net/bluetooth/hidp/core.c

   1 /*
   2    HIDP implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 #include <linux/module.h>
  24
  25 #include <linux/types.h>
  26 #include <linux/errno.h>
  27 #include <linux/kernel.h>
  28 #include <linux/sched.h>
  29 #include <linux/slab.h>
  30 #include <linux/poll.h>
  31 #include <linux/freezer.h>
  32 #include <linux/fcntl.h>
  33 #include <linux/skbuff.h>
  34 #include <linux/socket.h>
  35 #include <linux/ioctl.h>
  36 #include <linux/file.h>
  37 #include <linux/init.h>
  38 #include <linux/wait.h>
  39 #include <net/sock.h>
  40
  41 #include <linux/input.h>
  42 #include <linux/hid.h>
  43 #include <linux/hidraw.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47 #include <net/bluetooth/l2cap.h>
  48
  49 #include "hidp.h"
  50
  51 #define VERSION "1.2"
  52
  53 static DECLARE_RWSEM(hidp_session_sem);
  54 static LIST_HEAD(hidp_session_list);
  55
  56 static unsigned char hidp_keycode[256] = {
  57           0,  0,  0,  0, 30, 48, 46, 32, 18, 33, 34, 35, 23, 36, 37, 38,
  58          50, 49, 24, 25, 16, 19, 31, 20, 22, 47, 17, 45, 21, 44,  2,  3,
  59           4,  5,  6,  7,  8,  9, 10, 11, 28,  1, 14, 15, 57, 12, 13, 26,
  60          27, 43, 43, 39, 40, 41, 51, 52, 53, 58, 59, 60, 61, 62, 63, 64,
  61          65, 66, 67, 68, 87, 88, 99, 70,119,110,102,104,111,107,109,106,
  62         105,108,103, 69, 98, 55, 74, 78, 96, 79, 80, 81, 75, 76, 77, 71,
  63          72, 73, 82, 83, 86,127,116,117,183,184,185,186,187,188,189,190,
  64         191,192,193,194,134,138,130,132,128,129,131,137,133,135,136,113,
  65         115,114,  0,  0,  0,121,  0, 89, 93,124, 92, 94, 95,  0,  0,  0,
  66         122,123, 90, 91, 85,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  67           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  68           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  69           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  70           0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,  0,
  71          29, 42, 56,125, 97, 54,100,126,164,166,165,163,161,115,114,113,
  72         150,158,159,128,136,177,178,176,142,152,173,140
  73 };
  74
  75 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
  76
  77 static struct hidp_session *__hidp_get_session(bdaddr_t *bdaddr)
  78 {
  79         struct hidp_session *session;
  80         struct list_head *p;
  81
  82         BT_DBG("");
  83
  84         list_for_each(p, &hidp_session_list) {
  85                 session = list_entry(p, struct hidp_session, list);
  86                 if (!bacmp(bdaddr, &session->bdaddr))
  87                         return session;
  88         }
  89         return NULL;
  90 }
  91
  92 static void __hidp_link_session(struct hidp_session *session)
  93 {
  94         __module_get(THIS_MODULE);
  95         list_add(&session->list, &hidp_session_list);
  96
  97         hci_conn_hold_device(session->conn);
  98 }
  99
 100 static void __hidp_unlink_session(struct hidp_session *session)
 101 {
 102         hci_conn_put_device(session->conn);
 103
 104         list_del(&session->list);
 105         module_put(THIS_MODULE);
 106 }
 107
 108 static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
 109 {
 110         bacpy(&ci->bdaddr, &session->bdaddr);
 111
 112         ci->flags = session->flags;
 113         ci->state = session->state;
 114
 115         ci->vendor  = 0x0000;
 116         ci->product = 0x0000;
 117         ci->version = 0x0000;
 118         memset(ci->name, 0, 128);
 119
 120         if (session->input) {
 121                 ci->vendor  = session->input->id.vendor;
 122                 ci->product = session->input->id.product;
 123                 ci->version = session->input->id.version;
 124                 if (session->input->name)
 125                         strncpy(ci->name, session->input->name, 128);
 126                 else
 127                         strncpy(ci->name, "HID Boot Device", 128);
 128         }
 129
 130         if (session->hid) {
 131                 ci->vendor  = session->hid->vendor;
 132                 ci->product = session->hid->product;
 133                 ci->version = session->hid->version;
 134                 strncpy(ci->name, session->hid->name, 128);
 135         }
 136 }
 137
 138 static int hidp_queue_event(struct hidp_session *session, struct input_dev *dev,
 139                                 unsigned int type, unsigned int code, int value)
 140 {
 141         unsigned char newleds;
 142         struct sk_buff *skb;
 143
 144         BT_DBG("session %p type %d code %d value %d", session, type, code, value);
 145
 146         if (type != EV_LED)
 147                 return -1;
 148
 149         newleds = (!!test_bit(LED_KANA,    dev->led) << 3) |
 150                   (!!test_bit(LED_COMPOSE, dev->led) << 3) |
 151                   (!!test_bit(LED_SCROLLL, dev->led) << 2) |
 152                   (!!test_bit(LED_CAPSL,   dev->led) << 1) |
 153                   (!!test_bit(LED_NUML,    dev->led));
