hw/bt-hci-csr.c

   1 /*
   2  * Bluetooth serial HCI transport.
   3  * CSR41814 HCI with H4p vendor extensions.
   4  *
   5  * Copyright (C) 2008 Andrzej Zaborowski  <balrog@zabor.org>
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License as
   9  * published by the Free Software Foundation; either version 2 or
  10  * (at your option) version 3 of the License.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, see <http://www.gnu.org/licenses/>.
  19  */
  20
  21 #include "qemu-common.h"
  22 #include "qemu-char.h"
  23 #include "qemu-timer.h"
  24 #include "irq.h"
  25 #include "net.h"
  26 #include "bt.h"
  27
  28 struct csrhci_s {
  29     int enable;
  30     qemu_irq *pins;
  31     int pin_state;
  32     int modem_state;
  33     CharDriverState chr;
  34 #define FIFO_LEN        4096
  35     int out_start;
  36     int out_len;
  37     int out_size;
  38     uint8_t outfifo[FIFO_LEN * 2];
  39     uint8_t inpkt[FIFO_LEN];
  40     int in_len;
  41     int in_hdr;
  42     int in_data;
  43     QEMUTimer *out_tm;
  44     int64_t baud_delay;
  45
  46     bdaddr_t bd_addr;
  47     struct HCIInfo *hci;
  48 };
  49
  50 /* H4+ packet types */
  51 enum {
  52     H4_CMD_PKT   = 1,
  53     H4_ACL_PKT   = 2,
  54     H4_SCO_PKT   = 3,
  55     H4_EVT_PKT   = 4,
  56     H4_NEG_PKT   = 6,
  57     H4_ALIVE_PKT = 7,
  58 };
  59
  60 /* CSR41814 negotiation start magic packet */
  61 static const uint8_t csrhci_neg_packet[] = {
  62     H4_NEG_PKT, 10,
  63     0x00, 0xa0, 0x01, 0x00, 0x00,
  64     0x4c, 0x00, 0x96, 0x00, 0x00,
  65 };
  66
  67 /* CSR41814 vendor-specific command OCFs */
  68 enum {
  69     OCF_CSR_SEND_FIRMWARE = 0x000,
  70 };
  71
  72 static inline void csrhci_fifo_wake(struct csrhci_s *s)
  73 {
  74     if (!s->enable || !s->out_len)
  75         return;
  76
  77     /* XXX: Should wait for s->modem_state & CHR_TIOCM_RTS? */
  78     if (qemu_chr_be_can_write(&s->chr)) {
  79         qemu_chr_be_write(&s->chr, s->outfifo + s->out_start ++, 1);
  80         s->out_len --;
  81         if (s->out_start >= s->out_size) {
  82             s->out_start = 0;
  83             s->out_size = FIFO_LEN;
  84         }
  85     }
  86
  87     if (s->out_len)
  88         qemu_mod_timer(s->out_tm, qemu_get_clock_ns(vm_clock) + s->baud_delay);
  89 }
  90
  91 #define csrhci_out_packetz(s, len) memset(csrhci_out_packet(s, len), 0, len)
  92 static uint8_t *csrhci_out_packet(struct csrhci_s *s, int len)
  93 {
  94     int off = s->out_start + s->out_len;
  95
  96     /* TODO: do the padding here, i.e. align len */
  97     s->out_len += len;
  98
  99     if (off < FIFO_LEN) {
 100         if (off + len > FIFO_LEN && (s->out_size = off + len) > FIFO_LEN * 2) {
 101             fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
 102             exit(-1);
 103         }
 104         return s->outfifo + off;
 105     }
 106
 107     if (s->out_len > s->out_size) {
 108         fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
 109         exit(-1);
 110     }
 111
 112     return s->outfifo + off - s->out_size;
 113 }
 114
 115 static inline uint8_t *csrhci_out_packet_csr(struct csrhci_s *s,
 116                 int type, int len)
 117 {
 118     uint8_t *ret = csrhci_out_packetz(s, len + 2);
 119
 120     *ret ++ = type;
 121     *ret ++ = len;
 122
 123     return ret;
 124 }
 125
 126 static inline uint8_t *csrhci_out_packet_event(struct csrhci_s *s,
