net/bluetooth/hidp/core.c

   1 /*
   2    HIDP implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 #include <linux/module.h>
  24
  25 #include <linux/types.h>
  26 #include <linux/errno.h>
  27 #include <linux/kernel.h>
  28 #include <linux/sched.h>
  29 #include <linux/slab.h>
  30 #include <linux/poll.h>
  31 #include <linux/freezer.h>
  32 #include <linux/fcntl.h>
  33 #include <linux/skbuff.h>
  34 #include <linux/socket.h>
  35 #include <linux/ioctl.h>
  36 #include <linux/file.h>
  37 #include <linux/init.h>
  38 #include <linux/wait.h>
  39 #include <net/sock.h>
  40
  41 #include <linux/input.h>
  42 #include <linux/hid.h>
  43 #include <linux/hidraw.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47 #include <net/bluetooth/l2cap.h>
  48
  49 #include "hidp.h"
  50
  51 #define VERSION "1.2"
  52
  53 static DECLARE_RWSEM(hidp_session_sem);
  54 static LIST_HEAD(hidp_session_list);
  55
  56 static unsigned char hidp_keycode[256] = {
  57           0,  0,  0,  0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36, 37, 38,
  58          50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45, 21, 44,  2,  3,
  59           4,  5,  6,  7,  8,  9, 10, 11, 28,  1, 14, 15, 57, 12, 13, 26,
  60          27, 43, 43, 39, 40, 41, 51, 52, 53, 58, 59, 60, 61, 62, 63, 64,
  61          65, 66, 67, 68, 87, 88, 99, 70,119,110,102,104,111,107,109,106,
  62         105,108,103, 69, 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71,
  63          72, 73, 82, 83, 86,127,116,117,183,184,185,186,187,188,189,190,
  64         191,192,193,194,134,138,130,132,128,129,131,137,133,135,136,113,
  65         115,114,  0,  0,  0,121,  0, 89, 93,124, 92, 94, 95,  0,  0,  0,
  66         122,123, 90, 91, 85,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  67           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  68           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  69           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  70           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  71          29, 42, 56,125, 97, 54,100,126,164,166,165,163,161,115,114,113,
  72         150,158,159,128,136,177,178,176,142,152,173,140
  73 };
  74
  75 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
  76
  77 static struct hidp_session *__hidp_get_session(bdaddr_t *bdaddr)
  78 {
  79         struct hidp_session *session;
  80         struct list_head *p;
  81
  82         BT_DBG("");
  83
  84         list_for_each(p, &hidp_session_list) {
  85                 session = list_entry(p, struct hidp_session, list);
  86                 if (!bacmp(bdaddr, &session->bdaddr))
  87                         return session;
  88         }
  89         return NULL;
  90 }
  91
  92 static void __hidp_link_session(struct hidp_session *session)
  93 {
  94         __module_get(THIS_MODULE);
  95         list_add(&session->list, &hidp_session_list);
  96
  97         hci_conn_hold_device(session->conn);
  98 }
  99
 100 static void __hidp_unlink_session(struct hidp_session *session)
 101 {
 102         hci_conn_put_device(session->conn);
 103
 104         list_del(&session->list);
 105         module_put(THIS_MODULE);
 106 }
 107
 108 static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
 109 {
 110         memset(ci, 0, sizeof(*ci));
 111         bacpy(&ci->bdaddr, &session->bdaddr);
 112
 113         ci->flags = session->flags;
 114         ci->state = session->state;
 115
 116         ci->vendor  = 0x0000;
 117         ci->product = 0x0000;
 118         ci->version = 0x0000;
 119
 120         if (session->input) {
 121                 ci->vendor  = session->input->id.vendor;
 122                 ci->product = session->input->id.product;
 123                 ci->version = session->input->id.version;
 124                 if (session->input->name)
 125                         strncpy(ci->name, session->input->name, 128);
 126                 else
 127                         strncpy(ci->name, "HID Boot Device", 128);
 128         }
 129
 130         if (session->hid) {
 131                 ci->vendor  = session->hid->vendor;
 132                 ci->product = session->hid->product;
 133                 ci->version = session->hid->version;
 134                 strncpy(ci->name, session->hid->name, 128);
 135         }
 136 }
 137
 138 static int hidp_queue_event(struct hidp_session *session, struct input_dev *dev,
