]> git.proxmox.com Git - qemu.git/blame - hw/bt-hid.c
projects / qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Don't leak VLANClientState on PCI hot remove
[qemu.git] / hw / bt-hid.c
CommitLineData
47e699dc
AZ		 1/*
2 * QEMU Bluetooth HID Profile wrapper for USB HID.
3 *
4 * Copyright (C) 2007-2008 OpenMoko, Inc.
5 * Written by Andrzej Zaborowski <andrew@openedhand.com>
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
fad6cb1a
AJ		 17 * You should have received a copy of the GNU General Public License along
18 * with this program; if not, write to the Free Software Foundation, Inc.,
19 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
47e699dc
AZ		 20 */
21
22#include "qemu-common.h"
23#include "usb.h"
24#include "bt.h"
25
26enum hid_transaction_req {
27 BT_HANDSHAKE = 0x0,
28 BT_HID_CONTROL = 0x1,
29 BT_GET_REPORT = 0x4,
30 BT_SET_REPORT = 0x5,
31 BT_GET_PROTOCOL = 0x6,
32 BT_SET_PROTOCOL = 0x7,
33 BT_GET_IDLE = 0x8,
34 BT_SET_IDLE = 0x9,
35 BT_DATA = 0xa,
36 BT_DATC = 0xb,
37};
38
39enum hid_transaction_handshake {
40 BT_HS_SUCCESSFUL = 0x0,
41 BT_HS_NOT_READY = 0x1,
42 BT_HS_ERR_INVALID_REPORT_ID = 0x2,
43 BT_HS_ERR_UNSUPPORTED_REQUEST = 0x3,
44 BT_HS_ERR_INVALID_PARAMETER = 0x4,
45 BT_HS_ERR_UNKNOWN = 0xe,
46 BT_HS_ERR_FATAL = 0xf,
47};
48
49enum hid_transaction_control {
50 BT_HC_NOP = 0x0,
51 BT_HC_HARD_RESET = 0x1,
52 BT_HC_SOFT_RESET = 0x2,
53 BT_HC_SUSPEND = 0x3,
54 BT_HC_EXIT_SUSPEND = 0x4,
55 BT_HC_VIRTUAL_CABLE_UNPLUG = 0x5,
56};
57
58enum hid_protocol {
59 BT_HID_PROTO_BOOT = 0,
60 BT_HID_PROTO_REPORT = 1,
61};
62
63enum hid_boot_reportid {
64 BT_HID_BOOT_INVALID = 0,
65 BT_HID_BOOT_KEYBOARD,
66 BT_HID_BOOT_MOUSE,
67};
68
69enum hid_data_pkt {
70 BT_DATA_OTHER = 0,
71 BT_DATA_INPUT,
72 BT_DATA_OUTPUT,
73 BT_DATA_FEATURE,
74};
75
76#define BT_HID_MTU 48
77
78/* HID interface requests */
79#define GET_REPORT 0xa101
80#define GET_IDLE 0xa102
81#define GET_PROTOCOL 0xa103
82#define SET_REPORT 0x2109
83#define SET_IDLE 0x210a
84#define SET_PROTOCOL 0x210b
85
86struct bt_hid_device_s {
87 struct bt_l2cap_device_s btdev;
88 struct bt_l2cap_conn_params_s *control;
89 struct bt_l2cap_conn_params_s *interrupt;
90 USBDevice *usbdev;
91
92 int proto;
93 int connected;
94 int data_type;
95 int intr_state;
96 struct {
97 int len;
98 uint8_t buffer[1024];
99 } dataother, datain, dataout, feature, intrdataout;
100 enum {
101 bt_state_ready,
102 bt_state_transaction,
103 bt_state_suspend,
104 } state;
105};
106
107static void bt_hid_reset(struct bt_hid_device_s *s)
108{
109 struct bt_scatternet_s *net = s->btdev.device.net;
110
111 /* Go as far as... */
112 bt_l2cap_device_done(&s->btdev);
113 bt_l2cap_device_init(&s->btdev, net);
114
115 s->usbdev->handle_reset(s->usbdev);
116 s->proto = BT_HID_PROTO_REPORT;
117 s->state = bt_state_ready;
118 s->dataother.len = 0;
119 s->datain.len = 0;
