]>
Commit | Line | Data |
---|---|---|
58a26b47 AZ |
1 | /* |
2 | * Bluetooth serial HCI transport. | |
3 | * CSR41814 HCI with H4p vendor extensions. | |
4 | * | |
5 | * Copyright (C) 2008 Andrzej Zaborowski <balrog@zabor.org> | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or | |
8 | * modify it under the terms of the GNU General Public License as | |
9 | * published by the Free Software Foundation; either version 2 or | |
10 | * (at your option) version 3 of the License. | |
11 | * | |
12 | * This program is distributed in the hope that it will be useful, | |
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
15 | * GNU General Public License for more details. | |
16 | * | |
fad6cb1a | 17 | * You should have received a copy of the GNU General Public License along |
8167ee88 | 18 | * with this program; if not, see <http://www.gnu.org/licenses/>. |
58a26b47 AZ |
19 | */ |
20 | ||
0430891c | 21 | #include "qemu/osdep.h" |
58a26b47 | 22 | #include "qemu-common.h" |
dccfcd0e | 23 | #include "sysemu/char.h" |
1de7afc9 | 24 | #include "qemu/timer.h" |
58369e22 | 25 | #include "qemu/bswap.h" |
83c9f4ca | 26 | #include "hw/irq.h" |
dccfcd0e | 27 | #include "sysemu/bt.h" |
83c9f4ca | 28 | #include "hw/bt.h" |
58a26b47 AZ |
29 | |
30 | struct csrhci_s { | |
31 | int enable; | |
32 | qemu_irq *pins; | |
33 | int pin_state; | |
34 | int modem_state; | |
35 | CharDriverState chr; | |
36 | #define FIFO_LEN 4096 | |
37 | int out_start; | |
38 | int out_len; | |
39 | int out_size; | |
40 | uint8_t outfifo[FIFO_LEN * 2]; | |
41 | uint8_t inpkt[FIFO_LEN]; | |
141af038 PB |
42 | enum { |
43 | CSR_HDR_LEN, | |
44 | CSR_DATA_LEN, | |
45 | CSR_DATA | |
46 | } in_state; | |
58a26b47 AZ |
47 | int in_len; |
48 | int in_hdr; | |
141af038 | 49 | int in_needed; |
58a26b47 AZ |
50 | QEMUTimer *out_tm; |
51 | int64_t baud_delay; | |
52 | ||
c227f099 | 53 | bdaddr_t bd_addr; |
58a26b47 AZ |
54 | struct HCIInfo *hci; |
55 | }; | |
56 | ||
57 | /* H4+ packet types */ | |
58 | enum { | |
59 | H4_CMD_PKT = 1, | |
60 | H4_ACL_PKT = 2, | |
61 | H4_SCO_PKT = 3, | |
62 | H4_EVT_PKT = 4, | |
63 | H4_NEG_PKT = 6, | |
64 | H4_ALIVE_PKT = 7, | |
65 | }; | |
66 | ||
67 | /* CSR41814 negotiation start magic packet */ | |
68 | static const uint8_t csrhci_neg_packet[] = { | |
69 | H4_NEG_PKT, 10, | |
70 | 0x00, 0xa0, 0x01, 0x00, 0x00, | |
71 | 0x4c, 0x00, 0x96, 0x00, 0x00, | |
72 | }; | |
73 | ||
74 | /* CSR41814 vendor-specific command OCFs */ | |
75 | enum { | |
76 | OCF_CSR_SEND_FIRMWARE = 0x000, | |
77 | }; | |
78 | ||
79 | static inline void csrhci_fifo_wake(struct csrhci_s *s) | |
80 | { | |
81 | if (!s->enable || !s->out_len) | |
82 | return; | |
83 | ||
84 | /* XXX: Should wait for s->modem_state & CHR_TIOCM_RTS? */ | |
85 | if (s->chr.chr_can_read && s->chr.chr_can_read(s->chr.handler_opaque) && | |
86 | s->chr.chr_read) { | |
87 | s->chr.chr_read(s->chr.handler_opaque, | |
88 | s->outfifo + s->out_start ++, 1); | |
89 | s->out_len --; | |
90 | if (s->out_start >= s->out_size) { | |
91 | s->out_start = 0; | |
92 | s->out_size = FIFO_LEN; | |
93 | } | |
94 | } | |
95 | ||
96 | if (s->out_len) | |
