1 | /* |
2 | * Bluetooth serial HCI transport. |
3 | * CSR41814 HCI with H4p vendor extensions. |
4 | * |
5 | * Copyright (C) 2008 Andrzej Zaborowski <balrog@zabor.org> |
6 | * |
7 | * This program is free software; you can redistribute it and/or |
8 | * modify it under the terms of the GNU General Public License as |
9 | * published by the Free Software Foundation; either version 2 or |
10 | * (at your option) version 3 of the License. |
11 | * |
12 | * This program is distributed in the hope that it will be useful, |
13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
15 | * GNU General Public License for more details. |
16 | * |
17 | * You should have received a copy of the GNU General Public License along |
18 | * with this program; if not, see <http://www.gnu.org/licenses/>. |
19 | */ |
20 | |
21 | #include "qemu/osdep.h" |
22 | #include "qemu/error-report.h" |
23 | #include "qemu/module.h" |
24 | #include "chardev/char-serial.h" |
25 | #include "qemu/timer.h" |
26 | #include "qemu/bswap.h" |
27 | #include "hw/irq.h" |
28 | #include "sysemu/bt.h" |
29 | #include "hw/bt.h" |
30 | #include "qapi/error.h" |
31 | |
32 | struct csrhci_s { |
33 | Chardev parent; |
34 | int enable; |
35 | qemu_irq *pins; |
36 | int pin_state; |
37 | int modem_state; |
38 | #define FIFO_LEN 4096 |
39 | int out_start; |
40 | int out_len; |
41 | int out_size; |
42 | uint8_t outfifo[FIFO_LEN * 2]; |
43 | uint8_t inpkt[FIFO_LEN]; |
44 | enum { |
45 | CSR_HDR_LEN, |
46 | CSR_DATA_LEN, |
47 | CSR_DATA |
48 | } in_state; |
49 | int in_len; |
50 | int in_hdr; |
51 | int in_needed; |
52 | QEMUTimer *out_tm; |
53 | int64_t baud_delay; |
54 | |
55 | bdaddr_t bd_addr; |
56 | struct HCIInfo *hci; |
57 | }; |
58 | |
59 | #define TYPE_CHARDEV_HCI "chardev-hci" |
60 | #define HCI_CHARDEV(obj) OBJECT_CHECK(struct csrhci_s, (obj), TYPE_CHARDEV_HCI) |
61 | |
62 | /* H4+ packet types */ |
63 | enum { |
64 | H4_CMD_PKT = 1, |
65 | H4_ACL_PKT = 2, |
66 | H4_SCO_PKT = 3, |
67 | H4_EVT_PKT = 4, |
68 | H4_NEG_PKT = 6, |
69 | H4_ALIVE_PKT = 7, |
70 | }; |
71 | |
72 | /* CSR41814 negotiation start magic packet */ |
73 | static const uint8_t csrhci_neg_packet[] = { |
74 | H4_NEG_PKT, 10, |
75 | 0x00, 0xa0, 0x01, 0x00, 0x00, |
76 | 0x4c, 0x00, 0x96, 0x00, 0x00, |
77 | }; |
78 | |
79 | /* CSR41814 vendor-specific command OCFs */ |
80 | enum { |
81 | OCF_CSR_SEND_FIRMWARE = 0x000, |
82 | }; |
83 | |
84 | static inline void csrhci_fifo_wake(struct csrhci_s *s) |
85 | { |
86 | Chardev *chr = CHARDEV(s); |
87 | |
88 | if (!s->enable || !s->out_len) |
89 | return; |
90 | |
91 | /* XXX: Should wait for s->modem_state & CHR_TIOCM_RTS? */ |
92 | if (qemu_chr_be_can_write(chr)) { |
93 | qemu_chr_be_write(chr, s->outfifo + s->out_start++, 1); |
94 | s->out_len--; |
95 | if (s->out_start >= s->out_size) { |
96 | s->out_start = 0; |
97 | s->out_size = FIFO_LEN; |
98 | } |
99 | } |
100 | |
101 | if (s->out_len) |
102 | timer_mod(s->out_tm, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + s->baud_delay); |
103 | } |
104 | |
