projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge tag 'v4.5-rc5' into asoc-mtk
[deliverable/linux.git] / net / bluetooth / rfcomm / core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
8e87d142
YH		 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 21 SOFTWARE IS DISCLAIMED.
22*/
23
1da177e4
LT		 24/*
25 * Bluetooth RFCOMM core.
1da177e4
LT		 26 */
27
1da177e4 28#include <linux/module.h>
aef7d97c 29#include <linux/debugfs.h>
a524eccc 30#include <linux/kthread.h>
1da177e4
LT		 31#include <asm/unaligned.h>
32
33#include <net/bluetooth/bluetooth.h>
34#include <net/bluetooth/hci_core.h>
35#include <net/bluetooth/l2cap.h>
36#include <net/bluetooth/rfcomm.h>
37
5f9018af 38#define VERSION "1.11"
56f3a40a 39
eb939922
RR		 40static bool disable_cfc;
41static bool l2cap_ertm;
98bcd08b 42static int channel_mtu = -1;
56f3a40a
MH		 43static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
44
1da177e4
LT		 45static struct task_struct *rfcomm_thread;
46
4a3e2f71
AV		 47static DEFINE_MUTEX(rfcomm_mutex);
48#define rfcomm_lock() mutex_lock(&rfcomm_mutex)
49#define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
1da177e4 50
1da177e4
LT		 51
52static LIST_HEAD(session_list);
1da177e4 53
5436538f 54static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
1da177e4
LT		 55static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
56static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
57static int rfcomm_queue_disc(struct rfcomm_dlc *d);
58static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
59static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
60static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
61static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
62static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
63static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
64
65static void rfcomm_process_connect(struct rfcomm_session *s);
66
63ce0900
LAD		 67static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
68 bdaddr_t *dst,
69 u8 sec_level,
70 int *err);
1da177e4 71static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
8ff52f7d 72static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s);
1da177e4
LT		 73
74/* ---- RFCOMM frame parsing macros ---- */
75#define __get_dlci(b) ((b & 0xfc) >> 2)
76#define __get_channel(b) ((b & 0xf8) >> 3)
77#define __get_dir(b) ((b & 0x04) >> 2)
78#define __get_type(b) ((b & 0xef))
79
80#define __test_ea(b) ((b & 0x01))
ec511545 81#define __test_cr(b) (!!(b & 0x02))
15346a9c 82#define __test_pf(b) (!!(b & 0x10))
1da177e4 83
2a68c897 84#define __session_dir(s) ((s)->initiator ? 0x00 : 0x01)
1da177e4
LT		 85
86#define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
87#define __ctrl(type, pf) (((type & 0xef) | (pf << 4)))
88#define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir)
89#define __srv_channel(dlci) (dlci >> 1)
90#define __dir(dlci) (dlci & 0x01)
91
92#define __len8(len) (((len) << 1) | 1)
93#define __len16(len) ((len) << 1)
94
95/* MCC macros */
96#define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01))
97#define __get_mcc_type(b) ((b & 0xfc) >> 2)
98#define __get_mcc_len(b) ((b & 0xfe) >> 1)
99
100/* RPN macros */
3a5e903c 101#define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
1da177e4
LT		 102#define __get_rpn_data_bits(line) ((line) & 0x3)
103#define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
3a5e903c 104#define __get_rpn_parity(line) (((line) >> 3) & 0x7)
1da177e4 105
eedf7e47
PZ		 106static DECLARE_WAIT_QUEUE_HEAD(rfcomm_wq);
107
6039aa73 108static void rfcomm_schedule(void)
1da177e4 109{
eedf7e47 110 wake_up_all(&rfcomm_wq);
1da177e4
LT		 111}
112
1da177e4
LT		 113/* ---- RFCOMM FCS computation ---- */
114
408c1ce2 115/* reversed, 8-bit, poly=0x07 */
8e87d142 116static unsigned char rfcomm_crc_table[256] = {
408c1ce2
MH		 117 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
118 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
119 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
120 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
121
122 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
123 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
124 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
125 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
126
127 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
128 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
129 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
130 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
131
132 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
133 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
134 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
135 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
136
137 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
138 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
139 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
140 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
141
142 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
143 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
144 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
145 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
146
147 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
148 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
149 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
150 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
151
152 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
153 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
154 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
155 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
156};
157
1da177e4
LT		 158/* CRC on 2 bytes */
159#define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
160
8e87d142 161/* FCS on 2 bytes */
1da177e4
LT		 162static inline u8 __fcs(u8 *data)
163{
a02cec21 164 return 0xff - __crc(data);
1da177e4
LT		 165}
166
8e87d142 167/* FCS on 3 bytes */
1da177e4
LT		 168static inline u8 __fcs2(u8 *data)
169{
a02cec21 170 return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
1da177e4
LT		 171}
172
173/* Check FCS */
174static inline int __check_fcs(u8 *data, int type, u8 fcs)
175{
176 u8 f = __crc(data);
177
178 if (type != RFCOMM_UIH)
179 f = rfcomm_crc_table[f ^ data[2]];
180
181 return rfcomm_crc_table[f ^ fcs] != 0xcf;
182}
183
184/* ---- L2CAP callbacks ---- */
185static void rfcomm_l2state_change(struct sock *sk)
186{
187 BT_DBG("%p state %d", sk, sk->sk_state);
534c92fd 188 rfcomm_schedule();
1da177e4
LT		 189}
190
676d2369 191static void rfcomm_l2data_ready(struct sock *sk)
1da177e4 192{
676d2369 193 BT_DBG("%p", sk);
534c92fd 194 rfcomm_schedule();
1da177e4
LT		 195}
196
197static int rfcomm_l2sock_create(struct socket **sock)
198{
199 int err;
200
201 BT_DBG("");
202
eeb1bd5c 203 err = sock_create_kern(&init_net, PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
1da177e4
LT		 204 if (!err) {
205 struct sock *sk = (*sock)->sk;
206 sk->sk_data_ready = rfcomm_l2data_ready;
207 sk->sk_state_change = rfcomm_l2state_change;
208 }
209 return err;
210}
211
6039aa73 212static int rfcomm_check_security(struct rfcomm_dlc *d)
77db1980
MH		 213{
214 struct sock *sk = d->session->sock->sk;
8c1d787b
GP		 215 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
216
0684e5f9
MH		 217 __u8 auth_type;
218
219 switch (d->sec_level) {
220 case BT_SECURITY_HIGH:
2c068e0b 221 case BT_SECURITY_FIPS:
0684e5f9
MH		 222 auth_type = HCI_AT_GENERAL_BONDING_MITM;
223 break;
224 case BT_SECURITY_MEDIUM:
225 auth_type = HCI_AT_GENERAL_BONDING;
226 break;
227 default:
228 auth_type = HCI_AT_NO_BONDING;
229 break;
230 }
77db1980 231
e7cafc45
JH		 232 return hci_conn_security(conn->hcon, d->sec_level, auth_type,
233 d->out);
77db1980
MH		 234}
235
9e726b17
LAD		 236static void rfcomm_session_timeout(unsigned long arg)
237{
238 struct rfcomm_session *s = (void *) arg;
239
240 BT_DBG("session %p state %ld", s, s->state);
241
242 set_bit(RFCOMM_TIMED_OUT, &s->flags);
534c92fd 243 rfcomm_schedule();
9e726b17
LAD		 244}
245
246static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
247{
248 BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
249
08c30aca 250 mod_timer(&s->timer, jiffies + timeout);
9e726b17
LAD		 251}
252
253static void rfcomm_session_clear_timer(struct rfcomm_session *s)
254{
255 BT_DBG("session %p state %ld", s, s->state);
256
08c30aca 257 del_timer_sync(&s->timer);
9e726b17
LAD		 258}
259
1da177e4
LT		 260/* ---- RFCOMM DLCs ---- */
261static void rfcomm_dlc_timeout(unsigned long arg)
262{
263 struct rfcomm_dlc *d = (void *) arg;
264
265 BT_DBG("dlc %p state %ld", d, d->state);
266
267 set_bit(RFCOMM_TIMED_OUT, &d->flags);
