Statistics
| Branch: | Revision:

root / hw / bt-hid.c @ fad6cb1a

History | View | Annotate | Download (15.8 kB)

1
/*
2
 * QEMU Bluetooth HID Profile wrapper for USB HID.
3
 *
4
 * Copyright (C) 2007-2008 OpenMoko, Inc.
5
 * Written by Andrzej Zaborowski <andrew@openedhand.com>
6
 *
7
 * This program is free software; you can redistribute it and/or
8
 * modify it under the terms of the GNU General Public License as
9
 * published by the Free Software Foundation; either version 2 or
10
 * (at your option) version 3 of the License.
11
 *
12
 * This program is distributed in the hope that it will be useful,
13
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15
 * GNU General Public License for more details.
16
 *
17
 * You should have received a copy of the GNU General Public License along
18
 * with this program; if not, write to the Free Software Foundation, Inc.,
19
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
20
 */
21

    
22
#include "qemu-common.h"
23
#include "usb.h"
24
#include "bt.h"
25

    
26
enum hid_transaction_req {
27
    BT_HANDSHAKE                        = 0x0,
28
    BT_HID_CONTROL                        = 0x1,
29
    BT_GET_REPORT                        = 0x4,
30
    BT_SET_REPORT                        = 0x5,
31
    BT_GET_PROTOCOL                        = 0x6,
32
    BT_SET_PROTOCOL                        = 0x7,
33
    BT_GET_IDLE                                = 0x8,
34
    BT_SET_IDLE                                = 0x9,
35
    BT_DATA                                = 0xa,
36
    BT_DATC                                = 0xb,
37
};
38

    
39
enum hid_transaction_handshake {
40
    BT_HS_SUCCESSFUL                        = 0x0,
41
    BT_HS_NOT_READY                        = 0x1,
42
    BT_HS_ERR_INVALID_REPORT_ID                = 0x2,
43
    BT_HS_ERR_UNSUPPORTED_REQUEST        = 0x3,
44
    BT_HS_ERR_INVALID_PARAMETER                = 0x4,
45
    BT_HS_ERR_UNKNOWN                        = 0xe,
46
    BT_HS_ERR_FATAL                        = 0xf,
47
};
48

    
49
enum hid_transaction_control {
50
    BT_HC_NOP                                = 0x0,
51
    BT_HC_HARD_RESET                        = 0x1,
52
    BT_HC_SOFT_RESET                        = 0x2,
53
    BT_HC_SUSPEND                        = 0x3,
54
    BT_HC_EXIT_SUSPEND                        = 0x4,
55
    BT_HC_VIRTUAL_CABLE_UNPLUG                = 0x5,
56
};
57

    
58
enum hid_protocol {
59
    BT_HID_PROTO_BOOT                        = 0,
60
    BT_HID_PROTO_REPORT                        = 1,
61
};
62

    
63
enum hid_boot_reportid {
64
    BT_HID_BOOT_INVALID                        = 0,
65
    BT_HID_BOOT_KEYBOARD,
66
    BT_HID_BOOT_MOUSE,
67
};
68

    
69
enum hid_data_pkt {
70
    BT_DATA_OTHER                        = 0,
71
    BT_DATA_INPUT,
72
    BT_DATA_OUTPUT,
73
    BT_DATA_FEATURE,
74
};
75

    
76
#define BT_HID_MTU                        48
77

    
78
/* HID interface requests */
79
#define GET_REPORT                        0xa101
80
#define GET_IDLE                        0xa102
81
#define GET_PROTOCOL                        0xa103
82
#define SET_REPORT                        0x2109
83
#define SET_IDLE                        0x210a
84
#define SET_PROTOCOL                        0x210b
85

    
86
struct bt_hid_device_s {
87
    struct bt_l2cap_device_s btdev;
88
    struct bt_l2cap_conn_params_s *control;
89
    struct bt_l2cap_conn_params_s *interrupt;
90
    USBDevice *usbdev;
91

    
92
    int proto;
93
    int connected;
94
    int data_type;
95
    int intr_state;
96
    struct {
97
        int len;
98
        uint8_t buffer[1024];
99
    } dataother, datain, dataout, feature, intrdataout;
100
    enum {
101
        bt_state_ready,
102
        bt_state_transaction,
103
        bt_state_suspend,
104
    } state;
105
};
106

