projects/linux·blob master · refs

1528 lines · 39.7 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 HIDP implementation for Linux Bluetooth stack (BlueZ).
4 Copyright (C) 2003-2004 Marcel Holtmann <[email protected]>
5 Copyright (C) 2013 David Herrmann <[email protected]>
6
7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15
16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
18 SOFTWARE IS DISCLAIMED.
19*/
20
21#include <linux/kref.h>
22#include <linux/module.h>
23#include <linux/file.h>
24#include <linux/kthread.h>
25#include <linux/hidraw.h>
26
27#include <net/bluetooth/bluetooth.h>
28#include <net/bluetooth/hci_core.h>
29#include <net/bluetooth/l2cap.h>
30
31#include "hidp.h"
32
33#define VERSION "1.2"
34
35static DECLARE_RWSEM(hidp_session_sem);
36static DECLARE_WAIT_QUEUE_HEAD(hidp_session_wq);
37static LIST_HEAD(hidp_session_list);
38
39static unsigned char hidp_keycode[256] = {
40 0, 0, 0, 0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36,
41 37, 38, 50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45,
42 21, 44, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 28, 1,
43 14, 15, 57, 12, 13, 26, 27, 43, 43, 39, 40, 41, 51, 52,
44 53, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 87, 88,
45 99, 70, 119, 110, 102, 104, 111, 107, 109, 106, 105, 108, 103, 69,
46 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71, 72, 73,
47 82, 83, 86, 127, 116, 117, 183, 184, 185, 186, 187, 188, 189, 190,
48 191, 192, 193, 194, 134, 138, 130, 132, 128, 129, 131, 137, 133, 135,
49 136, 113, 115, 114, 0, 0, 0, 121, 0, 89, 93, 124, 92, 94,
50 95, 0, 0, 0, 122, 123, 90, 91, 85, 0, 0, 0, 0, 0,
51 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
52 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
53 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
54 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
55 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
56 29, 42, 56, 125, 97, 54, 100, 126, 164, 166, 165, 163, 161, 115,
57 114, 113, 150, 158, 159, 128, 136, 177, 178, 176, 142, 152, 173, 140
58};
59
60static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
61
62static int hidp_session_probe(struct l2cap_conn *conn,
63 struct l2cap_user *user);
64static void hidp_session_remove(struct l2cap_conn *conn,
65 struct l2cap_user *user);
66static int hidp_session_thread(void *arg);
67static void hidp_session_terminate(struct hidp_session *s);
68
69static void hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
70{
71 u32 valid_flags = 0;
72 memset(ci, 0, sizeof(*ci));
73 bacpy(&ci->bdaddr, &session->bdaddr);
74
75 ci->flags = session->flags & valid_flags;
76 ci->state = BT_CONNECTED;
77
78 if (session->input) {
79 ci->vendor = session->input->id.vendor;
80 ci->product = session->input->id.product;
81 ci->version = session->input->id.version;
82 if (session->input->name)
83 strscpy(ci->name, session->input->name, 128);
84 else
85 strscpy(ci->name, "HID Boot Device", 128);
86 } else if (session->hid) {
87 ci->vendor = session->hid->vendor;
88 ci->product = session->hid->product;
89 ci->version = session->hid->version;
90 strscpy(ci->name, session->hid->name, 128);
91 }
92}
93
94/* assemble skb, queue message on @transmit and wake up the session thread */
95static int hidp_send_message(struct hidp_session *session, struct socket *sock,
96 struct sk_buff_head *transmit, unsigned char hdr,
97 const unsigned char *data, int size)
98{
99 struct sk_buff *skb;
100 struct sock *sk = sock->sk;
101 int ret;
102
103 BT_DBG("session %p data %p size %d", session, data, size);
104
105 if (atomic_read(&session->terminate))
106 return -EIO;
107
108 skb = alloc_skb(size + 1, GFP_ATOMIC);
109 if (!skb) {
110 BT_ERR("Can't allocate memory for new frame");
111 return -ENOMEM;
112 }
113
114 skb_put_u8(skb, hdr);
115 if (data && size > 0) {
116 skb_put_data(skb, data, size);
117 ret = size;
118 } else {
119 ret = 0;
120 }
121
122 skb_queue_tail(transmit, skb);
123 wake_up_interruptible(sk_sleep(sk));
124
125 return ret;
126}
127
128static int hidp_send_ctrl_message(struct hidp_session *session,
129 unsigned char hdr, const unsigned char *data,
130 int size)
131{
132 return hidp_send_message(session, session->ctrl_sock,
133 &session->ctrl_transmit, hdr, data, size);
134}
135
136static int hidp_send_intr_message(struct hidp_session *session,
137 unsigned char hdr, const unsigned char *data,
138 int size)
139{
140 return hidp_send_message(session, session->intr_sock,
141 &session->intr_transmit, hdr, data, size);
142}
143
144static int hidp_input_event(struct input_dev *dev, unsigned int type,
145 unsigned int code, int value)
146{
147 struct hidp_session *session = input_get_drvdata(dev);
148 unsigned char newleds;
149 unsigned char hdr, data[2];
150
151 BT_DBG("session %p type %d code %d value %d",
152 session, type, code, value);
153
154 if (type != EV_LED)
155 return -1;
156
157 newleds = (!!test_bit(LED_KANA, dev->led) << 3) |
158 (!!test_bit(LED_COMPOSE, dev->led) << 3) |
159 (!!test_bit(LED_SCROLLL, dev->led) << 2) |
160 (!!test_bit(LED_CAPSL, dev->led) << 1) |
161 (!!test_bit(LED_NUML, dev->led) << 0);
162
163 if (session->leds == newleds)
164 return 0;
165
166 session->leds = newleds;
167
168 hdr = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
169 data[0] = 0x01;
170 data[1] = newleds;
171
172 return hidp_send_intr_message(session, hdr, data, 2);
173}
174
175static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
176{
177 struct input_dev *dev = session->input;
178 unsigned char *keys = session->keys;
179 unsigned char *udata;
180 signed char *sdata;
181 u8 *hdr;
182 int i;
183
184 hdr = skb_pull_data(skb, 1);
185 if (!hdr)
186 return;
187
188 switch (*hdr) {
189 case 0x01: /* Keyboard report */
190 udata = skb_pull_data(skb, 8);
191 if (!udata)
192 break;
193
194 for (i = 0; i < 8; i++)
195 input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
196
197 /* If all the key codes have been set to 0x01, it means
198 * too many keys were pressed at the same time. */
199 if (!memcmp(udata + 2, hidp_mkeyspat, 6))
200 break;
201
202 for (i = 2; i < 8; i++) {
203 if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) {
204 if (hidp_keycode[keys[i]])
205 input_report_key(dev, hidp_keycode[keys[i]], 0);
206 else
207 BT_ERR("Unknown key (scancode %#x) released.", keys[i]);
