Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
core.c
Go to the documentation of this file.
1 /*
2  RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3  Copyright (C) 2002 Maxim Krasnyansky <[email protected]>
4  Copyright (C) 2002 Marcel Holtmann <[email protected]>
5 
6  This program is free software; you can redistribute it and/or modify
7  it under the terms of the GNU General Public License version 2 as
8  published by the Free Software Foundation;
9 
10  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11  OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13  IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14  CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15  WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 
19  ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20  COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21  SOFTWARE IS DISCLAIMED.
22 */
23 
24 /*
25  * Bluetooth RFCOMM core.
26  */
27 
28 #include <linux/module.h>
29 #include <linux/debugfs.h>
30 #include <linux/kthread.h>
31 #include <asm/unaligned.h>
32 
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
36 #include <net/bluetooth/rfcomm.h>
37 
38 #define VERSION "1.11"
39 
40 static bool disable_cfc;
41 static bool l2cap_ertm;
42 static int channel_mtu = -1;
43 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
44 
45 static struct task_struct *rfcomm_thread;
46 
47 static DEFINE_MUTEX(rfcomm_mutex);
48 #define rfcomm_lock() mutex_lock(&rfcomm_mutex)
49 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
50 
51 
52 static LIST_HEAD(session_list);
53 
54 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
55 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
56 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
57 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
58 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
59 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
60 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
61 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
62 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
63 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
64 
65 static void rfcomm_process_connect(struct rfcomm_session *s);
66 
67 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
68  bdaddr_t *dst,
69  u8 sec_level,
70  int *err);
71 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
72 static void rfcomm_session_del(struct rfcomm_session *s);
73 
74 /* ---- RFCOMM frame parsing macros ---- */
75 #define __get_dlci(b) ((b & 0xfc) >> 2)
76 #define __get_channel(b) ((b & 0xf8) >> 3)
77 #define __get_dir(b) ((b & 0x04) >> 2)
78 #define __get_type(b) ((b & 0xef))
79 
80 #define __test_ea(b) ((b & 0x01))
81 #define __test_cr(b) ((b & 0x02))
82 #define __test_pf(b) ((b & 0x10))
83 
84 #define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
85 #define __ctrl(type, pf) (((type & 0xef) | (pf << 4)))
86 #define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir)
87 #define __srv_channel(dlci) (dlci >> 1)
88 #define __dir(dlci) (dlci & 0x01)
89 
90 #define __len8(len) (((len) << 1) | 1)
91 #define __len16(len) ((len) << 1)
92 
93 /* MCC macros */
94 #define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01))
95 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
96 #define __get_mcc_len(b) ((b & 0xfe) >> 1)
97 
98 /* RPN macros */
99 #define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
100 #define __get_rpn_data_bits(line) ((line) & 0x3)
101 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
102 #define __get_rpn_parity(line) (((line) >> 3) & 0x7)
103 
104 static void rfcomm_schedule(void)
105 {
106  if (!rfcomm_thread)
107  return;
108  wake_up_process(rfcomm_thread);
109 }
110 
111 static void rfcomm_session_put(struct rfcomm_session *s)
112 {
113  if (atomic_dec_and_test(&s->refcnt))
114  rfcomm_session_del(s);
115 }
116 
117 /* ---- RFCOMM FCS computation ---- */
118 
119 /* reversed, 8-bit, poly=0x07 */
120 static unsigned char rfcomm_crc_table[256] = {
121  0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
122  0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
123  0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
124  0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
125 
126  0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
127  0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
128  0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
129  0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
130 
131  0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
132  0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
133  0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
134  0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
135 
136  0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
137  0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
138  0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
139  0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
140 
141  0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
142  0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
143  0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
144  0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
145 
146  0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
147  0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
148  0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
149  0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
150 
151  0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
152  0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
153  0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
154  0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
155 
156  0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
157  0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
158  0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
159  0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
160 };
161 
162 /* CRC on 2 bytes */
163 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
164 
165 /* FCS on 2 bytes */
166 static inline u8 __fcs(u8 *data)
167 {
168  return 0xff - __crc(data);
169 }
170 
171 /* FCS on 3 bytes */
172 static inline u8 __fcs2(u8 *data)
173 {
174  return 0xff - rfcomm_crc_table[__crc(data) ^ data[2]];
175 }
176 
177 /* Check FCS */
178 static inline int __check_fcs(u8 *data, int type, u8 fcs)
179 {
180  u8 f = __crc(data);
181 
182  if (type != RFCOMM_UIH)
183  f = rfcomm_crc_table[f ^ data[2]];
184 
185  return rfcomm_crc_table[f ^ fcs] != 0xcf;
186 }
187 
188 /* ---- L2CAP callbacks ---- */
189 static void rfcomm_l2state_change(struct sock *sk)
190 {
191  BT_DBG("%p state %d", sk, sk->sk_state);
192  rfcomm_schedule();
193 }
194 
195 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
196 {
197  BT_DBG("%p bytes %d", sk, bytes);
198  rfcomm_schedule();
199 }
200 
201 static int rfcomm_l2sock_create(struct socket **sock)
202 {
203  int err;
204 
205  BT_DBG("");
206 
208  if (!err) {
209  struct sock *sk = (*sock)->sk;
210  sk->sk_data_ready = rfcomm_l2data_ready;
211  sk->sk_state_change = rfcomm_l2state_change;
212  }
213  return err;
214 }
215 
216 static int rfcomm_check_security(struct rfcomm_dlc *d)
217 {
218  struct sock *sk = d->session->sock->sk;
219  struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
220 
221  __u8 auth_type;
222 
223  switch (d->sec_level) {
224  case BT_SECURITY_HIGH:
225  auth_type = HCI_AT_GENERAL_BONDING_MITM;
226  break;
227  case BT_SECURITY_MEDIUM:
228  auth_type = HCI_AT_GENERAL_BONDING;
