net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <linux/capability.h>
  35 #include <linux/slab.h>
  36 #include <linux/skbuff.h>
  37
  38 #include <net/bluetooth/bluetooth.h>
  39 #include <net/bluetooth/hci_core.h>
  40 #include <net/bluetooth/rfcomm.h>
  41
  42 #ifndef CONFIG_BT_RFCOMM_DEBUG
  43 #undef  BT_DBG
  44 #define BT_DBG(D...)
  45 #endif
  46
  47 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  48 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  49 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  50 #define RFCOMM_TTY_MINOR 0
  51
  52 static struct tty_driver *rfcomm_tty_driver;
  53
  54 struct rfcomm_dev {
  55         struct list_head        list;
  56         atomic_t                refcnt;
  57
  58         char                    name[12];
  59         int                     id;
  60         unsigned long           flags;
  61         int                     opened;
  62         int                     err;
  63
  64         bdaddr_t                src;
  65         bdaddr_t                dst;
  66         u8                      channel;
  67
  68         uint                    modem_status;
  69
  70         struct rfcomm_dlc       *dlc;
  71         struct tty_struct       *tty;
  72         wait_queue_head_t       wait;
  73         struct tasklet_struct   wakeup_task;
  74
  75         struct device           *tty_dev;
  76
  77         atomic_t                wmem_alloc;
  78
  79         struct sk_buff_head     pending;
  80 };
  81
  82 static LIST_HEAD(rfcomm_dev_list);
  83 static DEFINE_RWLOCK(rfcomm_dev_lock);
  84
  85 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  86 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  87 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  88
  89 static void rfcomm_tty_wakeup(unsigned long arg);
  90
  91 /* ---- Device functions ---- */
  92 static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
  93 {
  94         struct rfcomm_dlc *dlc = dev->dlc;
  95
  96         BT_DBG("dev %p dlc %p", dev, dlc);
  97
  98         /* Refcount should only hit zero when called from rfcomm_dev_del()
  99            which will have taken us off the list. Everything else are
 100            refcounting bugs. */
 101         BUG_ON(!list_empty(&dev->list));
 102
 103         rfcomm_dlc_lock(dlc);
 104         /* Detach DLC if it's owned by this dev */
 105         if (dlc->owner == dev)
 106                 dlc->owner = NULL;
 107         rfcomm_dlc_unlock(dlc);
 108
 109         rfcomm_dlc_put(dlc);
 110
 111         tty_unregister_device(rfcomm_tty_driver, dev->id);
 112
 113         kfree(dev);
 114
 115         /* It's safe to call module_put() here because socket still
 116            holds reference to this module. */
 117         module_put(THIS_MODULE);
 118 }
 119
 120 static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
 121 {
 122         atomic_inc(&dev->refcnt);
 123 }
 124
 125 static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
 126 {
 127         /* The reason this isn't actually a race, as you no
 128            doubt have a little voice screaming at you in your
 129            head, is that the refcount should never actually
 130            reach zero unless the device has already been taken
 131            off the list, in rfcomm_dev_del(). And if that's not
 132            true, we'll hit the BUG() in rfcomm_dev_destruct()
 133            anyway. */
 134         if (atomic_dec_and_test(&dev->refcnt))
 135                 rfcomm_dev_destruct(dev);
 136 }
 137
 138 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 139 {
 140         struct rfcomm_dev *dev;
 141         struct list_head  *p;
 142
 143         list_for_each(p, &rfcomm_dev_list) {
 144                 dev = list_entry(p, struct rfcomm_dev, list);
 145                 if (dev->id == id)
 146                         return dev;
 147         }
 148
 149         return NULL;
 150 }
 151
 152 static inline struct rfcomm_dev *rfcomm_dev_get(int id)
 153 {
 154         struct rfcomm_dev *dev;
 155
 156         read_lock(&rfcomm_dev_lock);
 157
 158         dev = __rfcomm_dev_get(id);
 159
 160         if (dev) {
 161                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 162                         dev = NULL;
 163                 else
 164                         rfcomm_dev_hold(dev);
 165         }
 166
 167         read_unlock(&rfcomm_dev_lock);
 168
 169         return dev;
 170 }
 171
 172 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 173 {
 174         struct hci_dev *hdev;
 175         struct hci_conn *conn;
 176
 177         hdev = hci_get_route(&dev->dst, &dev->src);
 178         if (!hdev)
 179                 return NULL;
 180
 181         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 182
 183         hci_dev_put(hdev);
 184
 185         return conn ? &conn->dev : NULL;
