hw/usb-hid.c

   1 /*
   2  * QEMU USB HID devices
   3  *
   4  * Copyright (c) 2005 Fabrice Bellard
   5  * Copyright (c) 2007 OpenMoko, Inc.  (andrew@openedhand.com)
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  23  * THE SOFTWARE.
  24  */
  25 #include "hw.h"
  26 #include "console.h"
  27 #include "usb.h"
  28
  29 /* HID interface requests */
  30 #define GET_REPORT   0xa101
  31 #define GET_IDLE     0xa102
  32 #define GET_PROTOCOL 0xa103
  33 #define SET_REPORT   0x2109
  34 #define SET_IDLE     0x210a
  35 #define SET_PROTOCOL 0x210b
  36
  37 /* HID descriptor types */
  38 #define USB_DT_HID    0x21
  39 #define USB_DT_REPORT 0x22
  40 #define USB_DT_PHY    0x23
  41
  42 #define USB_MOUSE     1
  43 #define USB_TABLET    2
  44 #define USB_KEYBOARD  3
  45
  46 typedef struct USBMouseState {
  47     int dx, dy, dz, buttons_state;
  48     int x, y;
  49     int mouse_grabbed;
  50     QEMUPutMouseEntry *eh_entry;
  51 } USBMouseState;
  52
  53 typedef struct USBKeyboardState {
  54     uint16_t modifiers;
  55     uint8_t leds;
  56     uint8_t key[16];
  57     int keys;
  58 } USBKeyboardState;
  59
  60 typedef struct USBHIDState {
  61     USBDevice dev;
  62     union {
  63         USBMouseState ptr;
  64         USBKeyboardState kbd;
  65     };
  66     int kind;
  67     int protocol;
  68     int idle;
  69     int changed;
  70 } USBHIDState;
  71
  72 /* mostly the same values as the Bochs USB Mouse device */
  73 static const uint8_t qemu_mouse_dev_descriptor[] = {
  74         0x12,       /*  u8 bLength; */
  75         0x01,       /*  u8 bDescriptorType; Device */
  76         0x00, 0x01, /*  u16 bcdUSB; v1.0 */
  77
  78         0x00,       /*  u8  bDeviceClass; */
  79         0x00,       /*  u8  bDeviceSubClass; */
  80         0x00,       /*  u8  bDeviceProtocol; [ low/full speeds only ] */
  81         0x08,       /*  u8  bMaxPacketSize0; 8 Bytes */
  82
  83         0x27, 0x06, /*  u16 idVendor; */
  84         0x01, 0x00, /*  u16 idProduct; */
  85         0x00, 0x00, /*  u16 bcdDevice */
  86
  87         0x03,       /*  u8  iManufacturer; */
  88         0x02,       /*  u8  iProduct; */
  89         0x01,       /*  u8  iSerialNumber; */
  90         0x01        /*  u8  bNumConfigurations; */
  91 };
  92
  93 static const uint8_t qemu_mouse_config_descriptor[] = {
  94         /* one configuration */
  95         0x09,       /*  u8  bLength; */
  96         0x02,       /*  u8  bDescriptorType; Configuration */
  97         0x22, 0x00, /*  u16 wTotalLength; */
  98         0x01,       /*  u8  bNumInterfaces; (1) */
  99         0x01,       /*  u8  bConfigurationValue; */
 100         0x04,       /*  u8  iConfiguration; */
 101         0xa0,       /*  u8  bmAttributes;
 102                                  Bit 7: must be set,
 103                                      6: Self-powered,
 104                                      5: Remote wakeup,
 105                                      4..0: resvd */
 106         50,         /*  u8  MaxPower; */
 107
 108         /* USB 1.1:
 109          * USB 2.0, single TT organization (mandatory):
 110          *      one interface, protocol 0
 111          *
 112          * USB 2.0, multiple TT organization (optional):
 113          *      two interfaces, protocols 1 (like single TT)
 114          *      and 2 (multiple TT mode) ... config is
 115          *      sometimes settable
 116          *      NOT IMPLEMENTED
 117          */
 118
 119         /* one interface */
 120         0x09,       /*  u8  if_bLength; */
 121         0x04,       /*  u8  if_bDescriptorType; Interface */
 122         0x00,       /*  u8  if_bInterfaceNumber; */
 123         0x00,       /*  u8  if_bAlternateSetting; */
 124         0x01,       /*  u8  if_bNumEndpoints; */
 125         0x03,       /*  u8  if_bInterfaceClass; */
 126         0x01,       /*  u8  if_bInterfaceSubClass; */
 127         0x02,       /*  u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
 128         0x07,       /*  u8  if_iInterface; */
 129
