net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  40 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  41 #define RFCOMM_TTY_MINOR 0
  42
  43 static struct tty_driver *rfcomm_tty_driver;
  44
  45 struct rfcomm_dev {
  46         struct tty_port         port;
  47         struct list_head        list;
  48
  49         char                    name[12];
  50         int                     id;
  51         unsigned long           flags;
  52         int                     err;
  53
  54         bdaddr_t                src;
  55         bdaddr_t                dst;
  56         u8                      channel;
  57
  58         uint                    modem_status;
  59
  60         struct rfcomm_dlc       *dlc;
  61         wait_queue_head_t       wait;
  62
  63         struct device           *tty_dev;
  64
  65         atomic_t                wmem_alloc;
  66
  67         struct sk_buff_head     pending;
  68 };
  69
  70 static LIST_HEAD(rfcomm_dev_list);
  71 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  72
  73 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  74 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  75 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  76
  77 /* ---- Device functions ---- */
  78
  79 /*
  80  * The reason this isn't actually a race, as you no doubt have a little voice
  81  * screaming at you in your head, is that the refcount should never actually
  82  * reach zero unless the device has already been taken off the list, in
  83  * rfcomm_dev_del(). And if that's not true, we'll hit the BUG() in
  84  * rfcomm_dev_destruct() anyway.
  85  */
  86 static void rfcomm_dev_destruct(struct tty_port *port)
  87 {
  88         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  89         struct rfcomm_dlc *dlc = dev->dlc;
  90
  91         BT_DBG("dev %p dlc %p", dev, dlc);
  92
  93         /* Refcount should only hit zero when called from rfcomm_dev_del()
  94            which will have taken us off the list. Everything else are
  95            refcounting bugs. */
  96         BUG_ON(!list_empty(&dev->list));
  97
  98         rfcomm_dlc_lock(dlc);
  99         /* Detach DLC if it's owned by this dev */
 100         if (dlc->owner == dev)
 101                 dlc->owner = NULL;
 102         rfcomm_dlc_unlock(dlc);
 103
 104         rfcomm_dlc_put(dlc);
 105
 106         tty_unregister_device(rfcomm_tty_driver, dev->id);
 107
 108         kfree(dev);
 109
 110         /* It's safe to call module_put() here because socket still
 111            holds reference to this module. */
 112         module_put(THIS_MODULE);
 113 }
 114
 115 static const struct tty_port_operations rfcomm_port_ops = {
 116         .destruct = rfcomm_dev_destruct,
 117 };
 118
 119 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 120 {
 121         struct rfcomm_dev *dev;
 122
 123         list_for_each_entry(dev, &rfcomm_dev_list, list)
 124                 if (dev->id == id)
 125                         return dev;
 126
 127         return NULL;
 128 }
 129
 130 static struct rfcomm_dev *rfcomm_dev_get(int id)
 131 {
 132         struct rfcomm_dev *dev;
 133
 134         spin_lock(&rfcomm_dev_lock);
 135
 136         dev = __rfcomm_dev_get(id);
 137
 138         if (dev) {
 139                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 140                         dev = NULL;
 141                 else
 142                         tty_port_get(&dev->port);
 143         }
 144
 145         spin_unlock(&rfcomm_dev_lock);
 146
 147         return dev;
 148 }
 149
 150 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 151 {
 152         struct hci_dev *hdev;
 153         struct hci_conn *conn;
 154
 155         hdev = hci_get_route(&dev->dst, &dev->src);
 156         if (!hdev)
 157                 return NULL;
 158
 159         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 160
 161         hci_dev_put(hdev);
 162
 163         return conn ? &conn->dev : NULL;
 164 }
 165
 166 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 167 {
 168         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 169         return sprintf(buf, "%pMR\n", &dev->dst);
 170 }
 171
 172 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 173 {
 174         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 175         return sprintf(buf, "%d\n", dev->channel);
 176 }
 177
 178 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 179 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 180
 181 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 182 {
 183         struct rfcomm_dev *dev, *entry;
 184         struct list_head *head = &rfcomm_dev_list;
 185         int err = 0;
 186
 187         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 188
