[qemu.git] / hw / bt-hid.c

/*
 * QEMU Bluetooth HID Profile wrapper for USB HID.
 *
 * Copyright (C) 2007-2008 OpenMoko, Inc.
 * Written by Andrzej Zaborowski <[email protected]>
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 or
 * (at your option) version 3 of the License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

#include "qemu-common.h"
#include "usb.h"
#include "bt.h"

enum hid_transaction_req {
    BT_HANDSHAKE			= 0x0,
    BT_HID_CONTROL			= 0x1,
    BT_GET_REPORT			= 0x4,
    BT_SET_REPORT			= 0x5,
    BT_GET_PROTOCOL			= 0x6,
    BT_SET_PROTOCOL			= 0x7,
    BT_GET_IDLE				= 0x8,
    BT_SET_IDLE				= 0x9,
    BT_DATA				= 0xa,
    BT_DATC				= 0xb,
};

enum hid_transaction_handshake {
    BT_HS_SUCCESSFUL			= 0x0,
    BT_HS_NOT_READY			= 0x1,
    BT_HS_ERR_INVALID_REPORT_ID		= 0x2,
    BT_HS_ERR_UNSUPPORTED_REQUEST	= 0x3,
    BT_HS_ERR_INVALID_PARAMETER		= 0x4,
    BT_HS_ERR_UNKNOWN			= 0xe,
    BT_HS_ERR_FATAL			= 0xf,
};

enum hid_transaction_control {
    BT_HC_NOP				= 0x0,
    BT_HC_HARD_RESET			= 0x1,
    BT_HC_SOFT_RESET			= 0x2,
    BT_HC_SUSPEND			= 0x3,
    BT_HC_EXIT_SUSPEND			= 0x4,
    BT_HC_VIRTUAL_CABLE_UNPLUG		= 0x5,
};

enum hid_protocol {
    BT_HID_PROTO_BOOT			= 0,
    BT_HID_PROTO_REPORT			= 1,
};

enum hid_boot_reportid {
    BT_HID_BOOT_INVALID			= 0,
    BT_HID_BOOT_KEYBOARD,
    BT_HID_BOOT_MOUSE,
};

enum hid_data_pkt {
    BT_DATA_OTHER			= 0,
    BT_DATA_INPUT,
    BT_DATA_OUTPUT,
    BT_DATA_FEATURE,
};

#define BT_HID_MTU			48

/* HID interface requests */
#define GET_REPORT			0xa101
#define GET_IDLE			0xa102
#define GET_PROTOCOL			0xa103
#define SET_REPORT			0x2109
#define SET_IDLE			0x210a
#define SET_PROTOCOL			0x210b

struct bt_hid_device_s {
    struct bt_l2cap_device_s btdev;
    struct bt_l2cap_conn_params_s *control;
    struct bt_l2cap_conn_params_s *interrupt;
    USBDevice *usbdev;

    int proto;
    int connected;
    int data_type;
    int intr_state;
    struct {
        int len;
        uint8_t buffer[1024];
    } dataother, datain, dataout, feature, intrdataout;
    enum {
        bt_state_ready,
        bt_state_transaction,
        bt_state_suspend,
    } state;
};

static void bt_hid_reset(struct bt_hid_device_s *s)
{
    struct bt_scatternet_s *net = s->btdev.device.net;

    /* Go as far as... */
    bt_l2cap_device_done(&s->btdev);
    bt_l2cap_device_init(&s->btdev, net);

    s->usbdev->handle_reset(s->usbdev);
    s->proto = BT_HID_PROTO_REPORT;
    s->state = bt_state_ready;
    s->dataother.len = 0;
    s->datain.len = 0;
    s->dataout.len = 0;
    s->feature.len = 0;
    s->intrdataout.len = 0;
    s->intr_state = 0;
}

static int bt_hid_out(struct bt_hid_device_s *s)
{
    USBPacket p;

    if (s->data_type == BT_DATA_OUTPUT) {
        p.pid = USB_TOKEN_OUT;
        p.devep = 1;
        p.data = s->dataout.buffer;
        p.len = s->dataout.len;
        s->dataout.len = s->usbdev->handle_data(s->usbdev, &p);

        return s->dataout.len;
    }

    if (s->data_type == BT_DATA_FEATURE) {
        /* XXX:
         * does this send a USB_REQ_CLEAR_FEATURE/USB_REQ_SET_FEATURE
         * or a SET_REPORT? */
        p.devep = 0;
    }

    return -1;
}

static int bt_hid_in(struct bt_hid_device_s *s)
{
    USBPacket p;

    p.pid = USB_TOKEN_IN;
    p.devep = 1;
    p.data = s->datain.buffer;
    p.len = sizeof(s->datain.buffer);
    s->datain.len = s->usbdev->handle_data(s->usbdev, &p);

