Statistics
| Branch: | Revision:

root / hw / bt-hid.c @ 7442511c

History | View | Annotate | Download (15.9 kB)

1
/*
2
 * QEMU Bluetooth HID Profile wrapper for USB HID.
3
 *
4
 * Copyright (C) 2007-2008 OpenMoko, Inc.
5
 * Written by Andrzej Zaborowski <andrew@openedhand.com>
6
 *
7
 * This program is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU General Public License as
9
 * published by the Free Software Foundation; either version 2 or
10
 * (at your option) version 3 of the License.
11
 *
12
 * This program is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15
 * GNU General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU General Public License along
18
 * with this program; if not, write to the Free Software Foundation, Inc.,
19
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20
 */
21

    
22
#include "qemu-common.h"
23
#include "usb.h"
24
#include "bt.h"
25

    
26
enum hid_transaction_req {
27
    BT_HANDSHAKE                        = 0x0,
28
    BT_HID_CONTROL                        = 0x1,
29
    BT_GET_REPORT                        = 0x4,
30
    BT_SET_REPORT                        = 0x5,
31
    BT_GET_PROTOCOL                        = 0x6,
32
    BT_SET_PROTOCOL                        = 0x7,
33
    BT_GET_IDLE                                = 0x8,
34
    BT_SET_IDLE                                = 0x9,
35
    BT_DATA                                = 0xa,
36
    BT_DATC                                = 0xb,
37
};
38

    
39
enum hid_transaction_handshake {
40
    BT_HS_SUCCESSFUL                        = 0x0,
41
    BT_HS_NOT_READY                        = 0x1,
42
    BT_HS_ERR_INVALID_REPORT_ID                = 0x2,
43
    BT_HS_ERR_UNSUPPORTED_REQUEST        = 0x3,
44
    BT_HS_ERR_INVALID_PARAMETER                = 0x4,
45
    BT_HS_ERR_UNKNOWN                        = 0xe,
46
    BT_HS_ERR_FATAL                        = 0xf,
47
};
48

    
49
enum hid_transaction_control {
50
    BT_HC_NOP                                = 0x0,
51
    BT_HC_HARD_RESET                        = 0x1,
52
    BT_HC_SOFT_RESET                        = 0x2,
53
    BT_HC_SUSPEND                        = 0x3,
54
    BT_HC_EXIT_SUSPEND                        = 0x4,
55
    BT_HC_VIRTUAL_CABLE_UNPLUG                = 0x5,
56
};
57

    
58
enum hid_protocol {
59
    BT_HID_PROTO_BOOT                        = 0,
60
    BT_HID_PROTO_REPORT                        = 1,
61
};
62

    
63
enum hid_boot_reportid {
64
    BT_HID_BOOT_INVALID                        = 0,
65
    BT_HID_BOOT_KEYBOARD,
66
    BT_HID_BOOT_MOUSE,
67
};
68

    
69
enum hid_data_pkt {
70
    BT_DATA_OTHER                        = 0,
71
    BT_DATA_INPUT,
72
    BT_DATA_OUTPUT,
73
    BT_DATA_FEATURE,
74
};
75

    
76
#define BT_HID_MTU                        48
77

    
78
/* HID interface requests */
79
#define GET_REPORT                        0xa101
80
#define GET_IDLE                        0xa102
81
#define GET_PROTOCOL                        0xa103
82
#define SET_REPORT                        0x2109
83
#define SET_IDLE                        0x210a
84
#define SET_PROTOCOL                        0x210b
85

    
86
struct bt_hid_device_s {
87
    struct bt_l2cap_device_s btdev;
88
    struct bt_l2cap_conn_params_s *control;
89
    struct bt_l2cap_conn_params_s *interrupt;
90
    USBDevice *usbdev;
91

    
92
    int proto;
93
    int connected;
94
    int data_type;
95
    int intr_state;
96
    struct {
97
        int len;
98
        uint8_t buffer[1024];
99
    } dataother, datain, dataout, feature, intrdataout;
100
    enum {
101
        bt_state_ready,
102
        bt_state_transaction,
103
        bt_state_suspend,
104
    } state;
105
};
106

    
107
static void bt_hid_reset(struct bt_hid_device_s *s)
108
{
109
    struct bt_scatternet_s *net = s->btdev.device.net;
110

