net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  40 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  41 #define RFCOMM_TTY_MINOR 0
  42
  43 static struct tty_driver *rfcomm_tty_driver;
  44
  45 struct rfcomm_dev {
  46         struct tty_port         port;
  47         struct list_head        list;
  48
  49         char                    name[12];
  50         int                     id;
  51         unsigned long           flags;
  52         int                     err;
  53
  54         bdaddr_t                src;
  55         bdaddr_t                dst;
  56         u8                      channel;
  57
  58         uint                    modem_status;
  59
  60         struct rfcomm_dlc       *dlc;
  61
  62         struct device           *tty_dev;
  63
  64         atomic_t                wmem_alloc;
  65
  66         struct sk_buff_head     pending;
  67 };
  68
  69 static LIST_HEAD(rfcomm_dev_list);
  70 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  71
  72 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  73 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  74 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  75
  76 /* ---- Device functions ---- */
  77
  78 static void rfcomm_dev_destruct(struct tty_port *port)
  79 {
  80         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  81         struct rfcomm_dlc *dlc = dev->dlc;
  82
  83         BT_DBG("dev %p dlc %p", dev, dlc);
  84
  85         spin_lock(&rfcomm_dev_lock);
  86         list_del(&dev->list);
  87         spin_unlock(&rfcomm_dev_lock);
  88
  89         rfcomm_dlc_lock(dlc);
  90         /* Detach DLC if it's owned by this dev */
  91         if (dlc->owner == dev)
  92                 dlc->owner = NULL;
  93         rfcomm_dlc_unlock(dlc);
  94
  95         rfcomm_dlc_put(dlc);
  96
  97         tty_unregister_device(rfcomm_tty_driver, dev->id);
  98
  99         kfree(dev);
 100
 101         /* It's safe to call module_put() here because socket still
 102            holds reference to this module. */
 103         module_put(THIS_MODULE);
 104 }
 105
 106 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 107 {
 108         struct hci_dev *hdev;
 109         struct hci_conn *conn;
 110
 111         hdev = hci_get_route(&dev->dst, &dev->src);
 112         if (!hdev)
 113                 return NULL;
 114
 115         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 116
 117         hci_dev_put(hdev);
 118
 119         return conn ? &conn->dev : NULL;
 120 }
 121
 122 /* device-specific initialization: open the dlc */
 123 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
 124 {
 125         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 126
 127         return rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
 128 }
 129
 130 /* we block the open until the dlc->state becomes BT_CONNECTED */
 131 static int rfcomm_dev_carrier_raised(struct tty_port *port)
 132 {
 133         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 134
 135         return (dev->dlc->state == BT_CONNECTED);
 136 }
 137
 138 /* device-specific cleanup: close the dlc */
 139 static void rfcomm_dev_shutdown(struct tty_port *port)
 140 {
 141         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 142
 143         if (dev->tty_dev->parent)
 144                 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 145
 146         /* close the dlc */
 147         rfcomm_dlc_close(dev->dlc, 0);
 148 }
 149
 150 static const struct tty_port_operations rfcomm_port_ops = {
 151         .destruct = rfcomm_dev_destruct,
 152         .activate = rfcomm_dev_activate,
 153         .shutdown = rfcomm_dev_shutdown,
 154         .carrier_raised = rfcomm_dev_carrier_raised,
 155 };
 156
 157 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 158 {
 159         struct rfcomm_dev *dev;
 160
 161         list_for_each_entry(dev, &rfcomm_dev_list, list)
 162                 if (dev->id == id)
 163                         return dev;
 164
 165         return NULL;
 166 }
 167
 168 static struct rfcomm_dev *rfcomm_dev_get(int id)
 169 {
 170         struct rfcomm_dev *dev;
 171
 172         spin_lock(&rfcomm_dev_lock);
 173
 174         dev = __rfcomm_dev_get(id);
 175
 176         if (dev) {
 177                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 178                         dev = NULL;
 179                 else
 180                         tty_port_get(&dev->port);
 181         }
 182