 189         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 190         if (!dev)
 191                 return -ENOMEM;
 192
 193         spin_lock(&rfcomm_dev_lock);
 194
 195         if (req->dev_id < 0) {
 196                 dev->id = 0;
 197
 198                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 199                         if (entry->id != dev->id)
 200                                 break;
 201
 202                         dev->id++;
 203                         head = &entry->list;
 204                 }
 205         } else {
 206                 dev->id = req->dev_id;
 207
 208                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 209                         if (entry->id == dev->id) {
 210                                 err = -EADDRINUSE;
 211                                 goto out;
 212                         }
 213
 214                         if (entry->id > dev->id - 1)
 215                                 break;
 216
 217                         head = &entry->list;
 218                 }
 219         }
 220
 221         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 222                 err = -ENFILE;
 223                 goto out;
 224         }
 225
 226         sprintf(dev->name, "rfcomm%d", dev->id);
 227
 228         list_add(&dev->list, head);
 229
 230         bacpy(&dev->src, &req->src);
 231         bacpy(&dev->dst, &req->dst);
 232         dev->channel = req->channel;
 233
 234         dev->flags = req->flags &
 235                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 236
 237         tty_port_init(&dev->port);
 238         dev->port.ops = &rfcomm_port_ops;
 239         init_waitqueue_head(&dev->wait);
 240
 241         skb_queue_head_init(&dev->pending);
 242
 243         rfcomm_dlc_lock(dlc);
 244
 245         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 246                 struct sock *sk = dlc->owner;
 247                 struct sk_buff *skb;
 248
 249                 BUG_ON(!sk);
 250
 251                 rfcomm_dlc_throttle(dlc);
 252
 253                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 254                         skb_orphan(skb);
 255                         skb_queue_tail(&dev->pending, skb);
 256                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 257                 }
 258         }
 259
 260         dlc->data_ready   = rfcomm_dev_data_ready;
 261         dlc->state_change = rfcomm_dev_state_change;
 262         dlc->modem_status = rfcomm_dev_modem_status;
 263
 264         dlc->owner = dev;
 265         dev->dlc   = dlc;
 266
 267         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 268
 269         rfcomm_dlc_unlock(dlc);
 270
 271         /* It's safe to call __module_get() here because socket already
 272            holds reference to this module. */
 273         __module_get(THIS_MODULE);
 274
 275 out:
 276         spin_unlock(&rfcomm_dev_lock);
 277
 278         if (err < 0)
 279                 goto free;
 280
 281         dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
 282                         dev->id, NULL);
 283         if (IS_ERR(dev->tty_dev)) {
 284                 err = PTR_ERR(dev->tty_dev);
 285                 list_del(&dev->list);
 286                 goto free;
 287         }
 288
 289         dev_set_drvdata(dev->tty_dev, dev);
 290
 291         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 292                 BT_ERR("Failed to create address attribute");
 293
 294         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 295                 BT_ERR("Failed to create channel attribute");
 296
 297         return dev->id;
 298
 299 free:
 300         kfree(dev);
 301         return err;
 302 }
 303
 304 static void rfcomm_dev_del(struct rfcomm_dev *dev)
 305 {
 306         unsigned long flags;
 307         BT_DBG("dev %p", dev);
 308
 309         BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
 310
 311         spin_lock_irqsave(&dev->port.lock, flags);
 312         if (dev->port.count > 0) {
 313                 spin_unlock_irqrestore(&dev->port.lock, flags);
 314                 return;
 315         }
 316         spin_unlock_irqrestore(&dev->port.lock, flags);
 317
 318         spin_lock(&rfcomm_dev_lock);
 319         list_del_init(&dev->list);
 320         spin_unlock(&rfcomm_dev_lock);
 321
 322         tty_port_put(&dev->port);
 323 }
 324
 325 /* ---- Send buffer ---- */
 326 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 327 {
 328         /* We can't let it be zero, because we don't get a callback
 329            when tx_credits becomes nonzero, hence we'd never wake up */
 330         return dlc->mtu * (dlc->tx_credits?:1);
 331 }
