1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 RFCOMM implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com> 5 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 /* 22 * RFCOMM TTY. 23 */ 24 25 #include <linux/module.h> 26 27 #include <linux/tty.h> 28 #include <linux/tty_driver.h> 29 #include <linux/tty_flip.h> 30 31 #include <net/bluetooth/bluetooth.h> 32 #include <net/bluetooth/hci_core.h> 33 #include <net/bluetooth/rfcomm.h> 34 35 #define RFCOMM_TTY_PORTS RFCOMM_MAX_DEV /* whole lotta rfcomm devices */ 36 #define RFCOMM_TTY_MAJOR 216 /* device node major id of the usb/bluetooth.c driver */ 37 #define RFCOMM_TTY_MINOR 0 38 39 static DEFINE_MUTEX(rfcomm_ioctl_mutex); 40 static struct tty_driver *rfcomm_tty_driver; 41 42 struct rfcomm_dev { 43 struct tty_port port; 44 struct list_head list; 45 46 char name[12]; 47 int id; 48 unsigned long flags; 49 int err; 50 51 unsigned long status; /* don't export to userspace */ 52 53 bdaddr_t src; 54 bdaddr_t dst; 55 u8 channel; 56 57 uint modem_status; 58 59 struct rfcomm_dlc *dlc; 60 61 struct device *tty_dev; 62 63 atomic_t wmem_alloc; 64 65 struct sk_buff_head pending; 66 }; 67 68 static LIST_HEAD(rfcomm_dev_list); 69 static DEFINE_MUTEX(rfcomm_dev_lock); 70 71 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb); 72 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err); 73 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig); 74 75 /* ---- Device functions ---- */ 76 77 static void rfcomm_dev_destruct(struct tty_port *port) 78 { 79 struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port); 80 struct rfcomm_dlc *dlc = dev->dlc; 81 82 BT_DBG("dev %p dlc %p", dev, dlc); 83 84 rfcomm_dlc_lock(dlc); 85 /* Detach DLC if it's owned by this dev */ 86 if (dlc->owner == dev) 87 dlc->owner = NULL; 88 rfcomm_dlc_unlock(dlc); 89 90 rfcomm_dlc_put(dlc); 91 92 if (dev->tty_dev) 93 tty_unregister_device(rfcomm_tty_driver, dev->id); 94 95 mutex_lock(&rfcomm_dev_lock); 96 list_del(&dev->list); 97 mutex_unlock(&rfcomm_dev_lock); 98 99 kfree(dev); 100 101 /* It's safe to call module_put() here because socket still 102 holds reference to this module. */ 103 module_put(THIS_MODULE); 104 } 105 106 /* device-specific initialization: open the dlc */ 107 static int rfcomm_dev_activate(struct tty_port *port, struct tty_struct *tty) 108 { 109 struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port); 110 int err; 111 112 err = rfcomm_dlc_open(dev->dlc, &dev->src, &dev->dst, dev->channel); 113 if (err) 114 set_bit(TTY_IO_ERROR, &tty->flags); 115 return err; 116 } 117 118 /* we block the open until the dlc->state becomes BT_CONNECTED */ 119 static bool rfcomm_dev_carrier_raised(struct tty_port *port) 120 { 121 struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port); 122 123 return (dev->dlc->state == BT_CONNECTED); 124 } 125 126 /* device-specific cleanup: close the dlc */ 127 static void rfcomm_dev_shutdown(struct tty_port *port) 128 { 129 struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port); 130 131 if (dev->tty_dev && dev->tty_dev->parent) 132 device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST); 133 134 /* close the dlc */ 135 rfcomm_dlc_close(dev->dlc, 0); 136 } 137 138 static const struct tty_port_operations rfcomm_port_ops = { 139 .destruct = rfcomm_dev_destruct, 140 .activate = rfcomm_dev_activate, 141 .shutdown = rfcomm_dev_shutdown, 142 .carrier_raised = rfcomm_dev_carrier_raised, 143 }; 144 145 static struct rfcomm_dev *__rfcomm_dev_lookup(int id) 146 { 147 struct rfcomm_dev *dev; 148 149 list_for_each_entry(dev, &rfcomm_dev_list, list) 