/************************************************************************************ * C8051F340 USB Fn hacking * 说明： * 简单跟踪一下这个C8051F340 USB的使用。 * * 2017-4-1 深圳 南山平山村 曾剑锋 ***********************************************************************************/ void main(void) { System_Init (); --------------------+ USB0_Init (); | EA = 1; | | while (1) { | Key_Scan(); | ------------------------------------+ Key_Handle(); | ------------------------------------*-+ } | | | } | | | | | | void System_Init (void) <------------+ | | { | | PCA0MD &= ~0x40; // Disable Watchdog timer | | Sysclk_Init (); -------+ // initialize system clock | | Port_Init (); | // configure cross bar -----------+ | | Timer_Init (); | // configure timer -----------*-+ | | } | | | | | | | | | | void Sysclk_Init (void) <-----+ | | | | { | | | | #ifdef _USB_LOW_SPEED_ | | | | | | | | OSCICN |= 0x03; // Configure internal oscillator for | | | | // its maximum frequency and enable | | | | // missing clock detector | | | | | | | | CLKSEL = SYS_EXT_OSC; // Select System clock | | | | CLKSEL |= USB_INT_OSC_DIV_2; // Select USB clock | | | | #else | | | | OSCICN |= 0x03; // Configure internal oscillator for | | | | // its maximum frequency and enable | | | | // missing clock detector | | | | | | | | CLKMUL = 0x00; // Select internal oscillator as | | | | // input to clock multiplier | | | | | | | | CLKMUL |= 0x80; // Enable clock multiplier | | | | CLKMUL |= 0xC0; // Initialize the clock multiplier | | | | Delay(); // Delay for clock multiplier to begin | | | | | | | | while(!(CLKMUL & 0x20)); // Wait for multiplier to lock | | | | CLKSEL = SYS_INT_OSC; // Select system clock | | | | CLKSEL |= USB_4X_CLOCK; // Select USB clock | | | | #endif /* _USB_LOW_SPEED_ */ | | | | } | | | | | | | | void Port_Init(void) <------------------------------------------+ | | | { | | | P0MDOUT = 0xFF; | | | P0SKIP = 0xFF; | | | P2MDIN = 0xFF; // Port 2 pin 5 set as analog input | | | P2SKIP = 0xFF; // Port 2 pin 5 skipped by crossbar | | | | | | XBR1 = 0x40; // Enable Crossbar | | | | | | DebugLEDOFF; // ¹Ø±Õµ÷Êﵮ | | | } | | | | | | void Timer_Init (void) | | | { | | | TMR2CN = 0x00; // Stop Timer2; Clear TF2; | | | | | | CKCON &= ~0xF0; // Timer2 clocked based on T2XCLK; | | | TMR2L = 0x7F; // Timer/Counter 2 Low | | | TMR2H = 0xFF; // Timer/Counter 2 High | | | TMR2RLL = 0xEF; // Timer/Counter 2 Reload Low | | | TMR2RLH = 0xD8; // Timer/Counter 2 Reload High | | | | | | ET2 = 1; // Enable Timer2 interrupts | | | TR2 = 1; // Start Timer2 | | | } | | | | | | void USB0_Init (void) <-------------------------------------------------+ | | { | | | | // #define POLL_WRITE_BYTE(addr, data) while(USB0ADR & 0x80); | | // WRITE_BYTE(addr, data); | | POLL_WRITE_BYTE (POWER, 0x08); // Force Asynchronous USB Reset ---+ | | POLL_WRITE_BYTE (IN1IE, 0x07); // Enable Endpoint 0-1 in interrupts | | | POLL_WRITE_BYTE (OUT1IE,0x07); // Enable Endpoint 0-1 out interrupts | | | POLL_WRITE_BYTE (CMIE, 0x07); // Enable Reset, Resume, and Suspend | | | // interrupts | | | USB0XCN = 0xE0; // Enable