android/bluetooth.c

   1 /*
   2  *
   3  *  BlueZ - Bluetooth protocol stack for Linux
   4  *
   5  *  Copyright (C) 2013-2014  Intel Corporation. All rights reserved.
   6  *
   7  *
   8  *  This library is free software; you can redistribute it and/or
   9  *  modify it under the terms of the GNU Lesser General Public
  10  *  License as published by the Free Software Foundation; either
  11  *  version 2.1 of the License, or (at your option) any later version.
  12  *
  13  *  This library is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  *  Lesser General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU Lesser General Public
  19  *  License along with this library; if not, write to the Free Software
  20  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  21  *
  22  */
  23
  24 #ifdef HAVE_CONFIG_H
  25 #include <config.h>
  26 #endif
  27
  28 #include <errno.h>
  29 #include <stdlib.h>
  30 #include <unistd.h>
  31 #include <inttypes.h>
  32 #include <sys/types.h>
  33 #include <sys/stat.h>
  34 #include <fcntl.h>
  35
  36 #include <glib.h>
  37
  38 #include "lib/bluetooth.h"
  39 #include "lib/sdp.h"
  40 #include "lib/mgmt.h"
  41 #include "lib/uuid.h"
  42 #include "src/shared/util.h"
  43 #include "src/shared/mgmt.h"
  44 #include "src/shared/queue.h"
  45 #include "src/eir.h"
  46 #include "lib/sdp.h"
  47 #include "lib/sdp_lib.h"
  48 #include "src/sdp-client.h"
  49 #include "src/sdpd.h"
  50 #include "src/log.h"
  51 #include "hal-msg.h"
  52 #include "ipc-common.h"
  53 #include "ipc.h"
  54 #include "utils.h"
  55 #include "bluetooth.h"
  56
  57 #define DUT_MODE_FILE "/sys/kernel/debug/bluetooth/hci%u/dut_mode"
  58
  59 #define SETTINGS_FILE ANDROID_STORAGEDIR"/settings"
  60 #define DEVICES_FILE ANDROID_STORAGEDIR"/devices"
  61 #define CACHE_FILE ANDROID_STORAGEDIR"/cache"
  62
  63 #define ADAPTER_MAJOR_CLASS 0x02 /* Phone */
  64 #define ADAPTER_MINOR_CLASS 0x03 /* Smartphone */
  65
  66 /* Default to DisplayYesNo */
  67 #define DEFAULT_IO_CAPABILITY 0x01
  68
  69 /* Default discoverable timeout 120sec as in Android */
  70 #define DEFAULT_DISCOVERABLE_TIMEOUT 120
  71
  72 #define DEVICES_CACHE_MAX 300
  73
  74 #define BASELEN_PROP_CHANGED (sizeof(struct hal_ev_adapter_props_changed) \
  75                                         + sizeof(struct hal_property))
  76
  77 #define BASELEN_REMOTE_DEV_PROP (sizeof(struct hal_ev_remote_device_props) \
  78                                         + sizeof(struct hal_property))
  79
  80 #define SCAN_TYPE_NONE 0
  81 #define SCAN_TYPE_BREDR (1 << BDADDR_BREDR)
  82 #define SCAN_TYPE_LE ((1 << BDADDR_LE_PUBLIC) | (1 << BDADDR_LE_RANDOM))
  83 #define SCAN_TYPE_DUAL (SCAN_TYPE_BREDR | SCAN_TYPE_LE)
  84
  85 #define BDADDR_LE (BDADDR_LE_RANDOM | BDADDR_LE_PUBLIC)
  86
  87 struct device {
  88         bdaddr_t bdaddr;
  89         uint8_t bdaddr_type;
  90
  91         bdaddr_t rpa;
  92         uint8_t rpa_type;
  93
  94         bool le;
  95         bool bredr;
  96
  97         bool pairing;
  98
  99         bool bredr_paired;
 100         bool bredr_bonded;
 101         bool le_paired;
 102         bool le_bonded;
 103
 104         bool in_white_list;
 105
 106         bool connected;
 107
 108         char *name;
 109         char *friendly_name;
 110
 111         uint32_t class;
 112         int32_t rssi;
 113
 114         time_t bredr_seen;
 115         time_t le_seen;
 116
 117         GSList *uuids;
 118
 119         bool found; /* if device is found in current discovery session */
 120         unsigned int confirm_id; /* mgtm command id if command pending */
 121
 122         bool valid_remote_csrk;
 123         bool remote_csrk_auth;
 124         uint8_t remote_csrk[16];
 125         uint32_t remote_sign_cnt;
 126
 127         bool valid_local_csrk;
 128         bool local_csrk_auth;
 129         uint8_t local_csrk[16];
 130         uint32_t local_sign_cnt;
 131         uint16_t gatt_ccc;
 132 };
 133
 134 struct browse_req {
 135         bdaddr_t bdaddr;
 136         GSList *uuids;
 137         int search_uuid;
 138         int reconnect_attempt;
 139 };
 140
 141 static struct {
 142         uint16_t index;
 143
 144         bdaddr_t bdaddr;
 145         uint32_t dev_class;
 146
 147         char *name;
 148
 149         uint8_t max_advert_instance;
 150         uint8_t rpa_offload_supported;
 151         uint8_t max_irk_list_size;
 152         uint8_t max_scan_filters_supported;
 153         uint16_t scan_result_storage_size;
 154         uint8_t activity_energy_info_supported;
 155
 156         uint32_t current_settings;
 157         uint32_t supported_settings;
 158
 159         bool le_scanning;
 160         uint8_t cur_discovery_type;
 161         uint8_t exp_discovery_type;
 162         uint32_t discoverable_timeout;
 163
 164         GSList *uuids;
 165 } adapter = {
 166         .index = MGMT_INDEX_NONE,
 167         .dev_class = 0,
 168         .name = NULL,
 169         .max_advert_instance = 0,
 170         .rpa_offload_supported = 0,
 171         .max_irk_list_size = 0,
 172         .max_scan_filters_supported = 0,
 173         .scan_result_storage_size = 0,
 174         .activity_energy_info_supported = 0,
 175         .current_settings = 0,
 176         .supported_settings = 0,
 177         .cur_discovery_type = SCAN_TYPE_NONE,
 178         .exp_discovery_type = SCAN_TYPE_NONE,
 179         .discoverable_timeout = DEFAULT_DISCOVERABLE_TIMEOUT,
 180         .uuids = NULL,
 181 };
 182
 183 static const uint16_t uuid_list[] = {
 184         L2CAP_UUID,
 185         PNP_INFO_SVCLASS_ID,
 186         PUBLIC_BROWSE_GROUP,
 187         0
 188 };
 189
 190 static uint16_t option_index = MGMT_INDEX_NONE;
 191 static struct mgmt *mgmt_if = NULL;
 192
 193 static GSList *bonded_devices = NULL;
 194 static GSList *cached_devices = NULL;
 195
 196 static bt_le_device_found gatt_device_found_cb = NULL;
 197 static bt_le_discovery_stopped gatt_discovery_stopped_cb = NULL;
 198
 199 /* This list contains addresses which are asked for records */
 200 static GSList *browse_reqs;
 201
 202 static struct ipc *hal_ipc = NULL;
 203
 204 static bool kernel_conn_control = false;
 205
 206 static struct queue *unpaired_cb_list = NULL;
 207 static struct queue *paired_cb_list = NULL;
 208
 209 static void get_device_android_addr(struct device *dev, uint8_t *addr)
 210 {
 211         /*
 212          * If RPA is set it means that IRK was received and ID address is being
 213          * used. Android Framework is still using old RPA and it needs to be
 214          * used in notifications.
 215          */
 216         if (bacmp(&dev->rpa, BDADDR_ANY))
 217                 bdaddr2android(&dev->rpa, addr);
 218         else
 219                 bdaddr2android(&dev->bdaddr, addr);
 220 }
 221
 222 static void mgmt_debug(const char *str, void *user_data)
 223 {
 224         const char *prefix = user_data;
 225         info("%s%s", prefix, str);
 226 }
 227
 228 static void store_adapter_config(void)
 229 {
 230         GKeyFile *key_file;
 231         gsize length = 0;
 232         char addr[18];
 233         char *data;
 234
 235         key_file = g_key_file_new();
 236
 237         g_key_file_load_from_file(key_file, SETTINGS_FILE, 0, NULL);
 238
 239         ba2str(&adapter.bdaddr, addr);
 240
 241         g_key_file_set_string(key_file, "General", "Address", addr);
 242
 243         if (adapter.name)
 244                 g_key_file_set_string(key_file, "General", "Name",
 245                                 adapter.name);
 246
 247         g_key_file_set_integer(key_file, "General", "DiscoverableTimeout",
 248                                                 adapter.discoverable_timeout);
 249
 250         data = g_key_file_to_data(key_file, &length, NULL);
 251
 252         g_file_set_contents(SETTINGS_FILE, data, length, NULL);
 253
 254         g_free(data);
 255         g_key_file_free(key_file);
 256 }
 257
 258 static void load_adapter_config(void)
 259 {
 260         GError *gerr = NULL;
 261         GKeyFile *key_file;
 262         char *str;
 263
 264         key_file = g_key_file_new();
 265         g_key_file_load_from_file(key_file, SETTINGS_FILE, 0, NULL);
 266
 267         str = g_key_file_get_string(key_file, "General", "Address", NULL);
 268         if (!str) {
 269                 g_key_file_free(key_file);
 270                 return;
 271         }
 272
 273         str2ba(str, &adapter.bdaddr);
 274         g_free(str);
 275
 276         adapter.name = g_key_file_get_string(key_file, "General", "Name", NULL);
 277
 278         adapter.discoverable_timeout = g_key_file_get_integer(key_file,
 279                                 "General", "DiscoverableTimeout", &gerr);
 280         if (gerr) {
 281                 adapter.discoverable_timeout = DEFAULT_DISCOVERABLE_TIMEOUT;
 282                 g_clear_error(&gerr);
 283         }
 284
 285         g_key_file_free(key_file);
 286 }
 287
 288 static void store_device_info(struct device *dev, const char *path)
 289 {
 290         GKeyFile *key_file;
 291         char addr[18];
 292         gsize length = 0;
 293         char **uuids = NULL;
 294         char *str;
 295
 296         ba2str(&dev->bdaddr, addr);
 297
 298         key_file = g_key_file_new();
 299         g_key_file_load_from_file(key_file, path, 0, NULL);
 300
 301         g_key_file_set_boolean(key_file, addr, "BREDR", dev->bredr);
 302
 303         if (dev->le)
 304                 g_key_file_set_integer(key_file, addr, "AddressType",
 305                                                         dev->bdaddr_type);
 306
 307         g_key_file_set_string(key_file, addr, "Name", dev->name);
 308
 309         if (dev->friendly_name)
 310                 g_key_file_set_string(key_file, addr, "FriendlyName",
 311                                                         dev->friendly_name);
 312         else
 313                 g_key_file_remove_key(key_file, addr, "FriendlyName", NULL);
 314
 315         if (dev->class)
 316                 g_key_file_set_integer(key_file, addr, "Class", dev->class);
 317         else
 318                 g_key_file_remove_key(key_file, addr, "Class", NULL);
 319
 320         if (dev->bredr_seen > dev->le_seen)
 321                 g_key_file_set_integer(key_file, addr, "Timestamp",
 322                                                         dev->bredr_seen);
 323         else
 324                 g_key_file_set_integer(key_file, addr, "Timestamp",
 325                                                                 dev->le_seen);
 326
 327         if (dev->uuids) {
 328                 GSList *l;
 329                 int i;
 330
 331                 uuids = g_new0(char *, g_slist_length(dev->uuids) + 1);
 332
 333                 for (i = 0, l = dev->uuids; l; l = g_slist_next(l), i++) {
 334                         int j;
 335                         uint8_t *u = l->data;
 336                         char *uuid_str = g_malloc0(33);
 337
 338                         for (j = 0; j < 16; j++)
 339                                 sprintf(uuid_str + (j * 2), "%2.2X", u[j]);
 340
 341                         uuids[i] = uuid_str;
 342                 }
 343
 344                 g_key_file_set_string_list(key_file, addr, "Services",
 345                                                 (const char **)uuids, i);
 346         } else {
 347                 g_key_file_remove_key(key_file, addr, "Services", NULL);
 348         }
 349
 350         str = g_key_file_to_data(key_file, &length, NULL);
 351         g_file_set_contents(path, str, length, NULL);
 352         g_free(str);
 353
 354         g_key_file_free(key_file);
 355         g_strfreev(uuids);
 356 }
 357
 358 static void remove_device_info(struct device *dev, const char *path)
 359 {
 360         GKeyFile *key_file;
 361         gsize length = 0;
 362         char addr[18];
 363         char *str;
 364
 365         ba2str(&dev->bdaddr, addr);
 366
 367         key_file = g_key_file_new();
 368         g_key_file_load_from_file(key_file, path, 0, NULL);
 369
 370         g_key_file_remove_group(key_file, addr, NULL);
 371
 372         str = g_key_file_to_data(key_file, &length, NULL);
 373         g_file_set_contents(path, str, length, NULL);
 374         g_free(str);
 375
 376         g_key_file_free(key_file);
 377 }
 378
 379 static int device_match(gconstpointer a, gconstpointer b)
 380 {
 381         const struct device *dev = a;
 382         const bdaddr_t *bdaddr = b;
 383
 384         /* Android is using RPA even if IRK was received and ID addr resolved */
 385         if (!bacmp(&dev->rpa, bdaddr))
 386                 return 0;
 387
 388         return bacmp(&dev->bdaddr, bdaddr);
 389 }
 390
 391 static struct device *find_device(const bdaddr_t *bdaddr)
 392 {
 393         GSList *l;
 394
 395         l = g_slist_find_custom(bonded_devices, bdaddr, device_match);
 396         if (l)
 397                 return l->data;
 398
 399         l = g_slist_find_custom(cached_devices, bdaddr, device_match);
 400         if (l)
 401                 return l->data;
 402
 403         return NULL;
 404 }
 405
 406 static void free_device(struct device *dev)
 407 {
 408         if (dev->confirm_id)
 409                 mgmt_cancel(mgmt_if, dev->confirm_id);
 410
 411         g_free(dev->name);
 412         g_free(dev->friendly_name);
 413         g_slist_free_full(dev->uuids, g_free);
 414         g_free(dev);
 415 }
 416
 417 static void cache_device(struct device *new_dev)
 418 {
 419         struct device *dev;
 420         GSList *l;
 421
 422         l = g_slist_find(cached_devices, new_dev);
 423         if (l) {
 424                 cached_devices = g_slist_remove(cached_devices, new_dev);
 425                 goto cache;
 426         }
 427
 428         if (g_slist_length(cached_devices) < DEVICES_CACHE_MAX)
 429                 goto cache;
 430
 431         l = g_slist_last(cached_devices);
 432         dev = l->data;
 433
 434         cached_devices = g_slist_remove(cached_devices, dev);
 435         remove_device_info(dev, CACHE_FILE);
 436         free_device(dev);
 437
 438 cache:
 439         cached_devices = g_slist_prepend(cached_devices, new_dev);
 440         store_device_info(new_dev, CACHE_FILE);
 441 }
 442
 443 static struct device *create_device(const bdaddr_t *bdaddr, uint8_t bdaddr_type)
 444 {
 445         struct device *dev;
 446         char addr[18];
 447
 448         ba2str(bdaddr, addr);
 449         DBG("%s", addr);
 450
 451         dev = g_new0(struct device, 1);
 452
 453         bacpy(&dev->bdaddr, bdaddr);
 454
 455         if (bdaddr_type == BDADDR_BREDR) {
 456                 dev->bredr = true;
 457                 dev->bredr_seen = time(NULL);
 458         } else {
 459                 dev->le = true;
 460                 dev->bdaddr_type = bdaddr_type;
 461                 dev->le_seen = time(NULL);
 462         }
 463
 464         /*
 465          * Use address for name, will be change if one is present
 466          * eg. in EIR or set by set_property.
 467          */
 468         dev->name = g_strdup(addr);
 469
 470         return dev;
 471 }
 472
 473 static struct device *get_device(const bdaddr_t *bdaddr, uint8_t type)
 474 {
 475         struct device *dev;
 476
 477         dev = find_device(bdaddr);
 478         if (dev)
 479                 return dev;
 480
 481         dev = create_device(bdaddr, type);
 482
 483         cache_device(dev);
 484
 485         return dev;
 486 }
 487
 488 static struct device *find_device_android(const uint8_t *addr)
 489 {
 490         bdaddr_t bdaddr;
 491
 492         android2bdaddr(addr, &bdaddr);
 493
 494         return find_device(&bdaddr);
 495 }
 496
 497 static struct device *get_device_android(const uint8_t *addr)
 498 {
 499         bdaddr_t bdaddr;
 500
 501         android2bdaddr(addr, &bdaddr);
 502
 503         return get_device(&bdaddr, BDADDR_BREDR);
 504 }
 505
 506 static  void send_adapter_property(uint8_t type, uint16_t len, const void *val)
 507 {
 508         uint8_t buf[BASELEN_PROP_CHANGED + len];
 509         struct hal_ev_adapter_props_changed *ev = (void *) buf;
 510
 511         ev->status = HAL_STATUS_SUCCESS;
 512         ev->num_props = 1;
 513         ev->props[0].type = type;
 514         ev->props[0].len = len;
 515         memcpy(ev->props[0].val, val, len);
 516
 517         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
 518                                 HAL_EV_ADAPTER_PROPS_CHANGED, sizeof(buf), buf);
 519 }
 520
 521 static void adapter_name_changed(const uint8_t *name)
 522 {
 523         /* Android expects string value without NULL terminator */
 524         send_adapter_property(HAL_PROP_ADAPTER_NAME,
 525                                         strlen((const char *) name), name);
 526 }
 527
 528 static void adapter_set_name(const uint8_t *name)
 529 {
 530         if (!g_strcmp0(adapter.name, (const char *) name))
 531                 return;
 532
 533         DBG("%s", name);
 534
 535         g_free(adapter.name);
 536         adapter.name = g_strdup((const char *) name);
 537
 538         store_adapter_config();
 539
 540         adapter_name_changed(name);
 541 }
 542
 543 static void mgmt_local_name_changed_event(uint16_t index, uint16_t length,
 544                                         const void *param, void *user_data)
 545 {
 546         const struct mgmt_cp_set_local_name *rp = param;
 547
 548         if (length < sizeof(*rp)) {
 549                 error("Wrong size of local name changed parameters");
 550                 return;
 551         }
 552
 553         adapter_set_name(rp->name);
 554
 555         /* TODO Update services if needed */
 556 }
 557
 558 static void powered_changed(void)
 559 {
 560         struct hal_ev_adapter_state_changed ev;
 561
 562         ev.state = (adapter.current_settings & MGMT_SETTING_POWERED) ?
 563                                                 HAL_POWER_ON : HAL_POWER_OFF;
 564
 565         DBG("%u", ev.state);
 566
 567         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
 568                                 HAL_EV_ADAPTER_STATE_CHANGED, sizeof(ev), &ev);
 569 }
 570
 571 static uint8_t settings2scan_mode(void)
 572 {
 573         bool connectable, discoverable;
 574
 575         connectable = adapter.current_settings & MGMT_SETTING_CONNECTABLE;
 576         discoverable = adapter.current_settings & MGMT_SETTING_DISCOVERABLE;
 577
 578         if (connectable && discoverable)
 579                 return HAL_ADAPTER_SCAN_MODE_CONN_DISC;
 580
 581         if (connectable)
 582                 return HAL_ADAPTER_SCAN_MODE_CONN;
 583
 584         return HAL_ADAPTER_SCAN_MODE_NONE;
 585 }
 586
 587 static void scan_mode_changed(void)
 588 {
 589         uint8_t mode;
 590
 591         mode = settings2scan_mode();
 592
 593         DBG("mode %u", mode);
 594
 595         send_adapter_property(HAL_PROP_ADAPTER_SCAN_MODE, sizeof(mode), &mode);
 596 }
 597
 598 static void adapter_class_changed(void)
 599 {
 600         send_adapter_property(HAL_PROP_ADAPTER_CLASS, sizeof(adapter.dev_class),
 601                                                         &adapter.dev_class);
 602 }
 603
 604 static void settings_changed(uint32_t settings)
 605 {
 606         uint32_t changed_mask;
 607         uint32_t scan_mode_mask;
 608
 609         changed_mask = adapter.current_settings ^ settings;
 610
 611         adapter.current_settings = settings;
 612
 613         DBG("0x%08x", changed_mask);
 614
 615         if (changed_mask & MGMT_SETTING_POWERED)
 616                 powered_changed();
 617
 618         scan_mode_mask = MGMT_SETTING_CONNECTABLE |
 619                                         MGMT_SETTING_DISCOVERABLE;
 620
 621         /*
 622          * Only when powered, the connectable and discoverable
 623          * state changes should be communicated.
