1 /* 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License version 2 as 8 published by the Free Software Foundation; 9 10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 21 SOFTWARE IS DISCLAIMED. 22 */ 23 24 /* 25 * RFCOMM TTY. 26 */ 27 28 #include <linux/module.h> 29 30 #include <linux/tty.h> 31 #include <linux/tty_driver.h> 32 #include <linux/tty_flip.h> 33 34 #include <net/bluetooth/bluetooth.h> 35 #include <net/bluetooth/hci_core.h> 36 #include <net/bluetooth/rfcomm.h> 37 38 #define RFCOMM_TTY_MAGIC 0x6d02 /* magic number for rfcomm struct */ 39 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */ 40 #define RFCOMM_TTY_MAJOR 216 /* device node major id of the usb/bluetooth.c driver */ 41 #define RFCOMM_TTY_MINOR 0 42 43 static struct tty_driver *rfcomm_tty_driver; 44 45 struct rfcomm_dev { 46 struct tty_port port; 47 struct list_head list; 48 49 char name[12]; 50 int id; 51 unsigned long flags; 52 int err; 53 54 bdaddr_t src; 55 bdaddr_t dst; 56 u8 channel; 57 58 uint modem_status; 59 60 struct rfcomm_dlc *dlc; 61 wait_queue_head_t wait; 62 63 struct device *tty_dev; 64 65 atomic_t wmem_alloc; 66 67 struct sk_buff_head pending; 68 }; 69 70 static LIST_HEAD(rfcomm_dev_list); 71 static DEFINE_SPINLOCK(rfcomm_dev_lock); 72 73 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb); 74 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err); 75 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig); 76 77 /* ---- Device functions ---- */ 78 79 /* 80 * The reason this isn't actually a race, as you no doubt have a little voice 81 * screaming at you in your head, is that the refcount should never actually 82 * reach zero unless the device has already been taken off the list, in 83 * rfcomm_dev_del(). And if that's not true, we'll hit the BUG() in 84 * rfcomm_dev_destruct() anyway. 85 */ 86 static void rfcomm_dev_destruct(struct tty_port *port) 87 { 88 struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port); 89 struct rfcomm_dlc *dlc = dev->dlc; 90 91 BT_DBG("dev %p dlc %p", dev, dlc); 92 93 /* Refcount should only hit zero when called from rfcomm_dev_del() 94 which will have taken us off the list. Everything else are 95 refcounting bugs. */ 96 BUG_ON(!list_empty(&dev->list)); 97 98 rfcomm_dlc_lock(dlc); 99 /* Detach DLC if it's owned by this dev */ 100 if (dlc->owner == dev) 101 dlc->owner = NULL; 102 rfcomm_dlc_unlock(dlc); 103 104 rfcomm_dlc_put(dlc); 105 106 tty_unregister_device(rfcomm_tty_driver, dev->id); 107 108 kfree(dev); 109 110 /* It's safe to call module_put() here because socket still 111 holds reference to this module. */ 112 module_put(THIS_MODULE); 113 } 114 115 static const struct tty_port_operations rfcomm_port_ops = { 116 .destruct = rfcomm_dev_destruct, 117 }; 118 119 static struct rfcomm_dev *__rfcomm_dev_get(int id) 120 { 121 struct rfcomm_dev *dev; 122 123 list_for_each_entry(dev, &rfcomm_dev_list, list) 124 if (dev->id == id) 125 return dev; 126 127 return NULL; 128 } 129 130 static struct rfcomm_dev *rfcomm_dev_get(int id) 131 { 132 struct rfcomm_dev *dev; 133 134 spin_lock(&rfcomm_dev_lock); 135 136 dev = __rfcomm_dev_get(id); 137 138 if (dev) { 139 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) 140 dev = NULL; 141 else 142 tty_port_get(&dev->port); 143 } 144 145 spin_unlock(&rfcomm_dev_lock); 146 147 return dev; 148 } 149 150 static struct device *rfcomm_get_device(struct rfcomm_dev *dev) 151 { 152 struct hci_dev *hdev; 153 struct hci_conn *conn; 154 155 hdev = hci_get_route(&dev->dst, &dev->src); 156 if (!hdev) 157 return NULL; 158 159 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst); 