 332
 333 static void rfcomm_wfree(struct sk_buff *skb)
 334 {
 335         struct rfcomm_dev *dev = (void *) skb->sk;
 336         struct tty_struct *tty = dev->port.tty;
 337         atomic_sub(skb->truesize, &dev->wmem_alloc);
 338         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags) && tty)
 339                 tty_wakeup(tty);
 340         tty_port_put(&dev->port);
 341 }
 342
 343 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 344 {
 345         tty_port_get(&dev->port);
 346         atomic_add(skb->truesize, &dev->wmem_alloc);
 347         skb->sk = (void *) dev;
 348         skb->destructor = rfcomm_wfree;
 349 }
 350
 351 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 352 {
 353         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 354                 struct sk_buff *skb = alloc_skb(size, priority);
 355                 if (skb) {
 356                         rfcomm_set_owner_w(skb, dev);
 357                         return skb;
 358                 }
 359         }
 360         return NULL;
 361 }
 362
 363 /* ---- Device IOCTLs ---- */
 364
 365 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 366
 367 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 368 {
 369         struct rfcomm_dev_req req;
 370         struct rfcomm_dlc *dlc;
 371         int id;
 372
 373         if (copy_from_user(&req, arg, sizeof(req)))
 374                 return -EFAULT;
 375
 376         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 377
 378         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 379                 return -EPERM;
 380
 381         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 382                 /* Socket must be connected */
 383                 if (sk->sk_state != BT_CONNECTED)
 384                         return -EBADFD;
 385
 386                 dlc = rfcomm_pi(sk)->dlc;
 387                 rfcomm_dlc_hold(dlc);
 388         } else {
 389                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 390                 if (!dlc)
 391                         return -ENOMEM;
 392         }
 393
 394         id = rfcomm_dev_add(&req, dlc);
 395         if (id < 0) {
 396                 rfcomm_dlc_put(dlc);
 397                 return id;
 398         }
 399
 400         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 401                 /* DLC is now used by device.
 402                  * Socket must be disconnected */
 403                 sk->sk_state = BT_CLOSED;
 404         }
 405
 406         return id;
 407 }
 408
 409 static int rfcomm_release_dev(void __user *arg)
 410 {
 411         struct rfcomm_dev_req req;
 412         struct rfcomm_dev *dev;
 413
 414         if (copy_from_user(&req, arg, sizeof(req)))
 415                 return -EFAULT;
 416
 417         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 418
 419         dev = rfcomm_dev_get(req.dev_id);
 420         if (!dev)
 421                 return -ENODEV;
 422
 423         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 424                 tty_port_put(&dev->port);
 425                 return -EPERM;
 426         }
 427
 428         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 429                 rfcomm_dlc_close(dev->dlc, 0);
 430
 431         /* Shut down TTY synchronously before freeing rfcomm_dev */
 432         if (dev->port.tty)
 433                 tty_vhangup(dev->port.tty);
 434
 435         if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
 436                 rfcomm_dev_del(dev);
 437         tty_port_put(&dev->port);
 438         return 0;
 439 }
 440
 441 static int rfcomm_get_dev_list(void __user *arg)
 442 {
 443         struct rfcomm_dev *dev;
 444         struct rfcomm_dev_list_req *dl;
 445         struct rfcomm_dev_info *di;
 446         int n = 0, size, err;
 447         u16 dev_num;
 448
 449         BT_DBG("");
 450
 451         if (get_user(dev_num, (u16 __user *) arg))
 452                 return -EFAULT;
 453
 454         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 455                 return -EINVAL;
 456
 457         size = sizeof(*dl) + dev_num * sizeof(*di);
 458
 459         dl = kzalloc(size, GFP_KERNEL);
 460         if (!dl)
 461                 return -ENOMEM;
 462
 463         di = dl->dev_info;
 464
 465         spin_lock(&rfcomm_dev_lock);
 466
 467         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 468                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 469                         continue;
 470                 (di + n)->id      = dev->id;
 471                 (di + n)->flags   = dev->flags;
 472                 (di + n)->state   = dev->dlc->state;
 473                 (di + n)->channel = dev->channel;