 130         /* HID descriptor */
 131         0x09,        /*  u8  bLength; */
 132         0x21,        /*  u8 bDescriptorType; */
 133         0x01, 0x00,  /*  u16 HID_class */
 134         0x00,        /*  u8 country_code */
 135         0x01,        /*  u8 num_descriptors */
 136         0x22,        /*  u8 type; Report */
 137         50, 0,       /*  u16 len */
 138
 139         /* one endpoint (status change endpoint) */
 140         0x07,       /*  u8  ep_bLength; */
 141         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 142         0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
 143         0x03,       /*  u8  ep_bmAttributes; Interrupt */
 144         0x03, 0x00, /*  u16 ep_wMaxPacketSize; */
 145         0x0a,       /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 146 };
 147
 148 static const uint8_t qemu_tablet_config_descriptor[] = {
 149         /* one configuration */
 150         0x09,       /*  u8  bLength; */
 151         0x02,       /*  u8  bDescriptorType; Configuration */
 152         0x22, 0x00, /*  u16 wTotalLength; */
 153         0x01,       /*  u8  bNumInterfaces; (1) */
 154         0x01,       /*  u8  bConfigurationValue; */
 155         0x05,       /*  u8  iConfiguration; */
 156         0xa0,       /*  u8  bmAttributes;
 157                                  Bit 7: must be set,
 158                                      6: Self-powered,
 159                                      5: Remote wakeup,
 160                                      4..0: resvd */
 161         50,         /*  u8  MaxPower; */
 162
 163         /* USB 1.1:
 164          * USB 2.0, single TT organization (mandatory):
 165          *      one interface, protocol 0
 166          *
 167          * USB 2.0, multiple TT organization (optional):
 168          *      two interfaces, protocols 1 (like single TT)
 169          *      and 2 (multiple TT mode) ... config is
 170          *      sometimes settable
 171          *      NOT IMPLEMENTED
 172          */
 173
 174         /* one interface */
 175         0x09,       /*  u8  if_bLength; */
 176         0x04,       /*  u8  if_bDescriptorType; Interface */
 177         0x00,       /*  u8  if_bInterfaceNumber; */
 178         0x00,       /*  u8  if_bAlternateSetting; */
 179         0x01,       /*  u8  if_bNumEndpoints; */
 180         0x03,       /*  u8  if_bInterfaceClass; */
 181         0x01,       /*  u8  if_bInterfaceSubClass; */
 182         0x02,       /*  u8  if_bInterfaceProtocol; [usb1.1 or single tt] */
 183         0x07,       /*  u8  if_iInterface; */
 184
 185         /* HID descriptor */
 186         0x09,        /*  u8  bLength; */
 187         0x21,        /*  u8 bDescriptorType; */
 188         0x01, 0x00,  /*  u16 HID_class */
 189         0x00,        /*  u8 country_code */
 190         0x01,        /*  u8 num_descriptors */
 191         0x22,        /*  u8 type; Report */
 192         74, 0,       /*  u16 len */
 193
 194         /* one endpoint (status change endpoint) */
 195         0x07,       /*  u8  ep_bLength; */
 196         0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 197         0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
 198         0x03,       /*  u8  ep_bmAttributes; Interrupt */
 199         0x08, 0x00, /*  u16 ep_wMaxPacketSize; */
 200         0x0a,       /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 201 };
 202
 203 static const uint8_t qemu_keyboard_config_descriptor[] = {
 204     /* one configuration */
 205     0x09,               /*  u8  bLength; */
 206     USB_DT_CONFIG,      /*  u8  bDescriptorType; Configuration */
 207     0x22, 0x00,         /*  u16 wTotalLength; */
 208     0x01,               /*  u8  bNumInterfaces; (1) */
 209     0x01,               /*  u8  bConfigurationValue; */
 210     0x06,               /*  u8  iConfiguration; */
 211     0xa0,               /*  u8  bmAttributes;
 212                                 Bit 7: must be set,
 213                                     6: Self-powered,
 214                                     5: Remote wakeup,
