2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
25 * Bluetooth RFCOMM core.
27 * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
30 #include <linux/module.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/sched.h>
34 #include <linux/signal.h>
35 #include <linux/init.h>
36 #include <linux/wait.h>
37 #include <linux/device.h>
38 #include <linux/net.h>
39 #include <linux/mutex.h>
42 #include <asm/uaccess.h>
43 #include <asm/unaligned.h>
45 #include <net/bluetooth/bluetooth.h>
46 #include <net/bluetooth/hci_core.h>
47 #include <net/bluetooth/l2cap.h>
48 #include <net/bluetooth/rfcomm.h>
50 #ifndef CONFIG_BT_RFCOMM_DEBUG
57 static int disable_cfc = 0;
58 static unsigned int l2cap_mtu = RFCOMM_MAX_L2CAP_MTU;
60 static struct task_struct *rfcomm_thread;
62 static DEFINE_MUTEX(rfcomm_mutex);
63 #define rfcomm_lock() mutex_lock(&rfcomm_mutex)
64 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
66 static unsigned long rfcomm_event;
68 static LIST_HEAD(session_list);
69 static atomic_t terminate, running;
71 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
72 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
73 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
74 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
75 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
76 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
77 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
78 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
79 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
80 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
82 static void rfcomm_process_connect(struct rfcomm_session *s);
84 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
85 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
86 static void rfcomm_session_del(struct rfcomm_session *s);
88 /* ---- RFCOMM frame parsing macros ---- */
89 #define __get_dlci(b) ((b & 0xfc) >> 2)
90 #define __get_channel(b) ((b & 0xf8) >> 3)
91 #define __get_dir(b) ((b & 0x04) >> 2)
92 #define __get_type(b) ((b & 0xef))
94 #define __test_ea(b) ((b & 0x01))
95 #define __test_cr(b) ((b & 0x02))
96 #define __test_pf(b) ((b & 0x10))
98 #define __addr(cr, dlci) (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
99 #define __ctrl(type, pf) (((type & 0xef) | (pf << 4)))
100 #define __dlci(dir, chn) (((chn & 0x1f) << 1) | dir)
101 #define __srv_channel(dlci) (dlci >> 1)
102 #define __dir(dlci) (dlci & 0x01)
104 #define __len8(len) (((len) << 1) | 1)
105 #define __len16(len) ((len) << 1)
108 #define __mcc_type(cr, type) (((type << 2) | (cr << 1) | 0x01))
109 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
110 #define __get_mcc_len(b) ((b & 0xfe) >> 1)
113 #define __rpn_line_settings(data, stop, parity) ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x7) << 3))
114 #define __get_rpn_data_bits(line) ((line) & 0x3)
115 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
116 #define __get_rpn_parity(line) (((line) >> 3) & 0x7)
118 static inline void rfcomm_schedule(uint event)
122 //set_bit(event, &rfcomm_event);
123 set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
124 wake_up_process(rfcomm_thread);
127 static inline void rfcomm_session_put(struct rfcomm_session *s)
129 if (atomic_dec_and_test(&s->refcnt))
130 rfcomm_session_del(s);
133 /* ---- RFCOMM FCS computation ---- */
135 /* reversed, 8-bit, poly=0x07 */
136 static unsigned char rfcomm_crc_table[256] = {
137 0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
138 0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
139 0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
140 0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
142 0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
143 0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
144 0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
145 0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
147 0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
148 0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
149 0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
150 0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
152 0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
153 0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
154 0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
155 0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
157 0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
158 0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
159 0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
160 0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
162 0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
163 0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
164 0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
165 0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
167 0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
168 0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
169 0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
170 0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
172 0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
173 0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
174 0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
175 0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
179 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
182 static inline u8 __fcs(u8 *data)
184 return (0xff - __crc(data));
188 static inline u8 __fcs2(u8 *data)
190 return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
194 static inline int __check_fcs(u8 *data, int type, u8 fcs)
198 if (type != RFCOMM_UIH)
199 f = rfcomm_crc_table[f ^ data[2]];
201 return rfcomm_crc_table[f ^ fcs] != 0xcf;
204 /* ---- L2CAP callbacks ---- */
