1/*
2   RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3   Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4   Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6   This program is free software; you can redistribute it and/or modify
7   it under the terms of the GNU General Public License version 2 as
8   published by the Free Software Foundation;
9
10   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21   SOFTWARE IS DISCLAIMED.
22*/
23
24/*
25 * RFCOMM TTY.
26 */
27
28#include <linux/module.h>
29
30#include <linux/tty.h>
31#include <linux/tty_driver.h>
32#include <linux/tty_flip.h>
33
34#include <net/bluetooth/bluetooth.h>
35#include <net/bluetooth/hci_core.h>
36#include <net/bluetooth/rfcomm.h>
37
38#define RFCOMM_TTY_MAGIC 0x6d02		/* magic number for rfcomm struct */
39#define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV	/* whole lotta rfcomm devices */
40#define RFCOMM_TTY_MAJOR 216		/* device node major id of the usb/bluetooth.c driver */
41#define RFCOMM_TTY_MINOR 0
42
43static struct tty_driver *rfcomm_tty_driver;
44
45struct rfcomm_dev {
46	struct tty_port		port;
47	struct list_head	list;
48
49	char			name[12];
50	int			id;
51	unsigned long		flags;
52	int			err;
53
54	bdaddr_t		src;
55	bdaddr_t		dst;
56	u8			channel;
57
58	uint			modem_status;
59
60	struct rfcomm_dlc	*dlc;
61	wait_queue_head_t       wait;
62
63	struct device		*tty_dev;
64
65	atomic_t		wmem_alloc;
66
67	struct sk_buff_head	pending;
68};
69
70static LIST_HEAD(rfcomm_dev_list);
71static DEFINE_SPINLOCK(rfcomm_dev_lock);
72
73static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
74static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
75static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
76
77/* ---- Device functions ---- */
78
79/*
80 * The reason this isn't actually a race, as you no doubt have a little voice
81 * screaming at you in your head, is that the refcount should never actually
82 * reach zero unless the device has already been taken off the list, in
83 * rfcomm_dev_del(). And if that's not true, we'll hit the BUG() in
84 * rfcomm_dev_destruct() anyway.
85 */
86static void rfcomm_dev_destruct(struct tty_port *port)
87{
88	struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
89	struct rfcomm_dlc *dlc = dev->dlc;
90
91	BT_DBG("dev %p dlc %p", dev, dlc);
92
93	/* Refcount should only hit zero when called from rfcomm_dev_del()
94	   which will have taken us off the list. Everything else are
95	   refcounting bugs. */
96	BUG_ON(!list_empty(&dev->list));
97
98	rfcomm_dlc_lock(dlc);
99	/* Detach DLC if it's owned by this dev */
100	if (dlc->owner == dev)
101		dlc->owner = NULL;
102	rfcomm_dlc_unlock(dlc);
103
104	rfcomm_dlc_put(dlc);
105
106	tty_unregister_device(rfcomm_tty_driver, dev->id);
107
108	kfree(dev);
109
110	/* It's safe to call module_put() here because socket still
111	   holds reference to this module. */
112	module_put(THIS_MODULE);
113}
114
115static const struct tty_port_operations rfcomm_port_ops = {
116	.destruct = rfcomm_dev_destruct,
117};
118
119static struct rfcomm_dev *__rfcomm_dev_get(int id)
120{
121	struct rfcomm_dev *dev;
122
123	list_for_each_entry(dev, &rfcomm_dev_list, list)
124		if (dev->id == id)
125			return dev;
126
127	return NULL;
128}
129
130static struct rfcomm_dev *rfcomm_dev_get(int id)
131{
132	struct rfcomm_dev *dev;
133
134	spin_lock(&rfcomm_dev_lock);
135
136	dev = __rfcomm_dev_get(id);
137
138	if (dev) {
139		if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
140			dev = NULL;
141		else
142			tty_port_get(&dev->port);
143	}
144
145	spin_unlock(&rfcomm_dev_lock);
146
147	return dev;
148}
149
150static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