268 rfcomm_dlc_put(d);
534c92fd 269 rfcomm_schedule();
1da177e4
LT		 270}
271
272static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
273{
274 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
275
276 if (!mod_timer(&d->timer, jiffies + timeout))
277 rfcomm_dlc_hold(d);
278}
279
280static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
281{
282 BT_DBG("dlc %p state %ld", d, d->state);
283
25cc4ae9 284 if (del_timer(&d->timer))
1da177e4
LT		 285 rfcomm_dlc_put(d);
286}
287
288static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
289{
290 BT_DBG("%p", d);
291
292 d->state = BT_OPEN;
293 d->flags = 0;
294 d->mscex = 0;
183f732c 295 d->sec_level = BT_SECURITY_LOW;
1da177e4
LT		 296 d->mtu = RFCOMM_DEFAULT_MTU;
297 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
298
299 d->cfc = RFCOMM_CFC_DISABLED;
300 d->rx_credits = RFCOMM_DEFAULT_CREDITS;
301}
302
dd0fc66f 303struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
1da177e4 304{
25ea6db0
MH		 305 struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
306
1da177e4
LT		 307 if (!d)
308 return NULL;
1da177e4 309
b24b8a24 310 setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
1da177e4
LT		 311
312 skb_queue_head_init(&d->tx_queue);
86aae6c7 313 mutex_init(&d->lock);
1da177e4
LT		 314 atomic_set(&d->refcnt, 1);
315
316 rfcomm_dlc_clear_state(d);
8e87d142 317
1da177e4 318 BT_DBG("%p", d);
25ea6db0 319
1da177e4
LT		 320 return d;
321}
322
323void rfcomm_dlc_free(struct rfcomm_dlc *d)
324{
325 BT_DBG("%p", d);
326
327 skb_queue_purge(&d->tx_queue);
328 kfree(d);
329}
330
331static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
332{
333 BT_DBG("dlc %p session %p", d, s);
334
9e726b17 335 rfcomm_session_clear_timer(s);
1da177e4
LT		 336 rfcomm_dlc_hold(d);
337 list_add(&d->list, &s->dlcs);
338 d->session = s;
339}
340
341static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
342{
343 struct rfcomm_session *s = d->session;
344
345 BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
346
347 list_del(&d->list);
348 d->session = NULL;
349 rfcomm_dlc_put(d);
350
9e726b17
LAD		 351 if (list_empty(&s->dlcs))
352 rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
1da177e4
LT		 353}
354
355static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
356{
357 struct rfcomm_dlc *d;
1da177e4 358
8035ded4 359 list_for_each_entry(d, &s->dlcs, list)
1da177e4
LT		 360 if (d->dlci == dlci)
361 return d;
8035ded4 362
1da177e4
LT		 363 return NULL;
364}
365
c10a848c
PH		 366static int rfcomm_check_channel(u8 channel)
367{
368 return channel < 1 || channel > 30;
369}
370
1da177e4
LT		 371static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
372{
373 struct rfcomm_session *s;
374 int err = 0;
375 u8 dlci;
376
6ed93dc6
AE		 377 BT_DBG("dlc %p state %ld %pMR -> %pMR channel %d",
378 d, d->state, src, dst, channel);
1da177e4 379
c10a848c 380 if (rfcomm_check_channel(channel))
1da177e4
LT		 381 return -EINVAL;
382
383 if (d->state != BT_OPEN && d->state != BT_CLOSED)
384 return 0;
385
386 s = rfcomm_session_get(src, dst);
387 if (!s) {
63ce0900 388 s = rfcomm_session_create(src, dst, d->sec_level, &err);
1da177e4
LT		 389 if (!s)
390 return err;
391 }
392
2a68c897 393 dlci = __dlci(__session_dir(s), channel);
1da177e4
LT		 394
395 /* Check if DLCI already exists */
396 if (rfcomm_dlc_get(s, dlci))
397 return -EBUSY;
398
399 rfcomm_dlc_clear_state(d);
400
401 d->dlci = dlci;
402 d->addr = __addr(s->initiator, dlci);
403 d->priority = 7;
404
77db1980 405 d->state = BT_CONFIG;
1da177e4
LT		 406 rfcomm_dlc_link(s, d);
407
77db1980
MH		 408 d->out = 1;
409
1da177e4
LT		 410 d->mtu = s->mtu;
411 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
412
77db1980 413 if (s->state == BT_CONNECTED) {
9f2c8a03 414 if (rfcomm_check_security(d))
77db1980 415 rfcomm_send_pn(s, 1, d);
8c1b2355
MH		 416 else
417 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
77db1980
MH		 418 }
419
1da177e4 420 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
77db1980 421
1da177e4
LT		 422 return 0;
423}
424
425int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
426{
427 int r;
428
429 rfcomm_lock();
430
431 r = __rfcomm_dlc_open(d, src, dst, channel);
432
433 rfcomm_unlock();
434 return r;
435}
436
f622357a
PH		 437static void __rfcomm_dlc_disconn(struct rfcomm_dlc *d)
438{
439 struct rfcomm_session *s = d->session;
440
441 d->state = BT_DISCONN;
442 if (skb_queue_empty(&d->tx_queue)) {
443 rfcomm_send_disc(s, d->dlci);
444 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
445 } else {
446 rfcomm_queue_disc(d);
447 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
448 }
449}
450
1da177e4
LT		 451static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
452{
453 struct rfcomm_session *s = d->session;
454 if (!s)
455 return 0;
456
457 BT_DBG("dlc %p state %ld dlci %d err %d session %p",
458 d, d->state, d->dlci, err, s);
459
460 switch (d->state) {
1da177e4 461 case BT_CONNECT:
bb23c0ab 462 case BT_CONFIG:
5998e040
PH		 463 case BT_OPEN:
464 case BT_CONNECT2:
bb23c0ab
MH		 465 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
466 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
534c92fd 467 rfcomm_schedule();
5998e040 468 return 0;
bb23c0ab 469 }
5998e040
PH		 470 }
471
472 switch (d->state) {
473 case BT_CONNECT:
bb23c0ab 474 case BT_CONNECTED:
f622357a 475 __rfcomm_dlc_disconn(d);
1da177e4
LT		 476 break;
477
c4fd318d
PH		 478 case BT_CONFIG:
479 if (s->state != BT_BOUND) {
480 __rfcomm_dlc_disconn(d);
481 break;
482 }
483 /* if closing a dlc in a session that hasn't been started,
484 * just close and unlink the dlc
485 */
486
1da177e4
LT		 487 default:
488 rfcomm_dlc_clear_timer(d);
489
490 rfcomm_dlc_lock(d);
491 d->state = BT_CLOSED;
1905f6c7 492 d->state_change(d, err);
4c8411f8 493 rfcomm_dlc_unlock(d);
1da177e4
LT		 494
495 skb_queue_purge(&d->tx_queue);
1da177e4
LT		 496 rfcomm_dlc_unlink(d);
497 }
498
499 return 0;
500}
501
502int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
503{
c06f7d53
DJ		 504 int r = 0;
505 struct rfcomm_dlc *d_list;
506 struct rfcomm_session *s, *s_list;
507
508 BT_DBG("dlc %p state %ld dlci %d err %d", d, d->state, d->dlci, err);
1da177e4
LT		 509
510 rfcomm_lock();
511
c06f7d53
DJ		 512 s = d->session;
513 if (!s)
514 goto no_session;
515
516 /* after waiting on the mutex check the session still exists
517 * then check the dlc still exists
518 */
519 list_for_each_entry(s_list, &session_list, list) {
520 if (s_list == s) {
521 list_for_each_entry(d_list, &s->dlcs, list) {
522 if (d_list == d) {
523 r = __rfcomm_dlc_close(d, err);
524 break;
525 }
526 }
527 break;
528 }
529 }
1da177e4 530
c06f7d53 531no_session:
1da177e4
LT		 532 rfcomm_unlock();
533 return r;
534}
535
c10a848c
PH		 536struct rfcomm_dlc *rfcomm_dlc_exists(bdaddr_t *src, bdaddr_t *dst, u8 channel)
537{
538 struct rfcomm_session *s;
539 struct rfcomm_dlc *dlc = NULL;
540 u8 dlci;
541
542 if (rfcomm_check_channel(channel))
543 return ERR_PTR(-EINVAL);
544
545 rfcomm_lock();
546 s = rfcomm_session_get(src, dst);
547 if (s) {
2a68c897 548 dlci = __dlci(__session_dir(s), channel);
c10a848c
PH		 549 dlc = rfcomm_dlc_get(s, dlci);
550 }
551 rfcomm_unlock();
552 return dlc;
553}
554
1da177e4
LT		 555int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
556{
557 int len = skb->len;
558
559 if (d->state != BT_CONNECTED)
560 return -ENOTCONN;
561
562 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
563
564 if (len > d->mtu)
565 return -EINVAL;
566
567 rfcomm_make_uih(skb, d->addr);
568 skb_queue_tail(&d->tx_queue, skb);
569
570 if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
534c92fd 571 rfcomm_schedule();
1da177e4
LT		 572 return len;
573}
574
72e5108c
PH		 575void rfcomm_dlc_send_noerror(struct rfcomm_dlc *d, struct sk_buff *skb)
576{
577 int len = skb->len;
578
579 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
580
581 rfcomm_make_uih(skb, d->addr);
582 skb_queue_tail(&d->tx_queue, skb);
583
584 if (d->state == BT_CONNECTED &&
585 !test_bit(RFCOMM_TX_THROTTLED, &d->flags))
586 rfcomm_schedule();
587}
588
b5606c2d 589void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
1da177e4
LT		 590{
591 BT_DBG("dlc %p state %ld", d, d->state);
592
593 if (!d->cfc) {
594 d->v24_sig |= RFCOMM_V24_FC;
595 set_bit(RFCOMM_MSC_PENDING, &d->flags);
596 }
534c92fd 597 rfcomm_schedule();
1da177e4
LT		 598}
599
b5606c2d 600void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
1da177e4
LT		 601{
602 BT_DBG("dlc %p state %ld", d, d->state);
603
604 if (!d->cfc) {
605 d->v24_sig &= ~RFCOMM_V24_FC;
606 set_bit(RFCOMM_MSC_PENDING, &d->flags);
607 }
534c92fd 608 rfcomm_schedule();
1da177e4
LT		 609}
610
8e87d142 611/*
1da177e4
LT		 612 Set/get modem status functions use _local_ status i.e. what we report
613 to the other side.
