plugins/hciops.c

   1 /*
   2  *
   3  *  BlueZ - Bluetooth protocol stack for Linux
   4  *
   5  *  Copyright (C) 2004-2010  Marcel Holtmann <marcel@holtmann.org>
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 2 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, write to the Free Software
  19  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  20  *
  21  */
  22
  23 #ifdef HAVE_CONFIG_H
  24 #include <config.h>
  25 #endif
  26
  27 #include <stdio.h>
  28 #include <errno.h>
  29 #include <unistd.h>
  30 #include <stdlib.h>
  31 #include <sys/types.h>
  32 #include <sys/ioctl.h>
  33 #include <sys/wait.h>
  34
  35 #include <bluetooth/bluetooth.h>
  36 #include <bluetooth/hci.h>
  37 #include <bluetooth/hci_lib.h>
  38 #include <bluetooth/sdp.h>
  39 #include <bluetooth/sdp_lib.h>
  40
  41 #include <glib.h>
  42
  43 #include "hcid.h"
  44 #include "sdpd.h"
  45 #include "btio.h"
  46 #include "adapter.h"
  47 #include "device.h"
  48 #include "plugin.h"
  49 #include "log.h"
  50 #include "storage.h"
  51 #include "event.h"
  52 #include "manager.h"
  53 #include "oob.h"
  54 #include "eir.h"
  55
  56 #define DISCOV_HALTED 0
  57 #define DISCOV_INQ 1
  58 #define DISCOV_SCAN 2
  59 #define DISCOV_NAMES 3
  60
  61 #define TIMEOUT_BR_LE_SCAN 5120 /* TGAP(100)/2 */
  62 #define TIMEOUT_LE_SCAN 10240 /* TGAP(gen_disc_scan_min) */
  63
  64 #define LENGTH_BR_INQ 0x08
  65 #define LENGTH_BR_LE_INQ 0x04
  66
  67 static int start_scanning(int index, int timeout);
  68
  69 static int child_pipe[2] = { -1, -1 };
  70
  71 static guint child_io_id = 0;
  72 static guint ctl_io_id = 0;
  73
  74 enum adapter_type {
  75         BR_EDR,
  76         LE_ONLY,
  77         BR_EDR_LE,
  78         UNKNOWN,
  79 };
  80
  81 /* Commands sent by kernel on starting an adapter */
  82 enum {
  83         PENDING_BDADDR,
  84         PENDING_VERSION,
  85         PENDING_FEATURES,
  86         PENDING_NAME,
  87 };
  88
  89 struct bt_conn {
  90         struct dev_info *dev;
  91         bdaddr_t bdaddr;
  92         uint16_t handle;
  93         uint8_t loc_cap;
  94         uint8_t loc_auth;
  95         uint8_t rem_cap;
  96         uint8_t rem_auth;
  97         uint8_t rem_oob_data;
  98         gboolean bonding_initiator;
  99         gboolean secmode3;
 100         GIOChannel *io; /* For raw L2CAP socket (bonding) */
 101 };
 102
 103 struct oob_data {
 104         bdaddr_t bdaddr;
 105         uint8_t hash[16];
 106         uint8_t randomizer[16];
 107 };
 108
 109 enum name_state {
 110         NAME_UNKNOWN,
 111         NAME_NEEDED,
 112         NAME_NOT_NEEDED,
 113         NAME_PENDING,
 114 };
 115
 116 struct found_dev {
 117         bdaddr_t bdaddr;
 118         int8_t rssi;
 119         enum name_state name_state;
 120 };
 121
 122 static int max_dev = -1;
 123 static struct dev_info {
 124         int id;
 125         int sk;
 126         bdaddr_t bdaddr;
 127         char name[249];
 128         uint8_t eir[HCI_MAX_EIR_LENGTH];
 129         uint8_t features[8];
 130         uint8_t extfeatures[8];
 131         uint8_t ssp_mode;
 132
 133         int8_t tx_power;
 134
 135         int discov_state;
 136
 137         uint32_t current_cod;
 138         uint32_t wanted_cod;
 139         uint32_t pending_cod;
 140         gboolean cache_enable;
 141         gboolean already_up;
 142         gboolean registered;
 143         gboolean pairable;
 144
 145         uint8_t io_capability;
 146
 147         struct hci_version ver;
 148
 149         uint16_t did_source;
 150         uint16_t did_vendor;
 151         uint16_t did_product;
 152         uint16_t did_version;
 153
 154         gboolean up;
 155         uint32_t pending;
 156
 157         GIOChannel *io;
 158         guint watch_id;
 159
 160         gboolean debug_keys;
 161         GSList *keys;
 162         uint8_t pin_length;
 163
 164         GSList *oob_data;
 165
 166         GSList *uuids;
 167
 168         GSList *connections;
 169
 170         GSList *found_devs;
 171         GSList *need_name;
 172
 173         guint stop_scan_id;
 174
 175         uint16_t discoverable_timeout;
 176         guint discoverable_id;
 177 } *devs = NULL;
 178
 179 static int found_dev_rssi_cmp(gconstpointer a, gconstpointer b)
 180 {
 181         const struct found_dev *d1 = a, *d2 = b;
 182         int rssi1, rssi2;
 183
 184         if (d2->name_state == NAME_NOT_NEEDED)
 185                 return -1;
 186
 187         rssi1 = d1->rssi < 0 ? -d1->rssi : d1->rssi;
 188         rssi2 = d2->rssi < 0 ? -d2->rssi : d2->rssi;
 189
 190         return rssi1 - rssi2;
 191 }
 192
 193 static int found_dev_bda_cmp(gconstpointer a, gconstpointer b)
 194 {
 195         const struct found_dev *d1 = a, *d2 = b;
 196
 197         return bacmp(&d1->bdaddr, &d2->bdaddr);
 198 }
 199
 200 static void found_dev_cleanup(struct dev_info *info)
 201 {
 202         g_slist_free_full(info->found_devs, g_free);
 203         info->found_devs = NULL;
 204
 205         g_slist_free_full(info->need_name, g_free);
 206         info->need_name = NULL;
 207 }
 208
 209 static int resolve_name(struct dev_info *info, bdaddr_t *bdaddr)
 210 {
 211         remote_name_req_cp cp;
 212         char addr[18];
 213
 214         ba2str(bdaddr, addr);
 215         DBG("hci%d dba %s", info->id, addr);
 216
 217         memset(&cp, 0, sizeof(cp));
 218         bacpy(&cp.bdaddr, bdaddr);
 219         cp.pscan_rep_mode = 0x02;
 220
 221         if (hci_send_cmd(info->sk, OGF_LINK_CTL, OCF_REMOTE_NAME_REQ,
 222                                         REMOTE_NAME_REQ_CP_SIZE, &cp) < 0)
 223                 return -errno;
 224
 225         return 0;
 226 }
 227
 228 static int resolve_names(struct dev_info *info, struct btd_adapter *adapter)
 229 {
 230         struct found_dev *dev;
 231
 232         DBG("found_dev %u need_name %u", g_slist_length(info->found_devs),
 233                                         g_slist_length(info->need_name));
 234
 235         if (g_slist_length(info->need_name) == 0)
 236                 return -ENOENT;
 237
 238         dev = info->need_name->data;
 239         resolve_name(info, &dev->bdaddr);
 240         dev->name_state = NAME_PENDING;
 241
 242         return 0;
 243 }
 244
 245 static void set_state(int index, int state)
 246 {
 247         struct btd_adapter *adapter;
 248         struct dev_info *dev = &devs[index];
 249
 250         if (dev->discov_state == state)
 251                 return;
 252
 253         adapter = manager_find_adapter_by_id(index);
 254         if (!adapter) {
 255                 error("No matching adapter found");
 256                 return;
 257         }
 258
 259         dev->discov_state = state;
 260
 261         DBG("hci%d: new state %d", index, dev->discov_state);
 262
 263         switch (dev->discov_state) {
 264         case DISCOV_HALTED:
 265                 found_dev_cleanup(dev);
 266                 adapter_set_discovering(adapter, FALSE);
 267                 break;
 268         case DISCOV_INQ:
 269         case DISCOV_SCAN:
 270                 adapter_set_discovering(adapter, TRUE);
 271                 break;
 272         case DISCOV_NAMES:
 273                 if (resolve_names(dev, adapter) < 0)
 274                         set_state(index, DISCOV_HALTED);
 275                 break;
 276         }
 277 }
 278
 279 static inline gboolean is_le_capable(int index)
 280 {
 281         struct dev_info *dev = &devs[index];
 282
 283         return (dev->features[4] & LMP_LE &&
 284                         dev->extfeatures[0] & LMP_HOST_LE) ? TRUE : FALSE;
 285 }
 286
 287 static inline gboolean is_bredr_capable(int index)
 288 {
 289         struct dev_info *dev = &devs[index];
 290
 291         return (dev->features[4] & LMP_NO_BREDR) == 0 ? TRUE : FALSE;
 292 }
 293
 294 static int get_adapter_type(int index)
 295 {
 296         if (is_le_capable(index) && is_bredr_capable(index))
 297                 return BR_EDR_LE;
 298         else if (is_le_capable(index))
 299                 return LE_ONLY;
 300         else if (is_bredr_capable(index))
 301                 return BR_EDR;
 302
 303         return UNKNOWN;
 304 }
 305
 306 static int ignore_device(struct hci_dev_info *di)
 307 {
 308         return hci_test_bit(HCI_RAW, &di->flags) || di->type >> 4 != HCI_BREDR;
 309 }
 310
 311 static struct dev_info *init_dev_info(int index, int sk, gboolean registered,
 312                                                         gboolean already_up)
 313 {
 314         struct dev_info *dev = &devs[index];
 315
 316         memset(dev, 0, sizeof(*dev));
 317
 318         dev->id = index;
 319         dev->sk = sk;
 320         dev->cache_enable = TRUE;
 321         dev->registered = registered;
 322         dev->already_up = already_up;
 323         dev->io_capability = 0x03; /* No Input No Output */
 324         dev->discov_state = DISCOV_HALTED;
 325
 326         return dev;
 327 }
 328
 329 /* Async HCI command handling with callback support */
 330
 331 struct hci_cmd_data {
 332         bt_hci_result_t         cb;
 333         uint16_t                handle;
 334         uint16_t                ocf;
 335         gpointer                caller_data;
 336 };
 337
 338 static gboolean hci_event_watch(GIOChannel *io,
 339                         GIOCondition cond, gpointer user_data)
 340 {
 341         unsigned char buf[HCI_MAX_EVENT_SIZE], *body;
 342         struct hci_cmd_data *cmd = user_data;
 343         evt_cmd_status *evt_status;
 344         evt_auth_complete *evt_auth;
 345         evt_encrypt_change *evt_enc;
 346         hci_event_hdr *hdr;
 347         set_conn_encrypt_cp cp;
 348         int dd;
 349         uint16_t ocf;
 350         uint8_t status = HCI_OE_POWER_OFF;
 351
 352         if (cond & G_IO_NVAL) {
 353                 cmd->cb(status, cmd->caller_data);
 354                 return FALSE;
 355         }
 356
 357         if (cond & (G_IO_ERR | G_IO_HUP))
 358                 goto failed;
 359
 360         dd = g_io_channel_unix_get_fd(io);
 361
 362         if (read(dd, buf, sizeof(buf)) < 0)
 363                 goto failed;
 364
 365         hdr = (hci_event_hdr *) (buf + 1);
 366         body = buf + (1 + HCI_EVENT_HDR_SIZE);
 367
 368         switch (hdr->evt) {
 369         case EVT_CMD_STATUS:
 370                 evt_status = (evt_cmd_status *) body;
 371                 ocf = cmd_opcode_ocf(evt_status->opcode);
 372                 if (ocf != cmd->ocf)
 373                         return TRUE;
 374                 switch (ocf) {
 375                 case OCF_AUTH_REQUESTED:
 376                 case OCF_SET_CONN_ENCRYPT:
 377                         if (evt_status->status != 0) {
 378                                 /* Baseband rejected command */
 379                                 status = evt_status->status;
 380                                 goto failed;
 381                         }
 382                         break;
 383                 default:
 384                         return TRUE;
 385                 }
 386                 /* Wait for the next event */
 387                 return TRUE;
 388         case EVT_AUTH_COMPLETE:
 389                 evt_auth = (evt_auth_complete *) body;
 390                 if (evt_auth->handle != cmd->handle) {
 391                         /* Skipping */
 392                         return TRUE;
 393                 }
 394
 395                 if (evt_auth->status != 0x00) {
 396                         status = evt_auth->status;
 397                         /* Abort encryption */
 398                         goto failed;
 399                 }
 400
 401                 memset(&cp, 0, sizeof(cp));
 402                 cp.handle  = cmd->handle;
 403                 cp.encrypt = 1;
 404
 405                 cmd->ocf = OCF_SET_CONN_ENCRYPT;
 406
 407                 if (hci_send_cmd(dd, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT,
 408                                         SET_CONN_ENCRYPT_CP_SIZE, &cp) < 0) {
 409                         status = HCI_COMMAND_DISALLOWED;
 410                         goto failed;
 411                 }
 412                 /* Wait for encrypt change event */
 413                 return TRUE;
 414         case EVT_ENCRYPT_CHANGE:
 415                 evt_enc = (evt_encrypt_change *) body;
 416                 if (evt_enc->handle != cmd->handle)
 417                         return TRUE;
 418
 419                 /* Procedure finished: reporting status */
 420                 status = evt_enc->status;
 421                 break;
 422         default:
 423                 /* Skipping */
 424                 return TRUE;
 425         }
 426
 427 failed:
 428         cmd->cb(status, cmd->caller_data);
 429         g_io_channel_shutdown(io, TRUE, NULL);
 430
 431         return FALSE;
 432 }
 433
 434 static int write_inq_mode(int index, uint8_t mode)
 435 {
 436         struct dev_info *dev = &devs[index];
 437         write_inquiry_mode_cp cp;
 438
 439         memset(&cp, 0, sizeof(cp));
 440         cp.mode = mode;
 441
 442         if (hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_WRITE_INQUIRY_MODE,
 443                                         WRITE_INQUIRY_MODE_CP_SIZE, &cp) < 0)
 444                 return -errno;
 445
 446         return 0;
 447 }
 448
 449 static uint8_t get_inquiry_mode(int index)
 450 {
 451         struct dev_info *dev = &devs[index];
 452
 453         if (dev->features[6] & LMP_EXT_INQ)
 454                 return 2;
 455
 456         if (dev->features[3] & LMP_RSSI_INQ)
 457                 return 1;
 458
 459         if (dev->ver.manufacturer == 11 && dev->ver.hci_rev == 0x00 &&
 460                                         dev->ver.lmp_subver == 0x0757)
 461                 return 1;
 462
 463         if (dev->ver.manufacturer == 15) {
 464                 if (dev->ver.hci_rev == 0x03 &&
 465                                         dev->ver.lmp_subver == 0x6963)
 466                         return 1;
 467                 if (dev->ver.hci_rev == 0x09 &&
 468                                         dev->ver.lmp_subver == 0x6963)
 469                         return 1;
 470                 if (dev->ver.hci_rev == 0x00 &&
 471                                         dev->ver.lmp_subver == 0x6965)
 472                         return 1;
 473         }
 474
 475         if (dev->ver.manufacturer == 31 && dev->ver.hci_rev == 0x2005 &&
 476                                         dev->ver.lmp_subver == 0x1805)
 477                 return 1;
 478
 479         return 0;
 480 }
 481
 482 static int init_ssp_mode(int index)
 483 {
 484         struct dev_info *dev = &devs[index];
 485         write_simple_pairing_mode_cp cp;
 486
 487         if (ioctl(dev->sk, HCIGETAUTHINFO, NULL) < 0 && errno == EINVAL)
 488                 return 0;
 489
 490         memset(&cp, 0, sizeof(cp));
 491         cp.mode = 0x01;
 492
 493         if (hci_send_cmd(dev->sk, OGF_HOST_CTL,
 494                                 OCF_WRITE_SIMPLE_PAIRING_MODE,
 495                                 WRITE_SIMPLE_PAIRING_MODE_CP_SIZE, &cp) < 0)
 496                 return -errno;
 497
 498         return 0;
 499 }
 500
 501 static int hciops_set_discoverable(int index, gboolean discoverable,
 502                                                         uint16_t timeout)
 503 {
 504         struct dev_info *dev = &devs[index];
 505         uint8_t mode;
 506
 507         if (discoverable)
 508                 mode = (SCAN_PAGE | SCAN_INQUIRY);
 509         else
 510                 mode = SCAN_PAGE;
 511
 512         DBG("hci%d discoverable %d", index, discoverable);
 513
 514         if (hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE,
 515                                                                 1, &mode) < 0)
 516                 return -errno;
 517
 518         dev->discoverable_timeout = timeout;
 519
 520         return 0;
 521 }
 522
 523 static int hciops_set_pairable(int index, gboolean pairable)
 524 {
 525         struct btd_adapter *adapter;
 526
 527         DBG("hci%d pairable %d", index, pairable);
 528
 529         adapter = manager_find_adapter(&devs[index].bdaddr);
 530         if (adapter)
 531                 btd_adapter_pairable_changed(adapter, pairable);
 532
 533         devs[index].pairable = pairable;
 534
 535         return 0;
 536 }
 537
 538 static int hciops_power_off(int index)
 539 {
 540         struct dev_info *dev = &devs[index];
 541
 542         DBG("hci%d", index);
 543
 544         if (ioctl(dev->sk, HCIDEVDOWN, index) < 0 && errno != EALREADY)
 545                 return -errno;
 546
 547         return 0;
 548 }
 549
 550 static void set_event_mask(int index)
 551 {
 552         struct dev_info *dev = &devs[index];
 553         /* The second byte is 0xff instead of 0x9f (two reserved bits
 554          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 555          * command otherwise */
 556         uint8_t events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 557
 558         /* Events for 1.2 and newer controllers */
 559         if (dev->ver.lmp_ver > 1) {
