net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  40 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  41 #define RFCOMM_TTY_MINOR 0
  42
  43 static struct tty_driver *rfcomm_tty_driver;
  44
  45 struct rfcomm_dev {
  46         struct tty_port         port;
  47         struct list_head        list;
  48
  49         char                    name[12];
  50         int                     id;
  51         unsigned long           flags;
  52         int                     err;
  53
  54         unsigned long           status;         /* don't export to userspace */
  55
  56         bdaddr_t                src;
  57         bdaddr_t                dst;
  58         u8                      channel;
  59
  60         uint                    modem_status;
  61
  62         struct rfcomm_dlc       *dlc;
  63
  64         struct device           *tty_dev;
  65
  66         atomic_t                wmem_alloc;
  67
  68         struct sk_buff_head     pending;
  69 };
  70
  71 static LIST_HEAD(rfcomm_dev_list);
  72 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  73
  74 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  75 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  76 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  77
  78 /* ---- Device functions ---- */
  79
  80 static void rfcomm_dev_destruct(struct tty_port *port)
  81 {
  82         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  83         struct rfcomm_dlc *dlc = dev->dlc;
  84
  85         BT_DBG("dev %p dlc %p", dev, dlc);
  86
  87         rfcomm_dlc_lock(dlc);
  88         /* Detach DLC if it's owned by this dev */
  89         if (dlc->owner == dev)
  90                 dlc->owner = NULL;
  91         rfcomm_dlc_unlock(dlc);
  92
  93         rfcomm_dlc_put(dlc);
  94
  95         tty_unregister_device(rfcomm_tty_driver, dev->id);
  96
  97         spin_lock(&rfcomm_dev_lock);
  98         list_del(&dev->list);
  99         spin_unlock(&rfcomm_dev_lock);
 100
 101         kfree(dev);
 102
 103         /* It's safe to call module_put() here because socket still
 104            holds reference to this module. */
 105         module_put(THIS_MODULE);
 106 }
 107
 108 /* device-specific initialization: open the dlc */
 109 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
 110 {
 111         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 112
 113         return rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
 114 }
 115
 116 /* we block the open until the dlc->state becomes BT_CONNECTED */
 117 static int rfcomm_dev_carrier_raised(struct tty_port *port)
 118 {
 119         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 120
 121         return (dev->dlc->state == BT_CONNECTED);
 122 }
 123
 124 /* device-specific cleanup: close the dlc */
 125 static void rfcomm_dev_shutdown(struct tty_port *port)
 126 {
 127         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 128
 129         if (dev->tty_dev->parent)
 130                 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 131
 132         /* close the dlc */
 133         rfcomm_dlc_close(dev->dlc, 0);
 134 }
 135
 136 static const struct tty_port_operations rfcomm_port_ops = {
 137         .destruct = rfcomm_dev_destruct,
 138         .activate = rfcomm_dev_activate,
 139         .shutdown = rfcomm_dev_shutdown,
 140         .carrier_raised = rfcomm_dev_carrier_raised,
 141 };
 142
 143 static struct rfcomm_dev *__rfcomm_dev_lookup(int id)
 144 {
 145         struct rfcomm_dev *dev;
 146
 147         list_for_each_entry(dev, &rfcomm_dev_list, list)
 148                 if (dev->id == id)
 149                         return dev;
 150
 151         return NULL;
 152 }
 153
 154 static struct rfcomm_dev *rfcomm_dev_get(int id)
 155 {
 156         struct rfcomm_dev *dev;
 157
 158         spin_lock(&rfcomm_dev_lock);
 159
 160         dev = __rfcomm_dev_lookup(id);
 161
 162         if (dev && !tty_port_get(&dev->port))
 163                 dev = NULL;
 164
 165         spin_unlock(&rfcomm_dev_lock);
 166
 167         return dev;
 168 }
 169
 170 static void rfcomm_reparent_device(struct rfcomm_dev *dev)
 171 {
 172         struct hci_dev *hdev;
 173         struct hci_conn *conn;
 174
 175         hdev = hci_get_route(&dev->dst, &dev->src);
 176         if (!hdev)
 177                 return;
 178
 179         /* The lookup results are unsafe to access without the
 180          * hci device lock (FIXME: why is this not documented?)
