net/bluetooth/rfcomm/core.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25    RPN support    -    Dirk Husemann <hud@zurich.ibm.com>
  26 */
  27
  28 /*
  29  * Bluetooth RFCOMM core.
  30  *
  31  * $Id: core.c,v 1.42 2002/10/01 23:26:25 maxk Exp $
  32  */
  33
  34 #include <linux/config.h>
  35 #include <linux/module.h>
  36 #include <linux/errno.h>
  37 #include <linux/kernel.h>
  38 #include <linux/sched.h>
  39 #include <linux/signal.h>
  40 #include <linux/init.h>
  41 #include <linux/wait.h>
  42 #include <linux/net.h>
  43 #include <linux/proc_fs.h>
  44 #include <linux/seq_file.h>
  45 #include <net/sock.h>
  46 #include <asm/uaccess.h>
  47 #include <asm/unaligned.h>
  48
  49 #include <net/bluetooth/bluetooth.h>
  50 #include <net/bluetooth/l2cap.h>
  51 #include <net/bluetooth/rfcomm.h>
  52
  53 #define VERSION "1.3"
  54
  55 #ifndef CONFIG_BT_RFCOMM_DEBUG
  56 #undef  BT_DBG
  57 #define BT_DBG(D...)
  58 #endif
  59
  60 #ifdef CONFIG_PROC_FS
  61 struct proc_dir_entry *proc_bt_rfcomm;
  62 #endif
  63
  64 struct task_struct *rfcomm_thread;
  65 DECLARE_MUTEX(rfcomm_sem);
  66 unsigned long rfcomm_event;
  67
  68 static LIST_HEAD(session_list);
  69 static atomic_t terminate, running;
  70
  71 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len);
  72 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci);
  73 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci);
  74 static int rfcomm_queue_disc(struct rfcomm_dlc *d);
  75 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type);
  76 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d);
  77 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig);
  78 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len);
  79 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits);
  80 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr);
  81
  82 static void rfcomm_process_connect(struct rfcomm_session *s);
  83
  84 /* ---- RFCOMM frame parsing macros ---- */
  85 #define __get_dlci(b)     ((b & 0xfc) >> 2)
  86 #define __get_channel(b)  ((b & 0xf8) >> 3)
  87 #define __get_dir(b)      ((b & 0x04) >> 2)
  88 #define __get_type(b)     ((b & 0xef))
  89
  90 #define __test_ea(b)      ((b & 0x01))
  91 #define __test_cr(b)      ((b & 0x02))
  92 #define __test_pf(b)      ((b & 0x10))
  93
  94 #define __addr(cr, dlci)       (((dlci & 0x3f) << 2) | (cr << 1) | 0x01)
  95 #define __ctrl(type, pf)       (((type & 0xef) | (pf << 4)))
  96 #define __dlci(dir, chn)       (((chn & 0x1f) << 1) | dir)
  97 #define __srv_channel(dlci)    (dlci >> 1)
  98 #define __dir(dlci)            (dlci & 0x01)
  99
 100 #define __len8(len)       (((len) << 1) | 1)
 101 #define __len16(len)      ((len) << 1)
 102
 103 /* MCC macros */
 104 #define __mcc_type(cr, type)   (((type << 2) | (cr << 1) | 0x01))
 105 #define __get_mcc_type(b) ((b & 0xfc) >> 2)
 106 #define __get_mcc_len(b)  ((b & 0xfe) >> 1)
 107
 108 /* RPN macros */
 109 #define __rpn_line_settings(data, stop, parity)  ((data & 0x3) | ((stop & 0x1) << 2) | ((parity & 0x3) << 3))
 110 #define __get_rpn_data_bits(line) ((line) & 0x3)
 111 #define __get_rpn_stop_bits(line) (((line) >> 2) & 0x1)
 112 #define __get_rpn_parity(line)    (((line) >> 3) & 0x3)
 113
 114 /* ---- RFCOMM FCS computation ---- */
 115
 116 /* CRC on 2 bytes */
 117 #define __crc(data) (rfcomm_crc_table[rfcomm_crc_table[0xff ^ data[0]] ^ data[1]])
 118
 119 /* FCS on 2 bytes */
 120 static inline u8 __fcs(u8 *data)
 121 {
 122         return (0xff - __crc(data));
 123 }
 124
 125 /* FCS on 3 bytes */
 126 static inline u8 __fcs2(u8 *data)
 127 {
 128         return (0xff - rfcomm_crc_table[__crc(data) ^ data[2]]);
 129 }
 130
 131 /* Check FCS */
 132 static inline int __check_fcs(u8 *data, int type, u8 fcs)
 133 {
 134         u8 f = __crc(data);
 135
 136         if (type != RFCOMM_UIH)
 137                 f = rfcomm_crc_table[f ^ data[2]];
 138
 139         return rfcomm_crc_table[f ^ fcs] != 0xcf;
 140 }
 141
 142 /* ---- L2CAP callbacks ---- */
 143 static void rfcomm_l2state_change(struct sock *sk)
 144 {
 145         BT_DBG("%p state %d", sk, sk->sk_state);
 146         rfcomm_schedule(RFCOMM_SCHED_STATE);
 147 }
 148
 149 static void rfcomm_l2data_ready(struct sock *sk, int bytes)
 150 {
 151         BT_DBG("%p bytes %d", sk, bytes);
 152         rfcomm_schedule(RFCOMM_SCHED_RX);
 153 }
 154
 155 static int rfcomm_l2sock_create(struct socket **sock)
 156 {
 157         int err;
 158
 159         BT_DBG("");
 160
 161         err = sock_create_kern(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_L2CAP, sock);
 162         if (!err) {
 163                 struct sock *sk = (*sock)->sk;
 164                 sk->sk_data_ready   = rfcomm_l2data_ready;
 165                 sk->sk_state_change = rfcomm_l2state_change;
 166         }
 167         return err;
 168 }
 169
 170 /* ---- RFCOMM DLCs ---- */
 171 static void rfcomm_dlc_timeout(unsigned long arg)
 172 {
 173         struct rfcomm_dlc *d = (void *) arg;
 174
 175         BT_DBG("dlc %p state %ld", d, d->state);
 176
 177         set_bit(RFCOMM_TIMED_OUT, &d->flags);
 178         rfcomm_dlc_put(d);
 179         rfcomm_schedule(RFCOMM_SCHED_TIMEO);
 180 }
 181
 182 static void rfcomm_dlc_set_timer(struct rfcomm_dlc *d, long timeout)
 183 {
 184         BT_DBG("dlc %p state %ld timeout %ld", d, d->state, timeout);
 185
 186         if (!mod_timer(&d->timer, jiffies + timeout))
 187                 rfcomm_dlc_hold(d);
 188 }
 189
 190 static void rfcomm_dlc_clear_timer(struct rfcomm_dlc *d)
 191 {
 192         BT_DBG("dlc %p state %ld", d, d->state);
 193
 194         if (timer_pending(&d->timer) && del_timer(&d->timer))
 195                 rfcomm_dlc_put(d);
 196 }
 197
 198 static void rfcomm_dlc_clear_state(struct rfcomm_dlc *d)
 199 {
 200         BT_DBG("%p", d);
 201
 202         d->state      = BT_OPEN;
 203         d->flags      = 0;
 204         d->mscex      = 0;
 205         d->mtu        = RFCOMM_DEFAULT_MTU;
 206         d->v24_sig    = RFCOMM_V24_RTC | RFCOMM_V24_RTR | RFCOMM_V24_DV;
 207
 208         d->cfc        = RFCOMM_CFC_DISABLED;
 209         d->rx_credits = RFCOMM_DEFAULT_CREDITS;
 210 }
 211
 212 struct rfcomm_dlc *rfcomm_dlc_alloc(int prio)
 213 {
 214         struct rfcomm_dlc *d = kmalloc(sizeof(*d), prio);
 215         if (!d)
 216                 return NULL;
 217         memset(d, 0, sizeof(*d));
 218
 219         init_timer(&d->timer);
 220         d->timer.function = rfcomm_dlc_timeout;
 221         d->timer.data = (unsigned long) d;
 222
 223         skb_queue_head_init(&d->tx_queue);
 224         spin_lock_init(&d->lock);
 225         atomic_set(&d->refcnt, 1);
 226
 227         rfcomm_dlc_clear_state(d);
 228
 229         BT_DBG("%p", d);
 230         return d;
 231 }
 232
 233 void rfcomm_dlc_free(struct rfcomm_dlc *d)
 234 {
 235         BT_DBG("%p", d);
 236
 237         skb_queue_purge(&d->tx_queue);
 238         kfree(d);
 239 }
 240
 241 static void rfcomm_dlc_link(struct rfcomm_session *s, struct rfcomm_dlc *d)
 242 {
 243         BT_DBG("dlc %p session %p", d, s);
 244
 245         rfcomm_session_hold(s);
 246
 247         rfcomm_dlc_hold(d);
 248         list_add(&d->list, &s->dlcs);
