net/bluetooth/hidp/core.c

   1 /*
   2    HIDP implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 #include <linux/module.h>
  24
  25 #include <linux/types.h>
  26 #include <linux/errno.h>
  27 #include <linux/kernel.h>
  28 #include <linux/sched.h>
  29 #include <linux/slab.h>
  30 #include <linux/poll.h>
  31 #include <linux/freezer.h>
  32 #include <linux/fcntl.h>
  33 #include <linux/skbuff.h>
  34 #include <linux/socket.h>
  35 #include <linux/ioctl.h>
  36 #include <linux/file.h>
  37 #include <linux/init.h>
  38 #include <linux/wait.h>
  39 #include <net/sock.h>
  40
  41 #include <linux/input.h>
  42 #include <linux/hid.h>
  43 #include <linux/hidraw.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47 #include <net/bluetooth/l2cap.h>
  48
  49 #include "hidp.h"
  50
  51 #define VERSION "1.2"
  52
  53 static DECLARE_RWSEM(hidp_session_sem);
  54 static LIST_HEAD(hidp_session_list);
  55
  56 static unsigned char hidp_keycode[256] = {
  57           0,  0,  0,  0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36, 37, 38,
  58          50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45, 21, 44,  2,  3,
  59           4,  5,  6,  7,  8,  9, 10, 11, 28,  1, 14, 15, 57, 12, 13, 26,
  60          27, 43, 43, 39, 40, 41, 51, 52, 53, 58, 59, 60, 61, 62, 63, 64,
  61          65, 66, 67, 68, 87, 88, 99, 70,119,110,102,104,111,107,109,106,
  62         105,108,103, 69, 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71,
  63          72, 73, 82, 83, 86,127,116,117,183,184,185,186,187,188,189,190,
  64         191,192,193,194,134,138,130,132,128,129,131,137,133,135,136,113,
  65         115,114,  0,  0,  0,121,  0, 89, 93,124, 92, 94, 95,  0,  0,  0,
  66         122,123, 90, 91, 85,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  67           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  68           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  69           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  70           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  71          29, 42, 56,125, 97, 54,100,126,164,166,165,163,161,115,114,113,
  72         150,158,159,128,136,177,178,176,142,152,173,140
  73 };
  74
  75 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
  76
  77 static struct hidp_session *__hidp_get_session(bdaddr_t *bdaddr)
  78 {
  79         struct hidp_session *session;
  80         struct list_head *p;
  81
  82         BT_DBG("");
  83
  84         list_for_each(p, &hidp_session_list) {
  85                 session = list_entry(p, struct hidp_session, list);
  86                 if (!bacmp(bdaddr, &session->bdaddr))
  87                         return session;
  88         }
  89         return NULL;
  90 }
  91
  92 static void __hidp_link_session(struct hidp_session *session)
  93 {
  94         __module_get(THIS_MODULE);
  95         list_add(&session->list, &hidp_session_list);
  96
  97         hci_conn_hold_device(session->conn);
  98 }
  99
 100 static void __hidp_unlink_session(struct hidp_session *session)
 101 {
 102         hci_conn_put_device(session->conn);
 103
 104         list_del(&session->list);
 105         module_put(THIS_MODULE);
 106 }
 107
 108 static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
 109 {
 110         bacpy(&ci->bdaddr, &session->bdaddr);
 111
 112         ci->flags = session->flags;
 113         ci->state = session->state;
 114
 115         ci->vendor  = 0x0000;
 116         ci->product = 0x0000;
 117         ci->version = 0x0000;
 118         memset(ci->name, 0, 128);
 119
 120         if (session->input) {
 121                 ci->vendor  = session->input->id.vendor;
 122                 ci->product = session->input->id.product;
 123                 ci->version = session->input->id.version;
 124                 if (session->input->name)
 125                         strncpy(ci->name, session->input->name, 128);
 126                 else
 127                         strncpy(ci->name, "HID Boot Device", 128);
 128         }
 129
 130         if (session->hid) {
 131                 ci->vendor  = session->hid->vendor;
 132                 ci->product = session->hid->product;
 133                 ci->version = session->hid->version;
 134                 strncpy(ci->name, session->hid->name, 128);
 135         }
 136 }
 137
