org.handhelds.familiar/packages/linux/openzaurus-sa-2.4.18-rmk7-pxa3-embedix20030509/bluetooth-patch-2.4.18-mh9.diff

   1 diff -urN linux-2.4.18/CREDITS linux-2.4.18-mh9/CREDITS
   2 --- linux-2.4.18/CREDITS        Mon Feb 25 20:37:50 2002
   3 +++ linux-2.4.18-mh9/CREDITS    Mon Aug 25 18:38:09 2003
   4 @@ -1317,6 +1317,14 @@
   5  S: Provo, Utah 84606-5607
   6  S: USA
   7
   8 +N: Marcel Holtmann
   9 +E: marcel@holtmann.org
  10 +W: http://www.holtmann.org
  11 +D: Author and maintainer of the various Bluetooth HCI drivers
  12 +D: Author and maintainer of the CAPI message transport protocol driver
  13 +D: Various other Bluetooth related patches, cleanups and fixes
  14 +S: Germany
  15 +
  16  N: Rob W. W. Hooft
  17  E: hooft@EMBL-Heidelberg.DE
  18  D: Shared libs for graphics-tools and for the f2c compiler
  19 diff -urN linux-2.4.18/Documentation/Configure.help linux-2.4.18-mh9/Documentation/Configure.help
  20 --- linux-2.4.18/Documentation/Configure.help   Mon Feb 25 20:37:51 2002
  21 +++ linux-2.4.18-mh9/Documentation/Configure.help       Mon Aug 25 18:38:10 2003
  22 @@ -2824,14 +2824,6 @@
  23
  24    If unsure, say N.
  25
  26 -HCI EMU (virtual device) driver
  27 -CONFIG_BLUEZ_HCIEMU
  28 -  Bluetooth Virtual HCI device driver.
  29 -  This driver is required if you want to use HCI Emulation software.
  30 -
  31 -  Say Y here to compile support for Virtual HCI devices into the
  32 -  kernel or say M to compile it as module (hci_usb.o).
  33 -
  34  # Choice: alphatype
  35  Alpha system type
  36  CONFIG_ALPHA_GENERIC
  37 @@ -11037,6 +11029,12 @@
  38
  39    If unsure, say N.
  40
  41 +Hotplug firmware loading support (EXPERIMENTAL)
  42 +CONFIG_FW_LOADER
  43 +  This option is provided for the case where no in-kernel-tree modules require
  44 +  hotplug firmware loading support, but a module built outside the kernel tree
  45 +  does.
  46 +
  47  Use PCI shared memory for NIC registers
  48  CONFIG_TULIP_MMIO
  49    Use PCI shared memory for the NIC registers, rather than going through
  50 @@ -19870,11 +19868,15 @@
  51    Bluetooth can be found at <http://www.bluetooth.com/>.
  52
  53    Linux Bluetooth subsystem consist of several layers:
  54 -               HCI Core (device and connection manager, scheduler)
  55 +               BlueZ Core (HCI device and connection manager, scheduler)
  56                 HCI Device drivers (interface to the hardware)
  57                 L2CAP Module (L2CAP protocol)
  58 +               SCO Module (SCO links)
  59 +               RFCOMM Module (RFCOMM protocol)
  60 +               BNEP Module (BNEP protocol)
  61 +               CMTP Module (CMTP protocol)
  62
  63 -  Say Y here to enable Linux Bluetooth support and to build HCI Core
  64 +  Say Y here to enable Linux Bluetooth support and to build BlueZ Core
  65    layer.
  66
  67    To use Linux Bluetooth subsystem, you will need several user-space
  68 @@ -19882,7 +19884,7 @@
  69    Bluetooth kernel modules are provided in the BlueZ package.
  70    For more information, see <http://bluez.sourceforge.net/>.
  71
  72 -  If you want to compile HCI Core as module (hci.o) say M here.
  73 +  If you want to compile BlueZ Core as module (bluez.o) say M here.
  74
  75  L2CAP protocol support
  76  CONFIG_BLUEZ_L2CAP
  77 @@ -19893,15 +19895,91 @@
  78    Say Y here to compile L2CAP support into the kernel or say M to
  79    compile it as module (l2cap.o).
  80
  81 +SCO links support
  82 +CONFIG_BLUEZ_SCO
  83 +  SCO link provides voice transport over Bluetooth. SCO support is
  84 +  required for voice applications like Headset and Audio.
  85 +
  86 +  Say Y here to compile SCO support into the kernel or say M to
  87 +  compile it as module (sco.o).
  88 +
  89 +RFCOMM protocol support
  90 +CONFIG_BLUEZ_RFCOMM
  91 +  RFCOMM provides connection oriented stream transport. RFCOMM
  92 +  support is required for Dialup Networking, OBEX and other Bluetooth
  93 +  applications.
  94 +
  95 +  Say Y here to compile RFCOMM support into the kernel or say M to
  96 +  compile it as module (rfcomm.o).
  97 +
  98 +RFCOMM TTY emulation support
  99 +CONFIG_BLUEZ_RFCOMM_TTY
 100 +  This option enables TTY emulation support for RFCOMM channels.
 101 +
 102 +BNEP protocol support
 103 +CONFIG_BLUEZ_BNEP
 104 +  BNEP (Bluetooth Network Encapsulation Protocol) is Ethernet
 105 +  emulation layer on top of Bluetooth. BNEP is required for Bluetooth
 106 +  PAN (Personal Area Network).
 107 +
 108 +  To use BNEP, you will need user-space utilities provided in the
 109 +  BlueZ-PAN package.
 110 +  For more information, see <http://bluez.sourceforge.net>.
 111 +
 112 +  Say Y here to compile BNEP support into the kernel or say M to
 113 +  compile it as module (bnep.o).
 114 +
 115 +CMTP protocol support
 116 +CONFIG_BLUEZ_CMTP
 117 +  CMTP (CAPI Message Transport Protocol) is a transport layer
 118 +  for CAPI messages. CMTP is required for the Bluetooth Common
 119 +  ISDN Access Profile.
 120 +
 121 +  Say Y here to compile CMTP support into the kernel or say M to
 122 +  compile it as module (cmtp.o).
 123 +
 124 +BNEP multicast filter support
 125 +CONFIG_BLUEZ_BNEP_MC_FILTER
 126 +  This option enables the multicast filter support for BNEP.
 127 +
 128 +BNEP protocol filter support
 129 +CONFIG_BLUEZ_BNEP_PROTO_FILTER
 130 +  This option enables the protocol filter support for BNEP.
 131 +
 132  HCI UART driver
 133  CONFIG_BLUEZ_HCIUART
 134    Bluetooth HCI UART driver.
 135    This driver is required if you want to use Bluetooth devices with
 136 -  serial port interface.
 137 +  serial port interface. You will also need this driver if you have
 138 +  UART based Bluetooth PCMCIA and CF devices like Xircom Credit Card
 139 +  adapter and BrainBoxes Bluetooth PC Card.
 140
 141    Say Y here to compile support for Bluetooth UART devices into the
 142    kernel or say M to compile it as module (hci_uart.o).
 143
 144 +HCI UART (H4) protocol support
 145 +CONFIG_BLUEZ_HCIUART_H4
 146 +  UART (H4) is serial protocol for communication between Bluetooth
 147 +  device and host. This protocol is required for most Bluetooth devices
 148 +  with UART interface, including PCMCIA and CF cards.
 149 +
 150 +  Say Y here to compile support for HCI UART (H4) protocol.
 151 +
 152 +HCI BCSP protocol support
 153 +CONFIG_BLUEZ_HCIUART_BCSP
 154 +  BCSP (BlueCore Serial Protocol) is serial protocol for communication
 155 +  between Bluetooth device and host. This protocol is required for non
 156 +  USB Bluetooth devices based on CSR BlueCore chip, including PCMCIA and
 157 +  CF cards.
 158 +
 159 +  Say Y here to compile support for HCI BCSP protocol.
 160 +
 161 +HCI BCSP transmit CRC with every BCSP packet
 162 +CONFIG_BLUEZ_HCIUART_BCSP_TXCRC
 163 +  If you say Y here, a 16-bit CRC checksum will be transmitted along with
 164 +  every BCSP (BlueCore Serial Protocol) packet sent to the Bluetooth chip.
 165 +  This increases reliability, but slightly reduces efficiency.
 166 +
 167  HCI USB driver
 168  CONFIG_BLUEZ_HCIUSB
 169    Bluetooth HCI USB driver.
 170 @@ -19911,13 +19989,90 @@
 171    Say Y here to compile support for Bluetooth USB devices into the
 172    kernel or say M to compile it as module (hci_usb.o).
 173
 174 -HCI VHCI virtual HCI device driver
 175 +HCI USB SCO (voice) support
 176 +CONFIG_BLUEZ_USB_SCO
 177 +  This option enables the SCO support in the HCI USB driver. You need this
 178 +  to transmit voice data with your Bluetooth USB device. And your device
 179 +  must also support sending SCO data over the HCI layer, because some of
 180 +  them sends the SCO data to an internal PCM adapter.
 181 +
 182 +  Say Y here to compile support for HCI SCO data.
 183 +
 184 +HCI USB zero packet support
 185 +CONFIG_BLUEZ_USB_ZERO_PACKET
 186 +  This option is provided only as a work around for buggy Bluetooth USB
 187 +  devices. Do NOT enable it unless you know for sure that your device
 188 +  requires zero packets.
 189 +
 190 +  Most people should say N here.
 191 +
 192 +HCI VHCI Virtual HCI device driver
 193  CONFIG_BLUEZ_HCIVHCI
 194    Bluetooth Virtual HCI device driver.
 195    This driver is required if you want to use HCI Emulation software.
 196
 197    Say Y here to compile support for virtual HCI devices into the
 198    kernel or say M to compile it as module (hci_vhci.o).
 199 +
 200 +HCI BFUSB device driver
 201 +CONFIG_BLUEZ_HCIBFUSB
 202 +  Bluetooth HCI BlueFRITZ! USB driver.
 203 +  This driver provides support for Bluetooth USB devices with AVM
 204 +  interface:
 205 +     AVM BlueFRITZ! USB
 206 +
 207 +  Say Y here to compile support for HCI BFUSB devices into the
 208 +  kernel or say M to compile it as module (bfusb.o).
 209 +
 210 +HCI DTL1 (PC Card) device driver
 211 +CONFIG_BLUEZ_HCIDTL1
 212 +  Bluetooth HCI DTL1 (PC Card) driver.
 213 +  This driver provides support for Bluetooth PCMCIA devices with
 214 +  Nokia DTL1 interface:
 215 +     Nokia Bluetooth Card
 216 +     Socket Bluetooth CF Card
 217 +
 218 +  Say Y here to compile support for HCI DTL1 devices into the
 219 +  kernel or say M to compile it as module (dtl1_cs.o).
 220 +
 221 +HCI BT3C (PC Card) device driver
 222 +CONFIG_BLUEZ_HCIBT3C
 223 +  Bluetooth HCI BT3C (PC Card) driver.
 224 +  This driver provides support for Bluetooth PCMCIA devices with
 225 +  3Com BT3C interface:
 226 +     3Com Bluetooth Card (3CRWB6096)
 227 +     HP Bluetooth Card
 228 +
 229 +  The HCI BT3C driver uses external firmware loader program provided in
 230 +  the BlueFW package. For more information, see <http://bluez.sf.net>.
 231 +
 232 +  Say Y here to compile support for HCI BT3C devices into the
 233 +  kernel or say M to compile it as module (bt3c_cs.o).
 234 +
 235 +HCI BlueCard (PC Card) device driver
 236 +CONFIG_BLUEZ_HCIBLUECARD
 237 +  Bluetooth HCI BlueCard (PC Card) driver.
 238 +  This driver provides support for Bluetooth PCMCIA devices with
 239 +  Anycom BlueCard interface:
 240 +     Anycom Bluetooth PC Card
 241 +     Anycom Bluetooth CF Card
 242 +
 243 +  Say Y here to compile support for HCI BlueCard devices into the
 244 +  kernel or say M to compile it as module (bluecard_cs.o).
 245 +
 246 +HCI UART (PC Card) device driver
 247 +CONFIG_BLUEZ_HCIBTUART
 248 +  Bluetooth HCI UART (PC Card) driver.
 249 +  This driver provides support for Bluetooth PCMCIA devices with
 250 +  an UART interface:
 251 +     Xircom CreditCard Bluetooth Adapter
 252 +     Xircom RealPort2 Bluetooth Adapter
 253 +     Sphinx PICO Card
 254 +     H-Soft blue+Card
 255 +     Cyber-blue Compact Flash Card
 256 +
 257 +  Say Y here to compile support for HCI UART devices into the
 258 +  kernel or say M to compile it as module (btuart_cs.o).
 259
 260  # The following options are for Linux when running on the Hitachi
 261  # SuperH family of RISC microprocessors.
 262 diff -urN linux-2.4.18/Documentation/firmware_class/README linux-2.4.18-mh9/Documentation/firmware_class/README
 263 --- linux-2.4.18/Documentation/firmware_class/README    Thu Jan  1 01:00:00 1970
 264 +++ linux-2.4.18-mh9/Documentation/firmware_class/README        Mon Aug 25 18:38:10 2003
 265 @@ -0,0 +1,58 @@
 266 +
 267 + request_firmware() hotplug interface:
 268 + ------------------------------------
 269 +       Copyright (C) 2003 Manuel Estrada Sainz <ranty@debian.org>
 270 +
 271 + Why:
 272 + ---
 273 +
 274 + Today, the most extended way to use firmware in the Linux kernel is linking
 275 + it statically in a header file. Which has political and technical issues:
 276 +
 277 +  1) Some firmware is not legal to redistribute.
 278 +  2) The firmware occupies memory permanently, even though it often is just
 279 +     used once.
 280 +  3) Some people, like the Debian crowd, don't consider some firmware free
 281 +     enough and remove entire drivers (e.g.: keyspan).
 282 +
 283 + about in-kernel persistence:
 284 + ---------------------------
 285 + Under some circumstances, as explained below, it would be interesting to keep
 286 + firmware images in non-swappable kernel memory or even in the kernel image
 287 + (probably within initramfs).
 288 +
 289 + Note that this functionality has not been implemented.
 290 +
 291 + - Why OPTIONAL in-kernel persistence may be a good idea sometimes:
 292 +
 293 +       - If the device that needs the firmware is needed to access the
 294 +         filesystem. When upon some error the device has to be reset and the
 295 +         firmware reloaded, it won't be possible to get it from userspace.
 296 +         e.g.:
 297 +               - A diskless client with a network card that needs firmware.
 298 +               - The filesystem is stored in a disk behind an scsi device
 299 +                 that needs firmware.
 300 +       - Replacing buggy DSDT/SSDT ACPI tables on boot.
 301 +         Note: this would require the persistent objects to be included
 302 +         within the kernel image, probably within initramfs.
 303 +
 304 +   And the same device can be needed to access the filesystem or not depending
 305 +   on the setup, so I think that the choice on what firmware to make
 306 +   persistent should be left to userspace.
 307 +
 308 + - Why register_firmware()+__init can be useful:
 309 +       - For boot devices needing firmware.
 310 +       - To make the transition easier:
 311 +               The firmware can be declared __init and register_firmware()
 312 +               called on module_init. Then the firmware is warranted to be
 313 +               there even if "firmware hotplug userspace" is not there yet or
 314 +               it doesn't yet provide the needed firmware.
 315 +               Once the firmware is widely available in userspace, it can be
 316 +               removed from the kernel. Or made optional (CONFIG_.*_FIRMWARE).
 317 +
 318 +       In either case, if firmware hotplug support is there, it can move the
 319 +       firmware out of kernel memory into the real filesystem for later
 320 +       usage.
 321 +
 322 +       Note: If persistence is implemented on top of initramfs,
 323 +       register_firmware() may not be appropriate.
 324 diff -urN linux-2.4.18/Documentation/firmware_class/firmware_sample_driver.c linux-2.4.18-mh9/Documentation/firmware_class/firmware_sample_driver.c
 325 --- linux-2.4.18/Documentation/firmware_class/firmware_sample_driver.c  Thu Jan  1 01:00:00 1970
 326 +++ linux-2.4.18-mh9/Documentation/firmware_class/firmware_sample_driver.c      Mon Aug 25 18:38:10 2003
 327 @@ -0,0 +1,121 @@
 328 +/*
 329 + * firmware_sample_driver.c -
 330 + *
 331 + * Copyright (c) 2003 Manuel Estrada Sainz <ranty@debian.org>
 332 + *
 333 + * Sample code on how to use request_firmware() from drivers.
 334 + *
 335 + * Note that register_firmware() is currently useless.
 336 + *
 337 + */
 338 +
 339 +#include <linux/module.h>
 340 +#include <linux/kernel.h>
 341 +#include <linux/init.h>
 342 +#include <linux/string.h>
 343 +
 344 +#include "linux/firmware.h"
 345 +
 346 +#define WE_CAN_NEED_FIRMWARE_BEFORE_USERSPACE_IS_AVAILABLE
 347 +#ifdef WE_CAN_NEED_FIRMWARE_BEFORE_USERSPACE_IS_AVAILABLE
 348 +char __init inkernel_firmware[] = "let's say that this is firmware\n";
 349 +#endif
 350 +
 351 +static char ghost_device[] = "ghost0";
 352 +
 353 +static void sample_firmware_load(char *firmware, int size)
 354 +{
 355 +       u8 buf[size+1];
 356 +       memcpy(buf, firmware, size);
 357 +       buf[size] = '\0';
 358 +       printk("firmware_sample_driver: firmware: %s\n", buf);
 359 +}
 360 +
 361 +static void sample_probe_default(void)
 362 +{
 363 +       /* uses the default method to get the firmware */
 364 +        const struct firmware *fw_entry;
 365 +       printk("firmware_sample_driver: a ghost device got inserted :)\n");
 366 +
 367 +        if(request_firmware(&fw_entry, "sample_driver_fw", ghost_device)!=0)
 368 +       {
 369 +               printk(KERN_ERR
 370 +                      "firmware_sample_driver: Firmware not available\n");
 371 +               return;
 372 +       }
 373 +
 374 +       sample_firmware_load(fw_entry->data, fw_entry->size);
 375 +
 376 +       release_firmware(fw_entry);
 377 +
 378 +       /* finish setting up the device */
 379 +}
 380 +static void sample_probe_specific(void)
 381 +{
 382 +       /* Uses some specific hotplug support to get the firmware from
 383 +        * userspace  directly into the hardware, or via some sysfs file */
 384 +
 385 +       /* NOTE: This currently doesn't work */
 386 +
 387 +       printk("firmware_sample_driver: a ghost device got inserted :)\n");
 388 +
 389 +        if(request_firmware(NULL, "sample_driver_fw", ghost_device)!=0)
 390 +       {
 391 +               printk(KERN_ERR
 392 +                      "firmware_sample_driver: Firmware load failed\n");
 393 +               return;
 394 +       }
 395 +
 396 +       /* request_firmware blocks until userspace finished, so at
 397 +        * this point the firmware should be already in the device */
 398 +
 399 +       /* finish setting up the device */
 400 +}
 401 +static void sample_probe_async_cont(const struct firmware *fw, void *context)
 402 +{
 403 +       if(!fw){
 404 +               printk(KERN_ERR
 405 +                      "firmware_sample_driver: firmware load failed\n");
 406 +               return;
 407 +       }
 408 +
 409 +       printk("firmware_sample_driver: device pointer \"%s\"\n",
 410 +              (char *)context);
 411 +       sample_firmware_load(fw->data, fw->size);
 412 +}
 413 +static void sample_probe_async(void)
 414 +{
 415 +       /* Let's say that I can't sleep */
 416 +       int error;
 417 +       error = request_firmware_nowait (THIS_MODULE,
 418 +                                        "sample_driver_fw", ghost_device,
 419 +                                        "my device pointer",
 420 +                                        sample_probe_async_cont);
 421 +       if(error){
 422 +               printk(KERN_ERR
 423 +                      "firmware_sample_driver:"
 424 +                      " request_firmware_nowait failed\n");
 425 +       }
 426 +}
 427 +
 428 +static int sample_init(void)
 429 +{
 430 +#ifdef WE_CAN_NEED_FIRMWARE_BEFORE_USERSPACE_IS_AVAILABLE
 431 +       register_firmware("sample_driver_fw", inkernel_firmware,
 432 +                         sizeof(inkernel_firmware));
 433 +#endif
 434 +       /* since there is no real hardware insertion I just call the
 435 +        * sample probe functions here */
 436 +       sample_probe_specific();
 437 +       sample_probe_default();
 438 +       sample_probe_async();
 439 +       return 0;
 440 +}
 441 +static void __exit sample_exit(void)
 442 +{
 443 +}
 444 +
 445 +module_init (sample_init);
 446 +module_exit (sample_exit);
 447 +
 448 +MODULE_LICENSE("GPL");
 449 diff -urN linux-2.4.18/Documentation/firmware_class/hotplug-script linux-2.4.18-mh9/Documentation/firmware_class/hotplug-script
 450 --- linux-2.4.18/Documentation/firmware_class/hotplug-script    Thu Jan  1 01:00:00 1970
 451 +++ linux-2.4.18-mh9/Documentation/firmware_class/hotplug-script        Mon Aug 25 18:38:10 2003
 452 @@ -0,0 +1,16 @@
 453 +#!/bin/sh
 454 +
 455 +# Simple hotplug script sample:
 456 +#
 457 +# Both $DEVPATH and $FIRMWARE are already provided in the environment.
 458 +
 459 +HOTPLUG_FW_DIR=/usr/lib/hotplug/firmware/
 460 +
 461 +echo 1 > /sysfs/$DEVPATH/loading
 462 +cat $HOTPLUG_FW_DIR/$FIRMWARE > /sysfs/$DEVPATH/data
 463 +echo 0 > /sysfs/$DEVPATH/loading
 464 +
 465 +# To cancel the load in case of error:
 466 +#
 467 +#      echo -1 > /sysfs/$DEVPATH/loading
 468 +#
 469 diff -urN linux-2.4.18/MAINTAINERS linux-2.4.18-mh9/MAINTAINERS
 470 --- linux-2.4.18/MAINTAINERS    Mon Feb 25 20:37:52 2002
 471 +++ linux-2.4.18-mh9/MAINTAINERS        Mon Aug 25 18:38:10 2003
 472 @@ -252,7 +252,73 @@
 473  L:     linux-kernel@vger.kernel.org
 474  S:     Maintained
 475
 476 -BLUETOOTH SUBSYSTEM (BlueZ)
 477 +BLUETOOTH SUBSYSTEM
 478 +P:     Maxim Krasnyansky
 479 +M:     maxk@qualcomm.com
 480 +W:     http://bluez.sf.net
 481 +S:     Maintained
 482 +
 483 +BLUETOOTH RFCOMM LAYER
 484 +P:     Maxim Krasnyansky
 485 +M:     maxk@qualcomm.com
 486 +W:     http://bluez.sf.net
 487 +S:     Maintained
 488 +
 489 +BLUETOOTH BNEP LAYER
 490 +P:     Maxim Krasnyansky
 491 +M:     maxk@qualcomm.com
 492 +W:     http://bluez.sf.net
 493 +S:     Maintained
 494 +
 495 +BLUETOOTH CMTP LAYER
 496 +P:     Marcel Holtmann
 497 +M:     marcel@holtmann.org
 498 +W:     http://www.holtmann.org/linux/bluetooth/
 499 +S:     Maintained
 500 +
 501 +BLUETOOTH HCI USB DRIVER
 502 +P:     Maxim Krasnyansky
 503 +M:     maxk@qualcomm.com
 504 +W:     http://bluez.sf.net
 505 +S:     Maintained
 506 +
 507 +BLUETOOTH HCI UART DRIVER
 508 +P:     Maxim Krasnyansky
 509 +M:     maxk@qualcomm.com
 510 +W:     http://bluez.sf.net
 511 +S:     Maintained
 512 +
 513 +BLUETOOTH HCI BFUSB DRIVER
 514 +P:     Marcel Holtmann
 515 +M:     marcel@holtmann.org
 516 +W:     http://www.holtmann.org/linux/bluetooth/
 517 +S:     Maintained
 518 +
 519 +BLUETOOTH HCI DTL1 DRIVER
 520 +P:     Marcel Holtmann
 521 +M:     marcel@holtmann.org
 522 +W:     http://www.holtmann.org/linux/bluetooth/
 523 +S:     Maintained
 524 +
 525 +BLUETOOTH HCI BLUECARD DRIVER
 526 +P:     Marcel Holtmann
 527 +M:     marcel@holtmann.org
 528 +W:     http://www.holtmann.org/linux/bluetooth/
 529 +S:     Maintained
 530 +
 531 +BLUETOOTH HCI BT3C DRIVER
 532 +P:     Marcel Holtmann
 533 +M:     marcel@holtmann.org
 534 +W:     http://www.holtmann.org/linux/bluetooth/
 535 +S:     Maintained
 536 +
 537 +BLUETOOTH HCI BTUART DRIVER
 538 +P:     Marcel Holtmann
 539 +M:     marcel@holtmann.org
 540 +W:     http://www.holtmann.org/linux/bluetooth/
 541 +S:     Maintained
 542 +
 543 +BLUETOOTH HCI VHCI DRIVER
 544  P:     Maxim Krasnyansky
 545  M:     maxk@qualcomm.com
 546  W:     http://bluez.sf.net
 547 diff -urN linux-2.4.18/arch/alpha/config.in linux-2.4.18-mh9/arch/alpha/config.in
 548 --- linux-2.4.18/arch/alpha/config.in   Wed Nov 21 00:49:31 2001
 549 +++ linux-2.4.18-mh9/arch/alpha/config.in       Mon Aug 25 18:38:10 2003
 550 @@ -371,9 +371,7 @@
 551  source drivers/usb/Config.in
 552  source drivers/input/Config.in
 553
 554 -if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 555 -   source net/bluetooth/Config.in
 556 -fi
 557 +source net/bluetooth/Config.in
 558
 559  mainmenu_option next_comment
 560  comment 'Kernel hacking'
 561 diff -urN linux-2.4.18/arch/arm/config.in linux-2.4.18-mh9/arch/arm/config.in
 562 --- linux-2.4.18/arch/arm/config.in     Fri Nov  9 22:58:02 2001
 563 +++ linux-2.4.18-mh9/arch/arm/config.in Mon Aug 25 18:38:10 2003
 564 @@ -584,9 +584,7 @@
 565
 566  source drivers/usb/Config.in
 567
 568 -if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 569 -   source net/bluetooth/Config.in
 570 -fi
 571 +source net/bluetooth/Config.in
 572
 573  mainmenu_option next_comment
 574  comment 'Kernel hacking'
 575 diff -urN linux-2.4.18/arch/i386/config.in linux-2.4.18-mh9/arch/i386/config.in
 576 --- linux-2.4.18/arch/i386/config.in    Mon Feb 25 20:37:52 2002
 577 +++ linux-2.4.18-mh9/arch/i386/config.in        Mon Aug 25 18:38:10 2003
 578 @@ -407,9 +407,7 @@
 579
 580  source drivers/usb/Config.in
 581
 582 -if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 583 -   source net/bluetooth/Config.in
 584 -fi
 585 +source net/bluetooth/Config.in
 586
 587  mainmenu_option next_comment
 588  comment 'Kernel hacking'
 589 diff -urN linux-2.4.18/arch/ppc/config.in linux-2.4.18-mh9/arch/ppc/config.in
 590 --- linux-2.4.18/arch/ppc/config.in     Mon Feb 25 20:37:55 2002
 591 +++ linux-2.4.18-mh9/arch/ppc/config.in Mon Aug 25 18:38:10 2003
 592 @@ -389,9 +389,7 @@
 593
 594  source drivers/usb/Config.in
 595
 596 -if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 597 -   source net/bluetooth/Config.in
 598 -fi
 599 +source net/bluetooth/Config.in
 600
 601  mainmenu_option next_comment
 602  comment 'Kernel hacking'
 603 diff -urN linux-2.4.18/arch/sparc/config.in linux-2.4.18-mh9/arch/sparc/config.in
 604 --- linux-2.4.18/arch/sparc/config.in   Tue Jun 12 04:15:27 2001
 605 +++ linux-2.4.18-mh9/arch/sparc/config.in       Mon Aug 25 18:38:10 2003
 606 @@ -251,9 +251,7 @@
 607
 608  source fs/Config.in
 609
 610 -if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 611 -   source net/bluetooth/Config.in
 612 -fi
 613 +source net/bluetooth/Config.in
 614
 615  mainmenu_option next_comment
 616  comment 'Watchdog'
 617 diff -urN linux-2.4.18/arch/sparc64/config.in linux-2.4.18-mh9/arch/sparc64/config.in
 618 --- linux-2.4.18/arch/sparc64/config.in Fri Dec 21 18:41:53 2001
 619 +++ linux-2.4.18-mh9/arch/sparc64/config.in     Mon Aug 25 18:38:10 2003
 620 @@ -283,9 +283,7 @@
 621
 622  source drivers/usb/Config.in
 623
 624 -if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
 625 -   source net/bluetooth/Config.in
 626 -fi
 627 +source net/bluetooth/Config.in
 628
 629  mainmenu_option next_comment
 630  comment 'Watchdog'
 631 diff -urN linux-2.4.18/arch/sparc64/kernel/ioctl32.c linux-2.4.18-mh9/arch/sparc64/kernel/ioctl32.c
 632 --- linux-2.4.18/arch/sparc64/kernel/ioctl32.c  Mon Feb 25 20:37:56 2002
 633 +++ linux-2.4.18-mh9/arch/sparc64/kernel/ioctl32.c      Mon Aug 25 18:38:10 2003
 634 @@ -92,6 +92,7 @@
 635
 636  #include <net/bluetooth/bluetooth.h>
 637  #include <net/bluetooth/hci.h>
 638 +#include <net/bluetooth/rfcomm.h>
 639
 640  #include <linux/usb.h>
 641  #include <linux/usbdevice_fs.h>
 642 @@ -3822,6 +3823,15 @@
 643         return err;
 644  }
 645
 646 +/* Bluetooth ioctls */
 647 +#define HCIUARTSETPROTO        _IOW('U', 200, int)
 648 +#define HCIUARTGETPROTO        _IOR('U', 201, int)
 649 +
 650 +#define BNEPCONNADD    _IOW('B', 200, int)
 651 +#define BNEPCONNDEL    _IOW('B', 201, int)
 652 +#define BNEPGETCONNLIST        _IOR('B', 210, int)
 653 +#define BNEPGETCONNINFO        _IOR('B', 211, int)
 654 +
 655  struct mtd_oob_buf32 {
 656         u32 start;
 657         u32 length;
 658 @@ -3878,6 +3888,11 @@
 659         return ((0 == ret) ? 0 : -EFAULT);
 660  }
 661
 662 +#define CMTPCONNADD    _IOW('C', 200, int)
 663 +#define CMTPCONNDEL    _IOW('C', 201, int)
 664 +#define CMTPGETCONNLIST        _IOR('C', 210, int)
 665 +#define CMTPGETCONNINFO        _IOR('C', 211, int)
 666 +
 667  struct ioctl_trans {
 668         unsigned int cmd;
 669         unsigned int handler;
 670 @@ -4540,6 +4555,21 @@
 671  COMPATIBLE_IOCTL(HCISETSCAN)
 672  COMPATIBLE_IOCTL(HCISETAUTH)
 673  COMPATIBLE_IOCTL(HCIINQUIRY)
 674 +COMPATIBLE_IOCTL(HCIUARTSETPROTO)
 675 +COMPATIBLE_IOCTL(HCIUARTGETPROTO)
 676 +COMPATIBLE_IOCTL(RFCOMMCREATEDEV)
 677 +COMPATIBLE_IOCTL(RFCOMMRELEASEDEV)
 678 +COMPATIBLE_IOCTL(RFCOMMGETDEVLIST)
 679 +COMPATIBLE_IOCTL(RFCOMMGETDEVINFO)
 680 +COMPATIBLE_IOCTL(RFCOMMSTEALDLC)
 681 +COMPATIBLE_IOCTL(BNEPCONNADD)
 682 +COMPATIBLE_IOCTL(BNEPCONNDEL)
 683 +COMPATIBLE_IOCTL(BNEPGETCONNLIST)
 684 +COMPATIBLE_IOCTL(BNEPGETCONNINFO)
 685 +COMPATIBLE_IOCTL(CMTPCONNADD)
 686 +COMPATIBLE_IOCTL(CMTPCONNDEL)
 687 +COMPATIBLE_IOCTL(CMTPGETCONNLIST)
 688 +COMPATIBLE_IOCTL(CMTPGETCONNINFO)
 689  /* Misc. */
 690  COMPATIBLE_IOCTL(0x41545900)           /* ATYIO_CLKR */
 691  COMPATIBLE_IOCTL(0x41545901)           /* ATYIO_CLKW */
 692 diff -urN linux-2.4.18/drivers/bluetooth/Config.in linux-2.4.18-mh9/drivers/bluetooth/Config.in
 693 --- linux-2.4.18/drivers/bluetooth/Config.in    Fri Sep  7 18:28:38 2001
 694 +++ linux-2.4.18-mh9/drivers/bluetooth/Config.in        Mon Aug 25 18:38:10 2003
 695 @@ -1,8 +1,34 @@
 696 +#
 697 +# Bluetooth HCI device drivers configuration
 698 +#
 699 +
 700  mainmenu_option next_comment
 701  comment 'Bluetooth device drivers'
 702
 703  dep_tristate 'HCI USB driver' CONFIG_BLUEZ_HCIUSB $CONFIG_BLUEZ $CONFIG_USB
 704 +if [ "$CONFIG_BLUEZ_HCIUSB" != "n" ]; then
 705 +   bool '  SCO (voice) support'  CONFIG_BLUEZ_USB_SCO
 706 +   bool '  USB zero packet support'  CONFIG_BLUEZ_USB_ZERO_PACKET
 707 +fi
 708 +
 709  dep_tristate 'HCI UART driver' CONFIG_BLUEZ_HCIUART $CONFIG_BLUEZ
 710 -dep_tristate 'HCI VHCI virtual HCI device driver' CONFIG_BLUEZ_HCIVHCI $CONFIG_BLUEZ
 711 +if [ "$CONFIG_BLUEZ_HCIUART" != "n" ]; then
 712 +   bool '  UART (H4) protocol support' CONFIG_BLUEZ_HCIUART_H4
 713 +   bool '  BCSP protocol support' CONFIG_BLUEZ_HCIUART_BCSP
 714 +   dep_bool '  Transmit CRC with every BCSP packet' CONFIG_BLUEZ_HCIUART_BCSP_TXCRC $CONFIG_BLUEZ_HCIUART_BCSP
 715 +fi
 716 +
 717 +dep_tristate 'HCI BlueFRITZ! USB driver' CONFIG_BLUEZ_HCIBFUSB $CONFIG_BLUEZ $CONFIG_USB
 718 +
 719 +dep_tristate 'HCI DTL1 (PC Card) driver' CONFIG_BLUEZ_HCIDTL1 $CONFIG_PCMCIA $CONFIG_BLUEZ
 720 +
 721 +dep_tristate 'HCI BT3C (PC Card) driver' CONFIG_BLUEZ_HCIBT3C $CONFIG_PCMCIA $CONFIG_BLUEZ
 722 +
 723 +dep_tristate 'HCI BlueCard (PC Card) driver' CONFIG_BLUEZ_HCIBLUECARD $CONFIG_PCMCIA $CONFIG_BLUEZ
 724 +
 725 +dep_tristate 'HCI UART (PC Card) driver' CONFIG_BLUEZ_HCIBTUART $CONFIG_PCMCIA $CONFIG_BLUEZ
 726 +
 727 +dep_tristate 'HCI VHCI (Virtual HCI device) driver' CONFIG_BLUEZ_HCIVHCI $CONFIG_BLUEZ
 728
 729  endmenu
 730 +
 731 diff -urN linux-2.4.18/drivers/bluetooth/Makefile linux-2.4.18-mh9/drivers/bluetooth/Makefile
 732 --- linux-2.4.18/drivers/bluetooth/Makefile     Fri Sep  7 18:28:38 2001
 733 +++ linux-2.4.18-mh9/drivers/bluetooth/Makefile Mon Aug 25 18:38:10 2003
 734 @@ -1,11 +1,27 @@
 735  #
 736 -# Makefile for Bluetooth HCI device drivers.
 737 +# Makefile for the Linux Bluetooth HCI device drivers
 738  #
 739
 740  O_TARGET       := bluetooth.o
 741
 742 +list-multi     := hci_uart.o
 743 +
 744  obj-$(CONFIG_BLUEZ_HCIUSB)     += hci_usb.o
 745 -obj-$(CONFIG_BLUEZ_HCIUART)    += hci_uart.o
 746  obj-$(CONFIG_BLUEZ_HCIVHCI)    += hci_vhci.o
 747
 748 +obj-$(CONFIG_BLUEZ_HCIUART)            += hci_uart.o
 749 +uart-y                                 := hci_ldisc.o
 750 +uart-$(CONFIG_BLUEZ_HCIUART_H4)                += hci_h4.o
 751 +uart-$(CONFIG_BLUEZ_HCIUART_BCSP)      += hci_bcsp.o
 752 +
 753 +obj-$(CONFIG_BLUEZ_HCIBFUSB)   += bfusb.o
 754 +
 755 +obj-$(CONFIG_BLUEZ_HCIDTL1)    += dtl1_cs.o
 756 +obj-$(CONFIG_BLUEZ_HCIBT3C)    += bt3c_cs.o
 757 +obj-$(CONFIG_BLUEZ_HCIBLUECARD)        += bluecard_cs.o
 758 +obj-$(CONFIG_BLUEZ_HCIBTUART)  += btuart_cs.o
 759 +
 760  include $(TOPDIR)/Rules.make
 761 +
 762 +hci_uart.o: $(uart-y)
 763 +       $(LD) -r -o $@ $(uart-y)
 764 diff -urN linux-2.4.18/drivers/bluetooth/Makefile.lib linux-2.4.18-mh9/drivers/bluetooth/Makefile.lib
 765 --- linux-2.4.18/drivers/bluetooth/Makefile.lib Thu Jan  1 01:00:00 1970
 766 +++ linux-2.4.18-mh9/drivers/bluetooth/Makefile.lib     Mon Aug 25 18:38:10 2003
 767 @@ -0,0 +1 @@
 768 +obj-$(CONFIG_BLUEZ_HCIBFUSB) += firmware_class.o
 769 diff -urN linux-2.4.18/drivers/bluetooth/bfusb.c linux-2.4.18-mh9/drivers/bluetooth/bfusb.c
 770 --- linux-2.4.18/drivers/bluetooth/bfusb.c      Thu Jan  1 01:00:00 1970
 771 +++ linux-2.4.18-mh9/drivers/bluetooth/bfusb.c  Mon Aug 25 18:38:10 2003
 772 @@ -0,0 +1,781 @@
 773 +/*
 774 + *
 775 + *  AVM BlueFRITZ! USB driver
 776 + *
 777 + *  Copyright (C) 2003  Marcel Holtmann <marcel@holtmann.org>
 778 + *
 779 + *
 780 + *  This program is free software; you can redistribute it and/or modify
 781 + *  it under the terms of the GNU General Public License as published by
 782 + *  the Free Software Foundation; either version 2 of the License, or
 783 + *  (at your option) any later version.
 784 + *
 785 + *  This program is distributed in the hope that it will be useful,
 786 + *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 787 + *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 788 + *  GNU General Public License for more details.
 789 + *
 790 + *  You should have received a copy of the GNU General Public License
 791 + *  along with this program; if not, write to the Free Software
 792 + *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 793 + *
 794 + */
 795 +
 796 +#include <linux/config.h>
 797 +#include <linux/module.h>
 798 +
 799 +#include <linux/kernel.h>
 800 +#include <linux/init.h>
 801 +#include <linux/slab.h>
 802 +#include <linux/types.h>
 803 +#include <linux/sched.h>
 804 +#include <linux/errno.h>
 805 +#include <linux/skbuff.h>
 806 +
 807 +#include <linux/firmware.h>
 808 +#include <linux/usb.h>
 809 +
 810 +#include <net/bluetooth/bluetooth.h>
 811 +#include <net/bluetooth/hci_core.h>
 812 +
 813 +#ifndef CONFIG_BLUEZ_HCIBFUSB_DEBUG
 814 +#undef  BT_DBG
 815 +#define BT_DBG(D...)
 816 +#endif
 817 +
 818 +#define VERSION "1.1"
 819 +
 820 +static struct usb_device_id bfusb_table[] = {
 821 +       /* AVM BlueFRITZ! USB */
 822 +       { USB_DEVICE(0x057c, 0x2200) },
 823 +
 824 +       { }     /* Terminating entry */
 825 +};
 826 +
 827 +MODULE_DEVICE_TABLE(usb, bfusb_table);
 828 +
 829 +
 830 +#define BFUSB_MAX_BLOCK_SIZE   256
 831 +
 832 +#define BFUSB_BLOCK_TIMEOUT    (HZ * 3)
 833 +
 834 +#define BFUSB_TX_PROCESS       1
 835 +#define BFUSB_TX_WAKEUP                2
 836 +
 837 +#define BFUSB_MAX_BULK_TX      1
 838 +#define BFUSB_MAX_BULK_RX      1
 839 +
 840 +struct bfusb {
 841 +       struct hci_dev          hdev;
 842 +
 843 +       unsigned long           state;
 844 +
 845 +       struct usb_device       *udev;
 846 +
 847 +       unsigned int            bulk_in_ep;
 848 +       unsigned int            bulk_out_ep;
 849 +       unsigned int            bulk_pkt_size;
 850 +
 851 +       rwlock_t                lock;
 852 +
 853 +       struct sk_buff_head     transmit_q;
 854 +
 855 +       struct sk_buff          *reassembly;
 856 +
 857 +       atomic_t                pending_tx;
 858 +       struct sk_buff_head     pending_q;
 859 +       struct sk_buff_head     completed_q;
 860 +};
 861 +
 862 +struct bfusb_scb {
 863 +       struct urb *urb;
 864 +};
 865 +
 866 +static void bfusb_tx_complete(struct urb *urb);
 867 +static void bfusb_rx_complete(struct urb *urb);
 868 +
 869 +static struct urb *bfusb_get_completed(struct bfusb *bfusb)
 870 +{
 871 +       struct sk_buff *skb;
 872 +       struct urb *urb = NULL;
 873 +
 874 +       BT_DBG("bfusb %p", bfusb);
 875 +
 876 +       skb = skb_dequeue(&bfusb->completed_q);
 877 +       if (skb) {
 878 +               urb = ((struct bfusb_scb *) skb->cb)->urb;
 879 +               kfree_skb(skb);
 880 +       }
 881 +
 882 +       return urb;
 883 +}
 884 +
 885 +static inline void bfusb_unlink_urbs(struct bfusb *bfusb)
 886 +{
 887 +       struct sk_buff *skb;
 888 +       struct urb *urb;
 889 +
 890 +       BT_DBG("bfusb %p", bfusb);
 891 +
 892 +       while ((skb = skb_dequeue(&bfusb->pending_q))) {
 893 +               urb = ((struct bfusb_scb *) skb->cb)->urb;
 894 +               usb_unlink_urb(urb);
 895 +               skb_queue_tail(&bfusb->completed_q, skb);
 896 +       }
 897 +
 898 +       while ((urb = bfusb_get_completed(bfusb)))
 899 +               usb_free_urb(urb);
 900 +}
 901 +
 902 +
 903 +static int bfusb_send_bulk(struct bfusb *bfusb, struct sk_buff *skb)
 904 +{
 905 +       struct bfusb_scb *scb = (void *) skb->cb;
 906 +       struct urb *urb = bfusb_get_completed(bfusb);
 907 +       int err, pipe;
 908 +
 909 +       BT_DBG("bfusb %p skb %p len %d", bfusb, skb, skb->len);
 910 +
 911 +       if (!urb && !(urb = usb_alloc_urb(0)))
 912 +               return -ENOMEM;
 913 +
 914 +       pipe = usb_sndbulkpipe(bfusb->udev, bfusb->bulk_out_ep);
 915 +
 916 +       FILL_BULK_URB(urb, bfusb->udev, pipe, skb->data, skb->len,
 917 +                       bfusb_tx_complete, skb);
 918 +
 919 +       urb->transfer_flags = USB_QUEUE_BULK;
 920 +
 921 +       scb->urb = urb;
 922 +
 923 +       skb_queue_tail(&bfusb->pending_q, skb);
 924 +
 925 +       err = usb_submit_urb(urb);
 926 +       if (err) {
 927 +               BT_ERR("%s bulk tx submit failed urb %p err %d",
 928 +                                       bfusb->hdev.name, urb, err);
 929 +               skb_unlink(skb);
 930 +               usb_free_urb(urb);
 931 +       } else
 932 +               atomic_inc(&bfusb->pending_tx);
 933 +
 934 +       return err;
 935 +}
 936 +
 937 +static void bfusb_tx_wakeup(struct bfusb *bfusb)
 938 +{
 939 +       struct sk_buff *skb;
 940 +
 941 +       BT_DBG("bfusb %p", bfusb);
 942 +
 943 +       if (test_and_set_bit(BFUSB_TX_PROCESS, &bfusb->state)) {
 944 +               set_bit(BFUSB_TX_WAKEUP, &bfusb->state);
 945 +               return;
 946 +       }
 947 +
 948 +       do {
 949 +               clear_bit(BFUSB_TX_WAKEUP, &bfusb->state);
 950 +
 951 +               while ((atomic_read(&bfusb->pending_tx) < BFUSB_MAX_BULK_TX) &&
 952 +                               (skb = skb_dequeue(&bfusb->transmit_q))) {
 953 +                       if (bfusb_send_bulk(bfusb, skb) < 0) {
 954 +                               skb_queue_head(&bfusb->transmit_q, skb);
 955 +                               break;
 956 +                       }
 957 +               }
 958 +
 959 +       } while (test_bit(BFUSB_TX_WAKEUP, &bfusb->state));
 960 +
 961 +       clear_bit(BFUSB_TX_PROCESS, &bfusb->state);
 962 +}
 963 +
 964 +static void bfusb_tx_complete(struct urb *urb)
 965 +{
 966 +       struct sk_buff *skb = (struct sk_buff *) urb->context;
 967 +       struct bfusb *bfusb = (struct bfusb *) skb->dev;
 968 +
 969 +       BT_DBG("bfusb %p urb %p skb %p len %d", bfusb, urb, skb, skb->len);
 970 +
 971 +       atomic_dec(&bfusb->pending_tx);
 972 +
 973 +       if (!test_bit(HCI_RUNNING, &bfusb->hdev.flags))
 974 +               return;
 975 +
 976 +       if (!urb->status)
 977 +               bfusb->hdev.stat.byte_tx += skb->len;
 978 +       else
 979 +               bfusb->hdev.stat.err_tx++;
 980 +
 981 +       read_lock(&bfusb->lock);
 982 +
 983 +       skb_unlink(skb);
 984 +       skb_queue_tail(&bfusb->completed_q, skb);
 985 +
 986 +       bfusb_tx_wakeup(bfusb);
 987 +
 988 +       read_unlock(&bfusb->lock);
 989 +}
 990 +
 991 +
 992 +static int bfusb_rx_submit(struct bfusb *bfusb, struct urb *urb)
 993 +{
 994 +       struct bfusb_scb *scb;
 995 +       struct sk_buff *skb;
 996 +       int err, pipe, size = HCI_MAX_FRAME_SIZE + 32;
 997 +
 998 +       BT_DBG("bfusb %p urb %p", bfusb, urb);
 999 +
1000 +       if (!urb && !(urb = usb_alloc_urb(0)))
1001 +               return -ENOMEM;
1002 +
1003 +       if (!(skb = bluez_skb_alloc(size, GFP_ATOMIC))) {
1004 +               usb_free_urb(urb);
1005 +               return -ENOMEM;
1006 +       }
1007 +
1008 +       skb->dev = (void *) bfusb;
1009 +
1010 +       scb = (struct bfusb_scb *) skb->cb;
1011 +       scb->urb = urb;
1012 +
1013 +       pipe = usb_rcvbulkpipe(bfusb->udev, bfusb->bulk_in_ep);
1014 +
1015 +       FILL_BULK_URB(urb, bfusb->udev, pipe, skb->data, size,
1016 +                       bfusb_rx_complete, skb);
1017 +
1018 +       urb->transfer_flags = USB_QUEUE_BULK;
1019 +
1020 +       skb_queue_tail(&bfusb->pending_q, skb);
1021 +
1022 +       err = usb_submit_urb(urb);
1023 +       if (err) {
1024 +               BT_ERR("%s bulk rx submit failed urb %p err %d",
1025 +                                       bfusb->hdev.name, urb, err);
1026 +               skb_unlink(skb);
1027 +               kfree_skb(skb);
1028 +               usb_free_urb(urb);
1029 +       }
1030 +
1031 +       return err;
1032 +}
1033 +
1034 +static inline int bfusb_recv_block(struct bfusb *bfusb, int hdr, unsigned char *data, int len)
1035 +{
1036 +       BT_DBG("bfusb %p hdr 0x%02x data %p len %d", bfusb, hdr, data, len);
1037 +
1038 +       if (hdr & 0x10) {
1039 +               BT_ERR("%s error in block", bfusb->hdev.name);
1040 +               if (bfusb->reassembly)
1041 +                       kfree_skb(bfusb->reassembly);
1042 +               bfusb->reassembly = NULL;
1043 +               return -EIO;
1044 +       }
1045 +
1046 +       if (hdr & 0x04) {
1047 +               struct sk_buff *skb;
1048 +               unsigned char pkt_type;
1049 +               int pkt_len = 0;
1050 +
1051 +               if (bfusb->reassembly) {
1052 +                       BT_ERR("%s unexpected start block", bfusb->hdev.name);
1053 +                       kfree_skb(bfusb->reassembly);
1054 +                       bfusb->reassembly = NULL;
1055 +               }
1056 +
1057 +               if (len < 1) {
1058 +                       BT_ERR("%s no packet type found", bfusb->hdev.name);
1059 +                       return -EPROTO;
1060 +               }
1061 +
1062 +               pkt_type = *data++; len--;
1063 +
1064 +               switch (pkt_type) {
1065 +               case HCI_EVENT_PKT:
1066 +                       if (len >= HCI_EVENT_HDR_SIZE) {
1067 +                               hci_event_hdr *hdr = (hci_event_hdr *) data;
1068 +                               pkt_len = HCI_EVENT_HDR_SIZE + hdr->plen;
1069 +                       } else {
1070 +                               BT_ERR("%s event block is too short", bfusb->hdev.name);
1071 +                               return -EILSEQ;
1072 +                       }
1073 +                       break;
1074 +
1075 +               case HCI_ACLDATA_PKT:
1076 +                       if (len >= HCI_ACL_HDR_SIZE) {
1077 +                               hci_acl_hdr *hdr = (hci_acl_hdr *) data;
1078 +                               pkt_len = HCI_ACL_HDR_SIZE + __le16_to_cpu(hdr->dlen);
1079 +                       } else {
1080 +                               BT_ERR("%s data block is too short", bfusb->hdev.name);
1081 +                               return -EILSEQ;
1082 +                       }
1083 +                       break;
1084 +
1085 +               case HCI_SCODATA_PKT:
1086 +                       if (len >= HCI_SCO_HDR_SIZE) {
1087 +                               hci_sco_hdr *hdr = (hci_sco_hdr *) data;
1088 +                               pkt_len = HCI_SCO_HDR_SIZE + hdr->dlen;
1089 +                       } else {
1090 +                               BT_ERR("%s audio block is too short", bfusb->hdev.name);
1091 +                               return -EILSEQ;
1092 +                       }
1093 +                       break;
1094 +               }
1095 +
1096 +               skb = bluez_skb_alloc(pkt_len, GFP_ATOMIC);
1097 +               if (!skb) {
1098 +                       BT_ERR("%s no memory for the packet", bfusb->hdev.name);
1099 +                       return -ENOMEM;
1100 +               }
1101 +
1102 +               skb->dev = (void *) &bfusb->hdev;
1103 +               skb->pkt_type = pkt_type;
1104 +
1105 +               bfusb->reassembly = skb;
1106 +       } else {
1107 +               if (!bfusb->reassembly) {
1108 +                       BT_ERR("%s unexpected continuation block", bfusb->hdev.name);
1109 +                       return -EIO;
1110 +               }
1111 +       }
1112 +
1113 +       if (len > 0)
1114 +               memcpy(skb_put(bfusb->reassembly, len), data, len);
1115 +
1116 +       if (hdr & 0x08) {
1117 +               hci_recv_frame(bfusb->reassembly);
1118 +               bfusb->reassembly = NULL;
1119 +       }
1120 +
1121 +       return 0;
1122 +}
1123 +
1124 +static void bfusb_rx_complete(struct urb *urb)
1125 +{
1126 +       struct sk_buff *skb = (struct sk_buff *) urb->context;
1127 +       struct bfusb *bfusb = (struct bfusb *) skb->dev;
1128 +       unsigned char *buf = urb->transfer_buffer;
1129 +       int count = urb->actual_length;
1130 +       int err, hdr, len;
1131 +
1132 +       BT_DBG("bfusb %p urb %p skb %p len %d", bfusb, urb, skb, skb->len);
1133 +
1134 +       if (!test_bit(HCI_RUNNING, &bfusb->hdev.flags))
1135 +               return;
1136 +
1137 +       read_lock(&bfusb->lock);
1138 +
1139 +       if (urb->status || !count)
1140 +               goto resubmit;
1141 +
1142 +       bfusb->hdev.stat.byte_rx += count;
1143 +
1144 +       skb_put(skb, count);
1145 +
1146 +       while (count) {
1147 +               hdr = buf[0] | (buf[1] << 8);
1148 +
1149 +               if (hdr & 0x4000) {
1150 +                       len = 0;
1151 +                       count -= 2;
1152 +                       buf   += 2;
1153 +               } else {
1154 +                       len = (buf[2] == 0) ? 256 : buf[2];
1155 +                       count -= 3;
1156 +                       buf   += 3;
1157 +               }
1158 +
1159 +               if (count < len) {
1160 +                       BT_ERR("%s block extends over URB buffer ranges",
1161 +                                       bfusb->hdev.name);
1162 +               }
1163 +
1164 +               if ((hdr & 0xe1) == 0xc1)
1165 +                       bfusb_recv_block(bfusb, hdr, buf, len);
1166 +
1167 +               count -= len;
1168 +               buf   += len;
1169 +       }
1170 +
1171 +       skb_unlink(skb);
1172 +       kfree_skb(skb);
1173 +
1174 +       bfusb_rx_submit(bfusb, urb);
1175 +
1176 +       read_unlock(&bfusb->lock);
1177 +
1178 +       return;
1179 +
1180 +resubmit:
1181 +       urb->dev = bfusb->udev;
1182 +
1183 +       err = usb_submit_urb(urb);
1184 +       if (err) {
1185 +               BT_ERR("%s bulk resubmit failed urb %p err %d",
1186 +                                       bfusb->hdev.name, urb, err);
1187 +       }
1188 +
1189 +       read_unlock(&bfusb->lock);
1190 +}
1191 +
1192 +
1193 +static int bfusb_open(struct hci_dev *hdev)
1194 +{
1195 +       struct bfusb *bfusb = (struct bfusb *) hdev->driver_data;
1196 +       unsigned long flags;
1197 +       int i, err;
1198 +
1199 +       BT_DBG("hdev %p bfusb %p", hdev, bfusb);
1200 +
1201 +       if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
1202 +               return 0;
1203 +
1204 +       MOD_INC_USE_COUNT;
1205 +
1206 +       write_lock_irqsave(&bfusb->lock, flags);
1207 +
1208 +       err = bfusb_rx_submit(bfusb, NULL);
1209 +       if (!err) {
1210 +               for (i = 1; i < BFUSB_MAX_BULK_RX; i++)
1211 +                       bfusb_rx_submit(bfusb, NULL);
1212 +       } else {
1213 +               clear_bit(HCI_RUNNING, &hdev->flags);
1214 +               MOD_DEC_USE_COUNT;
1215 +       }
1216 +
1217 +       write_unlock_irqrestore(&bfusb->lock, flags);
1218 +
1219 +       return err;
1220 +}
1221 +
1222 +static int bfusb_flush(struct hci_dev *hdev)
1223 +{
1224 +       struct bfusb *bfusb = (struct bfusb *) hdev->driver_data;
1225 +
1226 +       BT_DBG("hdev %p bfusb %p", hdev, bfusb);
1227 +
1228 +       skb_queue_purge(&bfusb->transmit_q);
1229 +
1230 +       return 0;
1231 +}
1232 +
1233 +static int bfusb_close(struct hci_dev *hdev)
1234 +{
1235 +       struct bfusb *bfusb = (struct bfusb *) hdev->driver_data;
1236 +       unsigned long flags;
1237 +
1238 +       BT_DBG("hdev %p bfusb %p", hdev, bfusb);
1239 +
1240 +       if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
1241 +               return 0;
1242 +
1243 +       write_lock_irqsave(&bfusb->lock, flags);
1244 +
1245 +       bfusb_unlink_urbs(bfusb);
1246 +       bfusb_flush(hdev);
1247 +
1248 +       write_unlock_irqrestore(&bfusb->lock, flags);
1249 +
1250 +       MOD_DEC_USE_COUNT;
1251 +
1252 +       return 0;
1253 +}
1254 +
1255 +static int bfusb_send_frame(struct sk_buff *skb)
1256 +{
1257 +       struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1258 +       struct bfusb *bfusb;
1259 +       struct sk_buff *nskb;
1260 +       unsigned char buf[3];
1261 +       int sent = 0, size, count;
1262 +
1263 +       BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, skb->pkt_type, skb->len);
1264 +
1265 +       if (!hdev) {
1266 +               BT_ERR("Frame for unknown HCI device (hdev=NULL)");
1267 +               return -ENODEV;
1268 +       }
1269 +
1270 +       if (!test_bit(HCI_RUNNING, &hdev->flags))
1271 +               return -EBUSY;
1272 +
1273 +       bfusb = (struct bfusb *) hdev->driver_data;
1274 +
1275 +       switch (skb->pkt_type) {
1276 +       case HCI_COMMAND_PKT:
1277 +               hdev->stat.cmd_tx++;
1278 +               break;
1279 +       case HCI_ACLDATA_PKT:
1280 +               hdev->stat.acl_tx++;
1281 +               break;
1282 +       case HCI_SCODATA_PKT:
1283 +               hdev->stat.sco_tx++;
1284 +               break;
1285 +       };
1286 +
1287 +       /* Prepend skb with frame type */
1288 +       memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
1289 +
1290 +       count = skb->len;
1291 +
1292 +       /* Max HCI frame size seems to be 1511 + 1 */
1293 +       if (!(nskb = bluez_skb_alloc(count + 32, GFP_ATOMIC))) {
1294 +               BT_ERR("Can't allocate memory for new packet");
1295 +               return -ENOMEM;
1296 +       }
1297 +
1298 +       nskb->dev = (void *) bfusb;
1299 +
1300 +       while (count) {
1301 +               size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE);
1302 +
1303 +               buf[0] = 0xc1 | ((sent == 0) ? 0x04 : 0) | ((count == size) ? 0x08 : 0);
1304 +               buf[1] = 0x00;
1305 +               buf[2] = (size == BFUSB_MAX_BLOCK_SIZE) ? 0 : size;
1306 +
1307 +               memcpy(skb_put(nskb, 3), buf, 3);
1308 +               memcpy(skb_put(nskb, size), skb->data + sent, size);
1309 +
1310 +               sent  += size;
1311 +               count -= size;
1312 +       }
1313 +
1314 +       /* Don't send frame with multiple size of bulk max packet */
1315 +       if ((nskb->len % bfusb->bulk_pkt_size) == 0) {
1316 +               buf[0] = 0xdd;
1317 +               buf[1] = 0x00;
1318 +               memcpy(skb_put(nskb, 2), buf, 2);
1319 +       }
1320 +
1321 +       read_lock(&bfusb->lock);
1322 +
1323 +       skb_queue_tail(&bfusb->transmit_q, nskb);
1324 +       bfusb_tx_wakeup(bfusb);
1325 +
1326 +       read_unlock(&bfusb->lock);
1327 +
1328 +       kfree_skb(skb);
1329 +
1330 +       return 0;
1331 +}
1332 +
1333 +static void bfusb_destruct(struct hci_dev *hdev)
1334 +{
1335 +       struct bfusb *bfusb = (struct bfusb *) hdev->driver_data;
1336 +
1337 +       BT_DBG("hdev %p bfusb %p", hdev, bfusb);
1338 +
1339 +       kfree(bfusb);
1340 +}
1341 +
1342 +static int bfusb_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
1343 +{
1344 +       return -ENOIOCTLCMD;
1345 +}
1346 +
1347 +
1348 +static int bfusb_load_firmware(struct bfusb *bfusb, unsigned char *firmware, int count)
1349 +{
1350 +       unsigned char *buf;
1351 +       int err, pipe, len, size, sent = 0;
1352 +
1353 +       BT_DBG("bfusb %p udev %p firmware %p count %d", bfusb, bfusb->udev, firmware, count);
1354 +
1355 +       BT_INFO("BlueFRITZ! USB loading firmware");
1356 +
1357 +       if (usb_set_configuration(bfusb->udev, 1) < 0) {
1358 +               BT_ERR("Can't change to loading configuration");
1359 +               return -EBUSY;
1360 +       }
1361 +
1362 +       buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_ATOMIC);
1363 +       if (!buf) {
1364 +               BT_ERR("Can't allocate memory chunk for firmware");
1365 +               return -ENOMEM;
1366 +       }
1367 +
1368 +       pipe = usb_sndbulkpipe(bfusb->udev, bfusb->bulk_out_ep);
1369 +
1370 +       while (count) {
1371 +               size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE + 3);
1372 +
1373 +               memcpy(buf, firmware + sent, size);
1374 +
1375 +               err = usb_bulk_msg(bfusb->udev, pipe, buf, size,
1376 +                                       &len, BFUSB_BLOCK_TIMEOUT);
1377 +
1378 +               if (err || (len != size)) {
1379 +                       BT_ERR("Error in firmware loading");
1380 +                       goto error;
1381 +               }
1382 +
1383 +               sent  += size;
1384 +               count -= size;
1385 +       }
1386 +
1387 +       if ((err = usb_bulk_msg(bfusb->udev, pipe, NULL, 0,
1388 +                               &len, BFUSB_BLOCK_TIMEOUT)) < 0) {
1389 +               BT_ERR("Error in null packet request");
1390 +               goto error;
1391 +       }
1392 +
1393 +       if ((err = usb_set_configuration(bfusb->udev, 2)) < 0) {
1394 +               BT_ERR("Can't change to running configuration");
1395 +               goto error;
1396 +       }
1397 +
1398 +       BT_INFO("BlueFRITZ! USB device ready");
1399 +
1400 +       kfree(buf);
1401 +       return 0;
1402 +
1403 +error:
1404 +       kfree(buf);
1405 +
1406 +       pipe = usb_sndctrlpipe(bfusb->udev, 0);
1407 +
1408 +       usb_control_msg(bfusb->udev, pipe, USB_REQ_SET_CONFIGURATION,
1409 +                               0, 0, 0, NULL, 0, BFUSB_BLOCK_TIMEOUT);
1410 +
1411 +       return err;
1412 +}
1413 +
1414 +static void *bfusb_probe(struct usb_device *udev, unsigned int ifnum, const struct usb_device_id *id)
1415 +{
1416 +       const struct firmware *firmware;
1417 +       char device[16];
1418 +       struct usb_interface *iface;
1419 +       struct usb_interface_descriptor *iface_desc;
1420 +       struct usb_endpoint_descriptor *bulk_out_ep;
1421 +       struct usb_endpoint_descriptor *bulk_in_ep;
1422 +       struct hci_dev *hdev;
1423 +       struct bfusb *bfusb;
1424 +
1425 +       BT_DBG("udev %p ifnum %d id %p", udev, ifnum, id);
1426 +
1427 +       /* Check number of endpoints */
1428 +       iface = &udev->actconfig->interface[0];
1429 +       iface_desc = &iface->altsetting[0];
1430 +
1431 +       if (iface_desc->bNumEndpoints < 2)
1432 +               return NULL;
1433 +
1434 +       bulk_out_ep = &iface_desc->endpoint[0];
1435 +       bulk_in_ep  = &iface_desc->endpoint[1];
1436 +
1437 +       if (!bulk_out_ep || !bulk_in_ep) {
1438 +               BT_ERR("Bulk endpoints not found");
1439 +               goto done;
1440 +       }
1441 +
1442 +       /* Initialize control structure and load firmware */
1443 +       if (!(bfusb = kmalloc(sizeof(struct bfusb), GFP_KERNEL))) {
1444 +               BT_ERR("Can't allocate memory for control structure");
1445 +               goto done;
1446 +       }
1447 +
1448 +       memset(bfusb, 0, sizeof(struct bfusb));
1449 +
1450 +       bfusb->udev = udev;
1451 +       bfusb->bulk_in_ep    = bulk_in_ep->bEndpointAddress;
1452 +       bfusb->bulk_out_ep   = bulk_out_ep->bEndpointAddress;
1453 +       bfusb->bulk_pkt_size = bulk_out_ep->wMaxPacketSize;
1454 +
1455 +       bfusb->lock = RW_LOCK_UNLOCKED;
1456 +
1457 +       bfusb->reassembly = NULL;
1458 +
1459 +       skb_queue_head_init(&bfusb->transmit_q);
1460 +       skb_queue_head_init(&bfusb->pending_q);
1461 +       skb_queue_head_init(&bfusb->completed_q);
1462 +
1463 +       snprintf(device, sizeof(device), "bfusb%3.3d%3.3d", udev->bus->busnum, udev->devnum);
1464 +
1465 +       if (request_firmware(&firmware, "bfubase.frm", device) < 0) {
1466 +               BT_ERR("Firmware request failed");
1467 +               goto error;
1468 +       }
1469 +
1470 +       if (bfusb_load_firmware(bfusb, firmware->data, firmware->size) < 0) {
1471 +               BT_ERR("Firmware loading failed");
1472 +               goto release;
1473 +       }
1474 +
1475 +       release_firmware(firmware);
1476 +
1477 +       /* Initialize and register HCI device */
1478 +       hdev = &bfusb->hdev;
1479 +
1480 +       hdev->type = HCI_USB;
1481 +       hdev->driver_data = bfusb;
1482 +
1483 +       hdev->open     = bfusb_open;
1484 +       hdev->close    = bfusb_close;
1485 +       hdev->flush    = bfusb_flush;
1486 +       hdev->send     = bfusb_send_frame;
1487 +       hdev->destruct = bfusb_destruct;
1488 +       hdev->ioctl    = bfusb_ioctl;
1489 +
1490 +       if (hci_register_dev(hdev) < 0) {
1491 +               BT_ERR("Can't register HCI device");
1492 +               goto error;
1493 +       }
1494 +
1495 +       return bfusb;
1496 +
1497 +release:
1498 +       release_firmware(firmware);
1499 +
1500 +error:
1501 +       kfree(bfusb);
1502 +
1503 +done:
1504 +       return NULL;
1505 +}
1506 +
1507 +static void bfusb_disconnect(struct usb_device *udev, void *ptr)
1508 +{
1509 +       struct bfusb *bfusb = (struct bfusb *) ptr;
1510 +       struct hci_dev *hdev = &bfusb->hdev;
1511 +
1512 +       BT_DBG("udev %p ptr %p", udev, ptr);
1513 +
1514 +       if (!hdev)
1515 +               return;
1516 +
1517 +       bfusb_close(hdev);
1518 +
1519 +       if (hci_unregister_dev(hdev) < 0)
1520 +               BT_ERR("Can't unregister HCI device %s", hdev->name);
1521 +}
1522 +
1523 +static struct usb_driver bfusb_driver = {
1524 +       name:           "bfusb",
1525 +       probe:          bfusb_probe,
1526 +       disconnect:     bfusb_disconnect,
1527 +       id_table:       bfusb_table,
1528 +};
1529 +
1530 +static int __init bfusb_init(void)
1531 +{
1532 +       int err;
1533 +
1534 +       BT_INFO("BlueFRITZ! USB driver ver %s", VERSION);
1535 +       BT_INFO("Copyright (C) 2003 Marcel Holtmann <marcel@holtmann.org>");
1536 +
1537 +       if ((err = usb_register(&bfusb_driver)) < 0)
1538 +               BT_ERR("Failed to register BlueFRITZ! USB driver");
1539 +
1540 +       return err;
1541 +}
1542 +
1543 +static void __exit bfusb_cleanup(void)
1544 +{
1545 +       usb_deregister(&bfusb_driver);
1546 +}
1547 +
1548 +module_init(bfusb_init);
1549 +module_exit(bfusb_cleanup);
1550 +
1551 +MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1552 +MODULE_DESCRIPTION("BlueFRITZ! USB driver ver " VERSION);
1553 +MODULE_LICENSE("GPL");
1554 diff -urN linux-2.4.18/drivers/bluetooth/bluecard_cs.c linux-2.4.18-mh9/drivers/bluetooth/bluecard_cs.c
1555 --- linux-2.4.18/drivers/bluetooth/bluecard_cs.c        Thu Jan  1 01:00:00 1970
1556 +++ linux-2.4.18-mh9/drivers/bluetooth/bluecard_cs.c    Mon Aug 25 18:38:10 2003
1557 @@ -0,0 +1,1113 @@
1558 +/*
1559 + *
1560 + *  Bluetooth driver for the Anycom BlueCard (LSE039/LSE041)
1561 + *
1562 + *  Copyright (C) 2001-2002  Marcel Holtmann <marcel@holtmann.org>
1563 + *
1564 + *
1565 + *  This program is free software; you can redistribute it and/or modify
1566 + *  it under the terms of the GNU General Public License version 2 as
1567 + *  published by the Free Software Foundation;
1568 + *
1569 + *  Software distributed under the License is distributed on an "AS
1570 + *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
1571 + *  implied. See the License for the specific language governing
1572 + *  rights and limitations under the License.
1573 + *
1574 + *  The initial developer of the original code is David A. Hinds
1575 + *  <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
1576 + *  are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
1577 + *
1578 + */
1579 +
1580 +#include <linux/config.h>
1581 +#include <linux/module.h>
1582 +
1583 +#include <linux/kernel.h>
1584 +#include <linux/init.h>
1585 +#include <linux/slab.h>
1586 +#include <linux/types.h>
1587 +#include <linux/sched.h>
1588 +#include <linux/timer.h>
1589 +#include <linux/errno.h>
1590 +#include <linux/ptrace.h>
1591 +#include <linux/ioport.h>
1592 +#include <linux/spinlock.h>
1593 +#include <linux/skbuff.h>
1594 +#include <asm/io.h>
1595 +
1596 +#include <pcmcia/version.h>
1597 +#include <pcmcia/cs_types.h>
1598 +#include <pcmcia/cs.h>
1599 +#include <pcmcia/cistpl.h>
1600 +#include <pcmcia/ciscode.h>
1601 +#include <pcmcia/ds.h>
1602 +#include <pcmcia/cisreg.h>
1603 +
1604 +#include <net/bluetooth/bluetooth.h>
1605 +#include <net/bluetooth/hci_core.h>
1606 +
1607 +
1608 +
1609 +/* ======================== Module parameters ======================== */
1610 +
1611 +
1612 +/* Bit map of interrupts to choose from */
1613 +static u_int irq_mask = 0x86bc;
1614 +static int irq_list[4] = { -1 };
1615 +
1616 +MODULE_PARM(irq_mask, "i");
1617 +MODULE_PARM(irq_list, "1-4i");
1618 +
1619 +MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1620 +MODULE_DESCRIPTION("BlueZ driver for the Anycom BlueCard (LSE039/LSE041)");
1621 +MODULE_LICENSE("GPL");
1622 +
1623 +
1624 +
1625 +/* ======================== Local structures ======================== */
1626 +
1627 +
1628 +typedef struct bluecard_info_t {
1629 +       dev_link_t link;
1630 +       dev_node_t node;
1631 +
1632 +       struct hci_dev hdev;
1633 +
1634 +       spinlock_t lock;                /* For serializing operations */
1635 +       struct timer_list timer;        /* For LED control */
1636 +
1637 +       struct sk_buff_head txq;
1638 +       unsigned long tx_state;
1639 +
1640 +       unsigned long rx_state;
1641 +       unsigned long rx_count;
1642 +       struct sk_buff *rx_skb;
1643 +
1644 +       unsigned char ctrl_reg;
1645 +       unsigned long hw_state;         /* Status of the hardware and LED control */
1646 +} bluecard_info_t;
1647 +
1648 +
1649 +void bluecard_config(dev_link_t *link);
1650 +void bluecard_release(u_long arg);
1651 +int bluecard_event(event_t event, int priority, event_callback_args_t *args);
1652 +
1653 +static dev_info_t dev_info = "bluecard_cs";
1654 +
1655 +dev_link_t *bluecard_attach(void);
1656 +void bluecard_detach(dev_link_t *);
1657 +
1658 +static dev_link_t *dev_list = NULL;
1659 +
1660 +
1661 +/* Default baud rate: 57600, 115200, 230400 or 460800 */
1662 +#define DEFAULT_BAUD_RATE  230400
1663 +
1664 +
1665 +/* Hardware states */
1666 +#define CARD_READY             1
1667 +#define CARD_HAS_PCCARD_ID     4
1668 +#define CARD_HAS_POWER_LED     5
1669 +#define CARD_HAS_ACTIVITY_LED  6
1670 +
1671 +/* Transmit states  */
1672 +#define XMIT_SENDING         1
1673 +#define XMIT_WAKEUP          2
1674 +#define XMIT_BUFFER_NUMBER   5 /* unset = buffer one, set = buffer two */
1675 +#define XMIT_BUF_ONE_READY   6
1676 +#define XMIT_BUF_TWO_READY   7
1677 +#define XMIT_SENDING_READY   8
1678 +
1679 +/* Receiver states */
1680 +#define RECV_WAIT_PACKET_TYPE   0
1681 +#define RECV_WAIT_EVENT_HEADER  1
1682 +#define RECV_WAIT_ACL_HEADER    2
1683 +#define RECV_WAIT_SCO_HEADER    3
1684 +#define RECV_WAIT_DATA          4
1685 +
1686 +/* Special packet types */
1687 +#define PKT_BAUD_RATE_57600   0x80
1688 +#define PKT_BAUD_RATE_115200  0x81
1689 +#define PKT_BAUD_RATE_230400  0x82
1690 +#define PKT_BAUD_RATE_460800  0x83
1691 +
1692 +
1693 +/* These are the register offsets */
1694 +#define REG_COMMAND     0x20
1695 +#define REG_INTERRUPT   0x21
1696 +#define REG_CONTROL     0x22
1697 +#define REG_RX_CONTROL  0x24
1698 +#define REG_CARD_RESET  0x30
1699 +#define REG_LED_CTRL    0x30
1700 +
1701 +/* REG_COMMAND */
1702 +#define REG_COMMAND_TX_BUF_ONE  0x01
1703 +#define REG_COMMAND_TX_BUF_TWO  0x02
1704 +#define REG_COMMAND_RX_BUF_ONE  0x04
1705 +#define REG_COMMAND_RX_BUF_TWO  0x08
1706 +#define REG_COMMAND_RX_WIN_ONE  0x00
1707 +#define REG_COMMAND_RX_WIN_TWO  0x10
1708 +
1709 +/* REG_CONTROL */
1710 +#define REG_CONTROL_BAUD_RATE_57600   0x00
1711 +#define REG_CONTROL_BAUD_RATE_115200  0x01
1712 +#define REG_CONTROL_BAUD_RATE_230400  0x02
1713 +#define REG_CONTROL_BAUD_RATE_460800  0x03
1714 +#define REG_CONTROL_RTS               0x04
1715 +#define REG_CONTROL_BT_ON             0x08
1716 +#define REG_CONTROL_BT_RESET          0x10
1717 +#define REG_CONTROL_BT_RES_PU         0x20
1718 +#define REG_CONTROL_INTERRUPT         0x40
1719 +#define REG_CONTROL_CARD_RESET        0x80
1720 +
1721 +/* REG_RX_CONTROL */
1722 +#define RTS_LEVEL_SHIFT_BITS  0x02
1723 +
1724 +
1725 +
1726 +/* ======================== LED handling routines ======================== */
1727 +
1728 +
1729 +void bluecard_activity_led_timeout(u_long arg)
1730 +{
1731 +       bluecard_info_t *info = (bluecard_info_t *)arg;
1732 +       unsigned int iobase = info->link.io.BasePort1;
1733 +
1734 +       if (test_bit(CARD_HAS_ACTIVITY_LED, &(info->hw_state))) {
1735 +               /* Disable activity LED */
1736 +               outb(0x08 | 0x20, iobase + 0x30);
1737 +       } else {
1738 +               /* Disable power LED */
1739 +               outb(0x00, iobase + 0x30);
1740 +       }
1741 +}
1742 +
1743 +
1744 +static void bluecard_enable_activity_led(bluecard_info_t *info)
1745 +{
1746 +       unsigned int iobase = info->link.io.BasePort1;
1747 +
1748 +       if (test_bit(CARD_HAS_ACTIVITY_LED, &(info->hw_state))) {
1749 +               /* Enable activity LED */
1750 +               outb(0x10 | 0x40, iobase + 0x30);
1751 +
1752 +               /* Stop the LED after HZ/4 */
1753 +               mod_timer(&(info->timer), jiffies + HZ / 4);
1754 +       } else {
1755 +               /* Enable power LED */
1756 +               outb(0x08 | 0x20, iobase + 0x30);
1757 +
1758 +               /* Stop the LED after HZ/2 */
1759 +               mod_timer(&(info->timer), jiffies + HZ / 2);
1760 +       }
1761 +}
1762 +
1763 +
1764 +
1765 +/* ======================== Interrupt handling ======================== */
1766 +
1767 +
1768 +static int bluecard_write(unsigned int iobase, unsigned int offset, __u8 *buf, int len)
1769 +{
1770 +       int i, actual;
1771 +
1772 +       actual = (len > 15) ? 15 : len;
1773 +
1774 +       outb_p(actual, iobase + offset);
1775 +
1776 +       for (i = 0; i < actual; i++)
1777 +               outb_p(buf[i], iobase + offset + i + 1);
1778 +
1779 +       return actual;
1780 +}
1781 +
1782 +
1783 +static void bluecard_write_wakeup(bluecard_info_t *info)
1784 +{
1785 +       if (!info) {
1786 +               printk(KERN_WARNING "bluecard_cs: Call of write_wakeup for unknown device.\n");
1787 +               return;
1788 +       }
1789 +
1790 +       if (!test_bit(XMIT_SENDING_READY, &(info->tx_state)))
1791 +               return;
1792 +
1793 +       if (test_and_set_bit(XMIT_SENDING, &(info->tx_state))) {
1794 +               set_bit(XMIT_WAKEUP, &(info->tx_state));
1795 +               return;
1796 +       }
1797 +
1798 +       do {
1799 +               register unsigned int iobase = info->link.io.BasePort1;
1800 +               register unsigned int offset;
1801 +               register unsigned char command;
1802 +               register unsigned long ready_bit;
1803 +               register struct sk_buff *skb;
1804 +               register int len;
1805 +
1806 +               clear_bit(XMIT_WAKEUP, &(info->tx_state));
1807 +
1808 +               if (!(info->link.state & DEV_PRESENT))
1809 +                       return;
1810 +
1811 +               if (test_bit(XMIT_BUFFER_NUMBER, &(info->tx_state))) {
1812 +                       if (!test_bit(XMIT_BUF_TWO_READY, &(info->tx_state)))
1813 +                               break;
1814 +                       offset = 0x10;
1815 +                       command = REG_COMMAND_TX_BUF_TWO;
1816 +                       ready_bit = XMIT_BUF_TWO_READY;
1817 +               } else {
1818 +                       if (!test_bit(XMIT_BUF_ONE_READY, &(info->tx_state)))
1819 +                               break;
1820 +                       offset = 0x00;
1821 +                       command = REG_COMMAND_TX_BUF_ONE;
1822 +                       ready_bit = XMIT_BUF_ONE_READY;
1823 +               }
1824 +
1825 +               if (!(skb = skb_dequeue(&(info->txq))))
1826 +                       break;
1827 +
1828 +               if (skb->pkt_type & 0x80) {
1829 +                       /* Disable RTS */
1830 +                       info->ctrl_reg |= REG_CONTROL_RTS;
1831 +                       outb(info->ctrl_reg, iobase + REG_CONTROL);
1832 +               }
1833 +
1834 +               /* Activate LED */
1835 +               bluecard_enable_activity_led(info);
1836 +
1837 +               /* Send frame */
1838 +               len = bluecard_write(iobase, offset, skb->data, skb->len);
1839 +
1840 +               /* Tell the FPGA to send the data */
1841 +               outb_p(command, iobase + REG_COMMAND);
1842 +
1843 +               /* Mark the buffer as dirty */
1844 +               clear_bit(ready_bit, &(info->tx_state));
1845 +
1846 +               if (skb->pkt_type & 0x80) {
1847 +
1848 +                       wait_queue_head_t wait;
1849 +                       unsigned char baud_reg;
1850 +
1851 +                       switch (skb->pkt_type) {
1852 +                       case PKT_BAUD_RATE_460800:
1853 +                               baud_reg = REG_CONTROL_BAUD_RATE_460800;
1854 +                               break;
1855 +                       case PKT_BAUD_RATE_230400:
1856 +                               baud_reg = REG_CONTROL_BAUD_RATE_230400;
1857 +                               break;
1858 +                       case PKT_BAUD_RATE_115200:
1859 +                               baud_reg = REG_CONTROL_BAUD_RATE_115200;
1860 +                               break;
1861 +                       case PKT_BAUD_RATE_57600:
1862 +                               /* Fall through... */
1863 +                       default:
1864 +                               baud_reg = REG_CONTROL_BAUD_RATE_57600;
1865 +                               break;
1866 +                       }
1867 +
1868 +                       /* Wait until the command reaches the baseband */
1869 +                       init_waitqueue_head(&wait);
1870 +                       interruptible_sleep_on_timeout(&wait, HZ / 10);
1871 +
1872 +                       /* Set baud on baseband */
1873 +                       info->ctrl_reg &= ~0x03;
1874 +                       info->ctrl_reg |= baud_reg;
1875 +                       outb(info->ctrl_reg, iobase + REG_CONTROL);
1876 +
1877 +                       /* Enable RTS */
1878 +                       info->ctrl_reg &= ~REG_CONTROL_RTS;
1879 +                       outb(info->ctrl_reg, iobase + REG_CONTROL);
1880 +
1881 +                       /* Wait before the next HCI packet can be send */
1882 +                       interruptible_sleep_on_timeout(&wait, HZ);
1883 +
1884 +               }
1885 +
1886 +               if (len == skb->len) {
1887 +                       kfree_skb(skb);
1888 +               } else {
1889 +                       skb_pull(skb, len);
1890 +                       skb_queue_head(&(info->txq), skb);
1891 +               }
1892 +
1893 +               info->hdev.stat.byte_tx += len;
1894 +
1895 +               /* Change buffer */
1896 +               change_bit(XMIT_BUFFER_NUMBER, &(info->tx_state));
1897 +
1898 +       } while (test_bit(XMIT_WAKEUP, &(info->tx_state)));
1899 +
1900 +       clear_bit(XMIT_SENDING, &(info->tx_state));
1901 +}
1902 +
1903 +
1904 +static int bluecard_read(unsigned int iobase, unsigned int offset, __u8 *buf, int size)
1905 +{
1906 +       int i, n, len;
1907 +
1908 +       outb(REG_COMMAND_RX_WIN_ONE, iobase + REG_COMMAND);
1909 +
1910 +       len = inb(iobase + offset);
1911 +       n = 0;
1912 +       i = 1;
1913 +
1914 +       while (n < len) {
1915 +
1916 +               if (i == 16) {
1917 +                       outb(REG_COMMAND_RX_WIN_TWO, iobase + REG_COMMAND);
1918 +                       i = 0;
1919 +               }
1920 +
1921 +               buf[n] = inb(iobase + offset + i);
1922 +
1923 +               n++;
1924 +               i++;
1925 +
1926 +       }
1927 +
1928 +       return len;
1929 +}
1930 +
1931 +
1932 +static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
1933 +{
1934 +       unsigned int iobase;
1935 +       unsigned char buf[31];
1936 +       int i, len;
1937 +
1938 +       if (!info) {
1939 +               printk(KERN_WARNING "bluecard_cs: Call of receive for unknown device.\n");
1940 +               return;
1941 +       }
1942 +
1943 +       iobase = info->link.io.BasePort1;
1944 +
1945 +       if (test_bit(XMIT_SENDING_READY, &(info->tx_state)))
1946 +               bluecard_enable_activity_led(info);
1947 +
1948 +       len = bluecard_read(iobase, offset, buf, sizeof(buf));
1949 +
1950 +       for (i = 0; i < len; i++) {
1951 +
1952 +               /* Allocate packet */
1953 +               if (info->rx_skb == NULL) {
1954 +                       info->rx_state = RECV_WAIT_PACKET_TYPE;
1955 +                       info->rx_count = 0;
1956 +                       if (!(info->rx_skb = bluez_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
1957 +                               printk(KERN_WARNING "bluecard_cs: Can't allocate mem for new packet.\n");
1958 +                               return;
1959 +                       }
1960 +               }
1961 +
1962 +               if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
1963 +
1964 +                       info->rx_skb->dev = (void *)&(info->hdev);
1965 +                       info->rx_skb->pkt_type = buf[i];
1966 +
1967 +                       switch (info->rx_skb->pkt_type) {
1968 +
1969 +                       case 0x00:
1970 +                               /* init packet */
1971 +                               if (offset != 0x00) {
1972 +                                       set_bit(XMIT_BUF_ONE_READY, &(info->tx_state));
1973 +                                       set_bit(XMIT_BUF_TWO_READY, &(info->tx_state));
1974 +                                       set_bit(XMIT_SENDING_READY, &(info->tx_state));
1975 +                                       bluecard_write_wakeup(info);
1976 +                               }
1977 +
1978 +                               kfree_skb(info->rx_skb);
1979 +                               info->rx_skb = NULL;
1980 +                               break;
1981 +
1982 +                       case HCI_EVENT_PKT:
1983 +                               info->rx_state = RECV_WAIT_EVENT_HEADER;
1984 +                               info->rx_count = HCI_EVENT_HDR_SIZE;
1985 +                               break;
1986 +
1987 +                       case HCI_ACLDATA_PKT:
1988 +                               info->rx_state = RECV_WAIT_ACL_HEADER;
1989 +                               info->rx_count = HCI_ACL_HDR_SIZE;
1990 +                               break;
1991 +
1992 +                       case HCI_SCODATA_PKT:
1993 +                               info->rx_state = RECV_WAIT_SCO_HEADER;
1994 +                               info->rx_count = HCI_SCO_HDR_SIZE;
1995 +                               break;
1996 +
1997 +                       default:
1998 +                               /* unknown packet */
1999 +                               printk(KERN_WARNING "bluecard_cs: Unknown HCI packet with type 0x%02x received.\n", info->rx_skb->pkt_type);
2000 +                               info->hdev.stat.err_rx++;
2001 +
2002 +                               kfree_skb(info->rx_skb);
2003 +                               info->rx_skb = NULL;
2004 +                               break;
2005 +
2006 +                       }
2007 +
2008 +               } else {
2009 +
2010 +                       *skb_put(info->rx_skb, 1) = buf[i];
2011 +                       info->rx_count--;
2012 +
2013 +                       if (info->rx_count == 0) {
2014 +
2015 +                               int dlen;
2016 +                               hci_event_hdr *eh;
2017 +                               hci_acl_hdr *ah;
2018 +                               hci_sco_hdr *sh;
2019 +
2020 +                               switch (info->rx_state) {
2021 +
2022 +                               case RECV_WAIT_EVENT_HEADER:
2023 +                                       eh = (hci_event_hdr *)(info->rx_skb->data);
2024 +                                       info->rx_state = RECV_WAIT_DATA;
2025 +                                       info->rx_count = eh->plen;
2026 +                                       break;
2027 +
2028 +                               case RECV_WAIT_ACL_HEADER:
2029 +                                       ah = (hci_acl_hdr *)(info->rx_skb->data);
2030 +                                       dlen = __le16_to_cpu(ah->dlen);
2031 +                                       info->rx_state = RECV_WAIT_DATA;
2032 +                                       info->rx_count = dlen;
2033 +                                       break;
2034 +
2035 +                               case RECV_WAIT_SCO_HEADER:
2036 +                                       sh = (hci_sco_hdr *)(info->rx_skb->data);
2037 +                                       info->rx_state = RECV_WAIT_DATA;
2038 +                                       info->rx_count = sh->dlen;
2039 +                                       break;
2040 +
2041 +                               case RECV_WAIT_DATA:
2042 +                                       hci_recv_frame(info->rx_skb);
2043 +                                       info->rx_skb = NULL;
2044 +                                       break;
2045 +
2046 +                               }
2047 +
2048 +                       }
2049 +
2050 +               }
2051 +
2052 +
2053 +       }
2054 +
2055 +       info->hdev.stat.byte_rx += len;
2056 +}
2057 +
2058 +
2059 +void bluecard_interrupt(int irq, void *dev_inst, struct pt_regs *regs)
2060 +{
2061 +       bluecard_info_t *info = dev_inst;
2062 +       unsigned int iobase;
2063 +       unsigned char reg;
2064 +
2065 +       if (!info) {
2066 +               printk(KERN_WARNING "bluecard_cs: Call of irq %d for unknown device.\n", irq);
2067 +               return;
2068 +       }
2069 +
2070 +       if (!test_bit(CARD_READY, &(info->hw_state)))
2071 +               return;
2072 +
2073 +       iobase = info->link.io.BasePort1;
2074 +
2075 +       spin_lock(&(info->lock));
2076 +
2077 +       /* Disable interrupt */
2078 +       info->ctrl_reg &= ~REG_CONTROL_INTERRUPT;
2079 +       outb(info->ctrl_reg, iobase + REG_CONTROL);
2080 +
2081 +       reg = inb(iobase + REG_INTERRUPT);
2082 +
2083 +       if ((reg != 0x00) && (reg != 0xff)) {
2084 +
2085 +               if (reg & 0x04) {
2086 +                       bluecard_receive(info, 0x00);
2087 +                       outb(0x04, iobase + REG_INTERRUPT);
2088 +                       outb(REG_COMMAND_RX_BUF_ONE, iobase + REG_COMMAND);
2089 +               }
2090 +
2091 +               if (reg & 0x08) {
2092 +                       bluecard_receive(info, 0x10);
2093 +                       outb(0x08, iobase + REG_INTERRUPT);
2094 +                       outb(REG_COMMAND_RX_BUF_TWO, iobase + REG_COMMAND);
2095 +               }
2096 +
2097 +               if (reg & 0x01) {
2098 +                       set_bit(XMIT_BUF_ONE_READY, &(info->tx_state));
2099 +                       outb(0x01, iobase + REG_INTERRUPT);
2100 +                       bluecard_write_wakeup(info);
2101 +               }
2102 +
2103 +               if (reg & 0x02) {
2104 +                       set_bit(XMIT_BUF_TWO_READY, &(info->tx_state));
2105 +                       outb(0x02, iobase + REG_INTERRUPT);
2106 +                       bluecard_write_wakeup(info);
2107 +               }
2108 +
2109 +       }
2110 +
2111 +       /* Enable interrupt */
2112 +       info->ctrl_reg |= REG_CONTROL_INTERRUPT;
2113 +       outb(info->ctrl_reg, iobase + REG_CONTROL);
2114 +
2115 +       spin_unlock(&(info->lock));
2116 +}
2117 +
2118 +
2119 +
2120 +/* ======================== Device specific HCI commands ======================== */
2121 +
2122 +
2123 +static int bluecard_hci_set_baud_rate(struct hci_dev *hdev, int baud)
2124 +{
2125 +       bluecard_info_t *info = (bluecard_info_t *)(hdev->driver_data);
2126 +       struct sk_buff *skb;
2127 +
2128 +       /* Ericsson baud rate command */
2129 +       unsigned char cmd[] = { HCI_COMMAND_PKT, 0x09, 0xfc, 0x01, 0x03 };
2130 +
2131 +       if (!(skb = bluez_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
2132 +               printk(KERN_WARNING "bluecard_cs: Can't allocate mem for new packet.\n");
2133 +               return -1;
2134 +       }
2135 +
2136 +       switch (baud) {
2137 +       case 460800:
2138 +               cmd[4] = 0x00;
2139 +               skb->pkt_type = PKT_BAUD_RATE_460800;
2140 +               break;
2141 +       case 230400:
2142 +               cmd[4] = 0x01;
2143 +               skb->pkt_type = PKT_BAUD_RATE_230400;
2144 +               break;
2145 +       case 115200:
2146 +               cmd[4] = 0x02;
2147 +               skb->pkt_type = PKT_BAUD_RATE_115200;
2148 +               break;
2149 +       case 57600:
2150 +               /* Fall through... */
2151 +       default:
2152 +               cmd[4] = 0x03;
2153 +               skb->pkt_type = PKT_BAUD_RATE_57600;
2154 +               break;
2155 +       }
2156 +
2157 +       memcpy(skb_put(skb, sizeof(cmd)), cmd, sizeof(cmd));
2158 +
2159 +       skb_queue_tail(&(info->txq), skb);
2160 +
2161 +       bluecard_write_wakeup(info);
2162 +
2163 +       return 0;
2164 +}
2165 +
2166 +
2167 +
2168 +/* ======================== HCI interface ======================== */
2169 +
2170 +
2171 +static int bluecard_hci_flush(struct hci_dev *hdev)
2172 +{
2173 +       bluecard_info_t *info = (bluecard_info_t *)(hdev->driver_data);
2174 +
2175 +       /* Drop TX queue */
2176 +       skb_queue_purge(&(info->txq));
2177 +
2178 +       return 0;
2179 +}
2180 +
2181 +
2182 +static int bluecard_hci_open(struct hci_dev *hdev)
2183 +{
2184 +       bluecard_info_t *info = (bluecard_info_t *)(hdev->driver_data);
2185 +       unsigned int iobase = info->link.io.BasePort1;
2186 +
2187 +       bluecard_hci_set_baud_rate(hdev, DEFAULT_BAUD_RATE);
2188 +
2189 +       if (test_and_set_bit(HCI_RUNNING, &(hdev->flags)))
2190 +               return 0;
2191 +
2192 +       /* Enable LED */
2193 +       outb(0x08 | 0x20, iobase + 0x30);
2194 +
2195 +       return 0;
2196 +}
2197 +
2198 +
2199 +static int bluecard_hci_close(struct hci_dev *hdev)
2200 +{
2201 +       bluecard_info_t *info = (bluecard_info_t *)(hdev->driver_data);
2202 +       unsigned int iobase = info->link.io.BasePort1;
2203 +
2204 +       if (!test_and_clear_bit(HCI_RUNNING, &(hdev->flags)))
2205 +               return 0;
2206 +
2207 +       bluecard_hci_flush(hdev);
2208 +
2209 +       /* Disable LED */
2210 +       outb(0x00, iobase + 0x30);
2211 +
2212 +       return 0;
2213 +}
2214 +
2215 +
2216 +static int bluecard_hci_send_frame(struct sk_buff *skb)
2217 +{
2218 +       bluecard_info_t *info;
2219 +       struct hci_dev *hdev = (struct hci_dev *)(skb->dev);
2220 +
2221 +       if (!hdev) {
2222 +               printk(KERN_WARNING "bluecard_cs: Frame for unknown HCI device (hdev=NULL).");
2223 +               return -ENODEV;
2224 +       }
2225 +
2226 +       info = (bluecard_info_t *)(hdev->driver_data);
2227 +
2228 +       switch (skb->pkt_type) {
2229 +       case HCI_COMMAND_PKT:
2230 +               hdev->stat.cmd_tx++;
2231 +               break;
2232 +       case HCI_ACLDATA_PKT:
2233 +               hdev->stat.acl_tx++;
2234 +               break;
2235 +       case HCI_SCODATA_PKT:
2236 +               hdev->stat.sco_tx++;
2237 +               break;
2238 +       };
2239 +
2240 +       /* Prepend skb with frame type */
2241 +       memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
2242 +       skb_queue_tail(&(info->txq), skb);
2243 +
2244 +       bluecard_write_wakeup(info);
2245 +
2246 +       return 0;
2247 +}
2248 +
2249 +
2250 +static void bluecard_hci_destruct(struct hci_dev *hdev)
2251 +{
2252 +}
2253 +
2254 +
2255 +static int bluecard_hci_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
2256 +{
2257 +       return -ENOIOCTLCMD;
2258 +}
2259 +
2260 +
2261 +
2262 +/* ======================== Card services HCI interaction ======================== */
2263 +
2264 +
2265 +int bluecard_open(bluecard_info_t *info)
2266 +{
2267 +       unsigned int iobase = info->link.io.BasePort1;
2268 +       struct hci_dev *hdev;
2269 +       unsigned char id;
2270 +
2271 +       spin_lock_init(&(info->lock));
2272 +
2273 +       init_timer(&(info->timer));
2274 +       info->timer.function = &bluecard_activity_led_timeout;
2275 +       info->timer.data = (u_long)info;
2276 +
2277 +       skb_queue_head_init(&(info->txq));
2278 +
2279 +       info->rx_state = RECV_WAIT_PACKET_TYPE;
2280 +       info->rx_count = 0;
2281 +       info->rx_skb = NULL;
2282 +
2283 +       id = inb(iobase + 0x30);
2284 +
2285 +       if ((id & 0x0f) == 0x02)
2286 +               set_bit(CARD_HAS_PCCARD_ID, &(info->hw_state));
2287 +
2288 +       if (id & 0x10)
2289 +               set_bit(CARD_HAS_POWER_LED, &(info->hw_state));
2290 +
2291 +       if (id & 0x20)
2292 +               set_bit(CARD_HAS_ACTIVITY_LED, &(info->hw_state));
2293 +
2294 +       /* Reset card */
2295 +       info->ctrl_reg = REG_CONTROL_BT_RESET | REG_CONTROL_CARD_RESET;
2296 +       outb(info->ctrl_reg, iobase + REG_CONTROL);
2297 +
2298 +       /* Turn FPGA off */
2299 +       outb(0x80, iobase + 0x30);
2300 +
2301 +       /* Wait some time */
2302 +       set_current_state(TASK_INTERRUPTIBLE);
2303 +       schedule_timeout(HZ / 100);
2304 +
2305 +       /* Turn FPGA on */
2306 +       outb(0x00, iobase + 0x30);
2307 +
2308 +       /* Activate card */
2309 +       info->ctrl_reg = REG_CONTROL_BT_ON | REG_CONTROL_BT_RES_PU;
2310 +       outb(info->ctrl_reg, iobase + REG_CONTROL);
2311 +
2312 +       /* Enable interrupt */
2313 +       outb(0xff, iobase + REG_INTERRUPT);
2314 +       info->ctrl_reg |= REG_CONTROL_INTERRUPT;
2315 +       outb(info->ctrl_reg, iobase + REG_CONTROL);
2316 +
2317 +       /* Start the RX buffers */
2318 +       outb(REG_COMMAND_RX_BUF_ONE, iobase + REG_COMMAND);
2319 +       outb(REG_COMMAND_RX_BUF_TWO, iobase + REG_COMMAND);
2320 +
2321 +       /* Signal that the hardware is ready */
2322 +       set_bit(CARD_READY, &(info->hw_state));
2323 +
2324 +       /* Drop TX queue */
2325 +       skb_queue_purge(&(info->txq));
2326 +
2327 +       /* Control the point at which RTS is enabled */
2328 +       outb((0x0f << RTS_LEVEL_SHIFT_BITS) | 1, iobase + REG_RX_CONTROL);
2329 +
2330 +       /* Timeout before it is safe to send the first HCI packet */
2331 +       set_current_state(TASK_INTERRUPTIBLE);
2332 +       schedule_timeout((HZ * 5) / 4);         // or set it to 3/2
2333 +
2334 +
2335 +       /* Initialize and register HCI device */
2336 +
2337 +       hdev = &(info->hdev);
2338 +
2339 +       hdev->type = HCI_PCCARD;
2340 +       hdev->driver_data = info;
2341 +
2342 +       hdev->open = bluecard_hci_open;
2343 +       hdev->close = bluecard_hci_close;
2344 +       hdev->flush = bluecard_hci_flush;
2345 +       hdev->send = bluecard_hci_send_frame;
2346 +       hdev->destruct = bluecard_hci_destruct;
2347 +       hdev->ioctl = bluecard_hci_ioctl;
2348 +
2349 +       if (hci_register_dev(hdev) < 0) {
2350 +               printk(KERN_WARNING "bluecard_cs: Can't register HCI device %s.\n", hdev->name);
2351 +               return -ENODEV;
2352 +       }
2353 +
2354 +       return 0;
2355 +}
2356 +
2357 +
2358 +int bluecard_close(bluecard_info_t *info)
2359 +{
2360 +       unsigned int iobase = info->link.io.BasePort1;
2361 +       struct hci_dev *hdev = &(info->hdev);
2362 +
2363 +       bluecard_hci_close(hdev);
2364 +
2365 +       clear_bit(CARD_READY, &(info->hw_state));
2366 +
2367 +       /* Reset card */
2368 +       info->ctrl_reg = REG_CONTROL_BT_RESET | REG_CONTROL_CARD_RESET;
2369 +       outb(info->ctrl_reg, iobase + REG_CONTROL);
2370 +
2371 +       /* Turn FPGA off */
2372 +       outb(0x80, iobase + 0x30);
2373 +
2374 +       if (hci_unregister_dev(hdev) < 0)
2375 +               printk(KERN_WARNING "bluecard_cs: Can't unregister HCI device %s.\n", hdev->name);
2376 +
2377 +       return 0;
2378 +}
2379 +
2380 +
2381 +
2382 +/* ======================== Card services ======================== */
2383 +
2384 +
2385 +static void cs_error(client_handle_t handle, int func, int ret)
2386 +{
2387 +       error_info_t err = { func, ret };
2388 +
2389 +       CardServices(ReportError, handle, &err);
2390 +}
2391 +
2392 +
2393 +dev_link_t *bluecard_attach(void)
2394 +{
2395 +       bluecard_info_t *info;
2396 +       client_reg_t client_reg;
2397 +       dev_link_t *link;
2398 +       int i, ret;
2399 +
2400 +       /* Create new info device */
2401 +       info = kmalloc(sizeof(*info), GFP_KERNEL);
2402 +       if (!info)
2403 +               return NULL;
2404 +       memset(info, 0, sizeof(*info));
2405 +
2406 +       link = &info->link;
2407 +       link->priv = info;
2408 +
2409 +       link->release.function = &bluecard_release;
2410 +       link->release.data = (u_long)link;
2411 +       link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
2412 +       link->io.NumPorts1 = 8;
2413 +       link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
2414 +       link->irq.IRQInfo1 = IRQ_INFO2_VALID | IRQ_LEVEL_ID;
2415 +
2416 +       if (irq_list[0] == -1)
2417 +               link->irq.IRQInfo2 = irq_mask;
2418 +       else
2419 +               for (i = 0; i < 4; i++)
2420 +                       link->irq.IRQInfo2 |= 1 << irq_list[i];
2421 +
2422 +       link->irq.Handler = bluecard_interrupt;
2423 +       link->irq.Instance = info;
2424 +
2425 +       link->conf.Attributes = CONF_ENABLE_IRQ;
2426 +       link->conf.Vcc = 50;
2427 +       link->conf.IntType = INT_MEMORY_AND_IO;
2428 +
2429 +       /* Register with Card Services */
2430 +       link->next = dev_list;
2431 +       dev_list = link;
2432 +       client_reg.dev_info = &dev_info;
2433 +       client_reg.Attributes = INFO_IO_CLIENT | INFO_CARD_SHARE;
2434 +       client_reg.EventMask =
2435 +               CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
2436 +               CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
2437 +               CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
2438 +       client_reg.event_handler = &bluecard_event;
2439 +       client_reg.Version = 0x0210;
2440 +       client_reg.event_callback_args.client_data = link;
2441 +
2442 +       ret = CardServices(RegisterClient, &link->handle, &client_reg);
2443 +       if (ret != CS_SUCCESS) {
2444 +               cs_error(link->handle, RegisterClient, ret);
2445 +               bluecard_detach(link);
2446 +               return NULL;
2447 +       }
2448 +
2449 +       return link;
2450 +}
2451 +
2452 +
2453 +void bluecard_detach(dev_link_t *link)
2454 +{
2455 +       bluecard_info_t *info = link->priv;
2456 +       dev_link_t **linkp;
2457 +       int ret;
2458 +
2459 +       /* Locate device structure */
2460 +       for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
2461 +               if (*linkp == link)
2462 +                       break;
2463 +
2464 +       if (*linkp == NULL)
2465 +               return;
2466 +
2467 +       del_timer(&link->release);
2468 +       if (link->state & DEV_CONFIG)
2469 +               bluecard_release((u_long)link);
2470 +
2471 +       if (link->handle) {
2472 +               ret = CardServices(DeregisterClient, link->handle);
2473 +               if (ret != CS_SUCCESS)
2474 +                       cs_error(link->handle, DeregisterClient, ret);
2475 +       }
2476 +
2477 +       /* Unlink device structure, free bits */
2478 +       *linkp = link->next;
2479 +
2480 +       kfree(info);
2481 +}
2482 +
2483 +
2484 +static int get_tuple(int fn, client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
2485 +{
2486 +       int i;
2487 +
2488 +       i = CardServices(fn, handle, tuple);
2489 +       if (i != CS_SUCCESS)
2490 +               return CS_NO_MORE_ITEMS;
2491 +
2492 +       i = CardServices(GetTupleData, handle, tuple);
2493 +       if (i != CS_SUCCESS)
2494 +               return i;
2495 +
2496 +       return CardServices(ParseTuple, handle, tuple, parse);
2497 +}
2498 +
2499 +
2500 +#define first_tuple(a, b, c) get_tuple(GetFirstTuple, a, b, c)
2501 +#define next_tuple(a, b, c) get_tuple(GetNextTuple, a, b, c)
2502 +
2503 +void bluecard_config(dev_link_t *link)
2504 +{
2505 +       client_handle_t handle = link->handle;
2506 +       bluecard_info_t *info = link->priv;
2507 +       tuple_t tuple;
2508 +       u_short buf[256];
2509 +       cisparse_t parse;
2510 +       config_info_t config;
2511 +       int i, n, last_ret, last_fn;
2512 +
2513 +       tuple.TupleData = (cisdata_t *)buf;
2514 +       tuple.TupleOffset = 0;
2515 +       tuple.TupleDataMax = 255;
2516 +       tuple.Attributes = 0;
2517 +
2518 +       /* Get configuration register information */
2519 +       tuple.DesiredTuple = CISTPL_CONFIG;
2520 +       last_ret = first_tuple(handle, &tuple, &parse);
2521 +       if (last_ret != CS_SUCCESS) {
2522 +               last_fn = ParseTuple;
2523 +               goto cs_failed;
2524 +       }
2525 +       link->conf.ConfigBase = parse.config.base;
2526 +       link->conf.Present = parse.config.rmask[0];
2527 +
2528 +       /* Configure card */
2529 +       link->state |= DEV_CONFIG;
2530 +       i = CardServices(GetConfigurationInfo, handle, &config);
2531 +       link->conf.Vcc = config.Vcc;
2532 +
2533 +       link->conf.ConfigIndex = 0x20;
2534 +       link->io.NumPorts1 = 64;
2535 +       link->io.IOAddrLines = 6;
2536 +
2537 +       for (n = 0; n < 0x400; n += 0x40) {
2538 +               link->io.BasePort1 = n ^ 0x300;
2539 +               i = CardServices(RequestIO, link->handle, &link->io);
2540 +               if (i == CS_SUCCESS)
2541 +                       break;
2542 +       }
2543 +
2544 +       if (i != CS_SUCCESS) {
2545 +               cs_error(link->handle, RequestIO, i);
2546 +               goto failed;
2547 +       }
2548 +
2549 +       i = CardServices(RequestIRQ, link->handle, &link->irq);
2550 +       if (i != CS_SUCCESS) {
2551 +               cs_error(link->handle, RequestIRQ, i);
2552 +               link->irq.AssignedIRQ = 0;
2553 +       }
2554 +
2555 +       i = CardServices(RequestConfiguration, link->handle, &link->conf);
2556 +       if (i != CS_SUCCESS) {
2557 +               cs_error(link->handle, RequestConfiguration, i);
2558 +               goto failed;
2559 +       }
2560 +
2561 +       MOD_INC_USE_COUNT;
2562 +
2563 +       if (bluecard_open(info) != 0)
2564 +               goto failed;
2565 +
2566 +       strcpy(info->node.dev_name, info->hdev.name);
2567 +       link->dev = &info->node;
2568 +       link->state &= ~DEV_CONFIG_PENDING;
2569 +
2570 +       return;
2571 +
2572 +cs_failed:
2573 +       cs_error(link->handle, last_fn, last_ret);
2574 +
2575 +failed:
2576 +       bluecard_release((u_long)link);
2577 +}
2578 +
2579 +
2580 +void bluecard_release(u_long arg)
2581 +{
2582 +       dev_link_t *link = (dev_link_t *)arg;
2583 +       bluecard_info_t *info = link->priv;
2584 +
2585 +       if (link->state & DEV_PRESENT)
2586 +               bluecard_close(info);
2587 +
2588 +       MOD_DEC_USE_COUNT;
2589 +
2590 +       link->dev = NULL;
2591 +
2592 +       CardServices(ReleaseConfiguration, link->handle);
2593 +       CardServices(ReleaseIO, link->handle, &link->io);
2594 +       CardServices(ReleaseIRQ, link->handle, &link->irq);
2595 +
2596 +       link->state &= ~DEV_CONFIG;
2597 +}
2598 +
2599 +
2600 +int bluecard_event(event_t event, int priority, event_callback_args_t *args)
2601 +{
2602 +       dev_link_t *link = args->client_data;
2603 +       bluecard_info_t *info = link->priv;
2604 +
2605 +       switch (event) {
2606 +       case CS_EVENT_CARD_REMOVAL:
2607 +               link->state &= ~DEV_PRESENT;
2608 +               if (link->state & DEV_CONFIG) {
2609 +                       bluecard_close(info);
2610 +                       mod_timer(&link->release, jiffies + HZ / 20);
2611 +               }
2612 +               break;
2613 +       case CS_EVENT_CARD_INSERTION:
2614 +               link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
2615 +               bluecard_config(link);
2616 +               break;
2617 +       case CS_EVENT_PM_SUSPEND:
2618 +               link->state |= DEV_SUSPEND;
2619 +               /* Fall through... */
2620 +       case CS_EVENT_RESET_PHYSICAL:
2621 +               if (link->state & DEV_CONFIG)
2622 +                       CardServices(ReleaseConfiguration, link->handle);
2623 +               break;
2624 +       case CS_EVENT_PM_RESUME:
2625 +               link->state &= ~DEV_SUSPEND;
2626 +               /* Fall through... */
2627 +       case CS_EVENT_CARD_RESET:
2628 +               if (DEV_OK(link))
2629 +                       CardServices(RequestConfiguration, link->handle, &link->conf);
2630 +               break;
2631 +       }
2632 +
2633 +       return 0;
2634 +}
2635 +
2636 +
2637 +
2638 +/* ======================== Module initialization ======================== */
2639 +
2640 +
2641 +int __init init_bluecard_cs(void)
2642 +{
2643 +       servinfo_t serv;
2644 +       int err;
2645 +
2646 +       CardServices(GetCardServicesInfo, &serv);
2647 +       if (serv.Revision != CS_RELEASE_CODE) {
2648 +               printk(KERN_NOTICE "bluecard_cs: Card Services release does not match!\n");
2649 +               return -1;
2650 +       }
2651 +
2652 +       err = register_pccard_driver(&dev_info, &bluecard_attach, &bluecard_detach);
2653 +
2654 +       return err;
2655 +}
2656 +
2657 +
2658 +void __exit exit_bluecard_cs(void)
2659 +{
2660 +       unregister_pccard_driver(&dev_info);
2661 +
2662 +       while (dev_list != NULL)
2663 +               bluecard_detach(dev_list);
2664 +}
2665 +
2666 +
2667 +module_init(init_bluecard_cs);
2668 +module_exit(exit_bluecard_cs);
2669 +
2670 +EXPORT_NO_SYMBOLS;
2671 diff -urN linux-2.4.18/drivers/bluetooth/bt3c_cs.c linux-2.4.18-mh9/drivers/bluetooth/bt3c_cs.c
2672 --- linux-2.4.18/drivers/bluetooth/bt3c_cs.c    Thu Jan  1 01:00:00 1970
2673 +++ linux-2.4.18-mh9/drivers/bluetooth/bt3c_cs.c        Mon Aug 25 18:38:10 2003
2674 @@ -0,0 +1,946 @@
2675 +/*
2676 + *
2677 + *  Driver for the 3Com Bluetooth PCMCIA card
2678 + *
2679 + *  Copyright (C) 2001-2002  Marcel Holtmann <marcel@holtmann.org>
2680 + *                           Jose Orlando Pereira <jop@di.uminho.pt>
2681 + *
2682 + *
2683 + *  This program is free software; you can redistribute it and/or modify
2684 + *  it under the terms of the GNU General Public License version 2 as
2685 + *  published by the Free Software Foundation;
2686 + *
2687 + *  Software distributed under the License is distributed on an "AS
2688 + *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
2689 + *  implied. See the License for the specific language governing
2690 + *  rights and limitations under the License.
2691 + *
2692 + *  The initial developer of the original code is David A. Hinds
2693 + *  <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
2694 + *  are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
2695 + *
2696 + */
2697 +
2698 +#include <linux/config.h>
2699 +#include <linux/module.h>
2700 +
2701 +#define __KERNEL_SYSCALLS__
2702 +
2703 +#include <linux/kernel.h>
2704 +#include <linux/kmod.h>
2705 +#include <linux/init.h>
2706 +#include <linux/slab.h>
2707 +#include <linux/types.h>
2708 +#include <linux/sched.h>
2709 +#include <linux/delay.h>
2710 +#include <linux/timer.h>
2711 +#include <linux/errno.h>
2712 +#include <linux/unistd.h>
2713 +#include <linux/ptrace.h>
2714 +#include <linux/ioport.h>
2715 +#include <linux/spinlock.h>
2716 +
2717 +#include <linux/skbuff.h>
2718 +#include <linux/string.h>
2719 +#include <linux/serial.h>
2720 +#include <linux/serial_reg.h>
2721 +#include <asm/system.h>
2722 +#include <asm/bitops.h>
2723 +#include <asm/io.h>
2724 +
2725 +#include <pcmcia/version.h>
2726 +#include <pcmcia/cs_types.h>
2727 +#include <pcmcia/cs.h>
2728 +#include <pcmcia/cistpl.h>
2729 +#include <pcmcia/ciscode.h>
2730 +#include <pcmcia/ds.h>
2731 +#include <pcmcia/cisreg.h>
2732 +
2733 +#include <net/bluetooth/bluetooth.h>
2734 +#include <net/bluetooth/hci_core.h>
2735 +
2736 +
2737 +
2738 +/* ======================== Module parameters ======================== */
2739 +
2740 +
2741 +/* Bit map of interrupts to choose from */
2742 +static u_int irq_mask = 0xffff;
2743 +static int irq_list[4] = { -1 };
2744 +
2745 +MODULE_PARM(irq_mask, "i");
2746 +MODULE_PARM(irq_list, "1-4i");
2747 +
2748 +MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>, Jose Orlando Pereira <jop@di.uminho.pt>");
2749 +MODULE_DESCRIPTION("BlueZ driver for the 3Com Bluetooth PCMCIA card");
2750 +MODULE_LICENSE("GPL");
2751 +
2752 +
2753 +
2754 +/* ======================== Local structures ======================== */
2755 +
2756 +
2757 +typedef struct bt3c_info_t {
2758 +       dev_link_t link;
2759 +       dev_node_t node;
2760 +
2761 +       struct hci_dev hdev;
2762 +
2763 +       spinlock_t lock;                /* For serializing operations */
2764 +
2765 +       struct sk_buff_head txq;
2766 +       unsigned long tx_state;
2767 +
2768 +       unsigned long rx_state;
2769 +       unsigned long rx_count;
2770 +       struct sk_buff *rx_skb;
2771 +} bt3c_info_t;
2772 +
2773 +
2774 +void bt3c_config(dev_link_t *link);
2775 +void bt3c_release(u_long arg);
2776 +int bt3c_event(event_t event, int priority, event_callback_args_t *args);
2777 +
2778 +static dev_info_t dev_info = "bt3c_cs";
2779 +
2780 +dev_link_t *bt3c_attach(void);
2781 +void bt3c_detach(dev_link_t *);
2782 +
2783 +static dev_link_t *dev_list = NULL;
2784 +
2785 +
2786 +/* Transmit states  */
2787 +#define XMIT_SENDING  1
2788 +#define XMIT_WAKEUP   2
2789 +#define XMIT_WAITING  8
2790 +
2791 +/* Receiver states */
2792 +#define RECV_WAIT_PACKET_TYPE   0
2793 +#define RECV_WAIT_EVENT_HEADER  1
2794 +#define RECV_WAIT_ACL_HEADER    2
2795 +#define RECV_WAIT_SCO_HEADER    3
2796 +#define RECV_WAIT_DATA          4
2797 +
2798 +
2799 +
2800 +/* ======================== Special I/O functions ======================== */
2801 +
2802 +
2803 +#define DATA_L   0
2804 +#define DATA_H   1
2805 +#define ADDR_L   2
2806 +#define ADDR_H   3
2807 +#define CONTROL  4
2808 +
2809 +
2810 +inline void bt3c_address(unsigned int iobase, unsigned short addr)
2811 +{
2812 +       outb(addr & 0xff, iobase + ADDR_L);
2813 +       outb((addr >> 8) & 0xff, iobase + ADDR_H);
2814 +}
2815 +
2816 +
2817 +inline void bt3c_put(unsigned int iobase, unsigned short value)
2818 +{
2819 +       outb(value & 0xff, iobase + DATA_L);
2820 +       outb((value >> 8) & 0xff, iobase + DATA_H);
2821 +}
2822 +
2823 +
2824 +inline void bt3c_io_write(unsigned int iobase, unsigned short addr, unsigned short value)
2825 +{
2826 +       bt3c_address(iobase, addr);
2827 +       bt3c_put(iobase, value);
2828 +}
2829 +
2830 +
2831 +inline unsigned short bt3c_get(unsigned int iobase)
2832 +{
2833 +       unsigned short value = inb(iobase + DATA_L);
2834 +
2835 +       value |= inb(iobase + DATA_H) << 8;
2836 +
2837 +       return value;
2838 +}
2839 +
2840 +
2841 +inline unsigned short bt3c_read(unsigned int iobase, unsigned short addr)
2842 +{
2843 +       bt3c_address(iobase, addr);
2844 +
2845 +       return bt3c_get(iobase);
2846 +}
2847 +
2848 +
2849 +
2850 +/* ======================== Interrupt handling ======================== */
2851 +
2852 +
2853 +static int bt3c_write(unsigned int iobase, int fifo_size, __u8 *buf, int len)
2854 +{
2855 +       int actual = 0;
2856 +
2857 +       bt3c_address(iobase, 0x7080);
2858 +
2859 +       /* Fill FIFO with current frame */
2860 +       while (actual < len) {
2861 +               /* Transmit next byte */
2862 +               bt3c_put(iobase, buf[actual]);
2863 +               actual++;
2864 +       }
2865 +
2866 +       bt3c_io_write(iobase, 0x7005, actual);
2867 +
2868 +       return actual;
2869 +}
2870 +
2871 +
2872 +static void bt3c_write_wakeup(bt3c_info_t *info, int from)
2873 +{
2874 +       unsigned long flags;
2875 +
2876 +       if (!info) {
2877 +               printk(KERN_WARNING "bt3c_cs: Call of write_wakeup for unknown device.\n");
2878 +               return;
2879 +       }
2880 +
2881 +       if (test_and_set_bit(XMIT_SENDING, &(info->tx_state)))
2882 +               return;
2883 +
2884 +       spin_lock_irqsave(&(info->lock), flags);
2885 +
2886 +       do {
2887 +               register unsigned int iobase = info->link.io.BasePort1;
2888 +               register struct sk_buff *skb;
2889 +               register int len;
2890 +
2891 +               if (!(info->link.state & DEV_PRESENT))
2892 +                       break;
2893 +
2894 +
2895 +               if (!(skb = skb_dequeue(&(info->txq)))) {
2896 +                       clear_bit(XMIT_SENDING, &(info->tx_state));
2897 +                       break;
2898 +               }
2899 +
2900 +               /* Send frame */
2901 +               len = bt3c_write(iobase, 256, skb->data, skb->len);
2902 +
2903 +               if (len != skb->len) {
2904 +                       printk(KERN_WARNING "bt3c_cs: very strange\n");
2905 +               }
2906 +
2907 +               kfree_skb(skb);
2908 +
2909 +               info->hdev.stat.byte_tx += len;
2910 +
2911 +       } while (0);
2912 +
2913 +       spin_unlock_irqrestore(&(info->lock), flags);
2914 +}
2915 +
2916 +
2917 +static void bt3c_receive(bt3c_info_t *info)
2918 +{
2919 +       unsigned int iobase;
2920 +       int size = 0, avail;
2921 +
2922 +       if (!info) {
2923 +               printk(KERN_WARNING "bt3c_cs: Call of receive for unknown device.\n");
2924 +               return;
2925 +       }
2926 +
2927 +       iobase = info->link.io.BasePort1;
2928 +
2929 +       avail = bt3c_read(iobase, 0x7006);
2930 +       //printk("bt3c_cs: receiving %d bytes\n", avail);
2931 +
2932 +       bt3c_address(iobase, 0x7480);
2933 +       while (size < avail) {
2934 +               size++;
2935 +               info->hdev.stat.byte_rx++;
2936 +
2937 +               /* Allocate packet */
2938 +               if (info->rx_skb == NULL) {
2939 +                       info->rx_state = RECV_WAIT_PACKET_TYPE;
2940 +                       info->rx_count = 0;
2941 +                       if (!(info->rx_skb = bluez_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
2942 +                               printk(KERN_WARNING "bt3c_cs: Can't allocate mem for new packet.\n");
2943 +                               return;
2944 +                       }
2945 +               }
2946 +
2947 +
2948 +               if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
2949 +
2950 +                       info->rx_skb->dev = (void *)&(info->hdev);
2951 +                       info->rx_skb->pkt_type = inb(iobase + DATA_L);
2952 +                       inb(iobase + DATA_H);
2953 +                       //printk("bt3c: PACKET_TYPE=%02x\n", info->rx_skb->pkt_type);
2954 +
2955 +                       switch (info->rx_skb->pkt_type) {
2956 +
2957 +                       case HCI_EVENT_PKT:
2958 +                               info->rx_state = RECV_WAIT_EVENT_HEADER;
2959 +                               info->rx_count = HCI_EVENT_HDR_SIZE;
2960 +                               break;
2961 +
2962 +                       case HCI_ACLDATA_PKT:
2963 +                               info->rx_state = RECV_WAIT_ACL_HEADER;
2964 +                               info->rx_count = HCI_ACL_HDR_SIZE;
2965 +                               break;
2966 +
2967 +                       case HCI_SCODATA_PKT:
2968 +                               info->rx_state = RECV_WAIT_SCO_HEADER;
2969 +                               info->rx_count = HCI_SCO_HDR_SIZE;
2970 +                               break;
2971 +
2972 +                       default:
2973 +                               /* Unknown packet */
2974 +                               printk(KERN_WARNING "bt3c_cs: Unknown HCI packet with type 0x%02x received.\n", info->rx_skb->pkt_type);
2975 +                               info->hdev.stat.err_rx++;
2976 +                               clear_bit(HCI_RUNNING, &(info->hdev.flags));
2977 +
2978 +                               kfree_skb(info->rx_skb);
2979 +                               info->rx_skb = NULL;
2980 +                               break;
2981 +
2982 +                       }
2983 +
2984 +               } else {
2985 +
2986 +                       __u8 x = inb(iobase + DATA_L);
2987 +
2988 +                       *skb_put(info->rx_skb, 1) = x;
2989 +                       inb(iobase + DATA_H);
2990 +                       info->rx_count--;
2991 +
2992 +                       if (info->rx_count == 0) {
2993 +
2994 +                               int dlen;
2995 +                               hci_event_hdr *eh;
2996 +                               hci_acl_hdr *ah;
2997 +                               hci_sco_hdr *sh;
2998 +
2999 +                               switch (info->rx_state) {
3000 +
3001 +                               case RECV_WAIT_EVENT_HEADER:
3002 +                                       eh = (hci_event_hdr *)(info->rx_skb->data);
3003 +                                       info->rx_state = RECV_WAIT_DATA;
3004 +                                       info->rx_count = eh->plen;
3005 +                                       break;
3006 +
3007 +                               case RECV_WAIT_ACL_HEADER:
3008 +                                       ah = (hci_acl_hdr *)(info->rx_skb->data);
3009 +                                       dlen = __le16_to_cpu(ah->dlen);
3010 +                                       info->rx_state = RECV_WAIT_DATA;
3011 +                                       info->rx_count = dlen;
3012 +                                       break;
3013 +
3014 +                               case RECV_WAIT_SCO_HEADER:
3015 +                                       sh = (hci_sco_hdr *)(info->rx_skb->data);
3016 +                                       info->rx_state = RECV_WAIT_DATA;
3017 +                                       info->rx_count = sh->dlen;
3018 +                                       break;
3019 +
3020 +                               case RECV_WAIT_DATA:
3021 +                                       hci_recv_frame(info->rx_skb);
3022 +                                       info->rx_skb = NULL;
3023 +                                       break;
3024 +
3025 +                               }
3026 +
3027 +                       }
3028 +
3029 +               }
3030 +
3031 +       }
3032 +
3033 +       bt3c_io_write(iobase, 0x7006, 0x0000);
3034 +}
3035 +
3036 +
3037 +void bt3c_interrupt(int irq, void *dev_inst, struct pt_regs *regs)
3038 +{
3039 +       bt3c_info_t *info = dev_inst;
3040 +       unsigned int iobase;
3041 +       int iir;
3042 +
3043 +       if (!info) {
3044 +               printk(KERN_WARNING "bt3c_cs: Call of irq %d for unknown device.\n", irq);
3045 +               return;
3046 +       }
3047 +
3048 +       iobase = info->link.io.BasePort1;
3049 +
3050 +       spin_lock(&(info->lock));
3051 +
3052 +       iir = inb(iobase + CONTROL);
3053 +       if (iir & 0x80) {
3054 +               int stat = bt3c_read(iobase, 0x7001);
3055 +
3056 +               if ((stat & 0xff) == 0x7f) {
3057 +                       printk(KERN_WARNING "bt3c_cs: STRANGE stat=%04x\n", stat);
3058 +               } else if ((stat & 0xff) != 0xff) {
3059 +                       if (stat & 0x0020) {
3060 +                               int stat = bt3c_read(iobase, 0x7002) & 0x10;
3061 +                               printk(KERN_WARNING "bt3c_cs: antena %s\n", stat ? "OUT" : "IN");
3062 +                       }
3063 +                       if (stat & 0x0001)
3064 +                               bt3c_receive(info);
3065 +                       if (stat & 0x0002) {
3066 +                               //printk("bt3c_cs: ACK %04x\n", stat);
3067 +                               clear_bit(XMIT_SENDING, &(info->tx_state));
3068 +                               bt3c_write_wakeup(info, 1);
3069 +                       }
3070 +
3071 +                       bt3c_io_write(iobase, 0x7001, 0x0000);
3072 +
3073 +                       outb(iir, iobase + CONTROL);
3074 +               }
3075 +       }
3076 +
3077 +       spin_unlock(&(info->lock));
3078 +}
3079 +
3080 +
3081 +
3082 +
3083 +/* ======================== HCI interface ======================== */
3084 +
3085 +
3086 +static int bt3c_hci_flush(struct hci_dev *hdev)
3087 +{
3088 +       bt3c_info_t *info = (bt3c_info_t *)(hdev->driver_data);
3089 +
3090 +       /* Drop TX queue */
3091 +       skb_queue_purge(&(info->txq));
3092 +
3093 +       return 0;
3094 +}
3095 +
3096 +
3097 +static int bt3c_hci_open(struct hci_dev *hdev)
3098 +{
3099 +       set_bit(HCI_RUNNING, &(hdev->flags));
3100 +
3101 +       return 0;
3102 +}
3103 +
3104 +
3105 +static int bt3c_hci_close(struct hci_dev *hdev)
3106 +{
3107 +       if (!test_and_clear_bit(HCI_RUNNING, &(hdev->flags)))
3108 +               return 0;
3109 +
3110 +       bt3c_hci_flush(hdev);
3111 +
3112 +       return 0;
3113 +}
3114 +
3115 +
3116 +static int bt3c_hci_send_frame(struct sk_buff *skb)
3117 +{
3118 +       bt3c_info_t *info;
3119 +       struct hci_dev *hdev = (struct hci_dev *)(skb->dev);
3120 +
3121 +       if (!hdev) {
3122 +               printk(KERN_WARNING "bt3c_cs: Frame for unknown HCI device (hdev=NULL).");
3123 +               return -ENODEV;
3124 +       }
3125 +
3126 +       info = (bt3c_info_t *) (hdev->driver_data);
3127 +
3128 +       switch (skb->pkt_type) {
3129 +       case HCI_COMMAND_PKT:
3130 +               hdev->stat.cmd_tx++;
3131 +               break;
3132 +       case HCI_ACLDATA_PKT:
3133 +               hdev->stat.acl_tx++;
3134 +               break;
3135 +       case HCI_SCODATA_PKT:
3136 +               hdev->stat.sco_tx++;
3137 +               break;
3138 +       };
3139 +
3140 +       /* Prepend skb with frame type */
3141 +       memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
3142 +       skb_queue_tail(&(info->txq), skb);
3143 +
3144 +       bt3c_write_wakeup(info, 0);
3145 +
3146 +       return 0;
3147 +}
3148 +
3149 +
3150 +static void bt3c_hci_destruct(struct hci_dev *hdev)
3151 +{
3152 +}
3153 +
3154 +
3155 +static int bt3c_hci_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
3156 +{
3157 +       return -ENOIOCTLCMD;
3158 +}
3159 +
3160 +
3161 +
3162 +/* ======================== User mode firmware loader ======================== */
3163 +
3164 +
3165 +#define FW_LOADER  "/sbin/bluefw"
3166 +static int errno;
3167 +
3168 +
3169 +static int bt3c_fw_loader_exec(void *dev)
3170 +{
3171 +       char *argv[] = { FW_LOADER, "pccard", dev, NULL };
3172 +       char *envp[] = { "HOME=/", "TERM=linux", "PATH=/sbin:/usr/sbin:/bin:/usr/bin", NULL };
3173 +       int err;
3174 +
3175 +       err = exec_usermodehelper(FW_LOADER, argv, envp);
3176 +       if (err)
3177 +               printk(KERN_WARNING "bt3c_cs: Failed to exec \"%s pccard %s\".\n", FW_LOADER, (char *)dev);
3178 +
3179 +       return err;
3180 +}
3181 +
3182 +
3183 +static int bt3c_firmware_load(bt3c_info_t *info)
3184 +{
3185 +       sigset_t tmpsig;
3186 +       char dev[16];
3187 +       pid_t pid;
3188 +       int result;
3189 +
3190 +       /* Check if root fs is mounted */
3191 +       if (!current->fs->root) {
3192 +               printk(KERN_WARNING "bt3c_cs: Root filesystem is not mounted.\n");
3193 +               return -EPERM;
3194 +       }
3195 +
3196 +       sprintf(dev, "%04x", info->link.io.BasePort1);
3197 +
3198 +       pid = kernel_thread(bt3c_fw_loader_exec, (void *)dev, 0);
3199 +       if (pid < 0) {
3200 +               printk(KERN_WARNING "bt3c_cs: Forking of kernel thread failed (errno=%d).\n", -pid);
3201 +               return pid;
3202 +       }
3203 +
3204 +       /* Block signals, everything but SIGKILL/SIGSTOP */
3205 +       spin_lock_irq(&current->sigmask_lock);
3206 +       tmpsig = current->blocked;
3207 +       siginitsetinv(&current->blocked, sigmask(SIGKILL) | sigmask(SIGSTOP));
3208 +       recalc_sigpending(current);
3209 +       spin_unlock_irq(&current->sigmask_lock);
3210 +
3211 +       result = waitpid(pid, NULL, __WCLONE);
3212 +
3213 +       /* Allow signals again */
3214 +       spin_lock_irq(&current->sigmask_lock);
3215 +       current->blocked = tmpsig;
3216 +       recalc_sigpending(current);
3217 +       spin_unlock_irq(&current->sigmask_lock);
3218 +
3219 +       if (result != pid) {
3220 +               printk(KERN_WARNING "bt3c_cs: Waiting for pid %d failed (errno=%d).\n", pid, -result);
3221 +               return -result;
3222 +       }
3223 +
3224 +       return 0;
3225 +}
3226 +
3227 +
3228 +
3229 +/* ======================== Card services HCI interaction ======================== */
3230 +
3231 +
3232 +int bt3c_open(bt3c_info_t *info)
3233 +{
3234 +       struct hci_dev *hdev;
3235 +       int err;
3236 +
3237 +       spin_lock_init(&(info->lock));
3238 +
3239 +       skb_queue_head_init(&(info->txq));
3240 +
3241 +       info->rx_state = RECV_WAIT_PACKET_TYPE;
3242 +       info->rx_count = 0;
3243 +       info->rx_skb = NULL;
3244 +
3245 +       /* Load firmware */
3246 +
3247 +       if ((err = bt3c_firmware_load(info)) < 0)
3248 +               return err;
3249 +
3250 +       /* Timeout before it is safe to send the first HCI packet */
3251 +
3252 +       set_current_state(TASK_INTERRUPTIBLE);
3253 +       schedule_timeout(HZ);
3254 +
3255 +
3256 +       /* Initialize and register HCI device */
3257 +
3258 +       hdev = &(info->hdev);
3259 +
3260 +       hdev->type = HCI_PCCARD;
3261 +       hdev->driver_data = info;
3262 +
3263 +       hdev->open = bt3c_hci_open;
3264 +       hdev->close = bt3c_hci_close;
3265 +       hdev->flush = bt3c_hci_flush;
3266 +       hdev->send = bt3c_hci_send_frame;
3267 +       hdev->destruct = bt3c_hci_destruct;
3268 +       hdev->ioctl = bt3c_hci_ioctl;
3269 +
3270 +       if (hci_register_dev(hdev) < 0) {
3271 +               printk(KERN_WARNING "bt3c_cs: Can't register HCI device %s.\n", hdev->name);
3272 +               return -ENODEV;
3273 +       }
3274 +
3275 +       return 0;
3276 +}
3277 +
3278 +
3279 +int bt3c_close(bt3c_info_t *info)
3280 +{
3281 +       struct hci_dev *hdev = &(info->hdev);
3282 +
3283 +       bt3c_hci_close(hdev);
3284 +
3285 +       if (hci_unregister_dev(hdev) < 0)
3286 +               printk(KERN_WARNING "bt3c_cs: Can't unregister HCI device %s.\n", hdev->name);
3287 +
3288 +       return 0;
3289 +}
3290 +
3291 +
3292 +
3293 +/* ======================== Card services ======================== */
3294 +
3295 +
3296 +static void cs_error(client_handle_t handle, int func, int ret)
3297 +{
3298 +       error_info_t err = { func, ret };
3299 +
3300 +       CardServices(ReportError, handle, &err);
3301 +}
3302 +
3303 +
3304 +dev_link_t *bt3c_attach(void)
3305 +{
3306 +       bt3c_info_t *info;
3307 +       client_reg_t client_reg;
3308 +       dev_link_t *link;
3309 +       int i, ret;
3310 +
3311 +       /* Create new info device */
3312 +       info = kmalloc(sizeof(*info), GFP_KERNEL);
3313 +       if (!info)
3314 +               return NULL;
3315 +       memset(info, 0, sizeof(*info));
3316 +
3317 +       link = &info->link;
3318 +       link->priv = info;
3319 +
3320 +       link->release.function = &bt3c_release;
3321 +       link->release.data = (u_long)link;
3322 +       link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
3323 +       link->io.NumPorts1 = 8;
3324 +       link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
3325 +       link->irq.IRQInfo1 = IRQ_INFO2_VALID | IRQ_LEVEL_ID;
3326 +
3327 +       if (irq_list[0] == -1)
3328 +               link->irq.IRQInfo2 = irq_mask;
3329 +       else
3330 +               for (i = 0; i < 4; i++)
3331 +                       link->irq.IRQInfo2 |= 1 << irq_list[i];
3332 +
3333 +       link->irq.Handler = bt3c_interrupt;
3334 +       link->irq.Instance = info;
3335 +
3336 +       link->conf.Attributes = CONF_ENABLE_IRQ;
3337 +       link->conf.Vcc = 50;
3338 +       link->conf.IntType = INT_MEMORY_AND_IO;
3339 +
3340 +       /* Register with Card Services */
3341 +       link->next = dev_list;
3342 +       dev_list = link;
3343 +       client_reg.dev_info = &dev_info;
3344 +       client_reg.Attributes = INFO_IO_CLIENT | INFO_CARD_SHARE;
3345 +       client_reg.EventMask =
3346 +           CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
3347 +           CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
3348 +           CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
3349 +       client_reg.event_handler = &bt3c_event;
3350 +       client_reg.Version = 0x0210;
3351 +       client_reg.event_callback_args.client_data = link;
3352 +
3353 +       ret = CardServices(RegisterClient, &link->handle, &client_reg);
3354 +       if (ret != CS_SUCCESS) {
3355 +               cs_error(link->handle, RegisterClient, ret);
3356 +               bt3c_detach(link);
3357 +               return NULL;
3358 +       }
3359 +
3360 +       return link;
3361 +}
3362 +
3363 +
3364 +void bt3c_detach(dev_link_t *link)
3365 +{
3366 +       bt3c_info_t *info = link->priv;
3367 +       dev_link_t **linkp;
3368 +       int ret;
3369 +
3370 +       /* Locate device structure */
3371 +       for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
3372 +               if (*linkp == link)
3373 +                       break;
3374 +
3375 +       if (*linkp == NULL)
3376 +               return;
3377 +
3378 +       del_timer(&link->release);
3379 +
3380 +       if (link->state & DEV_CONFIG)
3381 +               bt3c_release((u_long)link);
3382 +
3383 +       if (link->handle) {
3384 +               ret = CardServices(DeregisterClient, link->handle);
3385 +               if (ret != CS_SUCCESS)
3386 +                       cs_error(link->handle, DeregisterClient, ret);
3387 +       }
3388 +
3389 +       /* Unlink device structure, free bits */
3390 +       *linkp = link->next;
3391 +
3392 +       kfree(info);
3393 +}
3394 +
3395 +
3396 +static int get_tuple(int fn, client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
3397 +{
3398 +       int i;
3399 +
3400 +       i = CardServices(fn, handle, tuple);
3401 +       if (i != CS_SUCCESS)
3402 +               return CS_NO_MORE_ITEMS;
3403 +
3404 +       i = CardServices(GetTupleData, handle, tuple);
3405 +       if (i != CS_SUCCESS)
3406 +               return i;
3407 +
3408 +       return CardServices(ParseTuple, handle, tuple, parse);
3409 +}
3410 +
3411 +
3412 +#define first_tuple(a, b, c) get_tuple(GetFirstTuple, a, b, c)
3413 +#define next_tuple(a, b, c) get_tuple(GetNextTuple, a, b, c)
3414 +
3415 +void bt3c_config(dev_link_t *link)
3416 +{
3417 +       static ioaddr_t base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 };
3418 +       client_handle_t handle = link->handle;
3419 +       bt3c_info_t *info = link->priv;
3420 +       tuple_t tuple;
3421 +       u_short buf[256];
3422 +       cisparse_t parse;
3423 +       cistpl_cftable_entry_t *cf = &parse.cftable_entry;
3424 +       config_info_t config;
3425 +       int i, j, try, last_ret, last_fn;
3426 +
3427 +       tuple.TupleData = (cisdata_t *)buf;
3428 +       tuple.TupleOffset = 0;
3429 +       tuple.TupleDataMax = 255;
3430 +       tuple.Attributes = 0;
3431 +
3432 +       /* Get configuration register information */
3433 +       tuple.DesiredTuple = CISTPL_CONFIG;
3434 +       last_ret = first_tuple(handle, &tuple, &parse);
3435 +       if (last_ret != CS_SUCCESS) {
3436 +               last_fn = ParseTuple;
3437 +               goto cs_failed;
3438 +       }
3439 +       link->conf.ConfigBase = parse.config.base;
3440 +       link->conf.Present = parse.config.rmask[0];
3441 +
3442 +       /* Configure card */
3443 +       link->state |= DEV_CONFIG;
3444 +       i = CardServices(GetConfigurationInfo, handle, &config);
3445 +       link->conf.Vcc = config.Vcc;
3446 +
3447 +       /* First pass: look for a config entry that looks normal. */
3448 +       tuple.TupleData = (cisdata_t *)buf;
3449 +       tuple.TupleOffset = 0;
3450 +       tuple.TupleDataMax = 255;
3451 +       tuple.Attributes = 0;
3452 +       tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
3453 +       /* Two tries: without IO aliases, then with aliases */
3454 +       for (try = 0; try < 2; try++) {
3455 +               i = first_tuple(handle, &tuple, &parse);
3456 +               while (i != CS_NO_MORE_ITEMS) {
3457 +                       if (i != CS_SUCCESS)
3458 +                               goto next_entry;
3459 +                       if (cf->vpp1.present & (1 << CISTPL_POWER_VNOM))
3460 +                               link->conf.Vpp1 = link->conf.Vpp2 = cf->vpp1.param[CISTPL_POWER_VNOM] / 10000;
3461 +                       if ((cf->io.nwin > 0) && (cf->io.win[0].len == 8) && (cf->io.win[0].base != 0)) {
3462 +                               link->conf.ConfigIndex = cf->index;
3463 +                               link->io.BasePort1 = cf->io.win[0].base;
3464 +                               link->io.IOAddrLines = (try == 0) ? 16 : cf->io.flags & CISTPL_IO_LINES_MASK;
3465 +                               i = CardServices(RequestIO, link->handle, &link->io);
3466 +                               if (i == CS_SUCCESS)
3467 +                                       goto found_port;
3468 +                       }
3469 +next_entry:
3470 +                       i = next_tuple(handle, &tuple, &parse);
3471 +               }
3472 +       }
3473 +
3474 +       /* Second pass: try to find an entry that isn't picky about
3475 +          its base address, then try to grab any standard serial port
3476 +          address, and finally try to get any free port. */
3477 +       i = first_tuple(handle, &tuple, &parse);
3478 +       while (i != CS_NO_MORE_ITEMS) {
3479 +               if ((i == CS_SUCCESS) && (cf->io.nwin > 0) && ((cf->io.flags & CISTPL_IO_LINES_MASK) <= 3)) {
3480 +                       link->conf.ConfigIndex = cf->index;
3481 +                       for (j = 0; j < 5; j++) {
3482 +                               link->io.BasePort1 = base[j];
3483 +                               link->io.IOAddrLines = base[j] ? 16 : 3;
3484 +                               i = CardServices(RequestIO, link->handle, &link->io);
3485 +                               if (i == CS_SUCCESS)
3486 +                                       goto found_port;
3487 +                       }
3488 +               }
3489 +               i = next_tuple(handle, &tuple, &parse);
3490 +       }
3491 +
3492 +found_port:
3493 +       if (i != CS_SUCCESS) {
3494 +               printk(KERN_NOTICE "bt3c_cs: No usable port range found. Giving up.\n");
3495 +               cs_error(link->handle, RequestIO, i);
3496 +               goto failed;
3497 +       }
3498 +
3499 +       i = CardServices(RequestIRQ, link->handle, &link->irq);
3500 +       if (i != CS_SUCCESS) {
3501 +               cs_error(link->handle, RequestIRQ, i);
3502 +               link->irq.AssignedIRQ = 0;
3503 +       }
3504 +
3505 +       i = CardServices(RequestConfiguration, link->handle, &link->conf);
3506 +       if (i != CS_SUCCESS) {
3507 +               cs_error(link->handle, RequestConfiguration, i);
3508 +               goto failed;
3509 +       }
3510 +
3511 +       MOD_INC_USE_COUNT;
3512 +
3513 +       if (bt3c_open(info) != 0)
3514 +               goto failed;
3515 +
3516 +       strcpy(info->node.dev_name, info->hdev.name);
3517 +       link->dev = &info->node;
3518 +       link->state &= ~DEV_CONFIG_PENDING;
3519 +
3520 +       return;
3521 +
3522 +cs_failed:
3523 +       cs_error(link->handle, last_fn, last_ret);
3524 +
3525 +failed:
3526 +       bt3c_release((u_long)link);
3527 +}
3528 +
3529 +
3530 +void bt3c_release(u_long arg)
3531 +{
3532 +       dev_link_t *link = (dev_link_t *)arg;
3533 +       bt3c_info_t *info = link->priv;
3534 +
3535 +       if (link->state & DEV_PRESENT)
3536 +               bt3c_close(info);
3537 +
3538 +       MOD_DEC_USE_COUNT;
3539 +
3540 +       link->dev = NULL;
3541 +
3542 +       CardServices(ReleaseConfiguration, link->handle);
3543 +       CardServices(ReleaseIO, link->handle, &link->io);
3544 +       CardServices(ReleaseIRQ, link->handle, &link->irq);
3545 +
3546 +       link->state &= ~DEV_CONFIG;
3547 +}
3548 +
3549 +
3550 +int bt3c_event(event_t event, int priority, event_callback_args_t *args)
3551 +{
3552 +       dev_link_t *link = args->client_data;
3553 +       bt3c_info_t *info = link->priv;
3554 +
3555 +       switch (event) {
3556 +       case CS_EVENT_CARD_REMOVAL:
3557 +               link->state &= ~DEV_PRESENT;
3558 +               if (link->state & DEV_CONFIG) {
3559 +                       bt3c_close(info);
3560 +                       mod_timer(&link->release, jiffies + HZ / 20);
3561 +               }
3562 +               break;
3563 +       case CS_EVENT_CARD_INSERTION:
3564 +               link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
3565 +               bt3c_config(link);
3566 +               break;
3567 +       case CS_EVENT_PM_SUSPEND:
3568 +               link->state |= DEV_SUSPEND;
3569 +               /* Fall through... */
3570 +       case CS_EVENT_RESET_PHYSICAL:
3571 +               if (link->state & DEV_CONFIG)
3572 +                       CardServices(ReleaseConfiguration, link->handle);
3573 +               break;
3574 +       case CS_EVENT_PM_RESUME:
3575 +               link->state &= ~DEV_SUSPEND;
3576 +               /* Fall through... */
3577 +       case CS_EVENT_CARD_RESET:
3578 +               if (DEV_OK(link))
3579 +                       CardServices(RequestConfiguration, link->handle, &link->conf);
3580 +               break;
3581 +       }
3582 +
3583 +       return 0;
3584 +}
3585 +
3586 +
3587 +
3588 +/* ======================== Module initialization ======================== */
3589 +
3590 +
3591 +int __init init_bt3c_cs(void)
3592 +{
3593 +       servinfo_t serv;
3594 +       int err;
3595 +
3596 +       CardServices(GetCardServicesInfo, &serv);
3597 +       if (serv.Revision != CS_RELEASE_CODE) {
3598 +               printk(KERN_NOTICE "bt3c_cs: Card Services release does not match!\n");
3599 +               return -1;
3600 +       }
3601 +
3602 +       err = register_pccard_driver(&dev_info, &bt3c_attach, &bt3c_detach);
3603 +
3604 +       return err;
3605 +}
3606 +
3607 +
3608 +void __exit exit_bt3c_cs(void)
3609 +{
3610 +       unregister_pccard_driver(&dev_info);
3611 +
3612 +       while (dev_list != NULL)
3613 +               bt3c_detach(dev_list);
3614 +}
3615 +
3616 +
3617 +module_init(init_bt3c_cs);
3618 +module_exit(exit_bt3c_cs);
3619 +
3620 +EXPORT_NO_SYMBOLS;
3621 diff -urN linux-2.4.18/drivers/bluetooth/btuart_cs.c linux-2.4.18-mh9/drivers/bluetooth/btuart_cs.c
3622 --- linux-2.4.18/drivers/bluetooth/btuart_cs.c  Thu Jan  1 01:00:00 1970
3623 +++ linux-2.4.18-mh9/drivers/bluetooth/btuart_cs.c      Mon Aug 25 18:38:10 2003
3624 @@ -0,0 +1,906 @@
3625 +/*
3626 + *
3627 + *  Driver for Bluetooth PCMCIA cards with HCI UART interface
3628 + *
3629 + *  Copyright (C) 2001-2002  Marcel Holtmann <marcel@holtmann.org>
3630 + *
3631 + *
3632 + *  This program is free software; you can redistribute it and/or modify
3633 + *  it under the terms of the GNU General Public License version 2 as
3634 + *  published by the Free Software Foundation;
3635 + *
3636 + *  Software distributed under the License is distributed on an "AS
3637 + *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
3638 + *  implied. See the License for the specific language governing
3639 + *  rights and limitations under the License.