 474                 bacpy(&(di + n)->src, &dev->src);
 475                 bacpy(&(di + n)->dst, &dev->dst);
 476                 if (++n >= dev_num)
 477                         break;
 478         }
 479
 480         spin_unlock(&rfcomm_dev_lock);
 481
 482         dl->dev_num = n;
 483         size = sizeof(*dl) + n * sizeof(*di);
 484
 485         err = copy_to_user(arg, dl, size);
 486         kfree(dl);
 487
 488         return err ? -EFAULT : 0;
 489 }
 490
 491 static int rfcomm_get_dev_info(void __user *arg)
 492 {
 493         struct rfcomm_dev *dev;
 494         struct rfcomm_dev_info di;
 495         int err = 0;
 496
 497         BT_DBG("");
 498
 499         if (copy_from_user(&di, arg, sizeof(di)))
 500                 return -EFAULT;
 501
 502         dev = rfcomm_dev_get(di.id);
 503         if (!dev)
 504                 return -ENODEV;
 505
 506         di.flags   = dev->flags;
 507         di.channel = dev->channel;
 508         di.state   = dev->dlc->state;
 509         bacpy(&di.src, &dev->src);
 510         bacpy(&di.dst, &dev->dst);
 511
 512         if (copy_to_user(arg, &di, sizeof(di)))
 513                 err = -EFAULT;
 514
 515         tty_port_put(&dev->port);
 516         return err;
 517 }
 518
 519 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 520 {
 521         BT_DBG("cmd %d arg %p", cmd, arg);
 522
 523         switch (cmd) {
 524         case RFCOMMCREATEDEV:
 525                 return rfcomm_create_dev(sk, arg);
 526
 527         case RFCOMMRELEASEDEV:
 528                 return rfcomm_release_dev(arg);
 529
 530         case RFCOMMGETDEVLIST:
 531                 return rfcomm_get_dev_list(arg);
 532
 533         case RFCOMMGETDEVINFO:
 534                 return rfcomm_get_dev_info(arg);
 535         }
 536
 537         return -EINVAL;
 538 }
 539
 540 /* ---- DLC callbacks ---- */
 541 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 542 {
 543         struct rfcomm_dev *dev = dlc->owner;
 544
 545         if (!dev) {
 546                 kfree_skb(skb);
 547                 return;
 548         }
 549
 550         if (!skb_queue_empty(&dev->pending)) {
 551                 skb_queue_tail(&dev->pending, skb);
 552                 return;
 553         }
 554
 555         BT_DBG("dlc %p len %d", dlc, skb->len);
 556
 557         tty_insert_flip_string(&dev->port, skb->data, skb->len);
 558         tty_flip_buffer_push(&dev->port);
 559
 560         kfree_skb(skb);
 561 }
 562
 563 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 564 {
 565         struct rfcomm_dev *dev = dlc->owner;
 566         if (!dev)
 567                 return;
 568
 569         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 570
 571         dev->err = err;
 572         wake_up_interruptible(&dev->wait);
 573
 574         if (dlc->state == BT_CLOSED) {
 575                 if (!dev->port.tty) {
 576                         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 577                                 /* Drop DLC lock here to avoid deadlock
 578                                  * 1. rfcomm_dev_get will take rfcomm_dev_lock
 579                                  *    but in rfcomm_dev_add there's lock order:
 580                                  *    rfcomm_dev_lock -> dlc lock
 581                                  * 2. tty_port_put will deadlock if it's
 582                                  *    the last reference
 583                                  */
 584                                 rfcomm_dlc_unlock(dlc);
 585                                 if (rfcomm_dev_get(dev->id) == NULL) {
 586                                         rfcomm_dlc_lock(dlc);
 587                                         return;
 588                                 }
 589
 590                                 rfcomm_dev_del(dev);
 591                                 tty_port_put(&dev->port);
 592                                 rfcomm_dlc_lock(dlc);
 593                         }
 594                 } else
 595                         tty_hangup(dev->port.tty);
 596         }
 597 }
 598
 599 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 600 {
 601         struct rfcomm_dev *dev = dlc->owner;
 602         if (!dev)
 603                 return;
 604
 605         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 606
 607         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
 608                 if (dev->port.tty && !C_CLOCAL(dev->port.tty))
 609                         tty_hangup(dev->port.tty);
 610         }
 611
 612         dev->modem_status =
 613                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 614                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 615                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 616                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 617 }
