hw/usb-bt.c

   1 /*
   2  * QEMU Bluetooth HCI USB Transport Layer v1.0
   3  *
   4  * Copyright (C) 2007 OpenMoko, Inc.
   5  * Copyright (C) 2008 Andrzej Zaborowski  <balrog@zabor.org>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License as
   9  * published by the Free Software Foundation; either version 2 or
  10  * (at your option) version 3 of the License.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, write to the Free Software Foundation, Inc.,
  19  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  20  */
  21
  22 #include "qemu-common.h"
  23 #include "usb.h"
  24 #include "net.h"
  25 #include "bt.h"
  26
  27 struct USBBtState {
  28     USBDevice dev;
  29     struct HCIInfo *hci;
  30
  31     int altsetting;
  32     int config;
  33
  34 #define CFIFO_LEN_MASK  255
  35 #define DFIFO_LEN_MASK  4095
  36     struct usb_hci_in_fifo_s {
  37         uint8_t data[(DFIFO_LEN_MASK + 1) * 2];
  38         struct {
  39             uint8_t *data;
  40             int len;
  41         } fifo[CFIFO_LEN_MASK + 1];
  42         int dstart, dlen, dsize, start, len;
  43     } evt, acl, sco;
  44
  45     struct usb_hci_out_fifo_s {
  46         uint8_t data[4096];
  47         int len;
  48     } outcmd, outacl, outsco;
  49 };
  50
  51 #define USB_EVT_EP      1
  52 #define USB_ACL_EP      2
  53 #define USB_SCO_EP      3
  54
  55 static const uint8_t qemu_bt_dev_descriptor[] = {
  56     0x12,               /*  u8 bLength; */
  57     USB_DT_DEVICE,      /*  u8 bDescriptorType; Device */
  58     0x10, 0x01,         /*  u16 bcdUSB; v1.10 */
  59
  60     0xe0,       /*  u8  bDeviceClass; Wireless */
  61     0x01,       /*  u8  bDeviceSubClass; Radio Frequency */
  62     0x01,       /*  u8  bDeviceProtocol; Bluetooth */
  63     0x40,       /*  u8  bMaxPacketSize0; 64 Bytes */
  64
  65     0x12, 0x0a, /*  u16 idVendor; */
  66     0x01, 0x00, /*  u16 idProduct; Bluetooth Dongle (HCI mode) */
  67     0x58, 0x19, /*  u16 bcdDevice; (some devices have 0x48, 0x02) */
  68
  69     0x00,       /*  u8  iManufacturer; */
  70     0x00,       /*  u8  iProduct; */
  71     0x00,       /*  u8  iSerialNumber; */
  72     0x01,       /*  u8  bNumConfigurations; */
  73 };
  74
  75 static const uint8_t qemu_bt_config_descriptor[] = {
  76     /* one configuration */
  77     0x09,               /*  u8  bLength; */
  78     USB_DT_CONFIG,      /*  u8  bDescriptorType; */
  79     0xb1, 0x00,         /*  u16 wTotalLength; */
  80     0x02,               /*  u8  bNumInterfaces; (2) */
  81     0x01,               /*  u8  bConfigurationValue; */
  82     0x00,               /*  u8  iConfiguration; */
  83     0xc0,               /*  u8  bmAttributes;
  84                                      Bit 7: must be set,
  85                                          6: Self-powered,
  86                                          5: Remote wakeup,
  87                                          4..0: resvd */
  88     0x00,               /*  u8  MaxPower; */
  89
  90     /* USB 1.1:
  91      * USB 2.0, single TT organization (mandatory):
  92      *  one interface, protocol 0
  93      *
  94      * USB 2.0, multiple TT organization (optional):
  95      *  two interfaces, protocols 1 (like single TT)
  96      *  and 2 (multiple TT mode) ... config is
  97      *  sometimes settable
  98      *  NOT IMPLEMENTED
  99      */
 100
 101     /* interface one */
 102     0x09,               /*  u8  if_bLength; */
 103     USB_DT_INTERFACE,   /*  u8  if_bDescriptorType; */
 104     0x00,               /*  u8  if_bInterfaceNumber; */
 105     0x00,               /*  u8  if_bAlternateSetting; */
 106     0x03,               /*  u8  if_bNumEndpoints; */
 107     0xe0,               /*  u8  if_bInterfaceClass; Wireless */
 108     0x01,               /*  u8  if_bInterfaceSubClass; Radio Frequency */
 109     0x01,               /*  u8  if_bInterfaceProtocol; Bluetooth */
 110     0x00,               /*  u8  if_iInterface; */
 111
 112     /* endpoint one */
 113     0x07,               /*  u8  ep_bLength; */
 114     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 115     USB_DIR_IN | USB_EVT_EP,    /*  u8  ep_bEndpointAddress; */
