net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  40 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  41 #define RFCOMM_TTY_MINOR 0
  42
  43 static struct tty_driver *rfcomm_tty_driver;
  44
  45 struct rfcomm_dev {
  46         struct tty_port         port;
  47         struct list_head        list;
  48
  49         char                    name[12];
  50         int                     id;
  51         unsigned long           flags;
  52         int                     err;
  53
  54         unsigned long           status;         /* don't export to userspace */
  55
  56         bdaddr_t                src;
  57         bdaddr_t                dst;
  58         u8                      channel;
  59
  60         uint                    modem_status;
  61
  62         struct rfcomm_dlc       *dlc;
  63
  64         struct device           *tty_dev;
  65
  66         atomic_t                wmem_alloc;
  67
  68         struct sk_buff_head     pending;
  69 };
  70
  71 static LIST_HEAD(rfcomm_dev_list);
  72 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  73
  74 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  75 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  76 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  77
  78 /* ---- Device functions ---- */
  79
  80 static void rfcomm_dev_destruct(struct tty_port *port)
  81 {
  82         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  83         struct rfcomm_dlc *dlc = dev->dlc;
  84
  85         BT_DBG("dev %p dlc %p", dev, dlc);
  86
  87         rfcomm_dlc_lock(dlc);
  88         /* Detach DLC if it's owned by this dev */
  89         if (dlc->owner == dev)
  90                 dlc->owner = NULL;
  91         rfcomm_dlc_unlock(dlc);
  92
  93         rfcomm_dlc_put(dlc);
  94
  95         tty_unregister_device(rfcomm_tty_driver, dev->id);
  96
  97         spin_lock(&rfcomm_dev_lock);
  98         list_del(&dev->list);
  99         spin_unlock(&rfcomm_dev_lock);
 100
 101         kfree(dev);
 102
 103         /* It's safe to call module_put() here because socket still
 104            holds reference to this module. */
 105         module_put(THIS_MODULE);
 106 }
 107
 108 /* device-specific initialization: open the dlc */
 109 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
 110 {
 111         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 112
 113         return rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
 114 }
 115
 116 /* we block the open until the dlc->state becomes BT_CONNECTED */
 117 static int rfcomm_dev_carrier_raised(struct tty_port *port)
 118 {
 119         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 120
 121         return (dev->dlc->state == BT_CONNECTED);
 122 }
 123
 124 /* device-specific cleanup: close the dlc */
 125 static void rfcomm_dev_shutdown(struct tty_port *port)
 126 {
 127         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 128
 129         if (dev->tty_dev->parent)
 130                 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 131
 132         /* close the dlc */
 133         rfcomm_dlc_close(dev->dlc, 0);
 134 }
 135
 136 static const struct tty_port_operations rfcomm_port_ops = {
 137         .destruct = rfcomm_dev_destruct,
 138         .activate = rfcomm_dev_activate,
 139         .shutdown = rfcomm_dev_shutdown,
 140         .carrier_raised = rfcomm_dev_carrier_raised,
 141 };
 142
 143 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 144 {
 145         struct rfcomm_dev *dev;
 146
 147         list_for_each_entry(dev, &rfcomm_dev_list, list)
 148                 if (dev->id == id)
 149                         return dev;
 150
 151         return NULL;
 152 }
 153
 154 static struct rfcomm_dev *rfcomm_dev_get(int id)
 155 {
 156         struct rfcomm_dev *dev;
 157
 158         spin_lock(&rfcomm_dev_lock);
 159
 160         dev = __rfcomm_dev_get(id);
 161
 162         if (dev && !tty_port_get(&dev->port))
 163                 dev = NULL;
 164
 165         spin_unlock(&rfcomm_dev_lock);
 166
 167         return dev;
 168 }
 169
 170 static void rfcomm_reparent_device(struct rfcomm_dev *dev)
 171 {
 172         struct hci_dev *hdev;
 173         struct hci_conn *conn;
 174
 175         hdev = hci_get_route(&dev->dst, &dev->src);
 176         if (!hdev)
 177                 return;
 178
 179         /* The lookup results are unsafe to access without the
 180          * hci device lock (FIXME: why is this not documented?)
