hw/bt-hid.c

   1 /*
   2  * QEMU Bluetooth HID Profile wrapper for USB HID.
   3  *
   4  * Copyright (C) 2007-2008 OpenMoko, Inc.
   5  * Written by Andrzej Zaborowski <andrew@openedhand.com>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License as
   9  * published by the Free Software Foundation; either version 2 or
  10  * (at your option) version 3 of the License.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, write to the Free Software Foundation, Inc.,
  19  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  */
  21
  22 #include "qemu-common.h"
  23 #include "usb.h"
  24 #include "bt.h"
  25
  26 enum hid_transaction_req {
  27     BT_HANDSHAKE                        = 0x0,
  28     BT_HID_CONTROL                      = 0x1,
  29     BT_GET_REPORT                       = 0x4,
  30     BT_SET_REPORT                       = 0x5,
  31     BT_GET_PROTOCOL                     = 0x6,
  32     BT_SET_PROTOCOL                     = 0x7,
  33     BT_GET_IDLE                         = 0x8,
  34     BT_SET_IDLE                         = 0x9,
  35     BT_DATA                             = 0xa,
  36     BT_DATC                             = 0xb,
  37 };
  38
  39 enum hid_transaction_handshake {
  40     BT_HS_SUCCESSFUL                    = 0x0,
  41     BT_HS_NOT_READY                     = 0x1,
  42     BT_HS_ERR_INVALID_REPORT_ID         = 0x2,
  43     BT_HS_ERR_UNSUPPORTED_REQUEST       = 0x3,
  44     BT_HS_ERR_INVALID_PARAMETER         = 0x4,
  45     BT_HS_ERR_UNKNOWN                   = 0xe,
  46     BT_HS_ERR_FATAL                     = 0xf,
  47 };
  48
  49 enum hid_transaction_control {
  50     BT_HC_NOP                           = 0x0,
  51     BT_HC_HARD_RESET                    = 0x1,
  52     BT_HC_SOFT_RESET                    = 0x2,
  53     BT_HC_SUSPEND                       = 0x3,
  54     BT_HC_EXIT_SUSPEND                  = 0x4,
  55     BT_HC_VIRTUAL_CABLE_UNPLUG          = 0x5,
  56 };
  57
  58 enum hid_protocol {
  59     BT_HID_PROTO_BOOT                   = 0,
  60     BT_HID_PROTO_REPORT                 = 1,
  61 };
  62
  63 enum hid_boot_reportid {
  64     BT_HID_BOOT_INVALID                 = 0,
  65     BT_HID_BOOT_KEYBOARD,
  66     BT_HID_BOOT_MOUSE,
  67 };
  68
  69 enum hid_data_pkt {
  70     BT_DATA_OTHER                       = 0,
  71     BT_DATA_INPUT,
  72     BT_DATA_OUTPUT,
  73     BT_DATA_FEATURE,
  74 };
  75
  76 #define BT_HID_MTU                      48
  77
  78 /* HID interface requests */
  79 #define GET_REPORT                      0xa101
  80 #define GET_IDLE                        0xa102
  81 #define GET_PROTOCOL                    0xa103
  82 #define SET_REPORT                      0x2109
  83 #define SET_IDLE                        0x210a
  84 #define SET_PROTOCOL                    0x210b
  85
  86 struct bt_hid_device_s {
  87     struct bt_l2cap_device_s btdev;
  88     struct bt_l2cap_conn_params_s *control;
  89     struct bt_l2cap_conn_params_s *interrupt;
  90     USBDevice *usbdev;
  91
  92     int proto;
  93     int connected;
  94     int data_type;
  95     int intr_state;
  96     struct {
  97         int len;
  98         uint8_t buffer[1024];
  99     } dataother, datain, dataout, feature, intrdataout;
 100     enum {
 101         bt_state_ready,
 102         bt_state_transaction,
 103         bt_state_suspend,
 104     } state;
 105 };
 106
 107 static void bt_hid_reset(struct bt_hid_device_s *s)
 108 {
 109     struct bt_scatternet_s *net = s->btdev.device.net;
 110
 111     /* Go as far as... */
 112     bt_l2cap_device_done(&s->btdev);
 113     bt_l2cap_device_init(&s->btdev, net);
 114
 115     s->usbdev->handle_reset(s->usbdev);
 116     s->proto = BT_HID_PROTO_REPORT;
 117     s->state = bt_state_ready;
 118     s->dataother.len = 0;
 119     s->datain.len = 0;
