Move AOA/HID code to usb/

PR #2974 <https://github.com/Genymobile/scrcpy/pull/2974>

app/src/usb/aoa_hid.c

@@ -0,0 +1,398 @@
+#include "util/log.h"
+
+#include <assert.h>
+#include <stdio.h>
+
+#include "aoa_hid.h"
+#include "util/log.h"
+
+// See <https://source.android.com/devices/accessories/aoa2#hid-support>.
+#define ACCESSORY_REGISTER_HID 54
+#define ACCESSORY_SET_HID_REPORT_DESC 56
+#define ACCESSORY_SEND_HID_EVENT 57
+#define ACCESSORY_UNREGISTER_HID 55
+
+#define DEFAULT_TIMEOUT 1000
+
+static void
+sc_hid_event_log(const struct sc_hid_event *event) {
+    // HID Event: [00] FF FF FF FF...
+    assert(event->size);
+    unsigned buffer_size = event->size * 3 + 1;
+    char *buffer = malloc(buffer_size);
+    if (!buffer) {
+        LOG_OOM();
+        return;
+    }
+    for (unsigned i = 0; i < event->size; ++i) {
+        snprintf(buffer + i * 3, 4, " %02x", event->buffer[i]);
+    }
+    LOGV("HID Event: [%d]%s", event->accessory_id, buffer);
+    free(buffer);
+}
+
+void
+sc_hid_event_init(struct sc_hid_event *hid_event, uint16_t accessory_id,
+                  unsigned char *buffer, uint16_t buffer_size) {
+    hid_event->accessory_id = accessory_id;
+    hid_event->buffer = buffer;
+    hid_event->size = buffer_size;
+    hid_event->ack_to_wait = SC_SEQUENCE_INVALID;
+}
+
+void
+sc_hid_event_destroy(struct sc_hid_event *hid_event) {
+    free(hid_event->buffer);
+}
+
+static inline void
+log_libusb_error(enum libusb_error errcode) {
+    LOGW("libusb error: %s", libusb_strerror(errcode));
+}
+
+static bool
+accept_device(libusb_device *device, const char *serial) {
+    // do not log any USB error in this function, it is expected that many USB
+    // devices available on the computer have permission restrictions
+
+    struct libusb_device_descriptor desc;
+    int result = libusb_get_device_descriptor(device, &desc);
+    if (result < 0 || !desc.iSerialNumber) {
+        return false;
+    }
+
+    libusb_device_handle *handle;
+    result = libusb_open(device, &handle);
+    if (result < 0) {
+        return false;
+    }
+
+    char buffer[128];
+    result = libusb_get_string_descriptor_ascii(handle, desc.iSerialNumber,
+                                                (unsigned char *) buffer,
+                                                sizeof(buffer));
+    libusb_close(handle);
+    if (result < 0) {
+        return false;
+    }
+
+    buffer[sizeof(buffer) - 1] = '\0'; // just in case
+
+    // accept the device if its serial matches
+    return !strcmp(buffer, serial);
+}
+
+static libusb_device *
+sc_aoa_find_usb_device(const char *serial) {
+    if (!serial) {
+        return NULL;
+    }
+
+    libusb_device **list;
+    libusb_device *result = NULL;
+    ssize_t count = libusb_get_device_list(NULL, &list);
+    if (count < 0) {
+        log_libusb_error((enum libusb_error) count);
+        return NULL;
+    }
+
+    for (size_t i = 0; i < (size_t) count; ++i) {
+        libusb_device *device = list[i];
+
+        if (accept_device(device, serial)) {
+            result = libusb_ref_device(device);
+            break;
+        }
+    }
+    libusb_free_device_list(list, 1);
+    return result;
+}
+
+static int
+sc_aoa_open_usb_handle(libusb_device *device, libusb_device_handle **handle) {
+    int result = libusb_open(device, handle);
+    if (result < 0) {
+        log_libusb_error((enum libusb_error) result);
+        return result;
+    }
+    return 0;
+}
+
+bool
+sc_aoa_init(struct sc_aoa *aoa, const char *serial,
+            struct sc_acksync *acksync) {
+    assert(acksync);
+
+    cbuf_init(&aoa->queue);
+
+    if (!sc_mutex_init(&aoa->mutex)) {
+        return false;
+    }
+
+    if (!sc_cond_init(&aoa->event_cond)) {
+        goto error_destroy_mutex;
+    }
+
+    if (libusb_init(&aoa->usb_context) != LIBUSB_SUCCESS) {
+        goto error_destroy_cond;
+    }
+
+    aoa->usb_device = sc_aoa_find_usb_device(serial);
+    if (!aoa->usb_device) {
+        LOGW("USB device of serial %s not found", serial);
+        goto error_exit_libusb;
+    }
+
+    if (sc_aoa_open_usb_handle(aoa->usb_device, &aoa->usb_handle) < 0) {
+        LOGW("Open USB handle failed");
+        goto error_unref_device;
+        return false;
+    }
+
+    aoa->stopped = false;
+    aoa->acksync = acksync;
+
+    return true;
+
+error_unref_device:
+    libusb_unref_device(aoa->usb_device);
+error_exit_libusb:
+    libusb_exit(aoa->usb_context);
+error_destroy_cond:
+    sc_cond_destroy(&aoa->event_cond);
+error_destroy_mutex:
+    sc_mutex_destroy(&aoa->mutex);
+    return false;
+}
+
+void
+sc_aoa_destroy(struct sc_aoa *aoa) {
+    // Destroy remaining events
+    struct sc_hid_event event;
+    while (cbuf_take(&aoa->queue, &event)) {
+        sc_hid_event_destroy(&event);
+    }
+
+    libusb_close(aoa->usb_handle);
+    libusb_unref_device(aoa->usb_device);
+    libusb_exit(aoa->usb_context);
+    sc_cond_destroy(&aoa->event_cond);
+    sc_mutex_destroy(&aoa->mutex);
+}
+
+static bool
+sc_aoa_register_hid(struct sc_aoa *aoa, uint16_t accessory_id,
