/*
* QEMU Bluetooth HCI USB Transport Layer v1.0
*
* Copyright (C) 2007 OpenMoko, Inc.
* Copyright (C) 2008 Andrzej Zaborowski <balrog@zabor.org>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 or
* (at your option) version 3 of the License.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston,
* MA 02111-1307 USA
*/
#include "qemu-common.h"
#include "usb.h"
#include "net.h"
#include "bt.h"
struct USBBtState {
USBDevice dev;
struct HCIInfo *hci;
int altsetting;
int config;
#define CFIFO_LEN_MASK 255
#define DFIFO_LEN_MASK 4095
struct usb_hci_in_fifo_s {
uint8_t data[(DFIFO_LEN_MASK + 1) * 2];
struct {
uint8_t *data;
int len;
} fifo[CFIFO_LEN_MASK + 1];
int dstart, dlen, dsize, start, len;
} evt, acl, sco;
struct usb_hci_out_fifo_s {
uint8_t data[4096];
int len;
} outcmd, outacl, outsco;
};
#define USB_EVT_EP 1
#define USB_ACL_EP 2
#define USB_SCO_EP 3
static const uint8_t qemu_bt_dev_descriptor[] = {
0x12, /* u8 bLength; */
USB_DT_DEVICE, /* u8 bDescriptorType; Device */
0x10, 0x01, /* u16 bcdUSB; v1.10 */
0xe0, /* u8 bDeviceClass; Wireless */
0x01, /* u8 bDeviceSubClass; Radio Frequency */
0x01, /* u8 bDeviceProtocol; Bluetooth */
0x40, /* u8 bMaxPacketSize0; 64 Bytes */
0x12, 0x0a, /* u16 idVendor; */
0x01, 0x00, /* u16 idProduct; Bluetooth Dongle (HCI mode) */
0x58, 0x19, /* u16 bcdDevice; (some devices have 0x48, 0x02) */
0x00, /* u8 iManufacturer; */
0x00, /* u8 iProduct; */
0x00, /* u8 iSerialNumber; */
0x01, /* u8 bNumConfigurations; */
};
static const uint8_t qemu_bt_config_descriptor[] = {
/* one configuration */
0x09, /* u8 bLength; */
USB_DT_CONFIG, /* u8 bDescriptorType; */
0xb1, 0x00, /* u16 wTotalLength; */
0x02, /* u8 bNumInterfaces; (2) */
0x01, /* u8 bConfigurationValue; */
0x00, /* u8 iConfiguration; */
0xc0, /* u8 bmAttributes;
Bit 7: must be set,
6: Self-powered,
5: Remote wakeup,
4..0: resvd */
0x00, /* u8 MaxPower; */
/* USB 1.1:
* USB 2.0, single TT organization (mandatory):
* one interface, protocol 0
*
* USB 2.0, multiple TT organization (optional):
* two interfaces, protocols 1 (like single TT)
* and 2 (multiple TT mode) ... config is
* sometimes settable
* NOT IMPLEMENTED
*/
/* interface one */
0x09, /* u8 if_bLength; */
USB_DT_INTERFACE, /* u8 if_bDescriptorType; */
0x00, /* u8 if_bInterfaceNumber; */
0x00, /* u8 if_bAlternateSetting; */
0x03, /* u8 if_bNumEndpoints; */
0xe0, /* u8 if_bInterfaceClass; Wireless */
0x01, /* u8 if_bInterfaceSubClass; Radio Frequency */
0x01, /* u8 if_bInterfaceProtocol; Bluetooth */
0x00, /* u8 if_iInterface; */
/* endpoint one */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_IN | USB_EVT_EP, /* u8 ep_bEndpointAddress; */
0x03, /* u8 ep_bmAttributes; Interrupt */
0x10, 0x00, /* u16 ep_wMaxPacketSize; */
0x02, /* u8 ep_bInterval; */
/* endpoint two */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_OUT | USB_ACL_EP, /* u8 ep_bEndpointAddress; */
0x02, /* u8 ep_bmAttributes; Bulk */
0x40, 0x00, /* u16 ep_wMaxPacketSize; */
0x0a, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* endpoint three */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_IN | USB_ACL_EP, /* u8 ep_bEndpointAddress; */
0x02, /* u8 ep_bmAttributes; Bulk */
0x40, 0x00, /* u16 ep_wMaxPacketSize; */
0x0a, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* interface two setting one */
0x09, /* u8 if_bLength; */
USB_DT_INTERFACE, /* u8 if_bDescriptorType; */
0x01, /* u8 if_bInterfaceNumber; */
0x00, /* u8 if_bAlternateSetting; */
0x02, /* u8 if_bNumEndpoints; */
0xe0, /* u8 if_bInterfaceClass; Wireless */
0x01, /* u8 if_bInterfaceSubClass; Radio Frequency */
0x01, /* u8 if_bInterfaceProtocol; Bluetooth */
0x00, /* u8 if_iInterface; */
/* endpoint one */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_OUT | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x00, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* endpoint two */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_IN | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x00, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* interface two setting two */
