Commit | Line | Data |
---|---|---|
8e87d142 | 1 | /* |
1da177e4 LT |
2 | RFCOMM implementation for Linux Bluetooth stack (BlueZ). |
3 | Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> | |
4 | Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> | |
5 | ||
6 | This program is free software; you can redistribute it and/or modify | |
7 | it under the terms of the GNU General Public License version 2 as | |
8 | published by the Free Software Foundation; | |
9 | ||
10 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS | |
11 | OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
12 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. | |
13 | IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY | |
8e87d142 YH |
14 | CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES |
15 | WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | |
16 | ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | |
1da177e4 LT |
17 | OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
18 | ||
8e87d142 YH |
19 | ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, |
20 | COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS | |
1da177e4 LT |
21 | SOFTWARE IS DISCLAIMED. |
22 | */ | |
23 | ||
24 | /* | |
25 | * RFCOMM TTY. | |
1da177e4 LT |
26 | */ |
27 | ||
1da177e4 LT |
28 | #include <linux/module.h> |
29 | ||
30 | #include <linux/tty.h> | |
31 | #include <linux/tty_driver.h> | |
32 | #include <linux/tty_flip.h> | |
33 | ||
4fc268d2 | 34 | #include <linux/capability.h> |
1da177e4 LT |
35 | #include <linux/slab.h> |
36 | #include <linux/skbuff.h> | |
37 | ||
38 | #include <net/bluetooth/bluetooth.h> | |
0a85b964 | 39 | #include <net/bluetooth/hci_core.h> |
1da177e4 LT |
40 | #include <net/bluetooth/rfcomm.h> |
41 | ||
1da177e4 LT |
42 | #define RFCOMM_TTY_MAGIC 0x6d02 /* magic number for rfcomm struct */ |
43 | #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */ | |
44 | #define RFCOMM_TTY_MAJOR 216 /* device node major id of the usb/bluetooth.c driver */ | |
45 | #define RFCOMM_TTY_MINOR 0 | |
46 | ||
47 | static struct tty_driver *rfcomm_tty_driver; | |
48 | ||
49 | struct rfcomm_dev { | |
50 | struct list_head list; | |
51 | atomic_t refcnt; | |
52 | ||
53 | char name[12]; | |
54 | int id; | |
55 | unsigned long flags; | |
9a5df923 | 56 | atomic_t opened; |
1da177e4 LT |
57 | int err; |
58 | ||
59 | bdaddr_t src; | |
60 | bdaddr_t dst; | |
61 | u8 channel; | |
62 | ||
63 | uint modem_status; | |
64 | ||
65 | struct rfcomm_dlc *dlc; | |
66 | struct tty_struct *tty; | |
67 | wait_queue_head_t wait; | |
68 | struct tasklet_struct wakeup_task; | |
69 | ||
c1a33136 MH |
70 | struct device *tty_dev; |
71 | ||
1da177e4 | 72 | atomic_t wmem_alloc; |
a0c22f22 MH |
73 | |
74 | struct sk_buff_head pending; | |
1da177e4 LT |
75 | }; |
76 | ||
77 | static LIST_HEAD(rfcomm_dev_list); | |
78 | static DEFINE_RWLOCK(rfcomm_dev_lock); | |
79 | ||
80 | static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb); | |
81 | static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err); | |
82 | static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig); | |
83 | ||
84 | static void rfcomm_tty_wakeup(unsigned long arg); | |
85 | ||
86 | /* ---- Device functions ---- */ | |
87 | static void rfcomm_dev_destruct(struct rfcomm_dev *dev) | |
88 | { | |
89 | struct rfcomm_dlc *dlc = dev->dlc; | |
