net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  40 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  41 #define RFCOMM_TTY_MINOR 0
  42
  43 static struct tty_driver *rfcomm_tty_driver;
  44
  45 struct rfcomm_dev {
  46         struct tty_port         port;
  47         struct list_head        list;
  48
  49         char                    name[12];
  50         int                     id;
  51         unsigned long           flags;
  52         int                     err;
  53
  54         bdaddr_t                src;
  55         bdaddr_t                dst;
  56         u8                      channel;
  57
  58         uint                    modem_status;
  59
  60         struct rfcomm_dlc       *dlc;
  61         wait_queue_head_t       conn_wait;
  62
  63         struct device           *tty_dev;
  64
  65         atomic_t                wmem_alloc;
  66
  67         struct sk_buff_head     pending;
  68 };
  69
  70 static LIST_HEAD(rfcomm_dev_list);
  71 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  72
  73 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  74 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  75 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  76
  77 /* ---- Device functions ---- */
  78
  79 static void rfcomm_dev_destruct(struct tty_port *port)
  80 {
  81         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  82         struct rfcomm_dlc *dlc = dev->dlc;
  83
  84         BT_DBG("dev %p dlc %p", dev, dlc);
  85
  86         spin_lock(&rfcomm_dev_lock);
  87         list_del(&dev->list);
  88         spin_unlock(&rfcomm_dev_lock);
  89
  90         rfcomm_dlc_lock(dlc);
  91         /* Detach DLC if it's owned by this dev */
  92         if (dlc->owner == dev)
  93                 dlc->owner = NULL;
  94         rfcomm_dlc_unlock(dlc);
  95
  96         rfcomm_dlc_put(dlc);
  97
  98         tty_unregister_device(rfcomm_tty_driver, dev->id);
  99
 100         kfree(dev);
 101
 102         /* It's safe to call module_put() here because socket still
 103            holds reference to this module. */
 104         module_put(THIS_MODULE);
 105 }
 106
 107 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 108 {
 109         struct hci_dev *hdev;
 110         struct hci_conn *conn;
 111
 112         hdev = hci_get_route(&dev->dst, &dev->src);
 113         if (!hdev)
 114                 return NULL;
 115
 116         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 117
 118         hci_dev_put(hdev);
 119
 120         return conn ? &conn->dev : NULL;
 121 }
 122
 123 /* device-specific initialization: open the dlc */
 124 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
 125 {
 126         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 127         DEFINE_WAIT(wait);
 128         int err;
 129
 130         err = rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
 131         if (err)
 132                 return err;
 133
 134         while (1) {
 135                 prepare_to_wait(&dev->conn_wait, &wait, TASK_INTERRUPTIBLE);
 136
 137                 if (dev->dlc->state == BT_CLOSED) {
 138                         err = -dev->err;
 139                         break;
 140                 }
 141
 142                 if (dev->dlc->state == BT_CONNECTED)
 143                         break;
 144
 145                 if (signal_pending(current)) {
 146                         err = -ERESTARTSYS;
 147                         break;
 148                 }
 149
 150                 tty_unlock(tty);
 151                 schedule();
 152                 tty_lock(tty);
 153         }
 154         finish_wait(&dev->conn_wait, &wait);
 155
 156         if (!err)
 157                 device_move(dev->tty_dev, rfcomm_get_device(dev),
 158                             DPM_ORDER_DEV_AFTER_PARENT);
 159
 160         return err;
 161 }
 162
 163 /* we block the open until the dlc->state becomes BT_CONNECTED */
 164 static int rfcomm_dev_carrier_raised(struct tty_port *port)
 165 {
 166         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 167
 168         return (dev->dlc->state == BT_CONNECTED);
 169 }
 170
 171 /* device-specific cleanup: close the dlc */
 172 static void rfcomm_dev_shutdown(struct tty_port *port)
 173 {
 174         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 175