120 s->dataout.len = 0;
121 s->feature.len = 0;
122 s->intrdataout.len = 0;
123 s->intr_state = 0;
124}
125
126static int bt_hid_out(struct bt_hid_device_s *s)
127{
128 USBPacket p;
129
130 if (s->data_type == BT_DATA_OUTPUT) {
131 p.pid = USB_TOKEN_OUT;
132 p.devep = 1;
133 p.data = s->dataout.buffer;
134 p.len = s->dataout.len;
135 s->dataout.len = s->usbdev->handle_data(s->usbdev, &p);
136
137 return s->dataout.len;
138 }
139
140 if (s->data_type == BT_DATA_FEATURE) {
141 /* XXX:
142 * does this send a USB_REQ_CLEAR_FEATURE/USB_REQ_SET_FEATURE
143 * or a SET_REPORT? */
144 p.devep = 0;
145 }
146
147 return -1;
148}
149
150static int bt_hid_in(struct bt_hid_device_s *s)
151{
152 USBPacket p;
153
154 p.pid = USB_TOKEN_IN;
155 p.devep = 1;
156 p.data = s->datain.buffer;
157 p.len = sizeof(s->datain.buffer);
158 s->datain.len = s->usbdev->handle_data(s->usbdev, &p);
159
160 return s->datain.len;
161}
162
163static void bt_hid_send_handshake(struct bt_hid_device_s *s, int result)
164{
165 *s->control->sdu_out(s->control, 1) =
166 (BT_HANDSHAKE << 4) | result;
167 s->control->sdu_submit(s->control);
168}
169
170static void bt_hid_send_control(struct bt_hid_device_s *s, int operation)
171{
172 *s->control->sdu_out(s->control, 1) =
173 (BT_HID_CONTROL << 4) | operation;
174 s->control->sdu_submit(s->control);
175}
176
177static void bt_hid_disconnect(struct bt_hid_device_s *s)
178{
179 /* Disconnect s->control and s->interrupt */
180}
181
182static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type,
183 const uint8_t *data, int len)
184{
185 uint8_t *pkt, hdr = (BT_DATA << 4) | type;
186 int plen;
187
188 do {
189 plen = MIN(len, ch->remote_mtu - 1);
190 pkt = ch->sdu_out(ch, plen + 1);
191
192 pkt[0] = hdr;
193 if (plen)
194 memcpy(pkt + 1, data, plen);
195 ch->sdu_submit(ch);
196
197 len -= plen;
198 data += plen;
199 hdr = (BT_DATC << 4) | type;
200 } while (plen == ch->remote_mtu - 1);
201}
202
203static void bt_hid_control_transaction(struct bt_hid_device_s *s,
204 const uint8_t *data, int len)
205{
206 uint8_t type, parameter;
207 int rlen, ret = -1;
208 if (len < 1)
209 return;
210
211 type = data[0] >> 4;
212 parameter = data[0] & 0xf;
213
214 switch (type) {
215 case BT_HANDSHAKE:
216 case BT_DATA:
217 switch (parameter) {
218 default:
219 /* These are not expected to be sent this direction. */
220 ret = BT_HS_ERR_INVALID_PARAMETER;
221 }
222 break;
223
224 case BT_HID_CONTROL:
225 if (len != 1 || (parameter != BT_HC_VIRTUAL_CABLE_UNPLUG &&
226 s->state == bt_state_transaction)) {
227 ret = BT_HS_ERR_INVALID_PARAMETER;
228 break;
229 }
230 switch (parameter) {
231 case BT_HC_NOP:
232 break;
233 case BT_HC_HARD_RESET:
234 case BT_HC_SOFT_RESET:
235 bt_hid_reset(s);
236 break;
237 case BT_HC_SUSPEND:
238 if (s->state == bt_state_ready)
239 s->state = bt_state_suspend;
240 else
241 ret = BT_HS_ERR_INVALID_PARAMETER;