    return s->datain.len;
}

static void bt_hid_send_handshake(struct bt_hid_device_s *s, int result)
{
    *s->control->sdu_out(s->control, 1) =
            (BT_HANDSHAKE << 4) | result;
    s->control->sdu_submit(s->control);
}

static void bt_hid_send_control(struct bt_hid_device_s *s, int operation)
{
    *s->control->sdu_out(s->control, 1) =
            (BT_HID_CONTROL << 4) | operation;
    s->control->sdu_submit(s->control);
}

static void bt_hid_disconnect(struct bt_hid_device_s *s)
{
    /* Disconnect s->control and s->interrupt */
}

static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type,
                const uint8_t *data, int len)
{
    uint8_t *pkt, hdr = (BT_DATA << 4) | type;
    int plen;

    do {
        plen = MIN(len, ch->remote_mtu - 1);
        pkt = ch->sdu_out(ch, plen + 1);

        pkt[0] = hdr;
        if (plen)
            memcpy(pkt + 1, data, plen);
        ch->sdu_submit(ch);

        len -= plen;
        data += plen;
        hdr = (BT_DATC << 4) | type;
    } while (plen == ch->remote_mtu - 1);
}

static void bt_hid_control_transaction(struct bt_hid_device_s *s,
                const uint8_t *data, int len)
{
    uint8_t type, parameter;
    int rlen, ret = -1;
    if (len < 1)
        return;

    type = data[0] >> 4;
    parameter = data[0] & 0xf;

    switch (type) {
    case BT_HANDSHAKE:
    case BT_DATA:
        switch (parameter) {
        default:
            /* These are not expected to be sent this direction.  */
            ret = BT_HS_ERR_INVALID_PARAMETER;
        }
        break;

    case BT_HID_CONTROL:
        if (len != 1 || (parameter != BT_HC_VIRTUAL_CABLE_UNPLUG &&
                                s->state == bt_state_transaction)) {
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        }
        switch (parameter) {
        case BT_HC_NOP:
            break;
        case BT_HC_HARD_RESET:
        case BT_HC_SOFT_RESET:
            bt_hid_reset(s);
            break;
        case BT_HC_SUSPEND:
            if (s->state == bt_state_ready)
                s->state = bt_state_suspend;
            else
                ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        case BT_HC_EXIT_SUSPEND:
            if (s->state == bt_state_suspend)
                s->state = bt_state_ready;
            else
                ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        case BT_HC_VIRTUAL_CABLE_UNPLUG:
            bt_hid_disconnect(s);
            break;
        default:
            ret = BT_HS_ERR_INVALID_PARAMETER;
        }
        break;

    case BT_GET_REPORT:
        /* No ReportIDs declared.  */
        if (((parameter & 8) && len != 3) ||
                        (!(parameter & 8) && len != 1) ||
                        s->state != bt_state_ready) {
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        }
        if (parameter & 8)
            rlen = data[2] | (data[3] << 8);
        else
            rlen = INT_MAX;
        switch (parameter & 3) {
        case BT_DATA_OTHER:
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        case BT_DATA_INPUT:
            /* Here we can as well poll s->usbdev */
            bt_hid_send_data(s->control, BT_DATA_INPUT,
                            s->datain.buffer, MIN(rlen, s->datain.len));
            break;
        case BT_DATA_OUTPUT:
            bt_hid_send_data(s->control, BT_DATA_OUTPUT,
                            s->dataout.buffer, MIN(rlen, s->dataout.len));
            break;
        case BT_DATA_FEATURE:
            bt_hid_send_data(s->control, BT_DATA_FEATURE,
                            s->feature.buffer, MIN(rlen, s->feature.len));
            break;
        }
        break;

    case BT_SET_REPORT:
        if (len < 2 || len > BT_HID_MTU || s->state != bt_state_ready ||
                        (parameter & 3) == BT_DATA_OTHER ||
                        (parameter & 3) == BT_DATA_INPUT) {
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        }
        s->data_type = parameter & 3;
        if (s->data_type == BT_DATA_OUTPUT) {
            s->dataout.len = len - 1;
            memcpy(s->dataout.buffer, data + 1, s->dataout.len);
        } else {
            s->feature.len = len - 1;
            memcpy(s->feature.buffer, data + 1, s->feature.len);
        }
        if (len == BT_HID_MTU)
            s->state = bt_state_transaction;
        else
            bt_hid_out(s);
        break;

    case BT_GET_PROTOCOL:
        if (len != 1 || s->state == bt_state_transaction) {
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        }
        *s->control->sdu_out(s->control, 1) = s->proto;
        s->control->sdu_submit(s->control);
        break;

    case BT_SET_PROTOCOL:
        if (len != 1 || s->state == bt_state_transaction ||
                        (parameter != BT_HID_PROTO_BOOT &&
                         parameter != BT_HID_PROTO_REPORT)) {
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        }
        s->proto = parameter;
        s->usbdev->handle_control(s->usbdev, SET_PROTOCOL, s->proto, 0, 0,
                                  NULL);
        ret = BT_HS_SUCCESSFUL;
        break;

    case BT_GET_IDLE:
        if (len != 1 || s->state == bt_state_transaction) {
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        }
        s->usbdev->handle_control(s->usbdev, GET_IDLE, 0, 0, 1,
                        s->control->sdu_out(s->control, 1));
        s->control->sdu_submit(s->control);
        break;

    case BT_SET_IDLE:
        if (len != 2 || s->state == bt_state_transaction) {
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        }