 154
 155         if (session->leds == newleds)
 156                 return 0;
 157
 158         session->leds = newleds;
 159
 160         if (!(skb = alloc_skb(3, GFP_ATOMIC))) {
 161                 BT_ERR("Can't allocate memory for new frame");
 162                 return -ENOMEM;
 163         }
 164
 165         *skb_put(skb, 1) = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 166         *skb_put(skb, 1) = 0x01;
 167         *skb_put(skb, 1) = newleds;
 168
 169         skb_queue_tail(&session->intr_transmit, skb);
 170
 171         hidp_schedule(session);
 172
 173         return 0;
 174 }
 175
 176 static int hidp_hidinput_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 177 {
 178         struct hid_device *hid = input_get_drvdata(dev);
 179         struct hidp_session *session = hid->driver_data;
 180
 181         return hidp_queue_event(session, dev, type, code, value);
 182 }
 183
 184 static int hidp_input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 185 {
 186         struct hidp_session *session = input_get_drvdata(dev);
 187
 188         return hidp_queue_event(session, dev, type, code, value);
 189 }
 190
 191 static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
 192 {
 193         struct input_dev *dev = session->input;
 194         unsigned char *keys = session->keys;
 195         unsigned char *udata = skb->data + 1;
 196         signed char *sdata = skb->data + 1;
 197         int i, size = skb->len - 1;
 198
 199         switch (skb->data[0]) {
 200         case 0x01:      /* Keyboard report */
 201                 for (i = 0; i < 8; i++)
 202                         input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
 203
 204                 /* If all the key codes have been set to 0x01, it means
 205                  * too many keys were pressed at the same time. */
 206                 if (!memcmp(udata + 2, hidp_mkeyspat, 6))
 207                         break;
 208
 209                 for (i = 2; i < 8; i++) {
 210                         if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) {
 211                                 if (hidp_keycode[keys[i]])
 212                                         input_report_key(dev, hidp_keycode[keys[i]], 0);
 213                                 else
 214                                         BT_ERR("Unknown key (scancode %#x) released.", keys[i]);
 215                         }
 216
 217                         if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) {
 218                                 if (hidp_keycode[udata[i]])
 219                                         input_report_key(dev, hidp_keycode[udata[i]], 1);
 220                                 else
 221                                         BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]);
 222                         }
 223                 }
 224
 225                 memcpy(keys, udata, 8);
 226                 break;
 227
 228         case 0x02:      /* Mouse report */
 229                 input_report_key(dev, BTN_LEFT,   sdata[0] & 0x01);
 230                 input_report_key(dev, BTN_RIGHT,  sdata[0] & 0x02);
 231                 input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
 232                 input_report_key(dev, BTN_SIDE,   sdata[0] & 0x08);
 233                 input_report_key(dev, BTN_EXTRA,  sdata[0] & 0x10);
 234
 235                 input_report_rel(dev, REL_X, sdata[1]);
 236                 input_report_rel(dev, REL_Y, sdata[2]);
 237
 238                 if (size > 3)
 239                         input_report_rel(dev, REL_WHEEL, sdata[3]);
 240                 break;
 241         }
 242
 243         input_sync(dev);
 244 }
 245
 246 static int __hidp_send_ctrl_message(struct hidp_session *session,
 247                         unsigned char hdr, unsigned char *data, int size)
 248 {
 249         struct sk_buff *skb;
 250
 251         BT_DBG("session %p data %p size %d", session, data, size);
 252
 253         if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
 254                 BT_ERR("Can't allocate memory for new frame");
 255                 return -ENOMEM;
 256         }
 257
 258         *skb_put(skb, 1) = hdr;
 259         if (data && size > 0)
 260                 memcpy(skb_put(skb, size), data, size);
 261
 262         skb_queue_tail(&session->ctrl_transmit, skb);
 263
 264         return 0;
 265 }
 266
 267 static inline int hidp_send_ctrl_message(struct hidp_session *session,
 268                         unsigned char hdr, unsigned char *data, int size)
 269 {
 270         int err;
 271
 272         err = __hidp_send_ctrl_message(session, hdr, data, size);
 273
 274         hidp_schedule(session);
 275
 276         return err;
 277 }
 278
 279 static int hidp_queue_report(struct hidp_session *session,
 280                                 unsigned char *data, int size)
 281 {
 282         struct sk_buff *skb;
 283
 284         BT_DBG("session %p hid %p data %p size %d", session, session->hid, data, size);
