Back to home page

OSCL-LXR
 
 

     

0001 /*
0002    HIDP implementation for Linux Bluetooth stack (BlueZ).
0003    Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
0004    Copyright (C) 2013 David Herrmann <dh.herrmann@gmail.com>
0005 
0006    This program is free software; you can redistribute it and/or modify
0007    it under the terms of the GNU General Public License version 2 as
0008    published by the Free Software Foundation;
0009 
0010    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
0011    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
0012    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
0013    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
0014    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
0015    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
0016    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
0017    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
0018 
0019    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
0020    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
0021    SOFTWARE IS DISCLAIMED.
0022 */
0023 
0024 #include <linux/kref.h>
0025 #include <linux/module.h>
0026 #include <linux/file.h>
0027 #include <linux/kthread.h>
0028 #include <linux/hidraw.h>
0029 
0030 #include <net/bluetooth/bluetooth.h>
0031 #include <net/bluetooth/hci_core.h>
0032 #include <net/bluetooth/l2cap.h>
0033 
0034 #include "hidp.h"
0035 
0036 #define VERSION "1.2"
0037 
0038 static DECLARE_RWSEM(hidp_session_sem);
0039 static DECLARE_WAIT_QUEUE_HEAD(hidp_session_wq);
0040 static LIST_HEAD(hidp_session_list);
0041 
0042 static unsigned char hidp_keycode[256] = {
0043       0,   0,   0,   0,  30,  48,  46,  32,  18,  33,  34,  35,  23,  36,
0044      37,  38,  50,  49,  24,  25,  16,  19,  31,  20,  22,  47,  17,  45,
0045      21,  44,   2,   3,   4,   5,   6,   7,   8,   9,  10,  11,  28,   1,
0046      14,  15,  57,  12,  13,  26,  27,  43,  43,  39,  40,  41,  51,  52,
0047      53,  58,  59,  60,  61,  62,  63,  64,  65,  66,  67,  68,  87,  88,
0048      99,  70, 119, 110, 102, 104, 111, 107, 109, 106, 105, 108, 103,  69,
0049      98,  55,  74,  78,  96,  79,  80,  81,  75,  76,  77,  71,  72,  73,
0050      82,  83,  86, 127, 116, 117, 183, 184, 185, 186, 187, 188, 189, 190,
0051     191, 192, 193, 194, 134, 138, 130, 132, 128, 129, 131, 137, 133, 135,
0052     136, 113, 115, 114,   0,   0,   0, 121,   0,  89,  93, 124,  92,  94,
0053      95,   0,   0,   0, 122, 123,  90,  91,  85,   0,   0,   0,   0,   0,
0054       0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
0055       0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
0056       0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
0057       0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
0058       0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
0059      29,  42,  56, 125,  97,  54, 100, 126, 164, 166, 165, 163, 161, 115,
0060     114, 113, 150, 158, 159, 128, 136, 177, 178, 176, 142, 152, 173, 140
0061 };
0062 
0063 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
0064 
0065 static int hidp_session_probe(struct l2cap_conn *conn,
0066                   struct l2cap_user *user);
0067 static void hidp_session_remove(struct l2cap_conn *conn,
0068                 struct l2cap_user *user);
0069 static int hidp_session_thread(void *arg);
0070 static void hidp_session_terminate(struct hidp_session *s);
0071 
0072 static void hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
0073 {
0074     u32 valid_flags = 0;
0075     memset(ci, 0, sizeof(*ci));
0076     bacpy(&ci->bdaddr, &session->bdaddr);
0077 
0078     ci->flags = session->flags & valid_flags;
0079     ci->state = BT_CONNECTED;
0080 
0081     if (session->input) {
0082         ci->vendor  = session->input->id.vendor;
0083         ci->product = session->input->id.product;
0084         ci->version = session->input->id.version;
0085         if (session->input->name)
0086             strscpy(ci->name, session->input->name, 128);
0087         else
0088             strscpy(ci->name, "HID Boot Device", 128);
0089     } else if (session->hid) {
0090         ci->vendor  = session->hid->vendor;
0091         ci->product = session->hid->product;
0092         ci->version = session->hid->version;
0093         strscpy(ci->name, session->hid->name, 128);
0094     }
0095 }
0096 
0097 /* assemble skb, queue message on @transmit and wake up the session thread */
0098 static int hidp_send_message(struct hidp_session *session, struct socket *sock,
0099                  struct sk_buff_head *transmit, unsigned char hdr,
0100                  const unsigned char *data, int size)
0101 {
0102     struct sk_buff *skb;
0103     struct sock *sk = sock->sk;
0104     int ret;
0105 
0106     BT_DBG("session %p data %p size %d", session, data, size);
0107 
0108     if (atomic_read(&session->terminate))
0109         return -EIO;
0110 
0111     skb = alloc_skb(size + 1, GFP_ATOMIC);
0112     if (!skb) {
0113         BT_ERR("Can't allocate memory for new frame");
0114         return -ENOMEM;
0115     }
0116 
0117     skb_put_u8(skb, hdr);
0118     if (data && size > 0) {
0119         skb_put_data(skb, data, size);
0120         ret = size;
0121     } else {
0122         ret = 0;
0123     }
0124 
0125     skb_queue_tail(transmit, skb);
0126     wake_up_interruptible(sk_sleep(sk));
0127 
0128     return ret;
0129 }
0130 
0131 static int hidp_send_ctrl_message(struct hidp_session *session,
0132                   unsigned char hdr, const unsigned char *data,
0133                   int size)
0134 {
0135     return hidp_send_message(session, session->ctrl_sock,
0136                  &session->ctrl_transmit, hdr, data, size);
0137 }
0138 
0139 static int hidp_send_intr_message(struct hidp_session *session,
0140                   unsigned char hdr, const unsigned char *data,
0141                   int size)
0142 {
0143     return hidp_send_message(session, session->intr_sock,
0144                  &session->intr_transmit, hdr, data, size);
0145 }
0146 
0147 static int hidp_input_event(struct input_dev *dev, unsigned int type,
0148                 unsigned int code, int value)
0149 {
0150     struct hidp_session *session = input_get_drvdata(dev);
0151     unsigned char newleds;
0152     unsigned char hdr, data[2];
0153 
0154     BT_DBG("session %p type %d code %d value %d",
0155            session, type, code, value);
0156 
0157     if (type != EV_LED)
0158         return -1;
0159 
0160     newleds = (!!test_bit(LED_KANA,    dev->led) << 3) |
0161           (!!test_bit(LED_COMPOSE, dev->led) << 3) |
0162           (!!test_bit(LED_SCROLLL, dev->led) << 2) |
0163           (!!test_bit(LED_CAPSL,   dev->led) << 1) |
0164           (!!test_bit(LED_NUML,    dev->led) << 0);
0165 
0166     if (session->leds == newleds)
0167         return 0;
0168 
0169     session->leds = newleds;
0170 
0171     hdr = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
0172     data[0] = 0x01;
0173     data[1] = newleds;