205 static void rfcomm_l2state_change(struct sock *sk)
207 BT_DBG("%p state %d", sk, sk->sk_state);
208 rfcomm_schedule(RFCOMM_SCHED_STATE);
211 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
213 BT_DBG("%p bytes %d", sk, bytes);
214 rfcomm_schedule(RFCOMM_SCHED_RX);
217 static int rfcomm_l2sock_create(struct socket **sock)
223 err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
225 struct sock *sk = (*sock)->sk;
226 sk->sk_data_ready = rfcomm_l2data_ready;
227 sk->sk_state_change = rfcomm_l2state_change;
232 /* ---- RFCOMM DLCs ---- */
233 static void rfcomm_dlc_timeout(unsigned long arg)
235 struct rfcomm_dlc *d = (void *) arg;
237 BT_DBG("dlc %p state %ld", d, d->state);
239 set_bit(RFCOMM_TIMED_OUT, &d->flags);
241 rfcomm_schedule(RFCOMM_SCHED_TIMEO);
244 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
246 BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
248 if (!mod_timer(&d->timer, jiffies + timeout))
252 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
254 BT_DBG("dlc %p state %ld", d, d->state);
256 if (timer_pending(&d->timer) && del_timer(&d->timer))
260 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
267 d->mtu = RFCOMM_DEFAULT_MTU;
268 d->v24_sig = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
270 d->cfc = RFCOMM_CFC_DISABLED;
271 d->rx_credits = RFCOMM_DEFAULT_CREDITS;
274 struct rfcomm_dlc *rfcomm_dlc_alloc(gfp_t prio)
276 struct rfcomm_dlc *d = kmalloc(sizeof(*d), prio);
279 memset(d, 0, sizeof(*d));
281 init_timer(&d->timer);
282 d->timer.function = rfcomm_dlc_timeout;
283 d->timer.data = (unsigned long) d;
285 skb_queue_head_init(&d->tx_queue);
286 spin_lock_init(&d->lock);
287 atomic_set(&d->refcnt, 1);
289 rfcomm_dlc_clear_state(d);
295 void rfcomm_dlc_free(struct rfcomm_dlc *d)
299 skb_queue_purge(&d->tx_queue);
303 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
305 BT_DBG("dlc %p session %p", d, s);
307 rfcomm_session_hold(s);
310 list_add(&d->list, &s->dlcs);
314 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
316 struct rfcomm_session *s = d->session;
318 BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
324 rfcomm_session_put(s);
327 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
329 struct rfcomm_dlc *d;
332 list_for_each(p, &s->dlcs) {
333 d = list_entry(p, struct rfcomm_dlc, list);
340 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
342 struct rfcomm_session *s;
346 BT_DBG("dlc %p state %ld %s %s channel %d",
347 d, d->state, batostr(src), batostr(dst), channel);
349 if (channel < 1 || channel > 30)
352 if (d->state != BT_OPEN && d->state != BT_CLOSED)
355 s = rfcomm_session_get(src, dst);
357 s = rfcomm_session_create(src, dst, &err);
362 dlci = __dlci(!s->initiator, channel);
364 /* Check if DLCI already exists */
365 if (rfcomm_dlc_get(s, dlci))
368 rfcomm_dlc_clear_state(d);
371 d->addr = __addr(s->initiator, dlci);
374 d->state = BT_CONFIG;
375 rfcomm_dlc_link(s, d);
378 d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
380 if (s->state == BT_CONNECTED)
381 rfcomm_send_pn(s, 1, d);
382 rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
386 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
392 r = __rfcomm_dlc_open(d, src, dst, channel);
398 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
400 struct rfcomm_session *s = d->session;
404 BT_DBG("dlc %p state %ld dlci %d err %d session %p",
405 d, d->state, d->dlci, err, s);
411 d->state = BT_DISCONN;
412 if (skb_queue_empty(&d->tx_queue)) {
413 rfcomm_send_disc(s, d->dlci);
414 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
416 rfcomm_queue_disc(d);
417 rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
422 rfcomm_dlc_clear_timer(d);
425 d->state = BT_CLOSED;
426 d->state_change(d, err);
427 rfcomm_dlc_unlock(d);
429 skb_queue_purge(&d->tx_queue);
430 rfcomm_dlc_unlink(d);
436 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
442 r = __rfcomm_dlc_close(d, err);
448 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
452 if (d->state != BT_CONNECTED)
455 BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
460 rfcomm_make_uih(skb, d->addr);
461 skb_queue_tail(&d->tx_queue, skb);
463 if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
464 rfcomm_schedule(RFCOMM_SCHED_TX);
468 void fastcall __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
470 BT_DBG("dlc %p state %ld", d, d->state);
473 d->v24_sig |= RFCOMM_V24_FC;
474 set_bit(RFCOMM_MSC_PENDING, &d->flags);
476 rfcomm_schedule(RFCOMM_SCHED_TX);
479 void fastcall __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
481 BT_DBG("dlc %p state %ld", d, d->state);
484 d->v24_sig &= ~RFCOMM_V24_FC;
485 set_bit(RFCOMM_MSC_PENDING, &d->flags);
487 rfcomm_schedule(RFCOMM_SCHED_TX);
491 Set/get modem status functions use _local_ status i.e. what we report
493 Remote status is provided by dlc->modem_status() callback.
495 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
497 BT_DBG("dlc %p state %ld v24_sig 0x%x",
498 d, d->state, v24_sig);
500 if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
501 v24_sig |= RFCOMM_V24_FC;
503 v24_sig &= ~RFCOMM_V24_FC;
505 d->v24_sig = v24_sig;
507 if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
508 rfcomm_schedule(RFCOMM_SCHED_TX);
513 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
515 BT_DBG("dlc %p state %ld v24_sig 0x%x",
516 d, d->state, d->v24_sig);
518 *v24_sig = d->v24_sig;
522 /* ---- RFCOMM sessions ---- */
523 static struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
525 struct rfcomm_session *s = kmalloc(sizeof(*s), GFP_KERNEL);
528 memset(s, 0, sizeof(*s));
530 BT_DBG("session %p sock %p", s, sock);
532 INIT_LIST_HEAD(&s->dlcs);
536 s->mtu = RFCOMM_DEFAULT_MTU;
537 s->cfc = disable_cfc ? RFCOMM_CFC_DISABLED : RFCOMM_CFC_UNKNOWN;
539 /* Do not increment module usage count for listening sessions.