242 break;
243 case BT_HC_EXIT_SUSPEND:
244 if (s->state == bt_state_suspend)
245 s->state = bt_state_ready;
246 else
247 ret = BT_HS_ERR_INVALID_PARAMETER;
248 break;
249 case BT_HC_VIRTUAL_CABLE_UNPLUG:
250 bt_hid_disconnect(s);
251 break;
252 default:
253 ret = BT_HS_ERR_INVALID_PARAMETER;
254 }
255 break;
256
257 case BT_GET_REPORT:
258 /* No ReportIDs declared. */
259 if (((parameter & 8) && len != 3) ||
260 (!(parameter & 8) && len != 1) ||
261 s->state != bt_state_ready) {
262 ret = BT_HS_ERR_INVALID_PARAMETER;
263 break;
264 }
265 if (parameter & 8)
266 rlen = data[2] | (data[3] << 8);
267 else
268 rlen = INT_MAX;
269 switch (parameter & 3) {
270 case BT_DATA_OTHER:
271 ret = BT_HS_ERR_INVALID_PARAMETER;
272 break;
273 case BT_DATA_INPUT:
274 /* Here we can as well poll s->usbdev */
275 bt_hid_send_data(s->control, BT_DATA_INPUT,
276 s->datain.buffer, MIN(rlen, s->datain.len));
277 break;
278 case BT_DATA_OUTPUT:
279 bt_hid_send_data(s->control, BT_DATA_OUTPUT,
280 s->dataout.buffer, MIN(rlen, s->dataout.len));
281 break;
282 case BT_DATA_FEATURE:
283 bt_hid_send_data(s->control, BT_DATA_FEATURE,
284 s->feature.buffer, MIN(rlen, s->feature.len));
285 break;
286 }
287 break;
288
289 case BT_SET_REPORT:
290 if (len < 2 || len > BT_HID_MTU || s->state != bt_state_ready ||
291 (parameter & 3) == BT_DATA_OTHER ||
292 (parameter & 3) == BT_DATA_INPUT) {
293 ret = BT_HS_ERR_INVALID_PARAMETER;
294 break;
295 }
296 s->data_type = parameter & 3;
297 if (s->data_type == BT_DATA_OUTPUT) {
298 s->dataout.len = len - 1;
299 memcpy(s->dataout.buffer, data + 1, s->dataout.len);
300 } else {
301 s->feature.len = len - 1;
302 memcpy(s->feature.buffer, data + 1, s->feature.len);
303 }
304 if (len == BT_HID_MTU)
305 s->state = bt_state_transaction;
306 else
307 bt_hid_out(s);
308 break;
309
310 case BT_GET_PROTOCOL:
311 if (len != 1 || s->state == bt_state_transaction) {
312 ret = BT_HS_ERR_INVALID_PARAMETER;
313 break;
314 }
315 *s->control->sdu_out(s->control, 1) = s->proto;
316 s->control->sdu_submit(s->control);
317 break;
318
319 case BT_SET_PROTOCOL:
320 if (len != 1 || s->state == bt_state_transaction ||
321 (parameter != BT_HID_PROTO_BOOT &&
322 parameter != BT_HID_PROTO_REPORT)) {
323 ret = BT_HS_ERR_INVALID_PARAMETER;
324 break;
325 }
326 s->proto = parameter;
327 s->usbdev->handle_control(s->usbdev, SET_PROTOCOL, s->proto, 0, 0, 0);
328 ret = BT_HS_SUCCESSFUL;
329 break;
330
331 case BT_GET_IDLE:
332 if (len != 1 || s->state == bt_state_transaction) {
333 ret = BT_HS_ERR_INVALID_PARAMETER;
334 break;
335 }
336 s->usbdev->handle_control(s->usbdev, GET_IDLE, 0, 0, 1,
337 s->control->sdu_out(s->control, 1));
338 s->control->sdu_submit(s->control);
339 break;
340
341 case BT_SET_IDLE:
342 if (len != 2 || s->state == bt_state_transaction) {
343 ret = BT_HS_ERR_INVALID_PARAMETER;
344 break;