0174 
0175     return hidp_send_intr_message(session, hdr, data, 2);
0176 }
0177 
0178 static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
0179 {
0180     struct input_dev *dev = session->input;
0181     unsigned char *keys = session->keys;
0182     unsigned char *udata = skb->data + 1;
0183     signed char *sdata = skb->data + 1;
0184     int i, size = skb->len - 1;
0185 
0186     switch (skb->data[0]) {
0187     case 0x01:  /* Keyboard report */
0188         for (i = 0; i < 8; i++)
0189             input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
0190 
0191         /* If all the key codes have been set to 0x01, it means
0192          * too many keys were pressed at the same time. */
0193         if (!memcmp(udata + 2, hidp_mkeyspat, 6))
0194             break;
0195 
0196         for (i = 2; i < 8; i++) {
0197             if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) {
0198                 if (hidp_keycode[keys[i]])
0199                     input_report_key(dev, hidp_keycode[keys[i]], 0);
0200                 else
0201                     BT_ERR("Unknown key (scancode %#x) released.", keys[i]);
0202             }
0203 
0204             if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) {
0205                 if (hidp_keycode[udata[i]])
0206                     input_report_key(dev, hidp_keycode[udata[i]], 1);
0207                 else
0208                     BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]);
0209             }
0210         }
0211 
0212         memcpy(keys, udata, 8);
0213         break;
0214 
0215     case 0x02:  /* Mouse report */
0216         input_report_key(dev, BTN_LEFT,   sdata[0] & 0x01);
0217         input_report_key(dev, BTN_RIGHT,  sdata[0] & 0x02);
0218         input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
0219         input_report_key(dev, BTN_SIDE,   sdata[0] & 0x08);
0220         input_report_key(dev, BTN_EXTRA,  sdata[0] & 0x10);
0221 
0222         input_report_rel(dev, REL_X, sdata[1]);
0223         input_report_rel(dev, REL_Y, sdata[2]);
0224 
0225         if (size > 3)
0226             input_report_rel(dev, REL_WHEEL, sdata[3]);
0227         break;
0228     }
0229 
0230     input_sync(dev);
0231 }
0232 
0233 static int hidp_get_raw_report(struct hid_device *hid,
0234         unsigned char report_number,
0235         unsigned char *data, size_t count,
0236         unsigned char report_type)
0237 {
0238     struct hidp_session *session = hid->driver_data;
0239     struct sk_buff *skb;
0240     size_t len;
0241     int numbered_reports = hid->report_enum[report_type].numbered;
0242     int ret;
0243 
0244     if (atomic_read(&session->terminate))
0245         return -EIO;
0246 
0247     switch (report_type) {
0248     case HID_FEATURE_REPORT:
0249         report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_FEATURE;
0250         break;
0251     case HID_INPUT_REPORT:
0252         report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_INPUT;
0253         break;
0254     case HID_OUTPUT_REPORT:
0255         report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_OUPUT;
0256         break;
0257     default:
0258         return -EINVAL;
0259     }
0260 
0261     if (mutex_lock_interruptible(&session->report_mutex))
0262         return -ERESTARTSYS;
0263 
0264     /* Set up our wait, and send the report request to the device. */
0265     session->waiting_report_type = report_type & HIDP_DATA_RTYPE_MASK;
0266     session->waiting_report_number = numbered_reports ? report_number : -1;
0267     set_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
0268     data[0] = report_number;
0269     ret = hidp_send_ctrl_message(session, report_type, data, 1);
0270     if (ret < 0)
0271         goto err;
0272 
0273     /* Wait for the return of the report. The returned report
0274        gets put in session->report_return.  */
0275     while (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) &&
0276            !atomic_read(&session->terminate)) {
0277         int res;
0278 
0279         res = wait_event_interruptible_timeout(session->report_queue,
0280             !test_bit(HIDP_WAITING_FOR_RETURN, &session->flags)
0281                 || atomic_read(&session->terminate),
0282             5*HZ);
0283         if (res == 0) {
0284             /* timeout */
0285             ret = -EIO;
0286             goto err;
0287         }
0288         if (res < 0) {
0289             /* signal */
0290             ret = -ERESTARTSYS;
0291             goto err;
0292         }
0293     }
0294 
0295     skb = session->report_return;
0296     if (skb) {
0297         len = skb->len < count ? skb->len : count;
0298         memcpy(data, skb->data, len);
0299 
0300         kfree_skb(skb);
0301         session->report_return = NULL;
0302     } else {
0303         /* Device returned a HANDSHAKE, indicating  protocol error. */
0304         len = -EIO;
0305     }
0306 
0307     clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
0308     mutex_unlock(&session->report_mutex);
0309 
0310     return len;
0311 
0312 err:
0313     clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
0314     mutex_unlock(&session->report_mutex);
0315     return ret;
0316 }
0317 
0318 static int hidp_set_raw_report(struct hid_device *hid, unsigned char reportnum,
0319                    unsigned char *data, size_t count,
0320                    unsigned char report_type)
0321 {
0322     struct hidp_session *session = hid->driver_data;
0323     int ret;
0324 
0325     switch (report_type) {
0326     case HID_FEATURE_REPORT:
0327         report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
0328         break;
0329     case HID_INPUT_REPORT:
0330         report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_INPUT;
0331         break;
0332     case HID_OUTPUT_REPORT:
0333         report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_OUPUT;
0334         break;
0335     default:
0336         return -EINVAL;
0337     }
0338 
0339     if (mutex_lock_interruptible(&session->report_mutex))
0340         return -ERESTARTSYS;
0341 
0342     /* Set up our wait, and send the report request to the device. */
0343     data[0] = reportnum;
0344     set_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
0345     ret = hidp_send_ctrl_message(session, report_type, data, count);
0346     if (ret < 0)
0347         goto err;
0348 
0349     /* Wait for the ACK from the device. */
0350     while (test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags) &&
0351            !atomic_read(&session->terminate)) {
0352         int res;
0353 
0354         res = wait_event_interruptible_timeout(session->report_queue,
0355             !test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags)
0356                 || atomic_read(&session->terminate),
0357             10*HZ);
0358         if (res == 0) {
0359             /* timeout */
0360             ret = -EIO;
0361             goto err;
0362         }
0363         if (res < 0) {