 181          */
 182         hci_dev_lock(hdev);
 183         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 184
 185         /* Just because the acl link is in the hash table is no
 186          * guarantee the sysfs device has been added ...
 187          */
 188         if (conn && device_is_registered(&conn->dev))
 189                 device_move(dev->tty_dev, &conn->dev, DPM_ORDER_DEV_AFTER_PARENT);
 190
 191         hci_dev_unlock(hdev);
 192         hci_dev_put(hdev);
 193 }
 194
 195 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 196 {
 197         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 198         return sprintf(buf, "%pMR\n", &dev->dst);
 199 }
 200
 201 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 202 {
 203         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 204         return sprintf(buf, "%d\n", dev->channel);
 205 }
 206
 207 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 208 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 209
 210 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 211 {
 212         struct rfcomm_dev *dev, *entry;
 213         struct list_head *head = &rfcomm_dev_list;
 214         int err = 0;
 215
 216         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 217
 218         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 219         if (!dev)
 220                 return -ENOMEM;
 221
 222         spin_lock(&rfcomm_dev_lock);
 223
 224         if (req->dev_id < 0) {
 225                 dev->id = 0;
 226
 227                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 228                         if (entry->id != dev->id)
 229                                 break;
 230
 231                         dev->id++;
 232                         head = &entry->list;
 233                 }
 234         } else {
 235                 dev->id = req->dev_id;
 236
 237                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 238                         if (entry->id == dev->id) {
 239                                 err = -EADDRINUSE;
 240                                 goto out;
 241                         }
 242
 243                         if (entry->id > dev->id - 1)
 244                                 break;
 245
 246                         head = &entry->list;
 247                 }
 248         }
 249
 250         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 251                 err = -ENFILE;
 252                 goto out;
 253         }
 254
 255         sprintf(dev->name, "rfcomm%d", dev->id);
 256
 257         list_add(&dev->list, head);
 258
 259         bacpy(&dev->src, &req->src);
 260         bacpy(&dev->dst, &req->dst);
 261         dev->channel = req->channel;
 262
 263         dev->flags = req->flags &
 264                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 265
 266         tty_port_init(&dev->port);
 267         dev->port.ops = &rfcomm_port_ops;
 268
 269         skb_queue_head_init(&dev->pending);
 270
 271         rfcomm_dlc_lock(dlc);
 272
 273         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 274                 struct sock *sk = dlc->owner;
 275                 struct sk_buff *skb;
 276
 277                 BUG_ON(!sk);
 278
 279                 rfcomm_dlc_throttle(dlc);
 280
 281                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 282                         skb_orphan(skb);
 283                         skb_queue_tail(&dev->pending, skb);
 284                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 285                 }
 286         }
 287
 288         dlc->data_ready   = rfcomm_dev_data_ready;
 289         dlc->state_change = rfcomm_dev_state_change;
 290         dlc->modem_status = rfcomm_dev_modem_status;
 291
 292         dlc->owner = dev;
 293         dev->dlc   = dlc;
 294
 295         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 296
 297         rfcomm_dlc_unlock(dlc);
 298
 299         /* It's safe to call __module_get() here because socket already
 300            holds reference to this module. */
 301         __module_get(THIS_MODULE);
 302
 303 out:
 304         spin_unlock(&rfcomm_dev_lock);
 305
 306         if (err < 0)
 307                 goto free;
 308
