1/*
2 * QEMU Bluetooth HCI helpers.
3 *
4 * Copyright (C) 2007 OpenMoko, Inc.
5 * Written by Andrzej Zaborowski <andrew@openedhand.com>
6 *
7 * Useful definitions taken from BlueZ project's headers.
8 * Copyright (C) 2000-2001 Qualcomm Incorporated
9 * Copyright (C) 2002-2003 Maxim Krasnyansky <maxk@qualcomm.com>
10 * Copyright (C) 2002-2006 Marcel Holtmann <marcel@holtmann.org>
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License as
14 * published by the Free Software Foundation; either version 2 of
15 * the License, or (at your option) any later version.
16 *
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
21 *
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, see <http://www.gnu.org/licenses/>.
24 */
25
26#ifndef HW_BT_H
27#define HW_BT_H
28
29
30/* BD Address */
31typedef struct {
32 uint8_t b[6];
33} QEMU_PACKED bdaddr_t;
34
35#define BDADDR_ANY (&(bdaddr_t) {{0, 0, 0, 0, 0, 0}})
36#define BDADDR_ALL (&(bdaddr_t) {{0xff, 0xff, 0xff, 0xff, 0xff, 0xff}})
37#define BDADDR_LOCAL (&(bdaddr_t) {{0, 0, 0, 0xff, 0xff, 0xff}})
38
39/* Copy, swap, convert BD Address */
40static inline int bacmp(const bdaddr_t *ba1, const bdaddr_t *ba2)
41{
42 return memcmp(ba1, ba2, sizeof(bdaddr_t));
43}
44static inline void bacpy(bdaddr_t *dst, const bdaddr_t *src)
45{
46 memcpy(dst, src, sizeof(bdaddr_t));
47}
48
49#define BAINIT(orig) { .b = { \
50 (orig)->b[0], (orig)->b[1], (orig)->b[2], \
51 (orig)->b[3], (orig)->b[4], (orig)->b[5], \
52}, }
53
54/* The twisted structures of a bluetooth environment */
55struct bt_device_s;
56struct bt_scatternet_s;
57struct bt_piconet_s;
58struct bt_link_s;
59
60struct bt_scatternet_s {
61 struct bt_device_s *slave;
62};
63
64struct bt_link_s {
65 struct bt_device_s *slave, *host;
66 uint16_t handle; /* Master (host) side handle */
67 uint16_t acl_interval;
68 enum {
69 acl_active,
70 acl_hold,
71 acl_sniff,
72 acl_parked,
73 } acl_mode;
74};
75
76struct bt_device_s {
77 int lt_addr;
78 bdaddr_t bd_addr;
79 int mtu;
80 int setup;
81 struct bt_scatternet_s *net;
82
83 uint8_t key[16];
84 int key_present;
85 uint8_t class[3];
86
87 uint8_t reject_reason;
88
89 uint64_t lmp_caps;
90 const char *lmp_name;
91 void (*lmp_connection_request)(struct bt_link_s *link);
92 void (*lmp_connection_complete)(struct bt_link_s *link);
93 void (*lmp_disconnect_master)(struct bt_link_s *link);
94 void (*lmp_disconnect_slave)(struct bt_link_s *link);
95 void (*lmp_acl_data)(struct bt_link_s *link, const uint8_t *data,
96 int start, int len);
97 void (*lmp_acl_resp)(struct bt_link_s *link, const uint8_t *data,
98 int start, int len);
99 void (*lmp_mode_change)(struct bt_link_s *link);
100
101 void (*handle_destroy)(struct bt_device_s *device);
102 struct bt_device_s *next; /* Next in the piconet/scatternet */
103
104 int inquiry_scan;
105 int page_scan;
106
107 uint16_t clkoff; /* Note: Always little-endian */
108};
109
110extern struct HCIInfo null_hci;
111/* bt.c */
112void bt_device_init(struct bt_device_s *dev, struct bt_scatternet_s *net);
113void bt_device_done(struct bt_device_s *dev);
114struct bt_scatternet_s *qemu_find_bt_vlan(int id);
115
116/* bt-hci.c */
117struct HCIInfo *bt_new_hci(struct bt_scatternet_s *net);
118struct HCIInfo *hci_init(const char *str);
119
120/* bt-vhci.c */
121void bt_vhci_init(struct HCIInfo *info);
122
123/* bt-hci-csr.c */
124enum {
125 csrhci_pin_reset,
126 csrhci_pin_wakeup,
127 __csrhci_pins,
128};
129qemu_irq *csrhci_pins_get(Chardev *chr);
130Chardev *uart_hci_init(void);
131
132/* bt-l2cap.c */
133struct bt_l2cap_device_s;
134struct bt_l2cap_conn_params_s;
135struct bt_l2cap_psm_s;
136void bt_l2cap_device_init(struct bt_l2cap_device_s *dev,
137 struct bt_scatternet_s *net);
138void bt_l2cap_device_done(struct bt_l2cap_device_s *dev);
139void bt_l2cap_psm_register(struct bt_l2cap_device_s *dev, int psm,
140 int min_mtu, int (*new_channel)(struct bt_l2cap_device_s *dev,
141 struct bt_l2cap_conn_params_s *params));
142
143struct bt_l2cap_device_s {
144 struct bt_device_s device;
145 struct bt_l2cap_psm_s *first_psm;
146};
147
148struct bt_l2cap_conn_params_s {
149 /* Input */
150 uint8_t *(*sdu_out)(struct bt_l2cap_conn_params_s *chan, int len);
151 void (*sdu_submit)(struct bt_l2cap_conn_params_s *chan);
152 int remote_mtu;
153 /* Output */
154 void *opaque;
155 void (*sdu_in)(void *opaque, const uint8_t *data, int len);
156 void (*close)(void *opaque);
157};
158
159enum bt_l2cap_psm_predef {
160 BT_PSM_SDP = 0x0001,
161 BT_PSM_RFCOMM = 0x0003,
162 BT_PSM_TELEPHONY = 0x0005,
163 BT_PSM_TCS = 0x0007,
164 BT_PSM_BNEP = 0x000f,
165 BT_PSM_HID_CTRL = 0x0011,
166 BT_PSM_HID_INTR = 0x0013,
167 BT_PSM_UPNP = 0x0015,
168 BT_PSM_AVCTP = 0x0017,
169 BT_PSM_AVDTP = 0x0019,
170};
171
172/* bt-sdp.c */
173void bt_l2cap_sdp_init(struct bt_l2cap_device_s *dev);
174
175/* bt-hid.c */
176struct bt_device_s *bt_keyboard_init(struct bt_scatternet_s *net);
177
178/* Link Management Protocol layer defines */
179
180#define LLID_ACLU_CONT 0x1
181#define LLID_ACLU_START 0x2
182#define LLID_ACLC 0x3
183
184enum lmp_pdu_type {
185 LMP_NAME_REQ = 0x0001,
186 LMP_NAME_RES = 0x0002,
187 LMP_ACCEPTED = 0x0003,
188 LMP_NOT_ACCEPTED = 0x0004,
189 LMP_CLKOFFSET_REQ = 0x0005,
190 LMP_CLKOFFSET_RES = 0x0006,
191 LMP_DETACH = 0x0007,
192 LMP_IN_RAND = 0x0008,
193 LMP_COMB_KEY = 0x0009,
194 LMP_UNIT_KEY = 0x000a,
195 LMP_AU_RAND = 0x000b,
196 LMP_SRES = 0x000c,
197 LMP_TEMP_RAND = 0x000d,
198 LMP_TEMP_KEY = 0x000e,
199 LMP_CRYPT_MODE_REQ = 0x000f,
200 LMP_CRYPT_KEY_SIZE_REQ = 0x0010,
201 LMP_START_ENCRYPT_REQ = 0x0011,
202 LMP_STOP_ENCRYPT_REQ = 0x0012,
203 LMP_SWITCH_REQ = 0x0013,
204 LMP_HOLD = 0x0014,
205 LMP_HOLD_REQ = 0x0015,
206 LMP_SNIFF_REQ = 0x0017,
207 LMP_UNSNIFF_REQ = 0x0018,
208 LMP_LMP_PARK_REQ = 0x0019,
209 LMP_SET_BCAST_SCAN_WND = 0x001b,
210 LMP_MODIFY_BEACON = 0x001c,
211 LMP_UNPARK_BD_ADDR_REQ = 0x001d,
212 LMP_UNPARK_PM_ADDR_REQ = 0x001e,
213 LMP_INCR_POWER_REQ = 0x001f,
214 LMP_DECR_POWER_REQ = 0x0020,
215 LMP_MAX_POWER = 0x0021,
216 LMP_MIN_POWER = 0x0022,
217 LMP_AUTO_RATE = 0x0023,
218 LMP_PREFERRED_RATE = 0x0024,
219 LMP_VERSION_REQ = 0x0025,
220 LMP_VERSION_RES = 0x0026,
221 LMP_FEATURES_REQ = 0x0027,
222 LMP_FEATURES_RES = 0x0028,
223 LMP_QUALITY_OF_SERVICE = 0x0029,
224 LMP_QOS_REQ = 0x002a,
225 LMP_RM_SCO_LINK_REQ = 0x002b,
226 LMP_SCO_LINK_REQ = 0x002c,
227 LMP_MAX_SLOT = 0x002d,
228 LMP_MAX_SLOT_REQ = 0x002e,
229 LMP_TIMING_ACCURACY_REQ = 0x002f,
230 LMP_TIMING_ACCURACY_RES = 0x0030,
231 LMP_SETUP_COMPLETE = 0x0031,
232 LMP_USE_SEMIPERM_KEY = 0x0032,
233 LMP_HOST_CONNECTION_REQ = 0x0033,
234 LMP_SLOT_OFFSET = 0x0034,
235 LMP_PAGE_MODE_REQ = 0x0035,
236 LMP_PAGE_SCAN_MODE_REQ = 0x0036,
237 LMP_SUPERVISION_TIMEOUT = 0x0037,
238 LMP_TEST_ACTIVATE = 0x0038,
239 LMP_TEST_CONTROL = 0x0039,
240 LMP_CRYPT_KEY_MASK_REQ = 0x003a,
241 LMP_CRYPT_KEY_MASK_RES = 0x003b,
242 LMP_SET_AFH = 0x003c,
243 LMP_ACCEPTED_EXT = 0x7f01,
244 LMP_NOT_ACCEPTED_EXT = 0x7f02,
245 LMP_FEATURES_REQ_EXT = 0x7f03,
246 LMP_FEATURES_RES_EXT = 0x7f04,
247 LMP_PACKET_TYPE_TBL_REQ = 0x7f0b,
248 LMP_ESCO_LINK_REQ = 0x7f0c,
249 LMP_RM_ESCO_LINK_REQ = 0x7f0d,
250 LMP_CHANNEL_CLASS_REQ = 0x7f10,
251 LMP_CHANNEL_CLASS = 0x7f11,
252};
253
254/* Host Controller Interface layer defines */
255
256enum hci_packet_type {
257 HCI_COMMAND_PKT = 0x01,
258 HCI_ACLDATA_PKT = 0x02,
259 HCI_SCODATA_PKT = 0x03,
260 HCI_EVENT_PKT = 0x04,
261 HCI_VENDOR_PKT = 0xff,
262};
263
264enum bt_packet_type {
265 HCI_2DH1 = 1 << 1,
266 HCI_3DH1 = 1 << 2,
267 HCI_DM1 = 1 << 3,
268 HCI_DH1 = 1 << 4,
269 HCI_2DH3 = 1 << 8,
270 HCI_3DH3 = 1 << 9,
271 HCI_DM3 = 1 << 10,
272 HCI_DH3 = 1 << 11,
273 HCI_2DH5 = 1 << 12,