150 if (dev->id == id) 151 return dev; 152 153 return NULL; 154 } 155 156 static struct rfcomm_dev *rfcomm_dev_get(int id) 157 { 158 struct rfcomm_dev *dev; 159 160 mutex_lock(&rfcomm_dev_lock); 161 162 dev = __rfcomm_dev_lookup(id); 163 164 if (dev && !tty_port_get(&dev->port)) 165 dev = NULL; 166 167 mutex_unlock(&rfcomm_dev_lock); 168 169 return dev; 170 } 171 172 static void rfcomm_reparent_device(struct rfcomm_dev *dev) 173 { 174 struct hci_dev *hdev; 175 struct hci_conn *conn; 176 177 hdev = hci_get_route(&dev->dst, &dev->src, BDADDR_BREDR); 178 if (!hdev) 179 return; 180 181 /* The lookup results are unsafe to access without the 182 * hci device lock (FIXME: why is this not documented?) 183 */ 184 hci_dev_lock(hdev); 185 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &dev->dst); 186 187 /* Just because the acl link is in the hash table is no 188 * guarantee the sysfs device has been added ... 189 */ 190 if (conn && device_is_registered(&conn->dev)) 191 device_move(dev->tty_dev, &conn->dev, DPM_ORDER_DEV_AFTER_PARENT); 192 193 hci_dev_unlock(hdev); 194 hci_dev_put(hdev); 195 } 196 197 static ssize_t address_show(struct device *tty_dev, 198 struct device_attribute *attr, char *buf) 199 { 200 struct rfcomm_dev *dev = dev_get_drvdata(tty_dev); 201 return sysfs_emit(buf, "%pMR\n", &dev->dst); 202 } 203 204 static ssize_t channel_show(struct device *tty_dev, 205 struct device_attribute *attr, char *buf) 206 { 207 struct rfcomm_dev *dev = dev_get_drvdata(tty_dev); 208 return sysfs_emit(buf, "%d\n", dev->channel); 209 } 210 211 static DEVICE_ATTR_RO(address); 212 static DEVICE_ATTR_RO(channel); 213 214 static struct rfcomm_dev *__rfcomm_dev_add(struct rfcomm_dev_req *req, 215 struct rfcomm_dlc *dlc) 216 { 217 struct rfcomm_dev *dev, *entry; 218 struct list_head *head = &rfcomm_dev_list; 219 int err = 0; 220 221 dev = kzalloc_obj(struct rfcomm_dev); 222 if (!dev) 223 return ERR_PTR(-ENOMEM); 224 225 mutex_lock(&rfcomm_dev_lock); 226 227 if (req->dev_id < 0) { 228 dev->id = 0; 229 230 list_for_each_entry(entry, &rfcomm_dev_list, list) { 231 if (entry->id != dev->id) 232 break; 233 234 dev->id++; 235 head = &entry->list; 236 } 237 } else { 238 dev->id = req->dev_id; 239 240 list_for_each_entry(entry, &rfcomm_dev_list, list) { 241 if (entry->id == dev->id) { 242 err = -EADDRINUSE; 243 goto out; 244 } 245 246 if (entry->id > dev->id - 1) 247 break; 248 249 head = &entry->list; 250 } 251 } 252 253 if ((dev->id < 0) || (dev->id > RFCOMM_MAX_DEV - 1)) { 254 err = -ENFILE; 255 goto out; 256 } 257 258 sprintf(dev->name, "rfcomm%d", dev->id); 259 260 list_add(&dev->list, head); 261 262 bacpy(&dev->src, &req->src); 263 bacpy(&dev->dst, &req->dst); 264 dev->channel = req->channel; 265 266 dev->flags = req->flags & 267 ((1 << RFCOMM_RELEASE_ONHUP) | (1 << RFCOMM_REUSE_DLC)); 268 269 tty_port_init(&dev->port); 270 dev->port.ops = &rfcomm_port_ops; 271 272 skb_queue_head_init(&dev->pending); 273 274 rfcomm_dlc_lock(dlc); 275 276 if (req->flags & (1 << RFCOMM_REUSE_DLC)) { 277 struct sock *sk = dlc->owner; 278 struct sk_buff *skb; 279 280 BUG_ON(!sk); 281 282 rfcomm_dlc_throttle(dlc); 283 284 while ((skb = skb_dequeue(&sk->sk_receive_queue))) { 285 skb_orphan(skb); 286 skb_queue_tail(&dev->pending, skb); 287 atomic_sub(skb->len, &sk->sk_rmem_alloc); 288 } 289 } 290 291 dlc->data_ready = rfcomm_dev_data_ready; 292 dlc->state_change = rfcomm_dev_state_change; 293 dlc->modem_status = rfcomm_dev_modem_status; 294 295 dlc->owner = dev; 296 dev->dlc = dlc; 297 298 rfcomm_dev_modem_status(dlc, dlc->remote_v24_sig); 299 