net/bluetooth/hidp/core.c

   1 /*
   2    HIDP implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 #include <linux/module.h>
  24
  25 #include <linux/types.h>
  26 #include <linux/errno.h>
  27 #include <linux/kernel.h>
  28 #include <linux/sched.h>
  29 #include <linux/slab.h>
  30 #include <linux/poll.h>
  31 #include <linux/freezer.h>
  32 #include <linux/fcntl.h>
  33 #include <linux/skbuff.h>
  34 #include <linux/socket.h>
  35 #include <linux/ioctl.h>
  36 #include <linux/file.h>
  37 #include <linux/init.h>
  38 #include <linux/wait.h>
  39 #include <linux/mutex.h>
  40 #include <net/sock.h>
  41
  42 #include <linux/input.h>
  43 #include <linux/hid.h>
  44 #include <linux/hidraw.h>
  45
  46 #include <net/bluetooth/bluetooth.h>
  47 #include <net/bluetooth/hci_core.h>
  48 #include <net/bluetooth/l2cap.h>
  49
  50 #include "hidp.h"
  51
  52 #define VERSION "1.2"
  53
  54 static DECLARE_RWSEM(hidp_session_sem);
  55 static LIST_HEAD(hidp_session_list);
  56
  57 static unsigned char hidp_keycode[256] = {
  58           0,  0,  0,  0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36, 37, 38,
  59          50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45, 21, 44,  2,  3,
  60           4,  5,  6,  7,  8,  9, 10, 11, 28,  1, 14, 15, 57, 12, 13, 26,
  61          27, 43, 43, 39, 40, 41, 51, 52, 53, 58, 59, 60, 61, 62, 63, 64,
  62          65, 66, 67, 68, 87, 88, 99, 70,119,110,102,104,111,107,109,106,
  63         105,108,103, 69, 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71,
  64          72, 73, 82, 83, 86,127,116,117,183,184,185,186,187,188,189,190,
  65         191,192,193,194,134,138,130,132,128,129,131,137,133,135,136,113,
  66         115,114,  0,  0,  0,121,  0, 89, 93,124, 92, 94, 95,  0,  0,  0,
  67         122,123, 90, 91, 85,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  68           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  69           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  70           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  71           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  72          29, 42, 56,125, 97, 54,100,126,164,166,165,163,161,115,114,113,
  73         150,158,159,128,136,177,178,176,142,152,173,140
  74 };
  75
  76 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
  77
  78 static struct hidp_session *__hidp_get_session(bdaddr_t *bdaddr)
  79 {
  80         struct hidp_session *session;
  81         struct list_head *p;
  82
  83         BT_DBG("");
  84
  85         list_for_each(p, &hidp_session_list) {
  86                 session = list_entry(p, struct hidp_session, list);
  87                 if (!bacmp(bdaddr, &session->bdaddr))
  88                         return session;
  89         }
  90         return NULL;
  91 }
  92
  93 static void __hidp_link_session(struct hidp_session *session)
  94 {
  95         __module_get(THIS_MODULE);
  96         list_add(&session->list, &hidp_session_list);
  97
  98         hci_conn_hold_device(session->conn);
  99 }
 100
 101 static void __hidp_unlink_session(struct hidp_session *session)
 102 {
 103         hci_conn_put_device(session->conn);
 104
 105         list_del(&session->list);
 106         module_put(THIS_MODULE);
 107 }
 108
 109 static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
 110 {
 111         memset(ci, 0, sizeof(*ci));
 112         bacpy(&ci->bdaddr, &session->bdaddr);
 113
 114         ci->flags = session->flags;
 115         ci->state = session->state;
 116
 117         ci->vendor  = 0x0000;
 118         ci->product = 0x0000;
 119         ci->version = 0x0000;
 120
 121         if (session->input) {
 122                 ci->vendor  = session->input->id.vendor;
 123                 ci->product = session->input->id.product;
 124                 ci->version = session->input->id.version;
 125                 if (session->input->name)
 126                         strncpy(ci->name, session->input->name, 128);
 127                 else
 128                         strncpy(ci->name, "HID Boot Device", 128);
 129         }
 130
 131         if (session->hid) {
 132                 ci->vendor  = session->hid->vendor;
 133                 ci->product = session->hid->product;
 134                 ci->version = session->hid->version;
 135                 strncpy(ci->name, session->hid->name, 128);
 136         }
 137 }
 138
 139 static int hidp_queue_event(struct hidp_session *session, struct input_dev *dev,
 140                                 unsigned int type, unsigned int code, int value)
 141 {
 142         unsigned char newleds;
 143         struct sk_buff *skb;
 144
 145         BT_DBG("session %p type %d code %d value %d", session, type, code, value);
 146
 147         if (type != EV_LED)
 148                 return -1;
 149
 150         newleds = (!!test_bit(LED_KANA,    dev->led) << 3) |
 151                   (!!test_bit(LED_COMPOSE, dev->led) << 3) |
 152                   (!!test_bit(LED_SCROLLL, dev->led) << 2) |
 153                   (!!test_bit(LED_CAPSL,   dev->led) << 1) |
 154                   (!!test_bit(LED_NUML,    dev->led));
 155
 156         if (session->leds == newleds)
 157                 return 0;
 158
 159         session->leds = newleds;
 160
 161         skb = alloc_skb(3, GFP_ATOMIC);
 162         if (!skb) {
