iLiad Bluetooth for iLiad

[scotty1024]

Got the new adaptor. It's the Belkin USB 2.0 Bluetooth 2.0 + EDR dongle. It can do three full speed bluetooth connections at the same time and has a radio capable of doing so out to 100 meters.

All for less than 100ma of power.

I plugged it in and it linked to the loadable module.

root@ereader:/proc/bus/usb# cat devices 
T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
B:  Alloc=  0/900 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=0000 ProdID=0000 Rev= 0.00
S:  Product=USB PHCI Root Hub
S:  SerialNumber=c2d36000
C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr=  0mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   2 Ivl=255ms
T:  Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#=  3 Spd=12  MxCh= 0
D:  Ver= 2.00 Cls=e0(unk. ) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=050d ProdID=0012 Rev= 1.00
S:  Manufacturer=Broadcom Corp
S:  Product=BCM92045DG-Flash
C:* #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=100mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(unk. ) Sub=01 Prot=01 Driver=hci_usb
E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(unk. ) Sub=01 Prot=01 Driver=hci_usb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(unk. ) Sub=01 Prot=01 Driver=hci_usb
E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(unk. ) Sub=01 Prot=01 Driver=hci_usb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(unk. ) Sub=01 Prot=01 Driver=hci_usb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(unk. ) Sub=01 Prot=01 Driver=hci_usb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(unk. ) Sub=01 Prot=01 Driver=hci_usb
E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
I:  If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=84(I) Atr=02(Bulk) MxPS=  32 Ivl=0ms
E:  Ad=04(O) Atr=02(Bulk) MxPS=  32 Ivl=0ms
I:  If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=00 Driver=(none)

This is where the Mac-ified D-Link let me down... But this dongle hooked right up.

root@ereader:/sbin# hciconfig hci0 up
root@ereader:/sbin# hciconfig -a
hci0:   Type: USB
        BD Address: 00:0A:3A:XX:XX:XX ACL MTU: 1017:8 SCO MTU: 64:0
        UP RUNNING PSCAN ISCAN 
        RX bytes:63 acl:0 sco:0 events:7 errors:0
        TX bytes:27 acl:0 sco:0 commands:7 errors:0
        Features: 0xff 0xff 0x8d 0xfe 0x9b 0xfd 0x00 0x80
        Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3 
        Link policy: 
        Link mode: SLAVE ACCEPT 
        Name: 'BCM92045DG-Flash'
        Class: 0x000000
        Service Classes: Unspecified
        Device Class: Miscellaneous, 
        HCI Ver: 2.0 (0x3) HCI Rev: 0x2000 LMP Ver: 2.0 (0x3) LMP Subver: 0x415c
        Manufacturer: Broadcom Corporation (15)

Now to figure out pairing...

[k2r]

Great work! BT in general and a Keyboard will be very useful!

Originally Posted by scotty1024

This is where the Mac-ified D-Link let me down...

You mean the FirmwareUpdate for the USB-Adaptor a while ago?
If I remember correctly the release notes said that the adaptor would work with a Mac exclusively after updating. I hope you didn't spend too much time on it.

[scotty1024]

Well it wasn't exactly wasted time, I got to explore the code stack very completely trying to figure out why the radio didn't want to work.

Of course when I plugged in the new one today and it "just worked"...

I survived the flooding on the way home and I now sit down to try and bond dongle to keyboard. I've never used BlueZ before so this should be entertaining, especially when you go to their web site and they tell you that the manuals are waste of time to read. And most of the FAQ's they send you to use phrases like "I don't remember how I got it to work"

[scotty1024]

Well that was fun.

The linux-2.4.19 kernel iRex is using is too old for the keyboard support to work. So tomorrow I'll begin the tricky process of patching the bluetooth stack to linux-2.4.20 which has working HIDP support... yet keep the modules working against linux-2.4.19.

I was able to connect a pipe to the Stowaway keyboard, just couldn't do anything with it since I couldn't hook that pipe to the HID support in the linux-2.4.19 kernel.

On the upside the dongle works a treat. I was able to discover the iLiad from several devices and the bluez command line tools were able to probe from the iLiad to every bluetooth device I had.

I just hope this isn't like the wired keyboard, get it all working and there is no place for the characters to go...

Some scenery from tonight's adventures...

Request info from keyboard.

root@ereader:/bin# hcitool -i hci0 info 00:16:38:XX:XX:XX
Requesting information ...
        BD Address:  00:16:38:XX:XX:XX
        Device Name: Think Outside Keyboard
        LMP Version: 1.2 (0x2) LMP Subversion: 0x4100
        Manufacturer: Broadcom Corporation (15)
        Features: 0xbc 0x02 0x04 0x28 0x08 0x08 0x00 0x00
                <encryption> <slot offset> <timing accuracy> <role switch> 
                <sniff mode> <RSSI> <power control> <enhanced iscan> 
                <interlaced pscan> <AFH cap. slave> <AFH cap. master>

Establish connection to keyboard.

root@ereader:/bin# hcitool -i hci0 cc 00:16:38:XX:XX:XX
root@ereader:/bin# hcitool con
Connections:
        < ACL 00:16:38:XX:XX:XX handle 12 state 1 lm MASTER

Checking out the Macbook Pro.

