net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  40 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  41 #define RFCOMM_TTY_MINOR 0
  42
  43 static struct tty_driver *rfcomm_tty_driver;
  44
  45 struct rfcomm_dev {
  46         struct tty_port         port;
  47         struct list_head        list;
  48
  49         char                    name[12];
  50         int                     id;
  51         unsigned long           flags;
  52         int                     err;
  53
  54         bdaddr_t                src;
  55         bdaddr_t                dst;
  56         u8                      channel;
  57
  58         uint                    modem_status;
  59
  60         struct rfcomm_dlc       *dlc;
  61
  62         struct device           *tty_dev;
  63
  64         atomic_t                wmem_alloc;
  65
  66         struct sk_buff_head     pending;
  67 };
  68
  69 static LIST_HEAD(rfcomm_dev_list);
  70 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  71
  72 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  73 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  74 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  75
  76 /* ---- Device functions ---- */
  77
  78 static void rfcomm_dev_destruct(struct tty_port *port)
  79 {
  80         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  81         struct rfcomm_dlc *dlc = dev->dlc;
  82
  83         BT_DBG("dev %p dlc %p", dev, dlc);
  84
  85         spin_lock(&rfcomm_dev_lock);
  86         list_del(&dev->list);
  87         spin_unlock(&rfcomm_dev_lock);
  88
  89         rfcomm_dlc_lock(dlc);
  90         /* Detach DLC if it's owned by this dev */
  91         if (dlc->owner == dev)
  92                 dlc->owner = NULL;
  93         rfcomm_dlc_unlock(dlc);
  94
  95         rfcomm_dlc_put(dlc);
  96
  97         tty_unregister_device(rfcomm_tty_driver, dev->id);
  98
  99         kfree(dev);
 100
 101         /* It's safe to call module_put() here because socket still
 102            holds reference to this module. */
 103         module_put(THIS_MODULE);
 104 }
 105
 106 /* device-specific initialization: open the dlc */
 107 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
 108 {
 109         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 110
 111         return rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
 112 }
 113
 114 /* we block the open until the dlc->state becomes BT_CONNECTED */
 115 static int rfcomm_dev_carrier_raised(struct tty_port *port)
 116 {
 117         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 118
 119         return (dev->dlc->state == BT_CONNECTED);
 120 }
 121
 122 /* device-specific cleanup: close the dlc */
 123 static void rfcomm_dev_shutdown(struct tty_port *port)
 124 {
 125         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 126
 127         if (dev->tty_dev->parent)
 128                 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 129
 130         /* close the dlc */
 131         rfcomm_dlc_close(dev->dlc, 0);
 132 }
 133
 134 static const struct tty_port_operations rfcomm_port_ops = {
 135         .destruct = rfcomm_dev_destruct,
 136         .activate = rfcomm_dev_activate,
 137         .shutdown = rfcomm_dev_shutdown,
 138         .carrier_raised = rfcomm_dev_carrier_raised,
 139 };
 140
 141 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 142 {
 143         struct rfcomm_dev *dev;
 144
 145         list_for_each_entry(dev, &rfcomm_dev_list, list)
 146                 if (dev->id == id)
 147                         return dev;
 148
 149         return NULL;
 150 }
 151
 152 static struct rfcomm_dev *rfcomm_dev_get(int id)
 153 {
 154         struct rfcomm_dev *dev;
 155
 156         spin_lock(&rfcomm_dev_lock);
 157
 158         dev = __rfcomm_dev_get(id);
 159
 160         if (dev && !tty_port_get(&dev->port))
 161                 dev = NULL;
 162
 163         spin_unlock(&rfcomm_dev_lock);
 164
 165         return dev;
 166 }
 167
 168 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 169 {
 170         struct hci_dev *hdev;
 171         struct hci_conn *conn;
 172
 173         hdev = hci_get_route(&dev->dst, &dev->src);
 174         if (!hdev)
 175                 return NULL;
 176
 177         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 178
 179         hci_dev_put(hdev);
 180
 181         return conn ? &conn->dev : NULL;
 182 }
 183
 184 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 185 {
