net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  40 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  41 #define RFCOMM_TTY_MINOR 0
  42
  43 static struct tty_driver *rfcomm_tty_driver;
  44
  45 struct rfcomm_dev {
  46         struct tty_port         port;
  47         struct list_head        list;
  48
  49         char                    name[12];
  50         int                     id;
  51         unsigned long           flags;
  52         int                     err;
  53
  54         unsigned long           status;         /* don't export to userspace */
  55
  56         bdaddr_t                src;
  57         bdaddr_t                dst;
  58         u8                      channel;
  59
  60         uint                    modem_status;
  61
  62         struct rfcomm_dlc       *dlc;
  63
  64         struct device           *tty_dev;
  65
  66         atomic_t                wmem_alloc;
  67
  68         struct sk_buff_head     pending;
  69 };
  70
  71 static LIST_HEAD(rfcomm_dev_list);
  72 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  73
  74 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  75 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  76 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  77
  78 /* ---- Device functions ---- */
  79
  80 static void rfcomm_dev_destruct(struct tty_port *port)
  81 {
  82         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  83         struct rfcomm_dlc *dlc = dev->dlc;
  84
  85         BT_DBG("dev %p dlc %p", dev, dlc);
  86
  87         rfcomm_dlc_lock(dlc);
  88         /* Detach DLC if it's owned by this dev */
  89         if (dlc->owner == dev)
  90                 dlc->owner = NULL;
  91         rfcomm_dlc_unlock(dlc);
  92
  93         rfcomm_dlc_put(dlc);
  94
  95         tty_unregister_device(rfcomm_tty_driver, dev->id);
  96
  97         spin_lock(&rfcomm_dev_lock);
  98         list_del(&dev->list);
  99         spin_unlock(&rfcomm_dev_lock);
 100
 101         kfree(dev);
 102
 103         /* It's safe to call module_put() here because socket still
 104            holds reference to this module. */
 105         module_put(THIS_MODULE);
 106 }
 107
 108 /* device-specific initialization: open the dlc */
 109 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
 110 {
 111         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 112
 113         return rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
 114 }
 115
 116 /* we block the open until the dlc->state becomes BT_CONNECTED */
 117 static int rfcomm_dev_carrier_raised(struct tty_port *port)
 118 {
 119         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 120
 121         return (dev->dlc->state == BT_CONNECTED);
 122 }
 123
 124 /* device-specific cleanup: close the dlc */
 125 static void rfcomm_dev_shutdown(struct tty_port *port)
 126 {
 127         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 128
 129         if (dev->tty_dev->parent)
 130                 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 131
 132         /* close the dlc */
 133         rfcomm_dlc_close(dev->dlc, 0);
 134 }
 135
 136 static const struct tty_port_operations rfcomm_port_ops = {
 137         .destruct = rfcomm_dev_destruct,
 138         .activate = rfcomm_dev_activate,
 139         .shutdown = rfcomm_dev_shutdown,
 140         .carrier_raised = rfcomm_dev_carrier_raised,
 141 };
 142
 143 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 144 {
 145         struct rfcomm_dev *dev;
 146
 147         list_for_each_entry(dev, &rfcomm_dev_list, list)
 148                 if (dev->id == id)
 149                         return dev;
 150
 151         return NULL;
 152 }
 153
 154 static struct rfcomm_dev *rfcomm_dev_get(int id)
 155 {
 156         struct rfcomm_dev *dev;
 157
 158         spin_lock(&rfcomm_dev_lock);
 159
 160         dev = __rfcomm_dev_get(id);
 161
 162         if (dev && !tty_port_get(&dev->port))
 163                 dev = NULL;
 164
 165         spin_unlock(&rfcomm_dev_lock);
 166
 167         return dev;
 168 }
 169
 170 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 171 {
 172         struct hci_dev *hdev;
 173         struct hci_conn *conn;
 174
 175         hdev = hci_get_route(&dev->dst, &dev->src);
 176         if (!hdev)
 177                 return NULL;
 178
 179         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 180
 181         hci_dev_put(hdev);
 182
 183         return conn ? &conn->dev : NULL;
 184 }
 185
 186 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 187 {