 176         if (dev->tty_dev->parent)
 177                 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 178
 179         /* close the dlc */
 180         rfcomm_dlc_close(dev->dlc, 0);
 181 }
 182
 183 static const struct tty_port_operations rfcomm_port_ops = {
 184         .destruct = rfcomm_dev_destruct,
 185         .activate = rfcomm_dev_activate,
 186         .shutdown = rfcomm_dev_shutdown,
 187 };
 188
 189 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 190 {
 191         struct rfcomm_dev *dev;
 192
 193         list_for_each_entry(dev, &rfcomm_dev_list, list)
 194                 if (dev->id == id)
 195                         return dev;
 196
 197         return NULL;
 198 }
 199
 200 static struct rfcomm_dev *rfcomm_dev_get(int id)
 201 {
 202         struct rfcomm_dev *dev;
 203
 204         spin_lock(&rfcomm_dev_lock);
 205
 206         dev = __rfcomm_dev_get(id);
 207
 208         if (dev) {
 209                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 210                         dev = NULL;
 211                 else
 212                         tty_port_get(&dev->port);
 213         }
 214
 215         spin_unlock(&rfcomm_dev_lock);
 216
 217         return dev;
 218 }
 219
 220 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 221 {
 222         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 223         return sprintf(buf, "%pMR\n", &dev->dst);
 224 }
 225
 226 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 227 {
 228         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 229         return sprintf(buf, "%d\n", dev->channel);
 230 }
 231
 232 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 233 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 234
 235 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 236 {
 237         struct rfcomm_dev *dev, *entry;
 238         struct list_head *head = &rfcomm_dev_list;
 239         int err = 0;
 240
 241         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 242
 243         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 244         if (!dev)
 245                 return -ENOMEM;
 246
 247         spin_lock(&rfcomm_dev_lock);
 248
 249         if (req->dev_id < 0) {
 250                 dev->id = 0;
 251
 252                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 253                         if (entry->id != dev->id)
 254                                 break;
 255
 256                         dev->id++;
 257                         head = &entry->list;
 258                 }
 259         } else {
 260                 dev->id = req->dev_id;
 261
 262                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 263                         if (entry->id == dev->id) {
 264                                 err = -EADDRINUSE;
 265                                 goto out;
 266                         }
 267
 268                         if (entry->id > dev->id - 1)
 269                                 break;
 270
 271                         head = &entry->list;
 272                 }
 273         }
 274
 275         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 276                 err = -ENFILE;
 277                 goto out;
 278         }
 279
 280         sprintf(dev->name, "rfcomm%d", dev->id);
 281
 282         list_add(&dev->list, head);
 283
 284         bacpy(&dev->src, &req->src);
 285         bacpy(&dev->dst, &req->dst);
 286         dev->channel = req->channel;
 287
 288         dev->flags = req->flags &
 289                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 290
 291         tty_port_init(&dev->port);
 292         dev->port.ops = &rfcomm_port_ops;
 293         init_waitqueue_head(&dev->conn_wait);
 294
 295         skb_queue_head_init(&dev->pending);
 296
 297         rfcomm_dlc_lock(dlc);
 298
 299         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 300                 struct sock *sk = dlc->owner;
 301                 struct sk_buff *skb;
 302
 303                 BUG_ON(!sk);
 304
 305                 rfcomm_dlc_throttle(dlc);
 306
 307                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 308                         skb_orphan(skb);
 309                         skb_queue_tail(&dev->pending, skb);