 181          */
 182         hci_dev_lock(hdev);
 183         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 184
 185         /* Just because the acl link is in the hash table is no
 186          * guarantee the sysfs device has been added ...
 187          */
 188         if (conn && device_is_registered(&conn->dev))
 189                 device_move(dev->tty_dev, &conn->dev, DPM_ORDER_DEV_AFTER_PARENT);
 190
 191         hci_dev_unlock(hdev);
 192         hci_dev_put(hdev);
 193 }
 194
 195 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 196 {
 197         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 198         return sprintf(buf, "%pMR\n", &dev->dst);
 199 }
 200
 201 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 202 {
 203         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 204         return sprintf(buf, "%d\n", dev->channel);
 205 }
 206
 207 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 208 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 209
 210 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 211 {
 212         struct rfcomm_dev *dev, *entry;
 213         struct list_head *head = &rfcomm_dev_list;
 214         int err = 0;
 215
 216         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 217
 218         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 219         if (!dev)
 220                 return -ENOMEM;
 221
 222         spin_lock(&rfcomm_dev_lock);
 223
 224         if (req->dev_id < 0) {
 225                 dev->id = 0;
 226
 227                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 228                         if (entry->id != dev->id)
 229                                 break;
 230
 231                         dev->id++;
 232                         head = &entry->list;
 233                 }
 234         } else {
 235                 dev->id = req->dev_id;
 236
 237                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 238                         if (entry->id == dev->id) {
 239                                 err = -EADDRINUSE;
 240                                 goto out;
 241                         }
 242
 243                         if (entry->id > dev->id - 1)
 244                                 break;
 245
 246                         head = &entry->list;
 247                 }
 248         }
 249
 250         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 251                 err = -ENFILE;
 252                 goto out;
 253         }
 254
 255         sprintf(dev->name, "rfcomm%d", dev->id);
 256
 257         list_add(&dev->list, head);
 258
 259         bacpy(&dev->src, &req->src);
 260         bacpy(&dev->dst, &req->dst);
 261         dev->channel = req->channel;
 262
 263         dev->flags = req->flags &
 264                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 265
 266         tty_port_init(&dev->port);
 267         dev->port.ops = &rfcomm_port_ops;
 268
 269         skb_queue_head_init(&dev->pending);
 270
 271         rfcomm_dlc_lock(dlc);
 272
 273         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 274                 struct sock *sk = dlc->owner;
 275                 struct sk_buff *skb;
 276
 277                 BUG_ON(!sk);
 278
 279                 rfcomm_dlc_throttle(dlc);
 280
 281                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 282                         skb_orphan(skb);
 283                         skb_queue_tail(&dev->pending, skb);
 284                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 285                 }
 286         }
 287
 288         dlc->data_ready   = rfcomm_dev_data_ready;
 289         dlc->state_change = rfcomm_dev_state_change;
 290         dlc->modem_status = rfcomm_dev_modem_status;
 291
 292         dlc->owner = dev;
 293         dev->dlc   = dlc;
 294
 295         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 296
 297         rfcomm_dlc_unlock(dlc);
 298
 299         /* It's safe to call __module_get() here because socket already
 300            holds reference to this module. */
 301         __module_get(THIS_MODULE);
 302
 303 out:
 304         spin_unlock(&rfcomm_dev_lock);
 305
 306         if (err < 0)
 307                 goto free;
 308
 309         dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
