/*

 * QEMU Bluetooth HCI logic.

 *

 * Copyright (C) 2007 OpenMoko, Inc.

 * Copyright (C) 2008 Andrzej Zaborowski  <balrog@zabor.org>

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License as

 * published by the Free Software Foundation; either version 2 of

 * the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston,

 * MA  02110-1301  USA

 */

#include "qemu-common.h"

#include "qemu-timer.h"

#include "usb.h"

#include "net.h"

#include "bt.h"

struct bt_hci_s {

    uint8_t *(*evt_packet)(void *opaque);

    void (*evt_submit)(void *opaque, int len);

    void *opaque;

    uint8_t evt_buf[256];

    uint8_t acl_buf[4096];

    int acl_len;

    uint16_t asb_handle;

    uint16_t psb_handle;

    int last_cmd;	/* Note: Always little-endian */

    struct bt_device_s *conn_req_host;

    struct {

        int inquire;

        int periodic;

        int responses_left;

        int responses;

        QEMUTimer *inquiry_done;

        QEMUTimer *inquiry_next;

        int inquiry_length;

        int inquiry_period;

        int inquiry_mode;

#define HCI_HANDLE_OFFSET	0x20

#define HCI_HANDLES_MAX		0x10

        struct bt_hci_master_link_s {

            struct bt_link_s *link;

            void (*lmp_acl_data)(struct bt_link_s *link,

                            const uint8_t *data, int start, int len);

            QEMUTimer *acl_mode_timer;

        } handle[HCI_HANDLES_MAX];

        uint32_t role_bmp;

        int last_handle;

        int connecting;

        bdaddr_t awaiting_bdaddr[HCI_HANDLES_MAX];

    } lm;

    uint8_t event_mask[8];

    uint16_t voice_setting;	/* Notw: Always little-endian */

    uint16_t conn_accept_tout;

    QEMUTimer *conn_accept_timer;

    struct HCIInfo info;

    struct bt_device_s device;

};

#define DEFAULT_RSSI_DBM	20

#define hci_from_info(ptr)	container_of((ptr), struct bt_hci_s, info)

#define hci_from_device(ptr)	container_of((ptr), struct bt_hci_s, device)

struct bt_hci_link_s {

    struct bt_link_s btlink;

    uint16_t handle;	/* Local */

};

/* LMP layer emulation */

#if 0

static void bt_submit_lmp(struct bt_device_s *bt, int length, uint8_t *data)

{

    int resp, resplen, error, op, tr;

    uint8_t respdata[17];

    if (length < 1)

        return;

    tr = *data & 1;

    op = *(data ++) >> 1;

    resp = LMP_ACCEPTED;

    resplen = 2;

    respdata[1] = op;

    error = 0;

    length --;

    if (op >= 0x7c) {	/* Extended opcode */

        op |= *(data ++) << 8;

        resp = LMP_ACCEPTED_EXT;

        resplen = 4;

        respdata[0] = op >> 8;

        respdata[1] = op & 0xff;

        length --;

    }

    switch (op) {

    case LMP_ACCEPTED:

        /* data[0]	Op code

         */

        if (length < 1) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        resp = 0;

        break;

    case LMP_ACCEPTED_EXT:

        /* data[0]	Escape op code

         * data[1]	Extended op code

         */

        if (length < 2) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        resp = 0;

        break;

    case LMP_NOT_ACCEPTED:

        /* data[0]	Op code

         * data[1]	Error code

         */

        if (length < 2) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        resp = 0;

        break;

    case LMP_NOT_ACCEPTED_EXT:

        /* data[0]	Op code

         * data[1]	Extended op code

         * data[2]	Error code

         */

        if (length < 3) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        resp = 0;

        break;

    case LMP_HOST_CONNECTION_REQ:

        break;

    case LMP_SETUP_COMPLETE:

        resp = LMP_SETUP_COMPLETE;

        resplen = 1;

        bt->setup = 1;

        break;

    case LMP_DETACH:

        /* data[0]	Error code

         */

        if (length < 1) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        bt->setup = 0;

        resp = 0;

        break;

    case LMP_SUPERVISION_TIMEOUT:

        /* data[0,1]	Supervision timeout

         */

        if (length < 2) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        resp = 0;

        break;

    case LMP_QUALITY_OF_SERVICE:

        resp = 0;

        /* Fall through */

    case LMP_QOS_REQ:

        /* data[0,1]	Poll interval

         * data[2]	N(BC)

         */

        if (length < 3) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        break;

    case LMP_MAX_SLOT:

        resp = 0;

        /* Fall through */

    case LMP_MAX_SLOT_REQ:

        /* data[0]	Max slots

         */

        if (length < 1) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        break;

    case LMP_AU_RAND:

    case LMP_IN_RAND:

    case LMP_COMB_KEY:

        /* data[0-15]	Random number

         */

        if (length < 16) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        if (op == LMP_AU_RAND) {

            if (bt->key_present) {

                resp = LMP_SRES;

                resplen = 5;

                /* XXX: [Part H] Section 6.1 on page 801 */

            } else {

                error = HCI_PIN_OR_KEY_MISSING;

                goto not_accepted;

            }

        } else if (op == LMP_IN_RAND) {

            error = HCI_PAIRING_NOT_ALLOWED;

            goto not_accepted;

        } else {

            /* XXX: [Part H] Section 3.2 on page 779 */

            resp = LMP_UNIT_KEY;

            resplen = 17;

            memcpy(respdata + 1, bt->key, 16);

            error = HCI_UNIT_LINK_KEY_USED;

            goto not_accepted;

        }

        break;

    case LMP_UNIT_KEY:

        /* data[0-15]	Key

         */

        if (length < 16) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        memcpy(bt->key, data, 16);

        bt->key_present = 1;

        break;

    case LMP_SRES:

        /* data[0-3]	Authentication response

         */

        if (length < 4) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        break;

    case LMP_CLKOFFSET_REQ:

        resp = LMP_CLKOFFSET_RES;

        resplen = 3;

        respdata[1] = 0x33;

        respdata[2] = 0x33;

        break;

    case LMP_CLKOFFSET_RES:

        /* data[0,1]	Clock offset

         * (Slave to master only)

         */

        if (length < 2) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        break;

    case LMP_VERSION_REQ:

    case LMP_VERSION_RES:

        /* data[0]	VersNr

         * data[1,2]	CompId

         * data[3,4]	SubVersNr

         */

        if (length < 5) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        if (op == LMP_VERSION_REQ) {

            resp = LMP_VERSION_RES;

            resplen = 6;

            respdata[1] = 0x20;

            respdata[2] = 0xff;

            respdata[3] = 0xff;

            respdata[4] = 0xff;

            respdata[5] = 0xff;

        } else

            resp = 0;

        break;

    case LMP_FEATURES_REQ:

    case LMP_FEATURES_RES:

        /* data[0-7]	Features

         */

        if (length < 8) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        if (op == LMP_FEATURES_REQ) {

            resp = LMP_FEATURES_RES;

            resplen = 9;

            respdata[1] = (bt->lmp_caps >> 0) & 0xff;

            respdata[2] = (bt->lmp_caps >> 8) & 0xff;

            respdata[3] = (bt->lmp_caps >> 16) & 0xff;

            respdata[4] = (bt->lmp_caps >> 24) & 0xff;

            respdata[5] = (bt->lmp_caps >> 32) & 0xff;

            respdata[6] = (bt->lmp_caps >> 40) & 0xff;

            respdata[7] = (bt->lmp_caps >> 48) & 0xff;

            respdata[8] = (bt->lmp_caps >> 56) & 0xff;

        } else

            resp = 0;

        break;

    case LMP_NAME_REQ:

        /* data[0]	Name offset

         */

        if (length < 1) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        resp = LMP_NAME_RES;

        resplen = 17;

        respdata[1] = data[0];

        respdata[2] = strlen(bt->lmp_name);

        memset(respdata + 3, 0x00, 14);

        if (respdata[2] > respdata[1])

            memcpy(respdata + 3, bt->lmp_name + respdata[1],

                            respdata[2] - respdata[1]);

        break;

    case LMP_NAME_RES:

        /* data[0]	Name offset

         * data[1]	Name length

         * data[2-15]	Name fragment

         */

        if (length < 16) {

            error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;

            goto not_accepted;

        }

        resp = 0;

        break;

    default:

        error = HCI_UNKNOWN_LMP_PDU;

        /* Fall through */

    not_accepted:

        if (op >> 8) {

            resp = LMP_NOT_ACCEPTED_EXT;

            resplen = 5;

            respdata[0] = op >> 8;

            respdata[1] = op & 0xff;

            respdata[2] = error;

        } else {

            resp = LMP_NOT_ACCEPTED;

            resplen = 3;

            respdata[0] = op & 0xff;

            respdata[1] = error;

        }

    }

    if (resp == 0)

        return;

    if (resp >> 8) {

        respdata[0] = resp >> 8;

        respdata[1] = resp & 0xff;

    } else

        respdata[0] = resp & 0xff;

    respdata[0] <<= 1;

    respdata[0] |= tr;