transceiver; select full speed | | | POLL_WRITE_BYTE (CLKREC,0x89); // Enable clock recovery, single-step | | | // mode disabled | | | | | | EIE1 |= 0x02; // Enable USB0 Interrupts | | | | | | // Enable USB0 by clearing the USB | | | POLL_WRITE_BYTE (POWER, 0x01); // Inhibit Bit and enable suspend | | | // detection | | | | | | } | | | | | | #define POLL_WRITE_BYTE(addr, data) while(USB0ADR & 0x80); <------------+ | | WRITE_BYTE(addr, data); -----+ | | | | | #define WRITE_BYTE(addr, data) USB0ADR = (addr); USB0DAT = data <----+ | | | | | sfr USB0DAT = 0x97; // USB0 Data Register <----+ | | | | void Key_Scan(void) { <------------------------------------------------+ | static unsigned char AllKeyBk; | unsigned char AllKey = 0; | unsigned char i = 0; | | if(b_ScanKey) { // 定时器中每过10ms会对这个变量置1一次 | b_ScanKey = 0; | AllKey = P2; | AllKey >>= 2; | if(AllKey != 0x3F) { // 有键按下 | if(AllKeyBk != AllKey) { | LongKeyCnt = 0; // 有新的按键按下，重新去抖 | } | AllKeyBk = AllKey; | LongKeyCnt++; | if(LongKeyCnt > 1) { // 20ms 去抖 | key_status[KEYALL] = KEY_DOWN; | for( i = 0; i < 6; i++) { | // 判断每一个按键的状态 | if( (AllKey & 0x01) == 0 ) { | key_status[i] = KEY_DOWN; | } else { | key_status[i] = KEY_UP; | } | AllKey >>= 1; | } | } | } else { | key_status[KEYALL] = KEY_UP; | LongKeyCnt = 0; // 当按键抬起来之后这里会置零 | for( i = 0; i < 6; i++) { | key_status[i] = KEY_UP; | } | } | } | } | | void Key_Handle(void) <-----------------------------------------------------+ { static unsigned char key_status_bk[6] = {KEY_UP}; unsigned char i; unsigned char cnt_i; cnt_i = 2; if(key_status[KEYF1] == KEY_DOWN) { if(key_status[KEYF1] != key_status_bk[KEYF1]) { IN_PACKET[cnt_i] = KB_F1; DebugLEDON; cnt_i++; } } else if(key_status[KEYF1] == KEY_UP) { if(key_status[KEYF1] != key_status_bk[KEYF1]) { // 按键状态发生改变，只发送一次数据 DebugLEDOFF; } } if(key_status[KEYF2] == KEY_DOWN) { if(key_status[KEYF2] != key_status_bk[KEYF2]) { IN_PACKET[cnt_i] = KB_F2; DebugLEDON; cnt_i++; } } else if(key_status[KEYF2] == KEY_UP) { if(key_status[KEYF2] != key_status_bk[KEYF2]) { // 按键状态发生改变，只发送一次数据 DebugLEDOFF; } } if(key_status[KEYF3] == KEY_DOWN) { if(key_status[KEYF3] != key_status_bk[KEYF3]) { IN_PACKET[cnt_i] = KB_F3; DebugLEDON; cnt_i++; } } else if(key_status[KEYF3] == KEY_UP) { if(key_status[KEYF3] != key_status_bk[KEYF3]) { // 按键状态发生改变，只发送一次数据 DebugLEDOFF; } } if(key_status[KEYF4] == KEY_DOWN) { if(key_status[KEYF4] != key_status_bk[KEYF4]) { IN_PACKET[cnt_i] = KB_F4; DebugLEDON; cnt_i++; } } else if(key_status[KEYF4] == KEY_UP) { if(key_status[KEYF4] != key_status_bk[KEYF4]) { // 按键状态发生改变，只发送一次数据 DebugLEDOFF; } } if(key_status[KEYF5] == KEY_DOWN) { if(key_status[KEYF5] != key_status_bk[KEYF5]) { IN_PACKET[cnt_i] = KB_F5; DebugLEDON; cnt_i++; } } else if(key_status[KEYF5] == KEY_UP) { if(key_status[KEYF5] != key_status_bk[KEYF5]) { // 按键状态发生改变，只发送一次数据 DebugLEDOFF; } } if(key_status[KEYF6] == KEY_DOWN) { if(key_status[KEYF6] != key_status_bk[KEYF6]) { IN_PACKET[cnt_i] = KB_F6; DebugLEDON; cnt_i++; } } else if(key_status[KEYF6] == KEY_UP) { if(key_status[KEYF6] != key_status_bk[KEYF6]) { // 