1 /*

     2  * QEMU Bluetooth HCI logic.

     3  *

     4  * Copyright (C) 2007 OpenMoko, Inc.

     5  * Copyright (C) 2008 Andrzej Zaborowski  <balrog@zabor.org>

     6  *

     7  * This program is free software; you can redistribute it and/or

     8  * modify it under the terms of the GNU General Public License as

     9  * published by the Free Software Foundation; either version 2 of

    10  * the License, or (at your option) any later version.

    11  *

    12  * This program is distributed in the hope that it will be useful,

    13  * but WITHOUT ANY WARRANTY; without even the implied warranty of

    14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

    15  * GNU General Public License for more details.

    16  *

    17  * You should have received a copy of the GNU General Public License

    18  * along with this program; if not, write to the Free Software

    19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,

    20  * MA  02110-1301  USA

    21  */

    22 

    23 #include "qemu-common.h"

    24 #include "qemu-timer.h"

    25 #include "usb.h"

    26 #include "net.h"

    27 #include "bt.h"

    28 

    29 struct bt_hci_s {

    30     uint8_t *(*evt_packet)(void *opaque);

    31     void (*evt_submit)(void *opaque, int len);

    32     void *opaque;

    33     uint8_t evt_buf[256];

    34 

    35     uint8_t acl_buf[4096];

    36     int acl_len;

    37 

    38     uint16_t asb_handle;

    39     uint16_t psb_handle;

    40 

    41     int last_cmd;	/* Note: Always little-endian */

    42 

    43     struct bt_device_s *conn_req_host;

    44 

    45     struct {

    46         int inquire;

    47         int periodic;

    48         int responses_left;

    49         int responses;

    50         QEMUTimer *inquiry_done;

    51         QEMUTimer *inquiry_next;

    52         int inquiry_length;

    53         int inquiry_period;

    54         int inquiry_mode;

    55 

    56 #define HCI_HANDLE_OFFSET	0x20

    57 #define HCI_HANDLES_MAX		0x10

    58         struct bt_hci_master_link_s {

    59             struct bt_link_s *link;

    60             void (*lmp_acl_data)(struct bt_link_s *link,

    61                             const uint8_t *data, int start, int len);

    62             QEMUTimer *acl_mode_timer;

    63         } handle[HCI_HANDLES_MAX];

    64         uint32_t role_bmp;

    65         int last_handle;

    66         int connecting;

    67         bdaddr_t awaiting_bdaddr[HCI_HANDLES_MAX];

    68     } lm;

    69 

    70     uint8_t event_mask[8];

    71     uint16_t voice_setting;	/* Notw: Always little-endian */

    72     uint16_t conn_accept_tout;

    73     QEMUTimer *conn_accept_timer;

    74 

    75     struct HCIInfo info;

    76     struct bt_device_s device;

    77 };

    78 

    79 #define DEFAULT_RSSI_DBM	20

    80 

    81 #define hci_from_info(ptr)	container_of((ptr), struct bt_hci_s, info)

    82 #define hci_from_device(ptr)	container_of((ptr), struct bt_hci_s, device)

    83 

    84 struct bt_hci_link_s {

    85     struct bt_link_s btlink;

    86     uint16_t handle;	/* Local */

    87 };

    88 

    89 /* LMP layer emulation */

    90 #if 0

    91 static void bt_submit_lmp(struct bt_device_s *bt, int length, uint8_t *data)

    92 {

    93     int resp, resplen, error, op, tr;

    94     uint8_t respdata[17];

    95 

    96     if (length < 1)

    97         return;

    98 

    99     tr = *data & 1;

   100     op = *(data ++) >> 1;

   101     resp = LMP_ACCEPTED;

   102     resplen = 2;

   103     respdata[1] = op;

   104     error = 0;

   105     length --;

   106 

   107     if (op >= 0x7c) {	/* Extended opcode */

   108         op |= *(data ++) << 8;

   109         resp = LMP_ACCEPTED_EXT;

   110         resplen = 4;

   111         respdata[0] = op >> 8;

   112         respdata[1] = op & 0xff;

   113         length --;

   114     }

   115 

   116     switch (op) {

   117     case LMP_ACCEPTED:

   118         /* data[0]	Op code

   119          */

   120         if (length < 1) {

   121             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   122             goto not_accepted;

   123         }

   124         resp = 0;

   125         break;

   126 

   127     case LMP_ACCEPTED_EXT:

   128         /* data[0]	Escape op code

   129          * data[1]	Extended op code

   130          */

   131         if (length < 2) {

   132             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   133             goto not_accepted;

   134         }

   135         resp = 0;

   136         break;

   137 

   138     case LMP_NOT_ACCEPTED:

   139         /* data[0]	Op code

   140          * data[1]	Error code

   141          */

   142         if (length < 2) {

   143             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   144             goto not_accepted;

   145         }

   146         resp = 0;

   147         break;

   148 

   149     case LMP_NOT_ACCEPTED_EXT:

   150         /* data[0]	Op code

   151          * data[1]	Extended op code

   152          * data[2]	Error code

   153          */

   154         if (length < 3) {

   155             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   156             goto not_accepted;

   157         }

   158         resp = 0;

   159         break;

   160 

   161     case LMP_HOST_CONNECTION_REQ:

   162         break;

   163 

   164     case LMP_SETUP_COMPLETE:

   165         resp = LMP_SETUP_COMPLETE;

   166         resplen = 1;

   167         bt->setup = 1;

   168         break;

   169 

   170     case LMP_DETACH:

   171         /* data[0]	Error code

   172          */

   173         if (length < 1) {

   174             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   175             goto not_accepted;

