net/bluetooth/hidp/core.c

   1 /*
   2    HIDP implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2003-2004 Marcel Holtmann <marcel@holtmann.org>
   4
   5    This program is free software; you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License version 2 as
   7    published by the Free Software Foundation;
   8
   9    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  10    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  11    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  12    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  13    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  14    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17
  18    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  19    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  20    SOFTWARE IS DISCLAIMED.
  21 */
  22
  23 #include <linux/module.h>
  24 #include <linux/file.h>
  25 #include <linux/kthread.h>
  26 #include <linux/hidraw.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30 #include <net/bluetooth/l2cap.h>
  31
  32 #include "hidp.h"
  33
  34 #define VERSION "1.2"
  35
  36 static DECLARE_RWSEM(hidp_session_sem);
  37 static LIST_HEAD(hidp_session_list);
  38
  39 static unsigned char hidp_keycode[256] = {
  40           0,   0,   0,   0,  30,  48,  46,  32,  18,  33,  34,  35,  23,  36,
  41          37,  38,  50,  49,  24,  25,  16,  19,  31,  20,  22,  47,  17,  45,
  42          21,  44,   2,   3,   4,   5,   6,   7,   8,   9,  10,  11,  28,   1,
  43          14,  15,  57,  12,  13,  26,  27,  43,  43,  39,  40,  41,  51,  52,
  44          53,  58,  59,  60,  61,  62,  63,  64,  65,  66,  67,  68,  87,  88,
  45          99,  70, 119, 110, 102, 104, 111, 107, 109, 106, 105, 108, 103,  69,
  46          98,  55,  74,  78,  96,  79,  80,  81,  75,  76,  77,  71,  72,  73,
  47          82,  83,  86, 127, 116, 117, 183, 184, 185, 186, 187, 188, 189, 190,
  48         191, 192, 193, 194, 134, 138, 130, 132, 128, 129, 131, 137, 133, 135,
  49         136, 113, 115, 114,   0,   0,   0, 121,   0,  89,  93, 124,  92,  94,
  50          95,   0,   0,   0, 122, 123,  90,  91,  85,   0,   0,   0,   0,   0,
  51           0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
  52           0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
  53           0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
  54           0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
  55           0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
  56          29,  42,  56, 125,  97,  54, 100, 126, 164, 166, 165, 163, 161, 115,
  57         114, 113, 150, 158, 159, 128, 136, 177, 178, 176, 142, 152, 173, 140
  58 };
  59
  60 static unsigned char hidp_mkeyspat[] = { 0x01, 0x01, 0x01, 0x01, 0x01, 0x01 };
  61
  62 static struct hidp_session *__hidp_get_session(bdaddr_t *bdaddr)
  63 {
  64         struct hidp_session *session;
  65
  66         BT_DBG("");
  67
  68         list_for_each_entry(session, &hidp_session_list, list) {
  69                 if (!bacmp(bdaddr, &session->bdaddr))
  70                         return session;
  71         }
  72
  73         return NULL;
  74 }
  75
  76 static void __hidp_link_session(struct hidp_session *session)
  77 {
  78         list_add(&session->list, &hidp_session_list);
  79 }
  80
  81 static void __hidp_unlink_session(struct hidp_session *session)
  82 {
  83         hci_conn_put_device(session->conn);
  84
  85         list_del(&session->list);
  86 }
  87
  88 static void __hidp_copy_session(struct hidp_session *session, struct hidp_conninfo *ci)
  89 {
  90         memset(ci, 0, sizeof(*ci));
  91         bacpy(&ci->bdaddr, &session->bdaddr);
  92
  93         ci->flags = session->flags;
  94         ci->state = session->state;
  95
  96         ci->vendor  = 0x0000;
  97         ci->product = 0x0000;
  98         ci->version = 0x0000;
  99
 100         if (session->input) {
 101                 ci->vendor  = session->input->id.vendor;
 102                 ci->product = session->input->id.product;
 103                 ci->version = session->input->id.version;
 104                 if (session->input->name)
 105                         strncpy(ci->name, session->input->name, 128);
 106                 else
 107                         strncpy(ci->name, "HID Boot Device", 128);
 108         }
 109
 110         if (session->hid) {
 111                 ci->vendor  = session->hid->vendor;
 112                 ci->product = session->hid->product;
 113                 ci->version = session->hid->version;
 114                 strncpy(ci->name, session->hid->name, 128);
 115         }
 116 }
 117
 118 static int hidp_queue_event(struct hidp_session *session, struct input_dev *dev,
 119                                 unsigned int type, unsigned int code, int value)
 120 {
 121         unsigned char newleds;
 122         struct sk_buff *skb;
 123
 124         BT_DBG("session %p type %d code %d value %d", session, type, code, value);
 125
 126         if (type != EV_LED)
 127                 return -1;
 128
 129         newleds = (!!test_bit(LED_KANA,    dev->led) << 3) |
 130                   (!!test_bit(LED_COMPOSE, dev->led) << 3) |
 131                   (!!test_bit(LED_SCROLLL, dev->led) << 2) |
 132                   (!!test_bit(LED_CAPSL,   dev->led) << 1) |
 133                   (!!test_bit(LED_NUML,    dev->led));
 134
 135         if (session->leds == newleds)