 186         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 187         return sprintf(buf, "%pMR\n", &dev->dst);
 188 }
 189
 190 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 191 {
 192         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 193         return sprintf(buf, "%d\n", dev->channel);
 194 }
 195
 196 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 197 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 198
 199 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 200 {
 201         struct rfcomm_dev *dev, *entry;
 202         struct list_head *head = &rfcomm_dev_list;
 203         int err = 0;
 204
 205         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 206
 207         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 208         if (!dev)
 209                 return -ENOMEM;
 210
 211         spin_lock(&rfcomm_dev_lock);
 212
 213         if (req->dev_id < 0) {
 214                 dev->id = 0;
 215
 216                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 217                         if (entry->id != dev->id)
 218                                 break;
 219
 220                         dev->id++;
 221                         head = &entry->list;
 222                 }
 223         } else {
 224                 dev->id = req->dev_id;
 225
 226                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 227                         if (entry->id == dev->id) {
 228                                 err = -EADDRINUSE;
 229                                 goto out;
 230                         }
 231
 232                         if (entry->id > dev->id - 1)
 233                                 break;
 234
 235                         head = &entry->list;
 236                 }
 237         }
 238
 239         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 240                 err = -ENFILE;
 241                 goto out;
 242         }
 243
 244         sprintf(dev->name, "rfcomm%d", dev->id);
 245
 246         list_add(&dev->list, head);
 247
 248         bacpy(&dev->src, &req->src);
 249         bacpy(&dev->dst, &req->dst);
 250         dev->channel = req->channel;
 251
 252         dev->flags = req->flags &
 253                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 254
 255         tty_port_init(&dev->port);
 256         dev->port.ops = &rfcomm_port_ops;
 257
 258         skb_queue_head_init(&dev->pending);
 259
 260         rfcomm_dlc_lock(dlc);
 261
 262         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 263                 struct sock *sk = dlc->owner;
 264                 struct sk_buff *skb;
 265
 266                 BUG_ON(!sk);
 267
 268                 rfcomm_dlc_throttle(dlc);
 269
 270                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 271                         skb_orphan(skb);
 272                         skb_queue_tail(&dev->pending, skb);
 273                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 274                 }
 275         }
 276
 277         dlc->data_ready   = rfcomm_dev_data_ready;
 278         dlc->state_change = rfcomm_dev_state_change;
 279         dlc->modem_status = rfcomm_dev_modem_status;
 280
 281         dlc->owner = dev;
 282         dev->dlc   = dlc;
 283
 284         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 285
 286         rfcomm_dlc_unlock(dlc);
 287
 288         /* It's safe to call __module_get() here because socket already
 289            holds reference to this module. */
 290         __module_get(THIS_MODULE);
 291
 292 out:
 293         spin_unlock(&rfcomm_dev_lock);
 294
 295         if (err < 0)
 296                 goto free;
 297
 298         dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
 299                         dev->id, NULL);
 300         if (IS_ERR(dev->tty_dev)) {
 301                 err = PTR_ERR(dev->tty_dev);
 302                 spin_lock(&rfcomm_dev_lock);
 303                 list_del(&dev->list);
 304                 spin_unlock(&rfcomm_dev_lock);
 305                 goto free;
 306         }
 307
 308         dev_set_drvdata(dev->tty_dev, dev);
 309
 310         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 311                 BT_ERR("Failed to create address attribute");
 312
 313         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 314                 BT_ERR("Failed to create channel attribute");
 315
 316         return dev->id;
 317