    
107
static void bt_hid_reset(struct bt_hid_device_s *s)
108
{
109
    struct bt_scatternet_s *net = s->btdev.device.net;
110

    
111
    /* Go as far as... */
112
    bt_l2cap_device_done(&s->btdev);
113
    bt_l2cap_device_init(&s->btdev, net);
114

    
115
    s->usbdev->handle_reset(s->usbdev);
116
    s->proto = BT_HID_PROTO_REPORT;
117
    s->state = bt_state_ready;
118
    s->dataother.len = 0;
119
    s->datain.len = 0;
120
    s->dataout.len = 0;
121
    s->feature.len = 0;
122
    s->intrdataout.len = 0;
123
    s->intr_state = 0;
124
}
125

    
126
static int bt_hid_out(struct bt_hid_device_s *s)
127
{
128
    USBPacket p;
129

    
130
    if (s->data_type == BT_DATA_OUTPUT) {
131
        p.pid = USB_TOKEN_OUT;
132
        p.devep = 1;
133
        p.data = s->dataout.buffer;
134
        p.len = s->dataout.len;
135
        s->dataout.len = s->usbdev->handle_data(s->usbdev, &p);
136

    
137
        return s->dataout.len;
138
    }
139

    
140
    if (s->data_type == BT_DATA_FEATURE) {
141
        /* XXX:
142
         * does this send a USB_REQ_CLEAR_FEATURE/USB_REQ_SET_FEATURE
143
         * or a SET_REPORT? */
144
        p.devep = 0;
145
    }
146

    
147
    return -1;
148
}
149

    
150
static int bt_hid_in(struct bt_hid_device_s *s)
151
{
152
    USBPacket p;
153

    
154
    p.pid = USB_TOKEN_IN;
155
    p.devep = 1;
156
    p.data = s->datain.buffer;
157
    p.len = sizeof(s->datain.buffer);
158
    s->datain.len = s->usbdev->handle_data(s->usbdev, &p);
159

    
160
    return s->datain.len;
161
}
162

    
163
static void bt_hid_send_handshake(struct bt_hid_device_s *s, int result)
164
{
165
    *s->control->sdu_out(s->control, 1) =
166
            (BT_HANDSHAKE << 4) | result;
167
    s->control->sdu_submit(s->control);
168
}
169

    
170
static void bt_hid_send_control(struct bt_hid_device_s *s, int operation)
171
{
172
    *s->control->sdu_out(s->control, 1) =
173
            (BT_HID_CONTROL << 4) | operation;
174
    s->control->sdu_submit(s->control);
175
}
176

    
177
static void bt_hid_disconnect(struct bt_hid_device_s *s)
178
{
179
    /* Disconnect s->control and s->interrupt */
180
}
181

    
182
static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type,
183
                const uint8_t *data, int len)
184
{
185
    uint8_t *pkt, hdr = (BT_DATA << 4) | type;
186
    int plen;
187

    
188
    do {
189
        plen = MIN(len, ch->remote_mtu - 1);
190
        pkt = ch->sdu_out(ch, plen + 1);
191

    
192
        pkt[0] = hdr;
193
        if (plen)
194
            memcpy(pkt + 1, data, plen);
195
        ch->sdu_submit(ch);
196

    
197
        len -= plen;
198
        data += plen;
199
        hdr = (BT_DATC << 4) | type;
200
    } while (plen == ch->remote_mtu - 1);
201
}
202

    
203
static void bt_hid_control_transaction(struct bt_hid_device_s *s,
204
                const uint8_t *data, int len)
205
{
206
    uint8_t type, parameter;
207
    int rlen, ret = -1;
208
    if (len < 1)
209
        return;
210

    
211
    type = data[0] >> 4;
212
    parameter = data[0] & 0xf;
213

    
214
    switch (type) {
215
    case BT_HANDSHAKE:
216
    case BT_DATA:
217
        switch (parameter) {
218
        default:
219
            /* These are not expected to be sent this direction.  */
220
            ret = BT_HS_ERR_INVALID_PARAMETER;
221
        }
222
        break;
223

