include/hw/bt.h

   1 /*
   2  * QEMU Bluetooth HCI helpers.
   3  *
   4  * Copyright (C) 2007 OpenMoko, Inc.
   5  * Written by Andrzej Zaborowski <andrew@openedhand.com>
   6  *
   7  * Useful definitions taken from BlueZ project's headers.
   8  * Copyright (C) 2000-2001  Qualcomm Incorporated
   9  * Copyright (C) 2002-2003  Maxim Krasnyansky <maxk@qualcomm.com>
  10  * Copyright (C) 2002-2006  Marcel Holtmann <marcel@holtmann.org>
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License as
  14  * published by the Free Software Foundation; either version 2 of
  15  * the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  24  */
  25
  26 #ifndef HW_BT_H
  27 #define HW_BT_H
  28
  29 #include "hw/irq.h"
  30
  31 /* BD Address */
  32 typedef struct {
  33     uint8_t b[6];
  34 } QEMU_PACKED bdaddr_t;
  35
  36 #define BDADDR_ANY      (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
  37 #define BDADDR_ALL      (&(bdaddr_t) {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff}})
  38 #define BDADDR_LOCAL    (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
  39
  40 /* Copy, swap, convert BD Address */
  41 static inline int bacmp(const bdaddr_t *ba1, const bdaddr_t *ba2)
  42 {
  43     return memcmp(ba1, ba2, sizeof(bdaddr_t));
  44 }
  45 static inline void bacpy(bdaddr_t *dst, const bdaddr_t *src)
  46 {
  47     memcpy(dst, src, sizeof(bdaddr_t));
  48 }
  49
  50 #define BAINIT(orig)    { .b = {                \
  51     (orig)->b[0], (orig)->b[1], (orig)->b[2],   \
  52     (orig)->b[3], (orig)->b[4], (orig)->b[5],   \
  53 }, }
  54
  55 /* The twisted structures of a bluetooth environment */
  56 struct bt_device_s;
  57 struct bt_scatternet_s;
  58 struct bt_piconet_s;
  59 struct bt_link_s;
  60
  61 struct bt_scatternet_s {
  62     struct bt_device_s *slave;
  63 };
  64
  65 struct bt_link_s {
  66     struct bt_device_s *slave, *host;
  67     uint16_t handle;            /* Master (host) side handle */
  68     uint16_t acl_interval;
  69     enum {
  70         acl_active,
  71         acl_hold,
  72         acl_sniff,
  73         acl_parked,
  74     } acl_mode;
  75 };
  76
  77 struct bt_device_s {
  78     int lt_addr;
  79     bdaddr_t bd_addr;
  80     int mtu;
  81     int setup;
  82     struct bt_scatternet_s *net;
  83
  84     uint8_t key[16];
  85     int key_present;
  86     uint8_t class[3];
  87
  88     uint8_t reject_reason;
  89
  90     uint64_t lmp_caps;
  91     const char *lmp_name;
  92     void (*lmp_connection_request)(struct bt_link_s *link);
  93     void (*lmp_connection_complete)(struct bt_link_s *link);
  94     void (*lmp_disconnect_master)(struct bt_link_s *link);
  95     void (*lmp_disconnect_slave)(struct bt_link_s *link);
  96     void (*lmp_acl_data)(struct bt_link_s *link, const uint8_t *data,
  97                     int start, int len);
  98     void (*lmp_acl_resp)(struct bt_link_s *link, const uint8_t *data,
  99                     int start, int len);
 100     void (*lmp_mode_change)(struct bt_link_s *link);
 101
 102     void (*handle_destroy)(struct bt_device_s *device);
 103     struct bt_device_s *next;   /* Next in the piconet/scatternet */
 104
 105     int inquiry_scan;
 106     int page_scan;
 107
 108     uint16_t clkoff;    /* Note: Always little-endian */
 109 };
 110
 111 extern struct HCIInfo null_hci;
 112 /* bt.c */
 113 void bt_device_init(struct bt_device_s *dev, struct bt_scatternet_s *net);
 114 void bt_device_done(struct bt_device_s *dev);
 115 struct bt_scatternet_s *qemu_find_bt_vlan(int id);
 116
 117 /* bt-hci.c */
 118 struct HCIInfo *bt_new_hci(struct bt_scatternet_s *net);
 119 struct HCIInfo *hci_init(const char *str);
 120
 121 /* bt-vhci.c */
 122 void bt_vhci_init(struct HCIInfo *info);
 123
 124 /* bt-hci-csr.c */
 125 enum {
 126     csrhci_pin_reset,
 127     csrhci_pin_wakeup,
 128     __csrhci_pins,
 129 };
 130 qemu_irq *csrhci_pins_get(Chardev *chr);
 131 Chardev *uart_hci_init(void);
 132
 133 /* bt-l2cap.c */
 134 struct bt_l2cap_device_s;
 135 struct bt_l2cap_conn_params_s;
 136 struct bt_l2cap_psm_s;
 137 void bt_l2cap_device_init(struct bt_l2cap_device_s *dev,
 138                 struct bt_scatternet_s *net);
 139 void bt_l2cap_device_done(struct bt_l2cap_device_s *dev);
 140 void bt_l2cap_psm_register(struct bt_l2cap_device_s *dev, int psm,
 141                 int min_mtu, int (*new_channel)(struct bt_l2cap_device_s *dev,
 142                         struct bt_l2cap_conn_params_s *params));
 143
 144 struct bt_l2cap_device_s {
 145     struct bt_device_s device;
 146     struct bt_l2cap_psm_s *first_psm;
 147 };
 148
 149 struct bt_l2cap_conn_params_s {
 150     /* Input */
 151     uint8_t *(*sdu_out)(struct bt_l2cap_conn_params_s *chan, int len);
 152     void (*sdu_submit)(struct bt_l2cap_conn_params_s *chan);
 153     int remote_mtu;
 154     /* Output */
 155     void *opaque;
 156     void (*sdu_in)(void *opaque, const uint8_t *data, int len);
 157     void (*close)(void *opaque);
 158 };
 159
 160 enum bt_l2cap_psm_predef {
 161     BT_PSM_SDP          = 0x0001,
 162     BT_PSM_RFCOMM       = 0x0003,
 163     BT_PSM_TELEPHONY    = 0x0005,
 164     BT_PSM_TCS          = 0x0007,
 165     BT_PSM_BNEP         = 0x000f,
 166     BT_PSM_HID_CTRL     = 0x0011,
 167     BT_PSM_HID_INTR     = 0x0013,
 168     BT_PSM_UPNP         = 0x0015,
 169     BT_PSM_AVCTP        = 0x0017,
 170     BT_PSM_AVDTP        = 0x0019,
 171 };
 172
 173 /* bt-sdp.c */
 174 void bt_l2cap_sdp_init(struct bt_l2cap_device_s *dev);
 175
 176 /* bt-hid.c */
 177 struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net);
 178
 179 /* Link Management Protocol layer defines */
 180
 181 #define LLID_ACLU_CONT          0x1
 182 #define LLID_ACLU_START         0x2
 183 #define LLID_ACLC               0x3
 184
 185 enum lmp_pdu_type {
 186     LMP_NAME_REQ                = 0x0001,
 187     LMP_NAME_RES                = 0x0002,
 188     LMP_ACCEPTED                = 0x0003,
 189     LMP_NOT_ACCEPTED            = 0x0004,
 190     LMP_CLKOFFSET_REQ           = 0x0005,
 191     LMP_CLKOFFSET_RES           = 0x0006,
 192     LMP_DETACH                  = 0x0007,
 193     LMP_IN_RAND                 = 0x0008,
 194     LMP_COMB_KEY                = 0x0009,
 195     LMP_UNIT_KEY                = 0x000a,
 196     LMP_AU_RAND                 = 0x000b,
 197     LMP_SRES                    = 0x000c,
 198     LMP_TEMP_RAND               = 0x000d,
 199     LMP_TEMP_KEY                = 0x000e,
 200     LMP_CRYPT_MODE_REQ          = 0x000f,
 201     LMP_CRYPT_KEY_SIZE_REQ      = 0x0010,
 202     LMP_START_ENCRYPT_REQ       = 0x0011,
 203     LMP_STOP_ENCRYPT_REQ        = 0x0012,
 204     LMP_SWITCH_REQ              = 0x0013,
 205     LMP_HOLD                    = 0x0014,
 206     LMP_HOLD_REQ                = 0x0015,
 207     LMP_SNIFF_REQ               = 0x0017,
 208     LMP_UNSNIFF_REQ             = 0x0018,
 209     LMP_LMP_PARK_REQ            = 0x0019,
 210     LMP_SET_BCAST_SCAN_WND      = 0x001b,
 211     LMP_MODIFY_BEACON           = 0x001c,
 212     LMP_UNPARK_BD_ADDR_REQ      = 0x001d,
 213     LMP_UNPARK_PM_ADDR_REQ      = 0x001e,
 214     LMP_INCR_POWER_REQ          = 0x001f,
 215     LMP_DECR_POWER_REQ          = 0x0020,
 216     LMP_MAX_POWER               = 0x0021,
 217     LMP_MIN_POWER               = 0x0022,
 218     LMP_AUTO_RATE               = 0x0023,
 219     LMP_PREFERRED_RATE          = 0x0024,
 220     LMP_VERSION_REQ             = 0x0025,
 221     LMP_VERSION_RES             = 0x0026,
 222     LMP_FEATURES_REQ            = 0x0027,
 223     LMP_FEATURES_RES            = 0x0028,
 224     LMP_QUALITY_OF_SERVICE      = 0x0029,
 225     LMP_QOS_REQ                 = 0x002a,
 226     LMP_RM_SCO_LINK_REQ         = 0x002b,
 227     LMP_SCO_LINK_REQ            = 0x002c,
 228     LMP_MAX_SLOT                = 0x002d,
 229     LMP_MAX_SLOT_REQ            = 0x002e,
 230     LMP_TIMING_ACCURACY_REQ     = 0x002f,
 231     LMP_TIMING_ACCURACY_RES     = 0x0030,
 232     LMP_SETUP_COMPLETE          = 0x0031,
 233     LMP_USE_SEMIPERM_KEY        = 0x0032,
 234     LMP_HOST_CONNECTION_REQ     = 0x0033,
 235     LMP_SLOT_OFFSET             = 0x0034,
 236     LMP_PAGE_MODE_REQ           = 0x0035,
 237     LMP_PAGE_SCAN_MODE_REQ      = 0x0036,
 238     LMP_SUPERVISION_TIMEOUT     = 0x0037,
 239     LMP_TEST_ACTIVATE           = 0x0038,
 240     LMP_TEST_CONTROL            = 0x0039,
 241     LMP_CRYPT_KEY_MASK_REQ      = 0x003a,
 242     LMP_CRYPT_KEY_MASK_RES      = 0x003b,
 243     LMP_SET_AFH                 = 0x003c,
 244     LMP_ACCEPTED_EXT            = 0x7f01,
 245     LMP_NOT_ACCEPTED_EXT        = 0x7f02,
 246     LMP_FEATURES_REQ_EXT        = 0x7f03,
 247     LMP_FEATURES_RES_EXT        = 0x7f04,
 248     LMP_PACKET_TYPE_TBL_REQ     = 0x7f0b,
 249     LMP_ESCO_LINK_REQ           = 0x7f0c,
 250     LMP_RM_ESCO_LINK_REQ        = 0x7f0d,
 251     LMP_CHANNEL_CLASS_REQ       = 0x7f10,
 252     LMP_CHANNEL_CLASS           = 0x7f11,
 253 };
 254
 255 /* Host Controller Interface layer defines */
 256
 257 enum hci_packet_type {
 258     HCI_COMMAND_PKT             = 0x01,
 259     HCI_ACLDATA_PKT             = 0x02,
 260     HCI_SCODATA_PKT             = 0x03,
 261     HCI_EVENT_PKT               = 0x04,
 262     HCI_VENDOR_PKT              = 0xff,
 263 };
 264
 265 enum bt_packet_type {
 266     HCI_2DH1    = 1 << 1,
 267     HCI_3DH1    = 1 << 2,
 268     HCI_DM1     = 1 << 3,