按键状态发生改变，只发送一次数据 DebugLEDOFF; } } if(key_status[KEYALL] == KEY_DOWN){ if(key_status[KEYALL] != key_status_bk[KEYALL]) { SendPacket (0); } } else if(key_status[KEYALL] == KEY_UP){ for(i = 2; i < 6; i++) { IN_PACKET[i] = 0; -------+ } | if(key_status[KEYALL] != key_status_bk[KEYALL]) { -------*-+ SendPacket (0); | | } | | } | | | | for(i = 0; i < 7; i++) { | | key_status_bk[i] = key_status[i]; | | } | | } | | | | unsigned char IN_PACKET[8] ={0,0,0,0,0,0,0,0}; <-------+ | | unsigned char key_status[7] = {KEY_UP}; <---------+ void Timer2_ISR (void) interrupt 5 // 10ms { static unsigned Timer2_Cnt = 0; Timer2_Cnt++; b_ScanKey = 1; // for key count if( (Timer2_Cnt%50) == 0 ) { } if( Timer2_Cnt == 50000) Timer2_Cnt = 0; TF2H = 0; // Clear Timer2 interrupt flag } //----------------------------------------------------------------------------- // Usb_ISR //----------------------------------------------------------------------------- // // Called after any USB type interrupt, this handler determines which type // of interrupt occurred, and calls the specific routine to handle it. // //----------------------------------------------------------------------------- void Usb_ISR (void) interrupt 8 // USB中断入口 { unsigned char bCommon, bIn, bOut; POLL_READ_BYTE (CMINT, bCommon); // USB0公共中断寄存器 ------+ POLL_READ_BYTE (IN1INT, bIn); // USB0输入端点中断寄存器 | POLL_READ_BYTE (OUT1INT, bOut); // USB0输出端点中断寄存器 | { | if (bCommon & rbRSUINT) { // 恢复-> 没有实质的动作 | Usb_Resume (); ------------*-+ } | | if (bCommon & rbRSTINT) { // 复位 | | Usb_Reset (); ------------*-*-+ } | | | if (bCommon & rbSUSINT) { // 挂起 | | | Usb_Suspend (); ------------*-*-*---+ } | | | | if (bIn & rbEP0) { // 端点0中断处理 | | | | Handle_Control (); ------------*-*-*---*-----+ } | | | | | if (bIn & rbIN1) { // 端点1输入中断处理 | | | | | Handle_In1 (); ------------*-*-*---*-+ | } | | | | | | if (bOut & rbOUT1) { // 端点1输出中断处理 | | | | | | Handle_Out1 (); ------------*-*-*---*-*-+ | } | | | | | | | } | | | | | | | } | | | | | | | | | | | | | | #define POLL_READ_BYTE(addr, target) while(USB0ADR & 0x80); <-----+ | | | | | | READ_BYTE(addr, target); -------+ | | | | | | | | | | | | | #define READ_BYTE(addr, target) USB0ADR = (0x80 | addr); <------+ | | | | | | while (USB0ADR & 0x80); target = USB0DAT | | | | | | | | | | | | void Usb_Resume(void) <------------------------------+ | | | | | { | | | | | volatile int k; | | | | | | | | | | k++; | | | | | | | | | | // Add code for resume | | | | | } | | | | | | | | | | void Usb_Reset (void) <--------------------------------+ | | | | { | | | | USB0_STATE = DEV_DEFAULT; // Set device state to default | | | | | | | | POLL_WRITE_BYTE (POWER, 0x01); // Clear usb inhibit bit to enable USB | | | | // suspend detection | | | | | | | | EP_STATUS[0] = EP_IDLE; // Set default Endpoint Status | | | | EP_STATUS[1] = EP_HALT; | | | | EP_STATUS[2] = EP_HALT; | | | | } | | | | | | | | void Usb_Suspend (void) <----------------------------------------------+ | | | { | | | volatile int k; | | | k++; | | | } | | | | | | void Handle_In1 () <------------------------------------------------+ | | { | | EP_STATUS[1] = EP_IDLE; | | } | | | | void Handle_Out1 () <--------------------------------------------------+ | { | | unsigned char Count = 0; | unsigned char ControlReg; | | POLL_WRITE_BYTE (INDEX, 1); // Set index to endpoint 2 registers | POLL_READ_BYTE (EOUTCSR1, ControlReg); | | if (EP_STATUS[1] == EP_HALT) // If endpoint is halted, send a stall | { | POLL_WRITE_BYTE (EOUTCSR1, rbOutSDSTL); | } | | else // Otherwise read received packet | // from host | { | if (ControlReg & rbOutSTSTL) // Clear sent stall bit if last | // packet was a stall | { | POLL_WRITE_BYTE (EOUTCSR1, rbOutCLRDT); | } | | Setup_OUT_BUFFER (); // configure buffer to save | // received data | Fifo_Read(FIFO_EP1, OUT_BUFFER.Length, OUT_BUFFER.Ptr); | | // process data according to received Report ID. | // In systems with Report Descriptors that do not define report IDs, | // the host will still format OUT packets with a prefix byte | // of '0x00'. | | ReportHandler_OUT (OUT_BUFFER.Ptr[0]); | | POLL_WRITE_BYTE (EOUTCSR1, 0); // Clear Out Packet ready bit | } | } | | //----------------------------------------------------------------------------- | // Handle_Control | //----------------------------------------------------------------------------- | // | // Return Value : None | // Parameters : None | // | // - Decode Incoming SETUP requests | // - Load data packets on fifo while in transmit mode | // | //----------------------------------------------------------------------------- | | void Handle_Control (void) <--------------------------------------+ { unsigned char ControlReg; // Temporary storage for EP control register POLL_WRITE_BYTE (INDEX, 0); // ¶ËµãË÷ÒýÖÁ ¶Ëµã0 POLL_READ_BYTE (E0CSR, ControlReg); // Read control register if (EP_STATUS[0] == EP_ADDRESS) // Handle Status Phase of Set Address // command { POLL_WRITE_BYTE (FADDR, SETUP.wValue.c[LSB]); EP_STATUS[0] = EP_IDLE; } if (ControlReg & rbSTSTL) // If last packet was a sent stall, { // reset STSTL bit and return EP0 // to idle state POLL_WRITE_BYTE (E0CSR, 0); EP_STATUS[0] = EP_IDLE; return; } if (ControlReg & rbSUEND) // If last SETUP transaction was { // ended prematurely then set POLL_WRITE_BYTE (E0CSR, rbDATAEND); // Serviced SETUP End bit and return EP0 POLL_WRITE_BYTE (E0CSR, rbSSUEND); EP_STATUS[0] = EP_IDLE; // to idle state } if (EP_STATUS[0] == EP_IDLE) // If Endpoint 0 is in idle mode { if (ControlReg & rbOPRDY) // Make sure that EP 0 has an Out Packet { // ready from host although if EP0 // is idle, this should always be the case /* typedef struct { // typedef union {unsigned int i; unsigned char c[2];} WORD; unsigned char bmRequestType; // Request recipient, type, and dir. unsigned char bRequest; // Specific standard request number WORD wValue; // varies according to request WORD wIndex; // varies according to request WORD wLength; // Number of bytes to transfer } setup_buffer; // End of SETUP Packet Type */ Fifo_Read (FIFO_EP0, 8, (unsigned char *)&SETUP); // Get SETUP Packet off of Fifo, it is currently Big-Endian // Compiler Specific - these next three statements swap the bytes of the // SETUP packet words to Big Endian so they can be compared to other 16-bit // values elsewhere properly SETUP.wValue.i = SETUP.wValue.c[MSB] + 256*SETUP.wValue.c[LSB]; SETUP.wIndex.i = SETUP.wIndex.c[MSB] + 256*SETUP.wIndex.c[LSB]; SETUP.wLength.i = SETUP.wLength.c[MSB] + 256*SETUP.wLength.c[LSB]; // Intercept HID class-specific requests if( (SETUP.bmRequestType & ~0x80) == DSC_HID) { switch (SETUP.bRequest) { case GET_REPORT: Get_Report (); ----------------------------------+ break; | case SET_REPORT: | Set_Report (); | break; | case GET_IDLE: | Get_Idle (); | break; | case SET_IDLE: | Set_Idle (); | break; | case GET_PROTOCOL: | Get_Protocol (); | break; | case SET_PROTOCOL: | Set_Protocol (); | break; | default: | Force_Stall (); // Send stall to host if invalid | break; // request | } | } else | | switch (SETUP.bRequest) // Call correct subroutine to handle | { // each kind of standard request | case GET_STATUS: | Get_Status (); | break; | case CLEAR_FEATURE: | Clear_Feature (); | break; | case SET_FEATURE: | Set_Feature (); | break; | case SET_ADDRESS: | Set_Address (); | break; | case GET_DESCRIPTOR: | Get_Descriptor (); | break; | case GET_CONFIGURATION: | Get_Configuration (); | break; | case SET_CONFIGURATION: | Set_Configuration (); | break; | case GET_INTERFACE: | Get_Interface (); | break; | case SET_INTERFACE: | Set_Interface (); | break; | default: | Force_Stall (); // Send stall to host if invalid request| break; | } | } | } | | if (EP_STATUS[0] == EP_TX) // See if endpoint should transmit | { | if (!(ControlReg & rbINPRDY) ) // Don't overwrite last packet | { | // Read control register | POLL_READ_BYTE (E0CSR, ControlReg); | | // Check to see if SETUP End or Out Packet received, if so do not put | // any new data on FIFO | if ((!(ControlReg & rbSUEND)) || (!(ControlReg & rbOPRDY))) | { | // Add In Packet ready flag to E0CSR bitmask | ControlReg = rbINPRDY; | if (DATASIZE >= EP0_PACKET_SIZE) | { | // Break Data into multiple packets if larger than Max Packet | Fifo_Write_InterruptServiceRoutine (FIFO_EP0, EP0_PACKET_SIZE, | (unsigned char*)DATAPTR); | // Advance data pointer | DATAPTR += EP0_PACKET_SIZE; | // Decrement data size | DATASIZE -= EP0_PACKET_SIZE; | // Increment data sent counter | DATASENT += EP0_PACKET_SIZE; | } | else | { | // If data is less than Max Packet size or zero | Fifo_Write_InterruptServiceRoutine (FIFO_EP0, DATASIZE, | (unsigned char*)DATAPTR); | ControlReg |= rbDATAEND;// Add Data End bit to bitmask | EP_STATUS[0] = EP_IDLE; // Return EP 0 to idle state | } | if (DATASENT == SETUP.wLength.i) | { | // This case exists when the host requests an even multiple of | // your endpoint zero max packet size, and you need to exit | // transmit mode without sending a zero length packet | ControlReg |= rbDATAEND;// Add Data End bit to mask | EP_STATUS[0] = EP_IDLE; // Return EP 0 to idle state | } | // Write mask to E0CSR | POLL_WRITE_BYTE(E0CSR, ControlReg); | } | } | } | | if (EP_STATUS[0] == EP_RX) // See