summaryrefslogtreecommitdiffstats
path: root/drivers/bluetooth/hci_ldisc.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Bluetooth: hci_uart: Cancel init work before unregisteringSamuel Holland2020-08-021-0/+1
| | | | | | | | | | | If hci_uart_tty_close() or hci_uart_unregister_device() is called while hu->init_ready is scheduled, hci_register_dev() could be called after the hci_uart is torn down. Avoid this by ensuring the work is complete or canceled before checking the HCI_UART_REGISTERED flag. Fixes: 9f2aee848fe6 ("Bluetooth: Add delayed init sequence support for UART controllers") Signed-off-by: Samuel Holland <samuel@sholland.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: check for missing tty operationsVladis Dronov2019-07-311-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset() functions which are called by the certain HCI UART protocols (hci_ath, hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control() or directly. This leads to an execution at NULL and can be triggered by an unprivileged user. Fix this by adding a helper function and a check for the missing tty operations in the protocols code. This fixes CVE-2019-10207. The Fixes: lines list commits where calls to tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART protocols. Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50 Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com Cc: stable@vger.kernel.org # v2.6.36+ Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip") Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions") Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support") Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support") Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Reviewed-by: Yu-Chen, Cho <acho@suse.com> Tested-by: Yu-Chen, Cho <acho@suse.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* Bluetooth: hci_ldisc: Add function to wait for characters to be sentSascha Hauer2019-07-061-0/+8
| | | | | | | | | | The hci UART line discipline sends its characters in a workqueue. Some devices like the Marvell Bluetooth chips need to make sure that all queued characters are sent before switching the baudrate. This adds a function to synchronize with the workqueue. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156Thomas Gleixner2019-05-301-16/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Based on 1 normalized pattern(s): this program is free software you can redistribute it and or modify it under the terms of the gnu general public license as published by the free software foundation either version 2 of the license or at your option any later version this program is distributed in the hope that it will be useful but without any warranty without even the implied warranty of merchantability or fitness for a particular purpose see the gnu general public license for more details you should have received a copy of the gnu general public license along with this program if not write to the free software foundation inc 59 temple place suite 330 boston ma 02111 1307 usa extracted by the scancode license scanner the SPDX license identifier GPL-2.0-or-later has been chosen to replace the boilerplate/reference in 1334 file(s). Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Allison Randal <allison@lohutok.net> Reviewed-by: Richard Fontana <rfontana@redhat.com> Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in ↵Kefeng Wang2019-02-261-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | hci_uart_set_proto() task A: task B: hci_uart_set_proto flush_to_ldisc - p->open(hu) -> h5_open //alloc h5 - receive_buf - set_bit HCI_UART_PROTO_READY - tty_port_default_receive_buf - hci_uart_register_dev - tty_ldisc_receive_buf - hci_uart_tty_receive - test_bit HCI_UART_PROTO_READY - h5_recv - clear_bit HCI_UART_PROTO_READY while() { - p->open(hu) -> h5_close //free h5 - h5_rx_3wire_hdr - h5_reset() //use-after-free } It could use ioctl to set hci uart proto, but there is a use-after-free issue when hci_uart_register_dev() fail in hci_uart_set_proto(), see stack above, fix this by setting HCI_UART_PROTO_READY bit only when hci_uart_register_dev() return success. Reported-by: syzbot+899a33dc0fa0dbaf06a6@syzkaller.appspotmail.com Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Reviewed-by: Jeremy Cline <jcline@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Initialize hci_dev before open()Jeremy Cline2019-02-181-7/+14
