[deliverable/linux.git] / net / bluetooth / rfcomm / tty.c

/* 
   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
   SOFTWARE IS DISCLAIMED.
*/

/*
 * RFCOMM TTY.
 *
 * $Id: tty.c,v 1.24 2002/10/03 01:54:38 holtmann Exp $
 */

#include <linux/config.h>
#include <linux/module.h>

#include <linux/tty.h>
#include <linux/tty_driver.h>
#include <linux/tty_flip.h>

#include <linux/capability.h>
#include <linux/slab.h>
#include <linux/skbuff.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/rfcomm.h>

#ifndef CONFIG_BT_RFCOMM_DEBUG
#undef  BT_DBG
#define BT_DBG(D...)
#endif

#define RFCOMM_TTY_MAGIC 0x6d02		/* magic number for rfcomm struct */
#define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV	/* whole lotta rfcomm devices */
#define RFCOMM_TTY_MAJOR 216		/* device node major id of the usb/bluetooth.c driver */
#define RFCOMM_TTY_MINOR 0

static struct tty_driver *rfcomm_tty_driver;

struct rfcomm_dev {
	struct list_head	list;
	atomic_t		refcnt;

	char			name[12];
	int			id;
	unsigned long		flags;
	int			opened;
	int			err;

	bdaddr_t		src;
	bdaddr_t		dst;
	u8 			channel;

	uint 			modem_status;

	struct rfcomm_dlc	*dlc;
	struct tty_struct	*tty;
	wait_queue_head_t       wait;
	struct tasklet_struct   wakeup_task;

	atomic_t 		wmem_alloc;
};

static LIST_HEAD(rfcomm_dev_list);
static DEFINE_RWLOCK(rfcomm_dev_lock);

static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);

static void rfcomm_tty_wakeup(unsigned long arg);

/* ---- Device functions ---- */
static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
{
	struct rfcomm_dlc *dlc = dev->dlc;

	BT_DBG("dev %p dlc %p", dev, dlc);

	rfcomm_dlc_lock(dlc);
	/* Detach DLC if it's owned by this dev */
	if (dlc->owner == dev)
		dlc->owner = NULL;
	rfcomm_dlc_unlock(dlc);

	rfcomm_dlc_put(dlc);

	tty_unregister_device(rfcomm_tty_driver, dev->id);

	/* Refcount should only hit zero when called from rfcomm_dev_del()
	   which will have taken us off the list. Everything else are
	   refcounting bugs. */
	BUG_ON(!list_empty(&dev->list));

	kfree(dev);

	/* It's safe to call module_put() here because socket still 
	   holds reference to this module. */
	module_put(THIS_MODULE);
}

static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
{
	atomic_inc(&dev->refcnt);
}

static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
{
	/* The reason this isn't actually a race, as you no
	   doubt have a little voice screaming at you in your
	   head, is that the refcount should never actually
	   reach zero unless the device has already been taken
	   off the list, in rfcomm_dev_del(). And if that's not
	   true, we'll hit the BUG() in rfcomm_dev_destruct()
	   anyway. */
	if (atomic_dec_and_test(&dev->refcnt))
		rfcomm_dev_destruct(dev);
}

static struct rfcomm_dev *__rfcomm_dev_get(int id)
{
	struct rfcomm_dev *dev;
	struct list_head  *p;

	list_for_each(p, &rfcomm_dev_list) {
		dev = list_entry(p, struct rfcomm_dev, list);
		if (dev->id == id)
			return dev;
	}

	return NULL;
}

static inline struct rfcomm_dev *rfcomm_dev_get(int id)
{
	struct rfcomm_dev *dev;

	read_lock(&rfcomm_dev_lock);

	dev = __rfcomm_dev_get(id);
	if (dev)
		rfcomm_dev_hold(dev);

	read_unlock(&rfcomm_dev_lock);

	return dev;
}

static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
{
	struct rfcomm_dev *dev;
	struct list_head *head = &rfcomm_dev_list, *p;
	int err = 0;