 139                                 unsigned int type, unsigned int code, int value)
 140 {
 141         unsigned char newleds;
 142         struct sk_buff *skb;
 143
 144         BT_DBG("session %p type %d code %d value %d", session, type, code, value);
 145
 146         if (type != EV_LED)
 147                 return -1;
 148
 149         newleds = (!!test_bit(LED_KANA,    dev->led) << 3) |
 150                   (!!test_bit(LED_COMPOSE, dev->led) << 3) |
 151                   (!!test_bit(LED_SCROLLL, dev->led) << 2) |
 152                   (!!test_bit(LED_CAPSL,   dev->led) << 1) |
 153                   (!!test_bit(LED_NUML,    dev->led));
 154
 155         if (session->leds == newleds)
 156                 return 0;
 157
 158         session->leds = newleds;
 159
 160         skb = alloc_skb(3, GFP_ATOMIC);
 161         if (!skb) {
 162                 BT_ERR("Can't allocate memory for new frame");
 163                 return -ENOMEM;
 164         }
 165
 166         *skb_put(skb, 1) = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 167         *skb_put(skb, 1) = 0x01;
 168         *skb_put(skb, 1) = newleds;
 169
 170         skb_queue_tail(&session->intr_transmit, skb);
 171
 172         hidp_schedule(session);
 173
 174         return 0;
 175 }
 176
 177 static int hidp_hidinput_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 178 {
 179         struct hid_device *hid = input_get_drvdata(dev);
 180         struct hidp_session *session = hid->driver_data;
 181
 182         return hidp_queue_event(session, dev, type, code, value);
 183 }
 184
 185 static int hidp_input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 186 {
 187         struct hidp_session *session = input_get_drvdata(dev);
 188
 189         return hidp_queue_event(session, dev, type, code, value);
 190 }
 191
 192 static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
 193 {
 194         struct input_dev *dev = session->input;
 195         unsigned char *keys = session->keys;
 196         unsigned char *udata = skb->data + 1;
 197         signed char *sdata = skb->data + 1;
 198         int i, size = skb->len - 1;
 199
 200         switch (skb->data[0]) {
 201         case 0x01:      /* Keyboard report */
 202                 for (i = 0; i < 8; i++)
 203                         input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
 204
 205                 /* If all the key codes have been set to 0x01, it means
 206                  * too many keys were pressed at the same time. */
 207                 if (!memcmp(udata + 2, hidp_mkeyspat, 6))
 208                         break;
 209
 210                 for (i = 2; i < 8; i++) {
 211                         if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) {
 212                                 if (hidp_keycode[keys[i]])
 213                                         input_report_key(dev, hidp_keycode[keys[i]], 0);
 214                                 else
 215                                         BT_ERR("Unknown key (scancode %#x) released.", keys[i]);
 216                         }
 217
 218                         if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) {
 219                                 if (hidp_keycode[udata[i]])
 220                                         input_report_key(dev, hidp_keycode[udata[i]], 1);
 221                                 else
 222                                         BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]);
 223                         }
 224                 }
 225
 226                 memcpy(keys, udata, 8);
 227                 break;
 228
 229         case 0x02:      /* Mouse report */
 230                 input_report_key(dev, BTN_LEFT,   sdata[0] & 0x01);
 231                 input_report_key(dev, BTN_RIGHT,  sdata[0] & 0x02);
 232                 input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
 233                 input_report_key(dev, BTN_SIDE,   sdata[0] & 0x08);
 234                 input_report_key(dev, BTN_EXTRA,  sdata[0] & 0x10);
 235
 236                 input_report_rel(dev, REL_X, sdata[1]);
 237                 input_report_rel(dev, REL_Y, sdata[2]);
 238
 239                 if (size > 3)
 240                         input_report_rel(dev, REL_WHEEL, sdata[3]);
 241                 break;
 242         }
 243
 244         input_sync(dev);
 245 }
 246
 247 static int __hidp_send_ctrl_message(struct hidp_session *session,