bc72ad67 | 97 | timer_mod(s->out_tm, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + s->baud_delay); |
58a26b47 AZ |
98 | } |
99 | ||
100 | #define csrhci_out_packetz(s, len) memset(csrhci_out_packet(s, len), 0, len) | |
101 | static uint8_t *csrhci_out_packet(struct csrhci_s *s, int len) | |
102 | { | |
103 | int off = s->out_start + s->out_len; | |
104 | ||
105 | /* TODO: do the padding here, i.e. align len */ | |
106 | s->out_len += len; | |
107 | ||
108 | if (off < FIFO_LEN) { | |
109 | if (off + len > FIFO_LEN && (s->out_size = off + len) > FIFO_LEN * 2) { | |
110 | fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len); | |
111 | exit(-1); | |
112 | } | |
113 | return s->outfifo + off; | |
114 | } | |
115 | ||
116 | if (s->out_len > s->out_size) { | |
117 | fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len); | |
118 | exit(-1); | |
119 | } | |
120 | ||
121 | return s->outfifo + off - s->out_size; | |
122 | } | |
123 | ||
124 | static inline uint8_t *csrhci_out_packet_csr(struct csrhci_s *s, | |
125 | int type, int len) | |
126 | { | |
127 | uint8_t *ret = csrhci_out_packetz(s, len + 2); | |
128 | ||
129 | *ret ++ = type; | |
130 | *ret ++ = len; | |
131 | ||
132 | return ret; | |
133 | } | |
134 | ||
135 | static inline uint8_t *csrhci_out_packet_event(struct csrhci_s *s, | |
136 | int evt, int len) | |
137 | { | |
138 | uint8_t *ret = csrhci_out_packetz(s, | |
139 | len + 1 + sizeof(struct hci_event_hdr)); | |
140 | ||
141 | *ret ++ = H4_EVT_PKT; | |
142 | ((struct hci_event_hdr *) ret)->evt = evt; | |
143 | ((struct hci_event_hdr *) ret)->plen = len; | |
144 | ||
145 | return ret + sizeof(struct hci_event_hdr); | |
146 | } | |
147 | ||
148 | static void csrhci_in_packet_vendor(struct csrhci_s *s, int ocf, | |
149 | uint8_t *data, int len) | |
150 | { | |
151 | int offset; | |
152 | uint8_t *rpkt; | |
153 | ||
154 | switch (ocf) { | |
155 | case OCF_CSR_SEND_FIRMWARE: | |
156 | /* Check if this is the bd_address packet */ | |
157 | if (len >= 18 + 8 && data[12] == 0x01 && data[13] == 0x00) { | |
158 | offset = 18; | |
159 | s->bd_addr.b[0] = data[offset + 7]; /* Beyond cmd packet end(!?) */ | |
160 | s->bd_addr.b[1] = data[offset + 6]; | |
161 | s->bd_addr.b[2] = data[offset + 4]; | |
162 | s->bd_addr.b[3] = data[offset + 0]; | |
163 | s->bd_addr.b[4] = data[offset + 3]; | |
164 | s->bd_addr.b[5] = data[offset + 2]; | |
165 | ||
166 | s->hci->bdaddr_set(s->hci, s->bd_addr.b); | |
167 | fprintf(stderr, "%s: bd_address loaded from firmware: " | |
168 | "%02x:%02x:%02x:%02x:%02x:%02x\n", __FUNCTION__, | |
169 | s->bd_addr.b[0], s->bd_addr.b[1], s->bd_addr.b[2], | |
170 | s->bd_addr.b[3], s->bd_addr.b[4], s->bd_addr.b[5]); | |
171 | } | |
172 | ||
173 | rpkt = csrhci_out_packet_event(s, EVT_VENDOR, 11); | |
174 | /* Status bytes: no error */ | |
175 | rpkt[9] = 0x00; | |
176 | rpkt[10] = 0x00; | |
177 | break; | |
178 | ||
179 | default: | |
180 | fprintf(stderr, "%s: got a bad CMD packet\n", __FUNCTION__); | |
181 | return; | |
182 | } | |
183 | ||
184 | csrhci_fifo_wake(s); | |
185 | } | |
186 | ||
187 | static void csrhci_in_packet(struct csrhci_s *s, uint8_t *pkt) | |
188 | { | |
189 | uint8_t *rpkt; | |
190 | int opc; | |
191 | ||