208 }
209
210 if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) {
211 if (hidp_keycode[udata[i]])
212 input_report_key(dev, hidp_keycode[udata[i]], 1);
213 else
214 BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]);
215 }
216 }
217
218 memcpy(keys, udata, 8);
219 break;
220
221 case 0x02: /* Mouse report */
222 sdata = skb_pull_data(skb, 3);
223 if (!sdata)
224 break;
225
226 input_report_key(dev, BTN_LEFT, sdata[0] & 0x01);
227 input_report_key(dev, BTN_RIGHT, sdata[0] & 0x02);
228 input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
229 input_report_key(dev, BTN_SIDE, sdata[0] & 0x08);
230 input_report_key(dev, BTN_EXTRA, sdata[0] & 0x10);
231
232 input_report_rel(dev, REL_X, sdata[1]);
233 input_report_rel(dev, REL_Y, sdata[2]);
234
235 if (skb->len > 0)
236 input_report_rel(dev, REL_WHEEL, sdata[3]);
237 break;
238 }
239
240 input_sync(dev);
241}
242
243static int hidp_get_raw_report(struct hid_device *hid,
244 unsigned char report_number,
245 unsigned char *data, size_t count,
246 unsigned char report_type)
247{
248 struct hidp_session *session = hid->driver_data;
249 struct sk_buff *skb;
250 size_t len;
251 int numbered_reports = hid->report_enum[report_type].numbered;
252 int ret;
253
254 if (atomic_read(&session->terminate))
255 return -EIO;
256
257 switch (report_type) {
258 case HID_FEATURE_REPORT:
259 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_FEATURE;
260 break;
261 case HID_INPUT_REPORT:
262 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_INPUT;
263 break;
264 case HID_OUTPUT_REPORT:
265 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_OUPUT;
266 break;
267 default:
268 return -EINVAL;
269 }
270
271 if (mutex_lock_interruptible(&session->report_mutex))
272 return -ERESTARTSYS;
273
274 /* Set up our wait, and send the report request to the device. */
275 session->waiting_report_type = report_type & HIDP_DATA_RTYPE_MASK;
276 session->waiting_report_number = numbered_reports ? report_number : -1;
277 set_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
278 data[0] = report_number;
279 ret = hidp_send_ctrl_message(session, report_type, data, 1);
280 if (ret < 0)
281 goto err;
282
283 /* Wait for the return of the report. The returned report
284 gets put in session->report_return. */
285 while (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) &&
286 !atomic_read(&session->terminate)) {
287 int res;
288
289 res = wait_event_interruptible_timeout(session->report_queue,
290 !test_bit(HIDP_WAITING_FOR_RETURN, &session->flags)
291 || atomic_read(&session->terminate),
292 5*HZ);
293 if (res == 0) {
294 /* timeout */
295 ret = -EIO;
296 goto err;
297 }
298 if (res < 0) {
299 /* signal */
300 ret = -ERESTARTSYS;
301 goto err;
302 }
303 }
304
305 skb = session->report_return;
306 if (skb) {
307 len = skb->len < count ? skb->len : count;
308 memcpy(data, skb->data, len);
309
310 kfree_skb(skb);
311 session->report_return = NULL;
312 } else {
313 /* Device returned a HANDSHAKE, indicating protocol error. */
314 len = -EIO;
315 }
316
317 clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
318 mutex_unlock(&session->report_mutex);
319
320 return len;
321
322err:
323 clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
324 mutex_unlock(&session->report_mutex);
325 return ret;
326}
327
328static int hidp_set_raw_report(struct hid_device *hid, unsigned char reportnum,
329 unsigned char *data, size_t count,
330 unsigned char report_type)
331{
332 struct hidp_session *session = hid->driver_data;
333 int ret;
334
335 switch (report_type) {
336 case HID_FEATURE_REPORT:
337 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
338 break;
339 case HID_INPUT_REPORT:
340 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_INPUT;
341 break;
342 case HID_OUTPUT_REPORT:
343 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_OUPUT;
344 break;
345 default:
346 return -EINVAL;
347 }
348
349 if (mutex_lock_interruptible(&session->report_mutex))
350 return -ERESTARTSYS;
351
352 /* Set up our wait, and send the report request to the device. */
353 data[0] = reportnum;
354 set_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
355 ret = hidp_send_ctrl_message(session, report_type, data, count);
356 if (ret < 0)
357 goto err;
358
359 /* Wait for the ACK from the device. */
360 while (test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags) &&
361 !atomic_read(&session->terminate)) {
362 int res;
363
364 res = wait_event_interruptible_timeout(session->report_queue,
365 !test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags)
366 || atomic_read(&session->terminate),
367 10*HZ);
368 if (res == 0) {
369 /* timeout */
370 ret = -EIO;
371 goto err;
372 }
373 if (res < 0) {
374 /* signal */
375 ret = -ERESTARTSYS;
376 goto err;
377 }
378 }
379
380 if (!session->output_report_success) {
381 ret = -EIO;
382 goto err;
383 }
384
385 ret = count;
386
387err:
388 clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
389 mutex_unlock(&session->report_mutex);
390 return ret;
391}
392
393static int hidp_output_report(struct hid_device *hid, __u8 *data, size_t count)
394{
395 struct hidp_session *session = hid->driver_data;
396
397 return hidp_send_intr_message(session,
398 HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT,
399 data, count);
400}
401
402static int hidp_raw_request(struct hid_device *hid, unsigned char reportnum,
403 __u8 *buf, size_t len, unsigned char rtype,
404 int reqtype)
405{
406 switch (reqtype) {
407 case HID_REQ_GET_REPORT:
408 return hidp_get_raw_report(hid, reportnum, buf, len, rtype);
409 case HID_REQ_SET_REPORT:
410 return hidp_set_raw_report(hid, reportnum, buf, len, rtype);
411 default:
412 return -EIO;
413 }
414}
415
416static void hidp_idle_timeout(struct timer_list *t)
417{
418 struct hidp_session *session = timer_container_of(session, t, timer);
419
420 /* The HIDP user-space API only contains calls to add and remove
421 * devices. There is no way to forward events of any kind. Therefore,
422 * we have to forcefully disconnect a device on idle-timeouts. This is
423 * unfortunate and weird API design, but it is spec-compliant and
424 * required for backwards-compatibility. Hence, on idle-timeout, we
425 * signal driver-detach events, so poll() will be woken up with an
426 * error-condition on both sockets.