 318 free:
 319         kfree(dev);
 320         return err;
 321 }
 322
 323 /* ---- Send buffer ---- */
 324 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 325 {
 326         /* We can't let it be zero, because we don't get a callback
 327            when tx_credits becomes nonzero, hence we'd never wake up */
 328         return dlc->mtu * (dlc->tx_credits?:1);
 329 }
 330
 331 static void rfcomm_wfree(struct sk_buff *skb)
 332 {
 333         struct rfcomm_dev *dev = (void *) skb->sk;
 334         atomic_sub(skb->truesize, &dev->wmem_alloc);
 335         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 336                 tty_port_tty_wakeup(&dev->port);
 337         tty_port_put(&dev->port);
 338 }
 339
 340 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 341 {
 342         tty_port_get(&dev->port);
 343         atomic_add(skb->truesize, &dev->wmem_alloc);
 344         skb->sk = (void *) dev;
 345         skb->destructor = rfcomm_wfree;
 346 }
 347
 348 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 349 {
 350         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 351                 struct sk_buff *skb = alloc_skb(size, priority);
 352                 if (skb) {
 353                         rfcomm_set_owner_w(skb, dev);
 354                         return skb;
 355                 }
 356         }
 357         return NULL;
 358 }
 359
 360 /* ---- Device IOCTLs ---- */
 361
 362 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 363
 364 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 365 {
 366         struct rfcomm_dev_req req;
 367         struct rfcomm_dlc *dlc;
 368         int id;
 369
 370         if (copy_from_user(&req, arg, sizeof(req)))
 371                 return -EFAULT;
 372
 373         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 374
 375         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 376                 return -EPERM;
 377
 378         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 379                 /* Socket must be connected */
 380                 if (sk->sk_state != BT_CONNECTED)
 381                         return -EBADFD;
 382
 383                 dlc = rfcomm_pi(sk)->dlc;
 384                 rfcomm_dlc_hold(dlc);
 385         } else {
 386                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 387                 if (!dlc)
 388                         return -ENOMEM;
 389         }
 390
 391         id = rfcomm_dev_add(&req, dlc);
 392         if (id < 0) {
 393                 rfcomm_dlc_put(dlc);
 394                 return id;
 395         }
 396
 397         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 398                 /* DLC is now used by device.
 399                  * Socket must be disconnected */
 400                 sk->sk_state = BT_CLOSED;
 401         }
 402
 403         return id;
 404 }
 405
 406 static int rfcomm_release_dev(void __user *arg)
 407 {
 408         struct rfcomm_dev_req req;
 409         struct rfcomm_dev *dev;
 410         struct tty_struct *tty;
 411
 412         if (copy_from_user(&req, arg, sizeof(req)))
 413                 return -EFAULT;
 414
 415         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 416
 417         dev = rfcomm_dev_get(req.dev_id);
 418         if (!dev)
 419                 return -ENODEV;
 420
 421         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 422                 tty_port_put(&dev->port);
 423                 return -EPERM;
 424         }
 425
 426         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 427                 rfcomm_dlc_close(dev->dlc, 0);
 428
 429         /* Shut down TTY synchronously before freeing rfcomm_dev */
 430         tty = tty_port_tty_get(&dev->port);
 431         if (tty) {
 432                 tty_vhangup(tty);
 433                 tty_kref_put(tty);
 434         }
 435
 436         if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags) &&
 437             !test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 438                 tty_port_put(&dev->port);
 439
 440         tty_port_put(&dev->port);
 441         return 0;
 442 }
 443
 444 static int rfcomm_get_dev_list(void __user *arg)
 445 {
 446         struct rfcomm_dev *dev;
 447         struct rfcomm_dev_list_req *dl;
 448         struct rfcomm_dev_info *di;
 449         int n = 0, size, err;
 450         u16 dev_num;
 451
 452         BT_DBG("");
 453
 454         if (get_user(dev_num, (u16 __user *) arg))