229  break;
230  default:
231  auth_type = HCI_AT_NO_BONDING;
232  break;
233  }
234 
235  return hci_conn_security(conn->hcon, d->sec_level, auth_type);
236 }
237 
238 static void rfcomm_session_timeout(unsigned long arg)
239 {
240  struct rfcomm_session *s = (void *) arg;
241 
242  BT_DBG("session %p state %ld", s, s->state);
243 
245  rfcomm_schedule();
246 }
247 
248 static void rfcomm_session_set_timer(struct rfcomm_session *s, long timeout)
249 {
250  BT_DBG("session %p state %ld timeout %ld", s, s->state, timeout);
251 
252  if (!mod_timer(&s->timer, jiffies + timeout))
253  rfcomm_session_hold(s);
254 }
255 
256 static void rfcomm_session_clear_timer(struct rfcomm_session *s)
257 {
258  BT_DBG("session %p state %ld", s, s->state);
259 
260  if (timer_pending(&s->timer) && del_timer(&s->timer))
261  rfcomm_session_put(s);
262 }
263 
264 /* ---- RFCOMM DLCs ---- */
265 static void rfcomm_dlc_timeout(unsigned long arg)
266 {
267  struct rfcomm_dlc *d = (void *) arg;
268 
269  BT_DBG("dlc %p state %ld", d, d->state);
270 
272  rfcomm_dlc_put(d);
273  rfcomm_schedule();
274 }
275 
276 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
277 {
278  BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
279 
280  if (!mod_timer(&d->timer, jiffies + timeout))
281  rfcomm_dlc_hold(d);
282 }
283 
284 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
285 {
286  BT_DBG("dlc %p state %ld", d, d->state);
287 
288  if (timer_pending(&d->timer) && del_timer(&d->timer))
289  rfcomm_dlc_put(d);
290 }
291 
292 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
293 {
294  BT_DBG("%p", d);
295 
296  d->state = BT_OPEN;
297  d->flags = 0;
298  d->mscex = 0;
300  d->mtu = RFCOMM_DEFAULT_MTU;
302 
305 }
306 
308 {
309  struct rfcomm_dlc *d = kzalloc(sizeof(*d), prio);
310 
311  if (!d)
312  return NULL;
313 
314  setup_timer(&d->timer, rfcomm_dlc_timeout, (unsigned long)d);
315 
316  skb_queue_head_init(&d->tx_queue);
317  spin_lock_init(&d->lock);
318  atomic_set(&d->refcnt, 1);
319 
320  rfcomm_dlc_clear_state(d);
321 
322  BT_DBG("%p", d);
323 
324  return d;
325 }
326 
328 {
329  BT_DBG("%p", d);
330 
332  kfree(d);
333 }
334 
335 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
336 {
337  BT_DBG("dlc %p session %p", d, s);
338 
339  rfcomm_session_hold(s);
340 
341  rfcomm_session_clear_timer(s);
342  rfcomm_dlc_hold(d);
343  list_add(&d->list, &s->dlcs);
344  d->session = s;
345 }
346 
347 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
348 {
349  struct rfcomm_session *s = d->session;
350 
351  BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
352 
353  list_del(&d->list);
354  d->session = NULL;
355  rfcomm_dlc_put(d);
356 
357  if (list_empty(&s->dlcs))
358  rfcomm_session_set_timer(s, RFCOMM_IDLE_TIMEOUT);
359 
360  rfcomm_session_put(s);
361 }
362 
363 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
364 {
365  struct rfcomm_dlc *d;
366 
367  list_for_each_entry(d, &s->dlcs, list)
368  if (d->dlci == dlci)
369  return d;
370 
371  return NULL;
372 }
373 
374 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
375 {
376  struct rfcomm_session *s;
377  int err = 0;
378  u8 dlci;
379 
380  BT_DBG("dlc %p state %ld %s %s channel %d",
381  d, d->state, batostr(src), batostr(dst), channel);
382 
384  return -EINVAL;
385 
386  if (d->state != BT_OPEN && d->state != BT_CLOSED)
387  return 0;
388 
389  s = rfcomm_session_get(src, dst);
390  if (!s) {
391  s = rfcomm_session_create(src, dst, d->sec_level, &err);
392  if (!s)
393  return err;
394  }
395 
396  dlci = __dlci(!s->initiator, channel);
397 
398  /* Check if DLCI already exists */
399  if (rfcomm_dlc_get(s, dlci))
400  return -EBUSY;
401 
402  rfcomm_dlc_clear_state(d);
403 
404  d->dlci = dlci;
405  d->addr = __addr(s->initiator, dlci);
406  d->priority = 7;
407 
408  d->state = BT_CONFIG;
409  rfcomm_dlc_link(s, d);
410 
411  d->out = 1;
412 
413  d->mtu = s->mtu;
414  d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
415 
416  if (s->state == BT_CONNECTED) {
417  if (rfcomm_check_security(d))
418  rfcomm_send_pn(s, 1, d);
419  else
420  set_bit(RFCOMM_AUTH_PENDING, &d->flags);
421  }
422 
423  rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
424 
425  return 0;
426 }
427 
428 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
429 {
430  int r;
431 
432  rfcomm_lock();
433 
434  r = __rfcomm_dlc_open(d, src, dst, channel);
435 
436  rfcomm_unlock();
437  return r;
438 }
439 
440 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
441 {
442  struct rfcomm_session *s = d->session;
443  if (!s)
444  return 0;
445 
446  BT_DBG("dlc %p state %ld dlci %d err %d session %p",
447  d, d->state, d->dlci, err, s);
448 
449  switch (d->state) {
450  case BT_CONNECT:
451  case BT_CONFIG:
454  rfcomm_schedule();
455  break;
456  }
457  /* Fall through */
458 
459  case BT_CONNECTED:
460  d->state = BT_DISCONN;
461  if (skb_queue_empty(&d->tx_queue)) {
462  rfcomm_send_disc(s, d->dlci);
463  rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
464  } else {
465  rfcomm_queue_disc(d);
466  rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
467  }
468  break;
469 
470  case BT_OPEN:
471  case BT_CONNECT2:
474  rfcomm_schedule();
475  break;
476  }
477  /* Fall through */
478 
479  default:
480  rfcomm_dlc_clear_timer(d);
481 
482  rfcomm_dlc_lock(d);
483  d->state = BT_CLOSED;
484  d->state_change(d, err);
486 
488  rfcomm_dlc_unlink(d);
489  }
490 
491  return 0;
492 }
493 
494 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
495 {
496  int r;
497 
498  rfcomm_lock();
499 
500  r = __rfcomm_dlc_close(d, err);
501 
502  rfcomm_unlock();
503  return r;
504 }
505 
506 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
507 {
508  int len = skb->len;
509 
510  if (d->state != BT_CONNECTED)
511  return -ENOTCONN;
512 
513  BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
514 
515  if (len > d->mtu)
516  return -EINVAL;
517 
518  rfcomm_make_uih(skb, d->addr);
519  skb_queue_tail(&d->tx_queue, skb);
520 
522  rfcomm_schedule();
523  return len;
524 }
525 
527 {
528  BT_DBG("dlc %p state %ld", d, d->state);
529 
530  if (!d->cfc) {
531  d->v24_sig |= RFCOMM_V24_FC;
533  }
534  rfcomm_schedule();
535 }
536 
538 {
539  BT_DBG("dlc %p state %ld", d, d->state);
540 
541  if (!d->cfc) {
542  d->v24_sig &= ~RFCOMM_V24_FC;
544  }
545  rfcomm_schedule();
546 }
547 
548 /*
549  Set/get modem status functions use _local_ status i.e. what we report
550  to the other side.
551  Remote status is provided by dlc->modem_status() callback.
552  */
554 {
555  BT_DBG("dlc %p state %ld v24_sig 0x%x",
556  d, d->state, v24_sig);
557 
559  v24_sig |= RFCOMM_V24_FC;
560  else
561  v24_sig &= ~RFCOMM_V24_FC;
562 
563  d->v24_sig = v24_sig;
564 
566  rfcomm_schedule();
567 
568  return 0;
569 }
570 
571 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
572 {
573  BT_DBG("dlc %p state %ld v24_sig 0x%x",
574  d, d->state, d->v24_sig);
575 
576  *v24_sig = d->v24_sig;
577  return 0;
578 }
579 
580 /* ---- RFCOMM sessions ---- */
581 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
582 {
583  struct rfcomm_session *s = kzalloc(sizeof(*s), GFP_KERNEL);
584 
585  if (!s)
586  return NULL;
587 
588  BT_DBG("session %p sock %p", s, sock);
589 
590  setup_timer(&s->timer, rfcomm_session_timeout, (unsigned long) s);
591 
592  INIT_LIST_HEAD(&s->dlcs);
593  s->state = state;
594  s->sock = sock;
595 
596  s->mtu = RFCOMM_DEFAULT_MTU;
597  s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
598 
599  /* Do not increment module usage count for listening sessions.
