net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <linux/capability.h>
  35 #include <linux/slab.h>
  36 #include <linux/skbuff.h>
  37
  38 #include <net/bluetooth/bluetooth.h>
  39 #include <net/bluetooth/hci_core.h>
  40 #include <net/bluetooth/rfcomm.h>
  41
  42 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  43 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  44 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  45 #define RFCOMM_TTY_MINOR 0
  46
  47 static struct tty_driver *rfcomm_tty_driver;
  48
  49 struct rfcomm_dev {
  50         struct list_head        list;
  51         atomic_t                refcnt;
  52
  53         char                    name[12];
  54         int                     id;
  55         unsigned long           flags;
  56         atomic_t                opened;
  57         int                     err;
  58
  59         bdaddr_t                src;
  60         bdaddr_t                dst;
  61         u8                      channel;
  62
  63         uint                    modem_status;
  64
  65         struct rfcomm_dlc       *dlc;
  66         struct tty_struct       *tty;
  67         wait_queue_head_t       wait;
  68         struct tasklet_struct   wakeup_task;
  69
  70         struct device           *tty_dev;
  71
  72         atomic_t                wmem_alloc;
  73
  74         struct sk_buff_head     pending;
  75 };
  76
  77 static LIST_HEAD(rfcomm_dev_list);
  78 static DEFINE_RWLOCK(rfcomm_dev_lock);
  79
  80 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  81 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  82 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  83
  84 static void rfcomm_tty_wakeup(unsigned long arg);
  85
  86 /* ---- Device functions ---- */
  87 static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
  88 {
  89         struct rfcomm_dlc *dlc = dev->dlc;
  90
  91         BT_DBG("dev %p dlc %p", dev, dlc);
  92
  93         /* Refcount should only hit zero when called from rfcomm_dev_del()
  94            which will have taken us off the list. Everything else are
  95            refcounting bugs. */
  96         BUG_ON(!list_empty(&dev->list));
  97
  98         rfcomm_dlc_lock(dlc);
  99         /* Detach DLC if it's owned by this dev */
 100         if (dlc->owner == dev)
 101                 dlc->owner = NULL;
 102         rfcomm_dlc_unlock(dlc);
 103
 104         rfcomm_dlc_put(dlc);
 105
 106         tty_unregister_device(rfcomm_tty_driver, dev->id);
 107
 108         kfree(dev);
 109
 110         /* It's safe to call module_put() here because socket still
 111            holds reference to this module. */
 112         module_put(THIS_MODULE);
 113 }
 114
 115 static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
 116 {
 117         atomic_inc(&dev->refcnt);
 118 }
 119
 120 static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
 121 {
 122         /* The reason this isn't actually a race, as you no
 123            doubt have a little voice screaming at you in your
 124            head, is that the refcount should never actually
 125            reach zero unless the device has already been taken
 126            off the list, in rfcomm_dev_del(). And if that's not
 127            true, we'll hit the BUG() in rfcomm_dev_destruct()
 128            anyway. */
 129         if (atomic_dec_and_test(&dev->refcnt))
 130                 rfcomm_dev_destruct(dev);
 131 }
 132
 133 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 134 {
 135         struct rfcomm_dev *dev;
 136         struct list_head  *p;
 137
 138         list_for_each(p, &rfcomm_dev_list) {
 139                 dev = list_entry(p, struct rfcomm_dev, list);
 140                 if (dev->id == id)
 141                         return dev;
 142         }
 143
 144         return NULL;
 145 }
 146
 147 static inline struct rfcomm_dev *rfcomm_dev_get(int id)
 148 {
 149         struct rfcomm_dev *dev;
 150
 151         read_lock(&rfcomm_dev_lock);
 152
 153         dev = __rfcomm_dev_get(id);
 154
 155         if (dev) {
 156                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 157                         dev = NULL;
 158                 else
 159                         rfcomm_dev_hold(dev);
 160         }
 161
 162         read_unlock(&rfcomm_dev_lock);
 163
 164         return dev;
 165 }
 166
 167 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 168 {
 169         struct hci_dev *hdev;
 170         struct hci_conn *conn;
 171
 172         hdev = hci_get_route(&dev->dst, &dev->src);
 173         if (!hdev)
 174                 return NULL;
 175
 176         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 177
 178         hci_dev_put(hdev);
 179
 180         return conn ? &conn->dev : NULL;
 181 }
 182
 183 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 184 {