 163                 BT_ERR("Can't allocate memory for new frame");
 164                 return -ENOMEM;
 165         }
 166
 167         *skb_put(skb, 1) = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 168         *skb_put(skb, 1) = 0x01;
 169         *skb_put(skb, 1) = newleds;
 170
 171         skb_queue_tail(&session->intr_transmit, skb);
 172
 173         hidp_schedule(session);
 174
 175         return 0;
 176 }
 177
 178 static int hidp_hidinput_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 179 {
 180         struct hid_device *hid = input_get_drvdata(dev);
 181         struct hidp_session *session = hid->driver_data;
 182
 183         return hidp_queue_event(session, dev, type, code, value);
 184 }
 185
 186 static int hidp_input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 187 {
 188         struct hidp_session *session = input_get_drvdata(dev);
 189
 190         return hidp_queue_event(session, dev, type, code, value);
 191 }
 192
 193 static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
 194 {
 195         struct input_dev *dev = session->input;
 196         unsigned char *keys = session->keys;
 197         unsigned char *udata = skb->data + 1;
 198         signed char *sdata = skb->data + 1;
 199         int i, size = skb->len - 1;
 200
 201         switch (skb->data[0]) {
 202         case 0x01:      /* Keyboard report */
 203                 for (i = 0; i < 8; i++)
 204                         input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
 205
 206                 /* If all the key codes have been set to 0x01, it means
 207                  * too many keys were pressed at the same time. */
 208                 if (!memcmp(udata + 2, hidp_mkeyspat, 6))
 209                         break;
 210
 211                 for (i = 2; i < 8; i++) {
 212                         if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) {
 213                                 if (hidp_keycode[keys[i]])
 214                                         input_report_key(dev, hidp_keycode[keys[i]], 0);
 215                                 else
 216                                         BT_ERR("Unknown key (scancode %#x) released.", keys[i]);
 217                         }
 218
 219                         if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) {
 220                                 if (hidp_keycode[udata[i]])
 221                                         input_report_key(dev, hidp_keycode[udata[i]], 1);
 222                                 else
 223                                         BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]);
 224                         }
 225                 }
 226
 227                 memcpy(keys, udata, 8);
 228                 break;
 229
 230         case 0x02:      /* Mouse report */
 231                 input_report_key(dev, BTN_LEFT,   sdata[0] & 0x01);
 232                 input_report_key(dev, BTN_RIGHT,  sdata[0] & 0x02);
 233                 input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
 234                 input_report_key(dev, BTN_SIDE,   sdata[0] & 0x08);
 235                 input_report_key(dev, BTN_EXTRA,  sdata[0] & 0x10);
 236
 237                 input_report_rel(dev, REL_X, sdata[1]);
 238                 input_report_rel(dev, REL_Y, sdata[2]);
 239
 240                 if (size > 3)
 241                         input_report_rel(dev, REL_WHEEL, sdata[3]);
 242                 break;
 243         }
 244
 245         input_sync(dev);
 246 }
 247
 248 static int __hidp_send_ctrl_message(struct hidp_session *session,
 249                         unsigned char hdr, unsigned char *data, int size)
 250 {
 251         struct sk_buff *skb;
 252
 253         BT_DBG("session %p data %p size %d", session, data, size);
 254
 255         skb = alloc_skb(size + 1, GFP_ATOMIC);
 256         if (!skb) {
 257                 BT_ERR("Can't allocate memory for new frame");
 258                 return -ENOMEM;
 259         }
 260
 261         *skb_put(skb, 1) = hdr;
 262         if (data && size > 0)
 263                 memcpy(skb_put(skb, size), data, size);
 264
 265         skb_queue_tail(&session->ctrl_transmit, skb);
 266
 267         return 0;
 268 }
 269
 270 static inline int hidp_send_ctrl_message(struct hidp_session *session,
 271                         unsigned char hdr, unsigned char *data, int size)
 272 {
 273         int err;
 274
 275         err = __hidp_send_ctrl_message(session, hdr, data, size);
 276
 277         hidp_schedule(session);
 278
 279         return err;
 280 }
 281
 282 static int hidp_queue_report(struct hidp_session *session,
 283                                 unsigned char *data, int size)
 284 {
 285         struct sk_buff *skb;
 286
 287         BT_DBG("session %p hid %p data %p size %d", session, session->hid, data, size);
 288
 289         skb = alloc_skb(size + 1, GFP_ATOMIC);
 290         if (!skb) {
 291                 BT_ERR("Can't allocate memory for new frame");
 292                 return -ENOMEM;
 293         }
 294
 295         *skb_put(skb, 1) = 0xa2;
 296         if (size > 0)
 297                 memcpy(skb_put(skb, size), data, size);
 298
 299         skb_queue_tail(&session->intr_transmit, skb);
 300
 301         hidp_schedule(session);
 302
 303         return 0;
 304 }
 305
