net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  *
  27  * $Id: tty.c,v 1.24 2002/10/03 01:54:38 holtmann Exp $
  28  */
  29
  30 #include <linux/module.h>
  31
  32 #include <linux/tty.h>
  33 #include <linux/tty_driver.h>
  34 #include <linux/tty_flip.h>
  35
  36 #include <linux/capability.h>
  37 #include <linux/slab.h>
  38 #include <linux/skbuff.h>
  39
  40 #include <net/bluetooth/bluetooth.h>
  41 #include <net/bluetooth/hci_core.h>
  42 #include <net/bluetooth/rfcomm.h>
  43
  44 #ifndef CONFIG_BT_RFCOMM_DEBUG
  45 #undef  BT_DBG
  46 #define BT_DBG(D...)
  47 #endif
  48
  49 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  50 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  51 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  52 #define RFCOMM_TTY_MINOR 0
  53
  54 static struct tty_driver *rfcomm_tty_driver;
  55
  56 struct rfcomm_dev {
  57         struct list_head        list;
  58         atomic_t                refcnt;
  59
  60         char                    name[12];
  61         int                     id;
  62         unsigned long           flags;
  63         int                     opened;
  64         int                     err;
  65
  66         bdaddr_t                src;
  67         bdaddr_t                dst;
  68         u8                      channel;
  69
  70         uint                    modem_status;
  71
  72         struct rfcomm_dlc       *dlc;
  73         struct tty_struct       *tty;
  74         wait_queue_head_t       wait;
  75         struct tasklet_struct   wakeup_task;
  76
  77         struct device           *tty_dev;
  78
  79         atomic_t                wmem_alloc;
  80 };
  81
  82 static LIST_HEAD(rfcomm_dev_list);
  83 static DEFINE_RWLOCK(rfcomm_dev_lock);
  84
  85 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  86 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  87 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  88
  89 static void rfcomm_tty_wakeup(unsigned long arg);
  90
  91 /* ---- Device functions ---- */
  92 static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
  93 {
  94         struct rfcomm_dlc *dlc = dev->dlc;
  95
  96         BT_DBG("dev %p dlc %p", dev, dlc);
  97
  98         rfcomm_dlc_lock(dlc);
  99         /* Detach DLC if it's owned by this dev */
 100         if (dlc->owner == dev)
 101                 dlc->owner = NULL;
 102         rfcomm_dlc_unlock(dlc);
 103
 104         rfcomm_dlc_put(dlc);
 105
 106         tty_unregister_device(rfcomm_tty_driver, dev->id);
 107
 108         /* Refcount should only hit zero when called from rfcomm_dev_del()
 109            which will have taken us off the list. Everything else are
 110            refcounting bugs. */
 111         BUG_ON(!list_empty(&dev->list));
 112
 113         kfree(dev);
 114
 115         /* It's safe to call module_put() here because socket still
 116            holds reference to this module. */
 117         module_put(THIS_MODULE);
 118 }
 119
 120 static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
 121 {
 122         atomic_inc(&dev->refcnt);
 123 }
 124
 125 static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
 126 {
 127         /* The reason this isn't actually a race, as you no
 128            doubt have a little voice screaming at you in your
 129            head, is that the refcount should never actually
 130            reach zero unless the device has already been taken
 131            off the list, in rfcomm_dev_del(). And if that's not
 132            true, we'll hit the BUG() in rfcomm_dev_destruct()
 133            anyway. */
 134         if (atomic_dec_and_test(&dev->refcnt))
 135                 rfcomm_dev_destruct(dev);
 136 }
 137
 138 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 139 {
 140         struct rfcomm_dev *dev;
 141         struct list_head  *p;
 142
 143         list_for_each(p, &rfcomm_dev_list) {
 144                 dev = list_entry(p, struct rfcomm_dev, list);
 145                 if (dev->id == id)
 146                         return dev;
 147         }
 148
 149         return NULL;
 150 }
 151
 152 static inline struct rfcomm_dev *rfcomm_dev_get(int id)
 153 {
 154         struct rfcomm_dev *dev;
 155
 156         read_lock(&rfcomm_dev_lock);
 157
 158         dev = __rfcomm_dev_get(id);
 159         if (dev)
 160                 rfcomm_dev_hold(dev);
 161
 162         read_unlock(&rfcomm_dev_lock);
