xref: /btstack/src/classic/hid_device.c (revision 536d74bc8da3e59d3c8ef399b9139f5919e29309)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "hid_device.c"
39 
40 #include <string.h>
41 
42 #include "classic/hid_device.h"
43 #include "classic/sdp_util.h"
44 #include "bluetooth.h"
45 #include "bluetooth_sdp.h"
46 #include "l2cap.h"
47 #include "btstack_event.h"
48 #include "btstack_debug.h"
49 #include "btstack_hid_parser.h"
50 
51 typedef enum {
52     HID_DEVICE_IDLE,
53     HID_DEVICE_CONNECTED,
54     HID_DEVICE_W2_GET_REPORT,
55     HID_DEVICE_W2_SET_REPORT,
56     HID_DEVICE_W2_GET_PROTOCOL,
57     HID_DEVICE_W2_SET_PROTOCOL,
58     HID_DEVICE_W2_ANSWER_SET_PROTOCOL,
59     HID_DEVICE_W2_SEND_UNSUPPORTED_REQUEST,
60 } hid_device_state_t;
61 
62 // hid device state
63 typedef struct hid_device {
64     uint16_t  cid;
65     bd_addr_t bd_addr;
66     hci_con_handle_t con_handle;
67     uint16_t  control_cid;
68     uint16_t  interrupt_cid;
69     uint8_t   incoming;
70     uint8_t   connected;
71     hid_device_state_t state;
72     hid_report_type_t report_type;
73     uint16_t  report_id;
74     uint16_t  expected_report_size;
75     uint16_t  report_size;
76 
77     hid_handshake_param_type_t report_status;
78     hid_protocol_mode_t protocol_mode;
79 } hid_device_t;
80 
81 static hid_device_t _hid_device;
82 static uint8_t hid_boot_protocol_mode_supported;
83 static const uint8_t * hid_descriptor;
84 static uint16_t hid_descriptor_len;
85 
86 static int dummy_write_report(uint16_t hid_cid, hid_report_type_t report_type, uint16_t report_id, int * out_report_size, uint8_t * out_report){
87     UNUSED(hid_cid);
88     UNUSED(report_type);
89     UNUSED(report_id);
90     UNUSED(out_report_size);
91     UNUSED(out_report);
92     return -1;
93 }
94 
95 static void dummy_set_report(uint16_t hid_cid, hid_report_type_t report_type, int report_size, uint8_t * report){
96     UNUSED(hid_cid);
97     UNUSED(report_type);
98     UNUSED(report_size);
99     UNUSED(report);
100 }
101 
102 static void dummy_report_data(uint16_t hid_cid, hid_report_type_t report_type, uint16_t report_id, int report_size, uint8_t * report){
103     UNUSED(hid_cid);
104     UNUSED(report_type);
105     UNUSED(report_id);
106     UNUSED(report_size);
107     UNUSED(report);
108 }
109 
110 static int  (*hci_device_get_report) (uint16_t hid_cid, hid_report_type_t report_type, uint16_t report_id, int * out_report_size, uint8_t * out_report) = dummy_write_report;
111 static void (*hci_device_set_report)   (uint16_t hid_cid, hid_report_type_t report_type, int report_size, uint8_t * report) = dummy_set_report;
112 static void (*hci_device_report_data)  (uint16_t hid_cid, hid_report_type_t report_type, uint16_t report_id, int report_size, uint8_t * report) = dummy_report_data;
113 
114 static btstack_packet_handler_t hid_callback;
115 
116 static uint16_t hid_device_cid = 0;
117 
118 static uint16_t hid_device_get_next_cid(void){
119     hid_device_cid++;
120     if (!hid_device_cid){
121         hid_device_cid = 1;
122     }
123     return hid_device_cid;
124 }
125 
126 // TODO: store hid device connection into list
127 static hid_device_t * hid_device_get_instance_for_l2cap_cid(uint16_t cid){
128     if (_hid_device.control_cid == cid || _hid_device.interrupt_cid == cid){
129         return &_hid_device;
130     }
131     return NULL;
132 }
133 
134 static hid_device_t * hid_device_get_instance_for_hid_cid(uint16_t hid_cid){
135     if (_hid_device.cid == hid_cid){
136         return &_hid_device;
137     }
138     return NULL;
139 }
140 
141 static hid_device_t * hid_device_provide_instance_for_bd_addr(bd_addr_t bd_addr){
142     if (!_hid_device.cid){
143         memcpy(_hid_device.bd_addr, bd_addr, 6);
144         _hid_device.cid = hid_device_get_next_cid();
145         _hid_device.protocol_mode = HID_PROTOCOL_MODE_REPORT;
146         _hid_device.con_handle = HCI_CON_HANDLE_INVALID;
147     }
148     return &_hid_device;
149 }
150 
151 static hid_device_t * hid_device_create_instance(void){
152 
153     return &_hid_device;
154 }
155 
156 void hid_create_sdp_record(
157     uint8_t *service,
158     uint32_t service_record_handle,
159     uint16_t hid_device_subclass,
160     uint8_t  hid_country_code,
161     uint8_t  hid_virtual_cable,
162     uint8_t  hid_reconnect_initiate,
163     uint8_t  hid_boot_device,
164     const uint8_t * descriptor, uint16_t descriptor_size,
165     const char *device_name){
166 
167     uint8_t * attribute;
168     de_create_sequence(service);
169 
170     de_add_number(service, DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_SERVICE_RECORD_HANDLE);
171     de_add_number(service, DE_UINT, DE_SIZE_32, service_record_handle);
172 
173     de_add_number(service, DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_SERVICE_CLASS_ID_LIST);
174     attribute = de_push_sequence(service);
175     {
176         de_add_number(attribute,  DE_UUID, DE_SIZE_16, BLUETOOTH_SERVICE_CLASS_HUMAN_INTERFACE_DEVICE_SERVICE);
177     }
178     de_pop_sequence(service, attribute);
179 
180     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_PROTOCOL_DESCRIPTOR_LIST);
181     attribute = de_push_sequence(service);
182     {
183         uint8_t * l2cpProtocol = de_push_sequence(attribute);
184         {
185             de_add_number(l2cpProtocol,  DE_UUID, DE_SIZE_16, BLUETOOTH_PROTOCOL_L2CAP);
186             de_add_number(l2cpProtocol,  DE_UINT, DE_SIZE_16, PSM_HID_CONTROL);
187         }
188         de_pop_sequence(attribute, l2cpProtocol);
189 
190         uint8_t * hidProtocol = de_push_sequence(attribute);
191         {
192             de_add_number(hidProtocol,  DE_UUID, DE_SIZE_16, BLUETOOTH_PROTOCOL_HIDP);
193         }
194         de_pop_sequence(attribute, hidProtocol);
195     }
196     de_pop_sequence(service, attribute);
197 
198     // TODO?