+                    uint16_t report_desc_size) {
+    uint8_t request_type = LIBUSB_ENDPOINT_OUT | LIBUSB_REQUEST_TYPE_VENDOR;
+    uint8_t request = ACCESSORY_REGISTER_HID;
+    // <https://source.android.com/devices/accessories/aoa2.html#hid-support>
+    // value (arg0): accessory assigned ID for the HID device
+    // index (arg1): total length of the HID report descriptor
+    uint16_t value = accessory_id;
+    uint16_t index = report_desc_size;
+    unsigned char *buffer = NULL;
+    uint16_t length = 0;
+    int result = libusb_control_transfer(aoa->usb_handle, request_type, request,
+                                         value, index, buffer, length,
+                                         DEFAULT_TIMEOUT);
+    if (result < 0) {
+        log_libusb_error((enum libusb_error) result);
+        return false;
+    }
+
+    return true;
+}
+
+static bool
+sc_aoa_set_hid_report_desc(struct sc_aoa *aoa, uint16_t accessory_id,
+                           const unsigned char *report_desc,
+                           uint16_t report_desc_size) {
+    uint8_t request_type = LIBUSB_ENDPOINT_OUT | LIBUSB_REQUEST_TYPE_VENDOR;
+    uint8_t request = ACCESSORY_SET_HID_REPORT_DESC;
+    /**
+     * If the HID descriptor is longer than the endpoint zero max packet size,
+     * the descriptor will be sent in multiple ACCESSORY_SET_HID_REPORT_DESC
+     * commands. The data for the descriptor must be sent sequentially
+     * if multiple packets are needed.
+     * <https://source.android.com/devices/accessories/aoa2.html#hid-support>
+     *
+     * libusb handles packet abstraction internally, so we don't need to care
+     * about bMaxPacketSize0 here.
+     *
+     * See <https://libusb.sourceforge.io/api-1.0/libusb_packetoverflow.html>
+     */
+    // value (arg0): accessory assigned ID for the HID device
+    // index (arg1): offset of data (buffer) in descriptor
+    uint16_t value = accessory_id;
+    uint16_t index = 0;
+    // libusb_control_transfer expects a pointer to non-const
+    unsigned char *buffer = (unsigned char *) report_desc;
+    uint16_t length = report_desc_size;
+    int result = libusb_control_transfer(aoa->usb_handle, request_type, request,
+                                         value, index, buffer, length,
+                                         DEFAULT_TIMEOUT);
+    if (result < 0) {
+        log_libusb_error((enum libusb_error) result);
+        return false;
+    }
+
+    return true;
+}
+
+bool
+sc_aoa_setup_hid(struct sc_aoa *aoa, uint16_t accessory_id,
+                 const unsigned char *report_desc, uint16_t report_desc_size) {
+    bool ok = sc_aoa_register_hid(aoa, accessory_id, report_desc_size);
+    if (!ok) {
+        return false;
+    }
+
+    ok = sc_aoa_set_hid_report_desc(aoa, accessory_id, report_desc,
+                                    report_desc_size);
+    if (!ok) {
+        if (!sc_aoa_unregister_hid(aoa, accessory_id)) {
+            LOGW("Could not unregister HID");
+        }
+        return false;
+    }
+
+    return true;
+}
+
+static bool
+sc_aoa_send_hid_event(struct sc_aoa *aoa, const struct sc_hid_event *event) {
+    uint8_t request_type = LIBUSB_ENDPOINT_OUT | LIBUSB_REQUEST_TYPE_VENDOR;
+    uint8_t request = ACCESSORY_SEND_HID_EVENT;
+    // <https://source.android.com/devices/accessories/aoa2.html#hid-support>
+    // value (arg0): accessory assigned ID for the HID device
+    // index (arg1): 0 (unused)
+    uint16_t value = event->accessory_id;
+    uint16_t index = 0;
+    unsigned char *buffer = event->buffer;
+    uint16_t length = event->size;
+    int result = libusb_control_transfer(aoa->usb_handle, request_type, request,
+                                         value, index, buffer, length,
+                                         DEFAULT_TIMEOUT);
+    if (result < 0) {
+        log_libusb_error((enum libusb_error) result);
+        return false;
+    }
+
+    return true;
+}
+
+bool
+sc_aoa_unregister_hid(struct sc_aoa *aoa, const uint16_t accessory_id) {
+    uint8_t request_type = LIBUSB_ENDPOINT_OUT | LIBUSB_REQUEST_TYPE_VENDOR;
+    uint8_t request = ACCESSORY_UNREGISTER_HID;
+    // <https://source.android.com/devices/accessories/aoa2.html#hid-support>
+    // value (arg0): accessory assigned ID for the HID device
+    // index (arg1): 0
+    uint16_t value = accessory_id;
+    uint16_t index = 0;
+    unsigned char *buffer = NULL;
+    uint16_t length = 0;
+    int result = libusb_control_transfer(aoa->usb_handle, request_type, request,
+                                         value, index, buffer, length,
+                                         DEFAULT_TIMEOUT);
+    if (result < 0) {
+        log_libusb_error((enum libusb_error) result);
+        return false;
+    }
+
+    return true;
+}
+
+bool
+sc_aoa_push_hid_event(struct sc_aoa *aoa, const struct sc_hid_event *event) {
+    if (sc_get_log_level() <= SC_LOG_LEVEL_VERBOSE) {
+        sc_hid_event_log(event);
+    }
+
+    sc_mutex_lock(&aoa->mutex);
