net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <linux/capability.h>
  35 #include <linux/slab.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/workqueue.h>
  38
  39 #include <net/bluetooth/bluetooth.h>
  40 #include <net/bluetooth/hci_core.h>
  41 #include <net/bluetooth/rfcomm.h>
  42
  43 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  44 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  45 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  46 #define RFCOMM_TTY_MINOR 0
  47
  48 static struct tty_driver *rfcomm_tty_driver;
  49
  50 struct rfcomm_dev {
  51         struct tty_port         port;
  52         struct list_head        list;
  53
  54         char                    name[12];
  55         int                     id;
  56         unsigned long           flags;
  57         int                     err;
  58
  59         bdaddr_t                src;
  60         bdaddr_t                dst;
  61         u8                      channel;
  62
  63         uint                    modem_status;
  64
  65         struct rfcomm_dlc       *dlc;
  66         wait_queue_head_t       wait;
  67
  68         struct device           *tty_dev;
  69
  70         atomic_t                wmem_alloc;
  71
  72         struct sk_buff_head     pending;
  73 };
  74
  75 static LIST_HEAD(rfcomm_dev_list);
  76 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  77
  78 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  79 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  80 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  81
  82 /* ---- Device functions ---- */
  83
  84 /*
  85  * The reason this isn't actually a race, as you no doubt have a little voice
  86  * screaming at you in your head, is that the refcount should never actually
  87  * reach zero unless the device has already been taken off the list, in
  88  * rfcomm_dev_del(). And if that's not true, we'll hit the BUG() in
  89  * rfcomm_dev_destruct() anyway.
  90  */
  91 static void rfcomm_dev_destruct(struct tty_port *port)
  92 {
  93         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  94         struct rfcomm_dlc *dlc = dev->dlc;
  95
  96         BT_DBG("dev %p dlc %p", dev, dlc);
  97
  98         /* Refcount should only hit zero when called from rfcomm_dev_del()
  99            which will have taken us off the list. Everything else are
 100            refcounting bugs. */
 101         BUG_ON(!list_empty(&dev->list));
 102
 103         rfcomm_dlc_lock(dlc);
 104         /* Detach DLC if it's owned by this dev */
 105         if (dlc->owner == dev)
 106                 dlc->owner = NULL;
 107         rfcomm_dlc_unlock(dlc);
 108
 109         rfcomm_dlc_put(dlc);
 110
 111         tty_unregister_device(rfcomm_tty_driver, dev->id);
 112
 113         kfree(dev);
 114
 115         /* It's safe to call module_put() here because socket still
 116            holds reference to this module. */
 117         module_put(THIS_MODULE);
 118 }
 119
 120 static const struct tty_port_operations rfcomm_port_ops = {
 121         .destruct = rfcomm_dev_destruct,
 122 };
 123
 124 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 125 {
 126         struct rfcomm_dev *dev;
 127
 128         list_for_each_entry(dev, &rfcomm_dev_list, list)
 129                 if (dev->id == id)
 130                         return dev;
 131
 132         return NULL;
 133 }
 134
 135 static inline struct rfcomm_dev *rfcomm_dev_get(int id)
 136 {
 137         struct rfcomm_dev *dev;
 138
 139         spin_lock(&rfcomm_dev_lock);
 140
 141         dev = __rfcomm_dev_get(id);
 142
 143         if (dev) {
 144                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 145                         dev = NULL;
 146                 else
 147                         tty_port_get(&dev->port);
 148         }
 149
 150         spin_unlock(&rfcomm_dev_lock);
 151
 152         return dev;
 153 }
 154
 155 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 156 {
 157         struct hci_dev *hdev;
 158         struct hci_conn *conn;
 159
 160         hdev = hci_get_route(&dev->dst, &dev->src);
 161         if (!hdev)
 162                 return NULL;
 163
 164         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 165
 166         hci_dev_put(hdev);
 167
 168         return conn ? &conn->dev : NULL;
 169 }
 170
 171 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 172 {
 173         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 174         return sprintf(buf, "%s\n", batostr(&dev->dst));
 175 }
 176
 177 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 178 {
 179         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 180         return sprintf(buf, "%d\n", dev->channel);
 181 }
 182