199     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_LANGUAGE_BASE_ATTRIBUTE_ID_LIST);
200     attribute = de_push_sequence(service);
201     {
202         de_add_number(attribute, DE_UINT, DE_SIZE_16, 0x656e);
203         de_add_number(attribute, DE_UINT, DE_SIZE_16, 0x006a);
204         de_add_number(attribute, DE_UINT, DE_SIZE_16, 0x0100);
205     }
206     de_pop_sequence(service, attribute);
207 
208     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_ADDITIONAL_PROTOCOL_DESCRIPTOR_LISTS);
209     attribute = de_push_sequence(service);
210     {
211         uint8_t * additionalDescriptorAttribute = de_push_sequence(attribute);
212         {
213             uint8_t * l2cpProtocol = de_push_sequence(additionalDescriptorAttribute);
214             {
215                 de_add_number(l2cpProtocol,  DE_UUID, DE_SIZE_16, BLUETOOTH_PROTOCOL_L2CAP);
216                 de_add_number(l2cpProtocol,  DE_UINT, DE_SIZE_16, PSM_HID_INTERRUPT);
217             }
218             de_pop_sequence(additionalDescriptorAttribute, l2cpProtocol);
219 
220             uint8_t * hidProtocol = de_push_sequence(additionalDescriptorAttribute);
221             {
222                 de_add_number(hidProtocol,  DE_UUID, DE_SIZE_16, BLUETOOTH_PROTOCOL_HIDP);
223             }
224             de_pop_sequence(additionalDescriptorAttribute, hidProtocol);
225         }
226         de_pop_sequence(attribute, additionalDescriptorAttribute);
227     }
228     de_pop_sequence(service, attribute);
229 
230     // 0x0100 "ServiceName"
231     de_add_number(service,  DE_UINT, DE_SIZE_16, 0x0100);
232     de_add_data(service,  DE_STRING, strlen(device_name), (uint8_t *) device_name);
233 
234     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_BLUETOOTH_PROFILE_DESCRIPTOR_LIST);
235     attribute = de_push_sequence(service);
236     {
237         uint8_t * hidProfile = de_push_sequence(attribute);
238         {
239             de_add_number(hidProfile,  DE_UUID, DE_SIZE_16, BLUETOOTH_SERVICE_CLASS_HUMAN_INTERFACE_DEVICE_SERVICE);
240             de_add_number(hidProfile,  DE_UINT, DE_SIZE_16, 0x0101);    // Version 1.1
241         }
242         de_pop_sequence(attribute, hidProfile);
243     }
244     de_pop_sequence(service, attribute);
245 
246     // Deprecated in v1.1.1
247     // de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_DEVICE_RELEASE_NUMBER);
248     // de_add_number(service,  DE_UINT, DE_SIZE_16, 0x0101);
249 
250     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_PARSER_VERSION);
251     de_add_number(service,  DE_UINT, DE_SIZE_16, 0x0111);  // v1.1.1
252 
253     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_DEVICE_SUBCLASS);
254     de_add_number(service,  DE_UINT, DE_SIZE_8,  hid_device_subclass);
255 
256     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_COUNTRY_CODE);
257     de_add_number(service,  DE_UINT, DE_SIZE_8,  hid_country_code);
258 
259     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_VIRTUAL_CABLE);
260     de_add_number(service,  DE_BOOL, DE_SIZE_8,  hid_virtual_cable);
261 
262     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_RECONNECT_INITIATE);
263     de_add_number(service,  DE_BOOL, DE_SIZE_8,  hid_reconnect_initiate);
264 
265     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_DESCRIPTOR_LIST);
266     attribute = de_push_sequence(service);
267     {
268         uint8_t* hidDescriptor = de_push_sequence(attribute);
269         {
270             de_add_number(hidDescriptor,  DE_UINT, DE_SIZE_8, 0x22);    // Report Descriptor
271             de_add_data(hidDescriptor,  DE_STRING, descriptor_size, (uint8_t *) descriptor);
272         }
273         de_pop_sequence(attribute, hidDescriptor);
274     }
275     de_pop_sequence(service, attribute);
276 
277     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HIDLANGID_BASE_LIST);
278     attribute = de_push_sequence(service);
279     {
280         uint8_t* hig_lang_base = de_push_sequence(attribute);
281         {
282             // see: http://www.usb.org/developers/docs/USB_LANGIDs.pdf
283             de_add_number(hig_lang_base,  DE_UINT, DE_SIZE_16, 0x0409);    // HIDLANGID = English (US)
284             de_add_number(hig_lang_base,  DE_UINT, DE_SIZE_16, 0x0100);    // HIDLanguageBase = 0x0100 default
285         }
286         de_pop_sequence(attribute, hig_lang_base);
287     }
288     de_pop_sequence(service, attribute);
289 
290     uint8_t hid_remote_wake = 1;
291     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_REMOTE_WAKE);
292     de_add_number(service,  DE_BOOL, DE_SIZE_8,  hid_remote_wake);
293 
294     de_add_number(service,  DE_UINT, DE_SIZE_16, BLUETOOTH_ATTRIBUTE_HID_BOOT_DEVICE);
295     de_add_number(service,  DE_BOOL, DE_SIZE_8,  hid_boot_device);
296 }
297 
298 static inline void hid_device_emit_connected_event(hid_device_t * context, uint8_t status){
299     uint8_t event[15];
300     int pos = 0;
301     event[pos++] = HCI_EVENT_HID_META;
302     pos++;  // skip len
303     event[pos++] = HID_SUBEVENT_CONNECTION_OPENED;
304     little_endian_store_16(event,pos,context->cid);
305     pos+=2;
306     event[pos++] = status;
307     reverse_bd_addr(context->bd_addr, &event[pos]);
308     pos += 6;
309     little_endian_store_16(event,pos,context->con_handle);
310     pos += 2;
311     event[pos++] = context->incoming;
312     event[1] = pos - 2;
313     if (pos != sizeof(event)) log_error("hid_device_emit_connected_event size %u", pos);
314     hid_callback(HCI_EVENT_PACKET, context->cid, &event[0], pos);
315 }
316 
317 static inline void hid_device_emit_connection_closed_event(hid_device_t * context){
318     uint8_t event[5];
319     int pos = 0;
320     event[pos++] = HCI_EVENT_HID_META;
321     pos++;  // skip len
322     event[pos++] = HID_SUBEVENT_CONNECTION_CLOSED;