 269     HCI_DH1     = 1 << 4,
 270     HCI_2DH3    = 1 << 8,
 271     HCI_3DH3    = 1 << 9,
 272     HCI_DM3     = 1 << 10,
 273     HCI_DH3     = 1 << 11,
 274     HCI_2DH5    = 1 << 12,
 275     HCI_3DH5    = 1 << 13,
 276     HCI_DM5     = 1 << 14,
 277     HCI_DH5     = 1 << 15,
 278 };
 279
 280 enum sco_packet_type {
 281     HCI_HV1     = 1 << 5,
 282     HCI_HV2     = 1 << 6,
 283     HCI_HV3     = 1 << 7,
 284 };
 285
 286 enum ev_packet_type {
 287     HCI_EV3     = 1 << 3,
 288     HCI_EV4     = 1 << 4,
 289     HCI_EV5     = 1 << 5,
 290     HCI_2EV3    = 1 << 6,
 291     HCI_3EV3    = 1 << 7,
 292     HCI_2EV5    = 1 << 8,
 293     HCI_3EV5    = 1 << 9,
 294 };
 295
 296 enum hci_error_code {
 297     HCI_SUCCESS                         = 0x00,
 298     HCI_UNKNOWN_COMMAND                 = 0x01,
 299     HCI_NO_CONNECTION                   = 0x02,
 300     HCI_HARDWARE_FAILURE                = 0x03,
 301     HCI_PAGE_TIMEOUT                    = 0x04,
 302     HCI_AUTHENTICATION_FAILURE          = 0x05,
 303     HCI_PIN_OR_KEY_MISSING              = 0x06,
 304     HCI_MEMORY_FULL                     = 0x07,
 305     HCI_CONNECTION_TIMEOUT              = 0x08,
 306     HCI_MAX_NUMBER_OF_CONNECTIONS       = 0x09,
 307     HCI_MAX_NUMBER_OF_SCO_CONNECTIONS   = 0x0a,
 308     HCI_ACL_CONNECTION_EXISTS           = 0x0b,
 309     HCI_COMMAND_DISALLOWED              = 0x0c,
 310     HCI_REJECTED_LIMITED_RESOURCES      = 0x0d,
 311     HCI_REJECTED_SECURITY               = 0x0e,
 312     HCI_REJECTED_PERSONAL               = 0x0f,
 313     HCI_HOST_TIMEOUT                    = 0x10,
 314     HCI_UNSUPPORTED_FEATURE             = 0x11,
 315     HCI_INVALID_PARAMETERS              = 0x12,
 316     HCI_OE_USER_ENDED_CONNECTION        = 0x13,
 317     HCI_OE_LOW_RESOURCES                = 0x14,
 318     HCI_OE_POWER_OFF                    = 0x15,
 319     HCI_CONNECTION_TERMINATED           = 0x16,
 320     HCI_REPEATED_ATTEMPTS               = 0x17,
 321     HCI_PAIRING_NOT_ALLOWED             = 0x18,
 322     HCI_UNKNOWN_LMP_PDU                 = 0x19,
 323     HCI_UNSUPPORTED_REMOTE_FEATURE      = 0x1a,
 324     HCI_SCO_OFFSET_REJECTED             = 0x1b,
 325     HCI_SCO_INTERVAL_REJECTED           = 0x1c,
 326     HCI_AIR_MODE_REJECTED               = 0x1d,
 327     HCI_INVALID_LMP_PARAMETERS          = 0x1e,
 328     HCI_UNSPECIFIED_ERROR               = 0x1f,
 329     HCI_UNSUPPORTED_LMP_PARAMETER_VALUE = 0x20,
 330     HCI_ROLE_CHANGE_NOT_ALLOWED         = 0x21,
 331     HCI_LMP_RESPONSE_TIMEOUT            = 0x22,
 332     HCI_LMP_ERROR_TRANSACTION_COLLISION = 0x23,
 333     HCI_LMP_PDU_NOT_ALLOWED             = 0x24,
 334     HCI_ENCRYPTION_MODE_NOT_ACCEPTED    = 0x25,
 335     HCI_UNIT_LINK_KEY_USED              = 0x26,
 336     HCI_QOS_NOT_SUPPORTED               = 0x27,
 337     HCI_INSTANT_PASSED                  = 0x28,
 338     HCI_PAIRING_NOT_SUPPORTED           = 0x29,
 339     HCI_TRANSACTION_COLLISION           = 0x2a,
 340     HCI_QOS_UNACCEPTABLE_PARAMETER      = 0x2c,
 341     HCI_QOS_REJECTED                    = 0x2d,
 342     HCI_CLASSIFICATION_NOT_SUPPORTED    = 0x2e,
 343     HCI_INSUFFICIENT_SECURITY           = 0x2f,
 344     HCI_PARAMETER_OUT_OF_RANGE          = 0x30,
 345     HCI_ROLE_SWITCH_PENDING             = 0x32,
 346     HCI_SLOT_VIOLATION                  = 0x34,
 347     HCI_ROLE_SWITCH_FAILED              = 0x35,
 348 };
 349
 350 enum acl_flag_bits {
 351     ACL_CONT            = 1 << 0,
 352     ACL_START           = 1 << 1,
 353     ACL_ACTIVE_BCAST    = 1 << 2,
 354     ACL_PICO_BCAST      = 1 << 3,
 355 };
 356
 357 enum baseband_link_type {
 358     SCO_LINK            = 0x00,
 359     ACL_LINK            = 0x01,
 360 };
 361
 362 enum lmp_feature_bits0 {
 363     LMP_3SLOT           = 1 << 0,
 364     LMP_5SLOT           = 1 << 1,
 365     LMP_ENCRYPT         = 1 << 2,
 366     LMP_SOFFSET         = 1 << 3,
 367     LMP_TACCURACY       = 1 << 4,
 368     LMP_RSWITCH         = 1 << 5,
 369     LMP_HOLD_MODE       = 1 << 6,
 370     LMP_SNIFF_MODE      = 1 << 7,
 371 };
 372
 373 enum lmp_feature_bits1 {
 374     LMP_PARK            = 1 << 0,
 375     LMP_RSSI            = 1 << 1,
 376     LMP_QUALITY         = 1 << 2,
 377     LMP_SCO             = 1 << 3,
 378     LMP_HV2             = 1 << 4,
 379     LMP_HV3             = 1 << 5,
 380     LMP_ULAW            = 1 << 6,
 381     LMP_ALAW            = 1 << 7,
 382 };
 383
 384 enum lmp_feature_bits2 {
 385     LMP_CVSD            = 1 << 0,
 386     LMP_PSCHEME         = 1 << 1,
 387     LMP_PCONTROL        = 1 << 2,
 388     LMP_TRSP_SCO        = 1 << 3,
 389     LMP_BCAST_ENC       = 1 << 7,
 390 };
 391
 392 enum lmp_feature_bits3 {
 393     LMP_EDR_ACL_2M      = 1 << 1,
 394     LMP_EDR_ACL_3M      = 1 << 2,
 395     LMP_ENH_ISCAN       = 1 << 3,
 396     LMP_ILACE_ISCAN     = 1 << 4,
 397     LMP_ILACE_PSCAN     = 1 << 5,
 398     LMP_RSSI_INQ        = 1 << 6,
 399     LMP_ESCO            = 1 << 7,
 400 };
 401
 402 enum lmp_feature_bits4 {
 403     LMP_EV4             = 1 << 0,
 404     LMP_EV5             = 1 << 1,
 405     LMP_AFH_CAP_SLV     = 1 << 3,
 406     LMP_AFH_CLS_SLV     = 1 << 4,
 407     LMP_EDR_3SLOT       = 1 << 7,
 408 };
 409
 410 enum lmp_feature_bits5 {
 411     LMP_EDR_5SLOT       = 1 << 0,
 412     LMP_SNIFF_SUBR      = 1 << 1,
 413     LMP_AFH_CAP_MST     = 1 << 3,
 414     LMP_AFH_CLS_MST     = 1 << 4,
 415     LMP_EDR_ESCO_2M     = 1 << 5,
 416     LMP_EDR_ESCO_3M     = 1 << 6,
 417     LMP_EDR_3S_ESCO     = 1 << 7,
 418 };
 419
 420 enum lmp_feature_bits6 {
 421     LMP_EXT_INQ         = 1 << 0,
 422 };
 423
 424 enum lmp_feature_bits7 {
 425     LMP_EXT_FEAT        = 1 << 7,
 426 };
 427
 428 enum hci_link_policy {
 429     HCI_LP_RSWITCH      = 1 << 0,
 430     HCI_LP_HOLD         = 1 << 1,
 431     HCI_LP_SNIFF        = 1 << 2,
 432     HCI_LP_PARK         = 1 << 3,
 433 };
 434
 435 enum hci_link_mode {
 436     HCI_LM_ACCEPT       = 1 << 15,
 437     HCI_LM_MASTER       = 1 << 0,
 438     HCI_LM_AUTH         = 1 << 1,
 439     HCI_LM_ENCRYPT      = 1 << 2,
 440     HCI_LM_TRUSTED      = 1 << 3,
 441     HCI_LM_RELIABLE     = 1 << 4,
 442     HCI_LM_SECURE       = 1 << 5,
 443 };
 444
 445 /* HCI Commands */
 446
 447 /* Link Control */
 448 #define OGF_LINK_CTL            0x01
 449
 450 #define OCF_INQUIRY                     0x0001
 451 typedef struct {
 452     uint8_t     lap[3];
 453     uint8_t     length;         /* 1.28s units */
 454     uint8_t     num_rsp;
 455 } QEMU_PACKED inquiry_cp;
 456 #define INQUIRY_CP_SIZE 5
 457
 458 typedef struct {
 459     uint8_t             status;
 460     bdaddr_t    bdaddr;
 461 } QEMU_PACKED status_bdaddr_rp;
 462 #define STATUS_BDADDR_RP_SIZE 7
 463
 464 #define OCF_INQUIRY_CANCEL              0x0002
 465
 466 #define OCF_PERIODIC_INQUIRY            0x0003
 467 typedef struct {
 468     uint16_t    max_period;     /* 1.28s units */
 469     uint16_t    min_period;     /* 1.28s units */
 470     uint8_t     lap[3];
 471     uint8_t     length;         /* 1.28s units */
 472     uint8_t     num_rsp;
 473 } QEMU_PACKED periodic_inquiry_cp;
 474 #define PERIODIC_INQUIRY_CP_SIZE 9
 475
 476 #define OCF_EXIT_PERIODIC_INQUIRY       0x0004
 477
 478 #define OCF_CREATE_CONN                 0x0005
 479 typedef struct {
 480     bdaddr_t    bdaddr;
 481     uint16_t    pkt_type;
 482     uint8_t     pscan_rep_mode;
 483     uint8_t     pscan_mode;
 484     uint16_t    clock_offset;
 485     uint8_t     role_switch;
 486 } QEMU_PACKED create_conn_cp;
 487 #define CREATE_CONN_CP_SIZE 13
 488
 489 #define OCF_DISCONNECT                  0x0006
 490 typedef struct {
 491     uint16_t    handle;
 492     uint8_t     reason;
 493 } QEMU_PACKED disconnect_cp;
 494 #define DISCONNECT_CP_SIZE 3
 495
 496 #define OCF_ADD_SCO                     0x0007
 497 typedef struct {
 498     uint16_t    handle;
 499     uint16_t    pkt_type;
 500 } QEMU_PACKED add_sco_cp;
 501 #define ADD_SCO_CP_SIZE 4
 502
 503 #define OCF_CREATE_CONN_CANCEL          0x0008
 504 typedef struct {
 505     bdaddr_t    bdaddr;
 506 } QEMU_PACKED create_conn_cancel_cp;
 507 #define CREATE_CONN_CANCEL_CP_SIZE 6
 508
 509 typedef struct {
 510     uint8_t     status;
 511     bdaddr_t    bdaddr;
 512 } QEMU_PACKED create_conn_cancel_rp;
 513 #define CREATE_CONN_CANCEL_RP_SIZE 7
 514
 515 #define OCF_ACCEPT_CONN_REQ             0x0009
 516 typedef struct {
 517     bdaddr_t    bdaddr;
 518     uint8_t     role;
 519 } QEMU_PACKED accept_conn_req_cp;
 520 #define ACCEPT_CONN_REQ_CP_SIZE 7
 521
 522 #define OCF_REJECT_CONN_REQ             0x000A
 523 typedef struct {
 524     bdaddr_t    bdaddr;
 525     uint8_t     reason;
 526 } QEMU_PACKED reject_conn_req_cp;
 527 #define REJECT_CONN_REQ_CP_SIZE 7
 528
 529 #define OCF_LINK_KEY_REPLY              0x000B
 530 typedef struct {
 531     bdaddr_t    bdaddr;
 532     uint8_t     link_key[16];
 533 } QEMU_PACKED link_key_reply_cp;
 534 #define LINK_KEY_REPLY_CP_SIZE 22
 535
 536 #define OCF_LINK_KEY_NEG_REPLY          0x000C
 537
 538 #define OCF_PIN_CODE_REPLY              0x000D
 539 typedef struct {
 540     bdaddr_t    bdaddr;
 541     uint8_t     pin_len;
 542     uint8_t     pin_code[16];
 543 } QEMU_PACKED pin_code_reply_cp;
 544 #define PIN_CODE_REPLY_CP_SIZE 23
 545
 546 #define OCF_PIN_CODE_NEG_REPLY          0x000E
 547
 548 #define OCF_SET_CONN_PTYPE              0x000F
 549 typedef struct {
 550     uint16_t     handle;