0x09, /* u8 if_bLength; */
USB_DT_INTERFACE, /* u8 if_bDescriptorType; */
0x01, /* u8 if_bInterfaceNumber; */
0x01, /* u8 if_bAlternateSetting; */
0x02, /* u8 if_bNumEndpoints; */
0xe0, /* u8 if_bInterfaceClass; Wireless */
0x01, /* u8 if_bInterfaceSubClass; Radio Frequency */
0x01, /* u8 if_bInterfaceProtocol; Bluetooth */
0x00, /* u8 if_iInterface; */
/* endpoint one */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_OUT | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x09, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* endpoint two */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_IN | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x09, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* interface two setting three */
0x09, /* u8 if_bLength; */
USB_DT_INTERFACE, /* u8 if_bDescriptorType; */
0x01, /* u8 if_bInterfaceNumber; */
0x02, /* u8 if_bAlternateSetting; */
0x02, /* u8 if_bNumEndpoints; */
0xe0, /* u8 if_bInterfaceClass; Wireless */
0x01, /* u8 if_bInterfaceSubClass; Radio Frequency */
0x01, /* u8 if_bInterfaceProtocol; Bluetooth */
0x00, /* u8 if_iInterface; */
/* endpoint one */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_OUT | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x11, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* endpoint two */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_IN | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x11, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* interface two setting four */
0x09, /* u8 if_bLength; */
USB_DT_INTERFACE, /* u8 if_bDescriptorType; */
0x01, /* u8 if_bInterfaceNumber; */
0x03, /* u8 if_bAlternateSetting; */
0x02, /* u8 if_bNumEndpoints; */
0xe0, /* u8 if_bInterfaceClass; Wireless */
0x01, /* u8 if_bInterfaceSubClass; Radio Frequency */
0x01, /* u8 if_bInterfaceProtocol; Bluetooth */
0x00, /* u8 if_iInterface; */
/* endpoint one */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_OUT | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x19, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* endpoint two */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_IN | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x19, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* interface two setting five */
0x09, /* u8 if_bLength; */
USB_DT_INTERFACE, /* u8 if_bDescriptorType; */
0x01, /* u8 if_bInterfaceNumber; */
0x04, /* u8 if_bAlternateSetting; */
0x02, /* u8 if_bNumEndpoints; */
0xe0, /* u8 if_bInterfaceClass; Wireless */
0x01, /* u8 if_bInterfaceSubClass; Radio Frequency */
0x01, /* u8 if_bInterfaceProtocol; Bluetooth */
0x00, /* u8 if_iInterface; */
/* endpoint one */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_OUT | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x21, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* endpoint two */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_IN | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x21, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* interface two setting six */
0x09, /* u8 if_bLength; */
USB_DT_INTERFACE, /* u8 if_bDescriptorType; */
0x01, /* u8 if_bInterfaceNumber; */
0x05, /* u8 if_bAlternateSetting; */
0x02, /* u8 if_bNumEndpoints; */
0xe0, /* u8 if_bInterfaceClass; Wireless */
0x01, /* u8 if_bInterfaceSubClass; Radio Frequency */
0x01, /* u8 if_bInterfaceProtocol; Bluetooth */
0x00, /* u8 if_iInterface; */
/* endpoint one */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_OUT | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x31, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* endpoint two */
0x07, /* u8 ep_bLength; */
USB_DT_ENDPOINT, /* u8 ep_bDescriptorType; */