 183         spin_unlock(&rfcomm_dev_lock);
 184
 185         return dev;
 186 }
 187
 188 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 189 {
 190         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 191         return sprintf(buf, "%pMR\n", &dev->dst);
 192 }
 193
 194 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 195 {
 196         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 197         return sprintf(buf, "%d\n", dev->channel);
 198 }
 199
 200 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 201 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 202
 203 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 204 {
 205         struct rfcomm_dev *dev, *entry;
 206         struct list_head *head = &rfcomm_dev_list;
 207         int err = 0;
 208
 209         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 210
 211         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 212         if (!dev)
 213                 return -ENOMEM;
 214
 215         spin_lock(&rfcomm_dev_lock);
 216
 217         if (req->dev_id < 0) {
 218                 dev->id = 0;
 219
 220                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 221                         if (entry->id != dev->id)
 222                                 break;
 223
 224                         dev->id++;
 225                         head = &entry->list;
 226                 }
 227         } else {
 228                 dev->id = req->dev_id;
 229
 230                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 231                         if (entry->id == dev->id) {
 232                                 err = -EADDRINUSE;
 233                                 goto out;
 234                         }
 235
 236                         if (entry->id > dev->id - 1)
 237                                 break;
 238
 239                         head = &entry->list;
 240                 }
 241         }
 242
 243         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 244                 err = -ENFILE;
 245                 goto out;
 246         }
 247
 248         sprintf(dev->name, "rfcomm%d", dev->id);
 249
 250         list_add(&dev->list, head);
 251
 252         bacpy(&dev->src, &req->src);
 253         bacpy(&dev->dst, &req->dst);
 254         dev->channel = req->channel;
 255
 256         dev->flags = req->flags &
 257                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 258
 259         tty_port_init(&dev->port);
 260         dev->port.ops = &rfcomm_port_ops;
 261
 262         skb_queue_head_init(&dev->pending);
 263
 264         rfcomm_dlc_lock(dlc);
 265
 266         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 267                 struct sock *sk = dlc->owner;
 268                 struct sk_buff *skb;
 269
 270                 BUG_ON(!sk);
 271
 272                 rfcomm_dlc_throttle(dlc);
 273
 274                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 275                         skb_orphan(skb);
 276                         skb_queue_tail(&dev->pending, skb);
 277                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 278                 }
 279         }
 280
 281         dlc->data_ready   = rfcomm_dev_data_ready;
 282         dlc->state_change = rfcomm_dev_state_change;
 283         dlc->modem_status = rfcomm_dev_modem_status;
 284
 285         dlc->owner = dev;
 286         dev->dlc   = dlc;
 287
 288         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 289
 290         rfcomm_dlc_unlock(dlc);
 291
 292         /* It's safe to call __module_get() here because socket already
 293            holds reference to this module. */
 294         __module_get(THIS_MODULE);
 295
 296 out:
 297         spin_unlock(&rfcomm_dev_lock);
 298
 299         if (err < 0)
 300                 goto free;
 301
 302         dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
 303                         dev->id, NULL);
 304         if (IS_ERR(dev->tty_dev)) {
 305                 err = PTR_ERR(dev->tty_dev);
 306                 spin_lock(&rfcomm_dev_lock);
 307                 list_del(&dev->list);
 308                 spin_unlock(&rfcomm_dev_lock);
 309                 goto free;
 310         }
 311
 312         dev_set_drvdata(dev->tty_dev, dev);
 313
 314         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 315                 BT_ERR("Failed to create address attribute");
 316