 136                 return 0;
 137
 138         session->leds = newleds;
 139
 140         skb = alloc_skb(3, GFP_ATOMIC);
 141         if (!skb) {
 142                 BT_ERR("Can't allocate memory for new frame");
 143                 return -ENOMEM;
 144         }
 145
 146         *skb_put(skb, 1) = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
 147         *skb_put(skb, 1) = 0x01;
 148         *skb_put(skb, 1) = newleds;
 149
 150         skb_queue_tail(&session->intr_transmit, skb);
 151
 152         hidp_schedule(session);
 153
 154         return 0;
 155 }
 156
 157 static int hidp_hidinput_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 158 {
 159         struct hid_device *hid = input_get_drvdata(dev);
 160         struct hidp_session *session = hid->driver_data;
 161
 162         return hidp_queue_event(session, dev, type, code, value);
 163 }
 164
 165 static int hidp_input_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
 166 {
 167         struct hidp_session *session = input_get_drvdata(dev);
 168
 169         return hidp_queue_event(session, dev, type, code, value);
 170 }
 171
 172 static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
 173 {
 174         struct input_dev *dev = session->input;
 175         unsigned char *keys = session->keys;
 176         unsigned char *udata = skb->data + 1;
 177         signed char *sdata = skb->data + 1;
 178         int i, size = skb->len - 1;
 179
 180         switch (skb->data[0]) {
 181         case 0x01:      /* Keyboard report */
 182                 for (i = 0; i < 8; i++)
 183                         input_report_key(dev, hidp_keycode[i + 224], (udata[0] >> i) & 1);
 184
 185                 /* If all the key codes have been set to 0x01, it means
 186                  * too many keys were pressed at the same time. */
 187                 if (!memcmp(udata + 2, hidp_mkeyspat, 6))
 188                         break;
 189
 190                 for (i = 2; i < 8; i++) {
 191                         if (keys[i] > 3 && memscan(udata + 2, keys[i], 6) == udata + 8) {
 192                                 if (hidp_keycode[keys[i]])
 193                                         input_report_key(dev, hidp_keycode[keys[i]], 0);
 194                                 else
 195                                         BT_ERR("Unknown key (scancode %#x) released.", keys[i]);
 196                         }
 197
 198                         if (udata[i] > 3 && memscan(keys + 2, udata[i], 6) == keys + 8) {
 199                                 if (hidp_keycode[udata[i]])
 200                                         input_report_key(dev, hidp_keycode[udata[i]], 1);
 201                                 else
 202                                         BT_ERR("Unknown key (scancode %#x) pressed.", udata[i]);
 203                         }
 204                 }
 205
 206                 memcpy(keys, udata, 8);
 207                 break;
 208
 209         case 0x02:      /* Mouse report */
 210                 input_report_key(dev, BTN_LEFT,   sdata[0] & 0x01);
 211                 input_report_key(dev, BTN_RIGHT,  sdata[0] & 0x02);
 212                 input_report_key(dev, BTN_MIDDLE, sdata[0] & 0x04);
 213                 input_report_key(dev, BTN_SIDE,   sdata[0] & 0x08);
 214                 input_report_key(dev, BTN_EXTRA,  sdata[0] & 0x10);
 215
 216                 input_report_rel(dev, REL_X, sdata[1]);
 217                 input_report_rel(dev, REL_Y, sdata[2]);
 218
 219                 if (size > 3)
 220                         input_report_rel(dev, REL_WHEEL, sdata[3]);
 221                 break;
 222         }
 223
 224         input_sync(dev);
 225 }
 226
 227 static int __hidp_send_ctrl_message(struct hidp_session *session,
 228                         unsigned char hdr, unsigned char *data, int size)
 229 {
 230         struct sk_buff *skb;
 231
 232         BT_DBG("session %p data %p size %d", session, data, size);
 233
 234         if (atomic_read(&session->terminate))
 235                 return -EIO;
 236
 237         skb = alloc_skb(size + 1, GFP_ATOMIC);
 238         if (!skb) {
 239                 BT_ERR("Can't allocate memory for new frame");
 240                 return -ENOMEM;
 241         }
 242
 243         *skb_put(skb, 1) = hdr;
 244         if (data && size > 0)
 245                 memcpy(skb_put(skb, size), data, size);
 246
 247         skb_queue_tail(&session->ctrl_transmit, skb);
 248
 249         return 0;
 250 }
 251
 252 static int hidp_send_ctrl_message(struct hidp_session *session,
 253                         unsigned char hdr, unsigned char *data, int size)
 254 {
 255         int err;
 256
 257         err = __hidp_send_ctrl_message(session, hdr, data, size);
 258
 259         hidp_schedule(session);
 260
 261         return err;
 262 }
 263
 264 static int hidp_queue_report(struct hidp_session *session,
 265                                 unsigned char *data, int size)
 266 {
 267         struct sk_buff *skb;
 268
 269         BT_DBG("session %p hid %p data %p size %d", session, session->hid, data, size);
 270
 271         skb = alloc_skb(size + 1, GFP_ATOMIC);
 272         if (!skb) {
 273                 BT_ERR("Can't allocate memory for new frame");
 274                 return -ENOMEM;
 275         }
 276
 277         *skb_put(skb, 1) = 0xa2;
 278         if (size > 0)
 279                 memcpy(skb_put(skb, size), data, size);
 280