 188         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 189         return sprintf(buf, "%pMR\n", &dev->dst);
 190 }
 191
 192 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 193 {
 194         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 195         return sprintf(buf, "%d\n", dev->channel);
 196 }
 197
 198 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 199 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 200
 201 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 202 {
 203         struct rfcomm_dev *dev, *entry;
 204         struct list_head *head = &rfcomm_dev_list;
 205         int err = 0;
 206
 207         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 208
 209         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 210         if (!dev)
 211                 return -ENOMEM;
 212
 213         spin_lock(&rfcomm_dev_lock);
 214
 215         if (req->dev_id < 0) {
 216                 dev->id = 0;
 217
 218                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 219                         if (entry->id != dev->id)
 220                                 break;
 221
 222                         dev->id++;
 223                         head = &entry->list;
 224                 }
 225         } else {
 226                 dev->id = req->dev_id;
 227
 228                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 229                         if (entry->id == dev->id) {
 230                                 err = -EADDRINUSE;
 231                                 goto out;
 232                         }
 233
 234                         if (entry->id > dev->id - 1)
 235                                 break;
 236
 237                         head = &entry->list;
 238                 }
 239         }
 240
 241         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 242                 err = -ENFILE;
 243                 goto out;
 244         }
 245
 246         sprintf(dev->name, "rfcomm%d", dev->id);
 247
 248         list_add(&dev->list, head);
 249
 250         bacpy(&dev->src, &req->src);
 251         bacpy(&dev->dst, &req->dst);
 252         dev->channel = req->channel;
 253
 254         dev->flags = req->flags &
 255                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 256
 257         tty_port_init(&dev->port);
 258         dev->port.ops = &rfcomm_port_ops;
 259
 260         skb_queue_head_init(&dev->pending);
 261
 262         rfcomm_dlc_lock(dlc);
 263
 264         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 265                 struct sock *sk = dlc->owner;
 266                 struct sk_buff *skb;
 267
 268                 BUG_ON(!sk);
 269
 270                 rfcomm_dlc_throttle(dlc);
 271
 272                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 273                         skb_orphan(skb);
 274                         skb_queue_tail(&dev->pending, skb);
 275                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 276                 }
 277         }
 278
 279         dlc->data_ready   = rfcomm_dev_data_ready;
 280         dlc->state_change = rfcomm_dev_state_change;
 281         dlc->modem_status = rfcomm_dev_modem_status;
 282
 283         dlc->owner = dev;
 284         dev->dlc   = dlc;
 285
 286         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 287
 288         rfcomm_dlc_unlock(dlc);
 289
 290         /* It's safe to call __module_get() here because socket already
 291            holds reference to this module. */
 292         __module_get(THIS_MODULE);
 293
 294 out:
 295         spin_unlock(&rfcomm_dev_lock);
 296
 297         if (err < 0)
 298                 goto free;
 299
 300         dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
 301                         dev->id, NULL);
 302         if (IS_ERR(dev->tty_dev)) {
 303                 err = PTR_ERR(dev->tty_dev);
 304                 spin_lock(&rfcomm_dev_lock);
 305                 list_del(&dev->list);
 306                 spin_unlock(&rfcomm_dev_lock);
 307                 goto free;
 308         }
 309
 310         dev_set_drvdata(dev->tty_dev, dev);
 311
 312         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 313                 BT_ERR("Failed to create address attribute");
 314
 315         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 316                 BT_ERR("Failed to create channel attribute");
 317
 318         return dev->id;
 319
 320 free:
 321         kfree(dev);
 322         return err;
 323 }
 324