   176         }

   177         bt->setup = 0;

   178         resp = 0;

   179         break;

   180 

   181     case LMP_SUPERVISION_TIMEOUT:

   182         /* data[0,1]	Supervision timeout

   183          */

   184         if (length < 2) {

   185             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   186             goto not_accepted;

   187         }

   188         resp = 0;

   189         break;

   190 

   191     case LMP_QUALITY_OF_SERVICE:

   192         resp = 0;

   193         /* Fall through */

   194     case LMP_QOS_REQ:

   195         /* data[0,1]	Poll interval

   196          * data[2]	N(BC)

   197          */

   198         if (length < 3) {

   199             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   200             goto not_accepted;

   201         }

   202         break;

   203 

   204     case LMP_MAX_SLOT:

   205         resp = 0;

   206         /* Fall through */

   207     case LMP_MAX_SLOT_REQ:

   208         /* data[0]	Max slots

   209          */

   210         if (length < 1) {

   211             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   212             goto not_accepted;

   213         }

   214         break;

   215 

   216     case LMP_AU_RAND:

   217     case LMP_IN_RAND:

   218     case LMP_COMB_KEY:

   219         /* data[0-15]	Random number

   220          */

   221         if (length < 16) {

   222             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   223             goto not_accepted;

   224         }

   225         if (op == LMP_AU_RAND) {

   226             if (bt->key_present) {

   227                 resp = LMP_SRES;

   228                 resplen = 5;

   229                 /* XXX: [Part H] Section 6.1 on page 801 */

   230             } else {

   231                 error = HCI_PIN_OR_KEY_MISSING;

   232                 goto not_accepted;

   233             }

   234         } else if (op == LMP_IN_RAND) {

   235             error = HCI_PAIRING_NOT_ALLOWED;

   236             goto not_accepted;

   237         } else {

   238             /* XXX: [Part H] Section 3.2 on page 779 */

   239             resp = LMP_UNIT_KEY;

   240             resplen = 17;

   241             memcpy(respdata + 1, bt->key, 16);

   242 

   243             error = HCI_UNIT_LINK_KEY_USED;

   244             goto not_accepted;

   245         }

   246         break;

   247 

   248     case LMP_UNIT_KEY:

   249         /* data[0-15]	Key

   250          */

   251         if (length < 16) {

   252             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   253             goto not_accepted;

   254         }

   255         memcpy(bt->key, data, 16);

   256         bt->key_present = 1;

   257         break;

   258 

   259     case LMP_SRES:

   260         /* data[0-3]	Authentication response

   261          */

   262         if (length < 4) {

   263             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   264             goto not_accepted;

   265         }

   266         break;

   267 

   268     case LMP_CLKOFFSET_REQ:

   269         resp = LMP_CLKOFFSET_RES;

   270         resplen = 3;

   271         respdata[1] = 0x33;

   272         respdata[2] = 0x33;

   273         break;

   274 

   275     case LMP_CLKOFFSET_RES:

   276         /* data[0,1]	Clock offset

   277          * (Slave to master only)

   278          */

   279         if (length < 2) {

   280             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   281             goto not_accepted;

   282         }

   283         break;

   284 

   285     case LMP_VERSION_REQ:

   286     case LMP_VERSION_RES:

   287         /* data[0]	VersNr

   288          * data[1,2]	CompId

   289          * data[3,4]	SubVersNr

   290          */

   291         if (length < 5) {

   292             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   293             goto not_accepted;

   294         }

   295         if (op == LMP_VERSION_REQ) {

   296             resp = LMP_VERSION_RES;

   297             resplen = 6;

   298             respdata[1] = 0x20;

   299             respdata[2] = 0xff;

   300             respdata[3] = 0xff;

   301             respdata[4] = 0xff;

   302             respdata[5] = 0xff;

   303         } else

   304             resp = 0;

   305         break;

   306 

   307     case LMP_FEATURES_REQ:

   308     case LMP_FEATURES_RES:

   309         /* data[0-7]	Features

   310          */

   311         if (length < 8) {

   312             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   313             goto not_accepted;

   314         }

   315         if (op == LMP_FEATURES_REQ) {

   316             resp = LMP_FEATURES_RES;

   317             resplen = 9;

   318             respdata[1] = (bt->lmp_caps >> 0) & 0xff;

   319             respdata[2] = (bt->lmp_caps >> 8) & 0xff;

   320             respdata[3] = (bt->lmp_caps >> 16) & 0xff;

   321             respdata[4] = (bt->lmp_caps >> 24) & 0xff;

   322             respdata[5] = (bt->lmp_caps >> 32) & 0xff;

   323             respdata[6] = (bt->lmp_caps >> 40) & 0xff;

   324             respdata[7] = (bt->lmp_caps >> 48) & 0xff;

   325             respdata[8] = (bt->lmp_caps >> 56) & 0xff;

   326         } else

   327             resp = 0;

   328         break;

   329 

   330     case LMP_NAME_REQ:

   331         /* data[0]	Name offset

   332          */

   333         if (length < 1) {

   334             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   335             goto not_accepted;

   336         }

   337         resp = LMP_NAME_RES;

   338         resplen = 17;

   339         respdata[1] = data[0];

   340         respdata[2] = strlen(bt->lmp_name);

   341         memset(respdata + 3, 0x00, 14);

   342         if (respdata[2] > respdata[1])

   343             memcpy(respdata + 3, bt->lmp_name + respdata[1],

   344                             respdata[2] - respdata[1]);

   345         break;

   346 

   347     case LMP_NAME_RES:

   348         /* data[0]	Name offset

   349          * data[1]	Name length

   350          * data[2-15]	Name fragment

   351          */

   352         if (length < 16) {

   353             error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

   354             goto not_accepted;

   355         }

   356         resp = 0;

   357         break;

   358 

   359     default:

   360         error = HCI_UNKNOWN_LMP_PDU;

   361         /* Fall through */

   362     not_accepted:

   363         if (op >> 8) {

   364             resp = LMP_NOT_ACCEPTED_EXT;

   365             resplen = 5;

   366             respdata[0] = op >> 8;

   367             respdata[1] = op & 0xff;

   368             respdata[2] = error;

   369         } else {

   370             resp = LMP_NOT_ACCEPTED;

   371             resplen = 3;

   372             respdata[0] = op & 0xff;

   373             respdata[1] = error;

   374         }

   375     }

   376 

   377     if (resp == 0)

   378         return;

   379 

   380     if (resp >> 8) {

   381         respdata[0] = resp >> 8;

   382         respdata[1] = resp & 0xff;

   383     } else

   384         respdata[0] = resp & 0xff;

   385 

   386     respdata[0] <<= 1;

   387     respdata[0] |= tr;

   388 }

   389 

   390 static void bt_submit_raw_acl(struct bt_piconet_s *net, int length, uint8_t *data)

   391 {

   392     struct bt_device_s *slave;

   393     if (length < 1)

   394         return;

   395 

   396     slave = 0;

   397 #if 0

   398     slave = net->slave;

   399 #endif

   400 

   401     switch (data[0] & 3) {

   402     case LLID_ACLC:

   403         bt_submit_lmp(slave, length - 1, data + 1);

   404         break;

   405     case LLID_ACLU_START:

   406 #if 0

   407         bt_sumbit_l2cap(slave, length - 1, data + 1, (data[0] >> 2) & 1);

   408         breka;

   409 #endif

   410     default:

   411     case LLID_ACLU_CONT:

   412         break;

   413     }

   414 }

   415 #endif

   416 

   417 /* HCI layer emulation */

   418 

   419 /* Note: we could ignore endiannes because unswapped handles will still

   420  * be valid as connection identifiers for the guest - they don't have to

   421  * be continuously allocated.  We do it though, to preserve similar

   422  * behaviour between hosts.  Some things, like the BD_ADDR cannot be

   423  * preserved though (for example if a real hci is used).  */

   424 #ifdef WORDS_BIGENDIAN

   425 # define HNDL(raw)	bswap16(raw)

   426 #else

   427 # define HNDL(raw)	(raw)

   428 #endif

   429 

   430 static const uint8_t bt_event_reserved_mask[8] = {

   431     0xff, 0x9f, 0xfb, 0xff, 0x07, 0x18, 0x00, 0x00,

   432 };

   433 

   434 static inline uint8_t *bt_hci_event_start(struct bt_hci_s *hci,

   435                 int evt, int len)

   436 {

   437     uint8_t *packet, mask;

   438     int mask_byte;

   439 

   440     if (len > 255) {

   441         fprintf(stderr, "%s: HCI event params too long (%ib)\n",

   442                         __FUNCTION__, len);

   443         exit(-1);

   444     }

   445 

   446     mask_byte = (evt - 1) >> 3;

   447     mask = 1 << ((evt - 1) & 3);

   448     if (mask & bt_event_reserved_mask[mask_byte] & ~hci->event_mask[mask_byte])

   449         return 0;

   450 

   451     packet = hci->evt_packet(hci->opaque);

   452     packet[0] = evt;

   453     packet[1] = len;

   454 

   455     return &packet[2];

   456 }

   457 

   458 static inline void bt_hci_event(struct bt_hci_s *hci, int evt,

   459                 void *params, int len)

   460 {

   461     uint8_t *packet = bt_hci_event_start(hci, evt, len);

   462 

   463     if (!packet)

   464         return;

   465 

   466     if (len)

   467         memcpy(packet, params, len);

   468 

   469     hci->evt_submit(hci->opaque, len + 2);

   470 }

   471 

   472 static inline void bt_hci_event_status(struct bt_hci_s *hci, int status)

   473 {

   474     evt_cmd_status params = {

   475         .status	= status,

   476         .ncmd	= 1,

   477         .opcode	= hci->last_cmd,

   478     };

   479 

   480     bt_hci_event(hci, EVT_CMD_STATUS, &params, EVT_CMD_STATUS_SIZE);

   481 }

   482 

   483 static inline void bt_hci_event_complete(struct bt_hci_s *hci,

   484                 void *ret, int len)

   485 {

   486     uint8_t *packet = bt_hci_event_start(hci, EVT_CMD_COMPLETE,

   487                     len + EVT_CMD_COMPLETE_SIZE);

   488     evt_cmd_complete *params = (evt_cmd_complete *) packet;

   489 

   490     if (!packet)

   491         return;

   492 

   493     params->ncmd	= 1;

   494     params->opcode	= hci->last_cmd;

   495     if (len)

   496         memcpy(&packet[EVT_CMD_COMPLETE_SIZE], ret, len);

   497 

   498     hci->evt_submit(hci->opaque, len + EVT_CMD_COMPLETE_SIZE + 2);

   499 }

   500 

   501 static void bt_hci_inquiry_done(void *opaque)

   502 {

   503     struct bt_hci_s *hci = (struct bt_hci_s *) opaque;

   504     uint8_t status = HCI_SUCCESS;

   505 

   506     if (!hci->lm.periodic)

   507         hci->lm.inquire = 0;