 560                 events[4] |= 0x01; /* Flow Specification Complete */
 561                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 562                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
 563                 events[5] |= 0x08; /* Synchronous Connection Complete */
 564                 events[5] |= 0x10; /* Synchronous Connection Changed */
 565         }
 566
 567         if (dev->features[3] & LMP_RSSI_INQ)
 568                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 569
 570         if (dev->features[5] & LMP_SNIFF_SUBR)
 571                 events[5] |= 0x20; /* Sniff Subrating */
 572
 573         if (dev->features[5] & LMP_PAUSE_ENC)
 574                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 575
 576         if (dev->features[6] & LMP_EXT_INQ)
 577                 events[5] |= 0x40; /* Extended Inquiry Result */
 578
 579         if (dev->features[6] & LMP_NFLUSH_PKTS)
 580                 events[7] |= 0x01; /* Enhanced Flush Complete */
 581
 582         if (dev->features[7] & LMP_LSTO)
 583                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 584
 585         if (dev->features[6] & LMP_SIMPLE_PAIR) {
 586                 events[6] |= 0x01;      /* IO Capability Request */
 587                 events[6] |= 0x02;      /* IO Capability Response */
 588                 events[6] |= 0x04;      /* User Confirmation Request */
 589                 events[6] |= 0x08;      /* User Passkey Request */
 590                 events[6] |= 0x10;      /* Remote OOB Data Request */
 591                 events[6] |= 0x20;      /* Simple Pairing Complete */
 592                 events[7] |= 0x04;      /* User Passkey Notification */
 593                 events[7] |= 0x08;      /* Keypress Notification */
 594                 events[7] |= 0x10;      /* Remote Host Supported
 595                                          * Features Notification */
 596         }
 597
 598         if (dev->features[4] & LMP_LE)
 599                 events[7] |= 0x20;      /* LE Meta-Event */
 600
 601         hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_SET_EVENT_MASK,
 602                                                 sizeof(events), events);
 603 }
 604
 605 static void start_adapter(int index)
 606 {
 607         struct dev_info *dev = &devs[index];
 608         uint8_t inqmode;
 609         uint16_t link_policy;
 610
 611         set_event_mask(index);
 612
 613         if (dev->features[6] & LMP_SIMPLE_PAIR)
 614                 init_ssp_mode(index);
 615
 616         inqmode = get_inquiry_mode(index);
 617         if (inqmode)
 618                 write_inq_mode(index, inqmode);
 619
 620         if (dev->features[7] & LMP_INQ_TX_PWR)
 621                 hci_send_cmd(dev->sk, OGF_HOST_CTL,
 622                                 OCF_READ_INQ_RESPONSE_TX_POWER_LEVEL, 0, NULL);
 623
 624         /* Set default link policy */
 625         link_policy = main_opts.link_policy;
 626
 627         if (!(dev->features[0] & LMP_RSWITCH))
 628                 link_policy &= ~HCI_LP_RSWITCH;
 629         if (!(dev->features[0] & LMP_HOLD))
 630                 link_policy &= ~HCI_LP_HOLD;
 631         if (!(dev->features[0] & LMP_SNIFF))
 632                 link_policy &= ~HCI_LP_SNIFF;
 633         if (!(dev->features[1] & LMP_PARK))
 634                 link_policy &= ~HCI_LP_PARK;
 635
 636         link_policy = htobs(link_policy);
 637         hci_send_cmd(dev->sk, OGF_LINK_POLICY, OCF_WRITE_DEFAULT_LINK_POLICY,
 638                                         sizeof(link_policy), &link_policy);
 639
 640         dev->current_cod = 0;
 641         memset(dev->eir, 0, sizeof(dev->eir));
 642 }
 643
 644 static int hciops_stop_inquiry(int index)
 645 {
 646         struct dev_info *dev = &devs[index];
 647
 648         DBG("hci%d", index);
 649
 650         if (hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_INQUIRY_CANCEL, 0, 0) < 0)
 651                 return -errno;
 652
 653         return 0;
 654 }
 655
 656 static void update_ext_inquiry_response(int index)
 657 {
 658         struct dev_info *dev = &devs[index];
 659         write_ext_inquiry_response_cp cp;
 660
 661         DBG("hci%d", index);
 662
 663         if (!(dev->features[6] & LMP_EXT_INQ))
 664                 return;
 665
 666         if (dev->ssp_mode == 0)
 667                 return;
 668
 669         if (dev->cache_enable)
 670                 return;
 671
 672         memset(&cp, 0, sizeof(cp));
 673
 674         eir_create(dev->name, dev->tx_power, dev->did_vendor, dev->did_product,
 675                         dev->did_version, dev->did_source, dev->uuids,
 676                         cp.data);
 677
 678         if (memcmp(cp.data, dev->eir, sizeof(cp.data)) == 0)
 679                 return;
 680
 681         memcpy(dev->eir, cp.data, sizeof(cp.data));
 682
 683         if (hci_send_cmd(dev->sk, OGF_HOST_CTL,
 684                                 OCF_WRITE_EXT_INQUIRY_RESPONSE,
 685                                 WRITE_EXT_INQUIRY_RESPONSE_CP_SIZE, &cp) < 0)
 686                 error("Unable to write EIR data: %s (%d)",
 687                                                 strerror(errno), errno);
 688 }
 689
 690 static int hciops_set_name(int index, const char *name)
 691 {
 692         struct dev_info *dev = &devs[index];
 693         change_local_name_cp cp;
 694
 695         DBG("hci%d, name %s", index, name);
 696
 697         memset(&cp, 0, sizeof(cp));
 698         strncpy((char *) cp.name, name, sizeof(cp.name));
 699
 700         if (hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_CHANGE_LOCAL_NAME,
 701                                 CHANGE_LOCAL_NAME_CP_SIZE, &cp) < 0)
 702                 return -errno;
 703
 704         memcpy(dev->name, cp.name, 248);
 705         update_ext_inquiry_response(index);
 706
 707         return 0;
 708 }
 709
 710 static int write_class(int index, uint32_t class)
 711 {
 712         struct dev_info *dev = &devs[index];
 713         write_class_of_dev_cp cp;
 714
 715         DBG("hci%d class 0x%06x", index, class);
 716
 717         memcpy(cp.dev_class, &class, 3);
 718
 719         if (hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_WRITE_CLASS_OF_DEV,
 720                                         WRITE_CLASS_OF_DEV_CP_SIZE, &cp) < 0)
 721                 return -errno;
 722
 723         dev->pending_cod = class;
 724
 725         return 0;
 726 }
 727
 728 static int hciops_set_dev_class(int index, uint8_t major, uint8_t minor)
 729 {
 730         struct dev_info *dev = &devs[index];
 731         int err;
 732
 733         DBG("hci%d major %u minor %u", index, major, minor);
 734
 735         /* Update only the major and minor class bits keeping remaining bits
 736          * intact*/
 737         dev->wanted_cod &= 0xffe000;
 738         dev->wanted_cod |= ((major & 0x1f) << 8) | minor;
 739
 740         if (dev->wanted_cod == dev->current_cod ||
 741                         dev->cache_enable || dev->pending_cod)
 742                 return 0;
 743
 744         DBG("Changing Major/Minor class to 0x%06x", dev->wanted_cod);
 745
 746         err = write_class(index, dev->wanted_cod);
 747         if (err < 0)
 748                 error("Adapter class update failed: %s (%d)",
 749                                                 strerror(-err), -err);
 750
 751         return err;
 752 }
 753
 754 static gboolean init_adapter(int index)
 755 {
 756         struct dev_info *dev = &devs[index];
 757         struct btd_adapter *adapter = NULL;
 758         gboolean existing_adapter = dev->registered;
 759         uint8_t mode, on_mode, major, minor;
 760         gboolean pairable, discoverable;
 761         const char *name;
 762         uint16_t discoverable_timeout;
 763
 764         if (!dev->registered) {
 765                 adapter = btd_manager_register_adapter(index, TRUE);
 766                 if (adapter)
 767                         dev->registered = TRUE;
 768         } else {
 769                 adapter = manager_find_adapter(&dev->bdaddr);
 770                 /* FIXME: manager_find_adapter should return a new ref */
 771                 btd_adapter_ref(adapter);
 772         }
 773
 774         if (adapter == NULL)
 775                 return FALSE;
 776
 777         btd_adapter_get_mode(adapter, &mode, &on_mode,
 778                                                 &discoverable_timeout,
 779                                                 &pairable);
 780
 781         if (existing_adapter)
 782                 mode = on_mode;
 783
 784         if (mode == MODE_OFF) {
 785                 hciops_power_off(index);
 786                 goto done;
 787         }
 788
 789         start_adapter(index);
 790
 791         name = btd_adapter_get_name(adapter);
 792         if (name)
 793                 hciops_set_name(index, name);
 794
 795         btd_adapter_get_class(adapter, &major, &minor);
 796         hciops_set_dev_class(index, major, minor);
 797
 798         btd_adapter_start(adapter);
 799
 800         discoverable = (mode == MODE_DISCOVERABLE);
 801
 802         hciops_set_discoverable(index, discoverable, discoverable_timeout);
 803         hciops_set_pairable(index, pairable);
 804
 805         if (dev->already_up)
 806                 hciops_stop_inquiry(index);
 807
 808 done:
 809         btd_adapter_unref(adapter);
 810         return TRUE;
 811 }
 812
 813 static int hciops_encrypt_link(int index, bdaddr_t *dst, bt_hci_result_t cb,
 814                                                         gpointer user_data)
 815 {
 816         GIOChannel *io;
 817         struct hci_cmd_data *cmd;
 818         struct hci_conn_info_req *cr;
 819         auth_requested_cp cp;
 820         struct hci_filter nf;
 821         int dd, err;
 822         uint32_t link_mode;
 823         uint16_t handle;
 824
 825         dd = hci_open_dev(index);
 826         if (dd < 0)
 827                 return -errno;
 828
 829         cr = g_malloc0(sizeof(*cr) + sizeof(struct hci_conn_info));
 830         cr->type = ACL_LINK;
 831         bacpy(&cr->bdaddr, dst);
 832
 833         err = ioctl(dd, HCIGETCONNINFO, cr);
 834         link_mode = cr->conn_info->link_mode;
 835         handle = cr->conn_info->handle;
 836         g_free(cr);
 837
 838         if (err < 0) {
 839                 err = -errno;
 840                 goto fail;
 841         }
 842
 843         if (link_mode & HCI_LM_ENCRYPT) {
 844                 err = -EALREADY;
 845                 goto fail;
 846         }
 847
 848         memset(&cp, 0, sizeof(cp));
 849         cp.handle = htobs(handle);
 850
 851         if (hci_send_cmd(dd, OGF_LINK_CTL, OCF_AUTH_REQUESTED,
 852                                 AUTH_REQUESTED_CP_SIZE, &cp) < 0) {
 853                 err = -errno;
 854                 goto fail;
 855         }
 856
 857         cmd = g_new0(struct hci_cmd_data, 1);
 858         cmd->handle = handle;
 859         cmd->ocf = OCF_AUTH_REQUESTED;
 860         cmd->cb = cb;
 861         cmd->caller_data = user_data;
 862
 863         hci_filter_clear(&nf);
 864         hci_filter_set_ptype(HCI_EVENT_PKT, &nf);
 865         hci_filter_set_event(EVT_CMD_STATUS, &nf);
 866         hci_filter_set_event(EVT_AUTH_COMPLETE, &nf);
 867         hci_filter_set_event(EVT_ENCRYPT_CHANGE, &nf);
 868
 869         if (setsockopt(dd, SOL_HCI, HCI_FILTER, &nf, sizeof(nf)) < 0) {
 870                 err = -errno;
 871                 g_free(cmd);
 872                 goto fail;
 873         }
 874
 875         io = g_io_channel_unix_new(dd);
 876         g_io_channel_set_close_on_unref(io, FALSE);
 877         g_io_add_watch_full(io, G_PRIORITY_DEFAULT,
 878                         G_IO_HUP | G_IO_ERR | G_IO_NVAL | G_IO_IN,
 879                         hci_event_watch, cmd, g_free);
 880         g_io_channel_unref(io);
 881
 882         return 0;
 883
 884 fail:
 885         close(dd);
 886         return err;
 887 }
 888
 889 static int hciops_set_did(int index, uint16_t vendor, uint16_t product,
 890                                         uint16_t version, uint16_t source)
 891 {
 892         struct dev_info *dev = &devs[index];
 893
 894         dev->did_vendor = vendor;
 895         dev->did_product = product;
 896         dev->did_version = version;
 897         dev->did_source = source;
 898
 899         return 0;
 900 }
 901
 902 /* End async HCI command handling */
 903
 904 /* Start of HCI event callbacks */
 905
 906 static gint conn_handle_cmp(gconstpointer a, gconstpointer b)
 907 {
 908         const struct bt_conn *conn = a;
 909         uint16_t handle = *((const uint16_t *) b);
 910
 911         return (int) conn->handle - (int) handle;
 912 }
 913
 914 static struct bt_conn *find_conn_by_handle(struct dev_info *dev,
 915                                                         uint16_t handle)
 916 {
 917         GSList *match;
 918
 919         match = g_slist_find_custom(dev->connections, &handle,
 920                                                         conn_handle_cmp);
 921         if (match)
 922                 return match->data;
 923
 924         return NULL;
 925 }
 926
 927 static gint conn_bdaddr_cmp(gconstpointer a, gconstpointer b)
 928 {
 929         const struct bt_conn *conn = a;
 930         const bdaddr_t *bdaddr = b;
 931
 932         return bacmp(&conn->bdaddr, bdaddr);
 933 }
 934
 935 static struct bt_conn *find_connection(struct dev_info *dev, bdaddr_t *bdaddr)
 936 {
 937         GSList *match;
 938
 939         match = g_slist_find_custom(dev->connections, bdaddr, conn_bdaddr_cmp);
 940         if (match)
 941                 return match->data;
 942
 943         return NULL;
 944 }
 945
 946 static struct bt_conn *get_connection(struct dev_info *dev, bdaddr_t *bdaddr)
 947 {
 948         struct bt_conn *conn;
 949
 950         conn = find_connection(dev, bdaddr);
 951         if (conn)
 952                 return conn;
 953
 954         conn = g_new0(struct bt_conn, 1);
 955
 956         conn->dev = dev;
 957         conn->loc_cap = dev->io_capability;
 958         conn->loc_auth = 0xff;
 959         conn->rem_auth = 0xff;
 960         bacpy(&conn->bdaddr, bdaddr);
 961
 962         dev->connections = g_slist_append(dev->connections, conn);
 963
 964         return conn;
 965 }
 966
 967 static int get_handle(int index, bdaddr_t *bdaddr, uint16_t *handle)
 968 {
 969         struct dev_info *dev = &devs[index];
 970         struct bt_conn *conn;
 971         char addr[18];
 972
 973         ba2str(bdaddr, addr);
 974         DBG("hci%d dba %s", index, addr);
 975
 976         conn = find_connection(dev, bdaddr);
 977         if (conn == NULL)
 978                 return -ENOENT;
 979
 980         *handle = conn->handle;
 981
 982         return 0;
 983 }
 984
 985 static int disconnect_addr(int index, bdaddr_t *dba, uint8_t reason)
 986 {
 987         disconnect_cp cp;
 988         uint16_t handle;
 989         int err;
 990
 991         err = get_handle(index, dba, &handle);
 992         if (err < 0)
 993                 return err;
 994
 995         memset(&cp, 0, sizeof(cp));
 996         cp.handle = htobs(handle);
 997         cp.reason = reason;
 998
 999         if (hci_send_cmd(devs[index].sk, OGF_LINK_CTL, OCF_DISCONNECT,
1000                                                 DISCONNECT_CP_SIZE, &cp) < 0)
1001                 return -errno;
1002
1003         return 0;
1004 }
1005
1006 static void bonding_complete(struct dev_info *dev, struct bt_conn *conn,
1007                                                                 uint8_t status)
1008 {
1009         struct btd_adapter *adapter;
1010
1011         DBG("status 0x%02x", status);
1012
1013         if (conn->io != NULL) {
1014                 /* bonding_connect_cb takes care of the successul case */
1015                 if (status != 0)
1016                         g_io_channel_shutdown(conn->io, TRUE, NULL);
1017                 g_io_channel_unref(conn->io);
1018                 conn->io = NULL;
1019         }
1020
1021         conn->bonding_initiator = FALSE;
1022
1023         adapter = manager_find_adapter(&dev->bdaddr);
1024         if (adapter)
1025                 adapter_bonding_complete(adapter, &conn->bdaddr, status);
1026 }
1027
1028 static int get_auth_info(int index, bdaddr_t *bdaddr, uint8_t *auth)
1029 {
1030         struct dev_info *dev = &devs[index];
1031         struct hci_auth_info_req req;
1032         char addr[18];
1033
1034         ba2str(bdaddr, addr);
1035         DBG("hci%d dba %s", index, addr);
1036
1037         memset(&req, 0, sizeof(req));
1038         bacpy(&req.bdaddr, bdaddr);
1039
1040         if (ioctl(dev->sk, HCIGETAUTHINFO, (unsigned long) &req) < 0)
1041                 return -errno;
1042
1043         if (auth)
1044                 *auth = req.type;
1045
1046         return 0;
1047 }
1048
1049 /* Link Key handling */
1050
1051 static void link_key_request(int index, bdaddr_t *dba)
1052 {
1053         struct dev_info *dev = &devs[index];
1054         struct link_key_info *key_info;
1055         struct bt_conn *conn;
1056         GSList *match;
1057         char da[18];
1058
1059         ba2str(dba, da);
