hciops.c revision cc758c498ed98de11e890e56d4500ca85587bc07
1/*
2 *
3 *  BlueZ - Bluetooth protocol stack for Linux
4 *
5 *  Copyright (C) 2004-2010  Marcel Holtmann <marcel@holtmann.org>
6 *
7 *  This program is free software; you can redistribute it and/or modify
8 *  it under the terms of the GNU General Public License as published by
9 *  the Free Software Foundation; either version 2 of the License, or
10 *  (at your option) any later version.
11 *
12 *  This program is distributed in the hope that it will be useful,
13 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
14 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15 *  GNU General Public License for more details.
16 *
17 *  You should have received a copy of the GNU General Public License
18 *  along with this program; if not, write to the Free Software
19 *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
20 *
21 */
22
23#ifdef HAVE_CONFIG_H
24#include <config.h>
25#endif
26
27#include <stdio.h>
28#include <errno.h>
29#include <unistd.h>
30#include <stdlib.h>
31#include <sys/types.h>
32#include <sys/ioctl.h>
33#include <sys/wait.h>
34
35#include <bluetooth/bluetooth.h>
36#include <bluetooth/hci.h>
37#include <bluetooth/hci_lib.h>
38
39#include <glib.h>
40
41#include "hcid.h"
42#include "sdpd.h"
43#include "adapter.h"
44#include "plugin.h"
45#include "log.h"
46#include "storage.h"
47#include "event.h"
48#include "device.h"
49#include "manager.h"
50
51#define HCI_REQ_TIMEOUT         5000
52
53static int child_pipe[2] = { -1, -1 };
54
55static guint child_io_id = 0;
56static guint ctl_io_id = 0;
57
58#define SK(index) devs[(index)].sk
59#define BDADDR(index) devs[(index)].bdaddr
60#define UP(index) devs[(index)].up
61#define READY(index) devs[(index)].ready
62#define CHANNEL(index) devs[(index)].channel
63#define WATCH_ID(index) devs[(index)].watch_id
64#define PIN_LENGTH(index) devs[(index)].pin_length
65
66static int max_dev = -1;
67static struct dev_info {
68	int sk;
69	bdaddr_t bdaddr;
70	gboolean up;
71	gboolean ready;
72
73	GIOChannel *channel;
74	guint watch_id;
75	int pin_length;
76} *devs = NULL;
77
78static int ignore_device(struct hci_dev_info *di)
79{
80	return hci_test_bit(HCI_RAW, &di->flags) || di->type >> 4 != HCI_BREDR;
81}
82
83static void init_dev_info(int index, int sk)
84{
85	memset(&devs[index], 0, sizeof(struct dev_info));
86	SK(index) = sk;
87	PIN_LENGTH(index) = -1;
88}
89
90/* Async HCI command handling with callback support */
91
92struct hci_cmd_data {
93	bt_hci_result_t		cb;
94	uint16_t		handle;
95	uint16_t		ocf;
96	gpointer		caller_data;
97};
98
99static gboolean hci_event_watch(GIOChannel *io,
100			GIOCondition cond, gpointer user_data)
101{
102	unsigned char buf[HCI_MAX_EVENT_SIZE], *body;
103	struct hci_cmd_data *cmd = user_data;
104	evt_cmd_status *evt_status;
105	evt_auth_complete *evt_auth;
106	evt_encrypt_change *evt_enc;
107	hci_event_hdr *hdr;
108	set_conn_encrypt_cp cp;
109	int dd;
110	uint16_t ocf;
111	uint8_t status = HCI_OE_POWER_OFF;
112
113	if (cond & G_IO_NVAL) {
114		cmd->cb(status, cmd->caller_data);
115		return FALSE;
116	}
117