 310                         dev->id, NULL);
 311         if (IS_ERR(dev->tty_dev)) {
 312                 err = PTR_ERR(dev->tty_dev);
 313                 spin_lock(&rfcomm_dev_lock);
 314                 list_del(&dev->list);
 315                 spin_unlock(&rfcomm_dev_lock);
 316                 goto free;
 317         }
 318
 319         rfcomm_reparent_device(dev);
 320         dev_set_drvdata(dev->tty_dev, dev);
 321
 322         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 323                 BT_ERR("Failed to create address attribute");
 324
 325         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 326                 BT_ERR("Failed to create channel attribute");
 327
 328         return dev->id;
 329
 330 free:
 331         kfree(dev);
 332         return err;
 333 }
 334
 335 /* ---- Send buffer ---- */
 336 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 337 {
 338         /* We can't let it be zero, because we don't get a callback
 339            when tx_credits becomes nonzero, hence we'd never wake up */
 340         return dlc->mtu * (dlc->tx_credits?:1);
 341 }
 342
 343 static void rfcomm_wfree(struct sk_buff *skb)
 344 {
 345         struct rfcomm_dev *dev = (void *) skb->sk;
 346         atomic_sub(skb->truesize, &dev->wmem_alloc);
 347         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 348                 tty_port_tty_wakeup(&dev->port);
 349         tty_port_put(&dev->port);
 350 }
 351
 352 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 353 {
 354         tty_port_get(&dev->port);
 355         atomic_add(skb->truesize, &dev->wmem_alloc);
 356         skb->sk = (void *) dev;
 357         skb->destructor = rfcomm_wfree;
 358 }
 359
 360 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 361 {
 362         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 363                 struct sk_buff *skb = alloc_skb(size, priority);
 364                 if (skb) {
 365                         rfcomm_set_owner_w(skb, dev);
 366                         return skb;
 367                 }
 368         }
 369         return NULL;
 370 }
 371
 372 /* ---- Device IOCTLs ---- */
 373
 374 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 375
 376 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 377 {
 378         struct rfcomm_dev_req req;
 379         struct rfcomm_dlc *dlc;
 380         int id;
 381
 382         if (copy_from_user(&req, arg, sizeof(req)))
 383                 return -EFAULT;
 384
 385         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 386
 387         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 388                 return -EPERM;
 389
 390         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 391                 /* Socket must be connected */
 392                 if (sk->sk_state != BT_CONNECTED)
 393                         return -EBADFD;
 394
 395                 dlc = rfcomm_pi(sk)->dlc;
 396                 rfcomm_dlc_hold(dlc);
 397         } else {
 398                 /* Validate the channel is unused */
 399                 dlc = rfcomm_dlc_exists(&req.src, &req.dst, req.channel);
 400                 if (IS_ERR(dlc))
 401                         return PTR_ERR(dlc);
 402                 else if (dlc) {
 403                         rfcomm_dlc_put(dlc);
 404                         return -EBUSY;
 405                 }
 406                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 407                 if (!dlc)
 408                         return -ENOMEM;
 409         }
 410
 411         id = rfcomm_dev_add(&req, dlc);
 412         if (id < 0) {
 413                 rfcomm_dlc_put(dlc);
 414                 return id;
 415         }
 416
 417         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 418                 /* DLC is now used by device.
 419                  * Socket must be disconnected */
 420                 sk->sk_state = BT_CLOSED;
 421         }
 422
 423         return id;
 424 }
 425
 426 static int rfcomm_release_dev(void __user *arg)
 427 {
 428         struct rfcomm_dev_req req;
 429         struct rfcomm_dev *dev;
 430         struct tty_struct *tty;
 431
 432         if (copy_from_user(&req, arg, sizeof(req)))
 433                 return -EFAULT;