 317         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 318                 BT_ERR("Failed to create channel attribute");
 319
 320         return dev->id;
 321
 322 free:
 323         kfree(dev);
 324         return err;
 325 }
 326
 327 /* ---- Send buffer ---- */
 328 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 329 {
 330         /* We can't let it be zero, because we don't get a callback
 331            when tx_credits becomes nonzero, hence we'd never wake up */
 332         return dlc->mtu * (dlc->tx_credits?:1);
 333 }
 334
 335 static void rfcomm_wfree(struct sk_buff *skb)
 336 {
 337         struct rfcomm_dev *dev = (void *) skb->sk;
 338         atomic_sub(skb->truesize, &dev->wmem_alloc);
 339         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 340                 tty_port_tty_wakeup(&dev->port);
 341         tty_port_put(&dev->port);
 342 }
 343
 344 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 345 {
 346         tty_port_get(&dev->port);
 347         atomic_add(skb->truesize, &dev->wmem_alloc);
 348         skb->sk = (void *) dev;
 349         skb->destructor = rfcomm_wfree;
 350 }
 351
 352 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 353 {
 354         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 355                 struct sk_buff *skb = alloc_skb(size, priority);
 356                 if (skb) {
 357                         rfcomm_set_owner_w(skb, dev);
 358                         return skb;
 359                 }
 360         }
 361         return NULL;
 362 }
 363
 364 /* ---- Device IOCTLs ---- */
 365
 366 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 367
 368 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 369 {
 370         struct rfcomm_dev_req req;
 371         struct rfcomm_dlc *dlc;
 372         int id;
 373
 374         if (copy_from_user(&req, arg, sizeof(req)))
 375                 return -EFAULT;
 376
 377         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 378
 379         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 380                 return -EPERM;
 381
 382         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 383                 /* Socket must be connected */
 384                 if (sk->sk_state != BT_CONNECTED)
 385                         return -EBADFD;
 386
 387                 dlc = rfcomm_pi(sk)->dlc;
 388                 rfcomm_dlc_hold(dlc);
 389         } else {
 390                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 391                 if (!dlc)
 392                         return -ENOMEM;
 393         }
 394
 395         id = rfcomm_dev_add(&req, dlc);
 396         if (id < 0) {
 397                 rfcomm_dlc_put(dlc);
 398                 return id;
 399         }
 400
 401         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 402                 /* DLC is now used by device.
 403                  * Socket must be disconnected */
 404                 sk->sk_state = BT_CLOSED;
 405         }
 406
 407         return id;
 408 }
 409
 410 static int rfcomm_release_dev(void __user *arg)
 411 {
 412         struct rfcomm_dev_req req;
 413         struct rfcomm_dev *dev;
 414         struct tty_struct *tty;
 415
 416         if (copy_from_user(&req, arg, sizeof(req)))
 417                 return -EFAULT;
 418
 419         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 420
 421         dev = rfcomm_dev_get(req.dev_id);
 422         if (!dev)
 423                 return -ENODEV;
 424
 425         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 426                 tty_port_put(&dev->port);
 427                 return -EPERM;
 428         }
 429
 430         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 431                 rfcomm_dlc_close(dev->dlc, 0);
 432
 433         /* Shut down TTY synchronously before freeing rfcomm_dev */
 434         tty = tty_port_tty_get(&dev->port);
 435         if (tty) {
 436                 tty_vhangup(tty);
 437                 tty_kref_put(tty);
 438         }
 439
 440         if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags) &&
 441             !test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 442                 tty_port_put(&dev->port);
 443
 444         tty_port_put(&dev->port);
 445         return 0;
 446 }
 447
 448 static int rfcomm_get_dev_list(void __user *arg)
 449 {
 450         struct rfcomm_dev *dev;
 451         struct rfcomm_dev_list_req *dl;
 452         struct rfcomm_dev_info *di;
 453         int n = 0, size, err;
 454         u16 dev_num;