 624          */
 625         if (adapter.current_settings & MGMT_SETTING_POWERED)
 626                 if (changed_mask & scan_mode_mask)
 627                         scan_mode_changed();
 628 }
 629
 630 static void new_settings_callback(uint16_t index, uint16_t length,
 631                                         const void *param, void *user_data)
 632 {
 633         uint32_t settings;
 634
 635         if (length < sizeof(settings)) {
 636                 error("Wrong size of new settings parameters");
 637                 return;
 638         }
 639
 640         settings = get_le32(param);
 641
 642         DBG("settings: 0x%8.8x -> 0x%8.8x", adapter.current_settings,
 643                                                                 settings);
 644
 645         if (settings == adapter.current_settings)
 646                 return;
 647
 648         settings_changed(settings);
 649 }
 650
 651 static void mgmt_dev_class_changed_event(uint16_t index, uint16_t length,
 652                                         const void *param, void *user_data)
 653 {
 654         const struct mgmt_cod *rp = param;
 655         uint32_t dev_class;
 656
 657         if (length < sizeof(*rp)) {
 658                 error("Wrong size of class of device changed parameters");
 659                 return;
 660         }
 661
 662         dev_class = rp->val[0] | (rp->val[1] << 8) | (rp->val[2] << 16);
 663
 664         if (dev_class == adapter.dev_class)
 665                 return;
 666
 667         DBG("Class: 0x%06x", dev_class);
 668
 669         adapter.dev_class = dev_class;
 670
 671         adapter_class_changed();
 672
 673         /* TODO: Gatt attrib set*/
 674 }
 675
 676 void bt_store_gatt_ccc(const bdaddr_t *dst, uint16_t value)
 677 {
 678         struct device *dev;
 679         GKeyFile *key_file;
 680         gsize length = 0;
 681         char addr[18];
 682         char *data;
 683
 684         dev = find_device(dst);
 685         if (!dev)
 686                 return;
 687
 688         key_file = g_key_file_new();
 689
 690         if (!g_key_file_load_from_file(key_file, DEVICES_FILE, 0, NULL)) {
 691                 g_key_file_free(key_file);
 692                 return;
 693         }
 694
 695         ba2str(&dev->bdaddr, addr);
 696
 697         DBG("%s Gatt CCC %d", addr, value);
 698
 699         g_key_file_set_integer(key_file, addr, "GattCCC", value);
 700
 701         data = g_key_file_to_data(key_file, &length, NULL);
 702         g_file_set_contents(DEVICES_FILE, data, length, NULL);
 703         g_free(data);
 704
 705         g_key_file_free(key_file);
 706
 707         dev->gatt_ccc = value;
 708 }
 709
 710 uint16_t bt_get_gatt_ccc(const bdaddr_t *addr)
 711 {
 712         struct device *dev;
 713
 714         dev = find_device(addr);
 715         if (!dev)
 716                 return 0;
 717
 718         return dev->gatt_ccc;
 719 }
 720
 721 static void store_link_key(const bdaddr_t *dst, const uint8_t *key,
 722                                         uint8_t type, uint8_t pin_length)
 723 {
 724         GKeyFile *key_file;
 725         char key_str[33];
 726         gsize length = 0;
 727         char addr[18];
 728         char *data;
 729         int i;
 730
 731         key_file = g_key_file_new();
 732
 733         if (!g_key_file_load_from_file(key_file, DEVICES_FILE, 0, NULL)) {
 734                 g_key_file_free(key_file);
 735                 return;
 736         }
 737
 738         ba2str(dst, addr);
 739
 740         DBG("%s type %u pin_len %u", addr, type, pin_length);
 741
 742         for (i = 0; i < 16; i++)
 743                 sprintf(key_str + (i * 2), "%2.2X", key[i]);
 744
 745         g_key_file_set_string(key_file, addr, "LinkKey", key_str);
 746         g_key_file_set_integer(key_file, addr, "LinkKeyType", type);
 747         g_key_file_set_integer(key_file, addr, "LinkKeyPinLength", pin_length);
 748
 749         data = g_key_file_to_data(key_file, &length, NULL);
 750         g_file_set_contents(DEVICES_FILE, data, length, NULL);
 751         g_free(data);
 752
 753         g_key_file_free(key_file);
 754 }
 755
 756 static void send_bond_state_change(struct device *dev, uint8_t status,
 757                                                                 uint8_t state)
 758 {
 759         struct hal_ev_bond_state_changed ev;
 760
 761         ev.status = status;
 762         ev.state = state;
 763         get_device_android_addr(dev, ev.bdaddr);
 764
 765         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
 766                                 HAL_EV_BOND_STATE_CHANGED, sizeof(ev), &ev);
 767 }
 768
 769 static void update_bredr_state(struct device *dev, bool pairing, bool paired,
 770                                                                 bool bonded)
 771 {
 772         if (pairing == dev->pairing && paired == dev->bredr_paired &&
 773                                                 bonded == dev->bredr_bonded)
 774                 return;
 775
 776         /* avoid unpairing device on incoming pairing request */
 777         if (pairing && dev->bredr_paired)
 778                 goto done;
 779
 780         /* avoid unpairing device if pairing failed */
 781         if (!pairing && !paired && dev->pairing && dev->bredr_paired)
 782                 goto done;
 783
 784         if (paired && !dev->le_paired && !dev->bredr_paired) {
 785                 cached_devices = g_slist_remove(cached_devices, dev);
 786                 bonded_devices = g_slist_prepend(bonded_devices, dev);
 787                 remove_device_info(dev, CACHE_FILE);
 788                 store_device_info(dev, DEVICES_FILE);
 789         } else if (!paired && !dev->le_paired) {
 790                 bonded_devices = g_slist_remove(bonded_devices, dev);
 791                 remove_device_info(dev, DEVICES_FILE);
 792                 cache_device(dev);
 793         }
 794
 795         dev->bredr_paired = paired;
 796
 797         if (dev->bredr_paired)
 798                 dev->bredr_bonded = dev->bredr_bonded || bonded;
 799         else
 800                 dev->bredr_bonded = false;
 801
 802 done:
 803         dev->pairing = pairing;
 804 }
 805
 806 static void update_le_state(struct device *dev, bool pairing, bool paired,
 807                                                                 bool bonded)
 808 {
 809         if (pairing == dev->pairing && paired == dev->le_paired &&
 810                                                 bonded == dev->le_bonded)
 811                 return;
 812
 813         /* avoid unpairing device on incoming pairing request */
 814         if (pairing && dev->le_paired)
 815                 goto done;
 816
 817         /* avoid unpairing device if pairing failed */
 818         if (!pairing && !paired && dev->pairing && dev->le_paired)
 819                 goto done;
 820
 821         if (paired && !dev->bredr_paired && !dev->le_paired) {
 822                 cached_devices = g_slist_remove(cached_devices, dev);
 823                 bonded_devices = g_slist_prepend(bonded_devices, dev);
 824                 remove_device_info(dev, CACHE_FILE);
 825                 store_device_info(dev, DEVICES_FILE);
 826         } else if (!paired && !dev->bredr_paired) {
 827                 bonded_devices = g_slist_remove(bonded_devices, dev);
 828                 remove_device_info(dev, DEVICES_FILE);
 829                 dev->valid_local_csrk = false;
 830                 dev->valid_remote_csrk = false;
 831                 dev->local_sign_cnt = 0;
 832                 dev->remote_sign_cnt = 0;
 833                 memset(dev->local_csrk, 0, sizeof(dev->local_csrk));
 834                 memset(dev->remote_csrk, 0, sizeof(dev->remote_csrk));
 835                 cache_device(dev);
 836         }
 837
 838         dev->le_paired = paired;
 839
 840         if (dev->le_paired)
 841                 dev->le_bonded = dev->le_bonded || bonded;
 842         else
 843                 dev->le_bonded = false;
 844
 845 done:
 846         dev->pairing = pairing;
 847 }
 848
 849 static uint8_t device_bond_state(struct device *dev)
 850 {
 851         if (dev->pairing)
 852                 return HAL_BOND_STATE_BONDING;
 853
 854         /*
 855          * We are checking for paired here instead of bonded as HAL API is
 856          * using BOND state also if there was no bonding pairing.
 857          */
 858         if (dev->bredr_paired || dev->le_paired)
 859                 return HAL_BOND_STATE_BONDED;
 860
 861         return HAL_BOND_STATE_NONE;
 862 }
 863
 864 static void update_bond_state(struct device *dev, uint8_t status,
 865                                         uint8_t old_bond, uint8_t new_bond)
 866 {
 867         if (old_bond == new_bond)
 868                 return;
 869
 870         /*
 871          * When internal bond state changes from bond to non-bond or other way,
 872          * BfA needs to send bonding state to Android in the middle. Otherwise
 873          * Android will not handle it correctly
 874          */
 875         if ((old_bond == HAL_BOND_STATE_NONE &&
 876                                 new_bond == HAL_BOND_STATE_BONDED) ||
 877                                 (old_bond == HAL_BOND_STATE_BONDED &&
 878                                 new_bond == HAL_BOND_STATE_NONE))
 879                 send_bond_state_change(dev, HAL_STATUS_SUCCESS,
 880                                                 HAL_BOND_STATE_BONDING);
 881
 882         send_bond_state_change(dev, status, new_bond);
 883 }
 884
 885 static void send_paired_notification(void *data, void *user_data)
 886 {
 887         bt_paired_device_cb cb = data;
 888         struct device *dev = user_data;
 889
 890         cb(&dev->bdaddr);
 891 }
 892
 893 static void update_device_state(struct device *dev, uint8_t addr_type,
 894                                 uint8_t status, bool pairing, bool paired,
 895                                 bool bonded)
 896 {
 897         uint8_t old_bond, new_bond;
 898
 899         old_bond = device_bond_state(dev);
 900
 901         if (addr_type == BDADDR_BREDR)
 902                 update_bredr_state(dev, pairing, paired, bonded);
 903         else
 904                 update_le_state(dev, pairing, paired, bonded);
 905
 906         new_bond = device_bond_state(dev);
 907
 908         update_bond_state(dev, status, old_bond, new_bond);
 909 }
 910
 911 static void send_device_property(struct device *dev, uint8_t type,
 912                                                 uint16_t len, const void *val)
 913 {
 914         uint8_t buf[BASELEN_REMOTE_DEV_PROP + len];
 915         struct hal_ev_remote_device_props *ev = (void *) buf;
 916
 917         ev->status = HAL_STATUS_SUCCESS;
 918         get_device_android_addr(dev, ev->bdaddr);
 919         ev->num_props = 1;
 920         ev->props[0].type = type;
 921         ev->props[0].len = len;
 922         memcpy(ev->props[0].val, val, len);
 923
 924         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
 925                                 HAL_EV_REMOTE_DEVICE_PROPS, sizeof(buf), buf);
 926 }
 927
 928 static void send_device_uuids_notif(struct device *dev)
 929 {
 930         uint8_t buf[sizeof(uint128_t) * g_slist_length(dev->uuids)];
 931         uint8_t *ptr = buf;
 932         GSList *l;
 933
 934         for (l = dev->uuids; l; l = g_slist_next(l)) {
 935                 memcpy(ptr, l->data, sizeof(uint128_t));
 936                 ptr += sizeof(uint128_t);
 937         }
 938
 939         send_device_property(dev, HAL_PROP_DEVICE_UUIDS, sizeof(buf), buf);
 940 }
 941
 942 static void set_device_uuids(struct device *dev, GSList *uuids)
 943 {
 944         g_slist_free_full(dev->uuids, g_free);
 945         dev->uuids = uuids;
 946
 947         if (dev->le_paired || dev->bredr_paired)
 948                 store_device_info(dev, DEVICES_FILE);
 949         else
 950                 store_device_info(dev, CACHE_FILE);
 951
 952         send_device_uuids_notif(dev);
 953 }
 954
 955 static void browse_req_free(struct browse_req *req)
 956 {
 957         g_slist_free_full(req->uuids, g_free);
 958         g_free(req);
 959 }
 960
 961 static int uuid_128_cmp(gconstpointer a, gconstpointer b)
 962 {
 963         return memcmp(a, b, sizeof(uint128_t));
 964 }
 965
 966 static void update_records(struct browse_req *req, sdp_list_t *recs)
 967 {
 968         for (; recs; recs = recs->next) {
 969                 sdp_record_t *rec = (sdp_record_t *) recs->data;
 970                 sdp_list_t *svcclass = NULL;
 971                 uuid_t uuid128;
 972                 uuid_t *tmp;
 973                 uint8_t *new_uuid;
 974
 975                 if (!rec)
 976                         break;
 977
 978                 if (sdp_get_service_classes(rec, &svcclass) < 0)
 979                         continue;
 980
 981                 if (!svcclass)
 982                         continue;
 983
 984                 tmp = svcclass->data;
 985
 986                 switch (tmp->type) {
 987                 case SDP_UUID16:
 988                         sdp_uuid16_to_uuid128(&uuid128, tmp);
 989                         break;
 990                 case SDP_UUID32:
 991                         sdp_uuid32_to_uuid128(&uuid128, tmp);
 992                         break;
 993                 case SDP_UUID128:
 994                         memcpy(&uuid128, tmp, sizeof(uuid_t));
 995                         break;
 996                 default:
 997                         sdp_list_free(svcclass, free);
 998                         continue;
 999                 }
1000
1001                 new_uuid = g_malloc(16);/* size of 128 bit uuid */
1002                 memcpy(new_uuid, &uuid128.value.uuid128,
1003                                 sizeof(uuid128.value.uuid128));
1004
1005                 /* Check if uuid is already added */
1006                 if (g_slist_find_custom(req->uuids, new_uuid, uuid_128_cmp))
1007                         g_free(new_uuid);
1008                 else
1009                         req->uuids = g_slist_append(req->uuids, new_uuid);
1010
1011                 sdp_list_free(svcclass, free);
1012         }
1013 }
1014
1015 static void browse_cb(sdp_list_t *recs, int err, gpointer user_data)
1016 {
1017         struct browse_req *req = user_data;
1018         struct device *dev;
1019         uuid_t uuid;
1020
1021         /*
1022          * If we have a valid response and req->search_uuid == 2, then L2CAP
1023          * UUID & PNP searching was successful -- we are done
1024          */
1025         if (err < 0 || req->search_uuid == 2) {
1026                 if (err == -ECONNRESET && req->reconnect_attempt < 1) {
1027                         req->search_uuid--;
1028                         req->reconnect_attempt++;
1029                 } else {
1030                         goto done;
1031                 }
1032         }
1033
1034         update_records(req, recs);
1035
1036         /* Search for mandatory uuids */
1037         if (uuid_list[req->search_uuid]) {
1038                 sdp_uuid16_create(&uuid, uuid_list[req->search_uuid++]);
1039                 bt_search_service(&adapter.bdaddr, &req->bdaddr, &uuid,
1040                                                 browse_cb, user_data, NULL, 0);
1041                 return;
1042         }
1043
1044 done:
1045         dev = find_device(&req->bdaddr);
1046         if (dev) {
1047                 set_device_uuids(dev, req->uuids);
1048                 req->uuids = NULL;
1049         }
1050
1051         browse_reqs = g_slist_remove(browse_reqs, req);
1052         browse_req_free(req);
1053 }
1054
1055 static int req_cmp(gconstpointer a, gconstpointer b)
1056 {
1057         const struct browse_req *req = a;
1058         const bdaddr_t *bdaddr = b;
1059
1060         return bacmp(&req->bdaddr, bdaddr);
1061 }
1062
1063 static uint8_t browse_remote_sdp(const bdaddr_t *addr)
1064 {
1065         struct browse_req *req;
1066         uuid_t uuid;
1067
1068         if (g_slist_find_custom(browse_reqs, addr, req_cmp))
1069                 return HAL_STATUS_SUCCESS;
1070
1071         req = g_new0(struct browse_req, 1);
1072         bacpy(&req->bdaddr, addr);
1073         sdp_uuid16_create(&uuid, uuid_list[req->search_uuid++]);
1074
1075         if (bt_search_service(&adapter.bdaddr,
1076                         &req->bdaddr, &uuid, browse_cb, req, NULL , 0) < 0) {
1077                 browse_req_free(req);
1078                 return HAL_STATUS_FAILED;
1079         }
1080
1081         browse_reqs = g_slist_append(browse_reqs, req);
1082
1083         return HAL_STATUS_SUCCESS;
1084 }
1085
1086 static void send_remote_sdp_rec_notify(bt_uuid_t *uuid, int channel,
1087                                         char *name, uint8_t name_len,
1088                                         uint8_t status, bdaddr_t *bdaddr)
1089 {
1090         struct hal_prop_device_service_rec *prop;
1091         uint8_t buf[BASELEN_REMOTE_DEV_PROP + name_len + sizeof(*prop)];
1092         struct hal_ev_remote_device_props *ev = (void *) buf;
1093         size_t prop_len = sizeof(*prop) + name_len;
1094
1095         memset(buf, 0, sizeof(buf));
1096
1097         if (uuid && status == HAL_STATUS_SUCCESS) {
1098                 prop = (void *) &ev->props[0].val;
1099                 prop->name_len = name_len;
1100                 prop->channel = (uint16_t)channel;
1101                 memcpy(prop->name, name, name_len);
1102                 memcpy(prop->uuid, &uuid->value.u128, sizeof(prop->uuid));
1103         }
1104
1105         ev->num_props = 1;
1106         ev->status = status;
1107         ev->props[0].len = prop_len;
1108         bdaddr2android(bdaddr, ev->bdaddr);
1109         ev->props[0].type = HAL_PROP_DEVICE_SERVICE_REC;
1110
1111         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
1112                                                 HAL_EV_REMOTE_DEVICE_PROPS,
1113                                                 sizeof(buf), buf);
1114 }
1115
1116 static void find_remote_sdp_rec_cb(sdp_list_t *recs, int err,
1117                                                         gpointer user_data)
1118 {
1119         bdaddr_t *addr = user_data;
1120         uint8_t name_len;
1121         uint8_t status;
1122         char name_buf[256];
1123         int channel;
1124         bt_uuid_t uuid;
1125         uuid_t uuid128_sdp;
1126         sdp_list_t *protos;
1127         sdp_record_t *sdp_rec;
1128
1129         if (err < 0) {
1130                 error("error while search remote sdp records");
1131                 status = HAL_STATUS_FAILED;
1132                 send_remote_sdp_rec_notify(NULL, 0, NULL, 0, status, addr);
1133                 goto done;
1134         }
1135
1136         if (!recs) {
1137                 info("No service records found on remote");
1138                 status = HAL_STATUS_SUCCESS;
1139                 send_remote_sdp_rec_notify(NULL, 0, NULL, 0, status, addr);
1140                 goto done;
1141         }
1142
1143         for ( ; recs; recs = recs->next) {
1144                 sdp_rec = recs->data;
1145
1146                 switch (sdp_rec->svclass.type) {
1147                 case SDP_UUID16:
1148                         sdp_uuid16_to_uuid128(&uuid128_sdp,
1149                                                         &sdp_rec->svclass);
1150                         break;
1151                 case SDP_UUID32:
1152                         sdp_uuid32_to_uuid128(&uuid128_sdp,
1153                                                         &sdp_rec->svclass);
1154                         break;
1155                 case SDP_UUID128:
1156                         break;
1157                 default:
1158                         error("wrong sdp uuid type");
1159                         goto done;
1160                 }
1161
1162                 if (!sdp_get_access_protos(sdp_rec, &protos)) {
1163                         channel = sdp_get_proto_port(protos, RFCOMM_UUID);
1164
1165                         sdp_list_foreach(protos,
1166                                                 (sdp_list_func_t) sdp_list_free,
1167                                                 NULL);
1168                         sdp_list_free(protos, NULL);
1169                 } else
1170                         channel = -1;
1171
1172                 if (channel < 0) {
1173                         error("can't get channel for sdp record");
1174                         channel = 0;
1175                 }
1176
1177                 if (!sdp_get_service_name(sdp_rec, name_buf, sizeof(name_buf)))
1178                         name_len = strlen(name_buf);
1179                 else
1180                         name_len = 0;
1181
1182                 uuid.type = BT_UUID128;
1183                 memcpy(&uuid.value.u128, uuid128_sdp.value.uuid128.data,
1184                                                 sizeof(uuid.value.u128));
1185                 status = HAL_STATUS_SUCCESS;
1186
1187                 send_remote_sdp_rec_notify(&uuid, channel, name_buf, name_len,
1188                                                                 status, addr);
1189         }
1190
1191 done:
1192         g_free(addr);
1193 }
1194
1195 static uint8_t find_remote_sdp_rec(const bdaddr_t *addr,
1196                                                 const uint8_t *find_uuid)
1197 {
1198         bdaddr_t *bdaddr;
1199         uuid_t uuid;
1200
1201         /* from android we always get full 128bit length uuid */
1202         sdp_uuid128_create(&uuid, find_uuid);
1203
1204         bdaddr = g_new(bdaddr_t, 1);
1205         if (!bdaddr)
1206                 return HAL_STATUS_NOMEM;
1207
1208         memcpy(bdaddr, addr, sizeof(*bdaddr));
1209
1210         if (bt_search_service(&adapter.bdaddr, addr, &uuid,
1211                                 find_remote_sdp_rec_cb, bdaddr, NULL, 0) < 0) {
1212                 g_free(bdaddr);
1213                 return HAL_STATUS_FAILED;
1214         }
1215
1216         return HAL_STATUS_SUCCESS;
1217 }
1218
1219 static void new_link_key_callback(uint16_t index, uint16_t length,
1220                                         const void *param, void *user_data)
1221 {
1222         const struct mgmt_ev_new_link_key *ev = param;
1223         const struct mgmt_addr_info *addr = &ev->key.addr;
1224         struct device *dev;
1225         char dst[18];
1226
1227         if (length < sizeof(*ev)) {
1228                 error("Too small new link key event");
1229                 return;
1230         }
1231
1232         ba2str(&addr->bdaddr, dst);
1233
1234         DBG("new key for %s type %u pin_len %u",
1235                                         dst, ev->key.type, ev->key.pin_len);
1236
1237         if (ev->key.pin_len > 16) {
1238                 error("Invalid PIN length (%u) in new_key event",
1239                                                         ev->key.pin_len);
1240                 return;
1241         }
1242
1243         dev = get_device(&ev->key.addr.bdaddr, ev->key.addr.type);
1244         if (!dev)
1245                 return;
1246
1247         update_device_state(dev, ev->key.addr.type, HAL_STATUS_SUCCESS, false,
1248                                                         true, !!ev->store_hint);
1249
1250         if (ev->store_hint) {
1251                 const struct mgmt_link_key_info *key = &ev->key;
1252
1253                 store_link_key(&addr->bdaddr, key->val, key->type,
1254                                                                 key->pin_len);
1255         }
1256
1257         browse_remote_sdp(&addr->bdaddr);
1258 }
1259
1260 static uint8_t get_device_name(struct device *dev)
1261 {
1262         send_device_property(dev, HAL_PROP_DEVICE_NAME,
1263                                                 strlen(dev->name), dev->name);
1264
1265         return HAL_STATUS_SUCCESS;
1266 }
1267
1268 static void pin_code_request_callback(uint16_t index, uint16_t length,
1269                                         const void *param, void *user_data)
1270 {
1271         const struct mgmt_ev_pin_code_request *ev = param;
1272         struct hal_ev_pin_request hal_ev;
1273         struct device *dev;
1274         char dst[18];
1275
1276         if (length < sizeof(*ev)) {
1277                 error("Too small PIN code request event");
1278                 return;
1279         }
1280
1281         ba2str(&ev->addr.bdaddr, dst);
1282
1283         dev = get_device(&ev->addr.bdaddr, BDADDR_BREDR);
1284
1285         /*
1286          * Workaround for Android Bluetooth.apk issue: send remote
1287          * device property
1288          */
1289         get_device_name(dev);
1290
1291         update_device_state(dev, ev->addr.type, HAL_STATUS_SUCCESS, true,
1292                                                                 false, false);
1293
1294         DBG("%s type %u secure %u", dst, ev->addr.type, ev->secure);
1295
1296         /* Name already sent in remote device prop */
1297         memset(&hal_ev, 0, sizeof(hal_ev));
1298         get_device_android_addr(dev, hal_ev.bdaddr);
1299         hal_ev.class_of_dev = dev->class;
1300
1301         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_EV_PIN_REQUEST,
1302                                                 sizeof(hal_ev), &hal_ev);
1303 }
1304
1305 static void send_ssp_request(struct device *dev, uint8_t variant,
1306                                                         uint32_t passkey)
1307 {
1308         struct hal_ev_ssp_request ev;
1309
1310         memset(&ev, 0, sizeof(ev));
1311
1312         get_device_android_addr(dev, ev.bdaddr);
1313         memcpy(ev.name, dev->name, strlen(dev->name));
1314         ev.class_of_dev = dev->class;
1315
1316         ev.pairing_variant = variant;
1317         ev.passkey = passkey;
1318
1319         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_EV_SSP_REQUEST,
1320                                                         sizeof(ev), &ev);
1321 }
1322
1323 static void user_confirm_request_callback(uint16_t index, uint16_t length,
1324                                         const void *param, void *user_data)
1325 {
1326         const struct mgmt_ev_user_confirm_request *ev = param;
1327         struct device *dev;
1328         char dst[18];
1329
1330         if (length < sizeof(*ev)) {
1331                 error("Too small user confirm request event");
1332                 return;
1333         }
1334
1335         ba2str(&ev->addr.bdaddr, dst);
1336         DBG("%s confirm_hint %u", dst, ev->confirm_hint);
1337
1338         dev = get_device(&ev->addr.bdaddr, ev->addr.type);
1339         if (!dev)
1340                 return;
1341
1342         update_device_state(dev, ev->addr.type, HAL_STATUS_SUCCESS, true,
1343                                                                 false, false);
1344
1345         if (ev->confirm_hint)
1346                 send_ssp_request(dev, HAL_SSP_VARIANT_CONSENT, 0);
1347         else
1348                 send_ssp_request(dev, HAL_SSP_VARIANT_CONFIRM, ev->value);
1349 }
1350
1351 static void user_passkey_request_callback(uint16_t index, uint16_t length,
1352                                         const void *param, void *user_data)
1353 {
1354         const struct mgmt_ev_user_passkey_request *ev = param;
1355         struct device *dev;
1356         char dst[18];
1357
1358         if (length < sizeof(*ev)) {
1359                 error("Too small passkey request event");
1360                 return;
1361         }
1362
1363         ba2str(&ev->addr.bdaddr, dst);
1364         DBG("%s", dst);
1365
1366         dev = get_device(&ev->addr.bdaddr, ev->addr.type);
1367         if (!dev)
1368                 return;
1369
1370         update_device_state(dev, ev->addr.type, HAL_STATUS_SUCCESS, true,
1371                                                                 false, false);
1372
1373         send_ssp_request(dev, HAL_SSP_VARIANT_ENTRY, 0);
1374 }
1375
1376 static void user_passkey_notify_callback(uint16_t index, uint16_t length,
1377                                                         const void *param,
1378                                                         void *user_data)
1379 {
1380         const struct mgmt_ev_passkey_notify *ev = param;
1381         struct device *dev;
1382         char dst[18];
1383
1384         if (length < sizeof(*ev)) {
1385                 error("Too small passkey notify event");
1386                 return;
1387         }
1388
1389         ba2str(&ev->addr.bdaddr, dst);
1390         DBG("%s entered %u", dst, ev->entered);
1391
1392         /* HAL seems to not support entered characters */
1393         if (ev->entered)
1394                 return;
1395
1396         dev = find_device(&ev->addr.bdaddr);
1397         if (!dev)
1398                 return;
1399
1400         update_device_state(dev, ev->addr.type, HAL_STATUS_SUCCESS, true,
1401                                                                 false, false);
1402
1403         send_ssp_request(dev, HAL_SSP_VARIANT_NOTIF, ev->passkey);
1404 }
1405
1406 static void clear_device_found(gpointer data, gpointer user_data)
1407 {
1408         struct device *dev = data;
1409
1410         dev->found = false;
1411 }
1412
1413 static uint8_t get_supported_discovery_type(void)
1414 {
1415         uint8_t type = SCAN_TYPE_NONE;
1416
1417         if (adapter.current_settings & MGMT_SETTING_BREDR)
1418                 type |= SCAN_TYPE_BREDR;
1419
1420         if (adapter.current_settings & MGMT_SETTING_LE)
1421                 type |= SCAN_TYPE_LE;
1422
1423         return type;
1424 }
1425
1426 static bool start_discovery(uint8_t type)
1427 {
1428         struct mgmt_cp_start_discovery cp;
1429
1430         cp.type = get_supported_discovery_type() & type;
1431
1432         DBG("type=0x%x", cp.type);
1433
1434         if (cp.type == SCAN_TYPE_NONE)
1435                 return false;
1436
1437         if (mgmt_send(mgmt_if, MGMT_OP_START_DISCOVERY, adapter.index,
1438                                 sizeof(cp), &cp, NULL, NULL, NULL) > 0)
1439                 return true;
1440
1441         error("Failed to start discovery");
1442
1443         return false;
1444 }
1445
1446 /*
1447  * Send discovery state change event only if it is related to dual type
1448  * discovery session (triggered by start/cancel discovery commands)
1449  */
1450 static void check_discovery_state(uint8_t new_type, uint8_t old_type)
1451 {
1452         struct hal_ev_discovery_state_changed ev;
1453
1454         DBG("%u %u", new_type, old_type);
1455
1456         if (new_type == get_supported_discovery_type()) {
1457                 g_slist_foreach(bonded_devices, clear_device_found, NULL);
1458                 g_slist_foreach(cached_devices, clear_device_found, NULL);
1459                 ev.state = HAL_DISCOVERY_STATE_STARTED;
1460                 goto done;
1461         }
1462
1463         if (old_type != get_supported_discovery_type())
1464                 return;
1465
1466         ev.state = HAL_DISCOVERY_STATE_STOPPED;
1467
1468 done:
1469         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
1470                         HAL_EV_DISCOVERY_STATE_CHANGED, sizeof(ev), &ev);
1471 }
1472
1473 static void mgmt_discovering_event(uint16_t index, uint16_t length,
1474                                         const void *param, void *user_data)
1475 {
1476         const struct mgmt_ev_discovering *ev = param;
1477         uint8_t type;
1478
1479         if (length < sizeof(*ev)) {
1480                 error("Too small discovering event");
1481                 return;
1482         }
1483
1484         DBG("type %u discovering %u", ev->type, ev->discovering);
1485
1486         if (!!adapter.cur_discovery_type == !!ev->discovering)
1487                 return;
1488
1489         type = ev->discovering ? ev->type : SCAN_TYPE_NONE;
1490
1491         check_discovery_state(type, adapter.cur_discovery_type);
1492
1493         adapter.cur_discovery_type = type;
1494
1495         if (ev->discovering) {
1496                 adapter.exp_discovery_type = adapter.le_scanning ?