   508 

   509     /* The specification is inconsistent about this one.  Page 565 reads

   510      * "The event parameters of Inquiry Complete event will have a summary

   511      * of the result from the Inquiry process, which reports the number of

   512      * nearby Bluetooth devices that responded [so hci->responses].", but

   513      * Event Parameters (see page 729) has only Status.  */

   514     bt_hci_event(hci, EVT_INQUIRY_COMPLETE, &status, 1);

   515 }

   516 

   517 static void bt_hci_inquiry_result_standard(struct bt_hci_s *hci,

   518                 struct bt_device_s *slave)

   519 {

   520     inquiry_info params = {

   521         .num_responses		= 1,

   522         .bdaddr			= BAINIT(&slave->bd_addr),

   523         .pscan_rep_mode		= 0x00,	/* R0 */

   524         .pscan_period_mode	= 0x00,	/* P0 - deprecated */

   525         .pscan_mode		= 0x00,	/* Standard scan - deprecated */

   526         .dev_class[0]		= slave->class[0],

   527         .dev_class[1]		= slave->class[1],

   528         .dev_class[2]		= slave->class[2],

   529         /* TODO: return the clkoff *differenece* */

   530         .clock_offset		= slave->clkoff,	/* Note: no swapping */

   531     };

   532 

   533     bt_hci_event(hci, EVT_INQUIRY_RESULT, &params, INQUIRY_INFO_SIZE);

   534 }

   535 

   536 static void bt_hci_inquiry_result_with_rssi(struct bt_hci_s *hci,

   537                 struct bt_device_s *slave)

   538 {

   539     inquiry_info_with_rssi params = {

   540         .num_responses		= 1,

   541         .bdaddr			= BAINIT(&slave->bd_addr),

   542         .pscan_rep_mode		= 0x00,	/* R0 */

   543         .pscan_period_mode	= 0x00,	/* P0 - deprecated */

   544         .dev_class[0]		= slave->class[0],

   545         .dev_class[1]		= slave->class[1],

   546         .dev_class[2]		= slave->class[2],

   547         /* TODO: return the clkoff *differenece* */

   548         .clock_offset		= slave->clkoff,	/* Note: no swapping */

   549         .rssi			= DEFAULT_RSSI_DBM,

   550     };

   551 

   552     bt_hci_event(hci, EVT_INQUIRY_RESULT_WITH_RSSI,

   553                     &params, INQUIRY_INFO_WITH_RSSI_SIZE);

   554 }

   555 

   556 static void bt_hci_inquiry_result(struct bt_hci_s *hci,

   557                 struct bt_device_s *slave)

   558 {

   559     if (!slave->inquiry_scan || !hci->lm.responses_left)

   560         return;

   561 

   562     hci->lm.responses_left --;

   563     hci->lm.responses ++;

   564 

   565     switch (hci->lm.inquiry_mode) {

   566     case 0x00:

   567         return bt_hci_inquiry_result_standard(hci, slave);

   568     case 0x01:

   569         return bt_hci_inquiry_result_with_rssi(hci, slave);

   570     default:

   571         fprintf(stderr, "%s: bad inquiry mode %02x\n", __FUNCTION__,

   572                         hci->lm.inquiry_mode);

   573         exit(-1);

   574     }

   575 }

   576 

   577 static void bt_hci_mod_timer_1280ms(QEMUTimer *timer, int period)

   578 {

   579     qemu_mod_timer(timer, qemu_get_clock(vm_clock) +

   580                     muldiv64(period << 7, ticks_per_sec, 100));

   581 }

   582 

   583 static void bt_hci_inquiry_start(struct bt_hci_s *hci, int length)

   584 {

   585     struct bt_device_s *slave;

   586 

   587     hci->lm.inquiry_length = length;

   588     for (slave = hci->device.net->slave; slave; slave = slave->next)

   589         /* Don't uncover ourselves.  */

   590         if (slave != &hci->device)

   591             bt_hci_inquiry_result(hci, slave);

   592 

   593     /* TODO: register for a callback on a new device's addition to the

   594      * scatternet so that if it's added before inquiry_length expires,

   595      * an Inquiry Result is generated immediately.  Alternatively re-loop

   596      * through the devices on the inquiry_length expiration and report

   597      * devices not seen before.  */

   598     if (hci->lm.responses_left)

   599         bt_hci_mod_timer_1280ms(hci->lm.inquiry_done, hci->lm.inquiry_length);

   600     else

   601         bt_hci_inquiry_done(hci);

   602 

   603     if (hci->lm.periodic)

   604         bt_hci_mod_timer_1280ms(hci->lm.inquiry_next, hci->lm.inquiry_period);

   605 }

   606 

   607 static void bt_hci_inquiry_next(void *opaque)

   608 {

   609     struct bt_hci_s *hci = (struct bt_hci_s *) opaque;

   610 

   611     hci->lm.responses_left += hci->lm.responses;

   612     hci->lm.responses = 0;

   613     bt_hci_inquiry_start(hci,  hci->lm.inquiry_length);

   614 }

   615 

   616 static inline int bt_hci_handle_bad(struct bt_hci_s *hci, uint16_t handle)

   617 {

   618     return !(handle & HCI_HANDLE_OFFSET) ||

   619             handle >= (HCI_HANDLE_OFFSET | HCI_HANDLES_MAX) ||

   620             !hci->lm.handle[handle & ~HCI_HANDLE_OFFSET].link;

   621 }

   622 

   623 static inline int bt_hci_role_master(struct bt_hci_s *hci, uint16_t handle)