 215                                     4..0: resvd */
 216     0x32,               /*  u8  MaxPower; */
 217
 218     /* USB 1.1:
 219      * USB 2.0, single TT organization (mandatory):
 220      *  one interface, protocol 0
 221      *
 222      * USB 2.0, multiple TT organization (optional):
 223      *  two interfaces, protocols 1 (like single TT)
 224      *  and 2 (multiple TT mode) ... config is
 225      *  sometimes settable
 226      *  NOT IMPLEMENTED
 227      */
 228
 229     /* one interface */
 230     0x09,               /*  u8  if_bLength; */
 231     USB_DT_INTERFACE,   /*  u8  if_bDescriptorType; Interface */
 232     0x00,               /*  u8  if_bInterfaceNumber; */
 233     0x00,               /*  u8  if_bAlternateSetting; */
 234     0x01,               /*  u8  if_bNumEndpoints; */
 235     0x03,               /*  u8  if_bInterfaceClass; HID */
 236     0x01,               /*  u8  if_bInterfaceSubClass; Boot */
 237     0x01,               /*  u8  if_bInterfaceProtocol; Keyboard */
 238     0x07,               /*  u8  if_iInterface; */
 239
 240     /* HID descriptor */
 241     0x09,               /*  u8  bLength; */
 242     USB_DT_HID,         /*  u8  bDescriptorType; */
 243     0x11, 0x01,         /*  u16 HID_class */
 244     0x00,               /*  u8  country_code */
 245     0x01,               /*  u8  num_descriptors */
 246     USB_DT_REPORT,      /*  u8  type; Report */
 247     0x3f, 0x00,         /*  u16 len */
 248
 249     /* one endpoint (status change endpoint) */
 250     0x07,               /*  u8  ep_bLength; */
 251     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; Endpoint */
 252     USB_DIR_IN | 0x01,  /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
 253     0x03,               /*  u8  ep_bmAttributes; Interrupt */
 254     0x08, 0x00,         /*  u16 ep_wMaxPacketSize; */
 255     0x0a,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 256 };
 257
 258 static const uint8_t qemu_mouse_hid_report_descriptor[] = {
 259     0x05, 0x01, 0x09, 0x02, 0xA1, 0x01, 0x09, 0x01,
 260     0xA1, 0x00, 0x05, 0x09, 0x19, 0x01, 0x29, 0x03,
 261     0x15, 0x00, 0x25, 0x01, 0x95, 0x03, 0x75, 0x01,
 262     0x81, 0x02, 0x95, 0x01, 0x75, 0x05, 0x81, 0x01,
 263     0x05, 0x01, 0x09, 0x30, 0x09, 0x31, 0x15, 0x81,
 264     0x25, 0x7F, 0x75, 0x08, 0x95, 0x02, 0x81, 0x06,
 265     0xC0, 0xC0,
 266 };
 267
 268 static const uint8_t qemu_tablet_hid_report_descriptor[] = {
 269         0x05, 0x01, /* Usage Page Generic Desktop */
 270         0x09, 0x01, /* Usage Mouse */
 271         0xA1, 0x01, /* Collection Application */
 272         0x09, 0x01, /* Usage Pointer */
 273         0xA1, 0x00, /* Collection Physical */
 274         0x05, 0x09, /* Usage Page Button */
 275         0x19, 0x01, /* Usage Minimum Button 1 */
 276         0x29, 0x03, /* Usage Maximum Button 3 */
 277         0x15, 0x00, /* Logical Minimum 0 */
 278         0x25, 0x01, /* Logical Maximum 1 */
 279         0x95, 0x03, /* Report Count 3 */
 280         0x75, 0x01, /* Report Size 1 */
 281         0x81, 0x02, /* Input (Data, Var, Abs) */
 282         0x95, 0x01, /* Report Count 1 */
 283         0x75, 0x05, /* Report Size 5 */
 284         0x81, 0x01, /* Input (Cnst, Var, Abs) */
 285         0x05, 0x01, /* Usage Page Generic Desktop */
 286         0x09, 0x30, /* Usage X */
 287         0x09, 0x31, /* Usage Y */
 288         0x15, 0x00, /* Logical Minimum 0 */
 289         0x26, 0xFF, 0x7F, /* Logical Maximum 0x7fff */
 290         0x35, 0x00, /* Physical Minimum 0 */
 291         0x46, 0xFE, 0x7F, /* Physical Maximum 0x7fff */
 292         0x75, 0x10, /* Report Size 16 */
 293         0x95, 0x02, /* Report Count 2 */
 294         0x81, 0x02, /* Input (Data, Var, Abs) */
 295         0x05, 0x01, /* Usage Page Generic Desktop */
 296         0x09, 0x38, /* Usage Wheel */
 297         0x15, 0x81, /* Logical Minimum -127 */
 298         0x25, 0x7F, /* Logical Maximum 127 */
 299         0x35, 0x00, /* Physical Minimum 0 (same as logical) */