1497                                                 SCAN_TYPE_LE : SCAN_TYPE_NONE;
1498                 return;
1499         }
1500
1501         /* One shot notification about discovery stopped */
1502         if (gatt_discovery_stopped_cb) {
1503                 gatt_discovery_stopped_cb();
1504                 gatt_discovery_stopped_cb = NULL;
1505         }
1506
1507         type = adapter.exp_discovery_type;
1508         adapter.exp_discovery_type = adapter.le_scanning ? SCAN_TYPE_LE :
1509                                                                 SCAN_TYPE_NONE;
1510
1511         if (type != SCAN_TYPE_NONE)
1512                 start_discovery(type);
1513 }
1514
1515 static void confirm_device_name_cb(uint8_t status, uint16_t length,
1516                                         const void *param, void *user_data)
1517 {
1518         const struct mgmt_rp_confirm_name *rp = param;
1519         struct device *dev;
1520
1521         DBG("Confirm name status: %s (0x%02x)", mgmt_errstr(status), status);
1522
1523         if (length < sizeof(*rp)) {
1524                 error("Wrong size of confirm name response");
1525                 return;
1526         }
1527
1528         dev = find_device(&rp->addr.bdaddr);
1529         if (!dev)
1530                 return;
1531
1532         dev->confirm_id = 0;
1533 }
1534
1535 static unsigned int confirm_device_name(const bdaddr_t *addr, uint8_t addr_type,
1536                                                         bool resolve_name)
1537 {
1538         struct mgmt_cp_confirm_name cp;
1539         unsigned int res;
1540
1541         memset(&cp, 0, sizeof(cp));
1542         bacpy(&cp.addr.bdaddr, addr);
1543         cp.addr.type = addr_type;
1544
1545         if (!resolve_name)
1546                 cp.name_known = 1;
1547
1548         res = mgmt_send(mgmt_if, MGMT_OP_CONFIRM_NAME, adapter.index,
1549                                 sizeof(cp), &cp, confirm_device_name_cb,
1550                                 NULL, NULL);
1551         if (!res)
1552                 error("Failed to send confirm name request");
1553
1554         return res;
1555 }
1556
1557 static int fill_hal_prop(void *buf, uint8_t type, uint16_t len,
1558                                                         const void *val)
1559 {
1560         struct hal_property *prop = buf;
1561
1562         prop->type = type;
1563         prop->len = len;
1564
1565         if (len)
1566                 memcpy(prop->val, val, len);
1567
1568         return sizeof(*prop) + len;
1569 }
1570
1571 static uint8_t get_device_android_type(struct device *dev)
1572 {
1573         if (dev->bredr && dev->le)
1574                 return HAL_TYPE_DUAL;
1575
1576         if (dev->le)
1577                 return HAL_TYPE_LE;
1578
1579         return HAL_TYPE_BREDR;
1580 }
1581
1582 uint8_t bt_get_device_android_type(const bdaddr_t *addr)
1583 {
1584         struct device *dev;
1585
1586         dev = get_device(addr, BDADDR_BREDR);
1587
1588         return get_device_android_type(dev);
1589 }
1590
1591 bool bt_is_device_le(const bdaddr_t *addr)
1592 {
1593         struct device *dev;
1594
1595         dev = find_device(addr);
1596         if (!dev)
1597                 return false;
1598
1599         return dev->le;
1600 }
1601
1602 const bdaddr_t *bt_get_id_addr(const bdaddr_t *addr, uint8_t *type)
1603 {
1604         struct device *dev;
1605
1606         dev = find_device(addr);
1607         if (!dev)
1608                 return NULL;
1609
1610         if (type)
1611                 *type = dev->bdaddr_type;
1612
1613         return &dev->bdaddr;
1614 }
1615
1616 const char *bt_get_adapter_name(void)
1617 {
1618         return adapter.name;
1619 }
1620
1621 bool bt_device_is_bonded(const bdaddr_t *bdaddr)
1622 {
1623         if (g_slist_find_custom(bonded_devices, bdaddr, device_match))
1624                 return true;
1625
1626         return false;
1627 }
1628
1629 bool bt_device_set_uuids(const bdaddr_t *addr, GSList *uuids)
1630 {
1631         struct device *dev;
1632
1633         dev = find_device(addr);
1634         if (!dev)
1635                 return false;
1636
1637         set_device_uuids(dev, uuids);
1638
1639         return true;
1640 }
1641
1642 bool bt_kernel_conn_control(void)
1643 {
1644         return kernel_conn_control;
1645 }
1646
1647 bool bt_auto_connect_add(const bdaddr_t *addr)
1648 {
1649         struct mgmt_cp_add_device cp;
1650         struct device *dev;
1651
1652         if (!kernel_conn_control)
1653                 return false;
1654
1655         dev = find_device(addr);
1656         if (!dev)
1657                 return false;
1658
1659         if (dev->bdaddr_type == BDADDR_BREDR) {
1660                 DBG("auto-connection feature is not available for BR/EDR");
1661                 return false;
1662         }
1663
1664         if (dev->in_white_list) {
1665                 DBG("Device already in white list");
1666                 return true;
1667         }
1668
1669         memset(&cp, 0, sizeof(cp));
1670         bacpy(&cp.addr.bdaddr, addr);
1671         cp.addr.type = dev->bdaddr_type;
1672         cp.action = 0x02;
1673
1674         if (mgmt_send(mgmt_if, MGMT_OP_ADD_DEVICE, adapter.index, sizeof(cp),
1675                                                 &cp, NULL, NULL, NULL) > 0) {
1676                 dev->in_white_list = true;
1677                 return true;
1678         }
1679
1680         error("Failed to add device");
1681
1682         return false;
1683 }
1684
1685 void bt_auto_connect_remove(const bdaddr_t *addr)
1686 {
1687         struct mgmt_cp_remove_device cp;
1688         struct device *dev;
1689
1690         if (!kernel_conn_control)
1691                 return;
1692
1693         dev = find_device(addr);
1694         if (!dev)
1695                 return;
1696
1697         if (dev->bdaddr_type == BDADDR_BREDR) {
1698                 DBG("auto-connection feature is not available for BR/EDR");
1699                 return;
1700         }
1701
1702         if (!dev->in_white_list) {
1703                 DBG("Device already removed from white list");
1704                 return;
1705         }
1706
1707         memset(&cp, 0, sizeof(cp));
1708         bacpy(&cp.addr.bdaddr, addr);
1709         cp.addr.type = dev->bdaddr_type;
1710
1711         if (mgmt_send(mgmt_if, MGMT_OP_REMOVE_DEVICE, adapter.index,
1712                                 sizeof(cp), &cp, NULL, NULL, NULL) > 0) {
1713                 dev->in_white_list = false;
1714                 return;
1715         }
1716
1717         error("Failed to remove device");
1718 }
1719
1720 static bool match_by_value(const void *data, const void *user_data)
1721 {
1722         return data == user_data;
1723 }
1724
1725 bool bt_unpaired_register(bt_unpaired_device_cb cb)
1726 {
1727         if (queue_find(unpaired_cb_list, match_by_value, cb))
1728                 return false;
1729
1730         return queue_push_head(unpaired_cb_list, cb);
1731 }
1732
1733 void bt_unpaired_unregister(bt_unpaired_device_cb cb)
1734 {
1735         queue_remove(unpaired_cb_list, cb);
1736 }
1737
1738 bool bt_paired_register(bt_paired_device_cb cb)
1739 {
1740         if (queue_find(paired_cb_list, match_by_value, cb))
1741                 return false;
1742
1743         return queue_push_head(paired_cb_list, cb);
1744 }
1745
1746 void bt_paired_unregister(bt_paired_device_cb cb)
1747 {
1748         queue_remove(paired_cb_list, cb);
1749 }
1750
1751 bool bt_is_pairing(const bdaddr_t *addr)
1752 {
1753         struct device *dev;
1754
1755         dev = find_device(addr);
1756         if (!dev)
1757                 return false;
1758
1759         return dev->pairing;
1760 }
1761
1762 static bool rssi_above_threshold(int old, int new)
1763 {
1764         /* only 8 dBm or more */
1765         return abs(old - new) >= 8;
1766 }
1767
1768 static void update_new_device(struct device *dev, int8_t rssi,
1769                                                 const struct eir_data *eir)
1770 {
1771         uint8_t buf[IPC_MTU];
1772         struct hal_ev_device_found *ev = (void *) buf;
1773         uint8_t android_bdaddr[6];
1774         uint8_t android_type;
1775         size_t size;
1776
1777         memset(buf, 0, sizeof(buf));
1778
1779         if (adapter.cur_discovery_type)
1780                 dev->found = true;
1781
1782         size = sizeof(*ev);
1783
1784         get_device_android_addr(dev, android_bdaddr);
1785         size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_ADDR,
1786                                 sizeof(android_bdaddr), android_bdaddr);
1787         ev->num_props++;
1788
1789         android_type = get_device_android_type(dev);
1790         size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_TYPE,
1791                                 sizeof(android_type), &android_type);
1792         ev->num_props++;
1793
1794         if (eir->class)
1795                 dev->class = eir->class;
1796
1797         if (dev->class) {
1798                 size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_CLASS,
1799                                         sizeof(dev->class), &dev->class);
1800                 ev->num_props++;
1801         }
1802
1803         if (rssi && rssi_above_threshold(dev->rssi, rssi))
1804                 dev->rssi = rssi;
1805
1806         if (dev->rssi) {
1807                 size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_RSSI,
1808                                                 sizeof(dev->rssi), &dev->rssi);
1809                 ev->num_props++;
1810         }
1811
1812         if (eir->name && strlen(eir->name)) {
1813                 g_free(dev->name);
1814                 dev->name = g_strdup(eir->name);
1815         }
1816
1817         if (dev->name) {
1818                 size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_NAME,
1819                                                 strlen(dev->name), dev->name);
1820                 ev->num_props++;
1821
1822                 /* when updating name also send stored friendly name */
1823                 if (dev->friendly_name) {
1824                         size += fill_hal_prop(buf + size,
1825                                                 HAL_PROP_DEVICE_FRIENDLY_NAME,
1826                                                 strlen(dev->friendly_name),
1827                                                 dev->friendly_name);
1828                         ev->num_props++;
1829                 }
1830         }
1831
1832         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_EV_DEVICE_FOUND,
1833                                                                 size, buf);
1834 }
1835
1836 static void update_device(struct device *dev, int8_t rssi,
1837                                                 const struct eir_data *eir)
1838 {
1839         uint8_t buf[IPC_MTU];
1840         struct hal_ev_remote_device_props *ev = (void *) buf;
1841         uint8_t old_type, new_type;
1842         size_t size;
1843
1844         memset(buf, 0, sizeof(buf));
1845
1846         size = sizeof(*ev);
1847
1848         ev->status = HAL_STATUS_SUCCESS;
1849         get_device_android_addr(dev, ev->bdaddr);
1850
1851         old_type = get_device_android_type(dev);
1852
1853         new_type = get_device_android_type(dev);
1854
1855         if (old_type != new_type) {
1856                 size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_TYPE,
1857                                                 sizeof(new_type), &new_type);
1858                 ev->num_props++;
1859         }
1860
1861         if (eir->class && dev->class != eir->class) {
1862                 dev->class = eir->class;
1863                 size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_CLASS,
1864                                         sizeof(dev->class), &dev->class);
1865                 ev->num_props++;
1866         }
1867
1868         if (rssi && rssi_above_threshold(dev->rssi, rssi)) {
1869                 dev->rssi = rssi;
1870                 size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_RSSI,
1871                                                 sizeof(dev->rssi), &dev->rssi);
1872                 ev->num_props++;
1873         }
1874
1875         if (eir->name && strlen(eir->name) && strcmp(dev->name, eir->name)) {
1876                 g_free(dev->name);
1877                 dev->name = g_strdup(eir->name);
1878                 size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_NAME,
1879                                                 strlen(dev->name), dev->name);
1880                 ev->num_props++;
1881
1882                 /* when updating name also send stored friendly name */
1883                 if (dev->friendly_name) {
1884                         size += fill_hal_prop(buf + size,
1885                                                 HAL_PROP_DEVICE_FRIENDLY_NAME,
1886                                                 strlen(dev->friendly_name),
1887                                                 dev->friendly_name);
1888                         ev->num_props++;
1889                 }
1890         }
1891
1892         if (ev->num_props)
1893                 ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
1894                                         HAL_EV_REMOTE_DEVICE_PROPS, size, buf);
1895 }
1896
1897 static bool is_new_device(const struct device *dev, unsigned int flags,
1898                                                         uint8_t bdaddr_type)
1899 {
1900         if (dev->found)
1901                 return false;
1902
1903         if (dev->bredr_paired || dev->le_paired)
1904                 return false;
1905
1906         if (bdaddr_type != BDADDR_BREDR &&
1907                                 !(flags & (EIR_LIM_DISC | EIR_GEN_DISC)))
1908                 return false;
1909
1910         return true;
1911 }
1912
1913 static void update_found_device(const bdaddr_t *bdaddr, uint8_t bdaddr_type,
1914                                         int8_t rssi, bool confirm,
1915                                         bool connectable,
1916                                         const uint8_t *data, uint8_t data_len)
1917 {
1918         struct eir_data eir;
1919         struct device *dev;
1920
1921         memset(&eir, 0, sizeof(eir));
1922
1923         eir_parse(&eir, data, data_len);
1924
1925         dev = get_device(bdaddr, bdaddr_type);
1926
1927         if (bdaddr_type == BDADDR_BREDR) {
1928                 dev->bredr = true;
1929                 dev->bredr_seen = time(NULL);
1930         } else {
1931                 dev->le = true;
1932                 dev->bdaddr_type = bdaddr_type;
1933                 dev->le_seen = time(NULL);
1934         }
1935
1936         /*
1937          * Device found event needs to be send also for known device if this is
1938          * new discovery session. Otherwise framework will ignore it.
1939          */
1940         if (is_new_device(dev, eir.flags, bdaddr_type))
1941                 update_new_device(dev, rssi, &eir);
1942         else
1943                 update_device(dev, rssi, &eir);
1944
1945         eir_data_free(&eir);
1946
1947         /* Notify Gatt if its registered for LE events */
1948         if (bdaddr_type != BDADDR_BREDR && gatt_device_found_cb) {
1949                 const bdaddr_t *addr;
1950
1951                 /*
1952                  * If RPA is set it means that IRK was received and ID address
1953                  * is being used. Android Framework is still using old RPA and
1954                  * it needs to be used also in GATT notifications. Also GATT
1955                  * HAL implementation is using RPA for devices matching.