| | | | | | | | | | | | | | | | | | The hci_dev struct hdev is referenced in work queues and timers started by open() in some protocols. This creates a race between the initialization function and the work or timer which can result hdev being dereferenced while it is still null. The syzbot report contains a reliable reproducer which causes a null pointer dereference of hdev in hci_uart_write_work() by making the memory allocation for hdev fail. To fix this, ensure hdev is valid from before calling a protocol's open() until after calling a protocol's close(). Reported-by: syzbot+257790c15bcdef6fe00c@syzkaller.appspotmail.com Signed-off-by: Jeremy Cline <jcline@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Merge branch 'work.tty-ioctl' of ↵Linus Torvalds2018-10-241-0/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull tty ioctl updates from Al Viro: "This is the compat_ioctl work related to tty ioctls. Quite a bit of dead code taken out, all tty-related stuff gone from fs/compat_ioctl.c. A bunch of compat bugs fixed - some still remain, but all more or less generic tty-related ioctls should be covered (remaining issues are in things like driver-private ioctls in a pcmcia serial card driver not getting properly handled in 32bit processes on 64bit host, etc)" * 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (53 commits) kill TIOCSERGSTRUCT change semantics of ldisc ->compat_ioctl() kill TIOCSER[SG]WILD synclink_gt(): fix compat_ioctl() pty: fix compat ioctls compat_ioctl - kill keyboard ioctl handling gigaset: add ->compat_ioctl() vt_compat_ioctl(): clean up, use compat_ptr() properly gigaset: don't try to printk userland buffer contents dgnc: don't bother with (empty) stub for TCXONC dgnc: leave TIOC[GS]SOFTCAR to ldisc remove fallback to drivers for TIOCGICOUNT dgnc: break-related ioctls won't reach ->ioctl() kill the rest of tty COMPAT_IOCTL() entries dgnc: TIOCM... won't reach ->ioctl() isdn_tty: TCSBRK{,P} won't reach ->ioctl() kill capinc_tty_ioctl() take compat TIOC[SG]SERIAL treatment into tty_compat_ioctl() synclink: reduce pointless checks in ->ioctl() complete ->[sg]et_serial() switchover ...
| * change semantics of ldisc ->compat_ioctl()Al Viro2018-10-131-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | First of all, make it return int. Returning long when native method had never allowed that is ridiculous and inconvenient. More importantly, change the caller; if ldisc ->compat_ioctl() is NULL or returns -ENOIOCTLCMD, tty_compat_ioctl() will try to feed cmd and compat_ptr(arg) to ldisc's native ->ioctl(). That simplifies ->compat_ioctl() instances quite a bit - they only need to deal with ioctls that are neither generic tty ones (those would get shunted off to tty_ioctl()) nor simple compat pointer ones. Note that something like TCFLSH won't reach ->compat_ioctl(), even if ldisc ->ioctl() does handle it - it will be recognized earlier and passed to tty_ioctl() (and ultimately - ldisc ->ioctl()). For many ldiscs it means that NULL ->compat_ioctl() does the right thing. Those where it won't serve (see e.g. n_r3964.c) are also easily dealt with - we need to handle the numeric-argument ioctls (calling the native instance) and, if such would exist, the ioctls that need layout conversion, etc. All in-tree ldiscs dealt with. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* | Bluetooth: hci_ldisc: Free rw_semaphore on closeHermes Zhang2018-09-111-0/+2
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The percpu_rw_semaphore is not currently freed, and this leads to a crash when the stale rcu callback is invoked. DEBUG_OBJECTS detects this. ODEBUG: free active (active state 1) object type: rcu_head hint: (null) ------------[ cut here ]------------ WARNING: CPU: 1 PID: 2024 at debug_print_object+0xac/0xc8 PC is at debug_print_object+0xac/0xc8 LR is at debug_print_object+0xac/0xc8 Call trace: [<ffffff80082e2c2c>] debug_print_object+0xac/0xc8 [<ffffff80082e40b0>] debug_check_no_obj_freed+0x1e8/0x228 [<ffffff8008191254>] kfree+0x1cc/0x250 [<ffffff80083cc03c>] hci_uart_tty_close+0x54/0x108 [<ffffff800832e118>] tty_ldisc_close.isra.1+0x40/0x58 [<ffffff800832e14c>] tty_ldisc_kill+0x1c/0x40 [<ffffff800832e3dc>] tty_ldisc_release+0x94/0x170 [<ffffff8008325554>] tty_release_struct+0x1c/0x58 [<ffffff8008326400>] tty_release+0x3b0/0x490 [<ffffff80081a3fe8>] __fput+0x88/0x1d0 [<ffffff80081a418c>] ____fput+0xc/0x18 [<ffffff80080c0624>] task_work_run+0x9c/0xc0 [<ffffff80080a9e24>] do_exit+0x24c/0x8a0 [<ffffff80080aa4e0>] do_group_exit+0x38/0xa0 [<ffffff80080aa558>] __wake_up_parent+0x0/0x28 [<ffffff8008082c00>] el0_svc_naked+0x34/0x38 ---[ end trace bfe08cbd89098cdf ]--- Signed-off-by: Hermes Zhang <chenhuiz@axis.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_serdev: Fix HCI_UART_INIT_PENDING not workingHans de Goede2018-05-301-1/+1
