]> git.proxmox.com Git - mirror_qemu.git/blame - hw/bt-hci-csr.c
CRIS: Dont flush kernel protected pages when modifying $pid.
[mirror_qemu.git] / hw / bt-hci-csr.c
CommitLineData
58a26b47
AZ
1/*
2 * Bluetooth serial HCI transport.
3 * CSR41814 HCI with H4p vendor extensions.
4 *
5 * Copyright (C) 2008 Andrzej Zaborowski <balrog@zabor.org>
6 *
7 * This program is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU General Public License as
9 * published by the Free Software Foundation; either version 2 or
10 * (at your option) version 3 of the License.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, write to the Free Software
19 * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
20 * MA 02111-1307 USA
21 */
22
23#include "qemu-common.h"
24#include "qemu-char.h"
25#include "qemu-timer.h"
26#include "irq.h"
27#include "sysemu.h"
28#include "net.h"
29#include "bt.h"
30
31struct csrhci_s {
32 int enable;
33 qemu_irq *pins;
34 int pin_state;
35 int modem_state;
36 CharDriverState chr;
37#define FIFO_LEN 4096
38 int out_start;
39 int out_len;
40 int out_size;
41 uint8_t outfifo[FIFO_LEN * 2];
42 uint8_t inpkt[FIFO_LEN];
43 int in_len;
44 int in_hdr;
45 int in_data;
46 QEMUTimer *out_tm;
47 int64_t baud_delay;
48
49 bdaddr_t bd_addr;
50 struct HCIInfo *hci;
51};
52
53/* H4+ packet types */
54enum {
55 H4_CMD_PKT = 1,
56 H4_ACL_PKT = 2,
57 H4_SCO_PKT = 3,
58 H4_EVT_PKT = 4,
59 H4_NEG_PKT = 6,
60 H4_ALIVE_PKT = 7,
61};
62
63/* CSR41814 negotiation start magic packet */
64static const uint8_t csrhci_neg_packet[] = {
65 H4_NEG_PKT, 10,
66 0x00, 0xa0, 0x01, 0x00, 0x00,
67 0x4c, 0x00, 0x96, 0x00, 0x00,
68};
69
70/* CSR41814 vendor-specific command OCFs */
71enum {
72 OCF_CSR_SEND_FIRMWARE = 0x000,
73};
74
75static inline void csrhci_fifo_wake(struct csrhci_s *s)
76{
77 if (!s->enable || !s->out_len)
78 return;
79
80 /* XXX: Should wait for s->modem_state & CHR_TIOCM_RTS? */
81 if (s->chr.chr_can_read && s->chr.chr_can_read(s->chr.handler_opaque) &&
82 s->chr.chr_read) {
83 s->chr.chr_read(s->chr.handler_opaque,
84 s->outfifo + s->out_start ++, 1);
85 s->out_len --;
86 if (s->out_start >= s->out_size) {
87 s->out_start = 0;
88 s->out_size = FIFO_LEN;
89 }
90 }
91
92 if (s->out_len)
93 qemu_mod_timer(s->out_tm, qemu_get_clock(vm_clock) + s->baud_delay);
94}
95
96#define csrhci_out_packetz(s, len) memset(csrhci_out_packet(s, len), 0, len)
97static uint8_t *csrhci_out_packet(struct csrhci_s *s, int len)
98{
99 int off = s->out_start + s->out_len;
100
101 /* TODO: do the padding here, i.e. align len */
102 s->out_len += len;
103
104 if (off < FIFO_LEN) {
105 if (off + len > FIFO_LEN && (s->out_size = off + len) > FIFO_LEN * 2) {
106 fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
107 exit(-1);
108 }
109 return s->outfifo + off;
110 }
111
112 if (s->out_len > s->out_size) {
113 fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
114 exit(-1);
115 }
116