 120     s->dataout.len = 0;
 121     s->feature.len = 0;
 122     s->intrdataout.len = 0;
 123     s->intr_state = 0;
 124 }
 125
 126 static int bt_hid_out(struct bt_hid_device_s *s)
 127 {
 128     USBPacket p;
 129
 130     if (s->data_type == BT_DATA_OUTPUT) {
 131         p.pid = USB_TOKEN_OUT;
 132         p.devep = 1;
 133         p.data = s->dataout.buffer;
 134         p.len = s->dataout.len;
 135         s->dataout.len = s->usbdev->handle_data(s->usbdev, &p);
 136
 137         return s->dataout.len;
 138     }
 139
 140     if (s->data_type == BT_DATA_FEATURE) {
 141         /* XXX:
 142          * does this send a USB_REQ_CLEAR_FEATURE/USB_REQ_SET_FEATURE
 143          * or a SET_REPORT? */
 144         p.devep = 0;
 145     }
 146
 147     return -1;
 148 }
 149
 150 static int bt_hid_in(struct bt_hid_device_s *s)
 151 {
 152     USBPacket p;
 153
 154     p.pid = USB_TOKEN_IN;
 155     p.devep = 1;
 156     p.data = s->datain.buffer;
 157     p.len = sizeof(s->datain.buffer);
 158     s->datain.len = s->usbdev->handle_data(s->usbdev, &p);
 159
 160     return s->datain.len;
 161 }
 162
 163 static void bt_hid_send_handshake(struct bt_hid_device_s *s, int result)
 164 {
 165     *s->control->sdu_out(s->control, 1) =
 166             (BT_HANDSHAKE << 4) | result;
 167     s->control->sdu_submit(s->control);
 168 }
 169
 170 static void bt_hid_send_control(struct bt_hid_device_s *s, int operation)
 171 {
 172     *s->control->sdu_out(s->control, 1) =
 173             (BT_HID_CONTROL << 4) | operation;
 174     s->control->sdu_submit(s->control);
 175 }
 176
 177 static void bt_hid_disconnect(struct bt_hid_device_s *s)
 178 {
 179     /* Disconnect s->control and s->interrupt */
 180 }
 181
 182 static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type,
 183                 const uint8_t *data, int len)
 184 {
 185     uint8_t *pkt, hdr = (BT_DATA << 4) | type;
 186     int plen;
 187
 188     do {
 189         plen = MIN(len, ch->remote_mtu - 1);
 190         pkt = ch->sdu_out(ch, plen + 1);
 191
 192         pkt[0] = hdr;
 193         if (plen)
 194             memcpy(pkt + 1, data, plen);
 195         ch->sdu_submit(ch);
 196
 197         len -= plen;
 198         data += plen;
 199         hdr = (BT_DATC << 4) | type;
 200     } while (plen == ch->remote_mtu - 1);
 201 }
 202
 203 static void bt_hid_control_transaction(struct bt_hid_device_s *s,
 204                 const uint8_t *data, int len)
 205 {
 206     uint8_t type, parameter;
 207     int rlen, ret = -1;
 208     if (len < 1)
 209         return;
 210
 211     type = data[0] >> 4;
 212     parameter = data[0] & 0xf;
 213
 214     switch (type) {
 215     case BT_HANDSHAKE:
 216     case BT_DATA:
 217         switch (parameter) {
 218         default:
 219             /* These are not expected to be sent this direction.  */
 220             ret = BT_HS_ERR_INVALID_PARAMETER;
 221         }
 222         break;
 223
 224     case BT_HID_CONTROL:
 225         if (len != 1 || (parameter != BT_HC_VIRTUAL_CABLE_UNPLUG &&
 226                                 s->state == bt_state_transaction)) {
 227             ret = BT_HS_ERR_INVALID_PARAMETER;
 228             break;
 229         }
 230         switch (parameter) {
 231         case BT_HC_NOP:
 232             break;
 233         case BT_HC_HARD_RESET:
 234         case BT_HC_SOFT_RESET:
 235             bt_hid_reset(s);
 236             break;
 237         case BT_HC_SUSPEND:
 238             if (s->state == bt_state_ready)
 239                 s->state = bt_state_suspend;
 240             else
 241                 ret = BT_HS_ERR_INVALID_PARAMETER;
 242             break;
 243         case BT_HC_EXIT_SUSPEND:
 244             if (s->state == bt_state_suspend)
 245                 s->state = bt_state_ready;
 246             else