 325 /* ---- Send buffer ---- */
 326 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 327 {
 328         /* We can't let it be zero, because we don't get a callback
 329            when tx_credits becomes nonzero, hence we'd never wake up */
 330         return dlc->mtu * (dlc->tx_credits?:1);
 331 }
 332
 333 static void rfcomm_wfree(struct sk_buff *skb)
 334 {
 335         struct rfcomm_dev *dev = (void *) skb->sk;
 336         atomic_sub(skb->truesize, &dev->wmem_alloc);
 337         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 338                 tty_port_tty_wakeup(&dev->port);
 339         tty_port_put(&dev->port);
 340 }
 341
 342 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 343 {
 344         tty_port_get(&dev->port);
 345         atomic_add(skb->truesize, &dev->wmem_alloc);
 346         skb->sk = (void *) dev;
 347         skb->destructor = rfcomm_wfree;
 348 }
 349
 350 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 351 {
 352         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 353                 struct sk_buff *skb = alloc_skb(size, priority);
 354                 if (skb) {
 355                         rfcomm_set_owner_w(skb, dev);
 356                         return skb;
 357                 }
 358         }
 359         return NULL;
 360 }
 361
 362 /* ---- Device IOCTLs ---- */
 363
 364 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 365
 366 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 367 {
 368         struct rfcomm_dev_req req;
 369         struct rfcomm_dlc *dlc;
 370         int id;
 371
 372         if (copy_from_user(&req, arg, sizeof(req)))
 373                 return -EFAULT;
 374
 375         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 376
 377         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 378                 return -EPERM;
 379
 380         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 381                 /* Socket must be connected */
 382                 if (sk->sk_state != BT_CONNECTED)
 383                         return -EBADFD;
 384
 385                 dlc = rfcomm_pi(sk)->dlc;
 386                 rfcomm_dlc_hold(dlc);
 387         } else {
 388                 /* Validate the channel is unused */
 389                 dlc = rfcomm_dlc_exists(&req.src, &req.dst, req.channel);
 390                 if (IS_ERR(dlc))
 391                         return PTR_ERR(dlc);
 392                 else if (dlc) {
 393                         rfcomm_dlc_put(dlc);
 394                         return -EBUSY;
 395                 }
 396                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 397                 if (!dlc)
 398                         return -ENOMEM;
 399         }
 400
 401         id = rfcomm_dev_add(&req, dlc);
 402         if (id < 0) {
 403                 rfcomm_dlc_put(dlc);
 404                 return id;
 405         }
 406
 407         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 408                 /* DLC is now used by device.
 409                  * Socket must be disconnected */
 410                 sk->sk_state = BT_CLOSED;
 411         }
 412
 413         return id;
 414 }
 415
 416 static int rfcomm_release_dev(void __user *arg)
 417 {
 418         struct rfcomm_dev_req req;
 419         struct rfcomm_dev *dev;
 420         struct tty_struct *tty;
 421
 422         if (copy_from_user(&req, arg, sizeof(req)))
 423                 return -EFAULT;
 424
 425         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 426
 427         dev = rfcomm_dev_get(req.dev_id);
 428         if (!dev)
 429                 return -ENODEV;
 430
 431         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 432                 tty_port_put(&dev->port);
 433                 return -EPERM;
 434         }
 435
 436         /* only release once */
 437         if (test_and_set_bit(RFCOMM_DEV_RELEASED, &dev->status)) {
 438                 tty_port_put(&dev->port);
 439                 return -EALREADY;
 440         }
 441
 442         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 443                 rfcomm_dlc_close(dev->dlc, 0);
 444
 445         /* Shut down TTY synchronously before freeing rfcomm_dev */
 446         tty = tty_port_tty_get(&dev->port);
 447         if (tty) {
 448                 tty_vhangup(tty);
 449                 tty_kref_put(tty);
 450         }
 451
 452         if (!test_bit(RFCOMM_TTY_OWNED, &dev->status))
 453                 tty_port_put(&dev->port);
 454
 455         tty_port_put(&dev->port);
 456         return 0;
 457 }