1060         DBG("hci%d dba %s", index, da);
1061
1062         conn = get_connection(dev, dba);
1063         if (conn->handle == 0)
1064                 conn->secmode3 = TRUE;
1065
1066         get_auth_info(index, dba, &conn->loc_auth);
1067
1068         DBG("kernel auth requirements = 0x%02x", conn->loc_auth);
1069
1070         match = g_slist_find_custom(dev->keys, dba, (GCompareFunc) bacmp);
1071         if (match)
1072                 key_info = match->data;
1073         else
1074                 key_info = NULL;
1075
1076         DBG("Matching key %s", key_info ? "found" : "not found");
1077
1078         if (key_info == NULL || (!dev->debug_keys && key_info->type == 0x03)) {
1079                 /* Link key not found */
1080                 hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_LINK_KEY_NEG_REPLY,
1081                                                                 6, dba);
1082                 return;
1083         }
1084
1085         /* Link key found */
1086
1087         DBG("link key type 0x%02x", key_info->type);
1088
1089         /* Don't use unauthenticated combination keys if MITM is
1090          * required */
1091         if (key_info->type == 0x04 && conn->loc_auth != 0xff &&
1092                                                 (conn->loc_auth & 0x01))
1093                 hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_LINK_KEY_NEG_REPLY,
1094                                                                 6, dba);
1095         else {
1096                 link_key_reply_cp lr;
1097
1098                 memcpy(lr.link_key, key_info->key, 16);
1099                 bacpy(&lr.bdaddr, dba);
1100
1101                 hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_LINK_KEY_REPLY,
1102                                                 LINK_KEY_REPLY_CP_SIZE, &lr);
1103         }
1104 }
1105
1106 static void link_key_notify(int index, void *ptr)
1107 {
1108         struct dev_info *dev = &devs[index];
1109         evt_link_key_notify *evt = ptr;
1110         bdaddr_t *dba = &evt->bdaddr;
1111         struct link_key_info *key_info;
1112         uint8_t old_key_type, key_type;
1113         struct bt_conn *conn;
1114         GSList *match;
1115         char da[18];
1116         uint8_t status = 0;
1117
1118         ba2str(dba, da);
1119         DBG("hci%d dba %s type %d", index, da, evt->key_type);
1120
1121         conn = get_connection(dev, &evt->bdaddr);
1122
1123         match = g_slist_find_custom(dev->keys, dba, (GCompareFunc) bacmp);
1124         if (match)
1125                 key_info = match->data;
1126         else
1127                 key_info = NULL;
1128
1129         if (key_info == NULL) {
1130                 key_info = g_new0(struct link_key_info, 1);
1131                 bacpy(&key_info->bdaddr, &evt->bdaddr);
1132                 old_key_type = 0xff;
1133         } else {
1134                 dev->keys = g_slist_remove(dev->keys, key_info);
1135                 old_key_type = key_info->type;
1136         }
1137
1138         memcpy(key_info->key, evt->link_key, sizeof(evt->link_key));
1139         key_info->type = evt->key_type;
1140         key_info->pin_len = dev->pin_length;
1141
1142         key_type = evt->key_type;
1143
1144         DBG("key type 0x%02x old key type 0x%02x", key_type, old_key_type);
1145         DBG("local auth 0x%02x and remote auth 0x%02x",
1146                                         conn->loc_auth, conn->rem_auth);
1147
1148         if (key_type == HCI_LK_CHANGED_COMBINATION) {
1149                 /* Some buggy controller combinations generate a changed
1150                  * combination key for legacy pairing even when there's no
1151                  * previous key */
1152                 if (conn->rem_auth == 0xff && old_key_type == 0xff)
1153                         key_type = HCI_LK_COMBINATION;
1154                 else if (old_key_type != 0xff)
1155                         key_type = old_key_type;
1156                 else
1157                         /* This is Changed Combination Link Key for
1158                          * a temporary link key.*/
1159                         goto done;
1160         }
1161
1162         key_info->type = key_type;
1163
1164         /* Skip the storage check if this is a debug key */
1165         if (key_type == HCI_LK_DEBUG_COMBINATION)
1166                 goto done;
1167
1168         /* Store the link key persistently if one of the following is true:
1169          * 1. this is a legacy link key
1170          * 2. this is a changed combination key and there was a previously
1171          *    stored one
1172          * 3. neither local nor remote side had no-bonding as a requirement
1173          * 4. the local side had dedicated bonding as a requirement
1174          * 5. the remote side is using dedicated bonding since in that case
1175          *    also the local requirements are set to dedicated bonding
1176          * If none of the above match only keep the link key around for
1177          * this connection and set the temporary flag for the device.
1178          */
1179         if (key_type < HCI_LK_DEBUG_COMBINATION ||
1180                         (key_type == HCI_LK_CHANGED_COMBINATION
1181                                         && old_key_type != HCI_LK_INVALID) ||
1182                         (conn->loc_auth > 0x01 && conn->rem_auth > 0x01) ||
1183                         (conn->loc_auth == 0x02 || conn->loc_auth == 0x03) ||
1184                         (conn->rem_auth == 0x02 || conn->rem_auth == 0x03)) {
1185                 int err;
1186
1187                 err = btd_event_link_key_notify(&dev->bdaddr, dba,
1188                                                 evt->link_key, key_type,
1189                                                 dev->pin_length);
1190
1191                 if (err == -ENODEV)
1192                         status = HCI_OE_LOW_RESOURCES;
1193                 else if (err < 0)
1194                         status = HCI_MEMORY_FULL;
1195
1196                 goto done;
1197         }
1198
1199 done:
1200         dev->pin_length = 0;
1201
1202         if (status != 0) {
1203                 g_free(key_info);
1204                 bonding_complete(dev, conn, status);
1205                 disconnect_addr(index, dba, status);
1206                 return;
1207         }
1208
1209         dev->keys = g_slist_prepend(dev->keys, key_info);
1210
1211         /* If we're connected and not dedicated bonding initiators we're
1212          * done with the bonding process */
1213         if (!conn->bonding_initiator && conn->handle != 0)
1214                 bonding_complete(dev, conn, 0);
1215 }
1216
1217 static void return_link_keys(int index, void *ptr)
1218 {
1219         struct dev_info *dev = &devs[index];
1220         evt_return_link_keys *evt = ptr;
1221         uint8_t num = evt->num_keys;
1222         unsigned char key[16];
1223         char da[18];
1224         bdaddr_t dba;
1225         int i;
1226
1227         DBG("hci%d num_keys %u", index, num);
1228
1229         ptr++;
1230
1231         for (i = 0; i < num; i++) {
1232                 bacpy(&dba, ptr); ba2str(&dba, da);
1233                 memcpy(key, ptr + 6, 16);
1234
1235                 DBG("hci%d returned key for %s", index, da);
1236
1237                 btd_event_returned_link_key(&dev->bdaddr, &dba);
1238
1239                 ptr += 22;
1240         }
1241 }
1242
1243 /* Simple Pairing handling */
1244
1245 static int hciops_confirm_reply(int index, bdaddr_t *bdaddr, uint8_t bdaddr_type,
1246                                                         gboolean success)
1247 {
1248         struct dev_info *dev = &devs[index];
1249         user_confirm_reply_cp cp;
1250         char addr[18];
1251         int err;
1252
1253         ba2str(bdaddr, addr);
1254         DBG("hci%d dba %s success %d", index, addr, success);
1255
1256         memset(&cp, 0, sizeof(cp));
1257         bacpy(&cp.bdaddr, bdaddr);
1258
1259         if (success)
1260                 err = hci_send_cmd(dev->sk, OGF_LINK_CTL,
1261                                         OCF_USER_CONFIRM_REPLY,
1262                                         USER_CONFIRM_REPLY_CP_SIZE, &cp);
1263         else
1264                 err = hci_send_cmd(dev->sk, OGF_LINK_CTL,
1265                                         OCF_USER_CONFIRM_NEG_REPLY,
1266                                         USER_CONFIRM_REPLY_CP_SIZE, &cp);
1267
1268         if (err < 0)
1269                 err = -errno;
1270
1271         return err;
1272 }
1273
1274 static void user_confirm_request(int index, void *ptr)
1275 {
1276         struct dev_info *dev = &devs[index];
1277         evt_user_confirm_request *req = ptr;
1278         gboolean loc_mitm, rem_mitm;
1279         struct bt_conn *conn;
1280
1281         DBG("hci%d", index);
1282
1283         conn = find_connection(dev, &req->bdaddr);
1284         if (conn == NULL)
1285                 return;
1286
1287         loc_mitm = (conn->loc_auth & 0x01) ? TRUE : FALSE;
1288         rem_mitm = (conn->rem_auth & 0x01) ? TRUE : FALSE;
1289
1290         /* If we require MITM but the remote device can't provide that
1291          * (it has NoInputNoOutput) then reject the confirmation
1292          * request. The only exception is when we're dedicated bonding
1293          * initiators since then we always have the MITM bit set. */
1294         if (!conn->bonding_initiator && loc_mitm && conn->rem_cap == 0x03) {
1295                 error("Rejecting request: remote device can't provide MITM");
1296                 goto fail;
1297         }
1298
1299         /* If no side requires MITM protection; auto-accept */
1300         if ((conn->loc_auth == 0xff || !loc_mitm || conn->rem_cap == 0x03) &&
1301                                         (!rem_mitm || conn->loc_cap == 0x03)) {
1302                 DBG("auto accept of confirmation");
1303
1304                 /* Wait 5 milliseconds before doing auto-accept */
1305                 usleep(5000);
1306
1307                 if (hciops_confirm_reply(index, &req->bdaddr,
1308                                                 BDADDR_BREDR, TRUE) < 0)
1309                         goto fail;
1310
1311                 return;
1312         }
1313
1314         if (btd_event_user_confirm(&dev->bdaddr, &req->bdaddr,
1315                                                 btohl(req->passkey)) == 0)
1316                 return;
1317
1318 fail:
1319         hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_USER_CONFIRM_NEG_REPLY,
1320                                                                 6, ptr);
1321 }
1322
1323 static void user_passkey_request(int index, void *ptr)
1324 {
1325         struct dev_info *dev = &devs[index];
1326         evt_user_passkey_request *req = ptr;
1327
1328         DBG("hci%d", index);
1329
1330         if (btd_event_user_passkey(&dev->bdaddr, &req->bdaddr) < 0)
1331                 hci_send_cmd(dev->sk, OGF_LINK_CTL,
1332                                 OCF_USER_PASSKEY_NEG_REPLY, 6, ptr);
1333 }
1334
1335 static void user_passkey_notify(int index, void *ptr)
1336 {
1337         struct dev_info *dev = &devs[index];
1338         evt_user_passkey_notify *req = ptr;
1339
1340         DBG("hci%d", index);
1341
1342         btd_event_user_notify(&dev->bdaddr, &req->bdaddr,
1343                                                 btohl(req->passkey));
1344 }
1345
1346 static gint oob_bdaddr_cmp(gconstpointer a, gconstpointer b)
1347 {
1348         const struct oob_data *data = a;
1349         const bdaddr_t *bdaddr = b;
1350
1351         return bacmp(&data->bdaddr, bdaddr);
1352 }
1353
1354 static void remote_oob_data_request(int index, bdaddr_t *bdaddr)
1355 {
1356         struct dev_info *dev = &devs[index];
1357         GSList *match;
1358
1359         DBG("hci%d", index);
1360
1361         match = g_slist_find_custom(dev->oob_data, bdaddr, oob_bdaddr_cmp);
1362
1363         if (match) {
1364                 struct oob_data *data;
1365                 remote_oob_data_reply_cp cp;
1366
1367                 data = match->data;
1368
1369                 bacpy(&cp.bdaddr, &data->bdaddr);
1370                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
1371                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
1372
1373                 dev->oob_data = g_slist_delete_link(dev->oob_data, match);
1374
1375                 hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_REMOTE_OOB_DATA_REPLY,
1376                                 REMOTE_OOB_DATA_REPLY_CP_SIZE, &cp);
1377
1378         } else {
1379                 hci_send_cmd(dev->sk, OGF_LINK_CTL,
1380                                 OCF_REMOTE_OOB_DATA_NEG_REPLY, 6, bdaddr);
1381         }
1382 }
1383
1384 static int get_io_cap(int index, bdaddr_t *bdaddr, uint8_t *cap, uint8_t *auth)
1385 {
1386         struct dev_info *dev = &devs[index];
1387         struct bt_conn *conn;
1388         int err;
1389
1390         conn = find_connection(dev, bdaddr);
1391         if (conn == NULL)
1392                 return -ENOENT;
1393
1394         err = get_auth_info(index, bdaddr, &conn->loc_auth);
1395         if (err < 0)
1396                 return err;
1397
1398         DBG("initial authentication requirement is 0x%02x", conn->loc_auth);
1399
1400         if (!dev->pairable && !conn->bonding_initiator) {
1401                 if (conn->rem_auth < 0x02) {
1402                         DBG("Allowing no bonding in non-bondable mode");
1403                         /* Kernel defaults to general bonding and so
1404                          * overwrite for this special case. Otherwise
1405                          * non-pairable test cases will fail. */
1406                         conn->loc_auth = conn->rem_auth;
1407                         goto done;
1408                 }
1409
1410                 return -EPERM;
1411         }
1412
1413         /* If the kernel doesn't know the local requirement just mirror
1414          * the remote one */
1415         if (conn->loc_auth == 0xff)
1416                 conn->loc_auth = conn->rem_auth;
1417
1418         if (conn->loc_auth == 0x00 || conn->loc_auth == 0x04) {
1419                 /* If remote requests dedicated bonding follow that lead */
1420                 if (conn->rem_auth == 0x02 || conn->rem_auth == 0x03) {
1421
1422                         /* If both remote and local IO capabilities allow MITM
1423                          * then require it, otherwise don't */
1424                         if (conn->rem_cap == 0x03 || conn->loc_cap == 0x03)
1425                                 conn->loc_auth = 0x02;
1426                         else
1427                                 conn->loc_auth = 0x03;
1428                 }
1429
1430                 /* If remote indicates no bonding then follow that. This
1431                  * is important since the kernel might give general bonding
1432                  * as default. */
1433                 if (conn->rem_auth == 0x00 || conn->rem_auth == 0x01)
1434                         conn->loc_auth = 0x00;
1435
1436                 /* If remote requires MITM then also require it, unless
1437                  * our IO capability is NoInputNoOutput (so some
1438                  * just-works security cases can be tested) */
1439                 if (conn->rem_auth != 0xff && (conn->rem_auth & 0x01) &&
1440                                                         conn->loc_cap != 0x03)
1441                         conn->loc_auth |= 0x01;
1442         }
1443
1444 done:
1445         *cap = conn->loc_cap;
1446         *auth = conn->loc_auth;
1447
1448         DBG("final authentication requirement is 0x%02x", *auth);
1449
1450         return 0;
1451 }
1452
1453 static void io_capa_request(int index, void *ptr)
1454 {
1455         struct dev_info *dev = &devs[index];
1456         bdaddr_t *dba = ptr;
1457         uint8_t cap, auth = 0xff;
1458         char da[18];
1459         int err;
1460
1461         ba2str(dba, da);
1462         DBG("hci%d IO capability request for %s", index, da);
1463
1464         err = get_io_cap(index, dba, &cap, &auth);
1465         if (err < 0) {
1466                 io_capability_neg_reply_cp cp;
1467
1468                 error("Getting IO capability failed: %s (%d)",
1469                                                 strerror(-err), -err);
1470
1471                 memset(&cp, 0, sizeof(cp));
1472                 bacpy(&cp.bdaddr, dba);
1473                 cp.reason = HCI_PAIRING_NOT_ALLOWED;
1474                 hci_send_cmd(dev->sk, OGF_LINK_CTL,
1475                                         OCF_IO_CAPABILITY_NEG_REPLY,
1476                                         IO_CAPABILITY_NEG_REPLY_CP_SIZE, &cp);
1477         } else {
1478                 io_capability_reply_cp cp;
1479                 struct bt_conn *conn;
1480                 GSList *match;
1481
1482                 memset(&cp, 0, sizeof(cp));
1483                 bacpy(&cp.bdaddr, dba);
1484                 cp.capability = cap;
1485                 cp.authentication = auth;
1486
1487                 conn = find_connection(dev, dba);
1488                 match = g_slist_find_custom(dev->oob_data, dba, oob_bdaddr_cmp);