 247                 ret = BT_HS_ERR_INVALID_PARAMETER;
 248             break;
 249         case BT_HC_VIRTUAL_CABLE_UNPLUG:
 250             bt_hid_disconnect(s);
 251             break;
 252         default:
 253             ret = BT_HS_ERR_INVALID_PARAMETER;
 254         }
 255         break;
 256
 257     case BT_GET_REPORT:
 258         /* No ReportIDs declared.  */
 259         if (((parameter & 8) && len != 3) ||
 260                         (!(parameter & 8) && len != 1) ||
 261                         s->state != bt_state_ready) {
 262             ret = BT_HS_ERR_INVALID_PARAMETER;
 263             break;
 264         }
 265         if (parameter & 8)
 266             rlen = data[2] | (data[3] << 8);
 267         else
 268             rlen = INT_MAX;
 269         switch (parameter & 3) {
 270         case BT_DATA_OTHER:
 271             ret = BT_HS_ERR_INVALID_PARAMETER;
 272             break;
 273         case BT_DATA_INPUT:
 274             /* Here we can as well poll s->usbdev */
 275             bt_hid_send_data(s->control, BT_DATA_INPUT,
 276                             s->datain.buffer, MIN(rlen, s->datain.len));
 277             break;
 278         case BT_DATA_OUTPUT:
 279             bt_hid_send_data(s->control, BT_DATA_OUTPUT,
 280                             s->dataout.buffer, MIN(rlen, s->dataout.len));
 281             break;
 282         case BT_DATA_FEATURE:
 283             bt_hid_send_data(s->control, BT_DATA_FEATURE,
 284                             s->feature.buffer, MIN(rlen, s->feature.len));
 285             break;
 286         }
 287         break;
 288
 289     case BT_SET_REPORT:
 290         if (len < 2 || len > BT_HID_MTU || s->state != bt_state_ready ||
 291                         (parameter & 3) == BT_DATA_OTHER ||
 292                         (parameter & 3) == BT_DATA_INPUT) {
 293             ret = BT_HS_ERR_INVALID_PARAMETER;
 294             break;
 295         }
 296         s->data_type = parameter & 3;
 297         if (s->data_type == BT_DATA_OUTPUT) {
 298             s->dataout.len = len - 1;
 299             memcpy(s->dataout.buffer, data + 1, s->dataout.len);
 300         } else {
 301             s->feature.len = len - 1;
 302             memcpy(s->feature.buffer, data + 1, s->feature.len);
 303         }
 304         if (len == BT_HID_MTU)
 305             s->state = bt_state_transaction;
 306         else
 307             bt_hid_out(s);
 308         break;
 309
 310     case BT_GET_PROTOCOL:
 311         if (len != 1 || s->state == bt_state_transaction) {
 312             ret = BT_HS_ERR_INVALID_PARAMETER;
 313             break;
 314         }
 315         *s->control->sdu_out(s->control, 1) = s->proto;
 316         s->control->sdu_submit(s->control);
 317         break;
 318
 319     case BT_SET_PROTOCOL:
 320         if (len != 1 || s->state == bt_state_transaction ||
 321                         (parameter != BT_HID_PROTO_BOOT &&
 322                          parameter != BT_HID_PROTO_REPORT)) {
 323             ret = BT_HS_ERR_INVALID_PARAMETER;
 324             break;
 325         }
 326         s->proto = parameter;
 327         s->usbdev->handle_control(s->usbdev, SET_PROTOCOL, s->proto, 0, 0, 0);
 328         ret = BT_HS_SUCCESSFUL;
 329         break;
 330
 331     case BT_GET_IDLE:
 332         if (len != 1 || s->state == bt_state_transaction) {
 333             ret = BT_HS_ERR_INVALID_PARAMETER;
 334             break;
 335         }
 336         s->usbdev->handle_control(s->usbdev, GET_IDLE, 0, 0, 1,
 337                         s->control->sdu_out(s->control, 1));
 338         s->control->sdu_submit(s->control);
 339         break;
 340
 341     case BT_SET_IDLE:
 342         if (len != 2 || s->state == bt_state_transaction) {
 343             ret = BT_HS_ERR_INVALID_PARAMETER;
 344             break;