+    bool was_empty = cbuf_is_empty(&aoa->queue);
+    bool res = cbuf_push(&aoa->queue, *event);
+    if (was_empty) {
+        sc_cond_signal(&aoa->event_cond);
+    }
+    sc_mutex_unlock(&aoa->mutex);
+    return res;
+}
+
+static int
+run_aoa_thread(void *data) {
+    struct sc_aoa *aoa = data;
+
+    for (;;) {
+        sc_mutex_lock(&aoa->mutex);
+        while (!aoa->stopped && cbuf_is_empty(&aoa->queue)) {
+            sc_cond_wait(&aoa->event_cond, &aoa->mutex);
+        }
+        if (aoa->stopped) {
+            // Stop immediately, do not process further events
+            sc_mutex_unlock(&aoa->mutex);
+            break;
+        }
+        struct sc_hid_event event;
+        bool non_empty = cbuf_take(&aoa->queue, &event);
+        assert(non_empty);
+        (void) non_empty;
+
+        uint64_t ack_to_wait = event.ack_to_wait;
+        sc_mutex_unlock(&aoa->mutex);
+
+        if (ack_to_wait != SC_SEQUENCE_INVALID) {
+            LOGD("Waiting ack from server sequence=%" PRIu64_, ack_to_wait);
+            // Do not block the loop indefinitely if the ack never comes (it
+            // should never happen)
+            sc_tick deadline = sc_tick_now() + SC_TICK_FROM_MS(500);
+            enum sc_acksync_wait_result result =
+                sc_acksync_wait(aoa->acksync, ack_to_wait, deadline);
+
+            if (result == SC_ACKSYNC_WAIT_TIMEOUT) {
+                LOGW("Ack not received after 500ms, discarding HID event");
+                sc_hid_event_destroy(&event);
+                continue;
+            } else if (result == SC_ACKSYNC_WAIT_INTR) {
+                // stopped
+                sc_hid_event_destroy(&event);
+                break;
+            }
+        }
+
+        bool ok = sc_aoa_send_hid_event(aoa, &event);
+        sc_hid_event_destroy(&event);
+        if (!ok) {
+            LOGW("Could not send HID event to USB device");
+        }
+    }
+    return 0;
+}
+
+bool
+sc_aoa_start(struct sc_aoa *aoa) {
+    LOGD("Starting AOA thread");
+
+    bool ok = sc_thread_create(&aoa->thread, run_aoa_thread, "scrcpy-aoa", aoa);
+    if (!ok) {
+        LOGC("Could not start AOA thread");
+        return false;
+    }
+
+    return true;
+}
+
+void
+sc_aoa_stop(struct sc_aoa *aoa) {
+    sc_mutex_lock(&aoa->mutex);
+    aoa->stopped = true;
+    sc_cond_signal(&aoa->event_cond);
+    sc_mutex_unlock(&aoa->mutex);
+
+    sc_acksync_interrupt(aoa->acksync);
+}
+
+void
+sc_aoa_join(struct sc_aoa *aoa) {
+    sc_thread_join(&aoa->thread, NULL);
+}

app/src/usb/aoa_hid.h

@@ -0,0 +1,69 @@
+#ifndef SC_AOA_HID_H
+#define SC_AOA_HID_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+#include <libusb-1.0/libusb.h>
+
+#include "util/acksync.h"
+#include "util/cbuf.h"
+#include "util/thread.h"
+#include "util/tick.h"
+
+struct sc_hid_event {
+    uint16_t accessory_id;
+    unsigned char *buffer;
+    uint16_t size;
+    uint64_t ack_to_wait;
+};
+
+// Takes ownership of buffer
+void
+sc_hid_event_init(struct sc_hid_event *hid_event, uint16_t accessory_id,
+                  unsigned char *buffer, uint16_t buffer_size);
+
+void
+sc_hid_event_destroy(struct sc_hid_event *hid_event);
+
+struct sc_hid_event_queue CBUF(struct sc_hid_event, 64);
+
+struct sc_aoa {
+    libusb_context *usb_context;
+    libusb_device *usb_device;
+    libusb_device_handle *usb_handle;
+    sc_thread thread;
+    sc_mutex mutex;
+    sc_cond event_cond;
+    bool stopped;
+    struct sc_hid_event_queue queue;
+
+    struct sc_acksync *acksync;
+};
+
+bool
+sc_aoa_init(struct sc_aoa *aoa, const char *serial, struct sc_acksync *acksync);
+
+void
+sc_aoa_destroy(struct sc_aoa *aoa);
+
+bool
+sc_aoa_start(struct sc_aoa *aoa);
+
+void
+sc_aoa_stop(struct sc_aoa *aoa);
+
+void
+sc_aoa_join(struct sc_aoa *aoa);
+
+bool
+sc_aoa_setup_hid(struct sc_aoa *aoa, uint16_t accessory_id,
+              const unsigned char *report_desc, uint16_t report_desc_size);
+
+bool
+sc_aoa_unregister_hid(struct sc_aoa *aoa, uint16_t accessory_id);
+
+bool
+sc_aoa_push_hid_event(struct sc_aoa *aoa, const struct sc_hid_event *event);
+
+#endif

app/src/usb/hid_keyboard.c

@@ -0,0 +1,430 @@
+#include "hid_keyboard.h"
+
+#include <assert.h>
+
+#include "input_events.h"
+#include "util/log.h"
+
+/** Downcast key processor to hid_keyboard */
+#define DOWNCAST(KP) container_of(KP, struct sc_hid_keyboard, key_processor)
+
+#define HID_KEYBOARD_ACCESSORY_ID 1
+
+#define HID_MODIFIER_NONE 0x00
+#define HID_MODIFIER_LEFT_CONTROL (1 << 0)
+#define HID_MODIFIER_LEFT_SHIFT (1 << 1)
+#define HID_MODIFIER_LEFT_ALT (1 << 2)
+#define HID_MODIFIER_LEFT_GUI (1 << 3)
+#define HID_MODIFIER_RIGHT_CONTROL (1 << 4)
+#define HID_MODIFIER_RIGHT_SHIFT (1 << 5)
+#define HID_MODIFIER_RIGHT_ALT (1 << 6)
+#define HID_MODIFIER_RIGHT_GUI (1 << 7)
+
+#define HID_KEYBOARD_INDEX_MODIFIER 0
+#define HID_KEYBOARD_INDEX_KEYS 2
+
+// USB HID protocol says 6 keys in an event is the requirement for BIOS
+// keyboard support, though OS could support more keys via modifying the report
+// desc. 6 should be enough for scrcpy.