345 }
346
347 /* We don't need to know about the Idle Rate here really,
348 * so just pass it on to the device. */
349 ret = s->usbdev->handle_control(s->usbdev,
350 SET_IDLE, data[1], 0, 0, 0) ?
351 BT_HS_SUCCESSFUL : BT_HS_ERR_INVALID_PARAMETER;
352 /* XXX: Does this generate a handshake? */
353 break;
354
355 case BT_DATC:
356 if (len > BT_HID_MTU || s->state != bt_state_transaction) {
357 ret = BT_HS_ERR_INVALID_PARAMETER;
358 break;
359 }
360 if (s->data_type == BT_DATA_OUTPUT) {
361 memcpy(s->dataout.buffer + s->dataout.len, data + 1, len - 1);
362 s->dataout.len += len - 1;
363 } else {
364 memcpy(s->feature.buffer + s->feature.len, data + 1, len - 1);
365 s->feature.len += len - 1;
366 }
367 if (len < BT_HID_MTU) {
368 bt_hid_out(s);
369 s->state = bt_state_ready;
370 }
371 break;
372
373 default:
374 ret = BT_HS_ERR_UNSUPPORTED_REQUEST;
375 }
376
377 if (ret != -1)
378 bt_hid_send_handshake(s, ret);
379}
380
381static void bt_hid_control_sdu(void *opaque, const uint8_t *data, int len)
382{
383 struct bt_hid_device_s *hid = opaque;
384
385 return bt_hid_control_transaction(hid, data, len);
386}
387
388static void bt_hid_datain(void *opaque)
389{
390 struct bt_hid_device_s *hid = opaque;
391
392 /* If suspended, wake-up and send a wake-up event first. We might
393 * want to also inspect the input report and ignore event like
394 * mouse movements until a button event occurs. */
395 if (hid->state == bt_state_suspend) {
396 hid->state = bt_state_ready;
397 }
398
399 if (bt_hid_in(hid) > 0)
400 /* TODO: when in boot-mode precede any Input reports with the ReportID
401 * byte, here and in GetReport/SetReport on the Control channel. */
402 bt_hid_send_data(hid->interrupt, BT_DATA_INPUT,
403 hid->datain.buffer, hid->datain.len);
404}
405
406static void bt_hid_interrupt_sdu(void *opaque, const uint8_t *data, int len)
407{
408 struct bt_hid_device_s *hid = opaque;
409
410 if (len > BT_HID_MTU || len < 1)
411 goto bad;
412 if ((data[0] & 3) != BT_DATA_OUTPUT)
413 goto bad;
414 if ((data[0] >> 4) == BT_DATA) {
415 if (hid->intr_state)
416 goto bad;
417
418 hid->data_type = BT_DATA_OUTPUT;
419 hid->intrdataout.len = 0;
420 } else if ((data[0] >> 4) == BT_DATC) {
421 if (!hid->intr_state)
422 goto bad;
423 } else
424 goto bad;
425
426 memcpy(hid->intrdataout.buffer + hid->intrdataout.len, data + 1, len - 1);
427 hid->intrdataout.len += len - 1;
428 hid->intr_state = (len == BT_HID_MTU);
429 if (!hid->intr_state) {
430 memcpy(hid->dataout.buffer, hid->intrdataout.buffer,
431 hid->dataout.len = hid->intrdataout.len);
432 bt_hid_out(hid);
433 }
434
435 return;
436bad:
437 fprintf(stderr, "%s: bad transaction on Interrupt channel.\n",
438 __FUNCTION__);
439}
440
441/* "Virtual cable" plug/unplug event. */
442static void bt_hid_connected_update(struct bt_hid_device_s *hid)
443{
444 int prev = hid->connected;
445
446 hid->connected = hid->control && hid->interrupt;
447
448 /* Stop page-/inquiry-scanning when a host is connected. */
449 hid->btdev.device.page_scan = !hid->connected;
450 hid->btdev.device.inquiry_scan = !hid->connected;
451
452 if (hid->connected && !prev) {
453 hid->usbdev->handle_reset(hid->usbdev);