0364             /* signal */
0365             ret = -ERESTARTSYS;
0366             goto err;
0367         }
0368     }
0369 
0370     if (!session->output_report_success) {
0371         ret = -EIO;
0372         goto err;
0373     }
0374 
0375     ret = count;
0376 
0377 err:
0378     clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
0379     mutex_unlock(&session->report_mutex);
0380     return ret;
0381 }
0382 
0383 static int hidp_output_report(struct hid_device *hid, __u8 *data, size_t count)
0384 {
0385     struct hidp_session *session = hid->driver_data;
0386 
0387     return hidp_send_intr_message(session,
0388                       HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT,
0389                       data, count);
0390 }
0391 
0392 static int hidp_raw_request(struct hid_device *hid, unsigned char reportnum,
0393                 __u8 *buf, size_t len, unsigned char rtype,
0394                 int reqtype)
0395 {
0396     switch (reqtype) {
0397     case HID_REQ_GET_REPORT:
0398         return hidp_get_raw_report(hid, reportnum, buf, len, rtype);
0399     case HID_REQ_SET_REPORT:
0400         return hidp_set_raw_report(hid, reportnum, buf, len, rtype);
0401     default:
0402         return -EIO;
0403     }
0404 }
0405 
0406 static void hidp_idle_timeout(struct timer_list *t)
0407 {
0408     struct hidp_session *session = from_timer(session, t, timer);
0409 
0410     /* The HIDP user-space API only contains calls to add and remove
0411      * devices. There is no way to forward events of any kind. Therefore,
0412      * we have to forcefully disconnect a device on idle-timeouts. This is
0413      * unfortunate and weird API design, but it is spec-compliant and
0414      * required for backwards-compatibility. Hence, on idle-timeout, we
0415      * signal driver-detach events, so poll() will be woken up with an
0416      * error-condition on both sockets.
0417      */
0418 
0419     session->intr_sock->sk->sk_err = EUNATCH;
0420     session->ctrl_sock->sk->sk_err = EUNATCH;
0421     wake_up_interruptible(sk_sleep(session->intr_sock->sk));
0422     wake_up_interruptible(sk_sleep(session->ctrl_sock->sk));
0423 
0424     hidp_session_terminate(session);
0425 }
0426 
0427 static void hidp_set_timer(struct hidp_session *session)
0428 {
0429     if (session->idle_to > 0)
0430         mod_timer(&session->timer, jiffies + HZ * session->idle_to);
0431 }
0432 
0433 static void hidp_del_timer(struct hidp_session *session)
0434 {
0435     if (session->idle_to > 0)
0436         del_timer(&session->timer);
0437 }
0438 
0439 static void hidp_process_report(struct hidp_session *session, int type,
0440                 const u8 *data, unsigned int len, int intr)
0441 {
0442     if (len > HID_MAX_BUFFER_SIZE)
0443         len = HID_MAX_BUFFER_SIZE;
0444 
0445     memcpy(session->input_buf, data, len);
0446     hid_input_report(session->hid, type, session->input_buf, len, intr);
0447 }
0448 
0449 static void hidp_process_handshake(struct hidp_session *session,
0450                     unsigned char param)
0451 {
0452     BT_DBG("session %p param 0x%02x", session, param);
0453     session->output_report_success = 0; /* default condition */
0454 
0455     switch (param) {
0456     case HIDP_HSHK_SUCCESSFUL:
0457         /* FIXME: Call into SET_ GET_ handlers here */
0458         session->output_report_success = 1;
0459         break;
0460 
0461     case HIDP_HSHK_NOT_READY:
0462     case HIDP_HSHK_ERR_INVALID_REPORT_ID:
0463     case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
0464     case HIDP_HSHK_ERR_INVALID_PARAMETER:
0465         if (test_and_clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags))
0466             wake_up_interruptible(&session->report_queue);
0467 
0468         /* FIXME: Call into SET_ GET_ handlers here */
0469         break;
0470 
0471     case HIDP_HSHK_ERR_UNKNOWN:
0472         break;
0473 
0474     case HIDP_HSHK_ERR_FATAL:
0475         /* Device requests a reboot, as this is the only way this error
0476          * can be recovered. */
0477         hidp_send_ctrl_message(session,
0478             HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0);
0479         break;
0480 
0481     default:
0482         hidp_send_ctrl_message(session,
0483             HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
0484         break;
0485     }
0486 
0487     /* Wake up the waiting thread. */
0488     if (test_and_clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags))
0489         wake_up_interruptible(&session->report_queue);
0490 }
0491 
0492 static void hidp_process_hid_control(struct hidp_session *session,
0493                     unsigned char param)
0494 {
0495     BT_DBG("session %p param 0x%02x", session, param);
0496 
0497     if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) {
0498         /* Flush the transmit queues */
0499         skb_queue_purge(&session->ctrl_transmit);
0500         skb_queue_purge(&session->intr_transmit);
0501 
0502         hidp_session_terminate(session);
0503     }
0504 }
0505 
0506 /* Returns true if the passed-in skb should be freed by the caller. */
0507 static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
0508                 unsigned char param)
0509 {
0510     int done_with_skb = 1;
0511     BT_DBG("session %p skb %p len %u param 0x%02x", session, skb, skb->len, param);
0512 
0513     switch (param) {
0514     case HIDP_DATA_RTYPE_INPUT:
0515         hidp_set_timer(session);
0516 
0517         if (session->input)
0518             hidp_input_report(session, skb);
0519 
0520         if (session->hid)
0521             hidp_process_report(session, HID_INPUT_REPORT,
0522                         skb->data, skb->len, 0);
0523         break;
0524 
0525     case HIDP_DATA_RTYPE_OTHER:
0526     case HIDP_DATA_RTYPE_OUPUT:
0527     case HIDP_DATA_RTYPE_FEATURE:
0528         break;
0529 
0530     default:
0531         hidp_send_ctrl_message(session,
0532             HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
0533     }
0534 
0535     if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) &&
0536                 param == session->waiting_report_type) {
0537         if (session->waiting_report_number < 0 ||
0538             session->waiting_report_number == skb->data[0]) {
0539             /* hidp_get_raw_report() is waiting on this report. */
0540             session->report_return = skb;
0541             done_with_skb = 0;
0542             clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
0543             wake_up_interruptible(&session->report_queue);
0544         }
0545     }
0546 
0547     return done_with_skb;
0548 }
0549 
0550 static void hidp_recv_ctrl_frame(struct hidp_session *session,
0551                     struct sk_buff *skb)
0552 {
0553     unsigned char hdr, type, param;
0554     int free_skb = 1;
0555 
0556     BT_DBG("session %p skb %p len %u", session, skb, skb->len);
0557 
0558     hdr = skb->data[0];
0559     skb_pull(skb, 1);
0560 