 455
 456         BT_DBG("");
 457
 458         if (get_user(dev_num, (u16 __user *) arg))
 459                 return -EFAULT;
 460
 461         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 462                 return -EINVAL;
 463
 464         size = sizeof(*dl) + dev_num * sizeof(*di);
 465
 466         dl = kzalloc(size, GFP_KERNEL);
 467         if (!dl)
 468                 return -ENOMEM;
 469
 470         di = dl->dev_info;
 471
 472         spin_lock(&rfcomm_dev_lock);
 473
 474         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 475                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 476                         continue;
 477                 (di + n)->id      = dev->id;
 478                 (di + n)->flags   = dev->flags;
 479                 (di + n)->state   = dev->dlc->state;
 480                 (di + n)->channel = dev->channel;
 481                 bacpy(&(di + n)->src, &dev->src);
 482                 bacpy(&(di + n)->dst, &dev->dst);
 483                 if (++n >= dev_num)
 484                         break;
 485         }
 486
 487         spin_unlock(&rfcomm_dev_lock);
 488
 489         dl->dev_num = n;
 490         size = sizeof(*dl) + n * sizeof(*di);
 491
 492         err = copy_to_user(arg, dl, size);
 493         kfree(dl);
 494
 495         return err ? -EFAULT : 0;
 496 }
 497
 498 static int rfcomm_get_dev_info(void __user *arg)
 499 {
 500         struct rfcomm_dev *dev;
 501         struct rfcomm_dev_info di;
 502         int err = 0;
 503
 504         BT_DBG("");
 505
 506         if (copy_from_user(&di, arg, sizeof(di)))
 507                 return -EFAULT;
 508
 509         dev = rfcomm_dev_get(di.id);
 510         if (!dev)
 511                 return -ENODEV;
 512
 513         di.flags   = dev->flags;
 514         di.channel = dev->channel;
 515         di.state   = dev->dlc->state;
 516         bacpy(&di.src, &dev->src);
 517         bacpy(&di.dst, &dev->dst);
 518
 519         if (copy_to_user(arg, &di, sizeof(di)))
 520                 err = -EFAULT;
 521
 522         tty_port_put(&dev->port);
 523         return err;
 524 }
 525
 526 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 527 {
 528         BT_DBG("cmd %d arg %p", cmd, arg);
 529
 530         switch (cmd) {
 531         case RFCOMMCREATEDEV:
 532                 return rfcomm_create_dev(sk, arg);
 533
 534         case RFCOMMRELEASEDEV:
 535                 return rfcomm_release_dev(arg);
 536
 537         case RFCOMMGETDEVLIST:
 538                 return rfcomm_get_dev_list(arg);
 539
 540         case RFCOMMGETDEVINFO:
 541                 return rfcomm_get_dev_info(arg);
 542         }
 543
 544         return -EINVAL;
 545 }
 546
 547 /* ---- DLC callbacks ---- */
 548 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 549 {
 550         struct rfcomm_dev *dev = dlc->owner;
 551
 552         if (!dev) {
 553                 kfree_skb(skb);
 554                 return;
 555         }
 556
 557         if (!skb_queue_empty(&dev->pending)) {
 558                 skb_queue_tail(&dev->pending, skb);
 559                 return;
 560         }
 561
 562         BT_DBG("dlc %p len %d", dlc, skb->len);
 563
 564         tty_insert_flip_string(&dev->port, skb->data, skb->len);
 565         tty_flip_buffer_push(&dev->port);
 566
 567         kfree_skb(skb);
 568 }
 569
 570 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 571 {
 572         struct rfcomm_dev *dev = dlc->owner;
 573         if (!dev)
 574                 return;
 575
 576         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 577
 578         dev->err = err;
 579         if (dlc->state == BT_CONNECTED) {
 580                 device_move(dev->tty_dev, rfcomm_get_device(dev),
 581                             DPM_ORDER_DEV_AFTER_PARENT);
 582
 583                 wake_up_interruptible(&dev->port.open_wait);
 584         } else if (dlc->state == BT_CLOSED)
 585                 tty_port_tty_hangup(&dev->port, false);
 586 }
 587
 588 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 589 {
 590         struct rfcomm_dev *dev = dlc->owner;
 591         if (!dev)
 592                 return;
 593
 594         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 595
 596         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
 597                 tty_port_tty_hangup(&dev->port, true);
 598
 599         dev->modem_status =