614 Remote status is provided by dlc->modem_status() callback.
615 */
616int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
617{
8e87d142 618 BT_DBG("dlc %p state %ld v24_sig 0x%x",
1da177e4
LT		 619 d, d->state, v24_sig);
620
621 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
622 v24_sig |= RFCOMM_V24_FC;
623 else
624 v24_sig &= ~RFCOMM_V24_FC;
8e87d142 625
1da177e4
LT		 626 d->v24_sig = v24_sig;
627
628 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
534c92fd 629 rfcomm_schedule();
1da177e4
LT		 630
631 return 0;
632}
633
634int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
635{
8e87d142 636 BT_DBG("dlc %p state %ld v24_sig 0x%x",
1da177e4
LT		 637 d, d->state, d->v24_sig);
638
639 *v24_sig = d->v24_sig;
640 return 0;
641}
642
643/* ---- RFCOMM sessions ---- */
644static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
645{
25ea6db0
MH		 646 struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
647
1da177e4
LT		 648 if (!s)
649 return NULL;
1da177e4
LT		 650
651 BT_DBG("session %p sock %p", s, sock);
652
9e726b17
LAD		 653 setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
654
1da177e4
LT		 655 INIT_LIST_HEAD(&s->dlcs);
656 s->state = state;
657 s->sock = sock;
658
659 s->mtu = RFCOMM_DEFAULT_MTU;
7c2660b0 660 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
1da177e4
LT		 661
662 /* Do not increment module usage count for listening sessions.
663 * Otherwise we won't be able to unload the module. */
664 if (state != BT_LISTEN)
665 if (!try_module_get(THIS_MODULE)) {
666 kfree(s);
667 return NULL;
668 }
669
670 list_add(&s->list, &session_list);
671
672 return s;
673}
674
8ff52f7d 675static struct rfcomm_session *rfcomm_session_del(struct rfcomm_session *s)
1da177e4
LT		 676{
677 int state = s->state;
678
679 BT_DBG("session %p state %ld", s, s->state);
680
681 list_del(&s->list);
682
9e726b17 683 rfcomm_session_clear_timer(s);
1da177e4
LT		 684 sock_release(s->sock);
685 kfree(s);
686
687 if (state != BT_LISTEN)
688 module_put(THIS_MODULE);
8ff52f7d
DJ		 689
690 return NULL;
1da177e4
LT		 691}
692
693static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
694{
7eb7404f 695 struct rfcomm_session *s, *n;
24bc10ca 696 struct l2cap_chan *chan;
7eb7404f 697 list_for_each_entry_safe(s, n, &session_list, list) {
24bc10ca 698 chan = l2cap_pi(s->sock->sk)->chan;
1da177e4 699
24bc10ca
MH		 700 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&chan->src, src)) &&
701 !bacmp(&chan->dst, dst))
1da177e4
LT		 702 return s;
703 }
704 return NULL;
705}
706
8ff52f7d
DJ		 707static struct rfcomm_session *rfcomm_session_close(struct rfcomm_session *s,
708 int err)
1da177e4 709{
7eb7404f 710 struct rfcomm_dlc *d, *n;
1da177e4 711
1da177e4
LT		 712 s->state = BT_CLOSED;
713
24fd642c
DJ		 714 BT_DBG("session %p state %ld err %d", s, s->state, err);
715
1da177e4 716 /* Close all dlcs */
7eb7404f 717 list_for_each_entry_safe(d, n, &s->dlcs, list) {
1da177e4
LT		 718 d->state = BT_CLOSED;
719 __rfcomm_dlc_close(d, err);
720 }
721
9e726b17 722 rfcomm_session_clear_timer(s);
08c30aca 723 return rfcomm_session_del(s);
1da177e4
LT		 724}
725
63ce0900
LAD		 726static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
727 bdaddr_t *dst,
728 u8 sec_level,
729 int *err)
1da177e4
LT		 730{
731 struct rfcomm_session *s = NULL;
732 struct sockaddr_l2 addr;
733 struct socket *sock;
734 struct sock *sk;
735
6ed93dc6 736 BT_DBG("%pMR -> %pMR", src, dst);
1da177e4
LT		 737
738 *err = rfcomm_l2sock_create(&sock);
739 if (*err < 0)
740 return NULL;
741
742 bacpy(&addr.l2_bdaddr, src);
743 addr.l2_family = AF_BLUETOOTH;
744 addr.l2_psm = 0;
37e62f55 745 addr.l2_cid = 0;
c507f138 746 addr.l2_bdaddr_type = BDADDR_BREDR;
48db9ca4 747 *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1da177e4
LT		 748 if (*err < 0)
749 goto failed;
750
751 /* Set L2CAP options */
752 sk = sock->sk;
753 lock_sock(sk);
0c1bc5c6 754 l2cap_pi(sk)->chan->imtu = l2cap_mtu;
47d1ec61 755 l2cap_pi(sk)->chan->sec_level = sec_level;
eae38eed 756 if (l2cap_ertm)
0c1bc5c6 757 l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
1da177e4
LT		 758 release_sock(sk);
759
760 s = rfcomm_session_add(sock, BT_BOUND);
761 if (!s) {
762 *err = -ENOMEM;
763 goto failed;
764 }
765
1da177e4
LT		 766 s->initiator = 1;
767
768 bacpy(&addr.l2_bdaddr, dst);
769 addr.l2_family = AF_BLUETOOTH;
72e4a6bd 770 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM);
37e62f55 771 addr.l2_cid = 0;
8992da09 772 addr.l2_bdaddr_type = BDADDR_BREDR;
48db9ca4 773 *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
b4c612a4 774 if (*err == 0 || *err == -EINPROGRESS)
1da177e4
LT		 775 return s;
776
8ff52f7d 777 return rfcomm_session_del(s);
1da177e4
LT		 778
779failed:
780 sock_release(sock);
781 return NULL;
782}
783
784void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
785{
24bc10ca 786 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
1da177e4 787 if (src)
24bc10ca 788 bacpy(src, &chan->src);
1da177e4 789 if (dst)
24bc10ca 790 bacpy(dst, &chan->dst);
1da177e4
LT		 791}
792
793/* ---- RFCOMM frame sending ---- */
5436538f 794static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
1da177e4 795{
1da177e4
LT		 796 struct kvec iv = { data, len };
797 struct msghdr msg;
798
5436538f 799 BT_DBG("session %p len %d", s, len);
1da177e4
LT		 800
801 memset(&msg, 0, sizeof(msg));
802
5436538f 803 return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
1da177e4
LT		 804}
805
262038fc
LAD		 806static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
807{
808 BT_DBG("%p cmd %u", s, cmd->ctrl);
809
5436538f 810 return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
262038fc
LAD		 811}
812
1da177e4
LT		 813static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
814{
815 struct rfcomm_cmd cmd;
816
817 BT_DBG("%p dlci %d", s, dlci);
818
819 cmd.addr = __addr(s->initiator, dlci);
820 cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
821 cmd.len = __len8(0);
822 cmd.fcs = __fcs2((u8 *) &cmd);
823
262038fc 824 return rfcomm_send_cmd(s, &cmd);
1da177e4
LT		 825}
826
827static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
828{
829 struct rfcomm_cmd cmd;
830
831 BT_DBG("%p dlci %d", s, dlci);
832
833 cmd.addr = __addr(!s->initiator, dlci);
834 cmd.ctrl = __ctrl(RFCOMM_UA, 1);
835 cmd.len = __len8(0);
836 cmd.fcs = __fcs2((u8 *) &cmd);
837
262038fc 838 return rfcomm_send_cmd(s, &cmd);
1da177e4
LT		 839}
840
841static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
842{
843 struct rfcomm_cmd cmd;
844
845 BT_DBG("%p dlci %d", s, dlci);
846
847 cmd.addr = __addr(s->initiator, dlci);
848 cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
849 cmd.len = __len8(0);
850 cmd.fcs = __fcs2((u8 *) &cmd);
851
262038fc 852 return rfcomm_send_cmd(s, &cmd);
1da177e4
LT		 853}
854
855static int rfcomm_queue_disc(struct rfcomm_dlc *d)
856{
857 struct rfcomm_cmd *cmd;
858 struct sk_buff *skb;
859
860 BT_DBG("dlc %p dlci %d", d, d->dlci);
861
862 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
863 if (!skb)
864 return -ENOMEM;
865
866 cmd = (void *) __skb_put(skb, sizeof(*cmd));
867 cmd->addr = d->addr;
868 cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
869 cmd->len = __len8(0);
870 cmd->fcs = __fcs2((u8 *) cmd);
871
872 skb_queue_tail(&d->tx_queue, skb);
534c92fd 873 rfcomm_schedule();
1da177e4
LT		 874 return 0;
875}
876
877static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
878{
879 struct rfcomm_cmd cmd;
880
881 BT_DBG("%p dlci %d", s, dlci);
882
883 cmd.addr = __addr(!s->initiator, dlci);
884 cmd.ctrl = __ctrl(RFCOMM_DM, 1);