 138 static int hidp_queue_event(struct hidp_session *session, struct input_dev *dev,
 139                                 unsigned int type, unsigned int code, int value)
 140 {
 141         unsigned char newleds;
 142         struct sk_buff *skb;
 143
 144         BT_DBG("session %p type %d code %d value %d", session, type, code, value);
 145
 146         if (type != EV_LED)
 147                 return -1;
 148
 149         newleds = (!!test_bit(LED_KANA,    dev->led) << 3) |
 150                   (!!test_bit(LED_COMPOSE, dev->led) << 3) |
 151                   (!!test_bit(LED_SCROLLL, dev->led) << 2) |
 152                   (!!test_bit(LED_CAPSL,   dev->led) << 1) |
 153                   (!!test_bit(LED_NUML,    dev->led));
 154
 155         if (session->leds == newleds)
 156                 return 0;
 157
 158         session->leds = newleds;
 159
 160         if (!(skb = alloc_skb(3, GFP_ATOMIC))) {
 161                 BT_ERR("Can't allocate memory for new frame");
 162                 return -ENOMEM;
 163         }
 164
 165         *skb_put(skb, 1) = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 166         *skb_put(skb, 1) = 0x01;
 167         *skb_put(skb, 1) = newleds;
 168
 169         skb_queue_tail(&session->intr_transmit, skb);
 170
 171         hidp_schedule(session);
 172
 173         return 0;
 174 }
 175
 176 static int hidp_hidinput_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 177 {
 178         struct hid_device *hid = input_get_drvdata(dev);
 179         struct hidp_session *session = hid->driver_data;
 180
 181         return hidp_queue_event(session, dev, type, code, value);
 182 }
 183
 184 static int hidp_input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 185 {
 186         struct hidp_session *session = input_get_drvdata(dev);
 187
 188         return hidp_queue_event(session, dev, type, code, value);
 189 }
 190
 191 static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
 192 {
 193         struct input_dev *dev = session->input;
 194         unsigned char *keys = session->keys;
 195         unsigned char *udata = skb->data + 1;
 196         signed char *sdata = skb->data + 1;
 197         int i, size = skb->len - 1;
 198
 199         switch (skb->data[0]) {
 200         case 0x01:      /* Keyboard report */
 201                 for (i = 0; i < 8; i++)
 202                         input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
 203
 204                 /* If all the key codes have been set to 0x01, it means
 205                  * too many keys were pressed at the same time. */
 206                 if (!memcmp(udata + 2, hidp_mkeyspat, 6))
 207                         break;
 208
 209                 for (i = 2; i < 8; i++) {
 210                         if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) {
 211                                 if (hidp_keycode[keys[i]])
 212                                         input_report_key(dev, hidp_keycode[keys[i]], 0);
 213                                 else
 214                                         BT_ERR("Unknown key (scancode %#x) released.", keys[i]);
 215                         }
 216
 217                         if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) {
 218                                 if (hidp_keycode[udata[i]])
 219                                         input_report_key(dev, hidp_keycode[udata[i]], 1);
 220                                 else
 221                                         BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]);
 222                         }
 223                 }
 224
 225                 memcpy(keys, udata, 8);
 226                 break;
 227
 228         case 0x02:      /* Mouse report */
 229                 input_report_key(dev, BTN_LEFT,   sdata[0] & 0x01);
 230                 input_report_key(dev, BTN_RIGHT,  sdata[0] & 0x02);
 231                 input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
 232                 input_report_key(dev, BTN_SIDE,   sdata[0] & 0x08);
 233                 input_report_key(dev, BTN_EXTRA,  sdata[0] & 0x10);
 234
 235                 input_report_rel(dev, REL_X, sdata[1]);
 236                 input_report_rel(dev, REL_Y, sdata[2]);
 237
 238                 if (size > 3)
 239                         input_report_rel(dev, REL_WHEEL, sdata[3]);