600  * Otherwise we won't be able to unload the module. */
601  if (state != BT_LISTEN)
602  if (!try_module_get(THIS_MODULE)) {
603  kfree(s);
604  return NULL;
605  }
606 
607  list_add(&s->list, &session_list);
608 
609  return s;
610 }
611 
612 static void rfcomm_session_del(struct rfcomm_session *s)
613 {
614  int state = s->state;
615 
616  BT_DBG("session %p state %ld", s, s->state);
617 
618  list_del(&s->list);
619 
620  if (state == BT_CONNECTED)
621  rfcomm_send_disc(s, 0);
622 
623  rfcomm_session_clear_timer(s);
624  sock_release(s->sock);
625  kfree(s);
626 
627  if (state != BT_LISTEN)
628  module_put(THIS_MODULE);
629 }
630 
631 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
632 {
633  struct rfcomm_session *s;
634  struct list_head *p, *n;
635  struct bt_sock *sk;
636  list_for_each_safe(p, n, &session_list) {
637  s = list_entry(p, struct rfcomm_session, list);
638  sk = bt_sk(s->sock->sk);
639 
640  if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
641  !bacmp(&sk->dst, dst))
642  return s;
643  }
644  return NULL;
645 }
646 
647 static void rfcomm_session_close(struct rfcomm_session *s, int err)
648 {
649  struct rfcomm_dlc *d;
650  struct list_head *p, *n;
651 
652  BT_DBG("session %p state %ld err %d", s, s->state, err);
653 
654  rfcomm_session_hold(s);
655 
656  s->state = BT_CLOSED;
657 
658  /* Close all dlcs */
659  list_for_each_safe(p, n, &s->dlcs) {
660  d = list_entry(p, struct rfcomm_dlc, list);
661  d->state = BT_CLOSED;
662  __rfcomm_dlc_close(d, err);
663  }
664 
665  rfcomm_session_clear_timer(s);
666  rfcomm_session_put(s);
667 }
668 
669 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
670  bdaddr_t *dst,
671  u8 sec_level,
672  int *err)
673 {
674  struct rfcomm_session *s = NULL;
675  struct sockaddr_l2 addr;
676  struct socket *sock;
677  struct sock *sk;
678 
679  BT_DBG("%s %s", batostr(src), batostr(dst));
680 
681  *err = rfcomm_l2sock_create(&sock);
682  if (*err < 0)
683  return NULL;
684 
685  bacpy(&addr.l2_bdaddr, src);
686  addr.l2_family = AF_BLUETOOTH;
687  addr.l2_psm = 0;
688  addr.l2_cid = 0;
689  *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
690  if (*err < 0)
691  goto failed;
692 
693  /* Set L2CAP options */
694  sk = sock->sk;
695  lock_sock(sk);
696  l2cap_pi(sk)->chan->imtu = l2cap_mtu;
697  l2cap_pi(sk)->chan->sec_level = sec_level;
698  if (l2cap_ertm)
699  l2cap_pi(sk)->chan->mode = L2CAP_MODE_ERTM;
700  release_sock(sk);
701 
702  s = rfcomm_session_add(sock, BT_BOUND);
703  if (!s) {
704  *err = -ENOMEM;
705  goto failed;
706  }
707 
708  s->initiator = 1;
709 
710  bacpy(&addr.l2_bdaddr, dst);
711  addr.l2_family = AF_BLUETOOTH;
712  addr.l2_psm = cpu_to_le16(RFCOMM_PSM);
713  addr.l2_cid = 0;
714  *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
715  if (*err == 0 || *err == -EINPROGRESS)
716  return s;
717 
718  rfcomm_session_del(s);
719  return NULL;
720 
721 failed:
722  sock_release(sock);
723  return NULL;
724 }
725 
726 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
727 {
728  struct sock *sk = s->sock->sk;
729  if (src)
730  bacpy(src, &bt_sk(sk)->src);
731  if (dst)
732  bacpy(dst, &bt_sk(sk)->dst);
733 }
734 
735 /* ---- RFCOMM frame sending ---- */
736 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
737 {
738  struct kvec iv = { data, len };
739  struct msghdr msg;
740 
741  BT_DBG("session %p len %d", s, len);
742 
743  memset(&msg, 0, sizeof(msg));
744 
745  return kernel_sendmsg(s->sock, &msg, &iv, 1, len);
746 }
747 
748 static int rfcomm_send_cmd(struct rfcomm_session *s, struct rfcomm_cmd *cmd)
749 {
750  BT_DBG("%p cmd %u", s, cmd->ctrl);
751 
752  return rfcomm_send_frame(s, (void *) cmd, sizeof(*cmd));
753 }
754 
755 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
756 {
757  struct rfcomm_cmd cmd;
758 
759  BT_DBG("%p dlci %d", s, dlci);
760 
761  cmd.addr = __addr(s->initiator, dlci);
762  cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
763  cmd.len = __len8(0);
764  cmd.fcs = __fcs2((u8 *) &cmd);
765 
766  return rfcomm_send_cmd(s, &cmd);
767 }
768 
769 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
770 {
771  struct rfcomm_cmd cmd;
772 
773  BT_DBG("%p dlci %d", s, dlci);
774 
775  cmd.addr = __addr(!s->initiator, dlci);
776  cmd.ctrl = __ctrl(RFCOMM_UA, 1);
777  cmd.len = __len8(0);
778  cmd.fcs = __fcs2((u8 *) &cmd);
779 
780  return rfcomm_send_cmd(s, &cmd);
781 }
782 
783 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
784 {
785  struct rfcomm_cmd cmd;
786 
787  BT_DBG("%p dlci %d", s, dlci);
788 
789  cmd.addr = __addr(s->initiator, dlci);
790  cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
791  cmd.len = __len8(0);
792  cmd.fcs = __fcs2((u8 *) &cmd);
793 
794  return rfcomm_send_cmd(s, &cmd);
795 }
796 
797 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
798 {
799  struct rfcomm_cmd *cmd;
800  struct sk_buff *skb;
801 
802  BT_DBG("dlc %p dlci %d", d, d->dlci);
803 
804  skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
805  if (!skb)
806  return -ENOMEM;
807 
808  cmd = (void *) __skb_put(skb, sizeof(*cmd));
809  cmd->addr = d->addr;
810  cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
811  cmd->len = __len8(0);
812  cmd->fcs = __fcs2((u8 *) cmd);
813 
814  skb_queue_tail(&d->tx_queue, skb);
815  rfcomm_schedule();
816  return 0;
817 }
818 
819 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
820 {
821  struct rfcomm_cmd cmd;
822 
823  BT_DBG("%p dlci %d", s, dlci);
824 
825  cmd.addr = __addr(!s->initiator, dlci);
826  cmd.ctrl = __ctrl(RFCOMM_DM, 1);
827  cmd.len = __len8(0);
828  cmd.fcs = __fcs2((u8 *) &cmd);
829 
830  return rfcomm_send_cmd(s, &cmd);
831 }
832 
833 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
834 {
835  struct rfcomm_hdr *hdr;
836  struct rfcomm_mcc *mcc;
837  u8 buf[16], *ptr = buf;
838 
839  BT_DBG("%p cr %d type %d", s, cr, type);
840 
841  hdr = (void *) ptr; ptr += sizeof(*hdr);
842  hdr->addr = __addr(s->initiator, 0);
843  hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
844  hdr->len = __len8(sizeof(*mcc) + 1);
845 
846  mcc = (void *) ptr; ptr += sizeof(*mcc);
847  mcc->type = __mcc_type(cr, RFCOMM_NSC);
848  mcc->len = __len8(1);
849 
850  /* Type that we didn't like */
851  *ptr = __mcc_type(cr, type); ptr++;
852 
853  *ptr = __fcs(buf); ptr++;
854 
855  return rfcomm_send_frame(s, buf, ptr - buf);
856 }
857 
858 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
859 {
860  struct rfcomm_hdr *hdr;
861  struct rfcomm_mcc *mcc;
862  struct rfcomm_pn *pn;
863  u8 buf[16], *ptr = buf;
864 
865  BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
866 
867  hdr = (void *) ptr; ptr += sizeof(*hdr);
868  hdr->addr = __addr(s->initiator, 0);
869  hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
870  hdr->len = __len8(sizeof(*mcc) + sizeof(*pn));
871 
872  mcc = (void *) ptr; ptr += sizeof(*mcc);
873  mcc->type = __mcc_type(cr, RFCOMM_PN);
874  mcc->len = __len8(sizeof(*pn));
875 
876  pn = (void *) ptr; ptr += sizeof(*pn);
877  pn->dlci = d->dlci;
878  pn->priority = d->priority;
879  pn->ack_timer = 0;
880  pn->max_retrans = 0;
881 
882  if (s->cfc) {
883  pn->flow_ctrl = cr ? 0xf0 : 0xe0;
885  } else {
886  pn->flow_ctrl = 0;
887  pn->credits = 0;
888  }
889 
890  if (cr && channel_mtu >= 0)
891  pn->mtu = cpu_to_le16(channel_mtu);
892  else
893  pn->mtu = cpu_to_le16(d->mtu);
894 
895  *ptr = __fcs(buf); ptr++;
896 
897  return rfcomm_send_frame(s, buf, ptr - buf);
898 }
899 
900 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