 163
 164         return dev;
 165 }
 166
 167 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 168 {
 169         struct hci_dev *hdev;
 170         struct hci_conn *conn;
 171
 172         hdev = hci_get_route(&dev->dst, &dev->src);
 173         if (!hdev)
 174                 return NULL;
 175
 176         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 177
 178         hci_dev_put(hdev);
 179
 180         return conn ? &conn->dev : NULL;
 181 }
 182
 183 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 184 {
 185         struct rfcomm_dev *dev;
 186         struct list_head *head = &rfcomm_dev_list, *p;
 187         int err = 0;
 188
 189         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 190
 191         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 192         if (!dev)
 193                 return -ENOMEM;
 194
 195         write_lock_bh(&rfcomm_dev_lock);
 196
 197         if (req->dev_id < 0) {
 198                 dev->id = 0;
 199
 200                 list_for_each(p, &rfcomm_dev_list) {
 201                         if (list_entry(p, struct rfcomm_dev, list)->id != dev->id)
 202                                 break;
 203
 204                         dev->id++;
 205                         head = p;
 206                 }
 207         } else {
 208                 dev->id = req->dev_id;
 209
 210                 list_for_each(p, &rfcomm_dev_list) {
 211                         struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list);
 212
 213                         if (entry->id == dev->id) {
 214                                 err = -EADDRINUSE;
 215                                 goto out;
 216                         }
 217
 218                         if (entry->id > dev->id - 1)
 219                                 break;
 220
 221                         head = p;
 222                 }
 223         }
 224
 225         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 226                 err = -ENFILE;
 227                 goto out;
 228         }
 229
 230         sprintf(dev->name, "rfcomm%d", dev->id);
 231
 232         list_add(&dev->list, head);
 233         atomic_set(&dev->refcnt, 1);
 234
 235         bacpy(&dev->src, &req->src);
 236         bacpy(&dev->dst, &req->dst);
 237         dev->channel = req->channel;
 238
 239         dev->flags = req->flags &
 240                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 241
 242         init_waitqueue_head(&dev->wait);
 243         tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev);
 244
 245         rfcomm_dlc_lock(dlc);
 246         dlc->data_ready   = rfcomm_dev_data_ready;
 247         dlc->state_change = rfcomm_dev_state_change;
 248         dlc->modem_status = rfcomm_dev_modem_status;
 249
 250         dlc->owner = dev;
 251         dev->dlc   = dlc;
 252         rfcomm_dlc_unlock(dlc);
 253
 254         /* It's safe to call __module_get() here because socket already
 255            holds reference to this module. */
 256         __module_get(THIS_MODULE);
 257
 258 out:
 259         write_unlock_bh(&rfcomm_dev_lock);
 260
 261         if (err) {
 262                 kfree(dev);
 263                 return err;
 264         }
 265
 266         dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL);
 267
 268         return dev->id;
 269 }
 270
 271 static void rfcomm_dev_del(struct rfcomm_dev *dev)
 272 {
 273         BT_DBG("dev %p", dev);
 274
 275         write_lock_bh(&rfcomm_dev_lock);
 276         list_del_init(&dev->list);
 277         write_unlock_bh(&rfcomm_dev_lock);
 278
 279         rfcomm_dev_put(dev);
 280 }
 281
 282 /* ---- Send buffer ---- */
 283 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 284 {
 285         /* We can't let it be zero, because we don't get a callback
 286            when tx_credits becomes nonzero, hence we'd never wake up */
 287         return dlc->mtu * (dlc->tx_credits?:1);
 288 }
 289
 290 static void rfcomm_wfree(struct sk_buff *skb)
 291 {
 292         struct rfcomm_dev *dev = (void *) skb->sk;
 293         atomic_sub(skb->truesize, &dev->wmem_alloc);
 294         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 295                 tasklet_schedule(&dev->wakeup_task);
 296         rfcomm_dev_put(dev);
 297 }
 298
 299 static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 300 {
 301         rfcomm_dev_hold(dev);
 302         atomic_add(skb->truesize, &dev->wmem_alloc);