 309         dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
 310                         dev->id, NULL);
 311         if (IS_ERR(dev->tty_dev)) {
 312                 err = PTR_ERR(dev->tty_dev);
 313                 spin_lock(&rfcomm_dev_lock);
 314                 list_del(&dev->list);
 315                 spin_unlock(&rfcomm_dev_lock);
 316                 goto free;
 317         }
 318
 319         dev_set_drvdata(dev->tty_dev, dev);
 320
 321         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 322                 BT_ERR("Failed to create address attribute");
 323
 324         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 325                 BT_ERR("Failed to create channel attribute");
 326
 327         return dev->id;
 328
 329 free:
 330         kfree(dev);
 331         return err;
 332 }
 333
 334 /* ---- Send buffer ---- */
 335 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 336 {
 337         /* We can't let it be zero, because we don't get a callback
 338            when tx_credits becomes nonzero, hence we'd never wake up */
 339         return dlc->mtu * (dlc->tx_credits?:1);
 340 }
 341
 342 static void rfcomm_wfree(struct sk_buff *skb)
 343 {
 344         struct rfcomm_dev *dev = (void *) skb->sk;
 345         atomic_sub(skb->truesize, &dev->wmem_alloc);
 346         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 347                 tty_port_tty_wakeup(&dev->port);
 348         tty_port_put(&dev->port);
 349 }
 350
 351 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 352 {
 353         tty_port_get(&dev->port);
 354         atomic_add(skb->truesize, &dev->wmem_alloc);
 355         skb->sk = (void *) dev;
 356         skb->destructor = rfcomm_wfree;
 357 }
 358
 359 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 360 {
 361         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 362                 struct sk_buff *skb = alloc_skb(size, priority);
 363                 if (skb) {
 364                         rfcomm_set_owner_w(skb, dev);
 365                         return skb;
 366                 }
 367         }
 368         return NULL;
 369 }
 370
 371 /* ---- Device IOCTLs ---- */
 372
 373 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 374
 375 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 376 {
 377         struct rfcomm_dev_req req;
 378         struct rfcomm_dlc *dlc;
 379         int id;
 380
 381         if (copy_from_user(&req, arg, sizeof(req)))
 382                 return -EFAULT;
 383
 384         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 385
 386         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 387                 return -EPERM;
 388
 389         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 390                 /* Socket must be connected */
 391                 if (sk->sk_state != BT_CONNECTED)
 392                         return -EBADFD;
 393
 394                 dlc = rfcomm_pi(sk)->dlc;
 395                 rfcomm_dlc_hold(dlc);
 396         } else {
 397                 /* Validate the channel is unused */
 398                 dlc = rfcomm_dlc_exists(&req.src, &req.dst, req.channel);
 399                 if (IS_ERR(dlc))
 400                         return PTR_ERR(dlc);
 401                 else if (dlc) {
 402                         rfcomm_dlc_put(dlc);
 403                         return -EBUSY;
 404                 }
 405                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 406                 if (!dlc)
 407                         return -ENOMEM;
 408         }
 409
 410         id = rfcomm_dev_add(&req, dlc);
 411         if (id < 0) {
 412                 rfcomm_dlc_put(dlc);
 413                 return id;
 414         }
 415
 416         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 417                 /* DLC is now used by device.
 418                  * Socket must be disconnected */
 419                 sk->sk_state = BT_CLOSED;
 420         }
 421
 422         return id;
 423 }
 424
 425 static int rfcomm_release_dev(void __user *arg)
 426 {
 427         struct rfcomm_dev_req req;
 428         struct rfcomm_dev *dev;
 429         struct tty_struct *tty;
 430
 431         if (copy_from_user(&req, arg, sizeof(req)))
 432                 return -EFAULT;
 433