1956                  */
1957                 if (bacmp(&dev->rpa, BDADDR_ANY))
1958                         addr = &dev->rpa;
1959                 else
1960                         addr = &dev->bdaddr;
1961
1962                 gatt_device_found_cb(addr, rssi, data_len, data, connectable,
1963                                                                 dev->le_bonded);
1964         }
1965
1966         if (!dev->bredr_paired && !dev->le_paired)
1967                 cache_device(dev);
1968
1969         if (confirm) {
1970                 char addr[18];
1971                 bool resolve_name = true;
1972
1973                 ba2str(bdaddr, addr);
1974
1975                 /*
1976                  * Don't need to confirm name if we have it already in cache
1977                  * Just check if device name is different than bdaddr
1978                  */
1979                 if (g_strcmp0(dev->name, addr)) {
1980                         get_device_name(dev);
1981                         resolve_name = false;
1982                 }
1983
1984                 info("Device %s needs name confirmation (resolve_name=%d)",
1985                                                         addr, resolve_name);
1986                 dev->confirm_id = confirm_device_name(bdaddr, bdaddr_type,
1987                                                                 resolve_name);
1988         }
1989 }
1990
1991 static void mgmt_device_found_event(uint16_t index, uint16_t length,
1992                                         const void *param, void *user_data)
1993 {
1994         const struct mgmt_ev_device_found *ev = param;
1995         const uint8_t *eir;
1996         uint16_t eir_len;
1997         uint32_t flags;
1998         bool confirm_name;
1999         bool connectable;
2000         char addr[18];
2001
2002         if (length < sizeof(*ev)) {
2003                 error("Too short device found event (%u bytes)", length);
2004                 return;
2005         }
2006
2007         eir_len = le16_to_cpu(ev->eir_len);
2008         if (length != sizeof(*ev) + eir_len) {
2009                 error("Device found event size mismatch (%u != %zu)",
2010                                         length, sizeof(*ev) + eir_len);
2011                 return;
2012         }
2013
2014         if (eir_len == 0)
2015                 eir = NULL;
2016         else
2017                 eir = ev->eir;
2018
2019         flags = le32_to_cpu(ev->flags);
2020
2021         ba2str(&ev->addr.bdaddr, addr);
2022         DBG("hci%u addr %s, rssi %d flags 0x%04x eir_len %u",
2023                                 index, addr, ev->rssi, flags, eir_len);
2024
2025         confirm_name = flags & MGMT_DEV_FOUND_CONFIRM_NAME;
2026         connectable = !(flags & MGMT_DEV_FOUND_NOT_CONNECTABLE);
2027
2028         update_found_device(&ev->addr.bdaddr, ev->addr.type, ev->rssi,
2029                                 confirm_name, connectable, eir, eir_len);
2030 }
2031
2032 static void mgmt_device_connected_event(uint16_t index, uint16_t length,
2033                                         const void *param, void *user_data)
2034 {
2035         const struct mgmt_ev_device_connected *ev = param;
2036         struct hal_ev_acl_state_changed hal_ev;
2037         struct device *dev;
2038         char addr[18];
2039
2040         if (length < sizeof(*ev)) {
2041                 error("Too short device connected event (%u bytes)", length);
2042                 return;
2043         }
2044
2045         ba2str(&ev->addr.bdaddr, addr);
2046         DBG("%s type %u", addr, ev->addr.type);
2047
2048         update_found_device(&ev->addr.bdaddr, ev->addr.type, 0, false, false,
2049                                         &ev->eir[0], le16_to_cpu(ev->eir_len));
2050
2051         hal_ev.status = HAL_STATUS_SUCCESS;
2052         hal_ev.state = HAL_ACL_STATE_CONNECTED;
2053
2054         dev = find_device(&ev->addr.bdaddr);
2055         if (!dev)
2056                 return;
2057
2058         dev->connected = true;
2059
2060         get_device_android_addr(dev, hal_ev.bdaddr);
2061
2062         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
2063                         HAL_EV_ACL_STATE_CHANGED, sizeof(hal_ev), &hal_ev);
2064 }
2065
2066 static bool device_is_paired(struct device *dev, uint8_t addr_type)
2067 {
2068         if (addr_type == BDADDR_BREDR)
2069                 return dev->bredr_paired;
2070
2071         return dev->le_paired;
2072 }
2073
2074 static bool device_is_bonded(struct device *dev)
2075 {
2076         return dev->bredr_bonded || dev->le_bonded;
2077 }
2078
2079 static void mgmt_device_disconnected_event(uint16_t index, uint16_t length,
2080                                                         const void *param,
2081                                                         void *user_data)
2082 {
2083         const struct mgmt_ev_device_disconnected *ev = param;
2084         struct hal_ev_acl_state_changed hal_ev;
2085         struct device *dev;
2086         uint8_t type = ev->addr.type;
2087
2088         if (length < sizeof(*ev)) {
2089                 error("Too short device disconnected event (%u bytes)", length);
2090                 return;
2091         }
2092
2093         dev = find_device(&ev->addr.bdaddr);
2094         if (!dev)
2095                 return;
2096
2097         hal_ev.status = HAL_STATUS_SUCCESS;
2098         hal_ev.state = HAL_ACL_STATE_DISCONNECTED;
2099         get_device_android_addr(dev, hal_ev.bdaddr);
2100
2101         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
2102                         HAL_EV_ACL_STATE_CHANGED, sizeof(hal_ev), &hal_ev);
2103
2104         if (device_is_paired(dev, type) && !device_is_bonded(dev))
2105                 update_device_state(dev, type, HAL_STATUS_SUCCESS, false,
2106                                                                 false, false);
2107
2108         dev->connected = false;
2109 }
2110
2111 static uint8_t status_mgmt2hal(uint8_t mgmt)
2112 {
2113         switch (mgmt) {
2114         case MGMT_STATUS_SUCCESS:
2115                 return HAL_STATUS_SUCCESS;
2116         case MGMT_STATUS_NO_RESOURCES:
2117                 return HAL_STATUS_NOMEM;
2118         case MGMT_STATUS_BUSY:
2119                 return HAL_STATUS_BUSY;
2120         case MGMT_STATUS_NOT_SUPPORTED:
2121                 return HAL_STATUS_UNSUPPORTED;
2122         case MGMT_STATUS_INVALID_PARAMS:
2123                 return HAL_STATUS_INVALID;
2124         case MGMT_STATUS_AUTH_FAILED:
2125                 return HAL_STATUS_AUTH_FAILURE;
2126         case MGMT_STATUS_NOT_CONNECTED:
2127                 return HAL_STATUS_REMOTE_DEVICE_DOWN;
2128         default:
2129                 return HAL_STATUS_FAILED;
2130         }
2131 }
2132
2133 static void mgmt_connect_failed_event(uint16_t index, uint16_t length,
2134                                         const void *param, void *user_data)
2135 {
2136         const struct mgmt_ev_connect_failed *ev = param;
2137         struct device *dev;
2138
2139         if (length < sizeof(*ev)) {
2140                 error("Too short connect failed event (%u bytes)", length);
2141                 return;
2142         }
2143
2144         DBG("");
2145
2146         dev = find_device(&ev->addr.bdaddr);
2147         if (!dev)
2148                 return;
2149
2150         /*
2151          * In case security mode 3 pairing we will get connect failed event
2152          * in case e.g wrong PIN code entered. Let's check if device is
2153          * bonding, if so update bond state
2154          */
2155
2156         if (!dev->pairing)
2157                 return;
2158
2159         update_device_state(dev, ev->addr.type, status_mgmt2hal(ev->status),
2160                                                         false, false, false);
2161 }
2162
2163 static void mgmt_auth_failed_event(uint16_t index, uint16_t length,
2164                                         const void *param, void *user_data)
2165 {
2166         const struct mgmt_ev_auth_failed *ev = param;
2167         struct device *dev;
2168
2169         if (length < sizeof(*ev)) {
2170                 error("Too small auth failed mgmt event (%u bytes)", length);
2171                 return;
2172         }
2173
2174         DBG("");
2175
2176         dev = find_device(&ev->addr.bdaddr);
2177         if (!dev)
2178                 return;
2179
2180         if (!dev->pairing)
2181                 return;
2182
2183         update_device_state(dev, ev->addr.type, status_mgmt2hal(ev->status),
2184                                                         false, false, false);
2185 }
2186
2187 static void mgmt_device_unpaired_event(uint16_t index, uint16_t length,
2188                                         const void *param, void *user_data)
2189 {
2190         const struct mgmt_ev_device_unpaired *ev = param;
2191         struct device *dev;
2192
2193         if (length < sizeof(*ev)) {
2194                 error("Too small device unpaired event (%u bytes)", length);
2195                 return;
2196         }
2197
2198         DBG("");
2199
2200         /* TODO should device be disconnected ? */
2201
2202         dev = find_device(&ev->addr.bdaddr);
2203         if (!dev)
2204                 return;
2205
2206         update_device_state(dev, ev->addr.type, HAL_STATUS_SUCCESS, false,
2207                                                                 false, false);
2208
2209         /* Unpaired device is removed from the white list */
2210         dev->in_white_list = false;
2211 }
2212
2213 static void store_ltk(const bdaddr_t *dst, uint8_t bdaddr_type, bool master,
2214                         const uint8_t *key, uint8_t key_type, uint8_t enc_size,
2215                         uint16_t ediv, uint64_t rand)
2216 {
2217         const char *key_s, *keytype_s, *encsize_s, *ediv_s, *rand_s;
2218         GKeyFile *key_file;
2219         char key_str[33];
2220         gsize length = 0;
2221         char addr[18];
2222         char *data;
2223         int i;
2224
2225         key_file = g_key_file_new();
2226         if (!g_key_file_load_from_file(key_file, DEVICES_FILE, 0, NULL)) {
2227                 g_key_file_free(key_file);
2228                 return;
2229         }
2230
2231         ba2str(dst, addr);
2232
2233         key_s = master ? "LongTermKey" : "SlaveLongTermKey";
2234         keytype_s = master ? "LongTermKeyType" : "SlaveLongTermKeyType";
2235         encsize_s = master ? "LongTermKeyEncSize" : "SlaveLongTermKeyEncSize";
2236         ediv_s = master ? "LongTermKeyEDiv" : "SlaveLongTermKeyEDiv";
2237         rand_s = master ? "LongTermKeyRand" : "SlaveLongTermKeyRand";
2238
2239         for (i = 0; i < 16; i++)
2240                 sprintf(key_str + (i * 2), "%2.2X", key[i]);
2241
2242         g_key_file_set_string(key_file, addr, key_s, key_str);
2243
2244         g_key_file_set_integer(key_file, addr, keytype_s, key_type);
2245
2246         g_key_file_set_integer(key_file, addr, encsize_s, enc_size);
2247
2248         g_key_file_set_integer(key_file, addr, ediv_s, ediv);
2249
2250         g_key_file_set_uint64(key_file, addr, rand_s, rand);
2251
2252         data = g_key_file_to_data(key_file, &length, NULL);
2253         g_file_set_contents(DEVICES_FILE, data, length, NULL);
2254         g_free(data);
2255
2256         g_key_file_free(key_file);
2257 }
2258
2259 static void new_long_term_key_event(uint16_t index, uint16_t length,
2260                                         const void *param, void *user_data)
2261 {
2262         const struct mgmt_ev_new_long_term_key *ev = param;
2263         struct device *dev;
2264         char dst[18];
2265
2266         if (length < sizeof(*ev)) {
2267                 error("Too small long term key event (%u bytes)", length);
2268                 return;
2269         }
2270
2271         ba2str(&ev->key.addr.bdaddr, dst);
2272
2273         DBG("new LTK for %s type %u enc_size %u store_hint %u",
2274                         dst, ev->key.type, ev->key.enc_size, ev->store_hint);
2275
2276         dev = find_device(&ev->key.addr.bdaddr);
2277         if (!dev)
2278                 return;
2279
2280         update_device_state(dev, ev->key.addr.type, HAL_STATUS_SUCCESS, false,
2281                                                         true, !!ev->store_hint);
2282
2283         if (ev->store_hint) {
2284                 const struct mgmt_ltk_info *key = &ev->key;
2285                 uint16_t ediv;
2286                 uint64_t rand;
2287
2288                 ediv = le16_to_cpu(key->ediv);
2289                 rand = le64_to_cpu(key->rand);
2290
2291                 store_ltk(&key->addr.bdaddr, key->addr.type, key->master,
2292                                 key->val, key->type, key->enc_size, ediv, rand);
2293         }
2294
2295         /* TODO browse services here? */
2296 }
2297
2298 static void store_csrk(struct device *dev)
2299 {
2300         GKeyFile *key_file;
2301         char key_str[33];
2302         char addr[18];
2303         int i;
2304         gsize length = 0;
2305         char *data;
2306
2307         ba2str(&dev->bdaddr, addr);
2308
2309         key_file = g_key_file_new();
2310         if (!g_key_file_load_from_file(key_file, DEVICES_FILE, 0, NULL)) {
2311                 g_key_file_free(key_file);
2312                 return;
2313         }
2314
2315         if (dev->valid_local_csrk) {
2316                 for (i = 0; i < 16; i++)
2317                         sprintf(key_str + (i * 2), "%2.2X",
2318                                                         dev->local_csrk[i]);
2319
2320                 g_key_file_set_string(key_file, addr, "LocalCSRK", key_str);
2321
2322                 g_key_file_set_boolean(key_file, addr, "LocalCSRKAuthenticated",
2323                                                         dev->local_csrk_auth);
2324         }
2325
2326         if (dev->valid_remote_csrk) {
2327                 for (i = 0; i < 16; i++)
2328                         sprintf(key_str + (i * 2), "%2.2X",
2329                                                         dev->remote_csrk[i]);
2330
2331                 g_key_file_set_string(key_file, addr, "RemoteCSRK", key_str);
2332
2333                 g_key_file_set_boolean(key_file, addr,
2334                                                 "RemoteCSRKAuthenticated",
2335                                                 dev->remote_csrk_auth);
2336         }
2337
2338         data = g_key_file_to_data(key_file, &length, NULL);
2339         g_file_set_contents(DEVICES_FILE, data, length, NULL);
2340         g_free(data);
2341
2342         g_key_file_free(key_file);
2343 }
2344
2345 static void new_csrk_callback(uint16_t index, uint16_t length,
2346                                         const void *param, void *user_data)
2347 {
2348         const struct mgmt_ev_new_csrk *ev = param;
2349         struct device *dev;
2350         char dst[18];
2351
2352         if (length < sizeof(*ev)) {
2353                 error("Too small csrk event (%u bytes)", length);
2354                 return;
2355         }
2356
2357         ba2str(&ev->key.addr.bdaddr, dst);
2358         dev = get_device(&ev->key.addr.bdaddr, ev->key.addr.type);
2359         if (!dev)
2360                 return;
2361
2362         switch (ev->key.type) {
2363         case 0x00:
2364         case 0x02:
2365                 memcpy(dev->local_csrk, ev->key.val, 16);
2366                 dev->local_sign_cnt = 0;
2367                 dev->valid_local_csrk = true;
2368                 dev->local_csrk_auth = ev->key.type == 0x02;
2369                 break;
2370         case 0x01:
2371         case 0x03:
2372                 memcpy(dev->remote_csrk, ev->key.val, 16);
2373                 dev->remote_sign_cnt = 0;
2374                 dev->valid_remote_csrk = true;
2375                 dev->remote_csrk_auth = ev->key.type == 0x03;
2376                 break;
2377         default:
2378                 error("Unknown CSRK key type 02%02x", ev->key.type);
2379                 return;
2380         }
2381
2382         update_device_state(dev, ev->key.addr.type, HAL_STATUS_SUCCESS, false,
2383                                                         true, !!ev->store_hint);
2384
2385         if (ev->store_hint)
2386                 store_csrk(dev);
2387 }
2388
2389 static void store_irk(struct device *dev, const uint8_t *val)
2390 {
2391         GKeyFile *key_file;
2392         char key_str[33];
2393         char addr[18];
2394         int i;
2395         gsize length = 0;
2396         char *data;
2397
2398         ba2str(&dev->bdaddr, addr);
2399
2400         key_file = g_key_file_new();
2401         if (!g_key_file_load_from_file(key_file, DEVICES_FILE, 0, NULL)) {
2402                 g_key_file_free(key_file);
2403                 return;
2404         }
2405
2406         for (i = 0; i < 16; i++)
2407                 sprintf(key_str + (i * 2), "%2.2X", val[i]);
2408
2409         g_key_file_set_string(key_file, addr, "IdentityResolvingKey", key_str);
2410
2411         data = g_key_file_to_data(key_file, &length, NULL);
2412         g_file_set_contents(DEVICES_FILE, data, length, NULL);
2413         g_free(data);
2414
2415         g_key_file_free(key_file);
2416 }
2417
2418 static void new_irk_callback(uint16_t index, uint16_t length,
2419                                         const void *param, void *user_data)
2420 {
2421         const struct mgmt_ev_new_irk *ev = param;
2422         const struct mgmt_addr_info *addr = &ev->key.addr;
2423         struct device *dev;
2424         char dst[18], rpa[18];
2425
2426         if (length < sizeof(*ev)) {
2427                 error("To small New Irk Event (%u bytes)", length);
2428                 return;
2429         }
2430
2431         ba2str(&ev->key.addr.bdaddr, dst);
2432         ba2str(&ev->rpa, rpa);
2433
2434         DBG("new IRK for %s, RPA %s", dst, rpa);
2435
2436         if (!bacmp(&ev->rpa, BDADDR_ANY)) {
2437                 dev = get_device(&addr->bdaddr, addr->type);
2438                 if (!dev)
2439                         return;
2440         } else {
2441                 dev = find_device(&addr->bdaddr);
2442
2443                 if (dev && dev->bredr_paired) {
2444                         bacpy(&dev->rpa, &addr->bdaddr);
2445                         dev->rpa_type = addr->type;
2446
2447                         /* TODO merge properties ie. UUIDs */
2448                 } else {
2449                         dev = find_device(&ev->rpa);
2450                         if (!dev)
2451                                 return;
2452
2453                         /* don't leave garbage in cache file */
2454                         remove_device_info(dev, CACHE_FILE);
2455
2456                         /*
2457                          * RPA resolution is transparent for Android Framework
2458                          * ie. device is still access by RPA so it need to be
2459                          * keep. After bluetoothd restart device is advertised
2460                          * to Android with IDA and RPA is not set.
2461                          */
2462                         bacpy(&dev->rpa, &dev->bdaddr);
2463                         dev->rpa_type = dev->bdaddr_type;
2464
2465                         bacpy(&dev->bdaddr, &addr->bdaddr);
2466                         dev->bdaddr_type = addr->type;
2467                 }
2468         }
2469
2470         update_device_state(dev, ev->key.addr.type, HAL_STATUS_SUCCESS, false,
2471                                                         true, !!ev->store_hint);
2472
2473         if (ev->store_hint)
2474                 store_irk(dev, ev->key.val);
2475 }
2476
2477 static void register_mgmt_handlers(void)
2478 {
2479         mgmt_register(mgmt_if, MGMT_EV_NEW_SETTINGS, adapter.index,
2480                                         new_settings_callback, NULL, NULL);
2481
2482         mgmt_register(mgmt_if, MGMT_EV_CLASS_OF_DEV_CHANGED, adapter.index,
2483                                 mgmt_dev_class_changed_event, NULL, NULL);
2484
2485         mgmt_register(mgmt_if, MGMT_EV_LOCAL_NAME_CHANGED, adapter.index,
2486                                 mgmt_local_name_changed_event, NULL, NULL);
2487
2488         mgmt_register(mgmt_if, MGMT_EV_NEW_LINK_KEY, adapter.index,
2489                                         new_link_key_callback, NULL, NULL);
2490
2491         mgmt_register(mgmt_if, MGMT_EV_PIN_CODE_REQUEST, adapter.index,
2492                                         pin_code_request_callback, NULL, NULL);
2493
2494         mgmt_register(mgmt_if, MGMT_EV_USER_CONFIRM_REQUEST, adapter.index,
2495                                 user_confirm_request_callback, NULL, NULL);
2496
2497         mgmt_register(mgmt_if, MGMT_EV_USER_PASSKEY_REQUEST, adapter.index,
2498                                 user_passkey_request_callback, NULL, NULL);
2499
2500         mgmt_register(mgmt_if, MGMT_EV_PASSKEY_NOTIFY, adapter.index,
2501                                 user_passkey_notify_callback, NULL, NULL);
2502
2503         mgmt_register(mgmt_if, MGMT_EV_DISCOVERING, adapter.index,
2504                                         mgmt_discovering_event, NULL, NULL);
2505
2506         mgmt_register(mgmt_if, MGMT_EV_DEVICE_FOUND, adapter.index,
2507                                         mgmt_device_found_event, NULL, NULL);
2508
2509         mgmt_register(mgmt_if, MGMT_EV_DEVICE_CONNECTED, adapter.index,
2510                                 mgmt_device_connected_event, NULL, NULL);
2511
2512         mgmt_register(mgmt_if, MGMT_EV_DEVICE_DISCONNECTED, adapter.index,
2513                                 mgmt_device_disconnected_event, NULL, NULL);
2514
2515         mgmt_register(mgmt_if, MGMT_EV_CONNECT_FAILED, adapter.index,
2516                                         mgmt_connect_failed_event, NULL, NULL);
2517
2518         mgmt_register(mgmt_if, MGMT_EV_AUTH_FAILED, adapter.index,
2519                                         mgmt_auth_failed_event, NULL, NULL);
2520
2521         mgmt_register(mgmt_if, MGMT_EV_DEVICE_UNPAIRED, adapter.index,
2522                                 mgmt_device_unpaired_event, NULL, NULL);
2523
2524         mgmt_register(mgmt_if, MGMT_EV_NEW_LONG_TERM_KEY, adapter.index,
2525                                         new_long_term_key_event, NULL, NULL);
2526
2527         mgmt_register(mgmt_if, MGMT_EV_NEW_CSRK, adapter.index,
2528                                                 new_csrk_callback, NULL, NULL);
2529
2530         mgmt_register(mgmt_if, MGMT_EV_NEW_IRK, adapter.index, new_irk_callback,
2531                                                                 NULL, NULL);
2532 }
2533
2534 static void load_link_keys_complete(uint8_t status, uint16_t length,
2535                                         const void *param, void *user_data)
2536 {
2537         bt_bluetooth_ready cb = user_data;
2538         int err;
2539
2540         if (status) {
2541                 error("Failed to load link keys for index %u: %s (0x%02x)",
2542                                 adapter.index, mgmt_errstr(status), status);
2543                 err = -EIO;
2544                 goto failed;
2545         }
2546
2547         DBG("status %u", status);
2548
2549         cb(0, &adapter.bdaddr);
2550         return;
2551
2552 failed:
2553         cb(err, NULL);
2554 }
2555
2556 static void load_link_keys(GSList *keys, bt_bluetooth_ready cb)
2557 {
2558         struct mgmt_cp_load_link_keys *cp;
2559         struct mgmt_link_key_info *key;
2560         size_t key_count, cp_size;
2561         unsigned int id;
2562
2563         key_count = g_slist_length(keys);
2564
2565         DBG("keys %zu ", key_count);
2566
2567         cp_size = sizeof(*cp) + (key_count * sizeof(*key));
2568
2569         cp = g_malloc0(cp_size);
2570
2571         /*
2572          * Even if the list of stored keys is empty, it is important to
2573          * load an empty list into the kernel. That way it is ensured
2574          * that no old keys from a previous daemon are present.
2575          */
2576         cp->key_count = cpu_to_le16(key_count);
2577
2578         for (key = cp->keys; keys != NULL; keys = g_slist_next(keys), key++)
2579                 memcpy(key, keys->data, sizeof(*key));
2580
2581         id = mgmt_send(mgmt_if, MGMT_OP_LOAD_LINK_KEYS, adapter.index,
2582                         cp_size, cp, load_link_keys_complete, cb, NULL);
2583
2584         g_free(cp);
2585
2586         if (id == 0) {
2587                 error("Failed to load link keys");
2588                 cb(-EIO, NULL);
2589         }
2590 }
2591
2592 static void load_ltk_complete(uint8_t status, uint16_t length,
2593                                         const void *param, void *user_data)
2594 {
2595         if (status == MGMT_STATUS_SUCCESS)
2596                 return;
2597
2598         info("Failed to load LTKs: %s (0x%02x)", mgmt_errstr(status), status);
2599 }
2600
2601 static void load_ltks(GSList *ltks)
2602 {
2603         struct mgmt_cp_load_long_term_keys *cp;
2604         struct mgmt_ltk_info *ltk;
2605         size_t ltk_count, cp_size;
2606         GSList *l;
2607
2608         ltk_count = g_slist_length(ltks);
2609
2610         DBG("ltks %zu", ltk_count);
2611
2612         cp_size = sizeof(*cp) + (ltk_count * sizeof(*ltk));
2613
2614         cp = g_malloc0(cp_size);
2615
2616         /*
2617          * Even if the list of stored keys is empty, it is important to load
2618          * an empty list into the kernel. That way it is ensured that no old
2619          * keys from a previous daemon are present.