 600                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 601                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 602                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 603                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 604 }
 605
 606 /* ---- TTY functions ---- */
 607 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 608 {
 609         struct sk_buff *skb;
 610         int inserted = 0;
 611
 612         BT_DBG("dev %p", dev);
 613
 614         rfcomm_dlc_lock(dev->dlc);
 615
 616         while ((skb = skb_dequeue(&dev->pending))) {
 617                 inserted += tty_insert_flip_string(&dev->port, skb->data,
 618                                 skb->len);
 619                 kfree_skb(skb);
 620         }
 621
 622         rfcomm_dlc_unlock(dev->dlc);
 623
 624         if (inserted > 0)
 625                 tty_flip_buffer_push(&dev->port);
 626 }
 627
 628 /* do the reverse of install, clearing the tty fields and releasing the
 629  * reference to tty_port
 630  */
 631 static void rfcomm_tty_cleanup(struct tty_struct *tty)
 632 {
 633         struct rfcomm_dev *dev = tty->driver_data;
 634
 635         clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 636
 637         rfcomm_dlc_lock(dev->dlc);
 638         tty->driver_data = NULL;
 639         rfcomm_dlc_unlock(dev->dlc);
 640
 641         /*
 642          * purge the dlc->tx_queue to avoid circular dependencies
 643          * between dev and dlc
 644          */
 645         skb_queue_purge(&dev->dlc->tx_queue);
 646
 647         tty_port_put(&dev->port);
 648 }
 649
 650 /* we acquire the tty_port reference since it's here the tty is first used
 651  * by setting the termios. We also populate the driver_data field and install
 652  * the tty port
 653  */
 654 static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
 655 {
 656         struct rfcomm_dev *dev;
 657         struct rfcomm_dlc *dlc;
 658         int err;
 659
 660         dev = rfcomm_dev_get(tty->index);
 661         if (!dev)
 662                 return -ENODEV;
 663
 664         dlc = dev->dlc;
 665
 666         /* Attach TTY and open DLC */
 667         rfcomm_dlc_lock(dlc);
 668         tty->driver_data = dev;
 669         rfcomm_dlc_unlock(dlc);
 670         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 671
 672         /* install the tty_port */
 673         err = tty_port_install(&dev->port, driver, tty);
 674         if (err) {
 675                 rfcomm_tty_cleanup(tty);
 676                 return err;
 677         }
 678
 679         /* take over the tty_port reference if the port was created with the
 680          * flag RFCOMM_RELEASE_ONHUP. This will force the release of the port
 681          * when the last process closes the tty. The behaviour is expected by
 682          * userspace.
 683          */
 684         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
 685                 tty_port_put(&dev->port);
 686
 687         return 0;
 688 }
 689
 690 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 691 {
 692         struct rfcomm_dev *dev = tty->driver_data;
 693         int err;
 694
 695         BT_DBG("tty %p id %d", tty, tty->index);
 696
 697         BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
 698                dev->channel, dev->port.count);
 699
 700         err = tty_port_open(&dev->port, tty, filp);
 701         if (err)
 702                 return err;
 703
 704         /*
 705          * FIXME: rfcomm should use proper flow control for
 706          * received data. This hack will be unnecessary and can
 707          * be removed when that's implemented
 708          */
 709         rfcomm_tty_copy_pending(dev);
 710
 711         rfcomm_dlc_unthrottle(dev->dlc);
 712
 713         return 0;
 714 }
 715
 716 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 717 {
 718         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 719
 720         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 721                                                 dev->port.count);
 722
 723         tty_port_close(&dev->port, tty, filp);
 724 }
 725
 726 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 727 {
 728         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 729         struct rfcomm_dlc *dlc = dev->dlc;
 730         struct sk_buff *skb;
 731         int err = 0, sent = 0, size;
 732
 733         BT_DBG("tty %p count %d", tty, count);
 734
 735         while (count) {
 736                 size = min_t(uint, count, dlc->mtu);