323     little_endian_store_16(event,pos,context->cid);
324     pos+=2;
325     event[1] = pos - 2;
326     if (pos != sizeof(event)) log_error("hid_device_emit_connection_closed_event size %u", pos);
327     hid_callback(HCI_EVENT_PACKET, context->cid, &event[0], pos);
328 }
329 
330 static inline void hid_device_emit_can_send_now_event(hid_device_t * context){
331     uint8_t event[5];
332     int pos = 0;
333     event[pos++] = HCI_EVENT_HID_META;
334     pos++;  // skip len
335     event[pos++] = HID_SUBEVENT_CAN_SEND_NOW;
336     little_endian_store_16(event,pos,context->cid);
337     pos+=2;
338     event[1] = pos - 2;
339     if (pos != sizeof(event)) log_error("hid_device_emit_can_send_now_event size %u", pos);
340     hid_callback(HCI_EVENT_PACKET, context->cid, &event[0], pos);
341 }
342 
343 static inline void hid_device_emit_event(hid_device_t * context, uint8_t subevent_type){
344     uint8_t event[4];
345     int pos = 0;
346     event[pos++] = HCI_EVENT_HID_META;
347     pos++;  // skip len
348     event[pos++] = subevent_type;
349     little_endian_store_16(event,pos,context->cid);
350     pos+=2;
351     event[1] = pos - 2;
352     if (pos != sizeof(event)) log_error("hid_device_emit_event size %u", pos);
353     hid_callback(HCI_EVENT_PACKET, context->cid, &event[0], pos);
354 }
355 
356 static int hid_report_size_valid(uint16_t cid, int report_id, hid_report_type_t report_type, int report_size){
357     if (!report_size) return 0;
358     if (hid_device_in_boot_protocol_mode(cid)){
359         switch (report_id){
360             case HID_BOOT_MODE_KEYBOARD_ID:
361                 if (report_size < 8) return 0;
362                 break;
363             case HID_BOOT_MODE_MOUSE_ID:
364                 if (report_size < 1) return 0;
365                 break;
366             default:
367                 return 0;
368         }
369     } else {
370         int size =  btstack_hid_get_report_size_for_id(report_id, report_type, hid_descriptor_len, hid_descriptor);
371         if (size == 0 || size != report_size) return 0;
372     }
373     return 1;
374 }
375 
376 static int hid_get_report_size_for_id(uint16_t cid, int report_id, hid_report_type_t report_type, uint16_t descriptor_len, const uint8_t * descriptor){
377     if (hid_device_in_boot_protocol_mode(cid)){
378         switch (report_id){
379             case HID_BOOT_MODE_KEYBOARD_ID:
380                 return 8;
381             case HID_BOOT_MODE_MOUSE_ID:
382                 return 3;
383             default:
384                 return 0;
385         }
386     } else {
387         return btstack_hid_get_report_size_for_id(report_id, report_type, descriptor_len, descriptor);
388     }
389 }
390 
391 static hid_report_id_status_t hid_report_id_status(uint16_t cid, uint16_t report_id){
392     if (hid_device_in_boot_protocol_mode(cid)){
393         switch (report_id){
394             case HID_BOOT_MODE_KEYBOARD_ID:
395             case HID_BOOT_MODE_MOUSE_ID:
396                 return HID_REPORT_ID_VALID;
397             default:
398                 return HID_REPORT_ID_INVALID;
399         }
400     } else {
401         return btstack_hid_id_valid(report_id, hid_descriptor_len, hid_descriptor);
402     }
403 }
404 
405 static hid_handshake_param_type_t hid_device_set_report_cmd_is_valid(uint16_t cid, hid_report_type_t report_type, int report_size, uint8_t * report){
406     int pos = 0;
407     int report_id = 0;
408 
409     if (btstack_hid_report_id_declared(hid_descriptor_len, hid_descriptor)){
410         report_id = report[pos++];
411         hid_report_id_status_t report_id_status = hid_report_id_status(cid, report_id);
412         switch (report_id_status){
413             case HID_REPORT_ID_INVALID:
414                 return HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_REPORT_ID;
415             default:
416                 break;
417         }
418         // printf("hid_device_set_report_cmd_is_valid: report_id %d, status %d \n", report_id, report_id_status);
419     }
420 
421     if (!hid_report_size_valid(cid, report_id, report_type, report_size-pos)){
422         // TODO clarify DCT/BI-03c
423         return HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
424     }
425     return HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL;
426 }
427 
428 static void packet_handler(uint8_t packet_type, uint16_t channel, uint8_t * packet, uint16_t packet_size){
429     UNUSED(channel);
430     UNUSED(packet_size);
431     int connected_before;
432     uint16_t psm;
433     uint8_t status;
434     hid_device_t * device = NULL;
435     uint8_t param;
436     bd_addr_t address;
437     uint16_t local_cid;
438     int pos = 0;
439     int report_size;
440     uint8_t report[48];
441     hid_message_type_t message_type;
442 
443     switch (packet_type){
444         case L2CAP_DATA_PACKET:
445             device = hid_device_get_instance_for_l2cap_cid(channel);
446             if (!device) {
447                 log_error("no device with cid 0x%02x", channel);
448                 return;
449             }
450             message_type = (hid_message_type_t)(packet[0] >> 4);
451             // printf("L2CAP_DATA_PACKET message_type %d, packet_size %d  \n", message_type, packet_size);
452             switch (message_type){
453                 case HID_MESSAGE_TYPE_GET_REPORT:
454 
455                     pos = 0;
456                     device->report_type = (hid_report_type_t)(packet[pos++] & 0x03);
457                     device->report_id = 0;
458                     device->report_status = HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL;
459                     device->state = HID_DEVICE_W2_GET_REPORT;
460 
461                     switch (device->protocol_mode){
462                         case HID_PROTOCOL_MODE_BOOT:
463                             if (packet_size < 2){