 285
 286         if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
 287                 BT_ERR("Can't allocate memory for new frame");
 288                 return -ENOMEM;
 289         }
 290
 291         *skb_put(skb, 1) = 0xa2;
 292         if (size > 0)
 293                 memcpy(skb_put(skb, size), data, size);
 294
 295         skb_queue_tail(&session->intr_transmit, skb);
 296
 297         hidp_schedule(session);
 298
 299         return 0;
 300 }
 301
 302 static int hidp_send_report(struct hidp_session *session, struct hid_report *report)
 303 {
 304         unsigned char buf[32];
 305         int rsize;
 306
 307         rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
 308         if (rsize > sizeof(buf))
 309                 return -EIO;
 310
 311         hid_output_report(report, buf);
 312
 313         return hidp_queue_report(session, buf, rsize);
 314 }
 315
 316 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
 317 static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count,
 318                 unsigned char report_type)
 319 {
 320         switch (report_type) {
 321         case HID_FEATURE_REPORT:
 322                 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
 323                 break;
 324         case HID_OUTPUT_REPORT:
 325                 report_type = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 326                 break;
 327         default:
 328                 return -EINVAL;
 329         }
 330
 331         if (hidp_send_ctrl_message(hid->driver_data, report_type,
 332                         data, count))
 333                 return -ENOMEM;
 334         return count;
 335 }
 336 #endif
 337
 338 static void hidp_idle_timeout(unsigned long arg)
 339 {
 340         struct hidp_session *session = (struct hidp_session *) arg;
 341
 342         atomic_inc(&session->terminate);
 343         hidp_schedule(session);
 344 }
 345
 346 static void hidp_set_timer(struct hidp_session *session)
 347 {
 348         if (session->idle_to > 0)
 349                 mod_timer(&session->timer, jiffies + HZ * session->idle_to);
 350 }
 351
 352 static inline void hidp_del_timer(struct hidp_session *session)
 353 {
 354         if (session->idle_to > 0)
 355                 del_timer(&session->timer);
 356 }
 357
 358 static void hidp_process_handshake(struct hidp_session *session,
 359                                         unsigned char param)
 360 {
 361         BT_DBG("session %p param 0x%02x", session, param);
 362
 363         switch (param) {
 364         case HIDP_HSHK_SUCCESSFUL:
 365                 /* FIXME: Call into SET_ GET_ handlers here */
 366                 break;
 367
 368         case HIDP_HSHK_NOT_READY:
 369         case HIDP_HSHK_ERR_INVALID_REPORT_ID:
 370         case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
 371         case HIDP_HSHK_ERR_INVALID_PARAMETER:
 372                 /* FIXME: Call into SET_ GET_ handlers here */
 373                 break;
 374
 375         case HIDP_HSHK_ERR_UNKNOWN:
 376                 break;
 377
 378         case HIDP_HSHK_ERR_FATAL:
 379                 /* Device requests a reboot, as this is the only way this error
 380                  * can be recovered. */
 381                 __hidp_send_ctrl_message(session,
 382                         HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0);
 383                 break;
 384
 385         default:
 386                 __hidp_send_ctrl_message(session,
 387                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 388                 break;
 389         }
 390 }
 391
 392 static void hidp_process_hid_control(struct hidp_session *session,
 393                                         unsigned char param)
 394 {
 395         BT_DBG("session %p param 0x%02x", session, param);
 396
 397         if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) {
 398                 /* Flush the transmit queues */
 399                 skb_queue_purge(&session->ctrl_transmit);
 400                 skb_queue_purge(&session->intr_transmit);
 401
 402                 /* Kill session thread */
 403                 atomic_inc(&session->terminate);
 404                 hidp_schedule(session);
 405         }
 406 }
 407
 408 static void hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
 409                                 unsigned char param)
 410 {
 411         BT_DBG("session %p skb %p len %d param 0x%02x", session, skb, skb->len, param);
 412
 413         switch (param) {
 414         case HIDP_DATA_RTYPE_INPUT:
 415                 hidp_set_timer(session);
 416
 417                 if (session->input)
 418                         hidp_input_report(session, skb);
 419
 420                 if (session->hid)
 421                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
 422
 423                 break;
 424
 425         case HIDP_DATA_RTYPE_OTHER:
 426         case HIDP_DATA_RTYPE_OUPUT:
 427         case HIDP_DATA_RTYPE_FEATURE:
 428                 break;