 303         skb->sk = (void *) dev;
 304         skb->destructor = rfcomm_wfree;
 305 }
 306
 307 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 308 {
 309         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 310                 struct sk_buff *skb = alloc_skb(size, priority);
 311                 if (skb) {
 312                         rfcomm_set_owner_w(skb, dev);
 313                         return skb;
 314                 }
 315         }
 316         return NULL;
 317 }
 318
 319 /* ---- Device IOCTLs ---- */
 320
 321 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 322
 323 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 324 {
 325         struct rfcomm_dev_req req;
 326         struct rfcomm_dlc *dlc;
 327         int id;
 328
 329         if (copy_from_user(&req, arg, sizeof(req)))
 330                 return -EFAULT;
 331
 332         BT_DBG("sk %p dev_id %id flags 0x%x", sk, req.dev_id, req.flags);
 333
 334         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 335                 return -EPERM;
 336
 337         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 338                 /* Socket must be connected */
 339                 if (sk->sk_state != BT_CONNECTED)
 340                         return -EBADFD;
 341
 342                 dlc = rfcomm_pi(sk)->dlc;
 343                 rfcomm_dlc_hold(dlc);
 344         } else {
 345                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 346                 if (!dlc)
 347                         return -ENOMEM;
 348         }
 349
 350         id = rfcomm_dev_add(&req, dlc);
 351         if (id < 0) {
 352                 rfcomm_dlc_put(dlc);
 353                 return id;
 354         }
 355
 356         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 357                 /* DLC is now used by device.
 358                  * Socket must be disconnected */
 359                 sk->sk_state = BT_CLOSED;
 360         }
 361
 362         return id;
 363 }
 364
 365 static int rfcomm_release_dev(void __user *arg)
 366 {
 367         struct rfcomm_dev_req req;
 368         struct rfcomm_dev *dev;
 369
 370         if (copy_from_user(&req, arg, sizeof(req)))
 371                 return -EFAULT;
 372
 373         BT_DBG("dev_id %id flags 0x%x", req.dev_id, req.flags);
 374
 375         if (!(dev = rfcomm_dev_get(req.dev_id)))
 376                 return -ENODEV;
 377
 378         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 379                 rfcomm_dev_put(dev);
 380                 return -EPERM;
 381         }
 382
 383         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 384                 rfcomm_dlc_close(dev->dlc, 0);
 385
 386         /* Shut down TTY synchronously before freeing rfcomm_dev */
 387         if (dev->tty)
 388                 tty_vhangup(dev->tty);
 389
 390         rfcomm_dev_del(dev);
 391         rfcomm_dev_put(dev);
 392         return 0;
 393 }
 394
 395 static int rfcomm_get_dev_list(void __user *arg)
 396 {
 397         struct rfcomm_dev_list_req *dl;
 398         struct rfcomm_dev_info *di;
 399         struct list_head *p;
 400         int n = 0, size, err;
 401         u16 dev_num;
 402
 403         BT_DBG("");
 404
 405         if (get_user(dev_num, (u16 __user *) arg))
 406                 return -EFAULT;
 407
 408         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 409                 return -EINVAL;
 410
 411         size = sizeof(*dl) + dev_num * sizeof(*di);
 412
 413         if (!(dl = kmalloc(size, GFP_KERNEL)))
 414                 return -ENOMEM;
 415
 416         di = dl->dev_info;
 417
 418         read_lock_bh(&rfcomm_dev_lock);
 419
 420         list_for_each(p, &rfcomm_dev_list) {
 421                 struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
 422                 (di + n)->id      = dev->id;
 423                 (di + n)->flags   = dev->flags;
 424                 (di + n)->state   = dev->dlc->state;
 425                 (di + n)->channel = dev->channel;
 426                 bacpy(&(di + n)->src, &dev->src);
 427                 bacpy(&(di + n)->dst, &dev->dst);
 428                 if (++n >= dev_num)
 429                         break;
 430         }
 431
 432         read_unlock_bh(&rfcomm_dev_lock);
 433
 434         dl->dev_num = n;
 435         size = sizeof(*dl) + n * sizeof(*di);
 436
 437         err = copy_to_user(arg, dl, size);