151{
152	struct hci_dev *hdev;
153	struct hci_conn *conn;
154
155	hdev = hci_get_route(&dev->dst, &dev->src);
156	if (!hdev)
157		return NULL;
158
159	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
160
161	hci_dev_put(hdev);
162
163	return conn ? &conn->dev : NULL;
164}
165
166static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
167{
168	struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
169	return sprintf(buf, "%pMR\n", &dev->dst);
170}
171
172static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
173{
174	struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
175	return sprintf(buf, "%d\n", dev->channel);
176}
177
178static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
179static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
180
181static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
182{
183	struct rfcomm_dev *dev, *entry;
184	struct list_head *head = &rfcomm_dev_list;
185	int err = 0;
186
187	BT_DBG("id %d channel %d", req->dev_id, req->channel);
188
189	dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
190	if (!dev)
191		return -ENOMEM;
192
193	spin_lock(&rfcomm_dev_lock);
194
195	if (req->dev_id < 0) {
196		dev->id = 0;
197
198		list_for_each_entry(entry, &rfcomm_dev_list, list) {
199			if (entry->id != dev->id)
200				break;
201
202			dev->id++;
203			head = &entry->list;
204		}
205	} else {
206		dev->id = req->dev_id;
207
208		list_for_each_entry(entry, &rfcomm_dev_list, list) {
209			if (entry->id == dev->id) {
210				err = -EADDRINUSE;
211				goto out;
212			}
213
214			if (entry->id > dev->id - 1)
215				break;
216
217			head = &entry->list;
218		}
219	}
220
221	if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
222		err = -ENFILE;
223		goto out;
224	}
225
226	sprintf(dev->name, "rfcomm%d", dev->id);
227
228	list_add(&dev->list, head);
229
230	bacpy(&dev->src, &req->src);
231	bacpy(&dev->dst, &req->dst);
232	dev->channel = req->channel;
233
234	dev->flags = req->flags &
235		((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
236
237	tty_port_init(&dev->port);
238	dev->port.ops = &rfcomm_port_ops;
239	init_waitqueue_head(&dev->wait);
240
241	skb_queue_head_init(&dev->pending);
242
243	rfcomm_dlc_lock(dlc);
244
245	if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
246		struct sock *sk = dlc->owner;
247		struct sk_buff *skb;
248
249		BUG_ON(!sk);
250
251		rfcomm_dlc_throttle(dlc);
252
253		while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
254			skb_orphan(skb);
255			skb_queue_tail(&dev->pending, skb);
256			atomic_sub(skb->len, &sk->sk_rmem_alloc);
257		}
258	}
259
260	dlc->data_ready   = rfcomm_dev_data_ready;
261	dlc->state_change = rfcomm_dev_state_change;
262	dlc->modem_status = rfcomm_dev_modem_status;
263
264	dlc->owner = dev;
265	dev->dlc   = dlc;
266
267	rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
268
269	rfcomm_dlc_unlock(dlc);
270
271	/* It's safe to call __module_get() here because socket already
272	   holds reference to this module. */
273	__module_get(THIS_MODULE);
274
275out:
276	spin_unlock(&rfcomm_dev_lock);
277
278	if (err < 0)
279		goto free;
280
281	dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver,
282			dev->id, NULL);
283	if (IS_ERR(dev->tty_dev)) {
284		err = PTR_ERR(dev->tty_dev);
285		list_del(&dev->list);
286		goto free;
287	}
288
289	dev_set_drvdata(dev->tty_dev, dev);
290
291	if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
292		BT_ERR("Failed to create address attribute");
293
294	if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
295		BT_ERR("Failed to create channel attribute");
296
297	return dev->id;
298
299free:
300	kfree(dev);
301	return err;
302}
303