 248                         unsigned char hdr, unsigned char *data, int size)
 249 {
 250         struct sk_buff *skb;
 251
 252         BT_DBG("session %p data %p size %d", session, data, size);
 253
 254         skb = alloc_skb(size + 1, GFP_ATOMIC);
 255         if (!skb) {
 256                 BT_ERR("Can't allocate memory for new frame");
 257                 return -ENOMEM;
 258         }
 259
 260         *skb_put(skb, 1) = hdr;
 261         if (data && size > 0)
 262                 memcpy(skb_put(skb, size), data, size);
 263
 264         skb_queue_tail(&session->ctrl_transmit, skb);
 265
 266         return 0;
 267 }
 268
 269 static inline int hidp_send_ctrl_message(struct hidp_session *session,
 270                         unsigned char hdr, unsigned char *data, int size)
 271 {
 272         int err;
 273
 274         err = __hidp_send_ctrl_message(session, hdr, data, size);
 275
 276         hidp_schedule(session);
 277
 278         return err;
 279 }
 280
 281 static int hidp_queue_report(struct hidp_session *session,
 282                                 unsigned char *data, int size)
 283 {
 284         struct sk_buff *skb;
 285
 286         BT_DBG("session %p hid %p data %p size %d", session, session->hid, data, size);
 287
 288         skb = alloc_skb(size + 1, GFP_ATOMIC);
 289         if (!skb) {
 290                 BT_ERR("Can't allocate memory for new frame");
 291                 return -ENOMEM;
 292         }
 293
 294         *skb_put(skb, 1) = 0xa2;
 295         if (size > 0)
 296                 memcpy(skb_put(skb, size), data, size);
 297
 298         skb_queue_tail(&session->intr_transmit, skb);
 299
 300         hidp_schedule(session);
 301
 302         return 0;
 303 }
 304
 305 static int hidp_send_report(struct hidp_session *session, struct hid_report *report)
 306 {
 307         unsigned char buf[32];
 308         int rsize;
 309
 310         rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
 311         if (rsize > sizeof(buf))
 312                 return -EIO;
 313
 314         hid_output_report(report, buf);
 315
 316         return hidp_queue_report(session, buf, rsize);
 317 }
 318
 319 static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count,
 320                 unsigned char report_type)
 321 {
 322         switch (report_type) {
 323         case HID_FEATURE_REPORT:
 324                 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
 325                 break;
 326         case HID_OUTPUT_REPORT:
 327                 report_type = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 328                 break;
 329         default:
 330                 return -EINVAL;
 331         }
 332
 333         if (hidp_send_ctrl_message(hid->driver_data, report_type,
 334                         data, count))
 335                 return -ENOMEM;
 336         return count;
 337 }
 338
 339 static void hidp_idle_timeout(unsigned long arg)
 340 {
 341         struct hidp_session *session = (struct hidp_session *) arg;
 342
 343         atomic_inc(&session->terminate);
 344         hidp_schedule(session);
 345 }
 346
 347 static void hidp_set_timer(struct hidp_session *session)
 348 {
 349         if (session->idle_to > 0)
 350                 mod_timer(&session->timer, jiffies + HZ * session->idle_to);
 351 }
 352
 353 static inline void hidp_del_timer(struct hidp_session *session)
 354 {
 355         if (session->idle_to > 0)
 356                 del_timer(&session->timer);
 357 }
 358
 359 static void hidp_process_handshake(struct hidp_session *session,
 360                                         unsigned char param)
 361 {
 362         BT_DBG("session %p param 0x%02x", session, param);
 363
 364         switch (param) {
 365         case HIDP_HSHK_SUCCESSFUL:
 366                 /* FIXME: Call into SET_ GET_ handlers here */
 367                 break;
 368
 369         case HIDP_HSHK_NOT_READY:
 370         case HIDP_HSHK_ERR_INVALID_REPORT_ID:
 371         case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
 372         case HIDP_HSHK_ERR_INVALID_PARAMETER:
 373                 /* FIXME: Call into SET_ GET_ handlers here */
 374                 break;
 375
 376         case HIDP_HSHK_ERR_UNKNOWN:
 377                 break;
 378
 379         case HIDP_HSHK_ERR_FATAL:
 380                 /* Device requests a reboot, as this is the only way this error
 381                  * can be recovered. */