540 * Otherwise we won't be able to unload the module. */
541 if (state != BT_LISTEN)
542 if (!try_module_get(THIS_MODULE)) {
547 list_add(&s->list, &session_list);
552 static void rfcomm_session_del(struct rfcomm_session *s)
554 int state = s->state;
556 BT_DBG("session %p state %ld", s, s->state);
560 if (state == BT_CONNECTED)
561 rfcomm_send_disc(s, 0);
563 sock_release(s->sock);
566 if (state != BT_LISTEN)
567 module_put(THIS_MODULE);
570 static struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
572 struct rfcomm_session *s;
573 struct list_head *p, *n;
575 list_for_each_safe(p, n, &session_list) {
576 s = list_entry(p, struct rfcomm_session, list);
577 sk = bt_sk(s->sock->sk);
579 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
580 !bacmp(&sk->dst, dst))
586 static void rfcomm_session_close(struct rfcomm_session *s, int err)
588 struct rfcomm_dlc *d;
589 struct list_head *p, *n;
591 BT_DBG("session %p state %ld err %d", s, s->state, err);
593 rfcomm_session_hold(s);
595 s->state = BT_CLOSED;
598 list_for_each_safe(p, n, &s->dlcs) {
599 d = list_entry(p, struct rfcomm_dlc, list);
600 d->state = BT_CLOSED;
601 __rfcomm_dlc_close(d, err);
604 rfcomm_session_put(s);
607 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
609 struct rfcomm_session *s = NULL;
610 struct sockaddr_l2 addr;
614 BT_DBG("%s %s", batostr(src), batostr(dst));
616 *err = rfcomm_l2sock_create(&sock);
620 bacpy(&addr.l2_bdaddr, src);
621 addr.l2_family = AF_BLUETOOTH;
623 *err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
627 /* Set L2CAP options */
630 l2cap_pi(sk)->imtu = l2cap_mtu;
633 s = rfcomm_session_add(sock, BT_BOUND);
641 bacpy(&addr.l2_bdaddr, dst);
642 addr.l2_family = AF_BLUETOOTH;
643 addr.l2_psm = htobs(RFCOMM_PSM);
644 *err = sock->ops->connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
645 if (*err == 0 || *err == -EAGAIN)
648 rfcomm_session_del(s);
656 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
658 struct sock *sk = s->sock->sk;
660 bacpy(src, &bt_sk(sk)->src);
662 bacpy(dst, &bt_sk(sk)->dst);
665 /* ---- RFCOMM frame sending ---- */
666 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
668 struct socket *sock = s->sock;
669 struct kvec iv = { data, len };
672 BT_DBG("session %p len %d", s, len);
674 memset(&msg, 0, sizeof(msg));
676 return kernel_sendmsg(sock, &msg, &iv, 1, len);
679 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
681 struct rfcomm_cmd cmd;
683 BT_DBG("%p dlci %d", s, dlci);
685 cmd.addr = __addr(s->initiator, dlci);
686 cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
688 cmd.fcs = __fcs2((u8 *) &cmd);
690 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
693 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
695 struct rfcomm_cmd cmd;
697 BT_DBG("%p dlci %d", s, dlci);
699 cmd.addr = __addr(!s->initiator, dlci);
700 cmd.ctrl = __ctrl(RFCOMM_UA, 1);
702 cmd.fcs = __fcs2((u8 *) &cmd);
704 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
707 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
709 struct rfcomm_cmd cmd;
711 BT_DBG("%p dlci %d", s, dlci);
713 cmd.addr = __addr(s->initiator, dlci);
714 cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
716 cmd.fcs = __fcs2((u8 *) &cmd);
718 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
721 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
723 struct rfcomm_cmd *cmd;
726 BT_DBG("dlc %p dlci %d", d, d->dlci);
728 skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
732 cmd = (void *) __skb_put(skb, sizeof(*cmd));
734 cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
735 cmd->len = __len8(0);
736 cmd->fcs = __fcs2((u8 *) cmd);
738 skb_queue_tail(&d->tx_queue, skb);
739 rfcomm_schedule(RFCOMM_SCHED_TX);
743 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
745 struct rfcomm_cmd cmd;
747 BT_DBG("%p dlci %d", s, dlci);
749 cmd.addr = __addr(!s->initiator, dlci);
750 cmd.ctrl = __ctrl(RFCOMM_DM, 1);
752 cmd.fcs = __fcs2((u8 *) &cmd);
754 return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
757 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
759 struct rfcomm_hdr *hdr;
760 struct rfcomm_mcc *mcc;
761 u8 buf[16], *ptr = buf;
763 BT_DBG("%p cr %d type %d", s, cr, type);
765 hdr = (void *) ptr; ptr += sizeof(*hdr);
766 hdr->addr = __addr(s->initiator, 0);
767 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
768 hdr->len = __len8(sizeof(*mcc) + 1);
770 mcc = (void *) ptr; ptr += sizeof(*mcc);
771 mcc->type = __mcc_type(cr, RFCOMM_NSC);
772 mcc->len = __len8(1);
774 /* Type that we didn't like */
775 *ptr = __mcc_type(cr, type); ptr++;
777 *ptr = __fcs(buf); ptr++;
779 return rfcomm_send_frame(s, buf, ptr - buf);
782 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
784 struct rfcomm_hdr *hdr;
785 struct rfcomm_mcc *mcc;
786 struct rfcomm_pn *pn;
787 u8 buf[16], *ptr = buf;
789 BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
791 hdr = (void *) ptr; ptr += sizeof(*hdr);
792 hdr->addr = __addr(s->initiator, 0);