304static void rfcomm_dev_del(struct rfcomm_dev *dev)
305{
306	unsigned long flags;
307	BT_DBG("dev %p", dev);
308
309	BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
310
311	spin_lock_irqsave(&dev->port.lock, flags);
312	if (dev->port.count > 0) {
313		spin_unlock_irqrestore(&dev->port.lock, flags);
314		return;
315	}
316	spin_unlock_irqrestore(&dev->port.lock, flags);
317
318	spin_lock(&rfcomm_dev_lock);
319	list_del_init(&dev->list);
320	spin_unlock(&rfcomm_dev_lock);
321
322	tty_port_put(&dev->port);
323}
324
325/* ---- Send buffer ---- */
326static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
327{
328	/* We can't let it be zero, because we don't get a callback
329	   when tx_credits becomes nonzero, hence we'd never wake up */
330	return dlc->mtu * (dlc->tx_credits?:1);
331}
332
333static void rfcomm_wfree(struct sk_buff *skb)
334{
335	struct rfcomm_dev *dev = (void *) skb->sk;
336	struct tty_struct *tty = dev->port.tty;
337	atomic_sub(skb->truesize, &dev->wmem_alloc);
338	if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags) && tty)
339		tty_wakeup(tty);
340	tty_port_put(&dev->port);
341}
342
343static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
344{
345	tty_port_get(&dev->port);
346	atomic_add(skb->truesize, &dev->wmem_alloc);
347	skb->sk = (void *) dev;
348	skb->destructor = rfcomm_wfree;
349}
350
351static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
352{
353	if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
354		struct sk_buff *skb = alloc_skb(size, priority);
355		if (skb) {
356			rfcomm_set_owner_w(skb, dev);
357			return skb;
358		}
359	}
360	return NULL;
361}
362
363/* ---- Device IOCTLs ---- */
364
365#define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
366
367static int rfcomm_create_dev(struct sock *sk, void __user *arg)
368{
369	struct rfcomm_dev_req req;
370	struct rfcomm_dlc *dlc;
371	int id;
372
373	if (copy_from_user(&req, arg, sizeof(req)))
374		return -EFAULT;
375
376	BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
377
378	if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
379		return -EPERM;
380
381	if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
382		/* Socket must be connected */
383		if (sk->sk_state != BT_CONNECTED)
384			return -EBADFD;
385
386		dlc = rfcomm_pi(sk)->dlc;
387		rfcomm_dlc_hold(dlc);
388	} else {
389		dlc = rfcomm_dlc_alloc(GFP_KERNEL);
390		if (!dlc)
391			return -ENOMEM;
392	}
393
394	id = rfcomm_dev_add(&req, dlc);
395	if (id < 0) {
396		rfcomm_dlc_put(dlc);
397		return id;
398	}
399
400	if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
401		/* DLC is now used by device.
402		 * Socket must be disconnected */
403		sk->sk_state = BT_CLOSED;
404	}
405
406	return id;
407}
408
409static int rfcomm_release_dev(void __user *arg)
410{
411	struct rfcomm_dev_req req;
412	struct rfcomm_dev *dev;
413
414	if (copy_from_user(&req, arg, sizeof(req)))
415		return -EFAULT;
416
417	BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
418
419	dev = rfcomm_dev_get(req.dev_id);
420	if (!dev)
421		return -ENODEV;
422
423	if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
424		tty_port_put(&dev->port);
425		return -EPERM;
426	}
427
428	if (req.flags & (1 << RFCOMM_HANGUP_NOW))
429		rfcomm_dlc_close(dev->dlc, 0);
430
431	/* Shut down TTY synchronously before freeing rfcomm_dev */
432	if (dev->port.tty)
433		tty_vhangup(dev->port.tty);
434
435	if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
436		rfcomm_dev_del(dev);
437	tty_port_put(&dev->port);
438	return 0;
439}
440
441static int rfcomm_get_dev_list(void __user *arg)
442{
443	struct rfcomm_dev *dev;
444	struct rfcomm_dev_list_req *dl;
445	struct rfcomm_dev_info *di;