 434
 435         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 436
 437         dev = rfcomm_dev_get(req.dev_id);
 438         if (!dev)
 439                 return -ENODEV;
 440
 441         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 442                 tty_port_put(&dev->port);
 443                 return -EPERM;
 444         }
 445
 446         /* only release once */
 447         if (test_and_set_bit(RFCOMM_DEV_RELEASED, &dev->status)) {
 448                 tty_port_put(&dev->port);
 449                 return -EALREADY;
 450         }
 451
 452         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 453                 rfcomm_dlc_close(dev->dlc, 0);
 454
 455         /* Shut down TTY synchronously before freeing rfcomm_dev */
 456         tty = tty_port_tty_get(&dev->port);
 457         if (tty) {
 458                 tty_vhangup(tty);
 459                 tty_kref_put(tty);
 460         }
 461
 462         if (!test_bit(RFCOMM_TTY_OWNED, &dev->status))
 463                 tty_port_put(&dev->port);
 464
 465         tty_port_put(&dev->port);
 466         return 0;
 467 }
 468
 469 static int rfcomm_get_dev_list(void __user *arg)
 470 {
 471         struct rfcomm_dev *dev;
 472         struct rfcomm_dev_list_req *dl;
 473         struct rfcomm_dev_info *di;
 474         int n = 0, size, err;
 475         u16 dev_num;
 476
 477         BT_DBG("");
 478
 479         if (get_user(dev_num, (u16 __user *) arg))
 480                 return -EFAULT;
 481
 482         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 483                 return -EINVAL;
 484
 485         size = sizeof(*dl) + dev_num * sizeof(*di);
 486
 487         dl = kzalloc(size, GFP_KERNEL);
 488         if (!dl)
 489                 return -ENOMEM;
 490
 491         di = dl->dev_info;
 492
 493         spin_lock(&rfcomm_dev_lock);
 494
 495         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 496                 if (!tty_port_get(&dev->port))
 497                         continue;
 498                 (di + n)->id      = dev->id;
 499                 (di + n)->flags   = dev->flags;
 500                 (di + n)->state   = dev->dlc->state;
 501                 (di + n)->channel = dev->channel;
 502                 bacpy(&(di + n)->src, &dev->src);
 503                 bacpy(&(di + n)->dst, &dev->dst);
 504                 tty_port_put(&dev->port);
 505                 if (++n >= dev_num)
 506                         break;
 507         }
 508
 509         spin_unlock(&rfcomm_dev_lock);
 510
 511         dl->dev_num = n;
 512         size = sizeof(*dl) + n * sizeof(*di);
 513
 514         err = copy_to_user(arg, dl, size);
 515         kfree(dl);
 516
 517         return err ? -EFAULT : 0;
 518 }
 519
 520 static int rfcomm_get_dev_info(void __user *arg)
 521 {
 522         struct rfcomm_dev *dev;
 523         struct rfcomm_dev_info di;
 524         int err = 0;
 525
 526         BT_DBG("");
 527
 528         if (copy_from_user(&di, arg, sizeof(di)))
 529                 return -EFAULT;
 530
 531         dev = rfcomm_dev_get(di.id);
 532         if (!dev)
 533                 return -ENODEV;
 534
 535         di.flags   = dev->flags;
 536         di.channel = dev->channel;
 537         di.state   = dev->dlc->state;
 538         bacpy(&di.src, &dev->src);
 539         bacpy(&di.dst, &dev->dst);
 540
 541         if (copy_to_user(arg, &di, sizeof(di)))
 542                 err = -EFAULT;
 543
 544         tty_port_put(&dev->port);
 545         return err;
 546 }
 547
 548 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 549 {
 550         BT_DBG("cmd %d arg %p", cmd, arg);
 551
 552         switch (cmd) {
 553         case RFCOMMCREATEDEV:
 554                 return rfcomm_create_dev(sk, arg);
 555
 556         case RFCOMMRELEASEDEV:
 557                 return rfcomm_release_dev(arg);
 558
 559         case RFCOMMGETDEVLIST:
 560                 return rfcomm_get_dev_list(arg);
 561
 562         case RFCOMMGETDEVINFO:
 563                 return rfcomm_get_dev_info(arg);
 564         }
 565
 566         return -EINVAL;
 567 }
 568
 569 /* ---- DLC callbacks ---- */
 570 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 571 {
 572         struct rfcomm_dev *dev = dlc->owner;
 573
 574         if (!dev) {