 434         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 435
 436         dev = rfcomm_dev_get(req.dev_id);
 437         if (!dev)
 438                 return -ENODEV;
 439
 440         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 441                 tty_port_put(&dev->port);
 442                 return -EPERM;
 443         }
 444
 445         /* only release once */
 446         if (test_and_set_bit(RFCOMM_DEV_RELEASED, &dev->status)) {
 447                 tty_port_put(&dev->port);
 448                 return -EALREADY;
 449         }
 450
 451         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 452                 rfcomm_dlc_close(dev->dlc, 0);
 453
 454         /* Shut down TTY synchronously before freeing rfcomm_dev */
 455         tty = tty_port_tty_get(&dev->port);
 456         if (tty) {
 457                 tty_vhangup(tty);
 458                 tty_kref_put(tty);
 459         }
 460
 461         if (!test_bit(RFCOMM_TTY_OWNED, &dev->status))
 462                 tty_port_put(&dev->port);
 463
 464         tty_port_put(&dev->port);
 465         return 0;
 466 }
 467
 468 static int rfcomm_get_dev_list(void __user *arg)
 469 {
 470         struct rfcomm_dev *dev;
 471         struct rfcomm_dev_list_req *dl;
 472         struct rfcomm_dev_info *di;
 473         int n = 0, size, err;
 474         u16 dev_num;
 475
 476         BT_DBG("");
 477
 478         if (get_user(dev_num, (u16 __user *) arg))
 479                 return -EFAULT;
 480
 481         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 482                 return -EINVAL;
 483
 484         size = sizeof(*dl) + dev_num * sizeof(*di);
 485
 486         dl = kzalloc(size, GFP_KERNEL);
 487         if (!dl)
 488                 return -ENOMEM;
 489
 490         di = dl->dev_info;
 491
 492         spin_lock(&rfcomm_dev_lock);
 493
 494         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 495                 if (!tty_port_get(&dev->port))
 496                         continue;
 497                 (di + n)->id      = dev->id;
 498                 (di + n)->flags   = dev->flags;
 499                 (di + n)->state   = dev->dlc->state;
 500                 (di + n)->channel = dev->channel;
 501                 bacpy(&(di + n)->src, &dev->src);
 502                 bacpy(&(di + n)->dst, &dev->dst);
 503                 tty_port_put(&dev->port);
 504                 if (++n >= dev_num)
 505                         break;
 506         }
 507
 508         spin_unlock(&rfcomm_dev_lock);
 509
 510         dl->dev_num = n;
 511         size = sizeof(*dl) + n * sizeof(*di);
 512
 513         err = copy_to_user(arg, dl, size);
 514         kfree(dl);
 515
 516         return err ? -EFAULT : 0;
 517 }
 518
 519 static int rfcomm_get_dev_info(void __user *arg)
 520 {
 521         struct rfcomm_dev *dev;
 522         struct rfcomm_dev_info di;
 523         int err = 0;
 524
 525         BT_DBG("");
 526
 527         if (copy_from_user(&di, arg, sizeof(di)))
 528                 return -EFAULT;
 529
 530         dev = rfcomm_dev_get(di.id);
 531         if (!dev)
 532                 return -ENODEV;
 533
 534         di.flags   = dev->flags;
 535         di.channel = dev->channel;
 536         di.state   = dev->dlc->state;
 537         bacpy(&di.src, &dev->src);
 538         bacpy(&di.dst, &dev->dst);
 539
 540         if (copy_to_user(arg, &di, sizeof(di)))
 541                 err = -EFAULT;
 542
 543         tty_port_put(&dev->port);
 544         return err;
 545 }
 546
 547 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 548 {
 549         BT_DBG("cmd %d arg %p", cmd, arg);
 550
 551         switch (cmd) {
 552         case RFCOMMCREATEDEV:
 553                 return rfcomm_create_dev(sk, arg);
 554
 555         case RFCOMMRELEASEDEV:
 556                 return rfcomm_release_dev(arg);
 557
 558         case RFCOMMGETDEVLIST:
 559                 return rfcomm_get_dev_list(arg);
 560
 561         case RFCOMMGETDEVINFO:
 562                 return rfcomm_get_dev_info(arg);
 563         }
 564
 565         return -EINVAL;
 566 }
 567
 568 /* ---- DLC callbacks ---- */
 569 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 570 {
 571         struct rfcomm_dev *dev = dlc->owner;
 572
 573         if (!dev) {