160 161 hci_dev_put(hdev); 162 163 return conn ? &conn->dev : NULL; 164 } 165 166 static ssize_t show_address(struct device *tty_dev, struct device_attribute *attr, char *buf) 167 { 168 struct rfcomm_dev *dev = dev_get_drvdata(tty_dev); 169 return sprintf(buf, "%pMR\n", &dev->dst); 170 } 171 172 static ssize_t show_channel(struct device *tty_dev, struct device_attribute *attr, char *buf) 173 { 174 struct rfcomm_dev *dev = dev_get_drvdata(tty_dev); 175 return sprintf(buf, "%d\n", dev->channel); 176 } 177 178 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL); 179 static DEVICE_ATTR(channel, S_IRUGO, show_channel, NULL); 180 181 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc) 182 { 183 struct rfcomm_dev *dev, *entry; 184 struct list_head *head = &rfcomm_dev_list; 185 int err = 0; 186 187 BT_DBG("id %d channel %d", req->dev_id, req->channel); 188 189 dev = kzalloc(sizeof(struct rfcomm_dev), GFP_KERNEL); 190 if (!dev) 191 return -ENOMEM; 192 193 spin_lock(&rfcomm_dev_lock); 194 195 if (req->dev_id < 0) { 196 dev->id = 0; 197 198 list_for_each_entry(entry, &rfcomm_dev_list, list) { 199 if (entry->id != dev->id) 200 break; 201 202 dev->id++; 203 head = &entry->list; 204 } 205 } else { 206 dev->id = req->dev_id; 207 208 list_for_each_entry(entry, &rfcomm_dev_list, list) { 209 if (entry->id == dev->id) { 210 err = -EADDRINUSE; 211 goto out; 212 } 213 214 if (entry->id > dev->id - 1) 215 break; 216 217 head = &entry->list; 218 } 219 } 220 221 if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) { 222 err = -ENFILE; 223 goto out; 224 } 225 226 sprintf(dev->name, "rfcomm%d", dev->id); 227 228 list_add(&dev->list, head); 229 230 bacpy(&dev->src, &req->src); 231 bacpy(&dev->dst, &req->dst); 232 dev->channel = req->channel; 233 234 dev->flags = req->flags & 235 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC)); 236 237 tty_port_init(&dev->port); 238 dev->port.ops = &rfcomm_port_ops; 239 init_waitqueue_head(&dev->wait); 240 241 skb_queue_head_init(&dev->pending); 242 243 rfcomm_dlc_lock(dlc); 244 245 if (req->flags & (1 << RFCOMM_REUSE_DLC)) { 246 struct sock *sk = dlc->owner; 247 struct sk_buff *skb; 248 249 BUG_ON(!sk); 250 251 rfcomm_dlc_throttle(dlc); 252 253 while ((skb = skb_dequeue(&sk->sk_receive_queue))) { 254 skb_orphan(skb); 255 skb_queue_tail(&dev->pending, skb); 256 atomic_sub(skb->len, &sk->sk_rmem_alloc); 257 } 258 } 259 260 dlc->data_ready = rfcomm_dev_data_ready; 261 dlc->state_change = rfcomm_dev_state_change; 262 dlc->modem_status = rfcomm_dev_modem_status; 263 264 dlc->owner = dev; 265 dev->dlc = dlc; 266 267 rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig); 268 269 rfcomm_dlc_unlock(dlc); 270 271 /* It's safe to call __module_get() here because socket already 272 holds reference to this module. */ 273 __module_get(THIS_MODULE); 274 275 out: 276 spin_unlock(&rfcomm_dev_lock); 277 278 if (err < 0) 279 goto free; 280 281 dev->tty_dev = tty_port_register_device(&dev->port, rfcomm_tty_driver, 282 dev->id, NULL); 283 if (IS_ERR(dev->tty_dev)) { 284 err = PTR_ERR(dev->tty_dev); 285 list_del(&dev->list); 286 goto free; 287 } 288 289 dev_set_drvdata(dev->tty_dev, dev); 290 291 if (device_create_file(dev->tty_dev, &dev_attr_address) < 0) 292 BT_ERR("Failed to create address attribute"); 293 294 if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0) 295 BT_ERR("Failed to create channel attribute"); 296 297 return dev->id; 298 299 free: 300 kfree(dev); 301 return err; 302 } 303 304 static void rfcomm_dev_del(struct rfcomm_dev *dev) 305 { 306 unsigned long flags; 307 BT_DBG("dev %p", dev); 308 309 