 186 }
 187
 188 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 189 {
 190         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 191         bdaddr_t bdaddr;
 192         baswap(&bdaddr, &dev->dst);
 193         return sprintf(buf, "%s\n", batostr(&bdaddr));
 194 }
 195
 196 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 197 {
 198         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 199         return sprintf(buf, "%d\n", dev->channel);
 200 }
 201
 202 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 203 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 204
 205 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 206 {
 207         struct rfcomm_dev *dev;
 208         struct list_head *head = &rfcomm_dev_list, *p;
 209         int err = 0;
 210
 211         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 212
 213         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 214         if (!dev)
 215                 return -ENOMEM;
 216
 217         write_lock_bh(&rfcomm_dev_lock);
 218
 219         if (req->dev_id < 0) {
 220                 dev->id = 0;
 221
 222                 list_for_each(p, &rfcomm_dev_list) {
 223                         if (list_entry(p, struct rfcomm_dev, list)->id != dev->id)
 224                                 break;
 225
 226                         dev->id++;
 227                         head = p;
 228                 }
 229         } else {
 230                 dev->id = req->dev_id;
 231
 232                 list_for_each(p, &rfcomm_dev_list) {
 233                         struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list);
 234
 235                         if (entry->id == dev->id) {
 236                                 err = -EADDRINUSE;
 237                                 goto out;
 238                         }
 239
 240                         if (entry->id > dev->id - 1)
 241                                 break;
 242
 243                         head = p;
 244                 }
 245         }
 246
 247         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 248                 err = -ENFILE;
 249                 goto out;
 250         }
 251
 252         sprintf(dev->name, "rfcomm%d", dev->id);
 253
 254         list_add(&dev->list, head);
 255         atomic_set(&dev->refcnt, 1);
 256
 257         bacpy(&dev->src, &req->src);
 258         bacpy(&dev->dst, &req->dst);
 259         dev->channel = req->channel;
 260
 261         dev->flags = req->flags &
 262                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 263
 264         init_waitqueue_head(&dev->wait);
 265         tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev);
 266
 267         skb_queue_head_init(&dev->pending);
 268
 269         rfcomm_dlc_lock(dlc);
 270
 271         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 272                 struct sock *sk = dlc->owner;
 273                 struct sk_buff *skb;
 274
 275                 BUG_ON(!sk);
 276
 277                 rfcomm_dlc_throttle(dlc);
 278
 279                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 280                         skb_orphan(skb);
 281                         skb_queue_tail(&dev->pending, skb);
 282                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 283                 }
 284         }
 285
 286         dlc->data_ready   = rfcomm_dev_data_ready;
 287         dlc->state_change = rfcomm_dev_state_change;
 288         dlc->modem_status = rfcomm_dev_modem_status;
 289
 290         dlc->owner = dev;
 291         dev->dlc   = dlc;
 292
 293         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 294
 295         rfcomm_dlc_unlock(dlc);
 296
 297         /* It's safe to call __module_get() here because socket already
 298            holds reference to this module. */
 299         __module_get(THIS_MODULE);
 300
 301 out:
 302         write_unlock_bh(&rfcomm_dev_lock);
 303
 304         if (err < 0) {
 305                 kfree(dev);
 306                 return err;
 307         }
 308
 309         dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL);
 310
 311         if (IS_ERR(dev->tty_dev)) {
 312                 err = PTR_ERR(dev->tty_dev);
 313                 list_del(&dev->list);
 314                 kfree(dev);
 315                 return err;
 316         }
 317
 318         dev_set_drvdata(dev->tty_dev, dev);
 319
 320         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 321                 BT_ERR("Failed to create address attribute");
 322
 323         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 324                 BT_ERR("Failed to create channel attribute");
 325
 326         return dev->id;
 327 }
 328
 329 static void rfcomm_dev_del(struct rfcomm_dev *dev)
 330 {
 331         BT_DBG("dev %p", dev);
 332
 333         if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 334                 BUG_ON(1);