 438         kfree(dl);
 439
 440         return err ? -EFAULT : 0;
 441 }
 442
 443 static int rfcomm_get_dev_info(void __user *arg)
 444 {
 445         struct rfcomm_dev *dev;
 446         struct rfcomm_dev_info di;
 447         int err = 0;
 448
 449         BT_DBG("");
 450
 451         if (copy_from_user(&di, arg, sizeof(di)))
 452                 return -EFAULT;
 453
 454         if (!(dev = rfcomm_dev_get(di.id)))
 455                 return -ENODEV;
 456
 457         di.flags   = dev->flags;
 458         di.channel = dev->channel;
 459         di.state   = dev->dlc->state;
 460         bacpy(&di.src, &dev->src);
 461         bacpy(&di.dst, &dev->dst);
 462
 463         if (copy_to_user(arg, &di, sizeof(di)))
 464                 err = -EFAULT;
 465
 466         rfcomm_dev_put(dev);
 467         return err;
 468 }
 469
 470 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 471 {
 472         BT_DBG("cmd %d arg %p", cmd, arg);
 473
 474         switch (cmd) {
 475         case RFCOMMCREATEDEV:
 476                 return rfcomm_create_dev(sk, arg);
 477
 478         case RFCOMMRELEASEDEV:
 479                 return rfcomm_release_dev(arg);
 480
 481         case RFCOMMGETDEVLIST:
 482                 return rfcomm_get_dev_list(arg);
 483
 484         case RFCOMMGETDEVINFO:
 485                 return rfcomm_get_dev_info(arg);
 486         }
 487
 488         return -EINVAL;
 489 }
 490
 491 /* ---- DLC callbacks ---- */
 492 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 493 {
 494         struct rfcomm_dev *dev = dlc->owner;
 495         struct tty_struct *tty;
 496
 497         if (!dev || !(tty = dev->tty)) {
 498                 kfree_skb(skb);
 499                 return;
 500         }
 501
 502         BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
 503
 504         tty_insert_flip_string(tty, skb->data, skb->len);
 505         tty_flip_buffer_push(tty);
 506
 507         kfree_skb(skb);
 508 }
 509
 510 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 511 {
 512         struct rfcomm_dev *dev = dlc->owner;
 513         if (!dev)
 514                 return;
 515
 516         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 517
 518         dev->err = err;
 519         wake_up_interruptible(&dev->wait);
 520
 521         if (dlc->state == BT_CLOSED) {
 522                 if (!dev->tty) {
 523                         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 524                                 if (rfcomm_dev_get(dev->id) == NULL)
 525                                         return;
 526
 527                                 rfcomm_dev_del(dev);
 528                                 /* We have to drop DLC lock here, otherwise
 529                                    rfcomm_dev_put() will dead lock if it's
 530                                    the last reference. */
 531                                 rfcomm_dlc_unlock(dlc);
 532                                 rfcomm_dev_put(dev);
 533                                 rfcomm_dlc_lock(dlc);
 534                         }
 535                 } else
 536                         tty_hangup(dev->tty);
 537         }
 538 }
 539
 540 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 541 {
 542         struct rfcomm_dev *dev = dlc->owner;
 543         if (!dev)
 544                 return;
 545
 546         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 547
 548         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
 549                 if (dev->tty && !C_CLOCAL(dev->tty))
 550                         tty_hangup(dev->tty);
 551         }
 552
 553         dev->modem_status =
 554                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 555                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 556                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 557                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 558 }
 559
 560 /* ---- TTY functions ---- */
 561 static void rfcomm_tty_wakeup(unsigned long arg)
 562 {
 563         struct rfcomm_dev *dev = (void *) arg;
 564         struct tty_struct *tty = dev->tty;
 565         if (!tty)
 566                 return;
 567
 568         BT_DBG("dev %p tty %p", dev, tty);
 569
 570         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
 571                 (tty->ldisc.write_wakeup)(tty);
 572
 573         wake_up_interruptible(&tty->write_wait);