 185         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 186         bdaddr_t bdaddr;
 187         baswap(&bdaddr, &dev->dst);
 188         return sprintf(buf, "%s\n", batostr(&bdaddr));
 189 }
 190
 191 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 192 {
 193         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 194         return sprintf(buf, "%d\n", dev->channel);
 195 }
 196
 197 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 198 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 199
 200 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 201 {
 202         struct rfcomm_dev *dev;
 203         struct list_head *head = &rfcomm_dev_list, *p;
 204         int err = 0;
 205
 206         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 207
 208         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 209         if (!dev)
 210                 return -ENOMEM;
 211
 212         write_lock_bh(&rfcomm_dev_lock);
 213
 214         if (req->dev_id < 0) {
 215                 dev->id = 0;
 216
 217                 list_for_each(p, &rfcomm_dev_list) {
 218                         if (list_entry(p, struct rfcomm_dev, list)->id != dev->id)
 219                                 break;
 220
 221                         dev->id++;
 222                         head = p;
 223                 }
 224         } else {
 225                 dev->id = req->dev_id;
 226
 227                 list_for_each(p, &rfcomm_dev_list) {
 228                         struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list);
 229
 230                         if (entry->id == dev->id) {
 231                                 err = -EADDRINUSE;
 232                                 goto out;
 233                         }
 234
 235                         if (entry->id > dev->id - 1)
 236                                 break;
 237
 238                         head = p;
 239                 }
 240         }
 241
 242         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 243                 err = -ENFILE;
 244                 goto out;
 245         }
 246
 247         sprintf(dev->name, "rfcomm%d", dev->id);
 248
 249         list_add(&dev->list, head);
 250         atomic_set(&dev->refcnt, 1);
 251
 252         bacpy(&dev->src, &req->src);
 253         bacpy(&dev->dst, &req->dst);
 254         dev->channel = req->channel;
 255
 256         dev->flags = req->flags &
 257                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 258
 259         atomic_set(&dev->opened, 0);
 260
 261         init_waitqueue_head(&dev->wait);
 262         tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev);
 263
 264         skb_queue_head_init(&dev->pending);
 265
 266         rfcomm_dlc_lock(dlc);
 267
 268         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 269                 struct sock *sk = dlc->owner;
 270                 struct sk_buff *skb;
 271
 272                 BUG_ON(!sk);
 273
 274                 rfcomm_dlc_throttle(dlc);
 275
 276                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 277                         skb_orphan(skb);
 278                         skb_queue_tail(&dev->pending, skb);
 279                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 280                 }
 281         }
 282
 283         dlc->data_ready   = rfcomm_dev_data_ready;
 284         dlc->state_change = rfcomm_dev_state_change;
 285         dlc->modem_status = rfcomm_dev_modem_status;
 286
 287         dlc->owner = dev;
 288         dev->dlc   = dlc;
 289
 290         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 291
 292         rfcomm_dlc_unlock(dlc);
 293
 294         /* It's safe to call __module_get() here because socket already
 295            holds reference to this module. */
 296         __module_get(THIS_MODULE);
 297
 298 out:
 299         write_unlock_bh(&rfcomm_dev_lock);
 300
 301         if (err < 0) {
 302                 kfree(dev);
 303                 return err;
 304         }
 305
 306         dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL);
 307
 308         if (IS_ERR(dev->tty_dev)) {
 309                 err = PTR_ERR(dev->tty_dev);
 310                 list_del(&dev->list);
 311                 kfree(dev);
 312                 return err;
 313         }
 314
 315         dev_set_drvdata(dev->tty_dev, dev);
 316
 317         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 318                 BT_ERR("Failed to create address attribute");
 319
 320         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 321                 BT_ERR("Failed to create channel attribute");
 322
 323         return dev->id;
 324 }
 325
 326 static void rfcomm_dev_del(struct rfcomm_dev *dev)
 327 {
 328         BT_DBG("dev %p", dev);
 329
 330         BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
 331
 332         if (atomic_read(&dev->opened) > 0)
