hw/bt-hid.c

   1 /*
   2  * QEMU Bluetooth HID Profile wrapper for USB HID.
   3  *
   4  * Copyright (C) 2007-2008 OpenMoko, Inc.
   5  * Written by Andrzej Zaborowski <andrew@openedhand.com>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License as
   9  * published by the Free Software Foundation; either version 2 or
  10  * (at your option) version 3 of the License.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, write to the Free Software Foundation, Inc.,
  19  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  */
  21
  22 #include "qemu-common.h"
  23 #include "usb.h"
  24 #include "bt.h"
  25
  26 enum hid_transaction_req {
  27     BT_HANDSHAKE                        = 0x0,
  28     BT_HID_CONTROL                      = 0x1,
  29     BT_GET_REPORT                       = 0x4,
  30     BT_SET_REPORT                       = 0x5,
  31     BT_GET_PROTOCOL                     = 0x6,
  32     BT_SET_PROTOCOL                     = 0x7,
  33     BT_GET_IDLE                         = 0x8,
  34     BT_SET_IDLE                         = 0x9,
  35     BT_DATA                             = 0xa,
  36     BT_DATC                             = 0xb,
  37 };
  38
  39 enum hid_transaction_handshake {
  40     BT_HS_SUCCESSFUL                    = 0x0,
  41     BT_HS_NOT_READY                     = 0x1,
  42     BT_HS_ERR_INVALID_REPORT_ID         = 0x2,
  43     BT_HS_ERR_UNSUPPORTED_REQUEST       = 0x3,
  44     BT_HS_ERR_INVALID_PARAMETER         = 0x4,
  45     BT_HS_ERR_UNKNOWN                   = 0xe,
  46     BT_HS_ERR_FATAL                     = 0xf,
  47 };
  48
  49 enum hid_transaction_control {
  50     BT_HC_NOP                           = 0x0,
  51     BT_HC_HARD_RESET                    = 0x1,
  52     BT_HC_SOFT_RESET                    = 0x2,
  53     BT_HC_SUSPEND                       = 0x3,
  54     BT_HC_EXIT_SUSPEND                  = 0x4,
  55     BT_HC_VIRTUAL_CABLE_UNPLUG          = 0x5,
  56 };
  57
  58 enum hid_protocol {
  59     BT_HID_PROTO_BOOT                   = 0,
  60     BT_HID_PROTO_REPORT                 = 1,
  61 };
  62
  63 enum hid_boot_reportid {
  64     BT_HID_BOOT_INVALID                 = 0,
  65     BT_HID_BOOT_KEYBOARD,
  66     BT_HID_BOOT_MOUSE,
  67 };
  68
  69 enum hid_data_pkt {
  70     BT_DATA_OTHER                       = 0,
  71     BT_DATA_INPUT,
  72     BT_DATA_OUTPUT,
  73     BT_DATA_FEATURE,
  74 };
  75
  76 #define BT_HID_MTU                      48
  77
  78 /* HID interface requests */
  79 #define GET_REPORT                      0xa101
  80 #define GET_IDLE                        0xa102
  81 #define GET_PROTOCOL                    0xa103
  82 #define SET_REPORT                      0x2109
  83 #define SET_IDLE                        0x210a
  84 #define SET_PROTOCOL                    0x210b
  85
  86 struct bt_hid_device_s {
  87     struct bt_l2cap_device_s btdev;
  88     struct bt_l2cap_conn_params_s *control;
  89     struct bt_l2cap_conn_params_s *interrupt;
  90     USBDevice *usbdev;
  91
  92     int proto;
  93     int connected;
  94     int data_type;
  95     int intr_state;
  96     struct {
  97         int len;
  98         uint8_t buffer[1024];
  99     } dataother, datain, dataout, feature, intrdataout;
 100     enum {
 101         bt_state_ready,
 102         bt_state_transaction,
 103         bt_state_suspend,
 104     } state;
 105 };
 106
 107 static void bt_hid_reset(struct bt_hid_device_s *s)
 108 {
 109     struct bt_scatternet_s *net = s->btdev.device.net;
 110
 111     /* Go as far as... */
 112     bt_l2cap_device_done(&s->btdev);
 113     bt_l2cap_device_init(&s->btdev, net);
 114
 115     s->usbdev->handle_reset(s->usbdev);
 116     s->proto = BT_HID_PROTO_REPORT;
 117     s->state = bt_state_ready;
 118     s->dataother.len = 0;
 119     s->datain.len = 0;