 310                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 311                 }
 312         }
 313
 314         dlc->data_ready   = rfcomm_dev_data_ready;
 315         dlc->state_change = rfcomm_dev_state_change;
 316         dlc->modem_status = rfcomm_dev_modem_status;
 317
 318         dlc->owner = dev;
 319         dev->dlc   = dlc;
 320
 321         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 322
 323         rfcomm_dlc_unlock(dlc);
 324
 325         /* It's safe to call __module_get() here because socket already
 326            holds reference to this module. */
 327         __module_get(THIS_MODULE);
 328
 329 out:
 330         spin_unlock(&rfcomm_dev_lock);
 331
 332         if (err < 0)
 333                 goto free;
 334
 335         dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
 336                         dev->id, NULL);
 337         if (IS_ERR(dev->tty_dev)) {
 338                 err = PTR_ERR(dev->tty_dev);
 339                 spin_lock(&rfcomm_dev_lock);
 340                 list_del(&dev->list);
 341                 spin_unlock(&rfcomm_dev_lock);
 342                 goto free;
 343         }
 344
 345         dev_set_drvdata(dev->tty_dev, dev);
 346
 347         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 348                 BT_ERR("Failed to create address attribute");
 349
 350         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 351                 BT_ERR("Failed to create channel attribute");
 352
 353         return dev->id;
 354
 355 free:
 356         kfree(dev);
 357         return err;
 358 }
 359
 360 /* ---- Send buffer ---- */
 361 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 362 {
 363         /* We can't let it be zero, because we don't get a callback
 364            when tx_credits becomes nonzero, hence we'd never wake up */
 365         return dlc->mtu * (dlc->tx_credits?:1);
 366 }
 367
 368 static void rfcomm_wfree(struct sk_buff *skb)
 369 {
 370         struct rfcomm_dev *dev = (void *) skb->sk;
 371         atomic_sub(skb->truesize, &dev->wmem_alloc);
 372         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 373                 tty_port_tty_wakeup(&dev->port);
 374         tty_port_put(&dev->port);
 375 }
 376
 377 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 378 {
 379         tty_port_get(&dev->port);
 380         atomic_add(skb->truesize, &dev->wmem_alloc);
 381         skb->sk = (void *) dev;
 382         skb->destructor = rfcomm_wfree;
 383 }
 384
 385 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 386 {
 387         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 388                 struct sk_buff *skb = alloc_skb(size, priority);
 389                 if (skb) {
 390                         rfcomm_set_owner_w(skb, dev);
 391                         return skb;
 392                 }
 393         }
 394         return NULL;
 395 }
 396
 397 /* ---- Device IOCTLs ---- */
 398
 399 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 400
 401 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 402 {
 403         struct rfcomm_dev_req req;
 404         struct rfcomm_dlc *dlc;
 405         int id;
 406
 407         if (copy_from_user(&req, arg, sizeof(req)))
 408                 return -EFAULT;
 409
 410         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 411
 412         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 413                 return -EPERM;
 414
 415         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 416                 /* Socket must be connected */
 417                 if (sk->sk_state != BT_CONNECTED)
 418                         return -EBADFD;
 419
 420                 dlc = rfcomm_pi(sk)->dlc;
 421                 rfcomm_dlc_hold(dlc);
 422         } else {
 423                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 424                 if (!dlc)
 425                         return -ENOMEM;
 426         }
 427
 428         id = rfcomm_dev_add(&req, dlc);
 429         if (id < 0) {
 430                 rfcomm_dlc_put(dlc);
 431                 return id;
 432         }
 433
 434         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 435                 /* DLC is now used by device.
 436                  * Socket must be disconnected */
 437                 sk->sk_state = BT_CLOSED;