 333                 return;
 334
 335         write_lock_bh(&rfcomm_dev_lock);
 336         list_del_init(&dev->list);
 337         write_unlock_bh(&rfcomm_dev_lock);
 338
 339         rfcomm_dev_put(dev);
 340 }
 341
 342 /* ---- Send buffer ---- */
 343 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 344 {
 345         /* We can't let it be zero, because we don't get a callback
 346            when tx_credits becomes nonzero, hence we'd never wake up */
 347         return dlc->mtu * (dlc->tx_credits?:1);
 348 }
 349
 350 static void rfcomm_wfree(struct sk_buff *skb)
 351 {
 352         struct rfcomm_dev *dev = (void *) skb->sk;
 353         atomic_sub(skb->truesize, &dev->wmem_alloc);
 354         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 355                 tasklet_schedule(&dev->wakeup_task);
 356         rfcomm_dev_put(dev);
 357 }
 358
 359 static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 360 {
 361         rfcomm_dev_hold(dev);
 362         atomic_add(skb->truesize, &dev->wmem_alloc);
 363         skb->sk = (void *) dev;
 364         skb->destructor = rfcomm_wfree;
 365 }
 366
 367 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 368 {
 369         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 370                 struct sk_buff *skb = alloc_skb(size, priority);
 371                 if (skb) {
 372                         rfcomm_set_owner_w(skb, dev);
 373                         return skb;
 374                 }
 375         }
 376         return NULL;
 377 }
 378
 379 /* ---- Device IOCTLs ---- */
 380
 381 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 382
 383 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 384 {
 385         struct rfcomm_dev_req req;
 386         struct rfcomm_dlc *dlc;
 387         int id;
 388
 389         if (copy_from_user(&req, arg, sizeof(req)))
 390                 return -EFAULT;
 391
 392         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 393
 394         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 395                 return -EPERM;
 396
 397         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 398                 /* Socket must be connected */
 399                 if (sk->sk_state != BT_CONNECTED)
 400                         return -EBADFD;
 401
 402                 dlc = rfcomm_pi(sk)->dlc;
 403                 rfcomm_dlc_hold(dlc);
 404         } else {
 405                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 406                 if (!dlc)
 407                         return -ENOMEM;
 408         }
 409
 410         id = rfcomm_dev_add(&req, dlc);
 411         if (id < 0) {
 412                 rfcomm_dlc_put(dlc);
 413                 return id;
 414         }
 415
 416         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 417                 /* DLC is now used by device.
 418                  * Socket must be disconnected */
 419                 sk->sk_state = BT_CLOSED;
 420         }
 421
 422         return id;
 423 }
 424
 425 static int rfcomm_release_dev(void __user *arg)
 426 {
 427         struct rfcomm_dev_req req;
 428         struct rfcomm_dev *dev;
 429
 430         if (copy_from_user(&req, arg, sizeof(req)))
 431                 return -EFAULT;
 432
 433         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 434
 435         if (!(dev = rfcomm_dev_get(req.dev_id)))
 436                 return -ENODEV;
 437
 438         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 439                 rfcomm_dev_put(dev);
 440                 return -EPERM;
 441         }
 442
 443         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 444                 rfcomm_dlc_close(dev->dlc, 0);
 445
 446         /* Shut down TTY synchronously before freeing rfcomm_dev */
 447         if (dev->tty)
 448                 tty_vhangup(dev->tty);
 449
 450         if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
 451                 rfcomm_dev_del(dev);
 452         rfcomm_dev_put(dev);
 453         return 0;
 454 }
 455
 456 static int rfcomm_get_dev_list(void __user *arg)
 457 {
 458         struct rfcomm_dev_list_req *dl;
 459         struct rfcomm_dev_info *di;
 460         struct list_head *p;
 461         int n = 0, size, err;
 462         u16 dev_num;
 463
 464         BT_DBG("");
 465
 466         if (get_user(dev_num, (u16 __user *) arg))
 467                 return -EFAULT;
 468
 469         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 470                 return -EINVAL;
 471
 472         size = sizeof(*dl) + dev_num * sizeof(*di);
 473
 474         if (!(dl = kmalloc(size, GFP_KERNEL)))
 475                 return -ENOMEM;
 476
 477         di = dl->dev_info;
 478
 479         read_lock_bh(&rfcomm_dev_lock);
 480
 481         list_for_each(p, &rfcomm_dev_list) {
 482                 struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