90 | ||
91 | BT_DBG("dev %p dlc %p", dev, dlc); | |
92 | ||
f951375d DY |
93 | /* Refcount should only hit zero when called from rfcomm_dev_del() |
94 | which will have taken us off the list. Everything else are | |
95 | refcounting bugs. */ | |
96 | BUG_ON(!list_empty(&dev->list)); | |
8de0a154 | 97 | |
1da177e4 LT |
98 | rfcomm_dlc_lock(dlc); |
99 | /* Detach DLC if it's owned by this dev */ | |
100 | if (dlc->owner == dev) | |
101 | dlc->owner = NULL; | |
102 | rfcomm_dlc_unlock(dlc); | |
103 | ||
104 | rfcomm_dlc_put(dlc); | |
105 | ||
106 | tty_unregister_device(rfcomm_tty_driver, dev->id); | |
107 | ||
1da177e4 LT |
108 | kfree(dev); |
109 | ||
8e87d142 | 110 | /* It's safe to call module_put() here because socket still |
1da177e4 LT |
111 | holds reference to this module. */ |
112 | module_put(THIS_MODULE); | |
113 | } | |
114 | ||
115 | static inline void rfcomm_dev_hold(struct rfcomm_dev *dev) | |
116 | { | |
117 | atomic_inc(&dev->refcnt); | |
118 | } | |
119 | ||
120 | static inline void rfcomm_dev_put(struct rfcomm_dev *dev) | |
121 | { | |
122 | /* The reason this isn't actually a race, as you no | |
123 | doubt have a little voice screaming at you in your | |
124 | head, is that the refcount should never actually | |
125 | reach zero unless the device has already been taken | |
126 | off the list, in rfcomm_dev_del(). And if that's not | |
127 | true, we'll hit the BUG() in rfcomm_dev_destruct() | |
128 | anyway. */ | |
129 | if (atomic_dec_and_test(&dev->refcnt)) | |
130 | rfcomm_dev_destruct(dev); | |
131 | } | |
132 | ||
133 | static struct rfcomm_dev *__rfcomm_dev_get(int id) | |
134 | { | |
135 | struct rfcomm_dev *dev; | |
136 | struct list_head *p; | |
137 | ||
138 | list_for_each(p, &rfcomm_dev_list) { | |
139 | dev = list_entry(p, struct rfcomm_dev, list); | |
140 | if (dev->id == id) | |
141 | return dev; | |
142 | } | |
143 | ||
144 | return NULL; | |
145 | } | |
146 | ||
147 | static inline struct rfcomm_dev *rfcomm_dev_get(int id) | |
148 | { | |
149 | struct rfcomm_dev *dev; | |
150 | ||
151 | read_lock(&rfcomm_dev_lock); | |
152 | ||
153 | dev = __rfcomm_dev_get(id); | |
8de0a154 VT |
154 | |
155 | if (dev) { | |
156 | if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) | |
157 | dev = NULL; | |
158 | else | |
159 | rfcomm_dev_hold(dev); | |
160 | } | |
1da177e4 LT |
161 | |
162 | read_unlock(&rfcomm_dev_lock); | |
163 | ||
164 | return dev; | |
165 | } | |
166 | ||
0a85b964 MH |
167 | static struct device *rfcomm_get_device(struct rfcomm_dev *dev) |
168 | { | |
169 | struct hci_dev *hdev; | |
170 | struct hci_conn *conn; | |
171 | ||
172 | hdev = hci_get_route(&dev->dst, &dev->src); | |
173 | if (!hdev) | |
174 | return NULL; | |
175 | ||
176 | conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst); | |
0a85b964 MH |
177 | |
178 | hci_dev_put(hdev); | |
179 | ||
b2cfcd75 | 180 | return conn ? &conn->dev : NULL; |
0a85b964 MH |
181 | } |
182 | ||
dae6a0f6 MH |
183 | static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf) |
184 | { | |
185 | struct rfcomm_dev *dev = dev_get_drvdata(tty_dev); | |
186 | bdaddr_t bdaddr; | |
187 | baswap(&bdaddr, &dev->dst); | |
188 | return sprintf(buf, "%s\n", batostr(&bdaddr)); | |
189 | } | |
190 | ||
191 | static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf) | |
192 | { | |
