8 buf[16], *ptr = buf;
937
938 BT_DBG("%p cr %d", s, cr);
939
940 hdr = (void *) ptr; ptr += sizeof(*hdr);
941 hdr->addr = __addr(s->initiator, 0);
942 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
943 hdr->len = __len8(sizeof(*mcc));
944
945 mcc = (void *) ptr; ptr += sizeof(*mcc);
946 mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
947 mcc->len = __len8(0);
948
949 *ptr = __fcs(buf); ptr++;
950
951 return rfcomm_send_frame(s, buf, ptr - buf);
952 }
953
954 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
955 {
956 struct rfcomm_hdr *hdr;
957 struct rfcomm_mcc *mcc;
958 u8 buf[16], *ptr = buf;
959
960 BT_DBG("%p cr %d", s, cr);
961
962 hdr = (void *) ptr; ptr += sizeof(*hdr);
963 hdr->addr = __addr(s->initiator, 0);
964 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
965 hdr->len = __len8(sizeof(*mcc));
966
967 mcc = (void *) ptr; ptr += sizeof(*mcc);
968 mcc->type = __mcc_type(cr, RFCOMM_FCON);
969 mcc->len = __len8(0);
970
971 *ptr = __fcs(buf); ptr++;
972
973 return rfcomm_send_frame(s, buf, ptr - buf);
974 }
975
976 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
977 {
978 struct socket *sock = s->sock;
979 struct kvec iv[3];
980 struct msghdr msg;
981 unsigned char hdr[5], crc[1];
982
983 if (len > 125)
984 return -EINVAL;
985
986 BT_DBG("%p cr %d", s, cr);
987
988 hdr[0] = __addr(s->initiator, 0);
989 hdr[1] = __ctrl(RFCOMM_UIH, 0);
990 hdr[2] = 0x01 | ((len + 2) << 1);
991 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
992 hdr[4] = 0x01 | (len << 1);
993
994 crc[0] = __fcs(hdr);
995
996 iv[0].iov_base = hdr;
997 iv[0].iov_len = 5;
998 iv[1].iov_base = pattern;
999 iv[1].iov_len = len;
1000 iv[2].iov_base = crc;
1001 iv[2].iov_len = 1;
1002
1003 memset(&msg, 0, sizeof(msg));
1004
1005 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1006 }
1007
1008 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1009 {
1010 struct rfcomm_hdr *hdr;
1011 u8 buf[16], *ptr = buf;
1012
1013 BT_DBG("%p addr %d credits %d", s, addr, credits);
1014
1015 hdr = (void *) ptr; ptr += sizeof(*hdr);
1016 hdr->addr = addr;
1017 hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1018 hdr->len = __len8(0);
1019
1020 *ptr = credits; ptr++;
1021
1022 *ptr = __fcs(buf); ptr++;
1023
1024 return rfcomm_send_frame(s, buf, ptr - buf);
1025 }
1026
1027 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1028 {
1029 struct rfcomm_hdr *hdr;
1030 int len = skb->len;
1031 u8 *crc;
1032
1033 if (len > 127) {
1034 hdr = (void *) skb_push(skb, 4);
1035 put_unaligned(htobs(__len16(len)), (__le16 *) &hdr->len);
1036 } else {
1037 hdr = (void *) skb_push(skb, 3);
1038 hdr->len = __len8(len);
1039 }
1040 hdr->addr = addr;
1041 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1042
1043 crc = skb_put(skb, 1);
1044 *crc = __fcs((void *) hdr);
1045 }
1046
1047 /* ---- RFCOMM frame reception ---- */
1048 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1049 {
1050 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1051
1052 if (dlci) {
1053 /* Data channel */
1054 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1055 if (!d) {
1056 rfcomm_send_dm(s, dlci);
1057 return 0;
1058 }
1059
1060 switch (d->state) {
1061 case BT_CONNECT:
1062 rfcomm_dlc_clear_timer(d);
1063
1064 rfcomm_dlc_lock(d);
1065 d->state = BT_CONNECTED;
1066 d->state_change(d, 0);
1067 rfcomm_dlc_unlock(d);
1068
1069 rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1070 break;
1071
1072 case BT_DISCONN:
1073 d->state = BT_CLOSED;
1074 __rfcomm_dlc_close(d, 0);
1075
1076 if (list_empty(&s->dlcs)) {
1077 s->state = BT_DISCONN;
1078 rfcomm_send_disc(s, 0);
1079 }
1080
1081 break;
1082 }
1083 } else {
1084 /* Control channel */