BUG_ON(test_and_set_bit(RFCOMM_TTY_RELEASED, &dev->flags)); 310 311 spin_lock_irqsave(&dev->port.lock, flags); 312 if (dev->port.count > 0) { 313 spin_unlock_irqrestore(&dev->port.lock, flags); 314 return; 315 } 316 spin_unlock_irqrestore(&dev->port.lock, flags); 317 318 spin_lock(&rfcomm_dev_lock); 319 list_del_init(&dev->list); 320 spin_unlock(&rfcomm_dev_lock); 321 322 tty_port_put(&dev->port); 323 } 324 325 /* ---- Send buffer ---- */ 326 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc) 327 { 328 /* We can't let it be zero, because we don't get a callback 329 when tx_credits becomes nonzero, hence we'd never wake up */ 330 return dlc->mtu * (dlc->tx_credits?:1); 331 } 332 333 static void rfcomm_wfree(struct sk_buff *skb) 334 { 335 struct rfcomm_dev *dev = (void *) skb->sk; 336 struct tty_struct *tty = dev->port.tty; 337 atomic_sub(skb->truesize, &dev->wmem_alloc); 338 if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags) && tty) 339 tty_wakeup(tty); 340 tty_port_put(&dev->port); 341 } 342 343 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev) 344 { 345 tty_port_get(&dev->port); 346 atomic_add(skb->truesize, &dev->wmem_alloc); 347 skb->sk = (void *) dev; 348 skb->destructor = rfcomm_wfree; 349 } 350 351 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority) 352 { 353 if (atomic_read(&dev->wmem_alloc) < rfcomm_room(dev->dlc)) { 354 struct sk_buff *skb = alloc_skb(size, priority); 355 if (skb) { 356 rfcomm_set_owner_w(skb, dev); 357 return skb; 358 } 359 } 360 return NULL; 361 } 362 363 /* ---- Device IOCTLs ---- */ 364 365 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP)) 366 367 static int rfcomm_create_dev(struct sock *sk, void __user *arg) 368 { 369 struct rfcomm_dev_req req; 370 struct rfcomm_dlc *dlc; 371 int id; 372 373 if (copy_from_user(&req, arg, sizeof(req))) 374 return -EFAULT; 375 376 BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags); 377 378 if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) 379 return -EPERM; 380 381 if (req.flags & (1 << RFCOMM_REUSE_DLC)) { 382 /* Socket must be connected */ 383 if (sk->sk_state != BT_CONNECTED) 384 return -EBADFD; 385 386 dlc = rfcomm_pi(sk)->dlc; 387 rfcomm_dlc_hold(dlc); 388 } else { 389 dlc = rfcomm_dlc_alloc(GFP_KERNEL); 390 if (!dlc) 391 return -ENOMEM; 392 } 393 394 id = rfcomm_dev_add(&req, dlc); 395 if (id < 0) { 396 rfcomm_dlc_put(dlc); 397 return id; 398 } 399 400 if (req.flags & (1 << RFCOMM_REUSE_DLC)) { 401 /* DLC is now used by device. 402 * Socket must be disconnected */ 403 sk->sk_state = BT_CLOSED; 404 } 405 406 return id; 407 } 408 409 static int rfcomm_release_dev(void __user *arg) 410 { 411 struct rfcomm_dev_req req; 412 struct rfcomm_dev *dev; 413 414 if (copy_from_user(&req, arg, sizeof(req))) 415 return -EFAULT; 416 417 BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags); 418 419 dev = rfcomm_dev_get(req.dev_id); 420 if (!dev) 421 return -ENODEV; 422 423 if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) { 424 tty_port_put(&dev->port); 425 return -EPERM; 426 } 427 428 if (req.flags & (1 << RFCOMM_HANGUP_NOW)) 429 rfcomm_dlc_close(dev->dlc, 0); 430 431 /* Shut down TTY synchronously before freeing rfcomm_dev */ 432 if (dev->port.tty) 433 tty_vhangup(dev->port.tty); 434 435 if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) 436 rfcomm_dev_del(dev); 437 tty_port_put(&dev->port); 438 return 0; 439 } 440 441 static int rfcomm_get_dev_list(void __user *arg) 442 { 443 struct rfcomm_dev *dev; 444 struct rfcomm_dev_list_req *dl; 445 struct rfcomm_dev_info *di; 446 int n = 0, size, err; 447 u16 dev_num; 448 449 BT_DBG(""); 450 451 