 240                 break;
 241         }
 242
 243         input_sync(dev);
 244 }
 245
 246 static int hidp_queue_report(struct hidp_session *session,
 247                                 unsigned char *data, int size)
 248 {
 249         struct sk_buff *skb;
 250
 251         BT_DBG("session %p hid %p data %p size %d", session, session->hid, data, size);
 252
 253         if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
 254                 BT_ERR("Can't allocate memory for new frame");
 255                 return -ENOMEM;
 256         }
 257
 258         *skb_put(skb, 1) = 0xa2;
 259         if (size > 0)
 260                 memcpy(skb_put(skb, size), data, size);
 261
 262         skb_queue_tail(&session->intr_transmit, skb);
 263
 264         hidp_schedule(session);
 265
 266         return 0;
 267 }
 268
 269 static int hidp_send_report(struct hidp_session *session, struct hid_report *report)
 270 {
 271         unsigned char buf[32];
 272         int rsize;
 273
 274         rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
 275         if (rsize > sizeof(buf))
 276                 return -EIO;
 277
 278         hid_output_report(report, buf);
 279
 280         return hidp_queue_report(session, buf, rsize);
 281 }
 282
 283 static void hidp_idle_timeout(unsigned long arg)
 284 {
 285         struct hidp_session *session = (struct hidp_session *) arg;
 286
 287         atomic_inc(&session->terminate);
 288         hidp_schedule(session);
 289 }
 290
 291 static void hidp_set_timer(struct hidp_session *session)
 292 {
 293         if (session->idle_to > 0)
 294                 mod_timer(&session->timer, jiffies + HZ * session->idle_to);
 295 }
 296
 297 static inline void hidp_del_timer(struct hidp_session *session)
 298 {
 299         if (session->idle_to > 0)
 300                 del_timer(&session->timer);
 301 }
 302
 303 static int __hidp_send_ctrl_message(struct hidp_session *session,
 304                         unsigned char hdr, unsigned char *data, int size)
 305 {
 306         struct sk_buff *skb;
 307
 308         BT_DBG("session %p data %p size %d", session, data, size);
 309
 310         if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
 311                 BT_ERR("Can't allocate memory for new frame");
 312                 return -ENOMEM;
 313         }
 314
 315         *skb_put(skb, 1) = hdr;
 316         if (data && size > 0)
 317                 memcpy(skb_put(skb, size), data, size);
 318
 319         skb_queue_tail(&session->ctrl_transmit, skb);
 320
 321         return 0;
 322 }
 323
 324 static inline int hidp_send_ctrl_message(struct hidp_session *session,
 325                         unsigned char hdr, unsigned char *data, int size)
 326 {
 327         int err;
 328
 329         err = __hidp_send_ctrl_message(session, hdr, data, size);
 330
 331         hidp_schedule(session);
 332
 333         return err;
 334 }
 335
 336 static void hidp_process_handshake(struct hidp_session *session,
 337                                         unsigned char param)
 338 {
 339         BT_DBG("session %p param 0x%02x", session, param);
 340
 341         switch (param) {
 342         case HIDP_HSHK_SUCCESSFUL:
 343                 /* FIXME: Call into SET_ GET_ handlers here */
 344                 break;
 345
 346         case HIDP_HSHK_NOT_READY:
 347         case HIDP_HSHK_ERR_INVALID_REPORT_ID:
 348         case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
 349         case HIDP_HSHK_ERR_INVALID_PARAMETER:
 350                 /* FIXME: Call into SET_ GET_ handlers here */
 351                 break;
 352
 353         case HIDP_HSHK_ERR_UNKNOWN:
 354                 break;
 355
 356         case HIDP_HSHK_ERR_FATAL:
 357                 /* Device requests a reboot, as this is the only way this error
 358                  * can be recovered. */
 359                 __hidp_send_ctrl_message(session,
 360                         HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0);
 361                 break;
 362
 363         default:
 364                 __hidp_send_ctrl_message(session,
 365                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 366                 break;
 367         }
 368 }
 369
 370 static void hidp_process_hid_control(struct hidp_session *session,
 371                                         unsigned char param)