117 return s->outfifo + off - s->out_size;
118}
119
120static inline uint8_t *csrhci_out_packet_csr(struct csrhci_s *s,
121 int type, int len)
122{
123 uint8_t *ret = csrhci_out_packetz(s, len + 2);
124
125 *ret ++ = type;
126 *ret ++ = len;
127
128 return ret;
129}
130
131static inline uint8_t *csrhci_out_packet_event(struct csrhci_s *s,
132 int evt, int len)
133{
134 uint8_t *ret = csrhci_out_packetz(s,
135 len + 1 + sizeof(struct hci_event_hdr));
136
137 *ret ++ = H4_EVT_PKT;
138 ((struct hci_event_hdr *) ret)->evt = evt;
139 ((struct hci_event_hdr *) ret)->plen = len;
140
141 return ret + sizeof(struct hci_event_hdr);
142}
143
144static void csrhci_in_packet_vendor(struct csrhci_s *s, int ocf,
145 uint8_t *data, int len)
146{
147 int offset;
148 uint8_t *rpkt;
149
150 switch (ocf) {
151 case OCF_CSR_SEND_FIRMWARE:
152 /* Check if this is the bd_address packet */
153 if (len >= 18 + 8 && data[12] == 0x01 && data[13] == 0x00) {
154 offset = 18;
155 s->bd_addr.b[0] = data[offset + 7]; /* Beyond cmd packet end(!?) */
156 s->bd_addr.b[1] = data[offset + 6];
157 s->bd_addr.b[2] = data[offset + 4];
158 s->bd_addr.b[3] = data[offset + 0];
159 s->bd_addr.b[4] = data[offset + 3];
160 s->bd_addr.b[5] = data[offset + 2];
161
162 s->hci->bdaddr_set(s->hci, s->bd_addr.b);
163 fprintf(stderr, "%s: bd_address loaded from firmware: "
164 "%02x:%02x:%02x:%02x:%02x:%02x\n", __FUNCTION__,
165 s->bd_addr.b[0], s->bd_addr.b[1], s->bd_addr.b[2],
166 s->bd_addr.b[3], s->bd_addr.b[4], s->bd_addr.b[5]);
167 }
168
169 rpkt = csrhci_out_packet_event(s, EVT_VENDOR, 11);
170 /* Status bytes: no error */
171 rpkt[9] = 0x00;
172 rpkt[10] = 0x00;
173 break;
174
175 default:
176 fprintf(stderr, "%s: got a bad CMD packet\n", __FUNCTION__);
177 return;
178 }
179
180 csrhci_fifo_wake(s);
181}
182
183static void csrhci_in_packet(struct csrhci_s *s, uint8_t *pkt)
184{
185 uint8_t *rpkt;
186 int opc;
187
188 switch (*pkt ++) {
189 case H4_CMD_PKT:
190 opc = le16_to_cpu(((struct hci_command_hdr *) pkt)->opcode);
191 if (cmd_opcode_ogf(opc) == OGF_VENDOR_CMD) {
192 csrhci_in_packet_vendor(s, cmd_opcode_ocf(opc),
193 pkt + sizeof(struct hci_command_hdr),
194 s->in_len - sizeof(struct hci_command_hdr) - 1);
195 return;
196 }
197
198 /* TODO: if the command is OCF_READ_LOCAL_COMMANDS or the likes,
199 * we need to send it to the HCI layer and then add our supported
200 * commands to the returned mask (such as OGF_VENDOR_CMD). With
201 * bt-hci.c we could just have hooks for this kind of commands but
202 * we can't with bt-host.c. */
203
204 s->hci->cmd_send(s->hci, pkt, s->in_len - 1);
205 break;
206
207 case H4_EVT_PKT:
208 goto bad_pkt;
209
210 case H4_ACL_PKT:
211 s->hci->acl_send(s->hci, pkt, s->in_len - 1);
212 break;
213
214 case H4_SCO_PKT:
215 s->hci->sco_send(s->hci, pkt, s->in_len - 1);
216 break;
217
218 case H4_NEG_PKT:
219 if (s->in_hdr != sizeof(csrhci_neg_packet) ||
220 memcmp(pkt - 1, csrhci_neg_packet, s->in_hdr)) {