 458
 459 static int rfcomm_get_dev_list(void __user *arg)
 460 {
 461         struct rfcomm_dev *dev;
 462         struct rfcomm_dev_list_req *dl;
 463         struct rfcomm_dev_info *di;
 464         int n = 0, size, err;
 465         u16 dev_num;
 466
 467         BT_DBG("");
 468
 469         if (get_user(dev_num, (u16 __user *) arg))
 470                 return -EFAULT;
 471
 472         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 473                 return -EINVAL;
 474
 475         size = sizeof(*dl) + dev_num * sizeof(*di);
 476
 477         dl = kzalloc(size, GFP_KERNEL);
 478         if (!dl)
 479                 return -ENOMEM;
 480
 481         di = dl->dev_info;
 482
 483         spin_lock(&rfcomm_dev_lock);
 484
 485         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 486                 if (!tty_port_get(&dev->port))
 487                         continue;
 488                 (di + n)->id      = dev->id;
 489                 (di + n)->flags   = dev->flags;
 490                 (di + n)->state   = dev->dlc->state;
 491                 (di + n)->channel = dev->channel;
 492                 bacpy(&(di + n)->src, &dev->src);
 493                 bacpy(&(di + n)->dst, &dev->dst);
 494                 tty_port_put(&dev->port);
 495                 if (++n >= dev_num)
 496                         break;
 497         }
 498
 499         spin_unlock(&rfcomm_dev_lock);
 500
 501         dl->dev_num = n;
 502         size = sizeof(*dl) + n * sizeof(*di);
 503
 504         err = copy_to_user(arg, dl, size);
 505         kfree(dl);
 506
 507         return err ? -EFAULT : 0;
 508 }
 509
 510 static int rfcomm_get_dev_info(void __user *arg)
 511 {
 512         struct rfcomm_dev *dev;
 513         struct rfcomm_dev_info di;
 514         int err = 0;
 515
 516         BT_DBG("");
 517
 518         if (copy_from_user(&di, arg, sizeof(di)))
 519                 return -EFAULT;
 520
 521         dev = rfcomm_dev_get(di.id);
 522         if (!dev)
 523                 return -ENODEV;
 524
 525         di.flags   = dev->flags;
 526         di.channel = dev->channel;
 527         di.state   = dev->dlc->state;
 528         bacpy(&di.src, &dev->src);
 529         bacpy(&di.dst, &dev->dst);
 530
 531         if (copy_to_user(arg, &di, sizeof(di)))
 532                 err = -EFAULT;
 533
 534         tty_port_put(&dev->port);
 535         return err;
 536 }
 537
 538 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 539 {
 540         BT_DBG("cmd %d arg %p", cmd, arg);
 541
 542         switch (cmd) {
 543         case RFCOMMCREATEDEV:
 544                 return rfcomm_create_dev(sk, arg);
 545
 546         case RFCOMMRELEASEDEV:
 547                 return rfcomm_release_dev(arg);
 548
 549         case RFCOMMGETDEVLIST:
 550                 return rfcomm_get_dev_list(arg);
 551
 552         case RFCOMMGETDEVINFO:
 553                 return rfcomm_get_dev_info(arg);
 554         }
 555
 556         return -EINVAL;
 557 }
 558
 559 /* ---- DLC callbacks ---- */
 560 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 561 {
 562         struct rfcomm_dev *dev = dlc->owner;
 563
 564         if (!dev) {
 565                 kfree_skb(skb);
 566                 return;
 567         }
 568
 569         if (!skb_queue_empty(&dev->pending)) {
 570                 skb_queue_tail(&dev->pending, skb);
 571                 return;
 572         }
 573
 574         BT_DBG("dlc %p len %d", dlc, skb->len);
 575
 576         tty_insert_flip_string(&dev->port, skb->data, skb->len);
 577         tty_flip_buffer_push(&dev->port);
 578
 579         kfree_skb(skb);
 580 }
 581
 582 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 583 {
 584         struct rfcomm_dev *dev = dlc->owner;
 585         if (!dev)
 586                 return;
 587
 588         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 589
 590         dev->err = err;
 591         if (dlc->state == BT_CONNECTED) {
 592                 device_move(dev->tty_dev, rfcomm_get_device(dev),
 593                             DPM_ORDER_DEV_AFTER_PARENT);
 594
 595                 wake_up_interruptible(&dev->port.open_wait);
 596         } else if (dlc->state == BT_CLOSED)
 597                 tty_port_tty_hangup(&dev->port, false);
 598 }
 599
 600 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 601 {
 602         struct rfcomm_dev *dev = dlc->owner;
 603         if (!dev)
 604                 return;
 605
 606         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 607
 608         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