 737
 738                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 739
 740                 if (!skb)
 741                         break;
 742
 743                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 744
 745                 memcpy(skb_put(skb, size), buf + sent, size);
 746
 747                 err = rfcomm_dlc_send(dlc, skb);
 748                 if (err < 0) {
 749                         kfree_skb(skb);
 750                         break;
 751                 }
 752
 753                 sent  += size;
 754                 count -= size;
 755         }
 756
 757         return sent ? sent : err;
 758 }
 759
 760 static int rfcomm_tty_write_room(struct tty_struct *tty)
 761 {
 762         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 763         int room;
 764
 765         BT_DBG("tty %p", tty);
 766
 767         if (!dev || !dev->dlc)
 768                 return 0;
 769
 770         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 771         if (room < 0)
 772                 room = 0;
 773
 774         return room;
 775 }
 776
 777 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 778 {
 779         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 780
 781         switch (cmd) {
 782         case TCGETS:
 783                 BT_DBG("TCGETS is not supported");
 784                 return -ENOIOCTLCMD;
 785
 786         case TCSETS:
 787                 BT_DBG("TCSETS is not supported");
 788                 return -ENOIOCTLCMD;
 789
 790         case TIOCMIWAIT:
 791                 BT_DBG("TIOCMIWAIT");
 792                 break;
 793
 794         case TIOCGSERIAL:
 795                 BT_ERR("TIOCGSERIAL is not supported");
 796                 return -ENOIOCTLCMD;
 797
 798         case TIOCSSERIAL:
 799                 BT_ERR("TIOCSSERIAL is not supported");
 800                 return -ENOIOCTLCMD;
 801
 802         case TIOCSERGSTRUCT:
 803                 BT_ERR("TIOCSERGSTRUCT is not supported");
 804                 return -ENOIOCTLCMD;
 805
 806         case TIOCSERGETLSR:
 807                 BT_ERR("TIOCSERGETLSR is not supported");
 808                 return -ENOIOCTLCMD;
 809
 810         case TIOCSERCONFIG:
 811                 BT_ERR("TIOCSERCONFIG is not supported");
 812                 return -ENOIOCTLCMD;
 813
 814         default:
 815                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 816
 817         }
 818
 819         return -ENOIOCTLCMD;
 820 }
 821
 822 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 823 {
 824         struct ktermios *new = &tty->termios;
 825         int old_baud_rate = tty_termios_baud_rate(old);
 826         int new_baud_rate = tty_termios_baud_rate(new);
 827
 828         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 829         u16 changes = 0;
 830
 831         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 832
 833         BT_DBG("tty %p termios %p", tty, old);
 834
 835         if (!dev || !dev->dlc || !dev->dlc->session)
 836                 return;
 837
 838         /* Handle turning off CRTSCTS */
 839         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 840                 BT_DBG("Turning off CRTSCTS unsupported");
 841
 842         /* Parity on/off and when on, odd/even */
 843         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 844                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 845                 changes |= RFCOMM_RPN_PM_PARITY;
 846                 BT_DBG("Parity change detected.");
 847         }
 848
 849         /* Mark and space parity are not supported! */
 850         if (new->c_cflag & PARENB) {
 851                 if (new->c_cflag & PARODD) {
 852                         BT_DBG("Parity is ODD");
 853                         parity = RFCOMM_RPN_PARITY_ODD;
 854                 } else {
 855                         BT_DBG("Parity is EVEN");
 856                         parity = RFCOMM_RPN_PARITY_EVEN;
 857                 }
 858         } else {
 859                 BT_DBG("Parity is OFF");
 860                 parity = RFCOMM_RPN_PARITY_NONE;
 861         }
 862
 863         /* Setting the x_on / x_off characters */
 864         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 865                 BT_DBG("XOFF custom");
 866                 x_on = new->c_cc[VSTOP];
 867                 changes |= RFCOMM_RPN_PM_XON;
 868         } else {
 869                 BT_DBG("XOFF default");
 870                 x_on = RFCOMM_RPN_XON_CHAR;