 483                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 484                         continue;
 485                 (di + n)->id      = dev->id;
 486                 (di + n)->flags   = dev->flags;
 487                 (di + n)->state   = dev->dlc->state;
 488                 (di + n)->channel = dev->channel;
 489                 bacpy(&(di + n)->src, &dev->src);
 490                 bacpy(&(di + n)->dst, &dev->dst);
 491                 if (++n >= dev_num)
 492                         break;
 493         }
 494
 495         read_unlock_bh(&rfcomm_dev_lock);
 496
 497         dl->dev_num = n;
 498         size = sizeof(*dl) + n * sizeof(*di);
 499
 500         err = copy_to_user(arg, dl, size);
 501         kfree(dl);
 502
 503         return err ? -EFAULT : 0;
 504 }
 505
 506 static int rfcomm_get_dev_info(void __user *arg)
 507 {
 508         struct rfcomm_dev *dev;
 509         struct rfcomm_dev_info di;
 510         int err = 0;
 511
 512         BT_DBG("");
 513
 514         if (copy_from_user(&di, arg, sizeof(di)))
 515                 return -EFAULT;
 516
 517         if (!(dev = rfcomm_dev_get(di.id)))
 518                 return -ENODEV;
 519
 520         di.flags   = dev->flags;
 521         di.channel = dev->channel;
 522         di.state   = dev->dlc->state;
 523         bacpy(&di.src, &dev->src);
 524         bacpy(&di.dst, &dev->dst);
 525
 526         if (copy_to_user(arg, &di, sizeof(di)))
 527                 err = -EFAULT;
 528
 529         rfcomm_dev_put(dev);
 530         return err;
 531 }
 532
 533 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 534 {
 535         BT_DBG("cmd %d arg %p", cmd, arg);
 536
 537         switch (cmd) {
 538         case RFCOMMCREATEDEV:
 539                 return rfcomm_create_dev(sk, arg);
 540
 541         case RFCOMMRELEASEDEV:
 542                 return rfcomm_release_dev(arg);
 543
 544         case RFCOMMGETDEVLIST:
 545                 return rfcomm_get_dev_list(arg);
 546
 547         case RFCOMMGETDEVINFO:
 548                 return rfcomm_get_dev_info(arg);
 549         }
 550
 551         return -EINVAL;
 552 }
 553
 554 /* ---- DLC callbacks ---- */
 555 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 556 {
 557         struct rfcomm_dev *dev = dlc->owner;
 558         struct tty_struct *tty;
 559
 560         if (!dev) {
 561                 kfree_skb(skb);
 562                 return;
 563         }
 564
 565         if (!(tty = dev->tty) || !skb_queue_empty(&dev->pending)) {
 566                 skb_queue_tail(&dev->pending, skb);
 567                 return;
 568         }
 569
 570         BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
 571
 572         tty_insert_flip_string(tty, skb->data, skb->len);
 573         tty_flip_buffer_push(tty);
 574
 575         kfree_skb(skb);
 576 }
 577
 578 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 579 {
 580         struct rfcomm_dev *dev = dlc->owner;
 581         if (!dev)
 582                 return;
 583
 584         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 585
 586         dev->err = err;
 587         wake_up_interruptible(&dev->wait);
 588
 589         if (dlc->state == BT_CLOSED) {
 590                 if (!dev->tty) {
 591                         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
 592                                 /* Drop DLC lock here to avoid deadlock
 593                                  * 1. rfcomm_dev_get will take rfcomm_dev_lock
 594                                  *    but in rfcomm_dev_add there's lock order:
 595                                  *    rfcomm_dev_lock -> dlc lock
 596                                  * 2. rfcomm_dev_put will deadlock if it's
 597                                  *    the last reference
 598                                  */
 599                                 rfcomm_dlc_unlock(dlc);
 600                                 if (rfcomm_dev_get(dev->id) == NULL) {
 601                                         rfcomm_dlc_lock(dlc);
 602                                         return;
 603                                 }
 604
 605                                 rfcomm_dev_del(dev);
 606                                 rfcomm_dev_put(dev);
 607                                 rfcomm_dlc_lock(dlc);
 608                         }
 609                 } else
 610                         tty_hangup(dev->tty);
 611         }
 612 }
 613
 614 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 615 {
 616         struct rfcomm_dev *dev = dlc->owner;
 617         if (!dev)
 618                 return;
 619
 620         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 621
 622         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
 623                 if (dev->tty && !C_CLOCAL(dev->tty))
 624                         tty_hangup(dev->tty);
 625         }
 626
