?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
eCryptfs: Prevent lower dentry from going negative during unlink
[linux/fpc-iii.git] / net / bluetooth / rfcomm / tty.c
blobcab71ea2796d472f740a88277d75805081873748
1 /*
2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22 */
23
24 /*
25 * RFCOMM TTY.
26 */
27
28 #include <linux/module.h>
29
30 #include <linux/tty.h>
31 #include <linux/tty_driver.h>
32 #include <linux/tty_flip.h>
33
34 #include <linux/capability.h>
35 #include <linux/slab.h>
36 #include <linux/skbuff.h>
37
38 #include <net/bluetooth/bluetooth.h>
39 #include <net/bluetooth/hci_core.h>
40 #include <net/bluetooth/rfcomm.h>
41
42 #define RFCOMM_TTY_MAGIC 0x6d02 /* magic number for rfcomm struct */
43 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */
44 #define RFCOMM_TTY_MAJOR 216 /* device node major id of the usb/bluetooth.c driver */
45 #define RFCOMM_TTY_MINOR 0
46
47 static struct tty_driver *rfcomm_tty_driver;
48
49 struct rfcomm_dev {
50 struct list_head list;
51 atomic_t refcnt;
52
53 char name[12];
54 int id;
55 unsigned long flags;
56 atomic_t opened;
57 int err;
58
59 bdaddr_t src;
60 bdaddr_t dst;
61 u8 channel;
62
63 uint modem_status;
64
65 struct rfcomm_dlc *dlc;
66 struct tty_struct *tty;
67 wait_queue_head_t wait;
68 struct tasklet_struct wakeup_task;
69
70 struct device *tty_dev;
71
72 atomic_t wmem_alloc;
73
74 struct sk_buff_head pending;
75 };
76
77 static LIST_HEAD(rfcomm_dev_list);
78 static DEFINE_RWLOCK(rfcomm_dev_lock);
79
80 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb);
81 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err);
82 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig);
83
84 static void rfcomm_tty_wakeup(unsigned long arg);
85
86 /* ---- Device functions ---- */
87 static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
88 {
89 struct rfcomm_dlc *dlc = dev->dlc;
90
91 BT_DBG("dev %p dlc %p", dev, dlc);
92
93 /* Refcount should only hit zero when called from rfcomm_dev_del()
94 which will have taken us off the list. Everything else are
95 refcounting bugs. */
96 BUG_ON(!list_empty(&dev->list));
97
98 rfcomm_dlc_lock(dlc);
99 /* Detach DLC if it's owned by this dev */
100 if (dlc->owner == dev)
101 dlc->owner = NULL;
102 rfcomm_dlc_unlock(dlc);
103
104 rfcomm_dlc_put(dlc);
105
106 tty_unregister_device(rfcomm_tty_driver, dev->id);
107
108 kfree(dev);
109
110 /* It's safe to call module_put() here because socket still
111 holds reference to this module. */
112 module_put(THIS_MODULE);
113 }
114
115 static inline void rfcomm_dev_hold(struct rfcomm_dev *dev)
116 {
117 atomic_inc(&dev->refcnt);
118 }
119
120 static inline void rfcomm_dev_put(struct rfcomm_dev *dev)
121 {
122 /* The reason this isn't actually a race, as you no
123 doubt have a little voice screaming at you in your
124 head, is that the refcount should never actually
125 reach zero unless the device has already been taken
126 off the list, in rfcomm_dev_del(). And if that's not
127 true, we'll hit the BUG() in rfcomm_dev_destruct()
128 anyway. */
129 if (atomic_dec_and_test(&dev->refcnt))
130 rfcomm_dev_destruct(dev);
131 }
132
133 static struct rfcomm_dev *__rfcomm_dev_get(int id)
134 {
135 struct rfcomm_dev *dev;
136 struct list_head *p;
137
138 list_for_each(p, &rfcomm_dev_list) {
139 dev = list_entry(p, struct rfcomm_dev, list);
140 if (dev->id == id)
141 return dev;
142 }
143
144 return NULL;
145 }
146
147 static inline struct rfcomm_dev *rfcomm_dev_get(int id)
148 {
149 struct rfcomm_dev *dev;
150
151 read_lock(&rfcomm_dev_lock);
152
153 dev = __rfcomm_dev_get(id);
154
155 if (dev) {
156 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
157 dev = NULL;