 871         }
 872
 873         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 874                 BT_DBG("XON custom");
 875                 x_off = new->c_cc[VSTART];
 876                 changes |= RFCOMM_RPN_PM_XOFF;
 877         } else {
 878                 BT_DBG("XON default");
 879                 x_off = RFCOMM_RPN_XOFF_CHAR;
 880         }
 881
 882         /* Handle setting of stop bits */
 883         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 884                 changes |= RFCOMM_RPN_PM_STOP;
 885
 886         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 887          * support 2 stop bits. So a request for 2 stop bits gets
 888          * translated to 1.5 stop bits */
 889         if (new->c_cflag & CSTOPB)
 890                 stop_bits = RFCOMM_RPN_STOP_15;
 891         else
 892                 stop_bits = RFCOMM_RPN_STOP_1;
 893
 894         /* Handle number of data bits [5-8] */
 895         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 896                 changes |= RFCOMM_RPN_PM_DATA;
 897
 898         switch (new->c_cflag & CSIZE) {
 899         case CS5:
 900                 data_bits = RFCOMM_RPN_DATA_5;
 901                 break;
 902         case CS6:
 903                 data_bits = RFCOMM_RPN_DATA_6;
 904                 break;
 905         case CS7:
 906                 data_bits = RFCOMM_RPN_DATA_7;
 907                 break;
 908         case CS8:
 909                 data_bits = RFCOMM_RPN_DATA_8;
 910                 break;
 911         default:
 912                 data_bits = RFCOMM_RPN_DATA_8;
 913                 break;
 914         }
 915
 916         /* Handle baudrate settings */
 917         if (old_baud_rate != new_baud_rate)
 918                 changes |= RFCOMM_RPN_PM_BITRATE;
 919
 920         switch (new_baud_rate) {
 921         case 2400:
 922                 baud = RFCOMM_RPN_BR_2400;
 923                 break;
 924         case 4800:
 925                 baud = RFCOMM_RPN_BR_4800;
 926                 break;
 927         case 7200:
 928                 baud = RFCOMM_RPN_BR_7200;
 929                 break;
 930         case 9600:
 931                 baud = RFCOMM_RPN_BR_9600;
 932                 break;
 933         case 19200:
 934                 baud = RFCOMM_RPN_BR_19200;
 935                 break;
 936         case 38400:
 937                 baud = RFCOMM_RPN_BR_38400;
 938                 break;
 939         case 57600:
 940                 baud = RFCOMM_RPN_BR_57600;
 941                 break;
 942         case 115200:
 943                 baud = RFCOMM_RPN_BR_115200;
 944                 break;
 945         case 230400:
 946                 baud = RFCOMM_RPN_BR_230400;
 947                 break;
 948         default:
 949                 /* 9600 is standard accordinag to the RFCOMM specification */
 950                 baud = RFCOMM_RPN_BR_9600;
 951                 break;
 952
 953         }
 954
 955         if (changes)
 956                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 957                                 data_bits, stop_bits, parity,
 958                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 959 }
 960
 961 static void rfcomm_tty_throttle(struct tty_struct *tty)
 962 {
 963         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 964
 965         BT_DBG("tty %p dev %p", tty, dev);
 966
 967         rfcomm_dlc_throttle(dev->dlc);
 968 }
 969
 970 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 971 {
 972         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 973
 974         BT_DBG("tty %p dev %p", tty, dev);
 975
 976         rfcomm_dlc_unthrottle(dev->dlc);
 977 }
 978
 979 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 980 {
 981         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 982
 983         BT_DBG("tty %p dev %p", tty, dev);
 984
 985         if (!dev || !dev->dlc)
 986                 return 0;
 987
 988         if (!skb_queue_empty(&dev->dlc->tx_queue))
 989                 return dev->dlc->mtu;
 990
 991         return 0;
 992 }
 993
 994 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 995 {
 996         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 997
 998         BT_DBG("tty %p dev %p", tty, dev);
 999
1000         if (!dev || !dev->dlc)
1001                 return;
1002
1003         skb_queue_purge(&dev->dlc->tx_queue);
1004         tty_wakeup(tty);
1005 }
1006
1007 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1008 {