 382                 __hidp_send_ctrl_message(session,
 383                         HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0);
 384                 break;
 385
 386         default:
 387                 __hidp_send_ctrl_message(session,
 388                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 389                 break;
 390         }
 391 }
 392
 393 static void hidp_process_hid_control(struct hidp_session *session,
 394                                         unsigned char param)
 395 {
 396         BT_DBG("session %p param 0x%02x", session, param);
 397
 398         if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) {
 399                 /* Flush the transmit queues */
 400                 skb_queue_purge(&session->ctrl_transmit);
 401                 skb_queue_purge(&session->intr_transmit);
 402
 403                 /* Kill session thread */
 404                 atomic_inc(&session->terminate);
 405                 hidp_schedule(session);
 406         }
 407 }
 408
 409 static void hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
 410                                 unsigned char param)
 411 {
 412         BT_DBG("session %p skb %p len %d param 0x%02x", session, skb, skb->len, param);
 413
 414         switch (param) {
 415         case HIDP_DATA_RTYPE_INPUT:
 416                 hidp_set_timer(session);
 417
 418                 if (session->input)
 419                         hidp_input_report(session, skb);
 420
 421                 if (session->hid)
 422                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
 423
 424                 break;
 425
 426         case HIDP_DATA_RTYPE_OTHER:
 427         case HIDP_DATA_RTYPE_OUPUT:
 428         case HIDP_DATA_RTYPE_FEATURE:
 429                 break;
 430
 431         default:
 432                 __hidp_send_ctrl_message(session,
 433                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 434         }
 435 }
 436
 437 static void hidp_recv_ctrl_frame(struct hidp_session *session,
 438                                         struct sk_buff *skb)
 439 {
 440         unsigned char hdr, type, param;
 441
 442         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 443
 444         hdr = skb->data[0];
 445         skb_pull(skb, 1);
 446
 447         type = hdr & HIDP_HEADER_TRANS_MASK;
 448         param = hdr & HIDP_HEADER_PARAM_MASK;
 449
 450         switch (type) {
 451         case HIDP_TRANS_HANDSHAKE:
 452                 hidp_process_handshake(session, param);
 453                 break;
 454
 455         case HIDP_TRANS_HID_CONTROL:
 456                 hidp_process_hid_control(session, param);
 457                 break;
 458
 459         case HIDP_TRANS_DATA:
 460                 hidp_process_data(session, skb, param);
 461                 break;
 462
 463         default:
 464                 __hidp_send_ctrl_message(session,
 465                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);
 466                 break;
 467         }
 468
 469         kfree_skb(skb);
 470 }
 471
 472 static void hidp_recv_intr_frame(struct hidp_session *session,
 473                                 struct sk_buff *skb)
 474 {
 475         unsigned char hdr;
 476
 477         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 478
 479         hdr = skb->data[0];
 480         skb_pull(skb, 1);
 481
 482         if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
 483                 hidp_set_timer(session);
 484
 485                 if (session->input)
 486                         hidp_input_report(session, skb);
 487
 488                 if (session->hid) {
 489                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 1);
 490                         BT_DBG("report len %d", skb->len);
 491                 }
 492         } else {
 493                 BT_DBG("Unsupported protocol header 0x%02x", hdr);
 494         }
 495
 496         kfree_skb(skb);
 497 }
 498
 499 static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
 500 {
 501         struct kvec iv = { data, len };
 502         struct msghdr msg;
 503
 504         BT_DBG("sock %p data %p len %d", sock, data, len);
 505
 506         if (!len)
 507                 return 0;
 508
 509         memset(&msg, 0, sizeof(msg));
 510
 511         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 512 }
 513
 514 static void hidp_process_transmit(struct hidp_session *session)
 515 {