 372 {
 373         BT_DBG("session %p param 0x%02x", session, param);
 374
 375         if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) {
 376                 /* Flush the transmit queues */
 377                 skb_queue_purge(&session->ctrl_transmit);
 378                 skb_queue_purge(&session->intr_transmit);
 379
 380                 /* Kill session thread */
 381                 atomic_inc(&session->terminate);
 382                 hidp_schedule(session);
 383         }
 384 }
 385
 386 static void hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
 387                                 unsigned char param)
 388 {
 389         BT_DBG("session %p skb %p len %d param 0x%02x", session, skb, skb->len, param);
 390
 391         switch (param) {
 392         case HIDP_DATA_RTYPE_INPUT:
 393                 hidp_set_timer(session);
 394
 395                 if (session->input)
 396                         hidp_input_report(session, skb);
 397
 398                 if (session->hid)
 399                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
 400
 401                 break;
 402
 403         case HIDP_DATA_RTYPE_OTHER:
 404         case HIDP_DATA_RTYPE_OUPUT:
 405         case HIDP_DATA_RTYPE_FEATURE:
 406                 break;
 407
 408         default:
 409                 __hidp_send_ctrl_message(session,
 410                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 411         }
 412 }
 413
 414 static void hidp_recv_ctrl_frame(struct hidp_session *session,
 415                                         struct sk_buff *skb)
 416 {
 417         unsigned char hdr, type, param;
 418
 419         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 420
 421         hdr = skb->data[0];
 422         skb_pull(skb, 1);
 423
 424         type = hdr & HIDP_HEADER_TRANS_MASK;
 425         param = hdr & HIDP_HEADER_PARAM_MASK;
 426
 427         switch (type) {
 428         case HIDP_TRANS_HANDSHAKE:
 429                 hidp_process_handshake(session, param);
 430                 break;
 431
 432         case HIDP_TRANS_HID_CONTROL:
 433                 hidp_process_hid_control(session, param);
 434                 break;
 435
 436         case HIDP_TRANS_DATA:
 437                 hidp_process_data(session, skb, param);
 438                 break;
 439
 440         default:
 441                 __hidp_send_ctrl_message(session,
 442                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);
 443                 break;
 444         }
 445
 446         kfree_skb(skb);
 447 }
 448
 449 static void hidp_recv_intr_frame(struct hidp_session *session,
 450                                 struct sk_buff *skb)
 451 {
 452         unsigned char hdr;
 453
 454         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 455
 456         hdr = skb->data[0];
 457         skb_pull(skb, 1);
 458
 459         if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
 460                 hidp_set_timer(session);
 461
 462                 if (session->input)
 463                         hidp_input_report(session, skb);
 464
 465                 if (session->hid) {
 466                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 1);
 467                         BT_DBG("report len %d", skb->len);
 468                 }
 469         } else {
 470                 BT_DBG("Unsupported protocol header 0x%02x", hdr);
 471         }
 472
 473         kfree_skb(skb);
 474 }
 475
 476 static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
 477 {
 478         struct kvec iv = { data, len };
 479         struct msghdr msg;
 480
 481         BT_DBG("sock %p data %p len %d", sock, data, len);
 482
 483         if (!len)
 484                 return 0;
 485
 486         memset(&msg, 0, sizeof(msg));
 487
 488         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 489 }
 490
 491 static void hidp_process_transmit(struct hidp_session *session)
 492 {
 493         struct sk_buff *skb;
 494
 495         BT_DBG("session %p", session);
 496
 497         while ((skb = skb_dequeue(&session->ctrl_transmit))) {
 498                 if (hidp_send_frame(session->ctrl_sock, skb->data, skb->len) < 0) {
 499                         skb_queue_head(&session->ctrl_transmit, skb);
 500                         break;
 501                 }
 502
