profiles/input/hog-lib.c

   1 /*
   2  *
   3  *  BlueZ - Bluetooth protocol stack for Linux
   4  *
   5  *  Copyright (C) 2014  Intel Corporation.
   6  *  Copyright (C) 2012  Marcel Holtmann <marcel@holtmann.org>
   7  *  Copyright (C) 2012  Nordic Semiconductor Inc.
   8  *  Copyright (C) 2012  Instituto Nokia de Tecnologia - INdT
   9  *
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, write to the Free Software
  23  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  24  *
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include <config.h>
  29 #endif
  30
  31 #include <stdlib.h>
  32 #include <stdbool.h>
  33 #include <errno.h>
  34 #include <unistd.h>
  35 #include <sys/types.h>
  36 #include <sys/stat.h>
  37 #include <fcntl.h>
  38
  39 #include <glib.h>
  40
  41 #include "lib/bluetooth.h"
  42 #include "lib/sdp.h"
  43 #include "lib/uuid.h"
  44
  45 #include "src/shared/util.h"
  46 #include "src/shared/uhid.h"
  47 #include "src/shared/queue.h"
  48 #include "src/log.h"
  49
  50 #include "attrib/att.h"
  51 #include "attrib/gattrib.h"
  52 #include "attrib/gatt.h"
  53
  54 #include "btio/btio.h"
  55
  56 #include "profiles/scanparam/scpp.h"
  57 #include "profiles/deviceinfo/dis.h"
  58 #include "profiles/battery/bas.h"
  59 #include "profiles/input/hog-lib.h"
  60
  61 #define HOG_UUID                "00001812-0000-1000-8000-00805f9b34fb"
  62
  63 #define HOG_INFO_UUID           0x2A4A
  64 #define HOG_REPORT_MAP_UUID     0x2A4B
  65 #define HOG_REPORT_UUID         0x2A4D
  66 #define HOG_PROTO_MODE_UUID     0x2A4E
  67 #define HOG_CONTROL_POINT_UUID  0x2A4C
  68
  69 #define HOG_REPORT_TYPE_INPUT   1
  70 #define HOG_REPORT_TYPE_OUTPUT  2
  71 #define HOG_REPORT_TYPE_FEATURE 3
  72
  73 #define HOG_PROTO_MODE_BOOT    0
  74 #define HOG_PROTO_MODE_REPORT  1
  75
  76 #define HOG_REPORT_MAP_MAX_SIZE        512
  77 #define HID_INFO_SIZE                   4
  78 #define ATT_NOTIFICATION_HEADER_SIZE    3
  79
  80 struct bt_hog {
  81         int                     ref_count;
  82         char                    *name;
  83         uint16_t                vendor;
  84         uint16_t                product;
  85         uint16_t                version;
  86         struct gatt_primary     *primary;
  87         GAttrib                 *attrib;
  88         GSList                  *reports;
  89         struct bt_uhid          *uhid;
  90         int                     uhid_fd;
  91         bool                    uhid_created;
  92         gboolean                has_report_id;
  93         uint16_t                bcdhid;
  94         uint8_t                 bcountrycode;
  95         uint16_t                proto_mode_handle;
  96         uint16_t                ctrlpt_handle;
  97         uint8_t                 flags;
  98         unsigned int            getrep_att;
  99         uint16_t                getrep_id;
 100         unsigned int            setrep_att;
 101         uint16_t                setrep_id;
 102         struct bt_scpp          *scpp;
 103         struct bt_dis           *dis;
 104         struct queue            *bas;
 105         GSList                  *instances;
 106         struct queue            *gatt_op;
 107 };
 108
 109 struct report {
 110         struct bt_hog           *hog;
 111         uint8_t                 id;
 112         uint8_t                 type;
 113         uint16_t                ccc_handle;
 114         guint                   notifyid;
 115         struct gatt_char        *decl;
 116         uint16_t                len;
 117         uint8_t                 *value;
 118 };
 119
 120 struct gatt_request {
 121         unsigned int id;
 122         struct bt_hog *hog;
 123         void *user_data;
 124 };
 125
 126 static struct gatt_request *create_request(struct bt_hog *hog,
 127                                                         void *user_data)
 128 {
 129         struct gatt_request *req;
 130
 131         req = new0(struct gatt_request, 1);
 132         if (!req)
 133                 return NULL;
 134
 135         req->user_data = user_data;
 136         req->hog = bt_hog_ref(hog);
 137
 138         return req;
 139 }
 140
 141 static bool set_and_store_gatt_req(struct bt_hog *hog,
 142                                                 struct gatt_request *req,
 143                                                 unsigned int id)
 144 {
 145         req->id = id;
 146         return queue_push_head(hog->gatt_op, req);
 147 }
 148
 149 static void destroy_gatt_req(struct gatt_request *req)
 150 {
 151         queue_remove(req->hog->gatt_op, req);
 152         bt_hog_unref(req->hog);
 153         free(req);
 154 }
 155
 156 static void write_char(struct bt_hog *hog, GAttrib *attrib, uint16_t handle,
 157                                         const uint8_t *value, size_t vlen,
 158                                         GAttribResultFunc func,
 159                                         gpointer user_data)
 160 {
 161         struct gatt_request *req;
 162         unsigned int id;
 163
 164         req = create_request(hog, user_data);
 165         if (!req)
 166                 return;
 167
 168         id = gatt_write_char(attrib, handle, value, vlen, func, req);
 169
 170         if (set_and_store_gatt_req(hog, req, id))
 171                 return;
 172
 173         error("hog: Could not read char");
 174         g_attrib_cancel(attrib, id);
 175         free(req);
 176 }
 177
 178 static void read_char(struct bt_hog *hog, GAttrib *attrib, uint16_t handle,
 179                                 GAttribResultFunc func, gpointer user_data)
 180 {
 181         struct gatt_request *req;
 182         unsigned int id;
 183
 184         req = create_request(hog, user_data);
 185         if (!req)
 186                 return;
 187
 188         id = gatt_read_char(attrib, handle, func, req);
 189
 190         if (set_and_store_gatt_req(hog, req, id))
 191                 return;
 192
 193         error("hog: Could not read char");
 194         g_attrib_cancel(attrib, id);
 195         free(req);
 196 }
 197
 198 static void discover_desc(struct bt_hog *hog, GAttrib *attrib,
 199                                 uint16_t start, uint16_t end, gatt_cb_t func,
 200                                 gpointer user_data)
 201 {
 202         struct gatt_request *req;
 203         unsigned int id;
 204
 205         req = create_request(hog, user_data);
 206         if (!req)
 207                 return;
 208
 209         id = gatt_discover_desc(attrib, start, end, NULL, func, req);