427 */
428
429 session->intr_sock->sk->sk_err = EUNATCH;
430 session->ctrl_sock->sk->sk_err = EUNATCH;
431 wake_up_interruptible(sk_sleep(session->intr_sock->sk));
432 wake_up_interruptible(sk_sleep(session->ctrl_sock->sk));
433
434 hidp_session_terminate(session);
435}
436
437static void hidp_set_timer(struct hidp_session *session)
438{
439 if (session->idle_to > 0)
440 mod_timer(&session->timer, jiffies + HZ * session->idle_to);
441}
442
443static void hidp_del_timer(struct hidp_session *session)
444{
445 if (session->idle_to > 0)
446 timer_delete_sync(&session->timer);
447}
448
449static void hidp_process_report(struct hidp_session *session, int type,
450 const u8 *data, unsigned int len, int intr)
451{
452 if (len > HID_MAX_BUFFER_SIZE)
453 len = HID_MAX_BUFFER_SIZE;
454
455 memcpy(session->input_buf, data, len);
456 hid_input_report(session->hid, type, session->input_buf, len, intr);
457}
458
459static void hidp_process_handshake(struct hidp_session *session,
460 unsigned char param)
461{
462 BT_DBG("session %p param 0x%02x", session, param);
463 session->output_report_success = 0; /* default condition */
464
465 switch (param) {
466 case HIDP_HSHK_SUCCESSFUL:
467 /* FIXME: Call into SET_ GET_ handlers here */
468 session->output_report_success = 1;
469 break;
470
471 case HIDP_HSHK_NOT_READY:
472 case HIDP_HSHK_ERR_INVALID_REPORT_ID:
473 case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
474 case HIDP_HSHK_ERR_INVALID_PARAMETER:
475 if (test_and_clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags))
476 wake_up_interruptible(&session->report_queue);
477
478 /* FIXME: Call into SET_ GET_ handlers here */
479 break;
480
481 case HIDP_HSHK_ERR_UNKNOWN:
482 break;
483
484 case HIDP_HSHK_ERR_FATAL:
485 /* Device requests a reboot, as this is the only way this error
486 * can be recovered. */
487 hidp_send_ctrl_message(session,
488 HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0);
489 break;
490
491 default:
492 hidp_send_ctrl_message(session,
493 HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
494 break;
495 }
496
497 /* Wake up the waiting thread. */
498 if (test_and_clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags))
499 wake_up_interruptible(&session->report_queue);
500}
501
502static void hidp_process_hid_control(struct hidp_session *session,
503 unsigned char param)
504{
505 BT_DBG("session %p param 0x%02x", session, param);
506
507 if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) {
508 /* Flush the transmit queues */
509 skb_queue_purge(&session->ctrl_transmit);
510 skb_queue_purge(&session->intr_transmit);
511
512 hidp_session_terminate(session);
513 }
514}
515
516/* Returns true if the passed-in skb should be freed by the caller. */
517static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
518 unsigned char param)
519{
520 int done_with_skb = 1;
521 BT_DBG("session %p skb %p len %u param 0x%02x", session, skb, skb->len, param);
522
523 switch (param) {
524 case HIDP_DATA_RTYPE_INPUT:
525 hidp_set_timer(session);
526
527 if (session->input)
528 hidp_input_report(session, skb);
529
530 if (session->hid)
531 hidp_process_report(session, HID_INPUT_REPORT,
532 skb->data, skb->len, 0);
533 break;
534
535 case HIDP_DATA_RTYPE_OTHER:
536 case HIDP_DATA_RTYPE_OUPUT:
537 case HIDP_DATA_RTYPE_FEATURE:
538 break;
539
540 default:
541 hidp_send_ctrl_message(session,
542 HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
543 }
544
545 if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) &&
546 param == session->waiting_report_type) {
547 if (session->waiting_report_number < 0 ||
548 (skb->len &&
549 session->waiting_report_number == skb->data[0])) {
550 /* hidp_get_raw_report() is waiting on this report. */
551 session->report_return = skb;
552 done_with_skb = 0;
553 clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
554 wake_up_interruptible(&session->report_queue);
555 }
556 }
557
558 return done_with_skb;
559}
560
561static void hidp_recv_ctrl_frame(struct hidp_session *session,
562 struct sk_buff *skb)
563{
564 unsigned char type, param;
565 u8 *hdr;
566 int free_skb = 1;
567
568 BT_DBG("session %p skb %p len %u", session, skb, skb->len);
569
570 hdr = skb_pull_data(skb, 1);
571 if (!hdr)
572 goto free;
573
574 type = *hdr & HIDP_HEADER_TRANS_MASK;
575 param = *hdr & HIDP_HEADER_PARAM_MASK;
576
577 switch (type) {
578 case HIDP_TRANS_HANDSHAKE:
579 hidp_process_handshake(session, param);
580 break;
581
582 case HIDP_TRANS_HID_CONTROL:
583 hidp_process_hid_control(session, param);
584 break;
585
586 case HIDP_TRANS_DATA:
587 free_skb = hidp_process_data(session, skb, param);
588 break;
589
590 default:
591 hidp_send_ctrl_message(session,
592 HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);
593 break;
594 }
595
596free:
597 if (free_skb)
598 kfree_skb(skb);
599}
600
601static void hidp_recv_intr_frame(struct hidp_session *session,
602 struct sk_buff *skb)
603{
604 u8 *hdr;
605
606 BT_DBG("session %p skb %p len %u", session, skb, skb->len);
607