0561     type = hdr & HIDP_HEADER_TRANS_MASK;
0562     param = hdr & HIDP_HEADER_PARAM_MASK;
0563 
0564     switch (type) {
0565     case HIDP_TRANS_HANDSHAKE:
0566         hidp_process_handshake(session, param);
0567         break;
0568 
0569     case HIDP_TRANS_HID_CONTROL:
0570         hidp_process_hid_control(session, param);
0571         break;
0572 
0573     case HIDP_TRANS_DATA:
0574         free_skb = hidp_process_data(session, skb, param);
0575         break;
0576 
0577     default:
0578         hidp_send_ctrl_message(session,
0579             HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);
0580         break;
0581     }
0582 
0583     if (free_skb)
0584         kfree_skb(skb);
0585 }
0586 
0587 static void hidp_recv_intr_frame(struct hidp_session *session,
0588                 struct sk_buff *skb)
0589 {
0590     unsigned char hdr;
0591 
0592     BT_DBG("session %p skb %p len %u", session, skb, skb->len);
0593 
0594     hdr = skb->data[0];
0595     skb_pull(skb, 1);
0596 
0597     if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
0598         hidp_set_timer(session);
0599 
0600         if (session->input)
0601             hidp_input_report(session, skb);
0602 
0603         if (session->hid) {
0604             hidp_process_report(session, HID_INPUT_REPORT,
0605                         skb->data, skb->len, 1);
0606             BT_DBG("report len %d", skb->len);
0607         }
0608     } else {
0609         BT_DBG("Unsupported protocol header 0x%02x", hdr);
0610     }
0611 
0612     kfree_skb(skb);
0613 }
0614 
0615 static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
0616 {
0617     struct kvec iv = { data, len };
0618     struct msghdr msg;
0619 
0620     BT_DBG("sock %p data %p len %d", sock, data, len);
0621 
0622     if (!len)
0623         return 0;
0624 
0625     memset(&msg, 0, sizeof(msg));
0626 
0627     return kernel_sendmsg(sock, &msg, &iv, 1, len);
0628 }
0629 
0630 /* dequeue message from @transmit and send via @sock */
0631 static void hidp_process_transmit(struct hidp_session *session,
0632                   struct sk_buff_head *transmit,
0633                   struct socket *sock)
0634 {
0635     struct sk_buff *skb;
0636     int ret;
0637 
0638     BT_DBG("session %p", session);
0639 
0640     while ((skb = skb_dequeue(transmit))) {
0641         ret = hidp_send_frame(sock, skb->data, skb->len);
0642         if (ret == -EAGAIN) {
0643             skb_queue_head(transmit, skb);
0644             break;
0645         } else if (ret < 0) {
0646             hidp_session_terminate(session);
0647             kfree_skb(skb);
0648             break;
0649         }
0650 
0651         hidp_set_timer(session);
0652         kfree_skb(skb);
0653     }
0654 }
0655 
0656 static int hidp_setup_input(struct hidp_session *session,
0657                 const struct hidp_connadd_req *req)
0658 {
0659     struct input_dev *input;
0660     int i;
0661 
0662     input = input_allocate_device();
0663     if (!input)
0664         return -ENOMEM;
0665 
0666     session->input = input;
0667 
0668     input_set_drvdata(input, session);
0669 
0670     input->name = "Bluetooth HID Boot Protocol Device";
0671 
0672     input->id.bustype = BUS_BLUETOOTH;
0673     input->id.vendor  = req->vendor;
0674     input->id.product = req->product;
0675     input->id.version = req->version;
0676 
0677     if (req->subclass & 0x40) {
0678         set_bit(EV_KEY, input->evbit);
0679         set_bit(EV_LED, input->evbit);
0680         set_bit(EV_REP, input->evbit);
0681 
0682         set_bit(LED_NUML,    input->ledbit);
0683         set_bit(LED_CAPSL,   input->ledbit);
0684         set_bit(LED_SCROLLL, input->ledbit);
0685         set_bit(LED_COMPOSE, input->ledbit);
0686         set_bit(LED_KANA,    input->ledbit);
0687 
0688         for (i = 0; i < sizeof(hidp_keycode); i++)
0689             set_bit(hidp_keycode[i], input->keybit);
0690         clear_bit(0, input->keybit);
0691     }
0692 
0693     if (req->subclass & 0x80) {
0694         input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
0695         input->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
0696             BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
0697         input->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
0698         input->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_SIDE) |
0699             BIT_MASK(BTN_EXTRA);
0700         input->relbit[0] |= BIT_MASK(REL_WHEEL);
0701     }
0702 
0703     input->dev.parent = &session->conn->hcon->dev;
0704 
0705     input->event = hidp_input_event;
0706 
0707     return 0;
0708 }
0709 
0710 static int hidp_open(struct hid_device *hid)
0711 {
0712     return 0;
0713 }
0714 
0715 static void hidp_close(struct hid_device *hid)
0716 {
0717 }
0718 
0719 static int hidp_parse(struct hid_device *hid)
0720 {
0721     struct hidp_session *session = hid->driver_data;
0722 
0723     return hid_parse_report(session->hid, session->rd_data,
0724             session->rd_size);
0725 }
0726 
0727 static int hidp_start(struct hid_device *hid)
0728 {
0729     return 0;
0730 }
0731 
0732 static void hidp_stop(struct hid_device *hid)
0733 {
0734     struct hidp_session *session = hid->driver_data;
0735 
0736     skb_queue_purge(&session->ctrl_transmit);
0737     skb_queue_purge(&session->intr_transmit);
0738 
0739     hid->claimed = 0;
0740 }
0741 
0742 struct hid_ll_driver hidp_hid_driver = {
0743     .parse = hidp_parse,
0744     .start = hidp_start,
0745     .stop = hidp_stop,
0746     .open  = hidp_open,
0747     .close = hidp_close,
0748     .raw_request = hidp_raw_request,
0749     .output_report = hidp_output_report,
0750 };
0751 EXPORT_SYMBOL_GPL(hidp_hid_driver);
0752 
0753 /* This function sets up the hid device. It does not add it
0754    to the HID system. That is done in hidp_add_connection(). */
0755 static int hidp_setup_hid(struct hidp_session *session,
0756                 const struct hidp_connadd_req *req)
0757 {
0758     struct hid_device *hid;
0759     int err;
0760 
0761     session->rd_data = memdup_user(req->rd_data, req->rd_size);
0762     if (IS_ERR(session->rd_data))
0763         return PTR_ERR(session->rd_data);
0764 
0765     session->rd_size = req->rd_size;
0766 
0767     hid = hid_allocate_device();
0768     if (IS_ERR(hid)) {
0769         err = PTR_ERR(hid);
0770         goto fault;
0771     }
0772 
0773     session->hid = hid;
0774 
0775     hid->driver_data = session;
0776 
0777     hid->bus     = BUS_BLUETOOTH;
0778     hid->vendor  = req->vendor;
0779     hid->product = req->product;
0780     hid->version = req->version;
0781     hid->country = req->country;
0782 
0783     strscpy(hid->name, req->name, sizeof(hid->name));
0784 
0785     snprintf(hid->phys, sizeof(hid->phys), "%pMR",
0786          &l2cap_pi(session->ctrl_sock->sk)->chan->src);
0787 
0788     /* NOTE: Some device modules depend on the dst address being stored in
0789      * uniq. Please be aware of this before making changes to this behavior.
