tcg-i386: fix a typo
[qemu/aliguori-queue.git] / hw / bt-hci.c
blobf1ee92cfd4186cedc18bf364a914fd33cbe0f316
1 /*
2 * QEMU Bluetooth HCI logic.
4 * Copyright (C) 2007 OpenMoko, Inc.
5 * Copyright (C) 2008 Andrzej Zaborowski <balrog@zabor.org>
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 of
10 * the License, or (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "qemu-common.h"
22 #include "qemu-timer.h"
23 #include "usb.h"
24 #include "net.h"
25 #include "bt.h"
27 struct bt_hci_s {
28 uint8_t *(*evt_packet)(void *opaque);
29 void (*evt_submit)(void *opaque, int len);
30 void *opaque;
31 uint8_t evt_buf[256];
33 uint8_t acl_buf[4096];
34 int acl_len;
36 uint16_t asb_handle;
37 uint16_t psb_handle;
39 int last_cmd; /* Note: Always little-endian */
41 struct bt_device_s *conn_req_host;
43 struct {
44 int inquire;
45 int periodic;
46 int responses_left;
47 int responses;
48 QEMUTimer *inquiry_done;
49 QEMUTimer *inquiry_next;
50 int inquiry_length;
51 int inquiry_period;
52 int inquiry_mode;
54 #define HCI_HANDLE_OFFSET 0x20
55 #define HCI_HANDLES_MAX 0x10
56 struct bt_hci_master_link_s {
57 struct bt_link_s *link;
58 void (*lmp_acl_data)(struct bt_link_s *link,
59 const uint8_t *data, int start, int len);
60 QEMUTimer *acl_mode_timer;
61 } handle[HCI_HANDLES_MAX];
62 uint32_t role_bmp;
63 int last_handle;
64 int connecting;
65 bdaddr_t awaiting_bdaddr[HCI_HANDLES_MAX];
66 } lm;
68 uint8_t event_mask[8];
69 uint16_t voice_setting; /* Notw: Always little-endian */
70 uint16_t conn_accept_tout;
71 QEMUTimer *conn_accept_timer;
73 struct HCIInfo info;
74 struct bt_device_s device;
77 #define DEFAULT_RSSI_DBM 20
79 #define hci_from_info(ptr) container_of((ptr), struct bt_hci_s, info)
80 #define hci_from_device(ptr) container_of((ptr), struct bt_hci_s, device)
82 struct bt_hci_link_s {
83 struct bt_link_s btlink;
84 uint16_t handle; /* Local */
87 /* LMP layer emulation */
88 #if 0
89 static void bt_submit_lmp(struct bt_device_s *bt, int length, uint8_t *data)
91 int resp, resplen, error, op, tr;
92 uint8_t respdata[17];
94 if (length < 1)
95 return;
97 tr = *data & 1;
98 op = *(data ++) >> 1;
99 resp = LMP_ACCEPTED;
100 resplen = 2;
101 respdata[1] = op;
102 error = 0;
103 length --;
105 if (op >= 0x7c) { /* Extended opcode */
106 op |= *(data ++) << 8;
107 resp = LMP_ACCEPTED_EXT;
108 resplen = 4;
109 respdata[0] = op >> 8;
110 respdata[1] = op & 0xff;
111 length --;
114 switch (op) {
115 case LMP_ACCEPTED:
116 /* data[0] Op code
118 if (length < 1) {
119 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
120 goto not_accepted;
122 resp = 0;
123 break;
125 case LMP_ACCEPTED_EXT:
126 /* data[0] Escape op code
127 * data[1] Extended op code
129 if (length < 2) {
130 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
131 goto not_accepted;
133 resp = 0;
134 break;
136 case LMP_NOT_ACCEPTED:
137 /* data[0] Op code
138 * data[1] Error code
140 if (length < 2) {
141 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
142 goto not_accepted;
144 resp = 0;
145 break;
147 case LMP_NOT_ACCEPTED_EXT:
148 /* data[0] Op code
149 * data[1] Extended op code
150 * data[2] Error code
152 if (length < 3) {
153 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
154 goto not_accepted;
156 resp = 0;
157 break;
159 case LMP_HOST_CONNECTION_REQ:
160 break;
162 case LMP_SETUP_COMPLETE:
163 resp = LMP_SETUP_COMPLETE;
164 resplen = 1;
165 bt->setup = 1;
166 break;
168 case LMP_DETACH:
169 /* data[0] Error code
171 if (length < 1) {
172 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
173 goto not_accepted;
175 bt->setup = 0;
176 resp = 0;
177 break;
179 case LMP_SUPERVISION_TIMEOUT:
180 /* data[0,1] Supervision timeout
182 if (length < 2) {
183 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
184 goto not_accepted;
186 resp = 0;
187 break;
189 case LMP_QUALITY_OF_SERVICE:
190 resp = 0;
191 /* Fall through */
192 case LMP_QOS_REQ:
193 /* data[0,1] Poll interval
194 * data[2] N(BC)
196 if (length < 3) {
197 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
198 goto not_accepted;
200 break;
202 case LMP_MAX_SLOT:
203 resp = 0;
204 /* Fall through */
205 case LMP_MAX_SLOT_REQ:
206 /* data[0] Max slots
208 if (length < 1) {
209 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
210 goto not_accepted;
212 break;
214 case LMP_AU_RAND:
215 case LMP_IN_RAND:
216 case LMP_COMB_KEY:
217 /* data[0-15] Random number
219 if (length < 16) {
220 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
221 goto not_accepted;
223 if (op == LMP_AU_RAND) {
224 if (bt->key_present) {
225 resp = LMP_SRES;
226 resplen = 5;
227 /* XXX: [Part H] Section 6.1 on page 801 */
228 } else {
229 error = HCI_PIN_OR_KEY_MISSING;
230 goto not_accepted;
232 } else if (op == LMP_IN_RAND) {
233 error = HCI_PAIRING_NOT_ALLOWED;
234 goto not_accepted;
235 } else {
236 /* XXX: [Part H] Section 3.2 on page 779 */
237 resp = LMP_UNIT_KEY;
238 resplen = 17;
239 memcpy(respdata + 1, bt->key, 16);
241 error = HCI_UNIT_LINK_KEY_USED;
242 goto not_accepted;
244 break;
246 case LMP_UNIT_KEY:
247 /* data[0-15] Key
249 if (length < 16) {
250 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
251 goto not_accepted;
253 memcpy(bt->key, data, 16);
254 bt->key_present = 1;
255 break;
257 case LMP_SRES:
258 /* data[0-3] Authentication response
260 if (length < 4) {
261 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
262 goto not_accepted;
264 break;
266 case LMP_CLKOFFSET_REQ:
267 resp = LMP_CLKOFFSET_RES;
268 resplen = 3;
269 respdata[1] = 0x33;
270 respdata[2] = 0x33;
271 break;
273 case LMP_CLKOFFSET_RES:
274 /* data[0,1] Clock offset
275 * (Slave to master only)
277 if (length < 2) {
278 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
279 goto not_accepted;
281 break;
283 case LMP_VERSION_REQ:
284 case LMP_VERSION_RES:
285 /* data[0] VersNr
286 * data[1,2] CompId
287 * data[3,4] SubVersNr
289 if (length < 5) {
290 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
291 goto not_accepted;
293 if (op == LMP_VERSION_REQ) {
294 resp = LMP_VERSION_RES;
295 resplen = 6;
296 respdata[1] = 0x20;
297 respdata[2] = 0xff;
298 respdata[3] = 0xff;
299 respdata[4] = 0xff;
300 respdata[5] = 0xff;
301 } else
302 resp = 0;
303 break;
305 case LMP_FEATURES_REQ:
306 case LMP_FEATURES_RES:
307 /* data[0-7] Features
309 if (length < 8) {
310 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
311 goto not_accepted;
313 if (op == LMP_FEATURES_REQ) {
314 resp = LMP_FEATURES_RES;
315 resplen = 9;
316 respdata[1] = (bt->lmp_caps >> 0) & 0xff;
317 respdata[2] = (bt->lmp_caps >> 8) & 0xff;
318 respdata[3] = (bt->lmp_caps >> 16) & 0xff;
319 respdata[4] = (bt->lmp_caps >> 24) & 0xff;
320 respdata[5] = (bt->lmp_caps >> 32) & 0xff;
321 respdata[6] = (bt->lmp_caps >> 40) & 0xff;
322 respdata[7] = (bt->lmp_caps >> 48) & 0xff;
323 respdata[8] = (bt->lmp_caps >> 56) & 0xff;
324 } else
325 resp = 0;
326 break;
328 case LMP_NAME_REQ:
329 /* data[0] Name offset
331 if (length < 1) {
332 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
333 goto not_accepted;
335 resp = LMP_NAME_RES;
336 resplen = 17;
337 respdata[1] = data[0];
338 respdata[2] = strlen(bt->lmp_name);
339 memset(respdata + 3, 0x00, 14);
340 if (respdata[2] > respdata[1])
341 memcpy(respdata + 3, bt->lmp_name + respdata[1],
342 respdata[2] - respdata[1]);
343 break;
345 case LMP_NAME_RES:
346 /* data[0] Name offset
347 * data[1] Name length
348 * data[2-15] Name fragment
350 if (length < 16) {
351 error = HCI_UNSUPPORTED_LMP_PARAMETER_VALUE;
352 goto not_accepted;
354 resp = 0;
355 break;
357 default:
358 error = HCI_UNKNOWN_LMP_PDU;
359 /* Fall through */
360 not_accepted:
361 if (op >> 8) {
362 resp = LMP_NOT_ACCEPTED_EXT;
363 resplen = 5;
364 respdata[0] = op >> 8;
365 respdata[1] = op & 0xff;
366 respdata[2] = error;
367 } else {
368 resp = LMP_NOT_ACCEPTED;
369 resplen = 3;