464                                 device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
465                                 break;
466                             }
467                             device->report_id = packet[pos++];
468                             break;
469                         case HID_PROTOCOL_MODE_REPORT:
470                             if (!btstack_hid_report_id_declared(hid_descriptor_len, hid_descriptor)) {
471                                 if (packet_size < 2) break;
472                                 if (packet[0] & 0x08){
473                                     if (packet_size > 2) {
474                                         device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_REPORT_ID;
475                                     }
476                                 } else {
477                                     if (packet_size > 1) {
478                                         device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_REPORT_ID;
479                                     }
480                                 }
481                                 break;
482                             }
483                             if (packet_size < 2){
484                                 device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
485                                 break;
486                             }
487                             device->report_id = packet[pos++];
488                             break;
489                     }
490                     if (device->report_status != HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL){
491                         hid_device_request_can_send_now_event(channel);
492                         break;
493                     }
494                     switch (hid_report_id_status(device->cid, device->report_id)){
495                         case HID_REPORT_ID_INVALID:
496                             device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_REPORT_ID;
497                             break;
498                         default:
499                             break;
500                     }
501 
502                     device->expected_report_size = hid_get_report_size_for_id(device->cid, device->report_id, device->report_type, hid_descriptor_len, hid_descriptor);
503                     report_size =  device->expected_report_size + pos; // add 1 for header size and report id
504 
505                     if ((packet[0] & 0x08) && packet_size >= pos + 1){
506                         device->report_size = btstack_min(btstack_min(little_endian_read_16(packet, pos), report_size), sizeof(report));
507                     } else {
508                         device->report_size = btstack_min(btstack_min(l2cap_max_mtu(), report_size), sizeof(report));
509                     }
510 
511                     hid_device_request_can_send_now_event(channel);
512                     break;
513 
514                 case HID_MESSAGE_TYPE_SET_REPORT:
515                     device->state = HID_DEVICE_W2_SET_REPORT;
516                     device->report_size = l2cap_max_mtu();
517                     device->report_type = (hid_report_type_t)(packet[0] & 0x03);
518                     if (packet_size < 1){
519                         device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
520                         break;
521                     }
522 
523                     switch (device->protocol_mode){
524                         case HID_PROTOCOL_MODE_BOOT:
525                             // printf("HID_PROTOCOL_MODE_BOOT \n");
526                             if (packet_size < 3){
527                                 device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
528                                 break;
529                             }
530                             device->report_id = packet[1];
531                             device->report_status = hid_device_set_report_cmd_is_valid(device->cid, device->report_type, packet_size - 1, &packet[1]);
532                             if (device->report_status != HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL) break;
533                             (*hci_device_set_report)(device->cid, device->report_type, packet_size-1, &packet[1]);
534                             break;
535                         case HID_PROTOCOL_MODE_REPORT:
536                             // printf("HID_PROTOCOL_MODE_REPORT \n");
537                             device->report_status = hid_device_set_report_cmd_is_valid(device->cid, device->report_type, packet_size - 1, &packet[1]);
538                             if (device->report_status != HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL) break;
539 
540                             if (packet_size >= 2){
541                                 (*hci_device_set_report)(device->cid, device->report_type, packet_size-1, &packet[1]);
542                             } else {
543                                 uint8_t payload[] = {0};
544                                 (*hci_device_set_report)(device->cid, device->report_type, 1, payload);
545                             }
546                             break;
547                     }
548                     device->report_type = (hid_report_type_t)(packet[0] & 0x03);
549                     hid_device_request_can_send_now_event(channel);
550                     // l2cap_request_can_send_now_event(device->control_cid);
551                     break;
552                 case HID_MESSAGE_TYPE_GET_PROTOCOL:
553                     // printf(" HID_MESSAGE_TYPE_GET_PROTOCOL\n");
554                     device->state = HID_DEVICE_W2_GET_PROTOCOL;
555                     if (packet_size != 1) {
556                         device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
