Emulate a USB bluetooth dongle (or HCI Transport layer).

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@5349 c046a42c-6fe2-441c-8c8c-71466251a162

2 files changed, 650 insertions, 0 deletions

diff --git a/hw/usb-bt.c b/hw/usb-bt.c
new file mode 100644
index 0000000000..b9b3463c05
--- /dev/null
+++ b/hw/usb-bt.c
@@ -0,0 +1,647 @@
+/*
+ * QEMU Bluetooth HCI USB Transport Layer v1.0
+ *
+ * Copyright (C) 2007 OpenMoko, Inc.
+ * Copyright (C) 2008 Andrzej Zaborowski  <balrog@zabor.org>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 or
+ * (at your option) version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+
+#include "qemu-common.h"
+#include "usb.h"
+#include "net.h"
+#include "bt.h"
+
+struct USBBtState {
+    USBDevice dev;
+    struct HCIInfo *hci;
+
+    int altsetting;
+    int config;
+
+#define CFIFO_LEN_MASK	255
+#define DFIFO_LEN_MASK	4095
+    struct usb_hci_in_fifo_s {
+        uint8_t data[(DFIFO_LEN_MASK + 1) * 2];
+        struct {
+            uint8_t *data;
+            int len;
+        } fifo[CFIFO_LEN_MASK + 1];
+        int dstart, dlen, dsize, start, len;
+    } evt, acl, sco;
+
+    struct usb_hci_out_fifo_s {
+        uint8_t data[4096];
+	int len;
+    } outcmd, outacl, outsco;
+};
+
+#define USB_EVT_EP	1
+#define USB_ACL_EP	2
+#define USB_SCO_EP	3
+
+static const uint8_t qemu_bt_dev_descriptor[] = {
+    0x12,		/*  u8 bLength; */
+    USB_DT_DEVICE,	/*  u8 bDescriptorType; Device */
+    0x10, 0x01,		/*  u16 bcdUSB; v1.10 */
+
+    0xe0,	/*  u8  bDeviceClass; Wireless */
+    0x01,	/*  u8  bDeviceSubClass; Radio Frequency */
+    0x01,	/*  u8  bDeviceProtocol; Bluetooth */
+    0x40,	/*  u8  bMaxPacketSize0; 64 Bytes */
+
+    0x12, 0x0a,	/*  u16 idVendor; */
+    0x01, 0x00,	/*  u16 idProduct; Bluetooth Dongle (HCI mode) */
+    0x58, 0x19,	/*  u16 bcdDevice; (some devices have 0x48, 0x02) */
+
+    0x00,	/*  u8  iManufacturer; */
+    0x00,	/*  u8  iProduct; */
+    0x00,	/*  u8  iSerialNumber; */
+    0x01,	/*  u8  bNumConfigurations; */
+};
+
+static const uint8_t qemu_bt_config_descriptor[] = {
+    /* one configuration */
+    0x09,		/*  u8  bLength; */
+    USB_DT_CONFIG,	/*  u8  bDescriptorType; */
+    0xb1, 0x00,		/*  u16 wTotalLength; */
+    0x02,		/*  u8  bNumInterfaces; (2) */
+    0x01,		/*  u8  bConfigurationValue; */
+    0x00,		/*  u8  iConfiguration; */
+    0xc0,		/*  u8  bmAttributes;
+				     Bit 7: must be set,
+					 6: Self-powered,
+					 5: Remote wakeup,
+					 4..0: resvd */
+    0x00,		/*  u8  MaxPower; */
+
+    /* USB 1.1:
+     * USB 2.0, single TT organization (mandatory):
+     *	one interface, protocol 0
+     *
+     * USB 2.0, multiple TT organization (optional):
+     *	two interfaces, protocols 1 (like single TT)
+     *	and 2 (multiple TT mode) ... config is
+     *	sometimes settable
+     *	NOT IMPLEMENTED
+     */
+
+    /* interface one */
+    0x09,		/*  u8  if_bLength; */
+    USB_DT_INTERFACE,	/*  u8  if_bDescriptorType; */
+    0x00,		/*  u8  if_bInterfaceNumber; */
+    0x00,		/*  u8  if_bAlternateSetting; */
+    0x03,		/*  u8  if_bNumEndpoints; */
+    0xe0,		/*  u8  if_bInterfaceClass; Wireless */
+    0x01,		/*  u8  if_bInterfaceSubClass; Radio Frequency */
+    0x01,		/*  u8  if_bInterfaceProtocol; Bluetooth */
+    0x00,		/*  u8  if_iInterface; */
+
+    /* endpoint one */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_IN | USB_EVT_EP,	/*  u8  ep_bEndpointAddress; */
+    0x03,		/*  u8  ep_bmAttributes; Interrupt */
+    0x10, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x02,		/*  u8  ep_bInterval; */
+
+    /* endpoint two */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_OUT | USB_ACL_EP,	/*  u8  ep_bEndpointAddress; */
+    0x02,		/*  u8  ep_bmAttributes; Bulk */
+    0x40, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x0a,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* endpoint three */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_IN | USB_ACL_EP,	/*  u8  ep_bEndpointAddress; */