1085 switch (s->state) {
1086 case BT_CONNECT:
1087 s->state = BT_CONNECTED;
1088 rfcomm_process_connect(s);
1089 break;
1090
1091 case BT_DISCONN:
1092 rfcomm_session_put(s);
1093 break;
1094 }
1095 }
1096 return 0;
1097 }
1098
1099 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1100 {
1101 int err = 0;
1102
1103 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1104
1105 if (dlci) {
1106 /* Data DLC */
1107 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1108 if (d) {
1109 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1110 err = ECONNREFUSED;
1111 else
1112 err = ECONNRESET;
1113
1114 d->state = BT_CLOSED;
1115 __rfcomm_dlc_close(d, err);
1116 }
1117 } else {
1118 if (s->state == BT_CONNECT)
1119 err = ECONNREFUSED;
1120 else
1121 err = ECONNRESET;
1122
1123 s->state = BT_CLOSED;
1124 rfcomm_session_close(s, err);
1125 }
1126 return 0;
1127 }
1128
1129 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1130 {
1131 int err = 0;
1132
1133 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1134
1135 if (dlci) {
1136 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1137 if (d) {
1138 rfcomm_send_ua(s, dlci);
1139
1140 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1141 err = ECONNREFUSED;
1142 else
1143 err = ECONNRESET;
1144
1145 d->state = BT_CLOSED;
1146 __rfcomm_dlc_close(d, err);
1147 } else
1148 rfcomm_send_dm(s, dlci);
1149
1150 } else {
1151 rfcomm_send_ua(s, 0);
1152
1153 if (s->state == BT_CONNECT)
1154 err = ECONNREFUSED;
1155 else
1156 err = ECONNRESET;
1157
1158 s->state = BT_CLOSED;
1159 rfcomm_session_close(s, err);
1160 }
1161
1162 return 0;
1163 }
1164
1165 static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1166 {
1167 struct sock *sk = d->session->sock->sk;
1168
1169 BT_DBG("dlc %p", d);
1170
1171 rfcomm_send_ua(d->session, d->dlci);
1172
1173 rfcomm_dlc_lock(d);
1174 d->state = BT_CONNECTED;
1175 d->state_change(d, 0);
1176 rfcomm_dlc_unlock(d);
1177
1178 if (d->link_mode & RFCOMM_LM_MASTER)
1179 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1180
1181 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1182 }
1183
1184 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1185 {
1186 struct rfcomm_dlc *d;
1187 u8 channel;
1188
1189 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1190
1191 if (!dlci) {
1192 rfcomm_send_ua(s, 0);
1193
1194 if (s->state == BT_OPEN) {
1195 s->state = BT_CONNECTED;
1196 rfcomm_process_connect(s);
1197 }
1198 return 0;
1199 }
1200
1201 /* Check if DLC exists */
1202 d = rfcomm_dlc_get(s, dlci);
1203 if (d) {
1204 if (d->state == BT_OPEN) {
1205 /* DLC was previously opened by PN request */
1206 if (rfcomm_check_link_mode(d)) {
1207 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1208 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1209 } else
1210 rfcomm_dlc_accept(d);
1211 }
1212 return 0;
1213 }
1214
1215 /* Notify socket layer about incoming connection */
1216 channel = __srv_channel(dlci);
1217 if (rfcomm_connect_ind(s, channel, &d)) {
1218 d->dlci = dlci;
1219 d->addr = __addr(s->initiator, dlci);
1220 rfcomm_dlc_link(s, d);
1221
1222 if (rfcomm_check_link_mode(d)) {
1223 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1224 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1225 } else
1226 rfcomm_dlc_accept(d);
1227 } else {
1228 rfcomm_send_dm(s, dlci);
1229 }
1230
1231 return 0;
1232 }
1233
1234 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1235 {
1236 struct rfcomm_session *s = d->session;
1237
1238 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1239 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1240
1241 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1242 pn->flow_ctrl == 0xe0) {