 281         skb_queue_tail(&session->intr_transmit, skb);
 282
 283         hidp_schedule(session);
 284
 285         return 0;
 286 }
 287
 288 static int hidp_send_report(struct hidp_session *session, struct hid_report *report)
 289 {
 290         unsigned char buf[32];
 291         int rsize;
 292
 293         rsize = ((report->size - 1) >> 3) + 1 + (report->id > 0);
 294         if (rsize > sizeof(buf))
 295                 return -EIO;
 296
 297         hid_output_report(report, buf);
 298
 299         return hidp_queue_report(session, buf, rsize);
 300 }
 301
 302 static int hidp_get_raw_report(struct hid_device *hid,
 303                 unsigned char report_number,
 304                 unsigned char *data, size_t count,
 305                 unsigned char report_type)
 306 {
 307         struct hidp_session *session = hid->driver_data;
 308         struct sk_buff *skb;
 309         size_t len;
 310         int numbered_reports = hid->report_enum[report_type].numbered;
 311         int ret;
 312
 313         switch (report_type) {
 314         case HID_FEATURE_REPORT:
 315                 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_FEATURE;
 316                 break;
 317         case HID_INPUT_REPORT:
 318                 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_INPUT;
 319                 break;
 320         case HID_OUTPUT_REPORT:
 321                 report_type = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_OUPUT;
 322                 break;
 323         default:
 324                 return -EINVAL;
 325         }
 326
 327         if (mutex_lock_interruptible(&session->report_mutex))
 328                 return -ERESTARTSYS;
 329
 330         /* Set up our wait, and send the report request to the device. */
 331         session->waiting_report_type = report_type & HIDP_DATA_RTYPE_MASK;
 332         session->waiting_report_number = numbered_reports ? report_number : -1;
 333         set_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 334         data[0] = report_number;
 335         ret = hidp_send_ctrl_message(hid->driver_data, report_type, data, 1);
 336         if (ret)
 337                 goto err;
 338
 339         /* Wait for the return of the report. The returned report
 340            gets put in session->report_return.  */
 341         while (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags)) {
 342                 int res;
 343
 344                 res = wait_event_interruptible_timeout(session->report_queue,
 345                         !test_bit(HIDP_WAITING_FOR_RETURN, &session->flags),
 346                         5*HZ);
 347                 if (res == 0) {
 348                         /* timeout */
 349                         ret = -EIO;
 350                         goto err;
 351                 }
 352                 if (res < 0) {
 353                         /* signal */
 354                         ret = -ERESTARTSYS;
 355                         goto err;
 356                 }
 357         }
 358
 359         skb = session->report_return;
 360         if (skb) {
 361                 len = skb->len < count ? skb->len : count;
 362                 memcpy(data, skb->data, len);
 363
 364                 kfree_skb(skb);
 365                 session->report_return = NULL;
 366         } else {
 367                 /* Device returned a HANDSHAKE, indicating  protocol error. */
 368                 len = -EIO;
 369         }
 370
 371         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 372         mutex_unlock(&session->report_mutex);
 373
 374         return len;
 375
 376 err:
 377         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 378         mutex_unlock(&session->report_mutex);
 379         return ret;
 380 }
 381
 382 static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count,
 383                 unsigned char report_type)
 384 {
 385         struct hidp_session *session = hid->driver_data;
 386         int ret;
 387
 388         switch (report_type) {
 389         case HID_FEATURE_REPORT:
 390                 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
 391                 break;
 392         case HID_OUTPUT_REPORT:
 393                 report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_OUPUT;
 394                 break;
 395         default:
 396                 return -EINVAL;
 397         }
 398
 399         if (mutex_lock_interruptible(&session->report_mutex))
 400                 return -ERESTARTSYS;
 401
 402         /* Set up our wait, and send the report request to the device. */
 403         set_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
 404         ret = hidp_send_ctrl_message(hid->driver_data, report_type, data,
 405                                                                         count);
 406         if (ret)
 407                 goto err;
 408
 409         /* Wait for the ACK from the device. */
 410         while (test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags)) {
 411                 int res;
 412
 413                 res = wait_event_interruptible_timeout(session->report_queue,
 414                         !test_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags),
 415                         10*HZ);
 416                 if (res == 0) {
 417                         /* timeout */
 418                         ret = -EIO;
 419                         goto err;
 420                 }