 210         if (set_and_store_gatt_req(hog, req, id))
 211                 return;
 212
 213         error("hog: Could not discover descriptors");
 214         g_attrib_cancel(attrib, id);
 215         free(req);
 216 }
 217
 218 static void discover_char(struct bt_hog *hog, GAttrib *attrib,
 219                                                 uint16_t start, uint16_t end,
 220                                                 bt_uuid_t *uuid, gatt_cb_t func,
 221                                                 gpointer user_data)
 222 {
 223         struct gatt_request *req;
 224         unsigned int id;
 225
 226         req = create_request(hog, user_data);
 227         if (!req)
 228                 return;
 229
 230         id = gatt_discover_char(attrib, start, end, uuid, func, req);
 231
 232         if (set_and_store_gatt_req(hog, req, id))
 233                 return;
 234
 235         error("hog: Could not discover characteristic");
 236         g_attrib_cancel(attrib, id);
 237         free(req);
 238 }
 239
 240 static void discover_primary(struct bt_hog *hog, GAttrib *attrib,
 241                                                 bt_uuid_t *uuid, gatt_cb_t func,
 242                                                 gpointer user_data)
 243 {
 244         struct gatt_request *req;
 245         unsigned int id;
 246
 247         req = create_request(hog, user_data);
 248         if (!req)
 249                 return;
 250
 251         id = gatt_discover_primary(attrib, uuid, func, req);
 252
 253         if (set_and_store_gatt_req(hog, req, id))
 254                 return;
 255
 256         error("hog: Could not send discover primary");
 257         g_attrib_cancel(attrib, id);
 258         free(req);
 259 }
 260
 261 static void find_included(struct bt_hog *hog, GAttrib *attrib,
 262                                         uint16_t start, uint16_t end,
 263                                         gatt_cb_t func, gpointer user_data)
 264 {
 265         struct gatt_request *req;
 266         unsigned int id;
 267
 268         req = create_request(hog, user_data);
 269         if (!req)
 270                 return;
 271
 272         id = gatt_find_included(attrib, start, end, func, req);
 273
 274         if (set_and_store_gatt_req(hog, req, id))
 275                 return;
 276
 277         error("Could not find included");
 278         g_attrib_cancel(attrib, id);
 279         free(req);
 280 }
 281
 282 static void report_value_cb(const guint8 *pdu, guint16 len, gpointer user_data)
 283 {
 284         struct report *report = user_data;
 285         struct bt_hog *hog = report->hog;
 286         struct uhid_event ev;
 287         uint8_t *buf;
 288         int err;
 289
 290         if (len < ATT_NOTIFICATION_HEADER_SIZE) {
 291                 error("Malformed ATT notification");
 292                 return;
 293         }
 294
 295         pdu += ATT_NOTIFICATION_HEADER_SIZE;
 296         len -= ATT_NOTIFICATION_HEADER_SIZE;
 297
 298         memset(&ev, 0, sizeof(ev));
 299         ev.type = UHID_INPUT;
 300         buf = ev.u.input.data;
 301
 302         if (hog->has_report_id) {
 303                 buf[0] = report->id;
 304                 len = MIN(len, sizeof(ev.u.input.data) - 1);
 305                 memcpy(buf + 1, pdu, len);
 306                 ev.u.input.size = ++len;
 307         } else {
 308                 len = MIN(len, sizeof(ev.u.input.data));
 309                 memcpy(buf, pdu, len);
 310                 ev.u.input.size = len;
 311         }
 312
 313         err = bt_uhid_send(hog->uhid, &ev);
 314         if (err < 0) {
 315                 error("bt_uhid_send: %s (%d)", strerror(-err), -err);
 316                 return;
 317         }
 318
 319         DBG("HoG report (%u bytes)", ev.u.input.size);
 320 }
 321
 322 static void report_ccc_written_cb(guint8 status, const guint8 *pdu,
 323                                         guint16 plen, gpointer user_data)
 324 {
 325         struct gatt_request *req = user_data;
 326         struct report *report = req->user_data;
 327         struct bt_hog *hog = report->hog;
 328
 329         destroy_gatt_req(req);
 330
 331         if (status != 0) {
 332                 error("Write report characteristic descriptor failed: %s",
 333                                                         att_ecode2str(status));
 334                 return;
 335         }
 336
 337         report->notifyid = g_attrib_register(hog->attrib,
 338                                         ATT_OP_HANDLE_NOTIFY,
 339                                         report->decl->value_handle,
 340                                         report_value_cb, report, NULL);
 341
 342         DBG("Report characteristic descriptor written: notifications enabled");
 343 }
 344
 345 static void write_ccc(struct bt_hog *hog, GAttrib *attrib, uint16_t handle,
 346                                                         void *user_data)
 347 {
 348         uint8_t value[2];
 349
 350         put_le16(GATT_CLIENT_CHARAC_CFG_NOTIF_BIT, value);
 351
 352         write_char(hog, attrib, handle, value, sizeof(value),
 353                                         report_ccc_written_cb, user_data);
 354 }
 355
 356 static void ccc_read_cb(guint8 status, const guint8 *pdu, guint16 len,
 357                                                         gpointer user_data)
 358 {
 359         struct gatt_request *req = user_data;
 360         struct report *report = req->user_data;
 361
 362         destroy_gatt_req(req);
 363
 364         if (status != 0) {
 365                 error("Error reading CCC value: %s", att_ecode2str(status));
 366                 return;
 367         }
 368
 369         write_ccc(report->hog, report->hog->attrib, report->ccc_handle, report);
 370 }
 371
 372 static const char *type_to_string(uint8_t type)
 373 {
 374         switch (type) {
 375         case HOG_REPORT_TYPE_INPUT:
 376                 return "input";
 377         case HOG_REPORT_TYPE_OUTPUT:
 378                 return "output";
 379         case HOG_REPORT_TYPE_FEATURE:
 380                 return "feature";
 381         }
 382
 383         return NULL;
 384 }
 385
 386 static void report_reference_cb(guint8 status, const guint8 *pdu,
 387                                         guint16 plen, gpointer user_data)
 388 {
 389         struct gatt_request *req = user_data;
 390         struct report *report = req->user_data;
 391
 392         destroy_gatt_req(req);
 393
 394         if (status != 0) {
 395                 error("Read Report Reference descriptor failed: %s",