+#define HID_KEYBOARD_MAX_KEYS 6
+#define HID_KEYBOARD_EVENT_SIZE (2 + HID_KEYBOARD_MAX_KEYS)
+
+#define HID_RESERVED 0x00
+#define HID_ERROR_ROLL_OVER 0x01
+
+/**
+ * For HID over AOAv2, only report descriptor is needed.
+ *
+ * The specification is available here:
+ * <https://www.usb.org/sites/default/files/hid1_11.pdf>
+ *
+ * In particular, read:
+ *  - 6.2.2 Report Descriptor
+ *  - Appendix B.1 Protocol 1 (Keyboard)
+ *  - Appendix C: Keyboard Implementation
+ *
+ * Normally a basic HID keyboard uses 8 bytes:
+ *     Modifier Reserved Key Key Key Key Key Key
+ *
+ * You can dump your device's report descriptor with:
+ *
+ *     sudo usbhid-dump -m vid:pid -e descriptor
+ *
+ * (change vid:pid' to your device's vendor ID and product ID).
+ */
+static const unsigned char keyboard_report_desc[]  = {
+    // Usage Page (Generic Desktop)
+    0x05, 0x01,
+    // Usage (Keyboard)
+    0x09, 0x06,
+
+    // Collection (Application)
+    0xA1, 0x01,
+
+    // Usage Page (Key Codes)
+    0x05, 0x07,
+    // Usage Minimum (224)
+    0x19, 0xE0,
+     // Usage Maximum (231)
+    0x29, 0xE7,
+    // Logical Minimum (0)
+    0x15, 0x00,
+    // Logical Maximum (1)
+    0x25, 0x01,
+    // Report Size (1)
+    0x75, 0x01,
+    // Report Count (8)
+    0x95, 0x08,
+    // Input (Data, Variable, Absolute): Modifier byte
+    0x81, 0x02,
+
+    // Report Size (8)
+    0x75, 0x08,
+    // Report Count (1)
+    0x95, 0x01,
+    // Input (Constant): Reserved byte
+    0x81, 0x01,
+
+    // Usage Page (LEDs)
+    0x05, 0x08,
+    // Usage Minimum (1)
+    0x19, 0x01,
+    // Usage Maximum (5)
+    0x29, 0x05,
+    // Report Size (1)
+    0x75, 0x01,
+    // Report Count (5)
+    0x95, 0x05,
+    // Output (Data, Variable, Absolute): LED report
+    0x91, 0x02,
+
+    // Report Size (3)
+    0x75, 0x03,
+    // Report Count (1)
+    0x95, 0x01,
+    // Output (Constant): LED report padding
+    0x91, 0x01,
+
+    // Usage Page (Key Codes)
+    0x05, 0x07,
+    // Usage Minimum (0)
+    0x19, 0x00,
+    // Usage Maximum (101)
+    0x29, SC_HID_KEYBOARD_KEYS - 1,
+    // Logical Minimum (0)
+    0x15, 0x00,
+    // Logical Maximum(101)
+    0x25, SC_HID_KEYBOARD_KEYS - 1,
+    // Report Size (8)
+    0x75, 0x08,
+    // Report Count (6)
+    0x95, HID_KEYBOARD_MAX_KEYS,
+    // Input (Data, Array): Keys
+    0x81, 0x00,
+
+    // End Collection
+    0xC0
+};
+
+/**
+ * A keyboard HID event is 8 bytes long:
+ *
+ *  - byte 0: modifiers (1 flag per modifier key, 8 possible modifier keys)
+ *  - byte 1: reserved (always 0)
+ *  - bytes 2 to 7: pressed keys (6 at most)
+ *
+ *                   7 6 5 4 3 2 1 0
+ *                  +---------------+
+ *         byte 0:  |. . . . . . . .| modifiers
+ *                  +---------------+
+ *                   ^ ^ ^ ^ ^ ^ ^ ^
+ *                   | | | | | | | `- left Ctrl
+ *                   | | | | | | `--- left Shift
+ *                   | | | | | `----- left Alt
+ *                   | | | | `------- left Gui
+ *                   | | | `--------- right Ctrl
+ *                   | | `----------- right Shift
+ *                   | `------------- right Alt
+ *                   `--------------- right Gui
+ *
+ *                  +---------------+
+ *         byte 1:  |0 0 0 0 0 0 0 0| reserved
+ *                  +---------------+
+ *
+ *                  +---------------+
+ *   bytes 2 to 7:  |. . . . . . . .| scancode of 1st key pressed
+ *                  +---------------+
+ *                  |. . . . . . . .| scancode of 2nd key pressed
+ *                  +---------------+
+ *                  |. . . . . . . .| scancode of 3rd key pressed
+ *                  +---------------+
+ *                  |. . . . . . . .| scancode of 4th key pressed
+ *                  +---------------+
+ *                  |. . . . . . . .| scancode of 5th key pressed
+ *                  +---------------+
+ *                  |. . . . . . . .| scancode of 6th key pressed
+ *                  +---------------+
+ *
+ * If there are less than 6 keys pressed, the last items are set to 0.