370 respdata[0] = op & 0xff;
371 respdata[1] = error;
375 if (resp == 0)
376 return;
378 if (resp >> 8) {
379 respdata[0] = resp >> 8;
380 respdata[1] = resp & 0xff;
381 } else
382 respdata[0] = resp & 0xff;
384 respdata[0] <<= 1;
385 respdata[0] |= tr;
388 static void bt_submit_raw_acl(struct bt_piconet_s *net, int length, uint8_t *data)
390 struct bt_device_s *slave;
391 if (length < 1)
392 return;
394 slave = 0;
395 #if 0
396 slave = net->slave;
397 #endif
399 switch (data[0] & 3) {
400 case LLID_ACLC:
401 bt_submit_lmp(slave, length - 1, data + 1);
402 break;
403 case LLID_ACLU_START:
404 #if 0
405 bt_sumbit_l2cap(slave, length - 1, data + 1, (data[0] >> 2) & 1);
406 breka;
407 #endif
408 default:
409 case LLID_ACLU_CONT:
410 break;
413 #endif
415 /* HCI layer emulation */
417 /* Note: we could ignore endiannes because unswapped handles will still
418 * be valid as connection identifiers for the guest - they don't have to
419 * be continuously allocated. We do it though, to preserve similar
420 * behaviour between hosts. Some things, like the BD_ADDR cannot be
421 * preserved though (for example if a real hci is used). */
422 #ifdef HOST_WORDS_BIGENDIAN
423 # define HNDL(raw) bswap16(raw)
424 #else
425 # define HNDL(raw) (raw)
426 #endif
428 static const uint8_t bt_event_reserved_mask[8] = {
429 0xff, 0x9f, 0xfb, 0xff, 0x07, 0x18, 0x00, 0x00,
432 static inline uint8_t *bt_hci_event_start(struct bt_hci_s *hci,
433 int evt, int len)
435 uint8_t *packet, mask;
436 int mask_byte;
438 if (len > 255) {
439 fprintf(stderr, "%s: HCI event params too long (%ib)\n",
440 __FUNCTION__, len);
441 exit(-1);
444 mask_byte = (evt - 1) >> 3;
445 mask = 1 << ((evt - 1) & 3);
446 if (mask & bt_event_reserved_mask[mask_byte] & ~hci->event_mask[mask_byte])
447 return NULL;
449 packet = hci->evt_packet(hci->opaque);
450 packet[0] = evt;
451 packet[1] = len;
453 return &packet[2];
456 static inline void bt_hci_event(struct bt_hci_s *hci, int evt,
457 void *params, int len)
459 uint8_t *packet = bt_hci_event_start(hci, evt, len);
461 if (!packet)
462 return;
464 if (len)
465 memcpy(packet, params, len);
467 hci->evt_submit(hci->opaque, len + 2);
470 static inline void bt_hci_event_status(struct bt_hci_s *hci, int status)
472 evt_cmd_status params = {
473 .status = status,
474 .ncmd = 1,
475 .opcode = hci->last_cmd,
478 bt_hci_event(hci, EVT_CMD_STATUS, &params, EVT_CMD_STATUS_SIZE);
481 static inline void bt_hci_event_complete(struct bt_hci_s *hci,
482 void *ret, int len)
484 uint8_t *packet = bt_hci_event_start(hci, EVT_CMD_COMPLETE,
485 len + EVT_CMD_COMPLETE_SIZE);
486 evt_cmd_complete *params = (evt_cmd_complete *) packet;
488 if (!packet)
489 return;
491 params->ncmd = 1;
492 params->opcode = hci->last_cmd;
493 if (len)
494 memcpy(&packet[EVT_CMD_COMPLETE_SIZE], ret, len);
496 hci->evt_submit(hci->opaque, len + EVT_CMD_COMPLETE_SIZE + 2);
499 static void bt_hci_inquiry_done(void *opaque)
501 struct bt_hci_s *hci = (struct bt_hci_s *) opaque;
502 uint8_t status = HCI_SUCCESS;
504 if (!hci->lm.periodic)
505 hci->lm.inquire = 0;
507 /* The specification is inconsistent about this one. Page 565 reads
508 * "The event parameters of Inquiry Complete event will have a summary
509 * of the result from the Inquiry process, which reports the number of
510 * nearby Bluetooth devices that responded [so hci->responses].", but
511 * Event Parameters (see page 729) has only Status. */
512 bt_hci_event(hci, EVT_INQUIRY_COMPLETE, &status, 1);
515 static void bt_hci_inquiry_result_standard(struct bt_hci_s *hci,
516 struct bt_device_s *slave)
518 inquiry_info params = {
519 .num_responses = 1,
520 .bdaddr = BAINIT(&slave->bd_addr),
521 .pscan_rep_mode = 0x00, /* R0 */
522 .pscan_period_mode = 0x00, /* P0 - deprecated */
523 .pscan_mode = 0x00, /* Standard scan - deprecated */
524 .dev_class[0] = slave->class[0],
525 .dev_class[1] = slave->class[1],
526 .dev_class[2] = slave->class[2],
527 /* TODO: return the clkoff *differenece* */
528 .clock_offset = slave->clkoff, /* Note: no swapping */
531 bt_hci_event(hci, EVT_INQUIRY_RESULT, &params, INQUIRY_INFO_SIZE);
534 static void bt_hci_inquiry_result_with_rssi(struct bt_hci_s *hci,
535 struct bt_device_s *slave)
537 inquiry_info_with_rssi params = {
538 .num_responses = 1,
539 .bdaddr = BAINIT(&slave->bd_addr),
540 .pscan_rep_mode = 0x00, /* R0 */
541 .pscan_period_mode = 0x00, /* P0 - deprecated */
542 .dev_class[0] = slave->class[0],
543 .dev_class[1] = slave->class[1],
544 .dev_class[2] = slave->class[2],
545 /* TODO: return the clkoff *differenece* */
546 .clock_offset = slave->clkoff, /* Note: no swapping */
547 .rssi = DEFAULT_RSSI_DBM,
550 bt_hci_event(hci, EVT_INQUIRY_RESULT_WITH_RSSI,
551 &params, INQUIRY_INFO_WITH_RSSI_SIZE);
554 static void bt_hci_inquiry_result(struct bt_hci_s *hci,
555 struct bt_device_s *slave)
557 if (!slave->inquiry_scan || !hci->lm.responses_left)
558 return;
560 hci->lm.responses_left --;
561 hci->lm.responses ++;
563 switch (hci->lm.inquiry_mode) {
564 case 0x00:
565 bt_hci_inquiry_result_standard(hci, slave);
566 return;
567 case 0x01:
568 bt_hci_inquiry_result_with_rssi(hci, slave);
569 return;
570 default:
571 fprintf(stderr, "%s: bad inquiry mode %02x\n", __FUNCTION__,
572 hci->lm.inquiry_mode);
573 exit(-1);
577 static void bt_hci_mod_timer_1280ms(QEMUTimer *timer, int period)
579 qemu_mod_timer(timer, qemu_get_clock(vm_clock) +
580 muldiv64(period << 7, get_ticks_per_sec(), 100));
583 static void bt_hci_inquiry_start(struct bt_hci_s *hci, int length)
585 struct bt_device_s *slave;
587 hci->lm.inquiry_length = length;
588 for (slave = hci->device.net->slave; slave; slave = slave->next)
589 /* Don't uncover ourselves. */
590 if (slave != &hci->device)
591 bt_hci_inquiry_result(hci, slave);
593 /* TODO: register for a callback on a new device's addition to the
594 * scatternet so that if it's added before inquiry_length expires,
595 * an Inquiry Result is generated immediately. Alternatively re-loop
596 * through the devices on the inquiry_length expiration and report
597 * devices not seen before. */
598 if (hci->lm.responses_left)
599 bt_hci_mod_timer_1280ms(hci->lm.inquiry_done, hci->lm.inquiry_length);
600 else
601 bt_hci_inquiry_done(hci);
603 if (hci->lm.periodic)
604 bt_hci_mod_timer_1280ms(hci->lm.inquiry_next, hci->lm.inquiry_period);
607 static void bt_hci_inquiry_next(void *opaque)
609 struct bt_hci_s *hci = (struct bt_hci_s *) opaque;
611 hci->lm.responses_left += hci->lm.responses;
612 hci->lm.responses = 0;
613 bt_hci_inquiry_start(hci, hci->lm.inquiry_length);
616 static inline int bt_hci_handle_bad(struct bt_hci_s *hci, uint16_t handle)
618 return !(handle & HCI_HANDLE_OFFSET) ||
619 handle >= (HCI_HANDLE_OFFSET | HCI_HANDLES_MAX) ||
620 !hci->lm.handle[handle & ~HCI_HANDLE_OFFSET].link;
623 static inline int bt_hci_role_master(struct bt_hci_s *hci, uint16_t handle)
625 return !!(hci->lm.role_bmp & (1 << (handle & ~HCI_HANDLE_OFFSET)));
628 static inline struct bt_device_s *bt_hci_remote_dev(struct bt_hci_s *hci,
629 uint16_t handle)
631 struct bt_link_s *link = hci->lm.handle[handle & ~HCI_HANDLE_OFFSET].link;
633 return bt_hci_role_master(hci, handle) ? link->slave : link->host;
636 static void bt_hci_mode_tick(void *opaque);
637 static void bt_hci_lmp_link_establish(struct bt_hci_s *hci,
638 struct bt_link_s *link, int master)
640 hci->lm.handle[hci->lm.last_handle].link = link;
642 if (master) {
643 /* We are the master side of an ACL link */
644 hci->lm.role_bmp |= 1 << hci->lm.last_handle;
646 hci->lm.handle[hci->lm.last_handle].lmp_acl_data =
647 link->slave->lmp_acl_data;
648 } else {
649 /* We are the slave side of an ACL link */
650 hci->lm.role_bmp &= ~(1 << hci->lm.last_handle);
652 hci->lm.handle[hci->lm.last_handle].lmp_acl_data =
653 link->host->lmp_acl_resp;
656 /* Mode */
657 if (master) {
658 link->acl_mode = acl_active;