105 | #define csrhci_out_packetz(s, len) memset(csrhci_out_packet(s, len), 0, len) |
106 | static uint8_t *csrhci_out_packet(struct csrhci_s *s, int len) |
107 | { |
108 | int off = s->out_start + s->out_len; |
109 | |
110 | /* TODO: do the padding here, i.e. align len */ |
111 | s->out_len += len; |
112 | |
113 | if (off < FIFO_LEN) { |
114 | if (off + len > FIFO_LEN && (s->out_size = off + len) > FIFO_LEN * 2) { |
115 | error_report("%s: can't alloc %i bytes" , __func__, len); |
116 | exit(-1); |
117 | } |
118 | return s->outfifo + off; |
119 | } |
120 | |
121 | if (s->out_len > s->out_size) { |
122 | error_report("%s: can't alloc %i bytes" , __func__, len); |
123 | exit(-1); |
124 | } |
125 | |
126 | return s->outfifo + off - s->out_size; |
127 | } |
128 | |
129 | static inline uint8_t *csrhci_out_packet_csr(struct csrhci_s *s, |
130 | int type, int len) |
131 | { |
132 | uint8_t *ret = csrhci_out_packetz(s, len + 2); |
133 | |
134 | *ret ++ = type; |
135 | *ret ++ = len; |
136 | |
137 | return ret; |
138 | } |
139 | |
140 | static inline uint8_t *csrhci_out_packet_event(struct csrhci_s *s, |
141 | int evt, int len) |
142 | { |
143 | uint8_t *ret = csrhci_out_packetz(s, |
144 | len + 1 + sizeof(struct hci_event_hdr)); |
145 | |
146 | *ret ++ = H4_EVT_PKT; |
147 | ((struct hci_event_hdr *) ret)->evt = evt; |
148 | ((struct hci_event_hdr *) ret)->plen = len; |
149 | |
150 | return ret + sizeof(struct hci_event_hdr); |
151 | } |
152 | |
153 | static void csrhci_in_packet_vendor(struct csrhci_s *s, int ocf, |
154 | uint8_t *data, int len) |
155 | { |
156 | int offset; |
157 | uint8_t *rpkt; |
158 | |
159 | switch (ocf) { |
160 | case OCF_CSR_SEND_FIRMWARE: |
161 | /* Check if this is the bd_address packet */ |
162 | if (len >= 18 + 8 && data[12] == 0x01 && data[13] == 0x00) { |
163 | offset = 18; |
164 | s->bd_addr.b[0] = data[offset + 7]; /* Beyond cmd packet end(!?) */ |
165 | s->bd_addr.b[1] = data[offset + 6]; |
166 | s->bd_addr.b[2] = data[offset + 4]; |
167 | s->bd_addr.b[3] = data[offset + 0]; |
168 | s->bd_addr.b[4] = data[offset + 3]; |
169 | s->bd_addr.b[5] = data[offset + 2]; |
170 | |
171 | s->hci->bdaddr_set(s->hci, s->bd_addr.b); |
172 | error_report("%s: bd_address loaded from firmware: " |
173 | "%02x:%02x:%02x:%02x:%02x:%02x" , __func__, |
174 | s->bd_addr.b[0], s->bd_addr.b[1], s->bd_addr.b[2], |
175 | s->bd_addr.b[3], s->bd_addr.b[4], s->bd_addr.b[5]); |
176 | } |
177 | |
178 | rpkt = csrhci_out_packet_event(s, EVT_VENDOR, 11); |
179 | /* Status bytes: no error */ |
180 | rpkt[9] = 0x00; |
181 | rpkt[10] = 0x00; |
182 | break; |
183 | |
184 | default: |
185 | error_report("%s: got a bad CMD packet" , __func__); |
186 | return; |
187 | } |
188 | |
189 | csrhci_fifo_wake(s); |
190 | } |
191 | |
192 | static void csrhci_in_packet(struct csrhci_s *s, uint8_t *pkt) |
193 | { |
194 | uint8_t *rpkt; |
195 | int opc; |
196 | |
197 | switch (*pkt ++) { |
198 | case H4_CMD_PKT: |
199 | opc = le16_to_cpu(((struct hci_command_hdr *) pkt)->opcode); |