 335         else
 336                 set_bit(RFCOMM_TTY_RELEASED, &dev->flags);
 337
 338         write_lock_bh(&rfcomm_dev_lock);
 339         list_del_init(&dev->list);
 340         write_unlock_bh(&rfcomm_dev_lock);
 341
 342         rfcomm_dev_put(dev);
 343 }
 344
 345 /* ---- Send buffer ---- */
 346 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 347 {
 348         /* We can't let it be zero, because we don't get a callback
 349            when tx_credits becomes nonzero, hence we'd never wake up */
 350         return dlc->mtu * (dlc->tx_credits?:1);
 351 }
 352
 353 static void rfcomm_wfree(struct sk_buff *skb)
 354 {
 355         struct rfcomm_dev *dev = (void *) skb->sk;
 356         atomic_sub(skb->truesize, &dev->wmem_alloc);
 357         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 358                 tasklet_schedule(&dev->wakeup_task);
 359         rfcomm_dev_put(dev);
 360 }
 361
 362 static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 363 {
 364         rfcomm_dev_hold(dev);
 365         atomic_add(skb->truesize, &dev->wmem_alloc);
 366         skb->sk = (void *) dev;
 367         skb->destructor = rfcomm_wfree;
 368 }
 369
 370 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 371 {
 372         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 373                 struct sk_buff *skb = alloc_skb(size, priority);
 374                 if (skb) {
 375                         rfcomm_set_owner_w(skb, dev);
 376                         return skb;
 377                 }
 378         }
 379         return NULL;
 380 }
 381
 382 /* ---- Device IOCTLs ---- */
 383
 384 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 385
 386 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 387 {
 388         struct rfcomm_dev_req req;
 389         struct rfcomm_dlc *dlc;
 390         int id;
 391
 392         if (copy_from_user(&req, arg, sizeof(req)))
 393                 return -EFAULT;
 394
 395         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 396
 397         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 398                 return -EPERM;
 399
 400         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 401                 /* Socket must be connected */
 402                 if (sk->sk_state != BT_CONNECTED)
 403                         return -EBADFD;
 404
 405                 dlc = rfcomm_pi(sk)->dlc;
 406                 rfcomm_dlc_hold(dlc);
 407         } else {
 408                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 409                 if (!dlc)
 410                         return -ENOMEM;
 411         }
 412
 413         id = rfcomm_dev_add(&req, dlc);
 414         if (id < 0) {
 415                 rfcomm_dlc_put(dlc);
 416                 return id;
 417         }
 418
 419         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 420                 /* DLC is now used by device.
 421                  * Socket must be disconnected */
 422                 sk->sk_state = BT_CLOSED;
 423         }
 424
 425         return id;
 426 }
 427
 428 static int rfcomm_release_dev(void __user *arg)
 429 {
 430         struct rfcomm_dev_req req;
 431         struct rfcomm_dev *dev;
 432
 433         if (copy_from_user(&req, arg, sizeof(req)))
 434                 return -EFAULT;
 435
 436         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 437
 438         if (!(dev = rfcomm_dev_get(req.dev_id)))
 439                 return -ENODEV;
 440
 441         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 442                 rfcomm_dev_put(dev);
 443                 return -EPERM;
 444         }
 445
 446         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 447                 rfcomm_dlc_close(dev->dlc, 0);
 448
 449         /* Shut down TTY synchronously before freeing rfcomm_dev */
 450         if (dev->tty)
 451                 tty_vhangup(dev->tty);
 452
 453         if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
 454                 rfcomm_dev_del(dev);
 455         rfcomm_dev_put(dev);
 456         return 0;
 457 }
 458
 459 static int rfcomm_get_dev_list(void __user *arg)
 460 {
 461         struct rfcomm_dev_list_req *dl;
 462         struct rfcomm_dev_info *di;
 463         struct list_head *p;
 464         int n = 0, size, err;
 465         u16 dev_num;
 466
 467         BT_DBG("");
 468
 469         if (get_user(dev_num, (u16 __user *) arg))
 470                 return -EFAULT;
 471
 472         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 473                 return -EINVAL;
 474
 475         size = sizeof(*dl) + dev_num * sizeof(*di);
 476
 477         if (!(dl = kmalloc(size, GFP_KERNEL)))
 478                 return -ENOMEM;
 479
 480         di = dl->dev_info;
 481
 482         read_lock_bh(&rfcomm_dev_lock);
 483