659 hci->lm.handle[hci->lm.last_handle].acl_mode_timer =
660 qemu_new_timer(vm_clock, bt_hci_mode_tick, link);
664 static void bt_hci_lmp_link_teardown(struct bt_hci_s *hci, uint16_t handle)
666 handle &= ~HCI_HANDLE_OFFSET;
667 hci->lm.handle[handle].link = NULL;
669 if (bt_hci_role_master(hci, handle)) {
670 qemu_del_timer(hci->lm.handle[handle].acl_mode_timer);
671 qemu_free_timer(hci->lm.handle[handle].acl_mode_timer);
675 static int bt_hci_connect(struct bt_hci_s *hci, bdaddr_t *bdaddr)
677 struct bt_device_s *slave;
678 struct bt_link_s link;
680 for (slave = hci->device.net->slave; slave; slave = slave->next)
681 if (slave->page_scan && !bacmp(&slave->bd_addr, bdaddr))
682 break;
683 if (!slave || slave == &hci->device)
684 return -ENODEV;
686 bacpy(&hci->lm.awaiting_bdaddr[hci->lm.connecting ++], &slave->bd_addr);
688 link.slave = slave;
689 link.host = &hci->device;
690 link.slave->lmp_connection_request(&link); /* Always last */
692 return 0;
695 static void bt_hci_connection_reject(struct bt_hci_s *hci,
696 struct bt_device_s *host, uint8_t because)
698 struct bt_link_s link = {
699 .slave = &hci->device,
700 .host = host,
701 /* Rest uninitialised */
704 host->reject_reason = because;
705 host->lmp_connection_complete(&link);
708 static void bt_hci_connection_reject_event(struct bt_hci_s *hci,
709 bdaddr_t *bdaddr)
711 evt_conn_complete params;
713 params.status = HCI_NO_CONNECTION;
714 params.handle = 0;
715 bacpy(&params.bdaddr, bdaddr);
716 params.link_type = ACL_LINK;
717 params.encr_mode = 0x00; /* Encryption not required */
718 bt_hci_event(hci, EVT_CONN_COMPLETE, &params, EVT_CONN_COMPLETE_SIZE);
721 static void bt_hci_connection_accept(struct bt_hci_s *hci,
722 struct bt_device_s *host)
724 struct bt_hci_link_s *link = qemu_mallocz(sizeof(struct bt_hci_link_s));
725 evt_conn_complete params;
726 uint16_t handle;
727 uint8_t status = HCI_SUCCESS;
728 int tries = HCI_HANDLES_MAX;
730 /* Make a connection handle */
731 do {
732 while (hci->lm.handle[++ hci->lm.last_handle].link && -- tries)
733 hci->lm.last_handle &= HCI_HANDLES_MAX - 1;
734 handle = hci->lm.last_handle | HCI_HANDLE_OFFSET;
735 } while ((handle == hci->asb_handle || handle == hci->psb_handle) &&
736 tries);
738 if (!tries) {
739 qemu_free(link);
740 bt_hci_connection_reject(hci, host, HCI_REJECTED_LIMITED_RESOURCES);
741 status = HCI_NO_CONNECTION;
742 goto complete;
745 link->btlink.slave = &hci->device;
746 link->btlink.host = host;
747 link->handle = handle;
749 /* Link established */
750 bt_hci_lmp_link_establish(hci, &link->btlink, 0);
752 complete:
753 params.status = status;
754 params.handle = HNDL(handle);
755 bacpy(&params.bdaddr, &host->bd_addr);
756 params.link_type = ACL_LINK;
757 params.encr_mode = 0x00; /* Encryption not required */
758 bt_hci_event(hci, EVT_CONN_COMPLETE, &params, EVT_CONN_COMPLETE_SIZE);
760 /* Neets to be done at the very end because it can trigger a (nested)
761 * disconnected, in case the other and had cancelled the request
762 * locally. */
763 if (status == HCI_SUCCESS) {
764 host->reject_reason = 0;
765 host->lmp_connection_complete(&link->btlink);
769 static void bt_hci_lmp_connection_request(struct bt_link_s *link)
771 struct bt_hci_s *hci = hci_from_device(link->slave);
772 evt_conn_request params;
774 if (hci->conn_req_host) {
775 bt_hci_connection_reject(hci, link->host,
776 HCI_REJECTED_LIMITED_RESOURCES);
777 return;
779 hci->conn_req_host = link->host;
780 /* TODO: if masked and auto-accept, then auto-accept,
781 * if masked and not auto-accept, then auto-reject */
782 /* TODO: kick the hci->conn_accept_timer, timeout after
783 * hci->conn_accept_tout * 0.625 msec */
785 bacpy(&params.bdaddr, &link->host->bd_addr);
786 memcpy(&params.dev_class, &link->host->class, sizeof(params.dev_class));
787 params.link_type = ACL_LINK;
788 bt_hci_event(hci, EVT_CONN_REQUEST, &params, EVT_CONN_REQUEST_SIZE);
789 return;
792 static void bt_hci_conn_accept_timeout(void *opaque)
794 struct bt_hci_s *hci = (struct bt_hci_s *) opaque;
796 if (!hci->conn_req_host)
797 /* Already accepted or rejected. If the other end cancelled the
798 * connection request then we still have to reject or accept it
799 * and then we'll get a disconnect. */
800 return;
802 /* TODO */
805 /* Remove from the list of devices which we wanted to connect to and
806 * are awaiting a response from. If the callback sees a response from
807 * a device which is not on the list it will assume it's a connection
808 * that's been cancelled by the host in the meantime and immediately
809 * try to detach the link and send a Connection Complete. */
810 static int bt_hci_lmp_connection_ready(struct bt_hci_s *hci,
811 bdaddr_t *bdaddr)
813 int i;
815 for (i = 0; i < hci->lm.connecting; i ++)
816 if (!bacmp(&hci->lm.awaiting_bdaddr[i], bdaddr)) {
817 if (i < -- hci->lm.connecting)
818 bacpy(&hci->lm.awaiting_bdaddr[i],
819 &hci->lm.awaiting_bdaddr[hci->lm.connecting]);
820 return 0;
823 return 1;
826 static void bt_hci_lmp_connection_complete(struct bt_link_s *link)
828 struct bt_hci_s *hci = hci_from_device(link->host);
829 evt_conn_complete params;
830 uint16_t handle;
831 uint8_t status = HCI_SUCCESS;
832 int tries = HCI_HANDLES_MAX;
834 if (bt_hci_lmp_connection_ready(hci, &link->slave->bd_addr)) {
835 if (!hci->device.reject_reason)
836 link->slave->lmp_disconnect_slave(link);
837 handle = 0;
838 status = HCI_NO_CONNECTION;
839 goto complete;
842 if (hci->device.reject_reason) {
843 handle = 0;
844 status = hci->device.reject_reason;
845 goto complete;
848 /* Make a connection handle */
849 do {
850 while (hci->lm.handle[++ hci->lm.last_handle].link && -- tries)
851 hci->lm.last_handle &= HCI_HANDLES_MAX - 1;
852 handle = hci->lm.last_handle | HCI_HANDLE_OFFSET;
853 } while ((handle == hci->asb_handle || handle == hci->psb_handle) &&
854 tries);
856 if (!tries) {
857 link->slave->lmp_disconnect_slave(link);
858 status = HCI_NO_CONNECTION;
859 goto complete;
862 /* Link established */
863 link->handle = handle;
864 bt_hci_lmp_link_establish(hci, link, 1);
866 complete:
867 params.status = status;
868 params.handle = HNDL(handle);
869 params.link_type = ACL_LINK;
870 bacpy(&params.bdaddr, &link->slave->bd_addr);
871 params.encr_mode = 0x00; /* Encryption not required */
872 bt_hci_event(hci, EVT_CONN_COMPLETE, &params, EVT_CONN_COMPLETE_SIZE);
875 static void bt_hci_disconnect(struct bt_hci_s *hci,
876 uint16_t handle, int reason)
878 struct bt_link_s *btlink =
879 hci->lm.handle[handle & ~HCI_HANDLE_OFFSET].link;
880 struct bt_hci_link_s *link;
881 evt_disconn_complete params;
883 if (bt_hci_role_master(hci, handle)) {
884 btlink->slave->reject_reason = reason;
885 btlink->slave->lmp_disconnect_slave(btlink);
886 /* The link pointer is invalid from now on */
888 goto complete;
891 btlink->host->reject_reason = reason;
892 btlink->host->lmp_disconnect_master(btlink);
894 /* We are the slave, we get to clean this burden */
895 link = (struct bt_hci_link_s *) btlink;
896 qemu_free(link);
898 complete:
899 bt_hci_lmp_link_teardown(hci, handle);
901 params.status = HCI_SUCCESS;
902 params.handle = HNDL(handle);
903 params.reason = HCI_CONNECTION_TERMINATED;
904 bt_hci_event(hci, EVT_DISCONN_COMPLETE,
905 &params, EVT_DISCONN_COMPLETE_SIZE);
908 /* TODO: use only one function */
909 static void bt_hci_lmp_disconnect_host(struct bt_link_s *link)
911 struct bt_hci_s *hci = hci_from_device(link->host);
912 uint16_t handle = link->handle;
913 evt_disconn_complete params;
915 bt_hci_lmp_link_teardown(hci, handle);
917 params.status = HCI_SUCCESS;
918 params.handle = HNDL(handle);
919 params.reason = hci->device.reject_reason;
920 bt_hci_event(hci, EVT_DISCONN_COMPLETE,
921 &params, EVT_DISCONN_COMPLETE_SIZE);
924 static void bt_hci_lmp_disconnect_slave(struct bt_link_s *btlink)