 627         dev->modem_status =
 628                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 629                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 630                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 631                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 632 }
 633
 634 /* ---- TTY functions ---- */
 635 static void rfcomm_tty_wakeup(unsigned long arg)
 636 {
 637         struct rfcomm_dev *dev = (void *) arg;
 638         struct tty_struct *tty = dev->tty;
 639         if (!tty)
 640                 return;
 641
 642         BT_DBG("dev %p tty %p", dev, tty);
 643         tty_wakeup(tty);
 644 }
 645
 646 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 647 {
 648         struct tty_struct *tty = dev->tty;
 649         struct sk_buff *skb;
 650         int inserted = 0;
 651
 652         if (!tty)
 653                 return;
 654
 655         BT_DBG("dev %p tty %p", dev, tty);
 656
 657         rfcomm_dlc_lock(dev->dlc);
 658
 659         while ((skb = skb_dequeue(&dev->pending))) {
 660                 inserted += tty_insert_flip_string(tty, skb->data, skb->len);
 661                 kfree_skb(skb);
 662         }
 663
 664         rfcomm_dlc_unlock(dev->dlc);
 665
 666         if (inserted > 0)
 667                 tty_flip_buffer_push(tty);
 668 }
 669
 670 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 671 {
 672         DECLARE_WAITQUEUE(wait, current);
 673         struct rfcomm_dev *dev;
 674         struct rfcomm_dlc *dlc;
 675         int err, id;
 676
 677         id = tty->index;
 678
 679         BT_DBG("tty %p id %d", tty, id);
 680
 681         /* We don't leak this refcount. For reasons which are not entirely
 682            clear, the TTY layer will call our ->close() method even if the
 683            open fails. We decrease the refcount there, and decreasing it
 684            here too would cause breakage. */
 685         dev = rfcomm_dev_get(id);
 686         if (!dev)
 687                 return -ENODEV;
 688
 689         BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst),
 690                                 dev->channel, atomic_read(&dev->opened));
 691
 692         if (atomic_inc_return(&dev->opened) > 1)
 693                 return 0;
 694
 695         dlc = dev->dlc;
 696
 697         /* Attach TTY and open DLC */
 698
 699         rfcomm_dlc_lock(dlc);
 700         tty->driver_data = dev;
 701         dev->tty = tty;
 702         rfcomm_dlc_unlock(dlc);
 703         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 704
 705         err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
 706         if (err < 0)
 707                 return err;
 708
 709         /* Wait for DLC to connect */
 710         add_wait_queue(&dev->wait, &wait);
 711         while (1) {
 712                 set_current_state(TASK_INTERRUPTIBLE);
 713
 714                 if (dlc->state == BT_CLOSED) {
 715                         err = -dev->err;
 716                         break;
 717                 }
 718
 719                 if (dlc->state == BT_CONNECTED)
 720                         break;
 721
 722                 if (signal_pending(current)) {
 723                         err = -EINTR;
 724                         break;
 725                 }
 726
 727                 schedule();
 728         }
 729         set_current_state(TASK_RUNNING);
 730         remove_wait_queue(&dev->wait, &wait);
 731
 732         if (err == 0)
 733                 device_move(dev->tty_dev, rfcomm_get_device(dev));
 734
 735         rfcomm_tty_copy_pending(dev);
 736
 737         rfcomm_dlc_unthrottle(dev->dlc);
 738
 739         return err;
 740 }
 741
 742 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 743 {
 744         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 745         if (!dev)
 746                 return;
 747
 748         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 749                                                 atomic_read(&dev->opened));
 750
 751         if (atomic_dec_and_test(&dev->opened)) {
 752                 if (dev->tty_dev->parent)
 753                         device_move(dev->tty_dev, NULL);
 754
 755                 /* Close DLC and dettach TTY */
 756                 rfcomm_dlc_close(dev->dlc, 0);
 757
 758                 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 759                 tasklet_kill(&dev->wakeup_task);
 760
 761                 rfcomm_dlc_lock(dev->dlc);
 762                 tty->driver_data = NULL;
 763                 dev->tty = NULL;
 764                 rfcomm_dlc_unlock(dev->dlc);
 765
 766                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) {
 767                         write_lock_bh(&rfcomm_dev_lock);
 768                         list_del_init(&dev->list);
 769                         write_unlock_bh(&rfcomm_dev_lock);
 770