 575                 kfree_skb(skb);
 576                 return;
 577         }
 578
 579         if (!skb_queue_empty(&dev->pending)) {
 580                 skb_queue_tail(&dev->pending, skb);
 581                 return;
 582         }
 583
 584         BT_DBG("dlc %p len %d", dlc, skb->len);
 585
 586         tty_insert_flip_string(&dev->port, skb->data, skb->len);
 587         tty_flip_buffer_push(&dev->port);
 588
 589         kfree_skb(skb);
 590 }
 591
 592 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 593 {
 594         struct rfcomm_dev *dev = dlc->owner;
 595         if (!dev)
 596                 return;
 597
 598         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 599
 600         dev->err = err;
 601         if (dlc->state == BT_CONNECTED) {
 602                 rfcomm_reparent_device(dev);
 603
 604                 wake_up_interruptible(&dev->port.open_wait);
 605         } else if (dlc->state == BT_CLOSED)
 606                 tty_port_tty_hangup(&dev->port, false);
 607 }
 608
 609 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 610 {
 611         struct rfcomm_dev *dev = dlc->owner;
 612         if (!dev)
 613                 return;
 614
 615         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 616
 617         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
 618                 tty_port_tty_hangup(&dev->port, true);
 619
 620         dev->modem_status =
 621                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 622                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 623                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 624                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 625 }
 626
 627 /* ---- TTY functions ---- */
 628 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 629 {
 630         struct sk_buff *skb;
 631         int inserted = 0;
 632
 633         BT_DBG("dev %p", dev);
 634
 635         rfcomm_dlc_lock(dev->dlc);
 636
 637         while ((skb = skb_dequeue(&dev->pending))) {
 638                 inserted += tty_insert_flip_string(&dev->port, skb->data,
 639                                 skb->len);
 640                 kfree_skb(skb);
 641         }
 642
 643         rfcomm_dlc_unlock(dev->dlc);
 644
 645         if (inserted > 0)
 646                 tty_flip_buffer_push(&dev->port);
 647 }
 648
 649 /* do the reverse of install, clearing the tty fields and releasing the
 650  * reference to tty_port
 651  */
 652 static void rfcomm_tty_cleanup(struct tty_struct *tty)
 653 {
 654         struct rfcomm_dev *dev = tty->driver_data;
 655
 656         clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 657
 658         rfcomm_dlc_lock(dev->dlc);
 659         tty->driver_data = NULL;
 660         rfcomm_dlc_unlock(dev->dlc);
 661
 662         /*
 663          * purge the dlc->tx_queue to avoid circular dependencies
 664          * between dev and dlc
 665          */
 666         skb_queue_purge(&dev->dlc->tx_queue);
 667
 668         tty_port_put(&dev->port);
 669 }
 670
 671 /* we acquire the tty_port reference since it's here the tty is first used
 672  * by setting the termios. We also populate the driver_data field and install
 673  * the tty port
 674  */
 675 static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
 676 {
 677         struct rfcomm_dev *dev;
 678         struct rfcomm_dlc *dlc;
 679         int err;
 680
 681         dev = rfcomm_dev_get(tty->index);
 682         if (!dev)
 683                 return -ENODEV;
 684
 685         dlc = dev->dlc;
 686
 687         /* Attach TTY and open DLC */
 688         rfcomm_dlc_lock(dlc);
 689         tty->driver_data = dev;
 690         rfcomm_dlc_unlock(dlc);
 691         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 692
 693         /* install the tty_port */
 694         err = tty_port_install(&dev->port, driver, tty);
 695         if (err) {
 696                 rfcomm_tty_cleanup(tty);
 697                 return err;
 698         }
 699
 700         /* take over the tty_port reference if the port was created with the
 701          * flag RFCOMM_RELEASE_ONHUP. This will force the release of the port
 702          * when the last process closes the tty. The behaviour is expected by
 703          * userspace.