 127                 int evt, int len)
 128 {
 129     uint8_t *ret = csrhci_out_packetz(s,
 130                     len + 1 + sizeof(struct hci_event_hdr));
 131
 132     *ret ++ = H4_EVT_PKT;
 133     ((struct hci_event_hdr *) ret)->evt = evt;
 134     ((struct hci_event_hdr *) ret)->plen = len;
 135
 136     return ret + sizeof(struct hci_event_hdr);
 137 }
 138
 139 static void csrhci_in_packet_vendor(struct csrhci_s *s, int ocf,
 140                 uint8_t *data, int len)
 141 {
 142     int offset;
 143     uint8_t *rpkt;
 144
 145     switch (ocf) {
 146     case OCF_CSR_SEND_FIRMWARE:
 147         /* Check if this is the bd_address packet */
 148         if (len >= 18 + 8 && data[12] == 0x01 && data[13] == 0x00) {
 149             offset = 18;
 150             s->bd_addr.b[0] = data[offset + 7]; /* Beyond cmd packet end(!?) */
 151             s->bd_addr.b[1] = data[offset + 6];
 152             s->bd_addr.b[2] = data[offset + 4];
 153             s->bd_addr.b[3] = data[offset + 0];
 154             s->bd_addr.b[4] = data[offset + 3];
 155             s->bd_addr.b[5] = data[offset + 2];
 156
 157             s->hci->bdaddr_set(s->hci, s->bd_addr.b);
 158             fprintf(stderr, "%s: bd_address loaded from firmware: "
 159                             "%02x:%02x:%02x:%02x:%02x:%02x\n", __FUNCTION__,
 160                             s->bd_addr.b[0], s->bd_addr.b[1], s->bd_addr.b[2],
 161                             s->bd_addr.b[3], s->bd_addr.b[4], s->bd_addr.b[5]);
 162         }
 163
 164         rpkt = csrhci_out_packet_event(s, EVT_VENDOR, 11);
 165         /* Status bytes: no error */
 166         rpkt[9] = 0x00;
 167         rpkt[10] = 0x00;
 168         break;
 169
 170     default:
 171         fprintf(stderr, "%s: got a bad CMD packet\n", __FUNCTION__);
 172         return;
 173     }
 174
 175     csrhci_fifo_wake(s);
 176 }
 177
 178 static void csrhci_in_packet(struct csrhci_s *s, uint8_t *pkt)
 179 {
 180     uint8_t *rpkt;
 181     int opc;
 182
 183     switch (*pkt ++) {
 184     case H4_CMD_PKT:
 185         opc = le16_to_cpu(((struct hci_command_hdr *) pkt)->opcode);
 186         if (cmd_opcode_ogf(opc) == OGF_VENDOR_CMD) {
 187             csrhci_in_packet_vendor(s, cmd_opcode_ocf(opc),
 188                             pkt + sizeof(struct hci_command_hdr),
 189                             s->in_len - sizeof(struct hci_command_hdr) - 1);
 190             return;
 191         }
 192
 193         /* TODO: if the command is OCF_READ_LOCAL_COMMANDS or the likes,
 194          * we need to send it to the HCI layer and then add our supported
 195          * commands to the returned mask (such as OGF_VENDOR_CMD).  With
 196          * bt-hci.c we could just have hooks for this kind of commands but
 197          * we can't with bt-host.c.  */
 198
 199         s->hci->cmd_send(s->hci, pkt, s->in_len - 1);
 200         break;
 201
 202     case H4_EVT_PKT:
 203         goto bad_pkt;
 204
 205     case H4_ACL_PKT:
 206         s->hci->acl_send(s->hci, pkt, s->in_len - 1);
 207         break;
 208
 209     case H4_SCO_PKT:
 210         s->hci->sco_send(s->hci, pkt, s->in_len - 1);
 211         break;
 212
 213     case H4_NEG_PKT:
 214         if (s->in_hdr != sizeof(csrhci_neg_packet) ||
 215                         memcmp(pkt - 1, csrhci_neg_packet, s->in_hdr)) {
 216             fprintf(stderr, "%s: got a bad NEG packet\n", __FUNCTION__);
 217             return;
 218         }
 219         pkt += 2;
 220