0790      */
0791     snprintf(hid->uniq, sizeof(hid->uniq), "%pMR",
0792          &l2cap_pi(session->ctrl_sock->sk)->chan->dst);
0793 
0794     hid->dev.parent = &session->conn->hcon->dev;
0795     hid->ll_driver = &hidp_hid_driver;
0796 
0797     /* True if device is blocked in drivers/hid/hid-quirks.c */
0798     if (hid_ignore(hid)) {
0799         hid_destroy_device(session->hid);
0800         session->hid = NULL;
0801         return -ENODEV;
0802     }
0803 
0804     return 0;
0805 
0806 fault:
0807     kfree(session->rd_data);
0808     session->rd_data = NULL;
0809 
0810     return err;
0811 }
0812 
0813 /* initialize session devices */
0814 static int hidp_session_dev_init(struct hidp_session *session,
0815                  const struct hidp_connadd_req *req)
0816 {
0817     int ret;
0818 
0819     if (req->rd_size > 0) {
0820         ret = hidp_setup_hid(session, req);
0821         if (ret && ret != -ENODEV)
0822             return ret;
0823     }
0824 
0825     if (!session->hid) {
0826         ret = hidp_setup_input(session, req);
0827         if (ret < 0)
0828             return ret;
0829     }
0830 
0831     return 0;
0832 }
0833 
0834 /* destroy session devices */
0835 static void hidp_session_dev_destroy(struct hidp_session *session)
0836 {
0837     if (session->hid)
0838         put_device(&session->hid->dev);
0839     else if (session->input)
0840         input_put_device(session->input);
0841 
0842     kfree(session->rd_data);
0843     session->rd_data = NULL;
0844 }
0845 
0846 /* add HID/input devices to their underlying bus systems */
0847 static int hidp_session_dev_add(struct hidp_session *session)
0848 {
0849     int ret;
0850 
0851     /* Both HID and input systems drop a ref-count when unregistering the
0852      * device but they don't take a ref-count when registering them. Work
0853      * around this by explicitly taking a refcount during registration
0854      * which is dropped automatically by unregistering the devices. */
0855 
0856     if (session->hid) {
0857         ret = hid_add_device(session->hid);
0858         if (ret)
0859             return ret;
0860         get_device(&session->hid->dev);
0861     } else if (session->input) {
0862         ret = input_register_device(session->input);
0863         if (ret)
0864             return ret;
0865         input_get_device(session->input);
0866     }
0867 
0868     return 0;
0869 }
0870 
0871 /* remove HID/input devices from their bus systems */
0872 static void hidp_session_dev_del(struct hidp_session *session)
0873 {
0874     if (session->hid)
0875         hid_destroy_device(session->hid);
0876     else if (session->input)
0877         input_unregister_device(session->input);
0878 }
0879 
0880 /*
0881  * Asynchronous device registration
0882  * HID device drivers might want to perform I/O during initialization to
0883  * detect device types. Therefore, call device registration in a separate
0884  * worker so the HIDP thread can schedule I/O operations.
0885  * Note that this must be called after the worker thread was initialized
0886  * successfully. This will then add the devices and increase session state
0887  * on success, otherwise it will terminate the session thread.
0888  */
0889 static void hidp_session_dev_work(struct work_struct *work)
0890 {
0891     struct hidp_session *session = container_of(work,
0892                             struct hidp_session,
0893                             dev_init);
0894     int ret;
0895 
0896     ret = hidp_session_dev_add(session);
0897     if (!ret)
0898         atomic_inc(&session->state);
0899     else
0900         hidp_session_terminate(session);
0901 }
0902 
0903 /*
0904  * Create new session object
0905  * Allocate session object, initialize static fields, copy input data into the
0906  * object and take a reference to all sub-objects.
0907  * This returns 0 on success and puts a pointer to the new session object in
0908  * \out. Otherwise, an error code is returned.
0909  * The new session object has an initial ref-count of 1.