	BT_DBG("id %d channel %d", req->dev_id, req->channel);
	
	dev = kmalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
	if (!dev)
		return -ENOMEM;
	memset(dev, 0, sizeof(struct rfcomm_dev));

	write_lock_bh(&rfcomm_dev_lock);

	if (req->dev_id < 0) {
		dev->id = 0;

		list_for_each(p, &rfcomm_dev_list) {
			if (list_entry(p, struct rfcomm_dev, list)->id != dev->id)
				break;

			dev->id++;
			head = p;
		}
	} else {
		dev->id = req->dev_id;

		list_for_each(p, &rfcomm_dev_list) {
			struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list);

			if (entry->id == dev->id) {
				err = -EADDRINUSE;
				goto out;
			}

			if (entry->id > dev->id - 1)
				break;

			head = p;
		}
	}

	if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
		err = -ENFILE;
		goto out;
	}

	sprintf(dev->name, "rfcomm%d", dev->id);

	list_add(&dev->list, head);
	atomic_set(&dev->refcnt, 1);

	bacpy(&dev->src, &req->src);
	bacpy(&dev->dst, &req->dst);
	dev->channel = req->channel;

	dev->flags = req->flags & 
		((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));

	init_waitqueue_head(&dev->wait);
	tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev);

	rfcomm_dlc_lock(dlc);
	dlc->data_ready   = rfcomm_dev_data_ready;
	dlc->state_change = rfcomm_dev_state_change;
	dlc->modem_status = rfcomm_dev_modem_status;

	dlc->owner = dev;
	dev->dlc   = dlc;
	rfcomm_dlc_unlock(dlc);

	/* It's safe to call __module_get() here because socket already 
	   holds reference to this module. */
	__module_get(THIS_MODULE);

out:
	write_unlock_bh(&rfcomm_dev_lock);

	if (err) {
		kfree(dev);
		return err;
	}

	tty_register_device(rfcomm_tty_driver, dev->id, NULL);

	return dev->id;
}

static void rfcomm_dev_del(struct rfcomm_dev *dev)
{
	BT_DBG("dev %p", dev);

	write_lock_bh(&rfcomm_dev_lock);
	list_del_init(&dev->list);
	write_unlock_bh(&rfcomm_dev_lock);

	rfcomm_dev_put(dev);
}

/* ---- Send buffer ---- */
static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
{
	/* We can't let it be zero, because we don't get a callback
	   when tx_credits becomes nonzero, hence we'd never wake up */
	return dlc->mtu * (dlc->tx_credits?:1);
}

static void rfcomm_wfree(struct sk_buff *skb)
{
	struct rfcomm_dev *dev = (void *) skb->sk;
	atomic_sub(skb->truesize, &dev->wmem_alloc);
	if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
		tasklet_schedule(&dev->wakeup_task);
	rfcomm_dev_put(dev);
}

static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
{
	rfcomm_dev_hold(dev);
	atomic_add(skb->truesize, &dev->wmem_alloc);
	skb->sk = (void *) dev;
	skb->destructor = rfcomm_wfree;
}

static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
{
	if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
		struct sk_buff *skb = alloc_skb(size, priority);
		if (skb) {
			rfcomm_set_owner_w(skb, dev);
			return skb;
		}
	}
	return NULL;
}

/* ---- Device IOCTLs ---- */

#define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))

static int rfcomm_create_dev(struct sock *sk, void __user *arg)
{
	struct rfcomm_dev_req req;
	struct rfcomm_dlc *dlc;
	int id;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	BT_DBG("sk %p dev_id %id flags 0x%x", sk, req.dev_id, req.flags);

	if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
		return -EPERM;

	if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
		/* Socket must be connected */
		if (sk->sk_state != BT_CONNECTED)
			return -EBADFD;

		dlc = rfcomm_pi(sk)->dlc;
		rfcomm_dlc_hold(dlc);
	} else {
		dlc = rfcomm_dlc_alloc(GFP_KERNEL);
		if (!dlc)
			return -ENOMEM;
	}

	id = rfcomm_dev_add(&req, dlc);
	if (id < 0) {
		rfcomm_dlc_put(dlc);
		return id;
	}

	if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
		/* DLC is now used by device.
		 * Socket must be disconnected */
		sk->sk_state = BT_CLOSED;
	}

	return id;
}

static int rfcomm_release_dev(void __user *arg)
{
	struct rfcomm_dev_req req;
	struct rfcomm_dev *dev;

	if (copy_from_user(&req, arg, sizeof(req)))
		return -EFAULT;

