Pileus Git - ~andy/linux/blob - net/bluetooth/rfcomm/tty.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM TTY.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/tty.h>
  31 #include <linux/tty_driver.h>
  32 #include <linux/tty_flip.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36 #include <net/bluetooth/rfcomm.h>
  37
  38 #define RFCOMM_TTY_MAGIC 0x6d02         /* magic number for rfcomm struct */
  39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
  40 #define RFCOMM_TTY_MAJOR 216            /* device node major id of the usb/bluetooth.c driver */
  41 #define RFCOMM_TTY_MINOR 0
  42
  43 static struct tty_driver *rfcomm_tty_driver;
  44
  45 struct rfcomm_dev {
  46         struct tty_port         port;
  47         struct list_head        list;
  48
  49         char                    name[12];
  50         int                     id;
  51         unsigned long           flags;
  52         int                     err;
  53
  54         bdaddr_t                src;
  55         bdaddr_t                dst;
  56         u8                      channel;
  57
  58         uint                    modem_status;
  59
  60         struct rfcomm_dlc       *dlc;
  61
  62         struct device           *tty_dev;
  63
  64         atomic_t                wmem_alloc;
  65
  66         struct sk_buff_head     pending;
  67 };
  68
  69 static LIST_HEAD(rfcomm_dev_list);
  70 static DEFINE_SPINLOCK(rfcomm_dev_lock);
  71
  72 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
  73 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
  74 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
  75
  76 /* ---- Device functions ---- */
  77
  78 static void rfcomm_dev_destruct(struct tty_port *port)
  79 {
  80         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
  81         struct rfcomm_dlc *dlc = dev->dlc;
  82
  83         BT_DBG("dev %p dlc %p", dev, dlc);
  84
  85         spin_lock(&rfcomm_dev_lock);
  86         list_del(&dev->list);
  87         spin_unlock(&rfcomm_dev_lock);
  88
  89         rfcomm_dlc_lock(dlc);
  90         /* Detach DLC if it's owned by this dev */
  91         if (dlc->owner == dev)
  92                 dlc->owner = NULL;
  93         rfcomm_dlc_unlock(dlc);
  94
  95         rfcomm_dlc_put(dlc);
  96
  97         tty_unregister_device(rfcomm_tty_driver, dev->id);
  98
  99         kfree(dev);
 100
 101         /* It's safe to call module_put() here because socket still
 102            holds reference to this module. */
 103         module_put(THIS_MODULE);
 104 }
 105
 106 /* device-specific initialization: open the dlc */
 107 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty)
 108 {
 109         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 110
 111         return rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel);
 112 }
 113
 114 /* we block the open until the dlc->state becomes BT_CONNECTED */
 115 static int rfcomm_dev_carrier_raised(struct tty_port *port)
 116 {
 117         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 118
 119         return (dev->dlc->state == BT_CONNECTED);
 120 }
 121
 122 /* device-specific cleanup: close the dlc */
 123 static void rfcomm_dev_shutdown(struct tty_port *port)
 124 {
 125         struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 126
 127         if (dev->tty_dev->parent)
 128                 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 129
 130         /* close the dlc */
 131         rfcomm_dlc_close(dev->dlc, 0);
 132 }
 133
 134 static const struct tty_port_operations rfcomm_port_ops = {
 135         .destruct = rfcomm_dev_destruct,
 136         .activate = rfcomm_dev_activate,
 137         .shutdown = rfcomm_dev_shutdown,
 138         .carrier_raised = rfcomm_dev_carrier_raised,
 139 };
 140
 141 static struct rfcomm_dev *__rfcomm_dev_get(int id)
 142 {
 143         struct rfcomm_dev *dev;
 144
 145         list_for_each_entry(dev, &rfcomm_dev_list, list)
 146                 if (dev->id == id)
 147                         return dev;
 148
 149         return NULL;
 150 }
 151
 152 static struct rfcomm_dev *rfcomm_dev_get(int id)
 153 {
 154         struct rfcomm_dev *dev;
 155
 156         spin_lock(&rfcomm_dev_lock);
 157
 158         dev = __rfcomm_dev_get(id);
 159
 160         if (dev) {
 161                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 162                         dev = NULL;
 163                 else
 164                         tty_port_get(&dev->port);
 165         }
 166