3640 + *
3641 + *  The initial developer of the original code is David A. Hinds
3642 + *  <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
3643 + *  are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
3644 + *
3645 + */
3646 +
3647 +#include <linux/config.h>
3648 +#include <linux/module.h>
3649 +
3650 +#include <linux/kernel.h>
3651 +#include <linux/init.h>
3652 +#include <linux/slab.h>
3653 +#include <linux/types.h>
3654 +#include <linux/sched.h>
3655 +#include <linux/timer.h>
3656 +#include <linux/errno.h>
3657 +#include <linux/ptrace.h>
3658 +#include <linux/ioport.h>
3659 +#include <linux/spinlock.h>
3660 +
3661 +#include <linux/skbuff.h>
3662 +#include <linux/string.h>
3663 +#include <linux/serial.h>
3664 +#include <linux/serial_reg.h>
3665 +#include <asm/system.h>
3666 +#include <asm/bitops.h>
3667 +#include <asm/io.h>
3668 +
3669 +#include <pcmcia/version.h>
3670 +#include <pcmcia/cs_types.h>
3671 +#include <pcmcia/cs.h>
3672 +#include <pcmcia/cistpl.h>
3673 +#include <pcmcia/ciscode.h>
3674 +#include <pcmcia/ds.h>
3675 +#include <pcmcia/cisreg.h>
3676 +
3677 +#include <net/bluetooth/bluetooth.h>
3678 +#include <net/bluetooth/hci_core.h>
3679 +
3680 +
3681 +
3682 +/* ======================== Module parameters ======================== */
3683 +
3684 +
3685 +/* Bit map of interrupts to choose from */
3686 +static u_int irq_mask = 0xffff;
3687 +static int irq_list[4] = { -1 };
3688 +
3689 +MODULE_PARM(irq_mask, "i");
3690 +MODULE_PARM(irq_list, "1-4i");
3691 +
3692 +MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
3693 +MODULE_DESCRIPTION("BlueZ driver for Bluetooth PCMCIA cards with HCI UART interface");
3694 +MODULE_LICENSE("GPL");
3695 +
3696 +
3697 +
3698 +/* ======================== Local structures ======================== */
3699 +
3700 +
3701 +typedef struct btuart_info_t {
3702 +       dev_link_t link;
3703 +       dev_node_t node;
3704 +
3705 +       struct hci_dev hdev;
3706 +
3707 +       spinlock_t lock;        /* For serializing operations */
3708 +
3709 +       struct sk_buff_head txq;
3710 +       unsigned long tx_state;
3711 +
3712 +       unsigned long rx_state;
3713 +       unsigned long rx_count;
3714 +       struct sk_buff *rx_skb;
3715 +} btuart_info_t;
3716 +
3717 +
3718 +void btuart_config(dev_link_t *link);
3719 +void btuart_release(u_long arg);
3720 +int btuart_event(event_t event, int priority, event_callback_args_t *args);
3721 +
3722 +static dev_info_t dev_info = "btuart_cs";
3723 +
3724 +dev_link_t *btuart_attach(void);
3725 +void btuart_detach(dev_link_t *);
3726 +
3727 +static dev_link_t *dev_list = NULL;
3728 +
3729 +
3730 +/* Maximum baud rate */
3731 +#define SPEED_MAX  115200
3732 +
3733 +/* Default baud rate: 57600, 115200, 230400 or 460800 */
3734 +#define DEFAULT_BAUD_RATE  115200
3735 +
3736 +
3737 +/* Transmit states  */
3738 +#define XMIT_SENDING   1
3739 +#define XMIT_WAKEUP    2
3740 +#define XMIT_WAITING   8
3741 +
3742 +/* Receiver states */
3743 +#define RECV_WAIT_PACKET_TYPE  0
3744 +#define RECV_WAIT_EVENT_HEADER 1
3745 +#define RECV_WAIT_ACL_HEADER   2
3746 +#define RECV_WAIT_SCO_HEADER   3
3747 +#define RECV_WAIT_DATA         4
3748 +
3749 +
3750 +
3751 +/* ======================== Interrupt handling ======================== */
3752 +
3753 +
3754 +static int btuart_write(unsigned int iobase, int fifo_size, __u8 *buf, int len)
3755 +{
3756 +       int actual = 0;
3757 +
3758 +       /* Tx FIFO should be empty */
3759 +       if (!(inb(iobase + UART_LSR) & UART_LSR_THRE))
3760 +               return 0;
3761 +
3762 +       /* Fill FIFO with current frame */
3763 +       while ((fifo_size-- > 0) && (actual < len)) {
3764 +               /* Transmit next byte */
3765 +               outb(buf[actual], iobase + UART_TX);
3766 +               actual++;
3767 +       }
3768 +
3769 +       return actual;
3770 +}
3771 +
3772 +
3773 +static void btuart_write_wakeup(btuart_info_t *info)
3774 +{
3775 +       if (!info) {
3776 +               printk(KERN_WARNING "btuart_cs: Call of write_wakeup for unknown device.\n");
3777 +               return;
3778 +       }
3779 +
3780 +       if (test_and_set_bit(XMIT_SENDING, &(info->tx_state))) {
3781 +               set_bit(XMIT_WAKEUP, &(info->tx_state));
3782 +               return;
3783 +       }
3784 +
3785 +       do {
3786 +               register unsigned int iobase = info->link.io.BasePort1;
3787 +               register struct sk_buff *skb;
3788 +               register int len;
3789 +
3790 +               clear_bit(XMIT_WAKEUP, &(info->tx_state));
3791 +
3792 +               if (!(info->link.state & DEV_PRESENT))
3793 +                       return;
3794 +
3795 +               if (!(skb = skb_dequeue(&(info->txq))))
3796 +                       break;
3797 +
3798 +               /* Send frame */
3799 +               len = btuart_write(iobase, 16, skb->data, skb->len);
3800 +               set_bit(XMIT_WAKEUP, &(info->tx_state));
3801 +
3802 +               if (len == skb->len) {
3803 +                       kfree_skb(skb);
3804 +               } else {
3805 +                       skb_pull(skb, len);
3806 +                       skb_queue_head(&(info->txq), skb);
3807 +               }
3808 +
3809 +               info->hdev.stat.byte_tx += len;
3810 +
3811 +       } while (test_bit(XMIT_WAKEUP, &(info->tx_state)));
3812 +
3813 +       clear_bit(XMIT_SENDING, &(info->tx_state));
3814 +}
3815 +
3816 +
3817 +static void btuart_receive(btuart_info_t *info)
3818 +{
3819 +       unsigned int iobase;
3820 +       int boguscount = 0;
3821 +
3822 +       if (!info) {
3823 +               printk(KERN_WARNING "btuart_cs: Call of receive for unknown device.\n");
3824 +               return;
3825 +       }
3826 +
3827 +       iobase = info->link.io.BasePort1;
3828 +
3829 +       do {
3830 +               info->hdev.stat.byte_rx++;
3831 +
3832 +               /* Allocate packet */
3833 +               if (info->rx_skb == NULL) {
3834 +                       info->rx_state = RECV_WAIT_PACKET_TYPE;
3835 +                       info->rx_count = 0;
3836 +                       if (!(info->rx_skb = bluez_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
3837 +                               printk(KERN_WARNING "btuart_cs: Can't allocate mem for new packet.\n");
3838 +                               return;
3839 +                       }
3840 +               }
3841 +
3842 +               if (info->rx_state == RECV_WAIT_PACKET_TYPE) {
3843 +
3844 +                       info->rx_skb->dev = (void *)&(info->hdev);
3845 +                       info->rx_skb->pkt_type = inb(iobase + UART_RX);
3846 +
3847 +                       switch (info->rx_skb->pkt_type) {
3848 +
3849 +                       case HCI_EVENT_PKT:
3850 +                               info->rx_state = RECV_WAIT_EVENT_HEADER;
3851 +                               info->rx_count = HCI_EVENT_HDR_SIZE;
3852 +                               break;
3853 +
3854 +                       case HCI_ACLDATA_PKT:
3855 +                               info->rx_state = RECV_WAIT_ACL_HEADER;
3856 +                               info->rx_count = HCI_ACL_HDR_SIZE;
3857 +                               break;
3858 +
3859 +                       case HCI_SCODATA_PKT:
3860 +                               info->rx_state = RECV_WAIT_SCO_HEADER;
3861 +                               info->rx_count = HCI_SCO_HDR_SIZE;
3862 +                               break;
3863 +
3864 +                       default:
3865 +                               /* Unknown packet */
3866 +                               printk(KERN_WARNING "btuart_cs: Unknown HCI packet with type 0x%02x received.\n", info->rx_skb->pkt_type);
3867 +                               info->hdev.stat.err_rx++;
3868 +                               clear_bit(HCI_RUNNING, &(info->hdev.flags));
3869 +
3870 +                               kfree_skb(info->rx_skb);
3871 +                               info->rx_skb = NULL;
3872 +                               break;
3873 +
3874 +                       }
3875 +
3876 +               } else {
3877 +
3878 +                       *skb_put(info->rx_skb, 1) = inb(iobase + UART_RX);
3879 +                       info->rx_count--;
3880 +
3881 +                       if (info->rx_count == 0) {
3882 +
3883 +                               int dlen;
3884 +                               hci_event_hdr *eh;
3885 +                               hci_acl_hdr *ah;
3886 +                               hci_sco_hdr *sh;
3887 +
3888 +
3889 +                               switch (info->rx_state) {
3890 +
3891 +                               case RECV_WAIT_EVENT_HEADER:
3892 +                                       eh = (hci_event_hdr *)(info->rx_skb->data);
3893 +                                       info->rx_state = RECV_WAIT_DATA;
3894 +                                       info->rx_count = eh->plen;
3895 +                                       break;
3896 +
3897 +                               case RECV_WAIT_ACL_HEADER:
3898 +                                       ah = (hci_acl_hdr *)(info->rx_skb->data);
3899 +                                       dlen = __le16_to_cpu(ah->dlen);
3900 +                                       info->rx_state = RECV_WAIT_DATA;
3901 +                                       info->rx_count = dlen;
3902 +                                       break;
3903 +
3904 +                               case RECV_WAIT_SCO_HEADER:
3905 +                                       sh = (hci_sco_hdr *)(info->rx_skb->data);
3906 +                                       info->rx_state = RECV_WAIT_DATA;
3907 +                                       info->rx_count = sh->dlen;
3908 +                                       break;
3909 +
3910 +                               case RECV_WAIT_DATA:
3911 +                                       hci_recv_frame(info->rx_skb);
3912 +                                       info->rx_skb = NULL;
3913 +                                       break;
3914 +
3915 +                               }
3916 +
3917 +                       }
3918 +
3919 +               }
3920 +
3921 +               /* Make sure we don't stay here to long */
3922 +               if (boguscount++ > 16)
3923 +                       break;
3924 +
3925 +       } while (inb(iobase + UART_LSR) & UART_LSR_DR);
3926 +}
3927 +
3928 +
3929 +void btuart_interrupt(int irq, void *dev_inst, struct pt_regs *regs)
3930 +{
3931 +       btuart_info_t *info = dev_inst;
3932 +       unsigned int iobase;
3933 +       int boguscount = 0;
3934 +       int iir, lsr;
3935 +
3936 +       if (!info) {
3937 +               printk(KERN_WARNING "btuart_cs: Call of irq %d for unknown device.\n", irq);
3938 +               return;
3939 +       }
3940 +
3941 +       iobase = info->link.io.BasePort1;
3942 +
3943 +       spin_lock(&(info->lock));
3944 +
3945 +       iir = inb(iobase + UART_IIR) & UART_IIR_ID;
3946 +       while (iir) {
3947 +
3948 +               /* Clear interrupt */
3949 +               lsr = inb(iobase + UART_LSR);
3950 +
3951 +               switch (iir) {
3952 +               case UART_IIR_RLSI:
3953 +                       printk(KERN_NOTICE "btuart_cs: RLSI\n");
3954 +                       break;
3955 +               case UART_IIR_RDI:
3956 +                       /* Receive interrupt */
3957 +                       btuart_receive(info);
3958 +                       break;
3959 +               case UART_IIR_THRI:
3960 +                       if (lsr & UART_LSR_THRE) {
3961 +                               /* Transmitter ready for data */
3962 +                               btuart_write_wakeup(info);
3963 +                       }
3964 +                       break;
3965 +               default:
3966 +                       printk(KERN_NOTICE "btuart_cs: Unhandled IIR=%#x\n", iir);
3967 +                       break;
3968 +               }
3969 +
3970 +               /* Make sure we don't stay here to long */
3971 +               if (boguscount++ > 100)
3972 +                       break;
3973 +
3974 +               iir = inb(iobase + UART_IIR) & UART_IIR_ID;
3975 +
3976 +       }
3977 +
3978 +       spin_unlock(&(info->lock));
3979 +}
3980 +
3981 +
3982 +static void btuart_change_speed(btuart_info_t *info, unsigned int speed)
3983 +{
3984 +       unsigned long flags;
3985 +       unsigned int iobase;
3986 +       int fcr;                /* FIFO control reg */
3987 +       int lcr;                /* Line control reg */
3988 +       int divisor;
3989 +
3990 +       if (!info) {
3991 +               printk(KERN_WARNING "btuart_cs: Call of change speed for unknown device.\n");
3992 +               return;
3993 +       }
3994 +
3995 +       iobase = info->link.io.BasePort1;
3996 +
3997 +       spin_lock_irqsave(&(info->lock), flags);
3998 +
3999 +       /* Turn off interrupts */
4000 +       outb(0, iobase + UART_IER);
4001 +
4002 +       divisor = SPEED_MAX / speed;
4003 +
4004 +       fcr = UART_FCR_ENABLE_FIFO | UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT;
4005 +
4006 +       /*
4007 +        * Use trigger level 1 to avoid 3 ms. timeout delay at 9600 bps, and
4008 +        * almost 1,7 ms at 19200 bps. At speeds above that we can just forget
4009 +        * about this timeout since it will always be fast enough.
4010 +        */
4011 +
4012 +       if (speed < 38400)
4013 +               fcr |= UART_FCR_TRIGGER_1;
4014 +       else
4015 +               fcr |= UART_FCR_TRIGGER_14;
4016 +
4017 +       /* Bluetooth cards use 8N1 */
4018 +       lcr = UART_LCR_WLEN8;
4019 +
4020 +       outb(UART_LCR_DLAB | lcr, iobase + UART_LCR);   /* Set DLAB */
4021 +       outb(divisor & 0xff, iobase + UART_DLL);        /* Set speed */
4022 +       outb(divisor >> 8, iobase + UART_DLM);
4023 +       outb(lcr, iobase + UART_LCR);   /* Set 8N1  */
4024 +       outb(fcr, iobase + UART_FCR);   /* Enable FIFO's */
4025 +
4026 +       /* Turn on interrups */
4027 +       outb(UART_IER_RLSI | UART_IER_RDI | UART_IER_THRI, iobase + UART_IER);
4028 +
4029 +       spin_unlock_irqrestore(&(info->lock), flags);
4030 +}
4031 +
4032 +
4033 +
4034 +/* ======================== HCI interface ======================== */
4035 +
4036 +
4037 +static int btuart_hci_flush(struct hci_dev *hdev)
4038 +{
4039 +       btuart_info_t *info = (btuart_info_t *)(hdev->driver_data);
4040 +
4041 +       /* Drop TX queue */
4042 +       skb_queue_purge(&(info->txq));
4043 +
4044 +       return 0;
4045 +}
4046 +
4047 +
4048 +static int btuart_hci_open(struct hci_dev *hdev)
4049 +{
4050 +       set_bit(HCI_RUNNING, &(hdev->flags));
4051 +
4052 +       return 0;
4053 +}
4054 +
4055 +
4056 +static int btuart_hci_close(struct hci_dev *hdev)
4057 +{
4058 +       if (!test_and_clear_bit(HCI_RUNNING, &(hdev->flags)))
4059 +               return 0;
4060 +
4061 +       btuart_hci_flush(hdev);
4062 +
4063 +       return 0;
4064 +}
4065 +
4066 +
4067 +static int btuart_hci_send_frame(struct sk_buff *skb)
4068 +{
4069 +       btuart_info_t *info;
4070 +       struct hci_dev *hdev = (struct hci_dev *)(skb->dev);
4071 +
4072 +       if (!hdev) {
4073 +               printk(KERN_WARNING "btuart_cs: Frame for unknown HCI device (hdev=NULL).");
4074 +               return -ENODEV;
4075 +       }
4076 +
4077 +       info = (btuart_info_t *)(hdev->driver_data);
4078 +
4079 +       switch (skb->pkt_type) {
4080 +       case HCI_COMMAND_PKT:
4081 +               hdev->stat.cmd_tx++;
4082 +               break;
4083 +       case HCI_ACLDATA_PKT:
4084 +               hdev->stat.acl_tx++;
4085 +               break;
4086 +       case HCI_SCODATA_PKT:
4087 +               hdev->stat.sco_tx++;
4088 +               break;
4089 +       };
4090 +
4091 +       /* Prepend skb with frame type */
4092 +       memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
4093 +       skb_queue_tail(&(info->txq), skb);
4094 +
4095 +       btuart_write_wakeup(info);
4096 +
4097 +       return 0;
4098 +}
4099 +
4100 +
4101 +static void btuart_hci_destruct(struct hci_dev *hdev)
4102 +{
4103 +}
4104 +
4105 +
4106 +static int btuart_hci_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
4107 +{
4108 +       return -ENOIOCTLCMD;
4109 +}
4110 +
4111 +
4112 +
4113 +/* ======================== Card services HCI interaction ======================== */
4114 +
4115 +
4116 +int btuart_open(btuart_info_t *info)
4117 +{
4118 +       unsigned long flags;
4119 +       unsigned int iobase = info->link.io.BasePort1;
4120 +       struct hci_dev *hdev;
4121 +
4122 +       spin_lock_init(&(info->lock));
4123 +
4124 +       skb_queue_head_init(&(info->txq));
4125 +
4126 +       info->rx_state = RECV_WAIT_PACKET_TYPE;
4127 +       info->rx_count = 0;
4128 +       info->rx_skb = NULL;
4129 +
4130 +       spin_lock_irqsave(&(info->lock), flags);
4131 +
4132 +       /* Reset UART */
4133 +       outb(0, iobase + UART_MCR);
4134 +
4135 +       /* Turn off interrupts */
4136 +       outb(0, iobase + UART_IER);
4137 +
4138 +       /* Initialize UART */
4139 +       outb(UART_LCR_WLEN8, iobase + UART_LCR);        /* Reset DLAB */
4140 +       outb((UART_MCR_DTR | UART_MCR_RTS | UART_MCR_OUT2), iobase + UART_MCR);
4141 +
4142 +       /* Turn on interrupts */
4143 +       // outb(UART_IER_RLSI | UART_IER_RDI | UART_IER_THRI, iobase + UART_IER);
4144 +
4145 +       spin_unlock_irqrestore(&(info->lock), flags);
4146 +
4147 +       btuart_change_speed(info, DEFAULT_BAUD_RATE);
4148 +
4149 +       /* Timeout before it is safe to send the first HCI packet */
4150 +       set_current_state(TASK_INTERRUPTIBLE);
4151 +       schedule_timeout(HZ);
4152 +
4153 +
4154 +       /* Initialize and register HCI device */
4155 +
4156 +       hdev = &(info->hdev);
4157 +
4158 +       hdev->type = HCI_PCCARD;
4159 +       hdev->driver_data = info;
4160 +
4161 +       hdev->open = btuart_hci_open;
4162 +       hdev->close = btuart_hci_close;
4163 +       hdev->flush = btuart_hci_flush;
4164 +       hdev->send = btuart_hci_send_frame;
4165 +       hdev->destruct = btuart_hci_destruct;
4166 +       hdev->ioctl = btuart_hci_ioctl;
4167 +
4168 +       if (hci_register_dev(hdev) < 0) {
4169 +               printk(KERN_WARNING "btuart_cs: Can't register HCI device %s.\n", hdev->name);
4170 +               return -ENODEV;
4171 +       }
4172 +
4173 +       return 0;
4174 +}
4175 +
4176 +
4177 +int btuart_close(btuart_info_t *info)
4178 +{
4179 +       unsigned long flags;
4180 +       unsigned int iobase = info->link.io.BasePort1;
4181 +       struct hci_dev *hdev = &(info->hdev);
4182 +
4183 +       btuart_hci_close(hdev);
4184 +
4185 +       spin_lock_irqsave(&(info->lock), flags);
4186 +
4187 +       /* Reset UART */
4188 +       outb(0, iobase + UART_MCR);
4189 +
4190 +       /* Turn off interrupts */
4191 +       outb(0, iobase + UART_IER);
4192 +
4193 +       spin_unlock_irqrestore(&(info->lock), flags);
4194 +
4195 +       if (hci_unregister_dev(hdev) < 0)
4196 +               printk(KERN_WARNING "btuart_cs: Can't unregister HCI device %s.\n", hdev->name);
4197 +
4198 +       return 0;
4199 +}
4200 +
4201 +
4202 +
4203 +/* ======================== Card services ======================== */
4204 +
4205 +
4206 +static void cs_error(client_handle_t handle, int func, int ret)
4207 +{
4208 +       error_info_t err = { func, ret };
4209 +
4210 +       CardServices(ReportError, handle, &err);
4211 +}
4212 +
4213 +
4214 +dev_link_t *btuart_attach(void)
4215 +{
4216 +       btuart_info_t *info;
4217 +       client_reg_t client_reg;
4218 +       dev_link_t *link;
4219 +       int i, ret;
4220 +
4221 +       /* Create new info device */
4222 +       info = kmalloc(sizeof(*info), GFP_KERNEL);
4223 +       if (!info)
4224 +               return NULL;
4225 +       memset(info, 0, sizeof(*info));
4226 +
4227 +       link = &info->link;
4228 +       link->priv = info;
4229 +
4230 +       link->release.function = &btuart_release;
4231 +       link->release.data = (u_long)link;
4232 +       link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
4233 +       link->io.NumPorts1 = 8;
4234 +       link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
4235 +       link->irq.IRQInfo1 = IRQ_INFO2_VALID | IRQ_LEVEL_ID;
4236 +
4237 +       if (irq_list[0] == -1)
4238 +               link->irq.IRQInfo2 = irq_mask;
4239 +       else
4240 +               for (i = 0; i < 4; i++)
4241 +                       link->irq.IRQInfo2 |= 1 << irq_list[i];
4242 +
4243 +       link->irq.Handler = btuart_interrupt;
4244 +       link->irq.Instance = info;
4245 +
4246 +       link->conf.Attributes = CONF_ENABLE_IRQ;
4247 +       link->conf.Vcc = 50;
4248 +       link->conf.IntType = INT_MEMORY_AND_IO;
4249 +
4250 +       /* Register with Card Services */
4251 +       link->next = dev_list;
4252 +       dev_list = link;
4253 +       client_reg.dev_info = &dev_info;
4254 +       client_reg.Attributes = INFO_IO_CLIENT | INFO_CARD_SHARE;
4255 +       client_reg.EventMask =
4256 +               CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
4257 +               CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
4258 +               CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
4259 +       client_reg.event_handler = &btuart_event;
4260 +       client_reg.Version = 0x0210;
4261 +       client_reg.event_callback_args.client_data = link;
4262 +
4263 +       ret = CardServices(RegisterClient, &link->handle, &client_reg);
4264 +       if (ret != CS_SUCCESS) {
4265 +               cs_error(link->handle, RegisterClient, ret);
4266 +               btuart_detach(link);
4267 +               return NULL;
4268 +       }
4269 +
4270 +       return link;
4271 +}
4272 +
4273 +
4274 +void btuart_detach(dev_link_t *link)
4275 +{
4276 +       btuart_info_t *info = link->priv;
4277 +       dev_link_t **linkp;
4278 +       int ret;
4279 +
4280 +       /* Locate device structure */
4281 +       for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
4282 +               if (*linkp == link)
4283 +                       break;
4284 +
4285 +       if (*linkp == NULL)
4286 +               return;
4287 +
4288 +       del_timer(&link->release);
4289 +       if (link->state & DEV_CONFIG)
4290 +               btuart_release((u_long)link);
4291 +
4292 +       if (link->handle) {
4293 +               ret = CardServices(DeregisterClient, link->handle);
4294 +               if (ret != CS_SUCCESS)
4295 +                       cs_error(link->handle, DeregisterClient, ret);
4296 +       }
4297 +
4298 +       /* Unlink device structure, free bits */
4299 +       *linkp = link->next;
4300 +
4301 +       kfree(info);
4302 +}
4303 +
4304 +
4305 +static int get_tuple(int fn, client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
4306 +{
4307 +       int i;
4308 +
4309 +       i = CardServices(fn, handle, tuple);
4310 +       if (i != CS_SUCCESS)
4311 +               return CS_NO_MORE_ITEMS;
4312 +
4313 +       i = CardServices(GetTupleData, handle, tuple);
4314 +       if (i != CS_SUCCESS)
4315 +               return i;
4316 +
4317 +       return CardServices(ParseTuple, handle, tuple, parse);
4318 +}
4319 +
4320 +
4321 +#define first_tuple(a, b, c) get_tuple(GetFirstTuple, a, b, c)
4322 +#define next_tuple(a, b, c) get_tuple(GetNextTuple, a, b, c)
4323 +
4324 +void btuart_config(dev_link_t *link)
4325 +{
4326 +       static ioaddr_t base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 };
4327 +       client_handle_t handle = link->handle;
4328 +       btuart_info_t *info = link->priv;
4329 +       tuple_t tuple;
4330 +       u_short buf[256];
4331 +       cisparse_t parse;
4332 +       cistpl_cftable_entry_t *cf = &parse.cftable_entry;
4333 +       config_info_t config;
4334 +       int i, j, try, last_ret, last_fn;
4335 +
4336 +       tuple.TupleData = (cisdata_t *)buf;
4337 +       tuple.TupleOffset = 0;
4338 +       tuple.TupleDataMax = 255;
4339 +       tuple.Attributes = 0;
4340 +
4341 +       /* Get configuration register information */
4342 +       tuple.DesiredTuple = CISTPL_CONFIG;
4343 +       last_ret = first_tuple(handle, &tuple, &parse);
4344 +       if (last_ret != CS_SUCCESS) {
4345 +               last_fn = ParseTuple;
4346 +               goto cs_failed;
4347 +       }
4348 +       link->conf.ConfigBase = parse.config.base;
4349 +       link->conf.Present = parse.config.rmask[0];
4350 +
4351 +       /* Configure card */
4352 +       link->state |= DEV_CONFIG;
4353 +       i = CardServices(GetConfigurationInfo, handle, &config);
4354 +       link->conf.Vcc = config.Vcc;
4355 +
4356 +       /* First pass: look for a config entry that looks normal. */
4357 +       tuple.TupleData = (cisdata_t *) buf;
4358 +       tuple.TupleOffset = 0;
4359 +       tuple.TupleDataMax = 255;
4360 +       tuple.Attributes = 0;
4361 +       tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
4362 +       /* Two tries: without IO aliases, then with aliases */
4363 +       for (try = 0; try < 2; try++) {
4364 +               i = first_tuple(handle, &tuple, &parse);
4365 +               while (i != CS_NO_MORE_ITEMS) {
4366 +                       if (i != CS_SUCCESS)
4367 +                               goto next_entry;
4368 +                       if (cf->vpp1.present & (1 << CISTPL_POWER_VNOM))
4369 +                               link->conf.Vpp1 = link->conf.Vpp2 = cf->vpp1.param[CISTPL_POWER_VNOM] / 10000;
4370 +                       if ((cf->io.nwin > 0) && (cf->io.win[0].len == 8) && (cf->io.win[0].base != 0)) {
4371 +                               link->conf.ConfigIndex = cf->index;
4372 +                               link->io.BasePort1 = cf->io.win[0].base;
4373 +                               link->io.IOAddrLines = (try == 0) ? 16 : cf->io.flags & CISTPL_IO_LINES_MASK;
4374 +                               i = CardServices(RequestIO, link->handle, &link->io);
4375 +                               if (i == CS_SUCCESS)
4376 +                                       goto found_port;
4377 +                       }
4378 +next_entry:
4379 +                       i = next_tuple(handle, &tuple, &parse);
4380 +               }
4381 +       }
4382 +
4383 +       /* Second pass: try to find an entry that isn't picky about
4384 +          its base address, then try to grab any standard serial port
4385 +          address, and finally try to get any free port. */
4386 +       i = first_tuple(handle, &tuple, &parse);
4387 +       while (i != CS_NO_MORE_ITEMS) {
4388 +               if ((i == CS_SUCCESS) && (cf->io.nwin > 0)
4389 +                   && ((cf->io.flags & CISTPL_IO_LINES_MASK) <= 3)) {
4390 +                       link->conf.ConfigIndex = cf->index;
4391 +                       for (j = 0; j < 5; j++) {
4392 +                               link->io.BasePort1 = base[j];
4393 +                               link->io.IOAddrLines = base[j] ? 16 : 3;
4394 +                               i = CardServices(RequestIO, link->handle, &link->io);
4395 +                               if (i == CS_SUCCESS)
4396 +                                       goto found_port;
4397 +                       }
4398 +               }
4399 +               i = next_tuple(handle, &tuple, &parse);
4400 +       }
4401 +
4402 +found_port:
4403 +       if (i != CS_SUCCESS) {
4404 +               printk(KERN_NOTICE "btuart_cs: No usable port range found. Giving up.\n");
4405 +               cs_error(link->handle, RequestIO, i);
4406 +               goto failed;
4407 +       }
4408 +
4409 +       i = CardServices(RequestIRQ, link->handle, &link->irq);
4410 +       if (i != CS_SUCCESS) {
4411 +               cs_error(link->handle, RequestIRQ, i);
4412 +               link->irq.AssignedIRQ = 0;
4413 +       }
4414 +
4415 +       i = CardServices(RequestConfiguration, link->handle, &link->conf);
4416 +       if (i != CS_SUCCESS) {
4417 +               cs_error(link->handle, RequestConfiguration, i);
4418 +               goto failed;
4419 +       }
4420 +
4421 +       MOD_INC_USE_COUNT;
4422 +
4423 +       if (btuart_open(info) != 0)
4424 +               goto failed;
4425 +
4426 +       strcpy(info->node.dev_name, info->hdev.name);
4427 +       link->dev = &info->node;
4428 +       link->state &= ~DEV_CONFIG_PENDING;
4429 +
4430 +       return;
4431 +
4432 +cs_failed:
4433 +       cs_error(link->handle, last_fn, last_ret);
4434 +
4435 +failed:
4436 +       btuart_release((u_long) link);
4437 +}
4438 +
4439 +
4440 +void btuart_release(u_long arg)
4441 +{
4442 +       dev_link_t *link = (dev_link_t *)arg;
4443 +       btuart_info_t *info = link->priv;
4444 +
4445 +       if (link->state & DEV_PRESENT)
4446 +               btuart_close(info);
4447 +
4448 +       MOD_DEC_USE_COUNT;
4449 +
4450 +       link->dev = NULL;
4451 +
4452 +       CardServices(ReleaseConfiguration, link->handle);
4453 +       CardServices(ReleaseIO, link->handle, &link->io);
4454 +       CardServices(ReleaseIRQ, link->handle, &link->irq);
4455 +
4456 +       link->state &= ~DEV_CONFIG;
4457 +}
4458 +
4459 +
4460 +int btuart_event(event_t event, int priority, event_callback_args_t *args)
4461 +{
4462 +       dev_link_t *link = args->client_data;
4463 +       btuart_info_t *info = link->priv;
4464 +
4465 +       switch (event) {
4466 +       case CS_EVENT_CARD_REMOVAL:
4467 +               link->state &= ~DEV_PRESENT;
4468 +               if (link->state & DEV_CONFIG) {
4469 +                       btuart_close(info);
4470 +                       mod_timer(&link->release, jiffies + HZ / 20);
4471 +               }
4472 +               break;
4473 +       case CS_EVENT_CARD_INSERTION:
4474 +               link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
4475 +               btuart_config(link);
4476 +               break;
4477 +       case CS_EVENT_PM_SUSPEND:
4478 +               link->state |= DEV_SUSPEND;
4479 +               /* Fall through... */
4480 +       case CS_EVENT_RESET_PHYSICAL:
4481 +               if (link->state & DEV_CONFIG)
4482 +                       CardServices(ReleaseConfiguration, link->handle);
4483 +               break;
4484 +       case CS_EVENT_PM_RESUME:
4485 +               link->state &= ~DEV_SUSPEND;
4486 +               /* Fall through... */
4487 +       case CS_EVENT_CARD_RESET:
4488 +               if (DEV_OK(link))
4489 +                       CardServices(RequestConfiguration, link->handle, &link->conf);
4490 +               break;
4491 +       }
4492 +
4493 +       return 0;
4494 +}
4495 +
4496 +
4497 +
4498 +/* ======================== Module initialization ======================== */
4499 +
4500 +
4501 +int __init init_btuart_cs(void)
4502 +{
4503 +       servinfo_t serv;
4504 +       int err;
4505 +
4506 +       CardServices(GetCardServicesInfo, &serv);
4507 +       if (serv.Revision != CS_RELEASE_CODE) {
4508 +               printk(KERN_NOTICE "btuart_cs: Card Services release does not match!\n");
4509 +               return -1;
4510 +       }
4511 +
4512 +       err = register_pccard_driver(&dev_info, &btuart_attach, &btuart_detach);
4513 +
4514 +       return err;
4515 +}
4516 +
4517 +
4518 +void __exit exit_btuart_cs(void)
4519 +{
4520 +       unregister_pccard_driver(&dev_info);
4521 +
4522 +       while (dev_list != NULL)
4523 +               btuart_detach(dev_list);
4524 +}
4525 +
4526 +
4527 +module_init(init_btuart_cs);
4528 +module_exit(exit_btuart_cs);
4529 +
4530 +EXPORT_NO_SYMBOLS;
4531 diff -urN linux-2.4.18/drivers/bluetooth/dtl1_cs.c linux-2.4.18-mh9/drivers/bluetooth/dtl1_cs.c
4532 --- linux-2.4.18/drivers/bluetooth/dtl1_cs.c    Thu Jan  1 01:00:00 1970
4533 +++ linux-2.4.18-mh9/drivers/bluetooth/dtl1_cs.c        Mon Aug 25 18:38:10 2003
4534 @@ -0,0 +1,858 @@
4535 +/*
4536 + *
4537 + *  A driver for Nokia Connectivity Card DTL-1 devices
4538 + *
4539 + *  Copyright (C) 2001-2002  Marcel Holtmann <marcel@holtmann.org>
4540 + *
4541 + *
4542 + *  This program is free software; you can redistribute it and/or modify
4543 + *  it under the terms of the GNU General Public License version 2 as
4544 + *  published by the Free Software Foundation;
4545 + *
4546 + *  Software distributed under the License is distributed on an "AS
4547 + *  IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
4548 + *  implied. See the License for the specific language governing
4549 + *  rights and limitations under the License.
4550 + *
4551 + *  The initial developer of the original code is David A. Hinds
4552 + *  <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
4553 + *  are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
4554 + *
4555 + */
4556 +
4557 +#include <linux/config.h>
4558 +#include <linux/module.h>
4559 +
4560 +#include <linux/kernel.h>
4561 +#include <linux/init.h>
4562 +#include <linux/slab.h>
4563 +#include <linux/types.h>
4564 +#include <linux/sched.h>
4565 +#include <linux/timer.h>
4566 +#include <linux/errno.h>
4567 +#include <linux/ptrace.h>
4568 +#include <linux/ioport.h>
4569 +#include <linux/spinlock.h>
4570 +
4571 +#include <linux/skbuff.h>
4572 +#include <linux/string.h>
4573 +#include <linux/serial.h>
4574 +#include <linux/serial_reg.h>
4575 +#include <asm/system.h>
4576 +#include <asm/bitops.h>
4577 +#include <asm/io.h>
4578 +
4579 +#include <pcmcia/version.h>
4580 +#include <pcmcia/cs_types.h>
4581 +#include <pcmcia/cs.h>
4582 +#include <pcmcia/cistpl.h>
4583 +#include <pcmcia/ciscode.h>
4584 +#include <pcmcia/ds.h>
4585 +#include <pcmcia/cisreg.h>
4586 +
4587 +#include <net/bluetooth/bluetooth.h>
4588 +#include <net/bluetooth/hci_core.h>
4589 +
4590 +
4591 +
4592 +/* ======================== Module parameters ======================== */
4593 +
4594 +
4595 +/* Bit map of interrupts to choose from */
4596 +static u_int irq_mask = 0xffff;
4597 +static int irq_list[4] = { -1 };
4598 +
4599 +MODULE_PARM(irq_mask, "i");
4600 +MODULE_PARM(irq_list, "1-4i");
4601 +
4602 +MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
4603 +MODULE_DESCRIPTION("BlueZ driver for Nokia Connectivity Card DTL-1");
4604 +MODULE_LICENSE("GPL");
4605 +
4606 +
4607 +
4608 +/* ======================== Local structures ======================== */
4609 +
4610 +
4611 +typedef struct dtl1_info_t {
4612 +       dev_link_t link;
4613 +       dev_node_t node;
4614 +
4615 +       struct hci_dev hdev;
4616 +
4617 +       spinlock_t lock;                /* For serializing operations */
4618 +
4619 +       unsigned long flowmask;         /* HCI flow mask */
4620 +       int ri_latch;
4621 +
4622 +       struct sk_buff_head txq;
4623 +       unsigned long tx_state;
4624 +
4625 +       unsigned long rx_state;
4626 +       unsigned long rx_count;
4627 +       struct sk_buff *rx_skb;
4628 +} dtl1_info_t;
4629 +
4630 +
4631 +void dtl1_config(dev_link_t *link);
4632 +void dtl1_release(u_long arg);
4633 +int dtl1_event(event_t event, int priority, event_callback_args_t *args);
4634 +
4635 +static dev_info_t dev_info = "dtl1_cs";
4636 +
4637 +dev_link_t *dtl1_attach(void);
4638 +void dtl1_detach(dev_link_t *);
4639 +
4640 +static dev_link_t *dev_list = NULL;
4641 +
4642 +
4643 +/* Transmit states  */
4644 +#define XMIT_SENDING  1
4645 +#define XMIT_WAKEUP   2
4646 +#define XMIT_WAITING  8
4647 +
4648 +/* Receiver States */
4649 +#define RECV_WAIT_NSH   0
4650 +#define RECV_WAIT_DATA  1
4651 +
4652 +
4653 +typedef struct {
4654 +       u8 type;
4655 +       u8 zero;
4656 +       u16 len;
4657 +} __attribute__ ((packed)) nsh_t;      /* Nokia Specific Header */
4658 +
4659 +#define NSHL  4                                /* Nokia Specific Header Length */
4660 +
4661 +
4662 +
4663 +/* ======================== Interrupt handling ======================== */
4664 +
4665 +
4666 +static int dtl1_write(unsigned int iobase, int fifo_size, __u8 *buf, int len)
4667 +{
4668 +       int actual = 0;
4669 +
4670 +       /* Tx FIFO should be empty */
4671 +       if (!(inb(iobase + UART_LSR) & UART_LSR_THRE))
4672 +               return 0;
4673 +
4674 +       /* Fill FIFO with current frame */
4675 +       while ((fifo_size-- > 0) && (actual < len)) {
4676 +               /* Transmit next byte */
4677 +               outb(buf[actual], iobase + UART_TX);
4678 +               actual++;
4679 +       }
4680 +
4681 +       return actual;
4682 +}
4683 +
4684 +
4685 +static void dtl1_write_wakeup(dtl1_info_t *info)
4686 +{
4687 +       if (!info) {
4688 +               printk(KERN_WARNING "dtl1_cs: Call of write_wakeup for unknown device.\n");
4689 +               return;
4690 +       }
4691 +
4692 +       if (test_bit(XMIT_WAITING, &(info->tx_state))) {
4693 +               set_bit(XMIT_WAKEUP, &(info->tx_state));
4694 +               return;
4695 +       }
4696 +
4697 +       if (test_and_set_bit(XMIT_SENDING, &(info->tx_state))) {
4698 +               set_bit(XMIT_WAKEUP, &(info->tx_state));
4699 +               return;
4700 +       }
4701 +
4702 +       do {
4703 +               register unsigned int iobase = info->link.io.BasePort1;
4704 +               register struct sk_buff *skb;
4705 +               register int len;
4706 +
4707 +               clear_bit(XMIT_WAKEUP, &(info->tx_state));
4708 +
4709 +               if (!(info->link.state & DEV_PRESENT))
4710 +                       return;
4711 +
4712 +               if (!(skb = skb_dequeue(&(info->txq))))
4713 +                       break;
4714 +
4715 +               /* Send frame */
4716 +               len = dtl1_write(iobase, 32, skb->data, skb->len);
4717 +
4718 +               if (len == skb->len) {
4719 +                       set_bit(XMIT_WAITING, &(info->tx_state));
4720 +                       kfree_skb(skb);
4721 +               } else {
4722 +                       skb_pull(skb, len);
4723 +                       skb_queue_head(&(info->txq), skb);
4724 +               }
4725 +
4726 +               info->hdev.stat.byte_tx += len;
4727 +
4728 +       } while (test_bit(XMIT_WAKEUP, &(info->tx_state)));
4729 +
4730 +       clear_bit(XMIT_SENDING, &(info->tx_state));
4731 +}
4732 +
4733 +
4734 +static void dtl1_control(dtl1_info_t *info, struct sk_buff *skb)
4735 +{
4736 +       u8 flowmask = *(u8 *)skb->data;
4737 +       int i;
4738 +
4739 +       printk(KERN_INFO "dtl1_cs: Nokia control data = ");
4740 +       for (i = 0; i < skb->len; i++) {
4741 +               printk("%02x ", skb->data[i]);
4742 +       }
4743 +       printk("\n");
4744 +
4745 +       /* transition to active state */
4746 +       if (((info->flowmask & 0x07) == 0) && ((flowmask & 0x07) != 0)) {
4747 +               clear_bit(XMIT_WAITING, &(info->tx_state));
4748 +               dtl1_write_wakeup(info);
4749 +       }
4750 +
4751 +       info->flowmask = flowmask;
4752 +
4753 +       kfree_skb(skb);
4754 +}
4755 +
4756 +
4757 +static void dtl1_receive(dtl1_info_t *info)
4758 +{
4759 +       unsigned int iobase;
4760 +       nsh_t *nsh;
4761 +       int boguscount = 0;
4762 +
4763 +       if (!info) {
4764 +               printk(KERN_WARNING "dtl1_cs: Call of receive for unknown device.\n");
4765 +               return;
4766 +       }
4767 +
4768 +       iobase = info->link.io.BasePort1;
4769 +
4770 +       do {
4771 +               info->hdev.stat.byte_rx++;
4772 +
4773 +               /* Allocate packet */
4774 +               if (info->rx_skb == NULL)
4775 +                       if (!(info->rx_skb = bluez_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
4776 +                               printk(KERN_WARNING "dtl1_cs: Can't allocate mem for new packet.\n");
4777 +                               info->rx_state = RECV_WAIT_NSH;
4778 +                               info->rx_count = NSHL;
4779 +                               return;
4780 +                       }
4781 +
4782 +               *skb_put(info->rx_skb, 1) = inb(iobase + UART_RX);
4783 +               nsh = (nsh_t *)info->rx_skb->data;
4784 +
4785 +               info->rx_count--;
4786 +
4787 +               if (info->rx_count == 0) {
4788 +
4789 +                       switch (info->rx_state) {
4790 +                       case RECV_WAIT_NSH:
4791 +                               info->rx_state = RECV_WAIT_DATA;
4792 +                               info->rx_count = nsh->len + (nsh->len & 0x0001);
4793 +                               break;
4794 +                       case RECV_WAIT_DATA:
4795 +                               info->rx_skb->pkt_type = nsh->type;
4796 +
4797 +                               /* remove PAD byte if it exists */
4798 +                               if (nsh->len & 0x0001) {
4799 +                                       info->rx_skb->tail--;
4800 +                                       info->rx_skb->len--;
4801 +                               }
4802 +
4803 +                               /* remove NSH */
4804 +                               skb_pull(info->rx_skb, NSHL);
4805 +
4806 +                               switch (info->rx_skb->pkt_type) {
4807 +                               case 0x80:
4808 +                                       /* control data for the Nokia Card */
4809 +                                       dtl1_control(info, info->rx_skb);
4810 +                                       break;
4811 +                               case 0x82:
4812 +                               case 0x83:
4813 +                               case 0x84:
4814 +                                       /* send frame to the HCI layer */
4815 +                                       info->rx_skb->dev = (void *)&(info->hdev);
4816 +                                       info->rx_skb->pkt_type &= 0x0f;
4817 +                                       hci_recv_frame(info->rx_skb);
4818 +                                       break;
4819 +                               default:
4820 +                                       /* unknown packet */
4821 +                                       printk(KERN_WARNING "dtl1_cs: Unknown HCI packet with type 0x%02x received.\n", info->rx_skb->pkt_type);
4822 +                                       kfree_skb(info->rx_skb);
4823 +                                       break;
4824 +                               }
4825 +
4826 +                               info->rx_state = RECV_WAIT_NSH;
4827 +                               info->rx_count = NSHL;
4828 +                               info->rx_skb = NULL;
4829 +                               break;
4830 +                       }
4831 +
4832 +               }
4833 +
4834 +               /* Make sure we don't stay here to long */
4835 +               if (boguscount++ > 32)
4836 +                       break;
4837 +
4838 +       } while (inb(iobase + UART_LSR) & UART_LSR_DR);
4839 +}
4840 +
4841 +
4842 +void dtl1_interrupt(int irq, void *dev_inst, struct pt_regs *regs)
4843 +{
4844 +       dtl1_info_t *info = dev_inst;
4845 +       unsigned int iobase;
4846 +       unsigned char msr;
4847 +       int boguscount = 0;
4848 +       int iir, lsr;
4849 +
4850 +       if (!info) {
4851 +               printk(KERN_WARNING "dtl1_cs: Call of irq %d for unknown device.\n", irq);
4852 +               return;
4853 +       }
4854 +
4855 +       iobase = info->link.io.BasePort1;
4856 +
4857 +       spin_lock(&(info->lock));
4858 +
4859 +       iir = inb(iobase + UART_IIR) & UART_IIR_ID;
4860 +       while (iir) {
4861 +
4862 +               /* Clear interrupt */
4863 +               lsr = inb(iobase + UART_LSR);
4864 +
4865 +               switch (iir) {
4866 +               case UART_IIR_RLSI:
4867 +                       printk(KERN_NOTICE "dtl1_cs: RLSI\n");
4868 +                       break;
4869 +               case UART_IIR_RDI:
4870 +                       /* Receive interrupt */
4871 +                       dtl1_receive(info);
4872 +                       break;
4873 +               case UART_IIR_THRI:
4874 +                       if (lsr & UART_LSR_THRE) {
4875 +                               /* Transmitter ready for data */
4876 +                               dtl1_write_wakeup(info);
4877 +                       }
4878 +                       break;
4879 +               default:
4880 +                       printk(KERN_NOTICE "dtl1_cs: Unhandled IIR=%#x\n", iir);
4881 +                       break;
4882 +               }
4883 +
4884 +               /* Make sure we don't stay here to long */
4885 +               if (boguscount++ > 100)
4886 +                       break;
4887 +
4888 +               iir = inb(iobase + UART_IIR) & UART_IIR_ID;
4889 +
4890 +       }
4891 +
4892 +       msr = inb(iobase + UART_MSR);
4893 +
4894 +       if (info->ri_latch ^ (msr & UART_MSR_RI)) {
4895 +               info->ri_latch = msr & UART_MSR_RI;
4896 +               clear_bit(XMIT_WAITING, &(info->tx_state));
4897 +               dtl1_write_wakeup(info);
4898 +       }
4899 +
4900 +       spin_unlock(&(info->lock));
4901 +}
4902 +
4903 +
4904 +
4905 +/* ======================== HCI interface ======================== */
4906 +
4907 +
4908 +static int dtl1_hci_open(struct hci_dev *hdev)
4909 +{
4910 +       set_bit(HCI_RUNNING, &(hdev->flags));
4911 +
4912 +       return 0;
4913 +}
4914 +
4915 +
4916 +static int dtl1_hci_flush(struct hci_dev *hdev)
4917 +{
4918 +       dtl1_info_t *info = (dtl1_info_t *)(hdev->driver_data);
4919 +
4920 +       /* Drop TX queue */
4921 +       skb_queue_purge(&(info->txq));
4922 +
4923 +       return 0;
4924 +}
4925 +
4926 +
4927 +static int dtl1_hci_close(struct hci_dev *hdev)
4928 +{
4929 +       if (!test_and_clear_bit(HCI_RUNNING, &(hdev->flags)))
4930 +               return 0;
4931 +
4932 +       dtl1_hci_flush(hdev);
4933 +
4934 +       return 0;
4935 +}
4936 +
4937 +
4938 +static int dtl1_hci_send_frame(struct sk_buff *skb)
4939 +{
4940 +       dtl1_info_t *info;
4941 +       struct hci_dev *hdev = (struct hci_dev *)(skb->dev);
4942 +       struct sk_buff *s;
4943 +       nsh_t nsh;
4944 +
4945 +       if (!hdev) {
4946 +               printk(KERN_WARNING "dtl1_cs: Frame for unknown HCI device (hdev=NULL).");
4947 +               return -ENODEV;
4948 +       }
4949 +
4950 +       info = (dtl1_info_t *)(hdev->driver_data);
4951 +
4952 +       switch (skb->pkt_type) {
4953 +       case HCI_COMMAND_PKT:
4954 +               hdev->stat.cmd_tx++;
4955 +               nsh.type = 0x81;
4956 +               break;
4957 +       case HCI_ACLDATA_PKT:
4958 +               hdev->stat.acl_tx++;
4959 +               nsh.type = 0x82;
4960 +               break;
4961 +       case HCI_SCODATA_PKT:
4962 +               hdev->stat.sco_tx++;
4963 +               nsh.type = 0x83;
4964 +               break;
4965 +       };
4966 +
4967 +       nsh.zero = 0;
4968 +       nsh.len = skb->len;
4969 +
4970 +       s = bluez_skb_alloc(NSHL + skb->len + 1, GFP_ATOMIC);
4971 +       skb_reserve(s, NSHL);
4972 +       memcpy(skb_put(s, skb->len), skb->data, skb->len);
4973 +       if (skb->len & 0x0001)
4974 +               *skb_put(s, 1) = 0;     /* PAD */
4975 +
4976 +       /* Prepend skb with Nokia frame header and queue */
4977 +       memcpy(skb_push(s, NSHL), &nsh, NSHL);
4978 +       skb_queue_tail(&(info->txq), s);
4979 +
4980 +       dtl1_write_wakeup(info);
4981 +
4982 +       kfree_skb(skb);
4983 +
4984 +       return 0;
4985 +}
4986 +
4987 +
4988 +static void dtl1_hci_destruct(struct hci_dev *hdev)
4989 +{
4990 +}
4991 +
4992 +
4993 +static int dtl1_hci_ioctl(struct hci_dev *hdev, unsigned int cmd,  unsigned long arg)
4994 +{
4995 +       return -ENOIOCTLCMD;
4996 +}
4997 +
4998 +
4999 +
5000 +/* ======================== Card services HCI interaction ======================== */
5001 +
5002 +
5003 +int dtl1_open(dtl1_info_t *info)
5004 +{
5005 +       unsigned long flags;
5006 +       unsigned int iobase = info->link.io.BasePort1;
5007 +       struct hci_dev *hdev;
5008 +
5009 +       spin_lock_init(&(info->lock));
5010 +
5011 +       skb_queue_head_init(&(info->txq));
5012 +
5013 +       info->rx_state = RECV_WAIT_NSH;
5014 +       info->rx_count = NSHL;
5015 +       info->rx_skb = NULL;
5016 +
5017 +       set_bit(XMIT_WAITING, &(info->tx_state));
5018 +
5019 +       spin_lock_irqsave(&(info->lock), flags);
5020 +
5021 +       /* Reset UART */
5022 +       outb(0, iobase + UART_MCR);
5023 +
5024 +       /* Turn off interrupts */
5025 +       outb(0, iobase + UART_IER);
5026 +
5027 +       /* Initialize UART */
5028 +       outb(UART_LCR_WLEN8, iobase + UART_LCR);        /* Reset DLAB */
5029 +       outb((UART_MCR_DTR | UART_MCR_RTS | UART_MCR_OUT2), iobase + UART_MCR);
5030 +
5031 +       info->ri_latch = inb(info->link.io.BasePort1 + UART_MSR) & UART_MSR_RI;
5032 +
5033 +       /* Turn on interrupts */
5034 +       outb(UART_IER_RLSI | UART_IER_RDI | UART_IER_THRI, iobase + UART_IER);
5035 +
5036 +       spin_unlock_irqrestore(&(info->lock), flags);
5037 +
5038 +       /* Timeout before it is safe to send the first HCI packet */
5039 +       set_current_state(TASK_INTERRUPTIBLE);
5040 +       schedule_timeout(HZ * 2);
5041 +
5042 +
5043 +       /* Initialize and register HCI device */
5044 +
5045 +       hdev = &(info->hdev);
5046 +
5047 +       hdev->type = HCI_PCCARD;
5048 +       hdev->driver_data = info;
5049 +
5050 +       hdev->open = dtl1_hci_open;
5051 +       hdev->close = dtl1_hci_close;
5052 +       hdev->flush = dtl1_hci_flush;
5053 +       hdev->send = dtl1_hci_send_frame;
5054 +       hdev->destruct = dtl1_hci_destruct;
5055 +       hdev->ioctl = dtl1_hci_ioctl;
5056 +
5057 +       if (hci_register_dev(hdev) < 0) {
5058 +               printk(KERN_WARNING "dtl1_cs: Can't register HCI device %s.\n", hdev->name);
5059 +               return -ENODEV;
5060 +       }
5061 +
5062 +       return 0;
5063 +}
5064 +
5065 +
5066 +int dtl1_close(dtl1_info_t *info)
5067 +{
5068 +       unsigned long flags;
5069 +       unsigned int iobase = info->link.io.BasePort1;
5070 +       struct hci_dev *hdev = &(info->hdev);
5071 +
5072 +       dtl1_hci_close(hdev);
5073 +
5074 +       spin_lock_irqsave(&(info->lock), flags);
5075 +
5076 +       /* Reset UART */
5077 +       outb(0, iobase + UART_MCR);
5078 +
5079 +       /* Turn off interrupts */
5080 +       outb(0, iobase + UART_IER);
5081 +
5082 +       spin_unlock_irqrestore(&(info->lock), flags);
5083 +
5084 +       if (hci_unregister_dev(hdev) < 0)
5085 +               printk(KERN_WARNING "dtl1_cs: Can't unregister HCI device %s.\n", hdev->name);
5086 +
5087 +       return 0;
5088 +}
5089 +
5090 +
5091 +
5092 +/* ======================== Card services ======================== */
5093 +
5094 +
5095 +static void cs_error(client_handle_t handle, int func, int ret)
5096 +{
5097 +       error_info_t err = { func, ret };
5098 +
5099 +       CardServices(ReportError, handle, &err);
5100 +}
5101 +
5102 +
5103 +dev_link_t *dtl1_attach(void)
5104 +{
5105 +       dtl1_info_t *info;
5106 +       client_reg_t client_reg;
5107 +       dev_link_t *link;
5108 +       int i, ret;
5109 +
5110 +       /* Create new info device */
5111 +       info = kmalloc(sizeof(*info), GFP_KERNEL);
5112 +       if (!info)
5113 +               return NULL;
5114 +       memset(info, 0, sizeof(*info));
5115 +
5116 +       link = &info->link;
5117 +       link->priv = info;
5118 +
5119 +       link->release.function = &dtl1_release;
5120 +       link->release.data = (u_long)link;
5121 +       link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
5122 +       link->io.NumPorts1 = 8;
5123 +       link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
5124 +       link->irq.IRQInfo1 = IRQ_INFO2_VALID | IRQ_LEVEL_ID;
5125 +
5126 +       if (irq_list[0] == -1)
5127 +               link->irq.IRQInfo2 = irq_mask;
5128 +       else
5129 +               for (i = 0; i < 4; i++)
5130 +                       link->irq.IRQInfo2 |= 1 << irq_list[i];
5131 +
5132 +       link->irq.Handler = dtl1_interrupt;
5133 +       link->irq.Instance = info;
5134 +
5135 +       link->conf.Attributes = CONF_ENABLE_IRQ;
5136 +       link->conf.Vcc = 50;
5137 +       link->conf.IntType = INT_MEMORY_AND_IO;
5138 +
5139 +       /* Register with Card Services */
5140 +       link->next = dev_list;
5141 +       dev_list = link;
5142 +       client_reg.dev_info = &dev_info;
5143 +       client_reg.Attributes = INFO_IO_CLIENT | INFO_CARD_SHARE;
5144 +       client_reg.EventMask =
5145 +               CS_EVENT_CARD_INSERTION | CS_EVENT_CARD_REMOVAL |
5146 +               CS_EVENT_RESET_PHYSICAL | CS_EVENT_CARD_RESET |
5147 +               CS_EVENT_PM_SUSPEND | CS_EVENT_PM_RESUME;
5148 +       client_reg.event_handler = &dtl1_event;
5149 +       client_reg.Version = 0x0210;
5150 +       client_reg.event_callback_args.client_data = link;
5151 +
5152 +       ret = CardServices(RegisterClient, &link->handle, &client_reg);
5153 +       if (ret != CS_SUCCESS) {
5154 +               cs_error(link->handle, RegisterClient, ret);
5155 +               dtl1_detach(link);
5156 +               return NULL;
5157 +       }
5158 +
5159 +       return link;
5160 +}
5161 +
5162 +
5163 +void dtl1_detach(dev_link_t *link)
5164 +{
5165 +       dtl1_info_t *info = link->priv;
5166 +       dev_link_t **linkp;
5167 +       int ret;
5168 +
5169 +       /* Locate device structure */
5170 +       for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
5171 +               if (*linkp == link)
5172 +                       break;
5173 +
5174 +       if (*linkp == NULL)
5175 +               return;
5176 +
5177 +       del_timer(&link->release);
5178 +       if (link->state & DEV_CONFIG)
5179 +               dtl1_release((u_long)link);
5180 +
5181 +       if (link->handle) {
5182 +               ret = CardServices(DeregisterClient, link->handle);
5183 +               if (ret != CS_SUCCESS)
5184 +                       cs_error(link->handle, DeregisterClient, ret);
5185 +       }
5186 +
5187 +       /* Unlink device structure, free bits */
5188 +       *linkp = link->next;
5189 +
5190 +       kfree(info);
5191 +}
5192 +
5193 +
5194 +static int get_tuple(int fn, client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
5195 +{
5196 +       int i;
5197 +
5198 +       i = CardServices(fn, handle, tuple);
5199 +       if (i != CS_SUCCESS)
5200 +               return CS_NO_MORE_ITEMS;
5201 +
5202 +       i = CardServices(GetTupleData, handle, tuple);
5203 +       if (i != CS_SUCCESS)
5204 +               return i;
5205 +
5206 +       return CardServices(ParseTuple, handle, tuple, parse);
5207 +}
5208 +
5209 +
5210 +#define first_tuple(a, b, c) get_tuple(GetFirstTuple, a, b, c)
5211 +#define next_tuple(a, b, c) get_tuple(GetNextTuple, a, b, c)
5212 +
5213 +void dtl1_config(dev_link_t *link)
5214 +{
5215 +       client_handle_t handle = link->handle;
5216 +       dtl1_info_t *info = link->priv;
5217 +       tuple_t tuple;
5218 +       u_short buf[256];
5219 +       cisparse_t parse;
5220 +       cistpl_cftable_entry_t *cf = &parse.cftable_entry;
5221 +       config_info_t config;
5222 +       int i, last_ret, last_fn;
5223 +
5224 +       tuple.TupleData = (cisdata_t *)buf;
5225 +       tuple.TupleOffset = 0;
5226 +       tuple.TupleDataMax = 255;
5227 +       tuple.Attributes = 0;
5228 +
5229 +       /* Get configuration register information */
5230 +       tuple.DesiredTuple = CISTPL_CONFIG;
5231 +       last_ret = first_tuple(handle, &tuple, &parse);
5232 +       if (last_ret != CS_SUCCESS) {
5233 +               last_fn = ParseTuple;
5234 +               goto cs_failed;
5235 +       }
5236 +       link->conf.ConfigBase = parse.config.base;
5237 +       link->conf.Present = parse.config.rmask[0];
5238 +
5239 +       /* Configure card */
5240 +       link->state |= DEV_CONFIG;
5241 +       i = CardServices(GetConfigurationInfo, handle, &config);
5242 +       link->conf.Vcc = config.Vcc;
5243 +
5244 +       tuple.TupleData = (cisdata_t *)buf;
5245 +       tuple.TupleOffset = 0;
5246 +       tuple.TupleDataMax = 255;
5247 +       tuple.Attributes = 0;
5248 +       tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
5249 +
5250 +       /* Look for a generic full-sized window */
5251 +       link->io.NumPorts1 = 8;
5252 +       i = first_tuple(handle, &tuple, &parse);
5253 +       while (i != CS_NO_MORE_ITEMS) {
5254 +               if ((i == CS_SUCCESS) && (cf->io.nwin == 1) && (cf->io.win[0].len > 8)) {
5255 +                       link->conf.ConfigIndex = cf->index;
5256 +                       link->io.BasePort1 = cf->io.win[0].base;
5257 +                       link->io.NumPorts1 = cf->io.win[0].len; /*yo */
5258 +                       link->io.IOAddrLines = cf->io.flags & CISTPL_IO_LINES_MASK;
5259 +                       i = CardServices(RequestIO, link->handle, &link->io);
5260 +                       if (i == CS_SUCCESS)
5261 +                               break;
5262 +               }
5263 +               i = next_tuple(handle, &tuple, &parse);
5264 +       }
5265 +
5266 +       if (i != CS_SUCCESS) {
5267 +               cs_error(link->handle, RequestIO, i);
5268 +               goto failed;
5269 +       }
5270 +
5271 +       i = CardServices(RequestIRQ, link->handle, &link->irq);
5272 +       if (i != CS_SUCCESS) {
5273 +               cs_error(link->handle, RequestIRQ, i);
5274 +               link->irq.AssignedIRQ = 0;
5275 +       }
5276 +
5277 +       i = CardServices(RequestConfiguration, link->handle, &link->conf);
5278 +       if (i != CS_SUCCESS) {
5279 +               cs_error(link->handle, RequestConfiguration, i);
5280 +               goto failed;
5281 +       }
5282 +
5283 +       MOD_INC_USE_COUNT;
5284 +
5285 +       if (dtl1_open(info) != 0)
5286 +               goto failed;
5287 +
5288 +       strcpy(info->node.dev_name, info->hdev.name);
5289 +       link->dev = &info->node;
5290 +       link->state &= ~DEV_CONFIG_PENDING;
5291 +
5292 +       return;
5293 +
5294 +cs_failed:
5295 +       cs_error(link->handle, last_fn, last_ret);
5296 +
5297 +failed:
5298 +       dtl1_release((u_long)link);
5299 +}
5300 +
5301 +
5302 +void dtl1_release(u_long arg)
5303 +{
5304 +       dev_link_t *link = (dev_link_t *)arg;
5305 +       dtl1_info_t *info = link->priv;
5306 +
5307 +       if (link->state & DEV_PRESENT)
5308 +               dtl1_close(info);
5309 +
5310 +       MOD_DEC_USE_COUNT;
5311 +
5312 +       link->dev = NULL;
5313 +
5314 +       CardServices(ReleaseConfiguration, link->handle);
5315 +       CardServices(ReleaseIO, link->handle, &link->io);
5316 +       CardServices(ReleaseIRQ, link->handle, &link->irq);
5317 +
5318 +       link->state &= ~DEV_CONFIG;
5319 +}
5320 +
5321 +
5322 +int dtl1_event(event_t event, int priority, event_callback_args_t *args)
5323 +{
5324 +       dev_link_t *link = args->client_data;
5325 +       dtl1_info_t *info = link->priv;
5326 +
5327 +       switch (event) {
5328 +       case CS_EVENT_CARD_REMOVAL:
5329 +               link->state &= ~DEV_PRESENT;
5330 +               if (link->state & DEV_CONFIG) {
5331 +                       dtl1_close(info);
5332 +                       mod_timer(&link->release, jiffies + HZ / 20);
5333 +               }
5334 +               break;
5335 +       case CS_EVENT_CARD_INSERTION:
5336 +               link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
5337 +               dtl1_config(link);
5338 +               break;
5339 +       case CS_EVENT_PM_SUSPEND:
5340 +               link->state |= DEV_SUSPEND;
5341 +               /* Fall through... */
5342 +       case CS_EVENT_RESET_PHYSICAL:
5343 +               if (link->state & DEV_CONFIG)
5344 +                       CardServices(ReleaseConfiguration, link->handle);
5345 +               break;
5346 +       case CS_EVENT_PM_RESUME:
5347 +               link->state &= ~DEV_SUSPEND;
5348 +               /* Fall through... */
5349 +       case CS_EVENT_CARD_RESET:
5350 +               if (DEV_OK(link))
5351 +                       CardServices(RequestConfiguration, link->handle, &link->conf);
5352 +               break;
5353 +       }
5354 +
5355 +       return 0;
5356 +}
5357 +
5358 +
5359 +
5360 +/* ======================== Module initialization ======================== */
5361 +
5362 +
5363 +int __init init_dtl1_cs(void)
5364 +{
5365 +       servinfo_t serv;
5366 +       int err;
5367 +
5368 +       CardServices(GetCardServicesInfo, &serv);
5369 +       if (serv.Revision != CS_RELEASE_CODE) {
5370 +               printk(KERN_NOTICE "dtl1_cs: Card Services release does not match!\n");
5371 +               return -1;
5372 +       }
5373 +
5374 +       err = register_pccard_driver(&dev_info, &dtl1_attach, &dtl1_detach);
5375 +
5376 +       return err;
5377 +}
5378 +
5379 +
5380 +void __exit exit_dtl1_cs(void)
5381 +{
5382 +       unregister_pccard_driver(&dev_info);
5383 +
5384 +       while (dev_list != NULL)
5385 +               dtl1_detach(dev_list);
5386 +}
5387 +
5388 +
5389 +module_init(init_dtl1_cs);
5390 +module_exit(exit_dtl1_cs);
5391 +
5392 +EXPORT_NO_SYMBOLS;
5393 diff -urN linux-2.4.18/drivers/bluetooth/hci_bcsp.c linux-2.4.18-mh9/drivers/bluetooth/hci_bcsp.c
5394 --- linux-2.4.18/drivers/bluetooth/hci_bcsp.c   Thu Jan  1 01:00:00 1970
5395 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_bcsp.c       Mon Aug 25 18:38:10 2003
5396 @@ -0,0 +1,710 @@
5397 +/*
5398 +   BlueCore Serial Protocol (BCSP) for Linux Bluetooth stack (BlueZ).
5399 +   Copyright 2002 by Fabrizio Gennari <fabrizio.gennari@philips.com>
5400 +
5401 +   Based on
5402 +       hci_h4.c  by Maxim Krasnyansky <maxk@qualcomm.com>
5403 +       ABCSP     by Carl Orsborn <cjo@csr.com>
5404 +
5405 +   This program is free software; you can redistribute it and/or modify
5406 +   it under the terms of the GNU General Public License version 2 as
5407 +   published by the Free Software Foundation;
5408 +
5409 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
5410 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
5411 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
5412 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
5413 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
5414 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
5415 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
5416 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
5417 +
5418 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
5419 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
5420 +   SOFTWARE IS DISCLAIMED.
5421 +*/
5422 +
5423 +/*
5424 + * $Id: hci_bcsp.c,v 1.2 2002/09/26 05:05:14 maxk Exp $
5425 + */
5426 +
5427 +#define VERSION "0.1"
5428 +
5429 +#include <linux/config.h>
5430 +#include <linux/module.h>
5431 +
5432 +#include <linux/version.h>
5433 +#include <linux/config.h>
5434 +#include <linux/kernel.h>
5435 +#include <linux/init.h>
5436 +#include <linux/sched.h>
5437 +#include <linux/types.h>
5438 +#include <linux/fcntl.h>
5439 +#include <linux/interrupt.h>
5440 +#include <linux/ptrace.h>
5441 +#include <linux/poll.h>
5442 +
5443 +#include <linux/slab.h>
5444 +#include <linux/tty.h>
5445 +#include <linux/errno.h>
5446 +#include <linux/string.h>
5447 +#include <linux/signal.h>
5448 +#include <linux/ioctl.h>
5449 +#include <linux/skbuff.h>
5450 +
5451 +#include <net/bluetooth/bluetooth.h>
5452 +#include <net/bluetooth/hci_core.h>
5453 +#include "hci_uart.h"
5454 +#include "hci_bcsp.h"
5455 +
5456 +#ifndef HCI_UART_DEBUG
5457 +#undef  BT_DBG
5458 +#define BT_DBG( A... )
5459 +#undef  BT_DMP
5460 +#define BT_DMP( A... )
5461 +#endif
5462 +
5463 +/* ---- BCSP CRC calculation ---- */
5464 +
5465 +/* Table for calculating CRC for polynomial 0x1021, LSB processed first,
5466 +initial value 0xffff, bits shifted in reverse order. */
5467 +
5468 +static const u16 crc_table[] = {
5469 +       0x0000, 0x1081, 0x2102, 0x3183,
5470 +       0x4204, 0x5285, 0x6306, 0x7387,
5471 +       0x8408, 0x9489, 0xa50a, 0xb58b,
5472 +       0xc60c, 0xd68d, 0xe70e, 0xf78f
5473 +};
5474 +
5475 +/* Initialise the crc calculator */
5476 +#define BCSP_CRC_INIT(x) x = 0xffff
5477 +
5478 +/*
5479 +   Update crc with next data byte
5480 +
5481 +   Implementation note
5482 +        The data byte is treated as two nibbles.  The crc is generated
5483 +        in reverse, i.e., bits are fed into the register from the top.
5484 +*/
5485 +static void bcsp_crc_update(u16 *crc, u8 d)
5486 +{
5487 +       u16 reg = *crc;
5488 +
5489 +       reg = (reg >> 4) ^ crc_table[(reg ^ d) & 0x000f];
5490 +       reg = (reg >> 4) ^ crc_table[(reg ^ (d >> 4)) & 0x000f];
5491 +
5492 +       *crc = reg;
5493 +}
5494 +
5495 +/*
5496 +   Get reverse of generated crc
5497 +
5498 +   Implementation note
5499 +        The crc generator (bcsp_crc_init() and bcsp_crc_update())
5500 +        creates a reversed crc, so it needs to be swapped back before
5501 +        being passed on.
5502 +*/
5503 +static u16 bcsp_crc_reverse(u16 crc)
5504 +{
5505 +       u16 b, rev;
5506 +
5507 +       for (b = 0, rev = 0; b < 16; b++) {
5508 +               rev = rev << 1;
5509 +               rev |= (crc & 1);
5510 +               crc = crc >> 1;
5511 +       }
5512 +       return (rev);
5513 +}
5514 +
5515 +/* ---- BCSP core ---- */
5516 +
5517 +static void bcsp_slip_msgdelim(struct sk_buff *skb)
5518 +{
5519 +       const char pkt_delim = 0xc0;
5520 +       memcpy(skb_put(skb, 1), &pkt_delim, 1);
5521 +}
5522 +
5523 +static void bcsp_slip_one_byte(struct sk_buff *skb, u8 c)
5524 +{
5525 +       const char esc_c0[2] = { 0xdb, 0xdc };
5526 +       const char esc_db[2] = { 0xdb, 0xdd };
5527 +
5528 +       switch (c) {
5529 +       case 0xc0:
5530 +               memcpy(skb_put(skb, 2), &esc_c0, 2);
5531 +               break;
5532 +       case 0xdb:
5533 +               memcpy(skb_put(skb, 2), &esc_db, 2);
5534 +               break;
5535 +       default:
5536 +               memcpy(skb_put(skb, 1), &c, 1);
5537 +       }
5538 +}
5539 +
5540 +static int bcsp_enqueue(struct hci_uart *hu, struct sk_buff *skb)
5541 +{
5542 +       struct bcsp_struct *bcsp = hu->priv;
5543 +
5544 +       if (skb->len > 0xFFF) {
5545 +               BT_ERR("Packet too long");
5546 +               kfree_skb(skb);
5547 +               return 0;
5548 +       }
5549 +
5550 +       switch (skb->pkt_type) {
5551 +       case HCI_ACLDATA_PKT:
5552 +       case HCI_COMMAND_PKT:
5553 +               skb_queue_tail(&bcsp->rel, skb);
5554 +               break;
5555 +
5556 +       case HCI_SCODATA_PKT:
5557 +               skb_queue_tail(&bcsp->unrel, skb);
5558 +               break;
5559 +
5560 +       default:
5561 +               BT_ERR("Unknown packet type");
5562 +               kfree_skb(skb);
5563 +               break;
5564 +       }
5565 +       return 0;
5566 +}
5567 +
5568 +static struct sk_buff *bcsp_prepare_pkt(struct bcsp_struct *bcsp, u8 *data,
5569 +               int len, int pkt_type)
5570 +{
5571 +       struct sk_buff *nskb;
5572 +       u8  hdr[4], chan;
5573 +       int rel, i;
5574 +
5575 +#ifdef CONFIG_BLUEZ_HCIUART_BCSP_TXCRC
5576 +       u16 BCSP_CRC_INIT(bcsp_txmsg_crc);
5577 +#endif
5578 +
5579 +       switch (pkt_type) {
5580 +       case HCI_ACLDATA_PKT:
5581 +               chan = 6;       /* BCSP ACL channel */
5582 +               rel = 1;        /* reliable channel */
5583 +               break;
5584 +       case HCI_COMMAND_PKT:
5585 +               chan = 5;       /* BCSP cmd/evt channel */
5586 +               rel = 1;        /* reliable channel */
5587 +               break;
5588 +       case HCI_SCODATA_PKT:
5589 +               chan = 7;       /* BCSP SCO channel */
5590 +               rel = 0;        /* unreliable channel */
5591 +               break;
5592 +       case BCSP_LE_PKT:
5593 +               chan = 1;       /* BCSP LE channel */
5594 +               rel = 0;        /* unreliable channel */
5595 +               break;
5596 +       case BCSP_ACK_PKT:
5597 +               chan = 0;       /* BCSP internal channel */
5598 +               rel = 0;        /* unreliable channel */
5599 +               break;
5600 +       default:
5601 +               BT_ERR("Unknown packet type");
5602 +               return NULL;
5603 +       }
5604 +
5605 +       /* Max len of packet: (original len +4(bcsp hdr) +2(crc))*2
5606 +          (because bytes 0xc0 and 0xdb are escaped, worst case is
5607 +          when the packet is all made of 0xc0 and 0xdb :) )
5608 +          + 2 (0xc0 delimiters at start and end). */
5609 +
5610 +       nskb = alloc_skb((len + 6) * 2 + 2, GFP_ATOMIC);
5611 +       if (!nskb)
5612 +               return NULL;
5613 +
5614 +       nskb->pkt_type = pkt_type;
5615 +
5616 +       bcsp_slip_msgdelim(nskb);
5617 +
5618 +       hdr[0] = bcsp->rxseq_txack << 3;
5619 +       bcsp->txack_req = 0;
5620 +       BT_DBG("We request packet no %u to card", bcsp->rxseq_txack);
5621 +
5622 +       if (rel) {
5623 +               hdr[0] |= 0x80 + bcsp->msgq_txseq;
5624 +               BT_DBG("Sending packet with seqno %u", bcsp->msgq_txseq);
5625 +               bcsp->msgq_txseq = ++(bcsp->msgq_txseq) & 0x07;
5626 +       }
5627 +#ifdef  CONFIG_BLUEZ_HCIUART_BCSP_TXCRC
5628 +       hdr[0] |= 0x40;
5629 +#endif
5630 +
5631 +       hdr[1]  = (len << 4) & 0xFF;
5632 +       hdr[1] |= chan;
5633 +       hdr[2]  = len >> 4;
5634 +       hdr[3]  = ~(hdr[0] + hdr[1] + hdr[2]);
5635 +
5636 +       /* Put BCSP header */
5637 +       for (i = 0; i < 4; i++) {
5638 +               bcsp_slip_one_byte(nskb, hdr[i]);
5639 +#ifdef  CONFIG_BLUEZ_HCIUART_BCSP_TXCRC
5640 +               bcsp_crc_update(&bcsp_txmsg_crc, hdr[i]);
5641 +#endif
5642 +       }
5643 +
5644 +       /* Put payload */
5645 +       for (i = 0; i < len; i++) {
5646 +               bcsp_slip_one_byte(nskb, data[i]);
5647 +#ifdef  CONFIG_BLUEZ_HCIUART_BCSP_TXCRC
5648 +               bcsp_crc_update(&bcsp_txmsg_crc, data[i]);
5649 +#endif
5650 +       }
5651 +
5652 +#ifdef CONFIG_BLUEZ_HCIUART_BCSP_TXCRC
5653 +       /* Put CRC */
5654 +       bcsp_txmsg_crc = bcsp_crc_reverse(bcsp_txmsg_crc);
5655 +       bcsp_slip_one_byte(nskb, (u8) ((bcsp_txmsg_crc >> 8) & 0x00ff));
5656 +       bcsp_slip_one_byte(nskb, (u8) (bcsp_txmsg_crc & 0x00ff));
5657 +#endif
5658 +
5659 +       bcsp_slip_msgdelim(nskb);
5660 +       return nskb;
5661 +}
5662 +
5663 +/* This is a rewrite of pkt_avail in ABCSP */
5664 +static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
5665 +{
5666 +       struct bcsp_struct *bcsp = (struct bcsp_struct *) hu->priv;
5667 +       unsigned long flags;
5668 +       struct sk_buff *skb;
5669 +
5670 +       /* First of all, check for unreliable messages in the queue,
5671 +          since they have priority */
5672 +
5673 +       if ((skb = skb_dequeue(&bcsp->unrel)) != NULL) {
5674 +               struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, skb->pkt_type);
5675 +               if (nskb) {
5676 +                       kfree_skb(skb);
5677 +                       return nskb;
5678 +               } else {
5679 +                       skb_queue_head(&bcsp->unrel, skb);
5680 +                       BT_ERR("Could not dequeue pkt because alloc_skb failed");
5681 +               }
5682 +       }
5683 +
5684 +       /* Now, try to send a reliable pkt. We can only send a
5685 +          reliable packet if the number of packets sent but not yet ack'ed
5686 +          is < than the winsize */
5687 +
5688 +       spin_lock_irqsave(&bcsp->unack.lock, flags);
5689 +
5690 +       if (bcsp->unack.qlen < BCSP_TXWINSIZE && (skb = skb_dequeue(&bcsp->rel)) != NULL) {
5691 +               struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, skb->pkt_type);
5692 +               if (nskb) {
5693 +                       __skb_queue_tail(&bcsp->unack, skb);
5694 +                       mod_timer(&bcsp->tbcsp, jiffies + HZ / 4);
5695 +                       spin_unlock_irqrestore(&bcsp->unack.lock, flags);
5696 +                       return nskb;
5697 +               } else {
5698 +                       skb_queue_head(&bcsp->rel, skb);
5699 +                       BT_ERR("Could not dequeue pkt because alloc_skb failed");
5700 +               }
5701 +       }
5702 +
5703 +       spin_unlock_irqrestore(&bcsp->unack.lock, flags);
5704 +
5705 +
5706 +       /* We could not send a reliable packet, either because there are
5707 +          none or because there are too many unack'ed pkts. Did we receive
5708 +          any packets we have not acknowledged yet ? */
5709 +
5710 +       if (bcsp->txack_req) {
5711 +               /* if so, craft an empty ACK pkt and send it on BCSP unreliable
5712 +                  channel 0 */
5713 +               struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, NULL, 0, BCSP_ACK_PKT);
5714 +               return nskb;
5715 +       }
5716 +
5717 +       /* We have nothing to send */
5718 +       return NULL;
5719 +}
5720 +
5721 +static int bcsp_flush(struct hci_uart *hu)
5722 +{
5723 +       BT_DBG("hu %p", hu);
5724 +       return 0;
5725 +}
5726 +
5727 +/* Remove ack'ed packets */
5728 +static void bcsp_pkt_cull(struct bcsp_struct *bcsp)
5729 +{
5730 +       unsigned long flags;
5731 +       struct sk_buff *skb;
5732 +       int i, pkts_to_be_removed;
5733 +       u8 seqno;
5734 +
5735 +       spin_lock_irqsave(&bcsp->unack.lock, flags);
5736 +
5737 +       pkts_to_be_removed = bcsp->unack.qlen;
5738 +       seqno = bcsp->msgq_txseq;
5739 +
5740 +       while (pkts_to_be_removed) {
5741 +               if (bcsp->rxack == seqno)
5742 +                       break;
5743 +               pkts_to_be_removed--;
5744 +               seqno = (seqno - 1) & 0x07;
5745 +       }
5746 +
5747 +       if (bcsp->rxack != seqno)
5748 +               BT_ERR("Peer acked invalid packet");
5749 +
5750 +       BT_DBG("Removing %u pkts out of %u, up to seqno %u",
5751 +              pkts_to_be_removed, bcsp->unack.qlen, (seqno - 1) & 0x07);
5752 +
5753 +       for (i = 0, skb = ((struct sk_buff *) &bcsp->unack)->next; i < pkts_to_be_removed
5754 +                       && skb != (struct sk_buff *) &bcsp->unack; i++) {
5755 +               struct sk_buff *nskb;
5756 +
5757 +               nskb = skb->next;
5758 +               __skb_unlink(skb, &bcsp->unack);
5759 +               kfree_skb(skb);
5760 +               skb = nskb;
5761 +       }
5762 +       if (bcsp->unack.qlen == 0)
5763 +               del_timer(&bcsp->tbcsp);
5764 +       spin_unlock_irqrestore(&bcsp->unack.lock, flags);
5765 +
5766 +       if (i != pkts_to_be_removed)
5767 +               BT_ERR("Removed only %u out of %u pkts", i, pkts_to_be_removed);
5768 +}
5769 +
5770 +/* Handle BCSP link-establishment packets. When we
5771 +   detect a "sync" packet, symptom that the BT module has reset,
5772 +   we do nothing :) (yet) */
5773 +static void bcsp_handle_le_pkt(struct hci_uart *hu)
5774 +{
5775 +       struct bcsp_struct *bcsp = hu->priv;
5776 +       u8 conf_pkt[4]     = { 0xad, 0xef, 0xac, 0xed };
5777 +       u8 conf_rsp_pkt[4] = { 0xde, 0xad, 0xd0, 0xd0 };
5778 +       u8 sync_pkt[4]     = { 0xda, 0xdc, 0xed, 0xed };
5779 +
5780 +       /* spot "conf" pkts and reply with a "conf rsp" pkt */
5781 +       if (bcsp->rx_skb->data[1] >> 4 == 4 && bcsp->rx_skb->data[2] == 0 &&
5782 +                       !memcmp(&bcsp->rx_skb->data[4], conf_pkt, 4)) {
5783 +               struct sk_buff *nskb = alloc_skb(4, GFP_ATOMIC);
5784 +
5785 +               BT_DBG("Found a LE conf pkt");
5786 +               if (!nskb)
5787 +                       return;
5788 +               memcpy(skb_put(nskb, 4), conf_rsp_pkt, 4);
5789 +               nskb->pkt_type = BCSP_LE_PKT;
5790 +
5791 +               skb_queue_head(&bcsp->unrel, nskb);
5792 +               hci_uart_tx_wakeup(hu);
5793 +       }
5794 +       /* Spot "sync" pkts. If we find one...disaster! */
5795 +       else if (bcsp->rx_skb->data[1] >> 4 == 4 && bcsp->rx_skb->data[2] == 0 &&
5796 +                       !memcmp(&bcsp->rx_skb->data[4], sync_pkt, 4)) {
5797 +               BT_ERR("Found a LE sync pkt, card has reset");
5798 +       }
5799 +}
5800 +
5801 +static inline void bcsp_unslip_one_byte(struct bcsp_struct *bcsp, unsigned char byte)
5802 +{
5803 +       const u8 c0 = 0xc0, db = 0xdb;
5804 +
5805 +       switch (bcsp->rx_esc_state) {
5806 +       case BCSP_ESCSTATE_NOESC:
5807 +               switch (byte) {
5808 +               case 0xdb:
5809 +                       bcsp->rx_esc_state = BCSP_ESCSTATE_ESC;
5810 +                       break;
5811 +               default:
5812 +                       memcpy(skb_put(bcsp->rx_skb, 1), &byte, 1);
5813 +                       if ((bcsp->rx_skb-> data[0] & 0x40) != 0 &&
5814 +                                       bcsp->rx_state != BCSP_W4_CRC)
5815 +                               bcsp_crc_update(&bcsp->message_crc, byte);
5816 +                       bcsp->rx_count--;
5817 +               }
5818 +               break;
5819 +
5820 +       case BCSP_ESCSTATE_ESC:
5821 +               switch (byte) {
5822 +               case 0xdc:
5823 +                       memcpy(skb_put(bcsp->rx_skb, 1), &c0, 1);
5824 +                       if ((bcsp->rx_skb-> data[0] & 0x40) != 0 &&
5825 +                                       bcsp->rx_state != BCSP_W4_CRC)
5826 +                               bcsp_crc_update(&bcsp-> message_crc, 0xc0);
5827 +                       bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
5828 +                       bcsp->rx_count--;
5829 +                       break;
5830 +
5831 +               case 0xdd:
5832 +                       memcpy(skb_put(bcsp->rx_skb, 1), &db, 1);
5833 +                       if ((bcsp->rx_skb-> data[0] & 0x40) != 0 &&
5834 +                                       bcsp->rx_state != BCSP_W4_CRC)
5835 +                               bcsp_crc_update(&bcsp-> message_crc, 0xdb);
5836 +                       bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
5837 +                       bcsp->rx_count--;
5838 +                       break;
5839 +
5840 +               default:
5841 +                       BT_ERR ("Invalid byte %02x after esc byte", byte);
5842 +                       kfree_skb(bcsp->rx_skb);
5843 +                       bcsp->rx_skb = NULL;
5844 +                       bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
5845 +                       bcsp->rx_count = 0;
5846 +               }
5847 +       }
5848 +}
5849 +
5850 +static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
5851 +{
5852 +       struct bcsp_struct *bcsp = hu->priv;
5853 +       int pass_up;
5854 +
5855 +       if (bcsp->rx_skb->data[0] & 0x80) {     /* reliable pkt */
5856 +               BT_DBG("Received seqno %u from card", bcsp->rxseq_txack);
5857 +               bcsp->rxseq_txack++;
5858 +               bcsp->rxseq_txack %= 0x8;
5859 +               bcsp->txack_req    = 1;
5860 +
5861 +               /* If needed, transmit an ack pkt */
5862 +               hci_uart_tx_wakeup(hu);
5863 +       }
5864 +
5865 +       bcsp->rxack = (bcsp->rx_skb->data[0] >> 3) & 0x07;
5866 +       BT_DBG("Request for pkt %u from card", bcsp->rxack);
5867 +
5868 +       bcsp_pkt_cull(bcsp);
5869 +       if ((bcsp->rx_skb->data[1] & 0x0f) == 6 &&
5870 +                       bcsp->rx_skb->data[0] & 0x80) {
5871 +               bcsp->rx_skb->pkt_type = HCI_ACLDATA_PKT;
5872 +               pass_up = 1;
5873 +       } else if ((bcsp->rx_skb->data[1] & 0x0f) == 5 &&
5874 +                       bcsp->rx_skb->data[0] & 0x80) {
5875 +               bcsp->rx_skb->pkt_type = HCI_EVENT_PKT;
5876 +               pass_up = 1;
5877 +       } else if ((bcsp->rx_skb->data[1] & 0x0f) == 7) {
5878 +               bcsp->rx_skb->pkt_type = HCI_SCODATA_PKT;
5879 +               pass_up = 1;
5880 +       } else if ((bcsp->rx_skb->data[1] & 0x0f) == 1 &&
5881 +                       !(bcsp->rx_skb->data[0] & 0x80)) {
5882 +               bcsp_handle_le_pkt(hu);
5883 +               pass_up = 0;
5884 +       } else
5885 +               pass_up = 0;
5886 +
5887 +       if (!pass_up) {
5888 +               if ((bcsp->rx_skb->data[1] & 0x0f) != 0 &&
5889 +                       (bcsp->rx_skb->data[1] & 0x0f) != 1) {
5890 +                       BT_ERR ("Packet for unknown channel (%u %s)",
5891 +                               bcsp->rx_skb->data[1] & 0x0f,
5892 +                               bcsp->rx_skb->data[0] & 0x80 ?
5893 +                               "reliable" : "unreliable");
5894 +               }
5895 +               kfree_skb(bcsp->rx_skb);
5896 +       } else {
5897 +               /* Pull out BCSP hdr */
5898 +               skb_pull(bcsp->rx_skb, 4);
5899 +
5900 +               hci_recv_frame(bcsp->rx_skb);
5901 +       }
5902 +       bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
5903 +       bcsp->rx_skb = NULL;
5904 +}
5905 +
5906 +/* Recv data */
5907 +static int bcsp_recv(struct hci_uart *hu, void *data, int count)
5908 +{
5909 +       struct bcsp_struct *bcsp = hu->priv;
5910 +       register unsigned char *ptr;
5911 +
5912 +       BT_DBG("hu %p count %d rx_state %ld rx_count %ld",
5913 +               hu, count, bcsp->rx_state, bcsp->rx_count);
5914 +
5915 +       ptr = data;
5916 +       while (count) {
5917 +               if (bcsp->rx_count) {
5918 +                       if (*ptr == 0xc0) {
5919 +                               BT_ERR("Short BCSP packet");
5920 +                               kfree_skb(bcsp->rx_skb);
5921 +                               bcsp->rx_state = BCSP_W4_PKT_START;
5922 +                               bcsp->rx_count = 0;
5923 +                       } else
5924 +                               bcsp_unslip_one_byte(bcsp, *ptr);
5925 +
5926 +                       ptr++; count--;
5927 +                       continue;
5928 +               }
5929 +
5930 +               switch (bcsp->rx_state) {
5931 +               case BCSP_W4_BCSP_HDR:
5932 +                       if ((0xff & (u8) ~ (bcsp->rx_skb->data[0] + bcsp->rx_skb->data[1] +
5933 +                                       bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) {
5934 +                               BT_ERR("Error in BCSP hdr checksum");
5935 +                               kfree_skb(bcsp->rx_skb);
5936 +                               bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
5937 +                               bcsp->rx_count = 0;
5938 +                               continue;
5939 +                       }
5940 +                       if (bcsp->rx_skb->data[0] & 0x80        /* reliable pkt */
5941 +                                       && (bcsp->rx_skb->data[0] & 0x07) != bcsp->rxseq_txack) {
5942 +                               BT_ERR ("Out-of-order packet arrived, got %u expected %u",
5943 +                                       bcsp->rx_skb->data[0] & 0x07, bcsp->rxseq_txack);
5944 +
5945 +                               kfree_skb(bcsp->rx_skb);
5946 +                               bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
5947 +                               bcsp->rx_count = 0;
5948 +                               continue;
5949 +                       }
5950 +                       bcsp->rx_state = BCSP_W4_DATA;
5951 +                       bcsp->rx_count = (bcsp->rx_skb->data[1] >> 4) +
5952 +                                       (bcsp->rx_skb->data[2] << 4);   /* May be 0 */
5953 +                       continue;
5954 +
5955 +               case BCSP_W4_DATA:
5956 +                       if (bcsp->rx_skb->data[0] & 0x40) {     /* pkt with crc */
5957 +                               bcsp->rx_state = BCSP_W4_CRC;
5958 +                               bcsp->rx_count = 2;
5959 +                       } else
5960 +                               bcsp_complete_rx_pkt(hu);
5961 +                       continue;
5962 +
5963 +               case BCSP_W4_CRC:
5964 +                       if (bcsp_crc_reverse(bcsp->message_crc) !=
5965 +                                       (bcsp->rx_skb->data[bcsp->rx_skb->len - 2] << 8) +
5966 +                                       bcsp->rx_skb->data[bcsp->rx_skb->len - 1]) {
5967 +
5968 +                               BT_ERR ("Checksum failed: computed %04x received %04x",
5969 +                                       bcsp_crc_reverse(bcsp->message_crc),
5970 +                                       (bcsp->rx_skb-> data[bcsp->rx_skb->len - 2] << 8) +
5971 +                                       bcsp->rx_skb->data[bcsp->rx_skb->len - 1]);
5972 +
5973 +                               kfree_skb(bcsp->rx_skb);
5974 +                               bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
5975 +                               bcsp->rx_count = 0;
5976 +                               continue;
5977 +                       }
5978 +                       skb_trim(bcsp->rx_skb, bcsp->rx_skb->len - 2);
5979 +                       bcsp_complete_rx_pkt(hu);
5980 +                       continue;
5981 +
5982 +               case BCSP_W4_PKT_DELIMITER:
5983 +                       switch (*ptr) {
5984 +                       case 0xc0:
5985 +                               bcsp->rx_state = BCSP_W4_PKT_START;
5986 +                               break;
5987 +                       default:
5988 +                               /*BT_ERR("Ignoring byte %02x", *ptr);*/
5989 +                               break;
5990 +                       }
5991 +                       ptr++; count--;
5992 +                       break;
5993 +
5994 +               case BCSP_W4_PKT_START:
5995 +                       switch (*ptr) {
5996 +                       case 0xc0:
5997 +                               ptr++; count--;
5998 +                               break;
5999 +
6000 +                       default:
6001 +                               bcsp->rx_state = BCSP_W4_BCSP_HDR;
6002 +                               bcsp->rx_count = 4;
6003 +                               bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
6004 +                               BCSP_CRC_INIT(bcsp->message_crc);
6005 +
6006 +                               /* Do not increment ptr or decrement count
6007 +                                * Allocate packet. Max len of a BCSP pkt=
6008 +                                * 0xFFF (payload) +4 (header) +2 (crc) */
6009 +
6010 +                               bcsp->rx_skb = bluez_skb_alloc(0x1005, GFP_ATOMIC);
6011 +                               if (!bcsp->rx_skb) {
6012 +                                       BT_ERR("Can't allocate mem for new packet");
6013 +                                       bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
6014 +                                       bcsp->rx_count = 0;
6015 +                                       return 0;
6016 +                               }
6017 +                               bcsp->rx_skb->dev = (void *) &hu->hdev;
6018 +                               break;
6019 +                       }
6020 +                       break;
6021 +               }
6022 +       }
6023 +       return count;
6024 +}
6025 +
6026 +       /* Arrange to retransmit all messages in the relq. */
6027 +static void bcsp_timed_event(unsigned long arg)
6028 +{
6029 +       struct hci_uart *hu = (struct hci_uart *) arg;
6030 +       struct bcsp_struct *bcsp = (struct bcsp_struct *) hu->priv;
6031 +       struct sk_buff *skb;
6032 +       unsigned long flags;
6033 +
6034 +       BT_ERR("Timeout, retransmitting %u pkts", bcsp->unack.qlen);
6035 +       spin_lock_irqsave(&bcsp->unack.lock, flags);
6036 +
6037 +       while ((skb = __skb_dequeue_tail(&bcsp->unack)) != NULL) {
6038 +               bcsp->msgq_txseq = (bcsp->msgq_txseq - 1) & 0x07;
6039 +               skb_queue_head(&bcsp->rel, skb);
6040 +       }
6041 +
6042 +       spin_unlock_irqrestore(&bcsp->unack.lock, flags);
6043 +
6044 +       hci_uart_tx_wakeup(hu);
6045 +}
6046 +
6047 +static int bcsp_open(struct hci_uart *hu)
6048 +{
6049 +       struct bcsp_struct *bcsp;
6050 +
6051 +       BT_DBG("hu %p", hu);
6052 +
6053 +       bcsp = kmalloc(sizeof(*bcsp), GFP_ATOMIC);
6054 +       if (!bcsp)
6055 +               return -ENOMEM;
6056 +       memset(bcsp, 0, sizeof(*bcsp));
6057 +
6058 +       hu->priv = bcsp;
6059 +       skb_queue_head_init(&bcsp->unack);
6060 +       skb_queue_head_init(&bcsp->rel);
6061 +       skb_queue_head_init(&bcsp->unrel);
6062 +
6063 +       init_timer(&bcsp->tbcsp);
6064 +       bcsp->tbcsp.function = bcsp_timed_event;
6065 +       bcsp->tbcsp.data     = (u_long) hu;
6066 +
6067 +       bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
6068 +
6069 +       return 0;
6070 +}
6071 +
6072 +static int bcsp_close(struct hci_uart *hu)
6073 +{
6074 +       struct bcsp_struct *bcsp = hu->priv;
6075 +       hu->priv = NULL;
6076 +
6077 +       BT_DBG("hu %p", hu);
6078 +
6079 +       skb_queue_purge(&bcsp->unack);
6080 +       skb_queue_purge(&bcsp->rel);
6081 +       skb_queue_purge(&bcsp->unrel);
6082 +       del_timer(&bcsp->tbcsp);
6083 +
6084 +       kfree(bcsp);
6085 +       return 0;
6086 +}
6087 +
6088 +static struct hci_uart_proto bcsp = {
6089 +       id:      HCI_UART_BCSP,
6090 +       open:    bcsp_open,
6091 +       close:   bcsp_close,
6092 +       enqueue: bcsp_enqueue,
6093 +       dequeue: bcsp_dequeue,
6094 +       recv:    bcsp_recv,
6095 +       flush:   bcsp_flush
6096 +};
6097 +
6098 +int bcsp_init(void)
6099 +{
6100 +       return hci_uart_register_proto(&bcsp);
6101 +}
6102 +
6103 +int bcsp_deinit(void)
6104 +{
6105 +       return hci_uart_unregister_proto(&bcsp);
6106 +}
6107 diff -urN linux-2.4.18/drivers/bluetooth/hci_bcsp.h linux-2.4.18-mh9/drivers/bluetooth/hci_bcsp.h
6108 --- linux-2.4.18/drivers/bluetooth/hci_bcsp.h   Thu Jan  1 01:00:00 1970
6109 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_bcsp.h       Mon Aug 25 18:38:10 2003
6110 @@ -0,0 +1,70 @@
6111 +/*
6112 +   BlueCore Serial Protocol (BCSP) for Linux Bluetooth stack (BlueZ).
6113 +   Copyright 2002 by Fabrizio Gennari <fabrizio.gennari@philips.com>
6114 +
6115 +   Based on
6116 +       hci_h4.c  by Maxim Krasnyansky <maxk@qualcomm.com>
6117 +       ABCSP     by Carl Orsborn <cjo@csr.com>
6118 +
6119 +   This program is free software; you can redistribute it and/or modify
6120 +   it under the terms of the GNU General Public License version 2 as
6121 +   published by the Free Software Foundation;
6122 +
6123 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
6124 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
6125 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
6126 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
6127 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
6128 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
6129 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
6130 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
6131 +
6132 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
6133 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
6134 +   SOFTWARE IS DISCLAIMED.
6135 +*/
6136 +
6137 +/*
6138 + * $Id: hci_bcsp.h,v 1.2 2002/09/26 05:05:14 maxk Exp $
6139 + */
6140 +
6141 +#ifndef __HCI_BCSP_H__
6142 +#define __HCI_BCSP_H__
6143 +
6144 +#define BCSP_TXWINSIZE  4
6145 +
6146 +#define BCSP_ACK_PKT    0x05
6147 +#define BCSP_LE_PKT     0x06
6148 +
6149 +struct bcsp_struct {
6150 +       struct sk_buff_head unack;      /* Unack'ed packets queue */
6151 +       struct sk_buff_head rel;        /* Reliable packets queue */
6152 +       struct sk_buff_head unrel;      /* Unreliable packets queue */
6153 +
6154 +       unsigned long rx_count;
6155 +       struct  sk_buff *rx_skb;
6156 +       u8      rxseq_txack;            /* rxseq == txack. */
6157 +       u8      rxack;                  /* Last packet sent by us that the peer ack'ed */
6158 +       struct  timer_list tbcsp;
6159 +
6160 +       enum {
6161 +               BCSP_W4_PKT_DELIMITER,
6162 +               BCSP_W4_PKT_START,
6163 +               BCSP_W4_BCSP_HDR,
6164 +               BCSP_W4_DATA,
6165 +               BCSP_W4_CRC
6166 +       } rx_state;
6167 +
6168 +       enum {
6169 +               BCSP_ESCSTATE_NOESC,
6170 +               BCSP_ESCSTATE_ESC
6171 +       } rx_esc_state;
6172 +
6173 +       u16     message_crc;
6174 +       u8      txack_req;              /* Do we need to send ack's to the peer? */
6175 +
6176 +       /* Reliable packet sequence number - used to assign seq to each rel pkt. */
6177 +       u8      msgq_txseq;
6178 +};
6179 +
6180 +#endif /* __HCI_BCSP_H__ */
6181 diff -urN linux-2.4.18/drivers/bluetooth/hci_h4.c linux-2.4.18-mh9/drivers/bluetooth/hci_h4.c
6182 --- linux-2.4.18/drivers/bluetooth/hci_h4.c     Thu Jan  1 01:00:00 1970
6183 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_h4.c Mon Aug 25 18:38:10 2003
6184 @@ -0,0 +1,277 @@
6185 +/*
6186 +   BlueZ - Bluetooth protocol stack for Linux
6187 +   Copyright (C) 2000-2001 Qualcomm Incorporated
6188 +
6189 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6190 +
6191 +   This program is free software; you can redistribute it and/or modify
6192 +   it under the terms of the GNU General Public License version 2 as
6193 +   published by the Free Software Foundation;
6194 +
6195 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
6196 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
6197 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
6198 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
6199 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
6200 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
6201 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
6202 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
6203 +
6204 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
6205 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
6206 +   SOFTWARE IS DISCLAIMED.
6207 +*/
6208 +
6209 +/*
6210 + * BlueZ HCI UART(H4) protocol.
6211 + *
6212 + * $Id: hci_h4.c,v 1.3 2002/09/09 01:17:32 maxk Exp $
6213 + */
6214 +#define VERSION "1.2"
6215 +
6216 +#include <linux/config.h>
6217 +#include <linux/module.h>
6218 +
6219 +#include <linux/version.h>
6220 +#include <linux/kernel.h>
6221 +#include <linux/init.h>
6222 +#include <linux/sched.h>
6223 +#include <linux/types.h>
6224 +#include <linux/fcntl.h>
6225 +#include <linux/interrupt.h>
6226 +#include <linux/ptrace.h>
6227 +#include <linux/poll.h>
6228 +
6229 +#include <linux/slab.h>
6230 +#include <linux/tty.h>
6231 +#include <linux/errno.h>
6232 +#include <linux/string.h>
6233 +#include <linux/signal.h>
6234 +#include <linux/ioctl.h>
6235 +#include <linux/skbuff.h>
6236 +
6237 +#include <net/bluetooth/bluetooth.h>
6238 +#include <net/bluetooth/hci_core.h>
6239 +#include "hci_uart.h"
6240 +#include "hci_h4.h"
6241 +
6242 +#ifndef HCI_UART_DEBUG
6243 +#undef  BT_DBG
6244 +#define BT_DBG( A... )
6245 +#undef  BT_DMP
6246 +#define BT_DMP( A... )
6247 +#endif
6248 +
6249 +/* Initialize protocol */
6250 +static int h4_open(struct hci_uart *hu)
6251 +{
6252 +       struct h4_struct *h4;
6253 +
6254 +       BT_DBG("hu %p", hu);
6255 +
6256 +       h4 = kmalloc(sizeof(*h4), GFP_ATOMIC);
6257 +       if (!h4)
6258 +               return -ENOMEM;
6259 +       memset(h4, 0, sizeof(*h4));
6260 +
6261 +       skb_queue_head_init(&h4->txq);
6262 +
6263 +       hu->priv = h4;
6264 +       return 0;
6265 +}
6266 +
6267 +/* Flush protocol data */
6268 +static int h4_flush(struct hci_uart *hu)
6269 +{
6270 +       struct h4_struct *h4 = hu->priv;
6271 +
6272 +       BT_DBG("hu %p", hu);
6273 +       skb_queue_purge(&h4->txq);
6274 +       return 0;
6275 +}
6276 +
6277 +/* Close protocol */
6278 +static int h4_close(struct hci_uart *hu)
6279 +{
6280 +       struct h4_struct *h4 = hu->priv;
6281 +       hu->priv = NULL;
6282 +
6283 +       BT_DBG("hu %p", hu);
6284 +
6285 +       skb_queue_purge(&h4->txq);
6286 +       if (h4->rx_skb)
6287 +               kfree_skb(h4->rx_skb);
6288 +
6289 +       hu->priv = NULL;
6290 +       kfree(h4);
6291 +       return 0;
6292 +}
6293 +
6294 +/* Enqueue frame for transmittion (padding, crc, etc) */
6295 +static int h4_enqueue(struct hci_uart *hu, struct sk_buff *skb)
6296 +{
6297 +       struct h4_struct *h4 = hu->priv;
6298 +
6299 +       BT_DBG("hu %p skb %p", hu, skb);
6300 +
6301 +       /* Prepend skb with frame type */
6302 +       memcpy(skb_push(skb, 1), &skb->pkt_type, 1);
6303 +       skb_queue_tail(&h4->txq, skb);
6304 +       return 0;
6305 +}
6306 +
6307 +static inline int h4_check_data_len(struct h4_struct *h4, int len)
6308 +{
6309 +       register int room = skb_tailroom(h4->rx_skb);
6310 +
6311 +       BT_DBG("len %d room %d", len, room);
6312 +       if (!len) {
6313 +               BT_DMP(h4->rx_skb->data, h4->rx_skb->len);
6314 +               hci_recv_frame(h4->rx_skb);
6315 +       } else if (len > room) {
6316 +               BT_ERR("Data length is too large");
6317 +               kfree_skb(h4->rx_skb);
6318 +       } else {
6319 +               h4->rx_state = H4_W4_DATA;
6320 +               h4->rx_count = len;
6321 +               return len;
6322 +       }
6323 +
6324 +       h4->rx_state = H4_W4_PACKET_TYPE;
6325 +       h4->rx_skb   = NULL;
6326 +       h4->rx_count = 0;
6327 +       return 0;
6328 +}
6329 +
6330 +/* Recv data */
6331 +static int h4_recv(struct hci_uart *hu, void *data, int count)
6332 +{
6333 +       struct h4_struct *h4 = hu->priv;
6334 +       register char *ptr;
6335 +       hci_event_hdr *eh;
6336 +       hci_acl_hdr   *ah;
6337 +       hci_sco_hdr   *sh;
6338 +       register int len, type, dlen;
6339 +
6340 +       BT_DBG("hu %p count %d rx_state %ld rx_count %ld",
6341 +                       hu, count, h4->rx_state, h4->rx_count);
6342 +
6343 +       ptr = data;
6344 +       while (count) {
6345 +               if (h4->rx_count) {
6346 +                       len = MIN(h4->rx_count, count);
6347 +                       memcpy(skb_put(h4->rx_skb, len), ptr, len);
6348 +                       h4->rx_count -= len; count -= len; ptr += len;
6349 +
6350 +                       if (h4->rx_count)
6351 +                               continue;
6352 +
6353 +                       switch (h4->rx_state) {
6354 +                       case H4_W4_DATA:
6355 +                               BT_DBG("Complete data");
6356 +
6357 +                               BT_DMP(h4->rx_skb->data, h4->rx_skb->len);
6358 +
6359 +                               hci_recv_frame(h4->rx_skb);
6360 +
6361 +                               h4->rx_state = H4_W4_PACKET_TYPE;
6362 +                               h4->rx_skb = NULL;
6363 +                               continue;
6364 +
6365 +                       case H4_W4_EVENT_HDR:
6366 +                               eh = (hci_event_hdr *) h4->rx_skb->data;
6367 +
6368 +                               BT_DBG("Event header: evt 0x%2.2x plen %d", eh->evt, eh->plen);
6369 +
6370 +                               h4_check_data_len(h4, eh->plen);
6371 +                               continue;
6372 +
6373 +                       case H4_W4_ACL_HDR:
6374 +                               ah = (hci_acl_hdr *) h4->rx_skb->data;
6375 +                               dlen = __le16_to_cpu(ah->dlen);
6376 +
6377 +                               BT_DBG("ACL header: dlen %d", dlen);
6378 +
6379 +                               h4_check_data_len(h4, dlen);
6380 +                               continue;
6381 +
6382 +                       case H4_W4_SCO_HDR:
6383 +                               sh = (hci_sco_hdr *) h4->rx_skb->data;
6384 +
6385 +                               BT_DBG("SCO header: dlen %d", sh->dlen);
6386 +
6387 +                               h4_check_data_len(h4, sh->dlen);
6388 +                               continue;
6389 +                       }
6390 +               }
6391 +
6392 +               /* H4_W4_PACKET_TYPE */
6393 +               switch (*ptr) {
6394 +               case HCI_EVENT_PKT:
6395 +                       BT_DBG("Event packet");
6396 +                       h4->rx_state = H4_W4_EVENT_HDR;
6397 +                       h4->rx_count = HCI_EVENT_HDR_SIZE;
6398 +                       type = HCI_EVENT_PKT;
6399 +                       break;
6400 +
6401 +               case HCI_ACLDATA_PKT:
6402 +                       BT_DBG("ACL packet");
6403 +                       h4->rx_state = H4_W4_ACL_HDR;
6404 +                       h4->rx_count = HCI_ACL_HDR_SIZE;
6405 +                       type = HCI_ACLDATA_PKT;
6406 +                       break;
6407 +
6408 +               case HCI_SCODATA_PKT:
6409 +                       BT_DBG("SCO packet");
6410 +                       h4->rx_state = H4_W4_SCO_HDR;
6411 +                       h4->rx_count = HCI_SCO_HDR_SIZE;
6412 +                       type = HCI_SCODATA_PKT;
6413 +                       break;
6414 +
6415 +               default:
6416 +                       BT_ERR("Unknown HCI packet type %2.2x", (__u8)*ptr);
6417 +                       hu->hdev.stat.err_rx++;
6418 +                       ptr++; count--;
6419 +                       continue;
6420 +               };
6421 +               ptr++; count--;
6422 +
6423 +               /* Allocate packet */
6424 +               h4->rx_skb = bluez_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
6425 +               if (!h4->rx_skb) {
6426 +                       BT_ERR("Can't allocate mem for new packet");
6427 +                       h4->rx_state = H4_W4_PACKET_TYPE;
6428 +                       h4->rx_count = 0;
6429 +                       return 0;
6430 +               }
6431 +               h4->rx_skb->dev = (void *) &hu->hdev;
6432 +               h4->rx_skb->pkt_type = type;
6433 +       }
6434 +       return count;
6435 +}
6436 +
6437 +static struct sk_buff *h4_dequeue(struct hci_uart *hu)
6438 +{
6439 +       struct h4_struct *h4 = hu->priv;
6440 +       return skb_dequeue(&h4->txq);
6441 +}
6442 +
6443 +static struct hci_uart_proto h4p = {
6444 +       id:      HCI_UART_H4,
6445 +       open:    h4_open,
6446 +       close:   h4_close,
6447 +       recv:    h4_recv,
6448 +       enqueue: h4_enqueue,
6449 +       dequeue: h4_dequeue,
6450 +       flush:   h4_flush,
6451 +};
6452 +
6453 +int h4_init(void)
6454 +{
6455 +       return hci_uart_register_proto(&h4p);
6456 +}
6457 +
6458 +int h4_deinit(void)
6459 +{
6460 +       return hci_uart_unregister_proto(&h4p);
6461 +}
6462 diff -urN linux-2.4.18/drivers/bluetooth/hci_h4.h linux-2.4.18-mh9/drivers/bluetooth/hci_h4.h
6463 --- linux-2.4.18/drivers/bluetooth/hci_h4.h     Thu Jan  1 01:00:00 1970
6464 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_h4.h Mon Aug 25 18:38:10 2003
6465 @@ -0,0 +1,44 @@
6466 +/*
6467 +   BlueZ - Bluetooth protocol stack for Linux
6468 +   Copyright (C) 2000-2001 Qualcomm Incorporated
6469 +
6470 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6471 +
6472 +   This program is free software; you can redistribute it and/or modify
6473 +   it under the terms of the GNU General Public License version 2 as
6474 +   published by the Free Software Foundation;
6475 +
6476 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
6477 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
6478 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
6479 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
6480 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
6481 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
6482 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
6483 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
6484 +
6485 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
6486 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
6487 +   SOFTWARE IS DISCLAIMED.
6488 +*/
6489 +
6490 +/*
6491 + * $Id: hci_h4.h,v 1.2 2002/09/09 01:17:32 maxk Exp $
6492 + */
6493 +
6494 +#ifdef __KERNEL__
6495 +struct h4_struct {
6496 +       unsigned long rx_state;
6497 +       unsigned long rx_count;
6498 +       struct sk_buff *rx_skb;
6499 +       struct sk_buff_head txq;
6500 +};
6501 +
6502 +/* H4 receiver States */
6503 +#define H4_W4_PACKET_TYPE 0
6504 +#define H4_W4_EVENT_HDR          1
6505 +#define H4_W4_ACL_HDR     2
6506 +#define H4_W4_SCO_HDR     3
6507 +#define H4_W4_DATA        4
6508 +
6509 +#endif /* __KERNEL__ */
6510 diff -urN linux-2.4.18/drivers/bluetooth/hci_ldisc.c linux-2.4.18-mh9/drivers/bluetooth/hci_ldisc.c
6511 --- linux-2.4.18/drivers/bluetooth/hci_ldisc.c  Thu Jan  1 01:00:00 1970
6512 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_ldisc.c      Mon Aug 25 18:38:10 2003
6513 @@ -0,0 +1,580 @@
6514 +/*
6515 +   BlueZ - Bluetooth protocol stack for Linux
6516 +   Copyright (C) 2000-2001 Qualcomm Incorporated
6517 +
6518 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6519 +
6520 +   This program is free software; you can redistribute it and/or modify
6521 +   it under the terms of the GNU General Public License version 2 as
6522 +   published by the Free Software Foundation;
6523 +
6524 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
6525 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
6526 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
6527 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
6528 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
6529 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
6530 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
6531 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
6532 +
6533 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
6534 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
6535 +   SOFTWARE IS DISCLAIMED.
6536 +*/
6537 +
6538 +/*
6539 + * BlueZ HCI UART driver.
6540 + *
6541 + * $Id: hci_ldisc.c,v 1.5 2002/10/02 18:37:20 maxk Exp $
6542 + */
6543 +#define VERSION "2.1"
6544 +
6545 +#include <linux/config.h>
6546 +#include <linux/module.h>
6547 +
6548 +#include <linux/version.h>
6549 +#include <linux/config.h>
6550 +#include <linux/kernel.h>
6551 +#include <linux/init.h>
6552 +#include <linux/sched.h>
6553 +#include <linux/types.h>
6554 +#include <linux/fcntl.h>
6555 +#include <linux/interrupt.h>
6556 +#include <linux/ptrace.h>
6557 +#include <linux/poll.h>
6558 +
6559 +#include <linux/slab.h>
6560 +#include <linux/tty.h>
6561 +#include <linux/errno.h>
6562 +#include <linux/string.h>
6563 +#include <linux/signal.h>
6564 +#include <linux/ioctl.h>
6565 +#include <linux/skbuff.h>
6566 +
6567 +#include <net/bluetooth/bluetooth.h>
6568 +#include <net/bluetooth/hci_core.h>
6569 +#include "hci_uart.h"
6570 +
6571 +#ifndef HCI_UART_DEBUG
6572 +#undef  BT_DBG
6573 +#define BT_DBG( A... )
6574 +#undef  BT_DMP
6575 +#define BT_DMP( A... )
6576 +#endif
6577 +
6578 +static struct hci_uart_proto *hup[HCI_UART_MAX_PROTO];
6579 +
6580 +int hci_uart_register_proto(struct hci_uart_proto *p)
6581 +{
6582 +       if (p->id >= HCI_UART_MAX_PROTO)
6583 +               return -EINVAL;
6584 +
6585 +       if (hup[p->id])
6586 +               return -EEXIST;
6587 +
6588 +       hup[p->id] = p;
6589 +       return 0;
6590 +}
6591 +
6592 +int hci_uart_unregister_proto(struct hci_uart_proto *p)
6593 +{
6594 +       if (p->id >= HCI_UART_MAX_PROTO)
6595 +               return -EINVAL;
6596 +
6597 +       if (!hup[p->id])
6598 +               return -EINVAL;
6599 +
6600 +       hup[p->id] = NULL;
6601 +       return 0;
6602 +}
6603 +
6604 +static struct hci_uart_proto *hci_uart_get_proto(unsigned int id)
6605 +{
6606 +       if (id >= HCI_UART_MAX_PROTO)
6607 +               return NULL;
6608 +       return hup[id];
6609 +}
6610 +
6611 +static inline void hci_uart_tx_complete(struct hci_uart *hu, int pkt_type)
6612 +{
6613 +       struct hci_dev *hdev = &hu->hdev;
6614 +
6615 +       /* Update HCI stat counters */
6616 +       switch (pkt_type) {
6617 +       case HCI_COMMAND_PKT:
6618 +               hdev->stat.cmd_tx++;
6619 +               break;
6620 +
6621 +       case HCI_ACLDATA_PKT:
6622 +               hdev->stat.acl_tx++;
6623 +               break;
6624 +
6625 +       case HCI_SCODATA_PKT:
6626 +               hdev->stat.cmd_tx++;
6627 +               break;
6628 +       }
6629 +}
6630 +
6631 +static inline struct sk_buff *hci_uart_dequeue(struct hci_uart *hu)
6632 +{
6633 +       struct sk_buff *skb = hu->tx_skb;
6634 +       if (!skb)
6635 +               skb = hu->proto->dequeue(hu);
6636 +       else
6637 +               hu->tx_skb = NULL;
6638 +       return skb;
6639 +}
6640 +
6641 +int hci_uart_tx_wakeup(struct hci_uart *hu)
6642 +{
6643 +       struct tty_struct *tty = hu->tty;
6644 +       struct hci_dev *hdev = &hu->hdev;
6645 +       struct sk_buff *skb;
6646 +
6647 +       if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) {
6648 +               set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
6649 +               return 0;
6650 +       }
6651 +
6652 +       BT_DBG("");
6653 +
6654 +restart:
6655 +       clear_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
6656 +
6657 +       while ((skb = hci_uart_dequeue(hu))) {
6658 +               int len;
6659 +
6660 +               set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
6661 +               len = tty->driver.write(tty, 0, skb->data, skb->len);
6662 +               hdev->stat.byte_tx += len;
6663 +
6664 +               skb_pull(skb, len);
6665 +               if (skb->len) {
6666 +                       hu->tx_skb = skb;
6667 +                       break;
6668 +               }
6669 +
6670 +               hci_uart_tx_complete(hu, skb->pkt_type);
6671 +               kfree_skb(skb);
6672 +       }
6673 +
6674 +       if (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state))
6675 +               goto restart;
6676 +
6677 +       clear_bit(HCI_UART_SENDING, &hu->tx_state);
6678 +       return 0;
6679 +}
6680 +
6681 +/* ------- Interface to HCI layer ------ */
6682 +/* Initialize device */
6683 +static int hci_uart_open(struct hci_dev *hdev)
6684 +{
6685 +       BT_DBG("%s %p", hdev->name, hdev);
6686 +
6687 +       /* Nothing to do for UART driver */
6688 +
6689 +       set_bit(HCI_RUNNING, &hdev->flags);
6690 +       return 0;
6691 +}
6692 +
6693 +/* Reset device */
6694 +static int hci_uart_flush(struct hci_dev *hdev)
6695 +{
6696 +       struct hci_uart *hu  = (struct hci_uart *) hdev->driver_data;
6697 +       struct tty_struct *tty = hu->tty;
6698 +
6699 +       BT_DBG("hdev %p tty %p", hdev, tty);
6700 +
6701 +       if (hu->tx_skb) {
6702 +               kfree_skb(hu->tx_skb); hu->tx_skb = NULL;
6703 +       }
6704 +
6705 +       /* Flush any pending characters in the driver and discipline. */
6706 +       if (tty->ldisc.flush_buffer)
6707 +               tty->ldisc.flush_buffer(tty);
6708 +
6709 +       if (tty->driver.flush_buffer)
6710 +               tty->driver.flush_buffer(tty);
6711 +
6712 +       if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
6713 +               hu->proto->flush(hu);
6714 +
6715 +       return 0;
6716 +}
6717 +
6718 +/* Close device */
6719 +static int hci_uart_close(struct hci_dev *hdev)
6720 +{
6721 +       BT_DBG("hdev %p", hdev);
6722 +
6723 +       if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
6724 +               return 0;
6725 +
6726 +       hci_uart_flush(hdev);
6727 +       return 0;
6728 +}
6729 +
6730 +/* Send frames from HCI layer */
6731 +static int hci_uart_send_frame(struct sk_buff *skb)
6732 +{
6733 +       struct hci_dev* hdev = (struct hci_dev *) skb->dev;
6734 +       struct tty_struct *tty;
6735 +       struct hci_uart *hu;
6736 +
6737 +       if (!hdev) {
6738 +               BT_ERR("Frame for uknown device (hdev=NULL)");
6739 +               return -ENODEV;
6740 +       }
6741 +
6742 +       if (!test_bit(HCI_RUNNING, &hdev->flags))
6743 +               return -EBUSY;
6744 +
6745 +       hu = (struct hci_uart *) hdev->driver_data;
6746 +       tty = hu->tty;
6747 +
6748 +       BT_DBG("%s: type %d len %d", hdev->name, skb->pkt_type, skb->len);
6749 +
6750 +       hu->proto->enqueue(hu, skb);
6751 +
6752 +       hci_uart_tx_wakeup(hu);
6753 +       return 0;
6754 +}
6755 +
6756 +static void hci_uart_destruct(struct hci_dev *hdev)
6757 +{
6758 +       struct hci_uart *hu;
6759 +
6760 +       if (!hdev) return;
6761 +
6762 +       BT_DBG("%s", hdev->name);
6763 +
6764 +       hu = (struct hci_uart *) hdev->driver_data;
6765 +       kfree(hu);
6766 +
6767 +       MOD_DEC_USE_COUNT;
6768 +}
6769 +
6770 +/* ------ LDISC part ------ */
6771 +/* hci_uart_tty_open
6772 + *
6773 + *     Called when line discipline changed to HCI_UART.
6774 + *
6775 + * Arguments:
6776 + *     tty    pointer to tty info structure
6777 + * Return Value:
6778 + *     0 if success, otherwise error code
6779 + */
6780 +static int hci_uart_tty_open(struct tty_struct *tty)
6781 +{
6782 +       struct hci_uart *hu = (void *) tty->disc_data;
6783 +
6784 +       BT_DBG("tty %p", tty);
6785 +
6786 +       if (hu)
6787 +               return -EEXIST;
6788 +
6789 +       if (!(hu = kmalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
6790 +               BT_ERR("Can't allocate controll structure");
6791 +               return -ENFILE;
6792 +       }
6793 +       memset(hu, 0, sizeof(struct hci_uart));
6794 +
6795 +       tty->disc_data = hu;
6796 +       hu->tty = tty;
6797 +
6798 +       spin_lock_init(&hu->rx_lock);
6799 +
6800 +       /* Flush any pending characters in the driver and line discipline */
6801 +       if (tty->ldisc.flush_buffer)
6802 +               tty->ldisc.flush_buffer(tty);
6803 +
6804 +       if (tty->driver.flush_buffer)
6805 +               tty->driver.flush_buffer(tty);
6806 +
6807 +       MOD_INC_USE_COUNT;
6808 +       return 0;
6809 +}
6810 +
6811 +/* hci_uart_tty_close()
6812 + *
6813 + *    Called when the line discipline is changed to something
6814 + *    else, the tty is closed, or the tty detects a hangup.
6815 + */
6816 +static void hci_uart_tty_close(struct tty_struct *tty)
6817 +{
6818 +       struct hci_uart *hu = (void *)tty->disc_data;
6819 +
6820 +       BT_DBG("tty %p", tty);
6821 +
6822 +       /* Detach from the tty */
6823 +       tty->disc_data = NULL;
6824 +
6825 +       if (hu) {
6826 +               struct hci_dev *hdev = &hu->hdev;
6827 +               hci_uart_close(hdev);
6828 +
6829 +               if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
6830 +                       hu->proto->close(hu);
6831 +                       hci_unregister_dev(hdev);
6832 +               }
6833 +
6834 +               MOD_DEC_USE_COUNT;
6835 +       }
6836 +}
6837 +
6838 +/* hci_uart_tty_wakeup()
6839 + *
6840 + *    Callback for transmit wakeup. Called when low level
6841 + *    device driver can accept more send data.
6842 + *
6843 + * Arguments:        tty    pointer to associated tty instance data
6844 + * Return Value:    None
6845 + */
6846 +static void hci_uart_tty_wakeup(struct tty_struct *tty)
6847 +{
6848 +       struct hci_uart *hu = (void *)tty->disc_data;
6849 +
6850 +       BT_DBG("");
6851 +
6852 +       if (!hu)
6853 +               return;
6854 +
6855 +       clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
6856 +
6857 +       if (tty != hu->tty)
6858 +               return;
6859 +
6860 +       if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
6861 +               hci_uart_tx_wakeup(hu);
6862 +}
6863 +
6864 +/* hci_uart_tty_room()
6865 + *
6866 + *    Callback function from tty driver. Return the amount of
6867 + *    space left in the receiver's buffer to decide if remote
6868 + *    transmitter is to be throttled.
6869 + *
6870 + * Arguments:        tty    pointer to associated tty instance data
6871 + * Return Value:    number of bytes left in receive buffer
6872 + */
6873 +static int hci_uart_tty_room (struct tty_struct *tty)
6874 +{
6875 +       return 65536;
6876 +}
6877 +
6878 +/* hci_uart_tty_receive()
6879 + *
6880 + *     Called by tty low level driver when receive data is
6881 + *     available.
6882 + *
6883 + * Arguments:  tty          pointer to tty isntance data
6884 + *             data         pointer to received data
6885 + *             flags        pointer to flags for data
6886 + *             count        count of received data in bytes
6887 + *
6888 + * Return Value:    None
6889 + */
6890 +static void hci_uart_tty_receive(struct tty_struct *tty, const __u8 *data, char *flags, int count)
6891 +{
6892 +       struct hci_uart *hu = (void *)tty->disc_data;
6893 +
6894 +       if (!hu || tty != hu->tty)
6895 +               return;
6896 +
6897 +       if (!test_bit(HCI_UART_PROTO_SET, &hu->flags))
6898 +               return;
6899 +
6900 +       spin_lock(&hu->rx_lock);
6901 +       hu->proto->recv(hu, (void *) data, count);
6902 +       hu->hdev.stat.byte_rx += count;
6903 +       spin_unlock(&hu->rx_lock);
6904 +
6905 +       if (test_and_clear_bit(TTY_THROTTLED,&tty->flags) && tty->driver.unthrottle)
6906 +               tty->driver.unthrottle(tty);
6907 +}
6908 +
6909 +static int hci_uart_register_dev(struct hci_uart *hu)
6910 +{
6911 +       struct hci_dev *hdev;
6912 +
6913 +       BT_DBG("");
6914 +
6915 +       /* Initialize and register HCI device */
6916 +       hdev = &hu->hdev;
6917 +
6918 +       hdev->type = HCI_UART;
6919 +       hdev->driver_data = hu;
6920 +
6921 +       hdev->open  = hci_uart_open;
6922 +       hdev->close = hci_uart_close;
6923 +       hdev->flush = hci_uart_flush;
6924 +       hdev->send  = hci_uart_send_frame;
6925 +       hdev->destruct = hci_uart_destruct;
6926 +
6927 +       if (hci_register_dev(hdev) < 0) {
6928 +               BT_ERR("Can't register HCI device %s", hdev->name);
6929 +               return -ENODEV;
6930 +       }
6931 +       MOD_INC_USE_COUNT;
6932 +       return 0;
6933 +}
6934 +
6935 +static int hci_uart_set_proto(struct hci_uart *hu, int id)
6936 +{
6937 +       struct hci_uart_proto *p;
6938 +       int err;
6939 +
6940 +       p = hci_uart_get_proto(id);
6941 +       if (!p)
6942 +               return -EPROTONOSUPPORT;
6943 +
6944 +       err = p->open(hu);
6945 +       if (err)
6946 +               return err;
6947 +
6948 +       hu->proto = p;
6949 +
6950 +       err = hci_uart_register_dev(hu);
6951 +       if (err) {
6952 +               p->close(hu);
6953 +               return err;
6954 +       }
6955 +       return 0;
6956 +}
6957 +
6958 +/* hci_uart_tty_ioctl()
6959 + *
6960 + *    Process IOCTL system call for the tty device.
6961 + *
6962 + * Arguments:
6963 + *
6964 + *    tty        pointer to tty instance data
6965 + *    file       pointer to open file object for device
6966 + *    cmd        IOCTL command code
6967 + *    arg        argument for IOCTL call (cmd dependent)
6968 + *
6969 + * Return Value:    Command dependent
6970 + */
6971 +static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file * file,
6972 +                            unsigned int cmd, unsigned long arg)
6973 +{
6974 +       struct hci_uart *hu = (void *)tty->disc_data;
6975 +       int err = 0;
6976 +
6977 +       BT_DBG("");
6978 +
6979 +       /* Verify the status of the device */
6980 +       if (!hu)
6981 +               return -EBADF;
6982 +
6983 +       switch (cmd) {
6984 +       case HCIUARTSETPROTO:
6985 +               if (!test_and_set_bit(HCI_UART_PROTO_SET, &hu->flags)) {
6986 +                       err = hci_uart_set_proto(hu, arg);
6987 +                       if (err) {
6988 +                               clear_bit(HCI_UART_PROTO_SET, &hu->flags);
6989 +                               return err;
6990 +                       }
6991 +                       tty->low_latency = 1;
6992 +               } else
6993 +                       return -EBUSY;
6994 +
6995 +       case HCIUARTGETPROTO:
6996 +               if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
6997 +                       return hu->proto->id;
6998 +               return -EUNATCH;
6999 +
7000 +       default:
7001 +               err = n_tty_ioctl(tty, file, cmd, arg);
7002 +               break;
7003 +       };
7004 +
7005 +       return err;
7006 +}
7007 +
7008 +/*
7009 + * We don't provide read/write/poll interface for user space.
7010 + */
7011 +static ssize_t hci_uart_tty_read(struct tty_struct *tty, struct file *file, unsigned char *buf, size_t nr)
7012 +{
7013 +       return 0;
7014 +}
7015 +static ssize_t hci_uart_tty_write(struct tty_struct *tty, struct file *file, const unsigned char *data, size_t count)
7016 +{
7017 +       return 0;
7018 +}
7019 +static unsigned int hci_uart_tty_poll(struct tty_struct *tty, struct file *filp, poll_table *wait)
7020 +{
7021 +       return 0;
7022 +}
7023 +
7024 +#ifdef CONFIG_BLUEZ_HCIUART_H4
7025 +int h4_init(void);
7026 +int h4_deinit(void);
7027 +#endif
7028 +#ifdef CONFIG_BLUEZ_HCIUART_BCSP
7029 +int bcsp_init(void);
7030 +int bcsp_deinit(void);
7031 +#endif
7032 +
7033 +int __init hci_uart_init(void)
7034 +{
7035 +       static struct tty_ldisc hci_uart_ldisc;
7036 +       int err;
7037 +
7038 +       BT_INFO("BlueZ HCI UART driver ver %s Copyright (C) 2000,2001 Qualcomm Inc",
7039 +               VERSION);
7040 +       BT_INFO("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
7041 +
7042 +       /* Register the tty discipline */
7043 +
7044 +       memset(&hci_uart_ldisc, 0, sizeof (hci_uart_ldisc));
7045 +       hci_uart_ldisc.magic       = TTY_LDISC_MAGIC;
7046 +       hci_uart_ldisc.name        = "n_hci";
7047 +       hci_uart_ldisc.open        = hci_uart_tty_open;
7048 +       hci_uart_ldisc.close       = hci_uart_tty_close;
7049 +       hci_uart_ldisc.read        = hci_uart_tty_read;
7050 +       hci_uart_ldisc.write       = hci_uart_tty_write;
7051 +       hci_uart_ldisc.ioctl       = hci_uart_tty_ioctl;
7052 +       hci_uart_ldisc.poll        = hci_uart_tty_poll;
7053 +       hci_uart_ldisc.receive_room= hci_uart_tty_room;
7054 +       hci_uart_ldisc.receive_buf = hci_uart_tty_receive;
7055 +       hci_uart_ldisc.write_wakeup= hci_uart_tty_wakeup;
7056 +
7057 +       if ((err = tty_register_ldisc(N_HCI, &hci_uart_ldisc))) {
7058 +               BT_ERR("Can't register HCI line discipline (%d)", err);
7059 +               return err;
7060 +       }
7061 +
7062 +#ifdef CONFIG_BLUEZ_HCIUART_H4
7063 +       h4_init();
7064 +#endif
7065 +#ifdef CONFIG_BLUEZ_HCIUART_BCSP
7066 +       bcsp_init();
7067 +#endif
7068 +
7069 +       return 0;
7070 +}
7071 +
7072 +void hci_uart_cleanup(void)
7073 +{
7074 +       int err;
7075 +
7076 +#ifdef CONFIG_BLUEZ_HCIUART_H4
7077 +       h4_deinit();
7078 +#endif
7079 +#ifdef CONFIG_BLUEZ_HCIUART_BCSP
7080 +       bcsp_deinit();
7081 +#endif
7082 +
7083 +       /* Release tty registration of line discipline */
7084 +       if ((err = tty_register_ldisc(N_HCI, NULL)))
7085 +               BT_ERR("Can't unregister HCI line discipline (%d)", err);
7086 +}
7087 +
7088 +module_init(hci_uart_init);
7089 +module_exit(hci_uart_cleanup);
7090 +
7091 +MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
7092 +MODULE_DESCRIPTION("BlueZ HCI UART driver ver " VERSION);
7093 +MODULE_LICENSE("GPL");
7094 diff -urN linux-2.4.18/drivers/bluetooth/hci_uart.c linux-2.4.18-mh9/drivers/bluetooth/hci_uart.c
7095 --- linux-2.4.18/drivers/bluetooth/hci_uart.c   Fri Sep  7 18:28:38 2001
7096 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_uart.c       Thu Jan  1 01:00:00 1970
7097 @@ -1,580 +0,0 @@
7098 -/*
7099 -   BlueZ - Bluetooth protocol stack for Linux
7100 -   Copyright (C) 2000-2001 Qualcomm Incorporated
7101 -
7102 -   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7103 -
7104 -   This program is free software; you can redistribute it and/or modify
7105 -   it under the terms of the GNU General Public License version 2 as
7106 -   published by the Free Software Foundation;
7107 -
7108 -   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
7109 -   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
7110 -   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
7111 -   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
7112 -   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
7113 -   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
7114 -   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
7115 -   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
7116 -
7117 -   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
7118 -   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
7119 -   SOFTWARE IS DISCLAIMED.
7120 -*/
7121 -
7122 -/*
7123 - * BlueZ HCI UART driver.
7124 - *
7125 - * $Id: hci_uart.c,v 1.5 2001/07/05 18:42:44 maxk Exp $
7126 - */
7127 -#define VERSION "1.0"
7128 -
7129 -#include <linux/config.h>
7130 -#include <linux/module.h>
7131 -
7132 -#include <linux/version.h>
7133 -#include <linux/config.h>
7134 -#include <linux/kernel.h>
7135 -#include <linux/init.h>
7136 -#include <linux/sched.h>
7137 -#include <linux/types.h>
7138 -#include <linux/fcntl.h>
7139 -#include <linux/interrupt.h>
7140 -#include <linux/ptrace.h>
7141 -#include <linux/poll.h>
7142 -
7143 -#include <linux/slab.h>
7144 -#include <linux/tty.h>
7145 -#include <linux/errno.h>
7146 -#include <linux/string.h>
7147 -#include <linux/signal.h>
7148 -#include <linux/ioctl.h>
7149 -#include <linux/skbuff.h>
7150 -
7151 -#include <net/bluetooth/bluetooth.h>
7152 -#include <net/bluetooth/bluez.h>
7153 -#include <net/bluetooth/hci_core.h>
7154 -#include <net/bluetooth/hci_uart.h>
7155 -
7156 -#ifndef HCI_UART_DEBUG
7157 -#undef  DBG
7158 -#define DBG( A... )
7159 -#undef  DMP
7160 -#define DMP( A... )
7161 -#endif
7162 -
7163 -/* ------- Interface to HCI layer ------ */
7164 -/* Initialize device */
7165 -int n_hci_open(struct hci_dev *hdev)
7166 -{
7167 -       DBG("%s %p", hdev->name, hdev);
7168 -
7169 -       /* Nothing to do for UART driver */
7170 -
7171 -       hdev->flags |= HCI_RUNNING;
7172 -
7173 -       return 0;
7174 -}
7175 -
7176 -/* Reset device */
7177 -int n_hci_flush(struct hci_dev *hdev)
7178 -{
7179 -       struct n_hci *n_hci  = (struct n_hci *) hdev->driver_data;
7180 -       struct tty_struct *tty = n_hci->tty;
7181 -
7182 -       DBG("hdev %p tty %p", hdev, tty);
7183 -
7184 -       /* Drop TX queue */
7185 -       skb_queue_purge(&n_hci->txq);
7186 -
7187 -       /* Flush any pending characters in the driver and discipline. */
7188 -       if (tty->ldisc.flush_buffer)
7189 -               tty->ldisc.flush_buffer(tty);
7190 -
7191 -       if (tty->driver.flush_buffer)
7192 -               tty->driver.flush_buffer(tty);
7193 -
7194 -       return 0;
7195 -}
7196 -
7197 -/* Close device */
7198 -int n_hci_close(struct hci_dev *hdev)
7199 -{
7200 -       DBG("hdev %p", hdev);
7201 -
7202 -       hdev->flags &= ~HCI_RUNNING;
7203 -
7204 -       n_hci_flush(hdev);
7205 -
7206 -       return 0;
7207 -}
7208 -
7209 -int n_hci_tx_wakeup(struct n_hci *n_hci)
7210 -{
7211 -       register struct tty_struct *tty = n_hci->tty;
7212 -
7213 -       if (test_and_set_bit(TRANS_SENDING, &n_hci->tx_state)) {
7214 -               set_bit(TRANS_WAKEUP, &n_hci->tx_state);
7215 -               return 0;
7216 -       }
7217 -
7218 -       DBG("");
7219 -       do {
7220 -               register struct sk_buff *skb;
7221 -               register int len;
7222 -
7223 -               clear_bit(TRANS_WAKEUP, &n_hci->tx_state);
7224 -
7225 -               if (!(skb = skb_dequeue(&n_hci->txq)))
7226 -                       break;
7227 -
7228 -               DMP(skb->data, skb->len);
7229 -
7230 -               /* Send frame to TTY driver */
7231 -               tty->flags |= (1 << TTY_DO_WRITE_WAKEUP);
7232 -               len = tty->driver.write(tty, 0, skb->data, skb->len);
7233 -
7234 -               n_hci->hdev.stat.byte_tx += len;
7235 -
7236 -               DBG("sent %d", len);
7237 -
7238 -               if (len == skb->len) {
7239 -                       /* Full frame was sent */
7240 -                       kfree_skb(skb);
7241 -               } else {
7242 -                       /* Subtract sent part and requeue  */
7243 -                       skb_pull(skb, len);
7244 -                       skb_queue_head(&n_hci->txq, skb);
7245 -               }
7246 -       } while (test_bit(TRANS_WAKEUP, &n_hci->tx_state));
7247 -       clear_bit(TRANS_SENDING, &n_hci->tx_state);
7248 -
7249 -       return 0;
7250 -}
7251 -
7252 -/* Send frames from HCI layer */
7253 -int n_hci_send_frame(struct sk_buff *skb)
7254 -{
7255 -       struct hci_dev* hdev = (struct hci_dev *) skb->dev;
7256 -       struct tty_struct *tty;
7257 -       struct n_hci *n_hci;
7258 -
7259 -       if (!hdev) {
7260 -               ERR("Frame for uknown device (hdev=NULL)");
7261 -               return -ENODEV;
7262 -       }
7263 -
7264 -       if (!(hdev->flags & HCI_RUNNING))
7265 -               return -EBUSY;
7266 -
7267 -       n_hci = (struct n_hci *) hdev->driver_data;
7268 -       tty = n_hci2tty(n_hci);
7269 -
7270 -       DBG("%s: type %d len %d", hdev->name, skb->pkt_type, skb->len);
7271 -
7272 -       switch (skb->pkt_type) {
7273 -               case HCI_COMMAND_PKT:
7274 -                       hdev->stat.cmd_tx++;
7275 -                       break;
7276 -
7277 -                case HCI_ACLDATA_PKT:
7278 -                       hdev->stat.acl_tx++;
7279 -                        break;
7280 -
7281 -               case HCI_SCODATA_PKT:
7282 -                       hdev->stat.cmd_tx++;
7283 -                        break;
7284 -       };
7285 -
7286 -       /* Prepend skb with frame type and queue */
7287 -       memcpy(skb_push(skb, 1), &skb->pkt_type, 1);
7288 -       skb_queue_tail(&n_hci->txq, skb);
7289 -
7290 -       n_hci_tx_wakeup(n_hci);
7291 -
7292 -       return 0;
7293 -}
7294 -
7295 -/* ------ LDISC part ------ */
7296 -
7297 -/* n_hci_tty_open
7298 - *
7299 - *     Called when line discipline changed to N_HCI.
7300 - *
7301 - * Arguments:
7302 - *     tty    pointer to tty info structure
7303 - * Return Value:
7304 - *     0 if success, otherwise error code
7305 - */
7306 -static int n_hci_tty_open(struct tty_struct *tty)
7307 -{
7308 -       struct n_hci *n_hci = tty2n_hci(tty);
7309 -       struct hci_dev *hdev;
7310 -
7311 -       DBG("tty %p", tty);
7312 -
7313 -       if (n_hci)
7314 -               return -EEXIST;
7315 -
7316 -       if (!(n_hci = kmalloc(sizeof(struct n_hci), GFP_KERNEL))) {
7317 -               ERR("Can't allocate controll structure");
7318 -               return -ENFILE;
7319 -       }
7320 -       memset(n_hci, 0, sizeof(struct n_hci));
7321 -
7322 -       /* Initialize and register HCI device */
7323 -       hdev = &n_hci->hdev;
7324 -
7325 -       hdev->type = HCI_UART;
7326 -       hdev->driver_data = n_hci;
7327 -
7328 -       hdev->open  = n_hci_open;
7329 -       hdev->close = n_hci_close;
7330 -       hdev->flush = n_hci_flush;
7331 -       hdev->send  = n_hci_send_frame;
7332 -
7333 -       if (hci_register_dev(hdev) < 0) {
7334 -               ERR("Can't register HCI device %s", hdev->name);
7335 -               kfree(n_hci);
7336 -               return -ENODEV;
7337 -       }
7338 -
7339 -       tty->disc_data = n_hci;
7340 -       n_hci->tty = tty;
7341 -
7342 -       spin_lock_init(&n_hci->rx_lock);
7343 -       n_hci->rx_state = WAIT_PACKET_TYPE;
7344 -
7345 -       skb_queue_head_init(&n_hci->txq);
7346 -
7347 -       MOD_INC_USE_COUNT;
7348 -
7349 -       /* Flush any pending characters in the driver and discipline. */
7350 -       if (tty->ldisc.flush_buffer)
7351 -               tty->ldisc.flush_buffer(tty);
7352 -
7353 -       if (tty->driver.flush_buffer)
7354 -               tty->driver.flush_buffer(tty);
7355 -
7356 -       return 0;
7357 -}
7358 -
7359 -/* n_hci_tty_close()
7360 - *
7361 - *    Called when the line discipline is changed to something
7362 - *    else, the tty is closed, or the tty detects a hangup.
7363 - */
7364 -static void n_hci_tty_close(struct tty_struct *tty)
7365 -{
7366 -       struct n_hci *n_hci = tty2n_hci(tty);
7367 -       struct hci_dev *hdev = &n_hci->hdev;
7368 -
7369 -       DBG("tty %p hdev %p", tty, hdev);
7370 -
7371 -       if (n_hci != NULL) {
7372 -               n_hci_close(hdev);
7373 -
7374 -               if (hci_unregister_dev(hdev) < 0) {
7375 -                       ERR("Can't unregister HCI device %s",hdev->name);
7376 -               }
7377 -
7378 -               hdev->driver_data = NULL;
7379 -               tty->disc_data = NULL;
7380 -               kfree(n_hci);
7381 -
7382 -               MOD_DEC_USE_COUNT;
7383 -       }
7384 -}
7385 -
7386 -/* n_hci_tty_wakeup()
7387 - *
7388 - *    Callback for transmit wakeup. Called when low level
7389 - *    device driver can accept more send data.
7390 - *
7391 - * Arguments:        tty    pointer to associated tty instance data
7392 - * Return Value:    None
7393 - */
7394 -static void n_hci_tty_wakeup( struct tty_struct *tty )
7395 -{
7396 -       struct n_hci *n_hci = tty2n_hci(tty);
7397 -
7398 -       DBG("");
7399 -
7400 -       if (!n_hci)
7401 -               return;
7402 -
7403 -       tty->flags &= ~(1 << TTY_DO_WRITE_WAKEUP);
7404 -
7405 -       if (tty != n_hci->tty)
7406 -               return;
7407 -
7408 -       n_hci_tx_wakeup(n_hci);
7409 -}
7410 -
7411 -/* n_hci_tty_room()
7412 - *
7413 - *    Callback function from tty driver. Return the amount of
7414 - *    space left in the receiver's buffer to decide if remote
7415 - *    transmitter is to be throttled.