        /* We don't need to know about the Idle Rate here really,
         * so just pass it on to the device.  */
        ret = s->usbdev->handle_control(s->usbdev,
                        SET_IDLE, data[1], 0, 0, NULL) ?
                BT_HS_SUCCESSFUL : BT_HS_ERR_INVALID_PARAMETER;
        /* XXX: Does this generate a handshake? */
        break;

    case BT_DATC:
        if (len > BT_HID_MTU || s->state != bt_state_transaction) {
            ret = BT_HS_ERR_INVALID_PARAMETER;
            break;
        }
        if (s->data_type == BT_DATA_OUTPUT) {
            memcpy(s->dataout.buffer + s->dataout.len, data + 1, len - 1);
            s->dataout.len += len - 1;
        } else {
            memcpy(s->feature.buffer + s->feature.len, data + 1, len - 1);
            s->feature.len += len - 1;
        }
        if (len < BT_HID_MTU) {
            bt_hid_out(s);
            s->state = bt_state_ready;
        }
        break;

    default:
        ret = BT_HS_ERR_UNSUPPORTED_REQUEST;
    }

    if (ret != -1)
        bt_hid_send_handshake(s, ret);
}

static void bt_hid_control_sdu(void *opaque, const uint8_t *data, int len)
{
    struct bt_hid_device_s *hid = opaque;

    bt_hid_control_transaction(hid, data, len);
}

static void bt_hid_datain(void *opaque)
{
    struct bt_hid_device_s *hid = opaque;

    /* If suspended, wake-up and send a wake-up event first.  We might
     * want to also inspect the input report and ignore event like
     * mouse movements until a button event occurs.  */
    if (hid->state == bt_state_suspend) {
        hid->state = bt_state_ready;
    }

    if (bt_hid_in(hid) > 0)
        /* TODO: when in boot-mode precede any Input reports with the ReportID
         * byte, here and in GetReport/SetReport on the Control channel.  */
        bt_hid_send_data(hid->interrupt, BT_DATA_INPUT,
                        hid->datain.buffer, hid->datain.len);
}

static void bt_hid_interrupt_sdu(void *opaque, const uint8_t *data, int len)
{
    struct bt_hid_device_s *hid = opaque;

    if (len > BT_HID_MTU || len < 1)
        goto bad;
    if ((data[0] & 3) != BT_DATA_OUTPUT)
        goto bad;
    if ((data[0] >> 4) == BT_DATA) {
        if (hid->intr_state)
            goto bad;

        hid->data_type = BT_DATA_OUTPUT;
        hid->intrdataout.len = 0;
    } else if ((data[0] >> 4) == BT_DATC) {
        if (!hid->intr_state)
            goto bad;
    } else
        goto bad;

    memcpy(hid->intrdataout.buffer + hid->intrdataout.len, data + 1, len - 1);
    hid->intrdataout.len += len - 1;
    hid->intr_state = (len == BT_HID_MTU);
    if (!hid->intr_state) {
        memcpy(hid->dataout.buffer, hid->intrdataout.buffer,
                        hid->dataout.len = hid->intrdataout.len);
        bt_hid_out(hid);
    }

    return;
bad:
    fprintf(stderr, "%s: bad transaction on Interrupt channel.\n",
                    __FUNCTION__);
}

/* "Virtual cable" plug/unplug event.  */
static void bt_hid_connected_update(struct bt_hid_device_s *hid)
{
    int prev = hid->connected;

    hid->connected = hid->control && hid->interrupt;

    /* Stop page-/inquiry-scanning when a host is connected.  */
    hid->btdev.device.page_scan = !hid->connected;
    hid->btdev.device.inquiry_scan = !hid->connected;

    if (hid->connected && !prev) {
        hid->usbdev->handle_reset(hid->usbdev);
        hid->proto = BT_HID_PROTO_REPORT;
    }