 167         spin_unlock(&rfcomm_dev_lock);
 168
 169         return dev;
 170 }
 171
 172 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
 173 {
 174         struct hci_dev *hdev;
 175         struct hci_conn *conn;
 176
 177         hdev = hci_get_route(&dev->dst, &dev->src);
 178         if (!hdev)
 179                 return NULL;
 180
 181         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
 182
 183         hci_dev_put(hdev);
 184
 185         return conn ? &conn->dev : NULL;
 186 }
 187
 188 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
 189 {
 190         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 191         return sprintf(buf, "%pMR\n", &dev->dst);
 192 }
 193
 194 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
 195 {
 196         struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
 197         return sprintf(buf, "%d\n", dev->channel);
 198 }
 199
 200 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
 201 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
 202
 203 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
 204 {
 205         struct rfcomm_dev *dev, *entry;
 206         struct list_head *head = &rfcomm_dev_list;
 207         int err = 0;
 208
 209         BT_DBG("id %d channel %d", req->dev_id, req->channel);
 210
 211         dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
 212         if (!dev)
 213                 return -ENOMEM;
 214
 215         spin_lock(&rfcomm_dev_lock);
 216
 217         if (req->dev_id < 0) {
 218                 dev->id = 0;
 219
 220                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 221                         if (entry->id != dev->id)
 222                                 break;
 223
 224                         dev->id++;
 225                         head = &entry->list;
 226                 }
 227         } else {
 228                 dev->id = req->dev_id;
 229
 230                 list_for_each_entry(entry, &rfcomm_dev_list, list) {
 231                         if (entry->id == dev->id) {
 232                                 err = -EADDRINUSE;
 233                                 goto out;
 234                         }
 235
 236                         if (entry->id > dev->id - 1)
 237                                 break;
 238
 239                         head = &entry->list;
 240                 }
 241         }
 242
 243         if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
 244                 err = -ENFILE;
 245                 goto out;
 246         }
 247
 248         sprintf(dev->name, "rfcomm%d", dev->id);
 249
 250         list_add(&dev->list, head);
 251
 252         bacpy(&dev->src, &req->src);
 253         bacpy(&dev->dst, &req->dst);
 254         dev->channel = req->channel;
 255
 256         dev->flags = req->flags &
 257                 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
 258
 259         tty_port_init(&dev->port);
 260         dev->port.ops = &rfcomm_port_ops;
 261
 262         skb_queue_head_init(&dev->pending);
 263
 264         rfcomm_dlc_lock(dlc);
 265
 266         if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
 267                 struct sock *sk = dlc->owner;
 268                 struct sk_buff *skb;
 269
 270                 BUG_ON(!sk);
 271
 272                 rfcomm_dlc_throttle(dlc);
 273
 274                 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
 275                         skb_orphan(skb);
 276                         skb_queue_tail(&dev->pending, skb);
 277                         atomic_sub(skb->len, &sk->sk_rmem_alloc);
 278                 }
 279         }
 280
 281         dlc->data_ready   = rfcomm_dev_data_ready;
 282         dlc->state_change = rfcomm_dev_state_change;
 283         dlc->modem_status = rfcomm_dev_modem_status;
 284
 285         dlc->owner = dev;
 286         dev->dlc   = dlc;
 287
 288         rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
 289
 290         rfcomm_dlc_unlock(dlc);
 291
 292         /* It's safe to call __module_get() here because socket already
 293            holds reference to this module. */
 294         __module_get(THIS_MODULE);
 295
 296 out:
 297         spin_unlock(&rfcomm_dev_lock);
 298
 299         if (err < 0)
 300                 goto free;
 301
 302         dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
 303                         dev->id, NULL);
 304         if (IS_ERR(dev->tty_dev)) {
 305                 err = PTR_ERR(dev->tty_dev);
 306                 spin_lock(&rfcomm_dev_lock);