 116     0x03,               /*  u8  ep_bmAttributes; Interrupt */
 117     0x10, 0x00,         /*  u16 ep_wMaxPacketSize; */
 118     0x02,               /*  u8  ep_bInterval; */
 119
 120     /* endpoint two */
 121     0x07,               /*  u8  ep_bLength; */
 122     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 123     USB_DIR_OUT | USB_ACL_EP,   /*  u8  ep_bEndpointAddress; */
 124     0x02,               /*  u8  ep_bmAttributes; Bulk */
 125     0x40, 0x00,         /*  u16 ep_wMaxPacketSize; */
 126     0x0a,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 127
 128     /* endpoint three */
 129     0x07,               /*  u8  ep_bLength; */
 130     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 131     USB_DIR_IN | USB_ACL_EP,    /*  u8  ep_bEndpointAddress; */
 132     0x02,               /*  u8  ep_bmAttributes; Bulk */
 133     0x40, 0x00,         /*  u16 ep_wMaxPacketSize; */
 134     0x0a,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 135
 136     /* interface two setting one */
 137     0x09,               /*  u8  if_bLength; */
 138     USB_DT_INTERFACE,   /*  u8  if_bDescriptorType; */
 139     0x01,               /*  u8  if_bInterfaceNumber; */
 140     0x00,               /*  u8  if_bAlternateSetting; */
 141     0x02,               /*  u8  if_bNumEndpoints; */
 142     0xe0,               /*  u8  if_bInterfaceClass; Wireless */
 143     0x01,               /*  u8  if_bInterfaceSubClass; Radio Frequency */
 144     0x01,               /*  u8  if_bInterfaceProtocol; Bluetooth */
 145     0x00,               /*  u8  if_iInterface; */
 146
 147     /* endpoint one */
 148     0x07,               /*  u8  ep_bLength; */
 149     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 150     USB_DIR_OUT | USB_SCO_EP,   /*  u8  ep_bEndpointAddress; */
 151     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 152     0x00, 0x00,         /*  u16 ep_wMaxPacketSize; */
 153     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 154
 155     /* endpoint two */
 156     0x07,               /*  u8  ep_bLength; */
 157     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 158     USB_DIR_IN | USB_SCO_EP,    /*  u8  ep_bEndpointAddress; */
 159     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 160     0x00, 0x00,         /*  u16 ep_wMaxPacketSize; */
 161     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 162
 163     /* interface two setting two */
 164     0x09,               /*  u8  if_bLength; */
 165     USB_DT_INTERFACE,   /*  u8  if_bDescriptorType; */
 166     0x01,               /*  u8  if_bInterfaceNumber; */
 167     0x01,               /*  u8  if_bAlternateSetting; */
 168     0x02,               /*  u8  if_bNumEndpoints; */
 169     0xe0,               /*  u8  if_bInterfaceClass; Wireless */
 170     0x01,               /*  u8  if_bInterfaceSubClass; Radio Frequency */
 171     0x01,               /*  u8  if_bInterfaceProtocol; Bluetooth */
 172     0x00,               /*  u8  if_iInterface; */
 173
 174     /* endpoint one */
 175     0x07,               /*  u8  ep_bLength; */
 176     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 177     USB_DIR_OUT | USB_SCO_EP,   /*  u8  ep_bEndpointAddress; */
 178     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 179     0x09, 0x00,         /*  u16 ep_wMaxPacketSize; */
 180     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 181
 182     /* endpoint two */
 183     0x07,               /*  u8  ep_bLength; */
 184     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 185     USB_DIR_IN | USB_SCO_EP,    /*  u8  ep_bEndpointAddress; */
 186     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 187     0x09, 0x00,         /*  u16 ep_wMaxPacketSize; */
 188     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 189
 190     /* interface two setting three */
 191     0x09,               /*  u8  if_bLength; */
 192     USB_DT_INTERFACE,   /*  u8  if_bDescriptorType; */
 193     0x01,               /*  u8  if_bInterfaceNumber; */
 194     0x02,               /*  u8  if_bAlternateSetting; */
 195     0x02,               /*  u8  if_bNumEndpoints; */