608 hdr = skb_pull_data(skb, 1);
609 if (!hdr)
610 goto free;
611
612 if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
613 hidp_set_timer(session);
614
615 if (session->input)
616 hidp_input_report(session, skb);
617
618 if (session->hid) {
619 hidp_process_report(session, HID_INPUT_REPORT,
620 skb->data, skb->len, 1);
621 BT_DBG("report len %d", skb->len);
622 }
623 } else {
624 BT_DBG("Unsupported protocol header 0x%02x", *hdr);
625 }
626
627free:
628 kfree_skb(skb);
629}
630
631static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
632{
633 struct kvec iv = { data, len };
634 struct msghdr msg;
635
636 BT_DBG("sock %p data %p len %d", sock, data, len);
637
638 if (!len)
639 return 0;
640
641 memset(&msg, 0, sizeof(msg));
642
643 return kernel_sendmsg(sock, &msg, &iv, 1, len);
644}
645
646/* dequeue message from @transmit and send via @sock */
647static void hidp_process_transmit(struct hidp_session *session,
648 struct sk_buff_head *transmit,
649 struct socket *sock)
650{
651 struct sk_buff *skb;
652 int ret;
653
654 BT_DBG("session %p", session);
655
656 while ((skb = skb_dequeue(transmit))) {
657 ret = hidp_send_frame(sock, skb->data, skb->len);
658 if (ret == -EAGAIN) {
659 skb_queue_head(transmit, skb);
660 break;
661 } else if (ret < 0) {
662 hidp_session_terminate(session);
663 kfree_skb(skb);
664 break;
665 }
666
667 hidp_set_timer(session);
668 kfree_skb(skb);
669 }
670}
671
672static int hidp_setup_input(struct hidp_session *session,
673 const struct hidp_connadd_req *req)
674{
675 struct input_dev *input;
676 int i;
677
678 input = input_allocate_device();
679 if (!input)
680 return -ENOMEM;
681
682 session->input = input;
683
684 input_set_drvdata(input, session);
685
686 input->name = "Bluetooth HID Boot Protocol Device";
687
688 input->id.bustype = BUS_BLUETOOTH;
689 input->id.vendor = req->vendor;
690 input->id.product = req->product;
691 input->id.version = req->version;
692
693 if (req->subclass & 0x40) {
694 set_bit(EV_KEY, input->evbit);
695 set_bit(EV_LED, input->evbit);
696 set_bit(EV_REP, input->evbit);
697
698 set_bit(LED_NUML, input->ledbit);
699 set_bit(LED_CAPSL, input->ledbit);
700 set_bit(LED_SCROLLL, input->ledbit);
701 set_bit(LED_COMPOSE, input->ledbit);
702 set_bit(LED_KANA, input->ledbit);
703
704 for (i = 0; i < sizeof(hidp_keycode); i++)
705 set_bit(hidp_keycode[i], input->keybit);
706 clear_bit(0, input->keybit);
707 }
708
709 if (req->subclass & 0x80) {
710 input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
711 input->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
712 BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
713 input->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
714 input->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_SIDE) |
715 BIT_MASK(BTN_EXTRA);
716 input->relbit[0] |= BIT_MASK(REL_WHEEL);
717 }
718
719 input->dev.parent = &session->conn->hcon->dev;
720
721 input->event = hidp_input_event;
722
723 return 0;
724}
725
726static int hidp_open(struct hid_device *hid)
727{
728 return 0;
729}
730
731static void hidp_close(struct hid_device *hid)
732{
733}
734
735static int hidp_parse(struct hid_device *hid)
736{
737 struct hidp_session *session = hid->driver_data;
738
739 return hid_parse_report(session->hid, session->rd_data,
740 session->rd_size);
741}
742
743static int hidp_start(struct hid_device *hid)
744{
745 return 0;
746}
747
748static void hidp_stop(struct hid_device *hid)
749{
750 struct hidp_session *session = hid->driver_data;
751
752 skb_queue_purge(&session->ctrl_transmit);
753 skb_queue_purge(&session->intr_transmit);
754
755 hid->claimed = 0;
756}
757
758static const struct hid_ll_driver hidp_hid_driver = {
759 .parse = hidp_parse,
760 .start = hidp_start,
761 .stop = hidp_stop,
762 .open = hidp_open,
763 .close = hidp_close,
764 .raw_request = hidp_raw_request,
765 .output_report = hidp_output_report,
766};
767
768/* This function sets up the hid device. It does not add it
769 to the HID system. That is done in hidp_add_connection(). */
770static int hidp_setup_hid(struct hidp_session *session,
771 const struct hidp_connadd_req *req)
772{
773 struct hid_device *hid;
774 int err;
775
776 session->rd_data = memdup_user(req->rd_data, req->rd_size);
777 if (IS_ERR(session->rd_data))
778 return PTR_ERR(session->rd_data);
779
780 session->rd_size = req->rd_size;
781
782 hid = hid_allocate_device();
783 if (IS_ERR(hid)) {
784 err = PTR_ERR(hid);
785 goto fault;
786 }
787
788 session->hid = hid;
789
790 hid->driver_data = session;
791
792 hid->bus = BUS_BLUETOOTH;
793 hid->vendor = req->vendor;
794 hid->product = req->product;
795 hid->version = req->version;
796 hid->country = req->country;
797
798 strscpy(hid->name, req->name, sizeof(hid->name));
799
800 snprintf(hid->phys, sizeof(hid->phys), "%pMR",
801 &l2cap_pi(session->ctrl_sock->sk)->chan->src);
802
803 /* NOTE: Some device modules depend on the dst address being stored in
804 * uniq. Please be aware of this before making changes to this behavior.