1009         BT_DBG("tty %p ch %c", tty, ch);
1010 }
1011
1012 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1013 {
1014         BT_DBG("tty %p timeout %d", tty, timeout);
1015 }
1016
1017 static void rfcomm_tty_hangup(struct tty_struct *tty)
1018 {
1019         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1020
1021         BT_DBG("tty %p dev %p", tty, dev);
1022
1023         tty_port_hangup(&dev->port);
1024 }
1025
1026 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1027 {
1028         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1029
1030         BT_DBG("tty %p dev %p", tty, dev);
1031
1032         return dev->modem_status;
1033 }
1034
1035 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1036 {
1037         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1038         struct rfcomm_dlc *dlc = dev->dlc;
1039         u8 v24_sig;
1040
1041         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1042
1043         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1044
1045         if (set & TIOCM_DSR || set & TIOCM_DTR)
1046                 v24_sig |= RFCOMM_V24_RTC;
1047         if (set & TIOCM_RTS || set & TIOCM_CTS)
1048                 v24_sig |= RFCOMM_V24_RTR;
1049         if (set & TIOCM_RI)
1050                 v24_sig |= RFCOMM_V24_IC;
1051         if (set & TIOCM_CD)
1052                 v24_sig |= RFCOMM_V24_DV;
1053
1054         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1055                 v24_sig &= ~RFCOMM_V24_RTC;
1056         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1057                 v24_sig &= ~RFCOMM_V24_RTR;
1058         if (clear & TIOCM_RI)
1059                 v24_sig &= ~RFCOMM_V24_IC;
1060         if (clear & TIOCM_CD)
1061                 v24_sig &= ~RFCOMM_V24_DV;
1062
1063         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1064
1065         return 0;
1066 }
1067
1068 /* ---- TTY structure ---- */
1069
1070 static const struct tty_operations rfcomm_ops = {
1071         .open                   = rfcomm_tty_open,
1072         .close                  = rfcomm_tty_close,
1073         .write                  = rfcomm_tty_write,
1074         .write_room             = rfcomm_tty_write_room,
1075         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1076         .flush_buffer           = rfcomm_tty_flush_buffer,
1077         .ioctl                  = rfcomm_tty_ioctl,
1078         .throttle               = rfcomm_tty_throttle,
1079         .unthrottle             = rfcomm_tty_unthrottle,
1080         .set_termios            = rfcomm_tty_set_termios,
1081         .send_xchar             = rfcomm_tty_send_xchar,
1082         .hangup                 = rfcomm_tty_hangup,
1083         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1084         .tiocmget               = rfcomm_tty_tiocmget,
1085         .tiocmset               = rfcomm_tty_tiocmset,
1086         .install                = rfcomm_tty_install,
1087         .cleanup                = rfcomm_tty_cleanup,
1088 };
1089
1090 int __init rfcomm_init_ttys(void)
1091 {
1092         int error;
1093
1094         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1095         if (!rfcomm_tty_driver)
1096                 return -ENOMEM;
1097
1098         rfcomm_tty_driver->driver_name  = "rfcomm";
1099         rfcomm_tty_driver->name         = "rfcomm";
1100         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1101         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1102         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1103         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1104         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1105         rfcomm_tty_driver->init_termios = tty_std_termios;
1106         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
1107         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1108         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1109
1110         error = tty_register_driver(rfcomm_tty_driver);
1111         if (error) {
1112                 BT_ERR("Can't register RFCOMM TTY driver");
1113                 put_tty_driver(rfcomm_tty_driver);
1114                 return error;
1115         }
1116
1117         BT_INFO("RFCOMM TTY layer initialized");
1118
1119         return 0;
1120 }
1121
1122 void rfcomm_cleanup_ttys(void)
1123 {
1124         tty_unregister_driver(rfcomm_tty_driver);
1125         put_tty_driver(rfcomm_tty_driver);
1126 }