 396                                                         att_ecode2str(status));
 397                 return;
 398         }
 399
 400         if (plen != 3) {
 401                 error("Malformed ATT read response");
 402                 return;
 403         }
 404
 405         report->id = pdu[1];
 406         report->type = pdu[2];
 407
 408         DBG("Report 0x%04x: id 0x%02x type %s", report->decl->value_handle,
 409                                 report->id, type_to_string(report->type));
 410
 411         /* Enable notifications only for Input Reports */
 412         if (report->type == HOG_REPORT_TYPE_INPUT)
 413                 read_char(report->hog, report->hog->attrib, report->ccc_handle,
 414                                                         ccc_read_cb, report);
 415 }
 416
 417 static void external_report_reference_cb(guint8 status, const guint8 *pdu,
 418                                         guint16 plen, gpointer user_data);
 419
 420 static void discover_external_cb(uint8_t status, GSList *descs, void *user_data)
 421 {
 422         struct gatt_request *req = user_data;
 423         struct bt_hog *hog = req->user_data;
 424
 425         destroy_gatt_req(req);
 426
 427         if (status != 0) {
 428                 error("Discover external descriptors failed: %s",
 429                                                         att_ecode2str(status));
 430                 return;
 431         }
 432
 433         for ( ; descs; descs = descs->next) {
 434                 struct gatt_desc *desc = descs->data;
 435
 436                 read_char(hog, hog->attrib, desc->handle,
 437                                                 external_report_reference_cb,
 438                                                 hog);
 439         }
 440 }
 441
 442 static void discover_external(struct bt_hog *hog, GAttrib *attrib,
 443                                                 uint16_t start, uint16_t end,
 444                                                 gpointer user_data)
 445 {
 446         bt_uuid_t uuid;
 447
 448         if (start > end)
 449                 return;
 450
 451         bt_uuid16_create(&uuid, GATT_EXTERNAL_REPORT_REFERENCE);
 452
 453         discover_desc(hog, attrib, start, end, discover_external_cb,
 454                                                                 user_data);
 455 }
 456
 457 static void discover_report_cb(uint8_t status, GSList *descs, void *user_data)
 458 {
 459         struct gatt_request *req = user_data;
 460         struct report *report = req->user_data;
 461         struct bt_hog *hog = report->hog;
 462
 463         destroy_gatt_req(req);
 464
 465         if (status != 0) {
 466                 error("Discover report descriptors failed: %s",
 467                                                         att_ecode2str(status));
 468                 return;
 469         }
 470
 471         for ( ; descs; descs = descs->next) {
 472                 struct gatt_desc *desc = descs->data;
 473
 474                 switch (desc->uuid16) {
 475                 case GATT_CLIENT_CHARAC_CFG_UUID:
 476                         report->ccc_handle = desc->handle;
 477                         break;
 478                 case GATT_REPORT_REFERENCE:
 479                         read_char(hog, hog->attrib, desc->handle,
 480                                                 report_reference_cb, report);
 481                         break;
 482                 }
 483         }
 484 }
 485
 486 static void discover_report(struct bt_hog *hog, GAttrib *attrib,
 487                                                 uint16_t start, uint16_t end,
 488                                                         gpointer user_data)
 489 {
 490         if (start > end)
 491                 return;
 492
 493         discover_desc(hog, attrib, start, end, discover_report_cb, user_data);
 494 }
 495
 496 static void report_read_cb(guint8 status, const guint8 *pdu, guint16 len,
 497                                                         gpointer user_data)
 498 {
 499         struct gatt_request *req = user_data;
 500         struct report *report = req->user_data;
 501
 502         destroy_gatt_req(req);
 503
 504         if (status != 0) {
 505                 error("Error reading Report value: %s", att_ecode2str(status));
 506                 return;
 507         }
 508
 509         if (report->value)
 510                 g_free(report->value);
 511
 512         report->value = g_memdup(pdu, len);
 513         report->len = len;
 514 }
 515
 516 static int report_chrc_cmp(const void *data, const void *user_data)
 517 {
 518         const struct report *report = data;
 519         const struct gatt_char *decl = user_data;
 520
 521         return report->decl->handle - decl->handle;
 522 }
 523
 524 static struct report *report_new(struct bt_hog *hog, struct gatt_char *chr)
 525 {
 526         struct report *report;
 527         GSList *l;
 528
 529         /* Skip if report already exists */
 530         l = g_slist_find_custom(hog->reports, chr, report_chrc_cmp);
 531         if (l)
 532                 return l->data;
 533
 534         report = g_new0(struct report, 1);
 535         report->hog = hog;
 536         report->decl = g_memdup(chr, sizeof(*chr));
 537         hog->reports = g_slist_append(hog->reports, report);
 538
 539         read_char(hog, hog->attrib, chr->value_handle, report_read_cb, report);
 540
 541         return report;
 542 }
 543
 544 static void external_service_char_cb(uint8_t status, GSList *chars,
 545                                                                 void *user_data)
 546 {
 547         struct gatt_request *req = user_data;
 548         struct bt_hog *hog = req->user_data;
 549         struct gatt_primary *primary = hog->primary;
 550         struct report *report;
 551         GSList *l;
 552
 553         destroy_gatt_req(req);
 554
 555         if (status != 0) {
 556                 const char *str = att_ecode2str(status);
 557                 DBG("Discover external service characteristic failed: %s", str);
 558                 return;
 559         }
 560
 561         for (l = chars; l; l = g_slist_next(l)) {
 562                 struct gatt_char *chr, *next;
 563                 uint16_t start, end;
 564
 565                 chr = l->data;
 566                 next = l->next ? l->next->data : NULL;
 567
 568                 DBG("0x%04x UUID: %s properties: %02x",
 569                                 chr->handle, chr->uuid, chr->properties);