	BT_DBG("dev_id %id flags 0x%x", req.dev_id, req.flags);

	if (!(dev = rfcomm_dev_get(req.dev_id)))
		return -ENODEV;

	if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
		rfcomm_dev_put(dev);
		return -EPERM;
	}

	if (req.flags & (1 << RFCOMM_HANGUP_NOW))
		rfcomm_dlc_close(dev->dlc, 0);

	rfcomm_dev_del(dev);
	rfcomm_dev_put(dev);
	return 0;
}

static int rfcomm_get_dev_list(void __user *arg)
{
	struct rfcomm_dev_list_req *dl;
	struct rfcomm_dev_info *di;
	struct list_head *p;
	int n = 0, size, err;
	u16 dev_num;

	BT_DBG("");

	if (get_user(dev_num, (u16 __user *) arg))
		return -EFAULT;

	if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
		return -EINVAL;

	size = sizeof(*dl) + dev_num * sizeof(*di);

	if (!(dl = kmalloc(size, GFP_KERNEL)))
		return -ENOMEM;

	di = dl->dev_info;

	read_lock_bh(&rfcomm_dev_lock);

	list_for_each(p, &rfcomm_dev_list) {
		struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
		(di + n)->id      = dev->id;
		(di + n)->flags   = dev->flags;
		(di + n)->state   = dev->dlc->state;
		(di + n)->channel = dev->channel;
		bacpy(&(di + n)->src, &dev->src);
		bacpy(&(di + n)->dst, &dev->dst);
		if (++n >= dev_num)
			break;
	}

	read_unlock_bh(&rfcomm_dev_lock);

	dl->dev_num = n;
	size = sizeof(*dl) + n * sizeof(*di);

	err = copy_to_user(arg, dl, size);
	kfree(dl);

	return err ? -EFAULT : 0;
}

static int rfcomm_get_dev_info(void __user *arg)
{
	struct rfcomm_dev *dev;
	struct rfcomm_dev_info di;
	int err = 0;

	BT_DBG("");

	if (copy_from_user(&di, arg, sizeof(di)))
		return -EFAULT;

	if (!(dev = rfcomm_dev_get(di.id)))
		return -ENODEV;

	di.flags   = dev->flags;
	di.channel = dev->channel;
	di.state   = dev->dlc->state;
	bacpy(&di.src, &dev->src);
	bacpy(&di.dst, &dev->dst);

	if (copy_to_user(arg, &di, sizeof(di)))
		err = -EFAULT;

	rfcomm_dev_put(dev);
	return err;
}

int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
{
	BT_DBG("cmd %d arg %p", cmd, arg);

	switch (cmd) {
	case RFCOMMCREATEDEV:
		return rfcomm_create_dev(sk, arg);

	case RFCOMMRELEASEDEV:
		return rfcomm_release_dev(arg);

	case RFCOMMGETDEVLIST:
		return rfcomm_get_dev_list(arg);

	case RFCOMMGETDEVINFO:
		return rfcomm_get_dev_info(arg);
	}

	return -EINVAL;
}

/* ---- DLC callbacks ---- */
static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
{
	struct rfcomm_dev *dev = dlc->owner;
	struct tty_struct *tty;
       
	if (!dev || !(tty = dev->tty)) {
		kfree_skb(skb);
		return;
	}

	BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);

	if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
		tty_buffer_request_room(tty, skb->len);
		tty_insert_flip_string(tty, skb->data, skb->len);
		tty_flip_buffer_push(tty);
	} else
		tty->ldisc.receive_buf(tty, skb->data, NULL, skb->len);

	kfree_skb(skb);
}

static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
{
	struct rfcomm_dev *dev = dlc->owner;
	if (!dev)
		return;
	
	BT_DBG("dlc %p dev %p err %d", dlc, dev, err);

	dev->err = err;
	wake_up_interruptible(&dev->wait);

	if (dlc->state == BT_CLOSED) {
		if (!dev->tty) {
			if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
				rfcomm_dev_hold(dev);
				rfcomm_dev_del(dev);