 574                 kfree_skb(skb);
 575                 return;
 576         }
 577
 578         if (!skb_queue_empty(&dev->pending)) {
 579                 skb_queue_tail(&dev->pending, skb);
 580                 return;
 581         }
 582
 583         BT_DBG("dlc %p len %d", dlc, skb->len);
 584
 585         tty_insert_flip_string(&dev->port, skb->data, skb->len);
 586         tty_flip_buffer_push(&dev->port);
 587
 588         kfree_skb(skb);
 589 }
 590
 591 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 592 {
 593         struct rfcomm_dev *dev = dlc->owner;
 594         if (!dev)
 595                 return;
 596
 597         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 598
 599         dev->err = err;
 600         if (dlc->state == BT_CONNECTED) {
 601                 rfcomm_reparent_device(dev);
 602
 603                 wake_up_interruptible(&dev->port.open_wait);
 604         } else if (dlc->state == BT_CLOSED)
 605                 tty_port_tty_hangup(&dev->port, false);
 606 }
 607
 608 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 609 {
 610         struct rfcomm_dev *dev = dlc->owner;
 611         if (!dev)
 612                 return;
 613
 614         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 615
 616         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
 617                 tty_port_tty_hangup(&dev->port, true);
 618
 619         dev->modem_status =
 620                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 621                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 622                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 623                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 624 }
 625
 626 /* ---- TTY functions ---- */
 627 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 628 {
 629         struct sk_buff *skb;
 630         int inserted = 0;
 631
 632         BT_DBG("dev %p", dev);
 633
 634         rfcomm_dlc_lock(dev->dlc);
 635
 636         while ((skb = skb_dequeue(&dev->pending))) {
 637                 inserted += tty_insert_flip_string(&dev->port, skb->data,
 638                                 skb->len);
 639                 kfree_skb(skb);
 640         }
 641
 642         rfcomm_dlc_unlock(dev->dlc);
 643
 644         if (inserted > 0)
 645                 tty_flip_buffer_push(&dev->port);
 646 }
 647
 648 /* do the reverse of install, clearing the tty fields and releasing the
 649  * reference to tty_port
 650  */
 651 static void rfcomm_tty_cleanup(struct tty_struct *tty)
 652 {
 653         struct rfcomm_dev *dev = tty->driver_data;
 654
 655         clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 656
 657         rfcomm_dlc_lock(dev->dlc);
 658         tty->driver_data = NULL;
 659         rfcomm_dlc_unlock(dev->dlc);
 660
 661         /*
 662          * purge the dlc->tx_queue to avoid circular dependencies
 663          * between dev and dlc
 664          */
 665         skb_queue_purge(&dev->dlc->tx_queue);
 666
 667         tty_port_put(&dev->port);
 668 }
 669
 670 /* we acquire the tty_port reference since it's here the tty is first used
 671  * by setting the termios. We also populate the driver_data field and install
 672  * the tty port
 673  */
 674 static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
 675 {
 676         struct rfcomm_dev *dev;
 677         struct rfcomm_dlc *dlc;
 678         int err;
 679
 680         dev = rfcomm_dev_get(tty->index);
 681         if (!dev)
 682                 return -ENODEV;
 683
 684         dlc = dev->dlc;
 685
 686         /* Attach TTY and open DLC */
 687         rfcomm_dlc_lock(dlc);
 688         tty->driver_data = dev;
 689         rfcomm_dlc_unlock(dlc);
 690         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 691
 692         /* install the tty_port */
 693         err = tty_port_install(&dev->port, driver, tty);
 694         if (err) {
 695                 rfcomm_tty_cleanup(tty);
 696                 return err;
 697         }
 698
 699         /* take over the tty_port reference if the port was created with the
 700          * flag RFCOMM_RELEASE_ONHUP. This will force the release of the port
 701          * when the last process closes the tty. The behaviour is expected by
 702          * userspace.