885 cmd.len = __len8(0);
886 cmd.fcs = __fcs2((u8 *) &cmd);
887
262038fc 888 return rfcomm_send_cmd(s, &cmd);
1da177e4
LT		 889}
890
891static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
892{
893 struct rfcomm_hdr *hdr;
894 struct rfcomm_mcc *mcc;
895 u8 buf[16], *ptr = buf;
896
897 BT_DBG("%p cr %d type %d", s, cr, type);
898
899 hdr = (void *) ptr; ptr += sizeof(*hdr);
900 hdr->addr = __addr(s->initiator, 0);
901 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
902 hdr->len = __len8(sizeof(*mcc) + 1);
903
904 mcc = (void *) ptr; ptr += sizeof(*mcc);
ec511545 905 mcc->type = __mcc_type(0, RFCOMM_NSC);
1da177e4
LT		 906 mcc->len = __len8(1);
907
908 /* Type that we didn't like */
909 *ptr = __mcc_type(cr, type); ptr++;
910
911 *ptr = __fcs(buf); ptr++;
912
5436538f 913 return rfcomm_send_frame(s, buf, ptr - buf);
1da177e4
LT		 914}
915
916static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
917{
918 struct rfcomm_hdr *hdr;
919 struct rfcomm_mcc *mcc;
920 struct rfcomm_pn *pn;
921 u8 buf[16], *ptr = buf;
922
923 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
924
925 hdr = (void *) ptr; ptr += sizeof(*hdr);
926 hdr->addr = __addr(s->initiator, 0);
927 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
928 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn));
929
930 mcc = (void *) ptr; ptr += sizeof(*mcc);
931 mcc->type = __mcc_type(cr, RFCOMM_PN);
932 mcc->len = __len8(sizeof(*pn));
933
934 pn = (void *) ptr; ptr += sizeof(*pn);
935 pn->dlci = d->dlci;
936 pn->priority = d->priority;
937 pn->ack_timer = 0;
938 pn->max_retrans = 0;
939
940 if (s->cfc) {
941 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
942 pn->credits = RFCOMM_DEFAULT_CREDITS;
943 } else {
944 pn->flow_ctrl = 0;
945 pn->credits = 0;
946 }
947
98bcd08b 948 if (cr && channel_mtu >= 0)
b4324b5d 949 pn->mtu = cpu_to_le16(channel_mtu);
98bcd08b 950 else
b4324b5d 951 pn->mtu = cpu_to_le16(d->mtu);
1da177e4
LT		 952
953 *ptr = __fcs(buf); ptr++;
954
5436538f 955 return rfcomm_send_frame(s, buf, ptr - buf);
1da177e4
LT		 956}
957
3a5e903c
S		 958int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
959 u8 bit_rate, u8 data_bits, u8 stop_bits,
8e87d142 960 u8 parity, u8 flow_ctrl_settings,
3a5e903c 961 u8 xon_char, u8 xoff_char, u16 param_mask)
1da177e4
LT		 962{
963 struct rfcomm_hdr *hdr;
964 struct rfcomm_mcc *mcc;
965 struct rfcomm_rpn *rpn;
966 u8 buf[16], *ptr = buf;
967
968 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
8e87d142
YH		 969 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
970 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
3a5e903c 971 flow_ctrl_settings, xon_char, xoff_char, param_mask);
1da177e4
LT		 972
973 hdr = (void *) ptr; ptr += sizeof(*hdr);
974 hdr->addr = __addr(s->initiator, 0);
975 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
976 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn));
977
978 mcc = (void *) ptr; ptr += sizeof(*mcc);
979 mcc->type = __mcc_type(cr, RFCOMM_RPN);
980 mcc->len = __len8(sizeof(*rpn));
981
982 rpn = (void *) ptr; ptr += sizeof(*rpn);
983 rpn->dlci = __addr(1, dlci);
984 rpn->bit_rate = bit_rate;
985 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
986 rpn->flow_ctrl = flow_ctrl_settings;
987 rpn->xon_char = xon_char;
988 rpn->xoff_char = xoff_char;
e8db8c99 989 rpn->param_mask = cpu_to_le16(param_mask);
1da177e4
LT		 990
991 *ptr = __fcs(buf); ptr++;
992
5436538f 993 return rfcomm_send_frame(s, buf, ptr - buf);
1da177e4
LT		 994}
995
996static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
997{
998 struct rfcomm_hdr *hdr;
999 struct rfcomm_mcc *mcc;
1000 struct rfcomm_rls *rls;
1001 u8 buf[16], *ptr = buf;
1002
1003 BT_DBG("%p cr %d status 0x%x", s, cr, status);
1004
1005 hdr = (void *) ptr; ptr += sizeof(*hdr);
1006 hdr->addr = __addr(s->initiator, 0);
1007 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1008 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls));
1009
1010 mcc = (void *) ptr; ptr += sizeof(*mcc);
1011 mcc->type = __mcc_type(cr, RFCOMM_RLS);
1012 mcc->len = __len8(sizeof(*rls));
1013
1014 rls = (void *) ptr; ptr += sizeof(*rls);
1015 rls->dlci = __addr(1, dlci);
1016 rls->status = status;
1017
1018 *ptr = __fcs(buf); ptr++;
1019
5436538f 1020 return rfcomm_send_frame(s, buf, ptr - buf);
1da177e4
LT		 1021}
1022
1023static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
1024{
1025 struct rfcomm_hdr *hdr;
1026 struct rfcomm_mcc *mcc;
1027 struct rfcomm_msc *msc;
1028 u8 buf[16], *ptr = buf;
1029
1030 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
1031
1032 hdr = (void *) ptr; ptr += sizeof(*hdr);
1033 hdr->addr = __addr(s->initiator, 0);
1034 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1035 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc));
1036
1037 mcc = (void *) ptr; ptr += sizeof(*mcc);
1038 mcc->type = __mcc_type(cr, RFCOMM_MSC);
1039 mcc->len = __len8(sizeof(*msc));
1040
1041 msc = (void *) ptr; ptr += sizeof(*msc);
1042 msc->dlci = __addr(1, dlci);
1043 msc->v24_sig = v24_sig | 0x01;
1044
1045 *ptr = __fcs(buf); ptr++;
1046
5436538f 1047 return rfcomm_send_frame(s, buf, ptr - buf);
1da177e4
LT		 1048}
1049
1050static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
1051{
1052 struct rfcomm_hdr *hdr;
1053 struct rfcomm_mcc *mcc;
1054 u8 buf[16], *ptr = buf;
1055
1056 BT_DBG("%p cr %d", s, cr);
1057
1058 hdr = (void *) ptr; ptr += sizeof(*hdr);
1059 hdr->addr = __addr(s->initiator, 0);
1060 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1061 hdr->len = __len8(sizeof(*mcc));
1062
1063 mcc = (void *) ptr; ptr += sizeof(*mcc);
1064 mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1065 mcc->len = __len8(0);
1066
1067 *ptr = __fcs(buf); ptr++;
1068
5436538f 1069 return rfcomm_send_frame(s, buf, ptr - buf);
1da177e4
LT		 1070}
1071
1072static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1073{
1074 struct rfcomm_hdr *hdr;
1075 struct rfcomm_mcc *mcc;
1076 u8 buf[16], *ptr = buf;
1077
1078 BT_DBG("%p cr %d", s, cr);
1079
1080 hdr = (void *) ptr; ptr += sizeof(*hdr);
1081 hdr->addr = __addr(s->initiator, 0);
1082 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1083 hdr->len = __len8(sizeof(*mcc));
1084
1085 mcc = (void *) ptr; ptr += sizeof(*mcc);
1086 mcc->type = __mcc_type(cr, RFCOMM_FCON);
1087 mcc->len = __len8(0);
1088
1089 *ptr = __fcs(buf); ptr++;
1090
5436538f 1091 return rfcomm_send_frame(s, buf, ptr - buf);
1da177e4
LT		 1092}
1093
1094static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1095{
1096 struct socket *sock = s->sock;
1097 struct kvec iv[3];
1098 struct msghdr msg;
1099 unsigned char hdr[5], crc[1];
1100
1101 if (len > 125)
1102 return -EINVAL;
1103
1104 BT_DBG("%p cr %d", s, cr);
1105
1106 hdr[0] = __addr(s->initiator, 0);
1107 hdr[1] = __ctrl(RFCOMM_UIH, 0);
1108 hdr[2] = 0x01 | ((len + 2) << 1);
1109 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1110 hdr[4] = 0x01 | (len << 1);
1111
1112 crc[0] = __fcs(hdr);
1113
1114 iv[0].iov_base = hdr;
1115 iv[0].iov_len = 5;
1116 iv[1].iov_base = pattern;
1117 iv[1].iov_len = len;
1118 iv[2].iov_base = crc;
1119 iv[2].iov_len = 1;
1120
1121 memset(&msg, 0, sizeof(msg));
1122
1123 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1124}
1125
1126static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1127{
1128 struct rfcomm_hdr *hdr;
1129 u8 buf[16], *ptr = buf;
1130
1131 BT_DBG("%p addr %d credits %d", s, addr, credits);
1132
1133 hdr = (void *) ptr; ptr += sizeof(*hdr);
1134 hdr->addr = addr;
1135 hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1136 hdr->len = __len8(0);
1137