2620          */
2621         cp->key_count = cpu_to_le16(ltk_count);
2622
2623         for (l = ltks, ltk = cp->keys; l != NULL; l = g_slist_next(l), ltk++)
2624                 memcpy(ltk, l->data, sizeof(*ltk));
2625
2626         if (mgmt_send(mgmt_if, MGMT_OP_LOAD_LONG_TERM_KEYS, adapter.index,
2627                         cp_size, cp, load_ltk_complete, NULL, NULL) == 0)
2628                 error("Failed to load LTKs");
2629
2630         g_free(cp);
2631 }
2632
2633 static void load_irk_complete(uint8_t status, uint16_t length,
2634                                         const void *param, void *user_data)
2635 {
2636         if (status == MGMT_STATUS_SUCCESS)
2637                 return;
2638
2639         info("Failed to load IRKs: %s (0x%02x)", mgmt_errstr(status), status);
2640 }
2641
2642 static void load_irks(GSList *irks)
2643 {
2644         struct mgmt_cp_load_irks *cp;
2645         struct mgmt_irk_info *irk;
2646         size_t irk_count, cp_size;
2647         GSList *l;
2648
2649         irk_count = g_slist_length(irks);
2650
2651         DBG("irks %zu", irk_count);
2652
2653         cp_size = sizeof(*cp) + (irk_count * sizeof(*irk));
2654
2655         cp = g_malloc0(cp_size);
2656
2657         cp->irk_count = cpu_to_le16(irk_count);
2658
2659         for (l = irks, irk = cp->irks; l != NULL; l = g_slist_next(l), irk++)
2660                 memcpy(irk, irks->data, sizeof(*irk));
2661
2662         if (mgmt_send(mgmt_if, MGMT_OP_LOAD_IRKS, adapter.index, cp_size, cp,
2663                                         load_irk_complete, NULL, NULL) == 0)
2664                 error("Failed to load IRKs");
2665
2666         g_free(cp);
2667 }
2668
2669 static uint8_t get_adapter_uuids(void)
2670 {
2671         struct hal_ev_adapter_props_changed *ev;
2672         GSList *list = adapter.uuids;
2673         size_t uuid_count = g_slist_length(list);
2674         size_t len = uuid_count * sizeof(uint128_t);
2675         uint8_t buf[BASELEN_PROP_CHANGED + len];
2676         uint8_t *p;
2677
2678         memset(buf, 0, sizeof(buf));
2679         ev = (void *) buf;
2680
2681         ev->num_props = 1;
2682         ev->status = HAL_STATUS_SUCCESS;
2683
2684         ev->props[0].type = HAL_PROP_ADAPTER_UUIDS;
2685         ev->props[0].len = len;
2686         p = ev->props->val;
2687
2688         for (; list; list = g_slist_next(list)) {
2689                 uuid_t *uuid = list->data;
2690
2691                 memcpy(p, &uuid->value.uuid128, sizeof(uint128_t));
2692
2693                 p += sizeof(uint128_t);
2694         }
2695
2696         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
2697                                 HAL_EV_ADAPTER_PROPS_CHANGED, sizeof(buf), ev);
2698
2699         return HAL_STATUS_SUCCESS;
2700 }
2701
2702 static void remove_uuid_complete(uint8_t status, uint16_t length,
2703                                         const void *param, void *user_data)
2704 {
2705         if (status != MGMT_STATUS_SUCCESS) {
2706                 error("Failed to remove UUID: %s (0x%02x)", mgmt_errstr(status),
2707                                                                         status);
2708                 return;
2709         }
2710
2711         mgmt_dev_class_changed_event(adapter.index, length, param, NULL);
2712
2713         get_adapter_uuids();
2714 }
2715
2716 static void remove_uuid(uuid_t *uuid)
2717 {
2718         uint128_t uint128;
2719         struct mgmt_cp_remove_uuid cp;
2720
2721         ntoh128((uint128_t *) uuid->value.uuid128.data, &uint128);
2722         htob128(&uint128, (uint128_t *) cp.uuid);
2723
2724         mgmt_send(mgmt_if, MGMT_OP_REMOVE_UUID, adapter.index, sizeof(cp), &cp,
2725                                         remove_uuid_complete, NULL, NULL);
2726 }
2727
2728 static void add_uuid_complete(uint8_t status, uint16_t length,
2729                                         const void *param, void *user_data)
2730 {
2731         if (status != MGMT_STATUS_SUCCESS) {
2732                 error("Failed to add UUID: %s (0x%02x)", mgmt_errstr(status),
2733                                                                         status);
2734                 return;
2735         }
2736
2737         mgmt_dev_class_changed_event(adapter.index, length, param, NULL);
2738
2739         get_adapter_uuids();
2740 }
2741
2742 static void add_uuid(uint8_t svc_hint, uuid_t *uuid)
2743 {
2744         uint128_t uint128;
2745         struct mgmt_cp_add_uuid cp;
2746
2747         ntoh128((uint128_t *) uuid->value.uuid128.data, &uint128);
2748         htob128(&uint128, (uint128_t *) cp.uuid);
2749
2750         cp.svc_hint = svc_hint;
2751
2752         mgmt_send(mgmt_if, MGMT_OP_ADD_UUID, adapter.index, sizeof(cp), &cp,
2753                                                 add_uuid_complete, NULL, NULL);
2754 }
2755
2756 int bt_adapter_add_record(sdp_record_t *rec, uint8_t svc_hint)
2757 {
2758         uuid_t *uuid;
2759
2760         uuid = sdp_uuid_to_uuid128(&rec->svclass);
2761
2762         if (g_slist_find_custom(adapter.uuids, uuid, sdp_uuid_cmp)) {
2763                 char uuid_str[32];
2764
2765                 sdp_uuid2strn(uuid, uuid_str, sizeof(uuid_str));
2766                 DBG("UUID %s already added", uuid_str);
2767
2768                 bt_free(uuid);
2769                 return -EALREADY;
2770         }
2771
2772         adapter.uuids = g_slist_prepend(adapter.uuids, uuid);
2773
2774         add_uuid(svc_hint, uuid);
2775
2776         return add_record_to_server(&adapter.bdaddr, rec);
2777 }
2778
2779 void bt_adapter_remove_record(uint32_t handle)
2780 {
2781         sdp_record_t *rec;
2782         GSList *uuid_found;
2783
2784         rec = sdp_record_find(handle);
2785         if (!rec)
2786                 return;
2787
2788         uuid_found = g_slist_find_custom(adapter.uuids, &rec->svclass,
2789                                                                 sdp_uuid_cmp);
2790         if (uuid_found) {
2791                 uuid_t *uuid = uuid_found->data;
2792
2793                 remove_uuid(uuid);
2794
2795                 adapter.uuids = g_slist_remove(adapter.uuids, uuid);
2796
2797                 free(uuid);
2798         }
2799
2800         remove_record_from_server(handle);
2801 }
2802
2803 static void set_mode_complete(uint8_t status, uint16_t length,
2804                                         const void *param, void *user_data)
2805 {
2806         if (status != MGMT_STATUS_SUCCESS) {
2807                 error("Failed to set mode: %s (0x%02x)",
2808                                                 mgmt_errstr(status), status);
2809                 return;
2810         }
2811
2812         /*
2813          * The parameters are identical and also the task that is
2814          * required in both cases. So it is safe to just call the
2815          * event handling functions here.
2816          */
2817         new_settings_callback(adapter.index, length, param, NULL);
2818 }
2819
2820 static bool set_mode(uint16_t opcode, uint8_t mode)
2821 {
2822         struct mgmt_mode cp;
2823
2824         memset(&cp, 0, sizeof(cp));
2825         cp.val = mode;
2826
2827         DBG("opcode=0x%x mode=0x%x", opcode, mode);
2828
2829         if (mgmt_send(mgmt_if, opcode, adapter.index, sizeof(cp), &cp,
2830                                         set_mode_complete, NULL, NULL) > 0)
2831                 return true;
2832
2833         error("Failed to set mode");
2834
2835         return false;
2836 }
2837
2838 static void set_io_capability(void)
2839 {
2840         struct mgmt_cp_set_io_capability cp;
2841
2842         memset(&cp, 0, sizeof(cp));
2843         cp.io_capability = DEFAULT_IO_CAPABILITY;
2844
2845         if (mgmt_send(mgmt_if, MGMT_OP_SET_IO_CAPABILITY, adapter.index,
2846                                 sizeof(cp), &cp, NULL, NULL, NULL) == 0)
2847                 error("Failed to set IO capability");
2848 }
2849
2850 static void set_device_id(void)
2851 {
2852         struct mgmt_cp_set_device_id cp;
2853
2854         memset(&cp, 0, sizeof(cp));
2855         cp.source = cpu_to_le16(bt_config_get_pnp_source());
2856         cp.vendor = cpu_to_le16(bt_config_get_pnp_vendor());
2857         cp.product = cpu_to_le16(bt_config_get_pnp_product());
2858         cp.version = cpu_to_le16(bt_config_get_pnp_version());
2859
2860         if (mgmt_send(mgmt_if, MGMT_OP_SET_DEVICE_ID, adapter.index,
2861                                 sizeof(cp), &cp, NULL, NULL, NULL) == 0)
2862                 error("Failed to set device id");
2863
2864         register_device_id(bt_config_get_pnp_source(),
2865                                                 bt_config_get_pnp_vendor(),
2866                                                 bt_config_get_pnp_product(),
2867                                                 bt_config_get_pnp_version());
2868
2869         bt_adapter_add_record(sdp_record_find(0x10000), 0x00);
2870 }
2871
2872 static void set_adapter_name_complete(uint8_t status, uint16_t length,
2873                                         const void *param, void *user_data)
2874 {
2875         const struct mgmt_cp_set_local_name *rp = param;
2876
2877         if (status != MGMT_STATUS_SUCCESS) {
2878                 error("Failed to set name: %s (0x%02x)", mgmt_errstr(status),
2879                                                                         status);
2880                 return;
2881         }
2882
2883         adapter_set_name(rp->name);
2884 }
2885
2886 static uint8_t set_adapter_name(const uint8_t *name, uint16_t len)
2887 {
2888         struct mgmt_cp_set_local_name cp;
2889
2890         memset(&cp, 0, sizeof(cp));
2891         memcpy(cp.name, name, len);
2892
2893         if (mgmt_send(mgmt_if, MGMT_OP_SET_LOCAL_NAME, adapter.index,
2894                                 sizeof(cp), &cp, set_adapter_name_complete,
2895                                 NULL, NULL) > 0)
2896                 return HAL_STATUS_SUCCESS;
2897
2898         error("Failed to set name");
2899
2900         return HAL_STATUS_FAILED;
2901 }
2902
2903 static uint8_t set_adapter_discoverable_timeout(const void *buf, uint16_t len)
2904 {
2905         const uint32_t *timeout = buf;
2906
2907         if (len != sizeof(*timeout)) {
2908                 error("Invalid set disc timeout size (%u bytes), terminating",
2909                                                                         len);
2910                 raise(SIGTERM);
2911                 return HAL_STATUS_FAILED;
2912         }
2913
2914         /*
2915          * Android handles discoverable timeout in Settings app.
2916          * There is no need to use kernel feature for that.
2917          * Just need to store this value here
2918          */
2919
2920         memcpy(&adapter.discoverable_timeout, timeout, sizeof(uint32_t));
2921
2922         store_adapter_config();
2923
2924         send_adapter_property(HAL_PROP_ADAPTER_DISC_TIMEOUT,
2925                                         sizeof(adapter.discoverable_timeout),
2926                                         &adapter.discoverable_timeout);
2927
2928         return HAL_STATUS_SUCCESS;
2929 }
2930
2931 static void clear_uuids(void)
2932 {
2933         struct mgmt_cp_remove_uuid cp;
2934
2935         memset(&cp, 0, sizeof(cp));
2936
2937         mgmt_send(mgmt_if, MGMT_OP_REMOVE_UUID, adapter.index, sizeof(cp),
2938                                                         &cp, NULL, NULL, NULL);
2939 }
2940
2941 static struct device *create_device_from_info(GKeyFile *key_file,
2942                                                         const char *peer)
2943 {
2944         struct device *dev;
2945         uint8_t type;
2946         bdaddr_t bdaddr;
2947         char **uuids;
2948         char *str;
2949
2950         /* BREDR if not present */
2951         type = g_key_file_get_integer(key_file, peer, "AddressType", NULL);
2952
2953         str2ba(peer, &bdaddr);
2954         dev = create_device(&bdaddr, type);
2955
2956         if (type != BDADDR_BREDR)
2957                 dev->bredr = g_key_file_get_boolean(key_file, peer, "BREDR",
2958                                                                         NULL);
2959
2960         str = g_key_file_get_string(key_file, peer, "LocalCSRK", NULL);
2961         if (str) {
2962                 int i;
2963
2964                 dev->valid_local_csrk = true;
2965                 for (i = 0; i < 16; i++)
2966                         sscanf(str + (i * 2), "%02hhX", &dev->local_csrk[i]);
2967
2968                 g_free(str);
2969
2970                 dev->local_sign_cnt = g_key_file_get_integer(key_file, peer,
2971                                                 "LocalCSRKSignCounter", NULL);
2972
2973                 dev->local_csrk_auth = g_key_file_get_boolean(key_file, peer,
2974                                                 "LocalCSRKAuthenticated", NULL);
2975         }
2976
2977         str = g_key_file_get_string(key_file, peer, "RemoteCSRK", NULL);
2978         if (str) {
2979                 int i;
2980
2981                 dev->valid_remote_csrk = true;
2982                 for (i = 0; i < 16; i++)
2983                         sscanf(str + (i * 2), "%02hhX", &dev->remote_csrk[i]);
2984
2985                 g_free(str);
2986
2987                 dev->remote_sign_cnt = g_key_file_get_integer(key_file, peer,
2988                                                 "RemoteCSRKSignCounter", NULL);
2989
2990                 dev->remote_csrk_auth = g_key_file_get_boolean(key_file, peer,
2991                                                 "RemoteCSRKAuthenticated",
2992                                                 NULL);
2993         }
2994
2995         str = g_key_file_get_string(key_file, peer, "GattCCC", NULL);
2996         if (str) {
2997                 dev->gatt_ccc = atoi(str);
2998                 g_free(str);
2999         }
3000
3001         str = g_key_file_get_string(key_file, peer, "Name", NULL);
3002         if (str) {
3003                 g_free(dev->name);
3004                 dev->name = str;
3005         }
3006
3007         str = g_key_file_get_string(key_file, peer, "FriendlyName", NULL);
3008         if (str) {
3009                 g_free(dev->friendly_name);
3010                 dev->friendly_name = str;
3011         }
3012
3013         dev->class = g_key_file_get_integer(key_file, peer, "Class", NULL);
3014
3015         if (dev->bredr)
3016                 dev->bredr_seen = g_key_file_get_integer(key_file, peer,
3017                                                                 "Timestamp",
3018                                                                 NULL);
3019         else
3020                 dev->le_seen = g_key_file_get_integer(key_file, peer,
3021                                                         "Timestamp", NULL);
3022
3023         uuids = g_key_file_get_string_list(key_file, peer, "Services", NULL,
3024                                                                         NULL);
3025         if (uuids) {
3026                 char **uuid;
3027
3028                 for (uuid = uuids; *uuid; uuid++) {
3029                         uint8_t *u = g_malloc0(16);
3030                         int i;
3031
3032                         for (i = 0; i < 16; i++)
3033                                 sscanf((*uuid) + (i * 2), "%02hhX", &u[i]);
3034
3035                         dev->uuids = g_slist_append(dev->uuids, u);
3036                 }
3037
3038                 g_strfreev(uuids);
3039         }
3040
3041         return dev;
3042 }
3043
3044 static struct mgmt_link_key_info *get_key_info(GKeyFile *key_file,
3045                                                         const char *peer)
3046 {
3047         struct mgmt_link_key_info *info = NULL;
3048         char *str;
3049         unsigned int i;
3050
3051         str = g_key_file_get_string(key_file, peer, "LinkKey", NULL);
3052         if (!str || strlen(str) != 32)
3053                 goto failed;
3054
3055         info = g_new0(struct mgmt_link_key_info, 1);
3056
3057         str2ba(peer, &info->addr.bdaddr);
3058
3059         for (i = 0; i < sizeof(info->val); i++)
3060                 sscanf(str + (i * 2), "%02hhX", &info->val[i]);
3061
3062         info->type = g_key_file_get_integer(key_file, peer, "LinkKeyType",
3063                                                                         NULL);
3064         info->pin_len = g_key_file_get_integer(key_file, peer,
3065                                                 "LinkKeyPinLength", NULL);
3066
3067 failed:
3068         g_free(str);
3069
3070         return info;
3071 }
3072
3073 static struct mgmt_ltk_info *get_ltk_info(GKeyFile *key_file, const char *peer,
3074                                                                 bool master)
3075 {
3076         const char *key_s, *keytype_s, *encsize_s, *ediv_s, *rand_s;
3077         struct mgmt_ltk_info *info = NULL;
3078         char *key;
3079         unsigned int i;
3080
3081         key_s = master ? "LongTermKey" : "SlaveLongTermKey";
3082         keytype_s = master ? "LongTermKeyType" : "SlaveLongTermKeyType";
3083         encsize_s = master ? "LongTermKeyEncSize" : "SlaveLongTermKeyEncSize";
3084         ediv_s = master ? "LongTermKeyEDiv" : "SlaveLongTermKeyEDiv";
3085         rand_s = master ? "LongTermKeyRand" : "SlaveLongTermKeyRand";
3086
3087         key = g_key_file_get_string(key_file, peer, key_s, NULL);
3088         if (!key || strlen(key) != 32)
3089                 goto failed;
3090
3091         info = g_new0(struct mgmt_ltk_info, 1);
3092
3093         str2ba(peer, &info->addr.bdaddr);
3094
3095         info->addr.type = g_key_file_get_integer(key_file, peer, "AddressType",
3096                                                                         NULL);
3097
3098         for (i = 0; i < sizeof(info->val); i++)
3099                 sscanf(key + (i * 2), "%02hhX", &info->val[i]);
3100
3101         info->type = g_key_file_get_integer(key_file, peer, keytype_s, NULL);
3102
3103         info->enc_size = g_key_file_get_integer(key_file, peer, encsize_s,
3104                                                                         NULL);
3105
3106         info->rand = g_key_file_get_uint64(key_file, peer, rand_s, NULL);
3107         info->rand = cpu_to_le64(info->rand);
3108
3109         info->ediv = g_key_file_get_integer(key_file, peer, ediv_s, NULL);
3110         info->ediv = cpu_to_le16(info->ediv);
3111
3112         info->master = master;
3113
3114 failed:
3115         g_free(key);
3116
3117         return info;
3118 }
3119
3120 static struct mgmt_irk_info *get_irk_info(GKeyFile *key_file, const char *peer)
3121 {
3122         struct mgmt_irk_info *info = NULL;
3123         unsigned int i;
3124         char *str;
3125
3126         str = g_key_file_get_string(key_file, peer, "IdentityResolvingKey",
3127                                                                         NULL);
3128         if (!str || strlen(str) != 32)
3129                 goto failed;
3130
3131         info = g_new0(struct mgmt_irk_info, 1);
3132
3133         str2ba(peer, &info->addr.bdaddr);
3134
3135         info->addr.type = g_key_file_get_integer(key_file, peer, "AddressType",
3136                                                                         NULL);
3137
3138         for (i = 0; i < sizeof(info->val); i++)
3139                 sscanf(str + (i * 2), "%02hhX", &info->val[i]);
3140
3141 failed:
3142         g_free(str);
3143
3144         return info;
3145 }
3146
3147 static time_t device_timestamp(const struct device *dev)
3148 {
3149         if (dev->bredr && dev->le) {
3150                 if (dev->le_seen > dev->bredr_seen)
3151                         return dev->le_seen;
3152
3153                 return dev->bredr_seen;
3154         }
3155
3156         if (dev->bredr)
3157                 return dev->bredr_seen;
3158
3159         return dev->le_seen;
3160 }
3161
3162 static int device_timestamp_cmp(gconstpointer  a, gconstpointer  b)
3163 {
3164         const struct device *deva = a;
3165         const struct device *devb = b;
3166
3167         return device_timestamp(deva) < device_timestamp(devb);
3168 }
3169
3170 static void load_devices_cache(void)
3171 {
3172         GKeyFile *key_file;
3173         gchar **devs;
3174         gsize len = 0;
3175         unsigned int i;
3176
3177         key_file = g_key_file_new();
3178
3179         g_key_file_load_from_file(key_file, CACHE_FILE, 0, NULL);
3180
3181         devs = g_key_file_get_groups(key_file, &len);
3182
3183         for (i = 0; i < len; i++) {
3184                 struct device *dev;
3185
3186                 dev = create_device_from_info(key_file, devs[i]);
3187                 cached_devices = g_slist_prepend(cached_devices, dev);
3188         }
3189
3190         cached_devices = g_slist_sort(cached_devices, device_timestamp_cmp);
3191
3192         g_strfreev(devs);
3193         g_key_file_free(key_file);
3194 }
3195
3196 static void load_devices_info(bt_bluetooth_ready cb)
3197 {
3198         GKeyFile *key_file;
3199         gchar **devs;
3200         gsize len = 0;
3201         unsigned int i;
3202         GSList *keys = NULL;
3203         GSList *ltks = NULL;
3204         GSList *irks = NULL;
3205
3206         key_file = g_key_file_new();
3207
3208         g_key_file_load_from_file(key_file, DEVICES_FILE, 0, NULL);
3209
3210         devs = g_key_file_get_groups(key_file, &len);
3211
3212         for (i = 0; i < len; i++) {
3213                 struct mgmt_link_key_info *key_info;
3214                 struct mgmt_ltk_info *ltk_info;
3215                 struct mgmt_irk_info *irk_info;
3216                 struct mgmt_ltk_info *slave_ltk_info;
3217                 struct device *dev;
3218
3219                 dev = create_device_from_info(key_file, devs[i]);
3220
3221                 key_info = get_key_info(key_file, devs[i]);
3222                 irk_info = get_irk_info(key_file, devs[i]);
3223                 ltk_info = get_ltk_info(key_file, devs[i], true);
3224                 slave_ltk_info = get_ltk_info(key_file, devs[i], false);
3225
3226                 /*
3227                  * Skip devices that have no permanent keys
3228                  * (CSRKs are loaded by create_device_from_info())
3229                  */
3230                 if (!dev->valid_local_csrk && !dev->valid_remote_csrk &&
3231                                                 !key_info && !ltk_info &&
3232                                                 !slave_ltk_info && !irk_info) {
3233                         error("Failed to load keys for %s, skipping", devs[i]);
3234                         free_device(dev);
3235                         continue;
3236                 }
3237
3238                 if (key_info) {
3239                         keys = g_slist_prepend(keys, key_info);
3240                         dev->bredr_paired = true;
3241                         dev->bredr_bonded = true;
3242                 }
3243
3244                 if (irk_info)
3245                         irks = g_slist_prepend(irks, irk_info);
3246
3247                 if (ltk_info)
3248                         ltks = g_slist_prepend(ltks, ltk_info);
3249
3250                 if (slave_ltk_info)
3251                         ltks = g_slist_prepend(ltks, slave_ltk_info);
3252
3253                 if (dev->valid_local_csrk || dev->valid_remote_csrk ||
3254                                 irk_info || ltk_info || slave_ltk_info) {
3255                         dev->le_paired = true;
3256                         dev->le_bonded = true;
3257                 }
3258
3259                 bonded_devices = g_slist_prepend(bonded_devices, dev);
3260         }
3261
3262         load_ltks(ltks);
3263         g_slist_free_full(ltks, g_free);
3264
3265         load_irks(irks);
3266         g_slist_free_full(irks, g_free);
3267
3268         load_link_keys(keys, cb);
3269         g_slist_free_full(keys, g_free);
3270
3271         g_strfreev(devs);
3272         g_key_file_free(key_file);
3273 }
3274
3275 static void set_adapter_class(void)
3276 {
3277         struct mgmt_cp_set_dev_class cp;
3278
3279         memset(&cp, 0, sizeof(cp));
3280
3281         /*
3282          * kernel assign the major and minor numbers straight to dev_class[0]
3283          * and dev_class[1] without considering the proper bit shifting.