 455                 return -EFAULT;
 456
 457         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 458                 return -EINVAL;
 459
 460         size = sizeof(*dl) + dev_num * sizeof(*di);
 461
 462         dl = kzalloc(size, GFP_KERNEL);
 463         if (!dl)
 464                 return -ENOMEM;
 465
 466         di = dl->dev_info;
 467
 468         spin_lock(&rfcomm_dev_lock);
 469
 470         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 471                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 472                         continue;
 473                 (di + n)->id      = dev->id;
 474                 (di + n)->flags   = dev->flags;
 475                 (di + n)->state   = dev->dlc->state;
 476                 (di + n)->channel = dev->channel;
 477                 bacpy(&(di + n)->src, &dev->src);
 478                 bacpy(&(di + n)->dst, &dev->dst);
 479                 if (++n >= dev_num)
 480                         break;
 481         }
 482
 483         spin_unlock(&rfcomm_dev_lock);
 484
 485         dl->dev_num = n;
 486         size = sizeof(*dl) + n * sizeof(*di);
 487
 488         err = copy_to_user(arg, dl, size);
 489         kfree(dl);
 490
 491         return err ? -EFAULT : 0;
 492 }
 493
 494 static int rfcomm_get_dev_info(void __user *arg)
 495 {
 496         struct rfcomm_dev *dev;
 497         struct rfcomm_dev_info di;
 498         int err = 0;
 499
 500         BT_DBG("");
 501
 502         if (copy_from_user(&di, arg, sizeof(di)))
 503                 return -EFAULT;
 504
 505         dev = rfcomm_dev_get(di.id);
 506         if (!dev)
 507                 return -ENODEV;
 508
 509         di.flags   = dev->flags;
 510         di.channel = dev->channel;
 511         di.state   = dev->dlc->state;
 512         bacpy(&di.src, &dev->src);
 513         bacpy(&di.dst, &dev->dst);
 514
 515         if (copy_to_user(arg, &di, sizeof(di)))
 516                 err = -EFAULT;
 517
 518         tty_port_put(&dev->port);
 519         return err;
 520 }
 521
 522 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 523 {
 524         BT_DBG("cmd %d arg %p", cmd, arg);
 525
 526         switch (cmd) {
 527         case RFCOMMCREATEDEV:
 528                 return rfcomm_create_dev(sk, arg);
 529
 530         case RFCOMMRELEASEDEV:
 531                 return rfcomm_release_dev(arg);
 532
 533         case RFCOMMGETDEVLIST:
 534                 return rfcomm_get_dev_list(arg);
 535
 536         case RFCOMMGETDEVINFO:
 537                 return rfcomm_get_dev_info(arg);
 538         }
 539
 540         return -EINVAL;
 541 }
 542
 543 /* ---- DLC callbacks ---- */
 544 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 545 {
 546         struct rfcomm_dev *dev = dlc->owner;
 547
 548         if (!dev) {
 549                 kfree_skb(skb);
 550                 return;
 551         }
 552
 553         if (!skb_queue_empty(&dev->pending)) {
 554                 skb_queue_tail(&dev->pending, skb);
 555                 return;
 556         }
 557
 558         BT_DBG("dlc %p len %d", dlc, skb->len);
 559
 560         tty_insert_flip_string(&dev->port, skb->data, skb->len);
 561         tty_flip_buffer_push(&dev->port);
 562
 563         kfree_skb(skb);
 564 }
 565
 566 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 567 {
 568         struct rfcomm_dev *dev = dlc->owner;
 569         if (!dev)
 570                 return;
 571
 572         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 573
 574         dev->err = err;
 575         if (dlc->state == BT_CONNECTED) {
 576                 device_move(dev->tty_dev, rfcomm_get_device(dev),
 577                             DPM_ORDER_DEV_AFTER_PARENT);
 578
 579                 wake_up_interruptible(&dev->port.open_wait);
 580         } else if (dlc->state == BT_CLOSED)
 581                 tty_port_tty_hangup(&dev->port, false);
 582 }
 583
 584 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 585 {
 586         struct rfcomm_dev *dev = dlc->owner;
 587         if (!dev)
 588                 return;
 589
 590         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 591
 592         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
 593                 tty_port_tty_hangup(&dev->port, true);
 594
 595         dev->modem_status =
 596                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 597                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 598                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 599                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 600 }