158 else
159 rfcomm_dev_hold(dev);
160 }
161
162 read_unlock(&rfcomm_dev_lock);
163
164 return dev;
165 }
166
167 static struct device *rfcomm_get_device(struct rfcomm_dev *dev)
168 {
169 struct hci_dev *hdev;
170 struct hci_conn *conn;
171
172 hdev = hci_get_route(&dev->dst, &dev->src);
173 if (!hdev)
174 return NULL;
175
176 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst);
177
178 hci_dev_put(hdev);
179
180 return conn ? &conn->dev : NULL;
181 }
182
183 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf)
184 {
185 struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
186 bdaddr_t bdaddr;
187 baswap(&bdaddr, &dev->dst);
188 return sprintf(buf, "%s\n", batostr(&bdaddr));
189 }
190
191 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf)
192 {
193 struct rfcomm_dev *dev = dev_get_drvdata(tty_dev);
194 return sprintf(buf, "%d\n", dev->channel);
195 }
196
197 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
198 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL);
199
200 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
201 {
202 struct rfcomm_dev *dev;
203 struct list_head *head = &rfcomm_dev_list, *p;
204 int err = 0;
205
206 BT_DBG("id %d channel %d", req->dev_id, req->channel);
207
208 dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL);
209 if (!dev)
210 return -ENOMEM;
211
212 write_lock_bh(&rfcomm_dev_lock);
213
214 if (req->dev_id < 0) {
215 dev->id = 0;
216
217 list_for_each(p, &rfcomm_dev_list) {
218 if (list_entry(p, struct rfcomm_dev, list)->id != dev->id)
219 break;
220
221 dev->id++;
222 head = p;
223 }
224 } else {
225 dev->id = req->dev_id;
226
227 list_for_each(p, &rfcomm_dev_list) {
228 struct rfcomm_dev *entry = list_entry(p, struct rfcomm_dev, list);
229
230 if (entry->id == dev->id) {
231 err = -EADDRINUSE;
232 goto out;
233 }
234
235 if (entry->id > dev->id - 1)
236 break;
237
238 head = p;
239 }
240 }
241
242 if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) {
243 err = -ENFILE;
244 goto out;
245 }
246
247 sprintf(dev->name, "rfcomm%d", dev->id);
248
249 list_add(&dev->list, head);
250 atomic_set(&dev->refcnt, 1);
251
252 bacpy(&dev->src, &req->src);
253 bacpy(&dev->dst, &req->dst);
254 dev->channel = req->channel;
255
256 dev->flags = req->flags &
257 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC));
258
259 atomic_set(&dev->opened, 0);
260
261 init_waitqueue_head(&dev->wait);
262 tasklet_init(&dev->wakeup_task, rfcomm_tty_wakeup, (unsigned long) dev);
263
264 skb_queue_head_init(&dev->pending);
265
266 rfcomm_dlc_lock(dlc);
267
268 if (req->flags & (1 << RFCOMM_REUSE_DLC)) {
269 struct sock *sk = dlc->owner;
270 struct sk_buff *skb;
271
272 BUG_ON(!sk);
273
274 rfcomm_dlc_throttle(dlc);
275
276 while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
277 skb_orphan(skb);
278 skb_queue_tail(&dev->pending, skb);
279 atomic_sub(skb->len, &sk->sk_rmem_alloc);
280 }
281 }
282
283 dlc->data_ready = rfcomm_dev_data_ready;
284 dlc->state_change = rfcomm_dev_state_change;
285 dlc->modem_status = rfcomm_dev_modem_status;
286
287 dlc->owner = dev;
288 dev->dlc = dlc;
289
290 rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig);
291
292 rfcomm_dlc_unlock(dlc);
293
294 /* It's safe to call __module_get() here because socket already
295 holds reference to this module. */
296 __module_get(THIS_MODULE);
297
298 out:
299 write_unlock_bh(&rfcomm_dev_lock);
300
301 if (err < 0)
302 goto free;
303
304 dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL);
305
306 if (IS_ERR(dev->tty_dev)) {
307 err = PTR_ERR(dev->tty_dev);
308 list_del(&dev->list);
309 goto free;
310 }
311
312 dev_set_drvdata(dev->tty_dev, dev);
313