 429
 430         default:
 431                 __hidp_send_ctrl_message(session,
 432                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 433         }
 434 }
 435
 436 static void hidp_recv_ctrl_frame(struct hidp_session *session,
 437                                         struct sk_buff *skb)
 438 {
 439         unsigned char hdr, type, param;
 440
 441         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 442
 443         hdr = skb->data[0];
 444         skb_pull(skb, 1);
 445
 446         type = hdr & HIDP_HEADER_TRANS_MASK;
 447         param = hdr & HIDP_HEADER_PARAM_MASK;
 448
 449         switch (type) {
 450         case HIDP_TRANS_HANDSHAKE:
 451                 hidp_process_handshake(session, param);
 452                 break;
 453
 454         case HIDP_TRANS_HID_CONTROL:
 455                 hidp_process_hid_control(session, param);
 456                 break;
 457
 458         case HIDP_TRANS_DATA:
 459                 hidp_process_data(session, skb, param);
 460                 break;
 461
 462         default:
 463                 __hidp_send_ctrl_message(session,
 464                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);
 465                 break;
 466         }
 467
 468         kfree_skb(skb);
 469 }
 470
 471 static void hidp_recv_intr_frame(struct hidp_session *session,
 472                                 struct sk_buff *skb)
 473 {
 474         unsigned char hdr;
 475
 476         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 477
 478         hdr = skb->data[0];
 479         skb_pull(skb, 1);
 480
 481         if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
 482                 hidp_set_timer(session);
 483
 484                 if (session->input)
 485                         hidp_input_report(session, skb);
 486
 487                 if (session->hid) {
 488                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 1);
 489                         BT_DBG("report len %d", skb->len);
 490                 }
 491         } else {
 492                 BT_DBG("Unsupported protocol header 0x%02x", hdr);
 493         }
 494
 495         kfree_skb(skb);
 496 }
 497
 498 static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
 499 {
 500         struct kvec iv = { data, len };
 501         struct msghdr msg;
 502
 503         BT_DBG("sock %p data %p len %d", sock, data, len);
 504
 505         if (!len)
 506                 return 0;
 507
 508         memset(&msg, 0, sizeof(msg));
 509
 510         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 511 }
 512
 513 static void hidp_process_transmit(struct hidp_session *session)
 514 {
 515         struct sk_buff *skb;
 516
 517         BT_DBG("session %p", session);
 518
 519         while ((skb = skb_dequeue(&session->ctrl_transmit))) {
 520                 if (hidp_send_frame(session->ctrl_sock, skb->data, skb->len) < 0) {
 521                         skb_queue_head(&session->ctrl_transmit, skb);
 522                         break;
 523                 }
 524
 525                 hidp_set_timer(session);
 526                 kfree_skb(skb);
 527         }
 528
 529         while ((skb = skb_dequeue(&session->intr_transmit))) {
 530                 if (hidp_send_frame(session->intr_sock, skb->data, skb->len) < 0) {
 531                         skb_queue_head(&session->intr_transmit, skb);
 532                         break;
 533                 }
 534
 535                 hidp_set_timer(session);
 536                 kfree_skb(skb);
 537         }
 538 }
 539
 540 static int hidp_session(void *arg)
 541 {
 542         struct hidp_session *session = arg;
 543         struct sock *ctrl_sk = session->ctrl_sock->sk;
 544         struct sock *intr_sk = session->intr_sock->sk;
 545         struct sk_buff *skb;
 546         int vendor = 0x0000, product = 0x0000;
 547         wait_queue_t ctrl_wait, intr_wait;
 548
 549         BT_DBG("session %p", session);
 550
 551         if (session->input) {
 552                 vendor  = session->input->id.vendor;
 553                 product = session->input->id.product;
 554         }
 555
 556         if (session->hid) {
 557                 vendor  = session->hid->vendor;
 558                 product = session->hid->product;
 559         }
 560
 561         daemonize("khidpd_%04x%04x", vendor, product);
 562         set_user_nice(current, -15);
 563
 564         init_waitqueue_entry(&ctrl_wait, current);
 565         init_waitqueue_entry(&intr_wait, current);
 566         add_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
 567         add_wait_queue(intr_sk->sk_sleep, &intr_wait);
 568         while (!atomic_read(&session->terminate)) {
 569                 set_current_state(TASK_INTERRUPTIBLE);
 570
 571                 if (ctrl_sk->sk_state != BT_CONNECTED || intr_sk->sk_state != BT_CONNECTED)
 572                         break;
 573
 574                 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
 575                         skb_orphan(skb);