557                         break;
558                     }
559                     device->report_status = HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL;
560                     // hid_device_request_can_send_now_event(channel);
561                     // printf("HID_MESSAGE_TYPE_GET_PROTOCOL l2cap_request_can_send_now_event\n");
562                     l2cap_request_can_send_now_event(device->control_cid);
563                     break;
564 
565                 case HID_MESSAGE_TYPE_SET_PROTOCOL:
566                     device->state = HID_DEVICE_W2_SET_PROTOCOL;
567                     if (packet_size != 1) {
568                         device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
569                         break;
570                     }
571                     param = packet[0] & 0x01;
572                     if (param == HID_PROTOCOL_MODE_BOOT && !hid_boot_protocol_mode_supported){
573                         device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
574                         break;
575                     }
576                     device->protocol_mode = (hid_protocol_mode_t) param;
577                     switch (device->protocol_mode){
578                         case HID_PROTOCOL_MODE_BOOT:
579                             // printf("Set protocol mode to BOOT\n");
580                             break;
581                         case HID_PROTOCOL_MODE_REPORT:
582                             // printf("Set protocol mode to REPORT\n");
583                             break;
584                     }
585                     device->report_status = HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL;
586                     hid_device_request_can_send_now_event(channel);
587                     break;
588 
589                 case HID_MESSAGE_TYPE_HID_CONTROL:
590                     param = packet[0] & 0x0F;
591                     switch (param){
592                         case HID_CONTROL_PARAM_SUSPEND:
593                             hid_device_emit_event(device, HID_SUBEVENT_SUSPEND);
594                             break;
595                         case HID_CONTROL_PARAM_EXIT_SUSPEND:
596                             hid_device_emit_event(device, HID_SUBEVENT_EXIT_SUSPEND);
597                             break;
598                         default:
599                             device->state = HID_DEVICE_W2_SEND_UNSUPPORTED_REQUEST;
600                             hid_device_request_can_send_now_event(channel);
601                             // l2cap_request_can_send_now_event(device->control_cid);
602                             break;
603                     }
604                     break;
605 
606                 case HID_MESSAGE_TYPE_DATA:
607                     if (packet_size < 2) {
608                         break;
609                     }
610                     pos = 0;
611                     device->report_type = (hid_report_type_t)(packet[pos++] & 0x03);
612                     device->report_id = 0;
613                     if (btstack_hid_report_id_declared(hid_descriptor_len, hid_descriptor)){
614                         device->report_id = packet[pos++];
615                     }
616 
617                     if (hid_report_id_status(device->cid, device->report_id) == HID_REPORT_ID_INVALID){
618                         log_info("Ignore invalid report data packet");
619                         break;
620                     }
621                     if (!hid_report_size_valid(device->cid, device->report_id, device->report_type, packet_size - pos)){
622                         log_info("Ignore invalid report data packet, invalid size");
623                         break;
624                     }
625                     (*hci_device_report_data)(device->cid, device->report_type, device->report_id, packet_size - pos, &packet[pos]);
626                     break;
627                 default:
628                     // printf("HID_DEVICE_W2_SEND_UNSUPPORTED_REQUEST %d  \n", message_type);
629                     device->state = HID_DEVICE_W2_SEND_UNSUPPORTED_REQUEST;
630                     // l2cap_request_can_send_now_event(device->control_cid);
631                     hid_device_request_can_send_now_event(channel);
632                     break;
633             }
634             break;
635         case HCI_EVENT_PACKET:
636             switch (packet[0]){
637                 case L2CAP_EVENT_INCOMING_CONNECTION:
638                     switch (l2cap_event_incoming_connection_get_psm(packet)){
639                         case PSM_HID_CONTROL:
640                         case PSM_HID_INTERRUPT:
641                             l2cap_event_incoming_connection_get_address(packet, address);
642                             device = hid_device_provide_instance_for_bd_addr(address);
643                             if (!device) {
644                                 log_error("L2CAP_EVENT_INCOMING_CONNECTION, cannot create instance for %s", bd_addr_to_str(address));
645                                 l2cap_decline_connection(channel);
646                                 break;
647                             }
648                             if (device->con_handle == HCI_CON_HANDLE_INVALID || l2cap_event_incoming_connection_get_handle(packet) == device->con_handle){
649                                 device->con_handle = l2cap_event_incoming_connection_get_handle(packet);
650                                 device->incoming = 1;
651                                 l2cap_event_incoming_connection_get_address(packet, device->bd_addr);
652                                 psm = l2cap_event_incoming_connection_get_psm(packet);
653                                 switch (psm){
654                                     case PSM_HID_CONTROL:
655                                         device->control_cid = l2cap_event_incoming_connection_get_local_cid(packet);
656                                         break;
657                                     case PSM_HID_INTERRUPT:
658                                         device->interrupt_cid = l2cap_event_incoming_connection_get_local_cid(packet);
659                                     break;
660                                     default:
661                                         break;
662                                 }
663 
664                                 l2cap_accept_connection(channel);
665                             } else {
666                                 l2cap_decline_connection(channel);
667                                 log_info("L2CAP_EVENT_INCOMING_CONNECTION, decline connection for %s", bd_addr_to_str(address));
668                             }
669                             break;
670                         default:
671                             l2cap_decline_connection(channel);
672                             break;
673                     }
674                     break;
675                 case L2CAP_EVENT_CHANNEL_OPENED:
676                     device = hid_device_get_instance_for_l2cap_cid(l2cap_event_channel_opened_get_local_cid(packet));
677                     if (!device) {
678                         log_error("L2CAP_EVENT_CHANNEL_OPENED, no hid device for local cid 0x%02x", l2cap_event_channel_opened_get_local_cid(packet));
679                         return;
680                     }
681                     status = l2cap_event_channel_opened_get_status(packet);
682                     if (status) {
683                         if (device->incoming == 0){
684                             // report error for outgoing connection
685                             hid_device_emit_connected_event(device, status);
686                         }
687                         return;
688                     }
689                     psm = l2cap_event_channel_opened_get_psm(packet);
690                     connected_before = device->connected;
691                     switch (psm){
692                         case PSM_HID_CONTROL:
693                             device->control_cid = l2cap_event_channel_opened_get_local_cid(packet);
694                             device->con_handle  = l2cap_event_incoming_connection_get_handle(packet);
695                             break;
696                         case PSM_HID_INTERRUPT:
697                             device->interrupt_cid = l2cap_event_channel_opened_get_local_cid(packet);
698                             break;
699                         default:
700                             break;
701                     }
702 
703                     // connect HID Interrupt for outgoing
704                     if (device->incoming == 0 && psm == PSM_HID_CONTROL){
705                         // printf("Create outgoing HID Interrupt\n");
706                         status = l2cap_create_channel(packet_handler, device->bd_addr, PSM_HID_INTERRUPT, 48, &device->interrupt_cid);
707                         break;
708                     }
709                     if (!connected_before && device->control_cid && device->interrupt_cid){
710                         device->connected = 1;
711                         hid_device_emit_connected_event(device, 0);
712                     }
713                     break;
714                 case L2CAP_EVENT_CHANNEL_CLOSED:
715                     device = hid_device_get_instance_for_l2cap_cid(l2cap_event_channel_closed_get_local_cid(packet));
716                     if (!device) return;
717 
718                     // connected_before = device->connected;
719                     device->incoming  = 0;
720                     if (l2cap_event_channel_closed_get_local_cid(packet) == device->interrupt_cid){
721                         device->interrupt_cid = 0;
722                     }
723                     if (l2cap_event_channel_closed_get_local_cid(packet) == device->control_cid){
724                         device->control_cid = 0;
725                     }
726                     if (!device->interrupt_cid && !device->control_cid){
727                         device->connected = 0;
728                         device->con_handle = HCI_CON_HANDLE_INVALID;
729                         device->cid = 0;
730                         hid_device_emit_connection_closed_event(device);
731                     }
732                     break;
733 
734                 case L2CAP_EVENT_CAN_SEND_NOW:
735                     local_cid = l2cap_event_can_send_now_get_local_cid(packet);
736                     device = hid_device_get_instance_for_l2cap_cid(local_cid);
737 
738                     if (!device) return;
739                     switch (device->state){
740                         case HID_DEVICE_W2_GET_REPORT:{
741                             // printf("HID_DEVICE_W2_GET_REPORT. on entry device->report_status %d \n", device->report_status);
742                             if (device->report_status != HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL) {
743                                 report[0] = (HID_MESSAGE_TYPE_HANDSHAKE << 4) | device->report_status;
744                                 hid_device_send_control_message(device->cid, &report[0], 1);
745                                 break;
746                             }
747 
748                             pos = 0;
749                             report[pos++] = (HID_MESSAGE_TYPE_DATA << 4) | device->report_type;
750                             if (device->report_id){
751                                 report[pos++] = device->report_id;
752                             }
753                             // printf(" report size with header and id %d\n", pos);