+    0x02,		/*  u8  ep_bmAttributes; Bulk */
+    0x40, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x0a,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* interface two setting one */
+    0x09,		/*  u8  if_bLength; */
+    USB_DT_INTERFACE,	/*  u8  if_bDescriptorType; */
+    0x01,		/*  u8  if_bInterfaceNumber; */
+    0x00,		/*  u8  if_bAlternateSetting; */
+    0x02,		/*  u8  if_bNumEndpoints; */
+    0xe0,		/*  u8  if_bInterfaceClass; Wireless */
+    0x01,		/*  u8  if_bInterfaceSubClass; Radio Frequency */
+    0x01,		/*  u8  if_bInterfaceProtocol; Bluetooth */
+    0x00,		/*  u8  if_iInterface; */
+
+    /* endpoint one */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_OUT | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x00, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* endpoint two */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_IN | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x00, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* interface two setting two */
+    0x09,		/*  u8  if_bLength; */
+    USB_DT_INTERFACE,	/*  u8  if_bDescriptorType; */
+    0x01,		/*  u8  if_bInterfaceNumber; */
+    0x01,		/*  u8  if_bAlternateSetting; */
+    0x02,		/*  u8  if_bNumEndpoints; */
+    0xe0,		/*  u8  if_bInterfaceClass; Wireless */
+    0x01,		/*  u8  if_bInterfaceSubClass; Radio Frequency */
+    0x01,		/*  u8  if_bInterfaceProtocol; Bluetooth */
+    0x00,		/*  u8  if_iInterface; */
+
+    /* endpoint one */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_OUT | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x09, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* endpoint two */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_IN | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x09, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* interface two setting three */
+    0x09,		/*  u8  if_bLength; */
+    USB_DT_INTERFACE,	/*  u8  if_bDescriptorType; */
+    0x01,		/*  u8  if_bInterfaceNumber; */
+    0x02,		/*  u8  if_bAlternateSetting; */
+    0x02,		/*  u8  if_bNumEndpoints; */
+    0xe0,		/*  u8  if_bInterfaceClass; Wireless */
+    0x01,		/*  u8  if_bInterfaceSubClass; Radio Frequency */
+    0x01,		/*  u8  if_bInterfaceProtocol; Bluetooth */
+    0x00,		/*  u8  if_iInterface; */
+
+    /* endpoint one */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_OUT | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x11, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* endpoint two */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_IN | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x11, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* interface two setting four */
+    0x09,		/*  u8  if_bLength; */
+    USB_DT_INTERFACE,	/*  u8  if_bDescriptorType; */
+    0x01,		/*  u8  if_bInterfaceNumber; */
+    0x03,		/*  u8  if_bAlternateSetting; */
+    0x02,		/*  u8  if_bNumEndpoints; */
+    0xe0,		/*  u8  if_bInterfaceClass; Wireless */
+    0x01,		/*  u8  if_bInterfaceSubClass; Radio Frequency */
+    0x01,		/*  u8  if_bInterfaceProtocol; Bluetooth */
+    0x00,		/*  u8  if_iInterface; */
+
+    /* endpoint one */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_OUT | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x19, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* endpoint two */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_IN | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x19, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* interface two setting five */
+    0x09,		/*  u8  if_bLength; */
+    USB_DT_INTERFACE,	/*  u8  if_bDescriptorType; */
+    0x01,		/*  u8  if_bInterfaceNumber; */
+    0x04,		/*  u8  if_bAlternateSetting; */
+    0x02,		/*  u8  if_bNumEndpoints; */
+    0xe0,		/*  u8  if_bInterfaceClass; Wireless */
+    0x01,		/*  u8  if_bInterfaceSubClass; Radio Frequency */
+    0x01,		/*  u8  if_bInterfaceProtocol; Bluetooth */