 306 static int hidp_send_report(struct hidp_session *session, struct hid_report *report)
 307 {
 308         unsigned char buf[32];
 309         int rsize;
 310
 311         rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
 312         if (rsize > sizeof(buf))
 313                 return -EIO;
 314
 315         hid_output_report(report, buf);
 316
 317         return hidp_queue_report(session, buf, rsize);
 318 }
 319
 320 static int hidp_get_raw_report(struct hid_device *hid,
 321                 unsigned char report_number,
 322                 unsigned char *data, size_t count,
 323                 unsigned char report_type)
 324 {
 325         struct hidp_session *session = hid->driver_data;
 326         struct sk_buff *skb;
 327         size_t len;
 328         int numbered_reports = hid->report_enum[report_type].numbered;
 329
 330         switch (report_type) {
 331         case HID_FEATURE_REPORT:
 332                 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_FEATURE;
 333                 break;
 334         case HID_INPUT_REPORT:
 335                 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_INPUT;
 336                 break;
 337         case HID_OUTPUT_REPORT:
 338                 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_OUPUT;
 339                 break;
 340         default:
 341                 return -EINVAL;
 342         }
 343
 344         if (mutex_lock_interruptible(&session->report_mutex))
 345                 return -ERESTARTSYS;
 346
 347         /* Set up our wait, and send the report request to the device. */
 348         session->waiting_report_type = report_type & HIDP_DATA_RTYPE_MASK;
 349         session->waiting_report_number = numbered_reports ? report_number : -1;
 350         set_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 351         data[0] = report_number;
 352         if (hidp_send_ctrl_message(hid->driver_data, report_type, data, 1))
 353                 goto err_eio;
 354
 355         /* Wait for the return of the report. The returned report
 356            gets put in session->report_return.  */
 357         while (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags)) {
 358                 int res;
 359
 360                 res = wait_event_interruptible_timeout(session->report_queue,
 361                         !test_bit(HIDP_WAITING_FOR_RETURN, &session->flags),
 362                         5*HZ);
 363                 if (res == 0) {
 364                         /* timeout */
 365                         goto err_eio;
 366                 }
 367                 if (res < 0) {
 368                         /* signal */
 369                         goto err_restartsys;
 370                 }
 371         }
 372
 373         skb = session->report_return;
 374         if (skb) {
 375                 len = skb->len < count ? skb->len : count;
 376                 memcpy(data, skb->data, len);
 377
 378                 kfree_skb(skb);
 379                 session->report_return = NULL;
 380         } else {
 381                 /* Device returned a HANDSHAKE, indicating  protocol error. */
 382                 len = -EIO;
 383         }
 384
 385         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 386         mutex_unlock(&session->report_mutex);
 387
 388         return len;
 389
 390 err_restartsys:
 391         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 392         mutex_unlock(&session->report_mutex);
 393         return -ERESTARTSYS;
 394 err_eio:
 395         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 396         mutex_unlock(&session->report_mutex);
 397         return -EIO;
 398 }
 399
 400 static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count,
 401                 unsigned char report_type)
 402 {
 403         struct hidp_session *session = hid->driver_data;
 404         int ret;
 405
 406         switch (report_type) {
 407         case HID_FEATURE_REPORT:
 408                 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
 409                 break;
 410         case HID_OUTPUT_REPORT:
 411                 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_OUPUT;
 412                 break;
 413         default:
 414                 return -EINVAL;
 415         }
 416
 417         if (mutex_lock_interruptible(&session->report_mutex))
 418                 return -ERESTARTSYS;
 419
 420         /* Set up our wait, and send the report request to the device. */
 421         set_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
 422         if (hidp_send_ctrl_message(hid->driver_data, report_type,
 423                         data, count)) {
 424                 ret = -ENOMEM;
 425                 goto err;
 426         }
 427
 428         /* Wait for the ACK from the device. */
 429         while (test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags)) {
 430                 int res;
 431
 432                 res = wait_event_interruptible_timeout(session->report_queue,
 433                         !test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags),
 434                         10*HZ);
 435                 if (res == 0) {
 436                         /* timeout */
 437                         ret = -EIO;
 438                         goto err;
 439                 }