 574 #ifdef SERIAL_HAVE_POLL_WAIT
 575         wake_up_interruptible(&tty->poll_wait);
 576 #endif
 577 }
 578
 579 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 580 {
 581         DECLARE_WAITQUEUE(wait, current);
 582         struct rfcomm_dev *dev;
 583         struct rfcomm_dlc *dlc;
 584         int err, id;
 585
 586         id = tty->index;
 587
 588         BT_DBG("tty %p id %d", tty, id);
 589
 590         /* We don't leak this refcount. For reasons which are not entirely
 591            clear, the TTY layer will call our ->close() method even if the
 592            open fails. We decrease the refcount there, and decreasing it
 593            here too would cause breakage. */
 594         dev = rfcomm_dev_get(id);
 595         if (!dev)
 596                 return -ENODEV;
 597
 598         BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst), dev->channel, dev->opened);
 599
 600         if (dev->opened++ != 0)
 601                 return 0;
 602
 603         dlc = dev->dlc;
 604
 605         /* Attach TTY and open DLC */
 606
 607         rfcomm_dlc_lock(dlc);
 608         tty->driver_data = dev;
 609         dev->tty = tty;
 610         rfcomm_dlc_unlock(dlc);
 611         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 612
 613         err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
 614         if (err < 0)
 615                 return err;
 616
 617         /* Wait for DLC to connect */
 618         add_wait_queue(&dev->wait, &wait);
 619         while (1) {
 620                 set_current_state(TASK_INTERRUPTIBLE);
 621
 622                 if (dlc->state == BT_CLOSED) {
 623                         err = -dev->err;
 624                         break;
 625                 }
 626
 627                 if (dlc->state == BT_CONNECTED)
 628                         break;
 629
 630                 if (signal_pending(current)) {
 631                         err = -EINTR;
 632                         break;
 633                 }
 634
 635                 schedule();
 636         }
 637         set_current_state(TASK_RUNNING);
 638         remove_wait_queue(&dev->wait, &wait);
 639
 640         if (err == 0)
 641                 device_move(dev->tty_dev, rfcomm_get_device(dev));
 642
 643         return err;
 644 }
 645
 646 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 647 {
 648         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 649         if (!dev)
 650                 return;
 651
 652         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, dev->opened);
 653
 654         if (--dev->opened == 0) {
 655                 device_move(dev->tty_dev, NULL);
 656
 657                 /* Close DLC and dettach TTY */
 658                 rfcomm_dlc_close(dev->dlc, 0);
 659
 660                 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 661                 tasklet_kill(&dev->wakeup_task);
 662
 663                 rfcomm_dlc_lock(dev->dlc);
 664                 tty->driver_data = NULL;
 665                 dev->tty = NULL;
 666                 rfcomm_dlc_unlock(dev->dlc);
 667         }
 668
 669         rfcomm_dev_put(dev);
 670 }
 671
 672 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 673 {
 674         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 675         struct rfcomm_dlc *dlc = dev->dlc;
 676         struct sk_buff *skb;
 677         int err = 0, sent = 0, size;
 678
 679         BT_DBG("tty %p count %d", tty, count);
 680
 681         while (count) {
 682                 size = min_t(uint, count, dlc->mtu);
 683
 684                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 685
 686                 if (!skb)
 687                         break;
 688
 689                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 690
 691                 memcpy(skb_put(skb, size), buf + sent, size);
 692
 693                 if ((err = rfcomm_dlc_send(dlc, skb)) < 0) {
 694                         kfree_skb(skb);
 695                         break;
 696                 }
 697
 698                 sent  += size;
 699                 count -= size;
 700         }
 701
 702         return sent ? sent : err;
 703 }
 704
 705 static int rfcomm_tty_write_room(struct tty_struct *tty)
 706 {
 707         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 708         int room;
 709
 710         BT_DBG("tty %p", tty);
 711
 712         if (!dev || !dev->dlc)