+    0x00,		/*  u8  if_iInterface; */
+
+    /* endpoint one */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_OUT | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x21, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* endpoint two */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_IN | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x21, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* interface two setting six */
+    0x09,		/*  u8  if_bLength; */
+    USB_DT_INTERFACE,	/*  u8  if_bDescriptorType; */
+    0x01,		/*  u8  if_bInterfaceNumber; */
+    0x05,		/*  u8  if_bAlternateSetting; */
+    0x02,		/*  u8  if_bNumEndpoints; */
+    0xe0,		/*  u8  if_bInterfaceClass; Wireless */
+    0x01,		/*  u8  if_bInterfaceSubClass; Radio Frequency */
+    0x01,		/*  u8  if_bInterfaceProtocol; Bluetooth */
+    0x00,		/*  u8  if_iInterface; */
+
+    /* endpoint one */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_OUT | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x31, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* endpoint two */
+    0x07,		/*  u8  ep_bLength; */
+    USB_DT_ENDPOINT,	/*  u8  ep_bDescriptorType; */
+    USB_DIR_IN | USB_SCO_EP,	/*  u8  ep_bEndpointAddress; */
+    0x01,		/*  u8  ep_bmAttributes; Isochronous */
+    0x31, 0x00,		/*  u16 ep_wMaxPacketSize; */
+    0x01,		/*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
+
+    /* If implemented, the DFU interface descriptor goes here with no
+     * endpoints or alternative settings.  */
+};
+
+static void usb_bt_fifo_reset(struct usb_hci_in_fifo_s *fifo)
+{
+    fifo->dstart = 0;
+    fifo->dlen = 0;
+    fifo->dsize = DFIFO_LEN_MASK + 1;
+    fifo->start = 0;
+    fifo->len = 0;
+}
+
+static void usb_bt_fifo_enqueue(struct usb_hci_in_fifo_s *fifo,
+                const uint8_t *data, int len)
+{
+    int off = fifo->dstart + fifo->dlen;
+    uint8_t *buf;
+
+    fifo->dlen += len;
+    if (off <= DFIFO_LEN_MASK) {
+        if (off + len > DFIFO_LEN_MASK + 1 &&
+                        (fifo->dsize = off + len) > (DFIFO_LEN_MASK + 1) * 2) {
+            fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
+            exit(-1);
+        }
+        buf = fifo->data + off;
+    } else {
+        if (fifo->dlen > fifo->dsize) {
+            fprintf(stderr, "%s: can't alloc %i bytes\n", __FUNCTION__, len);
+            exit(-1);
+        }
+        buf = fifo->data + off - fifo->dsize;
+    }
+
+    off = (fifo->start + fifo->len ++) & CFIFO_LEN_MASK;
+    fifo->fifo[off].data = memcpy(buf, data, len);
+    fifo->fifo[off].len = len;
+}
+
+static inline int usb_bt_fifo_dequeue(struct usb_hci_in_fifo_s *fifo,
+                USBPacket *p)
+{
+    int len;
+
+    if (likely(!fifo->len))
+        return USB_RET_STALL;
+
+    len = MIN(p->len, fifo->fifo[fifo->start].len);
+    memcpy(p->data, fifo->fifo[fifo->start].data, len);
+    if (len == p->len) {
+        fifo->fifo[fifo->start].len -= len;
+        fifo->fifo[fifo->start].data += len;
+    } else {
+        fifo->start ++;
+        fifo->start &= CFIFO_LEN_MASK;
+        fifo->len --;
+    }
+
+    fifo->dstart += len;
+    fifo->dlen -= len;
+    if (fifo->dstart >= fifo->dsize) {
+        fifo->dstart = 0;
+        fifo->dsize = DFIFO_LEN_MASK + 1;
+    }
+
+    return len;
+}
+
+static void inline usb_bt_fifo_out_enqueue(struct USBBtState *s,
+                struct usb_hci_out_fifo_s *fifo,
+                void (*send)(struct HCIInfo *, const uint8_t *, int),
+                int (*complete)(const uint8_t *, int),
+                const uint8_t *data, int len)
+{
+    if (fifo->len) {
+        memcpy(fifo->data + fifo->len, data, len);
+        fifo->len += len;
+        if (complete(fifo->data, fifo->len)) {
+            send(s->hci, fifo->data, fifo->len);
+            fifo->len = 0;
+        }
+    } else if (complete(data, len))
+        send(s->hci, data, len);
+    else {