1489
1490                 if ((conn->bonding_initiator || conn->rem_oob_data == 0x01) &&
1491                                 match)
1492                         cp.oob_data = 0x01;
1493                 else
1494                         cp.oob_data = 0x00;
1495
1496                 hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_IO_CAPABILITY_REPLY,
1497                                         IO_CAPABILITY_REPLY_CP_SIZE, &cp);
1498         }
1499 }
1500
1501 static void io_capa_response(int index, void *ptr)
1502 {
1503         struct dev_info *dev = &devs[index];
1504         evt_io_capability_response *evt = ptr;
1505         struct bt_conn *conn;
1506         char da[18];
1507
1508         ba2str(&evt->bdaddr, da);
1509         DBG("hci%d IO capability response from %s", index, da);
1510
1511         conn = find_connection(dev, &evt->bdaddr);
1512         if (conn) {
1513                 conn->rem_cap = evt->capability;
1514                 conn->rem_auth = evt->authentication;
1515                 conn->rem_oob_data = evt->oob_data;
1516         }
1517 }
1518
1519 /* PIN code handling */
1520
1521 static void pin_code_request(int index, bdaddr_t *dba)
1522 {
1523         struct dev_info *dev = &devs[index];
1524         struct bt_conn *conn;
1525         char addr[18];
1526         int err;
1527
1528         ba2str(dba, addr);
1529         DBG("hci%d PIN request for %s", index, addr);
1530
1531         conn = get_connection(dev, dba);
1532         if (conn->handle == 0)
1533                 conn->secmode3 = TRUE;
1534
1535         /* Check if the adapter is not pairable and if there isn't a bonding in
1536          * progress */
1537         if (!dev->pairable && !conn->bonding_initiator) {
1538                 DBG("Rejecting PIN request in non-pairable mode");
1539                 goto reject;
1540         }
1541
1542         err = btd_event_request_pin(&dev->bdaddr, dba, FALSE);
1543         if (err < 0) {
1544                 error("PIN code negative reply: %s", strerror(-err));
1545                 goto reject;
1546         }
1547
1548         return;
1549
1550 reject:
1551         hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_PIN_CODE_NEG_REPLY, 6, dba);
1552 }
1553
1554 static inline void remote_features_notify(int index, void *ptr)
1555 {
1556         struct dev_info *dev = &devs[index];
1557         evt_remote_host_features_notify *evt = ptr;
1558
1559         if (evt->features[0] & 0x01)
1560                 btd_event_set_legacy_pairing(&dev->bdaddr, &evt->bdaddr,
1561                                                                         FALSE);
1562         else
1563                 btd_event_set_legacy_pairing(&dev->bdaddr, &evt->bdaddr,
1564                                                                         TRUE);
1565
1566         write_features_info(&dev->bdaddr, &evt->bdaddr, NULL, evt->features);
1567 }
1568
1569 static void read_local_version_complete(int index,
1570                                 const read_local_version_rp *rp)
1571 {
1572         struct dev_info *dev = &devs[index];
1573
1574         if (rp->status)
1575                 return;
1576
1577         dev->ver.manufacturer = btohs(bt_get_unaligned(&rp->manufacturer));
1578         dev->ver.hci_ver = rp->hci_ver;
1579         dev->ver.hci_rev = btohs(bt_get_unaligned(&rp->hci_rev));
1580         dev->ver.lmp_ver = rp->lmp_ver;
1581         dev->ver.lmp_subver = btohs(bt_get_unaligned(&rp->lmp_subver));
1582
1583         if (!dev->pending)
1584                 return;
1585
1586         hci_clear_bit(PENDING_VERSION, &dev->pending);
1587
1588         DBG("Got version for hci%d", index);
1589
1590         if (!dev->pending && dev->up)
1591                 init_adapter(index);
1592 }
1593
1594 static void read_local_features_complete(int index,
1595                                 const read_local_features_rp *rp)
1596 {
1597         struct dev_info *dev = &devs[index];
1598
1599         if (rp->status)
1600                 return;
1601
1602         memcpy(dev->features, rp->features, 8);
1603
1604         if (!dev->pending)
1605                 return;
1606
1607         hci_clear_bit(PENDING_FEATURES, &dev->pending);
1608
1609         DBG("Got features for hci%d", index);
1610
1611         if (!dev->pending && dev->up)
1612                 init_adapter(index);
1613 }
1614
1615 static void update_name(int index, const char *name)
1616 {
1617         struct btd_adapter *adapter;
1618
1619         adapter = manager_find_adapter_by_id(index);
1620         if (adapter)
1621                 adapter_name_changed(adapter, name);
1622
1623         update_ext_inquiry_response(index);
1624 }
1625
1626 static void read_local_name_complete(int index, read_local_name_rp *rp)
1627 {
1628         struct dev_info *dev = &devs[index];
1629
1630         DBG("hci%d status %u", index, rp->status);
1631
1632         if (rp->status)
1633                 return;
1634
1635         memcpy(dev->name, rp->name, 248);
1636
1637         if (!dev->pending) {
1638                 update_name(index, (char *) rp->name);
1639                 return;
1640         }
1641
1642         hci_clear_bit(PENDING_NAME, &dev->pending);
1643
1644         DBG("Got name for hci%d", index);
1645
1646         if (!dev->pending && dev->up)
1647                 init_adapter(index);
1648 }
1649
1650 static void read_tx_power_complete(int index, void *ptr)
1651 {
1652         struct dev_info *dev = &devs[index];
1653
1654         read_inq_response_tx_power_level_rp *rp = ptr;
1655
1656         DBG("hci%d status %u", index, rp->status);
1657
1658         if (rp->status)
1659                 return;
1660
1661         dev->tx_power = rp->level;
1662         update_ext_inquiry_response(index);
1663 }
1664
1665 static void read_simple_pairing_mode_complete(int index, void *ptr)
1666 {
1667         struct dev_info *dev = &devs[index];
1668         read_simple_pairing_mode_rp *rp = ptr;
1669
1670         DBG("hci%d status %u", index, rp->status);
1671
1672         if (rp->status)
1673                 return;
1674
1675         dev->ssp_mode = rp->mode;
1676         update_ext_inquiry_response(index);
1677 }
1678
1679 static void read_local_ext_features_complete(int index,
1680                                 const read_local_ext_features_rp *rp)
1681 {
1682         struct dev_info *dev = &devs[index];
1683
1684         DBG("hci%d status %u", index, rp->status);
1685
1686         if (rp->status)
1687                 return;
1688
1689         /* Local Extended feature page number is 1 */
1690         if (rp->page_num != 1)
1691                 return;
1692
1693         memcpy(dev->extfeatures, rp->features, sizeof(dev->extfeatures));
1694 }
1695
1696 static void read_bd_addr_complete(int index, read_bd_addr_rp *rp)
1697 {
1698         struct dev_info *dev = &devs[index];
1699
1700         DBG("hci%d status %u", index, rp->status);
1701
1702         if (rp->status)
1703                 return;
1704
1705         bacpy(&dev->bdaddr, &rp->bdaddr);
1706
1707         if (!dev->pending)
1708                 return;
1709
1710         hci_clear_bit(PENDING_BDADDR, &dev->pending);
1711
1712         DBG("Got bdaddr for hci%d", index);
1713
1714         if (!dev->pending && dev->up)
1715                 init_adapter(index);
1716 }
1717
1718 static inline void cs_inquiry_evt(int index, uint8_t status)
1719 {
1720         if (status) {
1721                 error("Inquiry Failed with status 0x%02x", status);
1722                 return;
1723         }
1724
1725         set_state(index, DISCOV_INQ);
1726 }
1727
1728 static inline void cmd_status(int index, void *ptr)
1729 {
1730         evt_cmd_status *evt = ptr;
1731         uint16_t opcode = btohs(evt->opcode);
1732
1733         if (opcode == cmd_opcode_pack(OGF_LINK_CTL, OCF_INQUIRY))
1734                 cs_inquiry_evt(index, evt->status);
1735 }
1736
1737 static gboolean discoverable_timeout_handler(gpointer user_data)
1738 {
1739         struct dev_info *dev = user_data;
1740
1741         hciops_set_discoverable(dev->id, FALSE, 0);
1742
1743         return FALSE;
1744 }
1745
1746 /* Limited Discoverable bit mask in CoD */
1747 #define LIMITED_BIT                     0x002000
1748
1749 static int hciops_set_limited_discoverable(int index, gboolean limited)
1750 {
1751         struct dev_info *dev = &devs[index];
1752         int num = (limited ? 2 : 1);
1753         uint8_t lap[] = { 0x33, 0x8b, 0x9e, 0x00, 0x8b, 0x9e };
1754         write_current_iac_lap_cp cp;
1755
1756         DBG("hci%d limited %d", index, limited);
1757
1758         /* Check if limited bit needs to be set/reset */
1759         if (limited)
1760                 dev->wanted_cod |= LIMITED_BIT;
1761         else
1762                 dev->wanted_cod &= ~LIMITED_BIT;
1763
1764         /* If we dont need the toggling, save an unnecessary CoD write */
1765         if (dev->pending_cod || dev->wanted_cod == dev->current_cod)
1766                 return 0;
1767
1768         /*
1769          * 1: giac
1770          * 2: giac + liac
1771          */
1772         memset(&cp, 0, sizeof(cp));
1773         cp.num_current_iac = num;
1774         memcpy(&cp.lap, lap, num * 3);
1775
1776         if (hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_WRITE_CURRENT_IAC_LAP,
1777                                                 (num * 3 + 1), &cp) < 0)
1778                 return -errno;
1779
1780         return write_class(index, dev->wanted_cod);
1781 }
1782
1783 static void reset_discoverable_timeout(int index)
1784 {
1785         struct dev_info *dev = &devs[index];
1786
1787         if (dev->discoverable_id > 0) {
1788                 g_source_remove(dev->discoverable_id);
1789                 dev->discoverable_id = 0;
1790         }
1791 }
1792
1793 static void set_discoverable_timeout(int index)
1794 {
1795         struct dev_info *dev = &devs[index];
1796
1797         reset_discoverable_timeout(index);
1798
1799         if (dev->discoverable_timeout == 0) {
1800                 hciops_set_limited_discoverable(index, FALSE);
1801                 return;
1802         }
1803
1804         /* Set limited discoverable if pairable and interval between 0 to 60
1805            sec */
1806         if (dev->pairable && dev->discoverable_timeout <= 60)
1807                 hciops_set_limited_discoverable(index, TRUE);
1808         else
1809                 hciops_set_limited_discoverable(index, FALSE);
1810
1811         dev->discoverable_id = g_timeout_add_seconds(dev->discoverable_timeout,
1812                                                 discoverable_timeout_handler,
1813                                                 dev);
1814 }
1815
1816 static void read_scan_complete(int index, uint8_t status, void *ptr)
1817 {
1818         struct btd_adapter *adapter;
1819         read_scan_enable_rp *rp = ptr;
1820
1821         DBG("hci%d status %u", index, status);
1822
1823         switch (rp->enable) {
1824         case (SCAN_PAGE | SCAN_INQUIRY):
1825         case SCAN_INQUIRY:
1826                 set_discoverable_timeout(index);
1827                 break;
1828         default:
1829                 reset_discoverable_timeout(index);
1830                 hciops_set_limited_discoverable(index, FALSE);
1831         }
1832
1833         adapter = manager_find_adapter_by_id(index);
1834         if (!adapter) {
1835                 error("Unable to find matching adapter");
1836                 return;
1837         }
1838
1839         adapter_mode_changed(adapter, rp->enable);
1840 }
1841
1842 static void write_class_complete(int index, uint8_t status)
1843 {
1844         struct dev_info *dev = &devs[index];
1845         struct btd_adapter *adapter;
1846
1847         if (status)
1848                 return;
1849
1850         if (dev->pending_cod == 0)
1851                 return;
1852
1853         dev->current_cod = dev->pending_cod;
1854         dev->pending_cod = 0;
1855
1856         adapter = manager_find_adapter(&dev->bdaddr);
1857         if (adapter)
1858                 btd_adapter_class_changed(adapter, dev->current_cod);
1859
1860         update_ext_inquiry_response(index);
1861
1862         if (dev->wanted_cod == dev->current_cod)
1863                 return;
1864
1865         if (dev->wanted_cod & LIMITED_BIT &&
1866                         !(dev->current_cod & LIMITED_BIT))
1867                 hciops_set_limited_discoverable(index, TRUE);
1868         else if (!(dev->wanted_cod & LIMITED_BIT) &&
1869                                         (dev->current_cod & LIMITED_BIT))
1870                 hciops_set_limited_discoverable(index, FALSE);
1871         else
1872                 write_class(index, dev->wanted_cod);
1873 }
1874
1875 static void read_local_oob_data_complete(int index, uint8_t status,
1876                                                 read_local_oob_data_rp *rp)
1877 {
1878         struct btd_adapter *adapter = manager_find_adapter_by_id(index);
1879
1880         if (!adapter)
1881                 return;
1882
1883         if (status)
1884                 oob_read_local_data_complete(adapter, NULL, NULL);
1885         else
1886                 oob_read_local_data_complete(adapter, rp->hash, rp->randomizer);
1887 }
1888
1889 static inline void inquiry_complete_evt(int index, uint8_t status)
1890 {
1891         int adapter_type;
1892         struct btd_adapter *adapter;
1893
1894         if (status) {
1895                 error("Inquiry Failed with status 0x%02x", status);
1896                 return;
1897         }
1898
1899         adapter = manager_find_adapter_by_id(index);
1900         if (!adapter) {
1901                 error("No matching adapter found");
1902                 return;
1903         }
1904
1905         adapter_type = get_adapter_type(index);
1906
1907         if (adapter_type == BR_EDR_LE &&
1908                         start_scanning(index, TIMEOUT_BR_LE_SCAN) == 0)
1909                 return;
1910
1911         set_state(index, DISCOV_NAMES);
1912 }
1913
1914 static inline void cc_inquiry_cancel(int index, uint8_t status)
1915 {
1916         if (status) {
1917                 error("Inquiry Cancel Failed with status 0x%02x", status);
1918                 return;
1919         }
1920
1921         set_state(index, DISCOV_HALTED);
1922 }
1923
1924 static inline void cc_le_set_scan_enable(int index, uint8_t status)
1925 {
1926         struct dev_info *info = &devs[index];
1927
1928         if (status) {
1929                 error("LE Set Scan Enable Failed with status 0x%02x", status);
1930                 return;
1931         }
1932
1933         if (info->discov_state == DISCOV_SCAN)
1934                 set_state(index, DISCOV_HALTED);
1935         else
1936                 set_state(index, DISCOV_SCAN);
1937 }
1938
1939 static inline void cmd_complete(int index, void *ptr)
1940 {
1941         struct dev_info *dev = &devs[index];
1942         evt_cmd_complete *evt = ptr;
1943         uint16_t opcode = btohs(evt->opcode);
1944         uint8_t status = *((uint8_t *) ptr + EVT_CMD_COMPLETE_SIZE);
1945
1946         switch (opcode) {
1947         case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_LOCAL_VERSION):
1948                 ptr += sizeof(evt_cmd_complete);
1949                 read_local_version_complete(index, ptr);
1950                 break;
1951         case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES):
1952                 ptr += sizeof(evt_cmd_complete);
1953                 read_local_features_complete(index, ptr);
1954                 break;
1955         case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_LOCAL_EXT_FEATURES):
1956                 ptr += sizeof(evt_cmd_complete);
1957                 read_local_ext_features_complete(index, ptr);
1958                 break;
1959         case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_BD_ADDR):
1960                 ptr += sizeof(evt_cmd_complete);
1961                 read_bd_addr_complete(index, ptr);
1962                 break;
1963         case cmd_opcode_pack(OGF_LINK_CTL, OCF_INQUIRY_CANCEL):
1964                 cc_inquiry_cancel(index, status);
1965                 break;
1966         case cmd_opcode_pack(OGF_LE_CTL, OCF_LE_SET_SCAN_ENABLE):
1967                 cc_le_set_scan_enable(index, status);
1968                 break;
1969         case cmd_opcode_pack(OGF_HOST_CTL, OCF_CHANGE_LOCAL_NAME):
1970                 if (!status)
1971                         hci_send_cmd(dev->sk, OGF_HOST_CTL,
1972                                                 OCF_READ_LOCAL_NAME, 0, 0);
1973                 break;
1974         case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE):
1975                 hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_READ_SCAN_ENABLE,
1976                                                                 0, NULL);
1977                 break;
1978         case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_SCAN_ENABLE):
1979                 ptr += sizeof(evt_cmd_complete);
1980                 read_scan_complete(index, status, ptr);
1981                 break;
1982         case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_CLASS_OF_DEV):