901  u8 bit_rate, u8 data_bits, u8 stop_bits,
902  u8 parity, u8 flow_ctrl_settings,
903  u8 xon_char, u8 xoff_char, u16 param_mask)
904 {
905  struct rfcomm_hdr *hdr;
906  struct rfcomm_mcc *mcc;
907  struct rfcomm_rpn *rpn;
908  u8 buf[16], *ptr = buf;
909 
910  BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
911  " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
912  s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
913  flow_ctrl_settings, xon_char, xoff_char, param_mask);
914 
915  hdr = (void *) ptr; ptr += sizeof(*hdr);
916  hdr->addr = __addr(s->initiator, 0);
917  hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
918  hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn));
919 
920  mcc = (void *) ptr; ptr += sizeof(*mcc);
921  mcc->type = __mcc_type(cr, RFCOMM_RPN);
922  mcc->len = __len8(sizeof(*rpn));
923 
924  rpn = (void *) ptr; ptr += sizeof(*rpn);
925  rpn->dlci = __addr(1, dlci);
926  rpn->bit_rate = bit_rate;
927  rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
928  rpn->flow_ctrl = flow_ctrl_settings;
929  rpn->xon_char = xon_char;
930  rpn->xoff_char = xoff_char;
931  rpn->param_mask = cpu_to_le16(param_mask);
932 
933  *ptr = __fcs(buf); ptr++;
934 
935  return rfcomm_send_frame(s, buf, ptr - buf);
936 }
937 
938 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
939 {
940  struct rfcomm_hdr *hdr;
941  struct rfcomm_mcc *mcc;
942  struct rfcomm_rls *rls;
943  u8 buf[16], *ptr = buf;
944 
945  BT_DBG("%p cr %d status 0x%x", s, cr, status);
946 
947  hdr = (void *) ptr; ptr += sizeof(*hdr);
948  hdr->addr = __addr(s->initiator, 0);
949  hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
950  hdr->len = __len8(sizeof(*mcc) + sizeof(*rls));
951 
952  mcc = (void *) ptr; ptr += sizeof(*mcc);
953  mcc->type = __mcc_type(cr, RFCOMM_RLS);
954  mcc->len = __len8(sizeof(*rls));
955 
956  rls = (void *) ptr; ptr += sizeof(*rls);
957  rls->dlci = __addr(1, dlci);
958  rls->status = status;
959 
960  *ptr = __fcs(buf); ptr++;
961 
962  return rfcomm_send_frame(s, buf, ptr - buf);
963 }
964 
965 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
966 {
967  struct rfcomm_hdr *hdr;
968  struct rfcomm_mcc *mcc;
969  struct rfcomm_msc *msc;
970  u8 buf[16], *ptr = buf;
971 
972  BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
973 
974  hdr = (void *) ptr; ptr += sizeof(*hdr);
975  hdr->addr = __addr(s->initiator, 0);
976  hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
977  hdr->len = __len8(sizeof(*mcc) + sizeof(*msc));
978 
979  mcc = (void *) ptr; ptr += sizeof(*mcc);
980  mcc->type = __mcc_type(cr, RFCOMM_MSC);
981  mcc->len = __len8(sizeof(*msc));
982 
983  msc = (void *) ptr; ptr += sizeof(*msc);
984  msc->dlci = __addr(1, dlci);
985  msc->v24_sig = v24_sig | 0x01;
986 
987  *ptr = __fcs(buf); ptr++;
988 
989  return rfcomm_send_frame(s, buf, ptr - buf);
990 }
991 
992 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
993 {
994  struct rfcomm_hdr *hdr;
995  struct rfcomm_mcc *mcc;
996  u8 buf[16], *ptr = buf;
997 
998  BT_DBG("%p cr %d", s, cr);
999 
1000  hdr = (void *) ptr; ptr += sizeof(*hdr);
1001  hdr->addr = __addr(s->initiator, 0);
1002  hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1003  hdr->len = __len8(sizeof(*mcc));
1004 
1005  mcc = (void *) ptr; ptr += sizeof(*mcc);
1006  mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
1007  mcc->len = __len8(0);
1008 
1009  *ptr = __fcs(buf); ptr++;
1010 
1011  return rfcomm_send_frame(s, buf, ptr - buf);
1012 }
1013 
1014 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
1015 {
1016  struct rfcomm_hdr *hdr;
1017  struct rfcomm_mcc *mcc;
1018  u8 buf[16], *ptr = buf;
1019 
1020  BT_DBG("%p cr %d", s, cr);
1021 
1022  hdr = (void *) ptr; ptr += sizeof(*hdr);
1023  hdr->addr = __addr(s->initiator, 0);
1024  hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1025  hdr->len = __len8(sizeof(*mcc));
1026 
1027  mcc = (void *) ptr; ptr += sizeof(*mcc);
1028  mcc->type = __mcc_type(cr, RFCOMM_FCON);
1029  mcc->len = __len8(0);
1030 
1031  *ptr = __fcs(buf); ptr++;
1032 
1033  return rfcomm_send_frame(s, buf, ptr - buf);
1034 }
1035 
1036 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
1037 {
1038  struct socket *sock = s->sock;
1039  struct kvec iv[3];
1040  struct msghdr msg;
1041  unsigned char hdr[5], crc[1];
1042 
1043  if (len > 125)
1044  return -EINVAL;
1045 
1046  BT_DBG("%p cr %d", s, cr);
1047 
1048  hdr[0] = __addr(s->initiator, 0);
1049  hdr[1] = __ctrl(RFCOMM_UIH, 0);
1050  hdr[2] = 0x01 | ((len + 2) << 1);
1051  hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
1052  hdr[4] = 0x01 | (len << 1);
1053 
1054  crc[0] = __fcs(hdr);
1055 
1056  iv[0].iov_base = hdr;
1057  iv[0].iov_len = 5;
1058  iv[1].iov_base = pattern;
1059  iv[1].iov_len = len;
1060  iv[2].iov_base = crc;
1061  iv[2].iov_len = 1;
1062 
1063  memset(&msg, 0, sizeof(msg));
1064 
1065  return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
1066 }
1067 
1068 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
1069 {
1070  struct rfcomm_hdr *hdr;
1071  u8 buf[16], *ptr = buf;
1072 
1073  BT_DBG("%p addr %d credits %d", s, addr, credits);
1074 
1075  hdr = (void *) ptr; ptr += sizeof(*hdr);
1076  hdr->addr = addr;
1077  hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
1078  hdr->len = __len8(0);
1079 
1080  *ptr = credits; ptr++;
1081 
1082  *ptr = __fcs(buf); ptr++;
1083 
1084  return rfcomm_send_frame(s, buf, ptr - buf);
1085 }
1086 
1087 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1088 {
1089  struct rfcomm_hdr *hdr;
1090  int len = skb->len;
1091  u8 *crc;
1092 
1093  if (len > 127) {
1094  hdr = (void *) skb_push(skb, 4);
1095  put_unaligned(cpu_to_le16(__len16(len)), (__le16 *) &hdr->len);
1096  } else {
1097  hdr = (void *) skb_push(skb, 3);
1098  hdr->len = __len8(len);
1099  }
1100  hdr->addr = addr;
1101  hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1102 
1103  crc = skb_put(skb, 1);
1104  *crc = __fcs((void *) hdr);
1105 }
1106 
1107 /* ---- RFCOMM frame reception ---- */
1108 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1109 {
1110  BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1111 
1112  if (dlci) {
1113  /* Data channel */
1114  struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1115  if (!d) {
1116  rfcomm_send_dm(s, dlci);
1117  return 0;
1118  }
1119 
1120  switch (d->state) {
1121  case BT_CONNECT:
1122  rfcomm_dlc_clear_timer(d);
1123 
1124  rfcomm_dlc_lock(d);
1125  d->state = BT_CONNECTED;
1126  d->state_change(d, 0);
1127  rfcomm_dlc_unlock(d);
1128 
1129  rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1130  break;
1131 
1132  case BT_DISCONN:
1133  d->state = BT_CLOSED;
1134  __rfcomm_dlc_close(d, 0);
1135 
1136  if (list_empty(&s->dlcs)) {
1137  s->state = BT_DISCONN;
1138  rfcomm_send_disc(s, 0);
1139  rfcomm_session_clear_timer(s);
1140  }
1141 
1142  break;
1143  }
1144  } else {
1145  /* Control channel */
1146  switch (s->state) {
1147  case BT_CONNECT:
1148  s->state = BT_CONNECTED;
1149  rfcomm_process_connect(s);
1150  break;
1151 
1152  case BT_DISCONN:
1153  /* rfcomm_session_put is called later so don't do
1154  * anything here otherwise we will mess up the session
1155  * reference counter:
1156  *
1157  * (a) when we are the initiator dlc_unlink will drive
1158  * the reference counter to 0 (there is no initial put
1159  * after session_add)
1160  *
1161  * (b) when we are not the initiator rfcomm_rx_process
1162  * will explicitly call put to balance the initial hold
1163  * done after session add.