 438         }
 439
 440         return id;
 441 }
 442
 443 static int rfcomm_release_dev(void __user *arg)
 444 {
 445         struct rfcomm_dev_req req;
 446         struct rfcomm_dev *dev;
 447         struct tty_struct *tty;
 448
 449         if (copy_from_user(&req, arg, sizeof(req)))
 450                 return -EFAULT;
 451
 452         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 453
 454         dev = rfcomm_dev_get(req.dev_id);
 455         if (!dev)
 456                 return -ENODEV;
 457
 458         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 459                 tty_port_put(&dev->port);
 460                 return -EPERM;
 461         }
 462
 463         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 464                 rfcomm_dlc_close(dev->dlc, 0);
 465
 466         /* Shut down TTY synchronously before freeing rfcomm_dev */
 467         tty = tty_port_tty_get(&dev->port);
 468         if (tty) {
 469                 tty_vhangup(tty);
 470                 tty_kref_put(tty);
 471         }
 472
 473         if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags) &&
 474             !test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 475                 tty_port_put(&dev->port);
 476
 477         tty_port_put(&dev->port);
 478         return 0;
 479 }
 480
 481 static int rfcomm_get_dev_list(void __user *arg)
 482 {
 483         struct rfcomm_dev *dev;
 484         struct rfcomm_dev_list_req *dl;
 485         struct rfcomm_dev_info *di;
 486         int n = 0, size, err;
 487         u16 dev_num;
 488
 489         BT_DBG("");
 490
 491         if (get_user(dev_num, (u16 __user *) arg))
 492                 return -EFAULT;
 493
 494         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 495                 return -EINVAL;
 496
 497         size = sizeof(*dl) + dev_num * sizeof(*di);
 498
 499         dl = kzalloc(size, GFP_KERNEL);
 500         if (!dl)
 501                 return -ENOMEM;
 502
 503         di = dl->dev_info;
 504
 505         spin_lock(&rfcomm_dev_lock);
 506
 507         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 508                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 509                         continue;
 510                 (di + n)->id      = dev->id;
 511                 (di + n)->flags   = dev->flags;
 512                 (di + n)->state   = dev->dlc->state;
 513                 (di + n)->channel = dev->channel;
 514                 bacpy(&(di + n)->src, &dev->src);
 515                 bacpy(&(di + n)->dst, &dev->dst);
 516                 if (++n >= dev_num)
 517                         break;
 518         }
 519
 520         spin_unlock(&rfcomm_dev_lock);
 521
 522         dl->dev_num = n;
 523         size = sizeof(*dl) + n * sizeof(*di);
 524
 525         err = copy_to_user(arg, dl, size);
 526         kfree(dl);
 527
 528         return err ? -EFAULT : 0;
 529 }
 530
 531 static int rfcomm_get_dev_info(void __user *arg)
 532 {
 533         struct rfcomm_dev *dev;
 534         struct rfcomm_dev_info di;
 535         int err = 0;
 536
 537         BT_DBG("");
 538
 539         if (copy_from_user(&di, arg, sizeof(di)))
 540                 return -EFAULT;
 541
 542         dev = rfcomm_dev_get(di.id);
 543         if (!dev)
 544                 return -ENODEV;
 545
 546         di.flags   = dev->flags;
 547         di.channel = dev->channel;
 548         di.state   = dev->dlc->state;
 549         bacpy(&di.src, &dev->src);
 550         bacpy(&di.dst, &dev->dst);
 551
 552         if (copy_to_user(arg, &di, sizeof(di)))
 553                 err = -EFAULT;
 554
 555         tty_port_put(&dev->port);
 556         return err;
 557 }
 558
 559 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 560 {
 561         BT_DBG("cmd %d arg %p", cmd, arg);
 562
 563         switch (cmd) {
 564         case RFCOMMCREATEDEV:
 565                 return rfcomm_create_dev(sk, arg);
 566
 567         case RFCOMMRELEASEDEV:
 568                 return rfcomm_release_dev(arg);
 569
 570         case RFCOMMGETDEVLIST:
 571                 return rfcomm_get_dev_list(arg);
 572
 573         case RFCOMMGETDEVINFO:
 574                 return rfcomm_get_dev_info(arg);
 575         }
 576
 577         return -EINVAL;
 578 }
 579
 580 /* ---- DLC callbacks ---- */