 183 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 184 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 185
 186 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 187 {
 188         struct rfcomm_dev *dev, *entry;
 189         struct list_head *head = &rfcomm_dev_list;
 190         int err = 0;
 191
 192         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 193
 194         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 195         if (!dev)
 196                 return -ENOMEM;
 197
 198         spin_lock(&rfcomm_dev_lock);
 199
 200         if (req->dev_id < 0) {
 201                 dev->id = 0;
 202
 203                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 204                         if (entry->id != dev->id)
 205                                 break;
 206
 207                         dev->id++;
 208                         head = &entry->list;
 209                 }
 210         } else {
 211                 dev->id = req->dev_id;
 212
 213                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 214                         if (entry->id == dev->id) {
 215                                 err = -EADDRINUSE;
 216                                 goto out;
 217                         }
 218
 219                         if (entry->id > dev->id - 1)
 220                                 break;
 221
 222                         head = &entry->list;
 223                 }
 224         }
 225
 226         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 227                 err = -ENFILE;
 228                 goto out;
 229         }
 230
 231         sprintf(dev->name, "rfcomm%d", dev->id);
 232
 233         list_add(&dev->list, head);
 234
 235         bacpy(&dev->src, &req->src);
 236         bacpy(&dev->dst, &req->dst);
 237         dev->channel = req->channel;
 238
 239         dev->flags = req->flags &
 240                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 241
 242         tty_port_init(&dev->port);
 243         dev->port.ops = &rfcomm_port_ops;
 244         init_waitqueue_head(&dev->wait);
 245
 246         skb_queue_head_init(&dev->pending);
 247
 248         rfcomm_dlc_lock(dlc);
 249
 250         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 251                 struct sock *sk = dlc->owner;
 252                 struct sk_buff *skb;
 253
 254                 BUG_ON(!sk);
 255
 256                 rfcomm_dlc_throttle(dlc);
 257
 258                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 259                         skb_orphan(skb);
 260                         skb_queue_tail(&dev->pending, skb);
 261                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 262                 }
 263         }
 264
 265         dlc->data_ready   = rfcomm_dev_data_ready;
 266         dlc->state_change = rfcomm_dev_state_change;
 267         dlc->modem_status = rfcomm_dev_modem_status;
 268
 269         dlc->owner = dev;
 270         dev->dlc   = dlc;
 271
 272         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 273
 274         rfcomm_dlc_unlock(dlc);
 275
 276         /* It's safe to call __module_get() here because socket already
 277            holds reference to this module. */
 278         __module_get(THIS_MODULE);
 279
 280 out:
 281         spin_unlock(&rfcomm_dev_lock);
 282
 283         if (err < 0)
 284                 goto free;
 285
 286         dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL);
 287
 288         if (IS_ERR(dev->tty_dev)) {
 289                 err = PTR_ERR(dev->tty_dev);
 290                 list_del(&dev->list);
 291                 goto free;
 292         }
 293
 294         dev_set_drvdata(dev->tty_dev, dev);
 295
 296         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 297                 BT_ERR("Failed to create address attribute");
 298
 299         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 300                 BT_ERR("Failed to create channel attribute");
 301
 302         return dev->id;
 303
 304 free:
 305         kfree(dev);
 306         return err;
 307 }
 308
 309 static void rfcomm_dev_del(struct rfcomm_dev *dev)
 310 {
 311         unsigned long flags;
 312         BT_DBG("dev %p", dev);
 313
 314         BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
 315
 316         spin_lock_irqsave(&dev->port.lock, flags);
 317         if (dev->port.count > 0) {
 318                 spin_unlock_irqrestore(&dev->port.lock, flags);
 319                 return;
 320         }
 321         spin_unlock_irqrestore(&dev->port.lock, flags);
 322
 323         spin_lock(&rfcomm_dev_lock);
 324         list_del_init(&dev->list);
 325         spin_unlock(&rfcomm_dev_lock);
 326
 327         tty_port_put(&dev->port);
 328 }
 329
 330 /* ---- Send buffer ---- */
 331 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 332 {