314 if (device_create_file(dev->tty_dev, &dev_attr_address) < 0)
315 BT_ERR("Failed to create address attribute");
316
317 if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0)
318 BT_ERR("Failed to create channel attribute");
319
320 return dev->id;
321
322 free:
323 kfree(dev);
324 return err;
325 }
326
327 static void rfcomm_dev_del(struct rfcomm_dev *dev)
328 {
329 BT_DBG("dev %p", dev);
330
331 BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags));
332
333 if (atomic_read(&dev->opened) > 0)
334 return;
335
336 write_lock_bh(&rfcomm_dev_lock);
337 list_del_init(&dev->list);
338 write_unlock_bh(&rfcomm_dev_lock);
339
340 rfcomm_dev_put(dev);
341 }
342
343 /* ---- Send buffer ---- */
344 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
345 {
346 /* We can't let it be zero, because we don't get a callback
347 when tx_credits becomes nonzero, hence we'd never wake up */
348 return dlc->mtu * (dlc->tx_credits?:1);
349 }
350
351 static void rfcomm_wfree(struct sk_buff *skb)
352 {
353 struct rfcomm_dev *dev = (void *) skb->sk;
354 atomic_sub(skb->truesize, &dev->wmem_alloc);
355 if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags))
356 tasklet_schedule(&dev->wakeup_task);
357 rfcomm_dev_put(dev);
358 }
359
360 static inline void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev)
361 {
362 rfcomm_dev_hold(dev);
363 atomic_add(skb->truesize, &dev->wmem_alloc);
364 skb->sk = (void *) dev;
365 skb->destructor = rfcomm_wfree;
366 }
367
368 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority)
369 {
370 if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) {
371 struct sk_buff *skb = alloc_skb(size, priority);
372 if (skb) {
373 rfcomm_set_owner_w(skb, dev);
374 return skb;
375 }
376 }
377 return NULL;
378 }
379
380 /* ---- Device IOCTLs ---- */
381
382 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP))
383
384 static int rfcomm_create_dev(struct sock *sk, void __user *arg)
385 {
386 struct rfcomm_dev_req req;
387 struct rfcomm_dlc *dlc;
388 int id;
389
390 if (copy_from_user(&req, arg, sizeof(req)))
391 return -EFAULT;
392
393 BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
394
395 if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
396 return -EPERM;
397
398 if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
399 /* Socket must be connected */
400 if (sk->sk_state != BT_CONNECTED)
401 return -EBADFD;
402
403 dlc = rfcomm_pi(sk)->dlc;
404 rfcomm_dlc_hold(dlc);
405 } else {
406 dlc = rfcomm_dlc_alloc(GFP_KERNEL);
407 if (!dlc)
408 return -ENOMEM;
409 }
410
411 id = rfcomm_dev_add(&req, dlc);
412 if (id < 0) {
413 rfcomm_dlc_put(dlc);
414 return id;
415 }
416
417 if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
418 /* DLC is now used by device.
419 * Socket must be disconnected */
420 sk->sk_state = BT_CLOSED;
421 }
422
423 return id;
424 }
425
426 static int rfcomm_release_dev(void __user *arg)
427 {
428 struct rfcomm_dev_req req;
429 struct rfcomm_dev *dev;
430
431 if (copy_from_user(&req, arg, sizeof(req)))
432 return -EFAULT;
433
434 BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
435
436 if (!(dev = rfcomm_dev_get(req.dev_id)))
437 return -ENODEV;
438
439 if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) {
440 rfcomm_dev_put(dev);
441 return -EPERM;
442 }
443
444 if (req.flags & (1 << RFCOMM_HANGUP_NOW))
445 rfcomm_dlc_close(dev->dlc, 0);
446
447 /* Shut down TTY synchronously before freeing rfcomm_dev */
448 if (dev->tty)
449 tty_vhangup(dev->tty);
450
451 if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
452 rfcomm_dev_del(dev);
453 rfcomm_dev_put(dev);
454 return 0;
455 }
456
457 static int rfcomm_get_dev_list(void __user *arg)
458 {
459 struct rfcomm_dev_list_req *dl;