 120     s->dataout.len = 0;
 121     s->feature.len = 0;
 122     s->intrdataout.len = 0;
 123     s->intr_state = 0;
 124 }
 125
 126 static int bt_hid_out(struct bt_hid_device_s *s)
 127 {
 128     USBPacket p;
 129
 130     if (s->data_type == BT_DATA_OUTPUT) {
 131         p.pid = USB_TOKEN_OUT;
 132         p.devep = 1;
 133         p.data = s->dataout.buffer;
 134         p.len = s->dataout.len;
 135         s->dataout.len = s->usbdev->handle_data(s->usbdev, &p);
 136
 137         return s->dataout.len;
 138     }
 139
 140     if (s->data_type == BT_DATA_FEATURE) {
 141         /* XXX:
 142          * does this send a USB_REQ_CLEAR_FEATURE/USB_REQ_SET_FEATURE
 143          * or a SET_REPORT? */
 144         p.devep = 0;
 145     }
 146
 147     return -1;
 148 }
 149
 150 static int bt_hid_in(struct bt_hid_device_s *s)
 151 {
 152     USBPacket p;
 153
 154     p.pid = USB_TOKEN_IN;
 155     p.devep = 1;
 156     p.data = s->datain.buffer;
 157     p.len = sizeof(s->datain.buffer);
 158     s->datain.len = s->usbdev->handle_data(s->usbdev, &p);
 159
 160     return s->datain.len;
 161 }
 162
 163 static void bt_hid_send_handshake(struct bt_hid_device_s *s, int result)
 164 {
 165     *s->control->sdu_out(s->control, 1) =
 166             (BT_HANDSHAKE << 4) | result;
 167     s->control->sdu_submit(s->control);
 168 }
 169
 170 static void bt_hid_send_control(struct bt_hid_device_s *s, int operation)
 171 {
 172     *s->control->sdu_out(s->control, 1) =
 173             (BT_HID_CONTROL << 4) | operation;
 174     s->control->sdu_submit(s->control);
 175 }
 176
 177 static void bt_hid_disconnect(struct bt_hid_device_s *s)
 178 {
 179     /* Disconnect s->control and s->interrupt */
 180 }
 181
 182 static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type,
 183                 const uint8_t *data, int len)
 184 {
 185     uint8_t *pkt, hdr = (BT_DATA << 4) | type;
 186     int plen;
 187
 188     do {
 189         plen = MIN(len, ch->remote_mtu - 1);
 190         pkt = ch->sdu_out(ch, plen + 1);
 191
 192         pkt[0] = hdr;
 193         if (plen)
 194             memcpy(pkt + 1, data, plen);
 195         ch->sdu_submit(ch);
 196
 197         len -= plen;
 198         data += plen;
 199         hdr = (BT_DATC << 4) | type;
 200     } while (plen == ch->remote_mtu - 1);
 201 }
 202
 203 static void bt_hid_control_transaction(struct bt_hid_device_s *s,
 204                 const uint8_t *data, int len)
 205 {
 206     uint8_t type, parameter;
 207     int rlen, ret = -1;
 208     if (len < 1)
 209         return;
 210
 211     type = data[0] >> 4;
 212     parameter = data[0] & 0xf;
 213
 214     switch (type) {
 215     case BT_HANDSHAKE:
 216     case BT_DATA:
 217         switch (parameter) {
 218         default:
 219             /* These are not expected to be sent this direction.  */
 220             ret = BT_HS_ERR_INVALID_PARAMETER;
 221         }
 222         break;
 223
 224     case BT_HID_CONTROL:
 225         if (len != 1 || (parameter != BT_HC_VIRTUAL_CABLE_UNPLUG &&
 226                                 s->state == bt_state_transaction)) {
 227             ret = BT_HS_ERR_INVALID_PARAMETER;
 228             break;
 229         }
 230         switch (parameter) {
 231         case BT_HC_NOP:
 232             break;
 233         case BT_HC_HARD_RESET:
 234         case BT_HC_SOFT_RESET:
 235             bt_hid_reset(s);
 236             break;
 237         case BT_HC_SUSPEND:
 238             if (s->state == bt_state_ready)
 239                 s->state = bt_state_suspend;
 240             else
 241                 ret = BT_HS_ERR_INVALID_PARAMETER;
 242             break;
 243         case BT_HC_EXIT_SUSPEND:
 244             if (s->state == bt_state_suspend)
 245                 s->state = bt_state_ready;
 246             else
 247                 ret = BT_HS_ERR_INVALID_PARAMETER;