 440                 if (res < 0) {
 441                         /* signal */
 442                         ret = -ERESTARTSYS;
 443                         goto err;
 444                 }
 445         }
 446
 447         if (!session->output_report_success) {
 448                 ret = -EIO;
 449                 goto err;
 450         }
 451
 452         ret = count;
 453
 454 err:
 455         clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
 456         mutex_unlock(&session->report_mutex);
 457         return ret;
 458 }
 459
 460 static void hidp_idle_timeout(unsigned long arg)
 461 {
 462         struct hidp_session *session = (struct hidp_session *) arg;
 463
 464         atomic_inc(&session->terminate);
 465         hidp_schedule(session);
 466 }
 467
 468 static void hidp_set_timer(struct hidp_session *session)
 469 {
 470         if (session->idle_to > 0)
 471                 mod_timer(&session->timer, jiffies + HZ * session->idle_to);
 472 }
 473
 474 static inline void hidp_del_timer(struct hidp_session *session)
 475 {
 476         if (session->idle_to > 0)
 477                 del_timer(&session->timer);
 478 }
 479
 480 static void hidp_process_handshake(struct hidp_session *session,
 481                                         unsigned char param)
 482 {
 483         BT_DBG("session %p param 0x%02x", session, param);
 484         session->output_report_success = 0; /* default condition */
 485
 486         switch (param) {
 487         case HIDP_HSHK_SUCCESSFUL:
 488                 /* FIXME: Call into SET_ GET_ handlers here */
 489                 session->output_report_success = 1;
 490                 break;
 491
 492         case HIDP_HSHK_NOT_READY:
 493         case HIDP_HSHK_ERR_INVALID_REPORT_ID:
 494         case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
 495         case HIDP_HSHK_ERR_INVALID_PARAMETER:
 496                 if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags)) {
 497                         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 498                         wake_up_interruptible(&session->report_queue);
 499                 }
 500                 /* FIXME: Call into SET_ GET_ handlers here */
 501                 break;
 502
 503         case HIDP_HSHK_ERR_UNKNOWN:
 504                 break;
 505
 506         case HIDP_HSHK_ERR_FATAL:
 507                 /* Device requests a reboot, as this is the only way this error
 508                  * can be recovered. */
 509                 __hidp_send_ctrl_message(session,
 510                         HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0);
 511                 break;
 512
 513         default:
 514                 __hidp_send_ctrl_message(session,
 515                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 516                 break;
 517         }
 518
 519         /* Wake up the waiting thread. */
 520         if (test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags)) {
 521                 clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
 522                 wake_up_interruptible(&session->report_queue);
 523         }
 524 }
 525
 526 static void hidp_process_hid_control(struct hidp_session *session,
 527                                         unsigned char param)
 528 {
 529         BT_DBG("session %p param 0x%02x", session, param);
 530
 531         if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) {
 532                 /* Flush the transmit queues */
 533                 skb_queue_purge(&session->ctrl_transmit);
 534                 skb_queue_purge(&session->intr_transmit);
 535
 536                 /* Kill session thread */
 537                 atomic_inc(&session->terminate);
 538                 hidp_schedule(session);
 539         }
 540 }
 541
 542 /* Returns true if the passed-in skb should be freed by the caller. */
 543 static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
 544                                 unsigned char param)
 545 {
 546         int done_with_skb = 1;
 547         BT_DBG("session %p skb %p len %d param 0x%02x", session, skb, skb->len, param);
 548
 549         switch (param) {
 550         case HIDP_DATA_RTYPE_INPUT:
 551                 hidp_set_timer(session);
 552
 553                 if (session->input)
 554                         hidp_input_report(session, skb);
 555
 556                 if (session->hid)
 557                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
 558                 break;
 559
 560         case HIDP_DATA_RTYPE_OTHER:
 561         case HIDP_DATA_RTYPE_OUPUT:
 562         case HIDP_DATA_RTYPE_FEATURE:
 563                 break;
 564
 565         default:
 566                 __hidp_send_ctrl_message(session,
 567                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 568         }
 569
 570         if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) &&
 571                                 param == session->waiting_report_type) {
 572                 if (session->waiting_report_number < 0 ||
 573                     session->waiting_report_number == skb->data[0]) {
 574                         /* hidp_get_raw_report() is waiting on this report. */
 575                         session->report_return = skb;
 576                         done_with_skb = 0;