7416 - *
7417 - * Arguments:        tty    pointer to associated tty instance data
7418 - * Return Value:    number of bytes left in receive buffer
7419 - */
7420 -static int n_hci_tty_room (struct tty_struct *tty)
7421 -{
7422 -       return 65536;
7423 -}
7424 -
7425 -static inline int n_hci_check_data_len(struct n_hci *n_hci, int len)
7426 -{
7427 -       register int room = skb_tailroom(n_hci->rx_skb);
7428 -
7429 -       DBG("len %d room %d", len, room);
7430 -       if (!len) {
7431 -               DMP(n_hci->rx_skb->data, n_hci->rx_skb->len);
7432 -               hci_recv_frame(n_hci->rx_skb);
7433 -       } else if (len > room) {
7434 -               ERR("Data length is to large");
7435 -               kfree_skb(n_hci->rx_skb);
7436 -               n_hci->hdev.stat.err_rx++;
7437 -       } else {
7438 -               n_hci->rx_state = WAIT_DATA;
7439 -               n_hci->rx_count = len;
7440 -               return len;
7441 -       }
7442 -
7443 -       n_hci->rx_state = WAIT_PACKET_TYPE;
7444 -       n_hci->rx_skb   = NULL;
7445 -       n_hci->rx_count = 0;
7446 -       return 0;
7447 -}
7448 -
7449 -static inline void n_hci_rx(struct n_hci *n_hci, const __u8 * data, char *flags, int count)
7450 -{
7451 -       register const char *ptr;
7452 -       hci_event_hdr *eh;
7453 -       hci_acl_hdr   *ah;
7454 -       hci_sco_hdr   *sh;
7455 -       register int len, type, dlen;
7456 -
7457 -       DBG("count %d state %ld rx_count %ld", count, n_hci->rx_state, n_hci->rx_count);
7458 -
7459 -       n_hci->hdev.stat.byte_rx += count;
7460 -
7461 -       ptr = data;
7462 -       while (count) {
7463 -               if (n_hci->rx_count) {
7464 -                       len = MIN(n_hci->rx_count, count);
7465 -                       memcpy(skb_put(n_hci->rx_skb, len), ptr, len);
7466 -                       n_hci->rx_count -= len; count -= len; ptr += len;
7467 -
7468 -                       if (n_hci->rx_count)
7469 -                               continue;
7470 -
7471 -                       switch (n_hci->rx_state) {
7472 -                               case WAIT_DATA:
7473 -                                       DBG("Complete data");
7474 -
7475 -                                       DMP(n_hci->rx_skb->data, n_hci->rx_skb->len);
7476 -
7477 -                                       hci_recv_frame(n_hci->rx_skb);
7478 -
7479 -                                       n_hci->rx_state = WAIT_PACKET_TYPE;
7480 -                                       n_hci->rx_skb = NULL;
7481 -                                       continue;
7482 -
7483 -                               case WAIT_EVENT_HDR:
7484 -                                       eh = (hci_event_hdr *) n_hci->rx_skb->data;
7485 -
7486 -                                       DBG("Event header: evt 0x%2.2x plen %d", eh->evt, eh->plen);
7487 -
7488 -                                       n_hci_check_data_len(n_hci, eh->plen);
7489 -                                       continue;
7490 -
7491 -                               case WAIT_ACL_HDR:
7492 -                                       ah = (hci_acl_hdr *) n_hci->rx_skb->data;
7493 -                                       dlen = __le16_to_cpu(ah->dlen);
7494 -
7495 -                                       DBG("ACL header: dlen %d", dlen);
7496 -
7497 -                                       n_hci_check_data_len(n_hci, dlen);
7498 -                                       continue;
7499 -
7500 -                               case WAIT_SCO_HDR:
7501 -                                       sh = (hci_sco_hdr *) n_hci->rx_skb->data;
7502 -
7503 -                                       DBG("SCO header: dlen %d", sh->dlen);
7504 -
7505 -                                       n_hci_check_data_len(n_hci, sh->dlen);
7506 -                                       continue;
7507 -                       };
7508 -               }
7509 -
7510 -               /* WAIT_PACKET_TYPE */
7511 -               switch (*ptr) {
7512 -                       case HCI_EVENT_PKT:
7513 -                               DBG("Event packet");
7514 -                               n_hci->rx_state = WAIT_EVENT_HDR;
7515 -                               n_hci->rx_count = HCI_EVENT_HDR_SIZE;
7516 -                               type = HCI_EVENT_PKT;
7517 -                               break;
7518 -
7519 -                       case HCI_ACLDATA_PKT:
7520 -                               DBG("ACL packet");
7521 -                               n_hci->rx_state = WAIT_ACL_HDR;
7522 -                               n_hci->rx_count = HCI_ACL_HDR_SIZE;
7523 -                               type = HCI_ACLDATA_PKT;
7524 -                               break;
7525 -
7526 -                       case HCI_SCODATA_PKT:
7527 -                               DBG("SCO packet");
7528 -                               n_hci->rx_state = WAIT_SCO_HDR;
7529 -                               n_hci->rx_count = HCI_SCO_HDR_SIZE;
7530 -                               type = HCI_SCODATA_PKT;
7531 -                               break;
7532 -
7533 -                       default:
7534 -                               ERR("Unknown HCI packet type %2.2x", (__u8)*ptr);
7535 -                               n_hci->hdev.stat.err_rx++;
7536 -                               ptr++; count--;
7537 -                               continue;
7538 -               };
7539 -               ptr++; count--;
7540 -
7541 -               /* Allocate packet */
7542 -               if (!(n_hci->rx_skb = bluez_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC))) {
7543 -                       ERR("Can't allocate mem for new packet");
7544 -
7545 -                       n_hci->rx_state = WAIT_PACKET_TYPE;
7546 -                       n_hci->rx_count = 0;
7547 -                       return;
7548 -               }
7549 -               n_hci->rx_skb->dev = (void *) &n_hci->hdev;
7550 -               n_hci->rx_skb->pkt_type = type;
7551 -       }
7552 -}
7553 -
7554 -/* n_hci_tty_receive()
7555 - *
7556 - *     Called by tty low level driver when receive data is
7557 - *     available.
7558 - *
7559 - * Arguments:  tty          pointer to tty isntance data
7560 - *             data         pointer to received data
7561 - *             flags        pointer to flags for data
7562 - *             count        count of received data in bytes
7563 - *
7564 - * Return Value:    None
7565 - */
7566 -static void n_hci_tty_receive(struct tty_struct *tty, const __u8 * data, char *flags, int count)
7567 -{
7568 -       struct n_hci *n_hci = tty2n_hci(tty);
7569 -
7570 -       if (!n_hci || tty != n_hci->tty)
7571 -               return;
7572 -
7573 -       spin_lock(&n_hci->rx_lock);
7574 -       n_hci_rx(n_hci, data, flags, count);
7575 -       spin_unlock(&n_hci->rx_lock);
7576 -
7577 -       if (test_and_clear_bit(TTY_THROTTLED,&tty->flags) && tty->driver.unthrottle)
7578 -               tty->driver.unthrottle(tty);
7579 -}
7580 -
7581 -/* n_hci_tty_ioctl()
7582 - *
7583 - *    Process IOCTL system call for the tty device.
7584 - *
7585 - * Arguments:
7586 - *
7587 - *    tty        pointer to tty instance data
7588 - *    file       pointer to open file object for device
7589 - *    cmd        IOCTL command code
7590 - *    arg        argument for IOCTL call (cmd dependent)
7591 - *
7592 - * Return Value:    Command dependent
7593 - */
7594 -static int n_hci_tty_ioctl (struct tty_struct *tty, struct file * file,
7595 -                            unsigned int cmd, unsigned long arg)
7596 -{
7597 -       struct n_hci *n_hci = tty2n_hci(tty);
7598 -       int error = 0;
7599 -
7600 -       DBG("");
7601 -
7602 -       /* Verify the status of the device */
7603 -       if (!n_hci)
7604 -               return -EBADF;
7605 -
7606 -       switch (cmd) {
7607 -               default:
7608 -                       error = n_tty_ioctl(tty, file, cmd, arg);
7609 -                       break;
7610 -       };
7611 -
7612 -       return error;
7613 -}
7614 -
7615 -/*
7616 - * We don't provide read/write/poll interface for user space.
7617 - */
7618 -static ssize_t n_hci_tty_read(struct tty_struct *tty, struct file *file, unsigned char *buf, size_t nr)
7619 -{
7620 -       return 0;
7621 -}
7622 -static ssize_t n_hci_tty_write(struct tty_struct *tty, struct file *file, const unsigned char *data, size_t count)
7623 -{
7624 -       return 0;
7625 -}
7626 -static unsigned int n_hci_tty_poll(struct tty_struct *tty, struct file *filp, poll_table *wait)
7627 -{
7628 -       return 0;
7629 -}
7630 -
7631 -int __init n_hci_init(void)
7632 -{
7633 -       static struct tty_ldisc n_hci_ldisc;
7634 -       int err;
7635 -
7636 -       INF("BlueZ HCI UART driver ver %s Copyright (C) 2000,2001 Qualcomm Inc",
7637 -               VERSION);
7638 -       INF("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
7639 -
7640 -       /* Register the tty discipline */
7641 -
7642 -       memset(&n_hci_ldisc, 0, sizeof (n_hci_ldisc));
7643 -       n_hci_ldisc.magic       = TTY_LDISC_MAGIC;
7644 -       n_hci_ldisc.name        = "n_hci";
7645 -       n_hci_ldisc.open        = n_hci_tty_open;
7646 -       n_hci_ldisc.close       = n_hci_tty_close;
7647 -       n_hci_ldisc.read        = n_hci_tty_read;
7648 -       n_hci_ldisc.write       = n_hci_tty_write;
7649 -       n_hci_ldisc.ioctl       = n_hci_tty_ioctl;
7650 -       n_hci_ldisc.poll        = n_hci_tty_poll;
7651 -       n_hci_ldisc.receive_room= n_hci_tty_room;
7652 -       n_hci_ldisc.receive_buf = n_hci_tty_receive;
7653 -       n_hci_ldisc.write_wakeup= n_hci_tty_wakeup;
7654 -
7655 -       if ((err = tty_register_ldisc(N_HCI, &n_hci_ldisc))) {
7656 -               ERR("Can't register HCI line discipline (%d)", err);
7657 -               return err;
7658 -       }
7659 -
7660 -       return 0;
7661 -}
7662 -
7663 -void n_hci_cleanup(void)
7664 -{
7665 -       int err;
7666 -
7667 -       /* Release tty registration of line discipline */
7668 -       if ((err = tty_register_ldisc(N_HCI, NULL)))
7669 -               ERR("Can't unregister HCI line discipline (%d)", err);
7670 -}
7671 -
7672 -module_init(n_hci_init);
7673 -module_exit(n_hci_cleanup);
7674 -
7675 -MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
7676 -MODULE_DESCRIPTION("BlueZ HCI UART driver ver " VERSION);
7677 -MODULE_LICENSE("GPL");
7678 diff -urN linux-2.4.18/drivers/bluetooth/hci_uart.h linux-2.4.18-mh9/drivers/bluetooth/hci_uart.h
7679 --- linux-2.4.18/drivers/bluetooth/hci_uart.h   Thu Jan  1 01:00:00 1970
7680 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_uart.h       Mon Aug 25 18:38:10 2003
7681 @@ -0,0 +1,81 @@
7682 +/*
7683 +   BlueZ - Bluetooth protocol stack for Linux
7684 +   Copyright (C) 2000-2001 Qualcomm Incorporated
7685 +
7686 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7687 +
7688 +   This program is free software; you can redistribute it and/or modify
7689 +   it under the terms of the GNU General Public License version 2 as
7690 +   published by the Free Software Foundation;
7691 +
7692 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
7693 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
7694 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
7695 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
7696 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
7697 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
7698 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
7699 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
7700 +
7701 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
7702 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
7703 +   SOFTWARE IS DISCLAIMED.
7704 +*/
7705 +
7706 +/*
7707 + * $Id: hci_uart.h,v 1.2 2002/09/09 01:17:32 maxk Exp $
7708 + */
7709 +
7710 +#ifndef N_HCI
7711 +#define N_HCI  15
7712 +#endif
7713 +
7714 +/* Ioctls */
7715 +#define HCIUARTSETPROTO        _IOW('U', 200, int)
7716 +#define HCIUARTGETPROTO        _IOR('U', 201, int)
7717 +
7718 +/* UART protocols */
7719 +#define HCI_UART_MAX_PROTO     3
7720 +
7721 +#define HCI_UART_H4    0
7722 +#define HCI_UART_BCSP  1
7723 +#define HCI_UART_NCSP  2
7724 +
7725 +#ifdef __KERNEL__
7726 +struct hci_uart;
7727 +
7728 +struct hci_uart_proto {
7729 +       unsigned int id;
7730 +       int (*open)(struct hci_uart *hu);
7731 +       int (*close)(struct hci_uart *hu);
7732 +       int (*flush)(struct hci_uart *hu);
7733 +       int (*recv)(struct hci_uart *hu, void *data, int len);
7734 +       int (*enqueue)(struct hci_uart *hu, struct sk_buff *skb);
7735 +       struct sk_buff *(*dequeue)(struct hci_uart *hu);
7736 +};
7737 +
7738 +struct hci_uart {
7739 +       struct tty_struct  *tty;
7740 +       struct hci_dev     hdev;
7741 +       unsigned long      flags;
7742 +
7743 +       struct hci_uart_proto *proto;
7744 +       void               *priv;
7745 +
7746 +       struct sk_buff     *tx_skb;
7747 +       unsigned long      tx_state;
7748 +       spinlock_t         rx_lock;
7749 +};
7750 +
7751 +/* HCI_UART flag bits */
7752 +#define HCI_UART_PROTO_SET             0
7753 +
7754 +/* TX states  */
7755 +#define HCI_UART_SENDING               1
7756 +#define HCI_UART_TX_WAKEUP             2
7757 +
7758 +int hci_uart_register_proto(struct hci_uart_proto *p);
7759 +int hci_uart_unregister_proto(struct hci_uart_proto *p);
7760 +int hci_uart_tx_wakeup(struct hci_uart *hu);
7761 +
7762 +#endif /* __KERNEL__ */
7763 diff -urN linux-2.4.18/drivers/bluetooth/hci_usb.c linux-2.4.18-mh9/drivers/bluetooth/hci_usb.c
7764 --- linux-2.4.18/drivers/bluetooth/hci_usb.c    Fri Sep  7 18:28:38 2001
7765 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_usb.c        Mon Aug 25 18:38:12 2003
7766 @@ -1,9 +1,10 @@
7767  /*
7768 -   BlueZ - Bluetooth protocol stack for Linux
7769 +   HCI USB driver for Linux Bluetooth protocol stack (BlueZ)
7770     Copyright (C) 2000-2001 Qualcomm Incorporated
7771 -
7772     Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7773
7774 +   Copyright (C) 2003 Maxim Krasnyansky <maxk@qualcomm.com>
7775 +
7776     This program is free software; you can redistribute it and/or modify
7777     it under the terms of the GNU General Public License version 2 as
7778     published by the Free Software Foundation;
7779 @@ -23,598 +24,901 @@
7780  */
7781
7782  /*
7783 - * BlueZ HCI USB driver.
7784   * Based on original USB Bluetooth driver for Linux kernel
7785   *    Copyright (c) 2000 Greg Kroah-Hartman        <greg@kroah.com>
7786   *    Copyright (c) 2000 Mark Douglas Corner       <mcorner@umich.edu>
7787   *
7788 - * $Id: hci_usb.c,v 1.5 2001/07/05 18:42:44 maxk Exp $
7789 + * $Id: hci_usb.c,v 1.8 2002/07/18 17:23:09 maxk Exp $
7790   */
7791 -#define VERSION "1.0"
7792 +#define VERSION "2.4"
7793
7794  #include <linux/config.h>
7795  #include <linux/module.h>
7796
7797  #include <linux/version.h>
7798 -#include <linux/config.h>
7799  #include <linux/kernel.h>
7800  #include <linux/init.h>
7801  #include <linux/sched.h>
7802 +#include <linux/unistd.h>
7803  #include <linux/types.h>
7804 -#include <linux/fcntl.h>
7805  #include <linux/interrupt.h>
7806 -#include <linux/ptrace.h>
7807 -#include <linux/poll.h>
7808
7809  #include <linux/slab.h>
7810 -#include <linux/tty.h>
7811  #include <linux/errno.h>
7812  #include <linux/string.h>
7813 -#include <linux/signal.h>
7814 -#include <linux/ioctl.h>
7815  #include <linux/skbuff.h>
7816
7817  #include <linux/usb.h>
7818
7819  #include <net/bluetooth/bluetooth.h>
7820 -#include <net/bluetooth/bluez.h>
7821  #include <net/bluetooth/hci_core.h>
7822 -#include <net/bluetooth/hci_usb.h>
7823 +
7824 +#include "hci_usb.h"
7825
7826  #ifndef HCI_USB_DEBUG
7827 -#undef  DBG
7828 -#define DBG( A... )
7829 -#undef  DMP
7830 -#define DMP( A... )
7831 +#undef  BT_DBG
7832 +#define BT_DBG( A... )
7833 +#undef  BT_DMP
7834 +#define BT_DMP( A... )
7835  #endif
7836
7837 -static struct usb_device_id usb_bluetooth_ids [] = {
7838 +#ifndef CONFIG_BLUEZ_USB_ZERO_PACKET
7839 +#undef  USB_ZERO_PACKET
7840 +#define USB_ZERO_PACKET 0
7841 +#endif
7842 +
7843 +static struct usb_driver hci_usb_driver;
7844 +
7845 +static struct usb_device_id bluetooth_ids[] = {
7846 +       /* Generic Bluetooth USB device */
7847         { USB_DEVICE_INFO(HCI_DEV_CLASS, HCI_DEV_SUBCLASS, HCI_DEV_PROTOCOL) },
7848 +
7849 +       /* Ericsson with non-standard id */
7850 +       { USB_DEVICE(0x0bdb, 0x1002) },
7851 +
7852 +       /* Bluetooth Ultraport Module from IBM */
7853 +       { USB_DEVICE(0x04bf, 0x030a) },
7854 +
7855         { }     /* Terminating entry */
7856  };
7857
7858 -MODULE_DEVICE_TABLE (usb, usb_bluetooth_ids);
7859 +MODULE_DEVICE_TABLE (usb, bluetooth_ids);
7860
7861 -static int hci_usb_ctrl_msg(struct hci_usb *husb,  struct sk_buff *skb);
7862 -static int hci_usb_write_msg(struct hci_usb *husb, struct sk_buff *skb);
7863 +static struct usb_device_id ignore_ids[] = {
7864 +       /* Broadcom BCM2033 without firmware */
7865 +       { USB_DEVICE(0x0a5c, 0x2033) },
7866
7867 -static void hci_usb_unlink_urbs(struct hci_usb *husb)
7868 -{
7869 -       usb_unlink_urb(husb->read_urb);
7870 -       usb_unlink_urb(husb->intr_urb);
7871 -       usb_unlink_urb(husb->ctrl_urb);
7872 -       usb_unlink_urb(husb->write_urb);
7873 -}
7874 +       { }     /* Terminating entry */
7875 +};
7876
7877 -static void hci_usb_free_bufs(struct hci_usb *husb)
7878 +struct _urb *_urb_alloc(int isoc, int gfp)
7879  {
7880 -       if (husb->read_urb) {
7881 -               if (husb->read_urb->transfer_buffer)
7882 -                       kfree(husb->read_urb->transfer_buffer);
7883 -               usb_free_urb(husb->read_urb);
7884 -       }
7885 -
7886 -       if (husb->intr_urb) {
7887 -               if (husb->intr_urb->transfer_buffer)
7888 -                       kfree(husb->intr_urb->transfer_buffer);
7889 -               usb_free_urb(husb->intr_urb);
7890 +       struct _urb *_urb = kmalloc(sizeof(struct _urb) +
7891 +                               sizeof(iso_packet_descriptor_t) * isoc, gfp);
7892 +       if (_urb) {
7893 +               memset(_urb, 0, sizeof(*_urb));
7894 +               spin_lock_init(&_urb->urb.lock);
7895 +       }
7896 +       return _urb;
7897 +}
7898 +
7899 +struct _urb *_urb_dequeue(struct _urb_queue *q)
7900 +{
7901 +       struct _urb *_urb = NULL;
7902 +        unsigned long flags;
7903 +        spin_lock_irqsave(&q->lock, flags);
7904 +       {
7905 +               struct list_head *head = &q->head;
7906 +               struct list_head *next = head->next;
7907 +               if (next != head) {
7908 +                       _urb = list_entry(next, struct _urb, list);
7909 +                       list_del(next); _urb->queue = NULL;
7910 +               }
7911         }
7912 +       spin_unlock_irqrestore(&q->lock, flags);
7913 +       return _urb;
7914 +}
7915
7916 -       if (husb->ctrl_urb)
7917 -               usb_free_urb(husb->ctrl_urb);
7918 +static void hci_usb_rx_complete(struct urb *urb);
7919 +static void hci_usb_tx_complete(struct urb *urb);
7920
7921 -       if (husb->write_urb)
7922 -               usb_free_urb(husb->write_urb);
7923 +#define __pending_tx(husb, type)  (&husb->pending_tx[type-1])
7924 +#define __pending_q(husb, type)   (&husb->pending_q[type-1])
7925 +#define __completed_q(husb, type) (&husb->completed_q[type-1])
7926 +#define __transmit_q(husb, type)  (&husb->transmit_q[type-1])
7927 +#define __reassembly(husb, type)  (husb->reassembly[type-1])
7928
7929 -       if (husb->intr_skb)
7930 -               kfree_skb(husb->intr_skb);
7931 +static inline struct _urb *__get_completed(struct hci_usb *husb, int type)
7932 +{
7933 +       return _urb_dequeue(__completed_q(husb, type));
7934  }
7935
7936 -/* ------- Interface to HCI layer ------ */
7937 -/* Initialize device */
7938 -int hci_usb_open(struct hci_dev *hdev)
7939 +static void __fill_isoc_desc(struct urb *urb, int len, int mtu)
7940  {
7941 -       struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
7942 -       int status;
7943 -
7944 -       DBG("%s", hdev->name);
7945 -
7946 -       husb->read_urb->dev = husb->udev;
7947 -       if ((status = usb_submit_urb(husb->read_urb)))
7948 -               DBG("read submit failed. %d", status);
7949 +       int offset = 0, i;
7950
7951 -       husb->intr_urb->dev = husb->udev;
7952 -       if ((status = usb_submit_urb(husb->intr_urb)))
7953 -               DBG("interrupt submit failed. %d", status);
7954 +       BT_DBG("len %d mtu %d", len, mtu);
7955
7956 -       hdev->flags |= HCI_RUNNING;
7957 -
7958 -       return 0;
7959 +       for (i=0; i < HCI_MAX_ISOC_FRAMES && len >= mtu; i++, offset += mtu, len -= mtu) {
7960 +               urb->iso_frame_desc[i].offset = offset;
7961 +               urb->iso_frame_desc[i].length = mtu;
7962 +               BT_DBG("desc %d offset %d len %d", i, offset, mtu);
7963 +       }
7964 +       if (len && i < HCI_MAX_ISOC_FRAMES) {
7965 +               urb->iso_frame_desc[i].offset = offset;
7966 +               urb->iso_frame_desc[i].length = len;
7967 +               BT_DBG("desc %d offset %d len %d", i, offset, len);
7968 +               i++;
7969 +       }
7970 +       urb->number_of_packets = i;
7971  }
7972
7973 -/* Reset device */
7974 -int hci_usb_flush(struct hci_dev *hdev)
7975 +static int hci_usb_intr_rx_submit(struct hci_usb *husb)
7976  {
7977 -       struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
7978 +       struct _urb *_urb;
7979 +       struct urb *urb;
7980 +       int err, pipe, interval, size;
7981 +       void *buf;
7982
7983 -       DBG("%s", hdev->name);
7984 +       BT_DBG("%s", husb->hdev.name);
7985
7986 -       /* Drop TX queues */
7987 -       skb_queue_purge(&husb->tx_ctrl_q);
7988 -       skb_queue_purge(&husb->tx_write_q);
7989 +        size = husb->intr_in_ep->wMaxPacketSize;
7990
7991 -       return 0;
7992 +       buf = kmalloc(size, GFP_ATOMIC);
7993 +       if (!buf)
7994 +               return -ENOMEM;
7995 +
7996 +       _urb = _urb_alloc(0, GFP_ATOMIC);
7997 +       if (!_urb) {
7998 +               kfree(buf);
7999 +               return -ENOMEM;
8000 +       }
8001 +       _urb->type = HCI_EVENT_PKT;
8002 +       _urb_queue_tail(__pending_q(husb, _urb->type), _urb);
8003 +
8004 +       urb = &_urb->urb;
8005 +       pipe     = usb_rcvintpipe(husb->udev, husb->intr_in_ep->bEndpointAddress);
8006 +       interval = husb->intr_in_ep->bInterval;
8007 +       FILL_INT_URB(urb, husb->udev, pipe, buf, size, hci_usb_rx_complete, husb, interval);
8008 +
8009 +       err = usb_submit_urb(urb);
8010 +       if (err) {
8011 +               BT_ERR("%s intr rx submit failed urb %p err %d",
8012 +                               husb->hdev.name, urb, err);
8013 +               _urb_unlink(_urb);
8014 +               _urb_free(_urb);
8015 +               kfree(buf);
8016 +       }
8017 +       return err;
8018  }
8019
8020 -/* Close device */
8021 -int hci_usb_close(struct hci_dev *hdev)
8022 +static int hci_usb_bulk_rx_submit(struct hci_usb *husb)
8023  {
8024 -       struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
8025 +       struct _urb *_urb;
8026 +       struct urb *urb;
8027 +       int err, pipe, size = HCI_MAX_FRAME_SIZE;
8028 +       void *buf;
8029
8030 -       DBG("%s", hdev->name);
8031 +       buf = kmalloc(size, GFP_ATOMIC);
8032 +       if (!buf)
8033 +               return -ENOMEM;
8034
8035 -       hdev->flags &= ~HCI_RUNNING;
8036 -       hci_usb_unlink_urbs(husb);
8037 +       _urb = _urb_alloc(0, GFP_ATOMIC);
8038 +       if (!_urb) {
8039 +               kfree(buf);
8040 +               return -ENOMEM;
8041 +       }
8042 +       _urb->type = HCI_ACLDATA_PKT;
8043 +       _urb_queue_tail(__pending_q(husb, _urb->type), _urb);
8044
8045 -       hci_usb_flush(hdev);
8046 +       urb  = &_urb->urb;
8047 +       pipe = usb_rcvbulkpipe(husb->udev, husb->bulk_in_ep->bEndpointAddress);
8048 +        FILL_BULK_URB(urb, husb->udev, pipe, buf, size, hci_usb_rx_complete, husb);
8049 +        urb->transfer_flags = USB_QUEUE_BULK;
8050
8051 -       return 0;
8052 +       BT_DBG("%s urb %p", husb->hdev.name, urb);
8053 +
8054 +       err = usb_submit_urb(urb);
8055 +       if (err) {
8056 +               BT_ERR("%s bulk rx submit failed urb %p err %d",
8057 +                               husb->hdev.name, urb, err);
8058 +               _urb_unlink(_urb);
8059 +               _urb_free(_urb);
8060 +               kfree(buf);
8061 +       }
8062 +       return err;
8063  }
8064
8065 -void hci_usb_ctrl_wakeup(struct hci_usb *husb)
8066 +#ifdef CONFIG_BLUEZ_USB_SCO
8067 +static int hci_usb_isoc_rx_submit(struct hci_usb *husb)
8068  {
8069 -       struct sk_buff *skb;
8070 -
8071 -       if (test_and_set_bit(HCI_TX_CTRL, &husb->tx_state))
8072 -               return;
8073 +       struct _urb *_urb;
8074 +       struct urb *urb;
8075 +       int err, mtu, size;
8076 +       void *buf;
8077
8078 -       DBG("%s", husb->hdev.name);
8079 +       mtu  = husb->isoc_in_ep->wMaxPacketSize;
8080 +        size = mtu * HCI_MAX_ISOC_FRAMES;
8081
8082 -       if (!(skb = skb_dequeue(&husb->tx_ctrl_q)))
8083 -               goto done;
8084 +       buf = kmalloc(size, GFP_ATOMIC);
8085 +       if (!buf)
8086 +               return -ENOMEM;
8087
8088 -       if (hci_usb_ctrl_msg(husb, skb)){
8089 -               kfree_skb(skb);
8090 -               goto done;
8091 +       _urb = _urb_alloc(HCI_MAX_ISOC_FRAMES, GFP_ATOMIC);
8092 +       if (!_urb) {
8093 +               kfree(buf);
8094 +               return -ENOMEM;
8095         }
8096 +       _urb->type = HCI_SCODATA_PKT;
8097 +       _urb_queue_tail(__pending_q(husb, _urb->type), _urb);
8098
8099 -       DMP(skb->data, skb->len);
8100 +       urb = &_urb->urb;
8101
8102 -       husb->hdev.stat.byte_tx += skb->len;
8103 -       return;
8104 +       urb->context  = husb;
8105 +       urb->dev      = husb->udev;
8106 +       urb->pipe     = usb_rcvisocpipe(husb->udev, husb->isoc_in_ep->bEndpointAddress);
8107 +       urb->complete = hci_usb_rx_complete;
8108
8109 -done:
8110 -       clear_bit(HCI_TX_CTRL, &husb->tx_state);
8111 -       return;
8112 +       urb->transfer_buffer_length = size;
8113 +       urb->transfer_buffer = buf;
8114 +       urb->transfer_flags  = USB_ISO_ASAP;
8115 +
8116 +       __fill_isoc_desc(urb, size, mtu);
8117 +
8118 +       BT_DBG("%s urb %p", husb->hdev.name, urb);
8119 +
8120 +       err = usb_submit_urb(urb);
8121 +       if (err) {
8122 +               BT_ERR("%s isoc rx submit failed urb %p err %d",
8123 +                               husb->hdev.name, urb, err);
8124 +               _urb_unlink(_urb);
8125 +               _urb_free(_urb);
8126 +               kfree(buf);
8127 +       }
8128 +       return err;
8129  }
8130 +#endif
8131
8132 -void hci_usb_write_wakeup(struct hci_usb *husb)
8133 +/* Initialize device */
8134 +static int hci_usb_open(struct hci_dev *hdev)
8135  {
8136 -       struct sk_buff *skb;
8137 +       struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
8138 +       int i, err;
8139 +       unsigned long flags;
8140
8141 -       if (test_and_set_bit(HCI_TX_WRITE, &husb->tx_state))
8142 -               return;
8143 +       BT_DBG("%s", hdev->name);
8144
8145 -       DBG("%s", husb->hdev.name);
8146 +       if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
8147 +               return 0;
8148
8149 -       if (!(skb = skb_dequeue(&husb->tx_write_q)))
8150 -               goto done;
8151 +       MOD_INC_USE_COUNT;
8152
8153 -       if (hci_usb_write_msg(husb, skb)) {
8154 -               skb_queue_head(&husb->tx_write_q, skb);
8155 -               goto done;
8156 +       write_lock_irqsave(&husb->completion_lock, flags);
8157 +
8158 +       err = hci_usb_intr_rx_submit(husb);
8159 +       if (!err) {
8160 +               for (i = 0; i < HCI_MAX_BULK_RX; i++)
8161 +                       hci_usb_bulk_rx_submit(husb);
8162 +
8163 +#ifdef CONFIG_BLUEZ_USB_SCO
8164 +               if (husb->isoc_iface)
8165 +                       for (i = 0; i < HCI_MAX_ISOC_RX; i++)
8166 +                               hci_usb_isoc_rx_submit(husb);
8167 +#endif
8168 +       } else {
8169 +               clear_bit(HCI_RUNNING, &hdev->flags);
8170 +               MOD_DEC_USE_COUNT;
8171         }
8172
8173 -       DMP(skb->data, skb->len);
8174 +       write_unlock_irqrestore(&husb->completion_lock, flags);
8175 +       return err;
8176 +}
8177 +
8178 +/* Reset device */
8179 +static int hci_usb_flush(struct hci_dev *hdev)
8180 +{
8181 +       struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
8182 +       int i;
8183
8184 -       husb->hdev.stat.byte_tx += skb->len;
8185 -       return;
8186 +       BT_DBG("%s", hdev->name);
8187
8188 -done:
8189 -       clear_bit(HCI_TX_WRITE, &husb->tx_state);
8190 -       return;
8191 +       for (i=0; i < 4; i++)
8192 +               skb_queue_purge(&husb->transmit_q[i]);
8193 +       return 0;
8194  }
8195
8196 -/* Send frames from HCI layer */
8197 -int hci_usb_send_frame(struct sk_buff *skb)
8198 +static void hci_usb_unlink_urbs(struct hci_usb *husb)
8199  {
8200 -       struct hci_dev *hdev = (struct hci_dev *) skb->dev;
8201 -       struct hci_usb *husb;
8202 +       int i;
8203
8204 -       if (!hdev) {
8205 -               ERR("frame for uknown device (hdev=NULL)");
8206 -               return -ENODEV;
8207 +       BT_DBG("%s", husb->hdev.name);
8208 +
8209 +       for (i=0; i < 4; i++) {
8210 +               struct _urb *_urb;
8211 +               struct urb *urb;
8212 +
8213 +               /* Kill pending requests */
8214 +               while ((_urb = _urb_dequeue(&husb->pending_q[i]))) {
8215 +                       urb = &_urb->urb;
8216 +                       BT_DBG("%s unlinking _urb %p type %d urb %p",
8217 +                                       husb->hdev.name, _urb, _urb->type, urb);
8218 +                       usb_unlink_urb(urb);
8219 +                       _urb_queue_tail(__completed_q(husb, _urb->type), _urb);
8220 +               }
8221 +
8222 +               /* Release completed requests */
8223 +               while ((_urb = _urb_dequeue(&husb->completed_q[i]))) {
8224 +                       urb = &_urb->urb;
8225 +                       BT_DBG("%s freeing _urb %p type %d urb %p",
8226 +                                       husb->hdev.name, _urb, _urb->type, urb);
8227 +                       if (urb->setup_packet)
8228 +                               kfree(urb->setup_packet);
8229 +                       if (urb->transfer_buffer)
8230 +                               kfree(urb->transfer_buffer);
8231 +                       _urb_free(_urb);
8232 +               }
8233 +
8234 +               /* Release reassembly buffers */
8235 +               if (husb->reassembly[i]) {
8236 +                       kfree_skb(husb->reassembly[i]);
8237 +                       husb->reassembly[i] = NULL;
8238 +               }
8239         }
8240 +}
8241
8242 -       if (!(hdev->flags & HCI_RUNNING))
8243 +/* Close device */
8244 +static int hci_usb_close(struct hci_dev *hdev)
8245 +{
8246 +       struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
8247 +       unsigned long flags;
8248 +
8249 +       if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
8250                 return 0;
8251
8252 -       husb = (struct hci_usb *) hdev->driver_data;
8253 +       BT_DBG("%s", hdev->name);
8254
8255 -       DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
8256 +       write_lock_irqsave(&husb->completion_lock, flags);
8257 +
8258 +       hci_usb_unlink_urbs(husb);
8259 +       hci_usb_flush(hdev);
8260
8261 -       switch (skb->pkt_type) {
8262 -               case HCI_COMMAND_PKT:
8263 -                       skb_queue_tail(&husb->tx_ctrl_q, skb);
8264 -                       hci_usb_ctrl_wakeup(husb);
8265 -                       hdev->stat.cmd_tx++;
8266 -                       return 0;
8267 -
8268 -               case HCI_ACLDATA_PKT:
8269 -                       skb_queue_tail(&husb->tx_write_q, skb);
8270 -                       hci_usb_write_wakeup(husb);
8271 -                       hdev->stat.acl_tx++;
8272 -                       return 0;
8273 -
8274 -               case HCI_SCODATA_PKT:
8275 -                       return -EOPNOTSUPP;
8276 -       };
8277 +       write_unlock_irqrestore(&husb->completion_lock, flags);
8278
8279 +       MOD_DEC_USE_COUNT;
8280         return 0;
8281  }
8282
8283 -/* ---------- USB ------------- */
8284 -
8285 -static void hci_usb_ctrl(struct urb *urb)
8286 +static int __tx_submit(struct hci_usb *husb, struct _urb *_urb)
8287  {
8288 -       struct sk_buff *skb = (struct sk_buff *) urb->context;
8289 -       struct hci_dev *hdev;
8290 -       struct hci_usb *husb;
8291 -
8292 -       if (!skb)
8293 -               return;
8294 -       hdev = (struct hci_dev *) skb->dev;
8295 -       husb = (struct hci_usb *) hdev->driver_data;
8296 +       struct urb *urb = &_urb->urb;
8297 +       int err;
8298
8299 -       DBG("%s", hdev->name);
8300 +       BT_DBG("%s urb %p type %d", husb->hdev.name, urb, _urb->type);
8301 +
8302 +       _urb_queue_tail(__pending_q(husb, _urb->type), _urb);
8303 +       err = usb_submit_urb(urb);
8304 +       if (err) {
8305 +               BT_ERR("%s tx submit failed urb %p type %d err %d",
8306 +                               husb->hdev.name, urb, _urb->type, err);
8307 +               _urb_unlink(_urb);
8308 +               _urb_queue_tail(__completed_q(husb, _urb->type), _urb);
8309 +       } else
8310 +               atomic_inc(__pending_tx(husb, _urb->type));
8311 +
8312 +       return err;
8313 +}
8314 +
8315 +static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
8316 +{
8317 +       struct _urb *_urb = __get_completed(husb, skb->pkt_type);
8318 +       devrequest *dr;
8319 +       struct urb *urb;
8320 +
8321 +       if (!_urb) {
8322 +               _urb = _urb_alloc(0, GFP_ATOMIC);
8323 +               if (!_urb)
8324 +                       return -ENOMEM;
8325 +               _urb->type = skb->pkt_type;
8326 +
8327 +               dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
8328 +               if (!dr) {
8329 +                       _urb_free(_urb);
8330 +                       return -ENOMEM;
8331 +               }
8332 +       } else
8333 +               dr = (void *) _urb->urb.setup_packet;
8334
8335 -       if (urb->status)
8336 -               DBG("%s ctrl status: %d", hdev->name, urb->status);
8337 +       dr->requesttype = HCI_CTRL_REQ;
8338 +       dr->request = 0;
8339 +       dr->index   = 0;
8340 +       dr->value   = 0;
8341 +       dr->length  = __cpu_to_le16(skb->len);
8342
8343 -       clear_bit(HCI_TX_CTRL, &husb->tx_state);
8344 -       kfree_skb(skb);
8345 +       urb = &_urb->urb;
8346 +       FILL_CONTROL_URB(urb, husb->udev, usb_sndctrlpipe(husb->udev, 0),
8347 +               (void *) dr, skb->data, skb->len, hci_usb_tx_complete, husb);
8348
8349 -       /* Wake up device */
8350 -       hci_usb_ctrl_wakeup(husb);
8351 +       BT_DBG("%s skb %p len %d", husb->hdev.name, skb, skb->len);
8352 +
8353 +       _urb->priv = skb;
8354 +       return __tx_submit(husb, _urb);
8355  }
8356
8357 -static void hci_usb_bulk_write(struct urb *urb)
8358 +static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
8359  {
8360 -       struct sk_buff *skb = (struct sk_buff *) urb->context;
8361 -       struct hci_dev *hdev;
8362 -       struct hci_usb *husb;
8363 -
8364 -       if (!skb)
8365 -               return;
8366 -       hdev = (struct hci_dev *) skb->dev;
8367 -       husb = (struct hci_usb *) hdev->driver_data;
8368 +       struct _urb *_urb = __get_completed(husb, skb->pkt_type);
8369 +       struct urb *urb;
8370 +       int pipe;
8371
8372 -       DBG("%s", hdev->name);
8373 -
8374 -       if (urb->status)
8375 -               DBG("%s bulk write status: %d", hdev->name, urb->status);
8376 +       if (!_urb) {
8377 +               _urb = _urb_alloc(0, GFP_ATOMIC);
8378 +               if (!_urb)
8379 +                       return -ENOMEM;
8380 +               _urb->type = skb->pkt_type;
8381 +       }
8382
8383 -       clear_bit(HCI_TX_WRITE, &husb->tx_state);
8384 -       kfree_skb(skb);
8385 +       urb  = &_urb->urb;
8386 +       pipe = usb_sndbulkpipe(husb->udev, husb->bulk_out_ep->bEndpointAddress);
8387 +       FILL_BULK_URB(urb, husb->udev, pipe, skb->data, skb->len,
8388 +                       hci_usb_tx_complete, husb);
8389 +       urb->transfer_flags = USB_QUEUE_BULK | USB_ZERO_PACKET;
8390
8391 -       /* Wake up device */
8392 -       hci_usb_write_wakeup(husb);
8393 +       BT_DBG("%s skb %p len %d", husb->hdev.name, skb, skb->len);
8394
8395 -       return;
8396 +       _urb->priv = skb;
8397 +       return __tx_submit(husb, _urb);
8398  }
8399
8400 -static void hci_usb_intr(struct urb *urb)
8401 +#ifdef CONFIG_BLUEZ_USB_SCO
8402 +static inline int hci_usb_send_isoc(struct hci_usb *husb, struct sk_buff *skb)
8403  {
8404 -       struct hci_usb *husb = (struct hci_usb *) urb->context;
8405 -       unsigned char *data = urb->transfer_buffer;
8406 -       register int count  = urb->actual_length;
8407 -       register struct sk_buff *skb = husb->intr_skb;
8408 -       hci_event_hdr *eh;
8409 -       register int len;
8410 +       struct _urb *_urb = __get_completed(husb, skb->pkt_type);
8411 +       struct urb *urb;
8412 +
8413 +       if (!_urb) {
8414 +               _urb = _urb_alloc(HCI_MAX_ISOC_FRAMES, GFP_ATOMIC);
8415 +               if (!_urb)
8416 +                       return -ENOMEM;
8417 +               _urb->type = skb->pkt_type;
8418 +       }
8419
8420 -       if (!husb)
8421 -               return;
8422 +       BT_DBG("%s skb %p len %d", husb->hdev.name, skb, skb->len);
8423
8424 -       DBG("%s count %d", husb->hdev.name, count);
8425 +       urb = &_urb->urb;
8426 +
8427 +       urb->context  = husb;
8428 +       urb->dev      = husb->udev;
8429 +       urb->pipe     = usb_sndisocpipe(husb->udev, husb->isoc_out_ep->bEndpointAddress);
8430 +       urb->complete = hci_usb_tx_complete;
8431 +       urb->transfer_flags = USB_ISO_ASAP;
8432
8433 -       if (urb->status || !count) {
8434 -               DBG("%s intr status %d, count %d", husb->hdev.name, urb->status, count);
8435 -               return;
8436 -       }
8437 +       urb->transfer_buffer = skb->data;
8438 +       urb->transfer_buffer_length = skb->len;
8439 +
8440 +       __fill_isoc_desc(urb, skb->len, husb->isoc_out_ep->wMaxPacketSize);
8441
8442 -       /* Do we really have to handle continuations here ? */
8443 -       if (!skb) {
8444 -               /* New frame */
8445 -               if (count < HCI_EVENT_HDR_SIZE) {
8446 -                       DBG("%s bad frame len %d", husb->hdev.name, count);
8447 -                       return;
8448 -               }
8449 +       _urb->priv = skb;
8450 +       return __tx_submit(husb, _urb);
8451 +}
8452 +#endif
8453 +
8454 +static void hci_usb_tx_process(struct hci_usb *husb)
8455 +{
8456 +       struct sk_buff_head *q;
8457 +       struct sk_buff *skb;
8458
8459 -               eh = (hci_event_hdr *) data;
8460 -               len = eh->plen + HCI_EVENT_HDR_SIZE;
8461 +       BT_DBG("%s", husb->hdev.name);
8462
8463 -               if (count > len) {
8464 -                       DBG("%s corrupted frame, len %d", husb->hdev.name, count);
8465 -                       return;
8466 +       do {
8467 +               clear_bit(HCI_USB_TX_WAKEUP, &husb->state);
8468 +
8469 +               /* Process command queue */
8470 +               q = __transmit_q(husb, HCI_COMMAND_PKT);
8471 +               if (!atomic_read(__pending_tx(husb, HCI_COMMAND_PKT)) &&
8472 +                               (skb = skb_dequeue(q))) {
8473 +                       if (hci_usb_send_ctrl(husb, skb) < 0)
8474 +                               skb_queue_head(q, skb);
8475                 }
8476
8477 -               /* Allocate skb */
8478 -               if (!(skb = bluez_skb_alloc(len, GFP_ATOMIC))) {
8479 -                       ERR("Can't allocate mem for new packet");
8480 -                       return;
8481 +#ifdef CONFIG_BLUEZ_USB_SCO
8482 +               /* Process SCO queue */
8483 +               q = __transmit_q(husb, HCI_SCODATA_PKT);
8484 +               if (atomic_read(__pending_tx(husb, HCI_SCODATA_PKT)) < HCI_MAX_ISOC_TX &&
8485 +                               (skb = skb_dequeue(q))) {
8486 +                       if (hci_usb_send_isoc(husb, skb) < 0)
8487 +                               skb_queue_head(q, skb);
8488 +               }
8489 +#endif
8490 +
8491 +               /* Process ACL queue */
8492 +               q = __transmit_q(husb, HCI_ACLDATA_PKT);
8493 +               while (atomic_read(__pending_tx(husb, HCI_ACLDATA_PKT)) < HCI_MAX_BULK_TX &&
8494 +                               (skb = skb_dequeue(q))) {
8495 +                       if (hci_usb_send_bulk(husb, skb) < 0) {
8496 +                               skb_queue_head(q, skb);
8497 +                               break;
8498 +                       }
8499                 }
8500 -               skb->dev = (void *) &husb->hdev;
8501 -               skb->pkt_type = HCI_EVENT_PKT;
8502 +       } while(test_bit(HCI_USB_TX_WAKEUP, &husb->state));
8503 +}
8504
8505 -               husb->intr_skb = skb;
8506 -               husb->intr_count = len;
8507 -       } else {
8508 -               /* Continuation */
8509 -               if (count > husb->intr_count) {
8510 -                       ERR("%s bad frame len %d (expected %d)", husb->hdev.name, count, husb->intr_count);
8511 +static inline void hci_usb_tx_wakeup(struct hci_usb *husb)
8512 +{
8513 +       /* Serialize TX queue processing to avoid data reordering */
8514 +       if (!test_and_set_bit(HCI_USB_TX_PROCESS, &husb->state)) {
8515 +               hci_usb_tx_process(husb);
8516 +               clear_bit(HCI_USB_TX_PROCESS, &husb->state);
8517 +       } else
8518 +               set_bit(HCI_USB_TX_WAKEUP, &husb->state);
8519 +}
8520
8521 -                       kfree_skb(skb);
8522 -                       husb->intr_skb = NULL;
8523 -                       husb->intr_count = 0;
8524 -                       return;
8525 -               }
8526 +/* Send frames from HCI layer */
8527 +static int hci_usb_send_frame(struct sk_buff *skb)
8528 +{
8529 +       struct hci_dev *hdev = (struct hci_dev *) skb->dev;
8530 +       struct hci_usb *husb;
8531 +
8532 +       if (!hdev) {
8533 +               BT_ERR("frame for uknown device (hdev=NULL)");
8534 +               return -ENODEV;
8535         }
8536
8537 -       memcpy(skb_put(skb, count), data, count);
8538 -       husb->intr_count -= count;
8539 +       if (!test_bit(HCI_RUNNING, &hdev->flags))
8540 +               return -EBUSY;
8541
8542 -       DMP(data, count);
8543 +       BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
8544
8545 -       if (!husb->intr_count) {
8546 -               /* Got complete frame */
8547 +       husb = (struct hci_usb *) hdev->driver_data;
8548
8549 -               husb->hdev.stat.byte_rx += skb->len;
8550 -               hci_recv_frame(skb);
8551 +       switch (skb->pkt_type) {
8552 +       case HCI_COMMAND_PKT:
8553 +               hdev->stat.cmd_tx++;
8554 +               break;
8555 +
8556 +       case HCI_ACLDATA_PKT:
8557 +               hdev->stat.acl_tx++;
8558 +               break;
8559 +
8560 +#ifdef CONFIG_BLUEZ_USB_SCO
8561 +       case HCI_SCODATA_PKT:
8562 +               hdev->stat.sco_tx++;
8563 +               break;
8564 +#endif
8565
8566 -               husb->intr_skb = NULL;
8567 +       default:
8568 +               kfree_skb(skb);
8569 +               return 0;
8570         }
8571 +
8572 +       read_lock(&husb->completion_lock);
8573 +
8574 +       skb_queue_tail(__transmit_q(husb, skb->pkt_type), skb);
8575 +       hci_usb_tx_wakeup(husb);
8576 +
8577 +       read_unlock(&husb->completion_lock);
8578 +       return 0;
8579  }
8580
8581 -static void hci_usb_bulk_read(struct urb *urb)
8582 +static inline int __recv_frame(struct hci_usb *husb, int type, void *data, int count)
8583  {
8584 -       struct hci_usb *husb = (struct hci_usb *) urb->context;
8585 -       unsigned char *data = urb->transfer_buffer;
8586 -       int count = urb->actual_length, status;
8587 -       struct sk_buff *skb;
8588 -       hci_acl_hdr *ah;
8589 -       register __u16 dlen;
8590 -
8591 -       if (!husb)
8592 -               return;
8593 +       BT_DBG("%s type %d data %p count %d", husb->hdev.name, type, data, count);
8594
8595 -       DBG("%s status %d, count %d, flags %x", husb->hdev.name, urb->status, count, urb->transfer_flags);
8596 +       husb->hdev.stat.byte_rx += count;
8597
8598 -       if (urb->status) {
8599 -               /* Do not re-submit URB on critical errors */
8600 -               switch (urb->status) {
8601 -                       case -ENOENT:
8602 -                               return;
8603 -                       default:
8604 -                               goto resubmit;
8605 -               };
8606 -       }
8607 -       if (!count)
8608 -               goto resubmit;
8609 +       while (count) {
8610 +               struct sk_buff *skb = __reassembly(husb, type);
8611 +               struct { int expect; } *scb;
8612 +               int len = 0;
8613 +
8614 +               if (!skb) {
8615 +                       /* Start of the frame */
8616 +
8617 +                       switch (type) {
8618 +                       case HCI_EVENT_PKT:
8619 +                               if (count >= HCI_EVENT_HDR_SIZE) {
8620 +                                       hci_event_hdr *h = data;
8621 +                                       len = HCI_EVENT_HDR_SIZE + h->plen;
8622 +                               } else
8623 +                                       return -EILSEQ;
8624 +                               break;
8625
8626 -       DMP(data, count);
8627 +                       case HCI_ACLDATA_PKT:
8628 +                               if (count >= HCI_ACL_HDR_SIZE) {
8629 +                                       hci_acl_hdr *h = data;
8630 +                                       len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen);
8631 +                               } else
8632 +                                       return -EILSEQ;
8633 +                               break;
8634 +#ifdef CONFIG_BLUEZ_USB_SCO
8635 +                       case HCI_SCODATA_PKT:
8636 +                               if (count >= HCI_SCO_HDR_SIZE) {
8637 +                                       hci_sco_hdr *h = data;
8638 +                                       len = HCI_SCO_HDR_SIZE + h->dlen;
8639 +                               } else
8640 +                                       return -EILSEQ;
8641 +                               break;
8642 +#endif
8643 +                       }
8644 +                       BT_DBG("new packet len %d", len);
8645 +
8646 +                       skb = bluez_skb_alloc(len, GFP_ATOMIC);
8647 +                       if (!skb) {
8648 +                               BT_ERR("%s no memory for the packet", husb->hdev.name);
8649 +                               return -ENOMEM;
8650 +                       }
8651 +                       skb->dev = (void *) &husb->hdev;
8652 +                       skb->pkt_type = type;
8653 +
8654 +                       __reassembly(husb, type) = skb;
8655 +
8656 +                       scb = (void *) skb->cb;
8657 +                       scb->expect = len;
8658 +               } else {
8659 +                       /* Continuation */
8660 +                       scb = (void *) skb->cb;
8661 +                       len = scb->expect;
8662 +               }
8663
8664 -       ah = (hci_acl_hdr *) data;
8665 -       dlen = le16_to_cpu(ah->dlen);
8666 +               len = min(len, count);
8667 +
8668 +               memcpy(skb_put(skb, len), data, len);
8669 +
8670 +               scb->expect -= len;
8671 +               if (!scb->expect) {
8672 +                       /* Complete frame */
8673 +                       __reassembly(husb, type) = NULL;
8674 +                       hci_recv_frame(skb);
8675 +               }
8676
8677 -       /* Verify frame len and completeness */
8678 -       if ((count - HCI_ACL_HDR_SIZE) != dlen) {
8679 -               ERR("%s corrupted ACL packet: count %d, plen %d", husb->hdev.name, count, dlen);
8680 -               goto resubmit;
8681 +               count -= len; data += len;
8682         }
8683 +       return 0;
8684 +}
8685
8686 -       /* Allocate packet */
8687 -       if (!(skb = bluez_skb_alloc(count, GFP_ATOMIC))) {
8688 -               ERR("Can't allocate mem for new packet");
8689 -               goto resubmit;
8690 -       }
8691 +static void hci_usb_rx_complete(struct urb *urb)
8692 +{
8693 +       struct _urb *_urb = container_of(urb, struct _urb, urb);
8694 +       struct hci_usb *husb = (void *) urb->context;
8695 +       struct hci_dev *hdev = &husb->hdev;
8696 +       int    err, count = urb->actual_length;
8697
8698 -       memcpy(skb_put(skb, count), data, count);
8699 -       skb->dev = (void *) &husb->hdev;
8700 -       skb->pkt_type = HCI_ACLDATA_PKT;
8701 +       BT_DBG("%s urb %p type %d status %d count %d flags %x", hdev->name, urb,
8702 +                       _urb->type, urb->status, count, urb->transfer_flags);
8703
8704 -       husb->hdev.stat.byte_rx += skb->len;
8705 +       if (!test_bit(HCI_RUNNING, &hdev->flags))
8706 +               return;
8707
8708 -       hci_recv_frame(skb);
8709 +       read_lock(&husb->completion_lock);
8710
8711 -resubmit:
8712 -       husb->read_urb->dev = husb->udev;
8713 -       if ((status = usb_submit_urb(husb->read_urb)))
8714 -               DBG("%s read URB submit failed %d", husb->hdev.name, status);
8715 +       if (urb->status || !count)
8716 +               goto resubmit;
8717 +
8718 +       if (_urb->type == HCI_SCODATA_PKT) {
8719 +#ifdef CONFIG_BLUEZ_USB_SCO
8720 +               int i;
8721 +               for (i=0; i < urb->number_of_packets; i++) {
8722 +                       BT_DBG("desc %d status %d offset %d len %d", i,
8723 +                                       urb->iso_frame_desc[i].status,
8724 +                                       urb->iso_frame_desc[i].offset,
8725 +                                       urb->iso_frame_desc[i].actual_length);
8726 +
8727 +                       if (!urb->iso_frame_desc[i].status)
8728 +                               __recv_frame(husb, _urb->type,
8729 +                                       urb->transfer_buffer + urb->iso_frame_desc[i].offset,
8730 +                                       urb->iso_frame_desc[i].actual_length);
8731 +               }
8732 +#else
8733 +               ;
8734 +#endif
8735 +       } else {
8736 +               err = __recv_frame(husb, _urb->type, urb->transfer_buffer, count);
8737 +               if (err < 0) {
8738 +                       BT_ERR("%s corrupted packet: type %d count %d",
8739 +                                       husb->hdev.name, _urb->type, count);
8740 +                       hdev->stat.err_rx++;
8741 +               }
8742 +       }
8743
8744 -       DBG("%s read URB re-submited", husb->hdev.name);
8745 +resubmit:
8746 +       if (_urb->type != HCI_EVENT_PKT) {
8747 +               urb->dev = husb->udev;
8748 +               err      = usb_submit_urb(urb);
8749 +               BT_DBG("%s urb %p type %d resubmit status %d", hdev->name, urb,
8750 +                               _urb->type, err);
8751 +       }
8752 +       read_unlock(&husb->completion_lock);
8753  }
8754
8755 -static int hci_usb_ctrl_msg(struct hci_usb *husb, struct sk_buff *skb)
8756 +static void hci_usb_tx_complete(struct urb *urb)
8757  {
8758 -       struct urb *urb = husb->ctrl_urb;
8759 -       devrequest *dr  = &husb->dev_req;
8760 -       int pipe, status;
8761 +       struct _urb *_urb = container_of(urb, struct _urb, urb);
8762 +       struct hci_usb *husb = (void *) urb->context;
8763 +       struct hci_dev *hdev = &husb->hdev;
8764
8765 -       DBG("%s len %d", husb->hdev.name, skb->len);
8766 +       BT_DBG("%s urb %p status %d flags %x", hdev->name, urb,
8767 +                       urb->status, urb->transfer_flags);
8768
8769 -       pipe = usb_sndctrlpipe(husb->udev, 0);
8770 +       atomic_dec(__pending_tx(husb, _urb->type));
8771
8772 -       dr->requesttype = HCI_CTRL_REQ;
8773 -       dr->request = 0;
8774 -       dr->index   = 0;
8775 -       dr->value   = 0;
8776 -       dr->length  = cpu_to_le16(skb->len);
8777 +       urb->transfer_buffer = NULL;
8778 +       kfree_skb((struct sk_buff *) _urb->priv);
8779
8780 -       FILL_CONTROL_URB(urb, husb->udev, pipe, (void*)dr, skb->data, skb->len,
8781 -                        hci_usb_ctrl, skb);
8782 -
8783 -       if ((status = usb_submit_urb(urb))) {
8784 -               DBG("%s control URB submit failed %d", husb->hdev.name, status);
8785 -               return status;
8786 -       }
8787 +       if (!test_bit(HCI_RUNNING, &hdev->flags))
8788 +               return;
8789
8790 -       return 0;
8791 -}
8792 +       if (!urb->status)
8793 +               hdev->stat.byte_tx += urb->transfer_buffer_length;
8794 +       else
8795 +               hdev->stat.err_tx++;
8796
8797 -static int hci_usb_write_msg(struct hci_usb *husb, struct sk_buff *skb)
8798 -{
8799 -       struct urb *urb = husb->write_urb;
8800 -       int pipe, status;
8801 +       read_lock(&husb->completion_lock);
8802
8803 -       DBG("%s len %d", husb->hdev.name, skb->len);
8804 +       _urb_unlink(_urb);
8805 +       _urb_queue_tail(__completed_q(husb, _urb->type), _urb);
8806
8807 -       pipe = usb_sndbulkpipe(husb->udev, husb->bulk_out_ep_addr);
8808 +       hci_usb_tx_wakeup(husb);
8809 +
8810 +       read_unlock(&husb->completion_lock);
8811 +}
8812
8813 -       FILL_BULK_URB(urb, husb->udev, pipe, skb->data, skb->len,
8814 -                     hci_usb_bulk_write, skb);
8815 -       urb->transfer_flags |= USB_QUEUE_BULK;
8816 +static void hci_usb_destruct(struct hci_dev *hdev)
8817 +{
8818 +       struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
8819
8820 -       if ((status = usb_submit_urb(urb))) {
8821 -               DBG("%s write URB submit failed %d", husb->hdev.name, status);
8822 -               return status;
8823 -       }
8824 +       BT_DBG("%s", hdev->name);
8825
8826 -       return 0;
8827 +       kfree(husb);
8828  }
8829
8830 -static void * hci_usb_probe(struct usb_device *udev, unsigned int ifnum, const struct usb_device_id *id)
8831 +static void *hci_usb_probe(struct usb_device *udev, unsigned int ifnum, const struct usb_device_id *id)
8832  {
8833 -       struct usb_endpoint_descriptor *bulk_out_ep, *intr_in_ep, *bulk_in_ep;
8834 +       struct usb_endpoint_descriptor *bulk_out_ep[HCI_MAX_IFACE_NUM];
8835 +       struct usb_endpoint_descriptor *isoc_out_ep[HCI_MAX_IFACE_NUM];
8836 +       struct usb_endpoint_descriptor *bulk_in_ep[HCI_MAX_IFACE_NUM];
8837 +       struct usb_endpoint_descriptor *isoc_in_ep[HCI_MAX_IFACE_NUM];
8838 +       struct usb_endpoint_descriptor *intr_in_ep[HCI_MAX_IFACE_NUM];
8839         struct usb_interface_descriptor *uif;
8840         struct usb_endpoint_descriptor *ep;
8841 +       struct usb_interface *iface, *isoc_iface;
8842         struct hci_usb *husb;
8843         struct hci_dev *hdev;
8844 -       int i, size, pipe;
8845 -       __u8 * buf;
8846 +       int i, a, e, size, ifn, isoc_ifnum, isoc_alts;
8847
8848 -       DBG("udev %p ifnum %d", udev, ifnum);
8849 -
8850 -       /* Check device signature */
8851 -       if ((udev->descriptor.bDeviceClass    != HCI_DEV_CLASS)   ||
8852 -           (udev->descriptor.bDeviceSubClass != HCI_DEV_SUBCLASS)||
8853 -           (udev->descriptor.bDeviceProtocol != HCI_DEV_PROTOCOL) )
8854 -               return NULL;
8855 -
8856 -       MOD_INC_USE_COUNT;
8857 +       BT_DBG("udev %p ifnum %d", udev, ifnum);
8858
8859 -       uif = &udev->actconfig->interface[ifnum].altsetting[0];
8860 +       iface = &udev->actconfig->interface[0];
8861
8862 -       if (uif->bNumEndpoints != 3) {
8863 -               DBG("Wrong number of endpoints %d", uif->bNumEndpoints);
8864 -               MOD_DEC_USE_COUNT;
8865 +       /* Check our black list */
8866 +       if (usb_match_id(udev, iface, ignore_ids))
8867                 return NULL;
8868 -       }
8869
8870 -       bulk_out_ep = intr_in_ep = bulk_in_ep = NULL;
8871 +       /* Check number of endpoints */
8872 +       if (udev->actconfig->interface[ifnum].altsetting[0].bNumEndpoints < 3)
8873 +               return NULL;
8874
8875 +       memset(bulk_out_ep, 0, sizeof(bulk_out_ep));
8876 +       memset(isoc_out_ep, 0, sizeof(isoc_out_ep));
8877 +       memset(bulk_in_ep,  0, sizeof(bulk_in_ep));
8878 +       memset(isoc_in_ep,  0, sizeof(isoc_in_ep));
8879 +       memset(intr_in_ep,  0, sizeof(intr_in_ep));
8880 +
8881 +       size = 0;
8882 +       isoc_iface = NULL;
8883 +       isoc_alts  = isoc_ifnum = 0;
8884 +
8885         /* Find endpoints that we need */
8886 -       for ( i = 0; i < uif->bNumEndpoints; ++i) {
8887 -               ep = &uif->endpoint[i];
8888
8889 -               switch (ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
8890 -                       case USB_ENDPOINT_XFER_BULK:
8891 -                               if (ep->bEndpointAddress & USB_DIR_IN)
8892 -                                       bulk_in_ep  = ep;
8893 -                               else
8894 -                                       bulk_out_ep = ep;
8895 -                               break;
8896 +       ifn = MIN(udev->actconfig->bNumInterfaces, HCI_MAX_IFACE_NUM);
8897 +       for (i = 0; i < ifn; i++) {
8898 +               iface = &udev->actconfig->interface[i];
8899 +               for (a = 0; a < iface->num_altsetting; a++) {
8900 +                       uif = &iface->altsetting[a];
8901 +                       for (e = 0; e < uif->bNumEndpoints; e++) {
8902 +                               ep = &uif->endpoint[e];
8903 +
8904 +                               switch (ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
8905 +                               case USB_ENDPOINT_XFER_INT:
8906 +                                       if (ep->bEndpointAddress & USB_DIR_IN)
8907 +                                               intr_in_ep[i] = ep;
8908 +                                       break;
8909 +
8910 +                               case USB_ENDPOINT_XFER_BULK:
8911 +                                       if (ep->bEndpointAddress & USB_DIR_IN)
8912 +                                               bulk_in_ep[i]  = ep;
8913 +                                       else
8914 +                                               bulk_out_ep[i] = ep;
8915 +                                       break;
8916 +
8917 +#ifdef CONFIG_BLUEZ_USB_SCO
8918 +                               case USB_ENDPOINT_XFER_ISOC:
8919 +                                       if (ep->wMaxPacketSize < size || a > 2)
8920 +                                               break;
8921 +                                       size = ep->wMaxPacketSize;
8922 +
8923 +                                       isoc_iface = iface;
8924 +                                       isoc_alts  = a;
8925 +                                       isoc_ifnum = i;
8926 +
8927 +                                       if (ep->bEndpointAddress & USB_DIR_IN)
8928 +                                               isoc_in_ep[i]  = ep;
8929 +                                       else
8930 +                                               isoc_out_ep[i] = ep;
8931 +                                       break;
8932 +#endif
8933 +                               }
8934 +                       }
8935 +               }
8936 +       }
8937
8938 -                       case USB_ENDPOINT_XFER_INT:
8939 -                               intr_in_ep = ep;
8940 -                               break;
8941 -               };
8942 +       if (!bulk_in_ep[0] || !bulk_out_ep[0] || !intr_in_ep[0]) {
8943 +               BT_DBG("Bulk endpoints not found");
8944 +               goto done;
8945         }
8946
8947 -       if (!bulk_in_ep || !bulk_out_ep || !intr_in_ep) {
8948 -               DBG("Endpoints not found: %p %p %p", bulk_in_ep, bulk_out_ep, intr_in_ep);
8949 -               MOD_DEC_USE_COUNT;
8950 -               return NULL;
8951 +#ifdef CONFIG_BLUEZ_USB_SCO
8952 +       if (!isoc_in_ep[1] || !isoc_out_ep[1]) {
8953 +               BT_DBG("Isoc endpoints not found");
8954 +               isoc_iface = NULL;
8955         }
8956 +#endif
8957
8958         if (!(husb = kmalloc(sizeof(struct hci_usb), GFP_KERNEL))) {
8959 -               ERR("Can't allocate: control structure");
8960 -               MOD_DEC_USE_COUNT;
8961 -               return NULL;
8962 +               BT_ERR("Can't allocate: control structure");
8963 +               goto done;
8964         }
8965
8966         memset(husb, 0, sizeof(struct hci_usb));
8967
8968         husb->udev = udev;
8969 -       husb->bulk_out_ep_addr = bulk_out_ep->bEndpointAddress;
8970 -
8971 -       if (!(husb->ctrl_urb = usb_alloc_urb(0))) {
8972 -               ERR("Can't allocate: control URB");
8973 -               goto probe_error;
8974 -       }
8975 -
8976 -       if (!(husb->write_urb = usb_alloc_urb(0))) {
8977 -               ERR("Can't allocate: write URB");
8978 -               goto probe_error;
8979 -       }
8980 -
8981 -       if (!(husb->read_urb = usb_alloc_urb(0))) {
8982 -               ERR("Can't allocate: read URB");
8983 -               goto probe_error;
8984 -       }
8985 -
8986 -       ep = bulk_in_ep;
8987 -       pipe = usb_rcvbulkpipe(udev, ep->bEndpointAddress);
8988 -       size = HCI_MAX_FRAME_SIZE;
8989 -
8990 -       if (!(buf = kmalloc(size, GFP_KERNEL))) {
8991 -               ERR("Can't allocate: read buffer");
8992 -               goto probe_error;
8993 -       }
8994 -
8995 -       FILL_BULK_URB(husb->read_urb, udev, pipe, buf, size, hci_usb_bulk_read, husb);
8996 -       husb->read_urb->transfer_flags |= USB_QUEUE_BULK;
8997 -
8998 -       ep = intr_in_ep;
8999 -       pipe = usb_rcvintpipe(udev, ep->bEndpointAddress);
9000 -       size = usb_maxpacket(udev, pipe, usb_pipeout(pipe));
9001 -
9002 -       if (!(husb->intr_urb = usb_alloc_urb(0))) {
9003 -               ERR("Can't allocate: interrupt URB");
9004 -               goto probe_error;
9005 +       husb->bulk_out_ep = bulk_out_ep[0];
9006 +       husb->bulk_in_ep  = bulk_in_ep[0];
9007 +       husb->intr_in_ep  = intr_in_ep[0];
9008 +
9009 +#ifdef CONFIG_BLUEZ_USB_SCO
9010 +       if (isoc_iface) {
9011 +               BT_DBG("isoc ifnum %d alts %d", isoc_ifnum, isoc_alts);
9012 +               if (usb_set_interface(udev, isoc_ifnum, isoc_alts)) {
9013 +                       BT_ERR("Can't set isoc interface settings");
9014 +                       isoc_iface = NULL;
9015 +               }
9016 +               usb_driver_claim_interface(&hci_usb_driver, isoc_iface, husb);
9017 +               husb->isoc_iface  = isoc_iface;
9018 +               husb->isoc_in_ep  = isoc_in_ep[isoc_ifnum];
9019 +               husb->isoc_out_ep = isoc_out_ep[isoc_ifnum];
9020         }
9021 +#endif
9022 +
9023 +       husb->completion_lock = RW_LOCK_UNLOCKED;
9024
9025 -       if (!(buf = kmalloc(size, GFP_KERNEL))) {
9026 -               ERR("Can't allocate: interrupt buffer");
9027 -               goto probe_error;
9028 +       for (i = 0; i < 4; i++) {
9029 +               skb_queue_head_init(&husb->transmit_q[i]);
9030 +               _urb_queue_init(&husb->pending_q[i]);
9031 +               _urb_queue_init(&husb->completed_q[i]);
9032         }
9033
9034 -       FILL_INT_URB(husb->intr_urb, udev, pipe, buf, size, hci_usb_intr, husb, ep->bInterval);
9035 -
9036 -       skb_queue_head_init(&husb->tx_ctrl_q);
9037 -       skb_queue_head_init(&husb->tx_write_q);
9038 -
9039         /* Initialize and register HCI device */
9040         hdev = &husb->hdev;
9041
9042 -       hdev->type = HCI_USB;
9043 +       hdev->type  = HCI_USB;
9044         hdev->driver_data = husb;
9045
9046         hdev->open  = hci_usb_open;
9047         hdev->close = hci_usb_close;
9048         hdev->flush = hci_usb_flush;
9049 -       hdev->send      = hci_usb_send_frame;
9050 +       hdev->send  = hci_usb_send_frame;
9051 +       hdev->destruct = hci_usb_destruct;
9052
9053         if (hci_register_dev(hdev) < 0) {
9054 -               ERR("Can't register HCI device %s", hdev->name);
9055 +               BT_ERR("Can't register HCI device");
9056                 goto probe_error;
9057         }
9058
9059         return husb;
9060
9061  probe_error:
9062 -       hci_usb_free_bufs(husb);
9063         kfree(husb);
9064 -       MOD_DEC_USE_COUNT;
9065 +
9066 +done:
9067         return NULL;
9068  }
9069
9070 @@ -626,38 +930,34 @@
9071         if (!husb)
9072                 return;
9073
9074 -       DBG("%s", hdev->name);
9075 +       BT_DBG("%s", hdev->name);
9076
9077         hci_usb_close(hdev);
9078
9079 -       if (hci_unregister_dev(hdev) < 0) {
9080 -               ERR("Can't unregister HCI device %s", hdev->name);
9081 -       }
9082 +       if (husb->isoc_iface)
9083 +               usb_driver_release_interface(&hci_usb_driver, husb->isoc_iface);
9084
9085 -       hci_usb_free_bufs(husb);
9086 -       kfree(husb);
9087 -
9088 -       MOD_DEC_USE_COUNT;
9089 +       if (hci_unregister_dev(hdev) < 0)
9090 +               BT_ERR("Can't unregister HCI device %s", hdev->name);
9091  }
9092
9093 -static struct usb_driver hci_usb_driver =
9094 -{
9095 +static struct usb_driver hci_usb_driver = {
9096         name:           "hci_usb",
9097         probe:          hci_usb_probe,
9098         disconnect:     hci_usb_disconnect,
9099 -       id_table:       usb_bluetooth_ids,
9100 +       id_table:       bluetooth_ids,
9101  };
9102
9103  int hci_usb_init(void)
9104  {
9105         int err;
9106
9107 -       INF("BlueZ HCI USB driver ver %s Copyright (C) 2000,2001 Qualcomm Inc",
9108 +       BT_INFO("BlueZ HCI USB driver ver %s Copyright (C) 2000,2001 Qualcomm Inc",
9109                 VERSION);
9110 -       INF("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
9111 +       BT_INFO("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
9112
9113         if ((err = usb_register(&hci_usb_driver)) < 0)
9114 -               ERR("Failed to register HCI USB driver");
9115 +               BT_ERR("Failed to register HCI USB driver");
9116
9117         return err;
9118  }
9119 diff -urN linux-2.4.18/drivers/bluetooth/hci_usb.h linux-2.4.18-mh9/drivers/bluetooth/hci_usb.h
9120 --- linux-2.4.18/drivers/bluetooth/hci_usb.h    Thu Jan  1 01:00:00 1970
9121 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_usb.h        Mon Aug 25 18:38:12 2003
9122 @@ -0,0 +1,139 @@
9123 +/*
9124 +   HCI USB driver for Linux Bluetooth protocol stack (BlueZ)
9125 +   Copyright (C) 2000-2001 Qualcomm Incorporated
9126 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
9127 +
9128 +   Copyright (C) 2003 Maxim Krasnyansky <maxk@qualcomm.com>
9129 +
9130 +   This program is free software; you can redistribute it and/or modify
9131 +   it under the terms of the GNU General Public License version 2 as
9132 +   published by the Free Software Foundation;
9133 +
9134 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9135 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
9136 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
9137 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
9138 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
9139 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
9140 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
9141 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
9142 +
9143 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
9144 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
9145 +   SOFTWARE IS DISCLAIMED.
9146 +*/
9147 +
9148 +/*
9149 + * $Id: hci_usb.h,v 1.2 2002/03/18 19:10:04 maxk Exp $
9150 + */
9151 +
9152 +#ifdef __KERNEL__
9153 +
9154 +/* Class, SubClass, and Protocol codes that describe a Bluetooth device */
9155 +#define HCI_DEV_CLASS        0xe0      /* Wireless class */
9156 +#define HCI_DEV_SUBCLASS     0x01      /* RF subclass */
9157 +#define HCI_DEV_PROTOCOL     0x01      /* Bluetooth programming protocol */
9158 +
9159 +#define HCI_CTRL_REQ        0x20
9160 +
9161 +#define HCI_MAX_IFACE_NUM      3
9162 +
9163 +#define HCI_MAX_BULK_TX        4
9164 +#define HCI_MAX_BULK_RX        1
9165 +
9166 +#define HCI_MAX_ISOC_RX                2
9167 +#define HCI_MAX_ISOC_TX                2
9168 +
9169 +#define HCI_MAX_ISOC_FRAMES     10
9170 +
9171 +struct _urb_queue {
9172 +       struct list_head head;
9173 +       spinlock_t       lock;
9174 +};
9175 +
9176 +struct _urb {
9177 +       struct list_head  list;
9178 +       struct _urb_queue *queue;
9179 +       int               type;
9180 +       void              *priv;
9181 +       struct urb        urb;
9182 +};
9183 +
9184 +struct _urb *_urb_alloc(int isoc, int gfp);
9185 +
9186 +static inline void _urb_free(struct _urb *_urb)
9187 +{
9188 +       kfree(_urb);
9189 +}
9190 +
9191 +static inline void _urb_queue_init(struct _urb_queue *q)
9192 +{
9193 +       INIT_LIST_HEAD(&q->head);
9194 +       spin_lock_init(&q->lock);
9195 +}
9196 +
9197 +static inline void _urb_queue_head(struct _urb_queue *q, struct _urb *_urb)
9198 +{
9199 +        unsigned long flags;
9200 +        spin_lock_irqsave(&q->lock, flags);
9201 +       list_add(&_urb->list, &q->head); _urb->queue = q;
9202 +       spin_unlock_irqrestore(&q->lock, flags);
9203 +}
9204 +
9205 +static inline void _urb_queue_tail(struct _urb_queue *q, struct _urb *_urb)
9206 +{
9207 +        unsigned long flags;
9208 +        spin_lock_irqsave(&q->lock, flags);
9209 +       list_add_tail(&_urb->list, &q->head); _urb->queue = q;
9210 +       spin_unlock_irqrestore(&q->lock, flags);
9211 +}
9212 +
9213 +static inline void _urb_unlink(struct _urb *_urb)
9214 +{
9215 +       struct _urb_queue *q = _urb->queue;
9216 +        unsigned long flags;
9217 +       if (q) {
9218 +               spin_lock_irqsave(&q->lock, flags);
9219 +               list_del(&_urb->list); _urb->queue = NULL;
9220 +               spin_unlock_irqrestore(&q->lock, flags);
9221 +       }
9222 +}
9223 +
9224 +struct _urb *_urb_dequeue(struct _urb_queue *q);
9225 +
9226 +#ifndef container_of
9227 +#define container_of(ptr, type, member) ({                      \
9228 +                       const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
9229 +                               (type *)( (char *)__mptr - offsetof(type,member) );})
9230 +#endif
9231 +
9232 +struct hci_usb {
9233 +       struct hci_dev          hdev;
9234 +
9235 +       unsigned long           state;
9236 +
9237 +       struct usb_device       *udev;
9238 +
9239 +       struct usb_endpoint_descriptor  *bulk_in_ep;
9240 +       struct usb_endpoint_descriptor  *bulk_out_ep;
9241 +       struct usb_endpoint_descriptor  *intr_in_ep;
9242 +
9243 +       struct usb_interface            *isoc_iface;
9244 +       struct usb_endpoint_descriptor  *isoc_out_ep;
9245 +       struct usb_endpoint_descriptor  *isoc_in_ep;
9246 +
9247 +       struct sk_buff_head     transmit_q[4];
9248 +       struct sk_buff          *reassembly[4]; // Reassembly buffers
9249 +
9250 +       rwlock_t                completion_lock;
9251 +
9252 +       atomic_t                pending_tx[4];  // Number of pending requests
9253 +       struct _urb_queue       pending_q[4];   // Pending requests
9254 +       struct _urb_queue       completed_q[4]; // Completed requests
9255 +};
9256 +
9257 +/* States  */
9258 +#define HCI_USB_TX_PROCESS     1
9259 +#define HCI_USB_TX_WAKEUP      2
9260 +
9261 +#endif /* __KERNEL__ */
9262 diff -urN linux-2.4.18/drivers/bluetooth/hci_vhci.c linux-2.4.18-mh9/drivers/bluetooth/hci_vhci.c
9263 --- linux-2.4.18/drivers/bluetooth/hci_vhci.c   Fri Sep  7 18:28:38 2001
9264 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_vhci.c       Mon Aug 25 18:38:10 2003
9265 @@ -25,9 +25,9 @@
9266  /*
9267   * BlueZ HCI virtual device driver.
9268   *
9269 - * $Id: hci_vhci.c,v 1.3 2001/08/03 04:19:50 maxk Exp $
9270 + * $Id: hci_vhci.c,v 1.3 2002/04/17 17:37:20 maxk Exp $
9271   */
9272 -#define VERSION "1.0"
9273 +#define VERSION "1.1"
9274
9275  #include <linux/config.h>
9276  #include <linux/module.h>
9277 @@ -49,43 +49,56 @@
9278  #include <asm/uaccess.h>
9279
9280  #include <net/bluetooth/bluetooth.h>
9281 -#include <net/bluetooth/bluez.h>
9282  #include <net/bluetooth/hci_core.h>
9283 -#include <net/bluetooth/hci_vhci.h>
9284 +#include "hci_vhci.h"
9285
9286  /* HCI device part */
9287
9288 -int hci_vhci_open(struct hci_dev *hdev)
9289 +static int hci_vhci_open(struct hci_dev *hdev)
9290  {
9291 -       hdev->flags |= HCI_RUNNING;
9292 +       set_bit(HCI_RUNNING, &hdev->flags);
9293         return 0;
9294  }
9295
9296 -int hci_vhci_flush(struct hci_dev *hdev)
9297 +static int hci_vhci_flush(struct hci_dev *hdev)
9298  {
9299         struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) hdev->driver_data;
9300         skb_queue_purge(&hci_vhci->readq);
9301         return 0;
9302  }
9303
9304 -int hci_vhci_close(struct hci_dev *hdev)
9305 +static int hci_vhci_close(struct hci_dev *hdev)
9306  {
9307 -       hdev->flags &= ~HCI_RUNNING;
9308 +       if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
9309 +               return 0;
9310 +
9311         hci_vhci_flush(hdev);
9312         return 0;
9313  }
9314
9315 -int hci_vhci_send_frame(struct sk_buff *skb)
9316 +static void hci_vhci_destruct(struct hci_dev *hdev)
9317 +{
9318 +       struct hci_vhci_struct *vhci;
9319 +
9320 +       if (!hdev) return;
9321 +
9322 +       vhci = (struct hci_vhci_struct *) hdev->driver_data;
9323 +       kfree(vhci);
9324 +
9325 +       MOD_DEC_USE_COUNT;
9326 +}
9327 +
9328 +static int hci_vhci_send_frame(struct sk_buff *skb)
9329  {
9330         struct hci_dev* hdev = (struct hci_dev *) skb->dev;
9331         struct hci_vhci_struct *hci_vhci;
9332
9333         if (!hdev) {
9334 -               ERR("Frame for uknown device (hdev=NULL)");
9335 +               BT_ERR("Frame for uknown device (hdev=NULL)");
9336                 return -ENODEV;
9337         }
9338
9339 -       if (!(hdev->flags & HCI_RUNNING))
9340 +       if (!test_bit(HCI_RUNNING, &hdev->flags))
9341                 return -EBUSY;
9342
9343         hci_vhci = (struct hci_vhci_struct *) hdev->driver_data;
9344 @@ -188,7 +201,7 @@
9345
9346         add_wait_queue(&hci_vhci->read_wait, &wait);
9347         while (count) {
9348 -               current->state = TASK_INTERRUPTIBLE;
9349 +               set_current_state(TASK_INTERRUPTIBLE);
9350
9351                 /* Read frames from device queue */
9352                 if (!(skb = skb_dequeue(&hci_vhci->readq))) {
9353 @@ -214,8 +227,7 @@
9354                 kfree_skb(skb);
9355                 break;
9356         }
9357 -
9358 -       current->state = TASK_RUNNING;
9359 +       set_current_state(TASK_RUNNING);
9360         remove_wait_queue(&hci_vhci->read_wait, &wait);
9361
9362         return ret;
9363 @@ -270,11 +282,13 @@
9364         hdev->close = hci_vhci_close;
9365         hdev->flush = hci_vhci_flush;
9366         hdev->send  = hci_vhci_send_frame;
9367 +       hdev->destruct = hci_vhci_destruct;
9368
9369         if (hci_register_dev(hdev) < 0) {
9370                 kfree(hci_vhci);
9371                 return -EBUSY;
9372         }
9373 +       MOD_INC_USE_COUNT;
9374
9375         file->private_data = hci_vhci;
9376         return 0;
9377 @@ -285,12 +299,10 @@
9378         struct hci_vhci_struct *hci_vhci = (struct hci_vhci_struct *) file->private_data;
9379
9380         if (hci_unregister_dev(&hci_vhci->hdev) < 0) {
9381 -               ERR("Can't unregister HCI device %s", hci_vhci->hdev.name);
9382 +               BT_ERR("Can't unregister HCI device %s", hci_vhci->hdev.name);
9383         }
9384
9385 -       kfree(hci_vhci);
9386         file->private_data = NULL;
9387 -
9388         return 0;
9389  }
9390
9391 @@ -315,12 +327,12 @@
9392
9393  int __init hci_vhci_init(void)
9394  {
9395 -       INF("BlueZ VHCI driver ver %s Copyright (C) 2000,2001 Qualcomm Inc",
9396 +       BT_INFO("BlueZ VHCI driver ver %s Copyright (C) 2000,2001 Qualcomm Inc",
9397                 VERSION);
9398 -       INF("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
9399 +       BT_INFO("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
9400
9401         if (misc_register(&hci_vhci_miscdev)) {
9402 -               ERR("Can't register misc device %d\n", VHCI_MINOR);
9403 +               BT_ERR("Can't register misc device %d\n", VHCI_MINOR);
9404                 return -EIO;
9405         }
9406
9407 @@ -337,4 +349,4 @@
9408
9409  MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
9410  MODULE_DESCRIPTION("BlueZ VHCI driver ver " VERSION);
9411 -MODULE_LICENSE("GPL");
9412 +MODULE_LICENSE("GPL");
9413 diff -urN linux-2.4.18/drivers/bluetooth/hci_vhci.h linux-2.4.18-mh9/drivers/bluetooth/hci_vhci.h
9414 --- linux-2.4.18/drivers/bluetooth/hci_vhci.h   Thu Jan  1 01:00:00 1970
9415 +++ linux-2.4.18-mh9/drivers/bluetooth/hci_vhci.h       Mon Aug 25 18:38:10 2003
9416 @@ -0,0 +1,50 @@
9417 +/*
9418 +   BlueZ - Bluetooth protocol stack for Linux
9419 +   Copyright (C) 2000-2001 Qualcomm Incorporated
9420 +
9421 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
9422 +
9423 +   This program is free software; you can redistribute it and/or modify
9424 +   it under the terms of the GNU General Public License version 2 as
9425 +   published by the Free Software Foundation;
9426 +
9427 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9428 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
9429 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
9430 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
9431 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
9432 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
9433 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
9434 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
9435 +
9436 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
9437 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
9438 +   SOFTWARE IS DISCLAIMED.
9439 +*/
9440 +
9441 +/*
9442 + * $Id: hci_vhci.h,v 1.1.1.1 2002/03/08 21:03:15 maxk Exp $
9443 + */
9444 +
9445 +#ifndef __HCI_VHCI_H
9446 +#define __HCI_VHCI_H
9447 +
9448 +#ifdef __KERNEL__
9449 +
9450 +struct hci_vhci_struct {
9451 +       struct hci_dev       hdev;
9452 +       __u32                flags;
9453 +       wait_queue_head_t    read_wait;
9454 +       struct sk_buff_head  readq;
9455 +       struct fasync_struct *fasync;
9456 +};
9457 +
9458 +/* VHCI device flags */
9459 +#define VHCI_FASYNC            0x0010
9460 +
9461 +#endif /* __KERNEL__ */
9462 +
9463 +#define VHCI_DEV       "/dev/vhci"
9464 +#define VHCI_MINOR     250
9465 +
9466 +#endif /* __HCI_VHCI_H */
9467 diff -urN linux-2.4.18/drivers/char/pcmcia/serial_cs.c linux-2.4.18-mh9/drivers/char/pcmcia/serial_cs.c
9468 --- linux-2.4.18/drivers/char/pcmcia/serial_cs.c        Fri Dec 21 18:41:54 2001
9469 +++ linux-2.4.18-mh9/drivers/char/pcmcia/serial_cs.c    Mon Aug 25 18:38:10 2003
9470 @@ -2,7 +2,7 @@
9471
9472      A driver for PCMCIA serial devices
9473
9474 -    serial_cs.c 1.128 2001/10/18 12:18:35
9475 +    serial_cs.c 1.138 2002/10/25 06:24:52
9476
9477      The contents of this file are subject to the Mozilla Public
9478      License Version 1.1 (the "License"); you may not use this file
9479 @@ -28,7 +28,7 @@
9480      and other provisions required by the GPL.  If you do not delete
9481      the provisions above, a recipient may use your version of this
9482      file under either the MPL or the GPL.
9483 -
9484 +
9485  ======================================================================*/
9486
9487  #include <linux/module.h>
9488 @@ -69,14 +69,14 @@
9489  static int irq_list[4] = { -1 };
9490  MODULE_PARM(irq_list, "1-4i");
9491
9492 -/* Enable the speaker? */
9493 -INT_MODULE_PARM(do_sound, 1);
9494 +INT_MODULE_PARM(do_sound, 1);          /* Enable the speaker? */
9495 +INT_MODULE_PARM(buggy_uart, 0);                /* Skip strict UART tests? */
9496
9497  #ifdef PCMCIA_DEBUG
9498  INT_MODULE_PARM(pc_debug, PCMCIA_DEBUG);
9499  #define DEBUG(n, args...) if (pc_debug>(n)) printk(KERN_DEBUG args)
9500  static char *version =
9501 -"serial_cs.c 1.128 2001/10/18 12:18:35 (David Hinds)";
9502 +"serial_cs.c 1.138 2002/10/25 06:24:52 (David Hinds)";
9503  #else
9504  #define DEBUG(n, args...)
9505  #endif
9506 @@ -95,6 +95,7 @@
9507      { MANFID_OMEGA, PRODID_OMEGA_QSP_100, 4 },
9508      { MANFID_QUATECH, PRODID_QUATECH_DUAL_RS232, 2 },
9509      { MANFID_QUATECH, PRODID_QUATECH_DUAL_RS232_D1, 2 },
9510 +    { MANFID_QUATECH, PRODID_QUATECH_DUAL_RS232_D2, 2 },
9511      { MANFID_QUATECH, PRODID_QUATECH_QUAD_RS232, 4 },
9512      { MANFID_QUATECH, PRODID_QUATECH_DUAL_RS422, 2 },
9513      { MANFID_QUATECH, PRODID_QUATECH_QUAD_RS422, 4 },
9514 @@ -148,7 +149,7 @@
9515      client_reg_t client_reg;
9516      dev_link_t *link;
9517      int i, ret;
9518 -
9519 +
9520      DEBUG(0, "serial_attach()\n");
9521
9522      /* Create new serial device */
9523 @@ -160,7 +161,7 @@
9524      link->release.function = &serial_release;
9525      link->release.data = (u_long)link;
9526      link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
9527 -    link->io.NumPorts1 = 8;
9528 +    link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
9529      link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
9530      link->irq.IRQInfo1 = IRQ_INFO2_VALID|IRQ_LEVEL_ID;
9531      if (irq_list[0] == -1)
9532 @@ -169,13 +170,12 @@
9533         for (i = 0; i < 4; i++)
9534             link->irq.IRQInfo2 |= 1 << irq_list[i];
9535      link->conf.Attributes = CONF_ENABLE_IRQ;
9536 -    link->conf.Vcc = 50;
9537      if (do_sound) {
9538         link->conf.Attributes |= CONF_ENABLE_SPKR;
9539         link->conf.Status = CCSR_AUDIO_ENA;
9540      }
9541      link->conf.IntType = INT_MEMORY_AND_IO;
9542 -
9543 +
9544      /* Register with Card Services */
9545      link->next = dev_list;
9546      dev_list = link;
9547 @@ -194,7 +194,7 @@
9548         serial_detach(link);
9549         return NULL;
9550      }
9551 -
9552 +
9553      return link;
9554  } /* serial_attach */
9555
9556 @@ -214,7 +214,7 @@
9557      int ret;
9558
9559      DEBUG(0, "serial_detach(0x%p)\n", link);
9560 -
9561 +
9562      /* Locate device structure */
9563      for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
9564         if (*linkp == link) break;
9565 @@ -224,17 +224,17 @@
9566      del_timer(&link->release);
9567      if (link->state & DEV_CONFIG)
9568         serial_release((u_long)link);
9569 -
9570 +
9571      if (link->handle) {
9572         ret = CardServices(DeregisterClient, link->handle);
9573         if (ret != CS_SUCCESS)
9574             cs_error(link->handle, DeregisterClient, ret);
9575      }
9576 -
9577 +
9578      /* Unlink device structure, free bits */
9579      *linkp = link->next;
9580      kfree(info);
9581 -
9582 +
9583  } /* serial_detach */
9584
9585  /*====================================================================*/
9586 @@ -243,18 +243,20 @@
9587  {
9588      struct serial_struct serial;
9589      int line;
9590 -
9591 +
9592      memset(&serial, 0, sizeof(serial));
9593      serial.port = port;
9594      serial.irq = irq;
9595      serial.flags = ASYNC_SKIP_TEST | ASYNC_SHARE_IRQ;
9596 +    if (buggy_uart)
9597 +       serial.flags |= ASYNC_BUGGY_UART;
9598      line = register_serial(&serial);
9599      if (line < 0) {
9600         printk(KERN_NOTICE "serial_cs: register_serial() at 0x%04lx,"
9601                " irq %d failed\n", (u_long)serial.port, serial.irq);
9602         return -1;
9603      }
9604 -
9605 +
9606      info->line[info->ndev] = line;
9607      sprintf(info->node[info->ndev].dev_name, "ttyS%d", line);
9608      info->node[info->ndev].major = TTY_MAJOR;
9609 @@ -262,7 +264,7 @@
9610      if (info->ndev > 0)
9611         info->node[info->ndev-1].next = &info->node[info->ndev];
9612      info->ndev++;
9613 -
9614 +
9615      return 0;
9616  }
9617
9618 @@ -313,7 +315,10 @@
9619             return setup_serial(info, port, config.AssignedIRQ);
9620      }
9621      link->conf.Vcc = config.Vcc;
9622 -
9623 +
9624 +    link->io.NumPorts1 = 8;
9625 +    link->io.NumPorts2 = 0;
9626 +
9627      /* First pass: look for a config entry that looks normal. */
9628      tuple.TupleData = (cisdata_t *)buf;
9629      tuple.TupleOffset = 0; tuple.TupleDataMax = 255;
9630 @@ -340,7 +345,7 @@
9631             i = next_tuple(handle, &tuple, &parse);
9632         }
9633      }
9634 -
9635 +
9636      /* Second pass: try to find an entry that isn't picky about
9637         its base address, then try to grab any standard serial port
9638         address, and finally try to get any free port. */
9639 @@ -352,8 +357,7 @@
9640             for (j = 0; j < 5; j++) {
9641                 link->io.BasePort1 = base[j];
9642                 link->io.IOAddrLines = base[j] ? 16 : 3;
9643 -               i = CardServices(RequestIO, link->handle,
9644 -                                &link->io);
9645 +               i = CardServices(RequestIO, link->handle, &link->io);
9646                 if (i == CS_SUCCESS) goto found_port;
9647             }
9648         }
9649 @@ -365,7 +369,7 @@
9650         cs_error(link->handle, RequestIO, i);
9651         return -1;
9652      }
9653 -
9654 +
9655      i = CardServices(RequestIRQ, link->handle, &link->irq);
9656      if (i != CS_SUCCESS) {
9657         cs_error(link->handle, RequestIRQ, i);
9658 @@ -390,8 +394,12 @@
9659      u_char buf[256];
9660      cisparse_t parse;
9661      cistpl_cftable_entry_t *cf = &parse.cftable_entry;
9662 +    config_info_t config;
9663      int i, base2 = 0;
9664
9665 +    CardServices(GetConfigurationInfo, handle, &config);
9666 +    link->conf.Vcc = config.Vcc;
9667 +
9668      tuple.TupleData = (cisdata_t *)buf;
9669      tuple.TupleOffset = 0; tuple.TupleDataMax = 255;
9670      tuple.Attributes = 0;
9671 @@ -433,12 +441,12 @@
9672             i = next_tuple(handle, &tuple, &parse);
9673         }
9674      }
9675 -
9676 +
9677      if (i != CS_SUCCESS) {
9678 -       cs_error(link->handle, RequestIO, i);
9679 -       return -1;
9680 +       /* At worst, try to configure as a single port */
9681 +       return simple_config(link);
9682      }
9683 -
9684 +
9685      i = CardServices(RequestIRQ, link->handle, &link->irq);
9686      if (i != CS_SUCCESS) {
9687         cs_error(link->handle, RequestIRQ, i);
9688 @@ -454,14 +462,27 @@
9689         cs_error(link->handle, RequestConfiguration, i);
9690         return -1;
9691      }
9692 -
9693 +
9694 +    /* The Oxford Semiconductor OXCF950 cards are in fact single-port:
9695 +       8 registers are for the UART, the others are extra registers */
9696 +    if (info->manfid == MANFID_OXSEMI) {
9697 +       if (cf->index == 1 || cf->index == 3) {
9698 +           setup_serial(info, base2, link->irq.AssignedIRQ);
9699 +           outb(12,link->io.BasePort1+1);
9700 +       } else {
9701 +           setup_serial(info, link->io.BasePort1, link->irq.AssignedIRQ);
9702 +           outb(12,base2+1);
9703 +       }
9704 +       return 0;
9705 +    }
9706 +
9707      setup_serial(info, link->io.BasePort1, link->irq.AssignedIRQ);
9708      /* The Nokia cards are not really multiport cards */
9709      if (info->manfid == MANFID_NOKIA)
9710         return 0;
9711      for (i = 0; i < info->multi-1; i++)
9712         setup_serial(info, base2+(8*i), link->irq.AssignedIRQ);
9713 -
9714 +
9715      return 0;
9716  }
9717
9718 @@ -487,7 +508,7 @@
9719      int i, last_ret, last_fn;
9720
9721      DEBUG(0, "serial_config(0x%p)\n", link);
9722 -
9723 +
9724      tuple.TupleData = (cisdata_t *)buf;
9725      tuple.TupleOffset = 0; tuple.TupleDataMax = 255;
9726      tuple.Attributes = 0;
9727 @@ -500,7 +521,7 @@
9728      }
9729      link->conf.ConfigBase = parse.config.base;
9730      link->conf.Present = parse.config.rmask[0];
9731 -
9732 +
9733      /* Configure card */
9734      link->state |= DEV_CONFIG;
9735
9736 @@ -508,8 +529,8 @@
9737      tuple.DesiredTuple = CISTPL_LONGLINK_MFC;
9738      tuple.Attributes = TUPLE_RETURN_COMMON | TUPLE_RETURN_LINK;
9739      info->multi = (first_tuple(handle, &tuple, &parse) == CS_SUCCESS);
9740 -
9741 -    /* Is this a multiport card? */
9742 +
9743 +    /* Scan list of known multiport card ID's */
9744      tuple.DesiredTuple = CISTPL_MANFID;
9745      if (first_tuple(handle, &tuple, &parse) == CS_SUCCESS) {
9746         info->manfid = le16_to_cpu(buf[0]);
9747 @@ -537,15 +558,15 @@
9748                 info->multi = 2;
9749         }
9750      }
9751 -
9752 +
9753      if (info->multi > 1)
9754         multi_config(link);
9755      else
9756         simple_config(link);
9757 -
9758 +
9759      if (info->ndev == 0)
9760         goto failed;
9761 -
9762 +
9763      if (info->manfid == MANFID_IBM) {
9764         conf_reg_t reg = { 0, CS_READ, 0x800, 0 };
9765         CS_CHECK(AccessConfigurationRegister, link->handle, &reg);
9766 @@ -562,6 +583,7 @@
9767      cs_error(link->handle, last_fn, last_ret);
9768  failed:
9769      serial_release((u_long)link);
9770 +    link->state &= ~DEV_CONFIG_PENDING;
9771
9772  } /* serial_config */
9773
9774 @@ -569,7 +591,7 @@
9775
9776      After a card is removed, serial_release() will unregister the net
9777      device, and release the PCMCIA configuration.
9778 -
9779 +
9780  ======================================================================*/
9781
9782  void serial_release(u_long arg)
9783 @@ -577,7 +599,7 @@
9784      dev_link_t *link = (dev_link_t *)arg;
9785      serial_info_t *info = link->priv;
9786      int i;
9787 -
9788 +
9789      DEBUG(0, "serial_release(0x%p)\n", link);
9790
9791      for (i = 0; i < info->ndev; i++) {
9792 @@ -590,7 +612,7 @@
9793         CardServices(ReleaseIO, link->handle, &link->io);
9794         CardServices(ReleaseIRQ, link->handle, &link->irq);
9795      }
9796 -
9797 +
9798      link->state &= ~DEV_CONFIG;
9799
9800  } /* serial_release */
9801 @@ -601,7 +623,7 @@
9802      stuff to run after an event is received.  A CARD_REMOVAL event
9803      also sets some flags to discourage the serial drivers from
9804      talking to the ports.
9805 -
9806 +
9807  ======================================================================*/
9808
9809  static int serial_event(event_t event, int priority,
9810 @@ -609,9 +631,9 @@
9811  {
9812      dev_link_t *link = args->client_data;
9813      serial_info_t *info = link->priv;
9814 -
9815 +
9816      DEBUG(1, "serial_event(0x%06x)\n", event);
9817 -
9818 +
9819      switch (event) {
9820      case CS_EVENT_CARD_REMOVAL:
9821         link->state &= ~DEV_PRESENT;
9822 @@ -650,7 +672,7 @@
9823      if (serv.Revision != CS_RELEASE_CODE) {
9824         printk(KERN_NOTICE "serial_cs: Card Services release "
9825                "does not match!\n");
9826 -       return -1;
9827 +       return -EINVAL;
9828      }
9829      register_pccard_driver(&dev_info, &serial_attach, &serial_detach);
9830      return 0;
9831 diff -urN linux-2.4.18/drivers/usb/Config.in linux-2.4.18-mh9/drivers/usb/Config.in
9832 --- linux-2.4.18/drivers/usb/Config.in  Mon Feb 25 20:38:07 2002
9833 +++ linux-2.4.18-mh9/drivers/usb/Config.in      Mon Aug 25 18:38:10 2003
9834 @@ -31,7 +31,13 @@
9835
9836  comment 'USB Device Class drivers'
9837  dep_tristate '  USB Audio support' CONFIG_USB_AUDIO $CONFIG_USB $CONFIG_SOUND
9838 -dep_tristate '  USB Bluetooth support (EXPERIMENTAL)' CONFIG_USB_BLUETOOTH $CONFIG_USB $CONFIG_EXPERIMENTAL
9839 +if [ "$CONFIG_EXPERIMENTAL" = "y" ]; then
9840 +   if [ "$CONFIG_BLUEZ" = "n" ]; then
9841 +      dep_tristate '  USB Bluetooth support (EXPERIMENTAL)' CONFIG_USB_BLUETOOTH $CONFIG_USB
9842 +   else
9843 +      comment '  USB Bluetooth can only be used with disabled Bluetooth subsystem'
9844 +   fi
9845 +fi
9846  if [ "$CONFIG_SCSI" = "n" ]; then
9847     comment '  SCSI support is needed for USB Storage'
9848  fi
9849 diff -urN linux-2.4.18/include/linux/firmware.h linux-2.4.18-mh9/include/linux/firmware.h
9850 --- linux-2.4.18/include/linux/firmware.h       Thu Jan  1 01:00:00 1970
9851 +++ linux-2.4.18-mh9/include/linux/firmware.h   Mon Aug 25 18:38:10 2003
9852 @@ -0,0 +1,20 @@
9853 +#ifndef _LINUX_FIRMWARE_H
9854 +#define _LINUX_FIRMWARE_H
9855 +#include <linux/module.h>
9856 +#include <linux/types.h>
9857 +#define FIRMWARE_NAME_MAX 30
9858 +struct firmware {
9859 +       size_t size;
9860 +       u8 *data;
9861 +};
9862 +int request_firmware (const struct firmware **fw, const char *name,
9863 +                     const char *device);
9864 +int request_firmware_nowait (
9865 +       struct module *module,
9866 +       const char *name, const char *device, void *context,
9867 +       void (*cont)(const struct firmware *fw, void *context));
9868 +/* On 2.5 'device' is 'struct device *' */
9869 +
9870 +void release_firmware (const struct firmware *fw);
9871 +void register_firmware (const char *name, const u8 *data, size_t size);
9872 +#endif
9873 diff -urN linux-2.4.18/include/linux/kernel.h linux-2.4.18-mh9/include/linux/kernel.h
9874 --- linux-2.4.18/include/linux/kernel.h Mon Feb 25 20:38:13 2002
9875 +++ linux-2.4.18-mh9/include/linux/kernel.h     Mon Aug 25 18:38:11 2003
9876 @@ -11,6 +11,7 @@
9877  #include <linux/linkage.h>
9878  #include <linux/stddef.h>
9879  #include <linux/types.h>
9880 +#include <linux/compiler.h>
9881
9882  /* Optimization barrier */
9883  /* The "volatile" is due to gcc bugs */
9884 @@ -181,4 +182,6 @@
9885         char _f[20-2*sizeof(long)-sizeof(int)]; /* Padding: libc5 uses this.. */
9886  };
9887
9888 -#endif
9889 +#define BUG_ON(condition) do { if (unlikely((condition)!=0)) BUG(); } while(0)
9890 +
9891 +#endif /* _LINUX_KERNEL_H */
9892 diff -urN linux-2.4.18/include/net/bluetooth/bluetooth.h linux-2.4.18-mh9/include/net/bluetooth/bluetooth.h
9893 --- linux-2.4.18/include/net/bluetooth/bluetooth.h      Fri Sep  7 18:28:38 2001
9894 +++ linux-2.4.18-mh9/include/net/bluetooth/bluetooth.h  Mon Aug 25 18:38:11 2003
9895 @@ -23,7 +23,7 @@
9896  */
9897
9898  /*
9899 - *  $Id: bluetooth.h,v 1.6 2001/08/03 04:19:49 maxk Exp $
9900 + *  $Id: bluetooth.h,v 1.9 2002/05/06 21:11:55 maxk Exp $
9901   */
9902
9903  #ifndef __BLUETOOTH_H
9904 @@ -31,17 +31,63 @@
9905
9906  #include <asm/types.h>
9907  #include <asm/byteorder.h>
9908 +#include <linux/poll.h>
9909 +#include <net/sock.h>
9910
9911  #ifndef AF_BLUETOOTH
9912  #define AF_BLUETOOTH   31
9913  #define PF_BLUETOOTH   AF_BLUETOOTH
9914  #endif
9915
9916 +/* Reserv for core and drivers use */
9917 +#define BLUEZ_SKB_RESERVE       8
9918 +
9919 +#ifndef MIN
9920 +#define MIN(a,b) ((a) < (b) ? (a) : (b))
9921 +#endif
9922 +
9923  #define BTPROTO_L2CAP   0
9924  #define BTPROTO_HCI     1
9925 +#define BTPROTO_SCO    2
9926 +#define BTPROTO_RFCOMM 3
9927 +#define BTPROTO_BNEP   4
9928 +#define BTPROTO_CMTP   5
9929
9930  #define SOL_HCI     0
9931  #define SOL_L2CAP   6
9932 +#define SOL_SCO     17
9933 +#define SOL_RFCOMM  18
9934 +
9935 +/* Debugging */
9936 +#ifdef CONFIG_BLUEZ_DEBUG
9937 +
9938 +#define HCI_CORE_DEBUG         1
9939 +#define HCI_SOCK_DEBUG         1
9940 +#define HCI_UART_DEBUG         1
9941 +#define HCI_USB_DEBUG          1
9942 +//#define HCI_DATA_DUMP                1
9943 +
9944 +#define L2CAP_DEBUG            1
9945 +#define SCO_DEBUG              1
9946 +#define AF_BLUETOOTH_DEBUG     1
9947 +
9948 +#endif /* CONFIG_BLUEZ_DEBUG */
9949 +
9950 +extern void bluez_dump(char *pref, __u8 *buf, int count);
9951 +
9952 +#if __GNUC__ <= 2 && __GNUC_MINOR__ < 95
9953 +#define __func__ __FUNCTION__
9954 +#endif
9955 +
9956 +#define BT_INFO(fmt, arg...) printk(KERN_INFO fmt "\n" , ## arg)
9957 +#define BT_DBG(fmt, arg...)  printk(KERN_INFO "%s: " fmt "\n" , __func__ , ## arg)
9958 +#define BT_ERR(fmt, arg...)  printk(KERN_ERR  "%s: " fmt "\n" , __func__ , ## arg)
9959 +
9960 +#ifdef HCI_DATA_DUMP
9961 +#define BT_DMP(buf, len)    bluez_dump(__func__, buf, len)
9962 +#else
9963 +#define BT_DMP(D...)
9964 +#endif
9965
9966  /* Connection and socket states */
9967  enum {
9968 @@ -50,6 +96,7 @@
9969         BT_BOUND,
9970         BT_LISTEN,
9971         BT_CONNECT,
9972 +       BT_CONNECT2,
9973         BT_CONFIG,
9974         BT_DISCONN,
9975         BT_CLOSED
9976 @@ -66,7 +113,8 @@
9977         __u8 b[6];
9978  } __attribute__((packed)) bdaddr_t;
9979
9980 -#define BDADDR_ANY ((bdaddr_t *)"\000\000\000\000\000")
9981 +#define BDADDR_ANY   (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
9982 +#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
9983
9984  /* Copy, swap, convert BD Address */
9985  static inline int bacmp(bdaddr_t *ba1, bdaddr_t *ba2)
9986 @@ -82,6 +130,91 @@
9987  char *batostr(bdaddr_t *ba);
9988  bdaddr_t *strtoba(char *str);
9989
9990 +/* Common socket structures and functions */
9991 +
9992 +#define bluez_pi(sk) ((struct bluez_pinfo *) &sk->protinfo)
9993 +#define bluez_sk(pi) ((struct sock *) \
9994 +       ((void *)pi - (unsigned long)(&((struct sock *)0)->protinfo)))
9995 +
9996 +struct bluez_pinfo {
9997 +       bdaddr_t        src;
9998 +       bdaddr_t        dst;
9999 +
10000 +       struct list_head accept_q;
10001 +       struct sock *parent;
10002 +};
10003 +
10004 +struct bluez_sock_list {
10005 +       struct sock *head;
10006 +       rwlock_t     lock;
10007 +};
10008 +
10009 +int  bluez_sock_register(int proto, struct net_proto_family *ops);
10010 +int  bluez_sock_unregister(int proto);
10011 +void bluez_sock_init(struct socket *sock, struct sock *sk);
10012 +void bluez_sock_link(struct bluez_sock_list *l, struct sock *s);
10013 +void bluez_sock_unlink(struct bluez_sock_list *l, struct sock *s);
10014 +int  bluez_sock_recvmsg(struct socket *sock, struct msghdr *msg, int len, int flags, struct scm_cookie *scm);
10015 +uint bluez_sock_poll(struct file * file, struct socket *sock, poll_table *wait);
10016 +int  bluez_sock_wait_state(struct sock *sk, int state, unsigned long timeo);
10017 +
10018 +void bluez_accept_enqueue(struct sock *parent, struct sock *sk);
10019 +struct sock * bluez_accept_dequeue(struct sock *parent, struct socket *newsock);
10020 +
10021 +/* Skb helpers */
10022 +struct bluez_skb_cb {
10023 +       int    incomming;
10024 +};
10025 +#define bluez_cb(skb)  ((struct bluez_skb_cb *)(skb->cb))
10026 +
10027 +static inline struct sk_buff *bluez_skb_alloc(unsigned int len, int how)
10028 +{
10029 +       struct sk_buff *skb;
10030 +
10031 +       if ((skb = alloc_skb(len + BLUEZ_SKB_RESERVE, how))) {
10032 +               skb_reserve(skb, BLUEZ_SKB_RESERVE);
10033 +               bluez_cb(skb)->incomming  = 0;
10034 +       }
10035 +       return skb;
10036 +}
10037 +
10038 +static inline struct sk_buff *bluez_skb_send_alloc(struct sock *sk, unsigned long len,
10039 +                                                      int nb, int *err)
10040 +{
10041 +       struct sk_buff *skb;
10042 +
10043 +       if ((skb = sock_alloc_send_skb(sk, len + BLUEZ_SKB_RESERVE, nb, err))) {
10044 +               skb_reserve(skb, BLUEZ_SKB_RESERVE);
10045 +               bluez_cb(skb)->incomming  = 0;
10046 +       }
10047 +
10048 +       return skb;
10049 +}
10050 +
10051 +static inline int skb_frags_no(struct sk_buff *skb)
10052 +{
10053 +       register struct sk_buff *frag = skb_shinfo(skb)->frag_list;
10054 +       register int n = 1;
10055 +
10056 +       for (; frag; frag=frag->next, n++);
10057 +       return n;
10058 +}
10059 +
10060 +int hci_core_init(void);
10061 +int hci_core_cleanup(void);
10062 +int hci_sock_init(void);
10063 +int hci_sock_cleanup(void);
10064 +
10065  int bterr(__u16 code);
10066 +
10067 +#ifndef MODULE_LICENSE
10068 +#define MODULE_LICENSE(x)
10069 +#endif
10070 +
10071 +#ifndef list_for_each_safe
10072 +#define list_for_each_safe(pos, n, head) \
10073 +       for (pos = (head)->next, n = pos->next; pos != (head); \
10074 +               pos = n, n = pos->next)
10075 +#endif
10076
10077  #endif /* __BLUETOOTH_H */
10078 diff -urN linux-2.4.18/include/net/bluetooth/bluez.h linux-2.4.18-mh9/include/net/bluetooth/bluez.h
10079 --- linux-2.4.18/include/net/bluetooth/bluez.h  Fri Sep  7 18:28:38 2001
10080 +++ linux-2.4.18-mh9/include/net/bluetooth/bluez.h      Thu Jan  1 01:00:00 1970
10081 @@ -1,124 +0,0 @@
10082 -/*
10083 -   BlueZ - Bluetooth protocol stack for Linux
10084 -   Copyright (C) 2000-2001 Qualcomm Incorporated
10085 -
10086 -   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10087 -
10088 -   This program is free software; you can redistribute it and/or modify
10089 -   it under the terms of the GNU General Public License version 2 as
10090 -   published by the Free Software Foundation;
10091 -
10092 -   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
10093 -   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
10094 -   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
10095 -   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
10096 -   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
10097 -   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
10098 -   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
10099 -   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
10100 -
10101 -   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
10102 -   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
10103 -   SOFTWARE IS DISCLAIMED.
10104 -*/
10105 -
10106 -/*
10107 - *  $Id: bluez.h,v 1.4 2001/08/03 04:19:49 maxk Exp $
10108 - */
10109 -
10110 -#ifndef __IF_BLUEZ_H
10111 -#define __IF_BLUEZ_H
10112 -
10113 -#include <net/sock.h>
10114 -
10115 -#define BLUEZ_MAX_PROTO        2
10116 -
10117 -/* Reserv for core and drivers use */
10118 -#define BLUEZ_SKB_RESERVE      8
10119 -
10120 -#ifndef MIN
10121 -#define MIN(a,b) ((a) < (b) ? (a) : (b))
10122 -#endif
10123 -
10124 -/* Debugging */
10125 -#ifdef BLUEZ_DEBUG
10126 -
10127 -#define HCI_CORE_DEBUG         1
10128 -#define HCI_SOCK_DEBUG         1
10129 -#define HCI_UART_DEBUG         1
10130 -#define HCI_USB_DEBUG          1
10131 -//#define HCI_DATA_DUMP                1
10132 -
10133 -#define L2CAP_DEBUG                    1
10134 -
10135 -#endif /* BLUEZ_DEBUG */
10136 -
10137 -extern void bluez_dump(char *pref, __u8 *buf, int count);
10138 -
10139 -#define INF(fmt, arg...) printk(KERN_INFO fmt "\n" , ## arg)
10140 -#define DBG(fmt, arg...) printk(KERN_INFO __FUNCTION__ ": " fmt "\n" , ## arg)
10141 -#define ERR(fmt, arg...) printk(KERN_ERR  __FUNCTION__ ": " fmt "\n" , ## arg)
10142 -
10143 -#ifdef HCI_DATA_DUMP
10144 -#define DMP(buf, len)    bluez_dump(__FUNCTION__, buf, len)
10145 -#else
10146 -#define DMP(D...)
10147 -#endif
10148 -
10149 -/* ----- Sockets ------ */
10150 -struct bluez_sock_list {
10151 -       struct sock *head;
10152 -       rwlock_t     lock;
10153 -};
10154 -
10155 -extern int  bluez_sock_register(int proto, struct net_proto_family *ops);
10156 -extern int  bluez_sock_unregister(int proto);
10157 -
10158 -extern void bluez_sock_link(struct bluez_sock_list *l, struct sock *s);
10159 -extern void bluez_sock_unlink(struct bluez_sock_list *l, struct sock *s);
10160 -
10161 -/* ----- SKB helpers ----- */
10162 -struct bluez_skb_cb {
10163 -       int    incomming;
10164 -};
10165 -#define bluez_cb(skb)  ((struct bluez_skb_cb *)(skb->cb))
10166 -
10167 -static inline struct sk_buff *bluez_skb_alloc(unsigned int len, int how)
10168 -{
10169 -       struct sk_buff *skb;
10170 -
10171 -       if ((skb = alloc_skb(len + BLUEZ_SKB_RESERVE, how))) {
10172 -               skb_reserve(skb, BLUEZ_SKB_RESERVE);
10173 -               bluez_cb(skb)->incomming  = 0;
10174 -       }
10175 -       return skb;
10176 -}
10177 -
10178 -static inline struct sk_buff *bluez_skb_send_alloc(struct sock *sk, unsigned long len,
10179 -                                                      int nb, int *err)
10180 -{
10181 -       struct sk_buff *skb;
10182 -
10183 -       if ((skb = sock_alloc_send_skb(sk, len + BLUEZ_SKB_RESERVE, nb, err))) {
10184 -               skb_reserve(skb, BLUEZ_SKB_RESERVE);
10185 -               bluez_cb(skb)->incomming  = 0;
10186 -       }
10187 -
10188 -       return skb;
10189 -}
10190 -
10191 -static inline int skb_frags_no(struct sk_buff *skb)
10192 -{
10193 -       register struct sk_buff *frag = skb_shinfo(skb)->frag_list;
10194 -       register int n = 1;
10195 -
10196 -       for (; frag; frag=frag->next, n++);
10197 -       return n;
10198 -}
10199 -
10200 -extern int hci_core_init(void);
10201 -extern int hci_core_cleanup(void);
10202 -extern int hci_sock_init(void);
10203 -extern int hci_sock_cleanup(void);
10204 -
10205 -#endif /* __IF_BLUEZ_H */
10206 diff -urN linux-2.4.18/include/net/bluetooth/hci.h linux-2.4.18-mh9/include/net/bluetooth/hci.h
10207 --- linux-2.4.18/include/net/bluetooth/hci.h    Fri Sep  7 18:28:38 2001
10208 +++ linux-2.4.18-mh9/include/net/bluetooth/hci.h        Mon Aug 25 18:38:12 2003
10209 @@ -23,59 +23,80 @@
10210  */
10211
10212  /*
10213 - *  $Id: hci.h,v 1.15 2001/08/05 06:02:15 maxk Exp $
10214 + *  $Id: hci.h,v 1.5 2002/06/27 17:29:30 maxk Exp $
10215   */
10216
10217  #ifndef __HCI_H
10218  #define __HCI_H
10219
10220 -#include <asm/byteorder.h>
10221 -
10222 -#define HCI_MAX_DEV    8
10223 -#define HCI_MAX_FRAME_SIZE     2048
10224 +#define HCI_MAX_ACL_SIZE       1024
10225 +#define HCI_MAX_SCO_SIZE       255
10226 +#define HCI_MAX_EVENT_SIZE     260
10227 +#define HCI_MAX_FRAME_SIZE     (HCI_MAX_ACL_SIZE + 4)
10228
10229  /* HCI dev events */
10230  #define HCI_DEV_REG    1
10231  #define HCI_DEV_UNREG   2
10232  #define HCI_DEV_UP     3
10233  #define HCI_DEV_DOWN   4
10234 +#define HCI_DEV_SUSPEND        5
10235 +#define HCI_DEV_RESUME 6
10236 +
10237 +/* HCI notify events */
10238 +#define HCI_NOTIFY_CONN_ADD            1
10239 +#define HCI_NOTIFY_CONN_DEL            2
10240 +#define HCI_NOTIFY_VOICE_SETTING       3
10241
10242  /* HCI device types */
10243 -#define HCI_UART       0
10244 +#define HCI_VHCI       0
10245  #define HCI_USB                1
10246 -#define HCI_VHCI       2
10247 -
10248 -/* HCI device modes */
10249 -#define HCI_NORMAL     0x0001
10250 -#define HCI_RAW                0x0002
10251 -#define HCI_MODE_MASK   (HCI_NORMAL | HCI_RAW)
10252 -#define HCI_SOCK       0x1000
10253 -
10254 -/* HCI device states */
10255 -#define HCI_INIT       0x0010
10256 -#define HCI_UP                 0x0020
10257 -#define HCI_RUNNING    0x0040
10258 +#define HCI_PCCARD     2
10259 +#define HCI_UART       3
10260 +#define HCI_RS232      4
10261 +#define HCI_PCI                5
10262
10263  /* HCI device flags */
10264 -#define HCI_PSCAN      0x0100
10265 -#define HCI_ISCAN      0x0200
10266 -#define HCI_AUTH       0x0400
10267 +enum {
10268 +       HCI_UP,
10269 +       HCI_INIT,
10270 +       HCI_RUNNING,
10271 +
10272 +       HCI_PSCAN,
10273 +       HCI_ISCAN,
10274 +       HCI_AUTH,
10275 +       HCI_ENCRYPT,
10276 +       HCI_INQUIRY,
10277 +
10278 +       HCI_RAW
10279 +};
10280
10281 -/* HCI Ioctl defines */
10282 +/* HCI ioctl defines */
10283  #define HCIDEVUP        _IOW('H', 201, int)
10284  #define HCIDEVDOWN      _IOW('H', 202, int)
10285  #define HCIDEVRESET     _IOW('H', 203, int)
10286 -#define HCIRESETSTAT    _IOW('H', 204, int)
10287 -#define HCIGETINFO      _IOR('H', 205, int)
10288 -#define HCIGETDEVLIST   _IOR('H', 206, int)
10289 -#define HCISETRAW       _IOW('H', 207, int)
10290 -#define HCISETSCAN      _IOW('H', 208, int)
10291 -#define HCISETAUTH      _IOW('H', 209, int)
10292 -#define HCIINQUIRY      _IOR('H', 210, int)
10293 -#define HCISETPTYPE     _IOW('H', 211, int)
10294 +#define HCIDEVRESTAT    _IOW('H', 204, int)
10295 +
10296 +#define HCIGETDEVLIST   _IOR('H', 210, int)
10297 +#define HCIGETDEVINFO   _IOR('H', 211, int)
10298  #define HCIGETCONNLIST  _IOR('H', 212, int)
10299 +#define HCIGETCONNINFO  _IOR('H', 213, int)
10300
10301 -#ifndef __NO_HCI_DEFS
10302 +#define HCISETRAW       _IOW('H', 220, int)
10303 +#define HCISETSCAN      _IOW('H', 221, int)
10304 +#define HCISETAUTH      _IOW('H', 222, int)
10305 +#define HCISETENCRYPT   _IOW('H', 223, int)
10306 +#define HCISETPTYPE     _IOW('H', 224, int)
10307 +#define HCISETLINKPOL   _IOW('H', 225, int)
10308 +#define HCISETLINKMODE  _IOW('H', 226, int)
10309 +#define HCISETACLMTU    _IOW('H', 227, int)
10310 +#define HCISETSCOMTU    _IOW('H', 228, int)
10311 +
10312 +#define HCIINQUIRY      _IOR('H', 240, int)
10313 +
10314 +/* HCI timeouts */
10315 +#define HCI_CONN_TIMEOUT       (HZ * 40)
10316 +#define HCI_DISCONN_TIMEOUT    (HZ * 2)
10317 +#define HCI_CONN_IDLE_TIMEOUT  (HZ * 60)
10318
10319  /* HCI Packet types */
10320  #define HCI_COMMAND_PKT                0x01
10321 @@ -92,11 +113,18 @@
10322  #define HCI_DH3        0x0800
10323  #define HCI_DH5        0x8000
10324
10325 +#define HCI_HV1                0x0020
10326 +#define HCI_HV2                0x0040
10327 +#define HCI_HV3                0x0080
10328 +
10329 +#define SCO_PTYPE_MASK (HCI_HV1 | HCI_HV2 | HCI_HV3)
10330 +#define ACL_PTYPE_MASK (~SCO_PTYPE_MASK)
10331 +
10332  /* ACL flags */
10333 -#define ACL_CONT               0x0001
10334 -#define ACL_START              0x0002
10335 -#define ACL_ACTIVE_BCAST       0x0010
10336 -#define ACL_PICO_BCAST         0x0020
10337 +#define ACL_CONT               0x01
10338 +#define ACL_START              0x02
10339 +#define ACL_ACTIVE_BCAST       0x04
10340 +#define ACL_PICO_BCAST         0x08
10341
10342  /* Baseband links */
10343  #define SCO_LINK       0x00
10344 @@ -125,6 +153,20 @@
10345  #define LMP_PSCHEME    0x02
10346  #define LMP_PCONTROL   0x04
10347
10348 +/* Link policies */
10349 +#define HCI_LP_RSWITCH 0x0001
10350 +#define HCI_LP_HOLD    0x0002
10351 +#define HCI_LP_SNIFF   0x0004
10352 +#define HCI_LP_PARK    0x0008
10353 +
10354 +/* Link mode */
10355 +#define HCI_LM_ACCEPT  0x8000
10356 +#define HCI_LM_MASTER  0x0001
10357 +#define HCI_LM_AUTH    0x0002
10358 +#define HCI_LM_ENCRYPT 0x0004
10359 +#define HCI_LM_TRUSTED 0x0008
10360 +#define HCI_LM_RELIABLE        0x0010
10361 +
10362  /* -----  HCI Commands ----- */
10363  /* OGF & OCF values */
10364
10365 @@ -137,9 +179,10 @@
10366         __u8  hci_ver;
10367         __u16 hci_rev;
10368         __u8  lmp_ver;
10369 -       __u16 man_name;
10370 -       __u16 lmp_sub;
10371 +       __u16 manufacturer;
10372 +       __u16 lmp_subver;
10373  } __attribute__ ((packed)) read_local_version_rp;
10374 +#define READ_LOCAL_VERSION_RP_SIZE 9
10375
10376  #define OCF_READ_LOCAL_FEATURES        0x0003
10377  typedef struct {
10378 @@ -165,18 +208,24 @@
10379  /* Host Controller and Baseband */
10380  #define OGF_HOST_CTL   0x03
10381  #define OCF_RESET              0x0003
10382 +#define OCF_READ_AUTH_ENABLE   0x001F
10383  #define OCF_WRITE_AUTH_ENABLE  0x0020
10384 -       #define AUTH_DISABLED                   0x00
10385 -       #define AUTH_ENABLED                    0x01
10386 +       #define AUTH_DISABLED           0x00
10387 +       #define AUTH_ENABLED            0x01
10388 +
10389 +#define OCF_READ_ENCRYPT_MODE  0x0021
10390 +#define OCF_WRITE_ENCRYPT_MODE 0x0022
10391 +       #define ENCRYPT_DISABLED        0x00
10392 +       #define ENCRYPT_P2P             0x01
10393 +       #define ENCRYPT_BOTH            0x02
10394
10395  #define OCF_WRITE_CA_TIMEOUT   0x0016
10396  #define OCF_WRITE_PG_TIMEOUT   0x0018
10397
10398  #define OCF_WRITE_SCAN_ENABLE  0x001A
10399 -       #define SCANS_DISABLED          0x00
10400 -       #define IS_ENA_PS_DIS           0x01
10401 -       #define IS_DIS_PS_ENA           0x02
10402 -       #define IS_ENA_PS_ENA           0x03
10403 +       #define SCAN_DISABLED           0x00
10404 +       #define SCAN_INQUIRY            0x01
10405 +       #define SCAN_PAGE               0x02
10406
10407  #define OCF_SET_EVENT_FLT      0x0005
10408  typedef struct {
10409 @@ -226,9 +275,31 @@
10410  } __attribute__ ((packed)) write_class_of_dev_cp;
10411  #define WRITE_CLASS_OF_DEV_CP_SIZE 3
10412
10413 +#define OCF_READ_VOICE_SETTING 0x0025
10414 +typedef struct {
10415 +       __u8    status;
10416 +       __u16   voice_setting;
10417 +} __attribute__ ((packed)) read_voice_setting_rp;
10418 +#define READ_VOICE_SETTING_RP_SIZE 3
10419 +
10420 +#define OCF_WRITE_VOICE_SETTING        0x0026
10421 +typedef struct {
10422 +       __u16   voice_setting;
10423 +} __attribute__ ((packed)) write_voice_setting_cp;
10424 +#define WRITE_VOICE_SETTING_CP_SIZE 2
10425 +
10426 +#define OCF_HOST_BUFFER_SIZE   0x0033
10427 +typedef struct {
10428 +       __u16   acl_mtu;
10429 +       __u8    sco_mtu;
10430 +       __u16   acl_max_pkt;
10431 +       __u16   sco_max_pkt;
10432 +} __attribute__ ((packed)) host_buffer_size_cp;
10433 +#define HOST_BUFFER_SIZE_CP_SIZE 7
10434 +
10435  /* Link Control */
10436  #define OGF_LINK_CTL   0x01
10437 -#define OCF_CREATE_CONN        0x0005
10438 +#define OCF_CREATE_CONN                0x0005
10439  typedef struct {
10440         bdaddr_t bdaddr;
10441         __u16   pkt_type;
10442 @@ -246,6 +317,13 @@
10443  } __attribute__ ((packed)) accept_conn_req_cp;
10444  #define ACCEPT_CONN_REQ_CP_SIZE        7
10445
10446 +#define OCF_REJECT_CONN_REQ    0x000a
10447 +typedef struct {
10448 +       bdaddr_t bdaddr;
10449 +       __u8    reason;
10450 +} __attribute__ ((packed)) reject_conn_req_cp;
10451 +#define REJECT_CONN_REQ_CP_SIZE        7
10452 +
10453  #define OCF_DISCONNECT 0x0006
10454  typedef struct {
10455         __u16   handle;
10456 @@ -253,17 +331,142 @@
10457  } __attribute__ ((packed)) disconnect_cp;
10458  #define DISCONNECT_CP_SIZE 3
10459
10460 +#define OCF_ADD_SCO    0x0007
10461 +typedef struct {
10462 +       __u16   handle;
10463 +       __u16   pkt_type;
10464 +} __attribute__ ((packed)) add_sco_cp;
10465 +#define ADD_SCO_CP_SIZE 4
10466 +
10467  #define OCF_INQUIRY            0x0001
10468  typedef struct {
10469         __u8    lap[3];
10470 -       __u8    lenght;
10471 +       __u8    length;
10472         __u8    num_rsp;
10473  } __attribute__ ((packed)) inquiry_cp;
10474  #define INQUIRY_CP_SIZE 5
10475
10476 -#define OGF_LINK_POLICY                0x02   /* Link Policy */
10477 +typedef struct {
10478 +       __u8     status;
10479 +       bdaddr_t bdaddr;
10480 +} __attribute__ ((packed)) status_bdaddr_rp;
10481 +#define STATUS_BDADDR_RP_SIZE 7
10482 +
10483 +#define OCF_INQUIRY_CANCEL     0x0002
10484 +
10485 +#define OCF_LINK_KEY_REPLY     0x000B
10486 +#define OCF_LINK_KEY_NEG_REPLY 0x000C
10487 +typedef struct {
10488 +       bdaddr_t bdaddr;
10489 +       __u8     link_key[16];
10490 +} __attribute__ ((packed)) link_key_reply_cp;
10491 +#define LINK_KEY_REPLY_CP_SIZE 22
10492 +
10493 +#define OCF_PIN_CODE_REPLY     0x000D
10494 +#define OCF_PIN_CODE_NEG_REPLY 0x000E
10495 +typedef struct {
10496 +       bdaddr_t bdaddr;
10497 +       __u8     pin_len;
10498 +       __u8     pin_code[16];
10499 +} __attribute__ ((packed)) pin_code_reply_cp;
10500 +#define PIN_CODE_REPLY_CP_SIZE 23
10501 +
10502 +#define OCF_CHANGE_CONN_PTYPE  0x000F
10503 +typedef struct {
10504 +       __u16    handle;
10505 +       __u16    pkt_type;
10506 +} __attribute__ ((packed)) change_conn_ptype_cp;
10507 +#define CHANGE_CONN_PTYPE_CP_SIZE 4
10508 +
10509 +#define OCF_AUTH_REQUESTED     0x0011
10510 +typedef struct {
10511 +       __u16    handle;
10512 +} __attribute__ ((packed)) auth_requested_cp;
10513 +#define AUTH_REQUESTED_CP_SIZE 2
10514 +
10515 +#define OCF_SET_CONN_ENCRYPT   0x0013
10516 +typedef struct {
10517 +       __u16    handle;
10518 +       __u8     encrypt;
10519 +} __attribute__ ((packed)) set_conn_encrypt_cp;
10520 +#define SET_CONN_ENCRYPT_CP_SIZE 3
10521 +
10522 +#define OCF_REMOTE_NAME_REQ    0x0019
10523 +typedef struct {
10524 +       bdaddr_t bdaddr;
10525 +       __u8     pscan_rep_mode;
10526 +       __u8     pscan_mode;
10527 +       __u16    clock_offset;
10528 +} __attribute__ ((packed)) remote_name_req_cp;
10529 +#define REMOTE_NAME_REQ_CP_SIZE 10
10530 +
10531 +#define OCF_READ_REMOTE_FEATURES 0x001B
10532 +typedef struct {
10533 +       __u16   handle;
10534 +} __attribute__ ((packed)) read_remote_features_cp;
10535 +#define READ_REMOTE_FEATURES_CP_SIZE 2
10536 +
10537 +#define OCF_READ_REMOTE_VERSION 0x001D
10538 +typedef struct {
10539 +       __u16   handle;
10540 +} __attribute__ ((packed)) read_remote_version_cp;
10541 +#define READ_REMOTE_VERSION_CP_SIZE 2
10542 +
10543 +/* Link Policy */
10544 +#define OGF_LINK_POLICY         0x02
10545 +#define OCF_ROLE_DISCOVERY     0x0009
10546 +typedef struct {
10547 +       __u16   handle;
10548 +} __attribute__ ((packed)) role_discovery_cp;
10549 +#define ROLE_DISCOVERY_CP_SIZE 2
10550 +typedef struct {
10551 +       __u8    status;
10552 +       __u16   handle;
10553 +       __u8    role;
10554 +} __attribute__ ((packed)) role_discovery_rp;
10555 +#define ROLE_DISCOVERY_RP_SIZE 4
10556
10557 -/* --------- HCI Events --------- */
10558 +#define OCF_READ_LINK_POLICY   0x000C
10559 +typedef struct {
10560 +       __u16   handle;
10561 +} __attribute__ ((packed)) read_link_policy_cp;
10562 +#define READ_LINK_POLICY_CP_SIZE 2
10563 +typedef struct {
10564 +       __u8    status;
10565 +       __u16   handle;
10566 +       __u16   policy;
10567 +} __attribute__ ((packed)) read_link_policy_rp;
10568 +#define READ_LINK_POLICY_RP_SIZE 5
10569 +
10570 +#define OCF_SWITCH_ROLE        0x000B
10571 +typedef struct {
10572 +       bdaddr_t bdaddr;
10573 +       __u8     role;
10574 +} __attribute__ ((packed)) switch_role_cp;
10575 +#define SWITCH_ROLE_CP_SIZE 7
10576 +
10577 +#define OCF_WRITE_LINK_POLICY  0x000D
10578 +typedef struct {
10579 +       __u16   handle;
10580 +       __u16   policy;
10581 +} __attribute__ ((packed)) write_link_policy_cp;
10582 +#define WRITE_LINK_POLICY_CP_SIZE 4
10583 +typedef struct {
10584 +       __u8    status;
10585 +       __u16   handle;
10586 +} __attribute__ ((packed)) write_link_policy_rp;
10587 +#define WRITE_LINK_POLICY_RP_SIZE 3
10588 +
10589 +/* Status params */
10590 +#define OGF_STATUS_PARAM       0x05
10591 +
10592 +/* Testing commands */
10593 +#define OGF_TESTING_CMD        0x3e
10594 +
10595 +/* Vendor specific commands */
10596 +#define OGF_VENDOR_CMD         0x3f
10597 +
10598 +/* ---- HCI Events ---- */
10599  #define EVT_INQUIRY_COMPLETE   0x01
10600
10601  #define EVT_INQUIRY_RESULT     0x02
10602 @@ -272,7 +475,7 @@
10603         __u8    pscan_rep_mode;
10604         __u8    pscan_period_mode;
10605         __u8    pscan_mode;
10606 -       __u8    class[3];
10607 +       __u8    dev_class[3];
10608         __u16   clock_offset;
10609  } __attribute__ ((packed)) inquiry_info;
10610  #define INQUIRY_INFO_SIZE 14
10611 @@ -303,6 +506,44 @@
10612  } __attribute__ ((packed)) evt_disconn_complete;
10613  #define EVT_DISCONN_COMPLETE_SIZE 4
10614
10615 +#define EVT_AUTH_COMPLETE      0x06
10616 +typedef struct {
10617 +       __u8    status;
10618 +       __u16   handle;
10619 +} __attribute__ ((packed)) evt_auth_complete;
10620 +#define EVT_AUTH_COMPLETE_SIZE 3
10621 +
10622 +#define EVT_REMOTE_NAME_REQ_COMPLETE   0x07
10623 +typedef struct {
10624 +       __u8     status;
10625 +       bdaddr_t bdaddr;
10626 +       __u8     name[248];
10627 +} __attribute__ ((packed)) evt_remote_name_req_complete;
10628 +#define EVT_REMOTE_NAME_REQ_COMPLETE_SIZE 255
10629 +
10630 +#define EVT_ENCRYPT_CHANGE     0x08
10631 +typedef struct {
10632 +       __u8    status;
10633 +       __u16   handle;
10634 +       __u8    encrypt;
10635 +} __attribute__ ((packed)) evt_encrypt_change;
10636 +#define EVT_ENCRYPT_CHANGE_SIZE 5
10637 +
10638 +#define EVT_QOS_SETUP_COMPLETE 0x0D
10639 +typedef struct {
10640 +       __u8    service_type;
10641 +       __u32   token_rate;
10642 +       __u32   peak_bandwidth;
10643 +       __u32   latency;
10644 +       __u32   delay_variation;
10645 +} __attribute__ ((packed)) hci_qos;
10646 +typedef struct {
10647 +       __u8    status;
10648 +       __u16   handle;
10649 +       hci_qos qos;
10650 +} __attribute__ ((packed)) evt_qos_setup_complete;
10651 +#define EVT_QOS_SETUP_COMPLETE_SIZE 20
10652 +
10653  #define EVT_CMD_COMPLETE       0x0e
10654  typedef struct {
10655         __u8    ncmd;
10656 @@ -321,16 +562,78 @@
10657  #define EVT_NUM_COMP_PKTS      0x13
10658  typedef struct {
10659         __u8    num_hndl;
10660 -       /* variable lenght part */
10661 +       /* variable length part */
10662  } __attribute__ ((packed)) evt_num_comp_pkts;
10663  #define EVT_NUM_COMP_PKTS_SIZE 1
10664
10665 -#define EVT_HCI_DEV_EVENT      0xfd
10666 +#define EVT_ROLE_CHANGE                0x12
10667 +typedef struct {
10668 +       __u8     status;
10669 +       bdaddr_t bdaddr;
10670 +       __u8     role;
10671 +} __attribute__ ((packed)) evt_role_change;
10672 +#define EVT_ROLE_CHANGE_SIZE 8
10673 +
10674 +#define EVT_PIN_CODE_REQ        0x16
10675 +typedef struct {
10676 +       bdaddr_t bdaddr;
10677 +} __attribute__ ((packed)) evt_pin_code_req;
10678 +#define EVT_PIN_CODE_REQ_SIZE 6
10679 +
10680 +#define EVT_LINK_KEY_REQ        0x17
10681 +typedef struct {
10682 +       bdaddr_t bdaddr;
10683 +} __attribute__ ((packed)) evt_link_key_req;
10684 +#define EVT_LINK_KEY_REQ_SIZE 6
10685 +
10686 +#define EVT_LINK_KEY_NOTIFY    0x18
10687 +typedef struct {
10688 +       bdaddr_t bdaddr;
10689 +       __u8     link_key[16];
10690 +       __u8     key_type;
10691 +} __attribute__ ((packed)) evt_link_key_notify;
10692 +#define EVT_LINK_KEY_NOTIFY_SIZE 23
10693 +
10694 +#define EVT_READ_REMOTE_FEATURES_COMPLETE 0x0B
10695 +typedef struct {
10696 +       __u8    status;
10697 +       __u16   handle;
10698 +       __u8    features[8];
10699 +} __attribute__ ((packed)) evt_read_remote_features_complete;
10700 +#define EVT_READ_REMOTE_FEATURES_COMPLETE_SIZE 11
10701 +
10702 +#define EVT_READ_REMOTE_VERSION_COMPLETE 0x0C
10703 +typedef struct {
10704 +       __u8    status;
10705 +       __u16   handle;
10706 +       __u8    lmp_ver;
10707 +       __u16   manufacturer;
10708 +       __u16   lmp_subver;
10709 +} __attribute__ ((packed)) evt_read_remote_version_complete;
10710 +#define EVT_READ_REMOTE_VERSION_COMPLETE_SIZE 8
10711 +
10712 +/* Internal events generated by BlueZ stack */
10713 +#define EVT_STACK_INTERNAL     0xfd
10714 +typedef struct {
10715 +       __u16   type;
10716 +       __u8    data[0];
10717 +} __attribute__ ((packed)) evt_stack_internal;
10718 +#define EVT_STACK_INTERNAL_SIZE 2
10719 +
10720 +#define EVT_SI_DEVICE          0x01
10721 +typedef struct {
10722 +       __u16   event;
10723 +       __u16   dev_id;
10724 +} __attribute__ ((packed)) evt_si_device;
10725 +#define EVT_SI_DEVICE_SIZE 4
10726 +
10727 +#define EVT_SI_SECURITY        0x02
10728  typedef struct {
10729         __u16   event;
10730 -       __u16   param;
10731 -} __attribute__ ((packed)) evt_hci_dev_event;
10732 -#define EVT_HCI_DEV_EVENT_SIZE 4
10733 +       __u16   proto;
10734 +       __u16   subproto;
10735 +       __u8    incomming;
10736 +} __attribute__ ((packed)) evt_si_security;
10737
10738  /* --------  HCI Packet structures  -------- */
10739  #define HCI_TYPE_LEN   1
10740 @@ -369,14 +672,14 @@
10741  #define acl_handle(h)          (h & 0x0fff)
10742  #define acl_flags(h)           (h >> 12)
10743
10744 -#endif /* _NO_HCI_DEFS */
10745 -
10746  /* HCI Socket options */
10747 -#define HCI_DATA_DIR   0x0001
10748 -#define HCI_FILTER     0x0002
10749 +#define HCI_DATA_DIR   1
10750 +#define HCI_FILTER     2
10751 +#define HCI_TIME_STAMP 3
10752
10753  /* HCI CMSG flags */
10754  #define HCI_CMSG_DIR   0x0001
10755 +#define HCI_CMSG_TSTAMP        0x0002
10756
10757  struct sockaddr_hci {
10758         sa_family_t    hci_family;
10759 @@ -387,27 +690,29 @@
10760  struct hci_filter {
10761         __u32 type_mask;
10762         __u32 event_mask[2];
10763 +       __u16 opcode;
10764  };
10765
10766 -struct hci_dev_req {
10767 -       __u16 dev_id;
10768 -       __u32 dev_opt;
10769 -};
10770 -
10771 -struct hci_dev_list_req {
10772 -       __u16  dev_num;
10773 -       struct hci_dev_req dev_req[0];  /* hci_dev_req structures */
10774 -};
10775 -
10776 -struct hci_inquiry_req {
10777 -       __u16 dev_id;
10778 -       __u16 flags;
10779 -       __u8  lap[3];
10780 -       __u8  length;
10781 -       __u8  num_rsp;
10782 -};
10783 -#define IREQ_CACHE_FLUSH 0x0001
10784 +#define HCI_FLT_TYPE_BITS      31
10785 +#define HCI_FLT_EVENT_BITS     63
10786 +#define HCI_FLT_OGF_BITS       63
10787 +#define HCI_FLT_OCF_BITS       127
10788 +
10789 +#if BITS_PER_LONG == 64
10790 +static inline void hci_set_bit(int nr, void *addr)
10791 +{
10792 +       *((__u32 *) addr + (nr >> 5)) |= ((__u32) 1 << (nr & 31));
10793 +}
10794 +static inline int hci_test_bit(int nr, void *addr)
10795 +{
10796 +       return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
10797 +}
10798 +#else
10799 +#define hci_set_bit    set_bit
10800 +#define hci_test_bit   test_bit
10801 +#endif
10802
10803 +/* Ioctl requests structures */
10804  struct hci_dev_stats {
10805         __u32 err_rx;
10806         __u32 err_tx;
10807 @@ -433,11 +738,13 @@
10808         __u8  features[8];
10809
10810         __u32 pkt_type;
10811 +       __u32 link_policy;
10812 +       __u32 link_mode;
10813
10814         __u16 acl_mtu;
10815 -       __u16 acl_max;
10816 +       __u16 acl_pkts;
10817         __u16 sco_mtu;
10818 -       __u16 sco_max;
10819 +       __u16 sco_pkts;
10820
10821         struct hci_dev_stats stat;
10822  };
10823 @@ -445,12 +752,48 @@
10824  struct hci_conn_info {
10825         __u16    handle;
10826         bdaddr_t bdaddr;
10827 +       __u8     type;
10828 +       __u8     out;
10829 +       __u16    state;
10830 +       __u32    link_mode;
10831 +};
10832 +
10833 +struct hci_dev_req {
10834 +       __u16 dev_id;
10835 +       __u32 dev_opt;
10836 +};
10837 +
10838 +struct hci_dev_list_req {
10839 +       __u16  dev_num;
10840 +       struct hci_dev_req dev_req[0];  /* hci_dev_req structures */
10841  };
10842
10843  struct hci_conn_list_req {
10844         __u16  dev_id;
10845         __u16  conn_num;
10846         struct hci_conn_info conn_info[0];
10847 +};
10848 +
10849 +struct hci_conn_info_req {
10850 +       bdaddr_t bdaddr;
10851 +       __u8     type;
10852 +       struct   hci_conn_info conn_info[0];
10853 +};
10854 +
10855 +struct hci_inquiry_req {
10856 +       __u16 dev_id;
10857 +       __u16 flags;
10858 +       __u8  lap[3];
10859 +       __u8  length;
10860 +       __u8  num_rsp;
10861 +};
10862 +#define IREQ_CACHE_FLUSH 0x0001
10863 +
10864 +struct hci_remotename_req {
10865 +       __u16 dev_id;
10866 +       __u16 flags;
10867 +       bdaddr_t bdaddr;
10868 +       __u8  name[248];
10869  };
10870
10871  #endif /* __HCI_H */
10872 diff -urN linux-2.4.18/include/net/bluetooth/hci_core.h linux-2.4.18-mh9/include/net/bluetooth/hci_core.h
10873 --- linux-2.4.18/include/net/bluetooth/hci_core.h       Fri Sep  7 18:28:38 2001
10874 +++ linux-2.4.18-mh9/include/net/bluetooth/hci_core.h   Mon Aug 25 18:38:12 2003
10875 @@ -23,7 +23,7 @@
10876  */
10877
10878  /*
10879 - * $Id: hci_core.h,v 1.11 2001/08/05 06:02:15 maxk Exp $
10880 + * $Id: hci_core.h,v 1.5 2002/06/27 04:56:30 maxk Exp $
10881   */
10882
10883  #ifndef __HCI_CORE_H
10884 @@ -32,14 +32,12 @@
10885  #include <net/bluetooth/hci.h>
10886
10887  /* HCI upper protocols */
10888 -#define HCI_MAX_PROTO  1
10889  #define HCI_PROTO_L2CAP        0
10890 +#define HCI_PROTO_SCO  1
10891
10892  #define HCI_INIT_TIMEOUT (HZ * 10)
10893
10894 -/* ----- Inquiry cache ----- */
10895 -#define INQUIRY_CACHE_AGE_MAX   (HZ*5)    // 5 seconds
10896 -#define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   // 60 seconds
10897 +/* HCI Core structures */
10898
10899  struct inquiry_entry {
10900         struct inquiry_entry    *next;
10901 @@ -53,111 +51,182 @@
10902         struct inquiry_entry    *list;
10903  };
10904
10905 -static inline void inquiry_cache_init(struct inquiry_cache *cache)
10906 -{
10907 -       spin_lock_init(&cache->lock);
10908 -       cache->list = NULL;
10909 -}
10910 +struct conn_hash {
10911 +       struct list_head list;
10912 +       spinlock_t       lock;
10913 +       unsigned int     num;
10914 +};
10915
10916 -static inline void inquiry_cache_lock(struct inquiry_cache *cache)
10917 -{
10918 -       spin_lock(&cache->lock);
10919 -}
10920 +struct hci_dev {
10921 +       struct list_head list;
10922 +       spinlock_t      lock;
10923 +       atomic_t        refcnt;
10924
10925 -static inline void inquiry_cache_unlock(struct inquiry_cache *cache)
10926 -{
10927 -       spin_unlock(&cache->lock);
10928 -}
10929 +       char            name[8];
10930 +       unsigned long   flags;
10931 +       __u16           id;
10932 +       __u8            type;
10933 +       bdaddr_t        bdaddr;
10934 +       __u8            features[8];
10935 +       __u16           voice_setting;
10936
10937 -static inline void inquiry_cache_lock_bh(struct inquiry_cache *cache)
10938 -{
10939 -       spin_lock_bh(&cache->lock);
10940 -}
10941 +       __u16           pkt_type;
10942 +       __u16           link_policy;
10943 +       __u16           link_mode;
10944
10945 -static inline void inquiry_cache_unlock_bh(struct inquiry_cache *cache)
10946 -{
10947 -       spin_unlock_bh(&cache->lock);
10948 -}
10949 +       atomic_t        cmd_cnt;
10950 +       unsigned int    acl_cnt;
10951 +       unsigned int    sco_cnt;
10952
10953 -static inline long inquiry_cache_age(struct inquiry_cache *cache)
10954 -{
10955 -       return jiffies - cache->timestamp;
10956 -}
10957 +       unsigned int    acl_mtu;
10958 +       unsigned int    sco_mtu;
10959 +       unsigned int    acl_pkts;
10960 +       unsigned int    sco_pkts;
10961
10962 -static inline long inquiry_entry_age(struct inquiry_entry *e)
10963 -{
10964 -       return jiffies - e->timestamp;
10965 -}
10966 -extern void inquiry_cache_flush(struct inquiry_cache *cache);
10967 +       unsigned long   cmd_last_tx;
10968 +       unsigned long   acl_last_tx;
10969 +       unsigned long   sco_last_tx;
10970 +
10971 +       struct tasklet_struct   cmd_task;
10972 +       struct tasklet_struct   rx_task;
10973 +       struct tasklet_struct   tx_task;
10974
10975 -struct hci_dev;
10976 +       struct sk_buff_head     rx_q;
10977 +       struct sk_buff_head     raw_q;
10978 +       struct sk_buff_head     cmd_q;
10979 +
10980 +       struct sk_buff          *sent_cmd;
10981 +
10982 +       struct semaphore        req_lock;
10983 +       wait_queue_head_t       req_wait_q;
10984 +       __u32                   req_status;
10985 +       __u32                   req_result;
10986 +
10987 +       struct inquiry_cache    inq_cache;
10988 +       struct conn_hash        conn_hash;
10989 +
10990 +       struct hci_dev_stats    stat;
10991 +
10992 +       void                    *driver_data;
10993 +       void                    *core_data;
10994 +
10995 +       atomic_t                promisc;
10996 +
10997 +       int (*open)(struct hci_dev *hdev);
10998 +       int (*close)(struct hci_dev *hdev);
10999 +       int (*flush)(struct hci_dev *hdev);
11000 +       int (*send)(struct sk_buff *skb);
11001 +       void (*destruct)(struct hci_dev *hdev);
11002 +       void (*notify)(struct hci_dev *hdev, unsigned int evt, unsigned long arg);
11003 +       int (*ioctl)(struct hci_dev *hdev, unsigned int cmd, unsigned long arg);
11004 +};
11005
11006 -/* ----- HCI Connections ----- */
11007  struct hci_conn {
11008         struct list_head list;
11009 +
11010 +       atomic_t         refcnt;
11011 +       spinlock_t       lock;
11012 +
11013         bdaddr_t         dst;
11014         __u16            handle;
11015 +       __u16            state;
11016         __u8             type;
11017 -       unsigned int     sent;
11018 +       __u8             out;
11019 +       __u32            link_mode;
11020 +       unsigned long    pend;
11021 +
11022 +       unsigned int     sent;
11023 +
11024 +       struct sk_buff_head data_q;
11025
11026 +       struct timer_list timer;
11027 +
11028         struct hci_dev  *hdev;
11029         void            *l2cap_data;
11030 +       void            *sco_data;
11031         void            *priv;
11032
11033 -       struct sk_buff_head data_q;
11034 +       struct hci_conn *link;
11035  };
11036
11037 -struct conn_hash {
11038 -       struct list_head list;
11039 -       spinlock_t       lock;
11040 -       unsigned int     num;
11041 -};
11042 +extern struct hci_proto *hci_proto[];
11043 +extern struct list_head hdev_list;
11044 +extern rwlock_t hdev_list_lock;
11045 +
11046 +/* ----- Inquiry cache ----- */
11047 +#define INQUIRY_CACHE_AGE_MAX   (HZ*30)   // 30 seconds
11048 +#define INQUIRY_ENTRY_AGE_MAX   (HZ*60)   // 60 seconds
11049 +
11050 +#define inquiry_cache_lock(c)          spin_lock(&c->lock)
11051 +#define inquiry_cache_unlock(c)                spin_unlock(&c->lock)
11052 +#define inquiry_cache_lock_bh(c)       spin_lock_bh(&c->lock)
11053 +#define inquiry_cache_unlock_bh(c)     spin_unlock_bh(&c->lock)
11054
11055 -static inline void conn_hash_init(struct conn_hash *h)
11056 +static inline void inquiry_cache_init(struct hci_dev *hdev)
11057  {
11058 -       INIT_LIST_HEAD(&h->list);
11059 -       spin_lock_init(&h->lock);
11060 -       h->num = 0;
11061 +       struct inquiry_cache *c = &hdev->inq_cache;
11062 +       spin_lock_init(&c->lock);
11063 +       c->list = NULL;
11064  }
11065
11066 -static inline void conn_hash_lock(struct conn_hash *h)
11067 +static inline long inquiry_cache_age(struct hci_dev *hdev)
11068  {
11069 -       spin_lock(&h->lock);
11070 +       struct inquiry_cache *c = &hdev->inq_cache;
11071 +       return jiffies - c->timestamp;
11072  }
11073
11074 -static inline void conn_hash_unlock(struct conn_hash *h)
11075 +static inline long inquiry_entry_age(struct inquiry_entry *e)
11076  {
11077 -       spin_unlock(&h->lock);
11078 +       return jiffies - e->timestamp;
11079  }
11080
11081 -static inline void __conn_hash_add(struct conn_hash *h, __u16 handle, struct hci_conn *c)
11082 +struct inquiry_entry *inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr);
11083 +void inquiry_cache_update(struct hci_dev *hdev, inquiry_info *info);
11084 +void inquiry_cache_flush(struct hci_dev *hdev);
11085 +int  inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf);
11086 +
11087 +/* ----- HCI Connections ----- */
11088 +enum {
11089 +       HCI_CONN_AUTH_PEND,
11090 +       HCI_CONN_ENCRYPT_PEND
11091 +};
11092 +
11093 +#define hci_conn_lock(c)       spin_lock(&c->lock)
11094 +#define hci_conn_unlock(c)     spin_unlock(&c->lock)
11095 +#define hci_conn_lock_bh(c)    spin_lock_bh(&c->lock)
11096 +#define hci_conn_unlock_bh(c)  spin_unlock_bh(&c->lock)
11097 +
11098 +#define conn_hash_lock(d)      spin_lock(&d->conn_hash->lock)
11099 +#define conn_hash_unlock(d)    spin_unlock(&d->conn_hash->lock)
11100 +#define conn_hash_lock_bh(d)   spin_lock_bh(&d->conn_hash->lock)
11101 +#define conn_hash_unlock_bh(d) spin_unlock_bh(&d->conn_hash->lock)
11102 +
11103 +static inline void conn_hash_init(struct hci_dev *hdev)
11104  {
11105 -       list_add(&c->list, &h->list);
11106 -       h->num++;
11107 +       struct conn_hash *h = &hdev->conn_hash;
11108 +       INIT_LIST_HEAD(&h->list);
11109 +       spin_lock_init(&h->lock);
11110 +       h->num = 0;
11111  }
11112
11113 -static inline void conn_hash_add(struct conn_hash *h, __u16 handle, struct hci_conn *c)
11114 +static inline void conn_hash_add(struct hci_dev *hdev, struct hci_conn *c)
11115  {
11116 -       conn_hash_lock(h);
11117 -       __conn_hash_add(h, handle, c);
11118 -       conn_hash_unlock(h);
11119 +       struct conn_hash *h = &hdev->conn_hash;
11120 +       list_add(&c->list, &h->list);
11121 +       h->num++;
11122  }
11123
11124 -static inline void __conn_hash_del(struct conn_hash *h, struct hci_conn *c)
11125 +static inline void conn_hash_del(struct hci_dev *hdev, struct hci_conn *c)
11126  {
11127 +       struct conn_hash *h = &hdev->conn_hash;
11128         list_del(&c->list);
11129         h->num--;
11130  }
11131
11132 -static inline void conn_hash_del(struct conn_hash *h, struct hci_conn *c)
11133 -{
11134 -       conn_hash_lock(h);
11135 -       __conn_hash_del(h, c);
11136 -       conn_hash_unlock(h);
11137 -}
11138 -
11139 -static inline  struct hci_conn *__conn_hash_lookup(struct conn_hash *h, __u16 handle)
11140 +static inline struct hci_conn *conn_hash_lookup_handle(struct hci_dev *hdev,
11141 +                                       __u16 handle)
11142  {
11143 +       register struct conn_hash *h = &hdev->conn_hash;
11144         register struct list_head *p;
11145         register struct hci_conn  *c;
11146
11147 @@ -169,101 +238,95 @@
11148          return NULL;
11149  }
11150
11151 -static inline struct hci_conn *conn_hash_lookup(struct conn_hash *h, __u16 handle)
11152 +static inline struct hci_conn *conn_hash_lookup_ba(struct hci_dev *hdev,
11153 +                                       __u8 type, bdaddr_t *ba)
11154  {
11155 -       struct hci_conn *conn;
11156 +       register struct conn_hash *h = &hdev->conn_hash;
11157 +       register struct list_head *p;
11158 +       register struct hci_conn  *c;
11159
11160 -       conn_hash_lock(h);
11161 -       conn = __conn_hash_lookup(h, handle);
11162 -       conn_hash_unlock(h);
11163 -       return conn;
11164 +       list_for_each(p, &h->list) {
11165 +               c = list_entry(p, struct hci_conn, list);
11166 +               if (c->type == type && !bacmp(&c->dst, ba))
11167 +                       return c;
11168 +       }
11169 +        return NULL;
11170  }
11171
11172 -/* ----- HCI Devices ----- */
11173 -struct hci_dev {
11174 -       atomic_t        refcnt;
11175 -
11176 -       char            name[8];
11177 -       __u32           flags;
11178 -       __u16           id;
11179 -       __u8            type;
11180 -       bdaddr_t        bdaddr;
11181 -       __u8            features[8];
11182 -
11183 -       __u16           pkt_type;
11184 -
11185 -       atomic_t        cmd_cnt;
11186 -       unsigned int    acl_cnt;
11187 -       unsigned int    sco_cnt;
11188 -
11189 -       unsigned int    acl_mtu;
11190 -       unsigned int    sco_mtu;
11191 -       unsigned int    acl_max;
11192 -       unsigned int    sco_max;
11193 -
11194 -       void            *driver_data;
11195 -       void            *l2cap_data;
11196 -       void            *priv;
11197 -
11198 -       struct tasklet_struct   cmd_task;
11199 -       struct tasklet_struct   rx_task;
11200 -       struct tasklet_struct   tx_task;
11201 -
11202 -       struct sk_buff_head     rx_q;
11203 -       struct sk_buff_head     raw_q;
11204 -       struct sk_buff_head     cmd_q;
11205 -
11206 -       struct sk_buff          *sent_cmd;
11207 -
11208 -       struct semaphore        req_lock;
11209 -       wait_queue_head_t       req_wait_q;
11210 -       __u32                   req_status;
11211 -       __u32                   req_result;
11212 -
11213 -       struct inquiry_cache    inq_cache;
11214 +void hci_acl_connect(struct hci_conn *conn);
11215 +void hci_acl_disconn(struct hci_conn *conn, __u8 reason);
11216 +void hci_add_sco(struct hci_conn *conn, __u16 handle);
11217
11218 -       struct conn_hash        conn_hash;
11219 +struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst);
11220 +int    hci_conn_del(struct hci_conn *conn);
11221 +void   hci_conn_hash_flush(struct hci_dev *hdev);
11222
11223 -       struct hci_dev_stats    stat;
11224 +struct hci_conn *hci_connect(struct hci_dev *hdev, int type, bdaddr_t *src);
11225 +int hci_conn_auth(struct hci_conn *conn);
11226 +int hci_conn_encrypt(struct hci_conn *conn);
11227
11228 -       int (*open)(struct hci_dev *hdev);
11229 -       int (*close)(struct hci_dev *hdev);
11230 -       int (*flush)(struct hci_dev *hdev);
11231 -       int (*send)(struct sk_buff *skb);
11232 -};
11233 +static inline void hci_conn_set_timer(struct hci_conn *conn, long timeout)
11234 +{
11235 +       mod_timer(&conn->timer, jiffies + timeout);
11236 +}
11237
11238 -static inline void hci_dev_hold(struct hci_dev *hdev)
11239 +static inline void hci_conn_del_timer(struct hci_conn *conn)
11240  {
11241 -       atomic_inc(&hdev->refcnt);
11242 +       del_timer(&conn->timer);
11243  }
11244
11245 -static inline void hci_dev_put(struct hci_dev *hdev)
11246 +static inline void hci_conn_hold(struct hci_conn *conn)
11247  {
11248 -       atomic_dec(&hdev->refcnt);
11249 +       atomic_inc(&conn->refcnt);
11250 +       hci_conn_del_timer(conn);
11251  }
11252
11253 -extern struct hci_dev *hci_dev_get(int index);
11254 -extern int hci_register_dev(struct hci_dev *hdev);
11255 -extern int hci_unregister_dev(struct hci_dev *hdev);
11256 -extern int hci_dev_open(__u16 dev);
11257 -extern int hci_dev_close(__u16 dev);
11258 -extern int hci_dev_reset(__u16 dev);
11259 -extern int hci_dev_reset_stat(__u16 dev);
11260 -extern int hci_dev_info(unsigned long arg);
11261 -extern int hci_dev_list(unsigned long arg);
11262 -extern int hci_dev_setscan(unsigned long arg);
11263 -extern int hci_dev_setauth(unsigned long arg);
11264 -extern int hci_dev_setptype(unsigned long arg);
11265 -extern int hci_conn_list(unsigned long arg);
11266 -extern int hci_inquiry(unsigned long arg);
11267 +static inline void hci_conn_put(struct hci_conn *conn)
11268 +{
11269 +       if (atomic_dec_and_test(&conn->refcnt)) {
11270 +               if (conn->type == SCO_LINK)
11271 +                       hci_conn_set_timer(conn, HZ / 100);
11272 +               else if (conn->out)
11273 +                       hci_conn_set_timer(conn, HCI_DISCONN_TIMEOUT);
11274 +       }
11275 +}
11276
11277 -extern __u32 hci_dev_setmode(struct hci_dev *hdev, __u32 mode);
11278 -extern __u32 hci_dev_getmode(struct hci_dev *hdev);
11279 +/* ----- HCI Devices ----- */
11280 +static inline void hci_dev_put(struct hci_dev *d)
11281 +{
11282 +       if (atomic_dec_and_test(&d->refcnt))
11283 +               d->destruct(d);
11284 +}
11285 +#define hci_dev_hold(d)                atomic_inc(&d->refcnt)
11286 +
11287 +#define hci_dev_lock(d)                spin_lock(&d->lock)
11288 +#define hci_dev_unlock(d)      spin_unlock(&d->lock)
11289 +#define hci_dev_lock_bh(d)     spin_lock_bh(&d->lock)
11290 +#define hci_dev_unlock_bh(d)   spin_unlock_bh(&d->lock)
11291 +
11292 +struct hci_dev *hci_dev_get(int index);
11293 +struct hci_dev *hci_get_route(bdaddr_t *src, bdaddr_t *dst);
11294 +int hci_register_dev(struct hci_dev *hdev);
11295 +int hci_unregister_dev(struct hci_dev *hdev);
11296 +int hci_suspend_dev(struct hci_dev *hdev);
11297 +int hci_resume_dev(struct hci_dev *hdev);
11298 +int hci_dev_open(__u16 dev);
11299 +int hci_dev_close(__u16 dev);
11300 +int hci_dev_reset(__u16 dev);
11301 +int hci_dev_reset_stat(__u16 dev);
11302 +int hci_dev_cmd(unsigned int cmd, unsigned long arg);
11303 +int hci_get_dev_list(unsigned long arg);
11304 +int hci_get_dev_info(unsigned long arg);
11305 +int hci_get_conn_list(unsigned long arg);
11306 +int hci_get_conn_info(struct hci_dev *hdev, unsigned long arg);
11307 +int hci_inquiry(unsigned long arg);
11308
11309 -extern int hci_recv_frame(struct sk_buff *skb);
11310 +int  hci_recv_frame(struct sk_buff *skb);
11311 +void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb);
11312
11313  /* ----- LMP capabilities ----- */
11314  #define lmp_rswitch_capable(dev) (dev->features[0] & LMP_RSWITCH)
11315 +#define lmp_encrypt_capable(dev) (dev->features[0] & LMP_ENCRYPT)
11316
11317  /* ----- HCI tasks ----- */
11318  static inline void hci_sched_cmd(struct hci_dev *hdev)
11319 @@ -284,43 +347,130 @@
11320  /* ----- HCI protocols ----- */
11321  struct hci_proto {
11322         char            *name;
11323 -       __u32           id;
11324 -       __u32           flags;
11325 +       unsigned int    id;
11326 +       unsigned long   flags;
11327
11328         void            *priv;
11329
11330 -       int (*connect_ind)      (struct hci_dev *hdev, bdaddr_t *bdaddr);
11331 -       int (*connect_cfm)      (struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 status, struct hci_conn *conn);
11332 +       int (*connect_ind)      (struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type);
11333 +       int (*connect_cfm)      (struct hci_conn *conn, __u8 status);
11334         int (*disconn_ind)      (struct hci_conn *conn, __u8 reason);
11335 -       int (*recv_acldata)     (struct hci_conn *conn, struct sk_buff *skb , __u16 flags);
11336 +       int (*recv_acldata)     (struct hci_conn *conn, struct sk_buff *skb, __u16 flags);
11337         int (*recv_scodata)     (struct hci_conn *conn, struct sk_buff *skb);
11338 +       int (*auth_cfm)         (struct hci_conn *conn, __u8 status);
11339 +       int (*encrypt_cfm)      (struct hci_conn *conn, __u8 status);
11340  };
11341
11342 -extern int hci_register_proto(struct hci_proto *hproto);
11343 -extern int hci_unregister_proto(struct hci_proto *hproto);
11344 -extern int hci_register_notifier(struct notifier_block *nb);
11345 -extern int hci_unregister_notifier(struct notifier_block *nb);
11346 -extern int hci_connect(struct hci_dev * hdev, bdaddr_t * bdaddr);
11347 -extern int hci_disconnect(struct hci_conn *conn, __u8 reason);
11348 -extern int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void * param);
11349 -extern int hci_send_raw(struct sk_buff *skb);
11350 -extern int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags);
11351 -extern int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb);
11352 +static inline int hci_proto_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
11353 +{
11354 +       register struct hci_proto *hp;
11355 +       int mask = 0;
11356 +
11357 +       hp = hci_proto[HCI_PROTO_L2CAP];
11358 +       if (hp && hp->connect_ind)
11359 +               mask |= hp->connect_ind(hdev, bdaddr, type);
11360 +
11361 +       hp = hci_proto[HCI_PROTO_SCO];
11362 +       if (hp && hp->connect_ind)
11363 +               mask |= hp->connect_ind(hdev, bdaddr, type);
11364 +
11365 +       return mask;
11366 +}
11367 +
11368 +static inline void hci_proto_connect_cfm(struct hci_conn *conn, __u8 status)
11369 +{
11370 +       register struct hci_proto *hp;
11371 +
11372 +       hp = hci_proto[HCI_PROTO_L2CAP];
11373 +       if (hp && hp->connect_cfm)
11374 +               hp->connect_cfm(conn, status);
11375 +
11376 +       hp = hci_proto[HCI_PROTO_SCO];
11377 +       if (hp && hp->connect_cfm)
11378 +               hp->connect_cfm(conn, status);
11379 +}
11380 +
11381 +static inline void hci_proto_disconn_ind(struct hci_conn *conn, __u8 reason)
11382 +{
11383 +       register struct hci_proto *hp;
11384 +
11385 +       hp = hci_proto[HCI_PROTO_L2CAP];
11386 +       if (hp && hp->disconn_ind)
11387 +               hp->disconn_ind(conn, reason);
11388 +
11389 +       hp = hci_proto[HCI_PROTO_SCO];
11390 +       if (hp && hp->disconn_ind)
11391 +               hp->disconn_ind(conn, reason);
11392 +}
11393 +
11394 +static inline void hci_proto_auth_cfm(struct hci_conn *conn, __u8 status)
11395 +{
11396 +       register struct hci_proto *hp;
11397 +
11398 +       hp = hci_proto[HCI_PROTO_L2CAP];
11399 +       if (hp && hp->auth_cfm)
11400 +               hp->auth_cfm(conn, status);
11401 +
11402 +       hp = hci_proto[HCI_PROTO_SCO];
11403 +       if (hp && hp->auth_cfm)
11404 +               hp->auth_cfm(conn, status);
11405 +}
11406 +
11407 +static inline void hci_proto_encrypt_cfm(struct hci_conn *conn, __u8 status)
11408 +{
11409 +       register struct hci_proto *hp;
11410 +
11411 +       hp = hci_proto[HCI_PROTO_L2CAP];
11412 +       if (hp && hp->encrypt_cfm)
11413 +               hp->encrypt_cfm(conn, status);
11414 +
11415 +       hp = hci_proto[HCI_PROTO_SCO];
11416 +       if (hp && hp->encrypt_cfm)
11417 +               hp->encrypt_cfm(conn, status);
11418 +}
11419 +
11420 +int hci_register_proto(struct hci_proto *hproto);
11421 +int hci_unregister_proto(struct hci_proto *hproto);
11422 +int hci_register_notifier(struct notifier_block *nb);
11423 +int hci_unregister_notifier(struct notifier_block *nb);
11424 +
11425 +int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param);
11426 +int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags);
11427 +int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb);
11428 +
11429 +void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf);
11430 +
11431 +void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data);
11432
11433  /* ----- HCI Sockets ----- */
11434 -extern void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb);
11435 +void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb);
11436
11437  /* HCI info for socket */
11438 -#define hci_pi(sk)     ((struct hci_pinfo *) &sk->protinfo)
11439 +#define hci_pi(sk)     ((struct hci_pinfo *) &sk->tp_pinfo)
11440  struct hci_pinfo {
11441         struct hci_dev    *hdev;
11442         struct hci_filter filter;
11443         __u32             cmsg_mask;
11444  };
11445
11446 +/* HCI security filter */
11447 +#define HCI_SFLT_MAX_OGF  5
11448 +
11449 +struct hci_sec_filter {
11450 +       __u32 type_mask;
11451 +       __u32 event_mask[2];
11452 +       __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4];
11453 +};
11454 +
11455  /* ----- HCI requests ----- */
11456  #define HCI_REQ_DONE     0
11457  #define HCI_REQ_PEND     1
11458  #define HCI_REQ_CANCELED  2
11459 +
11460 +#define hci_req_lock(d)                down(&d->req_lock)
11461 +#define hci_req_unlock(d)      up(&d->req_lock)
11462 +
11463 +void hci_req_complete(struct hci_dev *hdev, int result);
11464 +void hci_req_cancel(struct hci_dev *hdev, int err);
11465
11466  #endif /* __HCI_CORE_H */
11467 diff -urN linux-2.4.18/include/net/bluetooth/hci_uart.h linux-2.4.18-mh9/include/net/bluetooth/hci_uart.h
11468 --- linux-2.4.18/include/net/bluetooth/hci_uart.h       Fri Sep  7 18:28:38 2001
11469 +++ linux-2.4.18-mh9/include/net/bluetooth/hci_uart.h   Thu Jan  1 01:00:00 1970
11470 @@ -1,62 +0,0 @@
11471 -/*
11472 -   BlueZ - Bluetooth protocol stack for Linux
11473 -   Copyright (C) 2000-2001 Qualcomm Incorporated
11474 -
11475 -   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
11476 -
11477 -   This program is free software; you can redistribute it and/or modify
11478 -   it under the terms of the GNU General Public License version 2 as
11479 -   published by the Free Software Foundation;
11480 -
11481 -   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11482 -   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11483 -   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11484 -   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
11485 -   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
11486 -   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
11487 -   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
11488 -   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
11489 -
11490 -   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
11491 -   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
11492 -   SOFTWARE IS DISCLAIMED.