 333         /* We can't let it be zero, because we don't get a callback
 334            when tx_credits becomes nonzero, hence we'd never wake up */
 335         return dlc->mtu * (dlc->tx_credits?:1);
 336 }
 337
 338 static void rfcomm_wfree(struct sk_buff *skb)
 339 {
 340         struct rfcomm_dev *dev = (void *) skb->sk;
 341         struct tty_struct *tty = dev->port.tty;
 342         atomic_sub(skb->truesize, &dev->wmem_alloc);
 343         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags) && tty)
 344                 tty_wakeup(tty);
 345         tty_port_put(&dev->port);
 346 }
 347
 348 static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 349 {
 350         tty_port_get(&dev->port);
 351         atomic_add(skb->truesize, &dev->wmem_alloc);
 352         skb->sk = (void *) dev;
 353         skb->destructor = rfcomm_wfree;
 354 }
 355
 356 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 357 {
 358         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 359                 struct sk_buff *skb = alloc_skb(size, priority);
 360                 if (skb) {
 361                         rfcomm_set_owner_w(skb, dev);
 362                         return skb;
 363                 }
 364         }
 365         return NULL;
 366 }
 367
 368 /* ---- Device IOCTLs ---- */
 369
 370 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 371
 372 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 373 {
 374         struct rfcomm_dev_req req;
 375         struct rfcomm_dlc *dlc;
 376         int id;
 377
 378         if (copy_from_user(&req, arg, sizeof(req)))
 379                 return -EFAULT;
 380
 381         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 382
 383         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 384                 return -EPERM;
 385
 386         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 387                 /* Socket must be connected */
 388                 if (sk->sk_state != BT_CONNECTED)
 389                         return -EBADFD;
 390
 391                 dlc = rfcomm_pi(sk)->dlc;
 392                 rfcomm_dlc_hold(dlc);
 393         } else {
 394                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 395                 if (!dlc)
 396                         return -ENOMEM;
 397         }
 398
 399         id = rfcomm_dev_add(&req, dlc);
 400         if (id < 0) {
 401                 rfcomm_dlc_put(dlc);
 402                 return id;
 403         }
 404
 405         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 406                 /* DLC is now used by device.
 407                  * Socket must be disconnected */
 408                 sk->sk_state = BT_CLOSED;
 409         }
 410
 411         return id;
 412 }
 413
 414 static int rfcomm_release_dev(void __user *arg)
 415 {
 416         struct rfcomm_dev_req req;
 417         struct rfcomm_dev *dev;
 418
 419         if (copy_from_user(&req, arg, sizeof(req)))
 420                 return -EFAULT;
 421
 422         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 423
 424         dev = rfcomm_dev_get(req.dev_id);
 425         if (!dev)
 426                 return -ENODEV;
 427
 428         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 429                 tty_port_put(&dev->port);
 430                 return -EPERM;
 431         }
 432
 433         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 434                 rfcomm_dlc_close(dev->dlc, 0);
 435
 436         /* Shut down TTY synchronously before freeing rfcomm_dev */
 437         if (dev->port.tty)
 438                 tty_vhangup(dev->port.tty);
 439
 440         if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
 441                 rfcomm_dev_del(dev);
 442         tty_port_put(&dev->port);
 443         return 0;
 444 }
 445
 446 static int rfcomm_get_dev_list(void __user *arg)
 447 {
 448         struct rfcomm_dev *dev;
 449         struct rfcomm_dev_list_req *dl;
 450         struct rfcomm_dev_info *di;
 451         int n = 0, size, err;
 452         u16 dev_num;
 453
 454         BT_DBG("");
 455
 456         if (get_user(dev_num, (u16 __user *) arg))
 457                 return -EFAULT;
 458
 459         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 460                 return -EINVAL;
 461
 462         size = sizeof(*dl) + dev_num * sizeof(*di);
 463
 464         dl = kmalloc(size, GFP_KERNEL);
 465         if (!dl)
 466                 return -ENOMEM;
 467
 468         di = dl->dev_info;
 469
 470         spin_lock(&rfcomm_dev_lock);
 471
 472         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 473                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 474                         continue;
 475                 (di + n)->id      = dev->id;
 476                 (di + n)->flags   = dev->flags;