 601
 602 /* ---- TTY functions ---- */
 603 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 604 {
 605         struct sk_buff *skb;
 606         int inserted = 0;
 607
 608         BT_DBG("dev %p", dev);
 609
 610         rfcomm_dlc_lock(dev->dlc);
 611
 612         while ((skb = skb_dequeue(&dev->pending))) {
 613                 inserted += tty_insert_flip_string(&dev->port, skb->data,
 614                                 skb->len);
 615                 kfree_skb(skb);
 616         }
 617
 618         rfcomm_dlc_unlock(dev->dlc);
 619
 620         if (inserted > 0)
 621                 tty_flip_buffer_push(&dev->port);
 622 }
 623
 624 /* do the reverse of install, clearing the tty fields and releasing the
 625  * reference to tty_port
 626  */
 627 static void rfcomm_tty_cleanup(struct tty_struct *tty)
 628 {
 629         struct rfcomm_dev *dev = tty->driver_data;
 630
 631         clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 632
 633         rfcomm_dlc_lock(dev->dlc);
 634         tty->driver_data = NULL;
 635         rfcomm_dlc_unlock(dev->dlc);
 636
 637         /*
 638          * purge the dlc->tx_queue to avoid circular dependencies
 639          * between dev and dlc
 640          */
 641         skb_queue_purge(&dev->dlc->tx_queue);
 642
 643         tty_port_put(&dev->port);
 644 }
 645
 646 /* we acquire the tty_port reference since it's here the tty is first used
 647  * by setting the termios. We also populate the driver_data field and install
 648  * the tty port
 649  */
 650 static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
 651 {
 652         struct rfcomm_dev *dev;
 653         struct rfcomm_dlc *dlc;
 654         int err;
 655
 656         dev = rfcomm_dev_get(tty->index);
 657         if (!dev)
 658                 return -ENODEV;
 659
 660         dlc = dev->dlc;
 661
 662         /* Attach TTY and open DLC */
 663         rfcomm_dlc_lock(dlc);
 664         tty->driver_data = dev;
 665         rfcomm_dlc_unlock(dlc);
 666         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 667
 668         /* install the tty_port */
 669         err = tty_port_install(&dev->port, driver, tty);
 670         if (err) {
 671                 rfcomm_tty_cleanup(tty);
 672                 return err;
 673         }
 674
 675         /* take over the tty_port reference if the port was created with the
 676          * flag RFCOMM_RELEASE_ONHUP. This will force the release of the port
 677          * when the last process closes the tty. The behaviour is expected by
 678          * userspace.
 679          */
 680         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
 681                 tty_port_put(&dev->port);
 682
 683         return 0;
 684 }
 685
 686 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 687 {
 688         struct rfcomm_dev *dev = tty->driver_data;
 689         int err;
 690
 691         BT_DBG("tty %p id %d", tty, tty->index);
 692
 693         BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
 694                dev->channel, dev->port.count);
 695
 696         err = tty_port_open(&dev->port, tty, filp);
 697         if (err)
 698                 return err;
 699
 700         /*
 701          * FIXME: rfcomm should use proper flow control for
 702          * received data. This hack will be unnecessary and can
 703          * be removed when that's implemented
 704          */
 705         rfcomm_tty_copy_pending(dev);
 706
 707         rfcomm_dlc_unthrottle(dev->dlc);
 708
 709         return 0;
 710 }
 711
 712 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 713 {
 714         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 715
 716         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 717                                                 dev->port.count);
 718
 719         tty_port_close(&dev->port, tty, filp);
 720 }
 721
 722 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 723 {
 724         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 725         struct rfcomm_dlc *dlc = dev->dlc;
 726         struct sk_buff *skb;
 727         int err = 0, sent = 0, size;
 728
 729         BT_DBG("tty %p count %d", tty, count);
 730
 731         while (count) {
 732                 size = min_t(uint, count, dlc->mtu);
 733
 734                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 735