 516         struct sk_buff *skb;
 517
 518         BT_DBG("session %p", session);
 519
 520         while ((skb = skb_dequeue(&session->ctrl_transmit))) {
 521                 if (hidp_send_frame(session->ctrl_sock, skb->data, skb->len) < 0) {
 522                         skb_queue_head(&session->ctrl_transmit, skb);
 523                         break;
 524                 }
 525
 526                 hidp_set_timer(session);
 527                 kfree_skb(skb);
 528         }
 529
 530         while ((skb = skb_dequeue(&session->intr_transmit))) {
 531                 if (hidp_send_frame(session->intr_sock, skb->data, skb->len) < 0) {
 532                         skb_queue_head(&session->intr_transmit, skb);
 533                         break;
 534                 }
 535
 536                 hidp_set_timer(session);
 537                 kfree_skb(skb);
 538         }
 539 }
 540
 541 static int hidp_session(void *arg)
 542 {
 543         struct hidp_session *session = arg;
 544         struct sock *ctrl_sk = session->ctrl_sock->sk;
 545         struct sock *intr_sk = session->intr_sock->sk;
 546         struct sk_buff *skb;
 547         int vendor = 0x0000, product = 0x0000;
 548         wait_queue_t ctrl_wait, intr_wait;
 549
 550         BT_DBG("session %p", session);
 551
 552         if (session->input) {
 553                 vendor  = session->input->id.vendor;
 554                 product = session->input->id.product;
 555         }
 556
 557         if (session->hid) {
 558                 vendor  = session->hid->vendor;
 559                 product = session->hid->product;
 560         }
 561
 562         daemonize("khidpd_%04x%04x", vendor, product);
 563         set_user_nice(current, -15);
 564
 565         init_waitqueue_entry(&ctrl_wait, current);
 566         init_waitqueue_entry(&intr_wait, current);
 567         add_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
 568         add_wait_queue(sk_sleep(intr_sk), &intr_wait);
 569         while (!atomic_read(&session->terminate)) {
 570                 set_current_state(TASK_INTERRUPTIBLE);
 571
 572                 if (ctrl_sk->sk_state != BT_CONNECTED || intr_sk->sk_state != BT_CONNECTED)
 573                         break;
 574
 575                 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
 576                         skb_orphan(skb);
 577                         hidp_recv_ctrl_frame(session, skb);
 578                 }
 579
 580                 while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
 581                         skb_orphan(skb);
 582                         hidp_recv_intr_frame(session, skb);
 583                 }
 584
 585                 hidp_process_transmit(session);
 586
 587                 schedule();
 588         }
 589         set_current_state(TASK_RUNNING);
 590         remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
 591         remove_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
 592
 593         down_write(&hidp_session_sem);
 594
 595         hidp_del_timer(session);
 596
 597         if (session->input) {
 598                 input_unregister_device(session->input);
 599                 session->input = NULL;
 600         }
 601
 602         if (session->hid) {
 603                 hid_destroy_device(session->hid);
 604                 session->hid = NULL;
 605         }
 606
 607         /* Wakeup user-space polling for socket errors */
 608         session->intr_sock->sk->sk_err = EUNATCH;
 609         session->ctrl_sock->sk->sk_err = EUNATCH;
 610
 611         hidp_schedule(session);
 612
 613         fput(session->intr_sock->file);
 614
 615         wait_event_timeout(*(sk_sleep(ctrl_sk)),
 616                 (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
 617
 618         fput(session->ctrl_sock->file);
 619
 620         __hidp_unlink_session(session);
 621
 622         up_write(&hidp_session_sem);
 623
 624         kfree(session);
 625         return 0;
 626 }
 627
 628 static struct device *hidp_get_device(struct hidp_session *session)
 629 {
 630         bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
 631         bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
 632         struct device *device = NULL;
 633         struct hci_dev *hdev;
 634
 635         hdev = hci_get_route(dst, src);
 636         if (!hdev)
 637                 return NULL;
 638