 551     uint16_t     pkt_type;
 552 } QEMU_PACKED set_conn_ptype_cp;
 553 #define SET_CONN_PTYPE_CP_SIZE 4
 554
 555 #define OCF_AUTH_REQUESTED              0x0011
 556 typedef struct {
 557     uint16_t     handle;
 558 } QEMU_PACKED auth_requested_cp;
 559 #define AUTH_REQUESTED_CP_SIZE 2
 560
 561 #define OCF_SET_CONN_ENCRYPT            0x0013
 562 typedef struct {
 563     uint16_t    handle;
 564     uint8_t     encrypt;
 565 } QEMU_PACKED set_conn_encrypt_cp;
 566 #define SET_CONN_ENCRYPT_CP_SIZE 3
 567
 568 #define OCF_CHANGE_CONN_LINK_KEY        0x0015
 569 typedef struct {
 570     uint16_t    handle;
 571 } QEMU_PACKED change_conn_link_key_cp;
 572 #define CHANGE_CONN_LINK_KEY_CP_SIZE 2
 573
 574 #define OCF_MASTER_LINK_KEY             0x0017
 575 typedef struct {
 576     uint8_t     key_flag;
 577 } QEMU_PACKED master_link_key_cp;
 578 #define MASTER_LINK_KEY_CP_SIZE 1
 579
 580 #define OCF_REMOTE_NAME_REQ             0x0019
 581 typedef struct {
 582     bdaddr_t    bdaddr;
 583     uint8_t     pscan_rep_mode;
 584     uint8_t     pscan_mode;
 585     uint16_t    clock_offset;
 586 } QEMU_PACKED remote_name_req_cp;
 587 #define REMOTE_NAME_REQ_CP_SIZE 10
 588
 589 #define OCF_REMOTE_NAME_REQ_CANCEL      0x001A
 590 typedef struct {
 591     bdaddr_t    bdaddr;
 592 } QEMU_PACKED remote_name_req_cancel_cp;
 593 #define REMOTE_NAME_REQ_CANCEL_CP_SIZE 6
 594
 595 typedef struct {
 596     uint8_t             status;
 597     bdaddr_t    bdaddr;
 598 } QEMU_PACKED remote_name_req_cancel_rp;
 599 #define REMOTE_NAME_REQ_CANCEL_RP_SIZE 7
 600
 601 #define OCF_READ_REMOTE_FEATURES        0x001B
 602 typedef struct {
 603     uint16_t    handle;
 604 } QEMU_PACKED read_remote_features_cp;
 605 #define READ_REMOTE_FEATURES_CP_SIZE 2
 606
 607 #define OCF_READ_REMOTE_EXT_FEATURES    0x001C
 608 typedef struct {
 609     uint16_t    handle;
 610     uint8_t     page_num;
 611 } QEMU_PACKED read_remote_ext_features_cp;
 612 #define READ_REMOTE_EXT_FEATURES_CP_SIZE 3
 613
 614 #define OCF_READ_REMOTE_VERSION         0x001D
 615 typedef struct {
 616     uint16_t    handle;
 617 } QEMU_PACKED read_remote_version_cp;
 618 #define READ_REMOTE_VERSION_CP_SIZE 2
 619
 620 #define OCF_READ_CLOCK_OFFSET           0x001F
 621 typedef struct {
 622     uint16_t    handle;
 623 } QEMU_PACKED read_clock_offset_cp;
 624 #define READ_CLOCK_OFFSET_CP_SIZE 2
 625
 626 #define OCF_READ_LMP_HANDLE             0x0020
 627 typedef struct {
 628     uint16_t    handle;
 629 } QEMU_PACKED read_lmp_handle_cp;
 630 #define READ_LMP_HANDLE_CP_SIZE 2
 631
 632 typedef struct {
 633     uint8_t     status;
 634     uint16_t    handle;
 635     uint8_t     lmp_handle;
 636     uint32_t    reserved;
 637 } QEMU_PACKED read_lmp_handle_rp;
 638 #define READ_LMP_HANDLE_RP_SIZE 8
 639
 640 #define OCF_SETUP_SYNC_CONN             0x0028
 641 typedef struct {
 642     uint16_t    handle;
 643     uint32_t    tx_bandwidth;
 644     uint32_t    rx_bandwidth;
 645     uint16_t    max_latency;
 646     uint16_t    voice_setting;
 647     uint8_t     retrans_effort;
 648     uint16_t    pkt_type;
 649 } QEMU_PACKED setup_sync_conn_cp;
 650 #define SETUP_SYNC_CONN_CP_SIZE 17
 651
 652 #define OCF_ACCEPT_SYNC_CONN_REQ        0x0029
 653 typedef struct {
 654     bdaddr_t    bdaddr;
 655     uint32_t    tx_bandwidth;
 656     uint32_t    rx_bandwidth;
 657     uint16_t    max_latency;
 658     uint16_t    voice_setting;
 659     uint8_t     retrans_effort;
 660     uint16_t    pkt_type;
 661 } QEMU_PACKED accept_sync_conn_req_cp;
 662 #define ACCEPT_SYNC_CONN_REQ_CP_SIZE 21
 663
 664 #define OCF_REJECT_SYNC_CONN_REQ        0x002A
 665 typedef struct {
 666     bdaddr_t    bdaddr;
 667     uint8_t     reason;
 668 } QEMU_PACKED reject_sync_conn_req_cp;
 669 #define REJECT_SYNC_CONN_REQ_CP_SIZE 7
 670
 671 /* Link Policy */
 672 #define OGF_LINK_POLICY         0x02
 673
 674 #define OCF_HOLD_MODE                   0x0001
 675 typedef struct {
 676     uint16_t    handle;
 677     uint16_t    max_interval;
 678     uint16_t    min_interval;
 679 } QEMU_PACKED hold_mode_cp;
 680 #define HOLD_MODE_CP_SIZE 6
 681
 682 #define OCF_SNIFF_MODE                  0x0003
 683 typedef struct {
 684     uint16_t    handle;
 685     uint16_t    max_interval;
 686     uint16_t    min_interval;
 687     uint16_t    attempt;
 688     uint16_t    timeout;
 689 } QEMU_PACKED sniff_mode_cp;
 690 #define SNIFF_MODE_CP_SIZE 10
 691
 692 #define OCF_EXIT_SNIFF_MODE             0x0004
 693 typedef struct {
 694     uint16_t    handle;
 695 } QEMU_PACKED exit_sniff_mode_cp;
 696 #define EXIT_SNIFF_MODE_CP_SIZE 2
 697
 698 #define OCF_PARK_MODE                   0x0005
 699 typedef struct {
 700     uint16_t    handle;
 701     uint16_t    max_interval;
 702     uint16_t    min_interval;
 703 } QEMU_PACKED park_mode_cp;
 704 #define PARK_MODE_CP_SIZE 6
 705
 706 #define OCF_EXIT_PARK_MODE              0x0006
 707 typedef struct {
 708     uint16_t    handle;
 709 } QEMU_PACKED exit_park_mode_cp;
 710 #define EXIT_PARK_MODE_CP_SIZE 2
 711
 712 #define OCF_QOS_SETUP                   0x0007
 713 typedef struct {
 714     uint8_t     service_type;           /* 1 = best effort */
 715     uint32_t    token_rate;             /* Byte per seconds */
 716     uint32_t    peak_bandwidth;         /* Byte per seconds */
 717     uint32_t    latency;                /* Microseconds */
 718     uint32_t    delay_variation;        /* Microseconds */
 719 } QEMU_PACKED hci_qos;
 720 #define HCI_QOS_CP_SIZE 17
 721 typedef struct {
 722     uint16_t    handle;
 723     uint8_t     flags;                  /* Reserved */
 724     hci_qos     qos;
 725 } QEMU_PACKED qos_setup_cp;
 726 #define QOS_SETUP_CP_SIZE (3 + HCI_QOS_CP_SIZE)
 727
 728 #define OCF_ROLE_DISCOVERY              0x0009
 729 typedef struct {
 730     uint16_t    handle;
 731 } QEMU_PACKED role_discovery_cp;
 732 #define ROLE_DISCOVERY_CP_SIZE 2
 733 typedef struct {
 734     uint8_t     status;
 735     uint16_t    handle;
 736     uint8_t     role;
 737 } QEMU_PACKED role_discovery_rp;
 738 #define ROLE_DISCOVERY_RP_SIZE 4
 739
 740 #define OCF_SWITCH_ROLE                 0x000B
 741 typedef struct {
 742     bdaddr_t    bdaddr;
 743     uint8_t     role;
 744 } QEMU_PACKED switch_role_cp;
 745 #define SWITCH_ROLE_CP_SIZE 7
 746
 747 #define OCF_READ_LINK_POLICY            0x000C
 748 typedef struct {
 749     uint16_t    handle;
 750 } QEMU_PACKED read_link_policy_cp;
 751 #define READ_LINK_POLICY_CP_SIZE 2
 752 typedef struct {
 753     uint8_t     status;
 754     uint16_t    handle;
 755     uint16_t    policy;
 756 } QEMU_PACKED read_link_policy_rp;
 757 #define READ_LINK_POLICY_RP_SIZE 5
 758
 759 #define OCF_WRITE_LINK_POLICY           0x000D
 760 typedef struct {
 761     uint16_t    handle;
 762     uint16_t    policy;
 763 } QEMU_PACKED write_link_policy_cp;
 764 #define WRITE_LINK_POLICY_CP_SIZE 4
 765 typedef struct {
 766     uint8_t     status;
 767     uint16_t    handle;
 768 } QEMU_PACKED write_link_policy_rp;
 769 #define WRITE_LINK_POLICY_RP_SIZE 3
 770
 771 #define OCF_READ_DEFAULT_LINK_POLICY    0x000E
 772
 773 #define OCF_WRITE_DEFAULT_LINK_POLICY   0x000F
 774
 775 #define OCF_FLOW_SPECIFICATION          0x0010
 776
 777 #define OCF_SNIFF_SUBRATE               0x0011
 778 typedef struct {
 779     uint16_t    handle;
 780     uint16_t    max_remote_latency;
 781     uint16_t    max_local_latency;
 782     uint16_t    min_remote_timeout;
 783     uint16_t    min_local_timeout;
 784 } QEMU_PACKED sniff_subrate_cp;
 785 #define SNIFF_SUBRATE_CP_SIZE 10
 786
 787 /* Host Controller and Baseband */
 788 #define OGF_HOST_CTL            0x03
 789
 790 #define OCF_SET_EVENT_MASK              0x0001
 791 typedef struct {
 792     uint8_t     mask[8];
 793 } QEMU_PACKED set_event_mask_cp;
 794 #define SET_EVENT_MASK_CP_SIZE 8
 795
 796 #define OCF_RESET                       0x0003
 797
 798 #define OCF_SET_EVENT_FLT               0x0005
 799 typedef struct {
 800     uint8_t     flt_type;
 801     uint8_t     cond_type;
 802     uint8_t     condition[0];
 803 } QEMU_PACKED set_event_flt_cp;
 804 #define SET_EVENT_FLT_CP_SIZE 2
 805
 806 enum bt_filter_type {
 807     FLT_CLEAR_ALL               = 0x00,
 808     FLT_INQ_RESULT              = 0x01,
 809     FLT_CONN_SETUP              = 0x02,
 810 };
 811 enum inq_result_cond_type {
 812     INQ_RESULT_RETURN_ALL       = 0x00,
 813     INQ_RESULT_RETURN_CLASS     = 0x01,
 814     INQ_RESULT_RETURN_BDADDR    = 0x02,
 815 };
 816 enum conn_setup_cond_type {
 817     CONN_SETUP_ALLOW_ALL        = 0x00,
 818     CONN_SETUP_ALLOW_CLASS      = 0x01,
 819     CONN_SETUP_ALLOW_BDADDR     = 0x02,
 820 };
 821 enum conn_setup_cond {
 822     CONN_SETUP_AUTO_OFF         = 0x01,
 823     CONN_SETUP_AUTO_ON          = 0x02,
 824 };
 825
 826 #define OCF_FLUSH                       0x0008
 827 typedef struct {
 828     uint16_t    handle;
 829 } QEMU_PACKED flush_cp;
 830 #define FLUSH_CP_SIZE 2
 831
 832 typedef struct {
 833     uint8_t     status;
 834     uint16_t    handle;
 835 } QEMU_PACKED flush_rp;
 836 #define FLUSH_RP_SIZE 3
 837
 838 #define OCF_READ_PIN_TYPE               0x0009
 839 typedef struct {
 840     uint8_t     status;
 841     uint8_t     pin_type;
 842 } QEMU_PACKED read_pin_type_rp;
 843 #define READ_PIN_TYPE_RP_SIZE 2
 844
 845 #define OCF_WRITE_PIN_TYPE              0x000A
 846 typedef struct {
 847     uint8_t     pin_type;