 421                 if (res < 0) {
 422                         /* signal */
 423                         ret = -ERESTARTSYS;
 424                         goto err;
 425                 }
 426         }
 427
 428         if (!session->output_report_success) {
 429                 ret = -EIO;
 430                 goto err;
 431         }
 432
 433         ret = count;
 434
 435 err:
 436         clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
 437         mutex_unlock(&session->report_mutex);
 438         return ret;
 439 }
 440
 441 static void hidp_idle_timeout(unsigned long arg)
 442 {
 443         struct hidp_session *session = (struct hidp_session *) arg;
 444
 445         atomic_inc(&session->terminate);
 446         wake_up_process(session->task);
 447 }
 448
 449 static void hidp_set_timer(struct hidp_session *session)
 450 {
 451         if (session->idle_to > 0)
 452                 mod_timer(&session->timer, jiffies + HZ * session->idle_to);
 453 }
 454
 455 static void hidp_del_timer(struct hidp_session *session)
 456 {
 457         if (session->idle_to > 0)
 458                 del_timer(&session->timer);
 459 }
 460
 461 static void hidp_process_handshake(struct hidp_session *session,
 462                                         unsigned char param)
 463 {
 464         BT_DBG("session %p param 0x%02x", session, param);
 465         session->output_report_success = 0; /* default condition */
 466
 467         switch (param) {
 468         case HIDP_HSHK_SUCCESSFUL:
 469                 /* FIXME: Call into SET_ GET_ handlers here */
 470                 session->output_report_success = 1;
 471                 break;
 472
 473         case HIDP_HSHK_NOT_READY:
 474         case HIDP_HSHK_ERR_INVALID_REPORT_ID:
 475         case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:
 476         case HIDP_HSHK_ERR_INVALID_PARAMETER:
 477                 if (test_and_clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags))
 478                         wake_up_interruptible(&session->report_queue);
 479
 480                 /* FIXME: Call into SET_ GET_ handlers here */
 481                 break;
 482
 483         case HIDP_HSHK_ERR_UNKNOWN:
 484                 break;
 485
 486         case HIDP_HSHK_ERR_FATAL:
 487                 /* Device requests a reboot, as this is the only way this error
 488                  * can be recovered. */
 489                 __hidp_send_ctrl_message(session,
 490                         HIDP_TRANS_HID_CONTROL | HIDP_CTRL_SOFT_RESET, NULL, 0);
 491                 break;
 492
 493         default:
 494                 __hidp_send_ctrl_message(session,
 495                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 496                 break;
 497         }
 498
 499         /* Wake up the waiting thread. */
 500         if (test_and_clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags))
 501                 wake_up_interruptible(&session->report_queue);
 502 }
 503
 504 static void hidp_process_hid_control(struct hidp_session *session,
 505                                         unsigned char param)
 506 {
 507         BT_DBG("session %p param 0x%02x", session, param);
 508
 509         if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) {
 510                 /* Flush the transmit queues */
 511                 skb_queue_purge(&session->ctrl_transmit);
 512                 skb_queue_purge(&session->intr_transmit);
 513
 514                 atomic_inc(&session->terminate);
 515                 wake_up_process(current);
 516         }
 517 }
 518
 519 /* Returns true if the passed-in skb should be freed by the caller. */
 520 static int hidp_process_data(struct hidp_session *session, struct sk_buff *skb,
 521                                 unsigned char param)
 522 {
 523         int done_with_skb = 1;
 524         BT_DBG("session %p skb %p len %d param 0x%02x", session, skb, skb->len, param);
 525
 526         switch (param) {
 527         case HIDP_DATA_RTYPE_INPUT:
 528                 hidp_set_timer(session);
 529
 530                 if (session->input)
 531                         hidp_input_report(session, skb);
 532
 533                 if (session->hid)
 534                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 0);
 535                 break;
 536
 537         case HIDP_DATA_RTYPE_OTHER:
 538         case HIDP_DATA_RTYPE_OUPUT:
 539         case HIDP_DATA_RTYPE_FEATURE:
 540                 break;
 541
 542         default:
 543                 __hidp_send_ctrl_message(session,
 544                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);
 545         }
 546
 547         if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) &&
 548                                 param == session->waiting_report_type) {
 549                 if (session->waiting_report_number < 0 ||
 550                     session->waiting_report_number == skb->data[0]) {
 551                         /* hidp_get_raw_report() is waiting on this report. */
 552                         session->report_return = skb;
 553                         done_with_skb = 0;
 554                         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 555                         wake_up_interruptible(&session->report_queue);
 556                 }
 557         }
 558
 559         return done_with_skb;
 560 }
 561
 562 static void hidp_recv_ctrl_frame(struct hidp_session *session,