793 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
794 hdr->len = __len8(sizeof(*mcc) + sizeof(*pn));
796 mcc = (void *) ptr; ptr += sizeof(*mcc);
797 mcc->type = __mcc_type(cr, RFCOMM_PN);
798 mcc->len = __len8(sizeof(*pn));
800 pn = (void *) ptr; ptr += sizeof(*pn);
802 pn->priority = d->priority;
807 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
808 pn->credits = RFCOMM_DEFAULT_CREDITS;
814 pn->mtu = htobs(d->mtu);
816 *ptr = __fcs(buf); ptr++;
818 return rfcomm_send_frame(s, buf, ptr - buf);
821 int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
822 u8 bit_rate, u8 data_bits, u8 stop_bits,
823 u8 parity, u8 flow_ctrl_settings,
824 u8 xon_char, u8 xoff_char, u16 param_mask)
826 struct rfcomm_hdr *hdr;
827 struct rfcomm_mcc *mcc;
828 struct rfcomm_rpn *rpn;
829 u8 buf[16], *ptr = buf;
831 BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
832 " flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
833 s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
834 flow_ctrl_settings, xon_char, xoff_char, param_mask);
836 hdr = (void *) ptr; ptr += sizeof(*hdr);
837 hdr->addr = __addr(s->initiator, 0);
838 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
839 hdr->len = __len8(sizeof(*mcc) + sizeof(*rpn));
841 mcc = (void *) ptr; ptr += sizeof(*mcc);
842 mcc->type = __mcc_type(cr, RFCOMM_RPN);
843 mcc->len = __len8(sizeof(*rpn));
845 rpn = (void *) ptr; ptr += sizeof(*rpn);
846 rpn->dlci = __addr(1, dlci);
847 rpn->bit_rate = bit_rate;
848 rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
849 rpn->flow_ctrl = flow_ctrl_settings;
850 rpn->xon_char = xon_char;
851 rpn->xoff_char = xoff_char;
852 rpn->param_mask = param_mask;
854 *ptr = __fcs(buf); ptr++;
856 return rfcomm_send_frame(s, buf, ptr - buf);
859 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
861 struct rfcomm_hdr *hdr;
862 struct rfcomm_mcc *mcc;
863 struct rfcomm_rls *rls;
864 u8 buf[16], *ptr = buf;
866 BT_DBG("%p cr %d status 0x%x", s, cr, status);
868 hdr = (void *) ptr; ptr += sizeof(*hdr);
869 hdr->addr = __addr(s->initiator, 0);
870 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
871 hdr->len = __len8(sizeof(*mcc) + sizeof(*rls));
873 mcc = (void *) ptr; ptr += sizeof(*mcc);
874 mcc->type = __mcc_type(cr, RFCOMM_RLS);
875 mcc->len = __len8(sizeof(*rls));
877 rls = (void *) ptr; ptr += sizeof(*rls);
878 rls->dlci = __addr(1, dlci);
879 rls->status = status;
881 *ptr = __fcs(buf); ptr++;
883 return rfcomm_send_frame(s, buf, ptr - buf);
886 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
888 struct rfcomm_hdr *hdr;
889 struct rfcomm_mcc *mcc;
890 struct rfcomm_msc *msc;
891 u8 buf[16], *ptr = buf;
893 BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
895 hdr = (void *) ptr; ptr += sizeof(*hdr);
896 hdr->addr = __addr(s->initiator, 0);
897 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
898 hdr->len = __len8(sizeof(*mcc) + sizeof(*msc));
900 mcc = (void *) ptr; ptr += sizeof(*mcc);
901 mcc->type = __mcc_type(cr, RFCOMM_MSC);
902 mcc->len = __len8(sizeof(*msc));
904 msc = (void *) ptr; ptr += sizeof(*msc);
905 msc->dlci = __addr(1, dlci);
906 msc->v24_sig = v24_sig | 0x01;
908 *ptr = __fcs(buf); ptr++;
910 return rfcomm_send_frame(s, buf, ptr - buf);
913 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
915 struct rfcomm_hdr *hdr;
916 struct rfcomm_mcc *mcc;
917 u8 buf[16], *ptr = buf;
919 BT_DBG("%p cr %d", s, cr);
921 hdr = (void *) ptr; ptr += sizeof(*hdr);
922 hdr->addr = __addr(s->initiator, 0);
923 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
924 hdr->len = __len8(sizeof(*mcc));
926 mcc = (void *) ptr; ptr += sizeof(*mcc);
927 mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
928 mcc->len = __len8(0);
930 *ptr = __fcs(buf); ptr++;
932 return rfcomm_send_frame(s, buf, ptr - buf);
935 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
937 struct rfcomm_hdr *hdr;
938 struct rfcomm_mcc *mcc;
939 u8 buf[16], *ptr = buf;
941 BT_DBG("%p cr %d", s, cr);
943 hdr = (void *) ptr; ptr += sizeof(*hdr);
944 hdr->addr = __addr(s->initiator, 0);
945 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
946 hdr->len = __len8(sizeof(*mcc));
948 mcc = (void *) ptr; ptr += sizeof(*mcc);
949 mcc->type = __mcc_type(cr, RFCOMM_FCON);
950 mcc->len = __len8(0);
952 *ptr = __fcs(buf); ptr++;
954 return rfcomm_send_frame(s, buf, ptr - buf);
957 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
959 struct socket *sock = s->sock;
962 unsigned char hdr[5], crc[1];
967 BT_DBG("%p cr %d", s, cr);
969 hdr[0] = __addr(s->initiator, 0);
970 hdr[1] = __ctrl(RFCOMM_UIH, 0);
971 hdr[2] = 0x01 | ((len + 2) << 1);
972 hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
973 hdr[4] = 0x01 | (len << 1);
977 iv[0].iov_base = hdr;
979 iv[1].iov_base = pattern;
981 iv[2].iov_base = crc;
984 memset(&msg, 0, sizeof(msg));
986 return kernel_sendmsg(sock, &msg, iv, 3, 6 + len);
989 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