 771                         rfcomm_dev_put(dev);
 772                 }
 773         }
 774
 775         rfcomm_dev_put(dev);
 776 }
 777
 778 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 779 {
 780         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 781         struct rfcomm_dlc *dlc = dev->dlc;
 782         struct sk_buff *skb;
 783         int err = 0, sent = 0, size;
 784
 785         BT_DBG("tty %p count %d", tty, count);
 786
 787         while (count) {
 788                 size = min_t(uint, count, dlc->mtu);
 789
 790                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 791
 792                 if (!skb)
 793                         break;
 794
 795                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 796
 797                 memcpy(skb_put(skb, size), buf + sent, size);
 798
 799                 if ((err = rfcomm_dlc_send(dlc, skb)) < 0) {
 800                         kfree_skb(skb);
 801                         break;
 802                 }
 803
 804                 sent  += size;
 805                 count -= size;
 806         }
 807
 808         return sent ? sent : err;
 809 }
 810
 811 static int rfcomm_tty_write_room(struct tty_struct *tty)
 812 {
 813         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 814         int room;
 815
 816         BT_DBG("tty %p", tty);
 817
 818         if (!dev || !dev->dlc)
 819                 return 0;
 820
 821         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 822         if (room < 0)
 823                 room = 0;
 824
 825         return room;
 826 }
 827
 828 static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd, unsigned long arg)
 829 {
 830         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 831
 832         switch (cmd) {
 833         case TCGETS:
 834                 BT_DBG("TCGETS is not supported");
 835                 return -ENOIOCTLCMD;
 836
 837         case TCSETS:
 838                 BT_DBG("TCSETS is not supported");
 839                 return -ENOIOCTLCMD;
 840
 841         case TIOCMIWAIT:
 842                 BT_DBG("TIOCMIWAIT");
 843                 break;
 844
 845         case TIOCGICOUNT:
 846                 BT_DBG("TIOCGICOUNT");
 847                 break;
 848
 849         case TIOCGSERIAL:
 850                 BT_ERR("TIOCGSERIAL is not supported");
 851                 return -ENOIOCTLCMD;
 852
 853         case TIOCSSERIAL:
 854                 BT_ERR("TIOCSSERIAL is not supported");
 855                 return -ENOIOCTLCMD;
 856
 857         case TIOCSERGSTRUCT:
 858                 BT_ERR("TIOCSERGSTRUCT is not supported");
 859                 return -ENOIOCTLCMD;
 860
 861         case TIOCSERGETLSR:
 862                 BT_ERR("TIOCSERGETLSR is not supported");
 863                 return -ENOIOCTLCMD;
 864
 865         case TIOCSERCONFIG:
 866                 BT_ERR("TIOCSERCONFIG is not supported");
 867                 return -ENOIOCTLCMD;
 868
 869         default:
 870                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 871
 872         }
 873
 874         return -ENOIOCTLCMD;
 875 }
 876
 877 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 878 {
 879         struct ktermios *new = tty->termios;
 880         int old_baud_rate = tty_termios_baud_rate(old);
 881         int new_baud_rate = tty_termios_baud_rate(new);
 882
 883         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 884         u16 changes = 0;
 885
 886         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 887
 888         BT_DBG("tty %p termios %p", tty, old);
 889
 890         if (!dev || !dev->dlc || !dev->dlc->session)
 891                 return;
 892
 893         /* Handle turning off CRTSCTS */
 894         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 895                 BT_DBG("Turning off CRTSCTS unsupported");
 896
 897         /* Parity on/off and when on, odd/even */
 898         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 899                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD)) ) {
 900                 changes |= RFCOMM_RPN_PM_PARITY;
 901                 BT_DBG("Parity change detected.");
 902         }
 903
 904         /* Mark and space parity are not supported! */
 905         if (new->c_cflag & PARENB) {
 906                 if (new->c_cflag & PARODD) {
 907                         BT_DBG("Parity is ODD");
 908                         parity = RFCOMM_RPN_PARITY_ODD;
 909                 } else {
 910                         BT_DBG("Parity is EVEN");
 911                         parity = RFCOMM_RPN_PARITY_EVEN;
 912                 }
 913         } else {
 914                 BT_DBG("Parity is OFF");
 915                 parity = RFCOMM_RPN_PARITY_NONE;
 916         }
 917
 918         /* Setting the x_on / x_off characters */