 736                 if (!skb)
 737                         break;
 738
 739                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 740
 741                 memcpy(skb_put(skb, size), buf + sent, size);
 742
 743                 err = rfcomm_dlc_send(dlc, skb);
 744                 if (err < 0) {
 745                         kfree_skb(skb);
 746                         break;
 747                 }
 748
 749                 sent  += size;
 750                 count -= size;
 751         }
 752
 753         return sent ? sent : err;
 754 }
 755
 756 static int rfcomm_tty_write_room(struct tty_struct *tty)
 757 {
 758         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 759         int room;
 760
 761         BT_DBG("tty %p", tty);
 762
 763         if (!dev || !dev->dlc)
 764                 return 0;
 765
 766         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 767         if (room < 0)
 768                 room = 0;
 769
 770         return room;
 771 }
 772
 773 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 774 {
 775         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 776
 777         switch (cmd) {
 778         case TCGETS:
 779                 BT_DBG("TCGETS is not supported");
 780                 return -ENOIOCTLCMD;
 781
 782         case TCSETS:
 783                 BT_DBG("TCSETS is not supported");
 784                 return -ENOIOCTLCMD;
 785
 786         case TIOCMIWAIT:
 787                 BT_DBG("TIOCMIWAIT");
 788                 break;
 789
 790         case TIOCGSERIAL:
 791                 BT_ERR("TIOCGSERIAL is not supported");
 792                 return -ENOIOCTLCMD;
 793
 794         case TIOCSSERIAL:
 795                 BT_ERR("TIOCSSERIAL is not supported");
 796                 return -ENOIOCTLCMD;
 797
 798         case TIOCSERGSTRUCT:
 799                 BT_ERR("TIOCSERGSTRUCT is not supported");
 800                 return -ENOIOCTLCMD;
 801
 802         case TIOCSERGETLSR:
 803                 BT_ERR("TIOCSERGETLSR is not supported");
 804                 return -ENOIOCTLCMD;
 805
 806         case TIOCSERCONFIG:
 807                 BT_ERR("TIOCSERCONFIG is not supported");
 808                 return -ENOIOCTLCMD;
 809
 810         default:
 811                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 812
 813         }
 814
 815         return -ENOIOCTLCMD;
 816 }
 817
 818 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 819 {
 820         struct ktermios *new = &tty->termios;
 821         int old_baud_rate = tty_termios_baud_rate(old);
 822         int new_baud_rate = tty_termios_baud_rate(new);
 823
 824         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 825         u16 changes = 0;
 826
 827         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 828
 829         BT_DBG("tty %p termios %p", tty, old);
 830
 831         if (!dev || !dev->dlc || !dev->dlc->session)
 832                 return;
 833
 834         /* Handle turning off CRTSCTS */
 835         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 836                 BT_DBG("Turning off CRTSCTS unsupported");
 837
 838         /* Parity on/off and when on, odd/even */
 839         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 840                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 841                 changes |= RFCOMM_RPN_PM_PARITY;
 842                 BT_DBG("Parity change detected.");
 843         }
 844
 845         /* Mark and space parity are not supported! */
 846         if (new->c_cflag & PARENB) {
 847                 if (new->c_cflag & PARODD) {
 848                         BT_DBG("Parity is ODD");
 849                         parity = RFCOMM_RPN_PARITY_ODD;
 850                 } else {
 851                         BT_DBG("Parity is EVEN");
 852                         parity = RFCOMM_RPN_PARITY_EVEN;
 853                 }
 854         } else {
 855                 BT_DBG("Parity is OFF");
 856                 parity = RFCOMM_RPN_PARITY_NONE;
 857         }
 858
 859         /* Setting the x_on / x_off characters */
 860         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 861                 BT_DBG("XOFF custom");
 862                 x_on = new->c_cc[VSTOP];
 863                 changes |= RFCOMM_RPN_PM_XON;
 864         } else {
 865                 BT_DBG("XOFF default");
 866                 x_on = RFCOMM_RPN_XON_CHAR;
 867         }
 868