274 HCI_3DH5 = 1 << 13,
275 HCI_DM5 = 1 << 14,
276 HCI_DH5 = 1 << 15,
277};
278
279enum sco_packet_type {
280 HCI_HV1 = 1 << 5,
281 HCI_HV2 = 1 << 6,
282 HCI_HV3 = 1 << 7,
283};
284
285enum ev_packet_type {
286 HCI_EV3 = 1 << 3,
287 HCI_EV4 = 1 << 4,
288 HCI_EV5 = 1 << 5,
289 HCI_2EV3 = 1 << 6,
290 HCI_3EV3 = 1 << 7,
291 HCI_2EV5 = 1 << 8,
292 HCI_3EV5 = 1 << 9,
293};
294
295enum hci_error_code {
296 HCI_SUCCESS = 0x00,
297 HCI_UNKNOWN_COMMAND = 0x01,
298 HCI_NO_CONNECTION = 0x02,
299 HCI_HARDWARE_FAILURE = 0x03,
300 HCI_PAGE_TIMEOUT = 0x04,
301 HCI_AUTHENTICATION_FAILURE = 0x05,
302 HCI_PIN_OR_KEY_MISSING = 0x06,
303 HCI_MEMORY_FULL = 0x07,
304 HCI_CONNECTION_TIMEOUT = 0x08,
305 HCI_MAX_NUMBER_OF_CONNECTIONS = 0x09,
306 HCI_MAX_NUMBER_OF_SCO_CONNECTIONS = 0x0a,
307 HCI_ACL_CONNECTION_EXISTS = 0x0b,
308 HCI_COMMAND_DISALLOWED = 0x0c,
309 HCI_REJECTED_LIMITED_RESOURCES = 0x0d,
310 HCI_REJECTED_SECURITY = 0x0e,
311 HCI_REJECTED_PERSONAL = 0x0f,
312 HCI_HOST_TIMEOUT = 0x10,
313 HCI_UNSUPPORTED_FEATURE = 0x11,
314 HCI_INVALID_PARAMETERS = 0x12,
315 HCI_OE_USER_ENDED_CONNECTION = 0x13,
316 HCI_OE_LOW_RESOURCES = 0x14,
317 HCI_OE_POWER_OFF = 0x15,
318 HCI_CONNECTION_TERMINATED = 0x16,
319 HCI_REPEATED_ATTEMPTS = 0x17,
320 HCI_PAIRING_NOT_ALLOWED = 0x18,
321 HCI_UNKNOWN_LMP_PDU = 0x19,
322 HCI_UNSUPPORTED_REMOTE_FEATURE = 0x1a,
323 HCI_SCO_OFFSET_REJECTED = 0x1b,
324 HCI_SCO_INTERVAL_REJECTED = 0x1c,
325 HCI_AIR_MODE_REJECTED = 0x1d,
326 HCI_INVALID_LMP_PARAMETERS = 0x1e,
327 HCI_UNSPECIFIED_ERROR = 0x1f,
328 HCI_UNSUPPORTED_LMP_PARAMETER_VALUE = 0x20,
329 HCI_ROLE_CHANGE_NOT_ALLOWED = 0x21,
330 HCI_LMP_RESPONSE_TIMEOUT = 0x22,
331 HCI_LMP_ERROR_TRANSACTION_COLLISION = 0x23,
332 HCI_LMP_PDU_NOT_ALLOWED = 0x24,
333 HCI_ENCRYPTION_MODE_NOT_ACCEPTED = 0x25,
334 HCI_UNIT_LINK_KEY_USED = 0x26,
335 HCI_QOS_NOT_SUPPORTED = 0x27,
336 HCI_INSTANT_PASSED = 0x28,
337 HCI_PAIRING_NOT_SUPPORTED = 0x29,
338 HCI_TRANSACTION_COLLISION = 0x2a,
339 HCI_QOS_UNACCEPTABLE_PARAMETER = 0x2c,
340 HCI_QOS_REJECTED = 0x2d,
341 HCI_CLASSIFICATION_NOT_SUPPORTED = 0x2e,
342 HCI_INSUFFICIENT_SECURITY = 0x2f,
343 HCI_PARAMETER_OUT_OF_RANGE = 0x30,
344 HCI_ROLE_SWITCH_PENDING = 0x32,
345 HCI_SLOT_VIOLATION = 0x34,
346 HCI_ROLE_SWITCH_FAILED = 0x35,
347};
348
349enum acl_flag_bits {
350 ACL_CONT = 1 << 0,
351 ACL_START = 1 << 1,
352 ACL_ACTIVE_BCAST = 1 << 2,
353 ACL_PICO_BCAST = 1 << 3,
354};
355
356enum baseband_link_type {
357 SCO_LINK = 0x00,
358 ACL_LINK = 0x01,
359};
360
361enum lmp_feature_bits0 {
362 LMP_3SLOT = 1 << 0,
363 LMP_5SLOT = 1 << 1,
364 LMP_ENCRYPT = 1 << 2,
365 LMP_SOFFSET = 1 << 3,
366 LMP_TACCURACY = 1 << 4,
367 LMP_RSWITCH = 1 << 5,
368 LMP_HOLD_MODE = 1 << 6,
369 LMP_SNIFF_MODE = 1 << 7,
370};
371
372enum lmp_feature_bits1 {
373 LMP_PARK = 1 << 0,
374 LMP_RSSI = 1 << 1,
375 LMP_QUALITY = 1 << 2,
376 LMP_SCO = 1 << 3,
377 LMP_HV2 = 1 << 4,
378 LMP_HV3 = 1 << 5,
379 LMP_ULAW = 1 << 6,
380 LMP_ALAW = 1 << 7,
381};
382
383enum lmp_feature_bits2 {
384 LMP_CVSD = 1 << 0,
385 LMP_PSCHEME = 1 << 1,
386 LMP_PCONTROL = 1 << 2,
387 LMP_TRSP_SCO = 1 << 3,
388 LMP_BCAST_ENC = 1 << 7,
389};
390
391enum lmp_feature_bits3 {
392 LMP_EDR_ACL_2M = 1 << 1,
393 LMP_EDR_ACL_3M = 1 << 2,
394 LMP_ENH_ISCAN = 1 << 3,
395 LMP_ILACE_ISCAN = 1 << 4,
396 LMP_ILACE_PSCAN = 1 << 5,
397 LMP_RSSI_INQ = 1 << 6,
398 LMP_ESCO = 1 << 7,
399};
400
401enum lmp_feature_bits4 {
402 LMP_EV4 = 1 << 0,
403 LMP_EV5 = 1 << 1,
404 LMP_AFH_CAP_SLV = 1 << 3,
405 LMP_AFH_CLS_SLV = 1 << 4,
406 LMP_EDR_3SLOT = 1 << 7,
407};
408
409enum lmp_feature_bits5 {
410 LMP_EDR_5SLOT = 1 << 0,
411 LMP_SNIFF_SUBR = 1 << 1,
412 LMP_AFH_CAP_MST = 1 << 3,
413 LMP_AFH_CLS_MST = 1 << 4,
414 LMP_EDR_ESCO_2M = 1 << 5,
415 LMP_EDR_ESCO_3M = 1 << 6,
416 LMP_EDR_3S_ESCO = 1 << 7,
417};
418
419enum lmp_feature_bits6 {
420 LMP_EXT_INQ = 1 << 0,
421};
422
423enum lmp_feature_bits7 {
424 LMP_EXT_FEAT = 1 << 7,
425};
426
427enum hci_link_policy {
428 HCI_LP_RSWITCH = 1 << 0,
429 HCI_LP_HOLD = 1 << 1,
430 HCI_LP_SNIFF = 1 << 2,
431 HCI_LP_PARK = 1 << 3,
432};
433
434enum hci_link_mode {
435 HCI_LM_ACCEPT = 1 << 15,
436 HCI_LM_MASTER = 1 << 0,
437 HCI_LM_AUTH = 1 << 1,
438 HCI_LM_ENCRYPT = 1 << 2,
439 HCI_LM_TRUSTED = 1 << 3,
440 HCI_LM_RELIABLE = 1 << 4,
441 HCI_LM_SECURE = 1 << 5,
442};
443
444/* HCI Commands */
445
446/* Link Control */
447#define OGF_LINK_CTL 0x01
448
449#define OCF_INQUIRY 0x0001
450typedef struct {
451 uint8_t lap[3];
452 uint8_t length; /* 1.28s units */
453 uint8_t num_rsp;
454} QEMU_PACKED inquiry_cp;
455#define INQUIRY_CP_SIZE 5
456
457typedef struct {
458 uint8_t status;
459 bdaddr_t bdaddr;
460} QEMU_PACKED status_bdaddr_rp;
461#define STATUS_BDADDR_RP_SIZE 7
462
463#define OCF_INQUIRY_CANCEL 0x0002
464
465#define OCF_PERIODIC_INQUIRY 0x0003
466typedef struct {
467 uint16_t max_period; /* 1.28s units */
468 uint16_t min_period; /* 1.28s units */
469 uint8_t lap[3];
470 uint8_t length; /* 1.28s units */
471 uint8_t num_rsp;
472} QEMU_PACKED periodic_inquiry_cp;
473#define PERIODIC_INQUIRY_CP_SIZE 9
474
475#define OCF_EXIT_PERIODIC_INQUIRY 0x0004
476
477#define OCF_CREATE_CONN 0x0005
478typedef struct {
479 bdaddr_t bdaddr;
480 uint16_t pkt_type;
481 uint8_t pscan_rep_mode;
482 uint8_t pscan_mode;
483 uint16_t clock_offset;
484 uint8_t role_switch;
485} QEMU_PACKED create_conn_cp;
486#define CREATE_CONN_CP_SIZE 13
487
488#define OCF_DISCONNECT 0x0006
489typedef struct {
490 uint16_t handle;
491 uint8_t reason;
492} QEMU_PACKED disconnect_cp;
493#define DISCONNECT_CP_SIZE 3
494
495#define OCF_ADD_SCO 0x0007
496typedef struct {
497 uint16_t handle;
498 uint16_t pkt_type;
499} QEMU_PACKED add_sco_cp;
500#define ADD_SCO_CP_SIZE 4
501
502#define OCF_CREATE_CONN_CANCEL 0x0008
503typedef struct {
504 bdaddr_t bdaddr;
505} QEMU_PACKED create_conn_cancel_cp;
506#define CREATE_CONN_CANCEL_CP_SIZE 6
507
508typedef struct {
509 uint8_t status;
510 bdaddr_t bdaddr;
511} QEMU_PACKED create_conn_cancel_rp;
512#define CREATE_CONN_CANCEL_RP_SIZE 7
513
514#define OCF_ACCEPT_CONN_REQ 0x0009
515typedef struct {
516 bdaddr_t bdaddr;
517 uint8_t role;
518} QEMU_PACKED accept_conn_req_cp;
519#define ACCEPT_CONN_REQ_CP_SIZE 7
520
521#define OCF_REJECT_CONN_REQ 0x000A
522typedef struct {
523 bdaddr_t bdaddr;
524 uint8_t reason;
525} QEMU_PACKED reject_conn_req_cp;
526#define REJECT_CONN_REQ_CP_SIZE 7
527
528#define OCF_LINK_KEY_REPLY 0x000B
529typedef struct {
530 bdaddr_t bdaddr;
531 uint8_t link_key[16];
532} QEMU_PACKED link_key_reply_cp;
533#define LINK_KEY_REPLY_CP_SIZE 22
534
535#define OCF_LINK_KEY_NEG_REPLY 0x000C
536
537#define OCF_PIN_CODE_REPLY 0x000D
538typedef struct {
539 bdaddr_t bdaddr;
540 uint8_t pin_len;
541 uint8_t pin_code[16];
542} QEMU_PACKED pin_code_reply_cp;
543#define PIN_CODE_REPLY_CP_SIZE 23
544
545#define OCF_PIN_CODE_NEG_REPLY 0x000E
546
547#define OCF_SET_CONN_PTYPE 0x000F
548typedef struct {
549 uint16_t handle;
550 uint16_t pkt_type;
551} QEMU_PACKED set_conn_ptype_cp;
552#define SET_CONN_PTYPE_CP_SIZE 4
553
554#define OCF_AUTH_REQUESTED 0x0011
555typedef struct {
556 uint16_t handle;
557} QEMU_PACKED auth_requested_cp;
558#define AUTH_REQUESTED_CP_SIZE 2
559
560#define OCF_SET_CONN_ENCRYPT 0x0013
561typedef struct {
562 uint16_t handle;
563 uint8_t encrypt;
564} QEMU_PACKED set_conn_encrypt_cp;
565#define SET_CONN_ENCRYPT_CP_SIZE 3
566
567#define OCF_CHANGE_CONN_LINK_KEY 0x0015
568typedef struct {
569 uint16_t handle;
570} QEMU_PACKED change_conn_link_key_cp;
571#define CHANGE_CONN_LINK_KEY_CP_SIZE 2
572
573#define OCF_MASTER_LINK_KEY 0x0017
574typedef struct {
575 uint8_t key_flag;
576} QEMU_PACKED master_link_key_cp;
577#define MASTER_LINK_KEY_CP_SIZE 1