    
224
    case BT_HID_CONTROL:
225
        if (len != 1 || (parameter != BT_HC_VIRTUAL_CABLE_UNPLUG &&
226
                                s->state == bt_state_transaction)) {
227
            ret = BT_HS_ERR_INVALID_PARAMETER;
228
            break;
229
        }
230
        switch (parameter) {
231
        case BT_HC_NOP:
232
            break;
233
        case BT_HC_HARD_RESET:
234
        case BT_HC_SOFT_RESET:
235
            bt_hid_reset(s);
236
            break;
237
        case BT_HC_SUSPEND:
238
            if (s->state == bt_state_ready)
239
                s->state = bt_state_suspend;
240
            else
241
                ret = BT_HS_ERR_INVALID_PARAMETER;
242
            break;
243
        case BT_HC_EXIT_SUSPEND:
244
            if (s->state == bt_state_suspend)
245
                s->state = bt_state_ready;
246
            else
247
                ret = BT_HS_ERR_INVALID_PARAMETER;
248
            break;
249
        case BT_HC_VIRTUAL_CABLE_UNPLUG:
250
            bt_hid_disconnect(s);
251
            break;
252
        default:
253
            ret = BT_HS_ERR_INVALID_PARAMETER;
254
        }
255
        break;
256

    
257
    case BT_GET_REPORT:
258
        /* No ReportIDs declared.  */
259
        if (((parameter & 8) && len != 3) ||
260
                        (!(parameter & 8) && len != 1) ||
261
                        s->state != bt_state_ready) {
262
            ret = BT_HS_ERR_INVALID_PARAMETER;
263
            break;
264
        }
265
        if (parameter & 8)
266
            rlen = data[2] | (data[3] << 8);
267
        else
268
            rlen = INT_MAX;
269
        switch (parameter & 3) {
270
        case BT_DATA_OTHER:
271
            ret = BT_HS_ERR_INVALID_PARAMETER;
272
            break;
273
        case BT_DATA_INPUT:
274
            /* Here we can as well poll s->usbdev */
275
            bt_hid_send_data(s->control, BT_DATA_INPUT,
276
                            s->datain.buffer, MIN(rlen, s->datain.len));
277
            break;
278
        case BT_DATA_OUTPUT:
279
            bt_hid_send_data(s->control, BT_DATA_OUTPUT,
280
                            s->dataout.buffer, MIN(rlen, s->dataout.len));
281
            break;
282
        case BT_DATA_FEATURE:
283
            bt_hid_send_data(s->control, BT_DATA_FEATURE,
284
                            s->feature.buffer, MIN(rlen, s->feature.len));
285
            break;
286
        }
287
        break;
288

    
289
    case BT_SET_REPORT:
290
        if (len < 2 || len > BT_HID_MTU || s->state != bt_state_ready ||
291
                        (parameter & 3) == BT_DATA_OTHER ||
292
                        (parameter & 3) == BT_DATA_INPUT) {
293
            ret = BT_HS_ERR_INVALID_PARAMETER;
294
            break;
295
        }
296
        s->data_type = parameter & 3;
297
        if (s->data_type == BT_DATA_OUTPUT) {
298
            s->dataout.len = len - 1;
299
            memcpy(s->dataout.buffer, data + 1, s->dataout.len);
300
        } else {
301
            s->feature.len = len - 1;
302
            memcpy(s->feature.buffer, data + 1, s->feature.len);
303
        }
304
        if (len == BT_HID_MTU)
305
            s->state = bt_state_transaction;
306
        else
307
            bt_hid_out(s);
308
        break;
309

    
310
    case BT_GET_PROTOCOL:
311
        if (len != 1 || s->state == bt_state_transaction) {
312
            ret = BT_HS_ERR_INVALID_PARAMETER;
313
            break;
314
        }
315
        *s->control->sdu_out(s->control, 1) = s->proto;
316
        s->control->sdu_submit(s->control);
317
        break;
318

    
319
    case BT_SET_PROTOCOL:
320
        if (len != 1 || s->state == bt_state_transaction ||
321
                        (parameter != BT_HID_PROTO_BOOT &&
322
                         parameter != BT_HID_PROTO_REPORT)) {
323
            ret = BT_HS_ERR_INVALID_PARAMETER;
324
            break;
325
        }
326
        s->proto = parameter;
327
        s->usbdev->handle_control(s->usbdev, SET_PROTOCOL, s->proto, 0, 0, 0);
328
        ret = BT_HS_SUCCESSFUL;
329
        break;
330

    
331
    case BT_GET_IDLE:
332
        if (len != 1 || s->state == bt_state_transaction) {
333
            ret = BT_HS_ERR_INVALID_PARAMETER;
334
            break;
335
        }
336
        s->usbdev->handle_control(s->usbdev, GET_IDLE, 0, 0, 1,
337
                        s->control->sdu_out(s->control, 1));
338
        s->control->sdu_submit(s->control);
339
        break;
340