USB_DIR_IN | USB_SCO_EP, /* u8 ep_bEndpointAddress; */
0x01, /* u8 ep_bmAttributes; Isochronous */
0x31, 0x00, /* u16 ep_wMaxPacketSize; */
0x01, /* u8 ep_bInterval; (255ms -- usb 2.0 spec) */
/* If implemented, the DFU interface descriptor goes here with no
* endpoints or alternative settings. */
};
static void usb_bt_fifo_reset(struct usb_hci_in_fifo_s *fifo)
{
fifo->dstart = 0;
fifo->dlen = 0;
fifo->dsize = DFIFO_LEN_MASK + 1;
fifo->start = 0;
fifo->len = 0;
}
static void usb_bt_fifo_enqueue(struct usb_hci_in_fifo_s *fifo,
const uint8_t *data, int len)
{
int off = fifo->dstart + fifo->dlen;
uint8_t *buf;
fifo->dlen += len;
if (off <= DFIFO_LEN_MASK) {
if (off + len > DFIFO_LEN_MASK + 1 &&
(fifo->dsize = off + len) > (DFIFO_LEN_MASK + 1) * 2) {
fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
exit(-1);
}
buf = fifo->data + off;
} else {
if (fifo->dlen > fifo->dsize) {
fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
exit(-1);
}
buf = fifo->data + off - fifo->dsize;
}
off = (fifo->start + fifo->len ++) & CFIFO_LEN_MASK;
fifo->fifo[off].data = memcpy(buf, data, len);
fifo->fifo[off].len = len;
}
static inline int usb_bt_fifo_dequeue(struct usb_hci_in_fifo_s *fifo,
USBPacket *p)
{
int len;
if (likely(!fifo->len))
return USB_RET_STALL;
len = MIN(p->len, fifo->fifo[fifo->start].len);
memcpy(p->data, fifo->fifo[fifo->start].data, len);
if (len == p->len) {
fifo->fifo[fifo->start].len -= len;
fifo->fifo[fifo->start].data += len;
} else {
fifo->start ++;
fifo->start &= CFIFO_LEN_MASK;
fifo->len --;
}
fifo->dstart += len;
fifo->dlen -= len;
if (fifo->dstart >= fifo->dsize) {
fifo->dstart = 0;
fifo->dsize = DFIFO_LEN_MASK + 1;
}
return len;
}
static void inline usb_bt_fifo_out_enqueue(struct USBBtState *s,
struct usb_hci_out_fifo_s *fifo,
void (*send)(struct HCIInfo *, const uint8_t *, int),
int (*complete)(const uint8_t *, int),
const uint8_t *data, int len)
{
if (fifo->len) {
memcpy(fifo->data + fifo->len, data, len);
fifo->len += len;
if (complete(fifo->data, fifo->len)) {
send(s->hci, fifo->data, fifo->len);
fifo->len = 0;
}
} else if (complete(data, len))
send(s->hci, data, len);
else {
memcpy(fifo->data, data, len);
fifo->len = len;
}
/* TODO: do we need to loop? */
}
static int usb_bt_hci_cmd_complete(const uint8_t *data, int len)
{
len -= HCI_COMMAND_HDR_SIZE;
return len >= 0 &&
len >= ((struct hci_command_hdr *) data)->plen;
}
static int usb_bt_hci_acl_complete(const uint8_t *data, int len)
{
len -= HCI_ACL_HDR_SIZE;
return len >= 0 &&
len >= le16_to_cpu(((struct hci_acl_hdr *) data)->dlen);
}
static int usb_bt_hci_sco_complete(const uint8_t *data, int len)
{
len -= HCI_SCO_HDR_SIZE;
return len >= 0 &&
len >= ((struct hci_sco_hdr *) data)->dlen;
}
static void usb_bt_handle_reset(USBDevice *dev)
{
struct USBBtState *s = (struct USBBtState *) dev->opaque;
usb_bt_fifo_reset(&s->evt);
usb_bt_fifo_reset(&s->acl);
usb_bt_fifo_reset(&s->sco);
s->outcmd.len = 0;
s->outacl.len = 0;
s->outsco.len = 0;
s->altsetting = 0;
}
static int usb_bt_handle_control(USBDevice *dev, int request, int value,
int index, int length, uint8_t *data)
{
struct USBBtState *s = (struct USBBtState *) dev->opaque;
int ret = 0;
switch (request) {
case DeviceRequest | USB_REQ_GET_STATUS:
case InterfaceRequest | USB_REQ_GET_STATUS:
case EndpointRequest | USB_REQ_GET_STATUS:
data[0] = (1 << USB_DEVICE_SELF_POWERED) |
(dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
data[1] = 0x00;
ret = 2;
break;
case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
case InterfaceOutRequest | USB_REQ_CLEAR_FEATURE:
case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
if (value == USB_DEVICE_REMOTE_WAKEUP) {
dev->remote_wakeup = 0;
} else {
goto fail;
}
ret = 0;
break;
case DeviceOutRequest | USB_REQ_SET_FEATURE:
case InterfaceOutRequest | USB_REQ_SET_FEATURE:
case EndpointOutRequest | USB_REQ_SET_FEATURE:
if (value == USB_DEVICE_REMOTE_WAKEUP) {