1243 d->cfc = RFCOMM_CFC_ENABLED;
1244 d->tx_credits = pn->credits;
1245 } else {
1246 d->cfc = RFCOMM_CFC_DISABLED;
1247 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1248 }
1249
1250 if (s->cfc == RFCOMM_CFC_UNKNOWN)
1251 s->cfc = d->cfc;
1252
1253 d->priority = pn->priority;
1254
1255 d->mtu = btohs(pn->mtu);
1256
1257 if (cr && d->mtu > s->mtu)
1258 d->mtu = s->mtu;
1259
1260 return 0;
1261 }
1262
1263 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1264 {
1265 struct rfcomm_pn *pn = (void *) skb->data;
1266 struct rfcomm_dlc *d;
1267 u8 dlci = pn->dlci;
1268
1269 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1270
1271 if (!dlci)
1272 return 0;
1273
1274 d = rfcomm_dlc_get(s, dlci);
1275 if (d) {
1276 if (cr) {
1277 /* PN request */
1278 rfcomm_apply_pn(d, cr, pn);
1279 rfcomm_send_pn(s, 0, d);
1280 } else {
1281 /* PN response */
1282 switch (d->state) {
1283 case BT_CONFIG:
1284 rfcomm_apply_pn(d, cr, pn);
1285
1286 d->state = BT_CONNECT;
1287 rfcomm_send_sabm(s, d->dlci);
1288 break;
1289 }
1290 }
1291 } else {
1292 u8 channel = __srv_channel(dlci);
1293
1294 if (!cr)
1295 return 0;
1296
1297 /* PN request for non existing DLC.
1298 * Assume incoming connection. */
1299 if (rfcomm_connect_ind(s, channel, &d)) {
1300 d->dlci = dlci;
1301 d->addr = __addr(s->initiator, dlci);
1302 rfcomm_dlc_link(s, d);
1303
1304 rfcomm_apply_pn(d, cr, pn);
1305
1306 d->state = BT_OPEN;
1307 rfcomm_send_pn(s, 0, d);
1308 } else {
1309 rfcomm_send_dm(s, dlci);
1310 }
1311 }
1312 return 0;
1313 }
1314
1315 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1316 {
1317 struct rfcomm_rpn *rpn = (void *) skb->data;
1318 u8 dlci = __get_dlci(rpn->dlci);
1319
1320 u8 bit_rate = 0;
1321 u8 data_bits = 0;
1322 u8 stop_bits = 0;
1323 u8 parity = 0;
1324 u8 flow_ctrl = 0;
1325 u8 xon_char = 0;
1326 u8 xoff_char = 0;
1327 u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1328
1329 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1330 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1331 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1332
1333 if (!cr)
1334 return 0;
1335
1336 if (len == 1) {
1337 /* This is a request, return default settings */
1338 bit_rate = RFCOMM_RPN_BR_115200;
1339 data_bits = RFCOMM_RPN_DATA_8;
1340 stop_bits = RFCOMM_RPN_STOP_1;
1341 parity = RFCOMM_RPN_PARITY_NONE;
1342 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1343 xon_char = RFCOMM_RPN_XON_CHAR;
1344 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1345 goto rpn_out;
1346 }
1347
1348 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1349 * no parity, no flow control lines, normal XON/XOFF chars */
1350
1351 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1352 bit_rate = rpn->bit_rate;
1353 if (bit_rate != RFCOMM_RPN_BR_115200) {
1354 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1355 bit_rate = RFCOMM_RPN_BR_115200;
1356 rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1357 }
1358 }
1359
1360 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1361 data_bits = __get_rpn_data_bits(rpn->line_settings);
1362 if (data_bits != RFCOMM_RPN_DATA_8) {
1363 BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1364 data_bits = RFCOMM_RPN_DATA_8;
1365 rpn_mask ^= RFCOMM_RPN_PM_DATA;
1366 }
1367 }
1368
1369 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1370 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1371 if (stop_bits != RFCOMM_RPN_STOP_1) {
1372 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1373 stop_bits = RFCOMM_RPN_STOP_1;
1374 rpn_mask ^= RFCOMM_RPN_PM_STOP;
1375 }
1376 }
1377
1378 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1379 parity = __get_rpn_parity(rpn->line_settings);