    /* Should set HIDVirtualCable in SDP (possibly need to check that SDP
     * isn't destroyed yet, in case we're being called from handle_destroy) */
}

static void bt_hid_close_control(void *opaque)
{
    struct bt_hid_device_s *hid = opaque;

    hid->control = NULL;
    bt_hid_connected_update(hid);
}

static void bt_hid_close_interrupt(void *opaque)
{
    struct bt_hid_device_s *hid = opaque;

    hid->interrupt = NULL;
    bt_hid_connected_update(hid);
}

static int bt_hid_new_control_ch(struct bt_l2cap_device_s *dev,
                struct bt_l2cap_conn_params_s *params)
{
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;

    if (hid->control)
        return 1;

    hid->control = params;
    hid->control->opaque = hid;
    hid->control->close = bt_hid_close_control;
    hid->control->sdu_in = bt_hid_control_sdu;

    bt_hid_connected_update(hid);

    return 0;
}

static int bt_hid_new_interrupt_ch(struct bt_l2cap_device_s *dev,
                struct bt_l2cap_conn_params_s *params)
{
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;

    if (hid->interrupt)
        return 1;

    hid->interrupt = params;
    hid->interrupt->opaque = hid;
    hid->interrupt->close = bt_hid_close_interrupt;
    hid->interrupt->sdu_in = bt_hid_interrupt_sdu;

    bt_hid_connected_update(hid);

    return 0;
}

static void bt_hid_destroy(struct bt_device_s *dev)
{
    struct bt_hid_device_s *hid = (struct bt_hid_device_s *) dev;

    if (hid->connected)
        bt_hid_send_control(hid, BT_HC_VIRTUAL_CABLE_UNPLUG);
    bt_l2cap_device_done(&hid->btdev);

    hid->usbdev->handle_destroy(hid->usbdev);

    qemu_free(hid);
}

enum peripheral_minor_class {
    class_other		= 0 << 4,
    class_keyboard	= 1 << 4,
    class_pointing	= 2 << 4,
    class_combo		= 3 << 4,
};

static struct bt_device_s *bt_hid_init(struct bt_scatternet_s *net,
                USBDevice *dev, enum peripheral_minor_class minor)
{
    struct bt_hid_device_s *s = qemu_mallocz(sizeof(*s));
    uint32_t class =
            /* Format type */
            (0 << 0) |
            /* Device class */
            (minor << 2) |
            (5 << 8) |  /* "Peripheral" */
            /* Service classes */
            (1 << 13) | /* Limited discoverable mode */
            (1 << 19);  /* Capturing device (?) */

    bt_l2cap_device_init(&s->btdev, net);
    bt_l2cap_sdp_init(&s->btdev);
    bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_CTRL,
                    BT_HID_MTU, bt_hid_new_control_ch);
    bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_INTR,
                    BT_HID_MTU, bt_hid_new_interrupt_ch);

    s->usbdev = dev;
    s->btdev.device.lmp_name = s->usbdev->devname;
    usb_hid_datain_cb(s->usbdev, s, bt_hid_datain);

    s->btdev.device.handle_destroy = bt_hid_destroy;

    s->btdev.device.class[0] = (class >>  0) & 0xff;
    s->btdev.device.class[1] = (class >>  8) & 0xff;
    s->btdev.device.class[2] = (class >> 16) & 0xff;