 484         list_for_each(p, &rfcomm_dev_list) {
 485                 struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
 486                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 487                         continue;
 488                 (di + n)->id      = dev->id;
 489                 (di + n)->flags   = dev->flags;
 490                 (di + n)->state   = dev->dlc->state;
 491                 (di + n)->channel = dev->channel;
 492                 bacpy(&(di + n)->src, &dev->src);
 493                 bacpy(&(di + n)->dst, &dev->dst);
 494                 if (++n >= dev_num)
 495                         break;
 496         }
 497
 498         read_unlock_bh(&rfcomm_dev_lock);
 499
 500         dl->dev_num = n;
 501         size = sizeof(*dl) + n * sizeof(*di);
 502
 503         err = copy_to_user(arg, dl, size);
 504         kfree(dl);
 505
 506         return err ? -EFAULT : 0;
 507 }
 508
 509 static int rfcomm_get_dev_info(void __user *arg)
 510 {
 511         struct rfcomm_dev *dev;
 512         struct rfcomm_dev_info di;
 513         int err = 0;
 514
 515         BT_DBG("");
 516
 517         if (copy_from_user(&di, arg, sizeof(di)))
 518                 return -EFAULT;
 519
 520         if (!(dev = rfcomm_dev_get(di.id)))
 521                 return -ENODEV;
 522
 523         di.flags   = dev->flags;
 524         di.channel = dev->channel;
 525         di.state   = dev->dlc->state;
 526         bacpy(&di.src, &dev->src);
 527         bacpy(&di.dst, &dev->dst);
 528
 529         if (copy_to_user(arg, &di, sizeof(di)))
 530                 err = -EFAULT;
 531
 532         rfcomm_dev_put(dev);
 533         return err;
 534 }
 535
 536 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 537 {
 538         BT_DBG("cmd %d arg %p", cmd, arg);
 539
 540         switch (cmd) {
 541         case RFCOMMCREATEDEV:
 542                 return rfcomm_create_dev(sk, arg);
 543
 544         case RFCOMMRELEASEDEV:
 545                 return rfcomm_release_dev(arg);
 546
 547         case RFCOMMGETDEVLIST:
 548                 return rfcomm_get_dev_list(arg);
 549
 550         case RFCOMMGETDEVINFO:
 551                 return rfcomm_get_dev_info(arg);
 552         }
 553
 554         return -EINVAL;
 555 }
 556
 557 /* ---- DLC callbacks ---- */
 558 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 559 {
 560         struct rfcomm_dev *dev = dlc->owner;
 561         struct tty_struct *tty;
 562
 563         if (!dev) {
 564                 kfree_skb(skb);
 565                 return;
 566         }
 567
 568         if (!(tty = dev->tty) || !skb_queue_empty(&dev->pending)) {
 569                 skb_queue_tail(&dev->pending, skb);
 570                 return;
 571         }
 572
 573         BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
 574
 575         tty_insert_flip_string(tty, skb->data, skb->len);
 576         tty_flip_buffer_push(tty);
 577
 578         kfree_skb(skb);
 579 }
 580
 581 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 582 {
 583         struct rfcomm_dev *dev = dlc->owner;
 584         if (!dev)
 585                 return;
 586
 587         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 588
 589         dev->err = err;
 590         wake_up_interruptible(&dev->wait);
 591
 592         if (dlc->state == BT_CLOSED) {
 593                 if (!dev->tty) {
 594                         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 595                                 /* Drop DLC lock here to avoid deadlock
 596                                  * 1. rfcomm_dev_get will take rfcomm_dev_lock
 597                                  *    but in rfcomm_dev_add there's lock order:
 598                                  *    rfcomm_dev_lock -> dlc lock
 599                                  * 2. rfcomm_dev_put will deadlock if it's
 600                                  *    the last reference
 601                                  */
 602                                 rfcomm_dlc_unlock(dlc);
 603                                 if (rfcomm_dev_get(dev->id) == NULL) {
 604                                         rfcomm_dlc_lock(dlc);
 605                                         return;
 606                                 }
 607
 608                                 rfcomm_dev_del(dev);
 609                                 rfcomm_dev_put(dev);
 610                                 rfcomm_dlc_lock(dlc);
 611                         }
 612                 } else
 613                         tty_hangup(dev->tty);
 614         }
 615 }
 616
 617 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 618 {
 619         struct rfcomm_dev *dev = dlc->owner;
 620         if (!dev)
 621                 return;
 622
 623         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 624
 625         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