 300         0x45, 0x00, /* Physical Maximum 0 (same as logical) */
 301         0x75, 0x08, /* Report Size 8 */
 302         0x95, 0x01, /* Report Count 1 */
 303         0x81, 0x02, /* Input (Data, Var, Rel) */
 304         0xC0,       /* End Collection */
 305         0xC0,       /* End Collection */
 306 };
 307
 308 static const uint8_t qemu_keyboard_hid_report_descriptor[] = {
 309     0x05, 0x01,         /* Usage Page (Generic Desktop) */
 310     0x09, 0x06,         /* Usage (Keyboard) */
 311     0xa1, 0x01,         /* Collection (Application) */
 312     0x75, 0x01,         /*   Report Size (1) */
 313     0x95, 0x08,         /*   Report Count (8) */
 314     0x05, 0x07,         /*   Usage Page (Key Codes) */
 315     0x19, 0xe0,         /*   Usage Minimum (224) */
 316     0x29, 0xe7,         /*   Usage Maximum (231) */
 317     0x15, 0x00,         /*   Logical Minimum (0) */
 318     0x25, 0x01,         /*   Logical Maximum (1) */
 319     0x81, 0x02,         /*   Input (Data, Variable, Absolute) */
 320     0x95, 0x01,         /*   Report Count (1) */
 321     0x75, 0x08,         /*   Report Size (8) */
 322     0x81, 0x01,         /*   Input (Constant) */
 323     0x95, 0x05,         /*   Report Count (5) */
 324     0x75, 0x01,         /*   Report Size (1) */
 325     0x05, 0x08,         /*   Usage Page (LEDs) */
 326     0x19, 0x01,         /*   Usage Minimum (1) */
 327     0x29, 0x05,         /*   Usage Maximum (5) */
 328     0x91, 0x02,         /*   Output (Data, Variable, Absolute) */
 329     0x95, 0x01,         /*   Report Count (1) */
 330     0x75, 0x03,         /*   Report Size (3) */
 331     0x91, 0x01,         /*   Output (Constant) */
 332     0x95, 0x06,         /*   Report Count (6) */
 333     0x75, 0x08,         /*   Report Size (8) */
 334     0x15, 0x00,         /*   Logical Minimum (0) */
 335     0x25, 0xff,         /*   Logical Maximum (255) */
 336     0x05, 0x07,         /*   Usage Page (Key Codes) */
 337     0x19, 0x00,         /*   Usage Minimum (0) */
 338     0x29, 0xff,         /*   Usage Maximum (255) */
 339     0x81, 0x00,         /*   Input (Data, Array) */
 340     0xc0,               /* End Collection */
 341 };
 342
 343 #define USB_HID_USAGE_ERROR_ROLLOVER    0x01
 344 #define USB_HID_USAGE_POSTFAIL          0x02
 345 #define USB_HID_USAGE_ERROR_UNDEFINED   0x03
 346
 347 /* Indices are QEMU keycodes, values are from HID Usage Table.  Indices
 348  * above 0x80 are for keys that come after 0xe0 or 0xe1+0x1d or 0xe1+0x9d.  */
 349 static const uint8_t usb_hid_usage_keys[0x100] = {
 350     0x00, 0x29, 0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
 351     0x24, 0x25, 0x26, 0x27, 0x2d, 0x2e, 0x2a, 0x2b,
 352     0x14, 0x1a, 0x08, 0x15, 0x17, 0x1c, 0x18, 0x0c,
 353     0x12, 0x13, 0x2f, 0x30, 0x28, 0xe0, 0x04, 0x16,
 354     0x07, 0x09, 0x0a, 0x0b, 0x0d, 0x0e, 0x0f, 0x33,
 355     0x34, 0x35, 0xe1, 0x31, 0x1d, 0x1b, 0x06, 0x19,
 356     0x05, 0x11, 0x10, 0x36, 0x37, 0x38, 0xe5, 0x55,
 357     0xe2, 0x2c, 0x32, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e,
 358     0x3f, 0x40, 0x41, 0x42, 0x43, 0x53, 0x47, 0x5f,
 359     0x60, 0x61, 0x56, 0x5c, 0x5d, 0x5e, 0x57, 0x59,
 360     0x5a, 0x5b, 0x62, 0x63, 0x00, 0x00, 0x00, 0x44,
 361     0x45, 0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e,
 362     0xe8, 0xe9, 0x71, 0x72, 0x73, 0x00, 0x00, 0x00,
 363     0x00, 0x00, 0x00, 0x85, 0x00, 0x00, 0x00, 0x00,
 364     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 365     0x00, 0x00, 0x00, 0x00, 0x00, 0xe3, 0xe7, 0x65,
 366
 367     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 368     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 369     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 370     0x00, 0x00, 0x00, 0x00, 0x58, 0xe4, 0x00, 0x00,
 371     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 372     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 373     0x00, 0x00, 0x00, 0x00, 0x00, 0x54, 0x00, 0x46,
 374     0xe6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 375     0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x00, 0x4a,