 703          */
 704         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 705                 set_bit(RFCOMM_TTY_OWNED, &dev->status);
 706                 tty_port_put(&dev->port);
 707         }
 708
 709         return 0;
 710 }
 711
 712 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 713 {
 714         struct rfcomm_dev *dev = tty->driver_data;
 715         int err;
 716
 717         BT_DBG("tty %p id %d", tty, tty->index);
 718
 719         BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
 720                dev->channel, dev->port.count);
 721
 722         err = tty_port_open(&dev->port, tty, filp);
 723         if (err)
 724                 return err;
 725
 726         /*
 727          * FIXME: rfcomm should use proper flow control for
 728          * received data. This hack will be unnecessary and can
 729          * be removed when that's implemented
 730          */
 731         rfcomm_tty_copy_pending(dev);
 732
 733         rfcomm_dlc_unthrottle(dev->dlc);
 734
 735         return 0;
 736 }
 737
 738 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 739 {
 740         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 741
 742         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 743                                                 dev->port.count);
 744
 745         tty_port_close(&dev->port, tty, filp);
 746 }
 747
 748 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 749 {
 750         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 751         struct rfcomm_dlc *dlc = dev->dlc;
 752         struct sk_buff *skb;
 753         int err = 0, sent = 0, size;
 754
 755         BT_DBG("tty %p count %d", tty, count);
 756
 757         while (count) {
 758                 size = min_t(uint, count, dlc->mtu);
 759
 760                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 761
 762                 if (!skb)
 763                         break;
 764
 765                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 766
 767                 memcpy(skb_put(skb, size), buf + sent, size);
 768
 769                 err = rfcomm_dlc_send(dlc, skb);
 770                 if (err < 0) {
 771                         kfree_skb(skb);
 772                         break;
 773                 }
 774
 775                 sent  += size;
 776                 count -= size;
 777         }
 778
 779         return sent ? sent : err;
 780 }
 781
 782 static int rfcomm_tty_write_room(struct tty_struct *tty)
 783 {
 784         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 785         int room;
 786
 787         BT_DBG("tty %p", tty);
 788
 789         if (!dev || !dev->dlc)
 790                 return 0;
 791
 792         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 793         if (room < 0)
 794                 room = 0;
 795
 796         return room;
 797 }
 798
 799 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 800 {
 801         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 802
 803         switch (cmd) {
 804         case TCGETS:
 805                 BT_DBG("TCGETS is not supported");
 806                 return -ENOIOCTLCMD;
 807
 808         case TCSETS:
 809                 BT_DBG("TCSETS is not supported");
 810                 return -ENOIOCTLCMD;
 811
 812         case TIOCMIWAIT:
 813                 BT_DBG("TIOCMIWAIT");
 814                 break;
 815
 816         case TIOCGSERIAL:
 817                 BT_ERR("TIOCGSERIAL is not supported");
 818                 return -ENOIOCTLCMD;
 819
 820         case TIOCSSERIAL:
 821                 BT_ERR("TIOCSSERIAL is not supported");
 822                 return -ENOIOCTLCMD;
 823
 824         case TIOCSERGSTRUCT:
 825                 BT_ERR("TIOCSERGSTRUCT is not supported");
 826                 return -ENOIOCTLCMD;
 827
 828         case TIOCSERGETLSR:
 829                 BT_ERR("TIOCSERGETLSR is not supported");
 830                 return -ENOIOCTLCMD;
 831
 832         case TIOCSERCONFIG:
 833                 BT_ERR("TIOCSERCONFIG is not supported");
 834                 return -ENOIOCTLCMD;
 835
 836         default:
 837                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 838
 839         }
 840
 841         return -ENOIOCTLCMD;
 842 }
 843
 844 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 845 {
 846         struct ktermios *new = &tty->termios;
 847         int old_baud_rate = tty_termios_baud_rate(old);
 848         int new_baud_rate = tty_termios_baud_rate(new);
 849
 850         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 851         u16 changes = 0;
 852
 853         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 854
 855         BT_DBG("tty %p termios %p", tty, old);
 856
 857         if (!dev || !dev->dlc || !dev->dlc->session)
 858                 return;
 859
 860         /* Handle turning off CRTSCTS */
 861         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 862                 BT_DBG("Turning off CRTSCTS unsupported");
 863
 864         /* Parity on/off and when on, odd/even */