 626                 if (dev->tty && !C_CLOCAL(dev->tty))
 627                         tty_hangup(dev->tty);
 628         }
 629
 630         dev->modem_status =
 631                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 632                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 633                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 634                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 635 }
 636
 637 /* ---- TTY functions ---- */
 638 static void rfcomm_tty_wakeup(unsigned long arg)
 639 {
 640         struct rfcomm_dev *dev = (void *) arg;
 641         struct tty_struct *tty = dev->tty;
 642         if (!tty)
 643                 return;
 644
 645         BT_DBG("dev %p tty %p", dev, tty);
 646
 647         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
 648                 (tty->ldisc.write_wakeup)(tty);
 649
 650         wake_up_interruptible(&tty->write_wait);
 651 #ifdef SERIAL_HAVE_POLL_WAIT
 652         wake_up_interruptible(&tty->poll_wait);
 653 #endif
 654 }
 655
 656 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 657 {
 658         struct tty_struct *tty = dev->tty;
 659         struct sk_buff *skb;
 660         int inserted = 0;
 661
 662         if (!tty)
 663                 return;
 664
 665         BT_DBG("dev %p tty %p", dev, tty);
 666
 667         rfcomm_dlc_lock(dev->dlc);
 668
 669         while ((skb = skb_dequeue(&dev->pending))) {
 670                 inserted += tty_insert_flip_string(tty, skb->data, skb->len);
 671                 kfree_skb(skb);
 672         }
 673
 674         rfcomm_dlc_unlock(dev->dlc);
 675
 676         if (inserted > 0)
 677                 tty_flip_buffer_push(tty);
 678 }
 679
 680 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 681 {
 682         DECLARE_WAITQUEUE(wait, current);
 683         struct rfcomm_dev *dev;
 684         struct rfcomm_dlc *dlc;
 685         int err, id;
 686
 687         id = tty->index;
 688
 689         BT_DBG("tty %p id %d", tty, id);
 690
 691         /* We don't leak this refcount. For reasons which are not entirely
 692            clear, the TTY layer will call our ->close() method even if the
 693            open fails. We decrease the refcount there, and decreasing it
 694            here too would cause breakage. */
 695         dev = rfcomm_dev_get(id);
 696         if (!dev)
 697                 return -ENODEV;
 698
 699         BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst), dev->channel, dev->opened);
 700
 701         if (dev->opened++ != 0)
 702                 return 0;
 703
 704         dlc = dev->dlc;
 705
 706         /* Attach TTY and open DLC */
 707
 708         rfcomm_dlc_lock(dlc);
 709         tty->driver_data = dev;
 710         dev->tty = tty;
 711         rfcomm_dlc_unlock(dlc);
 712         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 713
 714         err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
 715         if (err < 0)
 716                 return err;
 717
 718         /* Wait for DLC to connect */
 719         add_wait_queue(&dev->wait, &wait);
 720         while (1) {
 721                 set_current_state(TASK_INTERRUPTIBLE);
 722
 723                 if (dlc->state == BT_CLOSED) {
 724                         err = -dev->err;
 725                         break;
 726                 }
 727
 728                 if (dlc->state == BT_CONNECTED)
 729                         break;
 730
 731                 if (signal_pending(current)) {
 732                         err = -EINTR;
 733                         break;
 734                 }
 735
 736                 schedule();
 737         }
 738         set_current_state(TASK_RUNNING);
 739         remove_wait_queue(&dev->wait, &wait);
 740
 741         if (err == 0)
 742                 device_move(dev->tty_dev, rfcomm_get_device(dev));
 743
 744         rfcomm_tty_copy_pending(dev);
 745
 746         rfcomm_dlc_unthrottle(dev->dlc);
 747
 748         return err;
 749 }
 750
 751 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 752 {
 753         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 754         if (!dev)
 755                 return;
 756
 757         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, dev->opened);
 758
 759         if (--dev->opened == 0) {
 760                 if (dev->tty_dev->parent)
 761                         device_move(dev->tty_dev, NULL);
 762
 763                 /* Close DLC and dettach TTY */
 764                 rfcomm_dlc_close(dev->dlc, 0);
 765
 766                 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 767                 tasklet_kill(&dev->wakeup_task);
 768
 769                 rfcomm_dlc_lock(dev->dlc);
 770                 tty->driver_data = NULL;
 771                 dev->tty = NULL;
 772                 rfcomm_dlc_unlock(dev->dlc);
 773         }
 774
 775         rfcomm_dev_put(dev);