 477                 (di + n)->state   = dev->dlc->state;
 478                 (di + n)->channel = dev->channel;
 479                 bacpy(&(di + n)->src, &dev->src);
 480                 bacpy(&(di + n)->dst, &dev->dst);
 481                 if (++n >= dev_num)
 482                         break;
 483         }
 484
 485         spin_unlock(&rfcomm_dev_lock);
 486
 487         dl->dev_num = n;
 488         size = sizeof(*dl) + n * sizeof(*di);
 489
 490         err = copy_to_user(arg, dl, size);
 491         kfree(dl);
 492
 493         return err ? -EFAULT : 0;
 494 }
 495
 496 static int rfcomm_get_dev_info(void __user *arg)
 497 {
 498         struct rfcomm_dev *dev;
 499         struct rfcomm_dev_info di;
 500         int err = 0;
 501
 502         BT_DBG("");
 503
 504         if (copy_from_user(&di, arg, sizeof(di)))
 505                 return -EFAULT;
 506
 507         dev = rfcomm_dev_get(di.id);
 508         if (!dev)
 509                 return -ENODEV;
 510
 511         di.flags   = dev->flags;
 512         di.channel = dev->channel;
 513         di.state   = dev->dlc->state;
 514         bacpy(&di.src, &dev->src);
 515         bacpy(&di.dst, &dev->dst);
 516
 517         if (copy_to_user(arg, &di, sizeof(di)))
 518                 err = -EFAULT;
 519
 520         tty_port_put(&dev->port);
 521         return err;
 522 }
 523
 524 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 525 {
 526         BT_DBG("cmd %d arg %p", cmd, arg);
 527
 528         switch (cmd) {
 529         case RFCOMMCREATEDEV:
 530                 return rfcomm_create_dev(sk, arg);
 531
 532         case RFCOMMRELEASEDEV:
 533                 return rfcomm_release_dev(arg);
 534
 535         case RFCOMMGETDEVLIST:
 536                 return rfcomm_get_dev_list(arg);
 537
 538         case RFCOMMGETDEVINFO:
 539                 return rfcomm_get_dev_info(arg);
 540         }
 541
 542         return -EINVAL;
 543 }
 544
 545 /* ---- DLC callbacks ---- */
 546 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 547 {
 548         struct rfcomm_dev *dev = dlc->owner;
 549         struct tty_struct *tty;
 550
 551         if (!dev) {
 552                 kfree_skb(skb);
 553                 return;
 554         }
 555
 556         tty = dev->port.tty;
 557         if (!tty || !skb_queue_empty(&dev->pending)) {
 558                 skb_queue_tail(&dev->pending, skb);
 559                 return;
 560         }
 561
 562         BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
 563
 564         tty_insert_flip_string(tty, skb->data, skb->len);
 565         tty_flip_buffer_push(tty);
 566
 567         kfree_skb(skb);
 568 }
 569
 570 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 571 {
 572         struct rfcomm_dev *dev = dlc->owner;
 573         if (!dev)
 574                 return;
 575
 576         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 577
 578         dev->err = err;
 579         wake_up_interruptible(&dev->wait);
 580
 581         if (dlc->state == BT_CLOSED) {
 582                 if (!dev->port.tty) {
 583                         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 584                                 /* Drop DLC lock here to avoid deadlock
 585                                  * 1. rfcomm_dev_get will take rfcomm_dev_lock
 586                                  *    but in rfcomm_dev_add there's lock order:
 587                                  *    rfcomm_dev_lock -> dlc lock
 588                                  * 2. tty_port_put will deadlock if it's
 589                                  *    the last reference
 590                                  */
 591                                 rfcomm_dlc_unlock(dlc);
 592                                 if (rfcomm_dev_get(dev->id) == NULL) {
 593                                         rfcomm_dlc_lock(dlc);
 594                                         return;
 595                                 }
 596
 597                                 rfcomm_dev_del(dev);
 598                                 tty_port_put(&dev->port);
 599                                 rfcomm_dlc_lock(dlc);
 600                         }
 601                 } else
 602                         tty_hangup(dev->port.tty);
 603         }
 604 }
 605
 606 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 607 {
 608         struct rfcomm_dev *dev = dlc->owner;
 609         if (!dev)
 610                 return;
 611
 612         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 613
 614         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
 615                 if (dev->port.tty && !C_CLOCAL(dev->port.tty))
 616                         tty_hangup(dev->port.tty);
 617         }
 618
 619         dev->modem_status =