+ * For example, if A and W are pressed:
+ *
+ *                  +---------------+
+ *   bytes 2 to 7:  |0 0 0 0 0 1 0 0| A is pressed (scancode = 4)
+ *                  +---------------+
+ *                  |0 0 0 1 1 0 1 0| W is pressed (scancode = 26)
+ *                  +---------------+
+ *                  |0 0 0 0 0 0 0 0| ^
+ *                  +---------------+ |  only 2 keys are pressed, the
+ *                  |0 0 0 0 0 0 0 0| |  remaining items are set to 0
+ *                  +---------------+ |
+ *                  |0 0 0 0 0 0 0 0| |
+ *                  +---------------+ |
+ *                  |0 0 0 0 0 0 0 0| v
+ *                  +---------------+
+ *
+ * Pressing more than 6 keys is not supported. If this happens (typically,
+ * never in practice), report a "phantom state":
+ *
+ *                  +---------------+
+ *   bytes 2 to 7:  |0 0 0 0 0 0 0 1| ^
+ *                  +---------------+ |
+ *                  |0 0 0 0 0 0 0 1| |  more than 6 keys pressed:
+ *                  +---------------+ |  the list is filled with a special
+ *                  |0 0 0 0 0 0 0 1| |  rollover error code (0x01)
+ *                  +---------------+ |
+ *                  |0 0 0 0 0 0 0 1| |
+ *                  +---------------+ |
+ *                  |0 0 0 0 0 0 0 1| |
+ *                  +---------------+ |
+ *                  |0 0 0 0 0 0 0 1| v
+ *                  +---------------+
+ */
+
+static unsigned char
+sdl_keymod_to_hid_modifiers(uint16_t mod) {
+    unsigned char modifiers = HID_MODIFIER_NONE;
+    if (mod & SC_MOD_LCTRL) {
+        modifiers |= HID_MODIFIER_LEFT_CONTROL;
+    }
+    if (mod & SC_MOD_LSHIFT) {
+        modifiers |= HID_MODIFIER_LEFT_SHIFT;
+    }
+    if (mod & SC_MOD_LALT) {
+        modifiers |= HID_MODIFIER_LEFT_ALT;
+    }
+    if (mod & SC_MOD_LGUI) {
+        modifiers |= HID_MODIFIER_LEFT_GUI;
+    }
+    if (mod & SC_MOD_RCTRL) {
+        modifiers |= HID_MODIFIER_RIGHT_CONTROL;
+    }
+    if (mod & SC_MOD_RSHIFT) {
+        modifiers |= HID_MODIFIER_RIGHT_SHIFT;
+    }
+    if (mod & SC_MOD_RALT) {
+        modifiers |= HID_MODIFIER_RIGHT_ALT;
+    }
+    if (mod & SC_MOD_RGUI) {
+        modifiers |= HID_MODIFIER_RIGHT_GUI;
+    }
+    return modifiers;
+}
+
+static bool
+sc_hid_keyboard_event_init(struct sc_hid_event *hid_event) {
+    unsigned char *buffer = malloc(HID_KEYBOARD_EVENT_SIZE);
+    if (!buffer) {
+        LOG_OOM();
+        return false;
+    }
+
+    buffer[HID_KEYBOARD_INDEX_MODIFIER] = HID_MODIFIER_NONE;
+    buffer[1] = HID_RESERVED;
+    memset(&buffer[HID_KEYBOARD_INDEX_KEYS], 0, HID_KEYBOARD_MAX_KEYS);
+
+    sc_hid_event_init(hid_event, HID_KEYBOARD_ACCESSORY_ID, buffer,
+                      HID_KEYBOARD_EVENT_SIZE);
+    return true;
+}
+
+static inline bool
+scancode_is_modifier(enum sc_scancode scancode) {
+    return scancode >= SC_SCANCODE_LCTRL && scancode <= SC_SCANCODE_RGUI;
+}
+
+static bool
+convert_hid_keyboard_event(struct sc_hid_keyboard *kb,
+                           struct sc_hid_event *hid_event,
+                           const struct sc_key_event *event) {
+    enum sc_scancode scancode = event->scancode;
+    assert(scancode >= 0);
+
+    // SDL also generates events when only modifiers are pressed, we cannot
+    // ignore them totally, for example press 'a' first then press 'Control',
+    // if we ignore 'Control' event, only 'a' is sent.