0910  */
0911 static int hidp_session_new(struct hidp_session **out, const bdaddr_t *bdaddr,
0912                 struct socket *ctrl_sock,
0913                 struct socket *intr_sock,
0914                 const struct hidp_connadd_req *req,
0915                 struct l2cap_conn *conn)
0916 {
0917     struct hidp_session *session;
0918     int ret;
0919     struct bt_sock *ctrl, *intr;
0920 
0921     ctrl = bt_sk(ctrl_sock->sk);
0922     intr = bt_sk(intr_sock->sk);
0923 
0924     session = kzalloc(sizeof(*session), GFP_KERNEL);
0925     if (!session)
0926         return -ENOMEM;
0927 
0928     /* object and runtime management */
0929     kref_init(&session->ref);
0930     atomic_set(&session->state, HIDP_SESSION_IDLING);
0931     init_waitqueue_head(&session->state_queue);
0932     session->flags = req->flags & BIT(HIDP_BLUETOOTH_VENDOR_ID);
0933 
0934     /* connection management */
0935     bacpy(&session->bdaddr, bdaddr);
0936     session->conn = l2cap_conn_get(conn);
0937     session->user.probe = hidp_session_probe;
0938     session->user.remove = hidp_session_remove;
0939     INIT_LIST_HEAD(&session->user.list);
0940     session->ctrl_sock = ctrl_sock;
0941     session->intr_sock = intr_sock;
0942     skb_queue_head_init(&session->ctrl_transmit);
0943     skb_queue_head_init(&session->intr_transmit);
0944     session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl)->chan->omtu,
0945                     l2cap_pi(ctrl)->chan->imtu);
0946     session->intr_mtu = min_t(uint, l2cap_pi(intr)->chan->omtu,
0947                     l2cap_pi(intr)->chan->imtu);
0948     session->idle_to = req->idle_to;
0949 
0950     /* device management */
0951     INIT_WORK(&session->dev_init, hidp_session_dev_work);
0952     timer_setup(&session->timer, hidp_idle_timeout, 0);
0953 
0954     /* session data */
0955     mutex_init(&session->report_mutex);
0956     init_waitqueue_head(&session->report_queue);
0957 
0958     ret = hidp_session_dev_init(session, req);
0959     if (ret)
0960         goto err_free;
0961 
0962     get_file(session->intr_sock->file);
0963     get_file(session->ctrl_sock->file);
0964     *out = session;
0965     return 0;
0966 
0967 err_free:
0968     l2cap_conn_put(session->conn);
0969     kfree(session);
0970     return ret;
0971 }
0972 
0973 /* increase ref-count of the given session by one */
0974 static void hidp_session_get(struct hidp_session *session)
0975 {
0976     kref_get(&session->ref);
0977 }
0978 
0979 /* release callback */
0980 static void session_free(struct kref *ref)
0981 {
0982     struct hidp_session *session = container_of(ref, struct hidp_session,
0983                             ref);
0984 
0985     hidp_session_dev_destroy(session);
0986     skb_queue_purge(&session->ctrl_transmit);
0987     skb_queue_purge(&session->intr_transmit);
0988     fput(session->intr_sock->file);
0989     fput(session->ctrl_sock->file);
0990     l2cap_conn_put(session->conn);
0991     kfree(session);
0992 }
0993 
0994 /* decrease ref-count of the given session by one */
0995 static void hidp_session_put(struct hidp_session *session)
0996 {
0997     kref_put(&session->ref, session_free);
0998 }
0999 
1000 /*
1001  * Search the list of active sessions for a session with target address
1002  * \bdaddr. You must hold at least a read-lock on \hidp_session_sem. As long as
1003  * you do not release this lock, the session objects cannot vanish and you can
1004  * safely take a reference to the session yourself.
1005  */
1006 static struct hidp_session *__hidp_session_find(const bdaddr_t *bdaddr)
1007 {
1008     struct hidp_session *session;
1009 
1010     list_for_each_entry(session, &hidp_session_list, list) {
1011         if (!bacmp(bdaddr, &session->bdaddr))
1012             return session;
1013     }
1014 
1015     return NULL;
1016 }
1017 
1018 /*
1019  * Same as __hidp_session_find() but no locks must be held. This also takes a
1020  * reference of the returned session (if non-NULL) so you must drop this
1021  * reference if you no longer use the object.
1022  */
1023 static struct hidp_session *hidp_session_find(const bdaddr_t *bdaddr)
1024 {
1025     struct hidp_session *session;
1026 
1027     down_read(&hidp_session_sem);
1028 
1029     session = __hidp_session_find(bdaddr);
1030     if (session)
1031         hidp_session_get(session);
1032 
1033     up_read(&hidp_session_sem);
1034 
1035     return session;
1036 }
1037 
1038 /*
1039  * Start session synchronously
1040  * This starts a session thread and waits until initialization
1041  * is done or returns an error if it couldn't be started.
1042  * If this returns 0 the session thread is up and running. You must call
1043  * hipd_session_stop_sync() before deleting any runtime resources.
1044  */
1045 static int hidp_session_start_sync(struct hidp_session *session)
1046 {
1047     unsigned int vendor, product;
1048 
1049     if (session->hid) {
1050         vendor  = session->hid->vendor;
1051         product = session->hid->product;
1052     } else if (session->input) {
1053         vendor  = session->input->id.vendor;
1054         product = session->input->id.product;
1055     } else {
1056         vendor = 0x0000;
1057         product = 0x0000;
1058     }
1059 
1060     session->task = kthread_run(hidp_session_thread, session,
1061                     "khidpd_%04x%04x", vendor, product);
1062     if (IS_ERR(session->task))
1063         return PTR_ERR(session->task);
1064 
1065     while (atomic_read(&session->state) <= HIDP_SESSION_IDLING)
1066         wait_event(session->state_queue,
1067                atomic_read(&session->state) > HIDP_SESSION_IDLING);
1068 
1069     return 0;
1070 }
1071 
1072 /*
1073  * Terminate session thread
1074  * Wake up session thread and notify it to stop. This is asynchronous and
1075  * returns immediately. Call this whenever a runtime error occurs and you want
1076  * the session to stop.
1077  * Note: wake_up_interruptible() performs any necessary memory-barriers for us.
1078  */
1079 static void hidp_session_terminate(struct hidp_session *session)
1080 {
1081     atomic_inc(&session->terminate);
1082     /*
1083      * See the comment preceding the call to wait_woken()
1084      * in hidp_session_run().
1085      */
1086     wake_up_interruptible(&hidp_session_wq);
1087 }
1088 
1089 /*
1090  * Probe HIDP session
1091  * This is called from the l2cap_conn core when our l2cap_user object is bound
1092  * to the hci-connection. We get the session via the \user object and can now
1093  * start the session thread, link it into the global session list and
1094  * schedule HID/input device registration.
1095  * The global session-list owns its own reference to the session object so you
1096  * can drop your own reference after registering the l2cap_user object.