 563                                         struct sk_buff *skb)
 564 {
 565         unsigned char hdr, type, param;
 566         int free_skb = 1;
 567
 568         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 569
 570         hdr = skb->data[0];
 571         skb_pull(skb, 1);
 572
 573         type = hdr & HIDP_HEADER_TRANS_MASK;
 574         param = hdr & HIDP_HEADER_PARAM_MASK;
 575
 576         switch (type) {
 577         case HIDP_TRANS_HANDSHAKE:
 578                 hidp_process_handshake(session, param);
 579                 break;
 580
 581         case HIDP_TRANS_HID_CONTROL:
 582                 hidp_process_hid_control(session, param);
 583                 break;
 584
 585         case HIDP_TRANS_DATA:
 586                 free_skb = hidp_process_data(session, skb, param);
 587                 break;
 588
 589         default:
 590                 __hidp_send_ctrl_message(session,
 591                         HIDP_TRANS_HANDSHAKE | HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);
 592                 break;
 593         }
 594
 595         if (free_skb)
 596                 kfree_skb(skb);
 597 }
 598
 599 static void hidp_recv_intr_frame(struct hidp_session *session,
 600                                 struct sk_buff *skb)
 601 {
 602         unsigned char hdr;
 603
 604         BT_DBG("session %p skb %p len %d", session, skb, skb->len);
 605
 606         hdr = skb->data[0];
 607         skb_pull(skb, 1);
 608
 609         if (hdr == (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {
 610                 hidp_set_timer(session);
 611
 612                 if (session->input)
 613                         hidp_input_report(session, skb);
 614
 615                 if (session->hid) {
 616                         hid_input_report(session->hid, HID_INPUT_REPORT, skb->data, skb->len, 1);
 617                         BT_DBG("report len %d", skb->len);
 618                 }
 619         } else {
 620                 BT_DBG("Unsupported protocol header 0x%02x", hdr);
 621         }
 622
 623         kfree_skb(skb);
 624 }
 625
 626 static int hidp_send_frame(struct socket *sock, unsigned char *data, int len)
 627 {
 628         struct kvec iv = { data, len };
 629         struct msghdr msg;
 630
 631         BT_DBG("sock %p data %p len %d", sock, data, len);
 632
 633         if (!len)
 634                 return 0;
 635
 636         memset(&msg, 0, sizeof(msg));
 637
 638         return kernel_sendmsg(sock, &msg, &iv, 1, len);
 639 }
 640
 641 static void hidp_process_intr_transmit(struct hidp_session *session)
 642 {
 643         struct sk_buff *skb;
 644
 645         BT_DBG("session %p", session);
 646
 647         while ((skb = skb_dequeue(&session->intr_transmit))) {
 648                 if (hidp_send_frame(session->intr_sock, skb->data, skb->len) < 0) {
 649                         skb_queue_head(&session->intr_transmit, skb);
 650                         break;
 651                 }
 652
 653                 hidp_set_timer(session);
 654                 kfree_skb(skb);
 655         }
 656 }
 657
 658 static void hidp_process_ctrl_transmit(struct hidp_session *session)
 659 {
 660         struct sk_buff *skb;
 661
 662         BT_DBG("session %p", session);
 663
 664         while ((skb = skb_dequeue(&session->ctrl_transmit))) {
 665                 if (hidp_send_frame(session->ctrl_sock, skb->data, skb->len) < 0) {
 666                         skb_queue_head(&session->ctrl_transmit, skb);
 667                         break;
 668                 }
 669
 670                 hidp_set_timer(session);
 671                 kfree_skb(skb);
 672         }
 673 }
 674
 675 static int hidp_session(void *arg)
 676 {
 677         struct hidp_session *session = arg;
 678         struct sock *ctrl_sk = session->ctrl_sock->sk;
 679         struct sock *intr_sk = session->intr_sock->sk;
 680         struct sk_buff *skb;
 681         wait_queue_t ctrl_wait, intr_wait;
 682
 683         BT_DBG("session %p", session);
 684
 685         __module_get(THIS_MODULE);
 686         set_user_nice(current, -15);
 687
 688         init_waitqueue_entry(&ctrl_wait, current);
 689         init_waitqueue_entry(&intr_wait, current);
 690         add_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
 691         add_wait_queue(sk_sleep(intr_sk), &intr_wait);
 692         session->waiting_for_startup = 0;
 693         wake_up_interruptible(&session->startup_queue);
 694         set_current_state(TASK_INTERRUPTIBLE);
 695         while (!atomic_read(&session->terminate)) {
 696                 if (ctrl_sk->sk_state != BT_CONNECTED ||
 697                                 intr_sk->sk_state != BT_CONNECTED)
 698                         break;
 699
 700                 while ((skb = skb_dequeue(&intr_sk->sk_receive_queue))) {
 701                         skb_orphan(skb);
 702                         if (!skb_linearize(skb))
 703                                 hidp_recv_intr_frame(session, skb);
 704                         else
 705                                 kfree_skb(skb);
 706                 }
 707
 708                 hidp_process_intr_transmit(session);
 709
 710                 while ((skb = skb_dequeue(&ctrl_sk->sk_receive_queue))) {
 711                         skb_orphan(skb);
 712                         if (!skb_linearize(skb))
 713                                 hidp_recv_ctrl_frame(session, skb);
 714                         else