 248             break;
 249         case BT_HC_VIRTUAL_CABLE_UNPLUG:
 250             bt_hid_disconnect(s);
 251             break;
 252         default:
 253             ret = BT_HS_ERR_INVALID_PARAMETER;
 254         }
 255         break;
 256
 257     case BT_GET_REPORT:
 258         /* No ReportIDs declared.  */
 259         if (((parameter & 8) && len != 3) ||
 260                         (!(parameter & 8) && len != 1) ||
 261                         s->state != bt_state_ready) {
 262             ret = BT_HS_ERR_INVALID_PARAMETER;
 263             break;
 264         }
 265         if (parameter & 8)
 266             rlen = data[2] | (data[3] << 8);
 267         else
 268             rlen = INT_MAX;
 269         switch (parameter & 3) {
 270         case BT_DATA_OTHER:
 271             ret = BT_HS_ERR_INVALID_PARAMETER;
 272             break;
 273         case BT_DATA_INPUT:
 274             /* Here we can as well poll s->usbdev */
 275             bt_hid_send_data(s->control, BT_DATA_INPUT,
 276                             s->datain.buffer, MIN(rlen, s->datain.len));
 277             break;
 278         case BT_DATA_OUTPUT:
 279             bt_hid_send_data(s->control, BT_DATA_OUTPUT,
 280                             s->dataout.buffer, MIN(rlen, s->dataout.len));
 281             break;
 282         case BT_DATA_FEATURE:
 283             bt_hid_send_data(s->control, BT_DATA_FEATURE,
 284                             s->feature.buffer, MIN(rlen, s->feature.len));
 285             break;
 286         }
 287         break;
 288
 289     case BT_SET_REPORT:
 290         if (len < 2 || len > BT_HID_MTU || s->state != bt_state_ready ||
 291                         (parameter & 3) == BT_DATA_OTHER ||
 292                         (parameter & 3) == BT_DATA_INPUT) {
 293             ret = BT_HS_ERR_INVALID_PARAMETER;
 294             break;
 295         }
 296         s->data_type = parameter & 3;
 297         if (s->data_type == BT_DATA_OUTPUT) {
 298             s->dataout.len = len - 1;
 299             memcpy(s->dataout.buffer, data + 1, s->dataout.len);
 300         } else {
 301             s->feature.len = len - 1;
 302             memcpy(s->feature.buffer, data + 1, s->feature.len);
 303         }
 304         if (len == BT_HID_MTU)
 305             s->state = bt_state_transaction;
 306         else
 307             bt_hid_out(s);
 308         break;
 309
 310     case BT_GET_PROTOCOL:
 311         if (len != 1 || s->state == bt_state_transaction) {
 312             ret = BT_HS_ERR_INVALID_PARAMETER;
 313             break;
 314         }
 315         *s->control->sdu_out(s->control, 1) = s->proto;
 316         s->control->sdu_submit(s->control);
 317         break;
 318
 319     case BT_SET_PROTOCOL:
 320         if (len != 1 || s->state == bt_state_transaction ||
 321                         (parameter != BT_HID_PROTO_BOOT &&
 322                          parameter != BT_HID_PROTO_REPORT)) {
 323             ret = BT_HS_ERR_INVALID_PARAMETER;
 324             break;
 325         }
 326         s->proto = parameter;
 327         s->usbdev->handle_control(s->usbdev, SET_PROTOCOL, s->proto, 0, 0,
 328                                   NULL);
 329         ret = BT_HS_SUCCESSFUL;
 330         break;
 331
 332     case BT_GET_IDLE:
 333         if (len != 1 || s->state == bt_state_transaction) {
 334             ret = BT_HS_ERR_INVALID_PARAMETER;
 335             break;
 336         }
 337         s->usbdev->handle_control(s->usbdev, GET_IDLE, 0, 0, 1,
 338                         s->control->sdu_out(s->control, 1));
 339         s->control->sdu_submit(s->control);
 340         break;
 341
 342     case BT_SET_IDLE:
 343         if (len != 2 || s->state == bt_state_transaction) {
 344             ret = BT_HS_ERR_INVALID_PARAMETER;
 345             break;