 249         d->session = s;
 250 }
 251
 252 static void rfcomm_dlc_unlink(struct rfcomm_dlc *d)
 253 {
 254         struct rfcomm_session *s = d->session;
 255
 256         BT_DBG("dlc %p refcnt %d session %p", d, atomic_read(&d->refcnt), s);
 257
 258         list_del(&d->list);
 259         d->session = NULL;
 260         rfcomm_dlc_put(d);
 261
 262         rfcomm_session_put(s);
 263 }
 264
 265 static struct rfcomm_dlc *rfcomm_dlc_get(struct rfcomm_session *s, u8 dlci)
 266 {
 267         struct rfcomm_dlc *d;
 268         struct list_head *p;
 269
 270         list_for_each(p, &s->dlcs) {
 271                 d = list_entry(p, struct rfcomm_dlc, list);
 272                 if (d->dlci == dlci)
 273                         return d;
 274         }
 275         return NULL;
 276 }
 277
 278 static int __rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 279 {
 280         struct rfcomm_session *s;
 281         int err = 0;
 282         u8 dlci;
 283
 284         BT_DBG("dlc %p state %ld %s %s channel %d",
 285                         d, d->state, batostr(src), batostr(dst), channel);
 286
 287         if (channel < 1 || channel > 30)
 288                 return -EINVAL;
 289
 290         if (d->state != BT_OPEN && d->state != BT_CLOSED)
 291                 return 0;
 292
 293         s = rfcomm_session_get(src, dst);
 294         if (!s) {
 295                 s = rfcomm_session_create(src, dst, &err);
 296                 if (!s)
 297                         return err;
 298         }
 299
 300         dlci = __dlci(!s->initiator, channel);
 301
 302         /* Check if DLCI already exists */
 303         if (rfcomm_dlc_get(s, dlci))
 304                 return -EBUSY;
 305
 306         rfcomm_dlc_clear_state(d);
 307
 308         d->dlci     = dlci;
 309         d->addr     = __addr(s->initiator, dlci);
 310         d->priority = 7;
 311
 312         d->state    = BT_CONFIG;
 313         rfcomm_dlc_link(s, d);
 314
 315         d->mtu = s->mtu;
 316         d->cfc = (s->cfc == RFCOMM_CFC_UNKNOWN) ? 0 : s->cfc;
 317
 318         if (s->state == BT_CONNECTED)
 319                 rfcomm_send_pn(s, 1, d);
 320         rfcomm_dlc_set_timer(d, RFCOMM_CONN_TIMEOUT);
 321         return 0;
 322 }
 323
 324 int rfcomm_dlc_open(struct rfcomm_dlc *d, bdaddr_t *src, bdaddr_t *dst, u8 channel)
 325 {
 326         mm_segment_t fs;
 327         int r;
 328
 329         rfcomm_lock();
 330
 331         fs = get_fs(); set_fs(KERNEL_DS);
 332         r = __rfcomm_dlc_open(d, src, dst, channel);
 333         set_fs(fs);
 334
 335         rfcomm_unlock();
 336         return r;
 337 }
 338
 339 static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 340 {
 341         struct rfcomm_session *s = d->session;
 342         if (!s)
 343                 return 0;
 344
 345         BT_DBG("dlc %p state %ld dlci %d err %d session %p",
 346                         d, d->state, d->dlci, err, s);
 347
 348         switch (d->state) {
 349         case BT_CONNECTED:
 350         case BT_CONFIG:
 351         case BT_CONNECT:
 352                 d->state = BT_DISCONN;
 353                 if (skb_queue_empty(&d->tx_queue)) {
 354                         rfcomm_send_disc(s, d->dlci);
 355                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT);
 356                 } else {
 357                         rfcomm_queue_disc(d);
 358                         rfcomm_dlc_set_timer(d, RFCOMM_DISC_TIMEOUT * 2);
 359                 }
 360                 break;
 361
 362         default:
 363                 rfcomm_dlc_clear_timer(d);
 364
 365                 rfcomm_dlc_lock(d);
 366                 d->state = BT_CLOSED;
 367                 d->state_change(d, err);
 368                 rfcomm_dlc_unlock(d);
 369
 370                 skb_queue_purge(&d->tx_queue);
 371                 rfcomm_dlc_unlink(d);
 372         }
 373
 374         return 0;
 375 }
 376
 377 int rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 378 {
 379         mm_segment_t fs;
 380         int r;
 381
 382         rfcomm_lock();
 383
 384         fs = get_fs(); set_fs(KERNEL_DS);
 385         r = __rfcomm_dlc_close(d, err);
 386         set_fs(fs);
 387
 388         rfcomm_unlock();
 389         return r;
 390 }
 391
 392 int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb)
 393 {
 394         int len = skb->len;
 395
 396         if (d->state != BT_CONNECTED)
 397                 return -ENOTCONN;
 398
 399         BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len);
 400
 401         if (len > d->mtu)
 402                 return -EINVAL;
 403
 404         rfcomm_make_uih(skb, d->addr);
 405         skb_queue_tail(&d->tx_queue, skb);
 406
 407         if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags))
 408                 rfcomm_schedule(RFCOMM_SCHED_TX);
 409         return len;
 410 }
 411
 412 void fastcall __rfcomm_dlc_throttle(struct rfcomm_dlc *d)
 413 {
 414         BT_DBG("dlc %p state %ld", d, d->state);
 415
 416         if (!d->cfc) {
 417                 d->v24_sig |= RFCOMM_V24_FC;
 418                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 419         }
 420         rfcomm_schedule(RFCOMM_SCHED_TX);
 421 }
 422
 423 void fastcall __rfcomm_dlc_unthrottle(struct rfcomm_dlc *d)
 424 {
 425         BT_DBG("dlc %p state %ld", d, d->state);
 426
 427         if (!d->cfc) {
 428                 d->v24_sig &= ~RFCOMM_V24_FC;
 429                 set_bit(RFCOMM_MSC_PENDING, &d->flags);
 430         }
 431         rfcomm_schedule(RFCOMM_SCHED_TX);
 432 }
 433
 434 /*
 435    Set/get modem status functions use _local_ status i.e. what we report
 436    to the other side.
 437    Remote status is provided by dlc->modem_status() callback.
 438  */
 439 int rfcomm_dlc_set_modem_status(struct rfcomm_dlc *d, u8 v24_sig)
 440 {
 441         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 442                         d, d->state, v24_sig);
 443
 444         if (test_bit(RFCOMM_RX_THROTTLED, &d->flags))
 445                 v24_sig |= RFCOMM_V24_FC;
 446         else
 447                 v24_sig &= ~RFCOMM_V24_FC;
 448
 449         d->v24_sig = v24_sig;
 450
 451         if (!test_and_set_bit(RFCOMM_MSC_PENDING, &d->flags))
 452                 rfcomm_schedule(RFCOMM_SCHED_TX);
 453
 454         return 0;
 455 }
 456
 457 int rfcomm_dlc_get_modem_status(struct rfcomm_dlc *d, u8 *v24_sig)
 458 {
 459         BT_DBG("dlc %p state %ld v24_sig 0x%x",
 460                         d, d->state, d->v24_sig);
 461
 462         *v24_sig = d->v24_sig;
 463         return 0;
 464 }
 465
 466 /* ---- RFCOMM sessions ---- */
 467 struct rfcomm_session *rfcomm_session_add(struct socket *sock, int state)
 468 {
 469         struct rfcomm_session *s = kmalloc(sizeof(*s), GFP_KERNEL);
 470         if (!s)
 471                 return NULL;
 472         memset(s, 0, sizeof(*s));
 473
 474         BT_DBG("session %p sock %p", s, sock);
 475
 476         INIT_LIST_HEAD(&s->dlcs);
 477         s->state = state;
 478         s->sock  = sock;
 479
 480         s->mtu = RFCOMM_DEFAULT_MTU;
 481         s->cfc = RFCOMM_CFC_UNKNOWN;
 482
 483         /* Do not increment module usage count for listening sessions.