 221         rpkt = csrhci_out_packet_csr(s, H4_NEG_PKT, 10);
 222
 223         *rpkt ++ = 0x20;        /* Operational settings negotation Ok */
 224         memcpy(rpkt, pkt, 7); rpkt += 7;
 225         *rpkt ++ = 0xff;
 226         *rpkt = 0xff;
 227         break;
 228
 229     case H4_ALIVE_PKT:
 230         if (s->in_hdr != 4 || pkt[1] != 0x55 || pkt[2] != 0x00) {
 231             fprintf(stderr, "%s: got a bad ALIVE packet\n", __FUNCTION__);
 232             return;
 233         }
 234
 235         rpkt = csrhci_out_packet_csr(s, H4_ALIVE_PKT, 2);
 236
 237         *rpkt ++ = 0xcc;
 238         *rpkt = 0x00;
 239         break;
 240
 241     default:
 242     bad_pkt:
 243         /* TODO: error out */
 244         fprintf(stderr, "%s: got a bad packet\n", __FUNCTION__);
 245         break;
 246     }
 247
 248     csrhci_fifo_wake(s);
 249 }
 250
 251 static int csrhci_header_len(const uint8_t *pkt)
 252 {
 253     switch (pkt[0]) {
 254     case H4_CMD_PKT:
 255         return HCI_COMMAND_HDR_SIZE;
 256     case H4_EVT_PKT:
 257         return HCI_EVENT_HDR_SIZE;
 258     case H4_ACL_PKT:
 259         return HCI_ACL_HDR_SIZE;
 260     case H4_SCO_PKT:
 261         return HCI_SCO_HDR_SIZE;
 262     case H4_NEG_PKT:
 263         return pkt[1] + 1;
 264     case H4_ALIVE_PKT:
 265         return 3;
 266     }
 267
 268     exit(-1);
 269 }
 270
 271 static int csrhci_data_len(const uint8_t *pkt)
 272 {
 273     switch (*pkt ++) {
 274     case H4_CMD_PKT:
 275         /* It seems that vendor-specific command packets for H4+ are all
 276          * one byte longer than indicated in the standard header.  */
 277         if (le16_to_cpu(((struct hci_command_hdr *) pkt)->opcode) == 0xfc00)
 278             return (((struct hci_command_hdr *) pkt)->plen + 1) & ~1;
 279
 280         return ((struct hci_command_hdr *) pkt)->plen;
 281     case H4_EVT_PKT:
 282         return ((struct hci_event_hdr *) pkt)->plen;
 283     case H4_ACL_PKT:
 284         return le16_to_cpu(((struct hci_acl_hdr *) pkt)->dlen);
 285     case H4_SCO_PKT:
 286         return ((struct hci_sco_hdr *) pkt)->dlen;
 287     case H4_NEG_PKT:
 288     case H4_ALIVE_PKT:
 289         return 0;
 290     }
 291
 292     exit(-1);
 293 }
 294
 295 static int csrhci_write(struct CharDriverState *chr,
 296                 const uint8_t *buf, int len)
 297 {
 298     struct csrhci_s *s = (struct csrhci_s *) chr->opaque;
 299     int plen = s->in_len;
 300
 301     if (!s->enable)
 302         return 0;
 303
 304     s->in_len += len;
 305     memcpy(s->inpkt + plen, buf, len);
 306
 307     while (1) {
 308         if (s->in_len >= 2 && plen < 2)
 309             s->in_hdr = csrhci_header_len(s->inpkt) + 1;
 310
 311         if (s->in_len >= s->in_hdr && plen < s->in_hdr)
 312             s->in_data = csrhci_data_len(s->inpkt) + s->in_hdr;
 313
 314         if (s->in_len >= s->in_data) {
 315             csrhci_in_packet(s, s->inpkt);
 316
 317             memmove(s->inpkt, s->inpkt + s->in_len, s->in_len - s->in_data);
 318             s->in_len -= s->in_data;
 319             s->in_hdr = INT_MAX;
 320             s->in_data = INT_MAX;
 321             plen = 0;
 322         } else
 323             break;
 324     }
 325
 326     return len;
 327 }
 328
 329 static void csrhci_out_hci_packet_event(void *opaque,
 330                 const uint8_t *data, int len)
 331 {
 332     struct csrhci_s *s = (struct csrhci_s *) opaque;