 620                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 621                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 622                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 623                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 624 }
 625
 626 /* ---- TTY functions ---- */
 627 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 628 {
 629         struct tty_struct *tty = dev->port.tty;
 630         struct sk_buff *skb;
 631         int inserted = 0;
 632
 633         if (!tty)
 634                 return;
 635
 636         BT_DBG("dev %p tty %p", dev, tty);
 637
 638         rfcomm_dlc_lock(dev->dlc);
 639
 640         while ((skb = skb_dequeue(&dev->pending))) {
 641                 inserted += tty_insert_flip_string(tty, skb->data, skb->len);
 642                 kfree_skb(skb);
 643         }
 644
 645         rfcomm_dlc_unlock(dev->dlc);
 646
 647         if (inserted > 0)
 648                 tty_flip_buffer_push(tty);
 649 }
 650
 651 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 652 {
 653         DECLARE_WAITQUEUE(wait, current);
 654         struct rfcomm_dev *dev;
 655         struct rfcomm_dlc *dlc;
 656         unsigned long flags;
 657         int err, id;
 658
 659         id = tty->index;
 660
 661         BT_DBG("tty %p id %d", tty, id);
 662
 663         /* We don't leak this refcount. For reasons which are not entirely
 664            clear, the TTY layer will call our ->close() method even if the
 665            open fails. We decrease the refcount there, and decreasing it
 666            here too would cause breakage. */
 667         dev = rfcomm_dev_get(id);
 668         if (!dev)
 669                 return -ENODEV;
 670
 671         BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst),
 672                                 dev->channel, dev->port.count);
 673
 674         spin_lock_irqsave(&dev->port.lock, flags);
 675         if (++dev->port.count > 1) {
 676                 spin_unlock_irqrestore(&dev->port.lock, flags);
 677                 return 0;
 678         }
 679         spin_unlock_irqrestore(&dev->port.lock, flags);
 680
 681         dlc = dev->dlc;
 682
 683         /* Attach TTY and open DLC */
 684
 685         rfcomm_dlc_lock(dlc);
 686         tty->driver_data = dev;
 687         dev->port.tty = tty;
 688         rfcomm_dlc_unlock(dlc);
 689         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 690
 691         err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
 692         if (err < 0)
 693                 return err;
 694
 695         /* Wait for DLC to connect */
 696         add_wait_queue(&dev->wait, &wait);
 697         while (1) {
 698                 set_current_state(TASK_INTERRUPTIBLE);
 699
 700                 if (dlc->state == BT_CLOSED) {
 701                         err = -dev->err;
 702                         break;
 703                 }
 704
 705                 if (dlc->state == BT_CONNECTED)
 706                         break;
 707
 708                 if (signal_pending(current)) {
 709                         err = -EINTR;
 710                         break;
 711                 }
 712
 713                 tty_unlock(tty);
 714                 schedule();
 715                 tty_lock(tty);
 716         }
 717         set_current_state(TASK_RUNNING);
 718         remove_wait_queue(&dev->wait, &wait);
 719
 720         if (err == 0)
 721                 device_move(dev->tty_dev, rfcomm_get_device(dev),
 722                             DPM_ORDER_DEV_AFTER_PARENT);
 723
 724         rfcomm_tty_copy_pending(dev);
 725
 726         rfcomm_dlc_unthrottle(dev->dlc);
 727
 728         return err;
 729 }
 730
 731 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 732 {
 733         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 734         unsigned long flags;
 735
 736         if (!dev)
 737                 return;
 738
 739         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 740                                                 dev->port.count);
 741
 742         spin_lock_irqsave(&dev->port.lock, flags);
 743         if (!--dev->port.count) {
 744                 spin_unlock_irqrestore(&dev->port.lock, flags);
 745                 if (dev->tty_dev->parent)
 746                         device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 747
 748                 /* Close DLC and dettach TTY */
 749                 rfcomm_dlc_close(dev->dlc, 0);
 750
 751                 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 752
 753                 rfcomm_dlc_lock(dev->dlc);
 754                 tty->driver_data = NULL;
 755                 dev->port.tty = NULL;
 756                 rfcomm_dlc_unlock(dev->dlc);
 757
 758                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) {