 618
 619 /* ---- TTY functions ---- */
 620 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 621 {
 622         struct sk_buff *skb;
 623         int inserted = 0;
 624
 625         BT_DBG("dev %p", dev);
 626
 627         rfcomm_dlc_lock(dev->dlc);
 628
 629         while ((skb = skb_dequeue(&dev->pending))) {
 630                 inserted += tty_insert_flip_string(&dev->port, skb->data,
 631                                 skb->len);
 632                 kfree_skb(skb);
 633         }
 634
 635         rfcomm_dlc_unlock(dev->dlc);
 636
 637         if (inserted > 0)
 638                 tty_flip_buffer_push(&dev->port);
 639 }
 640
 641 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 642 {
 643         DECLARE_WAITQUEUE(wait, current);
 644         struct rfcomm_dev *dev;
 645         struct rfcomm_dlc *dlc;
 646         unsigned long flags;
 647         int err, id;
 648
 649         id = tty->index;
 650
 651         BT_DBG("tty %p id %d", tty, id);
 652
 653         /* We don't leak this refcount. For reasons which are not entirely
 654            clear, the TTY layer will call our ->close() method even if the
 655            open fails. We decrease the refcount there, and decreasing it
 656            here too would cause breakage. */
 657         dev = rfcomm_dev_get(id);
 658         if (!dev)
 659                 return -ENODEV;
 660
 661         BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
 662                dev->channel, dev->port.count);
 663
 664         spin_lock_irqsave(&dev->port.lock, flags);
 665         if (++dev->port.count > 1) {
 666                 spin_unlock_irqrestore(&dev->port.lock, flags);
 667                 return 0;
 668         }
 669         spin_unlock_irqrestore(&dev->port.lock, flags);
 670
 671         dlc = dev->dlc;
 672
 673         /* Attach TTY and open DLC */
 674
 675         rfcomm_dlc_lock(dlc);
 676         tty->driver_data = dev;
 677         dev->port.tty = tty;
 678         rfcomm_dlc_unlock(dlc);
 679         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 680
 681         err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
 682         if (err < 0)
 683                 return err;
 684
 685         /* Wait for DLC to connect */
 686         add_wait_queue(&dev->wait, &wait);
 687         while (1) {
 688                 set_current_state(TASK_INTERRUPTIBLE);
 689
 690                 if (dlc->state == BT_CLOSED) {
 691                         err = -dev->err;
 692                         break;
 693                 }
 694
 695                 if (dlc->state == BT_CONNECTED)
 696                         break;
 697
 698                 if (signal_pending(current)) {
 699                         err = -EINTR;
 700                         break;
 701                 }
 702
 703                 tty_unlock(tty);
 704                 schedule();
 705                 tty_lock(tty);
 706         }
 707         set_current_state(TASK_RUNNING);
 708         remove_wait_queue(&dev->wait, &wait);
 709
 710         if (err == 0)
 711                 device_move(dev->tty_dev, rfcomm_get_device(dev),
 712                             DPM_ORDER_DEV_AFTER_PARENT);
 713
 714         rfcomm_tty_copy_pending(dev);
 715
 716         rfcomm_dlc_unthrottle(dev->dlc);
 717
 718         return err;
 719 }
 720
 721 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 722 {
 723         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 724         unsigned long flags;
 725
 726         if (!dev)
 727                 return;
 728
 729         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 730                                                 dev->port.count);
 731
 732         spin_lock_irqsave(&dev->port.lock, flags);
 733         if (!--dev->port.count) {
 734                 spin_unlock_irqrestore(&dev->port.lock, flags);
 735                 if (dev->tty_dev->parent)
 736                         device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 737
 738                 /* Close DLC and dettach TTY */
 739                 rfcomm_dlc_close(dev->dlc, 0);
 740
 741                 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 742
 743                 rfcomm_dlc_lock(dev->dlc);
 744                 tty->driver_data = NULL;
 745                 dev->port.tty = NULL;
 746                 rfcomm_dlc_unlock(dev->dlc);
 747
 748                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) {
 749                         spin_lock(&rfcomm_dev_lock);
 750                         list_del_init(&dev->list);
 751                         spin_unlock(&rfcomm_dev_lock);
 752
 753                         tty_port_put(&dev->port);