446	int n = 0, size, err;
447	u16 dev_num;
448
449	BT_DBG("");
450
451	if (get_user(dev_num, (u16 __user *) arg))
452		return -EFAULT;
453
454	if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
455		return -EINVAL;
456
457	size = sizeof(*dl) + dev_num * sizeof(*di);
458
459	dl = kzalloc(size, GFP_KERNEL);
460	if (!dl)
461		return -ENOMEM;
462
463	di = dl->dev_info;
464
465	spin_lock(&rfcomm_dev_lock);
466
467	list_for_each_entry(dev, &rfcomm_dev_list, list) {
468		if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
469			continue;
470		(di + n)->id      = dev->id;
471		(di + n)->flags   = dev->flags;
472		(di + n)->state   = dev->dlc->state;
473		(di + n)->channel = dev->channel;
474		bacpy(&(di + n)->src, &dev->src);
475		bacpy(&(di + n)->dst, &dev->dst);
476		if (++n >= dev_num)
477			break;
478	}
479
480	spin_unlock(&rfcomm_dev_lock);
481
482	dl->dev_num = n;
483	size = sizeof(*dl) + n * sizeof(*di);
484
485	err = copy_to_user(arg, dl, size);
486	kfree(dl);
487
488	return err ? -EFAULT : 0;
489}
490
491static int rfcomm_get_dev_info(void __user *arg)
492{
493	struct rfcomm_dev *dev;
494	struct rfcomm_dev_info di;
495	int err = 0;
496
497	BT_DBG("");
498
499	if (copy_from_user(&di, arg, sizeof(di)))
500		return -EFAULT;
501
502	dev = rfcomm_dev_get(di.id);
503	if (!dev)
504		return -ENODEV;
505
506	di.flags   = dev->flags;
507	di.channel = dev->channel;
508	di.state   = dev->dlc->state;
509	bacpy(&di.src, &dev->src);
510	bacpy(&di.dst, &dev->dst);
511
512	if (copy_to_user(arg, &di, sizeof(di)))
513		err = -EFAULT;
514
515	tty_port_put(&dev->port);
516	return err;
517}
518
519int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
520{
521	BT_DBG("cmd %d arg %p", cmd, arg);
522
523	switch (cmd) {
524	case RFCOMMCREATEDEV:
525		return rfcomm_create_dev(sk, arg);
526
527	case RFCOMMRELEASEDEV:
528		return rfcomm_release_dev(arg);
529
530	case RFCOMMGETDEVLIST:
531		return rfcomm_get_dev_list(arg);
532
533	case RFCOMMGETDEVINFO:
534		return rfcomm_get_dev_info(arg);
535	}
536
537	return -EINVAL;
538}
539
540/* ---- DLC callbacks ---- */
541static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
542{
543	struct rfcomm_dev *dev = dlc->owner;
544
545	if (!dev) {
546		kfree_skb(skb);
547		return;
548	}
549
550	if (!skb_queue_empty(&dev->pending)) {
551		skb_queue_tail(&dev->pending, skb);
552		return;
553	}
554
555	BT_DBG("dlc %p len %d", dlc, skb->len);
556
557	tty_insert_flip_string(&dev->port, skb->data, skb->len);
558	tty_flip_buffer_push(&dev->port);
559
560	kfree_skb(skb);
561}
562
563static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
564{
565	struct rfcomm_dev *dev = dlc->owner;
566	if (!dev)
567		return;
568
569	BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
570
571	dev->err = err;
572	wake_up_interruptible(&dev->wait);
573
574	if (dlc->state == BT_CLOSED) {
575		if (!dev->port.tty) {
576			if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
577				/* Drop DLC lock here to avoid deadlock
578				 * 1. rfcomm_dev_get will take rfcomm_dev_lock
579				 *    but in rfcomm_dev_add there's lock order:
580				 *    rfcomm_dev_lock -> dlc lock
581				 * 2. tty_port_put will deadlock if it's
582				 *    the last reference
583				 */
584				rfcomm_dlc_unlock(dlc);
585				if (rfcomm_dev_get(dev->id) == NULL) {
586					rfcomm_dlc_lock(dlc);
587					return;
588				}
589
590				rfcomm_dev_del(dev);
591				tty_port_put(&dev->port);
592				rfcomm_dlc_lock(dlc);
593			}
594		} else
595			tty_hangup(dev->port.tty);
596	}
597}
598
599static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
600{
601	struct rfcomm_dev *dev = dlc->owner;
602	if (!dev)
603		return;
604