460 struct rfcomm_dev_info *di;
461 struct list_head *p;
462 int n = 0, size, err;
463 u16 dev_num;
464
465 BT_DBG("");
466
467 if (get_user(dev_num, (u16 __user *) arg))
468 return -EFAULT;
469
470 if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di))
471 return -EINVAL;
472
473 size = sizeof(*dl) + dev_num * sizeof(*di);
474
475 if (!(dl = kmalloc(size, GFP_KERNEL)))
476 return -ENOMEM;
477
478 di = dl->dev_info;
479
480 read_lock_bh(&rfcomm_dev_lock);
481
482 list_for_each(p, &rfcomm_dev_list) {
483 struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
484 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
485 continue;
486 (di + n)->id = dev->id;
487 (di + n)->flags = dev->flags;
488 (di + n)->state = dev->dlc->state;
489 (di + n)->channel = dev->channel;
490 bacpy(&(di + n)->src, &dev->src);
491 bacpy(&(di + n)->dst, &dev->dst);
492 if (++n >= dev_num)
493 break;
494 }
495
496 read_unlock_bh(&rfcomm_dev_lock);
497
498 dl->dev_num = n;
499 size = sizeof(*dl) + n * sizeof(*di);
500
501 err = copy_to_user(arg, dl, size);
502 kfree(dl);
503
504 return err ? -EFAULT : 0;
505 }
506
507 static int rfcomm_get_dev_info(void __user *arg)
508 {
509 struct rfcomm_dev *dev;
510 struct rfcomm_dev_info di;
511 int err = 0;
512
513 BT_DBG("");
514
515 if (copy_from_user(&di, arg, sizeof(di)))
516 return -EFAULT;
517
518 if (!(dev = rfcomm_dev_get(di.id)))
519 return -ENODEV;
520
521 di.flags = dev->flags;
522 di.channel = dev->channel;
523 di.state = dev->dlc->state;
524 bacpy(&di.src, &dev->src);
525 bacpy(&di.dst, &dev->dst);
526
527 if (copy_to_user(arg, &di, sizeof(di)))
528 err = -EFAULT;
529
530 rfcomm_dev_put(dev);
531 return err;
532 }
533
534 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg)
535 {
536 BT_DBG("cmd %d arg %p", cmd, arg);
537
538 switch (cmd) {
539 case RFCOMMCREATEDEV:
540 return rfcomm_create_dev(sk, arg);
541
542 case RFCOMMRELEASEDEV:
543 return rfcomm_release_dev(arg);
544
545 case RFCOMMGETDEVLIST:
546 return rfcomm_get_dev_list(arg);
547
548 case RFCOMMGETDEVINFO:
549 return rfcomm_get_dev_info(arg);
550 }
551
552 return -EINVAL;
553 }
554
555 /* ---- DLC callbacks ---- */
556 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb)
557 {
558 struct rfcomm_dev *dev = dlc->owner;
559 struct tty_struct *tty;
560
561 if (!dev) {
562 kfree_skb(skb);
563 return;
564 }
565
566 if (!(tty = dev->tty) || !skb_queue_empty(&dev->pending)) {
567 skb_queue_tail(&dev->pending, skb);
568 return;
569 }
570
571 BT_DBG("dlc %p tty %p len %d", dlc, tty, skb->len);
572
573 tty_insert_flip_string(tty, skb->data, skb->len);
574 tty_flip_buffer_push(tty);
575
576 kfree_skb(skb);
577 }
578
579 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
580 {
581 struct rfcomm_dev *dev = dlc->owner;
582 if (!dev)
583 return;
584
585 BT_DBG("dlc %p dev %p err %d", dlc, dev, err);
586
587 dev->err = err;
588 wake_up_interruptible(&dev->wait);
589
590 if (dlc->state == BT_CLOSED) {
591 if (!dev->tty) {
592 if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
593 /* Drop DLC lock here to avoid deadlock
594 * 1. rfcomm_dev_get will take rfcomm_dev_lock
595 * but in rfcomm_dev_add there's lock order:
596 * rfcomm_dev_lock -> dlc lock
597 * 2. rfcomm_dev_put will deadlock if it's
598 * the last reference
599 */
600 rfcomm_dlc_unlock(dlc);
601 if (rfcomm_dev_get(dev->id) == NULL) {
602 rfcomm_dlc_lock(dlc);
603 return;
604 }
605
606 rfcomm_dev_del(dev);
607 rfcomm_dev_put(dev);
608 rfcomm_dlc_lock(dlc);
609 }
610 } else
611 tty_hangup(dev->tty);
612 }
613 }
614
615 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig)
616 {
617 struct rfcomm_dev *dev = dlc->owner;
618 if (!dev)
619 return;