1138 *ptr = credits; ptr++;
1139
1140 *ptr = __fcs(buf); ptr++;
1141
5436538f 1142 return rfcomm_send_frame(s, buf, ptr - buf);
1da177e4
LT		 1143}
1144
1145static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1146{
1147 struct rfcomm_hdr *hdr;
1148 int len = skb->len;
1149 u8 *crc;
1150
1151 if (len > 127) {
1152 hdr = (void *) skb_push(skb, 4);
b4324b5d 1153 put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1da177e4
LT		 1154 } else {
1155 hdr = (void *) skb_push(skb, 3);
1156 hdr->len = __len8(len);
1157 }
1158 hdr->addr = addr;
1159 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1160
1161 crc = skb_put(skb, 1);
1162 *crc = __fcs((void *) hdr);
1163}
1164
1165/* ---- RFCOMM frame reception ---- */
8ff52f7d 1166static struct rfcomm_session *rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1da177e4
LT		 1167{
1168 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1169
1170 if (dlci) {
1171 /* Data channel */
1172 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1173 if (!d) {
1174 rfcomm_send_dm(s, dlci);
8ff52f7d 1175 return s;
1da177e4
LT		 1176 }
1177
1178 switch (d->state) {
1179 case BT_CONNECT:
1180 rfcomm_dlc_clear_timer(d);
1181
1182 rfcomm_dlc_lock(d);
1183 d->state = BT_CONNECTED;
1184 d->state_change(d, 0);
1185 rfcomm_dlc_unlock(d);
1186
1187 rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1188 break;
1189
1190 case BT_DISCONN:
1191 d->state = BT_CLOSED;
1192 __rfcomm_dlc_close(d, 0);
9cf5b0ea
MH		 1193
1194 if (list_empty(&s->dlcs)) {
1195 s->state = BT_DISCONN;
1196 rfcomm_send_disc(s, 0);
79e65478 1197 rfcomm_session_clear_timer(s);
9cf5b0ea
MH		 1198 }
1199
1da177e4
LT		 1200 break;
1201 }
1202 } else {
1203 /* Control channel */
1204 switch (s->state) {
1205 case BT_CONNECT:
1206 s->state = BT_CONNECTED;
1207 rfcomm_process_connect(s);
1208 break;
9cf5b0ea
MH		 1209
1210 case BT_DISCONN:
8ff52f7d 1211 s = rfcomm_session_close(s, ECONNRESET);
9cf5b0ea 1212 break;
1da177e4
LT		 1213 }
1214 }
8ff52f7d 1215 return s;
1da177e4
LT		 1216}
1217
8ff52f7d 1218static struct rfcomm_session *rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1da177e4
LT		 1219{
1220 int err = 0;
1221
1222 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1223
1224 if (dlci) {
1225 /* Data DLC */
1226 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1227 if (d) {
1228 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1229 err = ECONNREFUSED;
1230 else
1231 err = ECONNRESET;
1232
1233 d->state = BT_CLOSED;
1234 __rfcomm_dlc_close(d, err);
1235 }
1236 } else {
1237 if (s->state == BT_CONNECT)
1238 err = ECONNREFUSED;
1239 else
1240 err = ECONNRESET;
1241
8ff52f7d 1242 s = rfcomm_session_close(s, err);
1da177e4 1243 }
8ff52f7d 1244 return s;
1da177e4
LT		 1245}
1246
8ff52f7d
DJ		 1247static struct rfcomm_session *rfcomm_recv_disc(struct rfcomm_session *s,
1248 u8 dlci)
1da177e4
LT		 1249{
1250 int err = 0;
1251
1252 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1253
1254 if (dlci) {
1255 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1256 if (d) {
1257 rfcomm_send_ua(s, dlci);
1258
1259 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1260 err = ECONNREFUSED;
1261 else
1262 err = ECONNRESET;
1263
1264 d->state = BT_CLOSED;
1265 __rfcomm_dlc_close(d, err);
8e87d142 1266 } else
1da177e4 1267 rfcomm_send_dm(s, dlci);
8e87d142 1268
1da177e4
LT		 1269 } else {
1270 rfcomm_send_ua(s, 0);
1271
1272 if (s->state == BT_CONNECT)
1273 err = ECONNREFUSED;
1274 else
1275 err = ECONNRESET;
1276
8ff52f7d 1277 s = rfcomm_session_close(s, err);
1da177e4 1278 }
8ff52f7d 1279 return s;
1da177e4
LT		 1280}
1281
bb23c0ab 1282void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1da177e4 1283{
300b9397 1284 struct sock *sk = d->session->sock->sk;
8c1d787b 1285 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
300b9397 1286
1da177e4
LT		 1287 BT_DBG("dlc %p", d);
1288
1289 rfcomm_send_ua(d->session, d->dlci);
1290
e2139b32
JH		 1291 rfcomm_dlc_clear_timer(d);
1292
1da177e4
LT		 1293 rfcomm_dlc_lock(d);
1294 d->state = BT_CONNECTED;
1295 d->state_change(d, 0);
1296 rfcomm_dlc_unlock(d);
1297
9f2c8a03 1298 if (d->role_switch)
8c1d787b 1299 hci_conn_switch_role(conn->hcon, 0x00);
300b9397 1300
1da177e4
LT		 1301 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1302}
1303
bb23c0ab
MH		 1304static void rfcomm_check_accept(struct rfcomm_dlc *d)
1305{
9f2c8a03 1306 if (rfcomm_check_security(d)) {
bb23c0ab
MH		 1307 if (d->defer_setup) {
1308 set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1309 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
8bf47941
MH		 1310
1311 rfcomm_dlc_lock(d);
1312 d->state = BT_CONNECT2;
1313 d->state_change(d, 0);
1314 rfcomm_dlc_unlock(d);
bb23c0ab
MH		 1315 } else
1316 rfcomm_dlc_accept(d);
8c1b2355
MH		 1317 } else {
1318 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1319 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
bb23c0ab
MH		 1320 }
1321}
1322
1da177e4
LT		 1323static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1324{
1325 struct rfcomm_dlc *d;
1326 u8 channel;
1327
1328 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1329
1330 if (!dlci) {
1331 rfcomm_send_ua(s, 0);
1332
1333 if (s->state == BT_OPEN) {
1334 s->state = BT_CONNECTED;
1335 rfcomm_process_connect(s);
1336 }
1337 return 0;
1338 }
1339
1340 /* Check if DLC exists */
1341 d = rfcomm_dlc_get(s, dlci);
1342 if (d) {
1343 if (d->state == BT_OPEN) {
1344 /* DLC was previously opened by PN request */
bb23c0ab 1345 rfcomm_check_accept(d);
1da177e4
LT		 1346 }
1347 return 0;
1348 }
1349
1350 /* Notify socket layer about incoming connection */
1351 channel = __srv_channel(dlci);
1352 if (rfcomm_connect_ind(s, channel, &d)) {
1353 d->dlci = dlci;
1354 d->addr = __addr(s->initiator, dlci);
1355 rfcomm_dlc_link(s, d);
1356
bb23c0ab 1357 rfcomm_check_accept(d);
1da177e4
LT		 1358 } else {
1359 rfcomm_send_dm(s, dlci);
1360 }
1361
1362 return 0;
1363}
1364
1365static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1366{
1367 struct rfcomm_session *s = d->session;
1368
8e87d142 1369 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1da177e4
LT		 1370 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1371
7c2660b0
MH		 1372 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1373 pn->flow_ctrl == 0xe0) {
1374 d->cfc = RFCOMM_CFC_ENABLED;
1da177e4
LT		 1375 d->tx_credits = pn->credits;
1376 } else {
7c2660b0 1377 d->cfc = RFCOMM_CFC_DISABLED;
1da177e4
LT		 1378 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1379 }
1380
7c2660b0
MH		 1381 if (s->cfc == RFCOMM_CFC_UNKNOWN)
1382 s->cfc = d->cfc;
1383
1da177e4
LT		 1384 d->priority = pn->priority;
1385
b4324b5d 1386 d->mtu = __le16_to_cpu(pn->mtu);
98bcd08b
MH		 1387
1388 if (cr && d->mtu > s->mtu)
1389 d->mtu = s->mtu;
1da177e4
LT		 1390
1391 return 0;
1392}
1393
1394static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1395{
1396 struct rfcomm_pn *pn = (void *) skb->data;
1397 struct rfcomm_dlc *d;
1398 u8 dlci = pn->dlci;
1399
1400 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1401
1402 if (!dlci)
1403 return 0;
1404
1405 d = rfcomm_dlc_get(s, dlci);
1406 if (d) {
1407 if (cr) {
1408 /* PN request */
1409 rfcomm_apply_pn(d, cr, pn);
1410 rfcomm_send_pn(s, 0, d);
1411 } else {
1412 /* PN response */
1413 switch (d->state) {
1414 case BT_CONFIG:
1415 rfcomm_apply_pn(d, cr, pn);
1416
1417 d->state = BT_CONNECT;
1418 rfcomm_send_sabm(s, d->dlci);
1419 break;
1420 }
1421 }
1422 } else {
1423 u8 channel = __srv_channel(dlci);
1424
1425 if (!cr)
1426 return 0;
1427
1428 /* PN request for non existing DLC.