 570
 571                 report = report_new(hog, chr);
 572                 start = chr->value_handle + 1;
 573                 end = (next ? next->handle - 1 : primary->range.end);
 574                 discover_report(hog, hog->attrib, start, end, report);
 575         }
 576 }
 577
 578 static void external_report_reference_cb(guint8 status, const guint8 *pdu,
 579                                         guint16 plen, gpointer user_data)
 580 {
 581         struct gatt_request *req = user_data;
 582         struct bt_hog *hog = req->user_data;
 583         uint16_t uuid16;
 584         bt_uuid_t uuid;
 585
 586         destroy_gatt_req(req);
 587
 588         if (status != 0) {
 589                 error("Read External Report Reference descriptor failed: %s",
 590                                                         att_ecode2str(status));
 591                 return;
 592         }
 593
 594         if (plen != 3) {
 595                 error("Malformed ATT read response");
 596                 return;
 597         }
 598
 599         uuid16 = get_le16(&pdu[1]);
 600         DBG("External report reference read, external report characteristic "
 601                                                 "UUID: 0x%04x", uuid16);
 602
 603         /* Do not discover if is not a Report */
 604         if (uuid16 != HOG_REPORT_UUID)
 605                 return;
 606
 607         bt_uuid16_create(&uuid, uuid16);
 608         discover_char(hog, hog->attrib, 0x0001, 0xffff, &uuid,
 609                                         external_service_char_cb, hog);
 610 }
 611
 612 static int report_cmp(gconstpointer a, gconstpointer b)
 613 {
 614         const struct report *ra = a, *rb = b;
 615
 616         /* sort by type first.. */
 617         if (ra->type != rb->type)
 618                 return ra->type - rb->type;
 619
 620         /* skip id check in case of report id 0 */
 621         if (!rb->id)
 622                 return 0;
 623
 624         /* ..then by id */
 625         return ra->id - rb->id;
 626 }
 627
 628 static struct report *find_report(struct bt_hog *hog, uint8_t type, uint8_t id)
 629 {
 630         struct report cmp;
 631         GSList *l;
 632
 633         cmp.type = type;
 634         cmp.id = hog->has_report_id ? id : 0;
 635
 636         l = g_slist_find_custom(hog->reports, &cmp, report_cmp);
 637
 638         return l ? l->data : NULL;
 639 }
 640
 641 static struct report *find_report_by_rtype(struct bt_hog *hog, uint8_t rtype,
 642                                                                 uint8_t id)
 643 {
 644         uint8_t type;
 645
 646         switch (rtype) {
 647         case UHID_FEATURE_REPORT:
 648                 type = HOG_REPORT_TYPE_FEATURE;
 649                 break;
 650         case UHID_OUTPUT_REPORT:
 651                 type = HOG_REPORT_TYPE_OUTPUT;
 652                 break;
 653         case UHID_INPUT_REPORT:
 654                 type = HOG_REPORT_TYPE_INPUT;
 655                 break;
 656         default:
 657                 return NULL;
 658         }
 659
 660         return find_report(hog, type, id);
 661 }
 662
 663 static void output_written_cb(guint8 status, const guint8 *pdu,
 664                                         guint16 plen, gpointer user_data)
 665 {
 666         struct gatt_request *req = user_data;
 667
 668         destroy_gatt_req(req);
 669
 670         if (status != 0) {
 671                 error("Write output report failed: %s", att_ecode2str(status));
 672                 return;
 673         }
 674 }
 675
 676 static void forward_report(struct uhid_event *ev, void *user_data)
 677 {
 678         struct bt_hog *hog = user_data;
 679         struct report *report;
 680         void *data;
 681         int size;
 682
 683         report = find_report_by_rtype(hog, ev->u.output.rtype,
 684                                                         ev->u.output.data[0]);
 685         if (!report)
 686                 return;
 687
 688         data = ev->u.output.data;
 689         size = ev->u.output.size;
 690         if (hog->has_report_id && size > 0) {
 691                 data++;
 692                 --size;
 693         }
 694
 695         DBG("Sending report type %d ID %d to handle 0x%X", report->type,
 696                                 report->id, report->decl->value_handle);
 697
 698         if (hog->attrib == NULL)
 699                 return;
 700
 701         if (report->decl->properties & GATT_CHR_PROP_WRITE)
 702                 write_char(hog, hog->attrib, report->decl->value_handle,
 703                                 data, size, output_written_cb, hog);
 704         else if (report->decl->properties & GATT_CHR_PROP_WRITE_WITHOUT_RESP)
 705                 gatt_write_cmd(hog->attrib, report->decl->value_handle,
 706                                                 data, size, NULL, NULL);
 707 }
 708
 709 static void get_feature(struct uhid_event *ev, void *user_data)
 710 {
 711         struct bt_hog *hog = user_data;
 712         struct report *report;
 713         struct uhid_event rsp;
 714         int err;
 715
 716         memset(&rsp, 0, sizeof(rsp));
 717         rsp.type = UHID_FEATURE_ANSWER;
 718         rsp.u.feature_answer.id = ev->u.feature.id;
 719
 720         report = find_report_by_rtype(hog, ev->u.feature.rtype,
 721                                                         ev->u.feature.rnum);
 722         if (!report) {
 723                 rsp.u.feature_answer.err = ENOTSUP;
 724                 goto done;
 725         }
 726
 727         if (!report->value) {
 728                 rsp.u.feature_answer.err = EIO;
 729                 goto done;
 730         }
 731
 732         rsp.u.feature_answer.size = report->len;
 733         memcpy(rsp.u.feature_answer.data, report->value, report->len);
 734
 735 done:
 736         err = bt_uhid_send(hog->uhid, &rsp);
 737         if (err < 0)
 738                 error("bt_uhid_send: %s", strerror(-err));
 739 }
 740
 741 static void set_report_cb(guint8 status, const guint8 *pdu,
 742                                         guint16 plen, gpointer user_data)
 743 {
 744         struct bt_hog *hog = user_data;
 745         struct uhid_event rsp;
 746         int err;
 747
 748         hog->setrep_att = 0;
 749
 750         memset(&rsp, 0, sizeof(rsp));
 751         rsp.type = UHID_SET_REPORT_REPLY;
 752         rsp.u.set_report_reply.id = hog->setrep_id;
 753         rsp.u.set_report_reply.err = status;
 754
 755         if (status != 0)
 756                 error("Error setting Report value: %s", att_ecode2str(status));