200 | if (cmd_opcode_ogf(opc) == OGF_VENDOR_CMD) { |
201 | csrhci_in_packet_vendor(s, cmd_opcode_ocf(opc), |
202 | pkt + sizeof(struct hci_command_hdr), |
203 | s->in_len - sizeof(struct hci_command_hdr) - 1); |
204 | return; |
205 | } |
206 | |
207 | /* TODO: if the command is OCF_READ_LOCAL_COMMANDS or the likes, |
208 | * we need to send it to the HCI layer and then add our supported |
209 | * commands to the returned mask (such as OGF_VENDOR_CMD). With |
210 | * bt-hci.c we could just have hooks for this kind of commands but |
211 | * we can't with bt-host.c. */ |
212 | |
213 | s->hci->cmd_send(s->hci, pkt, s->in_len - 1); |
214 | break; |
215 | |
216 | case H4_EVT_PKT: |
217 | goto bad_pkt; |
218 | |
219 | case H4_ACL_PKT: |
220 | s->hci->acl_send(s->hci, pkt, s->in_len - 1); |
221 | break; |
222 | |
223 | case H4_SCO_PKT: |
224 | s->hci->sco_send(s->hci, pkt, s->in_len - 1); |
225 | break; |
226 | |
227 | case H4_NEG_PKT: |
228 | if (s->in_hdr != sizeof(csrhci_neg_packet) || |
229 | memcmp(pkt - 1, csrhci_neg_packet, s->in_hdr)) { |
230 | error_report("%s: got a bad NEG packet" , __func__); |
231 | return; |
232 | } |
233 | pkt += 2; |
234 | |
235 | rpkt = csrhci_out_packet_csr(s, H4_NEG_PKT, 10); |
236 | |
237 | *rpkt ++ = 0x20; /* Operational settings negotiation Ok */ |
238 | memcpy(rpkt, pkt, 7); rpkt += 7; |
239 | *rpkt ++ = 0xff; |
240 | *rpkt = 0xff; |
241 | break; |
242 | |
243 | case H4_ALIVE_PKT: |
244 | if (s->in_hdr != 4 || pkt[1] != 0x55 || pkt[2] != 0x00) { |
245 | error_report("%s: got a bad ALIVE packet" , __func__); |
246 | return; |
247 | } |
248 | |
249 | rpkt = csrhci_out_packet_csr(s, H4_ALIVE_PKT, 2); |
250 | |
251 | *rpkt ++ = 0xcc; |
252 | *rpkt = 0x00; |
253 | break; |
254 | |
255 | default: |
256 | bad_pkt: |
257 | /* TODO: error out */ |
258 | error_report("%s: got a bad packet" , __func__); |
259 | break; |
260 | } |
261 | |
262 | csrhci_fifo_wake(s); |
263 | } |
264 | |
265 | static int (const uint8_t *pkt) |
266 | { |
267 | switch (pkt[0]) { |
268 | case H4_CMD_PKT: |
269 | return HCI_COMMAND_HDR_SIZE; |
270 | case H4_EVT_PKT: |
271 | return HCI_EVENT_HDR_SIZE; |
272 | case H4_ACL_PKT: |
273 | return HCI_ACL_HDR_SIZE; |
274 | case H4_SCO_PKT: |
275 | return HCI_SCO_HDR_SIZE; |
276 | case H4_NEG_PKT: |
277 | return pkt[1] + 1; |
278 | case H4_ALIVE_PKT: |
279 | return 3; |
280 | } |
281 | |
282 | exit(-1); |
283 | } |
284 | |
285 | static int csrhci_data_len(const uint8_t *pkt) |
286 | { |
287 | switch (*pkt ++) { |
288 | case H4_CMD_PKT: |
289 | /* It seems that vendor-specific command packets for H4+ are all |
290 | * one byte longer than indicated in the standard header. */ |
291 | if (le16_to_cpu(((struct hci_command_hdr *) pkt)->opcode) == 0xfc00) |
292 | return (((struct hci_command_hdr *) pkt)->plen + 1) & ~1; |
293 | |
294 | return ((struct hci_command_hdr *) pkt)->plen; |
295 | case H4_EVT_PKT: |
296 | return ((struct hci_event_hdr *) pkt)->plen; |
297 | case H4_ACL_PKT: |
298 | return le16_to_cpu(((struct hci_acl_hdr *) pkt)->dlen); |