221 fprintf(stderr, "%s: got a bad NEG packet\n", __FUNCTION__);
222 return;
223 }
224 pkt += 2;
225
226 rpkt = csrhci_out_packet_csr(s, H4_NEG_PKT, 10);
227
228 *rpkt ++ = 0x20; /* Operational settings negotation Ok */
229 memcpy(rpkt, pkt, 7); rpkt += 7;
230 *rpkt ++ = 0xff;
231 *rpkt ++ = 0xff;
232 break;
233
234 case H4_ALIVE_PKT:
235 if (s->in_hdr != 4 || pkt[1] != 0x55 || pkt[2] != 0x00) {
236 fprintf(stderr, "%s: got a bad ALIVE packet\n", __FUNCTION__);
237 return;
238 }
239
240 rpkt = csrhci_out_packet_csr(s, H4_ALIVE_PKT, 2);
241
242 *rpkt ++ = 0xcc;
243 *rpkt ++ = 0x00;
244 break;
245
246 default:
247 bad_pkt:
248 /* TODO: error out */
249 fprintf(stderr, "%s: got a bad packet\n", __FUNCTION__);
250 break;
251 }
252
253 csrhci_fifo_wake(s);
254}
255
256static int csrhci_header_len(const uint8_t *pkt)
257{
258 switch (pkt[0]) {
259 case H4_CMD_PKT:
260 return HCI_COMMAND_HDR_SIZE;
261 case H4_EVT_PKT:
262 return HCI_EVENT_HDR_SIZE;
263 case H4_ACL_PKT:
264 return HCI_ACL_HDR_SIZE;
265 case H4_SCO_PKT:
266 return HCI_SCO_HDR_SIZE;
267 case H4_NEG_PKT:
268 return pkt[1] + 1;
269 case H4_ALIVE_PKT:
270 return 3;
271 }
272
273 exit(-1);
274}
275
276static int csrhci_data_len(const uint8_t *pkt)
277{
278 switch (*pkt ++) {
279 case H4_CMD_PKT:
280 /* It seems that vendor-specific command packets for H4+ are all
281 * one byte longer than indicated in the standard header. */
282 if (le16_to_cpu(((struct hci_command_hdr *) pkt)->opcode) == 0xfc00)
283 return (((struct hci_command_hdr *) pkt)->plen + 1) & ~1;
284
285 return ((struct hci_command_hdr *) pkt)->plen;
286 case H4_EVT_PKT:
287 return ((struct hci_event_hdr *) pkt)->plen;
288 case H4_ACL_PKT:
289 return le16_to_cpu(((struct hci_acl_hdr *) pkt)->dlen);
290 case H4_SCO_PKT:
291 return ((struct hci_sco_hdr *) pkt)->dlen;
292 case H4_NEG_PKT:
293 case H4_ALIVE_PKT:
294 return 0;
295 }
296
297 exit(-1);
298}
299
300static int csrhci_write(struct CharDriverState *chr,
301 const uint8_t *buf, int len)
302{
303 struct csrhci_s *s = (struct csrhci_s *) chr->opaque;
304 int plen = s->in_len;
305
306 if (!s->enable)
307 return 0;
308
309 s->in_len += len;
310 memcpy(s->inpkt + plen, buf, len);
311
312 while (1) {
313 if (s->in_len >= 2 && plen < 2)
314 s->in_hdr = csrhci_header_len(s->inpkt) + 1;
315
316 if (s->in_len >= s->in_hdr && plen < s->in_hdr)
317 s->in_data = csrhci_data_len(s->inpkt) + s->in_hdr;
318
319 if (s->in_len >= s->in_data) {
320 csrhci_in_packet(s, s->inpkt);
321
322 memmove(s->inpkt, s->inpkt + s->in_len, s->in_len - s->in_data);
323 s->in_len -= s->in_data;
324 s->in_hdr = INT_MAX;
325 s->in_data = INT_MAX;
326 plen = 0;
327 } else
328 break;
329 }
330
331 return len;
332}
333
334static void csrhci_out_hci_packet_event(void *opaque,
335 const uint8_t *data, int len)
336{
337 struct csrhci_s *s = (struct csrhci_s *) opaque;
338 uint8_t *pkt = csrhci_out_packet(s, (len + 2) & ~1); /* Align */
339