+    if (scancode >= SC_HID_KEYBOARD_KEYS && !scancode_is_modifier(scancode)) {
+        // Scancode to ignore
+        return false;
+    }
+
+    if (!sc_hid_keyboard_event_init(hid_event)) {
+        LOGW("Could not initialize HID keyboard event");
+        return false;
+    }
+
+    unsigned char modifiers = sdl_keymod_to_hid_modifiers(event->mods_state);
+
+    if (scancode < SC_HID_KEYBOARD_KEYS) {
+        // Pressed is true and released is false
+        kb->keys[scancode] = (event->action == SC_ACTION_DOWN);
+        LOGV("keys[%02x] = %s", scancode,
+             kb->keys[scancode] ? "true" : "false");
+    }
+
+    hid_event->buffer[HID_KEYBOARD_INDEX_MODIFIER] = modifiers;
+
+    unsigned char *keys_buffer = &hid_event->buffer[HID_KEYBOARD_INDEX_KEYS];
+    // Re-calculate pressed keys every time
+    int keys_pressed_count = 0;
+    for (int i = 0; i < SC_HID_KEYBOARD_KEYS; ++i) {
+        if (kb->keys[i]) {
+            // USB HID protocol says that if keys exceeds report count, a
+            // phantom state should be reported
+            if (keys_pressed_count >= HID_KEYBOARD_MAX_KEYS) {
+                // Phantom state:
+                //  - Modifiers
+                //  - Reserved
+                //  - ErrorRollOver * HID_MAX_KEYS
+                memset(keys_buffer, HID_ERROR_ROLL_OVER, HID_KEYBOARD_MAX_KEYS);
+                goto end;
+            }
+
+            keys_buffer[keys_pressed_count] = i;
+            ++keys_pressed_count;
+        }
+    }
+
+end:
+    LOGV("hid keyboard: key %-4s scancode=%02x (%u) mod=%02x",
+         event->action == SC_ACTION_DOWN ? "down" : "up", event->scancode,
+         event->scancode, modifiers);
+
+    return true;
+}
+
+
+static bool
+push_mod_lock_state(struct sc_hid_keyboard *kb, uint16_t mods_state) {
+    bool capslock = mods_state & SC_MOD_CAPS;
+    bool numlock = mods_state & SC_MOD_NUM;
+    if (!capslock && !numlock) {
+        // Nothing to do
+        return true;
+    }
+
+    struct sc_hid_event hid_event;
+    if (!sc_hid_keyboard_event_init(&hid_event)) {
+        LOGW("Could not initialize HID keyboard event");
+        return false;
+    }
+
+    unsigned i = 0;
+    if (capslock) {
+        hid_event.buffer[HID_KEYBOARD_INDEX_KEYS + i] = SC_SCANCODE_CAPSLOCK;
+        ++i;
+    }
+    if (numlock) {
+        hid_event.buffer[HID_KEYBOARD_INDEX_KEYS + i] = SC_SCANCODE_NUMLOCK;
+        ++i;
+    }
+
+    if (!sc_aoa_push_hid_event(kb->aoa, &hid_event)) {
+        sc_hid_event_destroy(&hid_event);
+        LOGW("Could request HID event");
+        return false;
+    }
+
+    LOGD("HID keyboard state synchronized");
+
+    return true;
+}
+
+static void
+sc_key_processor_process_key(struct sc_key_processor *kp,
+                             const struct sc_key_event *event,
+                             uint64_t ack_to_wait) {
+    if (event->repeat) {
+        // In USB HID protocol, key repeat is handled by the host (Android), so
+        // just ignore key repeat here.
+        return;
+    }
+
+    struct sc_hid_keyboard *kb = DOWNCAST(kp);
+
+    struct sc_hid_event hid_event;
+    // Not all keys are supported, just ignore unsupported keys
+    if (convert_hid_keyboard_event(kb, &hid_event, event)) {
+        if (!kb->mod_lock_synchronized) {
+            // Inject CAPSLOCK and/or NUMLOCK if necessary to synchronize
+            // keyboard state
+            if (push_mod_lock_state(kb, event->mods_state)) {
+                kb->mod_lock_synchronized = true;
+            }
+        }
+
+        if (ack_to_wait) {
+            // Ctrl+v is pressed, so clipboard synchronization has been
+            // requested. Wait until clipboard synchronization is acknowledged
+            // by the server, otherwise it could paste the old clipboard
+            // content.
+            hid_event.ack_to_wait = ack_to_wait;
+        }
+
+        if (!sc_aoa_push_hid_event(kb->aoa, &hid_event)) {
+            sc_hid_event_destroy(&hid_event);
+            LOGW("Could request HID event");
+        }
+    }
+}
+
+bool
+sc_hid_keyboard_init(struct sc_hid_keyboard *kb, struct sc_aoa *aoa) {
+    kb->aoa = aoa;
+
+    bool ok = sc_aoa_setup_hid(aoa, HID_KEYBOARD_ACCESSORY_ID,
+                               keyboard_report_desc,
+                               ARRAY_LEN(keyboard_report_desc));
+    if (!ok) {
+        LOGW("Register HID keyboard failed");
+        return false;
+    }
+
+    // Reset all states
+    memset(kb->keys, false, SC_HID_KEYBOARD_KEYS);
+
+    kb->mod_lock_synchronized = false;
+
+    static const struct sc_key_processor_ops ops = {
+        .process_key = sc_key_processor_process_key,
+        // Never forward text input via HID (all the keys are injected
+        // separately)
+        .process_text = NULL,
+    };
+
+    // Clipboard synchronization is requested over the control socket, while HID
+    // events are sent over AOA, so it must wait for clipboard synchronization
+    // to be acknowledged by the device before injecting Ctrl+v.
+    kb->key_processor.async_paste = true;
+    kb->key_processor.ops = &ops;
+
+    return true;
+}
+
+void
+sc_hid_keyboard_destroy(struct sc_hid_keyboard *kb) {
+    // Unregister HID keyboard so the soft keyboard shows again on Android
+    bool ok = sc_aoa_unregister_hid(kb->aoa, HID_KEYBOARD_ACCESSORY_ID);
+    if (!ok) {
+        LOGW("Could not unregister HID keyboard");
+    }
+}

app/src/usb/hid_keyboard.h

@@ -0,0 +1,44 @@
+#ifndef SC_HID_KEYBOARD_H
+#define SC_HID_KEYBOARD_H
+
+#include "common.h"
+
+#include <stdbool.h>
+
+#include "aoa_hid.h"
+#include "trait/key_processor.h"
+
+// See "SDL2/SDL_scancode.h".
+// Maybe SDL_Keycode is used by most people, but SDL_Scancode is taken from USB
+// HID protocol.
+// 0x65 is Application, typically AT-101 Keyboard ends here.