118	if (cond & (G_IO_ERR | G_IO_HUP))
119		goto failed;
120
121	dd = g_io_channel_unix_get_fd(io);
122
123	if (read(dd, buf, sizeof(buf)) < 0)
124		goto failed;
125
126	hdr = (hci_event_hdr *) (buf + 1);
127	body = buf + (1 + HCI_EVENT_HDR_SIZE);
128
129	switch (hdr->evt) {
130	case EVT_CMD_STATUS:
131		evt_status = (evt_cmd_status *) body;
132		ocf = cmd_opcode_ocf(evt_status->opcode);
133		if (ocf != cmd->ocf)
134			return TRUE;
135		switch (ocf) {
136		case OCF_AUTH_REQUESTED:
137		case OCF_SET_CONN_ENCRYPT:
138			if (evt_status->status != 0) {
139				/* Baseband rejected command */
140				status = evt_status->status;
141				goto failed;
142			}
143			break;
144		default:
145			return TRUE;
146		}
147		/* Wait for the next event */
148		return TRUE;
149	case EVT_AUTH_COMPLETE:
150		evt_auth = (evt_auth_complete *) body;
151		if (evt_auth->handle != cmd->handle) {
152			/* Skipping */
153			return TRUE;
154		}
155
156		if (evt_auth->status != 0x00) {
157			status = evt_auth->status;
158			/* Abort encryption */
159			goto failed;
160		}
161
162		memset(&cp, 0, sizeof(cp));
163		cp.handle  = cmd->handle;
164		cp.encrypt = 1;
165
166		cmd->ocf = OCF_SET_CONN_ENCRYPT;
167
168		if (hci_send_cmd(dd, OGF_LINK_CTL, OCF_SET_CONN_ENCRYPT,
169					SET_CONN_ENCRYPT_CP_SIZE, &cp) < 0) {
170			status = HCI_COMMAND_DISALLOWED;
171			goto failed;
172		}
173		/* Wait for encrypt change event */
174		return TRUE;
175	case EVT_ENCRYPT_CHANGE:
176		evt_enc = (evt_encrypt_change *) body;
177		if (evt_enc->handle != cmd->handle)
178			return TRUE;
179
180		/* Procedure finished: reporting status */
181		status = evt_enc->status;
182		break;
183	default:
184		/* Skipping */
185		return TRUE;
186	}
187
188failed:
189	cmd->cb(status, cmd->caller_data);
190	g_io_channel_shutdown(io, TRUE, NULL);
191
192	return FALSE;
193}
194
195static int hciops_encrypt_link(int index, bdaddr_t *dst, bt_hci_result_t cb,
196							gpointer user_data)
197{
198	GIOChannel *io;
199	struct hci_cmd_data *cmd;
200	struct hci_conn_info_req *cr;
201	auth_requested_cp cp;
202	struct hci_filter nf;
203	int dd, err;
204	uint32_t link_mode;
205	uint16_t handle;
206
207	cr = g_malloc0(sizeof(*cr) + sizeof(struct hci_conn_info));
208	cr->type = ACL_LINK;
209	bacpy(&cr->bdaddr, dst);
210
211	err = ioctl(SK(index), HCIGETCONNINFO, cr);
212	link_mode = cr->conn_info->link_mode;
213	handle = cr->conn_info->handle;
214	g_free(cr);
215
216	if (err < 0)
217		return -errno;
218
219	if (link_mode & HCI_LM_ENCRYPT)
220		return -EALREADY;
221
222	memset(&cp, 0, sizeof(cp));
223	cp.handle = htobs(handle);
224
225	if (hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_AUTH_REQUESTED,
226				AUTH_REQUESTED_CP_SIZE, &cp) < 0)
227		return -errno;
228
229	dd = dup(SK(index));
230	if (dd < 0)
231		return -errno;
232
233	cmd = g_new0(struct hci_cmd_data, 1);
234	cmd->handle = handle;
235	cmd->ocf = OCF_AUTH_REQUESTED;
236	cmd->cb	= cb;
237	cmd->caller_data = user_data;
238
239	hci_filter_clear(&nf);
240	hci_filter_set_ptype(HCI_EVENT_PKT, &nf);
241	hci_filter_set_event(EVT_CMD_STATUS, &nf);
242	hci_filter_set_event(EVT_AUTH_COMPLETE, &nf);