 307                 list_del(&dev->list);
 308                 spin_unlock(&rfcomm_dev_lock);
 309                 goto free;
 310         }
 311
 312         dev_set_drvdata(dev->tty_dev, dev);
 313
 314         if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
 315                 BT_ERR("Failed to create address attribute");
 316
 317         if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
 318                 BT_ERR("Failed to create channel attribute");
 319
 320         return dev->id;
 321
 322 free:
 323         kfree(dev);
 324         return err;
 325 }
 326
 327 /* ---- Send buffer ---- */
 328 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 329 {
 330         /* We can't let it be zero, because we don't get a callback
 331            when tx_credits becomes nonzero, hence we'd never wake up */
 332         return dlc->mtu * (dlc->tx_credits?:1);
 333 }
 334
 335 static void rfcomm_wfree(struct sk_buff *skb)
 336 {
 337         struct rfcomm_dev *dev = (void *) skb->sk;
 338         atomic_sub(skb->truesize, &dev->wmem_alloc);
 339         if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
 340                 tty_port_tty_wakeup(&dev->port);
 341         tty_port_put(&dev->port);
 342 }
 343
 344 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
 345 {
 346         tty_port_get(&dev->port);
 347         atomic_add(skb->truesize, &dev->wmem_alloc);
 348         skb->sk = (void *) dev;
 349         skb->destructor = rfcomm_wfree;
 350 }
 351
 352 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
 353 {
 354         if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
 355                 struct sk_buff *skb = alloc_skb(size, priority);
 356                 if (skb) {
 357                         rfcomm_set_owner_w(skb, dev);
 358                         return skb;
 359                 }
 360         }
 361         return NULL;
 362 }
 363
 364 /* ---- Device IOCTLs ---- */
 365
 366 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
 367
 368 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
 369 {
 370         struct rfcomm_dev_req req;
 371         struct rfcomm_dlc *dlc;
 372         int id;
 373
 374         if (copy_from_user(&req, arg, sizeof(req)))
 375                 return -EFAULT;
 376
 377         BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
 378
 379         if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
 380                 return -EPERM;
 381
 382         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 383                 /* Socket must be connected */
 384                 if (sk->sk_state != BT_CONNECTED)
 385                         return -EBADFD;
 386
 387                 dlc = rfcomm_pi(sk)->dlc;
 388                 rfcomm_dlc_hold(dlc);
 389         } else {
 390                 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
 391                 if (!dlc)
 392                         return -ENOMEM;
 393         }
 394
 395         id = rfcomm_dev_add(&req, dlc);
 396         if (id < 0) {
 397                 rfcomm_dlc_put(dlc);
 398                 return id;
 399         }
 400
 401         if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 402                 /* DLC is now used by device.
 403                  * Socket must be disconnected */
 404                 sk->sk_state = BT_CLOSED;
 405         }
 406
 407         return id;
 408 }
 409
 410 static int rfcomm_release_dev(void __user *arg)
 411 {
 412         struct rfcomm_dev_req req;
 413         struct rfcomm_dev *dev;
 414         struct tty_struct *tty;
 415
 416         if (copy_from_user(&req, arg, sizeof(req)))
 417                 return -EFAULT;
 418
 419         BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
 420
 421         dev = rfcomm_dev_get(req.dev_id);
 422         if (!dev)
 423                 return -ENODEV;
 424
 425         if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
 426                 tty_port_put(&dev->port);
 427                 return -EPERM;
 428         }
 429
 430         if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 431                 rfcomm_dlc_close(dev->dlc, 0);
 432
 433         /* Shut down TTY synchronously before freeing rfcomm_dev */
 434         tty = tty_port_tty_get(&dev->port);
 435         if (tty) {
 436                 tty_vhangup(tty);
 437                 tty_kref_put(tty);
 438         }
 439
 440         if (!test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 441                 tty_port_put(&dev->port);