if (get_user(dev_num, (u16 __user *) arg)) 452 return -EFAULT; 453 454 if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di)) 455 return -EINVAL; 456 457 size = sizeof(*dl) + dev_num * sizeof(*di); 458 459 dl = kzalloc(size, GFP_KERNEL); 460 if (!dl) 461 return -ENOMEM; 462 463 di = dl->dev_info; 464 465 spin_lock(&rfcomm_dev_lock); 466 467 list_for_each_entry(dev, &rfcomm_dev_list, list) { 468 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) 469 continue; 470 (di + n)->id = dev->id; 471 (di + n)->flags = dev->flags; 472 (di + n)->state = dev->dlc->state; 473 (di + n)->channel = dev->channel; 474 bacpy(&(di + n)->src, &dev->src); 475 bacpy(&(di + n)->dst, &dev->dst); 476 if (++n >= dev_num) 477 break; 478 } 479 480 spin_unlock(&rfcomm_dev_lock); 481 482 dl->dev_num = n; 483 size = sizeof(*dl) + n * sizeof(*di); 484 485 err = copy_to_user(arg, dl, size); 486 kfree(dl); 487 488 return err ? -EFAULT : 0; 489 } 490 491 static int rfcomm_get_dev_info(void __user *arg) 492 { 493 struct rfcomm_dev *dev; 494 struct rfcomm_dev_info di; 495 int err = 0; 496 497 BT_DBG(""); 498 499 if (copy_from_user(&di, arg, sizeof(di))) 500 return -EFAULT; 501 502 dev = rfcomm_dev_get(di.id); 503 if (!dev) 504 return -ENODEV; 505 506 di.flags = dev->flags; 507 di.channel = dev->channel; 508 di.state = dev->dlc->state; 509 bacpy(&di.src, &dev->src); 510 bacpy(&di.dst, &dev->dst); 511 512 if (copy_to_user(arg, &di, sizeof(di))) 513 err = -EFAULT; 514 515 tty_port_put(&dev->port); 516 return err; 517 } 518 519 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) 520 { 521 BT_DBG("cmd %d arg %p", cmd, arg); 522 523 switch (cmd) { 524 case RFCOMMCREATEDEV: 525 return rfcomm_create_dev(sk, arg); 526 527 case RFCOMMRELEASEDEV: 528 return rfcomm_release_dev(arg); 529 530 case RFCOMMGETDEVLIST: 531 return rfcomm_get_dev_list(arg); 532 533 case RFCOMMGETDEVINFO: 534 return rfcomm_get_dev_info(arg); 535 } 536 537 return -EINVAL; 538 } 539 540 /* ---- DLC callbacks ---- */ 541 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb) 542 { 543 struct rfcomm_dev *dev = dlc->owner; 544 545 if (!dev) { 546 kfree_skb(skb); 547 return; 548 } 549 550 if (!skb_queue_empty(&dev->pending)) { 551 skb_queue_tail(&dev->pending, skb); 552 return; 553 } 554 555 BT_DBG("dlc %p len %d", dlc, skb->len); 556 557 tty_insert_flip_string(&dev->port, skb->data, skb->len); 558 tty_flip_buffer_push(&dev->port); 559 560 kfree_skb(skb); 561 } 562 563 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err) 564 { 565 struct rfcomm_dev *dev = dlc->owner; 566 if (!dev) 567 return; 568 569 BT_DBG("dlc %p dev %p err %d", dlc, dev, err); 570 571 dev->err = err; 572 wake_up_interruptible(&dev->wait); 573 574 if (dlc->state == BT_CLOSED) { 575 if (!dev->port.tty) { 576 if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) { 577 /* Drop DLC lock here to avoid deadlock 578 * 1. rfcomm_dev_get will take rfcomm_dev_lock 579 * but in rfcomm_dev_add there's lock order: 580 * rfcomm_dev_lock -> dlc lock 581 * 2. tty_port_put will deadlock if it's 582 * the last reference 583 */ 584 rfcomm_dlc_unlock(dlc); 585 if (rfcomm_dev_get(dev->id) == NULL) { 586 rfcomm_dlc_lock(dlc); 587 return; 588 } 589 590 rfcomm_dev_del(dev); 591 tty_port_put(&dev->port); 592 rfcomm_dlc_lock(dlc); 593 } 594 } else 595 tty_hangup(dev->port.tty); 596 } 597 } 598 599 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig) 600 { 601 struct rfcomm_dev *dev = dlc->owner; 602 if (!dev) 603 return; 604 605 BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig); 606 607 if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) { 608 if (dev->port.tty && !C_CLOCAL(dev->port.tty)) 609 tty_hangup(dev->port.tty); 610 } 611 612 dev->modem_status = 613 ((v24_sig & RFCOMM_V24_RTC) ? (TIOCM_DSR | TIOCM_DTR) : 0) | 614 ((v24_sig & RFCOMM_V24_RTR) ? (TIOCM_RTS | TIOCM_CTS) : 0) | 615 ((v24_sig & RFCOMM_V24_IC) ? TIOCM_RI : 0) | 616 ((v24_sig & RFCOMM_V24_DV) ? TIOCM_CD : 0); 617 } 618 619 /* ---- TTY functions ---- */ 620 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev) 621 { 622 struct sk_buff *skb; 623 int inserted = 0; 624 625 BT_DBG("dev %p", dev); 626 627 rfcomm_dlc_lock(dev->dlc); 628 629 while ((skb = skb_dequeue(&dev->pending))) { 630 inserted += tty_insert_flip_string(&dev->port, skb->data, 631 skb->len); 632 kfree_skb(skb); 633 } 634 635 rfcomm_dlc_unlock(dev->dlc); 636 637 if (inserted > 0) 638 tty_flip_buffer_push(&dev->port); 639 } 640 641 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp) 642 { 643 DECLARE_WAITQUEUE(wait, current); 644 struct rfcomm_dev *dev; 645 struct rfcomm_dlc *dlc; 646 unsigned long flags; 647 int err, id; 648 649 id = tty->index; 650 651 BT_DBG("tty %p id %d", tty, id); 652 653 /* We don't leak this refcount. For reasons which are not entirely 654 clear, the TTY layer will call our ->close() method even if the 655 open fails. We decrease the refcount there, and decreasing it 656 here too would cause breakage. */ 657 dev = rfcomm_dev_get(id); 658 if (!dev) 659 return -ENODEV; 660 661 BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst, 662 dev->channel, dev->port.count); 663 664 spin_lock_irqsave(&dev->port.lock, flags); 665 if (++dev->port.count > 1) { 666 spin_unlock_irqrestore(&dev->port.lock, flags); 667 return 0; 668 } 669 spin_unlock_irqrestore(&dev->port.lock, flags); 670 671 dlc = dev->dlc; 672 673 /* Attach TTY and open DLC */ 674 675 rfcomm_dlc_lock(dlc); 676 tty->driver_data = dev; 677 dev->port.tty = tty; 678 rfcomm_dlc_unlock(dlc); 679 set_bit(RFCOMM_TTY_ATTACHED, &dev->flags); 680 681 err = rfcomm_dlc_open(dlc, &dev->src, &dev->dst, dev->channel); 682 if (err < 0) 683 return err; 684 685 /* Wait for DLC to connect */ 686 add_wait_queue(&dev->wait, &wait); 687 while (1) { 688 set_current_state(TASK_INTERRUPTIBLE); 689 690 if (dlc->state == BT_CLOSED) { 691 err = -dev->err; 692 break; 693 } 694 695 if (dlc->state == BT_CONNECTED) 696 break; 697 698 if (signal_pending(current)) { 699 err = -EINTR; 700 break; 701 } 702 703 tty_unlock(tty); 704 schedule(); 705 tty_lock(tty); 706 } 707 set_current_state(TASK_RUNNING); 708 remove_wait_queue(&dev->wait, &wait); 709 710 if (err == 0) 711 device_move(dev->tty_dev, rfcomm_get_device(dev), 712 DPM_ORDER_DEV_AFTER_PARENT); 713 714 rfcomm_tty_copy_pending(dev); 715 716 rfcomm_dlc_unthrottle(dev->dlc); 717 718 return err; 719 } 720 721 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp) 722 { 723 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 724 unsigned long flags; 725 726 if (!dev) 727 return; 728 729 BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, 730 dev->port.count); 731 732 spin_lock_irqsave(&dev->port.lock, flags); 733 if (!--dev->port.count) { 734 spin_unlock_irqrestore(&dev->port.lock, flags); 735 if (dev->tty_dev->parent) 736 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST); 737 738 /* Close DLC and dettach TTY */ 739 rfcomm_dlc_close(dev->dlc, 0); 740 741 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags); 742 743 rfcomm_dlc_lock(dev->dlc); 744 tty->driver_data = NULL; 745 dev->port.tty = NULL; 746 rfcomm_dlc_unlock(dev->dlc); 747 748 if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags)) { 749 spin_lock(&rfcomm_dev_lock); 750 