578
579#define OCF_REMOTE_NAME_REQ 0x0019
580typedef struct {
581 bdaddr_t bdaddr;
582 uint8_t pscan_rep_mode;
583 uint8_t pscan_mode;
584 uint16_t clock_offset;
585} QEMU_PACKED remote_name_req_cp;
586#define REMOTE_NAME_REQ_CP_SIZE 10
587
588#define OCF_REMOTE_NAME_REQ_CANCEL 0x001A
589typedef struct {
590 bdaddr_t bdaddr;
591} QEMU_PACKED remote_name_req_cancel_cp;
592#define REMOTE_NAME_REQ_CANCEL_CP_SIZE 6
593
594typedef struct {
595 uint8_t status;
596 bdaddr_t bdaddr;
597} QEMU_PACKED remote_name_req_cancel_rp;
598#define REMOTE_NAME_REQ_CANCEL_RP_SIZE 7
599
600#define OCF_READ_REMOTE_FEATURES 0x001B
601typedef struct {
602 uint16_t handle;
603} QEMU_PACKED read_remote_features_cp;
604#define READ_REMOTE_FEATURES_CP_SIZE 2
605
606#define OCF_READ_REMOTE_EXT_FEATURES 0x001C
607typedef struct {
608 uint16_t handle;
609 uint8_t page_num;
610} QEMU_PACKED read_remote_ext_features_cp;
611#define READ_REMOTE_EXT_FEATURES_CP_SIZE 3
612
613#define OCF_READ_REMOTE_VERSION 0x001D
614typedef struct {
615 uint16_t handle;
616} QEMU_PACKED read_remote_version_cp;
617#define READ_REMOTE_VERSION_CP_SIZE 2
618
619#define OCF_READ_CLOCK_OFFSET 0x001F
620typedef struct {
621 uint16_t handle;
622} QEMU_PACKED read_clock_offset_cp;
623#define READ_CLOCK_OFFSET_CP_SIZE 2
624
625#define OCF_READ_LMP_HANDLE 0x0020
626typedef struct {
627 uint16_t handle;
628} QEMU_PACKED read_lmp_handle_cp;
629#define READ_LMP_HANDLE_CP_SIZE 2
630
631typedef struct {
632 uint8_t status;
633 uint16_t handle;
634 uint8_t lmp_handle;
635 uint32_t reserved;
636} QEMU_PACKED read_lmp_handle_rp;
637#define READ_LMP_HANDLE_RP_SIZE 8
638
639#define OCF_SETUP_SYNC_CONN 0x0028
640typedef struct {
641 uint16_t handle;
642 uint32_t tx_bandwidth;
643 uint32_t rx_bandwidth;
644 uint16_t max_latency;
645 uint16_t voice_setting;
646 uint8_t retrans_effort;
647 uint16_t pkt_type;
648} QEMU_PACKED setup_sync_conn_cp;
649#define SETUP_SYNC_CONN_CP_SIZE 17
650
651#define OCF_ACCEPT_SYNC_CONN_REQ 0x0029
652typedef struct {
653 bdaddr_t bdaddr;
654 uint32_t tx_bandwidth;
655 uint32_t rx_bandwidth;
656 uint16_t max_latency;
657 uint16_t voice_setting;
658 uint8_t retrans_effort;
659 uint16_t pkt_type;
660} QEMU_PACKED accept_sync_conn_req_cp;
661#define ACCEPT_SYNC_CONN_REQ_CP_SIZE 21
662
663#define OCF_REJECT_SYNC_CONN_REQ 0x002A
664typedef struct {
665 bdaddr_t bdaddr;
666 uint8_t reason;
667} QEMU_PACKED reject_sync_conn_req_cp;
668#define REJECT_SYNC_CONN_REQ_CP_SIZE 7
669
670/* Link Policy */
671#define OGF_LINK_POLICY 0x02
672
673#define OCF_HOLD_MODE 0x0001
674typedef struct {
675 uint16_t handle;
676 uint16_t max_interval;
677 uint16_t min_interval;
678} QEMU_PACKED hold_mode_cp;
679#define HOLD_MODE_CP_SIZE 6
680
681#define OCF_SNIFF_MODE 0x0003
682typedef struct {
683 uint16_t handle;
684 uint16_t max_interval;
685 uint16_t min_interval;
686 uint16_t attempt;
687 uint16_t timeout;
688} QEMU_PACKED sniff_mode_cp;
689#define SNIFF_MODE_CP_SIZE 10
690
691#define OCF_EXIT_SNIFF_MODE 0x0004
692typedef struct {
693 uint16_t handle;
694} QEMU_PACKED exit_sniff_mode_cp;
695#define EXIT_SNIFF_MODE_CP_SIZE 2
696
697#define OCF_PARK_MODE 0x0005
698typedef struct {
699 uint16_t handle;
700 uint16_t max_interval;
701 uint16_t min_interval;
702} QEMU_PACKED park_mode_cp;
703#define PARK_MODE_CP_SIZE 6
704
705#define OCF_EXIT_PARK_MODE 0x0006
706typedef struct {
707 uint16_t handle;
708} QEMU_PACKED exit_park_mode_cp;
709#define EXIT_PARK_MODE_CP_SIZE 2
710
711#define OCF_QOS_SETUP 0x0007
712typedef struct {
713 uint8_t service_type; /* 1 = best effort */
714 uint32_t token_rate; /* Byte per seconds */
715 uint32_t peak_bandwidth; /* Byte per seconds */
716 uint32_t latency; /* Microseconds */
717 uint32_t delay_variation; /* Microseconds */
718} QEMU_PACKED hci_qos;
719#define HCI_QOS_CP_SIZE 17
720typedef struct {
721 uint16_t handle;
722 uint8_t flags; /* Reserved */
723 hci_qos qos;
724} QEMU_PACKED qos_setup_cp;
725#define QOS_SETUP_CP_SIZE (3 + HCI_QOS_CP_SIZE)
726
727#define OCF_ROLE_DISCOVERY 0x0009
728typedef struct {
729 uint16_t handle;
730} QEMU_PACKED role_discovery_cp;
731#define ROLE_DISCOVERY_CP_SIZE 2
732typedef struct {
733 uint8_t status;
734 uint16_t handle;
735 uint8_t role;
736} QEMU_PACKED role_discovery_rp;
737#define ROLE_DISCOVERY_RP_SIZE 4
738
739#define OCF_SWITCH_ROLE 0x000B
740typedef struct {
741 bdaddr_t bdaddr;
742 uint8_t role;
743} QEMU_PACKED switch_role_cp;
744#define SWITCH_ROLE_CP_SIZE 7
745
746#define OCF_READ_LINK_POLICY 0x000C
747typedef struct {
748 uint16_t handle;
749} QEMU_PACKED read_link_policy_cp;
750#define READ_LINK_POLICY_CP_SIZE 2
751typedef struct {
752 uint8_t status;
753 uint16_t handle;
754 uint16_t policy;
755} QEMU_PACKED read_link_policy_rp;
756#define READ_LINK_POLICY_RP_SIZE 5
757
758#define OCF_WRITE_LINK_POLICY 0x000D
759typedef struct {
760 uint16_t handle;
761 uint16_t policy;
762} QEMU_PACKED write_link_policy_cp;
763#define WRITE_LINK_POLICY_CP_SIZE 4
764typedef struct {
765 uint8_t status;
766 uint16_t handle;
767} QEMU_PACKED write_link_policy_rp;
768#define WRITE_LINK_POLICY_RP_SIZE 3
769
770#define OCF_READ_DEFAULT_LINK_POLICY 0x000E
771
772#define OCF_WRITE_DEFAULT_LINK_POLICY 0x000F
773
774#define OCF_FLOW_SPECIFICATION 0x0010
775
776#define OCF_SNIFF_SUBRATE 0x0011
777typedef struct {
778 uint16_t handle;
779 uint16_t max_remote_latency;
780 uint16_t max_local_latency;
781 uint16_t min_remote_timeout;
782 uint16_t min_local_timeout;
783} QEMU_PACKED sniff_subrate_cp;
784#define SNIFF_SUBRATE_CP_SIZE 10
785
786/* Host Controller and Baseband */
787#define OGF_HOST_CTL 0x03
788
789#define OCF_SET_EVENT_MASK 0x0001
790typedef struct {
791 uint8_t mask[8];
792} QEMU_PACKED set_event_mask_cp;
793#define SET_EVENT_MASK_CP_SIZE 8
794
795#define OCF_RESET 0x0003
796
797#define OCF_SET_EVENT_FLT 0x0005
798typedef struct {
799 uint8_t flt_type;
800 uint8_t cond_type;
801 uint8_t condition[0];
802} QEMU_PACKED set_event_flt_cp;
803#define SET_EVENT_FLT_CP_SIZE 2
804
805enum bt_filter_type {
806 FLT_CLEAR_ALL = 0x00,
807 FLT_INQ_RESULT = 0x01,
808 FLT_CONN_SETUP = 0x02,
809};
810enum inq_result_cond_type {
811 INQ_RESULT_RETURN_ALL = 0x00,
812 INQ_RESULT_RETURN_CLASS = 0x01,
813 INQ_RESULT_RETURN_BDADDR = 0x02,
814};
815enum conn_setup_cond_type {
816 CONN_SETUP_ALLOW_ALL = 0x00,
817 CONN_SETUP_ALLOW_CLASS = 0x01,
818 CONN_SETUP_ALLOW_BDADDR = 0x02,
819};
820enum conn_setup_cond {
821 CONN_SETUP_AUTO_OFF = 0x01,
822 CONN_SETUP_AUTO_ON = 0x02,
823};
824
825#define OCF_FLUSH 0x0008
826typedef struct {
827 uint16_t handle;
828} QEMU_PACKED flush_cp;
829#define FLUSH_CP_SIZE 2
830
831typedef struct {
832 uint8_t status;
833 uint16_t handle;
834} QEMU_PACKED flush_rp;
835#define FLUSH_RP_SIZE 3
836
837#define OCF_READ_PIN_TYPE 0x0009
838typedef struct {
839 uint8_t status;
840 uint8_t pin_type;
841} QEMU_PACKED read_pin_type_rp;
842#define READ_PIN_TYPE_RP_SIZE 2
843
844#define OCF_WRITE_PIN_TYPE 0x000A
845typedef struct {
846 uint8_t pin_type;
847} QEMU_PACKED write_pin_type_cp;
848#define WRITE_PIN_TYPE_CP_SIZE 1
849
850#define OCF_CREATE_NEW_UNIT_KEY 0x000B
851
852#define OCF_READ_STORED_LINK_KEY 0x000D
853typedef struct {
854 bdaddr_t bdaddr;
855 uint8_t read_all;
856} QEMU_PACKED read_stored_link_key_cp;
857#define READ_STORED_LINK_KEY_CP_SIZE 7
858typedef struct {
859 uint8_t status;
860 uint16_t max_keys;
861 uint16_t num_keys;
862} QEMU_PACKED read_stored_link_key_rp;
863#define READ_STORED_LINK_KEY_RP_SIZE 5
864
865#define OCF_WRITE_STORED_LINK_KEY 0x0011
866typedef struct {
867 uint8_t num_keys;
868 /* variable length part */
869} QEMU_PACKED write_stored_link_key_cp;