620
621 BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig);
622
623 if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) {
624 if (dev->tty && !C_CLOCAL(dev->tty))
625 tty_hangup(dev->tty);
626 }
627
628 dev->modem_status =
629 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) |
630 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) |
631 ((v24_sig & RFCOMM_V24_IC) ? TIOCM_RI : 0) |
632 ((v24_sig & RFCOMM_V24_DV) ? TIOCM_CD : 0);
633 }
634
635 /* ---- TTY functions ---- */
636 static void rfcomm_tty_wakeup(unsigned long arg)
637 {
638 struct rfcomm_dev *dev = (void *) arg;
639 struct tty_struct *tty = dev->tty;
640 if (!tty)
641 return;
642
643 BT_DBG("dev %p tty %p", dev, tty);
644 tty_wakeup(tty);
645 }
646
647 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev)
648 {
649 struct tty_struct *tty = dev->tty;
650 struct sk_buff *skb;
651 int inserted = 0;
652
653 if (!tty)
654 return;
655
656 BT_DBG("dev %p tty %p", dev, tty);
657
658 rfcomm_dlc_lock(dev->dlc);
659
660 while ((skb = skb_dequeue(&dev->pending))) {
661 inserted += tty_insert_flip_string(tty, skb->data, skb->len);
662 kfree_skb(skb);
663 }
664
665 rfcomm_dlc_unlock(dev->dlc);
666
667 if (inserted > 0)
668 tty_flip_buffer_push(tty);
669 }
670
671 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
672 {
673 DECLARE_WAITQUEUE(wait, current);
674 struct rfcomm_dev *dev;
675 struct rfcomm_dlc *dlc;
676 int err, id;
677
678 id = tty->index;
679
680 BT_DBG("tty %p id %d", tty, id);
681
682 /* We don't leak this refcount. For reasons which are not entirely
683 clear, the TTY layer will call our ->close() method even if the
684 open fails. We decrease the refcount there, and decreasing it
685 here too would cause breakage. */
686 dev = rfcomm_dev_get(id);
687 if (!dev)
688 return -ENODEV;
689
690 BT_DBG("dev %p dst %s channel %d opened %d", dev, batostr(&dev->dst),
691 dev->channel, atomic_read(&dev->opened));
692
693 if (atomic_inc_return(&dev->opened) > 1)
694 return 0;
695
696 dlc = dev->dlc;
697
698 /* Attach TTY and open DLC */
699
700 rfcomm_dlc_lock(dlc);
701 tty->driver_data = dev;
702 dev->tty = tty;
703 rfcomm_dlc_unlock(dlc);
704 set_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
705
706 err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel);
707 if (err < 0)
708 return err;
709
710 /* Wait for DLC to connect */
711 add_wait_queue(&dev->wait, &wait);
712 while (1) {
713 set_current_state(TASK_INTERRUPTIBLE);
714
715 if (dlc->state == BT_CLOSED) {
716 err = -dev->err;
717 break;
718 }
719
720 if (dlc->state == BT_CONNECTED)
721 break;
722
723 if (signal_pending(current)) {
724 err = -EINTR;
725 break;
726 }
727
728 schedule();
729 }
730 set_current_state(TASK_RUNNING);
731 remove_wait_queue(&dev->wait, &wait);
732
733 if (err == 0)
734 device_move(dev->tty_dev, rfcomm_get_device(dev),
735 DPM_ORDER_DEV_AFTER_PARENT);
736
737 rfcomm_tty_copy_pending(dev);
738
739 rfcomm_dlc_unthrottle(dev->dlc);
740
741 return err;
742 }
743
744 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
745 {
746 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
747 if (!dev)
748 return;
749
750 BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc,
751 atomic_read(&dev->opened));
752
753 if (atomic_dec_and_test(&dev->opened)) {
754 if (dev->tty_dev->parent)
755 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
756
757 /* Close DLC and dettach TTY */
758 rfcomm_dlc_close(dev->dlc, 0);
759
760 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags);
761 tasklet_kill(&dev->wakeup_task);
762
763 rfcomm_dlc_lock(dev->dlc);
764 tty->driver_data = NULL;
765 dev->tty = NULL;
766 rfcomm_dlc_unlock(dev->dlc);
767