192 | switch (*pkt ++) { | |
193 | case H4_CMD_PKT: | |
194 | opc = le16_to_cpu(((struct hci_command_hdr *) pkt)->opcode); | |
195 | if (cmd_opcode_ogf(opc) == OGF_VENDOR_CMD) { | |
196 | csrhci_in_packet_vendor(s, cmd_opcode_ocf(opc), | |
197 | pkt + sizeof(struct hci_command_hdr), | |
198 | s->in_len - sizeof(struct hci_command_hdr) - 1); | |
199 | return; | |
200 | } | |
201 | ||
202 | /* TODO: if the command is OCF_READ_LOCAL_COMMANDS or the likes, | |
203 | * we need to send it to the HCI layer and then add our supported | |
204 | * commands to the returned mask (such as OGF_VENDOR_CMD). With | |
205 | * bt-hci.c we could just have hooks for this kind of commands but | |
206 | * we can't with bt-host.c. */ | |
207 | ||
208 | s->hci->cmd_send(s->hci, pkt, s->in_len - 1); | |
209 | break; | |
210 | ||
211 | case H4_EVT_PKT: | |
212 | goto bad_pkt; | |
213 | ||
214 | case H4_ACL_PKT: | |
215 | s->hci->acl_send(s->hci, pkt, s->in_len - 1); | |
216 | break; | |
217 | ||
218 | case H4_SCO_PKT: | |
219 | s->hci->sco_send(s->hci, pkt, s->in_len - 1); | |
220 | break; | |
221 | ||
222 | case H4_NEG_PKT: | |
223 | if (s->in_hdr != sizeof(csrhci_neg_packet) || | |
224 | memcmp(pkt - 1, csrhci_neg_packet, s->in_hdr)) { | |
225 | fprintf(stderr, "%s: got a bad NEG packet\n", __FUNCTION__); | |
226 | return; | |
227 | } | |
228 | pkt += 2; | |
229 | ||
230 | rpkt = csrhci_out_packet_csr(s, H4_NEG_PKT, 10); | |
231 | ||
66a0a2cb | 232 | *rpkt ++ = 0x20; /* Operational settings negotiation Ok */ |
58a26b47 AZ |
233 | memcpy(rpkt, pkt, 7); rpkt += 7; |
234 | *rpkt ++ = 0xff; | |
7300c079 | 235 | *rpkt = 0xff; |
58a26b47 AZ |
236 | break; |
237 | ||
238 | case H4_ALIVE_PKT: | |
239 | if (s->in_hdr != 4 || pkt[1] != 0x55 || pkt[2] != 0x00) { | |
240 | fprintf(stderr, "%s: got a bad ALIVE packet\n", __FUNCTION__); | |
241 | return; | |
242 | } | |
243 | ||
244 | rpkt = csrhci_out_packet_csr(s, H4_ALIVE_PKT, 2); | |
245 | ||
246 | *rpkt ++ = 0xcc; | |
7300c079 | 247 | *rpkt = 0x00; |
58a26b47 AZ |
248 | break; |
249 | ||
250 | default: | |
251 | bad_pkt: | |
252 | /* TODO: error out */ | |
253 | fprintf(stderr, "%s: got a bad packet\n", __FUNCTION__); | |
254 | break; | |
255 | } | |
256 | ||
257 | csrhci_fifo_wake(s); | |
258 | } | |
259 | ||
260 | static int csrhci_header_len(const uint8_t *pkt) | |
261 | { | |
262 | switch (pkt[0]) { | |
263 | case H4_CMD_PKT: | |
264 | return HCI_COMMAND_HDR_SIZE; | |
265 | case H4_EVT_PKT: | |
266 | return HCI_EVENT_HDR_SIZE; | |
267 | case H4_ACL_PKT: | |
268 | return HCI_ACL_HDR_SIZE; | |
269 | case H4_SCO_PKT: | |
270 | return HCI_SCO_HDR_SIZE; | |
271 | case H4_NEG_PKT: | |
272 | return pkt[1] + 1; | |
273 | case H4_ALIVE_PKT: | |
274 | return 3; | |
275 | } | |
276 | ||
277 | exit(-1); | |
278 | } | |
279 | ||
280 | static int csrhci_data_len(const uint8_t *pkt) | |
281 | { | |
282 | switch (*pkt ++) { | |
283 | case H4_CMD_PKT: | |
284 | /* It seems that vendor-specific command packets for H4+ are all | |
285 | * one byte longer than indicated in the standard header. */ | |
286 | if (le16_to_cpu(((struct hci_command_hdr *) pkt)->opcode) == 0xfc00) | |