 919         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 920                 BT_DBG("XOFF custom");
 921                 x_on = new->c_cc[VSTOP];
 922                 changes |= RFCOMM_RPN_PM_XON;
 923         } else {
 924                 BT_DBG("XOFF default");
 925                 x_on = RFCOMM_RPN_XON_CHAR;
 926         }
 927
 928         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 929                 BT_DBG("XON custom");
 930                 x_off = new->c_cc[VSTART];
 931                 changes |= RFCOMM_RPN_PM_XOFF;
 932         } else {
 933                 BT_DBG("XON default");
 934                 x_off = RFCOMM_RPN_XOFF_CHAR;
 935         }
 936
 937         /* Handle setting of stop bits */
 938         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 939                 changes |= RFCOMM_RPN_PM_STOP;
 940
 941         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 942          * support 2 stop bits. So a request for 2 stop bits gets
 943          * translated to 1.5 stop bits */
 944         if (new->c_cflag & CSTOPB) {
 945                 stop_bits = RFCOMM_RPN_STOP_15;
 946         } else {
 947                 stop_bits = RFCOMM_RPN_STOP_1;
 948         }
 949
 950         /* Handle number of data bits [5-8] */
 951         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 952                 changes |= RFCOMM_RPN_PM_DATA;
 953
 954         switch (new->c_cflag & CSIZE) {
 955         case CS5:
 956                 data_bits = RFCOMM_RPN_DATA_5;
 957                 break;
 958         case CS6:
 959                 data_bits = RFCOMM_RPN_DATA_6;
 960                 break;
 961         case CS7:
 962                 data_bits = RFCOMM_RPN_DATA_7;
 963                 break;
 964         case CS8:
 965                 data_bits = RFCOMM_RPN_DATA_8;
 966                 break;
 967         default:
 968                 data_bits = RFCOMM_RPN_DATA_8;
 969                 break;
 970         }
 971
 972         /* Handle baudrate settings */
 973         if (old_baud_rate != new_baud_rate)
 974                 changes |= RFCOMM_RPN_PM_BITRATE;
 975
 976         switch (new_baud_rate) {
 977         case 2400:
 978                 baud = RFCOMM_RPN_BR_2400;
 979                 break;
 980         case 4800:
 981                 baud = RFCOMM_RPN_BR_4800;
 982                 break;
 983         case 7200:
 984                 baud = RFCOMM_RPN_BR_7200;
 985                 break;
 986         case 9600:
 987                 baud = RFCOMM_RPN_BR_9600;
 988                 break;
 989         case 19200:
 990                 baud = RFCOMM_RPN_BR_19200;
 991                 break;
 992         case 38400:
 993                 baud = RFCOMM_RPN_BR_38400;
 994                 break;
 995         case 57600:
 996                 baud = RFCOMM_RPN_BR_57600;
 997                 break;
 998         case 115200:
 999                 baud = RFCOMM_RPN_BR_115200;
1000                 break;
1001         case 230400:
1002                 baud = RFCOMM_RPN_BR_230400;
1003                 break;
1004         default:
1005                 /* 9600 is standard accordinag to the RFCOMM specification */
1006                 baud = RFCOMM_RPN_BR_9600;
1007                 break;
1008
1009         }
1010
1011         if (changes)
1012                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
1013                                 data_bits, stop_bits, parity,
1014                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
1015
1016         return;
1017 }
1018
1019 static void rfcomm_tty_throttle(struct tty_struct *tty)
1020 {
1021         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1022
1023         BT_DBG("tty %p dev %p", tty, dev);
1024
1025         rfcomm_dlc_throttle(dev->dlc);
1026 }
1027
1028 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
1029 {
1030         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1031
1032         BT_DBG("tty %p dev %p", tty, dev);
1033
1034         rfcomm_dlc_unthrottle(dev->dlc);
1035 }
1036
1037 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1038 {
1039         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1040
1041         BT_DBG("tty %p dev %p", tty, dev);
1042
1043         if (!dev || !dev->dlc)
1044                 return 0;
1045
1046         if (!skb_queue_empty(&dev->dlc->tx_queue))
1047                 return dev->dlc->mtu;
1048
1049         return 0;
1050 }
1051
1052 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1053 {
1054         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1055
1056         BT_DBG("tty %p dev %p", tty, dev);
1057
1058         if (!dev || !dev->dlc)
1059                 return;
1060
1061         skb_queue_purge(&dev->dlc->tx_queue);
1062         tty_wakeup(tty);
1063 }
1064
1065 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1066 {
1067         BT_DBG("tty %p ch %c", tty, ch);
1068 }
1069