926 struct bt_hci_link_s *link = (struct bt_hci_link_s *) btlink;
927 struct bt_hci_s *hci = hci_from_device(btlink->slave);
928 uint16_t handle = link->handle;
929 evt_disconn_complete params;
931 qemu_free(link);
933 bt_hci_lmp_link_teardown(hci, handle);
935 params.status = HCI_SUCCESS;
936 params.handle = HNDL(handle);
937 params.reason = hci->device.reject_reason;
938 bt_hci_event(hci, EVT_DISCONN_COMPLETE,
939 &params, EVT_DISCONN_COMPLETE_SIZE);
942 static int bt_hci_name_req(struct bt_hci_s *hci, bdaddr_t *bdaddr)
944 struct bt_device_s *slave;
945 evt_remote_name_req_complete params;
946 int len;
948 for (slave = hci->device.net->slave; slave; slave = slave->next)
949 if (slave->page_scan && !bacmp(&slave->bd_addr, bdaddr))
950 break;
951 if (!slave)
952 return -ENODEV;
954 bt_hci_event_status(hci, HCI_SUCCESS);
956 params.status = HCI_SUCCESS;
957 bacpy(&params.bdaddr, &slave->bd_addr);
958 len = snprintf(params.name, sizeof(params.name),
959 "%s", slave->lmp_name ?: "");
960 memset(params.name + len, 0, sizeof(params.name) - len);
961 bt_hci_event(hci, EVT_REMOTE_NAME_REQ_COMPLETE,
962 &params, EVT_REMOTE_NAME_REQ_COMPLETE_SIZE);
964 return 0;
967 static int bt_hci_features_req(struct bt_hci_s *hci, uint16_t handle)
969 struct bt_device_s *slave;
970 evt_read_remote_features_complete params;
972 if (bt_hci_handle_bad(hci, handle))
973 return -ENODEV;
975 slave = bt_hci_remote_dev(hci, handle);
977 bt_hci_event_status(hci, HCI_SUCCESS);
979 params.status = HCI_SUCCESS;
980 params.handle = HNDL(handle);
981 params.features[0] = (slave->lmp_caps >> 0) & 0xff;
982 params.features[1] = (slave->lmp_caps >> 8) & 0xff;
983 params.features[2] = (slave->lmp_caps >> 16) & 0xff;
984 params.features[3] = (slave->lmp_caps >> 24) & 0xff;
985 params.features[4] = (slave->lmp_caps >> 32) & 0xff;
986 params.features[5] = (slave->lmp_caps >> 40) & 0xff;
987 params.features[6] = (slave->lmp_caps >> 48) & 0xff;
988 params.features[7] = (slave->lmp_caps >> 56) & 0xff;
989 bt_hci_event(hci, EVT_READ_REMOTE_FEATURES_COMPLETE,
990 &params, EVT_READ_REMOTE_FEATURES_COMPLETE_SIZE);
992 return 0;
995 static int bt_hci_version_req(struct bt_hci_s *hci, uint16_t handle)
997 evt_read_remote_version_complete params;
999 if (bt_hci_handle_bad(hci, handle))
1000 return -ENODEV;
1002 bt_hci_remote_dev(hci, handle);
1004 bt_hci_event_status(hci, HCI_SUCCESS);
1006 params.status = HCI_SUCCESS;
1007 params.handle = HNDL(handle);
1008 params.lmp_ver = 0x03;
1009 params.manufacturer = cpu_to_le16(0xa000);
1010 params.lmp_subver = cpu_to_le16(0xa607);
1011 bt_hci_event(hci, EVT_READ_REMOTE_VERSION_COMPLETE,
1012 &params, EVT_READ_REMOTE_VERSION_COMPLETE_SIZE);
1014 return 0;
1017 static int bt_hci_clkoffset_req(struct bt_hci_s *hci, uint16_t handle)
1019 struct bt_device_s *slave;
1020 evt_read_clock_offset_complete params;
1022 if (bt_hci_handle_bad(hci, handle))
1023 return -ENODEV;
1025 slave = bt_hci_remote_dev(hci, handle);
1027 bt_hci_event_status(hci, HCI_SUCCESS);
1029 params.status = HCI_SUCCESS;
1030 params.handle = HNDL(handle);
1031 /* TODO: return the clkoff *differenece* */
1032 params.clock_offset = slave->clkoff; /* Note: no swapping */
1033 bt_hci_event(hci, EVT_READ_CLOCK_OFFSET_COMPLETE,
1034 &params, EVT_READ_CLOCK_OFFSET_COMPLETE_SIZE);
1036 return 0;
1039 static void bt_hci_event_mode(struct bt_hci_s *hci, struct bt_link_s *link,
1040 uint16_t handle)
1042 evt_mode_change params = {
1043 .status = HCI_SUCCESS,
1044 .handle = HNDL(handle),
1045 .mode = link->acl_mode,
1046 .interval = cpu_to_le16(link->acl_interval),
1049 bt_hci_event(hci, EVT_MODE_CHANGE, &params, EVT_MODE_CHANGE_SIZE);
1052 static void bt_hci_lmp_mode_change_master(struct bt_hci_s *hci,
1053 struct bt_link_s *link, int mode, uint16_t interval)
1055 link->acl_mode = mode;
1056 link->acl_interval = interval;
1058 bt_hci_event_mode(hci, link, link->handle);
1060 link->slave->lmp_mode_change(link);
1063 static void bt_hci_lmp_mode_change_slave(struct bt_link_s *btlink)
1065 struct bt_hci_link_s *link = (struct bt_hci_link_s *) btlink;
1066 struct bt_hci_s *hci = hci_from_device(btlink->slave);
1068 bt_hci_event_mode(hci, btlink, link->handle);
1071 static int bt_hci_mode_change(struct bt_hci_s *hci, uint16_t handle,
1072 int interval, int mode)
1074 struct bt_hci_master_link_s *link;
1076 if (bt_hci_handle_bad(hci, handle) || !bt_hci_role_master(hci, handle))
1077 return -ENODEV;
1079 link = &hci->lm.handle[handle & ~HCI_HANDLE_OFFSET];
1080 if (link->link->acl_mode != acl_active) {
1081 bt_hci_event_status(hci, HCI_COMMAND_DISALLOWED);
1082 return 0;
1085 bt_hci_event_status(hci, HCI_SUCCESS);
1087 qemu_mod_timer(link->acl_mode_timer, qemu_get_clock(vm_clock) +
1088 muldiv64(interval * 625, get_ticks_per_sec(), 1000000));
1089 bt_hci_lmp_mode_change_master(hci, link->link, mode, interval);
1091 return 0;
1094 static int bt_hci_mode_cancel(struct bt_hci_s *hci, uint16_t handle, int mode)
1096 struct bt_hci_master_link_s *link;
1098 if (bt_hci_handle_bad(hci, handle) || !bt_hci_role_master(hci, handle))
1099 return -ENODEV;
1101 link = &hci->lm.handle[handle & ~HCI_HANDLE_OFFSET];
1102 if (link->link->acl_mode != mode) {
1103 bt_hci_event_status(hci, HCI_COMMAND_DISALLOWED);
1105 return 0;
1108 bt_hci_event_status(hci, HCI_SUCCESS);
1110 qemu_del_timer(link->acl_mode_timer);
1111 bt_hci_lmp_mode_change_master(hci, link->link, acl_active, 0);
1113 return 0;
1116 static void bt_hci_mode_tick(void *opaque)
1118 struct bt_link_s *link = opaque;
1119 struct bt_hci_s *hci = hci_from_device(link->host);
1121 bt_hci_lmp_mode_change_master(hci, link, acl_active, 0);
1124 static void bt_hci_reset(struct bt_hci_s *hci)
1126 hci->acl_len = 0;
1127 hci->last_cmd = 0;
1128 hci->lm.connecting = 0;
1130 hci->event_mask[0] = 0xff;
1131 hci->event_mask[1] = 0xff;
1132 hci->event_mask[2] = 0xff;
1133 hci->event_mask[3] = 0xff;
1134 hci->event_mask[4] = 0xff;
1135 hci->event_mask[5] = 0x1f;
1136 hci->event_mask[6] = 0x00;
1137 hci->event_mask[7] = 0x00;
1138 hci->device.inquiry_scan = 0;
1139 hci->device.page_scan = 0;
1140 if (hci->device.lmp_name)
1141 qemu_free((void *) hci->device.lmp_name);
1142 hci->device.lmp_name = NULL;
1143 hci->device.class[0] = 0x00;
1144 hci->device.class[1] = 0x00;
1145 hci->device.class[2] = 0x00;
1146 hci->voice_setting = 0x0000;
1147 hci->conn_accept_tout = 0x1f40;
1148 hci->lm.inquiry_mode = 0x00;
1150 hci->psb_handle = 0x000;
1151 hci->asb_handle = 0x000;
1153 /* XXX: qemu_del_timer(sl->acl_mode_timer); for all links */
1154 qemu_del_timer(hci->lm.inquiry_done);
1155 qemu_del_timer(hci->lm.inquiry_next);
1156 qemu_del_timer(hci->conn_accept_timer);
1159 static void bt_hci_read_local_version_rp(struct bt_hci_s *hci)
1161 read_local_version_rp lv = {
1162 .status = HCI_SUCCESS,
1163 .hci_ver = 0x03,
1164 .hci_rev = cpu_to_le16(0xa607),
1165 .lmp_ver = 0x03,
1166 .manufacturer = cpu_to_le16(0xa000),
1167 .lmp_subver = cpu_to_le16(0xa607),
1170 bt_hci_event_complete(hci, &lv, READ_LOCAL_VERSION_RP_SIZE);
1173 static void bt_hci_read_local_commands_rp(struct bt_hci_s *hci)
1175 read_local_commands_rp lc = {
1176 .status = HCI_SUCCESS,
1177 .commands = {
1178 /* Keep updated! */
1179 /* Also, keep in sync with hci->device.lmp_caps in bt_new_hci */
1180 0xbf, 0x80, 0xf9, 0x03, 0xb2, 0xc0, 0x03, 0xc3,
1181 0x00, 0x0f, 0x80, 0x00, 0xc0, 0x00, 0xe8, 0x13,
1182 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1183 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1184 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1185 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1186 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1187 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
1191 bt_hci_event_complete(hci, &lc, READ_LOCAL_COMMANDS_RP_SIZE);
1194 static void bt_hci_read_local_features_rp(struct bt_hci_s *hci)
1196 read_local_features_rp lf = {