 609                 tty_port_tty_hangup(&dev->port, true);
 610
 611         dev->modem_status =
 612                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 613                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 614                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 615                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 616 }
 617
 618 /* ---- TTY functions ---- */
 619 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 620 {
 621         struct sk_buff *skb;
 622         int inserted = 0;
 623
 624         BT_DBG("dev %p", dev);
 625
 626         rfcomm_dlc_lock(dev->dlc);
 627
 628         while ((skb = skb_dequeue(&dev->pending))) {
 629                 inserted += tty_insert_flip_string(&dev->port, skb->data,
 630                                 skb->len);
 631                 kfree_skb(skb);
 632         }
 633
 634         rfcomm_dlc_unlock(dev->dlc);
 635
 636         if (inserted > 0)
 637                 tty_flip_buffer_push(&dev->port);
 638 }
 639
 640 /* do the reverse of install, clearing the tty fields and releasing the
 641  * reference to tty_port
 642  */
 643 static void rfcomm_tty_cleanup(struct tty_struct *tty)
 644 {
 645         struct rfcomm_dev *dev = tty->driver_data;
 646
 647         clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 648
 649         rfcomm_dlc_lock(dev->dlc);
 650         tty->driver_data = NULL;
 651         rfcomm_dlc_unlock(dev->dlc);
 652
 653         /*
 654          * purge the dlc->tx_queue to avoid circular dependencies
 655          * between dev and dlc
 656          */
 657         skb_queue_purge(&dev->dlc->tx_queue);
 658
 659         tty_port_put(&dev->port);
 660 }
 661
 662 /* we acquire the tty_port reference since it's here the tty is first used
 663  * by setting the termios. We also populate the driver_data field and install
 664  * the tty port
 665  */
 666 static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
 667 {
 668         struct rfcomm_dev *dev;
 669         struct rfcomm_dlc *dlc;
 670         int err;
 671
 672         dev = rfcomm_dev_get(tty->index);
 673         if (!dev)
 674                 return -ENODEV;
 675
 676         dlc = dev->dlc;
 677
 678         /* Attach TTY and open DLC */
 679         rfcomm_dlc_lock(dlc);
 680         tty->driver_data = dev;
 681         rfcomm_dlc_unlock(dlc);
 682         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 683
 684         /* install the tty_port */
 685         err = tty_port_install(&dev->port, driver, tty);
 686         if (err) {
 687                 rfcomm_tty_cleanup(tty);
 688                 return err;
 689         }
 690
 691         /* take over the tty_port reference if the port was created with the
 692          * flag RFCOMM_RELEASE_ONHUP. This will force the release of the port
 693          * when the last process closes the tty. The behaviour is expected by
 694          * userspace.
 695          */
 696         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 697                 set_bit(RFCOMM_TTY_OWNED, &dev->status);
 698                 tty_port_put(&dev->port);
 699         }
 700
 701         return 0;
 702 }
 703
 704 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 705 {
 706         struct rfcomm_dev *dev = tty->driver_data;
 707         int err;
 708
 709         BT_DBG("tty %p id %d", tty, tty->index);
 710
 711         BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
 712                dev->channel, dev->port.count);
 713
 714         err = tty_port_open(&dev->port, tty, filp);
 715         if (err)
 716                 return err;
 717
 718         /*
 719          * FIXME: rfcomm should use proper flow control for
 720          * received data. This hack will be unnecessary and can
 721          * be removed when that's implemented
 722          */
 723         rfcomm_tty_copy_pending(dev);
 724
 725         rfcomm_dlc_unthrottle(dev->dlc);
 726
 727         return 0;
 728 }
 729
 730 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 731 {
 732         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 733
 734         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 735                                                 dev->port.count);
 736
 737         tty_port_close(&dev->port, tty, filp);
 738 }
 739
 740 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 741 {
 742         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 743         struct rfcomm_dlc *dlc = dev->dlc;