991 struct rfcomm_hdr *hdr;
992 u8 buf[16], *ptr = buf;
994 BT_DBG("%p addr %d credits %d", s, addr, credits);
996 hdr = (void *) ptr; ptr += sizeof(*hdr);
998 hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
999 hdr->len = __len8(0);
1001 *ptr = credits; ptr++;
1003 *ptr = __fcs(buf); ptr++;
1005 return rfcomm_send_frame(s, buf, ptr - buf);
1008 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
1010 struct rfcomm_hdr *hdr;
1015 hdr = (void *) skb_push(skb, 4);
1016 put_unaligned(htobs(__len16(len)), (u16 *) &hdr->len);
1018 hdr = (void *) skb_push(skb, 3);
1019 hdr->len = __len8(len);
1022 hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
1024 crc = skb_put(skb, 1);
1025 *crc = __fcs((void *) hdr);
1028 /* ---- RFCOMM frame reception ---- */
1029 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
1031 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1035 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1037 rfcomm_send_dm(s, dlci);
1043 rfcomm_dlc_clear_timer(d);
1046 d->state = BT_CONNECTED;
1047 d->state_change(d, 0);
1048 rfcomm_dlc_unlock(d);
1050 rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1054 d->state = BT_CLOSED;
1055 __rfcomm_dlc_close(d, 0);
1059 /* Control channel */
1062 s->state = BT_CONNECTED;
1063 rfcomm_process_connect(s);
1070 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1074 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1078 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1080 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1085 d->state = BT_CLOSED;
1086 __rfcomm_dlc_close(d, err);
1089 if (s->state == BT_CONNECT)
1094 s->state = BT_CLOSED;
1095 rfcomm_session_close(s, err);
1100 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1104 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1107 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1109 rfcomm_send_ua(s, dlci);
1111 if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1116 d->state = BT_CLOSED;
1117 __rfcomm_dlc_close(d, err);
1119 rfcomm_send_dm(s, dlci);
1122 rfcomm_send_ua(s, 0);
1124 if (s->state == BT_CONNECT)
1129 s->state = BT_CLOSED;
1130 rfcomm_session_close(s, err);
1136 static inline int rfcomm_check_link_mode(struct rfcomm_dlc *d)
1138 struct sock *sk = d->session->sock->sk;
1140 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE)) {
1141 if (!hci_conn_encrypt(l2cap_pi(sk)->conn->hcon))
1143 } else if (d->link_mode & RFCOMM_LM_AUTH) {
1144 if (!hci_conn_auth(l2cap_pi(sk)->conn->hcon))
1151 static void rfcomm_dlc_accept(struct rfcomm_dlc *d)
1153 struct sock *sk = d->session->sock->sk;
1155 BT_DBG("dlc %p", d);
1157 rfcomm_send_ua(d->session, d->dlci);
1160 d->state = BT_CONNECTED;
1161 d->state_change(d, 0);
1162 rfcomm_dlc_unlock(d);
1164 if (d->link_mode & RFCOMM_LM_MASTER)
1165 hci_conn_switch_role(l2cap_pi(sk)->conn->hcon, 0x00);
1167 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1170 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1172 struct rfcomm_dlc *d;
1175 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1178 rfcomm_send_ua(s, 0);
1180 if (s->state == BT_OPEN) {
1181 s->state = BT_CONNECTED;
1182 rfcomm_process_connect(s);
1187 /* Check if DLC exists */
1188 d = rfcomm_dlc_get(s, dlci);
1190 if (d->state == BT_OPEN) {
1191 /* DLC was previously opened by PN request */
1192 if (rfcomm_check_link_mode(d)) {
1193 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1194 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1198 rfcomm_dlc_accept(d);
1203 /* Notify socket layer about incoming connection */
1204 channel = __srv_channel(dlci);
1205 if (rfcomm_connect_ind(s, channel, &d)) {
1207 d->addr = __addr(s->initiator, dlci);
1208 rfcomm_dlc_link(s, d);
1210 if (rfcomm_check_link_mode(d)) {
1211 set_bit(RFCOMM_AUTH_PENDING, &d->flags);
1212 rfcomm_dlc_set_timer(d, RFCOMM_AUTH_TIMEOUT);
1216 rfcomm_dlc_accept(d);
1218 rfcomm_send_dm(s, dlci);
1224 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1226 struct rfcomm_session *s = d->session;
1228 BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1229 d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1231 if ((pn->flow_ctrl == 0xf0 && s->cfc != RFCOMM_CFC_DISABLED) ||
1232 pn->flow_ctrl == 0xe0) {
1233 d->cfc = RFCOMM_CFC_ENABLED;
1234 d->tx_credits = pn->credits;
1236 d->cfc = RFCOMM_CFC_DISABLED;
1237 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1240 if (s->cfc == RFCOMM_CFC_UNKNOWN)
1243 d->priority = pn->priority;
1245 d->mtu = s->mtu = btohs(pn->mtu);
1250 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1252 struct rfcomm_pn *pn = (void *) skb->data;
1253 struct rfcomm_dlc *d;
1256 BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1261 d = rfcomm_dlc_get(s, dlci);
1265 rfcomm_apply_pn(d, cr, pn);
1266 rfcomm_send_pn(s, 0, d);
1271 rfcomm_apply_pn(d, cr, pn);
1273 d->state = BT_CONNECT;
1274 rfcomm_send_sabm(s, d->dlci);
1279 u8 channel = __srv_channel(dlci);
1284 /* PN request for non existing DLC.