list_del_init(&dev->list); 751 spin_unlock(&rfcomm_dev_lock); 752 753 tty_port_put(&dev->port); 754 } 755 } else 756 spin_unlock_irqrestore(&dev->port.lock, flags); 757 758 tty_port_put(&dev->port); 759 } 760 761 static int rfcomm_tty_write(struct tty_struct *tty, const unsigned char *buf, int count) 762 { 763 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 764 struct rfcomm_dlc *dlc = dev->dlc; 765 struct sk_buff *skb; 766 int err = 0, sent = 0, size; 767 768 BT_DBG("tty %p count %d", tty, count); 769 770 while (count) { 771 size = min_t(uint, count, dlc->mtu); 772 773 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC); 774 775 if (!skb) 776 break; 777 778 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE); 779 780 memcpy(skb_put(skb, size), buf + sent, size); 781 782 err = rfcomm_dlc_send(dlc, skb); 783 if (err < 0) { 784 kfree_skb(skb); 785 break; 786 } 787 788 sent += size; 789 count -= size; 790 } 791 792 return sent ? sent : err; 793 } 794 795 static int rfcomm_tty_write_room(struct tty_struct *tty) 796 { 797 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 798 int room; 799 800 BT_DBG("tty %p", tty); 801 802 if (!dev || !dev->dlc) 803 return 0; 804 805 room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc); 806 if (room < 0) 807 room = 0; 808 809 return room; 810 } 811 812 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg) 813 { 814 BT_DBG("tty %p cmd 0x%02x", tty, cmd); 815 816 switch (cmd) { 817 case TCGETS: 818 BT_DBG("TCGETS is not supported"); 819 return -ENOIOCTLCMD; 820 821 case TCSETS: 822 BT_DBG("TCSETS is not supported"); 823 return -ENOIOCTLCMD; 824 825 case TIOCMIWAIT: 826 BT_DBG("TIOCMIWAIT"); 827 break; 828 829 case TIOCGSERIAL: 830 BT_ERR("TIOCGSERIAL is not supported"); 831 return -ENOIOCTLCMD; 832 833 case TIOCSSERIAL: 834 BT_ERR("TIOCSSERIAL is not supported"); 835 return -ENOIOCTLCMD; 836 837 case TIOCSERGSTRUCT: 838 BT_ERR("TIOCSERGSTRUCT is not supported"); 839 return -ENOIOCTLCMD; 840 841 case TIOCSERGETLSR: 842 BT_ERR("TIOCSERGETLSR is not supported"); 843 return -ENOIOCTLCMD; 844 845 case TIOCSERCONFIG: 846 BT_ERR("TIOCSERCONFIG is not supported"); 847 return -ENOIOCTLCMD; 848 849 default: 850 return -ENOIOCTLCMD; /* ioctls which we must ignore */ 851 852 } 853 854 return -ENOIOCTLCMD; 855 } 856 857 static void rfcomm_tty_set_termios(struct tty_struct *tty, struct ktermios *old) 858 { 859 struct ktermios *new = &tty->termios; 860 int old_baud_rate = tty_termios_baud_rate(old); 861 int new_baud_rate = tty_termios_baud_rate(new); 862 863 u8 baud, data_bits, stop_bits, parity, x_on, x_off; 864 u16 changes = 0; 865 866 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 867 868 BT_DBG("tty %p termios %p", tty, old); 869 870 if (!dev || !dev->dlc || !dev->dlc->session) 871 return; 872 873 /* Handle turning off CRTSCTS */ 874 if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS)) 875 BT_DBG("Turning off CRTSCTS unsupported"); 876 877 /* Parity on/off and when on, odd/even */ 878 if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) || 879 ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) { 880 changes |= RFCOMM_RPN_PM_PARITY; 881 BT_DBG("Parity change detected."); 882 } 883 884 /* Mark and space parity are not supported! */ 885 if (new->c_cflag & PARENB) { 886 if (new->c_cflag & PARODD) { 887 BT_DBG("Parity is ODD"); 888 parity = RFCOMM_RPN_PARITY_ODD; 889 } else { 890 BT_DBG("Parity is EVEN"); 891 parity = RFCOMM_RPN_PARITY_EVEN; 892 } 893 } else { 894 BT_DBG("Parity is OFF"); 895 parity = RFCOMM_RPN_PARITY_NONE; 896 } 897 898 /* Setting the x_on / x_off characters */ 899 