754 
755                             report_size = 0;
756                             status = (*hci_device_get_report)(device->cid, device->report_type, device->report_id, &report_size, &report[pos]);
757                             // printf(" report size %d, status after callback %d, expected report_size %d\n", report_size + pos, status, device->report_size + pos);
758 
759                             switch (status){
760                                 case 0:
761                                     device->report_status = HID_HANDSHAKE_PARAM_TYPE_NOT_READY;
762                                     break;
763                                 case 1:
764                                     if (report_size == 0){
765                                         device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_UNSUPPORTED_REQUEST;
766                                         break;
767                                     }
768                                     if (device->expected_report_size != report_size){
769                                         log_error("Expected report size of %d bytes, received %d", device->expected_report_size, report_size);
770                                         device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_UNSUPPORTED_REQUEST;
771                                         break;
772                                     }
773                                     break;
774                                 default:
775                                     device->report_status = HID_HANDSHAKE_PARAM_TYPE_ERR_UNSUPPORTED_REQUEST;
776                                     break;
777                             }
778                             if (device->report_status != HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL){
779                                 report[0] = (HID_MESSAGE_TYPE_HANDSHAKE << 4) | device->report_status;
780                                 hid_device_send_control_message(device->cid, &report[0], 1);
781                                 break;
782                             }
783 
784                             // if (report_size > l2cap_max_mtu()){
785                             //     report[0] = (HID_MESSAGE_TYPE_HANDSHAKE << 4) | HID_HANDSHAKE_PARAM_TYPE_ERR_INVALID_PARAMETER;
786                             //     hid_device_send_control_message(device->cid, &report[0], 1);
787                             //     break;
788                             // }
789 
790                             // printf("report type %d, report_size %d, report_size %d \n", device->report_type, report_size, device->report_size);
791                             hid_device_send_control_message(device->cid, &report[0], device->report_size);
792                             //     device->state = HID_DEVICE_IDLE;
793                             break;
794                         }
795                         case HID_DEVICE_W2_SET_REPORT:
796                         case HID_DEVICE_W2_SET_PROTOCOL:
797                             report[0] = (HID_MESSAGE_TYPE_HANDSHAKE << 4) | device->report_status;
798                             hid_device_send_control_message(device->cid, &report[0], 1);
799                             break;
800                         case HID_DEVICE_W2_GET_PROTOCOL:
801                             if (device->report_status != HID_HANDSHAKE_PARAM_TYPE_SUCCESSFUL){
802                                 // printf("send HID_MESSAGE_TYPE_HANDSHAKE, report_status %d \n", device->report_status);
803                                 report[0] = (HID_MESSAGE_TYPE_HANDSHAKE << 4) | device->report_status;
804                                 hid_device_send_control_message(device->cid, &report[0], 1);
805                                 break;
806                             }
807 
808                             // printf("send HID_MESSAGE_TYPE_DATA, protocol_mode %d \n", device->protocol_mode);
809                             report[0] = (HID_MESSAGE_TYPE_DATA << 4);
810                             report[1] =  device->protocol_mode;
811                             hid_device_send_control_message(device->cid, &report[0], 2);
812                             break;
813 
814 
815                         case HID_DEVICE_W2_SEND_UNSUPPORTED_REQUEST:
816                             report[0] = (HID_MESSAGE_TYPE_HANDSHAKE << 4) | HID_HANDSHAKE_PARAM_TYPE_ERR_UNSUPPORTED_REQUEST;
817                             hid_device_send_control_message(device->cid, &report[0], 1);
818                             break;
819                         default:
820                             log_info("HID Can send now, emit event");
821                             hid_device_emit_can_send_now_event(device);
822                             // device->state = HID_DEVICE_IDLE;
823                             break;
824                     }
825                     device->state = HID_DEVICE_IDLE;
826                     break;
827                 default:
828                     break;
829             }
830             break;
831         default:
832             break;
833     }
834 }
835 
836 /**
837  * @brief Set up HID Device
838  */
839 void hid_device_init(uint8_t boot_protocol_mode_supported, uint16_t descriptor_len, const uint8_t * descriptor){
840     hid_boot_protocol_mode_supported = boot_protocol_mode_supported;
841     hid_descriptor =  descriptor;
842     hid_descriptor_len = descriptor_len;
843     hci_device_get_report = dummy_write_report;
844     hci_device_set_report = dummy_set_report;
845     hci_device_report_data = dummy_report_data;
846 
847     l2cap_register_service(packet_handler, PSM_HID_INTERRUPT, 100, LEVEL_2);
848     l2cap_register_service(packet_handler, PSM_HID_CONTROL,   100, LEVEL_2);
849 }
850 
851 /**
852  * @brief Register callback for the HID Device client.