 376     0x52, 0x4b, 0x00, 0x50, 0x00, 0x4f, 0x00, 0x4d,
 377     0x51, 0x4e, 0x49, 0x4c, 0x00, 0x00, 0x00, 0x00,
 378     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 379     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 380     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 381     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 382     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 383 };
 384
 385 static void usb_mouse_event(void *opaque,
 386                             int dx1, int dy1, int dz1, int buttons_state)
 387 {
 388     USBHIDState *hs = opaque;
 389     USBMouseState *s = &hs->ptr;
 390
 391     s->dx += dx1;
 392     s->dy += dy1;
 393     s->dz += dz1;
 394     s->buttons_state = buttons_state;
 395     hs->changed = 1;
 396 }
 397
 398 static void usb_tablet_event(void *opaque,
 399                              int x, int y, int dz, int buttons_state)
 400 {
 401     USBHIDState *hs = opaque;
 402     USBMouseState *s = &hs->ptr;
 403
 404     s->x = x;
 405     s->y = y;
 406     s->dz += dz;
 407     s->buttons_state = buttons_state;
 408     hs->changed = 1;
 409 }
 410
 411 static void usb_keyboard_event(void *opaque, int keycode)
 412 {
 413     USBHIDState *hs = opaque;
 414     USBKeyboardState *s = &hs->kbd;
 415     uint8_t hid_code, key;
 416     int i;
 417
 418     key = keycode & 0x7f;
 419     hid_code = usb_hid_usage_keys[key | ((s->modifiers >> 1) & (1 << 7))];
 420     s->modifiers &= ~(1 << 8);
 421
 422     hs->changed = 1;
 423
 424     switch (hid_code) {
 425     case 0x00:
 426         return;
 427
 428     case 0xe0:
 429         if (s->modifiers & (1 << 9)) {
 430             s->modifiers ^= 3 << 8;
 431             return;
 432         }
 433     case 0xe1 ... 0xe7:
 434         if (keycode & (1 << 7)) {
 435             s->modifiers &= ~(1 << (hid_code & 0x0f));
 436             return;
 437         }
 438     case 0xe8 ... 0xef:
 439         s->modifiers |= 1 << (hid_code & 0x0f);
 440         return;
 441     }
 442
 443     if (keycode & (1 << 7)) {
 444         for (i = s->keys - 1; i >= 0; i --)
 445             if (s->key[i] == hid_code) {
 446                 s->key[i] = s->key[-- s->keys];
 447                 s->key[s->keys] = 0x00;
 448                 return;
 449             }
 450     } else {
 451         for (i = s->keys - 1; i >= 0; i --)
 452             if (s->key[i] == hid_code)
 453                 return;
 454         if (s->keys < sizeof(s->key))
 455             s->key[s->keys ++] = hid_code;
 456     }
 457 }
 458
 459 static inline int int_clamp(int val, int vmin, int vmax)
 460 {
 461     if (val < vmin)
 462         return vmin;
 463     else if (val > vmax)
 464         return vmax;
 465     else
 466         return val;
 467 }
 468
 469 static int usb_mouse_poll(USBHIDState *hs, uint8_t *buf, int len)
 470 {
 471     int dx, dy, dz, b, l;
 472     USBMouseState *s = &hs->ptr;
 473
 474     if (!s->mouse_grabbed) {
 475         s->eh_entry = qemu_add_mouse_event_handler(usb_mouse_event, hs,
 476                                                   0, "QEMU USB Mouse");
 477         s->mouse_grabbed = 1;
 478     }
 479
 480     dx = int_clamp(s->dx, -128, 127);
 481     dy = int_clamp(s->dy, -128, 127);
 482     dz = int_clamp(s->dz, -128, 127);
 483
 484     s->dx -= dx;
 485     s->dy -= dy;
 486     s->dz -= dz;
 487
 488     b = 0;
 489     if (s->buttons_state & MOUSE_EVENT_LBUTTON)
 490         b |= 0x01;
 491     if (s->buttons_state & MOUSE_EVENT_RBUTTON)
 492         b |= 0x02;
 493     if (s->buttons_state & MOUSE_EVENT_MBUTTON)
 494         b |= 0x04;
 495
 496     buf[0] = b;
 497     buf[1] = dx;
 498     buf[2] = dy;
 499     l = 3;
 500     if (len >= 4) {
 501         buf[3] = dz;
 502         l = 4;
 503     }
 504     return l;
 505 }
 506
 507 static int usb_tablet_poll(USBHIDState *hs, uint8_t *buf, int len)
 508 {
 509     int dz, b, l;
 510     USBMouseState *s = &hs->ptr;
 511
 512     if (!s->mouse_grabbed) {