if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) { 900 BT_DBG("XOFF custom"); 901 x_on = new->c_cc[VSTOP]; 902 changes |= RFCOMM_RPN_PM_XON; 903 } else { 904 BT_DBG("XOFF default"); 905 x_on = RFCOMM_RPN_XON_CHAR; 906 } 907 908 if (old->c_cc[VSTART] != new->c_cc[VSTART]) { 909 BT_DBG("XON custom"); 910 x_off = new->c_cc[VSTART]; 911 changes |= RFCOMM_RPN_PM_XOFF; 912 } else { 913 BT_DBG("XON default"); 914 x_off = RFCOMM_RPN_XOFF_CHAR; 915 } 916 917 /* Handle setting of stop bits */ 918 if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB)) 919 changes |= RFCOMM_RPN_PM_STOP; 920 921 /* POSIX does not support 1.5 stop bits and RFCOMM does not 922 * support 2 stop bits. So a request for 2 stop bits gets 923 * translated to 1.5 stop bits */ 924 if (new->c_cflag & CSTOPB) 925 stop_bits = RFCOMM_RPN_STOP_15; 926 else 927 stop_bits = RFCOMM_RPN_STOP_1; 928 929 /* Handle number of data bits [5-8] */ 930 if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE)) 931 changes |= RFCOMM_RPN_PM_DATA; 932 933 switch (new->c_cflag & CSIZE) { 934 case CS5: 935 data_bits = RFCOMM_RPN_DATA_5; 936 break; 937 case CS6: 938 data_bits = RFCOMM_RPN_DATA_6; 939 break; 940 case CS7: 941 data_bits = RFCOMM_RPN_DATA_7; 942 break; 943 case CS8: 944 data_bits = RFCOMM_RPN_DATA_8; 945 break; 946 default: 947 data_bits = RFCOMM_RPN_DATA_8; 948 break; 949 } 950 951 /* Handle baudrate settings */ 952 if (old_baud_rate != new_baud_rate) 953 changes |= RFCOMM_RPN_PM_BITRATE; 954 955 switch (new_baud_rate) { 956 case 2400: 957 baud = RFCOMM_RPN_BR_2400; 958 break; 959 case 4800: 960 baud = RFCOMM_RPN_BR_4800; 961 break; 962 case 7200: 963 baud = RFCOMM_RPN_BR_7200; 964 break; 965 case 9600: 966 baud = RFCOMM_RPN_BR_9600; 967 break; 968 case 19200: 969 baud = RFCOMM_RPN_BR_19200; 970 break; 971 case 38400: 972 baud = RFCOMM_RPN_BR_38400; 973 break; 974 case 57600: 975 baud = RFCOMM_RPN_BR_57600; 976 break; 977 case 115200: 978 baud = RFCOMM_RPN_BR_115200; 979 break; 980 case 230400: 981 baud = RFCOMM_RPN_BR_230400; 982 break; 983 default: 984 /* 9600 is standard accordinag to the RFCOMM specification */ 985 baud = RFCOMM_RPN_BR_9600; 986 break; 987 988 } 989 990 if (changes) 991 rfcomm_send_rpn(dev->dlc->session, 1, dev->dlc->dlci, baud, 992 data_bits, stop_bits, parity, 993 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes); 994 } 995 996 static void rfcomm_tty_throttle(struct tty_struct *tty) 997 { 998 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 999 1000 BT_DBG("tty %p dev %p", tty, dev); 1001 1002 rfcomm_dlc_throttle(dev->dlc); 1003 } 1004 1005 static void rfcomm_tty_unthrottle(struct tty_struct *tty) 1006 { 1007 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 1008 1009 BT_DBG("tty %p dev %p", tty, dev); 1010 1011 rfcomm_dlc_unthrottle(dev->dlc); 1012 } 1013 1014 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty) 1015 { 1016 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 1017 1018 BT_DBG("tty %p dev %p", tty, dev); 1019 1020 if (!dev || !dev->dlc) 1021 return 0; 1022 1023 if (!skb_queue_empty(&dev->dlc->tx_queue)) 1024 return dev->dlc->mtu; 1025 1026 return 0; 1027 } 1028 1029 static void rfcomm_tty_flush_buffer(struct tty_struct *tty) 1030 { 1031 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 1032 1033 BT_DBG("tty %p dev %p", tty, dev); 1034 1035 if (!dev || !dev->dlc) 1036 return; 1037 1038 skb_queue_purge(&dev->dlc->tx_queue); 1039 tty_wakeup(tty); 1040 } 1041 1042 static void rfcomm_tty_send_xchar(struct tty_struct *tty, char ch) 1043 { 1044 BT_DBG("tty %p ch %c", tty, ch); 1045 } 1046 1047 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout) 