870#define WRITE_STORED_LINK_KEY_CP_SIZE 1
871typedef struct {
872 uint8_t status;
873 uint8_t num_keys;
874} QEMU_PACKED write_stored_link_key_rp;
875#define READ_WRITE_LINK_KEY_RP_SIZE 2
876
877#define OCF_DELETE_STORED_LINK_KEY 0x0012
878typedef struct {
879 bdaddr_t bdaddr;
880 uint8_t delete_all;
881} QEMU_PACKED delete_stored_link_key_cp;
882#define DELETE_STORED_LINK_KEY_CP_SIZE 7
883typedef struct {
884 uint8_t status;
885 uint16_t num_keys;
886} QEMU_PACKED delete_stored_link_key_rp;
887#define DELETE_STORED_LINK_KEY_RP_SIZE 3
888
889#define OCF_CHANGE_LOCAL_NAME 0x0013
890typedef struct {
891 char name[248];
892} QEMU_PACKED change_local_name_cp;
893#define CHANGE_LOCAL_NAME_CP_SIZE 248
894
895#define OCF_READ_LOCAL_NAME 0x0014
896typedef struct {
897 uint8_t status;
898 char name[248];
899} QEMU_PACKED read_local_name_rp;
900#define READ_LOCAL_NAME_RP_SIZE 249
901
902#define OCF_READ_CONN_ACCEPT_TIMEOUT 0x0015
903typedef struct {
904 uint8_t status;
905 uint16_t timeout;
906} QEMU_PACKED read_conn_accept_timeout_rp;
907#define READ_CONN_ACCEPT_TIMEOUT_RP_SIZE 3
908
909#define OCF_WRITE_CONN_ACCEPT_TIMEOUT 0x0016
910typedef struct {
911 uint16_t timeout;
912} QEMU_PACKED write_conn_accept_timeout_cp;
913#define WRITE_CONN_ACCEPT_TIMEOUT_CP_SIZE 2
914
915#define OCF_READ_PAGE_TIMEOUT 0x0017
916typedef struct {
917 uint8_t status;
918 uint16_t timeout;
919} QEMU_PACKED read_page_timeout_rp;
920#define READ_PAGE_TIMEOUT_RP_SIZE 3
921
922#define OCF_WRITE_PAGE_TIMEOUT 0x0018
923typedef struct {
924 uint16_t timeout;
925} QEMU_PACKED write_page_timeout_cp;
926#define WRITE_PAGE_TIMEOUT_CP_SIZE 2
927
928#define OCF_READ_SCAN_ENABLE 0x0019
929typedef struct {
930 uint8_t status;
931 uint8_t enable;
932} QEMU_PACKED read_scan_enable_rp;
933#define READ_SCAN_ENABLE_RP_SIZE 2
934
935#define OCF_WRITE_SCAN_ENABLE 0x001A
936typedef struct {
937 uint8_t scan_enable;
938} QEMU_PACKED write_scan_enable_cp;
939#define WRITE_SCAN_ENABLE_CP_SIZE 1
940
941enum scan_enable_bits {
942 SCAN_DISABLED = 0,
943 SCAN_INQUIRY = 1 << 0,
944 SCAN_PAGE = 1 << 1,
945};
946
947#define OCF_READ_PAGE_ACTIVITY 0x001B
948typedef struct {
949 uint8_t status;
950 uint16_t interval;
951 uint16_t window;
952} QEMU_PACKED read_page_activity_rp;
953#define READ_PAGE_ACTIVITY_RP_SIZE 5
954
955#define OCF_WRITE_PAGE_ACTIVITY 0x001C
956typedef struct {
957 uint16_t interval;
958 uint16_t window;
959} QEMU_PACKED write_page_activity_cp;
960#define WRITE_PAGE_ACTIVITY_CP_SIZE 4
961
962#define OCF_READ_INQ_ACTIVITY 0x001D
963typedef struct {
964 uint8_t status;
965 uint16_t interval;
966 uint16_t window;
967} QEMU_PACKED read_inq_activity_rp;
968#define READ_INQ_ACTIVITY_RP_SIZE 5
969
970#define OCF_WRITE_INQ_ACTIVITY 0x001E
971typedef struct {
972 uint16_t interval;
973 uint16_t window;
974} QEMU_PACKED write_inq_activity_cp;
975#define WRITE_INQ_ACTIVITY_CP_SIZE 4
976
977#define OCF_READ_AUTH_ENABLE 0x001F
978
979#define OCF_WRITE_AUTH_ENABLE 0x0020
980
981#define AUTH_DISABLED 0x00
982#define AUTH_ENABLED 0x01
983
984#define OCF_READ_ENCRYPT_MODE 0x0021
985
986#define OCF_WRITE_ENCRYPT_MODE 0x0022
987
988#define ENCRYPT_DISABLED 0x00
989#define ENCRYPT_P2P 0x01
990#define ENCRYPT_BOTH 0x02
991
992#define OCF_READ_CLASS_OF_DEV 0x0023
993typedef struct {
994 uint8_t status;
995 uint8_t dev_class[3];
996} QEMU_PACKED read_class_of_dev_rp;
997#define READ_CLASS_OF_DEV_RP_SIZE 4
998
999#define OCF_WRITE_CLASS_OF_DEV 0x0024
1000typedef struct {
1001 uint8_t dev_class[3];
1002} QEMU_PACKED write_class_of_dev_cp;
1003#define WRITE_CLASS_OF_DEV_CP_SIZE 3
1004
1005#define OCF_READ_VOICE_SETTING 0x0025
1006typedef struct {
1007 uint8_t status;
1008 uint16_t voice_setting;
1009} QEMU_PACKED read_voice_setting_rp;
1010#define READ_VOICE_SETTING_RP_SIZE 3
1011
1012#define OCF_WRITE_VOICE_SETTING 0x0026
1013typedef struct {
1014 uint16_t voice_setting;
1015} QEMU_PACKED write_voice_setting_cp;
1016#define WRITE_VOICE_SETTING_CP_SIZE 2
1017
1018#define OCF_READ_AUTOMATIC_FLUSH_TIMEOUT 0x0027
1019
1020#define OCF_WRITE_AUTOMATIC_FLUSH_TIMEOUT 0x0028
1021
1022#define OCF_READ_NUM_BROADCAST_RETRANS 0x0029
1023
1024#define OCF_WRITE_NUM_BROADCAST_RETRANS 0x002A
1025
1026#define OCF_READ_HOLD_MODE_ACTIVITY 0x002B
1027
1028#define OCF_WRITE_HOLD_MODE_ACTIVITY 0x002C
1029
1030#define OCF_READ_TRANSMIT_POWER_LEVEL 0x002D
1031typedef struct {
1032 uint16_t handle;
1033 uint8_t type;
1034} QEMU_PACKED read_transmit_power_level_cp;
1035#define READ_TRANSMIT_POWER_LEVEL_CP_SIZE 3
1036typedef struct {
1037 uint8_t status;
1038 uint16_t handle;
1039 int8_t level;
1040} QEMU_PACKED read_transmit_power_level_rp;
1041#define READ_TRANSMIT_POWER_LEVEL_RP_SIZE 4
1042
1043#define OCF_HOST_BUFFER_SIZE 0x0033
1044typedef struct {
1045 uint16_t acl_mtu;
1046 uint8_t sco_mtu;
1047 uint16_t acl_max_pkt;
1048 uint16_t sco_max_pkt;
1049} QEMU_PACKED host_buffer_size_cp;
1050#define HOST_BUFFER_SIZE_CP_SIZE 7
1051
1052#define OCF_HOST_NUMBER_OF_COMPLETED_PACKETS 0x0035
1053
1054#define OCF_READ_LINK_SUPERVISION_TIMEOUT 0x0036
1055typedef struct {
1056 uint8_t status;
1057 uint16_t handle;
1058 uint16_t link_sup_to;
1059} QEMU_PACKED read_link_supervision_timeout_rp;
1060#define READ_LINK_SUPERVISION_TIMEOUT_RP_SIZE 5
1061
1062#define OCF_WRITE_LINK_SUPERVISION_TIMEOUT 0x0037
1063typedef struct {
1064 uint16_t handle;
1065 uint16_t link_sup_to;
1066} QEMU_PACKED write_link_supervision_timeout_cp;
1067#define WRITE_LINK_SUPERVISION_TIMEOUT_CP_SIZE 4
1068typedef struct {
1069 uint8_t status;
1070 uint16_t handle;
1071} QEMU_PACKED write_link_supervision_timeout_rp;
1072#define WRITE_LINK_SUPERVISION_TIMEOUT_RP_SIZE 3
1073
1074#define OCF_READ_NUM_SUPPORTED_IAC 0x0038
1075
1076#define MAX_IAC_LAP 0x40
1077#define OCF_READ_CURRENT_IAC_LAP 0x0039
1078typedef struct {
1079 uint8_t status;
1080 uint8_t num_current_iac;
1081 uint8_t lap[MAX_IAC_LAP][3];
1082} QEMU_PACKED read_current_iac_lap_rp;
1083#define READ_CURRENT_IAC_LAP_RP_SIZE 2+3*MAX_IAC_LAP
1084
1085#define OCF_WRITE_CURRENT_IAC_LAP 0x003A
1086typedef struct {
1087 uint8_t num_current_iac;
1088 uint8_t lap[MAX_IAC_LAP][3];
1089} QEMU_PACKED write_current_iac_lap_cp;
1090#define WRITE_CURRENT_IAC_LAP_CP_SIZE 1+3*MAX_IAC_LAP
1091
1092#define OCF_READ_PAGE_SCAN_PERIOD_MODE 0x003B
1093
1094#define OCF_WRITE_PAGE_SCAN_PERIOD_MODE 0x003C
1095
1096#define OCF_READ_PAGE_SCAN_MODE 0x003D
1097
1098#define OCF_WRITE_PAGE_SCAN_MODE 0x003E
1099
1100#define OCF_SET_AFH_CLASSIFICATION 0x003F
1101typedef struct {
1102 uint8_t map[10];
1103} QEMU_PACKED set_afh_classification_cp;
1104#define SET_AFH_CLASSIFICATION_CP_SIZE 10
1105typedef struct {
1106 uint8_t status;
1107} QEMU_PACKED set_afh_classification_rp;
1108#define SET_AFH_CLASSIFICATION_RP_SIZE 1
1109
1110#define OCF_READ_INQUIRY_SCAN_TYPE 0x0042
1111typedef struct {
1112 uint8_t status;
1113 uint8_t type;
1114} QEMU_PACKED read_inquiry_scan_type_rp;
1115#define READ_INQUIRY_SCAN_TYPE_RP_SIZE 2
1116
1117#define OCF_WRITE_INQUIRY_SCAN_TYPE 0x0043
1118typedef struct {
1119 uint8_t type;
1120} QEMU_PACKED write_inquiry_scan_type_cp;
1121#define WRITE_INQUIRY_SCAN_TYPE_CP_SIZE 1
1122typedef struct {
1123 uint8_t status;
1124} QEMU_PACKED write_inquiry_scan_type_rp;
1125#define WRITE_INQUIRY_SCAN_TYPE_RP_SIZE 1
1126
1127#define OCF_READ_INQUIRY_MODE 0x0044
1128typedef struct {
1129 uint8_t status;
1130 uint8_t mode;
1131} QEMU_PACKED read_inquiry_mode_rp;
1132#define READ_INQUIRY_MODE_RP_SIZE 2
1133
1134#define OCF_WRITE_INQUIRY_MODE 0x0045
1135typedef struct {
1136 uint8_t mode;
1137} QEMU_PACKED write_inquiry_mode_cp;
1138#define WRITE_INQUIRY_MODE_CP_SIZE 1
1139typedef struct {