 513         s->eh_entry = qemu_add_mouse_event_handler(usb_tablet_event, hs,
 514                                                   1, "QEMU USB Tablet");
 515         s->mouse_grabbed = 1;
 516     }
 517
 518     dz = int_clamp(s->dz, -128, 127);
 519     s->dz -= dz;
 520
 521     /* Appears we have to invert the wheel direction */
 522     dz = 0 - dz;
 523     b = 0;
 524     if (s->buttons_state & MOUSE_EVENT_LBUTTON)
 525         b |= 0x01;
 526     if (s->buttons_state & MOUSE_EVENT_RBUTTON)
 527         b |= 0x02;
 528     if (s->buttons_state & MOUSE_EVENT_MBUTTON)
 529         b |= 0x04;
 530
 531     buf[0] = b;
 532     buf[1] = s->x & 0xff;
 533     buf[2] = s->x >> 8;
 534     buf[3] = s->y & 0xff;
 535     buf[4] = s->y >> 8;
 536     buf[5] = dz;
 537     l = 6;
 538
 539     return l;
 540 }
 541
 542 static int usb_keyboard_poll(USBKeyboardState *s, uint8_t *buf, int len)
 543 {
 544     if (len < 2)
 545         return 0;
 546
 547     buf[0] = s->modifiers & 0xff;
 548     buf[1] = 0;
 549     if (s->keys > 6)
 550         memset(buf + 2, USB_HID_USAGE_ERROR_ROLLOVER, MIN(8, len) - 2);
 551     else
 552         memcpy(buf + 2, s->key, MIN(8, len) - 2);
 553
 554     return MIN(8, len);
 555 }
 556
 557 static int usb_keyboard_write(USBKeyboardState *s, uint8_t *buf, int len)
 558 {
 559     if (len > 0) {
 560         /* 0x01: Num Lock LED
 561          * 0x02: Caps Lock LED
 562          * 0x04: Scroll Lock LED
 563          * 0x08: Compose LED
 564          * 0x10: Kana LED */
 565         s->leds = buf[0];
 566     }
 567     return 0;
 568 }
 569
 570 static void usb_mouse_handle_reset(USBDevice *dev)
 571 {
 572     USBHIDState *s = (USBHIDState *)dev;
 573
 574     s->ptr.dx = 0;
 575     s->ptr.dy = 0;
 576     s->ptr.dz = 0;
 577     s->ptr.x = 0;
 578     s->ptr.y = 0;
 579     s->ptr.buttons_state = 0;
 580     s->protocol = 1;
 581 }
 582
 583 static void usb_keyboard_handle_reset(USBDevice *dev)
 584 {
 585     USBHIDState *s = (USBHIDState *)dev;
 586
 587     qemu_add_kbd_event_handler(usb_keyboard_event, s);
 588     s->protocol = 1;
 589 }
 590
 591 static int usb_hid_handle_control(USBDevice *dev, int request, int value,
 592                                   int index, int length, uint8_t *data)
 593 {
 594     USBHIDState *s = (USBHIDState *)dev;
 595     int ret = 0;
 596
 597     switch(request) {
 598     case DeviceRequest | USB_REQ_GET_STATUS:
 599         data[0] = (1 << USB_DEVICE_SELF_POWERED) |
 600             (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
 601         data[1] = 0x00;
 602         ret = 2;
 603         break;
 604     case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
 605         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 606             dev->remote_wakeup = 0;
 607         } else {
 608             goto fail;
 609         }
 610         ret = 0;
 611         break;
 612     case DeviceOutRequest | USB_REQ_SET_FEATURE:
 613         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 614             dev->remote_wakeup = 1;
 615         } else {
 616             goto fail;
 617         }
 618         ret = 0;
 619         break;
 620     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
 621         dev->addr = value;
 622         ret = 0;
 623         break;
 624     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
 625         switch(value >> 8) {
 626         case USB_DT_DEVICE:
 627             memcpy(data, qemu_mouse_dev_descriptor,
 628                    sizeof(qemu_mouse_dev_descriptor));
 629             ret = sizeof(qemu_mouse_dev_descriptor);
 630             break;
 631         case USB_DT_CONFIG:
 632             if (s->kind == USB_MOUSE) {
 633                 memcpy(data, qemu_mouse_config_descriptor,
 634                        sizeof(qemu_mouse_config_descriptor));
 635                 ret = sizeof(qemu_mouse_config_descriptor);
 636             } else if (s->kind == USB_TABLET) {
 637                 memcpy(data, qemu_tablet_config_descriptor,