 581 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 582 {
 583         struct rfcomm_dev *dev = dlc->owner;
 584
 585         if (!dev) {
 586                 kfree_skb(skb);
 587                 return;
 588         }
 589
 590         if (!skb_queue_empty(&dev->pending)) {
 591                 skb_queue_tail(&dev->pending, skb);
 592                 return;
 593         }
 594
 595         BT_DBG("dlc %p len %d", dlc, skb->len);
 596
 597         tty_insert_flip_string(&dev->port, skb->data, skb->len);
 598         tty_flip_buffer_push(&dev->port);
 599
 600         kfree_skb(skb);
 601 }
 602
 603 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 604 {
 605         struct rfcomm_dev *dev = dlc->owner;
 606         if (!dev)
 607                 return;
 608
 609         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 610
 611         dev->err = err;
 612         wake_up_interruptible(&dev->conn_wait);
 613
 614         if (dlc->state == BT_CLOSED)
 615                 tty_port_tty_hangup(&dev->port, false);
 616 }
 617
 618 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 619 {
 620         struct rfcomm_dev *dev = dlc->owner;
 621         if (!dev)
 622                 return;
 623
 624         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 625
 626         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
 627                 tty_port_tty_hangup(&dev->port, true);
 628
 629         dev->modem_status =
 630                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 631                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 632                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 633                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 634 }
 635
 636 /* ---- TTY functions ---- */
 637 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 638 {
 639         struct sk_buff *skb;
 640         int inserted = 0;
 641
 642         BT_DBG("dev %p", dev);
 643
 644         rfcomm_dlc_lock(dev->dlc);
 645
 646         while ((skb = skb_dequeue(&dev->pending))) {
 647                 inserted += tty_insert_flip_string(&dev->port, skb->data,
 648                                 skb->len);
 649                 kfree_skb(skb);
 650         }
 651
 652         rfcomm_dlc_unlock(dev->dlc);
 653
 654         if (inserted > 0)
 655                 tty_flip_buffer_push(&dev->port);
 656 }
 657
 658 /* do the reverse of install, clearing the tty fields and releasing the
 659  * reference to tty_port
 660  */
 661 static void rfcomm_tty_cleanup(struct tty_struct *tty)
 662 {
 663         struct rfcomm_dev *dev = tty->driver_data;
 664
 665         clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 666
 667         rfcomm_dlc_lock(dev->dlc);
 668         tty->driver_data = NULL;
 669         rfcomm_dlc_unlock(dev->dlc);
 670
 671         /*
 672          * purge the dlc->tx_queue to avoid circular dependencies
 673          * between dev and dlc
 674          */
 675         skb_queue_purge(&dev->dlc->tx_queue);
 676
 677         tty_port_put(&dev->port);
 678 }
 679
 680 /* we acquire the tty_port reference since it's here the tty is first used
 681  * by setting the termios. We also populate the driver_data field and install
 682  * the tty port
 683  */
 684 static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
 685 {
 686         struct rfcomm_dev *dev;
 687         struct rfcomm_dlc *dlc;
 688         int err;
 689
 690         dev = rfcomm_dev_get(tty->index);
 691         if (!dev)
 692                 return -ENODEV;
 693
 694         dlc = dev->dlc;
 695
 696         /* Attach TTY and open DLC */
 697         rfcomm_dlc_lock(dlc);
 698         tty->driver_data = dev;
 699         rfcomm_dlc_unlock(dlc);
 700         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 701
 702         /* install the tty_port */
 703         err = tty_port_install(&dev->port, driver, tty);
 704         if (err) {
 705                 rfcomm_tty_cleanup(tty);
 706                 return err;
 707         }
 708
 709         /* take over the tty_port reference if the port was created with the
 710          * flag RFCOMM_RELEASE_ONHUP. This will force the release of the port
 711          * when the last process closes the tty. The behaviour is expected by
 712          * userspace.