| | | | | | | Init hci_uart->init_ready so that hci_uart_init_ready() works properly. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: Restore hci_dev->flush callback on open()Hans de Goede2018-05-301-9/+11
| | | | | | | | | | | | | | | | For reasons explained in detail in commit 3611f4d2a5e0 ("hci_ldisc: fix null pointer deref") the hci_uart_close() functions sets hci_dev->flush to NULL. But the device may be re-opened after a close, this commit restores the hci_dev->flush callback on open(). Note this commit also moves the nearly empty defition of hci_uart_open() a bit down in the file to avoid the need for forward declaring hci_uart_flush(). Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Provide a 'default' switch caseFabio Estevam2018-05-181-0/+2
| | | | | | | | | | | | When both CONFIG_BT_HCIUART_INTEL and CONFIG_BT_HCIUART_BCM are not selected, sparse complains like this: drivers/bluetooth/hci_ldisc.c:437:9: warning: switch with no cases Fix the sparse warning by proving a default switch case. Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* the rest of drivers/*: annotate ->poll() instancesAl Viro2017-11-281-1/+1
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* Bluetooth: hci_ldisc: Fix another race when closing the tty.Ronald Tschalär2017-10-301-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | The following race condition still existed: P1 P2 cancel_work_sync() hci_uart_tx_wakeup() hci_uart_write_work() hci_uart_dequeue() clear_bit(HCI_UART_PROTO_READY) hci_unregister_dev(hdev) hci_free_dev(hdev) hu->proto->close(hu) kfree(hu) access to hdev and hu Cancelling the work after clearing the HCI_UART_PROTO_READY bit avoids this as any hci_uart_tx_wakeup() issued after the flag is cleared will detect that and not schedule further work. Signed-off-by: Ronald Tschalär <ronald@innovation.ch> Reviewed-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Allow sleeping while proto locks are held.Ronald Tschalär2017-10-291-16/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit dec2c92880cc5435381d50e3045ef018a762a917 ("Bluetooth: hci_ldisc: Use rwlocking to avoid closing proto races") introduced locks in hci_ldisc that are held while calling the proto functions. These locks are rwlock's, and hence do not allow sleeping while they are held. However, the proto functions that hci_bcm registers use mutexes and hence need to be able to sleep. In more detail: hci_uart_tty_receive() and hci_uart_dequeue() both acquire the rwlock, after which they call proto->recv() and proto->dequeue(), respectively. In the case of hci_bcm these point to bcm_recv() and bcm_dequeue(). The latter both acquire the bcm_device_lock, which is a mutex, so doing so results in a call to might_sleep(). But since we're holding a rwlock in hci_ldisc, that results in the following BUG (this for the dequeue case - a similar one for the receive case is omitted for brevity): BUG: sleeping function called from invalid context at kernel/locking/mutex.c in_atomic(): 1, irqs_disabled(): 0, pid: 7303, name: kworker/7:3 INFO: lockdep is turned off. CPU: 7 PID: 7303 Comm: kworker/7:3 Tainted: G W OE 4.13.2+ #17 Hardware name: Apple Inc. MacBookPro13,3/Mac-A5C67F76ED83108C, BIOS MBP133.8 Workqueue: events hci_uart_write_work [hci_uart] Call Trace: dump_stack+0x8e/0xd6 ___might_sleep+0x164/0x250 __might_sleep+0x4a/0x80 __mutex_lock+0x59/0xa00 ? lock_acquire+0xa3/0x1f0 ? lock_acquire+0xa3/0x1f0 ? hci_uart_write_work+0xd3/0x160 [hci_uart] mutex_lock_nested+0x1b/0x20 ? mutex_lock_nested+0x1b/0x20 bcm_dequeue+0x21/0xc0 [hci_uart] hci_uart_write_work+0xe6/0x160 [hci_uart] process_one_work+0x253/0x6a0 worker_thread+0x4d/0x3b0 kthread+0x133/0x150 We can't replace the mutex in hci_bcm, because there are other calls there that might sleep. Therefore this replaces the rwlock's in hci_ldisc with rw_semaphore's (which allow sleeping). This is a safer approach anyway as it reduces the restrictions on the proto callbacks. Also, because acquiring write-lock is very rare compared to acquiring the read-lock, the percpu variant of rw_semaphore is used. Lastly, because hci_uart_tx_wakeup() may be called from an IRQ context, we can't block (sleep) while trying acquire the read lock there, so we use the trylock variant. Signed-off-by: Ronald Tschalär <ronald@innovation.ch> Reviewed-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart_set_flow_control: Fix NULL deref when using serdevHans de Goede2017-10-061-0/+7
