1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 HIDP implementation for Linux Bluetooth stack (BlueZ). 4 Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org> 5 Copyright (C) 2013 David Herrmann <dh.herrmann@gmail.com> 6 7 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 8 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 9 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 10 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 11 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 12 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 13 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 14 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 16 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 17 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 18 SOFTWARE IS DISCLAIMED. 19 */ 20 21 #include <linux/kref.h> 22 #include <linux/module.h> 23 #include <linux/file.h> 24 #include <linux/kthread.h> 25 #include <linux/hidraw.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/l2cap.h> 30 31 #include "hidp.h" 32 33 #define VERSION "1.2" 34 35 static DECLARE_RWSEM(hidp_session_sem); 36 static DECLARE_WAIT_QUEUE_HEAD(hidp_session_wq); 37 static LIST_HEAD(hidp_session_list); 38 39 static unsigned char hidp_keycode[256] = { 40 0, 0, 0, 0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36, 41 37, 38, 50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45, 42 21, 44, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 28, 1, 43 14, 15, 57, 12, 13, 26, 27, 43, 43, 39, 40, 41, 51, 52, 44 53, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 87, 88, 45 99, 70, 119, 110, 102, 104, 111, 107, 109, 106, 105, 108, 103, 69, 46 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71, 72, 73, 47 82, 83, 86, 127, 116, 117, 183, 184, 185, 186, 187, 188, 189, 190, 48 191, 192, 193, 194, 134, 138, 130, 132, 128, 129, 131, 137, 133, 135, 49 136, 113, 115, 114, 0, 0, 0, 121, 0, 89, 93, 124, 92, 94, 50 95, 0, 0, 0, 122, 123, 90, 91, 85, 0, 0, 0, 0, 0, 51 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 52 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 53 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 54 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 55 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 56 29, 42, 56, 125, 97, 54, 100, 126, 164, 166, 165, 163, 161, 115, 57 114, 113, 150, 158, 159, 128, 136, 177, 178, 176, 142, 152, 173, 140 58 }; 59 60 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 }; 61 62 static int hidp_session_probe(struct l2cap_conn *conn, 63 struct l2cap_user *user); 64 static void hidp_session_remove(struct l2cap_conn *conn, 65 struct l2cap_user *user); 66 static int hidp_session_thread(void *arg); 67 static void hidp_session_terminate(struct hidp_session *s); 68 69 static void hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci) 70 { 71 u32 valid_flags = 0; 72 memset(ci, 0, sizeof(*ci)); 73 bacpy(&ci->bdaddr, &session->bdaddr); 74 75 ci->flags = session->flags & valid_flags; 76 ci->state = BT_CONNECTED; 77 78 if (session->input) { 79 ci->vendor = session->input->id.vendor; 80 ci->product = session->input->id.product; 81 ci->version = session->input->id.version; 82 if (session->input->name) 83 strscpy(ci->name, session->input->name, 128); 84 else 85 strscpy(ci->name, "HID Boot Device", 128); 86 } else if (session->hid) { 87 ci->vendor = session->hid->vendor; 88 ci->product = session->hid->product; 89 ci->version = session->hid->version; 90 strscpy(ci->name, session->hid->name, 128); 91 } 92 } 93 94 /* assemble skb, queue message on @transmit and wake up the session thread */ 95 static int hidp_send_message(struct hidp_session *session, struct socket *sock, 96 struct sk_buff_head *transmit, unsigned char hdr, 97 const unsigned char *data, int size) 98 { 99 struct sk_buff *skb; 100 struct sock *sk = sock->sk; 101 int ret; 102 103 BT_DBG("session %p data %p size %d", session, data, size); 104 105 if (atomic_read(&session->terminate)) 106 return -EIO; 107 108 skb = alloc_skb(size + 1, GFP_ATOMIC); 109 if (!skb) { 110 BT_ERR("Can't allocate memory for new frame"); 111 return -ENOMEM; 112 } 113 114 skb_put_u8(skb, hdr); 115 if (data && size > 0) { 116 skb_put_data(skb, data, size); 117 ret = size; 118 } else { 119 ret = 0; 120 } 121 122 skb_queue_tail(transmit, skb); 123 wake_up_interruptible(sk_sleep(sk)); 124 125 return ret; 126 } 127 128 static int hidp_send_ctrl_message(struct hidp_session *session, 129 unsigned char hdr, const unsigned char *data, 130 int size) 131 { 132 return hidp_send_message(session, session->ctrl_sock, 133 &session->ctrl_transmit, hdr, data, size); 134 } 135 136 static int hidp_send_intr_message(struct hidp_session *session, 137 unsigned char hdr, const unsigned char *data, 138 int size) 139 { 140 return hidp_send_message(session, session->intr_sock, 141 &session->intr_transmit, hdr, data, size); 142 } 143 144 static int hidp_input_event(struct input_dev *dev, unsigned int type, 145 unsigned int code, int value) 146 { 147 struct hidp_session *session = input_get_drvdata(dev); 148 unsigned char newleds; 149 unsigned char hdr, data[2]; 150 151 BT_DBG("session %p type %d code %d value %d", 152 session, type, code, value); 153 154 if (type != EV_LED) 155 return -1; 156 157 newleds = (!!test_bit(LED_KANA, dev->led) << 3) | 158 (!!test_bit(LED_COMPOSE, dev->led) << 3) | 159 (!!test_bit(LED_SCROLLL, dev->led) << 2) | 160 (!!test_bit(LED_CAPSL, dev->led) << 1) | 161 (!!test_bit(LED_NUML, dev->led) << 0); 162 163 if (session->leds == newleds) 164 return 0; 165 166 session->leds = newleds; 167 168 hdr = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT; 169 data[0] = 0x01; 170 data[1] = newleds; 171 172 return hidp_send_intr_message(session, hdr, data, 2); 173 } 174 175 static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb) 176 { 177 struct input_dev *dev = session->input; 178 unsigned char *keys = session->keys; 179 unsigned char *udata; 180 signed char *sdata; 181 u8 *hdr; 182 int i; 183 184 hdr = skb_pull_data(skb, 1); 185 if (!hdr) 186 return; 187 188 switch (*hdr) { 189 case 0x01: /* Keyboard report */ 190 udata = skb_pull_data(skb, 8); 191 if (!udata) 192 break; 193 194 for (i = 0; i < 8; i++) 195 input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1); 196 197 /* If all the key codes have been set to 0x01, it means 198 * too many keys were pressed at the same time. */ 199 if (!memcmp(udata + 2, hidp_mkeyspat, 6)) 200 break; 201 202 for (i = 2; i < 8; i++) { 203 if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) { 204 if (hidp_keycode[keys[i]]) 205 input_report_key(dev, hidp_keycode[keys[i]], 0); 206 else 207 BT_ERR("Unknown key (scancode %#x) released.", keys[i]); 208 } 209 210 if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) { 211 if (hidp_keycode[udata[i]]) 212 input_report_key(dev, hidp_keycode[udata[i]], 1); 213 else 214 BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]); 215 } 216 } 217 218 memcpy(keys, udata, 8); 219 break; 220 221 case 0x02: /* Mouse report */ 222 sdata = skb_pull_data(skb, 3); 223 if (!sdata) 224 break; 225 226 input_report_key(dev, BTN_LEFT, sdata[0] & 0x01); 227 input_report_key(dev, BTN_RIGHT, sdata[0] & 0x02); 228 input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04); 229 input_report_key(dev, BTN_SIDE, sdata[0] & 0x08); 230 input_report_key(dev, BTN_EXTRA, sdata[0] & 0x10); 231 232 input_report_rel(dev, REL_X, sdata[1]); 233 input_report_rel(dev, REL_Y, sdata[2]); 234 235 if (skb->len > 0) 236 input_report_rel(dev, REL_WHEEL, sdata[3]); 237 break; 238 } 239 240 input_sync(dev); 241 } 242 243 static int hidp_get_raw_report(struct hid_device *hid, 244 unsigned char report_number, 245 unsigned char *data, size_t count, 246 unsigned char report_type) 247 { 248 struct hidp_session *session = hid->driver_data; 249 struct sk_buff *skb; 250 size_t len; 251 int numbered_reports = hid->report_enum[report_type].numbered; 252 int ret; 253 254 if (atomic_read(&session->terminate)) 255 return -EIO; 256 257 switch (report_type) { 258 case HID_FEATURE_REPORT: 259 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_FEATURE; 260 break; 261 case HID_INPUT_REPORT: 262 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_INPUT; 263 break; 264 case HID_OUTPUT_REPORT: 265 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_OUPUT; 266 break; 267 default: 268 return -EINVAL; 269 } 270 271 if (mutex_lock_interruptible(&session->report_mutex)) 272 return -ERESTARTSYS; 273 274 /* Set up our wait, and send the report request to the device. */ 275 session->waiting_report_type = report_type & HIDP_DATA_RTYPE_MASK; 276 session->waiting_report_number = numbered_reports ? report_number : -1; 277 set_bit(HIDP_WAITING_FOR_RETURN, &session->flags); 278 data[0] = report_number; 279 ret = hidp_send_ctrl_message(session, report_type, data, 1); 280 if (ret < 0) 281 goto err; 282 283 /* Wait for the return of the report. The returned report 284 gets put in session->report_return. */ 285 while (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) && 286 !atomic_read(&session->terminate)) { 287 int res; 288 289 res = wait_event_interruptible_timeout(session->report_queue, 290 !test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) 291 || atomic_read(&session->terminate), 292 5*HZ); 293 if (res == 0) { 294 /* timeout */ 295 ret = -EIO; 296 goto err; 297 } 298 if (res < 0) { 299 /* signal */ 300 ret = -ERESTARTSYS; 301 goto err; 302 } 303 } 304 305 skb = session->report_return; 306 if (skb) { 307 len = skb->len < count ? skb->len : count; 308 memcpy(data, skb->data, len); 309 310 kfree_skb(skb); 311 session->report_return = NULL; 312 } else { 313 /* Device returned a HANDSHAKE, indicating protocol error. */ 314 len = -EIO; 315 } 316 317 clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags); 318 mutex_unlock(&session->report_mutex); 319 320 return len; 321 322 err: 323 clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags); 324 mutex_unlock(&session->report_mutex); 325 return ret; 326 } 327 328 static int hidp_set_raw_report(struct hid_device *hid, unsigned char reportnum, 329 unsigned char *data, size_t count, 330 unsigned char report_type) 331 { 332 struct hidp_session *session = hid->driver_data; 333 int ret; 334 335 switch (report_type) { 336 case HID_FEATURE_REPORT: 337 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE; 338 break; 339 case HID_INPUT_REPORT: 340 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_INPUT; 341 break; 342 case HID_OUTPUT_REPORT: 343 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_OUPUT; 344 break; 345 default: 346 return -EINVAL; 347 } 348 349 if (mutex_lock_interruptible(&session->report_mutex)) 350 return -ERESTARTSYS; 351 352 /* Set up our wait, and send the report request to the device. */ 353 data[0] = reportnum; 354 set_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags); 355 ret = hidp_send_ctrl_message(session, report_type, data, count); 356 if (ret < 0) 357 goto err; 358 359 /* Wait for the ACK from the device. */ 360 while (test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags) && 361 !atomic_read(&session->terminate)) { 