 484          * Otherwise we won't be able to unload the module. */
 485         if (state != BT_LISTEN)
 486                 if (!try_module_get(THIS_MODULE)) {
 487                         kfree(s);
 488                         return NULL;
 489                 }
 490
 491         list_add(&s->list, &session_list);
 492
 493         return s;
 494 }
 495
 496 void rfcomm_session_del(struct rfcomm_session *s)
 497 {
 498         int state = s->state;
 499
 500         BT_DBG("session %p state %ld", s, s->state);
 501
 502         list_del(&s->list);
 503
 504         if (state == BT_CONNECTED)
 505                 rfcomm_send_disc(s, 0);
 506
 507         sock_release(s->sock);
 508         kfree(s);
 509
 510         if (state != BT_LISTEN)
 511                 module_put(THIS_MODULE);
 512 }
 513
 514 struct rfcomm_session *rfcomm_session_get(bdaddr_t *src, bdaddr_t *dst)
 515 {
 516         struct rfcomm_session *s;
 517         struct list_head *p, *n;
 518         struct bt_sock *sk;
 519         list_for_each_safe(p, n, &session_list) {
 520                 s = list_entry(p, struct rfcomm_session, list);
 521                 sk = bt_sk(s->sock->sk);
 522
 523                 if ((!bacmp(src, BDADDR_ANY) || !bacmp(&sk->src, src)) &&
 524                                 !bacmp(&sk->dst, dst))
 525                         return s;
 526         }
 527         return NULL;
 528 }
 529
 530 void rfcomm_session_close(struct rfcomm_session *s, int err)
 531 {
 532         struct rfcomm_dlc *d;
 533         struct list_head *p, *n;
 534
 535         BT_DBG("session %p state %ld err %d", s, s->state, err);
 536
 537         rfcomm_session_hold(s);
 538
 539         s->state = BT_CLOSED;
 540
 541         /* Close all dlcs */
 542         list_for_each_safe(p, n, &s->dlcs) {
 543                 d = list_entry(p, struct rfcomm_dlc, list);
 544                 d->state = BT_CLOSED;
 545                 __rfcomm_dlc_close(d, err);
 546         }
 547
 548         rfcomm_session_put(s);
 549 }
 550
 551 struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst, int *err)
 552 {
 553         struct rfcomm_session *s = NULL;
 554         struct sockaddr_l2 addr;
 555         struct l2cap_options opts;
 556         struct socket *sock;
 557         int    size;
 558
 559         BT_DBG("%s %s", batostr(src), batostr(dst));
 560
 561         *err = rfcomm_l2sock_create(&sock);
 562         if (*err < 0)
 563                 return NULL;
 564
 565         bacpy(&addr.l2_bdaddr, src);
 566         addr.l2_family = AF_BLUETOOTH;
 567         addr.l2_psm    = 0;
 568         *err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
 569         if (*err < 0)
 570                 goto failed;
 571
 572         /* Set L2CAP options */
 573         size = sizeof(opts);
 574         sock->ops->getsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, &size);
 575
 576         opts.imtu = RFCOMM_MAX_L2CAP_MTU;
 577         sock->ops->setsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, size);
 578
 579         s = rfcomm_session_add(sock, BT_BOUND);
 580         if (!s) {
 581                 *err = -ENOMEM;
 582                 goto failed;
 583         }
 584
 585         s->initiator = 1;
 586
 587         bacpy(&addr.l2_bdaddr, dst);
 588         addr.l2_family = AF_BLUETOOTH;
 589         addr.l2_psm    = htobs(RFCOMM_PSM);
 590         *err = sock->ops->connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
 591         if (*err == 0 || *err == -EAGAIN)
 592                 return s;
 593
 594         rfcomm_session_del(s);
 595         return NULL;
 596
 597 failed:
 598         sock_release(sock);
 599         return NULL;
 600 }
 601
 602 void rfcomm_session_getaddr(struct rfcomm_session *s, bdaddr_t *src, bdaddr_t *dst)
 603 {
 604         struct sock *sk = s->sock->sk;
 605         if (src)
 606                 bacpy(src, &bt_sk(sk)->src);
 607         if (dst)
 608                 bacpy(dst, &bt_sk(sk)->dst);
 609 }
 610
 611 /* ---- RFCOMM frame sending ---- */
 612 static int rfcomm_send_frame(struct rfcomm_session *s, u8 *data, int len)
 613 {
 614         struct socket *sock = s->sock;
 615         struct iovec iv = { data, len };
 616         struct msghdr msg;
 617
 618         BT_DBG("session %p len %d", s, len);
 619
 620         memset(&msg, 0, sizeof(msg));
 621         msg.msg_iovlen = 1;
 622         msg.msg_iov = &iv;
 623
 624         return sock_sendmsg(sock, &msg, len);
 625 }
 626
 627 static int rfcomm_send_sabm(struct rfcomm_session *s, u8 dlci)
 628 {
 629         struct rfcomm_cmd cmd;
 630
 631         BT_DBG("%p dlci %d", s, dlci);
 632
 633         cmd.addr = __addr(s->initiator, dlci);
 634         cmd.ctrl = __ctrl(RFCOMM_SABM, 1);
 635         cmd.len  = __len8(0);
 636         cmd.fcs  = __fcs2((u8 *) &cmd);
 637
 638         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 639 }
 640
 641 static int rfcomm_send_ua(struct rfcomm_session *s, u8 dlci)
 642 {
 643         struct rfcomm_cmd cmd;
 644
 645         BT_DBG("%p dlci %d", s, dlci);
 646
 647         cmd.addr = __addr(!s->initiator, dlci);
 648         cmd.ctrl = __ctrl(RFCOMM_UA, 1);
 649         cmd.len  = __len8(0);
 650         cmd.fcs  = __fcs2((u8 *) &cmd);
 651
 652         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 653 }
 654
 655 static int rfcomm_send_disc(struct rfcomm_session *s, u8 dlci)
 656 {
 657         struct rfcomm_cmd cmd;
 658
 659         BT_DBG("%p dlci %d", s, dlci);
 660
 661         cmd.addr = __addr(s->initiator, dlci);
 662         cmd.ctrl = __ctrl(RFCOMM_DISC, 1);
 663         cmd.len  = __len8(0);
 664         cmd.fcs  = __fcs2((u8 *) &cmd);
 665
 666         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 667 }
 668
 669 static int rfcomm_queue_disc(struct rfcomm_dlc *d)
 670 {
 671         struct rfcomm_cmd *cmd;
 672         struct sk_buff *skb;
 673
 674         BT_DBG("dlc %p dlci %d", d, d->dlci);
 675
 676         skb = alloc_skb(sizeof(*cmd), GFP_KERNEL);
 677         if (!skb)
 678                 return -ENOMEM;
 679
 680         cmd = (void *) __skb_put(skb, sizeof(*cmd));
 681         cmd->addr = d->addr;
 682         cmd->ctrl = __ctrl(RFCOMM_DISC, 1);
 683         cmd->len  = __len8(0);
 684         cmd->fcs  = __fcs2((u8 *) cmd);
 685
 686         skb_queue_tail(&d->tx_queue, skb);
 687         rfcomm_schedule(RFCOMM_SCHED_TX);
 688         return 0;
 689 }
 690
 691 static int rfcomm_send_dm(struct rfcomm_session *s, u8 dlci)
 692 {
 693         struct rfcomm_cmd cmd;
 694
 695         BT_DBG("%p dlci %d", s, dlci);
 696
 697         cmd.addr = __addr(!s->initiator, dlci);
 698         cmd.ctrl = __ctrl(RFCOMM_DM, 1);
 699         cmd.len  = __len8(0);
 700         cmd.fcs  = __fcs2((u8 *) &cmd);
 701
 702         return rfcomm_send_frame(s, (void *) &cmd, sizeof(cmd));
 703 }
 704
 705 static int rfcomm_send_nsc(struct rfcomm_session *s, int cr, u8 type)
 706 {
 707         struct rfcomm_hdr *hdr;
 708         struct rfcomm_mcc *mcc;
 709         u8 buf[16], *ptr = buf;
 710
 711         BT_DBG("%p cr %d type %d", s, cr, type);
 712
 713         hdr = (void *) ptr; ptr += sizeof(*hdr);
 714         hdr->addr = __addr(s->initiator, 0);
 715         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 716         hdr->len  = __len8(sizeof(*mcc) + 1);
 717
 718         mcc = (void *) ptr; ptr += sizeof(*mcc);
 719         mcc->type = __mcc_type(cr, RFCOMM_NSC);
 720         mcc->len  = __len8(1);
 721
 722         /* Type that we didn't like */
 723         *ptr = __mcc_type(cr, type); ptr++;
 724
 725         *ptr = __fcs(buf); ptr++;
 726
 727         return rfcomm_send_frame(s, buf, ptr - buf);
 728 }
 729
 730 static int rfcomm_send_pn(struct rfcomm_session *s, int cr, struct rfcomm_dlc *d)
 731 {
 732         struct rfcomm_hdr *hdr;
 733         struct rfcomm_mcc *mcc;
 734         struct rfcomm_pn  *pn;
 735         u8 buf[16], *ptr = buf;
 736
 737         BT_DBG("%p cr %d dlci %d mtu %d", s, cr, d->dlci, d->mtu);
 738