 503                 hidp_set_timer(session);
 504                 kfree_skb(skb);
 505         }
 506
 507         while ((skb = skb_dequeue(&session->intr_transmit))) {
 508                 if (hidp_send_frame(session->intr_sock, skb->data, skb->len) < 0) {
 509                         skb_queue_head(&session->intr_transmit, skb);
 510                         break;
 511                 }
 512
 513                 hidp_set_timer(session);
 514                 kfree_skb(skb);
 515         }
 516 }
 517
 518 static int hidp_session(void *arg)
 519 {
 520         struct hidp_session *session = arg;
 521         struct sock *ctrl_sk = session->ctrl_sock->sk;
 522         struct sock *intr_sk = session->intr_sock->sk;
 523         struct sk_buff *skb;
 524         int vendor = 0x0000, product = 0x0000;
 525         wait_queue_t ctrl_wait, intr_wait;
 526
 527         BT_DBG("session %p", session);
 528
 529         if (session->input) {
 530                 vendor  = session->input->id.vendor;
 531                 product = session->input->id.product;
 532         }
 533
 534         if (session->hid) {
 535                 vendor  = session->hid->vendor;
 536                 product = session->hid->product;
 537         }
 538
 539         daemonize("khidpd_%04x%04x", vendor, product);
 540         set_user_nice(current, -15);
 541
 542         init_waitqueue_entry(&ctrl_wait, current);
 543         init_waitqueue_entry(&intr_wait, current);
 544         add_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
 545         add_wait_queue(intr_sk->sk_sleep, &intr_wait);
 546         while (!atomic_read(&session->terminate)) {
 547                 set_current_state(TASK_INTERRUPTIBLE);
 548
 549                 if (ctrl_sk->sk_state != BT_CONNECTED || intr_sk->sk_state != BT_CONNECTED)
 550                         break;
 551
 552                 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
 553                         skb_orphan(skb);
 554                         hidp_recv_ctrl_frame(session, skb);
 555                 }
 556
 557                 while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
 558                         skb_orphan(skb);
 559                         hidp_recv_intr_frame(session, skb);
 560                 }
 561
 562                 hidp_process_transmit(session);
 563
 564                 schedule();
 565         }
 566         set_current_state(TASK_RUNNING);
 567         remove_wait_queue(intr_sk->sk_sleep, &intr_wait);
 568         remove_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
 569
 570         down_write(&hidp_session_sem);
 571
 572         hidp_del_timer(session);
 573
 574         if (session->input) {
 575                 input_unregister_device(session->input);
 576                 session->input = NULL;
 577         }
 578
 579         if (session->hid) {
 580                 hid_destroy_device(session->hid);
 581                 session->hid = NULL;
 582         }
 583
 584         /* Wakeup user-space polling for socket errors */
 585         session->intr_sock->sk->sk_err = EUNATCH;
 586         session->ctrl_sock->sk->sk_err = EUNATCH;
 587
 588         hidp_schedule(session);
 589
 590         fput(session->intr_sock->file);
 591
 592         wait_event_timeout(*(ctrl_sk->sk_sleep),
 593                 (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
 594
 595         fput(session->ctrl_sock->file);
 596
 597         __hidp_unlink_session(session);
 598
 599         up_write(&hidp_session_sem);
 600
 601         kfree(session);
 602         return 0;
 603 }
 604
 605 static struct device *hidp_get_device(struct hidp_session *session)
 606 {
 607         bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
 608         bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
 609         struct device *device = NULL;
 610         struct hci_dev *hdev;
 611
 612         hdev = hci_get_route(dst, src);
 613         if (!hdev)
 614                 return NULL;
 615
 616         session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 617         if (session->conn)
 618                 device = &session->conn->dev;
 619
 620         hci_dev_put(hdev);
 621
 622         return device;
 623 }
 624
 625 static int hidp_setup_input(struct hidp_session *session,
 626                                 struct hidp_connadd_req *req)