   624 {

   625     return !!(hci->lm.role_bmp & (1 << (handle & ~HCI_HANDLE_OFFSET)));

   626 }

   627 

   628 static inline struct bt_device_s *bt_hci_remote_dev(struct bt_hci_s *hci,

   629                 uint16_t handle)

   630 {

   631     struct bt_link_s *link = hci->lm.handle[handle & ~HCI_HANDLE_OFFSET].link;

   632 

   633     return bt_hci_role_master(hci, handle) ? link->slave : link->host;

   634 }

   635 

   636 static void bt_hci_mode_tick(void *opaque);

   637 static void bt_hci_lmp_link_establish(struct bt_hci_s *hci,

   638                 struct bt_link_s *link, int master)

   639 {

   640     hci->lm.handle[hci->lm.last_handle].link = link;

   641 

   642     if (master) {

   643         /* We are the master side of an ACL link */

   644         hci->lm.role_bmp |= 1 << hci->lm.last_handle;

   645 

   646         hci->lm.handle[hci->lm.last_handle].lmp_acl_data =

   647                 link->slave->lmp_acl_data;

   648     } else {

   649         /* We are the slave side of an ACL link */

   650         hci->lm.role_bmp &= ~(1 << hci->lm.last_handle);

   651 

   652         hci->lm.handle[hci->lm.last_handle].lmp_acl_data =

   653                 link->host->lmp_acl_resp;

   654     }

   655 

   656     /* Mode */

   657     if (master) {

   658         link->acl_mode = acl_active;

   659         hci->lm.handle[hci->lm.last_handle].acl_mode_timer =

   660                 qemu_new_timer(vm_clock, bt_hci_mode_tick, link);

   661     }

   662 }

   663 

   664 static void bt_hci_lmp_link_teardown(struct bt_hci_s *hci, uint16_t handle)

   665 {

   666     handle &= ~HCI_HANDLE_OFFSET;

   667     hci->lm.handle[handle].link = 0;

   668 

   669     if (bt_hci_role_master(hci, handle)) {

   670         qemu_del_timer(hci->lm.handle[handle].acl_mode_timer);

   671         qemu_free_timer(hci->lm.handle[handle].acl_mode_timer);

   672     }

   673 }

   674 

   675 static int bt_hci_connect(struct bt_hci_s *hci, bdaddr_t *bdaddr)

   676 {

   677     struct bt_device_s *slave;

   678     struct bt_link_s link;

   679 

   680     for (slave = hci->device.net->slave; slave; slave = slave->next)

   681         if (slave->page_scan && !bacmp(&slave->bd_addr, bdaddr))

   682             break;

   683     if (!slave || slave == &hci->device)

   684         return -ENODEV;

   685 

   686     bacpy(&hci->lm.awaiting_bdaddr[hci->lm.connecting ++], &slave->bd_addr);

   687 

   688     link.slave = slave;

   689     link.host = &hci->device;

   690     link.slave->lmp_connection_request(&link);	/* Always last */

   691 

   692     return 0;

   693 }

   694 

   695 static void bt_hci_connection_reject(struct bt_hci_s *hci,

   696                 struct bt_device_s *host, uint8_t because)

   697 {

   698     struct bt_link_s link = {

   699         .slave	= &hci->device,

   700         .host	= host,

   701         /* Rest uninitialised */

   702     };

   703 

   704     host->reject_reason = because;

   705     host->lmp_connection_complete(&link);

   706 }

   707 

   708 static void bt_hci_connection_reject_event(struct bt_hci_s *hci,

   709                 bdaddr_t *bdaddr)

   710 {

   711     evt_conn_complete params;

   712 

   713     params.status	= HCI_NO_CONNECTION;

   714     params.handle	= 0;

   715     bacpy(&params.bdaddr, bdaddr);

   716     params.link_type	= ACL_LINK;

   717     params.encr_mode	= 0x00;		/* Encryption not required */

   718     bt_hci_event(hci, EVT_CONN_COMPLETE, &params, EVT_CONN_COMPLETE_SIZE);

   719 }

   720 

   721 static void bt_hci_connection_accept(struct bt_hci_s *hci,

   722                 struct bt_device_s *host)

   723 {

   724     struct bt_hci_link_s *link = qemu_mallocz(sizeof(struct bt_hci_link_s));

   725     evt_conn_complete params;

   726     uint16_t handle;

   727     uint8_t status = HCI_SUCCESS;

   728     int tries = HCI_HANDLES_MAX;

   729 

   730     /* Make a connection handle */

   731     do {

   732         while (hci->lm.handle[++ hci->lm.last_handle].link && -- tries)

   733             hci->lm.last_handle &= HCI_HANDLES_MAX - 1;

   734         handle = hci->lm.last_handle | HCI_HANDLE_OFFSET;

   735     } while ((handle == hci->asb_handle || handle == hci->psb_handle) &&

   736             tries);

   737 

   738     if (!tries) {

   739         qemu_free(link);

   740         bt_hci_connection_reject(hci, host, HCI_REJECTED_LIMITED_RESOURCES);

   741         status = HCI_NO_CONNECTION;

   742         goto complete;

   743     }

   744 

   745     link->btlink.slave	= &hci->device;

   746     link->btlink.host	= host;

   747     link->handle = handle;

   748 

   749     /* Link established */

   750     bt_hci_lmp_link_establish(hci, &link->btlink, 0);

   751 

   752 complete:

   753     params.status	= status;

   754     params.handle	= HNDL(handle);

   755     bacpy(&params.bdaddr, &host->bd_addr);

   756     params.link_type	= ACL_LINK;