1983                 write_class_complete(index, status);
1984                 break;
1985         case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_SIMPLE_PAIRING_MODE):
1986                 if (!status)
1987                         hci_send_cmd(dev->sk, OGF_HOST_CTL,
1988                                         OCF_READ_SIMPLE_PAIRING_MODE, 0, NULL);
1989                 break;
1990         case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_SIMPLE_PAIRING_MODE):
1991                 ptr += sizeof(evt_cmd_complete);
1992                 read_simple_pairing_mode_complete(index, ptr);
1993                 break;
1994         case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_LOCAL_NAME):
1995                 ptr += sizeof(evt_cmd_complete);
1996                 read_local_name_complete(index, ptr);
1997                 break;
1998         case cmd_opcode_pack(OGF_HOST_CTL,
1999                                         OCF_READ_INQ_RESPONSE_TX_POWER_LEVEL):
2000                 ptr += sizeof(evt_cmd_complete);
2001                 read_tx_power_complete(index, ptr);
2002                 break;
2003         case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_LOCAL_OOB_DATA):
2004                 ptr += sizeof(evt_cmd_complete);
2005                 read_local_oob_data_complete(index, status, ptr);
2006                 break;
2007         };
2008 }
2009
2010 static inline void remote_name_information(int index, void *ptr)
2011 {
2012         struct dev_info *dev = &devs[index];
2013         evt_remote_name_req_complete *evt = ptr;
2014         struct btd_adapter *adapter;
2015         char name[MAX_NAME_LENGTH + 1];
2016         struct found_dev *found;
2017
2018         GSList *match;
2019
2020         DBG("hci%d status %u", index, evt->status);
2021
2022         memset(name, 0, sizeof(name));
2023
2024         if (evt->status == 0) {
2025                 memcpy(name, evt->name, MAX_NAME_LENGTH);
2026                 btd_event_remote_name(&dev->bdaddr, &evt->bdaddr, name);
2027         }
2028
2029         adapter = manager_find_adapter_by_id(index);
2030         if (!adapter) {
2031                 error("No matching adapter found");
2032                 return;
2033         }
2034
2035         match = g_slist_find_custom(dev->need_name, &evt->bdaddr,
2036                                                         found_dev_bda_cmp);
2037         if (match == NULL)
2038                 return;
2039
2040         found = match->data;
2041         found->name_state = NAME_NOT_NEEDED;
2042
2043         dev->need_name = g_slist_remove_link(dev->need_name, match);
2044
2045         match->next = dev->found_devs;
2046         dev->found_devs = match;
2047         dev->found_devs = g_slist_sort(dev->found_devs, found_dev_rssi_cmp);
2048
2049         if (resolve_names(dev, adapter) < 0)
2050                 set_state(index, DISCOV_HALTED);
2051 }
2052
2053 static inline void remote_version_information(int index, void *ptr)
2054 {
2055         struct dev_info *dev = &devs[index];
2056         evt_read_remote_version_complete *evt = ptr;
2057         struct bt_conn *conn;
2058
2059         DBG("hci%d status %u", index, evt->status);
2060
2061         if (evt->status)
2062                 return;
2063
2064         conn = find_conn_by_handle(dev, btohs(evt->handle));
2065         if (conn == NULL)
2066                 return;
2067
2068         write_version_info(&dev->bdaddr, &conn->bdaddr,
2069                                 btohs(evt->manufacturer), evt->lmp_ver,
2070                                 btohs(evt->lmp_subver));
2071 }
2072
2073 static void dev_found(struct dev_info *info, bdaddr_t *dba, uint8_t bdaddr_type,
2074                                 uint8_t *cod, int8_t rssi, uint8_t cfm_name,
2075                                 uint8_t *eir, size_t eir_len)
2076 {
2077         struct found_dev *dev;
2078         GSList *match;
2079
2080         match = g_slist_find_custom(info->found_devs, dba, found_dev_bda_cmp);
2081         if (match != NULL) {
2082                 cfm_name = 0;
2083                 goto event;
2084         }
2085
2086         dev = g_new0(struct found_dev, 1);
2087         bacpy(&dev->bdaddr, dba);
2088         dev->rssi = rssi;
2089         if (cfm_name)
2090                 dev->name_state = NAME_UNKNOWN;
2091         else
2092                 dev->name_state = NAME_NOT_NEEDED;
2093
2094         if (cod && !eir_has_data_type(eir, eir_len, EIR_CLASS_OF_DEV))
2095                 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV,
2096                                                                 cod, 3);
2097
2098         info->found_devs = g_slist_prepend(info->found_devs, dev);
2099
2100 event:
2101         btd_event_device_found(&info->bdaddr, dba, bdaddr_type, rssi, cfm_name,
2102                                                                 eir, eir_len);
2103 }
2104
2105 static inline void inquiry_result(int index, int plen, void *ptr)
2106 {
2107         struct dev_info *dev = &devs[index];
2108         uint8_t num = *(uint8_t *) ptr++;
2109         int i;
2110
2111         for (i = 0; i < num; i++) {
2112                 inquiry_info *info = ptr;
2113                 uint8_t eir[5];
2114
2115                 memset(eir, 0, sizeof(eir));
2116                 dev_found(dev, &info->bdaddr, BDADDR_BREDR, info->dev_class,
2117                                                                 0, 1, eir, 0);
2118                 ptr += INQUIRY_INFO_SIZE;
2119         }
2120 }
2121
2122 static inline void inquiry_result_with_rssi(int index, int plen, void *ptr)
2123 {
2124         struct dev_info *dev = &devs[index];
2125         uint8_t num = *(uint8_t *) ptr++;
2126         uint8_t eir[5];
2127         int i;
2128
2129         if (!num)
2130                 return;
2131
2132         if ((plen - 1) / num == INQUIRY_INFO_WITH_RSSI_AND_PSCAN_MODE_SIZE) {
2133                 for (i = 0; i < num; i++) {
2134                         inquiry_info_with_rssi_and_pscan_mode *info = ptr;
2135
2136                         memset(eir, 0, sizeof(eir));
2137                         dev_found(dev, &info->bdaddr, BDADDR_BREDR,
2138                                                 info->dev_class, info->rssi,
2139                                                 1, eir, 0);
2140                         ptr += INQUIRY_INFO_WITH_RSSI_AND_PSCAN_MODE_SIZE;
2141                 }
2142         } else {
2143                 for (i = 0; i < num; i++) {
2144                         inquiry_info_with_rssi *info = ptr;
2145
2146                         memset(eir, 0, sizeof(eir));
2147                         dev_found(dev, &info->bdaddr, BDADDR_BREDR,
2148                                                 info->dev_class, info->rssi,
2149                                                 1, eir, 0);
2150                         ptr += INQUIRY_INFO_WITH_RSSI_SIZE;
2151                 }
2152         }
2153 }
2154
2155 static inline void extended_inquiry_result(int index, int plen, void *ptr)
2156 {
2157         struct dev_info *dev = &devs[index];
2158         uint8_t num = *(uint8_t *) ptr++;
2159         int i;
2160
2161         for (i = 0; i < num; i++) {
2162                 extended_inquiry_info *info = ptr;
2163                 uint8_t eir[sizeof(info->data) + 5];
2164                 gboolean cfm_name;
2165                 size_t eir_len;
2166
2167                 eir_len = eir_length(info->data, sizeof(info->data));
2168
2169                 memset(eir, 0, sizeof(eir));
2170                 memcpy(eir, info->data, eir_len);
2171
2172                 if (eir_has_data_type(eir, eir_len, EIR_NAME_COMPLETE))
2173                         cfm_name = FALSE;
2174                 else
2175                         cfm_name = TRUE;
2176
2177                 dev_found(dev, &info->bdaddr, BDADDR_BREDR, info->dev_class,
2178                                         info->rssi, cfm_name, eir, eir_len);
2179                 ptr += EXTENDED_INQUIRY_INFO_SIZE;
2180         }
2181 }
2182
2183 static inline void remote_features_information(int index, void *ptr)
2184 {
2185         struct dev_info *dev = &devs[index];
2186         evt_read_remote_features_complete *evt = ptr;
2187         struct bt_conn *conn;
2188
2189         DBG("hci%d status %u", index, evt->status);
2190
2191         if (evt->status)
2192                 return;
2193
2194         conn = find_conn_by_handle(dev, btohs(evt->handle));
2195         if (conn == NULL)
2196                 return;
2197
2198         write_features_info(&dev->bdaddr, &conn->bdaddr, evt->features, NULL);
2199 }
2200
2201 struct remote_version_req {
2202         int index;
2203         uint16_t handle;
2204 };
2205
2206 static gboolean __get_remote_version(gpointer user_data)
2207 {
2208         struct remote_version_req *req = user_data;
2209         struct dev_info *dev = &devs[req->index];
2210         read_remote_version_cp cp;
2211
2212         DBG("hci%d handle %u", req->index, req->handle);
2213
2214         memset(&cp, 0, sizeof(cp));
2215         cp.handle = htobs(req->handle);
2216
2217         hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_READ_REMOTE_VERSION,
2218                                         READ_REMOTE_VERSION_CP_SIZE, &cp);
2219
2220         return FALSE;
2221 }
2222
2223 static void get_remote_version(int index, uint16_t handle)
2224 {
2225         struct remote_version_req *req;
2226
2227         req = g_new0(struct remote_version_req, 1);
2228         req->handle = handle;
2229         req->index = index;
2230
2231         g_timeout_add_seconds_full(G_PRIORITY_DEFAULT, 1, __get_remote_version,
2232                                                                 req, g_free);
2233 }
2234
2235 static void conn_free(struct bt_conn *conn)
2236 {
2237         if (conn->io != NULL) {
2238                 g_io_channel_shutdown(conn->io, TRUE, NULL);
2239                 g_io_channel_unref(conn->io);
2240         }
2241
2242         g_free(conn);
2243 }
2244
2245 static inline void conn_failed(int index, bdaddr_t *bdaddr, uint8_t status)
2246 {
2247         struct dev_info *dev = &devs[index];
2248         struct bt_conn *conn;
2249
2250         btd_event_conn_failed(&dev->bdaddr, bdaddr, status);
2251
2252         conn = find_connection(dev, bdaddr);
2253         if (conn == NULL)
2254                 return;
2255
2256         bonding_complete(dev, conn, status);
2257
2258         dev->connections = g_slist_remove(dev->connections, conn);
2259         conn_free(conn);
2260 }
2261
2262 static inline void conn_complete(int index, void *ptr)
2263 {
2264         struct dev_info *dev = &devs[index];
2265         evt_conn_complete *evt = ptr;
2266         char filename[PATH_MAX];
2267         char local_addr[18], peer_addr[18], *str;
2268         struct bt_conn *conn;
2269
2270         if (evt->link_type != ACL_LINK)
2271                 return;
2272
2273         DBG("status 0x%02x", evt->status);
2274
2275         if (evt->status != 0) {
2276                 conn_failed(index, &evt->bdaddr, evt->status);
2277                 return;
2278         }
2279
2280         conn = get_connection(dev, &evt->bdaddr);
2281         conn->handle = btohs(evt->handle);
2282
2283         btd_event_conn_complete(&dev->bdaddr, &evt->bdaddr, BDADDR_BREDR,
2284                                                                 NULL, NULL);
2285
2286         if (conn->secmode3)
2287                 bonding_complete(dev, conn, 0);
2288
2289         /* check if the remote version needs be requested */
2290         ba2str(&dev->bdaddr, local_addr);
2291         ba2str(&evt->bdaddr, peer_addr);
2292
2293         create_name(filename, sizeof(filename), STORAGEDIR, local_addr,
2294                                                         "manufacturers");
2295
2296         str = textfile_get(filename, peer_addr);
2297         if (!str)
2298                 get_remote_version(index, btohs(evt->handle));
2299         else
2300                 free(str);
2301 }
2302
2303 static inline uint8_t le_addr_type(uint8_t bdaddr_type)
2304 {
2305         switch (bdaddr_type) {
2306         case LE_RANDOM_ADDRESS:
2307                 return BDADDR_LE_RANDOM;
2308         case LE_PUBLIC_ADDRESS:
2309         default:
2310                 return BDADDR_LE_PUBLIC;
2311         }
2312 }
2313
2314 static inline void le_conn_complete(int index, void *ptr)
2315 {
2316         struct dev_info *dev = &devs[index];
2317         evt_le_connection_complete *evt = ptr;
2318         char filename[PATH_MAX];
2319         char local_addr[18], peer_addr[18], *str;
2320         struct bt_conn *conn;
2321         uint8_t bdaddr_type;
2322
2323         if (evt->status) {
2324                 btd_event_conn_failed(&dev->bdaddr, &evt->peer_bdaddr,
2325                                                                 evt->status);
2326                 return;
2327         }
2328
2329         conn = get_connection(dev, &evt->peer_bdaddr);
2330         conn->handle = btohs(evt->handle);
2331
2332         bdaddr_type = le_addr_type(evt->peer_bdaddr_type);
2333         btd_event_conn_complete(&dev->bdaddr, &evt->peer_bdaddr, bdaddr_type,
2334                                                                 NULL, NULL);
2335
2336         /* check if the remote version needs be requested */
2337         ba2str(&dev->bdaddr, local_addr);
2338         ba2str(&evt->peer_bdaddr, peer_addr);
2339
2340         create_name(filename, sizeof(filename), STORAGEDIR, local_addr,
2341                                                         "manufacturers");
2342
2343         str = textfile_get(filename, peer_addr);
2344         if (!str)
2345                 get_remote_version(index, btohs(evt->handle));
2346         else
2347                 free(str);
2348 }
2349
2350 static inline void disconn_complete(int index, void *ptr)
2351 {
2352         struct dev_info *dev = &devs[index];
2353         evt_disconn_complete *evt = ptr;
2354         struct bt_conn *conn;
2355
2356         DBG("handle %u status 0x%02x", btohs(evt->handle), evt->status);
2357
2358         if (evt->status != 0)
2359                 return;
2360
2361         conn = find_conn_by_handle(dev, btohs(evt->handle));
2362         if (conn == NULL)
2363                 return;
2364
2365         dev->connections = g_slist_remove(dev->connections, conn);
2366
2367         btd_event_disconn_complete(&dev->bdaddr, &conn->bdaddr);
2368
2369         conn_free(conn);
2370 }
2371
2372 static inline void auth_complete(int index, void *ptr)
2373 {
2374         struct dev_info *dev = &devs[index];
2375         evt_auth_complete *evt = ptr;
2376         struct bt_conn *conn;
2377
2378         DBG("hci%d status %u", index, evt->status);
2379
2380         conn = find_conn_by_handle(dev, btohs(evt->handle));
2381         if (conn == NULL)
2382                 return;
2383
2384         bonding_complete(dev, conn, evt->status);
2385 }
2386
2387 static inline void simple_pairing_complete(int index, void *ptr)
2388 {
2389         struct dev_info *dev = &devs[index];
2390         evt_simple_pairing_complete *evt = ptr;
2391
2392         DBG("hci%d status %u", index, evt->status);
2393
2394         btd_event_simple_pairing_complete(&dev->bdaddr, &evt->bdaddr,
2395                                                                 evt->status);
2396 }
2397
2398 static inline void conn_request(int index, void *ptr)
2399 {
2400         struct dev_info *dev = &devs[index];
2401         evt_conn_request *evt = ptr;
2402         uint32_t class = evt->dev_class[0] | (evt->dev_class[1] << 8)
2403                                 | (evt->dev_class[2] << 16);
2404
2405         btd_event_remote_class(&dev->bdaddr, &evt->bdaddr, class);
2406 }
2407
2408 static inline void le_advertising_report(int index, evt_le_meta_event *meta)
2409 {
2410         struct dev_info *dev = &devs[index];
2411         le_advertising_info *info;
2412         uint8_t num_reports, rssi;
2413         const uint8_t RSSI_SIZE = 1;
2414
2415         num_reports = meta->data[0];
2416
2417         info = (le_advertising_info *) &meta->data[1];
2418         rssi = *(info->data + info->length);
2419
2420         dev_found(dev, &info->bdaddr, le_addr_type(info->bdaddr_type), NULL,
2421                                         rssi, 0, info->data, info->length);
2422
2423         num_reports--;
2424
2425         while (num_reports--) {
2426                 info = (le_advertising_info *) (info->data + info->length +
2427                                                                 RSSI_SIZE);
2428                 rssi = *(info->data + info->length);
2429
2430                 dev_found(dev, &info->bdaddr, le_addr_type(info->bdaddr_type),
2431                                 NULL, rssi, 0, info->data, info->length);
2432         }
2433 }
2434
2435 static inline void le_metaevent(int index, void *ptr)
2436 {
2437         evt_le_meta_event *meta = ptr;
2438
2439         DBG("hci%d LE Meta Event %u", index, meta->subevent);
2440
2441         switch (meta->subevent) {
2442         case EVT_LE_ADVERTISING_REPORT:
2443                 le_advertising_report(index, meta);