    return &s->btdev.device;
}

struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net)
{
    return bt_hid_init(net, usb_keyboard_init(), class_keyboard);
}
Commit	Line	Data
47e699dc AZ	1	/*
	2	* QEMU Bluetooth HID Profile wrapper for USB HID.
	3	*
	4	* Copyright (C) 2007-2008 OpenMoko, Inc.
	5	* Written by Andrzej Zaborowski <[email protected]>
	6	*
	7	* This program is free software; you can redistribute it and/or
	8	* modify it under the terms of the GNU General Public License as
	9	* published by the Free Software Foundation; either version 2 or
	10	* (at your option) version 3 of the License.
	11	*
	12	* This program is distributed in the hope that it will be useful,
	13	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	14	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	15	* GNU General Public License for more details.
	16	*
fad6cb1a AJ	17	* You should have received a copy of the GNU General Public License along
	18	* with this program; if not, write to the Free Software Foundation, Inc.,
	19	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
47e699dc AZ	20	*/
	21
	22	#include "qemu-common.h"
	23	#include "usb.h"
	24	#include "bt.h"
	25
	26	enum hid_transaction_req {
	27	BT_HANDSHAKE = 0x0,
	28	BT_HID_CONTROL = 0x1,
	29	BT_GET_REPORT = 0x4,
	30	BT_SET_REPORT = 0x5,
	31	BT_GET_PROTOCOL = 0x6,
	32	BT_SET_PROTOCOL = 0x7,
	33	BT_GET_IDLE = 0x8,
	34	BT_SET_IDLE = 0x9,
	35	BT_DATA = 0xa,
	36	BT_DATC = 0xb,
	37	};
	38
	39	enum hid_transaction_handshake {
	40	BT_HS_SUCCESSFUL = 0x0,
	41	BT_HS_NOT_READY = 0x1,
	42	BT_HS_ERR_INVALID_REPORT_ID = 0x2,
	43	BT_HS_ERR_UNSUPPORTED_REQUEST = 0x3,
	44	BT_HS_ERR_INVALID_PARAMETER = 0x4,
	45	BT_HS_ERR_UNKNOWN = 0xe,
	46	BT_HS_ERR_FATAL = 0xf,
	47	};
	48
	49	enum hid_transaction_control {
	50	BT_HC_NOP = 0x0,
	51	BT_HC_HARD_RESET = 0x1,
	52	BT_HC_SOFT_RESET = 0x2,
	53	BT_HC_SUSPEND = 0x3,
	54	BT_HC_EXIT_SUSPEND = 0x4,
	55	BT_HC_VIRTUAL_CABLE_UNPLUG = 0x5,
	56	};
	57
	58	enum hid_protocol {
	59	BT_HID_PROTO_BOOT = 0,
	60	BT_HID_PROTO_REPORT = 1,
	61	};
	62
	63	enum hid_boot_reportid {
	64	BT_HID_BOOT_INVALID = 0,
	65	BT_HID_BOOT_KEYBOARD,
	66	BT_HID_BOOT_MOUSE,
	67	};
	68
	69	enum hid_data_pkt {
	70	BT_DATA_OTHER = 0,
	71	BT_DATA_INPUT,
	72	BT_DATA_OUTPUT,
	73	BT_DATA_FEATURE,
	74	};
	75
	76	#define BT_HID_MTU 48
	77
	78	/* HID interface requests */
	79	#define GET_REPORT 0xa101
	80	#define GET_IDLE 0xa102
	81	#define GET_PROTOCOL 0xa103
	82	#define SET_REPORT 0x2109
	83	#define SET_IDLE 0x210a
84	#define SET_PROTOCOL 0x210b
85
86	struct bt_hid_device_s {
87	struct bt_l2cap_device_s btdev;
88	struct bt_l2cap_conn_params_s *control;
89	struct bt_l2cap_conn_params_s *interrupt;
90	USBDevice *usbdev;
91
92	int proto;
93	int connected;
94	int data_type;
95	int intr_state;
96	struct {
97	int len;
98	uint8_t buffer[1024];
99	} dataother, datain, dataout, feature, intrdataout;
100	enum {
101	bt_state_ready,
102	bt_state_transaction,
103	bt_state_suspend,
104	} state;
105	};
106
107	static void bt_hid_reset(struct bt_hid_device_s *s)
108	{
109	struct bt_scatternet_s *net = s->btdev.device.net;
110
111	/* Go as far as... */
112	bt_l2cap_device_done(&s->btdev);
113	bt_l2cap_device_init(&s->btdev, net);
114
115	s->usbdev->handle_reset(s->usbdev);
116	s->proto = BT_HID_PROTO_REPORT;
117	s->state = bt_state_ready;
118	s->dataother.len = 0;
119	s->datain.len = 0;
120	s->dataout.len = 0;
121	s->feature.len = 0;
122	s->intrdataout.len = 0;
123	s->intr_state = 0;
124	}
125
126	static int bt_hid_out(struct bt_hid_device_s *s)
127	{
128	USBPacket p;
129
130	if (s->data_type == BT_DATA_OUTPUT) {
131	p.pid = USB_TOKEN_OUT;
132	p.devep = 1;
133	p.data = s->dataout.buffer;
134	p.len = s->dataout.len;
135	s->dataout.len = s->usbdev->handle_data(s->usbdev, &p);
136
137	return s->dataout.len;
138	}
139
140	if (s->data_type == BT_DATA_FEATURE) {
141	/* XXX:
142	* does this send a USB_REQ_CLEAR_FEATURE/USB_REQ_SET_FEATURE
143	* or a SET_REPORT? */
144	p.devep = 0;