 639         session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 640         if (session->conn)
 641                 device = &session->conn->dev;
 642
 643         hci_dev_put(hdev);
 644
 645         return device;
 646 }
 647
 648 static int hidp_setup_input(struct hidp_session *session,
 649                                 struct hidp_connadd_req *req)
 650 {
 651         struct input_dev *input;
 652         int err, i;
 653
 654         input = input_allocate_device();
 655         if (!input)
 656                 return -ENOMEM;
 657
 658         session->input = input;
 659
 660         input_set_drvdata(input, session);
 661
 662         input->name = "Bluetooth HID Boot Protocol Device";
 663
 664         input->id.bustype = BUS_BLUETOOTH;
 665         input->id.vendor  = req->vendor;
 666         input->id.product = req->product;
 667         input->id.version = req->version;
 668
 669         if (req->subclass & 0x40) {
 670                 set_bit(EV_KEY, input->evbit);
 671                 set_bit(EV_LED, input->evbit);
 672                 set_bit(EV_REP, input->evbit);
 673
 674                 set_bit(LED_NUML,    input->ledbit);
 675                 set_bit(LED_CAPSL,   input->ledbit);
 676                 set_bit(LED_SCROLLL, input->ledbit);
 677                 set_bit(LED_COMPOSE, input->ledbit);
 678                 set_bit(LED_KANA,    input->ledbit);
 679
 680                 for (i = 0; i < sizeof(hidp_keycode); i++)
 681                         set_bit(hidp_keycode[i], input->keybit);
 682                 clear_bit(0, input->keybit);
 683         }
 684
 685         if (req->subclass & 0x80) {
 686                 input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
 687                 input->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
 688                         BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
 689                 input->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
 690                 input->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_SIDE) |
 691                         BIT_MASK(BTN_EXTRA);
 692                 input->relbit[0] |= BIT_MASK(REL_WHEEL);
 693         }
 694
 695         input->dev.parent = hidp_get_device(session);
 696
 697         input->event = hidp_input_event;
 698
 699         err = input_register_device(input);
 700         if (err < 0) {
 701                 hci_conn_put_device(session->conn);
 702                 return err;
 703         }
 704
 705         return 0;
 706 }
 707
 708 static int hidp_open(struct hid_device *hid)
 709 {
 710         return 0;
 711 }
 712
 713 static void hidp_close(struct hid_device *hid)
 714 {
 715 }
 716
 717 static int hidp_parse(struct hid_device *hid)
 718 {
 719         struct hidp_session *session = hid->driver_data;
 720
 721         return hid_parse_report(session->hid, session->rd_data,
 722                         session->rd_size);
 723 }
 724
 725 static int hidp_start(struct hid_device *hid)
 726 {
 727         struct hidp_session *session = hid->driver_data;
 728         struct hid_report *report;
 729
 730         list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].
 731                         report_list, list)
 732                 hidp_send_report(session, report);
 733
 734         list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].
 735                         report_list, list)
 736                 hidp_send_report(session, report);
 737
 738         return 0;
 739 }
 740
 741 static void hidp_stop(struct hid_device *hid)
 742 {
 743         struct hidp_session *session = hid->driver_data;
 744
 745         skb_queue_purge(&session->ctrl_transmit);
 746         skb_queue_purge(&session->intr_transmit);
 747
 748         hid->claimed = 0;
 749 }
 750
 751 static struct hid_ll_driver hidp_hid_driver = {
 752         .parse = hidp_parse,
 753         .start = hidp_start,
 754         .stop = hidp_stop,
 755         .open  = hidp_open,
 756         .close = hidp_close,
 757         .hidinput_input_event = hidp_hidinput_event,
 758 };
 759
 760 static int hidp_setup_hid(struct hidp_session *session,
 761                                 struct hidp_connadd_req *req)
 762 {
 763         struct hid_device *hid;
 764         int err;
 765
 766         session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
 767         if (!session->rd_data)
 768                 return -ENOMEM;
 769
 770         if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