 739         hdr = (void *) ptr; ptr += sizeof(*hdr);
 740         hdr->addr = __addr(s->initiator, 0);
 741         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 742         hdr->len  = __len8(sizeof(*mcc) + sizeof(*pn));
 743
 744         mcc = (void *) ptr; ptr += sizeof(*mcc);
 745         mcc->type = __mcc_type(cr, RFCOMM_PN);
 746         mcc->len  = __len8(sizeof(*pn));
 747
 748         pn = (void *) ptr; ptr += sizeof(*pn);
 749         pn->dlci        = d->dlci;
 750         pn->priority    = d->priority;
 751         pn->ack_timer   = 0;
 752         pn->max_retrans = 0;
 753
 754         if (s->cfc) {
 755                 pn->flow_ctrl = cr ? 0xf0 : 0xe0;
 756                 pn->credits = RFCOMM_DEFAULT_CREDITS;
 757         } else {
 758                 pn->flow_ctrl = 0;
 759                 pn->credits   = 0;
 760         }
 761
 762         pn->mtu = htobs(d->mtu);
 763
 764         *ptr = __fcs(buf); ptr++;
 765
 766         return rfcomm_send_frame(s, buf, ptr - buf);
 767 }
 768
 769 static int rfcomm_send_rpn(struct rfcomm_session *s, int cr, u8 dlci,
 770                            u8 bit_rate, u8 data_bits, u8 stop_bits,
 771                            u8 parity, u8 flow_ctrl_settings,
 772                            u8 xon_char, u8 xoff_char, u16 param_mask)
 773 {
 774         struct rfcomm_hdr *hdr;
 775         struct rfcomm_mcc *mcc;
 776         struct rfcomm_rpn *rpn;
 777         u8 buf[16], *ptr = buf;
 778
 779         BT_DBG("%p cr %d dlci %d bit_r 0x%x data_b 0x%x stop_b 0x%x parity 0x%x"
 780                "flwc_s 0x%x xon_c 0x%x xoff_c 0x%x p_mask 0x%x",
 781                         s, cr, dlci, bit_rate, data_bits, stop_bits, parity,
 782                         flow_ctrl_settings, xon_char, xoff_char, param_mask);
 783
 784         hdr = (void *) ptr; ptr += sizeof(*hdr);
 785         hdr->addr = __addr(s->initiator, 0);
 786         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 787         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rpn));
 788
 789         mcc = (void *) ptr; ptr += sizeof(*mcc);
 790         mcc->type = __mcc_type(cr, RFCOMM_RPN);
 791         mcc->len  = __len8(sizeof(*rpn));
 792
 793         rpn = (void *) ptr; ptr += sizeof(*rpn);
 794         rpn->dlci          = __addr(1, dlci);
 795         rpn->bit_rate      = bit_rate;
 796         rpn->line_settings = __rpn_line_settings(data_bits, stop_bits, parity);
 797         rpn->flow_ctrl     = flow_ctrl_settings;
 798         rpn->xon_char      = xon_char;
 799         rpn->xoff_char     = xoff_char;
 800         rpn->param_mask    = param_mask;
 801
 802         *ptr = __fcs(buf); ptr++;
 803
 804         return rfcomm_send_frame(s, buf, ptr - buf);
 805 }
 806
 807 static int rfcomm_send_rls(struct rfcomm_session *s, int cr, u8 dlci, u8 status)
 808 {
 809         struct rfcomm_hdr *hdr;
 810         struct rfcomm_mcc *mcc;
 811         struct rfcomm_rls *rls;
 812         u8 buf[16], *ptr = buf;
 813
 814         BT_DBG("%p cr %d status 0x%x", s, cr, status);
 815
 816         hdr = (void *) ptr; ptr += sizeof(*hdr);
 817         hdr->addr = __addr(s->initiator, 0);
 818         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 819         hdr->len  = __len8(sizeof(*mcc) + sizeof(*rls));
 820
 821         mcc = (void *) ptr; ptr += sizeof(*mcc);
 822         mcc->type = __mcc_type(cr, RFCOMM_RLS);
 823         mcc->len  = __len8(sizeof(*rls));
 824
 825         rls = (void *) ptr; ptr += sizeof(*rls);
 826         rls->dlci   = __addr(1, dlci);
 827         rls->status = status;
 828
 829         *ptr = __fcs(buf); ptr++;
 830
 831         return rfcomm_send_frame(s, buf, ptr - buf);
 832 }
 833
 834 static int rfcomm_send_msc(struct rfcomm_session *s, int cr, u8 dlci, u8 v24_sig)
 835 {
 836         struct rfcomm_hdr *hdr;
 837         struct rfcomm_mcc *mcc;
 838         struct rfcomm_msc *msc;
 839         u8 buf[16], *ptr = buf;
 840
 841         BT_DBG("%p cr %d v24 0x%x", s, cr, v24_sig);
 842
 843         hdr = (void *) ptr; ptr += sizeof(*hdr);
 844         hdr->addr = __addr(s->initiator, 0);
 845         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 846         hdr->len  = __len8(sizeof(*mcc) + sizeof(*msc));
 847
 848         mcc = (void *) ptr; ptr += sizeof(*mcc);
 849         mcc->type = __mcc_type(cr, RFCOMM_MSC);
 850         mcc->len  = __len8(sizeof(*msc));
 851
 852         msc = (void *) ptr; ptr += sizeof(*msc);
 853         msc->dlci    = __addr(1, dlci);
 854         msc->v24_sig = v24_sig | 0x01;
 855
 856         *ptr = __fcs(buf); ptr++;
 857
 858         return rfcomm_send_frame(s, buf, ptr - buf);
 859 }
 860
 861 static int rfcomm_send_fcoff(struct rfcomm_session *s, int cr)
 862 {
 863         struct rfcomm_hdr *hdr;
 864         struct rfcomm_mcc *mcc;
 865         u8 buf[16], *ptr = buf;
 866
 867         BT_DBG("%p cr %d", s, cr);
 868
 869         hdr = (void *) ptr; ptr += sizeof(*hdr);
 870         hdr->addr = __addr(s->initiator, 0);
 871         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 872         hdr->len  = __len8(sizeof(*mcc));
 873
 874         mcc = (void *) ptr; ptr += sizeof(*mcc);
 875         mcc->type = __mcc_type(cr, RFCOMM_FCOFF);
 876         mcc->len  = __len8(0);
 877
 878         *ptr = __fcs(buf); ptr++;
 879
 880         return rfcomm_send_frame(s, buf, ptr - buf);
 881 }
 882
 883 static int rfcomm_send_fcon(struct rfcomm_session *s, int cr)
 884 {
 885         struct rfcomm_hdr *hdr;
 886         struct rfcomm_mcc *mcc;
 887         u8 buf[16], *ptr = buf;
 888
 889         BT_DBG("%p cr %d", s, cr);
 890
 891         hdr = (void *) ptr; ptr += sizeof(*hdr);
 892         hdr->addr = __addr(s->initiator, 0);
 893         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 894         hdr->len  = __len8(sizeof(*mcc));
 895
 896         mcc = (void *) ptr; ptr += sizeof(*mcc);
 897         mcc->type = __mcc_type(cr, RFCOMM_FCON);
 898         mcc->len  = __len8(0);
 899
 900         *ptr = __fcs(buf); ptr++;
 901
 902         return rfcomm_send_frame(s, buf, ptr - buf);
 903 }
 904
 905 static int rfcomm_send_test(struct rfcomm_session *s, int cr, u8 *pattern, int len)
 906 {
 907         struct socket *sock = s->sock;
 908         struct iovec iv[3];
 909         struct msghdr msg;
 910         unsigned char hdr[5], crc[1];
 911
 912         if (len > 125)
 913                 return -EINVAL;
 914
 915         BT_DBG("%p cr %d", s, cr);
 916
 917         hdr[0] = __addr(s->initiator, 0);
 918         hdr[1] = __ctrl(RFCOMM_UIH, 0);
 919         hdr[2] = 0x01 | ((len + 2) << 1);
 920         hdr[3] = 0x01 | ((cr & 0x01) << 1) | (RFCOMM_TEST << 2);
 921         hdr[4] = 0x01 | (len << 1);
 922
 923         crc[0] = __fcs(hdr);
 924
 925         iv[0].iov_base = hdr;
 926         iv[0].iov_len  = 5;
 927         iv[1].iov_base = pattern;
 928         iv[1].iov_len  = len;
 929         iv[2].iov_base = crc;
 930         iv[2].iov_len  = 1;
 931
 932         memset(&msg, 0, sizeof(msg));
 933         msg.msg_iovlen = 3;
 934         msg.msg_iov = iv;
 935
 936         return sock_sendmsg(sock, &msg, 6 + len);
 937 }
 938
 939 static int rfcomm_send_credits(struct rfcomm_session *s, u8 addr, u8 credits)
 940 {
 941         struct rfcomm_hdr *hdr;
 942         u8 buf[16], *ptr = buf;
 943
 944         BT_DBG("%p addr %d credits %d", s, addr, credits);
 945
 946         hdr = (void *) ptr; ptr += sizeof(*hdr);
 947         hdr->addr = addr;
 948         hdr->ctrl = __ctrl(RFCOMM_UIH, 1);
 949         hdr->len  = __len8(0);
 950
 951         *ptr = credits; ptr++;
 952
 953         *ptr = __fcs(buf); ptr++;
 954
 955         return rfcomm_send_frame(s, buf, ptr - buf);
 956 }
 957
 958 static void rfcomm_make_uih(struct sk_buff *skb, u8 addr)
 959 {
 960         struct rfcomm_hdr *hdr;
 961         int len = skb->len;
 962         u8 *crc;
 963
 964         if (len > 127) {
 965                 hdr = (void *) skb_push(skb, 4);
 966                 put_unaligned(htobs(__len16(len)), (u16 *) &hdr->len);