 757
 758         err = bt_uhid_send(hog->uhid, &rsp);
 759         if (err < 0)
 760                 error("bt_uhid_send: %s", strerror(-err));
 761 }
 762
 763 static void set_report(struct uhid_event *ev, void *user_data)
 764 {
 765         struct bt_hog *hog = user_data;
 766         struct report *report;
 767         void *data;
 768         int size;
 769         int err;
 770
 771         /* uhid never sends reqs in parallel; if there's a req, it timed out */
 772         if (hog->setrep_att) {
 773                 g_attrib_cancel(hog->attrib, hog->setrep_att);
 774                 hog->setrep_att = 0;
 775         }
 776
 777         hog->setrep_id = ev->u.set_report.id;
 778
 779         report = find_report_by_rtype(hog, ev->u.set_report.rtype,
 780                                                         ev->u.set_report.rnum);
 781         if (!report) {
 782                 err = ENOTSUP;
 783                 goto fail;
 784         }
 785
 786         data = ev->u.set_report.data;
 787         size = ev->u.set_report.size;
 788         if (hog->has_report_id && size > 0) {
 789                 data++;
 790                 --size;
 791         }
 792
 793         DBG("Sending report type %d ID %d to handle 0x%X", report->type,
 794                                 report->id, report->decl->value_handle);
 795
 796         if (hog->attrib == NULL)
 797                 return;
 798
 799         hog->setrep_att = gatt_write_char(hog->attrib,
 800                                                 report->decl->value_handle,
 801                                                 data, size, set_report_cb,
 802                                                 hog);
 803         if (!hog->setrep_att) {
 804                 err = ENOMEM;
 805                 goto fail;
 806         }
 807
 808         return;
 809 fail:
 810         /* cancel the request on failure */
 811         set_report_cb(err, NULL, 0, hog);
 812 }
 813
 814 static void get_report_cb(guint8 status, const guint8 *pdu, guint16 len,
 815                                                         gpointer user_data)
 816 {
 817         struct bt_hog *hog = user_data;
 818         struct uhid_event rsp;
 819         int err;
 820
 821         hog->getrep_att = 0;
 822
 823         memset(&rsp, 0, sizeof(rsp));
 824         rsp.type = UHID_GET_REPORT_REPLY;
 825         rsp.u.get_report_reply.id = hog->getrep_id;
 826
 827         if (status != 0) {
 828                 error("Error reading Report value: %s", att_ecode2str(status));
 829                 goto exit;
 830         }
 831
 832         if (len == 0) {
 833                 error("Error reading Report, length %d", len);
 834                 status = EIO;
 835                 goto exit;
 836         }
 837
 838         if (pdu[0] != 0x0b) {
 839                 error("Error reading Report, invalid response: %02x", pdu[0]);
 840                 status = EPROTO;
 841                 goto exit;
 842         }
 843
 844         --len;
 845         ++pdu;
 846         if (hog->has_report_id && len > 0) {
 847                 --len;
 848                 ++pdu;
 849         }
 850
 851         rsp.u.get_report_reply.size = len;
 852         memcpy(rsp.u.get_report_reply.data, pdu, len);
 853
 854 exit:
 855         rsp.u.get_report_reply.err = status;
 856         err = bt_uhid_send(hog->uhid, &rsp);
 857         if (err < 0)
 858                 error("bt_uhid_send: %s", strerror(-err));
 859 }
 860
 861 static void get_report(struct uhid_event *ev, void *user_data)
 862 {
 863         struct bt_hog *hog = user_data;
 864         struct report *report;
 865         guint8 err;
 866
 867         /* uhid never sends reqs in parallel; if there's a req, it timed out */
 868         if (hog->getrep_att) {
 869                 g_attrib_cancel(hog->attrib, hog->getrep_att);
 870                 hog->getrep_att = 0;
 871         }
 872
 873         hog->getrep_id = ev->u.get_report.id;
 874
 875         report = find_report_by_rtype(hog, ev->u.get_report.rtype,
 876                                                         ev->u.get_report.rnum);
 877         if (!report) {
 878                 err = ENOTSUP;
 879                 goto fail;
 880         }
 881
 882         hog->getrep_att = gatt_read_char(hog->attrib,
 883                                                 report->decl->value_handle,
 884                                                 get_report_cb, hog);
 885         if (!hog->getrep_att) {
 886                 err = ENOMEM;
 887                 goto fail;
 888         }
 889
 890         return;
 891
 892 fail:
 893         /* cancel the request on failure */
 894         get_report_cb(err, NULL, 0, hog);
 895 }
 896
 897 static bool get_descriptor_item_info(uint8_t *buf, ssize_t blen, ssize_t *len,
 898                                                                 bool *is_long)
 899 {
 900         if (!blen)
 901                 return false;
 902
 903         *is_long = (buf[0] == 0xfe);
 904
 905         if (*is_long) {
 906                 if (blen < 3)
 907                         return false;
 908
 909                 /*
 910                  * long item:
 911                  * byte 0 -> 0xFE
 912                  * byte 1 -> data size
 913                  * byte 2 -> tag
 914                  * + data
 915                  */
 916
 917                 *len = buf[1] + 3;
 918         } else {
 919                 uint8_t b_size;
 920
 921                 /*
 922                  * short item:
 923                  * byte 0[1..0] -> data size (=0, 1, 2, 4)
 924                  * byte 0[3..2] -> type
 925                  * byte 0[7..4] -> tag
 926                  * + data
 927                  */
 928
 929                 b_size = buf[0] & 0x03;
 930                 *len = (b_size ? 1 << (b_size - 1) : 0) + 1;
 931         }
 932
 933         /* item length should be no more than input buffer length */
 934         return *len <= blen;
 935 }
 936
 937 static char *item2string(char *str, uint8_t *buf, uint8_t len)
 938 {
 939         char *p = str;
 940         int i;
 941
 942         /*
 943          * Since long item tags are not defined except for vendor ones, we
 944          * just ensure that short items are printed properly (up to 5 bytes).
 945          */
 946         for (i = 0; i < 6 && i < len; i++)
 947                 p += sprintf(p, " %02x", buf[i]);
 948
 949         /*
 950          * If there are some data left, just add continuation mark to indicate
 951          * this.