   757     params.encr_mode	= 0x00;		/* Encryption not required */

   758     bt_hci_event(hci, EVT_CONN_COMPLETE, &params, EVT_CONN_COMPLETE_SIZE);

   759 

   760     /* Neets to be done at the very end because it can trigger a (nested)

   761      * disconnected, in case the other and had cancelled the request

   762      * locally.  */

   763     if (status == HCI_SUCCESS) {

   764         host->reject_reason = 0;

   765         host->lmp_connection_complete(&link->btlink);

   766     }

   767 }

   768 

   769 static void bt_hci_lmp_connection_request(struct bt_link_s *link)

   770 {

   771     struct bt_hci_s *hci = hci_from_device(link->slave);

   772     evt_conn_request params;

   773 

   774     if (hci->conn_req_host)

   775         return bt_hci_connection_reject(hci, link->host,

   776                         HCI_REJECTED_LIMITED_RESOURCES);

   777     hci->conn_req_host = link->host;

   778     /* TODO: if masked and auto-accept, then auto-accept,

   779      * if masked and not auto-accept, then auto-reject */

   780     /* TODO: kick the hci->conn_accept_timer, timeout after

   781      * hci->conn_accept_tout * 0.625 msec */

   782 

   783     bacpy(&params.bdaddr, &link->host->bd_addr);

   784     memcpy(&params.dev_class, &link->host->class, sizeof(params.dev_class));

   785     params.link_type	= ACL_LINK;

   786     bt_hci_event(hci, EVT_CONN_REQUEST, &params, EVT_CONN_REQUEST_SIZE);

   787     return;

   788 }

   789 

   790 static void bt_hci_conn_accept_timeout(void *opaque)

   791 {

   792     struct bt_hci_s *hci = (struct bt_hci_s *) opaque;

   793 

   794     if (!hci->conn_req_host)

   795         /* Already accepted or rejected.  If the other end cancelled the

   796          * connection request then we still have to reject or accept it

   797          * and then we'll get a disconnect.  */

   798         return;

   799 

   800     /* TODO */

   801 }

   802 

   803 /* Remove from the list of devices which we wanted to connect to and

   804  * are awaiting a response from.  If the callback sees a response from

   805  * a device which is not on the list it will assume it's a connection

   806  * that's been cancelled by the host in the meantime and immediately

   807  * try to detach the link and send a Connection Complete.  */

   808 static int bt_hci_lmp_connection_ready(struct bt_hci_s *hci,

   809                 bdaddr_t *bdaddr)

   810 {

   811     int i;

   812 

   813     for (i = 0; i < hci->lm.connecting; i ++)

   814         if (!bacmp(&hci->lm.awaiting_bdaddr[i], bdaddr)) {

   815             if (i < -- hci->lm.connecting)

   816                 bacpy(&hci->lm.awaiting_bdaddr[i],

   817                                 &hci->lm.awaiting_bdaddr[hci->lm.connecting]);

   818             return 0;

   819         }

   820 

   821     return 1;

   822 }

   823 

   824 static void bt_hci_lmp_connection_complete(struct bt_link_s *link)

   825 {

   826     struct bt_hci_s *hci = hci_from_device(link->host);

   827     evt_conn_complete params;

   828     uint16_t handle;

   829     uint8_t status = HCI_SUCCESS;

   830     int tries = HCI_HANDLES_MAX;

   831 

   832     if (bt_hci_lmp_connection_ready(hci, &link->slave->bd_addr)) {

   833         if (!hci->device.reject_reason)

   834             link->slave->lmp_disconnect_slave(link);

   835         handle = 0;

   836         status = HCI_NO_CONNECTION;

   837         goto complete;

   838     }

   839 

   840     if (hci->device.reject_reason) {

   841         handle = 0;

   842         status = hci->device.reject_reason;

   843         goto complete;

   844     }

   845 

   846     /* Make a connection handle */

   847     do {

   848         while (hci->lm.handle[++ hci->lm.last_handle].link && -- tries)

   849             hci->lm.last_handle &= HCI_HANDLES_MAX - 1;

   850         handle = hci->lm.last_handle | HCI_HANDLE_OFFSET;

   851     } while ((handle == hci->asb_handle || handle == hci->psb_handle) &&

   852             tries);

   853 

   854     if (!tries) {

   855         link->slave->lmp_disconnect_slave(link);

   856         status = HCI_NO_CONNECTION;

   857         goto complete;

   858     }

   859 

   860     /* Link established */

   861     link->handle = handle;

   862     bt_hci_lmp_link_establish(hci, link, 1);

   863 

   864 complete:

   865     params.status	= status;

   866     params.handle	= HNDL(handle);

   867     params.link_type	= ACL_LINK;

   868     bacpy(&params.bdaddr, &link->slave->bd_addr);

   869     params.encr_mode	= 0x00;		/* Encryption not required */

   870     bt_hci_event(hci, EVT_CONN_COMPLETE, &params, EVT_CONN_COMPLETE_SIZE);

   871 }

   872 

   873 static void bt_hci_disconnect(struct bt_hci_s *hci,

   874                 uint16_t handle, int reason)

   875 {

   876     struct bt_link_s *btlink =

   877             hci->lm.handle[handle & ~HCI_HANDLE_OFFSET].link;

   878     struct bt_hci_link_s *link;

   879     evt_disconn_complete params;

   880 

   881     if (bt_hci_role_master(hci, handle)) {

   882         btlink->slave->reject_reason = reason;

   883         btlink->slave->lmp_disconnect_slave(btlink);

   884         /* The link pointer is invalid from now on */

   885 

   886         goto complete;