if endpoint should transmit | { | // Read control register | POLL_READ_BYTE (E0CSR, ControlReg); | if (ControlReg & rbOPRDY) // Verify packet was received | { | ControlReg = rbSOPRDY; | if (DATASIZE >= EP0_PACKET_SIZE) | { | Fifo_Read(FIFO_EP0, EP0_PACKET_SIZE, (unsigned char*)DATAPTR); | // Advance data pointer | DATAPTR += EP0_PACKET_SIZE; | // Decrement data size | DATASIZE -= EP0_PACKET_SIZE; | // Increment data sent counter | DATASENT += EP0_PACKET_SIZE; | } | else | { | // read bytes from FIFO | Fifo_Read (FIFO_EP0, DATASIZE, (unsigned char*) DATAPTR); | | ControlReg |= rbDATAEND; // signal end of data | EP_STATUS[0] = EP_IDLE; // set Endpoint to IDLE | } | if (DATASENT == SETUP.wLength.i) | { | ControlReg |= rbDATAEND; | EP_STATUS[0] = EP_IDLE; | } | // if EP_RX mode was entered through a SET_REPORT request, | // call the ReportHandler_OUT function and pass the Report | // ID, which is the first by the of DATAPTR's buffer | if ( (EP_STATUS[0] == EP_IDLE) && (SETUP.bRequest == SET_REPORT) ) | { | ReportHandler_OUT (*DATAPTR); | } | | if (EP_STATUS[0] != EP_STALL) POLL_WRITE_BYTE (E0CSR, ControlReg); | } | } | | } | | //----------------------------------------------------------------------------- | // | // Return Value - None | // Parameters - None | // | // Description: Sends a given report type to the host. | // | //----------------------------------------------------------------------------- | void Get_Report (void) <------------------------------+ { // call appropriate handler to prepare buffer ReportHandler_IN_ISR(SETUP.wValue.c[LSB]); --------------------+ // set DATAPTR to buffer used inside Control Endpoint | DATAPTR = IN_BUFFER.Ptr; | DATASIZE = IN_BUFFER.Length; | | if (EP_STATUS[0] != EP_STALL) | { | // Set serviced SETUP Packet | POLL_WRITE_BYTE (E0CSR, rbSOPRDY); | EP_STATUS[0] = EP_TX; // Endpoint 0 in transmit mode | DATASENT = 0; // Reset DATASENT counter | } | } | | void ReportHandler_IN_ISR(unsigned char R_ID) <--------------------+ { unsigned char index; index = 0; while(index <= IN_VECTORTABLESize) { // check to see if Report ID passed into function // matches the Report ID for this entry in the Vector Table if(IN_VECTORTABLE[index].ReportID == R_ID) ---------------------------+ { | IN_VECTORTABLE[index].hdlr(); | break; | } | | // if Report IDs didn't match, increment the index pointer | index++; | } | | } | | // **************************************************************************** | // Link all Report Handler functions to corresponding Report IDs | // **************************************************************************** | | const VectorTableEntry code IN_VECTORTABLE[IN_VECTORTABLESize] = <-----------+ { // FORMAT: Report ID, Report Handler 0, IN_Report ------+ }; | | void IN_Report(void){ <---------------------------+ // save left mouse button stat to bit 0 of first data byte // IN_PACKET[2] = MOUSE_BUTTON1; // IN_PACKET[3] = MOUSE_BUTTON2; IN_BUFFER.Ptr = IN_PACKET; ---------+ IN_BUFFER.Length = 8; | | } | | unsigned char IN_PACKET[8] ={0,0,0,0,0,0,0,0}; <--------+