				/* We have to drop DLC lock here, otherwise
				   rfcomm_dev_put() will dead lock if it's
				   the last reference. */
				rfcomm_dlc_unlock(dlc);
				rfcomm_dev_put(dev);
				rfcomm_dlc_lock(dlc);
			}
		} else 
			tty_hangup(dev->tty);
	}
}

static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
{
	struct rfcomm_dev *dev = dlc->owner;
	if (!dev)
		return;
Commit	Line	Data
1da177e4 LT	1	/*
	2	RFCOMM implementation for Linux Bluetooth stack (BlueZ).
	3	Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
	4	Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
	5
	6	This program is free software; you can redistribute it and/or modify
	7	it under the terms of the GNU General Public License version 2 as
	8	published by the Free Software Foundation;
	9
	10	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	11	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	12	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	13	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
	14	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	15	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	16	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	17	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	18
	19	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
	20	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
	21	SOFTWARE IS DISCLAIMED.
	22	*/
	23
	24	/*
	25	* RFCOMM TTY.
	26	*
	27	* $Id: tty.c,v 1.24 2002/10/03 01:54:38 holtmann Exp $
	28	*/
	29
	30	#include <linux/config.h>
	31	#include <linux/module.h>
	32
	33	#include <linux/tty.h>
	34	#include <linux/tty_driver.h>
	35	#include <linux/tty_flip.h>
	36
4fc268d2	37	#include <linux/capability.h>
1da177e4 LT	38	#include <linux/slab.h>
	39	#include <linux/skbuff.h>
	40
	41	#include <net/bluetooth/bluetooth.h>
	42	#include <net/bluetooth/rfcomm.h>
	43
	44	#ifndef CONFIG_BT_RFCOMM_DEBUG
	45	#undef BT_DBG
	46	#define BT_DBG(D...)
	47	#endif
	48
	49	#define RFCOMM_TTY_MAGIC 0x6d02 /* magic number for rfcomm struct */
	50	#define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
	51	#define RFCOMM_TTY_MAJOR 216 /* device node major id of the usb/bluetooth.c driver */
	52	#define RFCOMM_TTY_MINOR 0
	53
	54	static struct tty_driver *rfcomm_tty_driver;
	55
	56	struct rfcomm_dev {
	57	struct list_head list;
	58	atomic_t refcnt;
	59
	60	char name[12];
	61	int id;
	62	unsigned long flags;
	63	int opened;
	64	int err;
	65
	66	bdaddr_t src;
	67	bdaddr_t dst;
	68	u8 channel;
	69
	70	uint modem_status;
	71
	72	struct rfcomm_dlc *dlc;
	73	struct tty_struct *tty;
	74	wait_queue_head_t wait;
	75	struct tasklet_struct wakeup_task;
	76
	77	atomic_t wmem_alloc;
	78	};
	79
	80	static LIST_HEAD(rfcomm_dev_list);
	81	static DEFINE_RWLOCK(rfcomm_dev_lock);
	82
	83	static void rfcomm_dev_data_ready(struct rfcomm_dlc dlc, struct sk_buff skb);
	84	static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
	85	static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
	86
	87	static void rfcomm_tty_wakeup(unsigned long arg);
	88
	89	/* ---- Device functions ---- */
	90	static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
	91	{
	92	struct rfcomm_dlc *dlc = dev->dlc;
	93
	94	BT_DBG("dev %p dlc %p", dev, dlc);
	95
	96	rfcomm_dlc_lock(dlc);
	97	/* Detach DLC if it's owned by this dev */
	98	if (dlc->owner == dev)
	99	dlc->owner = NULL;
	100	rfcomm_dlc_unlock(dlc);
	101
102	rfcomm_dlc_put(dlc);
103
104	tty_unregister_device(rfcomm_tty_driver, dev->id);
105