 865         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 866                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 867                 changes |= RFCOMM_RPN_PM_PARITY;
 868                 BT_DBG("Parity change detected.");
 869         }
 870
 871         /* Mark and space parity are not supported! */
 872         if (new->c_cflag & PARENB) {
 873                 if (new->c_cflag & PARODD) {
 874                         BT_DBG("Parity is ODD");
 875                         parity = RFCOMM_RPN_PARITY_ODD;
 876                 } else {
 877                         BT_DBG("Parity is EVEN");
 878                         parity = RFCOMM_RPN_PARITY_EVEN;
 879                 }
 880         } else {
 881                 BT_DBG("Parity is OFF");
 882                 parity = RFCOMM_RPN_PARITY_NONE;
 883         }
 884
 885         /* Setting the x_on / x_off characters */
 886         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 887                 BT_DBG("XOFF custom");
 888                 x_on = new->c_cc[VSTOP];
 889                 changes |= RFCOMM_RPN_PM_XON;
 890         } else {
 891                 BT_DBG("XOFF default");
 892                 x_on = RFCOMM_RPN_XON_CHAR;
 893         }
 894
 895         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 896                 BT_DBG("XON custom");
 897                 x_off = new->c_cc[VSTART];
 898                 changes |= RFCOMM_RPN_PM_XOFF;
 899         } else {
 900                 BT_DBG("XON default");
 901                 x_off = RFCOMM_RPN_XOFF_CHAR;
 902         }
 903
 904         /* Handle setting of stop bits */
 905         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 906                 changes |= RFCOMM_RPN_PM_STOP;
 907
 908         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 909          * support 2 stop bits. So a request for 2 stop bits gets
 910          * translated to 1.5 stop bits */
 911         if (new->c_cflag & CSTOPB)
 912                 stop_bits = RFCOMM_RPN_STOP_15;
 913         else
 914                 stop_bits = RFCOMM_RPN_STOP_1;
 915
 916         /* Handle number of data bits [5-8] */
 917         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 918                 changes |= RFCOMM_RPN_PM_DATA;
 919
 920         switch (new->c_cflag & CSIZE) {
 921         case CS5:
 922                 data_bits = RFCOMM_RPN_DATA_5;
 923                 break;
 924         case CS6:
 925                 data_bits = RFCOMM_RPN_DATA_6;
 926                 break;
 927         case CS7:
 928                 data_bits = RFCOMM_RPN_DATA_7;
 929                 break;
 930         case CS8:
 931                 data_bits = RFCOMM_RPN_DATA_8;
 932                 break;
 933         default:
 934                 data_bits = RFCOMM_RPN_DATA_8;
 935                 break;
 936         }
 937
 938         /* Handle baudrate settings */
 939         if (old_baud_rate != new_baud_rate)
 940                 changes |= RFCOMM_RPN_PM_BITRATE;
 941
 942         switch (new_baud_rate) {
 943         case 2400:
 944                 baud = RFCOMM_RPN_BR_2400;
 945                 break;
 946         case 4800:
 947                 baud = RFCOMM_RPN_BR_4800;
 948                 break;
 949         case 7200:
 950                 baud = RFCOMM_RPN_BR_7200;
 951                 break;
 952         case 9600:
 953                 baud = RFCOMM_RPN_BR_9600;
 954                 break;
 955         case 19200:
 956                 baud = RFCOMM_RPN_BR_19200;
 957                 break;
 958         case 38400:
 959                 baud = RFCOMM_RPN_BR_38400;
 960                 break;
 961         case 57600:
 962                 baud = RFCOMM_RPN_BR_57600;
 963                 break;
 964         case 115200:
 965                 baud = RFCOMM_RPN_BR_115200;
 966                 break;
 967         case 230400:
 968                 baud = RFCOMM_RPN_BR_230400;
 969                 break;
 970         default:
 971                 /* 9600 is standard accordinag to the RFCOMM specification */
 972                 baud = RFCOMM_RPN_BR_9600;
 973                 break;
 974
 975         }
 976
 977         if (changes)
 978                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 979                                 data_bits, stop_bits, parity,
 980                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 981 }
 982
 983 static void rfcomm_tty_throttle(struct tty_struct *tty)
 984 {
 985         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 986
 987         BT_DBG("tty %p dev %p", tty, dev);
 988
 989         rfcomm_dlc_throttle(dev->dlc);
 990 }
 991
 992 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 993 {
 994         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 995
 996         BT_DBG("tty %p dev %p", tty, dev);
 997
 998         rfcomm_dlc_unthrottle(dev->dlc);
 999 }
1000
1001 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1002 {
1003         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1004
1005         BT_DBG("tty %p dev %p", tty, dev);
1006