| | | | | | | | Fix a NULL pointer deref (hu->tty) when calling hci_uart_set_flow_control on hci_uart-s using serdev. Signed-off-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: Style fix - align block commentsDerek Robson2017-07-221-1/+2
| | | | | | | | Fixed alignment of all block comments. Found using checkpatch Signed-off-by: Derek Robson <robsonde@gmail.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Use rwlocking to avoid closing proto racesDean Jenkins2017-05-181-5/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | When HCI_UART_PROTO_READY is in the set state, the Data Link protocol layer (proto) is bound to the HCI UART driver. This state allows the registered proto function pointers to be used by the HCI UART driver. When unbinding (closing) the Data Link protocol layer, the proto function pointers much be prevented from being used immediately before running the proto close function pointer. Otherwise, there is a risk that a proto non-close function pointer is used during or after the proto close function pointer is used. The consequences are likely to be a kernel crash because the proto close function pointer will free resources used in the Data Link protocol layer. Therefore, add a reader writer lock (rwlock) solution to prevent the close proto function pointer from running by using write_lock_irqsave() whilst the other proto function pointers are protected using read_lock(). This means HCI_UART_PROTO_READY can safely be cleared in the knowledge that no proto function pointers are running. When flag HCI_UART_PROTO_READY is put into the clear state, proto close function pointer can safely be run. Note flag HCI_UART_PROTO_SET being in the set state prevents the proto open function pointer from being run so there is no race condition between proto open and close function pointers. Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Add protocol check to hci_uart_tx_wakeup()Dean Jenkins2017-04-301-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Before attempting to schedule a work-item onto hu->write_work in hci_uart_tx_wakeup(), check that the Data Link protocol layer is still bound to the HCI UART driver. Failure to perform this protocol check causes a race condition between the work queue hu->write_work running hci_uart_write_work() and the Data Link protocol layer being unbound (closed) in hci_uart_tty_close(). Note hci_uart_tty_close() does have a "cancel_work_sync(&hu->write_work)" but it is ineffective because it cannot prevent work-items being added to hu->write_work after cancel_work_sync() has run. Therefore, add a check for HCI_UART_PROTO_READY into hci_uart_tx_wakeup() which prevents scheduling of the work queue when HCI_UART_PROTO_READY is in the clear state. However, note a small race condition remains because the hci_uart_tx_wakeup() thread can run in parallel with the hci_uart_tty_close() thread so it is possible that a schedule of hu->write_work can occur when HCI_UART_PROTO_READY is cleared. A complete solution needs locking of the threads which is implemented in a future commit. Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Add protocol check to hci_uart_dequeue()Dean Jenkins2017-04-301-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Before attempting to dequeue a Data Link protocol encapsulated message, check that the Data Link protocol is still bound to the HCI UART driver. This makes the code consistent with the usage of the other proto function pointers. Therefore, add a check for HCI_UART_PROTO_READY into hci_uart_dequeue() and return NULL if the Data Link protocol is not bound. This is needed for robustness as there is a scheduling race condition. hci_uart_write_work() is scheduled to run via work queue hu->write_work from hci_uart_tx_wakeup(). Therefore, there is a delay between scheduling hci_uart_write_work() to run and hci_uart_dequeue() running whereby the Data Link protocol layer could become unbound during the scheduling delay. In this case, without the check, the call to the unbound Data Link protocol layer dequeue function can crash. It is noted that hci_uart_tty_close() has a "cancel_work_sync(&hu->write_work)" statement but this only reduces the window of the race condition because it is possible for a new work-item to be added to work queue hu->write_work after the call to cancel_work_sync(). For example, Data Link layer retransmissions can be added to the work queue after the cancel_work_sync() has finished. Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Add protocol check to hci_uart_send_frame()Dean Jenkins2017-04-301-0/+3