1380 if (parity != RFCOMM_RPN_PARITY_NONE) {
1381 BT_DBG("RPN parity mismatch 0x%x", parity);
1382 parity = RFCOMM_RPN_PARITY_NONE;
1383 rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1384 }
1385 }
1386
1387 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1388 flow_ctrl = rpn->flow_ctrl;
1389 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1390 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1391 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1392 rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1393 }
1394 }
1395
1396 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1397 xon_char = rpn->xon_char;
1398 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1399 BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1400 xon_char = RFCOMM_RPN_XON_CHAR;
1401 rpn_mask ^= RFCOMM_RPN_PM_XON;
1402 }
1403 }
1404
1405 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1406 xoff_char = rpn->xoff_char;
1407 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1408 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1409 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1410 rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1411 }
1412 }
1413
1414 rpn_out:
1415 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1416 parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1417
1418 return 0;
1419 }
1420
1421 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1422 {
1423 struct rfcomm_rls *rls = (void *) skb->data;
1424 u8 dlci = __get_dlci(rls->dlci);
1425
1426 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1427
1428 if (!cr)
1429 return 0;
1430
1431 /* We should probably do something with this information here. But
1432 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1433 * mandatory to recognise and respond to RLS */
1434
1435 rfcomm_send_rls(s, 0, dlci, rls->status);
1436
1437 return 0;
1438 }
1439
1440 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1441 {
1442 struct rfcomm_msc *msc = (void *) skb->data;
1443 struct rfcomm_dlc *d;
1444 u8 dlci = __get_dlci(msc->dlci);
1445
1446 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1447
1448 d = rfcomm_dlc_get(s, dlci);
1449 if (!d)
1450 return 0;
1451
1452 if (cr) {
1453 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1454 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1455 else
1456 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1457
1458 rfcomm_dlc_lock(d);
1459
1460 d->remote_v24_sig = msc->v24_sig;
1461
1462 if (d->modem_status)
1463 d->modem_status(d, msc->v24_sig);
1464
1465 rfcomm_dlc_unlock(d);
1466
1467 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1468
1469 d->mscex |= RFCOMM_MSCEX_RX;
1470 } else
1471 d->mscex |= RFCOMM_MSCEX_TX;
1472
1473 return 0;
1474 }
1475
1476 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1477 {
1478 struct rfcomm_mcc *mcc = (void *) skb->data;
1479 u8 type, cr, len;
1480
1481 cr = __test_cr(mcc->type);
1482 type = __get_mcc_type(mcc->type);
1483 len = __get_mcc_len(mcc->len);
1484
1485 BT_DBG("%p type 0x%x cr %d", s, type, cr);
1486
1487 skb_pull(skb, 2);
1488
1489 switch (type) {
1490 case RFCOMM_PN:
1491 rfcomm_recv_pn(s, cr, skb);
1492 break;
1493
1494 case RFCOMM_RPN:
1495 rfcomm_recv_rpn(s, cr, len, skb);
1496 break;
1497
1498 case RFCOMM_RLS:
1499 rfcomm_recv_rls(s, cr, skb);
1500 break;
1501
1502 case RFCOMM_MSC:
1503 rfcomm_recv_msc(s, cr, skb);
1504 break;
1505
1506 case RFCOMM_FCOFF:
1507 if (cr) {
1508 set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1509 rfcomm_send_fcoff(s, 0);
1510 }
1511 break;
1512
1513 case RFCOMM_FCON:
1514 if (cr) {
1515 clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1516 rfcomm_send_fcon(s, 0);