300 rfcomm_dlc_unlock(dlc); 301 302 /* It's safe to call __module_get() here because socket already 303 holds reference to this module. */ 304 __module_get(THIS_MODULE); 305 306 mutex_unlock(&rfcomm_dev_lock); 307 return dev; 308 309 out: 310 mutex_unlock(&rfcomm_dev_lock); 311 kfree(dev); 312 return ERR_PTR(err); 313 } 314 315 static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc) 316 { 317 struct rfcomm_dev *dev; 318 struct device *tty; 319 320 BT_DBG("id %d channel %d", req->dev_id, req->channel); 321 322 dev = __rfcomm_dev_add(req, dlc); 323 if (IS_ERR(dev)) { 324 rfcomm_dlc_put(dlc); 325 return PTR_ERR(dev); 326 } 327 328 tty = tty_port_register_device(&dev->port, rfcomm_tty_driver, 329 dev->id, NULL); 330 if (IS_ERR(tty)) { 331 tty_port_put(&dev->port); 332 return PTR_ERR(tty); 333 } 334 335 dev->tty_dev = tty; 336 rfcomm_reparent_device(dev); 337 dev_set_drvdata(dev->tty_dev, dev); 338 339 if (device_create_file(dev->tty_dev, &dev_attr_address) < 0) 340 BT_ERR("Failed to create address attribute"); 341 342 if (device_create_file(dev->tty_dev, &dev_attr_channel) < 0) 343 BT_ERR("Failed to create channel attribute"); 344 345 return dev->id; 346 } 347 348 /* ---- Send buffer ---- */ 349 static inline unsigned int rfcomm_room(struct rfcomm_dev *dev) 350 { 351 struct rfcomm_dlc *dlc = dev->dlc; 352 353 /* Limit the outstanding number of packets not yet sent to 40 */ 354 int pending = 40 - atomic_read(&dev->wmem_alloc); 355 356 return max(0, pending) * dlc->mtu; 357 } 358 359 static void rfcomm_wfree(struct sk_buff *skb) 360 { 361 struct rfcomm_dev *dev = (void *) skb->sk; 362 atomic_dec(&dev->wmem_alloc); 363 if (test_bit(RFCOMM_TTY_ATTACHED, &dev->flags)) 364 tty_port_tty_wakeup(&dev->port); 365 tty_port_put(&dev->port); 366 } 367 368 static void rfcomm_set_owner_w(struct sk_buff *skb, struct rfcomm_dev *dev) 369 { 370 tty_port_get(&dev->port); 371 atomic_inc(&dev->wmem_alloc); 372 skb->sk = (void *) dev; 373 skb->destructor = rfcomm_wfree; 374 } 375 376 static struct sk_buff *rfcomm_wmalloc(struct rfcomm_dev *dev, unsigned long size, gfp_t priority) 377 { 378 struct sk_buff *skb = alloc_skb(size, priority); 379 if (skb) 380 rfcomm_set_owner_w(skb, dev); 381 return skb; 382 } 383 384 /* ---- Device IOCTLs ---- */ 385 386 #define NOCAP_FLAGS ((1 << RFCOMM_REUSE_DLC) | (1 << RFCOMM_RELEASE_ONHUP)) 387 388 static int __rfcomm_create_dev(struct sock *sk, void __user *arg) 389 { 390 struct rfcomm_dev_req req; 391 struct rfcomm_dlc *dlc; 392 int id; 393 394 if (copy_from_user(&req, arg, sizeof(req))) 395 return -EFAULT; 396 397 BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags); 398 399 if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) 400 return -EPERM; 401 402 if (req.flags & (1 << RFCOMM_REUSE_DLC)) { 403 /* Socket must be connected */ 404 if (sk->sk_state != BT_CONNECTED) 405 return -EBADFD; 406 407 dlc = rfcomm_pi(sk)->dlc; 408 rfcomm_dlc_hold(dlc); 409 } else { 410 /* Validate the channel is unused */ 411 dlc = rfcomm_dlc_exists(&req.src, &req.dst, req.channel); 412 if (IS_ERR(dlc)) 413 return PTR_ERR(dlc); 414 if (dlc) 415 return -EBUSY; 416 dlc = rfcomm_dlc_alloc(GFP_KERNEL); 417 if (!dlc) 418 return -ENOMEM; 419 } 420 421 id = rfcomm_dev_add(&req, dlc); 422 if (id < 0) 423 return id; 424 425 if (req.flags & (1 << RFCOMM_REUSE_DLC)) { 426 /* DLC is now used by device. 