605	BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
606
607	if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
608		if (dev->port.tty && !C_CLOCAL(dev->port.tty))
609			tty_hangup(dev->port.tty);
610	}
611
612	dev->modem_status =
613		((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
614		((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
615		((v24_sig & RFCOMM_V24_IC)  ? TIOCM_RI : 0) |
616		((v24_sig & RFCOMM_V24_DV)  ? TIOCM_CD : 0);
617}
618
619/* ---- TTY functions ---- */
620static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
621{
622	struct sk_buff *skb;
623	int inserted = 0;
624
625	BT_DBG("dev %p", dev);
626
627	rfcomm_dlc_lock(dev->dlc);
628
629	while ((skb = skb_dequeue(&dev->pending))) {
630		inserted += tty_insert_flip_string(&dev->port, skb->data,
631				skb->len);
632		kfree_skb(skb);
633	}
634
635	rfcomm_dlc_unlock(dev->dlc);
636
637	if (inserted > 0)
638		tty_flip_buffer_push(&dev->port);
639}
640
641static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
642{
643	DECLARE_WAITQUEUE(wait, current);
644	struct rfcomm_dev *dev;
645	struct rfcomm_dlc *dlc;
646	unsigned long flags;
647	int err, id;
648
649	id = tty->index;
650
651	BT_DBG("tty %p id %d", tty, id);
652
653	/* We don't leak this refcount. For reasons which are not entirely
654	   clear, the TTY layer will call our ->close() method even if the
655	   open fails. We decrease the refcount there, and decreasing it
656	   here too would cause breakage. */
657	dev = rfcomm_dev_get(id);
658	if (!dev)
659		return -ENODEV;
660
661	BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst,
662	       dev->channel, dev->port.count);
663
664	spin_lock_irqsave(&dev->port.lock, flags);
665	if (++dev->port.count > 1) {
666		spin_unlock_irqrestore(&dev->port.lock, flags);
667		return 0;
668	}
669	spin_unlock_irqrestore(&dev->port.lock, flags);
670
671	dlc = dev->dlc;
672
673	/* Attach TTY and open DLC */
674
675	rfcomm_dlc_lock(dlc);
676	tty->driver_data = dev;
677	dev->port.tty = tty;
678	rfcomm_dlc_unlock(dlc);
679	set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
680
681	err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
682	if (err < 0)
683		return err;
684
685	/* Wait for DLC to connect */
686	add_wait_queue(&dev->wait, &wait);
687	while (1) {
688		set_current_state(TASK_INTERRUPTIBLE);
689
690		if (dlc->state == BT_CLOSED) {
691			err = -dev->err;
692			break;
693		}
694
695		if (dlc->state == BT_CONNECTED)
696			break;
697
698		if (signal_pending(current)) {
699			err = -EINTR;
700			break;
701		}
702
703		tty_unlock(tty);
704		schedule();
705		tty_lock(tty);
706	}
707	set_current_state(TASK_RUNNING);
708	remove_wait_queue(&dev->wait, &wait);
709
710	if (err == 0)
711		device_move(dev->tty_dev, rfcomm_get_device(dev),
712			    DPM_ORDER_DEV_AFTER_PARENT);
713
714	rfcomm_tty_copy_pending(dev);
715
716	rfcomm_dlc_unthrottle(dev->dlc);
717
718	return err;
719}
720
721static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
722{
723	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
724	unsigned long flags;
725
726	if (!dev)
727		return;
728
729	BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
730						dev->port.count);
731
732	spin_lock_irqsave(&dev->port.lock, flags);
733	if (!--dev->port.count) {
734		spin_unlock_irqrestore(&dev->port.lock, flags);
735		if (dev->tty_dev->parent)
736			device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
737
738		/* Close DLC and dettach TTY */
739		rfcomm_dlc_close(dev->dlc, 0);
740
741		clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
742
743		rfcomm_dlc_lock(dev->dlc);
744		tty->driver_data = NULL;
745		dev->port.tty = NULL;
746		rfcomm_dlc_unlock(dev->dlc);
747