 715                                 kfree_skb(skb);
 716                 }
 717
 718                 hidp_process_ctrl_transmit(session);
 719
 720                 schedule();
 721                 set_current_state(TASK_INTERRUPTIBLE);
 722         }
 723         set_current_state(TASK_RUNNING);
 724         remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
 725         remove_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
 726
 727         clear_bit(HIDP_WAITING_FOR_SEND_ACK, &session->flags);
 728         clear_bit(HIDP_WAITING_FOR_RETURN, &session->flags);
 729         wake_up_interruptible(&session->report_queue);
 730
 731         down_write(&hidp_session_sem);
 732
 733         hidp_del_timer(session);
 734
 735         if (session->input) {
 736                 input_unregister_device(session->input);
 737                 session->input = NULL;
 738         }
 739
 740         if (session->hid) {
 741                 hid_destroy_device(session->hid);
 742                 session->hid = NULL;
 743         }
 744
 745         /* Wakeup user-space polling for socket errors */
 746         session->intr_sock->sk->sk_err = EUNATCH;
 747         session->ctrl_sock->sk->sk_err = EUNATCH;
 748
 749         hidp_schedule(session);
 750
 751         fput(session->intr_sock->file);
 752
 753         wait_event_timeout(*(sk_sleep(ctrl_sk)),
 754                 (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
 755
 756         fput(session->ctrl_sock->file);
 757
 758         __hidp_unlink_session(session);
 759
 760         up_write(&hidp_session_sem);
 761
 762         kfree(session->rd_data);
 763         kfree(session);
 764         module_put_and_exit(0);
 765         return 0;
 766 }
 767
 768 static struct hci_conn *hidp_get_connection(struct hidp_session *session)
 769 {
 770         bdaddr_t *src = &bt_sk(session->ctrl_sock->sk)->src;
 771         bdaddr_t *dst = &bt_sk(session->ctrl_sock->sk)->dst;
 772         struct hci_conn *conn;
 773         struct hci_dev *hdev;
 774
 775         hdev = hci_get_route(dst, src);
 776         if (!hdev)
 777                 return NULL;
 778
 779         hci_dev_lock(hdev);
 780         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
 781         if (conn)
 782                 hci_conn_hold_device(conn);
 783         hci_dev_unlock(hdev);
 784
 785         hci_dev_put(hdev);
 786
 787         return conn;
 788 }
 789
 790 static int hidp_setup_input(struct hidp_session *session,
 791                                 struct hidp_connadd_req *req)
 792 {
 793         struct input_dev *input;
 794         int i;
 795
 796         input = input_allocate_device();
 797         if (!input)
 798                 return -ENOMEM;
 799
 800         session->input = input;
 801
 802         input_set_drvdata(input, session);
 803
 804         input->name = "Bluetooth HID Boot Protocol Device";
 805
 806         input->id.bustype = BUS_BLUETOOTH;
 807         input->id.vendor  = req->vendor;
 808         input->id.product = req->product;
 809         input->id.version = req->version;
 810
 811         if (req->subclass & 0x40) {
 812                 set_bit(EV_KEY, input->evbit);
 813                 set_bit(EV_LED, input->evbit);
 814                 set_bit(EV_REP, input->evbit);
 815
 816                 set_bit(LED_NUML,    input->ledbit);
 817                 set_bit(LED_CAPSL,   input->ledbit);
 818                 set_bit(LED_SCROLLL, input->ledbit);
 819                 set_bit(LED_COMPOSE, input->ledbit);
 820                 set_bit(LED_KANA,    input->ledbit);
 821
 822                 for (i = 0; i < sizeof(hidp_keycode); i++)
 823                         set_bit(hidp_keycode[i], input->keybit);
 824                 clear_bit(0, input->keybit);
 825         }
 826
 827         if (req->subclass & 0x80) {
 828                 input->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REL);
 829                 input->keybit[BIT_WORD(BTN_MOUSE)] = BIT_MASK(BTN_LEFT) |
 830                         BIT_MASK(BTN_RIGHT) | BIT_MASK(BTN_MIDDLE);
 831                 input->relbit[0] = BIT_MASK(REL_X) | BIT_MASK(REL_Y);
 832                 input->keybit[BIT_WORD(BTN_MOUSE)] |= BIT_MASK(BTN_SIDE) |
 833                         BIT_MASK(BTN_EXTRA);
 834                 input->relbit[0] |= BIT_MASK(REL_WHEEL);
 835         }
 836
 837         input->dev.parent = &session->conn->dev;
 838
 839         input->event = hidp_input_event;
 840
 841         return 0;
 842 }
 843
 844 static int hidp_open(struct hid_device *hid)
 845 {
 846         return 0;
 847 }
 848
 849 static void hidp_close(struct hid_device *hid)
 850 {
 851 }
 852
 853 static int hidp_parse(struct hid_device *hid)
 854 {
 855         struct hidp_session *session = hid->driver_data;
 856
 857         return hid_parse_report(session->hid, session->rd_data,
 858                         session->rd_size);
 859 }
 860
 861 static int hidp_start(struct hid_device *hid)
 862 {
 863         struct hidp_session *session = hid->driver_data;
 864         struct hid_report *report;
 865
 866         if (hid->quirks & HID_QUIRK_NO_INIT_REPORTS)
 867                 return 0;
 868
 869         list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].
 870                         report_list, list)
 871                 hidp_send_report(session, report);
 872
 873         list_for_each_entry(report, &hid->report_enum[HID_FEATURE_REPORT].