 967         } else {
 968                 hdr = (void *) skb_push(skb, 3);
 969                 hdr->len = __len8(len);
 970         }
 971         hdr->addr = addr;
 972         hdr->ctrl = __ctrl(RFCOMM_UIH, 0);
 973
 974         crc = skb_put(skb, 1);
 975         *crc = __fcs((void *) hdr);
 976 }
 977
 978 /* ---- RFCOMM frame reception ---- */
 979 static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
 980 {
 981         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
 982
 983         if (dlci) {
 984                 /* Data channel */
 985                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
 986                 if (!d) {
 987                         rfcomm_send_dm(s, dlci);
 988                         return 0;
 989                 }
 990
 991                 switch (d->state) {
 992                 case BT_CONNECT:
 993                         rfcomm_dlc_clear_timer(d);
 994
 995                         rfcomm_dlc_lock(d);
 996                         d->state = BT_CONNECTED;
 997                         d->state_change(d, 0);
 998                         rfcomm_dlc_unlock(d);
 999
1000                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1001                         break;
1002
1003                 case BT_DISCONN:
1004                         d->state = BT_CLOSED;
1005                         __rfcomm_dlc_close(d, 0);
1006                         break;
1007                 }
1008         } else {
1009                 /* Control channel */
1010                 switch (s->state) {
1011                 case BT_CONNECT:
1012                         s->state = BT_CONNECTED;
1013                         rfcomm_process_connect(s);
1014                         break;
1015                 }
1016         }
1017         return 0;
1018 }
1019
1020 static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
1021 {
1022         int err = 0;
1023
1024         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1025
1026         if (dlci) {
1027                 /* Data DLC */
1028                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1029                 if (d) {
1030                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1031                                 err = ECONNREFUSED;
1032                         else
1033                                 err = ECONNRESET;
1034
1035                         d->state = BT_CLOSED;
1036                         __rfcomm_dlc_close(d, err);
1037                 }
1038         } else {
1039                 if (s->state == BT_CONNECT)
1040                         err = ECONNREFUSED;
1041                 else
1042                         err = ECONNRESET;
1043
1044                 s->state = BT_CLOSED;
1045                 rfcomm_session_close(s, err);
1046         }
1047         return 0;
1048 }
1049
1050 static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
1051 {
1052         int err = 0;
1053
1054         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1055
1056         if (dlci) {
1057                 struct rfcomm_dlc *d = rfcomm_dlc_get(s, dlci);
1058                 if (d) {
1059                         rfcomm_send_ua(s, dlci);
1060
1061                         if (d->state == BT_CONNECT || d->state == BT_CONFIG)
1062                                 err = ECONNREFUSED;
1063                         else
1064                                 err = ECONNRESET;
1065
1066                         d->state = BT_CLOSED;
1067                         __rfcomm_dlc_close(d, err);
1068                 } else
1069                         rfcomm_send_dm(s, dlci);
1070
1071         } else {
1072                 rfcomm_send_ua(s, 0);
1073
1074                 if (s->state == BT_CONNECT)
1075                         err = ECONNREFUSED;
1076                 else
1077                         err = ECONNRESET;
1078
1079                 s->state = BT_CLOSED;
1080                 rfcomm_session_close(s, err);
1081         }
1082
1083         return 0;
1084 }
1085
1086 static int rfcomm_recv_sabm(struct rfcomm_session *s, u8 dlci)
1087 {
1088         struct rfcomm_dlc *d;
1089         u8 channel;
1090
1091         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1092
1093         if (!dlci) {
1094                 rfcomm_send_ua(s, 0);
1095
1096                 if (s->state == BT_OPEN) {
1097                         s->state = BT_CONNECTED;
1098                         rfcomm_process_connect(s);
1099                 }
1100                 return 0;
1101         }
1102
1103         /* Check if DLC exists */
1104         d = rfcomm_dlc_get(s, dlci);
1105         if (d) {
1106                 if (d->state == BT_OPEN) {
1107                         /* DLC was previously opened by PN request */
1108                         rfcomm_send_ua(s, dlci);
1109
1110                         rfcomm_dlc_lock(d);
1111                         d->state = BT_CONNECTED;
1112                         d->state_change(d, 0);
1113                         rfcomm_dlc_unlock(d);
1114
1115                         rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1116                 }
1117                 return 0;
1118         }
1119
1120         /* Notify socket layer about incoming connection */
1121         channel = __srv_channel(dlci);
1122         if (rfcomm_connect_ind(s, channel, &d)) {
1123                 d->dlci = dlci;
1124                 d->addr = __addr(s->initiator, dlci);
1125                 rfcomm_dlc_link(s, d);
1126
1127                 rfcomm_send_ua(s, dlci);
1128
1129                 rfcomm_dlc_lock(d);
1130                 d->state = BT_CONNECTED;
1131                 d->state_change(d, 0);
1132                 rfcomm_dlc_unlock(d);
1133
1134                 rfcomm_send_msc(s, 1, dlci, d->v24_sig);
1135         } else {
1136                 rfcomm_send_dm(s, dlci);
1137         }
1138
1139         return 0;
1140 }
1141
1142 static int rfcomm_apply_pn(struct rfcomm_dlc *d, int cr, struct rfcomm_pn *pn)
1143 {
1144         struct rfcomm_session *s = d->session;
1145
1146         BT_DBG("dlc %p state %ld dlci %d mtu %d fc 0x%x credits %d",
1147                         d, d->state, d->dlci, pn->mtu, pn->flow_ctrl, pn->credits);
1148
1149         if (pn->flow_ctrl == 0xf0 || pn->flow_ctrl == 0xe0) {
1150                 d->cfc = s->cfc = RFCOMM_CFC_ENABLED;
1151                 d->tx_credits = pn->credits;
1152         } else {
1153                 d->cfc = s->cfc = RFCOMM_CFC_DISABLED;
1154                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1155         }
1156
1157         d->priority = pn->priority;
1158
1159         d->mtu = s->mtu = btohs(pn->mtu);
1160
1161         return 0;
1162 }
1163
1164 static int rfcomm_recv_pn(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1165 {
1166         struct rfcomm_pn *pn = (void *) skb->data;
1167         struct rfcomm_dlc *d;
1168         u8 dlci = pn->dlci;
1169
1170         BT_DBG("session %p state %ld dlci %d", s, s->state, dlci);
1171
1172         if (!dlci)
1173                 return 0;
1174
1175         d = rfcomm_dlc_get(s, dlci);
1176         if (d) {
1177                 if (cr) {
1178                         /* PN request */
1179                         rfcomm_apply_pn(d, cr, pn);
1180                         rfcomm_send_pn(s, 0, d);
1181                 } else {
1182                         /* PN response */
1183                         switch (d->state) {
1184                         case BT_CONFIG:
1185                                 rfcomm_apply_pn(d, cr, pn);
1186
1187                                 d->state = BT_CONNECT;
1188                                 rfcomm_send_sabm(s, d->dlci);
1189                                 break;
1190                         }
1191                 }
1192         } else {
1193                 u8 channel = __srv_channel(dlci);
1194
1195                 if (!cr)
1196                         return 0;
1197
1198                 /* PN request for non existing DLC.