 848 } QEMU_PACKED write_pin_type_cp;
 849 #define WRITE_PIN_TYPE_CP_SIZE 1
 850
 851 #define OCF_CREATE_NEW_UNIT_KEY         0x000B
 852
 853 #define OCF_READ_STORED_LINK_KEY        0x000D
 854 typedef struct {
 855     bdaddr_t    bdaddr;
 856     uint8_t     read_all;
 857 } QEMU_PACKED read_stored_link_key_cp;
 858 #define READ_STORED_LINK_KEY_CP_SIZE 7
 859 typedef struct {
 860     uint8_t     status;
 861     uint16_t    max_keys;
 862     uint16_t    num_keys;
 863 } QEMU_PACKED read_stored_link_key_rp;
 864 #define READ_STORED_LINK_KEY_RP_SIZE 5
 865
 866 #define OCF_WRITE_STORED_LINK_KEY       0x0011
 867 typedef struct {
 868     uint8_t     num_keys;
 869     /* variable length part */
 870 } QEMU_PACKED write_stored_link_key_cp;
 871 #define WRITE_STORED_LINK_KEY_CP_SIZE 1
 872 typedef struct {
 873     uint8_t     status;
 874     uint8_t     num_keys;
 875 } QEMU_PACKED write_stored_link_key_rp;
 876 #define READ_WRITE_LINK_KEY_RP_SIZE 2
 877
 878 #define OCF_DELETE_STORED_LINK_KEY      0x0012
 879 typedef struct {
 880     bdaddr_t    bdaddr;
 881     uint8_t     delete_all;
 882 } QEMU_PACKED delete_stored_link_key_cp;
 883 #define DELETE_STORED_LINK_KEY_CP_SIZE 7
 884 typedef struct {
 885     uint8_t     status;
 886     uint16_t    num_keys;
 887 } QEMU_PACKED delete_stored_link_key_rp;
 888 #define DELETE_STORED_LINK_KEY_RP_SIZE 3
 889
 890 #define OCF_CHANGE_LOCAL_NAME           0x0013
 891 typedef struct {
 892     char        name[248];
 893 } QEMU_PACKED change_local_name_cp;
 894 #define CHANGE_LOCAL_NAME_CP_SIZE 248
 895
 896 #define OCF_READ_LOCAL_NAME             0x0014
 897 typedef struct {
 898     uint8_t     status;
 899     char        name[248];
 900 } QEMU_PACKED read_local_name_rp;
 901 #define READ_LOCAL_NAME_RP_SIZE 249
 902
 903 #define OCF_READ_CONN_ACCEPT_TIMEOUT    0x0015
 904 typedef struct {
 905     uint8_t     status;
 906     uint16_t    timeout;
 907 } QEMU_PACKED read_conn_accept_timeout_rp;
 908 #define READ_CONN_ACCEPT_TIMEOUT_RP_SIZE 3
 909
 910 #define OCF_WRITE_CONN_ACCEPT_TIMEOUT   0x0016
 911 typedef struct {
 912     uint16_t    timeout;
 913 } QEMU_PACKED write_conn_accept_timeout_cp;
 914 #define WRITE_CONN_ACCEPT_TIMEOUT_CP_SIZE 2
 915
 916 #define OCF_READ_PAGE_TIMEOUT           0x0017
 917 typedef struct {
 918     uint8_t     status;
 919     uint16_t    timeout;
 920 } QEMU_PACKED read_page_timeout_rp;
 921 #define READ_PAGE_TIMEOUT_RP_SIZE 3
 922
 923 #define OCF_WRITE_PAGE_TIMEOUT          0x0018
 924 typedef struct {
 925     uint16_t    timeout;
 926 } QEMU_PACKED write_page_timeout_cp;
 927 #define WRITE_PAGE_TIMEOUT_CP_SIZE 2
 928
 929 #define OCF_READ_SCAN_ENABLE            0x0019
 930 typedef struct {
 931     uint8_t     status;
 932     uint8_t     enable;
 933 } QEMU_PACKED read_scan_enable_rp;
 934 #define READ_SCAN_ENABLE_RP_SIZE 2
 935
 936 #define OCF_WRITE_SCAN_ENABLE           0x001A
 937 typedef struct {
 938     uint8_t     scan_enable;
 939 } QEMU_PACKED write_scan_enable_cp;
 940 #define WRITE_SCAN_ENABLE_CP_SIZE 1
 941
 942 enum scan_enable_bits {
 943     SCAN_DISABLED               = 0,
 944     SCAN_INQUIRY                = 1 << 0,
 945     SCAN_PAGE                   = 1 << 1,
 946 };
 947
 948 #define OCF_READ_PAGE_ACTIVITY          0x001B
 949 typedef struct {
 950     uint8_t     status;
 951     uint16_t    interval;
 952     uint16_t    window;
 953 } QEMU_PACKED read_page_activity_rp;
 954 #define READ_PAGE_ACTIVITY_RP_SIZE 5
 955
 956 #define OCF_WRITE_PAGE_ACTIVITY         0x001C
 957 typedef struct {
 958     uint16_t    interval;
 959     uint16_t    window;
 960 } QEMU_PACKED write_page_activity_cp;
 961 #define WRITE_PAGE_ACTIVITY_CP_SIZE 4
 962
 963 #define OCF_READ_INQ_ACTIVITY           0x001D
 964 typedef struct {
 965     uint8_t     status;
 966     uint16_t    interval;
 967     uint16_t    window;
 968 } QEMU_PACKED read_inq_activity_rp;
 969 #define READ_INQ_ACTIVITY_RP_SIZE 5
 970
 971 #define OCF_WRITE_INQ_ACTIVITY          0x001E
 972 typedef struct {
 973     uint16_t    interval;
 974     uint16_t    window;
 975 } QEMU_PACKED write_inq_activity_cp;
 976 #define WRITE_INQ_ACTIVITY_CP_SIZE 4
 977
 978 #define OCF_READ_AUTH_ENABLE            0x001F
 979
 980 #define OCF_WRITE_AUTH_ENABLE           0x0020
 981
 982 #define AUTH_DISABLED           0x00
 983 #define AUTH_ENABLED            0x01
 984
 985 #define OCF_READ_ENCRYPT_MODE           0x0021
 986
 987 #define OCF_WRITE_ENCRYPT_MODE          0x0022
 988
 989 #define ENCRYPT_DISABLED        0x00
 990 #define ENCRYPT_P2P             0x01
 991 #define ENCRYPT_BOTH            0x02
 992
 993 #define OCF_READ_CLASS_OF_DEV           0x0023
 994 typedef struct {
 995     uint8_t     status;
 996     uint8_t     dev_class[3];
 997 } QEMU_PACKED read_class_of_dev_rp;
 998 #define READ_CLASS_OF_DEV_RP_SIZE 4
 999
1000 #define OCF_WRITE_CLASS_OF_DEV          0x0024
1001 typedef struct {
1002     uint8_t     dev_class[3];
1003 } QEMU_PACKED write_class_of_dev_cp;
1004 #define WRITE_CLASS_OF_DEV_CP_SIZE 3
1005
1006 #define OCF_READ_VOICE_SETTING          0x0025
1007 typedef struct {
1008     uint8_t     status;
1009     uint16_t    voice_setting;
1010 } QEMU_PACKED read_voice_setting_rp;
1011 #define READ_VOICE_SETTING_RP_SIZE 3
1012
1013 #define OCF_WRITE_VOICE_SETTING         0x0026
1014 typedef struct {
1015     uint16_t    voice_setting;
1016 } QEMU_PACKED write_voice_setting_cp;
1017 #define WRITE_VOICE_SETTING_CP_SIZE 2
1018
1019 #define OCF_READ_AUTOMATIC_FLUSH_TIMEOUT        0x0027
1020
1021 #define OCF_WRITE_AUTOMATIC_FLUSH_TIMEOUT       0x0028
1022
1023 #define OCF_READ_NUM_BROADCAST_RETRANS  0x0029
1024
1025 #define OCF_WRITE_NUM_BROADCAST_RETRANS 0x002A
1026
1027 #define OCF_READ_HOLD_MODE_ACTIVITY     0x002B
1028
1029 #define OCF_WRITE_HOLD_MODE_ACTIVITY    0x002C
1030
1031 #define OCF_READ_TRANSMIT_POWER_LEVEL   0x002D
1032 typedef struct {
1033     uint16_t    handle;
1034     uint8_t     type;
1035 } QEMU_PACKED read_transmit_power_level_cp;
1036 #define READ_TRANSMIT_POWER_LEVEL_CP_SIZE 3
1037 typedef struct {
1038     uint8_t     status;
1039     uint16_t    handle;
1040     int8_t      level;
1041 } QEMU_PACKED read_transmit_power_level_rp;
1042 #define READ_TRANSMIT_POWER_LEVEL_RP_SIZE 4
1043
1044 #define OCF_HOST_BUFFER_SIZE            0x0033
1045 typedef struct {
1046     uint16_t    acl_mtu;
1047     uint8_t     sco_mtu;
1048     uint16_t    acl_max_pkt;
1049     uint16_t    sco_max_pkt;
1050 } QEMU_PACKED host_buffer_size_cp;
1051 #define HOST_BUFFER_SIZE_CP_SIZE 7
1052
1053 #define OCF_HOST_NUMBER_OF_COMPLETED_PACKETS    0x0035
1054
1055 #define OCF_READ_LINK_SUPERVISION_TIMEOUT       0x0036
1056 typedef struct {
1057     uint8_t     status;
1058     uint16_t    handle;
1059     uint16_t    link_sup_to;
1060 } QEMU_PACKED read_link_supervision_timeout_rp;
1061 #define READ_LINK_SUPERVISION_TIMEOUT_RP_SIZE 5
1062
1063 #define OCF_WRITE_LINK_SUPERVISION_TIMEOUT      0x0037
1064 typedef struct {
1065     uint16_t    handle;
1066     uint16_t    link_sup_to;
1067 } QEMU_PACKED write_link_supervision_timeout_cp;
1068 #define WRITE_LINK_SUPERVISION_TIMEOUT_CP_SIZE 4
1069 typedef struct {
1070     uint8_t     status;
1071     uint16_t    handle;
1072 } QEMU_PACKED write_link_supervision_timeout_rp;
1073 #define WRITE_LINK_SUPERVISION_TIMEOUT_RP_SIZE 3
1074
1075 #define OCF_READ_NUM_SUPPORTED_IAC      0x0038
1076
1077 #define MAX_IAC_LAP 0x40
1078 #define OCF_READ_CURRENT_IAC_LAP        0x0039
1079 typedef struct {
1080     uint8_t     status;
1081     uint8_t     num_current_iac;
1082     uint8_t     lap[MAX_IAC_LAP][3];
1083 } QEMU_PACKED read_current_iac_lap_rp;
1084 #define READ_CURRENT_IAC_LAP_RP_SIZE 2+3*MAX_IAC_LAP
1085
1086 #define OCF_WRITE_CURRENT_IAC_LAP       0x003A
1087 typedef struct {
1088     uint8_t     num_current_iac;
1089     uint8_t     lap[MAX_IAC_LAP][3];
1090 } QEMU_PACKED write_current_iac_lap_cp;
1091 #define WRITE_CURRENT_IAC_LAP_CP_SIZE 1+3*MAX_IAC_LAP
1092
1093 #define OCF_READ_PAGE_SCAN_PERIOD_MODE  0x003B
1094
1095 #define OCF_WRITE_PAGE_SCAN_PERIOD_MODE 0x003C
1096
1097 #define OCF_READ_PAGE_SCAN_MODE         0x003D
1098
1099 #define OCF_WRITE_PAGE_SCAN_MODE        0x003E
1100
1101 #define OCF_SET_AFH_CLASSIFICATION      0x003F
1102 typedef struct {
1103     uint8_t     map[10];
1104 } QEMU_PACKED set_afh_classification_cp;
1105 #define SET_AFH_CLASSIFICATION_CP_SIZE 10
1106 typedef struct {
1107     uint8_t     status;
1108 } QEMU_PACKED set_afh_classification_rp;
1109 #define SET_AFH_CLASSIFICATION_RP_SIZE 1
1110
1111 #define OCF_READ_INQUIRY_SCAN_TYPE      0x0042
1112 typedef struct {
1113     uint8_t     status;
1114     uint8_t     type;
1115 } QEMU_PACKED read_inquiry_scan_type_rp;
1116 #define READ_INQUIRY_SCAN_TYPE_RP_SIZE 2
1117
1118 #define OCF_WRITE_INQUIRY_SCAN_TYPE     0x0043
1119 typedef struct {
1120     uint8_t     type;
1121 } QEMU_PACKED write_inquiry_scan_type_cp;
1122 #define WRITE_INQUIRY_SCAN_TYPE_CP_SIZE 1
1123 typedef struct {
1124     uint8_t     status;
1125 } QEMU_PACKED write_inquiry_scan_type_rp;
1126 #define WRITE_INQUIRY_SCAN_TYPE_RP_SIZE 1
1127
1128 #define OCF_READ_INQUIRY_MODE           0x0044
1129 typedef struct {
1130     uint8_t     status;
1131     uint8_t     mode;
1132 } QEMU_PACKED read_inquiry_mode_rp;
1133 #define READ_INQUIRY_MODE_RP_SIZE 2
1134
1135 #define OCF_WRITE_INQUIRY_MODE          0x0045
1136 typedef struct {
1137     uint8_t     mode;