1140 uint8_t status;
1141} QEMU_PACKED write_inquiry_mode_rp;
1142#define WRITE_INQUIRY_MODE_RP_SIZE 1
1143
1144#define OCF_READ_PAGE_SCAN_TYPE 0x0046
1145
1146#define OCF_WRITE_PAGE_SCAN_TYPE 0x0047
1147
1148#define OCF_READ_AFH_MODE 0x0048
1149typedef struct {
1150 uint8_t status;
1151 uint8_t mode;
1152} QEMU_PACKED read_afh_mode_rp;
1153#define READ_AFH_MODE_RP_SIZE 2
1154
1155#define OCF_WRITE_AFH_MODE 0x0049
1156typedef struct {
1157 uint8_t mode;
1158} QEMU_PACKED write_afh_mode_cp;
1159#define WRITE_AFH_MODE_CP_SIZE 1
1160typedef struct {
1161 uint8_t status;
1162} QEMU_PACKED write_afh_mode_rp;
1163#define WRITE_AFH_MODE_RP_SIZE 1
1164
1165#define OCF_READ_EXT_INQUIRY_RESPONSE 0x0051
1166typedef struct {
1167 uint8_t status;
1168 uint8_t fec;
1169 uint8_t data[240];
1170} QEMU_PACKED read_ext_inquiry_response_rp;
1171#define READ_EXT_INQUIRY_RESPONSE_RP_SIZE 242
1172
1173#define OCF_WRITE_EXT_INQUIRY_RESPONSE 0x0052
1174typedef struct {
1175 uint8_t fec;
1176 uint8_t data[240];
1177} QEMU_PACKED write_ext_inquiry_response_cp;
1178#define WRITE_EXT_INQUIRY_RESPONSE_CP_SIZE 241
1179typedef struct {
1180 uint8_t status;
1181} QEMU_PACKED write_ext_inquiry_response_rp;
1182#define WRITE_EXT_INQUIRY_RESPONSE_RP_SIZE 1
1183
1184/* Informational Parameters */
1185#define OGF_INFO_PARAM 0x04
1186
1187#define OCF_READ_LOCAL_VERSION 0x0001
1188typedef struct {
1189 uint8_t status;
1190 uint8_t hci_ver;
1191 uint16_t hci_rev;
1192 uint8_t lmp_ver;
1193 uint16_t manufacturer;
1194 uint16_t lmp_subver;
1195} QEMU_PACKED read_local_version_rp;
1196#define READ_LOCAL_VERSION_RP_SIZE 9
1197
1198#define OCF_READ_LOCAL_COMMANDS 0x0002
1199typedef struct {
1200 uint8_t status;
1201 uint8_t commands[64];
1202} QEMU_PACKED read_local_commands_rp;
1203#define READ_LOCAL_COMMANDS_RP_SIZE 65
1204
1205#define OCF_READ_LOCAL_FEATURES 0x0003
1206typedef struct {
1207 uint8_t status;
1208 uint8_t features[8];
1209} QEMU_PACKED read_local_features_rp;
1210#define READ_LOCAL_FEATURES_RP_SIZE 9
1211
1212#define OCF_READ_LOCAL_EXT_FEATURES 0x0004
1213typedef struct {
1214 uint8_t page_num;
1215} QEMU_PACKED read_local_ext_features_cp;
1216#define READ_LOCAL_EXT_FEATURES_CP_SIZE 1
1217typedef struct {
1218 uint8_t status;
1219 uint8_t page_num;
1220 uint8_t max_page_num;
1221 uint8_t features[8];
1222} QEMU_PACKED read_local_ext_features_rp;
1223#define READ_LOCAL_EXT_FEATURES_RP_SIZE 11
1224
1225#define OCF_READ_BUFFER_SIZE 0x0005
1226typedef struct {
1227 uint8_t status;
1228 uint16_t acl_mtu;
1229 uint8_t sco_mtu;
1230 uint16_t acl_max_pkt;
1231 uint16_t sco_max_pkt;
1232} QEMU_PACKED read_buffer_size_rp;
1233#define READ_BUFFER_SIZE_RP_SIZE 8
1234
1235#define OCF_READ_COUNTRY_CODE 0x0007
1236typedef struct {
1237 uint8_t status;
1238 uint8_t country_code;
1239} QEMU_PACKED read_country_code_rp;
1240#define READ_COUNTRY_CODE_RP_SIZE 2
1241
1242#define OCF_READ_BD_ADDR 0x0009
1243typedef struct {
1244 uint8_t status;
1245 bdaddr_t bdaddr;
1246} QEMU_PACKED read_bd_addr_rp;
1247#define READ_BD_ADDR_RP_SIZE 7
1248
1249/* Status params */
1250#define OGF_STATUS_PARAM 0x05
1251
1252#define OCF_READ_FAILED_CONTACT_COUNTER 0x0001
1253typedef struct {
1254 uint8_t status;
1255 uint16_t handle;
1256 uint8_t counter;
1257} QEMU_PACKED read_failed_contact_counter_rp;
1258#define READ_FAILED_CONTACT_COUNTER_RP_SIZE 4
1259
1260#define OCF_RESET_FAILED_CONTACT_COUNTER 0x0002
1261typedef struct {
1262 uint8_t status;
1263 uint16_t handle;
1264} QEMU_PACKED reset_failed_contact_counter_rp;
1265#define RESET_FAILED_CONTACT_COUNTER_RP_SIZE 3
1266
1267#define OCF_READ_LINK_QUALITY 0x0003
1268typedef struct {
1269 uint16_t handle;
1270} QEMU_PACKED read_link_quality_cp;
1271#define READ_LINK_QUALITY_CP_SIZE 2
1272
1273typedef struct {
1274 uint8_t status;
1275 uint16_t handle;
1276 uint8_t link_quality;
1277} QEMU_PACKED read_link_quality_rp;
1278#define READ_LINK_QUALITY_RP_SIZE 4
1279
1280#define OCF_READ_RSSI 0x0005
1281typedef struct {
1282 uint8_t status;
1283 uint16_t handle;
1284 int8_t rssi;
1285} QEMU_PACKED read_rssi_rp;
1286#define READ_RSSI_RP_SIZE 4
1287
1288#define OCF_READ_AFH_MAP 0x0006
1289typedef struct {
1290 uint8_t status;
1291 uint16_t handle;
1292 uint8_t mode;
1293 uint8_t map[10];
1294} QEMU_PACKED read_afh_map_rp;
1295#define READ_AFH_MAP_RP_SIZE 14
1296
1297#define OCF_READ_CLOCK 0x0007
1298typedef struct {
1299 uint16_t handle;
1300 uint8_t which_clock;
1301} QEMU_PACKED read_clock_cp;
1302#define READ_CLOCK_CP_SIZE 3
1303typedef struct {
1304 uint8_t status;
1305 uint16_t handle;
1306 uint32_t clock;
1307 uint16_t accuracy;
1308} QEMU_PACKED read_clock_rp;
1309#define READ_CLOCK_RP_SIZE 9
1310
1311/* Testing commands */
1312#define OGF_TESTING_CMD 0x3e
1313
1314/* Vendor specific commands */
1315#define OGF_VENDOR_CMD 0x3f
1316
1317/* HCI Events */
1318
1319#define EVT_INQUIRY_COMPLETE 0x01
1320
1321#define EVT_INQUIRY_RESULT 0x02
1322typedef struct {
1323 uint8_t num_responses;
1324 bdaddr_t bdaddr;
1325 uint8_t pscan_rep_mode;
1326 uint8_t pscan_period_mode;
1327 uint8_t pscan_mode;
1328 uint8_t dev_class[3];
1329 uint16_t clock_offset;
1330} QEMU_PACKED inquiry_info;
1331#define INQUIRY_INFO_SIZE 15
1332
1333#define EVT_CONN_COMPLETE 0x03
1334typedef struct {
1335 uint8_t status;
1336 uint16_t handle;
1337 bdaddr_t bdaddr;
1338 uint8_t link_type;
1339 uint8_t encr_mode;
1340} QEMU_PACKED evt_conn_complete;
1341#define EVT_CONN_COMPLETE_SIZE 11
1342
1343#define EVT_CONN_REQUEST 0x04
1344typedef struct {
1345 bdaddr_t bdaddr;
1346 uint8_t dev_class[3];
1347 uint8_t link_type;
1348} QEMU_PACKED evt_conn_request;
1349#define EVT_CONN_REQUEST_SIZE 10
1350
1351#define EVT_DISCONN_COMPLETE 0x05
1352typedef struct {
1353 uint8_t status;
1354 uint16_t handle;
1355 uint8_t reason;
1356} QEMU_PACKED evt_disconn_complete;
1357#define EVT_DISCONN_COMPLETE_SIZE 4
1358
1359#define EVT_AUTH_COMPLETE 0x06
1360typedef struct {
1361 uint8_t status;
1362 uint16_t handle;
1363} QEMU_PACKED evt_auth_complete;
1364#define EVT_AUTH_COMPLETE_SIZE 3
1365
1366#define EVT_REMOTE_NAME_REQ_COMPLETE 0x07
1367typedef struct {
1368 uint8_t status;
1369 bdaddr_t bdaddr;
1370 char name[248];
1371} QEMU_PACKED evt_remote_name_req_complete;
1372#define EVT_REMOTE_NAME_REQ_COMPLETE_SIZE 255
1373
1374#define EVT_ENCRYPT_CHANGE 0x08
1375typedef struct {
1376 uint8_t status;
1377 uint16_t handle;
1378 uint8_t encrypt;
1379} QEMU_PACKED evt_encrypt_change;
1380#define EVT_ENCRYPT_CHANGE_SIZE 4
1381
1382#define EVT_CHANGE_CONN_LINK_KEY_COMPLETE 0x09
1383typedef struct {
1384 uint8_t status;
1385 uint16_t handle;
1386} QEMU_PACKED evt_change_conn_link_key_complete;
1387#define EVT_CHANGE_CONN_LINK_KEY_COMPLETE_SIZE 3
1388
1389#define EVT_MASTER_LINK_KEY_COMPLETE 0x0A
1390typedef struct {
1391 uint8_t status;
1392 uint16_t handle;
1393 uint8_t key_flag;
1394} QEMU_PACKED evt_master_link_key_complete;
1395#define EVT_MASTER_LINK_KEY_COMPLETE_SIZE 4
1396
1397#define EVT_READ_REMOTE_FEATURES_COMPLETE 0x0B
1398typedef struct {
1399 uint8_t status;
1400 uint16_t handle;
1401 uint8_t features[8];
1402} QEMU_PACKED evt_read_remote_features_complete;
1403#define EVT_READ_REMOTE_FEATURES_COMPLETE_SIZE 11
1404
1405#define EVT_READ_REMOTE_VERSION_COMPLETE 0x0C
1406typedef struct {
1407 uint8_t status;
1408 uint16_t handle;
1409 uint8_t lmp_ver;
1410 uint16_t manufacturer;
1411 uint16_t lmp_subver;
1412} QEMU_PACKED evt_read_remote_version_complete;
1413#define EVT_READ_REMOTE_VERSION_COMPLETE_SIZE 8
1414
1415#define EVT_QOS_SETUP_COMPLETE 0x0D
1416typedef struct {
1417 uint8_t status;
1418 uint16_t handle;
1419 uint8_t flags; /* Reserved */
1420 hci_qos qos;