}

static void bt_submit_raw_acl(struct bt_piconet_s *net, int length, uint8_t *data)

{

    struct bt_device_s *slave;

    if (length < 1)

        return;

    slave = 0;

#if 0

    slave = net->slave;

#endif

    switch (data[0] & 3) {

    case LLID_ACLC:

        bt_submit_lmp(slave, length - 1, data + 1);

        break;

    case LLID_ACLU_START:

#if 0

        bt_sumbit_l2cap(slave, length - 1, data + 1, (data[0] >> 2) & 1);

        breka;

#endif

    default:

    case LLID_ACLU_CONT:

        break;

    }

}

#endif

/* HCI layer emulation */

/* Note: we could ignore endiannes because unswapped handles will still

 * be valid as connection identifiers for the guest - they don't have to

 * be continuously allocated.  We do it though, to preserve similar

 * behaviour between hosts.  Some things, like the BD_ADDR cannot be

 * preserved though (for example if a real hci is used).  */

#ifdef WORDS_BIGENDIAN

# define HNDL(raw)	bswap16(raw)

#else

# define HNDL(raw)	(raw)

#endif

static const uint8_t bt_event_reserved_mask[8] = {

    0xff, 0x9f, 0xfb, 0xff, 0x07, 0x18, 0x00, 0x00,

};

static inline uint8_t *bt_hci_event_start(struct bt_hci_s *hci,

                int evt, int len)

{

    uint8_t *packet, mask;

    int mask_byte;

    if (len > 255) {

        fprintf(stderr, "%s: HCI event params too long (%ib)\n",

                        __FUNCTION__, len);

        exit(-1);

    }

    mask_byte = (evt - 1) >> 3;

    mask = 1 << ((evt - 1) & 3);

    if (mask & bt_event_reserved_mask[mask_byte] & ~hci->event_mask[mask_byte])

        return 0;

    packet = hci->evt_packet(hci->opaque);

    packet[0] = evt;

    packet[1] = len;

    return &packet[2];

}

static inline void bt_hci_event(struct bt_hci_s *hci, int evt,

                void *params, int len)

{

    uint8_t *packet = bt_hci_event_start(hci, evt, len);

    if (!packet)

        return;

    if (len)

        memcpy(packet, params, len);

    hci->evt_submit(hci->opaque, len + 2);

}

static inline void bt_hci_event_status(struct bt_hci_s *hci, int status)

{

    evt_cmd_status params = {

        .status	= status,

        .ncmd	= 1,

        .opcode	= hci->last_cmd,

    };

    bt_hci_event(hci, EVT_CMD_STATUS, &params, EVT_CMD_STATUS_SIZE);

}

static inline void bt_hci_event_complete(struct bt_hci_s *hci,

                void *ret, int len)

{

    uint8_t *packet = bt_hci_event_start(hci, EVT_CMD_COMPLETE,

                    len + EVT_CMD_COMPLETE_SIZE);

    evt_cmd_complete *params = (evt_cmd_complete *) packet;

    if (!packet)

        return;

    params->ncmd	= 1;

    params->opcode	= hci->last_cmd;

    if (len)

        memcpy(&packet[EVT_CMD_COMPLETE_SIZE], ret, len);

    hci->evt_submit(hci->opaque, len + EVT_CMD_COMPLETE_SIZE + 2);

}

static void bt_hci_inquiry_done(void *opaque)

{

    struct bt_hci_s *hci = (struct bt_hci_s *) opaque;

    uint8_t status = HCI_SUCCESS;

    if (!hci->lm.periodic)

        hci->lm.inquire = 0;

    /* The specification is inconsistent about this one.  Page 565 reads

     * "The event parameters of Inquiry Complete event will have a summary

     * of the result from the Inquiry process, which reports the number of

     * nearby Bluetooth devices that responded [so hci->responses].", but

     * Event Parameters (see page 729) has only Status.  */

    bt_hci_event(hci, EVT_INQUIRY_COMPLETE, &status, 1);

}

static void bt_hci_inquiry_result_standard(struct bt_hci_s *hci,

                struct bt_device_s *slave)

{

    inquiry_info params = {

        .num_responses		= 1,

        .bdaddr			= BAINIT(&slave->bd_addr),

        .pscan_rep_mode		= 0x00,	/* R0 */

        .pscan_period_mode	= 0x00,	/* P0 - deprecated */

        .pscan_mode		= 0x00,	/* Standard scan - deprecated */

        .dev_class[0]		= slave->class[0],

        .dev_class[1]		= slave->class[1],

        .dev_class[2]		= slave->class[2],