 577                         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 578                         wake_up_interruptible(&session->report_queue);
 579                 }
 580         }
 581
 582         return done_with_skb;
 583 }
 584
 585 static void hidp_recv_ctrl_frame(struct hidp_session *session,
 586                                         struct sk_buff *skb)
 587 {
 588         unsigned char hdr, type, param;
 589         int free_skb = 1;
 590
 591         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 592
 593         hdr = skb->data[0];
 594         skb_pull(skb, 1);
 595
 596         type = hdr & HIDP_HEADER_TRANS_MASK;
 597         param = hdr & HIDP_HEADER_PARAM_MASK;
 598
 599         switch (type) {
 600         case HIDP_TRANS_HANDSHAKE:
 601                 hidp_process_handshake(session, param);
 602                 break;
 603
 604         case HIDP_TRANS_HID_CONTROL:
 605                 hidp_process_hid_control(session, param);
 606                 break;
 607
 608         case HIDP_TRANS_DATA:
 609                 free_skb = hidp_process_data(session, skb, param);
 610                 break;
 611
 612         default:
 613                 __hidp_send_ctrl_message(session,
 614                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);
 615                 break;
 616         }
 617
 618         if (free_skb)
 619                 kfree_skb(skb);
 620 }
 621
 622 static void hidp_recv_intr_frame(struct hidp_session *session,
 623                                 struct sk_buff *skb)
 624 {
 625         unsigned char hdr;
 626
 627         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 628
 629         hdr = skb->data[0];
 630         skb_pull(skb, 1);
 631
 632         if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
 633                 hidp_set_timer(session);
 634
 635                 if (session->input)
 636                         hidp_input_report(session, skb);
 637
 638                 if (session->hid) {
 639                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 1);
 640                         BT_DBG("report len %d", skb->len);
 641                 }
 642         } else {
 643                 BT_DBG("Unsupported protocol header 0x%02x", hdr);
 644         }
 645
 646         kfree_skb(skb);
 647 }
 648
 649 static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
 650 {
 651         struct kvec iv = { data, len };
 652         struct msghdr msg;
 653
 654         BT_DBG("sock %p data %p len %d", sock, data, len);
 655
 656         if (!len)
 657                 return 0;
 658
 659         memset(&msg, 0, sizeof(msg));
 660
 661         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 662 }
 663
 664 static void hidp_process_transmit(struct hidp_session *session)
 665 {
 666         struct sk_buff *skb;
 667
 668         BT_DBG("session %p", session);
 669
 670         while ((skb = skb_dequeue(&session->ctrl_transmit))) {
 671                 if (hidp_send_frame(session->ctrl_sock, skb->data, skb->len) < 0) {
 672                         skb_queue_head(&session->ctrl_transmit, skb);
 673                         break;
 674                 }
 675
 676                 hidp_set_timer(session);
 677                 kfree_skb(skb);
 678         }
 679
 680         while ((skb = skb_dequeue(&session->intr_transmit))) {
 681                 if (hidp_send_frame(session->intr_sock, skb->data, skb->len) < 0) {
 682                         skb_queue_head(&session->intr_transmit, skb);
 683                         break;
 684                 }
 685
 686                 hidp_set_timer(session);
 687                 kfree_skb(skb);
 688         }
 689 }
 690
 691 static int hidp_session(void *arg)
 692 {
 693         struct hidp_session *session = arg;
 694         struct sock *ctrl_sk = session->ctrl_sock->sk;
 695         struct sock *intr_sk = session->intr_sock->sk;
 696         struct sk_buff *skb;
 697         int vendor = 0x0000, product = 0x0000;
 698         wait_queue_t ctrl_wait, intr_wait;
 699
 700         BT_DBG("session %p", session);
 701
 702         if (session->input) {
 703                 vendor  = session->input->id.vendor;
 704                 product = session->input->id.product;
 705         }
 706
 707         if (session->hid) {
 708                 vendor  = session->hid->vendor;
 709                 product = session->hid->product;
 710         }
 711
 712         daemonize("khidpd_%04x%04x", vendor, product);
 713         set_user_nice(current, -15);
 714
 715         init_waitqueue_entry(&ctrl_wait, current);
 716         init_waitqueue_entry(&intr_wait, current);
 717         add_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
 718         add_wait_queue(sk_sleep(intr_sk), &intr_wait);
 719         session->waiting_for_startup = 0;
 720         wake_up_interruptible(&session->startup_queue);
 721         while (!atomic_read(&session->terminate)) {
 722                 set_current_state(TASK_INTERRUPTIBLE);
 723
 724                 if (ctrl_sk->sk_state != BT_CONNECTED || intr_sk->sk_state != BT_CONNECTED)
 725                         break;
 726
 727                 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
 728                         skb_orphan(skb);
 729                         hidp_recv_ctrl_frame(session, skb);