11493 -*/
11494 -
11495 -/*
11496 - * $Id: hci_uart.h,v 1.2 2001/06/02 01:40:08 maxk Exp $
11497 - */
11498 -
11499 -#ifndef N_HCI
11500 -#define N_HCI  15
11501 -#endif
11502 -
11503 -#ifdef __KERNEL__
11504 -
11505 -#define tty2n_hci(tty)  ((struct n_hci *)((tty)->disc_data))
11506 -#define n_hci2tty(n_hci) ((n_hci)->tty)
11507 -
11508 -struct n_hci {
11509 -       struct tty_struct *tty;
11510 -       struct hci_dev hdev;
11511 -
11512 -       struct sk_buff_head txq;
11513 -       unsigned long tx_state;
11514 -
11515 -       spinlock_t rx_lock;
11516 -       unsigned long rx_state;
11517 -       unsigned long rx_count;
11518 -       struct sk_buff *rx_skb;
11519 -};
11520 -
11521 -/* Transmit states  */
11522 -#define TRANS_SENDING          1
11523 -#define TRANS_WAKEUP           2
11524 -
11525 -/* Receiver States */
11526 -#define WAIT_PACKET_TYPE       0
11527 -#define WAIT_EVENT_HDR         1
11528 -#define WAIT_ACL_HDR           2
11529 -#define WAIT_SCO_HDR           3
11530 -#define WAIT_DATA              4
11531 -
11532 -#endif /* __KERNEL__ */
11533 diff -urN linux-2.4.18/include/net/bluetooth/hci_usb.h linux-2.4.18-mh9/include/net/bluetooth/hci_usb.h
11534 --- linux-2.4.18/include/net/bluetooth/hci_usb.h        Fri Sep  7 18:28:38 2001
11535 +++ linux-2.4.18-mh9/include/net/bluetooth/hci_usb.h    Thu Jan  1 01:00:00 1970
11536 @@ -1,68 +0,0 @@
11537 -/*
11538 -   BlueZ - Bluetooth protocol stack for Linux
11539 -   Copyright (C) 2000-2001 Qualcomm Incorporated
11540 -
11541 -   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
11542 -
11543 -   This program is free software; you can redistribute it and/or modify
11544 -   it under the terms of the GNU General Public License version 2 as
11545 -   published by the Free Software Foundation;
11546 -
11547 -   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11548 -   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11549 -   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11550 -   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
11551 -   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
11552 -   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
11553 -   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
11554 -   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
11555 -
11556 -   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
11557 -   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
11558 -   SOFTWARE IS DISCLAIMED.
11559 -*/
11560 -
11561 -/*
11562 - * $Id: hci_usb.h,v 1.3 2001/06/02 01:40:08 maxk Exp $
11563 - */
11564 -
11565 -#ifdef __KERNEL__
11566 -
11567 -/* Class, SubClass, and Protocol codes that describe a Bluetooth device */
11568 -#define HCI_DEV_CLASS        0xe0      /* Wireless class */
11569 -#define HCI_DEV_SUBCLASS     0x01      /* RF subclass */
11570 -#define HCI_DEV_PROTOCOL     0x01      /* Bluetooth programming protocol */
11571 -
11572 -#define HCI_CTRL_REQ        0x20
11573 -
11574 -struct hci_usb {
11575 -       struct usb_device       *udev;
11576 -
11577 -       devrequest              dev_req;
11578 -       struct urb              *ctrl_urb;
11579 -       struct urb              *intr_urb;
11580 -       struct urb              *read_urb;
11581 -       struct urb              *write_urb;
11582 -
11583 -       __u8                    *read_buf;
11584 -       __u8                    *intr_buf;
11585 -       struct sk_buff          *intr_skb;
11586 -       int                     intr_count;
11587 -
11588 -       __u8                    bulk_out_ep_addr;
11589 -       __u8                    bulk_in_ep_addr;
11590 -       __u8                    intr_in_ep_addr;
11591 -       __u8                    intr_in_interval;
11592 -
11593 -       struct hci_dev          hdev;
11594 -
11595 -       unsigned long           tx_state;
11596 -       struct sk_buff_head     tx_ctrl_q;
11597 -       struct sk_buff_head     tx_write_q;
11598 -};
11599 -
11600 -/* Transmit states  */
11601 -#define HCI_TX_CTRL    1
11602 -#define HCI_TX_WRITE   2
11603 -
11604 -#endif /* __KERNEL__ */
11605 diff -urN linux-2.4.18/include/net/bluetooth/hci_vhci.h linux-2.4.18-mh9/include/net/bluetooth/hci_vhci.h
11606 --- linux-2.4.18/include/net/bluetooth/hci_vhci.h       Fri Sep  7 18:28:38 2001
11607 +++ linux-2.4.18-mh9/include/net/bluetooth/hci_vhci.h   Thu Jan  1 01:00:00 1970
11608 @@ -1,50 +0,0 @@
11609 -/*
11610 -   BlueZ - Bluetooth protocol stack for Linux
11611 -   Copyright (C) 2000-2001 Qualcomm Incorporated
11612 -
11613 -   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
11614 -
11615 -   This program is free software; you can redistribute it and/or modify
11616 -   it under the terms of the GNU General Public License version 2 as
11617 -   published by the Free Software Foundation;
11618 -
11619 -   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11620 -   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11621 -   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11622 -   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
11623 -   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
11624 -   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
11625 -   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
11626 -   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
11627 -
11628 -   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
11629 -   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
11630 -   SOFTWARE IS DISCLAIMED.
11631 -*/
11632 -
11633 -/*
11634 - * $Id: hci_vhci.h,v 1.2 2001/08/01 01:02:20 maxk Exp $
11635 - */
11636 -
11637 -#ifndef __HCI_VHCI_H
11638 -#define __HCI_VHCI_H
11639 -
11640 -#ifdef __KERNEL__
11641 -
11642 -struct hci_vhci_struct {
11643 -       struct hci_dev       hdev;
11644 -       __u32                flags;
11645 -       wait_queue_head_t    read_wait;
11646 -       struct sk_buff_head  readq;
11647 -       struct fasync_struct *fasync;
11648 -};
11649 -
11650 -/* VHCI device flags */
11651 -#define VHCI_FASYNC            0x0010
11652 -
11653 -#endif /* __KERNEL__ */
11654 -
11655 -#define VHCI_DEV       "/dev/vhci"
11656 -#define VHCI_MINOR     250
11657 -
11658 -#endif /* __HCI_VHCI_H */
11659 diff -urN linux-2.4.18/include/net/bluetooth/l2cap.h linux-2.4.18-mh9/include/net/bluetooth/l2cap.h
11660 --- linux-2.4.18/include/net/bluetooth/l2cap.h  Fri Sep  7 18:28:38 2001
11661 +++ linux-2.4.18-mh9/include/net/bluetooth/l2cap.h      Mon Aug 25 18:38:12 2003
11662 @@ -23,22 +23,17 @@
11663  */
11664
11665  /*
11666 - *  $Id: l2cap.h,v 1.5 2001/06/14 21:28:26 maxk Exp $
11667 + *  $Id: l2cap.h,v 1.1.1.1 2002/03/08 21:03:15 maxk Exp $
11668   */
11669
11670  #ifndef __L2CAP_H
11671  #define __L2CAP_H
11672
11673 -#include <asm/types.h>
11674 -#include <asm/byteorder.h>
11675 -
11676  /* L2CAP defaults */
11677  #define L2CAP_DEFAULT_MTU      672
11678  #define L2CAP_DEFAULT_FLUSH_TO 0xFFFF
11679
11680  #define L2CAP_CONN_TIMEOUT     (HZ * 40)
11681 -#define L2CAP_DISCONN_TIMEOUT  (HZ * 2)
11682 -#define L2CAP_CONN_IDLE_TIMEOUT        (HZ * 60)
11683
11684  /* L2CAP socket address */
11685  struct sockaddr_l2 {
11686 @@ -47,17 +42,12 @@
11687         bdaddr_t        l2_bdaddr;
11688  };
11689
11690 -/* set/get sockopt defines */
11691 -#define L2CAP_OPTIONS  0x01
11692 +/* Socket options */
11693 +#define L2CAP_OPTIONS  0x01
11694  struct l2cap_options {
11695         __u16 omtu;
11696         __u16 imtu;
11697         __u16 flush_to;
11698 -       __u32 token_rate;
11699 -       __u32 bucket_size;
11700 -       __u32 pick_band;
11701 -       __u32 latency;
11702 -       __u32 delay_var;
11703  };
11704
11705  #define L2CAP_CONNINFO  0x02
11706 @@ -65,6 +55,27 @@
11707         __u16 hci_handle;
11708  };
11709
11710 +#define L2CAP_LM       0x03
11711 +#define L2CAP_LM_MASTER                0x0001
11712 +#define L2CAP_LM_AUTH          0x0002
11713 +#define L2CAP_LM_ENCRYPT       0x0004
11714 +#define L2CAP_LM_TRUSTED       0x0008
11715 +#define L2CAP_LM_RELIABLE      0x0010
11716 +
11717 +#define L2CAP_QOS      0x04
11718 +struct l2cap_qos {
11719 +       __u16 service_type;
11720 +       __u32 token_rate;
11721 +       __u32 token_bucket_size;
11722 +       __u32 peak_bandwidth;
11723 +       __u32 latency;
11724 +       __u32 delay_variation;
11725 +};
11726 +
11727 +#define L2CAP_SERV_NO_TRAFFIC  0x00
11728 +#define L2CAP_SERV_BEST_EFFORT 0x01
11729 +#define L2CAP_SERV_GUARANTEED  0x02
11730 +
11731  /* L2CAP command codes */
11732  #define L2CAP_COMMAND_REJ 0x01
11733  #define L2CAP_CONN_REQ    0x02
11734 @@ -79,7 +90,6 @@
11735  #define L2CAP_INFO_RSP    0x0b
11736
11737  /* L2CAP structures */
11738 -
11739  typedef struct {
11740         __u16      len;
11741         __u16      cid;
11742 @@ -112,11 +122,17 @@
11743  } __attribute__ ((packed))     l2cap_conn_rsp;
11744  #define L2CAP_CONN_RSP_SIZE    8
11745
11746 -#define L2CAP_CONN_SUCCESS    0x0000
11747 -#define L2CAP_CONN_PEND       0x0001
11748 -#define L2CAP_CONN_BAD_PSM    0x0002
11749 -#define L2CAP_CONN_SEC_BLOCK  0x0003
11750 -#define L2CAP_CONN_NO_MEM     0x0004
11751 +/* connect result */
11752 +#define L2CAP_CR_SUCCESS    0x0000
11753 +#define L2CAP_CR_PEND       0x0001
11754 +#define L2CAP_CR_BAD_PSM    0x0002
11755 +#define L2CAP_CR_SEC_BLOCK  0x0003
11756 +#define L2CAP_CR_NO_MEM     0x0004
11757 +
11758 +/* connect status */
11759 +#define L2CAP_CS_NO_INFO      0x0000
11760 +#define L2CAP_CS_AUTHEN_PEND  0x0001
11761 +#define L2CAP_CS_AUTHOR_PEND  0x0002
11762
11763  typedef struct {
11764         __u16      dcid;
11765 @@ -147,6 +163,8 @@
11766  #define L2CAP_CONF_FLUSH_TO    0x02
11767  #define L2CAP_CONF_QOS         0x03
11768
11769 +#define L2CAP_CONF_MAX_SIZE    22
11770 +
11771  typedef struct {
11772         __u16      dcid;
11773         __u16      scid;
11774 @@ -158,5 +176,75 @@
11775         __u16      scid;
11776  } __attribute__ ((packed))     l2cap_disconn_rsp;
11777  #define L2CAP_DISCONN_RSP_SIZE 4
11778 +
11779 +typedef struct {
11780 +       __u16       type;
11781 +       __u8        data[0];
11782 +} __attribute__ ((packed))     l2cap_info_req;
11783 +#define L2CAP_INFO_REQ_SIZE    2
11784 +
11785 +typedef struct {
11786 +       __u16       type;
11787 +       __u16       result;
11788 +       __u8        data[0];
11789 +} __attribute__ ((packed))     l2cap_info_rsp;
11790 +#define L2CAP_INFO_RSP_SIZE    4
11791 +
11792 +/* ----- L2CAP connections ----- */
11793 +struct l2cap_chan_list {
11794 +       struct sock     *head;
11795 +       rwlock_t        lock;
11796 +       long            num;
11797 +};
11798 +
11799 +struct l2cap_conn {
11800 +       struct hci_conn *hcon;
11801 +
11802 +       bdaddr_t        *dst;
11803 +       bdaddr_t        *src;
11804 +
11805 +       unsigned int    mtu;
11806 +
11807 +       spinlock_t      lock;
11808 +
11809 +       struct sk_buff *rx_skb;
11810 +       __u32           rx_len;
11811 +       __u8            rx_ident;
11812 +       __u8            tx_ident;
11813 +
11814 +       struct l2cap_chan_list chan_list;
11815 +};
11816 +
11817 +/* ----- L2CAP channel and socket info ----- */
11818 +#define l2cap_pi(sk)   ((struct l2cap_pinfo *) &sk->tp_pinfo)
11819 +
11820 +struct l2cap_pinfo {
11821 +       __u16           psm;
11822 +       __u16           dcid;
11823 +       __u16           scid;
11824 +
11825 +       __u16           imtu;
11826 +       __u16           omtu;
11827 +       __u16           flush_to;
11828 +
11829 +       __u32           link_mode;
11830 +
11831 +       __u8            conf_state;
11832 +       __u8            conf_retry;
11833 +       __u16           conf_mtu;
11834 +
11835 +       __u8            ident;
11836 +
11837 +       struct l2cap_conn       *conn;
11838 +       struct sock             *next_c;
11839 +       struct sock             *prev_c;
11840 +};
11841 +
11842 +#define L2CAP_CONF_REQ_SENT    0x01
11843 +#define L2CAP_CONF_INPUT_DONE  0x02
11844 +#define L2CAP_CONF_OUTPUT_DONE 0x04
11845 +#define L2CAP_CONF_MAX_RETRIES 2
11846 +
11847 +void l2cap_load(void);
11848
11849  #endif /* __L2CAP_H */
11850 diff -urN linux-2.4.18/include/net/bluetooth/l2cap_core.h linux-2.4.18-mh9/include/net/bluetooth/l2cap_core.h
11851 --- linux-2.4.18/include/net/bluetooth/l2cap_core.h     Fri Sep  7 18:28:38 2001
11852 +++ linux-2.4.18-mh9/include/net/bluetooth/l2cap_core.h Thu Jan  1 01:00:00 1970
11853 @@ -1,144 +0,0 @@
11854 -/*
11855 -   BlueZ - Bluetooth protocol stack for Linux
11856 -   Copyright (C) 2000-2001 Qualcomm Incorporated
11857 -
11858 -   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
11859 -
11860 -   This program is free software; you can redistribute it and/or modify
11861 -   it under the terms of the GNU General Public License version 2 as
11862 -   published by the Free Software Foundation;
11863 -
11864 -   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11865 -   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
11866 -   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11867 -   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
11868 -   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
11869 -   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
11870 -   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
11871 -   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
11872 -
11873 -   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
11874 -   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
11875 -   SOFTWARE IS DISCLAIMED.
11876 -*/
11877 -
11878 -/*
11879 - *  $Id: l2cap_core.h,v 1.6 2001/08/03 04:19:49 maxk Exp $
11880 - */
11881 -
11882 -#ifndef __L2CAP_CORE_H
11883 -#define __L2CAP_CORE_H
11884 -
11885 -#ifdef __KERNEL__
11886 -
11887 -/* ----- L2CAP interface ----- */
11888 -struct l2cap_iff {
11889 -       struct list_head list;
11890 -       struct hci_dev   *hdev;
11891 -       bdaddr_t         *bdaddr;
11892 -       __u16            mtu;
11893 -       spinlock_t       lock;
11894 -       struct list_head conn_list;
11895 -};
11896 -
11897 -static inline void l2cap_iff_lock(struct l2cap_iff *iff)
11898 -{
11899 -       spin_lock(&iff->lock);
11900 -}
11901 -
11902 -static inline void l2cap_iff_unlock(struct l2cap_iff *iff)
11903 -{
11904 -       spin_unlock(&iff->lock);
11905 -}
11906 -
11907 -/* ----- L2CAP connections ----- */
11908 -struct l2cap_chan_list {
11909 -       struct sock     *head;
11910 -       rwlock_t        lock;
11911 -       long            num;
11912 -};
11913 -
11914 -struct l2cap_conn {
11915 -       struct l2cap_iff *iff;
11916 -       struct list_head list;
11917 -
11918 -       struct hci_conn  *hconn;
11919 -
11920 -       __u16           state;
11921 -       __u8            out;
11922 -       bdaddr_t        src;
11923 -       bdaddr_t        dst;
11924 -
11925 -       spinlock_t      lock;
11926 -       atomic_t        refcnt;
11927 -
11928 -       struct sk_buff *rx_skb;
11929 -       __u32           rx_len;
11930 -       __u8            rx_ident;
11931 -       __u8            tx_ident;
11932 -
11933 -       struct l2cap_chan_list chan_list;
11934 -
11935 -       struct timer_list timer;
11936 -};
11937 -
11938 -static inline void __l2cap_conn_link(struct l2cap_iff *iff, struct l2cap_conn *c)
11939 -{
11940 -       list_add(&c->list, &iff->conn_list);
11941 -}
11942 -
11943 -static inline void __l2cap_conn_unlink(struct l2cap_iff *iff, struct l2cap_conn *c)
11944 -{
11945 -       list_del(&c->list);
11946 -}
11947 -
11948 -/* ----- L2CAP channel and socket info ----- */
11949 -#define l2cap_pi(sk)   ((struct l2cap_pinfo *) &sk->protinfo)
11950 -
11951 -struct l2cap_accept_q {
11952 -       struct sock     *head;
11953 -       struct sock     *tail;
11954 -};
11955 -
11956 -struct l2cap_pinfo {
11957 -       bdaddr_t        src;
11958 -       bdaddr_t        dst;
11959 -       __u16           psm;
11960 -       __u16           dcid;
11961 -       __u16           scid;
11962 -       __u32           flags;
11963 -
11964 -       __u16           imtu;
11965 -       __u16           omtu;
11966 -       __u16           flush_to;
11967 -
11968 -       __u8            conf_state;
11969 -       __u16           conf_mtu;
11970 -
11971 -       __u8            ident;
11972 -
11973 -       struct l2cap_conn       *conn;
11974 -       struct sock             *next_c;
11975 -       struct sock             *prev_c;
11976 -
11977 -       struct sock *parent;
11978 -       struct sock *next_q;
11979 -       struct sock *prev_q;
11980 -
11981 -       struct l2cap_accept_q accept_q;
11982 -};
11983 -
11984 -#define CONF_REQ_SENT    0x01
11985 -#define CONF_INPUT_DONE  0x02
11986 -#define CONF_OUTPUT_DONE 0x04
11987 -
11988 -extern struct bluez_sock_list l2cap_sk_list;
11989 -extern struct list_head  l2cap_iff_list;
11990 -extern rwlock_t l2cap_rt_lock;
11991 -
11992 -extern void l2cap_register_proc(void);
11993 -extern void l2cap_unregister_proc(void);
11994 -
11995 -#endif /* __KERNEL__ */
11996 -
11997 -#endif /* __L2CAP_CORE_H */
11998 diff -urN linux-2.4.18/include/net/bluetooth/rfcomm.h linux-2.4.18-mh9/include/net/bluetooth/rfcomm.h
11999 --- linux-2.4.18/include/net/bluetooth/rfcomm.h Thu Jan  1 01:00:00 1970
12000 +++ linux-2.4.18-mh9/include/net/bluetooth/rfcomm.h     Mon Aug 25 18:38:12 2003
12001 @@ -0,0 +1,356 @@
12002 +/*
12003 +   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
12004 +   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
12005 +   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
12006 +
12007 +   This program is free software; you can redistribute it and/or modify
12008 +   it under the terms of the GNU General Public License version 2 as
12009 +   published by the Free Software Foundation;
12010 +
12011 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12012 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12013 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12014 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12015 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
12016 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12017 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
12018 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
12019 +
12020 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
12021 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
12022 +   SOFTWARE IS DISCLAIMED.
12023 +*/
12024 +
12025 +/*
12026 +   RPN support    -    Dirk Husemann <hud@zurich.ibm.com>
12027 +*/
12028 +
12029 +/*
12030 + * $Id: rfcomm.h,v 1.31 2002/10/18 20:12:11 maxk Exp $
12031 + */
12032 +
12033 +#ifndef __RFCOMM_H
12034 +#define __RFCOMM_H
12035 +
12036 +#define RFCOMM_PSM 3
12037 +
12038 +#define RFCOMM_CONN_TIMEOUT (HZ * 30)
12039 +#define RFCOMM_DISC_TIMEOUT (HZ * 20)
12040 +
12041 +#define RFCOMM_DEFAULT_MTU     127
12042 +#define RFCOMM_DEFAULT_CREDITS 7
12043 +
12044 +#define RFCOMM_MAX_L2CAP_MTU   1024
12045 +#define RFCOMM_MAX_CREDITS     40
12046 +
12047 +#define RFCOMM_SKB_HEAD_RESERVE        8
12048 +#define RFCOMM_SKB_TAIL_RESERVE        2
12049 +#define RFCOMM_SKB_RESERVE     (RFCOMM_SKB_HEAD_RESERVE + RFCOMM_SKB_TAIL_RESERVE)
12050 +
12051 +#define RFCOMM_SABM    0x2f
12052 +#define RFCOMM_DISC    0x43
12053 +#define RFCOMM_UA      0x63
12054 +#define RFCOMM_DM      0x0f
12055 +#define RFCOMM_UIH     0xef
12056 +
12057 +#define RFCOMM_TEST    0x08
12058 +#define RFCOMM_FCON    0x28
12059 +#define RFCOMM_FCOFF   0x18
12060 +#define RFCOMM_MSC     0x38
12061 +#define RFCOMM_RPN     0x24
12062 +#define RFCOMM_RLS     0x14
12063 +#define RFCOMM_PN      0x20
12064 +#define RFCOMM_NSC     0x04
12065 +
12066 +#define RFCOMM_V24_FC  0x02
12067 +#define RFCOMM_V24_RTC 0x04
12068 +#define RFCOMM_V24_RTR 0x08
12069 +#define RFCOMM_V24_IC  0x40
12070 +#define RFCOMM_V24_DV  0x80
12071 +
12072 +#define RFCOMM_RPN_BR_2400     0x0
12073 +#define RFCOMM_RPN_BR_4800     0x1
12074 +#define RFCOMM_RPN_BR_7200     0x2
12075 +#define RFCOMM_RPN_BR_9600     0x3
12076 +#define RFCOMM_RPN_BR_19200    0x4
12077 +#define RFCOMM_RPN_BR_38400    0x5
12078 +#define RFCOMM_RPN_BR_57600    0x6
12079 +#define RFCOMM_RPN_BR_115200   0x7
12080 +#define RFCOMM_RPN_BR_230400   0x8
12081 +
12082 +#define RFCOMM_RPN_DATA_5      0x0
12083 +#define RFCOMM_RPN_DATA_6      0x1
12084 +#define RFCOMM_RPN_DATA_7      0x2
12085 +#define RFCOMM_RPN_DATA_8      0x3
12086 +
12087 +#define RFCOMM_RPN_STOP_1      0
12088 +#define RFCOMM_RPN_STOP_15     1
12089 +
12090 +#define RFCOMM_RPN_PARITY_NONE 0x0
12091 +#define RFCOMM_RPN_PARITY_ODD  0x4
12092 +#define RFCOMM_RPN_PARITY_EVEN 0x5
12093 +#define RFCOMM_RPN_PARITY_MARK 0x6
12094 +#define RFCOMM_RPN_PARITY_SPACE        0x7
12095 +
12096 +#define RFCOMM_RPN_FLOW_NONE   0x00
12097 +
12098 +#define RFCOMM_RPN_XON_CHAR    0x11
12099 +#define RFCOMM_RPN_XOFF_CHAR   0x13
12100 +
12101 +#define RFCOMM_RPN_PM_BITRATE          0x0001
12102 +#define RFCOMM_RPN_PM_DATA             0x0002
12103 +#define RFCOMM_RPN_PM_STOP             0x0004
12104 +#define RFCOMM_RPN_PM_PARITY           0x0008
12105 +#define RFCOMM_RPN_PM_PARITY_TYPE      0x0010
12106 +#define RFCOMM_RPN_PM_XON              0x0020
12107 +#define RFCOMM_RPN_PM_XOFF             0x0040
12108 +#define RFCOMM_RPN_PM_FLOW             0x3F00
12109 +
12110 +#define RFCOMM_RPN_PM_ALL              0x3F7F
12111 +
12112 +struct rfcomm_hdr {
12113 +       u8 addr;
12114 +       u8 ctrl;
12115 +       u8 len;    // Actual size can be 2 bytes
12116 +} __attribute__ ((packed));
12117 +
12118 +struct rfcomm_cmd {
12119 +       u8 addr;
12120 +       u8 ctrl;
12121 +       u8 len;
12122 +       u8 fcs;
12123 +} __attribute__ ((packed));
12124 +
12125 +struct rfcomm_mcc {
12126 +       u8 type;
12127 +       u8 len;
12128 +} __attribute__ ((packed));
12129 +
12130 +struct rfcomm_pn {
12131 +       u8  dlci;
12132 +       u8  flow_ctrl;
12133 +       u8  priority;
12134 +       u8  ack_timer;
12135 +       u16 mtu;
12136 +       u8  max_retrans;
12137 +       u8  credits;
12138 +} __attribute__ ((packed));
12139 +
12140 +struct rfcomm_rpn {
12141 +       u8  dlci;
12142 +       u8  bit_rate;
12143 +       u8  line_settings;
12144 +       u8  flow_ctrl;
12145 +       u8  xon_char;
12146 +       u8  xoff_char;
12147 +       u16 param_mask;
12148 +} __attribute__ ((packed));
12149 +
12150 +struct rfcomm_rls {
12151 +       u8  dlci;
12152 +       u8  status;
12153 +} __attribute__ ((packed));
12154 +
12155 +struct rfcomm_msc {
12156 +       u8  dlci;
12157 +       u8  v24_sig;
12158 +} __attribute__ ((packed));
12159 +
12160 +/* ---- Core structures, flags etc ---- */
12161 +
12162 +struct rfcomm_session {
12163 +       struct list_head list;
12164 +       struct socket   *sock;
12165 +       unsigned long    state;
12166 +       unsigned long    flags;
12167 +       atomic_t         refcnt;
12168 +       int              initiator;
12169 +
12170 +       /* Default DLC parameters */
12171 +       uint   mtu;
12172 +       uint   credits;
12173 +
12174 +       struct list_head dlcs;
12175 +};
12176 +
12177 +struct rfcomm_dlc {
12178 +       struct list_head      list;
12179 +       struct rfcomm_session *session;
12180 +       struct sk_buff_head   tx_queue;
12181 +       struct timer_list     timer;
12182 +
12183 +       spinlock_t    lock;
12184 +       unsigned long state;
12185 +       unsigned long flags;
12186 +       atomic_t      refcnt;
12187 +       u8            dlci;
12188 +       u8            addr;
12189 +       u8            priority;
12190 +       u8            v24_sig;
12191 +       u8            mscex;
12192 +
12193 +       uint          mtu;
12194 +       uint          credits;
12195 +       uint          rx_credits;
12196 +       uint          tx_credits;
12197 +
12198 +       void          *owner;
12199 +
12200 +       void (*data_ready)(struct rfcomm_dlc *d, struct sk_buff *skb);
12201 +       void (*state_change)(struct rfcomm_dlc *d, int err);
12202 +       void (*modem_status)(struct rfcomm_dlc *d, u8 v24_sig);
12203 +};
12204 +
12205 +/* DLC and session flags */
12206 +#define RFCOMM_RX_THROTTLED 0
12207 +#define RFCOMM_TX_THROTTLED 1
12208 +#define RFCOMM_MSC_PENDING  2
12209 +#define RFCOMM_TIMED_OUT    3
12210 +
12211 +/* Scheduling flags and events */
12212 +#define RFCOMM_SCHED_STATE  0
12213 +#define RFCOMM_SCHED_RX     1
12214 +#define RFCOMM_SCHED_TX     2
12215 +#define RFCOMM_SCHED_TIMEO  3
12216 +#define RFCOMM_SCHED_WAKEUP 31
12217 +
12218 +/* MSC exchange flags */
12219 +#define RFCOMM_MSCEX_TX     1
12220 +#define RFCOMM_MSCEX_RX     2
12221 +#define RFCOMM_MSCEX_OK     (RFCOMM_MSCEX_TX + RFCOMM_MSCEX_RX)
12222 +
12223 +extern struct task_struct *rfcomm_thread;
12224 +extern unsigned long rfcomm_event;
12225 +
12226 +static inline void rfcomm_schedule(uint event)
12227 +{
12228 +       if (!rfcomm_thread)
12229 +               return;
12230 +       set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
12231 +       wake_up_process(rfcomm_thread);
12232 +}
12233 +
12234 +extern struct semaphore rfcomm_sem;
12235 +#define rfcomm_lock()  down(&rfcomm_sem);
12236 +#define rfcomm_unlock()        up(&rfcomm_sem);
12237 +
12238 +/* ---- RFCOMM DLCs (channels) ---- */
12239 +struct rfcomm_dlc *rfcomm_dlc_alloc(int prio);
12240 +void rfcomm_dlc_free(struct rfcomm_dlc *d);
12241 +int  rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel);
12242 +int  rfcomm_dlc_close(struct rfcomm_dlc *d, int reason);
12243 +int  rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb);
12244 +int  rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig);
12245 +int  rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig);
12246 +
12247 +#define rfcomm_dlc_lock(d)     spin_lock(&d->lock)
12248 +#define rfcomm_dlc_unlock(d)   spin_unlock(&d->lock)
12249 +
12250 +static inline void rfcomm_dlc_hold(struct rfcomm_dlc *d)
12251 +{
12252 +       atomic_inc(&d->refcnt);
12253 +}
12254 +
12255 +static inline void rfcomm_dlc_put(struct rfcomm_dlc *d)
12256 +{
12257 +       if (atomic_dec_and_test(&d->refcnt))
12258 +               rfcomm_dlc_free(d);
12259 +}
12260 +
12261 +extern void FASTCALL(__rfcomm_dlc_throttle(struct rfcomm_dlc *d));
12262 +extern void FASTCALL(__rfcomm_dlc_unthrottle(struct rfcomm_dlc *d));
12263 +
12264 +static inline void rfcomm_dlc_throttle(struct rfcomm_dlc *d)
12265 +{
12266 +       if (!test_and_set_bit(RFCOMM_RX_THROTTLED, &d->flags))
12267 +               __rfcomm_dlc_throttle(d);
12268 +}
12269 +
12270 +static inline void rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
12271 +{
12272 +       if (test_and_clear_bit(RFCOMM_RX_THROTTLED, &d->flags))
12273 +               __rfcomm_dlc_unthrottle(d);
12274 +}
12275 +
12276 +/* ---- RFCOMM sessions ---- */
12277 +struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state);
12278 +struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst);
12279 +struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err);
12280 +void   rfcomm_session_del(struct rfcomm_session *s);
12281 +void   rfcomm_session_close(struct rfcomm_session *s, int err);
12282 +void   rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst);
12283 +
12284 +static inline void rfcomm_session_hold(struct rfcomm_session *s)
12285 +{
12286 +       atomic_inc(&s->refcnt);
12287 +}
12288 +
12289 +static inline void rfcomm_session_put(struct rfcomm_session *s)
12290 +{
12291 +       if (atomic_dec_and_test(&s->refcnt))
12292 +               rfcomm_session_del(s);
12293 +}
12294 +
12295 +/* ---- RFCOMM chechsum ---- */
12296 +extern u8 rfcomm_crc_table[];
12297 +
12298 +/* ---- RFCOMM sockets ---- */
12299 +struct sockaddr_rc {
12300 +       sa_family_t rc_family;
12301 +       bdaddr_t    rc_bdaddr;
12302 +       u8          rc_channel;
12303 +};
12304 +
12305 +#define rfcomm_pi(sk)  ((struct rfcomm_pinfo *) &sk->tp_pinfo)
12306 +
12307 +struct rfcomm_pinfo {
12308 +       struct rfcomm_dlc *dlc;
12309 +       u8 channel;
12310 +};
12311 +
12312 +int  rfcomm_init_sockets(void);
12313 +void rfcomm_cleanup_sockets(void);
12314 +
12315 +int  rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d);
12316 +
12317 +/* ---- RFCOMM TTY ---- */
12318 +#define RFCOMM_MAX_DEV  256
12319 +
12320 +#define RFCOMMCREATEDEV                _IOW('R', 200, int)
12321 +#define RFCOMMRELEASEDEV       _IOW('R', 201, int)
12322 +#define RFCOMMGETDEVLIST       _IOR('R', 210, int)
12323 +#define RFCOMMGETDEVINFO       _IOR('R', 211, int)
12324 +#define RFCOMMSTEALDLC         _IOW('R', 220, int)
12325 +
12326 +#define RFCOMM_REUSE_DLC       0
12327 +#define RFCOMM_RELEASE_ONHUP   1
12328 +#define RFCOMM_HANGUP_NOW      2
12329 +#define RFCOMM_TTY_ATTACHED    3
12330 +
12331 +struct rfcomm_dev_req {
12332 +       s16      dev_id;
12333 +       u32      flags;
12334 +       bdaddr_t src;
12335 +       bdaddr_t dst;
12336 +       u8       channel;
12337 +};
12338 +
12339 +struct rfcomm_dev_info {
12340 +       s16      id;
12341 +       u32      flags;
12342 +       u16      state;
12343 +       bdaddr_t src;
12344 +       bdaddr_t dst;
12345 +       u8       channel;
12346 +};
12347 +
12348 +struct rfcomm_dev_list_req {
12349 +       u16      dev_num;
12350 +       struct   rfcomm_dev_info dev_info[0];
12351 +};
12352 +
12353 +int  rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg);
12354 +int  rfcomm_init_ttys(void);
12355 +void rfcomm_cleanup_ttys(void);
12356 +
12357 +#endif /* __RFCOMM_H */
12358 diff -urN linux-2.4.18/include/net/bluetooth/sco.h linux-2.4.18-mh9/include/net/bluetooth/sco.h
12359 --- linux-2.4.18/include/net/bluetooth/sco.h    Thu Jan  1 01:00:00 1970
12360 +++ linux-2.4.18-mh9/include/net/bluetooth/sco.h        Mon Aug 25 18:38:12 2003
12361 @@ -0,0 +1,81 @@
12362 +/*
12363 +   BlueZ - Bluetooth protocol stack for Linux
12364 +   Copyright (C) 2000-2001 Qualcomm Incorporated
12365 +
12366 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
12367 +
12368 +   This program is free software; you can redistribute it and/or modify
12369 +   it under the terms of the GNU General Public License version 2 as
12370 +   published by the Free Software Foundation;
12371 +
12372 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12373 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12374 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
12375 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12376 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
12377 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
12378 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
12379 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
12380 +
12381 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
12382 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
12383 +   SOFTWARE IS DISCLAIMED.
12384 +*/
12385 +
12386 +/*
12387 + *  $Id: sco.h,v 1.1.1.1 2002/03/08 21:03:15 maxk Exp $
12388 + */
12389 +
12390 +#ifndef __SCO_H
12391 +#define __SCO_H
12392 +
12393 +/* SCO defaults */
12394 +#define SCO_DEFAULT_MTU        500
12395 +#define SCO_DEFAULT_FLUSH_TO   0xFFFF
12396 +
12397 +#define SCO_CONN_TIMEOUT       (HZ * 40)
12398 +#define SCO_DISCONN_TIMEOUT    (HZ * 2)
12399 +#define SCO_CONN_IDLE_TIMEOUT  (HZ * 60)
12400 +
12401 +/* SCO socket address */
12402 +struct sockaddr_sco {
12403 +       sa_family_t     sco_family;
12404 +       bdaddr_t        sco_bdaddr;
12405 +};
12406 +
12407 +/* set/get sockopt defines */
12408 +#define SCO_OPTIONS  0x01
12409 +struct sco_options {
12410 +       __u16 mtu;
12411 +};
12412 +
12413 +#define SCO_CONNINFO  0x02
12414 +struct sco_conninfo {
12415 +       __u16 hci_handle;
12416 +};
12417 +
12418 +/* ---- SCO connections ---- */
12419 +struct sco_conn {
12420 +       struct hci_conn *hcon;
12421 +
12422 +       bdaddr_t        *dst;
12423 +       bdaddr_t        *src;
12424 +
12425 +       spinlock_t      lock;
12426 +       struct sock     *sk;
12427 +
12428 +       unsigned int    mtu;
12429 +};
12430 +
12431 +#define sco_conn_lock(c)       spin_lock(&c->lock);
12432 +#define sco_conn_unlock(c)     spin_unlock(&c->lock);
12433 +
12434 +/* ----- SCO socket info ----- */
12435 +#define sco_pi(sk)   ((struct sco_pinfo *) &sk->tp_pinfo)
12436 +
12437 +struct sco_pinfo {
12438 +       __u32           flags;
12439 +       struct sco_conn *conn;
12440 +};
12441 +
12442 +#endif /* __SCO_H */
12443 diff -urN linux-2.4.18/include/pcmcia/ciscode.h linux-2.4.18-mh9/include/pcmcia/ciscode.h
12444 --- linux-2.4.18/include/pcmcia/ciscode.h       Fri Dec 21 18:42:04 2001
12445 +++ linux-2.4.18-mh9/include/pcmcia/ciscode.h   Mon Aug 25 18:38:12 2003
12446 @@ -1,5 +1,5 @@
12447  /*
12448 - * ciscode.h 1.48 2001/08/24 12:16:12
12449 + * ciscode.h 1.57 2002/11/03 20:38:14
12450   *
12451   * The contents of this file are subject to the Mozilla Public License
12452   * Version 1.1 (the "License"); you may not use this file except in
12453 @@ -60,6 +60,10 @@
12454  #define PRODID_INTEL_DUAL_RS232                0x0301
12455  #define PRODID_INTEL_2PLUS             0x8422
12456
12457 +#define MANFID_KME                     0x0032
12458 +#define PRODID_KME_KXLC005_A           0x0704
12459 +#define PRODID_KME_KXLC005_B           0x2904
12460 +
12461  #define MANFID_LINKSYS                 0x0143
12462  #define PRODID_LINKSYS_PCMLM28         0xc0ab
12463  #define PRODID_LINKSYS_3400            0x3341
12464 @@ -94,6 +98,8 @@
12465  #define PRODID_OSITECH_JACK_336                0x0007
12466  #define PRODID_OSITECH_SEVEN           0x0008
12467
12468 +#define MANFID_OXSEMI                  0x0279
12469 +
12470  #define MANFID_PIONEER                 0x000b
12471
12472  #define MANFID_PSION                   0x016c
12473 @@ -103,6 +109,7 @@
12474  #define PRODID_QUATECH_SPP100          0x0003
12475  #define PRODID_QUATECH_DUAL_RS232      0x0012
12476  #define PRODID_QUATECH_DUAL_RS232_D1   0x0007
12477 +#define PRODID_QUATECH_DUAL_RS232_D2   0x0052
12478  #define PRODID_QUATECH_QUAD_RS232      0x001b
12479  #define PRODID_QUATECH_DUAL_RS422      0x000e
12480  #define PRODID_QUATECH_QUAD_RS422      0x0045
12481 @@ -120,8 +127,11 @@
12482
12483  #define MANFID_TDK                     0x0105
12484  #define PRODID_TDK_CF010               0x0900
12485 +#define PRODID_TDK_GN3410              0x4815
12486
12487  #define MANFID_TOSHIBA                 0x0098
12488 +
12489 +#define MANFID_UNGERMANN               0x02c0
12490
12491  #define MANFID_XIRCOM                  0x0105
12492
12493 diff -urN linux-2.4.18/lib/Config.in linux-2.4.18-mh9/lib/Config.in
12494 --- linux-2.4.18/lib/Config.in  Thu Jan  1 01:00:00 1970
12495 +++ linux-2.4.18-mh9/lib/Config.in      Mon Aug 25 18:38:12 2003
12496 @@ -0,0 +1,12 @@
12497 +#
12498 +# Library configuration
12499 +#
12500 +mainmenu_option next_comment
12501 +comment 'Library routines'
12502 +
12503 +if [ "$CONFIG_EXPERIMENTAL" = "y" -a \
12504 +     "$CONFIG_HOTPLUG" = "y" ]; then
12505 +   tristate 'Hotplug firmware loading support (EXPERIMENTAL)' CONFIG_FW_LOADER
12506 +fi
12507 +
12508 +endmenu
12509 diff -urN linux-2.4.18/lib/Makefile linux-2.4.18-mh9/lib/Makefile
12510 --- linux-2.4.18/lib/Makefile   Tue Sep 18 00:31:15 2001
12511 +++ linux-2.4.18-mh9/lib/Makefile       Mon Aug 25 18:38:12 2003
12512 @@ -8,12 +8,16 @@
12513
12514  L_TARGET := lib.a
12515
12516 -export-objs := cmdline.o dec_and_lock.o rwsem-spinlock.o rwsem.o
12517 +export-objs := cmdline.o dec_and_lock.o rwsem-spinlock.o rwsem.o \
12518 +              firmware_class.o
12519
12520  obj-y := errno.o ctype.o string.o vsprintf.o brlock.o cmdline.o bust_spinlocks.o rbtree.o
12521
12522 +obj-$(CONFIG_FW_LOADER) += firmware_class.o
12523  obj-$(CONFIG_RWSEM_GENERIC_SPINLOCK) += rwsem-spinlock.o
12524  obj-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o
12525 +
12526 +include $(TOPDIR)/drivers/bluetooth/Makefile.lib
12527
12528  ifneq ($(CONFIG_HAVE_DEC_LOCK),y)
12529    obj-y += dec_and_lock.o
12530 diff -urN linux-2.4.18/lib/firmware_class.c linux-2.4.18-mh9/lib/firmware_class.c
12531 --- linux-2.4.18/lib/firmware_class.c   Thu Jan  1 01:00:00 1970
12532 +++ linux-2.4.18-mh9/lib/firmware_class.c       Mon Aug 25 18:38:12 2003
12533 @@ -0,0 +1,571 @@
12534 +/*
12535 + * firmware_class.c - Multi purpose firmware loading support
12536 + *
12537 + * Copyright (c) 2003 Manuel Estrada Sainz <ranty@debian.org>
12538 + *
12539 + * Please see Documentation/firmware_class/ for more information.
12540 + *
12541 + */
12542 +/*
12543 + * Based on kernel/kmod.c and drivers/usb/usb.c
12544 + */
12545 +/*
12546 +        kernel/kmod.c
12547 +        Kirk Petersen
12548 +
12549 +        Reorganized not to be a daemon by Adam Richter, with guidance
12550 +        from Greg Zornetzer.
12551 +
12552 +        Modified to avoid chroot and file sharing problems.
12553 +        Mikael Pettersson
12554 +
12555 +        Limit the concurrent number of kmod modprobes to catch loops from
12556 +        "modprobe needs a service that is in a module".
12557 +        Keith Owens <kaos@ocs.com.au> December 1999
12558 +
12559 +        Unblock all signals when we exec a usermode process.
12560 +        Shuu Yamaguchi <shuu@wondernetworkresources.com> December 2000
12561 +*/
12562 +/*
12563 + * drivers/usb/usb.c
12564 + *
12565 + * (C) Copyright Linus Torvalds 1999
12566 + * (C) Copyright Johannes Erdfelt 1999-2001
12567 + * (C) Copyright Andreas Gal 1999
12568 + * (C) Copyright Gregory P. Smith 1999
12569 + * (C) Copyright Deti Fliegl 1999 (new USB architecture)
12570 + * (C) Copyright Randy Dunlap 2000
12571 + * (C) Copyright David Brownell 2000 (kernel hotplug, usb_device_id)
12572 + * (C) Copyright Yggdrasil Computing, Inc. 2000
12573 + *     (usb_device_id matching changes by Adam J. Richter)
12574 + */
12575 +
12576 +#include <linux/config.h>
12577 +#include <linux/module.h>
12578 +#include <linux/string.h>
12579 +#include <linux/types.h>
12580 +#include <linux/init.h>
12581 +#include <linux/slab.h>
12582 +#include <linux/kmod.h>
12583 +#include <linux/proc_fs.h>
12584 +#include <linux/vmalloc.h>
12585 +#include <asm/hardirq.h>
12586 +
12587 +#include "linux/firmware.h"
12588 +
12589 +MODULE_AUTHOR("Manuel Estrada Sainz <ranty@debian.org>");
12590 +MODULE_DESCRIPTION("Multi purpose firmware loading support");
12591 +MODULE_LICENSE("GPL");
12592 +
12593 +#define err(format, arg...) \
12594 +     printk(KERN_ERR  "%s:%s: " format "\n",__FILE__, __FUNCTION__ , ## arg)
12595 +#define warn(format, arg...) \
12596 +     printk(KERN_WARNING "%s:%s: " format "\n",__FILE__, __FUNCTION__ , ## arg)
12597 +#define dbg(format, arg...) \
12598 +     printk(KERN_DEBUG "%s:%s: " format "\n",__FILE__, __FUNCTION__ , ## arg)
12599 +
12600 +static int loading_timeout = 10;       /* In seconds */
12601 +static struct proc_dir_entry *proc_dir_timeout;
12602 +static struct proc_dir_entry *proc_dir;
12603 +
12604 +#ifdef CONFIG_HOTPLUG
12605 +
12606 +static int
12607 +call_helper(char *verb, const char *name, const char *device)
12608 +{
12609 +       char *argv[3], **envp, *buf, *scratch;
12610 +       int i = 0;
12611 +
12612 +       int retval = 0;
12613 +
12614 +       if (!hotplug_path[0])
12615 +               return -ENOENT;
12616 +       if (in_interrupt()) {
12617 +               err("in_interrupt");
12618 +               return -EFAULT;
12619 +       }
12620 +       if (!current->fs->root) {
12621 +               warn("call_policy %s -- no FS yet", verb);
12622 +               return -EPERM;
12623 +       }
12624 +
12625 +       if (!(envp = (char **) kmalloc(20 * sizeof (char *), GFP_KERNEL))) {
12626 +               err("unable to allocate envp");
12627 +               return -ENOMEM;
12628 +       }
12629 +       if (!(buf = kmalloc(256, GFP_KERNEL))) {
12630 +               kfree(envp);
12631 +               err("unable to allocate buf");
12632 +               return -ENOMEM;
12633 +       }
12634 +
12635 +       /* only one standardized param to hotplug command: type */
12636 +       argv[0] = hotplug_path;
12637 +       argv[1] = "firmware";
12638 +       argv[2] = 0;
12639 +
12640 +       /* minimal command environment */
12641 +       envp[i++] = "HOME=/";
12642 +       envp[i++] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
12643 +
12644 +#ifdef  DEBUG
12645 +       /* hint that policy agent should enter no-stdout debug mode */
12646 +       envp[i++] = "DEBUG=kernel";
12647 +#endif
12648 +       scratch = buf;
12649 +
12650 +       if (device) {
12651 +               envp[i++] = scratch;
12652 +               scratch += snprintf(scratch, FIRMWARE_NAME_MAX+25,
12653 +                                   "DEVPATH=/driver/firmware/%s", device) + 1;
12654 +       }
12655 +
12656 +       envp[i++] = scratch;
12657 +       scratch += sprintf(scratch, "ACTION=%s", verb) + 1;
12658 +
12659 +       envp[i++] = scratch;
12660 +       scratch += snprintf(scratch, FIRMWARE_NAME_MAX,
12661 +                           "FIRMWARE=%s", name) + 1;
12662 +
12663 +       envp[i++] = 0;
12664 +
12665 +#ifdef  DEBUG
12666 +       dbg("firmware: %s %s %s", argv[0], argv[1], verb);
12667 +#endif
12668 +
12669 +       retval = call_usermodehelper(argv[0], argv, envp);
12670 +       if (retval) {
12671 +               printk("call_usermodehelper return %d\n", retval);
12672 +       }
12673 +
12674 +       kfree(buf);
12675 +       kfree(envp);
12676 +       return retval;
12677 +}
12678 +#else
12679 +
12680 +static inline int
12681 +call_helper(char *verb, const char *name, const char *device)
12682 +{
12683 +       return -ENOENT;
12684 +}
12685 +
12686 +#endif /* CONFIG_HOTPLUG */
12687 +
12688 +struct firmware_priv {
12689 +       struct completion completion;
12690 +       struct proc_dir_entry *proc_dir;
12691 +       struct proc_dir_entry *attr_data;
12692 +       struct proc_dir_entry *attr_loading;
12693 +       struct firmware *fw;
12694 +       int loading;
12695 +       int abort;
12696 +       int alloc_size;
12697 +       struct timer_list timeout;
12698 +};
12699 +
12700 +static int
12701 +firmware_timeout_show(char *buf, char **start, off_t off,
12702 +                     int count, int *eof, void *data)
12703 +{
12704 +       return sprintf(buf, "%d\n", loading_timeout);
12705 +}
12706 +
12707 +/**
12708 + * firmware_timeout_store:
12709 + * Description:
12710 + *     Sets the number of seconds to wait for the firmware.  Once
12711 + *     this expires an error will be return to the driver and no
12712 + *     firmware will be provided.
12713 + *
12714 + *     Note: zero means 'wait for ever'
12715 + *
12716 + **/
12717 +static int
12718 +firmware_timeout_store(struct file *file, const char *buf,
12719 +                      unsigned long count, void *data)
12720 +{
12721 +       loading_timeout = simple_strtol(buf, NULL, 10);
12722 +       return count;
12723 +}
12724 +
12725 +static int
12726 +firmware_loading_show(char *buf, char **start, off_t off,
12727 +                     int count, int *eof, void *data)
12728 +{
12729 +       struct firmware_priv *fw_priv = data;
12730 +       return sprintf(buf, "%d\n", fw_priv->loading);
12731 +}
12732 +
12733 +/**
12734 + * firmware_loading_store: - loading control file
12735 + * Description:
12736 + *     The relevant values are:
12737 + *
12738 + *      1: Start a load, discarding any previous partial load.
12739 + *      0: Conclude the load and handle the data to the driver code.
12740 + *     -1: Conclude the load with an error and discard any written data.
12741 + **/
12742 +static int
12743 +firmware_loading_store(struct file *file, const char *buf,
12744 +                      unsigned long count, void *data)
12745 +{
12746 +       struct firmware_priv *fw_priv = data;
12747 +       int prev_loading = fw_priv->loading;
12748 +
12749 +       fw_priv->loading = simple_strtol(buf, NULL, 10);
12750 +
12751 +       switch (fw_priv->loading) {
12752 +       case -1:
12753 +               fw_priv->abort = 1;
12754 +               wmb();
12755 +               complete(&fw_priv->completion);
12756 +               break;
12757 +       case 1:
12758 +               kfree(fw_priv->fw->data);
12759 +               fw_priv->fw->data = NULL;
12760 +               fw_priv->fw->size = 0;
12761 +               fw_priv->alloc_size = 0;
12762 +               break;
12763 +       case 0:
12764 +               if (prev_loading == 1)
12765 +                       complete(&fw_priv->completion);
12766 +               break;
12767 +       }
12768 +
12769 +       return count;
12770 +}
12771 +
12772 +static int
12773 +firmware_data_read(char *buffer, char **start, off_t offset,
12774 +                  int count, int *eof, void *data)
12775 +{
12776 +       struct firmware_priv *fw_priv = data;
12777 +       struct firmware *fw = fw_priv->fw;
12778 +
12779 +       if (offset > fw->size)
12780 +               return 0;
12781 +       if (offset + count > fw->size)
12782 +               count = fw->size - offset;
12783 +
12784 +       memcpy(buffer, fw->data + offset, count);
12785 +       *start = (void *) ((long) count);
12786 +       return count;
12787 +}
12788 +static int
12789 +fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
12790 +{
12791 +       u8 *new_data;
12792 +       int new_size;
12793 +
12794 +       if (min_size <= fw_priv->alloc_size)
12795 +               return 0;
12796 +       if((min_size % PAGE_SIZE) == 0)
12797 +               new_size = min_size;
12798 +       else
12799 +               new_size = (min_size + PAGE_SIZE) & PAGE_MASK;
12800 +       new_data = vmalloc(new_size);
12801 +       if (!new_data) {
12802 +               printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
12803 +               /* Make sure that we don't keep incomplete data */
12804 +               fw_priv->abort = 1;
12805 +               return -ENOMEM;
12806 +       }
12807 +       fw_priv->alloc_size = new_size;
12808 +       if (fw_priv->fw->data) {
12809 +               memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
12810 +               vfree(fw_priv->fw->data);
12811 +       }
12812 +       fw_priv->fw->data = new_data;
12813 +       BUG_ON(min_size > fw_priv->alloc_size);
12814 +       return 0;
12815 +}
12816 +
12817 +/**
12818 + * firmware_data_write:
12819 + *
12820 + * Description:
12821 + *
12822 + *     Data written to the 'data' attribute will be later handled to
12823 + *     the driver as a firmware image.
12824 + **/
12825 +static int
12826 +firmware_data_write(struct file *file, const char *buffer,
12827 +                   unsigned long count, void *data)
12828 +{
12829 +       struct firmware_priv *fw_priv = data;
12830 +       struct firmware *fw = fw_priv->fw;
12831 +       int offset = file->f_pos;
12832 +       int retval;
12833 +
12834 +       retval = fw_realloc_buffer(fw_priv, offset + count);
12835 +       if (retval) {
12836 +               printk("%s: retval:%d\n", __FUNCTION__, retval);
12837 +               return retval;
12838 +       }
12839 +
12840 +       memcpy(fw->data + offset, buffer, count);
12841 +
12842 +       fw->size = max_t(size_t, offset + count, fw->size);
12843 +       file->f_pos += count;
12844 +       return count;
12845 +}
12846 +
12847 +static void
12848 +firmware_class_timeout(u_long data)
12849 +{
12850 +       struct firmware_priv *fw_priv = (struct firmware_priv *) data;
12851 +       fw_priv->abort = 1;
12852 +       wmb();
12853 +       complete(&fw_priv->completion);
12854 +}
12855 +static int
12856 +fw_setup_class_device(struct firmware_priv **fw_priv_p,
12857 +                     const char *fw_name, const char *device)
12858 +{
12859 +       int retval;
12860 +       struct firmware_priv *fw_priv = kmalloc(sizeof (struct firmware_priv),
12861 +                                               GFP_KERNEL);
12862 +       *fw_priv_p = fw_priv;
12863 +       if (!fw_priv) {
12864 +               retval = -ENOMEM;
12865 +               goto out;
12866 +       }
12867 +       memset(fw_priv, 0, sizeof (*fw_priv));
12868 +
12869 +       init_completion(&fw_priv->completion);
12870 +
12871 +       fw_priv->timeout.function = firmware_class_timeout;
12872 +       fw_priv->timeout.data = (u_long) fw_priv;
12873 +       init_timer(&fw_priv->timeout);
12874 +
12875 +       retval = -EAGAIN;
12876 +       fw_priv->proc_dir = create_proc_entry(device, 0644 | S_IFDIR, proc_dir);
12877 +       if (!fw_priv->proc_dir)
12878 +               goto err_free_fw_priv;
12879 +
12880 +       fw_priv->attr_data = create_proc_entry("data", 0644 | S_IFREG,
12881 +                                              fw_priv->proc_dir);
12882 +       if (!fw_priv->attr_data)
12883 +               goto err_remove_dir;
12884 +
12885 +       fw_priv->attr_data->read_proc = firmware_data_read;
12886 +       fw_priv->attr_data->write_proc = firmware_data_write;
12887 +       fw_priv->attr_data->data = fw_priv;
12888 +
12889 +       fw_priv->attr_loading = create_proc_entry("loading", 0644 | S_IFREG,
12890 +                                                 fw_priv->proc_dir);
12891 +       if (!fw_priv->attr_loading)
12892 +               goto err_remove_data;
12893 +
12894 +       fw_priv->attr_loading->read_proc = firmware_loading_show;
12895 +       fw_priv->attr_loading->write_proc = firmware_loading_store;
12896 +       fw_priv->attr_loading->data = fw_priv;
12897 +
12898 +       retval = 0;
12899 +       fw_priv->fw = kmalloc(sizeof (struct firmware), GFP_KERNEL);
12900 +       if (!fw_priv->fw) {
12901 +               printk(KERN_ERR "%s: kmalloc(struct firmware) failed\n",
12902 +                      __FUNCTION__);
12903 +               retval = -ENOMEM;
12904 +               goto err_remove_loading;
12905 +       }
12906 +       memset(fw_priv->fw, 0, sizeof (*fw_priv->fw));
12907 +
12908 +       goto out;
12909 +
12910 +err_remove_loading:
12911 +       remove_proc_entry("loading", fw_priv->proc_dir);
12912 +err_remove_data:
12913 +       remove_proc_entry("data", fw_priv->proc_dir);
12914 +err_remove_dir:
12915 +       remove_proc_entry(device, proc_dir);
12916 +err_free_fw_priv:
12917 +       kfree(fw_priv);
12918 +out:
12919 +       return retval;
12920 +}
12921 +static void
12922 +fw_remove_class_device(struct firmware_priv *fw_priv)
12923 +{
12924 +       remove_proc_entry("loading", fw_priv->proc_dir);
12925 +       remove_proc_entry("data", fw_priv->proc_dir);
12926 +       remove_proc_entry(fw_priv->proc_dir->name, proc_dir);
12927 +}
12928 +
12929 +/**
12930 + * request_firmware: - request firmware to hotplug and wait for it
12931 + * Description:
12932 + *     @firmware will be used to return a firmware image by the name
12933 + *     of @name for device @device.
12934 + *
12935 + *     Should be called from user context where sleeping is allowed.
12936 + *
12937 + *     @name will be use as $FIRMWARE in the hotplug environment and
12938 + *     should be distinctive enough not to be confused with any other
12939 + *     firmware image for this or any other device.
12940 + **/
12941 +int
12942 +request_firmware(const struct firmware **firmware, const char *name,
12943 +                const char *device)
12944 +{
12945 +       struct firmware_priv *fw_priv;
12946 +       int retval;
12947 +
12948 +       if (!firmware) {
12949 +               retval = -EINVAL;
12950 +               goto out;
12951 +       }
12952 +       *firmware = NULL;
12953 +
12954 +       retval = fw_setup_class_device(&fw_priv, name, device);
12955 +       if (retval)
12956 +               goto out;
12957 +
12958 +       retval = call_helper("add", name, device);
12959 +       if (retval)
12960 +               goto out;
12961 +       if (loading_timeout) {
12962 +               fw_priv->timeout.expires = jiffies + loading_timeout * HZ;
12963 +               add_timer(&fw_priv->timeout);
12964 +       }
12965 +
12966 +       wait_for_completion(&fw_priv->completion);
12967 +
12968 +       del_timer(&fw_priv->timeout);
12969 +       fw_remove_class_device(fw_priv);
12970 +
12971 +       if (fw_priv->fw->size && !fw_priv->abort) {
12972 +               *firmware = fw_priv->fw;
12973 +       } else {
12974 +               retval = -ENOENT;
12975 +               vfree(fw_priv->fw->data);
12976 +               kfree(fw_priv->fw);
12977 +       }
12978 +out:
12979 +       kfree(fw_priv);
12980 +       return retval;
12981 +}
12982 +
12983 +void
12984 +release_firmware(const struct firmware *fw)
12985 +{
12986 +       if (fw) {
12987 +               vfree(fw->data);
12988 +               kfree(fw);
12989 +       }
12990 +}
12991 +
12992 +/**
12993 + * register_firmware: - provide a firmware image for later usage
12994 + *
12995 + * Description:
12996 + *     Make sure that @data will be available by requesting firmware @name.
12997 + *
12998 + *     Note: This will not be possible until some kind of persistence
12999 + *     is available.
13000 + **/
13001 +void
13002 +register_firmware(const char *name, const u8 *data, size_t size)
13003 +{
13004 +       /* This is meaningless without firmware caching, so until we
13005 +        * decide if firmware caching is reasonable just leave it as a
13006 +        * noop */
13007 +}
13008 +
13009 +/* Async support */
13010 +struct firmware_work {
13011 +       struct tq_struct work;
13012 +       struct module *module;
13013 +       const char *name;
13014 +       const char *device;
13015 +       void *context;
13016 +       void (*cont)(const struct firmware *fw, void *context);
13017 +};
13018 +
13019 +static void
13020 +request_firmware_work_func(void *arg)
13021 +{
13022 +       struct firmware_work *fw_work = arg;
13023 +       const struct firmware *fw;
13024 +       if (!arg)
13025 +               return;
13026 +       request_firmware(&fw, fw_work->name, fw_work->device);
13027 +       fw_work->cont(fw, fw_work->context);
13028 +       release_firmware(fw);
13029 +       __MOD_DEC_USE_COUNT(fw_work->module);
13030 +       kfree(fw_work);
13031 +}
13032 +
13033 +/**
13034 + * request_firmware_nowait:
13035 + *
13036 + * Description:
13037 + *     Asynchronous variant of request_firmware() for contexts where
13038 + *     it is not possible to sleep.
13039 + *
13040 + *     @cont will be called asynchronously when the firmware request is over.
13041 + *
13042 + *     @context will be passed over to @cont.
13043 + *
13044 + *     @fw may be %NULL if firmware request fails.
13045 + *
13046 + **/
13047 +int
13048 +request_firmware_nowait(
13049 +       struct module *module,
13050 +       const char *name, const char *device, void *context,
13051 +       void (*cont)(const struct firmware *fw, void *context))
13052 +{
13053 +       struct firmware_work *fw_work = kmalloc(sizeof (struct firmware_work),
13054 +                                               GFP_ATOMIC);
13055 +       if (!fw_work)
13056 +               return -ENOMEM;
13057 +       if (!try_inc_mod_count(module)) {
13058 +               kfree(fw_work);
13059 +               return -EFAULT;
13060 +       }
13061 +
13062 +       *fw_work = (struct firmware_work) {
13063 +               .module = module,
13064 +               .name = name,
13065 +               .device = device,
13066 +               .context = context,
13067 +               .cont = cont,
13068 +       };
13069 +       INIT_TQUEUE(&fw_work->work, request_firmware_work_func, fw_work);
13070 +
13071 +       schedule_task(&fw_work->work);
13072 +       return 0;
13073 +}
13074 +
13075 +static int __init
13076 +firmware_class_init(void)
13077 +{
13078 +       proc_dir = create_proc_entry("driver/firmware", 0755 | S_IFDIR, NULL);
13079 +       if (!proc_dir)
13080 +               return -EAGAIN;
13081 +       proc_dir_timeout = create_proc_entry("timeout",
13082 +                                            0644 | S_IFREG, proc_dir);
13083 +       if (!proc_dir_timeout) {
13084 +               remove_proc_entry("driver/firmware", NULL);
13085 +               return -EAGAIN;
13086 +       }
13087 +       proc_dir_timeout->read_proc = firmware_timeout_show;
13088 +       proc_dir_timeout->write_proc = firmware_timeout_store;
13089 +       return 0;
13090 +}
13091 +static void __exit
13092 +firmware_class_exit(void)
13093 +{
13094 +       remove_proc_entry("timeout", proc_dir);
13095 +       remove_proc_entry("driver/firmware", NULL);
13096 +}
13097 +
13098 +module_init(firmware_class_init);
13099 +module_exit(firmware_class_exit);
13100 +
13101 +EXPORT_SYMBOL(release_firmware);
13102 +EXPORT_SYMBOL(request_firmware);
13103 +EXPORT_SYMBOL(request_firmware_nowait);
13104 +EXPORT_SYMBOL(register_firmware);
13105 diff -urN linux-2.4.18/net/bluetooth/Config.in linux-2.4.18-mh9/net/bluetooth/Config.in
13106 --- linux-2.4.18/net/bluetooth/Config.in        Tue Jun 12 04:15:27 2001
13107 +++ linux-2.4.18-mh9/net/bluetooth/Config.in    Mon Aug 25 18:38:12 2003
13108 @@ -1,16 +1,22 @@
13109  #
13110 -# Bluetooth configuration
13111 +# Bluetooth subsystem configuration
13112  #
13113
13114  if [ "$CONFIG_NET" != "n" ]; then
13115 +
13116     mainmenu_option next_comment
13117     comment 'Bluetooth support'
13118     dep_tristate 'Bluetooth subsystem support' CONFIG_BLUEZ $CONFIG_NET
13119
13120     if [ "$CONFIG_BLUEZ" != "n" ]; then
13121        dep_tristate 'L2CAP protocol support' CONFIG_BLUEZ_L2CAP $CONFIG_BLUEZ
13122 +      dep_tristate 'SCO links support' CONFIG_BLUEZ_SCO $CONFIG_BLUEZ
13123 +      source net/bluetooth/rfcomm/Config.in
13124 +      source net/bluetooth/bnep/Config.in
13125 +      source net/bluetooth/cmtp/Config.in
13126        source drivers/bluetooth/Config.in
13127     fi
13128 +
13129     endmenu
13130  fi
13131
13132 diff -urN linux-2.4.18/net/bluetooth/Makefile linux-2.4.18-mh9/net/bluetooth/Makefile
13133 --- linux-2.4.18/net/bluetooth/Makefile Tue Jun 12 04:15:27 2001
13134 +++ linux-2.4.18-mh9/net/bluetooth/Makefile     Mon Aug 25 18:38:12 2003
13135 @@ -1,20 +1,31 @@
13136  #
13137 -# Makefile for the Bluetooth subsystem
13138 +# Makefile for the Linux Bluetooth subsystem
13139  #
13140 -O_TARGET       := bluetooth.o
13141
13142 -list-multi     := hci.o l2cap.o
13143 -export-objs    := syms.o
13144 -hci-objs       := af_bluetooth.o hci_core.o hci_sock.o lib.o syms.o
13145 -l2cap-objs     := l2cap_core.o l2cap_proc.o
13146 +O_TARGET    := bluetooth.o
13147
13148 -obj-$(CONFIG_BLUEZ) += hci.o
13149 +list-multi  := bluez.o
13150 +export-objs := syms.o l2cap.o
13151 +
13152 +bluez-objs  := af_bluetooth.o hci_core.o hci_conn.o hci_event.o hci_sock.o lib.o syms.o
13153 +
13154 +obj-$(CONFIG_BLUEZ) += bluez.o
13155  obj-$(CONFIG_BLUEZ_L2CAP) += l2cap.o
13156 +obj-$(CONFIG_BLUEZ_SCO) += sco.o
13157
13158 -include $(TOPDIR)/Rules.make
13159 +subdir-$(CONFIG_BLUEZ_RFCOMM) += rfcomm
13160 +subdir-$(CONFIG_BLUEZ_BNEP) += bnep
13161 +subdir-$(CONFIG_BLUEZ_CMTP) += cmtp
13162
13163 -hci.o: $(hci-objs)
13164 -       $(LD) -r -o $@ $(hci-objs)
13165 +ifeq ($(CONFIG_BLUEZ_RFCOMM),y)
13166 +obj-y += rfcomm/rfcomm.o
13167 +endif
13168 +
13169 +ifeq ($(CONFIG_BLUEZ_BNEP),y)
13170 +obj-y += bnep/bnep.o
13171 +endif
13172 +
13173 +include $(TOPDIR)/Rules.make
13174
13175 -l2cap.o: $(l2cap-objs)
13176 -       $(LD) -r -o $@ $(l2cap-objs)
13177 +bluez.o: $(bluez-objs)
13178 +       $(LD) -r -o $@ $(bluez-objs)
13179 diff -urN linux-2.4.18/net/bluetooth/af_bluetooth.c linux-2.4.18-mh9/net/bluetooth/af_bluetooth.c
13180 --- linux-2.4.18/net/bluetooth/af_bluetooth.c   Fri Sep  7 18:28:38 2001
13181 +++ linux-2.4.18-mh9/net/bluetooth/af_bluetooth.c       Mon Aug 25 18:38:12 2003
13182 @@ -25,14 +25,15 @@
13183  /*
13184   * BlueZ Bluetooth address family and sockets.
13185   *
13186 - * $Id: af_bluetooth.c,v 1.4 2001/07/05 18:42:44 maxk Exp $
13187 + * $Id: af_bluetooth.c,v 1.8 2002/07/22 20:32:54 maxk Exp $
13188   */
13189 -#define VERSION "1.1"
13190 +#define VERSION "2.4"
13191
13192  #include <linux/config.h>
13193  #include <linux/module.h>
13194
13195  #include <linux/types.h>
13196 +#include <linux/list.h>
13197  #include <linux/errno.h>
13198  #include <linux/kernel.h>
13199  #include <linux/major.h>
13200 @@ -40,6 +41,7 @@
13201  #include <linux/slab.h>
13202  #include <linux/skbuff.h>
13203  #include <linux/init.h>
13204 +#include <linux/poll.h>
13205  #include <linux/proc_fs.h>
13206  #include <net/sock.h>
13207
13208 @@ -48,70 +50,79 @@
13209  #endif
13210
13211  #include <net/bluetooth/bluetooth.h>
13212 -#include <net/bluetooth/bluez.h>
13213 +
13214 +#ifndef AF_BLUETOOTH_DEBUG
13215 +#undef  BT_DBG
13216 +#define BT_DBG( A... )
13217 +#endif
13218
13219  /* Bluetooth sockets */
13220 -static struct net_proto_family *bluez_sock[BLUEZ_MAX_PROTO];
13221 +#define BLUEZ_MAX_PROTO        6
13222 +static struct net_proto_family *bluez_proto[BLUEZ_MAX_PROTO];
13223
13224  int bluez_sock_register(int proto, struct net_proto_family *ops)
13225  {
13226 -       if (proto > BLUEZ_MAX_PROTO)
13227 +       if (proto >= BLUEZ_MAX_PROTO)
13228                 return -EINVAL;
13229
13230 -       if (bluez_sock[proto])
13231 +       if (bluez_proto[proto])
13232                 return -EEXIST;
13233
13234 -       bluez_sock[proto] = ops;
13235 +       bluez_proto[proto] = ops;
13236         return 0;
13237  }
13238
13239  int bluez_sock_unregister(int proto)
13240  {
13241 -       if (proto > BLUEZ_MAX_PROTO)
13242 +       if (proto >= BLUEZ_MAX_PROTO)
13243                 return -EINVAL;
13244
13245 -       if (!bluez_sock[proto])
13246 +       if (!bluez_proto[proto])
13247                 return -ENOENT;
13248
13249 -       bluez_sock[proto] = NULL;
13250 +       bluez_proto[proto] = NULL;
13251         return 0;
13252  }
13253
13254  static int bluez_sock_create(struct socket *sock, int proto)
13255  {
13256 -       if (proto > BLUEZ_MAX_PROTO)
13257 +       if (proto >= BLUEZ_MAX_PROTO)
13258                 return -EINVAL;
13259
13260  #if defined(CONFIG_KMOD)
13261 -       if (!bluez_sock[proto]) {
13262 +       if (!bluez_proto[proto]) {
13263                 char module_name[30];
13264                 sprintf(module_name, "bt-proto-%d", proto);
13265                 request_module(module_name);
13266         }
13267  #endif
13268
13269 -       if (!bluez_sock[proto])
13270 +       if (!bluez_proto[proto])
13271                 return -ENOENT;
13272
13273 -       return bluez_sock[proto]->create(sock, proto);
13274 +       return bluez_proto[proto]->create(sock, proto);
13275 +}
13276 +
13277 +void bluez_sock_init(struct socket *sock, struct sock *sk)
13278 +{
13279 +       sock_init_data(sock, sk);
13280 +       INIT_LIST_HEAD(&bluez_pi(sk)->accept_q);
13281  }
13282
13283  void bluez_sock_link(struct bluez_sock_list *l, struct sock *sk)
13284  {
13285 -       write_lock(&l->lock);
13286 -
13287 +       write_lock_bh(&l->lock);
13288         sk->next = l->head;
13289         l->head = sk;
13290         sock_hold(sk);
13291 -
13292 -       write_unlock(&l->lock);
13293 +       write_unlock_bh(&l->lock);
13294  }
13295
13296  void bluez_sock_unlink(struct bluez_sock_list *l, struct sock *sk)
13297  {
13298         struct sock **skp;
13299
13300 -       write_lock(&l->lock);
13301 +       write_lock_bh(&l->lock);
13302         for (skp = &l->head; *skp; skp = &((*skp)->next)) {
13303                 if (*skp == sk) {
13304                         *skp = sk->next;
13305 @@ -119,7 +130,162 @@
13306                         break;
13307                 }
13308         }
13309 -       write_unlock(&l->lock);
13310 +       write_unlock_bh(&l->lock);
13311 +}
13312 +
13313 +void bluez_accept_enqueue(struct sock *parent, struct sock *sk)
13314 +{
13315 +       BT_DBG("parent %p, sk %p", parent, sk);
13316 +
13317 +       sock_hold(sk);
13318 +       list_add_tail(&bluez_pi(sk)->accept_q, &bluez_pi(parent)->accept_q);
13319 +       bluez_pi(sk)->parent = parent;
13320 +       parent->ack_backlog++;
13321 +}
13322 +
13323 +static void bluez_accept_unlink(struct sock *sk)
13324 +{
13325 +       BT_DBG("sk %p state %d", sk, sk->state);
13326 +
13327 +       list_del_init(&bluez_pi(sk)->accept_q);
13328 +       bluez_pi(sk)->parent->ack_backlog--;
13329 +       bluez_pi(sk)->parent = NULL;
13330 +       sock_put(sk);
13331 +}
13332 +
13333 +struct sock *bluez_accept_dequeue(struct sock *parent, struct socket *newsock)
13334 +{
13335 +       struct list_head *p, *n;
13336 +       struct bluez_pinfo *pi;
13337 +       struct sock *sk;
13338 +
13339 +       BT_DBG("parent %p", parent);
13340 +
13341 +       list_for_each_safe(p, n, &bluez_pi(parent)->accept_q) {
13342 +               pi = list_entry(p, struct bluez_pinfo, accept_q);
13343 +               sk = bluez_sk(pi);
13344 +
13345 +               lock_sock(sk);
13346 +               if (sk->state == BT_CLOSED) {
13347 +                       release_sock(sk);
13348 +                       bluez_accept_unlink(sk);
13349 +                       continue;
13350 +               }
13351 +
13352 +               if (sk->state == BT_CONNECTED || !newsock) {
13353 +                       bluez_accept_unlink(sk);
13354 +                       if (newsock)
13355 +                               sock_graft(sk, newsock);
13356 +                       release_sock(sk);
13357 +                       return sk;
13358 +               }
13359 +               release_sock(sk);
13360 +       }
13361 +       return NULL;
13362 +}
13363 +
13364 +int bluez_sock_recvmsg(struct socket *sock, struct msghdr *msg, int len, int flags, struct scm_cookie *scm)
13365 +{
13366 +       int noblock = flags & MSG_DONTWAIT;
13367 +       struct sock *sk = sock->sk;
13368 +       struct sk_buff *skb;
13369 +       int copied, err;
13370 +
13371 +       BT_DBG("sock %p sk %p len %d", sock, sk, len);
13372 +
13373 +       if (flags & (MSG_OOB))
13374 +               return -EOPNOTSUPP;
13375 +
13376 +       if (!(skb = skb_recv_datagram(sk, flags, noblock, &err))) {
13377 +               if (sk->shutdown & RCV_SHUTDOWN)
13378 +                       return 0;
13379 +               return err;
13380 +       }
13381 +
13382 +       msg->msg_namelen = 0;
13383 +
13384 +       copied = skb->len;
13385 +       if (len < copied) {
13386 +               msg->msg_flags |= MSG_TRUNC;
13387 +               copied = len;
13388 +       }
13389 +
13390 +       skb->h.raw = skb->data;
13391 +       err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
13392 +
13393 +       skb_free_datagram(sk, skb);
13394 +
13395 +       return err ? : copied;
13396 +}
13397 +
13398 +unsigned int bluez_sock_poll(struct file * file, struct socket *sock, poll_table *wait)
13399 +{
13400 +       struct sock *sk = sock->sk;
13401 +       unsigned int mask;
13402 +
13403 +       BT_DBG("sock %p, sk %p", sock, sk);
13404 +
13405 +       poll_wait(file, sk->sleep, wait);
13406 +       mask = 0;
13407 +
13408 +       if (sk->err || !skb_queue_empty(&sk->error_queue))
13409 +               mask |= POLLERR;
13410 +
13411 +       if (sk->shutdown == SHUTDOWN_MASK)
13412 +               mask |= POLLHUP;
13413 +
13414 +       if (!skb_queue_empty(&sk->receive_queue) ||
13415 +                       !list_empty(&bluez_pi(sk)->accept_q) ||
13416 +                       (sk->shutdown & RCV_SHUTDOWN))
13417 +               mask |= POLLIN | POLLRDNORM;
13418 +
13419 +       if (sk->state == BT_CLOSED)
13420 +               mask |= POLLHUP;
13421 +
13422 +       if (sk->state == BT_CONNECT || sk->state == BT_CONNECT2)
13423 +               return mask;
13424 +
13425 +       if (sock_writeable(sk))
13426 +               mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
13427 +       else
13428 +               set_bit(SOCK_ASYNC_NOSPACE, &sk->socket->flags);
13429 +
13430 +       return mask;
13431 +}
13432 +
13433 +int bluez_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
13434 +{
13435 +       DECLARE_WAITQUEUE(wait, current);
13436 +       int err = 0;
13437 +
13438 +       BT_DBG("sk %p", sk);
13439 +
13440 +       add_wait_queue(sk->sleep, &wait);
13441 +       while (sk->state != state) {
13442 +               set_current_state(TASK_INTERRUPTIBLE);
13443 +
13444 +               if (!timeo) {
13445 +                       err = -EAGAIN;
13446 +                       break;
13447 +               }
13448 +
13449 +               if (signal_pending(current)) {
13450 +                       err = sock_intr_errno(timeo);
13451 +                       break;
13452 +               }
13453 +
13454 +               release_sock(sk);
13455 +               timeo = schedule_timeout(timeo);
13456 +               lock_sock(sk);
13457 +
13458 +               if (sk->err) {
13459 +                       err = sock_error(sk);
13460 +                       break;
13461 +               }
13462 +       }
13463 +       set_current_state(TASK_RUNNING);
13464 +       remove_wait_queue(sk->sleep, &wait);
13465 +       return err;
13466  }
13467
13468  struct net_proto_family bluez_sock_family_ops =
13469 @@ -129,9 +295,9 @@
13470
13471  int bluez_init(void)
13472  {
13473 -       INF("BlueZ HCI Core ver %s Copyright (C) 2000,2001 Qualcomm Inc",
13474 +       BT_INFO("BlueZ Core ver %s Copyright (C) 2000,2001 Qualcomm Inc",
13475                  VERSION);
13476 -       INF("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
13477 +       BT_INFO("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
13478
13479         proc_mkdir("bluetooth", NULL);
13480
13481 @@ -164,5 +330,6 @@
13482  module_exit(bluez_cleanup);
13483
13484  MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
13485 -MODULE_DESCRIPTION("BlueZ HCI Core ver " VERSION);
13486 +MODULE_DESCRIPTION("BlueZ Core ver " VERSION);
13487 +MODULE_LICENSE("GPL");
13488  #endif
13489 diff -urN linux-2.4.18/net/bluetooth/bnep/Config.in linux-2.4.18-mh9/net/bluetooth/bnep/Config.in
13490 --- linux-2.4.18/net/bluetooth/bnep/Config.in   Thu Jan  1 01:00:00 1970
13491 +++ linux-2.4.18-mh9/net/bluetooth/bnep/Config.in       Mon Aug 25 18:38:12 2003
13492 @@ -0,0 +1,11 @@
13493 +#
13494 +# Bluetooth BNEP layer configuration
13495 +#
13496 +
13497 +dep_tristate 'BNEP protocol support' CONFIG_BLUEZ_BNEP $CONFIG_BLUEZ_L2CAP
13498 +
13499 +if [ "$CONFIG_BLUEZ_BNEP" != "n" ]; then
13500 +   bool '  Multicast filter support' CONFIG_BLUEZ_BNEP_MC_FILTER
13501 +   bool '  Protocol filter support'  CONFIG_BLUEZ_BNEP_PROTO_FILTER
13502 +fi
13503 +
13504 diff -urN linux-2.4.18/net/bluetooth/bnep/Makefile linux-2.4.18-mh9/net/bluetooth/bnep/Makefile
13505 --- linux-2.4.18/net/bluetooth/bnep/Makefile    Thu Jan  1 01:00:00 1970
13506 +++ linux-2.4.18-mh9/net/bluetooth/bnep/Makefile        Mon Aug 25 18:38:12 2003
13507 @@ -0,0 +1,10 @@
13508 +#
13509 +# Makefile for the Linux Bluetooth BNEP layer
13510 +#
13511 +
13512 +O_TARGET := bnep.o
13513 +
13514 +obj-y   := core.o sock.o netdev.o crc32.o
13515 +obj-m    += $(O_TARGET)
13516 +
13517 +include $(TOPDIR)/Rules.make
13518 diff -urN linux-2.4.18/net/bluetooth/bnep/bnep.h linux-2.4.18-mh9/net/bluetooth/bnep/bnep.h
13519 --- linux-2.4.18/net/bluetooth/bnep/bnep.h      Thu Jan  1 01:00:00 1970
13520 +++ linux-2.4.18-mh9/net/bluetooth/bnep/bnep.h  Mon Aug 25 18:38:12 2003
13521 @@ -0,0 +1,185 @@
13522 +/*
13523 +  BNEP protocol definition for Linux Bluetooth stack (BlueZ).
13524 +  Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
13525 +
13526 +  This program is free software; you can redistribute it and/or modify
13527 +  it under the terms of the GNU General Public License, version 2, as
13528 +  published by the Free Software Foundation.
13529 +
13530 +  This program is distributed in the hope that it will be useful,
13531 +  but WITHOUT ANY WARRANTY; without even the implied warranty of
13532 +  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13533 +  GNU General Public License for more details.
13534 +
13535 +  You should have received a copy of the GNU General Public License
13536 +  along with this program; if not, write to the Free Software
13537 +  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
13538 +*/
13539 +
13540 +/*
13541 + * $Id: bnep2.h,v 1.9 2002/07/14 07:09:19 maxk Exp $
13542 + */
13543 +
13544 +#ifndef _BNEP_H
13545 +#define _BNEP_H
13546 +
13547 +#include <linux/types.h>
13548 +#include <net/bluetooth/bluetooth.h>
13549 +
13550 +#include "crc32.h"
13551 +
13552 +// Limits
13553 +#define BNEP_MAX_PROTO_FILTERS     5
13554 +#define BNEP_MAX_MULTICAST_FILTERS 20
13555 +
13556 +// UUIDs
13557 +#define BNEP_BASE_UUID 0x0000000000001000800000805F9B34FB
13558 +#define BNEP_UUID16    0x02
13559 +#define BNEP_UUID32    0x04
13560 +#define BNEP_UUID128   0x16
13561 +
13562 +#define BNEP_SVC_PANU  0x1115
13563 +#define BNEP_SVC_NAP   0x1116
13564 +#define BNEP_SVC_GN    0x1117
13565 +
13566 +// Packet types
13567 +#define BNEP_GENERAL               0x00
13568 +#define BNEP_CONTROL               0x01
13569 +#define BNEP_COMPRESSED            0x02
13570 +#define BNEP_COMPRESSED_SRC_ONLY   0x03
13571 +#define BNEP_COMPRESSED_DST_ONLY   0x04
13572 +
13573 +// Control types
13574 +#define BNEP_CMD_NOT_UNDERSTOOD    0x00
13575 +#define BNEP_SETUP_CONN_REQ        0x01
13576 +#define BNEP_SETUP_CONN_RSP        0x02
13577 +#define BNEP_FILTER_NET_TYPE_SET   0x03
13578 +#define BNEP_FILTER_NET_TYPE_RSP   0x04
13579 +#define BNEP_FILTER_MULTI_ADDR_SET 0x05
13580 +#define BNEP_FILTER_MULTI_ADDR_RSP 0x06
13581 +
13582 +// Extension types
13583 +#define BNEP_EXT_CONTROL           0x00
13584 +
13585 +// Response messages
13586 +#define BNEP_SUCCESS               0x00
13587 +
13588 +#define BNEP_CONN_INVALID_DST      0x01
13589 +#define BNEP_CONN_INVALID_SRC      0x02
13590 +#define BNEP_CONN_INVALID_SVC      0x03
13591 +#define BNEP_CONN_NOT_ALLOWED      0x04
13592 +
13593 +#define BNEP_FILTER_UNSUPPORTED_REQ    0x01
13594 +#define BNEP_FILTER_INVALID_RANGE      0x02
13595 +#define BNEP_FILTER_INVALID_MCADDR     0x02
13596 +#define BNEP_FILTER_LIMIT_REACHED      0x03
13597 +#define BNEP_FILTER_DENIED_SECURITY    0x04
13598 +
13599 +// L2CAP settings
13600 +#define BNEP_MTU         1691
13601 +#define BNEP_PSM        0x0f
13602 +#define BNEP_FLUSH_TO    0xffff
13603 +#define BNEP_CONNECT_TO  15
13604 +#define BNEP_FILTER_TO   15
13605 +
13606 +// Headers
13607 +#define BNEP_TYPE_MASK  0x7f
13608 +#define BNEP_EXT_HEADER         0x80
13609 +
13610 +struct bnep_setup_conn_req {
13611 +       __u8  type;
13612 +       __u8  ctrl;
13613 +       __u8  uuid_size;
13614 +       __u8  service[0];
13615 +} __attribute__((packed));
13616 +
13617 +struct bnep_set_filter_req {
13618 +       __u8  type;
13619 +       __u8  ctrl;
13620 +       __u16 len;
13621 +       __u8  list[0];
13622 +} __attribute__((packed));
13623 +
13624 +struct bnep_control_rsp {
13625 +       __u8  type;
13626 +       __u8  ctrl;
13627 +       __u16 resp;
13628 +} __attribute__((packed));
13629 +
13630 +struct bnep_ext_hdr {
13631 +       __u8  type;
13632 +       __u8  len;
13633 +       __u8  data[0];
13634 +} __attribute__((packed));
13635 +
13636 +/* BNEP ioctl defines */
13637 +#define BNEPCONNADD    _IOW('B', 200, int)
13638 +#define BNEPCONNDEL    _IOW('B', 201, int)
13639 +#define BNEPGETCONNLIST        _IOR('B', 210, int)
13640 +#define BNEPGETCONNINFO        _IOR('B', 211, int)
13641 +
13642 +struct bnep_connadd_req {
13643 +       int   sock;       // Connected socket
13644 +       __u32 flags;
13645 +       __u16 role;
13646 +       char  device[16]; // Name of the Ethernet device
13647 +};
13648 +
13649 +struct bnep_conndel_req {
13650 +       __u32 flags;
13651 +       __u8  dst[ETH_ALEN];
13652 +};
13653 +
13654 +struct bnep_conninfo {
13655 +       __u32 flags;
13656 +       __u16 role;
13657 +       __u16 state;
13658 +       __u8  dst[ETH_ALEN];
13659 +       char  device[16];
13660 +};
13661 +
13662 +struct bnep_connlist_req {
13663 +       __u32  cnum;
13664 +       struct bnep_conninfo *ci;
13665 +};
13666 +
13667 +struct bnep_proto_filter {
13668 +       __u16 start;
13669 +       __u16 end;
13670 +};
13671 +
13672 +int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock);
13673 +int bnep_del_connection(struct bnep_conndel_req *req);
13674 +int bnep_get_connlist(struct bnep_connlist_req *req);
13675 +int bnep_get_conninfo(struct bnep_conninfo *ci);
13676 +
13677 +// BNEP sessions
13678 +struct bnep_session {
13679 +       struct list_head list;
13680 +
13681 +       unsigned int  role;
13682 +        unsigned long state;
13683 +        unsigned long flags;
13684 +       atomic_t      killed;
13685 +
13686 +       struct ethhdr eh;
13687 +       struct msghdr msg;
13688 +
13689 +       struct bnep_proto_filter proto_filter[BNEP_MAX_PROTO_FILTERS];
13690 +       u64    mc_filter;
13691 +
13692 +       struct socket    *sock;
13693 +       struct net_device dev;
13694 +       struct net_device_stats stats;
13695 +};
13696 +
13697 +int bnep_net_init(struct net_device *dev);
13698 +int bnep_sock_init(void);
13699 +int bnep_sock_cleanup(void);
13700 +
13701 +static inline int bnep_mc_hash(__u8 *addr)
13702 +{
13703 +        return (bnep_crc32(~0, addr, ETH_ALEN) >> 26);
13704 +}
13705 +
13706 +#endif
13707 diff -urN linux-2.4.18/net/bluetooth/bnep/core.c linux-2.4.18-mh9/net/bluetooth/bnep/core.c
13708 --- linux-2.4.18/net/bluetooth/bnep/core.c      Thu Jan  1 01:00:00 1970
13709 +++ linux-2.4.18-mh9/net/bluetooth/bnep/core.c  Mon Aug 25 18:38:12 2003
13710 @@ -0,0 +1,708 @@
13711 +/*
13712 +   BNEP implementation for Linux Bluetooth stack (BlueZ).
13713 +   Copyright (C) 2001-2002 Inventel Systemes
13714 +   Written 2001-2002 by
13715 +       Clément Moreau <clement.moreau@inventel.fr>
13716 +       David Libault  <david.libault@inventel.fr>
13717 +
13718 +   Copyright (C) 2002 Maxim Krasnyanskiy <maxk@qualcomm.com>
13719 +
13720 +   This program is free software; you can redistribute it and/or modify
13721 +   it under the terms of the GNU General Public License version 2 as
13722 +   published by the Free Software Foundation;
13723 +
13724 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13725 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13726 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13727 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
13728 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
13729 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13730 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
13731 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
13732 +
13733 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
13734 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
13735 +   SOFTWARE IS DISCLAIMED.
13736 +*/
13737 +
13738 +/*
13739 + * $Id: core.c,v 1.18 2002/07/14 07:09:19 maxk Exp $
13740 + */
13741 +
13742 +#define __KERNEL_SYSCALLS__
13743 +
13744 +#include <linux/config.h>
13745 +#include <linux/module.h>
13746 +
13747 +#include <linux/kernel.h>
13748 +#include <linux/sched.h>
13749 +#include <linux/signal.h>
13750 +#include <linux/init.h>
13751 +#include <linux/wait.h>
13752 +#include <linux/errno.h>
13753 +#include <linux/smp_lock.h>
13754 +#include <linux/net.h>
13755 +#include <net/sock.h>
13756 +
13757 +#include <linux/socket.h>
13758 +#include <linux/file.h>
13759 +
13760 +#include <linux/netdevice.h>
13761 +#include <linux/etherdevice.h>
13762 +#include <linux/skbuff.h>
13763 +
13764 +#include <asm/unaligned.h>
13765 +
13766 +#include <net/bluetooth/bluetooth.h>
13767 +#include <net/bluetooth/l2cap.h>
13768 +
13769 +#include "bnep.h"
13770 +
13771 +#ifndef CONFIG_BLUEZ_BNEP_DEBUG
13772 +#undef  BT_DBG
13773 +#define BT_DBG(D...)
13774 +#endif
13775 +
13776 +#define VERSION "1.1"
13777 +
13778 +static LIST_HEAD(bnep_session_list);
13779 +static DECLARE_RWSEM(bnep_session_sem);
13780 +
13781 +static struct bnep_session *__bnep_get_session(u8 *dst)
13782 +{
13783 +       struct bnep_session *s;
13784 +       struct list_head *p;
13785 +
13786 +       BT_DBG("");
13787 +
13788 +       list_for_each(p, &bnep_session_list) {
13789 +               s = list_entry(p, struct bnep_session, list);
13790 +               if (!memcmp(dst, s->eh.h_source, ETH_ALEN))
13791 +                       return s;
13792 +       }
13793 +       return NULL;
13794 +}
13795 +
13796 +static void __bnep_link_session(struct bnep_session *s)
13797 +{
13798 +       MOD_INC_USE_COUNT;
13799 +       list_add(&s->list, &bnep_session_list);
13800 +}
13801 +
13802 +static void __bnep_unlink_session(struct bnep_session *s)
13803 +{
13804 +       list_del(&s->list);
13805 +       MOD_DEC_USE_COUNT;
13806 +}
13807 +
13808 +static int bnep_send(struct bnep_session *s, void *data, size_t len)
13809 +{
13810 +       struct socket *sock = s->sock;
13811 +       struct iovec iv = { data, len };
13812 +       s->msg.msg_iov    = &iv;
13813 +       s->msg.msg_iovlen = 1;
13814 +       return sock->ops->sendmsg(sock, &s->msg, len, NULL);
13815 +}
13816 +
13817 +static int bnep_send_rsp(struct bnep_session *s, u8 ctrl, u16 resp)
13818 +{
13819 +       struct bnep_control_rsp rsp;
13820 +       rsp.type = BNEP_CONTROL;
13821 +       rsp.ctrl = ctrl;
13822 +       rsp.resp = htons(resp);
13823 +       return bnep_send(s, &rsp, sizeof(rsp));
13824 +}
13825 +
13826 +static int bnep_ctrl_set_netfilter(struct bnep_session *s, u16 *data, int len)
13827 +{
13828 +       int n;
13829 +
13830 +       if (len < 2)
13831 +               return -EILSEQ;
13832 +
13833 +       n = ntohs(get_unaligned(data));
13834 +       data++; len -= 2;
13835 +
13836 +       if (len < n)
13837 +               return -EILSEQ;
13838 +
13839 +       BT_DBG("filter len %d", n);
13840 +
13841 +#ifdef CONFIG_BLUEZ_BNEP_PROTO_FILTER
13842 +       n /= 4;
13843 +       if (n <= BNEP_MAX_PROTO_FILTERS) {
13844 +               struct bnep_proto_filter *f = s->proto_filter;
13845 +               int i;
13846 +
13847 +               for (i = 0; i < n; i++) {
13848 +                       f[i].start = get_unaligned(data++);
13849 +                       f[i].end   = get_unaligned(data++);
13850 +
13851 +                       BT_DBG("proto filter start %d end %d",
13852 +                               f[i].start, f[i].end);
13853 +               }
13854 +               if (i < BNEP_MAX_PROTO_FILTERS)
13855 +                       memset(f + i, 0, sizeof(*f));
13856 +
13857 +               bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_SUCCESS);
13858 +       } else {
13859 +               bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_FILTER_LIMIT_REACHED);
13860 +       }
13861 +#else
13862 +       bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_FILTER_UNSUPPORTED_REQ);
13863 +#endif
13864 +       return 0;
13865 +}
13866 +
13867 +static int bnep_ctrl_set_mcfilter(struct bnep_session *s, u8 *data, int len)
13868 +{
13869 +       int n;
13870 +
13871 +       if (len < 2)
13872 +               return -EILSEQ;
13873 +
13874 +       n = ntohs(get_unaligned((u16 *) data));
13875 +       data += 2; len -= 2;
13876 +
13877 +       if (len < n)
13878 +               return -EILSEQ;
13879 +
13880 +       BT_DBG("filter len %d", n);
13881 +
13882 +#ifdef CONFIG_BLUEZ_BNEP_MC_FILTER
13883 +       n /= (ETH_ALEN * 2);
13884 +
13885 +       if (n > 0) {
13886 +               s->mc_filter = 0;
13887 +
13888 +               /* Always send broadcast */
13889 +               set_bit(bnep_mc_hash(s->dev.broadcast), &s->mc_filter);
13890 +
13891 +               /* Add address ranges to the multicast hash */
13892 +               for (; n > 0; n--) {
13893 +                       u8 a1[6], *a2;
13894 +
13895 +                       memcpy(a1, data, ETH_ALEN); data += ETH_ALEN;
13896 +                       a2 = data; data += ETH_ALEN;
13897 +
13898 +                       BT_DBG("mc filter %s -> %s",
13899 +                               batostr((void *) a1), batostr((void *) a2));
13900 +
13901 +                       #define INCA(a) { int i = 5; while (i >=0 && ++a[i--] == 0); }
13902 +
13903 +                       /* Iterate from a1 to a2 */
13904 +                       set_bit(bnep_mc_hash(a1), &s->mc_filter);
13905 +                       while (memcmp(a1, a2, 6) < 0 && s->mc_filter != ~0LL) {
13906 +                               INCA(a1);
13907 +                               set_bit(bnep_mc_hash(a1), &s->mc_filter);
13908 +                       }
13909 +               }
13910 +       }
13911 +
13912 +       BT_DBG("mc filter hash 0x%llx", s->mc_filter);
13913 +
13914 +       bnep_send_rsp(s, BNEP_FILTER_MULTI_ADDR_RSP, BNEP_SUCCESS);
13915 +#else
13916 +       bnep_send_rsp(s, BNEP_FILTER_MULTI_ADDR_RSP, BNEP_FILTER_UNSUPPORTED_REQ);
13917 +#endif
13918 +       return 0;
13919 +}
13920 +
13921 +static int bnep_rx_control(struct bnep_session *s, void *data, int len)
13922 +{
13923 +       u8  cmd = *(u8 *)data;
13924 +       int err = 0;
13925 +
13926 +       data++; len--;
13927 +
13928 +       switch (cmd) {
13929 +       case BNEP_CMD_NOT_UNDERSTOOD:
13930 +       case BNEP_SETUP_CONN_REQ:
13931 +       case BNEP_SETUP_CONN_RSP:
13932 +       case BNEP_FILTER_NET_TYPE_RSP:
13933 +       case BNEP_FILTER_MULTI_ADDR_RSP:
13934 +               /* Ignore these for now */
13935 +               break;
13936 +
13937 +       case BNEP_FILTER_NET_TYPE_SET:
13938 +               err = bnep_ctrl_set_netfilter(s, data, len);
13939 +               break;
13940 +
13941 +       case BNEP_FILTER_MULTI_ADDR_SET:
13942 +               err = bnep_ctrl_set_mcfilter(s, data, len);
13943 +               break;
13944 +
13945 +       default: {
13946 +                       u8 pkt[3];
13947 +                       pkt[0] = BNEP_CONTROL;
13948 +                       pkt[1] = BNEP_CMD_NOT_UNDERSTOOD;
13949 +                       pkt[2] = cmd;
13950 +                       bnep_send(s, pkt, sizeof(pkt));
13951 +               }
13952 +               break;
13953 +       }
13954 +
13955 +       return err;
13956 +}
13957 +
13958 +static int bnep_rx_extension(struct bnep_session *s, struct sk_buff *skb)
13959 +{
13960 +       struct bnep_ext_hdr *h;
13961 +       int err = 0;
13962 +
13963 +       do {
13964 +               h = (void *) skb->data;
13965 +               if (!skb_pull(skb, sizeof(*h))) {
13966 +                       err = -EILSEQ;
13967 +                       break;
13968 +               }
13969 +
13970 +               BT_DBG("type 0x%x len %d", h->type, h->len);
13971 +
13972 +               switch (h->type & BNEP_TYPE_MASK) {
13973 +               case BNEP_EXT_CONTROL:
13974 +                       bnep_rx_control(s, skb->data, skb->len);
13975 +                       break;
13976 +
13977 +               default:
13978 +                       /* Unknown extension, skip it. */
13979 +                       break;
13980 +               }
13981 +
13982 +               if (!skb_pull(skb, h->len)) {
13983 +                       err = -EILSEQ;
13984 +                       break;
13985 +               }
13986 +       } while (!err && (h->type & BNEP_EXT_HEADER));
13987 +
13988 +       return err;
13989 +}
13990 +
13991 +static u8 __bnep_rx_hlen[] = {
13992 +       ETH_HLEN,     /* BNEP_GENERAL */
13993 +       0,            /* BNEP_CONTROL */
13994 +       2,            /* BNEP_COMPRESSED */
13995 +       ETH_ALEN + 2, /* BNEP_COMPRESSED_SRC_ONLY */
13996 +       ETH_ALEN + 2  /* BNEP_COMPRESSED_DST_ONLY */
13997 +};
13998 +#define BNEP_RX_TYPES  (sizeof(__bnep_rx_hlen) - 1)
13999 +
14000 +static inline int bnep_rx_frame(struct bnep_session *s, struct sk_buff *skb)
14001 +{
14002 +       struct net_device *dev = &s->dev;
14003 +       struct sk_buff *nskb;
14004 +       u8 type;
14005 +
14006 +       dev->last_rx = jiffies;
14007 +       s->stats.rx_bytes += skb->len;
14008 +
14009 +       type = *(u8 *) skb->data; skb_pull(skb, 1);
14010 +
14011 +       if ((type & BNEP_TYPE_MASK) > BNEP_RX_TYPES)
14012 +               goto badframe;
14013 +
14014 +       if ((type & BNEP_TYPE_MASK) == BNEP_CONTROL) {
14015 +               bnep_rx_control(s, skb->data, skb->len);
14016 +               kfree_skb(skb);
14017 +               return 0;
14018 +       }
14019 +
14020 +       skb->mac.raw = skb->data;
14021 +
14022 +       /* Verify and pull out header */
14023 +       if (!skb_pull(skb, __bnep_rx_hlen[type & BNEP_TYPE_MASK]))
14024 +               goto badframe;
14025 +
14026 +       s->eh.h_proto = get_unaligned((u16 *) (skb->data - 2));
14027 +
14028 +       if (type & BNEP_EXT_HEADER) {
14029 +               if (bnep_rx_extension(s, skb) < 0)
14030 +                       goto badframe;
14031 +       }
14032 +
14033 +       /* Strip 802.1p header */
14034 +       if (ntohs(s->eh.h_proto) == 0x8100) {
14035 +               if (!skb_pull(skb, 4))
14036 +                       goto badframe;
14037 +               s->eh.h_proto = get_unaligned((u16 *) (skb->data - 2));
14038 +       }
14039 +
14040 +       /* We have to alloc new skb and copy data here :(. Because original skb
14041 +        * may not be modified and because of the alignment requirements. */
14042 +       nskb = alloc_skb(2 + ETH_HLEN + skb->len, GFP_KERNEL);
14043 +       if (!nskb) {
14044 +               s->stats.rx_dropped++;
14045 +               kfree_skb(skb);
14046 +               return -ENOMEM;
14047 +       }
14048 +       skb_reserve(nskb, 2);
14049 +
14050 +       /* Decompress header and construct ether frame */
14051 +       switch (type & BNEP_TYPE_MASK) {
14052 +       case BNEP_COMPRESSED:
14053 +               memcpy(__skb_put(nskb, ETH_HLEN), &s->eh, ETH_HLEN);
14054 +               break;
14055 +
14056 +       case BNEP_COMPRESSED_SRC_ONLY:
14057 +               memcpy(__skb_put(nskb, ETH_ALEN), s->eh.h_dest, ETH_ALEN);
14058 +               memcpy(__skb_put(nskb, ETH_ALEN), skb->mac.raw, ETH_ALEN);
14059 +               put_unaligned(s->eh.h_proto, (u16 *) __skb_put(nskb, 2));
14060 +               break;
14061 +
14062 +       case BNEP_COMPRESSED_DST_ONLY:
14063 +               memcpy(__skb_put(nskb, ETH_ALEN), skb->mac.raw, ETH_ALEN);
14064 +               memcpy(__skb_put(nskb, ETH_ALEN + 2), s->eh.h_source, ETH_ALEN + 2);
14065 +               break;
14066 +
14067 +       case BNEP_GENERAL:
14068 +               memcpy(__skb_put(nskb, ETH_ALEN * 2), skb->mac.raw, ETH_ALEN * 2);
14069 +               put_unaligned(s->eh.h_proto, (u16 *) __skb_put(nskb, 2));
14070 +               break;
14071 +       }
14072 +
14073 +       memcpy(__skb_put(nskb, skb->len), skb->data, skb->len);
14074 +       kfree_skb(skb);
14075 +
14076 +       s->stats.rx_packets++;
14077 +       nskb->dev       = dev;
14078 +       nskb->ip_summed = CHECKSUM_UNNECESSARY;
14079 +       nskb->protocol  = eth_type_trans(nskb, dev);
14080 +       netif_rx_ni(nskb);
14081 +       return 0;
14082 +
14083 +badframe:
14084 +       s->stats.rx_errors++;
14085 +       kfree_skb(skb);
14086 +       return 0;
14087 +}
14088 +
14089 +static u8 __bnep_tx_types[] = {
14090 +       BNEP_GENERAL,
14091 +       BNEP_COMPRESSED_SRC_ONLY,
14092 +       BNEP_COMPRESSED_DST_ONLY,
14093 +       BNEP_COMPRESSED
14094 +};
14095 +
14096 +static inline int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb)
14097 +{
14098 +       struct ethhdr *eh = (void *) skb->data;
14099 +       struct socket *sock = s->sock;
14100 +       struct iovec iv[3];
14101 +       int len = 0, il = 0;
14102 +       u8 type = 0;
14103 +
14104 +       BT_DBG("skb %p dev %p type %d", skb, skb->dev, skb->pkt_type);
14105 +
14106 +       if (!skb->dev) {
14107 +               /* Control frame sent by us */
14108 +               goto send;
14109 +       }
14110 +
14111 +       iv[il++] = (struct iovec) { &type, 1 };
14112 +       len++;
14113 +
14114 +       if (!memcmp(eh->h_dest, s->eh.h_source, ETH_ALEN))
14115 +               type |= 0x01;
14116 +
14117 +       if (!memcmp(eh->h_source, s->eh.h_dest, ETH_ALEN))
14118 +               type |= 0x02;
14119 +
14120 +       if (type)
14121 +               skb_pull(skb, ETH_ALEN * 2);
14122 +
14123 +       type = __bnep_tx_types[type];
14124 +       switch (type) {
14125 +       case BNEP_COMPRESSED_SRC_ONLY:
14126 +               iv[il++] = (struct iovec) { eh->h_source, ETH_ALEN };
14127 +               len += ETH_ALEN;
14128 +               break;
14129 +
14130 +       case BNEP_COMPRESSED_DST_ONLY:
14131 +               iv[il++] = (struct iovec) { eh->h_dest, ETH_ALEN };
14132 +               len += ETH_ALEN;
14133 +               break;
14134 +       }
14135 +
14136 +send:
14137 +       iv[il++] = (struct iovec) { skb->data, skb->len };
14138 +       len += skb->len;
14139 +
14140 +       /* FIXME: linearize skb */
14141 +
14142 +       s->msg.msg_iov    = iv;
14143 +       s->msg.msg_iovlen = il;
14144 +       len = sock->ops->sendmsg(sock, &s->msg, len, NULL);
14145 +       kfree_skb(skb);
14146 +
14147 +       if (len > 0) {
14148 +               s->stats.tx_bytes += len;
14149 +               s->stats.tx_packets++;
14150 +               return 0;
14151 +       }
14152 +
14153 +       return len;
14154 +}
14155 +
14156 +static int bnep_session(void *arg)
14157 +{
14158 +       struct bnep_session *s = arg;
14159 +       struct net_device *dev = &s->dev;
14160 +       struct sock *sk = s->sock->sk;
14161 +       struct sk_buff *skb;
14162 +       wait_queue_t wait;
14163 +
14164 +       BT_DBG("");
14165 +
14166 +        daemonize(); reparent_to_init();
14167 +
14168 +        sprintf(current->comm, "kbnepd %s", dev->name);
14169 +
14170 +        sigfillset(&current->blocked);
14171 +       flush_signals(current);
14172 +
14173 +       current->nice = -15;
14174 +
14175 +        set_fs(KERNEL_DS);
14176 +
14177 +       init_waitqueue_entry(&wait, current);
14178 +       add_wait_queue(sk->sleep, &wait);
14179 +       while (!atomic_read(&s->killed)) {
14180 +               set_current_state(TASK_INTERRUPTIBLE);
14181 +
14182 +               // RX
14183 +               while ((skb = skb_dequeue(&sk->receive_queue))) {
14184 +                       skb_orphan(skb);
14185 +                       bnep_rx_frame(s, skb);
14186 +               }
14187 +
14188 +               if (sk->state != BT_CONNECTED)
14189 +                       break;
14190 +
14191 +               // TX
14192 +               while ((skb = skb_dequeue(&sk->write_queue)))
14193 +                       if (bnep_tx_frame(s, skb))
14194 +                               break;
14195 +               netif_wake_queue(dev);
14196 +
14197 +               schedule();
14198 +       }
14199 +       set_current_state(TASK_RUNNING);
14200 +       remove_wait_queue(sk->sleep, &wait);
14201 +
14202 +       /* Cleanup session */
14203 +       down_write(&bnep_session_sem);
14204 +
14205 +       /* Delete network device */
14206 +       unregister_netdev(dev);
14207 +
14208 +       /* Release the socket */
14209 +       fput(s->sock->file);
14210 +
14211 +       __bnep_unlink_session(s);
14212 +
14213 +       up_write(&bnep_session_sem);
14214 +       kfree(s);
14215 +       return 0;
14216 +}
14217 +
14218 +int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock)
14219 +{
14220 +       struct net_device *dev;
14221 +       struct bnep_session *s, *ss;
14222 +       u8 dst[ETH_ALEN], src[ETH_ALEN];
14223 +       int err;
14224 +
14225 +       BT_DBG("");
14226 +
14227 +       baswap((void *) dst, &bluez_pi(sock->sk)->dst);
14228 +       baswap((void *) src, &bluez_pi(sock->sk)->src);
14229 +
14230 +       s = kmalloc(sizeof(struct bnep_session), GFP_KERNEL);
14231 +       if (!s)
14232 +               return -ENOMEM;
14233 +       memset(s, 0, sizeof(struct bnep_session));
14234 +
14235 +       down_write(&bnep_session_sem);
14236 +
14237 +       ss = __bnep_get_session(dst);
14238 +       if (ss && ss->state == BT_CONNECTED) {
14239 +               err = -EEXIST;
14240 +               goto failed;
14241 +       }
14242 +
14243 +       dev = &s->dev;
14244 +
14245 +       if (*req->device)
14246 +               strcpy(dev->name, req->device);
14247 +       else
14248 +               strcpy(dev->name, "bnep%d");
14249 +
14250 +       memset(dev->broadcast, 0xff, ETH_ALEN);
14251 +
14252 +       /* This is rx header therefor addresses are swaped.
14253 +        * ie eh.h_dest is our local address. */
14254 +       memcpy(s->eh.h_dest,   &src, ETH_ALEN);
14255 +       memcpy(s->eh.h_source, &dst, ETH_ALEN);
14256 +
14257 +       s->sock  = sock;
14258 +       s->role  = req->role;
14259 +       s->state = BT_CONNECTED;
14260 +
14261 +       s->msg.msg_flags = MSG_NOSIGNAL;
14262 +
14263 +#ifdef CONFIG_BLUEZ_BNEP_MC_FILTER
14264 +       /* Set default mc filter */
14265 +       set_bit(bnep_mc_hash(dev->broadcast), &s->mc_filter);
14266 +#endif
14267 +
14268 +#ifdef CONFIG_BLUEZ_BNEP_PROTO_FILTER
14269 +       /* Set default protocol filter */
14270 +
14271 +       /* (IPv4, ARP)  */
14272 +       s->proto_filter[0].start = htons(0x0800);
14273 +       s->proto_filter[0].end   = htons(0x0806);
14274 +       /* (RARP, AppleTalk) */
14275 +       s->proto_filter[1].start = htons(0x8035);
14276 +       s->proto_filter[1].end   = htons(0x80F3);
14277 +       /* (IPX, IPv6) */
14278 +       s->proto_filter[2].start = htons(0x8137);
14279 +       s->proto_filter[2].end   = htons(0x86DD);
14280 +#endif
14281 +
14282 +       dev->init = bnep_net_init;
14283 +       dev->priv = s;
14284 +       err = register_netdev(dev);
14285 +       if (err) {
14286 +               goto failed;
14287 +       }
14288 +
14289 +       __bnep_link_session(s);
14290 +
14291 +       err = kernel_thread(bnep_session, s, CLONE_FS | CLONE_FILES | CLONE_SIGHAND);
14292 +       if (err < 0) {
14293 +               /* Session thread start failed, gotta cleanup. */
14294 +               unregister_netdev(dev);
14295 +               __bnep_unlink_session(s);
14296 +               goto failed;
14297 +       }
14298 +
14299 +       up_write(&bnep_session_sem);
14300 +       strcpy(req->device, dev->name);
14301 +       return 0;
14302 +
14303 +failed:
14304 +       up_write(&bnep_session_sem);
14305 +       kfree(s);
14306 +       return err;
14307 +}
14308 +
14309 +int bnep_del_connection(struct bnep_conndel_req *req)
14310 +{
14311 +       struct bnep_session *s;
14312 +       int  err = 0;
14313 +
14314 +       BT_DBG("");
14315 +
14316 +       down_read(&bnep_session_sem);
14317 +
14318 +       s = __bnep_get_session(req->dst);
14319 +       if (s) {
14320 +               /* Wakeup user-space which is polling for socket errors.
14321 +                * This is temporary hack untill we have shutdown in L2CAP */
14322 +               s->sock->sk->err = EUNATCH;
14323 +
14324 +               /* Kill session thread */
14325 +               atomic_inc(&s->killed);
14326 +               wake_up_interruptible(s->sock->sk->sleep);
14327 +       } else
14328 +               err = -ENOENT;
14329 +
14330 +       up_read(&bnep_session_sem);
14331 +       return err;
14332 +}
14333 +
14334 +static void __bnep_copy_ci(struct bnep_conninfo *ci, struct bnep_session *s)
14335 +{
14336 +       memcpy(ci->dst, s->eh.h_source, ETH_ALEN);
14337 +       strcpy(ci->device, s->dev.name);
14338 +       ci->flags = s->flags;
14339 +       ci->state = s->state;
14340 +       ci->role  = s->role;
14341 +}
14342 +
14343 +int bnep_get_connlist(struct bnep_connlist_req *req)
14344 +{
14345 +       struct list_head *p;
14346 +       int err = 0, n = 0;
14347 +
14348 +       down_read(&bnep_session_sem);
14349 +
14350 +       list_for_each(p, &bnep_session_list) {
14351 +               struct bnep_session *s;
14352 +               struct bnep_conninfo ci;
14353 +
14354 +               s = list_entry(p, struct bnep_session, list);
14355 +
14356 +               __bnep_copy_ci(&ci, s);
14357 +
14358 +               if (copy_to_user(req->ci, &ci, sizeof(ci))) {
14359 +                       err = -EFAULT;
14360 +                       break;
14361 +               }
14362 +
14363 +               if (++n >= req->cnum)
14364 +                       break;
14365 +
14366 +               req->ci++;
14367 +       }
14368 +       req->cnum = n;
14369 +
14370 +       up_read(&bnep_session_sem);
14371 +       return err;
14372 +}
14373 +
14374 +int bnep_get_conninfo(struct bnep_conninfo *ci)
14375 +{
14376 +       struct bnep_session *s;
14377 +       int err = 0;
14378 +
14379 +       down_read(&bnep_session_sem);
14380 +
14381 +       s = __bnep_get_session(ci->dst);
14382 +       if (s)
14383 +               __bnep_copy_ci(ci, s);
14384 +       else
14385 +               err = -ENOENT;
14386 +
14387 +       up_read(&bnep_session_sem);
14388 +       return err;
14389 +}
14390 +
14391 +static int __init bnep_init_module(void)
14392 +{
14393 +       l2cap_load();
14394 +
14395 +       bnep_crc32_init();
14396 +       bnep_sock_init();
14397 +
14398 +       BT_INFO("BlueZ BNEP ver %s", VERSION);
14399 +       BT_INFO("Copyright (C) 2001,2002 Inventel Systemes");
14400 +       BT_INFO("Written 2001,2002 by Clement Moreau <clement.moreau@inventel.fr>");
14401 +       BT_INFO("Written 2001,2002 by David Libault <david.libault@inventel.fr>");
14402 +       BT_INFO("Copyright (C) 2002 Maxim Krasnyanskiy <maxk@qualcomm.com>");
14403 +
14404 +       return 0;
14405 +}
14406 +
14407 +static void __exit bnep_cleanup_module(void)
14408 +{
14409 +       bnep_sock_cleanup();
14410 +       bnep_crc32_cleanup();
14411 +}
14412 +
14413 +module_init(bnep_init_module);
14414 +module_exit(bnep_cleanup_module);
14415 +
14416 +MODULE_DESCRIPTION("BlueZ BNEP ver " VERSION);
14417 +MODULE_AUTHOR("David Libault <david.libault@inventel.fr>, Maxim Krasnyanskiy <maxk@qualcomm.com>");
14418 +MODULE_LICENSE("GPL");
14419 diff -urN linux-2.4.18/net/bluetooth/bnep/crc32.c linux-2.4.18-mh9/net/bluetooth/bnep/crc32.c
14420 --- linux-2.4.18/net/bluetooth/bnep/crc32.c     Thu Jan  1 01:00:00 1970
14421 +++ linux-2.4.18-mh9/net/bluetooth/bnep/crc32.c Mon Aug 25 18:38:12 2003
14422 @@ -0,0 +1,59 @@
14423 +/*
14424 + * Based on linux-2.5/lib/crc32 by Matt Domsch <Matt_Domsch@dell.com>
14425 + *
14426 + * FIXME: Remove in 2.5
14427 + */
14428 +
14429 +#include <linux/kernel.h>
14430 +#include <linux/module.h>
14431 +#include <linux/types.h>
14432 +#include <linux/slab.h>
14433 +#include <linux/init.h>
14434 +#include <asm/atomic.h>
14435 +
14436 +#include "crc32.h"
14437 +
14438 +#define CRCPOLY_BE 0x04c11db7
14439 +#define CRC_BE_BITS 8
14440 +
14441 +static u32 *bnep_crc32_table;
14442 +
14443 +/*
14444 + * This code is in the public domain; copyright abandoned.
14445 + * Liability for non-performance of this code is limited to the amount
14446 + * you paid for it.  Since it is distributed for free, your refund will
14447 + * be very very small.  If it breaks, you get to keep both pieces.
14448 + */
14449 +u32 bnep_crc32(u32 crc, unsigned char const *p, size_t len)
14450 +{
14451 +       while (len--)
14452 +               crc = (crc << 8) ^ bnep_crc32_table[(crc >> 24) ^ *p++];
14453 +
14454 +       return crc;
14455 +}
14456 +
14457 +int __init bnep_crc32_init(void)
14458 +{
14459 +       unsigned i, j;
14460 +       u32 crc = 0x80000000;
14461 +
14462 +       bnep_crc32_table = kmalloc((1 << CRC_BE_BITS) * sizeof(u32), GFP_KERNEL);
14463 +       if (!bnep_crc32_table)
14464 +               return -ENOMEM;
14465 +
14466 +       bnep_crc32_table[0] = 0;
14467 +
14468 +       for (i = 1; i < 1 << CRC_BE_BITS; i <<= 1) {
14469 +               crc = (crc << 1) ^ ((crc & 0x80000000) ? CRCPOLY_BE : 0);
14470 +               for (j = 0; j < i; j++)
14471 +                       bnep_crc32_table[i + j] = crc ^ bnep_crc32_table[j];
14472 +       }
14473 +       return 0;
14474 +}
14475 +
14476 +void __exit bnep_crc32_cleanup(void)
14477 +{
14478 +       if (bnep_crc32_table)
14479 +               kfree(bnep_crc32_table);
14480 +       bnep_crc32_table = NULL;
14481 +}
14482 diff -urN linux-2.4.18/net/bluetooth/bnep/crc32.h linux-2.4.18-mh9/net/bluetooth/bnep/crc32.h
14483 --- linux-2.4.18/net/bluetooth/bnep/crc32.h     Thu Jan  1 01:00:00 1970
14484 +++ linux-2.4.18-mh9/net/bluetooth/bnep/crc32.h Mon Aug 25 18:38:12 2003
14485 @@ -0,0 +1,10 @@
14486 +/*
14487 + * crc32.h
14488 + * See crc32.c for license and changes
14489 + *
14490 + * FIXME: Remove in 2.5
14491 + */
14492 +
14493 +int  bnep_crc32_init(void);
14494 +void bnep_crc32_cleanup(void);
14495 +u32  bnep_crc32(u32 crc, unsigned char const *p, size_t len);
14496 diff -urN linux-2.4.18/net/bluetooth/bnep/netdev.c linux-2.4.18-mh9/net/bluetooth/bnep/netdev.c
14497 --- linux-2.4.18/net/bluetooth/bnep/netdev.c    Thu Jan  1 01:00:00 1970
14498 +++ linux-2.4.18-mh9/net/bluetooth/bnep/netdev.c        Mon Aug 25 18:38:12 2003
14499 @@ -0,0 +1,254 @@
14500 +/*
14501 +   BNEP implementation for Linux Bluetooth stack (BlueZ).
14502 +   Copyright (C) 2001-2002 Inventel Systemes
14503 +   Written 2001-2002 by
14504 +       Clément Moreau <clement.moreau@inventel.fr>
14505 +       David Libault  <david.libault@inventel.fr>
14506 +
14507 +   Copyright (C) 2002 Maxim Krasnyanskiy <maxk@qualcomm.com>
14508 +
14509 +   This program is free software; you can redistribute it and/or modify
14510 +   it under the terms of the GNU General Public License version 2 as
14511 +   published by the Free Software Foundation;
14512 +
14513 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
14514 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14515 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14516 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14517 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14518 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14519 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14520 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14521 +
14522 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
14523 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
14524 +   SOFTWARE IS DISCLAIMED.
14525 +*/
14526 +
14527 +/*
14528 + * $Id: netdev.c,v 1.7 2002/07/14 05:39:26 maxk Exp $
14529 + */
14530 +
14531 +#include <linux/config.h>
14532 +#include <linux/module.h>
14533 +
14534 +#include <linux/socket.h>
14535 +#include <linux/netdevice.h>
14536 +#include <linux/etherdevice.h>
14537 +#include <linux/skbuff.h>
14538 +#include <linux/wait.h>
14539 +
14540 +#include <asm/unaligned.h>
14541 +
14542 +#include <net/bluetooth/bluetooth.h>
14543 +#include <net/bluetooth/hci_core.h>
14544 +#include <net/bluetooth/l2cap.h>
14545 +
14546 +#include "bnep.h"
14547 +
14548 +#ifndef CONFIG_BLUEZ_BNEP_DEBUG
14549 +#undef  BT_DBG
14550 +#define BT_DBG( A... )
14551 +#endif
14552 +
14553 +#define BNEP_TX_QUEUE_LEN 20
14554 +
14555 +static int bnep_net_open(struct net_device *dev)
14556 +{
14557 +       netif_start_queue(dev);
14558 +       return 0;
14559 +}
14560 +
14561 +static int bnep_net_close(struct net_device *dev)
14562 +{
14563 +       netif_stop_queue(dev);
14564 +       return 0;
14565 +}
14566 +
14567 +static struct net_device_stats *bnep_net_get_stats(struct net_device *dev)
14568 +{
14569 +       struct bnep_session *s = dev->priv;
14570 +       return &s->stats;
14571 +}
14572 +
14573 +static void bnep_net_set_mc_list(struct net_device *dev)
14574 +{
14575 +#ifdef CONFIG_BLUEZ_BNEP_MC_FILTER
14576 +       struct bnep_session *s = dev->priv;
14577 +       struct sock *sk = s->sock->sk;
14578 +       struct bnep_set_filter_req *r;
14579 +       struct sk_buff *skb;
14580 +       int size;
14581 +
14582 +       BT_DBG("%s mc_count %d", dev->name, dev->mc_count);
14583 +
14584 +       size = sizeof(*r) + (BNEP_MAX_MULTICAST_FILTERS + 1) * ETH_ALEN * 2;
14585 +       skb  = alloc_skb(size, GFP_ATOMIC);
14586 +       if (!skb) {
14587 +               BT_ERR("%s Multicast list allocation failed", dev->name);
14588 +               return;
14589 +       }
14590 +
14591 +       r = (void *) skb->data;
14592 +       __skb_put(skb, sizeof(*r));
14593 +
14594 +       r->type = BNEP_CONTROL;
14595 +       r->ctrl = BNEP_FILTER_MULTI_ADDR_SET;
14596 +
14597 +        if (dev->flags & (IFF_PROMISC | IFF_ALLMULTI)) {
14598 +               u8 start[ETH_ALEN] = { 0x01 };
14599 +
14600 +               /* Request all addresses */
14601 +               memcpy(__skb_put(skb, ETH_ALEN), start, ETH_ALEN);
14602 +               memcpy(__skb_put(skb, ETH_ALEN), dev->broadcast, ETH_ALEN);
14603 +               r->len = htons(ETH_ALEN * 2);
14604 +       } else {
14605 +                struct dev_mc_list *dmi = dev->mc_list;
14606 +               int i, len = skb->len;
14607 +
14608 +               if (dev->flags & IFF_BROADCAST) {
14609 +                       memcpy(__skb_put(skb, ETH_ALEN), dev->broadcast, ETH_ALEN);
14610 +                       memcpy(__skb_put(skb, ETH_ALEN), dev->broadcast, ETH_ALEN);
14611 +               }
14612 +
14613 +               /* FIXME: We should group addresses here. */
14614 +
14615 +               for (i = 0; i < dev->mc_count && i < BNEP_MAX_MULTICAST_FILTERS; i++) {
14616 +                       memcpy(__skb_put(skb, ETH_ALEN), dmi->dmi_addr, ETH_ALEN);
14617 +                       memcpy(__skb_put(skb, ETH_ALEN), dmi->dmi_addr, ETH_ALEN);
14618 +                       dmi = dmi->next;
14619 +               }
14620 +               r->len = htons(skb->len - len);
14621 +       }
14622 +
14623 +       skb_queue_tail(&sk->write_queue, skb);
14624 +       wake_up_interruptible(sk->sleep);
14625 +#endif
14626 +}
14627 +
14628 +static int bnep_net_set_mac_addr(struct net_device *dev, void *arg)
14629 +{
14630 +       BT_DBG("%s", dev->name);
14631 +       return 0;
14632 +}
14633 +
14634 +static void bnep_net_timeout(struct net_device *dev)
14635 +{
14636 +       BT_DBG("net_timeout");
14637 +       netif_wake_queue(dev);
14638 +}
14639 +
14640 +static int bnep_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
14641 +{
14642 +       return -EINVAL;
14643 +}
14644 +
14645 +#ifdef CONFIG_BLUEZ_BNEP_MC_FILTER
14646 +static inline int bnep_net_mc_filter(struct sk_buff *skb, struct bnep_session *s)
14647 +{
14648 +       struct ethhdr *eh = (void *) skb->data;
14649 +
14650 +       if ((eh->h_dest[0] & 1) && !test_bit(bnep_mc_hash(eh->h_dest), &s->mc_filter)) {
14651 +               BT_DBG("BNEP: filtered skb %p, dst %.2x:%.2x:%.2x:%.2x:%.2x:%.2x", skb,
14652 +                               eh->h_dest[0], eh->h_dest[1], eh->h_dest[2],
14653 +                               eh->h_dest[3], eh->h_dest[4], eh->h_dest[5]);
14654 +               return 1;
14655 +       }
14656 +       return 0;
14657 +}
14658 +#endif
14659 +
14660 +#ifdef CONFIG_BLUEZ_BNEP_PROTO_FILTER
14661 +/* Determine ether protocol. Based on eth_type_trans. */
14662 +static inline u16 bnep_net_eth_proto(struct sk_buff *skb)
14663 +{
14664 +       struct ethhdr *eh = (void *) skb->data;
14665 +
14666 +       if (ntohs(eh->h_proto) >= 1536)
14667 +               return eh->h_proto;
14668 +
14669 +       if (get_unaligned((u16 *) skb->data) == 0xFFFF)
14670 +               return htons(ETH_P_802_3);
14671 +
14672 +       return htons(ETH_P_802_2);
14673 +}
14674 +
14675 +static inline int bnep_net_proto_filter(struct sk_buff *skb, struct bnep_session *s)
14676 +{
14677 +       u16 proto = bnep_net_eth_proto(skb);
14678 +       struct bnep_proto_filter *f = s->proto_filter;
14679 +       int i;
14680 +
14681 +       for (i = 0; i < BNEP_MAX_PROTO_FILTERS && f[i].end; i++) {
14682 +               if (proto >= f[i].start && proto <= f[i].end)
14683 +                       return 0;
14684 +       }
14685 +
14686 +       BT_DBG("BNEP: filtered skb %p, proto 0x%.4x", skb, proto);
14687 +       return 1;
14688 +}
14689 +#endif
14690 +
14691 +static int bnep_net_xmit(struct sk_buff *skb, struct net_device *dev)
14692 +{
14693 +       struct bnep_session *s = dev->priv;
14694 +       struct sock *sk = s->sock->sk;
14695 +
14696 +       BT_DBG("skb %p, dev %p", skb, dev);
14697 +
14698 +#ifdef CONFIG_BLUEZ_BNEP_MC_FILTER
14699 +       if (bnep_net_mc_filter(skb, s)) {
14700 +               kfree_skb(skb);
14701 +               return 0;
14702 +       }
14703 +#endif
14704 +
14705 +#ifdef CONFIG_BLUEZ_BNEP_PROTO_FILTER
14706 +       if (bnep_net_proto_filter(skb, s)) {
14707 +               kfree_skb(skb);
14708 +               return 0;
14709 +       }
14710 +#endif
14711 +
14712 +       /*
14713 +        * We cannot send L2CAP packets from here as we are potentially in a bh.