 442
 443         tty_port_put(&dev->port);
 444         return 0;
 445 }
 446
 447 static int rfcomm_get_dev_list(void __user *arg)
 448 {
 449         struct rfcomm_dev *dev;
 450         struct rfcomm_dev_list_req *dl;
 451         struct rfcomm_dev_info *di;
 452         int n = 0, size, err;
 453         u16 dev_num;
 454
 455         BT_DBG("");
 456
 457         if (get_user(dev_num, (u16 __user *) arg))
 458                 return -EFAULT;
 459
 460         if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
 461                 return -EINVAL;
 462
 463         size = sizeof(*dl) + dev_num * sizeof(*di);
 464
 465         dl = kzalloc(size, GFP_KERNEL);
 466         if (!dl)
 467                 return -ENOMEM;
 468
 469         di = dl->dev_info;
 470
 471         spin_lock(&rfcomm_dev_lock);
 472
 473         list_for_each_entry(dev, &rfcomm_dev_list, list) {
 474                 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
 475                         continue;
 476                 (di + n)->id      = dev->id;
 477                 (di + n)->flags   = dev->flags;
 478                 (di + n)->state   = dev->dlc->state;
 479                 (di + n)->channel = dev->channel;
 480                 bacpy(&(di + n)->src, &dev->src);
 481                 bacpy(&(di + n)->dst, &dev->dst);
 482                 if (++n >= dev_num)
 483                         break;
 484         }
 485
 486         spin_unlock(&rfcomm_dev_lock);
 487
 488         dl->dev_num = n;
 489         size = sizeof(*dl) + n * sizeof(*di);
 490
 491         err = copy_to_user(arg, dl, size);
 492         kfree(dl);
 493
 494         return err ? -EFAULT : 0;
 495 }
 496
 497 static int rfcomm_get_dev_info(void __user *arg)
 498 {
 499         struct rfcomm_dev *dev;
 500         struct rfcomm_dev_info di;
 501         int err = 0;
 502
 503         BT_DBG("");
 504
 505         if (copy_from_user(&di, arg, sizeof(di)))
 506                 return -EFAULT;
 507
 508         dev = rfcomm_dev_get(di.id);
 509         if (!dev)
 510                 return -ENODEV;
 511
 512         di.flags   = dev->flags;
 513         di.channel = dev->channel;
 514         di.state   = dev->dlc->state;
 515         bacpy(&di.src, &dev->src);
 516         bacpy(&di.dst, &dev->dst);
 517
 518         if (copy_to_user(arg, &di, sizeof(di)))
 519                 err = -EFAULT;
 520
 521         tty_port_put(&dev->port);
 522         return err;
 523 }
 524
 525 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
 526 {
 527         BT_DBG("cmd %d arg %p", cmd, arg);
 528
 529         switch (cmd) {
 530         case RFCOMMCREATEDEV:
 531                 return rfcomm_create_dev(sk, arg);
 532
 533         case RFCOMMRELEASEDEV:
 534                 return rfcomm_release_dev(arg);
 535
 536         case RFCOMMGETDEVLIST:
 537                 return rfcomm_get_dev_list(arg);
 538
 539         case RFCOMMGETDEVINFO:
 540                 return rfcomm_get_dev_info(arg);
 541         }
 542
 543         return -EINVAL;
 544 }
 545
 546 /* ---- DLC callbacks ---- */
 547 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
 548 {
 549         struct rfcomm_dev *dev = dlc->owner;
 550
 551         if (!dev) {
 552                 kfree_skb(skb);
 553                 return;
 554         }
 555
 556         if (!skb_queue_empty(&dev->pending)) {
 557                 skb_queue_tail(&dev->pending, skb);
 558                 return;
 559         }
 560
 561         BT_DBG("dlc %p len %d", dlc, skb->len);
 562
 563         tty_insert_flip_string(&dev->port, skb->data, skb->len);
 564         tty_flip_buffer_push(&dev->port);
 565
 566         kfree_skb(skb);
 567 }
 568
 569 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
 570 {
 571         struct rfcomm_dev *dev = dlc->owner;
 572         if (!dev)
 573                 return;
 574
 575         BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
 576
 577         dev->err = err;
 578         if (dlc->state == BT_CONNECTED) {
 579                 device_move(dev->tty_dev, rfcomm_get_device(dev),
 580                             DPM_ORDER_DEV_AFTER_PARENT);
 581
 582                 wake_up_interruptible(&dev->port.open_wait);
 583         } else if (dlc->state == BT_CLOSED)
 584                 tty_port_tty_hangup(&dev->port, false);
 585 }
 586
 587 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
 588 {
 589         struct rfcomm_dev *dev = dlc->owner;
 590         if (!dev)
 591                 return;
 592