2444                 break;
2445
2446         case EVT_LE_CONN_COMPLETE:
2447                 le_conn_complete(index, meta->data);
2448                 break;
2449         }
2450 }
2451
2452 static void stop_hci_dev(int index)
2453 {
2454         struct dev_info *dev = &devs[index];
2455
2456         if (dev->sk < 0)
2457                 return;
2458
2459         info("Stopping hci%d event socket", index);
2460
2461         if (dev->watch_id > 0)
2462                 g_source_remove(dev->watch_id);
2463
2464         if (dev->stop_scan_id > 0)
2465                 g_source_remove(dev->stop_scan_id);
2466
2467         if (dev->io != NULL)
2468                 g_io_channel_unref(dev->io);
2469
2470         hci_close_dev(dev->sk);
2471
2472         g_slist_free_full(dev->keys, g_free);
2473         g_slist_free_full(dev->uuids, g_free);
2474         g_slist_free_full(dev->connections, g_free);
2475
2476         init_dev_info(index, -1, dev->registered, dev->already_up);
2477 }
2478
2479 static gboolean io_security_event(GIOChannel *chan, GIOCondition cond,
2480                                                                 gpointer data)
2481 {
2482         unsigned char buf[HCI_MAX_EVENT_SIZE], *ptr = buf;
2483         int type, index = GPOINTER_TO_INT(data);
2484         struct dev_info *dev = &devs[index];
2485         struct hci_dev_info di;
2486         ssize_t len;
2487         hci_event_hdr *eh;
2488         evt_cmd_status *evt;
2489         int fd;
2490
2491         if (cond & (G_IO_NVAL | G_IO_HUP | G_IO_ERR)) {
2492                 stop_hci_dev(index);
2493                 return FALSE;
2494         }
2495
2496         fd = g_io_channel_unix_get_fd(chan);
2497
2498         len = read(fd, buf, sizeof(buf));
2499         if (len < 0) {
2500                 if (errno == EAGAIN)
2501                         return TRUE;
2502                 stop_hci_dev(index);
2503                 return FALSE;
2504         }
2505
2506         type = *ptr++;
2507
2508         if (type != HCI_EVENT_PKT)
2509                 return TRUE;
2510
2511         eh = (hci_event_hdr *) ptr;
2512         ptr += HCI_EVENT_HDR_SIZE;
2513
2514         memset(&di, 0, sizeof(di));
2515         if (hci_devinfo(index, &di) == 0) {
2516                 bacpy(&dev->bdaddr, &di.bdaddr);
2517
2518                 if (ignore_device(&di))
2519                         return TRUE;
2520         }
2521
2522         switch (eh->evt) {
2523         case EVT_CMD_STATUS:
2524                 cmd_status(index, ptr);
2525                 break;
2526
2527         case EVT_CMD_COMPLETE:
2528                 cmd_complete(index, ptr);
2529                 break;
2530
2531         case EVT_REMOTE_NAME_REQ_COMPLETE:
2532                 remote_name_information(index, ptr);
2533                 break;
2534
2535         case EVT_READ_REMOTE_VERSION_COMPLETE:
2536                 remote_version_information(index, ptr);
2537                 break;
2538
2539         case EVT_READ_REMOTE_FEATURES_COMPLETE:
2540                 remote_features_information(index, ptr);
2541                 break;
2542
2543         case EVT_REMOTE_HOST_FEATURES_NOTIFY:
2544                 remote_features_notify(index, ptr);
2545                 break;
2546
2547         case EVT_INQUIRY_COMPLETE:
2548                 evt = (evt_cmd_status *) ptr;
2549                 inquiry_complete_evt(index, evt->status);
2550                 break;
2551
2552         case EVT_INQUIRY_RESULT:
2553                 inquiry_result(index, eh->plen, ptr);
2554                 break;
2555
2556         case EVT_INQUIRY_RESULT_WITH_RSSI:
2557                 inquiry_result_with_rssi(index, eh->plen, ptr);
2558                 break;
2559
2560         case EVT_EXTENDED_INQUIRY_RESULT:
2561                 extended_inquiry_result(index, eh->plen, ptr);
2562                 break;
2563
2564         case EVT_CONN_COMPLETE:
2565                 conn_complete(index, ptr);
2566                 break;
2567
2568         case EVT_DISCONN_COMPLETE:
2569                 disconn_complete(index, ptr);
2570                 break;
2571
2572         case EVT_AUTH_COMPLETE:
2573                 auth_complete(index, ptr);
2574                 break;
2575
2576         case EVT_SIMPLE_PAIRING_COMPLETE:
2577                 simple_pairing_complete(index, ptr);
2578                 break;
2579
2580         case EVT_CONN_REQUEST:
2581                 conn_request(index, ptr);
2582                 break;
2583         case EVT_LE_META_EVENT:
2584                 le_metaevent(index, ptr);
2585                 break;
2586         case EVT_PIN_CODE_REQ:
2587                 pin_code_request(index, (bdaddr_t *) ptr);
2588                 break;
2589
2590         case EVT_LINK_KEY_REQ:
2591                 link_key_request(index, (bdaddr_t *) ptr);
2592                 break;
2593
2594         case EVT_LINK_KEY_NOTIFY:
2595                 link_key_notify(index, ptr);
2596                 break;
2597
2598         case EVT_RETURN_LINK_KEYS:
2599                 return_link_keys(index, ptr);
2600                 break;
2601
2602         case EVT_IO_CAPABILITY_REQUEST:
2603                 io_capa_request(index, ptr);
2604                 break;
2605
2606         case EVT_IO_CAPABILITY_RESPONSE:
2607                 io_capa_response(index, ptr);
2608                 break;
2609
2610         case EVT_USER_CONFIRM_REQUEST:
2611                 user_confirm_request(index, ptr);
2612                 break;
2613
2614         case EVT_USER_PASSKEY_REQUEST:
2615                 user_passkey_request(index, ptr);
2616                 break;
2617
2618         case EVT_USER_PASSKEY_NOTIFY:
2619                 user_passkey_notify(index, ptr);
2620                 break;
2621
2622         case EVT_REMOTE_OOB_DATA_REQUEST:
2623                 remote_oob_data_request(index, (bdaddr_t *) ptr);
2624                 break;
2625         }
2626
2627         return TRUE;
2628 }
2629
2630 static void start_hci_dev(int index)
2631 {
2632         struct dev_info *dev = &devs[index];
2633         GIOChannel *chan = dev->io;
2634         GIOCondition cond;
2635         struct hci_filter flt;
2636
2637         if (chan)
2638                 return;
2639
2640         info("Listening for HCI events on hci%d", index);
2641
2642         /* Set filter */
2643         hci_filter_clear(&flt);
2644         hci_filter_set_ptype(HCI_EVENT_PKT, &flt);
2645         hci_filter_set_event(EVT_CMD_STATUS, &flt);
2646         hci_filter_set_event(EVT_CMD_COMPLETE, &flt);
2647         hci_filter_set_event(EVT_PIN_CODE_REQ, &flt);
2648         hci_filter_set_event(EVT_LINK_KEY_REQ, &flt);
2649         hci_filter_set_event(EVT_LINK_KEY_NOTIFY, &flt);
2650         hci_filter_set_event(EVT_RETURN_LINK_KEYS, &flt);
2651         hci_filter_set_event(EVT_IO_CAPABILITY_REQUEST, &flt);
2652         hci_filter_set_event(EVT_IO_CAPABILITY_RESPONSE, &flt);
2653         hci_filter_set_event(EVT_USER_CONFIRM_REQUEST, &flt);
2654         hci_filter_set_event(EVT_USER_PASSKEY_REQUEST, &flt);
2655         hci_filter_set_event(EVT_REMOTE_OOB_DATA_REQUEST, &flt);
2656         hci_filter_set_event(EVT_USER_PASSKEY_NOTIFY, &flt);
2657         hci_filter_set_event(EVT_KEYPRESS_NOTIFY, &flt);
2658         hci_filter_set_event(EVT_SIMPLE_PAIRING_COMPLETE, &flt);
2659         hci_filter_set_event(EVT_AUTH_COMPLETE, &flt);
2660         hci_filter_set_event(EVT_REMOTE_NAME_REQ_COMPLETE, &flt);
2661         hci_filter_set_event(EVT_READ_REMOTE_VERSION_COMPLETE, &flt);
2662         hci_filter_set_event(EVT_READ_REMOTE_FEATURES_COMPLETE, &flt);
2663         hci_filter_set_event(EVT_REMOTE_HOST_FEATURES_NOTIFY, &flt);
2664         hci_filter_set_event(EVT_INQUIRY_COMPLETE, &flt);
2665         hci_filter_set_event(EVT_INQUIRY_RESULT, &flt);
2666         hci_filter_set_event(EVT_INQUIRY_RESULT_WITH_RSSI, &flt);
2667         hci_filter_set_event(EVT_EXTENDED_INQUIRY_RESULT, &flt);
2668         hci_filter_set_event(EVT_CONN_REQUEST, &flt);
2669         hci_filter_set_event(EVT_CONN_COMPLETE, &flt);
2670         hci_filter_set_event(EVT_DISCONN_COMPLETE, &flt);
2671         hci_filter_set_event(EVT_LE_META_EVENT, &flt);
2672         if (setsockopt(dev->sk, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
2673                 error("Can't set filter on hci%d: %s (%d)",
2674                                                 index, strerror(errno), errno);
2675                 return;
2676         }
2677
2678         chan = g_io_channel_unix_new(dev->sk);
2679         cond = G_IO_IN | G_IO_NVAL | G_IO_HUP | G_IO_ERR;
2680         dev->watch_id = g_io_add_watch_full(chan, G_PRIORITY_LOW, cond,
2681                                                 io_security_event,
2682                                                 GINT_TO_POINTER(index), NULL);
2683         dev->io = chan;
2684         dev->pin_length = 0;
2685
2686 }
2687
2688 /* End of HCI event callbacks */
2689
2690 static gboolean child_exit(GIOChannel *io, GIOCondition cond, void *user_data)
2691 {
2692         int status, fd = g_io_channel_unix_get_fd(io);
2693         pid_t child_pid;
2694
2695         if (read(fd, &child_pid, sizeof(child_pid)) != sizeof(child_pid)) {
2696                 error("child_exit: unable to read child pid from pipe");
2697                 return TRUE;
2698         }
2699
2700         if (waitpid(child_pid, &status, 0) != child_pid)
2701                 error("waitpid(%d) failed", child_pid);
2702         else
2703                 DBG("child %d exited", child_pid);
2704
2705         return TRUE;
2706 }
2707
2708 static void at_child_exit(void)
2709 {
2710         pid_t pid = getpid();
2711
2712         if (write(child_pipe[1], &pid, sizeof(pid)) != sizeof(pid))
2713                 error("unable to write to child pipe");
2714 }
2715
2716 static void device_devup_setup(int index)
2717 {
2718         struct dev_info *dev = &devs[index];
2719         struct hci_dev_info di;
2720         read_stored_link_key_cp cp;
2721
2722         DBG("hci%d", index);
2723
2724         if (hci_devinfo(index, &di) < 0)
2725                 return;
2726
2727         if (ignore_device(&di))
2728                 return;
2729
2730         bacpy(&dev->bdaddr, &di.bdaddr);
2731         memcpy(dev->features, di.features, 8);
2732
2733         if (dev->features[7] & LMP_EXT_FEAT) {
2734                 uint8_t page_num = 0x01;
2735
2736                 hci_send_cmd(dev->sk, OGF_INFO_PARAM,
2737                                 OCF_READ_LOCAL_EXT_FEATURES, 1, &page_num);
2738         }
2739
2740         /* Set page timeout */
2741         if ((main_opts.flags & (1 << HCID_SET_PAGETO))) {
2742                 write_page_timeout_cp cp;
2743
2744                 cp.timeout = htobs(main_opts.pageto);
2745                 hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_WRITE_PAGE_TIMEOUT,
2746                                         WRITE_PAGE_TIMEOUT_CP_SIZE, &cp);
2747         }
2748
2749         bacpy(&cp.bdaddr, BDADDR_ANY);
2750         cp.read_all = 1;
2751         hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_READ_STORED_LINK_KEY,
2752                                         READ_STORED_LINK_KEY_CP_SIZE, &cp);
2753
2754         if (!dev->pending) {
2755                 init_adapter(index);
2756                 return;
2757         }
2758
2759         /* Even though it shouldn't happen (assuming the kernel behaves
2760          * properly) it seems like we might miss the very first
2761          * initialization commands that the kernel sends. So check for
2762          * it here and resend the ones we haven't seen their results yet */
2763
2764         if (hci_test_bit(PENDING_FEATURES, &dev->pending))
2765                 hci_send_cmd(dev->sk, OGF_INFO_PARAM,
2766                                         OCF_READ_LOCAL_FEATURES, 0, NULL);
2767
2768         if (hci_test_bit(PENDING_VERSION, &dev->pending))
2769                 hci_send_cmd(dev->sk, OGF_INFO_PARAM,
2770                                         OCF_READ_LOCAL_VERSION, 0, NULL);
2771
2772         if (hci_test_bit(PENDING_NAME, &dev->pending))
2773                 hci_send_cmd(dev->sk, OGF_HOST_CTL,
2774                                         OCF_READ_LOCAL_NAME, 0, 0);
2775
2776         if (hci_test_bit(PENDING_BDADDR, &dev->pending))
2777                 hci_send_cmd(dev->sk, OGF_INFO_PARAM,
2778                                         OCF_READ_BD_ADDR, 0, NULL);
2779 }
2780
2781 static void init_pending(int index)
2782 {
2783         struct dev_info *dev = &devs[index];
2784
2785         hci_set_bit(PENDING_BDADDR, &dev->pending);
2786         hci_set_bit(PENDING_VERSION, &dev->pending);
2787         hci_set_bit(PENDING_FEATURES, &dev->pending);
2788         hci_set_bit(PENDING_NAME, &dev->pending);
2789 }
2790
2791 static struct dev_info *init_device(int index, gboolean already_up)
2792 {
2793         struct dev_info *dev;
2794         struct hci_dev_req dr;
2795         int dd;
2796         pid_t pid;
2797
2798         DBG("hci%d", index);
2799
2800         dd = hci_open_dev(index);
2801         if (dd < 0) {
2802                 error("Unable to open hci%d: %s (%d)", index,
2803                                                 strerror(errno), errno);
2804                 return NULL;
2805         }
2806
2807         if (index > max_dev) {
2808                 max_dev = index;
2809                 devs = g_realloc(devs, sizeof(devs[0]) * (max_dev + 1));
2810         }
2811
2812         dev = init_dev_info(index, dd, FALSE, already_up);
2813         init_pending(index);
2814         start_hci_dev(index);
2815
2816         /* Avoid forking if nothing else has to be done */
2817         if (already_up)
2818                 return dev;
2819
2820         /* Do initialization in the separate process */
2821         pid = fork();
2822         switch (pid) {
2823                 case 0:
2824                         atexit(at_child_exit);
2825                         break;
2826                 case -1:
2827                         error("Fork failed. Can't init device hci%d: %s (%d)",
2828                                         index, strerror(errno), errno);
2829                 default:
2830                         DBG("child %d forked", pid);
2831                         return dev;
2832         }
2833
2834         memset(&dr, 0, sizeof(dr));
2835         dr.dev_id = index;
2836
2837         /* Set link mode */
2838         dr.dev_opt = main_opts.link_mode;
2839         if (ioctl(dd, HCISETLINKMODE, (unsigned long) &dr) < 0)
2840                 error("Can't set link mode on hci%d: %s (%d)",
2841                                                 index, strerror(errno), errno);
2842
2843         /* Start HCI device */
2844         if (ioctl(dd, HCIDEVUP, index) < 0 && errno != EALREADY) {
2845                 error("Can't init device hci%d: %s (%d)",
2846                                         index, strerror(errno), errno);
2847                 goto fail;
2848         }
2849
2850         hci_close_dev(dd);
2851         exit(0);
2852
2853 fail:
2854         hci_close_dev(dd);
2855         exit(1);
2856 }
2857
2858 static void init_conn_list(int index)
2859 {
2860         struct dev_info *dev = &devs[index];
2861         struct hci_conn_list_req *cl;
2862         struct hci_conn_info *ci;
2863         int i;
2864
2865         DBG("hci%d", index);
2866
2867         cl = g_malloc0(10 * sizeof(*ci) + sizeof(*cl));
2868
2869         cl->dev_id = index;
2870         cl->conn_num = 10;
2871         ci = cl->conn_info;
2872
2873         if (ioctl(dev->sk, HCIGETCONNLIST, cl) < 0) {
2874                 error("Unable to get connection list: %s (%d)",
2875                                                 strerror(errno), errno);
2876                 goto failed;
2877         }
2878
2879         for (i = 0; i < cl->conn_num; i++, ci++) {
2880                 struct bt_conn *conn;
2881
2882                 if (ci->type != ACL_LINK)
2883                         continue;
2884
2885                 conn = get_connection(dev, &ci->bdaddr);
2886                 conn->handle = ci->handle;
2887         }
2888
2889 failed:
2890         g_free(cl);
2891 }
2892
2893 static void device_event(int event, int index)
2894 {
2895         switch (event) {
2896         case HCI_DEV_REG:
2897                 info("HCI dev %d registered", index);
2898                 init_device(index, FALSE);
2899                 break;
2900
2901         case HCI_DEV_UNREG:
2902                 info("HCI dev %d unregistered", index);
2903                 stop_hci_dev(index);
2904                 if (devs[index].registered)
2905                         btd_manager_unregister_adapter(index);
2906                 break;
2907
2908         case HCI_DEV_UP:
2909                 info("HCI dev %d up", index);
2910                 devs[index].up = TRUE;
2911                 device_devup_setup(index);
2912                 break;
2913
2914         case HCI_DEV_DOWN:
2915                 info("HCI dev %d down", index);
2916                 devs[index].up = FALSE;
2917                 devs[index].pending_cod = 0;
2918                 devs[index].cache_enable = TRUE;