 771                 err = -EFAULT;
 772                 goto fault;
 773         }
 774         session->rd_size = req->rd_size;
 775
 776         hid = hid_allocate_device();
 777         if (IS_ERR(hid)) {
 778                 err = PTR_ERR(hid);
 779                 goto fault;
 780         }
 781
 782         session->hid = hid;
 783
 784         hid->driver_data = session;
 785
 786         hid->bus     = BUS_BLUETOOTH;
 787         hid->vendor  = req->vendor;
 788         hid->product = req->product;
 789         hid->version = req->version;
 790         hid->country = req->country;
 791
 792         strncpy(hid->name, req->name, 128);
 793         strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64);
 794         strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64);
 795
 796         hid->dev.parent = hidp_get_device(session);
 797         hid->ll_driver = &hidp_hid_driver;
 798
 799         hid->hid_output_raw_report = hidp_output_raw_report;
 800
 801         err = hid_add_device(hid);
 802         if (err < 0)
 803                 goto failed;
 804
 805         return 0;
 806
 807 failed:
 808         hid_destroy_device(hid);
 809         session->hid = NULL;
 810
 811 fault:
 812         kfree(session->rd_data);
 813         session->rd_data = NULL;
 814
 815         return err;
 816 }
 817
 818 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
 819 {
 820         struct hidp_session *session, *s;
 821         int err;
 822
 823         BT_DBG("");
 824
 825         if (bacmp(&bt_sk(ctrl_sock->sk)->src, &bt_sk(intr_sock->sk)->src) ||
 826                         bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
 827                 return -ENOTUNIQ;
 828
 829         session = kzalloc(sizeof(struct hidp_session), GFP_KERNEL);
 830         if (!session)
 831                 return -ENOMEM;
 832
 833         BT_DBG("rd_data %p rd_size %d", req->rd_data, req->rd_size);
 834
 835         down_write(&hidp_session_sem);
 836
 837         s = __hidp_get_session(&bt_sk(ctrl_sock->sk)->dst);
 838         if (s && s->state == BT_CONNECTED) {
 839                 err = -EEXIST;
 840                 goto failed;
 841         }
 842
 843         bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
 844
 845         session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->omtu, l2cap_pi(ctrl_sock->sk)->imtu);
 846         session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->omtu, l2cap_pi(intr_sock->sk)->imtu);
 847
 848         BT_DBG("ctrl mtu %d intr mtu %d", session->ctrl_mtu, session->intr_mtu);
 849
 850         session->ctrl_sock = ctrl_sock;
 851         session->intr_sock = intr_sock;
 852         session->state     = BT_CONNECTED;
 853
 854         setup_timer(&session->timer, hidp_idle_timeout, (unsigned long)session);
 855
 856         skb_queue_head_init(&session->ctrl_transmit);
 857         skb_queue_head_init(&session->intr_transmit);
 858
 859         session->flags   = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
 860         session->idle_to = req->idle_to;
 861
 862         if (req->rd_size > 0) {
 863                 err = hidp_setup_hid(session, req);
 864                 if (err && err != -ENODEV)
 865                         goto purge;
 866         }
 867
 868         if (!session->hid) {
 869                 err = hidp_setup_input(session, req);
 870                 if (err < 0)
 871                         goto purge;
 872         }
 873
 874         __hidp_link_session(session);
 875
 876         hidp_set_timer(session);
 877
 878         err = kernel_thread(hidp_session, session, CLONE_KERNEL);
 879         if (err < 0)
 880                 goto unlink;
 881
 882         if (session->input) {
 883                 hidp_send_ctrl_message(session,
 884                         HIDP_TRANS_SET_PROTOCOL | HIDP_PROTO_BOOT, NULL, 0);
 885                 session->flags |= (1 << HIDP_BOOT_PROTOCOL_MODE);
 886
 887                 session->leds = 0xff;
 888                 hidp_input_event(session->input, EV_LED, 0, 0);
 889         }
 890
 891         up_write(&hidp_session_sem);
 892         return 0;
 893
 894 unlink:
 895         hidp_del_timer(session);
 896
 897         __hidp_unlink_session(session);
 898
 899         if (session->input) {
 900                 input_unregister_device(session->input);
 901                 session->input = NULL;
 902         }
 903