 952          */
 953         if (i < len)
 954                 sprintf(p, " ...");
 955
 956         return str;
 957 }
 958
 959 static void report_map_read_cb(guint8 status, const guint8 *pdu, guint16 plen,
 960                                                         gpointer user_data)
 961 {
 962         struct gatt_request *req = user_data;
 963         struct bt_hog *hog = req->user_data;
 964         uint8_t value[HOG_REPORT_MAP_MAX_SIZE];
 965         struct uhid_event ev;
 966         ssize_t vlen;
 967         char itemstr[20]; /* 5x3 (data) + 4 (continuation) + 1 (null) */
 968         int i, err;
 969         GError *gerr = NULL;
 970
 971         destroy_gatt_req(req);
 972
 973         DBG("HoG inspecting report map");
 974
 975         if (status != 0) {
 976                 error("Report Map read failed: %s", att_ecode2str(status));
 977                 return;
 978         }
 979
 980         vlen = dec_read_resp(pdu, plen, value, sizeof(value));
 981         if (vlen < 0) {
 982                 error("ATT protocol error");
 983                 return;
 984         }
 985
 986         DBG("Report MAP:");
 987         for (i = 0; i < vlen;) {
 988                 ssize_t ilen = 0;
 989                 bool long_item = false;
 990
 991                 if (get_descriptor_item_info(&value[i], vlen - i, &ilen,
 992                                                                 &long_item)) {
 993                         /* Report ID is short item with prefix 100001xx */
 994                         if (!long_item && (value[i] & 0xfc) == 0x84)
 995                                 hog->has_report_id = TRUE;
 996
 997                         DBG("\t%s", item2string(itemstr, &value[i], ilen));
 998
 999                         i += ilen;
1000                 } else {
1001                         error("Report Map parsing failed at %d", i);
1002
1003                         /* Just print remaining items at once and break */
1004                         DBG("\t%s", item2string(itemstr, &value[i], vlen - i));
1005                         break;
1006                 }
1007         }
1008
1009         /* create uHID device */
1010         memset(&ev, 0, sizeof(ev));
1011         ev.type = UHID_CREATE;
1012
1013         bt_io_get(g_attrib_get_channel(hog->attrib), &gerr,
1014                         BT_IO_OPT_SOURCE, ev.u.create.phys,
1015                         BT_IO_OPT_DEST, ev.u.create.uniq,
1016                         BT_IO_OPT_INVALID);
1017         if (gerr) {
1018                 error("Failed to connection details: %s", gerr->message);
1019                 g_error_free(gerr);
1020                 return;
1021         }
1022
1023         strcpy((char *) ev.u.create.name, hog->name);
1024         ev.u.create.vendor = hog->vendor;
1025         ev.u.create.product = hog->product;
1026         ev.u.create.version = hog->version;
1027         ev.u.create.country = hog->bcountrycode;
1028         ev.u.create.bus = BUS_BLUETOOTH;
1029         ev.u.create.rd_data = value;
1030         ev.u.create.rd_size = vlen;
1031
1032         err = bt_uhid_send(hog->uhid, &ev);
1033         if (err < 0) {
1034                 error("bt_uhid_send: %s", strerror(-err));
1035                 return;
1036         }
1037
1038         bt_uhid_register(hog->uhid, UHID_OUTPUT, forward_report, hog);
1039         bt_uhid_register(hog->uhid, UHID_FEATURE, get_feature, hog);
1040         bt_uhid_register(hog->uhid, UHID_GET_REPORT, get_report, hog);
1041         bt_uhid_register(hog->uhid, UHID_SET_REPORT, set_report, hog);
1042
1043         hog->uhid_created = true;
1044
1045         DBG("HoG created uHID device");
1046 }
1047
1048 static void info_read_cb(guint8 status, const guint8 *pdu, guint16 plen,
1049                                                         gpointer user_data)
1050 {
1051         struct gatt_request *req = user_data;
1052         struct bt_hog *hog = req->user_data;
1053         uint8_t value[HID_INFO_SIZE];
1054         ssize_t vlen;
1055
1056         destroy_gatt_req(req);
1057
1058         if (status != 0) {
1059                 error("HID Information read failed: %s",
1060                                                 att_ecode2str(status));
1061                 return;
1062         }
1063
1064         vlen = dec_read_resp(pdu, plen, value, sizeof(value));
1065         if (vlen != 4) {
1066                 error("ATT protocol error");
1067                 return;
1068         }
1069
1070         hog->bcdhid = get_le16(&value[0]);
1071         hog->bcountrycode = value[2];
1072         hog->flags = value[3];
1073
1074         DBG("bcdHID: 0x%04X bCountryCode: 0x%02X Flags: 0x%02X",
1075                         hog->bcdhid, hog->bcountrycode, hog->flags);
1076 }
1077
1078 static void proto_mode_read_cb(guint8 status, const guint8 *pdu, guint16 plen,
1079                                                         gpointer user_data)
1080 {
1081         struct gatt_request *req = user_data;
1082         struct bt_hog *hog = req->user_data;
1083         uint8_t value;
1084         ssize_t vlen;
1085
1086         destroy_gatt_req(req);
1087
1088         if (status != 0) {
1089                 error("Protocol Mode characteristic read failed: %s",
1090                                                         att_ecode2str(status));
1091                 return;
1092         }
1093
1094         vlen = dec_read_resp(pdu, plen, &value, sizeof(value));
1095         if (vlen < 0) {
1096                 error("ATT protocol error");
1097                 return;
1098         }
1099
1100         if (value == HOG_PROTO_MODE_BOOT) {
1101                 uint8_t nval = HOG_PROTO_MODE_REPORT;
1102
1103                 DBG("HoG is operating in Boot Procotol Mode");
1104
1105                 gatt_write_cmd(hog->attrib, hog->proto_mode_handle, &nval,
1106                                                 sizeof(nval), NULL, NULL);
1107         } else if (value == HOG_PROTO_MODE_REPORT)
1108                 DBG("HoG is operating in Report Protocol Mode");
1109 }
1110
1111 static void char_discovered_cb(uint8_t status, GSList *chars, void *user_data)
1112 {
1113         struct gatt_request *req = user_data;
1114         struct bt_hog *hog = req->user_data;
1115         struct gatt_primary *primary = hog->primary;
1116         bt_uuid_t report_uuid, report_map_uuid, info_uuid;
1117         bt_uuid_t proto_mode_uuid, ctrlpt_uuid;
1118         struct report *report;
1119         GSList *l;
1120         uint16_t info_handle = 0, proto_mode_handle = 0;
1121
1122         destroy_gatt_req(req);
1123
1124         DBG("HoG inspecting characteristics");
1125
1126         if (status != 0) {
1127                 const char *str = att_ecode2str(status);
1128                 DBG("Discover all characteristics failed: %s", str);
1129                 return;
1130         }
1131
1132         bt_uuid16_create(&report_uuid, HOG_REPORT_UUID);
1133         bt_uuid16_create(&report_map_uuid, HOG_REPORT_MAP_UUID);
1134         bt_uuid16_create(&info_uuid, HOG_INFO_UUID);
1135         bt_uuid16_create(&proto_mode_uuid, HOG_PROTO_MODE_UUID);