1097  */
1098 static int hidp_session_probe(struct l2cap_conn *conn,
1099                   struct l2cap_user *user)
1100 {
1101     struct hidp_session *session = container_of(user,
1102                             struct hidp_session,
1103                             user);
1104     struct hidp_session *s;
1105     int ret;
1106 
1107     down_write(&hidp_session_sem);
1108 
1109     /* check that no other session for this device exists */
1110     s = __hidp_session_find(&session->bdaddr);
1111     if (s) {
1112         ret = -EEXIST;
1113         goto out_unlock;
1114     }
1115 
1116     if (session->input) {
1117         ret = hidp_session_dev_add(session);
1118         if (ret)
1119             goto out_unlock;
1120     }
1121 
1122     ret = hidp_session_start_sync(session);
1123     if (ret)
1124         goto out_del;
1125 
1126     /* HID device registration is async to allow I/O during probe */
1127     if (session->input)
1128         atomic_inc(&session->state);
1129     else
1130         schedule_work(&session->dev_init);
1131 
1132     hidp_session_get(session);
1133     list_add(&session->list, &hidp_session_list);
1134     ret = 0;
1135     goto out_unlock;
1136 
1137 out_del:
1138     if (session->input)
1139         hidp_session_dev_del(session);
1140 out_unlock:
1141     up_write(&hidp_session_sem);
1142     return ret;
1143 }
1144 
1145 /*
1146  * Remove HIDP session
1147  * Called from the l2cap_conn core when either we explicitly unregistered
1148  * the l2cap_user object or if the underlying connection is shut down.
1149  * We signal the hidp-session thread to shut down, unregister the HID/input
1150  * devices and unlink the session from the global list.
1151  * This drops the reference to the session that is owned by the global
1152  * session-list.
1153  * Note: We _must_ not synchronosly wait for the session-thread to shut down.
1154  * This is, because the session-thread might be waiting for an HCI lock that is
1155  * held while we are called. Therefore, we only unregister the devices and
1156  * notify the session-thread to terminate. The thread itself owns a reference
1157  * to the session object so it can safely shut down.
1158  */
1159 static void hidp_session_remove(struct l2cap_conn *conn,
1160                 struct l2cap_user *user)
1161 {
1162     struct hidp_session *session = container_of(user,
1163                             struct hidp_session,
1164                             user);
1165 
1166     down_write(&hidp_session_sem);
1167 
1168     hidp_session_terminate(session);
1169 
1170     cancel_work_sync(&session->dev_init);
1171     if (session->input ||
1172         atomic_read(&session->state) > HIDP_SESSION_PREPARING)
1173         hidp_session_dev_del(session);
1174 
1175     list_del(&session->list);
1176 
1177     up_write(&hidp_session_sem);
1178 
1179     hidp_session_put(session);
1180 }
1181 
1182 /*
1183  * Session Worker
1184  * This performs the actual main-loop of the HIDP worker. We first check
1185  * whether the underlying connection is still alive, then parse all pending
1186  * messages and finally send all outstanding messages.
1187  */
1188 static void hidp_session_run(struct hidp_session *session)
1189 {
1190     struct sock *ctrl_sk = session->ctrl_sock->sk;
1191     struct sock *intr_sk = session->intr_sock->sk;
1192     struct sk_buff *skb;
1193     DEFINE_WAIT_FUNC(wait, woken_wake_function);
1194 
1195     add_wait_queue(&hidp_session_wq, &wait);
1196     for (;;) {
1197         /*
1198          * This thread can be woken up two ways:
1199          *  - You call hidp_session_terminate() which sets the
1200          *    session->terminate flag and wakes this thread up.
1201          *  - Via modifying the socket state of ctrl/intr_sock. This
1202          *    thread is woken up by ->sk_state_changed().
1203          */
1204 
1205         if (atomic_read(&session->terminate))
1206             break;
1207 
1208         if (ctrl_sk->sk_state != BT_CONNECTED ||
1209             intr_sk->sk_state != BT_CONNECTED)
1210             break;
1211 
1212         /* parse incoming intr-skbs */
1213         while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
1214             skb_orphan(skb);
1215             if (!skb_linearize(skb))
1216                 hidp_recv_intr_frame(session, skb);
1217             else
1218                 kfree_skb(skb);
1219         }
1220 
1221         /* send pending intr-skbs */
1222         hidp_process_transmit(session, &session->intr_transmit,
1223                       session->intr_sock);
1224 
1225         /* parse incoming ctrl-skbs */
1226         while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
1227             skb_orphan(skb);
1228             if (!skb_linearize(skb))
1229                 hidp_recv_ctrl_frame(session, skb);
1230             else
1231                 kfree_skb(skb);
1232         }
1233 
1234         /* send pending ctrl-skbs */
1235         hidp_process_transmit(session, &session->ctrl_transmit,
1236                       session->ctrl_sock);
1237 
1238         /*
1239          * wait_woken() performs the necessary memory barriers
1240          * for us; see the header comment for this primitive.
1241          */
1242         wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
1243     }
1244     remove_wait_queue(&hidp_session_wq, &wait);
1245 
1246     atomic_inc(&session->terminate);
1247 }
1248 
1249 static int hidp_session_wake_function(wait_queue_entry_t *wait,
1250                       unsigned int mode,
1251                       int sync, void *key)
1252 {
1253     wake_up_interruptible(&hidp_session_wq);
1254     return false;
1255 }
1256 
1257 /*
1258  * HIDP session thread
1259  * This thread runs the I/O for a single HIDP session. Startup is synchronous
1260  * which allows us to take references to ourself here instead of doing that in
1261  * the caller.
1262  * When we are ready to run we notify the caller and call hidp_session_run().
1263  */
1264 static int hidp_session_thread(void *arg)
1265 {
1266     struct hidp_session *session = arg;
1267     DEFINE_WAIT_FUNC(ctrl_wait, hidp_session_wake_function);
1268     DEFINE_WAIT_FUNC(intr_wait, hidp_session_wake_function);
1269 
1270     BT_DBG("session %p", session);
1271 
1272     /* initialize runtime environment */
1273     hidp_session_get(session);
1274     __module_get(THIS_MODULE);
1275     set_user_nice(current, -15);
1276     hidp_set_timer(session);
1277 
1278     add_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
1279     add_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
1280     /* This memory barrier is paired with wq_has_sleeper(). See
1281      * sock_poll_wait() for more information why this is needed. */
1282     smp_mb__before_atomic();
1283 
1284     /* notify synchronous startup that we're ready */
1285     atomic_inc(&session->state);
1286     wake_up(&session->state_queue);
1287 
1288     /* run session */
1289     hidp_session_run(session);
1290 
1291     /* cleanup runtime environment */
1292     remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
1293     remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
1294     wake_up_interruptible(&session->report_queue);
1295     hidp_del_timer(session);
1296 
1297     /*
1298      * If we stopped ourself due to any internal signal, we should try to
1299      * unregister our own session here to avoid having it linger until the
1300      * parent l2cap_conn dies or user-space cleans it up.