+#define SC_HID_KEYBOARD_KEYS 0x66
+
+/**
+ * HID keyboard events are sequence-based, every time keyboard state changes
+ * it sends an array of currently pressed keys, the host is responsible for
+ * compare events and determine which key becomes pressed and which key becomes
+ * released. In order to convert SDL_KeyboardEvent to HID events, we first use
+ * an array of keys to save each keys' state. And when a SDL_KeyboardEvent was
+ * emitted, we updated our state, and then we use a loop to generate HID
+ * events. The sequence of array elements is unimportant and when too much keys
+ * pressed at the same time (more than report count), we should generate
+ * phantom state. Don't forget that modifiers should be updated too, even for
+ * phantom state.
+ */
+struct sc_hid_keyboard {
+    struct sc_key_processor key_processor; // key processor trait
+
+    struct sc_aoa *aoa;
+    bool keys[SC_HID_KEYBOARD_KEYS];
+
+    bool mod_lock_synchronized;
+};
+
+bool
+sc_hid_keyboard_init(struct sc_hid_keyboard *kb, struct sc_aoa *aoa);
+
+void
+sc_hid_keyboard_destroy(struct sc_hid_keyboard *kb);
+
+#endif

app/src/usb/hid_mouse.c

@@ -0,0 +1,267 @@
+#include "hid_mouse.h"
+
+#include <assert.h>
+
+#include "input_events.h"
+#include "util/log.h"
+
+/** Downcast mouse processor to hid_mouse */
+#define DOWNCAST(MP) container_of(MP, struct sc_hid_mouse, mouse_processor)
+
+#define HID_MOUSE_ACCESSORY_ID 2
+
+// 1 byte for buttons + padding, 1 byte for X position, 1 byte for Y position
+#define HID_MOUSE_EVENT_SIZE 4
+
+/**
+ * Mouse descriptor from the specification:
+ * <https://www.usb.org/sites/default/files/hid1_11.pdf>
+ *
+ * Appendix E (p71): §E.10 Report Descriptor (Mouse)
+ *
+ * The usage tags (like Wheel) are listed in "HID Usage Tables":
+ * <https://www.usb.org/sites/default/files/documents/hut1_12v2.pdf>
+ * §4 Generic Desktop Page (0x01) (p26)
+ */
+static const unsigned char mouse_report_desc[]  = {
+    // Usage Page (Generic Desktop)
+    0x05, 0x01,
+    // Usage (Mouse)
+    0x09, 0x02,
+
+    // Collection (Application)
+    0xA1, 0x01,
+
+    // Usage (Pointer)
+    0x09, 0x01,
+
+    // Collection (Physical)
+    0xA1, 0x00,
+
+    // Usage Page (Buttons)
+    0x05, 0x09,
+
+    // Usage Minimum (1)
+    0x19, 0x01,
+     // Usage Maximum (5)
+    0x29, 0x05,
+    // Logical Minimum (0)
+    0x15, 0x00,
+    // Logical Maximum (1)
+    0x25, 0x01,
+    // Report Count (5)
+    0x95, 0x05,
+    // Report Size (1)
+    0x75, 0x01,
+    // Input (Data, Variable, Absolute): 5 buttons bits
+    0x81, 0x02,
+
+    // Report Count (1)
+    0x95, 0x01,
+    // Report Size (3)
+    0x75, 0x03,
+    // Input (Constant): 3 bits padding
+    0x81, 0x01,
+
+    // Usage Page (Generic Desktop)
+    0x05, 0x01,
+    // Usage (X)
+    0x09, 0x30,
+    // Usage (Y)
+    0x09, 0x31,
+    // Usage (Wheel)
+    0x09, 0x38,
+    // Local Minimum (-127)
+    0x15, 0x81,
+    // Local Maximum (127)
+    0x25, 0x7F,
+    // Report Size (8)
+    0x75, 0x08,
+    // Report Count (3)
+    0x95, 0x03,
+    // Input (Data, Variable, Relative): 3 position bytes (X, Y, Wheel)
+    0x81, 0x06,
+
+    // End Collection
+    0xC0,
+
+    // End Collection
+    0xC0,
+};
+
+/**
+ * A mouse HID event is 3 bytes long:
+ *
+ *  - byte 0: buttons state
+ *  - byte 1: relative x motion (signed byte from -127 to 127)
+ *  - byte 2: relative y motion (signed byte from -127 to 127)
+ *
+ *                   7 6 5 4 3 2 1 0
+ *                  +---------------+
+ *         byte 0:  |0 0 0 . . . . .| buttons state
+ *                  +---------------+
+ *                         ^ ^ ^ ^ ^
+ *                         | | | | `- left button
+ *                         | | | `--- right button
+ *                         | | `----- middle button
+ *                         | `------- button 4
+ *                         `--------- button 5
+ *
+ *                  +---------------+
+ *         byte 1:  |. . . . . . . .| relative x motion
+ *                  +---------------+
+ *         byte 2:  |. . . . . . . .| relative y motion
+ *                  +---------------+
+ *         byte 3:  |. . . . . . . .| wheel motion (-1, 0 or 1)
+ *                  +---------------+
+ *
+ * As an example, here is the report for a motion of (x=5, y=-4) with left
+ * button pressed:
+ *
+ *                  +---------------+
+ *                  |0 0 0 0 0 0 0 1| left button pressed
+ *                  +---------------+
+ *                  |0 0 0 0 0 1 0 1| horizontal motion (x = 5)
+ *                  +---------------+
+ *                  |1 1 1 1 1 1 0 0| relative y motion (y = -4)
+ *                  +---------------+
+ *                  |0 0 0 0 0 0 0 0| wheel motion
+ *                  +---------------+