145	}
146
147	return -1;
148	}
149
150	static int bt_hid_in(struct bt_hid_device_s *s)
151	{
152	USBPacket p;
153
154	p.pid = USB_TOKEN_IN;
155	p.devep = 1;
156	p.data = s->datain.buffer;
157	p.len = sizeof(s->datain.buffer);
158	s->datain.len = s->usbdev->handle_data(s->usbdev, &p);
159
160	return s->datain.len;
161	}
162
163	static void bt_hid_send_handshake(struct bt_hid_device_s *s, int result)
164	{
165	*s->control->sdu_out(s->control, 1) =
166	(BT_HANDSHAKE << 4) \| result;
167	s->control->sdu_submit(s->control);
168	}
169
170	static void bt_hid_send_control(struct bt_hid_device_s *s, int operation)
171	{
172	*s->control->sdu_out(s->control, 1) =
173	(BT_HID_CONTROL << 4) \| operation;
174	s->control->sdu_submit(s->control);
175	}
176
177	static void bt_hid_disconnect(struct bt_hid_device_s *s)
178	{
179	/* Disconnect s->control and s->interrupt */
180	}
181
182	static void bt_hid_send_data(struct bt_l2cap_conn_params_s *ch, int type,
183	const uint8_t *data, int len)
184	{
185	uint8_t *pkt, hdr = (BT_DATA << 4) \| type;
186	int plen;
187
188	do {
189	plen = MIN(len, ch->remote_mtu - 1);
190	pkt = ch->sdu_out(ch, plen + 1);
191
192	pkt[0] = hdr;
193	if (plen)
194	memcpy(pkt + 1, data, plen);
195	ch->sdu_submit(ch);
196
197	len -= plen;
198	data += plen;
199	hdr = (BT_DATC << 4) \| type;
200	} while (plen == ch->remote_mtu - 1);
201	}
202
203	static void bt_hid_control_transaction(struct bt_hid_device_s *s,
204	const uint8_t *data, int len)
205	{
206	uint8_t type, parameter;
207	int rlen, ret = -1;
208	if (len < 1)
209	return;
210
211	type = data[0] >> 4;
212	parameter = data[0] & 0xf;
213
214	switch (type) {
215	case BT_HANDSHAKE:
216	case BT_DATA:
217	switch (parameter) {
218	default:
219	/* These are not expected to be sent this direction. */
220	ret = BT_HS_ERR_INVALID_PARAMETER;
221	}
222	break;
223
224	case BT_HID_CONTROL:
225	if (len != 1 \|\| (parameter != BT_HC_VIRTUAL_CABLE_UNPLUG &&
226	s->state == bt_state_transaction)) {
227	ret = BT_HS_ERR_INVALID_PARAMETER;
228	break;
229	}
230	switch (parameter) {
231	case BT_HC_NOP:
232	break;
233	case BT_HC_HARD_RESET:
234	case BT_HC_SOFT_RESET:
235	bt_hid_reset(s);
236	break;
237	case BT_HC_SUSPEND:
238	if (s->state == bt_state_ready)
239	s->state = bt_state_suspend;
240	else
241	ret = BT_HS_ERR_INVALID_PARAMETER;
242	break;
243	case BT_HC_EXIT_SUSPEND:
244	if (s->state == bt_state_suspend)
245	s->state = bt_state_ready;
246	else
247	ret = BT_HS_ERR_INVALID_PARAMETER;
248	break;
249	case BT_HC_VIRTUAL_CABLE_UNPLUG:
250	bt_hid_disconnect(s);
251	break;
252	default:
253	ret = BT_HS_ERR_INVALID_PARAMETER;
254	}
255	break;
256
257	case BT_GET_REPORT:
258	/* No ReportIDs declared. */
259	if (((parameter & 8) && len != 3) \|\|
260	(!(parameter & 8) && len != 1) \|\|
261	s->state != bt_state_ready) {
262	ret = BT_HS_ERR_INVALID_PARAMETER;
263	break;
264	}
265	if (parameter & 8)
266	rlen = data[2] \| (data[3] << 8);
267	else
268	rlen = INT_MAX;
269	switch (parameter & 3) {
270	case BT_DATA_OTHER:
271	ret = BT_HS_ERR_INVALID_PARAMETER;
272	break;
273	case BT_DATA_INPUT:
274	/* Here we can as well poll s->usbdev */
275	bt_hid_send_data(s->control, BT_DATA_INPUT,
276	s->datain.buffer, MIN(rlen, s->datain.len));
277	break;
278	case BT_DATA_OUTPUT:
279	bt_hid_send_data(s->control, BT_DATA_OUTPUT,
280	s->dataout.buffer, MIN(rlen, s->dataout.len));
281	break;
282	case BT_DATA_FEATURE:
283	bt_hid_send_data(s->control, BT_DATA_FEATURE,
284	s->feature.buffer, MIN(rlen, s->feature.len));
285	break;
286	}
287	break;
288
289	case BT_SET_REPORT:
290	if (len < 2 \|\| len > BT_HID_MTU \|\| s->state != bt_state_ready \|\|
291	(parameter & 3) == BT_DATA_OTHER \|\|
292	(parameter & 3) == BT_DATA_INPUT) {
293	ret = BT_HS_ERR_INVALID_PARAMETER;
294	break;
295	}
296	s->data_type = parameter & 3;
297	if (s->data_type == BT_DATA_OUTPUT) {
298	s->dataout.len = len - 1;
299	memcpy(s->dataout.buffer, data + 1, s->dataout.len);
300	} else {
301	s->feature.len = len - 1;