 345         }
 346
 347         /* We don't need to know about the Idle Rate here really,
 348          * so just pass it on to the device.  */
 349         ret = s->usbdev->handle_control(s->usbdev,
 350                         SET_IDLE, data[1], 0, 0, 0) ?
 351                 BT_HS_SUCCESSFUL : BT_HS_ERR_INVALID_PARAMETER;
 352         /* XXX: Does this generate a handshake? */
 353         break;
 354
 355     case BT_DATC:
 356         if (len > BT_HID_MTU || s->state != bt_state_transaction) {
 357             ret = BT_HS_ERR_INVALID_PARAMETER;
 358             break;
 359         }
 360         if (s->data_type == BT_DATA_OUTPUT) {
 361             memcpy(s->dataout.buffer + s->dataout.len, data + 1, len - 1);
 362             s->dataout.len += len - 1;
 363         } else {
 364             memcpy(s->feature.buffer + s->feature.len, data + 1, len - 1);
 365             s->feature.len += len - 1;
 366         }
 367         if (len < BT_HID_MTU) {
 368             bt_hid_out(s);
 369             s->state = bt_state_ready;
 370         }
 371         break;
 372
 373     default:
 374         ret = BT_HS_ERR_UNSUPPORTED_REQUEST;
 375     }
 376
 377     if (ret != -1)
 378         bt_hid_send_handshake(s, ret);
 379 }
 380
 381 static void bt_hid_control_sdu(void *opaque, const uint8_t *data, int len)
 382 {
 383     struct bt_hid_device_s *hid = opaque;
 384
 385     return bt_hid_control_transaction(hid, data, len);
 386 }
 387
 388 static void bt_hid_datain(void *opaque)
 389 {
 390     struct bt_hid_device_s *hid = opaque;
 391
 392     /* If suspended, wake-up and send a wake-up event first.  We might
 393      * want to also inspect the input report and ignore event like
 394      * mouse movements until a button event occurs.  */
 395     if (hid->state == bt_state_suspend) {
 396         hid->state = bt_state_ready;
 397     }
 398
 399     if (bt_hid_in(hid) > 0)
 400         /* TODO: when in boot-mode precede any Input reports with the ReportID
 401          * byte, here and in GetReport/SetReport on the Control channel.  */
 402         bt_hid_send_data(hid->interrupt, BT_DATA_INPUT,
 403                         hid->datain.buffer, hid->datain.len);
 404 }
 405
 406 static void bt_hid_interrupt_sdu(void *opaque, const uint8_t *data, int len)
 407 {
 408     struct bt_hid_device_s *hid = opaque;
 409
 410     if (len > BT_HID_MTU || len < 1)
 411         goto bad;
 412     if ((data[0] & 3) != BT_DATA_OUTPUT)
 413         goto bad;
 414     if ((data[0] >> 4) == BT_DATA) {
 415         if (hid->intr_state)
 416             goto bad;
 417
 418         hid->data_type = BT_DATA_OUTPUT;
 419         hid->intrdataout.len = 0;
 420     } else if ((data[0] >> 4) == BT_DATC) {
 421         if (!hid->intr_state)
 422             goto bad;
 423     } else
 424         goto bad;
 425
 426     memcpy(hid->intrdataout.buffer + hid->intrdataout.len, data + 1, len - 1);
 427     hid->intrdataout.len += len - 1;
 428     hid->intr_state = (len == BT_HID_MTU);
 429     if (!hid->intr_state) {
 430         memcpy(hid->dataout.buffer, hid->intrdataout.buffer,
 431                         hid->dataout.len = hid->intrdataout.len);
 432         bt_hid_out(hid);
 433     }
 434
 435     return;
 436 bad:
 437     fprintf(stderr, "%s: bad transaction on Interrupt channel.\n",
 438                     __FUNCTION__);
 439 }
 440
 441 /* "Virtual cable" plug/unplug event.  */
 442 static void bt_hid_connected_update(struct bt_hid_device_s *hid)
 443 {
 444     int prev = hid->connected;
 445
 446     hid->connected = hid->control && hid->interrupt;
 447
 448     /* Stop page-/inquiry-scanning when a host is connected.  */
 449     hid->btdev.device.page_scan = !hid->connected;
 450     hid->btdev.device.inquiry_scan = !hid->connected;
 451
 452     if (hid->connected && !prev) {