 776 }
 777
 778 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 779 {
 780         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 781         struct rfcomm_dlc *dlc = dev->dlc;
 782         struct sk_buff *skb;
 783         int err = 0, sent = 0, size;
 784
 785         BT_DBG("tty %p count %d", tty, count);
 786
 787         while (count) {
 788                 size = min_t(uint, count, dlc->mtu);
 789
 790                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 791
 792                 if (!skb)
 793                         break;
 794
 795                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 796
 797                 memcpy(skb_put(skb, size), buf + sent, size);
 798
 799                 if ((err = rfcomm_dlc_send(dlc, skb)) < 0) {
 800                         kfree_skb(skb);
 801                         break;
 802                 }
 803
 804                 sent  += size;
 805                 count -= size;
 806         }
 807
 808         return sent ? sent : err;
 809 }
 810
 811 static int rfcomm_tty_write_room(struct tty_struct *tty)
 812 {
 813         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 814         int room;
 815
 816         BT_DBG("tty %p", tty);
 817
 818         if (!dev || !dev->dlc)
 819                 return 0;
 820
 821         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 822         if (room < 0)
 823                 room = 0;
 824
 825         return room;
 826 }
 827
 828 static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd, unsigned long arg)
 829 {
 830         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 831
 832         switch (cmd) {
 833         case TCGETS:
 834                 BT_DBG("TCGETS is not supported");
 835                 return -ENOIOCTLCMD;
 836
 837         case TCSETS:
 838                 BT_DBG("TCSETS is not supported");
 839                 return -ENOIOCTLCMD;
 840
 841         case TIOCMIWAIT:
 842                 BT_DBG("TIOCMIWAIT");
 843                 break;
 844
 845         case TIOCGICOUNT:
 846                 BT_DBG("TIOCGICOUNT");
 847                 break;
 848
 849         case TIOCGSERIAL:
 850                 BT_ERR("TIOCGSERIAL is not supported");
 851                 return -ENOIOCTLCMD;
 852
 853         case TIOCSSERIAL:
 854                 BT_ERR("TIOCSSERIAL is not supported");
 855                 return -ENOIOCTLCMD;
 856
 857         case TIOCSERGSTRUCT:
 858                 BT_ERR("TIOCSERGSTRUCT is not supported");
 859                 return -ENOIOCTLCMD;
 860
 861         case TIOCSERGETLSR:
 862                 BT_ERR("TIOCSERGETLSR is not supported");
 863                 return -ENOIOCTLCMD;
 864
 865         case TIOCSERCONFIG:
 866                 BT_ERR("TIOCSERCONFIG is not supported");
 867                 return -ENOIOCTLCMD;
 868
 869         default:
 870                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 871
 872         }
 873
 874         return -ENOIOCTLCMD;
 875 }
 876
 877 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 878 {
 879         struct ktermios *new = tty->termios;
 880         int old_baud_rate = tty_termios_baud_rate(old);
 881         int new_baud_rate = tty_termios_baud_rate(new);
 882
 883         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 884         u16 changes = 0;
 885
 886         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 887
 888         BT_DBG("tty %p termios %p", tty, old);
 889
 890         if (!dev || !dev->dlc || !dev->dlc->session)
 891                 return;
 892
 893         /* Handle turning off CRTSCTS */
 894         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 895                 BT_DBG("Turning off CRTSCTS unsupported");
 896
 897         /* Parity on/off and when on, odd/even */
 898         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 899                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD)) ) {
 900                 changes |= RFCOMM_RPN_PM_PARITY;
 901                 BT_DBG("Parity change detected.");
 902         }
 903
 904         /* Mark and space parity are not supported! */
 905         if (new->c_cflag & PARENB) {
 906                 if (new->c_cflag & PARODD) {
 907                         BT_DBG("Parity is ODD");
 908                         parity = RFCOMM_RPN_PARITY_ODD;
 909                 } else {
 910                         BT_DBG("Parity is EVEN");
 911                         parity = RFCOMM_RPN_PARITY_EVEN;
 912                 }
 913         } else {
 914                 BT_DBG("Parity is OFF");
 915                 parity = RFCOMM_RPN_PARITY_NONE;
 916         }
 917
 918         /* Setting the x_on / x_off characters */
 919         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 920                 BT_DBG("XOFF custom");
 921                 x_on = new->c_cc[VSTOP];