 713                 return 0;
 714
 715         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 716         if (room < 0)
 717                 room = 0;
 718
 719         return room;
 720 }
 721
 722 static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd, unsigned long arg)
 723 {
 724         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 725
 726         switch (cmd) {
 727         case TCGETS:
 728                 BT_DBG("TCGETS is not supported");
 729                 return -ENOIOCTLCMD;
 730
 731         case TCSETS:
 732                 BT_DBG("TCSETS is not supported");
 733                 return -ENOIOCTLCMD;
 734
 735         case TIOCMIWAIT:
 736                 BT_DBG("TIOCMIWAIT");
 737                 break;
 738
 739         case TIOCGICOUNT:
 740                 BT_DBG("TIOCGICOUNT");
 741                 break;
 742
 743         case TIOCGSERIAL:
 744                 BT_ERR("TIOCGSERIAL is not supported");
 745                 return -ENOIOCTLCMD;
 746
 747         case TIOCSSERIAL:
 748                 BT_ERR("TIOCSSERIAL is not supported");
 749                 return -ENOIOCTLCMD;
 750
 751         case TIOCSERGSTRUCT:
 752                 BT_ERR("TIOCSERGSTRUCT is not supported");
 753                 return -ENOIOCTLCMD;
 754
 755         case TIOCSERGETLSR:
 756                 BT_ERR("TIOCSERGETLSR is not supported");
 757                 return -ENOIOCTLCMD;
 758
 759         case TIOCSERCONFIG:
 760                 BT_ERR("TIOCSERCONFIG is not supported");
 761                 return -ENOIOCTLCMD;
 762
 763         default:
 764                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 765
 766         }
 767
 768         return -ENOIOCTLCMD;
 769 }
 770
 771 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 772 {
 773         struct ktermios *new = tty->termios;
 774         int old_baud_rate = tty_termios_baud_rate(old);
 775         int new_baud_rate = tty_termios_baud_rate(new);
 776
 777         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 778         u16 changes = 0;
 779
 780         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 781
 782         BT_DBG("tty %p termios %p", tty, old);
 783
 784         if (!dev || !dev->dlc || !dev->dlc->session)
 785                 return;
 786
 787         /* Handle turning off CRTSCTS */
 788         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 789                 BT_DBG("Turning off CRTSCTS unsupported");
 790
 791         /* Parity on/off and when on, odd/even */
 792         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 793                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD)) ) {
 794                 changes |= RFCOMM_RPN_PM_PARITY;
 795                 BT_DBG("Parity change detected.");
 796         }
 797
 798         /* Mark and space parity are not supported! */
 799         if (new->c_cflag & PARENB) {
 800                 if (new->c_cflag & PARODD) {
 801                         BT_DBG("Parity is ODD");
 802                         parity = RFCOMM_RPN_PARITY_ODD;
 803                 } else {
 804                         BT_DBG("Parity is EVEN");
 805                         parity = RFCOMM_RPN_PARITY_EVEN;
 806                 }
 807         } else {
 808                 BT_DBG("Parity is OFF");
 809                 parity = RFCOMM_RPN_PARITY_NONE;
 810         }
 811
 812         /* Setting the x_on / x_off characters */
 813         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 814                 BT_DBG("XOFF custom");
 815                 x_on = new->c_cc[VSTOP];
 816                 changes |= RFCOMM_RPN_PM_XON;
 817         } else {
 818                 BT_DBG("XOFF default");
 819                 x_on = RFCOMM_RPN_XON_CHAR;
 820         }
 821
 822         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 823                 BT_DBG("XON custom");
 824                 x_off = new->c_cc[VSTART];
 825                 changes |= RFCOMM_RPN_PM_XOFF;
 826         } else {
 827                 BT_DBG("XON default");
 828                 x_off = RFCOMM_RPN_XOFF_CHAR;
 829         }
 830
 831         /* Handle setting of stop bits */
 832         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 833                 changes |= RFCOMM_RPN_PM_STOP;
 834
 835         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 836          * support 2 stop bits. So a request for 2 stop bits gets