 196     0xe0,               /*  u8  if_bInterfaceClass; Wireless */
 197     0x01,               /*  u8  if_bInterfaceSubClass; Radio Frequency */
 198     0x01,               /*  u8  if_bInterfaceProtocol; Bluetooth */
 199     0x00,               /*  u8  if_iInterface; */
 200
 201     /* endpoint one */
 202     0x07,               /*  u8  ep_bLength; */
 203     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 204     USB_DIR_OUT | USB_SCO_EP,   /*  u8  ep_bEndpointAddress; */
 205     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 206     0x11, 0x00,         /*  u16 ep_wMaxPacketSize; */
 207     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 208
 209     /* endpoint two */
 210     0x07,               /*  u8  ep_bLength; */
 211     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 212     USB_DIR_IN | USB_SCO_EP,    /*  u8  ep_bEndpointAddress; */
 213     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 214     0x11, 0x00,         /*  u16 ep_wMaxPacketSize; */
 215     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 216
 217     /* interface two setting four */
 218     0x09,               /*  u8  if_bLength; */
 219     USB_DT_INTERFACE,   /*  u8  if_bDescriptorType; */
 220     0x01,               /*  u8  if_bInterfaceNumber; */
 221     0x03,               /*  u8  if_bAlternateSetting; */
 222     0x02,               /*  u8  if_bNumEndpoints; */
 223     0xe0,               /*  u8  if_bInterfaceClass; Wireless */
 224     0x01,               /*  u8  if_bInterfaceSubClass; Radio Frequency */
 225     0x01,               /*  u8  if_bInterfaceProtocol; Bluetooth */
 226     0x00,               /*  u8  if_iInterface; */
 227
 228     /* endpoint one */
 229     0x07,               /*  u8  ep_bLength; */
 230     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 231     USB_DIR_OUT | USB_SCO_EP,   /*  u8  ep_bEndpointAddress; */
 232     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 233     0x19, 0x00,         /*  u16 ep_wMaxPacketSize; */
 234     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 235
 236     /* endpoint two */
 237     0x07,               /*  u8  ep_bLength; */
 238     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 239     USB_DIR_IN | USB_SCO_EP,    /*  u8  ep_bEndpointAddress; */
 240     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 241     0x19, 0x00,         /*  u16 ep_wMaxPacketSize; */
 242     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 243
 244     /* interface two setting five */
 245     0x09,               /*  u8  if_bLength; */
 246     USB_DT_INTERFACE,   /*  u8  if_bDescriptorType; */
 247     0x01,               /*  u8  if_bInterfaceNumber; */
 248     0x04,               /*  u8  if_bAlternateSetting; */
 249     0x02,               /*  u8  if_bNumEndpoints; */
 250     0xe0,               /*  u8  if_bInterfaceClass; Wireless */
 251     0x01,               /*  u8  if_bInterfaceSubClass; Radio Frequency */
 252     0x01,               /*  u8  if_bInterfaceProtocol; Bluetooth */
 253     0x00,               /*  u8  if_iInterface; */
 254
 255     /* endpoint one */
 256     0x07,               /*  u8  ep_bLength; */
 257     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 258     USB_DIR_OUT | USB_SCO_EP,   /*  u8  ep_bEndpointAddress; */
 259     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 260     0x21, 0x00,         /*  u16 ep_wMaxPacketSize; */
 261     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 262
 263     /* endpoint two */
 264     0x07,               /*  u8  ep_bLength; */
 265     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 266     USB_DIR_IN | USB_SCO_EP,    /*  u8  ep_bEndpointAddress; */
 267     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 268     0x21, 0x00,         /*  u16 ep_wMaxPacketSize; */
 269     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 270
 271     /* interface two setting six */
 272     0x09,               /*  u8  if_bLength; */
 273     USB_DT_INTERFACE,   /*  u8  if_bDescriptorType; */
 274     0x01,               /*  u8  if_bInterfaceNumber; */
 275     0x05,               /*  u8  if_bAlternateSetting; */
 276     0x02,               /*  u8  if_bNumEndpoints; */