 874                         report_list, list)
 875                 hidp_send_report(session, report);
 876
 877         return 0;
 878 }
 879
 880 static void hidp_stop(struct hid_device *hid)
 881 {
 882         struct hidp_session *session = hid->driver_data;
 883
 884         skb_queue_purge(&session->ctrl_transmit);
 885         skb_queue_purge(&session->intr_transmit);
 886
 887         hid->claimed = 0;
 888 }
 889
 890 static struct hid_ll_driver hidp_hid_driver = {
 891         .parse = hidp_parse,
 892         .start = hidp_start,
 893         .stop = hidp_stop,
 894         .open  = hidp_open,
 895         .close = hidp_close,
 896         .hidinput_input_event = hidp_hidinput_event,
 897 };
 898
 899 /* This function sets up the hid device. It does not add it
 900    to the HID system. That is done in hidp_add_connection(). */
 901 static int hidp_setup_hid(struct hidp_session *session,
 902                                 struct hidp_connadd_req *req)
 903 {
 904         struct hid_device *hid;
 905         int err;
 906
 907         session->rd_data = kzalloc(req->rd_size, GFP_KERNEL);
 908         if (!session->rd_data)
 909                 return -ENOMEM;
 910
 911         if (copy_from_user(session->rd_data, req->rd_data, req->rd_size)) {
 912                 err = -EFAULT;
 913                 goto fault;
 914         }
 915         session->rd_size = req->rd_size;
 916
 917         hid = hid_allocate_device();
 918         if (IS_ERR(hid)) {
 919                 err = PTR_ERR(hid);
 920                 goto fault;
 921         }
 922
 923         session->hid = hid;
 924
 925         hid->driver_data = session;
 926
 927         hid->bus     = BUS_BLUETOOTH;
 928         hid->vendor  = req->vendor;
 929         hid->product = req->product;
 930         hid->version = req->version;
 931         hid->country = req->country;
 932
 933         strncpy(hid->name, req->name, 128);
 934         strncpy(hid->phys, batostr(&bt_sk(session->ctrl_sock->sk)->src), 64);
 935         strncpy(hid->uniq, batostr(&bt_sk(session->ctrl_sock->sk)->dst), 64);
 936
 937         hid->dev.parent = &session->conn->dev;
 938         hid->ll_driver = &hidp_hid_driver;
 939
 940         hid->hid_get_raw_report = hidp_get_raw_report;
 941         hid->hid_output_raw_report = hidp_output_raw_report;
 942
 943         return 0;
 944
 945 fault:
 946         kfree(session->rd_data);
 947         session->rd_data = NULL;
 948
 949         return err;
 950 }
 951
 952 int hidp_add_connection(struct hidp_connadd_req *req, struct socket *ctrl_sock, struct socket *intr_sock)
 953 {
 954         struct hidp_session *session, *s;
 955         int vendor, product;
 956         int err;
 957
 958         BT_DBG("");
 959
 960         if (bacmp(&bt_sk(ctrl_sock->sk)->src, &bt_sk(intr_sock->sk)->src) ||
 961                         bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
 962                 return -ENOTUNIQ;
 963
 964         BT_DBG("rd_data %p rd_size %d", req->rd_data, req->rd_size);
 965
 966         down_write(&hidp_session_sem);
 967
 968         s = __hidp_get_session(&bt_sk(ctrl_sock->sk)->dst);
 969         if (s && s->state == BT_CONNECTED) {
 970                 up_write(&hidp_session_sem);
 971                 return -EEXIST;
 972         }
 973
 974         session = kzalloc(sizeof(struct hidp_session), GFP_KERNEL);
 975         if (!session) {
 976                 up_write(&hidp_session_sem);
 977                 return -ENOMEM;
 978         }
 979
 980         bacpy(&session->bdaddr, &bt_sk(ctrl_sock->sk)->dst);
 981
 982         session->ctrl_mtu = min_t(uint, l2cap_pi(ctrl_sock->sk)->chan->omtu,
 983                                         l2cap_pi(ctrl_sock->sk)->chan->imtu);
 984         session->intr_mtu = min_t(uint, l2cap_pi(intr_sock->sk)->chan->omtu,
 985                                         l2cap_pi(intr_sock->sk)->chan->imtu);
 986
 987         BT_DBG("ctrl mtu %d intr mtu %d", session->ctrl_mtu, session->intr_mtu);
 988
 989         session->ctrl_sock = ctrl_sock;
 990         session->intr_sock = intr_sock;
 991         session->state     = BT_CONNECTED;
 992
 993         session->conn = hidp_get_connection(session);
 994         if (!session->conn) {
 995                 err = -ENOTCONN;
 996                 goto failed;
 997         }
 998
 999         setup_timer(&session->timer, hidp_idle_timeout, (unsigned long)session);
1000
1001         skb_queue_head_init(&session->ctrl_transmit);
1002         skb_queue_head_init(&session->intr_transmit);
1003
1004         mutex_init(&session->report_mutex);
1005         init_waitqueue_head(&session->report_queue);
1006         init_waitqueue_head(&session->startup_queue);
1007         session->waiting_for_startup = 1;
1008         session->flags   = req->flags & (1 << HIDP_BLUETOOTH_VENDOR_ID);
1009         session->idle_to = req->idle_to;
1010
1011         __hidp_link_session(session);
1012
1013         if (req->rd_size > 0) {
1014                 err = hidp_setup_hid(session, req);
1015                 if (err)
1016                         goto purge;
1017         }
1018
1019         if (!session->hid) {
1020                 err = hidp_setup_input(session, req);
1021                 if (err < 0)
1022                         goto purge;
1023         }
1024
1025         hidp_set_timer(session);
1026
1027         if (session->hid) {