| | | | | | | | | | | | | | | | | Before attempting to send a HCI message, check that the Data Link protocol is still bound to the HCI UART driver. This makes the code consistent with the usage of the other proto function pointers. Therefore, add a check for HCI_UART_PROTO_READY into hci_uart_send_frame() and return -EUNATCH if the Data Link protocol is not bound. This also allows hci_send_frame() to report the error of an unbound Data Link protocol layer. Therefore, it assists with diagnostics into why HCI messages are being sent when the Data Link protocol is not bound and avoids potential crashes. Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Add missing clear HCI_UART_PROTO_READYDean Jenkins2017-04-221-0/+1
| | | | | | | | | | | | | | | | Ensure that HCI_UART_PROTO_READY is cleared before close(hu) is called which closes the Data Link protocol layer. Therefore, add the missing bit clear of HCI_UART_PROTO_READY to hci_uart_init_work() so that the flag is cleared when hci_register_dev fails. Without the fix, the functions of the Data Link protocol layer could potentially be accessed after that layer has been closed. This could lead to a crash as memory would have been freed in that layer. Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Ensure hu->hdev set to NULL before freeing hdevDean Jenkins2017-04-221-1/+4
| | | | | | | | | | | | When hci_register_dev() fails, hu->hdev should be set to NULL before freeing hdev. This avoids potential use of hu->hdev after it has been freed. This commit sets hu->hdev to NULL before calling hci_free_dev() in error handling scenarios in hci_uart_init_work() and hci_uart_register_dev(). Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Add missing return in hci_uart_init_work()Dean Jenkins2017-04-221-0/+1
| | | | | | | | | | | | | | | If hci_register_dev() returns an error in hci_uart_init_work() then the HCI_UART_REGISTERED bit gets erroneously set due to a missing return statement. Therefore, add the missing return statement. The consequence of the missing return is that the HCI UART is not registered but HCI_UART_REGISTERED is set which allows the code to think that hu->hdev is safe to access but hu->hdev has been freed so could lead to a crash. Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* bluetooth: hci_uart: remove unused hci_uart_init_ttyRob Herring2017-04-131-19/+0
| | | | | | | | | | | There are no users of hci_uart_init_tty, so remove it. Signed-off-by: Rob Herring <robh@kernel.org> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Gustavo Padovan <gustavo@padovan.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Cc: linux-bluetooth@vger.kernel.org Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_serdev: allow modular driversSebastian Reichel2017-04-121-0/+1
| | | | | | | | | | | | For bluetooth protocol driver only supporting serdev it makes sense to follow common practice and built them into their own module. Such modules need access to hci_uart_register_device and hci_uart_tx_wakeup for using the common protocol helpers. Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: add support for word alignmentSebastian Reichel2017-04-121-0/+4
| | | | | | | | | This will be used by Nokia's H4+ protocol, which uses 2-byte aligned packets. Acked-by: Pavel Machek <pavel@ucw.cz> Signed-off-by: Sebastian Reichel <sre@kernel.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: Use single return in hci_uart_tty_ioctl() callVignesh Raman2016-09-241-13/+15
| | | | | | | | | | | | | Remove multiple return statements in hci_uart_tty_ioctl() call and added a single return statement. This code re-organisation allows subsequent locking to be easily added. Signed-off-by: Vignesh Raman <Vignesh_Raman@mentor.com> Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Rajeev Kumar <rajeev_kumar@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: Add Marvell supportLoic Poulain2016-09-191-0/+6
| | | | | | | | | | | | | | This patch introduces support for Marvell Bluetooth controller over UART (8897 for now). In order to send the final firmware at full speed, a helper firmware is firstly sent. Firmware download is driven by the controller which sends request firmware packets (including expected size). This driver is a global rework of the one proposed by Amitkumar Karwar <akarwar@marvell.com>. Signed-off-by: Loic Poulain <loic.poulain@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: Rename HCI_BREDR into HCI_PRIMARYMarcel Holtmann2016-07-091-1/+1