   887     }

   888 

   889     btlink->host->reject_reason = reason;

   890     btlink->host->lmp_disconnect_master(btlink);

   891 

   892     /* We are the slave, we get to clean this burden */

   893     link = (struct bt_hci_link_s *) btlink;

   894     qemu_free(link);

   895 

   896 complete:

   897     bt_hci_lmp_link_teardown(hci, handle);

   898 

   899     params.status	= HCI_SUCCESS;

   900     params.handle	= HNDL(handle);

   901     params.reason	= HCI_CONNECTION_TERMINATED;

   902     bt_hci_event(hci, EVT_DISCONN_COMPLETE,

   903                     &params, EVT_DISCONN_COMPLETE_SIZE);

   904 }

   905 

   906 /* TODO: use only one function */

   907 static void bt_hci_lmp_disconnect_host(struct bt_link_s *link)

   908 {

   909     struct bt_hci_s *hci = hci_from_device(link->host);

   910     uint16_t handle = link->handle;

   911     evt_disconn_complete params;

   912 

   913     bt_hci_lmp_link_teardown(hci, handle);

   914 

   915     params.status	= HCI_SUCCESS;

   916     params.handle	= HNDL(handle);

   917     params.reason	= hci->device.reject_reason;

   918     bt_hci_event(hci, EVT_DISCONN_COMPLETE,

   919                     &params, EVT_DISCONN_COMPLETE_SIZE);

   920 }

   921 

   922 static void bt_hci_lmp_disconnect_slave(struct bt_link_s *btlink)

   923 {

   924     struct bt_hci_link_s *link = (struct bt_hci_link_s *) btlink;

   925     struct bt_hci_s *hci = hci_from_device(btlink->slave);

   926     uint16_t handle = link->handle;

   927     evt_disconn_complete params;

   928 

   929     qemu_free(link);

   930 

   931     bt_hci_lmp_link_teardown(hci, handle);

   932 

   933     params.status	= HCI_SUCCESS;

   934     params.handle	= HNDL(handle);

   935     params.reason	= hci->device.reject_reason;

   936     bt_hci_event(hci, EVT_DISCONN_COMPLETE,

   937                     &params, EVT_DISCONN_COMPLETE_SIZE);

   938 }

   939 

   940 static int bt_hci_name_req(struct bt_hci_s *hci, bdaddr_t *bdaddr)

   941 {

   942     struct bt_device_s *slave;

   943     evt_remote_name_req_complete params;

   944     int len;

   945 

   946     for (slave = hci->device.net->slave; slave; slave = slave->next)

   947         if (slave->page_scan && !bacmp(&slave->bd_addr, bdaddr))

   948             break;

   949     if (!slave)

   950         return -ENODEV;

   951 

   952     bt_hci_event_status(hci, HCI_SUCCESS);

   953 

   954     params.status       = HCI_SUCCESS;

   955     bacpy(&params.bdaddr, &slave->bd_addr);

   956     len = snprintf(params.name, sizeof(params.name),

   957                     "%s", slave->lmp_name ?: "");

   958     memset(params.name + len, 0, sizeof(params.name) - len);

   959     bt_hci_event(hci, EVT_REMOTE_NAME_REQ_COMPLETE,

   960                     &params, EVT_REMOTE_NAME_REQ_COMPLETE_SIZE);

   961 

   962     return 0;

   963 }

   964 

   965 static int bt_hci_features_req(struct bt_hci_s *hci, uint16_t handle)

   966 {

   967     struct bt_device_s *slave;

   968     evt_read_remote_features_complete params;

   969 

   970     if (bt_hci_handle_bad(hci, handle))

   971         return -ENODEV;

   972 

   973     slave = bt_hci_remote_dev(hci, handle);

   974 

   975     bt_hci_event_status(hci, HCI_SUCCESS);

   976 

   977     params.status	= HCI_SUCCESS;

   978     params.handle	= HNDL(handle);

   979     params.features[0]	= (slave->lmp_caps >>  0) & 0xff;

   980     params.features[1]	= (slave->lmp_caps >>  8) & 0xff;

   981     params.features[2]	= (slave->lmp_caps >> 16) & 0xff;

   982     params.features[3]	= (slave->lmp_caps >> 24) & 0xff;

   983     params.features[4]	= (slave->lmp_caps >> 32) & 0xff;

   984     params.features[5]	= (slave->lmp_caps >> 40) & 0xff;

   985     params.features[6]	= (slave->lmp_caps >> 48) & 0xff;

   986     params.features[7]	= (slave->lmp_caps >> 56) & 0xff;

   987     bt_hci_event(hci, EVT_READ_REMOTE_FEATURES_COMPLETE,

   988                     &params, EVT_READ_REMOTE_FEATURES_COMPLETE_SIZE);

   989 

   990     return 0;

   991 }

   992 

   993 static int bt_hci_version_req(struct bt_hci_s *hci, uint16_t handle)

   994 {

   995     struct bt_device_s *slave;

   996     evt_read_remote_version_complete params;

   997 

   998     if (bt_hci_handle_bad(hci, handle))

   999         return -ENODEV;

  1000 

  1001     slave = bt_hci_remote_dev(hci, handle);

  1002 

  1003     bt_hci_event_status(hci, HCI_SUCCESS);

  1004 

  1005     params.status	= HCI_SUCCESS;

  1006     params.handle	= HNDL(handle);

  1007     params.lmp_ver	= 0x03;

  1008     params.manufacturer	= cpu_to_le16(0xa000);

  1009     params.lmp_subver	= cpu_to_le16(0xa607);