748		if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) {
749			spin_lock(&rfcomm_dev_lock);
750			list_del_init(&dev->list);
751			spin_unlock(&rfcomm_dev_lock);
752
753			tty_port_put(&dev->port);
754		}
755	} else
756		spin_unlock_irqrestore(&dev->port.lock, flags);
757
758	tty_port_put(&dev->port);
759}
760
761static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
762{
763	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
764	struct rfcomm_dlc *dlc = dev->dlc;
765	struct sk_buff *skb;
766	int err = 0, sent = 0, size;
767
768	BT_DBG("tty %p count %d", tty, count);
769
770	while (count) {
771		size = min_t(uint, count, dlc->mtu);
772
773		skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
774
775		if (!skb)
776			break;
777
778		skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
779
780		memcpy(skb_put(skb, size), buf + sent, size);
781
782		err = rfcomm_dlc_send(dlc, skb);
783		if (err < 0) {
784			kfree_skb(skb);
785			break;
786		}
787
788		sent  += size;
789		count -= size;
790	}
791
792	return sent ? sent : err;
793}
794
795static int rfcomm_tty_write_room(struct tty_struct *tty)
796{
797	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
798	int room;
799
800	BT_DBG("tty %p", tty);
801
802	if (!dev || !dev->dlc)
803		return 0;
804
805	room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
806	if (room < 0)
807		room = 0;
808
809	return room;
810}
811
812static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg)
813{
814	BT_DBG("tty %p cmd 0x%02x", tty, cmd);
815
816	switch (cmd) {
817	case TCGETS:
818		BT_DBG("TCGETS is not supported");
819		return -ENOIOCTLCMD;
820
821	case TCSETS:
822		BT_DBG("TCSETS is not supported");
823		return -ENOIOCTLCMD;
824
825	case TIOCMIWAIT:
826		BT_DBG("TIOCMIWAIT");
827		break;
828
829	case TIOCGSERIAL:
830		BT_ERR("TIOCGSERIAL is not supported");
831		return -ENOIOCTLCMD;
832
833	case TIOCSSERIAL:
834		BT_ERR("TIOCSSERIAL is not supported");
835		return -ENOIOCTLCMD;
836
837	case TIOCSERGSTRUCT:
838		BT_ERR("TIOCSERGSTRUCT is not supported");
839		return -ENOIOCTLCMD;
840
841	case TIOCSERGETLSR:
842		BT_ERR("TIOCSERGETLSR is not supported");
843		return -ENOIOCTLCMD;
844
845	case TIOCSERCONFIG:
846		BT_ERR("TIOCSERCONFIG is not supported");
847		return -ENOIOCTLCMD;
848
849	default:
850		return -ENOIOCTLCMD;	/* ioctls which we must ignore */
851
852	}
853
854	return -ENOIOCTLCMD;
855}
856
857static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
858{
859	struct ktermios *new = &tty->termios;
860	int old_baud_rate = tty_termios_baud_rate(old);
861	int new_baud_rate = tty_termios_baud_rate(new);
862
863	u8 baud, data_bits, stop_bits, parity, x_on, x_off;
864	u16 changes = 0;
865
866	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
867
868	BT_DBG("tty %p termios %p", tty, old);
869
870	if (!dev || !dev->dlc || !dev->dlc->session)
871		return;
872
873	/* Handle turning off CRTSCTS */
874	if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
875		BT_DBG("Turning off CRTSCTS unsupported");
876
877	/* Parity on/off and when on, odd/even */
878	if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
879			((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) {
880		changes |= RFCOMM_RPN_PM_PARITY;
881		BT_DBG("Parity change detected.");
882	}
883
884	/* Mark and space parity are not supported! */
885	if (new->c_cflag & PARENB) {
886		if (new->c_cflag & PARODD) {
887			BT_DBG("Parity is ODD");
888			parity = RFCOMM_RPN_PARITY_ODD;
889		} else {
890			BT_DBG("Parity is EVEN");
891			parity = RFCOMM_RPN_PARITY_EVEN;
892		}
893	} else {
894		BT_DBG("Parity is OFF");
895		parity = RFCOMM_RPN_PARITY_NONE;
896	}
897
898	/* Setting the x_on / x_off characters */