1028                 vendor  = session->hid->vendor;
1029                 product = session->hid->product;
1030         } else if (session->input) {
1031                 vendor  = session->input->id.vendor;
1032                 product = session->input->id.product;
1033         } else {
1034                 vendor = 0x0000;
1035                 product = 0x0000;
1036         }
1037
1038         session->task = kthread_run(hidp_session, session, "khidpd_%04x%04x",
1039                                                         vendor, product);
1040         if (IS_ERR(session->task)) {
1041                 err = PTR_ERR(session->task);
1042                 goto unlink;
1043         }
1044
1045         while (session->waiting_for_startup) {
1046                 wait_event_interruptible(session->startup_queue,
1047                         !session->waiting_for_startup);
1048         }
1049
1050         if (session->hid)
1051                 err = hid_add_device(session->hid);
1052         else
1053                 err = input_register_device(session->input);
1054
1055         if (err < 0) {
1056                 atomic_inc(&session->terminate);
1057                 wake_up_process(session->task);
1058                 up_write(&hidp_session_sem);
1059                 return err;
1060         }
1061
1062         if (session->input) {
1063                 hidp_send_ctrl_message(session,
1064                         HIDP_TRANS_SET_PROTOCOL | HIDP_PROTO_BOOT, NULL, 0);
1065                 session->flags |= (1 << HIDP_BOOT_PROTOCOL_MODE);
1066
1067                 session->leds = 0xff;
1068                 hidp_input_event(session->input, EV_LED, 0, 0);
1069         }
1070
1071         up_write(&hidp_session_sem);
1072         return 0;
1073
1074 unlink:
1075         hidp_del_timer(session);
1076
1077         if (session->input) {
1078                 input_unregister_device(session->input);
1079                 session->input = NULL;
1080         }
1081
1082         if (session->hid) {
1083                 hid_destroy_device(session->hid);
1084                 session->hid = NULL;
1085         }
1086
1087         kfree(session->rd_data);
1088         session->rd_data = NULL;
1089
1090 purge:
1091         __hidp_unlink_session(session);
1092
1093         skb_queue_purge(&session->ctrl_transmit);
1094         skb_queue_purge(&session->intr_transmit);
1095
1096 failed:
1097         up_write(&hidp_session_sem);
1098
1099         kfree(session);
1100         return err;
1101 }
1102
1103 int hidp_del_connection(struct hidp_conndel_req *req)
1104 {
1105         struct hidp_session *session;
1106         int err = 0;
1107
1108         BT_DBG("");
1109
1110         down_read(&hidp_session_sem);
1111
1112         session = __hidp_get_session(&req->bdaddr);
1113         if (session) {
1114                 if (req->flags & (1 << HIDP_VIRTUAL_CABLE_UNPLUG)) {
1115                         hidp_send_ctrl_message(session,
1116                                 HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG, NULL, 0);
1117                 } else {
1118                         /* Flush the transmit queues */
1119                         skb_queue_purge(&session->ctrl_transmit);
1120                         skb_queue_purge(&session->intr_transmit);
1121
1122                         atomic_inc(&session->terminate);
1123                         wake_up_process(session->task);
1124                 }
1125         } else
1126                 err = -ENOENT;
1127
1128         up_read(&hidp_session_sem);
1129         return err;
1130 }
1131
1132 int hidp_get_connlist(struct hidp_connlist_req *req)
1133 {
1134         struct hidp_session *session;
1135         int err = 0, n = 0;
1136
1137         BT_DBG("");
1138
1139         down_read(&hidp_session_sem);
1140
1141         list_for_each_entry(session, &hidp_session_list, list) {
1142                 struct hidp_conninfo ci;
1143
1144                 __hidp_copy_session(session, &ci);
1145
1146                 if (copy_to_user(req->ci, &ci, sizeof(ci))) {
1147                         err = -EFAULT;
1148                         break;
1149                 }
1150
1151                 if (++n >= req->cnum)
1152                         break;
1153
1154                 req->ci++;
1155         }
1156         req->cnum = n;
1157
1158         up_read(&hidp_session_sem);
1159         return err;
1160 }
1161
1162 int hidp_get_conninfo(struct hidp_conninfo *ci)
1163 {
1164         struct hidp_session *session;
1165         int err = 0;
1166
1167         down_read(&hidp_session_sem);
1168
1169         session = __hidp_get_session(&ci->bdaddr);
1170         if (session)
1171                 __hidp_copy_session(session, ci);
1172         else
1173                 err = -ENOENT;
1174
1175         up_read(&hidp_session_sem);
1176         return err;
1177 }
1178
1179 static int __init hidp_init(void)
1180 {
1181         BT_INFO("HIDP (Human Interface Emulation) ver %s", VERSION);
1182
1183         return hidp_init_sockets();
1184 }
1185
1186 static void __exit hidp_exit(void)
1187 {
1188         hidp_cleanup_sockets();
1189 }
1190
1191 module_init(hidp_init);
1192 module_exit(hidp_exit);
1193
1194 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1195 MODULE_DESCRIPTION("Bluetooth HIDP ver " VERSION);
1196 MODULE_VERSION(VERSION);
1197 MODULE_LICENSE("GPL");
1198 MODULE_ALIAS("bt-proto-6");