427 * Socket must be disconnected */ 428 sk->sk_state = BT_CLOSED; 429 } 430 431 return id; 432 } 433 434 static int __rfcomm_release_dev(void __user *arg) 435 { 436 struct rfcomm_dev_req req; 437 struct rfcomm_dev *dev; 438 439 if (copy_from_user(&req, arg, sizeof(req))) 440 return -EFAULT; 441 442 BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags); 443 444 dev = rfcomm_dev_get(req.dev_id); 445 if (!dev) 446 return -ENODEV; 447 448 if (dev->flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN)) { 449 tty_port_put(&dev->port); 450 return -EPERM; 451 } 452 453 /* only release once */ 454 if (test_and_set_bit(RFCOMM_DEV_RELEASED, &dev->status)) { 455 tty_port_put(&dev->port); 456 return -EALREADY; 457 } 458 459 if (req.flags & (1 << RFCOMM_HANGUP_NOW)) 460 rfcomm_dlc_close(dev->dlc, 0); 461 462 /* Shut down TTY synchronously before freeing rfcomm_dev */ 463 tty_port_tty_vhangup(&dev->port); 464 465 if (!test_and_set_bit(RFCOMM_TTY_OWNED, &dev->status)) 466 tty_port_put(&dev->port); 467 468 tty_port_put(&dev->port); 469 return 0; 470 } 471 472 static int rfcomm_create_dev(struct sock *sk, void __user *arg) 473 { 474 int ret; 475 476 mutex_lock(&rfcomm_ioctl_mutex); 477 ret = __rfcomm_create_dev(sk, arg); 478 mutex_unlock(&rfcomm_ioctl_mutex); 479 480 return ret; 481 } 482 483 static int rfcomm_release_dev(void __user *arg) 484 { 485 int ret; 486 487 mutex_lock(&rfcomm_ioctl_mutex); 488 ret = __rfcomm_release_dev(arg); 489 mutex_unlock(&rfcomm_ioctl_mutex); 490 491 return ret; 492 } 493 494 static int rfcomm_get_dev_list(void __user *arg) 495 { 496 struct rfcomm_dev *dev; 497 struct rfcomm_dev_list_req *dl; 498 struct rfcomm_dev_info *di; 499 int n = 0, err; 500 u16 dev_num; 501 502 BT_DBG(""); 503 504 if (get_user(dev_num, (u16 __user *) arg)) 505 return -EFAULT; 506 507 if (!dev_num || dev_num > (PAGE_SIZE * 4) / sizeof(*di)) 508 return -EINVAL; 509 510 dl = kzalloc_flex(*dl, dev_info, dev_num); 511 if (!dl) 512 return -ENOMEM; 513 514 dl->dev_num = dev_num; 515 di = dl->dev_info; 516 517 mutex_lock(&rfcomm_dev_lock); 518 519 list_for_each_entry(dev, &rfcomm_dev_list, list) { 520 if (!tty_port_get(&dev->port)) 521 continue; 522 di[n].id = dev->id; 523 di[n].flags = dev->flags; 524 di[n].state = dev->dlc->state; 525 di[n].channel = dev->channel; 526 bacpy(&di[n].src, &dev->src); 527 bacpy(&di[n].dst, &dev->dst); 528 tty_port_put(&dev->port); 529 if (++n >= dev_num) 530 break; 531 } 532 533 mutex_unlock(&rfcomm_dev_lock); 534 535 dl->dev_num = n; 536 err = copy_to_user(arg, dl, struct_size(dl, dev_info, n)); 537 kfree(dl); 538 539 return err ? -EFAULT : 0; 540 } 541 542 static int rfcomm_get_dev_info(void __user *arg) 543 { 544 struct rfcomm_dev *dev; 545 struct rfcomm_dev_info di; 546 int err = 0; 547 548 BT_DBG(""); 549 550 if (copy_from_user(&di, arg, sizeof(di))) 551 return -EFAULT; 552 553 dev = rfcomm_dev_get(di.id); 554 if (!dev) 555 return -ENODEV; 556 557 di.flags = dev->flags; 558 di.channel = dev->channel; 559 di.state = dev->dlc->state; 560 bacpy(&di.src, &dev->src); 561 bacpy(&di.dst, &dev->dst); 562 563 if (copy_to_user(arg, &di, sizeof(di))) 564 err = -EFAULT; 565 566 tty_port_put(&dev->port); 567 return err; 568 } 569 570 int rfcomm_dev_ioctl(struct sock *sk, unsigned int cmd, void __user *arg) 571 { 572 BT_DBG("cmd %d arg %p", cmd, arg); 573 574 switch (cmd) { 575 case RFCOMMCREATEDEV: 576 return rfcomm_create_dev(sk, arg); 577 578 case RFCOMMRELEASEDEV: 579 return rfcomm_release_dev(arg); 580 581 case RFCOMMGETDEVLIST: 582 return rfcomm_get_dev_list(arg); 583 584 case RFCOMMGETDEVINFO: 585 return rfcomm_get_dev_info(arg); 586 } 587 588 return -EINVAL; 589 } 590 591 /* ---- DLC callbacks ---- */ 592 static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb) 593 { 594 struct rfcomm_dev *dev = dlc->owner; 