2919                 devs[index].discov_state = DISCOV_HALTED;
2920                 reset_discoverable_timeout(index);
2921                 if (!devs[index].pending) {
2922                         struct btd_adapter *adapter;
2923
2924                         adapter = manager_find_adapter_by_id(index);
2925                         if (adapter)
2926                                 btd_adapter_stop(adapter);
2927
2928                         init_pending(index);
2929                 }
2930                 break;
2931         }
2932 }
2933
2934 static gboolean init_known_adapters(gpointer user_data)
2935 {
2936         struct hci_dev_list_req *dl;
2937         struct hci_dev_req *dr;
2938         int i, err, ctl = GPOINTER_TO_INT(user_data);
2939         size_t req_size;
2940
2941         DBG("");
2942
2943         req_size = HCI_MAX_DEV * sizeof(struct hci_dev_req) + sizeof(uint16_t);
2944
2945         dl = g_try_malloc0(req_size);
2946         if (!dl) {
2947                 error("Can't allocate devlist buffer");
2948                 return FALSE;
2949         }
2950
2951         dl->dev_num = HCI_MAX_DEV;
2952         dr = dl->dev_req;
2953
2954         if (ioctl(ctl, HCIGETDEVLIST, dl) < 0) {
2955                 err = -errno;
2956                 error("Can't get device list: %s (%d)", strerror(-err), -err);
2957                 g_free(dl);
2958                 return FALSE;
2959         }
2960
2961         for (i = 0; i < dl->dev_num; i++, dr++) {
2962                 struct dev_info *dev;
2963                 gboolean already_up;
2964
2965                 already_up = hci_test_bit(HCI_UP, &dr->dev_opt);
2966
2967                 dev = init_device(dr->dev_id, already_up);
2968                 if (dev == NULL)
2969                         continue;
2970
2971                 if (!dev->already_up)
2972                         continue;
2973
2974                 init_conn_list(dr->dev_id);
2975
2976                 dev->pending = 0;
2977                 hci_set_bit(PENDING_VERSION, &dev->pending);
2978                 hci_send_cmd(dev->sk, OGF_INFO_PARAM,
2979                                         OCF_READ_LOCAL_VERSION, 0, NULL);
2980                 device_event(HCI_DEV_UP, dr->dev_id);
2981         }
2982
2983         g_free(dl);
2984
2985         return FALSE;
2986 }
2987
2988 static gboolean io_stack_event(GIOChannel *chan, GIOCondition cond,
2989                                                                 gpointer data)
2990 {
2991         unsigned char buf[HCI_MAX_FRAME_SIZE], *ptr;
2992         evt_stack_internal *si;
2993         evt_si_device *sd;
2994         hci_event_hdr *eh;
2995         int type, fd;
2996         ssize_t len;
2997
2998         ptr = buf;
2999
3000         fd = g_io_channel_unix_get_fd(chan);
3001
3002         len = read(fd, buf, sizeof(buf));
3003         if (len < 0) {
3004                 if (errno == EAGAIN)
3005                         return TRUE;
3006
3007                 error("Read from control socket failed: %s (%d)",
3008                                                 strerror(errno), errno);
3009                 return FALSE;
3010         }
3011
3012         type = *ptr++;
3013
3014         if (type != HCI_EVENT_PKT)
3015                 return TRUE;
3016
3017         eh = (hci_event_hdr *) ptr;
3018         if (eh->evt != EVT_STACK_INTERNAL)
3019                 return TRUE;
3020
3021         ptr += HCI_EVENT_HDR_SIZE;
3022
3023         si = (evt_stack_internal *) ptr;
3024         switch (si->type) {
3025         case EVT_SI_DEVICE:
3026                 sd = (void *) &si->data;
3027                 device_event(sd->event, sd->dev_id);
3028                 break;
3029         }
3030
3031         return TRUE;
3032 }
3033
3034 static int hciops_setup(void)
3035 {
3036         struct sockaddr_hci addr;
3037         struct hci_filter flt;
3038         GIOChannel *ctl_io, *child_io;
3039         int sock, err;
3040
3041         DBG("");
3042
3043         if (child_pipe[0] != -1)
3044                 return -EALREADY;
3045
3046         if (pipe(child_pipe) < 0) {
3047                 err = -errno;
3048                 error("pipe(): %s (%d)", strerror(-err), -err);
3049                 return err;
3050         }
3051
3052         child_io = g_io_channel_unix_new(child_pipe[0]);
3053         g_io_channel_set_close_on_unref(child_io, TRUE);
3054         child_io_id = g_io_add_watch(child_io,
3055                                 G_IO_IN | G_IO_ERR | G_IO_HUP | G_IO_NVAL,
3056                                 child_exit, NULL);
3057         g_io_channel_unref(child_io);
3058
3059         /* Create and bind HCI socket */
3060         sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
3061         if (sock < 0) {
3062                 err = -errno;
3063                 error("Can't open HCI socket: %s (%d)", strerror(-err),
3064                                                                 -err);
3065                 return err;
3066         }
3067
3068         /* Set filter */
3069         hci_filter_clear(&flt);
3070         hci_filter_set_ptype(HCI_EVENT_PKT, &flt);
3071         hci_filter_set_event(EVT_STACK_INTERNAL, &flt);
3072         if (setsockopt(sock, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
3073                 err = -errno;
3074                 error("Can't set filter: %s (%d)", strerror(-err), -err);
3075                 return err;
3076         }
3077
3078         memset(&addr, 0, sizeof(addr));
3079         addr.hci_family = AF_BLUETOOTH;
3080         addr.hci_dev = HCI_DEV_NONE;
3081         if (bind(sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
3082                 err = -errno;
3083                 error("Can't bind HCI socket: %s (%d)", strerror(-err), -err);
3084                 return err;
3085         }
3086
3087         ctl_io = g_io_channel_unix_new(sock);
3088         g_io_channel_set_close_on_unref(ctl_io, TRUE);
3089
3090         ctl_io_id = g_io_add_watch(ctl_io, G_IO_IN, io_stack_event, NULL);
3091
3092         g_io_channel_unref(ctl_io);
3093
3094         g_idle_add(init_known_adapters, GINT_TO_POINTER(sock));
3095
3096         return 0;
3097 }
3098
3099 static void hciops_cleanup(void)
3100 {
3101         int i;
3102
3103         DBG("");
3104
3105         for (i = 0; i <= max_dev; i++)
3106                 stop_hci_dev(i);
3107
3108         g_free(devs);
3109         devs = NULL;
3110         max_dev = -1;
3111
3112         if (child_io_id) {
3113                 g_source_remove(child_io_id);
3114                 child_io_id = 0;
3115         }
3116
3117         if (ctl_io_id) {
3118                 g_source_remove(ctl_io_id);
3119                 ctl_io_id = 0;
3120         }
3121
3122         if (child_pipe[0] >= 0) {
3123                 close(child_pipe[0]);
3124                 child_pipe[0] = -1;
3125         }
3126
3127         if (child_pipe[1] >= 0) {
3128                 close(child_pipe[1]);
3129                 child_pipe[1] = -1;
3130         }
3131 }
3132
3133 static int hciops_set_powered(int index, gboolean powered)
3134 {
3135         struct dev_info *dev = &devs[index];
3136         int err;
3137
3138         DBG("hci%d powered %d", index, powered);
3139
3140         if (powered == FALSE)
3141                 return hciops_power_off(index);
3142
3143         if (ioctl(dev->sk, HCIDEVUP, index) == 0)
3144                 return 0;
3145
3146         if (errno == EALREADY)
3147                 return 0;
3148
3149         err = -errno;
3150         error("Can't init device hci%d: %s (%d)",
3151                                         index, strerror(-err), -err);
3152
3153         return err;
3154 }
3155
3156 static int start_inquiry(int index, uint8_t length)
3157 {
3158         struct dev_info *dev = &devs[index];
3159         uint8_t lap[3] = { 0x33, 0x8b, 0x9e };
3160         inquiry_cp inq_cp;
3161
3162         DBG("hci%d length %u", index, length);
3163
3164         memset(&inq_cp, 0, sizeof(inq_cp));
3165         memcpy(&inq_cp.lap, lap, 3);
3166         inq_cp.length = length;
3167         inq_cp.num_rsp = 0x00;
3168
3169         if (hci_send_cmd(dev->sk, OGF_LINK_CTL,
3170                         OCF_INQUIRY, INQUIRY_CP_SIZE, &inq_cp) < 0)
3171                 return -errno;
3172
3173         return 0;
3174 }
3175
3176 static int le_set_scan_enable(int index, uint8_t enable)
3177 {
3178         struct dev_info *dev = &devs[index];
3179         le_set_scan_enable_cp cp;
3180
3181         DBG("hci%d enable %u", index, enable);
3182
3183         memset(&cp, 0, sizeof(cp));
3184         cp.enable = enable;
3185         cp.filter_dup = 0;
3186
3187         if (hci_send_cmd(dev->sk, OGF_LE_CTL, OCF_LE_SET_SCAN_ENABLE,
3188                                 LE_SET_SCAN_ENABLE_CP_SIZE, &cp) < 0)
3189                 return -errno;
3190
3191         return 0;
3192 }
3193
3194 static gboolean stop_le_scan_cb(gpointer user_data)
3195 {
3196         struct dev_info *dev = user_data;
3197         int err;
3198
3199         err = le_set_scan_enable(dev->id, 0);
3200         if (err < 0)
3201                 return TRUE;
3202
3203         dev->stop_scan_id = 0;
3204
3205         return FALSE;
3206 }
3207
3208 static int start_scanning(int index, int timeout)
3209 {
3210         struct dev_info *dev = &devs[index];
3211         le_set_scan_parameters_cp cp;
3212         int err;
3213
3214         DBG("hci%d", index);
3215
3216         memset(&cp, 0, sizeof(cp));
3217         cp.type = 0x01;                 /* Active scanning */
3218         /* The recommended value for scan interval and window is 11.25 msec.
3219          * It is calculated by: time = n * 0.625 msec */
3220         cp.interval = htobs(0x0012);
3221         cp.window = htobs(0x0012);
3222         cp.own_bdaddr_type = 0;         /* Public address */
3223         cp.filter = 0;                  /* Accept all adv packets */
3224
3225         if (hci_send_cmd(dev->sk, OGF_LE_CTL, OCF_LE_SET_SCAN_PARAMETERS,
3226                                 LE_SET_SCAN_PARAMETERS_CP_SIZE, &cp) < 0)
3227                 return -errno;
3228
3229         err = le_set_scan_enable(index, 1);
3230         if (err < 0)
3231                 return err;
3232
3233         /* Schedule a le scan disable in 'timeout' milliseconds */
3234         dev->stop_scan_id = g_timeout_add(timeout, stop_le_scan_cb, dev);
3235
3236         return 0;
3237 }
3238
3239 static int hciops_stop_scanning(int index)
3240 {
3241         struct dev_info *dev = &devs[index];
3242
3243         DBG("hci%d", index);
3244
3245         if (dev->stop_scan_id > 0) {
3246                 g_source_remove(dev->stop_scan_id);
3247                 dev->stop_scan_id = 0;
3248         }
3249
3250         return le_set_scan_enable(index, 0);
3251 }
3252
3253 static int cancel_resolve_name(int index)
3254 {
3255         struct dev_info *info = &devs[index];
3256         struct found_dev *dev;
3257         remote_name_req_cancel_cp cp;
3258         struct btd_adapter *adapter;
3259
3260         DBG("hci%d", index);
3261
3262         if (g_slist_length(info->need_name) == 0)
3263                 return 0;
3264
3265         dev = info->need_name->data;
3266         if (dev->name_state != NAME_PENDING)
3267                 return 0;
3268
3269         memset(&cp, 0, sizeof(cp));
3270         bacpy(&cp.bdaddr, &dev->bdaddr);
3271
3272         adapter = manager_find_adapter_by_id(index);
3273         if (adapter)
3274                 adapter_set_discovering(adapter, FALSE);
3275
3276         found_dev_cleanup(info);
3277
3278         if (hci_send_cmd(info->sk, OGF_LINK_CTL, OCF_REMOTE_NAME_REQ_CANCEL,
3279                                 REMOTE_NAME_REQ_CANCEL_CP_SIZE, &cp) < 0)
3280                 return -errno;
3281
3282         return 0;
3283 }
3284
3285 static int hciops_start_discovery(int index)
3286 {
3287         int adapter_type = get_adapter_type(index);
3288
3289         DBG("hci%u", index);
3290
3291         switch (adapter_type) {
3292         case BR_EDR_LE:
3293                 return start_inquiry(index, LENGTH_BR_LE_INQ);
3294         case BR_EDR:
3295                 return start_inquiry(index, LENGTH_BR_INQ);
3296         case LE_ONLY:
3297                 return start_scanning(index, TIMEOUT_LE_SCAN);
3298         default:
3299                 return -EINVAL;
3300         }
3301 }
3302
3303 static int hciops_stop_discovery(int index)
3304 {
3305         struct dev_info *dev = &devs[index];
3306
3307         DBG("index %d", index);
3308
3309         switch (dev->discov_state) {
3310         case DISCOV_INQ:
3311                 return hciops_stop_inquiry(index);
3312         case DISCOV_SCAN:
3313                 return hciops_stop_scanning(index);
3314         case DISCOV_NAMES:
3315                 cancel_resolve_name(index);
3316         default:
3317                 return -EINVAL;
3318         }
3319 }
3320
3321 static int hciops_set_fast_connectable(int index, gboolean enable)
3322 {
3323         struct dev_info *dev = &devs[index];
3324         write_page_activity_cp cp;
3325         uint8_t type;
3326
3327         DBG("hci%d enable %d", index, enable);
3328
3329         if (enable) {
3330                 type = PAGE_SCAN_TYPE_INTERLACED;
3331                 cp.interval = 0x0024;   /* 22.5 msec page scan interval */
3332         } else {
3333                 type = PAGE_SCAN_TYPE_STANDARD; /* default */
3334                 cp.interval = 0x0800;   /* default 1.28 sec page scan */
3335         }
3336
3337         cp.window = 0x0012;     /* default 11.25 msec page scan window */
3338
3339         if (hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_WRITE_PAGE_ACTIVITY,
3340                                         WRITE_PAGE_ACTIVITY_CP_SIZE, &cp) < 0)
3341                 return -errno;
3342         else if (hci_send_cmd(dev->sk, OGF_HOST_CTL,
3343                                 OCF_WRITE_PAGE_SCAN_TYPE, 1, &type) < 0)
3344                 return -errno;
3345
3346         return 0;
3347 }
3348
3349 static int hciops_read_clock(int index, bdaddr_t *bdaddr, int which,
3350                                                 int timeout, uint32_t *clock,
3351                                                 uint16_t *accuracy)
3352 {
3353         struct dev_info *dev = &devs[index];
3354         uint16_t handle = 0;
3355         char addr[18];
3356         int ret;
3357
3358         ba2str(bdaddr, addr);
3359         DBG("hci%d addr %s which %d timeout %d", index, addr, which, timeout);
3360
3361         ret = get_handle(index, bdaddr, &handle);
3362         if (ret < 0)
3363                 return ret;
3364
3365         if (hci_read_clock(dev->sk, htobs(handle), which, clock, accuracy,
3366                                                                 timeout) < 0)
3367                 return -errno;
3368
3369         return 0;
3370 }
3371
3372 static int hciops_read_bdaddr(int index, bdaddr_t *bdaddr)
3373 {
3374         struct dev_info *dev = &devs[index];
3375
3376         DBG("hci%d", index);
3377
3378         bacpy(bdaddr, &dev->bdaddr);
3379
3380         return 0;
3381 }
3382
3383 static int hciops_block_device(int index, bdaddr_t *bdaddr,
3384                                                 uint8_t bdaddr_type)
3385 {
3386         struct dev_info *dev = &devs[index];
3387         char addr[18];
3388
3389         ba2str(bdaddr, addr);
3390         DBG("hci%d dba %s", index, addr);
3391
3392         if (ioctl(dev->sk, HCIBLOCKADDR, bdaddr) < 0)
3393                 return -errno;
3394
3395         return 0;
3396 }
3397
3398 static int hciops_unblock_device(int index, bdaddr_t *bdaddr,
3399                                                 uint8_t bdaddr_type)
3400 {
3401         struct dev_info *dev = &devs[index];
3402         char addr[18];
3403
3404         ba2str(bdaddr, addr);
3405         DBG("hci%d dba %s", index, addr);
3406
3407         if (ioctl(dev->sk, HCIUNBLOCKADDR, bdaddr) < 0)
3408                 return -errno;
3409
3410         return 0;
3411 }
3412
3413 static int hciops_get_conn_list(int index, GSList **conns)
3414 {
3415         struct dev_info *dev = &devs[index];
3416         GSList *l;
3417
3418         DBG("hci%d", index);
3419
3420         *conns = NULL;
3421
3422         for (l = dev->connections; l != NULL; l = g_slist_next(l)) {
3423                 struct bt_conn *conn = l->data;
3424
3425                 *conns = g_slist_append(*conns,
3426                                 g_memdup(&conn->bdaddr, sizeof(bdaddr_t)));
3427         }
3428
3429         return 0;
3430 }
3431
3432 static int hciops_disconnect(int index, bdaddr_t *bdaddr, uint8_t bdaddr_type)
3433 {
3434         DBG("hci%d", index);
3435
3436         return disconnect_addr(index, bdaddr, HCI_OE_USER_ENDED_CONNECTION);
3437 }
3438
3439 static int hciops_remove_bonding(int index, bdaddr_t *bdaddr,
3440                                                         uint8_t bdaddr_type)
3441 {
3442         struct dev_info *dev = &devs[index];
3443         delete_stored_link_key_cp cp;
3444         GSList *match;
3445         char addr[18];
3446
3447         ba2str(bdaddr, addr);
3448         DBG("hci%d dba %s", index, addr);
3449
3450         match = g_slist_find_custom(dev->keys, bdaddr, (GCompareFunc) bacmp);