 638                        sizeof(qemu_tablet_config_descriptor));
 639                 ret = sizeof(qemu_tablet_config_descriptor);
 640             } else if (s->kind == USB_KEYBOARD) {
 641                 memcpy(data, qemu_keyboard_config_descriptor,
 642                        sizeof(qemu_keyboard_config_descriptor));
 643                 ret = sizeof(qemu_keyboard_config_descriptor);
 644             }
 645             break;
 646         case USB_DT_STRING:
 647             switch(value & 0xff) {
 648             case 0:
 649                 /* language ids */
 650                 data[0] = 4;
 651                 data[1] = 3;
 652                 data[2] = 0x09;
 653                 data[3] = 0x04;
 654                 ret = 4;
 655                 break;
 656             case 1:
 657                 /* serial number */
 658                 ret = set_usb_string(data, "1");
 659                 break;
 660             case 2:
 661                 /* product description */
 662                 ret = set_usb_string(data, s->dev.devname);
 663                 break;
 664             case 3:
 665                 /* vendor description */
 666                 ret = set_usb_string(data, "QEMU " QEMU_VERSION);
 667                 break;
 668             case 4:
 669                 ret = set_usb_string(data, "HID Mouse");
 670                 break;
 671             case 5:
 672                 ret = set_usb_string(data, "HID Tablet");
 673                 break;
 674             case 6:
 675                 ret = set_usb_string(data, "HID Keyboard");
 676                 break;
 677             case 7:
 678                 ret = set_usb_string(data, "Endpoint1 Interrupt Pipe");
 679                 break;
 680             default:
 681                 goto fail;
 682             }
 683             break;
 684         default:
 685             goto fail;
 686         }
 687         break;
 688     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
 689         data[0] = 1;
 690         ret = 1;
 691         break;
 692     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
 693         ret = 0;
 694         break;
 695     case DeviceRequest | USB_REQ_GET_INTERFACE:
 696         data[0] = 0;
 697         ret = 1;
 698         break;
 699     case DeviceOutRequest | USB_REQ_SET_INTERFACE:
 700         ret = 0;
 701         break;
 702         /* hid specific requests */
 703     case InterfaceRequest | USB_REQ_GET_DESCRIPTOR:
 704         switch(value >> 8) {
 705         case 0x22:
 706             if (s->kind == USB_MOUSE) {
 707                 memcpy(data, qemu_mouse_hid_report_descriptor,
 708                        sizeof(qemu_mouse_hid_report_descriptor));
 709                 ret = sizeof(qemu_mouse_hid_report_descriptor);
 710             } else if (s->kind == USB_TABLET) {
 711                 memcpy(data, qemu_tablet_hid_report_descriptor,
 712                        sizeof(qemu_tablet_hid_report_descriptor));
 713                 ret = sizeof(qemu_tablet_hid_report_descriptor);
 714             } else if (s->kind == USB_KEYBOARD) {
 715                 memcpy(data, qemu_keyboard_hid_report_descriptor,
 716                        sizeof(qemu_keyboard_hid_report_descriptor));
 717                 ret = sizeof(qemu_keyboard_hid_report_descriptor);
 718             }
 719             break;
 720         default:
 721             goto fail;
 722         }
 723         break;
 724     case GET_REPORT:
 725         if (s->kind == USB_MOUSE)
 726             ret = usb_mouse_poll(s, data, length);
 727         else if (s->kind == USB_TABLET)
 728             ret = usb_tablet_poll(s, data, length);
 729         else if (s->kind == USB_KEYBOARD)
 730             ret = usb_keyboard_poll(&s->kbd, data, length);
 731         break;
 732     case SET_REPORT:
 733         if (s->kind == USB_KEYBOARD)
 734             ret = usb_keyboard_write(&s->kbd, data, length);
 735         else
 736             goto fail;
 737         break;
 738     case GET_PROTOCOL:
 739         if (s->kind != USB_KEYBOARD)