1429 * Assume incoming connection. */
1430 if (rfcomm_connect_ind(s, channel, &d)) {
1431 d->dlci = dlci;
1432 d->addr = __addr(s->initiator, dlci);
1433 rfcomm_dlc_link(s, d);
1434
1435 rfcomm_apply_pn(d, cr, pn);
1436
1437 d->state = BT_OPEN;
1438 rfcomm_send_pn(s, 0, d);
1439 } else {
1440 rfcomm_send_dm(s, dlci);
1441 }
1442 }
1443 return 0;
1444}
1445
1446static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1447{
1448 struct rfcomm_rpn *rpn = (void *) skb->data;
1449 u8 dlci = __get_dlci(rpn->dlci);
1450
1451 u8 bit_rate = 0;
1452 u8 data_bits = 0;
1453 u8 stop_bits = 0;
1454 u8 parity = 0;
1455 u8 flow_ctrl = 0;
1456 u8 xon_char = 0;
1457 u8 xoff_char = 0;
1458 u16 rpn_mask = RFCOMM_RPN_PM_ALL;
3a5e903c
S		 1459
1460 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1461 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1462 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1463
1464 if (!cr)
1da177e4 1465 return 0;
3a5e903c 1466
1da177e4 1467 if (len == 1) {
08601469
YK		 1468 /* This is a request, return default (according to ETSI TS 07.10) settings */
1469 bit_rate = RFCOMM_RPN_BR_9600;
1da177e4
LT		 1470 data_bits = RFCOMM_RPN_DATA_8;
1471 stop_bits = RFCOMM_RPN_STOP_1;
1472 parity = RFCOMM_RPN_PARITY_NONE;
1473 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1474 xon_char = RFCOMM_RPN_XON_CHAR;
1475 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1da177e4
LT		 1476 goto rpn_out;
1477 }
3a5e903c
S		 1478
1479 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1480 * no parity, no flow control lines, normal XON/XOFF chars */
1481
e8db8c99 1482 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_BITRATE)) {
1da177e4 1483 bit_rate = rpn->bit_rate;
08601469 1484 if (bit_rate > RFCOMM_RPN_BR_230400) {
1da177e4 1485 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
08601469 1486 bit_rate = RFCOMM_RPN_BR_9600;
1da177e4
LT		 1487 rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1488 }
1489 }
3a5e903c 1490
e8db8c99 1491 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_DATA)) {
1da177e4
LT		 1492 data_bits = __get_rpn_data_bits(rpn->line_settings);
1493 if (data_bits != RFCOMM_RPN_DATA_8) {
1494 BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1495 data_bits = RFCOMM_RPN_DATA_8;
1496 rpn_mask ^= RFCOMM_RPN_PM_DATA;
1497 }
1498 }
3a5e903c 1499
e8db8c99 1500 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_STOP)) {
1da177e4
LT		 1501 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1502 if (stop_bits != RFCOMM_RPN_STOP_1) {
1503 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1504 stop_bits = RFCOMM_RPN_STOP_1;
1505 rpn_mask ^= RFCOMM_RPN_PM_STOP;
1506 }
1507 }
3a5e903c 1508
e8db8c99 1509 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_PARITY)) {
1da177e4
LT		 1510 parity = __get_rpn_parity(rpn->line_settings);
1511 if (parity != RFCOMM_RPN_PARITY_NONE) {
1512 BT_DBG("RPN parity mismatch 0x%x", parity);
1513 parity = RFCOMM_RPN_PARITY_NONE;
1514 rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1515 }
1516 }
3a5e903c 1517
e8db8c99 1518 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_FLOW)) {
1da177e4
LT		 1519 flow_ctrl = rpn->flow_ctrl;
1520 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1521 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1522 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1523 rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1524 }
1525 }
3a5e903c 1526
e8db8c99 1527 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XON)) {
1da177e4
LT		 1528 xon_char = rpn->xon_char;
1529 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1530 BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1531 xon_char = RFCOMM_RPN_XON_CHAR;
1532 rpn_mask ^= RFCOMM_RPN_PM_XON;
1533 }
1534 }
3a5e903c 1535
e8db8c99 1536 if (rpn->param_mask & cpu_to_le16(RFCOMM_RPN_PM_XOFF)) {
1da177e4
LT		 1537 xoff_char = rpn->xoff_char;
1538 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1539 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1540 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1541 rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1542 }
1543 }
1544
1545rpn_out:
3a5e903c
S		 1546 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1547 parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1da177e4
LT		 1548
1549 return 0;
1550}
1551
1552static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1553{
1554 struct rfcomm_rls *rls = (void *) skb->data;
1555 u8 dlci = __get_dlci(rls->dlci);
1556
1557 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
3a5e903c 1558
1da177e4
LT		 1559 if (!cr)
1560 return 0;
1561
3a5e903c
S		 1562 /* We should probably do something with this information here. But
1563 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1564 * mandatory to recognise and respond to RLS */
1da177e4
LT		 1565
1566 rfcomm_send_rls(s, 0, dlci, rls->status);
1567
1568 return 0;
1569}
1570
1571static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1572{
1573 struct rfcomm_msc *msc = (void *) skb->data;
1574 struct rfcomm_dlc *d;
1575 u8 dlci = __get_dlci(msc->dlci);
1576
1577 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1578
1579 d = rfcomm_dlc_get(s, dlci);
3a5e903c 1580 if (!d)
1da177e4
LT		 1581 return 0;
1582
1583 if (cr) {
1584 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1585 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1586 else
1587 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
3a5e903c 1588
1da177e4 1589 rfcomm_dlc_lock(d);
8b6b3da7
MH		 1590
1591 d->remote_v24_sig = msc->v24_sig;
1592
1da177e4
LT		 1593 if (d->modem_status)
1594 d->modem_status(d, msc->v24_sig);
8b6b3da7 1595
1da177e4 1596 rfcomm_dlc_unlock(d);
8e87d142 1597
1da177e4
LT		 1598 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1599
1600 d->mscex |= RFCOMM_MSCEX_RX;
3a5e903c 1601 } else
1da177e4
LT		 1602 d->mscex |= RFCOMM_MSCEX_TX;
1603
1604 return 0;
1605}
1606
1607static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1608{
1609 struct rfcomm_mcc *mcc = (void *) skb->data;
1610 u8 type, cr, len;
1611
1612 cr = __test_cr(mcc->type);
1613 type = __get_mcc_type(mcc->type);
1614 len = __get_mcc_len(mcc->len);
1615
1616 BT_DBG("%p type 0x%x cr %d", s, type, cr);
1617
1618 skb_pull(skb, 2);
1619
1620 switch (type) {
1621 case RFCOMM_PN:
1622 rfcomm_recv_pn(s, cr, skb);
1623 break;
1624
1625 case RFCOMM_RPN:
1626 rfcomm_recv_rpn(s, cr, len, skb);
1627 break;
1628
1629 case RFCOMM_RLS:
1630 rfcomm_recv_rls(s, cr, skb);
1631 break;
1632
1633 case RFCOMM_MSC:
1634 rfcomm_recv_msc(s, cr, skb);
1635 break;
1636
1637 case RFCOMM_FCOFF:
1638 if (cr) {
1639 set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1640 rfcomm_send_fcoff(s, 0);
1641 }
1642 break;
1643
1644 case RFCOMM_FCON:
1645 if (cr) {
1646 clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1647 rfcomm_send_fcon(s, 0);
1648 }
1649 break;
1650
1651 case RFCOMM_TEST:
1652 if (cr)
1653 rfcomm_send_test(s, 0, skb->data, skb->len);
1654 break;
1655
1656 case RFCOMM_NSC:
1657 break;
1658
1659 default:
1660 BT_ERR("Unknown control type 0x%02x", type);
1661 rfcomm_send_nsc(s, cr, type);
1662 break;
1663 }
1664 return 0;
1665}
1666
1667static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1668{
1669 struct rfcomm_dlc *d;
1670
1671 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1672
1673 d = rfcomm_dlc_get(s, dlci);
1674 if (!d) {
1675 rfcomm_send_dm(s, dlci);
1676 goto drop;
1677 }
1678
1679 if (pf && d->cfc) {
1680 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1681
1682 d->tx_credits += credits;
1683 if (d->tx_credits)
1684 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1685 }
1686
1687 if (skb->len && d->state == BT_CONNECTED) {
1688 rfcomm_dlc_lock(d);
1689 d->rx_credits--;
1690 d->data_ready(d, skb);
1691 rfcomm_dlc_unlock(d);
1692 return 0;
1693 }
1694
1695drop:
1696 kfree_skb(skb);
1697 return 0;
1698}
1699
8ff52f7d
DJ		 1700static struct rfcomm_session *rfcomm_recv_frame(struct rfcomm_session *s,
1701 struct sk_buff *skb)
1da177e4
LT		 1702{
1703 struct rfcomm_hdr *hdr = (void *) skb->data;
1704 u8 type, dlci, fcs;
1705
8ff52f7d
DJ		 1706 if (!s) {
1707 /* no session, so free socket data */
1708 kfree_skb(skb);
1709 return s;
1710 }
1711
1da177e4
LT		 1712 dlci = __get_dlci(hdr->addr);
1713 type = __get_type(hdr->ctrl);
1714
1715 /* Trim FCS */
1716 skb->len--; skb->tail--;
27a884dc 1717 fcs = *(u8 *)skb_tail_pointer(skb);
1da177e4
LT		 1718
1719 if (__check_fcs(skb->data, type, fcs)) {
1720 BT_ERR("bad checksum in packet");
1721 kfree_skb(skb);
8ff52f7d 1722 return s;
1da177e4
LT		 1723 }
1724
1725 if (__test_ea(hdr->len))
1726 skb_pull(skb, 3);
1727 else
1728 skb_pull(skb, 4);
1729
1730 switch (type) {
1731 case RFCOMM_SABM:
1732 if (__test_pf(hdr->ctrl))
1733 rfcomm_recv_sabm(s, dlci);
1734 break;
1735
1736 case RFCOMM_DISC:
1737 if (__test_pf(hdr->ctrl))
8ff52f7d 1738 s = rfcomm_recv_disc(s, dlci);
1da177e4
LT		 1739 break;
1740
1741 case RFCOMM_UA:
1742 if (__test_pf(hdr->ctrl))
8ff52f7d 1743 s = rfcomm_recv_ua(s, dlci);
1da177e4
LT		 1744 break;
1745
1746 case RFCOMM_DM:
8ff52f7d 1747 s = rfcomm_recv_dm(s, dlci);
1da177e4
LT		 1748 break;
1749
1750 case RFCOMM_UIH:
8ff52f7d
DJ		 1751 if (dlci) {
1752 rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1753 return s;
1754 }
1da177e4
LT		 1755 rfcomm_recv_mcc(s, skb);
1756 break;
1757
1758 default:
5017d8dd 1759 BT_ERR("Unknown packet type 0x%02x", type);
1da177e4
LT		 1760 break;
1761 }
1762 kfree_skb(skb);
8ff52f7d 1763 return s;
1da177e4
LT		 1764}
1765
1766/* ---- Connection and data processing ---- */
1767
1768static void rfcomm_process_connect(struct rfcomm_session *s)
1769{
7eb7404f 1770 struct rfcomm_dlc *d, *n;
1da177e4
LT		 1771
1772 BT_DBG("session %p state %ld", s, s->state);
1773
7eb7404f 1774 list_for_each_entry_safe(d, n, &s->dlcs, list) {
1da177e4
LT		 1775 if (d->state == BT_CONFIG) {
1776 d->mtu = s->mtu;
9f2c8a03 1777 if (rfcomm_check_security(d)) {
8c1b2355
MH		 1778 rfcomm_send_pn(s, 1, d);
1779 } else {
77db1980
MH		 1780 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1781 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
8c1b2355 1782 }
1da177e4
LT		 1783 }
1784 }
1785}
1786
1787/* Send data queued for the DLC.