1138 } QEMU_PACKED write_inquiry_mode_cp;
1139 #define WRITE_INQUIRY_MODE_CP_SIZE 1
1140 typedef struct {
1141     uint8_t     status;
1142 } QEMU_PACKED write_inquiry_mode_rp;
1143 #define WRITE_INQUIRY_MODE_RP_SIZE 1
1144
1145 #define OCF_READ_PAGE_SCAN_TYPE         0x0046
1146
1147 #define OCF_WRITE_PAGE_SCAN_TYPE        0x0047
1148
1149 #define OCF_READ_AFH_MODE               0x0048
1150 typedef struct {
1151     uint8_t     status;
1152     uint8_t     mode;
1153 } QEMU_PACKED read_afh_mode_rp;
1154 #define READ_AFH_MODE_RP_SIZE 2
1155
1156 #define OCF_WRITE_AFH_MODE              0x0049
1157 typedef struct {
1158     uint8_t     mode;
1159 } QEMU_PACKED write_afh_mode_cp;
1160 #define WRITE_AFH_MODE_CP_SIZE 1
1161 typedef struct {
1162     uint8_t     status;
1163 } QEMU_PACKED write_afh_mode_rp;
1164 #define WRITE_AFH_MODE_RP_SIZE 1
1165
1166 #define OCF_READ_EXT_INQUIRY_RESPONSE   0x0051
1167 typedef struct {
1168     uint8_t     status;
1169     uint8_t     fec;
1170     uint8_t     data[240];
1171 } QEMU_PACKED read_ext_inquiry_response_rp;
1172 #define READ_EXT_INQUIRY_RESPONSE_RP_SIZE 242
1173
1174 #define OCF_WRITE_EXT_INQUIRY_RESPONSE  0x0052
1175 typedef struct {
1176     uint8_t     fec;
1177     uint8_t     data[240];
1178 } QEMU_PACKED write_ext_inquiry_response_cp;
1179 #define WRITE_EXT_INQUIRY_RESPONSE_CP_SIZE 241
1180 typedef struct {
1181     uint8_t     status;
1182 } QEMU_PACKED write_ext_inquiry_response_rp;
1183 #define WRITE_EXT_INQUIRY_RESPONSE_RP_SIZE 1
1184
1185 /* Informational Parameters */
1186 #define OGF_INFO_PARAM          0x04
1187
1188 #define OCF_READ_LOCAL_VERSION          0x0001
1189 typedef struct {
1190     uint8_t     status;
1191     uint8_t     hci_ver;
1192     uint16_t    hci_rev;
1193     uint8_t     lmp_ver;
1194     uint16_t    manufacturer;
1195     uint16_t    lmp_subver;
1196 } QEMU_PACKED read_local_version_rp;
1197 #define READ_LOCAL_VERSION_RP_SIZE 9
1198
1199 #define OCF_READ_LOCAL_COMMANDS         0x0002
1200 typedef struct {
1201     uint8_t     status;
1202     uint8_t     commands[64];
1203 } QEMU_PACKED read_local_commands_rp;
1204 #define READ_LOCAL_COMMANDS_RP_SIZE 65
1205
1206 #define OCF_READ_LOCAL_FEATURES         0x0003
1207 typedef struct {
1208     uint8_t     status;
1209     uint8_t     features[8];
1210 } QEMU_PACKED read_local_features_rp;
1211 #define READ_LOCAL_FEATURES_RP_SIZE 9
1212
1213 #define OCF_READ_LOCAL_EXT_FEATURES     0x0004
1214 typedef struct {
1215     uint8_t     page_num;
1216 } QEMU_PACKED read_local_ext_features_cp;
1217 #define READ_LOCAL_EXT_FEATURES_CP_SIZE 1
1218 typedef struct {
1219     uint8_t     status;
1220     uint8_t     page_num;
1221     uint8_t     max_page_num;
1222     uint8_t     features[8];
1223 } QEMU_PACKED read_local_ext_features_rp;
1224 #define READ_LOCAL_EXT_FEATURES_RP_SIZE 11
1225
1226 #define OCF_READ_BUFFER_SIZE            0x0005
1227 typedef struct {
1228     uint8_t     status;
1229     uint16_t    acl_mtu;
1230     uint8_t     sco_mtu;
1231     uint16_t    acl_max_pkt;
1232     uint16_t    sco_max_pkt;
1233 } QEMU_PACKED read_buffer_size_rp;
1234 #define READ_BUFFER_SIZE_RP_SIZE 8
1235
1236 #define OCF_READ_COUNTRY_CODE           0x0007
1237 typedef struct {
1238     uint8_t     status;
1239     uint8_t     country_code;
1240 } QEMU_PACKED read_country_code_rp;
1241 #define READ_COUNTRY_CODE_RP_SIZE 2
1242
1243 #define OCF_READ_BD_ADDR                0x0009
1244 typedef struct {
1245     uint8_t     status;
1246     bdaddr_t    bdaddr;
1247 } QEMU_PACKED read_bd_addr_rp;
1248 #define READ_BD_ADDR_RP_SIZE 7
1249
1250 /* Status params */
1251 #define OGF_STATUS_PARAM        0x05
1252
1253 #define OCF_READ_FAILED_CONTACT_COUNTER         0x0001
1254 typedef struct {
1255     uint8_t     status;
1256     uint16_t    handle;
1257     uint8_t     counter;
1258 } QEMU_PACKED read_failed_contact_counter_rp;
1259 #define READ_FAILED_CONTACT_COUNTER_RP_SIZE 4
1260
1261 #define OCF_RESET_FAILED_CONTACT_COUNTER        0x0002
1262 typedef struct {
1263     uint8_t     status;
1264     uint16_t    handle;
1265 } QEMU_PACKED reset_failed_contact_counter_rp;
1266 #define RESET_FAILED_CONTACT_COUNTER_RP_SIZE 3
1267
1268 #define OCF_READ_LINK_QUALITY           0x0003
1269 typedef struct {
1270     uint16_t    handle;
1271 } QEMU_PACKED read_link_quality_cp;
1272 #define READ_LINK_QUALITY_CP_SIZE 2
1273
1274 typedef struct {
1275     uint8_t     status;
1276     uint16_t    handle;
1277     uint8_t     link_quality;
1278 } QEMU_PACKED read_link_quality_rp;
1279 #define READ_LINK_QUALITY_RP_SIZE 4
1280
1281 #define OCF_READ_RSSI                   0x0005
1282 typedef struct {
1283     uint8_t     status;
1284     uint16_t    handle;
1285     int8_t      rssi;
1286 } QEMU_PACKED read_rssi_rp;
1287 #define READ_RSSI_RP_SIZE 4
1288
1289 #define OCF_READ_AFH_MAP                0x0006
1290 typedef struct {
1291     uint8_t     status;
1292     uint16_t    handle;
1293     uint8_t     mode;
1294     uint8_t     map[10];
1295 } QEMU_PACKED read_afh_map_rp;
1296 #define READ_AFH_MAP_RP_SIZE 14
1297
1298 #define OCF_READ_CLOCK                  0x0007
1299 typedef struct {
1300     uint16_t    handle;
1301     uint8_t     which_clock;
1302 } QEMU_PACKED read_clock_cp;
1303 #define READ_CLOCK_CP_SIZE 3
1304 typedef struct {
1305     uint8_t     status;
1306     uint16_t    handle;
1307     uint32_t    clock;
1308     uint16_t    accuracy;
1309 } QEMU_PACKED read_clock_rp;
1310 #define READ_CLOCK_RP_SIZE 9
1311
1312 /* Testing commands */
1313 #define OGF_TESTING_CMD         0x3e
1314
1315 /* Vendor specific commands */
1316 #define OGF_VENDOR_CMD          0x3f
1317
1318 /* HCI Events */
1319
1320 #define EVT_INQUIRY_COMPLETE            0x01
1321
1322 #define EVT_INQUIRY_RESULT              0x02
1323 typedef struct {
1324     uint8_t     num_responses;
1325     bdaddr_t    bdaddr;
1326     uint8_t     pscan_rep_mode;
1327     uint8_t     pscan_period_mode;
1328     uint8_t     pscan_mode;
1329     uint8_t     dev_class[3];
1330     uint16_t    clock_offset;
1331 } QEMU_PACKED inquiry_info;
1332 #define INQUIRY_INFO_SIZE 15
1333
1334 #define EVT_CONN_COMPLETE               0x03
1335 typedef struct {
1336     uint8_t     status;
1337     uint16_t    handle;
1338     bdaddr_t    bdaddr;
1339     uint8_t     link_type;
1340     uint8_t     encr_mode;
1341 } QEMU_PACKED evt_conn_complete;
1342 #define EVT_CONN_COMPLETE_SIZE 11
1343
1344 #define EVT_CONN_REQUEST                0x04
1345 typedef struct {
1346     bdaddr_t    bdaddr;
1347     uint8_t     dev_class[3];
1348     uint8_t     link_type;
1349 } QEMU_PACKED evt_conn_request;
1350 #define EVT_CONN_REQUEST_SIZE 10
1351
1352 #define EVT_DISCONN_COMPLETE            0x05
1353 typedef struct {
1354     uint8_t     status;
1355     uint16_t    handle;
1356     uint8_t     reason;
1357 } QEMU_PACKED evt_disconn_complete;
1358 #define EVT_DISCONN_COMPLETE_SIZE 4
1359
1360 #define EVT_AUTH_COMPLETE               0x06
1361 typedef struct {
1362     uint8_t     status;
1363     uint16_t    handle;
1364 } QEMU_PACKED evt_auth_complete;
1365 #define EVT_AUTH_COMPLETE_SIZE 3
1366
1367 #define EVT_REMOTE_NAME_REQ_COMPLETE    0x07
1368 typedef struct {
1369     uint8_t     status;
1370     bdaddr_t    bdaddr;
1371     char        name[248];
1372 } QEMU_PACKED evt_remote_name_req_complete;
1373 #define EVT_REMOTE_NAME_REQ_COMPLETE_SIZE 255
1374
1375 #define EVT_ENCRYPT_CHANGE              0x08
1376 typedef struct {
1377     uint8_t     status;
1378     uint16_t    handle;
1379     uint8_t     encrypt;
1380 } QEMU_PACKED evt_encrypt_change;
1381 #define EVT_ENCRYPT_CHANGE_SIZE 4
1382
1383 #define EVT_CHANGE_CONN_LINK_KEY_COMPLETE       0x09
1384 typedef struct {
1385     uint8_t     status;
1386     uint16_t    handle;
1387 }  QEMU_PACKED evt_change_conn_link_key_complete;
1388 #define EVT_CHANGE_CONN_LINK_KEY_COMPLETE_SIZE 3
1389
1390 #define EVT_MASTER_LINK_KEY_COMPLETE            0x0A
1391 typedef struct {
1392     uint8_t     status;
1393     uint16_t    handle;
1394     uint8_t     key_flag;
1395 } QEMU_PACKED evt_master_link_key_complete;
1396 #define EVT_MASTER_LINK_KEY_COMPLETE_SIZE 4
1397
1398 #define EVT_READ_REMOTE_FEATURES_COMPLETE       0x0B
1399 typedef struct {
1400     uint8_t     status;
1401     uint16_t    handle;
1402     uint8_t     features[8];
1403 } QEMU_PACKED evt_read_remote_features_complete;
1404 #define EVT_READ_REMOTE_FEATURES_COMPLETE_SIZE 11
1405
1406 #define EVT_READ_REMOTE_VERSION_COMPLETE        0x0C
1407 typedef struct {
1408     uint8_t     status;
1409     uint16_t    handle;
1410     uint8_t     lmp_ver;
1411     uint16_t    manufacturer;
1412     uint16_t    lmp_subver;
1413 } QEMU_PACKED evt_read_remote_version_complete;
1414 #define EVT_READ_REMOTE_VERSION_COMPLETE_SIZE 8
1415
1416 #define EVT_QOS_SETUP_COMPLETE          0x0D
1417 typedef struct {
1418     uint8_t     status;
1419     uint16_t    handle;
1420     uint8_t     flags;                  /* Reserved */
1421     hci_qos     qos;
1422 } QEMU_PACKED evt_qos_setup_complete;
1423 #define EVT_QOS_SETUP_COMPLETE_SIZE (4 + HCI_QOS_CP_SIZE)
1424
1425 #define EVT_CMD_COMPLETE                0x0E
1426 typedef struct {
1427     uint8_t     ncmd;
1428     uint16_t    opcode;
1429 } QEMU_PACKED evt_cmd_complete;
1430 #define EVT_CMD_COMPLETE_SIZE 3
1431
1432 #define EVT_CMD_STATUS                  0x0F
1433 typedef struct {
1434     uint8_t     status;