 730                 }
 731
 732                 while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
 733                         skb_orphan(skb);
 734                         hidp_recv_intr_frame(session, skb);
 735                 }
 736
 737                 hidp_process_transmit(session);
 738
 739                 schedule();
 740         }
 741         set_current_state(TASK_RUNNING);
 742         remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
 743         remove_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
 744
 745         down_write(&hidp_session_sem);
 746
 747         hidp_del_timer(session);
 748
 749         if (session->input) {
 750                 input_unregister_device(session->input);
 751                 session->input = NULL;
 752         }
 753
 754         if (session->hid) {
 755                 hid_destroy_device(session->hid);
 756                 session->hid = NULL;
 757         }
 758
 759         /* Wakeup user-space polling for socket errors */
 760         session->intr_sock->sk->sk_err = EUNATCH;
 761         session->ctrl_sock->sk->sk_err = EUNATCH;
 762
 763         hidp_schedule(session);
 764
 765         fput(session->intr_sock->file);
 766
 767         wait_event_timeout(*(sk_sleep(ctrl_sk)),
 768                 (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
 769
 770         fput(session->ctrl_sock->file);
 771
 772         __hidp_unlink_session(session);
 773
 774         up_write(&hidp_session_sem);
 775
 776         kfree(session);
 777         return 0;
 778 }
 779
 780 static struct device *hidp_get_device(struct hidp_session *session)
 781 {
 782         bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
 783         bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
 784         struct device *device = NULL;
 785         struct hci_dev *hdev;
 786
 787         hdev = hci_get_route(dst, src);
 788         if (!hdev)
 789                 return NULL;
 790
 791         session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 792         if (session->conn)
 793                 device = &session->conn->dev;
 794
 795         hci_dev_put(hdev);
 796
 797         return device;
 798 }
 799
 800 static int hidp_setup_input(struct hidp_session *session,
 801                                 struct hidp_connadd_req *req)
 802 {
 803         struct input_dev *input;
 804         int err, i;
 805
 806         input = input_allocate_device();
 807         if (!input)
 808                 return -ENOMEM;
 809
 810         session->input = input;
 811
 812         input_set_drvdata(input, session);
 813
 814         input->name = "Bluetooth HID Boot Protocol Device";
 815
 816         input->id.bustype = BUS_BLUETOOTH;
 817         input->id.vendor  = req->vendor;
 818         input->id.product = req->product;
 819         input->id.version = req->version;
 820
 821         if (req->subclass & 0x40) {
 822                 set_bit(EV_KEY, input->evbit);
 823                 set_bit(EV_LED, input->evbit);
 824                 set_bit(EV_REP, input->evbit);
 825
 826                 set_bit(LED_NUML,    input->ledbit);
 827                 set_bit(LED_CAPSL,   input->ledbit);
 828                 set_bit(LED_SCROLLL, input->ledbit);
 829                 set_bit(LED_COMPOSE, input->ledbit);
 830                 set_bit(LED_KANA,    input->ledbit);
 831
 832                 for (i = 0; i < sizeof(hidp_keycode); i++)
 833                         set_bit(hidp_keycode[i], input->keybit);
 834                 clear_bit(0, input->keybit);
 835         }
 836
 837         if (req->subclass & 0x80) {
 838                 input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
 839                 input->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
 840                         BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
 841                 input->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
 842                 input->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_SIDE) |
 843                         BIT_MASK(BTN_EXTRA);
 844                 input->relbit[0] |= BIT_MASK(REL_WHEEL);
 845         }
 846
 847         input->dev.parent = hidp_get_device(session);
 848
 849         input->event = hidp_input_event;
 850
 851         err = input_register_device(input);
 852         if (err < 0) {
 853                 hci_conn_put_device(session->conn);
 854                 return err;
 855         }
 856
 857         return 0;
 858 }
 859
 860 static int hidp_open(struct hid_device *hid)
 861 {
 862         return 0;
 863 }
 864
 865 static void hidp_close(struct hid_device *hid)
 866 {
 867 }
 868
 869 static int hidp_parse(struct hid_device *hid)
 870 {
 871         struct hidp_session *session = hid->driver_data;
 872
 873         return hid_parse_report(session->hid, session->rd_data,
 874                         session->rd_size);
 875 }
 876
 877 static int hidp_start(struct hid_device *hid)
 878 {
 879         struct hidp_session *session = hid->driver_data;
 880         struct hid_report *report;
 881
 882         list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].
 883                         report_list, list)
 884                 hidp_send_report(session, report);
 885
 886         list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].