 593         BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
 594
 595         if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV))
 596                 tty_port_tty_hangup(&dev->port, true);
 597
 598         dev->modem_status =
 599                 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
 600                 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
 601                 ((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
 602                 ((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
 603 }
 604
 605 /* ---- TTY functions ---- */
 606 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
 607 {
 608         struct sk_buff *skb;
 609         int inserted = 0;
 610
 611         BT_DBG("dev %p", dev);
 612
 613         rfcomm_dlc_lock(dev->dlc);
 614
 615         while ((skb = skb_dequeue(&dev->pending))) {
 616                 inserted += tty_insert_flip_string(&dev->port, skb->data,
 617                                 skb->len);
 618                 kfree_skb(skb);
 619         }
 620
 621         rfcomm_dlc_unlock(dev->dlc);
 622
 623         if (inserted > 0)
 624                 tty_flip_buffer_push(&dev->port);
 625 }
 626
 627 /* do the reverse of install, clearing the tty fields and releasing the
 628  * reference to tty_port
 629  */
 630 static void rfcomm_tty_cleanup(struct tty_struct *tty)
 631 {
 632         struct rfcomm_dev *dev = tty->driver_data;
 633
 634         clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 635
 636         rfcomm_dlc_lock(dev->dlc);
 637         tty->driver_data = NULL;
 638         rfcomm_dlc_unlock(dev->dlc);
 639
 640         /*
 641          * purge the dlc->tx_queue to avoid circular dependencies
 642          * between dev and dlc
 643          */
 644         skb_queue_purge(&dev->dlc->tx_queue);
 645
 646         tty_port_put(&dev->port);
 647 }
 648
 649 /* we acquire the tty_port reference since it's here the tty is first used
 650  * by setting the termios. We also populate the driver_data field and install
 651  * the tty port
 652  */
 653 static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty)
 654 {
 655         struct rfcomm_dev *dev;
 656         struct rfcomm_dlc *dlc;
 657         int err;
 658
 659         dev = rfcomm_dev_get(tty->index);
 660         if (!dev)
 661                 return -ENODEV;
 662
 663         dlc = dev->dlc;
 664
 665         /* Attach TTY and open DLC */
 666         rfcomm_dlc_lock(dlc);
 667         tty->driver_data = dev;
 668         rfcomm_dlc_unlock(dlc);
 669         set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
 670
 671         /* install the tty_port */
 672         err = tty_port_install(&dev->port, driver, tty);
 673         if (err)
 674                 rfcomm_tty_cleanup(tty);
 675
 676         return err;
 677 }
 678
 679 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 680 {
 681         struct rfcomm_dev *dev = tty->driver_data;
 682         int err;
 683
 684         BT_DBG("tty %p id %d", tty, tty->index);
 685
 686         BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
 687                dev->channel, dev->port.count);
 688
 689         err = tty_port_open(&dev->port, tty, filp);
 690         if (err)
 691                 return err;
 692
 693         /*
 694          * FIXME: rfcomm should use proper flow control for
 695          * received data. This hack will be unnecessary and can
 696          * be removed when that's implemented
 697          */
 698         rfcomm_tty_copy_pending(dev);
 699
 700         rfcomm_dlc_unthrottle(dev->dlc);
 701
 702         return 0;
 703 }
 704
 705 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 706 {
 707         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 708
 709         BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
 710                                                 dev->port.count);
 711
 712         tty_port_close(&dev->port, tty, filp);
 713 }
 714
 715 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
 716 {
 717         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 718         struct rfcomm_dlc *dlc = dev->dlc;
 719         struct sk_buff *skb;
 720         int err = 0, sent = 0, size;
 721
 722         BT_DBG("tty %p count %d", tty, count);
 723
 724         while (count) {
 725                 size = min_t(uint, count, dlc->mtu);
 726
 727                 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
 728
 729                 if (!skb)
 730                         break;
 731