 333     uint8_t *pkt = csrhci_out_packet(s, (len + 2) & ~1);        /* Align */
 334
 335     *pkt ++ = H4_EVT_PKT;
 336     memcpy(pkt, data, len);
 337
 338     csrhci_fifo_wake(s);
 339 }
 340
 341 static void csrhci_out_hci_packet_acl(void *opaque,
 342                 const uint8_t *data, int len)
 343 {
 344     struct csrhci_s *s = (struct csrhci_s *) opaque;
 345     uint8_t *pkt = csrhci_out_packet(s, (len + 2) & ~1);        /* Align */
 346
 347     *pkt ++ = H4_ACL_PKT;
 348     pkt[len & ~1] = 0;
 349     memcpy(pkt, data, len);
 350
 351     csrhci_fifo_wake(s);
 352 }
 353
 354 static int csrhci_ioctl(void *opaque, int cmd, void *arg)
 355 {
 356     QEMUSerialSetParams *ssp;
 357     struct csrhci_s *s = opaque;
 358     int prev_state = s->modem_state;
 359
 360     switch (cmd) {
 361     case CHR_IOCTL_SERIAL_SET_PARAMS:
 362         ssp = (QEMUSerialSetParams *) arg;
 363         s->baud_delay = get_ticks_per_sec() / ssp->speed;
 364         /* Moments later... (but shorter than 100ms) */
 365         s->modem_state |= CHR_TIOCM_CTS;
 366         break;
 367
 368     case CHR_IOCTL_SERIAL_GET_TIOCM:
 369         *(int *) arg = s->modem_state;
 370         break;
 371
 372     case CHR_IOCTL_SERIAL_SET_TIOCM:
 373         s->modem_state = *(int *) arg;
 374         if (~s->modem_state & prev_state & CHR_TIOCM_RTS)
 375             s->modem_state &= ~CHR_TIOCM_CTS;
 376         break;
 377
 378     default:
 379         return -ENOTSUP;
 380     }
 381     return 0;
 382 }
 383
 384 static void csrhci_reset(struct csrhci_s *s)
 385 {
 386     s->out_len = 0;
 387     s->out_size = FIFO_LEN;
 388     s->in_len = 0;
 389     s->baud_delay = get_ticks_per_sec();
 390     s->enable = 0;
 391     s->in_hdr = INT_MAX;
 392     s->in_data = INT_MAX;
 393
 394     s->modem_state = 0;
 395     /* After a while... (but sooner than 10ms) */
 396     s->modem_state |= CHR_TIOCM_CTS;
 397
 398     memset(&s->bd_addr, 0, sizeof(bdaddr_t));
 399 }
 400
 401 static void csrhci_out_tick(void *opaque)
 402 {
 403     csrhci_fifo_wake((struct csrhci_s *) opaque);
 404 }
 405
 406 static void csrhci_pins(void *opaque, int line, int level)
 407 {
 408     struct csrhci_s *s = (struct csrhci_s *) opaque;
 409     int state = s->pin_state;
 410
 411     s->pin_state &= ~(1 << line);
 412     s->pin_state |= (!!level) << line;
 413
 414     if ((state & ~s->pin_state) & (1 << csrhci_pin_reset)) {
 415         /* TODO: Disappear from lower layers */
 416         csrhci_reset(s);
 417     }
 418
 419     if (s->pin_state == 3 && state != 3) {
 420         s->enable = 1;
 421         /* TODO: Wake lower layers up */
 422     }
 423 }
 424
 425 qemu_irq *csrhci_pins_get(CharDriverState *chr)
 426 {
 427     struct csrhci_s *s = (struct csrhci_s *) chr->opaque;
 428
 429     return s->pins;
 430 }
 431
 432 CharDriverState *uart_hci_init(qemu_irq wakeup)
 433 {
 434     struct csrhci_s *s = (struct csrhci_s *)
 435             qemu_mallocz(sizeof(struct csrhci_s));
 436
 437     s->chr.opaque = s;
 438     s->chr.chr_write = csrhci_write;
 439     s->chr.chr_ioctl = csrhci_ioctl;
 440
 441     s->hci = qemu_next_hci();
 442     s->hci->opaque = s;
 443     s->hci->evt_recv = csrhci_out_hci_packet_event;
 444     s->hci->acl_recv = csrhci_out_hci_packet_acl;
 445
 446     s->out_tm = qemu_new_timer_ns(vm_clock, csrhci_out_tick, s);
 447     s->pins = qemu_allocate_irqs(csrhci_pins, s, __csrhci_pins);
 448     csrhci_reset(s);
 449
 450     return &s->chr;
 451 }