 740             goto fail;
 741         ret = 1;
 742         data[0] = s->protocol;
 743         break;
 744     case SET_PROTOCOL:
 745         if (s->kind != USB_KEYBOARD)
 746             goto fail;
 747         ret = 0;
 748         s->protocol = value;
 749         break;
 750     case GET_IDLE:
 751         ret = 1;
 752         data[0] = s->idle;
 753         break;
 754     case SET_IDLE:
 755         s->idle = value;
 756         ret = 0;
 757         break;
 758     default:
 759     fail:
 760         ret = USB_RET_STALL;
 761         break;
 762     }
 763     return ret;
 764 }
 765
 766 static int usb_hid_handle_data(USBDevice *dev, USBPacket *p)
 767 {
 768     USBHIDState *s = (USBHIDState *)dev;
 769     int ret = 0;
 770
 771     switch(p->pid) {
 772     case USB_TOKEN_IN:
 773         if (p->devep == 1) {
 774             /* TODO: Implement finite idle delays.  */
 775             if (!(s->changed || s->idle))
 776                 return USB_RET_NAK;
 777             s->changed = 0;
 778             if (s->kind == USB_MOUSE)
 779                 ret = usb_mouse_poll(s, p->data, p->len);
 780             else if (s->kind == USB_TABLET)
 781                 ret = usb_tablet_poll(s, p->data, p->len);
 782             else if (s->kind == USB_KEYBOARD)
 783                 ret = usb_keyboard_poll(&s->kbd, p->data, p->len);
 784         } else {
 785             goto fail;
 786         }
 787         break;
 788     case USB_TOKEN_OUT:
 789     default:
 790     fail:
 791         ret = USB_RET_STALL;
 792         break;
 793     }
 794     return ret;
 795 }
 796
 797 static void usb_hid_handle_destroy(USBDevice *dev)
 798 {
 799     USBHIDState *s = (USBHIDState *)dev;
 800
 801     if (s->kind != USB_KEYBOARD)
 802         qemu_remove_mouse_event_handler(s->ptr.eh_entry);
 803     /* TODO: else */
 804     qemu_free(s);
 805 }
 806
 807 USBDevice *usb_tablet_init(void)
 808 {
 809     USBHIDState *s;
 810
 811     s = qemu_mallocz(sizeof(USBHIDState));
 812     if (!s)
 813         return NULL;
 814     s->dev.speed = USB_SPEED_FULL;
 815     s->dev.handle_packet = usb_generic_handle_packet;
 816
 817     s->dev.handle_reset = usb_mouse_handle_reset;
 818     s->dev.handle_control = usb_hid_handle_control;
 819     s->dev.handle_data = usb_hid_handle_data;
 820     s->dev.handle_destroy = usb_hid_handle_destroy;
 821     s->kind = USB_TABLET;
 822     /* Force poll routine to be run and grab input the first time.  */
 823     s->changed = 1;
 824
 825     pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU USB Tablet");
 826
 827     return (USBDevice *)s;
 828 }
 829
 830 USBDevice *usb_mouse_init(void)
 831 {
 832     USBHIDState *s;
 833
 834     s = qemu_mallocz(sizeof(USBHIDState));
 835     if (!s)
 836         return NULL;
 837     s->dev.speed = USB_SPEED_FULL;
 838     s->dev.handle_packet = usb_generic_handle_packet;
 839
 840     s->dev.handle_reset = usb_mouse_handle_reset;
 841     s->dev.handle_control = usb_hid_handle_control;
 842     s->dev.handle_data = usb_hid_handle_data;
 843     s->dev.handle_destroy = usb_hid_handle_destroy;
 844     s->kind = USB_MOUSE;
 845     /* Force poll routine to be run and grab input the first time.  */
 846     s->changed = 1;
 847
 848     pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU USB Mouse");
 849
 850     return (USBDevice *)s;
 851 }
 852
 853 USBDevice *usb_keyboard_init(void)
 854 {
 855     USBHIDState *s;
 856
 857     s = qemu_mallocz(sizeof(USBHIDState));
 858     if (!s)
 859         return NULL;
 860     s->dev.speed = USB_SPEED_FULL;
 861     s->dev.handle_packet = usb_generic_handle_packet;
 862
 863     s->dev.handle_reset = usb_keyboard_handle_reset;
 864     s->dev.handle_control = usb_hid_handle_control;
 865     s->dev.handle_data = usb_hid_handle_data;
 866     s->dev.handle_destroy = usb_hid_handle_destroy;
 867     s->kind = USB_KEYBOARD;
 868
 869     pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU USB Keyboard");
 870
 871     return (USBDevice *) s;
 872 }