+        memcpy(fifo->data, data, len);
+        fifo->len = len;
+    }
+
+    /* TODO: do we need to loop? */
+}
+
+static int usb_bt_hci_cmd_complete(const uint8_t *data, int len)
+{
+    len -= HCI_COMMAND_HDR_SIZE;
+    return len >= 0 &&
+            len >= ((struct hci_command_hdr *) data)->plen;
+}
+
+static int usb_bt_hci_acl_complete(const uint8_t *data, int len)
+{
+    len -= HCI_ACL_HDR_SIZE;
+    return len >= 0 &&
+            len >= le16_to_cpu(((struct hci_acl_hdr *) data)->dlen);
+}
+
+static int usb_bt_hci_sco_complete(const uint8_t *data, int len)
+{
+    len -= HCI_SCO_HDR_SIZE;
+    return len >= 0 &&
+            len >= ((struct hci_sco_hdr *) data)->dlen;
+}
+
+static void usb_bt_handle_reset(USBDevice *dev)
+{
+    struct USBBtState *s = (struct USBBtState *) dev->opaque;
+
+    usb_bt_fifo_reset(&s->evt);
+    usb_bt_fifo_reset(&s->acl);
+    usb_bt_fifo_reset(&s->sco);
+    s->outcmd.len = 0;
+    s->outacl.len = 0;
+    s->outsco.len = 0;
+    s->altsetting = 0;
+}
+
+static int usb_bt_handle_control(USBDevice *dev, int request, int value,
+                int index, int length, uint8_t *data)
+{
+    struct USBBtState *s = (struct USBBtState *) dev->opaque;
+    int ret = 0;
+
+    switch (request) {
+    case DeviceRequest | USB_REQ_GET_STATUS:
+    case InterfaceRequest | USB_REQ_GET_STATUS:
+    case EndpointRequest | USB_REQ_GET_STATUS:
+        data[0] = (1 << USB_DEVICE_SELF_POWERED) |
+            (dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
+        data[1] = 0x00;
+        ret = 2;
+        break;
+    case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
+    case InterfaceOutRequest | USB_REQ_CLEAR_FEATURE:
+    case EndpointOutRequest | USB_REQ_CLEAR_FEATURE:
+        if (value == USB_DEVICE_REMOTE_WAKEUP) {
+            dev->remote_wakeup = 0;
+        } else {
+            goto fail;
+        }
+        ret = 0;
+        break;
+    case DeviceOutRequest | USB_REQ_SET_FEATURE:
+    case InterfaceOutRequest | USB_REQ_SET_FEATURE:
+    case EndpointOutRequest | USB_REQ_SET_FEATURE:
+        if (value == USB_DEVICE_REMOTE_WAKEUP) {
+            dev->remote_wakeup = 1;
+        } else {
+            goto fail;
+        }
+        ret = 0;
+        break;
+    case DeviceOutRequest | USB_REQ_SET_ADDRESS:
+        dev->addr = value;
+        ret = 0;
+        break;
+    case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
+        switch (value >> 8) {
+        case USB_DT_DEVICE:
+            ret = sizeof(qemu_bt_dev_descriptor);
+            memcpy(data, qemu_bt_dev_descriptor, ret);
+            break;
+        case USB_DT_CONFIG:
+            ret = sizeof(qemu_bt_config_descriptor);
+            memcpy(data, qemu_bt_config_descriptor, ret);
+            break;
+        case USB_DT_STRING:
+            switch(value & 0xff) {
+            case 0:
+                /* language ids */
+                data[0] = 4;
+                data[1] = 3;
+                data[2] = 0x09;
+                data[3] = 0x04;
+                ret = 4;
+                break;
+            default:
+                goto fail;
+            }
+            break;
+        default:
+            goto fail;
+        }
+        break;
+    case DeviceRequest | USB_REQ_GET_CONFIGURATION:
+        data[0] = qemu_bt_config_descriptor[0x5];
+        ret = 1;
+        s->config = 0;
+        break;
+    case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
+        ret = 0;
+        if (value != qemu_bt_config_descriptor[0x5] && value != 0) {
+            printf("%s: Wrong SET_CONFIGURATION request (%i)\n",
+                            __FUNCTION__, value);
+            goto fail;
+        }
+        s->config = 1;
+        usb_bt_fifo_reset(&s->evt);
+        usb_bt_fifo_reset(&s->acl);
+        usb_bt_fifo_reset(&s->sco);
+        break;
+    case InterfaceRequest | USB_REQ_GET_INTERFACE:
+        if (value != 0 || (index & ~1) || length != 1)