 922                 changes |= RFCOMM_RPN_PM_XON;
 923         } else {
 924                 BT_DBG("XOFF default");
 925                 x_on = RFCOMM_RPN_XON_CHAR;
 926         }
 927
 928         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 929                 BT_DBG("XON custom");
 930                 x_off = new->c_cc[VSTART];
 931                 changes |= RFCOMM_RPN_PM_XOFF;
 932         } else {
 933                 BT_DBG("XON default");
 934                 x_off = RFCOMM_RPN_XOFF_CHAR;
 935         }
 936
 937         /* Handle setting of stop bits */
 938         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 939                 changes |= RFCOMM_RPN_PM_STOP;
 940
 941         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 942          * support 2 stop bits. So a request for 2 stop bits gets
 943          * translated to 1.5 stop bits */
 944         if (new->c_cflag & CSTOPB) {
 945                 stop_bits = RFCOMM_RPN_STOP_15;
 946         } else {
 947                 stop_bits = RFCOMM_RPN_STOP_1;
 948         }
 949
 950         /* Handle number of data bits [5-8] */
 951         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 952                 changes |= RFCOMM_RPN_PM_DATA;
 953
 954         switch (new->c_cflag & CSIZE) {
 955         case CS5:
 956                 data_bits = RFCOMM_RPN_DATA_5;
 957                 break;
 958         case CS6:
 959                 data_bits = RFCOMM_RPN_DATA_6;
 960                 break;
 961         case CS7:
 962                 data_bits = RFCOMM_RPN_DATA_7;
 963                 break;
 964         case CS8:
 965                 data_bits = RFCOMM_RPN_DATA_8;
 966                 break;
 967         default:
 968                 data_bits = RFCOMM_RPN_DATA_8;
 969                 break;
 970         }
 971
 972         /* Handle baudrate settings */
 973         if (old_baud_rate != new_baud_rate)
 974                 changes |= RFCOMM_RPN_PM_BITRATE;
 975
 976         switch (new_baud_rate) {
 977         case 2400:
 978                 baud = RFCOMM_RPN_BR_2400;
 979                 break;
 980         case 4800:
 981                 baud = RFCOMM_RPN_BR_4800;
 982                 break;
 983         case 7200:
 984                 baud = RFCOMM_RPN_BR_7200;
 985                 break;
 986         case 9600:
 987                 baud = RFCOMM_RPN_BR_9600;
 988                 break;
 989         case 19200:
 990                 baud = RFCOMM_RPN_BR_19200;
 991                 break;
 992         case 38400:
 993                 baud = RFCOMM_RPN_BR_38400;
 994                 break;
 995         case 57600:
 996                 baud = RFCOMM_RPN_BR_57600;
 997                 break;
 998         case 115200:
 999                 baud = RFCOMM_RPN_BR_115200;
1000                 break;
1001         case 230400:
1002                 baud = RFCOMM_RPN_BR_230400;
1003                 break;
1004         default:
1005                 /* 9600 is standard accordinag to the RFCOMM specification */
1006                 baud = RFCOMM_RPN_BR_9600;
1007                 break;
1008
1009         }
1010
1011         if (changes)
1012                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
1013                                 data_bits, stop_bits, parity,
1014                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
1015
1016         return;
1017 }
1018
1019 static void rfcomm_tty_throttle(struct tty_struct *tty)
1020 {
1021         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1022
1023         BT_DBG("tty %p dev %p", tty, dev);
1024
1025         rfcomm_dlc_throttle(dev->dlc);
1026 }
1027
1028 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
1029 {
1030         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1031
1032         BT_DBG("tty %p dev %p", tty, dev);
1033
1034         rfcomm_dlc_unthrottle(dev->dlc);
1035 }
1036
1037 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1038 {
1039         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1040
1041         BT_DBG("tty %p dev %p", tty, dev);
1042
1043         if (!dev || !dev->dlc)
1044                 return 0;
1045
1046         if (!skb_queue_empty(&dev->dlc->tx_queue))
1047                 return dev->dlc->mtu;
1048
1049         return 0;
1050 }
1051
1052 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1053 {
1054         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1055
1056         BT_DBG("tty %p dev %p", tty, dev);
1057
1058         if (!dev || !dev->dlc)
1059                 return;
1060
1061         skb_queue_purge(&dev->dlc->tx_queue);
1062
1063         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
1064                 tty->ldisc.write_wakeup(tty);
1065 }
1066
1067 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1068 {
1069         BT_DBG("tty %p ch %c", tty, ch);
1070 }
1071