302	memcpy(s->feature.buffer, data + 1, s->feature.len);
303	}
304	if (len == BT_HID_MTU)
305	s->state = bt_state_transaction;
306	else
307	bt_hid_out(s);
308	break;
309
310	case BT_GET_PROTOCOL:
311	if (len != 1 \|\| s->state == bt_state_transaction) {
312	ret = BT_HS_ERR_INVALID_PARAMETER;
313	break;
314	}
315	*s->control->sdu_out(s->control, 1) = s->proto;
316	s->control->sdu_submit(s->control);
317	break;
318
319	case BT_SET_PROTOCOL:
320	if (len != 1 \|\| s->state == bt_state_transaction \|\|
321	(parameter != BT_HID_PROTO_BOOT &&
322	parameter != BT_HID_PROTO_REPORT)) {
323	ret = BT_HS_ERR_INVALID_PARAMETER;
324	break;
325	}
326	s->proto = parameter;
511d2b14 BS	327	s->usbdev->handle_control(s->usbdev, SET_PROTOCOL, s->proto, 0, 0,
511d2b14 BS	328	NULL);
47e699dc AZ	329	ret = BT_HS_SUCCESSFUL;
	330	break;
	331
	332	case BT_GET_IDLE:
	333	if (len != 1 \|\| s->state == bt_state_transaction) {
	334	ret = BT_HS_ERR_INVALID_PARAMETER;
	335	break;
	336	}
	337	s->usbdev->handle_control(s->usbdev, GET_IDLE, 0, 0, 1,
	338	s->control->sdu_out(s->control, 1));
	339	s->control->sdu_submit(s->control);
	340	break;
	341
	342	case BT_SET_IDLE:
	343	if (len != 2 \|\| s->state == bt_state_transaction) {
	344	ret = BT_HS_ERR_INVALID_PARAMETER;
	345	break;
	346	}
	347
	348	/* We don't need to know about the Idle Rate here really,
	349	* so just pass it on to the device. */
	350	ret = s->usbdev->handle_control(s->usbdev,
511d2b14	351	SET_IDLE, data[1], 0, 0, NULL) ?
47e699dc AZ	352	BT_HS_SUCCESSFUL : BT_HS_ERR_INVALID_PARAMETER;
	353	/* XXX: Does this generate a handshake? */
	354	break;
	355
	356	case BT_DATC:
	357	if (len > BT_HID_MTU \|\| s->state != bt_state_transaction) {
	358	ret = BT_HS_ERR_INVALID_PARAMETER;
	359	break;
	360	}
	361	if (s->data_type == BT_DATA_OUTPUT) {
	362	memcpy(s->dataout.buffer + s->dataout.len, data + 1, len - 1);
	363	s->dataout.len += len - 1;
	364	} else {
	365	memcpy(s->feature.buffer + s->feature.len, data + 1, len - 1);
	366	s->feature.len += len - 1;
	367	}
	368	if (len < BT_HID_MTU) {
	369	bt_hid_out(s);
	370	s->state = bt_state_ready;
	371	}
	372	break;
	373
	374	default:
	375	ret = BT_HS_ERR_UNSUPPORTED_REQUEST;
	376	}
	377
	378	if (ret != -1)
	379	bt_hid_send_handshake(s, ret);
	380	}
	381
	382	static void bt_hid_control_sdu(void opaque, const uint8_t data, int len)
	383	{
	384	struct bt_hid_device_s *hid = opaque;
	385
7442511c	386	bt_hid_control_transaction(hid, data, len);
47e699dc AZ	387	}
	388
	389	static void bt_hid_datain(void *opaque)
	390	{
	391	struct bt_hid_device_s *hid = opaque;
	392
	393	/* If suspended, wake-up and send a wake-up event first. We might
	394	* want to also inspect the input report and ignore event like
	395	* mouse movements until a button event occurs. */
	396	if (hid->state == bt_state_suspend) {
	397	hid->state = bt_state_ready;
	398	}
	399
	400	if (bt_hid_in(hid) > 0)
	401	/* TODO: when in boot-mode precede any Input reports with the ReportID
	402	* byte, here and in GetReport/SetReport on the Control channel. */
	403	bt_hid_send_data(hid->interrupt, BT_DATA_INPUT,
	404	hid->datain.buffer, hid->datain.len);
	405	}
	406
	407	static void bt_hid_interrupt_sdu(void opaque, const uint8_t data, int len)
	408	{
	409	struct bt_hid_device_s *hid = opaque;
	410
	411	if (len > BT_HID_MTU \|\| len < 1)
	412	goto bad;
	413	if ((data[0] & 3) != BT_DATA_OUTPUT)
	414	goto bad;
	415	if ((data[0] >> 4) == BT_DATA) {
	416	if (hid->intr_state)
	417	goto bad;
	418
	419	hid->data_type = BT_DATA_OUTPUT;
	420	hid->intrdataout.len = 0;
	421	} else if ((data[0] >> 4) == BT_DATC) {
	422	if (!hid->intr_state)
	423	goto bad;
	424	} else
	425	goto bad;
	426
	427	memcpy(hid->intrdataout.buffer + hid->intrdataout.len, data + 1, len - 1);
	428	hid->intrdataout.len += len - 1;
	429	hid->intr_state = (len == BT_HID_MTU);
	430	if (!hid->intr_state) {
	431	memcpy(hid->dataout.buffer, hid->intrdataout.buffer,
	432	hid->dataout.len = hid->intrdataout.len);