1517 }
1518 break;
1519
1520 case RFCOMM_TEST:
1521 if (cr)
1522 rfcomm_send_test(s, 0, skb->data, skb->len);
1523 break;
1524
1525 case RFCOMM_NSC:
1526 break;
1527
1528 default:
1529 BT_ERR("Unknown control type 0x%02x", type);
1530 rfcomm_send_nsc(s, cr, type);
1531 break;
1532 }
1533 return 0;
1534 }
1535
1536 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1537 {
1538 struct rfcomm_dlc *d;
1539
1540 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1541
1542 d = rfcomm_dlc_get(s, dlci);
1543 if (!d) {
1544 rfcomm_send_dm(s, dlci);
1545 goto drop;
1546 }
1547
1548 if (pf && d->cfc) {
1549 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1550
1551 d->tx_credits += credits;
1552 if (d->tx_credits)
1553 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1554 }
1555
1556 if (skb->len && d->state == BT_CONNECTED) {
1557 rfcomm_dlc_lock(d);
1558 d->rx_credits--;
1559 d->data_ready(d, skb);
1560 rfcomm_dlc_unlock(d);
1561 return 0;
1562 }
1563
1564 drop:
1565 kfree_skb(skb);
1566 return 0;
1567 }
1568
1569 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1570 {
1571 struct rfcomm_hdr *hdr = (void *) skb->data;
1572 u8 type, dlci, fcs;
1573
1574 dlci = __get_dlci(hdr->addr);
1575 type = __get_type(hdr->ctrl);
1576
1577 /* Trim FCS */
1578 skb->len--; skb->tail--;
1579 fcs = *(u8 *)skb_tail_pointer(skb);
1580
1581 if (__check_fcs(skb->data, type, fcs)) {
1582 BT_ERR("bad checksum in packet");
1583 kfree_skb(skb);
1584 return -EILSEQ;
1585 }
1586
1587 if (__test_ea(hdr->len))
1588 skb_pull(skb, 3);
1589 else
1590 skb_pull(skb, 4);
1591
1592 switch (type) {
1593 case RFCOMM_SABM:
1594 if (__test_pf(hdr->ctrl))
1595 rfcomm_recv_sabm(s, dlci);
1596 break;
1597
1598 case RFCOMM_DISC:
1599 if (__test_pf(hdr->ctrl))
1600 rfcomm_recv_disc(s, dlci);
1601 break;
1602
1603 case RFCOMM_UA:
1604 if (__test_pf(hdr->ctrl))
1605 rfcomm_recv_ua(s, dlci);
1606 break;
1607
1608 case RFCOMM_DM:
1609 rfcomm_recv_dm(s, dlci);
1610 break;
1611
1612 case RFCOMM_UIH:
1613 if (dlci)
1614 return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1615
1616 rfcomm_recv_mcc(s, skb);
1617 break;
1618
1619 default:
1620 BT_ERR("Unknown packet type 0x%02x\n", type);
1621 break;
1622 }
1623 kfree_skb(skb);
1624 return 0;
1625 }
1626
1627 /* ---- Connection and data processing ---- */
1628
1629 static void rfcomm_process_connect(struct rfcomm_session *s)
1630 {
1631 struct rfcomm_dlc *d;
1632 struct list_head *p, *n;
1633
1634 BT_DBG("session %p state %ld", s, s->state);
1635
1636 list_for_each_safe(p, n, &s->dlcs) {
1637 d = list_entry(p, struct rfcomm_dlc, list);
1638 if (d->state == BT_CONFIG) {
1639 d->mtu = s->mtu;
1640 if (rfcomm_check_link_mode(d)) {
1641 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1642 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1643 } else
1644 rfcomm_send_pn(s, 1, d);
1645 }
1646 }
1647 }
1648
1649 /* Send data queued for the DLC.
1650 * Return number of frames left in the queue.
1651 */
1652 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1653 {
1654 struct sk_buff *skb;
1655 int err;
1656
1657 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1658 d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1659
1660 /* Send pending MSC */
1661 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1662 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1663
1664 if (d->cfc) {
1665 /* CFC enabled.
1666 * Give them some credits */
1667 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1668 d->rx_credits <= (d->cfc >> 2)) {
1669 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1670 d->rx_credits = d->cfc;
1671 }
1672 } else {
1673 /* CFC disabled.