    
341
    case BT_SET_IDLE:
342
        if (len != 2 || s->state == bt_state_transaction) {
343
            ret = BT_HS_ERR_INVALID_PARAMETER;
344
            break;
345
        }
346

    
347
        /* We don't need to know about the Idle Rate here really,
348
         * so just pass it on to the device.  */
349
        ret = s->usbdev->handle_control(s->usbdev,
350
                        SET_IDLE, data[1], 0, 0, 0) ?
351
                BT_HS_SUCCESSFUL : BT_HS_ERR_INVALID_PARAMETER;
352
        /* XXX: Does this generate a handshake? */
353
        break;
354

    
355
    case BT_DATC:
356
        if (len > BT_HID_MTU || s->state != bt_state_transaction) {
357
            ret = BT_HS_ERR_INVALID_PARAMETER;
358
            break;
359
        }
360
        if (s->data_type == BT_DATA_OUTPUT) {
361
            memcpy(s->dataout.buffer + s->dataout.len, data + 1, len - 1);
362
            s->dataout.len += len - 1;
363
        } else {
364
            memcpy(s->feature.buffer + s->feature.len, data + 1, len - 1);
365
            s->feature.len += len - 1;
366
        }
367
        if (len < BT_HID_MTU) {
368
            bt_hid_out(s);
369
            s->state = bt_state_ready;
370
        }
371
        break;
372

    
373
    default:
374
        ret = BT_HS_ERR_UNSUPPORTED_REQUEST;
375
    }
376

    
377
    if (ret != -1)
378
        bt_hid_send_handshake(s, ret);
379
}
380

    
381
static void bt_hid_control_sdu(void *opaque, const uint8_t *data, int len)
382
{
383
    struct bt_hid_device_s *hid = opaque;
384

    
385
    return bt_hid_control_transaction(hid, data, len);
386
}
387

    
388
static void bt_hid_datain(void *opaque)
389
{
390
    struct bt_hid_device_s *hid = opaque;
391

    
392
    /* If suspended, wake-up and send a wake-up event first.  We might
393
     * want to also inspect the input report and ignore event like
394
     * mouse movements until a button event occurs.  */
395
    if (hid->state == bt_state_suspend) {
396
        hid->state = bt_state_ready;
397
    }
398

    
399
    if (bt_hid_in(hid) > 0)
400
        /* TODO: when in boot-mode precede any Input reports with the ReportID
401
         * byte, here and in GetReport/SetReport on the Control channel.  */
402
        bt_hid_send_data(hid->interrupt, BT_DATA_INPUT,
403
                        hid->datain.buffer, hid->datain.len);
404
}
405

    
406
static void bt_hid_interrupt_sdu(void *opaque, const uint8_t *data, int len)
407
{
408
    struct bt_hid_device_s *hid = opaque;
409

    
410
    if (len > BT_HID_MTU || len < 1)
411
        goto bad;
412
    if ((data[0] & 3) != BT_DATA_OUTPUT)
413
        goto bad;
414
    if ((data[0] >> 4) == BT_DATA) {
415
        if (hid->intr_state)
416
            goto bad;
417

    
418
        hid->data_type = BT_DATA_OUTPUT;
419
        hid->intrdataout.len = 0;
420
    } else if ((data[0] >> 4) == BT_DATC) {
421
        if (!hid->intr_state)
422
            goto bad;
423
    } else
424
        goto bad;
425

    
426
    memcpy(hid->intrdataout.buffer + hid->intrdataout.len, data + 1, len - 1);
427
    hid->intrdataout.len += len - 1;
428
    hid->intr_state = (len == BT_HID_MTU);
429
    if (!hid->intr_state) {
430
        memcpy(hid->dataout.buffer, hid->intrdataout.buffer,
431
                        hid->dataout.len = hid->intrdataout.len);
432
        bt_hid_out(hid);
433
    }
434

    
435
    return;
436
bad:
437
    fprintf(stderr, "%s: bad transaction on Interrupt channel.\n",
438
                    __FUNCTION__);
439
}
440

    
441
/* "Virtual cable" plug/unplug event.  */
442
static void bt_hid_connected_update(struct bt_hid_device_s *hid)
443
{
444
    int prev = hid->connected;
445