14714 +        * So we have to queue them and wake up session thread which is sleeping
14715 +        * on the sk->sleep.
14716 +        */
14717 +       dev->trans_start = jiffies;
14718 +       skb_queue_tail(&sk->write_queue, skb);
14719 +       wake_up_interruptible(sk->sleep);
14720 +
14721 +       if (skb_queue_len(&sk->write_queue) >= BNEP_TX_QUEUE_LEN) {
14722 +               BT_DBG("tx queue is full");
14723 +
14724 +               /* Stop queuing.
14725 +                * Session thread will do netif_wake_queue() */
14726 +               netif_stop_queue(dev);
14727 +       }
14728 +
14729 +       return 0;
14730 +}
14731 +
14732 +int bnep_net_init(struct net_device *dev)
14733 +{
14734 +       struct bnep_session *s = dev->priv;
14735 +
14736 +       memcpy(dev->dev_addr, s->eh.h_dest, ETH_ALEN);
14737 +       dev->addr_len = ETH_ALEN;
14738 +
14739 +       ether_setup(dev);
14740 +
14741 +       dev->open            = bnep_net_open;
14742 +       dev->stop            = bnep_net_close;
14743 +       dev->hard_start_xmit = bnep_net_xmit;
14744 +       dev->get_stats       = bnep_net_get_stats;
14745 +       dev->do_ioctl        = bnep_net_ioctl;
14746 +       dev->set_mac_address = bnep_net_set_mac_addr;
14747 +       dev->set_multicast_list = bnep_net_set_mc_list;
14748 +
14749 +       dev->watchdog_timeo  = HZ * 2;
14750 +       dev->tx_timeout      = bnep_net_timeout;
14751 +
14752 +       return 0;
14753 +}
14754 diff -urN linux-2.4.18/net/bluetooth/bnep/sock.c linux-2.4.18-mh9/net/bluetooth/bnep/sock.c
14755 --- linux-2.4.18/net/bluetooth/bnep/sock.c      Thu Jan  1 01:00:00 1970
14756 +++ linux-2.4.18-mh9/net/bluetooth/bnep/sock.c  Mon Aug 25 18:38:12 2003
14757 @@ -0,0 +1,238 @@
14758 +/*
14759 +   BNEP implementation for Linux Bluetooth stack (BlueZ).
14760 +   Copyright (C) 2001-2002 Inventel Systemes
14761 +   Written 2001-2002 by
14762 +       David Libault  <david.libault@inventel.fr>
14763 +
14764 +   Copyright (C) 2002 Maxim Krasnyanskiy <maxk@qualcomm.com>
14765 +
14766 +   This program is free software; you can redistribute it and/or modify
14767 +   it under the terms of the GNU General Public License version 2 as
14768 +   published by the Free Software Foundation;
14769 +
14770 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
14771 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14772 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14773 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14774 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
14775 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14776 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14777 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
14778 +
14779 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
14780 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
14781 +   SOFTWARE IS DISCLAIMED.
14782 +*/
14783 +
14784 +/*
14785 + * $Id: sock.c,v 1.3 2002/07/10 22:59:52 maxk Exp $
14786 + */
14787 +
14788 +#include <linux/config.h>
14789 +#include <linux/module.h>
14790 +
14791 +#include <linux/types.h>
14792 +#include <linux/errno.h>
14793 +#include <linux/kernel.h>
14794 +#include <linux/major.h>
14795 +#include <linux/sched.h>
14796 +#include <linux/slab.h>
14797 +#include <linux/poll.h>
14798 +#include <linux/fcntl.h>
14799 +#include <linux/skbuff.h>
14800 +#include <linux/socket.h>
14801 +#include <linux/ioctl.h>
14802 +#include <linux/file.h>
14803 +#include <net/sock.h>
14804 +
14805 +#include <asm/system.h>
14806 +#include <asm/uaccess.h>
14807 +
14808 +#include "bnep.h"
14809 +
14810 +#ifndef CONFIG_BLUEZ_BNEP_DEBUG
14811 +#undef  BT_DBG
14812 +#define BT_DBG( A... )
14813 +#endif
14814 +
14815 +static inline struct socket *socki_lookup(struct inode *inode)
14816 +{
14817 +       return &inode->u.socket_i;
14818 +}
14819 +
14820 +static struct socket *sockfd_lookup(int fd, int *err)
14821 +{
14822 +       struct file *file;
14823 +       struct inode *inode;
14824 +       struct socket *sock;
14825 +
14826 +       if (!(file = fget(fd))) {
14827 +               *err = -EBADF;
14828 +               return NULL;
14829 +       }
14830 +
14831 +       inode = file->f_dentry->d_inode;
14832 +       if (!inode->i_sock || !(sock = socki_lookup(inode))) {
14833 +               *err = -ENOTSOCK;
14834 +               fput(file);
14835 +               return NULL;
14836 +       }
14837 +
14838 +       if (sock->file != file) {
14839 +               printk(KERN_ERR "socki_lookup: socket file changed!\n");
14840 +               sock->file = file;
14841 +       }
14842 +       return sock;
14843 +}
14844 +
14845 +static int bnep_sock_release(struct socket *sock)
14846 +{
14847 +       struct sock *sk = sock->sk;
14848 +
14849 +       BT_DBG("sock %p sk %p", sock, sk);
14850 +
14851 +       if (!sk)
14852 +               return 0;
14853 +
14854 +       sock_orphan(sk);
14855 +       sock_put(sk);
14856 +
14857 +       MOD_DEC_USE_COUNT;
14858 +       return 0;
14859 +}
14860 +
14861 +static int bnep_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
14862 +{
14863 +       struct bnep_connlist_req cl;
14864 +       struct bnep_connadd_req  ca;
14865 +       struct bnep_conndel_req  cd;
14866 +       struct bnep_conninfo ci;
14867 +       struct socket *nsock;
14868 +       int err;
14869 +
14870 +       BT_DBG("cmd %x arg %lx", cmd, arg);
14871 +
14872 +       switch (cmd) {
14873 +       case BNEPCONNADD:
14874 +               if (!capable(CAP_NET_ADMIN))
14875 +                       return -EACCES;
14876 +
14877 +               if (copy_from_user(&ca, (void *) arg, sizeof(ca)))
14878 +                       return -EFAULT;
14879 +
14880 +               nsock = sockfd_lookup(ca.sock, &err);
14881 +               if (!nsock)
14882 +                       return err;
14883 +
14884 +               if (nsock->sk->state != BT_CONNECTED)
14885 +                       return -EBADFD;
14886 +
14887 +               err = bnep_add_connection(&ca, nsock);
14888 +               if (!err) {
14889 +                       if (copy_to_user((void *) arg, &ca, sizeof(ca)))
14890 +                               err = -EFAULT;
14891 +               } else
14892 +                       fput(nsock->file);
14893 +
14894 +               return err;
14895 +
14896 +       case BNEPCONNDEL:
14897 +               if (!capable(CAP_NET_ADMIN))
14898 +                       return -EACCES;
14899 +
14900 +               if (copy_from_user(&cd, (void *) arg, sizeof(cd)))
14901 +                       return -EFAULT;
14902 +
14903 +               return bnep_del_connection(&cd);
14904 +
14905 +       case BNEPGETCONNLIST:
14906 +               if (copy_from_user(&cl, (void *) arg, sizeof(cl)))
14907 +                       return -EFAULT;
14908 +
14909 +               if (cl.cnum <= 0)
14910 +                       return -EINVAL;
14911 +
14912 +               err = bnep_get_connlist(&cl);
14913 +               if (!err && copy_to_user((void *) arg, &cl, sizeof(cl)))
14914 +                       return -EFAULT;
14915 +
14916 +               return err;
14917 +
14918 +       case BNEPGETCONNINFO:
14919 +               if (copy_from_user(&ci, (void *) arg, sizeof(ci)))
14920 +                       return -EFAULT;
14921 +
14922 +               err = bnep_get_conninfo(&ci);
14923 +               if (!err && copy_to_user((void *) arg, &ci, sizeof(ci)))
14924 +                       return -EFAULT;
14925 +
14926 +               return err;
14927 +
14928 +       default:
14929 +               return -EINVAL;
14930 +       }
14931 +
14932 +       return 0;
14933 +}
14934 +
14935 +static struct proto_ops bnep_sock_ops = {
14936 +       family:     PF_BLUETOOTH,
14937 +       release:    bnep_sock_release,
14938 +       ioctl:      bnep_sock_ioctl,
14939 +       bind:       sock_no_bind,
14940 +       getname:    sock_no_getname,
14941 +       sendmsg:    sock_no_sendmsg,
14942 +       recvmsg:    sock_no_recvmsg,
14943 +       poll:       sock_no_poll,
14944 +       listen:     sock_no_listen,
14945 +       shutdown:   sock_no_shutdown,
14946 +       setsockopt: sock_no_setsockopt,
14947 +       getsockopt: sock_no_getsockopt,
14948 +       connect:    sock_no_connect,
14949 +       socketpair: sock_no_socketpair,
14950 +       accept:     sock_no_accept,
14951 +       mmap:       sock_no_mmap
14952 +};
14953 +
14954 +static int bnep_sock_create(struct socket *sock, int protocol)
14955 +{
14956 +       struct sock *sk;
14957 +
14958 +       BT_DBG("sock %p", sock);
14959 +
14960 +       if (sock->type != SOCK_RAW)
14961 +               return -ESOCKTNOSUPPORT;
14962 +
14963 +       sock->ops = &bnep_sock_ops;
14964 +
14965 +       if (!(sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, 1)))
14966 +               return -ENOMEM;
14967 +
14968 +       MOD_INC_USE_COUNT;
14969 +
14970 +       sock->state = SS_UNCONNECTED;
14971 +       sock_init_data(sock, sk);
14972 +
14973 +       sk->destruct = NULL;
14974 +       sk->protocol = protocol;
14975 +
14976 +       return 0;
14977 +}
14978 +
14979 +static struct net_proto_family bnep_sock_family_ops = {
14980 +       family: PF_BLUETOOTH,
14981 +       create: bnep_sock_create
14982 +};
14983 +
14984 +int bnep_sock_init(void)
14985 +{
14986 +       bluez_sock_register(BTPROTO_BNEP, &bnep_sock_family_ops);
14987 +       return 0;
14988 +}
14989 +
14990 +int bnep_sock_cleanup(void)
14991 +{
14992 +       if (bluez_sock_unregister(BTPROTO_BNEP))
14993 +               BT_ERR("Can't unregister BNEP socket");
14994 +       return 0;
14995 +}
14996 diff -urN linux-2.4.18/net/bluetooth/cmtp/Config.in linux-2.4.18-mh9/net/bluetooth/cmtp/Config.in
14997 --- linux-2.4.18/net/bluetooth/cmtp/Config.in   Thu Jan  1 01:00:00 1970
14998 +++ linux-2.4.18-mh9/net/bluetooth/cmtp/Config.in       Mon Aug 25 18:38:12 2003
14999 @@ -0,0 +1,7 @@
15000 +#
15001 +# Bluetooth CMTP layer configuration
15002 +#
15003 +
15004 +if [ "$CONFIG_ISDN" = "y" -o "$CONFIG_ISDN" = "m" ]; then
15005 +   dep_tristate 'CMTP protocol support' CONFIG_BLUEZ_CMTP $CONFIG_ISDN_CAPI $CONFIG_BLUEZ_L2CAP
15006 +fi
15007 diff -urN linux-2.4.18/net/bluetooth/cmtp/Makefile linux-2.4.18-mh9/net/bluetooth/cmtp/Makefile
15008 --- linux-2.4.18/net/bluetooth/cmtp/Makefile    Thu Jan  1 01:00:00 1970
15009 +++ linux-2.4.18-mh9/net/bluetooth/cmtp/Makefile        Mon Aug 25 18:38:12 2003
15010 @@ -0,0 +1,10 @@
15011 +#
15012 +# Makefile for the Linux Bluetooth CMTP layer
15013 +#
15014 +
15015 +O_TARGET := cmtp.o
15016 +
15017 +obj-y  := core.o sock.o capi.o
15018 +obj-m  += $(O_TARGET)
15019 +
15020 +include $(TOPDIR)/Rules.make
15021 diff -urN linux-2.4.18/net/bluetooth/cmtp/capi.c linux-2.4.18-mh9/net/bluetooth/cmtp/capi.c
15022 --- linux-2.4.18/net/bluetooth/cmtp/capi.c      Thu Jan  1 01:00:00 1970
15023 +++ linux-2.4.18-mh9/net/bluetooth/cmtp/capi.c  Mon Aug 25 18:38:12 2003
15024 @@ -0,0 +1,707 @@
15025 +/*
15026 +   CMTP implementation for Linux Bluetooth stack (BlueZ).
15027 +   Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>
15028 +
15029 +   This program is free software; you can redistribute it and/or modify
15030 +   it under the terms of the GNU General Public License version 2 as
15031 +   published by the Free Software Foundation;
15032 +
15033 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15034 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15035 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15036 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15037 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15038 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15039 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15040 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15041 +
15042 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
15043 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
15044 +   SOFTWARE IS DISCLAIMED.
15045 +*/
15046 +
15047 +#include <linux/config.h>
15048 +#include <linux/module.h>
15049 +
15050 +#include <linux/types.h>
15051 +#include <linux/errno.h>
15052 +#include <linux/kernel.h>
15053 +#include <linux/major.h>
15054 +#include <linux/sched.h>
15055 +#include <linux/slab.h>
15056 +#include <linux/poll.h>
15057 +#include <linux/fcntl.h>
15058 +#include <linux/skbuff.h>
15059 +#include <linux/socket.h>
15060 +#include <linux/ioctl.h>
15061 +#include <linux/file.h>
15062 +#include <net/sock.h>
15063 +
15064 +#include <linux/capi.h>
15065 +
15066 +#include "../drivers/isdn/avmb1/capilli.h"
15067 +#include "../drivers/isdn/avmb1/capicmd.h"
15068 +#include "../drivers/isdn/avmb1/capiutil.h"
15069 +
15070 +#include "cmtp.h"
15071 +
15072 +#ifndef CONFIG_BLUEZ_CMTP_DEBUG
15073 +#undef  BT_DBG
15074 +#define BT_DBG(D...)
15075 +#endif
15076 +
15077 +#define REVISION "1.0"
15078 +
15079 +#define CAPI_INTEROPERABILITY          0x20
15080 +
15081 +#define CAPI_INTEROPERABILITY_REQ      CAPICMD(CAPI_INTEROPERABILITY, CAPI_REQ)
15082 +#define CAPI_INTEROPERABILITY_CONF     CAPICMD(CAPI_INTEROPERABILITY, CAPI_CONF)
15083 +#define CAPI_INTEROPERABILITY_IND      CAPICMD(CAPI_INTEROPERABILITY, CAPI_IND)
15084 +#define CAPI_INTEROPERABILITY_RESP     CAPICMD(CAPI_INTEROPERABILITY, CAPI_RESP)
15085 +
15086 +#define CAPI_INTEROPERABILITY_REQ_LEN  (CAPI_MSG_BASELEN + 2)
15087 +#define CAPI_INTEROPERABILITY_CONF_LEN (CAPI_MSG_BASELEN + 4)
15088 +#define CAPI_INTEROPERABILITY_IND_LEN  (CAPI_MSG_BASELEN + 2)
15089 +#define CAPI_INTEROPERABILITY_RESP_LEN (CAPI_MSG_BASELEN + 2)
15090 +
15091 +#define CAPI_FUNCTION_REGISTER         0
15092 +#define CAPI_FUNCTION_RELEASE          1
15093 +#define CAPI_FUNCTION_GET_PROFILE      2
15094 +#define CAPI_FUNCTION_GET_MANUFACTURER 3
15095 +#define CAPI_FUNCTION_GET_VERSION      4
15096 +#define CAPI_FUNCTION_GET_SERIAL_NUMBER        5
15097 +#define CAPI_FUNCTION_MANUFACTURER     6
15098 +#define CAPI_FUNCTION_LOOPBACK         7
15099 +
15100 +static struct capi_driver_interface *di;
15101 +
15102 +
15103 +#define CMTP_MSGNUM    1
15104 +#define CMTP_APPLID    2
15105 +#define CMTP_MAPPING   3
15106 +
15107 +static struct cmtp_application *cmtp_application_add(struct cmtp_session *session, __u16 appl)
15108 +{
15109 +       struct cmtp_application *app = kmalloc(sizeof(*app), GFP_KERNEL);
15110 +
15111 +       BT_DBG("session %p application %p appl %d", session, app, appl);
15112 +
15113 +       if (!app)
15114 +               return NULL;
15115 +
15116 +       memset(app, 0, sizeof(*app));
15117 +
15118 +       app->state = BT_OPEN;
15119 +       app->appl = appl;
15120 +
15121 +       list_add_tail(&app->list, &session->applications);
15122 +
15123 +       return app;
15124 +}
15125 +
15126 +static void cmtp_application_del(struct cmtp_session *session, struct cmtp_application *app)
15127 +{
15128 +       BT_DBG("session %p application %p", session, app);
15129 +
15130 +       if (app) {
15131 +               list_del(&app->list);
15132 +               kfree(app);
15133 +       }
15134 +}
15135 +
15136 +static struct cmtp_application *cmtp_application_get(struct cmtp_session *session, int pattern, __u16 value)
15137 +{
15138 +       struct cmtp_application *app;
15139 +       struct list_head *p, *n;
15140 +
15141 +       list_for_each_safe(p, n, &session->applications) {
15142 +               app = list_entry(p, struct cmtp_application, list);
15143 +               switch (pattern) {
15144 +               case CMTP_MSGNUM:
15145 +                       if (app->msgnum == value)
15146 +                               return app;
15147 +                       break;
15148 +               case CMTP_APPLID:
15149 +                       if (app->appl == value)
15150 +                               return app;
15151 +                       break;
15152 +               case CMTP_MAPPING:
15153 +                       if (app->mapping == value)
15154 +                               return app;
15155 +                       break;
15156 +               }
15157 +       }
15158 +
15159 +       return NULL;
15160 +}
15161 +
15162 +static int cmtp_msgnum_get(struct cmtp_session *session)
15163 +{
15164 +       session->msgnum++;
15165 +
15166 +       if ((session->msgnum & 0xff) > 200)
15167 +               session->msgnum = CMTP_INITIAL_MSGNUM + 1;
15168 +
15169 +       return session->msgnum;
15170 +}
15171 +
15172 +
15173 +static void cmtp_send_interopmsg(struct cmtp_session *session,
15174 +                                       __u8 subcmd, __u16 appl, __u16 msgnum,
15175 +                                       __u16 function, unsigned char *buf, int len)
15176 +{
15177 +       struct sk_buff *skb;
15178 +       unsigned char *s;
15179 +
15180 +       BT_DBG("session %p subcmd 0x%02x appl %d msgnum %d", session, subcmd, appl, msgnum);
15181 +
15182 +       if (!(skb = alloc_skb(CAPI_MSG_BASELEN + 6 + len, GFP_ATOMIC))) {
15183 +               BT_ERR("Can't allocate memory for interoperability packet");
15184 +               return;
15185 +       }
15186 +
15187 +       s = skb_put(skb, CAPI_MSG_BASELEN + 6 + len);
15188 +
15189 +       capimsg_setu16(s, 0, CAPI_MSG_BASELEN + 6 + len);
15190 +       capimsg_setu16(s, 2, appl);
15191 +       capimsg_setu8 (s, 4, CAPI_INTEROPERABILITY);
15192 +       capimsg_setu8 (s, 5, subcmd);
15193 +       capimsg_setu16(s, 6, msgnum);
15194 +
15195 +       /* Interoperability selector (Bluetooth Device Management) */
15196 +       capimsg_setu16(s, 8, 0x0001);
15197 +
15198 +       capimsg_setu8 (s, 10, 3 + len);
15199 +       capimsg_setu16(s, 11, function);
15200 +       capimsg_setu8 (s, 13, len);
15201 +
15202 +       if (len > 0)
15203 +               memcpy(s + 14, buf, len);
15204 +
15205 +       cmtp_send_capimsg(session, skb);
15206 +}
15207 +
15208 +static void cmtp_recv_interopmsg(struct cmtp_session *session, struct sk_buff *skb)
15209 +{
15210 +       struct capi_ctr *ctrl = session->ctrl;
15211 +       struct cmtp_application *application;
15212 +       __u16 appl, msgnum, func, info;
15213 +       __u32 controller;
15214 +
15215 +       BT_DBG("session %p skb %p len %d", session, skb, skb->len);
15216 +
15217 +       switch (CAPIMSG_SUBCOMMAND(skb->data)) {
15218 +       case CAPI_CONF:
15219 +               func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 5);
15220 +               info = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 8);
15221 +
15222 +               switch (func) {
15223 +               case CAPI_FUNCTION_REGISTER:
15224 +                       msgnum = CAPIMSG_MSGID(skb->data);
15225 +
15226 +                       application = cmtp_application_get(session, CMTP_MSGNUM, msgnum);
15227 +                       if (application) {
15228 +                               application->state = BT_CONNECTED;
15229 +                               application->msgnum = 0;
15230 +                               application->mapping = CAPIMSG_APPID(skb->data);
15231 +                               wake_up_interruptible(&session->wait);
15232 +                       }
15233 +
15234 +                       break;
15235 +
15236 +               case CAPI_FUNCTION_RELEASE:
15237 +                       appl = CAPIMSG_APPID(skb->data);
15238 +
15239 +                       application = cmtp_application_get(session, CMTP_MAPPING, appl);
15240 +                       if (application) {
15241 +                               application->state = BT_CLOSED;
15242 +                               application->msgnum = 0;
15243 +                               wake_up_interruptible(&session->wait);
15244 +                       }
15245 +
15246 +                       break;
15247 +
15248 +               case CAPI_FUNCTION_GET_PROFILE:
15249 +                       controller = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 11);
15250 +                       msgnum = CAPIMSG_MSGID(skb->data);
15251 +
15252 +                       if (!info && (msgnum == CMTP_INITIAL_MSGNUM)) {
15253 +                               session->ncontroller = controller;
15254 +                               wake_up_interruptible(&session->wait);
15255 +                               break;
15256 +                       }
15257 +
15258 +                       if (!info && ctrl) {
15259 +                               memcpy(&ctrl->profile,
15260 +                                       skb->data + CAPI_MSG_BASELEN + 11,
15261 +                                       sizeof(capi_profile));
15262 +                               session->state = BT_CONNECTED;
15263 +                               ctrl->ready(ctrl);
15264 +                       }
15265 +
15266 +                       break;
15267 +
15268 +               case CAPI_FUNCTION_GET_MANUFACTURER:
15269 +                       controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 10);
15270 +
15271 +                       if (!info && ctrl) {
15272 +                               strncpy(ctrl->manu,
15273 +                                       skb->data + CAPI_MSG_BASELEN + 15,
15274 +                                       skb->data[CAPI_MSG_BASELEN + 14]);
15275 +                       }
15276 +
15277 +                       break;
15278 +
15279 +               case CAPI_FUNCTION_GET_VERSION:
15280 +                       controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
15281 +
15282 +                       if (!info && ctrl) {
15283 +                               ctrl->version.majorversion = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 16);
15284 +                               ctrl->version.minorversion = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 20);
15285 +                               ctrl->version.majormanuversion = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 24);
15286 +                               ctrl->version.minormanuversion = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 28);
15287 +                       }
15288 +
15289 +                       break;
15290 +
15291 +               case CAPI_FUNCTION_GET_SERIAL_NUMBER:
15292 +                       controller = CAPIMSG_U32(skb->data, CAPI_MSG_BASELEN + 12);
15293 +
15294 +                       if (!info && ctrl) {
15295 +                               memset(ctrl->serial, 0, CAPI_SERIAL_LEN);
15296 +                               strncpy(ctrl->serial,
15297 +                                       skb->data + CAPI_MSG_BASELEN + 17,
15298 +                                       skb->data[CAPI_MSG_BASELEN + 16]);
15299 +                       }
15300 +
15301 +                       break;
15302 +               }
15303 +
15304 +               break;
15305 +
15306 +       case CAPI_IND:
15307 +               func = CAPIMSG_U16(skb->data, CAPI_MSG_BASELEN + 3);
15308 +
15309 +               if (func == CAPI_FUNCTION_LOOPBACK) {
15310 +                       appl = CAPIMSG_APPID(skb->data);
15311 +                       msgnum = CAPIMSG_MSGID(skb->data);
15312 +                       cmtp_send_interopmsg(session, CAPI_RESP, appl, msgnum, func,
15313 +                                               skb->data + CAPI_MSG_BASELEN + 6,
15314 +                                               skb->data[CAPI_MSG_BASELEN + 5]);
15315 +               }
15316 +
15317 +               break;
15318 +       }
15319 +
15320 +       kfree_skb(skb);
15321 +}
15322 +
15323 +void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb)
15324 +{
15325 +       struct capi_ctr *ctrl = session->ctrl;
15326 +       struct cmtp_application *application;
15327 +       __u16 cmd, appl, info;
15328 +       __u32 ncci, contr;
15329 +
15330 +       BT_DBG("session %p skb %p len %d", session, skb, skb->len);
15331 +
15332 +       if (CAPIMSG_COMMAND(skb->data) == CAPI_INTEROPERABILITY) {
15333 +               cmtp_recv_interopmsg(session, skb);
15334 +               return;
15335 +       }
15336 +
15337 +       if (session->flags & (1 << CMTP_LOOPBACK)) {
15338 +               kfree_skb(skb);
15339 +               return;
15340 +       }
15341 +
15342 +       cmd = CAPICMD(CAPIMSG_COMMAND(skb->data), CAPIMSG_SUBCOMMAND(skb->data));
15343 +       appl = CAPIMSG_APPID(skb->data);
15344 +       contr = CAPIMSG_CONTROL(skb->data);
15345 +
15346 +       application = cmtp_application_get(session, CMTP_MAPPING, appl);
15347 +       if (application) {
15348 +               appl = application->appl;
15349 +               CAPIMSG_SETAPPID(skb->data, appl);
15350 +       } else {
15351 +               BT_ERR("Can't find application with id %d", appl);
15352 +               kfree_skb(skb);
15353 +               return;
15354 +       }
15355 +
15356 +       if ((contr & 0x7f) == 0x01) {
15357 +               contr = (contr & 0xffffff80) | session->num;
15358 +               CAPIMSG_SETCONTROL(skb->data, contr);
15359 +       }
15360 +
15361 +       if (!ctrl) {
15362 +               BT_ERR("Can't find controller %d for message", session->num);
15363 +               kfree_skb(skb);
15364 +               return;
15365 +       }
15366 +
15367 +       switch (cmd) {
15368 +       case CAPI_CONNECT_B3_CONF:
15369 +               ncci = CAPIMSG_NCCI(skb->data);
15370 +               info = CAPIMSG_U16(skb->data, 12);
15371 +
15372 +               BT_DBG("CONNECT_B3_CONF ncci 0x%02x info 0x%02x", ncci, info);
15373 +
15374 +               if (info == 0)
15375 +                       ctrl->new_ncci(ctrl, appl, ncci, 8);
15376 +
15377 +               ctrl->handle_capimsg(ctrl, appl, skb);
15378 +               break;
15379 +
15380 +       case CAPI_CONNECT_B3_IND:
15381 +               ncci = CAPIMSG_NCCI(skb->data);
15382 +
15383 +               BT_DBG("CONNECT_B3_IND ncci 0x%02x", ncci);
15384 +
15385 +               ctrl->new_ncci(ctrl, appl, ncci, 8);
15386 +               ctrl->handle_capimsg(ctrl, appl, skb);
15387 +               break;
15388 +
15389 +       case CAPI_DISCONNECT_B3_IND:
15390 +               ncci = CAPIMSG_NCCI(skb->data);
15391 +
15392 +               BT_DBG("DISCONNECT_B3_IND ncci 0x%02x", ncci);
15393 +
15394 +               if (ncci == 0xffffffff)
15395 +                       BT_ERR("DISCONNECT_B3_IND with ncci 0xffffffff");
15396 +
15397 +               ctrl->handle_capimsg(ctrl, appl, skb);
15398 +               ctrl->free_ncci(ctrl, appl, ncci);
15399 +               break;
15400 +
15401 +       default:
15402 +               ctrl->handle_capimsg(ctrl, appl, skb);
15403 +               break;
15404 +       }
15405 +}
15406 +
15407 +void cmtp_send_capimsg(struct cmtp_session *session, struct sk_buff *skb)
15408 +{
15409 +       struct cmtp_scb *scb = (void *) skb->cb;
15410 +
15411 +       BT_DBG("session %p skb %p len %d", session, skb, skb->len);
15412 +
15413 +       scb->id = -1;
15414 +       scb->data = (CAPIMSG_COMMAND(skb->data) == CAPI_DATA_B3);
15415 +
15416 +       skb_queue_tail(&session->transmit, skb);
15417 +
15418 +       cmtp_schedule(session);
15419 +}
15420 +
15421 +
15422 +static int cmtp_load_firmware(struct capi_ctr *ctrl, capiloaddata *data)
15423 +{
15424 +       BT_DBG("ctrl %p data %p", ctrl, data);
15425 +
15426 +       return -EIO;
15427 +}
15428 +
15429 +static void cmtp_reset_ctr(struct capi_ctr *ctrl)
15430 +{
15431 +       BT_DBG("ctrl %p", ctrl);
15432 +
15433 +       ctrl->reseted(ctrl);
15434 +}
15435 +
15436 +static void cmtp_remove_ctr(struct capi_ctr *ctrl)
15437 +{
15438 +       struct cmtp_session *session = ctrl->driverdata;
15439 +
15440 +       BT_DBG("ctrl %p", ctrl);
15441 +
15442 +       ctrl->suspend_output(ctrl);
15443 +
15444 +       atomic_inc(&session->terminate);
15445 +       cmtp_schedule(session);
15446 +}
15447 +
15448 +static void cmtp_register_appl(struct capi_ctr *ctrl, __u16 appl, capi_register_params *rp)
15449 +{
15450 +       DECLARE_WAITQUEUE(wait, current);
15451 +       struct cmtp_session *session = ctrl->driverdata;
15452 +       struct cmtp_application *application;
15453 +       unsigned long timeo = CMTP_INTEROP_TIMEOUT;
15454 +       unsigned char buf[8];
15455 +       int err = 0, nconn, want = rp->level3cnt;
15456 +
15457 +       BT_DBG("ctrl %p appl %d level3cnt %d datablkcnt %d datablklen %d",
15458 +               ctrl, appl, rp->level3cnt, rp->datablkcnt, rp->datablklen);
15459 +
15460 +       application = cmtp_application_add(session, appl);
15461 +       if (!application) {
15462 +               BT_ERR("Can't allocate memory for new application");
15463 +               ctrl->appl_released(ctrl, appl);
15464 +               return;
15465 +       }
15466 +
15467 +       if (want < 0)
15468 +               nconn = ctrl->profile.nbchannel * -want;
15469 +       else
15470 +               nconn = want;
15471 +
15472 +       if (nconn == 0)
15473 +               nconn = ctrl->profile.nbchannel;
15474 +
15475 +       capimsg_setu16(buf, 0, nconn);
15476 +       capimsg_setu16(buf, 2, rp->datablkcnt);
15477 +       capimsg_setu16(buf, 4, rp->datablklen);
15478 +
15479 +       application->state = BT_CONFIG;
15480 +       application->msgnum = cmtp_msgnum_get(session);
15481 +
15482 +       cmtp_send_interopmsg(session, CAPI_REQ, 0x0000, application->msgnum,
15483 +                               CAPI_FUNCTION_REGISTER, buf, 6);
15484 +
15485 +       add_wait_queue(&session->wait, &wait);
15486 +       while (1) {
15487 +               set_current_state(TASK_INTERRUPTIBLE);
15488 +
15489 +               if (!timeo) {
15490 +                       err = -EAGAIN;
15491 +                       break;
15492 +               }
15493 +
15494 +               if (application->state == BT_CLOSED) {
15495 +                       err = -application->err;
15496 +                       break;
15497 +               }
15498 +
15499 +               if (application->state == BT_CONNECTED)
15500 +                       break;
15501 +
15502 +               if (signal_pending(current)) {
15503 +                       err = -EINTR;
15504 +                       break;
15505 +               }
15506 +
15507 +               timeo = schedule_timeout(timeo);
15508 +       }
15509 +       set_current_state(TASK_RUNNING);
15510 +       remove_wait_queue(&session->wait, &wait);
15511 +
15512 +       if (err) {
15513 +               ctrl->appl_released(ctrl, appl);
15514 +               cmtp_application_del(session, application);
15515 +               return;
15516 +       }
15517 +
15518 +       ctrl->appl_registered(ctrl, appl);
15519 +}
15520 +
15521 +static void cmtp_release_appl(struct capi_ctr *ctrl, __u16 appl)
15522 +{
15523 +       DECLARE_WAITQUEUE(wait, current);
15524 +       struct cmtp_session *session = ctrl->driverdata;
15525 +       struct cmtp_application *application;
15526 +       unsigned long timeo = CMTP_INTEROP_TIMEOUT;
15527 +
15528 +       BT_DBG("ctrl %p appl %d", ctrl, appl);
15529 +
15530 +       application = cmtp_application_get(session, CMTP_APPLID, appl);
15531 +       if (!application) {
15532 +               BT_ERR("Can't find application");
15533 +               return;
15534 +       }
15535 +
15536 +       application->msgnum = cmtp_msgnum_get(session);
15537 +
15538 +       cmtp_send_interopmsg(session, CAPI_REQ, application->mapping, application->msgnum,
15539 +                               CAPI_FUNCTION_RELEASE, NULL, 0);
15540 +
15541 +       add_wait_queue(&session->wait, &wait);
15542 +       while (timeo) {
15543 +               set_current_state(TASK_INTERRUPTIBLE);
15544 +
15545 +               if (application->state == BT_CLOSED)
15546 +                       break;
15547 +
15548 +               if (signal_pending(current))
15549 +                       break;
15550 +
15551 +               timeo = schedule_timeout(timeo);
15552 +       }
15553 +       set_current_state(TASK_RUNNING);
15554 +       remove_wait_queue(&session->wait, &wait);
15555 +
15556 +       cmtp_application_del(session, application);
15557 +       ctrl->appl_released(ctrl, appl);
15558 +}
15559 +
15560 +static void cmtp_send_message(struct capi_ctr *ctrl, struct sk_buff *skb)
15561 +{
15562 +       struct cmtp_session *session = ctrl->driverdata;
15563 +       struct cmtp_application *application;
15564 +       __u16 appl;
15565 +       __u32 contr;
15566 +
15567 +       BT_DBG("ctrl %p skb %p", ctrl, skb);
15568 +
15569 +       appl = CAPIMSG_APPID(skb->data);
15570 +       contr = CAPIMSG_CONTROL(skb->data);
15571 +
15572 +       application = cmtp_application_get(session, CMTP_APPLID, appl);
15573 +       if ((!application) || (application->state != BT_CONNECTED)) {
15574 +               BT_ERR("Can't find application with id %d", appl);
15575 +               kfree_skb(skb);
15576 +               return;
15577 +       }
15578 +
15579 +       CAPIMSG_SETAPPID(skb->data, application->mapping);
15580 +
15581 +       if ((contr & 0x7f) == session->num) {
15582 +               contr = (contr & 0xffffff80) | 0x01;
15583 +               CAPIMSG_SETCONTROL(skb->data, contr);
15584 +       }
15585 +
15586 +       cmtp_send_capimsg(session, skb);
15587 +}
15588 +
15589 +static char *cmtp_procinfo(struct capi_ctr *ctrl)
15590 +{
15591 +       return "CAPI Message Transport Protocol";
15592 +}
15593 +
15594 +static int cmtp_ctr_read_proc(char *page, char **start, off_t off, int count, int *eof, struct capi_ctr *ctrl)
15595 +{
15596 +       struct cmtp_session *session = ctrl->driverdata;
15597 +       struct cmtp_application *app;
15598 +       struct list_head *p, *n;
15599 +       int len = 0;
15600 +
15601 +       len += sprintf(page + len, "%s (Revision %s)\n\n", cmtp_procinfo(ctrl), REVISION);
15602 +       len += sprintf(page + len, "addr %s\n", session->name);
15603 +       len += sprintf(page + len, "ctrl %d\n", session->num);
15604 +
15605 +       list_for_each_safe(p, n, &session->applications) {
15606 +               app = list_entry(p, struct cmtp_application, list);
15607 +               len += sprintf(page + len, "appl %d -> %d\n", app->appl, app->mapping);
15608 +       }
15609 +
15610 +       if (off + count >= len)
15611 +               *eof = 1;
15612 +
15613 +       if (len < off)
15614 +               return 0;
15615 +
15616 +       *start = page + off;
15617 +
15618 +       return ((count < len - off) ? count : len - off);
15619 +}
15620 +
15621 +static struct capi_driver cmtp_driver = {
15622 +       name:           "cmtp",
15623 +       revision:       REVISION,
15624 +       load_firmware:  cmtp_load_firmware,
15625 +       reset_ctr:      cmtp_reset_ctr,
15626 +       remove_ctr:     cmtp_remove_ctr,
15627 +       register_appl:  cmtp_register_appl,
15628 +       release_appl:   cmtp_release_appl,
15629 +       send_message:   cmtp_send_message,
15630 +       procinfo:       cmtp_procinfo,
15631 +       ctr_read_proc:  cmtp_ctr_read_proc,
15632 +
15633 +       driver_read_proc:       0,
15634 +       add_card:               0,
15635 +};
15636 +
15637 +
15638 +int cmtp_attach_device(struct cmtp_session *session)
15639 +{
15640 +       DECLARE_WAITQUEUE(wait, current);
15641 +       unsigned long timeo = CMTP_INTEROP_TIMEOUT;
15642 +       unsigned char buf[4];
15643 +
15644 +       BT_DBG("session %p", session);
15645 +
15646 +       capimsg_setu32(buf, 0, 0);
15647 +
15648 +       cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, CMTP_INITIAL_MSGNUM,
15649 +                               CAPI_FUNCTION_GET_PROFILE, buf, 4);
15650 +
15651 +       add_wait_queue(&session->wait, &wait);
15652 +       while (timeo) {
15653 +               set_current_state(TASK_INTERRUPTIBLE);
15654 +
15655 +               if (session->ncontroller)
15656 +                       break;
15657 +
15658 +               if (signal_pending(current))
15659 +                       break;
15660 +
15661 +               timeo = schedule_timeout(timeo);
15662 +       }
15663 +       set_current_state(TASK_RUNNING);
15664 +       remove_wait_queue(&session->wait, &wait);
15665 +
15666 +       BT_INFO("Found %d CAPI controller(s) on device %s", session->ncontroller, session->name);
15667 +
15668 +       if (!timeo)
15669 +               return -ETIMEDOUT;
15670 +
15671 +       if (!session->ncontroller)
15672 +               return -ENODEV;
15673 +
15674 +
15675 +       if (session->ncontroller > 1)
15676 +               BT_INFO("Setting up only CAPI controller 1");
15677 +
15678 +       if (!(session->ctrl = di->attach_ctr(&cmtp_driver, session->name, session))) {
15679 +               BT_ERR("Can't attach new controller");
15680 +               return -EBUSY;
15681 +       }
15682 +
15683 +       session->num = session->ctrl->cnr;
15684 +
15685 +       BT_DBG("session %p ctrl %p num %d", session, session->ctrl, session->num);
15686 +
15687 +       capimsg_setu32(buf, 0, 1);
15688 +
15689 +       cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, cmtp_msgnum_get(session),
15690 +                               CAPI_FUNCTION_GET_MANUFACTURER, buf, 4);
15691 +
15692 +       cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, cmtp_msgnum_get(session),
15693 +                               CAPI_FUNCTION_GET_VERSION, buf, 4);
15694 +
15695 +       cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, cmtp_msgnum_get(session),
15696 +                               CAPI_FUNCTION_GET_SERIAL_NUMBER, buf, 4);
15697 +
15698 +       cmtp_send_interopmsg(session, CAPI_REQ, 0xffff, cmtp_msgnum_get(session),
15699 +                               CAPI_FUNCTION_GET_PROFILE, buf, 4);
15700 +
15701 +       return 0;
15702 +}
15703 +
15704 +void cmtp_detach_device(struct cmtp_session *session)
15705 +{
15706 +       struct capi_ctr *ctrl = session->ctrl;
15707 +
15708 +       BT_DBG("session %p ctrl %p", session, ctrl);
15709 +
15710 +       if (!ctrl)
15711 +               return;
15712 +
15713 +       ctrl->reseted(ctrl);
15714 +
15715 +       di->detach_ctr(ctrl);
15716 +}
15717 +
15718 +int cmtp_init_capi(void)
15719 +{
15720 +       if (!(di = attach_capi_driver(&cmtp_driver))) {
15721 +               BT_ERR("Can't attach CAPI driver");
15722 +               return -EIO;
15723 +       }
15724 +
15725 +       return 0;
15726 +}
15727 +
15728 +void cmtp_cleanup_capi(void)
15729 +{
15730 +       detach_capi_driver(&cmtp_driver);
15731 +}
15732 diff -urN linux-2.4.18/net/bluetooth/cmtp/cmtp.h linux-2.4.18-mh9/net/bluetooth/cmtp/cmtp.h
15733 --- linux-2.4.18/net/bluetooth/cmtp/cmtp.h      Thu Jan  1 01:00:00 1970
15734 +++ linux-2.4.18-mh9/net/bluetooth/cmtp/cmtp.h  Mon Aug 25 18:38:12 2003
15735 @@ -0,0 +1,138 @@
15736 +/*
15737 +   CMTP implementation for Linux Bluetooth stack (BlueZ).
15738 +   Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>
15739 +
15740 +   This program is free software; you can redistribute it and/or modify
15741 +   it under the terms of the GNU General Public License version 2 as
15742 +   published by the Free Software Foundation;
15743 +
15744 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15745 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15746 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15747 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15748 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15749 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15750 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15751 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15752 +
15753 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
15754 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
15755 +   SOFTWARE IS DISCLAIMED.
15756 +*/
15757 +
15758 +#ifndef __CMTP_H
15759 +#define __CMTP_H
15760 +
15761 +#include <linux/types.h>
15762 +#include <net/bluetooth/bluetooth.h>
15763 +
15764 +#define BTNAMSIZ 18
15765 +
15766 +/* CMTP ioctl defines */
15767 +#define CMTPCONNADD    _IOW('C', 200, int)
15768 +#define CMTPCONNDEL    _IOW('C', 201, int)
15769 +#define CMTPGETCONNLIST        _IOR('C', 210, int)
15770 +#define CMTPGETCONNINFO        _IOR('C', 211, int)
15771 +
15772 +#define CMTP_LOOPBACK  0
15773 +
15774 +struct cmtp_connadd_req {
15775 +       int   sock;     // Connected socket
15776 +       __u32 flags;
15777 +};
15778 +
15779 +struct cmtp_conndel_req {
15780 +       bdaddr_t bdaddr;
15781 +       __u32    flags;
15782 +};
15783 +
15784 +struct cmtp_conninfo {
15785 +       bdaddr_t bdaddr;
15786 +       __u32    flags;
15787 +       __u16    state;
15788 +       int      num;
15789 +};
15790 +
15791 +struct cmtp_connlist_req {
15792 +       __u32  cnum;
15793 +       struct cmtp_conninfo *ci;
15794 +};
15795 +
15796 +int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock);
15797 +int cmtp_del_connection(struct cmtp_conndel_req *req);
15798 +int cmtp_get_connlist(struct cmtp_connlist_req *req);
15799 +int cmtp_get_conninfo(struct cmtp_conninfo *ci);
15800 +
15801 +/* CMTP session defines */
15802 +#define CMTP_INTEROP_TIMEOUT   (HZ * 5)
15803 +#define CMTP_INITIAL_MSGNUM    0xff00
15804 +
15805 +struct cmtp_session {
15806 +       struct list_head list;
15807 +
15808 +       struct socket *sock;
15809 +
15810 +       bdaddr_t bdaddr;
15811 +
15812 +       unsigned long state;
15813 +       unsigned long flags;
15814 +
15815 +       uint mtu;
15816 +
15817 +       char name[BTNAMSIZ];
15818 +
15819 +       atomic_t terminate;
15820 +
15821 +       wait_queue_head_t wait;
15822 +
15823 +       int ncontroller;
15824 +       int num;
15825 +       struct capi_ctr *ctrl;
15826 +
15827 +       struct list_head applications;
15828 +
15829 +       unsigned long blockids;
15830 +       int msgnum;
15831 +
15832 +       struct sk_buff_head transmit;
15833 +
15834 +       struct sk_buff *reassembly[16];
15835 +};
15836 +
15837 +struct cmtp_application {
15838 +       struct list_head list;
15839 +
15840 +       unsigned long state;
15841 +       int err;
15842 +
15843 +       __u16 appl;
15844 +       __u16 mapping;
15845 +
15846 +       __u16 msgnum;
15847 +};
15848 +
15849 +struct cmtp_scb {
15850 +       int id;
15851 +       int data;
15852 +};
15853 +
15854 +int  cmtp_attach_device(struct cmtp_session *session);
15855 +void cmtp_detach_device(struct cmtp_session *session);
15856 +
15857 +void cmtp_recv_capimsg(struct cmtp_session *session, struct sk_buff *skb);
15858 +void cmtp_send_capimsg(struct cmtp_session *session, struct sk_buff *skb);
15859 +
15860 +static inline void cmtp_schedule(struct cmtp_session *session)
15861 +{
15862 +       struct sock *sk = session->sock->sk;
15863 +
15864 +       wake_up_interruptible(sk->sleep);
15865 +}
15866 +
15867 +/* CMTP init defines */
15868 +int cmtp_init_capi(void);
15869 +int cmtp_init_sockets(void);
15870 +void cmtp_cleanup_capi(void);
15871 +void cmtp_cleanup_sockets(void);
15872 +
15873 +#endif /* __CMTP_H */
15874 diff -urN linux-2.4.18/net/bluetooth/cmtp/core.c linux-2.4.18-mh9/net/bluetooth/cmtp/core.c
15875 --- linux-2.4.18/net/bluetooth/cmtp/core.c      Thu Jan  1 01:00:00 1970
15876 +++ linux-2.4.18-mh9/net/bluetooth/cmtp/core.c  Mon Aug 25 18:38:12 2003
15877 @@ -0,0 +1,515 @@
15878 +/*
15879 +   CMTP implementation for Linux Bluetooth stack (BlueZ).
15880 +   Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>
15881 +
15882 +   This program is free software; you can redistribute it and/or modify
15883 +   it under the terms of the GNU General Public License version 2 as
15884 +   published by the Free Software Foundation;
15885 +
15886 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15887 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15888 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15889 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15890 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15891 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15892 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15893 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15894 +
15895 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
15896 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
15897 +   SOFTWARE IS DISCLAIMED.
15898 +*/
15899 +
15900 +#include <linux/config.h>
15901 +#include <linux/module.h>
15902 +
15903 +#include <linux/types.h>
15904 +#include <linux/errno.h>
15905 +#include <linux/kernel.h>
15906 +#include <linux/major.h>
15907 +#include <linux/sched.h>
15908 +#include <linux/slab.h>
15909 +#include <linux/poll.h>
15910 +#include <linux/fcntl.h>
15911 +#include <linux/skbuff.h>
15912 +#include <linux/socket.h>
15913 +#include <linux/ioctl.h>
15914 +#include <linux/file.h>
15915 +#include <linux/init.h>
15916 +#include <net/sock.h>
15917 +
15918 +#include <net/bluetooth/bluetooth.h>
15919 +#include <net/bluetooth/l2cap.h>
15920 +
15921 +#include "cmtp.h"
15922 +
15923 +#ifndef CONFIG_BLUEZ_CMTP_DEBUG
15924 +#undef  BT_DBG
15925 +#define BT_DBG(D...)
15926 +#endif
15927 +
15928 +#define VERSION "1.0"
15929 +
15930 +static DECLARE_RWSEM(cmtp_session_sem);
15931 +static LIST_HEAD(cmtp_session_list);
15932 +
15933 +static struct cmtp_session *__cmtp_get_session(bdaddr_t *bdaddr)
15934 +{
15935 +       struct cmtp_session *session;
15936 +       struct list_head *p;
15937 +
15938 +       BT_DBG("");
15939 +
15940 +       list_for_each(p, &cmtp_session_list) {
15941 +               session = list_entry(p, struct cmtp_session, list);
15942 +               if (!bacmp(bdaddr, &session->bdaddr))
15943 +                       return session;
15944 +       }
15945 +       return NULL;
15946 +}
15947 +
15948 +static void __cmtp_link_session(struct cmtp_session *session)
15949 +{
15950 +       MOD_INC_USE_COUNT;
15951 +       list_add(&session->list, &cmtp_session_list);
15952 +}
15953 +
15954 +static void __cmtp_unlink_session(struct cmtp_session *session)
15955 +{
15956 +       list_del(&session->list);
15957 +       MOD_DEC_USE_COUNT;
15958 +}
15959 +
15960 +static void __cmtp_copy_session(struct cmtp_session *session, struct cmtp_conninfo *ci)
15961 +{
15962 +       bacpy(&ci->bdaddr, &session->bdaddr);
15963 +
15964 +       ci->flags = session->flags;
15965 +       ci->state = session->state;
15966 +
15967 +       ci->num = session->num;
15968 +}
15969 +
15970 +
15971 +static inline int cmtp_alloc_block_id(struct cmtp_session *session)
15972 +{
15973 +       int i, id = -1;
15974 +
15975 +       for (i = 0; i < 16; i++)
15976 +               if (!test_and_set_bit(i, &session->blockids)) {
15977 +                       id = i;
15978 +                       break;
15979 +               }
15980 +
15981 +       return id;
15982 +}
15983 +
15984 +static inline void cmtp_free_block_id(struct cmtp_session *session, int id)
15985 +{
15986 +       clear_bit(id, &session->blockids);
15987 +}
15988 +
15989 +static inline void cmtp_add_msgpart(struct cmtp_session *session, int id, const unsigned char *buf, int count)
15990 +{
15991 +       struct sk_buff *skb = session->reassembly[id], *nskb;
15992 +       int size;
15993 +
15994 +       BT_DBG("session %p buf %p count %d", session, buf, count);
15995 +
15996 +       size = (skb) ? skb->len + count : count;
15997 +
15998 +       if (!(nskb = alloc_skb(size, GFP_ATOMIC))) {
15999 +               BT_ERR("Can't allocate memory for CAPI message");
16000 +               return;
16001 +       }
16002 +
16003 +       if (skb && (skb->len > 0))
16004 +               memcpy(skb_put(nskb, skb->len), skb->data, skb->len);
16005 +
16006 +       memcpy(skb_put(nskb, count), buf, count);
16007 +
16008 +       session->reassembly[id] = nskb;
16009 +
16010 +       if (skb)
16011 +               kfree_skb(skb);
16012 +}
16013 +
16014 +static inline int cmtp_recv_frame(struct cmtp_session *session, struct sk_buff *skb)
16015 +{
16016 +       __u8 hdr, hdrlen, id;
16017 +       __u16 len;
16018 +
16019 +       BT_DBG("session %p skb %p len %d", session, skb, skb->len);
16020 +
16021 +       while (skb->len > 0) {
16022 +               hdr = skb->data[0];
16023 +
16024 +               switch (hdr & 0xc0) {
16025 +               case 0x40:
16026 +                       hdrlen = 2;
16027 +                       len = skb->data[1];
16028 +                       break;
16029 +               case 0x80:
16030 +                       hdrlen = 3;
16031 +                       len = skb->data[1] | (skb->data[2] << 8);
16032 +                       break;
16033 +               default:
16034 +                       hdrlen = 1;
16035 +                       len = 0;
16036 +                       break;
16037 +               }
16038 +
16039 +               id = (hdr & 0x3c) >> 2;
16040 +
16041 +               BT_DBG("hdr 0x%02x hdrlen %d len %d id %d", hdr, hdrlen, len, id);
16042 +
16043 +               if (hdrlen + len > skb->len) {
16044 +                       BT_ERR("Wrong size or header information in CMTP frame");
16045 +                       break;
16046 +               }
16047 +
16048 +               if (len == 0) {
16049 +                       skb_pull(skb, hdrlen);
16050 +                       continue;
16051 +               }
16052 +
16053 +               switch (hdr & 0x03) {
16054 +               case 0x00:
16055 +                       cmtp_add_msgpart(session, id, skb->data + hdrlen, len);
16056 +                       cmtp_recv_capimsg(session, session->reassembly[id]);
16057 +                       session->reassembly[id] = NULL;
16058 +                       break;
16059 +               case 0x01:
16060 +                       cmtp_add_msgpart(session, id, skb->data + hdrlen, len);
16061 +                       break;
16062 +               default:
16063 +                       if (session->reassembly[id] != NULL)
16064 +                               kfree_skb(session->reassembly[id]);
16065 +                       session->reassembly[id] = NULL;
16066 +                       break;
16067 +               }
16068 +
16069 +               skb_pull(skb, hdrlen + len);
16070 +       }
16071 +
16072 +       kfree_skb(skb);
16073 +       return 0;
16074 +}
16075 +
16076 +static int cmtp_send_frame(struct cmtp_session *session, unsigned char *data, int len)
16077 +{
16078 +       struct socket *sock = session->sock;
16079 +       struct iovec iv = { data, len };
16080 +       struct msghdr msg;
16081 +       int err;
16082 +
16083 +       BT_DBG("session %p data %p len %d", session, data, len);
16084 +
16085 +       if (!len)
16086 +               return 0;
16087 +
16088 +       memset(&msg, 0, sizeof(msg));
16089 +       msg.msg_iovlen = 1;
16090 +       msg.msg_iov = &iv;
16091 +
16092 +       err = sock->ops->sendmsg(sock, &msg, len, 0);
16093 +       return err;
16094 +}
16095 +
16096 +static int cmtp_process_transmit(struct cmtp_session *session)
16097 +{
16098 +       struct sk_buff *skb, *nskb;
16099 +       unsigned char *hdr;
16100 +       unsigned int size, tail;
16101 +
16102 +       BT_DBG("session %p", session);
16103 +
16104 +       if (!(nskb = alloc_skb(session->mtu, GFP_ATOMIC))) {
16105 +               BT_ERR("Can't allocate memory for new frame");
16106 +               return -ENOMEM;
16107 +       }
16108 +
16109 +       while ((skb = skb_dequeue(&session->transmit))) {
16110 +               struct cmtp_scb *scb = (void *) skb->cb;
16111 +
16112 +               if ((tail = (session->mtu - nskb->len)) < 5) {
16113 +                       cmtp_send_frame(session, nskb->data, nskb->len);
16114 +                       skb_trim(nskb, 0);
16115 +                       tail = session->mtu;
16116 +               }
16117 +
16118 +               size = min_t(uint, ((tail < 258) ? (tail - 2) : (tail - 3)), skb->len);
16119 +
16120 +               if ((scb->id < 0) && ((scb->id = cmtp_alloc_block_id(session)) < 0)) {
16121 +                       skb_queue_head(&session->transmit, skb);
16122 +                       break;
16123 +               }
16124 +
16125 +               if (size < 256) {
16126 +                       hdr = skb_put(nskb, 2);
16127 +                       hdr[0] = 0x40
16128 +                               | ((scb->id << 2) & 0x3c)
16129 +                               | ((skb->len == size) ? 0x00 : 0x01);
16130 +                       hdr[1] = size;
16131 +               } else {
16132 +                       hdr = skb_put(nskb, 3);
16133 +                       hdr[0] = 0x80
16134 +                               | ((scb->id << 2) & 0x3c)
16135 +                               | ((skb->len == size) ? 0x00 : 0x01);
16136 +                       hdr[1] = size & 0xff;
16137 +                       hdr[2] = size >> 8;
16138 +               }
16139 +
16140 +               memcpy(skb_put(nskb, size), skb->data, size);
16141 +               skb_pull(skb, size);
16142 +
16143 +               if (skb->len > 0) {
16144 +                       skb_queue_head(&session->transmit, skb);
16145 +               } else {
16146 +                       cmtp_free_block_id(session, scb->id);
16147 +                       if (scb->data) {
16148 +                               cmtp_send_frame(session, nskb->data, nskb->len);
16149 +                               skb_trim(nskb, 0);
16150 +                       }
16151 +                       kfree_skb(skb);
16152 +               }
16153 +       }
16154 +
16155 +       cmtp_send_frame(session, nskb->data, nskb->len);
16156 +
16157 +       kfree_skb(nskb);
16158 +
16159 +       return skb_queue_len(&session->transmit);
16160 +}
16161 +
16162 +static int cmtp_session(void *arg)
16163 +{
16164 +       struct cmtp_session *session = arg;
16165 +       struct sock *sk = session->sock->sk;
16166 +       struct sk_buff *skb;
16167 +       wait_queue_t wait;
16168 +
16169 +       BT_DBG("session %p", session);
16170 +
16171 +       daemonize(); reparent_to_init();
16172 +
16173 +       sprintf(current->comm, "kcmtpd_ctr_%d", session->num);
16174 +
16175 +       sigfillset(&current->blocked);
16176 +       flush_signals(current);
16177 +
16178 +       current->nice = -15;
16179 +
16180 +       set_fs(KERNEL_DS);
16181 +
16182 +       init_waitqueue_entry(&wait, current);
16183 +       add_wait_queue(sk->sleep, &wait);
16184 +       while (!atomic_read(&session->terminate)) {
16185 +               set_current_state(TASK_INTERRUPTIBLE);
16186 +
16187 +               if (sk->state != BT_CONNECTED)
16188 +                       break;
16189 +
16190 +               while ((skb = skb_dequeue(&sk->receive_queue))) {
16191 +                       skb_orphan(skb);
16192 +                       cmtp_recv_frame(session, skb);
16193 +               }
16194 +
16195 +               cmtp_process_transmit(session);
16196 +
16197 +               schedule();
16198 +       }
16199 +       set_current_state(TASK_RUNNING);
16200 +       remove_wait_queue(sk->sleep, &wait);
16201 +
16202 +       down_write(&cmtp_session_sem);
16203 +
16204 +       if (!(session->flags & (1 << CMTP_LOOPBACK)))
16205 +               cmtp_detach_device(session);
16206 +
16207 +       fput(session->sock->file);
16208 +
16209 +       __cmtp_unlink_session(session);
16210 +
16211 +       up_write(&cmtp_session_sem);
16212 +
16213 +       kfree(session);
16214 +       return 0;
16215 +}
16216 +
16217 +int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
16218 +{
16219 +       struct cmtp_session *session, *s;
16220 +       bdaddr_t src, dst;
16221 +       int i, err;
16222 +
16223 +       BT_DBG("");
16224 +
16225 +       baswap(&src, &bluez_pi(sock->sk)->src);
16226 +       baswap(&dst, &bluez_pi(sock->sk)->dst);
16227 +
16228 +       session = kmalloc(sizeof(struct cmtp_session), GFP_KERNEL);
16229 +       if (!session)
16230 +               return -ENOMEM;
16231 +       memset(session, 0, sizeof(struct cmtp_session));
16232 +
16233 +       down_write(&cmtp_session_sem);
16234 +
16235 +       s = __cmtp_get_session(&bluez_pi(sock->sk)->dst);
16236 +       if (s && s->state == BT_CONNECTED) {
16237 +               err = -EEXIST;
16238 +               goto failed;
16239 +       }
16240 +
16241 +       bacpy(&session->bdaddr, &bluez_pi(sock->sk)->dst);
16242 +
16243 +       session->mtu = min_t(uint, l2cap_pi(sock->sk)->omtu, l2cap_pi(sock->sk)->imtu);
16244 +
16245 +       BT_DBG("mtu %d", session->mtu);
16246 +
16247 +       sprintf(session->name, "%s", batostr(&dst));
16248 +
16249 +       session->sock  = sock;
16250 +       session->state = BT_CONFIG;
16251 +
16252 +       init_waitqueue_head(&session->wait);
16253 +
16254 +       session->ctrl   = NULL;
16255 +       session->msgnum = CMTP_INITIAL_MSGNUM;
16256 +
16257 +       INIT_LIST_HEAD(&session->applications);
16258 +
16259 +       skb_queue_head_init(&session->transmit);
16260 +
16261 +       for (i = 0; i < 16; i++)
16262 +               session->reassembly[i] = NULL;
16263 +
16264 +       session->flags = req->flags;
16265 +
16266 +       __cmtp_link_session(session);
16267 +
16268 +       err = kernel_thread(cmtp_session, session, CLONE_FS | CLONE_FILES | CLONE_SIGHAND);
16269 +       if (err < 0)
16270 +               goto unlink;
16271 +
16272 +       if (!(session->flags & (1 << CMTP_LOOPBACK))) {
16273 +               err = cmtp_attach_device(session);
16274 +               if (err < 0)
16275 +                       goto detach;
16276 +       }
16277 +
16278 +       up_write(&cmtp_session_sem);
16279 +       return 0;
16280 +
16281 +detach:
16282 +       cmtp_detach_device(session);
16283 +
16284 +unlink:
16285 +       __cmtp_unlink_session(session);
16286 +
16287 +failed:
16288 +       up_write(&cmtp_session_sem);
16289 +       kfree(session);
16290 +       return err;
16291 +}
16292 +
16293 +int cmtp_del_connection(struct cmtp_conndel_req *req)
16294 +{
16295 +       struct cmtp_session *session;
16296 +       int err = 0;
16297 +
16298 +       BT_DBG("");
16299 +
16300 +       down_read(&cmtp_session_sem);
16301 +
16302 +       session = __cmtp_get_session(&req->bdaddr);
16303 +       if (session) {
16304 +               /* Flush the transmit queue */
16305 +               skb_queue_purge(&session->transmit);
16306 +
16307 +               /* Kill session thread */
16308 +               atomic_inc(&session->terminate);
16309 +               cmtp_schedule(session);
16310 +       } else
16311 +               err = -ENOENT;
16312 +
16313 +       up_read(&cmtp_session_sem);
16314 +       return err;
16315 +}
16316 +
16317 +int cmtp_get_connlist(struct cmtp_connlist_req *req)
16318 +{
16319 +       struct list_head *p;
16320 +       int err = 0, n = 0;
16321 +
16322 +       BT_DBG("");
16323 +
16324 +       down_read(&cmtp_session_sem);
16325 +
16326 +       list_for_each(p, &cmtp_session_list) {
16327 +               struct cmtp_session *session;
16328 +               struct cmtp_conninfo ci;
16329 +
16330 +               session = list_entry(p, struct cmtp_session, list);
16331 +
16332 +               __cmtp_copy_session(session, &ci);
16333 +
16334 +               if (copy_to_user(req->ci, &ci, sizeof(ci))) {
16335 +                       err = -EFAULT;
16336 +                       break;
16337 +               }
16338 +
16339 +               if (++n >= req->cnum)
16340 +                       break;
16341 +
16342 +               req->ci++;
16343 +       }
16344 +       req->cnum = n;
16345 +
16346 +       up_read(&cmtp_session_sem);
16347 +       return err;
16348 +}
16349 +
16350 +int cmtp_get_conninfo(struct cmtp_conninfo *ci)
16351 +{
16352 +       struct cmtp_session *session;
16353 +       int err = 0;
16354 +
16355 +       down_read(&cmtp_session_sem);
16356 +
16357 +       session = __cmtp_get_session(&ci->bdaddr);
16358 +       if (session)
16359 +               __cmtp_copy_session(session, ci);
16360 +       else
16361 +               err = -ENOENT;
16362 +
16363 +       up_read(&cmtp_session_sem);
16364 +       return err;
16365 +}
16366 +
16367 +
16368 +int __init init_cmtp(void)
16369 +{
16370 +       l2cap_load();
16371 +
16372 +       cmtp_init_capi();
16373 +       cmtp_init_sockets();
16374 +
16375 +       BT_INFO("BlueZ CMTP ver %s", VERSION);
16376 +       BT_INFO("Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>");
16377 +
16378 +       return 0;
16379 +}
16380 +
16381 +void __exit exit_cmtp(void)
16382 +{
16383 +       cmtp_cleanup_sockets();
16384 +       cmtp_cleanup_capi();
16385 +}
16386 +
16387 +module_init(init_cmtp);
16388 +module_exit(exit_cmtp);
16389 +
16390 +MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
16391 +MODULE_DESCRIPTION("BlueZ CMTP ver " VERSION);
16392 +MODULE_LICENSE("GPL");
16393 diff -urN linux-2.4.18/net/bluetooth/cmtp/sock.c linux-2.4.18-mh9/net/bluetooth/cmtp/sock.c
16394 --- linux-2.4.18/net/bluetooth/cmtp/sock.c      Thu Jan  1 01:00:00 1970
16395 +++ linux-2.4.18-mh9/net/bluetooth/cmtp/sock.c  Mon Aug 25 18:38:12 2003
16396 @@ -0,0 +1,236 @@
16397 +/*
16398 +   CMTP implementation for Linux Bluetooth stack (BlueZ).
16399 +   Copyright (C) 2002-2003 Marcel Holtmann <marcel@holtmann.org>
16400 +
16401 +   This program is free software; you can redistribute it and/or modify
16402 +   it under the terms of the GNU General Public License version 2 as
16403 +   published by the Free Software Foundation;
16404 +
16405 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16406 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16407 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
16408 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16409 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16410 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16411 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16412 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16413 +
16414 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
16415 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
16416 +   SOFTWARE IS DISCLAIMED.
16417 +*/
16418 +
16419 +#include <linux/config.h>
16420 +#include <linux/module.h>
16421 +
16422 +#include <linux/types.h>
16423 +#include <linux/errno.h>
16424 +#include <linux/kernel.h>
16425 +#include <linux/major.h>
16426 +#include <linux/sched.h>
16427 +#include <linux/slab.h>
16428 +#include <linux/poll.h>
16429 +#include <linux/fcntl.h>
16430 +#include <linux/skbuff.h>
16431 +#include <linux/socket.h>
16432 +#include <linux/ioctl.h>
16433 +#include <linux/file.h>
16434 +#include <net/sock.h>
16435 +
16436 +#include <asm/system.h>
16437 +#include <asm/uaccess.h>
16438 +
16439 +#include "cmtp.h"
16440 +
16441 +#ifndef CONFIG_BLUEZ_CMTP_DEBUG
16442 +#undef  BT_DBG
16443 +#define BT_DBG(D...)
16444 +#endif
16445 +
16446 +static inline struct socket *socki_lookup(struct inode *inode)
16447 +{
16448 +       return &inode->u.socket_i;
16449 +}
16450 +
16451 +static struct socket *sockfd_lookup(int fd, int *err)
16452 +{
16453 +       struct file *file;
16454 +       struct inode *inode;
16455 +       struct socket *sock;
16456 +
16457 +       if (!(file = fget(fd))) {
16458 +               *err = -EBADF;
16459 +               return NULL;
16460 +       }
16461 +
16462 +       inode = file->f_dentry->d_inode;
16463 +       if (!inode->i_sock || !(sock = socki_lookup(inode))) {
16464 +               *err = -ENOTSOCK;
16465 +               fput(file);
16466 +               return NULL;
16467 +       }
16468 +
16469 +       if (sock->file != file) {
16470 +               printk(KERN_ERR "socki_lookup: socket file changed!\n");
16471 +               sock->file = file;
16472 +       }
16473 +       return sock;
16474 +}
16475 +
16476 +static int cmtp_sock_release(struct socket *sock)
16477 +{
16478 +       struct sock *sk = sock->sk;
16479 +
16480 +       BT_DBG("sock %p sk %p", sock, sk);
16481 +
16482 +       if (!sk)
16483 +               return 0;
16484 +
16485 +       sock_orphan(sk);
16486 +       sock_put(sk);
16487 +
16488 +       MOD_DEC_USE_COUNT;
16489 +       return 0;
16490 +}
16491 +
16492 +static int cmtp_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
16493 +{
16494 +       struct cmtp_connadd_req ca;
16495 +       struct cmtp_conndel_req cd;
16496 +       struct cmtp_connlist_req cl;
16497 +       struct cmtp_conninfo ci;
16498 +       struct socket *nsock;
16499 +       int err;
16500 +
16501 +       BT_DBG("cmd %x arg %lx", cmd, arg);
16502 +
16503 +       switch (cmd) {
16504 +       case CMTPCONNADD:
16505 +               if (!capable(CAP_NET_ADMIN))
16506 +                       return -EACCES;
16507 +
16508 +               if (copy_from_user(&ca, (void *) arg, sizeof(ca)))
16509 +                       return -EFAULT;
16510 +
16511 +               nsock = sockfd_lookup(ca.sock, &err);
16512 +               if (!nsock)
16513 +                       return err;
16514 +
16515 +               if (nsock->sk->state != BT_CONNECTED)
16516 +                       return -EBADFD;
16517 +
16518 +               err = cmtp_add_connection(&ca, nsock);
16519 +               if (!err) {
16520 +                       if (copy_to_user((void *) arg, &ca, sizeof(ca)))
16521 +                               err = -EFAULT;
16522 +               } else
16523 +                       fput(nsock->file);
16524 +
16525 +               return err;
16526 +
16527 +       case CMTPCONNDEL:
16528 +               if (!capable(CAP_NET_ADMIN))
16529 +                       return -EACCES;
16530 +
16531 +               if (copy_from_user(&cd, (void *) arg, sizeof(cd)))
16532 +                       return -EFAULT;
16533 +
16534 +               return cmtp_del_connection(&cd);
16535 +
16536 +       case CMTPGETCONNLIST:
16537 +               if (copy_from_user(&cl, (void *) arg, sizeof(cl)))
16538 +                       return -EFAULT;
16539 +
16540 +               if (cl.cnum <= 0)
16541 +                       return -EINVAL;
16542 +
16543 +               err = cmtp_get_connlist(&cl);
16544 +               if (!err && copy_to_user((void *) arg, &cl, sizeof(cl)))
16545 +                       return -EFAULT;
16546 +
16547 +               return err;
16548 +
16549 +       case CMTPGETCONNINFO:
16550 +               if (copy_from_user(&ci, (void *) arg, sizeof(ci)))
16551 +                       return -EFAULT;
16552 +
16553 +               err = cmtp_get_conninfo(&ci);
16554 +               if (!err && copy_to_user((void *) arg, &ci, sizeof(ci)))
16555 +                       return -EFAULT;
16556 +
16557 +               return err;
16558 +       }
16559 +
16560 +       return -EINVAL;
16561 +}
16562 +
16563 +static struct proto_ops cmtp_sock_ops = {
16564 +       family:         PF_BLUETOOTH,
16565 +       release:        cmtp_sock_release,
16566 +       ioctl:          cmtp_sock_ioctl,
16567 +       bind:           sock_no_bind,
16568 +       getname:        sock_no_getname,
16569 +       sendmsg:        sock_no_sendmsg,
16570 +       recvmsg:        sock_no_recvmsg,
16571 +       poll:           sock_no_poll,
16572 +       listen:         sock_no_listen,
16573 +       shutdown:       sock_no_shutdown,
16574 +       setsockopt:     sock_no_setsockopt,
16575 +       getsockopt:     sock_no_getsockopt,
16576 +       connect:        sock_no_connect,
16577 +       socketpair:     sock_no_socketpair,
16578 +       accept:         sock_no_accept,
16579 +       mmap:           sock_no_mmap
16580 +};
16581 +
16582 +static int cmtp_sock_create(struct socket *sock, int protocol)
16583 +{
16584 +       struct sock *sk;
16585 +
16586 +       BT_DBG("sock %p", sock);
16587 +
16588 +       if (sock->type != SOCK_RAW)
16589 +               return -ESOCKTNOSUPPORT;
16590 +
16591 +       sock->ops = &cmtp_sock_ops;
16592 +
16593 +       if (!(sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, 1)))
16594 +               return -ENOMEM;
16595 +
16596 +       MOD_INC_USE_COUNT;
16597 +
16598 +       sock->state = SS_UNCONNECTED;
16599 +       sock_init_data(sock, sk);
16600 +
16601 +       sk->destruct = NULL;
16602 +       sk->protocol = protocol;
16603 +
16604 +       return 0;
16605 +}
16606 +
16607 +static struct net_proto_family cmtp_sock_family_ops = {
16608 +       family:         PF_BLUETOOTH,
16609 +       create:         cmtp_sock_create
16610 +};
16611 +
16612 +int cmtp_init_sockets(void)
16613 +{
16614 +       int err;
16615 +
16616 +       if ((err = bluez_sock_register(BTPROTO_CMTP, &cmtp_sock_family_ops))) {
16617 +               BT_ERR("Can't register CMTP socket layer (%d)", err);
16618 +               return err;
16619 +       }
16620 +
16621 +       return 0;
16622 +}
16623 +
16624 +void cmtp_cleanup_sockets(void)
16625 +{
16626 +       int err;
16627 +
16628 +       if ((err = bluez_sock_unregister(BTPROTO_CMTP)))
16629 +               BT_ERR("Can't unregister CMTP socket layer (%d)", err);
16630 +
16631 +       return;
16632 +}
16633 diff -urN linux-2.4.18/net/bluetooth/hci_conn.c linux-2.4.18-mh9/net/bluetooth/hci_conn.c
16634 --- linux-2.4.18/net/bluetooth/hci_conn.c       Thu Jan  1 01:00:00 1970
16635 +++ linux-2.4.18-mh9/net/bluetooth/hci_conn.c   Mon Aug 25 18:38:12 2003
16636 @@ -0,0 +1,441 @@
16637 +/*
16638 +   BlueZ - Bluetooth protocol stack for Linux
16639 +   Copyright (C) 2000-2001 Qualcomm Incorporated
16640 +
16641 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
16642 +
16643 +   This program is free software; you can redistribute it and/or modify
16644 +   it under the terms of the GNU General Public License version 2 as
16645 +   published by the Free Software Foundation;
16646 +
16647 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16648 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16649 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
16650 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16651 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16652 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16653 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16654 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16655 +
16656 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
16657 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
16658 +   SOFTWARE IS DISCLAIMED.
16659 +*/
16660 +
16661 +/*
16662 + * HCI Connection handling.
16663 + *
16664 + * $Id: hci_conn.c,v 1.5 2002/07/17 18:46:25 maxk Exp $
16665 + */
16666 +
16667 +#include <linux/config.h>
16668 +#include <linux/module.h>
16669 +
16670 +#include <linux/types.h>
16671 +#include <linux/errno.h>
16672 +#include <linux/kernel.h>
16673 +#include <linux/major.h>
16674 +#include <linux/sched.h>
16675 +#include <linux/slab.h>
16676 +#include <linux/poll.h>
16677 +#include <linux/fcntl.h>
16678 +#include <linux/init.h>
16679 +#include <linux/skbuff.h>
16680 +#include <linux/interrupt.h>
16681 +#include <linux/notifier.h>
16682 +#include <net/sock.h>
16683 +
16684 +#include <asm/system.h>
16685 +#include <asm/uaccess.h>
16686 +#include <asm/unaligned.h>
16687 +
16688 +#include <net/bluetooth/bluetooth.h>
16689 +#include <net/bluetooth/hci_core.h>
16690 +
16691 +#ifndef HCI_CORE_DEBUG
16692 +#undef  BT_DBG
16693 +#define BT_DBG( A... )
16694 +#endif
16695 +
16696 +void hci_acl_connect(struct hci_conn *conn)
16697 +{
16698 +       struct hci_dev *hdev = conn->hdev;
16699 +       struct inquiry_entry *ie;
16700 +       create_conn_cp cp;
16701 +
16702 +       BT_DBG("%p", conn);
16703 +
16704 +       conn->state = BT_CONNECT;
16705 +       conn->out   = 1;
16706 +       conn->link_mode = HCI_LM_MASTER;
16707 +
16708 +       memset(&cp, 0, sizeof(cp));
16709 +       bacpy(&cp.bdaddr, &conn->dst);
16710 +       cp.pscan_rep_mode = 0x01;
16711 +
16712 +       if ((ie = inquiry_cache_lookup(hdev, &conn->dst)) &&
16713 +                       inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
16714 +               cp.pscan_rep_mode = ie->info.pscan_rep_mode;
16715 +               cp.pscan_mode     = ie->info.pscan_mode;
16716 +               cp.clock_offset   = ie->info.clock_offset | __cpu_to_le16(0x8000);
16717 +       }
16718 +
16719 +       cp.pkt_type = __cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK);
16720 +       if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
16721 +               cp.role_switch  = 0x01;
16722 +       else
16723 +               cp.role_switch  = 0x00;
16724 +
16725 +       hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN,
16726 +                               CREATE_CONN_CP_SIZE, &cp);
16727 +}
16728 +
16729 +void hci_acl_disconn(struct hci_conn *conn, __u8 reason)
16730 +{
16731 +       disconnect_cp cp;
16732 +
16733 +       BT_DBG("%p", conn);
16734 +
16735 +       conn->state = BT_DISCONN;
16736 +
16737 +       cp.handle = __cpu_to_le16(conn->handle);
16738 +       cp.reason = reason;
16739 +       hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_DISCONNECT,
16740 +                               DISCONNECT_CP_SIZE, &cp);
16741 +}
16742 +
16743 +void hci_add_sco(struct hci_conn *conn, __u16 handle)
16744 +{
16745 +       struct hci_dev *hdev = conn->hdev;
16746 +       add_sco_cp cp;
16747 +
16748 +       BT_DBG("%p", conn);
16749 +
16750 +       conn->state = BT_CONNECT;
16751 +       conn->out = 1;
16752 +
16753 +       cp.pkt_type = __cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
16754 +       cp.handle   = __cpu_to_le16(handle);
16755 +
16756 +       hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ADD_SCO, ADD_SCO_CP_SIZE, &cp);
16757 +}
16758 +
16759 +static void hci_conn_timeout(unsigned long arg)
16760 +{
16761 +       struct hci_conn *conn = (void *)arg;
16762 +       struct hci_dev  *hdev = conn->hdev;
16763 +
16764 +       BT_DBG("conn %p state %d", conn, conn->state);
16765 +
16766 +       if (atomic_read(&conn->refcnt))
16767 +               return;
16768 +
16769 +       hci_dev_lock(hdev);
16770 +       if (conn->state == BT_CONNECTED)
16771 +               hci_acl_disconn(conn, 0x13);
16772 +       else
16773 +               conn->state = BT_CLOSED;
16774 +       hci_dev_unlock(hdev);
16775 +       return;
16776 +}
16777 +
16778 +static void hci_conn_init_timer(struct hci_conn *conn)
16779 +{
16780 +       init_timer(&conn->timer);
16781 +       conn->timer.function = hci_conn_timeout;
16782 +       conn->timer.data = (unsigned long)conn;
16783 +}
16784 +
16785 +struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
16786 +{
16787 +       struct hci_conn *conn;
16788 +
16789 +       BT_DBG("%s dst %s", hdev->name, batostr(dst));
16790 +
16791 +       if (!(conn = kmalloc(sizeof(struct hci_conn), GFP_ATOMIC)))
16792 +               return NULL;
16793 +       memset(conn, 0, sizeof(struct hci_conn));
16794 +
16795 +       bacpy(&conn->dst, dst);
16796 +       conn->type   = type;
16797 +       conn->hdev   = hdev;
16798 +       conn->state  = BT_OPEN;
16799 +
16800 +       skb_queue_head_init(&conn->data_q);
16801 +       hci_conn_init_timer(conn);
16802 +
16803 +       atomic_set(&conn->refcnt, 0);
16804 +
16805 +       hci_dev_hold(hdev);
16806 +
16807 +       if (hdev->notify)
16808 +               hdev->notify(hdev, HCI_NOTIFY_CONN_ADD, (unsigned long) conn);
16809 +
16810 +       tasklet_disable(&hdev->tx_task);
16811 +       conn_hash_add(hdev, conn);
16812 +       tasklet_enable(&hdev->tx_task);
16813 +
16814 +       return conn;
16815 +}
16816 +
16817 +int hci_conn_del(struct hci_conn *conn)
16818 +{
16819 +       struct hci_dev  *hdev = conn->hdev;
16820 +
16821 +       BT_DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
16822 +
16823 +       hci_conn_del_timer(conn);
16824 +
16825 +       if (conn->type == SCO_LINK) {
16826 +               struct hci_conn *acl = conn->link;
16827 +               if (acl) {
16828 +                       acl->link = NULL;
16829 +                       hci_conn_put(acl);
16830 +               }
16831 +       } else {
16832 +               struct hci_conn *sco = conn->link;
16833 +               if (sco)
16834 +                       sco->link = NULL;
16835 +
16836 +               /* Unacked frames */
16837 +               hdev->acl_cnt += conn->sent;
16838 +       }
16839 +
16840 +       tasklet_disable(&hdev->tx_task);
16841 +       conn_hash_del(hdev, conn);
16842 +       tasklet_enable(&hdev->tx_task);
16843 +
16844 +       skb_queue_purge(&conn->data_q);
16845 +
16846 +       if (hdev->notify)
16847 +               hdev->notify(hdev, HCI_NOTIFY_CONN_DEL, (unsigned long) conn);
16848 +
16849 +       hci_dev_put(hdev);
16850 +
16851 +       kfree(conn);
16852 +       return 0;
16853 +}
16854 +
16855 +struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
16856 +{
16857 +       int use_src = bacmp(src, BDADDR_ANY);
16858 +       struct hci_dev *hdev = NULL;
16859 +       struct list_head *p;
16860 +
16861 +       BT_DBG("%s -> %s", batostr(src), batostr(dst));
16862 +
16863 +       read_lock_bh(&hdev_list_lock);
16864 +
16865 +       list_for_each(p, &hdev_list) {
16866 +               struct hci_dev *d;
16867 +               d = list_entry(p, struct hci_dev, list);
16868 +
16869 +               if (!test_bit(HCI_UP, &d->flags))
16870 +                       continue;
16871 +
16872 +               /* Simple routing:
16873 +                *      No source address - find interface with bdaddr != dst
16874 +                *      Source address    - find interface with bdaddr == src
16875 +                */
16876 +
16877 +               if (use_src) {
16878 +                       if (!bacmp(&d->bdaddr, src)) {
16879 +                               hdev = d; break;
16880 +                       }
16881 +               } else {
16882 +                       if (bacmp(&d->bdaddr, dst)) {
16883 +                               hdev = d; break;
16884 +                       }
16885 +               }
16886 +       }
16887 +
16888 +       if (hdev)
16889 +               hci_dev_hold(hdev);
16890 +
16891 +       read_unlock_bh(&hdev_list_lock);
16892 +       return hdev;
16893 +}
16894 +
16895 +/* Create SCO or ACL connection.
16896 + * Device _must_ be locked */
16897 +struct hci_conn * hci_connect(struct hci_dev *hdev, int type, bdaddr_t *dst)
16898 +{
16899 +       struct hci_conn *acl;
16900 +
16901 +       BT_DBG("%s dst %s", hdev->name, batostr(dst));
16902 +
16903 +       if (!(acl = conn_hash_lookup_ba(hdev, ACL_LINK, dst))) {
16904 +               if (!(acl = hci_conn_add(hdev, ACL_LINK, dst)))
16905 +                       return NULL;
16906 +       }
16907 +
16908 +       hci_conn_hold(acl);
16909 +
16910 +       if (acl->state == BT_OPEN || acl->state == BT_CLOSED)
16911 +               hci_acl_connect(acl);
16912 +
16913 +       if (type == SCO_LINK) {
16914 +               struct hci_conn *sco;
16915 +
16916 +               if (!(sco = conn_hash_lookup_ba(hdev, SCO_LINK, dst))) {
16917 +                       if (!(sco = hci_conn_add(hdev, SCO_LINK, dst))) {
16918 +                               hci_conn_put(acl);
16919 +                               return NULL;
16920 +                       }
16921 +               }
16922 +               acl->link = sco;
16923 +               sco->link = acl;
16924 +
16925 +               hci_conn_hold(sco);
16926 +
16927 +               if (acl->state == BT_CONNECTED &&
16928 +                               (sco->state == BT_OPEN || sco->state == BT_CLOSED))
16929 +                       hci_add_sco(sco, acl->handle);
16930 +
16931 +               return sco;
16932 +       } else {
16933 +               return acl;
16934 +       }
16935 +}
16936 +
16937 +/* Authenticate remote device */
16938 +int hci_conn_auth(struct hci_conn *conn)
16939 +{
16940 +       BT_DBG("conn %p", conn);
16941 +
16942 +       if (conn->link_mode & HCI_LM_AUTH)
16943 +               return 1;
16944 +
16945 +       if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
16946 +               auth_requested_cp ar;
16947 +               ar.handle = __cpu_to_le16(conn->handle);
16948 +               hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_AUTH_REQUESTED,
16949 +                               AUTH_REQUESTED_CP_SIZE, &ar);
16950 +       }
16951 +       return 0;
16952 +}
16953 +
16954 +/* Enable encryption */
16955 +int hci_conn_encrypt(struct hci_conn *conn)
16956 +{
16957 +       BT_DBG("conn %p", conn);
16958 +
16959 +       if (conn->link_mode & HCI_LM_ENCRYPT)
16960 +               return 1;
16961 +
16962 +       if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend))
16963 +               return 0;
16964 +
16965 +       if (hci_conn_auth(conn)) {
16966 +               set_conn_encrypt_cp ce;
16967 +               ce.handle  = __cpu_to_le16(conn->handle);
16968 +               ce.encrypt = 1;
16969 +               hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT,
16970 +                               SET_CONN_ENCRYPT_CP_SIZE, &ce);
16971 +       }
16972 +       return 0;
16973 +}
16974 +
16975 +/* Drop all connection on the device */
16976 +void hci_conn_hash_flush(struct hci_dev *hdev)
16977 +{
16978 +       struct conn_hash *h = &hdev->conn_hash;
16979 +        struct list_head *p;
16980 +
16981 +       BT_DBG("hdev %s", hdev->name);
16982 +
16983 +       p = h->list.next;
16984 +       while (p != &h->list) {
16985 +               struct hci_conn *c;
16986 +
16987 +               c = list_entry(p, struct hci_conn, list);
16988 +               p = p->next;
16989 +
16990 +               c->state = BT_CLOSED;
16991 +
16992 +               hci_proto_disconn_ind(c, 0x16);
16993 +               hci_conn_del(c);
16994 +       }
16995 +}
16996 +
16997 +int hci_get_conn_list(unsigned long arg)
16998 +{
16999 +       struct hci_conn_list_req req, *cl;
17000 +       struct hci_conn_info *ci;
17001 +       struct hci_dev *hdev;
17002 +       struct list_head *p;
17003 +       int n = 0, size;
17004 +
17005 +       if (copy_from_user(&req, (void *) arg, sizeof(req)))
17006 +               return -EFAULT;
17007 +
17008 +       if (!(hdev = hci_dev_get(req.dev_id)))
17009 +               return -ENODEV;
17010 +
17011 +       size = req.conn_num * sizeof(struct hci_conn_info) + sizeof(req);
17012 +
17013 +       if (verify_area(VERIFY_WRITE, (void *)arg, size))
17014 +               return -EFAULT;
17015 +
17016 +       if (!(cl = (void *) kmalloc(size, GFP_KERNEL)))
17017 +               return -ENOMEM;
17018 +       ci = cl->conn_info;
17019 +
17020 +       hci_dev_lock_bh(hdev);
17021 +       list_for_each(p, &hdev->conn_hash.list) {
17022 +               register struct hci_conn *c;
17023 +               c = list_entry(p, struct hci_conn, list);
17024 +
17025 +               bacpy(&(ci + n)->bdaddr, &c->dst);
17026 +               (ci + n)->handle = c->handle;
17027 +               (ci + n)->type  = c->type;
17028 +               (ci + n)->out   = c->out;
17029 +               (ci + n)->state = c->state;
17030 +               (ci + n)->link_mode = c->link_mode;
17031 +               n++;
17032 +       }
17033 +       hci_dev_unlock_bh(hdev);
17034 +
17035 +       cl->dev_id = hdev->id;
17036 +       cl->conn_num = n;
17037 +       size = n * sizeof(struct hci_conn_info) + sizeof(req);
17038 +
17039 +       hci_dev_put(hdev);
17040 +
17041 +       copy_to_user((void *) arg, cl, size);
17042 +       kfree(cl);
17043 +
17044 +       return 0;
17045 +}
17046 +
17047 +int hci_get_conn_info(struct hci_dev *hdev, unsigned long arg)
17048 +{
17049 +       struct hci_conn_info_req req;
17050 +       struct hci_conn_info ci;
17051 +       struct hci_conn *conn;
17052 +       char *ptr = (void *) arg + sizeof(req);
17053 +
17054 +       if (copy_from_user(&req, (void *) arg, sizeof(req)))
17055 +               return -EFAULT;
17056 +
17057 +       if (verify_area(VERIFY_WRITE, ptr, sizeof(ci)))
17058 +               return -EFAULT;
17059 +
17060 +       hci_dev_lock_bh(hdev);
17061 +       conn = conn_hash_lookup_ba(hdev, req.type, &req.bdaddr);
17062 +       if (conn) {
17063 +               bacpy(&ci.bdaddr, &conn->dst);
17064 +               ci.handle = conn->handle;
17065 +               ci.type  = conn->type;
17066 +               ci.out   = conn->out;
17067 +               ci.state = conn->state;
17068 +               ci.link_mode = conn->link_mode;
17069 +       }
17070 +       hci_dev_unlock_bh(hdev);
17071 +
17072 +       if (!conn)
17073 +               return -ENOENT;
17074 +
17075 +       copy_to_user(ptr, &ci, sizeof(ci));
17076 +       return 0;
17077 +}
17078 diff -urN linux-2.4.18/net/bluetooth/hci_core.c linux-2.4.18-mh9/net/bluetooth/hci_core.c
17079 --- linux-2.4.18/net/bluetooth/hci_core.c       Fri Nov  9 23:21:21 2001
17080 +++ linux-2.4.18-mh9/net/bluetooth/hci_core.c   Mon Aug 25 18:38:12 2003
17081 @@ -25,11 +25,12 @@
17082  /*
17083   * BlueZ HCI Core.
17084   *
17085 - * $Id: hci_core.c,v 1.22 2001/08/03 04:19:50 maxk Exp $
17086 + * $Id: hci_core.c,v 1.14 2002/08/26 16:57:57 maxk Exp $
17087   */
17088
17089  #include <linux/config.h>
17090  #include <linux/module.h>
17091 +#include <linux/kmod.h>
17092
17093  #include <linux/types.h>
17094  #include <linux/errno.h>
17095 @@ -50,12 +51,11 @@
17096  #include <asm/unaligned.h>
17097
17098  #include <net/bluetooth/bluetooth.h>
17099 -#include <net/bluetooth/bluez.h>
17100  #include <net/bluetooth/hci_core.h>
17101
17102  #ifndef HCI_CORE_DEBUG
17103 -#undef  DBG
17104 -#define DBG( A... )
17105 +#undef  BT_DBG
17106 +#define BT_DBG( A... )
17107  #endif
17108
17109  static void hci_cmd_task(unsigned long arg);
17110 @@ -63,279 +63,69 @@
17111  static void hci_tx_task(unsigned long arg);
17112  static void hci_notify(struct hci_dev *hdev, int event);
17113
17114 -static rwlock_t hci_task_lock = RW_LOCK_UNLOCKED;
17115 +rwlock_t hci_task_lock = RW_LOCK_UNLOCKED;
17116
17117  /* HCI device list */
17118 -struct hci_dev *hdev_list[HCI_MAX_DEV];
17119 -spinlock_t hdev_list_lock;
17120 -#define GET_HDEV(a) (hdev_list[a])
17121 -
17122 -/* HCI protocol list */
17123 -struct hci_proto *hproto_list[HCI_MAX_PROTO];
17124 -#define GET_HPROTO(a) (hproto_list[a])
17125 +LIST_HEAD(hdev_list);
17126 +rwlock_t hdev_list_lock = RW_LOCK_UNLOCKED;
17127
17128 -/* HCI notifiers list */
17129 -struct notifier_block *hci_dev_notifier;
17130 -
17131 -/* HCI device notifications */
17132 -int hci_register_notifier(struct notifier_block *nb)
17133 -{
17134 -       int err, i;
17135 -       struct hci_dev *hdev;
17136 -
17137 -       if ((err = notifier_chain_register(&hci_dev_notifier, nb)))
17138 -               return err;
17139 -
17140 -       /* Notify about already registered devices */
17141 -       spin_lock(&hdev_list_lock);
17142 -       for (i = 0; i < HCI_MAX_DEV; i++) {
17143 -               if (!(hdev = GET_HDEV(i)))
17144 -                       continue;
17145 -               if (hdev->flags & HCI_UP)
17146 -                       (*nb->notifier_call)(nb, HCI_DEV_UP, hdev);
17147 -       }
17148 -       spin_unlock(&hdev_list_lock);
17149 -
17150 -       return 0;
17151 -}
17152 -
17153 -int hci_unregister_notifier(struct notifier_block *nb)
17154 -{
17155 -       return notifier_chain_unregister(&hci_dev_notifier, nb);
17156 -}
17157 -
17158 -static inline void hci_notify(struct hci_dev *hdev, int event)
17159 -{
17160 -       notifier_call_chain(&hci_dev_notifier, event, hdev);
17161 -}
17162 -
17163 -/* Get HCI device by index (device is locked on return)*/
17164 -struct hci_dev *hci_dev_get(int index)
17165 -{
17166 -       struct hci_dev *hdev;
17167 -       DBG("%d", index);
17168 -
17169 -       if (index < 0 || index >= HCI_MAX_DEV)
17170 -               return NULL;
17171 -
17172 -       spin_lock(&hdev_list_lock);
17173 -       if ((hdev = GET_HDEV(index)))
17174 -               hci_dev_hold(hdev);
17175 -       spin_unlock(&hdev_list_lock);
17176 -
17177 -       return hdev;
17178 -}
17179 -
17180 -/* Flush inquiry cache */
17181 -void inquiry_cache_flush(struct inquiry_cache *cache)
17182 -{
17183 -       struct inquiry_entry *next = cache->list, *e;
17184 -
17185 -       DBG("cache %p", cache);
17186 -
17187 -       cache->list = NULL;
17188 -       while ((e = next)) {
17189 -               next = e->next;
17190 -               kfree(e);
17191 -       }
17192 -}
17193 -
17194 -/* Lookup by bdaddr.
17195 - * Cache must be locked. */
17196 -static struct inquiry_entry * __inquiry_cache_lookup(struct inquiry_cache *cache, bdaddr_t *bdaddr)
17197 -{
17198 -       struct inquiry_entry *e;
17199 -
17200 -       DBG("cache %p, %s", cache, batostr(bdaddr));
17201 -
17202 -       for (e = cache->list; e; e = e->next)
17203 -               if (!bacmp(&e->info.bdaddr, bdaddr))
17204 -                       break;
17205 -
17206 -       return e;
17207 -}
17208 -
17209 -static void inquiry_cache_update(struct inquiry_cache *cache, inquiry_info *info)
17210 -{
17211 -       struct inquiry_entry *e;
17212 -
17213 -       DBG("cache %p, %s", cache, batostr(&info->bdaddr));
17214 -
17215 -       inquiry_cache_lock(cache);
17216 -
17217 -       if (!(e = __inquiry_cache_lookup(cache, &info->bdaddr))) {
17218 -               /* Entry not in the cache. Add new one. */
17219 -               if (!(e = kmalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
17220 -                       goto unlock;
17221 -               memset(e, 0, sizeof(struct inquiry_entry));
17222 -               e->next     = cache->list;
17223 -               cache->list = e;
17224 -       }
17225 -
17226 -       memcpy(&e->info, info, sizeof(inquiry_info));
17227 -       e->timestamp = jiffies;
17228 -       cache->timestamp = jiffies;
17229 -unlock:
17230 -       inquiry_cache_unlock(cache);
17231 -}
17232 -
17233 -static int inquiry_cache_dump(struct inquiry_cache *cache, int num, __u8 *buf)
17234 -{
17235 -       inquiry_info *info = (inquiry_info *) buf;
17236 -       struct inquiry_entry *e;
17237 -       int copied = 0;
17238 +/* HCI protocols */
17239 +#define HCI_MAX_PROTO  2
17240 +struct hci_proto *hci_proto[HCI_MAX_PROTO];
17241
17242 -       inquiry_cache_lock(cache);
17243 -
17244 -       for (e = cache->list; e && copied < num; e = e->next, copied++)
17245 -               memcpy(info++, &e->info, sizeof(inquiry_info));
17246 +/* HCI notifiers list */
17247 +static struct notifier_block *hci_notifier;
17248
17249 -       inquiry_cache_unlock(cache);
17250
17251 -       DBG("cache %p, copied %d", cache, copied);
17252 -       return copied;
17253 -}
17254 +/* ---- HCI notifications ---- */
17255
17256 -/* --------- BaseBand connections --------- */
17257 -static struct hci_conn *hci_conn_add(struct hci_dev *hdev, __u16 handle, __u8 type, bdaddr_t *dst)
17258 +int hci_register_notifier(struct notifier_block *nb)
17259  {
17260 -       struct hci_conn *conn;
17261 -
17262 -       DBG("%s handle %d dst %s", hdev->name, handle, batostr(dst));
17263 -
17264 -       if ( conn_hash_lookup(&hdev->conn_hash, handle)) {
17265 -               ERR("%s handle 0x%x already exists", hdev->name, handle);
17266 -               return NULL;
17267 -       }
17268 -
17269 -       if (!(conn = kmalloc(sizeof(struct hci_conn), GFP_ATOMIC)))
17270 -               return NULL;
17271 -       memset(conn, 0, sizeof(struct hci_conn));
17272 -
17273 -       bacpy(&conn->dst, dst);
17274 -       conn->handle = handle;
17275 -       conn->type   = type;
17276 -       conn->hdev   = hdev;
17277 -
17278 -       skb_queue_head_init(&conn->data_q);
17279 -
17280 -       hci_dev_hold(hdev);
17281 -       conn_hash_add(&hdev->conn_hash, handle, conn);
17282 -
17283 -       return conn;
17284 +       return notifier_chain_register(&hci_notifier, nb);
17285  }
17286
17287 -static int hci_conn_del(struct hci_dev *hdev, struct hci_conn *conn)
17288 +int hci_unregister_notifier(struct notifier_block *nb)
17289  {
17290 -       DBG("%s conn %p handle %d", hdev->name, conn, conn->handle);
17291 -
17292 -       conn_hash_del(&hdev->conn_hash, conn);
17293 -       hci_dev_put(hdev);
17294 -
17295 -       /* Unacked frames */
17296 -       hdev->acl_cnt += conn->sent;
17297 -
17298 -       skb_queue_purge(&conn->data_q);
17299 -
17300 -       kfree(conn);
17301 -       return 0;
17302 +       return notifier_chain_unregister(&hci_notifier, nb);
17303  }
17304
17305 -/* Drop all connection on the device */
17306 -static void hci_conn_hash_flush(struct hci_dev *hdev)
17307 +void hci_notify(struct hci_dev *hdev, int event)
17308  {
17309 -       struct conn_hash *h = &hdev->conn_hash;
17310 -       struct hci_proto *hp;
17311 -        struct list_head *p;
17312 -
17313 -       DBG("hdev %s", hdev->name);
17314 -
17315 -       p = h->list.next;
17316 -       while (p != &h->list) {
17317 -               struct hci_conn *c;
17318 -
17319 -               c = list_entry(p, struct hci_conn, list);
17320 -               p = p->next;
17321 -
17322 -               if (c->type == ACL_LINK) {
17323 -                       /* ACL link notify L2CAP layer */
17324 -                       if ((hp = GET_HPROTO(HCI_PROTO_L2CAP)) && hp->disconn_ind)
17325 -                               hp->disconn_ind(c, 0x16);
17326 -               } else {
17327 -                       /* SCO link (no notification) */
17328 -               }
17329 -
17330 -               hci_conn_del(hdev, c);
17331 -       }
17332 +       notifier_call_chain(&hci_notifier, event, hdev);
17333  }
17334
17335 -int hci_connect(struct hci_dev *hdev, bdaddr_t *bdaddr)
17336 -{
17337 -       struct inquiry_cache *cache = &hdev->inq_cache;
17338 -       struct inquiry_entry *e;
17339 -       create_conn_cp cc;
17340 -       __u16 clock_offset;
17341 -
17342 -       DBG("%s bdaddr %s", hdev->name, batostr(bdaddr));
17343 -
17344 -       if (!(hdev->flags & HCI_UP))
17345 -               return -ENODEV;
17346 -
17347 -       inquiry_cache_lock_bh(cache);
17348 -
17349 -       if (!(e = __inquiry_cache_lookup(cache, bdaddr)) || inquiry_entry_age(e) > INQUIRY_ENTRY_AGE_MAX) {
17350 -               cc.pscan_rep_mode = 0;
17351 -               cc.pscan_mode     = 0;
17352 -               clock_offset      = 0;
17353 -       } else {
17354 -               cc.pscan_rep_mode = e->info.pscan_rep_mode;
17355 -               cc.pscan_mode     = e->info.pscan_mode;
17356 -               clock_offset      = __le16_to_cpu(e->info.clock_offset) & 0x8000;
17357 -       }
17358 -
17359 -       inquiry_cache_unlock_bh(cache);
17360 -
17361 -       bacpy(&cc.bdaddr, bdaddr);
17362 -       cc.pkt_type     = __cpu_to_le16(hdev->pkt_type);
17363 -       cc.clock_offset = __cpu_to_le16(clock_offset);
17364 -
17365 -       if (lmp_rswitch_capable(hdev))
17366 -               cc.role_switch  = 0x01;
17367 -       else
17368 -               cc.role_switch  = 0x00;
17369 -
17370 -       hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CREATE_CONN, CREATE_CONN_CP_SIZE, &cc);
17371 +/* ---- HCI hotplug support ---- */
17372
17373 -       return 0;
17374 -}
17375 +#ifdef CONFIG_HOTPLUG
17376
17377 -int hci_disconnect(struct hci_conn *conn, __u8 reason)
17378 +static int hci_run_hotplug(char *dev, char *action)
17379  {
17380 -       disconnect_cp dc;
17381 -
17382 -       DBG("conn %p handle %d", conn, conn->handle);
17383 +       char *argv[3], *envp[5], dstr[20], astr[32];
17384
17385 -       dc.handle = __cpu_to_le16(conn->handle);
17386 -       dc.reason = reason;
17387 -       hci_send_cmd(conn->hdev, OGF_LINK_CTL, OCF_DISCONNECT, DISCONNECT_CP_SIZE, &dc);
17388 +       sprintf(dstr, "DEVICE=%s", dev);
17389 +       sprintf(astr, "ACTION=%s", action);
17390
17391 -       return 0;
17392 -}
17393 +        argv[0] = hotplug_path;
17394 +        argv[1] = "bluetooth";
17395 +        argv[2] = NULL;
17396
17397 -/* --------- HCI request handling ------------ */
17398 -static inline void hci_req_lock(struct hci_dev *hdev)
17399 -{
17400 -       down(&hdev->req_lock);
17401 +       envp[0] = "HOME=/";
17402 +       envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
17403 +       envp[2] = dstr;
17404 +       envp[3] = astr;
17405 +       envp[4] = NULL;
17406 +
17407 +       return call_usermodehelper(argv[0], argv, envp);
17408  }
17409 +#else
17410 +#define hci_run_hotplug(A...)
17411 +#endif
17412
17413 -static inline void hci_req_unlock(struct hci_dev *hdev)
17414 -{
17415 -       up(&hdev->req_lock);
17416 -}
17417 +/* ---- HCI requests ---- */
17418
17419 -static inline void hci_req_complete(struct hci_dev *hdev, int result)
17420 +void hci_req_complete(struct hci_dev *hdev, int result)
17421  {
17422 -       DBG("%s result 0x%2.2x", hdev->name, result);
17423 +       BT_DBG("%s result 0x%2.2x", hdev->name, result);
17424
17425         if (hdev->req_status == HCI_REQ_PEND) {
17426                 hdev->req_result = result;
17427 @@ -344,9 +134,9 @@
17428         }
17429  }
17430
17431 -static inline void hci_req_cancel(struct hci_dev *hdev, int err)
17432 +void hci_req_cancel(struct hci_dev *hdev, int err)
17433  {
17434 -       DBG("%s err 0x%2.2x", hdev->name, err);
17435 +       BT_DBG("%s err 0x%2.2x", hdev->name, err);
17436
17437         if (hdev->req_status == HCI_REQ_PEND) {
17438                 hdev->req_result = err;
17439 @@ -356,23 +146,22 @@
17440  }
17441
17442  /* Execute request and wait for completion. */
17443 -static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
17444 -                         unsigned long opt, __u32 timeout)
17445 +static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), unsigned long opt, __u32 timeout)
17446  {
17447         DECLARE_WAITQUEUE(wait, current);
17448         int err = 0;
17449
17450 -       DBG("%s start", hdev->name);
17451 +       BT_DBG("%s start", hdev->name);
17452
17453         hdev->req_status = HCI_REQ_PEND;
17454
17455         add_wait_queue(&hdev->req_wait_q, &wait);
17456 -       current->state = TASK_INTERRUPTIBLE;
17457 +       set_current_state(TASK_INTERRUPTIBLE);
17458
17459         req(hdev, opt);
17460         schedule_timeout(timeout);
17461
17462 -       current->state = TASK_RUNNING;
17463 +       set_current_state(TASK_RUNNING);
17464         remove_wait_queue(&hdev->req_wait_q, &wait);
17465
17466         if (signal_pending(current))
17467 @@ -394,7 +183,7 @@
17468
17469         hdev->req_status = hdev->req_result = 0;
17470
17471 -       DBG("%s end: err %d", hdev->name, err);
17472 +       BT_DBG("%s end: err %d", hdev->name, err);
17473
17474         return err;
17475  }
17476 @@ -412,10 +201,9 @@
17477         return ret;
17478  }
17479
17480 -/* --------- HCI requests ---------- */
17481  static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
17482  {
17483 -       DBG("%s %ld", hdev->name, opt);
17484 +       BT_DBG("%s %ld", hdev->name, opt);
17485
17486         /* Reset device */
17487         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
17488 @@ -423,10 +211,10 @@
17489
17490  static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
17491  {
17492 -       set_event_flt_cp ec;
17493 +       set_event_flt_cp ef;
17494         __u16 param;
17495
17496 -       DBG("%s %ld", hdev->name, opt);
17497 +       BT_DBG("%s %ld", hdev->name, opt);
17498
17499         /* Mandatory initialization */
17500
17501 @@ -436,14 +224,30 @@
17502         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
17503         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL);
17504
17505 +#if 0
17506 +       /* Host buffer size */
17507 +       {
17508 +               host_buffer_size_cp bs;
17509 +               bs.acl_mtu = __cpu_to_le16(HCI_MAX_ACL_SIZE);
17510 +               bs.sco_mtu = HCI_MAX_SCO_SIZE;
17511 +               bs.acl_max_pkt = __cpu_to_le16(0xffff);
17512 +               bs.sco_max_pkt = __cpu_to_le16(0xffff);
17513 +               hci_send_cmd(hdev, OGF_HOST_CTL, OCF_HOST_BUFFER_SIZE,
17514 +                               HOST_BUFFER_SIZE_CP_SIZE, &bs);
17515 +       }
17516 +#endif
17517 +
17518         /* Read BD Address */
17519         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, NULL);
17520
17521 +        /* Read Voice Setting */
17522 +       hci_send_cmd(hdev, OGF_HOST_CTL, OCF_READ_VOICE_SETTING, 0, NULL);
17523 +
17524         /* Optional initialization */
17525
17526         /* Clear Event Filters */
17527 -       ec.flt_type  = FLT_CLEAR_ALL;
17528 -       hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, 1, &ec);
17529 +       ef.flt_type  = FLT_CLEAR_ALL;
17530 +       hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, 1, &ef);
17531
17532         /* Page timeout ~20 secs */
17533         param = __cpu_to_le16(0x8000);
17534 @@ -458,7 +262,7 @@
17535  {
17536         __u8 scan = opt;
17537
17538 -       DBG("%s %x", hdev->name, scan);
17539 +       BT_DBG("%s %x", hdev->name, scan);
17540
17541         /* Inquiry and Page scans */
17542         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, &scan);
17543 @@ -468,116 +272,272 @@
17544  {
17545         __u8 auth = opt;
17546
17547 -       DBG("%s %x", hdev->name, auth);
17548 +       BT_DBG("%s %x", hdev->name, auth);
17549
17550         /* Authentication */
17551         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE, 1, &auth);
17552  }
17553
17554 -static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
17555 +static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
17556  {
17557 -       struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
17558 -       inquiry_cp ic;
17559 +       __u8 encrypt = opt;
17560
17561 -       DBG("%s", hdev->name);
17562 +       BT_DBG("%s %x", hdev->name, encrypt);
17563
17564 -       /* Start Inquiry */
17565 -       memcpy(&ic.lap, &ir->lap, 3);
17566 -       ic.lenght  = ir->length;
17567 -       ic.num_rsp = ir->num_rsp;
17568 -       hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, INQUIRY_CP_SIZE, &ic);
17569 +       /* Authentication */
17570 +       hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE, 1, &encrypt);
17571  }
17572
17573 -/* HCI ioctl helpers */
17574 -int hci_dev_open(__u16 dev)
17575 +/* Get HCI device by index.
17576 + * Device is locked on return. */
17577 +struct hci_dev *hci_dev_get(int index)
17578  {
17579         struct hci_dev *hdev;
17580 -       int ret = 0;
17581 -
17582 -       if (!(hdev = hci_dev_get(dev)))
17583 -               return -ENODEV;
17584 +       struct list_head *p;
17585
17586 -       DBG("%s %p", hdev->name, hdev);
17587 +       BT_DBG("%d", index);
17588
17589 -       hci_req_lock(hdev);
17590 +       if (index < 0)
17591 +               return NULL;
17592
17593 -       if (hdev->flags & HCI_UP) {
17594 -               ret = -EALREADY;
17595 -               goto done;
17596 +       read_lock(&hdev_list_lock);
17597 +       list_for_each(p, &hdev_list) {
17598 +               hdev = list_entry(p, struct hci_dev, list);
17599 +               if (hdev->id == index) {
17600 +                       hci_dev_hold(hdev);
17601 +                       goto done;
17602 +               }
17603         }
17604 +       hdev = NULL;
17605 +done:
17606 +       read_unlock(&hdev_list_lock);
17607 +       return hdev;
17608 +}
17609
17610 -       if (hdev->open(hdev)) {
17611 -               ret = -EIO;
17612 -               goto done;
17613 -       }
17614 +/* ---- Inquiry support ---- */
17615 +void inquiry_cache_flush(struct hci_dev *hdev)
17616 +{
17617 +       struct inquiry_cache *cache = &hdev->inq_cache;
17618 +       struct inquiry_entry *next  = cache->list, *e;
17619
17620 -       if (hdev->flags & HCI_NORMAL) {
17621 -               atomic_set(&hdev->cmd_cnt, 1);
17622 -               hdev->flags |= HCI_INIT;
17623 +       BT_DBG("cache %p", cache);
17624
17625 -               //__hci_request(hdev, hci_reset_req, 0, HZ);
17626 -               ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
17627 -
17628 -               hdev->flags &= ~HCI_INIT;
17629 +       cache->list = NULL;
17630 +       while ((e = next)) {
17631 +               next = e->next;
17632 +               kfree(e);
17633         }
17634 +}
17635
17636 -       if (!ret) {
17637 -               hdev->flags |= HCI_UP;
17638 -               hci_notify(hdev, HCI_DEV_UP);
17639 -       } else {
17640 -               /* Init failed, cleanup */
17641 -               tasklet_kill(&hdev->rx_task);
17642 -               tasklet_kill(&hdev->tx_task);
17643 -               tasklet_kill(&hdev->cmd_task);
17644 +struct inquiry_entry *inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
17645 +{
17646 +       struct inquiry_cache *cache = &hdev->inq_cache;
17647 +       struct inquiry_entry *e;
17648
17649 -               skb_queue_purge(&hdev->cmd_q);
17650 -               skb_queue_purge(&hdev->rx_q);
17651 +       BT_DBG("cache %p, %s", cache, batostr(bdaddr));
17652
17653 -               if (hdev->flush)
17654 -                       hdev->flush(hdev);
17655 +       for (e = cache->list; e; e = e->next)
17656 +               if (!bacmp(&e->info.bdaddr, bdaddr))
17657 +                       break;
17658 +       return e;
17659 +}
17660
17661 -               if (hdev->sent_cmd) {
17662 -                       kfree_skb(hdev->sent_cmd);
17663 -                       hdev->sent_cmd = NULL;
17664 -               }
17665 +void inquiry_cache_update(struct hci_dev *hdev, inquiry_info *info)
17666 +{
17667 +       struct inquiry_cache *cache = &hdev->inq_cache;
17668 +       struct inquiry_entry *e;
17669
17670 -               hdev->close(hdev);
17671 -       }
17672 +       BT_DBG("cache %p, %s", cache, batostr(&info->bdaddr));
17673
17674 -done:
17675 -       hci_req_unlock(hdev);
17676 -       hci_dev_put(hdev);
17677 +       if (!(e = inquiry_cache_lookup(hdev, &info->bdaddr))) {
17678 +               /* Entry not in the cache. Add new one. */
17679 +               if (!(e = kmalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
17680 +                       return;
17681 +               memset(e, 0, sizeof(struct inquiry_entry));
17682 +               e->next     = cache->list;
17683 +               cache->list = e;
17684 +       }
17685
17686 -       return ret;
17687 +       memcpy(&e->info, info, sizeof(inquiry_info));
17688 +       e->timestamp = jiffies;
17689 +       cache->timestamp = jiffies;
17690  }
17691
17692 -int hci_dev_close(__u16 dev)
17693 +int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
17694  {
17695 -       struct hci_dev *hdev;
17696 -
17697 -       if (!(hdev = hci_dev_get(dev)))
17698 -               return -ENODEV;
17699 +       struct inquiry_cache *cache = &hdev->inq_cache;
17700 +       inquiry_info *info = (inquiry_info *) buf;
17701 +       struct inquiry_entry *e;
17702 +       int copied = 0;
17703
17704 -       DBG("%s %p", hdev->name, hdev);
17705 +       for (e = cache->list; e && copied < num; e = e->next, copied++)
17706 +               memcpy(info++, &e->info, sizeof(inquiry_info));
17707
17708 -       hci_req_cancel(hdev, ENODEV);
17709 -       hci_req_lock(hdev);
17710 +       BT_DBG("cache %p, copied %d", cache, copied);
17711 +       return copied;
17712 +}
17713
17714 -       if (!(hdev->flags & HCI_UP))
17715 -               goto done;
17716 +static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
17717 +{
17718 +       struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
17719 +       inquiry_cp ic;
17720
17721 -       /* Kill RX and TX tasks */
17722 -       tasklet_kill(&hdev->rx_task);
17723 -       tasklet_kill(&hdev->tx_task);
17724 +       BT_DBG("%s", hdev->name);
17725
17726 -       inquiry_cache_flush(&hdev->inq_cache);
17727 +       if (test_bit(HCI_INQUIRY, &hdev->flags))
17728 +               return;
17729
17730 -       hci_conn_hash_flush(hdev);
17731 +       /* Start Inquiry */
17732 +       memcpy(&ic.lap, &ir->lap, 3);
17733 +       ic.length  = ir->length;
17734 +       ic.num_rsp = ir->num_rsp;
17735 +       hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, INQUIRY_CP_SIZE, &ic);
17736 +}
17737
17738 -       /* Clear flags */
17739 -       hdev->flags &= HCI_SOCK;
17740 -       hdev->flags |= HCI_NORMAL;
17741 +int hci_inquiry(unsigned long arg)
17742 +{
17743 +       struct hci_inquiry_req ir;
17744 +       struct hci_dev *hdev;
17745 +       int err = 0, do_inquiry = 0, max_rsp;
17746 +       long timeo;
17747 +       __u8 *buf, *ptr;
17748
17749 +       ptr = (void *) arg;
17750 +       if (copy_from_user(&ir, ptr, sizeof(ir)))
17751 +               return -EFAULT;
17752 +
17753 +       if (!(hdev = hci_dev_get(ir.dev_id)))
17754 +               return -ENODEV;
17755 +
17756 +       hci_dev_lock_bh(hdev);
17757 +       if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
17758 +                                       ir.flags & IREQ_CACHE_FLUSH) {
17759 +               inquiry_cache_flush(hdev);
17760 +               do_inquiry = 1;
17761 +       }
17762 +       hci_dev_unlock_bh(hdev);
17763 +
17764 +       timeo = ir.length * 2 * HZ;
17765 +       if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
17766 +               goto done;
17767 +
17768 +       /* for unlimited number of responses we will use buffer with 255 entries */
17769 +       max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
17770 +
17771 +       /* cache_dump can't sleep. Therefore we allocate temp buffer and then
17772 +        * copy it to the user space.
17773 +        */
17774 +       if (!(buf = kmalloc(sizeof(inquiry_info) * max_rsp, GFP_KERNEL))) {
17775 +               err = -ENOMEM;
17776 +               goto done;
17777 +       }
17778 +
17779 +       hci_dev_lock_bh(hdev);
17780 +       ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
17781 +       hci_dev_unlock_bh(hdev);
17782 +
17783 +       BT_DBG("num_rsp %d", ir.num_rsp);
17784 +
17785 +       if (!verify_area(VERIFY_WRITE, ptr, sizeof(ir) +
17786 +                               (sizeof(inquiry_info) * ir.num_rsp))) {
17787 +               copy_to_user(ptr, &ir, sizeof(ir));
17788 +               ptr += sizeof(ir);
17789 +               copy_to_user(ptr, buf, sizeof(inquiry_info) * ir.num_rsp);
17790 +       } else
17791 +               err = -EFAULT;
17792 +
17793 +       kfree(buf);
17794 +
17795 +done:
17796 +       hci_dev_put(hdev);
17797 +       return err;
17798 +}
17799 +
17800 +/* ---- HCI ioctl helpers ---- */
17801 +
17802 +int hci_dev_open(__u16 dev)
17803 +{
17804 +       struct hci_dev *hdev;
17805 +       int ret = 0;
17806 +
17807 +       if (!(hdev = hci_dev_get(dev)))
17808 +               return -ENODEV;
17809 +
17810 +       BT_DBG("%s %p", hdev->name, hdev);
17811 +
17812 +       hci_req_lock(hdev);
17813 +
17814 +       if (test_bit(HCI_UP, &hdev->flags)) {
17815 +               ret = -EALREADY;
17816 +               goto done;
17817 +       }
17818 +
17819 +       if (hdev->open(hdev)) {
17820 +               ret = -EIO;
17821 +               goto done;
17822 +       }
17823 +
17824 +       if (!test_bit(HCI_RAW, &hdev->flags)) {
17825 +               atomic_set(&hdev->cmd_cnt, 1);
17826 +               set_bit(HCI_INIT, &hdev->flags);
17827 +
17828 +               //__hci_request(hdev, hci_reset_req, 0, HZ);
17829 +               ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
17830 +
17831 +               clear_bit(HCI_INIT, &hdev->flags);
17832 +       }
17833 +
17834 +       if (!ret) {
17835 +               set_bit(HCI_UP, &hdev->flags);
17836 +               hci_notify(hdev, HCI_DEV_UP);
17837 +       } else {
17838 +               /* Init failed, cleanup */
17839 +               tasklet_kill(&hdev->rx_task);
17840 +               tasklet_kill(&hdev->tx_task);
17841 +               tasklet_kill(&hdev->cmd_task);
17842 +
17843 +               skb_queue_purge(&hdev->cmd_q);
17844 +               skb_queue_purge(&hdev->rx_q);
17845 +
17846 +               if (hdev->flush)
17847 +                       hdev->flush(hdev);
17848 +
17849 +               if (hdev->sent_cmd) {
17850 +                       kfree_skb(hdev->sent_cmd);
17851 +                       hdev->sent_cmd = NULL;
17852 +               }
17853 +
17854 +               hdev->close(hdev);
17855 +               hdev->flags = 0;
17856 +       }
17857 +
17858 +done:
17859 +       hci_req_unlock(hdev);
17860 +       hci_dev_put(hdev);
17861 +       return ret;
17862 +}
17863 +
17864 +static int hci_dev_do_close(struct hci_dev *hdev)
17865 +{
17866 +       BT_DBG("%s %p", hdev->name, hdev);
17867 +
17868 +       hci_req_cancel(hdev, ENODEV);
17869 +       hci_req_lock(hdev);
17870 +
17871 +       if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
17872 +               hci_req_unlock(hdev);
17873 +               return 0;
17874 +       }
17875 +
17876 +       /* Kill RX and TX tasks */
17877 +       tasklet_kill(&hdev->rx_task);
17878 +       tasklet_kill(&hdev->tx_task);
17879 +
17880 +       hci_dev_lock_bh(hdev);
17881 +       inquiry_cache_flush(hdev);
17882 +       hci_conn_hash_flush(hdev);
17883 +       hci_dev_unlock_bh(hdev);
17884 +
17885         hci_notify(hdev, HCI_DEV_DOWN);
17886
17887         if (hdev->flush)
17888 @@ -586,9 +546,9 @@
17889         /* Reset device */
17890         skb_queue_purge(&hdev->cmd_q);
17891         atomic_set(&hdev->cmd_cnt, 1);
17892 -       hdev->flags |= HCI_INIT;
17893 -       __hci_request(hdev, hci_reset_req, 0, HZ);
17894 -       hdev->flags &= ~HCI_INIT;
17895 +       set_bit(HCI_INIT, &hdev->flags);
17896 +       __hci_request(hdev, hci_reset_req, 0, HZ/4);
17897 +       clear_bit(HCI_INIT, &hdev->flags);
17898
17899         /* Kill cmd task */
17900         tasklet_kill(&hdev->cmd_task);
17901 @@ -605,17 +565,28 @@
17902         }
17903
17904         /* After this point our queues are empty
17905 -        * and no tasks are scheduled.
17906 -        */
17907 +        * and no tasks are scheduled. */
17908         hdev->close(hdev);
17909
17910 -done:
17911 -       hci_req_unlock(hdev);
17912 -       hci_dev_put(hdev);
17913 +       /* Clear flags */
17914 +       hdev->flags = 0;
17915
17916 +       hci_req_unlock(hdev);
17917         return 0;
17918  }
17919
17920 +int hci_dev_close(__u16 dev)
17921 +{
17922 +       struct hci_dev *hdev;
17923 +       int err;
17924 +
17925 +       if (!(hdev = hci_dev_get(dev)))
17926 +               return -ENODEV;
17927 +       err = hci_dev_do_close(hdev);
17928 +       hci_dev_put(hdev);
17929 +       return err;
17930 +}
17931 +
17932  int hci_dev_reset(__u16 dev)
17933  {
17934         struct hci_dev *hdev;
17935 @@ -627,16 +598,17 @@
17936         hci_req_lock(hdev);
17937         tasklet_disable(&hdev->tx_task);
17938
17939 -       if (!(hdev->flags & HCI_UP))
17940 +       if (!test_bit(HCI_UP, &hdev->flags))
17941                 goto done;
17942
17943         /* Drop queues */
17944         skb_queue_purge(&hdev->rx_q);
17945         skb_queue_purge(&hdev->cmd_q);
17946
17947 -       inquiry_cache_flush(&hdev->inq_cache);
17948 -
17949 +       hci_dev_lock_bh(hdev);
17950 +       inquiry_cache_flush(hdev);
17951         hci_conn_hash_flush(hdev);
17952 +       hci_dev_unlock_bh(hdev);
17953
17954         if (hdev->flush)
17955                 hdev->flush(hdev);
17956 @@ -650,7 +622,6 @@
17957         tasklet_enable(&hdev->tx_task);
17958         hci_req_unlock(hdev);
17959         hci_dev_put(hdev);
17960 -
17961         return ret;
17962  }
17963
17964 @@ -669,30 +640,11 @@
17965         return ret;
17966  }
17967
17968 -int hci_dev_setauth(unsigned long arg)
17969 -{
17970 -       struct hci_dev *hdev;
17971 -       struct hci_dev_req dr;
17972 -       int ret = 0;
17973 -
17974 -       if (copy_from_user(&dr, (void *) arg, sizeof(dr)))
17975 -               return -EFAULT;
17976 -
17977 -       if (!(hdev = hci_dev_get(dr.dev_id)))
17978 -               return -ENODEV;
17979 -
17980 -       ret = hci_request(hdev, hci_auth_req, dr.dev_opt, HCI_INIT_TIMEOUT);
17981 -
17982 -       hci_dev_put(hdev);
17983 -
17984 -       return ret;
17985 -}
17986 -
17987 -int hci_dev_setscan(unsigned long arg)
17988 +int hci_dev_cmd(unsigned int cmd, unsigned long arg)
17989  {
17990         struct hci_dev *hdev;
17991         struct hci_dev_req dr;
17992 -       int ret = 0;
17993 +       int err = 0;
17994
17995         if (copy_from_user(&dr, (void *) arg, sizeof(dr)))
17996                 return -EFAULT;
17997 @@ -700,48 +652,78 @@
17998         if (!(hdev = hci_dev_get(dr.dev_id)))
17999                 return -ENODEV;
18000
18001 -       ret = hci_request(hdev, hci_scan_req, dr.dev_opt, HCI_INIT_TIMEOUT);
18002 -
18003 -       hci_dev_put(hdev);
18004 +       switch (cmd) {
18005 +       case HCISETAUTH:
18006 +               err = hci_request(hdev, hci_auth_req, dr.dev_opt, HCI_INIT_TIMEOUT);
18007 +               break;
18008
18009 -       return ret;
18010 -}
18011 +       case HCISETENCRYPT:
18012 +               if (!lmp_encrypt_capable(hdev)) {
18013 +                       err = -EOPNOTSUPP;
18014 +                       break;
18015 +               }
18016
18017 -int hci_dev_setptype(unsigned long arg)
18018 -{
18019 -       struct hci_dev *hdev;
18020 -       struct hci_dev_req dr;
18021 -       int ret = 0;
18022 +               if (!test_bit(HCI_AUTH, &hdev->flags)) {
18023 +                       /* Auth must be enabled first */
18024 +                       err = hci_request(hdev, hci_auth_req,
18025 +                                       dr.dev_opt, HCI_INIT_TIMEOUT);
18026 +                       if (err)
18027 +                               break;
18028 +               }
18029 +
18030 +               err = hci_request(hdev, hci_encrypt_req,
18031 +                                       dr.dev_opt, HCI_INIT_TIMEOUT);
18032 +               break;
18033 +
18034 +       case HCISETSCAN:
18035 +               err = hci_request(hdev, hci_scan_req, dr.dev_opt, HCI_INIT_TIMEOUT);
18036 +               break;
18037 +
18038 +       case HCISETPTYPE:
18039 +               hdev->pkt_type = (__u16) dr.dev_opt;
18040 +               break;
18041 +
18042 +       case HCISETLINKPOL:
18043 +               hdev->link_policy = (__u16) dr.dev_opt;
18044 +               break;
18045
18046 -       if (copy_from_user(&dr, (void *) arg, sizeof(dr)))
18047 -               return -EFAULT;
18048 +       case HCISETLINKMODE:
18049 +               hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT);
18050 +               break;
18051
18052 -       if (!(hdev = hci_dev_get(dr.dev_id)))
18053 -               return -ENODEV;
18054 +       case HCISETACLMTU:
18055 +               hdev->acl_mtu  = *((__u16 *)&dr.dev_opt + 1);
18056 +               hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0);
18057 +               break;
18058
18059 -       hdev->pkt_type = (__u16) dr.dev_opt;
18060 +       case HCISETSCOMTU:
18061 +               hdev->sco_mtu  = *((__u16 *)&dr.dev_opt + 1);
18062 +               hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0);
18063 +               break;
18064
18065 +       default:
18066 +               err = -EINVAL;
18067 +               break;
18068 +       }
18069         hci_dev_put(hdev);
18070 -
18071 -       return ret;
18072 +       return err;
18073  }
18074
18075 -int hci_dev_list(unsigned long arg)
18076 +int hci_get_dev_list(unsigned long arg)
18077  {
18078         struct hci_dev_list_req *dl;
18079         struct hci_dev_req *dr;
18080 -       struct hci_dev *hdev;
18081 -       int i, n, size;
18082 +       struct list_head *p;
18083 +       int n = 0, size;
18084         __u16 dev_num;
18085
18086         if (get_user(dev_num, (__u16 *) arg))
18087                 return -EFAULT;
18088
18089 -       /* Avoid long loop, overflow */
18090 -       if (dev_num > 2048)
18091 +       if (!dev_num)
18092                 return -EINVAL;
18093
18094 -       size = dev_num * sizeof(struct hci_dev_req) + sizeof(__u16);
18095 +       size = dev_num * sizeof(*dr) + sizeof(*dl);
18096
18097         if (verify_area(VERIFY_WRITE, (void *) arg, size))
18098                 return -EFAULT;
18099 @@ -750,25 +732,27 @@
18100                 return -ENOMEM;
18101         dr = dl->dev_req;
18102
18103 -       spin_lock_bh(&hdev_list_lock);
18104 -       for (i = 0, n = 0; i < HCI_MAX_DEV && n < dev_num; i++) {
18105 -               if ((hdev = hdev_list[i])) {
18106 -                       (dr + n)->dev_id  = hdev->id;
18107 -                       (dr + n)->dev_opt = hdev->flags;
18108 -                       n++;
18109 -               }
18110 +       read_lock_bh(&hdev_list_lock);
18111 +       list_for_each(p, &hdev_list) {
18112 +               struct hci_dev *hdev;
18113 +               hdev = list_entry(p, struct hci_dev, list);
18114 +               (dr + n)->dev_id  = hdev->id;
18115 +               (dr + n)->dev_opt = hdev->flags;
18116 +               if (++n >= dev_num)
18117 +                       break;
18118         }
18119 -       spin_unlock_bh(&hdev_list_lock);
18120 +       read_unlock_bh(&hdev_list_lock);
18121
18122         dl->dev_num = n;
18123 -       size = n * sizeof(struct hci_dev_req) + sizeof(__u16);
18124 +       size = n * sizeof(*dr) + sizeof(*dl);
18125
18126         copy_to_user((void *) arg, dl, size);
18127 +       kfree(dl);
18128
18129         return 0;
18130  }
18131
18132 -int hci_dev_info(unsigned long arg)
18133 +int hci_get_dev_info(unsigned long arg)
18134  {
18135         struct hci_dev *hdev;
18136         struct hci_dev_info di;
18137 @@ -786,9 +770,11 @@
18138         di.flags    = hdev->flags;
18139         di.pkt_type = hdev->pkt_type;
18140         di.acl_mtu  = hdev->acl_mtu;
18141 -       di.acl_max  = hdev->acl_max;
18142 +       di.acl_pkts = hdev->acl_pkts;
18143         di.sco_mtu  = hdev->sco_mtu;
18144 -       di.sco_max  = hdev->sco_max;
18145 +       di.sco_pkts = hdev->sco_pkts;
18146 +       di.link_policy = hdev->link_policy;
18147 +       di.link_mode   = hdev->link_mode;
18148
18149         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
18150         memcpy(&di.features, &hdev->features, sizeof(di.features));
18151 @@ -801,258 +787,168 @@
18152         return err;
18153  }
18154
18155 -__u32 hci_dev_setmode(struct hci_dev *hdev, __u32 mode)
18156 -{
18157 -       __u32 omode = hdev->flags & HCI_MODE_MASK;
18158 -
18159 -       hdev->flags &= ~HCI_MODE_MASK;
18160 -       hdev->flags |= (mode & HCI_MODE_MASK);
18161
18162 -       return omode;
18163 -}
18164 +/* ---- Interface to HCI drivers ---- */
18165
18166 -__u32 hci_dev_getmode(struct hci_dev *hdev)
18167 +/* Register HCI device */
18168 +int hci_register_dev(struct hci_dev *hdev)
18169  {
18170 -       return hdev->flags & HCI_MODE_MASK;
18171 -}
18172 +       struct list_head *head = &hdev_list, *p;
18173 +       int id = 0;
18174
18175 -int hci_conn_list(unsigned long arg)
18176 -{
18177 -       struct hci_conn_list_req req, *cl;
18178 -       struct hci_conn_info *ci;
18179 -       struct hci_dev *hdev;
18180 -       struct list_head *p;
18181 -       int n = 0, size;
18182 +       BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
18183
18184 -       if (copy_from_user(&req, (void *) arg, sizeof(req)))
18185 -               return -EFAULT;
18186 +       if (!hdev->open || !hdev->close || !hdev->destruct)
18187 +               return -EINVAL;
18188
18189 -       if (!(hdev = hci_dev_get(req.dev_id)))
18190 -               return -ENODEV;
18191 +       write_lock_bh(&hdev_list_lock);
18192
18193 -       /* Set a limit to avoid overlong loops, and also numeric overflow - AC */
18194 -       if(req.conn_num < 2048)
18195 -               return -EINVAL;
18196 +       /* Find first available device id */
18197 +       list_for_each(p, &hdev_list) {
18198 +               if (list_entry(p, struct hci_dev, list)->id != id)
18199 +                       break;
18200 +               head = p; id++;
18201 +       }
18202
18203 -       size = req.conn_num * sizeof(struct hci_conn_info) + sizeof(req);
18204 -
18205 -       if (!(cl = kmalloc(size, GFP_KERNEL)))
18206 -               return -ENOMEM;
18207 -       ci = cl->conn_info;
18208 +       sprintf(hdev->name, "hci%d", id);
18209 +       hdev->id = id;
18210 +       list_add(&hdev->list, head);
18211
18212 -       local_bh_disable();
18213 -       conn_hash_lock(&hdev->conn_hash);
18214 -       list_for_each(p, &hdev->conn_hash.list) {
18215 -               register struct hci_conn *c;
18216 -               c = list_entry(p, struct hci_conn, list);
18217 +       atomic_set(&hdev->refcnt, 1);
18218 +       spin_lock_init(&hdev->lock);
18219 +
18220 +       hdev->flags = 0;
18221 +       hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
18222 +       hdev->link_mode = (HCI_LM_ACCEPT);
18223
18224 -               (ci + n)->handle = c->handle;
18225 -               bacpy(&(ci + n)->bdaddr, &c->dst);
18226 -               n++;
18227 -       }
18228 -       conn_hash_unlock(&hdev->conn_hash);
18229 -       local_bh_enable();
18230 -
18231 -       cl->dev_id = hdev->id;
18232 -       cl->conn_num = n;
18233 -       size = n * sizeof(struct hci_conn_info) + sizeof(req);
18234 +       tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
18235 +       tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
18236 +       tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
18237
18238 -       hci_dev_put(hdev);
18239 +       skb_queue_head_init(&hdev->rx_q);
18240 +       skb_queue_head_init(&hdev->cmd_q);
18241 +       skb_queue_head_init(&hdev->raw_q);
18242
18243 -       if(copy_to_user((void *) arg, cl, size))
18244 -               return -EFAULT;
18245 -       return 0;
18246 -}
18247 +       init_waitqueue_head(&hdev->req_wait_q);
18248 +       init_MUTEX(&hdev->req_lock);
18249
18250 -int hci_inquiry(unsigned long arg)
18251 -{
18252 -       struct inquiry_cache *cache;
18253 -       struct hci_inquiry_req ir;
18254 -       struct hci_dev *hdev;
18255 -       int err = 0, do_inquiry = 0;
18256 -       long timeo;
18257 -       __u8 *buf, *ptr;
18258 +       inquiry_cache_init(hdev);
18259
18260 -       ptr = (void *) arg;
18261 -       if (copy_from_user(&ir, ptr, sizeof(ir)))
18262 -               return -EFAULT;
18263 +       conn_hash_init(hdev);
18264
18265 -       if (!(hdev = hci_dev_get(ir.dev_id)))
18266 -               return -ENODEV;
18267 +       memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
18268
18269 -       cache = &hdev->inq_cache;
18270 +       atomic_set(&hdev->promisc, 0);
18271
18272 -       inquiry_cache_lock(cache);
18273 -       if (inquiry_cache_age(cache) > INQUIRY_CACHE_AGE_MAX || ir.flags & IREQ_CACHE_FLUSH) {
18274 -               inquiry_cache_flush(cache);
18275 -               do_inquiry = 1;
18276 -       }
18277 -       inquiry_cache_unlock(cache);
18278 +       MOD_INC_USE_COUNT;
18279
18280 -       /* Limit inquiry time, also avoid overflows */
18281 +       write_unlock_bh(&hdev_list_lock);
18282
18283 -       if(ir.length > 2048 || ir.num_rsp > 2048)
18284 -       {
18285 -               err = -EINVAL;
18286 -               goto done;
18287 -       }
18288 +       hci_notify(hdev, HCI_DEV_REG);
18289 +       hci_run_hotplug(hdev->name, "register");
18290
18291 -       timeo = ir.length * 2 * HZ;
18292 -       if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
18293 -               goto done;
18294 +       return id;
18295 +}
18296
18297 -       /* cache_dump can't sleep. Therefore we allocate temp buffer and then
18298 -        * copy it to the user space.
18299 -        */
18300 -       if (!(buf = kmalloc(sizeof(inquiry_info) * ir.num_rsp, GFP_KERNEL))) {
18301 -               err = -ENOMEM;
18302 -               goto done;
18303 -       }
18304 -       ir.num_rsp = inquiry_cache_dump(cache, ir.num_rsp, buf);
18305 +/* Unregister HCI device */
18306 +int hci_unregister_dev(struct hci_dev *hdev)
18307 +{
18308 +       BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
18309
18310 -       DBG("num_rsp %d", ir.num_rsp);
18311 +       write_lock_bh(&hdev_list_lock);
18312 +       list_del(&hdev->list);
18313 +       write_unlock_bh(&hdev_list_lock);
18314
18315 -       if (!verify_area(VERIFY_WRITE, ptr, sizeof(ir) + (sizeof(inquiry_info) * ir.num_rsp))) {
18316 -               copy_to_user(ptr, &ir, sizeof(ir));
18317 -               ptr += sizeof(ir);
18318 -               copy_to_user(ptr, buf, sizeof(inquiry_info) * ir.num_rsp);
18319 -       } else
18320 -               err = -EFAULT;
18321 +       hci_dev_do_close(hdev);
18322
18323 -       kfree(buf);
18324 +       hci_notify(hdev, HCI_DEV_UNREG);
18325 +       hci_run_hotplug(hdev->name, "unregister");
18326
18327 -done:
18328         hci_dev_put(hdev);
18329
18330 -       return err;
18331 +       MOD_DEC_USE_COUNT;
18332 +       return 0;
18333  }
18334
18335 -/* Interface to HCI drivers */
18336 -
18337 -/* Register HCI device */
18338 -int hci_register_dev(struct hci_dev *hdev)
18339 +/* Suspend HCI device */
18340 +int hci_suspend_dev(struct hci_dev *hdev)
18341  {
18342 -       int i;
18343 -
18344 -       DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
18345 -
18346 -       /* Find free slot */
18347 -       spin_lock_bh(&hdev_list_lock);
18348 -       for (i = 0; i < HCI_MAX_DEV; i++) {
18349 -               if (!hdev_list[i]) {
18350 -                       hdev_list[i] = hdev;
18351 +       hci_notify(hdev, HCI_DEV_SUSPEND);
18352 +       hci_run_hotplug(hdev->name, "suspend");
18353 +       return 0;
18354 +}
18355
18356 -                       sprintf(hdev->name, "hci%d", i);
18357 -                       atomic_set(&hdev->refcnt, 0);
18358 -                       hdev->id    = i;
18359 -                       hdev->flags = HCI_NORMAL;
18360 +/* Resume HCI device */
18361 +int hci_resume_dev(struct hci_dev *hdev)
18362 +{
18363 +       hci_notify(hdev, HCI_DEV_RESUME);
18364 +       hci_run_hotplug(hdev->name, "resume");
18365 +       return 0;
18366 +}
18367
18368 -                       hdev->pkt_type = (HCI_DM1 | HCI_DH1);
18369 -
18370 -                       tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
18371 -                       tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
18372 -                       tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
18373 -
18374 -                       skb_queue_head_init(&hdev->rx_q);
18375 -                       skb_queue_head_init(&hdev->cmd_q);
18376 -                       skb_queue_head_init(&hdev->raw_q);
18377 -
18378 -                       init_waitqueue_head(&hdev->req_wait_q);
18379 -                       init_MUTEX(&hdev->req_lock);
18380 -
18381 -                       inquiry_cache_init(&hdev->inq_cache);
18382 -
18383 -                       conn_hash_init(&hdev->conn_hash);
18384 -
18385 -                       memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
18386 -
18387 -                       hci_notify(hdev, HCI_DEV_REG);
18388 -
18389 -                       MOD_INC_USE_COUNT;
18390 -                       break;
18391 -               }
18392 -       }
18393 -       spin_unlock_bh(&hdev_list_lock);
18394 -
18395 -       return (i == HCI_MAX_DEV) ? -1 : i;
18396 -}
18397 -
18398 -/* Unregister HCI device */
18399 -int hci_unregister_dev(struct hci_dev *hdev)
18400 +/* Receive frame from HCI drivers */
18401 +int hci_recv_frame(struct sk_buff *skb)
18402  {
18403 -       int i;
18404 -
18405 -       DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
18406 -
18407 -       if (hdev->flags & HCI_UP)
18408 -               hci_dev_close(hdev->id);
18409 +       struct hci_dev *hdev = (struct hci_dev *) skb->dev;
18410
18411 -       /* Find device slot */
18412 -       spin_lock(&hdev_list_lock);
18413 -       for (i = 0; i < HCI_MAX_DEV; i++) {
18414 -               if (hdev_list[i] == hdev) {
18415 -                       hdev_list[i] = NULL;
18416 -                       MOD_DEC_USE_COUNT;
18417 -                       break;
18418 -               }
18419 +       if (!hdev || (!test_bit(HCI_UP, &hdev->flags) &&
18420 +                               !test_bit(HCI_INIT, &hdev->flags)) ) {
18421 +               kfree_skb(skb);
18422 +               return -1;
18423         }
18424 -       spin_unlock(&hdev_list_lock);
18425 -
18426 -       hci_notify(hdev, HCI_DEV_UNREG);
18427
18428 -       /* Sleep while device is in use */
18429 -       while (atomic_read(&hdev->refcnt)) {
18430 -               int sleep_cnt = 100;
18431 +       BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
18432
18433 -               DBG("%s sleeping on lock %d", hdev->name, atomic_read(&hdev->refcnt));
18434 +       /* Incomming skb */
18435 +       bluez_cb(skb)->incomming = 1;
18436
18437 -               sleep_on_timeout(&hdev->req_wait_q, HZ*10);
18438 -               if (!(--sleep_cnt))
18439 -                       break;
18440 -       }
18441 +       /* Time stamp */
18442 +       do_gettimeofday(&skb->stamp);
18443
18444 +       /* Queue frame for rx task */
18445 +       skb_queue_tail(&hdev->rx_q, skb);
18446 +       hci_sched_rx(hdev);
18447         return 0;
18448  }
18449
18450 -/* Interface to upper protocols */
18451 +/* ---- Interface to upper protocols ---- */
18452
18453  /* Register/Unregister protocols.
18454 - * hci_task_lock is used to ensure that no tasks are running.
18455 - */
18456 -int hci_register_proto(struct hci_proto *hproto)
18457 + * hci_task_lock is used to ensure that no tasks are running. */
18458 +int hci_register_proto(struct hci_proto *hp)
18459  {
18460         int err = 0;
18461
18462 -       DBG("%p name %s", hproto, hproto->name);
18463 +       BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
18464
18465 -       if (hproto->id >= HCI_MAX_PROTO)
18466 +       if (hp->id >= HCI_MAX_PROTO)
18467                 return -EINVAL;
18468
18469         write_lock_bh(&hci_task_lock);
18470
18471 -       if (!hproto_list[hproto->id])
18472 -               hproto_list[hproto->id] = hproto;
18473 +       if (!hci_proto[hp->id])
18474 +               hci_proto[hp->id] = hp;
18475         else
18476 -               err = -1;
18477 +               err = -EEXIST;
18478
18479         write_unlock_bh(&hci_task_lock);
18480
18481         return err;
18482  }
18483
18484 -int hci_unregister_proto(struct hci_proto *hproto)
18485 +int hci_unregister_proto(struct hci_proto *hp)
18486  {
18487         int err = 0;
18488
18489 -       DBG("%p name %s", hproto, hproto->name);
18490 +       BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
18491
18492 -       if (hproto->id > HCI_MAX_PROTO)
18493 +       if (hp->id >= HCI_MAX_PROTO)
18494                 return -EINVAL;
18495
18496         write_lock_bh(&hci_task_lock);
18497
18498 -       if (hproto_list[hproto->id])
18499 -               hproto_list[hproto->id] = NULL;
18500 +       if (hci_proto[hp->id])
18501 +               hci_proto[hp->id] = NULL;
18502         else
18503                 err = -ENOENT;
18504
18505 @@ -1070,10 +966,14 @@
18506                 return -ENODEV;
18507         }
18508
18509 -       DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
18510 +       BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
18511 +
18512 +       if (atomic_read(&hdev->promisc)) {
18513 +               /* Time stamp */
18514 +               do_gettimeofday(&skb->stamp);
18515
18516 -       if (hdev->flags & HCI_SOCK)
18517                 hci_send_to_sock(hdev, skb);
18518 +       }
18519
18520         /* Get rid of skb owner, prior to sending to the driver. */
18521         skb_orphan(skb);
18522 @@ -1081,128 +981,6 @@
18523         return hdev->send(skb);
18524  }
18525
18526 -/* Connection scheduler */
18527 -static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
18528 -{
18529 -       struct conn_hash *h = &hdev->conn_hash;
18530 -       struct hci_conn *conn = NULL;
18531 -       int num = 0, min = 0xffff;
18532 -        struct list_head *p;
18533 -
18534 -       conn_hash_lock(h);
18535 -       list_for_each(p, &h->list) {
18536 -               register struct hci_conn *c;
18537 -
18538 -               c = list_entry(p, struct hci_conn, list);
18539 -
18540 -               if (c->type != type || skb_queue_empty(&c->data_q))
18541 -                       continue;
18542 -               num++;
18543 -
18544 -               if (c->sent < min) {
18545 -                       min  = c->sent;
18546 -                       conn = c;
18547 -               }
18548 -       }
18549 -       conn_hash_unlock(h);
18550 -
18551 -       if (conn) {
18552 -               int q = hdev->acl_cnt / num;
18553 -               *quote = q ? q : 1;
18554 -       } else
18555 -               *quote = 0;
18556 -
18557 -       DBG("conn %p quote %d", conn, *quote);
18558 -
18559 -       return conn;
18560 -}
18561 -
18562 -static inline void hci_sched_acl(struct hci_dev *hdev)
18563 -{
18564 -       struct hci_conn *conn;
18565 -       struct sk_buff *skb;
18566 -       int quote;
18567 -
18568 -       DBG("%s", hdev->name);
18569 -
18570 -       while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
18571 -               while (quote && (skb = skb_dequeue(&conn->data_q))) {
18572 -                       DBG("skb %p len %d", skb, skb->len);
18573 -
18574 -                       hci_send_frame(skb);
18575 -
18576 -                       conn->sent++;
18577 -                       hdev->acl_cnt--;
18578 -                       quote--;
18579 -               }
18580 -       }
18581 -}
18582 -
18583 -/* Schedule SCO */
18584 -static inline void hci_sched_sco(struct hci_dev *hdev)
18585 -{
18586 -       /* FIXME: For now we queue SCO packets to the raw queue
18587 -
18588 -               while (hdev->sco_cnt && (skb = skb_dequeue(&conn->data_q))) {
18589 -                       hci_send_frame(skb);
18590 -                       conn->sco_sent++;
18591 -                       hdev->sco_cnt--;
18592 -               }
18593 -       */
18594 -}
18595 -
18596 -/* Get data from the previously sent command */
18597 -static void * hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
18598 -{
18599 -       hci_command_hdr *hc;
18600 -
18601 -       if (!hdev->sent_cmd)
18602 -               return NULL;
18603 -
18604 -       hc = (void *) hdev->sent_cmd->data;
18605 -
18606 -       if (hc->opcode != __cpu_to_le16(cmd_opcode_pack(ogf, ocf)))
18607 -               return NULL;
18608 -
18609 -       DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf);
18610 -
18611 -       return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
18612 -}
18613 -
18614 -/* Send raw HCI frame */
18615 -int hci_send_raw(struct sk_buff *skb)
18616 -{
18617 -       struct hci_dev *hdev = (struct hci_dev *) skb->dev;
18618 -
18619 -       if (!hdev) {
18620 -               kfree_skb(skb);
18621 -               return -ENODEV;
18622 -       }
18623 -
18624 -       DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
18625 -
18626 -       if (hdev->flags & HCI_NORMAL) {
18627 -               /* Queue frame according it's type */
18628 -               switch (skb->pkt_type) {
18629 -               case HCI_COMMAND_PKT:
18630 -                       skb_queue_tail(&hdev->cmd_q, skb);
18631 -                       hci_sched_cmd(hdev);
18632 -                       return 0;
18633 -
18634 -               case HCI_ACLDATA_PKT:
18635 -               case HCI_SCODATA_PKT:
18636 -                       /* FIXME:
18637 -                        * Check header here and queue to apropriate connection.