 627 {
 628         struct input_dev *input;
 629         int err, i;
 630
 631         input = input_allocate_device();
 632         if (!input)
 633                 return -ENOMEM;
 634
 635         session->input = input;
 636
 637         input_set_drvdata(input, session);
 638
 639         input->name = "Bluetooth HID Boot Protocol Device";
 640
 641         input->id.bustype = BUS_BLUETOOTH;
 642         input->id.vendor  = req->vendor;
 643         input->id.product = req->product;
 644         input->id.version = req->version;
 645
 646         if (req->subclass & 0x40) {
 647                 set_bit(EV_KEY, input->evbit);
 648                 set_bit(EV_LED, input->evbit);
 649                 set_bit(EV_REP, input->evbit);
 650
 651                 set_bit(LED_NUML,    input->ledbit);
 652                 set_bit(LED_CAPSL,   input->ledbit);
 653                 set_bit(LED_SCROLLL, input->ledbit);
 654                 set_bit(LED_COMPOSE, input->ledbit);
 655                 set_bit(LED_KANA,    input->ledbit);
 656
 657                 for (i = 0; i < sizeof(hidp_keycode); i++)
 658                         set_bit(hidp_keycode[i], input->keybit);
 659                 clear_bit(0, input->keybit);
 660         }
 661
 662         if (req->subclass & 0x80) {
 663                 input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
 664                 input->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
 665                         BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
 666                 input->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
 667                 input->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_SIDE) |
 668                         BIT_MASK(BTN_EXTRA);
 669                 input->relbit[0] |= BIT_MASK(REL_WHEEL);
 670         }
 671
 672         input->dev.parent = hidp_get_device(session);
 673
 674         input->event = hidp_input_event;
 675
 676         err = input_register_device(input);
 677         if (err < 0) {
 678                 hci_conn_put_device(session->conn);
 679                 return err;
 680         }
 681
 682         return 0;
 683 }
 684
 685 static int hidp_open(struct hid_device *hid)
 686 {
 687         return 0;
 688 }
 689
 690 static void hidp_close(struct hid_device *hid)
 691 {
 692 }
 693
 694 static int hidp_parse(struct hid_device *hid)
 695 {
 696         struct hidp_session *session = hid->driver_data;
 697         struct hidp_connadd_req *req = session->req;
 698         unsigned char *buf;
 699         int ret;
 700
 701         buf = kmalloc(req->rd_size, GFP_KERNEL);
 702         if (!buf)
 703                 return -ENOMEM;
 704
 705         if (copy_from_user(buf, req->rd_data, req->rd_size)) {
 706                 kfree(buf);
 707                 return -EFAULT;
 708         }
 709
 710         ret = hid_parse_report(session->hid, buf, req->rd_size);
 711
 712         kfree(buf);
 713
 714         if (ret)
 715                 return ret;
 716
 717         session->req = NULL;
 718
 719         return 0;
 720 }
 721
 722 static int hidp_start(struct hid_device *hid)
 723 {
 724         struct hidp_session *session = hid->driver_data;
 725         struct hid_report *report;
 726
 727         list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].
 728                         report_list, list)
 729                 hidp_send_report(session, report);
 730
 731         list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].
 732                         report_list, list)
 733                 hidp_send_report(session, report);
 734
 735         return 0;
 736 }
 737
 738 static void hidp_stop(struct hid_device *hid)
 739 {
 740         struct hidp_session *session = hid->driver_data;
 741
 742         skb_queue_purge(&session->ctrl_transmit);
 743         skb_queue_purge(&session->intr_transmit);
 744
 745         hid->claimed = 0;
 746 }
 747
 748 static struct hid_ll_driver hidp_hid_driver = {
 749         .parse = hidp_parse,
 750         .start = hidp_start,
 751         .stop = hidp_stop,
 752         .open  = hidp_open,
 753         .close = hidp_close,
 754         .hidinput_input_event = hidp_hidinput_event,
 755 };
 756
 757 static int hidp_setup_hid(struct hidp_session *session,
 758                                 struct hidp_connadd_req *req)