362 int res; 363 364 res = wait_event_interruptible_timeout(session->report_queue, 365 !test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags) 366 || atomic_read(&session->terminate), 367 10*HZ); 368 if (res == 0) { 369 /* timeout */ 370 ret = -EIO; 371 goto err; 372 } 373 if (res < 0) { 374 /* signal */ 375 ret = -ERESTARTSYS; 376 goto err; 377 } 378 } 379 380 if (!session->output_report_success) { 381 ret = -EIO; 382 goto err; 383 } 384 385 ret = count; 386 387 err: 388 clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags); 389 mutex_unlock(&session->report_mutex); 390 return ret; 391 } 392 393 static int hidp_output_report(struct hid_device *hid, __u8 *data, size_t count) 394 { 395 struct hidp_session *session = hid->driver_data; 396 397 return hidp_send_intr_message(session, 398 HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT, 399 data, count); 400 } 401 402 static int hidp_raw_request(struct hid_device *hid, unsigned char reportnum, 403 __u8 *buf, size_t len, unsigned char rtype, 404 int reqtype) 405 { 406 switch (reqtype) { 407 case HID_REQ_GET_REPORT: 408 return hidp_get_raw_report(hid, reportnum, buf, len, rtype); 409 case HID_REQ_SET_REPORT: 410 return hidp_set_raw_report(hid, reportnum, buf, len, rtype); 411 default: 412 return -EIO; 413 } 414 } 415 416 static void hidp_idle_timeout(struct timer_list *t) 417 { 418 struct hidp_session *session = timer_container_of(session, t, timer); 419 420 /* The HIDP user-space API only contains calls to add and remove 421 * devices. There is no way to forward events of any kind. Therefore, 422 * we have to forcefully disconnect a device on idle-timeouts. This is 423 * unfortunate and weird API design, but it is spec-compliant and 424 * required for backwards-compatibility. Hence, on idle-timeout, we 425 * signal driver-detach events, so poll() will be woken up with an 426 * error-condition on both sockets. 427 */ 428 429 session->intr_sock->sk->sk_err = EUNATCH; 430 session->ctrl_sock->sk->sk_err = EUNATCH; 431 wake_up_interruptible(sk_sleep(session->intr_sock->sk)); 432 wake_up_interruptible(sk_sleep(session->ctrl_sock->sk)); 433 434 hidp_session_terminate(session); 435 } 436 437 static void hidp_set_timer(struct hidp_session *session) 438 { 439 if (session->idle_to > 0) 440 mod_timer(&session->timer, jiffies + HZ * session->idle_to); 441 } 442 443 static void hidp_del_timer(struct hidp_session *session) 444 { 445 if (session->idle_to > 0) 446 timer_delete_sync(&session->timer); 447 } 448 449 static void hidp_process_report(struct hidp_session *session, int type, 450 const u8 *data, unsigned int len, int intr) 451 { 452 if (len > HID_MAX_BUFFER_SIZE) 453 len = HID_MAX_BUFFER_SIZE; 454 455 memcpy(session->input_buf, data, len); 456 hid_input_report(session->hid, type, session->input_buf, len, intr); 457 } 458 459 static void hidp_process_handshake(struct hidp_session *session, 460 unsigned char param) 461 { 462 BT_DBG("session %p param 0x%02x", session, param); 463 session->output_report_success = 0; /* default condition */ 464 465 switch (param) { 466 case HIDP_HSHK_SUCCESSFUL: 467 /* FIXME: Call into SET_ GET_ handlers here */ 468 session->output_report_success = 1; 469 break; 470 471 case HIDP_HSHK_NOT_READY: 472 case HIDP_HSHK_ERR_INVALID_REPORT_ID: 473 case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST: 474 case HIDP_HSHK_ERR_INVALID_PARAMETER: 475 if (test_and_clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags)) 476 wake_up_interruptible(&session->report_queue); 477 478 /* FIXME: Call into SET_ GET_ handlers here */ 479 break; 480 481 case HIDP_HSHK_ERR_UNKNOWN: 482 break; 483 484 case HIDP_HSHK_ERR_FATAL: 485 /* Device requests a reboot, as this is the only way this error 486 * can be recovered. */ 487 hidp_send_ctrl_message(session, 488 HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0); 489 break; 490 491 default: 492 hidp_send_ctrl_message(session, 493 HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0); 494 break; 495 } 496 497 /* Wake up the waiting thread. */ 498 if (test_and_clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags)) 499 wake_up_interruptible(&session->report_queue); 500 } 501 502 static void hidp_process_hid_control(struct hidp_session *session, 503 unsigned char param) 504 { 505 BT_DBG("session %p param 0x%02x", session, param); 506 507 if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) { 508 /* Flush the transmit queues */ 509 skb_queue_purge(&session->ctrl_transmit); 510 skb_queue_purge(&session->intr_transmit); 511 512 hidp_session_terminate(session); 513 } 514 } 515 516 /* Returns true if the passed-in skb should be freed by the caller. */ 517 static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb, 518 unsigned char param) 519 { 520 int done_with_skb = 1; 521 BT_DBG("session %p skb %p len %u param 0x%02x", session, skb, skb->len, param); 522 523 switch (param) { 524 case HIDP_DATA_RTYPE_INPUT: 525 hidp_set_timer(session); 526 527 if (session->input) 528 hidp_input_report(session, skb); 529 530 if (session->hid) 531 hidp_process_report(session, HID_INPUT_REPORT, 532 skb->data, skb->len, 0); 533 break; 534 535 case HIDP_DATA_RTYPE_OTHER: 536 case HIDP_DATA_RTYPE_OUPUT: 537 case HIDP_DATA_RTYPE_FEATURE: 538 break; 539 540 default: 541 hidp_send_ctrl_message(session, 542 HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0); 543 } 544 545 if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) && 546 param == session->waiting_report_type) { 547 if (session->waiting_report_number < 0 || 548 (skb->len && 549 session->waiting_report_number == skb->data[0])) { 550 /* hidp_get_raw_report() is waiting on this report. */ 551 session->report_return = skb; 552 done_with_skb = 0; 553 clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags); 554 wake_up_interruptible(&session->report_queue); 555 } 556 } 557 558 return done_with_skb; 559 } 560 561 static void hidp_recv_ctrl_frame(struct hidp_session *session, 562 struct sk_buff *skb) 563 { 564 unsigned char type, param; 565 u8 *hdr; 566 int free_skb = 1; 567 568 BT_DBG("session %p skb %p len %u", session, skb, skb->len); 569 570 hdr = skb_pull_data(skb, 1); 571 if (!hdr) 572 goto free; 573 574 type = *hdr & HIDP_HEADER_TRANS_MASK; 575 param = *hdr & HIDP_HEADER_PARAM_MASK; 576 577 switch (type) { 578 case HIDP_TRANS_HANDSHAKE: 579 hidp_process_handshake(session, param); 580 break; 581 582 case HIDP_TRANS_HID_CONTROL: 583 hidp_process_hid_control(session, param); 584 break; 585 586 case HIDP_TRANS_DATA: 587 free_skb = hidp_process_data(session, skb, param); 588 break; 589 590 default: 591 hidp_send_ctrl_message(session, 592 HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0); 593 break; 594 } 595 596 free: 597 if (free_skb) 598 kfree_skb(skb); 599 } 600 601 static void hidp_recv_intr_frame(struct hidp_session *session, 602 struct sk_buff *skb) 603 { 604 u8 *hdr; 605 606 BT_DBG("session %p skb %p len %u", session, skb, skb->len); 607 608 hdr = skb_pull_data(skb, 1); 609 if (!hdr) 610 goto free; 611 612 if (*hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) { 613 hidp_set_timer(session); 614 615 if (session->input) 616 hidp_input_report(session, skb); 617 618 if (session->hid) { 619 hidp_process_report(session, HID_INPUT_REPORT, 620 skb->data, skb->len, 1); 621 BT_DBG("report len %d", skb->len); 622 } 623 } else { 624 BT_DBG("Unsupported protocol header 0x%02x", *hdr); 625 } 626 627 free: 628 kfree_skb(skb); 629 } 630 631 static int hidp_send_frame(struct socket *sock, unsigned char *data, int len) 632 { 633 struct kvec iv = { data, len }; 634 struct msghdr msg; 635 636 BT_DBG("sock %p data %p len %d", sock, data, len); 637 638 if (!len) 639 return 0; 640 641 memset(&msg, 0, sizeof(msg)); 642 643 return kernel_sendmsg(sock, &msg, &iv, 1, len); 644 } 645 646 /* dequeue message from @transmit and send via @sock */ 647 static void hidp_process_transmit(struct hidp_session *session, 648 struct sk_buff_head *transmit, 649 struct socket *sock) 650 { 651 struct sk_buff *skb; 652 int ret; 653 654 BT_DBG("session %p", session); 655 656 while ((skb = skb_dequeue(transmit))) { 657 ret = hidp_send_frame(sock, skb->data, skb->len); 658 if (ret == -EAGAIN) { 659 skb_queue_head(transmit, skb); 660 break; 661 } else if (ret < 0) { 662 hidp_session_terminate(session); 663 kfree_skb(skb); 664 break; 665 } 666 667 hidp_set_timer(session); 668 kfree_skb(skb); 669 } 670 } 671 672 static int hidp_setup_input(struct hidp_session *session, 673 const struct hidp_connadd_req *req) 674 { 675 struct input_dev *input; 676 int i; 677 678 input = input_allocate_device(); 679 if (!input) 680 return -ENOMEM; 681 682 session->input = input; 683 684 input_set_drvdata(input, session); 685 686 input->name = "Bluetooth HID Boot Protocol Device"; 687 688 input->id.bustype = BUS_BLUETOOTH; 689 input->id.vendor = req->vendor; 690 input->id.product = req->product; 691 input->id.version = req->version; 692 693 if (req->subclass & 0x40) { 694 set_bit(EV_KEY, input->evbit); 695 set_bit(EV_LED, input->evbit); 696 set_bit(EV_REP, input->evbit); 697 698 set_bit(LED_NUML, input->ledbit); 699 set_bit(LED_CAPSL, input->ledbit); 700 set_bit(LED_SCROLLL, input->ledbit); 701 set_bit(LED_COMPOSE, input->ledbit); 702 set_bit(LED_KANA, input->ledbit); 703 704 for (i = 0; i < sizeof(hidp_keycode); i++) 705 set_bit(hidp_keycode[i], input->keybit); 706 clear_bit(0, input->keybit); 707 } 708 709 if (req->subclass & 0x80) { 710 input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL); 711 input->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) | 712 BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE); 713 input->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y); 714 input->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_SIDE) | 715 BIT_MASK(BTN_EXTRA); 716 input->relbit[0] |= BIT_MASK(REL_WHEEL); 717 } 718 719 input->dev.parent = &session->conn->hcon->dev; 720 721 input->event = hidp_input_event; 722 723 return 0; 724 } 725 726 static int hidp_open(struct hid_device *hid) 727 { 728 return 0; 729 } 730 731 static void hidp_close(struct hid_device *hid) 732 { 733 } 734 735 static int hidp_parse(struct hid_device *hid) 736 { 737 struct hidp_session *session = hid->driver_data; 738 739 return hid_parse_report(session->hid, session->rd_data, 740 session->rd_size); 741 } 742 743 static int hidp_start(struct hid_device *hid) 744 { 745 return 0; 746 } 747 748 static void hidp_stop(struct hid_device *hid) 749 { 750 struct hidp_session *session = hid->driver_data; 751 752 skb_queue_purge(&session->ctrl_transmit); 753 skb_queue_purge(&session->intr_transmit); 754 755 hid->claimed = 0; 756 } 757 758 static const struct hid_ll_driver hidp_hid_driver = { 759 .parse = hidp_parse, 760 .start = hidp_start, 761 .stop = hidp_stop, 762 .open = hidp_open, 763 .close = hidp_close, 764 .raw_request = hidp_raw_request, 765 .output_report = hidp_output_report, 766 }; 767 768 /* This function sets up the hid device. It does not add it 769 to the HID system. That is done in hidp_add_connection(). */ 770 static int hidp_setup_hid(struct hidp_session *session, 771 const struct hidp_connadd_req *req) 772 { 773 struct