1435     uint8_t     ncmd;
1436     uint16_t    opcode;
1437 } QEMU_PACKED evt_cmd_status;
1438 #define EVT_CMD_STATUS_SIZE 4
1439
1440 #define EVT_HARDWARE_ERROR              0x10
1441 typedef struct {
1442     uint8_t     code;
1443 } QEMU_PACKED evt_hardware_error;
1444 #define EVT_HARDWARE_ERROR_SIZE 1
1445
1446 #define EVT_FLUSH_OCCURRED              0x11
1447 typedef struct {
1448     uint16_t    handle;
1449 } QEMU_PACKED evt_flush_occurred;
1450 #define EVT_FLUSH_OCCURRED_SIZE 2
1451
1452 #define EVT_ROLE_CHANGE                 0x12
1453 typedef struct {
1454     uint8_t     status;
1455     bdaddr_t    bdaddr;
1456     uint8_t     role;
1457 } QEMU_PACKED evt_role_change;
1458 #define EVT_ROLE_CHANGE_SIZE 8
1459
1460 #define EVT_NUM_COMP_PKTS               0x13
1461 typedef struct {
1462     uint8_t     num_hndl;
1463     struct {
1464         uint16_t handle;
1465         uint16_t num_packets;
1466     } connection[0];
1467 } QEMU_PACKED evt_num_comp_pkts;
1468 #define EVT_NUM_COMP_PKTS_SIZE(num_hndl) (1 + 4 * (num_hndl))
1469
1470 #define EVT_MODE_CHANGE                 0x14
1471 typedef struct {
1472     uint8_t     status;
1473     uint16_t    handle;
1474     uint8_t     mode;
1475     uint16_t    interval;
1476 } QEMU_PACKED evt_mode_change;
1477 #define EVT_MODE_CHANGE_SIZE 6
1478
1479 #define EVT_RETURN_LINK_KEYS            0x15
1480 typedef struct {
1481     uint8_t     num_keys;
1482     /* variable length part */
1483 } QEMU_PACKED evt_return_link_keys;
1484 #define EVT_RETURN_LINK_KEYS_SIZE 1
1485
1486 #define EVT_PIN_CODE_REQ                0x16
1487 typedef struct {
1488     bdaddr_t    bdaddr;
1489 } QEMU_PACKED evt_pin_code_req;
1490 #define EVT_PIN_CODE_REQ_SIZE 6
1491
1492 #define EVT_LINK_KEY_REQ                0x17
1493 typedef struct {
1494     bdaddr_t    bdaddr;
1495 } QEMU_PACKED evt_link_key_req;
1496 #define EVT_LINK_KEY_REQ_SIZE 6
1497
1498 #define EVT_LINK_KEY_NOTIFY             0x18
1499 typedef struct {
1500     bdaddr_t    bdaddr;
1501     uint8_t     link_key[16];
1502     uint8_t     key_type;
1503 } QEMU_PACKED evt_link_key_notify;
1504 #define EVT_LINK_KEY_NOTIFY_SIZE 23
1505
1506 #define EVT_LOOPBACK_COMMAND            0x19
1507
1508 #define EVT_DATA_BUFFER_OVERFLOW        0x1A
1509 typedef struct {
1510     uint8_t     link_type;
1511 } QEMU_PACKED evt_data_buffer_overflow;
1512 #define EVT_DATA_BUFFER_OVERFLOW_SIZE 1
1513
1514 #define EVT_MAX_SLOTS_CHANGE            0x1B
1515 typedef struct {
1516     uint16_t    handle;
1517     uint8_t     max_slots;
1518 } QEMU_PACKED evt_max_slots_change;
1519 #define EVT_MAX_SLOTS_CHANGE_SIZE 3
1520
1521 #define EVT_READ_CLOCK_OFFSET_COMPLETE  0x1C
1522 typedef struct {
1523     uint8_t     status;
1524     uint16_t    handle;
1525     uint16_t    clock_offset;
1526 } QEMU_PACKED evt_read_clock_offset_complete;
1527 #define EVT_READ_CLOCK_OFFSET_COMPLETE_SIZE 5
1528
1529 #define EVT_CONN_PTYPE_CHANGED          0x1D
1530 typedef struct {
1531     uint8_t     status;
1532     uint16_t    handle;
1533     uint16_t    ptype;
1534 } QEMU_PACKED evt_conn_ptype_changed;
1535 #define EVT_CONN_PTYPE_CHANGED_SIZE 5
1536
1537 #define EVT_QOS_VIOLATION               0x1E
1538 typedef struct {
1539     uint16_t    handle;
1540 } QEMU_PACKED evt_qos_violation;
1541 #define EVT_QOS_VIOLATION_SIZE 2
1542
1543 #define EVT_PSCAN_REP_MODE_CHANGE       0x20
1544 typedef struct {
1545     bdaddr_t    bdaddr;
1546     uint8_t     pscan_rep_mode;
1547 } QEMU_PACKED evt_pscan_rep_mode_change;
1548 #define EVT_PSCAN_REP_MODE_CHANGE_SIZE 7
1549
1550 #define EVT_FLOW_SPEC_COMPLETE          0x21
1551 typedef struct {
1552     uint8_t     status;
1553     uint16_t    handle;
1554     uint8_t     flags;
1555     uint8_t     direction;
1556     hci_qos     qos;
1557 } QEMU_PACKED evt_flow_spec_complete;
1558 #define EVT_FLOW_SPEC_COMPLETE_SIZE (5 + HCI_QOS_CP_SIZE)
1559
1560 #define EVT_INQUIRY_RESULT_WITH_RSSI    0x22
1561 typedef struct {
1562     uint8_t     num_responses;
1563     bdaddr_t    bdaddr;
1564     uint8_t     pscan_rep_mode;
1565     uint8_t     pscan_period_mode;
1566     uint8_t     dev_class[3];
1567     uint16_t    clock_offset;
1568     int8_t      rssi;
1569 } QEMU_PACKED inquiry_info_with_rssi;
1570 #define INQUIRY_INFO_WITH_RSSI_SIZE 15
1571 typedef struct {
1572     uint8_t     num_responses;
1573     bdaddr_t    bdaddr;
1574     uint8_t     pscan_rep_mode;
1575     uint8_t     pscan_period_mode;
1576     uint8_t     pscan_mode;
1577     uint8_t     dev_class[3];
1578     uint16_t    clock_offset;
1579     int8_t      rssi;
1580 } QEMU_PACKED inquiry_info_with_rssi_and_pscan_mode;
1581 #define INQUIRY_INFO_WITH_RSSI_AND_PSCAN_MODE_SIZE 16
1582
1583 #define EVT_READ_REMOTE_EXT_FEATURES_COMPLETE   0x23
1584 typedef struct {
1585     uint8_t     status;
1586     uint16_t    handle;
1587     uint8_t     page_num;
1588     uint8_t     max_page_num;
1589     uint8_t     features[8];
1590 } QEMU_PACKED evt_read_remote_ext_features_complete;
1591 #define EVT_READ_REMOTE_EXT_FEATURES_COMPLETE_SIZE 13
1592
1593 #define EVT_SYNC_CONN_COMPLETE          0x2C
1594 typedef struct {
1595     uint8_t     status;
1596     uint16_t    handle;
1597     bdaddr_t    bdaddr;
1598     uint8_t     link_type;
1599     uint8_t     trans_interval;
1600     uint8_t     retrans_window;
1601     uint16_t    rx_pkt_len;
1602     uint16_t    tx_pkt_len;
1603     uint8_t     air_mode;
1604 } QEMU_PACKED evt_sync_conn_complete;
1605 #define EVT_SYNC_CONN_COMPLETE_SIZE 17
1606
1607 #define EVT_SYNC_CONN_CHANGED           0x2D
1608 typedef struct {
1609     uint8_t     status;
1610     uint16_t    handle;
1611     uint8_t     trans_interval;
1612     uint8_t     retrans_window;
1613     uint16_t    rx_pkt_len;
1614     uint16_t    tx_pkt_len;
1615 } QEMU_PACKED evt_sync_conn_changed;
1616 #define EVT_SYNC_CONN_CHANGED_SIZE 9
1617
1618 #define EVT_SNIFF_SUBRATE               0x2E
1619 typedef struct {
1620     uint8_t     status;
1621     uint16_t    handle;
1622     uint16_t    max_remote_latency;
1623     uint16_t    max_local_latency;
1624     uint16_t    min_remote_timeout;
1625     uint16_t    min_local_timeout;
1626 } QEMU_PACKED evt_sniff_subrate;
1627 #define EVT_SNIFF_SUBRATE_SIZE 11
1628
1629 #define EVT_TESTING                     0xFE
1630
1631 #define EVT_VENDOR                      0xFF
1632
1633 /* Command opcode pack/unpack */
1634 #define cmd_opcode_pack(ogf, ocf)       (uint16_t)((ocf & 0x03ff)|(ogf << 10))
1635 #define cmd_opcode_ogf(op)              (op >> 10)
1636 #define cmd_opcode_ocf(op)              (op & 0x03ff)
1637
1638 /* ACL handle and flags pack/unpack */
1639 #define acl_handle_pack(h, f)   (uint16_t)(((h) & 0x0fff)|((f) << 12))
1640 #define acl_handle(h)           ((h) & 0x0fff)
1641 #define acl_flags(h)            ((h) >> 12)
1642
1643 /* HCI Packet structures */
1644 #define HCI_COMMAND_HDR_SIZE    3
1645 #define HCI_EVENT_HDR_SIZE      2
1646 #define HCI_ACL_HDR_SIZE        4
1647 #define HCI_SCO_HDR_SIZE        3
1648
1649 struct hci_command_hdr {
1650     uint16_t    opcode;         /* OCF & OGF */
1651     uint8_t     plen;
1652 } QEMU_PACKED;
1653
1654 struct hci_event_hdr {
1655     uint8_t     evt;
1656     uint8_t     plen;
1657 } QEMU_PACKED;
1658
1659 struct hci_acl_hdr {
1660     uint16_t    handle;         /* Handle & Flags(PB, BC) */
1661     uint16_t    dlen;
1662 } QEMU_PACKED;
1663
1664 struct hci_sco_hdr {
1665     uint16_t    handle;
1666     uint8_t     dlen;
1667 } QEMU_PACKED;
1668
1669 /* L2CAP layer defines */
1670
1671 enum bt_l2cap_lm_bits {
1672     L2CAP_LM_MASTER     = 1 << 0,
1673     L2CAP_LM_AUTH       = 1 << 1,
1674     L2CAP_LM_ENCRYPT    = 1 << 2,
1675     L2CAP_LM_TRUSTED    = 1 << 3,
1676     L2CAP_LM_RELIABLE   = 1 << 4,
1677     L2CAP_LM_SECURE     = 1 << 5,
1678 };
1679
1680 enum bt_l2cap_cid_predef {
1681     L2CAP_CID_INVALID   = 0x0000,
1682     L2CAP_CID_SIGNALLING= 0x0001,
1683     L2CAP_CID_GROUP     = 0x0002,
1684     L2CAP_CID_ALLOC     = 0x0040,
1685 };
1686
1687 /* L2CAP command codes */
1688 enum bt_l2cap_cmd {
1689     L2CAP_COMMAND_REJ   = 1,
1690     L2CAP_CONN_REQ,
1691     L2CAP_CONN_RSP,
1692     L2CAP_CONF_REQ,
1693     L2CAP_CONF_RSP,
1694     L2CAP_DISCONN_REQ,
1695     L2CAP_DISCONN_RSP,
1696     L2CAP_ECHO_REQ,
1697     L2CAP_ECHO_RSP,
1698     L2CAP_INFO_REQ,
1699     L2CAP_INFO_RSP,
1700 };
1701
1702 enum bt_l2cap_sar_bits {
1703     L2CAP_SAR_NO_SEG    = 0,
1704     L2CAP_SAR_START,
1705     L2CAP_SAR_END,
1706     L2CAP_SAR_CONT,
1707 };
1708
1709 /* L2CAP structures */
1710 typedef struct {
1711     uint16_t    len;
1712     uint16_t    cid;
1713     uint8_t     data[0];
1714 } QEMU_PACKED l2cap_hdr;
1715 #define L2CAP_HDR_SIZE 4
1716
1717 typedef struct {
1718     uint8_t     code;
1719     uint8_t     ident;
1720     uint16_t    len;
1721 } QEMU_PACKED l2cap_cmd_hdr;
1722 #define L2CAP_CMD_HDR_SIZE 4
1723
1724 typedef struct {
1725     uint16_t    reason;
1726 } QEMU_PACKED l2cap_cmd_rej;
1727 #define L2CAP_CMD_REJ_SIZE 2
1728
1729 typedef struct {
1730     uint16_t    dcid;
1731     uint16_t    scid;
1732 } QEMU_PACKED l2cap_cmd_rej_cid;
1733 #define L2CAP_CMD_REJ_CID_SIZE 4
1734
1735 /* reject reason */
1736 enum bt_l2cap_rej_reason {
1737     L2CAP_REJ_CMD_NOT_UNDERSTOOD = 0,
1738     L2CAP_REJ_SIG_TOOBIG,
1739     L2CAP_REJ_CID_INVAL,
1740 };
1741
1742 typedef struct {
1743     uint16_t    psm;
1744     uint16_t    scid;
1745 } QEMU_PACKED l2cap_conn_req;