18638 -                        */
18639 -                       break;
18640 -               }
18641 -       }
18642 -
18643 -       skb_queue_tail(&hdev->raw_q, skb);
18644 -       hci_sched_tx(hdev);
18645 -       return 0;
18646 -}
18647 -
18648  /* Send HCI command */
18649  int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param)
18650  {
18651 @@ -1210,10 +988,10 @@
18652         hci_command_hdr *hc;
18653         struct sk_buff *skb;
18654
18655 -       DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen);
18656 +       BT_DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen);
18657
18658         if (!(skb = bluez_skb_alloc(len, GFP_ATOMIC))) {
18659 -               ERR("%s Can't allocate memory for HCI command", hdev->name);
18660 +               BT_ERR("%s Can't allocate memory for HCI command", hdev->name);
18661                 return -ENOMEM;
18662         }
18663
18664 @@ -1224,7 +1002,7 @@
18665         if (plen)
18666                 memcpy(skb_put(skb, plen), param, plen);
18667
18668 -       DBG("skb len %d", skb->len);
18669 +       BT_DBG("skb len %d", skb->len);
18670
18671         skb->pkt_type = HCI_COMMAND_PKT;
18672         skb->dev = (void *) hdev;
18673 @@ -1234,10 +1012,28 @@
18674         return 0;
18675  }
18676
18677 +/* Get data from the previously sent command */
18678 +void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
18679 +{
18680 +       hci_command_hdr *hc;
18681 +
18682 +       if (!hdev->sent_cmd)
18683 +               return NULL;
18684 +
18685 +       hc = (void *) hdev->sent_cmd->data;
18686 +
18687 +       if (hc->opcode != __cpu_to_le16(cmd_opcode_pack(ogf, ocf)))
18688 +               return NULL;
18689 +
18690 +       BT_DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf);
18691 +
18692 +       return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
18693 +}
18694 +
18695  /* Send ACL data */
18696  static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
18697  {
18698 -       int len = skb->len;
18699 +       int len = skb->len;
18700         hci_acl_hdr *ah;
18701
18702         ah = (hci_acl_hdr *) skb_push(skb, HCI_ACL_HDR_SIZE);
18703 @@ -1252,7 +1048,7 @@
18704         struct hci_dev *hdev = conn->hdev;
18705         struct sk_buff *list;
18706
18707 -       DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
18708 +       BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
18709
18710         skb->dev = (void *) hdev;
18711         skb->pkt_type = HCI_ACLDATA_PKT;
18712 @@ -1260,12 +1056,12 @@
18713
18714         if (!(list = skb_shinfo(skb)->frag_list)) {
18715                 /* Non fragmented */
18716 -               DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
18717 +               BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
18718
18719                 skb_queue_tail(&conn->data_q, skb);
18720         } else {
18721                 /* Fragmented */
18722 -               DBG("%s frag %p len %d", hdev->name, skb, skb->len);
18723 +               BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
18724
18725                 skb_shinfo(skb)->frag_list = NULL;
18726
18727 @@ -1280,7 +1076,7 @@
18728                         skb->pkt_type = HCI_ACLDATA_PKT;
18729                         hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
18730
18731 -                       DBG("%s frag %p len %d", hdev->name, skb, skb->len);
18732 +                       BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
18733
18734                         __skb_queue_tail(&conn->data_q, skb);
18735                 } while (list);
18736 @@ -1298,7 +1094,7 @@
18737         struct hci_dev *hdev = conn->hdev;
18738         hci_sco_hdr hs;
18739
18740 -       DBG("%s len %d", hdev->name, skb->len);
18741 +       BT_DBG("%s len %d", hdev->name, skb->len);
18742
18743         if (skb->len > hdev->sco_mtu) {
18744                 kfree_skb(skb);
18745 @@ -1315,544 +1111,136 @@
18746         skb->pkt_type = HCI_SCODATA_PKT;
18747         skb_queue_tail(&conn->data_q, skb);
18748         hci_sched_tx(hdev);
18749 -
18750         return 0;
18751  }
18752
18753 -/* Handle HCI Event packets */
18754 -
18755 -/* Command Complete OGF LINK_CTL  */
18756 -static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
18757 -{
18758 -       DBG("%s ocf 0x%x", hdev->name, ocf);
18759 -
18760 -       switch (ocf) {
18761 -       default:
18762 -               DBG("%s Command complete: ogf LINK_CTL ocf %x", hdev->name, ocf);
18763 -               break;
18764 -       };
18765 -}
18766 -
18767 -/* Command Complete OGF LINK_POLICY  */
18768 -static void hci_cc_link_policy(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
18769 -{
18770 -       DBG("%s ocf 0x%x", hdev->name, ocf);
18771 -
18772 -       switch (ocf) {
18773 -       default:
18774 -               DBG("%s: Command complete: ogf LINK_POLICY ocf %x", hdev->name, ocf);
18775 -               break;
18776 -       };
18777 -}
18778 -
18779 -/* Command Complete OGF HOST_CTL  */
18780 -static void hci_cc_host_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
18781 -{
18782 -       __u8 status, param;
18783 -       void *sent;
18784 -
18785 -
18786 -       DBG("%s ocf 0x%x", hdev->name, ocf);
18787 -
18788 -       switch (ocf) {
18789 -       case OCF_RESET:
18790 -               status = *((__u8 *) skb->data);
18791 -
18792 -               hci_req_complete(hdev, status);
18793 -               break;
18794 -
18795 -       case OCF_SET_EVENT_FLT:
18796 -               status = *((__u8 *) skb->data);
18797 -
18798 -               if (status) {
18799 -                       DBG("%s SET_EVENT_FLT failed %d", hdev->name, status);
18800 -               } else {
18801 -                       DBG("%s SET_EVENT_FLT succeseful", hdev->name);
18802 -               }
18803 -               break;
18804 -
18805 -       case OCF_WRITE_AUTH_ENABLE:
18806 -               if (!(sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE)))
18807 -                       break;
18808 -
18809 -               status = *((__u8 *) skb->data);
18810 -               param  = *((__u8 *) sent);
18811 +/* ---- HCI TX task (outgoing data) ---- */
18812
18813 -               if (!status) {
18814 -                       if (param == AUTH_ENABLED)
18815 -                               hdev->flags |= HCI_AUTH;
18816 -                       else
18817 -                               hdev->flags &= ~HCI_AUTH;
18818 -               }
18819 -               hci_req_complete(hdev, status);
18820 -               break;
18821 -
18822 -       case OCF_WRITE_CA_TIMEOUT:
18823 -               status = *((__u8 *) skb->data);
18824 -
18825 -               if (status) {
18826 -                       DBG("%s OCF_WRITE_CA_TIMEOUT failed %d", hdev->name, status);
18827 -               } else {
18828 -                       DBG("%s OCF_WRITE_CA_TIMEOUT succeseful", hdev->name);
18829 -               }
18830 -               break;
18831 -
18832 -       case OCF_WRITE_PG_TIMEOUT:
18833 -               status = *((__u8 *) skb->data);
18834 -
18835 -               if (status) {
18836 -                       DBG("%s OCF_WRITE_PG_TIMEOUT failed %d", hdev->name, status);
18837 -               } else {
18838 -                       DBG("%s: OCF_WRITE_PG_TIMEOUT succeseful", hdev->name);
18839 -               }
18840 -               break;
18841 -
18842 -       case OCF_WRITE_SCAN_ENABLE:
18843 -               if (!(sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE)))
18844 -                       break;
18845 -               status = *((__u8 *) skb->data);
18846 -               param  = *((__u8 *) sent);
18847 -
18848 -               DBG("param 0x%x", param);
18849 -
18850 -               if (!status) {
18851 -                       switch (param) {
18852 -                       case IS_ENA_PS_ENA:
18853 -                               hdev->flags |=  HCI_PSCAN | HCI_ISCAN;
18854 -                               break;
18855 -
18856 -                       case IS_ENA_PS_DIS:
18857 -                               hdev->flags &= ~HCI_PSCAN;
18858 -                               hdev->flags |=  HCI_ISCAN;
18859 -                               break;
18860 -
18861 -                       case IS_DIS_PS_ENA:
18862 -                               hdev->flags &= ~HCI_ISCAN;
18863 -                               hdev->flags |=  HCI_PSCAN;
18864 -                               break;
18865 -
18866 -                       default:
18867 -                               hdev->flags &= ~(HCI_ISCAN | HCI_PSCAN);
18868 -                               break;
18869 -                       };
18870 -               }
18871 -               hci_req_complete(hdev, status);
18872 -               break;
18873 -
18874 -       default:
18875 -               DBG("%s Command complete: ogf HOST_CTL ocf %x", hdev->name, ocf);
18876 -               break;
18877 -       };
18878 -}
18879 -
18880 -/* Command Complete OGF INFO_PARAM  */
18881 -static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
18882 +/* HCI Connection scheduler */
18883 +static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
18884  {
18885 -       read_local_features_rp *lf;
18886 -       read_buffer_size_rp *bs;
18887 -       read_bd_addr_rp *ba;
18888 -
18889 -       DBG("%s ocf 0x%x", hdev->name, ocf);
18890 -
18891 -       switch (ocf) {
18892 -       case OCF_READ_LOCAL_FEATURES:
18893 -               lf = (read_local_features_rp *) skb->data;
18894 -
18895 -               if (lf->status) {
18896 -                       DBG("%s READ_LOCAL_FEATURES failed %d", hdev->name, lf->status);
18897 -                       break;
18898 -               }
18899 -
18900 -               memcpy(hdev->features, lf->features, sizeof(hdev->features));
18901 -
18902 -               /* Adjust default settings according to features
18903 -                * supported by device. */
18904 -               if (hdev->features[0] & LMP_3SLOT)
18905 -                       hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
18906 -
18907 -               if (hdev->features[0] & LMP_5SLOT)
18908 -                       hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
18909 -
18910 -               DBG("%s: features 0x%x 0x%x 0x%x", hdev->name, lf->features[0], lf->features[1], lf->features[2]);
18911 -
18912 -               break;
18913 -
18914 -       case OCF_READ_BUFFER_SIZE:
18915 -               bs = (read_buffer_size_rp *) skb->data;
18916 -
18917 -               if (bs->status) {
18918 -                       DBG("%s READ_BUFFER_SIZE failed %d", hdev->name, bs->status);
18919 -                       break;
18920 -               }
18921 -
18922 -               hdev->acl_mtu = __le16_to_cpu(bs->acl_mtu);
18923 -               hdev->sco_mtu = bs->sco_mtu;
18924 -               hdev->acl_max = hdev->acl_cnt = __le16_to_cpu(bs->acl_max_pkt);
18925 -               hdev->sco_max = hdev->sco_cnt = __le16_to_cpu(bs->sco_max_pkt);
18926 -
18927 -               DBG("%s mtu: acl %d, sco %d max_pkt: acl %d, sco %d", hdev->name,
18928 -                   hdev->acl_mtu, hdev->sco_mtu, hdev->acl_max, hdev->sco_max);
18929 +       struct conn_hash *h = &hdev->conn_hash;
18930 +       struct hci_conn  *conn = NULL;
18931 +       int num = 0, min = ~0;
18932 +        struct list_head *p;
18933
18934 -               break;
18935 +       /* We don't have to lock device here. Connections are always
18936 +        * added and removed with TX task disabled. */
18937 +       list_for_each(p, &h->list) {
18938 +               struct hci_conn *c;
18939 +               c = list_entry(p, struct hci_conn, list);
18940
18941 -       case OCF_READ_BD_ADDR:
18942 -               ba = (read_bd_addr_rp *) skb->data;
18943 +               if (c->type != type || c->state != BT_CONNECTED
18944 +                               || skb_queue_empty(&c->data_q))
18945 +                       continue;
18946 +               num++;
18947
18948 -               if (!ba->status) {
18949 -                       bacpy(&hdev->bdaddr, &ba->bdaddr);
18950 -               } else {
18951 -                       DBG("%s: READ_BD_ADDR failed %d", hdev->name, ba->status);
18952 +               if (c->sent < min) {
18953 +                       min  = c->sent;
18954 +                       conn = c;
18955                 }
18956 +       }
18957
18958 -               hci_req_complete(hdev, ba->status);
18959 -               break;
18960 +       if (conn) {
18961 +               int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
18962 +               int q = cnt / num;
18963 +               *quote = q ? q : 1;
18964 +       } else
18965 +               *quote = 0;
18966
18967 -       default:
18968 -               DBG("%s Command complete: ogf INFO_PARAM ocf %x", hdev->name, ocf);
18969 -               break;
18970 -       };
18971 +       BT_DBG("conn %p quote %d", conn, *quote);
18972 +       return conn;
18973  }
18974
18975 -/* Command Status OGF LINK_CTL  */
18976 -static void hci_cs_link_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
18977 +static inline void hci_acl_tx_to(struct hci_dev *hdev)
18978  {
18979 -       struct hci_proto * hp;
18980 -
18981 -       DBG("%s ocf 0x%x", hdev->name, ocf);
18982 -
18983 -       switch (ocf) {
18984 -       case OCF_CREATE_CONN:
18985 -               if (status) {
18986 -                       create_conn_cp *cc = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_CREATE_CONN);
18987 -
18988 -                       if (!cc)
18989 -                               break;
18990 -
18991 -                       DBG("%s Create connection error: status 0x%x %s", hdev->name,
18992 -                           status, batostr(&cc->bdaddr));
18993 +       struct conn_hash *h = &hdev->conn_hash;
18994 +       struct list_head *p;
18995 +       struct hci_conn  *c;
18996
18997 -                       /* Notify upper protocols */
18998 -                       if ((hp = GET_HPROTO(HCI_PROTO_L2CAP)) && hp->connect_cfm) {
18999 -                               tasklet_disable(&hdev->tx_task);
19000 -                               hp->connect_cfm(hdev, &cc->bdaddr, status, NULL);
19001 -                               tasklet_enable(&hdev->tx_task);
19002 -                       }
19003 -               }
19004 -               break;
19005 +       BT_ERR("%s ACL tx timeout", hdev->name);
19006
19007 -       case OCF_INQUIRY:
19008 -               if (status) {
19009 -                       DBG("%s Inquiry error: status 0x%x", hdev->name, status);
19010 -                       hci_req_complete(hdev, status);
19011 +       /* Kill stalled connections */
19012 +       list_for_each(p, &h->list) {
19013 +               c = list_entry(p, struct hci_conn, list);
19014 +               if (c->type == ACL_LINK && c->sent) {
19015 +                       BT_ERR("%s killing stalled ACL connection %s",
19016 +                               hdev->name, batostr(&c->dst));
19017 +                       hci_acl_disconn(c, 0x13);
19018                 }
19019 -               break;
19020 -
19021 -       default:
19022 -               DBG("%s Command status: ogf LINK_CTL ocf %x", hdev->name, ocf);
19023 -               break;
19024 -       };
19025 -}
19026 -
19027 -/* Command Status OGF LINK_POLICY */
19028 -static void hci_cs_link_policy(struct hci_dev *hdev, __u16 ocf, __u8 status)
19029 -{
19030 -       DBG("%s ocf 0x%x", hdev->name, ocf);
19031 -
19032 -       switch (ocf) {
19033 -       default:
19034 -               DBG("%s Command status: ogf HOST_POLICY ocf %x", hdev->name, ocf);
19035 -               break;
19036 -       };
19037 -}
19038 -
19039 -/* Command Status OGF HOST_CTL */
19040 -static void hci_cs_host_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
19041 -{
19042 -       DBG("%s ocf 0x%x", hdev->name, ocf);
19043 -
19044 -       switch (ocf) {
19045 -       default:
19046 -               DBG("%s Command status: ogf HOST_CTL ocf %x", hdev->name, ocf);
19047 -               break;
19048 -       };
19049 -}
19050 -
19051 -/* Command Status OGF INFO_PARAM  */
19052 -static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
19053 -{
19054 -       DBG("%s: hci_cs_info_param: ocf 0x%x", hdev->name, ocf);
19055 -
19056 -       switch (ocf) {
19057 -       default:
19058 -               DBG("%s Command status: ogf INFO_PARAM ocf %x", hdev->name, ocf);
19059 -               break;
19060 -       };
19061 -}
19062 -
19063 -/* Inquiry Complete */
19064 -static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
19065 -{
19066 -       __u8 status = *((__u8 *) skb->data);
19067 -
19068 -       DBG("%s status %d", hdev->name, status);
19069 -
19070 -       hci_req_complete(hdev, status);
19071 +       }
19072  }
19073
19074 -/* Inquiry Result */
19075 -static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
19076 +static inline void hci_sched_acl(struct hci_dev *hdev)
19077  {
19078 -       inquiry_info *info = (inquiry_info *) (skb->data + 1);
19079 -       int num_rsp = *((__u8 *) skb->data);
19080 -
19081 -       DBG("%s num_rsp %d", hdev->name, num_rsp);
19082 +       struct hci_conn *conn;
19083 +       struct sk_buff *skb;
19084 +       int quote;
19085
19086 -       for (; num_rsp; num_rsp--)
19087 -               inquiry_cache_update(&hdev->inq_cache, info++);
19088 -}
19089 +       BT_DBG("%s", hdev->name);
19090
19091 -/* Connect Request */
19092 -static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
19093 -{
19094 -       evt_conn_request *cr = (evt_conn_request *) skb->data;
19095 -       struct hci_proto *hp;
19096 -       accept_conn_req_cp ac;
19097 -       int accept = 0;
19098 +       /* ACL tx timeout must be longer than maximum
19099 +        * link supervision timeout (40.9 seconds) */
19100 +       if (!hdev->acl_cnt && (jiffies - hdev->acl_last_tx) > (HZ * 45))
19101 +               hci_acl_tx_to(hdev);
19102
19103 -       DBG("%s Connection request: %s type 0x%x", hdev->name, batostr(&cr->bdaddr), cr->link_type);
19104 +       while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
19105 +               while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
19106 +                       BT_DBG("skb %p len %d", skb, skb->len);
19107 +                       hci_send_frame(skb);
19108 +                       hdev->acl_last_tx = jiffies;
19109
19110 -       /* Notify upper protocols */
19111 -       if (cr->link_type == ACL_LINK) {
19112 -               /* ACL link notify L2CAP */
19113 -               if ((hp = GET_HPROTO(HCI_PROTO_L2CAP)) && hp->connect_ind) {
19114 -                       tasklet_disable(&hdev->tx_task);
19115 -                       accept = hp->connect_ind(hdev, &cr->bdaddr);
19116 -                       tasklet_enable(&hdev->tx_task);
19117 +                       hdev->acl_cnt--;
19118 +                       conn->sent++;
19119                 }
19120 -       } else {
19121 -               /* SCO link (no notification) */
19122 -               /* FIXME: Should be accept it here or let the requester (app) accept it ? */
19123 -               accept = 1;
19124 -       }
19125 -
19126 -       if (accept) {
19127 -               /* Connection accepted by upper layer */
19128 -               bacpy(&ac.bdaddr, &cr->bdaddr);
19129 -               ac.role = 0x01; /* Remain slave */
19130 -               hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ACCEPT_CONN_REQ, ACCEPT_CONN_REQ_CP_SIZE, &ac);
19131 -       } else {
19132 -               /* Connection rejected by upper layer */
19133 -               /* FIXME:
19134 -                * Should we use HCI reject here ?
19135 -                */
19136 -               return;
19137         }
19138  }
19139
19140 -/* Connect Complete */
19141 -static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
19142 +/* Schedule SCO */
19143 +static inline void hci_sched_sco(struct hci_dev *hdev)
19144  {
19145 -       evt_conn_complete *cc = (evt_conn_complete *) skb->data;
19146 -       struct hci_conn *conn = NULL;
19147 -       struct hci_proto *hp;
19148 -
19149 -       DBG("%s", hdev->name);
19150 -
19151 -       tasklet_disable(&hdev->tx_task);
19152 -
19153 -       if (!cc->status)
19154 -               conn = hci_conn_add(hdev, __le16_to_cpu(cc->handle), cc->link_type, &cc->bdaddr);
19155 +       struct hci_conn *conn;
19156 +       struct sk_buff *skb;
19157 +       int quote;
19158
19159 -       /* Notify upper protocols */
19160 -       if (cc->link_type == ACL_LINK) {
19161 -               /* ACL link notify L2CAP layer */
19162 -               if ((hp = GET_HPROTO(HCI_PROTO_L2CAP)) && hp->connect_cfm)
19163 -                       hp->connect_cfm(hdev, &cc->bdaddr, cc->status, conn);
19164 -       } else {
19165 -               /* SCO link (no notification) */
19166 -       }
19167 +       BT_DBG("%s", hdev->name);
19168
19169 -       tasklet_enable(&hdev->tx_task);
19170 -}
19171 +       while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
19172 +               while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
19173 +                       BT_DBG("skb %p len %d", skb, skb->len);
19174 +                       hci_send_frame(skb);
19175
19176 -/* Disconnect Complete */
19177 -static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
19178 -{
19179 -       evt_disconn_complete *dc = (evt_disconn_complete *) skb->data;
19180 -       struct hci_conn *conn = NULL;
19181 -       struct hci_proto *hp;
19182 -       __u16 handle = __le16_to_cpu(dc->handle);
19183 -
19184 -       DBG("%s", hdev->name);
19185 -
19186 -       if (!dc->status && (conn = conn_hash_lookup(&hdev->conn_hash, handle))) {
19187 -               tasklet_disable(&hdev->tx_task);
19188 -
19189 -               /* Notify upper protocols */
19190 -               if (conn->type == ACL_LINK) {
19191 -                       /* ACL link notify L2CAP layer */
19192 -                       if ((hp = GET_HPROTO(HCI_PROTO_L2CAP)) && hp->disconn_ind)
19193 -                               hp->disconn_ind(conn, dc->reason);
19194 -               } else {
19195 -                       /* SCO link (no notification) */
19196 +                       conn->sent++;
19197 +                       if (conn->sent == ~0)
19198 +                               conn->sent = 0;
19199                 }
19200 -
19201 -               hci_conn_del(hdev, conn);
19202 -
19203 -               tasklet_enable(&hdev->tx_task);
19204         }
19205  }
19206
19207 -/* Number of completed packets */
19208 -static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
19209 +static void hci_tx_task(unsigned long arg)
19210  {
19211 -       evt_num_comp_pkts *nc = (evt_num_comp_pkts *) skb->data;
19212 -       __u16 *ptr;
19213 -       int i;
19214 -
19215 -       skb_pull(skb, EVT_NUM_COMP_PKTS_SIZE);
19216 -
19217 -       DBG("%s num_hndl %d", hdev->name, nc->num_hndl);
19218 +       struct hci_dev *hdev = (struct hci_dev *) arg;
19219 +       struct sk_buff *skb;
19220
19221 -       if (skb->len < nc->num_hndl * 4) {
19222 -               DBG("%s bad parameters", hdev->name);
19223 -               return;
19224 -       }
19225 +       read_lock(&hci_task_lock);
19226
19227 -       tasklet_disable(&hdev->tx_task);
19228 +       BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
19229
19230 -       for (i = 0, ptr = (__u16 *) skb->data; i < nc->num_hndl; i++) {
19231 -               struct hci_conn *conn;
19232 -               __u16 handle, count;
19233 +       /* Schedule queues and send stuff to HCI driver */
19234
19235 -               handle = __le16_to_cpu(get_unaligned(ptr++));
19236 -               count  = __le16_to_cpu(get_unaligned(ptr++));
19237 +       hci_sched_acl(hdev);
19238
19239 -               hdev->acl_cnt += count;
19240 +       hci_sched_sco(hdev);
19241
19242 -               if ((conn = conn_hash_lookup(&hdev->conn_hash, handle)))
19243 -                       conn->sent -= count;
19244 -       }
19245 +       /* Send next queued raw (unknown type) packet */
19246 +       while ((skb = skb_dequeue(&hdev->raw_q)))
19247 +               hci_send_frame(skb);
19248
19249 -       tasklet_enable(&hdev->tx_task);
19250 -
19251 -       hci_sched_tx(hdev);
19252 +       read_unlock(&hci_task_lock);
19253  }
19254
19255 -static inline void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
19256 -{
19257 -       hci_event_hdr *he = (hci_event_hdr *) skb->data;
19258 -       evt_cmd_status *cs;
19259 -       evt_cmd_complete *ec;
19260 -       __u16 opcode, ocf, ogf;
19261 -
19262 -       skb_pull(skb, HCI_EVENT_HDR_SIZE);
19263 -
19264 -       DBG("%s evt 0x%x", hdev->name, he->evt);
19265 -
19266 -       switch (he->evt) {
19267 -       case EVT_NUM_COMP_PKTS:
19268 -               hci_num_comp_pkts_evt(hdev, skb);
19269 -               break;
19270 -
19271 -       case EVT_INQUIRY_COMPLETE:
19272 -               hci_inquiry_complete_evt(hdev, skb);
19273 -               break;
19274 -
19275 -       case EVT_INQUIRY_RESULT:
19276 -               hci_inquiry_result_evt(hdev, skb);
19277 -               break;
19278 -
19279 -       case EVT_CONN_REQUEST:
19280 -               hci_conn_request_evt(hdev, skb);
19281 -               break;
19282 -
19283 -       case EVT_CONN_COMPLETE:
19284 -               hci_conn_complete_evt(hdev, skb);
19285 -               break;
19286 -
19287 -       case EVT_DISCONN_COMPLETE:
19288 -               hci_disconn_complete_evt(hdev, skb);
19289 -               break;
19290 -
19291 -       case EVT_CMD_STATUS:
19292 -               cs = (evt_cmd_status *) skb->data;
19293 -               skb_pull(skb, EVT_CMD_STATUS_SIZE);
19294 -
19295 -               opcode = __le16_to_cpu(cs->opcode);
19296 -               ogf = cmd_opcode_ogf(opcode);
19297 -               ocf = cmd_opcode_ocf(opcode);
19298 -
19299 -               switch (ogf) {
19300 -               case OGF_INFO_PARAM:
19301 -                       hci_cs_info_param(hdev, ocf, cs->status);
19302 -                       break;
19303 -
19304 -               case OGF_HOST_CTL:
19305 -                       hci_cs_host_ctl(hdev, ocf, cs->status);
19306 -                       break;
19307 -
19308 -               case OGF_LINK_CTL:
19309 -                       hci_cs_link_ctl(hdev, ocf, cs->status);
19310 -                       break;
19311 -
19312 -               case OGF_LINK_POLICY:
19313 -                       hci_cs_link_policy(hdev, ocf, cs->status);
19314 -                       break;
19315 -
19316 -               default:
19317 -                       DBG("%s Command Status OGF %x", hdev->name, ogf);
19318 -                       break;
19319 -               };
19320 -
19321 -               if (cs->ncmd) {
19322 -                       atomic_set(&hdev->cmd_cnt, 1);
19323 -                       if (!skb_queue_empty(&hdev->cmd_q))
19324 -                               hci_sched_cmd(hdev);
19325 -               }
19326 -               break;
19327 -
19328 -       case EVT_CMD_COMPLETE:
19329 -               ec = (evt_cmd_complete *) skb->data;
19330 -               skb_pull(skb, EVT_CMD_COMPLETE_SIZE);
19331 -
19332 -               opcode = __le16_to_cpu(ec->opcode);
19333 -               ogf = cmd_opcode_ogf(opcode);
19334 -               ocf = cmd_opcode_ocf(opcode);
19335 -
19336 -               switch (ogf) {
19337 -               case OGF_INFO_PARAM:
19338 -                       hci_cc_info_param(hdev, ocf, skb);
19339 -                       break;
19340 -
19341 -               case OGF_HOST_CTL:
19342 -                       hci_cc_host_ctl(hdev, ocf, skb);
19343 -                       break;
19344 -
19345 -               case OGF_LINK_CTL:
19346 -                       hci_cc_link_ctl(hdev, ocf, skb);
19347 -                       break;
19348 -
19349 -               case OGF_LINK_POLICY:
19350 -                       hci_cc_link_policy(hdev, ocf, skb);
19351 -                       break;
19352
19353 -               default:
19354 -                       DBG("%s Command Completed OGF %x", hdev->name, ogf);
19355 -                       break;
19356 -               };
19357 -
19358 -               if (ec->ncmd) {
19359 -                       atomic_set(&hdev->cmd_cnt, 1);
19360 -                       if (!skb_queue_empty(&hdev->cmd_q))
19361 -                               hci_sched_cmd(hdev);
19362 -               }
19363 -               break;
19364 -       };
19365 -
19366 -       kfree_skb(skb);
19367 -       hdev->stat.evt_rx++;
19368 -}
19369 +/* ----- HCI RX task (incomming data proccessing) ----- */
19370
19371  /* ACL data packet */
19372  static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
19373 @@ -1867,51 +1255,86 @@
19374         flags  = acl_flags(handle);
19375         handle = acl_handle(handle);
19376
19377 -       DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
19378 +       BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
19379 +
19380 +       hdev->stat.acl_rx++;
19381
19382 -       if ((conn = conn_hash_lookup(&hdev->conn_hash, handle))) {
19383 +       hci_dev_lock(hdev);
19384 +       conn = conn_hash_lookup_handle(hdev, handle);
19385 +       hci_dev_unlock(hdev);
19386 +
19387 +       if (conn) {
19388                 register struct hci_proto *hp;
19389
19390                 /* Send to upper protocol */
19391 -               if ((hp = GET_HPROTO(HCI_PROTO_L2CAP)) && hp->recv_acldata) {
19392 +               if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
19393                         hp->recv_acldata(conn, skb, flags);
19394 -                       goto sent;
19395 +                       return;
19396                 }
19397         } else {
19398 -               ERR("%s ACL packet for unknown connection handle %d", hdev->name, handle);
19399 +               BT_ERR("%s ACL packet for unknown connection handle %d",
19400 +                       hdev->name, handle);
19401         }
19402
19403         kfree_skb(skb);
19404 -sent:
19405 -       hdev->stat.acl_rx++;
19406  }
19407
19408  /* SCO data packet */
19409  static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
19410  {
19411 -       DBG("%s len %d", hdev->name, skb->len);
19412 +       hci_sco_hdr *sh = (void *) skb->data;
19413 +       struct hci_conn *conn;
19414 +       __u16 handle;
19415 +
19416 +       skb_pull(skb, HCI_SCO_HDR_SIZE);
19417 +
19418 +       handle = __le16_to_cpu(sh->handle);
19419 +
19420 +       BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
19421
19422 -       kfree_skb(skb);
19423         hdev->stat.sco_rx++;
19424 +
19425 +       hci_dev_lock(hdev);
19426 +       conn = conn_hash_lookup_handle(hdev, handle);
19427 +       hci_dev_unlock(hdev);
19428 +
19429 +       if (conn) {
19430 +               register struct hci_proto *hp;
19431 +
19432 +               /* Send to upper protocol */
19433 +               if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
19434 +                       hp->recv_scodata(conn, skb);
19435 +                       return;
19436 +               }
19437 +       } else {
19438 +               BT_ERR("%s SCO packet for unknown connection handle %d",
19439 +                       hdev->name, handle);
19440 +       }
19441 +
19442 +       kfree_skb(skb);
19443  }
19444
19445 -/* ----- HCI tasks ----- */
19446  void hci_rx_task(unsigned long arg)
19447  {
19448         struct hci_dev *hdev = (struct hci_dev *) arg;
19449         struct sk_buff *skb;
19450
19451 -       DBG("%s", hdev->name);
19452 +       BT_DBG("%s", hdev->name);
19453
19454         read_lock(&hci_task_lock);
19455
19456         while ((skb = skb_dequeue(&hdev->rx_q))) {
19457 -               if (hdev->flags & HCI_SOCK) {
19458 +               if (atomic_read(&hdev->promisc)) {
19459                         /* Send copy to the sockets */
19460                         hci_send_to_sock(hdev, skb);
19461                 }
19462
19463 -               if (hdev->flags & HCI_INIT) {
19464 +               if (test_bit(HCI_RAW, &hdev->flags)) {
19465 +                       kfree_skb(skb);
19466 +                       continue;
19467 +               }
19468 +
19469 +               if (test_bit(HCI_INIT, &hdev->flags)) {
19470                         /* Don't process data packets in this states. */
19471                         switch (skb->pkt_type) {
19472                         case HCI_ACLDATA_PKT:
19473 @@ -1921,64 +1344,43 @@
19474                         };
19475                 }
19476
19477 -               if (hdev->flags & HCI_NORMAL) {
19478 -                       /* Process frame */
19479 -                       switch (skb->pkt_type) {
19480 -                       case HCI_EVENT_PKT:
19481 -                               hci_event_packet(hdev, skb);
19482 -                               break;
19483 +               /* Process frame */
19484 +               switch (skb->pkt_type) {
19485 +               case HCI_EVENT_PKT:
19486 +                       hci_event_packet(hdev, skb);
19487 +                       break;
19488
19489 -                       case HCI_ACLDATA_PKT:
19490 -                               DBG("%s ACL data packet", hdev->name);
19491 -                               hci_acldata_packet(hdev, skb);
19492 -                               break;
19493 +               case HCI_ACLDATA_PKT:
19494 +                       BT_DBG("%s ACL data packet", hdev->name);
19495 +                       hci_acldata_packet(hdev, skb);
19496 +                       break;
19497
19498 -                       case HCI_SCODATA_PKT:
19499 -                               DBG("%s SCO data packet", hdev->name);
19500 -                               hci_scodata_packet(hdev, skb);
19501 -                               break;
19502 +               case HCI_SCODATA_PKT:
19503 +                       BT_DBG("%s SCO data packet", hdev->name);
19504 +                       hci_scodata_packet(hdev, skb);
19505 +                       break;
19506
19507 -                       default:
19508 -                               kfree_skb(skb);
19509 -                               break;
19510 -                       };
19511 -               } else {
19512 +               default:
19513                         kfree_skb(skb);
19514 +                       break;
19515                 }
19516         }
19517
19518         read_unlock(&hci_task_lock);
19519  }
19520
19521 -static void hci_tx_task(unsigned long arg)
19522 -{
19523 -       struct hci_dev *hdev = (struct hci_dev *) arg;
19524 -       struct sk_buff *skb;
19525 -
19526 -       read_lock(&hci_task_lock);
19527 -
19528 -       DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
19529 -
19530 -       /* Schedule queues and send stuff to HCI driver */
19531 -
19532 -       hci_sched_acl(hdev);
19533 -
19534 -       hci_sched_sco(hdev);
19535 -
19536 -       /* Send next queued raw (unknown type) packet */
19537 -       while ((skb = skb_dequeue(&hdev->raw_q)))
19538 -               hci_send_frame(skb);
19539 -
19540 -       read_unlock(&hci_task_lock);
19541 -}
19542 -
19543  static void hci_cmd_task(unsigned long arg)
19544  {
19545         struct hci_dev *hdev = (struct hci_dev *) arg;
19546         struct sk_buff *skb;
19547
19548 -       DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
19549 +       BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
19550
19551 +       if (!atomic_read(&hdev->cmd_cnt) && (jiffies - hdev->cmd_last_tx) > HZ) {
19552 +               BT_ERR("%s command tx timeout", hdev->name);
19553 +               atomic_set(&hdev->cmd_cnt, 1);
19554 +       }
19555 +
19556         /* Send queued commands */
19557         if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
19558                 if (hdev->sent_cmd)
19559 @@ -1987,6 +1389,7 @@
19560                 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
19561                         atomic_dec(&hdev->cmd_cnt);
19562                         hci_send_frame(skb);
19563 +                       hdev->cmd_last_tx = jiffies;
19564                 } else {
19565                         skb_queue_head(&hdev->cmd_q, skb);
19566                         hci_sched_cmd(hdev);
19567 @@ -1994,33 +1397,10 @@
19568         }
19569  }
19570
19571 -/* Receive frame from HCI drivers */
19572 -int hci_recv_frame(struct sk_buff *skb)
19573 -{
19574 -       struct hci_dev *hdev = (struct hci_dev *) skb->dev;
19575 -
19576 -       if (!hdev || !(hdev->flags & (HCI_UP | HCI_INIT))) {
19577 -               kfree_skb(skb);
19578 -               return -1;
19579 -       }
19580 -
19581 -       DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
19582 -
19583 -       /* Incomming skb */
19584 -       bluez_cb(skb)->incomming = 1;
19585 -
19586 -       /* Queue frame for rx task */
19587 -       skb_queue_tail(&hdev->rx_q, skb);
19588 -       hci_sched_rx(hdev);
19589 -
19590 -       return 0;
19591 -}
19592 +/* ---- Initialization ---- */
19593
19594  int hci_core_init(void)
19595  {
19596 -       /* Init locks */
19597 -       spin_lock_init(&hdev_list_lock);
19598 -
19599         return 0;
19600  }
19601
19602 @@ -2028,5 +1408,3 @@
19603  {
19604         return 0;
19605  }
19606 -
19607 -MODULE_LICENSE("GPL");
19608 diff -urN linux-2.4.18/net/bluetooth/hci_event.c linux-2.4.18-mh9/net/bluetooth/hci_event.c
19609 --- linux-2.4.18/net/bluetooth/hci_event.c      Thu Jan  1 01:00:00 1970
19610 +++ linux-2.4.18-mh9/net/bluetooth/hci_event.c  Mon Aug 25 18:38:12 2003
19611 @@ -0,0 +1,927 @@
19612 +/*
19613 +   BlueZ - Bluetooth protocol stack for Linux
19614 +   Copyright (C) 2000-2001 Qualcomm Incorporated
19615 +
19616 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
19617 +
19618 +   This program is free software; you can redistribute it and/or modify
19619 +   it under the terms of the GNU General Public License version 2 as
19620 +   published by the Free Software Foundation;
19621 +
19622 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
19623 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19624 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
19625 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19626 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19627 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19628 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19629 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19630 +
19631 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
19632 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
19633 +   SOFTWARE IS DISCLAIMED.
19634 +*/
19635 +
19636 +/*
19637 + * HCI Events.
19638 + *
19639 + * $Id: hci_event.c,v 1.4 2002/07/27 18:14:38 maxk Exp $
19640 + */
19641 +
19642 +#include <linux/config.h>
19643 +#include <linux/module.h>
19644 +
19645 +#include <linux/types.h>
19646 +#include <linux/errno.h>
19647 +#include <linux/kernel.h>
19648 +#include <linux/major.h>
19649 +#include <linux/sched.h>
19650 +#include <linux/slab.h>
19651 +#include <linux/poll.h>
19652 +#include <linux/fcntl.h>
19653 +#include <linux/init.h>
19654 +#include <linux/skbuff.h>
19655 +#include <linux/interrupt.h>
19656 +#include <linux/notifier.h>
19657 +#include <net/sock.h>
19658 +
19659 +#include <asm/system.h>
19660 +#include <asm/uaccess.h>
19661 +#include <asm/unaligned.h>
19662 +
19663 +#include <net/bluetooth/bluetooth.h>
19664 +#include <net/bluetooth/hci_core.h>
19665 +
19666 +#ifndef HCI_CORE_DEBUG
19667 +#undef  BT_DBG
19668 +#define BT_DBG( A... )
19669 +#endif
19670 +
19671 +/* Handle HCI Event packets */
19672 +
19673 +/* Command Complete OGF LINK_CTL  */
19674 +static void hci_cc_link_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
19675 +{
19676 +       __u8 status;
19677 +
19678 +       BT_DBG("%s ocf 0x%x", hdev->name, ocf);
19679 +
19680 +       switch (ocf) {
19681 +       case OCF_INQUIRY_CANCEL:
19682 +               status = *((__u8 *) skb->data);
19683 +
19684 +               if (status) {
19685 +                       BT_DBG("%s Inquiry cancel error: status 0x%x", hdev->name, status);
19686 +               } else {
19687 +                       clear_bit(HCI_INQUIRY, &hdev->flags);
19688 +                       hci_req_complete(hdev, status);
19689 +               }
19690 +               break;
19691 +
19692 +       default:
19693 +               BT_DBG("%s Command complete: ogf LINK_CTL ocf %x", hdev->name, ocf);
19694 +               break;
19695 +       };
19696 +}
19697 +
19698 +/* Command Complete OGF LINK_POLICY  */
19699 +static void hci_cc_link_policy(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
19700 +{
19701 +       struct hci_conn *conn;
19702 +       role_discovery_rp *rd;
19703 +
19704 +       BT_DBG("%s ocf 0x%x", hdev->name, ocf);
19705 +
19706 +       switch (ocf) {
19707 +       case OCF_ROLE_DISCOVERY:
19708 +               rd = (void *) skb->data;
19709 +
19710 +               if (rd->status)
19711 +                       break;
19712 +
19713 +               hci_dev_lock(hdev);
19714 +
19715 +               conn = conn_hash_lookup_handle(hdev, __le16_to_cpu(rd->handle));
19716 +               if (conn) {
19717 +                       if (rd->role)
19718 +                               conn->link_mode &= ~HCI_LM_MASTER;
19719 +                       else
19720 +                               conn->link_mode |= HCI_LM_MASTER;
19721 +               }
19722 +
19723 +               hci_dev_unlock(hdev);
19724 +               break;
19725 +
19726 +       default:
19727 +               BT_DBG("%s: Command complete: ogf LINK_POLICY ocf %x",
19728 +                               hdev->name, ocf);
19729 +               break;
19730 +       };
19731 +}
19732 +
19733 +/* Command Complete OGF HOST_CTL  */
19734 +static void hci_cc_host_ctl(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
19735 +{
19736 +       __u8 status, param;
19737 +       __u16 setting;
19738 +       read_voice_setting_rp *vs;
19739 +       void *sent;
19740 +
19741 +       BT_DBG("%s ocf 0x%x", hdev->name, ocf);
19742 +
19743 +       switch (ocf) {
19744 +       case OCF_RESET:
19745 +               status = *((__u8 *) skb->data);
19746 +               hci_req_complete(hdev, status);
19747 +               break;
19748 +
19749 +       case OCF_SET_EVENT_FLT:
19750 +               status = *((__u8 *) skb->data);
19751 +               if (status) {
19752 +                       BT_DBG("%s SET_EVENT_FLT failed %d", hdev->name, status);
19753 +               } else {
19754 +                       BT_DBG("%s SET_EVENT_FLT succeseful", hdev->name);
19755 +               }
19756 +               break;
19757 +
19758 +       case OCF_WRITE_AUTH_ENABLE:
19759 +               sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE);
19760 +               if (!sent)
19761 +                       break;
19762 +
19763 +               status = *((__u8 *) skb->data);
19764 +               param  = *((__u8 *) sent);
19765 +
19766 +               if (!status) {
19767 +                       if (param == AUTH_ENABLED)
19768 +                               set_bit(HCI_AUTH, &hdev->flags);
19769 +                       else
19770 +                               clear_bit(HCI_AUTH, &hdev->flags);
19771 +               }
19772 +               hci_req_complete(hdev, status);
19773 +               break;
19774 +
19775 +       case OCF_WRITE_ENCRYPT_MODE:
19776 +               sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE);
19777 +               if (!sent)
19778 +                       break;
19779 +
19780 +               status = *((__u8 *) skb->data);
19781 +               param  = *((__u8 *) sent);
19782 +
19783 +               if (!status) {
19784 +                       if (param)
19785 +                               set_bit(HCI_ENCRYPT, &hdev->flags);
19786 +                       else
19787 +                               clear_bit(HCI_ENCRYPT, &hdev->flags);
19788 +               }
19789 +               hci_req_complete(hdev, status);
19790 +               break;
19791 +
19792 +       case OCF_WRITE_CA_TIMEOUT:
19793 +               status = *((__u8 *) skb->data);
19794 +               if (status) {
19795 +                       BT_DBG("%s OCF_WRITE_CA_TIMEOUT failed %d", hdev->name, status);
19796 +               } else {
19797 +                       BT_DBG("%s OCF_WRITE_CA_TIMEOUT succeseful", hdev->name);
19798 +               }
19799 +               break;
19800 +
19801 +       case OCF_WRITE_PG_TIMEOUT:
19802 +               status = *((__u8 *) skb->data);
19803 +               if (status) {
19804 +                       BT_DBG("%s OCF_WRITE_PG_TIMEOUT failed %d", hdev->name, status);
19805 +               } else {
19806 +                       BT_DBG("%s: OCF_WRITE_PG_TIMEOUT succeseful", hdev->name);
19807 +               }
19808 +               break;
19809 +
19810 +       case OCF_WRITE_SCAN_ENABLE:
19811 +               sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE);
19812 +               if (!sent)
19813 +                       break;
19814 +
19815 +               status = *((__u8 *) skb->data);
19816 +               param  = *((__u8 *) sent);
19817 +
19818 +               BT_DBG("param 0x%x", param);
19819 +
19820 +               if (!status) {
19821 +                       clear_bit(HCI_PSCAN, &hdev->flags);
19822 +                       clear_bit(HCI_ISCAN, &hdev->flags);
19823 +                       if (param & SCAN_INQUIRY)
19824 +                               set_bit(HCI_ISCAN, &hdev->flags);
19825 +
19826 +                       if (param & SCAN_PAGE)
19827 +                               set_bit(HCI_PSCAN, &hdev->flags);
19828 +               }
19829 +               hci_req_complete(hdev, status);
19830 +               break;
19831 +
19832 +       case OCF_READ_VOICE_SETTING:
19833 +               vs = (read_voice_setting_rp *) skb->data;
19834 +
19835 +               if (vs->status) {
19836 +                       BT_DBG("%s READ_VOICE_SETTING failed %d", hdev->name, vc->status);
19837 +                       break;
19838 +               }
19839 +
19840 +               setting = __le16_to_cpu(vs->voice_setting);
19841 +
19842 +               if (hdev->voice_setting != setting ) {
19843 +                       hdev->voice_setting = setting;
19844 +
19845 +                       BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
19846 +
19847 +                       if (hdev->notify)
19848 +                               hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING, 0);
19849 +               }
19850 +
19851 +               break;
19852 +
19853 +       case OCF_WRITE_VOICE_SETTING:
19854 +               sent = hci_sent_cmd_data(hdev, OGF_HOST_CTL, OCF_WRITE_VOICE_SETTING);
19855 +               if (!sent)
19856 +                       break;
19857 +
19858 +               status = *((__u8 *) skb->data);
19859 +               setting = __le16_to_cpu(get_unaligned((__u16 *) sent));
19860 +
19861 +               if (!status && hdev->voice_setting != setting) {
19862 +                       hdev->voice_setting = setting;
19863 +
19864 +                       BT_DBG("%s: voice setting 0x%04x", hdev->name, setting);
19865 +
19866 +                       if (hdev->notify)
19867 +                               hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING, 0);
19868 +               }
19869 +               hci_req_complete(hdev, status);
19870 +               break;
19871 +
19872 +       case OCF_HOST_BUFFER_SIZE:
19873 +               status = *((__u8 *) skb->data);
19874 +               if (status) {
19875 +                       BT_DBG("%s OCF_BUFFER_SIZE failed %d", hdev->name, status);
19876 +                       hci_req_complete(hdev, status);
19877 +               }
19878 +               break;
19879 +
19880 +       default:
19881 +               BT_DBG("%s Command complete: ogf HOST_CTL ocf %x", hdev->name, ocf);
19882 +               break;
19883 +       };
19884 +}
19885 +
19886 +/* Command Complete OGF INFO_PARAM  */
19887 +static void hci_cc_info_param(struct hci_dev *hdev, __u16 ocf, struct sk_buff *skb)
19888 +{
19889 +       read_local_features_rp *lf;
19890 +       read_buffer_size_rp *bs;
19891 +       read_bd_addr_rp *ba;
19892 +
19893 +       BT_DBG("%s ocf 0x%x", hdev->name, ocf);
19894 +
19895 +       switch (ocf) {
19896 +       case OCF_READ_LOCAL_FEATURES:
19897 +               lf = (read_local_features_rp *) skb->data;
19898 +
19899 +               if (lf->status) {
19900 +                       BT_DBG("%s READ_LOCAL_FEATURES failed %d", hdev->name, lf->status);
19901 +                       break;
19902 +               }
19903 +
19904 +               memcpy(hdev->features, lf->features, sizeof(hdev->features));
19905 +
19906 +               /* Adjust default settings according to features
19907 +                * supported by device. */
19908 +               if (hdev->features[0] & LMP_3SLOT)
19909 +                       hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
19910 +
19911 +               if (hdev->features[0] & LMP_5SLOT)
19912 +                       hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
19913 +
19914 +               if (hdev->features[1] & LMP_HV2)
19915 +                       hdev->pkt_type |= (HCI_HV2);
19916 +
19917 +               if (hdev->features[1] & LMP_HV3)
19918 +                       hdev->pkt_type |= (HCI_HV3);
19919 +
19920 +               BT_DBG("%s: features 0x%x 0x%x 0x%x", hdev->name, lf->features[0], lf->features[1], lf->features[2]);
19921 +
19922 +               break;
19923 +
19924 +       case OCF_READ_BUFFER_SIZE:
19925 +               bs = (read_buffer_size_rp *) skb->data;
19926 +
19927 +               if (bs->status) {
19928 +                       BT_DBG("%s READ_BUFFER_SIZE failed %d", hdev->name, bs->status);
19929 +                       hci_req_complete(hdev, bs->status);
19930 +                       break;
19931 +               }
19932 +
19933 +               hdev->acl_mtu  = __le16_to_cpu(bs->acl_mtu);
19934 +               hdev->sco_mtu  = bs->sco_mtu ? bs->sco_mtu : 64;
19935 +               hdev->acl_pkts = hdev->acl_cnt = __le16_to_cpu(bs->acl_max_pkt);
19936 +               hdev->sco_pkts = hdev->sco_cnt = __le16_to_cpu(bs->sco_max_pkt);
19937 +
19938 +               BT_DBG("%s mtu: acl %d, sco %d max_pkt: acl %d, sco %d", hdev->name,
19939 +                       hdev->acl_mtu, hdev->sco_mtu, hdev->acl_pkts, hdev->sco_pkts);
19940 +
19941 +               break;
19942 +
19943 +       case OCF_READ_BD_ADDR:
19944 +               ba = (read_bd_addr_rp *) skb->data;
19945 +
19946 +               if (!ba->status) {
19947 +                       bacpy(&hdev->bdaddr, &ba->bdaddr);
19948 +               } else {
19949 +                       BT_DBG("%s: READ_BD_ADDR failed %d", hdev->name, ba->status);
19950 +               }
19951 +
19952 +               hci_req_complete(hdev, ba->status);
19953 +               break;
19954 +
19955 +       default:
19956 +               BT_DBG("%s Command complete: ogf INFO_PARAM ocf %x", hdev->name, ocf);
19957 +               break;
19958 +       };
19959 +}
19960 +
19961 +/* Command Status OGF LINK_CTL  */
19962 +static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
19963 +{
19964 +       struct hci_conn *conn;
19965 +       create_conn_cp *cc = hci_sent_cmd_data(hdev, OGF_LINK_CTL, OCF_CREATE_CONN);
19966 +
19967 +       if (!cc)
19968 +               return;
19969 +
19970 +       hci_dev_lock(hdev);
19971 +
19972 +       conn = conn_hash_lookup_ba(hdev, ACL_LINK, &cc->bdaddr);
19973 +
19974 +       BT_DBG("%s status 0x%x bdaddr %s conn %p", hdev->name,
19975 +                       status, batostr(&cc->bdaddr), conn);
19976 +
19977 +       if (status) {
19978 +               if (conn) {
19979 +                       conn->state = BT_CLOSED;
19980 +                       hci_proto_connect_cfm(conn, status);
19981 +                       hci_conn_del(conn);
19982 +               }
19983 +       } else {
19984 +               if (!conn) {
19985 +                       conn = hci_conn_add(hdev, ACL_LINK, &cc->bdaddr);
19986 +                       if (conn) {
19987 +                               conn->out = 1;
19988 +                               conn->link_mode |= HCI_LM_MASTER;
19989 +                       } else
19990 +                               BT_ERR("No memmory for new connection");
19991 +               }
19992 +       }
19993 +
19994 +       hci_dev_unlock(hdev);
19995 +}
19996 +
19997 +static void hci_cs_link_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
19998 +{
19999 +       BT_DBG("%s ocf 0x%x", hdev->name, ocf);
20000 +
20001 +       switch (ocf) {
20002 +       case OCF_CREATE_CONN:
20003 +               hci_cs_create_conn(hdev, status);
20004 +               break;
20005 +
20006 +       case OCF_ADD_SCO:
20007 +               if (status) {
20008 +                       struct hci_conn *acl, *sco;
20009 +                       add_sco_cp *cp = hci_sent_cmd_data(hdev,
20010 +                                               OGF_LINK_CTL, OCF_ADD_SCO);
20011 +                       __u16 handle;
20012 +
20013 +                       if (!cp)
20014 +                               break;
20015 +
20016 +                       handle = __le16_to_cpu(cp->handle);
20017 +
20018 +                       BT_DBG("%s Add SCO error: handle %d status 0x%x", hdev->name, handle, status);
20019 +
20020 +                       hci_dev_lock(hdev);
20021 +
20022 +                       acl = conn_hash_lookup_handle(hdev, handle);
20023 +                       if (acl && (sco = acl->link)) {
20024 +                               sco->state = BT_CLOSED;
20025 +                               hci_proto_connect_cfm(sco, status);
20026 +                               hci_conn_del(sco);
20027 +                       }
20028 +
20029 +                       hci_dev_unlock(hdev);
20030 +               }
20031 +               break;
20032 +
20033 +       case OCF_INQUIRY:
20034 +               if (status) {
20035 +                       BT_DBG("%s Inquiry error: status 0x%x", hdev->name, status);
20036 +                       hci_req_complete(hdev, status);
20037 +               } else {
20038 +                       set_bit(HCI_INQUIRY, &hdev->flags);
20039 +               }
20040 +               break;
20041 +
20042 +       default:
20043 +               BT_DBG("%s Command status: ogf LINK_CTL ocf %x status %d",
20044 +                       hdev->name, ocf, status);
20045 +               break;
20046 +       };
20047 +}
20048 +
20049 +/* Command Status OGF LINK_POLICY */
20050 +static void hci_cs_link_policy(struct hci_dev *hdev, __u16 ocf, __u8 status)
20051 +{
20052 +       BT_DBG("%s ocf 0x%x", hdev->name, ocf);
20053 +
20054 +       switch (ocf) {
20055 +       default:
20056 +               BT_DBG("%s Command status: ogf HOST_POLICY ocf %x", hdev->name, ocf);
20057 +               break;
20058 +       };
20059 +}
20060 +
20061 +/* Command Status OGF HOST_CTL */
20062 +static void hci_cs_host_ctl(struct hci_dev *hdev, __u16 ocf, __u8 status)
20063 +{
20064 +       BT_DBG("%s ocf 0x%x", hdev->name, ocf);
20065 +
20066 +       switch (ocf) {
20067 +       default:
20068 +               BT_DBG("%s Command status: ogf HOST_CTL ocf %x", hdev->name, ocf);
20069 +               break;
20070 +       };
20071 +}
20072 +
20073 +/* Command Status OGF INFO_PARAM  */
20074 +static void hci_cs_info_param(struct hci_dev *hdev, __u16 ocf, __u8 status)
20075 +{
20076 +       BT_DBG("%s: hci_cs_info_param: ocf 0x%x", hdev->name, ocf);
20077 +
20078 +       switch (ocf) {
20079 +       default:
20080 +               BT_DBG("%s Command status: ogf INFO_PARAM ocf %x", hdev->name, ocf);
20081 +               break;
20082 +       };
20083 +}
20084 +
20085 +/* Inquiry Complete */
20086 +static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
20087 +{
20088 +       __u8 status = *((__u8 *) skb->data);
20089 +
20090 +       BT_DBG("%s status %d", hdev->name, status);
20091 +
20092 +       clear_bit(HCI_INQUIRY, &hdev->flags);
20093 +       hci_req_complete(hdev, status);
20094 +}
20095 +
20096 +/* Inquiry Result */
20097 +static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
20098 +{
20099 +       inquiry_info *info = (inquiry_info *) (skb->data + 1);
20100 +       int num_rsp = *((__u8 *) skb->data);
20101 +
20102 +       BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
20103 +
20104 +       hci_dev_lock(hdev);
20105 +       for (; num_rsp; num_rsp--)
20106 +               inquiry_cache_update(hdev, info++);
20107 +       hci_dev_unlock(hdev);
20108 +}
20109 +
20110 +/* Connect Request */
20111 +static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
20112 +{
20113 +       evt_conn_request *cr = (evt_conn_request *) skb->data;
20114 +       int mask = hdev->link_mode;
20115 +
20116 +       BT_DBG("%s Connection request: %s type 0x%x", hdev->name,
20117 +                       batostr(&cr->bdaddr), cr->link_type);
20118 +
20119 +       mask |= hci_proto_connect_ind(hdev, &cr->bdaddr, cr->link_type);
20120 +
20121 +       if (mask & HCI_LM_ACCEPT) {
20122 +               /* Connection accepted */
20123 +               struct hci_conn *conn;
20124 +               accept_conn_req_cp ac;
20125 +
20126 +               hci_dev_lock(hdev);
20127 +               conn = conn_hash_lookup_ba(hdev, cr->link_type, &cr->bdaddr);
20128 +               if (!conn) {
20129 +                       if (!(conn = hci_conn_add(hdev, cr->link_type, &cr->bdaddr))) {
20130 +                               BT_ERR("No memmory for new connection");
20131 +                               hci_dev_unlock(hdev);
20132 +                               return;
20133 +                       }
20134 +               }
20135 +               conn->state = BT_CONNECT;
20136 +               hci_dev_unlock(hdev);
20137 +
20138 +               bacpy(&ac.bdaddr, &cr->bdaddr);
20139 +
20140 +               if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
20141 +                       ac.role = 0x00; /* Become master */
20142 +               else
20143 +                       ac.role = 0x01; /* Remain slave */
20144 +
20145 +               hci_send_cmd(hdev, OGF_LINK_CTL, OCF_ACCEPT_CONN_REQ,
20146 +                               ACCEPT_CONN_REQ_CP_SIZE, &ac);
20147 +       } else {
20148 +               /* Connection rejected */
20149 +               reject_conn_req_cp rc;
20150 +
20151 +               bacpy(&rc.bdaddr, &cr->bdaddr);
20152 +               rc.reason = 0x0f;
20153 +               hci_send_cmd(hdev, OGF_LINK_CTL, OCF_REJECT_CONN_REQ,
20154 +                               REJECT_CONN_REQ_CP_SIZE, &rc);
20155 +       }
20156 +}
20157 +
20158 +/* Connect Complete */
20159 +static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
20160 +{
20161 +       evt_conn_complete *cc = (evt_conn_complete *) skb->data;
20162 +       struct hci_conn *conn = NULL;
20163 +
20164 +       BT_DBG("%s", hdev->name);
20165 +
20166 +       hci_dev_lock(hdev);
20167 +
20168 +       conn = conn_hash_lookup_ba(hdev, cc->link_type, &cc->bdaddr);
20169 +       if (!conn) {
20170 +               hci_dev_unlock(hdev);
20171 +               return;
20172 +       }
20173 +
20174 +       if (!cc->status) {
20175 +               conn->handle = __le16_to_cpu(cc->handle);
20176 +               conn->state  = BT_CONNECTED;
20177 +
20178 +               if (test_bit(HCI_AUTH, &hdev->flags))
20179 +                       conn->link_mode |= HCI_LM_AUTH;
20180 +
20181 +               if (test_bit(HCI_ENCRYPT, &hdev->flags))
20182 +                       conn->link_mode |= HCI_LM_ENCRYPT;
20183 +
20184 +
20185 +               /* Set link policy */
20186 +               if (conn->type == ACL_LINK && hdev->link_policy) {
20187 +                       write_link_policy_cp lp;
20188 +                       lp.handle = cc->handle;
20189 +                       lp.policy = __cpu_to_le16(hdev->link_policy);
20190 +                       hci_send_cmd(hdev, OGF_LINK_POLICY, OCF_WRITE_LINK_POLICY,
20191 +                               WRITE_LINK_POLICY_CP_SIZE, &lp);
20192 +               }
20193 +
20194 +               /* Set packet type for incomming connection */
20195 +               if (!conn->out) {
20196 +                       change_conn_ptype_cp cp;
20197 +                       cp.handle = cc->handle;
20198 +                       cp.pkt_type = (conn->type == ACL_LINK) ?
20199 +                               __cpu_to_le16(hdev->pkt_type & ACL_PTYPE_MASK):
20200 +                               __cpu_to_le16(hdev->pkt_type & SCO_PTYPE_MASK);
20201 +
20202 +                       hci_send_cmd(hdev, OGF_LINK_CTL, OCF_CHANGE_CONN_PTYPE,
20203 +                               CHANGE_CONN_PTYPE_CP_SIZE, &cp);
20204 +               }
20205 +       } else
20206 +               conn->state = BT_CLOSED;
20207 +
20208 +       if (conn->type == ACL_LINK) {
20209 +               struct hci_conn *sco = conn->link;
20210 +               if (sco) {
20211 +                       if (!cc->status)
20212 +                               hci_add_sco(sco, conn->handle);
20213 +                       else {
20214 +                               hci_proto_connect_cfm(sco, cc->status);
20215 +                               hci_conn_del(sco);
20216 +                       }
20217 +               }
20218 +       }
20219 +
20220 +       hci_proto_connect_cfm(conn, cc->status);
20221 +       if (cc->status)
20222 +               hci_conn_del(conn);
20223 +
20224 +       hci_dev_unlock(hdev);
20225 +}
20226 +
20227 +/* Disconnect Complete */
20228 +static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
20229 +{
20230 +       evt_disconn_complete *dc = (evt_disconn_complete *) skb->data;
20231 +       struct hci_conn *conn = NULL;
20232 +       __u16 handle = __le16_to_cpu(dc->handle);
20233 +
20234 +       BT_DBG("%s status %d", hdev->name, dc->status);
20235 +
20236 +       if (dc->status)
20237 +               return;
20238 +
20239 +       hci_dev_lock(hdev);
20240 +
20241 +       conn = conn_hash_lookup_handle(hdev, handle);
20242 +       if (conn) {
20243 +               conn->state = BT_CLOSED;
20244 +               hci_proto_disconn_ind(conn, dc->reason);
20245 +               hci_conn_del(conn);
20246 +       }
20247 +
20248 +       hci_dev_unlock(hdev);
20249 +}
20250 +
20251 +/* Number of completed packets */
20252 +static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
20253 +{
20254 +       evt_num_comp_pkts *nc = (evt_num_comp_pkts *) skb->data;
20255 +       __u16 *ptr;
20256 +       int i;
20257 +
20258 +       skb_pull(skb, EVT_NUM_COMP_PKTS_SIZE);
20259 +
20260 +       BT_DBG("%s num_hndl %d", hdev->name, nc->num_hndl);
20261 +
20262 +       if (skb->len < nc->num_hndl * 4) {
20263 +               BT_DBG("%s bad parameters", hdev->name);
20264 +               return;
20265 +       }
20266 +
20267 +       tasklet_disable(&hdev->tx_task);
20268 +
20269 +       for (i = 0, ptr = (__u16 *) skb->data; i < nc->num_hndl; i++) {
20270 +               struct hci_conn *conn;
20271 +               __u16  handle, count;
20272 +
20273 +               handle = __le16_to_cpu(get_unaligned(ptr++));
20274 +               count  = __le16_to_cpu(get_unaligned(ptr++));
20275 +
20276 +               conn = conn_hash_lookup_handle(hdev, handle);
20277 +               if (conn) {
20278 +                       conn->sent -= count;
20279 +
20280 +                       if (conn->type == SCO_LINK) {
20281 +                               if ((hdev->sco_cnt += count) > hdev->sco_pkts)
20282 +                                       hdev->sco_cnt = hdev->sco_pkts;
20283 +                       } else {
20284 +                               if ((hdev->acl_cnt += count) > hdev->acl_pkts)
20285 +                                       hdev->acl_cnt = hdev->acl_pkts;
20286 +                       }
20287 +               }
20288 +       }
20289 +       hci_sched_tx(hdev);
20290 +
20291 +       tasklet_enable(&hdev->tx_task);
20292 +}
20293 +
20294 +/* Role Change */
20295 +static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
20296 +{
20297 +       evt_role_change *rc = (evt_role_change *) skb->data;
20298 +       struct hci_conn *conn = NULL;
20299 +
20300 +       BT_DBG("%s status %d", hdev->name, rc->status);
20301 +
20302 +       if (rc->status)
20303 +               return;
20304 +
20305 +       hci_dev_lock(hdev);
20306 +
20307 +       conn = conn_hash_lookup_ba(hdev, ACL_LINK, &rc->bdaddr);
20308 +       if (conn) {
20309 +               if (rc->role)
20310 +                       conn->link_mode &= ~HCI_LM_MASTER;
20311 +               else
20312 +                       conn->link_mode |= HCI_LM_MASTER;
20313 +       }
20314 +
20315 +       hci_dev_unlock(hdev);
20316 +}
20317 +
20318 +/* Authentication Complete */
20319 +static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
20320 +{
20321 +       evt_auth_complete *ac = (evt_auth_complete *) skb->data;
20322 +       struct hci_conn *conn = NULL;
20323 +       __u16 handle = __le16_to_cpu(ac->handle);
20324 +
20325 +       BT_DBG("%s status %d", hdev->name, ac->status);
20326 +
20327 +       hci_dev_lock(hdev);
20328 +
20329 +       conn = conn_hash_lookup_handle(hdev, handle);
20330 +       if (conn) {
20331 +               if (!ac->status)
20332 +                       conn->link_mode |= HCI_LM_AUTH;
20333 +               clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
20334 +
20335 +               hci_proto_auth_cfm(conn, ac->status);
20336 +
20337 +               if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
20338 +                       if (!ac->status) {
20339 +                               set_conn_encrypt_cp ce;
20340 +                               ce.handle  = __cpu_to_le16(conn->handle);
20341 +                               ce.encrypt = 1;
20342 +                               hci_send_cmd(conn->hdev, OGF_LINK_CTL,
20343 +                                               OCF_SET_CONN_ENCRYPT,
20344 +                                               SET_CONN_ENCRYPT_CP_SIZE, &ce);
20345 +                       } else {
20346 +                               clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
20347 +                               hci_proto_encrypt_cfm(conn, ac->status);
20348 +                       }
20349 +               }
20350 +       }
20351 +
20352 +       hci_dev_unlock(hdev);
20353 +}
20354 +
20355 +/* Encryption Change */
20356 +static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
20357 +{
20358 +       evt_encrypt_change *ec = (evt_encrypt_change *) skb->data;
20359 +       struct hci_conn *conn = NULL;
20360 +       __u16 handle = __le16_to_cpu(ec->handle);
20361 +
20362 +       BT_DBG("%s status %d", hdev->name, ec->status);
20363 +
20364 +       hci_dev_lock(hdev);
20365 +
20366 +       conn = conn_hash_lookup_handle(hdev, handle);
20367 +       if (conn) {
20368 +               if (!ec->status) {
20369 +                       if (ec->encrypt)
20370 +                               conn->link_mode |= HCI_LM_ENCRYPT;
20371 +                       else
20372 +                               conn->link_mode &= ~HCI_LM_ENCRYPT;
20373 +               }
20374 +               clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
20375 +
20376 +               hci_proto_encrypt_cfm(conn, ec->status);
20377 +       }
20378 +
20379 +       hci_dev_unlock(hdev);
20380 +}
20381 +
20382 +void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
20383 +{
20384 +       hci_event_hdr *he = (hci_event_hdr *) skb->data;
20385 +       evt_cmd_status *cs;
20386 +       evt_cmd_complete *ec;
20387 +       __u16 opcode, ocf, ogf;
20388 +
20389 +       skb_pull(skb, HCI_EVENT_HDR_SIZE);
20390 +
20391 +       BT_DBG("%s evt 0x%x", hdev->name, he->evt);
20392 +
20393 +       switch (he->evt) {
20394 +       case EVT_NUM_COMP_PKTS:
20395 +               hci_num_comp_pkts_evt(hdev, skb);
20396 +               break;
20397 +
20398 +       case EVT_INQUIRY_COMPLETE:
20399 +               hci_inquiry_complete_evt(hdev, skb);
20400 +               break;
20401 +
20402 +       case EVT_INQUIRY_RESULT:
20403 +               hci_inquiry_result_evt(hdev, skb);
20404 +               break;
20405 +
20406 +       case EVT_CONN_REQUEST:
20407 +               hci_conn_request_evt(hdev, skb);
20408 +               break;
20409 +
20410 +       case EVT_CONN_COMPLETE:
20411 +               hci_conn_complete_evt(hdev, skb);
20412 +               break;
20413 +
20414 +       case EVT_DISCONN_COMPLETE:
20415 +               hci_disconn_complete_evt(hdev, skb);
20416 +               break;
20417 +
20418 +       case EVT_ROLE_CHANGE:
20419 +               hci_role_change_evt(hdev, skb);
20420 +               break;
20421 +
20422 +       case EVT_AUTH_COMPLETE:
20423 +               hci_auth_complete_evt(hdev, skb);
20424 +               break;
20425 +
20426 +       case EVT_ENCRYPT_CHANGE:
20427 +               hci_encrypt_change_evt(hdev, skb);
20428 +               break;
20429 +
20430 +       case EVT_CMD_STATUS:
20431 +               cs = (evt_cmd_status *) skb->data;
20432 +               skb_pull(skb, EVT_CMD_STATUS_SIZE);
20433 +
20434 +               opcode = __le16_to_cpu(cs->opcode);
20435 +               ogf = cmd_opcode_ogf(opcode);
20436 +               ocf = cmd_opcode_ocf(opcode);
20437 +
20438 +               switch (ogf) {
20439 +               case OGF_INFO_PARAM:
20440 +                       hci_cs_info_param(hdev, ocf, cs->status);
20441 +                       break;
20442 +
20443 +               case OGF_HOST_CTL:
20444 +                       hci_cs_host_ctl(hdev, ocf, cs->status);
20445 +                       break;
20446 +
20447 +               case OGF_LINK_CTL:
20448 +                       hci_cs_link_ctl(hdev, ocf, cs->status);
20449 +                       break;
20450 +
20451 +               case OGF_LINK_POLICY:
20452 +                       hci_cs_link_policy(hdev, ocf, cs->status);
20453 +                       break;
20454 +
20455 +               default:
20456 +                       BT_DBG("%s Command Status OGF %x", hdev->name, ogf);
20457 +                       break;
20458 +               };
20459 +
20460 +               if (cs->ncmd) {
20461 +                       atomic_set(&hdev->cmd_cnt, 1);
20462 +                       if (!skb_queue_empty(&hdev->cmd_q))
20463 +                               hci_sched_cmd(hdev);
20464 +               }
20465 +               break;
20466 +
20467 +       case EVT_CMD_COMPLETE:
20468 +               ec = (evt_cmd_complete *) skb->data;
20469 +               skb_pull(skb, EVT_CMD_COMPLETE_SIZE);
20470 +
20471 +               opcode = __le16_to_cpu(ec->opcode);
20472 +               ogf = cmd_opcode_ogf(opcode);
20473 +               ocf = cmd_opcode_ocf(opcode);
20474 +
20475 +               switch (ogf) {
20476 +               case OGF_INFO_PARAM:
20477 +                       hci_cc_info_param(hdev, ocf, skb);
20478 +                       break;
20479 +
20480 +               case OGF_HOST_CTL:
20481 +                       hci_cc_host_ctl(hdev, ocf, skb);
20482 +                       break;
20483 +
20484 +               case OGF_LINK_CTL:
20485 +                       hci_cc_link_ctl(hdev, ocf, skb);
20486 +                       break;
20487 +
20488 +               case OGF_LINK_POLICY:
20489 +                       hci_cc_link_policy(hdev, ocf, skb);
20490 +                       break;
20491 +
20492 +               default:
20493 +                       BT_DBG("%s Command Completed OGF %x", hdev->name, ogf);
20494 +                       break;
20495 +               };
20496 +
20497 +               if (ec->ncmd) {
20498 +                       atomic_set(&hdev->cmd_cnt, 1);
20499 +                       if (!skb_queue_empty(&hdev->cmd_q))
20500 +                               hci_sched_cmd(hdev);
20501 +               }
20502 +               break;
20503 +       };
20504 +
20505 +       kfree_skb(skb);
20506 +       hdev->stat.evt_rx++;
20507 +}
20508 +
20509 +/* General internal stack event */
20510 +void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
20511 +{
20512 +       hci_event_hdr *eh;
20513 +       evt_stack_internal *si;
20514 +       struct sk_buff *skb;
20515 +       int size;
20516 +       void *ptr;
20517 +
20518 +       size = HCI_EVENT_HDR_SIZE + EVT_STACK_INTERNAL_SIZE + dlen;
20519 +       skb  = bluez_skb_alloc(size, GFP_ATOMIC);
20520 +       if (!skb)
20521 +               return;
20522 +
20523 +       ptr = skb_put(skb, size);
20524 +
20525 +       eh = ptr;
20526 +               eh->evt  = EVT_STACK_INTERNAL;
20527 +       eh->plen = EVT_STACK_INTERNAL_SIZE + dlen;
20528 +       ptr += HCI_EVENT_HDR_SIZE;
20529 +
20530 +       si = ptr;
20531 +       si->type = type;
20532 +       memcpy(si->data, data, dlen);
20533 +
20534 +       skb->pkt_type = HCI_EVENT_PKT;
20535 +       skb->dev = (void *) hdev;
20536 +       hci_send_to_sock(hdev, skb);
20537 +       kfree_skb(skb);
20538 +}
20539 diff -urN linux-2.4.18/net/bluetooth/hci_sock.c linux-2.4.18-mh9/net/bluetooth/hci_sock.c
20540 --- linux-2.4.18/net/bluetooth/hci_sock.c       Fri Sep  7 18:28:38 2001
20541 +++ linux-2.4.18-mh9/net/bluetooth/hci_sock.c   Mon Aug 25 18:38:12 2003
20542 @@ -25,7 +25,7 @@
20543  /*
20544   * BlueZ HCI socket layer.
20545   *
20546 - * $Id: hci_sock.c,v 1.9 2001/08/05 06:02:16 maxk Exp $
20547 + * $Id: hci_sock.c,v 1.5 2002/07/22 20:32:54 maxk Exp $
20548   */
20549
20550  #include <linux/config.h>
20551 @@ -49,45 +49,54 @@
20552
20553  #include <asm/system.h>
20554  #include <asm/uaccess.h>
20555 +#include <asm/unaligned.h>
20556
20557  #include <net/bluetooth/bluetooth.h>
20558 -#include <net/bluetooth/bluez.h>
20559  #include <net/bluetooth/hci_core.h>
20560
20561  #ifndef HCI_SOCK_DEBUG
20562 -#undef  DBG
20563 -#define DBG( A... )
20564 +#undef  BT_DBG
20565 +#define BT_DBG( A... )
20566  #endif
20567
20568 -/* HCI socket interface */
20569 +/* ----- HCI socket interface ----- */
20570 +
20571 +/* Security filter */
20572 +static struct hci_sec_filter hci_sec_filter = {
20573 +       /* Packet types */
20574 +       0x10,
20575 +       /* Events */
20576 +       { 0xd9fe, 0x0 },
20577 +       /* Commands */
20578 +       {
20579 +               { 0x0 },
20580 +               /* OGF_LINK_CTL */
20581 +               { 0x2a000002, 0x0, 0x0, 0x0  },
20582 +               /* OGF_LINK_POLICY */
20583 +               { 0x1200, 0x0, 0x0, 0x0      },
20584 +               /* OGF_HOST_CTL */
20585 +               { 0x80100000, 0x202a, 0x0, 0x0 },
20586 +               /* OGF_INFO_PARAM */
20587 +               { 0x22a, 0x0, 0x0, 0x0       },
20588 +               /* OGF_STATUS_PARAM */
20589 +               { 0x2e, 0x0, 0x0, 0x0        }
20590 +       }
20591 +};
20592
20593  static struct bluez_sock_list hci_sk_list = {
20594         lock: RW_LOCK_UNLOCKED
20595  };
20596
20597 -static struct sock *hci_sock_lookup(struct hci_dev *hdev)
20598 -{
20599 -       struct sock *sk;
20600 -
20601 -       read_lock(&hci_sk_list.lock);
20602 -       for (sk = hci_sk_list.head; sk; sk = sk->next) {
20603 -               if (hci_pi(sk)->hdev == hdev)
20604 -                       break;
20605 -       }
20606 -       read_unlock(&hci_sk_list.lock);
20607 -       return sk;
20608 -}
20609 -
20610  /* Send frame to RAW socket */
20611  void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
20612  {
20613         struct sock * sk;
20614
20615 -       DBG("hdev %p len %d", hdev, skb->len);
20616 +       BT_DBG("hdev %p len %d", hdev, skb->len);
20617
20618         read_lock(&hci_sk_list.lock);
20619         for (sk = hci_sk_list.head; sk; sk = sk->next) {
20620 -               struct hci_filter *flt;
20621 +               struct hci_filter *flt;
20622                 struct sk_buff *nskb;
20623
20624                 if (sk->state != BT_BOUND || hci_pi(sk)->hdev != hdev)
20625 @@ -100,13 +109,19 @@
20626                 /* Apply filter */
20627                 flt = &hci_pi(sk)->filter;
20628
20629 -               if (!test_bit(skb->pkt_type, &flt->type_mask))
20630 +               if (!hci_test_bit((skb->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
20631                         continue;
20632
20633                 if (skb->pkt_type == HCI_EVENT_PKT) {
20634 -                       register int evt = (*(__u8 *)skb->data & 63);
20635 +                       register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
20636 +
20637 +                       if (!hci_test_bit(evt, &flt->event_mask))
20638 +                               continue;
20639
20640 -                       if (!test_bit(evt, &flt->event_mask))
20641 +                       if (flt->opcode && ((evt == EVT_CMD_COMPLETE &&
20642 +                                       flt->opcode != *(__u16 *)(skb->data + 3)) ||
20643 +                                       (evt == EVT_CMD_STATUS &&
20644 +                                       flt->opcode != *(__u16 *)(skb->data + 4))))
20645                                 continue;
20646                 }
20647
20648 @@ -116,8 +131,8 @@
20649                 /* Put type byte before the data */
20650                 memcpy(skb_push(nskb, 1), &nskb->pkt_type, 1);
20651
20652 -               skb_queue_tail(&sk->receive_queue, nskb);
20653 -               sk->data_ready(sk, nskb->len);
20654 +               if (sock_queue_rcv_skb(sk, nskb))
20655 +                       kfree_skb(nskb);
20656         }
20657         read_unlock(&hci_sk_list.lock);
20658  }
20659 @@ -127,7 +142,7 @@
20660         struct sock *sk = sock->sk;
20661         struct hci_dev *hdev = hci_pi(sk)->hdev;
20662
20663 -       DBG("sock %p sk %p", sock, sk);
20664 +       BT_DBG("sock %p sk %p", sock, sk);
20665
20666         if (!sk)
20667                 return 0;
20668 @@ -135,9 +150,7 @@
20669         bluez_sock_unlink(&hci_sk_list, sk);
20670
20671         if (hdev) {
20672 -               if (!hci_sock_lookup(hdev))
20673 -                       hdev->flags &= ~HCI_SOCK;
20674 -
20675 +               atomic_dec(&hdev->promisc);
20676                 hci_dev_put(hdev);
20677         }
20678
20679 @@ -149,24 +162,55 @@
20680         sock_put(sk);
20681
20682         MOD_DEC_USE_COUNT;
20683 -
20684         return 0;
20685  }
20686
20687 -static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
20688 +/* Ioctls that require bound socket */
20689 +static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
20690  {
20691 -       struct sock *sk = sock->sk;
20692         struct hci_dev *hdev = hci_pi(sk)->hdev;
20693 -       __u32 mode;
20694
20695 -       DBG("cmd %x arg %lx", cmd, arg);
20696 +       if (!hdev)
20697 +               return -EBADFD;
20698
20699         switch (cmd) {
20700 -       case HCIGETINFO:
20701 -               return hci_dev_info(arg);
20702 +       case HCISETRAW:
20703 +               if (!capable(CAP_NET_ADMIN))
20704 +                       return -EACCES;
20705
20706 +               if (arg)
20707 +                       set_bit(HCI_RAW, &hdev->flags);
20708 +               else
20709 +                       clear_bit(HCI_RAW, &hdev->flags);
20710 +
20711 +               return 0;
20712 +
20713 +       case HCIGETCONNINFO:
20714 +               return hci_get_conn_info(hdev, arg);
20715 +
20716 +       default:
20717 +               if (hdev->ioctl)
20718 +                       return hdev->ioctl(hdev, cmd, arg);
20719 +               return -EINVAL;
20720 +       }
20721 +}
20722 +
20723 +static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
20724 +{
20725 +       struct sock *sk = sock->sk;
20726 +       int err;
20727 +
20728 +       BT_DBG("cmd %x arg %lx", cmd, arg);
20729 +
20730 +       switch (cmd) {
20731         case HCIGETDEVLIST:
20732 -               return hci_dev_list(arg);
20733 +               return hci_get_dev_list(arg);
20734 +
20735 +       case HCIGETDEVINFO:
20736 +               return hci_get_dev_info(arg);
20737 +
20738 +       case HCIGETCONNLIST:
20739 +               return hci_get_conn_list(arg);
20740
20741         case HCIDEVUP:
20742                 if (!capable(CAP_NET_ADMIN))
20743 @@ -183,48 +227,31 @@
20744                         return -EACCES;
20745                 return hci_dev_reset(arg);
20746
20747 -       case HCIRESETSTAT:
20748 +       case HCIDEVRESTAT:
20749                 if (!capable(CAP_NET_ADMIN))
20750                         return -EACCES;
20751                 return hci_dev_reset_stat(arg);
20752
20753         case HCISETSCAN:
20754 -               if (!capable(CAP_NET_ADMIN))
20755 -                       return -EACCES;
20756 -               return hci_dev_setscan(arg);
20757 -
20758         case HCISETAUTH:
20759 -               if (!capable(CAP_NET_ADMIN))
20760 -                       return -EACCES;
20761 -               return hci_dev_setauth(arg);
20762 -
20763 -       case HCISETRAW:
20764 -               if (!capable(CAP_NET_ADMIN))
20765 -                       return -EACCES;
20766 -
20767 -               if (!hdev)
20768 -                       return -EBADFD;
20769 -
20770 -               if (arg)
20771 -                       mode = HCI_RAW;
20772 -               else
20773 -                       mode = HCI_NORMAL;
20774 -
20775 -               return hci_dev_setmode(hdev, mode);
20776 -
20777 +       case HCISETENCRYPT:
20778         case HCISETPTYPE:
20779 +       case HCISETLINKPOL:
20780 +       case HCISETLINKMODE:
20781 +       case HCISETACLMTU:
20782 +       case HCISETSCOMTU:
20783                 if (!capable(CAP_NET_ADMIN))
20784                         return -EACCES;
20785 -               return hci_dev_setptype(arg);
20786 +               return hci_dev_cmd(cmd, arg);
20787
20788         case HCIINQUIRY:
20789                 return hci_inquiry(arg);
20790
20791 -       case HCIGETCONNLIST:
20792 -               return hci_conn_list(arg);
20793 -
20794         default:
20795 -               return -EINVAL;
20796 +               lock_sock(sk);
20797 +               err = hci_sock_bound_ioctl(sk, cmd, arg);
20798 +               release_sock(sk);
20799 +               return err;
20800         };
20801  }
20802
20803 @@ -233,28 +260,35 @@
20804         struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
20805         struct sock *sk = sock->sk;
20806         struct hci_dev *hdev = NULL;
20807 +       int err = 0;
20808
20809 -       DBG("sock %p sk %p", sock, sk);
20810 +       BT_DBG("sock %p sk %p", sock, sk);
20811
20812         if (!haddr || haddr->hci_family != AF_BLUETOOTH)
20813                 return -EINVAL;
20814
20815 +       lock_sock(sk);
20816 +
20817         if (hci_pi(sk)->hdev) {
20818 -               /* Already bound */
20819 -               return 0;
20820 +               err = -EALREADY;
20821 +               goto done;
20822         }
20823
20824         if (haddr->hci_dev != HCI_DEV_NONE) {
20825 -               if (!(hdev = hci_dev_get(haddr->hci_dev)))
20826 -                       return -ENODEV;
20827 +               if (!(hdev = hci_dev_get(haddr->hci_dev))) {
20828 +                       err = -ENODEV;
20829 +                       goto done;
20830 +               }
20831
20832 -               hdev->flags |= HCI_SOCK;
20833 +               atomic_inc(&hdev->promisc);
20834         }
20835
20836         hci_pi(sk)->hdev = hdev;
20837         sk->state = BT_BOUND;
20838
20839 -       return 0;
20840 +done:
20841 +       release_sock(sk);
20842 +       return err;
20843  }
20844
20845  static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
20846 @@ -262,73 +296,44 @@
20847         struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
20848         struct sock *sk = sock->sk;
20849
20850 -       DBG("sock %p sk %p", sock, sk);
20851 +       BT_DBG("sock %p sk %p", sock, sk);
20852 +
20853 +       lock_sock(sk);
20854
20855         *addr_len = sizeof(*haddr);
20856         haddr->hci_family = AF_BLUETOOTH;
20857         haddr->hci_dev    = hci_pi(sk)->hdev->id;
20858
20859 +       release_sock(sk);
20860         return 0;
20861  }
20862
20863 -static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, int len,
20864 -                            struct scm_cookie *scm)
20865 -{
20866 -       struct sock *sk = sock->sk;
20867 -       struct hci_dev *hdev = hci_pi(sk)->hdev;
20868 -       struct sk_buff *skb;
20869 -       int err;
20870 -
20871 -       DBG("sock %p sk %p", sock, sk);
20872 -
20873 -       if (msg->msg_flags & MSG_OOB)
20874 -               return -EOPNOTSUPP;
20875 -
20876 -       if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
20877 -               return -EINVAL;
20878 -
20879 -       if (!hdev)
20880 -               return -EBADFD;
20881 -
20882 -       if (!(skb = bluez_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
20883 -               return err;
20884 -
20885 -       if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
20886 -               kfree_skb(skb);
20887 -               return -EFAULT;
20888 -       }
20889 -
20890 -       skb->dev = (void *) hdev;
20891 -       skb->pkt_type = *((unsigned char *) skb->data);
20892 -       skb_pull(skb, 1);
20893 -
20894 -       /* Send frame to HCI core */
20895 -       hci_send_raw(skb);
20896 -
20897 -       return len;
20898 -}
20899 -
20900  static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
20901  {
20902         __u32 mask = hci_pi(sk)->cmsg_mask;
20903
20904         if (mask & HCI_CMSG_DIR)
20905                 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(int), &bluez_cb(skb)->incomming);
20906 +
20907 +       if (mask & HCI_CMSG_TSTAMP)
20908 +               put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(skb->stamp), &skb->stamp);
20909  }
20910
20911 -static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, int len,
20912 -                            int flags, struct scm_cookie *scm)
20913 +static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, int len, int flags, struct scm_cookie *scm)
20914  {
20915         int noblock = flags & MSG_DONTWAIT;
20916         struct sock *sk = sock->sk;
20917         struct sk_buff *skb;
20918         int copied, err;
20919
20920 -       DBG("sock %p sk %p", sock, sk);
20921 +       BT_DBG("sock %p, sk %p", sock, sk);
20922
20923 -       if (flags & (MSG_OOB | MSG_PEEK))
20924 +       if (flags & (MSG_OOB))
20925                 return -EOPNOTSUPP;
20926
20927 +       if (sk->state == BT_CLOSED)
20928 +               return 0;
20929 +
20930         if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
20931                 return err;
20932
20933 @@ -343,28 +348,107 @@
20934         skb->h.raw = skb->data;
20935         err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
20936
20937 -       if (hci_pi(sk)->cmsg_mask)
20938 -               hci_sock_cmsg(sk, msg, skb);
20939 -
20940 +       hci_sock_cmsg(sk, msg, skb);
20941 +
20942         skb_free_datagram(sk, skb);
20943
20944         return err ? : copied;
20945  }
20946
20947 +static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, int len,
20948 +                            struct scm_cookie *scm)
20949 +{
20950 +       struct sock *sk = sock->sk;
20951 +       struct hci_dev *hdev;
20952 +       struct sk_buff *skb;
20953 +       int err;
20954 +
20955 +       BT_DBG("sock %p sk %p", sock, sk);
20956 +
20957 +       if (msg->msg_flags & MSG_OOB)
20958 +               return -EOPNOTSUPP;
20959 +
20960 +       if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
20961 +               return -EINVAL;
20962 +
20963 +       if (len < 4)
20964 +               return -EINVAL;
20965 +
20966 +       lock_sock(sk);
20967 +
20968 +       if (!(hdev = hci_pi(sk)->hdev)) {
20969 +               err = -EBADFD;
20970 +               goto done;
20971 +       }
20972 +
20973 +       if (!(skb = bluez_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
20974 +               goto done;
20975 +
20976 +       if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
20977 +               err = -EFAULT;
20978 +               goto drop;
20979 +       }
20980 +
20981 +       skb->pkt_type = *((unsigned char *) skb->data);
20982 +       skb_pull(skb, 1);
20983 +       skb->dev = (void *) hdev;
20984 +
20985 +       if (skb->pkt_type == HCI_COMMAND_PKT) {
20986 +               u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data));
20987 +               u16 ogf = cmd_opcode_ogf(opcode);
20988 +               u16 ocf = cmd_opcode_ocf(opcode);
20989 +
20990 +               if (((ogf > HCI_SFLT_MAX_OGF) ||
20991 +                               !hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
20992 +                                       !capable(CAP_NET_RAW)) {
20993 +                       err = -EPERM;
20994 +                       goto drop;
20995 +               }
20996 +
20997 +               if (test_bit(HCI_RAW, &hdev->flags) || (ogf == OGF_VENDOR_CMD)) {
20998 +                       skb_queue_tail(&hdev->raw_q, skb);
20999 +                       hci_sched_tx(hdev);
21000 +               } else {
21001 +                       skb_queue_tail(&hdev->cmd_q, skb);
21002 +                       hci_sched_cmd(hdev);
21003 +               }
21004 +       } else {
21005 +               if (!capable(CAP_NET_RAW)) {
21006 +                       err = -EPERM;
21007 +                       goto drop;
21008 +               }
21009 +
21010 +               skb_queue_tail(&hdev->raw_q, skb);
21011 +               hci_sched_tx(hdev);
21012 +       }
21013 +
21014 +       err = len;
21015 +
21016 +done:
21017 +       release_sock(sk);
21018 +       return err;
21019 +
21020 +drop:
21021 +       kfree_skb(skb);
21022 +       goto done;
21023 +}
21024 +
21025  int hci_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int len)
21026  {
21027         struct sock *sk = sock->sk;
21028 -       struct hci_filter flt;
21029 +       struct hci_filter flt = { opcode: 0 };
21030         int err = 0, opt = 0;
21031
21032 -       DBG("sk %p, opt %d", sk, optname);
21033 +       BT_DBG("sk %p, opt %d", sk, optname);
21034
21035         lock_sock(sk);
21036
21037         switch (optname) {
21038         case HCI_DATA_DIR:
21039 -               if (get_user(opt, (int *)optval))
21040 -                       return -EFAULT;
21041 +               if (get_user(opt, (int *)optval)) {
21042 +                       err = -EFAULT;
21043 +                       break;
21044 +               }
21045
21046                 if (opt)
21047                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
21048 @@ -372,12 +456,31 @@
21049                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
21050                 break;
21051
21052 +       case HCI_TIME_STAMP:
21053 +               if (get_user(opt, (int *)optval)) {
21054 +                       err = -EFAULT;
21055 +                       break;
21056 +               }
21057 +
21058 +               if (opt)
21059 +                       hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
21060 +               else
21061 +                       hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
21062 +               break;
21063 +
21064         case HCI_FILTER:
21065                 len = MIN(len, sizeof(struct hci_filter));
21066                 if (copy_from_user(&flt, optval, len)) {
21067                         err = -EFAULT;
21068                         break;
21069                 }
21070 +
21071 +               if (!capable(CAP_NET_RAW)) {
21072 +                       flt.type_mask     &= hci_sec_filter.type_mask;
21073 +                       flt.event_mask[0] &= hci_sec_filter.event_mask[0];
21074 +                       flt.event_mask[1] &= hci_sec_filter.event_mask[1];
21075 +               }
21076 +
21077                 memcpy(&hci_pi(sk)->filter, &flt, len);
21078                 break;
21079
21080 @@ -409,6 +512,16 @@
21081                         return -EFAULT;
21082                 break;
21083
21084 +       case HCI_TIME_STAMP:
21085 +               if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
21086 +                       opt = 1;
21087 +               else
21088 +                       opt = 0;
21089 +
21090 +               if (put_user(opt, optval))
21091 +                       return -EFAULT;
21092 +               break;
21093 +
21094         case HCI_FILTER:
21095                 len = MIN(len, sizeof(struct hci_filter));
21096                 if (copy_to_user(optval, &hci_pi(sk)->filter, len))
21097 @@ -446,7 +559,7 @@
21098  {
21099         struct sock *sk;
21100
21101 -       DBG("sock %p", sock);
21102 +       BT_DBG("sock %p", sock);
21103
21104         if (sock->type != SOCK_RAW)
21105                 return -ESOCKTNOSUPPORT;
21106 @@ -464,44 +577,31 @@
21107         sk->protocol = protocol;
21108         sk->state    = BT_OPEN;
21109
21110 -       /* Initialize filter */
21111 -       hci_pi(sk)->filter.type_mask  = (1<<HCI_EVENT_PKT);
21112 -       hci_pi(sk)->filter.event_mask[0] = ~0L;
21113 -       hci_pi(sk)->filter.event_mask[1] = ~0L;
21114 -
21115         bluez_sock_link(&hci_sk_list, sk);
21116
21117         MOD_INC_USE_COUNT;
21118 -
21119         return 0;
21120  }
21121
21122  static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
21123  {
21124         struct hci_dev *hdev = (struct hci_dev *) ptr;
21125 -       struct sk_buff *skb;
21126 -
21127 -       DBG("hdev %s event %ld", hdev->name, event);
21128 +       evt_si_device sd;
21129 +
21130 +       BT_DBG("hdev %s event %ld", hdev->name, event);
21131
21132         /* Send event to sockets */
21133 -       if ((skb = bluez_skb_alloc(HCI_EVENT_HDR_SIZE + EVT_HCI_DEV_EVENT_SIZE, GFP_ATOMIC))) {
21134 -               hci_event_hdr eh = { EVT_HCI_DEV_EVENT, EVT_HCI_DEV_EVENT_SIZE };
21135 -               evt_hci_dev_event he = { event, hdev->id };
21136 -
21137 -               skb->pkt_type = HCI_EVENT_PKT;
21138 -               memcpy(skb_put(skb, HCI_EVENT_HDR_SIZE), &eh, HCI_EVENT_HDR_SIZE);
21139 -               memcpy(skb_put(skb, EVT_HCI_DEV_EVENT_SIZE), &he, EVT_HCI_DEV_EVENT_SIZE);
21140 -
21141 -               hci_send_to_sock(NULL, skb);
21142 -               kfree_skb(skb);
21143 -       }
21144 -
21145 +       sd.event  = event;
21146 +       sd.dev_id = hdev->id;
21147 +       hci_si_event(NULL, EVT_SI_DEVICE, EVT_SI_DEVICE_SIZE, &sd);
21148 +
21149         if (event == HCI_DEV_UNREG) {
21150                 struct sock *sk;
21151
21152                 /* Detach sockets from device */
21153                 read_lock(&hci_sk_list.lock);
21154                 for (sk = hci_sk_list.head; sk; sk = sk->next) {
21155 +                       bh_lock_sock(sk);
21156                         if (hci_pi(sk)->hdev == hdev) {
21157                                 hci_pi(sk)->hdev = NULL;
21158                                 sk->err = EPIPE;
21159 @@ -510,6 +610,7 @@
21160
21161                                 hci_dev_put(hdev);
21162                         }
21163 +                       bh_unlock_sock(sk);
21164                 }
21165                 read_unlock(&hci_sk_list.lock);
21166         }
21167 @@ -529,21 +630,19 @@
21168  int hci_sock_init(void)
21169  {
21170         if (bluez_sock_register(BTPROTO_HCI, &hci_sock_family_ops)) {
21171 -               ERR("Can't register HCI socket");
21172 +               BT_ERR("Can't register HCI socket");
21173                 return -EPROTO;
21174         }
21175
21176         hci_register_notifier(&hci_sock_nblock);
21177 -
21178         return 0;
21179  }
21180
21181  int hci_sock_cleanup(void)
21182  {
21183         if (bluez_sock_unregister(BTPROTO_HCI))
21184 -               ERR("Can't unregister HCI socket");
21185 +               BT_ERR("Can't unregister HCI socket");
21186
21187         hci_unregister_notifier(&hci_sock_nblock);
21188 -
21189         return 0;
21190  }
21191 diff -urN linux-2.4.18/net/bluetooth/l2cap.c linux-2.4.18-mh9/net/bluetooth/l2cap.c
21192 --- linux-2.4.18/net/bluetooth/l2cap.c  Thu Jan  1 01:00:00 1970
21193 +++ linux-2.4.18-mh9/net/bluetooth/l2cap.c      Mon Aug 25 18:38:12 2003
21194 @@ -0,0 +1,2187 @@
21195 +/*
21196 +   BlueZ - Bluetooth protocol stack for Linux
21197 +   Copyright (C) 2000-2001 Qualcomm Incorporated
21198 +
21199 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
21200 +
21201 +   This program is free software; you can redistribute it and/or modify
21202 +   it under the terms of the GNU General Public License version 2 as
21203 +   published by the Free Software Foundation;
21204 +
21205 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
21206 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21207 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
21208 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
21209 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
21210 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21211 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21212 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21213 +
21214 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21215 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21216 +   SOFTWARE IS DISCLAIMED.
21217 +*/
21218 +
21219 +/*
21220 + * BlueZ L2CAP core and sockets.
21221 + *
21222 + * $Id: l2cap.c,v 1.15 2002/09/09 01:14:52 maxk Exp $
21223 + */
21224 +#define VERSION "2.3"
21225 +
21226 +#include <linux/config.h>
21227 +#include <linux/module.h>
21228 +
21229 +#include <linux/types.h>
21230 +#include <linux/errno.h>
21231 +#include <linux/kernel.h>
21232 +#include <linux/major.h>
21233 +#include <linux/sched.h>
21234 +#include <linux/slab.h>
21235 +#include <linux/poll.h>
21236 +#include <linux/fcntl.h>
21237 +#include <linux/init.h>
21238 +#include <linux/skbuff.h>
21239 +#include <linux/interrupt.h>
21240 +#include <linux/socket.h>
21241 +#include <linux/skbuff.h>
21242 +#include <linux/proc_fs.h>
21243 +#include <linux/list.h>
21244 +#include <net/sock.h>
21245 +
21246 +#include <asm/system.h>
21247 +#include <asm/uaccess.h>
21248 +#include <asm/unaligned.h>
21249 +
21250 +#include <net/bluetooth/bluetooth.h>
21251 +#include <net/bluetooth/hci_core.h>
21252 +#include <net/bluetooth/l2cap.h>
21253 +
21254 +#ifndef L2CAP_DEBUG
21255 +#undef  BT_DBG
21256 +#define BT_DBG( A... )
21257 +#endif
21258 +
21259 +static struct proto_ops l2cap_sock_ops;
21260 +
21261 +struct bluez_sock_list l2cap_sk_list = {
21262 +       lock: RW_LOCK_UNLOCKED
21263 +};
21264 +
21265 +static int l2cap_conn_del(struct hci_conn *conn, int err);
21266 +
21267 +static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent);
21268 +static void l2cap_chan_del(struct sock *sk, int err);
21269 +static int  l2cap_chan_send(struct sock *sk, struct msghdr *msg, int len);
21270 +
21271 +static void __l2cap_sock_close(struct sock *sk, int reason);
21272 +static void l2cap_sock_close(struct sock *sk);
21273 +static void l2cap_sock_kill(struct sock *sk);
21274 +
21275 +static int l2cap_send_req(struct l2cap_conn *conn, __u8 code, __u16 len, void *data);
21276 +static int l2cap_send_rsp(struct l2cap_conn *conn, __u8 ident, __u8 code, __u16 len, void *data);
21277 +
21278 +/* ----- L2CAP timers ------ */
21279 +static void l2cap_sock_timeout(unsigned long arg)
21280 +{
21281 +       struct sock *sk = (struct sock *) arg;
21282 +
21283 +       BT_DBG("sock %p state %d", sk, sk->state);
21284 +
21285 +       bh_lock_sock(sk);
21286 +       __l2cap_sock_close(sk, ETIMEDOUT);
21287 +       bh_unlock_sock(sk);
21288 +
21289 +       l2cap_sock_kill(sk);
21290 +       sock_put(sk);
21291 +}
21292 +
21293 +static void l2cap_sock_set_timer(struct sock *sk, long timeout)
21294 +{
21295 +       BT_DBG("sk %p state %d timeout %ld", sk, sk->state, timeout);
21296 +
21297 +       if (!mod_timer(&sk->timer, jiffies + timeout))
21298 +               sock_hold(sk);
21299 +}
21300 +
21301 +static void l2cap_sock_clear_timer(struct sock *sk)
21302 +{
21303 +       BT_DBG("sock %p state %d", sk, sk->state);
21304 +
21305 +       if (timer_pending(&sk->timer) && del_timer(&sk->timer))
21306 +               __sock_put(sk);
21307 +}
21308 +
21309 +static void l2cap_sock_init_timer(struct sock *sk)
21310 +{
21311 +       init_timer(&sk->timer);
21312 +       sk->timer.function = l2cap_sock_timeout;
21313 +       sk->timer.data = (unsigned long)sk;
21314 +}
21315 +
21316 +/* -------- L2CAP connections --------- */
21317 +static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, __u8 status)
21318 +{
21319 +       struct l2cap_conn *conn;
21320 +
21321 +       if ((conn = hcon->l2cap_data))
21322 +               return conn;
21323 +
21324 +       if (status)
21325 +               return conn;
21326 +
21327 +       if (!(conn = kmalloc(sizeof(struct l2cap_conn), GFP_ATOMIC)))
21328 +               return NULL;
21329 +       memset(conn, 0, sizeof(struct l2cap_conn));
21330 +
21331 +       hcon->l2cap_data = conn;
21332 +       conn->hcon = hcon;
21333 +
21334 +       conn->mtu = hcon->hdev->acl_mtu;
21335 +       conn->src = &hcon->hdev->bdaddr;
21336 +       conn->dst = &hcon->dst;
21337 +
21338 +       spin_lock_init(&conn->lock);
21339 +       conn->chan_list.lock = RW_LOCK_UNLOCKED;
21340 +
21341 +       BT_DBG("hcon %p conn %p", hcon, conn);
21342 +
21343 +       MOD_INC_USE_COUNT;
21344 +       return conn;
21345 +}
21346 +
21347 +static int l2cap_conn_del(struct hci_conn *hcon, int err)
21348 +{
21349 +       struct l2cap_conn *conn;
21350 +       struct sock *sk;
21351 +
21352 +       if (!(conn = hcon->l2cap_data))
21353 +               return 0;
21354 +
21355 +       BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
21356 +
21357 +       if (conn->rx_skb)
21358 +               kfree_skb(conn->rx_skb);
21359 +
21360 +       /* Kill channels */
21361 +       while ((sk = conn->chan_list.head)) {
21362 +               bh_lock_sock(sk);
21363 +               l2cap_chan_del(sk, err);
21364 +               bh_unlock_sock(sk);
21365 +               l2cap_sock_kill(sk);
21366 +       }
21367 +
21368 +       hcon->l2cap_data = NULL;
21369 +       kfree(conn);
21370 +
21371 +       MOD_DEC_USE_COUNT;
21372 +       return 0;
21373 +}
21374 +
21375 +/* -------- Socket interface ---------- */
21376 +static struct sock *__l2cap_get_sock_by_addr(__u16 psm, bdaddr_t *src)
21377 +{
21378 +       struct sock *sk;
21379 +       for (sk = l2cap_sk_list.head; sk; sk = sk->next) {
21380 +               if (sk->sport == psm && !bacmp(&bluez_pi(sk)->src, src))
21381 +                       break;
21382 +       }
21383 +       return sk;
21384 +}
21385 +
21386 +/* Find socket with psm and source bdaddr.
21387 + * Returns closest match.
21388 + */
21389 +static struct sock *__l2cap_get_sock_by_psm(int state, __u16 psm, bdaddr_t *src)
21390 +{
21391 +       struct sock *sk, *sk1 = NULL;
21392 +
21393 +       for (sk = l2cap_sk_list.head; sk; sk = sk->next) {
21394 +               if (state && sk->state != state)
21395 +                       continue;
21396 +
21397 +               if (l2cap_pi(sk)->psm == psm) {
21398 +                       /* Exact match. */
21399 +                       if (!bacmp(&bluez_pi(sk)->src, src))
21400 +                               break;
21401 +
21402 +                       /* Closest match */
21403 +                       if (!bacmp(&bluez_pi(sk)->src, BDADDR_ANY))
21404 +                               sk1 = sk;
21405 +               }
21406 +       }
21407 +       return sk ? sk : sk1;
21408 +}
21409 +
21410 +/* Find socket with given address (psm, src).
21411 + * Returns locked socket */
21412 +static inline struct sock *l2cap_get_sock_by_psm(int state, __u16 psm, bdaddr_t *src)
21413 +{
21414 +       struct sock *s;
21415 +       read_lock(&l2cap_sk_list.lock);
21416 +       s = __l2cap_get_sock_by_psm(state, psm, src);
21417 +       if (s) bh_lock_sock(s);
21418 +       read_unlock(&l2cap_sk_list.lock);
21419 +       return s;
21420 +}
21421 +
21422 +static void l2cap_sock_destruct(struct sock *sk)
21423 +{
21424 +       BT_DBG("sk %p", sk);
21425 +
21426 +       skb_queue_purge(&sk->receive_queue);
21427 +       skb_queue_purge(&sk->write_queue);
21428 +
21429 +       MOD_DEC_USE_COUNT;
21430 +}
21431 +
21432 +static void l2cap_sock_cleanup_listen(struct sock *parent)
21433 +{
21434 +       struct sock *sk;
21435 +
21436 +       BT_DBG("parent %p", parent);
21437 +
21438 +       /* Close not yet accepted channels */
21439 +       while ((sk = bluez_accept_dequeue(parent, NULL)))
21440 +               l2cap_sock_close(sk);
21441 +
21442 +       parent->state  = BT_CLOSED;
21443 +       parent->zapped = 1;
21444 +}
21445 +
21446 +/* Kill socket (only if zapped and orphan)
21447 + * Must be called on unlocked socket.
21448 + */
21449 +static void l2cap_sock_kill(struct sock *sk)
21450 +{
21451 +       if (!sk->zapped || sk->socket)
21452 +               return;
21453 +
21454 +       BT_DBG("sk %p state %d", sk, sk->state);
21455 +
21456 +       /* Kill poor orphan */
21457 +       bluez_sock_unlink(&l2cap_sk_list, sk);
21458 +       sk->dead = 1;
21459 +       sock_put(sk);
21460 +}
21461 +
21462 +/* Close socket.
21463 + */
21464 +static void __l2cap_sock_close(struct sock *sk, int reason)
21465 +{
21466 +       BT_DBG("sk %p state %d socket %p", sk, sk->state, sk->socket);
21467 +
21468 +       switch (sk->state) {
21469 +       case BT_LISTEN:
21470 +               l2cap_sock_cleanup_listen(sk);
21471 +               break;
21472 +
21473 +       case BT_CONNECTED:
21474 +       case BT_CONFIG:
21475 +       case BT_CONNECT2:
21476 +               if (sk->type == SOCK_SEQPACKET) {
21477 +                       struct l2cap_conn *conn = l2cap_pi(sk)->conn;
21478 +                       l2cap_disconn_req req;
21479 +
21480 +                       sk->state = BT_DISCONN;
21481 +                       l2cap_sock_set_timer(sk, sk->sndtimeo);
21482 +
21483 +                       req.dcid = __cpu_to_le16(l2cap_pi(sk)->dcid);
21484 +                       req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
21485 +                       l2cap_send_req(conn, L2CAP_DISCONN_REQ, L2CAP_DISCONN_REQ_SIZE, &req);
21486 +               } else {
21487 +                       l2cap_chan_del(sk, reason);
21488 +               }
21489 +               break;
21490 +
21491 +       case BT_CONNECT:
21492 +       case BT_DISCONN:
21493 +               l2cap_chan_del(sk, reason);
21494 +               break;
21495 +
21496 +       default:
21497 +               sk->zapped = 1;
21498 +               break;
21499 +       };
21500 +}
21501 +
21502 +/* Must be called on unlocked socket. */
21503 +static void l2cap_sock_close(struct sock *sk)
21504 +{
21505 +       l2cap_sock_clear_timer(sk);
21506 +       lock_sock(sk);
21507 +       __l2cap_sock_close(sk, ECONNRESET);
21508 +       release_sock(sk);
21509 +       l2cap_sock_kill(sk);
21510 +}
21511 +
21512 +static void l2cap_sock_init(struct sock *sk, struct sock *parent)
21513 +{
21514 +       struct l2cap_pinfo *pi = l2cap_pi(sk);
21515 +
21516 +       BT_DBG("sk %p", sk);
21517 +
21518 +       if (parent) {
21519 +               sk->type = parent->type;
21520 +               pi->imtu = l2cap_pi(parent)->imtu;
21521 +               pi->omtu = l2cap_pi(parent)->omtu;
21522 +               pi->link_mode = l2cap_pi(parent)->link_mode;
21523 +       } else {
21524 +               pi->imtu = L2CAP_DEFAULT_MTU;
21525 +               pi->omtu = 0;
21526 +               pi->link_mode = 0;
21527 +       }
21528 +
21529 +       /* Default config options */
21530 +       pi->conf_mtu = L2CAP_DEFAULT_MTU;
21531 +       pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
21532 +}
21533 +
21534 +static struct sock *l2cap_sock_alloc(struct socket *sock, int proto, int prio)
21535 +{
21536 +       struct sock *sk;
21537 +
21538 +       if (!(sk = sk_alloc(PF_BLUETOOTH, prio, 1)))
21539 +               return NULL;
21540 +
21541 +       bluez_sock_init(sock, sk);
21542 +
21543 +       sk->zapped   = 0;
21544 +
21545 +       sk->destruct = l2cap_sock_destruct;
21546 +       sk->sndtimeo = L2CAP_CONN_TIMEOUT;
21547 +
21548 +       sk->protocol = proto;
21549 +       sk->state    = BT_OPEN;
21550 +
21551 +       l2cap_sock_init_timer(sk);
21552 +
21553 +       bluez_sock_link(&l2cap_sk_list, sk);
21554 +
21555 +       MOD_INC_USE_COUNT;
21556 +       return sk;
21557 +}
21558 +
21559 +static int l2cap_sock_create(struct socket *sock, int protocol)
21560 +{
21561 +       struct sock *sk;
21562 +
21563 +       BT_DBG("sock %p", sock);
21564 +
21565 +       sock->state = SS_UNCONNECTED;
21566 +
21567 +       if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
21568 +               return -ESOCKTNOSUPPORT;
21569 +
21570 +       if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
21571 +               return -EPERM;
21572 +
21573 +       sock->ops = &l2cap_sock_ops;
21574 +
21575 +       if (!(sk = l2cap_sock_alloc(sock, protocol, GFP_KERNEL)))
21576 +               return -ENOMEM;
21577 +
21578 +       l2cap_sock_init(sk, NULL);
21579 +       return 0;
21580 +}
21581 +
21582 +static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
21583 +{
21584 +       struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
21585 +       struct sock *sk = sock->sk;
21586 +       int err = 0;
21587 +
21588 +       BT_DBG("sk %p, %s %d", sk, batostr(&la->l2_bdaddr), la->l2_psm);
21589 +
21590 +       if (!addr || addr->sa_family != AF_BLUETOOTH)
21591 +               return -EINVAL;
21592 +
21593 +       lock_sock(sk);
21594 +
21595 +       if (sk->state != BT_OPEN) {
21596 +               err = -EBADFD;
21597 +               goto done;
21598 +       }
21599 +
21600 +       write_lock_bh(&l2cap_sk_list.lock);
21601 +       if (la->l2_psm && __l2cap_get_sock_by_addr(la->l2_psm, &la->l2_bdaddr)) {
21602 +               err = -EADDRINUSE;
21603 +       } else {
21604 +               /* Save source address */
21605 +               bacpy(&bluez_pi(sk)->src, &la->l2_bdaddr);
21606 +               l2cap_pi(sk)->psm = la->l2_psm;
21607 +               sk->sport = la->l2_psm;
21608 +               sk->state = BT_BOUND;
21609 +       }
21610 +       write_unlock_bh(&l2cap_sk_list.lock);
21611 +
21612 +done:
21613 +       release_sock(sk);
21614 +       return err;
21615 +}
21616 +
21617 +static int l2cap_do_connect(struct sock *sk)
21618 +{
21619 +       bdaddr_t *src = &bluez_pi(sk)->src;
21620 +       bdaddr_t *dst = &bluez_pi(sk)->dst;
21621 +       struct l2cap_conn *conn;
21622 +       struct hci_conn   *hcon;
21623 +       struct hci_dev    *hdev;
21624 +       int err = 0;
21625 +
21626 +       BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst), l2cap_pi(sk)->psm);
21627 +
21628 +       if (!(hdev = hci_get_route(dst, src)))
21629 +               return -EHOSTUNREACH;
21630 +
21631 +       hci_dev_lock_bh(hdev);
21632 +
21633 +       err = -ENOMEM;
21634 +
21635 +       hcon = hci_connect(hdev, ACL_LINK, dst);
21636 +       if (!hcon)
21637 +               goto done;
21638 +
21639 +       conn = l2cap_conn_add(hcon, 0);
21640 +       if (!conn) {
21641 +               hci_conn_put(hcon);
21642 +               goto done;
21643 +       }
21644 +
21645 +       err = 0;
21646 +
21647 +       /* Update source addr of the socket */
21648 +       bacpy(src, conn->src);
21649 +
21650 +       l2cap_chan_add(conn, sk, NULL);
21651 +
21652 +       sk->state = BT_CONNECT;
21653 +       l2cap_sock_set_timer(sk, sk->sndtimeo);
21654 +
21655 +       if (hcon->state == BT_CONNECTED) {
21656 +               if (sk->type == SOCK_SEQPACKET) {
21657 +                       l2cap_conn_req req;
21658 +                       req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
21659 +                       req.psm  = l2cap_pi(sk)->psm;
21660 +                       l2cap_send_req(conn, L2CAP_CONN_REQ, L2CAP_CONN_REQ_SIZE, &req);
21661 +               } else {
21662 +                       l2cap_sock_clear_timer(sk);
21663 +                       sk->state = BT_CONNECTED;
21664 +               }
21665 +       }
21666 +
21667 +done:
21668 +       hci_dev_unlock_bh(hdev);
21669 +       hci_dev_put(hdev);
21670 +       return err;
21671 +}
21672 +
21673 +static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
21674 +{
21675 +       struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
21676 +       struct sock *sk = sock->sk;
21677 +       int err = 0;
21678 +
21679 +       lock_sock(sk);
21680 +
21681 +       BT_DBG("sk %p", sk);
21682 +
21683 +       if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_l2)) {
21684 +               err = -EINVAL;
21685 +               goto done;
21686 +       }
21687 +
21688 +       if (sk->type == SOCK_SEQPACKET && !la->l2_psm) {
21689 +               err = -EINVAL;
21690 +               goto done;
21691 +       }
21692 +
21693 +       switch(sk->state) {
21694 +       case BT_CONNECT:
21695 +       case BT_CONNECT2:
21696 +       case BT_CONFIG:
21697 +               /* Already connecting */
21698 +               goto wait;
21699 +
21700 +       case BT_CONNECTED:
21701 +               /* Already connected */
21702 +               goto done;
21703 +
21704 +       case BT_OPEN:
21705 +       case BT_BOUND:
21706 +               /* Can connect */
21707 +               break;
21708 +
21709 +       default:
21710 +               err = -EBADFD;
21711 +               goto done;
21712 +       }
21713 +
21714 +       /* Set destination address and psm */
21715 +       bacpy(&bluez_pi(sk)->dst, &la->l2_bdaddr);
21716 +       l2cap_pi(sk)->psm = la->l2_psm;
21717 +
21718 +       if ((err = l2cap_do_connect(sk)))
21719 +               goto done;
21720 +
21721 +wait:
21722 +       err = bluez_sock_wait_state(sk, BT_CONNECTED,
21723 +                       sock_sndtimeo(sk, flags & O_NONBLOCK));
21724 +
21725 +done:
21726 +       release_sock(sk);
21727 +       return err;
21728 +}
21729 +
21730 +int l2cap_sock_listen(struct socket *sock, int backlog)
21731 +{
21732 +       struct sock *sk = sock->sk;
21733 +       int err = 0;
21734 +
21735 +       BT_DBG("sk %p backlog %d", sk, backlog);
21736 +
21737 +       lock_sock(sk);
21738 +
21739 +       if (sk->state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
21740 +               err = -EBADFD;
21741 +               goto done;
21742 +       }
21743 +
21744 +       if (!l2cap_pi(sk)->psm) {
21745 +               err = -EINVAL;
21746 +               goto done;
21747 +       }
21748 +
21749 +       sk->max_ack_backlog = backlog;
21750 +       sk->ack_backlog = 0;
21751 +       sk->state = BT_LISTEN;
21752 +
21753 +done:
21754 +       release_sock(sk);
21755 +       return err;
21756 +}
21757 +
21758 +int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
21759 +{
21760 +       DECLARE_WAITQUEUE(wait, current);
21761 +       struct sock *sk = sock->sk, *nsk;
21762 +       long timeo;
21763 +       int err = 0;
21764 +
21765 +       lock_sock(sk);
21766 +
21767 +       if (sk->state != BT_LISTEN) {
21768 +               err = -EBADFD;
21769 +               goto done;
21770 +       }
21771 +
21772 +       timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
21773 +
21774 +       BT_DBG("sk %p timeo %ld", sk, timeo);
21775 +
21776 +       /* Wait for an incoming connection. (wake-one). */
21777 +       add_wait_queue_exclusive(sk->sleep, &wait);
21778 +       while (!(nsk = bluez_accept_dequeue(sk, newsock))) {
21779 +               set_current_state(TASK_INTERRUPTIBLE);
21780 +               if (!timeo) {
21781 +                       err = -EAGAIN;
21782 +                       break;
21783 +               }
21784 +
21785 +               release_sock(sk);
21786 +               timeo = schedule_timeout(timeo);
21787 +               lock_sock(sk);
21788 +
21789 +               if (sk->state != BT_LISTEN) {
21790 +                       err = -EBADFD;
21791 +                       break;
21792 +               }
21793 +
21794 +               if (signal_pending(current)) {
21795 +                       err = sock_intr_errno(timeo);
21796 +                       break;
21797 +               }
21798 +       }
21799 +       set_current_state(TASK_RUNNING);
21800 +       remove_wait_queue(sk->sleep, &wait);
21801 +
21802 +       if (err)
21803 +               goto done;
21804 +
21805 +       newsock->state = SS_CONNECTED;
21806 +
21807 +       BT_DBG("new socket %p", nsk);
21808 +
21809 +done:
21810 +       release_sock(sk);
21811 +       return err;
21812 +}
21813 +
21814 +static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
21815 +{
21816 +       struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
21817 +       struct sock *sk = sock->sk;
21818 +
21819 +       BT_DBG("sock %p, sk %p", sock, sk);
21820 +
21821 +       addr->sa_family = AF_BLUETOOTH;
21822 +       *len = sizeof(struct sockaddr_l2);
21823 +
21824 +       if (peer)
21825 +               bacpy(&la->l2_bdaddr, &bluez_pi(sk)->dst);
21826 +       else
21827 +               bacpy(&la->l2_bdaddr, &bluez_pi(sk)->src);
21828 +
21829 +       la->l2_psm = l2cap_pi(sk)->psm;
21830 +       return 0;
21831 +}
21832 +
21833 +static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg, int len, struct scm_cookie *scm)
21834 +{
21835 +       struct sock *sk = sock->sk;
21836 +       int err = 0;
21837 +
21838 +       BT_DBG("sock %p, sk %p", sock, sk);
21839 +
21840 +       if (sk->err)
21841 +               return sock_error(sk);
21842 +
21843 +       if (msg->msg_flags & MSG_OOB)
21844 +               return -EOPNOTSUPP;
21845 +
21846 +       /* Check outgoing MTU */
21847 +       if (len > l2cap_pi(sk)->omtu)
21848 +               return -EINVAL;
21849 +
21850 +       lock_sock(sk);
21851 +
21852 +       if (sk->state == BT_CONNECTED)
21853 +               err = l2cap_chan_send(sk, msg, len);
21854 +       else
21855 +               err = -ENOTCONN;
21856 +
21857 +       release_sock(sk);
21858 +       return err;
21859 +}
21860 +
21861 +static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
21862 +{
21863 +       struct sock *sk = sock->sk;
21864 +       struct l2cap_options opts;
21865 +       int err = 0, len;
21866 +       __u32 opt;
21867 +
21868 +       BT_DBG("sk %p", sk);
21869 +
21870 +       lock_sock(sk);
21871 +
21872 +       switch (optname) {
21873 +       case L2CAP_OPTIONS:
21874 +               len = MIN(sizeof(opts), optlen);
21875 +               if (copy_from_user((char *)&opts, optval, len)) {
21876 +                       err = -EFAULT;
21877 +                       break;
21878 +               }
21879 +               l2cap_pi(sk)->imtu  = opts.imtu;
21880 +               l2cap_pi(sk)->omtu  = opts.omtu;
21881 +               break;
21882 +
21883 +       case L2CAP_LM:
21884 +               if (get_user(opt, (__u32 *)optval)) {
21885 +                       err = -EFAULT;
21886 +                       break;
21887 +               }
21888 +
21889 +               l2cap_pi(sk)->link_mode = opt;
21890 +               break;
21891 +
21892 +       default:
21893 +               err = -ENOPROTOOPT;
21894 +               break;
21895 +       }
21896 +
21897 +       release_sock(sk);
21898 +       return err;
21899 +}
21900 +
21901 +static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
21902 +{
21903 +       struct sock *sk = sock->sk;
21904 +       struct l2cap_options opts;
21905 +       struct l2cap_conninfo cinfo;
21906 +       int len, err = 0;
21907 +
21908 +       if (get_user(len, optlen))
21909 +               return -EFAULT;
21910 +
21911 +       lock_sock(sk);
21912 +
21913 +       switch (optname) {
21914 +       case L2CAP_OPTIONS:
21915 +               opts.imtu     = l2cap_pi(sk)->imtu;
21916 +               opts.omtu     = l2cap_pi(sk)->omtu;
21917 +               opts.flush_to = l2cap_pi(sk)->flush_to;
21918 +
21919 +               len = MIN(len, sizeof(opts));
21920 +               if (copy_to_user(optval, (char *)&opts, len))
21921 +                       err = -EFAULT;
21922 +
21923 +               break;
21924 +
21925 +       case L2CAP_LM:
21926 +               if (put_user(l2cap_pi(sk)->link_mode, (__u32 *)optval))
21927 +                       err = -EFAULT;
21928 +               break;
21929 +
21930 +       case L2CAP_CONNINFO:
21931 +               if (sk->state != BT_CONNECTED) {
21932 +                       err = -ENOTCONN;
21933 +                       break;
21934 +               }
21935 +
21936 +               cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
21937 +
21938 +               len = MIN(len, sizeof(cinfo));
21939 +               if (copy_to_user(optval, (char *)&cinfo, len))
21940 +                       err = -EFAULT;
21941 +
21942 +               break;
21943 +
21944 +       default:
21945 +               err = -ENOPROTOOPT;
21946 +               break;
21947 +       }
21948 +
21949 +       release_sock(sk);
21950 +       return err;
21951 +}
21952 +
21953 +static int l2cap_sock_shutdown(struct socket *sock, int how)
21954 +{
21955 +       struct sock *sk = sock->sk;
21956 +       int err = 0;
21957 +
21958 +       BT_DBG("sock %p, sk %p", sock, sk);
21959 +
21960 +       if (!sk) return 0;
21961 +
21962 +       lock_sock(sk);
21963 +       if (!sk->shutdown) {
21964 +               sk->shutdown = SHUTDOWN_MASK;
21965 +               l2cap_sock_clear_timer(sk);
21966 +               __l2cap_sock_close(sk, 0);
21967 +
21968 +               if (sk->linger)
21969 +                       err = bluez_sock_wait_state(sk, BT_CLOSED, sk->lingertime);
21970 +       }
21971 +       release_sock(sk);
21972 +       return err;
21973 +}
21974 +
21975 +static int l2cap_sock_release(struct socket *sock)
21976 +{
21977 +       struct sock *sk = sock->sk;
21978 +       int err;
21979 +
21980 +       BT_DBG("sock %p, sk %p", sock, sk);
21981 +
21982 +       if (!sk) return 0;
21983 +
21984 +       err = l2cap_sock_shutdown(sock, 2);
21985 +
21986 +       sock_orphan(sk);
21987 +       l2cap_sock_kill(sk);
21988 +       return err;
21989 +}
21990 +
21991 +/* --------- L2CAP channels --------- */
21992 +static struct sock * __l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, __u16 cid)
21993 +{
21994 +       struct sock *s;
21995 +       for (s = l->head; s; s = l2cap_pi(s)->next_c) {
21996 +               if (l2cap_pi(s)->dcid == cid)
21997 +                       break;
21998 +       }
21999 +       return s;
22000 +}
22001 +
22002 +static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, __u16 cid)
22003 +{
22004 +       struct sock *s;
22005 +       for (s = l->head; s; s = l2cap_pi(s)->next_c) {
22006 +               if (l2cap_pi(s)->scid == cid)
22007 +                       break;
22008 +       }
22009 +       return s;
22010 +}
22011 +
22012 +/* Find channel with given SCID.
22013 + * Returns locked socket */
22014 +static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, __u16 cid)
22015 +{
22016 +       struct sock *s;
22017 +       read_lock(&l->lock);
22018 +       s = __l2cap_get_chan_by_scid(l, cid);
22019 +       if (s) bh_lock_sock(s);
22020 +       read_unlock(&l->lock);
22021 +       return s;
22022 +}
22023 +
22024 +static __u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
22025 +{
22026 +       __u16 cid = 0x0040;
22027 +
22028 +       for (; cid < 0xffff; cid++) {
22029 +               if(!__l2cap_get_chan_by_scid(l, cid))
22030 +                       return cid;
22031 +       }
22032 +
22033 +       return 0;
22034 +}
22035 +
22036 +static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
22037 +{
22038 +       sock_hold(sk);
22039 +
22040 +       if (l->head)
22041 +               l2cap_pi(l->head)->prev_c = sk;
22042 +
22043 +       l2cap_pi(sk)->next_c = l->head;
22044 +       l2cap_pi(sk)->prev_c = NULL;
22045 +       l->head = sk;
22046 +}
22047 +
22048 +static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
22049 +{
22050 +       struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
22051 +
22052 +       write_lock(&l->lock);
22053 +       if (sk == l->head)
22054 +               l->head = next;
22055 +
22056 +       if (next)
22057 +               l2cap_pi(next)->prev_c = prev;
22058 +       if (prev)
22059 +               l2cap_pi(prev)->next_c = next;
22060 +       write_unlock(&l->lock);
22061 +
22062 +       __sock_put(sk);
22063 +}
22064 +
22065 +static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
22066 +{
22067 +       struct l2cap_chan_list *l = &conn->chan_list;
22068 +
22069 +       BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
22070 +
22071 +       l2cap_pi(sk)->conn = conn;
22072 +
22073 +       if (sk->type == SOCK_SEQPACKET) {
22074 +               /* Alloc CID for connection-oriented socket */
22075 +               l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
22076 +       } else if (sk->type == SOCK_DGRAM) {
22077 +               /* Connectionless socket */
22078 +               l2cap_pi(sk)->scid = 0x0002;
22079 +               l2cap_pi(sk)->dcid = 0x0002;
22080 +               l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
22081 +       } else {
22082 +               /* Raw socket can send/recv signalling messages only */
22083 +               l2cap_pi(sk)->scid = 0x0001;
22084 +               l2cap_pi(sk)->dcid = 0x0001;
22085 +               l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
22086 +       }
22087 +
22088 +       __l2cap_chan_link(l, sk);
22089 +
22090 +       if (parent)
22091 +               bluez_accept_enqueue(parent, sk);
22092 +}
22093 +
22094 +static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
22095 +{
22096 +       struct l2cap_chan_list *l = &conn->chan_list;
22097 +       write_lock(&l->lock);
22098 +       __l2cap_chan_add(conn, sk, parent);
22099 +       write_unlock(&l->lock);
22100 +}
22101 +
22102 +/* Delete channel.
22103 + * Must be called on the locked socket. */
22104 +static void l2cap_chan_del(struct sock *sk, int err)
22105 +{
22106 +       struct l2cap_conn *conn = l2cap_pi(sk)->conn;
22107 +       struct sock *parent = bluez_pi(sk)->parent;
22108 +
22109 +       l2cap_sock_clear_timer(sk);
22110 +
22111 +       BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
22112 +
22113 +       if (conn) {
22114 +               /* Unlink from channel list */
22115 +               l2cap_chan_unlink(&conn->chan_list, sk);
22116 +               l2cap_pi(sk)->conn = NULL;
22117 +               hci_conn_put(conn->hcon);
22118 +       }
22119 +
22120 +       sk->state  = BT_CLOSED;
22121 +       sk->zapped = 1;
22122 +
22123 +       if (err)
22124 +               sk->err = err;
22125 +
22126 +       if (parent)
22127 +               parent->data_ready(parent, 0);
22128 +       else
22129 +               sk->state_change(sk);
22130 +}
22131 +
22132 +static void l2cap_conn_ready(struct l2cap_conn *conn)
22133 +{
22134 +       struct l2cap_chan_list *l = &conn->chan_list;
22135 +       struct sock *sk;
22136 +
22137 +       BT_DBG("conn %p", conn);
22138 +
22139 +       read_lock(&l->lock);
22140 +
22141 +       for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
22142 +               bh_lock_sock(sk);
22143 +
22144 +               if (sk->type != SOCK_SEQPACKET) {
22145 +                       l2cap_sock_clear_timer(sk);
22146 +                       sk->state = BT_CONNECTED;
22147 +                       sk->state_change(sk);
22148 +               } else if (sk->state == BT_CONNECT) {
22149 +                       l2cap_conn_req req;
22150 +                       req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
22151 +                       req.psm  = l2cap_pi(sk)->psm;
22152 +                       l2cap_send_req(conn, L2CAP_CONN_REQ, L2CAP_CONN_REQ_SIZE, &req);
22153 +               }
22154 +
22155 +               bh_unlock_sock(sk);
22156 +       }
22157 +
22158 +       read_unlock(&l->lock);
22159 +}
22160 +
22161 +/* Notify sockets that we cannot guaranty reliability anymore */
22162 +static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
22163 +{
22164 +       struct l2cap_chan_list *l = &conn->chan_list;
22165 +       struct sock *sk;
22166 +
22167 +       BT_DBG("conn %p", conn);
22168 +
22169 +       read_lock(&l->lock);
22170 +       for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
22171 +               if (l2cap_pi(sk)->link_mode & L2CAP_LM_RELIABLE)
22172 +                       sk->err = err;
22173 +       }
22174 +       read_unlock(&l->lock);
22175 +}
22176 +
22177 +static void l2cap_chan_ready(struct sock *sk)
22178 +{
22179 +       struct sock *parent = bluez_pi(sk)->parent;
22180 +
22181 +       BT_DBG("sk %p, parent %p", sk, parent);
22182 +
22183 +       l2cap_pi(sk)->conf_state = 0;
22184 +       l2cap_sock_clear_timer(sk);
22185 +
22186 +       if (!parent) {
22187 +               /* Outgoing channel.
22188 +                * Wake up socket sleeping on connect.
22189 +                */
22190 +               sk->state = BT_CONNECTED;
22191 +               sk->state_change(sk);
22192 +       } else {
22193 +               /* Incomming channel.
22194 +                * Wake up socket sleeping on accept.
22195 +                */
22196 +               parent->data_ready(parent, 0);
22197 +       }
22198 +}
22199 +
22200 +/* Copy frame to all raw sockets on that connection */
22201 +void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
22202 +{
22203 +       struct l2cap_chan_list *l = &conn->chan_list;
22204 +       struct sk_buff *nskb;
22205 +       struct sock * sk;
22206 +
22207 +       BT_DBG("conn %p", conn);
22208 +
22209 +       read_lock(&l->lock);
22210 +       for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
22211 +               if (sk->type != SOCK_RAW)
22212 +                       continue;
22213 +
22214 +               /* Don't send frame to the socket it came from */
22215 +               if (skb->sk == sk)
22216 +                       continue;
22217 +
22218 +               if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
22219 +                       continue;
22220 +
22221 +               if (sock_queue_rcv_skb(sk, nskb))
22222 +                       kfree_skb(nskb);
22223 +       }
22224 +       read_unlock(&l->lock);
22225 +}
22226 +
22227 +static int l2cap_chan_send(struct sock *sk, struct msghdr *msg, int len)
22228 +{
22229 +       struct l2cap_conn *conn = l2cap_pi(sk)->conn;
22230 +       struct sk_buff *skb, **frag;
22231 +       int err, hlen, count, sent=0;
22232 +       l2cap_hdr *lh;
22233 +
22234 +       BT_DBG("sk %p len %d", sk, len);
22235 +
22236 +       /* First fragment (with L2CAP header) */
22237 +       if (sk->type == SOCK_DGRAM)
22238 +               hlen = L2CAP_HDR_SIZE + 2;
22239 +       else
22240 +               hlen = L2CAP_HDR_SIZE;
22241 +
22242 +       count = MIN(conn->mtu - hlen, len);
22243 +
22244 +       skb = bluez_skb_send_alloc(sk, hlen + count,
22245 +                       msg->msg_flags & MSG_DONTWAIT, &err);
22246 +       if (!skb)
22247 +               return err;
22248 +
22249 +       /* Create L2CAP header */
22250 +       lh = (l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
22251 +       lh->cid = __cpu_to_le16(l2cap_pi(sk)->dcid);
22252 +       lh->len = __cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
22253 +
22254 +       if (sk->type == SOCK_DGRAM)
22255 +               put_unaligned(l2cap_pi(sk)->psm, (__u16 *) skb_put(skb, 2));
22256 +
22257 +       if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
22258 +               err = -EFAULT;
22259 +               goto fail;
22260 +       }
22261 +
22262 +       sent += count;
22263 +       len  -= count;
22264 +
22265 +       /* Continuation fragments (no L2CAP header) */
22266 +       frag = &skb_shinfo(skb)->frag_list;
22267 +       while (len) {
22268 +               count = MIN(conn->mtu, len);
22269 +
22270 +               *frag = bluez_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
22271 +               if (!*frag)
22272 +                       goto fail;
22273 +
22274 +               if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
22275 +                       err = -EFAULT;
22276 +                       goto fail;
22277 +               }
22278 +
22279 +               sent += count;
22280 +               len  -= count;
22281 +
22282 +               frag = &(*frag)->next;
22283 +       }
22284 +
22285 +       if ((err = hci_send_acl(conn->hcon, skb, 0)) < 0)
22286 +               goto fail;
22287 +
22288 +       return sent;
22289 +
22290 +fail:
22291 +       kfree_skb(skb);
22292 +       return err;
22293 +}
22294 +
22295 +/* --------- L2CAP signalling commands --------- */
22296 +static inline __u8 l2cap_get_ident(struct l2cap_conn *conn)
22297 +{
22298 +       __u8 id;
22299 +
22300 +       /* Get next available identificator.
22301 +        *    1 - 199 are used by kernel.
22302 +        *  200 - 254 are used by utilities like l2ping, etc
22303 +        */
22304 +
22305 +       spin_lock(&conn->lock);
22306 +
22307 +       if (++conn->tx_ident > 199)
22308 +               conn->tx_ident = 1;
22309 +
22310 +       id = conn->tx_ident;
22311 +
22312 +       spin_unlock(&conn->lock);
22313 +
22314 +       return id;
22315 +}
22316 +
22317 +static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
22318 +                               __u8 code, __u8 ident, __u16 dlen, void *data)
22319 +{
22320 +       struct sk_buff *skb, **frag;
22321 +       l2cap_cmd_hdr *cmd;
22322 +       l2cap_hdr *lh;
22323 +       int len, count;
22324 +
22325 +       BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", conn, code, ident, dlen);
22326 +
22327 +       len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
22328 +       count = MIN(conn->mtu, len);
22329 +
22330 +       skb = bluez_skb_alloc(count, GFP_ATOMIC);
22331 +       if (!skb)
22332 +               return NULL;
22333 +
22334 +       lh = (l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
22335 +       lh->len = __cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
22336 +       lh->cid = __cpu_to_le16(0x0001);
22337 +
22338 +       cmd = (l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
22339 +       cmd->code  = code;
22340 +       cmd->ident = ident;
22341 +       cmd->len   = __cpu_to_le16(dlen);
22342 +
22343 +       if (dlen) {
22344 +               count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
22345 +               memcpy(skb_put(skb, count), data, count);
22346 +               data += count;
22347 +       }
22348 +
22349 +       len -= skb->len;
22350 +
22351 +       /* Continuation fragments (no L2CAP header) */
22352 +       frag = &skb_shinfo(skb)->frag_list;
22353 +       while (len) {
22354 +               count = MIN(conn->mtu, len);
22355 +
22356 +               *frag = bluez_skb_alloc(count, GFP_ATOMIC);
22357 +               if (!*frag)
22358 +                       goto fail;
22359 +
22360 +               memcpy(skb_put(*frag, count), data, count);
22361 +
22362 +               len  -= count;
22363 +               data += count;
22364 +
22365 +               frag = &(*frag)->next;
22366 +       }
22367 +
22368 +       return skb;
22369 +
22370 +fail:
22371 +       kfree_skb(skb);
22372 +       return NULL;
22373 +}
22374 +
22375 +static int l2cap_send_req(struct l2cap_conn *conn, __u8 code, __u16 len, void *data)
22376 +{
22377 +       __u8 ident = l2cap_get_ident(conn);
22378 +       struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
22379 +
22380 +       BT_DBG("code 0x%2.2x", code);
22381 +
22382 +       if (!skb)
22383 +               return -ENOMEM;
22384 +       return hci_send_acl(conn->hcon, skb, 0);
22385 +}
22386 +
22387 +static int l2cap_send_rsp(struct l2cap_conn *conn, __u8 ident, __u8 code, __u16 len, void *data)
22388 +{
22389 +       struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
22390 +
22391 +       BT_DBG("code 0x%2.2x", code);
22392 +
22393 +       if (!skb)
22394 +               return -ENOMEM;
22395 +       return hci_send_acl(conn->hcon, skb, 0);
22396 +}
22397 +
22398 +static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
22399 +{
22400 +       l2cap_conf_opt *opt = *ptr;
22401 +       int len;
22402 +
22403 +       len = L2CAP_CONF_OPT_SIZE + opt->len;
22404 +       *ptr += len;
22405 +
22406 +       *type = opt->type;
22407 +       *olen = opt->len;
22408 +
22409 +       switch (opt->len) {
22410 +       case 1:
22411 +               *val = *((__u8 *) opt->val);
22412 +               break;
22413 +
22414 +       case 2:
22415 +               *val = __le16_to_cpu(*((__u16 *)opt->val));
22416 +               break;
22417 +
22418 +       case 4:
22419 +               *val = __le32_to_cpu(*((__u32 *)opt->val));
22420 +               break;
22421 +
22422 +       default:
22423 +               *val = (unsigned long) opt->val;
22424 +               break;
22425 +       };
22426 +
22427 +       BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
22428 +       return len;
22429 +}
22430 +
22431 +static inline void l2cap_parse_conf_req(struct sock *sk, void *data, int len)
22432 +{
22433 +       int type, hint, olen;
22434 +       unsigned long val;
22435 +       void *ptr = data;
22436 +
22437 +       BT_DBG("sk %p len %d", sk, len);
22438 +
22439 +       while (len >= L2CAP_CONF_OPT_SIZE) {
22440 +               len -= l2cap_get_conf_opt(&ptr, &type, &olen, &val);
22441 +
22442 +               hint  = type & 0x80;
22443 +               type &= 0x7f;
22444 +
22445 +               switch (type) {
22446 +               case L2CAP_CONF_MTU:
22447 +                       l2cap_pi(sk)->conf_mtu = val;
22448 +                       break;
22449 +
22450 +               case L2CAP_CONF_FLUSH_TO:
22451 +                       l2cap_pi(sk)->flush_to = val;
22452 +                       break;
22453 +
22454 +               case L2CAP_CONF_QOS:
22455 +                       break;
22456 +
22457 +               default:
22458 +                       if (hint)
22459 +                               break;
22460 +
22461 +                       /* FIXME: Reject unknown option */
22462 +                       break;
22463 +               };
22464 +       }
22465 +}
22466 +
22467 +static void l2cap_add_conf_opt(void **ptr, __u8 type, __u8 len, unsigned long val)
22468 +{
22469 +       register l2cap_conf_opt *opt = *ptr;
22470 +
22471 +       BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
22472 +
22473 +       opt->type = type;
22474 +       opt->len  = len;
22475 +
22476 +       switch (len) {
22477 +       case 1:
22478 +               *((__u8 *) opt->val)  = val;
22479 +               break;
22480 +
22481 +       case 2:
22482 +               *((__u16 *) opt->val) = __cpu_to_le16(val);
22483 +               break;
22484 +
22485 +       case 4:
22486 +               *((__u32 *) opt->val) = __cpu_to_le32(val);
22487 +               break;
22488 +
22489 +       default:
22490 +               memcpy(opt->val, (void *) val, len);
22491 +               break;
22492 +       };
22493 +
22494 +       *ptr += L2CAP_CONF_OPT_SIZE + len;
22495 +}
22496 +
22497 +static int l2cap_build_conf_req(struct sock *sk, void *data)
22498 +{
22499 +       struct l2cap_pinfo *pi = l2cap_pi(sk);
22500 +       l2cap_conf_req *req = (l2cap_conf_req *) data;
22501 +       void *ptr = req->data;
22502 +
22503 +       BT_DBG("sk %p", sk);
22504 +
22505 +       if (pi->imtu != L2CAP_DEFAULT_MTU)
22506 +               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
22507 +
22508 +       /* FIXME. Need actual value of the flush timeout */
22509 +       //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
22510 +       //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
22511 +
22512 +       req->dcid  = __cpu_to_le16(pi->dcid);
22513 +       req->flags = __cpu_to_le16(0);
22514 +
22515 +       return ptr - data;
22516 +}
22517 +
22518 +static inline int l2cap_conf_output(struct sock *sk, void **ptr)
22519 +{
22520 +       struct l2cap_pinfo *pi = l2cap_pi(sk);
22521 +       int result = 0;
22522 +
22523 +       /* Configure output options and let the other side know
22524 +        * which ones we don't like.