1301      * This does not deadlock as we don't do any synchronous shutdown.
1302      * Instead, this call has the same semantics as if user-space tried to
1303      * delete the session.
1304      */
1305     l2cap_unregister_user(session->conn, &session->user);
1306     hidp_session_put(session);
1307 
1308     module_put_and_kthread_exit(0);
1309     return 0;
1310 }
1311 
1312 static int hidp_verify_sockets(struct socket *ctrl_sock,
1313                    struct socket *intr_sock)
1314 {
1315     struct l2cap_chan *ctrl_chan, *intr_chan;
1316     struct bt_sock *ctrl, *intr;
1317     struct hidp_session *session;
1318 
1319     if (!l2cap_is_socket(ctrl_sock) || !l2cap_is_socket(intr_sock))
1320         return -EINVAL;
1321 
1322     ctrl_chan = l2cap_pi(ctrl_sock->sk)->chan;
1323     intr_chan = l2cap_pi(intr_sock->sk)->chan;
1324 
1325     if (bacmp(&ctrl_chan->src, &intr_chan->src) ||
1326         bacmp(&ctrl_chan->dst, &intr_chan->dst))
1327         return -ENOTUNIQ;
1328 
1329     ctrl = bt_sk(ctrl_sock->sk);
1330     intr = bt_sk(intr_sock->sk);
1331 
1332     if (ctrl->sk.sk_state != BT_CONNECTED ||
1333         intr->sk.sk_state != BT_CONNECTED)
1334         return -EBADFD;
1335 
1336     /* early session check, we check again during session registration */
1337     session = hidp_session_find(&ctrl_chan->dst);
1338     if (session) {
1339         hidp_session_put(session);
1340         return -EEXIST;
1341     }
1342 
1343     return 0;
1344 }
1345 
1346 int hidp_connection_add(const struct hidp_connadd_req *req,
1347             struct socket *ctrl_sock,
1348             struct socket *intr_sock)
1349 {
1350     u32 valid_flags = BIT(HIDP_VIRTUAL_CABLE_UNPLUG) |
1351               BIT(HIDP_BOOT_PROTOCOL_MODE);
1352     struct hidp_session *session;
1353     struct l2cap_conn *conn;
1354     struct l2cap_chan *chan;
1355     int ret;
1356 
1357     ret = hidp_verify_sockets(ctrl_sock, intr_sock);
1358     if (ret)
1359         return ret;
1360 
1361     if (req->flags & ~valid_flags)
1362         return -EINVAL;
1363 
1364     chan = l2cap_pi(ctrl_sock->sk)->chan;
1365     conn = NULL;
1366     l2cap_chan_lock(chan);
1367     if (chan->conn)
1368         conn = l2cap_conn_get(chan->conn);
1369     l2cap_chan_unlock(chan);
1370 
1371     if (!conn)
1372         return -EBADFD;
1373 
1374     ret = hidp_session_new(&session, &chan->dst, ctrl_sock,
1375                    intr_sock, req, conn);
1376     if (ret)
1377         goto out_conn;
1378 
1379     ret = l2cap_register_user(conn, &session->user);
1380     if (ret)
1381         goto out_session;
1382 
1383     ret = 0;
1384 
1385 out_session:
1386     hidp_session_put(session);
1387 out_conn:
1388     l2cap_conn_put(conn);
1389     return ret;
1390 }
1391 
1392 int hidp_connection_del(struct hidp_conndel_req *req)
1393 {
1394     u32 valid_flags = BIT(HIDP_VIRTUAL_CABLE_UNPLUG);
1395     struct hidp_session *session;
1396 
1397     if (req->flags & ~valid_flags)
1398         return -EINVAL;
1399 
1400     session = hidp_session_find(&req->bdaddr);
1401     if (!session)
1402         return -ENOENT;
1403 
1404     if (req->flags & BIT(HIDP_VIRTUAL_CABLE_UNPLUG))
1405         hidp_send_ctrl_message(session,
1406                        HIDP_TRANS_HID_CONTROL |
1407                          HIDP_CTRL_VIRTUAL_CABLE_UNPLUG,
1408                        NULL, 0);
1409     else
1410         l2cap_unregister_user(session->conn, &session->user);
1411 
1412     hidp_session_put(session);
1413 
1414     return 0;
1415 }
1416 
1417 int hidp_get_connlist(struct hidp_connlist_req *req)
1418 {
1419     struct hidp_session *session;
1420     int err = 0, n = 0;
1421 
1422     BT_DBG("");
1423 
1424     down_read(&hidp_session_sem);
1425 
1426     list_for_each_entry(session, &hidp_session_list, list) {
1427         struct hidp_conninfo ci;
1428 
1429         hidp_copy_session(session, &ci);
1430 
1431         if (copy_to_user(req->ci, &ci, sizeof(ci))) {
1432             err = -EFAULT;
1433             break;
1434         }
1435 
1436         if (++n >= req->cnum)
1437             break;
1438 
1439         req->ci++;
1440     }
1441     req->cnum = n;
1442 
1443     up_read(&hidp_session_sem);
1444     return err;
1445 }
1446 
1447 int hidp_get_conninfo(struct hidp_conninfo *ci)
1448 {
1449     struct hidp_session *session;
1450 
1451     session = hidp_session_find(&ci->bdaddr);
1452     if (session) {
1453         hidp_copy_session(session, ci);
1454         hidp_session_put(session);
1455     }
1456 
1457     return session ? 0 : -ENOENT;
1458 }
1459 
1460 static int __init hidp_init(void)
1461 {
1462     BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
1463 
1464     return hidp_init_sockets();
1465 }
1466 
1467 static void __exit hidp_exit(void)
1468 {
1469     hidp_cleanup_sockets();
1470 }
1471 
1472 module_init(hidp_init);
1473 module_exit(hidp_exit);
1474 
1475 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1476 MODULE_AUTHOR("David Herrmann <dh.herrmann@gmail.com>");
1477 MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION);
1478 MODULE_VERSION(VERSION);
1479 MODULE_LICENSE("GPL");
1480 MODULE_ALIAS("bt-proto-6");
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!