 732                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 733
 734                 memcpy(skb_put(skb, size), buf + sent, size);
 735
 736                 err = rfcomm_dlc_send(dlc, skb);
 737                 if (err < 0) {
 738                         kfree_skb(skb);
 739                         break;
 740                 }
 741
 742                 sent  += size;
 743                 count -= size;
 744         }
 745
 746         return sent ? sent : err;
 747 }
 748
 749 static int rfcomm_tty_write_room(struct tty_struct *tty)
 750 {
 751         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 752         int room;
 753
 754         BT_DBG("tty %p", tty);
 755
 756         if (!dev || !dev->dlc)
 757                 return 0;
 758
 759         room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 760         if (room < 0)
 761                 room = 0;
 762
 763         return room;
 764 }
 765
 766 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
 767 {
 768         BT_DBG("tty %p cmd 0x%02x", tty, cmd);
 769
 770         switch (cmd) {
 771         case TCGETS:
 772                 BT_DBG("TCGETS is not supported");
 773                 return -ENOIOCTLCMD;
 774
 775         case TCSETS:
 776                 BT_DBG("TCSETS is not supported");
 777                 return -ENOIOCTLCMD;
 778
 779         case TIOCMIWAIT:
 780                 BT_DBG("TIOCMIWAIT");
 781                 break;
 782
 783         case TIOCGSERIAL:
 784                 BT_ERR("TIOCGSERIAL is not supported");
 785                 return -ENOIOCTLCMD;
 786
 787         case TIOCSSERIAL:
 788                 BT_ERR("TIOCSSERIAL is not supported");
 789                 return -ENOIOCTLCMD;
 790
 791         case TIOCSERGSTRUCT:
 792                 BT_ERR("TIOCSERGSTRUCT is not supported");
 793                 return -ENOIOCTLCMD;
 794
 795         case TIOCSERGETLSR:
 796                 BT_ERR("TIOCSERGETLSR is not supported");
 797                 return -ENOIOCTLCMD;
 798
 799         case TIOCSERCONFIG:
 800                 BT_ERR("TIOCSERCONFIG is not supported");
 801                 return -ENOIOCTLCMD;
 802
 803         default:
 804                 return -ENOIOCTLCMD;    /* ioctls which we must ignore */
 805
 806         }
 807
 808         return -ENOIOCTLCMD;
 809 }
 810
 811 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
 812 {
 813         struct ktermios *new = &tty->termios;
 814         int old_baud_rate = tty_termios_baud_rate(old);
 815         int new_baud_rate = tty_termios_baud_rate(new);
 816
 817         u8 baud, data_bits, stop_bits, parity, x_on, x_off;
 818         u16 changes = 0;
 819
 820         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 821
 822         BT_DBG("tty %p termios %p", tty, old);
 823
 824         if (!dev || !dev->dlc || !dev->dlc->session)
 825                 return;
 826
 827         /* Handle turning off CRTSCTS */
 828         if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
 829                 BT_DBG("Turning off CRTSCTS unsupported");
 830
 831         /* Parity on/off and when on, odd/even */
 832         if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
 833                         ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
 834                 changes |= RFCOMM_RPN_PM_PARITY;
 835                 BT_DBG("Parity change detected.");
 836         }
 837
 838         /* Mark and space parity are not supported! */
 839         if (new->c_cflag & PARENB) {
 840                 if (new->c_cflag & PARODD) {
 841                         BT_DBG("Parity is ODD");
 842                         parity = RFCOMM_RPN_PARITY_ODD;
 843                 } else {
 844                         BT_DBG("Parity is EVEN");
 845                         parity = RFCOMM_RPN_PARITY_EVEN;
 846                 }
 847         } else {
 848                 BT_DBG("Parity is OFF");
 849                 parity = RFCOMM_RPN_PARITY_NONE;
 850         }
 851
 852         /* Setting the x_on / x_off characters */
 853         if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
 854                 BT_DBG("XOFF custom");
 855                 x_on = new->c_cc[VSTOP];
 856                 changes |= RFCOMM_RPN_PM_XON;
 857         } else {
 858                 BT_DBG("XOFF default");
 859                 x_on = RFCOMM_RPN_XON_CHAR;
 860         }
 861
 862         if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
 863                 BT_DBG("XON custom");
 864                 x_off = new->c_cc[VSTART];