 887                         report_list, list)
 888                 hidp_send_report(session, report);
 889
 890         return 0;
 891 }
 892
 893 static void hidp_stop(struct hid_device *hid)
 894 {
 895         struct hidp_session *session = hid->driver_data;
 896
 897         skb_queue_purge(&session->ctrl_transmit);
 898         skb_queue_purge(&session->intr_transmit);
 899
 900         hid->claimed = 0;
 901 }
 902
 903 static struct hid_ll_driver hidp_hid_driver = {
 904         .parse = hidp_parse,
 905         .start = hidp_start,
 906         .stop = hidp_stop,
 907         .open  = hidp_open,
 908         .close = hidp_close,
 909         .hidinput_input_event = hidp_hidinput_event,
 910 };
 911
 912 /* This function sets up the hid device. It does not add it
 913    to the HID system. That is done in hidp_add_connection(). */
 914 static int hidp_setup_hid(struct hidp_session *session,
 915                                 struct hidp_connadd_req *req)
 916 {
 917         struct hid_device *hid;
 918         int err;
 919
 920         session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
 921         if (!session->rd_data)
 922                 return -ENOMEM;
 923
 924         if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
 925                 err = -EFAULT;
 926                 goto fault;
 927         }
 928         session->rd_size = req->rd_size;
 929
 930         hid = hid_allocate_device();
 931         if (IS_ERR(hid)) {
 932                 err = PTR_ERR(hid);
 933                 goto fault;
 934         }
 935
 936         session->hid = hid;
 937
 938         hid->driver_data = session;
 939
 940         hid->bus     = BUS_BLUETOOTH;
 941         hid->vendor  = req->vendor;
 942         hid->product = req->product;
 943         hid->version = req->version;
 944         hid->country = req->country;
 945
 946         strncpy(hid->name, req->name, 128);
 947         strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64);
 948         strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64);
 949
 950         hid->dev.parent = hidp_get_device(session);
 951         hid->ll_driver = &hidp_hid_driver;
 952
 953         hid->hid_get_raw_report = hidp_get_raw_report;
 954         hid->hid_output_raw_report = hidp_output_raw_report;
 955
 956         return 0;
 957
 958 fault:
 959         kfree(session->rd_data);
 960         session->rd_data = NULL;
 961
 962         return err;
 963 }
 964
 965 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
 966 {
 967         struct hidp_session *session, *s;
 968         int err;
 969
 970         BT_DBG("");
 971
 972         if (bacmp(&bt_sk(ctrl_sock->sk)->src, &bt_sk(intr_sock->sk)->src) ||
 973                         bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
 974                 return -ENOTUNIQ;
 975
 976         session = kzalloc(sizeof(struct hidp_session), GFP_KERNEL);
 977         if (!session)
 978                 return -ENOMEM;
 979
 980         BT_DBG("rd_data %p rd_size %d", req->rd_data, req->rd_size);
 981
 982         down_write(&hidp_session_sem);
 983
 984         s = __hidp_get_session(&bt_sk(ctrl_sock->sk)->dst);
 985         if (s && s->state == BT_CONNECTED) {
 986                 err = -EEXIST;
 987                 goto failed;
 988         }
 989
 990         bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
 991
 992         session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->omtu, l2cap_pi(ctrl_sock->sk)->imtu);
 993         session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->omtu, l2cap_pi(intr_sock->sk)->imtu);
 994
 995         BT_DBG("ctrl mtu %d intr mtu %d", session->ctrl_mtu, session->intr_mtu);
 996
 997         session->ctrl_sock = ctrl_sock;
 998         session->intr_sock = intr_sock;
 999         session->state     = BT_CONNECTED;
1000
1001         setup_timer(&session->timer, hidp_idle_timeout, (unsigned long)session);
1002
1003         skb_queue_head_init(&session->ctrl_transmit);
1004         skb_queue_head_init(&session->intr_transmit);
1005
1006         mutex_init(&session->report_mutex);
1007         init_waitqueue_head(&session->report_queue);
1008         init_waitqueue_head(&session->startup_queue);
1009         session->waiting_for_startup = 1;
1010         session->flags   = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
1011         session->idle_to = req->idle_to;
1012
1013         if (req->rd_size > 0) {
1014                 err = hidp_setup_hid(session, req);
1015                 if (err && err != -ENODEV)
1016                         goto purge;
1017         }
1018
1019         if (!session->hid) {
1020                 err = hidp_setup_input(session, req);
1021                 if (err < 0)
1022                         goto purge;
1023         }
1024
1025         __hidp_link_session(session);
1026
1027         hidp_set_timer(session);
1028
1029         err = kernel_thread(hidp_session, session, CLONE_KERNEL);
1030         if (err < 0)
1031                 goto unlink;
1032         while (session->waiting_for_startup) {
1033                 wait_event_interruptible(session->startup_queue,
1034                         !session->waiting_for_startup);
1035         }
1036
1037         err = hid_add_device(session->hid);
1038         if (err < 0)
1039                 goto err_add_device;