 713          */
 714         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
 715                 tty_port_put(&dev->port);
 716
 717         return 0;
 718 }
 719
 720 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 721 {
 722         struct rfcomm_dev *dev = tty->driver_data;
 723         int err;
 724
 725         BT_DBG("tty %p id %d", tty, tty->index);
 726
 727         BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
 728                dev->channel, dev->port.count);
 729
 730         err = tty_port_open(&dev->port, tty, filp);
 731         if (err)
 732                 return err;
 733
 734         /*
 735          * FIXME: rfcomm should use proper flow control for
 736          * received data. This hack will be unnecessary and can
 737          * be removed when that's implemented
 738          */
 739         rfcomm_tty_copy_pending(dev);
 740
 741         rfcomm_dlc_unthrottle(dev->dlc);
 742
 743         return 0;
 744 }
 745
 746 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 747 {
 748         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 749
 750         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 751                                                 dev->port.count);
 752
 753         tty_port_close(&dev->port, tty, filp);
 754 }
 755
 756 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 757 {
 758         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 759         struct rfcomm_dlc *dlc = dev->dlc;
 760         struct sk_buff *skb;
 761         int err = 0, sent = 0, size;
 762
 763         BT_DBG("tty %p count %d", tty, count);
 764
 765         while (count) {
 766                 size = min_t(uint, count, dlc->mtu);
 767
 768                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 769
 770                 if (!skb)
 771                         break;
 772
 773                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 774
 775                 memcpy(skb_put(skb, size), buf + sent, size);
 776
 777                 err = rfcomm_dlc_send(dlc, skb);
 778                 if (err < 0) {
 779                         kfree_skb(skb);
 780                         break;
 781                 }
 782
 783                 sent  += size;
 784                 count -= size;
 785         }
 786
 787         return sent ? sent : err;
 788 }
 789
 790 static int rfcomm_tty_write_room(struct tty_struct *tty)
 791 {
 792         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 793         int room;
 794
 795         BT_DBG("tty %p", tty);
 796
 797         if (!dev || !dev->dlc)
 798                 return 0;
 799
 800         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 801         if (room < 0)
 802                 room = 0;
 803
 804         return room;
 805 }
 806
 807 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 808 {
 809         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 810
 811         switch (cmd) {
 812         case TCGETS:
 813                 BT_DBG("TCGETS is not supported");
 814                 return -ENOIOCTLCMD;
 815
 816         case TCSETS:
 817                 BT_DBG("TCSETS is not supported");
 818                 return -ENOIOCTLCMD;
 819
 820         case TIOCMIWAIT:
 821                 BT_DBG("TIOCMIWAIT");
 822                 break;
 823
 824         case TIOCGSERIAL:
 825                 BT_ERR("TIOCGSERIAL is not supported");
 826                 return -ENOIOCTLCMD;
 827
 828         case TIOCSSERIAL:
 829                 BT_ERR("TIOCSSERIAL is not supported");
 830                 return -ENOIOCTLCMD;
 831
 832         case TIOCSERGSTRUCT:
 833                 BT_ERR("TIOCSERGSTRUCT is not supported");
 834                 return -ENOIOCTLCMD;
 835
 836         case TIOCSERGETLSR:
 837                 BT_ERR("TIOCSERGETLSR is not supported");
 838                 return -ENOIOCTLCMD;
 839
 840         case TIOCSERCONFIG:
 841                 BT_ERR("TIOCSERCONFIG is not supported");
 842                 return -ENOIOCTLCMD;
 843
 844         default:
 845                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 846
 847         }
 848
 849         return -ENOIOCTLCMD;
 850 }
 851
 852 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 853 {
 854         struct ktermios *new = &tty->termios;
 855         int old_baud_rate = tty_termios_baud_rate(old);
 856         int new_baud_rate = tty_termios_baud_rate(new);
 857
 858         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 859         u16 changes = 0;
 860
 861         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 862
 863         BT_DBG("tty %p termios %p", tty, old);
 864
 865         if (!dev || !dev->dlc || !dev->dlc->session)
 866                 return;
 867
 868         /* Handle turning off CRTSCTS */
 869         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 870                 BT_DBG("Turning off CRTSCTS unsupported");
 871
 872         /* Parity on/off and when on, odd/even */