 346         }
 347
 348         /* We don't need to know about the Idle Rate here really,
 349          * so just pass it on to the device.  */
 350         ret = s->usbdev->handle_control(s->usbdev,
 351                         SET_IDLE, data[1], 0, 0, NULL) ?
 352                 BT_HS_SUCCESSFUL : BT_HS_ERR_INVALID_PARAMETER;
 353         /* XXX: Does this generate a handshake? */
 354         break;
 355
 356     case BT_DATC:
 357         if (len > BT_HID_MTU || s->state != bt_state_transaction) {
 358             ret = BT_HS_ERR_INVALID_PARAMETER;
 359             break;
 360         }
 361         if (s->data_type == BT_DATA_OUTPUT) {
 362             memcpy(s->dataout.buffer + s->dataout.len, data + 1, len - 1);
 363             s->dataout.len += len - 1;
 364         } else {
 365             memcpy(s->feature.buffer + s->feature.len, data + 1, len - 1);
 366             s->feature.len += len - 1;
 367         }
 368         if (len < BT_HID_MTU) {
 369             bt_hid_out(s);
 370             s->state = bt_state_ready;
 371         }
 372         break;
 373
 374     default:
 375         ret = BT_HS_ERR_UNSUPPORTED_REQUEST;
 376     }
 377
 378     if (ret != -1)
 379         bt_hid_send_handshake(s, ret);
 380 }
 381
 382 static void bt_hid_control_sdu(void *opaque, const uint8_t *data, int len)
 383 {
 384     struct bt_hid_device_s *hid = opaque;
 385
 386     bt_hid_control_transaction(hid, data, len);
 387 }
 388
 389 static void bt_hid_datain(void *opaque)
 390 {
 391     struct bt_hid_device_s *hid = opaque;
 392
 393     /* If suspended, wake-up and send a wake-up event first.  We might
 394      * want to also inspect the input report and ignore event like
 395      * mouse movements until a button event occurs.  */
 396     if (hid->state == bt_state_suspend) {
 397         hid->state = bt_state_ready;
 398     }
 399
 400     if (bt_hid_in(hid) > 0)
 401         /* TODO: when in boot-mode precede any Input reports with the ReportID
 402          * byte, here and in GetReport/SetReport on the Control channel.  */
 403         bt_hid_send_data(hid->interrupt, BT_DATA_INPUT,
 404                         hid->datain.buffer, hid->datain.len);
 405 }
 406
 407 static void bt_hid_interrupt_sdu(void *opaque, const uint8_t *data, int len)
 408 {
 409     struct bt_hid_device_s *hid = opaque;
 410
 411     if (len > BT_HID_MTU || len < 1)
 412         goto bad;
 413     if ((data[0] & 3) != BT_DATA_OUTPUT)
 414         goto bad;
 415     if ((data[0] >> 4) == BT_DATA) {
 416         if (hid->intr_state)
 417             goto bad;
 418
 419         hid->data_type = BT_DATA_OUTPUT;
 420         hid->intrdataout.len = 0;
 421     } else if ((data[0] >> 4) == BT_DATC) {
 422         if (!hid->intr_state)
 423             goto bad;
 424     } else
 425         goto bad;
 426
 427     memcpy(hid->intrdataout.buffer + hid->intrdataout.len, data + 1, len - 1);
 428     hid->intrdataout.len += len - 1;
 429     hid->intr_state = (len == BT_HID_MTU);
 430     if (!hid->intr_state) {
 431         memcpy(hid->dataout.buffer, hid->intrdataout.buffer,
 432                         hid->dataout.len = hid->intrdataout.len);
 433         bt_hid_out(hid);
 434     }
 435
 436     return;
 437 bad:
 438     fprintf(stderr, "%s: bad transaction on Interrupt channel.\n",
 439                     __FUNCTION__);
 440 }
 441
 442 /* "Virtual cable" plug/unplug event.  */
 443 static void bt_hid_connected_update(struct bt_hid_device_s *hid)
 444 {
 445     int prev = hid->connected;
 446
 447     hid->connected = hid->control && hid->interrupt;
 448
 449     /* Stop page-/inquiry-scanning when a host is connected.  */
 450     hid->btdev.device.page_scan = !hid->connected;
 451     hid->btdev.device.inquiry_scan = !hid->connected;
 452
 453     if (hid->connected && !prev) {