1164  */
1165  break;
1166  }
1167  }
1168  return 0;
1169 }
1170 
1171 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1172 {
1173  int err = 0;
1174 
1175  BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1176 
1177  if (dlci) {
1178  /* Data DLC */
1179  struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1180  if (d) {
1181  if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1182  err = ECONNREFUSED;
1183  else
1184  err = ECONNRESET;
1185 
1186  d->state = BT_CLOSED;
1187  __rfcomm_dlc_close(d, err);
1188  }
1189  } else {
1190  if (s->state == BT_CONNECT)
1191  err = ECONNREFUSED;
1192  else
1193  err = ECONNRESET;
1194 
1195  s->state = BT_CLOSED;
1196  rfcomm_session_close(s, err);
1197  }
1198  return 0;
1199 }
1200 
1201 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1202 {
1203  int err = 0;
1204 
1205  BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1206 
1207  if (dlci) {
1208  struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1209  if (d) {
1210  rfcomm_send_ua(s, dlci);
1211 
1212  if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1213  err = ECONNREFUSED;
1214  else
1215  err = ECONNRESET;
1216 
1217  d->state = BT_CLOSED;
1218  __rfcomm_dlc_close(d, err);
1219  } else
1220  rfcomm_send_dm(s, dlci);
1221 
1222  } else {
1223  rfcomm_send_ua(s, 0);
1224 
1225  if (s->state == BT_CONNECT)
1226  err = ECONNREFUSED;
1227  else
1228  err = ECONNRESET;
1229 
1230  s->state = BT_CLOSED;
1231  rfcomm_session_close(s, err);
1232  }
1233 
1234  return 0;
1235 }
1236 
1238 {
1239  struct sock *sk = d->session->sock->sk;
1240  struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1241 
1242  BT_DBG("dlc %p", d);
1243 
1244  rfcomm_send_ua(d->session, d->dlci);
1245 
1246  rfcomm_dlc_clear_timer(d);
1247 
1248  rfcomm_dlc_lock(d);
1249  d->state = BT_CONNECTED;
1250  d->state_change(d, 0);
1251  rfcomm_dlc_unlock(d);
1252 
1253  if (d->role_switch)
1254  hci_conn_switch_role(conn->hcon, 0x00);
1255 
1256  rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1257 }
1258 
1259 static void rfcomm_check_accept(struct rfcomm_dlc *d)
1260 {
1261  if (rfcomm_check_security(d)) {
1262  if (d->defer_setup) {
1264  rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1265 
1266  rfcomm_dlc_lock(d);
1267  d->state = BT_CONNECT2;
1268  d->state_change(d, 0);
1269  rfcomm_dlc_unlock(d);
1270  } else
1271  rfcomm_dlc_accept(d);
1272  } else {
1274  rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1275  }
1276 }
1277 
1278 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1279 {
1280  struct rfcomm_dlc *d;
1281  u8 channel;
1282 
1283  BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1284 
1285  if (!dlci) {
1286  rfcomm_send_ua(s, 0);
1287 
1288  if (s->state == BT_OPEN) {
1289  s->state = BT_CONNECTED;
1290  rfcomm_process_connect(s);
1291  }
1292  return 0;
1293  }
1294 
1295  /* Check if DLC exists */
1296  d = rfcomm_dlc_get(s, dlci);
1297  if (d) {
1298  if (d->state == BT_OPEN) {
1299  /* DLC was previously opened by PN request */
1300  rfcomm_check_accept(d);
1301  }
1302  return 0;
1303  }
1304 
1305  /* Notify socket layer about incoming connection */
1306  channel = __srv_channel(dlci);
1307  if (rfcomm_connect_ind(s, channel, &d)) {
1308  d->dlci = dlci;
1309  d->addr = __addr(s->initiator, dlci);
1310  rfcomm_dlc_link(s, d);
1311 
1312  rfcomm_check_accept(d);
1313  } else {
1314  rfcomm_send_dm(s, dlci);
1315  }
1316 
1317  return 0;
1318 }
1319 
1320 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1321 {
1322  struct rfcomm_session *s = d->session;
1323 
1324  BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1325  d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1326 
1327  if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1328  pn->flow_ctrl == 0xe0) {
1329  d->cfc = RFCOMM_CFC_ENABLED;
1330  d->tx_credits = pn->credits;
1331  } else {
1332  d->cfc = RFCOMM_CFC_DISABLED;
1334  }
1335 
1336  if (s->cfc == RFCOMM_CFC_UNKNOWN)
1337  s->cfc = d->cfc;
1338 
1339  d->priority = pn->priority;
1340 
1341  d->mtu = __le16_to_cpu(pn->mtu);
1342 
1343  if (cr && d->mtu > s->mtu)
1344  d->mtu = s->mtu;
1345 
1346  return 0;
1347 }
1348 
1349 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1350 {
1351  struct rfcomm_pn *pn = (void *) skb->data;
1352  struct rfcomm_dlc *d;
1353  u8 dlci = pn->dlci;
1354 
1355  BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1356 
1357  if (!dlci)
1358  return 0;
1359 
1360  d = rfcomm_dlc_get(s, dlci);
1361  if (d) {
1362  if (cr) {
1363  /* PN request */
1364  rfcomm_apply_pn(d, cr, pn);
1365  rfcomm_send_pn(s, 0, d);
1366  } else {
1367  /* PN response */
1368  switch (d->state) {
1369  case BT_CONFIG:
1370  rfcomm_apply_pn(d, cr, pn);
1371 
1372  d->state = BT_CONNECT;
1373  rfcomm_send_sabm(s, d->dlci);
1374  break;
1375  }
1376  }
1377  } else {
1378  u8 channel = __srv_channel(dlci);
1379 
1380  if (!cr)
1381  return 0;
1382 
1383  /* PN request for non existing DLC.