 873         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 874                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 875                 changes |= RFCOMM_RPN_PM_PARITY;
 876                 BT_DBG("Parity change detected.");
 877         }
 878
 879         /* Mark and space parity are not supported! */
 880         if (new->c_cflag & PARENB) {
 881                 if (new->c_cflag & PARODD) {
 882                         BT_DBG("Parity is ODD");
 883                         parity = RFCOMM_RPN_PARITY_ODD;
 884                 } else {
 885                         BT_DBG("Parity is EVEN");
 886                         parity = RFCOMM_RPN_PARITY_EVEN;
 887                 }
 888         } else {
 889                 BT_DBG("Parity is OFF");
 890                 parity = RFCOMM_RPN_PARITY_NONE;
 891         }
 892
 893         /* Setting the x_on / x_off characters */
 894         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 895                 BT_DBG("XOFF custom");
 896                 x_on = new->c_cc[VSTOP];
 897                 changes |= RFCOMM_RPN_PM_XON;
 898         } else {
 899                 BT_DBG("XOFF default");
 900                 x_on = RFCOMM_RPN_XON_CHAR;
 901         }
 902
 903         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 904                 BT_DBG("XON custom");
 905                 x_off = new->c_cc[VSTART];
 906                 changes |= RFCOMM_RPN_PM_XOFF;
 907         } else {
 908                 BT_DBG("XON default");
 909                 x_off = RFCOMM_RPN_XOFF_CHAR;
 910         }
 911
 912         /* Handle setting of stop bits */
 913         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 914                 changes |= RFCOMM_RPN_PM_STOP;
 915
 916         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 917          * support 2 stop bits. So a request for 2 stop bits gets
 918          * translated to 1.5 stop bits */
 919         if (new->c_cflag & CSTOPB)
 920                 stop_bits = RFCOMM_RPN_STOP_15;
 921         else
 922                 stop_bits = RFCOMM_RPN_STOP_1;
 923
 924         /* Handle number of data bits [5-8] */
 925         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 926                 changes |= RFCOMM_RPN_PM_DATA;
 927
 928         switch (new->c_cflag & CSIZE) {
 929         case CS5:
 930                 data_bits = RFCOMM_RPN_DATA_5;
 931                 break;
 932         case CS6:
 933                 data_bits = RFCOMM_RPN_DATA_6;
 934                 break;
 935         case CS7:
 936                 data_bits = RFCOMM_RPN_DATA_7;
 937                 break;
 938         case CS8:
 939                 data_bits = RFCOMM_RPN_DATA_8;
 940                 break;
 941         default:
 942                 data_bits = RFCOMM_RPN_DATA_8;
 943                 break;
 944         }
 945
 946         /* Handle baudrate settings */
 947         if (old_baud_rate != new_baud_rate)
 948                 changes |= RFCOMM_RPN_PM_BITRATE;
 949
 950         switch (new_baud_rate) {
 951         case 2400:
 952                 baud = RFCOMM_RPN_BR_2400;
 953                 break;
 954         case 4800:
 955                 baud = RFCOMM_RPN_BR_4800;
 956                 break;
 957         case 7200:
 958                 baud = RFCOMM_RPN_BR_7200;
 959                 break;
 960         case 9600:
 961                 baud = RFCOMM_RPN_BR_9600;
 962                 break;
 963         case 19200:
 964                 baud = RFCOMM_RPN_BR_19200;
 965                 break;
 966         case 38400:
 967                 baud = RFCOMM_RPN_BR_38400;
 968                 break;
 969         case 57600:
 970                 baud = RFCOMM_RPN_BR_57600;
 971                 break;
 972         case 115200:
 973                 baud = RFCOMM_RPN_BR_115200;
 974                 break;
 975         case 230400:
 976                 baud = RFCOMM_RPN_BR_230400;
 977                 break;
 978         default:
 979                 /* 9600 is standard accordinag to the RFCOMM specification */
 980                 baud = RFCOMM_RPN_BR_9600;
 981                 break;
 982
 983         }
 984
 985         if (changes)
 986                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 987                                 data_bits, stop_bits, parity,
 988                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 989 }
 990
 991 static void rfcomm_tty_throttle(struct tty_struct *tty)
 992 {
 993         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 994
 995         BT_DBG("tty %p dev %p", tty, dev);
 996
 997         rfcomm_dlc_throttle(dev->dlc);
 998 }
 999
1000 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
1001 {
1002         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1003
1004         BT_DBG("tty %p dev %p", tty, dev);
1005
1006         rfcomm_dlc_unthrottle(dev->dlc);
1007 }
1008
1009 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1010 {
1011         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1012
1013         BT_DBG("tty %p dev %p", tty, dev);
1014
1015         if (!dev || !dev->dlc)