340 *pkt ++ = H4_EVT_PKT;
341 memcpy(pkt, data, len);
342
343 csrhci_fifo_wake(s);
344}
345
346static void csrhci_out_hci_packet_acl(void *opaque,
347 const uint8_t *data, int len)
348{
349 struct csrhci_s *s = (struct csrhci_s *) opaque;
350 uint8_t *pkt = csrhci_out_packet(s, (len + 2) & ~1); /* Align */
351
352 *pkt ++ = H4_ACL_PKT;
353 pkt[len & ~1] = 0;
354 memcpy(pkt, data, len);
355
356 csrhci_fifo_wake(s);
357}
358
359static int csrhci_ioctl(struct CharDriverState *chr, int cmd, void *arg)
360{
361 QEMUSerialSetParams *ssp;
362 struct csrhci_s *s = (struct csrhci_s *) chr->opaque;
363 int prev_state = s->modem_state;
364
365 switch (cmd) {
366 case CHR_IOCTL_SERIAL_SET_PARAMS:
367 ssp = (QEMUSerialSetParams *) arg;
368 s->baud_delay = ticks_per_sec / ssp->speed;
369 /* Moments later... (but shorter than 100ms) */
370 s->modem_state |= CHR_TIOCM_CTS;
371 break;
372
373 case CHR_IOCTL_SERIAL_GET_TIOCM:
374 *(int *) arg = s->modem_state;
375 break;
376
377 case CHR_IOCTL_SERIAL_SET_TIOCM:
378 s->modem_state = *(int *) arg;
379 if (~s->modem_state & prev_state & CHR_TIOCM_RTS)
380 s->modem_state &= ~CHR_TIOCM_CTS;
381 break;
382
383 default:
384 return -ENOTSUP;
385 }
386 return 0;
387}
388
389static void csrhci_reset(struct csrhci_s *s)
390{
391 s->out_len = 0;
392 s->out_size = FIFO_LEN;
393 s->in_len = 0;
394 s->baud_delay = ticks_per_sec;
395 s->enable = 0;
396 s->in_hdr = INT_MAX;
397 s->in_data = INT_MAX;
398
399 s->modem_state = 0;
400 /* After a while... (but sooner than 10ms) */
401 s->modem_state |= CHR_TIOCM_CTS;
402
403 memset(&s->bd_addr, 0, sizeof(bdaddr_t));
404}
405
406static void csrhci_out_tick(void *opaque)
407{
408 csrhci_fifo_wake((struct csrhci_s *) opaque);
409}
410
411static void csrhci_pins(void *opaque, int line, int level)
412{
413 struct csrhci_s *s = (struct csrhci_s *) opaque;
414 int state = s->pin_state;
415
416 s->pin_state &= ~(1 << line);
417 s->pin_state |= (!!level) << line;
418
419 if ((state & ~s->pin_state) & (1 << csrhci_pin_reset)) {
420 /* TODO: Disappear from lower layers */
421 csrhci_reset(s);
422 }
423
424 if (s->pin_state == 3 && state != 3) {
425 s->enable = 1;
426 /* TODO: Wake lower layers up */
427 }
428}
429
430qemu_irq *csrhci_pins_get(CharDriverState *chr)
431{
432 struct csrhci_s *s = (struct csrhci_s *) chr->opaque;
433
434 return s->pins;
435}
436
437CharDriverState *uart_hci_init(qemu_irq wakeup)
438{
439 struct csrhci_s *s = (struct csrhci_s *)
440 qemu_mallocz(sizeof(struct csrhci_s));
441
442 s->chr.opaque = s;
443 s->chr.chr_write = csrhci_write;
444 s->chr.chr_ioctl = csrhci_ioctl;
445
446 s->hci = qemu_next_hci();
447 s->hci->opaque = s;
448 s->hci->evt_recv = csrhci_out_hci_packet_event;
449 s->hci->acl_recv = csrhci_out_hci_packet_acl;
450
451 s->out_tm = qemu_new_timer(vm_clock, csrhci_out_tick, s);
452 s->pins = qemu_allocate_irqs(csrhci_pins, s, __csrhci_pins);
453 csrhci_reset(s);
454
455 return &s->chr;
456}