 744         struct sk_buff *skb;
 745         int err = 0, sent = 0, size;
 746
 747         BT_DBG("tty %p count %d", tty, count);
 748
 749         while (count) {
 750                 size = min_t(uint, count, dlc->mtu);
 751
 752                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 753
 754                 if (!skb)
 755                         break;
 756
 757                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 758
 759                 memcpy(skb_put(skb, size), buf + sent, size);
 760
 761                 err = rfcomm_dlc_send(dlc, skb);
 762                 if (err < 0) {
 763                         kfree_skb(skb);
 764                         break;
 765                 }
 766
 767                 sent  += size;
 768                 count -= size;
 769         }
 770
 771         return sent ? sent : err;
 772 }
 773
 774 static int rfcomm_tty_write_room(struct tty_struct *tty)
 775 {
 776         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 777         int room;
 778
 779         BT_DBG("tty %p", tty);
 780
 781         if (!dev || !dev->dlc)
 782                 return 0;
 783
 784         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 785         if (room < 0)
 786                 room = 0;
 787
 788         return room;
 789 }
 790
 791 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 792 {
 793         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 794
 795         switch (cmd) {
 796         case TCGETS:
 797                 BT_DBG("TCGETS is not supported");
 798                 return -ENOIOCTLCMD;
 799
 800         case TCSETS:
 801                 BT_DBG("TCSETS is not supported");
 802                 return -ENOIOCTLCMD;
 803
 804         case TIOCMIWAIT:
 805                 BT_DBG("TIOCMIWAIT");
 806                 break;
 807
 808         case TIOCGSERIAL:
 809                 BT_ERR("TIOCGSERIAL is not supported");
 810                 return -ENOIOCTLCMD;
 811
 812         case TIOCSSERIAL:
 813                 BT_ERR("TIOCSSERIAL is not supported");
 814                 return -ENOIOCTLCMD;
 815
 816         case TIOCSERGSTRUCT:
 817                 BT_ERR("TIOCSERGSTRUCT is not supported");
 818                 return -ENOIOCTLCMD;
 819
 820         case TIOCSERGETLSR:
 821                 BT_ERR("TIOCSERGETLSR is not supported");
 822                 return -ENOIOCTLCMD;
 823
 824         case TIOCSERCONFIG:
 825                 BT_ERR("TIOCSERCONFIG is not supported");
 826                 return -ENOIOCTLCMD;
 827
 828         default:
 829                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 830
 831         }
 832
 833         return -ENOIOCTLCMD;
 834 }
 835
 836 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 837 {
 838         struct ktermios *new = &tty->termios;
 839         int old_baud_rate = tty_termios_baud_rate(old);
 840         int new_baud_rate = tty_termios_baud_rate(new);
 841
 842         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 843         u16 changes = 0;
 844
 845         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 846
 847         BT_DBG("tty %p termios %p", tty, old);
 848
 849         if (!dev || !dev->dlc || !dev->dlc->session)
 850                 return;
 851
 852         /* Handle turning off CRTSCTS */
 853         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 854                 BT_DBG("Turning off CRTSCTS unsupported");
 855
 856         /* Parity on/off and when on, odd/even */
 857         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 858                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 859                 changes |= RFCOMM_RPN_PM_PARITY;
 860                 BT_DBG("Parity change detected.");
 861         }
 862
 863         /* Mark and space parity are not supported! */
 864         if (new->c_cflag & PARENB) {
 865                 if (new->c_cflag & PARODD) {
 866                         BT_DBG("Parity is ODD");
 867                         parity = RFCOMM_RPN_PARITY_ODD;
 868                 } else {
 869                         BT_DBG("Parity is EVEN");
 870                         parity = RFCOMM_RPN_PARITY_EVEN;
 871                 }
 872         } else {
 873                 BT_DBG("Parity is OFF");
 874                 parity = RFCOMM_RPN_PARITY_NONE;
 875         }
 876
 877         /* Setting the x_on / x_off characters */
 878         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 879                 BT_DBG("XOFF custom");
 880                 x_on = new->c_cc[VSTOP];