 904         if (session->hid) {
 905                 hid_destroy_device(session->hid);
 906                 session->hid = NULL;
 907         }
 908
 909         kfree(session->rd_data);
 910         session->rd_data = NULL;
 911
 912 purge:
 913         skb_queue_purge(&session->ctrl_transmit);
 914         skb_queue_purge(&session->intr_transmit);
 915
 916 failed:
 917         up_write(&hidp_session_sem);
 918
 919         input_free_device(session->input);
 920         kfree(session);
 921         return err;
 922 }
 923
 924 int hidp_del_connection(struct hidp_conndel_req *req)
 925 {
 926         struct hidp_session *session;
 927         int err = 0;
 928
 929         BT_DBG("");
 930
 931         down_read(&hidp_session_sem);
 932
 933         session = __hidp_get_session(&req->bdaddr);
 934         if (session) {
 935                 if (req->flags & (1 << HIDP_VIRTUAL_CABLE_UNPLUG)) {
 936                         hidp_send_ctrl_message(session,
 937                                 HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG, NULL, 0);
 938                 } else {
 939                         /* Flush the transmit queues */
 940                         skb_queue_purge(&session->ctrl_transmit);
 941                         skb_queue_purge(&session->intr_transmit);
 942
 943                         /* Wakeup user-space polling for socket errors */
 944                         session->intr_sock->sk->sk_err = EUNATCH;
 945                         session->ctrl_sock->sk->sk_err = EUNATCH;
 946
 947                         /* Kill session thread */
 948                         atomic_inc(&session->terminate);
 949                         hidp_schedule(session);
 950                 }
 951         } else
 952                 err = -ENOENT;
 953
 954         up_read(&hidp_session_sem);
 955         return err;
 956 }
 957
 958 int hidp_get_connlist(struct hidp_connlist_req *req)
 959 {
 960         struct list_head *p;
 961         int err = 0, n = 0;
 962
 963         BT_DBG("");
 964
 965         down_read(&hidp_session_sem);
 966
 967         list_for_each(p, &hidp_session_list) {
 968                 struct hidp_session *session;
 969                 struct hidp_conninfo ci;
 970
 971                 session = list_entry(p, struct hidp_session, list);
 972
 973                 __hidp_copy_session(session, &ci);
 974
 975                 if (copy_to_user(req->ci, &ci, sizeof(ci))) {
 976                         err = -EFAULT;
 977                         break;
 978                 }
 979
 980                 if (++n >= req->cnum)
 981                         break;
 982
 983                 req->ci++;
 984         }
 985         req->cnum = n;
 986
 987         up_read(&hidp_session_sem);
 988         return err;
 989 }
 990
 991 int hidp_get_conninfo(struct hidp_conninfo *ci)
 992 {
 993         struct hidp_session *session;
 994         int err = 0;
 995
 996         down_read(&hidp_session_sem);
 997
 998         session = __hidp_get_session(&ci->bdaddr);
 999         if (session)
1000                 __hidp_copy_session(session, ci);
1001         else
1002                 err = -ENOENT;
1003
1004         up_read(&hidp_session_sem);
1005         return err;
1006 }
1007
1008 static const struct hid_device_id hidp_table[] = {
1009         { HID_BLUETOOTH_DEVICE(HID_ANY_ID, HID_ANY_ID) },
1010         { }
1011 };
1012
1013 static struct hid_driver hidp_driver = {
1014         .name = "generic-bluetooth",
1015         .id_table = hidp_table,
1016 };
1017
1018 static int __init hidp_init(void)
1019 {
1020         int ret;
1021
1022         BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
1023
1024         ret = hid_register_driver(&hidp_driver);
1025         if (ret)
1026                 goto err;
1027
1028         ret = hidp_init_sockets();
1029         if (ret)
1030                 goto err_drv;
1031
1032         return 0;
1033 err_drv:
1034         hid_unregister_driver(&hidp_driver);
1035 err:
1036         return ret;
1037 }
1038
1039 static void __exit hidp_exit(void)
1040 {
1041         hidp_cleanup_sockets();
1042         hid_unregister_driver(&hidp_driver);
1043 }
1044
1045 module_init(hidp_init);
1046 module_exit(hidp_exit);
1047
1048 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1049 MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION);
1050 MODULE_VERSION(VERSION);
1051 MODULE_LICENSE("GPL");
1052 MODULE_ALIAS("bt-proto-6");