1674 * Give ourselves some credits */
1675 d->tx_credits = 5;
1676 }
1677
1678 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1679 return skb_queue_len(&d->tx_queue);
1680
1681 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1682 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1683 if (err < 0) {
1684 skb_queue_head(&d->tx_queue, skb);
1685 break;
1686 }
1687 kfree_skb(skb);
1688 d->tx_credits--;
1689 }
1690
1691 if (d->cfc && !d->tx_credits) {
1692 /* We're out of TX credits.
1693 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1694 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1695 }
1696
1697 return skb_queue_len(&d->tx_queue);
1698 }
1699
1700 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1701 {
1702 struct rfcomm_dlc *d;
1703 struct list_head *p, *n;
1704
1705 BT_DBG("session %p state %ld", s, s->state);
1706
1707 list_for_each_safe(p, n, &s->dlcs) {
1708 d = list_entry(p, struct rfcomm_dlc, list);
1709
1710 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1711 __rfcomm_dlc_close(d, ETIMEDOUT);
1712 continue;
1713 }
1714
1715 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1716 rfcomm_dlc_clear_timer(d);
1717 if (d->out) {
1718 rfcomm_send_pn(s, 1, d);
1719 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1720 } else
1721 rfcomm_dlc_accept(d);
1722 if (d->link_mode & RFCOMM_LM_SECURE) {
1723 struct sock *sk = s->sock->sk;
1724 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
1725 }
1726 continue;
1727 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1728 rfcomm_dlc_clear_timer(d);
1729 if (!d->out)
1730 rfcomm_send_dm(s, d->dlci);
1731 else
1732 d->state = BT_CLOSED;
1733 __rfcomm_dlc_close(d, ECONNREFUSED);
1734 continue;
1735 }
1736
1737 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1738 continue;
1739
1740 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1741 d->mscex == RFCOMM_MSCEX_OK)
1742 rfcomm_process_tx(d);
1743 }
1744 }
1745
1746 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1747 {
1748 struct socket *sock = s->sock;
1749 struct sock *sk = sock->sk;
1750 struct sk_buff *skb;
1751
1752 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1753
1754 /* Get data directly from socket receive queue without copying it. */
1755 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1756 skb_orphan(skb);
1757 rfcomm_recv_frame(s, skb);
1758 }
1759
1760 if (sk->sk_state == BT_CLOSED) {
1761 if (!s->initiator)
1762 rfcomm_session_put(s);
1763
1764 rfcomm_session_close(s, sk->sk_err);
1765 }
1766 }
1767
1768 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1769 {
1770 struct socket *sock = s->sock, *nsock;
1771 int err;
1772
1773 /* Fast check for a new connection.
1774 * Avoids unnesesary socket allocations. */
1775 if (list_empty(&bt_sk(sock->sk)->accept_q))
1776 return;
1777
1778 BT_DBG("session %p", s);
1779
1780 err = kernel_accept(sock, &nsock, O_NONBLOCK);
1781 if (err < 0)
1782 return;
1783
1784 /* Set our callbacks */
1785 nsock->sk->sk_data_ready = rfcomm_l2data_ready;
1786 nsock->sk->sk_state_change = rfcomm_l2state_change;
1787
1788 s = rfcomm_session_add(nsock, BT_OPEN);
1789 if (s) {
1790 rfcomm_session_hold(s);
1791
1792 /* We should adjust MTU on incoming sessions.
1793 * L2CAP MTU minus UIH header and FCS. */
1794 s->mtu = min(l2cap_pi(nsock->sk)->omtu, l2cap_pi(nsock->sk)->imtu) - 5;
1795
1796 rfcomm_schedule(RFCOMM_SCHED_RX);
1797 } else
1798 sock_release(nsock);
1799 }
1800
1801 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1802 {
1803 struct sock *sk = s->sock->sk;
1804
1805 BT_DBG("%p state %ld", s, s->state);
1806
1807 switch(sk->sk_state) {
1808 case BT_CONNECTED:
1809 s->state = BT_CONNECT;
1810
1811 /* We can adjust MTU on outgoing sessions.