1197 .status = HCI_SUCCESS,
1198 .features = {
1199 (hci->device.lmp_caps >> 0) & 0xff,
1200 (hci->device.lmp_caps >> 8) & 0xff,
1201 (hci->device.lmp_caps >> 16) & 0xff,
1202 (hci->device.lmp_caps >> 24) & 0xff,
1203 (hci->device.lmp_caps >> 32) & 0xff,
1204 (hci->device.lmp_caps >> 40) & 0xff,
1205 (hci->device.lmp_caps >> 48) & 0xff,
1206 (hci->device.lmp_caps >> 56) & 0xff,
1210 bt_hci_event_complete(hci, &lf, READ_LOCAL_FEATURES_RP_SIZE);
1213 static void bt_hci_read_local_ext_features_rp(struct bt_hci_s *hci, int page)
1215 read_local_ext_features_rp lef = {
1216 .status = HCI_SUCCESS,
1217 .page_num = page,
1218 .max_page_num = 0x00,
1219 .features = {
1220 /* Keep updated! */
1221 0x5f, 0x35, 0x85, 0x7e, 0x9b, 0x19, 0x00, 0x80,
1224 if (page)
1225 memset(lef.features, 0, sizeof(lef.features));
1227 bt_hci_event_complete(hci, &lef, READ_LOCAL_EXT_FEATURES_RP_SIZE);
1230 static void bt_hci_read_buffer_size_rp(struct bt_hci_s *hci)
1232 read_buffer_size_rp bs = {
1233 /* This can be made configurable, for one standard USB dongle HCI
1234 * the four values are cpu_to_le16(0x0180), 0x40,
1235 * cpu_to_le16(0x0008), cpu_to_le16(0x0008). */
1236 .status = HCI_SUCCESS,
1237 .acl_mtu = cpu_to_le16(0x0200),
1238 .sco_mtu = 0,
1239 .acl_max_pkt = cpu_to_le16(0x0001),
1240 .sco_max_pkt = cpu_to_le16(0x0000),
1243 bt_hci_event_complete(hci, &bs, READ_BUFFER_SIZE_RP_SIZE);
1246 /* Deprecated in V2.0 (page 661) */
1247 static void bt_hci_read_country_code_rp(struct bt_hci_s *hci)
1249 read_country_code_rp cc ={
1250 .status = HCI_SUCCESS,
1251 .country_code = 0x00, /* North America & Europe^1 and Japan */
1254 bt_hci_event_complete(hci, &cc, READ_COUNTRY_CODE_RP_SIZE);
1256 /* ^1. Except France, sorry */
1259 static void bt_hci_read_bd_addr_rp(struct bt_hci_s *hci)
1261 read_bd_addr_rp ba = {
1262 .status = HCI_SUCCESS,
1263 .bdaddr = BAINIT(&hci->device.bd_addr),
1266 bt_hci_event_complete(hci, &ba, READ_BD_ADDR_RP_SIZE);
1269 static int bt_hci_link_quality_rp(struct bt_hci_s *hci, uint16_t handle)
1271 read_link_quality_rp lq = {
1272 .status = HCI_SUCCESS,
1273 .handle = HNDL(handle),
1274 .link_quality = 0xff,
1277 if (bt_hci_handle_bad(hci, handle))
1278 lq.status = HCI_NO_CONNECTION;
1280 bt_hci_event_complete(hci, &lq, READ_LINK_QUALITY_RP_SIZE);
1281 return 0;
1284 /* Generate a Command Complete event with only the Status parameter */
1285 static inline void bt_hci_event_complete_status(struct bt_hci_s *hci,
1286 uint8_t status)
1288 bt_hci_event_complete(hci, &status, 1);
1291 static inline void bt_hci_event_complete_conn_cancel(struct bt_hci_s *hci,
1292 uint8_t status, bdaddr_t *bd_addr)
1294 create_conn_cancel_rp params = {
1295 .status = status,
1296 .bdaddr = BAINIT(bd_addr),
1299 bt_hci_event_complete(hci, &params, CREATE_CONN_CANCEL_RP_SIZE);
1302 static inline void bt_hci_event_auth_complete(struct bt_hci_s *hci,
1303 uint16_t handle)
1305 evt_auth_complete params = {
1306 .status = HCI_SUCCESS,
1307 .handle = HNDL(handle),
1310 bt_hci_event(hci, EVT_AUTH_COMPLETE, &params, EVT_AUTH_COMPLETE_SIZE);
1313 static inline void bt_hci_event_encrypt_change(struct bt_hci_s *hci,
1314 uint16_t handle, uint8_t mode)
1316 evt_encrypt_change params = {
1317 .status = HCI_SUCCESS,
1318 .handle = HNDL(handle),
1319 .encrypt = mode,
1322 bt_hci_event(hci, EVT_ENCRYPT_CHANGE, &params, EVT_ENCRYPT_CHANGE_SIZE);
1325 static inline void bt_hci_event_complete_name_cancel(struct bt_hci_s *hci,
1326 bdaddr_t *bd_addr)
1328 remote_name_req_cancel_rp params = {
1329 .status = HCI_INVALID_PARAMETERS,
1330 .bdaddr = BAINIT(bd_addr),
1333 bt_hci_event_complete(hci, &params, REMOTE_NAME_REQ_CANCEL_RP_SIZE);
1336 static inline void bt_hci_event_read_remote_ext_features(struct bt_hci_s *hci,
1337 uint16_t handle)
1339 evt_read_remote_ext_features_complete params = {
1340 .status = HCI_UNSUPPORTED_FEATURE,
1341 .handle = HNDL(handle),
1342 /* Rest uninitialised */
1345 bt_hci_event(hci, EVT_READ_REMOTE_EXT_FEATURES_COMPLETE,
1346 &params, EVT_READ_REMOTE_EXT_FEATURES_COMPLETE_SIZE);
1349 static inline void bt_hci_event_complete_lmp_handle(struct bt_hci_s *hci,
1350 uint16_t handle)
1352 read_lmp_handle_rp params = {
1353 .status = HCI_NO_CONNECTION,
1354 .handle = HNDL(handle),
1355 .reserved = 0,
1356 /* Rest uninitialised */
1359 bt_hci_event_complete(hci, &params, READ_LMP_HANDLE_RP_SIZE);
1362 static inline void bt_hci_event_complete_role_discovery(struct bt_hci_s *hci,
1363 int status, uint16_t handle, int master)
1365 role_discovery_rp params = {
1366 .status = status,
1367 .handle = HNDL(handle),
1368 .role = master ? 0x00 : 0x01,
1371 bt_hci_event_complete(hci, &params, ROLE_DISCOVERY_RP_SIZE);
1374 static inline void bt_hci_event_complete_flush(struct bt_hci_s *hci,
1375 int status, uint16_t handle)
1377 flush_rp params = {
1378 .status = status,
1379 .handle = HNDL(handle),
1382 bt_hci_event_complete(hci, &params, FLUSH_RP_SIZE);
1385 static inline void bt_hci_event_complete_read_local_name(struct bt_hci_s *hci)
1387 read_local_name_rp params;
1388 params.status = HCI_SUCCESS;
1389 memset(params.name, 0, sizeof(params.name));
1390 if (hci->device.lmp_name)
1391 strncpy(params.name, hci->device.lmp_name, sizeof(params.name));
1393 bt_hci_event_complete(hci, &params, READ_LOCAL_NAME_RP_SIZE);
1396 static inline void bt_hci_event_complete_read_conn_accept_timeout(
1397 struct bt_hci_s *hci)
1399 read_conn_accept_timeout_rp params = {
1400 .status = HCI_SUCCESS,
1401 .timeout = cpu_to_le16(hci->conn_accept_tout),
1404 bt_hci_event_complete(hci, &params, READ_CONN_ACCEPT_TIMEOUT_RP_SIZE);
1407 static inline void bt_hci_event_complete_read_scan_enable(struct bt_hci_s *hci)
1409 read_scan_enable_rp params = {
1410 .status = HCI_SUCCESS,
1411 .enable =
1412 (hci->device.inquiry_scan ? SCAN_INQUIRY : 0) |
1413 (hci->device.page_scan ? SCAN_PAGE : 0),
1416 bt_hci_event_complete(hci, &params, READ_SCAN_ENABLE_RP_SIZE);
1419 static inline void bt_hci_event_complete_read_local_class(struct bt_hci_s *hci)
1421 read_class_of_dev_rp params;
1423 params.status = HCI_SUCCESS;
1424 memcpy(params.dev_class, hci->device.class, sizeof(params.dev_class));
1426 bt_hci_event_complete(hci, &params, READ_CLASS_OF_DEV_RP_SIZE);
1429 static inline void bt_hci_event_complete_voice_setting(struct bt_hci_s *hci)
1431 read_voice_setting_rp params = {
1432 .status = HCI_SUCCESS,
1433 .voice_setting = hci->voice_setting, /* Note: no swapping */
1436 bt_hci_event_complete(hci, &params, READ_VOICE_SETTING_RP_SIZE);
1439 static inline void bt_hci_event_complete_read_inquiry_mode(
1440 struct bt_hci_s *hci)
1442 read_inquiry_mode_rp params = {
1443 .status = HCI_SUCCESS,
1444 .mode = hci->lm.inquiry_mode,
1447 bt_hci_event_complete(hci, &params, READ_INQUIRY_MODE_RP_SIZE);
1450 static inline void bt_hci_event_num_comp_pkts(struct bt_hci_s *hci,
1451 uint16_t handle, int packets)
1453 uint16_t buf[EVT_NUM_COMP_PKTS_SIZE(1) / 2 + 1];
1454 evt_num_comp_pkts *params = (void *) ((uint8_t *) buf + 1);
1456 params->num_hndl = 1;
1457 params->connection->handle = HNDL(handle);
1458 params->connection->num_packets = cpu_to_le16(packets);
1460 bt_hci_event(hci, EVT_NUM_COMP_PKTS, params, EVT_NUM_COMP_PKTS_SIZE(1));
1463 static void bt_submit_hci(struct HCIInfo *info,
1464 const uint8_t *data, int length)
1466 struct bt_hci_s *hci = hci_from_info(info);
1467 uint16_t cmd;
1468 int paramlen, i;
1470 if (length < HCI_COMMAND_HDR_SIZE)
1471 goto short_hci;
1473 memcpy(&hci->last_cmd, data, 2);
1475 cmd = (data[1] << 8) | data[0];
1476 paramlen = data[2];
1477 if (cmd_opcode_ogf(cmd) == 0 || cmd_opcode_ocf(cmd) == 0) /* NOP */
1478 return;
1480 data += HCI_COMMAND_HDR_SIZE;
1481 length -= HCI_COMMAND_HDR_SIZE;
1483 if (paramlen > length)
1484 return;
1486 #define PARAM(cmd, param) (((cmd##_cp *) data)->param)