1199                  * Assume incoming connection. */
1200                 if (rfcomm_connect_ind(s, channel, &d)) {
1201                         d->dlci = dlci;
1202                         d->addr = __addr(s->initiator, dlci);
1203                         rfcomm_dlc_link(s, d);
1204
1205                         rfcomm_apply_pn(d, cr, pn);
1206
1207                         d->state = BT_OPEN;
1208                         rfcomm_send_pn(s, 0, d);
1209                 } else {
1210                         rfcomm_send_dm(s, dlci);
1211                 }
1212         }
1213         return 0;
1214 }
1215
1216 static int rfcomm_recv_rpn(struct rfcomm_session *s, int cr, int len, struct sk_buff *skb)
1217 {
1218         struct rfcomm_rpn *rpn = (void *) skb->data;
1219         u8 dlci = __get_dlci(rpn->dlci);
1220
1221         u8 bit_rate  = 0;
1222         u8 data_bits = 0;
1223         u8 stop_bits = 0;
1224         u8 parity    = 0;
1225         u8 flow_ctrl = 0;
1226         u8 xon_char  = 0;
1227         u8 xoff_char = 0;
1228         u16 rpn_mask = RFCOMM_RPN_PM_ALL;
1229
1230         BT_DBG("dlci %d cr %d len 0x%x bitr 0x%x line 0x%x flow 0x%x xonc 0x%x xoffc 0x%x pm 0x%x",
1231                dlci, cr, len, rpn->bit_rate, rpn->line_settings, rpn->flow_ctrl,
1232                rpn->xon_char, rpn->xoff_char, rpn->param_mask);
1233
1234         if (!cr)
1235                 return 0;
1236
1237         if (len == 1) {
1238                 /* request: return default setting */
1239                 bit_rate  = RFCOMM_RPN_BR_115200;
1240                 data_bits = RFCOMM_RPN_DATA_8;
1241                 stop_bits = RFCOMM_RPN_STOP_1;
1242                 parity    = RFCOMM_RPN_PARITY_NONE;
1243                 flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1244                 xon_char  = RFCOMM_RPN_XON_CHAR;
1245                 xoff_char = RFCOMM_RPN_XOFF_CHAR;
1246
1247                 goto rpn_out;
1248         }
1249         /* check for sane values: ignore/accept bit_rate, 8 bits, 1 stop bit, no parity,
1250                                   no flow control lines, normal XON/XOFF chars */
1251         if (rpn->param_mask & RFCOMM_RPN_PM_BITRATE) {
1252                 bit_rate = rpn->bit_rate;
1253                 if (bit_rate != RFCOMM_RPN_BR_115200) {
1254                         BT_DBG("RPN bit rate mismatch 0x%x", bit_rate);
1255                         bit_rate = RFCOMM_RPN_BR_115200;
1256                         rpn_mask ^= RFCOMM_RPN_PM_BITRATE;
1257                 }
1258         }
1259         if (rpn->param_mask & RFCOMM_RPN_PM_DATA) {
1260                 data_bits = __get_rpn_data_bits(rpn->line_settings);
1261                 if (data_bits != RFCOMM_RPN_DATA_8) {
1262                         BT_DBG("RPN data bits mismatch 0x%x", data_bits);
1263                         data_bits = RFCOMM_RPN_DATA_8;
1264                         rpn_mask ^= RFCOMM_RPN_PM_DATA;
1265                 }
1266         }
1267         if (rpn->param_mask & RFCOMM_RPN_PM_STOP) {
1268                 stop_bits = __get_rpn_stop_bits(rpn->line_settings);
1269                 if (stop_bits != RFCOMM_RPN_STOP_1) {
1270                         BT_DBG("RPN stop bits mismatch 0x%x", stop_bits);
1271                         stop_bits = RFCOMM_RPN_STOP_1;
1272                         rpn_mask ^= RFCOMM_RPN_PM_STOP;
1273                 }
1274         }
1275         if (rpn->param_mask & RFCOMM_RPN_PM_PARITY) {
1276                 parity = __get_rpn_parity(rpn->line_settings);
1277                 if (parity != RFCOMM_RPN_PARITY_NONE) {
1278                         BT_DBG("RPN parity mismatch 0x%x", parity);
1279                         parity = RFCOMM_RPN_PARITY_NONE;
1280                         rpn_mask ^= RFCOMM_RPN_PM_PARITY;
1281                 }
1282         }
1283         if (rpn->param_mask & RFCOMM_RPN_PM_FLOW) {
1284                 flow_ctrl = rpn->flow_ctrl;
1285                 if (flow_ctrl != RFCOMM_RPN_FLOW_NONE) {
1286                         BT_DBG("RPN flow ctrl mismatch 0x%x", flow_ctrl);
1287                         flow_ctrl = RFCOMM_RPN_FLOW_NONE;
1288                         rpn_mask ^= RFCOMM_RPN_PM_FLOW;
1289                 }
1290         }
1291         if (rpn->param_mask & RFCOMM_RPN_PM_XON) {
1292                 xon_char = rpn->xon_char;
1293                 if (xon_char != RFCOMM_RPN_XON_CHAR) {
1294                         BT_DBG("RPN XON char mismatch 0x%x", xon_char);
1295                         xon_char = RFCOMM_RPN_XON_CHAR;
1296                         rpn_mask ^= RFCOMM_RPN_PM_XON;
1297                 }
1298         }
1299         if (rpn->param_mask & RFCOMM_RPN_PM_XOFF) {
1300                 xoff_char = rpn->xoff_char;
1301                 if (xoff_char != RFCOMM_RPN_XOFF_CHAR) {
1302                         BT_DBG("RPN XOFF char mismatch 0x%x", xoff_char);
1303                         xoff_char = RFCOMM_RPN_XOFF_CHAR;
1304                         rpn_mask ^= RFCOMM_RPN_PM_XOFF;
1305                 }
1306         }
1307
1308 rpn_out:
1309         rfcomm_send_rpn(s, 0, dlci,
1310                         bit_rate, data_bits, stop_bits, parity, flow_ctrl,
1311                         xon_char, xoff_char, rpn_mask);
1312
1313         return 0;
1314 }
1315
1316 static int rfcomm_recv_rls(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1317 {
1318         struct rfcomm_rls *rls = (void *) skb->data;
1319         u8 dlci = __get_dlci(rls->dlci);
1320
1321         BT_DBG("dlci %d cr %d status 0x%x", dlci, cr, rls->status);
1322
1323         if (!cr)
1324                 return 0;
1325
1326         /* FIXME: We should probably do something with this
1327            information here. But for now it's sufficient just
1328            to reply -- Bluetooth 1.1 says it's mandatory to
1329            recognise and respond to RLS */
1330
1331         rfcomm_send_rls(s, 0, dlci, rls->status);
1332
1333         return 0;
1334 }
1335
1336 static int rfcomm_recv_msc(struct rfcomm_session *s, int cr, struct sk_buff *skb)
1337 {
1338         struct rfcomm_msc *msc = (void *) skb->data;
1339         struct rfcomm_dlc *d;
1340         u8 dlci = __get_dlci(msc->dlci);
1341
1342         BT_DBG("dlci %d cr %d v24 0x%x", dlci, cr, msc->v24_sig);
1343
1344         d = rfcomm_dlc_get(s, dlci);
1345         if (!d)
1346                 return 0;
1347
1348         if (cr) {
1349                 if (msc->v24_sig & RFCOMM_V24_FC && !d->cfc)
1350                         set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1351                 else
1352                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1353
1354                 rfcomm_dlc_lock(d);
1355                 if (d->modem_status)
1356                         d->modem_status(d, msc->v24_sig);
1357                 rfcomm_dlc_unlock(d);
1358
1359                 rfcomm_send_msc(s, 0, dlci, msc->v24_sig);
1360
1361                 d->mscex |= RFCOMM_MSCEX_RX;
1362         } else
1363                 d->mscex |= RFCOMM_MSCEX_TX;
1364
1365         return 0;
1366 }
1367
1368 static int rfcomm_recv_mcc(struct rfcomm_session *s, struct sk_buff *skb)
1369 {
1370         struct rfcomm_mcc *mcc = (void *) skb->data;
1371         u8 type, cr, len;
1372
1373         cr   = __test_cr(mcc->type);
1374         type = __get_mcc_type(mcc->type);
1375         len  = __get_mcc_len(mcc->len);
1376
1377         BT_DBG("%p type 0x%x cr %d", s, type, cr);
1378
1379         skb_pull(skb, 2);
1380
1381         switch (type) {
1382         case RFCOMM_PN:
1383                 rfcomm_recv_pn(s, cr, skb);
1384                 break;
1385
1386         case RFCOMM_RPN:
1387                 rfcomm_recv_rpn(s, cr, len, skb);
1388                 break;
1389
1390         case RFCOMM_RLS:
1391                 rfcomm_recv_rls(s, cr, skb);
1392                 break;
1393
1394         case RFCOMM_MSC:
1395                 rfcomm_recv_msc(s, cr, skb);
1396                 break;
1397
1398         case RFCOMM_FCOFF:
1399                 if (cr) {
1400                         set_bit(RFCOMM_TX_THROTTLED, &s->flags);
1401                         rfcomm_send_fcoff(s, 0);
1402                 }
1403                 break;
1404
1405         case RFCOMM_FCON:
1406                 if (cr) {
1407                         clear_bit(RFCOMM_TX_THROTTLED, &s->flags);
1408                         rfcomm_send_fcon(s, 0);
1409                 }
1410                 break;
1411
1412         case RFCOMM_TEST:
1413                 if (cr)
1414                         rfcomm_send_test(s, 0, skb->data, skb->len);
1415                 break;
1416
1417         case RFCOMM_NSC:
1418                 break;
1419
1420         default:
1421                 BT_ERR("Unknown control type 0x%02x", type);
1422                 rfcomm_send_nsc(s, cr, type);
1423                 break;
1424         }
1425         return 0;
1426 }
1427
1428 static int rfcomm_recv_data(struct rfcomm_session *s, u8 dlci, int pf, struct sk_buff *skb)
1429 {
1430         struct rfcomm_dlc *d;
1431
1432         BT_DBG("session %p state %ld dlci %d pf %d", s, s->state, dlci, pf);
1433
1434         d = rfcomm_dlc_get(s, dlci);
1435         if (!d) {
1436                 rfcomm_send_dm(s, dlci);
1437                 goto drop;
1438         }
1439
1440         if (pf && d->cfc) {
1441                 u8 credits = *(u8 *) skb->data; skb_pull(skb, 1);
1442
1443                 d->tx_credits += credits;
1444                 if (d->tx_credits)
1445                         clear_bit(RFCOMM_TX_THROTTLED, &d->flags);
1446         }
1447