	433	bt_hid_out(hid);
	434	}
	435
	436	return;
	437	bad:
	438	fprintf(stderr, "%s: bad transaction on Interrupt channel.\n",
	439	__FUNCTION__);
	440	}
	441
	442	/* "Virtual cable" plug/unplug event. */
	443	static void bt_hid_connected_update(struct bt_hid_device_s *hid)
	444	{
	445	int prev = hid->connected;
	446
	447	hid->connected = hid->control && hid->interrupt;
	448
	449	/* Stop page-/inquiry-scanning when a host is connected. */
	450	hid->btdev.device.page_scan = !hid->connected;
451	hid->btdev.device.inquiry_scan = !hid->connected;
452
453	if (hid->connected && !prev) {
454	hid->usbdev->handle_reset(hid->usbdev);
455	hid->proto = BT_HID_PROTO_REPORT;
456	}
457
458	/* Should set HIDVirtualCable in SDP (possibly need to check that SDP
459	* isn't destroyed yet, in case we're being called from handle_destroy) */
460	}
461
462	static void bt_hid_close_control(void *opaque)
463	{
464	struct bt_hid_device_s *hid = opaque;
465
511d2b14	466	hid->control = NULL;
47e699dc AZ	467	bt_hid_connected_update(hid);
	468	}
	469
	470	static void bt_hid_close_interrupt(void *opaque)
	471	{
	472	struct bt_hid_device_s *hid = opaque;
	473
511d2b14	474	hid->interrupt = NULL;
47e699dc AZ	475	bt_hid_connected_update(hid);
	476	}
	477
	478	static int bt_hid_new_control_ch(struct bt_l2cap_device_s *dev,
	479	struct bt_l2cap_conn_params_s *params)
	480	{
	481	struct bt_hid_device_s hid = (struct bt_hid_device_s ) dev;
	482
	483	if (hid->control)
	484	return 1;
	485
	486	hid->control = params;
	487	hid->control->opaque = hid;
	488	hid->control->close = bt_hid_close_control;
	489	hid->control->sdu_in = bt_hid_control_sdu;
	490
	491	bt_hid_connected_update(hid);
	492
	493	return 0;
	494	}
	495
	496	static int bt_hid_new_interrupt_ch(struct bt_l2cap_device_s *dev,
	497	struct bt_l2cap_conn_params_s *params)
	498	{
	499	struct bt_hid_device_s hid = (struct bt_hid_device_s ) dev;
	500
	501	if (hid->interrupt)
	502	return 1;
	503
	504	hid->interrupt = params;
	505	hid->interrupt->opaque = hid;
	506	hid->interrupt->close = bt_hid_close_interrupt;
	507	hid->interrupt->sdu_in = bt_hid_interrupt_sdu;
	508
	509	bt_hid_connected_update(hid);
	510
	511	return 0;
	512	}
	513
	514	static void bt_hid_destroy(struct bt_device_s *dev)
	515	{
	516	struct bt_hid_device_s hid = (struct bt_hid_device_s ) dev;
	517
	518	if (hid->connected)
	519	bt_hid_send_control(hid, BT_HC_VIRTUAL_CABLE_UNPLUG);
	520	bt_l2cap_device_done(&hid->btdev);
	521
	522	hid->usbdev->handle_destroy(hid->usbdev);
	523
	524	qemu_free(hid);
	525	}
	526
	527	enum peripheral_minor_class {
	528	class_other = 0 << 4,
	529	class_keyboard = 1 << 4,
	530	class_pointing = 2 << 4,
	531	class_combo = 3 << 4,
	532	};
	533
	534	static struct bt_device_s bt_hid_init(struct bt_scatternet_s net,
	535	USBDevice *dev, enum peripheral_minor_class minor)
	536	{
	537	struct bt_hid_device_s s = qemu_mallocz(sizeof(s));
	538	uint32_t class =
539	/* Format type */
540	(0 << 0) \|
541	/* Device class */
542	(minor << 2) \|
543	(5 << 8) \| /* "Peripheral" */
544	/* Service classes */
545	(1 << 13) \| /* Limited discoverable mode */
546	(1 << 19); /* Capturing device (?) */
547
548	bt_l2cap_device_init(&s->btdev, net);
549	bt_l2cap_sdp_init(&s->btdev);
550	bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_CTRL,
551	BT_HID_MTU, bt_hid_new_control_ch);
552	bt_l2cap_psm_register(&s->btdev, BT_PSM_HID_INTR,
553	BT_HID_MTU, bt_hid_new_interrupt_ch);
554
555	s->usbdev = dev;
556	s->btdev.device.lmp_name = s->usbdev->devname;
557	usb_hid_datain_cb(s->usbdev, s, bt_hid_datain);
558
559	s->btdev.device.handle_destroy = bt_hid_destroy;
560
561	s->btdev.device.class[0] = (class >> 0) & 0xff;
562	s->btdev.device.class[1] = (class >> 8) & 0xff;
563	s->btdev.device.class[2] = (class >> 16) & 0xff;
564
565	return &s->btdev.device;
566	}
567
568	struct bt_device_s bt_keyboard_init(struct bt_scatternet_s net)
569	{
570	return bt_hid_init(net, usb_keyboard_init(), class_keyboard);
571	}