768 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) {
769 write_lock_bh(&rfcomm_dev_lock);
770 list_del_init(&dev->list);
771 write_unlock_bh(&rfcomm_dev_lock);
772
773 rfcomm_dev_put(dev);
774 }
775 }
776
777 rfcomm_dev_put(dev);
778 }
779
780 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count)
781 {
782 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
783 struct rfcomm_dlc *dlc = dev->dlc;
784 struct sk_buff *skb;
785 int err = 0, sent = 0, size;
786
787 BT_DBG("tty %p count %d", tty, count);
788
789 while (count) {
790 size = min_t(uint, count, dlc->mtu);
791
792 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC);
793
794 if (!skb)
795 break;
796
797 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
798
799 memcpy(skb_put(skb, size), buf + sent, size);
800
801 if ((err = rfcomm_dlc_send(dlc, skb)) < 0) {
802 kfree_skb(skb);
803 break;
804 }
805
806 sent += size;
807 count -= size;
808 }
809
810 return sent ? sent : err;
811 }
812
813 static int rfcomm_tty_write_room(struct tty_struct *tty)
814 {
815 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
816 int room;
817
818 BT_DBG("tty %p", tty);
819
820 if (!dev || !dev->dlc)
821 return 0;
822
823 room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
824 if (room < 0)
825 room = 0;
826
827 return room;
828 }
829
830 static int rfcomm_tty_ioctl(struct tty_struct *tty, struct file *filp, unsigned int cmd, unsigned long arg)
831 {
832 BT_DBG("tty %p cmd 0x%02x", tty, cmd);
833
834 switch (cmd) {
835 case TCGETS:
836 BT_DBG("TCGETS is not supported");
837 return -ENOIOCTLCMD;
838
839 case TCSETS:
840 BT_DBG("TCSETS is not supported");
841 return -ENOIOCTLCMD;
842
843 case TIOCMIWAIT:
844 BT_DBG("TIOCMIWAIT");
845 break;
846
847 case TIOCGICOUNT:
848 BT_DBG("TIOCGICOUNT");
849 break;
850
851 case TIOCGSERIAL:
852 BT_ERR("TIOCGSERIAL is not supported");
853 return -ENOIOCTLCMD;
854
855 case TIOCSSERIAL:
856 BT_ERR("TIOCSSERIAL is not supported");
857 return -ENOIOCTLCMD;
858
859 case TIOCSERGSTRUCT:
860 BT_ERR("TIOCSERGSTRUCT is not supported");
861 return -ENOIOCTLCMD;
862
863 case TIOCSERGETLSR:
864 BT_ERR("TIOCSERGETLSR is not supported");
865 return -ENOIOCTLCMD;
866
867 case TIOCSERCONFIG:
868 BT_ERR("TIOCSERCONFIG is not supported");
869 return -ENOIOCTLCMD;
870
871 default:
872 return -ENOIOCTLCMD; /* ioctls which we must ignore */
873
874 }
875
876 return -ENOIOCTLCMD;
877 }
878
879 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old)
880 {
881 struct ktermios *new = tty->termios;
882 int old_baud_rate = tty_termios_baud_rate(old);
883 int new_baud_rate = tty_termios_baud_rate(new);
884
885 u8 baud, data_bits, stop_bits, parity, x_on, x_off;
886 u16 changes = 0;
887
888 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
889
890 BT_DBG("tty %p termios %p", tty, old);
891
892 if (!dev || !dev->dlc || !dev->dlc->session)
893 return;
894
895 /* Handle turning off CRTSCTS */
896 if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS))
897 BT_DBG("Turning off CRTSCTS unsupported");
898
899 /* Parity on/off and when on, odd/even */
900 if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) ||
901 ((old->c_cflag & PARODD) != (new->c_cflag & PARODD)) ) {
902 changes |= RFCOMM_RPN_PM_PARITY;
903 BT_DBG("Parity change detected.");
904 }
905
906 /* Mark and space parity are not supported! */
907 if (new->c_cflag & PARENB) {
908 if (new->c_cflag & PARODD) {
909 BT_DBG("Parity is ODD");
910 parity = RFCOMM_RPN_PARITY_ODD;
911 } else {
912 BT_DBG("Parity is EVEN");
913 parity = RFCOMM_RPN_PARITY_EVEN;
914 }
915 } else {
916 BT_DBG("Parity is OFF");
917 parity = RFCOMM_RPN_PARITY_NONE;
918 }
919
920 /* Setting the x_on / x_off characters */