3284          */
3285         cp.major = ADAPTER_MAJOR_CLASS & 0x1f;
3286         cp.minor = ADAPTER_MINOR_CLASS << 2;
3287
3288         if (mgmt_send(mgmt_if, MGMT_OP_SET_DEV_CLASS, adapter.index, sizeof(cp),
3289                                                 &cp, NULL, NULL, NULL) > 0)
3290                 return;
3291
3292         error("Failed to set class of device");
3293 }
3294
3295 static void enable_mps(void)
3296 {
3297         uuid_t uuid, *uuid128;
3298
3299         sdp_uuid16_create(&uuid, MPS_SVCLASS_ID);
3300         uuid128 = sdp_uuid_to_uuid128(&uuid);
3301         if (!uuid128)
3302                 return;
3303
3304         register_mps(true);
3305         adapter.uuids = g_slist_prepend(adapter.uuids, uuid128);
3306         add_uuid(0, uuid128);
3307 }
3308
3309 static void clear_auto_connect_list_complete(uint8_t status,
3310                                                         uint16_t length,
3311                                                         const void *param,
3312                                                         void *user_data)
3313 {
3314         if (status != MGMT_STATUS_SUCCESS)
3315                 error("Failed to clear auto connect list: %s (0x%02x)",
3316                                                 mgmt_errstr(status), status);
3317 }
3318
3319 static void clear_auto_connect_list(void)
3320 {
3321         struct mgmt_cp_remove_device cp;
3322
3323         if (!kernel_conn_control)
3324                 return;
3325
3326         memset(&cp, 0, sizeof(cp));
3327
3328         if (mgmt_send(mgmt_if, MGMT_OP_REMOVE_DEVICE, adapter.index, sizeof(cp),
3329                         &cp, clear_auto_connect_list_complete, NULL, NULL) > 0)
3330                 return;
3331
3332         error("Could not clear auto connect list");
3333 }
3334
3335 static void read_info_complete(uint8_t status, uint16_t length,
3336                                         const void *param, void *user_data)
3337 {
3338         const struct mgmt_rp_read_info *rp = param;
3339         bt_bluetooth_ready cb = user_data;
3340         uint32_t missing_settings;
3341         int err;
3342
3343         DBG("");
3344
3345         if (status) {
3346                 error("Failed to read info for index %u: %s (0x%02x)",
3347                                 adapter.index, mgmt_errstr(status), status);
3348                 err = -EIO;
3349                 goto failed;
3350         }
3351
3352         if (length < sizeof(*rp)) {
3353                 error("Too small read info complete response");
3354                 err = -EIO;
3355                 goto failed;
3356         }
3357
3358         if (!bacmp(&rp->bdaddr, BDADDR_ANY)) {
3359                 error("No Bluetooth address");
3360                 err = -ENODEV;
3361                 goto failed;
3362         }
3363
3364         load_adapter_config();
3365
3366         if (!bacmp(&adapter.bdaddr, BDADDR_ANY)) {
3367                 bacpy(&adapter.bdaddr, &rp->bdaddr);
3368                 store_adapter_config();
3369         } else if (bacmp(&adapter.bdaddr, &rp->bdaddr)) {
3370                 error("Bluetooth address mismatch");
3371                 err = -ENODEV;
3372                 goto failed;
3373         }
3374
3375         if (adapter.name && g_strcmp0(adapter.name, (const char *) rp->name))
3376                 set_adapter_name((uint8_t *)adapter.name, strlen(adapter.name));
3377
3378         set_adapter_class();
3379
3380         /* Store adapter information */
3381         adapter.dev_class = rp->dev_class[0] | (rp->dev_class[1] << 8) |
3382                                                 (rp->dev_class[2] << 16);
3383
3384         adapter.supported_settings = le32_to_cpu(rp->supported_settings);
3385         adapter.current_settings = le32_to_cpu(rp->current_settings);
3386
3387         /* TODO: Register all event notification handlers */
3388         register_mgmt_handlers();
3389
3390         clear_uuids();
3391         clear_auto_connect_list();
3392
3393         set_io_capability();
3394         set_device_id();
3395         enable_mps();
3396
3397         missing_settings = adapter.current_settings ^
3398                                                 adapter.supported_settings;
3399
3400         if (missing_settings & MGMT_SETTING_SSP)
3401                 set_mode(MGMT_OP_SET_SSP, 0x01);
3402
3403         if (missing_settings & MGMT_SETTING_BONDABLE)
3404                 set_mode(MGMT_OP_SET_BONDABLE, 0x01);
3405
3406         load_devices_info(cb);
3407         load_devices_cache();
3408
3409         return;
3410
3411 failed:
3412         cb(err, NULL);
3413 }
3414
3415 static void mgmt_index_added_event(uint16_t index, uint16_t length,
3416                                         const void *param, void *user_data)
3417 {
3418         bt_bluetooth_ready cb = user_data;
3419
3420         DBG("index %u", index);
3421
3422         if (adapter.index != MGMT_INDEX_NONE) {
3423                 DBG("skip event for index %u", index);
3424                 return;
3425         }
3426
3427         if (option_index != MGMT_INDEX_NONE && option_index != index) {
3428                 DBG("skip event for index %u (option %u)", index, option_index);
3429                 return;
3430         }
3431
3432         adapter.index = index;
3433
3434         if (mgmt_send(mgmt_if, MGMT_OP_READ_INFO, index, 0, NULL,
3435                                 read_info_complete, cb, NULL) == 0) {
3436                 cb(-EIO, NULL);
3437                 return;
3438         }
3439 }
3440
3441 static void mgmt_index_removed_event(uint16_t index, uint16_t length,
3442                                         const void *param, void *user_data)
3443 {
3444         DBG("index %u", index);
3445
3446         if (index != adapter.index)
3447                 return;
3448
3449         error("Adapter was removed. Exiting.");
3450         raise(SIGTERM);
3451 }
3452
3453 static void read_index_list_complete(uint8_t status, uint16_t length,
3454                                         const void *param, void *user_data)
3455 {
3456         const struct mgmt_rp_read_index_list *rp = param;
3457         bt_bluetooth_ready cb = user_data;
3458         uint16_t num;
3459         int i;
3460
3461         DBG("");
3462
3463         if (status) {
3464                 error("%s: Failed to read index list: %s (0x%02x)", __func__,
3465                                                 mgmt_errstr(status), status);
3466                 goto failed;
3467         }
3468
3469         if (length < sizeof(*rp)) {
3470                 error("%s: Wrong size of read index list response", __func__);
3471                 goto failed;
3472         }
3473
3474         num = le16_to_cpu(rp->num_controllers);
3475
3476         DBG("Number of controllers: %u", num);
3477
3478         if (num * sizeof(uint16_t) + sizeof(*rp) != length) {
3479                 error("%s: Incorrect pkt size for index list rsp", __func__);
3480                 goto failed;
3481         }
3482
3483         if (adapter.index != MGMT_INDEX_NONE)
3484                 return;
3485
3486         for (i = 0; i < num; i++) {
3487                 uint16_t index = le16_to_cpu(rp->index[i]);
3488
3489                 if (option_index != MGMT_INDEX_NONE && option_index != index)
3490                         continue;
3491
3492                 if (mgmt_send(mgmt_if, MGMT_OP_READ_INFO, index, 0, NULL,
3493                                         read_info_complete, cb, NULL) == 0)
3494                         goto failed;
3495
3496                 adapter.index = index;
3497                 return;
3498         }
3499
3500         return;
3501
3502 failed:
3503         cb(-EIO, NULL);
3504 }
3505
3506 static void read_version_complete(uint8_t status, uint16_t length,
3507                                         const void *param, void *user_data)
3508 {
3509         const struct mgmt_rp_read_version *rp = param;
3510         uint8_t mgmt_version, mgmt_revision;
3511         bt_bluetooth_ready cb = user_data;
3512
3513         DBG("");
3514
3515         if (status) {
3516                 error("Failed to read version information: %s (0x%02x)",
3517                                                 mgmt_errstr(status), status);
3518                 goto failed;
3519         }
3520
3521         if (length < sizeof(*rp)) {
3522                 error("Wrong size response");
3523                 goto failed;
3524         }
3525
3526         mgmt_version = rp->version;
3527         mgmt_revision = le16_to_cpu(rp->revision);
3528
3529         info("Bluetooth management interface %u.%u initialized",
3530                                                 mgmt_version, mgmt_revision);
3531
3532         if (MGMT_VERSION(mgmt_version, mgmt_revision) < MGMT_VERSION(1, 3)) {
3533                 error("Version 1.3 or later of management interface required");
3534                 goto failed;
3535         }
3536
3537         /* Starting from mgmt 1.7, kernel can handle connection control */
3538         if (MGMT_VERSION(mgmt_version, mgmt_revision) >= MGMT_VERSION(1, 7)) {
3539                 info("Kernel connection control will be used");
3540                 kernel_conn_control = true;
3541         }
3542
3543         mgmt_register(mgmt_if, MGMT_EV_INDEX_ADDED, MGMT_INDEX_NONE,
3544                                         mgmt_index_added_event, cb, NULL);
3545         mgmt_register(mgmt_if, MGMT_EV_INDEX_REMOVED, MGMT_INDEX_NONE,
3546                                         mgmt_index_removed_event, NULL, NULL);
3547
3548         if (mgmt_send(mgmt_if, MGMT_OP_READ_INDEX_LIST, MGMT_INDEX_NONE, 0,
3549                                 NULL, read_index_list_complete, cb, NULL) > 0)
3550                 return;
3551
3552         error("Failed to read controller index list");
3553
3554 failed:
3555         cb(-EIO, NULL);
3556 }
3557
3558 bool bt_bluetooth_start(int index, bool mgmt_dbg, bt_bluetooth_ready cb)
3559 {
3560         DBG("index %d", index);
3561
3562         mgmt_if = mgmt_new_default();
3563         if (!mgmt_if) {
3564                 error("Failed to access management interface");
3565                 return false;
3566         }
3567
3568         if (mgmt_dbg)
3569                 mgmt_set_debug(mgmt_if, mgmt_debug, "mgmt_if: ", NULL);
3570
3571         if (mgmt_send(mgmt_if, MGMT_OP_READ_VERSION, MGMT_INDEX_NONE, 0, NULL,
3572                                 read_version_complete, cb, NULL) == 0) {
3573                 error("Error sending READ_VERSION mgmt command");
3574
3575                 mgmt_unref(mgmt_if);
3576                 mgmt_if = NULL;
3577
3578                 return false;
3579         }
3580
3581         if (index >= 0)
3582                 option_index = index;
3583
3584         return true;
3585 }
3586
3587 static void shutdown_complete(uint8_t status, uint16_t length,
3588                                         const void *param, void *user_data)
3589 {
3590         bt_bluetooth_stopped cb = user_data;
3591
3592         if (status != MGMT_STATUS_SUCCESS)
3593                 error("Clean controller shutdown failed");
3594
3595         cb();
3596 }
3597
3598 bool bt_bluetooth_stop(bt_bluetooth_stopped cb)
3599 {
3600         struct mgmt_mode cp;
3601
3602         if (adapter.index == MGMT_INDEX_NONE)
3603                 return false;
3604
3605         info("Switching controller off");
3606
3607         memset(&cp, 0, sizeof(cp));
3608
3609         return mgmt_send(mgmt_if, MGMT_OP_SET_POWERED, adapter.index,
3610                                 sizeof(cp), &cp, shutdown_complete, (void *)cb,
3611                                 NULL) > 0;
3612 }
3613
3614 void bt_bluetooth_cleanup(void)
3615 {
3616         g_free(adapter.name);
3617         adapter.name = NULL;
3618
3619         mgmt_unref(mgmt_if);
3620         mgmt_if = NULL;
3621 }
3622
3623 static bool set_discoverable(uint8_t mode, uint16_t timeout)
3624 {
3625         struct mgmt_cp_set_discoverable cp;
3626
3627         memset(&cp, 0, sizeof(cp));
3628         cp.val = mode;
3629         cp.timeout = cpu_to_le16(timeout);
3630
3631         DBG("mode %u timeout %u", mode, timeout);
3632
3633         if (mgmt_send(mgmt_if, MGMT_OP_SET_DISCOVERABLE, adapter.index,
3634                         sizeof(cp), &cp, set_mode_complete, NULL, NULL) > 0)
3635                 return true;
3636
3637         error("Failed to set mode discoverable");
3638
3639         return false;
3640 }
3641
3642 static uint8_t get_adapter_address(void)
3643 {
3644         uint8_t buf[6];
3645
3646         bdaddr2android(&adapter.bdaddr, buf);
3647
3648         send_adapter_property(HAL_PROP_ADAPTER_ADDR, sizeof(buf), buf);
3649
3650         return HAL_STATUS_SUCCESS;
3651 }
3652
3653 static uint8_t get_adapter_name(void)
3654 {
3655         if (!adapter.name)
3656                 return HAL_STATUS_FAILED;
3657
3658         adapter_name_changed((uint8_t *) adapter.name);
3659
3660         return HAL_STATUS_SUCCESS;
3661 }
3662
3663 static uint8_t get_adapter_class(void)
3664 {
3665         DBG("");
3666
3667         adapter_class_changed();
3668
3669         return HAL_STATUS_SUCCESS;
3670 }
3671
3672 static uint8_t settings2type(void)
3673 {
3674         bool bredr, le;
3675
3676         bredr = adapter.current_settings & MGMT_SETTING_BREDR;
3677         le = adapter.current_settings & MGMT_SETTING_LE;
3678
3679         if (bredr && le)
3680                 return HAL_TYPE_DUAL;
3681
3682         if (bredr && !le)
3683                 return HAL_TYPE_BREDR;
3684
3685         if (!bredr && le)
3686                 return HAL_TYPE_LE;
3687
3688         return 0;
3689 }
3690
3691 static uint8_t get_adapter_type(void)
3692 {
3693         uint8_t type;
3694
3695         DBG("");
3696
3697         type = settings2type();
3698
3699         if (!type)
3700                 return HAL_STATUS_FAILED;
3701
3702         send_adapter_property(HAL_PROP_ADAPTER_TYPE, sizeof(type), &type);
3703
3704         return HAL_STATUS_SUCCESS;
3705 }
3706
3707 static uint8_t get_adapter_service_rec(void)
3708 {
3709         DBG("Not implemented");
3710
3711         /* TODO: Add implementation */
3712
3713         return HAL_STATUS_FAILED;
3714 }
3715
3716 static uint8_t get_adapter_scan_mode(void)
3717 {
3718         DBG("");
3719
3720         scan_mode_changed();
3721
3722         return HAL_STATUS_SUCCESS;
3723 }
3724
3725 static uint8_t get_adapter_bonded_devices(void)
3726 {
3727         uint8_t buf[sizeof(bdaddr_t) * g_slist_length(bonded_devices)];
3728         int i = 0;
3729         GSList *l;
3730
3731         DBG("");
3732
3733         for (l = bonded_devices; l; l = g_slist_next(l)) {
3734                 struct device *dev = l->data;
3735
3736                 get_device_android_addr(dev, buf + (i * sizeof(bdaddr_t)));
3737                 i++;
3738         }
3739
3740         send_adapter_property(HAL_PROP_ADAPTER_BONDED_DEVICES,
3741                                                 i * sizeof(bdaddr_t), buf);
3742
3743         return HAL_STATUS_SUCCESS;
3744 }
3745
3746 static uint8_t get_adapter_discoverable_timeout(void)
3747 {
3748         send_adapter_property(HAL_PROP_ADAPTER_DISC_TIMEOUT,
3749                                         sizeof(adapter.discoverable_timeout),
3750                                         &adapter.discoverable_timeout);
3751
3752         return HAL_STATUS_SUCCESS;
3753 }
3754
3755 static void prepare_le_features(uint8_t *le_features)
3756 {
3757         le_features[0] = !!(adapter.current_settings & MGMT_SETTING_PRIVACY);
3758         le_features[1] = adapter.max_advert_instance;
3759         le_features[2] = adapter.rpa_offload_supported;
3760         le_features[3] = adapter.max_irk_list_size;
3761         le_features[4] = adapter.max_scan_filters_supported;
3762         /* lo byte */
3763         le_features[5] = adapter.scan_result_storage_size;
3764         /* hi byte */
3765         le_features[6] = adapter.scan_result_storage_size >> 8;
3766         le_features[7] = adapter.activity_energy_info_supported;
3767 }
3768
3769 static uint8_t get_adapter_le_features(void)
3770 {
3771         uint8_t le_features[8];
3772
3773         prepare_le_features(le_features);
3774
3775         send_adapter_property(HAL_PROP_ADAPTER_LOCAL_LE_FEAT,
3776                                         sizeof(le_features), le_features);
3777         return HAL_STATUS_SUCCESS;
3778 }
3779
3780 static void handle_get_adapter_prop_cmd(const void *buf, uint16_t len)
3781 {
3782         const struct hal_cmd_get_adapter_prop *cmd = buf;
3783         uint8_t status;
3784
3785         switch (cmd->type) {
3786         case HAL_PROP_ADAPTER_ADDR:
3787                 status = get_adapter_address();
3788                 break;
3789         case HAL_PROP_ADAPTER_NAME:
3790                 status = get_adapter_name();
3791                 break;
3792         case HAL_PROP_ADAPTER_UUIDS:
3793                 status = get_adapter_uuids();
3794                 break;
3795         case HAL_PROP_ADAPTER_CLASS:
3796                 status = get_adapter_class();
3797                 break;
3798         case HAL_PROP_ADAPTER_TYPE:
3799                 status = get_adapter_type();
3800                 break;
3801         case HAL_PROP_ADAPTER_SERVICE_REC:
3802                 status = get_adapter_service_rec();
3803                 break;
3804         case HAL_PROP_ADAPTER_SCAN_MODE:
3805                 status = get_adapter_scan_mode();
3806                 break;
3807         case HAL_PROP_ADAPTER_BONDED_DEVICES:
3808                 status = get_adapter_bonded_devices();
3809                 break;
3810         case HAL_PROP_ADAPTER_DISC_TIMEOUT:
3811                 status = get_adapter_discoverable_timeout();
3812                 break;
3813         case HAL_PROP_ADAPTER_LOCAL_LE_FEAT:
3814                 status = get_adapter_le_features();
3815                 break;
3816         default:
3817                 status = HAL_STATUS_FAILED;
3818                 break;
3819         }
3820
3821         if (status != HAL_STATUS_SUCCESS)
3822                 error("Failed to get adapter property (type %u status %u)",
3823                                                         cmd->type, status);
3824
3825         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_GET_ADAPTER_PROP,
3826                                                                         status);
3827 }
3828
3829 static void get_adapter_properties(void)
3830 {
3831         uint8_t buf[IPC_MTU];
3832         struct hal_ev_adapter_props_changed *ev = (void *) buf;
3833         uint8_t bonded[g_slist_length(bonded_devices) * sizeof(bdaddr_t)];
3834         uint128_t uuids[g_slist_length(adapter.uuids)];
3835         uint8_t android_bdaddr[6];
3836         uint8_t le_features[8];
3837         uint8_t type, mode;
3838         size_t size, i;
3839         GSList *l;
3840
3841         size = sizeof(*ev);
3842
3843         ev->status = HAL_STATUS_SUCCESS;
3844         ev->num_props = 0;
3845
3846         bdaddr2android(&adapter.bdaddr, &android_bdaddr);
3847         size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_ADDR,
3848                                         sizeof(android_bdaddr), android_bdaddr);
3849         ev->num_props++;
3850
3851         if (adapter.name) {
3852                 size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_NAME,
3853                                         strlen(adapter.name), adapter.name);
3854                 ev->num_props++;
3855         }
3856
3857         size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_CLASS,
3858                                 sizeof(adapter.dev_class), &adapter.dev_class);
3859         ev->num_props++;
3860
3861         type = settings2type();
3862         if (type) {
3863                 size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_TYPE,
3864                                                         sizeof(type), &type);
3865                 ev->num_props++;
3866         }
3867
3868         mode = settings2scan_mode();
3869         size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_SCAN_MODE,
3870                                                         sizeof(mode), &mode);
3871         ev->num_props++;
3872
3873         size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_DISC_TIMEOUT,
3874                                         sizeof(adapter.discoverable_timeout),
3875                                         &adapter.discoverable_timeout);
3876         ev->num_props++;
3877
3878         for (i = 0, l = bonded_devices; l; l = g_slist_next(l), i++) {
3879                 struct device *dev = l->data;
3880
3881                 get_device_android_addr(dev, bonded + (i * sizeof(bdaddr_t)));
3882         }
3883
3884         size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_BONDED_DEVICES,
3885                                                 sizeof(bonded), bonded);
3886         ev->num_props++;
3887
3888         for (i = 0, l = adapter.uuids; l; l = g_slist_next(l), i++) {
3889                 uuid_t *uuid = l->data;
3890
3891                 memcpy(&uuids[i], &uuid->value.uuid128, sizeof(uint128_t));
3892         }
3893
3894         size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_UUIDS, sizeof(uuids),
3895                                                                         uuids);
3896         ev->num_props++;
3897
3898         prepare_le_features(le_features);
3899         size += fill_hal_prop(buf + size, HAL_PROP_ADAPTER_LOCAL_LE_FEAT,
3900                                         sizeof(le_features), le_features);
3901
3902         ev->num_props++;
3903
3904         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
3905                                 HAL_EV_ADAPTER_PROPS_CHANGED, size, buf);
3906 }
3907
3908 static void cancel_pending_confirm_name(gpointer data, gpointer user_data)
3909 {
3910         struct device *dev = data;
3911
3912         mgmt_cancel(mgmt_if, dev->confirm_id);
3913         dev->confirm_id = 0;
3914 }
3915
3916 static bool stop_discovery(uint8_t type)
3917 {
3918         struct mgmt_cp_stop_discovery cp;
3919
3920         cp.type = get_supported_discovery_type() & type;
3921
3922         DBG("type=0x%x", cp.type);
3923
3924         if (cp.type == SCAN_TYPE_NONE)
3925                 return false;
3926
3927         /* Lets drop all confirm name request as we don't need it anymore */
3928         g_slist_foreach(cached_devices, cancel_pending_confirm_name, NULL);
3929
3930         if (mgmt_send(mgmt_if, MGMT_OP_STOP_DISCOVERY, adapter.index,
3931                                         sizeof(cp), &cp, NULL, NULL, NULL) > 0)
3932                 return true;
3933
3934         error("Failed to stop discovery");
3935         return false;
3936 }
3937
3938 struct adv_user_data {
3939         bt_le_set_advertising_done cb;
3940         void *user_data;
3941 };
3942
3943 static void set_advertising_cb(uint8_t status, uint16_t length,
3944                         const void *param, void *user_data)
3945 {
3946         struct adv_user_data *data = user_data;
3947
3948         DBG("");
3949
3950         if (status)
3951                 error("Failed to set adverising %s (0x%02x))",
3952                                                 mgmt_errstr(status), status);
3953
3954         data->cb(status, data->user_data);
3955 }
3956
3957 bool bt_le_set_advertising(bool advertising, bt_le_set_advertising_done cb,
3958                                                          void *user_data)
3959 {
3960         struct adv_user_data *data;
3961         uint8_t adv = advertising ? 0x01 : 0x00;
3962
3963         data = new0(struct adv_user_data, 1);
3964         data->cb = cb;
3965         data->user_data = user_data;
3966
3967         if (mgmt_send(mgmt_if, MGMT_OP_SET_ADVERTISING, adapter.index,
3968                         sizeof(adv), &adv, set_advertising_cb, data, free) > 0)
3969                 return true;
3970
3971         error("Failed to set advertising");
3972         free(data);
3973         return false;
3974 }
3975
3976 bool bt_le_register(bt_le_device_found cb)
3977 {
3978         if (gatt_device_found_cb)
3979                 return false;
3980
3981         gatt_device_found_cb = cb;
3982
3983         return true;
3984 }
3985
3986 void bt_le_unregister(void)
3987 {
3988         gatt_device_found_cb = NULL;
3989 }
3990
3991 bool bt_le_discovery_stop(bt_le_discovery_stopped cb)
3992 {
3993         if (!(adapter.current_settings & MGMT_SETTING_POWERED))
3994                 return false;
3995
3996         adapter.le_scanning = false;
3997
3998         if (adapter.cur_discovery_type != SCAN_TYPE_LE) {
3999                 if (cb)
4000                         cb();
4001
4002                 return true;
4003         }
4004
4005         if (!stop_discovery(SCAN_TYPE_LE))
4006                 return false;
4007
4008         gatt_discovery_stopped_cb = cb;
4009         adapter.exp_discovery_type = SCAN_TYPE_NONE;
4010
4011         return true;
4012 }
4013
4014 bool bt_le_discovery_start(void)
4015 {
4016         if (!(adapter.current_settings & MGMT_SETTING_POWERED))
4017                 return false;
4018
4019         adapter.le_scanning = true;
4020
4021         /*
4022          * If core is discovering - just set expected next scan type.
4023          * It will be triggered in case current scan session is almost done
4024          * i.e. we missed LE phase in interleaved scan, or we're trying to
4025          * connect to device that was already discovered.