 759 {
 760         struct hid_device *hid;
 761         bdaddr_t src, dst;
 762         int err;
 763
 764         hid = hid_allocate_device();
 765         if (IS_ERR(hid))
 766                 return PTR_ERR(session->hid);
 767
 768         session->hid = hid;
 769         session->req = req;
 770         hid->driver_data = session;
 771
 772         baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
 773         baswap(&dst, &bt_sk(session->ctrl_sock->sk)->dst);
 774
 775         hid->bus     = BUS_BLUETOOTH;
 776         hid->vendor  = req->vendor;
 777         hid->product = req->product;
 778         hid->version = req->version;
 779         hid->country = req->country;
 780
 781         strncpy(hid->name, req->name, 128);
 782         strncpy(hid->phys, batostr(&src), 64);
 783         strncpy(hid->uniq, batostr(&dst), 64);
 784
 785         hid->dev.parent = hidp_get_device(session);
 786         hid->ll_driver = &hidp_hid_driver;
 787
 788         err = hid_add_device(hid);
 789         if (err < 0)
 790                 goto failed;
 791
 792         return 0;
 793
 794 failed:
 795         hid_destroy_device(hid);
 796         session->hid = NULL;
 797
 798         return err;
 799 }
 800
 801 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
 802 {
 803         struct hidp_session *session, *s;
 804         int err;
 805
 806         BT_DBG("");
 807
 808         if (bacmp(&bt_sk(ctrl_sock->sk)->src, &bt_sk(intr_sock->sk)->src) ||
 809                         bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
 810                 return -ENOTUNIQ;
 811
 812         session = kzalloc(sizeof(struct hidp_session), GFP_KERNEL);
 813         if (!session)
 814                 return -ENOMEM;
 815
 816         BT_DBG("rd_data %p rd_size %d", req->rd_data, req->rd_size);
 817
 818         down_write(&hidp_session_sem);
 819
 820         s = __hidp_get_session(&bt_sk(ctrl_sock->sk)->dst);
 821         if (s && s->state == BT_CONNECTED) {
 822                 err = -EEXIST;
 823                 goto failed;
 824         }
 825
 826         bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
 827
 828         session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->omtu, l2cap_pi(ctrl_sock->sk)->imtu);
 829         session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->omtu, l2cap_pi(intr_sock->sk)->imtu);
 830
 831         BT_DBG("ctrl mtu %d intr mtu %d", session->ctrl_mtu, session->intr_mtu);
 832
 833         session->ctrl_sock = ctrl_sock;
 834         session->intr_sock = intr_sock;
 835         session->state     = BT_CONNECTED;
 836
 837         setup_timer(&session->timer, hidp_idle_timeout, (unsigned long)session);
 838
 839         skb_queue_head_init(&session->ctrl_transmit);
 840         skb_queue_head_init(&session->intr_transmit);
 841
 842         session->flags   = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
 843         session->idle_to = req->idle_to;
 844
 845         if (req->rd_size > 0) {
 846                 err = hidp_setup_hid(session, req);
 847                 if (err && err != -ENODEV)
 848                         goto purge;
 849         }
 850
 851         if (!session->hid) {
 852                 err = hidp_setup_input(session, req);
 853                 if (err < 0)
 854                         goto purge;
 855         }
 856
 857         __hidp_link_session(session);
 858
 859         hidp_set_timer(session);
 860
 861         err = kernel_thread(hidp_session, session, CLONE_KERNEL);
 862         if (err < 0)
 863                 goto unlink;
 864
 865         if (session->input) {
 866                 hidp_send_ctrl_message(session,
 867                         HIDP_TRANS_SET_PROTOCOL | HIDP_PROTO_BOOT, NULL, 0);
 868                 session->flags |= (1 << HIDP_BOOT_PROTOCOL_MODE);
 869
 870                 session->leds = 0xff;
 871                 hidp_input_event(session->input, EV_LED, 0, 0);
 872         }
 873
 874         up_write(&hidp_session_sem);
 875         return 0;
 876
 877 unlink:
 878         hidp_del_timer(session);
 879
 880         __hidp_unlink_session(session);
 881
 882         if (session->input) {
 883                 input_unregister_device(session->input);
 884                 session->input = NULL;
 885         }
 886
 887         if (session->hid) {