    
111
    /* Go as far as... */
112
    bt_l2cap_device_done(&s->btdev);
113
    bt_l2cap_device_init(&s->btdev, net);
114

    
115
    s->usbdev->handle_reset(s->usbdev);
116
    s->proto = BT_HID_PROTO_REPORT;
117
    s->state = bt_state_ready;
118
    s->dataother.len = 0;
119
    s->datain.len = 0;
120
    s->dataout.len = 0;
121
    s->feature.len = 0;
122
    s->intrdataout.len = 0;
123
    s->intr_state = 0;
124
}
125

    
126
static int bt_hid_out(struct bt_hid_device_s *s)
127
{
128
    USBPacket p;
129

    
130
    if (s->data_type == BT_DATA_OUTPUT) {
131
        p.pid = USB_TOKEN_OUT;
132
        p.devep = 1;
133
        p.data = s->dataout.buffer;
134
        p.len = s->dataout.len;
135
        s->dataout.len = s->usbdev->handle_data(s->usbdev, &p);
136

    
137
        return s->dataout.len;
138
    }
139

    
140
    if (s->data_type == BT_DATA_FEATURE) {
141
        /* XXX:
142
         * does this send a USB_REQ_CLEAR_FEATURE/USB_REQ_SET_FEATURE
143
         * or a SET_REPORT? */
144
        p.devep = 0;
145
    }
146

    
147
    return -1;
148
}
149

    
150
static int bt_hid_in(struct bt_hid_device_s *s)
151
{
152
    USBPacket p;
153

    
154
    p.pid = USB_TOKEN_IN;
155
    p.devep = 1;
156
    p.data = s->datain.buffer;
157
    p.len = sizeof(s->datain.buffer);
158
    s->datain.len = s->usbdev->handle_data(s->usbdev, &p);
159

    
160
    return s->datain.len;
161
}
162

    
163
static void bt_hid_send_handshake(struct bt_hid_device_s *s, int result)
164
{
165
    *s->control->sdu_out(s->control, 1) =
166
            (BT_HANDSHAKE << 4) | result;
167
    s->control->sdu_submit(s->control);
168
}
169

    
170
static void bt_hid_send_control(struct bt_hid_device_s *s, int operation)
171
{
172
    *s->control->sdu_out(s->control, 1) =
173
            (BT_HID_CONTROL << 4) | operation;
174
    s->control->sdu_submit(s->control);
175
}
176

    
177
static void bt_hid_disconnect(struct bt_hid_device_s *s)
178
{
179
    /* Disconnect s->control and s->interrupt */
180
}
181

    
182
static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type,
183
                const uint8_t *data, int len)
184
{
185
    uint8_t *pkt, hdr = (BT_DATA << 4) | type;
186
    int plen;
187

    
188
    do {
189
        plen = MIN(len, ch->remote_mtu - 1);
190
        pkt = ch->sdu_out(ch, plen + 1);
191

    
192
        pkt[0] = hdr;
193
        if (plen)
194
            memcpy(pkt + 1, data, plen);
195
        ch->sdu_submit(ch);
196

    
197
        len -= plen;
198
        data += plen;
199
        hdr = (BT_DATC << 4) | type;
200
    } while (plen == ch->remote_mtu - 1);
201
}
202

    
203
static void bt_hid_control_transaction(struct bt_hid_device_s *s,
204
                const uint8_t *data, int len)
205
{
206
    uint8_t type, parameter;
207
    int rlen, ret = -1;
208
    if (len < 1)
209
        return;
210

    
211
    type = data[0] >> 4;
212
    parameter = data[0] & 0xf;
213

    
214
    switch (type) {
215
    case BT_HANDSHAKE:
216
    case BT_DATA:
217
        switch (parameter) {
218
        default:
219
            /* These are not expected to be sent this direction.  */
220
            ret = BT_HS_ERR_INVALID_PARAMETER;
221
        }
222
        break;
223