193 | struct rfcomm_dev *dev = dev_get_drvdata(tty_dev); | |
194 | return sprintf(buf, "%d\n", dev->channel); | |
195 | } | |
196 | ||
197 | static DEVICE_ATTR(address, S_IRUGO, show_address, NULL); | |
198 | static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL); | |
199 | ||
1da177e4 LT |
200 | static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc) |
201 | { | |
202 | struct rfcomm_dev *dev; | |
203 | struct list_head *head = &rfcomm_dev_list, *p; | |
204 | int err = 0; | |
205 | ||
206 | BT_DBG("id %d channel %d", req->dev_id, req->channel); | |
8e87d142 | 207 | |
25ea6db0 | 208 | dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL); |
1da177e4 LT |
209 | if (!dev) |
210 | return -ENOMEM; | |
1da177e4 LT |
211 | |
212 | write_lock_bh(&rfcomm_dev_lock); | |
213 | ||
214 | if (req->dev_id < 0) { | |
215 | dev->id = 0; | |
216 | ||
217 | list_for_each(p, &rfcomm_dev_list) { | |
218 | if (list_entry(p, struct rfcomm_dev, list)->id != dev->id) | |
219 | break; | |
220 | ||
221 | dev->id++; | |
222 | head = p; | |
223 | } | |
224 | } else { | |
225 | dev->id = req->dev_id; | |
226 | ||
227 | list_for_each(p, &rfcomm_dev_list) { | |
228 | struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list); | |
229 | ||
230 | if (entry->id == dev->id) { | |
231 | err = -EADDRINUSE; | |
232 | goto out; | |
233 | } | |
234 | ||
235 | if (entry->id > dev->id - 1) | |
236 | break; | |
237 | ||
238 | head = p; | |
239 | } | |
240 | } | |
241 | ||
242 | if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) { | |
243 | err = -ENFILE; | |
244 | goto out; | |
245 | } | |
246 | ||
247 | sprintf(dev->name, "rfcomm%d", dev->id); | |
248 | ||
249 | list_add(&dev->list, head); | |
250 | atomic_set(&dev->refcnt, 1); | |
251 | ||
252 | bacpy(&dev->src, &req->src); | |
253 | bacpy(&dev->dst, &req->dst); | |
254 | dev->channel = req->channel; | |
255 | ||
8e87d142 | 256 | dev->flags = req->flags & |
1da177e4 LT |
257 | ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC)); |
258 | ||
9a5df923 MH |
259 | atomic_set(&dev->opened, 0); |
260 | ||
1da177e4 LT |
261 | init_waitqueue_head(&dev->wait); |
262 | tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev); | |
263 | ||
a0c22f22 MH |
264 | skb_queue_head_init(&dev->pending); |
265 | ||
1da177e4 | 266 | rfcomm_dlc_lock(dlc); |
a0c22f22 MH |
267 | |
268 | if (req->flags & (1 << RFCOMM_REUSE_DLC)) { | |
269 | struct sock *sk = dlc->owner; | |
270 | struct sk_buff *skb; | |
271 | ||
272 | BUG_ON(!sk); | |
273 | ||
274 | rfcomm_dlc_throttle(dlc); | |
275 | ||
276 | while ((skb = skb_dequeue(&sk->sk_receive_queue))) { | |
277 | skb_orphan(skb); | |
278 | skb_queue_tail(&dev->pending, skb); | |
279 | atomic_sub(skb->len, &sk->sk_rmem_alloc); | |
280 | } | |
281 | } | |
282 | ||
1da177e4 LT |
283 | dlc->data_ready = rfcomm_dev_data_ready; |
284 | dlc->state_change = rfcomm_dev_state_change; | |
285 | dlc->modem_status = rfcomm_dev_modem_status; | |
286 | ||
287 | dlc->owner = dev; | |
288 | dev->dlc = dlc; | |
8b6b3da7 MH |
289 | |
290 | rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig); | |
291 | ||
1da177e4 LT |
292 | rfcomm_dlc_unlock(dlc); |
293 | ||
8e87d142 | 294 | /* It's safe to call __module_get() here because socket already |
1da177e4 LT |
295 | holds reference to this module. */ |
296 | __module_get(THIS_MODULE); | |
297 | ||
298 | out: | |