287 | return (((struct hci_command_hdr *) pkt)->plen + 1) & ~1; | |
288 | ||
289 | return ((struct hci_command_hdr *) pkt)->plen; | |
290 | case H4_EVT_PKT: | |
291 | return ((struct hci_event_hdr *) pkt)->plen; | |
292 | case H4_ACL_PKT: | |
293 | return le16_to_cpu(((struct hci_acl_hdr *) pkt)->dlen); | |
294 | case H4_SCO_PKT: | |
295 | return ((struct hci_sco_hdr *) pkt)->dlen; | |
296 | case H4_NEG_PKT: | |
297 | case H4_ALIVE_PKT: | |
298 | return 0; | |
299 | } | |
300 | ||
301 | exit(-1); | |
302 | } | |
303 | ||
141af038 PB |
304 | static void csrhci_ready_for_next_inpkt(struct csrhci_s *s) |
305 | { | |
306 | s->in_state = CSR_HDR_LEN; | |
307 | s->in_len = 0; | |
308 | s->in_needed = 2; | |
309 | s->in_hdr = INT_MAX; | |
310 | } | |
311 | ||
58a26b47 AZ |
312 | static int csrhci_write(struct CharDriverState *chr, |
313 | const uint8_t *buf, int len) | |
314 | { | |
315 | struct csrhci_s *s = (struct csrhci_s *) chr->opaque; | |
141af038 | 316 | int total = 0; |
58a26b47 AZ |
317 | |
318 | if (!s->enable) | |
319 | return 0; | |
320 | ||
141af038 PB |
321 | for (;;) { |
322 | int cnt = MIN(len, s->in_needed - s->in_len); | |
323 | if (cnt) { | |
324 | memcpy(s->inpkt + s->in_len, buf, cnt); | |
325 | s->in_len += cnt; | |
326 | buf += cnt; | |
327 | len -= cnt; | |
328 | total += cnt; | |
329 | } | |
330 | ||
331 | if (s->in_len < s->in_needed) { | |
332 | break; | |
333 | } | |
58a26b47 | 334 | |
141af038 | 335 | if (s->in_state == CSR_HDR_LEN) { |
58a26b47 | 336 | s->in_hdr = csrhci_header_len(s->inpkt) + 1; |
141af038 PB |
337 | assert(s->in_hdr >= s->in_needed); |
338 | s->in_needed = s->in_hdr; | |
339 | s->in_state = CSR_DATA_LEN; | |
340 | continue; | |
341 | } | |
58a26b47 | 342 | |
141af038 PB |
343 | if (s->in_state == CSR_DATA_LEN) { |
344 | s->in_needed += csrhci_data_len(s->inpkt); | |
345 | /* hci_acl_hdr could specify more than 4096 bytes, so assert. */ | |
346 | assert(s->in_needed <= sizeof(s->inpkt)); | |
347 | s->in_state = CSR_DATA; | |
348 | continue; | |
349 | } | |
58a26b47 | 350 | |
141af038 | 351 | if (s->in_state == CSR_DATA) { |
58a26b47 | 352 | csrhci_in_packet(s, s->inpkt); |
141af038 PB |
353 | csrhci_ready_for_next_inpkt(s); |
354 | } | |
58a26b47 AZ |
355 | } |
356 | ||
141af038 | 357 | return total; |
58a26b47 AZ |
358 | } |
359 | ||
360 | static void csrhci_out_hci_packet_event(void *opaque, | |
361 | const uint8_t *data, int len) | |
362 | { | |
363 | struct csrhci_s *s = (struct csrhci_s *) opaque; | |
364 | uint8_t *pkt = csrhci_out_packet(s, (len + 2) & ~1); /* Align */ | |
365 | ||
366 | *pkt ++ = H4_EVT_PKT; | |
367 | memcpy(pkt, data, len); | |
368 | ||
369 | csrhci_fifo_wake(s); | |
370 | } | |
371 | ||
372 | static void csrhci_out_hci_packet_acl(void *opaque, | |
373 | const uint8_t *data, int len) | |
374 | { | |
375 | struct csrhci_s *s = (struct csrhci_s *) opaque; | |
376 | uint8_t *pkt = csrhci_out_packet(s, (len + 2) & ~1); /* Align */ | |
377 | ||
378 | *pkt ++ = H4_ACL_PKT; | |
379 | pkt[len & ~1] = 0; | |
380 | memcpy(pkt, data, len); | |
381 | ||
382 | csrhci_fifo_wake(s); | |
383 | } | |
384 | ||
385 | static int csrhci_ioctl(struct CharDriverState *chr, int cmd, void *arg) | |