  1010     bt_hci_event(hci, EVT_READ_REMOTE_VERSION_COMPLETE,

  1011                     &params, EVT_READ_REMOTE_VERSION_COMPLETE_SIZE);

  1012 

  1013     return 0;

  1014 }

  1015 

  1016 static int bt_hci_clkoffset_req(struct bt_hci_s *hci, uint16_t handle)

  1017 {

  1018     struct bt_device_s *slave;

  1019     evt_read_clock_offset_complete params;

  1020 

  1021     if (bt_hci_handle_bad(hci, handle))

  1022         return -ENODEV;

  1023 

  1024     slave = bt_hci_remote_dev(hci, handle);

  1025 

  1026     bt_hci_event_status(hci, HCI_SUCCESS);

  1027 

  1028     params.status	= HCI_SUCCESS;

  1029     params.handle	= HNDL(handle);

  1030     /* TODO: return the clkoff *differenece* */

  1031     params.clock_offset	= slave->clkoff;	/* Note: no swapping */

  1032     bt_hci_event(hci, EVT_READ_CLOCK_OFFSET_COMPLETE,

  1033                     &params, EVT_READ_CLOCK_OFFSET_COMPLETE_SIZE);

  1034 

  1035     return 0;

  1036 }

  1037 

  1038 static void bt_hci_event_mode(struct bt_hci_s *hci, struct bt_link_s *link,

  1039                 uint16_t handle)

  1040 {

  1041     evt_mode_change params = {

  1042         .status		= HCI_SUCCESS,

  1043         .handle		= HNDL(handle),

  1044         .mode		= link->acl_mode,

  1045         .interval	= cpu_to_le16(link->acl_interval),

  1046     };

  1047 

  1048     bt_hci_event(hci, EVT_MODE_CHANGE, &params, EVT_MODE_CHANGE_SIZE);

  1049 }

  1050 

  1051 static void bt_hci_lmp_mode_change_master(struct bt_hci_s *hci,

  1052                 struct bt_link_s *link, int mode, uint16_t interval)

  1053 {

  1054     link->acl_mode = mode;

  1055     link->acl_interval = interval;

  1056 

  1057     bt_hci_event_mode(hci, link, link->handle);

  1058 

  1059     link->slave->lmp_mode_change(link);

  1060 }

  1061 

  1062 static void bt_hci_lmp_mode_change_slave(struct bt_link_s *btlink)

  1063 {

  1064     struct bt_hci_link_s *link = (struct bt_hci_link_s *) btlink;

  1065     struct bt_hci_s *hci = hci_from_device(btlink->slave);

  1066 

  1067     bt_hci_event_mode(hci, btlink, link->handle);

  1068 }

  1069 

  1070 static int bt_hci_mode_change(struct bt_hci_s *hci, uint16_t handle,

  1071                 int interval, int mode)

  1072 {

  1073     struct bt_hci_master_link_s *link;

  1074 

  1075     if (bt_hci_handle_bad(hci, handle) || !bt_hci_role_master(hci, handle))

  1076         return -ENODEV;

  1077 

  1078     link = &hci->lm.handle[handle & ~HCI_HANDLE_OFFSET];

  1079     if (link->link->acl_mode != acl_active) {

  1080         bt_hci_event_status(hci, HCI_COMMAND_DISALLOWED);

  1081         return 0;

  1082     }

  1083 

  1084     bt_hci_event_status(hci, HCI_SUCCESS);

  1085 

  1086     qemu_mod_timer(link->acl_mode_timer, qemu_get_clock(vm_clock) +

  1087                             muldiv64(interval * 625, ticks_per_sec, 1000000));

  1088     bt_hci_lmp_mode_change_master(hci, link->link, mode, interval);

  1089 

  1090     return 0;

  1091 }

  1092 

  1093 static int bt_hci_mode_cancel(struct bt_hci_s *hci, uint16_t handle, int mode)

  1094 {

  1095     struct bt_hci_master_link_s *link;

  1096 

  1097     if (bt_hci_handle_bad(hci, handle) || !bt_hci_role_master(hci, handle))

  1098         return -ENODEV;

  1099 

  1100     link = &hci->lm.handle[handle & ~HCI_HANDLE_OFFSET];

  1101     if (link->link->acl_mode != mode) {

  1102         bt_hci_event_status(hci, HCI_COMMAND_DISALLOWED);

  1103 

  1104         return 0;

  1105     }

  1106 

  1107     bt_hci_event_status(hci, HCI_SUCCESS);

  1108 

  1109     qemu_del_timer(link->acl_mode_timer);

  1110     bt_hci_lmp_mode_change_master(hci, link->link, acl_active, 0);

  1111 

  1112     return 0;

  1113 }

  1114 

  1115 static void bt_hci_mode_tick(void *opaque)

  1116 {

  1117     struct bt_link_s *link = opaque;

  1118     struct bt_hci_s *hci = hci_from_device(link->host);

  1119 

  1120     bt_hci_lmp_mode_change_master(hci, link, acl_active, 0);

  1121 }

  1122 

  1123 static void bt_hci_reset(struct bt_hci_s *hci)

  1124 {

  1125     hci->acl_len = 0;

  1126     hci->last_cmd = 0;

  1127     hci->lm.connecting = 0;

  1128 

  1129     hci->event_mask[0] = 0xff;

  1130     hci->event_mask[1] = 0xff;

  1131     hci->event_mask[2] = 0xff;

  1132     hci->event_mask[3] = 0xff;

  1133     hci->event_mask[4] = 0xff;

  1134     hci->event_mask[5] = 0x1f;

  1135     hci->event_mask[6] = 0x00;