1016                 return 0;
1017
1018         if (!skb_queue_empty(&dev->dlc->tx_queue))
1019                 return dev->dlc->mtu;
1020
1021         return 0;
1022 }
1023
1024 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1025 {
1026         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1027
1028         BT_DBG("tty %p dev %p", tty, dev);
1029
1030         if (!dev || !dev->dlc)
1031                 return;
1032
1033         skb_queue_purge(&dev->dlc->tx_queue);
1034         tty_wakeup(tty);
1035 }
1036
1037 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1038 {
1039         BT_DBG("tty %p ch %c", tty, ch);
1040 }
1041
1042 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1043 {
1044         BT_DBG("tty %p timeout %d", tty, timeout);
1045 }
1046
1047 static void rfcomm_tty_hangup(struct tty_struct *tty)
1048 {
1049         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1050
1051         BT_DBG("tty %p dev %p", tty, dev);
1052
1053         tty_port_hangup(&dev->port);
1054 }
1055
1056 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1057 {
1058         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1059
1060         BT_DBG("tty %p dev %p", tty, dev);
1061
1062         return dev->modem_status;
1063 }
1064
1065 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1066 {
1067         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1068         struct rfcomm_dlc *dlc = dev->dlc;
1069         u8 v24_sig;
1070
1071         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1072
1073         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1074
1075         if (set & TIOCM_DSR || set & TIOCM_DTR)
1076                 v24_sig |= RFCOMM_V24_RTC;
1077         if (set & TIOCM_RTS || set & TIOCM_CTS)
1078                 v24_sig |= RFCOMM_V24_RTR;
1079         if (set & TIOCM_RI)
1080                 v24_sig |= RFCOMM_V24_IC;
1081         if (set & TIOCM_CD)
1082                 v24_sig |= RFCOMM_V24_DV;
1083
1084         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1085                 v24_sig &= ~RFCOMM_V24_RTC;
1086         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1087                 v24_sig &= ~RFCOMM_V24_RTR;
1088         if (clear & TIOCM_RI)
1089                 v24_sig &= ~RFCOMM_V24_IC;
1090         if (clear & TIOCM_CD)
1091                 v24_sig &= ~RFCOMM_V24_DV;
1092
1093         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1094
1095         return 0;
1096 }
1097
1098 /* ---- TTY structure ---- */
1099
1100 static const struct tty_operations rfcomm_ops = {
1101         .open                   = rfcomm_tty_open,
1102         .close                  = rfcomm_tty_close,
1103         .write                  = rfcomm_tty_write,
1104         .write_room             = rfcomm_tty_write_room,
1105         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1106         .flush_buffer           = rfcomm_tty_flush_buffer,
1107         .ioctl                  = rfcomm_tty_ioctl,
1108         .throttle               = rfcomm_tty_throttle,
1109         .unthrottle             = rfcomm_tty_unthrottle,
1110         .set_termios            = rfcomm_tty_set_termios,
1111         .send_xchar             = rfcomm_tty_send_xchar,
1112         .hangup                 = rfcomm_tty_hangup,
1113         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1114         .tiocmget               = rfcomm_tty_tiocmget,
1115         .tiocmset               = rfcomm_tty_tiocmset,
1116         .install                = rfcomm_tty_install,
1117         .cleanup                = rfcomm_tty_cleanup,
1118 };
1119
1120 int __init rfcomm_init_ttys(void)
1121 {
1122         int error;
1123
1124         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1125         if (!rfcomm_tty_driver)
1126                 return -ENOMEM;
1127
1128         rfcomm_tty_driver->driver_name  = "rfcomm";
1129         rfcomm_tty_driver->name         = "rfcomm";
1130         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1131         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1132         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1133         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1134         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1135         rfcomm_tty_driver->init_termios = tty_std_termios;
1136         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1137         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1138         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1139
1140         error = tty_register_driver(rfcomm_tty_driver);
1141         if (error) {
1142                 BT_ERR("Can't register RFCOMM TTY driver");
1143                 put_tty_driver(rfcomm_tty_driver);
1144                 return error;
1145         }
1146
1147         BT_INFO("RFCOMM TTY layer initialized");
1148
1149         return 0;
1150 }
1151
1152 void rfcomm_cleanup_ttys(void)
1153 {
1154         tty_unregister_driver(rfcomm_tty_driver);
1155         put_tty_driver(rfcomm_tty_driver);
1156 }