386 | { | |
387 | QEMUSerialSetParams *ssp; | |
388 | struct csrhci_s *s = (struct csrhci_s *) chr->opaque; | |
389 | int prev_state = s->modem_state; | |
390 | ||
391 | switch (cmd) { | |
392 | case CHR_IOCTL_SERIAL_SET_PARAMS: | |
393 | ssp = (QEMUSerialSetParams *) arg; | |
73bcb24d | 394 | s->baud_delay = NANOSECONDS_PER_SECOND / ssp->speed; |
58a26b47 AZ |
395 | /* Moments later... (but shorter than 100ms) */ |
396 | s->modem_state |= CHR_TIOCM_CTS; | |
397 | break; | |
398 | ||
399 | case CHR_IOCTL_SERIAL_GET_TIOCM: | |
400 | *(int *) arg = s->modem_state; | |
401 | break; | |
402 | ||
403 | case CHR_IOCTL_SERIAL_SET_TIOCM: | |
404 | s->modem_state = *(int *) arg; | |
405 | if (~s->modem_state & prev_state & CHR_TIOCM_RTS) | |
406 | s->modem_state &= ~CHR_TIOCM_CTS; | |
407 | break; | |
408 | ||
409 | default: | |
410 | return -ENOTSUP; | |
411 | } | |
412 | return 0; | |
413 | } | |
414 | ||
415 | static void csrhci_reset(struct csrhci_s *s) | |
416 | { | |
417 | s->out_len = 0; | |
418 | s->out_size = FIFO_LEN; | |
141af038 | 419 | csrhci_ready_for_next_inpkt(s); |
73bcb24d | 420 | s->baud_delay = NANOSECONDS_PER_SECOND; |
58a26b47 | 421 | s->enable = 0; |
58a26b47 AZ |
422 | |
423 | s->modem_state = 0; | |
424 | /* After a while... (but sooner than 10ms) */ | |
425 | s->modem_state |= CHR_TIOCM_CTS; | |
426 | ||
c227f099 | 427 | memset(&s->bd_addr, 0, sizeof(bdaddr_t)); |
58a26b47 AZ |
428 | } |
429 | ||
430 | static void csrhci_out_tick(void *opaque) | |
431 | { | |
432 | csrhci_fifo_wake((struct csrhci_s *) opaque); | |
433 | } | |
434 | ||
435 | static void csrhci_pins(void *opaque, int line, int level) | |
436 | { | |
437 | struct csrhci_s *s = (struct csrhci_s *) opaque; | |
438 | int state = s->pin_state; | |
439 | ||
440 | s->pin_state &= ~(1 << line); | |
441 | s->pin_state |= (!!level) << line; | |
442 | ||
443 | if ((state & ~s->pin_state) & (1 << csrhci_pin_reset)) { | |
444 | /* TODO: Disappear from lower layers */ | |
445 | csrhci_reset(s); | |
446 | } | |
447 | ||
448 | if (s->pin_state == 3 && state != 3) { | |
449 | s->enable = 1; | |
450 | /* TODO: Wake lower layers up */ | |
451 | } | |
452 | } | |
453 | ||
454 | qemu_irq *csrhci_pins_get(CharDriverState *chr) | |
455 | { | |
456 | struct csrhci_s *s = (struct csrhci_s *) chr->opaque; | |
457 | ||
458 | return s->pins; | |
459 | } | |
460 | ||
461 | CharDriverState *uart_hci_init(qemu_irq wakeup) | |
462 | { | |
463 | struct csrhci_s *s = (struct csrhci_s *) | |
7267c094 | 464 | g_malloc0(sizeof(struct csrhci_s)); |
58a26b47 AZ |
465 | |
466 | s->chr.opaque = s; | |
467 | s->chr.chr_write = csrhci_write; | |
468 | s->chr.chr_ioctl = csrhci_ioctl; | |
456d6069 | 469 | s->chr.avail_connections = 1; |
58a26b47 AZ |
470 | |
471 | s->hci = qemu_next_hci(); | |
472 | s->hci->opaque = s; | |
473 | s->hci->evt_recv = csrhci_out_hci_packet_event; | |
474 | s->hci->acl_recv = csrhci_out_hci_packet_acl; | |
475 | ||
bc72ad67 | 476 | s->out_tm = timer_new_ns(QEMU_CLOCK_VIRTUAL, csrhci_out_tick, s); |
58a26b47 AZ |
477 | s->pins = qemu_allocate_irqs(csrhci_pins, s, __csrhci_pins); |
478 | csrhci_reset(s); | |
479 | ||
480 | return &s->chr; | |
481 | } |