 754                 }
 755         } else
 756                 spin_unlock_irqrestore(&dev->port.lock, flags);
 757
 758         tty_port_put(&dev->port);
 759 }
 760
 761 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 762 {
 763         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 764         struct rfcomm_dlc *dlc = dev->dlc;
 765         struct sk_buff *skb;
 766         int err = 0, sent = 0, size;
 767
 768         BT_DBG("tty %p count %d", tty, count);
 769
 770         while (count) {
 771                 size = min_t(uint, count, dlc->mtu);
 772
 773                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 774
 775                 if (!skb)
 776                         break;
 777
 778                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 779
 780                 memcpy(skb_put(skb, size), buf + sent, size);
 781
 782                 err = rfcomm_dlc_send(dlc, skb);
 783                 if (err < 0) {
 784                         kfree_skb(skb);
 785                         break;
 786                 }
 787
 788                 sent  += size;
 789                 count -= size;
 790         }
 791
 792         return sent ? sent : err;
 793 }
 794
 795 static int rfcomm_tty_write_room(struct tty_struct *tty)
 796 {
 797         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 798         int room;
 799
 800         BT_DBG("tty %p", tty);
 801
 802         if (!dev || !dev->dlc)
 803                 return 0;
 804
 805         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 806         if (room < 0)
 807                 room = 0;
 808
 809         return room;
 810 }
 811
 812 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 813 {
 814         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 815
 816         switch (cmd) {
 817         case TCGETS:
 818                 BT_DBG("TCGETS is not supported");
 819                 return -ENOIOCTLCMD;
 820
 821         case TCSETS:
 822                 BT_DBG("TCSETS is not supported");
 823                 return -ENOIOCTLCMD;
 824
 825         case TIOCMIWAIT:
 826                 BT_DBG("TIOCMIWAIT");
 827                 break;
 828
 829         case TIOCGSERIAL:
 830                 BT_ERR("TIOCGSERIAL is not supported");
 831                 return -ENOIOCTLCMD;
 832
 833         case TIOCSSERIAL:
 834                 BT_ERR("TIOCSSERIAL is not supported");
 835                 return -ENOIOCTLCMD;
 836
 837         case TIOCSERGSTRUCT:
 838                 BT_ERR("TIOCSERGSTRUCT is not supported");
 839                 return -ENOIOCTLCMD;
 840
 841         case TIOCSERGETLSR:
 842                 BT_ERR("TIOCSERGETLSR is not supported");
 843                 return -ENOIOCTLCMD;
 844
 845         case TIOCSERCONFIG:
 846                 BT_ERR("TIOCSERCONFIG is not supported");
 847                 return -ENOIOCTLCMD;
 848
 849         default:
 850                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 851
 852         }
 853
 854         return -ENOIOCTLCMD;
 855 }
 856
 857 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 858 {
 859         struct ktermios *new = &tty->termios;
 860         int old_baud_rate = tty_termios_baud_rate(old);
 861         int new_baud_rate = tty_termios_baud_rate(new);
 862
 863         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 864         u16 changes = 0;
 865
 866         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 867
 868         BT_DBG("tty %p termios %p", tty, old);
 869
 870         if (!dev || !dev->dlc || !dev->dlc->session)
 871                 return;
 872
 873         /* Handle turning off CRTSCTS */
 874         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 875                 BT_DBG("Turning off CRTSCTS unsupported");
 876
 877         /* Parity on/off and when on, odd/even */
 878         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 879                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 880                 changes |= RFCOMM_RPN_PM_PARITY;
 881                 BT_DBG("Parity change detected.");
 882         }
 883
 884         /* Mark and space parity are not supported! */
 885         if (new->c_cflag & PARENB) {
 886                 if (new->c_cflag & PARODD) {
 887                         BT_DBG("Parity is ODD");
 888                         parity = RFCOMM_RPN_PARITY_ODD;
 889                 } else {
 890                         BT_DBG("Parity is EVEN");
 891                         parity = RFCOMM_RPN_PARITY_EVEN;
 892                 }
 893         } else {
 894                 BT_DBG("Parity is OFF");
 895                 parity = RFCOMM_RPN_PARITY_NONE;
 896         }
 897
 898         /* Setting the x_on / x_off characters */