299 | write_unlock_bh(&rfcomm_dev_lock); | |
300 | ||
037322ab IJ |
301 | if (err < 0) |
302 | goto free; | |
1da177e4 | 303 | |
c1a33136 | 304 | dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL); |
1da177e4 | 305 | |
8de0a154 | 306 | if (IS_ERR(dev->tty_dev)) { |
09c7d829 | 307 | err = PTR_ERR(dev->tty_dev); |
8de0a154 | 308 | list_del(&dev->list); |
037322ab | 309 | goto free; |
8de0a154 VT |
310 | } |
311 | ||
dae6a0f6 MH |
312 | dev_set_drvdata(dev->tty_dev, dev); |
313 | ||
314 | if (device_create_file(dev->tty_dev, &dev_attr_address) < 0) | |
315 | BT_ERR("Failed to create address attribute"); | |
316 | ||
317 | if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0) | |
318 | BT_ERR("Failed to create channel attribute"); | |
319 | ||
1da177e4 | 320 | return dev->id; |
037322ab IJ |
321 | |
322 | free: | |
323 | kfree(dev); | |
324 | return err; | |
1da177e4 LT |
325 | } |
326 | ||
327 | static void rfcomm_dev_del(struct rfcomm_dev *dev) | |
328 | { | |
329 | BT_DBG("dev %p", dev); | |
330 | ||
9a5df923 MH |
331 | BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags)); |
332 | ||
333 | if (atomic_read(&dev->opened) > 0) | |
334 | return; | |
f951375d DY |
335 | |
336 | write_lock_bh(&rfcomm_dev_lock); | |
337 | list_del_init(&dev->list); | |
338 | write_unlock_bh(&rfcomm_dev_lock); | |
339 | ||
1da177e4 LT |
340 | rfcomm_dev_put(dev); |
341 | } | |
342 | ||
343 | /* ---- Send buffer ---- */ | |
344 | static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc) | |
345 | { | |
346 | /* We can't let it be zero, because we don't get a callback | |
347 | when tx_credits becomes nonzero, hence we'd never wake up */ | |
348 | return dlc->mtu * (dlc->tx_credits?:1); | |
349 | } | |
350 | ||
351 | static void rfcomm_wfree(struct sk_buff *skb) | |
352 | { | |
353 | struct rfcomm_dev *dev = (void *) skb->sk; | |
354 | atomic_sub(skb->truesize, &dev->wmem_alloc); | |
355 | if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags)) | |
356 | tasklet_schedule(&dev->wakeup_task); | |
357 | rfcomm_dev_put(dev); | |
358 | } | |
359 | ||
360 | static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev) | |
361 | { | |
362 | rfcomm_dev_hold(dev); | |
363 | atomic_add(skb->truesize, &dev->wmem_alloc); | |
364 | skb->sk = (void *) dev; | |
365 | skb->destructor = rfcomm_wfree; | |
366 | } | |
367 | ||
dd0fc66f | 368 | static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority) |
1da177e4 LT |
369 | { |
370 | if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) { | |
371 | struct sk_buff *skb = alloc_skb(size, priority); | |
372 | if (skb) { | |
373 | rfcomm_set_owner_w(skb, dev); | |
374 | return skb; | |
375 | } | |
376 | } | |
377 | return NULL; | |
378 | } | |
379 | ||
380 | /* ---- Device IOCTLs ---- */ | |
381 | ||
382 | #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP)) | |
383 | ||
384 | static int rfcomm_create_dev(struct sock *sk, void __user *arg) | |
385 | { | |
386 | struct rfcomm_dev_req req; | |
387 | struct rfcomm_dlc *dlc; | |
388 | int id; | |
389 | ||
390 | if (copy_from_user(&req, arg, sizeof(req))) | |
391 | return -EFAULT; | |
392 | ||
8de0a154 | 393 | BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags); |
1da177e4 LT |
394 | |
395 | if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) | |
396 | return -EPERM; | |
397 | ||
398 | if (req.flags & (1 << RFCOMM_REUSE_DLC)) { | |