 865                 changes |= RFCOMM_RPN_PM_XOFF;
 866         } else {
 867                 BT_DBG("XON default");
 868                 x_off = RFCOMM_RPN_XOFF_CHAR;
 869         }
 870
 871         /* Handle setting of stop bits */
 872         if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
 873                 changes |= RFCOMM_RPN_PM_STOP;
 874
 875         /* POSIX does not support 1.5 stop bits and RFCOMM does not
 876          * support 2 stop bits. So a request for 2 stop bits gets
 877          * translated to 1.5 stop bits */
 878         if (new->c_cflag & CSTOPB)
 879                 stop_bits = RFCOMM_RPN_STOP_15;
 880         else
 881                 stop_bits = RFCOMM_RPN_STOP_1;
 882
 883         /* Handle number of data bits [5-8] */
 884         if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
 885                 changes |= RFCOMM_RPN_PM_DATA;
 886
 887         switch (new->c_cflag & CSIZE) {
 888         case CS5:
 889                 data_bits = RFCOMM_RPN_DATA_5;
 890                 break;
 891         case CS6:
 892                 data_bits = RFCOMM_RPN_DATA_6;
 893                 break;
 894         case CS7:
 895                 data_bits = RFCOMM_RPN_DATA_7;
 896                 break;
 897         case CS8:
 898                 data_bits = RFCOMM_RPN_DATA_8;
 899                 break;
 900         default:
 901                 data_bits = RFCOMM_RPN_DATA_8;
 902                 break;
 903         }
 904
 905         /* Handle baudrate settings */
 906         if (old_baud_rate != new_baud_rate)
 907                 changes |= RFCOMM_RPN_PM_BITRATE;
 908
 909         switch (new_baud_rate) {
 910         case 2400:
 911                 baud = RFCOMM_RPN_BR_2400;
 912                 break;
 913         case 4800:
 914                 baud = RFCOMM_RPN_BR_4800;
 915                 break;
 916         case 7200:
 917                 baud = RFCOMM_RPN_BR_7200;
 918                 break;
 919         case 9600:
 920                 baud = RFCOMM_RPN_BR_9600;
 921                 break;
 922         case 19200:
 923                 baud = RFCOMM_RPN_BR_19200;
 924                 break;
 925         case 38400:
 926                 baud = RFCOMM_RPN_BR_38400;
 927                 break;
 928         case 57600:
 929                 baud = RFCOMM_RPN_BR_57600;
 930                 break;
 931         case 115200:
 932                 baud = RFCOMM_RPN_BR_115200;
 933                 break;
 934         case 230400:
 935                 baud = RFCOMM_RPN_BR_230400;
 936                 break;
 937         default:
 938                 /* 9600 is standard accordinag to the RFCOMM specification */
 939                 baud = RFCOMM_RPN_BR_9600;
 940                 break;
 941
 942         }
 943
 944         if (changes)
 945                 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
 946                                 data_bits, stop_bits, parity,
 947                                 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
 948 }
 949
 950 static void rfcomm_tty_throttle(struct tty_struct *tty)
 951 {
 952         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 953
 954         BT_DBG("tty %p dev %p", tty, dev);
 955
 956         rfcomm_dlc_throttle(dev->dlc);
 957 }
 958
 959 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 960 {
 961         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 962
 963         BT_DBG("tty %p dev %p", tty, dev);
 964
 965         rfcomm_dlc_unthrottle(dev->dlc);
 966 }
 967
 968 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 969 {
 970         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 971
 972         BT_DBG("tty %p dev %p", tty, dev);
 973
 974         if (!dev || !dev->dlc)
 975                 return 0;
 976
 977         if (!skb_queue_empty(&dev->dlc->tx_queue))
 978                 return dev->dlc->mtu;
 979
 980         return 0;
 981 }
 982
 983 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 984 {
 985         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
 986
 987         BT_DBG("tty %p dev %p", tty, dev);
 988
 989         if (!dev || !dev->dlc)
 990                 return;
 991
 992         skb_queue_purge(&dev->dlc->tx_queue);
 993         tty_wakeup(tty);
 994 }
 995
 996 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
 997 {
 998         BT_DBG("tty %p ch %c", tty, ch);
 999 }
1000
1001 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1002 {
1003         BT_DBG("tty %p timeout %d", tty, timeout);
1004 }