1788 * Return number of frames left in the queue.
1789 */
6039aa73 1790static int rfcomm_process_tx(struct rfcomm_dlc *d)
1da177e4
LT		 1791{
1792 struct sk_buff *skb;
1793 int err;
1794
8e87d142 1795 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1da177e4
LT		 1796 d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1797
1798 /* Send pending MSC */
1799 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
8e87d142 1800 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1da177e4
LT		 1801
1802 if (d->cfc) {
8e87d142 1803 /* CFC enabled.
1da177e4
LT		 1804 * Give them some credits */
1805 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
8e87d142 1806 d->rx_credits <= (d->cfc >> 2)) {
1da177e4
LT		 1807 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1808 d->rx_credits = d->cfc;
1809 }
1810 } else {
1811 /* CFC disabled.
1812 * Give ourselves some credits */
1813 d->tx_credits = 5;
1814 }
1815
1816 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1817 return skb_queue_len(&d->tx_queue);
1818
1819 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
5436538f 1820 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1da177e4
LT		 1821 if (err < 0) {
1822 skb_queue_head(&d->tx_queue, skb);
1823 break;
1824 }
1825 kfree_skb(skb);
1826 d->tx_credits--;
1827 }
1828
1829 if (d->cfc && !d->tx_credits) {
1830 /* We're out of TX credits.
1831 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1832 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1833 }
1834
1835 return skb_queue_len(&d->tx_queue);
1836}
1837
6039aa73 1838static void rfcomm_process_dlcs(struct rfcomm_session *s)
1da177e4 1839{
7eb7404f 1840 struct rfcomm_dlc *d, *n;
1da177e4
LT		 1841
1842 BT_DBG("session %p state %ld", s, s->state);
1843
7eb7404f 1844 list_for_each_entry_safe(d, n, &s->dlcs, list) {
1da177e4
LT		 1845 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1846 __rfcomm_dlc_close(d, ETIMEDOUT);
1847 continue;
1848 }
1849
db54467a
SJ		 1850 if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1851 __rfcomm_dlc_close(d, ECONNREFUSED);
1852 continue;
1853 }
1854
1da177e4
LT		 1855 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1856 rfcomm_dlc_clear_timer(d);
77db1980
MH		 1857 if (d->out) {
1858 rfcomm_send_pn(s, 1, d);
1859 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
bb23c0ab
MH		 1860 } else {
1861 if (d->defer_setup) {
1862 set_bit(RFCOMM_DEFER_SETUP, &d->flags);
1863 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
8bf47941
MH		 1864
1865 rfcomm_dlc_lock(d);
1866 d->state = BT_CONNECT2;
1867 d->state_change(d, 0);
1868 rfcomm_dlc_unlock(d);
bb23c0ab
MH		 1869 } else
1870 rfcomm_dlc_accept(d);
1871 }
1da177e4
LT		 1872 continue;
1873 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1874 rfcomm_dlc_clear_timer(d);
77db1980
MH		 1875 if (!d->out)
1876 rfcomm_send_dm(s, d->dlci);
1877 else
1878 d->state = BT_CLOSED;
1da177e4
LT		 1879 __rfcomm_dlc_close(d, ECONNREFUSED);
1880 continue;
1881 }
1882
6e1031a4
JG		 1883 if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1884 continue;
1885
1da177e4
LT		 1886 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1887 continue;
1888
1889 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
77db1980 1890 d->mscex == RFCOMM_MSCEX_OK)
1da177e4
LT		 1891 rfcomm_process_tx(d);
1892 }
1893}
1894
8ff52f7d 1895static struct rfcomm_session *rfcomm_process_rx(struct rfcomm_session *s)
1da177e4
LT		 1896{
1897 struct socket *sock = s->sock;
1898 struct sock *sk = sock->sk;
1899 struct sk_buff *skb;
1900
1901 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1902
1903 /* Get data directly from socket receive queue without copying it. */
1904 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1905 skb_orphan(skb);
32333edb 1906 if (!skb_linearize(skb)) {
8ff52f7d 1907 s = rfcomm_recv_frame(s, skb);
32333edb
VR		 1908 if (!s)
1909 break;
1910 } else {
44935720 1911 kfree_skb(skb);
32333edb 1912 }
1da177e4
LT		 1913 }
1914
08c30aca
DJ		 1915 if (s && (sk->sk_state == BT_CLOSED))
1916 s = rfcomm_session_close(s, sk->sk_err);
8ff52f7d
DJ		 1917
1918 return s;
1da177e4
LT		 1919}
1920
6039aa73 1921static void rfcomm_accept_connection(struct rfcomm_session *s)
1da177e4
LT		 1922{
1923 struct socket *sock = s->sock, *nsock;
1924 int err;
1925
1926 /* Fast check for a new connection.
1927 * Avoids unnesesary socket allocations. */
1928 if (list_empty(&bt_sk(sock->sk)->accept_q))
1929 return;
1930
1931 BT_DBG("session %p", s);
1932
48db9ca4
MH		 1933 err = kernel_accept(sock, &nsock, O_NONBLOCK);
1934 if (err < 0)
1da177e4
LT		 1935 return;
1936
1da177e4
LT		 1937 /* Set our callbacks */
1938 nsock->sk->sk_data_ready = rfcomm_l2data_ready;
1939 nsock->sk->sk_state_change = rfcomm_l2state_change;
1940
1941 s = rfcomm_session_add(nsock, BT_OPEN);
1942 if (s) {
98bcd08b
MH		 1943 /* We should adjust MTU on incoming sessions.
1944 * L2CAP MTU minus UIH header and FCS. */
0c1bc5c6
GP		 1945 s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1946 l2cap_pi(nsock->sk)->chan->imtu) - 5;
98bcd08b 1947
534c92fd 1948 rfcomm_schedule();
1da177e4
LT		 1949 } else
1950 sock_release(nsock);
1951}
1952
8ff52f7d 1953static struct rfcomm_session *rfcomm_check_connection(struct rfcomm_session *s)
1da177e4
LT		 1954{
1955 struct sock *sk = s->sock->sk;
1956
1957 BT_DBG("%p state %ld", s, s->state);
1958
285b4e90 1959 switch (sk->sk_state) {
1da177e4
LT		 1960 case BT_CONNECTED:
1961 s->state = BT_CONNECT;
1962
1963 /* We can adjust MTU on outgoing sessions.