+            goto fail;
+        if (index == 1)
+            data[0] = s->altsetting;
+        else
+            data[0] = 0;
+        ret = 1;
+        break;
+    case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
+        if ((index & ~1) || length != 0 ||
+                        (index == 1 && (value < 0 || value > 4)) ||
+                        (index == 0 && value != 0)) {
+            printf("%s: Wrong SET_INTERFACE request (%i, %i)\n",
+                            __FUNCTION__, index, value);
+            goto fail;
+        }
+        s->altsetting = value;
+        ret = 0;
+        break;
+    case ((USB_DIR_OUT | USB_TYPE_CLASS | USB_RECIP_DEVICE) << 8):
+        if (s->config)
+            usb_bt_fifo_out_enqueue(s, &s->outcmd, s->hci->cmd_send,
+                            usb_bt_hci_cmd_complete, data, length);
+        break;
+    default:
+    fail:
+        ret = USB_RET_STALL;
+        break;
+    }
+    return ret;
+}
+
+static int usb_bt_handle_data(USBDevice *dev, USBPacket *p)
+{
+    struct USBBtState *s = (struct USBBtState *) dev->opaque;
+    int ret = 0;
+
+    if (!s->config)
+        goto fail;
+
+    switch (p->pid) {
+    case USB_TOKEN_IN:
+        switch (p->devep & 0xf) {
+        case USB_EVT_EP:
+            ret = usb_bt_fifo_dequeue(&s->evt, p);
+            break;
+
+        case USB_ACL_EP:
+            ret = usb_bt_fifo_dequeue(&s->acl, p);
+            break;
+
+        case USB_SCO_EP:
+            ret = usb_bt_fifo_dequeue(&s->sco, p);
+            break;
+
+        default:
+            goto fail;
+        }
+        break;
+
+    case USB_TOKEN_OUT:
+        switch (p->devep & 0xf) {
+        case USB_ACL_EP:
+            usb_bt_fifo_out_enqueue(s, &s->outacl, s->hci->acl_send,
+                            usb_bt_hci_acl_complete, p->data, p->len);
+            break;
+
+        case USB_SCO_EP:
+            usb_bt_fifo_out_enqueue(s, &s->outsco, s->hci->sco_send,
+                            usb_bt_hci_sco_complete, p->data, p->len);
+            break;
+
+        default:
+            goto fail;
+        }
+        break;
+
+    default:
+    fail:
+        ret = USB_RET_STALL;
+        break;
+    }
+
+    return ret;
+}
+
+static void usb_bt_out_hci_packet_event(void *opaque,
+                const uint8_t *data, int len)
+{
+    struct USBBtState *s = (struct USBBtState *) opaque;
+
+    usb_bt_fifo_enqueue(&s->evt, data, len);
+}
+
+static void usb_bt_out_hci_packet_acl(void *opaque,
+                const uint8_t *data, int len)
+{
+    struct USBBtState *s = (struct USBBtState *) opaque;
+
+    usb_bt_fifo_enqueue(&s->acl, data, len);
+}
+
+static void usb_bt_handle_destroy(USBDevice *dev)
+{
+    struct USBBtState *s = (struct USBBtState *) dev->opaque;
+
+    s->hci->opaque = 0;
+    s->hci->evt_recv = 0;
+    s->hci->acl_recv = 0;
+    qemu_free(s);
+}
+
+USBDevice *usb_bt_init(HCIInfo *hci)
+{
+    struct USBBtState *s;
+
+    s = qemu_mallocz(sizeof(struct USBBtState));
+    if (!s)
+        return NULL;
+    s->dev.opaque = s;
+    s->dev.speed = USB_SPEED_HIGH;
+    s->dev.handle_packet = usb_generic_handle_packet;
+    pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU BT dongle");
+
+    s->dev.handle_reset = usb_bt_handle_reset;
+    s->dev.handle_control = usb_bt_handle_control;
+    s->dev.handle_data = usb_bt_handle_data;
+    s->dev.handle_destroy = usb_bt_handle_destroy;
+
+    s->hci = hci;
+    s->hci->opaque = s;
+    s->hci->evt_recv = usb_bt_out_hci_packet_event;
+    s->hci->acl_recv = usb_bt_out_hci_packet_acl;
+
+    usb_bt_handle_reset(&s->dev);
+
+    return &s->dev;
+}
diff --git a/hw/usb.h b/hw/usb.h
index 137488d206..4204808a00 100644
--- a/hw/usb.h
+++ b/hw/usb.h
@@ -255,6 +255,9 @@ USBDevice *usb_msd_init(const char *filename);
 /* usb-net.c */
 USBDevice *usb_net_init(NICInfo *nd);
 
+/* usb-bt.c */
+USBDevice *usb_bt_init(HCIInfo *hci);
+
 /* usb-wacom.c */
 USBDevice *usb_wacom_init(void);