hid_device *hid; 774 int err; 775 776 session->rd_data = memdup_user(req->rd_data, req->rd_size); 777 if (IS_ERR(session->rd_data)) 778 return PTR_ERR(session->rd_data); 779 780 session->rd_size = req->rd_size; 781 782 hid = hid_allocate_device(); 783 if (IS_ERR(hid)) { 784 err = PTR_ERR(hid); 785 goto fault; 786 } 787 788 session->hid = hid; 789 790 hid->driver_data = session; 791 792 hid->bus = BUS_BLUETOOTH; 793 hid->vendor = req->vendor; 794 hid->product = req->product; 795 hid->version = req->version; 796 hid->country = req->country; 797 798 strscpy(hid->name, req->name, sizeof(hid->name)); 799 800 snprintf(hid->phys, sizeof(hid->phys), "%pMR", 801 &l2cap_pi(session->ctrl_sock->sk)->chan->src); 802 803 /* NOTE: Some device modules depend on the dst address being stored in 804 * uniq. Please be aware of this before making changes to this behavior. 805 */ 806 snprintf(hid->uniq, sizeof(hid->uniq), "%pMR", 807 &l2cap_pi(session->ctrl_sock->sk)->chan->dst); 808 809 hid->dev.parent = &session->conn->hcon->dev; 810 hid->ll_driver = &hidp_hid_driver; 811 812 /* True if device is blocked in drivers/hid/hid-quirks.c */ 813 if (hid_ignore(hid)) { 814 hid_destroy_device(session->hid); 815 session->hid = NULL; 816 return -ENODEV; 817 } 818 819 return 0; 820 821 fault: 822 kfree(session->rd_data); 823 session->rd_data = NULL; 824 825 return err; 826 } 827 828 /* initialize session devices */ 829 static int hidp_session_dev_init(struct hidp_session *session, 830 const struct hidp_connadd_req *req) 831 { 832 int ret; 833 834 if (req->rd_size > 0) { 835 ret = hidp_setup_hid(session, req); 836 if (ret && ret != -ENODEV) 837 return ret; 838 } 839 840 if (!session->hid) { 841 ret = hidp_setup_input(session, req); 842 if (ret < 0) 843 return ret; 844 } 845 846 return 0; 847 } 848 849 /* destroy session devices */ 850 static void hidp_session_dev_destroy(struct hidp_session *session) 851 { 852 if (session->hid) 853 put_device(&session->hid->dev); 854 else if (session->input) 855 input_put_device(session->input); 856 857 kfree(session->rd_data); 858 session->rd_data = NULL; 859 } 860 861 /* add HID/input devices to their underlying bus systems */ 862 static int hidp_session_dev_add(struct hidp_session *session) 863 { 864 int ret; 865 866 /* Both HID and input systems drop a ref-count when unregistering the 867 * device but they don't take a ref-count when registering them. Work 868 * around this by explicitly taking a refcount during registration 869 * which is dropped automatically by unregistering the devices. */ 870 871 if (session->hid) { 872 ret = hid_add_device(session->hid); 873 if (ret) 874 return ret; 875 get_device(&session->hid->dev); 876 } else if (session->input) { 877 ret = input_register_device(session->input); 878 if (ret) 879 return ret; 880 input_get_device(session->input); 881 } 882 883 return 0; 884 } 885 886 /* remove HID/input devices from their bus systems */ 887 static void hidp_session_dev_del(struct hidp_session *session) 888 { 889 if (session->hid) 890 hid_destroy_device(session->hid); 891 else if (session->input) 892 input_unregister_device(session->input); 893 } 894 895 /* 896 * Asynchronous device registration 897 * HID device drivers might want to perform I/O during initialization to 898 * detect device types. Therefore, call device registration in a separate 899 * worker so the HIDP thread can schedule I/O operations. 900 * Note that this must be called after the worker thread was initialized 901 * successfully. This will then add the devices and increase session state 902 * on success, otherwise it will terminate the session thread. 903 */ 904 static void hidp_session_dev_work(struct work_struct *work) 905 { 906 struct hidp_session *session = container_of(work, 907 struct hidp_session, 908 dev_init); 909 int ret; 910 911 ret = hidp_session_dev_add(session); 912 if (!ret) 913 atomic_inc(&session->state); 914 else 915 hidp_session_terminate(session); 916 } 917 918 /* 919 * Create new session object 920 * Allocate session object, initialize static fields, copy input data into the 921 * object and take a reference to all sub-objects. 922 * This returns 0 on success and puts a pointer to the new session object in 923 * \out. Otherwise, an error code is returned. 924 * The new session object has an initial ref-count of 1. 925 */ 926 static int hidp_session_new(struct hidp_session **out, const bdaddr_t *bdaddr, 927 struct socket *ctrl_sock, 928 struct socket *intr_sock, 929 const struct hidp_connadd_req *req, 930 struct l2cap_conn *conn) 931 { 932 struct hidp_session *session; 933 int ret; 934 struct bt_sock *ctrl, *intr; 935 936 ctrl = bt_sk(ctrl_sock->sk); 937 intr = bt_sk(intr_sock->sk); 938 939 session = kzalloc_obj(*session); 940 if (!session) 941 return -ENOMEM; 942 943 /* object and runtime management */ 944 kref_init(&session->ref); 945 atomic_set(&session->state, HIDP_SESSION_IDLING); 946 init_waitqueue_head(&session->state_queue); 947 session->flags = req->flags & BIT(HIDP_BLUETOOTH_VENDOR_ID); 948 949 /* connection management */ 950 bacpy(&session->bdaddr, bdaddr); 951 session->conn = l2cap_conn_get(conn); 952 session->user.probe = hidp_session_probe; 953 session->user.remove = hidp_session_remove; 954 INIT_LIST_HEAD(&session->user.list); 955 session->ctrl_sock = ctrl_sock; 956 session->intr_sock = intr_sock; 957 skb_queue_head_init(&session->ctrl_transmit); 958 skb_queue_head_init(&session->intr_transmit); 959 session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl)->chan->omtu, 960 l2cap_pi(ctrl)->chan->imtu); 961 session->intr_mtu = min_t(uint, l2cap_pi(intr)->chan->omtu, 962 l2cap_pi(intr)->chan->imtu); 963 session->idle_to = req->idle_to; 964 965 /* device management */ 966 INIT_WORK(&session->dev_init, hidp_session_dev_work); 967 timer_setup(&session->timer, hidp_idle_timeout, 0); 968 969 /* session data */ 970 mutex_init(&session->report_mutex); 971 init_waitqueue_head(&session->report_queue); 972 973 ret = hidp_session_dev_init(session, req); 974 if (ret) 975 goto err_free; 976 977 get_file(session->intr_sock->file); 978 get_file(session->ctrl_sock->file); 979 *out = session; 980 return 0; 981 982 err_free: 983 l2cap_conn_put(session->conn); 984 kfree(session); 985 return ret; 986 } 987 988 /* increase ref-count of the given session by one */ 989 static void hidp_session_get(struct hidp_session *session) 990 { 991 kref_get(&session->ref); 992 } 993 994 /* release callback */ 995 static void session_free(struct kref *ref) 996 { 997 struct hidp_session *session = container_of(ref, struct hidp_session, 998 ref); 999 1000 hidp_session_dev_destroy(session); 1001 skb_queue_purge(&session->ctrl_transmit); 1002 skb_queue_purge(&session->intr_transmit); 1003 fput(session->intr_sock->file); 1004 fput(session->ctrl_sock->file); 1005 if (session->conn) 1006 l2cap_conn_put(session->conn); 1007 kfree(session); 1008 } 1009 1010 /* decrease ref-count of the given session by one */ 1011 static void hidp_session_put(struct hidp_session *session) 1012 { 1013 kref_put(&session->ref, session_free); 1014 } 1015 1016 /* 1017 * Search the list of active sessions for a session with target address 1018 * \bdaddr. You must hold at least a read-lock on \hidp_session_sem. As long as 1019 * you do not release this lock, the session objects cannot vanish and you can 1020 * safely take a reference to the session yourself. 1021 */ 1022 static struct hidp_session *__hidp_session_find(const bdaddr_t *bdaddr) 1023 { 1024 struct hidp_session *session; 1025 1026 list_for_each_entry(session, &hidp_session_list, list) { 1027 if (!bacmp(bdaddr, &session->bdaddr)) 1028 return session; 1029 } 1030 1031 return NULL; 1032 } 1033 1034 /* 1035 * Same as __hidp_session_find() but no locks must be held. This also takes a 1036 * reference of the returned session (if non-NULL) so you must drop this 1037 * reference if you no longer use the object. 1038 */ 1039 static struct hidp_session *hidp_session_find(const bdaddr_t *bdaddr) 1040 { 1041 struct hidp_session *session; 1042 1043 down_read(&hidp_session_sem); 1044 1045 session = __hidp_session_find(bdaddr); 1046 if (session) 1047 hidp_session_get(session); 1048 1049 up_read(&hidp_session_sem); 1050 1051 return session; 1052 } 1053 1054 /* 1055 * Consume session->conn: clear the member under hidp_session_sem, then 1056 * l2cap_unregister_user() and l2cap_conn_put() the snapshot outside the 1057 * sem. At most one caller wins; later callers see NULL and skip. The 1058 * reference is the one hidp_session_new() took via l2cap_conn_get(). 1059 */ 1060 static void hidp_session_unregister_conn(struct hidp_session *session) 1061 { 1062 struct l2cap_conn *conn; 1063 1064 down_write(&hidp_session_sem); 1065 conn = session->conn; 1066 if (conn) 1067 session->conn = NULL; 1068 up_write(&hidp_session_sem); 1069 1070 if (conn) { 1071 l2cap_unregister_user(conn, &session->user); 1072 l2cap_conn_put(conn); 1073 } 1074 } 1075 1076 /* 1077 * Start session synchronously 1078 * This starts a session thread and waits until initialization 1079 * is done or returns an error if it couldn't be started. 1080 * If this returns 0 the session thread is up and running. You must call 1081 * hipd_session_stop_sync() before deleting any runtime resources. 1082 */ 1083 static int hidp_session_start_sync(struct hidp_session *session) 1084 { 1085 unsigned int vendor, product; 1086 1087 if (session->hid) { 1088 vendor = session->hid->vendor; 1089 product = session->hid->product; 1090 } else if (session->input) { 1091 vendor = session->input->id.vendor; 1092 product = session->input->id.product; 1093 } else { 1094 vendor = 0x0000; 1095 product = 0x0000; 1096 } 1097 1098 session->task = kthread_run(hidp_session_thread, session, 1099 "khidpd_%04x%04x", vendor, product); 1100 if (IS_ERR(session->task)) 1101 return PTR_ERR(session->task); 1102 1103 while (atomic_read(&session->state) <= HIDP_SESSION_IDLING) 1104 wait_event(session->state_queue, 1105 atomic_read(&session->state) > HIDP_SESSION_IDLING); 1106 1107 return 0; 1108 } 1109 1110 /* 1111 * Terminate session thread 1112 * Wake up session thread and notify it to stop. This is asynchronous and 1113 * returns immediately. Call this whenever a runtime error occurs and you want 1114 * the session to stop. 1115 * Note: wake_up_interruptible() performs any necessary memory-barriers for us. 1116 */ 1117 static void hidp_session_terminate(struct hidp_session *session) 1118 { 1119 atomic_inc(&session->terminate); 1120 /* 1121 * See the comment preceding the call to wait_woken() 1122 * in hidp_session_run(). 1123 */ 1124 wake_up_interruptible(&hidp_session_wq); 1125 } 1126 1127 /* 1128 * Probe HIDP session 1129 * This is called from the l2cap_conn core when our l2cap_user object is bound 1130 * to the hci-connection. We get the session via the \user object and can now 1131 * start the session thread, link it into the global session list and 1132 * schedule HID/input device registration. 1133 * The global session-list owns its own reference to the session object so you 1134 * can drop your own reference after registering the l2cap_user object. 