 704          */
 705         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 706                 set_bit(RFCOMM_TTY_OWNED, &dev->status);
 707                 tty_port_put(&dev->port);
 708         }
 709
 710         return 0;
 711 }
 712
 713 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 714 {
 715         struct rfcomm_dev *dev = tty->driver_data;
 716         int err;
 717
 718         BT_DBG("tty %p id %d", tty, tty->index);
 719
 720         BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
 721                dev->channel, dev->port.count);
 722
 723         err = tty_port_open(&dev->port, tty, filp);
 724         if (err)
 725                 return err;
 726
 727         /*
 728          * FIXME: rfcomm should use proper flow control for
 729          * received data. This hack will be unnecessary and can
 730          * be removed when that's implemented
 731          */
 732         rfcomm_tty_copy_pending(dev);
 733
 734         rfcomm_dlc_unthrottle(dev->dlc);
 735
 736         return 0;
 737 }
 738
 739 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 740 {
 741         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 742
 743         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 744                                                 dev->port.count);
 745
 746         tty_port_close(&dev->port, tty, filp);
 747 }
 748
 749 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 750 {
 751         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 752         struct rfcomm_dlc *dlc = dev->dlc;
 753         struct sk_buff *skb;
 754         int err = 0, sent = 0, size;
 755
 756         BT_DBG("tty %p count %d", tty, count);
 757
 758         while (count) {
 759                 size = min_t(uint, count, dlc->mtu);
 760
 761                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 762
 763                 if (!skb)
 764                         break;
 765
 766                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 767
 768                 memcpy(skb_put(skb, size), buf + sent, size);
 769
 770                 err = rfcomm_dlc_send(dlc, skb);
 771                 if (err < 0) {
 772                         kfree_skb(skb);
 773                         break;
 774                 }
 775
 776                 sent  += size;
 777                 count -= size;
 778         }
 779
 780         return sent ? sent : err;
 781 }
 782
 783 static int rfcomm_tty_write_room(struct tty_struct *tty)
 784 {
 785         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 786         int room;
 787
 788         BT_DBG("tty %p", tty);
 789
 790         if (!dev || !dev->dlc)
 791                 return 0;
 792
 793         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 794         if (room < 0)
 795                 room = 0;
 796
 797         return room;
 798 }
 799
 800 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 801 {
 802         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 803
 804         switch (cmd) {
 805         case TCGETS:
 806                 BT_DBG("TCGETS is not supported");
 807                 return -ENOIOCTLCMD;
 808
 809         case TCSETS:
 810                 BT_DBG("TCSETS is not supported");
 811                 return -ENOIOCTLCMD;
 812
 813         case TIOCMIWAIT:
 814                 BT_DBG("TIOCMIWAIT");
 815                 break;
 816
 817         case TIOCGSERIAL:
 818                 BT_ERR("TIOCGSERIAL is not supported");
 819                 return -ENOIOCTLCMD;
 820
 821         case TIOCSSERIAL:
 822                 BT_ERR("TIOCSSERIAL is not supported");
 823                 return -ENOIOCTLCMD;
 824
 825         case TIOCSERGSTRUCT:
 826                 BT_ERR("TIOCSERGSTRUCT is not supported");
 827                 return -ENOIOCTLCMD;
 828
 829         case TIOCSERGETLSR:
 830                 BT_ERR("TIOCSERGETLSR is not supported");
 831                 return -ENOIOCTLCMD;
 832
 833         case TIOCSERCONFIG:
 834                 BT_ERR("TIOCSERCONFIG is not supported");
 835                 return -ENOIOCTLCMD;
 836
 837         default:
 838                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 839
 840         }
 841
 842         return -ENOIOCTLCMD;
 843 }
 844
 845 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 846 {
 847         struct ktermios *new = &tty->termios;
 848         int old_baud_rate = tty_termios_baud_rate(old);
 849         int new_baud_rate = tty_termios_baud_rate(new);
 850
 851         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 852         u16 changes = 0;
 853
 854         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 855
 856         BT_DBG("tty %p termios %p", tty, old);
 857
 858         if (!dev || !dev->dlc || !dev->dlc->session)
 859                 return;
 860
 861         /* Handle turning off CRTSCTS */
 862         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 863                 BT_DBG("Turning off CRTSCTS unsupported");
 864
 865         /* Parity on/off and when on, odd/even */