3451         if (match) {
3452                 g_free(match->data);
3453                 dev->keys = g_slist_delete_link(dev->keys, match);
3454         }
3455
3456         memset(&cp, 0, sizeof(cp));
3457         bacpy(&cp.bdaddr, bdaddr);
3458
3459         /* Delete the link key from the Bluetooth chip */
3460         if (hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_DELETE_STORED_LINK_KEY,
3461                                 DELETE_STORED_LINK_KEY_CP_SIZE, &cp) < 0)
3462                 return -errno;
3463
3464         return 0;
3465 }
3466
3467 static int hciops_pincode_reply(int index, bdaddr_t *bdaddr, const char *pin,
3468                                                                 size_t pin_len)
3469 {
3470         struct dev_info *dev = &devs[index];
3471         char addr[18];
3472         int err;
3473
3474         ba2str(bdaddr, addr);
3475         DBG("hci%d dba %s", index, addr);
3476
3477         if (pin) {
3478                 pin_code_reply_cp pr;
3479
3480                 dev->pin_length = pin_len;
3481
3482                 memset(&pr, 0, sizeof(pr));
3483                 bacpy(&pr.bdaddr, bdaddr);
3484                 memcpy(pr.pin_code, pin, pin_len);
3485                 pr.pin_len = pin_len;
3486                 err = hci_send_cmd(dev->sk, OGF_LINK_CTL,
3487                                                 OCF_PIN_CODE_REPLY,
3488                                                 PIN_CODE_REPLY_CP_SIZE, &pr);
3489         } else
3490                 err = hci_send_cmd(dev->sk, OGF_LINK_CTL,
3491                                         OCF_PIN_CODE_NEG_REPLY, 6, bdaddr);
3492
3493         if (err < 0)
3494                 err = -errno;
3495
3496         return err;
3497 }
3498
3499 static int hciops_passkey_reply(int index, bdaddr_t *bdaddr,
3500                                         uint8_t bdaddr_type, uint32_t passkey)
3501 {
3502         struct dev_info *dev = &devs[index];
3503         char addr[18];
3504         int err;
3505
3506         ba2str(bdaddr, addr);
3507         DBG("hci%d dba %s", index, addr);
3508
3509         if (passkey != INVALID_PASSKEY) {
3510                 user_passkey_reply_cp cp;
3511
3512                 memset(&cp, 0, sizeof(cp));
3513                 bacpy(&cp.bdaddr, bdaddr);
3514                 cp.passkey = passkey;
3515
3516                 err = hci_send_cmd(dev->sk, OGF_LINK_CTL,
3517                                         OCF_USER_PASSKEY_REPLY,
3518                                         USER_PASSKEY_REPLY_CP_SIZE, &cp);
3519         } else
3520                 err = hci_send_cmd(dev->sk, OGF_LINK_CTL,
3521                                         OCF_USER_PASSKEY_NEG_REPLY, 6, bdaddr);
3522
3523         if (err < 0)
3524                 err = -errno;
3525
3526         return err;
3527 }
3528
3529 static uint8_t generate_service_class(int index)
3530 {
3531         struct dev_info *dev = &devs[index];
3532         GSList *l;
3533         uint8_t val = 0;
3534
3535         for (l = dev->uuids; l != NULL; l = g_slist_next(l)) {
3536                 struct uuid_info *uuid = l->data;
3537
3538                 val |= uuid->svc_hint;
3539         }
3540
3541         return val;
3542 }
3543
3544 static int update_service_classes(int index)
3545 {
3546         struct dev_info *dev = &devs[index];
3547         uint8_t value;
3548         int err;
3549
3550         value = generate_service_class(index);
3551
3552         DBG("hci%d value %u", index, value);
3553
3554         /* Update only the service class, keep the limited bit,
3555          * major/minor class bits intact */
3556         dev->wanted_cod &= 0x00ffff;
3557         dev->wanted_cod |= (value << 16);
3558
3559         /* If the cache is enabled or an existing CoD write is in progress
3560          * just bail out */
3561         if (dev->cache_enable || dev->pending_cod)
3562                 return 0;
3563
3564         /* If we already have the CoD we want, update EIR and return */
3565         if (dev->current_cod == dev->wanted_cod) {
3566                 update_ext_inquiry_response(index);
3567                 return 0;
3568         }
3569
3570         DBG("Changing service classes to 0x%06x", dev->wanted_cod);
3571
3572         err = write_class(index, dev->wanted_cod);
3573         if (err < 0)
3574                 error("Adapter class update failed: %s (%d)",
3575                                                 strerror(-err), -err);
3576
3577         return err;
3578 }
3579
3580 static int hciops_add_uuid(int index, uuid_t *uuid, uint8_t svc_hint)
3581 {
3582         struct dev_info *dev = &devs[index];
3583         struct uuid_info *info;
3584
3585         DBG("hci%d", index);
3586
3587         info = g_new0(struct uuid_info, 1);
3588         memcpy(&info->uuid, uuid, sizeof(*uuid));
3589         info->svc_hint = svc_hint;
3590
3591         dev->uuids = g_slist_append(dev->uuids, info);
3592
3593         return update_service_classes(index);
3594 }
3595
3596 static int hciops_remove_uuid(int index, uuid_t *uuid)
3597 {
3598         struct dev_info *dev = &devs[index];
3599         GSList *match;
3600
3601         match = g_slist_find_custom(dev->uuids, uuid, sdp_uuid_cmp);
3602         if (match) {
3603                 g_free(match->data);
3604                 dev->uuids = g_slist_delete_link(dev->uuids, match);
3605         }
3606
3607         DBG("hci%d", index);
3608
3609         return update_service_classes(index);
3610 }
3611
3612 static int hciops_disable_cod_cache(int index)
3613 {
3614         struct dev_info *dev = &devs[index];
3615
3616         DBG("hci%d cache_enable %d", index, dev->cache_enable);
3617
3618         if (!dev->cache_enable)
3619                 return 0;
3620
3621         DBG("hci%d current_cod 0x%06x wanted_cod 0x%06x", index,
3622                                         dev->current_cod, dev->wanted_cod);
3623
3624         /* Disable and flush svc cache. All successive service class
3625          * updates * will be written to the device */
3626         dev->cache_enable = FALSE;
3627
3628         if (dev->current_cod == dev->wanted_cod) {
3629                 update_ext_inquiry_response(index);
3630                 return 0;
3631         }
3632
3633         return write_class(index, dev->wanted_cod);
3634 }
3635
3636 static int hciops_restore_powered(int index)
3637 {
3638         struct dev_info *dev = &devs[index];
3639
3640         if (!dev->already_up && dev->up)
3641                 return hciops_power_off(index);
3642
3643         return 0;
3644 }
3645
3646 static int hciops_load_keys(int index, GSList *keys, gboolean debug_keys)
3647 {
3648         struct dev_info *dev = &devs[index];
3649         GSList *l;
3650
3651         DBG("hci%d keys %d debug_keys %d", index, g_slist_length(keys),
3652                                                                 debug_keys);
3653
3654         if (dev->keys != NULL)
3655                 return -EEXIST;
3656
3657         for (l = keys; l; l = l->next) {
3658                 struct link_key_info *orig, *dup;
3659
3660                 orig = l->data;
3661
3662                 dup = g_memdup(orig, sizeof(*orig));
3663
3664                 dev->keys = g_slist_prepend(dev->keys, dup);
3665         }
3666
3667         dev->debug_keys = debug_keys;
3668
3669         return 0;
3670 }
3671
3672 static int hciops_set_io_capability(int index, uint8_t io_capability)
3673 {
3674         struct dev_info *dev = &devs[index];
3675
3676         /* hciops is not to be used for SMP pairing for LE devices. So
3677          * change the IO capability from KeyboardDisplay to DisplayYesNo
3678          * in case it is set. */
3679         dev->io_capability = (io_capability == 0x04) ? 0x01 : io_capability;
3680
3681         return 0;
3682 }
3683
3684 static int request_authentication(int index, bdaddr_t *bdaddr)
3685 {
3686         struct dev_info *dev = &devs[index];
3687         auth_requested_cp cp;
3688         uint16_t handle;
3689         int err;
3690
3691         DBG("hci%d", index);
3692
3693         err = get_handle(index, bdaddr, &handle);
3694         if (err < 0)
3695                 return err;
3696
3697         memset(&cp, 0, sizeof(cp));
3698         cp.handle = htobs(handle);
3699
3700         if (hci_send_cmd(dev->sk, OGF_LINK_CTL, OCF_AUTH_REQUESTED,
3701                                         AUTH_REQUESTED_CP_SIZE, &cp) < 0)
3702                 return -errno;
3703
3704         return 0;
3705 }
3706
3707 static void bonding_connect_cb(GIOChannel *io, GError *err, gpointer user_data)
3708 {
3709         struct bt_conn *conn = user_data;
3710         struct dev_info *dev = conn->dev;
3711
3712         if (!conn->io) {
3713                 if (!err)
3714                         g_io_channel_shutdown(io, TRUE, NULL);
3715                 return;
3716         }
3717
3718         if (err)
3719                 /* Wait proper error to be propagated by bonding complete */
3720                 return;
3721
3722         if (request_authentication(dev->id, &conn->bdaddr) < 0)
3723                 goto failed;
3724
3725         return;
3726
3727 failed:
3728         bonding_complete(dev, conn, HCI_UNSPECIFIED_ERROR);
3729 }
3730
3731 static int hciops_create_bonding(int index, bdaddr_t *bdaddr,
3732                                         uint8_t bdaddr_type, uint8_t io_cap)
3733 {
3734         struct dev_info *dev = &devs[index];
3735         BtIOSecLevel sec_level;
3736         struct bt_conn *conn;
3737         GError *err = NULL;
3738
3739         conn = get_connection(dev, bdaddr);
3740
3741         if (conn->io != NULL)
3742                 return -EBUSY;
3743
3744         /* hciops is not to be used for SMP pairing for LE devices. So
3745          * change the IO capability from KeyboardDisplay to DisplayYesNo
3746          * in case it is set. */
3747         conn->loc_cap = (io_cap == 0x04 ? 0x01 : io_cap);
3748
3749         /* If our IO capability is NoInputNoOutput use medium security
3750          * level (i.e. don't require MITM protection) else use high
3751          * security level */
3752         if (io_cap == 0x03)
3753                 sec_level = BT_IO_SEC_MEDIUM;
3754         else
3755                 sec_level = BT_IO_SEC_HIGH;
3756
3757         conn->io = bt_io_connect(BT_IO_L2RAW, bonding_connect_cb, conn,
3758                                         NULL, &err,
3759                                         BT_IO_OPT_SOURCE_BDADDR, &dev->bdaddr,
3760                                         BT_IO_OPT_DEST_BDADDR, bdaddr,
3761                                         BT_IO_OPT_SEC_LEVEL, sec_level,
3762                                         BT_IO_OPT_INVALID);
3763         if (conn->io == NULL) {
3764                 error("bt_io_connect: %s", err->message);
3765                 g_error_free(err);
3766                 return -EIO;
3767         }
3768
3769         conn->bonding_initiator = TRUE;
3770
3771         return 0;
3772 }
3773
3774 static int hciops_cancel_bonding(int index, bdaddr_t *bdaddr)
3775 {
3776         struct dev_info *dev = &devs[index];
3777         struct bt_conn *conn;
3778
3779         DBG("hci%d", index);
3780
3781         conn = find_connection(dev, bdaddr);
3782         if (conn == NULL || conn->io == NULL)
3783                 return -ENOTCONN;
3784
3785         g_io_channel_shutdown(conn->io, TRUE, NULL);
3786         g_io_channel_unref(conn->io);
3787         conn->io = NULL;
3788
3789         return 0;
3790 }
3791
3792 static int hciops_read_local_oob_data(int index)
3793 {
3794         struct dev_info *dev = &devs[index];
3795
3796         DBG("hci%d", index);
3797
3798         if (hci_send_cmd(dev->sk, OGF_HOST_CTL, OCF_READ_LOCAL_OOB_DATA, 0, 0)
3799                                                                         < 0)
3800                 return -errno;
3801
3802         return 0;
3803 }
3804
3805 static int hciops_add_remote_oob_data(int index, bdaddr_t *bdaddr,
3806                                         uint8_t *hash, uint8_t *randomizer)
3807 {
3808         char addr[18];
3809         struct dev_info *dev = &devs[index];
3810         GSList *match;
3811         struct oob_data *data;
3812
3813         ba2str(bdaddr, addr);
3814         DBG("hci%d bdaddr %s", index, addr);
3815
3816         match = g_slist_find_custom(dev->oob_data, bdaddr, oob_bdaddr_cmp);
3817
3818         if (match) {
3819                 data = match->data;
3820         } else {
3821                 data = g_new(struct oob_data, 1);
3822                 bacpy(&data->bdaddr, bdaddr);
3823                 dev->oob_data = g_slist_prepend(dev->oob_data, data);
3824         }
3825
3826         memcpy(data->hash, hash, sizeof(data->hash));
3827         memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
3828
3829         return 0;
3830 }
3831
3832 static int hciops_remove_remote_oob_data(int index, bdaddr_t *bdaddr)
3833 {
3834         char addr[18];
3835         struct dev_info *dev = &devs[index];
3836         GSList *match;
3837
3838         ba2str(bdaddr, addr);
3839         DBG("hci%d bdaddr %s", index, addr);
3840
3841         match = g_slist_find_custom(dev->oob_data, bdaddr, oob_bdaddr_cmp);
3842
3843         if (!match)
3844                 return -ENOENT;
3845
3846         g_free(match->data);
3847         dev->oob_data = g_slist_delete_link(dev->oob_data, match);
3848
3849         return 0;
3850 }
3851
3852 static int hciops_confirm_name(int index, bdaddr_t *bdaddr,
3853                                 uint8_t bdaddr_type, gboolean name_known)
3854 {
3855         struct dev_info *info = &devs[index];
3856         struct found_dev *dev;
3857         GSList *match;
3858         char addr[18];
3859
3860         ba2str(bdaddr, addr);
3861         DBG("hci%u %s name_known %u", index, addr, name_known);
3862
3863         match = g_slist_find_custom(info->found_devs, bdaddr,
3864                                                 found_dev_bda_cmp);
3865         if (match == NULL)
3866                 return -ENOENT;
3867
3868         dev = match->data;
3869
3870         if (name_known) {
3871                 dev->name_state = NAME_NOT_NEEDED;
3872                 info->found_devs = g_slist_sort(info->found_devs,
3873                                                         found_dev_rssi_cmp);
3874                 return 0;
3875         }
3876
3877         dev->name_state = NAME_NEEDED;
3878         info->found_devs = g_slist_remove_link(info->found_devs, match);
3879
3880         match->next = info->need_name;
3881         info->need_name = match;
3882         info->need_name = g_slist_sort(info->need_name, found_dev_rssi_cmp);
3883
3884         return 0;
3885 }
3886
3887 static int hciops_load_ltks(int index, GSList *keys)
3888 {
3889         return -ENOSYS;
3890 }
3891
3892 static struct btd_adapter_ops hci_ops = {
3893         .setup = hciops_setup,
3894         .cleanup = hciops_cleanup,
3895         .set_powered = hciops_set_powered,
3896         .set_discoverable = hciops_set_discoverable,
3897         .set_pairable = hciops_set_pairable,
3898         .start_discovery = hciops_start_discovery,
3899         .stop_discovery = hciops_stop_discovery,
3900         .set_name = hciops_set_name,
3901         .set_dev_class = hciops_set_dev_class,
3902         .set_fast_connectable = hciops_set_fast_connectable,
3903         .read_clock = hciops_read_clock,
3904         .read_bdaddr = hciops_read_bdaddr,
3905         .block_device = hciops_block_device,
3906         .unblock_device = hciops_unblock_device,
3907         .get_conn_list = hciops_get_conn_list,
3908         .disconnect = hciops_disconnect,
3909         .remove_bonding = hciops_remove_bonding,
3910         .pincode_reply = hciops_pincode_reply,
3911         .confirm_reply = hciops_confirm_reply,
3912         .passkey_reply = hciops_passkey_reply,
3913         .encrypt_link = hciops_encrypt_link,
3914         .set_did = hciops_set_did,
3915         .add_uuid = hciops_add_uuid,
3916         .remove_uuid = hciops_remove_uuid,
3917         .disable_cod_cache = hciops_disable_cod_cache,
3918         .restore_powered = hciops_restore_powered,
3919         .load_keys = hciops_load_keys,
3920         .set_io_capability = hciops_set_io_capability,
3921         .create_bonding = hciops_create_bonding,
3922         .cancel_bonding = hciops_cancel_bonding,
3923         .read_local_oob_data = hciops_read_local_oob_data,
3924         .add_remote_oob_data = hciops_add_remote_oob_data,
3925         .remove_remote_oob_data = hciops_remove_remote_oob_data,
3926         .confirm_name = hciops_confirm_name,
3927         .load_ltks = hciops_load_ltks,
3928 };
3929
3930 static int hciops_init(void)
3931 {
3932         DBG("");
3933 #ifdef __TIZEN_PATCH__
3934         return btd_register_adapter_ops(&hci_ops, TRUE);
3935 #else
3936         return btd_register_adapter_ops(&hci_ops, FALSE);
3937 #endif
3938 }
3939
3940 static void hciops_exit(void)
3941 {
3942         DBG("");
3943         btd_adapter_cleanup_ops(&hci_ops);
3944 }
3945
3946 BLUETOOTH_PLUGIN_DEFINE(hciops, VERSION,
3947                 BLUETOOTH_PLUGIN_PRIORITY_LOW, hciops_init, hciops_exit)