1487 #define PARAM16(cmd, param) le16_to_cpup(&PARAM(cmd, param))
1488 #define PARAMHANDLE(cmd) HNDL(PARAM(cmd, handle))
1489 #define LENGTH_CHECK(cmd) if (length < sizeof(cmd##_cp)) goto short_hci
1490 /* Note: the supported commands bitmask in bt_hci_read_local_commands_rp
1491 * needs to be updated every time a command is implemented here! */
1492 switch (cmd) {
1493 case cmd_opcode_pack(OGF_LINK_CTL, OCF_INQUIRY):
1494 LENGTH_CHECK(inquiry);
1496 if (PARAM(inquiry, length) < 1) {
1497 bt_hci_event_complete_status(hci, HCI_INVALID_PARAMETERS);
1498 break;
1501 hci->lm.inquire = 1;
1502 hci->lm.periodic = 0;
1503 hci->lm.responses_left = PARAM(inquiry, num_rsp) ?: INT_MAX;
1504 hci->lm.responses = 0;
1505 bt_hci_event_status(hci, HCI_SUCCESS);
1506 bt_hci_inquiry_start(hci, PARAM(inquiry, length));
1507 break;
1509 case cmd_opcode_pack(OGF_LINK_CTL, OCF_INQUIRY_CANCEL):
1510 if (!hci->lm.inquire || hci->lm.periodic) {
1511 fprintf(stderr, "%s: Inquiry Cancel should only be issued after "
1512 "the Inquiry command has been issued, a Command "
1513 "Status event has been received for the Inquiry "
1514 "command, and before the Inquiry Complete event "
1515 "occurs", __FUNCTION__);
1516 bt_hci_event_complete_status(hci, HCI_COMMAND_DISALLOWED);
1517 break;
1520 hci->lm.inquire = 0;
1521 qemu_del_timer(hci->lm.inquiry_done);
1522 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1523 break;
1525 case cmd_opcode_pack(OGF_LINK_CTL, OCF_PERIODIC_INQUIRY):
1526 LENGTH_CHECK(periodic_inquiry);
1528 if (!(PARAM(periodic_inquiry, length) <
1529 PARAM16(periodic_inquiry, min_period) &&
1530 PARAM16(periodic_inquiry, min_period) <
1531 PARAM16(periodic_inquiry, max_period)) ||
1532 PARAM(periodic_inquiry, length) < 1 ||
1533 PARAM16(periodic_inquiry, min_period) < 2 ||
1534 PARAM16(periodic_inquiry, max_period) < 3) {
1535 bt_hci_event_complete_status(hci, HCI_INVALID_PARAMETERS);
1536 break;
1539 hci->lm.inquire = 1;
1540 hci->lm.periodic = 1;
1541 hci->lm.responses_left = PARAM(periodic_inquiry, num_rsp);
1542 hci->lm.responses = 0;
1543 hci->lm.inquiry_period = PARAM16(periodic_inquiry, max_period);
1544 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1545 bt_hci_inquiry_start(hci, PARAM(periodic_inquiry, length));
1546 break;
1548 case cmd_opcode_pack(OGF_LINK_CTL, OCF_EXIT_PERIODIC_INQUIRY):
1549 if (!hci->lm.inquire || !hci->lm.periodic) {
1550 fprintf(stderr, "%s: Inquiry Cancel should only be issued after "
1551 "the Inquiry command has been issued, a Command "
1552 "Status event has been received for the Inquiry "
1553 "command, and before the Inquiry Complete event "
1554 "occurs", __FUNCTION__);
1555 bt_hci_event_complete_status(hci, HCI_COMMAND_DISALLOWED);
1556 break;
1558 hci->lm.inquire = 0;
1559 qemu_del_timer(hci->lm.inquiry_done);
1560 qemu_del_timer(hci->lm.inquiry_next);
1561 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1562 break;
1564 case cmd_opcode_pack(OGF_LINK_CTL, OCF_CREATE_CONN):
1565 LENGTH_CHECK(create_conn);
1567 if (hci->lm.connecting >= HCI_HANDLES_MAX) {
1568 bt_hci_event_status(hci, HCI_REJECTED_LIMITED_RESOURCES);
1569 break;
1571 bt_hci_event_status(hci, HCI_SUCCESS);
1573 if (bt_hci_connect(hci, &PARAM(create_conn, bdaddr)))
1574 bt_hci_connection_reject_event(hci, &PARAM(create_conn, bdaddr));
1575 break;
1577 case cmd_opcode_pack(OGF_LINK_CTL, OCF_DISCONNECT):
1578 LENGTH_CHECK(disconnect);
1580 if (bt_hci_handle_bad(hci, PARAMHANDLE(disconnect))) {
1581 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1582 break;
1585 bt_hci_event_status(hci, HCI_SUCCESS);
1586 bt_hci_disconnect(hci, PARAMHANDLE(disconnect),
1587 PARAM(disconnect, reason));
1588 break;
1590 case cmd_opcode_pack(OGF_LINK_CTL, OCF_CREATE_CONN_CANCEL):
1591 LENGTH_CHECK(create_conn_cancel);
1593 if (bt_hci_lmp_connection_ready(hci,
1594 &PARAM(create_conn_cancel, bdaddr))) {
1595 for (i = 0; i < HCI_HANDLES_MAX; i ++)
1596 if (bt_hci_role_master(hci, i) && hci->lm.handle[i].link &&
1597 !bacmp(&hci->lm.handle[i].link->slave->bd_addr,
1598 &PARAM(create_conn_cancel, bdaddr)))
1599 break;
1601 bt_hci_event_complete_conn_cancel(hci, i < HCI_HANDLES_MAX ?
1602 HCI_ACL_CONNECTION_EXISTS : HCI_NO_CONNECTION,
1603 &PARAM(create_conn_cancel, bdaddr));
1604 } else
1605 bt_hci_event_complete_conn_cancel(hci, HCI_SUCCESS,
1606 &PARAM(create_conn_cancel, bdaddr));
1607 break;
1609 case cmd_opcode_pack(OGF_LINK_CTL, OCF_ACCEPT_CONN_REQ):
1610 LENGTH_CHECK(accept_conn_req);
1612 if (!hci->conn_req_host ||
1613 bacmp(&PARAM(accept_conn_req, bdaddr),
1614 &hci->conn_req_host->bd_addr)) {
1615 bt_hci_event_status(hci, HCI_INVALID_PARAMETERS);
1616 break;
1619 bt_hci_event_status(hci, HCI_SUCCESS);
1620 bt_hci_connection_accept(hci, hci->conn_req_host);
1621 hci->conn_req_host = NULL;
1622 break;
1624 case cmd_opcode_pack(OGF_LINK_CTL, OCF_REJECT_CONN_REQ):
1625 LENGTH_CHECK(reject_conn_req);
1627 if (!hci->conn_req_host ||
1628 bacmp(&PARAM(reject_conn_req, bdaddr),
1629 &hci->conn_req_host->bd_addr)) {
1630 bt_hci_event_status(hci, HCI_INVALID_PARAMETERS);
1631 break;
1634 bt_hci_event_status(hci, HCI_SUCCESS);
1635 bt_hci_connection_reject(hci, hci->conn_req_host,
1636 PARAM(reject_conn_req, reason));
1637 bt_hci_connection_reject_event(hci, &hci->conn_req_host->bd_addr);
1638 hci->conn_req_host = NULL;
1639 break;
1641 case cmd_opcode_pack(OGF_LINK_CTL, OCF_AUTH_REQUESTED):
1642 LENGTH_CHECK(auth_requested);
1644 if (bt_hci_handle_bad(hci, PARAMHANDLE(auth_requested)))
1645 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1646 else {
1647 bt_hci_event_status(hci, HCI_SUCCESS);
1648 bt_hci_event_auth_complete(hci, PARAMHANDLE(auth_requested));
1650 break;
1652 case cmd_opcode_pack(OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT):
1653 LENGTH_CHECK(set_conn_encrypt);
1655 if (bt_hci_handle_bad(hci, PARAMHANDLE(set_conn_encrypt)))
1656 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1657 else {
1658 bt_hci_event_status(hci, HCI_SUCCESS);
1659 bt_hci_event_encrypt_change(hci,
1660 PARAMHANDLE(set_conn_encrypt),
1661 PARAM(set_conn_encrypt, encrypt));
1663 break;
1665 case cmd_opcode_pack(OGF_LINK_CTL, OCF_REMOTE_NAME_REQ):
1666 LENGTH_CHECK(remote_name_req);
1668 if (bt_hci_name_req(hci, &PARAM(remote_name_req, bdaddr)))
1669 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1670 break;
1672 case cmd_opcode_pack(OGF_LINK_CTL, OCF_REMOTE_NAME_REQ_CANCEL):
1673 LENGTH_CHECK(remote_name_req_cancel);
1675 bt_hci_event_complete_name_cancel(hci,
1676 &PARAM(remote_name_req_cancel, bdaddr));
1677 break;
1679 case cmd_opcode_pack(OGF_LINK_CTL, OCF_READ_REMOTE_FEATURES):
1680 LENGTH_CHECK(read_remote_features);
1682 if (bt_hci_features_req(hci, PARAMHANDLE(read_remote_features)))
1683 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1684 break;
1686 case cmd_opcode_pack(OGF_LINK_CTL, OCF_READ_REMOTE_EXT_FEATURES):
1687 LENGTH_CHECK(read_remote_ext_features);
1689 if (bt_hci_handle_bad(hci, PARAMHANDLE(read_remote_ext_features)))
1690 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1691 else {
1692 bt_hci_event_status(hci, HCI_SUCCESS);
1693 bt_hci_event_read_remote_ext_features(hci,
1694 PARAMHANDLE(read_remote_ext_features));
1696 break;
1698 case cmd_opcode_pack(OGF_LINK_CTL, OCF_READ_REMOTE_VERSION):
1699 LENGTH_CHECK(read_remote_version);
1701 if (bt_hci_version_req(hci, PARAMHANDLE(read_remote_version)))
1702 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1703 break;
1705 case cmd_opcode_pack(OGF_LINK_CTL, OCF_READ_CLOCK_OFFSET):
1706 LENGTH_CHECK(read_clock_offset);
1708 if (bt_hci_clkoffset_req(hci, PARAMHANDLE(read_clock_offset)))
1709 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1710 break;
1712 case cmd_opcode_pack(OGF_LINK_CTL, OCF_READ_LMP_HANDLE):
1713 LENGTH_CHECK(read_lmp_handle);
1715 /* TODO: */
1716 bt_hci_event_complete_lmp_handle(hci, PARAMHANDLE(read_lmp_handle));