| | | | | | | | | | | | | | The HCI_BREDR naming is confusing since it actually stands for Primary Bluetooth Controller. Which is a term that has been used in the latest standard. However from a legacy point of view there only really have been Basic Rate (BR) and Enhanced Data Rate (EDR). Recent versions of Bluetooth introduced Low Energy (LE) and made this terminology a little bit confused since Dual Mode Controllers include BR/EDR and LE. To simplify this the name HCI_PRIMARY stands for the Primary Controller which can be a single mode or dual mode controller. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: hci_ldisc: Fix null pointer derefence in case of early dataLoic Poulain2016-04-081-4/+7
| | | | | | | | | | | | | HCI_UART_PROTO_SET flag is set before hci_uart_set_proto call. If we receive data from tty layer during this procedure, proto pointer may not be assigned yet, leading to null pointer dereference in rx method hci_uart_tty_receive. This patch fixes this issue by introducing HCI_UART_PROTO_READY flag in order to avoid any proto operation before proto opening and assignment. Signed-off-by: Loic Poulain <loic.poulain@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: Add Intel/AG6xx supportLoic Poulain2016-02-241-0/+6
| | | | | | | | | | This driver implements support for iBT2.1 Bluetooth controller embedded in the AG620 communication combo. The controller needs to be configured with bddata and can be patched with a binary patch file (pbn). These operations are performed in manufacturing mode. Signed-off-by: Loic Poulain <loic.poulain@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Remove dead codePeter Hurley2015-12-101-7/+1
| | | | | | | | The N_HCI ldisc does not define a flush_buffer() ldisc method, so the check when opening the ldisc is always false. Signed-off-by: Peter Hurley <peter@hurleysoftware.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: Use new hci_skb_pkt_* wrappers for driversMarcel Holtmann2015-11-191-2/+3
| | | | | | | | | The new hci_skb_pkt_* wrappers are mainly intented for drivers to require less knowledge about bt_cb(sbk) handling. So after converting the core packet handling, convert all drivers. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: hci_uart: Provide initial manufacturer informationMarcel Holtmann2015-10-211-0/+7
| | | | | | | | Provide an early indication about the manufacturer information so that it can be forwarded into monitor channel. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: Move handling of HCI_RUNNING flag into coreMarcel Holtmann2015-10-051-6/+0
| | | | | | | | | | Setting and clearing of HCI_RUNNING flag in each and every driver is just duplicating the same code all over the place. So instead of having the driver do it in their hdev->open and hdev->close callbacks, set it globally in the core transport handling. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: Move HCI_RUNNING check into hci_send_frameMarcel Holtmann2015-10-051-3/+0
| | | | | | | | | In all callbacks for hdev->send the status of HCI_RUNNING is checked. So instead of repeating that code in every driver, move the check into the hci_send_frame function before calling hdev->send. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: Remove useless rx_lock spinlockFrederic Danis2015-09-241-5/+3
| | | | | | | | | | | | | | | | | | rx_lock spinlock is only used in hci_uart_tty_receive() which is the receive_buf ldisc callback. hci_uart_tty_receive() is protected from re-entrance by its only caller (flush_to_ldisc() in drivers/tty/tty_buffer.c) which held a mutex (buf->lock) for this section. This lock allows "safe use of the line discipline's receive_buf() method by excluding the buffer work and any pending flush from using the flip buffer." (comments from tty_buffer_lock_exclusive() in drivers/tty/tty_buffer.c) So, no need to double protect this resource with rx_lock. Signed-off-by: Frederic Danis <frederic.danis@linux.intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hciuart: Add support QCA chipset for UARTBen Young Tae Kim2015-08-101-0/+6