1285 * Assume incoming connection. */
1286 if (rfcomm_connect_ind(s, channel, &d)) {
1288 d->addr = __addr(s->initiator, dlci);
1289 rfcomm_dlc_link(s, d);
1291 rfcomm_apply_pn(d, cr, pn);
1294 rfcomm_send_pn(s, 0, d);
1296 rfcomm_send_dm(s, dlci);
1302 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1304 struct rfcomm_rpn *rpn = (void *) skb->data;
1305 u8 dlci = __get_dlci(rpn->dlci);
1314 u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1316 BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1317 dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1318 rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1324 /* This is a request, return default settings */
1325 bit_rate = RFCOMM_RPN_BR_115200;
1326 data_bits = RFCOMM_RPN_DATA_8;
1327 stop_bits = RFCOMM_RPN_STOP_1;
1328 parity = RFCOMM_RPN_PARITY_NONE;
1329 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1330 xon_char = RFCOMM_RPN_XON_CHAR;
1331 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1335 /* Check for sane values, ignore/accept bit_rate, 8 bits, 1 stop bit,
1336 * no parity, no flow control lines, normal XON/XOFF chars */
1338 if (rpn->param_mask & RFCOMM_RPN_PM_BITRATE) {
1339 bit_rate = rpn->bit_rate;
1340 if (bit_rate != RFCOMM_RPN_BR_115200) {
1341 BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1342 bit_rate = RFCOMM_RPN_BR_115200;
1343 rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1347 if (rpn->param_mask & RFCOMM_RPN_PM_DATA) {
1348 data_bits = __get_rpn_data_bits(rpn->line_settings);
1349 if (data_bits != RFCOMM_RPN_DATA_8) {
1350 BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1351 data_bits = RFCOMM_RPN_DATA_8;
1352 rpn_mask ^= RFCOMM_RPN_PM_DATA;
1356 if (rpn->param_mask & RFCOMM_RPN_PM_STOP) {
1357 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1358 if (stop_bits != RFCOMM_RPN_STOP_1) {
1359 BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1360 stop_bits = RFCOMM_RPN_STOP_1;
1361 rpn_mask ^= RFCOMM_RPN_PM_STOP;
1365 if (rpn->param_mask & RFCOMM_RPN_PM_PARITY) {
1366 parity = __get_rpn_parity(rpn->line_settings);
1367 if (parity != RFCOMM_RPN_PARITY_NONE) {
1368 BT_DBG("RPN parity mismatch 0x%x", parity);
1369 parity = RFCOMM_RPN_PARITY_NONE;
1370 rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1374 if (rpn->param_mask & RFCOMM_RPN_PM_FLOW) {
1375 flow_ctrl = rpn->flow_ctrl;
1376 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1377 BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1378 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1379 rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1383 if (rpn->param_mask & RFCOMM_RPN_PM_XON) {
1384 xon_char = rpn->xon_char;
1385 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1386 BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1387 xon_char = RFCOMM_RPN_XON_CHAR;
1388 rpn_mask ^= RFCOMM_RPN_PM_XON;
1392 if (rpn->param_mask & RFCOMM_RPN_PM_XOFF) {
1393 xoff_char = rpn->xoff_char;
1394 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1395 BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1396 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1397 rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1402 rfcomm_send_rpn(s, 0, dlci, bit_rate, data_bits, stop_bits,
1403 parity, flow_ctrl, xon_char, xoff_char, rpn_mask);
1408 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1410 struct rfcomm_rls *rls = (void *) skb->data;
1411 u8 dlci = __get_dlci(rls->dlci);
1413 BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1418 /* We should probably do something with this information here. But
1419 * for now it's sufficient just to reply -- Bluetooth 1.1 says it's
1420 * mandatory to recognise and respond to RLS */
1422 rfcomm_send_rls(s, 0, dlci, rls->status);
1427 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1429 struct rfcomm_msc *msc = (void *) skb->data;
1430 struct rfcomm_dlc *d;
1431 u8 dlci = __get_dlci(msc->dlci);
1433 BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1435 d = rfcomm_dlc_get(s, dlci);
1440 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1441 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1443 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1446 if (d->modem_status)
1447 d->modem_status(d, msc->v24_sig);
1448 rfcomm_dlc_unlock(d);
1450 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1452 d->mscex |= RFCOMM_MSCEX_RX;
1454 d->mscex |= RFCOMM_MSCEX_TX;
1459 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1461 struct rfcomm_mcc *mcc = (void *) skb->data;
1464 cr = __test_cr(mcc->type);
1465 type = __get_mcc_type(mcc->type);
1466 len = __get_mcc_len(mcc->len);
1468 BT_DBG("%p type 0x%x cr %d", s, type, cr);
1474 rfcomm_recv_pn(s, cr, skb);
1478 rfcomm_recv_rpn(s, cr, len, skb);
1482 rfcomm_recv_rls(s, cr, skb);
1486 rfcomm_recv_msc(s, cr, skb);
1491 set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1492 rfcomm_send_fcoff(s, 0);
1498 clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1499 rfcomm_send_fcon(s, 0);
1505 rfcomm_send_test(s, 0, skb->data, skb->len);
1512 BT_ERR("Unknown control type 0x%02x", type);
1513 rfcomm_send_nsc(s, cr, type);
1519 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1521 struct rfcomm_dlc *d;
1523 BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1525 d = rfcomm_dlc_get(s, dlci);
1527 rfcomm_send_dm(s, dlci);
1532 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1534 d->tx_credits += credits;
1536 clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1539 if (skb->len && d->state == BT_CONNECTED) {
1542 d->data_ready(d, skb);
1543 rfcomm_dlc_unlock(d);
1552 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1554 struct rfcomm_hdr *hdr = (void *) skb->data;
1557 dlci = __get_dlci(hdr->addr);
1558 type = __get_type(hdr->ctrl);
1561 skb->len--; skb->tail--;
1562 fcs = *(u8 *) skb->tail;
1564 if (__check_fcs(skb->data, type, fcs)) {
1565 BT_ERR("bad checksum in packet");
1570 if (__test_ea(hdr->len))
1577 if (__test_pf(hdr->ctrl))
1578 rfcomm_recv_sabm(s, dlci);
1582 if (__test_pf(hdr->ctrl))
1583 rfcomm_recv_disc(s, dlci);
1587 if (__test_pf(hdr->ctrl))
1588 rfcomm_recv_ua(s, dlci);
1592 rfcomm_recv_dm(s, dlci);
1597 return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1599 rfcomm_recv_mcc(s, skb);
1603 BT_ERR("Unknown packet type 0x%02x\n", type);
1610 /* ---- Connection and data processing ---- */
1612 static void rfcomm_process_connect(struct rfcomm_session *s)
1614 struct rfcomm_dlc *d;
1615 struct list_head *p, *n;
1617 BT_DBG("session %p state %ld", s, s->state);
1619 list_for_each_safe(p, n, &s->dlcs) {
1620 d = list_entry(p, struct rfcomm_dlc, list);
1621 if (d->state == BT_CONFIG) {
1623 rfcomm_send_pn(s, 1, d);
1628 /* Send data queued for the DLC.