805 */
806 snprintf(hid->uniq, sizeof(hid->uniq), "%pMR",
807 &l2cap_pi(session->ctrl_sock->sk)->chan->dst);
808
809 hid->dev.parent = &session->conn->hcon->dev;
810 hid->ll_driver = &hidp_hid_driver;
811
812 /* True if device is blocked in drivers/hid/hid-quirks.c */
813 if (hid_ignore(hid)) {
814 hid_destroy_device(session->hid);
815 session->hid = NULL;
816 return -ENODEV;
817 }
818
819 return 0;
820
821fault:
822 kfree(session->rd_data);
823 session->rd_data = NULL;
824
825 return err;
826}
827
828/* initialize session devices */
829static int hidp_session_dev_init(struct hidp_session *session,
830 const struct hidp_connadd_req *req)
831{
832 int ret;
833
834 if (req->rd_size > 0) {
835 ret = hidp_setup_hid(session, req);
836 if (ret && ret != -ENODEV)
837 return ret;
838 }
839
840 if (!session->hid) {
841 ret = hidp_setup_input(session, req);
842 if (ret < 0)
843 return ret;
844 }
845
846 return 0;
847}
848
849/* destroy session devices */
850static void hidp_session_dev_destroy(struct hidp_session *session)
851{
852 if (session->hid)
853 put_device(&session->hid->dev);
854 else if (session->input)
855 input_put_device(session->input);
856
857 kfree(session->rd_data);
858 session->rd_data = NULL;
859}
860
861/* add HID/input devices to their underlying bus systems */
862static int hidp_session_dev_add(struct hidp_session *session)
863{
864 int ret;
865
866 /* Both HID and input systems drop a ref-count when unregistering the
867 * device but they don't take a ref-count when registering them. Work
868 * around this by explicitly taking a refcount during registration
869 * which is dropped automatically by unregistering the devices. */
870
871 if (session->hid) {
872 ret = hid_add_device(session->hid);
873 if (ret)
874 return ret;
875 get_device(&session->hid->dev);
876 } else if (session->input) {
877 ret = input_register_device(session->input);
878 if (ret)
879 return ret;
880 input_get_device(session->input);
881 }
882
883 return 0;
884}
885
886/* remove HID/input devices from their bus systems */
887static void hidp_session_dev_del(struct hidp_session *session)
888{
889 if (session->hid)
890 hid_destroy_device(session->hid);
891 else if (session->input)
892 input_unregister_device(session->input);
893}
894
895/*
896 * Asynchronous device registration
897 * HID device drivers might want to perform I/O during initialization to
898 * detect device types. Therefore, call device registration in a separate
899 * worker so the HIDP thread can schedule I/O operations.
900 * Note that this must be called after the worker thread was initialized
901 * successfully. This will then add the devices and increase session state
902 * on success, otherwise it will terminate the session thread.
903 */
904static void hidp_session_dev_work(struct work_struct *work)
905{
906 struct hidp_session *session = container_of(work,
907 struct hidp_session,
908 dev_init);
909 int ret;
910
911 ret = hidp_session_dev_add(session);
912 if (!ret)
913 atomic_inc(&session->state);
914 else
915 hidp_session_terminate(session);
916}
917
918/*
919 * Create new session object
920 * Allocate session object, initialize static fields, copy input data into the
921 * object and take a reference to all sub-objects.
922 * This returns 0 on success and puts a pointer to the new session object in
923 * \out. Otherwise, an error code is returned.
924 * The new session object has an initial ref-count of 1.
925 */
926static int hidp_session_new(struct hidp_session **out, const bdaddr_t *bdaddr,
927 struct socket *ctrl_sock,
928 struct socket *intr_sock,
929 const struct hidp_connadd_req *req,
930 struct l2cap_conn *conn)
931{
932 struct hidp_session *session;
933 int ret;
934 struct bt_sock *ctrl, *intr;
935
936 ctrl = bt_sk(ctrl_sock->sk);
937 intr = bt_sk(intr_sock->sk);
938
939 session = kzalloc_obj(*session);
940 if (!session)
941 return -ENOMEM;
942
943 /* object and runtime management */
944 kref_init(&session->ref);
945 atomic_set(&session->state, HIDP_SESSION_IDLING);
946 init_waitqueue_head(&session->state_queue);
947 session->flags = req->flags & BIT(HIDP_BLUETOOTH_VENDOR_ID);
948
949 /* connection management */
950 bacpy(&session->bdaddr, bdaddr);
951 session->conn = l2cap_conn_get(conn);
952 session->user.probe = hidp_session_probe;
953 session->user.remove = hidp_session_remove;
954 INIT_LIST_HEAD(&session->user.list);
955 session->ctrl_sock = ctrl_sock;
956 session->intr_sock = intr_sock;
957 skb_queue_head_init(&session->ctrl_transmit);
958 skb_queue_head_init(&session->intr_transmit);
959 session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl)->chan->omtu,
960 l2cap_pi(ctrl)->chan->imtu);
961 session->intr_mtu = min_t(uint, l2cap_pi(intr)->chan->omtu,
962 l2cap_pi(intr)->chan->imtu);
963 session->idle_to = req->idle_to;
964
965 /* device management */
966 INIT_WORK(&session->dev_init, hidp_session_dev_work);
967 timer_setup(&session->timer, hidp_idle_timeout, 0);
968
969 /* session data */
970 mutex_init(&session->report_mutex);
971 init_waitqueue_head(&session->report_queue);
972
973 ret = hidp_session_dev_init(session, req);
974 if (ret)
975 goto err_free;
976
977 get_file(session->intr_sock->file);
978 get_file(session->ctrl_sock->file);
979 *out = session;
980 return 0;
981
982err_free:
983 l2cap_conn_put(session->conn);
984 kfree(session);
985 return ret;
986}
987
988/* increase ref-count of the given session by one */
989static void hidp_session_get(struct hidp_session *session)
990{
991 kref_get(&session->ref);
992}
993
994/* release callback */
995static void session_free(struct kref *ref)
996{
997 struct hidp_session *session = container_of(ref, struct hidp_session,
998 ref);
999
1000 hidp_session_dev_destroy(session);
1001 skb_queue_purge(&session->ctrl_transmit);
1002 skb_queue_purge(&session->intr_transmit);
1003 fput(session->intr_sock->file);
1004 fput(session->ctrl_sock->file);
1005 if (session->conn)
1006 l2cap_conn_put(session->conn);
1007 kfree(session);
1008}
1009
1010/* decrease ref-count of the given session by one */
1011static void hidp_session_put(struct hidp_session *session)
1012{
1013 kref_put(&session->ref, session_free);
1014}
1015
1016/*
1017 * Search the list of active sessions for a session with target address
1018 * \bdaddr. You must hold at least a read-lock on \hidp_session_sem. As long as
1019 * you do not release this lock, the session objects cannot vanish and you can
1020 * safely take a reference to the session yourself.