1448         if (skb->len && d->state == BT_CONNECTED) {
1449                 rfcomm_dlc_lock(d);
1450                 d->rx_credits--;
1451                 d->data_ready(d, skb);
1452                 rfcomm_dlc_unlock(d);
1453                 return 0;
1454         }
1455
1456 drop:
1457         kfree_skb(skb);
1458         return 0;
1459 }
1460
1461 static int rfcomm_recv_frame(struct rfcomm_session *s, struct sk_buff *skb)
1462 {
1463         struct rfcomm_hdr *hdr = (void *) skb->data;
1464         u8 type, dlci, fcs;
1465
1466         dlci = __get_dlci(hdr->addr);
1467         type = __get_type(hdr->ctrl);
1468
1469         /* Trim FCS */
1470         skb->len--; skb->tail--;
1471         fcs = *(u8 *) skb->tail;
1472
1473         if (__check_fcs(skb->data, type, fcs)) {
1474                 BT_ERR("bad checksum in packet");
1475                 kfree_skb(skb);
1476                 return -EILSEQ;
1477         }
1478
1479         if (__test_ea(hdr->len))
1480                 skb_pull(skb, 3);
1481         else
1482                 skb_pull(skb, 4);
1483
1484         switch (type) {
1485         case RFCOMM_SABM:
1486                 if (__test_pf(hdr->ctrl))
1487                         rfcomm_recv_sabm(s, dlci);
1488                 break;
1489
1490         case RFCOMM_DISC:
1491                 if (__test_pf(hdr->ctrl))
1492                         rfcomm_recv_disc(s, dlci);
1493                 break;
1494
1495         case RFCOMM_UA:
1496                 if (__test_pf(hdr->ctrl))
1497                         rfcomm_recv_ua(s, dlci);
1498                 break;
1499
1500         case RFCOMM_DM:
1501                 rfcomm_recv_dm(s, dlci);
1502                 break;
1503
1504         case RFCOMM_UIH:
1505                 if (dlci)
1506                         return rfcomm_recv_data(s, dlci, __test_pf(hdr->ctrl), skb);
1507
1508                 rfcomm_recv_mcc(s, skb);
1509                 break;
1510
1511         default:
1512                 BT_ERR("Unknown packet type 0x%02x\n", type);
1513                 break;
1514         }
1515         kfree_skb(skb);
1516         return 0;
1517 }
1518
1519 /* ---- Connection and data processing ---- */
1520
1521 static void rfcomm_process_connect(struct rfcomm_session *s)
1522 {
1523         struct rfcomm_dlc *d;
1524         struct list_head *p, *n;
1525
1526         BT_DBG("session %p state %ld", s, s->state);
1527
1528         list_for_each_safe(p, n, &s->dlcs) {
1529                 d = list_entry(p, struct rfcomm_dlc, list);
1530                 if (d->state == BT_CONFIG) {
1531                         d->mtu = s->mtu;
1532                         rfcomm_send_pn(s, 1, d);
1533                 }
1534         }
1535 }
1536
1537 /* Send data queued for the DLC.
1538  * Return number of frames left in the queue.
1539  */
1540 static inline int rfcomm_process_tx(struct rfcomm_dlc *d)
1541 {
1542         struct sk_buff *skb;
1543         int err;
1544
1545         BT_DBG("dlc %p state %ld cfc %d rx_credits %d tx_credits %d",
1546                         d, d->state, d->cfc, d->rx_credits, d->tx_credits);
1547
1548         /* Send pending MSC */
1549         if (test_and_clear_bit(RFCOMM_MSC_PENDING, &d->flags))
1550                 rfcomm_send_msc(d->session, 1, d->dlci, d->v24_sig);
1551
1552         if (d->cfc) {
1553                 /* CFC enabled.
1554                  * Give them some credits */
1555                 if (!test_bit(RFCOMM_RX_THROTTLED, &d->flags) &&
1556                                 d->rx_credits <= (d->cfc >> 2)) {
1557                         rfcomm_send_credits(d->session, d->addr, d->cfc - d->rx_credits);
1558                         d->rx_credits = d->cfc;
1559                 }
1560         } else {
1561                 /* CFC disabled.
1562                  * Give ourselves some credits */
1563                 d->tx_credits = 5;
1564         }
1565
1566         if (test_bit(RFCOMM_TX_THROTTLED, &d->flags))
1567                 return skb_queue_len(&d->tx_queue);
1568
1569         while (d->tx_credits && (skb = skb_dequeue(&d->tx_queue))) {
1570                 err = rfcomm_send_frame(d->session, skb->data, skb->len);
1571                 if (err < 0) {
1572                         skb_queue_head(&d->tx_queue, skb);
1573                         break;
1574                 }
1575                 kfree_skb(skb);
1576                 d->tx_credits--;
1577         }
1578
1579         if (d->cfc && !d->tx_credits) {
1580                 /* We're out of TX credits.
1581                  * Set TX_THROTTLED flag to avoid unnesary wakeups by dlc_send. */
1582                 set_bit(RFCOMM_TX_THROTTLED, &d->flags);
1583         }
1584
1585         return skb_queue_len(&d->tx_queue);
1586 }
1587
1588 static inline void rfcomm_process_dlcs(struct rfcomm_session *s)
1589 {
1590         struct rfcomm_dlc *d;
1591         struct list_head *p, *n;
1592
1593         BT_DBG("session %p state %ld", s, s->state);
1594
1595         list_for_each_safe(p, n, &s->dlcs) {
1596                 d = list_entry(p, struct rfcomm_dlc, list);
1597                 if (test_bit(RFCOMM_TIMED_OUT, &d->flags)) {
1598                         __rfcomm_dlc_close(d, ETIMEDOUT);
1599                         continue;
1600                 }
1601
1602                 if (test_bit(RFCOMM_TX_THROTTLED, &s->flags))
1603                         continue;
1604
1605                 if ((d->state == BT_CONNECTED || d->state == BT_DISCONN) &&
1606                                 d->mscex == RFCOMM_MSCEX_OK)
1607                         rfcomm_process_tx(d);
1608         }
1609 }
1610
1611 static inline void rfcomm_process_rx(struct rfcomm_session *s)
1612 {
1613         struct socket *sock = s->sock;
1614         struct sock *sk = sock->sk;
1615         struct sk_buff *skb;
1616
1617         BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue));
1618
1619         /* Get data directly from socket receive queue without copying it. */
1620         while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
1621                 skb_orphan(skb);
1622                 rfcomm_recv_frame(s, skb);
1623         }
1624
1625         if (sk->sk_state == BT_CLOSED) {
1626                 if (!s->initiator)
1627                         rfcomm_session_put(s);
1628
1629                 rfcomm_session_close(s, sk->sk_err);
1630         }
1631 }
1632
1633 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
1634 {
1635         struct socket *sock = s->sock, *nsock;
1636         int err;
1637
1638         /* Fast check for a new connection.
1639          * Avoids unnesesary socket allocations. */
1640         if (list_empty(&bt_sk(sock->sk)->accept_q))
1641                 return;
1642
1643         BT_DBG("session %p", s);
1644
1645         if (sock_create_lite(PF_BLUETOOTH, sock->type, BTPROTO_L2CAP, &nsock))
1646                 return;
1647
1648         nsock->ops  = sock->ops;
1649
1650         __module_get(nsock->ops->owner);
1651
1652         err = sock->ops->accept(sock, nsock, O_NONBLOCK);
1653         if (err < 0) {
1654                 sock_release(nsock);
1655                 return;
1656         }
1657
1658         /* Set our callbacks */
1659         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
1660         nsock->sk->sk_state_change = rfcomm_l2state_change;
1661
1662         s = rfcomm_session_add(nsock, BT_OPEN);
1663         if (s) {
1664                 rfcomm_session_hold(s);
1665                 rfcomm_schedule(RFCOMM_SCHED_RX);
1666         } else
1667                 sock_release(nsock);
1668 }
1669
1670 static inline void rfcomm_check_connection(struct rfcomm_session *s)
1671 {
1672         struct sock *sk = s->sock->sk;
1673
1674         BT_DBG("%p state %ld", s, s->state);
1675
1676         switch(sk->sk_state) {
1677         case BT_CONNECTED:
1678                 s->state = BT_CONNECT;
1679
1680                 /* We can adjust MTU on outgoing sessions.
1681                  * L2CAP MTU minus UIH header and FCS. */
1682                 s->mtu = min(l2cap_pi(sk)->omtu, l2cap_pi(sk)->imtu) - 5;
1683
1684                 rfcomm_send_sabm(s, 0);
1685                 break;
1686
1687         case BT_CLOSED:
1688                 s->state = BT_CLOSED;
1689                 rfcomm_session_close(s, sk->sk_err);
1690                 break;
1691         }
1692 }
1693
1694 static inline void rfcomm_process_sessions(void)
1695 {
1696         struct list_head *p, *n;
1697
1698         rfcomm_lock();
1699
1700         list_for_each_safe(p, n, &session_list) {
1701                 struct rfcomm_session *s;
1702                 s = list_entry(p, struct rfcomm_session, list);
1703
1704                 if (s->state == BT_LISTEN) {
1705                         rfcomm_accept_connection(s);
1706                         continue;
1707                 }
1708
1709                 rfcomm_session_hold(s);
1710
1711                 switch (s->state) {
1712                 case BT_BOUND:
1713                         rfcomm_check_connection(s);
1714                         break;
1715
1716                 default:
1717                         rfcomm_process_rx(s);
1718                         break;
1719                 }
1720
1721                 rfcomm_process_dlcs(s);
1722
1723                 rfcomm_session_put(s);
1724         }
1725
1726         rfcomm_unlock();
1727 }
1728
1729 static void rfcomm_worker(void)
1730 {
1731         BT_DBG("");
1732
1733         while (!atomic_read(&terminate)) {
1734                 if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
1735                         /* No pending events. Let's sleep.