1629 * Return number of frames left in the queue.
1631 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1633 struct sk_buff *skb;
1636 BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1637 d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1639 /* Send pending MSC */
1640 if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1641 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1645 * Give them some credits */
1646 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1647 d->rx_credits <= (d->cfc >> 2)) {
1648 rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1649 d->rx_credits = d->cfc;
1653 * Give ourselves some credits */
1657 if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1658 return skb_queue_len(&d->tx_queue);
1660 while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1661 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1663 skb_queue_head(&d->tx_queue, skb);
1670 if (d->cfc && !d->tx_credits) {
1671 /* We're out of TX credits.
1672 * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1673 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1676 return skb_queue_len(&d->tx_queue);
1679 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1681 struct rfcomm_dlc *d;
1682 struct list_head *p, *n;
1684 BT_DBG("session %p state %ld", s, s->state);
1686 list_for_each_safe(p, n, &s->dlcs) {
1687 d = list_entry(p, struct rfcomm_dlc, list);
1689 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1690 __rfcomm_dlc_close(d, ETIMEDOUT);
1694 if (test_and_clear_bit(RFCOMM_AUTH_ACCEPT, &d->flags)) {
1695 rfcomm_dlc_clear_timer(d);
1696 rfcomm_dlc_accept(d);
1697 if (d->link_mode & RFCOMM_LM_SECURE) {
1698 struct sock *sk = s->sock->sk;
1699 hci_conn_change_link_key(l2cap_pi(sk)->conn->hcon);
1702 } else if (test_and_clear_bit(RFCOMM_AUTH_REJECT, &d->flags)) {
1703 rfcomm_dlc_clear_timer(d);
1704 rfcomm_send_dm(s, d->dlci);
1705 __rfcomm_dlc_close(d, ECONNREFUSED);
1709 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1712 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1713 d->mscex == RFCOMM_MSCEX_OK)
1714 rfcomm_process_tx(d);
1718 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1720 struct socket *sock = s->sock;
1721 struct sock *sk = sock->sk;
1722 struct sk_buff *skb;
1724 BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1726 /* Get data directly from socket receive queue without copying it. */
1727 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1729 rfcomm_recv_frame(s, skb);
1732 if (sk->sk_state == BT_CLOSED) {
1734 rfcomm_session_put(s);
1736 rfcomm_session_close(s, sk->sk_err);
1740 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1742 struct socket *sock = s->sock, *nsock;
1745 /* Fast check for a new connection.
1746 * Avoids unnesesary socket allocations. */
1747 if (list_empty(&bt_sk(sock->sk)->accept_q))
1750 BT_DBG("session %p", s);
1752 if (sock_create_lite(PF_BLUETOOTH, sock->type, BTPROTO_L2CAP, &nsock))
1755 nsock->ops = sock->ops;
1757 __module_get(nsock->ops->owner);
1759 err = sock->ops->accept(sock, nsock, O_NONBLOCK);
1761 sock_release(nsock);
1765 /* Set our callbacks */
1766 nsock->sk->sk_data_ready = rfcomm_l2data_ready;
1767 nsock->sk->sk_state_change = rfcomm_l2state_change;
1769 s = rfcomm_session_add(nsock, BT_OPEN);
1771 rfcomm_session_hold(s);
1772 rfcomm_schedule(RFCOMM_SCHED_RX);
1774 sock_release(nsock);
1777 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1779 struct sock *sk = s->sock->sk;
1781 BT_DBG("%p state %ld", s, s->state);
1783 switch(sk->sk_state) {
1785 s->state = BT_CONNECT;
1787 /* We can adjust MTU on outgoing sessions.
1788 * L2CAP MTU minus UIH header and FCS. */
1789 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1791 rfcomm_send_sabm(s, 0);
1795 s->state = BT_CLOSED;
1796 rfcomm_session_close(s, sk->sk_err);
1801 static inline void rfcomm_process_sessions(void)
1803 struct list_head *p, *n;
1807 list_for_each_safe(p, n, &session_list) {
1808 struct rfcomm_session *s;
1809 s = list_entry(p, struct rfcomm_session, list);
1811 if (s->state == BT_LISTEN) {
1812 rfcomm_accept_connection(s);
1816 rfcomm_session_hold(s);
1820 rfcomm_check_connection(s);
1824 rfcomm_process_rx(s);
1828 rfcomm_process_dlcs(s);
1830 rfcomm_session_put(s);
1836 static void rfcomm_worker(void)
1840 while (!atomic_read(&terminate)) {
1841 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1842 /* No pending events. Let's sleep.