1964 * L2CAP MTU minus UIH header and FCS. */
0c1bc5c6 1965 s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1da177e4
LT		 1966
1967 rfcomm_send_sabm(s, 0);
1968 break;
1969
1970 case BT_CLOSED:
8ff52f7d 1971 s = rfcomm_session_close(s, sk->sk_err);
1da177e4
LT		 1972 break;
1973 }
8ff52f7d 1974 return s;
1da177e4
LT		 1975}
1976
6039aa73 1977static void rfcomm_process_sessions(void)
1da177e4 1978{
7eb7404f 1979 struct rfcomm_session *s, *n;
1da177e4
LT		 1980
1981 rfcomm_lock();
1982
7eb7404f 1983 list_for_each_entry_safe(s, n, &session_list, list) {
9e726b17
LAD		 1984 if (test_and_clear_bit(RFCOMM_TIMED_OUT, &s->flags)) {
1985 s->state = BT_DISCONN;
1986 rfcomm_send_disc(s, 0);
1987 continue;
1988 }
1989
4339c25a
PH		 1990 switch (s->state) {
1991 case BT_LISTEN:
1da177e4
LT		 1992 rfcomm_accept_connection(s);
1993 continue;
1da177e4 1994
1da177e4 1995 case BT_BOUND:
8ff52f7d 1996 s = rfcomm_check_connection(s);
1da177e4
LT		 1997 break;
1998
1999 default:
8ff52f7d 2000 s = rfcomm_process_rx(s);
1da177e4
LT		 2001 break;
2002 }
2003
8ff52f7d
DJ		 2004 if (s)
2005 rfcomm_process_dlcs(s);
1da177e4
LT		 2006 }
2007
2008 rfcomm_unlock();
2009}
2010
1da177e4
LT		 2011static int rfcomm_add_listener(bdaddr_t *ba)
2012{
2013 struct sockaddr_l2 addr;
2014 struct socket *sock;
2015 struct sock *sk;
2016 struct rfcomm_session *s;
2017 int err = 0;
2018
2019 /* Create socket */
2020 err = rfcomm_l2sock_create(&sock);
8e87d142 2021 if (err < 0) {
1da177e4
LT		 2022 BT_ERR("Create socket failed %d", err);
2023 return err;
2024 }
2025
2026 /* Bind socket */
2027 bacpy(&addr.l2_bdaddr, ba);
2028 addr.l2_family = AF_BLUETOOTH;
72e4a6bd 2029 addr.l2_psm = cpu_to_le16(L2CAP_PSM_RFCOMM);
37e62f55 2030 addr.l2_cid = 0;
c507f138 2031 addr.l2_bdaddr_type = BDADDR_BREDR;
48db9ca4 2032 err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1da177e4
LT		 2033 if (err < 0) {
2034 BT_ERR("Bind failed %d", err);
2035 goto failed;
2036 }
2037
2038 /* Set L2CAP options */
2039 sk = sock->sk;
2040 lock_sock(sk);
0c1bc5c6 2041 l2cap_pi(sk)->chan->imtu = l2cap_mtu;
1da177e4
LT		 2042 release_sock(sk);
2043
2044 /* Start listening on the socket */
48db9ca4 2045 err = kernel_listen(sock, 10);
1da177e4
LT		 2046 if (err) {
2047 BT_ERR("Listen failed %d", err);
2048 goto failed;
2049 }
2050
2051 /* Add listening session */
2052 s = rfcomm_session_add(sock, BT_LISTEN);
0227c7b5
WY		 2053 if (!s) {
2054 err = -ENOMEM;
1da177e4 2055 goto failed;
0227c7b5 2056 }
1da177e4 2057
1da177e4
LT		 2058 return 0;
2059failed:
2060 sock_release(sock);
2061 return err;
2062}
2063
2064static void rfcomm_kill_listener(void)
2065{
7eb7404f 2066 struct rfcomm_session *s, *n;
1da177e4
LT		 2067
2068 BT_DBG("");
2069
7eb7404f 2070 list_for_each_entry_safe(s, n, &session_list, list)
1da177e4 2071 rfcomm_session_del(s);
1da177e4
LT		 2072}
2073
2074static int rfcomm_run(void *unused)
2075{
eedf7e47 2076 DEFINE_WAIT_FUNC(wait, woken_wake_function);
a524eccc 2077 BT_DBG("");
1da177e4 2078
1da177e4 2079 set_user_nice(current, -10);
1da177e4 2080
1da177e4
LT		 2081 rfcomm_add_listener(BDADDR_ANY);
2082
eedf7e47
PZ		 2083 add_wait_queue(&rfcomm_wq, &wait);
2084 while (!kthread_should_stop()) {
a524eccc
MH		 2085
2086 /* Process stuff */
a524eccc 2087 rfcomm_process_sessions();
e5842cdb 2088
eedf7e47 2089 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
a524eccc 2090 }
eedf7e47 2091 remove_wait_queue(&rfcomm_wq, &wait);
1da177e4
LT		 2092
2093 rfcomm_kill_listener();
2094
1da177e4
LT		 2095 return 0;
2096}
2097
8c1b2355 2098static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1da177e4
LT		 2099{
2100 struct rfcomm_session *s;
7eb7404f 2101 struct rfcomm_dlc *d, *n;
1da177e4
LT		 2102
2103 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2104
2105 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2106 if (!s)
2107 return;
2108
7eb7404f 2109 list_for_each_entry_safe(d, n, &s->dlcs, list) {
8c84b830
MH		 2110 if (test_and_clear_bit(RFCOMM_SEC_PENDING, &d->flags)) {
2111 rfcomm_dlc_clear_timer(d);
2112 if (status || encrypt == 0x00) {
db54467a 2113 set_bit(RFCOMM_ENC_DROP, &d->flags);
8c84b830
MH		 2114 continue;
2115 }
2116 }
2117
2118 if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2119 if (d->sec_level == BT_SECURITY_MEDIUM) {
2120 set_bit(RFCOMM_SEC_PENDING, &d->flags);
2121 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2122 continue;
2c068e0b
MH		 2123 } else if (d->sec_level == BT_SECURITY_HIGH ||
2124 d->sec_level == BT_SECURITY_FIPS) {
db54467a 2125 set_bit(RFCOMM_ENC_DROP, &d->flags);
8c84b830
MH		 2126 continue;
2127 }
9719f8af
MH		 2128 }
2129
1da177e4
LT		 2130 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
2131 continue;
2132
b3b1b061 2133 if (!status && hci_conn_check_secure(conn, d->sec_level))
1da177e4
LT		 2134 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
2135 else
2136 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2137 }
2138
534c92fd 2139 rfcomm_schedule();
1da177e4
LT		 2140}
2141
2142static struct hci_cb rfcomm_cb = {
2143 .name = "RFCOMM",
8c1b2355 2144 .security_cfm = rfcomm_security_cfm
1da177e4
LT		 2145};
2146
aef7d97c 2147static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
1da177e4
LT		 2148{
2149 struct rfcomm_session *s;
1da177e4
LT		 2150
2151 rfcomm_lock();
2152
8035ded4 2153 list_for_each_entry(s, &session_list, list) {
24bc10ca 2154 struct l2cap_chan *chan = l2cap_pi(s->sock->sk)->chan;
8035ded4
LAD		 2155 struct rfcomm_dlc *d;
2156 list_for_each_entry(d, &s->dlcs, list) {
fcb73338 2157 seq_printf(f, "%pMR %pMR %ld %d %d %d %d\n",
24bc10ca 2158 &chan->src, &chan->dst,
fcb73338
AE		 2159 d->state, d->dlci, d->mtu,
2160 d->rx_credits, d->tx_credits);
1da177e4
LT		 2161 }
2162 }
1da177e4 2163
1da177e4 2164 rfcomm_unlock();
1da177e4 2165
aef7d97c
MH		 2166 return 0;
2167}
2168
2169static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2170{
2171 return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
1da177e4
LT		 2172}
2173
aef7d97c
MH		 2174static const struct file_operations rfcomm_dlc_debugfs_fops = {
2175 .open = rfcomm_dlc_debugfs_open,
2176 .read = seq_read,
2177 .llseek = seq_lseek,
2178 .release = single_release,
2179};
2180
2181static struct dentry *rfcomm_dlc_debugfs;
1da177e4
LT		 2182
2183/* ---- Initialization ---- */
2184static int __init rfcomm_init(void)
2185{
52d18347 2186 int err;
af0d3b10 2187
1da177e4
LT		 2188 hci_register_cb(&rfcomm_cb);
2189
a524eccc
MH		 2190 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2191 if (IS_ERR(rfcomm_thread)) {
52d18347
MH		 2192 err = PTR_ERR(rfcomm_thread);
2193 goto unregister;
a524eccc 2194 }
1da177e4 2195
52d18347
MH		 2196 err = rfcomm_init_ttys();
2197 if (err < 0)
2198 goto stop;
1da177e4 2199
52d18347
MH		 2200 err = rfcomm_init_sockets();
2201 if (err < 0)
2202 goto cleanup;
1da177e4 2203
be9d1227
MH		 2204 BT_INFO("RFCOMM ver %s", VERSION);
2205
1120e4bf
MH		 2206 if (IS_ERR_OR_NULL(bt_debugfs))
2207 return 0;
2208
2209 rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2210 bt_debugfs, NULL,
2211 &rfcomm_dlc_debugfs_fops);
2212
1da177e4 2213 return 0;
af0d3b10 2214
52d18347 2215cleanup:
af0d3b10 2216 rfcomm_cleanup_ttys();
52d18347
MH		 2217
2218stop:
af0d3b10 2219 kthread_stop(rfcomm_thread);
52d18347
MH		 2220
2221unregister:
af0d3b10
DY		 2222 hci_unregister_cb(&rfcomm_cb);
2223
52d18347 2224 return err;
1da177e4
LT		 2225}
2226
2227static void __exit rfcomm_exit(void)
2228{
aef7d97c 2229 debugfs_remove(rfcomm_dlc_debugfs);
be9d1227 2230
1da177e4
LT		 2231 hci_unregister_cb(&rfcomm_cb);
2232
a524eccc 2233 kthread_stop(rfcomm_thread);
1da177e4 2234
1da177e4 2235 rfcomm_cleanup_ttys();
1da177e4
LT		 2236
2237 rfcomm_cleanup_sockets();
1da177e4
LT		 2238}
2239
2240module_init(rfcomm_init);
2241module_exit(rfcomm_exit);
2242
7c2660b0
MH		 2243module_param(disable_cfc, bool, 0644);
2244MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2245
98bcd08b
MH		 2246module_param(channel_mtu, int, 0644);
2247MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2248
56f3a40a
MH		 2249module_param(l2cap_mtu, uint, 0644);
2250MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2251
eae38eed
MH		 2252module_param(l2cap_ertm, bool, 0644);
2253MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2254
63fbd24e 2255MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1da177e4
LT		 2256MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2257MODULE_VERSION(VERSION);
2258MODULE_LICENSE("GPL");
2259MODULE_ALIAS("bt-proto-3");
Linux kernel - Deliverables
This page took 1.187549 seconds and 5 git commands to generate.