299 | case H4_SCO_PKT: |
300 | return ((struct hci_sco_hdr *) pkt)->dlen; |
301 | case H4_NEG_PKT: |
302 | case H4_ALIVE_PKT: |
303 | return 0; |
304 | } |
305 | |
306 | exit(-1); |
307 | } |
308 | |
309 | static void csrhci_ready_for_next_inpkt(struct csrhci_s *s) |
310 | { |
311 | s->in_state = CSR_HDR_LEN; |
312 | s->in_len = 0; |
313 | s->in_needed = 2; |
314 | s->in_hdr = INT_MAX; |
315 | } |
316 | |
317 | static int csrhci_write(struct Chardev *chr, |
318 | const uint8_t *buf, int len) |
319 | { |
320 | struct csrhci_s *s = (struct csrhci_s *)chr; |
321 | int total = 0; |
322 | |
323 | if (!s->enable) |
324 | return 0; |
325 | |
326 | for (;;) { |
327 | int cnt = MIN(len, s->in_needed - s->in_len); |
328 | if (cnt) { |
329 | memcpy(s->inpkt + s->in_len, buf, cnt); |
330 | s->in_len += cnt; |
331 | buf += cnt; |
332 | len -= cnt; |
333 | total += cnt; |
334 | } |
335 | |
336 | if (s->in_len < s->in_needed) { |
337 | break; |
338 | } |
339 | |
340 | if (s->in_state == CSR_HDR_LEN) { |
341 | s->in_hdr = csrhci_header_len(s->inpkt) + 1; |
342 | assert(s->in_hdr >= s->in_needed); |
343 | s->in_needed = s->in_hdr; |
344 | s->in_state = CSR_DATA_LEN; |
345 | continue; |
346 | } |
347 | |
348 | if (s->in_state == CSR_DATA_LEN) { |
349 | s->in_needed += csrhci_data_len(s->inpkt); |
350 | /* hci_acl_hdr could specify more than 4096 bytes, so assert. */ |
351 | assert(s->in_needed <= sizeof(s->inpkt)); |
352 | s->in_state = CSR_DATA; |
353 | continue; |
354 | } |
355 | |
356 | if (s->in_state == CSR_DATA) { |
357 | csrhci_in_packet(s, s->inpkt); |
358 | csrhci_ready_for_next_inpkt(s); |
359 | } |
360 | } |
361 | |
362 | return total; |
363 | } |
364 | |
365 | static void csrhci_out_hci_packet_event(void *opaque, |
366 | const uint8_t *data, int len) |
367 | { |
368 | struct csrhci_s *s = (struct csrhci_s *) opaque; |
369 | uint8_t *pkt = csrhci_out_packet(s, (len + 2) & ~1); /* Align */ |
370 | |
371 | *pkt ++ = H4_EVT_PKT; |
372 | memcpy(pkt, data, len); |
373 | |
374 | csrhci_fifo_wake(s); |
375 | } |
376 | |
377 | static void csrhci_out_hci_packet_acl(void *opaque, |
378 | const uint8_t *data, int len) |
379 | { |
380 | struct csrhci_s *s = (struct csrhci_s *) opaque; |
381 | uint8_t *pkt = csrhci_out_packet(s, (len + 2) & ~1); /* Align */ |
382 | |
383 | *pkt ++ = H4_ACL_PKT; |
384 | pkt[len & ~1] = 0; |
385 | memcpy(pkt, data, len); |
386 | |
387 | csrhci_fifo_wake(s); |
388 | } |
389 | |
390 | static int csrhci_ioctl(struct Chardev *chr, int cmd, void *arg) |
391 | { |
392 | QEMUSerialSetParams *ssp; |
393 | struct csrhci_s *s = (struct csrhci_s *) chr; |
394 | int prev_state = s->modem_state; |
395 | |
396 | switch (cmd) { |
397 | case CHR_IOCTL_SERIAL_SET_PARAMS: |
398 | ssp = (QEMUSerialSetParams *) arg; |
399 | s->baud_delay = NANOSECONDS_PER_SECOND / ssp->speed; |
400 | /* Moments later... (but shorter than 100ms) */ |
401 | s->modem_state |= CHR_TIOCM_CTS; |
402 | break; |
403 | |
404 | case CHR_IOCTL_SERIAL_GET_TIOCM: |
405 | *(int *) arg = s->modem_state; |