root@ereader:/bin# hcitool -i hci0 info 00:17:f2:XX:XX:XX
Requesting information ...
        BD Address:  00:17:f2:XX:XX:XX
        Device Name: Scotty’s Macbook Pro
        LMP Version: 2.0 (0x3) LMP Subversion: 0x7ad
        Manufacturer: Cambridge Silicon Radio (10)
        Features: 0xff 0xff 0x8f 0xfe 0x9b 0xf9 0x00 0x80
                <3-slot packets> <5-slot packets> <encryption> <slot offset> 
                <timing accuracy> <role switch> <hold mode> <sniff mode> 
                <park state> <RSSI> <channel quality> <SCO link> <HV2 packets> 
                <HV3 packets> <u-law log> <A-law log> <CVSD> <paging scheme> 
                <power control> <transparent SCO> <broadcast encrypt> 
                <EDR ACL 2 Mbps> <EDR ACL 3 Mbps> <enhanced iscan> 
                <interlaced iscan> <interlaced pscan> <inquiry with RSSI> 
                <extended SCO> <EV4 packets> <EV5 packets> <AFH cap. slave> 
                <AFH class. slave> <3-slot EDR ACL> <5-slot EDR ACL> 
                <AFH cap. master> <AFH class. master> <EDR eSCO 2 Mbps> 
                <EDR eSCO 3 Mbps> <3-slot EDR eSCO> <extended features>

Probe the Motorola A1200.

root@ereader:/bin# hcitool -i hci0 info 00:17:84:XX:XX:XX
Requesting information ...
        BD Address:  00:17:84:XX:XX:XX
        Device Name: Motorola A1200
        LMP Version: 2.0 (0x3) LMP Subversion: 0x410d
        Manufacturer: Broadcom Corporation (15)
        Features: 0xff 0xff 0x8d 0xfe 0x8f 0xf9 0x00 0x80
                <3-slot packets> <5-slot packets> <encryption> <slot offset> 
                <timing accuracy> <role switch> <hold mode> <sniff mode> 
                <park state> <RSSI> <channel quality> <SCO link> <HV2 packets> 
                <HV3 packets> <u-law log> <A-law log> <CVSD> <power control> 
                <transparent SCO> <broadcast encrypt> <EDR ACL 2 Mbps> 
                <EDR ACL 3 Mbps> <enhanced iscan> <interlaced iscan> 
                <interlaced pscan> <inquiry with RSSI> <extended SCO> 
                <EV4 packets> <EV5 packets> <no. 34> <AFH cap. slave> 
                <3-slot EDR ACL> <5-slot EDR ACL> <AFH cap. master> 
                <AFH class. master> <EDR eSCO 2 Mbps> <EDR eSCO 3 Mbps> 
                <3-slot EDR eSCO> <extended features>

[arivero]

So our argument at iRex that root access is a real need is proving true! Fascinating.

I had expected problems with the HID thing. My student on the Zaurus was always protesting about how incomplete the 2.4.x implementation was. But I am surprised you are already in with the bluetooth dongle and the bluez tools. Given that the iLiad supports the X extension for inserting keyboard events, in the worst case you can bypass the kernel HID driver and run a user level application polling (well, knowing you, you will try to do it interrupt-driven) the BT driver and inserting the events towards X.

Non-HID BT keyboards are implemented in a similar way, using not the event insertion of X windows but a kernel module (udev?). Let me to see, I am back in a minute.

[arivero]

uinput was the thing, not udev. kbdd, the buggy user level driver for nonHID BT keyboards, uses rfcomm to link with the keyboard and then the modules uinput and keybdev to inject the keystrokes.


Also, google reports on some old work of a guy creating the fake hid needed for some keyboards in 2.4 kernels, http://klausler.com/msbtkb-linux.html

I read the code in the kernel for USB keyboards and realized that I could exploit it. I wrote a small (100 lines) Linux device driver as a loadable module. All it does is register itself as a keyboard device, and then take any keyboard input events that are written into it and hand them off to the input core as keycode events. After remembering to load the "input" and "keybdev" modules, I loaded my new driver, and it worked the first time I tested it by creating a character device special file with "mknod" and writing some bytes into it. The keycodes that I sent were immediately echoed as if I had typed them on the keyboard. I was in business.

So once we have got, via kernel space modules, the BT signal, there are three ways:
- From the kernel space, via input and keybdev
- From user space, uinput and keybdev
- From user space having access to X, via the extension Xtest, which is told to be activated in the iRex (Antartica suggested xautomaton, and in fact design256 tested xte to work for mouse input at least)

xmodmap will be probably a must, later depending on the keyboard. I have a BT keyboard without the pipe symbol!

[scotty1024]

The Matchbox "keyboard" we all know and love reports "Entering fake key X" on the console as it works.

I'll probably wind up stracing it to figure out how to plumb this.

But the newer bluetooth code does indeed use "uinput" to try and do it the "right way".

I'm guessing we are stuck on this old broken kernel because of iRex's decision to use the Philips non-open source USB chip. RMS had some excellent advice for iRex, it's too bad they didn't listen.

[Matthijs]

The 'new' keyboard/writepad is not Matchbox Keyboard, nor based on it. But it does use (like matchbox keyboard) libfakekey (one of the latest SVN Versions). Earlier SW versions of the iLiad used matchbox-keyboard (0.1).

BTW: I've never seen RMS give us any advice, did I miss something?

[scotty1024]

Originally Posted by Matthijs

The 'new' keyboard/writepad is not Matchbox Keyboard, nor based on it. But it does use (like matchbox keyboard) libfakekey (one of the latest SVN Versions). Earlier SW versions of the iLiad used matchbox-keyboard (0.1).

BTW: I've never seen RMS give us any advice, did I miss something?

Thanks, I may need that fakekey yet.

My latest struggle is with the decision to not include kmod in the kernel. The hci part of the bluez package has a circular reference that they seem to have been depending on kmod to resolve.

RMS' advice on proprietary device drivers: don't do it, you will always regret doing it in the long run.

The patched code is working better in many little ways but until I can load the hci stuff it will only do small things.