+ */
+
+static bool
+sc_hid_mouse_event_init(struct sc_hid_event *hid_event) {
+    unsigned char *buffer = calloc(1, HID_MOUSE_EVENT_SIZE);
+    if (!buffer) {
+        LOG_OOM();
+        return false;
+    }
+
+    sc_hid_event_init(hid_event, HID_MOUSE_ACCESSORY_ID, buffer,
+                      HID_MOUSE_EVENT_SIZE);
+    return true;
+}
+
+static unsigned char
+buttons_state_to_hid_buttons(uint8_t buttons_state) {
+    unsigned char c = 0;
+    if (buttons_state & SC_MOUSE_BUTTON_LEFT) {
+        c |= 1 << 0;
+    }
+    if (buttons_state & SC_MOUSE_BUTTON_RIGHT) {
+        c |= 1 << 1;
+    }
+    if (buttons_state & SC_MOUSE_BUTTON_MIDDLE) {
+        c |= 1 << 2;
+    }
+    if (buttons_state & SC_MOUSE_BUTTON_X1) {
+        c |= 1 << 3;
+    }
+    if (buttons_state & SC_MOUSE_BUTTON_X2) {
+        c |= 1 << 4;
+    }
+    return c;
+}
+
+static void
+sc_mouse_processor_process_mouse_motion(struct sc_mouse_processor *mp,
+                                    const struct sc_mouse_motion_event *event) {
+    struct sc_hid_mouse *mouse = DOWNCAST(mp);
+
+    struct sc_hid_event hid_event;
+    if (!sc_hid_mouse_event_init(&hid_event)) {
+        return;
+    }
+
+    unsigned char *buffer = hid_event.buffer;
+    buffer[0] = buttons_state_to_hid_buttons(event->buttons_state);
+    buffer[1] = CLAMP(event->xrel, -127, 127);
+    buffer[2] = CLAMP(event->yrel, -127, 127);
+    buffer[3] = 0; // wheel coordinates only used for scrolling
+
+    if (!sc_aoa_push_hid_event(mouse->aoa, &hid_event)) {
+        sc_hid_event_destroy(&hid_event);
+        LOGW("Could request HID event");
+    }
+}
+
+static void
+sc_mouse_processor_process_mouse_click(struct sc_mouse_processor *mp,
+                                   const struct sc_mouse_click_event *event) {
+    struct sc_hid_mouse *mouse = DOWNCAST(mp);
+
+    struct sc_hid_event hid_event;
+    if (!sc_hid_mouse_event_init(&hid_event)) {
+        return;
+    }
+
+    unsigned char *buffer = hid_event.buffer;
+    buffer[0] = buttons_state_to_hid_buttons(event->buttons_state);
+    buffer[1] = 0; // no x motion
+    buffer[2] = 0; // no y motion
+    buffer[3] = 0; // wheel coordinates only used for scrolling
+
+    if (!sc_aoa_push_hid_event(mouse->aoa, &hid_event)) {
+        sc_hid_event_destroy(&hid_event);
+        LOGW("Could request HID event");
+    }
+}
+
+static void
+sc_mouse_processor_process_mouse_scroll(struct sc_mouse_processor *mp,
+                                    const struct sc_mouse_scroll_event *event) {
+    struct sc_hid_mouse *mouse = DOWNCAST(mp);
+
+    struct sc_hid_event hid_event;
+    if (!sc_hid_mouse_event_init(&hid_event)) {
+        return;
+    }
+
+    unsigned char *buffer = hid_event.buffer;
+    buffer[0] = 0; // buttons state irrelevant (and unknown)
+    buffer[1] = 0; // no x motion
+    buffer[2] = 0; // no y motion
+    // In practice, vscroll is always -1, 0 or 1, but in theory other values
+    // are possible
+    buffer[3] = CLAMP(event->vscroll, -127, 127);
+    // Horizontal scrolling ignored
+
+    if (!sc_aoa_push_hid_event(mouse->aoa, &hid_event)) {
+        sc_hid_event_destroy(&hid_event);
+        LOGW("Could request HID event");
+    }
+}
+
+bool
+sc_hid_mouse_init(struct sc_hid_mouse *mouse, struct sc_aoa *aoa) {
+    mouse->aoa = aoa;
+
+    bool ok = sc_aoa_setup_hid(aoa, HID_MOUSE_ACCESSORY_ID, mouse_report_desc,
+                               ARRAY_LEN(mouse_report_desc));
+    if (!ok) {
+        LOGW("Register HID mouse failed");
+        return false;
+    }
+
+    static const struct sc_mouse_processor_ops ops = {
+        .process_mouse_motion = sc_mouse_processor_process_mouse_motion,
+        .process_mouse_click = sc_mouse_processor_process_mouse_click,
+        .process_mouse_scroll = sc_mouse_processor_process_mouse_scroll,
+        // Touch events not supported (coordinates are not relative)
+        .process_touch = NULL,
+    };
+
+    mouse->mouse_processor.ops = &ops;
+
+    mouse->mouse_processor.relative_mode = true;
+
+    return true;
+}
+
+void
+sc_hid_mouse_destroy(struct sc_hid_mouse *mouse) {
+    bool ok = sc_aoa_unregister_hid(mouse->aoa, HID_MOUSE_ACCESSORY_ID);
+    if (!ok) {
+        LOGW("Could not unregister HID mouse");
+    }
+}

app/src/usb/hid_mouse.h

@@ -0,0 +1,23 @@
+#ifndef SC_HID_MOUSE_H
+#define SC_HID_MOUSE_H
+
+#include "common.h"
+
+#include <stdbool.h>
+
+#include "aoa_hid.h"
+#include "trait/mouse_processor.h"
+
+struct sc_hid_mouse {
+    struct sc_mouse_processor mouse_processor; // mouse processor trait
+
+    struct sc_aoa *aoa;
+};
+
+bool
+sc_hid_mouse_init(struct sc_hid_mouse *mouse, struct sc_aoa *aoa);
+
+void
+sc_hid_mouse_destroy(struct sc_hid_mouse *mouse);
+
+#endif