1005
1006 static void rfcomm_tty_hangup(struct tty_struct *tty)
1007 {
1008         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1009
1010         BT_DBG("tty %p dev %p", tty, dev);
1011
1012         tty_port_hangup(&dev->port);
1013
1014         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags) &&
1015             !test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags))
1016                 tty_port_put(&dev->port);
1017 }
1018
1019 static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1020 {
1021         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1022
1023         BT_DBG("tty %p dev %p", tty, dev);
1024
1025         return dev->modem_status;
1026 }
1027
1028 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1029 {
1030         struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1031         struct rfcomm_dlc *dlc = dev->dlc;
1032         u8 v24_sig;
1033
1034         BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1035
1036         rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1037
1038         if (set & TIOCM_DSR || set & TIOCM_DTR)
1039                 v24_sig |= RFCOMM_V24_RTC;
1040         if (set & TIOCM_RTS || set & TIOCM_CTS)
1041                 v24_sig |= RFCOMM_V24_RTR;
1042         if (set & TIOCM_RI)
1043                 v24_sig |= RFCOMM_V24_IC;
1044         if (set & TIOCM_CD)
1045                 v24_sig |= RFCOMM_V24_DV;
1046
1047         if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1048                 v24_sig &= ~RFCOMM_V24_RTC;
1049         if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1050                 v24_sig &= ~RFCOMM_V24_RTR;
1051         if (clear & TIOCM_RI)
1052                 v24_sig &= ~RFCOMM_V24_IC;
1053         if (clear & TIOCM_CD)
1054                 v24_sig &= ~RFCOMM_V24_DV;
1055
1056         rfcomm_dlc_set_modem_status(dlc, v24_sig);
1057
1058         return 0;
1059 }
1060
1061 /* ---- TTY structure ---- */
1062
1063 static const struct tty_operations rfcomm_ops = {
1064         .open                   = rfcomm_tty_open,
1065         .close                  = rfcomm_tty_close,
1066         .write                  = rfcomm_tty_write,
1067         .write_room             = rfcomm_tty_write_room,
1068         .chars_in_buffer        = rfcomm_tty_chars_in_buffer,
1069         .flush_buffer           = rfcomm_tty_flush_buffer,
1070         .ioctl                  = rfcomm_tty_ioctl,
1071         .throttle               = rfcomm_tty_throttle,
1072         .unthrottle             = rfcomm_tty_unthrottle,
1073         .set_termios            = rfcomm_tty_set_termios,
1074         .send_xchar             = rfcomm_tty_send_xchar,
1075         .hangup                 = rfcomm_tty_hangup,
1076         .wait_until_sent        = rfcomm_tty_wait_until_sent,
1077         .tiocmget               = rfcomm_tty_tiocmget,
1078         .tiocmset               = rfcomm_tty_tiocmset,
1079         .install                = rfcomm_tty_install,
1080         .cleanup                = rfcomm_tty_cleanup,
1081 };
1082
1083 int __init rfcomm_init_ttys(void)
1084 {
1085         int error;
1086
1087         rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1088         if (!rfcomm_tty_driver)
1089                 return -ENOMEM;
1090
1091         rfcomm_tty_driver->driver_name  = "rfcomm";
1092         rfcomm_tty_driver->name         = "rfcomm";
1093         rfcomm_tty_driver->major        = RFCOMM_TTY_MAJOR;
1094         rfcomm_tty_driver->minor_start  = RFCOMM_TTY_MINOR;
1095         rfcomm_tty_driver->type         = TTY_DRIVER_TYPE_SERIAL;
1096         rfcomm_tty_driver->subtype      = SERIAL_TYPE_NORMAL;
1097         rfcomm_tty_driver->flags        = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1098         rfcomm_tty_driver->init_termios = tty_std_termios;
1099         rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL;
1100         rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1101         tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1102
1103         error = tty_register_driver(rfcomm_tty_driver);
1104         if (error) {
1105                 BT_ERR("Can't register RFCOMM TTY driver");
1106                 put_tty_driver(rfcomm_tty_driver);
1107                 return error;
1108         }
1109
1110         BT_INFO("RFCOMM TTY layer initialized");
1111
1112         return 0;
1113 }
1114
1115 void rfcomm_cleanup_ttys(void)
1116 {
1117         tty_unregister_driver(rfcomm_tty_driver);
1118         put_tty_driver(rfcomm_tty_driver);
1119 }