595 596 if (!dev) { 597 kfree_skb(skb); 598 return; 599 } 600 601 if (!skb_queue_empty(&dev->pending)) { 602 skb_queue_tail(&dev->pending, skb); 603 return; 604 } 605 606 BT_DBG("dlc %p len %d", dlc, skb->len); 607 608 tty_insert_flip_string(&dev->port, skb->data, skb->len); 609 tty_flip_buffer_push(&dev->port); 610 611 kfree_skb(skb); 612 } 613 614 static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err) 615 { 616 struct rfcomm_dev *dev = dlc->owner; 617 if (!dev) 618 return; 619 620 BT_DBG("dlc %p dev %p err %d", dlc, dev, err); 621 622 dev->err = err; 623 if (dlc->state == BT_CONNECTED) { 624 rfcomm_reparent_device(dev); 625 626 wake_up_interruptible(&dev->port.open_wait); 627 } else if (dlc->state == BT_CLOSED) 628 tty_port_tty_hangup(&dev->port, false); 629 } 630 631 static void rfcomm_dev_modem_status(struct rfcomm_dlc *dlc, u8 v24_sig) 632 { 633 struct rfcomm_dev *dev = dlc->owner; 634 if (!dev) 635 return; 636 637 BT_DBG("dlc %p dev %p v24_sig 0x%02x", dlc, dev, v24_sig); 638 639 if ((dev->modem_status & TIOCM_CD) && !(v24_sig & RFCOMM_V24_DV)) 640 tty_port_tty_hangup(&dev->port, true); 641 642 dev->modem_status = 643 ((v24_sig & RFCOMM_V24_RTC) ? TIOCM_DSR : 0) | 644 ((v24_sig & RFCOMM_V24_RTR) ? TIOCM_CTS : 0) | 645 ((v24_sig & RFCOMM_V24_IC) ? TIOCM_RI : 0) | 646 ((v24_sig & RFCOMM_V24_DV) ? TIOCM_CD : 0); 647 } 648 649 /* ---- TTY functions ---- */ 650 static void rfcomm_tty_copy_pending(struct rfcomm_dev *dev) 651 { 652 struct sk_buff *skb; 653 int inserted = 0; 654 655 BT_DBG("dev %p", dev); 656 657 rfcomm_dlc_lock(dev->dlc); 658 659 while ((skb = skb_dequeue(&dev->pending))) { 660 inserted += tty_insert_flip_string(&dev->port, skb->data, 661 skb->len); 662 kfree_skb(skb); 663 } 664 665 rfcomm_dlc_unlock(dev->dlc); 666 667 if (inserted > 0) 668 tty_flip_buffer_push(&dev->port); 669 } 670 671 /* do the reverse of install, clearing the tty fields and releasing the 672 * reference to tty_port 673 */ 674 static void rfcomm_tty_cleanup(struct tty_struct *tty) 675 { 676 struct rfcomm_dev *dev = tty->driver_data; 677 678 clear_bit(RFCOMM_TTY_ATTACHED, &dev->flags); 679 680 rfcomm_dlc_lock(dev->dlc); 681 tty->driver_data = NULL; 682 rfcomm_dlc_unlock(dev->dlc); 683 684 /* 685 * purge the dlc->tx_queue to avoid circular dependencies 686 * between dev and dlc 687 */ 688 skb_queue_purge(&dev->dlc->tx_queue); 689 690 tty_port_put(&dev->port); 691 } 692 693 /* we acquire the tty_port reference since it's here the tty is first used 694 * by setting the termios. We also populate the driver_data field and install 695 * the tty port 696 */ 697 static int rfcomm_tty_install(struct tty_driver *driver, struct tty_struct *tty) 698 { 699 struct rfcomm_dev *dev; 700 struct rfcomm_dlc *dlc; 701 int err; 702 703 dev = rfcomm_dev_get(tty->index); 704 if (!dev) 705 return -ENODEV; 706 707 dlc = dev->dlc; 708 709 /* Attach TTY and open DLC */ 710 rfcomm_dlc_lock(dlc); 711 tty->driver_data = dev; 712 rfcomm_dlc_unlock(dlc); 713 set_bit(RFCOMM_TTY_ATTACHED, &dev->flags); 714 715 /* install the tty_port */ 716 err = tty_port_install(&dev->port, driver, tty); 717 if (err) { 718 rfcomm_tty_cleanup(tty); 719 return err; 720 } 721 722 /* take over the tty_port reference if the port was created with the 723 * flag RFCOMM_RELEASE_ONHUP. This will force the release of the port 724 * when the last process closes the tty. The behaviour is expected by 725 * userspace. 