 869         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 870                 BT_DBG("XON custom");
 871                 x_off = new->c_cc[VSTART];
 872                 changes |= RFCOMM_RPN_PM_XOFF;
 873         } else {
 874                 BT_DBG("XON default");
 875                 x_off = RFCOMM_RPN_XOFF_CHAR;
 876         }
 877
 878         /* Handle setting of stop bits */
 879         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 880                 changes |= RFCOMM_RPN_PM_STOP;
 881
 882         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 883          * support 2 stop bits. So a request for 2 stop bits gets
 884          * translated to 1.5 stop bits */
 885         if (new->c_cflag & CSTOPB)
 886                 stop_bits = RFCOMM_RPN_STOP_15;
 887         else
 888                 stop_bits = RFCOMM_RPN_STOP_1;
 889
 890         /* Handle number of data bits [5-8] */
 891         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 892                 changes |= RFCOMM_RPN_PM_DATA;
 893
 894         switch (new->c_cflag & CSIZE) {
 895         case CS5:
 896                 data_bits = RFCOMM_RPN_DATA_5;
 897                 break;
 898         case CS6:
 899                 data_bits = RFCOMM_RPN_DATA_6;
 900                 break;
 901         case CS7:
 902                 data_bits = RFCOMM_RPN_DATA_7;
 903                 break;
 904         case CS8:
 905                 data_bits = RFCOMM_RPN_DATA_8;
 906                 break;
 907         default:
 908                 data_bits = RFCOMM_RPN_DATA_8;
 909                 break;
 910         }
 911
 912         /* Handle baudrate settings */
 913         if (old_baud_rate != new_baud_rate)
 914                 changes |= RFCOMM_RPN_PM_BITRATE;
 915
 916         switch (new_baud_rate) {
 917         case 2400:
 918                 baud = RFCOMM_RPN_BR_2400;
 919                 break;
 920         case 4800:
 921                 baud = RFCOMM_RPN_BR_4800;
 922                 break;
 923         case 7200:
 924                 baud = RFCOMM_RPN_BR_7200;
 925                 break;
 926         case 9600:
 927                 baud = RFCOMM_RPN_BR_9600;
 928                 break;
 929         case 19200:
 930                 baud = RFCOMM_RPN_BR_19200;
 931                 break;
 932         case 38400:
 933                 baud = RFCOMM_RPN_BR_38400;
 934                 break;
 935         case 57600:
 936                 baud = RFCOMM_RPN_BR_57600;
 937                 break;
 938         case 115200:
 939                 baud = RFCOMM_RPN_BR_115200;
 940                 break;
 941         case 230400:
 942                 baud = RFCOMM_RPN_BR_230400;
 943                 break;
 944         default:
 945                 /* 9600 is standard accordinag to the RFCOMM specification */
 946                 baud = RFCOMM_RPN_BR_9600;
 947                 break;
 948
 949         }
 950
 951         if (changes)
 952                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 953                                 data_bits, stop_bits, parity,
 954                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 955 }
 956
 957 static void rfcomm_tty_throttle(struct tty_struct *tty)
 958 {
 959         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 960
 961         BT_DBG("tty %p dev %p", tty, dev);
 962
 963         rfcomm_dlc_throttle(dev->dlc);
 964 }
 965
 966 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 967 {
 968         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 969
 970         BT_DBG("tty %p dev %p", tty, dev);
 971
 972         rfcomm_dlc_unthrottle(dev->dlc);
 973 }
 974
 975 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 976 {
 977         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 978
 979         BT_DBG("tty %p dev %p", tty, dev);
 980
 981         if (!dev || !dev->dlc)
 982                 return 0;
 983
 984         if (!skb_queue_empty(&dev->dlc->tx_queue))
 985                 return dev->dlc->mtu;
 986
 987         return 0;
 988 }
 989
 990 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 991 {
 992         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 993
 994         BT_DBG("tty %p dev %p", tty, dev);
 995
 996         if (!dev || !dev->dlc)
 997                 return;
 998
 999         skb_queue_purge(&dev->dlc->tx_queue);
1000         tty_wakeup(tty);
1001 }
1002
1003 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1004 {