1021 */
1022static struct hidp_session *__hidp_session_find(const bdaddr_t *bdaddr)
1023{
1024 struct hidp_session *session;
1025
1026 list_for_each_entry(session, &hidp_session_list, list) {
1027 if (!bacmp(bdaddr, &session->bdaddr))
1028 return session;
1029 }
1030
1031 return NULL;
1032}
1033
1034/*
1035 * Same as __hidp_session_find() but no locks must be held. This also takes a
1036 * reference of the returned session (if non-NULL) so you must drop this
1037 * reference if you no longer use the object.
1038 */
1039static struct hidp_session *hidp_session_find(const bdaddr_t *bdaddr)
1040{
1041 struct hidp_session *session;
1042
1043 down_read(&hidp_session_sem);
1044
1045 session = __hidp_session_find(bdaddr);
1046 if (session)
1047 hidp_session_get(session);
1048
1049 up_read(&hidp_session_sem);
1050
1051 return session;
1052}
1053
1054/*
1055 * Consume session->conn: clear the member under hidp_session_sem, then
1056 * l2cap_unregister_user() and l2cap_conn_put() the snapshot outside the
1057 * sem. At most one caller wins; later callers see NULL and skip. The
1058 * reference is the one hidp_session_new() took via l2cap_conn_get().
1059 */
1060static void hidp_session_unregister_conn(struct hidp_session *session)
1061{
1062 struct l2cap_conn *conn;
1063
1064 down_write(&hidp_session_sem);
1065 conn = session->conn;
1066 if (conn)
1067 session->conn = NULL;
1068 up_write(&hidp_session_sem);
1069
1070 if (conn) {
1071 l2cap_unregister_user(conn, &session->user);
1072 l2cap_conn_put(conn);
1073 }
1074}
1075
1076/*
1077 * Start session synchronously
1078 * This starts a session thread and waits until initialization
1079 * is done or returns an error if it couldn't be started.
1080 * If this returns 0 the session thread is up and running. You must call
1081 * hipd_session_stop_sync() before deleting any runtime resources.
1082 */
1083static int hidp_session_start_sync(struct hidp_session *session)
1084{
1085 unsigned int vendor, product;
1086
1087 if (session->hid) {
1088 vendor = session->hid->vendor;
1089 product = session->hid->product;
1090 } else if (session->input) {
1091 vendor = session->input->id.vendor;
1092 product = session->input->id.product;
1093 } else {
1094 vendor = 0x0000;
1095 product = 0x0000;
1096 }
1097
1098 session->task = kthread_run(hidp_session_thread, session,
1099 "khidpd_%04x%04x", vendor, product);
1100 if (IS_ERR(session->task))
1101 return PTR_ERR(session->task);
1102
1103 while (atomic_read(&session->state) <= HIDP_SESSION_IDLING)
1104 wait_event(session->state_queue,
1105 atomic_read(&session->state) > HIDP_SESSION_IDLING);
1106
1107 return 0;
1108}
1109
1110/*
1111 * Terminate session thread
1112 * Wake up session thread and notify it to stop. This is asynchronous and
1113 * returns immediately. Call this whenever a runtime error occurs and you want
1114 * the session to stop.
1115 * Note: wake_up_interruptible() performs any necessary memory-barriers for us.
1116 */
1117static void hidp_session_terminate(struct hidp_session *session)
1118{
1119 atomic_inc(&session->terminate);
1120 /*
1121 * See the comment preceding the call to wait_woken()
1122 * in hidp_session_run().
1123 */
1124 wake_up_interruptible(&hidp_session_wq);
1125}
1126
1127/*
1128 * Probe HIDP session
1129 * This is called from the l2cap_conn core when our l2cap_user object is bound
1130 * to the hci-connection. We get the session via the \user object and can now
1131 * start the session thread, link it into the global session list and
1132 * schedule HID/input device registration.
1133 * The global session-list owns its own reference to the session object so you
1134 * can drop your own reference after registering the l2cap_user object.
1135 */
1136static int hidp_session_probe(struct l2cap_conn *conn,
1137 struct l2cap_user *user)
1138{
1139 struct hidp_session *session = container_of(user,
1140 struct hidp_session,
1141 user);
1142 struct hidp_session *s;
1143 int ret;
1144
1145 down_write(&hidp_session_sem);
1146
1147 /* check that no other session for this device exists */
1148 s = __hidp_session_find(&session->bdaddr);
1149 if (s) {
1150 ret = -EEXIST;
1151 goto out_unlock;
1152 }
1153
1154 if (session->input) {
1155 ret = hidp_session_dev_add(session);
1156 if (ret)
1157 goto out_unlock;
1158 }
1159
1160 ret = hidp_session_start_sync(session);
1161 if (ret)
1162 goto out_del;
1163
1164 /* HID device registration is async to allow I/O during probe */
1165 if (session->input)
1166 atomic_inc(&session->state);
1167 else
1168 schedule_work(&session->dev_init);
1169
1170 hidp_session_get(session);
1171 list_add(&session->list, &hidp_session_list);
1172 ret = 0;
1173 goto out_unlock;
1174
1175out_del:
1176 if (session->input)
1177 hidp_session_dev_del(session);
1178out_unlock:
1179 up_write(&hidp_session_sem);
1180 return ret;
1181}
1182
1183/*
1184 * Remove HIDP session
1185 * Called from the l2cap_conn core when either we explicitly unregistered
1186 * the l2cap_user object or if the underlying connection is shut down.