1736                          * Incoming connections and data will wake us up. */
1737                         set_current_state(TASK_INTERRUPTIBLE);
1738                         schedule();
1739                 }
1740
1741                 /* Process stuff */
1742                 clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
1743                 rfcomm_process_sessions();
1744         }
1745         set_current_state(TASK_RUNNING);
1746         return;
1747 }
1748
1749 static int rfcomm_add_listener(bdaddr_t *ba)
1750 {
1751         struct sockaddr_l2 addr;
1752         struct l2cap_options opts;
1753         struct socket *sock;
1754         struct rfcomm_session *s;
1755         int    size, err = 0;
1756
1757         /* Create socket */
1758         err = rfcomm_l2sock_create(&sock);
1759         if (err < 0) {
1760                 BT_ERR("Create socket failed %d", err);
1761                 return err;
1762         }
1763
1764         /* Bind socket */
1765         bacpy(&addr.l2_bdaddr, ba);
1766         addr.l2_family = AF_BLUETOOTH;
1767         addr.l2_psm    = htobs(RFCOMM_PSM);
1768         err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
1769         if (err < 0) {
1770                 BT_ERR("Bind failed %d", err);
1771                 goto failed;
1772         }
1773
1774         /* Set L2CAP options */
1775         size = sizeof(opts);
1776         sock->ops->getsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, &size);
1777
1778         opts.imtu = RFCOMM_MAX_L2CAP_MTU;
1779         sock->ops->setsockopt(sock, SOL_L2CAP, L2CAP_OPTIONS, (void *)&opts, size);
1780
1781         /* Start listening on the socket */
1782         err = sock->ops->listen(sock, 10);
1783         if (err) {
1784                 BT_ERR("Listen failed %d", err);
1785                 goto failed;
1786         }
1787
1788         /* Add listening session */
1789         s = rfcomm_session_add(sock, BT_LISTEN);
1790         if (!s)
1791                 goto failed;
1792
1793         rfcomm_session_hold(s);
1794         return 0;
1795 failed:
1796         sock_release(sock);
1797         return err;
1798 }
1799
1800 static void rfcomm_kill_listener(void)
1801 {
1802         struct rfcomm_session *s;
1803         struct list_head *p, *n;
1804
1805         BT_DBG("");
1806
1807         list_for_each_safe(p, n, &session_list) {
1808                 s = list_entry(p, struct rfcomm_session, list);
1809                 rfcomm_session_del(s);
1810         }
1811 }
1812
1813 static int rfcomm_run(void *unused)
1814 {
1815         rfcomm_thread = current;
1816
1817         atomic_inc(&running);
1818
1819         daemonize("krfcommd");
1820         set_user_nice(current, -10);
1821         current->flags |= PF_NOFREEZE;
1822
1823         set_fs(KERNEL_DS);
1824
1825         BT_DBG("");
1826
1827         rfcomm_add_listener(BDADDR_ANY);
1828
1829         rfcomm_worker();
1830
1831         rfcomm_kill_listener();
1832
1833         atomic_dec(&running);
1834         return 0;
1835 }
1836
1837 /* ---- Proc fs support ---- */
1838 #ifdef CONFIG_PROC_FS
1839 static void *rfcomm_seq_start(struct seq_file *seq, loff_t *pos)
1840 {
1841         struct rfcomm_session *s;
1842         struct list_head *pp, *p;
1843         loff_t l = *pos;
1844
1845         rfcomm_lock();
1846
1847         list_for_each(p, &session_list) {
1848                 s = list_entry(p, struct rfcomm_session, list);
1849                 list_for_each(pp, &s->dlcs)
1850                         if (!l--) {
1851                                 seq->private = s;
1852                                 return pp;
1853                         }
1854         }
1855         return NULL;
1856 }
1857
1858 static void *rfcomm_seq_next(struct seq_file *seq, void *e, loff_t *pos)
1859 {
1860         struct rfcomm_session *s = seq->private;
1861         struct list_head *pp, *p = e;
1862         (*pos)++;
1863
1864         if (p->next != &s->dlcs)
1865                 return p->next;
1866
1867         list_for_each(p, &session_list) {
1868                 s = list_entry(p, struct rfcomm_session, list);
1869                 __list_for_each(pp, &s->dlcs) {
1870                         seq->private = s;
1871                         return pp;
1872                 }
1873         }
1874         return NULL;
1875 }
1876
1877 static void rfcomm_seq_stop(struct seq_file *seq, void *e)
1878 {
1879         rfcomm_unlock();
1880 }
1881
1882 static int  rfcomm_seq_show(struct seq_file *seq, void *e)
1883 {
1884         struct rfcomm_session *s = seq->private;
1885         struct sock *sk = s->sock->sk;
1886         struct rfcomm_dlc *d = list_entry(e, struct rfcomm_dlc, list);
1887
1888         seq_printf(seq, "%s %s %ld %d %d %d %d\n",
1889                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
1890                         d->state, d->dlci, d->mtu, d->rx_credits, d->tx_credits);
1891         return 0;
1892 }
1893
1894 static struct seq_operations rfcomm_seq_ops = {
1895         .start  = rfcomm_seq_start,
1896         .next   = rfcomm_seq_next,
1897         .stop   = rfcomm_seq_stop,
1898         .show   = rfcomm_seq_show
1899 };
1900
1901 static int rfcomm_seq_open(struct inode *inode, struct file *file)
1902 {
1903         return seq_open(file, &rfcomm_seq_ops);
1904 }
1905
1906 static struct file_operations rfcomm_seq_fops = {
1907         .owner   = THIS_MODULE,
1908         .open    = rfcomm_seq_open,
1909         .read    = seq_read,
1910         .llseek  = seq_lseek,
1911         .release = seq_release,
1912 };
1913
1914 static int  __init rfcomm_proc_init(void)
1915 {
1916         struct proc_dir_entry *p;
1917
1918         proc_bt_rfcomm = proc_mkdir("rfcomm", proc_bt);
1919         if (proc_bt_rfcomm) {
1920                 proc_bt_rfcomm->owner = THIS_MODULE;
1921
1922                 p = create_proc_entry("dlc", S_IRUGO, proc_bt_rfcomm);
1923                 if (p)
1924                         p->proc_fops = &rfcomm_seq_fops;
1925         }
1926         return 0;
1927 }
1928
1929 static void __exit rfcomm_proc_cleanup(void)
1930 {
1931         remove_proc_entry("dlc", proc_bt_rfcomm);
1932
1933         remove_proc_entry("rfcomm", proc_bt);
1934 }
1935
1936 #else /* CONFIG_PROC_FS */
1937
1938 static int  __init rfcomm_proc_init(void)
1939 {
1940         return 0;
1941 }
1942
1943 static void __exit rfcomm_proc_cleanup(void)
1944 {
1945         return;
1946 }
1947 #endif /* CONFIG_PROC_FS */
1948
1949 /* ---- Initialization ---- */
1950 static int __init rfcomm_init(void)
1951 {
1952         l2cap_load();
1953
1954         kernel_thread(rfcomm_run, NULL, CLONE_KERNEL);
1955
1956         BT_INFO("RFCOMM ver %s", VERSION);
1957
1958         rfcomm_proc_init();
1959
1960         rfcomm_init_sockets();
1961
1962 #ifdef CONFIG_BT_RFCOMM_TTY
1963         rfcomm_init_ttys();
1964 #endif
1965
1966         return 0;
1967 }
1968
1969 static void __exit rfcomm_exit(void)
1970 {
1971         /* Terminate working thread.
1972          * ie. Set terminate flag and wake it up */
1973         atomic_inc(&terminate);
1974         rfcomm_schedule(RFCOMM_SCHED_STATE);
1975
1976         /* Wait until thread is running */
1977         while (atomic_read(&running))
1978                 schedule();
1979
1980 #ifdef CONFIG_BT_RFCOMM_TTY
1981         rfcomm_cleanup_ttys();
1982 #endif
1983
1984         rfcomm_cleanup_sockets();
1985
1986         rfcomm_proc_cleanup();
1987 }
1988
1989 module_init(rfcomm_init);
1990 module_exit(rfcomm_exit);
1991
1992 MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
1993 MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
1994 MODULE_VERSION(VERSION);
1995 MODULE_LICENSE("GPL");
1996 MODULE_ALIAS("bt-proto-3");