1421} QEMU_PACKED evt_qos_setup_complete;
1422#define EVT_QOS_SETUP_COMPLETE_SIZE (4 + HCI_QOS_CP_SIZE)
1423
1424#define EVT_CMD_COMPLETE 0x0E
1425typedef struct {
1426 uint8_t ncmd;
1427 uint16_t opcode;
1428} QEMU_PACKED evt_cmd_complete;
1429#define EVT_CMD_COMPLETE_SIZE 3
1430
1431#define EVT_CMD_STATUS 0x0F
1432typedef struct {
1433 uint8_t status;
1434 uint8_t ncmd;
1435 uint16_t opcode;
1436} QEMU_PACKED evt_cmd_status;
1437#define EVT_CMD_STATUS_SIZE 4
1438
1439#define EVT_HARDWARE_ERROR 0x10
1440typedef struct {
1441 uint8_t code;
1442} QEMU_PACKED evt_hardware_error;
1443#define EVT_HARDWARE_ERROR_SIZE 1
1444
1445#define EVT_FLUSH_OCCURRED 0x11
1446typedef struct {
1447 uint16_t handle;
1448} QEMU_PACKED evt_flush_occurred;
1449#define EVT_FLUSH_OCCURRED_SIZE 2
1450
1451#define EVT_ROLE_CHANGE 0x12
1452typedef struct {
1453 uint8_t status;
1454 bdaddr_t bdaddr;
1455 uint8_t role;
1456} QEMU_PACKED evt_role_change;
1457#define EVT_ROLE_CHANGE_SIZE 8
1458
1459#define EVT_NUM_COMP_PKTS 0x13
1460typedef struct {
1461 uint8_t num_hndl;
1462 struct {
1463 uint16_t handle;
1464 uint16_t num_packets;
1465 } connection[0];
1466} QEMU_PACKED evt_num_comp_pkts;
1467#define EVT_NUM_COMP_PKTS_SIZE(num_hndl) (1 + 4 * (num_hndl))
1468
1469#define EVT_MODE_CHANGE 0x14
1470typedef struct {
1471 uint8_t status;
1472 uint16_t handle;
1473 uint8_t mode;
1474 uint16_t interval;
1475} QEMU_PACKED evt_mode_change;
1476#define EVT_MODE_CHANGE_SIZE 6
1477
1478#define EVT_RETURN_LINK_KEYS 0x15
1479typedef struct {
1480 uint8_t num_keys;
1481 /* variable length part */
1482} QEMU_PACKED evt_return_link_keys;
1483#define EVT_RETURN_LINK_KEYS_SIZE 1
1484
1485#define EVT_PIN_CODE_REQ 0x16
1486typedef struct {
1487 bdaddr_t bdaddr;
1488} QEMU_PACKED evt_pin_code_req;
1489#define EVT_PIN_CODE_REQ_SIZE 6
1490
1491#define EVT_LINK_KEY_REQ 0x17
1492typedef struct {
1493 bdaddr_t bdaddr;
1494} QEMU_PACKED evt_link_key_req;
1495#define EVT_LINK_KEY_REQ_SIZE 6
1496
1497#define EVT_LINK_KEY_NOTIFY 0x18
1498typedef struct {
1499 bdaddr_t bdaddr;
1500 uint8_t link_key[16];
1501 uint8_t key_type;
1502} QEMU_PACKED evt_link_key_notify;
1503#define EVT_LINK_KEY_NOTIFY_SIZE 23
1504
1505#define EVT_LOOPBACK_COMMAND 0x19
1506
1507#define EVT_DATA_BUFFER_OVERFLOW 0x1A
1508typedef struct {
1509 uint8_t link_type;
1510} QEMU_PACKED evt_data_buffer_overflow;
1511#define EVT_DATA_BUFFER_OVERFLOW_SIZE 1
1512
1513#define EVT_MAX_SLOTS_CHANGE 0x1B
1514typedef struct {
1515 uint16_t handle;
1516 uint8_t max_slots;
1517} QEMU_PACKED evt_max_slots_change;
1518#define EVT_MAX_SLOTS_CHANGE_SIZE 3
1519
1520#define EVT_READ_CLOCK_OFFSET_COMPLETE 0x1C
1521typedef struct {
1522 uint8_t status;
1523 uint16_t handle;
1524 uint16_t clock_offset;
1525} QEMU_PACKED evt_read_clock_offset_complete;
1526#define EVT_READ_CLOCK_OFFSET_COMPLETE_SIZE 5
1527
1528#define EVT_CONN_PTYPE_CHANGED 0x1D
1529typedef struct {
1530 uint8_t status;
1531 uint16_t handle;
1532 uint16_t ptype;
1533} QEMU_PACKED evt_conn_ptype_changed;
1534#define EVT_CONN_PTYPE_CHANGED_SIZE 5
1535
1536#define EVT_QOS_VIOLATION 0x1E
1537typedef struct {
1538 uint16_t handle;
1539} QEMU_PACKED evt_qos_violation;
1540#define EVT_QOS_VIOLATION_SIZE 2
1541
1542#define EVT_PSCAN_REP_MODE_CHANGE 0x20
1543typedef struct {
1544 bdaddr_t bdaddr;
1545 uint8_t pscan_rep_mode;
1546} QEMU_PACKED evt_pscan_rep_mode_change;
1547#define EVT_PSCAN_REP_MODE_CHANGE_SIZE 7
1548
1549#define EVT_FLOW_SPEC_COMPLETE 0x21
1550typedef struct {
1551 uint8_t status;
1552 uint16_t handle;
1553 uint8_t flags;
1554 uint8_t direction;
1555 hci_qos qos;
1556} QEMU_PACKED evt_flow_spec_complete;
1557#define EVT_FLOW_SPEC_COMPLETE_SIZE (5 + HCI_QOS_CP_SIZE)
1558
1559#define EVT_INQUIRY_RESULT_WITH_RSSI 0x22
1560typedef struct {
1561 uint8_t num_responses;
1562 bdaddr_t bdaddr;
1563 uint8_t pscan_rep_mode;
1564 uint8_t pscan_period_mode;
1565 uint8_t dev_class[3];
1566 uint16_t clock_offset;
1567 int8_t rssi;
1568} QEMU_PACKED inquiry_info_with_rssi;
1569#define INQUIRY_INFO_WITH_RSSI_SIZE 15
1570typedef struct {
1571 uint8_t num_responses;
1572 bdaddr_t bdaddr;
1573 uint8_t pscan_rep_mode;
1574 uint8_t pscan_period_mode;
1575 uint8_t pscan_mode;
1576 uint8_t dev_class[3];
1577 uint16_t clock_offset;
1578 int8_t rssi;
1579} QEMU_PACKED inquiry_info_with_rssi_and_pscan_mode;
1580#define INQUIRY_INFO_WITH_RSSI_AND_PSCAN_MODE_SIZE 16
1581
1582#define EVT_READ_REMOTE_EXT_FEATURES_COMPLETE 0x23
1583typedef struct {
1584 uint8_t status;
1585 uint16_t handle;
1586 uint8_t page_num;
1587 uint8_t max_page_num;
1588 uint8_t features[8];
1589} QEMU_PACKED evt_read_remote_ext_features_complete;
1590#define EVT_READ_REMOTE_EXT_FEATURES_COMPLETE_SIZE 13
1591
1592#define EVT_SYNC_CONN_COMPLETE 0x2C
1593typedef struct {
1594 uint8_t status;
1595 uint16_t handle;
1596 bdaddr_t bdaddr;
1597 uint8_t link_type;
1598 uint8_t trans_interval;
1599 uint8_t retrans_window;
1600 uint16_t rx_pkt_len;
1601 uint16_t tx_pkt_len;
1602 uint8_t air_mode;
1603} QEMU_PACKED evt_sync_conn_complete;
1604#define EVT_SYNC_CONN_COMPLETE_SIZE 17
1605
1606#define EVT_SYNC_CONN_CHANGED 0x2D
1607typedef struct {
1608 uint8_t status;
1609 uint16_t handle;
1610 uint8_t trans_interval;
1611 uint8_t retrans_window;
1612 uint16_t rx_pkt_len;
1613 uint16_t tx_pkt_len;
1614} QEMU_PACKED evt_sync_conn_changed;
1615#define EVT_SYNC_CONN_CHANGED_SIZE 9
1616
1617#define EVT_SNIFF_SUBRATE 0x2E
1618typedef struct {
1619 uint8_t status;
1620 uint16_t handle;
1621 uint16_t max_remote_latency;
1622 uint16_t max_local_latency;
1623 uint16_t min_remote_timeout;
1624 uint16_t min_local_timeout;
1625} QEMU_PACKED evt_sniff_subrate;
1626#define EVT_SNIFF_SUBRATE_SIZE 11
1627
1628#define EVT_TESTING 0xFE
1629
1630#define EVT_VENDOR 0xFF
1631
1632/* Command opcode pack/unpack */
1633#define cmd_opcode_pack(ogf, ocf) (uint16_t)((ocf & 0x03ff)|(ogf << 10))
1634#define cmd_opcode_ogf(op) (op >> 10)
1635#define cmd_opcode_ocf(op) (op & 0x03ff)
1636
1637/* ACL handle and flags pack/unpack */
1638#define acl_handle_pack(h, f) (uint16_t)(((h) & 0x0fff)|((f) << 12))
1639#define acl_handle(h) ((h) & 0x0fff)
1640#define acl_flags(h) ((h) >> 12)
1641
1642/* HCI Packet structures */
1643#define HCI_COMMAND_HDR_SIZE 3
1644#define HCI_EVENT_HDR_SIZE 2
1645#define HCI_ACL_HDR_SIZE 4
1646#define HCI_SCO_HDR_SIZE 3
1647
1648struct hci_command_hdr {
1649 uint16_t opcode; /* OCF & OGF */
1650 uint8_t plen;
1651} QEMU_PACKED;
1652
1653struct hci_event_hdr {
1654 uint8_t evt;
1655 uint8_t plen;
1656} QEMU_PACKED;
1657
1658struct hci_acl_hdr {
1659 uint16_t handle; /* Handle & Flags(PB, BC) */
1660 uint16_t dlen;
1661} QEMU_PACKED;
1662
1663struct hci_sco_hdr {
1664 uint16_t handle;
1665 uint8_t dlen;
1666} QEMU_PACKED;
1667
1668/* L2CAP layer defines */
1669
1670enum bt_l2cap_lm_bits {
1671 L2CAP_LM_MASTER = 1 << 0,
1672 L2CAP_LM_AUTH = 1 << 1,
1673 L2CAP_LM_ENCRYPT = 1 << 2,
1674 L2CAP_LM_TRUSTED = 1 << 3,
1675 L2CAP_LM_RELIABLE = 1 << 4,
1676 L2CAP_LM_SECURE = 1 << 5,
1677};
1678
1679enum bt_l2cap_cid_predef {
1680 L2CAP_CID_INVALID = 0x0000,
1681 L2CAP_CID_SIGNALLING= 0x0001,
1682 L2CAP_CID_GROUP = 0x0002,
1683 L2CAP_CID_ALLOC = 0x0040,
1684};
1685
1686/* L2CAP command codes */
1687enum bt_l2cap_cmd {
1688 L2CAP_COMMAND_REJ = 1,
1689 L2CAP_CONN_REQ,
1690 L2CAP_CONN_RSP,
1691 L2CAP_CONF_REQ,
1692 L2CAP_CONF_RSP,
1693 L2CAP_DISCONN_REQ,
1694 L2CAP_DISCONN_RSP,
1695 L2CAP_ECHO_REQ,
1696 L2CAP_ECHO_RSP,
1697 L2CAP_INFO_REQ,
1698 L2CAP_INFO_RSP,
1699};
1700
1701enum bt_l2cap_sar_bits {
1702 L2CAP_SAR_NO_SEG = 0,
1703 L2CAP_SAR_START,
1704 L2CAP_SAR_END,
1705 L2CAP_SAR_CONT,
1706};
1707
1708/* L2CAP structures */