 888                 hid_destroy_device(session->hid);
 889                 session->hid = NULL;
 890         }
 891
 892 purge:
 893         skb_queue_purge(&session->ctrl_transmit);
 894         skb_queue_purge(&session->intr_transmit);
 895
 896 failed:
 897         up_write(&hidp_session_sem);
 898
 899         input_free_device(session->input);
 900         kfree(session);
 901         return err;
 902 }
 903
 904 int hidp_del_connection(struct hidp_conndel_req *req)
 905 {
 906         struct hidp_session *session;
 907         int err = 0;
 908
 909         BT_DBG("");
 910
 911         down_read(&hidp_session_sem);
 912
 913         session = __hidp_get_session(&req->bdaddr);
 914         if (session) {
 915                 if (req->flags & (1 << HIDP_VIRTUAL_CABLE_UNPLUG)) {
 916                         hidp_send_ctrl_message(session,
 917                                 HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG, NULL, 0);
 918                 } else {
 919                         /* Flush the transmit queues */
 920                         skb_queue_purge(&session->ctrl_transmit);
 921                         skb_queue_purge(&session->intr_transmit);
 922
 923                         /* Wakeup user-space polling for socket errors */
 924                         session->intr_sock->sk->sk_err = EUNATCH;
 925                         session->ctrl_sock->sk->sk_err = EUNATCH;
 926
 927                         /* Kill session thread */
 928                         atomic_inc(&session->terminate);
 929                         hidp_schedule(session);
 930                 }
 931         } else
 932                 err = -ENOENT;
 933
 934         up_read(&hidp_session_sem);
 935         return err;
 936 }
 937
 938 int hidp_get_connlist(struct hidp_connlist_req *req)
 939 {
 940         struct list_head *p;
 941         int err = 0, n = 0;
 942
 943         BT_DBG("");
 944
 945         down_read(&hidp_session_sem);
 946
 947         list_for_each(p, &hidp_session_list) {
 948                 struct hidp_session *session;
 949                 struct hidp_conninfo ci;
 950
 951                 session = list_entry(p, struct hidp_session, list);
 952
 953                 __hidp_copy_session(session, &ci);
 954
 955                 if (copy_to_user(req->ci, &ci, sizeof(ci))) {
 956                         err = -EFAULT;
 957                         break;
 958                 }
 959
 960                 if (++n >= req->cnum)
 961                         break;
 962
 963                 req->ci++;
 964         }
 965         req->cnum = n;
 966
 967         up_read(&hidp_session_sem);
 968         return err;
 969 }
 970
 971 int hidp_get_conninfo(struct hidp_conninfo *ci)
 972 {
 973         struct hidp_session *session;
 974         int err = 0;
 975
 976         down_read(&hidp_session_sem);
 977
 978         session = __hidp_get_session(&ci->bdaddr);
 979         if (session)
 980                 __hidp_copy_session(session, ci);
 981         else
 982                 err = -ENOENT;
 983
 984         up_read(&hidp_session_sem);
 985         return err;
 986 }
 987
 988 static const struct hid_device_id hidp_table[] = {
 989         { HID_BLUETOOTH_DEVICE(HID_ANY_ID, HID_ANY_ID) },
 990         { }
 991 };
 992
 993 static struct hid_driver hidp_driver = {
 994         .name = "generic-bluetooth",
 995         .id_table = hidp_table,
 996 };
 997
 998 static int __init hidp_init(void)
 999 {
1000         int ret;
1001
1002         l2cap_load();
1003
1004         BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
1005
1006         ret = hid_register_driver(&hidp_driver);
1007         if (ret)
1008                 goto err;
1009
1010         ret = hidp_init_sockets();
1011         if (ret)
1012                 goto err_drv;
1013
1014         return 0;
1015 err_drv:
1016         hid_unregister_driver(&hidp_driver);
1017 err:
1018         return ret;
1019 }
1020
1021 static void __exit hidp_exit(void)
1022 {
1023         hidp_cleanup_sockets();
1024         hid_unregister_driver(&hidp_driver);
1025 }
1026
1027 module_init(hidp_init);
1028 module_exit(hidp_exit);
1029
1030 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1031 MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION);
1032 MODULE_VERSION(VERSION);
1033 MODULE_LICENSE("GPL");
1034 MODULE_ALIAS("bt-proto-6");