1136         bt_uuid16_create(&ctrlpt_uuid, HOG_CONTROL_POINT_UUID);
1137
1138         for (l = chars; l; l = g_slist_next(l)) {
1139                 struct gatt_char *chr, *next;
1140                 bt_uuid_t uuid;
1141                 uint16_t start, end;
1142
1143                 chr = l->data;
1144                 next = l->next ? l->next->data : NULL;
1145
1146                 DBG("0x%04x UUID: %s properties: %02x",
1147                                 chr->handle, chr->uuid, chr->properties);
1148
1149                 bt_string_to_uuid(&uuid, chr->uuid);
1150
1151                 start = chr->value_handle + 1;
1152                 end = (next ? next->handle - 1 : primary->range.end);
1153
1154                 if (bt_uuid_cmp(&uuid, &report_uuid) == 0) {
1155                         report = report_new(hog, chr);
1156                         discover_report(hog, hog->attrib, start, end, report);
1157                 } else if (bt_uuid_cmp(&uuid, &report_map_uuid) == 0) {
1158                         DBG("HoG discovering report map");
1159                         read_char(hog, hog->attrib, chr->value_handle,
1160                                                 report_map_read_cb, hog);
1161                         discover_external(hog, hog->attrib, start, end, hog);
1162                 } else if (bt_uuid_cmp(&uuid, &info_uuid) == 0)
1163                         info_handle = chr->value_handle;
1164                 else if (bt_uuid_cmp(&uuid, &proto_mode_uuid) == 0)
1165                         proto_mode_handle = chr->value_handle;
1166                 else if (bt_uuid_cmp(&uuid, &ctrlpt_uuid) == 0)
1167                         hog->ctrlpt_handle = chr->value_handle;
1168         }
1169
1170         if (proto_mode_handle) {
1171                 hog->proto_mode_handle = proto_mode_handle;
1172                 read_char(hog, hog->attrib, proto_mode_handle,
1173                                                 proto_mode_read_cb, hog);
1174         }
1175
1176         if (info_handle)
1177                 read_char(hog, hog->attrib, info_handle, info_read_cb, hog);
1178 }
1179
1180 static void report_free(void *data)
1181 {
1182         struct report *report = data;
1183
1184         g_free(report->value);
1185         g_free(report->decl);
1186         g_free(report);
1187 }
1188
1189 static void cancel_gatt_req(struct gatt_request *req)
1190 {
1191         if (g_attrib_cancel(req->hog->attrib, req->id))
1192                 destroy_gatt_req(req);
1193 }
1194
1195 static void hog_free(void *data)
1196 {
1197         struct bt_hog *hog = data;
1198
1199         bt_hog_detach(hog);
1200
1201         queue_destroy(hog->bas, (void *) bt_bas_unref);
1202         g_slist_free_full(hog->instances, hog_free);
1203
1204         bt_scpp_unref(hog->scpp);
1205         bt_dis_unref(hog->dis);
1206         bt_uhid_unref(hog->uhid);
1207         g_slist_free_full(hog->reports, report_free);
1208         g_free(hog->name);
1209         g_free(hog->primary);
1210         queue_destroy(hog->gatt_op, (void *) destroy_gatt_req);
1211         g_free(hog);
1212 }
1213
1214 struct bt_hog *bt_hog_new_default(const char *name, uint16_t vendor,
1215                                         uint16_t product, uint16_t version,
1216                                         void *primary)
1217 {
1218         return bt_hog_new(-1, name, vendor, product, version, primary);
1219 }
1220
1221 struct bt_hog *bt_hog_new(int fd, const char *name, uint16_t vendor,
1222                                         uint16_t product, uint16_t version,
1223                                         void *primary)
1224 {
1225         struct bt_hog *hog;
1226
1227         hog = g_try_new0(struct bt_hog, 1);
1228         if (!hog)
1229                 return NULL;
1230
1231         hog->gatt_op = queue_new();
1232         hog->bas = queue_new();
1233
1234         if (fd < 0)
1235                 hog->uhid = bt_uhid_new_default();
1236         else
1237                 hog->uhid = bt_uhid_new(fd);
1238
1239         hog->uhid_fd = fd;
1240
1241         if (!hog->gatt_op || !hog->bas || !hog->uhid) {
1242                 hog_free(hog);
1243                 return NULL;
1244         }
1245
1246         hog->name = g_strdup(name);
1247         hog->vendor = vendor;
1248         hog->product = product;
1249         hog->version = version;
1250
1251         if (primary)
1252                 hog->primary = g_memdup(primary, sizeof(*hog->primary));
1253
1254         return bt_hog_ref(hog);
1255 }
1256
1257 struct bt_hog *bt_hog_ref(struct bt_hog *hog)
1258 {
1259         if (!hog)
1260                 return NULL;
1261
1262         __sync_fetch_and_add(&hog->ref_count, 1);
1263
1264         return hog;
1265 }
1266
1267 void bt_hog_unref(struct bt_hog *hog)
1268 {
1269         if (!hog)
1270                 return;
1271
1272         if (__sync_sub_and_fetch(&hog->ref_count, 1))
1273                 return;
1274
1275         hog_free(hog);
1276 }
1277
1278 static void find_included_cb(uint8_t status, GSList *services, void *user_data)
1279 {
1280         struct gatt_request *req = user_data;
1281         GSList *l;
1282
1283         DBG("");
1284
1285         destroy_gatt_req(req);
1286
1287         if (status) {
1288                 const char *str = att_ecode2str(status);
1289                 DBG("Find included failed: %s", str);
1290                 return;
1291         }
1292
1293         for (l = services; l; l = l->next) {
1294                 struct gatt_included *include = l->data;
1295
1296                 DBG("included: handle %x, uuid %s",
1297                         include->handle, include->uuid);
1298         }
1299 }
1300
1301 static void hog_attach_scpp(struct bt_hog *hog, struct gatt_primary *primary)
1302 {
1303         if (hog->scpp) {
1304                 bt_scpp_attach(hog->scpp, hog->attrib);
1305                 return;
1306         }
1307
1308         hog->scpp = bt_scpp_new(primary);
1309         if (hog->scpp)
1310                 bt_scpp_attach(hog->scpp, hog->attrib);
1311 }
1312
1313 static void dis_notify(uint8_t source, uint16_t vendor, uint16_t product,
1314                                         uint16_t version, void *user_data)
1315 {
1316         struct bt_hog *hog = user_data;
1317
1318         hog->vendor = vendor;
1319         hog->product = product;
1320         hog->version = version;
1321 }
1322
1323 static void hog_attach_dis(struct bt_hog *hog, struct gatt_primary *primary)
1324 {
1325         if (hog->dis) {
1326                 bt_dis_attach(hog->dis, hog->attrib);
1327                 return;
1328         }
1329
1330         hog->dis = bt_dis_new(primary);
1331         if (hog->dis) {
1332                 bt_dis_set_notification(hog->dis, dis_notify, hog);
1333                 bt_dis_attach(hog->dis, hog->attrib);
1334         }
1335 }
1336
1337 static void hog_attach_bas(struct bt_hog *hog, struct gatt_primary *primary)
1338 {
1339         struct bt_bas *instance;
1340
1341         instance = bt_bas_new(primary);
1342
1343         bt_bas_attach(instance, hog->attrib);
1344         queue_push_head(hog->bas, instance);