    
446
    hid->connected = hid->control && hid->interrupt;
447

    
448
    /* Stop page-/inquiry-scanning when a host is connected.  */
449
    hid->btdev.device.page_scan = !hid->connected;
450
    hid->btdev.device.inquiry_scan = !hid->connected;
451

    
452
    if (hid->connected && !prev) {
453
        hid->usbdev->handle_reset(hid->usbdev);
454
        hid->proto = BT_HID_PROTO_REPORT;
455
    }
456

    
457
    /* Should set HIDVirtualCable in SDP (possibly need to check that SDP
458
     * isn't destroyed yet, in case we're being called from handle_destroy) */
459
}
460

    
461
static void bt_hid_close_control(void *opaque)
462
{
463
    struct bt_hid_device_s *hid = opaque;
464

    
465
    hid->control = 0;
466
    bt_hid_connected_update(hid);
467
}
468

    
469
static void bt_hid_close_interrupt(void *opaque)
470
{
471
    struct bt_hid_device_s *hid = opaque;
472

    
473
    hid->interrupt = 0;
474
    bt_hid_connected_update(hid);
475
}
476

    
477
static int bt_hid_new_control_ch(struct bt_l2cap_device_s *dev,
478
                struct bt_l2cap_conn_params_s *params)
479
{
480
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
481

    
482
    if (hid->control)
483
        return 1;
484

    
485
    hid->control = params;
486
    hid->control->opaque = hid;
487
    hid->control->close = bt_hid_close_control;
488
    hid->control->sdu_in = bt_hid_control_sdu;
489

    
490
    bt_hid_connected_update(hid);
491

    
492
    return 0;
493
}
494

    
495
static int bt_hid_new_interrupt_ch(struct bt_l2cap_device_s *dev,
496
                struct bt_l2cap_conn_params_s *params)
497
{
498
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
499

    
500
    if (hid->interrupt)
501
        return 1;
502

    
503
    hid->interrupt = params;
504
    hid->interrupt->opaque = hid;
505
    hid->interrupt->close = bt_hid_close_interrupt;
506
    hid->interrupt->sdu_in = bt_hid_interrupt_sdu;
507

    
508
    bt_hid_connected_update(hid);
509

    
510
    return 0;
511
}
512

    
513
static void bt_hid_destroy(struct bt_device_s *dev)
514
{
515
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
516

    
517
    if (hid->connected)
518
        bt_hid_send_control(hid, BT_HC_VIRTUAL_CABLE_UNPLUG);
519
    bt_l2cap_device_done(&hid->btdev);
520

    
521
    hid->usbdev->handle_destroy(hid->usbdev);
522

    
523
    qemu_free(hid);
524
}
525

    
526
enum peripheral_minor_class {
527
    class_other                = 0 << 4,
528
    class_keyboard        = 1 << 4,
529
    class_pointing        = 2 << 4,
530
    class_combo                = 3 << 4,
531
};
532

    
533
static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
534
                USBDevice *dev, enum peripheral_minor_class minor)
535
{
536
    struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
537
    uint32_t class =
538
            /* Format type */
539
            (0 << 0) |
540
            /* Device class */
541
            (minor << 2) |
542
            (5 << 8) |  /* "Peripheral" */
543
            /* Service classes */
544
            (1 << 13) | /* Limited discoverable mode */
545
            (1 << 19);  /* Capturing device (?) */
546

    
547
    bt_l2cap_device_init(&s->btdev, net);
548
    bt_l2cap_sdp_init(&s->btdev);
549
    bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_CTRL,
550
                    BT_HID_MTU, bt_hid_new_control_ch);
551
    bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_INTR,
552
                    BT_HID_MTU, bt_hid_new_interrupt_ch);
553

    
554
    s->usbdev = dev;
555
    s->btdev.device.lmp_name = s->usbdev->devname;
556
    usb_hid_datain_cb(s->usbdev, s, bt_hid_datain);
557

    
558
    s->btdev.device.handle_destroy = bt_hid_destroy;
559

    
560
    s->btdev.device.class[0] = (class >>  0) & 0xff;
561
    s->btdev.device.class[1] = (class >>  8) & 0xff;
562
    s->btdev.device.class[2] = (class >> 16) & 0xff;
563

    
564
    return &s->btdev.device;
565
}
566

    
567
struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net)
568
{
569
    return bt_hid_init(net, usb_keyboard_init(), class_keyboard);
570
}