243	hci_filter_set_event(EVT_ENCRYPT_CHANGE, &nf);
244
245	if (setsockopt(dd, SOL_HCI, HCI_FILTER, &nf, sizeof(nf)) < 0) {
246		err = -errno;
247		g_free(cmd);
248		close(dd);
249		return -err;
250	}
251
252	io = g_io_channel_unix_new(dup(SK(index)));
253	g_io_channel_set_close_on_unref(io, FALSE);
254	g_io_add_watch_full(io, G_PRIORITY_DEFAULT,
255			G_IO_HUP | G_IO_ERR | G_IO_NVAL | G_IO_IN,
256			hci_event_watch, cmd, g_free);
257	g_io_channel_unref(io);
258
259	return 0;
260}
261
262/* End async HCI command handling */
263
264/* Start of HCI event callbacks */
265
266static int get_handle(int index, bdaddr_t *dba, uint16_t *handle)
267{
268	struct hci_conn_list_req *cl;
269	struct hci_conn_info *ci;
270	int i;
271
272	cl = g_malloc0(10 * sizeof(*ci) + sizeof(*cl));
273
274	cl->dev_id = index;
275	cl->conn_num = 10;
276	ci = cl->conn_info;
277
278	if (ioctl(SK(index), HCIGETCONNLIST, (void *) cl) < 0) {
279		g_free(cl);
280		return -EIO;
281	}
282
283	for (i = 0; i < cl->conn_num; i++, ci++) {
284		if (bacmp(&ci->bdaddr, dba) == 0) {
285			*handle = ci->handle;
286			g_free(cl);
287			return 0;
288		}
289	}
290
291	g_free(cl);
292
293	return -ENOENT;
294}
295
296static inline int get_bdaddr(int index, uint16_t handle, bdaddr_t *dba)
297{
298	struct hci_conn_list_req *cl;
299	struct hci_conn_info *ci;
300	int i;
301
302	cl = g_malloc0(10 * sizeof(*ci) + sizeof(*cl));
303
304	cl->dev_id = index;
305	cl->conn_num = 10;
306	ci = cl->conn_info;
307
308	if (ioctl(SK(index), HCIGETCONNLIST, (void *) cl) < 0) {
309		g_free(cl);
310		return -EIO;
311	}
312
313	for (i = 0; i < cl->conn_num; i++, ci++)
314		if (ci->handle == handle) {
315			bacpy(dba, &ci->bdaddr);
316			g_free(cl);
317			return 0;
318		}
319
320	g_free(cl);
321
322	return -ENOENT;
323}
324
325static inline void update_lastseen(bdaddr_t *sba, bdaddr_t *dba)
326{
327	time_t t;
328	struct tm *tm;
329
330	t = time(NULL);
331	tm = gmtime(&t);
332
333	write_lastseen_info(sba, dba, tm);
334}
335
336static inline void update_lastused(bdaddr_t *sba, bdaddr_t *dba)
337{
338	time_t t;
339	struct tm *tm;
340
341	t = time(NULL);
342	tm = gmtime(&t);
343
344	write_lastused_info(sba, dba, tm);
345}
346
347/* Link Key handling */
348
349static void link_key_request(int index, bdaddr_t *dba)
350{
351	struct btd_adapter *adapter;
352	struct btd_device *device;
353	struct hci_auth_info_req req;
354	unsigned char key[16];
355	char sa[18], da[18];
356	uint8_t type;
357	int err;
358
359	ba2str(&BDADDR(index), sa); ba2str(dba, da);
360	info("link_key_request (sba=%s, dba=%s)", sa, da);
361
362	adapter = manager_find_adapter(&BDADDR(index));
363	if (adapter)
364		device = adapter_find_device(adapter, da);
365	else
366		device = NULL;
367
368	memset(&req, 0, sizeof(req));
369	bacpy(&req.bdaddr, dba);
370
371	err = ioctl(SK(index), HCIGETAUTHINFO, (unsigned long) &req);
372	if (err < 0) {
373		if (errno != EINVAL)
374			DBG("HCIGETAUTHINFO failed %s (%d)",
375						strerror(errno), errno);
376		req.type = 0x00;
377	}
378
379	DBG("kernel auth requirements = 0x%02x", req.type);
380