1843 * Incoming connections and data will wake us up. */
1844 set_current_state(TASK_INTERRUPTIBLE);
1849 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1850 rfcomm_process_sessions();
1852 set_current_state(TASK_RUNNING);
1856 static int rfcomm_add_listener(bdaddr_t *ba)
1858 struct sockaddr_l2 addr;
1859 struct socket *sock;
1861 struct rfcomm_session *s;
1865 err = rfcomm_l2sock_create(&sock);
1867 BT_ERR("Create socket failed %d", err);
1872 bacpy(&addr.l2_bdaddr, ba);
1873 addr.l2_family = AF_BLUETOOTH;
1874 addr.l2_psm = htobs(RFCOMM_PSM);
1875 err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1877 BT_ERR("Bind failed %d", err);
1881 /* Set L2CAP options */
1884 l2cap_pi(sk)->imtu = l2cap_mtu;
1887 /* Start listening on the socket */
1888 err = sock->ops->listen(sock, 10);
1890 BT_ERR("Listen failed %d", err);
1894 /* Add listening session */
1895 s = rfcomm_session_add(sock, BT_LISTEN);
1899 rfcomm_session_hold(s);
1906 static void rfcomm_kill_listener(void)
1908 struct rfcomm_session *s;
1909 struct list_head *p, *n;
1913 list_for_each_safe(p, n, &session_list) {
1914 s = list_entry(p, struct rfcomm_session, list);
1915 rfcomm_session_del(s);
1919 static int rfcomm_run(void *unused)
1921 rfcomm_thread = current;
1923 atomic_inc(&running);
1925 daemonize("krfcommd");
1926 set_user_nice(current, -10);
1927 current->flags |= PF_NOFREEZE;
1931 rfcomm_add_listener(BDADDR_ANY);
1935 rfcomm_kill_listener();
1937 atomic_dec(&running);
1941 static void rfcomm_auth_cfm(struct hci_conn *conn, u8 status)
1943 struct rfcomm_session *s;
1944 struct rfcomm_dlc *d;
1945 struct list_head *p, *n;
1947 BT_DBG("conn %p status 0x%02x", conn, status);
1949 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1953 rfcomm_session_hold(s);
1955 list_for_each_safe(p, n, &s->dlcs) {
1956 d = list_entry(p, struct rfcomm_dlc, list);
1958 if (d->link_mode & (RFCOMM_LM_ENCRYPT | RFCOMM_LM_SECURE))
1961 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1965 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1967 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
1970 rfcomm_session_put(s);
1972 rfcomm_schedule(RFCOMM_SCHED_AUTH);
1975 static void rfcomm_encrypt_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
1977 struct rfcomm_session *s;
1978 struct rfcomm_dlc *d;
1979 struct list_head *p, *n;
1981 BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
1983 s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
1987 rfcomm_session_hold(s);
1989 list_for_each_safe(p, n, &s->dlcs) {
1990 d = list_entry(p, struct rfcomm_dlc, list);
1992 if (!test_and_clear_bit(RFCOMM_AUTH_PENDING, &d->flags))
1995 if (!status && encrypt)
1996 set_bit(RFCOMM_AUTH_ACCEPT, &d->flags);
1998 set_bit(RFCOMM_AUTH_REJECT, &d->flags);
2001 rfcomm_session_put(s);
2003 rfcomm_schedule(RFCOMM_SCHED_AUTH);
2006 static struct hci_cb rfcomm_cb = {
2008 .auth_cfm = rfcomm_auth_cfm,
2009 .encrypt_cfm = rfcomm_encrypt_cfm
2012 static ssize_t rfcomm_dlc_sysfs_show(struct class *dev, char *buf)
2014 struct rfcomm_session *s;
2015 struct list_head *pp, *p;
2020 list_for_each(p, &session_list) {
2021 s = list_entry(p, struct rfcomm_session, list);
2022 list_for_each(pp, &s->dlcs) {
2023 struct sock *sk = s->sock->sk;
2024 struct rfcomm_dlc *d = list_entry(pp, struct rfcomm_dlc, list);
2026 str += sprintf(str, "%s %s %ld %d %d %d %d\n",
2027 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2028 d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
2037 static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2039 /* ---- Initialization ---- */
2040 static int __init rfcomm_init(void)
2044 hci_register_cb(&rfcomm_cb);
2046 kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
2048 class_create_file(bt_class, &class_attr_rfcomm_dlc);
2050 rfcomm_init_sockets();
2052 #ifdef CONFIG_BT_RFCOMM_TTY
2056 BT_INFO("RFCOMM ver %s", VERSION);
2061 static void __exit rfcomm_exit(void)
2063 class_remove_file(bt_class, &class_attr_rfcomm_dlc);
2065 hci_unregister_cb(&rfcomm_cb);
2067 /* Terminate working thread.
2068 * ie. Set terminate flag and wake it up */
2069 atomic_inc(&terminate);
2070 rfcomm_schedule(RFCOMM_SCHED_STATE);
2072 /* Wait until thread is running */
2073 while (atomic_read(&running))
2076 #ifdef CONFIG_BT_RFCOMM_TTY
2077 rfcomm_cleanup_ttys();
2080 rfcomm_cleanup_sockets();
2083 module_init(rfcomm_init);
2084 module_exit(rfcomm_exit);
2086 module_param(disable_cfc, bool, 0644);
2087 MODULE_PARM_DESC(disable_cfc, "Disable credit based flow control");
2089 module_param(l2cap_mtu, uint, 0644);
2090 MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2092 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
2093 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2094 MODULE_VERSION(VERSION);
2095 MODULE_LICENSE("GPL");
2096 MODULE_ALIAS("bt-proto-3");