 837          * translated to 1.5 stop bits */
 838         if (new->c_cflag & CSTOPB) {
 839                 stop_bits = RFCOMM_RPN_STOP_15;
 840         } else {
 841                 stop_bits = RFCOMM_RPN_STOP_1;
 842         }
 843
 844         /* Handle number of data bits [5-8] */
 845         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 846                 changes |= RFCOMM_RPN_PM_DATA;
 847
 848         switch (new->c_cflag & CSIZE) {
 849         case CS5:
 850                 data_bits = RFCOMM_RPN_DATA_5;
 851                 break;
 852         case CS6:
 853                 data_bits = RFCOMM_RPN_DATA_6;
 854                 break;
 855         case CS7:
 856                 data_bits = RFCOMM_RPN_DATA_7;
 857                 break;
 858         case CS8:
 859                 data_bits = RFCOMM_RPN_DATA_8;
 860                 break;
 861         default:
 862                 data_bits = RFCOMM_RPN_DATA_8;
 863                 break;
 864         }
 865
 866         /* Handle baudrate settings */
 867         if (old_baud_rate != new_baud_rate)
 868                 changes |= RFCOMM_RPN_PM_BITRATE;
 869
 870         switch (new_baud_rate) {
 871         case 2400:
 872                 baud = RFCOMM_RPN_BR_2400;
 873                 break;
 874         case 4800:
 875                 baud = RFCOMM_RPN_BR_4800;
 876                 break;
 877         case 7200:
 878                 baud = RFCOMM_RPN_BR_7200;
 879                 break;
 880         case 9600:
 881                 baud = RFCOMM_RPN_BR_9600;
 882                 break;
 883         case 19200:
 884                 baud = RFCOMM_RPN_BR_19200;
 885                 break;
 886         case 38400:
 887                 baud = RFCOMM_RPN_BR_38400;
 888                 break;
 889         case 57600:
 890                 baud = RFCOMM_RPN_BR_57600;
 891                 break;
 892         case 115200:
 893                 baud = RFCOMM_RPN_BR_115200;
 894                 break;
 895         case 230400:
 896                 baud = RFCOMM_RPN_BR_230400;
 897                 break;
 898         default:
 899                 /* 9600 is standard accordinag to the RFCOMM specification */
 900                 baud = RFCOMM_RPN_BR_9600;
 901                 break;
 902
 903         }
 904
 905         if (changes)
 906                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 907                                 data_bits, stop_bits, parity,
 908                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 909
 910         return;
 911 }
 912
 913 static void rfcomm_tty_throttle(struct tty_struct *tty)
 914 {
 915         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 916
 917         BT_DBG("tty %p dev %p", tty, dev);
 918
 919         rfcomm_dlc_throttle(dev->dlc);
 920 }
 921
 922 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 923 {
 924         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 925
 926         BT_DBG("tty %p dev %p", tty, dev);
 927
 928         rfcomm_dlc_unthrottle(dev->dlc);
 929 }
 930
 931 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 932 {
 933         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 934
 935         BT_DBG("tty %p dev %p", tty, dev);
 936
 937         if (!dev || !dev->dlc)
 938                 return 0;
 939
 940         if (!skb_queue_empty(&dev->dlc->tx_queue))
 941                 return dev->dlc->mtu;
 942
 943         return 0;
 944 }
 945
 946 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 947 {
 948         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 949
 950         BT_DBG("tty %p dev %p", tty, dev);
 951
 952         if (!dev || !dev->dlc)
 953                 return;
 954
 955         skb_queue_purge(&dev->dlc->tx_queue);
 956
 957         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
 958                 tty->ldisc.write_wakeup(tty);
 959 }
 960
 961 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
 962 {
 963         BT_DBG("tty %p ch %c", tty, ch);
 964 }
 965
 966 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
 967 {
 968         BT_DBG("tty %p timeout %d", tty, timeout);
 969 }
 970
 971 static void rfcomm_tty_hangup(struct tty_struct *tty)
 972 {
 973         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 974
 975         BT_DBG("tty %p dev %p", tty, dev);
 976
 977         if (!dev)
 978                 return;
 979