1717 break;
1719 case cmd_opcode_pack(OGF_LINK_POLICY, OCF_HOLD_MODE):
1720 LENGTH_CHECK(hold_mode);
1722 if (PARAM16(hold_mode, min_interval) >
1723 PARAM16(hold_mode, max_interval) ||
1724 PARAM16(hold_mode, min_interval) < 0x0002 ||
1725 PARAM16(hold_mode, max_interval) > 0xff00 ||
1726 (PARAM16(hold_mode, min_interval) & 1) ||
1727 (PARAM16(hold_mode, max_interval) & 1)) {
1728 bt_hci_event_status(hci, HCI_INVALID_PARAMETERS);
1729 break;
1732 if (bt_hci_mode_change(hci, PARAMHANDLE(hold_mode),
1733 PARAM16(hold_mode, max_interval),
1734 acl_hold))
1735 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1736 break;
1738 case cmd_opcode_pack(OGF_LINK_POLICY, OCF_PARK_MODE):
1739 LENGTH_CHECK(park_mode);
1741 if (PARAM16(park_mode, min_interval) >
1742 PARAM16(park_mode, max_interval) ||
1743 PARAM16(park_mode, min_interval) < 0x000e ||
1744 (PARAM16(park_mode, min_interval) & 1) ||
1745 (PARAM16(park_mode, max_interval) & 1)) {
1746 bt_hci_event_status(hci, HCI_INVALID_PARAMETERS);
1747 break;
1750 if (bt_hci_mode_change(hci, PARAMHANDLE(park_mode),
1751 PARAM16(park_mode, max_interval),
1752 acl_parked))
1753 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1754 break;
1756 case cmd_opcode_pack(OGF_LINK_POLICY, OCF_EXIT_PARK_MODE):
1757 LENGTH_CHECK(exit_park_mode);
1759 if (bt_hci_mode_cancel(hci, PARAMHANDLE(exit_park_mode),
1760 acl_parked))
1761 bt_hci_event_status(hci, HCI_NO_CONNECTION);
1762 break;
1764 case cmd_opcode_pack(OGF_LINK_POLICY, OCF_ROLE_DISCOVERY):
1765 LENGTH_CHECK(role_discovery);
1767 if (bt_hci_handle_bad(hci, PARAMHANDLE(role_discovery)))
1768 bt_hci_event_complete_role_discovery(hci,
1769 HCI_NO_CONNECTION, PARAMHANDLE(role_discovery), 0);
1770 else
1771 bt_hci_event_complete_role_discovery(hci,
1772 HCI_SUCCESS, PARAMHANDLE(role_discovery),
1773 bt_hci_role_master(hci,
1774 PARAMHANDLE(role_discovery)));
1775 break;
1777 case cmd_opcode_pack(OGF_HOST_CTL, OCF_SET_EVENT_MASK):
1778 LENGTH_CHECK(set_event_mask);
1780 memcpy(hci->event_mask, PARAM(set_event_mask, mask), 8);
1781 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1782 break;
1784 case cmd_opcode_pack(OGF_HOST_CTL, OCF_RESET):
1785 bt_hci_reset(hci);
1786 bt_hci_event_status(hci, HCI_SUCCESS);
1787 break;
1789 case cmd_opcode_pack(OGF_HOST_CTL, OCF_SET_EVENT_FLT):
1790 if (length >= 1 && PARAM(set_event_flt, flt_type) == FLT_CLEAR_ALL)
1791 /* No length check */;
1792 else
1793 LENGTH_CHECK(set_event_flt);
1795 /* Filters are not implemented */
1796 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1797 break;
1799 case cmd_opcode_pack(OGF_HOST_CTL, OCF_FLUSH):
1800 LENGTH_CHECK(flush);
1802 if (bt_hci_handle_bad(hci, PARAMHANDLE(flush)))
1803 bt_hci_event_complete_flush(hci,
1804 HCI_NO_CONNECTION, PARAMHANDLE(flush));
1805 else {
1806 /* TODO: ordering? */
1807 bt_hci_event(hci, EVT_FLUSH_OCCURRED,
1808 &PARAM(flush, handle),
1809 EVT_FLUSH_OCCURRED_SIZE);
1810 bt_hci_event_complete_flush(hci,
1811 HCI_SUCCESS, PARAMHANDLE(flush));
1813 break;
1815 case cmd_opcode_pack(OGF_HOST_CTL, OCF_CHANGE_LOCAL_NAME):
1816 LENGTH_CHECK(change_local_name);
1818 if (hci->device.lmp_name)
1819 qemu_free((void *) hci->device.lmp_name);
1820 hci->device.lmp_name = qemu_strndup(PARAM(change_local_name, name),
1821 sizeof(PARAM(change_local_name, name)));
1822 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1823 break;
1825 case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_LOCAL_NAME):
1826 bt_hci_event_complete_read_local_name(hci);
1827 break;
1829 case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_CONN_ACCEPT_TIMEOUT):
1830 bt_hci_event_complete_read_conn_accept_timeout(hci);
1831 break;
1833 case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_CONN_ACCEPT_TIMEOUT):
1834 /* TODO */
1835 LENGTH_CHECK(write_conn_accept_timeout);
1837 if (PARAM16(write_conn_accept_timeout, timeout) < 0x0001 ||
1838 PARAM16(write_conn_accept_timeout, timeout) > 0xb540) {
1839 bt_hci_event_complete_status(hci, HCI_INVALID_PARAMETERS);
1840 break;
1843 hci->conn_accept_tout = PARAM16(write_conn_accept_timeout, timeout);
1844 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1845 break;
1847 case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_SCAN_ENABLE):
1848 bt_hci_event_complete_read_scan_enable(hci);
1849 break;
1851 case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE):
1852 LENGTH_CHECK(write_scan_enable);
1854 /* TODO: check that the remaining bits are all 0 */
1855 hci->device.inquiry_scan =
1856 !!(PARAM(write_scan_enable, scan_enable) & SCAN_INQUIRY);
1857 hci->device.page_scan =
1858 !!(PARAM(write_scan_enable, scan_enable) & SCAN_PAGE);
1859 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1860 break;
1862 case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_CLASS_OF_DEV):
1863 bt_hci_event_complete_read_local_class(hci);
1864 break;
1866 case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_CLASS_OF_DEV):
1867 LENGTH_CHECK(write_class_of_dev);
1869 memcpy(hci->device.class, PARAM(write_class_of_dev, dev_class),
1870 sizeof(PARAM(write_class_of_dev, dev_class)));
1871 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1872 break;
1874 case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_VOICE_SETTING):
1875 bt_hci_event_complete_voice_setting(hci);
1876 break;
1878 case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_VOICE_SETTING):
1879 LENGTH_CHECK(write_voice_setting);
1881 hci->voice_setting = PARAM(write_voice_setting, voice_setting);
1882 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1883 break;
1885 case cmd_opcode_pack(OGF_HOST_CTL, OCF_HOST_NUMBER_OF_COMPLETED_PACKETS):
1886 if (length < data[0] * 2 + 1)
1887 goto short_hci;
1889 for (i = 0; i < data[0]; i ++)
1890 if (bt_hci_handle_bad(hci,
1891 data[i * 2 + 1] | (data[i * 2 + 2] << 8)))
1892 bt_hci_event_complete_status(hci, HCI_INVALID_PARAMETERS);
1893 break;
1895 case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_INQUIRY_MODE):
1896 /* Only if (local_features[3] & 0x40) && (local_commands[12] & 0x40)
1897 * else
1898 * goto unknown_command */
1899 bt_hci_event_complete_read_inquiry_mode(hci);
1900 break;
1902 case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_INQUIRY_MODE):
1903 /* Only if (local_features[3] & 0x40) && (local_commands[12] & 0x80)
1904 * else
1905 * goto unknown_command */
1906 LENGTH_CHECK(write_inquiry_mode);
1908 if (PARAM(write_inquiry_mode, mode) > 0x01) {
1909 bt_hci_event_complete_status(hci, HCI_INVALID_PARAMETERS);
1910 break;
1913 hci->lm.inquiry_mode = PARAM(write_inquiry_mode, mode);
1914 bt_hci_event_complete_status(hci, HCI_SUCCESS);
1915 break;
1917 case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_LOCAL_VERSION):
1918 bt_hci_read_local_version_rp(hci);
1919 break;
1921 case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_LOCAL_COMMANDS):
1922 bt_hci_read_local_commands_rp(hci);
1923 break;
1925 case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES):
1926 bt_hci_read_local_features_rp(hci);
1927 break;
1929 case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_LOCAL_EXT_FEATURES):
1930 LENGTH_CHECK(read_local_ext_features);
1932 bt_hci_read_local_ext_features_rp(hci,
1933 PARAM(read_local_ext_features, page_num));
1934 break;
1936 case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE):
1937 bt_hci_read_buffer_size_rp(hci);
1938 break;
1940 case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_COUNTRY_CODE):
1941 bt_hci_read_country_code_rp(hci);
1942 break;
1944 case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_BD_ADDR):
1945 bt_hci_read_bd_addr_rp(hci);
1946 break;
1948 case cmd_opcode_pack(OGF_STATUS_PARAM, OCF_READ_LINK_QUALITY):
1949 LENGTH_CHECK(read_link_quality);
1951 bt_hci_link_quality_rp(hci, PARAMHANDLE(read_link_quality));
1952 break;
1954 default:
1955 bt_hci_event_status(hci, HCI_UNKNOWN_COMMAND);