1746 #define L2CAP_CONN_REQ_SIZE 4
1747
1748 typedef struct {
1749     uint16_t    dcid;
1750     uint16_t    scid;
1751     uint16_t    result;
1752     uint16_t    status;
1753 } QEMU_PACKED l2cap_conn_rsp;
1754 #define L2CAP_CONN_RSP_SIZE 8
1755
1756 /* connect result */
1757 enum bt_l2cap_conn_res {
1758     L2CAP_CR_SUCCESS    = 0,
1759     L2CAP_CR_PEND,
1760     L2CAP_CR_BAD_PSM,
1761     L2CAP_CR_SEC_BLOCK,
1762     L2CAP_CR_NO_MEM,
1763 };
1764
1765 /* connect status */
1766 enum bt_l2cap_conn_stat {
1767     L2CAP_CS_NO_INFO    = 0,
1768     L2CAP_CS_AUTHEN_PEND,
1769     L2CAP_CS_AUTHOR_PEND,
1770 };
1771
1772 typedef struct {
1773     uint16_t    dcid;
1774     uint16_t    flags;
1775     uint8_t     data[0];
1776 } QEMU_PACKED l2cap_conf_req;
1777 #define L2CAP_CONF_REQ_SIZE(datalen) (4 + (datalen))
1778
1779 typedef struct {
1780     uint16_t    scid;
1781     uint16_t    flags;
1782     uint16_t    result;
1783     uint8_t     data[0];
1784 } QEMU_PACKED l2cap_conf_rsp;
1785 #define L2CAP_CONF_RSP_SIZE(datalen) (6 + datalen)
1786
1787 enum bt_l2cap_conf_res {
1788     L2CAP_CONF_SUCCESS  = 0,
1789     L2CAP_CONF_UNACCEPT,
1790     L2CAP_CONF_REJECT,
1791     L2CAP_CONF_UNKNOWN,
1792 };
1793
1794 typedef struct {
1795     uint8_t     type;
1796     uint8_t     len;
1797     uint8_t     val[0];
1798 } QEMU_PACKED l2cap_conf_opt;
1799 #define L2CAP_CONF_OPT_SIZE 2
1800
1801 enum bt_l2cap_conf_val {
1802     L2CAP_CONF_MTU      = 1,
1803     L2CAP_CONF_FLUSH_TO,
1804     L2CAP_CONF_QOS,
1805     L2CAP_CONF_RFC,
1806     L2CAP_CONF_RFC_MODE = L2CAP_CONF_RFC,
1807 };
1808
1809 typedef struct {
1810     uint8_t     flags;
1811     uint8_t     service_type;
1812     uint32_t    token_rate;
1813     uint32_t    token_bucket_size;
1814     uint32_t    peak_bandwidth;
1815     uint32_t    latency;
1816     uint32_t    delay_variation;
1817 } QEMU_PACKED l2cap_conf_opt_qos;
1818 #define L2CAP_CONF_OPT_QOS_SIZE 22
1819
1820 enum bt_l2cap_conf_opt_qos_st {
1821     L2CAP_CONF_QOS_NO_TRAFFIC = 0x00,
1822     L2CAP_CONF_QOS_BEST_EFFORT,
1823     L2CAP_CONF_QOS_GUARANTEED,
1824 };
1825
1826 #define L2CAP_CONF_QOS_WILDCARD 0xffffffff
1827
1828 enum bt_l2cap_mode {
1829     L2CAP_MODE_BASIC    = 0,
1830     L2CAP_MODE_RETRANS  = 1,
1831     L2CAP_MODE_FLOWCTL  = 2,
1832 };
1833
1834 typedef struct {
1835     uint16_t    dcid;
1836     uint16_t    scid;
1837 } QEMU_PACKED l2cap_disconn_req;
1838 #define L2CAP_DISCONN_REQ_SIZE 4
1839
1840 typedef struct {
1841     uint16_t    dcid;
1842     uint16_t    scid;
1843 } QEMU_PACKED l2cap_disconn_rsp;
1844 #define L2CAP_DISCONN_RSP_SIZE 4
1845
1846 typedef struct {
1847     uint16_t    type;
1848 } QEMU_PACKED l2cap_info_req;
1849 #define L2CAP_INFO_REQ_SIZE 2
1850
1851 typedef struct {
1852     uint16_t    type;
1853     uint16_t    result;
1854     uint8_t     data[0];
1855 } QEMU_PACKED l2cap_info_rsp;
1856 #define L2CAP_INFO_RSP_SIZE 4
1857
1858 /* info type */
1859 enum bt_l2cap_info_type {
1860     L2CAP_IT_CL_MTU     = 1,
1861     L2CAP_IT_FEAT_MASK,
1862 };
1863
1864 /* info result */
1865 enum bt_l2cap_info_result {
1866     L2CAP_IR_SUCCESS    = 0,
1867     L2CAP_IR_NOTSUPP,
1868 };
1869
1870 /* Service Discovery Protocol defines */
1871 /* Note that all multibyte values in lower layer protocols (above in this file)
1872  * are little-endian while SDP is big-endian.  */
1873
1874 /* Protocol UUIDs */
1875 enum sdp_proto_uuid {
1876     SDP_UUID            = 0x0001,
1877     UDP_UUID            = 0x0002,
1878     RFCOMM_UUID         = 0x0003,
1879     TCP_UUID            = 0x0004,
1880     TCS_BIN_UUID        = 0x0005,
1881     TCS_AT_UUID         = 0x0006,
1882     OBEX_UUID           = 0x0008,
1883     IP_UUID             = 0x0009,
1884     FTP_UUID            = 0x000a,
1885     HTTP_UUID           = 0x000c,
1886     WSP_UUID            = 0x000e,
1887     BNEP_UUID           = 0x000f,
1888     UPNP_UUID           = 0x0010,
1889     HIDP_UUID           = 0x0011,
1890     HCRP_CTRL_UUID      = 0x0012,
1891     HCRP_DATA_UUID      = 0x0014,
1892     HCRP_NOTE_UUID      = 0x0016,
1893     AVCTP_UUID          = 0x0017,
1894     AVDTP_UUID          = 0x0019,
1895     CMTP_UUID           = 0x001b,
1896     UDI_UUID            = 0x001d,
1897     MCAP_CTRL_UUID      = 0x001e,
1898     MCAP_DATA_UUID      = 0x001f,
1899     L2CAP_UUID          = 0x0100,
1900 };
1901
1902 /*
1903  * Service class identifiers of standard services and service groups
1904  */
1905 enum service_class_id {
1906     SDP_SERVER_SVCLASS_ID               = 0x1000,
1907     BROWSE_GRP_DESC_SVCLASS_ID          = 0x1001,
1908     PUBLIC_BROWSE_GROUP                 = 0x1002,
1909     SERIAL_PORT_SVCLASS_ID              = 0x1101,
1910     LAN_ACCESS_SVCLASS_ID               = 0x1102,
1911     DIALUP_NET_SVCLASS_ID               = 0x1103,
1912     IRMC_SYNC_SVCLASS_ID                = 0x1104,
1913     OBEX_OBJPUSH_SVCLASS_ID             = 0x1105,
1914     OBEX_FILETRANS_SVCLASS_ID           = 0x1106,
1915     IRMC_SYNC_CMD_SVCLASS_ID            = 0x1107,
1916     HEADSET_SVCLASS_ID                  = 0x1108,
1917     CORDLESS_TELEPHONY_SVCLASS_ID       = 0x1109,
1918     AUDIO_SOURCE_SVCLASS_ID             = 0x110a,
1919     AUDIO_SINK_SVCLASS_ID               = 0x110b,
1920     AV_REMOTE_TARGET_SVCLASS_ID         = 0x110c,
1921     ADVANCED_AUDIO_SVCLASS_ID           = 0x110d,
1922     AV_REMOTE_SVCLASS_ID                = 0x110e,
1923     VIDEO_CONF_SVCLASS_ID               = 0x110f,
1924     INTERCOM_SVCLASS_ID                 = 0x1110,
1925     FAX_SVCLASS_ID                      = 0x1111,
1926     HEADSET_AGW_SVCLASS_ID              = 0x1112,
1927     WAP_SVCLASS_ID                      = 0x1113,
1928     WAP_CLIENT_SVCLASS_ID               = 0x1114,
1929     PANU_SVCLASS_ID                     = 0x1115,
1930     NAP_SVCLASS_ID                      = 0x1116,
1931     GN_SVCLASS_ID                       = 0x1117,
1932     DIRECT_PRINTING_SVCLASS_ID          = 0x1118,
1933     REFERENCE_PRINTING_SVCLASS_ID       = 0x1119,
1934     IMAGING_SVCLASS_ID                  = 0x111a,
1935     IMAGING_RESPONDER_SVCLASS_ID        = 0x111b,
1936     IMAGING_ARCHIVE_SVCLASS_ID          = 0x111c,
1937     IMAGING_REFOBJS_SVCLASS_ID          = 0x111d,
1938     HANDSFREE_SVCLASS_ID                = 0x111e,
1939     HANDSFREE_AGW_SVCLASS_ID            = 0x111f,
1940     DIRECT_PRT_REFOBJS_SVCLASS_ID       = 0x1120,
1941     REFLECTED_UI_SVCLASS_ID             = 0x1121,
1942     BASIC_PRINTING_SVCLASS_ID           = 0x1122,
1943     PRINTING_STATUS_SVCLASS_ID          = 0x1123,
1944     HID_SVCLASS_ID                      = 0x1124,
1945     HCR_SVCLASS_ID                      = 0x1125,
1946     HCR_PRINT_SVCLASS_ID                = 0x1126,
1947     HCR_SCAN_SVCLASS_ID                 = 0x1127,
1948     CIP_SVCLASS_ID                      = 0x1128,
1949     VIDEO_CONF_GW_SVCLASS_ID            = 0x1129,
1950     UDI_MT_SVCLASS_ID                   = 0x112a,
1951     UDI_TA_SVCLASS_ID                   = 0x112b,
1952     AV_SVCLASS_ID                       = 0x112c,
1953     SAP_SVCLASS_ID                      = 0x112d,
1954     PBAP_PCE_SVCLASS_ID                 = 0x112e,
1955     PBAP_PSE_SVCLASS_ID                 = 0x112f,
1956     PBAP_SVCLASS_ID                     = 0x1130,
1957     PNP_INFO_SVCLASS_ID                 = 0x1200,
1958     GENERIC_NETWORKING_SVCLASS_ID       = 0x1201,
1959     GENERIC_FILETRANS_SVCLASS_ID        = 0x1202,
1960     GENERIC_AUDIO_SVCLASS_ID            = 0x1203,
1961     GENERIC_TELEPHONY_SVCLASS_ID        = 0x1204,
1962     UPNP_SVCLASS_ID                     = 0x1205,
1963     UPNP_IP_SVCLASS_ID                  = 0x1206,
1964     UPNP_PAN_SVCLASS_ID                 = 0x1300,
1965     UPNP_LAP_SVCLASS_ID                 = 0x1301,
1966     UPNP_L2CAP_SVCLASS_ID               = 0x1302,
1967     VIDEO_SOURCE_SVCLASS_ID             = 0x1303,
1968     VIDEO_SINK_SVCLASS_ID               = 0x1304,
1969     VIDEO_DISTRIBUTION_SVCLASS_ID       = 0x1305,
1970     MDP_SVCLASS_ID                      = 0x1400,
1971     MDP_SOURCE_SVCLASS_ID               = 0x1401,
1972     MDP_SINK_SVCLASS_ID                 = 0x1402,
1973     APPLE_AGENT_SVCLASS_ID              = 0x2112,
1974 };
1975
1976 /*
1977  * Standard profile descriptor identifiers; note these
1978  * may be identical to some of the service classes defined above
1979  */
1980 #define SDP_SERVER_PROFILE_ID           SDP_SERVER_SVCLASS_ID
1981 #define BROWSE_GRP_DESC_PROFILE_ID      BROWSE_GRP_DESC_SVCLASS_ID
1982 #define SERIAL_PORT_PROFILE_ID          SERIAL_PORT_SVCLASS_ID
1983 #define LAN_ACCESS_PROFILE_ID           LAN_ACCESS_SVCLASS_ID
1984 #define DIALUP_NET_PROFILE_ID           DIALUP_NET_SVCLASS_ID
1985 #define IRMC_SYNC_PROFILE_ID            IRMC_SYNC_SVCLASS_ID
1986 #define OBEX_OBJPUSH_PROFILE_ID         OBEX_OBJPUSH_SVCLASS_ID
1987 #define OBEX_FILETRANS_PROFILE_ID       OBEX_FILETRANS_SVCLASS_ID
1988 #define IRMC_SYNC_CMD_PROFILE_ID        IRMC_SYNC_CMD_SVCLASS_ID
1989 #define HEADSET_PROFILE_ID              HEADSET_SVCLASS_ID
1990 #define CORDLESS_TELEPHONY_PROFILE_ID   CORDLESS_TELEPHONY_SVCLASS_ID
1991 #define AUDIO_SOURCE_PROFILE_ID         AUDIO_SOURCE_SVCLASS_ID
1992 #define AUDIO_SINK_PROFILE_ID           AUDIO_SINK_SVCLASS_ID
1993 #define AV_REMOTE_TARGET_PROFILE_ID     AV_REMOTE_TARGET_SVCLASS_ID
1994 #define ADVANCED_AUDIO_PROFILE_ID       ADVANCED_AUDIO_SVCLASS_ID