1187 * We signal the hidp-session thread to shut down, unregister the HID/input
1188 * devices and unlink the session from the global list.
1189 * This drops the reference to the session that is owned by the global
1190 * session-list.
1191 * Note: We _must_ not synchronosly wait for the session-thread to shut down.
1192 * This is, because the session-thread might be waiting for an HCI lock that is
1193 * held while we are called. Therefore, we only unregister the devices and
1194 * notify the session-thread to terminate. The thread itself owns a reference
1195 * to the session object so it can safely shut down.
1196 */
1197static void hidp_session_remove(struct l2cap_conn *conn,
1198 struct l2cap_user *user)
1199{
1200 struct hidp_session *session = container_of(user,
1201 struct hidp_session,
1202 user);
1203
1204 down_write(&hidp_session_sem);
1205
1206 /* Drop L2CAP reference immediately to indicate that
1207 * l2cap_unregister_user() shall not be called as it is already
1208 * considered removed.
1209 */
1210 if (session->conn) {
1211 l2cap_conn_put(session->conn);
1212 session->conn = NULL;
1213 }
1214
1215 hidp_session_terminate(session);
1216
1217 cancel_work_sync(&session->dev_init);
1218 if (session->input ||
1219 atomic_read(&session->state) > HIDP_SESSION_PREPARING)
1220 hidp_session_dev_del(session);
1221
1222 list_del(&session->list);
1223
1224 up_write(&hidp_session_sem);
1225
1226 hidp_session_put(session);
1227}
1228
1229/*
1230 * Session Worker
1231 * This performs the actual main-loop of the HIDP worker. We first check
1232 * whether the underlying connection is still alive, then parse all pending
1233 * messages and finally send all outstanding messages.
1234 */
1235static void hidp_session_run(struct hidp_session *session)
1236{
1237 struct sock *ctrl_sk = session->ctrl_sock->sk;
1238 struct sock *intr_sk = session->intr_sock->sk;
1239 struct sk_buff *skb;
1240 DEFINE_WAIT_FUNC(wait, woken_wake_function);
1241
1242 add_wait_queue(&hidp_session_wq, &wait);
1243 for (;;) {
1244 /*
1245 * This thread can be woken up two ways:
1246 * - You call hidp_session_terminate() which sets the
1247 * session->terminate flag and wakes this thread up.
1248 * - Via modifying the socket state of ctrl/intr_sock. This
1249 * thread is woken up by ->sk_state_changed().
1250 */
1251
1252 if (atomic_read(&session->terminate))
1253 break;
1254
1255 if (ctrl_sk->sk_state != BT_CONNECTED ||
1256 intr_sk->sk_state != BT_CONNECTED)
1257 break;
1258
1259 /* parse incoming intr-skbs */
1260 while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
1261 skb_orphan(skb);
1262 if (!skb_linearize(skb))
1263 hidp_recv_intr_frame(session, skb);
1264 else
1265 kfree_skb(skb);
1266 }
1267
1268 /* send pending intr-skbs */
1269 hidp_process_transmit(session, &session->intr_transmit,
1270 session->intr_sock);
1271
1272 /* parse incoming ctrl-skbs */
1273 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
1274 skb_orphan(skb);
1275 if (!skb_linearize(skb))
1276 hidp_recv_ctrl_frame(session, skb);
1277 else
1278 kfree_skb(skb);
1279 }
1280
1281 /* send pending ctrl-skbs */
1282 hidp_process_transmit(session, &session->ctrl_transmit,
1283 session->ctrl_sock);
1284
1285 /*
1286 * wait_woken() performs the necessary memory barriers
1287 * for us; see the header comment for this primitive.
1288 */
1289 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
1290 }
1291 remove_wait_queue(&hidp_session_wq, &wait);
1292
1293 atomic_inc(&session->terminate);
1294}
1295
1296static int hidp_session_wake_function(wait_queue_entry_t *wait,
1297 unsigned int mode,
1298 int sync, void *key)
1299{
1300 wake_up_interruptible(&hidp_session_wq);
1301 return false;
1302}
1303
1304/*
1305 * HIDP session thread
1306 * This thread runs the I/O for a single HIDP session. Startup is synchronous
1307 * which allows us to take references to ourself here instead of doing that in
1308 * the caller.
1309 * When we are ready to run we notify the caller and call hidp_session_run().
1310 */
1311static int hidp_session_thread(void *arg)
1312{
1313 struct hidp_session *session = arg;
1314 DEFINE_WAIT_FUNC(ctrl_wait, hidp_session_wake_function);
1315 DEFINE_WAIT_FUNC(intr_wait, hidp_session_wake_function);
1316
1317 BT_DBG("session %p", session);
1318
1319 /* initialize runtime environment */
1320 hidp_session_get(session);
1321 __module_get(THIS_MODULE);
1322 set_user_nice(current, -15);
1323 hidp_set_timer(session);
1324
1325 add_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
1326 add_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
1327 /* This memory barrier is paired with wq_has_sleeper(). See
1328 * sock_poll_wait() for more information why this is needed. */
1329 smp_mb__before_atomic();
1330
1331 /* notify synchronous startup that we're ready */
1332 atomic_inc(&session->state);
1333 wake_up(&session->state_queue);
1334
1335 /* run session */
1336 hidp_session_run(session);
1337
1338 /* cleanup runtime environment */
1339 remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
1340 remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
1341 wake_up_interruptible(&session->report_queue);
1342 hidp_del_timer(session);
1343
1344 /*
1345 * If we stopped ourself due to any internal signal, we should try to
1346 * unregister our own session here to avoid having it linger until the
1347 * parent l2cap_conn dies or user-space cleans it up.