899	if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
900		BT_DBG("XOFF custom");
901		x_on = new->c_cc[VSTOP];
902		changes |= RFCOMM_RPN_PM_XON;
903	} else {
904		BT_DBG("XOFF default");
905		x_on = RFCOMM_RPN_XON_CHAR;
906	}
907
908	if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
909		BT_DBG("XON custom");
910		x_off = new->c_cc[VSTART];
911		changes |= RFCOMM_RPN_PM_XOFF;
912	} else {
913		BT_DBG("XON default");
914		x_off = RFCOMM_RPN_XOFF_CHAR;
915	}
916
917	/* Handle setting of stop bits */
918	if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
919		changes |= RFCOMM_RPN_PM_STOP;
920
921	/* POSIX does not support 1.5 stop bits and RFCOMM does not
922	 * support 2 stop bits. So a request for 2 stop bits gets
923	 * translated to 1.5 stop bits */
924	if (new->c_cflag & CSTOPB)
925		stop_bits = RFCOMM_RPN_STOP_15;
926	else
927		stop_bits = RFCOMM_RPN_STOP_1;
928
929	/* Handle number of data bits [5-8] */
930	if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
931		changes |= RFCOMM_RPN_PM_DATA;
932
933	switch (new->c_cflag & CSIZE) {
934	case CS5:
935		data_bits = RFCOMM_RPN_DATA_5;
936		break;
937	case CS6:
938		data_bits = RFCOMM_RPN_DATA_6;
939		break;
940	case CS7:
941		data_bits = RFCOMM_RPN_DATA_7;
942		break;
943	case CS8:
944		data_bits = RFCOMM_RPN_DATA_8;
945		break;
946	default:
947		data_bits = RFCOMM_RPN_DATA_8;
948		break;
949	}
950
951	/* Handle baudrate settings */
952	if (old_baud_rate != new_baud_rate)
953		changes |= RFCOMM_RPN_PM_BITRATE;
954
955	switch (new_baud_rate) {
956	case 2400:
957		baud = RFCOMM_RPN_BR_2400;
958		break;
959	case 4800:
960		baud = RFCOMM_RPN_BR_4800;
961		break;
962	case 7200:
963		baud = RFCOMM_RPN_BR_7200;
964		break;
965	case 9600:
966		baud = RFCOMM_RPN_BR_9600;
967		break;
968	case 19200:
969		baud = RFCOMM_RPN_BR_19200;
970		break;
971	case 38400:
972		baud = RFCOMM_RPN_BR_38400;
973		break;
974	case 57600:
975		baud = RFCOMM_RPN_BR_57600;
976		break;
977	case 115200:
978		baud = RFCOMM_RPN_BR_115200;
979		break;
980	case 230400:
981		baud = RFCOMM_RPN_BR_230400;
982		break;
983	default:
984		/* 9600 is standard accordinag to the RFCOMM specification */
985		baud = RFCOMM_RPN_BR_9600;
986		break;
987
988	}
989
990	if (changes)
991		rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
992				data_bits, stop_bits, parity,
993				RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
994}
995
996static void rfcomm_tty_throttle(struct tty_struct *tty)
997{
998	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
999
1000	BT_DBG("tty %p dev %p", tty, dev);
1001
1002	rfcomm_dlc_throttle(dev->dlc);
1003}
1004
1005static void rfcomm_tty_unthrottle(struct tty_struct *tty)
1006{
1007	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1008
1009	BT_DBG("tty %p dev %p", tty, dev);
1010
1011	rfcomm_dlc_unthrottle(dev->dlc);
1012}
1013
1014static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1015{
1016	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1017
1018	BT_DBG("tty %p dev %p", tty, dev);
1019
1020	if (!dev || !dev->dlc)
1021		return 0;
1022
1023	if (!skb_queue_empty(&dev->dlc->tx_queue))
1024		return dev->dlc->mtu;
1025
1026	return 0;
1027}
1028
1029static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1030{
1031	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1032
1033	BT_DBG("tty %p dev %p", tty, dev);
1034
1035	if (!dev || !dev->dlc)
1036		return;
1037
1038	skb_queue_purge(&dev->dlc->tx_queue);
1039	tty_wakeup(tty);
1040}
1041
1042static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1043{
1044	BT_DBG("tty %p ch %c", tty, ch);
1045}
1046
1047static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1048{