 576                         hidp_recv_ctrl_frame(session, skb);
 577                 }
 578
 579                 while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
 580                         skb_orphan(skb);
 581                         hidp_recv_intr_frame(session, skb);
 582                 }
 583
 584                 hidp_process_transmit(session);
 585
 586                 schedule();
 587         }
 588         set_current_state(TASK_RUNNING);
 589         remove_wait_queue(intr_sk->sk_sleep, &intr_wait);
 590         remove_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
 591
 592         down_write(&hidp_session_sem);
 593
 594         hidp_del_timer(session);
 595
 596         if (session->input) {
 597                 input_unregister_device(session->input);
 598                 session->input = NULL;
 599         }
 600
 601   if (session->hid) {
 602 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
 603     hid_destroy_device(session->hid);
 604     session->hid = NULL;
 605 #else
 606     if (session->hid->claimed & HID_CLAIMED_INPUT)
 607       hidinput_disconnect(session->hid);
 608     hid_free_device(session->hid);
 609 #endif
 610   }
 611
 612         /* Wakeup user-space polling for socket errors */
 613         session->intr_sock->sk->sk_err = EUNATCH;
 614         session->ctrl_sock->sk->sk_err = EUNATCH;
 615
 616         hidp_schedule(session);
 617
 618         fput(session->intr_sock->file);
 619
 620         wait_event_timeout(*(ctrl_sk->sk_sleep),
 621                 (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
 622
 623         fput(session->ctrl_sock->file);
 624
 625         __hidp_unlink_session(session);
 626
 627         up_write(&hidp_session_sem);
 628
 629         kfree(session);
 630         return 0;
 631 }
 632
 633 static struct device *hidp_get_device(struct hidp_session *session)
 634 {
 635         bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
 636         bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
 637         struct device *device = NULL;
 638         struct hci_dev *hdev;
 639
 640         hdev = hci_get_route(dst, src);
 641         if (!hdev)
 642                 return NULL;
 643
 644         session->conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 645         if (session->conn)
 646                 device = &session->conn->dev;
 647
 648         hci_dev_put(hdev);
 649
 650         return device;
 651 }
 652
 653 static int hidp_setup_input(struct hidp_session *session,
 654                                 struct hidp_connadd_req *req)
 655 {
 656         struct input_dev *input;
 657         int err, i;
 658
 659         input = input_allocate_device();
 660         if (!input)
 661                 return -ENOMEM;
 662
 663         session->input = input;
 664
 665         input_set_drvdata(input, session);
 666
 667         input->name = "Bluetooth HID Boot Protocol Device";
 668
 669         input->id.bustype = BUS_BLUETOOTH;
 670         input->id.vendor  = req->vendor;
 671         input->id.product = req->product;
 672         input->id.version = req->version;
 673
 674         if (req->subclass & 0x40) {
 675                 set_bit(EV_KEY, input->evbit);
 676                 set_bit(EV_LED, input->evbit);
 677                 set_bit(EV_REP, input->evbit);
 678
 679                 set_bit(LED_NUML,    input->ledbit);
 680                 set_bit(LED_CAPSL,   input->ledbit);
 681                 set_bit(LED_SCROLLL, input->ledbit);
 682                 set_bit(LED_COMPOSE, input->ledbit);
 683                 set_bit(LED_KANA,    input->ledbit);
 684
 685                 for (i = 0; i < sizeof(hidp_keycode); i++)
 686                         set_bit(hidp_keycode[i], input->keybit);
 687                 clear_bit(0, input->keybit);
 688         }
 689
 690         if (req->subclass & 0x80) {
 691                 input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
 692                 input->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
 693                         BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
 694                 input->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
 695                 input->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_SIDE) |
 696                         BIT_MASK(BTN_EXTRA);
 697                 input->relbit[0] |= BIT_MASK(REL_WHEEL);
 698         }
 699
 700         input->dev.parent = hidp_get_device(session);
 701
 702         input->event = hidp_input_event;
 703
 704         err = input_register_device(input);
 705         if (err < 0) {
 706                 hci_conn_put_device(session->conn);
 707                 return err;
 708         }
 709
 710         return 0;
 711 }
 712
 713 static int hidp_open(struct hid_device *hid)
 714 {
 715         return 0;
 716 }
 717
 718 static void hidp_close(struct hid_device *hid)
 719 {
 720 }
 721
 722 #if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,27))
 723 static const struct {