1007         if (!dev || !dev->dlc)
1008                 return 0;
1009
1010         if (!skb_queue_empty(&dev->dlc->tx_queue))
1011                 return dev->dlc->mtu;
1012
1013         return 0;
1014 }
1015
1016 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1017 {
1018         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1019
1020         BT_DBG("tty %p dev %p", tty, dev);
1021
1022         if (!dev || !dev->dlc)
1023                 return;
1024
1025         skb_queue_purge(&dev->dlc->tx_queue);
1026         tty_wakeup(tty);
1027 }
1028
1029 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1030 {
1031         BT_DBG("tty %p ch %c", tty, ch);
1032 }
1033
1034 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1035 {
1036         BT_DBG("tty %p timeout %d", tty, timeout);
1037 }
1038
1039 static void rfcomm_tty_hangup(struct tty_struct *tty)
1040 {
1041         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1042
1043         BT_DBG("tty %p dev %p", tty, dev);
1044
1045         tty_port_hangup(&dev->port);
1046 }
1047
1048 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1049 {
1050         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1051
1052         BT_DBG("tty %p dev %p", tty, dev);
1053
1054         return dev->modem_status;
1055 }
1056
1057 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1058 {
1059         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1060         struct rfcomm_dlc *dlc = dev->dlc;
1061         u8 v24_sig;
1062
1063         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1064
1065         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1066
1067         if (set & TIOCM_DSR || set & TIOCM_DTR)
1068                 v24_sig |= RFCOMM_V24_RTC;
1069         if (set & TIOCM_RTS || set & TIOCM_CTS)
1070                 v24_sig |= RFCOMM_V24_RTR;
1071         if (set & TIOCM_RI)
1072                 v24_sig |= RFCOMM_V24_IC;
1073         if (set & TIOCM_CD)
1074                 v24_sig |= RFCOMM_V24_DV;
1075
1076         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1077                 v24_sig &= ~RFCOMM_V24_RTC;
1078         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1079                 v24_sig &= ~RFCOMM_V24_RTR;
1080         if (clear & TIOCM_RI)
1081                 v24_sig &= ~RFCOMM_V24_IC;
1082         if (clear & TIOCM_CD)
1083                 v24_sig &= ~RFCOMM_V24_DV;
1084
1085         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1086
1087         return 0;
1088 }
1089
1090 /* ---- TTY structure ---- */
1091
1092 static const struct tty_operations rfcomm_ops = {
1093         .open                   = rfcomm_tty_open,
1094         .close                  = rfcomm_tty_close,
1095         .write                  = rfcomm_tty_write,
1096         .write_room             = rfcomm_tty_write_room,
1097         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1098         .flush_buffer           = rfcomm_tty_flush_buffer,
1099         .ioctl                  = rfcomm_tty_ioctl,
1100         .throttle               = rfcomm_tty_throttle,
1101         .unthrottle             = rfcomm_tty_unthrottle,
1102         .set_termios            = rfcomm_tty_set_termios,
1103         .send_xchar             = rfcomm_tty_send_xchar,
1104         .hangup                 = rfcomm_tty_hangup,
1105         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1106         .tiocmget               = rfcomm_tty_tiocmget,
1107         .tiocmset               = rfcomm_tty_tiocmset,
1108         .install                = rfcomm_tty_install,
1109         .cleanup                = rfcomm_tty_cleanup,
1110 };
1111
1112 int __init rfcomm_init_ttys(void)
1113 {
1114         int error;
1115
1116         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1117         if (!rfcomm_tty_driver)
1118                 return -ENOMEM;
1119
1120         rfcomm_tty_driver->driver_name  = "rfcomm";
1121         rfcomm_tty_driver->name         = "rfcomm";
1122         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1123         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1124         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1125         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1126         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1127         rfcomm_tty_driver->init_termios = tty_std_termios;
1128         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
1129         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1130         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1131
1132         error = tty_register_driver(rfcomm_tty_driver);
1133         if (error) {
1134                 BT_ERR("Can't register RFCOMM TTY driver");
1135                 put_tty_driver(rfcomm_tty_driver);
1136                 return error;
1137         }
1138
1139         BT_INFO("RFCOMM TTY layer initialized");
1140
1141         return 0;
1142 }
1143
1144 void rfcomm_cleanup_ttys(void)
1145 {
1146         tty_unregister_driver(rfcomm_tty_driver);
1147         put_tty_driver(rfcomm_tty_driver);
1148 }