 899         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 900                 BT_DBG("XOFF custom");
 901                 x_on = new->c_cc[VSTOP];
 902                 changes |= RFCOMM_RPN_PM_XON;
 903         } else {
 904                 BT_DBG("XOFF default");
 905                 x_on = RFCOMM_RPN_XON_CHAR;
 906         }
 907
 908         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 909                 BT_DBG("XON custom");
 910                 x_off = new->c_cc[VSTART];
 911                 changes |= RFCOMM_RPN_PM_XOFF;
 912         } else {
 913                 BT_DBG("XON default");
 914                 x_off = RFCOMM_RPN_XOFF_CHAR;
 915         }
 916
 917         /* Handle setting of stop bits */
 918         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 919                 changes |= RFCOMM_RPN_PM_STOP;
 920
 921         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 922          * support 2 stop bits. So a request for 2 stop bits gets
 923          * translated to 1.5 stop bits */
 924         if (new->c_cflag & CSTOPB)
 925                 stop_bits = RFCOMM_RPN_STOP_15;
 926         else
 927                 stop_bits = RFCOMM_RPN_STOP_1;
 928
 929         /* Handle number of data bits [5-8] */
 930         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 931                 changes |= RFCOMM_RPN_PM_DATA;
 932
 933         switch (new->c_cflag & CSIZE) {
 934         case CS5:
 935                 data_bits = RFCOMM_RPN_DATA_5;
 936                 break;
 937         case CS6:
 938                 data_bits = RFCOMM_RPN_DATA_6;
 939                 break;
 940         case CS7:
 941                 data_bits = RFCOMM_RPN_DATA_7;
 942                 break;
 943         case CS8:
 944                 data_bits = RFCOMM_RPN_DATA_8;
 945                 break;
 946         default:
 947                 data_bits = RFCOMM_RPN_DATA_8;
 948                 break;
 949         }
 950
 951         /* Handle baudrate settings */
 952         if (old_baud_rate != new_baud_rate)
 953                 changes |= RFCOMM_RPN_PM_BITRATE;
 954
 955         switch (new_baud_rate) {
 956         case 2400:
 957                 baud = RFCOMM_RPN_BR_2400;
 958                 break;
 959         case 4800:
 960                 baud = RFCOMM_RPN_BR_4800;
 961                 break;
 962         case 7200:
 963                 baud = RFCOMM_RPN_BR_7200;
 964                 break;
 965         case 9600:
 966                 baud = RFCOMM_RPN_BR_9600;
 967                 break;
 968         case 19200:
 969                 baud = RFCOMM_RPN_BR_19200;
 970                 break;
 971         case 38400:
 972                 baud = RFCOMM_RPN_BR_38400;
 973                 break;
 974         case 57600:
 975                 baud = RFCOMM_RPN_BR_57600;
 976                 break;
 977         case 115200:
 978                 baud = RFCOMM_RPN_BR_115200;
 979                 break;
 980         case 230400:
 981                 baud = RFCOMM_RPN_BR_230400;
 982                 break;
 983         default:
 984                 /* 9600 is standard accordinag to the RFCOMM specification */
 985                 baud = RFCOMM_RPN_BR_9600;
 986                 break;
 987
 988         }
 989
 990         if (changes)
 991                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 992                                 data_bits, stop_bits, parity,
 993                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 994 }
 995
 996 static void rfcomm_tty_throttle(struct tty_struct *tty)
 997 {
 998         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 999
1000         BT_DBG("tty %p dev %p", tty, dev);
1001
1002         rfcomm_dlc_throttle(dev->dlc);
1003 }
1004
1005 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
1006 {
1007         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1008
1009         BT_DBG("tty %p dev %p", tty, dev);
1010
1011         rfcomm_dlc_unthrottle(dev->dlc);
1012 }
1013
1014 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1015 {
1016         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1017
1018         BT_DBG("tty %p dev %p", tty, dev);
1019
1020         if (!dev || !dev->dlc)
1021                 return 0;
1022
1023         if (!skb_queue_empty(&dev->dlc->tx_queue))
1024                 return dev->dlc->mtu;
1025
1026         return 0;
1027 }
1028
1029 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1030 {
1031         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1032
1033         BT_DBG("tty %p dev %p", tty, dev);
1034
1035         if (!dev || !dev->dlc)
1036                 return;
1037
1038         skb_queue_purge(&dev->dlc->tx_queue);
1039         tty_wakeup(tty);