 759                         spin_lock(&rfcomm_dev_lock);
 760                         list_del_init(&dev->list);
 761                         spin_unlock(&rfcomm_dev_lock);
 762
 763                         tty_port_put(&dev->port);
 764                 }
 765         } else
 766                 spin_unlock_irqrestore(&dev->port.lock, flags);
 767
 768         tty_port_put(&dev->port);
 769 }
 770
 771 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 772 {
 773         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 774         struct rfcomm_dlc *dlc = dev->dlc;
 775         struct sk_buff *skb;
 776         int err = 0, sent = 0, size;
 777
 778         BT_DBG("tty %p count %d", tty, count);
 779
 780         while (count) {
 781                 size = min_t(uint, count, dlc->mtu);
 782
 783                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 784
 785                 if (!skb)
 786                         break;
 787
 788                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 789
 790                 memcpy(skb_put(skb, size), buf + sent, size);
 791
 792                 err = rfcomm_dlc_send(dlc, skb);
 793                 if (err < 0) {
 794                         kfree_skb(skb);
 795                         break;
 796                 }
 797
 798                 sent  += size;
 799                 count -= size;
 800         }
 801
 802         return sent ? sent : err;
 803 }
 804
 805 static int rfcomm_tty_write_room(struct tty_struct *tty)
 806 {
 807         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 808         int room;
 809
 810         BT_DBG("tty %p", tty);
 811
 812         if (!dev || !dev->dlc)
 813                 return 0;
 814
 815         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 816         if (room < 0)
 817                 room = 0;
 818
 819         return room;
 820 }
 821
 822 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 823 {
 824         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 825
 826         switch (cmd) {
 827         case TCGETS:
 828                 BT_DBG("TCGETS is not supported");
 829                 return -ENOIOCTLCMD;
 830
 831         case TCSETS:
 832                 BT_DBG("TCSETS is not supported");
 833                 return -ENOIOCTLCMD;
 834
 835         case TIOCMIWAIT:
 836                 BT_DBG("TIOCMIWAIT");
 837                 break;
 838
 839         case TIOCGSERIAL:
 840                 BT_ERR("TIOCGSERIAL is not supported");
 841                 return -ENOIOCTLCMD;
 842
 843         case TIOCSSERIAL:
 844                 BT_ERR("TIOCSSERIAL is not supported");
 845                 return -ENOIOCTLCMD;
 846
 847         case TIOCSERGSTRUCT:
 848                 BT_ERR("TIOCSERGSTRUCT is not supported");
 849                 return -ENOIOCTLCMD;
 850
 851         case TIOCSERGETLSR:
 852                 BT_ERR("TIOCSERGETLSR is not supported");
 853                 return -ENOIOCTLCMD;
 854
 855         case TIOCSERCONFIG:
 856                 BT_ERR("TIOCSERCONFIG is not supported");
 857                 return -ENOIOCTLCMD;
 858
 859         default:
 860                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 861
 862         }
 863
 864         return -ENOIOCTLCMD;
 865 }
 866
 867 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 868 {
 869         struct ktermios *new = tty->termios;
 870         int old_baud_rate = tty_termios_baud_rate(old);
 871         int new_baud_rate = tty_termios_baud_rate(new);
 872
 873         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 874         u16 changes = 0;
 875
 876         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 877
 878         BT_DBG("tty %p termios %p", tty, old);
 879
 880         if (!dev || !dev->dlc || !dev->dlc->session)
 881                 return;
 882
 883         /* Handle turning off CRTSCTS */
 884         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 885                 BT_DBG("Turning off CRTSCTS unsupported");
 886
 887         /* Parity on/off and when on, odd/even */
 888         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 889                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 890                 changes |= RFCOMM_RPN_PM_PARITY;
 891                 BT_DBG("Parity change detected.");
 892         }
 893
 894         /* Mark and space parity are not supported! */
 895         if (new->c_cflag & PARENB) {
 896                 if (new->c_cflag & PARODD) {
 897                         BT_DBG("Parity is ODD");
 898                         parity = RFCOMM_RPN_PARITY_ODD;
 899                 } else {
 900                         BT_DBG("Parity is EVEN");
 901                         parity = RFCOMM_RPN_PARITY_EVEN;
 902                 }
 903         } else {
 904                 BT_DBG("Parity is OFF");