106	/* Refcount should only hit zero when called from rfcomm_dev_del()
107	which will have taken us off the list. Everything else are
108	refcounting bugs. */
109	BUG_ON(!list_empty(&dev->list));
110
111	kfree(dev);
112
113	/* It's safe to call module_put() here because socket still
114	holds reference to this module. */
115	module_put(THIS_MODULE);
116	}
117
118	static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
119	{
120	atomic_inc(&dev->refcnt);
121	}
122
123	static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
124	{
125	/* The reason this isn't actually a race, as you no
126	doubt have a little voice screaming at you in your
127	head, is that the refcount should never actually
128	reach zero unless the device has already been taken
129	off the list, in rfcomm_dev_del(). And if that's not
130	true, we'll hit the BUG() in rfcomm_dev_destruct()
131	anyway. */
132	if (atomic_dec_and_test(&dev->refcnt))
133	rfcomm_dev_destruct(dev);
134	}
135
136	static struct rfcomm_dev *__rfcomm_dev_get(int id)
137	{
138	struct rfcomm_dev *dev;
139	struct list_head *p;
140
141	list_for_each(p, &rfcomm_dev_list) {
142	dev = list_entry(p, struct rfcomm_dev, list);
143	if (dev->id == id)
144	return dev;
145	}
146
147	return NULL;
148	}
149
150	static inline struct rfcomm_dev *rfcomm_dev_get(int id)
151	{
152	struct rfcomm_dev *dev;
153
154	read_lock(&rfcomm_dev_lock);
155
156	dev = __rfcomm_dev_get(id);
157	if (dev)
158	rfcomm_dev_hold(dev);
159
160	read_unlock(&rfcomm_dev_lock);
161
162	return dev;
163	}
164
165	static int rfcomm_dev_add(struct rfcomm_dev_req req, struct rfcomm_dlc dlc)
166	{
167	struct rfcomm_dev *dev;
168	struct list_head head = &rfcomm_dev_list, p;
169	int err = 0;
170
171	BT_DBG("id %d channel %d", req->dev_id, req->channel);
172
173	dev = kmalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
174	if (!dev)
175	return -ENOMEM;
176	memset(dev, 0, sizeof(struct rfcomm_dev));
177
178	write_lock_bh(&rfcomm_dev_lock);
179
180	if (req->dev_id < 0) {
181	dev->id = 0;
182
183	list_for_each(p, &rfcomm_dev_list) {
184	if (list_entry(p, struct rfcomm_dev, list)->id != dev->id)
185	break;
186
187	dev->id++;
188	head = p;
189	}
190	} else {
191	dev->id = req->dev_id;
192
193	list_for_each(p, &rfcomm_dev_list) {
194	struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list);
195
196	if (entry->id == dev->id) {
197	err = -EADDRINUSE;
198	goto out;
199	}
200
201	if (entry->id > dev->id - 1)
202	break;
203
204	head = p;
205	}
206	}
207
208	if ((dev->id < 0) \|\| (dev->id > RFCOMM_MAX_DEV - 1)) {
209	err = -ENFILE;
210	goto out;
211	}
212
213	sprintf(dev->name, "rfcomm%d", dev->id);
214
215	list_add(&dev->list, head);
216	atomic_set(&dev->refcnt, 1);
217
218	bacpy(&dev->src, &req->src);
219	bacpy(&dev->dst, &req->dst);
220	dev->channel = req->channel;
221
222	dev->flags = req->flags &
223	((1 << RFCOMM_RELEASE_ONHUP) \| (1 << RFCOMM_REUSE_DLC));
224
225	init_waitqueue_head(&dev->wait);
226	tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev);
227
228	rfcomm_dlc_lock(dlc);
229	dlc->data_ready = rfcomm_dev_data_ready;
230	dlc->state_change = rfcomm_dev_state_change;
231	dlc->modem_status = rfcomm_dev_modem_status;
232
233	dlc->owner = dev;
234	dev->dlc = dlc;
235	rfcomm_dlc_unlock(dlc);
236
237	/* It's safe to call __module_get() here because socket already
238	holds reference to this module. */
239	__module_get(THIS_MODULE);
240
241	out:
242	write_unlock_bh(&rfcomm_dev_lock);
243
244	if (err) {
245	kfree(dev);
246	return err;