1995 #define AV_REMOTE_PROFILE_ID            AV_REMOTE_SVCLASS_ID
1996 #define VIDEO_CONF_PROFILE_ID           VIDEO_CONF_SVCLASS_ID
1997 #define INTERCOM_PROFILE_ID             INTERCOM_SVCLASS_ID
1998 #define FAX_PROFILE_ID                  FAX_SVCLASS_ID
1999 #define HEADSET_AGW_PROFILE_ID          HEADSET_AGW_SVCLASS_ID
2000 #define WAP_PROFILE_ID                  WAP_SVCLASS_ID
2001 #define WAP_CLIENT_PROFILE_ID           WAP_CLIENT_SVCLASS_ID
2002 #define PANU_PROFILE_ID                 PANU_SVCLASS_ID
2003 #define NAP_PROFILE_ID                  NAP_SVCLASS_ID
2004 #define GN_PROFILE_ID                   GN_SVCLASS_ID
2005 #define DIRECT_PRINTING_PROFILE_ID      DIRECT_PRINTING_SVCLASS_ID
2006 #define REFERENCE_PRINTING_PROFILE_ID   REFERENCE_PRINTING_SVCLASS_ID
2007 #define IMAGING_PROFILE_ID              IMAGING_SVCLASS_ID
2008 #define IMAGING_RESPONDER_PROFILE_ID    IMAGING_RESPONDER_SVCLASS_ID
2009 #define IMAGING_ARCHIVE_PROFILE_ID      IMAGING_ARCHIVE_SVCLASS_ID
2010 #define IMAGING_REFOBJS_PROFILE_ID      IMAGING_REFOBJS_SVCLASS_ID
2011 #define HANDSFREE_PROFILE_ID            HANDSFREE_SVCLASS_ID
2012 #define HANDSFREE_AGW_PROFILE_ID        HANDSFREE_AGW_SVCLASS_ID
2013 #define DIRECT_PRT_REFOBJS_PROFILE_ID   DIRECT_PRT_REFOBJS_SVCLASS_ID
2014 #define REFLECTED_UI_PROFILE_ID         REFLECTED_UI_SVCLASS_ID
2015 #define BASIC_PRINTING_PROFILE_ID       BASIC_PRINTING_SVCLASS_ID
2016 #define PRINTING_STATUS_PROFILE_ID      PRINTING_STATUS_SVCLASS_ID
2017 #define HID_PROFILE_ID                  HID_SVCLASS_ID
2018 #define HCR_PROFILE_ID                  HCR_SCAN_SVCLASS_ID
2019 #define HCR_PRINT_PROFILE_ID            HCR_PRINT_SVCLASS_ID
2020 #define HCR_SCAN_PROFILE_ID             HCR_SCAN_SVCLASS_ID
2021 #define CIP_PROFILE_ID                  CIP_SVCLASS_ID
2022 #define VIDEO_CONF_GW_PROFILE_ID        VIDEO_CONF_GW_SVCLASS_ID
2023 #define UDI_MT_PROFILE_ID               UDI_MT_SVCLASS_ID
2024 #define UDI_TA_PROFILE_ID               UDI_TA_SVCLASS_ID
2025 #define AV_PROFILE_ID                   AV_SVCLASS_ID
2026 #define SAP_PROFILE_ID                  SAP_SVCLASS_ID
2027 #define PBAP_PCE_PROFILE_ID             PBAP_PCE_SVCLASS_ID
2028 #define PBAP_PSE_PROFILE_ID             PBAP_PSE_SVCLASS_ID
2029 #define PBAP_PROFILE_ID                 PBAP_SVCLASS_ID
2030 #define PNP_INFO_PROFILE_ID             PNP_INFO_SVCLASS_ID
2031 #define GENERIC_NETWORKING_PROFILE_ID   GENERIC_NETWORKING_SVCLASS_ID
2032 #define GENERIC_FILETRANS_PROFILE_ID    GENERIC_FILETRANS_SVCLASS_ID
2033 #define GENERIC_AUDIO_PROFILE_ID        GENERIC_AUDIO_SVCLASS_ID
2034 #define GENERIC_TELEPHONY_PROFILE_ID    GENERIC_TELEPHONY_SVCLASS_ID
2035 #define UPNP_PROFILE_ID                 UPNP_SVCLASS_ID
2036 #define UPNP_IP_PROFILE_ID              UPNP_IP_SVCLASS_ID
2037 #define UPNP_PAN_PROFILE_ID             UPNP_PAN_SVCLASS_ID
2038 #define UPNP_LAP_PROFILE_ID             UPNP_LAP_SVCLASS_ID
2039 #define UPNP_L2CAP_PROFILE_ID           UPNP_L2CAP_SVCLASS_ID
2040 #define VIDEO_SOURCE_PROFILE_ID         VIDEO_SOURCE_SVCLASS_ID
2041 #define VIDEO_SINK_PROFILE_ID           VIDEO_SINK_SVCLASS_ID
2042 #define VIDEO_DISTRIBUTION_PROFILE_ID   VIDEO_DISTRIBUTION_SVCLASS_ID
2043 #define MDP_PROFILE_ID                  MDP_SVCLASS_ID
2044 #define MDP_SOURCE_PROFILE_ID           MDP_SROUCE_SVCLASS_ID
2045 #define MDP_SINK_PROFILE_ID             MDP_SINK_SVCLASS_ID
2046 #define APPLE_AGENT_PROFILE_ID          APPLE_AGENT_SVCLASS_ID
2047
2048 /* Data Representation */
2049 enum bt_sdp_data_type {
2050     SDP_DTYPE_NIL       = 0 << 3,
2051     SDP_DTYPE_UINT      = 1 << 3,
2052     SDP_DTYPE_SINT      = 2 << 3,
2053     SDP_DTYPE_UUID      = 3 << 3,
2054     SDP_DTYPE_STRING    = 4 << 3,
2055     SDP_DTYPE_BOOL      = 5 << 3,
2056     SDP_DTYPE_SEQ       = 6 << 3,
2057     SDP_DTYPE_ALT       = 7 << 3,
2058     SDP_DTYPE_URL       = 8 << 3,
2059 };
2060
2061 enum bt_sdp_data_size {
2062     SDP_DSIZE_1         = 0,
2063     SDP_DSIZE_2,
2064     SDP_DSIZE_4,
2065     SDP_DSIZE_8,
2066     SDP_DSIZE_16,
2067     SDP_DSIZE_NEXT1,
2068     SDP_DSIZE_NEXT2,
2069     SDP_DSIZE_NEXT4,
2070     SDP_DSIZE_MASK = SDP_DSIZE_NEXT4,
2071 };
2072
2073 enum bt_sdp_cmd {
2074     SDP_ERROR_RSP               = 0x01,
2075     SDP_SVC_SEARCH_REQ          = 0x02,
2076     SDP_SVC_SEARCH_RSP          = 0x03,
2077     SDP_SVC_ATTR_REQ            = 0x04,
2078     SDP_SVC_ATTR_RSP            = 0x05,
2079     SDP_SVC_SEARCH_ATTR_REQ     = 0x06,
2080     SDP_SVC_SEARCH_ATTR_RSP     = 0x07,
2081 };
2082
2083 enum bt_sdp_errorcode {
2084     SDP_INVALID_VERSION         = 0x0001,
2085     SDP_INVALID_RECORD_HANDLE   = 0x0002,
2086     SDP_INVALID_SYNTAX          = 0x0003,
2087     SDP_INVALID_PDU_SIZE        = 0x0004,
2088     SDP_INVALID_CSTATE          = 0x0005,
2089 };
2090
2091 /*
2092  * String identifiers are based on the SDP spec stating that
2093  * "base attribute id of the primary (universal) language must be 0x0100"
2094  *
2095  * Other languages should have their own offset; e.g.:
2096  * #define XXXLangBase yyyy
2097  * #define AttrServiceName_XXX  0x0000+XXXLangBase
2098  */
2099 #define SDP_PRIMARY_LANG_BASE           0x0100
2100
2101 enum bt_sdp_attribute_id {
2102     SDP_ATTR_RECORD_HANDLE                      = 0x0000,
2103     SDP_ATTR_SVCLASS_ID_LIST                    = 0x0001,
2104     SDP_ATTR_RECORD_STATE                       = 0x0002,
2105     SDP_ATTR_SERVICE_ID                         = 0x0003,
2106     SDP_ATTR_PROTO_DESC_LIST                    = 0x0004,
2107     SDP_ATTR_BROWSE_GRP_LIST                    = 0x0005,
2108     SDP_ATTR_LANG_BASE_ATTR_ID_LIST             = 0x0006,
2109     SDP_ATTR_SVCINFO_TTL                        = 0x0007,
2110     SDP_ATTR_SERVICE_AVAILABILITY               = 0x0008,
2111     SDP_ATTR_PFILE_DESC_LIST                    = 0x0009,
2112     SDP_ATTR_DOC_URL                            = 0x000a,
2113     SDP_ATTR_CLNT_EXEC_URL                      = 0x000b,
2114     SDP_ATTR_ICON_URL                           = 0x000c,
2115     SDP_ATTR_ADD_PROTO_DESC_LIST                = 0x000d,
2116
2117     SDP_ATTR_SVCNAME_PRIMARY                    = SDP_PRIMARY_LANG_BASE + 0,
2118     SDP_ATTR_SVCDESC_PRIMARY                    = SDP_PRIMARY_LANG_BASE + 1,
2119     SDP_ATTR_SVCPROV_PRIMARY                    = SDP_PRIMARY_LANG_BASE + 2,
2120
2121     SDP_ATTR_GROUP_ID                           = 0x0200,
2122     SDP_ATTR_IP_SUBNET                          = 0x0200,
2123
2124     /* SDP */
2125     SDP_ATTR_VERSION_NUM_LIST                   = 0x0200,
2126     SDP_ATTR_SVCDB_STATE                        = 0x0201,
2127
2128     SDP_ATTR_SERVICE_VERSION                    = 0x0300,
2129     SDP_ATTR_EXTERNAL_NETWORK                   = 0x0301,
2130     SDP_ATTR_SUPPORTED_DATA_STORES_LIST         = 0x0301,
2131     SDP_ATTR_FAX_CLASS1_SUPPORT                 = 0x0302,
2132     SDP_ATTR_REMOTE_AUDIO_VOLUME_CONTROL        = 0x0302,
2133     SDP_ATTR_FAX_CLASS20_SUPPORT                = 0x0303,
2134     SDP_ATTR_SUPPORTED_FORMATS_LIST             = 0x0303,
2135     SDP_ATTR_FAX_CLASS2_SUPPORT                 = 0x0304,
2136     SDP_ATTR_AUDIO_FEEDBACK_SUPPORT             = 0x0305,
2137     SDP_ATTR_NETWORK_ADDRESS                    = 0x0306,
2138     SDP_ATTR_WAP_GATEWAY                        = 0x0307,
2139     SDP_ATTR_HOMEPAGE_URL                       = 0x0308,
2140     SDP_ATTR_WAP_STACK_TYPE                     = 0x0309,
2141     SDP_ATTR_SECURITY_DESC                      = 0x030a,
2142     SDP_ATTR_NET_ACCESS_TYPE                    = 0x030b,
2143     SDP_ATTR_MAX_NET_ACCESSRATE                 = 0x030c,
2144     SDP_ATTR_IP4_SUBNET                         = 0x030d,
2145     SDP_ATTR_IP6_SUBNET                         = 0x030e,
2146     SDP_ATTR_SUPPORTED_CAPABILITIES             = 0x0310,
2147     SDP_ATTR_SUPPORTED_FEATURES                 = 0x0311,
2148     SDP_ATTR_SUPPORTED_FUNCTIONS                = 0x0312,
2149     SDP_ATTR_TOTAL_IMAGING_DATA_CAPACITY        = 0x0313,
2150     SDP_ATTR_SUPPORTED_REPOSITORIES             = 0x0314,
2151
2152     /* PnP Information */
2153     SDP_ATTR_SPECIFICATION_ID                   = 0x0200,
2154     SDP_ATTR_VENDOR_ID                          = 0x0201,
2155     SDP_ATTR_PRODUCT_ID                         = 0x0202,
2156     SDP_ATTR_VERSION                            = 0x0203,
2157     SDP_ATTR_PRIMARY_RECORD                     = 0x0204,
2158     SDP_ATTR_VENDOR_ID_SOURCE                   = 0x0205,
2159
2160     /* BT HID */
2161     SDP_ATTR_DEVICE_RELEASE_NUMBER              = 0x0200,
2162     SDP_ATTR_PARSER_VERSION                     = 0x0201,
2163     SDP_ATTR_DEVICE_SUBCLASS                    = 0x0202,
2164     SDP_ATTR_COUNTRY_CODE                       = 0x0203,
2165     SDP_ATTR_VIRTUAL_CABLE                      = 0x0204,
2166     SDP_ATTR_RECONNECT_INITIATE                 = 0x0205,
2167     SDP_ATTR_DESCRIPTOR_LIST                    = 0x0206,
2168     SDP_ATTR_LANG_ID_BASE_LIST                  = 0x0207,
2169     SDP_ATTR_SDP_DISABLE                        = 0x0208,
2170     SDP_ATTR_BATTERY_POWER                      = 0x0209,
2171     SDP_ATTR_REMOTE_WAKEUP                      = 0x020a,
2172     SDP_ATTR_PROFILE_VERSION                    = 0x020b,
2173     SDP_ATTR_SUPERVISION_TIMEOUT                = 0x020c,
2174     SDP_ATTR_NORMALLY_CONNECTABLE               = 0x020d,
2175     SDP_ATTR_BOOT_DEVICE                        = 0x020e,
2176 };
2177
2178 #endif