1040 }
1041
1042 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1043 {
1044         BT_DBG("tty %p ch %c", tty, ch);
1045 }
1046
1047 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1048 {
1049         BT_DBG("tty %p timeout %d", tty, timeout);
1050 }
1051
1052 static void rfcomm_tty_hangup(struct tty_struct *tty)
1053 {
1054         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1055
1056         BT_DBG("tty %p dev %p", tty, dev);
1057
1058         if (!dev)
1059                 return;
1060
1061         rfcomm_tty_flush_buffer(tty);
1062
1063         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
1064                 if (rfcomm_dev_get(dev->id) == NULL)
1065                         return;
1066                 rfcomm_dev_del(dev);
1067                 tty_port_put(&dev->port);
1068         }
1069 }
1070
1071 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1072 {
1073         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1074
1075         BT_DBG("tty %p dev %p", tty, dev);
1076
1077         return dev->modem_status;
1078 }
1079
1080 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1081 {
1082         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1083         struct rfcomm_dlc *dlc = dev->dlc;
1084         u8 v24_sig;
1085
1086         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1087
1088         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1089
1090         if (set & TIOCM_DSR || set & TIOCM_DTR)
1091                 v24_sig |= RFCOMM_V24_RTC;
1092         if (set & TIOCM_RTS || set & TIOCM_CTS)
1093                 v24_sig |= RFCOMM_V24_RTR;
1094         if (set & TIOCM_RI)
1095                 v24_sig |= RFCOMM_V24_IC;
1096         if (set & TIOCM_CD)
1097                 v24_sig |= RFCOMM_V24_DV;
1098
1099         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1100                 v24_sig &= ~RFCOMM_V24_RTC;
1101         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1102                 v24_sig &= ~RFCOMM_V24_RTR;
1103         if (clear & TIOCM_RI)
1104                 v24_sig &= ~RFCOMM_V24_IC;
1105         if (clear & TIOCM_CD)
1106                 v24_sig &= ~RFCOMM_V24_DV;
1107
1108         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1109
1110         return 0;
1111 }
1112
1113 /* ---- TTY structure ---- */
1114
1115 static const struct tty_operations rfcomm_ops = {
1116         .open                   = rfcomm_tty_open,
1117         .close                  = rfcomm_tty_close,
1118         .write                  = rfcomm_tty_write,
1119         .write_room             = rfcomm_tty_write_room,
1120         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1121         .flush_buffer           = rfcomm_tty_flush_buffer,
1122         .ioctl                  = rfcomm_tty_ioctl,
1123         .throttle               = rfcomm_tty_throttle,
1124         .unthrottle             = rfcomm_tty_unthrottle,
1125         .set_termios            = rfcomm_tty_set_termios,
1126         .send_xchar             = rfcomm_tty_send_xchar,
1127         .hangup                 = rfcomm_tty_hangup,
1128         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1129         .tiocmget               = rfcomm_tty_tiocmget,
1130         .tiocmset               = rfcomm_tty_tiocmset,
1131 };
1132
1133 int __init rfcomm_init_ttys(void)
1134 {
1135         int error;
1136
1137         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1138         if (!rfcomm_tty_driver)
1139                 return -ENOMEM;
1140
1141         rfcomm_tty_driver->driver_name  = "rfcomm";
1142         rfcomm_tty_driver->name         = "rfcomm";
1143         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1144         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1145         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1146         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1147         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1148         rfcomm_tty_driver->init_termios = tty_std_termios;
1149         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1150         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1151         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1152
1153         error = tty_register_driver(rfcomm_tty_driver);
1154         if (error) {
1155                 BT_ERR("Can't register RFCOMM TTY driver");
1156                 put_tty_driver(rfcomm_tty_driver);
1157                 return error;
1158         }
1159
1160         BT_INFO("RFCOMM TTY layer initialized");
1161
1162         return 0;
1163 }
1164
1165 void rfcomm_cleanup_ttys(void)
1166 {
1167         tty_unregister_driver(rfcomm_tty_driver);
1168         put_tty_driver(rfcomm_tty_driver);
1169 }