247	}
248
249	tty_register_device(rfcomm_tty_driver, dev->id, NULL);
250
251	return dev->id;
252	}
253
254	static void rfcomm_dev_del(struct rfcomm_dev *dev)
255	{
256	BT_DBG("dev %p", dev);
257
258	write_lock_bh(&rfcomm_dev_lock);
259	list_del_init(&dev->list);
260	write_unlock_bh(&rfcomm_dev_lock);
261
262	rfcomm_dev_put(dev);
263	}
264
265	/* ---- Send buffer ---- */
266	static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
267	{
268	/* We can't let it be zero, because we don't get a callback
269	when tx_credits becomes nonzero, hence we'd never wake up */
270	return dlc->mtu * (dlc->tx_credits?:1);
271	}
272
273	static void rfcomm_wfree(struct sk_buff *skb)
274	{
275	struct rfcomm_dev dev = (void ) skb->sk;
276	atomic_sub(skb->truesize, &dev->wmem_alloc);
277	if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
278	tasklet_schedule(&dev->wakeup_task);
279	rfcomm_dev_put(dev);
280	}
281
282	static inline void rfcomm_set_owner_w(struct sk_buff skb, struct rfcomm_dev dev)
283	{
284	rfcomm_dev_hold(dev);
285	atomic_add(skb->truesize, &dev->wmem_alloc);
286	skb->sk = (void *) dev;
287	skb->destructor = rfcomm_wfree;
288	}
289
dd0fc66f	290	static struct sk_buff rfcomm_wmalloc(struct rfcomm_dev dev, unsigned long size, gfp_t priority)
1da177e4 LT	291	{
	292	if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
	293	struct sk_buff *skb = alloc_skb(size, priority);
	294	if (skb) {
	295	rfcomm_set_owner_w(skb, dev);
	296	return skb;
	297	}
	298	}
	299	return NULL;
	300	}
	301
	302	/* ---- Device IOCTLs ---- */
	303
	304	#define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) \| (1 << RFCOMM_RELEASE_ONHUP))
	305
	306	static int rfcomm_create_dev(struct sock sk, void __user arg)
	307	{
	308	struct rfcomm_dev_req req;
	309	struct rfcomm_dlc *dlc;
	310	int id;
	311
	312	if (copy_from_user(&req, arg, sizeof(req)))
	313	return -EFAULT;
	314
	315	BT_DBG("sk %p dev_id %id flags 0x%x", sk, req.dev_id, req.flags);
	316
	317	if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
	318	return -EPERM;
	319
	320	if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
	321	/* Socket must be connected */
	322	if (sk->sk_state != BT_CONNECTED)
	323	return -EBADFD;
	324
	325	dlc = rfcomm_pi(sk)->dlc;
	326	rfcomm_dlc_hold(dlc);
	327	} else {
	328	dlc = rfcomm_dlc_alloc(GFP_KERNEL);
	329	if (!dlc)
	330	return -ENOMEM;
	331	}
	332
	333	id = rfcomm_dev_add(&req, dlc);
	334	if (id < 0) {
	335	rfcomm_dlc_put(dlc);
	336	return id;
	337	}
	338
	339	if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
	340	/* DLC is now used by device.
	341	* Socket must be disconnected */
	342	sk->sk_state = BT_CLOSED;
	343	}
	344
	345	return id;
	346	}
	347
	348	static int rfcomm_release_dev(void __user *arg)
	349	{
	350	struct rfcomm_dev_req req;
	351	struct rfcomm_dev *dev;
	352
	353	if (copy_from_user(&req, arg, sizeof(req)))
	354	return -EFAULT;
355
356	BT_DBG("dev_id %id flags 0x%x", req.dev_id, req.flags);
357
358	if (!(dev = rfcomm_dev_get(req.dev_id)))
359	return -ENODEV;
360
361	if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
362	rfcomm_dev_put(dev);
363	return -EPERM;
364	}
365
366	if (req.flags & (1 << RFCOMM_HANGUP_NOW))
367	rfcomm_dlc_close(dev->dlc, 0);
368
369	rfcomm_dev_del(dev);
370	rfcomm_dev_put(dev);
371	return 0;
372	}
373
374	static int rfcomm_get_dev_list(void __user *arg)
375	{
376	struct rfcomm_dev_list_req *dl;
377	struct rfcomm_dev_info *di;
378	struct list_head *p;
379	int n = 0, size, err;
380	u16 dev_num;