 454         hid->usbdev->handle_reset(hid->usbdev);
 455         hid->proto = BT_HID_PROTO_REPORT;
 456     }
 457
 458     /* Should set HIDVirtualCable in SDP (possibly need to check that SDP
 459      * isn't destroyed yet, in case we're being called from handle_destroy) */
 460 }
 461
 462 static void bt_hid_close_control(void *opaque)
 463 {
 464     struct bt_hid_device_s *hid = opaque;
 465
 466     hid->control = NULL;
 467     bt_hid_connected_update(hid);
 468 }
 469
 470 static void bt_hid_close_interrupt(void *opaque)
 471 {
 472     struct bt_hid_device_s *hid = opaque;
 473
 474     hid->interrupt = NULL;
 475     bt_hid_connected_update(hid);
 476 }
 477
 478 static int bt_hid_new_control_ch(struct bt_l2cap_device_s *dev,
 479                 struct bt_l2cap_conn_params_s *params)
 480 {
 481     struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
 482
 483     if (hid->control)
 484         return 1;
 485
 486     hid->control = params;
 487     hid->control->opaque = hid;
 488     hid->control->close = bt_hid_close_control;
 489     hid->control->sdu_in = bt_hid_control_sdu;
 490
 491     bt_hid_connected_update(hid);
 492
 493     return 0;
 494 }
 495
 496 static int bt_hid_new_interrupt_ch(struct bt_l2cap_device_s *dev,
 497                 struct bt_l2cap_conn_params_s *params)
 498 {
 499     struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
 500
 501     if (hid->interrupt)
 502         return 1;
 503
 504     hid->interrupt = params;
 505     hid->interrupt->opaque = hid;
 506     hid->interrupt->close = bt_hid_close_interrupt;
 507     hid->interrupt->sdu_in = bt_hid_interrupt_sdu;
 508
 509     bt_hid_connected_update(hid);
 510
 511     return 0;
 512 }
 513
 514 static void bt_hid_destroy(struct bt_device_s *dev)
 515 {
 516     struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
 517
 518     if (hid->connected)
 519         bt_hid_send_control(hid, BT_HC_VIRTUAL_CABLE_UNPLUG);
 520     bt_l2cap_device_done(&hid->btdev);
 521
 522     hid->usbdev->handle_destroy(hid->usbdev);
 523
 524     qemu_free(hid);
 525 }
 526
 527 enum peripheral_minor_class {
 528     class_other         = 0 << 4,
 529     class_keyboard      = 1 << 4,
 530     class_pointing      = 2 << 4,
 531     class_combo         = 3 << 4,
 532 };
 533
 534 static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
 535                 USBDevice *dev, enum peripheral_minor_class minor)
 536 {
 537     struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
 538     uint32_t class =
 539             /* Format type */
 540             (0 << 0) |
 541             /* Device class */
 542             (minor << 2) |
 543             (5 << 8) |  /* "Peripheral" */
 544             /* Service classes */
 545             (1 << 13) | /* Limited discoverable mode */
 546             (1 << 19);  /* Capturing device (?) */
 547
 548     bt_l2cap_device_init(&s->btdev, net);
 549     bt_l2cap_sdp_init(&s->btdev);
 550     bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_CTRL,
 551                     BT_HID_MTU, bt_hid_new_control_ch);
 552     bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_INTR,
 553                     BT_HID_MTU, bt_hid_new_interrupt_ch);
 554
 555     s->usbdev = dev;
 556     s->btdev.device.lmp_name = s->usbdev->devname;
 557     usb_hid_datain_cb(s->usbdev, s, bt_hid_datain);
 558
 559     s->btdev.device.handle_destroy = bt_hid_destroy;
 560
 561     s->btdev.device.class[0] = (class >>  0) & 0xff;
 562     s->btdev.device.class[1] = (class >>  8) & 0xff;
 563     s->btdev.device.class[2] = (class >> 16) & 0xff;
 564
 565     return &s->btdev.device;
 566 }
 567
 568 struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net)
 569 {
 570     return bt_hid_init(net, usb_keyboard_init(), class_keyboard);
 571 }