1384  * Assume incoming connection. */
1385  if (rfcomm_connect_ind(s, channel, &d)) {
1386  d->dlci = dlci;
1387  d->addr = __addr(s->initiator, dlci);
1388  rfcomm_dlc_link(s, d);
1389 
1390  rfcomm_apply_pn(d, cr, pn);
1391 
1392  d->state = BT_OPEN;
1393  rfcomm_send_pn(s, 0, d);
1394  } else {
1395  rfcomm_send_dm(s, dlci);
1396  }
1397  }
1398  return 0;
1399 }
1400 
1401 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1402 {
1403  struct rfcomm_rpn *rpn = (void *) skb->data;
1404  u8 dlci = __get_dlci(rpn->dlci);
1405 
1406  u8 bit_rate = 0;
1407  u8 data_bits = 0;
1408  u8 stop_bits = 0;
1409  u8 parity = 0;
1410  u8 flow_ctrl = 0;
1411  u8 xon_char = 0;
1412  u8 xoff_char = 0;
1413  u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1414 
1415  BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1416  dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1417  rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1418 
1419  if (!cr)
1420  return 0;
1421 
1422  if (len == 1) {
1423  /* This is a request, return default (according to ETSI TS 07.10) settings */
1424  bit_rate = RFCOMM_RPN_BR_9600;
1425  data_bits = RFCOMM_RPN_DATA_8;
1426  stop_bits = RFCOMM_RPN_STOP_1;
1427  parity = RFCOMM_RPN_PARITY_NONE;
1428  flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1429  xon_char = RFCOMM_RPN_XON_CHAR;
1430  xoff_char = RFCOMM_RPN_XOFF_CHAR;
1431  goto rpn_out;
1432  }
1433 
1434  /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1435  * no parity, no flow control lines, normal XON/XOFF chars */
1436 
1438  bit_rate = rpn->bit_rate;
1439  if (bit_rate > RFCOMM_RPN_BR_230400) {
1440  BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1441  bit_rate = RFCOMM_RPN_BR_9600;
1442  rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1443  }
1444  }
1445 
1447  data_bits = __get_rpn_data_bits(rpn->line_settings);
1448  if (data_bits != RFCOMM_RPN_DATA_8) {
1449  BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1450  data_bits = RFCOMM_RPN_DATA_8;
1451  rpn_mask ^= RFCOMM_RPN_PM_DATA;
1452  }
1453  }
1454 
1456  stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1457  if (stop_bits != RFCOMM_RPN_STOP_1) {
1458  BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1459  stop_bits = RFCOMM_RPN_STOP_1;
1460  rpn_mask ^= RFCOMM_RPN_PM_STOP;
1461  }
1462  }
1463 
1465  parity = __get_rpn_parity(rpn->line_settings);
1466  if (parity != RFCOMM_RPN_PARITY_NONE) {
1467  BT_DBG("RPN parity mismatch 0x%x", parity);
1468  parity = RFCOMM_RPN_PARITY_NONE;
1469  rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1470  }
1471  }
1472 
1474  flow_ctrl = rpn->flow_ctrl;
1475  if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1476  BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1477  flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1478  rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1479  }
1480  }
1481 
1483  xon_char = rpn->xon_char;
1484  if (xon_char != RFCOMM_RPN_XON_CHAR) {
1485  BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1486  xon_char = RFCOMM_RPN_XON_CHAR;
1487  rpn_mask ^= RFCOMM_RPN_PM_XON;
1488  }
1489  }
1490 
1492  xoff_char = rpn->xoff_char;
1493  if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1494  BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1495  xoff_char = RFCOMM_RPN_XOFF_CHAR;
1496  rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1497  }
1498  }
1499 
1500 rpn_out:
1501  rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1502  parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1503 
1504  return 0;
1505 }
1506 
1507 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1508 {
1509  struct rfcomm_rls *rls = (void *) skb->data;
1510  u8 dlci = __get_dlci(rls->dlci);
1511 
1512  BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1513 
1514  if (!cr)
1515  return 0;
1516 
1517  /* We should probably do something with this information here. But
1518  * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1519  * mandatory to recognise and respond to RLS */
1520 
1521  rfcomm_send_rls(s, 0, dlci, rls->status);
1522 
1523  return 0;
1524 }
1525 
1526 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1527 {
1528  struct rfcomm_msc *msc = (void *) skb->data;
1529  struct rfcomm_dlc *d;
1530  u8 dlci = __get_dlci(msc->dlci);
1531 
1532  BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1533 
1534  d = rfcomm_dlc_get(s, dlci);
1535  if (!d)
1536  return 0;
1537 
1538  if (cr) {
1539  if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1541  else
1543 
1544  rfcomm_dlc_lock(d);
1545 
1546  d->remote_v24_sig = msc->v24_sig;
1547 
1548  if (d->modem_status)
1549  d->modem_status(d, msc->v24_sig);
1550 
1551  rfcomm_dlc_unlock(d);
1552 
1553  rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1554 
1555  d->mscex |= RFCOMM_MSCEX_RX;
1556  } else
1557  d->mscex |= RFCOMM_MSCEX_TX;
1558 
1559  return 0;
1560 }
1561 
1562 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1563 {
1564  struct rfcomm_mcc *mcc = (void *) skb->data;
1565  u8 type, cr, len;
1566 
1567  cr = __test_cr(mcc->type);
1568  type = __get_mcc_type(mcc->type);
1569  len = __get_mcc_len(mcc->len);
1570 
1571  BT_DBG("%p type 0x%x cr %d", s, type, cr);
1572 
1573  skb_pull(skb, 2);
1574 
1575  switch (type) {
1576  case RFCOMM_PN:
1577  rfcomm_recv_pn(s, cr, skb);
1578  break;
1579 
1580  case RFCOMM_RPN:
1581  rfcomm_recv_rpn(s, cr, len, skb);
1582  break;
1583 
1584  case RFCOMM_RLS:
1585  rfcomm_recv_rls(s, cr, skb);
1586  break;
1587 
1588  case RFCOMM_MSC:
1589  rfcomm_recv_msc(s, cr, skb);
1590  break;
1591 
1592  case RFCOMM_FCOFF:
1593  if (cr) {
1595  rfcomm_send_fcoff(s, 0);
1596  }
1597  break;
1598 
1599  case RFCOMM_FCON:
1600  if (cr) {
1602  rfcomm_send_fcon(s, 0);
1603  }
1604  break;
1605 
1606  case RFCOMM_TEST:
1607  if (cr)
1608  rfcomm_send_test(s, 0, skb->data, skb->len);
1609  break;
1610 
1611  case RFCOMM_NSC:
1612  break;
1613 
1614  default:
1615  BT_ERR("Unknown control type 0x%02x", type);
1616  rfcomm_send_nsc(s, cr, type);
1617  break;
1618  }
1619  return 0;
1620 }
1621 
1622 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1623 {
1624  struct rfcomm_dlc *d;
1625 
1626  BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1627 
1628  d = rfcomm_dlc_get(s, dlci);
1629  if (!d) {
1630  rfcomm_send_dm(s, dlci);
1631  goto drop;
1632  }
1633 
1634  if (pf && d->cfc) {
1635  u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1636 
1637  d->tx_credits += credits;
1638  if (d->tx_credits)
1640  }
1641 
1642  if (skb->len && d->state == BT_CONNECTED) {
1643  rfcomm_dlc_lock(d);
1644  d->rx_credits--;
1645  d->data_ready(d, skb);
1646  rfcomm_dlc_unlock(d);
1647  return 0;
1648  }
1649 
1650 drop:
1651  kfree_skb(skb);
1652  return 0;
1653 }
1654 
1655 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1656 {
1657  struct rfcomm_hdr *hdr = (void *) skb->data;
1658  u8 type, dlci, fcs;
1659 
1660  dlci = __get_dlci(hdr->addr);
1661  type = __get_type(hdr->ctrl);
1662 
1663  /* Trim FCS */
1664  skb->len--; skb->tail--;
1665  fcs = *(u8 *)skb_tail_pointer(skb);
1666 
1667  if (__check_fcs(skb->data, type, fcs)) {
1668  BT_ERR("bad checksum in packet");
1669  kfree_skb(skb);
1670  return -EILSEQ;
1671  }
1672 
1673  if (__test_ea(hdr->len))
1674  skb_pull(skb, 3);
1675  else
1676  skb_pull(skb, 4);
1677 
1678  switch (type) {
1679  case RFCOMM_SABM:
1680  if (__test_pf(hdr->ctrl))
1681  rfcomm_recv_sabm(s, dlci);
1682  break;
1683 
1684  case RFCOMM_DISC:
1685  if (__test_pf(hdr->ctrl))
1686  rfcomm_recv_disc(s, dlci);
1687  break;
1688 
1689  case RFCOMM_UA:
1690  if (__test_pf(hdr->ctrl))
1691  rfcomm_recv_ua(s, dlci);
1692  break;
1693 
1694  case RFCOMM_DM:
1695  rfcomm_recv_dm(s, dlci);
1696  break;
1697 
1698  case RFCOMM_UIH:
1699  if (dlci)
1700  return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1701 
1702  rfcomm_recv_mcc(s, skb);
1703  break;
1704 
1705  default:
1706  BT_ERR("Unknown packet type 0x%02x", type);
1707  break;
1708  }
1709  kfree_skb(skb);
1710  return 0;
1711 }
1712 
1713 /* ---- Connection and data processing ---- */
1714 
1715 static void rfcomm_process_connect(struct rfcomm_session *s)
1716 {
1717  struct rfcomm_dlc *d;
1718  struct list_head *p, *n;
1719 
1720  BT_DBG("session %p state %ld", s, s->state);
1721 
1722  list_for_each_safe(p, n, &s->dlcs) {
1723  d = list_entry(p, struct rfcomm_dlc, list);
1724  if (d->state == BT_CONFIG) {
1725  d->mtu = s->mtu;
1726  if (rfcomm_check_security(d)) {
1727  rfcomm_send_pn(s, 1, d);
1728  } else {
1730  rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1731  }
1732  }
1733  }
1734 }
1735 
1736 /* Send data queued for the DLC.