1348 * This does not deadlock as we don't do any synchronous shutdown.
1349 * Instead, this call has the same semantics as if user-space tried to
1350 * delete the session.
1351 */
1352 hidp_session_unregister_conn(session);
1353
1354 hidp_session_put(session);
1355
1356 module_put_and_kthread_exit(0);
1357 return 0;
1358}
1359
1360static int hidp_verify_sockets(struct socket *ctrl_sock,
1361 struct socket *intr_sock)
1362{
1363 struct l2cap_chan *ctrl_chan, *intr_chan;
1364 struct bt_sock *ctrl, *intr;
1365 struct hidp_session *session;
1366
1367 if (!l2cap_is_socket(ctrl_sock) || !l2cap_is_socket(intr_sock))
1368 return -EINVAL;
1369
1370 ctrl_chan = l2cap_pi(ctrl_sock->sk)->chan;
1371 intr_chan = l2cap_pi(intr_sock->sk)->chan;
1372
1373 if (bacmp(&ctrl_chan->src, &intr_chan->src) ||
1374 bacmp(&ctrl_chan->dst, &intr_chan->dst))
1375 return -ENOTUNIQ;
1376
1377 ctrl = bt_sk(ctrl_sock->sk);
1378 intr = bt_sk(intr_sock->sk);
1379
1380 if (ctrl->sk.sk_state != BT_CONNECTED ||
1381 intr->sk.sk_state != BT_CONNECTED)
1382 return -EBADFD;
1383
1384 /* early session check, we check again during session registration */
1385 session = hidp_session_find(&ctrl_chan->dst);
1386 if (session) {
1387 hidp_session_put(session);
1388 return -EEXIST;
1389 }
1390
1391 return 0;
1392}
1393
1394int hidp_connection_add(const struct hidp_connadd_req *req,
1395 struct socket *ctrl_sock,
1396 struct socket *intr_sock)
1397{
1398 u32 valid_flags = BIT(HIDP_VIRTUAL_CABLE_UNPLUG) |
1399 BIT(HIDP_BOOT_PROTOCOL_MODE);
1400 struct hidp_session *session;
1401 struct l2cap_conn *conn;
1402 struct l2cap_chan *chan;
1403 int ret;
1404
1405 ret = hidp_verify_sockets(ctrl_sock, intr_sock);
1406 if (ret)
1407 return ret;
1408
1409 if (req->flags & ~valid_flags)
1410 return -EINVAL;
1411
1412 chan = l2cap_pi(ctrl_sock->sk)->chan;
1413 conn = NULL;
1414 l2cap_chan_lock(chan);
1415 if (chan->conn)
1416 conn = l2cap_conn_get(chan->conn);
1417 l2cap_chan_unlock(chan);
1418
1419 if (!conn)
1420 return -EBADFD;
1421
1422 ret = hidp_session_new(&session, &chan->dst, ctrl_sock,
1423 intr_sock, req, conn);
1424 if (ret)
1425 goto out_conn;
1426
1427 ret = l2cap_register_user(conn, &session->user);
1428 if (ret)
1429 goto out_session;
1430
1431 ret = 0;
1432
1433out_session:
1434 hidp_session_put(session);
1435out_conn:
1436 l2cap_conn_put(conn);
1437 return ret;
1438}
1439
1440int hidp_connection_del(struct hidp_conndel_req *req)
1441{
1442 u32 valid_flags = BIT(HIDP_VIRTUAL_CABLE_UNPLUG);
1443 struct hidp_session *session;
1444
1445 if (req->flags & ~valid_flags)
1446 return -EINVAL;
1447
1448 session = hidp_session_find(&req->bdaddr);
1449 if (!session)
1450 return -ENOENT;
1451
1452 if (req->flags & BIT(HIDP_VIRTUAL_CABLE_UNPLUG))
1453 hidp_send_ctrl_message(session,
1454 HIDP_TRANS_HID_CONTROL |
1455 HIDP_CTRL_VIRTUAL_CABLE_UNPLUG,
1456 NULL, 0);
1457 else
1458 hidp_session_unregister_conn(session);
1459
1460 hidp_session_put(session);
1461
1462 return 0;
1463}
1464
1465int hidp_get_connlist(struct hidp_connlist_req *req)
1466{
1467 struct hidp_session *session;
1468 int err = 0, n = 0;
1469
1470 BT_DBG("");
1471
1472 down_read(&hidp_session_sem);
1473
1474 list_for_each_entry(session, &hidp_session_list, list) {
1475 struct hidp_conninfo ci;
1476
1477 hidp_copy_session(session, &ci);
1478
1479 if (copy_to_user(req->ci, &ci, sizeof(ci))) {
1480 err = -EFAULT;
1481 break;
1482 }
1483
1484 if (++n >= req->cnum)
1485 break;
1486
1487 req->ci++;
1488 }
1489 req->cnum = n;
1490
1491 up_read(&hidp_session_sem);
1492 return err;
1493}
1494
1495int hidp_get_conninfo(struct hidp_conninfo *ci)
1496{
1497 struct hidp_session *session;
1498
1499 session = hidp_session_find(&ci->bdaddr);
1500 if (session) {
1501 hidp_copy_session(session, ci);
1502 hidp_session_put(session);
1503 }
1504
1505 return session ? 0 : -ENOENT;
1506}
1507
1508static int __init hidp_init(void)
1509{
1510 BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
1511
1512 return hidp_init_sockets();
1513}
1514
1515static void __exit hidp_exit(void)
1516{
1517 hidp_cleanup_sockets();
1518}
1519
1520module_init(hidp_init);
1521module_exit(hidp_exit);
1522
1523MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
1524MODULE_AUTHOR("David Herrmann <[email protected]>");
1525MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION);
1526MODULE_VERSION(VERSION);
1527MODULE_LICENSE("GPL");
1528MODULE_ALIAS("bt-proto-6");