 724         __u16 idVendor;
 725         __u16 idProduct;
 726         unsigned quirks;
 727 } hidp_blacklist[] = {
 728         /* Apple wireless Mighty Mouse */
 729         { 0x05ac, 0x030c, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
 730
 731         { }     /* Terminating entry */
 732 };
 733 static void hidp_setup_quirks(struct hid_device *hid)
 734 {
 735         unsigned int n;
 736
 737         for (n = 0; hidp_blacklist[n].idVendor; n++)
 738                 if (hidp_blacklist[n].idVendor == le16_to_cpu(hid->vendor) &&
 739                                 hidp_blacklist[n].idProduct == le16_to_cpu(hid->product))
 740                         hid->quirks = hidp_blacklist[n].quirks;
 741 }
 742
 743 static void hidp_setup_hid(struct hidp_session *session,
 744                                 struct hidp_connadd_req *req)
 745 {
 746         struct hid_device *hid = session->hid;
 747         struct hid_report *report;
 748         bdaddr_t src, dst;
 749
 750         session->hid = hid;
 751
 752         hid->driver_data = session;
 753
 754         baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
 755         baswap(&dst, &bt_sk(session->ctrl_sock->sk)->dst);
 756
 757         hid->bus     = BUS_BLUETOOTH;
 758         hid->vendor  = req->vendor;
 759         hid->product = req->product;
 760         hid->version = req->version;
 761         hid->country = req->country;
 762
 763         strncpy(hid->name, req->name, 128);
 764         strncpy(hid->phys, batostr(&src), 64);
 765         strncpy(hid->uniq, batostr(&dst), 64);
 766
 767         hid->dev = hidp_get_device(session);
 768         hid->hid_open  = hidp_open;
 769         hid->hid_close = hidp_close;
 770
 771         hid->hidinput_input_event = hidp_hidinput_event;
 772
 773         hidp_setup_quirks(hid);
 774
 775         list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].report_list, list)
 776                 hidp_send_report(session, report);
 777
 778         list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].report_list, list)
 779                 hidp_send_report(session, report);
 780
 781         if (hidinput_connect(hid) == 0)
 782                 hid->claimed |= HID_CLAIMED_INPUT;
 783 }
 784 #else
 785
 786 static int hidp_parse(struct hid_device *hid)
 787 {
 788         struct hidp_session *session = hid->driver_data;
 789
 790         return hid_parse_report(session->hid, session->rd_data,
 791                         session->rd_size);
 792 }
 793
 794 static int hidp_start(struct hid_device *hid)
 795 {
 796         struct hidp_session *session = hid->driver_data;
 797         struct hid_report *report;
 798
 799         list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].
 800                         report_list, list)
 801                 hidp_send_report(session, report);
 802
 803         list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].
 804                         report_list, list)
 805                 hidp_send_report(session, report);
 806
 807         return 0;
 808 }
 809
 810 static void hidp_stop(struct hid_device *hid)
 811 {
 812         struct hidp_session *session = hid->driver_data;
 813
 814         skb_queue_purge(&session->ctrl_transmit);
 815         skb_queue_purge(&session->intr_transmit);
 816
 817         hid->claimed = 0;
 818 }
 819
 820 static struct hid_ll_driver hidp_hid_driver = {
 821         .parse = hidp_parse,
 822         .start = hidp_start,
 823         .stop = hidp_stop,
 824         .open  = hidp_open,
 825         .close = hidp_close,
 826         .hidinput_input_event = hidp_hidinput_event,
 827 };
 828
 829 static int hidp_setup_hid(struct hidp_session *session,
 830                                 struct hidp_connadd_req *req)
 831 {
 832         struct hid_device *hid;
 833         bdaddr_t src, dst;
 834         int err;
 835
 836         session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
 837         if (!session->rd_data)
 838                 return -ENOMEM;
 839
 840         if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
 841                 err = -EFAULT;
 842                 goto fault;
 843         }
 844         session->rd_size = req->rd_size;
 845
 846         hid = hid_allocate_device();
 847         if (IS_ERR(hid)) {
 848                 err = PTR_ERR(hid);
 849                 goto fault;
 850         }
 851
 852         session->hid = hid;
 853
 854         hid->driver_data = session;
 855
 856         baswap(&src, &bt_sk(session->ctrl_sock->sk)->src);
 857         baswap(&dst, &bt_sk(session->ctrl_sock->sk)->dst);
 858
 859         hid->bus     = BUS_BLUETOOTH;
 860         hid->vendor  = req->vendor;
 861         hid->product = req->product;
 862         hid->version = req->version;
 863         hid->country = req->country;
 864
 865         strncpy(hid->name, req->name, 128);
 866         strncpy(hid->phys, batostr(&src), 64);
 867         strncpy(hid->uniq, batostr(&dst), 64);
 868
 869         hid->dev.parent = hidp_get_device(session);