399 | /* Socket must be connected */ | |
400 | if (sk->sk_state != BT_CONNECTED) | |
401 | return -EBADFD; | |
402 | ||
403 | dlc = rfcomm_pi(sk)->dlc; | |
404 | rfcomm_dlc_hold(dlc); | |
405 | } else { | |
406 | dlc = rfcomm_dlc_alloc(GFP_KERNEL); | |
407 | if (!dlc) | |
408 | return -ENOMEM; | |
409 | } | |
410 | ||
411 | id = rfcomm_dev_add(&req, dlc); | |
412 | if (id < 0) { | |
413 | rfcomm_dlc_put(dlc); | |
414 | return id; | |
415 | } | |
416 | ||
417 | if (req.flags & (1 << RFCOMM_REUSE_DLC)) { | |
418 | /* DLC is now used by device. | |
419 | * Socket must be disconnected */ | |
420 | sk->sk_state = BT_CLOSED; | |
421 | } | |
422 | ||
423 | return id; | |
424 | } | |
425 | ||
426 | static int rfcomm_release_dev(void __user *arg) | |
427 | { | |
428 | struct rfcomm_dev_req req; | |
429 | struct rfcomm_dev *dev; | |
430 | ||
431 | if (copy_from_user(&req, arg, sizeof(req))) | |
432 | return -EFAULT; | |
433 | ||
8de0a154 | 434 | BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags); |
1da177e4 LT |
435 | |
436 | if (!(dev = rfcomm_dev_get(req.dev_id))) | |
437 | return -ENODEV; | |
438 | ||
439 | if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) { | |
440 | rfcomm_dev_put(dev); | |
441 | return -EPERM; | |
442 | } | |
443 | ||
444 | if (req.flags & (1 << RFCOMM_HANGUP_NOW)) | |
445 | rfcomm_dlc_close(dev->dlc, 0); | |
446 | ||
84950cf0 MR |
447 | /* Shut down TTY synchronously before freeing rfcomm_dev */ |
448 | if (dev->tty) | |
449 | tty_vhangup(dev->tty); | |
450 | ||
93d80740 DY |
451 | if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) |
452 | rfcomm_dev_del(dev); | |
1da177e4 LT |
453 | rfcomm_dev_put(dev); |
454 | return 0; | |
455 | } | |
456 | ||
457 | static int rfcomm_get_dev_list(void __user *arg) | |
458 | { | |
459 | struct rfcomm_dev_list_req *dl; | |
460 | struct rfcomm_dev_info *di; | |
461 | struct list_head *p; | |
462 | int n = 0, size, err; | |
463 | u16 dev_num; | |
464 | ||
465 | BT_DBG(""); | |
466 | ||
467 | if (get_user(dev_num, (u16 __user *) arg)) | |
468 | return -EFAULT; | |
469 | ||
470 | if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di)) | |
471 | return -EINVAL; | |
472 | ||
473 | size = sizeof(*dl) + dev_num * sizeof(*di); | |
474 | ||
475 | if (!(dl = kmalloc(size, GFP_KERNEL))) | |
476 | return -ENOMEM; | |
477 | ||
478 | di = dl->dev_info; | |
479 | ||
480 | read_lock_bh(&rfcomm_dev_lock); | |
481 | ||
482 | list_for_each(p, &rfcomm_dev_list) { | |
483 | struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list); | |
8de0a154 VT |
484 | if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) |
485 | continue; | |
1da177e4 LT |
486 | (di + n)->id = dev->id; |
487 | (di + n)->flags = dev->flags; | |
488 | (di + n)->state = dev->dlc->state; | |
489 | (di + n)->channel = dev->channel; | |
490 | bacpy(&(di + n)->src, &dev->src); | |
491 | bacpy(&(di + n)->dst, &dev->dst); | |
492 | if (++n >= dev_num) | |
493 | break; | |
494 | } | |
495 | ||
496 | read_unlock_bh(&rfcomm_dev_lock); | |
497 | ||
498 | dl->dev_num = n; | |
499 | size = sizeof(*dl) + n * sizeof(*di); | |
500 | ||
501 | err = copy_to_user(arg, dl, size); | |
502 | kfree(dl); | |
503 | ||
504 | return err ? -EFAULT : 0; | |
505 | } | |
506 | ||
507 | static int rfcomm_get_dev_info(void __user *arg) | |
508 | { | |