1812 * L2CAP MTU minus UIH header and FCS. */
1813 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1814
1815 rfcomm_send_sabm(s, 0);
1816 break;
1817
1818 case BT_CLOSED:
1819 s->state = BT_CLOSED;
1820 rfcomm_session_close(s, sk->sk_err);
1821 break;
1822 }
1823 }
1824
1825 static inline void rfcomm_process_sessions(void)
1826 {
1827 struct list_head *p, *n;
1828
1829 rfcomm_lock();
1830
1831 list_for_each_safe(p, n, &session_list) {
1832 struct rfcomm_session *s;
1833 s = list_entry(p, struct rfcomm_session, list);
1834
1835 if (s->state == BT_LISTEN) {
1836 rfcomm_accept_connection(s);
1837 continue;
1838 }
1839
1840 rfcomm_session_hold(s);
1841
1842 switch (s->state) {
1843 case BT_BOUND:
1844 rfcomm_check_connection(s);
1845 break;
1846
1847 default:
1848 rfcomm_process_rx(s);
1849 break;
1850 }
1851
1852 rfcomm_process_dlcs(s);
1853
1854 rfcomm_session_put(s);
1855 }
1856
1857 rfcomm_unlock();
1858 }
1859
1860 static int rfcomm_add_listener(bdaddr_t *ba)
1861 {
1862 struct sockaddr_l2 addr;
1863 struct socket *sock;
1864 struct sock *sk;
1865 struct rfcomm_session *s;
1866 int err = 0;
1867
1868 /* Create socket */
1869 err = rfcomm_l2sock_create(&sock);
1870 if (err < 0) {
1871 BT_ERR("Create socket failed %d", err);
1872 return err;
1873 }
1874
1875 /* Bind socket */
1876 bacpy(&addr.l2_bdaddr, ba);
1877 addr.l2_family = AF_BLUETOOTH;
1878 addr.l2_psm = htobs(RFCOMM_PSM);
1879 err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1880 if (err < 0) {
1881 BT_ERR("Bind failed %d", err);
1882 goto failed;
1883 }
1884
1885 /* Set L2CAP options */
1886 sk = sock->sk;
1887 lock_sock(sk);
1888 l2cap_pi(sk)->imtu = l2cap_mtu;
1889 release_sock(sk);
1890
1891 /* Start listening on the socket */
1892 err = kernel_listen(sock, 10);
1893 if (err) {
1894 BT_ERR("Listen failed %d", err);
1895 goto failed;
1896 }
1897
1898 /* Add listening session */
1899 s = rfcomm_session_add(sock, BT_LISTEN);
1900 if (!s)
1901 goto failed;
1902
1903 rfcomm_session_hold(s);
1904 return 0;
1905 failed:
1906 sock_release(sock);
1907 return err;
1908 }
1909
1910 static void rfcomm_kill_listener(void)
1911 {
1912 struct rfcomm_session *s;
1913 struct list_head *p, *n;
1914
1915 BT_DBG("");
1916
1917 list_for_each_safe(p, n, &session_list) {
1918 s = list_entry(p, struct rfcomm_session, list);
1919 rfcomm_session_del(s);
1920 }
1921 }
1922
1923 static int rfcomm_run(void *unused)
1924 {
1925 BT_DBG("");
1926
1927 set_user_nice(current, -10);
1928
1929 rfcomm_add_listener(BDADDR_ANY);
1930
1931 while (!kthread_should_stop()) {
1932 set_current_state(TASK_INTERRUPTIBLE);
1933 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1934 /* No pending events. Let's sleep.