| | | | | | | | | QCA61x4 chips have supported sleep feature using In-Band-Sleep commands to enable sleep feature based on H4 protocol. After sending patch/nvm configuration is done, IBS mode will be up and running Signed-off-by: Ben Young Tae Kim <ytkim@qca.qualcomm.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_ldisc: Cleaned up coding style warningsPrasanna Karthik2015-07-271-1/+1
| | | | | | | | Fix for Cleanpatch warning: Space prohibited between function name and open parenthesis '(' Signed-off-by: Prasanna Karthik <mkarthi3@visteon.com> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: hci_uart: Add basic support for Intel Lightning Peak devicesLoic Poulain2015-07-231-0/+6
| | | | | | | | | | | | | The Intel Lightning Peak devices do not come with Bluetooth firmware loaded and thus require a full download of the operational Bluetooth firmware when the device is attached via the Bluetooth line discipline. Lightning Peak devices start with a bootloader mode that only accepts a very limited set of HCI commands. The supported commands are enough to identify the hardware and select the right firmware to load. Signed-off-by: Loic Poulain <loic.poulain@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: Fix speed selectionFrederic Danis2015-06-181-6/+6
| | | | | | | | | | hu->proto->*speed will always be used for all device where it is set. But hu->*speed should be used if exist, so the test should be swapped. The equivalent change is needed in bcm_setup() of hci_bcm.c. Signed-off-by: Frederic Danis <frederic.danis@linux.intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: Add new line discipline enhancementsIlya Faenson2015-06-171-6/+102
| | | | | | | | | Added the ability to flow control the UART, improved the UART baud rate setting, transferred the speeds into line discipline from the protocol and introduced the tty init function. Signed-off-by: Ilya Faenson <ifaenson@broadcom.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: Support operational speed during setupFrederic Danis2015-06-061-0/+26
| | | | | | | | | Add initial and operational speeds. Change to operational speed as soon as possible. If controller set_baudrate() fails, continue at initial speed. Signed-off-by: Frederic Danis <frederic.danis@linux.intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: btbcm: Move request/release_firmware()Frederic Danis2015-06-061-0/+1
| | | | | | | | | | | | Move request/release_firmware() out of btbcm_patchram(). This allows a better error management, if request_firmware() returns an error then the controller will be used without firmware loading and 0 is returned. This will imply to change btbcm_patchram() to accept a firmware instead of firmware name. Signed-off-by: Frederic Danis <frederic.danis@linux.intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
* Bluetooth: hci_uart: Use generic Intel support for address settingMarcel Holtmann2015-04-071-1/+3
| | | | | | | | | The Bluetooth address setting for Intel devices is provided by a generic module now. Start using that module instead of relying it being included in the driver. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: hci_uart: Add protocol support for Broadcom UART devicesMarcel Holtmann2015-04-071-0/+6
| | | | | | | | | | This adds the protocol support for Broadcom based UART devices to enable firmware and patchram download procedure. It is a pretty straight forward H:4 driver with the exception of actually having its own setup and address configuration callbacks. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: hci_uart: Use generic functionality from Broadcom moduleMarcel Holtmann2015-04-071-1/+3
| | | | | | | | | The new Broadcom Bluetooth support module provides generic functionality for changing and checking the Bluetooth device address. Use these new features instead of keeping a duplicate in the driver. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: hci_uart: Update version number driverMarcel Holtmann2015-04-071-1/+1
| | | | | | | | | | | This version number is more cosmetic and for debugging purposes, but since there has been a few changes lately, increase it now. Two left-over and not used version constants that were never exposed anywhere are removed since they have no actual value. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
* Bluetooth: hci_uart: Remove the manual protocol init messageMarcel Holtmann2015-04-071-0/+2
| | | | | | | | | The init function for each HCI UART protocol prints the same on success and failure. This information is so generic, remove it and let the main HCI UART handling print it instead. Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-25 16:16:08 +0100