1070 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1071 {
1072         BT_DBG("tty %p timeout %d", tty, timeout);
1073 }
1074
1075 static void rfcomm_tty_hangup(struct tty_struct *tty)
1076 {
1077         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1078
1079         BT_DBG("tty %p dev %p", tty, dev);
1080
1081         if (!dev)
1082                 return;
1083
1084         rfcomm_tty_flush_buffer(tty);
1085
1086         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
1087                 if (rfcomm_dev_get(dev->id) == NULL)
1088                         return;
1089                 rfcomm_dev_del(dev);
1090                 rfcomm_dev_put(dev);
1091         }
1092 }
1093
1094 static int rfcomm_tty_read_proc(char *buf, char **start, off_t offset, int len, int *eof, void *unused)
1095 {
1096         return 0;
1097 }
1098
1099 static int rfcomm_tty_tiocmget(struct tty_struct *tty, struct file *filp)
1100 {
1101         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1102
1103         BT_DBG("tty %p dev %p", tty, dev);
1104
1105         return dev->modem_status;
1106 }
1107
1108 static int rfcomm_tty_tiocmset(struct tty_struct *tty, struct file *filp, unsigned int set, unsigned int clear)
1109 {
1110         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1111         struct rfcomm_dlc *dlc = dev->dlc;
1112         u8 v24_sig;
1113
1114         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1115
1116         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1117
1118         if (set & TIOCM_DSR || set & TIOCM_DTR)
1119                 v24_sig |= RFCOMM_V24_RTC;
1120         if (set & TIOCM_RTS || set & TIOCM_CTS)
1121                 v24_sig |= RFCOMM_V24_RTR;
1122         if (set & TIOCM_RI)
1123                 v24_sig |= RFCOMM_V24_IC;
1124         if (set & TIOCM_CD)
1125                 v24_sig |= RFCOMM_V24_DV;
1126
1127         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1128                 v24_sig &= ~RFCOMM_V24_RTC;
1129         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1130                 v24_sig &= ~RFCOMM_V24_RTR;
1131         if (clear & TIOCM_RI)
1132                 v24_sig &= ~RFCOMM_V24_IC;
1133         if (clear & TIOCM_CD)
1134                 v24_sig &= ~RFCOMM_V24_DV;
1135
1136         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1137
1138         return 0;
1139 }
1140
1141 /* ---- TTY structure ---- */
1142
1143 static const struct tty_operations rfcomm_ops = {
1144         .open                   = rfcomm_tty_open,
1145         .close                  = rfcomm_tty_close,
1146         .write                  = rfcomm_tty_write,
1147         .write_room             = rfcomm_tty_write_room,
1148         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1149         .flush_buffer           = rfcomm_tty_flush_buffer,
1150         .ioctl                  = rfcomm_tty_ioctl,
1151         .throttle               = rfcomm_tty_throttle,
1152         .unthrottle             = rfcomm_tty_unthrottle,
1153         .set_termios            = rfcomm_tty_set_termios,
1154         .send_xchar             = rfcomm_tty_send_xchar,
1155         .hangup                 = rfcomm_tty_hangup,
1156         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1157         .read_proc              = rfcomm_tty_read_proc,
1158         .tiocmget               = rfcomm_tty_tiocmget,
1159         .tiocmset               = rfcomm_tty_tiocmset,
1160 };
1161
1162 int rfcomm_init_ttys(void)
1163 {
1164         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1165         if (!rfcomm_tty_driver)
1166                 return -1;
1167
1168         rfcomm_tty_driver->owner        = THIS_MODULE;
1169         rfcomm_tty_driver->driver_name  = "rfcomm";
1170         rfcomm_tty_driver->name         = "rfcomm";
1171         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1172         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1173         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1174         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1175         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1176         rfcomm_tty_driver->init_termios = tty_std_termios;
1177         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1178         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1179         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1180
1181         if (tty_register_driver(rfcomm_tty_driver)) {
1182                 BT_ERR("Can't register RFCOMM TTY driver");
1183                 put_tty_driver(rfcomm_tty_driver);
1184                 return -1;
1185         }
1186
1187         BT_INFO("RFCOMM TTY layer initialized");
1188
1189         return 0;
1190 }
1191
1192 void rfcomm_cleanup_ttys(void)
1193 {
1194         tty_unregister_driver(rfcomm_tty_driver);
1195         put_tty_driver(rfcomm_tty_driver);
1196 }