1135 */ 1136 static int hidp_session_probe(struct l2cap_conn *conn, 1137 struct l2cap_user *user) 1138 { 1139 struct hidp_session *session = container_of(user, 1140 struct hidp_session, 1141 user); 1142 struct hidp_session *s; 1143 int ret; 1144 1145 down_write(&hidp_session_sem); 1146 1147 /* check that no other session for this device exists */ 1148 s = __hidp_session_find(&session->bdaddr); 1149 if (s) { 1150 ret = -EEXIST; 1151 goto out_unlock; 1152 } 1153 1154 if (session->input) { 1155 ret = hidp_session_dev_add(session); 1156 if (ret) 1157 goto out_unlock; 1158 } 1159 1160 ret = hidp_session_start_sync(session); 1161 if (ret) 1162 goto out_del; 1163 1164 /* HID device registration is async to allow I/O during probe */ 1165 if (session->input) 1166 atomic_inc(&session->state); 1167 else 1168 schedule_work(&session->dev_init); 1169 1170 hidp_session_get(session); 1171 list_add(&session->list, &hidp_session_list); 1172 ret = 0; 1173 goto out_unlock; 1174 1175 out_del: 1176 if (session->input) 1177 hidp_session_dev_del(session); 1178 out_unlock: 1179 up_write(&hidp_session_sem); 1180 return ret; 1181 } 1182 1183 /* 1184 * Remove HIDP session 1185 * Called from the l2cap_conn core when either we explicitly unregistered 1186 * the l2cap_user object or if the underlying connection is shut down. 1187 * We signal the hidp-session thread to shut down, unregister the HID/input 1188 * devices and unlink the session from the global list. 1189 * This drops the reference to the session that is owned by the global 1190 * session-list. 1191 * Note: We _must_ not synchronosly wait for the session-thread to shut down. 1192 * This is, because the session-thread might be waiting for an HCI lock that is 1193 * held while we are called. Therefore, we only unregister the devices and 1194 * notify the session-thread to terminate. The thread itself owns a reference 1195 * to the session object so it can safely shut down. 1196 */ 1197 static void hidp_session_remove(struct l2cap_conn *conn, 1198 struct l2cap_user *user) 1199 { 1200 struct hidp_session *session = container_of(user, 1201 struct hidp_session, 1202 user); 1203 1204 down_write(&hidp_session_sem); 1205 1206 /* Drop L2CAP reference immediately to indicate that 1207 * l2cap_unregister_user() shall not be called as it is already 1208 * considered removed. 1209 */ 1210 if (session->conn) { 1211 l2cap_conn_put(session->conn); 1212 session->conn = NULL; 1213 } 1214 1215 hidp_session_terminate(session); 1216 1217 cancel_work_sync(&session->dev_init); 1218 if (session->input || 1219 atomic_read(&session->state) > HIDP_SESSION_PREPARING) 1220 hidp_session_dev_del(session); 1221 1222 list_del(&session->list); 1223 1224 up_write(&hidp_session_sem); 1225 1226 hidp_session_put(session); 1227 } 1228 1229 /* 1230 * Session Worker 1231 * This performs the actual main-loop of the HIDP worker. We first check 1232 * whether the underlying connection is still alive, then parse all pending 1233 * messages and finally send all outstanding messages. 1234 */ 1235 static void hidp_session_run(struct hidp_session *session) 1236 { 1237 struct sock *ctrl_sk = session->ctrl_sock->sk; 1238 struct sock *intr_sk = session->intr_sock->sk; 1239 struct sk_buff *skb; 1240 DEFINE_WAIT_FUNC(wait, woken_wake_function); 1241 1242 add_wait_queue(&hidp_session_wq, &wait); 1243 for (;;) { 1244 /* 1245 * This thread can be woken up two ways: 1246 * - You call hidp_session_terminate() which sets the 1247 * session->terminate flag and wakes this thread up. 1248 * - Via modifying the socket state of ctrl/intr_sock. This 1249 * thread is woken up by ->sk_state_changed(). 1250 */ 1251 1252 if (atomic_read(&session->terminate)) 1253 break; 1254 1255 if (ctrl_sk->sk_state != BT_CONNECTED || 1256 intr_sk->sk_state != BT_CONNECTED) 1257 break; 1258 1259 /* parse incoming intr-skbs */ 1260 while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) { 1261 skb_orphan(skb); 1262 if (!skb_linearize(skb)) 1263 hidp_recv_intr_frame(session, skb); 1264 else 1265 kfree_skb(skb); 1266 } 1267 1268 /* send pending intr-skbs */ 1269 hidp_process_transmit(session, &session->intr_transmit, 1270 session->intr_sock); 1271 1272 /* parse incoming ctrl-skbs */ 1273 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) { 1274 skb_orphan(skb); 1275 if (!skb_linearize(skb)) 1276 hidp_recv_ctrl_frame(session, skb); 1277 else 1278 kfree_skb(skb); 1279 } 1280 1281 /* send pending ctrl-skbs */ 1282 hidp_process_transmit(session, &session->ctrl_transmit, 1283 session->ctrl_sock); 1284 1285 /* 1286 * wait_woken() performs the necessary memory barriers 1287 * for us; see the header comment for this primitive. 1288 */ 1289 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 1290 } 1291 remove_wait_queue(&hidp_session_wq, &wait); 1292 1293 atomic_inc(&session->terminate); 1294 } 1295 1296 static int hidp_session_wake_function(wait_queue_entry_t *wait, 1297 unsigned int mode, 1298 int sync, void *key) 1299 { 1300 wake_up_interruptible(&hidp_session_wq); 1301 return false; 1302 } 1303 1304 /* 1305 * HIDP session thread 1306 * This thread runs the I/O for a single HIDP session. Startup is synchronous 1307 * which allows us to take references to ourself here instead of doing that in 1308 * the caller. 1309 * When we are ready to run we notify the caller and call hidp_session_run(). 