1956 break;
1958 short_hci:
1959 fprintf(stderr, "%s: HCI packet too short (%iB)\n",
1960 __FUNCTION__, length);
1961 bt_hci_event_status(hci, HCI_INVALID_PARAMETERS);
1962 break;
1966 /* We could perform fragmentation here, we can't do "recombination" because
1967 * at this layer the length of the payload is not know ahead, so we only
1968 * know that a packet contained the last fragment of the SDU when the next
1969 * SDU starts. */
1970 static inline void bt_hci_lmp_acl_data(struct bt_hci_s *hci, uint16_t handle,
1971 const uint8_t *data, int start, int len)
1973 struct hci_acl_hdr *pkt = (void *) hci->acl_buf;
1975 /* TODO: packet flags */
1976 /* TODO: avoid memcpy'ing */
1978 if (len + HCI_ACL_HDR_SIZE > sizeof(hci->acl_buf)) {
1979 fprintf(stderr, "%s: can't take ACL packets %i bytes long\n",
1980 __FUNCTION__, len);
1981 return;
1983 memcpy(hci->acl_buf + HCI_ACL_HDR_SIZE, data, len);
1985 pkt->handle = cpu_to_le16(
1986 acl_handle_pack(handle, start ? ACL_START : ACL_CONT));
1987 pkt->dlen = cpu_to_le16(len);
1988 hci->info.acl_recv(hci->info.opaque,
1989 hci->acl_buf, len + HCI_ACL_HDR_SIZE);
1992 static void bt_hci_lmp_acl_data_slave(struct bt_link_s *btlink,
1993 const uint8_t *data, int start, int len)
1995 struct bt_hci_link_s *link = (struct bt_hci_link_s *) btlink;
1997 bt_hci_lmp_acl_data(hci_from_device(btlink->slave),
1998 link->handle, data, start, len);
2001 static void bt_hci_lmp_acl_data_host(struct bt_link_s *link,
2002 const uint8_t *data, int start, int len)
2004 bt_hci_lmp_acl_data(hci_from_device(link->host),
2005 link->handle, data, start, len);
2008 static void bt_submit_acl(struct HCIInfo *info,
2009 const uint8_t *data, int length)
2011 struct bt_hci_s *hci = hci_from_info(info);
2012 uint16_t handle;
2013 int datalen, flags;
2014 struct bt_link_s *link;
2016 if (length < HCI_ACL_HDR_SIZE) {
2017 fprintf(stderr, "%s: ACL packet too short (%iB)\n",
2018 __FUNCTION__, length);
2019 return;
2022 handle = acl_handle((data[1] << 8) | data[0]);
2023 flags = acl_flags((data[1] << 8) | data[0]);
2024 datalen = (data[3] << 8) | data[2];
2025 data += HCI_ACL_HDR_SIZE;
2026 length -= HCI_ACL_HDR_SIZE;
2028 if (bt_hci_handle_bad(hci, handle)) {
2029 fprintf(stderr, "%s: invalid ACL handle %03x\n",
2030 __FUNCTION__, handle);
2031 /* TODO: signal an error */
2032 return;
2034 handle &= ~HCI_HANDLE_OFFSET;
2036 if (datalen > length) {
2037 fprintf(stderr, "%s: ACL packet too short (%iB < %iB)\n",
2038 __FUNCTION__, length, datalen);
2039 return;
2042 link = hci->lm.handle[handle].link;
2044 if ((flags & ~3) == ACL_ACTIVE_BCAST) {
2045 if (!hci->asb_handle)
2046 hci->asb_handle = handle;
2047 else if (handle != hci->asb_handle) {
2048 fprintf(stderr, "%s: Bad handle %03x in Active Slave Broadcast\n",
2049 __FUNCTION__, handle);
2050 /* TODO: signal an error */
2051 return;
2054 /* TODO */
2057 if ((flags & ~3) == ACL_PICO_BCAST) {
2058 if (!hci->psb_handle)
2059 hci->psb_handle = handle;
2060 else if (handle != hci->psb_handle) {
2061 fprintf(stderr, "%s: Bad handle %03x in Parked Slave Broadcast\n",
2062 __FUNCTION__, handle);
2063 /* TODO: signal an error */
2064 return;
2067 /* TODO */
2070 /* TODO: increase counter and send EVT_NUM_COMP_PKTS */
2071 bt_hci_event_num_comp_pkts(hci, handle | HCI_HANDLE_OFFSET, 1);
2073 /* Do this last as it can trigger further events even in this HCI */
2074 hci->lm.handle[handle].lmp_acl_data(link, data,
2075 (flags & 3) == ACL_START, length);
2078 static void bt_submit_sco(struct HCIInfo *info,
2079 const uint8_t *data, int length)
2081 struct bt_hci_s *hci = hci_from_info(info);
2082 uint16_t handle;
2083 int datalen;
2085 if (length < 3)
2086 return;
2088 handle = acl_handle((data[1] << 8) | data[0]);
2089 datalen = data[2];
2090 length -= 3;
2092 if (bt_hci_handle_bad(hci, handle)) {
2093 fprintf(stderr, "%s: invalid SCO handle %03x\n",
2094 __FUNCTION__, handle);
2095 return;
2098 if (datalen > length) {
2099 fprintf(stderr, "%s: SCO packet too short (%iB < %iB)\n",
2100 __FUNCTION__, length, datalen);
2101 return;
2104 /* TODO */
2106 /* TODO: increase counter and send EVT_NUM_COMP_PKTS if synchronous
2107 * Flow Control is enabled.
2108 * (See Read/Write_Synchronous_Flow_Control_Enable on page 513 and
2109 * page 514.) */
2112 static uint8_t *bt_hci_evt_packet(void *opaque)
2114 /* TODO: allocate a packet from upper layer */
2115 struct bt_hci_s *s = opaque;
2117 return s->evt_buf;
2120 static void bt_hci_evt_submit(void *opaque, int len)
2122 /* TODO: notify upper layer */
2123 struct bt_hci_s *s = opaque;
2125 s->info.evt_recv(s->info.opaque, s->evt_buf, len);
2128 static int bt_hci_bdaddr_set(struct HCIInfo *info, const uint8_t *bd_addr)
2130 struct bt_hci_s *hci = hci_from_info(info);
2132 bacpy(&hci->device.bd_addr, (const bdaddr_t *) bd_addr);
2133 return 0;
2136 static void bt_hci_done(struct HCIInfo *info);
2137 static void bt_hci_destroy(struct bt_device_s *dev)
2139 struct bt_hci_s *hci = hci_from_device(dev);
2141 bt_hci_done(&hci->info);
2144 struct HCIInfo *bt_new_hci(struct bt_scatternet_s *net)
2146 struct bt_hci_s *s = qemu_mallocz(sizeof(struct bt_hci_s));
2148 s->lm.inquiry_done = qemu_new_timer(vm_clock, bt_hci_inquiry_done, s);
2149 s->lm.inquiry_next = qemu_new_timer(vm_clock, bt_hci_inquiry_next, s);
2150 s->conn_accept_timer =
2151 qemu_new_timer(vm_clock, bt_hci_conn_accept_timeout, s);
2153 s->evt_packet = bt_hci_evt_packet;
2154 s->evt_submit = bt_hci_evt_submit;
2155 s->opaque = s;
2157 bt_device_init(&s->device, net);
2158 s->device.lmp_connection_request = bt_hci_lmp_connection_request;
2159 s->device.lmp_connection_complete = bt_hci_lmp_connection_complete;
2160 s->device.lmp_disconnect_master = bt_hci_lmp_disconnect_host;
2161 s->device.lmp_disconnect_slave = bt_hci_lmp_disconnect_slave;
2162 s->device.lmp_acl_data = bt_hci_lmp_acl_data_slave;
2163 s->device.lmp_acl_resp = bt_hci_lmp_acl_data_host;
2164 s->device.lmp_mode_change = bt_hci_lmp_mode_change_slave;
2166 /* Keep updated! */
2167 /* Also keep in sync with supported commands bitmask in
2168 * bt_hci_read_local_commands_rp */
2169 s->device.lmp_caps = 0x8000199b7e85355fll;
2171 bt_hci_reset(s);
2173 s->info.cmd_send = bt_submit_hci;
2174 s->info.sco_send = bt_submit_sco;
2175 s->info.acl_send = bt_submit_acl;
2176 s->info.bdaddr_set = bt_hci_bdaddr_set;
2178 s->device.handle_destroy = bt_hci_destroy;
2180 return &s->info;
2183 static void bt_hci_done(struct HCIInfo *info)
2185 struct bt_hci_s *hci = hci_from_info(info);
2186 int handle;
2188 bt_device_done(&hci->device);
2190 if (hci->device.lmp_name)
2191 qemu_free((void *) hci->device.lmp_name);
2193 /* Be gentle and send DISCONNECT to all connected peers and those
2194 * currently waiting for us to accept or reject a connection request.
2195 * This frees the links. */
2196 if (hci->conn_req_host) {
2197 bt_hci_connection_reject(hci,
2198 hci->conn_req_host, HCI_OE_POWER_OFF);
2199 return;
2202 for (handle = HCI_HANDLE_OFFSET;
2203 handle < (HCI_HANDLE_OFFSET | HCI_HANDLES_MAX); handle ++)
2204 if (!bt_hci_handle_bad(hci, handle))
2205 bt_hci_disconnect(hci, handle, HCI_OE_POWER_OFF);
2207 /* TODO: this is not enough actually, there may be slaves from whom
2208 * we have requested a connection who will soon (or not) respond with
2209 * an accept or a reject, so we should also check if hci->lm.connecting
2210 * is non-zero and if so, avoid freeing the hci but otherwise disappear
2211 * from all qemu social life (e.g. stop scanning and request to be
2212 * removed from s->device.net) and arrange for
2213 * s->device.lmp_connection_complete to free the remaining bits once
2214 * hci->lm.awaiting_bdaddr[] is empty. */
2216 qemu_free_timer(hci->lm.inquiry_done);
2217 qemu_free_timer(hci->lm.inquiry_next);
2218 qemu_free_timer(hci->conn_accept_timer);
2220 qemu_free(hci);