509 | struct rfcomm_dev *dev; | |
510 | struct rfcomm_dev_info di; | |
511 | int err = 0; | |
512 | ||
513 | BT_DBG(""); | |
514 | ||
515 | if (copy_from_user(&di, arg, sizeof(di))) | |
516 | return -EFAULT; | |
517 | ||
518 | if (!(dev = rfcomm_dev_get(di.id))) | |
519 | return -ENODEV; | |
520 | ||
521 | di.flags = dev->flags; | |
522 | di.channel = dev->channel; | |
523 | di.state = dev->dlc->state; | |
524 | bacpy(&di.src, &dev->src); | |
525 | bacpy(&di.dst, &dev->dst); | |
526 | ||
527 | if (copy_to_user(arg, &di, sizeof(di))) | |
528 | err = -EFAULT; | |
529 | ||
530 | rfcomm_dev_put(dev); | |
531 | return err; | |
532 | } | |
533 | ||
534 | int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) | |
535 | { | |
536 | BT_DBG("cmd %d arg %p", cmd, arg); | |
537 | ||
538 | switch (cmd) { | |
539 | case RFCOMMCREATEDEV: | |
540 | return rfcomm_create_dev(sk, arg); | |
541 | ||
542 | case RFCOMMRELEASEDEV: | |
543 | return rfcomm_release_dev(arg); | |
544 | ||
545 | case RFCOMMGETDEVLIST: | |
546 | return rfcomm_get_dev_list(arg); | |
547 | ||
548 | case RFCOMMGETDEVINFO: | |
549 | return rfcomm_get_dev_info(arg); | |
550 | } | |
551 | ||
552 | return -EINVAL; | |
553 | } | |
554 | ||
555 | /* ---- DLC callbacks ---- */ | |
556 | static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb) | |
557 | { | |
558 | struct rfcomm_dev *dev = dlc->owner; | |
559 | struct tty_struct *tty; | |
8e87d142 | 560 | |
a0c22f22 | 561 | if (!dev) { |
1da177e4 LT |
562 | kfree_skb(skb); |
563 | return; | |
564 | } | |
565 | ||
a0c22f22 MH |
566 | if (!(tty = dev->tty) || !skb_queue_empty(&dev->pending)) { |
567 | skb_queue_tail(&dev->pending, skb); | |
568 | return; | |
569 | } | |
570 | ||
1da177e4 LT |
571 | BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len); |
572 | ||
817d6d3b PF |
573 | tty_insert_flip_string(tty, skb->data, skb->len); |
574 | tty_flip_buffer_push(tty); | |
1da177e4 LT |
575 | |
576 | kfree_skb(skb); | |
577 | } | |
578 | ||
579 | static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err) | |
580 | { | |
581 | struct rfcomm_dev *dev = dlc->owner; | |
582 | if (!dev) | |
583 | return; | |
8e87d142 | 584 | |
1da177e4 LT |
585 | BT_DBG("dlc %p dev %p err %d", dlc, dev, err); |
586 | ||
587 | dev->err = err; | |
588 | wake_up_interruptible(&dev->wait); | |
589 | ||
590 | if (dlc->state == BT_CLOSED) { | |
591 | if (!dev->tty) { | |
592 | if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) { | |
537d59af DY |
593 | /* Drop DLC lock here to avoid deadlock |
594 | * 1. rfcomm_dev_get will take rfcomm_dev_lock | |
595 | * but in rfcomm_dev_add there's lock order: | |
596 | * rfcomm_dev_lock -> dlc lock | |
597 | * 2. rfcomm_dev_put will deadlock if it's | |
598 | * the last reference | |
599 | */ | |
600 | rfcomm_dlc_unlock(dlc); | |
601 | if (rfcomm_dev_get(dev->id) == NULL) { | |
602 | rfcomm_dlc_lock(dlc); | |
77f2a45f | 603 | return; |
537d59af | 604 | } |
1da177e4 | 605 | |
77f2a45f | 606 | rfcomm_dev_del(dev); |
1da177e4 | 607 | rfcomm_dev_put(dev); |
537d59af | 608 | rfcomm_dlc_lock(dlc); |
1da177e4 | 609 | } |
8e87d142 | 610 | } else |
1da177e4 LT |
611 | tty_hangup(dev->tty); |
612 | } | |
613 | } | |
614 | ||
615 | static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig) | |
616 | { | |
617 | struct rfcomm_dev *dev = dlc->owner; | |
618 | if (!dev) | |
619 | return; | |