1048 { 1049 BT_DBG("tty %p timeout %d", tty, timeout); 1050 } 1051 1052 static void rfcomm_tty_hangup(struct tty_struct *tty) 1053 { 1054 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 1055 1056 BT_DBG("tty %p dev %p", tty, dev); 1057 1058 if (!dev) 1059 return; 1060 1061 rfcomm_tty_flush_buffer(tty); 1062 1063 if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) { 1064 if (rfcomm_dev_get(dev->id) == NULL) 1065 return; 1066 rfcomm_dev_del(dev); 1067 tty_port_put(&dev->port); 1068 } 1069 } 1070 1071 static int rfcomm_tty_tiocmget(struct tty_struct *tty) 1072 { 1073 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 1074 1075 BT_DBG("tty %p dev %p", tty, dev); 1076 1077 return dev->modem_status; 1078 } 1079 1080 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear) 1081 { 1082 struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data; 1083 struct rfcomm_dlc *dlc = dev->dlc; 1084 u8 v24_sig; 1085 1086 BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear); 1087 1088 rfcomm_dlc_get_modem_status(dlc, &v24_sig); 1089 1090 if (set & TIOCM_DSR || set & TIOCM_DTR) 1091 v24_sig |= RFCOMM_V24_RTC; 1092 if (set & TIOCM_RTS || set & TIOCM_CTS) 1093 v24_sig |= RFCOMM_V24_RTR; 1094 if (set & TIOCM_RI) 1095 v24_sig |= RFCOMM_V24_IC; 1096 if (set & TIOCM_CD) 1097 v24_sig |= RFCOMM_V24_DV; 1098 1099 if (clear & TIOCM_DSR || clear & TIOCM_DTR) 1100 v24_sig &= ~RFCOMM_V24_RTC; 1101 if (clear & TIOCM_RTS || clear & TIOCM_CTS) 1102 v24_sig &= ~RFCOMM_V24_RTR; 1103 if (clear & TIOCM_RI) 1104 v24_sig &= ~RFCOMM_V24_IC; 1105 if (clear & TIOCM_CD) 1106 v24_sig &= ~RFCOMM_V24_DV; 1107 1108 rfcomm_dlc_set_modem_status(dlc, v24_sig); 1109 1110 return 0; 1111 } 1112 1113 /* ---- TTY structure ---- */ 1114 1115 static const struct tty_operations rfcomm_ops = { 1116 .open = rfcomm_tty_open, 1117 .close = rfcomm_tty_close, 1118 .write = rfcomm_tty_write, 1119 .write_room = rfcomm_tty_write_room, 1120 .chars_in_buffer = rfcomm_tty_chars_in_buffer, 1121 .flush_buffer = rfcomm_tty_flush_buffer, 1122 .ioctl = rfcomm_tty_ioctl, 1123 .throttle = rfcomm_tty_throttle, 1124 .unthrottle = rfcomm_tty_unthrottle, 1125 .set_termios = rfcomm_tty_set_termios, 1126 .send_xchar = rfcomm_tty_send_xchar, 1127 .hangup = rfcomm_tty_hangup, 1128 .wait_until_sent = rfcomm_tty_wait_until_sent, 1129 .tiocmget = rfcomm_tty_tiocmget, 1130 .tiocmset = rfcomm_tty_tiocmset, 1131 }; 1132 1133 int __init rfcomm_init_ttys(void) 1134 { 1135 int error; 1136 1137 rfcomm_tty_driver = alloc_tty_driver(RFCOMM_TTY_PORTS); 1138 if (!rfcomm_tty_driver) 1139 return -ENOMEM; 1140 1141 rfcomm_tty_driver->driver_name = "rfcomm"; 1142 rfcomm_tty_driver->name = "rfcomm"; 1143 rfcomm_tty_driver->major = RFCOMM_TTY_MAJOR; 1144 rfcomm_tty_driver->minor_start = RFCOMM_TTY_MINOR; 1145 rfcomm_tty_driver->type = TTY_DRIVER_TYPE_SERIAL; 1146 rfcomm_tty_driver->subtype = SERIAL_TYPE_NORMAL; 1147 rfcomm_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV; 1148 rfcomm_tty_driver->init_termios = tty_std_termios; 1149 rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL; 1150 rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON; 1151 tty_set_operations(rfcomm_tty_driver, &rfcomm_ops); 1152 1153 error = tty_register_driver(rfcomm_tty_driver); 1154 if (error) { 1155 BT_ERR("Can't register RFCOMM TTY driver"); 1156 put_tty_driver(rfcomm_tty_driver); 1157 return error; 1158 } 1159 1160 BT_INFO("RFCOMM TTY layer initialized"); 1161 1162 return 0; 1163 } 1164 1165 void rfcomm_cleanup_ttys(void) 1166 { 1167 tty_unregister_driver(rfcomm_tty_driver); 1168 put_tty_driver(rfcomm_tty_driver); 1169 } 1170