 866         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 867                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 868                 changes |= RFCOMM_RPN_PM_PARITY;
 869                 BT_DBG("Parity change detected.");
 870         }
 871
 872         /* Mark and space parity are not supported! */
 873         if (new->c_cflag & PARENB) {
 874                 if (new->c_cflag & PARODD) {
 875                         BT_DBG("Parity is ODD");
 876                         parity = RFCOMM_RPN_PARITY_ODD;
 877                 } else {
 878                         BT_DBG("Parity is EVEN");
 879                         parity = RFCOMM_RPN_PARITY_EVEN;
 880                 }
 881         } else {
 882                 BT_DBG("Parity is OFF");
 883                 parity = RFCOMM_RPN_PARITY_NONE;
 884         }
 885
 886         /* Setting the x_on / x_off characters */
 887         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 888                 BT_DBG("XOFF custom");
 889                 x_on = new->c_cc[VSTOP];
 890                 changes |= RFCOMM_RPN_PM_XON;
 891         } else {
 892                 BT_DBG("XOFF default");
 893                 x_on = RFCOMM_RPN_XON_CHAR;
 894         }
 895
 896         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 897                 BT_DBG("XON custom");
 898                 x_off = new->c_cc[VSTART];
 899                 changes |= RFCOMM_RPN_PM_XOFF;
 900         } else {
 901                 BT_DBG("XON default");
 902                 x_off = RFCOMM_RPN_XOFF_CHAR;
 903         }
 904
 905         /* Handle setting of stop bits */
 906         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 907                 changes |= RFCOMM_RPN_PM_STOP;
 908
 909         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 910          * support 2 stop bits. So a request for 2 stop bits gets
 911          * translated to 1.5 stop bits */
 912         if (new->c_cflag & CSTOPB)
 913                 stop_bits = RFCOMM_RPN_STOP_15;
 914         else
 915                 stop_bits = RFCOMM_RPN_STOP_1;
 916
 917         /* Handle number of data bits [5-8] */
 918         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 919                 changes |= RFCOMM_RPN_PM_DATA;
 920
 921         switch (new->c_cflag & CSIZE) {
 922         case CS5:
 923                 data_bits = RFCOMM_RPN_DATA_5;
 924                 break;
 925         case CS6:
 926                 data_bits = RFCOMM_RPN_DATA_6;
 927                 break;
 928         case CS7:
 929                 data_bits = RFCOMM_RPN_DATA_7;
 930                 break;
 931         case CS8:
 932                 data_bits = RFCOMM_RPN_DATA_8;
 933                 break;
 934         default:
 935                 data_bits = RFCOMM_RPN_DATA_8;
 936                 break;
 937         }
 938
 939         /* Handle baudrate settings */
 940         if (old_baud_rate != new_baud_rate)
 941                 changes |= RFCOMM_RPN_PM_BITRATE;
 942
 943         switch (new_baud_rate) {
 944         case 2400:
 945                 baud = RFCOMM_RPN_BR_2400;
 946                 break;
 947         case 4800:
 948                 baud = RFCOMM_RPN_BR_4800;
 949                 break;
 950         case 7200:
 951                 baud = RFCOMM_RPN_BR_7200;
 952                 break;
 953         case 9600:
 954                 baud = RFCOMM_RPN_BR_9600;
 955                 break;
 956         case 19200:
 957                 baud = RFCOMM_RPN_BR_19200;
 958                 break;
 959         case 38400:
 960                 baud = RFCOMM_RPN_BR_38400;
 961                 break;
 962         case 57600:
 963                 baud = RFCOMM_RPN_BR_57600;
 964                 break;
 965         case 115200:
 966                 baud = RFCOMM_RPN_BR_115200;
 967                 break;
 968         case 230400:
 969                 baud = RFCOMM_RPN_BR_230400;
 970                 break;
 971         default:
 972                 /* 9600 is standard accordinag to the RFCOMM specification */
 973                 baud = RFCOMM_RPN_BR_9600;
 974                 break;
 975
 976         }
 977
 978         if (changes)
 979                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 980                                 data_bits, stop_bits, parity,
 981                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 982 }
 983
 984 static void rfcomm_tty_throttle(struct tty_struct *tty)
 985 {
 986         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 987
 988         BT_DBG("tty %p dev %p", tty, dev);
 989
 990         rfcomm_dlc_throttle(dev->dlc);
 991 }
 992
 993 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 994 {
 995         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 996
 997         BT_DBG("tty %p dev %p", tty, dev);
 998
 999         rfcomm_dlc_unthrottle(dev->dlc);
1000 }
1001
1002 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1003 {
1004         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1005
1006         BT_DBG("tty %p dev %p", tty, dev);
1007