1040
1041         if (session->input) {
1042                 hidp_send_ctrl_message(session,
1043                         HIDP_TRANS_SET_PROTOCOL | HIDP_PROTO_BOOT, NULL, 0);
1044                 session->flags |= (1 << HIDP_BOOT_PROTOCOL_MODE);
1045
1046                 session->leds = 0xff;
1047                 hidp_input_event(session->input, EV_LED, 0, 0);
1048         }
1049
1050         up_write(&hidp_session_sem);
1051         return 0;
1052
1053 err_add_device:
1054         hid_destroy_device(session->hid);
1055         session->hid = NULL;
1056         atomic_inc(&session->terminate);
1057         hidp_schedule(session);
1058
1059 unlink:
1060         hidp_del_timer(session);
1061
1062         __hidp_unlink_session(session);
1063
1064         if (session->input) {
1065                 input_unregister_device(session->input);
1066                 session->input = NULL;
1067         }
1068
1069         if (session->hid) {
1070                 hid_destroy_device(session->hid);
1071                 session->hid = NULL;
1072         }
1073
1074         kfree(session->rd_data);
1075         session->rd_data = NULL;
1076
1077 purge:
1078         skb_queue_purge(&session->ctrl_transmit);
1079         skb_queue_purge(&session->intr_transmit);
1080
1081 failed:
1082         up_write(&hidp_session_sem);
1083
1084         input_free_device(session->input);
1085         kfree(session);
1086         return err;
1087 }
1088
1089 int hidp_del_connection(struct hidp_conndel_req *req)
1090 {
1091         struct hidp_session *session;
1092         int err = 0;
1093
1094         BT_DBG("");
1095
1096         down_read(&hidp_session_sem);
1097
1098         session = __hidp_get_session(&req->bdaddr);
1099         if (session) {
1100                 if (req->flags & (1 << HIDP_VIRTUAL_CABLE_UNPLUG)) {
1101                         hidp_send_ctrl_message(session,
1102                                 HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG, NULL, 0);
1103                 } else {
1104                         /* Flush the transmit queues */
1105                         skb_queue_purge(&session->ctrl_transmit);
1106                         skb_queue_purge(&session->intr_transmit);
1107
1108                         /* Wakeup user-space polling for socket errors */
1109                         session->intr_sock->sk->sk_err = EUNATCH;
1110                         session->ctrl_sock->sk->sk_err = EUNATCH;
1111
1112                         /* Kill session thread */
1113                         atomic_inc(&session->terminate);
1114                         hidp_schedule(session);
1115                 }
1116         } else
1117                 err = -ENOENT;
1118
1119         up_read(&hidp_session_sem);
1120         return err;
1121 }
1122
1123 int hidp_get_connlist(struct hidp_connlist_req *req)
1124 {
1125         struct list_head *p;
1126         int err = 0, n = 0;
1127
1128         BT_DBG("");
1129
1130         down_read(&hidp_session_sem);
1131
1132         list_for_each(p, &hidp_session_list) {
1133                 struct hidp_session *session;
1134                 struct hidp_conninfo ci;
1135
1136                 session = list_entry(p, struct hidp_session, list);
1137
1138                 __hidp_copy_session(session, &ci);
1139
1140                 if (copy_to_user(req->ci, &ci, sizeof(ci))) {
1141                         err = -EFAULT;
1142                         break;
1143                 }
1144
1145                 if (++n >= req->cnum)
1146                         break;
1147
1148                 req->ci++;
1149         }
1150         req->cnum = n;
1151
1152         up_read(&hidp_session_sem);
1153         return err;
1154 }
1155
1156 int hidp_get_conninfo(struct hidp_conninfo *ci)
1157 {
1158         struct hidp_session *session;
1159         int err = 0;
1160
1161         down_read(&hidp_session_sem);
1162
1163         session = __hidp_get_session(&ci->bdaddr);
1164         if (session)
1165                 __hidp_copy_session(session, ci);
1166         else
1167                 err = -ENOENT;
1168
1169         up_read(&hidp_session_sem);
1170         return err;
1171 }
1172
1173 static const struct hid_device_id hidp_table[] = {
1174         { HID_BLUETOOTH_DEVICE(HID_ANY_ID, HID_ANY_ID) },
1175         { }
1176 };
1177
1178 static struct hid_driver hidp_driver = {
1179         .name = "generic-bluetooth",
1180         .id_table = hidp_table,
1181 };
1182
1183 static int __init hidp_init(void)
1184 {
1185         int ret;
1186
1187         BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
1188
1189         ret = hid_register_driver(&hidp_driver);
1190         if (ret)
1191                 goto err;
1192
1193         ret = hidp_init_sockets();
1194         if (ret)
1195                 goto err_drv;
1196
1197         return 0;
1198 err_drv:
1199         hid_unregister_driver(&hidp_driver);
1200 err:
1201         return ret;
1202 }
1203
1204 static void __exit hidp_exit(void)
1205 {
1206         hidp_cleanup_sockets();
1207         hid_unregister_driver(&hidp_driver);
1208 }
1209
1210 module_init(hidp_init);
1211 module_exit(hidp_exit);
1212
1213 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1214 MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION);
1215 MODULE_VERSION(VERSION);
1216 MODULE_LICENSE("GPL");
1217 MODULE_ALIAS("bt-proto-6");