381	if (main_opts.debug_keys && device && device_get_debug_key(device, key))
382		type = 0x03;
383	else if (read_link_key(&BDADDR(index), dba, key, &type) < 0 ||
384								type == 0x03) {
385		/* Link key not found */
386		hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_LINK_KEY_NEG_REPLY,
387								6, dba);
388		return;
389	}
390
391	/* Link key found */
392
393	DBG("link key type = 0x%02x", type);
394
395	/* Don't use unauthenticated combination keys if MITM is
396	 * required */
397	if (type == 0x04 && req.type != 0xff && (req.type & 0x01))
398		hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_LINK_KEY_NEG_REPLY,
399								6, dba);
400	else {
401		link_key_reply_cp lr;
402
403		memcpy(lr.link_key, key, 16);
404		bacpy(&lr.bdaddr, dba);
405
406		hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_LINK_KEY_REPLY,
407						LINK_KEY_REPLY_CP_SIZE, &lr);
408	}
409}
410
411static void link_key_notify(int index, void *ptr)
412{
413	evt_link_key_notify *evt = ptr;
414	bdaddr_t *dba = &evt->bdaddr;
415	char sa[18], da[18];
416	int err;
417	unsigned char old_key[16];
418	uint8_t old_key_type;
419
420	ba2str(&BDADDR(index), sa); ba2str(dba, da);
421	info("link_key_notify (sba=%s, dba=%s, type=%d)", sa, da,
422							evt->key_type);
423
424	err = read_link_key(&BDADDR(index), dba, old_key, &old_key_type);
425	if (err < 0)
426		old_key_type = 0xff;
427
428	err = btd_event_link_key_notify(&BDADDR(index), dba, evt->link_key,
429					evt->key_type, PIN_LENGTH(index),
430					old_key_type);
431	PIN_LENGTH(index) = -1;
432
433	if (err < 0) {
434		uint16_t handle;
435
436		if (err == -ENODEV)
437			btd_event_bonding_process_complete(&BDADDR(index), dba,
438							HCI_OE_LOW_RESOURCES);
439		else
440			btd_event_bonding_process_complete(&BDADDR(index), dba,
441							HCI_MEMORY_FULL);
442
443		if (get_handle(index, dba, &handle) == 0) {
444			disconnect_cp cp;
445
446			memset(&cp, 0, sizeof(cp));
447			cp.handle = htobs(handle);
448			cp.reason = HCI_OE_LOW_RESOURCES;
449
450			hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_DISCONNECT,
451						DISCONNECT_CP_SIZE, &cp);
452		}
453	}
454}
455
456static void return_link_keys(int index, void *ptr)
457{
458	evt_return_link_keys *evt = ptr;
459	uint8_t num = evt->num_keys;
460	unsigned char key[16];
461	char sa[18], da[18];
462	bdaddr_t dba;
463	int i;
464
465	ba2str(&BDADDR(index), sa);
466	ptr++;
467
468	for (i = 0; i < num; i++) {
469		bacpy(&dba, ptr); ba2str(&dba, da);
470		memcpy(key, ptr + 6, 16);
471
472		info("return_link_keys (sba=%s, dba=%s)", sa, da);
473
474		btd_event_returned_link_key(&BDADDR(index), &dba);
475
476		ptr += 22;
477	}
478}
479
480/* Simple Pairing handling */
481
482static void user_confirm_request(int index, void *ptr)
483{
484	evt_user_confirm_request *req = ptr;
485
486	if (btd_event_user_confirm(&BDADDR(index), &req->bdaddr,
487					btohl(req->passkey)) < 0)
488		hci_send_cmd(SK(index), OGF_LINK_CTL,
489				OCF_USER_CONFIRM_NEG_REPLY, 6, ptr);
490}
491
492static void user_passkey_request(int index, void *ptr)
493{
494	evt_user_passkey_request *req = ptr;
495