1310 */ 1311 static int hidp_session_thread(void *arg) 1312 { 1313 struct hidp_session *session = arg; 1314 DEFINE_WAIT_FUNC(ctrl_wait, hidp_session_wake_function); 1315 DEFINE_WAIT_FUNC(intr_wait, hidp_session_wake_function); 1316 1317 BT_DBG("session %p", session); 1318 1319 /* initialize runtime environment */ 1320 hidp_session_get(session); 1321 __module_get(THIS_MODULE); 1322 set_user_nice(current, -15); 1323 hidp_set_timer(session); 1324 1325 add_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait); 1326 add_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait); 1327 /* This memory barrier is paired with wq_has_sleeper(). See 1328 * sock_poll_wait() for more information why this is needed. */ 1329 smp_mb__before_atomic(); 1330 1331 /* notify synchronous startup that we're ready */ 1332 atomic_inc(&session->state); 1333 wake_up(&session->state_queue); 1334 1335 /* run session */ 1336 hidp_session_run(session); 1337 1338 /* cleanup runtime environment */ 1339 remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait); 1340 remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait); 1341 wake_up_interruptible(&session->report_queue); 1342 hidp_del_timer(session); 1343 1344 /* 1345 * If we stopped ourself due to any internal signal, we should try to 1346 * unregister our own session here to avoid having it linger until the 1347 * parent l2cap_conn dies or user-space cleans it up. 1348 * This does not deadlock as we don't do any synchronous shutdown. 1349 * Instead, this call has the same semantics as if user-space tried to 1350 * delete the session. 1351 */ 1352 hidp_session_unregister_conn(session); 1353 1354 hidp_session_put(session); 1355 1356 module_put_and_kthread_exit(0); 1357 return 0; 1358 } 1359 1360 static int hidp_verify_sockets(struct socket *ctrl_sock, 1361 struct socket *intr_sock) 1362 { 1363 struct l2cap_chan *ctrl_chan, *intr_chan; 1364 struct bt_sock *ctrl, *intr; 1365 struct hidp_session *session; 1366 1367 if (!l2cap_is_socket(ctrl_sock) || !l2cap_is_socket(intr_sock)) 1368 return -EINVAL; 1369 1370 ctrl_chan = l2cap_pi(ctrl_sock->sk)->chan; 1371 intr_chan = l2cap_pi(intr_sock->sk)->chan; 1372 1373 if (bacmp(&ctrl_chan->src, &intr_chan->src) || 1374 bacmp(&ctrl_chan->dst, &intr_chan->dst)) 1375 return -ENOTUNIQ; 1376 1377 ctrl = bt_sk(ctrl_sock->sk); 1378 intr = bt_sk(intr_sock->sk); 1379 1380 if (ctrl->sk.sk_state != BT_CONNECTED || 1381 intr->sk.sk_state != BT_CONNECTED) 1382 return -EBADFD; 1383 1384 /* early session check, we check again during session registration */ 1385 session = hidp_session_find(&ctrl_chan->dst); 1386 if (session) { 1387 hidp_session_put(session); 1388 return -EEXIST; 1389 } 1390 1391 return 0; 1392 } 1393 1394 int hidp_connection_add(const struct hidp_connadd_req *req, 1395 struct socket *ctrl_sock, 1396 struct socket *intr_sock) 1397 { 1398 u32 valid_flags = BIT(HIDP_VIRTUAL_CABLE_UNPLUG) | 1399 BIT(HIDP_BOOT_PROTOCOL_MODE); 1400 struct hidp_session *session; 1401 struct l2cap_conn *conn; 1402 struct l2cap_chan *chan; 1403 int ret; 1404 1405 ret = hidp_verify_sockets(ctrl_sock, intr_sock); 1406 if (ret) 1407 return ret; 1408 1409 if (req->flags & ~valid_flags) 1410 return -EINVAL; 1411 1412 chan = l2cap_pi(ctrl_sock->sk)->chan; 1413 conn = NULL; 1414 l2cap_chan_lock(chan); 1415 if (chan->conn) 1416 conn = l2cap_conn_get(chan->conn); 1417 l2cap_chan_unlock(chan); 1418 1419 if (!conn) 1420 return -EBADFD; 1421 1422 ret = hidp_session_new(&session, &chan->dst, ctrl_sock, 1423 intr_sock, req, conn); 1424 if (ret) 1425 goto out_conn; 1426 1427 ret = l2cap_register_user(conn, &session->user); 1428 if (ret) 1429 goto out_session; 1430 1431 ret = 0; 1432 1433 out_session: 1434 hidp_session_put(session); 1435 out_conn: 1436 l2cap_conn_put(conn); 1437 return ret; 1438 } 1439 1440 int hidp_connection_del(struct hidp_conndel_req *req) 1441 { 1442 u32 valid_flags = BIT(HIDP_VIRTUAL_CABLE_UNPLUG); 1443 struct hidp_session *session; 1444 1445 if (req->flags & ~valid_flags) 1446 return -EINVAL; 1447 1448 session = hidp_session_find(&req->bdaddr); 1449 if (!session) 1450 return -ENOENT; 1451 1452 if (req->flags & BIT(HIDP_VIRTUAL_CABLE_UNPLUG)) 1453 hidp_send_ctrl_message(session, 1454 HIDP_TRANS_HID_CONTROL | 1455 HIDP_CTRL_VIRTUAL_CABLE_UNPLUG, 1456 NULL, 0); 1457 else 1458 hidp_session_unregister_conn(session); 1459 1460 hidp_session_put(session); 1461 1462 return 0; 1463 } 1464 1465 int hidp_get_connlist(struct hidp_connlist_req *req) 1466 { 1467 struct hidp_session *session; 1468 int err = 0, n = 0; 1469 1470 BT_DBG(""); 1471 1472 down_read(&hidp_session_sem); 1473 1474 list_for_each_entry(session, &hidp_session_list, list) { 1475 struct hidp_conninfo ci; 1476 1477 hidp_copy_session(session, &ci); 1478 1479 if (copy_to_user(req->ci, &ci, sizeof(ci))) { 1480 err = -EFAULT; 1481 break; 1482 } 1483 1484 if (++n >= req->cnum) 1485 break; 1486 1487 req->ci++; 1488 } 1489 req->cnum = n; 1490 1491 up_read(&hidp_session_sem); 1492 return err; 1493 } 1494 1495 int hidp_get_conninfo(struct hidp_conninfo *ci) 1496 { 1497 struct hidp_session *session; 1498 1499 session = hidp_session_find(&ci->bdaddr); 1500 if (session) { 1501 hidp_copy_session(session, ci); 1502 hidp_session_put(session); 1503 } 1504 1505 return session ? 0 : -ENOENT; 1506 } 1507 1508 static int __init hidp_init(void) 1509 { 1510 BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION); 1511 1512 return hidp_init_sockets(); 1513 } 1514 1515 static void __exit hidp_exit(void) 1516 { 1517 hidp_cleanup_sockets(); 1518 } 1519 1520 module_init(hidp_init); 1521 module_exit(hidp_exit); 1522 1523 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 1524 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>"); 1525 MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION); 1526 MODULE_VERSION(VERSION); 1527 MODULE_LICENSE("GPL"); 1528 MODULE_ALIAS("bt-proto-6"); 1529