1049	BT_DBG("tty %p timeout %d", tty, timeout);
1050}
1051
1052static void rfcomm_tty_hangup(struct tty_struct *tty)
1053{
1054	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1055
1056	BT_DBG("tty %p dev %p", tty, dev);
1057
1058	if (!dev)
1059		return;
1060
1061	rfcomm_tty_flush_buffer(tty);
1062
1063	if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
1064		if (rfcomm_dev_get(dev->id) == NULL)
1065			return;
1066		rfcomm_dev_del(dev);
1067		tty_port_put(&dev->port);
1068	}
1069}
1070
1071static int rfcomm_tty_tiocmget(struct tty_struct *tty)
1072{
1073	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1074
1075	BT_DBG("tty %p dev %p", tty, dev);
1076
1077	return dev->modem_status;
1078}
1079
1080static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
1081{
1082	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1083	struct rfcomm_dlc *dlc = dev->dlc;
1084	u8 v24_sig;
1085
1086	BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1087
1088	rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1089
1090	if (set & TIOCM_DSR || set & TIOCM_DTR)
1091		v24_sig |= RFCOMM_V24_RTC;
1092	if (set & TIOCM_RTS || set & TIOCM_CTS)
1093		v24_sig |= RFCOMM_V24_RTR;
1094	if (set & TIOCM_RI)
1095		v24_sig |= RFCOMM_V24_IC;
1096	if (set & TIOCM_CD)
1097		v24_sig |= RFCOMM_V24_DV;
1098
1099	if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1100		v24_sig &= ~RFCOMM_V24_RTC;
1101	if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1102		v24_sig &= ~RFCOMM_V24_RTR;
1103	if (clear & TIOCM_RI)
1104		v24_sig &= ~RFCOMM_V24_IC;
1105	if (clear & TIOCM_CD)
1106		v24_sig &= ~RFCOMM_V24_DV;
1107
1108	rfcomm_dlc_set_modem_status(dlc, v24_sig);
1109
1110	return 0;
1111}
1112
1113/* ---- TTY structure ---- */
1114
1115static const struct tty_operations rfcomm_ops = {
1116	.open			= rfcomm_tty_open,
1117	.close			= rfcomm_tty_close,
1118	.write			= rfcomm_tty_write,
1119	.write_room		= rfcomm_tty_write_room,
1120	.chars_in_buffer	= rfcomm_tty_chars_in_buffer,
1121	.flush_buffer		= rfcomm_tty_flush_buffer,
1122	.ioctl			= rfcomm_tty_ioctl,
1123	.throttle		= rfcomm_tty_throttle,
1124	.unthrottle		= rfcomm_tty_unthrottle,
1125	.set_termios		= rfcomm_tty_set_termios,
1126	.send_xchar		= rfcomm_tty_send_xchar,
1127	.hangup			= rfcomm_tty_hangup,
1128	.wait_until_sent	= rfcomm_tty_wait_until_sent,
1129	.tiocmget		= rfcomm_tty_tiocmget,
1130	.tiocmset		= rfcomm_tty_tiocmset,
1131};
1132
1133int __init rfcomm_init_ttys(void)
1134{
1135	int error;
1136
1137	rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1138	if (!rfcomm_tty_driver)
1139		return -ENOMEM;
1140
1141	rfcomm_tty_driver->driver_name	= "rfcomm";
1142	rfcomm_tty_driver->name		= "rfcomm";
1143	rfcomm_tty_driver->major	= RFCOMM_TTY_MAJOR;
1144	rfcomm_tty_driver->minor_start	= RFCOMM_TTY_MINOR;
1145	rfcomm_tty_driver->type		= TTY_DRIVER_TYPE_SERIAL;
1146	rfcomm_tty_driver->subtype	= SERIAL_TYPE_NORMAL;
1147	rfcomm_tty_driver->flags	= TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1148	rfcomm_tty_driver->init_termios	= tty_std_termios;
1149	rfcomm_tty_driver->init_termios.c_cflag	= B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1150	rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1151	tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1152
1153	error = tty_register_driver(rfcomm_tty_driver);
1154	if (error) {
1155		BT_ERR("Can't register RFCOMM TTY driver");
1156		put_tty_driver(rfcomm_tty_driver);
1157		return error;
1158	}
1159
1160	BT_INFO("RFCOMM TTY layer initialized");
1161
1162	return 0;
1163}
1164
1165void rfcomm_cleanup_ttys(void)
1166{
1167	tty_unregister_driver(rfcomm_tty_driver);
1168	put_tty_driver(rfcomm_tty_driver);
1169}
1170