1008         if (!dev || !dev->dlc)
1009                 return 0;
1010
1011         if (!skb_queue_empty(&dev->dlc->tx_queue))
1012                 return dev->dlc->mtu;
1013
1014         return 0;
1015 }
1016
1017 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1018 {
1019         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1020
1021         BT_DBG("tty %p dev %p", tty, dev);
1022
1023         if (!dev || !dev->dlc)
1024                 return;
1025
1026         skb_queue_purge(&dev->dlc->tx_queue);
1027         tty_wakeup(tty);
1028 }
1029
1030 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1031 {
1032         BT_DBG("tty %p ch %c", tty, ch);
1033 }
1034
1035 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1036 {
1037         BT_DBG("tty %p timeout %d", tty, timeout);
1038 }
1039
1040 static void rfcomm_tty_hangup(struct tty_struct *tty)
1041 {
1042         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1043
1044         BT_DBG("tty %p dev %p", tty, dev);
1045
1046         tty_port_hangup(&dev->port);
1047 }
1048
1049 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1050 {
1051         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1052
1053         BT_DBG("tty %p dev %p", tty, dev);
1054
1055         return dev->modem_status;
1056 }
1057
1058 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1059 {
1060         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1061         struct rfcomm_dlc *dlc = dev->dlc;
1062         u8 v24_sig;
1063
1064         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1065
1066         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1067
1068         if (set & TIOCM_DSR || set & TIOCM_DTR)
1069                 v24_sig |= RFCOMM_V24_RTC;
1070         if (set & TIOCM_RTS || set & TIOCM_CTS)
1071                 v24_sig |= RFCOMM_V24_RTR;
1072         if (set & TIOCM_RI)
1073                 v24_sig |= RFCOMM_V24_IC;
1074         if (set & TIOCM_CD)
1075                 v24_sig |= RFCOMM_V24_DV;
1076
1077         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1078                 v24_sig &= ~RFCOMM_V24_RTC;
1079         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1080                 v24_sig &= ~RFCOMM_V24_RTR;
1081         if (clear & TIOCM_RI)
1082                 v24_sig &= ~RFCOMM_V24_IC;
1083         if (clear & TIOCM_CD)
1084                 v24_sig &= ~RFCOMM_V24_DV;
1085
1086         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1087
1088         return 0;
1089 }
1090
1091 /* ---- TTY structure ---- */
1092
1093 static const struct tty_operations rfcomm_ops = {
1094         .open                   = rfcomm_tty_open,
1095         .close                  = rfcomm_tty_close,
1096         .write                  = rfcomm_tty_write,
1097         .write_room             = rfcomm_tty_write_room,
1098         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1099         .flush_buffer           = rfcomm_tty_flush_buffer,
1100         .ioctl                  = rfcomm_tty_ioctl,
1101         .throttle               = rfcomm_tty_throttle,
1102         .unthrottle             = rfcomm_tty_unthrottle,
1103         .set_termios            = rfcomm_tty_set_termios,
1104         .send_xchar             = rfcomm_tty_send_xchar,
1105         .hangup                 = rfcomm_tty_hangup,
1106         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1107         .tiocmget               = rfcomm_tty_tiocmget,
1108         .tiocmset               = rfcomm_tty_tiocmset,
1109         .install                = rfcomm_tty_install,
1110         .cleanup                = rfcomm_tty_cleanup,
1111 };
1112
1113 int __init rfcomm_init_ttys(void)
1114 {
1115         int error;
1116
1117         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1118         if (!rfcomm_tty_driver)
1119                 return -ENOMEM;
1120
1121         rfcomm_tty_driver->driver_name  = "rfcomm";
1122         rfcomm_tty_driver->name         = "rfcomm";
1123         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1124         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1125         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1126         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1127         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1128         rfcomm_tty_driver->init_termios = tty_std_termios;
1129         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
1130         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1131         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1132
1133         error = tty_register_driver(rfcomm_tty_driver);
1134         if (error) {
1135                 BT_ERR("Can't register RFCOMM TTY driver");
1136                 put_tty_driver(rfcomm_tty_driver);
1137                 return error;
1138         }
1139
1140         BT_INFO("RFCOMM TTY layer initialized");
1141
1142         return 0;
1143 }
1144
1145 void rfcomm_cleanup_ttys(void)
1146 {
1147         tty_unregister_driver(rfcomm_tty_driver);
1148         put_tty_driver(rfcomm_tty_driver);
1149 }