 905                 parity = RFCOMM_RPN_PARITY_NONE;
 906         }
 907
 908         /* Setting the x_on / x_off characters */
 909         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 910                 BT_DBG("XOFF custom");
 911                 x_on = new->c_cc[VSTOP];
 912                 changes |= RFCOMM_RPN_PM_XON;
 913         } else {
 914                 BT_DBG("XOFF default");
 915                 x_on = RFCOMM_RPN_XON_CHAR;
 916         }
 917
 918         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 919                 BT_DBG("XON custom");
 920                 x_off = new->c_cc[VSTART];
 921                 changes |= RFCOMM_RPN_PM_XOFF;
 922         } else {
 923                 BT_DBG("XON default");
 924                 x_off = RFCOMM_RPN_XOFF_CHAR;
 925         }
 926
 927         /* Handle setting of stop bits */
 928         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 929                 changes |= RFCOMM_RPN_PM_STOP;
 930
 931         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 932          * support 2 stop bits. So a request for 2 stop bits gets
 933          * translated to 1.5 stop bits */
 934         if (new->c_cflag & CSTOPB)
 935                 stop_bits = RFCOMM_RPN_STOP_15;
 936         else
 937                 stop_bits = RFCOMM_RPN_STOP_1;
 938
 939         /* Handle number of data bits [5-8] */
 940         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 941                 changes |= RFCOMM_RPN_PM_DATA;
 942
 943         switch (new->c_cflag & CSIZE) {
 944         case CS5:
 945                 data_bits = RFCOMM_RPN_DATA_5;
 946                 break;
 947         case CS6:
 948                 data_bits = RFCOMM_RPN_DATA_6;
 949                 break;
 950         case CS7:
 951                 data_bits = RFCOMM_RPN_DATA_7;
 952                 break;
 953         case CS8:
 954                 data_bits = RFCOMM_RPN_DATA_8;
 955                 break;
 956         default:
 957                 data_bits = RFCOMM_RPN_DATA_8;
 958                 break;
 959         }
 960
 961         /* Handle baudrate settings */
 962         if (old_baud_rate != new_baud_rate)
 963                 changes |= RFCOMM_RPN_PM_BITRATE;
 964
 965         switch (new_baud_rate) {
 966         case 2400:
 967                 baud = RFCOMM_RPN_BR_2400;
 968                 break;
 969         case 4800:
 970                 baud = RFCOMM_RPN_BR_4800;
 971                 break;
 972         case 7200:
 973                 baud = RFCOMM_RPN_BR_7200;
 974                 break;
 975         case 9600:
 976                 baud = RFCOMM_RPN_BR_9600;
 977                 break;
 978         case 19200:
 979                 baud = RFCOMM_RPN_BR_19200;
 980                 break;
 981         case 38400:
 982                 baud = RFCOMM_RPN_BR_38400;
 983                 break;
 984         case 57600:
 985                 baud = RFCOMM_RPN_BR_57600;
 986                 break;
 987         case 115200:
 988                 baud = RFCOMM_RPN_BR_115200;
 989                 break;
 990         case 230400:
 991                 baud = RFCOMM_RPN_BR_230400;
 992                 break;
 993         default:
 994                 /* 9600 is standard accordinag to the RFCOMM specification */
 995                 baud = RFCOMM_RPN_BR_9600;
 996                 break;
 997
 998         }
 999
1000         if (changes)
1001                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
1002                                 data_bits, stop_bits, parity,
1003                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
1004 }
1005
1006 static void rfcomm_tty_throttle(struct tty_struct *tty)
1007 {
1008         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1009
1010         BT_DBG("tty %p dev %p", tty, dev);
1011
1012         rfcomm_dlc_throttle(dev->dlc);
1013 }
1014
1015 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
1016 {
1017         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1018
1019         BT_DBG("tty %p dev %p", tty, dev);
1020
1021         rfcomm_dlc_unthrottle(dev->dlc);
1022 }
1023
1024 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1025 {
1026         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1027
1028         BT_DBG("tty %p dev %p", tty, dev);
1029
1030         if (!dev || !dev->dlc)
1031                 return 0;
1032
1033         if (!skb_queue_empty(&dev->dlc->tx_queue))
1034                 return dev->dlc->mtu;
1035
1036         return 0;
1037 }
1038
1039 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1040 {
1041         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1042
1043         BT_DBG("tty %p dev %p", tty, dev);
1044
1045         if (!dev || !dev->dlc)
1046                 return;
1047