853  * @param callback
854  */
855 void hid_device_register_packet_handler(btstack_packet_handler_t callback){
856     hid_callback = callback;
857 }
858 
859 
860 
861 void hid_device_register_report_request_callback(int (*callback)(uint16_t hid_cid, hid_report_type_t report_type, uint16_t report_id, int * out_report_size, uint8_t * out_report)){
862     if (callback == NULL){
863         callback = dummy_write_report;
864     }
865     hci_device_get_report = callback;
866 }
867 
868 void hid_device_register_set_report_callback(void (*callback)(uint16_t hid_cid, hid_report_type_t report_type, int report_size, uint8_t * report)){
869     if (callback == NULL){
870         callback = dummy_set_report;
871     }
872     hci_device_set_report = callback;
873 }
874 
875 void hid_device_register_report_data_callback(void (*callback)(uint16_t cid, hid_report_type_t report_type, uint16_t report_id, int report_size, uint8_t * report)){
876     if (callback == NULL){
877         callback = dummy_report_data;
878     }
879     hci_device_report_data = callback;
880 }
881 
882 
883 /**
884  * @brief Request can send now event to send HID Report
885  * @param hid_cid
886  */
887 void hid_device_request_can_send_now_event(uint16_t hid_cid){
888     hid_device_t * hid_device = hid_device_get_instance_for_hid_cid(hid_cid);
889     if (!hid_device || !hid_device->control_cid){
890          hid_device->state = HID_DEVICE_IDLE;
891          return;
892     }
893     l2cap_request_can_send_now_event(hid_device->control_cid);
894 }
895 
896 /**
897  * @brief Send HID messageon interrupt channel
898  * @param hid_cid
899  */
900 void hid_device_send_interrupt_message(uint16_t hid_cid, const uint8_t * message, uint16_t message_len){
901     hid_device_t * hid_device = hid_device_get_instance_for_hid_cid(hid_cid);
902     if (!hid_device || !hid_device->interrupt_cid) return;
903     l2cap_send(hid_device->interrupt_cid, (uint8_t*) message, message_len);
904 }
905 
906 /**
907  * @brief Send HID messageon control channel
908  * @param hid_cid
909  */
910 void hid_device_send_control_message(uint16_t hid_cid, const uint8_t * message, uint16_t message_len){
911     hid_device_t * hid_device = hid_device_get_instance_for_hid_cid(hid_cid);
912     if (!hid_device || !hid_device->control_cid) return;
913     l2cap_send(hid_device->control_cid, (uint8_t*) message, message_len);
914 }
915 
916 /*
917  * @brief Create HID connection to HID Host
918  * @param addr
919  * @param hid_cid to use for other commands
920  * @result status
921  */
922 uint8_t hid_device_connect(bd_addr_t addr, uint16_t * hid_cid){
923     hid_device_t * hid_device = hid_device_create_instance();
924     if (!hid_device){
925         log_error("hid_device_connect: could not create a hid device instace");
926         return BTSTACK_MEMORY_ALLOC_FAILED;
927     }
928     // assign hic_cid
929     *hid_cid = hid_device_get_next_cid();
930 
931     // store address
932     memcpy(hid_device->bd_addr, addr, 6);
933 
934     // reset state
935     hid_device->cid           = *hid_cid;
936     hid_device->incoming      = 0;
937     hid_device->connected     = 0;
938     hid_device->control_cid   = 0;
939     hid_device->interrupt_cid = 0;
940     hid_device->con_handle    = HCI_CON_HANDLE_INVALID;
941 
942     // create l2cap control using fixed HID L2CAP PSM
943     log_info("Create outgoing HID Control");
944     uint8_t status = l2cap_create_channel(packet_handler, hid_device->bd_addr, PSM_HID_CONTROL, 48, &hid_device->control_cid);
945     return status;
946 }
947 
948 /*
949  * @brief Disconnect from HID Host
950  * @param hid_cid
951  * @result status
952  */
953 void hid_device_disconnect_interrupt_channel(uint16_t hid_cid){
954     hid_device_t * hid_device = hid_device_get_instance_for_hid_cid(hid_cid);
955     if (!hid_device){
956         log_error("hid_device_disconnect_interrupt_channel: could not find hid device instace");
957         return;
958     }
959     log_info("Disconnect from interrupt channel HID Host");
960     if (hid_device->interrupt_cid){
961         l2cap_disconnect(hid_device->interrupt_cid, 0);  // reason isn't used
962     }
963 }
964 
965 void hid_device_disconnect_control_channel(uint16_t hid_cid){
966     hid_device_t * hid_device = hid_device_get_instance_for_hid_cid(hid_cid);
967     if (!hid_device){
968         log_error("hid_device_disconnect_control_channel: could not find hid device instace");
969         return;
970     }
971     log_info("Disconnect from control channel HID Host");
972     if (hid_device->control_cid){
973         l2cap_disconnect(hid_device->control_cid, 0);  // reason isn't used
974     }
975 }
976 
977 void hid_device_disconnect(uint16_t hid_cid){
978     hid_device_t * hid_device = hid_device_get_instance_for_hid_cid(hid_cid);
979     if (!hid_device){
980         log_error("hid_device_disconnect: could not find hid device instace");
981         return;
982     }
983     log_info("Disconnect from HID Host");
984     if (hid_device->interrupt_cid){
985         l2cap_disconnect(hid_device->interrupt_cid, 0);  // reason isn't used
986     }
987     if (hid_device->control_cid){
988         l2cap_disconnect(hid_device->control_cid, 0); // reason isn't used
989     }
990 }
991 
992 int hid_device_in_boot_protocol_mode(uint16_t hid_cid){
993     hid_device_t * hid_device = hid_device_get_instance_for_hid_cid(hid_cid);
994     if (!hid_device){
995         log_error("hid_device_in_boot_protocol_mode: could not find hid device instace");
996         return 0;
997     }
998     return hid_device->protocol_mode == HID_PROTOCOL_MODE_BOOT;
999 }
1000