4026          */
4027         if (adapter.cur_discovery_type != SCAN_TYPE_NONE) {
4028                 adapter.exp_discovery_type = SCAN_TYPE_LE;
4029                 return true;
4030         }
4031
4032         if (start_discovery(SCAN_TYPE_LE))
4033                 return true;
4034
4035         return false;
4036 }
4037
4038 struct read_rssi_user_data {
4039         bt_read_device_rssi_done cb;
4040         void *user_data;
4041 };
4042
4043 static void read_device_rssi_cb(uint8_t status, uint16_t length,
4044                         const void *param, void *user_data)
4045 {
4046         const struct mgmt_rp_get_conn_info *rp = param;
4047         struct read_rssi_user_data *data = user_data;
4048
4049         DBG("");
4050
4051         if (status)
4052                 error("Failed to get conn info: %s (0x%02x))",
4053                                                 mgmt_errstr(status), status);
4054
4055         if (length < sizeof(*rp)) {
4056                 error("Wrong size of get conn info response");
4057                 return;
4058         }
4059
4060         data->cb(status, &rp->addr.bdaddr, rp->rssi, data->user_data);
4061 }
4062
4063 bool bt_read_device_rssi(const bdaddr_t *addr, bt_read_device_rssi_done cb,
4064                                                         void *user_data)
4065 {
4066         struct device *dev;
4067         struct read_rssi_user_data *data;
4068         struct mgmt_cp_get_conn_info cp;
4069
4070         dev = find_device(addr);
4071         if (!dev)
4072                 return false;
4073
4074         memcpy(&cp.addr.bdaddr, addr, sizeof(cp.addr.bdaddr));
4075         cp.addr.type = dev->bredr ? BDADDR_BREDR : dev->bdaddr_type;
4076
4077         data = new0(struct read_rssi_user_data, 1);
4078         data->cb = cb;
4079         data->user_data = user_data;
4080
4081         if (!mgmt_send(mgmt_if, MGMT_OP_GET_CONN_INFO, adapter.index,
4082                         sizeof(cp), &cp, read_device_rssi_cb, data, free)) {
4083                 free(data);
4084                 error("Failed to get conn info");
4085                 return false;
4086         }
4087
4088         return true;
4089 }
4090
4091 bool bt_get_csrk(const bdaddr_t *addr, bool local, uint8_t key[16],
4092                                         uint32_t *sign_cnt, bool *authenticated)
4093 {
4094         struct device *dev;
4095
4096         dev = find_device(addr);
4097         if (!dev)
4098                 return false;
4099
4100         if (local && dev->valid_local_csrk) {
4101                 if (key)
4102                         memcpy(key, dev->local_csrk, 16);
4103
4104                 if (sign_cnt)
4105                         *sign_cnt = dev->local_sign_cnt;
4106
4107                 if (authenticated)
4108                         *authenticated = dev->local_csrk_auth;
4109         } else if (!local && dev->valid_remote_csrk) {
4110                 if (key)
4111                         memcpy(key, dev->remote_csrk, 16);
4112
4113                 if (sign_cnt)
4114                         *sign_cnt = dev->remote_sign_cnt;
4115
4116                 if (authenticated)
4117                         *authenticated = dev->remote_csrk_auth;
4118         } else {
4119                 return false;
4120         }
4121
4122         return true;
4123 }
4124
4125 static void store_sign_counter(struct device *dev, bool local)
4126 {
4127         const char *sign_cnt_s;
4128         uint32_t sign_cnt;
4129         GKeyFile *key_file;
4130
4131         gsize length = 0;
4132         char addr[18];
4133         char *data;
4134
4135         key_file = g_key_file_new();
4136         if (!g_key_file_load_from_file(key_file, DEVICES_FILE, 0, NULL)) {
4137                 g_key_file_free(key_file);
4138                 return;
4139         }
4140
4141         ba2str(&dev->bdaddr, addr);
4142
4143         sign_cnt_s = local ? "LocalCSRKSignCounter" : "RemoteCSRKSignCounter";
4144         sign_cnt = local ? dev->local_sign_cnt : dev->remote_sign_cnt;
4145
4146         g_key_file_set_integer(key_file, addr, sign_cnt_s, sign_cnt);
4147
4148         data = g_key_file_to_data(key_file, &length, NULL);
4149         g_file_set_contents(DEVICES_FILE, data, length, NULL);
4150         g_free(data);
4151
4152         g_key_file_free(key_file);
4153 }
4154
4155 void bt_update_sign_counter(const bdaddr_t *addr, bool local, uint32_t val)
4156 {
4157         struct device *dev;
4158
4159         dev = find_device(addr);
4160         if (!dev)
4161                 return;
4162
4163         if (local)
4164                 dev->local_sign_cnt = val;
4165         else
4166                 dev->remote_sign_cnt = val;
4167
4168         store_sign_counter(dev, local);
4169 }
4170
4171 static uint8_t set_adapter_scan_mode(const void *buf, uint16_t len)
4172 {
4173         const uint8_t *mode = buf;
4174         bool conn, disc, cur_conn, cur_disc;
4175
4176         if (len != sizeof(*mode)) {
4177                 error("Invalid set scan mode size (%u bytes), terminating",
4178                                                                 len);
4179                 raise(SIGTERM);
4180                 return HAL_STATUS_FAILED;
4181         }
4182
4183         cur_conn = adapter.current_settings & MGMT_SETTING_CONNECTABLE;
4184         cur_disc = adapter.current_settings & MGMT_SETTING_DISCOVERABLE;
4185
4186         DBG("connectable %u discoverable %d mode %u", cur_conn, cur_disc,
4187                                                                 *mode);
4188
4189         switch (*mode) {
4190         case HAL_ADAPTER_SCAN_MODE_NONE:
4191                 if (!cur_conn && !cur_disc)
4192                         goto done;
4193
4194                 conn = false;
4195                 disc = false;
4196                 break;
4197         case HAL_ADAPTER_SCAN_MODE_CONN:
4198                 if (cur_conn && !cur_disc)
4199                         goto done;
4200
4201                 conn = true;
4202                 disc = false;
4203                 break;
4204         case HAL_ADAPTER_SCAN_MODE_CONN_DISC:
4205                 if (cur_conn && cur_disc)
4206                         goto done;
4207
4208                 conn = true;
4209                 disc = true;
4210                 break;
4211         default:
4212                 return HAL_STATUS_FAILED;
4213         }
4214
4215         if (cur_conn != conn) {
4216                 if (!set_mode(MGMT_OP_SET_CONNECTABLE, conn ? 0x01 : 0x00))
4217                         return HAL_STATUS_FAILED;
4218         }
4219
4220         if (cur_disc != disc && conn) {
4221                 if (!set_discoverable(disc ? 0x01 : 0x00, 0))
4222                         return HAL_STATUS_FAILED;
4223         }
4224
4225         return HAL_STATUS_SUCCESS;
4226
4227 done:
4228         /* Android expects property changed callback */
4229         scan_mode_changed();
4230
4231         return HAL_STATUS_SUCCESS;
4232 }
4233
4234 static void handle_set_adapter_prop_cmd(const void *buf, uint16_t len)
4235 {
4236         const struct hal_cmd_set_adapter_prop *cmd = buf;
4237         uint8_t status;
4238
4239         if (len != sizeof(*cmd) + cmd->len) {
4240                 error("Invalid set adapter prop cmd (0x%x), terminating",
4241                                                                 cmd->type);
4242                 raise(SIGTERM);
4243                 return;
4244         }
4245
4246         switch (cmd->type) {
4247         case HAL_PROP_ADAPTER_SCAN_MODE:
4248                 status = set_adapter_scan_mode(cmd->val, cmd->len);
4249                 break;
4250         case HAL_PROP_ADAPTER_NAME:
4251                 status = set_adapter_name(cmd->val, cmd->len);
4252                 break;
4253         case HAL_PROP_ADAPTER_DISC_TIMEOUT:
4254                 status = set_adapter_discoverable_timeout(cmd->val, cmd->len);
4255                 break;
4256         default:
4257                 DBG("Unhandled property type 0x%x", cmd->type);
4258                 status = HAL_STATUS_FAILED;
4259                 break;
4260         }
4261
4262         if (status != HAL_STATUS_SUCCESS)
4263                 error("Failed to set adapter property (type %u status %u)",
4264                                                         cmd->type, status);
4265
4266         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_SET_ADAPTER_PROP,
4267                                                                         status);
4268 }
4269
4270 static void pair_device_complete(uint8_t status, uint16_t length,
4271                                         const void *param, void *user_data)
4272 {
4273         const struct mgmt_rp_pair_device *rp = param;
4274         struct device *dev;
4275
4276         DBG("status %u", status);
4277
4278         dev = find_device(&rp->addr.bdaddr);
4279         if (!dev)
4280                 return;
4281
4282         /*
4283          * Update pairing and paired status. Bonded status will be updated once
4284          * any link key come
4285          */
4286         update_device_state(dev, rp->addr.type, status_mgmt2hal(status), false,
4287                                                                 !status, false);
4288
4289         if (status == MGMT_STATUS_SUCCESS)
4290                 queue_foreach(paired_cb_list, send_paired_notification, dev);
4291 }
4292
4293 static uint8_t select_device_bearer(struct device *dev)
4294 {
4295         uint8_t res;
4296
4297         if (dev->bredr && dev->le) {
4298                 if (dev->le_seen > dev->bredr_seen)
4299                         res = dev->bdaddr_type;
4300                 else
4301                         res = BDADDR_BREDR;
4302         } else {
4303                 res = dev->bredr ? BDADDR_BREDR : dev->bdaddr_type;
4304         }
4305
4306         DBG("Selected bearer %d", res);
4307
4308         return res;
4309 }
4310
4311 uint8_t bt_device_last_seen_bearer(const bdaddr_t *bdaddr)
4312 {
4313          struct device *dev;
4314
4315         dev = find_device(bdaddr);
4316         if (!dev)
4317                 return BDADDR_BREDR;
4318
4319         return select_device_bearer(dev);
4320 }
4321
4322 static void handle_create_bond_cmd(const void *buf, uint16_t len)
4323 {
4324         const struct hal_cmd_create_bond *cmd = buf;
4325         struct device *dev;
4326         uint8_t status;
4327         struct mgmt_cp_pair_device cp;
4328
4329         dev = get_device_android(cmd->bdaddr);
4330
4331         cp.io_cap = DEFAULT_IO_CAPABILITY;
4332         cp.addr.type = select_device_bearer(dev);
4333         bacpy(&cp.addr.bdaddr, &dev->bdaddr);
4334
4335         /* TODO: Handle transport parameter */
4336         if (cmd->transport > BT_TRANSPORT_LE) {
4337                 status = HAL_STATUS_INVALID;
4338                 goto fail;
4339         }
4340
4341         if (device_is_paired(dev, cp.addr.type)) {
4342                 status = HAL_STATUS_FAILED;
4343                 goto fail;
4344         }
4345
4346         if (mgmt_send(mgmt_if, MGMT_OP_PAIR_DEVICE, adapter.index, sizeof(cp),
4347                                 &cp, pair_device_complete, NULL, NULL) == 0) {
4348                 status = HAL_STATUS_FAILED;
4349                 goto fail;
4350         }
4351
4352         status = HAL_STATUS_SUCCESS;
4353
4354         update_device_state(dev, cp.addr.type, HAL_STATUS_SUCCESS, true, false,
4355                                                                         false);
4356
4357 fail:
4358         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_CREATE_BOND,
4359                                                                         status);
4360 }
4361
4362 static void handle_cancel_bond_cmd(const void *buf, uint16_t len)
4363 {
4364         const struct hal_cmd_cancel_bond *cmd = buf;
4365         struct mgmt_addr_info cp;
4366         struct device *dev;
4367         uint8_t status;
4368
4369         dev = find_device_android(cmd->bdaddr);
4370         if (!dev) {
4371                 status = HAL_STATUS_FAILED;
4372                 goto failed;
4373         }
4374
4375         cp.type = select_device_bearer(dev);
4376         bacpy(&cp.bdaddr, &dev->bdaddr);
4377
4378         if (mgmt_reply(mgmt_if, MGMT_OP_CANCEL_PAIR_DEVICE, adapter.index,
4379                                 sizeof(cp), &cp, NULL, NULL, NULL) == 0) {
4380                 status = HAL_STATUS_FAILED;
4381                 goto failed;
4382         }
4383
4384         status = HAL_STATUS_SUCCESS;
4385
4386 failed:
4387         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_CANCEL_BOND,
4388                                                                         status);
4389 }
4390
4391 static void send_unpaired_notification(void *data, void *user_data)
4392 {
4393         bt_unpaired_device_cb cb = data;
4394         struct mgmt_addr_info *addr = user_data;
4395
4396         cb(&addr->bdaddr);
4397 }
4398
4399 static void unpair_device_complete(uint8_t status, uint16_t length,
4400                                         const void *param, void *user_data)
4401 {
4402         const struct mgmt_rp_unpair_device *rp = param;
4403         struct device *dev;
4404
4405         DBG("status %u", status);
4406
4407         if (status != MGMT_STATUS_SUCCESS && status != MGMT_STATUS_NOT_PAIRED)
4408                 return;
4409
4410         dev = find_device(&rp->addr.bdaddr);
4411         if (!dev)
4412                 return;
4413
4414         update_device_state(dev, rp->addr.type, HAL_STATUS_SUCCESS, false,
4415                                                                 false, false);
4416
4417         /* Cast rp->addr to (void *) since queue_foreach don't take const */
4418
4419         if (!dev->le_paired && !dev->bredr_paired)
4420                 queue_foreach(unpaired_cb_list, send_unpaired_notification,
4421                                                         (void *)&rp->addr);
4422 }
4423
4424 static void handle_remove_bond_cmd(const void *buf, uint16_t len)
4425 {
4426         const struct hal_cmd_remove_bond *cmd = buf;
4427         struct mgmt_cp_unpair_device cp;
4428         struct device *dev;
4429         uint8_t status;
4430
4431         dev = find_device_android(cmd->bdaddr);
4432         if (!dev) {
4433                 status = HAL_STATUS_FAILED;
4434                 goto failed;
4435         }
4436
4437         cp.disconnect = 1;
4438         bacpy(&cp.addr.bdaddr, &dev->bdaddr);
4439
4440         if (dev->le_paired) {
4441                 cp.addr.type = dev->bdaddr_type;
4442
4443                 if (mgmt_send(mgmt_if, MGMT_OP_UNPAIR_DEVICE, adapter.index,
4444                                         sizeof(cp), &cp, unpair_device_complete,
4445                                         NULL, NULL) == 0) {
4446                         status = HAL_STATUS_FAILED;
4447                         goto failed;
4448                 }
4449         }
4450
4451         if (dev->bredr_paired) {
4452                 cp.addr.type = BDADDR_BREDR;
4453
4454                 if (mgmt_send(mgmt_if, MGMT_OP_UNPAIR_DEVICE, adapter.index,
4455                                         sizeof(cp), &cp, unpair_device_complete,
4456                                         NULL, NULL) == 0) {
4457                         status = HAL_STATUS_FAILED;
4458                         goto failed;
4459                 }
4460         }
4461
4462         status = HAL_STATUS_SUCCESS;
4463
4464 failed:
4465         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_REMOVE_BOND,
4466                                                                         status);
4467 }
4468
4469 static void handle_pin_reply_cmd(const void *buf, uint16_t len)
4470 {
4471         const struct hal_cmd_pin_reply *cmd = buf;
4472         uint8_t status;
4473         bdaddr_t bdaddr;
4474         char addr[18];
4475
4476         android2bdaddr(cmd->bdaddr, &bdaddr);
4477         ba2str(&bdaddr, addr);
4478
4479         DBG("%s accept %u pin_len %u", addr, cmd->accept, cmd->pin_len);
4480
4481         if (!cmd->accept && cmd->pin_len) {
4482                 status = HAL_STATUS_INVALID;
4483                 goto failed;
4484         }
4485
4486         if (cmd->accept) {
4487                 struct mgmt_cp_pin_code_reply rp;
4488
4489                 memset(&rp, 0, sizeof(rp));
4490
4491                 bacpy(&rp.addr.bdaddr, &bdaddr);
4492                 rp.addr.type = BDADDR_BREDR;
4493                 rp.pin_len = cmd->pin_len;
4494                 memcpy(rp.pin_code, cmd->pin_code, rp.pin_len);
4495
4496                 if (mgmt_reply(mgmt_if, MGMT_OP_PIN_CODE_REPLY, adapter.index,
4497                                 sizeof(rp), &rp, NULL, NULL, NULL) == 0) {
4498                         status = HAL_STATUS_FAILED;
4499                         goto failed;
4500                 }
4501         } else {
4502                 struct mgmt_cp_pin_code_neg_reply rp;
4503
4504                 bacpy(&rp.addr.bdaddr, &bdaddr);
4505                 rp.addr.type = BDADDR_BREDR;
4506
4507                 if (mgmt_reply(mgmt_if, MGMT_OP_PIN_CODE_NEG_REPLY,
4508                                                 adapter.index, sizeof(rp), &rp,
4509                                                 NULL, NULL, NULL) == 0) {
4510                         status = HAL_STATUS_FAILED;
4511                         goto failed;
4512                 }
4513         }
4514
4515         status = HAL_STATUS_SUCCESS;
4516 failed:
4517         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_PIN_REPLY,
4518                                                                         status);
4519 }
4520
4521 static uint8_t user_confirm_reply(const bdaddr_t *bdaddr, uint8_t type,
4522                                                                 bool accept)
4523 {
4524         struct mgmt_addr_info cp;
4525         uint16_t opcode;
4526
4527         if (accept)
4528                 opcode = MGMT_OP_USER_CONFIRM_REPLY;
4529         else
4530                 opcode = MGMT_OP_USER_CONFIRM_NEG_REPLY;
4531
4532         bacpy(&cp.bdaddr, bdaddr);
4533         cp.type = type;
4534
4535         if (mgmt_reply(mgmt_if, opcode, adapter.index, sizeof(cp), &cp,
4536                                                         NULL, NULL, NULL) > 0)
4537                 return HAL_STATUS_SUCCESS;
4538
4539         return HAL_STATUS_FAILED;
4540 }
4541
4542 static uint8_t user_passkey_reply(const bdaddr_t *bdaddr, uint8_t type,
4543                                                 bool accept, uint32_t passkey)
4544 {
4545         unsigned int id;
4546
4547         if (accept) {
4548                 struct mgmt_cp_user_passkey_reply cp;
4549
4550                 memset(&cp, 0, sizeof(cp));
4551                 bacpy(&cp.addr.bdaddr, bdaddr);
4552                 cp.addr.type = type;
4553                 cp.passkey = cpu_to_le32(passkey);
4554
4555                 id = mgmt_reply(mgmt_if, MGMT_OP_USER_PASSKEY_REPLY,
4556                                                 adapter.index, sizeof(cp), &cp,
4557                                                 NULL, NULL, NULL);
4558         } else {
4559                 struct mgmt_cp_user_passkey_neg_reply cp;
4560
4561                 memset(&cp, 0, sizeof(cp));
4562                 bacpy(&cp.addr.bdaddr, bdaddr);
4563                 cp.addr.type = type;
4564
4565                 id = mgmt_reply(mgmt_if, MGMT_OP_USER_PASSKEY_NEG_REPLY,
4566                                                 adapter.index, sizeof(cp), &cp,
4567                                                 NULL, NULL, NULL);
4568         }
4569
4570         if (id == 0)
4571                 return HAL_STATUS_FAILED;
4572
4573         return HAL_STATUS_SUCCESS;
4574 }
4575
4576 static void handle_ssp_reply_cmd(const void *buf, uint16_t len)
4577 {
4578         const struct hal_cmd_ssp_reply *cmd = buf;
4579         struct device *dev;
4580         uint8_t status;
4581         char addr[18];
4582
4583         /* TODO should parameters sanity be verified here? */
4584
4585         dev = find_device_android(cmd->bdaddr);
4586         if (!dev)
4587                 return;
4588
4589         ba2str(&dev->bdaddr, addr);
4590
4591         DBG("%s variant %u accept %u", addr, cmd->ssp_variant, cmd->accept);
4592
4593         switch (cmd->ssp_variant) {
4594         case HAL_SSP_VARIANT_CONFIRM:
4595         case HAL_SSP_VARIANT_CONSENT:
4596                 status = user_confirm_reply(&dev->bdaddr,
4597                                                 select_device_bearer(dev),
4598                                                 cmd->accept);
4599                 break;
4600         case HAL_SSP_VARIANT_ENTRY:
4601                 status = user_passkey_reply(&dev->bdaddr,
4602                                                 select_device_bearer(dev),
4603                                                 cmd->accept, cmd->passkey);
4604                 break;
4605         case HAL_SSP_VARIANT_NOTIF:
4606                 status = HAL_STATUS_SUCCESS;
4607                 break;
4608         default:
4609                 status = HAL_STATUS_INVALID;
4610                 break;
4611         }
4612
4613         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_SSP_REPLY,
4614                                                                         status);
4615 }
4616
4617 static void handle_get_remote_services_cmd(const void *buf, uint16_t len)
4618 {
4619         const struct hal_cmd_get_remote_services *cmd = buf;
4620         uint8_t status;
4621         bdaddr_t addr;
4622
4623         android2bdaddr(&cmd->bdaddr, &addr);
4624
4625         status = browse_remote_sdp(&addr);
4626
4627         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
4628                                         HAL_OP_GET_REMOTE_SERVICES, status);
4629 }
4630
4631 static uint8_t get_device_uuids(struct device *dev)
4632 {
4633         send_device_uuids_notif(dev);
4634
4635         return HAL_STATUS_SUCCESS;
4636 }
4637
4638 static uint8_t get_device_class(struct device *dev)
4639 {
4640         send_device_property(dev, HAL_PROP_DEVICE_CLASS, sizeof(dev->class),
4641                                                                 &dev->class);
4642
4643         return HAL_STATUS_SUCCESS;
4644 }
4645
4646 static uint8_t get_device_type(struct device *dev)
4647 {
4648         uint8_t type = get_device_android_type(dev);
4649
4650         send_device_property(dev, HAL_PROP_DEVICE_TYPE, sizeof(type), &type);
4651
4652         return HAL_STATUS_SUCCESS;
4653 }
4654
4655 static uint8_t get_device_service_rec(struct device *dev)
4656 {
4657         DBG("Not implemented");
4658
4659         /* TODO */
4660
4661         return HAL_STATUS_FAILED;
4662 }
4663
4664 static uint8_t get_device_friendly_name(struct device *dev)
4665 {
4666         if (!dev->friendly_name)
4667                 return HAL_STATUS_FAILED;
4668
4669         send_device_property(dev, HAL_PROP_DEVICE_FRIENDLY_NAME,
4670                                 strlen(dev->friendly_name), dev->friendly_name);
4671
4672         return HAL_STATUS_SUCCESS;
4673 }
4674
4675 static uint8_t get_device_rssi(struct device *dev)
4676 {
4677         if (!dev->rssi)
4678                 return HAL_STATUS_FAILED;
4679
4680         send_device_property(dev, HAL_PROP_DEVICE_RSSI, sizeof(dev->rssi),
4681                                                                 &dev->rssi);
4682
4683         return HAL_STATUS_SUCCESS;
4684 }
4685
4686 static uint8_t get_device_version_info(struct device *dev)
4687 {
4688         DBG("Not implemented");
4689
4690         /* TODO */
4691
4692         return HAL_STATUS_FAILED;
4693 }
4694
4695 static uint8_t get_device_timestamp(struct device *dev)
4696 {
4697         uint32_t timestamp;
4698
4699         timestamp = device_timestamp(dev);
4700
4701         send_device_property(dev, HAL_PROP_DEVICE_TIMESTAMP, sizeof(timestamp),
4702                                                                 &timestamp);
4703
4704         return HAL_STATUS_SUCCESS;
4705 }
4706
4707 static void get_remote_device_props(struct device *dev)
4708 {