dev->remote_wakeup = 1;
} else {
goto fail;
}
ret = 0;
break;
case DeviceOutRequest | USB_REQ_SET_ADDRESS:
dev->addr = value;
ret = 0;
break;
case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
switch (value >> 8) {
case USB_DT_DEVICE:
ret = sizeof(qemu_bt_dev_descriptor);
memcpy(data, qemu_bt_dev_descriptor, ret);
break;
case USB_DT_CONFIG:
ret = sizeof(qemu_bt_config_descriptor);
memcpy(data, qemu_bt_config_descriptor, ret);
break;
case USB_DT_STRING:
switch(value & 0xff) {
case 0:
/* language ids */
data[0] = 4;
data[1] = 3;
data[2] = 0x09;
data[3] = 0x04;
ret = 4;
break;
default:
goto fail;
}
break;
default:
goto fail;
}
break;
case DeviceRequest | USB_REQ_GET_CONFIGURATION:
data[0] = qemu_bt_config_descriptor[0x5];
ret = 1;
s->config = 0;
break;
case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
ret = 0;
if (value != qemu_bt_config_descriptor[0x5] && value != 0) {
printf("%s: Wrong SET_CONFIGURATION request (%i)\n",
__FUNCTION__, value);
goto fail;
}
s->config = 1;
usb_bt_fifo_reset(&s->evt);
usb_bt_fifo_reset(&s->acl);
usb_bt_fifo_reset(&s->sco);
break;
case InterfaceRequest | USB_REQ_GET_INTERFACE:
if (value != 0 || (index & ~1) || length != 1)
goto fail;
if (index == 1)
data[0] = s->altsetting;
else
data[0] = 0;
ret = 1;
break;
case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
if ((index & ~1) || length != 0 ||
(index == 1 && (value < 0 || value > 4)) ||
(index == 0 && value != 0)) {
printf("%s: Wrong SET_INTERFACE request (%i, %i)\n",
__FUNCTION__, index, value);
goto fail;
}
s->altsetting = value;
ret = 0;
break;
case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_DEVICE) << 8):
if (s->config)
usb_bt_fifo_out_enqueue(s, &s->outcmd, s->hci->cmd_send,
usb_bt_hci_cmd_complete, data, length);
break;
default:
fail:
ret = USB_RET_STALL;
break;
}
return ret;
}
static int usb_bt_handle_data(USBDevice *dev, USBPacket *p)
{
struct USBBtState *s = (struct USBBtState *) dev->opaque;
int ret = 0;
if (!s->config)
goto fail;
switch (p->pid) {
case USB_TOKEN_IN:
switch (p->devep & 0xf) {
case USB_EVT_EP:
ret = usb_bt_fifo_dequeue(&s->evt, p);
break;
case USB_ACL_EP:
ret = usb_bt_fifo_dequeue(&s->acl, p);
break;
case USB_SCO_EP:
ret = usb_bt_fifo_dequeue(&s->sco, p);
break;
default:
goto fail;
}
break;
case USB_TOKEN_OUT:
switch (p->devep & 0xf) {
case USB_ACL_EP:
usb_bt_fifo_out_enqueue(s, &s->outacl, s->hci->acl_send,
usb_bt_hci_acl_complete, p->data, p->len);
break;
case USB_SCO_EP:
usb_bt_fifo_out_enqueue(s, &s->outsco, s->hci->sco_send,
usb_bt_hci_sco_complete, p->data, p->len);
break;
default:
goto fail;
}
break;
default:
fail:
ret = USB_RET_STALL;
break;
}
return ret;
}
static void usb_bt_out_hci_packet_event(void *opaque,
const uint8_t *data, int len)
{
struct USBBtState *s = (struct USBBtState *) opaque;
usb_bt_fifo_enqueue(&s->evt, data, len);
}
static void usb_bt_out_hci_packet_acl(void *opaque,
const uint8_t *data, int len)
{
struct USBBtState *s = (struct USBBtState *) opaque;
usb_bt_fifo_enqueue(&s->acl, data, len);
}
static void usb_bt_handle_destroy(USBDevice *dev)
{
struct USBBtState *s = (struct USBBtState *) dev->opaque;
s->hci->opaque = 0;
s->hci->evt_recv = 0;
s->hci->acl_recv = 0;
qemu_free(s);
}
USBDevice *usb_bt_init(HCIInfo *hci)
{
struct USBBtState *s;
if (!hci)
return NULL;
s = qemu_mallocz(sizeof(struct USBBtState));
if (!s)
return NULL;
s->dev.opaque = s;
s->dev.speed = USB_SPEED_HIGH;
s->dev.handle_packet = usb_generic_handle_packet;
pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU BT dongle");
s->dev.handle_reset = usb_bt_handle_reset;
s->dev.handle_control = usb_bt_handle_control;
s->dev.handle_data = usb_bt_handle_data;
s->dev.handle_destroy = usb_bt_handle_destroy;
s->hci = hci;
s->hci->opaque = s;
s->hci->evt_recv = usb_bt_out_hci_packet_event;
s->hci->acl_recv = usb_bt_out_hci_packet_acl;
usb_bt_handle_reset(&s->dev);
return &s->dev;
}