454 hid->proto = BT_HID_PROTO_REPORT;
455 }
456
457 /* Should set HIDVirtualCable in SDP (possibly need to check that SDP
458 * isn't destroyed yet, in case we're being called from handle_destroy) */
459}
460
461static void bt_hid_close_control(void *opaque)
462{
463 struct bt_hid_device_s *hid = opaque;
464
465 hid->control = 0;
466 bt_hid_connected_update(hid);
467}
468
469static void bt_hid_close_interrupt(void *opaque)
470{
471 struct bt_hid_device_s *hid = opaque;
472
473 hid->interrupt = 0;
474 bt_hid_connected_update(hid);
475}
476
477static int bt_hid_new_control_ch(struct bt_l2cap_device_s *dev,
478 struct bt_l2cap_conn_params_s *params)
479{
480 struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
481
482 if (hid->control)
483 return 1;
484
485 hid->control = params;
486 hid->control->opaque = hid;
487 hid->control->close = bt_hid_close_control;
488 hid->control->sdu_in = bt_hid_control_sdu;
489
490 bt_hid_connected_update(hid);
491
492 return 0;
493}
494
495static int bt_hid_new_interrupt_ch(struct bt_l2cap_device_s *dev,
496 struct bt_l2cap_conn_params_s *params)
497{
498 struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
499
500 if (hid->interrupt)
501 return 1;
502
503 hid->interrupt = params;
504 hid->interrupt->opaque = hid;
505 hid->interrupt->close = bt_hid_close_interrupt;
506 hid->interrupt->sdu_in = bt_hid_interrupt_sdu;
507
508 bt_hid_connected_update(hid);
509
510 return 0;
511}
512
513static void bt_hid_destroy(struct bt_device_s *dev)
514{
515 struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;
516
517 if (hid->connected)
518 bt_hid_send_control(hid, BT_HC_VIRTUAL_CABLE_UNPLUG);
519 bt_l2cap_device_done(&hid->btdev);
520
521 hid->usbdev->handle_destroy(hid->usbdev);
522
523 qemu_free(hid);
524}
525
526enum peripheral_minor_class {
527 class_other = 0 << 4,
528 class_keyboard = 1 << 4,
529 class_pointing = 2 << 4,
530 class_combo = 3 << 4,
531};
532
533static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
534 USBDevice *dev, enum peripheral_minor_class minor)
535{
536 struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
537 uint32_t class =
538 /* Format type */
539 (0 << 0) |
540 /* Device class */
541 (minor << 2) |
542 (5 << 8) | /* "Peripheral" */
543 /* Service classes */
544 (1 << 13) | /* Limited discoverable mode */
545 (1 << 19); /* Capturing device (?) */
546
547 bt_l2cap_device_init(&s->btdev, net);
548 bt_l2cap_sdp_init(&s->btdev);
549 bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_CTRL,
550 BT_HID_MTU, bt_hid_new_control_ch);
551 bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_INTR,
552 BT_HID_MTU, bt_hid_new_interrupt_ch);
553
554 s->usbdev = dev;
555 s->btdev.device.lmp_name = s->usbdev->devname;
556 usb_hid_datain_cb(s->usbdev, s, bt_hid_datain);
557
558 s->btdev.device.handle_destroy = bt_hid_destroy;
559
560 s->btdev.device.class[0] = (class >> 0) & 0xff;
561 s->btdev.device.class[1] = (class >> 8) & 0xff;
562 s->btdev.device.class[2] = (class >> 16) & 0xff;
563
564 return &s->btdev.device;
565}
566
567struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net)
568{
569 return bt_hid_init(net, usb_keyboard_init(), class_keyboard);
570}
Qemu copy for testing