 881                 changes |= RFCOMM_RPN_PM_XON;
 882         } else {
 883                 BT_DBG("XOFF default");
 884                 x_on = RFCOMM_RPN_XON_CHAR;
 885         }
 886
 887         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 888                 BT_DBG("XON custom");
 889                 x_off = new->c_cc[VSTART];
 890                 changes |= RFCOMM_RPN_PM_XOFF;
 891         } else {
 892                 BT_DBG("XON default");
 893                 x_off = RFCOMM_RPN_XOFF_CHAR;
 894         }
 895
 896         /* Handle setting of stop bits */
 897         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 898                 changes |= RFCOMM_RPN_PM_STOP;
 899
 900         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 901          * support 2 stop bits. So a request for 2 stop bits gets
 902          * translated to 1.5 stop bits */
 903         if (new->c_cflag & CSTOPB)
 904                 stop_bits = RFCOMM_RPN_STOP_15;
 905         else
 906                 stop_bits = RFCOMM_RPN_STOP_1;
 907
 908         /* Handle number of data bits [5-8] */
 909         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 910                 changes |= RFCOMM_RPN_PM_DATA;
 911
 912         switch (new->c_cflag & CSIZE) {
 913         case CS5:
 914                 data_bits = RFCOMM_RPN_DATA_5;
 915                 break;
 916         case CS6:
 917                 data_bits = RFCOMM_RPN_DATA_6;
 918                 break;
 919         case CS7:
 920                 data_bits = RFCOMM_RPN_DATA_7;
 921                 break;
 922         case CS8:
 923                 data_bits = RFCOMM_RPN_DATA_8;
 924                 break;
 925         default:
 926                 data_bits = RFCOMM_RPN_DATA_8;
 927                 break;
 928         }
 929
 930         /* Handle baudrate settings */
 931         if (old_baud_rate != new_baud_rate)
 932                 changes |= RFCOMM_RPN_PM_BITRATE;
 933
 934         switch (new_baud_rate) {
 935         case 2400:
 936                 baud = RFCOMM_RPN_BR_2400;
 937                 break;
 938         case 4800:
 939                 baud = RFCOMM_RPN_BR_4800;
 940                 break;
 941         case 7200:
 942                 baud = RFCOMM_RPN_BR_7200;
 943                 break;
 944         case 9600:
 945                 baud = RFCOMM_RPN_BR_9600;
 946                 break;
 947         case 19200:
 948                 baud = RFCOMM_RPN_BR_19200;
 949                 break;
 950         case 38400:
 951                 baud = RFCOMM_RPN_BR_38400;
 952                 break;
 953         case 57600:
 954                 baud = RFCOMM_RPN_BR_57600;
 955                 break;
 956         case 115200:
 957                 baud = RFCOMM_RPN_BR_115200;
 958                 break;
 959         case 230400:
 960                 baud = RFCOMM_RPN_BR_230400;
 961                 break;
 962         default:
 963                 /* 9600 is standard accordinag to the RFCOMM specification */
 964                 baud = RFCOMM_RPN_BR_9600;
 965                 break;
 966
 967         }
 968
 969         if (changes)
 970                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 971                                 data_bits, stop_bits, parity,
 972                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 973 }
 974
 975 static void rfcomm_tty_throttle(struct tty_struct *tty)
 976 {
 977         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 978
 979         BT_DBG("tty %p dev %p", tty, dev);
 980
 981         rfcomm_dlc_throttle(dev->dlc);
 982 }
 983
 984 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 985 {
 986         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 987
 988         BT_DBG("tty %p dev %p", tty, dev);
 989
 990         rfcomm_dlc_unthrottle(dev->dlc);
 991 }
 992
 993 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 994 {
 995         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 996
 997         BT_DBG("tty %p dev %p", tty, dev);
 998
 999         if (!dev || !dev->dlc)
1000                 return 0;
1001
1002         if (!skb_queue_empty(&dev->dlc->tx_queue))
1003                 return dev->dlc->mtu;
1004
1005         return 0;
1006 }
1007
1008 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1009 {
1010         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1011
1012         BT_DBG("tty %p dev %p", tty, dev);
1013
1014         if (!dev || !dev->dlc)
1015                 return;
1016
1017         skb_queue_purge(&dev->dlc->tx_queue);