    
224
    case BT_HID_CONTROL:
225
        if (len != 1 || (parameter != BT_HC_VIRTUAL_CABLE_UNPLUG &&
226
                                s->state == bt_state_transaction)) {
227
            ret = BT_HS_ERR_INVALID_PARAMETER;
228
            break;
229
        }
230
        switch (parameter) {
231
        case BT_HC_NOP:
232
            break;
233
        case BT_HC_HARD_RESET:
234
        case BT_HC_SOFT_RESET:
235
            bt_hid_reset(s);
236
            break;
237
        case BT_HC_SUSPEND:
238
            if (s->state == bt_state_ready)
239
                s->state = bt_state_suspend;
240
            else
241
                ret = BT_HS_ERR_INVALID_PARAMETER;
242
            break;
243
        case BT_HC_EXIT_SUSPEND:
244
            if (s->state == bt_state_suspend)
245
                s->state = bt_state_ready;
246
            else
247
                ret = BT_HS_ERR_INVALID_PARAMETER;
248
            break;
249
        case BT_HC_VIRTUAL_CABLE_UNPLUG:
250
            bt_hid_disconnect(s);
251
            break;
252
        default:
253
            ret = BT_HS_ERR_INVALID_PARAMETER;
254
        }
255
        break;
256

    
257
    case BT_GET_REPORT:
258
        /* No ReportIDs declared.  */
259
        if (((parameter & 8) && len != 3) ||
260
                        (!(parameter & 8) && len != 1) ||
261
                        s->state != bt_state_ready) {
262
            ret = BT_HS_ERR_INVALID_PARAMETER;
263
            break;
264
        }
265
        if (parameter & 8)
266
            rlen = data[2] | (data[3] << 8);
267
        else
268
            rlen = INT_MAX;
269
        switch (parameter & 3) {
270
        case BT_DATA_OTHER:
271
            ret = BT_HS_ERR_INVALID_PARAMETER;
272
            break;
273
        case BT_DATA_INPUT:
274
            /* Here we can as well poll s->usbdev */
275
            bt_hid_send_data(s->control, BT_DATA_INPUT,
276
                            s->datain.buffer, MIN(rlen, s->datain.len));
277
            break;
278
        case BT_DATA_OUTPUT:
279
            bt_hid_send_data(s->control, BT_DATA_OUTPUT,
280
                            s->dataout.buffer, MIN(rlen, s->dataout.len));
281
            break;
282
        case BT_DATA_FEATURE:
283
            bt_hid_send_data(s->control, BT_DATA_FEATURE,
284
                            s->feature.buffer, MIN(rlen, s->feature.len));
285
            break;
286
        }
287
        break;
288

    
289
    case BT_SET_REPORT:
290
        if (len < 2 || len > BT_HID_MTU || s->state != bt_state_ready ||
291
                        (parameter & 3) == BT_DATA_OTHER ||
292
                        (parameter & 3) == BT_DATA_INPUT) {
293
            ret = BT_HS_ERR_INVALID_PARAMETER;
294
            break;
295
        }
296
        s->data_type = parameter & 3;
297
        if (s->data_type == BT_DATA_OUTPUT) {
298
            s->dataout.len = len - 1;
299
            memcpy(s->dataout.buffer, data + 1, s->dataout.len);
300
        } else {
301
            s->feature.len = len - 1;
302
            memcpy(s->feature.buffer, data + 1, s->feature.len);
303
        }
304
        if (len == BT_HID_MTU)
305
            s->state = bt_state_transaction;
306
        else
307
            bt_hid_out(s);
308
        break;
309

    
310
    case BT_GET_PROTOCOL:
311
        if (len != 1 || s->state == bt_state_transaction) {
312
            ret = BT_HS_ERR_INVALID_PARAMETER;
313
            break;
314
        }
315
        *s->control->sdu_out(s->control, 1) = s->proto;
316
        s->control->sdu_submit(s->control);
317
        break;
318

    
319
    case BT_SET_PROTOCOL:
320
        if (len != 1 || s->state == bt_state_transaction ||
321
                        (parameter != BT_HID_PROTO_BOOT &&
322
                         parameter != BT_HID_PROTO_REPORT)) {
323
            ret = BT_HS_ERR_INVALID_PARAMETER;
324
            break;
325
        }
326
        s->proto = parameter;
327
        s->usbdev->handle_control(s->usbdev, SET_PROTOCOL, s->proto, 0, 0,
328
                                  NULL);
329
        ret = BT_HS_SUCCESSFUL;
330
        break;
331

    
332
    case BT_GET_IDLE:
333
        if (len != 1 || s->state == bt_state_transaction) {
334
            ret = BT_HS_ERR_INVALID_PARAMETER;
335
            break;
336
        }
337
        s->usbdev->handle_control(s->usbdev, GET_IDLE, 0, 0, 1,
338
                        s->control->sdu_out(s->control, 1));
339
        s->control->sdu_submit(s->control);
340
        break;
341