 277     0xe0,               /*  u8  if_bInterfaceClass; Wireless */
 278     0x01,               /*  u8  if_bInterfaceSubClass; Radio Frequency */
 279     0x01,               /*  u8  if_bInterfaceProtocol; Bluetooth */
 280     0x00,               /*  u8  if_iInterface; */
 281
 282     /* endpoint one */
 283     0x07,               /*  u8  ep_bLength; */
 284     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 285     USB_DIR_OUT | USB_SCO_EP,   /*  u8  ep_bEndpointAddress; */
 286     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 287     0x31, 0x00,         /*  u16 ep_wMaxPacketSize; */
 288     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 289
 290     /* endpoint two */
 291     0x07,               /*  u8  ep_bLength; */
 292     USB_DT_ENDPOINT,    /*  u8  ep_bDescriptorType; */
 293     USB_DIR_IN | USB_SCO_EP,    /*  u8  ep_bEndpointAddress; */
 294     0x01,               /*  u8  ep_bmAttributes; Isochronous */
 295     0x31, 0x00,         /*  u16 ep_wMaxPacketSize; */
 296     0x01,               /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 297
 298     /* If implemented, the DFU interface descriptor goes here with no
 299      * endpoints or alternative settings.  */
 300 };
 301
 302 static void usb_bt_fifo_reset(struct usb_hci_in_fifo_s *fifo)
 303 {
 304     fifo->dstart = 0;
 305     fifo->dlen = 0;
 306     fifo->dsize = DFIFO_LEN_MASK + 1;
 307     fifo->start = 0;
 308     fifo->len = 0;
 309 }
 310
 311 static void usb_bt_fifo_enqueue(struct usb_hci_in_fifo_s *fifo,
 312                 const uint8_t *data, int len)
 313 {
 314     int off = fifo->dstart + fifo->dlen;
 315     uint8_t *buf;
 316
 317     fifo->dlen += len;
 318     if (off <= DFIFO_LEN_MASK) {
 319         if (off + len > DFIFO_LEN_MASK + 1 &&
 320                         (fifo->dsize = off + len) > (DFIFO_LEN_MASK + 1) * 2) {
 321             fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
 322             exit(-1);
 323         }
 324         buf = fifo->data + off;
 325     } else {
 326         if (fifo->dlen > fifo->dsize) {
 327             fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
 328             exit(-1);
 329         }
 330         buf = fifo->data + off - fifo->dsize;
 331     }
 332
 333     off = (fifo->start + fifo->len ++) & CFIFO_LEN_MASK;
 334     fifo->fifo[off].data = memcpy(buf, data, len);
 335     fifo->fifo[off].len = len;
 336 }
 337
 338 static inline int usb_bt_fifo_dequeue(struct usb_hci_in_fifo_s *fifo,
 339                 USBPacket *p)
 340 {
 341     int len;
 342
 343     if (likely(!fifo->len))
 344         return USB_RET_STALL;
 345
 346     len = MIN(p->len, fifo->fifo[fifo->start].len);
 347     memcpy(p->data, fifo->fifo[fifo->start].data, len);
 348     if (len == p->len) {
 349         fifo->fifo[fifo->start].len -= len;
 350         fifo->fifo[fifo->start].data += len;
 351     } else {
 352         fifo->start ++;
 353         fifo->start &= CFIFO_LEN_MASK;
 354         fifo->len --;
 355     }
 356
 357     fifo->dstart += len;
 358     fifo->dlen -= len;
 359     if (fifo->dstart >= fifo->dsize) {
 360         fifo->dstart = 0;
 361         fifo->dsize = DFIFO_LEN_MASK + 1;
 362     }
 363
 364     return len;
 365 }
 366
 367 static void inline usb_bt_fifo_out_enqueue(struct USBBtState *s,
 368                 struct usb_hci_out_fifo_s *fifo,
 369                 void (*send)(struct HCIInfo *, const uint8_t *, int),
 370                 int (*complete)(const uint8_t *, int),
 371                 const uint8_t *data, int len)
 372 {
 373     if (fifo->len) {
 374         memcpy(fifo->data + fifo->len, data, len);
 375         fifo->len += len;
 376         if (complete(fifo->data, fifo->len)) {
 377             send(s->hci, fifo->data, fifo->len);
 378             fifo->len = 0;
 379         }
 380     } else if (complete(data, len))
 381         send(s->hci, data, len);
 382     else {
 383         memcpy(fifo->data, data, len);
 384         fifo->len = len;
 385     }
 386
 387     /* TODO: do we need to loop? */
 388 }
 389
 390 static int usb_bt_hci_cmd_complete(const uint8_t *data, int len)
 391 {