921 if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) {
922 BT_DBG("XOFF custom");
923 x_on = new->c_cc[VSTOP];
924 changes |= RFCOMM_RPN_PM_XON;
925 } else {
926 BT_DBG("XOFF default");
927 x_on = RFCOMM_RPN_XON_CHAR;
928 }
929
930 if (old->c_cc[VSTART] != new->c_cc[VSTART]) {
931 BT_DBG("XON custom");
932 x_off = new->c_cc[VSTART];
933 changes |= RFCOMM_RPN_PM_XOFF;
934 } else {
935 BT_DBG("XON default");
936 x_off = RFCOMM_RPN_XOFF_CHAR;
937 }
938
939 /* Handle setting of stop bits */
940 if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB))
941 changes |= RFCOMM_RPN_PM_STOP;
942
943 /* POSIX does not support 1.5 stop bits and RFCOMM does not
944 * support 2 stop bits. So a request for 2 stop bits gets
945 * translated to 1.5 stop bits */
946 if (new->c_cflag & CSTOPB) {
947 stop_bits = RFCOMM_RPN_STOP_15;
948 } else {
949 stop_bits = RFCOMM_RPN_STOP_1;
950 }
951
952 /* Handle number of data bits [5-8] */
953 if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE))
954 changes |= RFCOMM_RPN_PM_DATA;
955
956 switch (new->c_cflag & CSIZE) {
957 case CS5:
958 data_bits = RFCOMM_RPN_DATA_5;
959 break;
960 case CS6:
961 data_bits = RFCOMM_RPN_DATA_6;
962 break;
963 case CS7:
964 data_bits = RFCOMM_RPN_DATA_7;
965 break;
966 case CS8:
967 data_bits = RFCOMM_RPN_DATA_8;
968 break;
969 default:
970 data_bits = RFCOMM_RPN_DATA_8;
971 break;
972 }
973
974 /* Handle baudrate settings */
975 if (old_baud_rate != new_baud_rate)
976 changes |= RFCOMM_RPN_PM_BITRATE;
977
978 switch (new_baud_rate) {
979 case 2400:
980 baud = RFCOMM_RPN_BR_2400;
981 break;
982 case 4800:
983 baud = RFCOMM_RPN_BR_4800;
984 break;
985 case 7200:
986 baud = RFCOMM_RPN_BR_7200;
987 break;
988 case 9600:
989 baud = RFCOMM_RPN_BR_9600;
990 break;
991 case 19200:
992 baud = RFCOMM_RPN_BR_19200;
993 break;
994 case 38400:
995 baud = RFCOMM_RPN_BR_38400;
996 break;
997 case 57600:
998 baud = RFCOMM_RPN_BR_57600;
999 break;
1000 case 115200:
1001 baud = RFCOMM_RPN_BR_115200;
1002 break;
1003 case 230400:
1004 baud = RFCOMM_RPN_BR_230400;
1005 break;
1006 default:
1007 /* 9600 is standard accordinag to the RFCOMM specification */
1008 baud = RFCOMM_RPN_BR_9600;
1009 break;
1010
1011 }
1012
1013 if (changes)
1014 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud,
1015 data_bits, stop_bits, parity,
1016 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes);
1017
1018 return;
1019 }
1020
1021 static void rfcomm_tty_throttle(struct tty_struct *tty)
1022 {
1023 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1024
1025 BT_DBG("tty %p dev %p", tty, dev);
1026
1027 rfcomm_dlc_throttle(dev->dlc);
1028 }
1029
1030 static void rfcomm_tty_unthrottle(struct tty_struct *tty)
1031 {
1032 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1033
1034 BT_DBG("tty %p dev %p", tty, dev);
1035
1036 rfcomm_dlc_unthrottle(dev->dlc);
1037 }
1038
1039 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
1040 {
1041 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1042
1043 BT_DBG("tty %p dev %p", tty, dev);
1044
1045 if (!dev || !dev->dlc)
1046 return 0;
1047
1048 if (!skb_queue_empty(&dev->dlc->tx_queue))
1049 return dev->dlc->mtu;
1050
1051 return 0;
1052 }
1053
1054 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
1055 {
1056 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1057
1058 BT_DBG("tty %p dev %p", tty, dev);
1059
1060 if (!dev || !dev->dlc)
1061 return;
1062
1063 skb_queue_purge(&dev->dlc->tx_queue);
1064 tty_wakeup(tty);
1065 }
1066
1067 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch)
1068 {
1069 BT_DBG("tty %p ch %c", tty, ch);
1070 }
1071
1072 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