    
342
    case BT_SET_IDLE:
343
        if (len != 2 || s->state == bt_state_transaction) {
344
            ret = BT_HS_ERR_INVALID_PARAMETER;
345
            break;
346
        }
347

    
348
        /* We don't need to know about the Idle Rate here really,
349
         * so just pass it on to the device.  */
350
        ret = s->usbdev->handle_control(s->usbdev,
351
                        SET_IDLE, data[1], 0, 0, NULL) ?
352
                BT_HS_SUCCESSFUL : BT_HS_ERR_INVALID_PARAMETER;
353
        /* XXX: Does this generate a handshake? */
354
        break;
355

    
356
    case BT_DATC:
357
        if (len > BT_HID_MTU || s->state != bt_state_transaction) {
358
            ret = BT_HS_ERR_INVALID_PARAMETER;
359
            break;
360
        }
361
        if (s->data_type == BT_DATA_OUTPUT) {
362
            memcpy(s->dataout.buffer + s->dataout.len, data + 1, len - 1);
363
            s->dataout.len += len - 1;
364
        } else {
365
            memcpy(s->feature.buffer + s->feature.len, data + 1, len - 1);
366
            s->feature.len += len - 1;
367
        }
368
        if (len < BT_HID_MTU) {
369
            bt_hid_out(s);
370
            s->state = bt_state_ready;
371
        }
372
        break;
373

    
374
    default:
375
        ret = BT_HS_ERR_UNSUPPORTED_REQUEST;
376
    }
377

    
378
    if (ret != -1)
379
        bt_hid_send_handshake(s, ret);
380
}
381

    
382
static void bt_hid_control_sdu(void *opaque, const uint8_t *data, int len)
383
{
384
    struct bt_hid_device_s *hid = opaque;
385

    
386
    bt_hid_control_transaction(hid, data, len);
387
}
388

    
389
static void bt_hid_datain(void *opaque)
390
{
391
    struct bt_hid_device_s *hid = opaque;
392

    
393
    /* If suspended, wake-up and send a wake-up event first.  We might
394
     * want to also inspect the input report and ignore event like
395
     * mouse movements until a button event occurs.  */
396
    if (hid->state == bt_state_suspend) {
397
        hid->state = bt_state_ready;
398
    }
399

    
400
    if (bt_hid_in(hid) > 0)
401
        /* TODO: when in boot-mode precede any Input reports with the ReportID
402
         * byte, here and in GetReport/SetReport on the Control channel.  */
403
        bt_hid_send_data(hid->interrupt, BT_DATA_INPUT,
404
                        hid->datain.buffer, hid->datain.len);
405
}
406

    
407
static void bt_hid_interrupt_sdu(void *opaque, const uint8_t *data, int len)
408
{
409
    struct bt_hid_device_s *hid = opaque;
410

    
411
    if (len > BT_HID_MTU || len < 1)
412
        goto bad;
413
    if ((data[0] & 3) != BT_DATA_OUTPUT)
414
        goto bad;
415
    if ((data[0] >> 4) == BT_DATA) {
416
        if (hid->intr_state)
417
            goto bad;
418

    
419
        hid->data_type = BT_DATA_OUTPUT;
420
        hid->intrdataout.len = 0;
421
    } else if ((data[0] >> 4) == BT_DATC) {
422
        if (!hid->intr_state)
423
            goto bad;
424
    } else
425
        goto bad;
426

    
427
    memcpy(hid->intrdataout.buffer + hid->intrdataout.len, data + 1, len - 1);
428
    hid->intrdataout.len += len - 1;
429
    hid->intr_state = (len == BT_HID_MTU);
430
    if (!hid->intr_state) {
431
        memcpy(hid->dataout.buffer, hid->intrdataout.buffer,
432
                        hid->dataout.len = hid->intrdataout.len);
433
        bt_hid_out(hid);
434
    }
435

    
436
    return;
437
bad:
438
    fprintf(stderr, "%s: bad transaction on Interrupt channel.\n",
439
                    __FUNCTION__);
440
}
441

    
442
/* "Virtual cable" plug/unplug event.  */
443
static void bt_hid_connected_update(struct bt_hid_device_s *hid)
444
{
445
    int prev = hid->connected;
446