1737  * Return number of frames left in the queue.
1738  */
1739 static int rfcomm_process_tx(struct rfcomm_dlc *d)
1740 {
1741  struct sk_buff *skb;
1742  int err;
1743 
1744  BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1745  d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1746 
1747  /* Send pending MSC */
1749  rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1750 
1751  if (d->cfc) {
1752  /* CFC enabled.
1753  * Give them some credits */
1754  if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1755  d->rx_credits <= (d->cfc >> 2)) {
1756  rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1757  d->rx_credits = d->cfc;
1758  }
1759  } else {
1760  /* CFC disabled.
1761  * Give ourselves some credits */
1762  d->tx_credits = 5;
1763  }
1764 
1766  return skb_queue_len(&d->tx_queue);
1767 
1768  while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1769  err = rfcomm_send_frame(d->session, skb->data, skb->len);
1770  if (err < 0) {
1771  skb_queue_head(&d->tx_queue, skb);
1772  break;
1773  }
1774  kfree_skb(skb);
1775  d->tx_credits--;
1776  }
1777 
1778  if (d->cfc && !d->tx_credits) {
1779  /* We're out of TX credits.
1780  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1782  }
1783 
1784  return skb_queue_len(&d->tx_queue);
1785 }
1786 
1787 static void rfcomm_process_dlcs(struct rfcomm_session *s)
1788 {
1789  struct rfcomm_dlc *d;
1790  struct list_head *p, *n;
1791 
1792  BT_DBG("session %p state %ld", s, s->state);
1793 
1794  list_for_each_safe(p, n, &s->dlcs) {
1795  d = list_entry(p, struct rfcomm_dlc, list);
1796 
1797  if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1798  __rfcomm_dlc_close(d, ETIMEDOUT);
1799  continue;
1800  }
1801 
1802  if (test_bit(RFCOMM_ENC_DROP, &d->flags)) {
1803  __rfcomm_dlc_close(d, ECONNREFUSED);
1804  continue;
1805  }
1806 
1808  rfcomm_dlc_clear_timer(d);
1809  if (d->out) {
1810  rfcomm_send_pn(s, 1, d);
1811  rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
1812  } else {
1813  if (d->defer_setup) {
1815  rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1816 
1817  rfcomm_dlc_lock(d);
1818  d->state = BT_CONNECT2;
1819  d->state_change(d, 0);
1820  rfcomm_dlc_unlock(d);
1821  } else
1822  rfcomm_dlc_accept(d);
1823  }
1824  continue;
1825  } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1826  rfcomm_dlc_clear_timer(d);
1827  if (!d->out)
1828  rfcomm_send_dm(s, d->dlci);
1829  else
1830  d->state = BT_CLOSED;
1831  __rfcomm_dlc_close(d, ECONNREFUSED);
1832  continue;
1833  }
1834 
1835  if (test_bit(RFCOMM_SEC_PENDING, &d->flags))
1836  continue;
1837 
1839  continue;
1840 
1841  if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1842  d->mscex == RFCOMM_MSCEX_OK)
1843  rfcomm_process_tx(d);
1844  }
1845 }
1846 
1847 static void rfcomm_process_rx(struct rfcomm_session *s)
1848 {
1849  struct socket *sock = s->sock;
1850  struct sock *sk = sock->sk;
1851  struct sk_buff *skb;
1852 
1853  BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1854 
1855  /* Get data directly from socket receive queue without copying it. */
1856  while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1857  skb_orphan(skb);
1858  if (!skb_linearize(skb))
1859  rfcomm_recv_frame(s, skb);
1860  else
1861  kfree_skb(skb);
1862  }
1863 
1864  if (sk->sk_state == BT_CLOSED) {
1865  if (!s->initiator)
1866  rfcomm_session_put(s);
1867 
1868  rfcomm_session_close(s, sk->sk_err);
1869  }
1870 }
1871 
1872 static void rfcomm_accept_connection(struct rfcomm_session *s)
1873 {
1874  struct socket *sock = s->sock, *nsock;
1875  int err;
1876 
1877  /* Fast check for a new connection.
1878  * Avoids unnesesary socket allocations. */
1879  if (list_empty(&bt_sk(sock->sk)->accept_q))
1880  return;
1881 
1882  BT_DBG("session %p", s);
1883 
1884  err = kernel_accept(sock, &nsock, O_NONBLOCK);
1885  if (err < 0)
1886  return;
1887 
1888  /* Set our callbacks */
1889  nsock->sk->sk_data_ready = rfcomm_l2data_ready;
1890  nsock->sk->sk_state_change = rfcomm_l2state_change;
1891 
1892  s = rfcomm_session_add(nsock, BT_OPEN);
1893  if (s) {
1894  rfcomm_session_hold(s);
1895 
1896  /* We should adjust MTU on incoming sessions.
1897  * L2CAP MTU minus UIH header and FCS. */
1898  s->mtu = min(l2cap_pi(nsock->sk)->chan->omtu,
1899  l2cap_pi(nsock->sk)->chan->imtu) - 5;
1900 
1901  rfcomm_schedule();
1902  } else
1903  sock_release(nsock);
1904 }
1905 
1906 static void rfcomm_check_connection(struct rfcomm_session *s)
1907 {
1908  struct sock *sk = s->sock->sk;
1909 
1910  BT_DBG("%p state %ld", s, s->state);
1911 
1912  switch (sk->sk_state) {
1913  case BT_CONNECTED:
1914  s->state = BT_CONNECT;
1915 
1916  /* We can adjust MTU on outgoing sessions.