726 */ 727 if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags) && 728 !test_and_set_bit(RFCOMM_TTY_OWNED, &dev->status)) 729 tty_port_put(&dev->port); 730 731 return 0; 732 } 733 734 static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp) 735 { 736 struct rfcomm_dev *dev = tty->driver_data; 737 int err; 738 739 BT_DBG("tty %p id %d", tty, tty->index); 740 741 BT_DBG("dev %p dst %pMR channel %d opened %d", dev, &dev->dst, 742 dev->channel, dev->port.count); 743 744 err = tty_port_open(&dev->port, tty, filp); 745 if (err) 746 return err; 747 748 /* 749 * FIXME: rfcomm should use proper flow control for 750 * received data. This hack will be unnecessary and can 751 * be removed when that's implemented 752 */ 753 rfcomm_tty_copy_pending(dev); 754 755 rfcomm_dlc_unthrottle(dev->dlc); 756 757 return 0; 758 } 759 760 static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp) 761 { 762 struct rfcomm_dev *dev = tty->driver_data; 763 764 BT_DBG("tty %p dev %p dlc %p opened %d", tty, dev, dev->dlc, 765 dev->port.count); 766 767 tty_port_close(&dev->port, tty, filp); 768 } 769 770 static ssize_t rfcomm_tty_write(struct tty_struct *tty, const u8 *buf, 771 size_t count) 772 { 773 struct rfcomm_dev *dev = tty->driver_data; 774 struct rfcomm_dlc *dlc = dev->dlc; 775 struct sk_buff *skb; 776 size_t sent = 0, size; 777 778 BT_DBG("tty %p count %zu", tty, count); 779 780 while (count) { 781 size = min_t(size_t, count, dlc->mtu); 782 783 skb = rfcomm_wmalloc(dev, size + RFCOMM_SKB_RESERVE, GFP_ATOMIC); 784 if (!skb) 785 break; 786 787 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE); 788 789 skb_put_data(skb, buf + sent, size); 790 791 rfcomm_dlc_send_noerror(dlc, skb); 792 793 sent += size; 794 count -= size; 795 } 796 797 return sent; 798 } 799 800 static unsigned int rfcomm_tty_write_room(struct tty_struct *tty) 801 { 802 struct rfcomm_dev *dev = tty->driver_data; 803 int room = 0; 804 805 if (dev && dev->dlc) 806 room = rfcomm_room(dev); 807 808 BT_DBG("tty %p room %d", tty, room); 809 810 return room; 811 } 812 813 static int rfcomm_tty_ioctl(struct tty_struct *tty, unsigned int cmd, unsigned long arg) 814 { 815 BT_DBG("tty %p cmd 0x%02x", tty, cmd); 816 817 switch (cmd) { 818 case TCGETS: 819 BT_DBG("TCGETS is not supported"); 820 return -ENOIOCTLCMD; 821 822 case TCSETS: 823 BT_DBG("TCSETS is not supported"); 824 return -ENOIOCTLCMD; 825 826 case TIOCMIWAIT: 827 BT_DBG("TIOCMIWAIT"); 828 break; 829 830 case TIOCSERGETLSR: 831 BT_ERR("TIOCSERGETLSR is not supported"); 832 return -ENOIOCTLCMD; 833 834 case TIOCSERCONFIG: 835 BT_ERR("TIOCSERCONFIG is not supported"); 836 return -ENOIOCTLCMD; 837 838 default: 839 return -ENOIOCTLCMD; /* ioctls which we must ignore */ 840 841 } 842 843 return -ENOIOCTLCMD; 844 } 845 846 static void rfcomm_tty_set_termios(struct tty_struct *tty, 847 const struct ktermios *old) 848 { 849 struct ktermios *new = &tty->termios; 850 int old_baud_rate = tty_termios_baud_rate(old); 851 int new_baud_rate = tty_termios_baud_rate(new); 852 853 u8 baud, data_bits, stop_bits, parity, x_on, x_off; 854 u16 changes = 0; 855 856 struct rfcomm_dev *dev = tty->driver_data; 857 858 BT_DBG("tty %p termios %p", tty, old); 859 860 if (!dev || !dev->dlc) 861 return; 862 863 /* Handle turning off CRTSCTS */ 864 if ((old->c_cflag & CRTSCTS) && !