 870         hid->ll_driver = &hidp_hid_driver;
 871
 872         hid->hid_output_raw_report = hidp_output_raw_report;
 873
 874         err = hid_add_device(hid);
 875         if (err < 0)
 876                 goto failed;
 877
 878         return 0;
 879
 880 failed:
 881         hid_destroy_device(hid);
 882         session->hid = NULL;
 883
 884 fault:
 885         kfree(session->rd_data);
 886         session->rd_data = NULL;
 887
 888         return err;
 889 }
 890 #endif
 891
 892 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
 893 {
 894         struct hidp_session *session, *s;
 895         int err;
 896
 897         BT_DBG("");
 898
 899         if (bacmp(&bt_sk(ctrl_sock->sk)->src, &bt_sk(intr_sock->sk)->src) ||
 900                         bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
 901                 return -ENOTUNIQ;
 902
 903         session = kzalloc(sizeof(struct hidp_session), GFP_KERNEL);
 904         if (!session)
 905                 return -ENOMEM;
 906
 907         BT_DBG("rd_data %p rd_size %d", req->rd_data, req->rd_size);
 908
 909 #if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,27))
 910         if (req->rd_size > 0) {
 911                 unsigned char *buf = kmalloc(req->rd_size, GFP_KERNEL);
 912
 913                 if (!buf) {
 914                         kfree(session);
 915                         return -ENOMEM;
 916                 }
 917
 918                 if (copy_from_user(buf, req->rd_data, req->rd_size)) {
 919                         kfree(buf);
 920                         kfree(session);
 921                         return -EFAULT;
 922                 }
 923
 924                 session->hid = hid_parse_report(buf, req->rd_size);
 925
 926                 kfree(buf);
 927
 928                 if (!session->hid) {
 929                         kfree(session);
 930                         return -EINVAL;
 931                 }
 932         }
 933
 934         if (!session->hid) {
 935                 session->input = input_allocate_device();
 936                 if (!session->input) {
 937                         kfree(session);
 938                         return -ENOMEM;
 939                 }
 940         }
 941 #endif
 942         down_write(&hidp_session_sem);
 943
 944         s = __hidp_get_session(&bt_sk(ctrl_sock->sk)->dst);
 945         if (s && s->state == BT_CONNECTED) {
 946                 err = -EEXIST;
 947                 goto failed;
 948         }
 949
 950         bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
 951
 952         session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->omtu, l2cap_pi(ctrl_sock->sk)->imtu);
 953         session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->omtu, l2cap_pi(intr_sock->sk)->imtu);
 954
 955         BT_DBG("ctrl mtu %d intr mtu %d", session->ctrl_mtu, session->intr_mtu);
 956
 957         session->ctrl_sock = ctrl_sock;
 958         session->intr_sock = intr_sock;
 959         session->state     = BT_CONNECTED;
 960
 961         setup_timer(&session->timer, hidp_idle_timeout, (unsigned long)session);
 962
 963         skb_queue_head_init(&session->ctrl_transmit);
 964         skb_queue_head_init(&session->intr_transmit);
 965
 966         session->flags   = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
 967         session->idle_to = req->idle_to;
 968
 969 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
 970         if (req->rd_size > 0) {
 971                 err = hidp_setup_hid(session, req);
 972                 if (err && err != -ENODEV)
 973                         goto purge;
 974         }
 975
 976         if (!session->hid) {
 977                 err = hidp_setup_input(session, req);
 978                 if (err < 0)
 979                         goto purge;
 980         }
 981 #else
 982         if (session->input) {
 983                 err = hidp_setup_input(session, req);
 984                 if (err < 0)
 985                         goto failed;
 986         }
 987
 988         if (session->hid)
 989                 hidp_setup_hid(session, req);
 990 #endif
 991
 992         __hidp_link_session(session);
 993
 994         hidp_set_timer(session);
 995
 996         err = kernel_thread(hidp_session, session, CLONE_KERNEL);
 997         if (err < 0)
 998                 goto unlink;
 999
1000         if (session->input) {
1001                 hidp_send_ctrl_message(session,
1002                         HIDP_TRANS_SET_PROTOCOL | HIDP_PROTO_BOOT, NULL, 0);
1003                 session->flags |= (1 << HIDP_BOOT_PROTOCOL_MODE);
1004
1005                 session->leds = 0xff;
1006                 hidp_input_event(session->input, EV_LED, 0, 0);
1007         }
1008
1009         up_write(&hidp_session_sem);
1010         return 0;
1011
1012 unlink:
1013         hidp_del_timer(session);
1014
1015         __hidp_unlink_session(session);
1016
1017         if (session->input) {
1018                 input_unregister_device(session->input);
1019                 session->input = NULL;