 392     len -= HCI_COMMAND_HDR_SIZE;
 393     return len >= 0 &&
 394             len >= ((struct hci_command_hdr *) data)->plen;
 395 }
 396
 397 static int usb_bt_hci_acl_complete(const uint8_t *data, int len)
 398 {
 399     len -= HCI_ACL_HDR_SIZE;
 400     return len >= 0 &&
 401             len >= le16_to_cpu(((struct hci_acl_hdr *) data)->dlen);
 402 }
 403
 404 static int usb_bt_hci_sco_complete(const uint8_t *data, int len)
 405 {
 406     len -= HCI_SCO_HDR_SIZE;
 407     return len >= 0 &&
 408             len >= ((struct hci_sco_hdr *) data)->dlen;
 409 }
 410
 411 static void usb_bt_handle_reset(USBDevice *dev)
 412 {
 413     struct USBBtState *s = (struct USBBtState *) dev->opaque;
 414
 415     usb_bt_fifo_reset(&s->evt);
 416     usb_bt_fifo_reset(&s->acl);
 417     usb_bt_fifo_reset(&s->sco);
 418     s->outcmd.len = 0;
 419     s->outacl.len = 0;
 420     s->outsco.len = 0;
 421     s->altsetting = 0;
 422 }
 423
 424 static int usb_bt_handle_control(USBDevice *dev, int request, int value,
 425                 int index, int length, uint8_t *data)
 426 {
 427     struct USBBtState *s = (struct USBBtState *) dev->opaque;
 428     int ret = 0;
 429
 430     switch (request) {
 431     case DeviceRequest | USB_REQ_GET_STATUS:
 432     case InterfaceRequest | USB_REQ_GET_STATUS:
 433     case EndpointRequest | USB_REQ_GET_STATUS:
 434         data[0] = (1 << USB_DEVICE_SELF_POWERED) |
 435             (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
 436         data[1] = 0x00;
 437         ret = 2;
 438         break;
 439     case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
 440     case InterfaceOutRequest | USB_REQ_CLEAR_FEATURE:
 441     case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
 442         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 443             dev->remote_wakeup = 0;
 444         } else {
 445             goto fail;
 446         }
 447         ret = 0;
 448         break;
 449     case DeviceOutRequest | USB_REQ_SET_FEATURE:
 450     case InterfaceOutRequest | USB_REQ_SET_FEATURE:
 451     case EndpointOutRequest | USB_REQ_SET_FEATURE:
 452         if (value == USB_DEVICE_REMOTE_WAKEUP) {
 453             dev->remote_wakeup = 1;
 454         } else {
 455             goto fail;
 456         }
 457         ret = 0;
 458         break;
 459     case DeviceOutRequest | USB_REQ_SET_ADDRESS:
 460         dev->addr = value;
 461         ret = 0;
 462         break;
 463     case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
 464         switch (value >> 8) {
 465         case USB_DT_DEVICE:
 466             ret = sizeof(qemu_bt_dev_descriptor);
 467             memcpy(data, qemu_bt_dev_descriptor, ret);
 468             break;
 469         case USB_DT_CONFIG:
 470             ret = sizeof(qemu_bt_config_descriptor);
 471             memcpy(data, qemu_bt_config_descriptor, ret);
 472             break;
 473         case USB_DT_STRING:
 474             switch(value & 0xff) {
 475             case 0:
 476                 /* language ids */
 477                 data[0] = 4;
 478                 data[1] = 3;
 479                 data[2] = 0x09;
 480                 data[3] = 0x04;
 481                 ret = 4;
 482                 break;
 483             default:
 484                 goto fail;
 485             }
 486             break;
 487         default:
 488             goto fail;
 489         }
 490         break;
 491     case DeviceRequest | USB_REQ_GET_CONFIGURATION:
 492         data[0] = qemu_bt_config_descriptor[0x5];
 493         ret = 1;
 494         s->config = 0;
 495         break;
 496     case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
 497         ret = 0;
 498         if (value != qemu_bt_config_descriptor[0x5] && value != 0) {
 499             printf("%s: Wrong SET_CONFIGURATION request (%i)\n",
 500                             __FUNCTION__, value);
 501             goto fail;
 502         }
 503         s->config = 1;
 504         usb_bt_fifo_reset(&s->evt);
 505         usb_bt_fifo_reset(&s->acl);
 506         usb_bt_fifo_reset(&s->sco);
 507         break;
 508     case InterfaceRequest | USB_REQ_GET_INTERFACE:
 509         if (value != 0 || (index & ~1) || length != 1)
 510             goto fail;
 511         if (index == 1)
 512             data[0] = s->altsetting;
 513         else
 514             data[0] = 0;
 515         ret = 1;
 516         break;
 517     case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
 518         if ((index & ~1) || length != 0 ||
 519                         (index == 1 && (value < 0 || value > 4)) ||
 520                         (index == 0 && value != 0)) {
 521             printf("%s: Wrong SET_INTERFACE request (%i, %i)\n",
 522                             __FUNCTION__, index, value);
 523             goto fail;
 524         }
 525         s->altsetting = value;
 526         ret = 0;
 527         break;
 528     case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_DEVICE) << 8):
 529         if (s->config)
 530             usb_bt_fifo_out_enqueue(s, &s->outcmd, s->hci->cmd_send,
 531                             usb_bt_hci_cmd_complete, data, length);
 532         break;
 533     default:
 534     fail:
 535         ret = USB_RET_STALL;
 536         break;
 537     }
 538     return ret;
 539 }
 540
 541 static int usb_bt_handle_data(USBDevice *dev, USBPacket *p)
 542 {
 543     struct USBBtState *s = (struct USBBtState *) dev->opaque;
 544     int ret = 0;
 545
 546     if (!s->config)
 547         goto fail;
 548
 549     switch (p->pid) {
 550     case USB_TOKEN_IN:
 551         switch (p->devep & 0xf) {
 552         case USB_EVT_EP:
 553             ret = usb_bt_fifo_dequeue(&s->evt, p);
 554             break;
 555
 556         case USB_ACL_EP:
 557             ret = usb_bt_fifo_dequeue(&s->acl, p);
 558             break;
 559
 560         case USB_SCO_EP:
 561             ret = usb_bt_fifo_dequeue(&s->sco, p);
 562             break;
 563
 564         default:
 565             goto fail;
 566         }
 567         break;
 568
 569     case USB_TOKEN_OUT:
 570         switch (p->devep & 0xf) {
 571         case USB_ACL_EP:
 572             usb_bt_fifo_out_enqueue(s, &s->outacl, s->hci->acl_send,
 573                             usb_bt_hci_acl_complete, p->data, p->len);
 574             break;
 575
 576         case USB_SCO_EP:
 577             usb_bt_fifo_out_enqueue(s, &s->outsco, s->hci->sco_send,
 578                             usb_bt_hci_sco_complete, p->data, p->len);
 579             break;
 580
 581         default:
 582             goto fail;
 583         }
 584         break;
 585
 586     default:
 587     fail:
 588         ret = USB_RET_STALL;
 589         break;
 590     }
 591
 592     return ret;
 593 }
 594
 595 static void usb_bt_out_hci_packet_event(void *opaque,
 596                 const uint8_t *data, int len)
 597 {
 598     struct USBBtState *s = (struct USBBtState *) opaque;
 599
 600     usb_bt_fifo_enqueue(&s->evt, data, len);
 601 }
 602
 603 static void usb_bt_out_hci_packet_acl(void *opaque,
 604                 const uint8_t *data, int len)
 605 {
 606     struct USBBtState *s = (struct USBBtState *) opaque;
 607
 608     usb_bt_fifo_enqueue(&s->acl, data, len);
 609 }
 610
 611 static void usb_bt_handle_destroy(USBDevice *dev)
 612 {
 613     struct USBBtState *s = (struct USBBtState *) dev->opaque;
 614
 615     s->hci->opaque = 0;
 616     s->hci->evt_recv = 0;
 617     s->hci->acl_recv = 0;
 618     qemu_free(s);
 619 }
 620
 621 USBDevice *usb_bt_init(HCIInfo *hci)
 622 {
 623     struct USBBtState *s;
 624
 625     if (!hci)
 626         return NULL;
 627     s = qemu_mallocz(sizeof(struct USBBtState));
 628     s->dev.opaque = s;
 629     s->dev.speed = USB_SPEED_HIGH;
 630     s->dev.handle_packet = usb_generic_handle_packet;
 631     pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU BT dongle");
 632
 633     s->dev.handle_reset = usb_bt_handle_reset;
 634     s->dev.handle_control = usb_bt_handle_control;
 635     s->dev.handle_data = usb_bt_handle_data;
 636     s->dev.handle_destroy = usb_bt_handle_destroy;
 637
 638     s->hci = hci;
 639     s->hci->opaque = s;
 640     s->hci->evt_recv = usb_bt_out_hci_packet_event;
 641     s->hci->acl_recv = usb_bt_out_hci_packet_acl;
 642
 643     usb_bt_handle_reset(&s->dev);
 644
 645     return &s->dev;
 646 }