22525 +        */
22526 +       if (pi->conf_mtu < pi->omtu) {
22527 +               l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, pi->omtu);
22528 +               result = L2CAP_CONF_UNACCEPT;
22529 +       } else {
22530 +               pi->omtu = pi->conf_mtu;
22531 +       }
22532 +
22533 +       BT_DBG("sk %p result %d", sk, result);
22534 +       return result;
22535 +}
22536 +
22537 +static int l2cap_build_conf_rsp(struct sock *sk, void *data, int *result)
22538 +{
22539 +       l2cap_conf_rsp *rsp = (l2cap_conf_rsp *) data;
22540 +       void *ptr = rsp->data;
22541 +       u16 flags = 0;
22542 +
22543 +       BT_DBG("sk %p complete %d", sk, result ? 1 : 0);
22544 +
22545 +       if (result)
22546 +               *result = l2cap_conf_output(sk, &ptr);
22547 +       else
22548 +               flags |= 0x0001;
22549 +
22550 +       rsp->scid   = __cpu_to_le16(l2cap_pi(sk)->dcid);
22551 +       rsp->result = __cpu_to_le16(result ? *result : 0);
22552 +       rsp->flags  = __cpu_to_le16(flags);
22553 +
22554 +       return ptr - data;
22555 +}
22556 +
22557 +static inline int l2cap_connect_req(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
22558 +{
22559 +       struct l2cap_chan_list *list = &conn->chan_list;
22560 +       l2cap_conn_req *req = (l2cap_conn_req *) data;
22561 +       l2cap_conn_rsp rsp;
22562 +       struct sock *sk, *parent;
22563 +       int result = 0, status = 0;
22564 +
22565 +       __u16 dcid = 0, scid = __le16_to_cpu(req->scid);
22566 +       __u16 psm  = req->psm;
22567 +
22568 +       BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
22569 +
22570 +       /* Check if we have socket listening on psm */
22571 +       parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
22572 +       if (!parent) {
22573 +               result = L2CAP_CR_BAD_PSM;
22574 +               goto sendresp;
22575 +       }
22576 +
22577 +       result = L2CAP_CR_NO_MEM;
22578 +
22579 +       /* Check for backlog size */
22580 +       if (parent->ack_backlog > parent->max_ack_backlog) {
22581 +               BT_DBG("backlog full %d", parent->ack_backlog);
22582 +               goto response;
22583 +       }
22584 +
22585 +       sk = l2cap_sock_alloc(NULL, BTPROTO_L2CAP, GFP_ATOMIC);
22586 +       if (!sk)
22587 +               goto response;
22588 +
22589 +       write_lock(&list->lock);
22590 +
22591 +       /* Check if we already have channel with that dcid */
22592 +       if (__l2cap_get_chan_by_dcid(list, scid)) {
22593 +               write_unlock(&list->lock);
22594 +               sk->zapped = 1;
22595 +               l2cap_sock_kill(sk);
22596 +               goto response;
22597 +       }
22598 +
22599 +       hci_conn_hold(conn->hcon);
22600 +
22601 +       l2cap_sock_init(sk, parent);
22602 +       bacpy(&bluez_pi(sk)->src, conn->src);
22603 +       bacpy(&bluez_pi(sk)->dst, conn->dst);
22604 +       l2cap_pi(sk)->psm  = psm;
22605 +       l2cap_pi(sk)->dcid = scid;
22606 +
22607 +       __l2cap_chan_add(conn, sk, parent);
22608 +       dcid = l2cap_pi(sk)->scid;
22609 +
22610 +       l2cap_sock_set_timer(sk, sk->sndtimeo);
22611 +
22612 +       /* Service level security */
22613 +       result = L2CAP_CR_PEND;
22614 +       status = L2CAP_CS_AUTHEN_PEND;
22615 +       sk->state = BT_CONNECT2;
22616 +       l2cap_pi(sk)->ident = cmd->ident;
22617 +
22618 +       if (l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT) {
22619 +               if (!hci_conn_encrypt(conn->hcon))
22620 +                       goto done;
22621 +       } else if (l2cap_pi(sk)->link_mode & L2CAP_LM_AUTH) {
22622 +               if (!hci_conn_auth(conn->hcon))
22623 +                       goto done;
22624 +       }
22625 +
22626 +       sk->state = BT_CONFIG;
22627 +       result = status = 0;
22628 +
22629 +done:
22630 +       write_unlock(&list->lock);
22631 +
22632 +response:
22633 +       bh_unlock_sock(parent);
22634 +
22635 +sendresp:
22636 +       rsp.scid   = __cpu_to_le16(scid);
22637 +       rsp.dcid   = __cpu_to_le16(dcid);
22638 +       rsp.result = __cpu_to_le16(result);
22639 +       rsp.status = __cpu_to_le16(status);
22640 +       l2cap_send_rsp(conn, cmd->ident, L2CAP_CONN_RSP, L2CAP_CONN_RSP_SIZE, &rsp);
22641 +       return 0;
22642 +}
22643 +
22644 +static inline int l2cap_connect_rsp(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
22645 +{
22646 +       l2cap_conn_rsp *rsp = (l2cap_conn_rsp *) data;
22647 +       __u16 scid, dcid, result, status;
22648 +       struct sock *sk;
22649 +       char req[128];
22650 +
22651 +       scid   = __le16_to_cpu(rsp->scid);
22652 +       dcid   = __le16_to_cpu(rsp->dcid);
22653 +       result = __le16_to_cpu(rsp->result);
22654 +       status = __le16_to_cpu(rsp->status);
22655 +
22656 +       BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
22657 +
22658 +       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
22659 +               return -ENOENT;
22660 +
22661 +       switch (result) {
22662 +       case L2CAP_CR_SUCCESS:
22663 +               sk->state = BT_CONFIG;
22664 +               l2cap_pi(sk)->dcid = dcid;
22665 +               l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
22666 +
22667 +               l2cap_send_req(conn, L2CAP_CONF_REQ, l2cap_build_conf_req(sk, req), req);
22668 +               break;
22669 +
22670 +       case L2CAP_CR_PEND:
22671 +               break;
22672 +
22673 +       default:
22674 +               l2cap_chan_del(sk, ECONNREFUSED);
22675 +               break;
22676 +       }
22677 +
22678 +       bh_unlock_sock(sk);
22679 +       return 0;
22680 +}
22681 +
22682 +static inline int l2cap_config_req(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
22683 +{
22684 +       l2cap_conf_req * req = (l2cap_conf_req *) data;
22685 +       __u16 dcid, flags;
22686 +       __u8 rsp[64];
22687 +       struct sock *sk;
22688 +       int result;
22689 +
22690 +       dcid  = __le16_to_cpu(req->dcid);
22691 +       flags = __le16_to_cpu(req->flags);
22692 +
22693 +       BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
22694 +
22695 +       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
22696 +               return -ENOENT;
22697 +
22698 +       l2cap_parse_conf_req(sk, req->data, cmd->len - L2CAP_CONF_REQ_SIZE);
22699 +
22700 +       if (flags & 0x0001) {
22701 +               /* Incomplete config. Send empty response. */
22702 +               l2cap_send_rsp(conn, cmd->ident, L2CAP_CONF_RSP, l2cap_build_conf_rsp(sk, rsp, NULL), rsp);
22703 +               goto unlock;
22704 +       }
22705 +
22706 +       /* Complete config. */
22707 +       l2cap_send_rsp(conn, cmd->ident, L2CAP_CONF_RSP, l2cap_build_conf_rsp(sk, rsp, &result), rsp);
22708 +
22709 +       if (result)
22710 +               goto unlock;
22711 +
22712 +       /* Output config done */
22713 +       l2cap_pi(sk)->conf_state |= L2CAP_CONF_OUTPUT_DONE;
22714 +
22715 +       if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
22716 +               sk->state = BT_CONNECTED;
22717 +               l2cap_chan_ready(sk);
22718 +       } else if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
22719 +               char req[64];
22720 +               l2cap_send_req(conn, L2CAP_CONF_REQ, l2cap_build_conf_req(sk, req), req);
22721 +       }
22722 +
22723 +unlock:
22724 +       bh_unlock_sock(sk);
22725 +       return 0;
22726 +}
22727 +
22728 +static inline int l2cap_config_rsp(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
22729 +{
22730 +       l2cap_conf_rsp *rsp = (l2cap_conf_rsp *)data;
22731 +       __u16 scid, flags, result;
22732 +       struct sock *sk;
22733 +       int err = 0;
22734 +
22735 +       scid   = __le16_to_cpu(rsp->scid);
22736 +       flags  = __le16_to_cpu(rsp->flags);
22737 +       result = __le16_to_cpu(rsp->result);
22738 +
22739 +       BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x", scid, flags, result);
22740 +
22741 +       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
22742 +               return -ENOENT;
22743 +
22744 +       switch (result) {
22745 +       case L2CAP_CONF_SUCCESS:
22746 +               break;
22747 +
22748 +       case L2CAP_CONF_UNACCEPT:
22749 +               if (++l2cap_pi(sk)->conf_retry < L2CAP_CONF_MAX_RETRIES) {
22750 +                       char req[128];
22751 +                       /*
22752 +                          It does not make sense to adjust L2CAP parameters
22753 +                          that are currently defined in the spec. We simply
22754 +                          resend config request that we sent earlier. It is
22755 +                          stupid :) but it helps qualification testing
22756 +                          which expects at least some response from us.
22757 +                       */
22758 +                       l2cap_send_req(conn, L2CAP_CONF_REQ,
22759 +                               l2cap_build_conf_req(sk, req), req);
22760 +                       goto done;
22761 +               }
22762 +       default:
22763 +               sk->state = BT_DISCONN;
22764 +               sk->err   = ECONNRESET;
22765 +               l2cap_sock_set_timer(sk, HZ * 5);
22766 +               {
22767 +                       l2cap_disconn_req req;
22768 +                       req.dcid = __cpu_to_le16(l2cap_pi(sk)->dcid);
22769 +                       req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
22770 +                       l2cap_send_req(conn, L2CAP_DISCONN_REQ, L2CAP_DISCONN_REQ_SIZE, &req);
22771 +               }
22772 +               goto done;
22773 +       }
22774 +
22775 +       if (flags & 0x01)
22776 +               goto done;
22777 +
22778 +       /* Input config done */
22779 +       l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
22780 +
22781 +       if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
22782 +               sk->state = BT_CONNECTED;
22783 +               l2cap_chan_ready(sk);
22784 +       }
22785 +
22786 +done:
22787 +       bh_unlock_sock(sk);
22788 +       return err;
22789 +}
22790 +
22791 +static inline int l2cap_disconnect_req(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
22792 +{
22793 +       l2cap_disconn_req *req = (l2cap_disconn_req *) data;
22794 +       l2cap_disconn_rsp rsp;
22795 +       __u16 dcid, scid;
22796 +       struct sock *sk;
22797 +
22798 +       scid = __le16_to_cpu(req->scid);
22799 +       dcid = __le16_to_cpu(req->dcid);
22800 +
22801 +       BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
22802 +
22803 +       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
22804 +               return 0;
22805 +
22806 +       rsp.dcid = __cpu_to_le16(l2cap_pi(sk)->scid);
22807 +       rsp.scid = __cpu_to_le16(l2cap_pi(sk)->dcid);
22808 +       l2cap_send_rsp(conn, cmd->ident, L2CAP_DISCONN_RSP, L2CAP_DISCONN_RSP_SIZE, &rsp);
22809 +
22810 +       sk->shutdown = SHUTDOWN_MASK;
22811 +
22812 +       l2cap_chan_del(sk, ECONNRESET);
22813 +       bh_unlock_sock(sk);
22814 +
22815 +       l2cap_sock_kill(sk);
22816 +       return 0;
22817 +}
22818 +
22819 +static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
22820 +{
22821 +       l2cap_disconn_rsp *rsp = (l2cap_disconn_rsp *) data;
22822 +       __u16 dcid, scid;
22823 +       struct sock *sk;
22824 +
22825 +       scid = __le16_to_cpu(rsp->scid);
22826 +       dcid = __le16_to_cpu(rsp->dcid);
22827 +
22828 +       BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
22829 +
22830 +       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
22831 +               return 0;
22832 +       l2cap_chan_del(sk, 0);
22833 +       bh_unlock_sock(sk);
22834 +
22835 +       l2cap_sock_kill(sk);
22836 +       return 0;
22837 +}
22838 +
22839 +static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
22840 +{
22841 +       __u8 *data = skb->data;
22842 +       int len = skb->len;
22843 +       l2cap_cmd_hdr cmd;
22844 +       int err = 0;
22845 +
22846 +       while (len >= L2CAP_CMD_HDR_SIZE) {
22847 +               memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
22848 +               data += L2CAP_CMD_HDR_SIZE;
22849 +               len  -= L2CAP_CMD_HDR_SIZE;
22850 +
22851 +               cmd.len = __le16_to_cpu(cmd.len);
22852 +
22853 +               BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd.len, cmd.ident);
22854 +
22855 +               if (cmd.len > len || !cmd.ident) {
22856 +                       BT_DBG("corrupted command");
22857 +                       break;
22858 +               }
22859 +
22860 +               switch (cmd.code) {
22861 +               case L2CAP_CONN_REQ:
22862 +                       err = l2cap_connect_req(conn, &cmd, data);
22863 +                       break;
22864 +
22865 +               case L2CAP_CONN_RSP:
22866 +                       err = l2cap_connect_rsp(conn, &cmd, data);
22867 +                       break;
22868 +
22869 +               case L2CAP_CONF_REQ:
22870 +                       err = l2cap_config_req(conn, &cmd, data);
22871 +                       break;
22872 +
22873 +               case L2CAP_CONF_RSP:
22874 +                       err = l2cap_config_rsp(conn, &cmd, data);
22875 +                       break;
22876 +
22877 +               case L2CAP_DISCONN_REQ:
22878 +                       err = l2cap_disconnect_req(conn, &cmd, data);
22879 +                       break;
22880 +
22881 +               case L2CAP_DISCONN_RSP:
22882 +                       err = l2cap_disconnect_rsp(conn, &cmd, data);
22883 +                       break;
22884 +
22885 +               case L2CAP_COMMAND_REJ:
22886 +                       /* FIXME: We should process this */
22887 +                       l2cap_raw_recv(conn, skb);
22888 +                       break;
22889 +
22890 +               case L2CAP_ECHO_REQ:
22891 +                       l2cap_send_rsp(conn, cmd.ident, L2CAP_ECHO_RSP, cmd.len, data);
22892 +                       break;
22893 +
22894 +               case L2CAP_ECHO_RSP:
22895 +               case L2CAP_INFO_REQ:
22896 +               case L2CAP_INFO_RSP:
22897 +                       l2cap_raw_recv(conn, skb);
22898 +                       break;
22899 +
22900 +               default:
22901 +                       BT_ERR("Uknown signaling command 0x%2.2x", cmd.code);
22902 +                       err = -EINVAL;
22903 +                       break;
22904 +               };
22905 +
22906 +               if (err) {
22907 +                       l2cap_cmd_rej rej;
22908 +                       BT_DBG("error %d", err);
22909 +
22910 +                       /* FIXME: Map err to a valid reason. */
22911 +                       rej.reason = __cpu_to_le16(0);
22912 +                       l2cap_send_rsp(conn, cmd.ident, L2CAP_COMMAND_REJ, L2CAP_CMD_REJ_SIZE, &rej);
22913 +               }
22914 +
22915 +               data += cmd.len;
22916 +               len  -= cmd.len;
22917 +       }
22918 +
22919 +       kfree_skb(skb);
22920 +}
22921 +
22922 +static inline int l2cap_data_channel(struct l2cap_conn *conn, __u16 cid, struct sk_buff *skb)
22923 +{
22924 +       struct sock *sk;
22925 +
22926 +       sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
22927 +       if (!sk) {
22928 +               BT_DBG("unknown cid 0x%4.4x", cid);
22929 +               goto drop;
22930 +       }
22931 +
22932 +       BT_DBG("sk %p, len %d", sk, skb->len);
22933 +
22934 +       if (sk->state != BT_CONNECTED)
22935 +               goto drop;
22936 +
22937 +       if (l2cap_pi(sk)->imtu < skb->len)
22938 +               goto drop;
22939 +
22940 +       /* If socket recv buffers overflows we drop data here
22941 +        * which is *bad* because L2CAP has to be reliable.
22942 +        * But we don't have any other choice. L2CAP doesn't
22943 +        * provide flow control mechanism */
22944 +
22945 +       if (!sock_queue_rcv_skb(sk, skb))
22946 +               goto done;
22947 +
22948 +drop:
22949 +       kfree_skb(skb);
22950 +
22951 +done:
22952 +       if (sk) bh_unlock_sock(sk);
22953 +       return 0;
22954 +}
22955 +
22956 +static inline int l2cap_conless_channel(struct l2cap_conn *conn, __u16 psm, struct sk_buff *skb)
22957 +{
22958 +       struct sock *sk;
22959 +
22960 +       sk = l2cap_get_sock_by_psm(0, psm, conn->src);
22961 +       if (!sk)
22962 +               goto drop;
22963 +
22964 +       BT_DBG("sk %p, len %d", sk, skb->len);
22965 +
22966 +       if (sk->state != BT_BOUND && sk->state != BT_CONNECTED)
22967 +               goto drop;
22968 +
22969 +       if (l2cap_pi(sk)->imtu < skb->len)
22970 +               goto drop;
22971 +
22972 +       if (!sock_queue_rcv_skb(sk, skb))
22973 +               goto done;
22974 +
22975 +drop:
22976 +       kfree_skb(skb);
22977 +
22978 +done:
22979 +       if (sk) bh_unlock_sock(sk);
22980 +       return 0;
22981 +}
22982 +
22983 +static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
22984 +{
22985 +       l2cap_hdr *lh = (l2cap_hdr *) skb->data;
22986 +       __u16 cid, psm, len;
22987 +
22988 +       skb_pull(skb, L2CAP_HDR_SIZE);
22989 +       cid = __le16_to_cpu(lh->cid);
22990 +       len = __le16_to_cpu(lh->len);
22991 +
22992 +       BT_DBG("len %d, cid 0x%4.4x", len, cid);
22993 +
22994 +       switch (cid) {
22995 +       case 0x0001:
22996 +               l2cap_sig_channel(conn, skb);
22997 +               break;
22998 +
22999 +       case 0x0002:
23000 +               psm = get_unaligned((__u16 *) skb->data);
23001 +               skb_pull(skb, 2);
23002 +               l2cap_conless_channel(conn, psm, skb);
23003 +               break;
23004 +
23005 +       default:
23006 +               l2cap_data_channel(conn, cid, skb);
23007 +               break;
23008 +       }
23009 +}
23010 +
23011 +/* ------------ L2CAP interface with lower layer (HCI) ------------- */
23012 +
23013 +static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
23014 +{
23015 +       int exact = 0, lm1 = 0, lm2 = 0;
23016 +       register struct sock *sk;
23017 +
23018 +       if (type != ACL_LINK)
23019 +               return 0;
23020 +
23021 +       BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
23022 +
23023 +       /* Find listening sockets and check their link_mode */
23024 +       read_lock(&l2cap_sk_list.lock);
23025 +       for (sk = l2cap_sk_list.head; sk; sk = sk->next) {
23026 +               if (sk->state != BT_LISTEN)
23027 +                       continue;
23028 +
23029 +               if (!bacmp(&bluez_pi(sk)->src, &hdev->bdaddr)) {
23030 +                       lm1 |= (HCI_LM_ACCEPT | l2cap_pi(sk)->link_mode);
23031 +                       exact++;
23032 +               } else if (!bacmp(&bluez_pi(sk)->src, BDADDR_ANY))
23033 +                       lm2 |= (HCI_LM_ACCEPT | l2cap_pi(sk)->link_mode);
23034 +       }
23035 +       read_unlock(&l2cap_sk_list.lock);
23036 +
23037 +       return exact ? lm1 : lm2;
23038 +}
23039 +
23040 +static int l2cap_connect_cfm(struct hci_conn *hcon, __u8 status)
23041 +{
23042 +       BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
23043 +
23044 +       if (hcon->type != ACL_LINK)
23045 +               return 0;
23046 +
23047 +       if (!status) {
23048 +               struct l2cap_conn *conn;
23049 +
23050 +               conn = l2cap_conn_add(hcon, status);
23051 +               if (conn)
23052 +                       l2cap_conn_ready(conn);
23053 +       } else
23054 +               l2cap_conn_del(hcon, bterr(status));
23055 +
23056 +       return 0;
23057 +}
23058 +
23059 +static int l2cap_disconn_ind(struct hci_conn *hcon, __u8 reason)
23060 +{
23061 +       BT_DBG("hcon %p reason %d", hcon, reason);
23062 +
23063 +       if (hcon->type != ACL_LINK)
23064 +               return 0;
23065 +
23066 +       l2cap_conn_del(hcon, bterr(reason));
23067 +       return 0;
23068 +}
23069 +
23070 +static int l2cap_auth_cfm(struct hci_conn *hcon, __u8 status)
23071 +{
23072 +       struct l2cap_chan_list *l;
23073 +       struct l2cap_conn *conn;
23074 +       l2cap_conn_rsp rsp;
23075 +       struct sock *sk;
23076 +       int result;
23077 +
23078 +       if (!(conn = hcon->l2cap_data))
23079 +               return 0;
23080 +       l = &conn->chan_list;
23081 +
23082 +       BT_DBG("conn %p", conn);
23083 +
23084 +       read_lock(&l->lock);
23085 +
23086 +       for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
23087 +               bh_lock_sock(sk);
23088 +
23089 +               if (sk->state != BT_CONNECT2 ||
23090 +                               (l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT)) {
23091 +                       bh_unlock_sock(sk);
23092 +                       continue;
23093 +               }
23094 +
23095 +               if (!status) {
23096 +                       sk->state = BT_CONFIG;
23097 +                       result = 0;
23098 +               } else {
23099 +                       sk->state = BT_DISCONN;
23100 +                       l2cap_sock_set_timer(sk, HZ/10);
23101 +                       result = L2CAP_CR_SEC_BLOCK;
23102 +               }
23103 +
23104 +               rsp.scid   = __cpu_to_le16(l2cap_pi(sk)->dcid);
23105 +               rsp.dcid   = __cpu_to_le16(l2cap_pi(sk)->scid);
23106 +               rsp.result = __cpu_to_le16(result);
23107 +               rsp.status = __cpu_to_le16(0);
23108 +               l2cap_send_rsp(conn, l2cap_pi(sk)->ident, L2CAP_CONN_RSP,
23109 +                       L2CAP_CONN_RSP_SIZE, &rsp);
23110 +
23111 +               bh_unlock_sock(sk);
23112 +       }
23113 +
23114 +       read_unlock(&l->lock);
23115 +       return 0;
23116 +}
23117 +
23118 +static int l2cap_encrypt_cfm(struct hci_conn *hcon, __u8 status)
23119 +{
23120 +       struct l2cap_chan_list *l;
23121 +       struct l2cap_conn *conn;
23122 +       l2cap_conn_rsp rsp;
23123 +       struct sock *sk;
23124 +       int result;
23125 +
23126 +       if (!(conn = hcon->l2cap_data))
23127 +               return 0;
23128 +       l = &conn->chan_list;
23129 +
23130 +       BT_DBG("conn %p", conn);
23131 +
23132 +       read_lock(&l->lock);
23133 +
23134 +       for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
23135 +               bh_lock_sock(sk);
23136 +
23137 +               if (sk->state != BT_CONNECT2) {
23138 +                       bh_unlock_sock(sk);
23139 +                       continue;
23140 +               }
23141 +
23142 +               if (!status) {
23143 +                       sk->state = BT_CONFIG;
23144 +                       result = 0;
23145 +               } else {
23146 +                       sk->state = BT_DISCONN;
23147 +                       l2cap_sock_set_timer(sk, HZ/10);
23148 +                       result = L2CAP_CR_SEC_BLOCK;
23149 +               }
23150 +
23151 +               rsp.scid   = __cpu_to_le16(l2cap_pi(sk)->dcid);
23152 +               rsp.dcid   = __cpu_to_le16(l2cap_pi(sk)->scid);
23153 +               rsp.result = __cpu_to_le16(result);
23154 +               rsp.status = __cpu_to_le16(0);
23155 +               l2cap_send_rsp(conn, l2cap_pi(sk)->ident, L2CAP_CONN_RSP,
23156 +                       L2CAP_CONN_RSP_SIZE, &rsp);
23157 +
23158 +               bh_unlock_sock(sk);
23159 +       }
23160 +
23161 +       read_unlock(&l->lock);
23162 +       return 0;
23163 +}
23164 +
23165 +static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, __u16 flags)
23166 +{
23167 +       struct l2cap_conn *conn = hcon->l2cap_data;
23168 +
23169 +       if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
23170 +               goto drop;
23171 +
23172 +       BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
23173 +
23174 +       if (flags & ACL_START) {
23175 +               l2cap_hdr *hdr;
23176 +               int len;
23177 +
23178 +               if (conn->rx_len) {
23179 +                       BT_ERR("Unexpected start frame (len %d)", skb->len);
23180 +                       kfree_skb(conn->rx_skb);
23181 +                       conn->rx_skb = NULL;
23182 +                       conn->rx_len = 0;
23183 +                       l2cap_conn_unreliable(conn, ECOMM);
23184 +               }
23185 +
23186 +               if (skb->len < 2) {
23187 +                       BT_ERR("Frame is too short (len %d)", skb->len);
23188 +                       l2cap_conn_unreliable(conn, ECOMM);
23189 +                       goto drop;
23190 +               }
23191 +
23192 +               hdr = (l2cap_hdr *) skb->data;
23193 +               len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
23194 +
23195 +               if (len == skb->len) {
23196 +                       /* Complete frame received */
23197 +                       l2cap_recv_frame(conn, skb);
23198 +                       return 0;
23199 +               }
23200 +
23201 +               BT_DBG("Start: total len %d, frag len %d", len, skb->len);
23202 +
23203 +               if (skb->len > len) {
23204 +                       BT_ERR("Frame is too long (len %d, expected len %d)",
23205 +                               skb->len, len);
23206 +                       l2cap_conn_unreliable(conn, ECOMM);
23207 +                       goto drop;
23208 +               }
23209 +
23210 +               /* Allocate skb for the complete frame including header */
23211 +               conn->rx_skb = bluez_skb_alloc(len, GFP_ATOMIC);
23212 +               if (!conn->rx_skb)
23213 +                       goto drop;
23214 +
23215 +               memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
23216 +               conn->rx_len = len - skb->len;
23217 +       } else {
23218 +               BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
23219 +
23220 +               if (!conn->rx_len) {
23221 +                       BT_ERR("Unexpected continuation frame (len %d)", skb->len);
23222 +                       l2cap_conn_unreliable(conn, ECOMM);
23223 +                       goto drop;
23224 +               }
23225 +
23226 +               if (skb->len > conn->rx_len) {
23227 +                       BT_ERR("Fragment is too long (len %d, expected %d)",
23228 +                                       skb->len, conn->rx_len);
23229 +                       kfree_skb(conn->rx_skb);
23230 +                       conn->rx_skb = NULL;
23231 +                       conn->rx_len = 0;
23232 +                       l2cap_conn_unreliable(conn, ECOMM);
23233 +                       goto drop;
23234 +               }
23235 +
23236 +               memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
23237 +               conn->rx_len -= skb->len;
23238 +
23239 +               if (!conn->rx_len) {
23240 +                       /* Complete frame received */
23241 +                       l2cap_recv_frame(conn, conn->rx_skb);
23242 +                       conn->rx_skb = NULL;
23243 +               }
23244 +       }
23245 +
23246 +drop:
23247 +       kfree_skb(skb);
23248 +       return 0;
23249 +}
23250 +
23251 +/* ----- Proc fs support ------ */
23252 +static int l2cap_sock_dump(char *buf, struct bluez_sock_list *list)
23253 +{
23254 +       struct l2cap_pinfo *pi;
23255 +       struct sock *sk;
23256 +       char *ptr = buf;
23257 +
23258 +       read_lock_bh(&list->lock);
23259 +
23260 +       for (sk = list->head; sk; sk = sk->next) {
23261 +               pi = l2cap_pi(sk);
23262 +               ptr += sprintf(ptr, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d 0x%x\n",
23263 +                               batostr(&bluez_pi(sk)->src), batostr(&bluez_pi(sk)->dst),
23264 +                               sk->state, pi->psm, pi->scid, pi->dcid, pi->imtu, pi->omtu,
23265 +                               pi->link_mode);
23266 +       }
23267 +
23268 +       read_unlock_bh(&list->lock);
23269 +
23270 +       ptr += sprintf(ptr, "\n");
23271 +       return ptr - buf;
23272 +}
23273 +
23274 +static int l2cap_read_proc(char *buf, char **start, off_t offset, int count, int *eof, void *priv)
23275 +{
23276 +       char *ptr = buf;
23277 +       int len;
23278 +
23279 +       BT_DBG("count %d, offset %ld", count, offset);
23280 +
23281 +       ptr += l2cap_sock_dump(ptr, &l2cap_sk_list);
23282 +       len  = ptr - buf;
23283 +
23284 +       if (len <= count + offset)
23285 +               *eof = 1;
23286 +
23287 +       *start = buf + offset;
23288 +       len -= offset;
23289 +
23290 +       if (len > count)
23291 +               len = count;
23292 +       if (len < 0)
23293 +               len = 0;
23294 +
23295 +       return len;
23296 +}
23297 +
23298 +static struct proto_ops l2cap_sock_ops = {
23299 +       family:         PF_BLUETOOTH,
23300 +       release:        l2cap_sock_release,
23301 +       bind:           l2cap_sock_bind,
23302 +       connect:        l2cap_sock_connect,
23303 +       listen:         l2cap_sock_listen,
23304 +       accept:         l2cap_sock_accept,
23305 +       getname:        l2cap_sock_getname,
23306 +       sendmsg:        l2cap_sock_sendmsg,
23307 +       recvmsg:        bluez_sock_recvmsg,
23308 +       poll:           bluez_sock_poll,
23309 +       socketpair:     sock_no_socketpair,
23310 +       ioctl:          sock_no_ioctl,
23311 +       shutdown:       l2cap_sock_shutdown,
23312 +       setsockopt:     l2cap_sock_setsockopt,
23313 +       getsockopt:     l2cap_sock_getsockopt,
23314 +       mmap:           sock_no_mmap
23315 +};
23316 +
23317 +static struct net_proto_family l2cap_sock_family_ops = {
23318 +       family:         PF_BLUETOOTH,
23319 +       create:         l2cap_sock_create
23320 +};
23321 +
23322 +static struct hci_proto l2cap_hci_proto = {
23323 +       name:           "L2CAP",
23324 +       id:             HCI_PROTO_L2CAP,
23325 +       connect_ind:    l2cap_connect_ind,
23326 +       connect_cfm:    l2cap_connect_cfm,
23327 +       disconn_ind:    l2cap_disconn_ind,
23328 +       recv_acldata:   l2cap_recv_acldata,
23329 +       auth_cfm:       l2cap_auth_cfm,
23330 +       encrypt_cfm:    l2cap_encrypt_cfm
23331 +};
23332 +
23333 +int __init l2cap_init(void)
23334 +{
23335 +       int err;
23336 +
23337 +       if ((err = bluez_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops))) {
23338 +               BT_ERR("Can't register L2CAP socket");
23339 +               return err;
23340 +       }
23341 +
23342 +       if ((err = hci_register_proto(&l2cap_hci_proto))) {
23343 +               BT_ERR("Can't register L2CAP protocol");
23344 +               return err;
23345 +       }
23346 +
23347 +       create_proc_read_entry("bluetooth/l2cap", 0, 0, l2cap_read_proc, NULL);
23348 +
23349 +       BT_INFO("BlueZ L2CAP ver %s Copyright (C) 2000,2001 Qualcomm Inc", VERSION);
23350 +       BT_INFO("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
23351 +       return 0;
23352 +}
23353 +
23354 +void l2cap_cleanup(void)
23355 +{
23356 +       remove_proc_entry("bluetooth/l2cap", NULL);
23357 +
23358 +       /* Unregister socket and protocol */
23359 +       if (bluez_sock_unregister(BTPROTO_L2CAP))
23360 +               BT_ERR("Can't unregister L2CAP socket");
23361 +
23362 +       if (hci_unregister_proto(&l2cap_hci_proto))
23363 +               BT_ERR("Can't unregister L2CAP protocol");
23364 +}
23365 +
23366 +void l2cap_load(void)
23367 +{
23368 +       /* Dummy function to trigger automatic L2CAP module loading by
23369 +          other modules that use L2CAP sockets but do not use any other
23370 +          symbols from it. */
23371 +       return;
23372 +}
23373 +
23374 +EXPORT_SYMBOL(l2cap_load);
23375 +
23376 +module_init(l2cap_init);
23377 +module_exit(l2cap_cleanup);
23378 +
23379 +MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
23380 +MODULE_DESCRIPTION("BlueZ L2CAP ver " VERSION);
23381 +MODULE_LICENSE("GPL");
23382 diff -urN linux-2.4.18/net/bluetooth/l2cap_core.c linux-2.4.18-mh9/net/bluetooth/l2cap_core.c
23383 --- linux-2.4.18/net/bluetooth/l2cap_core.c     Sun Sep 30 21:26:08 2001
23384 +++ linux-2.4.18-mh9/net/bluetooth/l2cap_core.c Thu Jan  1 01:00:00 1970
23385 @@ -1,2316 +0,0 @@
23386 -/*
23387 -   BlueZ - Bluetooth protocol stack for Linux
23388 -   Copyright (C) 2000-2001 Qualcomm Incorporated
23389 -
23390 -   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
23391 -
23392 -   This program is free software; you can redistribute it and/or modify
23393 -   it under the terms of the GNU General Public License version 2 as
23394 -   published by the Free Software Foundation;
23395 -
23396 -   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
23397 -   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
23398 -   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
23399 -   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
23400 -   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
23401 -   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
23402 -   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
23403 -   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23404 -
23405 -   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
23406 -   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23407 -   SOFTWARE IS DISCLAIMED.
23408 -*/
23409 -
23410 -/*
23411 - * BlueZ L2CAP core and sockets.
23412 - *
23413 - * $Id: l2cap_core.c,v 1.19 2001/08/03 04:19:50 maxk Exp $
23414 - */
23415 -#define VERSION "1.1"
23416 -
23417 -#include <linux/config.h>
23418 -#include <linux/module.h>
23419 -
23420 -#include <linux/types.h>
23421 -#include <linux/errno.h>
23422 -#include <linux/kernel.h>
23423 -#include <linux/major.h>
23424 -#include <linux/sched.h>
23425 -#include <linux/slab.h>
23426 -#include <linux/poll.h>
23427 -#include <linux/fcntl.h>
23428 -#include <linux/init.h>
23429 -#include <linux/skbuff.h>
23430 -#include <linux/interrupt.h>
23431 -#include <linux/socket.h>
23432 -#include <linux/skbuff.h>
23433 -#include <linux/proc_fs.h>
23434 -#include <linux/list.h>
23435 -#include <net/sock.h>
23436 -
23437 -#include <asm/system.h>
23438 -#include <asm/uaccess.h>
23439 -
23440 -#include <net/bluetooth/bluetooth.h>
23441 -#include <net/bluetooth/bluez.h>
23442 -#include <net/bluetooth/hci_core.h>
23443 -#include <net/bluetooth/l2cap.h>
23444 -#include <net/bluetooth/l2cap_core.h>
23445 -
23446 -#ifndef L2CAP_DEBUG
23447 -#undef  DBG
23448 -#define DBG( A... )
23449 -#endif
23450 -
23451 -struct proto_ops l2cap_sock_ops;
23452 -
23453 -struct bluez_sock_list l2cap_sk_list = {
23454 -       lock: RW_LOCK_UNLOCKED
23455 -};
23456 -
23457 -struct list_head l2cap_iff_list = LIST_HEAD_INIT(l2cap_iff_list);
23458 -rwlock_t l2cap_rt_lock = RW_LOCK_UNLOCKED;
23459 -
23460 -static int  l2cap_conn_del(struct l2cap_conn *conn, int err);
23461 -
23462 -static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent);
23463 -static void l2cap_chan_del(struct sock *sk, int err);
23464 -static int  l2cap_chan_send(struct sock *sk, struct msghdr *msg, int len);
23465 -
23466 -static void l2cap_sock_close(struct sock *sk);
23467 -static void l2cap_sock_kill(struct sock *sk);
23468 -
23469 -static int l2cap_send_req(struct l2cap_conn *conn, __u8 code, __u16 len, void *data);
23470 -static int l2cap_send_rsp(struct l2cap_conn *conn, __u8 ident, __u8 code, __u16 len, void *data);
23471 -
23472 -/* -------- L2CAP interfaces & routing --------- */
23473 -/* Add/delete L2CAP interface.
23474 - * Must be called with locked rt_lock
23475 - */
23476 -
23477 -static void l2cap_iff_add(struct hci_dev *hdev)
23478 -{
23479 -       struct l2cap_iff *iff;
23480 -
23481 -       DBG("%s", hdev->name);
23482 -
23483 -       DBG("iff_list %p next %p prev %p", &l2cap_iff_list, l2cap_iff_list.next, l2cap_iff_list.prev);
23484 -
23485 -       /* Allocate new interface and lock HCI device */
23486 -       if (!(iff = kmalloc(sizeof(struct l2cap_iff), GFP_KERNEL))) {
23487 -               ERR("Can't allocate new interface %s", hdev->name);
23488 -               return;
23489 -       }
23490 -       memset(iff, 0, sizeof(struct l2cap_iff));
23491 -
23492 -       hci_dev_hold(hdev);
23493 -       hdev->l2cap_data = iff;
23494 -       iff->hdev   = hdev;
23495 -       iff->mtu    = hdev->acl_mtu - HCI_ACL_HDR_SIZE;
23496 -       iff->bdaddr = &hdev->bdaddr;
23497 -
23498 -       spin_lock_init(&iff->lock);
23499 -       INIT_LIST_HEAD(&iff->conn_list);
23500 -
23501 -       list_add(&iff->list, &l2cap_iff_list);
23502 -}
23503 -
23504 -static void l2cap_iff_del(struct hci_dev *hdev)
23505 -{
23506 -       struct l2cap_iff *iff;
23507 -
23508 -       if (!(iff = hdev->l2cap_data))
23509 -               return;
23510 -
23511 -       DBG("%s iff %p", hdev->name, iff);
23512 -
23513 -       list_del(&iff->list);
23514 -
23515 -       l2cap_iff_lock(iff);
23516 -
23517 -       /* Drop connections */
23518 -       while (!list_empty(&iff->conn_list)) {
23519 -               struct l2cap_conn *c;
23520 -
23521 -               c = list_entry(iff->conn_list.next, struct l2cap_conn, list);
23522 -               l2cap_conn_del(c, ENODEV);
23523 -       }
23524 -
23525 -       l2cap_iff_unlock(iff);
23526 -
23527 -       /* Unlock HCI device */
23528 -       hdev->l2cap_data = NULL;
23529 -       hci_dev_put(hdev);
23530 -
23531 -       kfree(iff);
23532 -}
23533 -
23534 -/* Get route. Returns L2CAP interface.
23535 - * Must be called with locked rt_lock
23536 - */
23537 -static struct l2cap_iff *l2cap_get_route(bdaddr_t *src, bdaddr_t *dst)
23538 -{
23539 -       struct list_head *p;
23540 -       int use_src;
23541 -
23542 -       DBG("%s -> %s", batostr(src), batostr(dst));
23543 -
23544 -       use_src = bacmp(src, BDADDR_ANY) ? 0 : 1;
23545 -
23546 -       /* Simple routing:
23547 -        *      No source address - find interface with bdaddr != dst
23548 -        *      Source address    - find interface with bdaddr == src
23549 -        */
23550 -
23551 -       list_for_each(p, &l2cap_iff_list) {
23552 -               struct l2cap_iff *iff;
23553 -
23554 -               iff = list_entry(p, struct l2cap_iff, list);
23555 -
23556 -               if (use_src && !bacmp(iff->bdaddr, src))
23557 -                       return iff;
23558 -               else if (bacmp(iff->bdaddr, dst))
23559 -                       return iff;
23560 -       }
23561 -       return NULL;
23562 -}
23563 -
23564 -/* ----- L2CAP timers ------ */
23565 -static void l2cap_sock_timeout(unsigned long arg)
23566 -{
23567 -       struct sock *sk = (struct sock *) arg;
23568 -
23569 -       DBG("sock %p state %d", sk, sk->state);
23570 -
23571 -       bh_lock_sock(sk);
23572 -       switch (sk->state) {
23573 -       case BT_DISCONN:
23574 -               l2cap_chan_del(sk, ETIMEDOUT);
23575 -               break;
23576 -
23577 -       default:
23578 -               sk->err = ETIMEDOUT;
23579 -               sk->state_change(sk);
23580 -               break;
23581 -       };
23582 -       bh_unlock_sock(sk);
23583 -
23584 -       l2cap_sock_kill(sk);
23585 -       sock_put(sk);
23586 -}
23587 -
23588 -static void l2cap_sock_set_timer(struct sock *sk, long timeout)
23589 -{
23590 -       DBG("sock %p state %d timeout %ld", sk, sk->state, timeout);
23591 -
23592 -       if (!mod_timer(&sk->timer, jiffies + timeout))
23593 -               sock_hold(sk);
23594 -}
23595 -
23596 -static void l2cap_sock_clear_timer(struct sock *sk)
23597 -{
23598 -       DBG("sock %p state %d", sk, sk->state);
23599 -
23600 -       if (timer_pending(&sk->timer) && del_timer(&sk->timer))
23601 -               __sock_put(sk);
23602 -}
23603 -
23604 -static void l2cap_sock_init_timer(struct sock *sk)
23605 -{
23606 -       init_timer(&sk->timer);
23607 -       sk->timer.function = l2cap_sock_timeout;
23608 -       sk->timer.data = (unsigned long)sk;
23609 -}
23610 -
23611 -static void l2cap_conn_timeout(unsigned long arg)
23612 -{
23613 -       struct l2cap_conn *conn = (void *)arg;
23614 -
23615 -       DBG("conn %p state %d", conn, conn->state);
23616 -
23617 -       if (conn->state == BT_CONNECTED) {
23618 -               hci_disconnect(conn->hconn, 0x13);
23619 -       }
23620 -
23621 -       return;
23622 -}
23623 -
23624 -static void l2cap_conn_set_timer(struct l2cap_conn *conn, long timeout)
23625 -{
23626 -       DBG("conn %p state %d timeout %ld", conn, conn->state, timeout);
23627 -
23628 -       mod_timer(&conn->timer, jiffies + timeout);
23629 -}
23630 -
23631 -static void l2cap_conn_clear_timer(struct l2cap_conn *conn)
23632 -{
23633 -       DBG("conn %p state %d", conn, conn->state);
23634 -
23635 -       del_timer(&conn->timer);
23636 -}
23637 -
23638 -static void l2cap_conn_init_timer(struct l2cap_conn *conn)
23639 -{
23640 -       init_timer(&conn->timer);
23641 -       conn->timer.function = l2cap_conn_timeout;
23642 -       conn->timer.data = (unsigned long)conn;
23643 -}
23644 -
23645 -/* -------- L2CAP connections --------- */
23646 -/* Add new connection to the interface.
23647 - * Interface must be locked
23648 - */
23649 -static struct l2cap_conn *l2cap_conn_add(struct l2cap_iff *iff, bdaddr_t *dst)
23650 -{
23651 -       struct l2cap_conn *conn;
23652 -       bdaddr_t *src = iff->bdaddr;
23653 -
23654 -       if (!(conn = kmalloc(sizeof(struct l2cap_conn), GFP_KERNEL)))
23655 -               return NULL;
23656 -
23657 -       memset(conn, 0, sizeof(struct l2cap_conn));
23658 -
23659 -       conn->state = BT_OPEN;
23660 -       conn->iff   = iff;
23661 -       bacpy(&conn->src, src);
23662 -       bacpy(&conn->dst, dst);
23663 -
23664 -       spin_lock_init(&conn->lock);
23665 -       conn->chan_list.lock = RW_LOCK_UNLOCKED;
23666 -
23667 -       l2cap_conn_init_timer(conn);
23668 -
23669 -       __l2cap_conn_link(iff, conn);
23670 -
23671 -       DBG("%s -> %s, %p", batostr(src), batostr(dst), conn);
23672 -
23673 -       MOD_INC_USE_COUNT;
23674 -
23675 -       return conn;
23676 -}
23677 -
23678 -/* Delete connection on the interface.
23679 - * Interface must be locked
23680 - */
23681 -static int l2cap_conn_del(struct l2cap_conn *conn, int err)
23682 -{
23683 -       struct sock *sk;
23684 -
23685 -       DBG("conn %p, state %d, err %d", conn, conn->state, err);
23686 -
23687 -       l2cap_conn_clear_timer(conn);
23688 -       __l2cap_conn_unlink(conn->iff, conn);
23689 -
23690 -       conn->state = BT_CLOSED;
23691 -
23692 -       if (conn->rx_skb)
23693 -               kfree_skb(conn->rx_skb);
23694 -
23695 -       /* Kill channels */
23696 -       while ((sk = conn->chan_list.head)) {
23697 -               bh_lock_sock(sk);
23698 -               l2cap_sock_clear_timer(sk);
23699 -               l2cap_chan_del(sk, err);
23700 -               bh_unlock_sock(sk);
23701 -
23702 -               l2cap_sock_kill(sk);
23703 -       }
23704 -
23705 -       kfree(conn);
23706 -
23707 -       MOD_DEC_USE_COUNT;
23708 -       return 0;
23709 -}
23710 -
23711 -static inline struct l2cap_conn *l2cap_get_conn_by_addr(struct l2cap_iff *iff, bdaddr_t *dst)
23712 -{
23713 -       struct list_head *p;
23714 -
23715 -       list_for_each(p, &iff->conn_list) {
23716 -               struct l2cap_conn *c;
23717 -
23718 -               c = list_entry(p, struct l2cap_conn, list);
23719 -               if (!bacmp(&c->dst, dst))
23720 -                       return c;
23721 -       }
23722 -       return NULL;
23723 -}
23724 -
23725 -int l2cap_connect(struct sock *sk)
23726 -{
23727 -       bdaddr_t *src = &l2cap_pi(sk)->src;
23728 -       bdaddr_t *dst = &l2cap_pi(sk)->dst;
23729 -       struct l2cap_conn *conn;
23730 -       struct l2cap_iff *iff;
23731 -       int err = 0;
23732 -
23733 -       DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst), l2cap_pi(sk)->psm);
23734 -
23735 -       read_lock_bh(&l2cap_rt_lock);
23736 -
23737 -       /* Get route to remote BD address */
23738 -       if (!(iff = l2cap_get_route(src, dst))) {
23739 -               err = -EHOSTUNREACH;
23740 -               goto done;
23741 -       }
23742 -
23743 -       /* Update source addr of the socket */
23744 -       bacpy(src, iff->bdaddr);
23745 -
23746 -       l2cap_iff_lock(iff);
23747 -
23748 -       if (!(conn = l2cap_get_conn_by_addr(iff, dst))) {
23749 -               /* Connection doesn't exist */
23750 -               if (!(conn = l2cap_conn_add(iff, dst))) {
23751 -                       l2cap_iff_unlock(iff);
23752 -                       err = -ENOMEM;
23753 -                       goto done;
23754 -               }
23755 -               conn->out = 1;
23756 -       }
23757 -
23758 -       l2cap_iff_unlock(iff);
23759 -
23760 -       l2cap_chan_add(conn, sk, NULL);
23761 -
23762 -       sk->state = BT_CONNECT;
23763 -       l2cap_sock_set_timer(sk, sk->sndtimeo);
23764 -
23765 -       switch (conn->state) {
23766 -       case BT_CONNECTED:
23767 -               if (sk->type == SOCK_SEQPACKET) {
23768 -                       l2cap_conn_req req;
23769 -                       req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
23770 -                       req.psm  = l2cap_pi(sk)->psm;
23771 -                       l2cap_send_req(conn, L2CAP_CONN_REQ, L2CAP_CONN_REQ_SIZE, &req);
23772 -               } else {
23773 -                       l2cap_sock_clear_timer(sk);
23774 -                       sk->state = BT_CONNECTED;
23775 -               }
23776 -               break;
23777 -
23778 -       case BT_CONNECT:
23779 -               break;
23780 -
23781 -       default:
23782 -               /* Create ACL connection */
23783 -               conn->state = BT_CONNECT;
23784 -               hci_connect(iff->hdev, dst);
23785 -               break;
23786 -       };
23787 -
23788 -done:
23789 -       read_unlock_bh(&l2cap_rt_lock);
23790 -       return err;
23791 -}
23792 -
23793 -/* ------ Channel queues for listening sockets ------ */
23794 -void l2cap_accept_queue(struct sock *parent, struct sock *sk)
23795 -{
23796 -       struct l2cap_accept_q *q = &l2cap_pi(parent)->accept_q;
23797 -
23798 -       DBG("parent %p, sk %p", parent, sk);
23799 -
23800 -       sock_hold(sk);
23801 -       l2cap_pi(sk)->parent = parent;
23802 -       l2cap_pi(sk)->next_q = NULL;
23803 -
23804 -       if (!q->head) {
23805 -               q->head = q->tail = sk;
23806 -       } else {
23807 -               struct sock *tail = q->tail;
23808 -
23809 -               l2cap_pi(sk)->prev_q = tail;
23810 -               l2cap_pi(tail)->next_q = sk;
23811 -               q->tail = sk;
23812 -       }
23813 -
23814 -       parent->ack_backlog++;
23815 -}
23816 -
23817 -void l2cap_accept_unlink(struct sock *sk)
23818 -{
23819 -       struct sock *parent = l2cap_pi(sk)->parent;
23820 -       struct l2cap_accept_q *q = &l2cap_pi(parent)->accept_q;
23821 -       struct sock *next, *prev;
23822 -
23823 -       DBG("sk %p", sk);
23824 -
23825 -       next = l2cap_pi(sk)->next_q;
23826 -       prev = l2cap_pi(sk)->prev_q;
23827 -
23828 -       if (sk == q->head)
23829 -               q->head = next;
23830 -       if (sk == q->tail)
23831 -               q->tail = prev;
23832 -
23833 -       if (next)
23834 -               l2cap_pi(next)->prev_q = prev;
23835 -       if (prev)
23836 -               l2cap_pi(prev)->next_q = next;
23837 -
23838 -       l2cap_pi(sk)->parent = NULL;
23839 -
23840 -       parent->ack_backlog--;
23841 -       __sock_put(sk);
23842 -}
23843 -
23844 -/* Get next connected channel in queue. */
23845 -struct sock *l2cap_accept_dequeue(struct sock *parent, int state)
23846 -{
23847 -       struct l2cap_accept_q *q = &l2cap_pi(parent)->accept_q;
23848 -       struct sock *sk;
23849 -
23850 -       for (sk = q->head; sk; sk = l2cap_pi(sk)->next_q) {
23851 -               if (!state || sk->state == state) {
23852 -                       l2cap_accept_unlink(sk);
23853 -                       break;
23854 -               }
23855 -       }
23856 -
23857 -       DBG("parent %p, sk %p", parent, sk);
23858 -
23859 -       return sk;
23860 -}
23861 -
23862 -/* -------- Socket interface ---------- */
23863 -static struct sock *__l2cap_get_sock_by_addr(struct sockaddr_l2 *addr)
23864 -{
23865 -       bdaddr_t *src = &addr->l2_bdaddr;
23866 -       __u16 psm = addr->l2_psm;
23867 -       struct sock *sk;
23868 -
23869 -       for (sk = l2cap_sk_list.head; sk; sk = sk->next) {
23870 -               if (l2cap_pi(sk)->psm == psm &&
23871 -                   !bacmp(&l2cap_pi(sk)->src, src))
23872 -                       break;
23873 -       }
23874 -
23875 -       return sk;
23876 -}
23877 -
23878 -/* Find socket listening on psm and source bdaddr.
23879 - * Returns closest match.
23880 - */
23881 -static struct sock *l2cap_get_sock_listen(bdaddr_t *src, __u16 psm)
23882 -{
23883 -       struct sock *sk, *sk1 = NULL;
23884 -
23885 -       read_lock(&l2cap_sk_list.lock);
23886 -
23887 -       for (sk = l2cap_sk_list.head; sk; sk = sk->next) {
23888 -               struct l2cap_pinfo *pi;
23889 -
23890 -               if (sk->state != BT_LISTEN)
23891 -                       continue;
23892 -
23893 -               pi = l2cap_pi(sk);
23894 -
23895 -               if (pi->psm == psm) {
23896 -                       /* Exact match. */
23897 -                       if (!bacmp(&pi->src, src))
23898 -                               break;
23899 -
23900 -                       /* Closest match */
23901 -                       if (!bacmp(&pi->src, BDADDR_ANY))
23902 -                               sk1 = sk;
23903 -               }
23904 -       }
23905 -
23906 -       read_unlock(&l2cap_sk_list.lock);
23907 -
23908 -       return sk ? sk : sk1;
23909 -}
23910 -
23911 -static void l2cap_sock_destruct(struct sock *sk)
23912 -{
23913 -       DBG("sk %p", sk);
23914 -
23915 -       skb_queue_purge(&sk->receive_queue);
23916 -       skb_queue_purge(&sk->write_queue);
23917 -
23918 -       MOD_DEC_USE_COUNT;
23919 -}
23920 -
23921 -static void l2cap_sock_cleanup_listen(struct sock *parent)
23922 -{
23923 -       struct sock *sk;
23924 -
23925 -       DBG("parent %p", parent);
23926 -
23927 -       /* Close not yet accepted channels */
23928 -       while ((sk = l2cap_accept_dequeue(parent, 0)))
23929 -               l2cap_sock_close(sk);
23930 -
23931 -       parent->state  = BT_CLOSED;
23932 -       parent->zapped = 1;
23933 -}
23934 -
23935 -/* Kill socket (only if zapped and orphan)
23936 - * Must be called on unlocked socket.
23937 - */
23938 -static void l2cap_sock_kill(struct sock *sk)
23939 -{
23940 -       if (!sk->zapped || sk->socket)
23941 -               return;
23942 -
23943 -       DBG("sk %p state %d", sk, sk->state);
23944 -
23945 -       /* Kill poor orphan */
23946 -       bluez_sock_unlink(&l2cap_sk_list, sk);
23947 -       sk->dead = 1;
23948 -       sock_put(sk);
23949 -}
23950 -
23951 -/* Close socket.
23952 - * Must be called on unlocked socket.
23953 - */
23954 -static void l2cap_sock_close(struct sock *sk)
23955 -{
23956 -       struct l2cap_conn *conn;
23957 -
23958 -       l2cap_sock_clear_timer(sk);
23959 -
23960 -       lock_sock(sk);
23961 -
23962 -       conn = l2cap_pi(sk)->conn;
23963 -
23964 -       DBG("sk %p state %d conn %p socket %p", sk, sk->state, conn, sk->socket);
23965 -
23966 -       switch (sk->state) {
23967 -       case BT_LISTEN:
23968 -               l2cap_sock_cleanup_listen(sk);
23969 -               break;
23970 -
23971 -       case BT_CONNECTED:
23972 -       case BT_CONFIG:
23973 -               if (sk->type == SOCK_SEQPACKET) {
23974 -                       l2cap_disconn_req req;
23975 -
23976 -                       sk->state = BT_DISCONN;
23977 -
23978 -                       req.dcid = __cpu_to_le16(l2cap_pi(sk)->dcid);
23979 -                       req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
23980 -                       l2cap_send_req(conn, L2CAP_DISCONN_REQ, L2CAP_DISCONN_REQ_SIZE, &req);
23981 -
23982 -                       l2cap_sock_set_timer(sk, sk->sndtimeo);
23983 -               } else {
23984 -                       l2cap_chan_del(sk, ECONNRESET);
23985 -               }
23986 -               break;
23987 -
23988 -       case BT_CONNECT:
23989 -       case BT_DISCONN:
23990 -               l2cap_chan_del(sk, ECONNRESET);
23991 -               break;
23992 -
23993 -       default:
23994 -               sk->zapped = 1;
23995 -               break;
23996 -       };
23997 -
23998 -       release_sock(sk);
23999 -
24000 -       l2cap_sock_kill(sk);
24001 -}
24002 -
24003 -static void l2cap_sock_init(struct sock *sk, struct sock *parent)
24004 -{
24005 -       struct l2cap_pinfo *pi = l2cap_pi(sk);
24006 -
24007 -       DBG("sk %p", sk);
24008 -
24009 -       if (parent) {
24010 -               sk->type = parent->type;
24011 -
24012 -               pi->imtu = l2cap_pi(parent)->imtu;
24013 -               pi->omtu = l2cap_pi(parent)->omtu;
24014 -       } else {
24015 -               pi->imtu = L2CAP_DEFAULT_MTU;
24016 -               pi->omtu = 0;
24017 -       }
24018 -
24019 -       /* Default config options */
24020 -       pi->conf_mtu = L2CAP_DEFAULT_MTU;
24021 -       pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
24022 -}
24023 -
24024 -static struct sock *l2cap_sock_alloc(struct socket *sock, int proto, int prio)
24025 -{
24026 -       struct sock *sk;
24027 -
24028 -       if (!(sk = sk_alloc(PF_BLUETOOTH, prio, 1)))
24029 -               return NULL;
24030 -
24031 -       sock_init_data(sock, sk);
24032 -
24033 -       sk->zapped   = 0;
24034 -
24035 -       sk->destruct = l2cap_sock_destruct;
24036 -       sk->sndtimeo = L2CAP_CONN_TIMEOUT;
24037 -
24038 -       sk->protocol = proto;
24039 -       sk->state    = BT_OPEN;
24040 -
24041 -       l2cap_sock_init_timer(sk);
24042 -
24043 -       bluez_sock_link(&l2cap_sk_list, sk);
24044 -
24045 -       MOD_INC_USE_COUNT;
24046 -
24047 -       return sk;
24048 -}
24049 -
24050 -static int l2cap_sock_create(struct socket *sock, int protocol)
24051 -{
24052 -       struct sock *sk;
24053 -
24054 -       DBG("sock %p", sock);
24055 -
24056 -       sock->state = SS_UNCONNECTED;
24057 -
24058 -       if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_RAW)
24059 -               return -ESOCKTNOSUPPORT;
24060 -
24061 -       sock->ops = &l2cap_sock_ops;
24062 -
24063 -       if (!(sk = l2cap_sock_alloc(sock, protocol, GFP_KERNEL)))
24064 -               return -ENOMEM;
24065 -
24066 -       l2cap_sock_init(sk, NULL);
24067 -
24068 -       return 0;
24069 -}
24070 -
24071 -static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
24072 -{
24073 -       struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
24074 -       struct sock *sk = sock->sk;
24075 -       int err = 0;
24076 -
24077 -       DBG("sk %p, %s %d", sk, batostr(&la->l2_bdaddr), la->l2_psm);
24078 -
24079 -       if (!addr || addr->sa_family != AF_BLUETOOTH)
24080 -               return -EINVAL;
24081 -
24082 -       lock_sock(sk);
24083 -
24084 -       if (sk->state != BT_OPEN) {
24085 -               err = -EBADFD;
24086 -               goto done;
24087 -       }
24088 -
24089 -       write_lock(&l2cap_sk_list.lock);
24090 -
24091 -       if (la->l2_psm && __l2cap_get_sock_by_addr(la)) {
24092 -               err = -EADDRINUSE;
24093 -               goto unlock;
24094 -       }
24095 -
24096 -       /* Save source address */
24097 -       bacpy(&l2cap_pi(sk)->src, &la->l2_bdaddr);
24098 -       l2cap_pi(sk)->psm = la->l2_psm;
24099 -       sk->state = BT_BOUND;
24100 -
24101 -unlock:
24102 -       write_unlock(&l2cap_sk_list.lock);
24103 -
24104 -done:
24105 -       release_sock(sk);
24106 -
24107 -       return err;
24108 -}
24109 -
24110 -static int l2cap_sock_w4_connect(struct sock *sk, int flags)
24111 -{
24112 -       DECLARE_WAITQUEUE(wait, current);
24113 -       long timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
24114 -       int err = 0;
24115 -
24116 -       DBG("sk %p", sk);
24117 -
24118 -       add_wait_queue(sk->sleep, &wait);
24119 -       current->state = TASK_INTERRUPTIBLE;
24120 -
24121 -       while (sk->state != BT_CONNECTED) {
24122 -               if (!timeo) {
24123 -                       err = -EAGAIN;
24124 -                       break;
24125 -               }
24126 -
24127 -               release_sock(sk);
24128 -               timeo = schedule_timeout(timeo);
24129 -               lock_sock(sk);
24130 -
24131 -               err = 0;
24132 -               if (sk->state == BT_CONNECTED)
24133 -                       break;
24134 -
24135 -               if (sk->err) {
24136 -                       err = sock_error(sk);
24137 -                       break;
24138 -               }
24139 -
24140 -               if (signal_pending(current)) {
24141 -                       err = sock_intr_errno(timeo);
24142 -                       break;
24143 -               }
24144 -       }
24145 -       current->state = TASK_RUNNING;
24146 -       remove_wait_queue(sk->sleep, &wait);
24147 -
24148 -       return err;
24149 -}
24150 -
24151 -static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
24152 -{
24153 -       struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
24154 -       struct sock *sk = sock->sk;
24155 -       int err = 0;
24156 -
24157 -       lock_sock(sk);
24158 -
24159 -       DBG("sk %p", sk);
24160 -
24161 -       if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_l2)) {
24162 -               err = -EINVAL;
24163 -               goto done;
24164 -       }
24165 -
24166 -       if (sk->state != BT_OPEN && sk->state != BT_BOUND) {
24167 -               err = -EBADFD;
24168 -               goto done;
24169 -       }
24170 -
24171 -       if (sk->type == SOCK_SEQPACKET && !la->l2_psm) {
24172 -               err = -EINVAL;
24173 -               goto done;
24174 -       }
24175 -
24176 -       /* Set destination address and psm */
24177 -       bacpy(&l2cap_pi(sk)->dst, &la->l2_bdaddr);
24178 -       l2cap_pi(sk)->psm = la->l2_psm;
24179 -
24180 -       if ((err = l2cap_connect(sk)))
24181 -               goto done;
24182 -
24183 -       err = l2cap_sock_w4_connect(sk, flags);
24184 -
24185 -done:
24186 -       release_sock(sk);
24187 -       return err;
24188 -}
24189 -
24190 -int l2cap_sock_listen(struct socket *sock, int backlog)
24191 -{
24192 -       struct sock *sk = sock->sk;
24193 -       int err = 0;
24194 -
24195 -       DBG("sk %p backlog %d", sk, backlog);
24196 -
24197 -       lock_sock(sk);
24198 -
24199 -       if (sk->state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
24200 -               err = -EBADFD;
24201 -               goto done;
24202 -       }
24203 -
24204 -       if (!l2cap_pi(sk)->psm) {
24205 -               err = -EINVAL;
24206 -               goto done;
24207 -       }
24208 -
24209 -       sk->max_ack_backlog = backlog;
24210 -       sk->ack_backlog = 0;
24211 -       sk->state = BT_LISTEN;
24212 -
24213 -done:
24214 -       release_sock(sk);
24215 -       return err;
24216 -}
24217 -
24218 -int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
24219 -{
24220 -       DECLARE_WAITQUEUE(wait, current);
24221 -       struct sock *sk = sock->sk, *ch;
24222 -       long timeo;
24223 -       int err = 0;
24224 -
24225 -       lock_sock(sk);
24226 -
24227 -       if (sk->state != BT_LISTEN) {
24228 -               err = -EBADFD;
24229 -               goto done;
24230 -       }
24231 -
24232 -       timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
24233 -
24234 -       DBG("sk %p timeo %ld", sk, timeo);
24235 -
24236 -       /* Wait for an incoming connection. (wake-one). */
24237 -       add_wait_queue_exclusive(sk->sleep, &wait);
24238 -       current->state = TASK_INTERRUPTIBLE;
24239 -       while (!(ch = l2cap_accept_dequeue(sk, BT_CONNECTED))) {
24240 -               if (!timeo) {
24241 -                       err = -EAGAIN;
24242 -                       break;
24243 -               }
24244 -
24245 -               release_sock(sk);
24246 -               timeo = schedule_timeout(timeo);
24247 -               lock_sock(sk);
24248 -
24249 -               if (sk->state != BT_LISTEN) {
24250 -                       err = -EBADFD;
24251 -                       break;
24252 -               }
24253 -
24254 -               if (signal_pending(current)) {
24255 -                       err = sock_intr_errno(timeo);
24256 -                       break;
24257 -               }
24258 -       }
24259 -       current->state = TASK_RUNNING;
24260 -       remove_wait_queue(sk->sleep, &wait);
24261 -
24262 -       if (err)
24263 -               goto done;
24264 -
24265 -       sock_graft(ch, newsock);
24266 -       newsock->state = SS_CONNECTED;
24267 -
24268 -       DBG("new socket %p", ch);
24269 -
24270 -done:
24271 -       release_sock(sk);
24272 -
24273 -       return err;
24274 -}
24275 -
24276 -static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
24277 -{
24278 -       struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
24279 -       struct sock *sk = sock->sk;
24280 -
24281 -       DBG("sock %p, sk %p", sock, sk);
24282 -
24283 -       addr->sa_family = AF_BLUETOOTH;
24284 -       *len = sizeof(struct sockaddr_l2);
24285 -
24286 -       if (peer)
24287 -               bacpy(&la->l2_bdaddr, &l2cap_pi(sk)->dst);
24288 -       else
24289 -               bacpy(&la->l2_bdaddr, &l2cap_pi(sk)->src);
24290 -
24291 -       la->l2_psm = l2cap_pi(sk)->psm;
24292 -
24293 -       return 0;
24294 -}
24295 -
24296 -static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg, int len, struct scm_cookie *scm)
24297 -{
24298 -       struct sock *sk = sock->sk;
24299 -       int err = 0;
24300 -
24301 -       DBG("sock %p, sk %p", sock, sk);
24302 -
24303 -       if (sk->err)
24304 -               return sock_error(sk);
24305 -
24306 -       if (msg->msg_flags & MSG_OOB)
24307 -               return -EOPNOTSUPP;
24308 -
24309 -       lock_sock(sk);
24310 -
24311 -       if (sk->state == BT_CONNECTED)
24312 -               err = l2cap_chan_send(sk, msg, len);
24313 -       else
24314 -               err = -ENOTCONN;
24315 -
24316 -       release_sock(sk);
24317 -       return err;
24318 -}
24319 -
24320 -static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg, int len, int flags, struct scm_cookie *scm)
24321 -{
24322 -       struct sock *sk = sock->sk;
24323 -       int noblock = flags & MSG_DONTWAIT;
24324 -       int copied, err;
24325 -       struct sk_buff *skb;
24326 -
24327 -       DBG("sock %p, sk %p", sock, sk);
24328 -
24329 -       if (flags & (MSG_OOB))
24330 -               return -EOPNOTSUPP;
24331 -
24332 -       if (sk->state == BT_CLOSED)
24333 -               return 0;
24334 -
24335 -       if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
24336 -               return err;
24337 -
24338 -       msg->msg_namelen = 0;
24339 -
24340 -       copied = skb->len;
24341 -       if (len < copied) {
24342 -               msg->msg_flags |= MSG_TRUNC;
24343 -               copied = len;
24344 -       }
24345 -
24346 -       skb->h.raw = skb->data;
24347 -       err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
24348 -
24349 -       skb_free_datagram(sk, skb);
24350 -
24351 -       return err ? : copied;
24352 -}
24353 -
24354 -int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
24355 -{
24356 -       struct sock *sk = sock->sk;
24357 -       struct l2cap_options opts;
24358 -       int err = 0;
24359 -
24360 -       DBG("sk %p", sk);
24361 -
24362 -       lock_sock(sk);
24363 -
24364 -       switch (optname) {
24365 -       case L2CAP_OPTIONS:
24366 -               if (copy_from_user((char *)&opts, optval, optlen)) {
24367 -                       err = -EFAULT;
24368 -                       break;
24369 -               }
24370 -               l2cap_pi(sk)->imtu = opts.imtu;
24371 -               l2cap_pi(sk)->omtu = opts.omtu;
24372 -               break;
24373 -
24374 -       default:
24375 -               err = -ENOPROTOOPT;
24376 -               break;
24377 -       };
24378 -
24379 -       release_sock(sk);
24380 -       return err;
24381 -}
24382 -
24383 -int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
24384 -{
24385 -       struct sock *sk = sock->sk;
24386 -       struct l2cap_options opts;
24387 -       struct l2cap_conninfo cinfo;
24388 -       int len, err = 0;
24389 -
24390 -       if (get_user(len, optlen))
24391 -               return -EFAULT;
24392 -
24393 -       lock_sock(sk);
24394 -
24395 -       switch (optname) {
24396 -       case L2CAP_OPTIONS:
24397 -               opts.imtu     = l2cap_pi(sk)->imtu;
24398 -               opts.omtu     = l2cap_pi(sk)->omtu;
24399 -               opts.flush_to = l2cap_pi(sk)->flush_to;
24400 -
24401 -               len = MIN(len, sizeof(opts));
24402 -               if (copy_to_user(optval, (char *)&opts, len))
24403 -                       err = -EFAULT;
24404 -
24405 -               break;
24406 -
24407 -       case L2CAP_CONNINFO:
24408 -               if (sk->state != BT_CONNECTED) {
24409 -                       err = -ENOTCONN;
24410 -                       break;
24411 -               }
24412 -
24413 -               cinfo.hci_handle = l2cap_pi(sk)->conn->hconn->handle;
24414 -
24415 -               len = MIN(len, sizeof(cinfo));
24416 -               if (copy_to_user(optval, (char *)&cinfo, len))
24417 -                       err = -EFAULT;
24418 -
24419 -               break;
24420 -
24421 -       default:
24422 -               err = -ENOPROTOOPT;
24423 -               break;
24424 -       };
24425 -
24426 -       release_sock(sk);
24427 -       return err;
24428 -}
24429 -
24430 -static unsigned int l2cap_sock_poll(struct file * file, struct socket *sock, poll_table *wait)
24431 -{
24432 -       struct sock *sk = sock->sk;
24433 -       struct l2cap_accept_q *aq;
24434 -       unsigned int mask;
24435 -
24436 -       DBG("sock %p, sk %p", sock, sk);
24437 -
24438 -       poll_wait(file, sk->sleep, wait);
24439 -       mask = 0;
24440 -
24441 -       if (sk->err || !skb_queue_empty(&sk->error_queue))
24442 -               mask |= POLLERR;
24443 -
24444 -       if (sk->shutdown == SHUTDOWN_MASK)
24445 -               mask |= POLLHUP;
24446 -
24447 -       aq = &l2cap_pi(sk)->accept_q;
24448 -       if (!skb_queue_empty(&sk->receive_queue) || aq->head || (sk->shutdown & RCV_SHUTDOWN))
24449 -               mask |= POLLIN | POLLRDNORM;
24450 -
24451 -       if (sk->state == BT_CLOSED)
24452 -               mask |= POLLHUP;
24453 -
24454 -       if (sock_writeable(sk))
24455 -               mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
24456 -       else
24457 -               set_bit(SOCK_ASYNC_NOSPACE, &sk->socket->flags);
24458 -
24459 -       return mask;
24460 -}
24461 -
24462 -static int l2cap_sock_release(struct socket *sock)
24463 -{
24464 -       struct sock *sk = sock->sk;
24465 -
24466 -       DBG("sock %p, sk %p", sock, sk);
24467 -
24468 -       if (!sk)
24469 -               return 0;
24470 -
24471 -       sock_orphan(sk);
24472 -
24473 -       l2cap_sock_close(sk);
24474 -
24475 -       return 0;
24476 -}
24477 -
24478 -/* --------- L2CAP channels --------- */
24479 -static struct sock * __l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, __u16 cid)
24480 -{
24481 -       struct sock *s;
24482 -
24483 -       for (s = l->head; s; s = l2cap_pi(s)->next_c) {
24484 -               if (l2cap_pi(s)->dcid == cid)
24485 -                       break;
24486 -       }
24487 -
24488 -       return s;
24489 -}
24490 -
24491 -static inline struct sock *l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, __u16 cid)
24492 -{
24493 -       struct sock *s;
24494 -
24495 -       read_lock(&l->lock);
24496 -       s = __l2cap_get_chan_by_dcid(l, cid);
24497 -       read_unlock(&l->lock);
24498 -
24499 -       return s;
24500 -}
24501 -
24502 -static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, __u16 cid)
24503 -{
24504 -       struct sock *s;
24505 -
24506 -       for (s = l->head; s; s = l2cap_pi(s)->next_c) {
24507 -               if (l2cap_pi(s)->scid == cid)
24508 -                       break;
24509 -       }
24510 -
24511 -       return s;
24512 -}
24513 -static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, __u16 cid)
24514 -{
24515 -       struct sock *s;
24516 -
24517 -       read_lock(&l->lock);
24518 -       s = __l2cap_get_chan_by_scid(l, cid);
24519 -       read_unlock(&l->lock);
24520 -
24521 -       return s;
24522 -}
24523 -
24524 -static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, __u8 ident)
24525 -{
24526 -       struct sock *s;
24527 -
24528 -       for (s = l->head; s; s = l2cap_pi(s)->next_c) {
24529 -               if (l2cap_pi(s)->ident == ident)
24530 -                       break;
24531 -       }
24532 -
24533 -       return s;
24534 -}
24535 -
24536 -static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, __u8 ident)
24537 -{
24538 -       struct sock *s;
24539 -
24540 -       read_lock(&l->lock);
24541 -       s = __l2cap_get_chan_by_ident(l, ident);
24542 -       read_unlock(&l->lock);
24543 -
24544 -       return s;
24545 -}
24546 -
24547 -static __u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
24548 -{
24549 -       __u16 cid = 0x0040;
24550 -
24551 -       for (; cid < 0xffff; cid++) {
24552 -               if(!__l2cap_get_chan_by_scid(l, cid))
24553 -                       return cid;
24554 -       }
24555 -
24556 -       return 0;
24557 -}
24558 -
24559 -static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
24560 -{
24561 -       sock_hold(sk);
24562 -
24563 -       if (l->head)
24564 -               l2cap_pi(l->head)->prev_c = sk;
24565 -
24566 -       l2cap_pi(sk)->next_c = l->head;
24567 -       l2cap_pi(sk)->prev_c = NULL;
24568 -       l->head = sk;
24569 -}
24570 -
24571 -static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
24572 -{
24573 -       struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
24574 -
24575 -       write_lock(&l->lock);
24576 -       if (sk == l->head)
24577 -               l->head = next;
24578 -
24579 -       if (next)
24580 -               l2cap_pi(next)->prev_c = prev;
24581 -       if (prev)
24582 -               l2cap_pi(prev)->next_c = next;
24583 -       write_unlock(&l->lock);
24584 -
24585 -       __sock_put(sk);
24586 -}
24587 -
24588 -static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
24589 -{
24590 -       struct l2cap_chan_list *l = &conn->chan_list;
24591 -
24592 -       DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
24593 -
24594 -       l2cap_conn_clear_timer(conn);
24595 -
24596 -       atomic_inc(&conn->refcnt);
24597 -       l2cap_pi(sk)->conn = conn;
24598 -
24599 -       if (sk->type == SOCK_SEQPACKET) {
24600 -               /* Alloc CID for normal socket */
24601 -               l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
24602 -       } else {
24603 -               /* Raw socket can send only signalling messages */
24604 -               l2cap_pi(sk)->scid = 0x0001;
24605 -               l2cap_pi(sk)->dcid = 0x0001;
24606 -               l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
24607 -       }
24608 -
24609 -       __l2cap_chan_link(l, sk);
24610 -
24611 -       if (parent)
24612 -               l2cap_accept_queue(parent, sk);
24613 -}
24614 -
24615 -static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
24616 -{
24617 -       struct l2cap_chan_list *l = &conn->chan_list;
24618 -
24619 -       write_lock(&l->lock);
24620 -       __l2cap_chan_add(conn, sk, parent);
24621 -       write_unlock(&l->lock);
24622 -}
24623 -
24624 -/* Delete channel.
24625 - * Must be called on the locked socket. */
24626 -static void l2cap_chan_del(struct sock *sk, int err)
24627 -{
24628 -       struct l2cap_conn *conn;
24629 -       struct sock *parent;
24630 -
24631 -       conn = l2cap_pi(sk)->conn;
24632 -       parent = l2cap_pi(sk)->parent;
24633 -
24634 -       DBG("sk %p, conn %p, err %d", sk, conn, err);
24635 -
24636 -       if (parent) {
24637 -               /* Unlink from parent accept queue */
24638 -               bh_lock_sock(parent);
24639 -               l2cap_accept_unlink(sk);
24640 -               bh_unlock_sock(parent);
24641 -       }
24642 -
24643 -       if (conn) {
24644 -               long timeout;
24645 -
24646 -               /* Unlink from channel list */
24647 -               l2cap_chan_unlink(&conn->chan_list, sk);
24648 -               l2cap_pi(sk)->conn = NULL;
24649 -
24650 -               if (conn->out)
24651 -                       timeout = L2CAP_DISCONN_TIMEOUT;
24652 -               else
24653 -                       timeout = L2CAP_CONN_IDLE_TIMEOUT;
24654 -
24655 -               if (atomic_dec_and_test(&conn->refcnt) && conn->state == BT_CONNECTED) {
24656 -                       /* Schedule Baseband disconnect */
24657 -                       l2cap_conn_set_timer(conn, timeout);
24658 -               }
24659 -       }
24660 -
24661 -       sk->state  = BT_CLOSED;
24662 -       sk->err    = err;
24663 -       sk->state_change(sk);
24664 -
24665 -       sk->zapped = 1;
24666 -}
24667 -
24668 -static void l2cap_conn_ready(struct l2cap_conn *conn)
24669 -{
24670 -       struct l2cap_chan_list *l = &conn->chan_list;
24671 -       struct sock *sk;
24672 -
24673 -       DBG("conn %p", conn);
24674 -
24675 -       read_lock(&l->lock);
24676 -
24677 -       for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
24678 -               bh_lock_sock(sk);
24679 -
24680 -               if (sk->type != SOCK_SEQPACKET) {
24681 -                       sk->state = BT_CONNECTED;
24682 -                       sk->state_change(sk);
24683 -                       l2cap_sock_clear_timer(sk);
24684 -               } else if (sk->state == BT_CONNECT) {
24685 -                       l2cap_conn_req req;
24686 -                       req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
24687 -                       req.psm  = l2cap_pi(sk)->psm;
24688 -                       l2cap_send_req(conn, L2CAP_CONN_REQ, L2CAP_CONN_REQ_SIZE, &req);
24689 -
24690 -                       l2cap_sock_set_timer(sk, sk->sndtimeo);
24691 -               }
24692 -
24693 -               bh_unlock_sock(sk);
24694 -       }
24695 -
24696 -       read_unlock(&l->lock);
24697 -}
24698 -
24699 -static void l2cap_chan_ready(struct sock *sk)
24700 -{
24701 -       struct sock *parent = l2cap_pi(sk)->parent;
24702 -
24703 -       DBG("sk %p, parent %p", sk, parent);
24704 -
24705 -       l2cap_pi(sk)->conf_state = 0;
24706 -       l2cap_sock_clear_timer(sk);
24707 -
24708 -       if (!parent) {
24709 -               /* Outgoing channel.
24710 -                * Wake up socket sleeping on connect.
24711 -                */
24712 -               sk->state = BT_CONNECTED;
24713 -               sk->state_change(sk);
24714 -       } else {
24715 -               /* Incomming channel.
24716 -                * Wake up socket sleeping on accept.
24717 -                */
24718 -               parent->data_ready(parent, 1);
24719 -       }
24720 -}
24721 -
24722 -/* Copy frame to all raw sockets on that connection */
24723 -void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
24724 -{
24725 -       struct l2cap_chan_list *l = &conn->chan_list;
24726 -       struct sk_buff *nskb;
24727 -       struct sock * sk;
24728 -
24729 -       DBG("conn %p", conn);
24730 -
24731 -       read_lock(&l->lock);
24732 -       for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
24733 -               if (sk->type != SOCK_RAW)
24734 -                       continue;
24735 -
24736 -               /* Don't send frame to the socket it came from */
24737 -               if (skb->sk == sk)
24738 -                       continue;
24739 -
24740 -               if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
24741 -                       continue;
24742 -
24743 -               skb_queue_tail(&sk->receive_queue, nskb);
24744 -               sk->data_ready(sk, nskb->len);
24745 -       }
24746 -       read_unlock(&l->lock);
24747 -}
24748 -
24749 -static int l2cap_chan_send(struct sock *sk, struct msghdr *msg, int len)
24750 -{
24751 -       struct l2cap_conn *conn = l2cap_pi(sk)->conn;
24752 -       struct sk_buff *skb, **frag;
24753 -       int err, size, count, sent=0;
24754 -       l2cap_hdr *lh;
24755 -
24756 -       /* Check outgoing MTU */
24757 -       if (len > l2cap_pi(sk)->omtu)
24758 -               return -EINVAL;
24759 -
24760 -       DBG("sk %p len %d", sk, len);
24761 -
24762 -       /* First fragment (with L2CAP header) */
24763 -       count = MIN(conn->iff->mtu - L2CAP_HDR_SIZE, len);
24764 -       size  = L2CAP_HDR_SIZE + count;
24765 -       if (!(skb = bluez_skb_send_alloc(sk, size, msg->msg_flags & MSG_DONTWAIT, &err)))
24766 -               return err;
24767 -
24768 -       /* Create L2CAP header */
24769 -       lh = (l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
24770 -       lh->len = __cpu_to_le16(len);
24771 -       lh->cid = __cpu_to_le16(l2cap_pi(sk)->dcid);
24772 -
24773 -       if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
24774 -               err = -EFAULT;
24775 -               goto fail;
24776 -       }
24777 -
24778 -       sent += count;
24779 -       len  -= count;
24780 -
24781 -       /* Continuation fragments (no L2CAP header) */
24782 -       frag = &skb_shinfo(skb)->frag_list;
24783 -       while (len) {
24784 -               count = MIN(conn->iff->mtu, len);
24785 -
24786 -               *frag = bluez_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
24787 -               if (!*frag)
24788 -                       goto fail;
24789 -
24790 -               if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
24791 -                       err = -EFAULT;
24792 -                       goto fail;
24793 -               }
24794 -
24795 -               sent += count;
24796 -               len  -= count;
24797 -
24798 -               frag = &(*frag)->next;
24799 -       }
24800 -
24801 -       if ((err = hci_send_acl(conn->hconn, skb, 0)) < 0)
24802 -               goto fail;
24803 -
24804 -       return sent;
24805 -
24806 -fail:
24807 -       kfree_skb(skb);
24808 -       return err;
24809 -}
24810 -
24811 -/* --------- L2CAP signalling commands --------- */
24812 -static inline __u8 l2cap_get_ident(struct l2cap_conn *conn)
24813 -{
24814 -       __u8 id;
24815 -
24816 -       /* Get next available identificator.
24817 -        *    1 - 199 are used by kernel.
24818 -        *  200 - 254 are used by utilities like l2ping, etc
24819 -        */
24820 -
24821 -       spin_lock(&conn->lock);
24822 -
24823 -       if (++conn->tx_ident > 199)
24824 -               conn->tx_ident = 1;
24825 -
24826 -       id = conn->tx_ident;
24827 -
24828 -       spin_unlock(&conn->lock);
24829 -
24830 -       return id;
24831 -}
24832 -
24833 -static inline struct sk_buff *l2cap_build_cmd(__u8 code, __u8 ident, __u16 len, void *data)
24834 -{
24835 -       struct sk_buff *skb;
24836 -       l2cap_cmd_hdr *cmd;
24837 -       l2cap_hdr *lh;
24838 -       int size;
24839 -
24840 -       DBG("code 0x%2.2x, ident 0x%2.2x, len %d", code, ident, len);
24841 -
24842 -       size = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + len;
24843 -       if (!(skb = bluez_skb_alloc(size, GFP_ATOMIC)))
24844 -               return NULL;
24845 -
24846 -       lh = (l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
24847 -       lh->len = __cpu_to_le16(L2CAP_CMD_HDR_SIZE + len);
24848 -       lh->cid = __cpu_to_le16(0x0001);
24849 -
24850 -       cmd = (l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
24851 -       cmd->code  = code;
24852 -       cmd->ident = ident;
24853 -       cmd->len   = __cpu_to_le16(len);
24854 -
24855 -       if (len)
24856 -               memcpy(skb_put(skb, len), data, len);
24857 -
24858 -       return skb;
24859 -}
24860 -
24861 -static int l2cap_send_req(struct l2cap_conn *conn, __u8 code, __u16 len, void *data)
24862 -{
24863 -       struct sk_buff *skb;
24864 -       __u8 ident;
24865 -
24866 -       DBG("code 0x%2.2x", code);
24867 -
24868 -       ident = l2cap_get_ident(conn);
24869 -       if (!(skb = l2cap_build_cmd(code, ident, len, data)))
24870 -               return -ENOMEM;
24871 -       return hci_send_acl(conn->hconn, skb, 0);
24872 -}
24873 -
24874 -static int l2cap_send_rsp(struct l2cap_conn *conn, __u8 ident, __u8 code, __u16 len, void *data)
24875 -{
24876 -       struct sk_buff *skb;
24877 -
24878 -       DBG("code 0x%2.2x", code);
24879 -
24880 -       if (!(skb = l2cap_build_cmd(code, ident, len, data)))
24881 -               return -ENOMEM;
24882 -       return hci_send_acl(conn->hconn, skb, 0);
24883 -}
24884 -
24885 -static inline int l2cap_get_conf_opt(__u8 **ptr, __u8 *type, __u32 *val)
24886 -{
24887 -       l2cap_conf_opt *opt = (l2cap_conf_opt *) (*ptr);
24888 -       int len;
24889 -
24890 -       *type = opt->type;
24891 -       switch (opt->len) {
24892 -       case 1:
24893 -               *val = *((__u8 *) opt->val);
24894 -               break;
24895 -
24896 -       case 2:
24897 -               *val = __le16_to_cpu(*((__u16 *)opt->val));
24898 -               break;
24899 -
24900 -       case 4:
24901 -               *val = __le32_to_cpu(*((__u32 *)opt->val));
24902 -               break;
24903 -
24904 -       default:
24905 -               *val = 0L;
24906 -               break;
24907 -       };
24908 -
24909 -       DBG("type 0x%2.2x len %d val 0x%8.8x", *type, opt->len, *val);
24910 -
24911 -       len = L2CAP_CONF_OPT_SIZE + opt->len;
24912 -
24913 -       *ptr += len;
24914 -
24915 -       return len;
24916 -}
24917 -
24918 -static inline void l2cap_parse_conf_req(struct sock *sk, char *data, int len)
24919 -{
24920 -       __u8 type, hint; __u32 val;
24921 -       __u8 *ptr = data;
24922 -
24923 -       DBG("sk %p len %d", sk, len);
24924 -
24925 -       while (len >= L2CAP_CONF_OPT_SIZE) {
24926 -               len -= l2cap_get_conf_opt(&ptr, &type, &val);
24927 -
24928 -               hint  = type & 0x80;
24929 -               type &= 0x7f;
24930 -
24931 -               switch (type) {
24932 -               case L2CAP_CONF_MTU:
24933 -                       l2cap_pi(sk)->conf_mtu = val;
24934 -                       break;
24935 -
24936 -               case L2CAP_CONF_FLUSH_TO:
24937 -                       l2cap_pi(sk)->flush_to = val;
24938 -                       break;
24939 -
24940 -               case L2CAP_CONF_QOS:
24941 -                       break;
24942 -
24943 -               default:
24944 -                       if (hint)
24945 -                               break;
24946 -
24947 -                       /* FIXME: Reject unknon option */
24948 -                       break;
24949 -               };
24950 -       }
24951 -}
24952 -
24953 -static inline void l2cap_add_conf_opt(__u8 **ptr, __u8 type, __u8 len, __u32 val)
24954 -{
24955 -       register l2cap_conf_opt *opt = (l2cap_conf_opt *) (*ptr);
24956 -
24957 -       DBG("type 0x%2.2x len %d val 0x%8.8x", type, len, val);
24958 -
24959 -       opt->type = type;
24960 -       opt->len  = len;
24961 -       switch (len) {
24962 -       case 1:
24963 -               *((__u8 *) opt->val)  = val;
24964 -               break;
24965 -
24966 -       case 2:
24967 -               *((__u16 *) opt->val) = __cpu_to_le16(val);
24968 -               break;
24969 -
24970 -       case 4:
24971 -               *((__u32 *) opt->val) = __cpu_to_le32(val);
24972 -               break;
24973 -       };
24974 -
24975 -       *ptr += L2CAP_CONF_OPT_SIZE + len;
24976 -}
24977 -
24978 -static int l2cap_build_conf_req(struct sock *sk, __u8 *data)
24979 -{
24980 -       struct l2cap_pinfo *pi = l2cap_pi(sk);
24981 -       l2cap_conf_req *req = (l2cap_conf_req *) data;
24982 -       __u8 *ptr = req->data;
24983 -
24984 -       DBG("sk %p", sk);
24985 -
24986 -       if (pi->imtu != L2CAP_DEFAULT_MTU)
24987 -               l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
24988 -
24989 -       /* FIXME. Need actual value of the flush timeout */
24990 -       //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
24991 -       //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
24992 -
24993 -       req->dcid  = __cpu_to_le16(pi->dcid);
24994 -       req->flags = __cpu_to_le16(0);
24995 -
24996 -       return ptr - data;
24997 -}
24998 -
24999 -static int l2cap_conf_output(struct sock *sk, __u8 **ptr)
25000 -{
25001 -       struct l2cap_pinfo *pi = l2cap_pi(sk);
25002 -       int result = 0;
25003 -
25004 -       /* Configure output options and let other side know
25005 -        * which ones we don't like.
25006 -        */
25007 -       if (pi->conf_mtu < pi->omtu) {
25008 -               l2cap_add_conf_opt(ptr, L2CAP_CONF_MTU, 2, l2cap_pi(sk)->omtu);
25009 -               result = L2CAP_CONF_UNACCEPT;
25010 -       } else {
25011 -               pi->omtu = pi->conf_mtu;
25012 -       }
25013 -
25014 -       DBG("sk %p result %d", sk, result);
25015 -       return result;
25016 -}
25017 -
25018 -static int l2cap_build_conf_rsp(struct sock *sk, __u8 *data, int *result)
25019 -{
25020 -       l2cap_conf_rsp *rsp = (l2cap_conf_rsp *) data;
25021 -       __u8 *ptr = rsp->data;
25022 -
25023 -       DBG("sk %p complete %d", sk, result ? 1 : 0);
25024 -
25025 -       if (result)
25026 -               *result = l2cap_conf_output(sk, &ptr);
25027 -
25028 -       rsp->scid   = __cpu_to_le16(l2cap_pi(sk)->dcid);
25029 -       rsp->result = __cpu_to_le16(result ? *result : 0);
25030 -       rsp->flags  = __cpu_to_le16(0);
25031 -
25032 -       return ptr - data;
25033 -}
25034 -
25035 -static inline int l2cap_connect_req(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
25036 -{
25037 -       struct l2cap_chan_list *list = &conn->chan_list;
25038 -       l2cap_conn_req *req = (l2cap_conn_req *) data;
25039 -       l2cap_conn_rsp rsp;
25040 -       struct sock *sk, *parent;
25041 -
25042 -       __u16 scid = __le16_to_cpu(req->scid);
25043 -       __u16 psm  = req->psm;
25044 -
25045 -       DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
25046 -
25047 -       /* Check if we have socket listening on psm */
25048 -       if (!(parent = l2cap_get_sock_listen(&conn->src, psm)))
25049 -               goto reject;
25050 -
25051 -       bh_lock_sock(parent);
25052 -       write_lock(&list->lock);
25053 -
25054 -       /* Check if we already have channel with that dcid */
25055 -       if (__l2cap_get_chan_by_dcid(list, scid))
25056 -               goto unlock;
25057 -
25058 -       /* Check for backlog size */
25059 -       if (parent->ack_backlog > parent->max_ack_backlog)
25060 -               goto unlock;
25061 -
25062 -       if (!(sk = l2cap_sock_alloc(NULL, BTPROTO_L2CAP, GFP_ATOMIC)))
25063 -               goto unlock;
25064 -
25065 -       l2cap_sock_init(sk, parent);
25066 -
25067 -       bacpy(&l2cap_pi(sk)->src, &conn->src);
25068 -       bacpy(&l2cap_pi(sk)->dst, &conn->dst);
25069 -       l2cap_pi(sk)->psm  = psm;
25070 -       l2cap_pi(sk)->dcid = scid;
25071 -
25072 -       __l2cap_chan_add(conn, sk, parent);
25073 -       sk->state = BT_CONFIG;
25074 -
25075 -       write_unlock(&list->lock);
25076 -       bh_unlock_sock(parent);
25077 -
25078 -       rsp.dcid   = __cpu_to_le16(l2cap_pi(sk)->scid);
25079 -       rsp.scid   = __cpu_to_le16(l2cap_pi(sk)->dcid);
25080 -       rsp.result = __cpu_to_le16(0);
25081 -       rsp.status = __cpu_to_le16(0);
25082 -       l2cap_send_rsp(conn, cmd->ident, L2CAP_CONN_RSP, L2CAP_CONN_RSP_SIZE, &rsp);
25083 -
25084 -       return 0;
25085 -
25086 -unlock:
25087 -       write_unlock(&list->lock);
25088 -       bh_unlock_sock(parent);
25089 -
25090 -reject:
25091 -       rsp.scid   = __cpu_to_le16(scid);
25092 -       rsp.dcid   = __cpu_to_le16(0);
25093 -       rsp.status = __cpu_to_le16(0);
25094 -       rsp.result = __cpu_to_le16(L2CAP_CONN_NO_MEM);
25095 -       l2cap_send_rsp(conn, cmd->ident, L2CAP_CONN_RSP, L2CAP_CONN_RSP_SIZE, &rsp);
25096 -
25097 -       return 0;
25098 -}
25099 -
25100 -static inline int l2cap_connect_rsp(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
25101 -{
25102 -       l2cap_conn_rsp *rsp = (l2cap_conn_rsp *) data;
25103 -       __u16 scid, dcid, result, status;
25104 -       struct sock *sk;
25105 -
25106 -       scid   = __le16_to_cpu(rsp->scid);
25107 -       dcid   = __le16_to_cpu(rsp->dcid);
25108 -       result = __le16_to_cpu(rsp->result);
25109 -       status = __le16_to_cpu(rsp->status);
25110 -
25111 -       DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
25112 -
25113 -       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
25114 -               return -ENOENT;
25115 -
25116 -       bh_lock_sock(sk);
25117 -
25118 -       if (!result) {
25119 -               char req[64];
25120 -
25121 -               sk->state = BT_CONFIG;
25122 -               l2cap_pi(sk)->dcid = dcid;
25123 -               l2cap_pi(sk)->conf_state |= CONF_REQ_SENT;
25124 -
25125 -               l2cap_send_req(conn, L2CAP_CONF_REQ, l2cap_build_conf_req(sk, req), req);
25126 -       } else {
25127 -               l2cap_chan_del(sk, ECONNREFUSED);
25128 -       }
25129 -
25130 -       bh_unlock_sock(sk);
25131 -       return 0;
25132 -}
25133 -
25134 -static inline int l2cap_config_req(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
25135 -{
25136 -       l2cap_conf_req * req = (l2cap_conf_req *) data;
25137 -       __u16 dcid, flags;
25138 -       __u8 rsp[64];
25139 -       struct sock *sk;
25140 -       int result;
25141 -
25142 -       dcid  = __le16_to_cpu(req->dcid);
25143 -       flags = __le16_to_cpu(req->flags);
25144 -
25145 -       DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
25146 -
25147 -       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
25148 -               return -ENOENT;
25149 -
25150 -       bh_lock_sock(sk);
25151 -
25152 -       l2cap_parse_conf_req(sk, req->data, cmd->len - L2CAP_CONF_REQ_SIZE);
25153 -
25154 -       if (flags & 0x01) {
25155 -               /* Incomplete config. Send empty response. */
25156 -               l2cap_send_rsp(conn, cmd->ident, L2CAP_CONF_RSP, l2cap_build_conf_rsp(sk, rsp, NULL), rsp);
25157 -               goto unlock;
25158 -       }
25159 -
25160 -       /* Complete config. */
25161 -       l2cap_send_rsp(conn, cmd->ident, L2CAP_CONF_RSP, l2cap_build_conf_rsp(sk, rsp, &result), rsp);
25162 -
25163 -       if (result)
25164 -               goto unlock;
25165 -
25166 -       /* Output config done */
25167 -       l2cap_pi(sk)->conf_state |= CONF_OUTPUT_DONE;
25168 -
25169 -       if (l2cap_pi(sk)->conf_state & CONF_INPUT_DONE) {
25170 -               sk->state = BT_CONNECTED;
25171 -               l2cap_chan_ready(sk);
25172 -       } else if (!(l2cap_pi(sk)->conf_state & CONF_REQ_SENT)) {
25173 -               char req[64];
25174 -               l2cap_send_req(conn, L2CAP_CONF_REQ, l2cap_build_conf_req(sk, req), req);
25175 -       }
25176 -
25177 -unlock:
25178 -       bh_unlock_sock(sk);
25179 -
25180 -       return 0;
25181 -}
25182 -
25183 -static inline int l2cap_config_rsp(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
25184 -{
25185 -       l2cap_conf_rsp *rsp = (l2cap_conf_rsp *)data;
25186 -       __u16 scid, flags, result;
25187 -       struct sock *sk;
25188 -       int err = 0;
25189 -
25190 -       scid   = __le16_to_cpu(rsp->scid);
25191 -       flags  = __le16_to_cpu(rsp->flags);
25192 -       result = __le16_to_cpu(rsp->result);
25193 -
25194 -       DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x", scid, flags, result);
25195 -
25196 -       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
25197 -               return -ENOENT;
25198 -
25199 -       bh_lock_sock(sk);
25200 -
25201 -       if (result) {
25202 -               l2cap_disconn_req req;
25203 -
25204 -               /* They didn't like our options. Well... we do not negotiate.
25205 -                * Close channel.
25206 -                */
25207 -               sk->state = BT_DISCONN;
25208 -
25209 -               req.dcid = __cpu_to_le16(l2cap_pi(sk)->dcid);
25210 -               req.scid = __cpu_to_le16(l2cap_pi(sk)->scid);
25211 -               l2cap_send_req(conn, L2CAP_DISCONN_REQ, L2CAP_DISCONN_REQ_SIZE, &req);
25212 -
25213 -               l2cap_sock_set_timer(sk, sk->sndtimeo);
25214 -               goto done;
25215 -       }
25216 -
25217 -       if (flags & 0x01)
25218 -               goto done;
25219 -
25220 -       /* Input config done */
25221 -       l2cap_pi(sk)->conf_state |= CONF_INPUT_DONE;
25222 -
25223 -       if (l2cap_pi(sk)->conf_state & CONF_OUTPUT_DONE) {
25224 -               sk->state = BT_CONNECTED;
25225 -               l2cap_chan_ready(sk);
25226 -       }
25227 -
25228 -done:
25229 -       bh_unlock_sock(sk);
25230 -
25231 -       return err;
25232 -}
25233 -
25234 -static inline int l2cap_disconnect_req(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
25235 -{
25236 -       l2cap_disconn_req *req = (l2cap_disconn_req *) data;
25237 -       l2cap_disconn_rsp rsp;
25238 -       __u16 dcid, scid;
25239 -       struct sock *sk;
25240 -
25241 -       scid = __le16_to_cpu(req->scid);
25242 -       dcid = __le16_to_cpu(req->dcid);
25243 -
25244 -       DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
25245 -
25246 -       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
25247 -               return 0;
25248 -
25249 -       bh_lock_sock(sk);
25250 -
25251 -       rsp.dcid = __cpu_to_le16(l2cap_pi(sk)->scid);
25252 -       rsp.scid = __cpu_to_le16(l2cap_pi(sk)->dcid);
25253 -       l2cap_send_rsp(conn, cmd->ident, L2CAP_DISCONN_RSP, L2CAP_DISCONN_RSP_SIZE, &rsp);
25254 -
25255 -       l2cap_chan_del(sk, ECONNRESET);
25256 -
25257 -       bh_unlock_sock(sk);
25258 -
25259 -       l2cap_sock_kill(sk);
25260 -
25261 -       return 0;
25262 -}
25263 -
25264 -static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, l2cap_cmd_hdr *cmd, __u8 *data)
25265 -{
25266 -       l2cap_disconn_rsp *rsp = (l2cap_disconn_rsp *) data;
25267 -       __u16 dcid, scid;
25268 -       struct sock *sk;
25269 -
25270 -       scid = __le16_to_cpu(rsp->scid);
25271 -       dcid = __le16_to_cpu(rsp->dcid);
25272 -
25273 -       DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
25274 -
25275 -       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
25276 -               return -ENOENT;
25277 -
25278 -       bh_lock_sock(sk);
25279 -       l2cap_sock_clear_timer(sk);
25280 -       l2cap_chan_del(sk, ECONNABORTED);
25281 -       bh_unlock_sock(sk);
25282 -
25283 -       l2cap_sock_kill(sk);
25284 -
25285 -       return 0;
25286 -}
25287 -
25288 -static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
25289 -{
25290 -       __u8 *data = skb->data;
25291 -       int len = skb->len;
25292 -       l2cap_cmd_hdr cmd;
25293 -       int err = 0;
25294 -
25295 -       while (len >= L2CAP_CMD_HDR_SIZE) {
25296 -               memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
25297 -               data += L2CAP_CMD_HDR_SIZE;
25298 -               len  -= L2CAP_CMD_HDR_SIZE;
25299 -
25300 -               cmd.len = __le16_to_cpu(cmd.len);
25301 -
25302 -               DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd.len, cmd.ident);
25303 -
25304 -               if (cmd.len > len || !cmd.ident) {
25305 -                       DBG("corrupted command");
25306 -                       break;
25307 -               }
25308 -
25309 -               switch (cmd.code) {
25310 -               case L2CAP_CONN_REQ:
25311 -                       err = l2cap_connect_req(conn, &cmd, data);
25312 -                       break;
25313 -
25314 -               case L2CAP_CONN_RSP:
25315 -                       err = l2cap_connect_rsp(conn, &cmd, data);
25316 -                       break;
25317 -
25318 -               case L2CAP_CONF_REQ:
25319 -                       err = l2cap_config_req(conn, &cmd, data);
25320 -                       break;
25321 -
25322 -               case L2CAP_CONF_RSP:
25323 -                       err = l2cap_config_rsp(conn, &cmd, data);
25324 -                       break;
25325 -
25326 -               case L2CAP_DISCONN_REQ:
25327 -                       err = l2cap_disconnect_req(conn, &cmd, data);
25328 -                       break;
25329 -
25330 -               case L2CAP_DISCONN_RSP:
25331 -                       err = l2cap_disconnect_rsp(conn, &cmd, data);
25332 -                       break;
25333 -
25334 -               case L2CAP_COMMAND_REJ:
25335 -                       /* FIXME: We should process this */
25336 -                       l2cap_raw_recv(conn, skb);
25337 -                       break;
25338 -
25339 -               case L2CAP_ECHO_REQ:
25340 -                       l2cap_send_rsp(conn, cmd.ident, L2CAP_ECHO_RSP, cmd.len, data);
25341 -                       break;
25342 -
25343 -               case L2CAP_ECHO_RSP:
25344 -               case L2CAP_INFO_REQ:
25345 -               case L2CAP_INFO_RSP:
25346 -                       l2cap_raw_recv(conn, skb);
25347 -                       break;
25348 -
25349 -               default:
25350 -                       ERR("Uknown signaling command 0x%2.2x", cmd.code);
25351 -                       err = -EINVAL;
25352 -                       break;
25353 -               };
25354 -
25355 -               if (err) {
25356 -                       l2cap_cmd_rej rej;
25357 -                       DBG("error %d", err);
25358 -
25359 -                       /* FIXME: Map err to a valid reason. */
25360 -                       rej.reason = __cpu_to_le16(0);
25361 -                       l2cap_send_rsp(conn, cmd.ident, L2CAP_COMMAND_REJ, L2CAP_CMD_REJ_SIZE, &rej);
25362 -               }
25363 -
25364 -               data += cmd.len;
25365 -               len  -= cmd.len;
25366 -       }
25367 -
25368 -       kfree_skb(skb);
25369 -}
25370 -
25371 -static inline int l2cap_data_channel(struct l2cap_conn *conn, __u16 cid, struct sk_buff *skb)
25372 -{
25373 -       struct sock *sk;
25374 -
25375 -       if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, cid))) {
25376 -               DBG("unknown cid 0x%4.4x", cid);
25377 -               goto drop;
25378 -       }
25379 -
25380 -       DBG("sk %p, len %d", sk, skb->len);
25381 -
25382 -       if (sk->state != BT_CONNECTED)
25383 -               goto drop;
25384 -
25385 -       if (l2cap_pi(sk)->imtu < skb->len)
25386 -               goto drop;
25387 -
25388 -       skb_queue_tail(&sk->receive_queue, skb);
25389 -       sk->data_ready(sk, skb->len);
25390 -
25391 -       return 0;
25392 -
25393 -drop:
25394 -       kfree_skb(skb);
25395 -
25396 -       return 0;
25397 -}
25398 -
25399 -static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
25400 -{
25401 -       l2cap_hdr *lh = (l2cap_hdr *) skb->data;
25402 -       __u16 cid, len;
25403 -
25404 -       skb_pull(skb, L2CAP_HDR_SIZE);
25405 -       cid = __le16_to_cpu(lh->cid);
25406 -       len = __le16_to_cpu(lh->len);
25407 -
25408 -       DBG("len %d, cid 0x%4.4x", len, cid);
25409 -
25410 -       if (cid == 0x0001)
25411 -               l2cap_sig_channel(conn, skb);
25412 -       else
25413 -               l2cap_data_channel(conn, cid, skb);
25414 -}
25415 -
25416 -/* ------------ L2CAP interface with lower layer (HCI) ------------- */
25417 -static int l2cap_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
25418 -{
25419 -       struct hci_dev *hdev = (struct hci_dev *) ptr;
25420 -
25421 -       DBG("hdev %s, event %ld", hdev->name, event);
25422 -
25423 -       write_lock(&l2cap_rt_lock);
25424 -
25425 -       switch (event) {
25426 -       case HCI_DEV_UP:
25427 -               l2cap_iff_add(hdev);
25428 -               break;
25429 -
25430 -       case HCI_DEV_DOWN:
25431 -               l2cap_iff_del(hdev);
25432 -               break;
25433 -       };
25434 -
25435 -       write_unlock(&l2cap_rt_lock);
25436 -
25437 -       return NOTIFY_DONE;
25438 -}
25439 -
25440 -int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
25441 -{
25442 -       struct l2cap_iff *iff;
25443 -
25444 -       DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
25445 -
25446 -       if (!(iff = hdev->l2cap_data)) {
25447 -               ERR("unknown interface");
25448 -               return 0;
25449 -       }
25450 -
25451 -       /* Always accept connection */
25452 -       return 1;
25453 -}
25454 -
25455 -int l2cap_connect_cfm(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 status, struct hci_conn *hconn)
25456 -{
25457 -       struct l2cap_conn *conn;
25458 -       struct l2cap_iff *iff;
25459 -       int err = 0;
25460 -
25461 -       DBG("hdev %s bdaddr %s hconn %p", hdev->name, batostr(bdaddr), hconn);
25462 -
25463 -       if (!(iff = hdev->l2cap_data)) {
25464 -               ERR("unknown interface");
25465 -               return 0;
25466 -       }
25467 -
25468 -       l2cap_iff_lock(iff);
25469 -
25470 -       conn = l2cap_get_conn_by_addr(iff, bdaddr);
25471 -
25472 -       if (conn) {
25473 -               /* Outgoing connection */
25474 -               DBG("Outgoing connection: %s -> %s, %p, %2.2x", batostr(iff->bdaddr), batostr(bdaddr), conn, status);
25475 -
25476 -               if (!status && hconn) {
25477 -                       conn->state = BT_CONNECTED;
25478 -                       conn->hconn = hconn;
25479 -
25480 -                       hconn->l2cap_data = (void *)conn;
25481 -
25482 -                       /* Establish channels */
25483 -                       l2cap_conn_ready(conn);
25484 -               } else {
25485 -                       l2cap_conn_del(conn, bterr(status));
25486 -               }
25487 -       } else {
25488 -               /* Incomming connection */
25489 -               DBG("Incomming connection: %s -> %s, %2.2x", batostr(iff->bdaddr), batostr(bdaddr), status);
25490 -
25491 -               if (status || !hconn)
25492 -                       goto done;
25493 -
25494 -               if (!(conn = l2cap_conn_add(iff, bdaddr))) {
25495 -                       err = -ENOMEM;
25496 -                       goto done;
25497 -               }
25498 -
25499 -               conn->hconn = hconn;
25500 -               hconn->l2cap_data = (void *)conn;
25501 -
25502 -               conn->state = BT_CONNECTED;
25503 -       }
25504 -
25505 -done:
25506 -       l2cap_iff_unlock(iff);
25507 -
25508 -       return err;
25509 -}
25510 -
25511 -int l2cap_disconn_ind(struct hci_conn *hconn, __u8 reason)
25512 -{
25513 -       struct l2cap_conn *conn = hconn->l2cap_data;
25514 -
25515 -       DBG("hconn %p reason %d", hconn, reason);
25516 -
25517 -       if (!conn) {
25518 -               ERR("unknown connection");
25519 -               return 0;
25520 -       }
25521 -       conn->hconn = NULL;
25522 -
25523 -       l2cap_iff_lock(conn->iff);
25524 -       l2cap_conn_del(conn, bterr(reason));
25525 -       l2cap_iff_unlock(conn->iff);
25526 -
25527 -       return 0;
25528 -}
25529 -
25530 -int l2cap_recv_acldata(struct hci_conn *hconn, struct sk_buff *skb, __u16 flags)
25531 -{
25532 -       struct l2cap_conn *conn = hconn->l2cap_data;
25533 -
25534 -       if (!conn) {
25535 -               ERR("unknown connection %p", hconn);
25536 -               goto drop;
25537 -       }
25538 -
25539 -       DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
25540 -
25541 -       if (flags & ACL_START) {
25542 -               int flen, tlen, size;
25543 -               l2cap_hdr *lh;
25544 -
25545 -               if (conn->rx_len) {
25546 -                       ERR("Unexpected start frame (len %d)", skb->len);
25547 -                       kfree_skb(conn->rx_skb); conn->rx_skb = NULL;
25548 -                       conn->rx_len = 0;
25549 -               }
25550 -
25551 -               if (skb->len < L2CAP_HDR_SIZE) {
25552 -                       ERR("Frame is too small (len %d)", skb->len);
25553 -                       goto drop;
25554 -               }
25555 -
25556 -               lh = (l2cap_hdr *)skb->data;
25557 -               tlen = __le16_to_cpu(lh->len);
25558 -               flen = skb->len - L2CAP_HDR_SIZE;
25559 -
25560 -               DBG("Start: total len %d, frag len %d", tlen, flen);
25561 -
25562 -               if (flen == tlen) {
25563 -                       /* Complete frame received */
25564 -                       l2cap_recv_frame(conn, skb);
25565 -                       return 0;
25566 -               }
25567 -
25568 -               /* Allocate skb for the complete frame (with header) */
25569 -               size = L2CAP_HDR_SIZE + tlen;
25570 -               if (!(conn->rx_skb = bluez_skb_alloc(size, GFP_ATOMIC)))
25571 -                       goto drop;
25572 -
25573 -               memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
25574 -
25575 -               conn->rx_len = tlen - flen;
25576 -       } else {
25577 -               DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
25578 -
25579 -               if (!conn->rx_len) {
25580 -                       ERR("Unexpected continuation frame (len %d)", skb->len);
25581 -                       goto drop;
25582 -               }
25583 -
25584 -               if (skb->len > conn->rx_len) {
25585 -                       ERR("Fragment is too large (len %d)", skb->len);
25586 -                       kfree_skb(conn->rx_skb); conn->rx_skb = NULL;
25587 -                       goto drop;
25588 -               }
25589 -
25590 -               memcpy(skb_put(conn->rx_skb, skb->len), skb->data, skb->len);
25591 -               conn->rx_len -= skb->len;
25592 -
25593 -               if (!conn->rx_len) {
25594 -                       /* Complete frame received */
25595 -                       l2cap_recv_frame(conn, conn->rx_skb);
25596 -                       conn->rx_skb = NULL;
25597 -               }
25598 -       }
25599 -
25600 -drop:
25601 -       kfree_skb(skb);
25602 -       return 0;
25603 -}
25604 -
25605 -struct proto_ops l2cap_sock_ops = {
25606 -       family:         PF_BLUETOOTH,
25607 -       release:        l2cap_sock_release,
25608 -       bind:           l2cap_sock_bind,
25609 -       connect:        l2cap_sock_connect,
25610 -       listen:         l2cap_sock_listen,
25611 -       accept:         l2cap_sock_accept,
25612 -       getname:        l2cap_sock_getname,
25613 -       sendmsg:        l2cap_sock_sendmsg,
25614 -       recvmsg:        l2cap_sock_recvmsg,
25615 -       poll:           l2cap_sock_poll,
25616 -       socketpair:     sock_no_socketpair,
25617 -       ioctl:          sock_no_ioctl,
25618 -       shutdown:       sock_no_shutdown,
25619 -       setsockopt:     l2cap_sock_setsockopt,
25620 -       getsockopt:     l2cap_sock_getsockopt,
25621 -       mmap:           sock_no_mmap
25622 -};
25623 -
25624 -struct net_proto_family l2cap_sock_family_ops = {
25625 -       family:         PF_BLUETOOTH,
25626 -       create:         l2cap_sock_create
25627 -};
25628 -
25629 -struct hci_proto l2cap_hci_proto = {
25630 -       name:           "L2CAP",
25631 -       id:             HCI_PROTO_L2CAP,
25632 -       connect_ind:    l2cap_connect_ind,
25633 -       connect_cfm:    l2cap_connect_cfm,
25634 -       disconn_ind:    l2cap_disconn_ind,
25635 -       recv_acldata:   l2cap_recv_acldata,
25636 -};
25637 -
25638 -struct notifier_block l2cap_nblock = {
25639 -       notifier_call: l2cap_dev_event
25640 -};
25641 -
25642 -int __init l2cap_init(void)
25643 -{
25644 -       INF("BlueZ L2CAP ver %s Copyright (C) 2000,2001 Qualcomm Inc",
25645 -               VERSION);
25646 -       INF("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
25647 -
25648 -       if (bluez_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops)) {
25649 -               ERR("Can't register L2CAP socket");
25650 -               return -EPROTO;
25651 -       }
25652 -
25653 -       if (hci_register_proto(&l2cap_hci_proto) < 0) {
25654 -               ERR("Can't register L2CAP protocol");
25655 -               return -EPROTO;
25656 -       }
25657 -
25658 -       hci_register_notifier(&l2cap_nblock);
25659 -
25660 -       l2cap_register_proc();
25661 -
25662 -       return 0;
25663 -}
25664 -
25665 -void l2cap_cleanup(void)
25666 -{
25667 -       l2cap_unregister_proc();
25668 -
25669 -       /* Unregister socket, protocol and notifier */
25670 -       if (bluez_sock_unregister(BTPROTO_L2CAP))
25671 -               ERR("Can't unregister L2CAP socket");
25672 -
25673 -       if (hci_unregister_proto(&l2cap_hci_proto) < 0)
25674 -               ERR("Can't unregister L2CAP protocol");
25675 -
25676 -       hci_unregister_notifier(&l2cap_nblock);
25677 -
25678 -       /* We _must_ not have any sockets and/or connections
25679 -        * at this stage.
25680 -        */
25681 -
25682 -       /* Free interface list and unlock HCI devices */
25683 -       {
25684 -               struct list_head *list = &l2cap_iff_list;
25685 -
25686 -               while (!list_empty(list)) {
25687 -                       struct l2cap_iff *iff;
25688 -
25689 -                       iff = list_entry(list->next, struct l2cap_iff, list);
25690 -                       l2cap_iff_del(iff->hdev);
25691 -               }
25692 -       }
25693 -}
25694 -
25695 -module_init(l2cap_init);
25696 -module_exit(l2cap_cleanup);
25697 -
25698 -MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
25699 -MODULE_DESCRIPTION("BlueZ L2CAP ver " VERSION);
25700 -MODULE_LICENSE("GPL");
25701 -
25702 diff -urN linux-2.4.18/net/bluetooth/l2cap_proc.c linux-2.4.18-mh9/net/bluetooth/l2cap_proc.c
25703 --- linux-2.4.18/net/bluetooth/l2cap_proc.c     Fri Sep  7 18:28:38 2001
25704 +++ linux-2.4.18-mh9/net/bluetooth/l2cap_proc.c Thu Jan  1 01:00:00 1970
25705 @@ -1,165 +0,0 @@
25706 -/*
25707 -   BlueZ - Bluetooth protocol stack for Linux
25708 -   Copyright (C) 2000-2001 Qualcomm Incorporated
25709 -
25710 -   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
25711 -
25712 -   This program is free software; you can redistribute it and/or modify
25713 -   it under the terms of the GNU General Public License version 2 as
25714 -   published by the Free Software Foundation;
25715 -
25716 -   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
25717 -   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
25718 -   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
25719 -   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
25720 -   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
25721 -   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
25722 -   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
25723 -   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
25724 -
25725 -   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25726 -   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25727 -   SOFTWARE IS DISCLAIMED.
25728 -*/
25729 -
25730 -/*
25731 - * BlueZ L2CAP proc fs support.
25732 - *
25733 - * $Id: l2cap_proc.c,v 1.2 2001/06/02 01:40:09 maxk Exp $
25734 - */
25735 -
25736 -#include <linux/config.h>
25737 -#include <linux/module.h>
25738 -
25739 -#include <linux/types.h>
25740 -#include <linux/errno.h>
25741 -#include <linux/kernel.h>
25742 -#include <linux/major.h>
25743 -#include <linux/sched.h>
25744 -#include <linux/slab.h>
25745 -#include <linux/poll.h>
25746 -#include <linux/fcntl.h>
25747 -#include <linux/init.h>
25748 -#include <linux/skbuff.h>
25749 -#include <linux/interrupt.h>
25750 -#include <linux/socket.h>
25751 -#include <linux/skbuff.h>
25752 -#include <linux/proc_fs.h>
25753 -#include <linux/list.h>
25754 -#include <net/sock.h>
25755 -
25756 -#include <asm/system.h>
25757 -#include <asm/uaccess.h>
25758 -
25759 -#include <net/bluetooth/bluez.h>
25760 -#include <net/bluetooth/bluetooth.h>
25761 -#include <net/bluetooth/hci_core.h>
25762 -#include <net/bluetooth/l2cap_core.h>
25763 -
25764 -#ifndef L2CAP_DEBUG
25765 -#undef  DBG
25766 -#define DBG( A... )
25767 -#endif
25768 -
25769 -/* ----- PROC fs support ----- */
25770 -static int l2cap_conn_dump(char *buf, struct l2cap_iff *iff)
25771 -{
25772 -       struct list_head *p;
25773 -       char *ptr = buf;
25774 -
25775 -       list_for_each(p, &iff->conn_list) {
25776 -               struct l2cap_conn *c;
25777 -
25778 -               c = list_entry(p, struct l2cap_conn, list);
25779 -               ptr += sprintf(ptr, "    %p %d %p %p %s %s\n",
25780 -                               c, c->state, c->iff, c->hconn, batostr(&c->src), batostr(&c->dst));
25781 -       }
25782 -
25783 -       return ptr - buf;
25784 -}
25785 -
25786 -static int l2cap_iff_dump(char *buf)
25787 -{
25788 -       struct list_head *p;
25789 -       char *ptr = buf;
25790 -
25791 -       ptr += sprintf(ptr, "Interfaces:\n");
25792 -
25793 -       write_lock(&l2cap_rt_lock);
25794 -
25795 -       list_for_each(p, &l2cap_iff_list) {
25796 -               struct l2cap_iff *iff;
25797 -
25798 -               iff = list_entry(p, struct l2cap_iff, list);
25799 -
25800 -               ptr += sprintf(ptr, "  %s %p %p\n", iff->hdev->name, iff, iff->hdev);
25801 -
25802 -               l2cap_iff_lock(iff);
25803 -               ptr += l2cap_conn_dump(ptr, iff);
25804 -               l2cap_iff_unlock(iff);
25805 -       }
25806 -
25807 -       write_unlock(&l2cap_rt_lock);
25808 -
25809 -       ptr += sprintf(ptr, "\n");
25810 -
25811 -       return ptr - buf;
25812 -}
25813 -
25814 -static int l2cap_sock_dump(char *buf, struct bluez_sock_list *list)
25815 -{
25816 -       struct l2cap_pinfo *pi;
25817 -       struct sock *sk;
25818 -       char *ptr = buf;
25819 -
25820 -       ptr += sprintf(ptr, "Sockets:\n");
25821 -
25822 -       write_lock(&list->lock);
25823 -
25824 -       for (sk = list->head; sk; sk = sk->next) {
25825 -               pi = l2cap_pi(sk);
25826 -               ptr += sprintf(ptr, "  %p %d %p %d %s %s 0x%4.4x 0x%4.4x %d %d\n", sk, sk->state, pi->conn, pi->psm,
25827 -                              batostr(&pi->src), batostr(&pi->dst), pi->scid, pi->dcid, pi->imtu, pi->omtu );
25828 -       }
25829 -
25830 -       write_unlock(&list->lock);
25831 -
25832 -       ptr += sprintf(ptr, "\n");
25833 -
25834 -       return ptr - buf;
25835 -}
25836 -
25837 -static int l2cap_read_proc(char *buf, char **start, off_t offset, int count, int *eof, void *priv)
25838 -{
25839 -       char *ptr = buf;
25840 -       int len;
25841 -
25842 -       DBG("count %d, offset %ld", count, offset);
25843 -
25844 -       ptr += l2cap_iff_dump(ptr);
25845 -       ptr += l2cap_sock_dump(ptr, &l2cap_sk_list);
25846 -       len  = ptr - buf;
25847 -
25848 -       if (len <= count + offset)
25849 -               *eof = 1;
25850 -
25851 -       *start = buf + offset;
25852 -       len -= offset;
25853 -
25854 -       if (len > count)
25855 -               len = count;
25856 -       if (len < 0)
25857 -               len = 0;
25858 -
25859 -       return len;
25860 -}
25861 -
25862 -void l2cap_register_proc(void)
25863 -{
25864 -       create_proc_read_entry("bluetooth/l2cap", 0, 0, l2cap_read_proc, NULL);
25865 -}
25866 -
25867 -void l2cap_unregister_proc(void)
25868 -{
25869 -       remove_proc_entry("bluetooth/l2cap", NULL);
25870 -}
25871 diff -urN linux-2.4.18/net/bluetooth/lib.c linux-2.4.18-mh9/net/bluetooth/lib.c
25872 --- linux-2.4.18/net/bluetooth/lib.c    Fri Sep  7 18:28:38 2001
25873 +++ linux-2.4.18-mh9/net/bluetooth/lib.c        Mon Aug 25 18:38:12 2003
25874 @@ -25,7 +25,7 @@
25875  /*
25876   * BlueZ kernel library.
25877   *
25878 - * $Id: lib.c,v 1.3 2001/06/22 23:14:23 maxk Exp $
25879 + * $Id: lib.c,v 1.2 2002/06/20 19:55:08 maxk Exp $
25880   */
25881
25882  #include <linux/kernel.h>
25883 @@ -105,7 +105,7 @@
25884                 return EACCES;
25885
25886         case 0x06:
25887 -               return EINVAL;
25888 +               return EBADE;
25889
25890         case 0x07:
25891                 return ENOMEM;
25892 diff -urN linux-2.4.18/net/bluetooth/rfcomm/Config.in linux-2.4.18-mh9/net/bluetooth/rfcomm/Config.in
25893 --- linux-2.4.18/net/bluetooth/rfcomm/Config.in Thu Jan  1 01:00:00 1970
25894 +++ linux-2.4.18-mh9/net/bluetooth/rfcomm/Config.in     Mon Aug 25 18:38:12 2003
25895 @@ -0,0 +1,10 @@
25896 +#
25897 +# Bluetooth RFCOMM layer configuration
25898 +#
25899 +
25900 +dep_tristate 'RFCOMM protocol support' CONFIG_BLUEZ_RFCOMM $CONFIG_BLUEZ_L2CAP
25901 +
25902 +if [ "$CONFIG_BLUEZ_RFCOMM" != "n" ]; then
25903 +   bool '  RFCOMM TTY support' CONFIG_BLUEZ_RFCOMM_TTY
25904 +fi
25905 +
25906 diff -urN linux-2.4.18/net/bluetooth/rfcomm/Makefile linux-2.4.18-mh9/net/bluetooth/rfcomm/Makefile
25907 --- linux-2.4.18/net/bluetooth/rfcomm/Makefile  Thu Jan  1 01:00:00 1970
25908 +++ linux-2.4.18-mh9/net/bluetooth/rfcomm/Makefile      Mon Aug 25 18:38:12 2003
25909 @@ -0,0 +1,11 @@
25910 +#
25911 +# Makefile for the Linux Bluetooth RFCOMM layer
25912 +#
25913 +
25914 +O_TARGET := rfcomm.o
25915 +
25916 +obj-y                          := core.o sock.o crc.o
25917 +obj-$(CONFIG_BLUEZ_RFCOMM_TTY) += tty.o
25918 +obj-m                          += $(O_TARGET)
25919 +
25920 +include $(TOPDIR)/Rules.make
25921 diff -urN linux-2.4.18/net/bluetooth/rfcomm/core.c linux-2.4.18-mh9/net/bluetooth/rfcomm/core.c
25922 --- linux-2.4.18/net/bluetooth/rfcomm/core.c    Thu Jan  1 01:00:00 1970
25923 +++ linux-2.4.18-mh9/net/bluetooth/rfcomm/core.c        Mon Aug 25 18:38:12 2003
25924 @@ -0,0 +1,1951 @@
25925 +/*
25926 +   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
25927 +   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
25928 +   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
25929 +
25930 +   This program is free software; you can redistribute it and/or modify
25931 +   it under the terms of the GNU General Public License version 2 as
25932 +   published by the Free Software Foundation;
25933 +
25934 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
25935 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
25936 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
25937 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
25938 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
25939 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
25940 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
25941 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
25942 +
25943 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25944 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25945 +   SOFTWARE IS DISCLAIMED.
25946 +*/
25947 +
25948 +/*
25949 +   RPN support    -    Dirk Husemann <hud@zurich.ibm.com>
25950 +*/
25951 +
25952 +/*
25953 + * RFCOMM core.
25954 + *
25955 + * $Id: core.c,v 1.46 2002/10/18 20:12:12 maxk Exp $
25956 + */
25957 +
25958 +#define __KERNEL_SYSCALLS__
25959 +
25960 +#include <linux/config.h>
25961 +#include <linux/module.h>
25962 +#include <linux/errno.h>
25963 +#include <linux/kernel.h>
25964 +#include <linux/sched.h>
25965 +#include <linux/signal.h>
25966 +#include <linux/init.h>
25967 +#include <linux/wait.h>
25968 +#include <linux/net.h>
25969 +#include <linux/proc_fs.h>
25970 +#include <net/sock.h>
25971 +#include <asm/uaccess.h>
25972 +#include <asm/unaligned.h>
25973 +
25974 +#include <net/bluetooth/bluetooth.h>
25975 +#include <net/bluetooth/l2cap.h>
25976 +#include <net/bluetooth/rfcomm.h>
25977 +
25978 +#define VERSION "1.0"
25979 +
25980 +#ifndef CONFIG_BLUEZ_RFCOMM_DEBUG
25981 +#undef  BT_DBG
25982 +#define BT_DBG(D...)
25983 +#endif
25984 +
25985 +struct task_struct *rfcomm_thread;
25986 +DECLARE_MUTEX(rfcomm_sem);
25987 +unsigned long rfcomm_event;
25988 +
25989 +static LIST_HEAD(session_list);
25990 +static atomic_t terminate, running;
25991 +
25992 +static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
25993 +static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
25994 +static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
25995 +static int rfcomm_queue_disc(struct rfcomm_dlc *d);
25996 +static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
25997 +static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
25998 +static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
25999 +static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
26000 +static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
26001 +static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
26002 +
26003 +static void rfcomm_process_connect(struct rfcomm_session *s);
26004 +
26005 +/* ---- RFCOMM frame parsing macros ---- */
26006 +#define __get_dlci(b)     ((b & 0xfc) >> 2)
26007 +#define __get_channel(b)  ((b & 0xf8) >> 3)
26008 +#define __get_dir(b)      ((b & 0x04) >> 2)
26009 +#define __get_type(b)     ((b & 0xef))
26010 +
26011 +#define __test_ea(b)      ((b & 0x01))
26012 +#define __test_cr(b)      ((b & 0x02))
26013 +#define __test_pf(b)      ((b & 0x10))
26014 +
26015 +#define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
26016 +#define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
26017 +#define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
26018 +#define __srv_channel(dlci)    (dlci >> 1)
26019 +#define __dir(dlci)            (dlci & 0x01)
26020 +
26021 +#define __len8(len)       (((len) << 1) | 1)
26022 +#define __len16(len)      ((len) << 1)
26023 +
26024 +/* MCC macros */
26025 +#define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
26026 +#define __get_mcc_type(b) ((b & 0xfc) >> 2)
26027 +#define __get_mcc_len(b)  ((b & 0xfe) >> 1)
26028 +
26029 +/* RPN macros */
26030 +#define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x3) << 3))
26031 +#define __get_rpn_data_bits(line) ((line) & 0x3)
26032 +#define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
26033 +#define __get_rpn_parity(line)    (((line) >> 3) & 0x3)
26034 +
26035 +/* ---- RFCOMM FCS computation ---- */
26036 +
26037 +/* CRC on 2 bytes */
26038 +#define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
26039 +
26040 +/* FCS on 2 bytes */
26041 +static inline u8 __fcs(u8 *data)
26042 +{
26043 +       return (0xff - __crc(data));
26044 +}
26045 +
26046 +/* FCS on 3 bytes */
26047 +static inline u8 __fcs2(u8 *data)
26048 +{
26049 +       return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
26050 +}
26051 +
26052 +/* Check FCS */
26053 +static inline int __check_fcs(u8 *data, int type, u8 fcs)
26054 +{
26055 +       u8 f = __crc(data);
26056 +
26057 +       if (type != RFCOMM_UIH)
26058 +               f = rfcomm_crc_table[f ^ data[2]];
26059 +
26060 +       return rfcomm_crc_table[f ^ fcs] != 0xcf;
26061 +}
26062 +
26063 +/* ---- L2CAP callbacks ---- */
26064 +static void rfcomm_l2state_change(struct sock *sk)
26065 +{
26066 +       BT_DBG("%p state %d", sk, sk->state);
26067 +       rfcomm_schedule(RFCOMM_SCHED_STATE);
26068 +}
26069 +
26070 +static void rfcomm_l2data_ready(struct sock *sk, int bytes)
26071 +{
26072 +       BT_DBG("%p bytes %d", sk, bytes);
26073 +       rfcomm_schedule(RFCOMM_SCHED_RX);
26074 +}
26075 +
26076 +static int rfcomm_l2sock_create(struct socket **sock)
26077 +{
26078 +       int err;
26079 +
26080 +       BT_DBG("");
26081 +
26082 +       err = sock_create(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
26083 +       if (!err) {
26084 +               struct sock *sk = (*sock)->sk;
26085 +               sk->data_ready   = rfcomm_l2data_ready;
26086 +               sk->state_change = rfcomm_l2state_change;
26087 +       }
26088 +       return err;
26089 +}
26090 +
26091 +/* ---- RFCOMM DLCs ---- */
26092 +static void rfcomm_dlc_timeout(unsigned long arg)
26093 +{
26094 +       struct rfcomm_dlc *d = (void *) arg;
26095 +
26096 +       BT_DBG("dlc %p state %ld", d, d->state);
26097 +
26098 +       set_bit(RFCOMM_TIMED_OUT, &d->flags);
26099 +       rfcomm_dlc_put(d);
26100 +       rfcomm_schedule(RFCOMM_SCHED_TIMEO);
26101 +}
26102 +
26103 +static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
26104 +{
26105 +       BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
26106 +
26107 +       if (!mod_timer(&d->timer, jiffies + timeout))
26108 +               rfcomm_dlc_hold(d);
26109 +}
26110 +
26111 +static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
26112 +{
26113 +       BT_DBG("dlc %p state %ld", d, d->state);
26114 +
26115 +       if (timer_pending(&d->timer) && del_timer(&d->timer))
26116 +               rfcomm_dlc_put(d);
26117 +}
26118 +
26119 +static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
26120 +{
26121 +       BT_DBG("%p", d);
26122 +
26123 +       d->state      = BT_OPEN;
26124 +       d->flags      = 0;
26125 +       d->mscex      = 0;
26126 +       d->mtu        = RFCOMM_DEFAULT_MTU;
26127 +       d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
26128 +
26129 +       d->credits    = 0;
26130 +       d->rx_credits = RFCOMM_DEFAULT_CREDITS;
26131 +}
26132 +
26133 +struct rfcomm_dlc *rfcomm_dlc_alloc(int prio)
26134 +{
26135 +       struct rfcomm_dlc *d = kmalloc(sizeof(*d), prio);
26136 +       if (!d)
26137 +               return NULL;
26138 +       memset(d, 0, sizeof(*d));
26139 +
26140 +       init_timer(&d->timer);
26141 +       d->timer.function = rfcomm_dlc_timeout;
26142 +       d->timer.data = (unsigned long) d;
26143 +
26144 +       skb_queue_head_init(&d->tx_queue);
26145 +       spin_lock_init(&d->lock);
26146 +       atomic_set(&d->refcnt, 1);
26147 +
26148 +       rfcomm_dlc_clear_state(d);
26149 +
26150 +       BT_DBG("%p", d);
26151 +       return d;
26152 +}
26153 +
26154 +void rfcomm_dlc_free(struct rfcomm_dlc *d)
26155 +{
26156 +       BT_DBG("%p", d);
26157 +
26158 +       skb_queue_purge(&d->tx_queue);
26159 +       kfree(d);
26160 +}
26161 +
26162 +static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
26163 +{
26164 +       BT_DBG("dlc %p session %p", d, s);
26165 +
26166 +       rfcomm_session_hold(s);
26167 +
26168 +       rfcomm_dlc_hold(d);
26169 +       list_add(&d->list, &s->dlcs);
26170 +       d->session = s;
26171 +}
26172 +
26173 +static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
26174 +{
26175 +       struct rfcomm_session *s = d->session;
26176 +
26177 +       BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
26178 +
26179 +       list_del(&d->list);
26180 +       d->session = NULL;
26181 +       rfcomm_dlc_put(d);
26182 +
26183 +       rfcomm_session_put(s);
26184 +}
26185 +
26186 +static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
26187 +{
26188 +       struct rfcomm_dlc *d;
26189 +       struct list_head *p;
26190 +
26191 +       list_for_each(p, &s->dlcs) {
26192 +               d = list_entry(p, struct rfcomm_dlc, list);
26193 +               if (d->dlci == dlci)
26194 +                       return d;
26195 +       }
26196 +       return NULL;
26197 +}
26198 +
26199 +static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
26200 +{
26201 +       struct rfcomm_session *s;
26202 +       int err = 0;
26203 +       u8 dlci;
26204 +
26205 +       BT_DBG("dlc %p state %ld %s %s channel %d",
26206 +                       d, d->state, batostr(src), batostr(dst), channel);
26207 +
26208 +       if (channel < 1 || channel > 30)
26209 +               return -EINVAL;
26210 +
26211 +       if (d->state != BT_OPEN && d->state != BT_CLOSED)
26212 +               return 0;
26213 +
26214 +       s = rfcomm_session_get(src, dst);
26215 +       if (!s) {
26216 +               s = rfcomm_session_create(src, dst, &err);
26217 +               if (!s)
26218 +                       return err;
26219 +       }
26220 +
26221 +       dlci = __dlci(!s->initiator, channel);
26222 +
26223 +       /* Check if DLCI already exists */
26224 +       if (rfcomm_dlc_get(s, dlci))
26225 +               return -EBUSY;
26226 +
26227 +       rfcomm_dlc_clear_state(d);
26228 +
26229 +       d->dlci     = dlci;
26230 +       d->addr     = __addr(s->initiator, dlci);
26231 +       d->priority = 7;
26232 +
26233 +       d->state    = BT_CONFIG;
26234 +       rfcomm_dlc_link(s, d);
26235 +
26236 +       d->mtu     = s->mtu;
26237 +       d->credits = s->credits;
26238 +
26239 +       if (s->state == BT_CONNECTED)
26240 +               rfcomm_send_pn(s, 1, d);
26241 +       rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
26242 +       return 0;
26243 +}
26244 +
26245 +int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
26246 +{
26247 +       mm_segment_t fs;
26248 +       int r;
26249 +
26250 +       rfcomm_lock();
26251 +
26252 +       fs = get_fs(); set_fs(KERNEL_DS);
26253 +       r = __rfcomm_dlc_open(d, src, dst, channel);
26254 +       set_fs(fs);
26255 +
26256 +       rfcomm_unlock();
26257 +       return r;
26258 +}
26259 +
26260 +static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
26261 +{
26262 +       struct rfcomm_session *s = d->session;
26263 +       if (!s)
26264 +               return 0;
26265 +
26266 +       BT_DBG("dlc %p state %ld dlci %d err %d session %p",
26267 +                       d, d->state, d->dlci, err, s);
26268 +
26269 +       switch (d->state) {
26270 +       case BT_CONNECTED:
26271 +       case BT_CONFIG:
26272 +       case BT_CONNECT:
26273 +               d->state = BT_DISCONN;
26274 +               if (skb_queue_empty(&d->tx_queue)) {
26275 +                       rfcomm_send_disc(s, d->dlci);
26276 +                       rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
26277 +               } else {
26278 +                       rfcomm_queue_disc(d);
26279 +                       rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
26280 +               }
26281 +               break;
26282 +
26283 +       default:
26284 +               rfcomm_dlc_clear_timer(d);
26285 +
26286 +               rfcomm_dlc_lock(d);
26287 +               d->state = BT_CLOSED;
26288 +               d->state_change(d, err);
26289 +               rfcomm_dlc_unlock(d);
26290 +
26291 +               skb_queue_purge(&d->tx_queue);
26292 +               rfcomm_dlc_unlink(d);
26293 +       }
26294 +
26295 +       return 0;
26296 +}
26297 +
26298 +int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
26299 +{
26300 +       mm_segment_t fs;
26301 +       int r;
26302 +
26303 +       rfcomm_lock();
26304 +
26305 +       fs = get_fs(); set_fs(KERNEL_DS);
26306 +       r = __rfcomm_dlc_close(d, err);
26307 +       set_fs(fs);
26308 +
26309 +       rfcomm_unlock();
26310 +       return r;
26311 +}
26312 +
26313 +int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
26314 +{
26315 +       int len = skb->len;
26316 +
26317 +       if (d->state != BT_CONNECTED)
26318 +               return -ENOTCONN;
26319 +
26320 +       BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
26321 +
26322 +       if (len > d->mtu)
26323 +               return -EINVAL;
26324 +
26325 +       rfcomm_make_uih(skb, d->addr);
26326 +       skb_queue_tail(&d->tx_queue, skb);
26327 +
26328 +       if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
26329 +               rfcomm_schedule(RFCOMM_SCHED_TX);
26330 +       return len;
26331 +}
26332 +
26333 +void __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
26334 +{
26335 +       BT_DBG("dlc %p state %ld", d, d->state);
26336 +
26337 +       if (!d->credits) {
26338 +               d->v24_sig |= RFCOMM_V24_FC;
26339 +               set_bit(RFCOMM_MSC_PENDING, &d->flags);
26340 +       }
26341 +       rfcomm_schedule(RFCOMM_SCHED_TX);
26342 +}
26343 +
26344 +void __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
26345 +{
26346 +       BT_DBG("dlc %p state %ld", d, d->state);
26347 +
26348 +       if (!d->credits) {
26349 +               d->v24_sig &= ~RFCOMM_V24_FC;
26350 +               set_bit(RFCOMM_MSC_PENDING, &d->flags);
26351 +       }
26352 +       rfcomm_schedule(RFCOMM_SCHED_TX);
26353 +}
26354 +
26355 +/*
26356 +   Set/get modem status functions use _local_ status i.e. what we report
26357 +   to the other side.
26358 +   Remote status is provided by dlc->modem_status() callback.
26359 + */
26360 +int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
26361 +{
26362 +       BT_DBG("dlc %p state %ld v24_sig 0x%x",
26363 +                       d, d->state, v24_sig);
26364 +
26365 +       if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
26366 +               v24_sig |= RFCOMM_V24_FC;
26367 +       else
26368 +               v24_sig &= ~RFCOMM_V24_FC;
26369 +
26370 +       d->v24_sig = v24_sig;
26371 +
26372 +       if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
26373 +               rfcomm_schedule(RFCOMM_SCHED_TX);
26374 +
26375 +       return 0;
26376 +}
26377 +
26378 +int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
26379 +{
26380 +       BT_DBG("dlc %p state %ld v24_sig 0x%x",
26381 +                       d, d->state, d->v24_sig);
26382 +
26383 +       *v24_sig = d->v24_sig;
26384 +       return 0;
26385 +}
26386 +
26387 +/* ---- RFCOMM sessions ---- */
26388 +struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
26389 +{
26390 +       struct rfcomm_session *s = kmalloc(sizeof(*s), GFP_KERNEL);
26391 +       if (!s)
26392 +               return NULL;
26393 +       memset(s, 0, sizeof(*s));
26394 +
26395 +       BT_DBG("session %p sock %p", s, sock);
26396 +
26397 +       INIT_LIST_HEAD(&s->dlcs);
26398 +       s->state = state;
26399 +       s->sock  = sock;
26400 +
26401 +       s->mtu     = RFCOMM_DEFAULT_MTU;
26402 +       s->credits = 0;
26403 +
26404 +       list_add(&s->list, &session_list);
26405 +
26406 +       /* Do not increment module usage count for listeting sessions.