1048         skb_queue_purge(&dev->dlc->tx_queue);
1049         tty_wakeup(tty);
1050 }
1051
1052 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1053 {
1054         BT_DBG("tty %p ch %c", tty, ch);
1055 }
1056
1057 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1058 {
1059         BT_DBG("tty %p timeout %d", tty, timeout);
1060 }
1061
1062 static void rfcomm_tty_hangup(struct tty_struct *tty)
1063 {
1064         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1065
1066         BT_DBG("tty %p dev %p", tty, dev);
1067
1068         if (!dev)
1069                 return;
1070
1071         rfcomm_tty_flush_buffer(tty);
1072
1073         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
1074                 if (rfcomm_dev_get(dev->id) == NULL)
1075                         return;
1076                 rfcomm_dev_del(dev);
1077                 tty_port_put(&dev->port);
1078         }
1079 }
1080
1081 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1082 {
1083         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1084
1085         BT_DBG("tty %p dev %p", tty, dev);
1086
1087         return dev->modem_status;
1088 }
1089
1090 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1091 {
1092         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1093         struct rfcomm_dlc *dlc = dev->dlc;
1094         u8 v24_sig;
1095
1096         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1097
1098         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1099
1100         if (set & TIOCM_DSR || set & TIOCM_DTR)
1101                 v24_sig |= RFCOMM_V24_RTC;
1102         if (set & TIOCM_RTS || set & TIOCM_CTS)
1103                 v24_sig |= RFCOMM_V24_RTR;
1104         if (set & TIOCM_RI)
1105                 v24_sig |= RFCOMM_V24_IC;
1106         if (set & TIOCM_CD)
1107                 v24_sig |= RFCOMM_V24_DV;
1108
1109         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1110                 v24_sig &= ~RFCOMM_V24_RTC;
1111         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1112                 v24_sig &= ~RFCOMM_V24_RTR;
1113         if (clear & TIOCM_RI)
1114                 v24_sig &= ~RFCOMM_V24_IC;
1115         if (clear & TIOCM_CD)
1116                 v24_sig &= ~RFCOMM_V24_DV;
1117
1118         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1119
1120         return 0;
1121 }
1122
1123 /* ---- TTY structure ---- */
1124
1125 static const struct tty_operations rfcomm_ops = {
1126         .open                   = rfcomm_tty_open,
1127         .close                  = rfcomm_tty_close,
1128         .write                  = rfcomm_tty_write,
1129         .write_room             = rfcomm_tty_write_room,
1130         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1131         .flush_buffer           = rfcomm_tty_flush_buffer,
1132         .ioctl                  = rfcomm_tty_ioctl,
1133         .throttle               = rfcomm_tty_throttle,
1134         .unthrottle             = rfcomm_tty_unthrottle,
1135         .set_termios            = rfcomm_tty_set_termios,
1136         .send_xchar             = rfcomm_tty_send_xchar,
1137         .hangup                 = rfcomm_tty_hangup,
1138         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1139         .tiocmget               = rfcomm_tty_tiocmget,
1140         .tiocmset               = rfcomm_tty_tiocmset,
1141 };
1142
1143 int __init rfcomm_init_ttys(void)
1144 {
1145         int error;
1146
1147         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1148         if (!rfcomm_tty_driver)
1149                 return -ENOMEM;
1150
1151         rfcomm_tty_driver->driver_name  = "rfcomm";
1152         rfcomm_tty_driver->name         = "rfcomm";
1153         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1154         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1155         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1156         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1157         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1158         rfcomm_tty_driver->init_termios = tty_std_termios;
1159         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1160         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1161         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1162
1163         error = tty_register_driver(rfcomm_tty_driver);
1164         if (error) {
1165                 BT_ERR("Can't register RFCOMM TTY driver");
1166                 put_tty_driver(rfcomm_tty_driver);
1167                 return error;
1168         }
1169
1170         BT_INFO("RFCOMM TTY layer initialized");
1171
1172         return 0;
1173 }
1174
1175 void rfcomm_cleanup_ttys(void)
1176 {
1177         tty_unregister_driver(rfcomm_tty_driver);
1178         put_tty_driver(rfcomm_tty_driver);
1179 }