1709typedef struct {
1710 uint16_t len;
1711 uint16_t cid;
1712 uint8_t data[0];
1713} QEMU_PACKED l2cap_hdr;
1714#define L2CAP_HDR_SIZE 4
1715
1716typedef struct {
1717 uint8_t code;
1718 uint8_t ident;
1719 uint16_t len;
1720} QEMU_PACKED l2cap_cmd_hdr;
1721#define L2CAP_CMD_HDR_SIZE 4
1722
1723typedef struct {
1724 uint16_t reason;
1725} QEMU_PACKED l2cap_cmd_rej;
1726#define L2CAP_CMD_REJ_SIZE 2
1727
1728typedef struct {
1729 uint16_t dcid;
1730 uint16_t scid;
1731} QEMU_PACKED l2cap_cmd_rej_cid;
1732#define L2CAP_CMD_REJ_CID_SIZE 4
1733
1734/* reject reason */
1735enum bt_l2cap_rej_reason {
1736 L2CAP_REJ_CMD_NOT_UNDERSTOOD = 0,
1737 L2CAP_REJ_SIG_TOOBIG,
1738 L2CAP_REJ_CID_INVAL,
1739};
1740
1741typedef struct {
1742 uint16_t psm;
1743 uint16_t scid;
1744} QEMU_PACKED l2cap_conn_req;
1745#define L2CAP_CONN_REQ_SIZE 4
1746
1747typedef struct {
1748 uint16_t dcid;
1749 uint16_t scid;
1750 uint16_t result;
1751 uint16_t status;
1752} QEMU_PACKED l2cap_conn_rsp;
1753#define L2CAP_CONN_RSP_SIZE 8
1754
1755/* connect result */
1756enum bt_l2cap_conn_res {
1757 L2CAP_CR_SUCCESS = 0,
1758 L2CAP_CR_PEND,
1759 L2CAP_CR_BAD_PSM,
1760 L2CAP_CR_SEC_BLOCK,
1761 L2CAP_CR_NO_MEM,
1762};
1763
1764/* connect status */
1765enum bt_l2cap_conn_stat {
1766 L2CAP_CS_NO_INFO = 0,
1767 L2CAP_CS_AUTHEN_PEND,
1768 L2CAP_CS_AUTHOR_PEND,
1769};
1770
1771typedef struct {
1772 uint16_t dcid;
1773 uint16_t flags;
1774 uint8_t data[0];
1775} QEMU_PACKED l2cap_conf_req;
1776#define L2CAP_CONF_REQ_SIZE(datalen) (4 + (datalen))
1777
1778typedef struct {
1779 uint16_t scid;
1780 uint16_t flags;
1781 uint16_t result;
1782 uint8_t data[0];
1783} QEMU_PACKED l2cap_conf_rsp;
1784#define L2CAP_CONF_RSP_SIZE(datalen) (6 + datalen)
1785
1786enum bt_l2cap_conf_res {
1787 L2CAP_CONF_SUCCESS = 0,
1788 L2CAP_CONF_UNACCEPT,
1789 L2CAP_CONF_REJECT,
1790 L2CAP_CONF_UNKNOWN,
1791};
1792
1793typedef struct {
1794 uint8_t type;
1795 uint8_t len;
1796 uint8_t val[0];
1797} QEMU_PACKED l2cap_conf_opt;
1798#define L2CAP_CONF_OPT_SIZE 2
1799
1800enum bt_l2cap_conf_val {
1801 L2CAP_CONF_MTU = 1,
1802 L2CAP_CONF_FLUSH_TO,
1803 L2CAP_CONF_QOS,
1804 L2CAP_CONF_RFC,
1805 L2CAP_CONF_RFC_MODE = L2CAP_CONF_RFC,
1806};
1807
1808typedef struct {
1809 uint8_t flags;
1810 uint8_t service_type;
1811 uint32_t token_rate;
1812 uint32_t token_bucket_size;
1813 uint32_t peak_bandwidth;
1814 uint32_t latency;
1815 uint32_t delay_variation;
1816} QEMU_PACKED l2cap_conf_opt_qos;
1817#define L2CAP_CONF_OPT_QOS_SIZE 22
1818
1819enum bt_l2cap_conf_opt_qos_st {
1820 L2CAP_CONF_QOS_NO_TRAFFIC = 0x00,
1821 L2CAP_CONF_QOS_BEST_EFFORT,
1822 L2CAP_CONF_QOS_GUARANTEED,
1823};
1824
1825#define L2CAP_CONF_QOS_WILDCARD 0xffffffff
1826
1827enum bt_l2cap_mode {
1828 L2CAP_MODE_BASIC = 0,
1829 L2CAP_MODE_RETRANS = 1,
1830 L2CAP_MODE_FLOWCTL = 2,
1831};
1832
1833typedef struct {
1834 uint16_t dcid;
1835 uint16_t scid;
1836} QEMU_PACKED l2cap_disconn_req;
1837#define L2CAP_DISCONN_REQ_SIZE 4
1838
1839typedef struct {
1840 uint16_t dcid;
1841 uint16_t scid;
1842} QEMU_PACKED l2cap_disconn_rsp;
1843#define L2CAP_DISCONN_RSP_SIZE 4
1844
1845typedef struct {
1846 uint16_t type;
1847} QEMU_PACKED l2cap_info_req;
1848#define L2CAP_INFO_REQ_SIZE 2
1849
1850typedef struct {
1851 uint16_t type;
1852 uint16_t result;
1853 uint8_t data[0];
1854} QEMU_PACKED l2cap_info_rsp;
1855#define L2CAP_INFO_RSP_SIZE 4
1856
1857/* info type */
1858enum bt_l2cap_info_type {
1859 L2CAP_IT_CL_MTU = 1,
1860 L2CAP_IT_FEAT_MASK,
1861};
1862
1863/* info result */
1864enum bt_l2cap_info_result {
1865 L2CAP_IR_SUCCESS = 0,
1866 L2CAP_IR_NOTSUPP,
1867};
1868
1869/* Service Discovery Protocol defines */
1870/* Note that all multibyte values in lower layer protocols (above in this file)
1871 * are little-endian while SDP is big-endian. */
1872
1873/* Protocol UUIDs */
1874enum sdp_proto_uuid {
1875 SDP_UUID = 0x0001,
1876 UDP_UUID = 0x0002,
1877 RFCOMM_UUID = 0x0003,
1878 TCP_UUID = 0x0004,
1879 TCS_BIN_UUID = 0x0005,
1880 TCS_AT_UUID = 0x0006,
1881 OBEX_UUID = 0x0008,
1882 IP_UUID = 0x0009,
1883 FTP_UUID = 0x000a,
1884 HTTP_UUID = 0x000c,
1885 WSP_UUID = 0x000e,
1886 BNEP_UUID = 0x000f,
1887 UPNP_UUID = 0x0010,
1888 HIDP_UUID = 0x0011,
1889 HCRP_CTRL_UUID = 0x0012,
1890 HCRP_DATA_UUID = 0x0014,
1891 HCRP_NOTE_UUID = 0x0016,
1892 AVCTP_UUID = 0x0017,
1893 AVDTP_UUID = 0x0019,
1894 CMTP_UUID = 0x001b,
1895 UDI_UUID = 0x001d,
1896 MCAP_CTRL_UUID = 0x001e,
1897 MCAP_DATA_UUID = 0x001f,
1898 L2CAP_UUID = 0x0100,
1899};
1900
1901/*
1902 * Service class identifiers of standard services and service groups
1903 */
1904enum service_class_id {
1905 SDP_SERVER_SVCLASS_ID = 0x1000,
1906 BROWSE_GRP_DESC_SVCLASS_ID = 0x1001,
1907 PUBLIC_BROWSE_GROUP = 0x1002,
1908 SERIAL_PORT_SVCLASS_ID = 0x1101,
1909 LAN_ACCESS_SVCLASS_ID = 0x1102,
1910 DIALUP_NET_SVCLASS_ID = 0x1103,
1911 IRMC_SYNC_SVCLASS_ID = 0x1104,
1912 OBEX_OBJPUSH_SVCLASS_ID = 0x1105,
1913 OBEX_FILETRANS_SVCLASS_ID = 0x1106,
1914 IRMC_SYNC_CMD_SVCLASS_ID = 0x1107,
1915 HEADSET_SVCLASS_ID = 0x1108,
1916 CORDLESS_TELEPHONY_SVCLASS_ID = 0x1109,
1917 AUDIO_SOURCE_SVCLASS_ID = 0x110a,
1918 AUDIO_SINK_SVCLASS_ID = 0x110b,
1919 AV_REMOTE_TARGET_SVCLASS_ID = 0x110c,
1920 ADVANCED_AUDIO_SVCLASS_ID = 0x110d,
1921 AV_REMOTE_SVCLASS_ID = 0x110e,
1922 VIDEO_CONF_SVCLASS_ID = 0x110f,
1923 INTERCOM_SVCLASS_ID = 0x1110,
1924 FAX_SVCLASS_ID = 0x1111,
1925 HEADSET_AGW_SVCLASS_ID = 0x1112,
1926 WAP_SVCLASS_ID = 0x1113,
1927 WAP_CLIENT_SVCLASS_ID = 0x1114,
1928 PANU_SVCLASS_ID = 0x1115,
1929 NAP_SVCLASS_ID = 0x1116,
1930 GN_SVCLASS_ID = 0x1117,
1931 DIRECT_PRINTING_SVCLASS_ID = 0x1118,
1932 REFERENCE_PRINTING_SVCLASS_ID = 0x1119,
1933 IMAGING_SVCLASS_ID = 0x111a,
1934 IMAGING_RESPONDER_SVCLASS_ID = 0x111b,
1935 IMAGING_ARCHIVE_SVCLASS_ID = 0x111c,
1936 IMAGING_REFOBJS_SVCLASS_ID = 0x111d,
1937 HANDSFREE_SVCLASS_ID = 0x111e,
1938 HANDSFREE_AGW_SVCLASS_ID = 0x111f,
1939 DIRECT_PRT_REFOBJS_SVCLASS_ID = 0x1120,
1940 REFLECTED_UI_SVCLASS_ID = 0x1121,
1941 BASIC_PRINTING_SVCLASS_ID = 0x1122,
1942 PRINTING_STATUS_SVCLASS_ID = 0x1123,
1943 HID_SVCLASS_ID = 0x1124,
1944 HCR_SVCLASS_ID = 0x1125,
1945 HCR_PRINT_SVCLASS_ID = 0x1126,
1946 HCR_SCAN_SVCLASS_ID = 0x1127,
1947 CIP_SVCLASS_ID = 0x1128,
1948 VIDEO_CONF_GW_SVCLASS_ID = 0x1129,
1949 UDI_MT_SVCLASS_ID = 0x112a,
1950 UDI_TA_SVCLASS_ID = 0x112b,
1951 AV_SVCLASS_ID = 0x112c,
1952 SAP_SVCLASS_ID = 0x112d,
1953 PBAP_PCE_SVCLASS_ID = 0x112e,
1954 PBAP_PSE_SVCLASS_ID = 0x112f,
1955 PBAP_SVCLASS_ID = 0x1130,
1956 PNP_INFO_SVCLASS_ID = 0x1200,
1957 GENERIC_NETWORKING_SVCLASS_ID = 0x1201,
1958 GENERIC_FILETRANS_SVCLASS_ID = 0x1202,
1959 GENERIC_AUDIO_SVCLASS_ID = 0x1203,
1960 GENERIC_TELEPHONY_SVCLASS_ID = 0x1204,
1961 UPNP_SVCLASS_ID = 0x1205,
1962 UPNP_IP_SVCLASS_ID = 0x1206,
1963 UPNP_PAN_SVCLASS_ID = 0x1300,
1964 UPNP_LAP_SVCLASS_ID = 0x1301,
1965 UPNP_L2CAP_SVCLASS_ID = 0x1302,
1966 VIDEO_SOURCE_SVCLASS_ID = 0x1303,
1967 VIDEO_SINK_SVCLASS_ID = 0x1304,
1968 VIDEO_DISTRIBUTION_SVCLASS_ID = 0x1305,
1969 MDP_SVCLASS_ID = 0x1400,
1970 MDP_SOURCE_SVCLASS_ID = 0x1401,
1971 MDP_SINK_SVCLASS_ID = 0x1402,
1972 APPLE_AGENT_SVCLASS_ID = 0x2112,
1973};
1974
1975/*
1976 * Standard profile descriptor identifiers; note these
1977 * may be identical to some of the service classes defined above
1978 */
1979#define SDP_SERVER_PROFILE_ID SDP_SERVER_SVCLASS_ID
1980#define BROWSE_GRP_DESC_PROFILE_ID BROWSE_GRP_DESC_SVCLASS_ID
1981#define SERIAL_PORT_PROFILE_ID SERIAL_PORT_SVCLASS_ID
1982#define LAN_ACCESS_PROFILE_ID LAN_ACCESS_SVCLASS_ID
1983#define DIALUP_NET_PROFILE_ID DIALUP_NET_SVCLASS_ID
1984#define IRMC_SYNC_PROFILE_ID IRMC_SYNC_SVCLASS_ID