 453         hid->usbdev->handle_reset(hid->usbdev);
 454         hid->proto = BT_HID_PROTO_REPORT;
 455     }
 456
 457     /* Should set HIDVirtualCable in SDP (possibly need to check that SDP
 458      * isn't destroyed yet, in case we're being called from handle_destroy) */
 459 }
 460
 461 static void bt_hid_close_control(void *opaque)
 462 {
 463     struct bt_hid_device_s *hid = opaque;
 464
 465     hid->control = 0;
 466     bt_hid_connected_update(hid);
 467 }
 468
 469 static void bt_hid_close_interrupt(void *opaque)
 470 {
 471     struct bt_hid_device_s *hid = opaque;
 472
 473     hid->interrupt = 0;
 474     bt_hid_connected_update(hid);
 475 }
 476
 477 static int bt_hid_new_control_ch(struct bt_l2cap_device_s *dev,
 478                 struct bt_l2cap_conn_params_s *params)
 479 {
 480     struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
 481
 482     if (hid->control)
 483         return 1;
 484
 485     hid->control = params;
 486     hid->control->opaque = hid;
 487     hid->control->close = bt_hid_close_control;
 488     hid->control->sdu_in = bt_hid_control_sdu;
 489
 490     bt_hid_connected_update(hid);
 491
 492     return 0;
 493 }
 494
 495 static int bt_hid_new_interrupt_ch(struct bt_l2cap_device_s *dev,
 496                 struct bt_l2cap_conn_params_s *params)
 497 {
 498     struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
 499
 500     if (hid->interrupt)
 501         return 1;
 502
 503     hid->interrupt = params;
 504     hid->interrupt->opaque = hid;
 505     hid->interrupt->close = bt_hid_close_interrupt;
 506     hid->interrupt->sdu_in = bt_hid_interrupt_sdu;
 507
 508     bt_hid_connected_update(hid);
 509
 510     return 0;
 511 }
 512
 513 static void bt_hid_destroy(struct bt_device_s *dev)
 514 {
 515     struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
 516
 517     if (hid->connected)
 518         bt_hid_send_control(hid, BT_HC_VIRTUAL_CABLE_UNPLUG);
 519     bt_l2cap_device_done(&hid->btdev);
 520
 521     hid->usbdev->handle_destroy(hid->usbdev);
 522
 523     qemu_free(hid);
 524 }
 525
 526 enum peripheral_minor_class {
 527     class_other         = 0 << 4,
 528     class_keyboard      = 1 << 4,
 529     class_pointing      = 2 << 4,
 530     class_combo         = 3 << 4,
 531 };
 532
 533 static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
 534                 USBDevice *dev, enum peripheral_minor_class minor)
 535 {
 536     struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
 537     uint32_t class =
 538             /* Format type */
 539             (0 << 0) |
 540             /* Device class */
 541             (minor << 2) |
 542             (5 << 8) |  /* "Peripheral" */
 543             /* Service classes */
 544             (1 << 13) | /* Limited discoverable mode */
 545             (1 << 19);  /* Capturing device (?) */
 546
 547     bt_l2cap_device_init(&s->btdev, net);
 548     bt_l2cap_sdp_init(&s->btdev);
 549     bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_CTRL,
 550                     BT_HID_MTU, bt_hid_new_control_ch);
 551     bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_INTR,
 552                     BT_HID_MTU, bt_hid_new_interrupt_ch);
 553
 554     s->usbdev = dev;
 555     s->btdev.device.lmp_name = s->usbdev->devname;
 556     usb_hid_datain_cb(s->usbdev, s, bt_hid_datain);
 557
 558     s->btdev.device.handle_destroy = bt_hid_destroy;
 559
 560     s->btdev.device.class[0] = (class >>  0) & 0xff;
 561     s->btdev.device.class[1] = (class >>  8) & 0xff;
 562     s->btdev.device.class[2] = (class >> 16) & 0xff;
 563
 564     return &s->btdev.device;
 565 }
 566
 567 struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net)
 568 {
 569     return bt_hid_init(net, usb_keyboard_init(), class_keyboard);
 570 }