1345 }
1346
1347 static void hog_attach_hog(struct bt_hog *hog, struct gatt_primary *primary)
1348 {
1349         struct bt_hog *instance;
1350
1351         if (!hog->primary) {
1352                 hog->primary = g_memdup(primary, sizeof(*primary));
1353                 discover_char(hog, hog->attrib, primary->range.start,
1354                                                 primary->range.end, NULL,
1355                                                 char_discovered_cb, hog);
1356                 find_included(hog, hog->attrib, primary->range.start,
1357                                 primary->range.end, find_included_cb, hog);
1358                 return;
1359         }
1360
1361         instance = bt_hog_new(hog->uhid_fd, hog->name, hog->vendor,
1362                                         hog->product, hog->version, primary);
1363         if (!instance)
1364                 return;
1365
1366         find_included(instance, hog->attrib, primary->range.start,
1367                         primary->range.end, find_included_cb, instance);
1368
1369         bt_hog_attach(instance, hog->attrib);
1370         hog->instances = g_slist_append(hog->instances, instance);
1371 }
1372
1373 static void primary_cb(uint8_t status, GSList *services, void *user_data)
1374 {
1375         struct gatt_request *req = user_data;
1376         struct bt_hog *hog = req->user_data;
1377         struct gatt_primary *primary;
1378         GSList *l;
1379
1380         DBG("");
1381
1382         destroy_gatt_req(req);
1383
1384         if (status) {
1385                 const char *str = att_ecode2str(status);
1386                 DBG("Discover primary failed: %s", str);
1387                 return;
1388         }
1389
1390         if (!services) {
1391                 DBG("No primary service found");
1392                 return;
1393         }
1394
1395         for (l = services; l; l = l->next) {
1396                 primary = l->data;
1397
1398                 if (strcmp(primary->uuid, SCAN_PARAMETERS_UUID) == 0) {
1399                         hog_attach_scpp(hog, primary);
1400                         continue;
1401                 }
1402
1403                 if (strcmp(primary->uuid, DEVICE_INFORMATION_UUID) == 0) {
1404                         hog_attach_dis(hog, primary);
1405                         continue;
1406                 }
1407
1408                 if (strcmp(primary->uuid, BATTERY_UUID) == 0) {
1409                         hog_attach_bas(hog, primary);
1410                         continue;
1411                 }
1412
1413                 if (strcmp(primary->uuid, HOG_UUID) == 0)
1414                         hog_attach_hog(hog, primary);
1415         }
1416 }
1417
1418 bool bt_hog_attach(struct bt_hog *hog, void *gatt)
1419 {
1420         struct gatt_primary *primary = hog->primary;
1421         GSList *l;
1422
1423         if (hog->attrib)
1424                 return false;
1425
1426         hog->attrib = g_attrib_ref(gatt);
1427
1428         if (!primary) {
1429                 discover_primary(hog, hog->attrib, NULL, primary_cb, hog);
1430                 return true;
1431         }
1432
1433         if (hog->scpp)
1434                 bt_scpp_attach(hog->scpp, gatt);
1435
1436         if (hog->dis)
1437                 bt_dis_attach(hog->dis, gatt);
1438
1439         queue_foreach(hog->bas, (void *) bt_bas_attach, gatt);
1440
1441         for (l = hog->instances; l; l = l->next) {
1442                 struct bt_hog *instance = l->data;
1443
1444                 bt_hog_attach(instance, gatt);
1445         }
1446
1447         if (!hog->uhid_created) {
1448                 DBG("HoG discovering characteristics");
1449                 discover_char(hog, hog->attrib, primary->range.start,
1450                                                 primary->range.end, NULL,
1451                                                 char_discovered_cb, hog);
1452                 return true;
1453         }
1454
1455         for (l = hog->reports; l; l = l->next) {
1456                 struct report *r = l->data;
1457
1458                 r->notifyid = g_attrib_register(hog->attrib,
1459                                         ATT_OP_HANDLE_NOTIFY,
1460                                         r->decl->value_handle,
1461                                         report_value_cb, r, NULL);
1462         }
1463
1464         return true;
1465 }
1466
1467 void bt_hog_detach(struct bt_hog *hog)
1468 {
1469         GSList *l;
1470
1471         if (!hog->attrib)
1472                 return;
1473
1474         queue_foreach(hog->bas, (void *) bt_bas_detach, NULL);
1475
1476         for (l = hog->instances; l; l = l->next) {
1477                 struct bt_hog *instance = l->data;
1478
1479                 bt_hog_detach(instance);
1480         }
1481
1482         for (l = hog->reports; l; l = l->next) {
1483                 struct report *r = l->data;
1484
1485                 if (r->notifyid > 0) {
1486                         g_attrib_unregister(hog->attrib, r->notifyid);
1487                         r->notifyid = 0;
1488                 }
1489         }
1490
1491         if (hog->scpp)
1492                 bt_scpp_detach(hog->scpp);
1493
1494         if (hog->dis)
1495                 bt_dis_detach(hog->dis);
1496
1497         queue_foreach(hog->gatt_op, (void *) cancel_gatt_req, NULL);
1498         g_attrib_unref(hog->attrib);
1499         hog->attrib = NULL;
1500 }
1501
1502 int bt_hog_set_control_point(struct bt_hog *hog, bool suspend)
1503 {
1504         uint8_t value = suspend ? 0x00 : 0x01;
1505
1506         if (hog->attrib == NULL)
1507                 return -ENOTCONN;
1508
1509         if (hog->ctrlpt_handle == 0)
1510                 return -ENOTSUP;
1511
1512         gatt_write_cmd(hog->attrib, hog->ctrlpt_handle, &value,
1513                                         sizeof(value), NULL, NULL);
1514
1515         return 0;
1516 }
1517
1518 int bt_hog_send_report(struct bt_hog *hog, void *data, size_t size, int type)
1519 {
1520         struct report *report;
1521         GSList *l;
1522
1523         if (!hog)
1524                 return -EINVAL;
1525
1526         if (!hog->attrib)
1527                 return -ENOTCONN;
1528
1529         report = find_report(hog, type, 0);
1530         if (!report)
1531                 return -ENOTSUP;
1532
1533         DBG("hog: Write report, handle 0x%X", report->decl->value_handle);
1534
1535         if (report->decl->properties & GATT_CHR_PROP_WRITE)
1536                 write_char(hog, hog->attrib, report->decl->value_handle,
1537                                 data, size, output_written_cb, hog);
1538
1539         if (report->decl->properties & GATT_CHR_PROP_WRITE_WITHOUT_RESP)
1540                 gatt_write_cmd(hog->attrib, report->decl->value_handle,
1541                                                 data, size, NULL, NULL);
1542
1543         for (l = hog->instances; l; l = l->next) {
1544                 struct bt_hog *instance = l->data;
1545
1546                 bt_hog_send_report(instance, data, size, type);
1547         }
1548
1549         return 0;
1550 }