1072 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1073 {
1074         BT_DBG("tty %p timeout %d", tty, timeout);
1075 }
1076
1077 static void rfcomm_tty_hangup(struct tty_struct *tty)
1078 {
1079         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1080
1081         BT_DBG("tty %p dev %p", tty, dev);
1082
1083         if (!dev)
1084                 return;
1085
1086         rfcomm_tty_flush_buffer(tty);
1087
1088         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
1089                 if (rfcomm_dev_get(dev->id) == NULL)
1090                         return;
1091                 rfcomm_dev_del(dev);
1092                 rfcomm_dev_put(dev);
1093         }
1094 }
1095
1096 static int rfcomm_tty_read_proc(char *buf, char **start, off_t offset, int len, int *eof, void *unused)
1097 {
1098         return 0;
1099 }
1100
1101 static int rfcomm_tty_tiocmget(struct tty_struct *tty, struct file *filp)
1102 {
1103         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1104
1105         BT_DBG("tty %p dev %p", tty, dev);
1106
1107         return dev->modem_status;
1108 }
1109
1110 static int rfcomm_tty_tiocmset(struct tty_struct *tty, struct file *filp, unsigned int set, unsigned int clear)
1111 {
1112         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1113         struct rfcomm_dlc *dlc = dev->dlc;
1114         u8 v24_sig;
1115
1116         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1117
1118         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1119
1120         if (set & TIOCM_DSR || set & TIOCM_DTR)
1121                 v24_sig |= RFCOMM_V24_RTC;
1122         if (set & TIOCM_RTS || set & TIOCM_CTS)
1123                 v24_sig |= RFCOMM_V24_RTR;
1124         if (set & TIOCM_RI)
1125                 v24_sig |= RFCOMM_V24_IC;
1126         if (set & TIOCM_CD)
1127                 v24_sig |= RFCOMM_V24_DV;
1128
1129         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1130                 v24_sig &= ~RFCOMM_V24_RTC;
1131         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1132                 v24_sig &= ~RFCOMM_V24_RTR;
1133         if (clear & TIOCM_RI)
1134                 v24_sig &= ~RFCOMM_V24_IC;
1135         if (clear & TIOCM_CD)
1136                 v24_sig &= ~RFCOMM_V24_DV;
1137
1138         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1139
1140         return 0;
1141 }
1142
1143 /* ---- TTY structure ---- */
1144
1145 static const struct tty_operations rfcomm_ops = {
1146         .open                   = rfcomm_tty_open,
1147         .close                  = rfcomm_tty_close,
1148         .write                  = rfcomm_tty_write,
1149         .write_room             = rfcomm_tty_write_room,
1150         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1151         .flush_buffer           = rfcomm_tty_flush_buffer,
1152         .ioctl                  = rfcomm_tty_ioctl,
1153         .throttle               = rfcomm_tty_throttle,
1154         .unthrottle             = rfcomm_tty_unthrottle,
1155         .set_termios            = rfcomm_tty_set_termios,
1156         .send_xchar             = rfcomm_tty_send_xchar,
1157         .hangup                 = rfcomm_tty_hangup,
1158         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1159         .read_proc              = rfcomm_tty_read_proc,
1160         .tiocmget               = rfcomm_tty_tiocmget,
1161         .tiocmset               = rfcomm_tty_tiocmset,
1162 };
1163
1164 int rfcomm_init_ttys(void)
1165 {
1166         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1167         if (!rfcomm_tty_driver)
1168                 return -1;
1169
1170         rfcomm_tty_driver->owner        = THIS_MODULE;
1171         rfcomm_tty_driver->driver_name  = "rfcomm";
1172         rfcomm_tty_driver->name         = "rfcomm";
1173         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1174         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1175         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1176         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1177         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1178         rfcomm_tty_driver->init_termios = tty_std_termios;
1179         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1180         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1181         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1182
1183         if (tty_register_driver(rfcomm_tty_driver)) {
1184                 BT_ERR("Can't register RFCOMM TTY driver");
1185                 put_tty_driver(rfcomm_tty_driver);
1186                 return -1;
1187         }
1188
1189         BT_INFO("RFCOMM TTY layer initialized");
1190
1191         return 0;
1192 }
1193
1194 void rfcomm_cleanup_ttys(void)
1195 {
1196         tty_unregister_driver(rfcomm_tty_driver);
1197         put_tty_driver(rfcomm_tty_driver);
1198 }