1005         BT_DBG("tty %p ch %c", tty, ch);
1006 }
1007
1008 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1009 {
1010         BT_DBG("tty %p timeout %d", tty, timeout);
1011 }
1012
1013 static void rfcomm_tty_hangup(struct tty_struct *tty)
1014 {
1015         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1016
1017         BT_DBG("tty %p dev %p", tty, dev);
1018
1019         tty_port_hangup(&dev->port);
1020 }
1021
1022 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1023 {
1024         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1025
1026         BT_DBG("tty %p dev %p", tty, dev);
1027
1028         return dev->modem_status;
1029 }
1030
1031 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1032 {
1033         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1034         struct rfcomm_dlc *dlc = dev->dlc;
1035         u8 v24_sig;
1036
1037         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1038
1039         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1040
1041         if (set & TIOCM_DSR || set & TIOCM_DTR)
1042                 v24_sig |= RFCOMM_V24_RTC;
1043         if (set & TIOCM_RTS || set & TIOCM_CTS)
1044                 v24_sig |= RFCOMM_V24_RTR;
1045         if (set & TIOCM_RI)
1046                 v24_sig |= RFCOMM_V24_IC;
1047         if (set & TIOCM_CD)
1048                 v24_sig |= RFCOMM_V24_DV;
1049
1050         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1051                 v24_sig &= ~RFCOMM_V24_RTC;
1052         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1053                 v24_sig &= ~RFCOMM_V24_RTR;
1054         if (clear & TIOCM_RI)
1055                 v24_sig &= ~RFCOMM_V24_IC;
1056         if (clear & TIOCM_CD)
1057                 v24_sig &= ~RFCOMM_V24_DV;
1058
1059         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1060
1061         return 0;
1062 }
1063
1064 /* ---- TTY structure ---- */
1065
1066 static const struct tty_operations rfcomm_ops = {
1067         .open                   = rfcomm_tty_open,
1068         .close                  = rfcomm_tty_close,
1069         .write                  = rfcomm_tty_write,
1070         .write_room             = rfcomm_tty_write_room,
1071         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1072         .flush_buffer           = rfcomm_tty_flush_buffer,
1073         .ioctl                  = rfcomm_tty_ioctl,
1074         .throttle               = rfcomm_tty_throttle,
1075         .unthrottle             = rfcomm_tty_unthrottle,
1076         .set_termios            = rfcomm_tty_set_termios,
1077         .send_xchar             = rfcomm_tty_send_xchar,
1078         .hangup                 = rfcomm_tty_hangup,
1079         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1080         .tiocmget               = rfcomm_tty_tiocmget,
1081         .tiocmset               = rfcomm_tty_tiocmset,
1082         .install                = rfcomm_tty_install,
1083         .cleanup                = rfcomm_tty_cleanup,
1084 };
1085
1086 int __init rfcomm_init_ttys(void)
1087 {
1088         int error;
1089
1090         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1091         if (!rfcomm_tty_driver)
1092                 return -ENOMEM;
1093
1094         rfcomm_tty_driver->driver_name  = "rfcomm";
1095         rfcomm_tty_driver->name         = "rfcomm";
1096         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1097         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1098         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1099         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1100         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1101         rfcomm_tty_driver->init_termios = tty_std_termios;
1102         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
1103         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1104         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1105
1106         error = tty_register_driver(rfcomm_tty_driver);
1107         if (error) {
1108                 BT_ERR("Can't register RFCOMM TTY driver");
1109                 put_tty_driver(rfcomm_tty_driver);
1110                 return error;
1111         }
1112
1113         BT_INFO("RFCOMM TTY layer initialized");
1114
1115         return 0;
1116 }
1117
1118 void rfcomm_cleanup_ttys(void)
1119 {
1120         tty_unregister_driver(rfcomm_tty_driver);
1121         put_tty_driver(rfcomm_tty_driver);
1122 }