(new->c_cflag & CRTSCTS)) 865 BT_DBG("Turning off CRTSCTS unsupported"); 866 867 /* Parity on/off and when on, odd/even */ 868 if (((old->c_cflag & PARENB) != (new->c_cflag & PARENB)) || 869 ((old->c_cflag & PARODD) != (new->c_cflag & PARODD))) { 870 changes |= RFCOMM_RPN_PM_PARITY; 871 BT_DBG("Parity change detected."); 872 } 873 874 /* Mark and space parity are not supported! */ 875 if (new->c_cflag & PARENB) { 876 if (new->c_cflag & PARODD) { 877 BT_DBG("Parity is ODD"); 878 parity = RFCOMM_RPN_PARITY_ODD; 879 } else { 880 BT_DBG("Parity is EVEN"); 881 parity = RFCOMM_RPN_PARITY_EVEN; 882 } 883 } else { 884 BT_DBG("Parity is OFF"); 885 parity = RFCOMM_RPN_PARITY_NONE; 886 } 887 888 /* Setting the x_on / x_off characters */ 889 if (old->c_cc[VSTOP] != new->c_cc[VSTOP]) { 890 BT_DBG("XOFF custom"); 891 x_on = new->c_cc[VSTOP]; 892 changes |= RFCOMM_RPN_PM_XON; 893 } else { 894 BT_DBG("XOFF default"); 895 x_on = RFCOMM_RPN_XON_CHAR; 896 } 897 898 if (old->c_cc[VSTART] != new->c_cc[VSTART]) { 899 BT_DBG("XON custom"); 900 x_off = new->c_cc[VSTART]; 901 changes |= RFCOMM_RPN_PM_XOFF; 902 } else { 903 BT_DBG("XON default"); 904 x_off = RFCOMM_RPN_XOFF_CHAR; 905 } 906 907 /* Handle setting of stop bits */ 908 if ((old->c_cflag & CSTOPB) != (new->c_cflag & CSTOPB)) 909 changes |= RFCOMM_RPN_PM_STOP; 910 911 /* POSIX does not support 1.5 stop bits and RFCOMM does not 912 * support 2 stop bits. So a request for 2 stop bits gets 913 * translated to 1.5 stop bits */ 914 if (new->c_cflag & CSTOPB) 915 stop_bits = RFCOMM_RPN_STOP_15; 916 else 917 stop_bits = RFCOMM_RPN_STOP_1; 918 919 /* Handle number of data bits [5-8] */ 920 if ((old->c_cflag & CSIZE) != (new->c_cflag & CSIZE)) 921 changes |= RFCOMM_RPN_PM_DATA; 922 923 switch (new->c_cflag & CSIZE) { 924 case CS5: 925 data_bits = RFCOMM_RPN_DATA_5; 926 break; 927 case CS6: 928 data_bits = RFCOMM_RPN_DATA_6; 929 break; 930 case CS7: 931 data_bits = RFCOMM_RPN_DATA_7; 932 break; 933 case CS8: 934 data_bits = RFCOMM_RPN_DATA_8; 935 break; 936 default: 937 data_bits = RFCOMM_RPN_DATA_8; 938 break; 939 } 940 941 /* Handle baudrate settings */ 942 if (old_baud_rate != new_baud_rate) 943 changes |= RFCOMM_RPN_PM_BITRATE; 944 945 switch (new_baud_rate) { 946 case 2400: 947 baud = RFCOMM_RPN_BR_2400; 948 break; 949 case 4800: 950 baud = RFCOMM_RPN_BR_4800; 951 break; 952 case 7200: 953 baud = RFCOMM_RPN_BR_7200; 954 break; 955 case 9600: 956 baud = RFCOMM_RPN_BR_9600; 957 break; 958 case 19200: 959 baud = RFCOMM_RPN_BR_19200; 960 break; 961 case 38400: 962 baud = RFCOMM_RPN_BR_38400; 963 break; 964 case 57600: 965 baud = RFCOMM_RPN_BR_57600; 966 break; 967 case 115200: 968 baud = RFCOMM_RPN_BR_115200; 969 break; 970 case 230400: 971 baud = RFCOMM_RPN_BR_230400; 972 break; 973 default: 974 /* 9600 is standard according to the RFCOMM specification */ 975 baud = RFCOMM_RPN_BR_9600; 976 break; 977 978 } 979 980 if (changes) 981 rfcomm_dlc_send_rpn(dev->dlc, baud, data_bits, stop_bits, parity, 982 RFCOMM_RPN_FLOW_NONE, x_on, x_off, changes); 983 } 984 985 static void rfcomm_tty_throttle(struct tty_struct *tty) 986 { 987 struct rfcomm_dev *dev = tty->driver_data; 988 989 BT_DBG("tty %p dev %p", tty, dev); 990 991 rfcomm_dlc_throttle(dev->dlc); 992 } 993 994 static void rfcomm_tty_unthrottle(struct tty_struct *tty) 995 { 996 struct rfcomm_dev *dev = tty->driver_data; 997 998 BT_DBG("tty %p dev %p", tty, dev); 999 1000 rfcomm_dlc_unthrottle(dev->dlc); 1001 } 1002 1003 static unsigned int rfcomm_tty_chars_in_buffer(struct tty_struct *tty) 1004 { 1005 struct rfcomm_dev *dev = tty->driver_data; 1006 1007 BT_DBG("tty %p dev %p", tty, dev); 1008 1009 if (!dev || !dev->dlc) 1010 return 0; 1011 1012 if (!skb_queue_empty(&dev->dlc->tx_queue)) 1013 return dev->dlc->mtu; 1014 1015 return 0; 1016 } 1017 1018 static void rfcomm_tty_flush_buffer(struct tty_struct *tty) 1019 { 1020 struct rfcomm_dev *dev = tty->driver_data; 1021 1022 BT_DBG("tty %p dev %p", tty, dev); 1023 1024 if (!dev || !dev->dlc) 1025 return; 1026 1027 