1917  * L2CAP MTU minus UIH header and FCS. */
1918  s->mtu = min(l2cap_pi(sk)->chan->omtu, l2cap_pi(sk)->chan->imtu) - 5;
1919 
1920  rfcomm_send_sabm(s, 0);
1921  break;
1922 
1923  case BT_CLOSED:
1924  s->state = BT_CLOSED;
1925  rfcomm_session_close(s, sk->sk_err);
1926  break;
1927  }
1928 }
1929 
1930 static void rfcomm_process_sessions(void)
1931 {
1932  struct list_head *p, *n;
1933 
1934  rfcomm_lock();
1935 
1936  list_for_each_safe(p, n, &session_list) {
1937  struct rfcomm_session *s;
1938  s = list_entry(p, struct rfcomm_session, list);
1939 
1941  s->state = BT_DISCONN;
1942  rfcomm_send_disc(s, 0);
1943  rfcomm_session_put(s);
1944  continue;
1945  }
1946 
1947  if (s->state == BT_LISTEN) {
1948  rfcomm_accept_connection(s);
1949  continue;
1950  }
1951 
1952  rfcomm_session_hold(s);
1953 
1954  switch (s->state) {
1955  case BT_BOUND:
1956  rfcomm_check_connection(s);
1957  break;
1958 
1959  default:
1960  rfcomm_process_rx(s);
1961  break;
1962  }
1963 
1964  rfcomm_process_dlcs(s);
1965 
1966  rfcomm_session_put(s);
1967  }
1968 
1969  rfcomm_unlock();
1970 }
1971 
1972 static int rfcomm_add_listener(bdaddr_t *ba)
1973 {
1974  struct sockaddr_l2 addr;
1975  struct socket *sock;
1976  struct sock *sk;
1977  struct rfcomm_session *s;
1978  int err = 0;
1979 
1980  /* Create socket */
1981  err = rfcomm_l2sock_create(&sock);
1982  if (err < 0) {
1983  BT_ERR("Create socket failed %d", err);
1984  return err;
1985  }
1986 
1987  /* Bind socket */
1988  bacpy(&addr.l2_bdaddr, ba);
1989  addr.l2_family = AF_BLUETOOTH;
1990  addr.l2_psm = cpu_to_le16(RFCOMM_PSM);
1991  addr.l2_cid = 0;
1992  err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1993  if (err < 0) {
1994  BT_ERR("Bind failed %d", err);
1995  goto failed;
1996  }
1997 
1998  /* Set L2CAP options */
1999  sk = sock->sk;
2000  lock_sock(sk);
2001  l2cap_pi(sk)->chan->imtu = l2cap_mtu;
2002  release_sock(sk);
2003 
2004  /* Start listening on the socket */
2005  err = kernel_listen(sock, 10);
2006  if (err) {
2007  BT_ERR("Listen failed %d", err);
2008  goto failed;
2009  }
2010 
2011  /* Add listening session */
2012  s = rfcomm_session_add(sock, BT_LISTEN);
2013  if (!s)
2014  goto failed;
2015 
2016  rfcomm_session_hold(s);
2017  return 0;
2018 failed:
2019  sock_release(sock);
2020  return err;
2021 }
2022 
2023 static void rfcomm_kill_listener(void)
2024 {
2025  struct rfcomm_session *s;
2026  struct list_head *p, *n;
2027 
2028  BT_DBG("");
2029 
2030  list_for_each_safe(p, n, &session_list) {
2031  s = list_entry(p, struct rfcomm_session, list);
2032  rfcomm_session_del(s);
2033  }
2034 }
2035 
2036 static int rfcomm_run(void *unused)
2037 {
2038  BT_DBG("");
2039 
2040  set_user_nice(current, -10);
2041 
2042  rfcomm_add_listener(BDADDR_ANY);
2043 
2044  while (1) {
2046 
2047  if (kthread_should_stop())
2048  break;
2049 
2050  /* Process stuff */
2051  rfcomm_process_sessions();
2052 
2053  schedule();
2054  }
2056 
2057  rfcomm_kill_listener();
2058 
2059  return 0;
2060 }
2061 
2062 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
2063 {
2064  struct rfcomm_session *s;
2065  struct rfcomm_dlc *d;
2066  struct list_head *p, *n;
2067 
2068  BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
2069 
2070  s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
2071  if (!s)
2072  return;
2073 
2074  rfcomm_session_hold(s);
2075 
2076  list_for_each_safe(p, n, &s->dlcs) {
2077  d = list_entry(p, struct rfcomm_dlc, list);
2078 
2080  rfcomm_dlc_clear_timer(d);
2081  if (status || encrypt == 0x00) {
2083  continue;
2084  }
2085  }
2086 
2087  if (d->state == BT_CONNECTED && !status && encrypt == 0x00) {
2088  if (d->sec_level == BT_SECURITY_MEDIUM) {
2090  rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
2091  continue;
2092  } else if (d->sec_level == BT_SECURITY_HIGH) {
2094  continue;
2095  }
2096  }
2097 
2099  continue;
2100 
2101  if (!status && hci_conn_check_secure(conn, d->sec_level))
2103  else
2105  }
2106 
2107  rfcomm_session_put(s);
2108 
2109  rfcomm_schedule();
2110 }
2111 
2112 static struct hci_cb rfcomm_cb = {
2113  .name = "RFCOMM",
2114  .security_cfm = rfcomm_security_cfm
2115 };
2116 
2117 static int rfcomm_dlc_debugfs_show(struct seq_file *f, void *x)
2118 {
2119  struct rfcomm_session *s;
2120 
2121  rfcomm_lock();
2122 
2123  list_for_each_entry(s, &session_list, list) {
2124  struct rfcomm_dlc *d;
2125  list_for_each_entry(d, &s->dlcs, list) {
2126  struct sock *sk = s->sock->sk;
2127 
2128  seq_printf(f, "%s %s %ld %d %d %d %d\n",
2129  batostr(&bt_sk(sk)->src),
2130  batostr(&bt_sk(sk)->dst),
2131  d->state, d->dlci, d->mtu,
2132  d->rx_credits, d->tx_credits);
2133  }
2134  }
2135 
2136  rfcomm_unlock();
2137 
2138  return 0;
2139 }
2140 
2141 static int rfcomm_dlc_debugfs_open(struct inode *inode, struct file *file)
2142 {
2143  return single_open(file, rfcomm_dlc_debugfs_show, inode->i_private);
2144 }
2145 
2146 static const struct file_operations rfcomm_dlc_debugfs_fops = {
2147  .open = rfcomm_dlc_debugfs_open,
2148  .read = seq_read,
2149  .llseek = seq_lseek,
2150  .release = single_release,
2151 };
2152 
2153 static struct dentry *rfcomm_dlc_debugfs;
2154 
2155 /* ---- Initialization ---- */
2156 static int __init rfcomm_init(void)
2157 {
2158  int err;
2159 
2160  hci_register_cb(&rfcomm_cb);
2161 
2162  rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2163  if (IS_ERR(rfcomm_thread)) {
2164  err = PTR_ERR(rfcomm_thread);
2165  goto unregister;
2166  }
2167 
2168  if (bt_debugfs) {
2169  rfcomm_dlc_debugfs = debugfs_create_file("rfcomm_dlc", 0444,
2170  bt_debugfs, NULL, &rfcomm_dlc_debugfs_fops);
2171  if (!rfcomm_dlc_debugfs)
2172  BT_ERR("Failed to create RFCOMM debug file");
2173  }
2174 
2175  err = rfcomm_init_ttys();
2176  if (err < 0)
2177  goto stop;
2178 
2179  err = rfcomm_init_sockets();
2180  if (err < 0)
2181  goto cleanup;
2182 
2183  BT_INFO("RFCOMM ver %s", VERSION);
2184 
2185  return 0;
2186 
2187 cleanup:
2189 
2190 stop:
2191  kthread_stop(rfcomm_thread);
2192 
2193 unregister:
2194  hci_unregister_cb(&rfcomm_cb);
2195 
2196  return err;
2197 }
2198 
2199 static void __exit rfcomm_exit(void)
2200 {
2201  debugfs_remove(rfcomm_dlc_debugfs);
2202 
2203  hci_unregister_cb(&rfcomm_cb);
2204 
2205  kthread_stop(rfcomm_thread);
2206 
2208 
2210 }
2211 
2212 module_init(rfcomm_init);
2213 module_exit(rfcomm_exit);
2214 
2215 module_param(disable_cfc, bool, 0644);
2216 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2217 
2218 module_param(channel_mtu, int, 0644);
2219 MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2220 
2221 module_param(l2cap_mtu, uint, 0644);
2222 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2223 
2224 module_param(l2cap_ertm, bool, 0644);
2225 MODULE_PARM_DESC(l2cap_ertm, "Use L2CAP ERTM mode for connection");
2226 
2227 MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
2228 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2230 MODULE_LICENSE("GPL");
2231 MODULE_ALIAS("bt-proto-3");