1020         }
1021
1022 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
1023         if (session->hid) {
1024                 hid_destroy_device(session->hid);
1025                 session->hid = NULL;
1026         }
1027
1028         kfree(session->rd_data);
1029         session->rd_data = NULL;
1030
1031 purge:
1032         skb_queue_purge(&session->ctrl_transmit);
1033         skb_queue_purge(&session->intr_transmit);
1034 #endif
1035
1036 failed:
1037         up_write(&hidp_session_sem);
1038
1039 #if (LINUX_VERSION_CODE <= KERNEL_VERSION(2,6,27))
1040         if (session->hid)
1041                 hid_free_device(session->hid);
1042 #endif
1043         input_free_device(session->input);
1044         kfree(session);
1045         return err;
1046 }
1047
1048 int hidp_del_connection(struct hidp_conndel_req *req)
1049 {
1050         struct hidp_session *session;
1051         int err = 0;
1052
1053         BT_DBG("");
1054
1055         down_read(&hidp_session_sem);
1056
1057         session = __hidp_get_session(&req->bdaddr);
1058         if (session) {
1059                 if (req->flags & (1 << HIDP_VIRTUAL_CABLE_UNPLUG)) {
1060                         hidp_send_ctrl_message(session,
1061                                 HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG, NULL, 0);
1062                 } else {
1063                         /* Flush the transmit queues */
1064                         skb_queue_purge(&session->ctrl_transmit);
1065                         skb_queue_purge(&session->intr_transmit);
1066
1067                         /* Wakeup user-space polling for socket errors */
1068                         session->intr_sock->sk->sk_err = EUNATCH;
1069                         session->ctrl_sock->sk->sk_err = EUNATCH;
1070
1071                         /* Kill session thread */
1072                         atomic_inc(&session->terminate);
1073                         hidp_schedule(session);
1074                 }
1075         } else
1076                 err = -ENOENT;
1077
1078         up_read(&hidp_session_sem);
1079         return err;
1080 }
1081
1082 int hidp_get_connlist(struct hidp_connlist_req *req)
1083 {
1084         struct list_head *p;
1085         int err = 0, n = 0;
1086
1087         BT_DBG("");
1088
1089         down_read(&hidp_session_sem);
1090
1091         list_for_each(p, &hidp_session_list) {
1092                 struct hidp_session *session;
1093                 struct hidp_conninfo ci;
1094
1095                 session = list_entry(p, struct hidp_session, list);
1096
1097                 __hidp_copy_session(session, &ci);
1098
1099                 if (copy_to_user(req->ci, &ci, sizeof(ci))) {
1100                         err = -EFAULT;
1101                         break;
1102                 }
1103
1104                 if (++n >= req->cnum)
1105                         break;
1106
1107                 req->ci++;
1108         }
1109         req->cnum = n;
1110
1111         up_read(&hidp_session_sem);
1112         return err;
1113 }
1114
1115 int hidp_get_conninfo(struct hidp_conninfo *ci)
1116 {
1117         struct hidp_session *session;
1118         int err = 0;
1119
1120         down_read(&hidp_session_sem);
1121
1122         session = __hidp_get_session(&ci->bdaddr);
1123         if (session)
1124                 __hidp_copy_session(session, ci);
1125         else
1126                 err = -ENOENT;
1127
1128         up_read(&hidp_session_sem);
1129         return err;
1130 }
1131
1132 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
1133 static const struct hid_device_id hidp_table[] = {
1134         { HID_BLUETOOTH_DEVICE(HID_ANY_ID, HID_ANY_ID) },
1135         { }
1136 };
1137
1138 static struct hid_driver hidp_driver = {
1139         .name = "generic-bluetooth",
1140         .id_table = hidp_table,
1141 };
1142 #endif
1143
1144 static int __init hidp_init(void)
1145 {
1146         int ret;
1147
1148         l2cap_load();
1149
1150         BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
1151
1152 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
1153         ret = hid_register_driver(&hidp_driver);
1154         if (ret)
1155                 goto err;
1156 #endif
1157
1158         ret = hidp_init_sockets();
1159 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
1160         if (ret)
1161                 goto err_drv;
1162
1163         return 0;
1164 err_drv:
1165         hid_unregister_driver(&hidp_driver);
1166 err:
1167 #endif
1168         return ret;
1169 }
1170
1171 static void __exit hidp_exit(void)
1172 {
1173         hidp_cleanup_sockets();
1174 #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,27))
1175         hid_unregister_driver(&hidp_driver);
1176 #endif
1177 }
1178
1179 module_init(hidp_init);
1180 module_exit(hidp_exit);
1181
1182 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1183 MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION);
1184 MODULE_VERSION(VERSION);
1185 MODULE_LICENSE("GPL");
1186 MODULE_ALIAS("bt-proto-6");