skb_queue_purge(&dev->dlc->tx_queue); 1028 tty_wakeup(tty); 1029 } 1030 1031 static void rfcomm_tty_send_xchar(struct tty_struct *tty, u8 ch) 1032 { 1033 BT_DBG("tty %p ch %c", tty, ch); 1034 } 1035 1036 static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout) 1037 { 1038 BT_DBG("tty %p timeout %d", tty, timeout); 1039 } 1040 1041 static void rfcomm_tty_hangup(struct tty_struct *tty) 1042 { 1043 struct rfcomm_dev *dev = tty->driver_data; 1044 1045 BT_DBG("tty %p dev %p", tty, dev); 1046 1047 tty_port_hangup(&dev->port); 1048 } 1049 1050 static int rfcomm_tty_tiocmget(struct tty_struct *tty) 1051 { 1052 struct rfcomm_dev *dev = tty->driver_data; 1053 struct rfcomm_dlc *dlc = dev->dlc; 1054 u8 v24_sig; 1055 1056 BT_DBG("tty %p dev %p", tty, dev); 1057 1058 rfcomm_dlc_get_modem_status(dlc, &v24_sig); 1059 1060 return (v24_sig & (TIOCM_DTR | TIOCM_RTS)) | dev->modem_status; 1061 } 1062 1063 static int rfcomm_tty_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear) 1064 { 1065 struct rfcomm_dev *dev = tty->driver_data; 1066 struct rfcomm_dlc *dlc = dev->dlc; 1067 u8 v24_sig; 1068 1069 BT_DBG("tty %p dev %p set 0x%02x clear 0x%02x", tty, dev, set, clear); 1070 1071 rfcomm_dlc_get_modem_status(dlc, &v24_sig); 1072 1073 if (set & TIOCM_DTR) 1074 v24_sig |= RFCOMM_V24_RTC; 1075 if (set & TIOCM_RTS) 1076 v24_sig |= RFCOMM_V24_RTR; 1077 1078 if (clear & TIOCM_DTR) 1079 v24_sig &= ~RFCOMM_V24_RTC; 1080 if (clear & TIOCM_RTS) 1081 v24_sig &= ~RFCOMM_V24_RTR; 1082 1083 rfcomm_dlc_set_modem_status(dlc, v24_sig); 1084 1085 return 0; 1086 } 1087 1088 /* ---- TTY structure ---- */ 1089 1090 static const struct tty_operations rfcomm_ops = { 1091 .open = rfcomm_tty_open, 1092 .close = rfcomm_tty_close, 1093 .write = rfcomm_tty_write, 1094 .write_room = rfcomm_tty_write_room, 1095 .chars_in_buffer = rfcomm_tty_chars_in_buffer, 1096 .flush_buffer = rfcomm_tty_flush_buffer, 1097 .ioctl = rfcomm_tty_ioctl, 1098 .throttle = rfcomm_tty_throttle, 1099 .unthrottle = rfcomm_tty_unthrottle, 1100 .set_termios = rfcomm_tty_set_termios, 1101 .send_xchar = rfcomm_tty_send_xchar, 1102 .hangup = rfcomm_tty_hangup, 1103 .wait_until_sent = rfcomm_tty_wait_until_sent, 1104 .tiocmget = rfcomm_tty_tiocmget, 1105 .tiocmset = rfcomm_tty_tiocmset, 1106 .install = rfcomm_tty_install, 1107 .cleanup = rfcomm_tty_cleanup, 1108 }; 1109 1110 int __init rfcomm_init_ttys(void) 1111 { 1112 int error; 1113 1114 rfcomm_tty_driver = tty_alloc_driver(RFCOMM_TTY_PORTS, 1115 TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV); 1116 if (IS_ERR(rfcomm_tty_driver)) 1117 return PTR_ERR(rfcomm_tty_driver); 1118 1119 rfcomm_tty_driver->driver_name = "rfcomm"; 1120 rfcomm_tty_driver->name = "rfcomm"; 1121 rfcomm_tty_driver->major = RFCOMM_TTY_MAJOR; 1122 rfcomm_tty_driver->minor_start = RFCOMM_TTY_MINOR; 1123 rfcomm_tty_driver->type = TTY_DRIVER_TYPE_SERIAL; 1124 rfcomm_tty_driver->subtype = SERIAL_TYPE_NORMAL; 1125 rfcomm_tty_driver->init_termios = tty_std_termios; 1126 rfcomm_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL; 1127 rfcomm_tty_driver->init_termios.c_lflag &= ~ICANON; 1128 tty_set_operations(rfcomm_tty_driver, &rfcomm_ops); 1129 1130 error = tty_register_driver(rfcomm_tty_driver); 1131 if (error) { 1132 BT_ERR("Can't register RFCOMM TTY driver"); 1133 tty_driver_kref_put(rfcomm_tty_driver); 1134 return error; 1135 } 1136 1137 BT_INFO("RFCOMM TTY layer initialized"); 1138 1139 return 0; 1140 } 1141 1142 void rfcomm_cleanup_ttys(void) 1143 { 1144 tty_unregister_driver(rfcomm_tty_driver); 1145 tty_driver_kref_put(rfcomm_tty_driver); 1146 } 1147