4709         uint8_t buf[IPC_MTU];
4710         struct hal_ev_remote_device_props *ev = (void *) buf;
4711         uint128_t uuids[g_slist_length(dev->uuids)];
4712         uint8_t android_type;
4713         uint32_t timestamp;
4714         size_t size, i;
4715         GSList *l;
4716
4717         memset(buf, 0, sizeof(buf));
4718
4719         size = sizeof(*ev);
4720
4721         ev->status = HAL_STATUS_SUCCESS;
4722         get_device_android_addr(dev, ev->bdaddr);
4723
4724         android_type = get_device_android_type(dev);
4725         size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_TYPE,
4726                                         sizeof(android_type), &android_type);
4727         ev->num_props++;
4728
4729         size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_CLASS,
4730                                         sizeof(dev->class), &dev->class);
4731         ev->num_props++;
4732
4733         if (dev->rssi) {
4734                 size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_RSSI,
4735                                                 sizeof(dev->rssi), &dev->rssi);
4736                 ev->num_props++;
4737         }
4738
4739         size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_NAME,
4740                                                 strlen(dev->name), dev->name);
4741         ev->num_props++;
4742
4743         if (dev->friendly_name) {
4744                 size += fill_hal_prop(buf + size,
4745                                         HAL_PROP_DEVICE_FRIENDLY_NAME,
4746                                         strlen(dev->friendly_name),
4747                                         dev->friendly_name);
4748                 ev->num_props++;
4749         }
4750
4751         for (i = 0, l = dev->uuids; l; l = g_slist_next(l), i++)
4752                 memcpy(&uuids[i], l->data, sizeof(uint128_t));
4753
4754         size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_UUIDS, sizeof(uuids),
4755                                                                         uuids);
4756         ev->num_props++;
4757
4758         timestamp = get_device_timestamp(dev);
4759
4760         size += fill_hal_prop(buf + size, HAL_PROP_DEVICE_TIMESTAMP,
4761                                                 sizeof(timestamp), &timestamp);
4762         ev->num_props++;
4763
4764         ipc_send_notif(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
4765                                         HAL_EV_REMOTE_DEVICE_PROPS, size, buf);
4766 }
4767
4768 static void send_bonded_devices_props(void)
4769 {
4770         GSList *l;
4771
4772         for (l = bonded_devices; l; l = g_slist_next(l)) {
4773                 struct device *dev = l->data;
4774
4775                 get_remote_device_props(dev);
4776         }
4777 }
4778
4779 static void handle_enable_cmd(const void *buf, uint16_t len)
4780 {
4781         uint8_t status;
4782
4783         /*
4784          * Framework expects all properties to be emitted while enabling
4785          * adapter
4786          */
4787         get_adapter_properties();
4788
4789         /* Sent also properties of bonded devices */
4790         send_bonded_devices_props();
4791
4792         if (adapter.current_settings & MGMT_SETTING_POWERED) {
4793                 status = HAL_STATUS_SUCCESS;
4794                 goto reply;
4795         }
4796
4797         if (!set_mode(MGMT_OP_SET_POWERED, 0x01)) {
4798                 status = HAL_STATUS_FAILED;
4799                 goto reply;
4800         }
4801
4802         status = HAL_STATUS_SUCCESS;
4803 reply:
4804         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_ENABLE, status);
4805 }
4806
4807 static void handle_disable_cmd(const void *buf, uint16_t len)
4808 {
4809         uint8_t status;
4810
4811         if (!(adapter.current_settings & MGMT_SETTING_POWERED)) {
4812                 status = HAL_STATUS_SUCCESS;
4813                 goto reply;
4814         }
4815
4816         /* Cancel all pending requests. Need it in case of ongoing paring */
4817         mgmt_cancel_index(mgmt_if, adapter.index);
4818
4819         if (!set_mode(MGMT_OP_SET_POWERED, 0x00)) {
4820                 status = HAL_STATUS_FAILED;
4821                 goto reply;
4822         }
4823
4824         status = HAL_STATUS_SUCCESS;
4825 reply:
4826         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_DISABLE, status);
4827 }
4828
4829 static void handle_get_adapter_props_cmd(const void *buf, uint16_t len)
4830 {
4831         get_adapter_properties();
4832
4833         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
4834                                 HAL_OP_GET_ADAPTER_PROPS, HAL_STATUS_SUCCESS);
4835 }
4836
4837 static void handle_get_remote_device_props_cmd(const void *buf, uint16_t len)
4838 {
4839         const struct hal_cmd_get_remote_device_props *cmd = buf;
4840         struct device *dev;
4841         uint8_t status;
4842
4843         dev = find_device_android(cmd->bdaddr);
4844         if (!dev) {
4845                 status = HAL_STATUS_INVALID;
4846                 goto failed;
4847         }
4848
4849         get_remote_device_props(dev);
4850
4851         status = HAL_STATUS_SUCCESS;
4852
4853 failed:
4854         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
4855                                         HAL_OP_GET_REMOTE_DEVICE_PROPS, status);
4856 }
4857
4858 static void handle_get_remote_device_prop_cmd(const void *buf, uint16_t len)
4859 {
4860         const struct hal_cmd_get_remote_device_prop *cmd = buf;
4861         struct device *dev;
4862         uint8_t status;
4863
4864         dev = find_device_android(cmd->bdaddr);
4865         if (!dev) {
4866                 status = HAL_STATUS_INVALID;
4867                 goto failed;
4868         }
4869
4870         switch (cmd->type) {
4871         case HAL_PROP_DEVICE_NAME:
4872                 status = get_device_name(dev);
4873                 break;
4874         case HAL_PROP_DEVICE_UUIDS:
4875                 status = get_device_uuids(dev);
4876                 break;
4877         case HAL_PROP_DEVICE_CLASS:
4878                 status = get_device_class(dev);
4879                 break;
4880         case HAL_PROP_DEVICE_TYPE:
4881                 status = get_device_type(dev);
4882                 break;
4883         case HAL_PROP_DEVICE_SERVICE_REC:
4884                 status = get_device_service_rec(dev);
4885                 break;
4886         case HAL_PROP_DEVICE_FRIENDLY_NAME:
4887                 status = get_device_friendly_name(dev);
4888                 break;
4889         case HAL_PROP_DEVICE_RSSI:
4890                 status = get_device_rssi(dev);
4891                 break;
4892         case HAL_PROP_DEVICE_VERSION_INFO:
4893                 status = get_device_version_info(dev);
4894                 break;
4895         case HAL_PROP_DEVICE_TIMESTAMP:
4896                 status = get_device_timestamp(dev);
4897                 break;
4898         default:
4899                 status = HAL_STATUS_FAILED;
4900                 break;
4901         }
4902
4903         if (status != HAL_STATUS_SUCCESS)
4904                 error("Failed to get device property (type %u status %u)",
4905                                                         cmd->type, status);
4906
4907 failed:
4908         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
4909                                         HAL_OP_GET_REMOTE_DEVICE_PROP, status);
4910 }
4911
4912 static uint8_t set_device_friendly_name(struct device *dev, const uint8_t *val,
4913                                                                 uint16_t len)
4914 {
4915         DBG("");
4916
4917         g_free(dev->friendly_name);
4918         dev->friendly_name = g_strndup((const char *) val, len);
4919
4920         if (dev->bredr_paired || dev->le_paired)
4921                 store_device_info(dev, DEVICES_FILE);
4922         else
4923                 store_device_info(dev, CACHE_FILE);
4924
4925         return HAL_STATUS_SUCCESS;
4926 }
4927
4928 static uint8_t set_device_version_info(struct device *dev)
4929 {
4930         DBG("Not implemented");
4931
4932         /* TODO */
4933
4934         return HAL_STATUS_FAILED;
4935 }
4936
4937 static void handle_set_remote_device_prop_cmd(const void *buf, uint16_t len)
4938 {
4939         const struct hal_cmd_set_remote_device_prop *cmd = buf;
4940         struct device *dev;
4941         uint8_t status;
4942
4943         if (len != sizeof(*cmd) + cmd->len) {
4944                 error("Invalid set remote device prop cmd (0x%x), terminating",
4945                                                                 cmd->type);
4946                 raise(SIGTERM);
4947                 return;
4948         }
4949
4950         dev = find_device_android(cmd->bdaddr);
4951         if (!dev) {
4952                 status = HAL_STATUS_INVALID;
4953                 goto failed;
4954         }
4955
4956         switch (cmd->type) {
4957         case HAL_PROP_DEVICE_FRIENDLY_NAME:
4958                 status = set_device_friendly_name(dev, cmd->val, cmd->len);
4959                 break;
4960         case HAL_PROP_DEVICE_VERSION_INFO:
4961                 status = set_device_version_info(dev);
4962                 break;
4963         default:
4964                 status = HAL_STATUS_FAILED;
4965                 break;
4966         }
4967
4968         if (status != HAL_STATUS_SUCCESS)
4969                 error("Failed to set device property (type %u status %u)",
4970                                                         cmd->type, status);
4971
4972 failed:
4973         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
4974                                         HAL_OP_SET_REMOTE_DEVICE_PROP, status);
4975 }
4976
4977 static void handle_get_remote_service_rec_cmd(const void *buf, uint16_t len)
4978 {
4979         const struct hal_cmd_get_remote_service_rec *cmd = buf;
4980         uint8_t status;
4981         bdaddr_t addr;
4982
4983         android2bdaddr(&cmd->bdaddr, &addr);
4984
4985         status = find_remote_sdp_rec(&addr, cmd->uuid);
4986
4987         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
4988                                         HAL_OP_GET_REMOTE_SERVICE_REC, status);
4989 }
4990
4991 static void handle_start_discovery_cmd(const void *buf, uint16_t len)
4992 {
4993         uint8_t status;
4994
4995         if (!(adapter.current_settings & MGMT_SETTING_POWERED)) {
4996                 status = HAL_STATUS_NOT_READY;
4997                 goto failed;
4998         }
4999
5000         switch (adapter.cur_discovery_type) {
5001         case SCAN_TYPE_DUAL:
5002         case SCAN_TYPE_BREDR:
5003                 break;
5004         case SCAN_TYPE_NONE:
5005                 if (!start_discovery(SCAN_TYPE_DUAL)) {
5006                         status = HAL_STATUS_FAILED;
5007                         goto failed;
5008                 }
5009
5010                 break;
5011         case SCAN_TYPE_LE:
5012                 if (get_supported_discovery_type() == SCAN_TYPE_LE)
5013                         break;
5014
5015                 if (!stop_discovery(SCAN_TYPE_LE)) {
5016                         status = HAL_STATUS_FAILED;
5017                         goto failed;
5018                 }
5019
5020                 adapter.exp_discovery_type = SCAN_TYPE_DUAL;
5021                 break;
5022         }
5023
5024         status = HAL_STATUS_SUCCESS;
5025
5026 failed:
5027         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_START_DISCOVERY,
5028                                                                         status);
5029 }
5030
5031 static void handle_cancel_discovery_cmd(const void *buf, uint16_t len)
5032 {
5033         uint8_t status;
5034
5035         if (!(adapter.current_settings & MGMT_SETTING_POWERED)) {
5036                 status = HAL_STATUS_NOT_READY;
5037                 goto failed;
5038         }
5039
5040         switch (adapter.cur_discovery_type) {
5041         case SCAN_TYPE_NONE:
5042                 break;
5043         case SCAN_TYPE_LE:
5044                 if (get_supported_discovery_type() != SCAN_TYPE_LE)
5045                         break;
5046
5047                 if (adapter.exp_discovery_type == SCAN_TYPE_LE) {
5048                         status = HAL_STATUS_BUSY;
5049                         goto failed;
5050                 }
5051
5052                 if (!stop_discovery(SCAN_TYPE_LE)) {
5053                         status = HAL_STATUS_FAILED;
5054                         goto failed;
5055                 }
5056
5057                 break;
5058         case SCAN_TYPE_DUAL:
5059         case SCAN_TYPE_BREDR:
5060                 if (!stop_discovery(SCAN_TYPE_DUAL)) {
5061                         status = HAL_STATUS_FAILED;
5062                         goto failed;
5063                 }
5064
5065                 if (adapter.exp_discovery_type != SCAN_TYPE_LE)
5066                         adapter.exp_discovery_type = SCAN_TYPE_NONE;
5067
5068                 break;
5069         }
5070
5071         status = HAL_STATUS_SUCCESS;
5072
5073 failed:
5074         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_CANCEL_DISCOVERY,
5075                                                                         status);
5076 }
5077
5078 static void handle_dut_mode_conf_cmd(const void *buf, uint16_t len)
5079 {
5080         const struct hal_cmd_dut_mode_conf *cmd = buf;
5081         char path[FILENAME_MAX];
5082         uint8_t status;
5083         int fd, ret;
5084
5085         DBG("enable %u", cmd->enable);
5086
5087         snprintf(path, sizeof(path), DUT_MODE_FILE, adapter.index);
5088
5089         fd = open(path, O_WRONLY);
5090         if (fd < 0) {
5091                 status = HAL_STATUS_FAILED;
5092                 goto failed;
5093         }
5094
5095         if (cmd->enable)
5096                 ret = write(fd, "1", sizeof("1"));
5097         else
5098                 ret = write(fd, "0", sizeof("0"));
5099
5100         if (ret < 0)
5101                 status = HAL_STATUS_FAILED;
5102         else
5103                 status = HAL_STATUS_SUCCESS;
5104
5105         close(fd);
5106
5107 failed:
5108         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_DUT_MODE_CONF,
5109                                                                         status);
5110 }
5111
5112 static void handle_dut_mode_send_cmd(const void *buf, uint16_t len)
5113 {
5114         const struct hal_cmd_dut_mode_send *cmd = buf;
5115
5116         if (len != sizeof(*cmd) + cmd->len) {
5117                 error("Invalid dut mode send cmd, terminating");
5118                 raise(SIGTERM);
5119                 return;
5120         }
5121
5122         error("dut_mode_send not supported (cmd opcode %u)", cmd->opcode);
5123
5124         /* TODO */
5125
5126         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_DUT_MODE_SEND,
5127                                                         HAL_STATUS_FAILED);
5128 }
5129
5130 static void handle_le_test_mode_cmd(const void *buf, uint16_t len)
5131 {
5132         const struct hal_cmd_le_test_mode *cmd = buf;
5133
5134         if (len != sizeof(*cmd) + cmd->len) {
5135                 error("Invalid le test mode cmd, terminating");
5136                 raise(SIGTERM);
5137                 return;
5138         }
5139
5140         error("le_test_mode not supported (cmd opcode %u)", cmd->opcode);
5141
5142         /* TODO */
5143
5144         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_LE_TEST_MODE,
5145                                                         HAL_STATUS_FAILED);
5146 }
5147
5148 static void handle_get_connection_state(const void *buf, uint16_t len)
5149 {
5150         const struct hal_cmd_get_connection_state *cmd = buf;
5151         struct hal_rsp_get_connection_state rsp;
5152         struct device *dev;
5153         char address[18];
5154         bdaddr_t bdaddr;
5155
5156         android2bdaddr(cmd->bdaddr, &bdaddr);
5157         ba2str(&bdaddr, address);
5158
5159         dev = find_device_android(cmd->bdaddr);
5160         if (dev && dev->connected)
5161                 rsp.connection_state = 1;
5162         else
5163                 rsp.connection_state = 0;
5164
5165         DBG("%s %u", address, rsp.connection_state);
5166
5167         ipc_send_rsp_full(hal_ipc, HAL_SERVICE_ID_BLUETOOTH,
5168                                 HAL_OP_GET_CONNECTION_STATE, sizeof(rsp), &rsp,
5169                                 -1);
5170 }
5171
5172 static void handle_read_energy_info(const void *buf, uint16_t len)
5173 {
5174         DBG("");
5175
5176         /* TODO */
5177
5178         ipc_send_rsp(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, HAL_OP_READ_ENERGY_INFO,
5179                                                         HAL_STATUS_UNSUPPORTED);
5180 }
5181
5182 static const struct ipc_handler cmd_handlers[] = {
5183         /* HAL_OP_ENABLE */
5184         { handle_enable_cmd, false, 0 },
5185         /* HAL_OP_DISABLE */
5186         { handle_disable_cmd, false, 0 },
5187         /* HAL_OP_GET_ADAPTER_PROPS */
5188         { handle_get_adapter_props_cmd, false, 0 },
5189         /* HAL_OP_GET_ADAPTER_PROP */
5190         { handle_get_adapter_prop_cmd, false,
5191                                 sizeof(struct hal_cmd_get_adapter_prop) },
5192         /* HAL_OP_SET_ADAPTER_PROP */
5193         { handle_set_adapter_prop_cmd, true,
5194                                 sizeof(struct hal_cmd_set_adapter_prop) },
5195         /* HAL_OP_GET_REMOTE_DEVICE_PROPS */
5196         { handle_get_remote_device_props_cmd, false,
5197                         sizeof(struct hal_cmd_get_remote_device_props) },
5198         /* HAL_OP_GET_REMOTE_DEVICE_PROP */
5199         { handle_get_remote_device_prop_cmd, false,
5200                                 sizeof(struct hal_cmd_get_remote_device_prop) },
5201         /* HAL_OP_SET_REMOTE_DEVICE_PROP */
5202         { handle_set_remote_device_prop_cmd, true,
5203                                 sizeof(struct hal_cmd_set_remote_device_prop) },
5204         /* HAL_OP_GET_REMOTE_SERVICE_REC */
5205         { handle_get_remote_service_rec_cmd, false,
5206                                 sizeof(struct hal_cmd_get_remote_service_rec) },
5207         /* HAL_OP_GET_REMOTE_SERVICES */
5208         { handle_get_remote_services_cmd, false,
5209                                 sizeof(struct hal_cmd_get_remote_services) },
5210         /* HAL_OP_START_DISCOVERY */
5211         { handle_start_discovery_cmd, false, 0 },
5212         /* HAL_OP_CANCEL_DISCOVERY */
5213         { handle_cancel_discovery_cmd, false, 0 },
5214         /* HAL_OP_CREATE_BOND */
5215         { handle_create_bond_cmd, false, sizeof(struct hal_cmd_create_bond) },
5216         /* HAL_OP_REMOVE_BOND */
5217         { handle_remove_bond_cmd, false, sizeof(struct hal_cmd_remove_bond) },
5218         /* HAL_OP_CANCEL_BOND */
5219         {handle_cancel_bond_cmd, false, sizeof(struct hal_cmd_cancel_bond) },
5220         /* HAL_OP_PIN_REPLY */
5221         { handle_pin_reply_cmd, false, sizeof(struct hal_cmd_pin_reply) },
5222         /* HAL_OP_SSP_REPLY */
5223         { handle_ssp_reply_cmd, false, sizeof(struct hal_cmd_ssp_reply) },
5224         /* HAL_OP_DUT_MODE_CONF */
5225         { handle_dut_mode_conf_cmd, false,
5226                                         sizeof(struct hal_cmd_dut_mode_conf) },
5227         /* HAL_OP_DUT_MODE_SEND */
5228         { handle_dut_mode_send_cmd, true,
5229                                         sizeof(struct hal_cmd_dut_mode_send) },
5230         /* HAL_OP_LE_TEST_MODE */
5231         { handle_le_test_mode_cmd, true, sizeof(struct hal_cmd_le_test_mode) },
5232         /* HAL_OP_GET_CONNECTION_STATE */
5233         { handle_get_connection_state, false,
5234                                 sizeof(struct hal_cmd_get_connection_state) },
5235         /* HAL_OP_READ_ENERGY_INFO */
5236         { handle_read_energy_info, false, 0 },
5237 };
5238
5239 bool bt_bluetooth_register(struct ipc *ipc, uint8_t mode)
5240 {
5241         uint32_t missing_settings;
5242
5243         DBG("mode 0x%x", mode);
5244
5245         unpaired_cb_list = queue_new();
5246         paired_cb_list = queue_new();
5247
5248         missing_settings = adapter.current_settings ^
5249                                                 adapter.supported_settings;
5250
5251         switch (mode) {
5252         case HAL_MODE_DEFAULT:
5253                 if (missing_settings & MGMT_SETTING_BREDR)
5254                         set_mode(MGMT_OP_SET_BREDR, 0x01);
5255
5256                 if (missing_settings & MGMT_SETTING_LE)
5257                         set_mode(MGMT_OP_SET_LE, 0x01);
5258                 break;
5259         case HAL_MODE_LE:
5260                 /* Fail if controller does not support LE */
5261                 if (!(adapter.supported_settings & MGMT_SETTING_LE)) {
5262                         error("LE Mode not supported by controller");
5263                         goto failed;
5264                 }
5265
5266                 /* If LE it is not yet enabled then enable it */
5267                 if (!(adapter.current_settings & MGMT_SETTING_LE))
5268                         set_mode(MGMT_OP_SET_LE, 0x01);
5269
5270                 /* Disable BR/EDR if it is enabled */
5271                 if (adapter.current_settings & MGMT_SETTING_BREDR)
5272                         set_mode(MGMT_OP_SET_BREDR, 0x00);
5273                 break;
5274         case HAL_MODE_BREDR:
5275                 /* Fail if controller does not support BR/EDR */
5276                 if (!(adapter.supported_settings & MGMT_SETTING_BREDR)) {
5277                         error("BR/EDR Mode not supported");
5278                         goto failed;
5279                 }
5280
5281                 /* Enable BR/EDR if it is not enabled */
5282                 if (missing_settings & MGMT_SETTING_BREDR)
5283                         set_mode(MGMT_OP_SET_BREDR, 0x01);
5284
5285                 /*
5286                  * According to Core Spec 4.0 host should not disable LE in
5287                  * controller if it was enabled (Vol 2. Part E. 7.3.79).
5288                  * Core Spec 4.1 removed this limitation and chips seem to be
5289                  * handling this just fine anyway.
5290                  */
5291                 if (adapter.current_settings & MGMT_SETTING_LE)
5292                         set_mode(MGMT_OP_SET_LE, 0x00);
5293                 break;
5294         default:
5295                 error("Unknown mode 0x%x", mode);
5296                 goto failed;
5297         }
5298
5299         /* Requested mode is set now, let's enable secure connection */
5300         if (missing_settings & MGMT_SETTING_SECURE_CONN)
5301                 set_mode(MGMT_OP_SET_SECURE_CONN, 0x01);
5302
5303         /* Set initial default name */
5304         if (!adapter.name) {
5305                 adapter.name = g_strdup(bt_config_get_model());
5306                 set_adapter_name((uint8_t *)adapter.name, strlen(adapter.name));
5307         }
5308
5309         hal_ipc = ipc;
5310
5311         ipc_register(hal_ipc, HAL_SERVICE_ID_BLUETOOTH, cmd_handlers,
5312                                                 G_N_ELEMENTS(cmd_handlers));
5313
5314         return true;
5315
5316 failed:
5317         queue_destroy(unpaired_cb_list, NULL);
5318         unpaired_cb_list = NULL;
5319         queue_destroy(paired_cb_list, NULL);
5320         paired_cb_list = NULL;
5321
5322         return false;
5323 }
5324
5325 void bt_bluetooth_unregister(void)
5326 {
5327         DBG("");
5328
5329         g_slist_free_full(bonded_devices, (GDestroyNotify) free_device);
5330         bonded_devices = NULL;
5331
5332         g_slist_free_full(cached_devices, (GDestroyNotify) free_device);
5333         cached_devices = NULL;
5334
5335         ipc_unregister(hal_ipc, HAL_SERVICE_ID_CORE);
5336         hal_ipc = NULL;
5337
5338         queue_destroy(unpaired_cb_list, NULL);
5339         unpaired_cb_list = NULL;
5340
5341         queue_destroy(paired_cb_list, NULL);
5342         paired_cb_list = NULL;
5343 }