1935 * Incoming connections and data will wake us up. */
1936 schedule();
1937 }
1938 set_current_state(TASK_RUNNING);
1939
1940 /* Process stuff */
1941 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1942 rfcomm_process_sessions();
1943 }
1944
1945 rfcomm_kill_listener();
1946
1947 return 0;
1948 }
1949
1950 static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
1951 {
1952 struct rfcomm_session *s;
1953 struct rfcomm_dlc *d;
1954 struct list_head *p, *n;
1955
1956 BT_DBG("conn %p status 0x%02x", conn, status);
1957
1958 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1959 if (!s)
1960 return;
1961
1962 rfcomm_session_hold(s);
1963
1964 list_for_each_safe(p, n, &s->dlcs) {
1965 d = list_entry(p, struct rfcomm_dlc, list);
1966
1967 if ((d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) &&
1968 !(conn->link_mode & HCI_LM_ENCRYPT) && !status)
1969 continue;
1970
1971 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1972 continue;
1973
1974 if (!status)
1975 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1976 else
1977 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1978 }
1979
1980 rfcomm_session_put(s);
1981
1982 rfcomm_schedule(RFCOMM_SCHED_AUTH);
1983 }
1984
1985 static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1986 {
1987 struct rfcomm_session *s;
1988 struct rfcomm_dlc *d;
1989 struct list_head *p, *n;
1990
1991 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
1992
1993 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1994 if (!s)
1995 return;
1996
1997 rfcomm_session_hold(s);
1998
1999 list_for_each_safe(p, n, &s->dlcs) {
2000 d = list_entry(p, struct rfcomm_dlc, list);
2001
2002 if ((d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) &&
2003 (d->state == BT_CONNECTED ||
2004 d->state == BT_CONFIG) &&
2005 !status && encrypt == 0x00) {
2006 __rfcomm_dlc_close(d, ECONNREFUSED);
2007 continue;
2008 }
2009
2010 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2011 continue;
2012
2013 if (!status && encrypt)
2014 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2015 else
2016 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2017 }
2018
2019 rfcomm_session_put(s);
2020
2021 rfcomm_schedule(RFCOMM_SCHED_AUTH);
2022 }
2023
2024 static struct hci_cb rfcomm_cb = {
2025 .name = "RFCOMM",
2026 .auth_cfm = rfcomm_auth_cfm,
2027 .encrypt_cfm = rfcomm_encrypt_cfm
2028 };
2029
2030 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2031 {
2032 struct rfcomm_session *s;
2033 struct list_head *pp, *p;
2034 char *str = buf;
2035
2036 rfcomm_lock();
2037
2038 list_for_each(p, &session_list) {
2039 s = list_entry(p, struct rfcomm_session, list);
2040 list_for_each(pp, &s->dlcs) {
2041 struct sock *sk = s->sock->sk;
2042 struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2043
2044 str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2045 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2046 d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2047 }
2048 }
2049
2050 rfcomm_unlock();
2051
2052 return (str - buf);
2053 }
2054
2055 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2056
2057 /* ---- Initialization ---- */
2058 static int __init rfcomm_init(void)
2059 {
2060 l2cap_load();
2061
2062 hci_register_cb(&rfcomm_cb);
2063
2064 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2065 if (IS_ERR(rfcomm_thread)) {
2066 hci_unregister_cb(&rfcomm_cb);
2067 return PTR_ERR(rfcomm_thread);
2068 }
2069
2070 if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2071 BT_ERR("Failed to create RFCOMM info file");
2072
2073 rfcomm_init_sockets();
2074
2075 #ifdef CONFIG_BT_RFCOMM_TTY
2076 rfcomm_init_ttys();
2077 #endif
2078
2079 BT_INFO("RFCOMM ver %s", VERSION);
2080
2081 return 0;
2082 }
2083
2084 static void __exit rfcomm_exit(void)
2085 {
2086 class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2087
2088 hci_unregister_cb(&rfcomm_cb);
2089
2090 kthread_stop(rfcomm_thread);
2091
2092 #ifdef CONFIG_BT_RFCOMM_TTY
2093 rfcomm_cleanup_ttys();
2094 #endif
2095
2096 rfcomm_cleanup_sockets();
2097 }
2098
2099 module_init(rfcomm_init);
2100 module_exit(rfcomm_exit);
2101
2102 module_param(disable_cfc, bool, 0644);
2103 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2104
2105 module_param(channel_mtu, int, 0644);
2106 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2107
2108 module_param(l2cap_mtu, uint, 0644);
2109 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2110
2111 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2112 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2113 MODULE_VERSION(VERSION);
2114 MODULE_LICENSE("GPL");
2115 MODULE_ALIAS("bt-proto-3");
Linux with added FPC-III support