    
447
    hid->connected = hid->control && hid->interrupt;
448

    
449
    /* Stop page-/inquiry-scanning when a host is connected.  */
450
    hid->btdev.device.page_scan = !hid->connected;
451
    hid->btdev.device.inquiry_scan = !hid->connected;
452

    
453
    if (hid->connected && !prev) {
454
        hid->usbdev->handle_reset(hid->usbdev);
455
        hid->proto = BT_HID_PROTO_REPORT;
456
    }
457

    
458
    /* Should set HIDVirtualCable in SDP (possibly need to check that SDP
459
     * isn't destroyed yet, in case we're being called from handle_destroy) */
460
}
461

    
462
static void bt_hid_close_control(void *opaque)
463
{
464
    struct bt_hid_device_s *hid = opaque;
465

    
466
    hid->control = NULL;
467
    bt_hid_connected_update(hid);
468
}
469

    
470
static void bt_hid_close_interrupt(void *opaque)
471
{
472
    struct bt_hid_device_s *hid = opaque;
473

    
474
    hid->interrupt = NULL;
475
    bt_hid_connected_update(hid);
476
}
477

    
478
static int bt_hid_new_control_ch(struct bt_l2cap_device_s *dev,
479
                struct bt_l2cap_conn_params_s *params)
480
{
481
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
482

    
483
    if (hid->control)
484
        return 1;
485

    
486
    hid->control = params;
487
    hid->control->opaque = hid;
488
    hid->control->close = bt_hid_close_control;
489
    hid->control->sdu_in = bt_hid_control_sdu;
490

    
491
    bt_hid_connected_update(hid);
492

    
493
    return 0;
494
}
495

    
496
static int bt_hid_new_interrupt_ch(struct bt_l2cap_device_s *dev,
497
                struct bt_l2cap_conn_params_s *params)
498
{
499
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
500

    
501
    if (hid->interrupt)
502
        return 1;
503

    
504
    hid->interrupt = params;
505
    hid->interrupt->opaque = hid;
506
    hid->interrupt->close = bt_hid_close_interrupt;
507
    hid->interrupt->sdu_in = bt_hid_interrupt_sdu;
508

    
509
    bt_hid_connected_update(hid);
510

    
511
    return 0;
512
}
513

    
514
static void bt_hid_destroy(struct bt_device_s *dev)
515
{
516
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
517

    
518
    if (hid->connected)
519
        bt_hid_send_control(hid, BT_HC_VIRTUAL_CABLE_UNPLUG);
520
    bt_l2cap_device_done(&hid->btdev);
521

    
522
    hid->usbdev->handle_destroy(hid->usbdev);
523

    
524
    qemu_free(hid);
525
}
526

    
527
enum peripheral_minor_class {
528
    class_other                = 0 << 4,
529
    class_keyboard        = 1 << 4,
530
    class_pointing        = 2 << 4,
531
    class_combo                = 3 << 4,
532
};
533

    
534
static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
535
                USBDevice *dev, enum peripheral_minor_class minor)
536
{
537
    struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
538
    uint32_t class =
539
            /* Format type */
540
            (0 << 0) |
541
            /* Device class */
542
            (minor << 2) |
543
            (5 << 8) |  /* "Peripheral" */
544
            /* Service classes */
545
            (1 << 13) | /* Limited discoverable mode */
546
            (1 << 19);  /* Capturing device (?) */
547

    
548
    bt_l2cap_device_init(&s->btdev, net);
549
    bt_l2cap_sdp_init(&s->btdev);
550
    bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_CTRL,
551
                    BT_HID_MTU, bt_hid_new_control_ch);
552
    bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_INTR,
553
                    BT_HID_MTU, bt_hid_new_interrupt_ch);
554

    
555
    s->usbdev = dev;
556
    s->btdev.device.lmp_name = s->usbdev->devname;
557
    usb_hid_datain_cb(s->usbdev, s, bt_hid_datain);
558

    
559
    s->btdev.device.handle_destroy = bt_hid_destroy;
560

    
561
    s->btdev.device.class[0] = (class >>  0) & 0xff;
562
    s->btdev.device.class[1] = (class >>  8) & 0xff;
563
    s->btdev.device.class[2] = (class >> 16) & 0xff;
564

    
565
    return &s->btdev.device;
566
}
567

    
568
struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net)
569
{
570
    return bt_hid_init(net, usb_keyboard_init(), class_keyboard);
571
}