1985#define OBEX_OBJPUSH_PROFILE_ID OBEX_OBJPUSH_SVCLASS_ID
1986#define OBEX_FILETRANS_PROFILE_ID OBEX_FILETRANS_SVCLASS_ID
1987#define IRMC_SYNC_CMD_PROFILE_ID IRMC_SYNC_CMD_SVCLASS_ID
1988#define HEADSET_PROFILE_ID HEADSET_SVCLASS_ID
1989#define CORDLESS_TELEPHONY_PROFILE_ID CORDLESS_TELEPHONY_SVCLASS_ID
1990#define AUDIO_SOURCE_PROFILE_ID AUDIO_SOURCE_SVCLASS_ID
1991#define AUDIO_SINK_PROFILE_ID AUDIO_SINK_SVCLASS_ID
1992#define AV_REMOTE_TARGET_PROFILE_ID AV_REMOTE_TARGET_SVCLASS_ID
1993#define ADVANCED_AUDIO_PROFILE_ID ADVANCED_AUDIO_SVCLASS_ID
1994#define AV_REMOTE_PROFILE_ID AV_REMOTE_SVCLASS_ID
1995#define VIDEO_CONF_PROFILE_ID VIDEO_CONF_SVCLASS_ID
1996#define INTERCOM_PROFILE_ID INTERCOM_SVCLASS_ID
1997#define FAX_PROFILE_ID FAX_SVCLASS_ID
1998#define HEADSET_AGW_PROFILE_ID HEADSET_AGW_SVCLASS_ID
1999#define WAP_PROFILE_ID WAP_SVCLASS_ID
2000#define WAP_CLIENT_PROFILE_ID WAP_CLIENT_SVCLASS_ID
2001#define PANU_PROFILE_ID PANU_SVCLASS_ID
2002#define NAP_PROFILE_ID NAP_SVCLASS_ID
2003#define GN_PROFILE_ID GN_SVCLASS_ID
2004#define DIRECT_PRINTING_PROFILE_ID DIRECT_PRINTING_SVCLASS_ID
2005#define REFERENCE_PRINTING_PROFILE_ID REFERENCE_PRINTING_SVCLASS_ID
2006#define IMAGING_PROFILE_ID IMAGING_SVCLASS_ID
2007#define IMAGING_RESPONDER_PROFILE_ID IMAGING_RESPONDER_SVCLASS_ID
2008#define IMAGING_ARCHIVE_PROFILE_ID IMAGING_ARCHIVE_SVCLASS_ID
2009#define IMAGING_REFOBJS_PROFILE_ID IMAGING_REFOBJS_SVCLASS_ID
2010#define HANDSFREE_PROFILE_ID HANDSFREE_SVCLASS_ID
2011#define HANDSFREE_AGW_PROFILE_ID HANDSFREE_AGW_SVCLASS_ID
2012#define DIRECT_PRT_REFOBJS_PROFILE_ID DIRECT_PRT_REFOBJS_SVCLASS_ID
2013#define REFLECTED_UI_PROFILE_ID REFLECTED_UI_SVCLASS_ID
2014#define BASIC_PRINTING_PROFILE_ID BASIC_PRINTING_SVCLASS_ID
2015#define PRINTING_STATUS_PROFILE_ID PRINTING_STATUS_SVCLASS_ID
2016#define HID_PROFILE_ID HID_SVCLASS_ID
2017#define HCR_PROFILE_ID HCR_SCAN_SVCLASS_ID
2018#define HCR_PRINT_PROFILE_ID HCR_PRINT_SVCLASS_ID
2019#define HCR_SCAN_PROFILE_ID HCR_SCAN_SVCLASS_ID
2020#define CIP_PROFILE_ID CIP_SVCLASS_ID
2021#define VIDEO_CONF_GW_PROFILE_ID VIDEO_CONF_GW_SVCLASS_ID
2022#define UDI_MT_PROFILE_ID UDI_MT_SVCLASS_ID
2023#define UDI_TA_PROFILE_ID UDI_TA_SVCLASS_ID
2024#define AV_PROFILE_ID AV_SVCLASS_ID
2025#define SAP_PROFILE_ID SAP_SVCLASS_ID
2026#define PBAP_PCE_PROFILE_ID PBAP_PCE_SVCLASS_ID
2027#define PBAP_PSE_PROFILE_ID PBAP_PSE_SVCLASS_ID
2028#define PBAP_PROFILE_ID PBAP_SVCLASS_ID
2029#define PNP_INFO_PROFILE_ID PNP_INFO_SVCLASS_ID
2030#define GENERIC_NETWORKING_PROFILE_ID GENERIC_NETWORKING_SVCLASS_ID
2031#define GENERIC_FILETRANS_PROFILE_ID GENERIC_FILETRANS_SVCLASS_ID
2032#define GENERIC_AUDIO_PROFILE_ID GENERIC_AUDIO_SVCLASS_ID
2033#define GENERIC_TELEPHONY_PROFILE_ID GENERIC_TELEPHONY_SVCLASS_ID
2034#define UPNP_PROFILE_ID UPNP_SVCLASS_ID
2035#define UPNP_IP_PROFILE_ID UPNP_IP_SVCLASS_ID
2036#define UPNP_PAN_PROFILE_ID UPNP_PAN_SVCLASS_ID
2037#define UPNP_LAP_PROFILE_ID UPNP_LAP_SVCLASS_ID
2038#define UPNP_L2CAP_PROFILE_ID UPNP_L2CAP_SVCLASS_ID
2039#define VIDEO_SOURCE_PROFILE_ID VIDEO_SOURCE_SVCLASS_ID
2040#define VIDEO_SINK_PROFILE_ID VIDEO_SINK_SVCLASS_ID
2041#define VIDEO_DISTRIBUTION_PROFILE_ID VIDEO_DISTRIBUTION_SVCLASS_ID
2042#define MDP_PROFILE_ID MDP_SVCLASS_ID
2043#define MDP_SOURCE_PROFILE_ID MDP_SROUCE_SVCLASS_ID
2044#define MDP_SINK_PROFILE_ID MDP_SINK_SVCLASS_ID
2045#define APPLE_AGENT_PROFILE_ID APPLE_AGENT_SVCLASS_ID
2046
2047/* Data Representation */
2048enum bt_sdp_data_type {
2049 SDP_DTYPE_NIL = 0 << 3,
2050 SDP_DTYPE_UINT = 1 << 3,
2051 SDP_DTYPE_SINT = 2 << 3,
2052 SDP_DTYPE_UUID = 3 << 3,
2053 SDP_DTYPE_STRING = 4 << 3,
2054 SDP_DTYPE_BOOL = 5 << 3,
2055 SDP_DTYPE_SEQ = 6 << 3,
2056 SDP_DTYPE_ALT = 7 << 3,
2057 SDP_DTYPE_URL = 8 << 3,
2058};
2059
2060enum bt_sdp_data_size {
2061 SDP_DSIZE_1 = 0,
2062 SDP_DSIZE_2,
2063 SDP_DSIZE_4,
2064 SDP_DSIZE_8,
2065 SDP_DSIZE_16,
2066 SDP_DSIZE_NEXT1,
2067 SDP_DSIZE_NEXT2,
2068 SDP_DSIZE_NEXT4,
2069 SDP_DSIZE_MASK = SDP_DSIZE_NEXT4,
2070};
2071
2072enum bt_sdp_cmd {
2073 SDP_ERROR_RSP = 0x01,
2074 SDP_SVC_SEARCH_REQ = 0x02,
2075 SDP_SVC_SEARCH_RSP = 0x03,
2076 SDP_SVC_ATTR_REQ = 0x04,
2077 SDP_SVC_ATTR_RSP = 0x05,
2078 SDP_SVC_SEARCH_ATTR_REQ = 0x06,
2079 SDP_SVC_SEARCH_ATTR_RSP = 0x07,
2080};
2081
2082enum bt_sdp_errorcode {
2083 SDP_INVALID_VERSION = 0x0001,
2084 SDP_INVALID_RECORD_HANDLE = 0x0002,
2085 SDP_INVALID_SYNTAX = 0x0003,
2086 SDP_INVALID_PDU_SIZE = 0x0004,
2087 SDP_INVALID_CSTATE = 0x0005,
2088};
2089
2090/*
2091 * String identifiers are based on the SDP spec stating that
2092 * "base attribute id of the primary (universal) language must be 0x0100"
2093 *
2094 * Other languages should have their own offset; e.g.:
2095 * #define XXXLangBase yyyy
2096 * #define AttrServiceName_XXX 0x0000+XXXLangBase
2097 */
2098#define SDP_PRIMARY_LANG_BASE 0x0100
2099
2100enum bt_sdp_attribute_id {
2101 SDP_ATTR_RECORD_HANDLE = 0x0000,
2102 SDP_ATTR_SVCLASS_ID_LIST = 0x0001,
2103 SDP_ATTR_RECORD_STATE = 0x0002,
2104 SDP_ATTR_SERVICE_ID = 0x0003,
2105 SDP_ATTR_PROTO_DESC_LIST = 0x0004,
2106 SDP_ATTR_BROWSE_GRP_LIST = 0x0005,
2107 SDP_ATTR_LANG_BASE_ATTR_ID_LIST = 0x0006,
2108 SDP_ATTR_SVCINFO_TTL = 0x0007,
2109 SDP_ATTR_SERVICE_AVAILABILITY = 0x0008,
2110 SDP_ATTR_PFILE_DESC_LIST = 0x0009,
2111 SDP_ATTR_DOC_URL = 0x000a,
2112 SDP_ATTR_CLNT_EXEC_URL = 0x000b,
2113 SDP_ATTR_ICON_URL = 0x000c,
2114 SDP_ATTR_ADD_PROTO_DESC_LIST = 0x000d,
2115
2116 SDP_ATTR_SVCNAME_PRIMARY = SDP_PRIMARY_LANG_BASE + 0,
2117 SDP_ATTR_SVCDESC_PRIMARY = SDP_PRIMARY_LANG_BASE + 1,
2118 SDP_ATTR_SVCPROV_PRIMARY = SDP_PRIMARY_LANG_BASE + 2,
2119
2120 SDP_ATTR_GROUP_ID = 0x0200,
2121 SDP_ATTR_IP_SUBNET = 0x0200,
2122
2123 /* SDP */
2124 SDP_ATTR_VERSION_NUM_LIST = 0x0200,
2125 SDP_ATTR_SVCDB_STATE = 0x0201,
2126
2127 SDP_ATTR_SERVICE_VERSION = 0x0300,
2128 SDP_ATTR_EXTERNAL_NETWORK = 0x0301,
2129 SDP_ATTR_SUPPORTED_DATA_STORES_LIST = 0x0301,
2130 SDP_ATTR_FAX_CLASS1_SUPPORT = 0x0302,
2131 SDP_ATTR_REMOTE_AUDIO_VOLUME_CONTROL = 0x0302,
2132 SDP_ATTR_FAX_CLASS20_SUPPORT = 0x0303,
2133 SDP_ATTR_SUPPORTED_FORMATS_LIST = 0x0303,
2134 SDP_ATTR_FAX_CLASS2_SUPPORT = 0x0304,
2135 SDP_ATTR_AUDIO_FEEDBACK_SUPPORT = 0x0305,
2136 SDP_ATTR_NETWORK_ADDRESS = 0x0306,
2137 SDP_ATTR_WAP_GATEWAY = 0x0307,
2138 SDP_ATTR_HOMEPAGE_URL = 0x0308,
2139 SDP_ATTR_WAP_STACK_TYPE = 0x0309,
2140 SDP_ATTR_SECURITY_DESC = 0x030a,
2141 SDP_ATTR_NET_ACCESS_TYPE = 0x030b,
2142 SDP_ATTR_MAX_NET_ACCESSRATE = 0x030c,
2143 SDP_ATTR_IP4_SUBNET = 0x030d,
2144 SDP_ATTR_IP6_SUBNET = 0x030e,
2145 SDP_ATTR_SUPPORTED_CAPABILITIES = 0x0310,
2146 SDP_ATTR_SUPPORTED_FEATURES = 0x0311,
2147 SDP_ATTR_SUPPORTED_FUNCTIONS = 0x0312,
2148 SDP_ATTR_TOTAL_IMAGING_DATA_CAPACITY = 0x0313,
2149 SDP_ATTR_SUPPORTED_REPOSITORIES = 0x0314,
2150
2151 /* PnP Information */
2152 SDP_ATTR_SPECIFICATION_ID = 0x0200,
2153 SDP_ATTR_VENDOR_ID = 0x0201,
2154 SDP_ATTR_PRODUCT_ID = 0x0202,
2155 SDP_ATTR_VERSION = 0x0203,
2156 SDP_ATTR_PRIMARY_RECORD = 0x0204,
2157 SDP_ATTR_VENDOR_ID_SOURCE = 0x0205,
2158
2159 /* BT HID */
2160 SDP_ATTR_DEVICE_RELEASE_NUMBER = 0x0200,
2161 SDP_ATTR_PARSER_VERSION = 0x0201,
2162 SDP_ATTR_DEVICE_SUBCLASS = 0x0202,
2163 SDP_ATTR_COUNTRY_CODE = 0x0203,
2164 SDP_ATTR_VIRTUAL_CABLE = 0x0204,
2165 SDP_ATTR_RECONNECT_INITIATE = 0x0205,
2166 SDP_ATTR_DESCRIPTOR_LIST = 0x0206,
2167 SDP_ATTR_LANG_ID_BASE_LIST = 0x0207,
2168 SDP_ATTR_SDP_DISABLE = 0x0208,
2169 SDP_ATTR_BATTERY_POWER = 0x0209,
2170 SDP_ATTR_REMOTE_WAKEUP = 0x020a,
2171 SDP_ATTR_PROFILE_VERSION = 0x020b,
2172 SDP_ATTR_SUPERVISION_TIMEOUT = 0x020c,
2173 SDP_ATTR_NORMALLY_CONNECTABLE = 0x020d,
2174 SDP_ATTR_BOOT_DEVICE = 0x020e,
2175};
2176
2177#endif
2178