1073 {
1074 BT_DBG("tty %p timeout %d", tty, timeout);
1075 }
1076
1077 static void rfcomm_tty_hangup(struct tty_struct *tty)
1078 {
1079 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1080
1081 BT_DBG("tty %p dev %p", tty, dev);
1082
1083 if (!dev)
1084 return;
1085
1086 rfcomm_tty_flush_buffer(tty);
1087
1088 if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
1089 if (rfcomm_dev_get(dev->id) == NULL)
1090 return;
1091 rfcomm_dev_del(dev);
1092 rfcomm_dev_put(dev);
1093 }
1094 }
1095
1096 static int rfcomm_tty_tiocmget(struct tty_struct *tty, struct file *filp)
1097 {
1098 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1099
1100 BT_DBG("tty %p dev %p", tty, dev);
1101
1102 return dev->modem_status;
1103 }
1104
1105 static int rfcomm_tty_tiocmset(struct tty_struct *tty, struct file *filp, unsigned int set, unsigned int clear)
1106 {
1107 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
1108 struct rfcomm_dlc *dlc = dev->dlc;
1109 u8 v24_sig;
1110
1111 BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear);
1112
1113 rfcomm_dlc_get_modem_status(dlc, &v24_sig);
1114
1115 if (set & TIOCM_DSR || set & TIOCM_DTR)
1116 v24_sig |= RFCOMM_V24_RTC;
1117 if (set & TIOCM_RTS || set & TIOCM_CTS)
1118 v24_sig |= RFCOMM_V24_RTR;
1119 if (set & TIOCM_RI)
1120 v24_sig |= RFCOMM_V24_IC;
1121 if (set & TIOCM_CD)
1122 v24_sig |= RFCOMM_V24_DV;
1123
1124 if (clear & TIOCM_DSR || clear & TIOCM_DTR)
1125 v24_sig &= ~RFCOMM_V24_RTC;
1126 if (clear & TIOCM_RTS || clear & TIOCM_CTS)
1127 v24_sig &= ~RFCOMM_V24_RTR;
1128 if (clear & TIOCM_RI)
1129 v24_sig &= ~RFCOMM_V24_IC;
1130 if (clear & TIOCM_CD)
1131 v24_sig &= ~RFCOMM_V24_DV;
1132
1133 rfcomm_dlc_set_modem_status(dlc, v24_sig);
1134
1135 return 0;
1136 }
1137
1138 /* ---- TTY structure ---- */
1139
1140 static const struct tty_operations rfcomm_ops = {
1141 .open = rfcomm_tty_open,
1142 .close = rfcomm_tty_close,
1143 .write = rfcomm_tty_write,
1144 .write_room = rfcomm_tty_write_room,
1145 .chars_in_buffer = rfcomm_tty_chars_in_buffer,
1146 .flush_buffer = rfcomm_tty_flush_buffer,
1147 .ioctl = rfcomm_tty_ioctl,
1148 .throttle = rfcomm_tty_throttle,
1149 .unthrottle = rfcomm_tty_unthrottle,
1150 .set_termios = rfcomm_tty_set_termios,
1151 .send_xchar = rfcomm_tty_send_xchar,
1152 .hangup = rfcomm_tty_hangup,
1153 .wait_until_sent = rfcomm_tty_wait_until_sent,
1154 .tiocmget = rfcomm_tty_tiocmget,
1155 .tiocmset = rfcomm_tty_tiocmset,
1156 };
1157
1158 int rfcomm_init_ttys(void)
1159 {
1160 rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS);
1161 if (!rfcomm_tty_driver)
1162 return -1;
1163
1164 rfcomm_tty_driver->owner = THIS_MODULE;
1165 rfcomm_tty_driver->driver_name = "rfcomm";
1166 rfcomm_tty_driver->name = "rfcomm";
1167 rfcomm_tty_driver->major = RFCOMM_TTY_MAJOR;
1168 rfcomm_tty_driver->minor_start = RFCOMM_TTY_MINOR;
1169 rfcomm_tty_driver->type = TTY_DRIVER_TYPE_SERIAL;
1170 rfcomm_tty_driver->subtype = SERIAL_TYPE_NORMAL;
1171 rfcomm_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV;
1172 rfcomm_tty_driver->init_termios = tty_std_termios;
1173 rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL;
1174 rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON;
1175 tty_set_operations(rfcomm_tty_driver, &rfcomm_ops);
1176
1177 if (tty_register_driver(rfcomm_tty_driver)) {
1178 BT_ERR("Can't register RFCOMM TTY driver");
1179 put_tty_driver(rfcomm_tty_driver);
1180 return -1;
1181 }
1182
1183 BT_INFO("RFCOMM TTY layer initialized");
1184
1185 return 0;
1186 }
1187
1188 void rfcomm_cleanup_ttys(void)
1189 {
1190 tty_unregister_driver(rfcomm_tty_driver);
1191 put_tty_driver(rfcomm_tty_driver);
1192 }
Linux with added FPC-III support