1018         tty_wakeup(tty);
1019 }
1020
1021 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1022 {
1023         BT_DBG("tty %p ch %c", tty, ch);
1024 }
1025
1026 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1027 {
1028         BT_DBG("tty %p timeout %d", tty, timeout);
1029 }
1030
1031 static void rfcomm_tty_hangup(struct tty_struct *tty)
1032 {
1033         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1034
1035         BT_DBG("tty %p dev %p", tty, dev);
1036
1037         tty_port_hangup(&dev->port);
1038 }
1039
1040 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1041 {
1042         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1043
1044         BT_DBG("tty %p dev %p", tty, dev);
1045
1046         return dev->modem_status;
1047 }
1048
1049 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1050 {
1051         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1052         struct rfcomm_dlc *dlc = dev->dlc;
1053         u8 v24_sig;
1054
1055         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1056
1057         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1058
1059         if (set & TIOCM_DSR || set & TIOCM_DTR)
1060                 v24_sig |= RFCOMM_V24_RTC;
1061         if (set & TIOCM_RTS || set & TIOCM_CTS)
1062                 v24_sig |= RFCOMM_V24_RTR;
1063         if (set & TIOCM_RI)
1064                 v24_sig |= RFCOMM_V24_IC;
1065         if (set & TIOCM_CD)
1066                 v24_sig |= RFCOMM_V24_DV;
1067
1068         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1069                 v24_sig &= ~RFCOMM_V24_RTC;
1070         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1071                 v24_sig &= ~RFCOMM_V24_RTR;
1072         if (clear & TIOCM_RI)
1073                 v24_sig &= ~RFCOMM_V24_IC;
1074         if (clear & TIOCM_CD)
1075                 v24_sig &= ~RFCOMM_V24_DV;
1076
1077         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1078
1079         return 0;
1080 }
1081
1082 /* ---- TTY structure ---- */
1083
1084 static const struct tty_operations rfcomm_ops = {
1085         .open                   = rfcomm_tty_open,
1086         .close                  = rfcomm_tty_close,
1087         .write                  = rfcomm_tty_write,
1088         .write_room             = rfcomm_tty_write_room,
1089         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1090         .flush_buffer           = rfcomm_tty_flush_buffer,
1091         .ioctl                  = rfcomm_tty_ioctl,
1092         .throttle               = rfcomm_tty_throttle,
1093         .unthrottle             = rfcomm_tty_unthrottle,
1094         .set_termios            = rfcomm_tty_set_termios,
1095         .send_xchar             = rfcomm_tty_send_xchar,
1096         .hangup                 = rfcomm_tty_hangup,
1097         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1098         .tiocmget               = rfcomm_tty_tiocmget,
1099         .tiocmset               = rfcomm_tty_tiocmset,
1100         .install                = rfcomm_tty_install,
1101         .cleanup                = rfcomm_tty_cleanup,
1102 };
1103
1104 int __init rfcomm_init_ttys(void)
1105 {
1106         int error;
1107
1108         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1109         if (!rfcomm_tty_driver)
1110                 return -ENOMEM;
1111
1112         rfcomm_tty_driver->driver_name  = "rfcomm";
1113         rfcomm_tty_driver->name         = "rfcomm";
1114         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1115         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1116         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1117         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1118         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1119         rfcomm_tty_driver->init_termios = tty_std_termios;
1120         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
1121         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1122         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1123
1124         error = tty_register_driver(rfcomm_tty_driver);
1125         if (error) {
1126                 BT_ERR("Can't register RFCOMM TTY driver");
1127                 put_tty_driver(rfcomm_tty_driver);
1128                 return error;
1129         }
1130
1131         BT_INFO("RFCOMM TTY layer initialized");
1132
1133         return 0;
1134 }
1135
1136 void rfcomm_cleanup_ttys(void)
1137 {
1138         tty_unregister_driver(rfcomm_tty_driver);
1139         put_tty_driver(rfcomm_tty_driver);
1140 }