1/*
2 * Wrap a host Bluetooth HCI socket in a struct HCIInfo.
3 *
4 * Copyright (C) 2008 Andrzej Zaborowski  <balrog@zabor.org>
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License as
8 * published by the Free Software Foundation; either version 2 or
9 * (at your option) version 3 of the License.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License along
17 * with this program; if not, write to the Free Software Foundation, Inc.,
18 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
19 */
20
21#include "qemu-common.h"
22#include "qemu-char.h"
23#include "sysemu.h"
24#include "net.h"
25#include "bt-host.h"
26
27#ifndef _WIN32
28# include <errno.h>
29# include <sys/ioctl.h>
30# include <sys/uio.h>
31# ifdef CONFIG_BLUEZ
32#  include <bluetooth/bluetooth.h>
33#  include <bluetooth/hci.h>
34#  include <bluetooth/hci_lib.h>
35# else
36#  include "hw/bt.h"
37#  define HCI_MAX_FRAME_SIZE	1028
38# endif
39
40struct bt_host_hci_s {
41    struct HCIInfo hci;
42    int fd;
43
44    uint8_t hdr[HCI_MAX_FRAME_SIZE];
45    int len;
46};
47
48static void bt_host_send(struct HCIInfo *hci,
49                int type, const uint8_t *data, int len)
50{
51    struct bt_host_hci_s *s = (struct bt_host_hci_s *) hci;
52    uint8_t pkt = type;
53    struct iovec iv[2];
54    int ret;
55
56    iv[0].iov_base = (void *)&pkt;
57    iv[0].iov_len  = 1;
58    iv[1].iov_base = (void *) data;
59    iv[1].iov_len  = len;
60
61    while ((ret = writev(s->fd, iv, 2)) < 0)
62        if (errno != EAGAIN && errno != EINTR) {
63            fprintf(stderr, "qemu: error %i writing bluetooth packet.\n",
64                            errno);
65            return;
66        }
67}
68
69static void bt_host_cmd(struct HCIInfo *hci, const uint8_t *data, int len)
70{
71    bt_host_send(hci, HCI_COMMAND_PKT, data, len);
72}
73
74static void bt_host_acl(struct HCIInfo *hci, const uint8_t *data, int len)
75{
76    bt_host_send(hci, HCI_ACLDATA_PKT, data, len);
77}
78
79static void bt_host_sco(struct HCIInfo *hci, const uint8_t *data, int len)
80{
81    bt_host_send(hci, HCI_SCODATA_PKT, data, len);
82}
83
84static int bt_host_read_poll(void *opaque)
85{
86    struct bt_host_hci_s *s = (struct bt_host_hci_s *) opaque;
87
88    return !!s->hci.evt_recv;
89}
90
91static void bt_host_read(void *opaque)
92{
93    struct bt_host_hci_s *s = (struct bt_host_hci_s *) opaque;
94    uint8_t *pkt;
95    int pktlen;
96
97    /* Seems that we can't read only the header first and then the amount
98     * of data indicated in the header because Linux will discard everything
99     * that's not been read in one go.  */
100    s->len = read(s->fd, s->hdr, sizeof(s->hdr));
101
102    if (s->len < 0) {
103        fprintf(stderr, "qemu: error %i reading HCI frame\n", errno);
104        return;
105    }
106
107    pkt = s->hdr;
108    while (s->len --)
109        switch (*pkt ++) {
110        case HCI_EVENT_PKT:
111            if (s->len < 2)
112                goto bad_pkt;
113
114            pktlen = MIN(pkt[1] + 2, s->len);
115            s->hci.evt_recv(s->hci.opaque, pkt, pktlen);
116            s->len -= pktlen;
117            pkt += pktlen;
118
119            /* TODO: if this is an Inquiry Result event, it's also
120             * interpreted by Linux kernel before we received it, possibly
121             * we should clean the kernel Inquiry cache through
122             * ioctl(s->fd, HCI_INQUIRY, ...).  */
123            break;
124
125        case HCI_ACLDATA_PKT:
126            if (s->len < 4)
127                goto bad_pkt;
128
129            pktlen = MIN(((pkt[3] << 8) | pkt[2]) + 4, s->len);
130            s->hci.acl_recv(s->hci.opaque, pkt, pktlen);
131            s->len -= pktlen;
132            pkt += pktlen;
133            break;
134
135        case HCI_SCODATA_PKT:
136            if (s->len < 3)
137                goto bad_pkt;
138
139            pktlen = MIN(pkt[2] + 3, s->len);
140            s->len -= pktlen;
141            pkt += pktlen;
142
143        default:
144        bad_pkt:
145            fprintf(stderr, "qemu: bad HCI packet type %02x\n", pkt[-1]);
146        }
147}
148
149static int bt_host_bdaddr_set(struct HCIInfo *hci, const uint8_t *bd_addr)
150{
151    return -ENOTSUP;
152}
153
154struct HCIInfo *bt_host_hci(const char *id)
155{
156    struct bt_host_hci_s *s;
157    int fd = -1;
158# ifdef CONFIG_BLUEZ
159    int dev_id = hci_devid(id);
160    struct hci_filter flt;
161
162    if (dev_id < 0) {
163        fprintf(stderr, "qemu: `%s' not available\n", id);
164        return 0;
165    }
166
167    fd = hci_open_dev(dev_id);
168
169    /* XXX: can we ensure nobody else has the device opened?  */
170# endif
171
172    if (fd < 0) {
173        fprintf(stderr, "qemu: Can't open `%s': %s (%i)\n",
174                        id, strerror(errno), errno);
175        return NULL;
176    }
177
178# ifdef CONFIG_BLUEZ
179    hci_filter_clear(&flt);
180    hci_filter_all_ptypes(&flt);
181    hci_filter_all_events(&flt);
182
183    if (setsockopt(fd, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
184        fprintf(stderr, "qemu: Can't set HCI filter on socket (%i)\n", errno);
185        return 0;
186    }
187# endif
188
189    s = qemu_mallocz(sizeof(struct bt_host_hci_s));
190    s->fd = fd;
191    s->hci.cmd_send = bt_host_cmd;
192    s->hci.sco_send = bt_host_sco;
193    s->hci.acl_send = bt_host_acl;
194    s->hci.bdaddr_set = bt_host_bdaddr_set;
195
196    qemu_set_fd_handler2(s->fd, bt_host_read_poll, bt_host_read, NULL, s);
197
198    return &s->hci;
199}
200#else
201struct HCIInfo *bt_host_hci(const char *id)
202{
203    fprintf(stderr, "qemu: bluetooth passthrough not supported (yet)\n");
204
205    return 0;
206}
207#endif
208