 980         rfcomm_tty_flush_buffer(tty);
 981
 982         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 983                 if (rfcomm_dev_get(dev->id) == NULL)
 984                         return;
 985                 rfcomm_dev_del(dev);
 986                 rfcomm_dev_put(dev);
 987         }
 988 }
 989
 990 static int rfcomm_tty_read_proc(char *buf, char **start, off_t offset, int len, int *eof, void *unused)
 991 {
 992         return 0;
 993 }
 994
 995 static int rfcomm_tty_tiocmget(struct tty_struct *tty, struct file *filp)
 996 {
 997         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 998
 999         BT_DBG("tty %p dev %p", tty, dev);
1000
1001         return dev->modem_status;
1002 }
1003
1004 static int rfcomm_tty_tiocmset(struct tty_struct *tty, struct file *filp, unsigned int set, unsigned int clear)
1005 {
1006         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1007         struct rfcomm_dlc *dlc = dev->dlc;
1008         u8 v24_sig;
1009
1010         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1011
1012         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1013
1014         if (set & TIOCM_DSR || set & TIOCM_DTR)
1015                 v24_sig |= RFCOMM_V24_RTC;
1016         if (set & TIOCM_RTS || set & TIOCM_CTS)
1017                 v24_sig |= RFCOMM_V24_RTR;
1018         if (set & TIOCM_RI)
1019                 v24_sig |= RFCOMM_V24_IC;
1020         if (set & TIOCM_CD)
1021                 v24_sig |= RFCOMM_V24_DV;
1022
1023         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1024                 v24_sig &= ~RFCOMM_V24_RTC;
1025         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1026                 v24_sig &= ~RFCOMM_V24_RTR;
1027         if (clear & TIOCM_RI)
1028                 v24_sig &= ~RFCOMM_V24_IC;
1029         if (clear & TIOCM_CD)
1030                 v24_sig &= ~RFCOMM_V24_DV;
1031
1032         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1033
1034         return 0;
1035 }
1036
1037 /* ---- TTY structure ---- */
1038
1039 static const struct tty_operations rfcomm_ops = {
1040         .open                   = rfcomm_tty_open,
1041         .close                  = rfcomm_tty_close,
1042         .write                  = rfcomm_tty_write,
1043         .write_room             = rfcomm_tty_write_room,
1044         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1045         .flush_buffer           = rfcomm_tty_flush_buffer,
1046         .ioctl                  = rfcomm_tty_ioctl,
1047         .throttle               = rfcomm_tty_throttle,
1048         .unthrottle             = rfcomm_tty_unthrottle,
1049         .set_termios            = rfcomm_tty_set_termios,
1050         .send_xchar             = rfcomm_tty_send_xchar,
1051         .hangup                 = rfcomm_tty_hangup,
1052         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1053         .read_proc              = rfcomm_tty_read_proc,
1054         .tiocmget               = rfcomm_tty_tiocmget,
1055         .tiocmset               = rfcomm_tty_tiocmset,
1056 };
1057
1058 int rfcomm_init_ttys(void)
1059 {
1060         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1061         if (!rfcomm_tty_driver)
1062                 return -1;
1063
1064         rfcomm_tty_driver->owner        = THIS_MODULE;
1065         rfcomm_tty_driver->driver_name  = "rfcomm";
1066         rfcomm_tty_driver->name         = "rfcomm";
1067         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1068         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1069         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1070         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1071         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1072         rfcomm_tty_driver->init_termios = tty_std_termios;
1073         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1074         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1075
1076         if (tty_register_driver(rfcomm_tty_driver)) {
1077                 BT_ERR("Can't register RFCOMM TTY driver");
1078                 put_tty_driver(rfcomm_tty_driver);
1079                 return -1;
1080         }
1081
1082         BT_INFO("RFCOMM TTY layer initialized");
1083
1084         return 0;
1085 }
1086
1087 void rfcomm_cleanup_ttys(void)
1088 {
1089         tty_unregister_driver(rfcomm_tty_driver);
1090         put_tty_driver(rfcomm_tty_driver);
1091 }