26407 +        * Otherwise we won't be able to unload the module. */
26408 +       if (state != BT_LISTEN)
26409 +               MOD_INC_USE_COUNT;
26410 +       return s;
26411 +}
26412 +
26413 +void rfcomm_session_del(struct rfcomm_session *s)
26414 +{
26415 +       int state = s->state;
26416 +
26417 +       BT_DBG("session %p state %ld", s, s->state);
26418 +
26419 +       list_del(&s->list);
26420 +
26421 +       if (state == BT_CONNECTED)
26422 +               rfcomm_send_disc(s, 0);
26423 +
26424 +       sock_release(s->sock);
26425 +       kfree(s);
26426 +
26427 +       if (state != BT_LISTEN)
26428 +               MOD_DEC_USE_COUNT;
26429 +}
26430 +
26431 +struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
26432 +{
26433 +       struct rfcomm_session *s;
26434 +       struct list_head *p, *n;
26435 +       struct bluez_pinfo *pi;
26436 +       list_for_each_safe(p, n, &session_list) {
26437 +               s = list_entry(p, struct rfcomm_session, list);
26438 +               pi = bluez_pi(s->sock->sk);
26439 +
26440 +               if ((!bacmp(src, BDADDR_ANY) || !bacmp(&pi->src, src)) &&
26441 +                               !bacmp(&pi->dst, dst))
26442 +                       return s;
26443 +       }
26444 +       return NULL;
26445 +}
26446 +
26447 +void rfcomm_session_close(struct rfcomm_session *s, int err)
26448 +{
26449 +       struct rfcomm_dlc *d;
26450 +       struct list_head *p, *n;
26451 +
26452 +       BT_DBG("session %p state %ld err %d", s, s->state, err);
26453 +
26454 +       rfcomm_session_hold(s);
26455 +
26456 +       s->state = BT_CLOSED;
26457 +
26458 +       /* Close all dlcs */
26459 +       list_for_each_safe(p, n, &s->dlcs) {
26460 +               d = list_entry(p, struct rfcomm_dlc, list);
26461 +               d->state = BT_CLOSED;
26462 +               __rfcomm_dlc_close(d, err);
26463 +       }
26464 +
26465 +       rfcomm_session_put(s);
26466 +}
26467 +
26468 +struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
26469 +{
26470 +       struct rfcomm_session *s = NULL;
26471 +       struct sockaddr_l2 addr;
26472 +       struct l2cap_options opts;
26473 +       struct socket *sock;
26474 +       int    size;
26475 +
26476 +       BT_DBG("%s %s", batostr(src), batostr(dst));
26477 +
26478 +       *err = rfcomm_l2sock_create(&sock);
26479 +       if (*err < 0)
26480 +               return NULL;
26481 +
26482 +       bacpy(&addr.l2_bdaddr, src);
26483 +       addr.l2_family = AF_BLUETOOTH;
26484 +       addr.l2_psm    = 0;
26485 +       *err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
26486 +       if (*err < 0)
26487 +               goto failed;
26488 +
26489 +       /* Set L2CAP options */
26490 +       size = sizeof(opts);
26491 +       sock->ops->getsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, &size);
26492 +
26493 +       opts.imtu = RFCOMM_MAX_L2CAP_MTU;
26494 +       sock->ops->setsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, size);
26495 +
26496 +       s = rfcomm_session_add(sock, BT_BOUND);
26497 +       if (!s) {
26498 +               *err = -ENOMEM;
26499 +               goto failed;
26500 +       }
26501 +
26502 +       s->initiator = 1;
26503 +
26504 +       bacpy(&addr.l2_bdaddr, dst);
26505 +       addr.l2_family = AF_BLUETOOTH;
26506 +       addr.l2_psm    = htobs(RFCOMM_PSM);
26507 +       *err = sock->ops->connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
26508 +       if (*err == 0 || *err == -EAGAIN)
26509 +               return s;
26510 +
26511 +       rfcomm_session_del(s);
26512 +       return NULL;
26513 +
26514 +failed:
26515 +       sock_release(sock);
26516 +       return NULL;
26517 +}
26518 +
26519 +void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
26520 +{
26521 +       struct sock *sk = s->sock->sk;
26522 +       if (src)
26523 +               bacpy(src, &bluez_pi(sk)->src);
26524 +       if (dst)
26525 +               bacpy(dst, &bluez_pi(sk)->dst);
26526 +}
26527 +
26528 +/* ---- RFCOMM frame sending ---- */
26529 +static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
26530 +{
26531 +       struct socket *sock = s->sock;
26532 +       struct iovec iv = { data, len };
26533 +       struct msghdr msg;
26534 +       int err;
26535 +
26536 +       BT_DBG("session %p len %d", s, len);
26537 +
26538 +       memset(&msg, 0, sizeof(msg));
26539 +       msg.msg_iovlen = 1;
26540 +       msg.msg_iov = &iv;
26541 +
26542 +       err = sock->ops->sendmsg(sock, &msg, len, 0);
26543 +       return err;
26544 +}
26545 +
26546 +static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
26547 +{
26548 +       struct rfcomm_cmd cmd;
26549 +
26550 +       BT_DBG("%p dlci %d", s, dlci);
26551 +
26552 +       cmd.addr = __addr(s->initiator, dlci);
26553 +       cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
26554 +       cmd.len  = __len8(0);
26555 +       cmd.fcs  = __fcs2((u8 *) &cmd);
26556 +
26557 +       return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
26558 +}
26559 +
26560 +static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
26561 +{
26562 +       struct rfcomm_cmd cmd;
26563 +
26564 +       BT_DBG("%p dlci %d", s, dlci);
26565 +
26566 +       cmd.addr = __addr(!s->initiator, dlci);
26567 +       cmd.ctrl = __ctrl(RFCOMM_UA, 1);
26568 +       cmd.len  = __len8(0);
26569 +       cmd.fcs  = __fcs2((u8 *) &cmd);
26570 +
26571 +       return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
26572 +}
26573 +
26574 +static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
26575 +{
26576 +       struct rfcomm_cmd cmd;
26577 +
26578 +       BT_DBG("%p dlci %d", s, dlci);
26579 +
26580 +       cmd.addr = __addr(s->initiator, dlci);
26581 +       cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
26582 +       cmd.len  = __len8(0);
26583 +       cmd.fcs  = __fcs2((u8 *) &cmd);
26584 +
26585 +       return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
26586 +}
26587 +
26588 +static int rfcomm_queue_disc(struct rfcomm_dlc *d)
26589 +{
26590 +       struct rfcomm_cmd *cmd;
26591 +       struct sk_buff *skb;
26592 +
26593 +       BT_DBG("dlc %p dlci %d", d, d->dlci);
26594 +
26595 +       skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
26596 +       if (!skb)
26597 +               return -ENOMEM;
26598 +
26599 +       cmd = (void *) __skb_put(skb, sizeof(*cmd));
26600 +       cmd->addr = d->addr;
26601 +       cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
26602 +       cmd->len  = __len8(0);
26603 +       cmd->fcs  = __fcs2((u8 *) cmd);
26604 +
26605 +       skb_queue_tail(&d->tx_queue, skb);
26606 +       rfcomm_schedule(RFCOMM_SCHED_TX);
26607 +       return 0;
26608 +}
26609 +
26610 +static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
26611 +{
26612 +       struct rfcomm_cmd cmd;
26613 +
26614 +       BT_DBG("%p dlci %d", s, dlci);
26615 +
26616 +       cmd.addr = __addr(!s->initiator, dlci);
26617 +       cmd.ctrl = __ctrl(RFCOMM_DM, 1);
26618 +       cmd.len  = __len8(0);
26619 +       cmd.fcs  = __fcs2((u8 *) &cmd);
26620 +
26621 +       return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
26622 +}
26623 +
26624 +static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
26625 +{
26626 +       struct rfcomm_hdr *hdr;
26627 +       struct rfcomm_mcc *mcc;
26628 +       u8 buf[16], *ptr = buf;
26629 +
26630 +       BT_DBG("%p cr %d type %d", s, cr, type);
26631 +
26632 +       hdr = (void *) ptr; ptr += sizeof(*hdr);
26633 +       hdr->addr = __addr(s->initiator, 0);
26634 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
26635 +       hdr->len  = __len8(sizeof(*mcc) + 1);
26636 +
26637 +       mcc = (void *) ptr; ptr += sizeof(*mcc);
26638 +       mcc->type = __mcc_type(cr, RFCOMM_NSC);
26639 +       mcc->len  = __len8(1);
26640 +
26641 +       /* Type that we didn't like */
26642 +       *ptr = __mcc_type(cr, type); ptr++;
26643 +
26644 +       *ptr = __fcs(buf); ptr++;
26645 +
26646 +       return rfcomm_send_frame(s, buf, ptr - buf);
26647 +}
26648 +
26649 +static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
26650 +{
26651 +       struct rfcomm_hdr *hdr;
26652 +       struct rfcomm_mcc *mcc;
26653 +       struct rfcomm_pn  *pn;
26654 +       u8 buf[16], *ptr = buf;
26655 +
26656 +       BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
26657 +
26658 +       hdr = (void *) ptr; ptr += sizeof(*hdr);
26659 +       hdr->addr = __addr(s->initiator, 0);
26660 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
26661 +       hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
26662 +
26663 +       mcc = (void *) ptr; ptr += sizeof(*mcc);
26664 +       mcc->type = __mcc_type(cr, RFCOMM_PN);
26665 +       mcc->len  = __len8(sizeof(*pn));
26666 +
26667 +       pn = (void *) ptr; ptr += sizeof(*pn);
26668 +       pn->dlci        = d->dlci;
26669 +       pn->priority    = d->priority;
26670 +       pn->ack_timer   = 0;
26671 +       pn->max_retrans = 0;
26672 +
26673 +       if (cr || d->credits) {
26674 +               pn->flow_ctrl = cr ? 0xf0 : 0xe0;
26675 +               pn->credits = RFCOMM_DEFAULT_CREDITS;
26676 +       } else {
26677 +               pn->flow_ctrl = 0;
26678 +               pn->credits   = 0;
26679 +       }
26680 +
26681 +       pn->mtu = htobs(d->mtu);
26682 +
26683 +       *ptr = __fcs(buf); ptr++;
26684 +
26685 +       return rfcomm_send_frame(s, buf, ptr - buf);
26686 +}
26687 +
26688 +static int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
26689 +                          u8 bit_rate, u8 data_bits, u8 stop_bits,
26690 +                          u8 parity, u8 flow_ctrl_settings,
26691 +                          u8 xon_char, u8 xoff_char, u16 param_mask)
26692 +{
26693 +       struct rfcomm_hdr *hdr;
26694 +       struct rfcomm_mcc *mcc;
26695 +       struct rfcomm_rpn *rpn;
26696 +       u8 buf[16], *ptr = buf;
26697 +
26698 +       BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
26699 +              "flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
26700 +                       s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
26701 +                       flow_ctrl_settings, xon_char, xoff_char, param_mask);
26702 +
26703 +       hdr = (void *) ptr; ptr += sizeof(*hdr);
26704 +       hdr->addr = __addr(s->initiator, 0);
26705 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
26706 +       hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
26707 +
26708 +       mcc = (void *) ptr; ptr += sizeof(*mcc);
26709 +       mcc->type = __mcc_type(cr, RFCOMM_RPN);
26710 +       mcc->len  = __len8(sizeof(*rpn));
26711 +
26712 +       rpn = (void *) ptr; ptr += sizeof(*rpn);
26713 +       rpn->dlci          = __addr(1, dlci);
26714 +       rpn->bit_rate      = bit_rate;
26715 +       rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
26716 +       rpn->flow_ctrl     = flow_ctrl_settings;
26717 +       rpn->xon_char      = xon_char;
26718 +       rpn->xoff_char     = xoff_char;
26719 +       rpn->param_mask    = param_mask;
26720 +
26721 +       *ptr = __fcs(buf); ptr++;
26722 +
26723 +       return rfcomm_send_frame(s, buf, ptr - buf);
26724 +}
26725 +
26726 +static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
26727 +{
26728 +       struct rfcomm_hdr *hdr;
26729 +       struct rfcomm_mcc *mcc;
26730 +       struct rfcomm_rls *rls;
26731 +       u8 buf[16], *ptr = buf;
26732 +
26733 +       BT_DBG("%p cr %d status 0x%x", s, cr, status);
26734 +
26735 +       hdr = (void *) ptr; ptr += sizeof(*hdr);
26736 +       hdr->addr = __addr(s->initiator, 0);
26737 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
26738 +       hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
26739 +
26740 +       mcc = (void *) ptr; ptr += sizeof(*mcc);
26741 +       mcc->type = __mcc_type(cr, RFCOMM_RLS);
26742 +       mcc->len  = __len8(sizeof(*rls));
26743 +
26744 +       rls = (void *) ptr; ptr += sizeof(*rls);
26745 +       rls->dlci   = __addr(1, dlci);
26746 +       rls->status = status;
26747 +
26748 +       *ptr = __fcs(buf); ptr++;
26749 +
26750 +       return rfcomm_send_frame(s, buf, ptr - buf);
26751 +}
26752 +
26753 +static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
26754 +{
26755 +       struct rfcomm_hdr *hdr;
26756 +       struct rfcomm_mcc *mcc;
26757 +       struct rfcomm_msc *msc;
26758 +       u8 buf[16], *ptr = buf;
26759 +
26760 +       BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
26761 +
26762 +       hdr = (void *) ptr; ptr += sizeof(*hdr);
26763 +       hdr->addr = __addr(s->initiator, 0);
26764 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
26765 +       hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
26766 +
26767 +       mcc = (void *) ptr; ptr += sizeof(*mcc);
26768 +       mcc->type = __mcc_type(cr, RFCOMM_MSC);
26769 +       mcc->len  = __len8(sizeof(*msc));
26770 +
26771 +       msc = (void *) ptr; ptr += sizeof(*msc);
26772 +       msc->dlci    = __addr(1, dlci);
26773 +       msc->v24_sig = v24_sig | 0x01;
26774 +
26775 +       *ptr = __fcs(buf); ptr++;
26776 +
26777 +       return rfcomm_send_frame(s, buf, ptr - buf);
26778 +}
26779 +
26780 +static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
26781 +{
26782 +       struct rfcomm_hdr *hdr;
26783 +       struct rfcomm_mcc *mcc;
26784 +       u8 buf[16], *ptr = buf;
26785 +
26786 +       BT_DBG("%p cr %d", s, cr);
26787 +
26788 +       hdr = (void *) ptr; ptr += sizeof(*hdr);
26789 +       hdr->addr = __addr(s->initiator, 0);
26790 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
26791 +       hdr->len  = __len8(sizeof(*mcc));
26792 +
26793 +       mcc = (void *) ptr; ptr += sizeof(*mcc);
26794 +       mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
26795 +       mcc->len  = __len8(0);
26796 +
26797 +       *ptr = __fcs(buf); ptr++;
26798 +
26799 +       return rfcomm_send_frame(s, buf, ptr - buf);
26800 +}
26801 +
26802 +static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
26803 +{
26804 +       struct rfcomm_hdr *hdr;
26805 +       struct rfcomm_mcc *mcc;
26806 +       u8 buf[16], *ptr = buf;
26807 +
26808 +       BT_DBG("%p cr %d", s, cr);
26809 +
26810 +       hdr = (void *) ptr; ptr += sizeof(*hdr);
26811 +       hdr->addr = __addr(s->initiator, 0);
26812 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
26813 +       hdr->len  = __len8(sizeof(*mcc));
26814 +
26815 +       mcc = (void *) ptr; ptr += sizeof(*mcc);
26816 +       mcc->type = __mcc_type(cr, RFCOMM_FCON);
26817 +       mcc->len  = __len8(0);
26818 +
26819 +       *ptr = __fcs(buf); ptr++;
26820 +
26821 +       return rfcomm_send_frame(s, buf, ptr - buf);
26822 +}
26823 +
26824 +static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
26825 +{
26826 +       struct socket *sock = s->sock;
26827 +       struct iovec iv[3];
26828 +       struct msghdr msg;
26829 +       unsigned char hdr[5], crc[1];
26830 +
26831 +       if (len > 125)
26832 +               return -EINVAL;
26833 +
26834 +       BT_DBG("%p cr %d", s, cr);
26835 +
26836 +       hdr[0] = __addr(s->initiator, 0);
26837 +       hdr[1] = __ctrl(RFCOMM_UIH, 0);
26838 +       hdr[2] = 0x01 | ((len + 2) << 1);
26839 +       hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
26840 +       hdr[4] = 0x01 | (len << 1);
26841 +
26842 +       crc[0] = __fcs(hdr);
26843 +
26844 +       iv[0].iov_base = hdr;
26845 +       iv[0].iov_len  = 5;
26846 +       iv[1].iov_base = pattern;
26847 +       iv[1].iov_len  = len;
26848 +       iv[2].iov_base = crc;
26849 +       iv[2].iov_len  = 1;
26850 +
26851 +       memset(&msg, 0, sizeof(msg));
26852 +       msg.msg_iovlen = 3;
26853 +       msg.msg_iov = iv;
26854 +       return sock->ops->sendmsg(sock, &msg, 6 + len, 0);
26855 +}
26856 +
26857 +static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
26858 +{
26859 +       struct rfcomm_hdr *hdr;
26860 +       u8 buf[16], *ptr = buf;
26861 +
26862 +       BT_DBG("%p addr %d credits %d", s, addr, credits);
26863 +
26864 +       hdr = (void *) ptr; ptr += sizeof(*hdr);
26865 +       hdr->addr = addr;
26866 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
26867 +       hdr->len  = __len8(0);
26868 +
26869 +       *ptr = credits; ptr++;
26870 +
26871 +       *ptr = __fcs(buf); ptr++;
26872 +
26873 +       return rfcomm_send_frame(s, buf, ptr - buf);
26874 +}
26875 +
26876 +static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
26877 +{
26878 +       struct rfcomm_hdr *hdr;
26879 +       int len = skb->len;
26880 +       u8 *crc;
26881 +
26882 +       if (len > 127) {
26883 +               hdr = (void *) skb_push(skb, 4);
26884 +               put_unaligned(htobs(__len16(len)), (u16 *) &hdr->len);
26885 +       } else {
26886 +               hdr = (void *) skb_push(skb, 3);
26887 +               hdr->len = __len8(len);
26888 +       }
26889 +       hdr->addr = addr;
26890 +       hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
26891 +
26892 +       crc = skb_put(skb, 1);
26893 +       *crc = __fcs((void *) hdr);
26894 +}
26895 +
26896 +/* ---- RFCOMM frame reception ---- */
26897 +static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
26898 +{
26899 +       BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
26900 +
26901 +       if (dlci) {
26902 +               /* Data channel */
26903 +               struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
26904 +               if (!d) {
26905 +                       rfcomm_send_dm(s, dlci);
26906 +                       return 0;
26907 +               }
26908 +
26909 +               switch (d->state) {
26910 +               case BT_CONNECT:
26911 +                       rfcomm_dlc_clear_timer(d);
26912 +
26913 +                       rfcomm_dlc_lock(d);
26914 +                       d->state = BT_CONNECTED;
26915 +                       d->state_change(d, 0);
26916 +                       rfcomm_dlc_unlock(d);
26917 +
26918 +                       rfcomm_send_msc(s, 1, dlci, d->v24_sig);
26919 +                       break;
26920 +
26921 +               case BT_DISCONN:
26922 +                       d->state = BT_CLOSED;
26923 +                       __rfcomm_dlc_close(d, 0);
26924 +                       break;
26925 +               }
26926 +       } else {
26927 +               /* Control channel */
26928 +               switch (s->state) {
26929 +               case BT_CONNECT:
26930 +                       s->state = BT_CONNECTED;
26931 +                       rfcomm_process_connect(s);
26932 +                       break;
26933 +               }
26934 +       }
26935 +       return 0;
26936 +}
26937 +
26938 +static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
26939 +{
26940 +       int err = 0;
26941 +
26942 +       BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
26943 +
26944 +       if (dlci) {
26945 +               /* Data DLC */
26946 +               struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
26947 +               if (d) {
26948 +                       if (d->state == BT_CONNECT || d->state == BT_CONFIG)
26949 +                               err = ECONNREFUSED;
26950 +                       else
26951 +                               err = ECONNRESET;
26952 +
26953 +                       d->state = BT_CLOSED;
26954 +                       __rfcomm_dlc_close(d, err);
26955 +               }
26956 +       } else {
26957 +               if (s->state == BT_CONNECT)
26958 +                       err = ECONNREFUSED;
26959 +               else
26960 +                       err = ECONNRESET;
26961 +
26962 +               s->state = BT_CLOSED;
26963 +               rfcomm_session_close(s, err);
26964 +       }
26965 +       return 0;
26966 +}
26967 +
26968 +static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
26969 +{
26970 +       int err = 0;
26971 +
26972 +       BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
26973 +
26974 +       if (dlci) {
26975 +               struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
26976 +               if (d) {
26977 +                       rfcomm_send_ua(s, dlci);
26978 +
26979 +                       if (d->state == BT_CONNECT || d->state == BT_CONFIG)
26980 +                               err = ECONNREFUSED;
26981 +                       else
26982 +                               err = ECONNRESET;
26983 +
26984 +                       d->state = BT_CLOSED;
26985 +                       __rfcomm_dlc_close(d, err);
26986 +               } else
26987 +                       rfcomm_send_dm(s, dlci);
26988 +
26989 +       } else {
26990 +               rfcomm_send_ua(s, 0);
26991 +
26992 +               if (s->state == BT_CONNECT)
26993 +                       err = ECONNREFUSED;
26994 +               else
26995 +                       err = ECONNRESET;
26996 +
26997 +               s->state = BT_CLOSED;
26998 +               rfcomm_session_close(s, err);
26999 +       }
27000 +
27001 +       return 0;
27002 +}
27003 +
27004 +static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
27005 +{
27006 +       struct rfcomm_dlc *d;
27007 +       u8 channel;
27008 +
27009 +       BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
27010 +
27011 +       if (!dlci) {
27012 +               rfcomm_send_ua(s, 0);
27013 +
27014 +               if (s->state == BT_OPEN) {
27015 +                       s->state = BT_CONNECTED;
27016 +                       rfcomm_process_connect(s);
27017 +               }
27018 +               return 0;
27019 +       }
27020 +
27021 +       /* Check if DLC exists */
27022 +       d = rfcomm_dlc_get(s, dlci);
27023 +       if (d) {
27024 +               if (d->state == BT_OPEN) {
27025 +                       /* DLC was previously opened by PN request */
27026 +                       rfcomm_send_ua(s, dlci);
27027 +
27028 +                       rfcomm_dlc_lock(d);
27029 +                       d->state = BT_CONNECTED;
27030 +                       d->state_change(d, 0);
27031 +                       rfcomm_dlc_unlock(d);
27032 +
27033 +                       rfcomm_send_msc(s, 1, dlci, d->v24_sig);
27034 +               }
27035 +               return 0;
27036 +       }
27037 +
27038 +       /* Notify socket layer about incomming connection */
27039 +       channel = __srv_channel(dlci);
27040 +       if (rfcomm_connect_ind(s, channel, &d)) {
27041 +               d->dlci = dlci;
27042 +               d->addr = __addr(s->initiator, dlci);
27043 +               rfcomm_dlc_link(s, d);
27044 +
27045 +               rfcomm_send_ua(s, dlci);
27046 +
27047 +               rfcomm_dlc_lock(d);
27048 +               d->state = BT_CONNECTED;
27049 +               d->state_change(d, 0);
27050 +               rfcomm_dlc_unlock(d);
27051 +
27052 +               rfcomm_send_msc(s, 1, dlci, d->v24_sig);
27053 +       } else {
27054 +               rfcomm_send_dm(s, dlci);
27055 +       }
27056 +
27057 +       return 0;
27058 +}
27059 +
27060 +static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
27061 +{
27062 +       struct rfcomm_session *s = d->session;
27063 +
27064 +       BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
27065 +                       d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
27066 +
27067 +       if (cr) {
27068 +               if (pn->flow_ctrl == 0xf0) {
27069 +                       s->credits = RFCOMM_MAX_CREDITS;
27070 +                       d->credits = s->credits;
27071 +                       d->tx_credits = pn->credits;
27072 +               } else {
27073 +                       set_bit(RFCOMM_TX_THROTTLED, &d->flags);
27074 +                       d->credits = 0;
27075 +               }
27076 +       } else {
27077 +               if (pn->flow_ctrl == 0xe0) {
27078 +                       s->credits = RFCOMM_MAX_CREDITS;
27079 +                       d->credits = s->credits;
27080 +                       d->tx_credits = pn->credits;
27081 +               } else {
27082 +                       set_bit(RFCOMM_TX_THROTTLED, &d->flags);
27083 +                       d->credits = 0;
27084 +               }
27085 +       }
27086 +
27087 +       d->priority = pn->priority;
27088 +
27089 +       d->mtu = btohs(pn->mtu);
27090 +
27091 +       return 0;
27092 +}
27093 +
27094 +static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
27095 +{
27096 +       struct rfcomm_pn *pn = (void *) skb->data;
27097 +       struct rfcomm_dlc *d;
27098 +       u8 dlci = pn->dlci;
27099 +
27100 +       BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
27101 +
27102 +       if (!dlci)
27103 +               return 0;
27104 +
27105 +       d = rfcomm_dlc_get(s, dlci);
27106 +       if (d) {
27107 +               if (cr) {
27108 +                       /* PN request */
27109 +                       rfcomm_apply_pn(d, cr, pn);
27110 +                       rfcomm_send_pn(s, 0, d);
27111 +               } else {
27112 +                       /* PN response */
27113 +                       switch (d->state) {
27114 +                       case BT_CONFIG:
27115 +                               rfcomm_apply_pn(d, cr, pn);
27116 +
27117 +                               d->state = BT_CONNECT;
27118 +                               rfcomm_send_sabm(s, d->dlci);
27119 +                               break;
27120 +                       }
27121 +               }
27122 +       } else {
27123 +               u8 channel = __srv_channel(dlci);
27124 +
27125 +               if (!cr)
27126 +                       return 0;
27127 +
27128 +               /* PN request for non existing DLC.
27129 +                * Assume incomming connection. */
27130 +               if (rfcomm_connect_ind(s, channel, &d)) {
27131 +                       d->dlci = dlci;
27132 +                       d->addr = __addr(s->initiator, dlci);
27133 +                       rfcomm_dlc_link(s, d);
27134 +
27135 +                       rfcomm_apply_pn(d, cr, pn);
27136 +
27137 +                       d->state = BT_OPEN;
27138 +                       rfcomm_send_pn(s, 0, d);
27139 +               } else {
27140 +                       rfcomm_send_dm(s, dlci);
27141 +               }
27142 +       }
27143 +       return 0;
27144 +}
27145 +
27146 +static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
27147 +{
27148 +       struct rfcomm_rpn *rpn = (void *) skb->data;
27149 +       u8 dlci = __get_dlci(rpn->dlci);
27150 +
27151 +       u8 bit_rate  = 0;
27152 +       u8 data_bits = 0;
27153 +       u8 stop_bits = 0;
27154 +       u8 parity    = 0;
27155 +       u8 flow_ctrl = 0;
27156 +       u8 xon_char  = 0;
27157 +       u8 xoff_char = 0;
27158 +       u16 rpn_mask = RFCOMM_RPN_PM_ALL;
27159 +
27160 +       BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
27161 +              dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
27162 +              rpn->xon_char, rpn->xoff_char, rpn->param_mask);
27163 +
27164 +       if (!cr)
27165 +               return 0;
27166 +
27167 +       if (len == 1) {
27168 +               /* request: return default setting */
27169 +               bit_rate  = RFCOMM_RPN_BR_115200;
27170 +               data_bits = RFCOMM_RPN_DATA_8;
27171 +               stop_bits = RFCOMM_RPN_STOP_1;
27172 +               parity    = RFCOMM_RPN_PARITY_NONE;
27173 +               flow_ctrl = RFCOMM_RPN_FLOW_NONE;
27174 +               xon_char  = RFCOMM_RPN_XON_CHAR;
27175 +               xoff_char = RFCOMM_RPN_XOFF_CHAR;
27176 +
27177 +               goto rpn_out;
27178 +       }
27179 +       /* check for sane values: ignore/accept bit_rate, 8 bits, 1 stop bit, no parity,
27180 +                                 no flow control lines, normal XON/XOFF chars */
27181 +       if (rpn->param_mask & RFCOMM_RPN_PM_BITRATE) {
27182 +               bit_rate = rpn->bit_rate;
27183 +               if (bit_rate != RFCOMM_RPN_BR_115200) {
27184 +                       BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
27185 +                       bit_rate = RFCOMM_RPN_BR_115200;
27186 +                       rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
27187 +               }
27188 +       }
27189 +       if (rpn->param_mask & RFCOMM_RPN_PM_DATA) {
27190 +               data_bits = __get_rpn_data_bits(rpn->line_settings);
27191 +               if (data_bits != RFCOMM_RPN_DATA_8) {
27192 +                       BT_DBG("RPN data bits mismatch 0x%x", data_bits);
27193 +                       data_bits = RFCOMM_RPN_DATA_8;
27194 +                       rpn_mask ^= RFCOMM_RPN_PM_DATA;
27195 +               }
27196 +       }
27197 +       if (rpn->param_mask & RFCOMM_RPN_PM_STOP) {
27198 +               stop_bits = __get_rpn_stop_bits(rpn->line_settings);
27199 +               if (stop_bits != RFCOMM_RPN_STOP_1) {
27200 +                       BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
27201 +                       stop_bits = RFCOMM_RPN_STOP_1;
27202 +                       rpn_mask ^= RFCOMM_RPN_PM_STOP;
27203 +               }
27204 +       }
27205 +       if (rpn->param_mask & RFCOMM_RPN_PM_PARITY) {
27206 +               parity = __get_rpn_parity(rpn->line_settings);
27207 +               if (parity != RFCOMM_RPN_PARITY_NONE) {
27208 +                       BT_DBG("RPN parity mismatch 0x%x", parity);
27209 +                       parity = RFCOMM_RPN_PARITY_NONE;
27210 +                       rpn_mask ^= RFCOMM_RPN_PM_PARITY;
27211 +               }
27212 +       }
27213 +       if (rpn->param_mask & RFCOMM_RPN_PM_FLOW) {
27214 +               flow_ctrl = rpn->flow_ctrl;
27215 +               if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
27216 +                       BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
27217 +                       flow_ctrl = RFCOMM_RPN_FLOW_NONE;
27218 +                       rpn_mask ^= RFCOMM_RPN_PM_FLOW;
27219 +               }
27220 +       }
27221 +       if (rpn->param_mask & RFCOMM_RPN_PM_XON) {
27222 +               xon_char = rpn->xon_char;
27223 +               if (xon_char != RFCOMM_RPN_XON_CHAR) {
27224 +                       BT_DBG("RPN XON char mismatch 0x%x", xon_char);
27225 +                       xon_char = RFCOMM_RPN_XON_CHAR;
27226 +                       rpn_mask ^= RFCOMM_RPN_PM_XON;
27227 +               }
27228 +       }
27229 +       if (rpn->param_mask & RFCOMM_RPN_PM_XOFF) {
27230 +               xoff_char = rpn->xoff_char;
27231 +               if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
27232 +                       BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
27233 +                       xoff_char = RFCOMM_RPN_XOFF_CHAR;
27234 +                       rpn_mask ^= RFCOMM_RPN_PM_XOFF;
27235 +               }
27236 +       }
27237 +
27238 +rpn_out:
27239 +       rfcomm_send_rpn(s, 0, dlci,
27240 +                       bit_rate, data_bits, stop_bits, parity, flow_ctrl,
27241 +                       xon_char, xoff_char, rpn_mask);
27242 +
27243 +       return 0;
27244 +}
27245 +
27246 +static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
27247 +{
27248 +       struct rfcomm_rls *rls = (void *) skb->data;
27249 +       u8 dlci = __get_dlci(rls->dlci);
27250 +
27251 +       BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
27252 +
27253 +       if (!cr)
27254 +               return 0;
27255 +
27256 +       /* FIXME: We should probably do something with this
27257 +          information here. But for now it's sufficient just
27258 +          to reply -- Bluetooth 1.1 says it's mandatory to
27259 +          recognise and respond to RLS */
27260 +
27261 +       rfcomm_send_rls(s, 0, dlci, rls->status);
27262 +
27263 +       return 0;
27264 +}
27265 +
27266 +static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
27267 +{
27268 +       struct rfcomm_msc *msc = (void *) skb->data;
27269 +       struct rfcomm_dlc *d;
27270 +       u8 dlci = __get_dlci(msc->dlci);
27271 +
27272 +       BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
27273 +
27274 +       d = rfcomm_dlc_get(s, dlci);
27275 +       if (!d)
27276 +               return 0;
27277 +
27278 +       if (cr) {
27279 +               if (msc->v24_sig & RFCOMM_V24_FC && !d->credits)
27280 +                       set_bit(RFCOMM_TX_THROTTLED, &d->flags);
27281 +               else
27282 +                       clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
27283 +
27284 +               rfcomm_dlc_lock(d);
27285 +               if (d->modem_status)
27286 +                       d->modem_status(d, msc->v24_sig);
27287 +               rfcomm_dlc_unlock(d);
27288 +
27289 +               rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
27290 +
27291 +               d->mscex |= RFCOMM_MSCEX_RX;
27292 +       } else
27293 +               d->mscex |= RFCOMM_MSCEX_TX;
27294 +
27295 +       return 0;
27296 +}
27297 +
27298 +static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
27299 +{
27300 +       struct rfcomm_mcc *mcc = (void *) skb->data;
27301 +       u8 type, cr, len;
27302 +
27303 +       cr   = __test_cr(mcc->type);
27304 +       type = __get_mcc_type(mcc->type);
27305 +       len  = __get_mcc_len(mcc->len);
27306 +
27307 +       BT_DBG("%p type 0x%x cr %d", s, type, cr);
27308 +
27309 +       skb_pull(skb, 2);
27310 +
27311 +       switch (type) {
27312 +       case RFCOMM_PN:
27313 +               rfcomm_recv_pn(s, cr, skb);
27314 +               break;
27315 +
27316 +       case RFCOMM_RPN:
27317 +               rfcomm_recv_rpn(s, cr, len, skb);
27318 +               break;
27319 +
27320 +       case RFCOMM_RLS:
27321 +               rfcomm_recv_rls(s, cr, skb);
27322 +               break;
27323 +
27324 +       case RFCOMM_MSC:
27325 +               rfcomm_recv_msc(s, cr, skb);
27326 +               break;
27327 +
27328 +       case RFCOMM_FCOFF:
27329 +               if (cr) {
27330 +                       set_bit(RFCOMM_TX_THROTTLED, &s->flags);
27331 +                       rfcomm_send_fcoff(s, 0);
27332 +               }
27333 +               break;
27334 +
27335 +       case RFCOMM_FCON:
27336 +               if (cr) {
27337 +                       clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
27338 +                       rfcomm_send_fcon(s, 0);
27339 +               }
27340 +               break;
27341 +
27342 +       case RFCOMM_TEST:
27343 +               if (cr)
27344 +                       rfcomm_send_test(s, 0, skb->data, skb->len);
27345 +               break;
27346 +
27347 +       case RFCOMM_NSC:
27348 +               break;
27349 +
27350 +       default:
27351 +               BT_ERR("Unknown control type 0x%02x", type);
27352 +               rfcomm_send_nsc(s, cr, type);
27353 +               break;
27354 +       }
27355 +       return 0;
27356 +}
27357 +
27358 +static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
27359 +{
27360 +       struct rfcomm_dlc *d;
27361 +
27362 +       BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
27363 +
27364 +       d = rfcomm_dlc_get(s, dlci);
27365 +       if (!d) {
27366 +               rfcomm_send_dm(s, dlci);
27367 +               goto drop;
27368 +       }
27369 +
27370 +       if (pf && d->credits) {
27371 +               u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
27372 +
27373 +               d->tx_credits += credits;
27374 +               if (d->tx_credits)
27375 +                       clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
27376 +       }
27377 +
27378 +       if (skb->len && d->state == BT_CONNECTED) {
27379 +               rfcomm_dlc_lock(d);
27380 +               d->rx_credits--;
27381 +               d->data_ready(d, skb);
27382 +               rfcomm_dlc_unlock(d);
27383 +               return 0;
27384 +       }
27385 +
27386 +drop:
27387 +       kfree_skb(skb);
27388 +       return 0;
27389 +}
27390 +
27391 +static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
27392 +{
27393 +       struct rfcomm_hdr *hdr = (void *) skb->data;
27394 +       u8 type, dlci, fcs;
27395 +
27396 +       dlci = __get_dlci(hdr->addr);
27397 +       type = __get_type(hdr->ctrl);
27398 +
27399 +       /* Trim FCS */
27400 +       skb->len--; skb->tail--;
27401 +       fcs = *(u8 *) skb->tail;
27402 +
27403 +       if (__check_fcs(skb->data, type, fcs)) {
27404 +               BT_ERR("bad checksum in packet");
27405 +               kfree_skb(skb);
27406 +               return -EILSEQ;
27407 +       }
27408 +
27409 +       if (__test_ea(hdr->len))
27410 +               skb_pull(skb, 3);
27411 +       else
27412 +               skb_pull(skb, 4);
27413 +
27414 +       switch (type) {
27415 +       case RFCOMM_SABM:
27416 +               if (__test_pf(hdr->ctrl))
27417 +                       rfcomm_recv_sabm(s, dlci);
27418 +               break;
27419 +
27420 +       case RFCOMM_DISC:
27421 +               if (__test_pf(hdr->ctrl))
27422 +                       rfcomm_recv_disc(s, dlci);
27423 +               break;
27424 +
27425 +       case RFCOMM_UA:
27426 +               if (__test_pf(hdr->ctrl))
27427 +                       rfcomm_recv_ua(s, dlci);
27428 +               break;
27429 +
27430 +       case RFCOMM_DM:
27431 +               rfcomm_recv_dm(s, dlci);
27432 +               break;
27433 +
27434 +       case RFCOMM_UIH:
27435 +               if (dlci)
27436 +                       return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
27437 +
27438 +               rfcomm_recv_mcc(s, skb);
27439 +               break;
27440 +
27441 +       default:
27442 +               BT_ERR("Unknown packet type 0x%02x\n", type);
27443 +               break;
27444 +       }
27445 +       kfree_skb(skb);
27446 +       return 0;
27447 +}
27448 +
27449 +/* ---- Connection and data processing ---- */
27450 +
27451 +static void rfcomm_process_connect(struct rfcomm_session *s)
27452 +{
27453 +       struct rfcomm_dlc *d;
27454 +       struct list_head *p, *n;
27455 +
27456 +       BT_DBG("session %p state %ld", s, s->state);
27457 +
27458 +       list_for_each_safe(p, n, &s->dlcs) {
27459 +               d = list_entry(p, struct rfcomm_dlc, list);
27460 +               if (d->state == BT_CONFIG) {
27461 +                       d->mtu = s->mtu;
27462 +                       rfcomm_send_pn(s, 1, d);
27463 +               }
27464 +       }
27465 +}
27466 +
27467 +/* Send data queued for the DLC.
27468 + * Return number of frames left in the queue.
27469 + */
27470 +static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
27471 +{
27472 +       struct sk_buff *skb;
27473 +       int err;
27474 +
27475 +       BT_DBG("dlc %p state %ld credits %d rx_credits %d tx_credits %d",
27476 +                       d, d->state, d->credits, d->rx_credits, d->tx_credits);
27477 +
27478 +       /* Send pending MSC */
27479 +       if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
27480 +               rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
27481 +
27482 +       if (d->credits) {
27483 +               /* CFC enabled.
27484 +                * Give them some credits */
27485 +               if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
27486 +                               d->rx_credits <= (d->credits >> 2)) {
27487 +                       rfcomm_send_credits(d->session, d->addr, d->credits - d->rx_credits);
27488 +                       d->rx_credits = d->credits;
27489 +               }
27490 +       } else {
27491 +               /* CFC disabled.
27492 +                * Give ourselves some credits */
27493 +               d->tx_credits = 5;
27494 +       }
27495 +
27496 +       if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
27497 +               return skb_queue_len(&d->tx_queue);
27498 +
27499 +       while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
27500 +               err = rfcomm_send_frame(d->session, skb->data, skb->len);
27501 +               if (err < 0) {
27502 +                       skb_queue_head(&d->tx_queue, skb);
27503 +                       break;
27504 +               }
27505 +               kfree_skb(skb);
27506 +               d->tx_credits--;
27507 +       }
27508 +
27509 +       if (d->credits && !d->tx_credits) {
27510 +               /* We're out of TX credits.
27511 +                * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
27512 +               set_bit(RFCOMM_TX_THROTTLED, &d->flags);
27513 +       }
27514 +
27515 +       return skb_queue_len(&d->tx_queue);
27516 +}
27517 +
27518 +static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
27519 +{
27520 +       struct rfcomm_dlc *d;
27521 +       struct list_head *p, *n;
27522 +
27523 +       BT_DBG("session %p state %ld", s, s->state);
27524 +
27525 +       list_for_each_safe(p, n, &s->dlcs) {
27526 +               d = list_entry(p, struct rfcomm_dlc, list);
27527 +               if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
27528 +                       __rfcomm_dlc_close(d, ETIMEDOUT);
27529 +                       continue;
27530 +               }
27531 +
27532 +               if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
27533 +                       continue;
27534 +
27535 +               if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
27536 +                               d->mscex == RFCOMM_MSCEX_OK)
27537 +                       rfcomm_process_tx(d);
27538 +       }
27539 +}
27540 +
27541 +static inline void rfcomm_process_rx(struct rfcomm_session *s)
27542 +{
27543 +       struct socket *sock = s->sock;
27544 +       struct sock *sk = sock->sk;
27545 +       struct sk_buff *skb;
27546 +
27547 +       BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->receive_queue));
27548 +
27549 +       /* Get data directly from socket receive queue without copying it. */
27550 +       while ((skb = skb_dequeue(&sk->receive_queue))) {
27551 +               skb_orphan(skb);
27552 +               rfcomm_recv_frame(s, skb);
27553 +       }
27554 +
27555 +       if (sk->state == BT_CLOSED) {
27556 +               if (!s->initiator)
27557 +                       rfcomm_session_put(s);
27558 +
27559 +               rfcomm_session_close(s, sk->err);
27560 +       }
27561 +}
27562 +
27563 +static inline void rfcomm_accept_connection(struct rfcomm_session *s)
27564 +{
27565 +       struct socket *sock = s->sock, *nsock;
27566 +       int err;
27567 +
27568 +       /* Fast check for a new connection.
27569 +        * Avoids unnesesary socket allocations. */
27570 +       if (list_empty(&bluez_pi(sock->sk)->accept_q))
27571 +               return;
27572 +
27573 +       BT_DBG("session %p", s);
27574 +
27575 +       nsock = sock_alloc();
27576 +       if (!nsock)
27577 +               return;
27578 +
27579 +       nsock->type = sock->type;
27580 +       nsock->ops  = sock->ops;
27581 +
27582 +       err = sock->ops->accept(sock, nsock, O_NONBLOCK);
27583 +       if (err < 0) {
27584 +               sock_release(nsock);
27585 +               return;
27586 +       }
27587 +
27588 +       /* Set our callbacks */
27589 +       nsock->sk->data_ready   = rfcomm_l2data_ready;
27590 +       nsock->sk->state_change = rfcomm_l2state_change;
27591 +
27592 +       s = rfcomm_session_add(nsock, BT_OPEN);
27593 +       if (s)
27594 +               rfcomm_session_hold(s);
27595 +       else
27596 +               sock_release(nsock);
27597 +}
27598 +
27599 +static inline void rfcomm_check_connection(struct rfcomm_session *s)
27600 +{
27601 +       struct sock *sk = s->sock->sk;
27602 +
27603 +       BT_DBG("%p state %ld", s, s->state);
27604 +
27605 +       switch(sk->state) {
27606 +       case BT_CONNECTED:
27607 +               s->state = BT_CONNECT;
27608 +
27609 +               /* We can adjust MTU on outgoing sessions.
27610 +                * L2CAP MTU minus UIH header and FCS. */
27611 +               s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
27612 +
27613 +               rfcomm_send_sabm(s, 0);
27614 +               break;
27615 +
27616 +       case BT_CLOSED:
27617 +               s->state = BT_CLOSED;
27618 +               rfcomm_session_close(s, sk->err);
27619 +               break;
27620 +       }
27621 +}
27622 +
27623 +static inline void rfcomm_process_sessions(void)
27624 +{
27625 +       struct list_head *p, *n;
27626 +
27627 +       rfcomm_lock();
27628 +
27629 +       list_for_each_safe(p, n, &session_list) {
27630 +               struct rfcomm_session *s;
27631 +               s = list_entry(p, struct rfcomm_session, list);
27632 +
27633 +               if (s->state == BT_LISTEN) {
27634 +                       rfcomm_accept_connection(s);
27635 +                       continue;
27636 +               }
27637 +
27638 +               rfcomm_session_hold(s);
27639 +
27640 +               switch (s->state) {
27641 +               case BT_BOUND:
27642 +                       rfcomm_check_connection(s);
27643 +                       break;
27644 +
27645 +               default:
27646 +                       rfcomm_process_rx(s);
27647 +                       break;
27648 +               }
27649 +
27650 +               rfcomm_process_dlcs(s);
27651 +
27652 +               rfcomm_session_put(s);
27653 +       }
27654 +
27655 +       rfcomm_unlock();
27656 +}
27657 +
27658 +static void rfcomm_worker(void)
27659 +{
27660 +       BT_DBG("");
27661 +
27662 +       daemonize(); reparent_to_init();
27663 +       set_fs(KERNEL_DS);
27664 +
27665 +       while (!atomic_read(&terminate)) {
27666 +               BT_DBG("worker loop event 0x%lx", rfcomm_event);
27667 +
27668 +               if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
27669 +                       /* No pending events. Let's sleep.
27670 +                        * Incomming connections and data will wake us up. */
27671 +                       set_current_state(TASK_INTERRUPTIBLE);
27672 +                       schedule();
27673 +               }
27674 +
27675 +               /* Process stuff */
27676 +               clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
27677 +               rfcomm_process_sessions();
27678 +       }
27679 +       set_current_state(TASK_RUNNING);
27680 +       return;
27681 +}
27682 +
27683 +static int rfcomm_add_listener(bdaddr_t *ba)
27684 +{
27685 +       struct sockaddr_l2 addr;
27686 +       struct l2cap_options opts;
27687 +       struct socket *sock;
27688 +       struct rfcomm_session *s;
27689 +       int    size, err = 0;
27690 +
27691 +       /* Create socket */
27692 +       err = rfcomm_l2sock_create(&sock);
27693 +       if (err < 0) {
27694 +               BT_ERR("Create socket failed %d", err);
27695 +               return err;
27696 +       }
27697 +
27698 +       /* Bind socket */
27699 +       bacpy(&addr.l2_bdaddr, ba);
27700 +       addr.l2_family = AF_BLUETOOTH;
27701 +       addr.l2_psm    = htobs(RFCOMM_PSM);
27702 +       err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
27703 +       if (err < 0) {
27704 +               BT_ERR("Bind failed %d", err);
27705 +               goto failed;
27706 +       }
27707 +
27708 +       /* Set L2CAP options */
27709 +       size = sizeof(opts);
27710 +       sock->ops->getsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, &size);
27711 +
27712 +       opts.imtu = RFCOMM_MAX_L2CAP_MTU;
27713 +       sock->ops->setsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, size);
27714 +
27715 +       /* Start listening on the socket */
27716 +       err = sock->ops->listen(sock, 10);
27717 +       if (err) {
27718 +               BT_ERR("Listen failed %d", err);
27719 +               goto failed;
27720 +       }
27721 +
27722 +       /* Add listening session */
27723 +       s = rfcomm_session_add(sock, BT_LISTEN);
27724 +       if (!s)
27725 +               goto failed;
27726 +
27727 +       rfcomm_session_hold(s);
27728 +       return 0;
27729 +failed:
27730 +       sock_release(sock);
27731 +       return err;
27732 +}
27733 +
27734 +static void rfcomm_kill_listener(void)
27735 +{
27736 +       struct rfcomm_session *s;
27737 +       struct list_head *p, *n;
27738 +
27739 +       BT_DBG("");
27740 +
27741 +       list_for_each_safe(p, n, &session_list) {
27742 +               s = list_entry(p, struct rfcomm_session, list);
27743 +               rfcomm_session_del(s);
27744 +       }
27745 +}
27746 +
27747 +static int rfcomm_run(void *unused)
27748 +{
27749 +       rfcomm_thread = current;
27750 +
27751 +       atomic_inc(&running);
27752 +
27753 +       daemonize(); reparent_to_init();
27754 +
27755 +       sigfillset(&current->blocked);
27756 +       set_fs(KERNEL_DS);
27757 +
27758 +       sprintf(current->comm, "krfcommd");
27759 +
27760 +       BT_DBG("");
27761 +
27762 +       rfcomm_add_listener(BDADDR_ANY);
27763 +
27764 +       rfcomm_worker();
27765 +
27766 +       rfcomm_kill_listener();
27767 +
27768 +       atomic_dec(&running);
27769 +       return 0;
27770 +}
27771 +
27772 +/* ---- Proc fs support ---- */
27773 +static int rfcomm_dlc_dump(char *buf)
27774 +{
27775 +       struct rfcomm_session *s;
27776 +       struct sock *sk;
27777 +       struct list_head *p, *pp;
27778 +       char *ptr = buf;
27779 +
27780 +       rfcomm_lock();
27781 +
27782 +       list_for_each(p, &session_list) {
27783 +               s = list_entry(p, struct rfcomm_session, list);
27784 +               sk = s->sock->sk;
27785 +
27786 +               list_for_each(pp, &s->dlcs) {
27787 +               struct rfcomm_dlc *d;
27788 +                       d = list_entry(pp, struct rfcomm_dlc, list);
27789 +
27790 +                       ptr += sprintf(ptr, "dlc %s %s %ld %d %d %d %d\n",
27791 +                               batostr(&bluez_pi(sk)->src), batostr(&bluez_pi(sk)->dst),
27792 +                               d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
27793 +               }
27794 +       }
27795 +
27796 +       rfcomm_unlock();
27797 +
27798 +       return ptr - buf;
27799 +}
27800 +
27801 +extern int rfcomm_sock_dump(char *buf);
27802 +
27803 +static int rfcomm_read_proc(char *buf, char **start, off_t offset, int count, int *eof, void *priv)
27804 +{
27805 +       char *ptr = buf;
27806 +       int len;
27807 +
27808 +       BT_DBG("count %d, offset %ld", count, offset);
27809 +
27810 +       ptr += rfcomm_dlc_dump(ptr);
27811 +       ptr += rfcomm_sock_dump(ptr);
27812 +       len  = ptr - buf;
27813 +
27814 +       if (len <= count + offset)
27815 +               *eof = 1;
27816 +
27817 +       *start = buf + offset;
27818 +       len -= offset;
27819 +
27820 +       if (len > count)
27821 +               len = count;
27822 +       if (len < 0)
27823 +               len = 0;
27824 +
27825 +       return len;
27826 +}
27827 +
27828 +/* ---- Initialization ---- */
27829 +int __init rfcomm_init(void)
27830 +{
27831 +       l2cap_load();
27832 +
27833 +       kernel_thread(rfcomm_run, NULL, CLONE_FS | CLONE_FILES | CLONE_SIGHAND);
27834 +
27835 +       rfcomm_init_sockets();
27836 +
27837 +#ifdef CONFIG_BLUEZ_RFCOMM_TTY
27838 +       rfcomm_init_ttys();
27839 +#endif
27840 +
27841 +       create_proc_read_entry("bluetooth/rfcomm", 0, 0, rfcomm_read_proc, NULL);
27842 +
27843 +       BT_INFO("BlueZ RFCOMM ver %s", VERSION);
27844 +       BT_INFO("Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>");
27845 +       BT_INFO("Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>");
27846 +       return 0;
27847 +}
27848 +
27849 +void rfcomm_cleanup(void)
27850 +{
27851 +       /* Terminate working thread.
27852 +        * ie. Set terminate flag and wake it up */
27853 +       atomic_inc(&terminate);
27854 +       rfcomm_schedule(RFCOMM_SCHED_STATE);
27855 +
27856 +       /* Wait until thread is running */
27857 +       while (atomic_read(&running))
27858 +               schedule();
27859 +
27860 +       remove_proc_entry("bluetooth/rfcomm", NULL);
27861 +
27862 +#ifdef CONFIG_BLUEZ_RFCOMM_TTY
27863 +       rfcomm_cleanup_ttys();
27864 +#endif
27865 +
27866 +       rfcomm_cleanup_sockets();
27867 +       return;
27868 +}
27869 +
27870 +module_init(rfcomm_init);
27871 +module_exit(rfcomm_cleanup);
27872 +
27873 +MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
27874 +MODULE_DESCRIPTION("BlueZ RFCOMM ver " VERSION);
27875 +MODULE_LICENSE("GPL");
27876 diff -urN linux-2.4.18/net/bluetooth/rfcomm/crc.c linux-2.4.18-mh9/net/bluetooth/rfcomm/crc.c
27877 --- linux-2.4.18/net/bluetooth/rfcomm/crc.c     Thu Jan  1 01:00:00 1970
27878 +++ linux-2.4.18-mh9/net/bluetooth/rfcomm/crc.c Mon Aug 25 18:38:12 2003
27879 @@ -0,0 +1,71 @@
27880 +/*
27881 +   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
27882 +   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
27883 +   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
27884 +
27885 +   This program is free software; you can redistribute it and/or modify
27886 +   it under the terms of the GNU General Public License version 2 as
27887 +   published by the Free Software Foundation;
27888 +
27889 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
27890 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
27891 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
27892 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
27893 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
27894 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
27895 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
27896 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
27897 +
27898 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
27899 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
27900 +   SOFTWARE IS DISCLAIMED.
27901 +*/
27902 +
27903 +/*
27904 + * RFCOMM FCS calculation.
27905 + *
27906 + * $Id: crc.c,v 1.2 2002/09/21 09:54:32 holtmann Exp $
27907 + */
27908 +
27909 +/* reversed, 8-bit, poly=0x07 */
27910 +unsigned char rfcomm_crc_table[256] = {
27911 +       0x00, 0x91, 0xe3, 0x72, 0x07, 0x96, 0xe4, 0x75,
27912 +       0x0e, 0x9f, 0xed, 0x7c, 0x09, 0x98, 0xea, 0x7b,
27913 +       0x1c, 0x8d, 0xff, 0x6e, 0x1b, 0x8a, 0xf8, 0x69,
27914 +       0x12, 0x83, 0xf1, 0x60, 0x15, 0x84, 0xf6, 0x67,
27915 +
27916 +       0x38, 0xa9, 0xdb, 0x4a, 0x3f, 0xae, 0xdc, 0x4d,
27917 +       0x36, 0xa7, 0xd5, 0x44, 0x31, 0xa0, 0xd2, 0x43,
27918 +       0x24, 0xb5, 0xc7, 0x56, 0x23, 0xb2, 0xc0, 0x51,
27919 +       0x2a, 0xbb, 0xc9, 0x58, 0x2d, 0xbc, 0xce, 0x5f,
27920 +
27921 +       0x70, 0xe1, 0x93, 0x02, 0x77, 0xe6, 0x94, 0x05,
27922 +       0x7e, 0xef, 0x9d, 0x0c, 0x79, 0xe8, 0x9a, 0x0b,
27923 +       0x6c, 0xfd, 0x8f, 0x1e, 0x6b, 0xfa, 0x88, 0x19,
27924 +       0x62, 0xf3, 0x81, 0x10, 0x65, 0xf4, 0x86, 0x17,
27925 +
27926 +       0x48, 0xd9, 0xab, 0x3a, 0x4f, 0xde, 0xac, 0x3d,
27927 +       0x46, 0xd7, 0xa5, 0x34, 0x41, 0xd0, 0xa2, 0x33,
27928 +       0x54, 0xc5, 0xb7, 0x26, 0x53, 0xc2, 0xb0, 0x21,
27929 +       0x5a, 0xcb, 0xb9, 0x28, 0x5d, 0xcc, 0xbe, 0x2f,
27930 +
27931 +       0xe0, 0x71, 0x03, 0x92, 0xe7, 0x76, 0x04, 0x95,
27932 +       0xee, 0x7f, 0x0d, 0x9c, 0xe9, 0x78, 0x0a, 0x9b,
27933 +       0xfc, 0x6d, 0x1f, 0x8e, 0xfb, 0x6a, 0x18, 0x89,
27934 +       0xf2, 0x63, 0x11, 0x80, 0xf5, 0x64, 0x16, 0x87,
27935 +
27936 +       0xd8, 0x49, 0x3b, 0xaa, 0xdf, 0x4e, 0x3c, 0xad,
27937 +       0xd6, 0x47, 0x35, 0xa4, 0xd1, 0x40, 0x32, 0xa3,
27938 +       0xc4, 0x55, 0x27, 0xb6, 0xc3, 0x52, 0x20, 0xb1,
27939 +       0xca, 0x5b, 0x29, 0xb8, 0xcd, 0x5c, 0x2e, 0xbf,
27940 +
27941 +       0x90, 0x01, 0x73, 0xe2, 0x97, 0x06, 0x74, 0xe5,
27942 +       0x9e, 0x0f, 0x7d, 0xec, 0x99, 0x08, 0x7a, 0xeb,
27943 +       0x8c, 0x1d, 0x6f, 0xfe, 0x8b, 0x1a, 0x68, 0xf9,
27944 +       0x82, 0x13, 0x61, 0xf0, 0x85, 0x14, 0x66, 0xf7,
27945 +
27946 +       0xa8, 0x39, 0x4b, 0xda, 0xaf, 0x3e, 0x4c, 0xdd,
27947 +       0xa6, 0x37, 0x45, 0xd4, 0xa1, 0x30, 0x42, 0xd3,
27948 +       0xb4, 0x25, 0x57, 0xc6, 0xb3, 0x22, 0x50, 0xc1,
27949 +       0xba, 0x2b, 0x59, 0xc8, 0xbd, 0x2c, 0x5e, 0xcf
27950 +};
27951 diff -urN linux-2.4.18/net/bluetooth/rfcomm/sock.c linux-2.4.18-mh9/net/bluetooth/rfcomm/sock.c
27952 --- linux-2.4.18/net/bluetooth/rfcomm/sock.c    Thu Jan  1 01:00:00 1970
27953 +++ linux-2.4.18-mh9/net/bluetooth/rfcomm/sock.c        Mon Aug 25 18:38:12 2003
27954 @@ -0,0 +1,847 @@
27955 +/*
27956 +   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
27957 +   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
27958 +   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
27959 +
27960 +   This program is free software; you can redistribute it and/or modify
27961 +   it under the terms of the GNU General Public License version 2 as
27962 +   published by the Free Software Foundation;
27963 +
27964 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
27965 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
27966 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
27967 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
27968 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
27969 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
27970 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
27971 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
27972 +
27973 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
27974 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
27975 +   SOFTWARE IS DISCLAIMED.
27976 +*/
27977 +
27978 +/*
27979 + * RFCOMM sockets.
27980 + *
27981 + * $Id: sock.c,v 1.30 2002/10/18 20:12:12 maxk Exp $
27982 + */
27983 +
27984 +#include <linux/config.h>
27985 +#include <linux/module.h>
27986 +
27987 +#include <linux/types.h>
27988 +#include <linux/errno.h>
27989 +#include <linux/kernel.h>
27990 +#include <linux/major.h>
27991 +#include <linux/sched.h>
27992 +#include <linux/slab.h>
27993 +#include <linux/poll.h>
27994 +#include <linux/fcntl.h>
27995 +#include <linux/init.h>
27996 +#include <linux/skbuff.h>
27997 +#include <linux/interrupt.h>
27998 +#include <linux/socket.h>
27999 +#include <linux/skbuff.h>
28000 +#include <linux/list.h>
28001 +#include <net/sock.h>
28002 +
28003 +#include <asm/system.h>
28004 +#include <asm/uaccess.h>
28005 +
28006 +#include <net/bluetooth/bluetooth.h>
28007 +#include <net/bluetooth/rfcomm.h>
28008 +
28009 +#ifndef CONFIG_BLUEZ_RFCOMM_DEBUG
28010 +#undef  BT_DBG
28011 +#define BT_DBG(D...)
28012 +#endif
28013 +
28014 +static struct proto_ops rfcomm_sock_ops;
28015 +
28016 +static struct bluez_sock_list rfcomm_sk_list = {
28017 +       lock: RW_LOCK_UNLOCKED
28018 +};
28019 +
28020 +static void rfcomm_sock_close(struct sock *sk);
28021 +static void rfcomm_sock_kill(struct sock *sk);
28022 +
28023 +/* ---- DLC callbacks ----
28024 + *
28025 + * called under rfcomm_dlc_lock()
28026 + */
28027 +static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
28028 +{
28029 +       struct sock *sk = d->owner;
28030 +       if (!sk)
28031 +               return;
28032 +
28033 +       atomic_add(skb->len, &sk->rmem_alloc);
28034 +       skb_queue_tail(&sk->receive_queue, skb);
28035 +       sk->data_ready(sk, skb->len);
28036 +
28037 +       if (atomic_read(&sk->rmem_alloc) >= sk->rcvbuf)
28038 +               rfcomm_dlc_throttle(d);
28039 +}
28040 +
28041 +static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
28042 +{
28043 +       struct sock *sk = d->owner, *parent;
28044 +       if (!sk)
28045 +               return;
28046 +
28047 +       BT_DBG("dlc %p state %ld err %d", d, d->state, err);
28048 +
28049 +       bh_lock_sock(sk);
28050 +
28051 +       if (err)
28052 +               sk->err = err;
28053 +       sk->state = d->state;
28054 +
28055 +       parent = bluez_pi(sk)->parent;
28056 +       if (!parent) {
28057 +               if (d->state == BT_CONNECTED)
28058 +                       rfcomm_session_getaddr(d->session, &bluez_pi(sk)->src, NULL);
28059 +               sk->state_change(sk);
28060 +       } else
28061 +               parent->data_ready(parent, 0);
28062 +
28063 +       bh_unlock_sock(sk);
28064 +}
28065 +
28066 +/* ---- Socket functions ---- */
28067 +static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
28068 +{
28069 +       struct sock *sk;
28070 +
28071 +       for (sk = rfcomm_sk_list.head; sk; sk = sk->next) {
28072 +               if (rfcomm_pi(sk)->channel == channel &&
28073 +                               !bacmp(&bluez_pi(sk)->src, src))
28074 +                       break;
28075 +       }
28076 +
28077 +       return sk;
28078 +}
28079 +
28080 +/* Find socket with channel and source bdaddr.
28081 + * Returns closest match.
28082 + */
28083 +static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
28084 +{
28085 +       struct sock *sk, *sk1 = NULL;
28086 +
28087 +       for (sk = rfcomm_sk_list.head; sk; sk = sk->next) {
28088 +               if (state && sk->state != state)
28089 +                       continue;
28090 +
28091 +               if (rfcomm_pi(sk)->channel == channel) {
28092 +                       /* Exact match. */
28093 +                       if (!bacmp(&bluez_pi(sk)->src, src))
28094 +                               break;
28095 +
28096 +                       /* Closest match */
28097 +                       if (!bacmp(&bluez_pi(sk)->src, BDADDR_ANY))
28098 +                               sk1 = sk;
28099 +               }
28100 +       }
28101 +       return sk ? sk : sk1;
28102 +}
28103 +
28104 +/* Find socket with given address (channel, src).
28105 + * Returns locked socket */
28106 +static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
28107 +{
28108 +       struct sock *s;
28109 +       read_lock(&rfcomm_sk_list.lock);
28110 +       s = __rfcomm_get_sock_by_channel(state, channel, src);
28111 +       if (s) bh_lock_sock(s);
28112 +       read_unlock(&rfcomm_sk_list.lock);
28113 +       return s;
28114 +}
28115 +
28116 +static void rfcomm_sock_destruct(struct sock *sk)
28117 +{
28118 +       struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
28119 +
28120 +       BT_DBG("sk %p dlc %p", sk, d);
28121 +
28122 +       skb_queue_purge(&sk->receive_queue);
28123 +       skb_queue_purge(&sk->write_queue);
28124 +
28125 +       rfcomm_dlc_lock(d);
28126 +       rfcomm_pi(sk)->dlc = NULL;
28127 +
28128 +       /* Detach DLC if it's owned by this socket */
28129 +       if (d->owner == sk)
28130 +               d->owner = NULL;
28131 +       rfcomm_dlc_unlock(d);
28132 +
28133 +       rfcomm_dlc_put(d);
28134 +
28135 +       MOD_DEC_USE_COUNT;
28136 +}
28137 +
28138 +static void rfcomm_sock_cleanup_listen(struct sock *parent)
28139 +{
28140 +       struct sock *sk;
28141 +
28142 +       BT_DBG("parent %p", parent);
28143 +
28144 +       /* Close not yet accepted dlcs */
28145 +       while ((sk = bluez_accept_dequeue(parent, NULL))) {
28146 +               rfcomm_sock_close(sk);
28147 +               rfcomm_sock_kill(sk);
28148 +       }
28149 +
28150 +       parent->state  = BT_CLOSED;
28151 +       parent->zapped = 1;
28152 +}
28153 +
28154 +/* Kill socket (only if zapped and orphan)
28155 + * Must be called on unlocked socket.
28156 + */
28157 +static void rfcomm_sock_kill(struct sock *sk)
28158 +{
28159 +       if (!sk->zapped || sk->socket)
28160 +               return;
28161 +
28162 +       BT_DBG("sk %p state %d refcnt %d", sk, sk->state, atomic_read(&sk->refcnt));
28163 +
28164 +       /* Kill poor orphan */
28165 +       bluez_sock_unlink(&rfcomm_sk_list, sk);
28166 +       sk->dead = 1;
28167 +       sock_put(sk);
28168 +}
28169 +
28170 +static void __rfcomm_sock_close(struct sock *sk)
28171 +{
28172 +       struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
28173 +
28174 +       BT_DBG("sk %p state %d socket %p", sk, sk->state, sk->socket);
28175 +
28176 +       switch (sk->state) {
28177 +       case BT_LISTEN:
28178 +               rfcomm_sock_cleanup_listen(sk);
28179 +               break;
28180 +
28181 +       case BT_CONNECT:
28182 +       case BT_CONNECT2:
28183 +       case BT_CONFIG:
28184 +       case BT_CONNECTED:
28185 +               rfcomm_dlc_close(d, 0);
28186 +
28187 +       default:
28188 +               sk->zapped = 1;
28189 +               break;
28190 +       }
28191 +}
28192 +
28193 +/* Close socket.
28194 + * Must be called on unlocked socket.
28195 + */
28196 +static void rfcomm_sock_close(struct sock *sk)
28197 +{
28198 +       lock_sock(sk);
28199 +       __rfcomm_sock_close(sk);
28200 +       release_sock(sk);
28201 +}
28202 +
28203 +static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
28204 +{
28205 +       BT_DBG("sk %p", sk);
28206 +
28207 +       if (parent)
28208 +               sk->type = parent->type;
28209 +}
28210 +
28211 +static struct sock *rfcomm_sock_alloc(struct socket *sock, int proto, int prio)
28212 +{
28213 +       struct rfcomm_dlc *d;
28214 +       struct sock *sk;
28215 +
28216 +       sk = sk_alloc(PF_BLUETOOTH, prio, 1);
28217 +       if (!sk)
28218 +               return NULL;
28219 +
28220 +       d = rfcomm_dlc_alloc(prio);
28221 +       if (!d) {
28222 +               sk_free(sk);
28223 +               return NULL;
28224 +       }
28225 +       d->data_ready   = rfcomm_sk_data_ready;
28226 +       d->state_change = rfcomm_sk_state_change;
28227 +
28228 +       rfcomm_pi(sk)->dlc = d;
28229 +       d->owner = sk;
28230 +
28231 +       bluez_sock_init(sock, sk);
28232 +
28233 +       sk->zapped   = 0;
28234 +
28235 +       sk->destruct = rfcomm_sock_destruct;
28236 +       sk->sndtimeo = RFCOMM_CONN_TIMEOUT;
28237 +
28238 +       sk->sndbuf   = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
28239 +       sk->rcvbuf   = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
28240 +
28241 +       sk->protocol = proto;
28242 +       sk->state    = BT_OPEN;
28243 +
28244 +       bluez_sock_link(&rfcomm_sk_list, sk);
28245 +
28246 +       BT_DBG("sk %p", sk);
28247 +
28248 +       MOD_INC_USE_COUNT;
28249 +       return sk;
28250 +}
28251 +
28252 +static int rfcomm_sock_create(struct socket *sock, int protocol)
28253 +{
28254 +       struct sock *sk;
28255 +
28256 +       BT_DBG("sock %p", sock);
28257 +
28258 +       sock->state = SS_UNCONNECTED;
28259 +
28260 +       if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
28261 +               return -ESOCKTNOSUPPORT;
28262 +
28263 +       sock->ops = &rfcomm_sock_ops;
28264 +
28265 +       if (!(sk = rfcomm_sock_alloc(sock, protocol, GFP_KERNEL)))
28266 +               return -ENOMEM;
28267 +
28268 +       rfcomm_sock_init(sk, NULL);
28269 +       return 0;
28270 +}
28271 +
28272 +static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
28273 +{
28274 +       struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
28275 +       struct sock *sk = sock->sk;
28276 +       int err = 0;
28277 +
28278 +       BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
28279 +
28280 +       if (!addr || addr->sa_family != AF_BLUETOOTH)
28281 +               return -EINVAL;
28282 +
28283 +       lock_sock(sk);
28284 +
28285 +       if (sk->state != BT_OPEN) {
28286 +               err = -EBADFD;
28287 +               goto done;
28288 +       }
28289 +
28290 +       write_lock_bh(&rfcomm_sk_list.lock);
28291 +
28292 +       if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
28293 +               err = -EADDRINUSE;
28294 +       } else {
28295 +               /* Save source address */
28296 +               bacpy(&bluez_pi(sk)->src, &sa->rc_bdaddr);
28297 +               rfcomm_pi(sk)->channel = sa->rc_channel;
28298 +               sk->state = BT_BOUND;
28299 +       }
28300 +
28301 +       write_unlock_bh(&rfcomm_sk_list.lock);
28302 +
28303 +done:
28304 +       release_sock(sk);
28305 +       return err;
28306 +}
28307 +
28308 +static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
28309 +{
28310 +       struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
28311 +       struct sock *sk = sock->sk;
28312 +       struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
28313 +       int err = 0;
28314 +
28315 +       BT_DBG("sk %p", sk);
28316 +
28317 +       if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
28318 +               return -EINVAL;
28319 +
28320 +       if (sk->state != BT_OPEN && sk->state != BT_BOUND)
28321 +               return -EBADFD;
28322 +
28323 +       if (sk->type != SOCK_STREAM)
28324 +               return -EINVAL;
28325 +
28326 +       lock_sock(sk);
28327 +
28328 +       sk->state = BT_CONNECT;
28329 +       bacpy(&bluez_pi(sk)->dst, &sa->rc_bdaddr);
28330 +       rfcomm_pi(sk)->channel = sa->rc_channel;
28331 +
28332 +       err = rfcomm_dlc_open(d, &bluez_pi(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
28333 +       if (!err)
28334 +               err = bluez_sock_wait_state(sk, BT_CONNECTED,
28335 +                               sock_sndtimeo(sk, flags & O_NONBLOCK));
28336 +
28337 +       release_sock(sk);
28338 +       return err;
28339 +}
28340 +
28341 +int rfcomm_sock_listen(struct socket *sock, int backlog)
28342 +{
28343 +       struct sock *sk = sock->sk;
28344 +       int err = 0;
28345 +
28346 +       BT_DBG("sk %p backlog %d", sk, backlog);
28347 +
28348 +       lock_sock(sk);
28349 +
28350 +       if (sk->state != BT_BOUND) {
28351 +               err = -EBADFD;
28352 +               goto done;
28353 +       }
28354 +
28355 +       sk->max_ack_backlog = backlog;
28356 +       sk->ack_backlog = 0;
28357 +       sk->state = BT_LISTEN;
28358 +
28359 +done:
28360 +       release_sock(sk);
28361 +       return err;
28362 +}
28363 +
28364 +int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
28365 +{
28366 +       DECLARE_WAITQUEUE(wait, current);
28367 +       struct sock *sk = sock->sk, *nsk;
28368 +       long timeo;
28369 +       int err = 0;
28370 +
28371 +       lock_sock(sk);
28372 +
28373 +       if (sk->state != BT_LISTEN) {
28374 +               err = -EBADFD;
28375 +               goto done;
28376 +       }
28377 +
28378 +       timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
28379 +
28380 +       BT_DBG("sk %p timeo %ld", sk, timeo);
28381 +
28382 +       /* Wait for an incoming connection. (wake-one). */
28383 +       add_wait_queue_exclusive(sk->sleep, &wait);
28384 +       while (!(nsk = bluez_accept_dequeue(sk, newsock))) {
28385 +               set_current_state(TASK_INTERRUPTIBLE);
28386 +               if (!timeo) {
28387 +                       err = -EAGAIN;
28388 +                       break;
28389 +               }
28390 +
28391 +               release_sock(sk);
28392 +               timeo = schedule_timeout(timeo);
28393 +               lock_sock(sk);
28394 +
28395 +               if (sk->state != BT_LISTEN) {
28396 +                       err = -EBADFD;
28397 +                       break;
28398 +               }
28399 +
28400 +               if (signal_pending(current)) {
28401 +                       err = sock_intr_errno(timeo);
28402 +                       break;
28403 +               }
28404 +       }
28405 +       set_current_state(TASK_RUNNING);
28406 +       remove_wait_queue(sk->sleep, &wait);
28407 +
28408 +       if (err)
28409 +               goto done;
28410 +
28411 +       newsock->state = SS_CONNECTED;
28412 +
28413 +       BT_DBG("new socket %p", nsk);
28414 +
28415 +done:
28416 +       release_sock(sk);
28417 +       return err;
28418 +}
28419 +
28420 +static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
28421 +{
28422 +       struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
28423 +       struct sock *sk = sock->sk;
28424 +
28425 +       BT_DBG("sock %p, sk %p", sock, sk);
28426 +
28427 +       sa->rc_family  = AF_BLUETOOTH;
28428 +       sa->rc_channel = rfcomm_pi(sk)->channel;
28429 +       if (peer)
28430 +               bacpy(&sa->rc_bdaddr, &bluez_pi(sk)->dst);
28431 +       else
28432 +               bacpy(&sa->rc_bdaddr, &bluez_pi(sk)->src);
28433 +
28434 +       *len = sizeof(struct sockaddr_rc);
28435 +       return 0;
28436 +}
28437 +
28438 +static int rfcomm_sock_sendmsg(struct socket *sock, struct msghdr *msg, int len,
28439 +                              struct scm_cookie *scm)
28440 +{
28441 +       struct sock *sk = sock->sk;
28442 +       struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
28443 +       struct sk_buff *skb;
28444 +       int err, size;
28445 +       int sent = 0;
28446 +
28447 +       if (msg->msg_flags & MSG_OOB)
28448 +               return -EOPNOTSUPP;
28449 +
28450 +       if (sk->shutdown & SEND_SHUTDOWN)
28451 +               return -EPIPE;
28452 +
28453 +       BT_DBG("sock %p, sk %p", sock, sk);
28454 +
28455 +       lock_sock(sk);
28456 +
28457 +       while (len) {
28458 +               size = min_t(uint, len, d->mtu);
28459 +
28460 +               skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
28461 +                               msg->msg_flags & MSG_DONTWAIT, &err);
28462 +               if (!skb)
28463 +                       break;
28464 +               skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
28465 +
28466 +               err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
28467 +               if (err) {
28468 +                       kfree_skb(skb);
28469 +                       sent = err;
28470 +                       break;
28471 +               }
28472 +
28473 +               err = rfcomm_dlc_send(d, skb);
28474 +               if (err < 0) {
28475 +                       kfree_skb(skb);
28476 +                       break;
28477 +               }
28478 +
28479 +               sent += size;
28480 +               len  -= size;
28481 +       }
28482 +
28483 +       release_sock(sk);
28484 +
28485 +       return sent ? sent : err;
28486 +}
28487 +
28488 +static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
28489 +{
28490 +       DECLARE_WAITQUEUE(wait, current);
28491 +
28492 +       add_wait_queue(sk->sleep, &wait);
28493 +       for (;;) {
28494 +               set_current_state(TASK_INTERRUPTIBLE);
28495 +
28496 +               if (skb_queue_len(&sk->receive_queue) || sk->err || (sk->shutdown & RCV_SHUTDOWN) ||
28497 +                               signal_pending(current) || !timeo)
28498 +                       break;
28499 +
28500 +               set_bit(SOCK_ASYNC_WAITDATA, &sk->socket->flags);
28501 +               release_sock(sk);
28502 +               timeo = schedule_timeout(timeo);
28503 +               lock_sock(sk);
28504 +               clear_bit(SOCK_ASYNC_WAITDATA, &sk->socket->flags);
28505 +       }
28506 +
28507 +       __set_current_state(TASK_RUNNING);
28508 +       remove_wait_queue(sk->sleep, &wait);
28509 +       return timeo;
28510 +}
28511 +
28512 +static int rfcomm_sock_recvmsg(struct socket *sock, struct msghdr *msg, int size,
28513 +                              int flags, struct scm_cookie *scm)
28514 +{
28515 +       struct sock *sk = sock->sk;
28516 +       int target, err = 0, copied = 0;
28517 +       long timeo;
28518 +
28519 +       if (flags & MSG_OOB)
28520 +               return -EOPNOTSUPP;
28521 +
28522 +       msg->msg_namelen = 0;
28523 +
28524 +       BT_DBG("sk %p size %d", sk, size);
28525 +
28526 +       lock_sock(sk);
28527 +
28528 +       target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
28529 +       timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
28530 +
28531 +       do {
28532 +               struct sk_buff *skb;
28533 +               int chunk;
28534 +
28535 +               skb = skb_dequeue(&sk->receive_queue);
28536 +               if (!skb) {
28537 +                       if (copied >= target)
28538 +                               break;
28539 +
28540 +                       if ((err = sock_error(sk)) != 0)
28541 +                               break;
28542 +                       if (sk->shutdown & RCV_SHUTDOWN)
28543 +                               break;
28544 +
28545 +                       err = -EAGAIN;
28546 +                       if (!timeo)
28547 +                               break;
28548 +
28549 +                       timeo = rfcomm_sock_data_wait(sk, timeo);
28550 +
28551 +                       if (signal_pending(current)) {
28552 +                               err = sock_intr_errno(timeo);
28553 +                               goto out;
28554 +                       }
28555 +                       continue;
28556 +               }
28557 +
28558 +               chunk = min_t(unsigned int, skb->len, size);
28559 +               if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
28560 +                       skb_queue_head(&sk->receive_queue, skb);
28561 +                       if (!copied)
28562 +                               copied = -EFAULT;
28563 +                       break;
28564 +               }
28565 +               copied += chunk;
28566 +               size   -= chunk;
28567 +
28568 +               if (!(flags & MSG_PEEK)) {
28569 +                       atomic_sub(chunk, &sk->rmem_alloc);
28570 +
28571 +                       skb_pull(skb, chunk);
28572 +                       if (skb->len) {
28573 +                               skb_queue_head(&sk->receive_queue, skb);
28574 +                               break;
28575 +                       }
28576 +                       kfree_skb(skb);
28577 +
28578 +               } else {
28579 +                       /* put message back and return */
28580 +                       skb_queue_head(&sk->receive_queue, skb);
28581 +                       break;
28582 +               }
28583 +       } while (size);
28584 +
28585 +out:
28586 +       if (atomic_read(&sk->rmem_alloc) <= (sk->rcvbuf >> 2))
28587 +               rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
28588 +
28589 +       release_sock(sk);
28590 +       return copied ? : err;
28591 +}
28592 +
28593 +static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
28594 +{
28595 +       struct sock *sk = sock->sk;
28596 +       int err = 0;
28597 +
28598 +       BT_DBG("sk %p", sk);
28599 +
28600 +       lock_sock(sk);
28601 +
28602 +       switch (optname) {
28603 +       default:
28604 +               err = -ENOPROTOOPT;
28605 +               break;
28606 +       };
28607 +
28608 +       release_sock(sk);
28609 +       return err;
28610 +}
28611 +
28612 +static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
28613 +{
28614 +       struct sock *sk = sock->sk;
28615 +       int len, err = 0;
28616 +
28617 +       BT_DBG("sk %p", sk);
28618 +
28619 +       if (get_user(len, optlen))
28620 +               return -EFAULT;
28621 +
28622 +       lock_sock(sk);
28623 +
28624 +       switch (optname) {
28625 +       default:
28626 +               err = -ENOPROTOOPT;
28627 +               break;
28628 +       };
28629 +
28630 +       release_sock(sk);
28631 +       return err;
28632 +}
28633 +
28634 +static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
28635 +{
28636 +       struct sock *sk = sock->sk;
28637 +       int err;
28638 +
28639 +       lock_sock(sk);
28640 +
28641 +#ifdef CONFIG_BLUEZ_RFCOMM_TTY
28642 +       err = rfcomm_dev_ioctl(sk, cmd, arg);
28643 +#else
28644 +       err = -EOPNOTSUPP;
28645 +#endif
28646 +
28647 +       release_sock(sk);
28648 +
28649 +       return err;
28650 +}
28651 +
28652 +static int rfcomm_sock_shutdown(struct socket *sock, int how)
28653 +{
28654 +       struct sock *sk = sock->sk;
28655 +       int err = 0;
28656 +
28657 +       BT_DBG("sock %p, sk %p", sock, sk);
28658 +
28659 +       if (!sk) return 0;
28660 +
28661 +       lock_sock(sk);
28662 +       if (!sk->shutdown) {
28663 +               sk->shutdown = SHUTDOWN_MASK;
28664 +               __rfcomm_sock_close(sk);
28665 +
28666 +               if (sk->linger)
28667 +                       err = bluez_sock_wait_state(sk, BT_CLOSED, sk->lingertime);
28668 +       }
28669 +       release_sock(sk);
28670 +       return err;
28671 +}
28672 +
28673 +static int rfcomm_sock_release(struct socket *sock)
28674 +{
28675 +       struct sock *sk = sock->sk;
28676 +       int err = 0;
28677 +
28678 +       BT_DBG("sock %p, sk %p", sock, sk);
28679 +
28680 +       if (!sk)
28681 +               return 0;
28682 +
28683 +       err = rfcomm_sock_shutdown(sock, 2);
28684 +
28685 +       sock_orphan(sk);
28686 +       rfcomm_sock_kill(sk);
28687 +       return err;
28688 +}
28689 +
28690 +/* ---- RFCOMM core layer callbacks ----
28691 + *
28692 + * called under rfcomm_lock()
28693 + */
28694 +int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
28695 +{
28696 +       struct sock *sk, *parent;
28697 +       bdaddr_t src, dst;
28698 +       int result = 0;
28699 +
28700 +       BT_DBG("session %p channel %d", s, channel);
28701 +
28702 +       rfcomm_session_getaddr(s, &src, &dst);
28703 +
28704 +       /* Check if we have socket listening on this channel */
28705 +       parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
28706 +       if (!parent)
28707 +               return 0;
28708 +
28709 +       /* Check for backlog size */
28710 +       if (parent->ack_backlog > parent->max_ack_backlog) {
28711 +               BT_DBG("backlog full %d", parent->ack_backlog);
28712 +               goto done;
28713 +       }
28714 +
28715 +       sk = rfcomm_sock_alloc(NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
28716 +       if (!sk)
28717 +               goto done;
28718 +
28719 +       rfcomm_sock_init(sk, parent);
28720 +       bacpy(&bluez_pi(sk)->src, &src);
28721 +       bacpy(&bluez_pi(sk)->dst, &dst);
28722 +       rfcomm_pi(sk)->channel = channel;
28723 +
28724 +       sk->state = BT_CONFIG;
28725 +       bluez_accept_enqueue(parent, sk);
28726 +
28727 +       /* Accept connection and return socket DLC */
28728 +       *d = rfcomm_pi(sk)->dlc;
28729 +       result = 1;
28730 +
28731 +done:
28732 +       bh_unlock_sock(parent);
28733 +       return result;
28734 +}
28735 +
28736 +/* ---- Proc fs support ---- */
28737 +int rfcomm_sock_dump(char *buf)
28738 +{
28739 +       struct bluez_sock_list *list = &rfcomm_sk_list;
28740 +       struct rfcomm_pinfo *pi;
28741 +       struct sock *sk;
28742 +       char *ptr = buf;
28743 +
28744 +       write_lock_bh(&list->lock);
28745 +
28746 +       for (sk = list->head; sk; sk = sk->next) {
28747 +               pi = rfcomm_pi(sk);
28748 +               ptr += sprintf(ptr, "sk  %s %s %d %d\n",
28749 +                               batostr(&bluez_pi(sk)->src), batostr(&bluez_pi(sk)->dst),
28750 +                               sk->state, rfcomm_pi(sk)->channel);
28751 +       }
28752 +
28753 +       write_unlock_bh(&list->lock);
28754 +
28755 +       return ptr - buf;
28756 +}
28757 +
28758 +static struct proto_ops rfcomm_sock_ops = {
28759 +       family:         PF_BLUETOOTH,
28760 +       release:        rfcomm_sock_release,
28761 +       bind:           rfcomm_sock_bind,
28762 +       connect:        rfcomm_sock_connect,
28763 +       listen:         rfcomm_sock_listen,
28764 +       accept:         rfcomm_sock_accept,
28765 +       getname:        rfcomm_sock_getname,
28766 +       sendmsg:        rfcomm_sock_sendmsg,
28767 +       recvmsg:        rfcomm_sock_recvmsg,
28768 +       shutdown:       rfcomm_sock_shutdown,
28769 +       setsockopt:     rfcomm_sock_setsockopt,
28770 +       getsockopt:     rfcomm_sock_getsockopt,
28771 +       ioctl:          rfcomm_sock_ioctl,
28772 +       poll:           bluez_sock_poll,
28773 +       socketpair:     sock_no_socketpair,
28774 +       mmap:           sock_no_mmap
28775 +};
28776 +
28777 +static struct net_proto_family rfcomm_sock_family_ops = {
28778 +       family:         PF_BLUETOOTH,
28779 +       create:         rfcomm_sock_create
28780 +};
28781 +
28782 +int rfcomm_init_sockets(void)
28783 +{
28784 +       int err;
28785 +
28786 +       if ((err = bluez_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops))) {
28787 +               BT_ERR("Can't register RFCOMM socket layer");
28788 +               return err;
28789 +       }
28790 +
28791 +       return 0;
28792 +}
28793 +
28794 +void rfcomm_cleanup_sockets(void)
28795 +{
28796 +       int err;
28797 +
28798 +       /* Unregister socket, protocol and notifier */
28799 +       if ((err = bluez_sock_unregister(BTPROTO_RFCOMM)))
28800 +               BT_ERR("Can't unregister RFCOMM socket layer %d", err);
28801 +}
28802 diff -urN linux-2.4.18/net/bluetooth/rfcomm/tty.c linux-2.4.18-mh9/net/bluetooth/rfcomm/tty.c
28803 --- linux-2.4.18/net/bluetooth/rfcomm/tty.c     Thu Jan  1 01:00:00 1970
28804 +++ linux-2.4.18-mh9/net/bluetooth/rfcomm/tty.c Mon Aug 25 18:38:12 2003
28805 @@ -0,0 +1,945 @@
28806 +/*
28807 +   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
28808 +   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
28809 +   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
28810 +
28811 +   This program is free software; you can redistribute it and/or modify
28812 +   it under the terms of the GNU General Public License version 2 as
28813 +   published by the Free Software Foundation;
28814 +
28815 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
28816 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
28817 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
28818 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
28819 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
28820 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
28821 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
28822 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
28823 +
28824 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
28825 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
28826 +   SOFTWARE IS DISCLAIMED.
28827 +*/
28828 +
28829 +/*
28830 + * RFCOMM TTY.
28831 + *
28832 + * $Id: tty.c,v 1.26 2002/10/18 20:12:12 maxk Exp $
28833 + */
28834 +
28835 +#include <linux/config.h>
28836 +#include <linux/module.h>
28837 +
28838 +#include <linux/tty.h>
28839 +#include <linux/tty_driver.h>
28840 +#include <linux/tty_flip.h>
28841 +
28842 +#include <linux/slab.h>
28843 +#include <linux/skbuff.h>
28844 +
28845 +#include <net/bluetooth/bluetooth.h>
28846 +#include <net/bluetooth/rfcomm.h>
28847 +
28848 +#ifndef CONFIG_BLUEZ_RFCOMM_DEBUG
28849 +#undef  BT_DBG
28850 +#define BT_DBG(D...)
28851 +#endif
28852 +
28853 +#define RFCOMM_TTY_MAGIC 0x6d02                /* magic number for rfcomm struct */
28854 +#define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV        /* whole lotta rfcomm devices */
28855 +#define RFCOMM_TTY_MAJOR 216           /* device node major id of the usb/bluetooth.c driver */
28856 +#define RFCOMM_TTY_MINOR 0
28857 +
28858 +struct rfcomm_dev {
28859 +       struct list_head        list;
28860 +       atomic_t                refcnt;
28861 +
28862 +       char                    name[12];
28863 +       int                     id;
28864 +       unsigned long           flags;
28865 +       int                     opened;
28866 +       int                     err;
28867 +
28868 +       bdaddr_t                src;
28869 +       bdaddr_t                dst;
28870 +       u8                      channel;
28871 +
28872 +       uint                    modem_status;
28873 +
28874 +       struct rfcomm_dlc       *dlc;
28875 +       struct tty_struct       *tty;
28876 +       wait_queue_head_t       wait;
28877 +       struct tasklet_struct   wakeup_task;
28878 +
28879 +       atomic_t                wmem_alloc;
28880 +};
28881 +
28882 +static LIST_HEAD(rfcomm_dev_list);
28883 +static rwlock_t rfcomm_dev_lock = RW_LOCK_UNLOCKED;
28884 +
28885 +static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
28886 +static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
28887 +static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
28888 +
28889 +static void rfcomm_tty_wakeup(unsigned long arg);
28890 +
28891 +/* ---- Device functions ---- */
28892 +static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
28893 +{
28894 +       struct rfcomm_dlc *dlc = dev->dlc;
28895 +
28896 +       BT_DBG("dev %p dlc %p", dev, dlc);
28897 +
28898 +       rfcomm_dlc_lock(dlc);
28899 +       /* Detach DLC if it's owned by this dev */
28900 +       if (dlc->owner == dev)
28901 +               dlc->owner = NULL;
28902 +       rfcomm_dlc_unlock(dlc);
28903 +
28904 +       rfcomm_dlc_put(dlc);
28905 +       kfree(dev);
28906 +
28907 +       MOD_DEC_USE_COUNT;
28908 +}
28909 +
28910 +static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
28911 +{
28912 +       atomic_inc(&dev->refcnt);
28913 +}
28914 +
28915 +static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
28916 +{
28917 +       if (atomic_dec_and_test(&dev->refcnt))
28918 +               rfcomm_dev_destruct(dev);
28919 +}
28920 +
28921 +static struct rfcomm_dev *__rfcomm_dev_get(int id)
28922 +{
28923 +       struct rfcomm_dev *dev;
28924 +       struct list_head  *p;
28925 +
28926 +       list_for_each(p, &rfcomm_dev_list) {
28927 +               dev = list_entry(p, struct rfcomm_dev, list);
28928 +               if (dev->id == id)
28929 +                       return dev;
28930 +       }
28931 +
28932 +       return NULL;
28933 +}
28934 +
28935 +static inline struct rfcomm_dev *rfcomm_dev_get(int id)
28936 +{
28937 +       struct rfcomm_dev *dev;
28938 +
28939 +       read_lock(&rfcomm_dev_lock);
28940 +       dev = __rfcomm_dev_get(id);
28941 +       read_unlock(&rfcomm_dev_lock);
28942 +
28943 +       if (dev) rfcomm_dev_hold(dev);
28944 +       return dev;
28945 +}
28946 +
28947 +static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
28948 +{
28949 +       struct rfcomm_dev *dev;
28950 +       struct list_head *head = &rfcomm_dev_list, *p;
28951 +       int err = 0;
28952 +
28953 +       BT_DBG("id %d channel %d", req->dev_id, req->channel);
28954 +
28955 +       dev = kmalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
28956 +       if (!dev)
28957 +               return -ENOMEM;
28958 +       memset(dev, 0, sizeof(struct rfcomm_dev));
28959 +
28960 +       write_lock_bh(&rfcomm_dev_lock);
28961 +
28962 +       if (req->dev_id < 0) {
28963 +               dev->id = 0;
28964 +
28965 +               list_for_each(p, &rfcomm_dev_list) {
28966 +                       if (list_entry(p, struct rfcomm_dev, list)->id != dev->id)
28967 +                               break;
28968 +
28969 +                       dev->id++;
28970 +                       head = p;
28971 +               }
28972 +       } else {
28973 +               dev->id = req->dev_id;
28974 +
28975 +               list_for_each(p, &rfcomm_dev_list) {
28976 +                       struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list);
28977 +
28978 +                       if (entry->id == dev->id) {
28979 +                               err = -EADDRINUSE;
28980 +                               goto out;
28981 +                       }
28982 +
28983 +                       if (entry->id > dev->id - 1)
28984 +                               break;
28985 +
28986 +                       head = p;
28987 +               }
28988 +       }
28989 +
28990 +       if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
28991 +               err = -ENFILE;
28992 +               goto out;
28993 +       }
28994 +
28995 +       sprintf(dev->name, "rfcomm%d", dev->id);
28996 +
28997 +       list_add(&dev->list, head);
28998 +       atomic_set(&dev->refcnt, 1);
28999 +
29000 +       bacpy(&dev->src, &req->src);
29001 +       bacpy(&dev->dst, &req->dst);
29002 +       dev->channel = req->channel;
29003 +
29004 +       dev->flags = req->flags &
29005 +               ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
29006 +
29007 +       init_waitqueue_head(&dev->wait);
29008 +       tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev);
29009 +
29010 +       rfcomm_dlc_lock(dlc);
29011 +       dlc->data_ready   = rfcomm_dev_data_ready;
29012 +       dlc->state_change = rfcomm_dev_state_change;
29013 +       dlc->modem_status = rfcomm_dev_modem_status;
29014 +
29015 +       dlc->owner = dev;
29016 +       dev->dlc   = dlc;
29017 +       rfcomm_dlc_unlock(dlc);
29018 +
29019 +       MOD_INC_USE_COUNT;
29020 +
29021 +out:
29022 +       write_unlock_bh(&rfcomm_dev_lock);
29023 +
29024 +       if (err) {
29025 +               kfree(dev);
29026 +               return err;
29027 +       } else
29028 +               return dev->id;
29029 +}
29030 +
29031 +static void rfcomm_dev_del(struct rfcomm_dev *dev)
29032 +{
29033 +       BT_DBG("dev %p", dev);
29034 +
29035 +       write_lock_bh(&rfcomm_dev_lock);
29036 +       list_del_init(&dev->list);
29037 +       write_unlock_bh(&rfcomm_dev_lock);
29038 +
29039 +       rfcomm_dev_put(dev);
29040 +}
29041 +
29042 +/* ---- Send buffer ---- */
29043 +
29044 +static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
29045 +{
29046 +       /* We can't let it be zero, because we don't get a callback
29047 +          when tx_credits becomes nonzero, hence we'd never wake up */
29048 +       return dlc->mtu * (dlc->tx_credits?:1);
29049 +}
29050 +
29051 +static void rfcomm_wfree(struct sk_buff *skb)
29052 +{
29053 +       struct rfcomm_dev *dev = (void *) skb->sk;
29054 +       atomic_sub(skb->truesize, &dev->wmem_alloc);
29055 +       if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
29056 +               tasklet_schedule(&dev->wakeup_task);
29057 +       rfcomm_dev_put(dev);
29058 +}
29059 +
29060 +static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
29061 +{
29062 +       rfcomm_dev_hold(dev);
29063 +       atomic_add(skb->truesize, &dev->wmem_alloc);
29064 +       skb->sk = (void *) dev;
29065 +       skb->destructor = rfcomm_wfree;
29066 +}
29067 +
29068 +static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, int force, int priority)
29069 +{
29070 +       if (force || atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
29071 +               struct sk_buff *skb = alloc_skb(size, priority);
29072 +               if (skb) {
29073 +                       rfcomm_set_owner_w(skb, dev);
29074 +                       return skb;
29075 +               }
29076 +       }
29077 +       return NULL;
29078 +}
29079 +
29080 +/* ---- Device IOCTLs ---- */
29081 +
29082 +#define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
29083 +
29084 +static int rfcomm_create_dev(struct sock *sk, unsigned long arg)
29085 +{
29086 +       struct rfcomm_dev_req req;
29087 +       struct rfcomm_dlc *dlc;
29088 +       int id;
29089 +
29090 +       if (copy_from_user(&req, (void *) arg, sizeof(req)))
29091 +               return -EFAULT;
29092 +
29093 +       BT_DBG("sk %p dev_id %id flags 0x%x", sk, req.dev_id, req.flags);
29094 +
29095 +       if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
29096 +               return -EPERM;
29097 +
29098 +       if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
29099 +               /* Socket must be connected */
29100 +               if (sk->state != BT_CONNECTED)
29101 +                       return -EBADFD;
29102 +
29103 +               dlc = rfcomm_pi(sk)->dlc;
29104 +               rfcomm_dlc_hold(dlc);
29105 +       } else {
29106 +               dlc = rfcomm_dlc_alloc(GFP_KERNEL);
29107 +               if (!dlc)
29108 +                       return -ENOMEM;
29109 +       }
29110 +
29111 +       id = rfcomm_dev_add(&req, dlc);
29112 +       if (id < 0) {
29113 +               rfcomm_dlc_put(dlc);
29114 +               return id;
29115 +       }
29116 +
29117 +       if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
29118 +               /* DLC is now used by device.
29119 +                * Socket must be disconnected */
29120 +               sk->state = BT_CLOSED;
29121 +       }
29122 +
29123 +       return id;
29124 +}
29125 +
29126 +static int rfcomm_release_dev(unsigned long arg)
29127 +{
29128 +       struct rfcomm_dev_req req;
29129 +       struct rfcomm_dev *dev;
29130 +
29131 +       if (copy_from_user(&req, (void *) arg, sizeof(req)))
29132 +               return -EFAULT;
29133 +
29134 +       BT_DBG("dev_id %id flags 0x%x", req.dev_id, req.flags);
29135 +
29136 +       if (!capable(CAP_NET_ADMIN))
29137 +               return -EPERM;
29138 +
29139 +       if (!(dev = rfcomm_dev_get(req.dev_id)))
29140 +               return -ENODEV;
29141 +
29142 +       if (req.flags & (1 << RFCOMM_HANGUP_NOW))
29143 +               rfcomm_dlc_close(dev->dlc, 0);
29144 +
29145 +       rfcomm_dev_del(dev);
29146 +       rfcomm_dev_put(dev);
29147 +       return 0;
29148 +}
29149 +
29150 +static int rfcomm_get_dev_list(unsigned long arg)
29151 +{
29152 +       struct rfcomm_dev_list_req *dl;
29153 +       struct rfcomm_dev_info *di;
29154 +       struct list_head *p;
29155 +       int n = 0, size;
29156 +       u16 dev_num;
29157 +
29158 +       BT_DBG("");
29159 +
29160 +       if (get_user(dev_num, (u16 *) arg))
29161 +               return -EFAULT;
29162 +
29163 +       if (!dev_num)
29164 +               return -EINVAL;
29165 +
29166 +       size = sizeof(*dl) + dev_num * sizeof(*di);
29167 +
29168 +       if (verify_area(VERIFY_WRITE, (void *)arg, size))
29169 +               return -EFAULT;
29170 +
29171 +       if (!(dl = kmalloc(size, GFP_KERNEL)))
29172 +               return -ENOMEM;
29173 +
29174 +       di = dl->dev_info;
29175 +
29176 +       read_lock_bh(&rfcomm_dev_lock);
29177 +
29178 +       list_for_each(p, &rfcomm_dev_list) {
29179 +               struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
29180 +               (di + n)->id      = dev->id;
29181 +               (di + n)->flags   = dev->flags;
29182 +               (di + n)->state   = dev->dlc->state;
29183 +               (di + n)->channel = dev->channel;
29184 +               bacpy(&(di + n)->src, &dev->src);
29185 +               bacpy(&(di + n)->dst, &dev->dst);
29186 +               if (++n >= dev_num)
29187 +                       break;
29188 +       }
29189 +
29190 +       read_unlock_bh(&rfcomm_dev_lock);
29191 +
29192 +       dl->dev_num = n;
29193 +       size = sizeof(*dl) + n * sizeof(*di);
29194 +
29195 +       copy_to_user((void *) arg, dl, size);
29196 +       kfree(dl);
29197 +       return 0;
29198 +}
29199 +
29200 +static int rfcomm_get_dev_info(unsigned long arg)
29201 +{
29202 +       struct rfcomm_dev *dev;
29203 +       struct rfcomm_dev_info di;
29204 +       int err = 0;
29205 +
29206 +       BT_DBG("");
29207 +
29208 +       if (copy_from_user(&di, (void *)arg, sizeof(di)))
29209 +               return -EFAULT;
29210 +
29211 +       if (!(dev = rfcomm_dev_get(di.id)))
29212 +               return -ENODEV;
29213 +
29214 +       di.flags   = dev->flags;
29215 +       di.channel = dev->channel;
29216 +       di.state   = dev->dlc->state;
29217 +       bacpy(&di.src, &dev->src);
29218 +       bacpy(&di.dst, &dev->dst);
29219 +
29220 +       if (copy_to_user((void *)arg, &di, sizeof(di)))
29221 +               err = -EFAULT;
29222 +
29223 +       rfcomm_dev_put(dev);
29224 +       return err;
29225 +}
29226 +
29227 +int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
29228 +{
29229 +       BT_DBG("cmd %d arg %ld", cmd, arg);
29230 +
29231 +       switch (cmd) {
29232 +       case RFCOMMCREATEDEV:
29233 +               return rfcomm_create_dev(sk, arg);
29234 +
29235 +       case RFCOMMRELEASEDEV:
29236 +               return rfcomm_release_dev(arg);
29237 +
29238 +       case RFCOMMGETDEVLIST:
29239 +               return rfcomm_get_dev_list(arg);
29240 +
29241 +       case RFCOMMGETDEVINFO:
29242 +               return rfcomm_get_dev_info(arg);
29243 +       }
29244 +
29245 +       return -EINVAL;
29246 +}
29247 +
29248 +/* ---- DLC callbacks ---- */
29249 +static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
29250 +{
29251 +       struct rfcomm_dev *dev = dlc->owner;
29252 +       struct tty_struct *tty;
29253 +
29254 +       if (!dev || !(tty = dev->tty)) {
29255 +               kfree_skb(skb);
29256 +               return;
29257 +       }
29258 +
29259 +       BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
29260 +
29261 +       if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
29262 +               register int i;
29263 +               for (i = 0; i < skb->len; i++) {
29264 +                       if (tty->flip.count >= TTY_FLIPBUF_SIZE)
29265 +                               tty_flip_buffer_push(tty);
29266 +
29267 +                       tty_insert_flip_char(tty, skb->data[i], 0);
29268 +               }
29269 +               tty_flip_buffer_push(tty);
29270 +       } else
29271 +               tty->ldisc.receive_buf(tty, skb->data, NULL, skb->len);
29272 +
29273 +       kfree_skb(skb);
29274 +}
29275 +
29276 +static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
29277 +{
29278 +       struct rfcomm_dev *dev = dlc->owner;
29279 +       if (!dev)
29280 +               return;
29281 +
29282 +       BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
29283 +
29284 +       dev->err = err;
29285 +       wake_up_interruptible(&dev->wait);
29286 +
29287 +       if (dlc->state == BT_CLOSED) {
29288 +               if (!dev->tty) {
29289 +                       if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
29290 +                               rfcomm_dev_hold(dev);
29291 +                               rfcomm_dev_del(dev);
29292 +
29293 +                               /* We have to drop DLC lock here, otherwise
29294 +                                * rfcomm_dev_put() will dead lock if it's the last refference */
29295 +                               rfcomm_dlc_unlock(dlc);
29296 +                               rfcomm_dev_put(dev);
29297 +                               rfcomm_dlc_lock(dlc);
29298 +                       }
29299 +               } else
29300 +                       tty_hangup(dev->tty);
29301 +       }
29302 +}
29303 +
29304 +static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
29305 +{
29306 +       struct rfcomm_dev *dev = dlc->owner;
29307 +       if (!dev)
29308 +               return;
29309 +
29310 +       BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
29311 +
29312 +       dev->modem_status =
29313 +               ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
29314 +               ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
29315 +               ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
29316 +               ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
29317 +}
29318 +
29319 +/* ---- TTY functions ---- */
29320 +static void rfcomm_tty_wakeup(unsigned long arg)
29321 +{
29322 +       struct rfcomm_dev *dev = (void *) arg;
29323 +       struct tty_struct *tty = dev->tty;
29324 +       if (!tty)
29325 +               return;
29326 +
29327 +       BT_DBG("dev %p tty %p", dev, tty);
29328 +
29329 +       if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
29330 +                (tty->ldisc.write_wakeup)(tty);
29331 +
29332 +       wake_up_interruptible(&tty->write_wait);
29333 +#ifdef SERIAL_HAVE_POLL_WAIT
29334 +       wake_up_interruptible(&tty->poll_wait);
29335 +#endif
29336 +}
29337 +
29338 +static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
29339 +{
29340 +       DECLARE_WAITQUEUE(wait, current);
29341 +       struct rfcomm_dev *dev;
29342 +       struct rfcomm_dlc *dlc;
29343 +       int err, id;
29344 +
29345 +       id = MINOR(tty->device) - tty->driver.minor_start;
29346 +
29347 +       BT_DBG("tty %p id %d", tty, id);
29348 +
29349 +       dev = rfcomm_dev_get(id);
29350 +       if (!dev)
29351 +               return -ENODEV;
29352 +
29353 +       BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst), dev->channel, dev->opened);
29354 +
29355 +       if (dev->opened++ != 0)
29356 +               return 0;
29357 +
29358 +       dlc = dev->dlc;
29359 +
29360 +       /* Attach TTY and open DLC */
29361 +
29362 +       rfcomm_dlc_lock(dlc);
29363 +       tty->driver_data = dev;
29364 +       dev->tty = tty;
29365 +       rfcomm_dlc_unlock(dlc);
29366 +       set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
29367 +
29368 +       err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
29369 +       if (err < 0)
29370 +               return err;
29371 +
29372 +       /* Wait for DLC to connect */
29373 +       add_wait_queue(&dev->wait, &wait);
29374 +       while (1) {
29375 +               set_current_state(TASK_INTERRUPTIBLE);
29376 +
29377 +               if (dlc->state == BT_CLOSED) {
29378 +                       err = -dev->err;
29379 +                       break;
29380 +               }
29381 +
29382 +               if (dlc->state == BT_CONNECTED)
29383 +                       break;
29384 +
29385 +               if (signal_pending(current)) {
29386 +                       err = -EINTR;
29387 +                       break;
29388 +               }
29389 +
29390 +               schedule();
29391 +       }
29392 +       set_current_state(TASK_RUNNING);
29393 +       remove_wait_queue(&dev->wait, &wait);
29394 +
29395 +       return err;
29396 +}
29397 +
29398 +static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
29399 +{
29400 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29401 +       if (!dev)
29402 +               return;
29403 +
29404 +       BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, dev->opened);
29405 +
29406 +       if (--dev->opened == 0) {
29407 +               /* Close DLC and dettach TTY */
29408 +               rfcomm_dlc_close(dev->dlc, 0);
29409 +
29410 +               clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
29411 +               tasklet_kill(&dev->wakeup_task);
29412 +
29413 +               rfcomm_dlc_lock(dev->dlc);
29414 +               tty->driver_data = NULL;
29415 +               dev->tty = NULL;
29416 +               rfcomm_dlc_unlock(dev->dlc);
29417 +       }
29418 +
29419 +       rfcomm_dev_put(dev);
29420 +}
29421 +
29422 +static int rfcomm_tty_write(struct tty_struct *tty, int from_user, const unsigned char *buf, int count)
29423 +{
29424 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29425 +       struct rfcomm_dlc *dlc = dev->dlc;
29426 +       struct sk_buff *skb;
29427 +       int err = 0, sent = 0, size;
29428 +
29429 +       BT_DBG("tty %p from_user %d count %d", tty, from_user, count);
29430 +
29431 +       while (count) {
29432 +               size = min_t(uint, count, dlc->mtu);
29433 +
29434 +               if (from_user)
29435 +                       skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, 0, GFP_KERNEL);
29436 +               else
29437 +                       skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, 0, GFP_ATOMIC);
29438 +
29439 +               if (!skb)
29440 +                       break;
29441 +
29442 +               skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
29443 +
29444 +               if (from_user)
29445 +                       copy_from_user(skb_put(skb, size), buf + sent, size);
29446 +               else
29447 +                       memcpy(skb_put(skb, size), buf + sent, size);
29448 +
29449 +               if ((err = rfcomm_dlc_send(dlc, skb)) < 0) {
29450 +                       kfree_skb(skb);
29451 +                       break;
29452 +               }
29453 +
29454 +               sent  += size;
29455 +               count -= size;
29456 +       }
29457 +
29458 +       return sent ? sent : err;
29459 +}
29460 +
29461 +static void rfcomm_tty_put_char(struct tty_struct *tty, unsigned char ch)
29462 +{
29463 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29464 +       struct rfcomm_dlc *dlc = dev->dlc;
29465 +       struct sk_buff *skb;
29466 +
29467 +       BT_DBG("tty %p char %x", tty, ch);
29468 +
29469 +       skb = rfcomm_wmalloc(dev, 1 + RFCOMM_SKB_RESERVE, 1, GFP_ATOMIC);
29470 +
29471 +       if (!skb)
29472 +               return;
29473 +
29474 +       skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
29475 +
29476 +       *(char *)skb_put(skb, 1) = ch;
29477 +
29478 +       if ((rfcomm_dlc_send(dlc, skb)) < 0)
29479 +               kfree_skb(skb);
29480 +}
29481 +
29482 +static int rfcomm_tty_write_room(struct tty_struct *tty)
29483 +{
29484 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29485 +       int room;
29486 +
29487 +       BT_DBG("tty %p", tty);
29488 +
29489 +       room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
29490 +       if (room < 0)
29491 +               room = 0;
29492 +
29493 +       return room;
29494 +}
29495 +
29496 +static int rfcomm_tty_set_modem_status(uint cmd, struct rfcomm_dlc *dlc, uint status)
29497 +{
29498 +       u8 v24_sig, mask;
29499 +
29500 +       BT_DBG("dlc %p cmd 0x%02x", dlc, cmd);
29501 +
29502 +       if (cmd == TIOCMSET)
29503 +               v24_sig = 0;
29504 +       else
29505 +               rfcomm_dlc_get_modem_status(dlc, &v24_sig);
29506 +
29507 +       mask =  ((status & TIOCM_DSR) ? RFCOMM_V24_RTC : 0) |
29508 +               ((status & TIOCM_DTR) ? RFCOMM_V24_RTC : 0) |
29509 +               ((status & TIOCM_RTS) ? RFCOMM_V24_RTR : 0) |
29510 +               ((status & TIOCM_CTS) ? RFCOMM_V24_RTR : 0) |
29511 +               ((status & TIOCM_RI)  ? RFCOMM_V24_IC  : 0) |
29512 +               ((status & TIOCM_CD)  ? RFCOMM_V24_DV  : 0);
29513 +
29514 +       if (cmd == TIOCMBIC)
29515 +               v24_sig &= ~mask;
29516 +       else
29517 +               v24_sig |= mask;
29518 +
29519 +       rfcomm_dlc_set_modem_status(dlc, v24_sig);
29520 +       return 0;
29521 +}
29522 +
29523 +static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd, unsigned long arg)
29524 +{
29525 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29526 +       struct rfcomm_dlc *dlc = dev->dlc;
29527 +       uint status;
29528 +       int err;
29529 +
29530 +       BT_DBG("tty %p cmd 0x%02x", tty, cmd);
29531 +
29532 +       switch (cmd) {
29533 +       case TCGETS:
29534 +               BT_DBG("TCGETS is not supported");
29535 +               return -ENOIOCTLCMD;
29536 +
29537 +       case TCSETS:
29538 +               BT_DBG("TCSETS is not supported");
29539 +               return -ENOIOCTLCMD;
29540 +
29541 +       case TIOCMGET:
29542 +               BT_DBG("TIOCMGET");
29543 +
29544 +               return put_user(dev->modem_status, (unsigned int *)arg);
29545 +
29546 +       case TIOCMSET: /* Turns on and off the lines as specified by the mask */
29547 +       case TIOCMBIS: /* Turns on the lines as specified by the mask */
29548 +       case TIOCMBIC: /* Turns off the lines as specified by the mask */
29549 +               if ((err = get_user(status, (unsigned int *)arg)))
29550 +                       return err;
29551 +               return rfcomm_tty_set_modem_status(cmd, dlc, status);
29552 +
29553 +       case TIOCMIWAIT:
29554 +               BT_DBG("TIOCMIWAIT");
29555 +               break;
29556 +
29557 +       case TIOCGICOUNT:
29558 +               BT_DBG("TIOCGICOUNT");
29559 +               break;
29560 +
29561 +       case TIOCGSERIAL:
29562 +               BT_ERR("TIOCGSERIAL is not supported");
29563 +               return -ENOIOCTLCMD;
29564 +
29565 +       case TIOCSSERIAL:
29566 +               BT_ERR("TIOCSSERIAL is not supported");
29567 +               return -ENOIOCTLCMD;
29568 +
29569 +       case TIOCSERGSTRUCT:
29570 +               BT_ERR("TIOCSERGSTRUCT is not supported");
29571 +               return -ENOIOCTLCMD;
29572 +
29573 +       case TIOCSERGETLSR:
29574 +               BT_ERR("TIOCSERGETLSR is not supported");
29575 +               return -ENOIOCTLCMD;
29576 +
29577 +       case TIOCSERCONFIG:
29578 +               BT_ERR("TIOCSERCONFIG is not supported");
29579 +               return -ENOIOCTLCMD;
29580 +
29581 +       default:
29582 +               return -ENOIOCTLCMD;    /* ioctls which we must ignore */
29583 +
29584 +       }
29585 +
29586 +       return -ENOIOCTLCMD;
29587 +}
29588 +
29589 +#define RELEVANT_IFLAG(iflag) (iflag & (IGNBRK|BRKINT|IGNPAR|PARMRK|INPCK))
29590 +
29591 +static void rfcomm_tty_set_termios(struct tty_struct *tty, struct termios *old)
29592 +{
29593 +       BT_DBG("tty %p", tty);
29594 +
29595 +       if ((tty->termios->c_cflag == old->c_cflag) &&
29596 +               (RELEVANT_IFLAG(tty->termios->c_iflag) == RELEVANT_IFLAG(old->c_iflag)))
29597 +               return;
29598 +
29599 +       /* handle turning off CRTSCTS */
29600 +       if ((old->c_cflag & CRTSCTS) && !(tty->termios->c_cflag & CRTSCTS)) {
29601 +               BT_DBG("turning off CRTSCTS");
29602 +       }
29603 +}
29604 +
29605 +static void rfcomm_tty_throttle(struct tty_struct *tty)
29606 +{
29607 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29608 +
29609 +       BT_DBG("tty %p dev %p", tty, dev);
29610 +
29611 +       rfcomm_dlc_throttle(dev->dlc);
29612 +}
29613 +
29614 +static void rfcomm_tty_unthrottle(struct tty_struct *tty)
29615 +{
29616 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29617 +
29618 +       BT_DBG("tty %p dev %p", tty, dev);
29619 +
29620 +       rfcomm_dlc_unthrottle(dev->dlc);
29621 +}
29622 +
29623 +static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
29624 +{
29625 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29626 +       struct rfcomm_dlc *dlc = dev->dlc;
29627 +
29628 +       BT_DBG("tty %p dev %p", tty, dev);
29629 +
29630 +       if (skb_queue_len(&dlc->tx_queue))
29631 +               return dlc->mtu;
29632 +
29633 +       return 0;
29634 +}
29635 +
29636 +static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
29637 +{
29638 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29639 +       if (!dev)
29640 +               return;
29641 +
29642 +       BT_DBG("tty %p dev %p", tty, dev);
29643 +
29644 +       skb_queue_purge(&dev->dlc->tx_queue);
29645 +
29646 +       if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
29647 +               tty->ldisc.write_wakeup(tty);
29648 +}
29649 +
29650 +static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
29651 +{
29652 +       BT_DBG("tty %p ch %c", tty, ch);
29653 +}
29654 +
29655 +static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
29656 +{
29657 +       BT_DBG("tty %p timeout %d", tty, timeout);
29658 +}
29659 +
29660 +static void rfcomm_tty_hangup(struct tty_struct *tty)
29661 +{
29662 +       struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
29663 +       if (!dev)
29664 +               return;
29665 +
29666 +       BT_DBG("tty %p dev %p", tty, dev);
29667 +
29668 +       rfcomm_tty_flush_buffer(tty);
29669 +
29670 +       if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
29671 +               rfcomm_dev_del(dev);
29672 +}
29673 +
29674 +static int rfcomm_tty_read_proc(char *buf, char **start, off_t offset, int len, int *eof, void *unused)
29675 +{
29676 +       return 0;
29677 +}
29678 +
29679 +/* ---- TTY structure ---- */
29680 +static int    rfcomm_tty_refcount;       /* If we manage several devices */
29681 +
29682 +static struct tty_struct *rfcomm_tty_table[RFCOMM_TTY_PORTS];
29683 +static struct termios *rfcomm_tty_termios[RFCOMM_TTY_PORTS];
29684 +static struct termios *rfcomm_tty_termios_locked[RFCOMM_TTY_PORTS];
29685 +
29686 +static struct tty_driver rfcomm_tty_driver = {
29687 +       magic:                  TTY_DRIVER_MAGIC,
29688 +       driver_name:            "rfcomm",
29689 +#ifdef CONFIG_DEVFS_FS
29690 +       name:                   "bluetooth/rfcomm/%d",
29691 +#else
29692 +       name:                   "rfcomm",
29693 +#endif
29694 +       major:                  RFCOMM_TTY_MAJOR,
29695 +       minor_start:            RFCOMM_TTY_MINOR,
29696 +       num:                    RFCOMM_TTY_PORTS,
29697 +       type:                   TTY_DRIVER_TYPE_SERIAL,
29698 +       subtype:                SERIAL_TYPE_NORMAL,
29699 +       flags:                  TTY_DRIVER_REAL_RAW,
29700 +
29701 +       refcount:               &rfcomm_tty_refcount,
29702 +       table:                  rfcomm_tty_table,
29703 +       termios:                rfcomm_tty_termios,
29704 +       termios_locked:         rfcomm_tty_termios_locked,
29705 +
29706 +       open:                   rfcomm_tty_open,
29707 +       close:                  rfcomm_tty_close,
29708 +       put_char:               rfcomm_tty_put_char,
29709 +       write:                  rfcomm_tty_write,
29710 +       write_room:             rfcomm_tty_write_room,
29711 +       chars_in_buffer:        rfcomm_tty_chars_in_buffer,
29712 +       flush_buffer:           rfcomm_tty_flush_buffer,
29713 +       ioctl:                  rfcomm_tty_ioctl,
29714 +       throttle:               rfcomm_tty_throttle,
29715 +       unthrottle:             rfcomm_tty_unthrottle,
29716 +       set_termios:            rfcomm_tty_set_termios,
29717 +       send_xchar:             rfcomm_tty_send_xchar,
29718 +       stop:                   NULL,
29719 +       start:                  NULL,
29720 +       hangup:                 rfcomm_tty_hangup,
29721 +       wait_until_sent:        rfcomm_tty_wait_until_sent,
29722 +       read_proc:              rfcomm_tty_read_proc,
29723 +};
29724 +
29725 +int rfcomm_init_ttys(void)
29726 +{
29727 +       int i;
29728 +
29729 +       /* Initalize our global data */
29730 +       for (i = 0; i < RFCOMM_TTY_PORTS; i++)
29731 +               rfcomm_tty_table[i] = NULL;
29732 +
29733 +       /* Register the TTY driver */
29734 +       rfcomm_tty_driver.init_termios = tty_std_termios;
29735 +       rfcomm_tty_driver.init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
29736 +       rfcomm_tty_driver.flags = TTY_DRIVER_REAL_RAW;
29737 +
29738 +       if (tty_register_driver(&rfcomm_tty_driver)) {
29739 +               BT_ERR("Can't register RFCOMM TTY driver");
29740 +               return -1;
29741 +       }
29742 +
29743 +       return 0;
29744 +}
29745 +
29746 +void rfcomm_cleanup_ttys(void)
29747 +{
29748 +       tty_unregister_driver(&rfcomm_tty_driver);
29749 +       return;
29750 +}
29751 diff -urN linux-2.4.18/net/bluetooth/sco.c linux-2.4.18-mh9/net/bluetooth/sco.c
29752 --- linux-2.4.18/net/bluetooth/sco.c    Thu Jan  1 01:00:00 1970
29753 +++ linux-2.4.18-mh9/net/bluetooth/sco.c        Mon Aug 25 18:38:12 2003
29754 @@ -0,0 +1,1019 @@
29755 +/*
29756 +   BlueZ - Bluetooth protocol stack for Linux
29757 +   Copyright (C) 2000-2001 Qualcomm Incorporated
29758 +
29759 +   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
29760 +
29761 +   This program is free software; you can redistribute it and/or modify
29762 +   it under the terms of the GNU General Public License version 2 as
29763 +   published by the Free Software Foundation;
29764 +
29765 +   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
29766 +   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
29767 +   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
29768 +   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
29769 +   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
29770 +   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
29771 +   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
29772 +   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
29773 +
29774 +   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
29775 +   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
29776 +   SOFTWARE IS DISCLAIMED.
29777 +*/
29778 +
29779 +/*
29780 + * BlueZ SCO sockets.
29781 + *
29782 + * $Id: sco.c,v 1.4 2002/07/22 20:32:54 maxk Exp $
29783 + */
29784 +#define VERSION "0.3"
29785 +
29786 +#include <linux/config.h>
29787 +#include <linux/module.h>
29788 +
29789 +#include <linux/types.h>
29790 +#include <linux/errno.h>
29791 +#include <linux/kernel.h>
29792 +#include <linux/major.h>
29793 +#include <linux/sched.h>
29794 +#include <linux/slab.h>
29795 +#include <linux/poll.h>
29796 +#include <linux/fcntl.h>
29797 +#include <linux/init.h>
29798 +#include <linux/skbuff.h>
29799 +#include <linux/interrupt.h>
29800 +#include <linux/socket.h>
29801 +#include <linux/skbuff.h>
29802 +#include <linux/proc_fs.h>
29803 +#include <linux/list.h>
29804 +#include <net/sock.h>
29805 +
29806 +#include <asm/system.h>
29807 +#include <asm/uaccess.h>
29808 +
29809 +#include <net/bluetooth/bluetooth.h>
29810 +#include <net/bluetooth/hci_core.h>
29811 +#include <net/bluetooth/sco.h>
29812 +
29813 +#ifndef SCO_DEBUG
29814 +#undef  BT_DBG
29815 +#define BT_DBG( A... )
29816 +#endif
29817 +
29818 +static struct proto_ops sco_sock_ops;
29819 +
29820 +static struct bluez_sock_list sco_sk_list = {
29821 +       lock: RW_LOCK_UNLOCKED
29822 +};
29823 +
29824 +static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent);
29825 +static void sco_chan_del(struct sock *sk, int err);
29826 +static inline struct sock * sco_chan_get(struct sco_conn *conn);
29827 +
29828 +static int  sco_conn_del(struct hci_conn *conn, int err);
29829 +
29830 +static void sco_sock_close(struct sock *sk);
29831 +static void sco_sock_kill(struct sock *sk);
29832 +
29833 +/* ----- SCO timers ------ */
29834 +static void sco_sock_timeout(unsigned long arg)
29835 +{
29836 +       struct sock *sk = (struct sock *) arg;
29837 +
29838 +       BT_DBG("sock %p state %d", sk, sk->state);
29839 +
29840 +       bh_lock_sock(sk);
29841 +       sk->err = ETIMEDOUT;
29842 +       sk->state_change(sk);
29843 +       bh_unlock_sock(sk);
29844 +
29845 +       sco_sock_kill(sk);
29846 +       sock_put(sk);
29847 +}
29848 +
29849 +static void sco_sock_set_timer(struct sock *sk, long timeout)
29850 +{
29851 +       BT_DBG("sock %p state %d timeout %ld", sk, sk->state, timeout);
29852 +
29853 +       if (!mod_timer(&sk->timer, jiffies + timeout))
29854 +               sock_hold(sk);
29855 +}
29856 +
29857 +static void sco_sock_clear_timer(struct sock *sk)
29858 +{
29859 +       BT_DBG("sock %p state %d", sk, sk->state);
29860 +
29861 +       if (timer_pending(&sk->timer) && del_timer(&sk->timer))
29862 +               __sock_put(sk);
29863 +}
29864 +
29865 +static void sco_sock_init_timer(struct sock *sk)
29866 +{
29867 +       init_timer(&sk->timer);
29868 +       sk->timer.function = sco_sock_timeout;
29869 +       sk->timer.data = (unsigned long)sk;
29870 +}
29871 +
29872 +/* -------- SCO connections --------- */
29873 +static struct sco_conn *sco_conn_add(struct hci_conn *hcon, __u8 status)
29874 +{
29875 +       struct hci_dev *hdev = hcon->hdev;
29876 +       struct sco_conn *conn;
29877 +
29878 +       if ((conn = hcon->sco_data))
29879 +               return conn;
29880 +
29881 +       if (status)
29882 +               return conn;
29883 +
29884 +       if (!(conn = kmalloc(sizeof(struct sco_conn), GFP_ATOMIC)))
29885 +               return NULL;
29886 +       memset(conn, 0, sizeof(struct sco_conn));
29887 +
29888 +       spin_lock_init(&conn->lock);
29889 +
29890 +       hcon->sco_data = conn;
29891 +       conn->hcon = hcon;
29892 +
29893 +       conn->src = &hdev->bdaddr;
29894 +       conn->dst = &hcon->dst;
29895 +
29896 +       if (hdev->sco_mtu > 0)
29897 +               conn->mtu = hdev->sco_mtu;
29898 +       else
29899 +               conn->mtu = 60;
29900 +
29901 +       BT_DBG("hcon %p conn %p", hcon, conn);
29902 +
29903 +       MOD_INC_USE_COUNT;
29904 +       return conn;
29905 +}
29906 +
29907 +static int sco_conn_del(struct hci_conn *hcon, int err)
29908 +{
29909 +       struct sco_conn *conn;
29910 +       struct sock *sk;
29911 +
29912 +       if (!(conn = hcon->sco_data))
29913 +               return 0;
29914 +
29915 +       BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
29916 +
29917 +       /* Kill socket */
29918 +       if ((sk = sco_chan_get(conn))) {
29919 +               bh_lock_sock(sk);
29920 +               sco_sock_clear_timer(sk);
29921 +               sco_chan_del(sk, err);
29922 +               bh_unlock_sock(sk);
29923 +               sco_sock_kill(sk);
29924 +       }
29925 +
29926 +       hcon->sco_data = NULL;
29927 +       kfree(conn);
29928 +
29929 +       MOD_DEC_USE_COUNT;
29930 +       return 0;
29931 +}
29932 +
29933 +int sco_connect(struct sock *sk)
29934 +{
29935 +       bdaddr_t *src = &bluez_pi(sk)->src;
29936 +       bdaddr_t *dst = &bluez_pi(sk)->dst;
29937 +       struct sco_conn *conn;
29938 +       struct hci_conn *hcon;
29939 +       struct hci_dev  *hdev;
29940 +       int err = 0;
29941 +
29942 +       BT_DBG("%s -> %s", batostr(src), batostr(dst));
29943 +
29944 +       if (!(hdev = hci_get_route(dst, src)))
29945 +               return -EHOSTUNREACH;
29946 +
29947 +       hci_dev_lock_bh(hdev);
29948 +
29949 +       err = -ENOMEM;
29950 +
29951 +       hcon = hci_connect(hdev, SCO_LINK, dst);
29952 +       if (!hcon)
29953 +               goto done;
29954 +
29955 +       conn = sco_conn_add(hcon, 0);
29956 +       if (!conn) {
29957 +               hci_conn_put(hcon);
29958 +               goto done;
29959 +       }
29960 +
29961 +       /* Update source addr of the socket */
29962 +       bacpy(src, conn->src);
29963 +
29964 +       err = sco_chan_add(conn, sk, NULL);
29965 +       if (err)
29966 +               goto done;
29967 +
29968 +       if (hcon->state == BT_CONNECTED) {
29969 +               sco_sock_clear_timer(sk);
29970 +               sk->state = BT_CONNECTED;
29971 +       } else {
29972 +               sk->state = BT_CONNECT;
29973 +               sco_sock_set_timer(sk, sk->sndtimeo);
29974 +       }
29975 +done:
29976 +       hci_dev_unlock_bh(hdev);
29977 +       hci_dev_put(hdev);
29978 +       return err;
29979 +}
29980 +
29981 +static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
29982 +{
29983 +       struct sco_conn *conn = sco_pi(sk)->conn;
29984 +       struct sk_buff *skb;
29985 +       int err, count;
29986 +
29987 +       /* Check outgoing MTU */
29988 +       if (len > conn->mtu)
29989 +               return -EINVAL;
29990 +
29991 +       BT_DBG("sk %p len %d", sk, len);
29992 +
29993 +       count = MIN(conn->mtu, len);
29994 +       if (!(skb = bluez_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err)))
29995 +               return err;
29996 +
29997 +       if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
29998 +               err = -EFAULT;
29999 +               goto fail;
30000 +       }
30001 +
30002 +       if ((err = hci_send_sco(conn->hcon, skb)) < 0)
30003 +               goto fail;
30004 +
30005 +       return count;
30006 +
30007 +fail:
30008 +       kfree_skb(skb);
30009 +       return err;
30010 +}
30011 +
30012 +static inline void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
30013 +{
30014 +       struct sock *sk = sco_chan_get(conn);
30015 +
30016 +       if (!sk)
30017 +               goto drop;
30018 +
30019 +       BT_DBG("sk %p len %d", sk, skb->len);
30020 +
30021 +       if (sk->state != BT_CONNECTED)
30022 +               goto drop;
30023 +
30024 +       if (!sock_queue_rcv_skb(sk, skb))
30025 +               return;
30026 +
30027 +drop:
30028 +       kfree_skb(skb);
30029 +       return;
30030 +}
30031 +
30032 +/* -------- Socket interface ---------- */
30033 +static struct sock *__sco_get_sock_by_addr(bdaddr_t *ba)
30034 +{
30035 +       struct sock *sk;
30036 +
30037 +       for (sk = sco_sk_list.head; sk; sk = sk->next) {
30038 +               if (!bacmp(&bluez_pi(sk)->src, ba))
30039 +                       break;
30040 +       }
30041 +
30042 +       return sk;
30043 +}
30044 +
30045 +/* Find socket listening on source bdaddr.
30046 + * Returns closest match.
30047 + */
30048 +static struct sock *sco_get_sock_listen(bdaddr_t *src)
30049 +{
30050 +       struct sock *sk, *sk1 = NULL;
30051 +
30052 +       read_lock(&sco_sk_list.lock);
30053 +
30054 +       for (sk = sco_sk_list.head; sk; sk = sk->next) {
30055 +               if (sk->state != BT_LISTEN)
30056 +                       continue;
30057 +
30058 +               /* Exact match. */
30059 +               if (!bacmp(&bluez_pi(sk)->src, src))
30060 +                       break;
30061 +
30062 +               /* Closest match */
30063 +               if (!bacmp(&bluez_pi(sk)->src, BDADDR_ANY))
30064 +                       sk1 = sk;
30065 +       }
30066 +
30067 +       read_unlock(&sco_sk_list.lock);
30068 +
30069 +       return sk ? sk : sk1;
30070 +}
30071 +
30072 +static void sco_sock_destruct(struct sock *sk)
30073 +{
30074 +       BT_DBG("sk %p", sk);
30075 +
30076 +       skb_queue_purge(&sk->receive_queue);
30077 +       skb_queue_purge(&sk->write_queue);
30078 +
30079 +       MOD_DEC_USE_COUNT;
30080 +}
30081 +
30082 +static void sco_sock_cleanup_listen(struct sock *parent)
30083 +{
30084 +       struct sock *sk;
30085 +
30086 +       BT_DBG("parent %p", parent);
30087 +
30088 +       /* Close not yet accepted channels */
30089 +       while ((sk = bluez_accept_dequeue(parent, NULL))) {
30090 +               sco_sock_close(sk);
30091 +               sco_sock_kill(sk);
30092 +       }
30093 +
30094 +       parent->state  = BT_CLOSED;
30095 +       parent->zapped = 1;
30096 +}
30097 +
30098 +/* Kill socket (only if zapped and orphan)
30099 + * Must be called on unlocked socket.
30100 + */
30101 +static void sco_sock_kill(struct sock *sk)
30102 +{
30103 +       if (!sk->zapped || sk->socket)
30104 +               return;
30105 +
30106 +       BT_DBG("sk %p state %d", sk, sk->state);
30107 +
30108 +       /* Kill poor orphan */
30109 +       bluez_sock_unlink(&sco_sk_list, sk);
30110 +       sk->dead = 1;
30111 +       sock_put(sk);
30112 +}
30113 +
30114 +/* Close socket.
30115 + * Must be called on unlocked socket.
30116 + */
30117 +static void sco_sock_close(struct sock *sk)
30118 +{
30119 +       struct sco_conn *conn;
30120 +
30121 +       sco_sock_clear_timer(sk);
30122 +
30123 +       lock_sock(sk);
30124 +
30125 +       conn = sco_pi(sk)->conn;
30126 +
30127 +       BT_DBG("sk %p state %d conn %p socket %p", sk, sk->state, conn, sk->socket);
30128 +
30129 +       switch (sk->state) {
30130 +       case BT_LISTEN:
30131 +               sco_sock_cleanup_listen(sk);
30132 +               break;
30133 +
30134 +       case BT_CONNECTED:
30135 +       case BT_CONFIG:
30136 +       case BT_CONNECT:
30137 +       case BT_DISCONN:
30138 +               sco_chan_del(sk, ECONNRESET);
30139 +               break;
30140 +
30141 +       default:
30142 +               sk->zapped = 1;
30143 +               break;
30144 +       };
30145 +
30146 +       release_sock(sk);
30147 +}
30148 +
30149 +static void sco_sock_init(struct sock *sk, struct sock *parent)
30150 +{
30151 +       BT_DBG("sk %p", sk);
30152 +
30153 +       if (parent)
30154 +               sk->type = parent->type;
30155 +}
30156 +
30157 +static struct sock *sco_sock_alloc(struct socket *sock, int proto, int prio)
30158 +{
30159 +       struct sock *sk;
30160 +
30161 +       if (!(sk = sk_alloc(PF_BLUETOOTH, prio, 1)))
30162 +               return NULL;
30163 +
30164 +       bluez_sock_init(sock, sk);
30165 +
30166 +       sk->zapped   = 0;
30167 +
30168 +       sk->destruct = sco_sock_destruct;
30169 +       sk->sndtimeo = SCO_CONN_TIMEOUT;
30170 +
30171 +       sk->protocol = proto;
30172 +       sk->state    = BT_OPEN;
30173 +
30174 +       sco_sock_init_timer(sk);
30175 +
30176 +       bluez_sock_link(&sco_sk_list, sk);
30177 +
30178 +       MOD_INC_USE_COUNT;
30179 +       return sk;
30180 +}
30181 +
30182 +static int sco_sock_create(struct socket *sock, int protocol)
30183 +{
30184 +       struct sock *sk;
30185 +
30186 +       BT_DBG("sock %p", sock);
30187 +
30188 +       sock->state = SS_UNCONNECTED;
30189 +
30190 +       if (sock->type != SOCK_SEQPACKET)
30191 +               return -ESOCKTNOSUPPORT;
30192 +
30193 +       sock->ops = &sco_sock_ops;
30194 +
30195 +       if (!(sk = sco_sock_alloc(sock, protocol, GFP_KERNEL)))
30196 +               return -ENOMEM;
30197 +
30198 +       sco_sock_init(sk, NULL);
30199 +       return 0;
30200 +}
30201 +
30202 +static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
30203 +{
30204 +       struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
30205 +       struct sock *sk = sock->sk;
30206 +       bdaddr_t *src = &sa->sco_bdaddr;
30207 +       int err = 0;
30208 +
30209 +       BT_DBG("sk %p %s", sk, batostr(&sa->sco_bdaddr));
30210 +
30211 +       if (!addr || addr->sa_family != AF_BLUETOOTH)
30212 +               return -EINVAL;
30213 +
30214 +       lock_sock(sk);
30215 +
30216 +       if (sk->state != BT_OPEN) {
30217 +               err = -EBADFD;
30218 +               goto done;
30219 +       }
30220 +
30221 +       write_lock_bh(&sco_sk_list.lock);
30222 +
30223 +       if (bacmp(src, BDADDR_ANY) && __sco_get_sock_by_addr(src)) {
30224 +               err = -EADDRINUSE;
30225 +       } else {
30226 +               /* Save source address */
30227 +               bacpy(&bluez_pi(sk)->src, &sa->sco_bdaddr);
30228 +               sk->state = BT_BOUND;
30229 +       }
30230 +
30231 +       write_unlock_bh(&sco_sk_list.lock);
30232 +
30233 +done:
30234 +       release_sock(sk);
30235 +
30236 +       return err;
30237 +}
30238 +
30239 +static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
30240 +{
30241 +       struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
30242 +       struct sock *sk = sock->sk;
30243 +       int err = 0;
30244 +
30245 +
30246 +       BT_DBG("sk %p", sk);
30247 +
30248 +       if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_sco))
30249 +               return -EINVAL;
30250 +
30251 +       if (sk->state != BT_OPEN && sk->state != BT_BOUND)
30252 +               return -EBADFD;
30253 +
30254 +       if (sk->type != SOCK_SEQPACKET)
30255 +               return -EINVAL;
30256 +
30257 +       lock_sock(sk);
30258 +
30259 +       /* Set destination address and psm */
30260 +       bacpy(&bluez_pi(sk)->dst, &sa->sco_bdaddr);
30261 +
30262 +       if ((err = sco_connect(sk)))
30263 +               goto done;
30264 +
30265 +       err = bluez_sock_wait_state(sk, BT_CONNECTED,
30266 +                       sock_sndtimeo(sk, flags & O_NONBLOCK));
30267 +
30268 +done:
30269 +       release_sock(sk);
30270 +       return err;
30271 +}
30272 +
30273 +int sco_sock_listen(struct socket *sock, int backlog)
30274 +{
30275 +       struct sock *sk = sock->sk;
30276 +       int err = 0;
30277 +
30278 +       BT_DBG("sk %p backlog %d", sk, backlog);
30279 +
30280 +       lock_sock(sk);
30281 +
30282 +       if (sk->state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
30283 +               err = -EBADFD;
30284 +               goto done;
30285 +       }
30286 +
30287 +       sk->max_ack_backlog = backlog;
30288 +       sk->ack_backlog = 0;
30289 +       sk->state = BT_LISTEN;
30290 +
30291 +done:
30292 +       release_sock(sk);
30293 +       return err;
30294 +}
30295 +
30296 +int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
30297 +{
30298 +       DECLARE_WAITQUEUE(wait, current);
30299 +       struct sock *sk = sock->sk, *ch;
30300 +       long timeo;
30301 +       int err = 0;
30302 +
30303 +       lock_sock(sk);
30304 +
30305 +       if (sk->state != BT_LISTEN) {
30306 +               err = -EBADFD;
30307 +               goto done;
30308 +       }
30309 +
30310 +       timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
30311 +
30312 +       BT_DBG("sk %p timeo %ld", sk, timeo);
30313 +
30314 +       /* Wait for an incoming connection. (wake-one). */
30315 +       add_wait_queue_exclusive(sk->sleep, &wait);
30316 +       while (!(ch = bluez_accept_dequeue(sk, newsock))) {
30317 +               set_current_state(TASK_INTERRUPTIBLE);
30318 +               if (!timeo) {
30319 +                       err = -EAGAIN;
30320 +                       break;
30321 +               }
30322 +
30323 +               release_sock(sk);
30324 +               timeo = schedule_timeout(timeo);
30325 +               lock_sock(sk);
30326 +
30327 +               if (sk->state != BT_LISTEN) {
30328 +                       err = -EBADFD;
30329 +                       break;
30330 +               }
30331 +
30332 +               if (signal_pending(current)) {
30333 +                       err = sock_intr_errno(timeo);
30334 +                       break;
30335 +               }
30336 +       }
30337 +       set_current_state(TASK_RUNNING);
30338 +       remove_wait_queue(sk->sleep, &wait);
30339 +
30340 +       if (err)
30341 +               goto done;
30342 +
30343 +       newsock->state = SS_CONNECTED;
30344 +
30345 +       BT_DBG("new socket %p", ch);
30346 +
30347 +done:
30348 +       release_sock(sk);
30349 +       return err;
30350 +}
30351 +
30352 +static int sco_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
30353 +{
30354 +       struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
30355 +       struct sock *sk = sock->sk;
30356 +
30357 +       BT_DBG("sock %p, sk %p", sock, sk);
30358 +
30359 +       addr->sa_family = AF_BLUETOOTH;
30360 +       *len = sizeof(struct sockaddr_sco);
30361 +
30362 +       if (peer)
30363 +               bacpy(&sa->sco_bdaddr, &bluez_pi(sk)->dst);
30364 +       else
30365 +               bacpy(&sa->sco_bdaddr, &bluez_pi(sk)->src);
30366 +
30367 +       return 0;
30368 +}
30369 +
30370 +static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg, int len, struct scm_cookie *scm)
30371 +{
30372 +       struct sock *sk = sock->sk;
30373 +       int err = 0;
30374 +
30375 +       BT_DBG("sock %p, sk %p", sock, sk);
30376 +
30377 +       if (sk->err)
30378 +               return sock_error(sk);
30379 +
30380 +       if (msg->msg_flags & MSG_OOB)
30381 +               return -EOPNOTSUPP;
30382 +
30383 +       lock_sock(sk);
30384 +
30385 +       if (sk->state == BT_CONNECTED)
30386 +               err = sco_send_frame(sk, msg, len);
30387 +       else
30388 +               err = -ENOTCONN;
30389 +
30390 +       release_sock(sk);
30391 +       return err;
30392 +}
30393 +
30394 +int sco_sock_setsockopt(struct socket *sock, int level, int optname, char *optval, int optlen)
30395 +{
30396 +       struct sock *sk = sock->sk;
30397 +       int err = 0;
30398 +
30399 +       BT_DBG("sk %p", sk);
30400 +
30401 +       lock_sock(sk);
30402 +
30403 +       switch (optname) {
30404 +       default:
30405 +               err = -ENOPROTOOPT;
30406 +               break;
30407 +       };
30408 +
30409 +       release_sock(sk);
30410 +       return err;
30411 +}
30412 +
30413 +int sco_sock_getsockopt(struct socket *sock, int level, int optname, char *optval, int *optlen)
30414 +{
30415 +       struct sock *sk = sock->sk;
30416 +       struct sco_options opts;
30417 +       struct sco_conninfo cinfo;
30418 +       int len, err = 0;
30419 +
30420 +       BT_DBG("sk %p", sk);
30421 +
30422 +       if (get_user(len, optlen))
30423 +               return -EFAULT;
30424 +
30425 +       lock_sock(sk);
30426 +
30427 +       switch (optname) {
30428 +       case SCO_OPTIONS:
30429 +               if (sk->state != BT_CONNECTED) {
30430 +                       err = -ENOTCONN;
30431 +                       break;
30432 +               }
30433 +
30434 +               opts.mtu = sco_pi(sk)->conn->mtu;
30435 +
30436 +               BT_DBG("mtu %d", opts.mtu);
30437 +
30438 +               len = MIN(len, sizeof(opts));
30439 +               if (copy_to_user(optval, (char *)&opts, len))
30440 +                       err = -EFAULT;
30441 +
30442 +               break;
30443 +
30444 +       case SCO_CONNINFO:
30445 +               if (sk->state != BT_CONNECTED) {
30446 +                       err = -ENOTCONN;
30447 +                       break;
30448 +               }
30449 +
30450 +               cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
30451 +
30452 +               len = MIN(len, sizeof(cinfo));
30453 +               if (copy_to_user(optval, (char *)&cinfo, len))
30454 +                       err = -EFAULT;
30455 +
30456 +               break;
30457 +
30458 +       default:
30459 +               err = -ENOPROTOOPT;
30460 +               break;
30461 +       };
30462 +
30463 +       release_sock(sk);
30464 +       return err;
30465 +}
30466 +
30467 +static int sco_sock_release(struct socket *sock)
30468 +{
30469 +       struct sock *sk = sock->sk;
30470 +       int err = 0;
30471 +
30472 +       BT_DBG("sock %p, sk %p", sock, sk);
30473 +
30474 +       if (!sk)
30475 +               return 0;
30476 +
30477 +       sco_sock_close(sk);
30478 +       if (sk->linger) {
30479 +               lock_sock(sk);
30480 +               err = bluez_sock_wait_state(sk, BT_CLOSED, sk->lingertime);
30481 +               release_sock(sk);
30482 +       }
30483 +
30484 +       sock_orphan(sk);
30485 +       sco_sock_kill(sk);
30486 +       return err;
30487 +}
30488 +
30489 +static void __sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
30490 +{
30491 +       BT_DBG("conn %p", conn);
30492 +
30493 +       sco_pi(sk)->conn = conn;
30494 +       conn->sk = sk;
30495 +
30496 +       if (parent)
30497 +               bluez_accept_enqueue(parent, sk);
30498 +}
30499 +
30500 +static inline int sco_chan_add(struct sco_conn *conn, struct sock *sk, struct sock *parent)
30501 +{
30502 +       int err = 0;
30503 +
30504 +       sco_conn_lock(conn);
30505 +       if (conn->sk) {
30506 +               err = -EBUSY;
30507 +       } else {
30508 +               __sco_chan_add(conn, sk, parent);
30509 +       }
30510 +       sco_conn_unlock(conn);
30511 +       return err;
30512 +}
30513 +
30514 +static inline struct sock * sco_chan_get(struct sco_conn *conn)
30515 +{
30516 +       struct sock *sk = NULL;
30517 +       sco_conn_lock(conn);
30518 +       sk = conn->sk;
30519 +       sco_conn_unlock(conn);
30520 +       return sk;
30521 +}
30522 +
30523 +/* Delete channel.
30524 + * Must be called on the locked socket. */
30525 +static void sco_chan_del(struct sock *sk, int err)
30526 +{
30527 +       struct sco_conn *conn;
30528 +
30529 +       conn = sco_pi(sk)->conn;
30530 +
30531 +       BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
30532 +
30533 +       if (conn) {
30534 +               sco_conn_lock(conn);
30535 +               conn->sk = NULL;
30536 +               sco_pi(sk)->conn = NULL;
30537 +               sco_conn_unlock(conn);
30538 +               hci_conn_put(conn->hcon);
30539 +       }
30540 +
30541 +       sk->state = BT_CLOSED;
30542 +       sk->err   = err;
30543 +       sk->state_change(sk);
30544 +
30545 +       sk->zapped = 1;
30546 +}
30547 +
30548 +static void sco_conn_ready(struct sco_conn *conn)
30549 +{
30550 +       struct sock *parent, *sk;
30551 +
30552 +       BT_DBG("conn %p", conn);
30553 +
30554 +       sco_conn_lock(conn);
30555 +
30556 +       if ((sk = conn->sk)) {
30557 +               sco_sock_clear_timer(sk);
30558 +               bh_lock_sock(sk);
30559 +               sk->state = BT_CONNECTED;
30560 +               sk->state_change(sk);
30561 +               bh_unlock_sock(sk);
30562 +       } else {
30563 +               parent = sco_get_sock_listen(conn->src);
30564 +               if (!parent)
30565 +                       goto done;
30566 +
30567 +               bh_lock_sock(parent);
30568 +
30569 +               sk = sco_sock_alloc(NULL, BTPROTO_SCO, GFP_ATOMIC);
30570 +               if (!sk) {
30571 +                       bh_unlock_sock(parent);
30572 +                       goto done;
30573 +               }
30574 +
30575 +               sco_sock_init(sk, parent);
30576 +
30577 +               bacpy(&bluez_pi(sk)->src, conn->src);
30578 +               bacpy(&bluez_pi(sk)->dst, conn->dst);
30579 +
30580 +               hci_conn_hold(conn->hcon);
30581 +               __sco_chan_add(conn, sk, parent);
30582 +
30583 +               sk->state = BT_CONNECTED;
30584 +
30585 +               /* Wake up parent */
30586 +               parent->data_ready(parent, 1);
30587 +
30588 +               bh_unlock_sock(parent);
30589 +       }
30590 +
30591 +done:
30592 +       sco_conn_unlock(conn);
30593 +}
30594 +
30595 +/* ----- SCO interface with lower layer (HCI) ----- */
30596 +int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
30597 +{
30598 +       BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
30599 +
30600 +       /* Always accept connection */
30601 +       return HCI_LM_ACCEPT;
30602 +}
30603 +
30604 +int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
30605 +{
30606 +       BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
30607 +
30608 +       if (hcon->type != SCO_LINK)
30609 +               return 0;
30610 +
30611 +       if (!status) {
30612 +               struct sco_conn *conn;
30613 +
30614 +               conn = sco_conn_add(hcon, status);
30615 +               if (conn)
30616 +                       sco_conn_ready(conn);
30617 +       } else
30618 +               sco_conn_del(hcon, bterr(status));
30619 +
30620 +       return 0;
30621 +}
30622 +
30623 +int sco_disconn_ind(struct hci_conn *hcon, __u8 reason)
30624 +{
30625 +       BT_DBG("hcon %p reason %d", hcon, reason);
30626 +
30627 +       if (hcon->type != SCO_LINK)
30628 +               return 0;
30629 +
30630 +       sco_conn_del(hcon, bterr(reason));
30631 +       return 0;
30632 +}
30633 +
30634 +int sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
30635 +{
30636 +       struct sco_conn *conn = hcon->sco_data;
30637 +
30638 +       if (!conn)
30639 +               goto drop;
30640 +
30641 +       BT_DBG("conn %p len %d", conn, skb->len);
30642 +
30643 +       if (skb->len) {
30644 +               sco_recv_frame(conn, skb);
30645 +               return 0;
30646 +       }
30647 +
30648 +drop:
30649 +       kfree_skb(skb);
30650 +       return 0;
30651 +}
30652 +
30653 +/* ----- Proc fs support ------ */
30654 +static int sco_sock_dump(char *buf, struct bluez_sock_list *list)
30655 +{
30656 +       struct sco_pinfo *pi;
30657 +       struct sock *sk;
30658 +       char *ptr = buf;
30659 +
30660 +       write_lock_bh(&list->lock);
30661 +
30662 +       for (sk = list->head; sk; sk = sk->next) {
30663 +               pi = sco_pi(sk);
30664 +               ptr += sprintf(ptr, "%s %s %d\n",
30665 +                               batostr(&bluez_pi(sk)->src), batostr(&bluez_pi(sk)->dst),
30666 +                               sk->state);
30667 +       }
30668 +
30669 +       write_unlock_bh(&list->lock);
30670 +
30671 +       ptr += sprintf(ptr, "\n");
30672 +
30673 +       return ptr - buf;
30674 +}
30675 +
30676 +static int sco_read_proc(char *buf, char **start, off_t offset, int count, int *eof, void *priv)
30677 +{
30678 +       char *ptr = buf;
30679 +       int len;
30680 +
30681 +       BT_DBG("count %d, offset %ld", count, offset);
30682 +
30683 +       ptr += sco_sock_dump(ptr, &sco_sk_list);
30684 +       len  = ptr - buf;
30685 +
30686 +       if (len <= count + offset)
30687 +               *eof = 1;
30688 +
30689 +       *start = buf + offset;
30690 +       len -= offset;
30691 +
30692 +       if (len > count)
30693 +               len = count;
30694 +       if (len < 0)
30695 +               len = 0;
30696 +
30697 +       return len;
30698 +}
30699 +
30700 +static struct proto_ops sco_sock_ops = {
30701 +       family:         PF_BLUETOOTH,
30702 +       release:        sco_sock_release,
30703 +       bind:           sco_sock_bind,
30704 +       connect:        sco_sock_connect,
30705 +       listen:         sco_sock_listen,
30706 +       accept:         sco_sock_accept,
30707 +       getname:        sco_sock_getname,
30708 +       sendmsg:        sco_sock_sendmsg,
30709 +       recvmsg:        bluez_sock_recvmsg,
30710 +       poll:           bluez_sock_poll,
30711 +       socketpair:     sock_no_socketpair,
30712 +       ioctl:          sock_no_ioctl,
30713 +       shutdown:       sock_no_shutdown,
30714 +       setsockopt:     sco_sock_setsockopt,
30715 +       getsockopt:     sco_sock_getsockopt,
30716 +       mmap:           sock_no_mmap
30717 +};
30718 +
30719 +static struct net_proto_family sco_sock_family_ops = {
30720 +       family:         PF_BLUETOOTH,
30721 +       create:         sco_sock_create
30722 +};
30723 +
30724 +static struct hci_proto sco_hci_proto = {
30725 +       name:           "SCO",
30726 +       id:             HCI_PROTO_SCO,
30727 +       connect_ind:    sco_connect_ind,
30728 +       connect_cfm:    sco_connect_cfm,
30729 +       disconn_ind:    sco_disconn_ind,
30730 +       recv_scodata:   sco_recv_scodata,
30731 +};
30732 +
30733 +int __init sco_init(void)
30734 +{
30735 +       int err;
30736 +
30737 +       if ((err = bluez_sock_register(BTPROTO_SCO, &sco_sock_family_ops))) {
30738 +               BT_ERR("Can't register SCO socket layer");
30739 +               return err;
30740 +       }
30741 +
30742 +       if ((err = hci_register_proto(&sco_hci_proto))) {
30743 +               BT_ERR("Can't register SCO protocol");
30744 +               return err;
30745 +       }
30746 +
30747 +       create_proc_read_entry("bluetooth/sco", 0, 0, sco_read_proc, NULL);
30748 +
30749 +       BT_INFO("BlueZ SCO ver %s Copyright (C) 2000,2001 Qualcomm Inc", VERSION);
30750 +       BT_INFO("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
30751 +       return 0;
30752 +}
30753 +
30754 +void sco_cleanup(void)
30755 +{
30756 +       int err;
30757 +
30758 +       remove_proc_entry("bluetooth/sco", NULL);
30759 +
30760 +       /* Unregister socket, protocol and notifier */
30761 +       if ((err = bluez_sock_unregister(BTPROTO_SCO)))
30762 +               BT_ERR("Can't unregister SCO socket layer %d", err);
30763 +
30764 +       if ((err = hci_unregister_proto(&sco_hci_proto)))
30765 +               BT_ERR("Can't unregister SCO protocol %d", err);
30766 +}
30767 +
30768 +module_init(sco_init);
30769 +module_exit(sco_cleanup);
30770 +
30771 +MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>");
30772 +MODULE_DESCRIPTION("BlueZ SCO ver " VERSION);
30773 +MODULE_LICENSE("GPL");
30774 diff -urN linux-2.4.18/net/bluetooth/syms.c linux-2.4.18-mh9/net/bluetooth/syms.c
30775 --- linux-2.4.18/net/bluetooth/syms.c   Fri Sep  7 18:28:38 2001
30776 +++ linux-2.4.18-mh9/net/bluetooth/syms.c       Mon Aug 25 18:38:12 2003
30777 @@ -25,7 +25,7 @@
30778  /*
30779   * BlueZ symbols.
30780   *
30781 - * $Id: syms.c,v 1.1 2001/07/12 19:31:24 maxk Exp $
30782 + * $Id: syms.c,v 1.1 2002/03/08 21:06:59 maxk Exp $
30783   */
30784
30785  #include <linux/config.h>
30786 @@ -39,25 +39,28 @@
30787  #include <linux/socket.h>
30788
30789  #include <net/bluetooth/bluetooth.h>
30790 -#include <net/bluetooth/bluez.h>
30791  #include <net/bluetooth/hci_core.h>
30792
30793  /* HCI Core */
30794  EXPORT_SYMBOL(hci_register_dev);
30795  EXPORT_SYMBOL(hci_unregister_dev);
30796 +EXPORT_SYMBOL(hci_suspend_dev);
30797 +EXPORT_SYMBOL(hci_resume_dev);
30798 +
30799  EXPORT_SYMBOL(hci_register_proto);
30800  EXPORT_SYMBOL(hci_unregister_proto);
30801 -EXPORT_SYMBOL(hci_register_notifier);
30802 -EXPORT_SYMBOL(hci_unregister_notifier);
30803
30804 +EXPORT_SYMBOL(hci_get_route);
30805  EXPORT_SYMBOL(hci_connect);
30806 -EXPORT_SYMBOL(hci_disconnect);
30807  EXPORT_SYMBOL(hci_dev_get);
30808 +EXPORT_SYMBOL(hci_conn_auth);
30809 +EXPORT_SYMBOL(hci_conn_encrypt);
30810
30811  EXPORT_SYMBOL(hci_recv_frame);
30812  EXPORT_SYMBOL(hci_send_acl);
30813  EXPORT_SYMBOL(hci_send_sco);
30814 -EXPORT_SYMBOL(hci_send_raw);
30815 +EXPORT_SYMBOL(hci_send_cmd);
30816 +EXPORT_SYMBOL(hci_si_event);
30817
30818  /* BlueZ lib */
30819  EXPORT_SYMBOL(bluez_dump);
30820 @@ -68,5 +71,11 @@
30821  /* BlueZ sockets */
30822  EXPORT_SYMBOL(bluez_sock_register);
30823  EXPORT_SYMBOL(bluez_sock_unregister);
30824 +EXPORT_SYMBOL(bluez_sock_init);
30825  EXPORT_SYMBOL(bluez_sock_link);
30826  EXPORT_SYMBOL(bluez_sock_unlink);
30827 +EXPORT_SYMBOL(bluez_sock_recvmsg);
30828 +EXPORT_SYMBOL(bluez_sock_poll);
30829 +EXPORT_SYMBOL(bluez_accept_enqueue);
30830 +EXPORT_SYMBOL(bluez_accept_dequeue);
30831 +EXPORT_SYMBOL(bluez_sock_wait_state);