381
382	BT_DBG("");
383
384	if (get_user(dev_num, (u16 __user *) arg))
385	return -EFAULT;
386
387	if (!dev_num \|\| dev_num > (PAGE_SIZE * 4) / sizeof(*di))
388	return -EINVAL;
389
390	size = sizeof(dl) + dev_num sizeof(*di);
391
392	if (!(dl = kmalloc(size, GFP_KERNEL)))
393	return -ENOMEM;
394
395	di = dl->dev_info;
396
397	read_lock_bh(&rfcomm_dev_lock);
398
399	list_for_each(p, &rfcomm_dev_list) {
400	struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
401	(di + n)->id = dev->id;
402	(di + n)->flags = dev->flags;
403	(di + n)->state = dev->dlc->state;
404	(di + n)->channel = dev->channel;
405	bacpy(&(di + n)->src, &dev->src);
406	bacpy(&(di + n)->dst, &dev->dst);
407	if (++n >= dev_num)
408	break;
409	}
410
411	read_unlock_bh(&rfcomm_dev_lock);
412
413	dl->dev_num = n;
414	size = sizeof(dl) + n sizeof(*di);
415
416	err = copy_to_user(arg, dl, size);
417	kfree(dl);
418
419	return err ? -EFAULT : 0;
420	}
421
422	static int rfcomm_get_dev_info(void __user *arg)
423	{
424	struct rfcomm_dev *dev;
425	struct rfcomm_dev_info di;
426	int err = 0;
427
428	BT_DBG("");
429
430	if (copy_from_user(&di, arg, sizeof(di)))
431	return -EFAULT;
432
433	if (!(dev = rfcomm_dev_get(di.id)))
434	return -ENODEV;
435
436	di.flags = dev->flags;
437	di.channel = dev->channel;
438	di.state = dev->dlc->state;
439	bacpy(&di.src, &dev->src);
440	bacpy(&di.dst, &dev->dst);
441
442	if (copy_to_user(arg, &di, sizeof(di)))
443	err = -EFAULT;
444
445	rfcomm_dev_put(dev);
446	return err;
447	}
448
449	int rfcomm_dev_ioctl(struct sock sk, unsigned int cmd, void __user arg)
450	{
451	BT_DBG("cmd %d arg %p", cmd, arg);
452
453	switch (cmd) {
454	case RFCOMMCREATEDEV:
455	return rfcomm_create_dev(sk, arg);
456
457	case RFCOMMRELEASEDEV:
458	return rfcomm_release_dev(arg);
459
460	case RFCOMMGETDEVLIST:
461	return rfcomm_get_dev_list(arg);
462
463	case RFCOMMGETDEVINFO:
464	return rfcomm_get_dev_info(arg);
465	}
466
467	return -EINVAL;
468	}
469
470	/* ---- DLC callbacks ---- */
471	static void rfcomm_dev_data_ready(struct rfcomm_dlc dlc, struct sk_buff skb)
472	{
473	struct rfcomm_dev *dev = dlc->owner;
474	struct tty_struct *tty;
475
476	if (!dev \|\| !(tty = dev->tty)) {
477	kfree_skb(skb);
478	return;
479	}
480
481	BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
482
483	if (test_bit(TTY_DONT_FLIP, &tty->flags)) {
33f0f88f AC	484	tty_buffer_request_room(tty, skb->len);
33f0f88f AC	485	tty_insert_flip_string(tty, skb->data, skb->len);
1da177e4 LT	486	tty_flip_buffer_push(tty);
	487	} else
	488	tty->ldisc.receive_buf(tty, skb->data, NULL, skb->len);
	489
	490	kfree_skb(skb);
	491	}
	492
	493	static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
	494	{
	495	struct rfcomm_dev *dev = dlc->owner;
	496	if (!dev)
	497	return;
	498
	499	BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
	500
	501	dev->err = err;
	502	wake_up_interruptible(&dev->wait);
	503
	504	if (dlc->state == BT_CLOSED) {
	505	if (!dev->tty) {
	506	if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
	507	rfcomm_dev_hold(dev);
	508	rfcomm_dev_del(dev);
	509
	510	/* We have to drop DLC lock here, otherwise
	511	rfcomm_dev_put() will dead lock if it's
	512	the last reference. */
	513	rfcomm_dlc_unlock(dlc);
	514	rfcomm_dev_put(dev);
	515	rfcomm_dlc_lock(dlc);
	516	}
	517	} else
	518	tty_hangup(dev->tty);
	519	}
	520	}
	521
	522	static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
	523	{
	524	struct rfcomm_dev *dev = dlc->owner;
	525	if (!dev)
	526	return;