406 | break; |
407 | |
408 | case CHR_IOCTL_SERIAL_SET_TIOCM: |
409 | s->modem_state = *(int *) arg; |
410 | if (~s->modem_state & prev_state & CHR_TIOCM_RTS) |
411 | s->modem_state &= ~CHR_TIOCM_CTS; |
412 | break; |
413 | |
414 | default: |
415 | return -ENOTSUP; |
416 | } |
417 | return 0; |
418 | } |
419 | |
420 | static void csrhci_reset(struct csrhci_s *s) |
421 | { |
422 | s->out_len = 0; |
423 | s->out_size = FIFO_LEN; |
424 | csrhci_ready_for_next_inpkt(s); |
425 | s->baud_delay = NANOSECONDS_PER_SECOND; |
426 | s->enable = 0; |
427 | |
428 | s->modem_state = 0; |
429 | /* After a while... (but sooner than 10ms) */ |
430 | s->modem_state |= CHR_TIOCM_CTS; |
431 | |
432 | memset(&s->bd_addr, 0, sizeof(bdaddr_t)); |
433 | } |
434 | |
435 | static void csrhci_out_tick(void *opaque) |
436 | { |
437 | csrhci_fifo_wake((struct csrhci_s *) opaque); |
438 | } |
439 | |
440 | static void csrhci_pins(void *opaque, int line, int level) |
441 | { |
442 | struct csrhci_s *s = (struct csrhci_s *) opaque; |
443 | int state = s->pin_state; |
444 | |
445 | s->pin_state &= ~(1 << line); |
446 | s->pin_state |= (!!level) << line; |
447 | |
448 | if ((state & ~s->pin_state) & (1 << csrhci_pin_reset)) { |
449 | /* TODO: Disappear from lower layers */ |
450 | csrhci_reset(s); |
451 | } |
452 | |
453 | if (s->pin_state == 3 && state != 3) { |
454 | s->enable = 1; |
455 | /* TODO: Wake lower layers up */ |
456 | } |
457 | } |
458 | |
459 | qemu_irq *csrhci_pins_get(Chardev *chr) |
460 | { |
461 | struct csrhci_s *s = (struct csrhci_s *) chr; |
462 | |
463 | return s->pins; |
464 | } |
465 | |
466 | static void csrhci_open(Chardev *chr, |
467 | ChardevBackend *backend, |
468 | bool *be_opened, |
469 | Error **errp) |
470 | { |
471 | struct csrhci_s *s = HCI_CHARDEV(chr); |
472 | |
473 | s->hci = qemu_next_hci(); |
474 | s->hci->opaque = s; |
475 | s->hci->evt_recv = csrhci_out_hci_packet_event; |
476 | s->hci->acl_recv = csrhci_out_hci_packet_acl; |
477 | |
478 | s->out_tm = timer_new_ns(QEMU_CLOCK_VIRTUAL, csrhci_out_tick, s); |
479 | s->pins = qemu_allocate_irqs(csrhci_pins, s, __csrhci_pins); |
480 | csrhci_reset(s); |
481 | *be_opened = false; |
482 | } |
483 | |
484 | static void char_hci_class_init(ObjectClass *oc, void *data) |
485 | { |
486 | ChardevClass *cc = CHARDEV_CLASS(oc); |
487 | |
488 | cc->internal = true; |
489 | cc->open = csrhci_open; |
490 | cc->chr_write = csrhci_write; |
491 | cc->chr_ioctl = csrhci_ioctl; |
492 | } |
493 | |
494 | static const TypeInfo char_hci_type_info = { |
495 | .name = TYPE_CHARDEV_HCI, |
496 | .parent = TYPE_CHARDEV, |
497 | .instance_size = sizeof(struct csrhci_s), |
498 | .class_init = char_hci_class_init, |
499 | }; |
500 | |
501 | Chardev *uart_hci_init(void) |
502 | { |
503 | return qemu_chardev_new(NULL, TYPE_CHARDEV_HCI, |
504 | NULL, NULL, &error_abort); |
505 | } |
506 | |
507 | static void register_types(void) |
508 | { |
509 | type_register_static(&char_hci_type_info); |
510 | } |
511 | |
512 | type_init(register_types); |
513 | |