496	if (btd_event_user_passkey(&BDADDR(index), &req->bdaddr) < 0)
497		hci_send_cmd(SK(index), OGF_LINK_CTL,
498				OCF_USER_PASSKEY_NEG_REPLY, 6, ptr);
499}
500
501static void user_passkey_notify(int index, void *ptr)
502{
503	evt_user_passkey_notify *req = ptr;
504
505	btd_event_user_notify(&BDADDR(index), &req->bdaddr,
506						btohl(req->passkey));
507}
508
509static void remote_oob_data_request(int index, void *ptr)
510{
511	hci_send_cmd(SK(index), OGF_LINK_CTL,
512				OCF_REMOTE_OOB_DATA_NEG_REPLY, 6, ptr);
513}
514
515static void io_capa_request(int index, void *ptr)
516{
517	bdaddr_t *dba = ptr;
518	char sa[18], da[18];
519	uint8_t cap, auth;
520
521	ba2str(&BDADDR(index), sa); ba2str(dba, da);
522	info("io_capa_request (sba=%s, dba=%s)", sa, da);
523
524	if (btd_event_get_io_cap(&BDADDR(index), dba, &cap, &auth) < 0) {
525		io_capability_neg_reply_cp cp;
526		memset(&cp, 0, sizeof(cp));
527		bacpy(&cp.bdaddr, dba);
528		cp.reason = HCI_PAIRING_NOT_ALLOWED;
529		hci_send_cmd(SK(index), OGF_LINK_CTL,
530					OCF_IO_CAPABILITY_NEG_REPLY,
531					IO_CAPABILITY_NEG_REPLY_CP_SIZE, &cp);
532	} else {
533		io_capability_reply_cp cp;
534		memset(&cp, 0, sizeof(cp));
535		bacpy(&cp.bdaddr, dba);
536		cp.capability = cap;
537		cp.oob_data = 0x00;
538		cp.authentication = auth;
539		hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_IO_CAPABILITY_REPLY,
540					IO_CAPABILITY_REPLY_CP_SIZE, &cp);
541	}
542}
543
544static void io_capa_response(int index, void *ptr)
545{
546	evt_io_capability_response *evt = ptr;
547	char sa[18], da[18];
548
549	ba2str(&BDADDR(index), sa); ba2str(&evt->bdaddr, da);
550	info("io_capa_response (sba=%s, dba=%s)", sa, da);
551
552	btd_event_set_io_cap(&BDADDR(index), &evt->bdaddr,
553				evt->capability, evt->authentication);
554}
555
556/* PIN code handling */
557
558static void pin_code_request(int index, bdaddr_t *dba)
559{
560	pin_code_reply_cp pr;
561	struct hci_conn_info_req *cr;
562	struct hci_conn_info *ci;
563	char sa[18], da[18], pin[17];
564	int pinlen;
565
566	memset(&pr, 0, sizeof(pr));
567	bacpy(&pr.bdaddr, dba);
568
569	ba2str(&BDADDR(index), sa); ba2str(dba, da);
570	info("pin_code_request (sba=%s, dba=%s)", sa, da);
571
572	cr = g_malloc0(sizeof(*cr) + sizeof(*ci));
573
574	bacpy(&cr->bdaddr, dba);
575	cr->type = ACL_LINK;
576	if (ioctl(SK(index), HCIGETCONNINFO, (unsigned long) cr) < 0) {
577		error("Can't get conn info: %s (%d)", strerror(errno), errno);
578		goto reject;
579	}
580	ci = cr->conn_info;
581
582	memset(pin, 0, sizeof(pin));
583	pinlen = read_pin_code(&BDADDR(index), dba, pin);
584
585	if (pinlen > 0) {
586		PIN_LENGTH(index) = pinlen;
587		memcpy(pr.pin_code, pin, pinlen);
588		pr.pin_len = pinlen;
589		hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_PIN_CODE_REPLY,
590						PIN_CODE_REPLY_CP_SIZE, &pr);
591	} else {
592		/* Request PIN from passkey agent */
593		if (btd_event_request_pin(&BDADDR(index), ci) < 0)
594			goto reject;
595	}
596
597	g_free(cr);
598
599	return;
600
601reject:
602	g_free(cr);
603
604	hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_PIN_CODE_NEG_REPLY, 6, dba);
605}
606
607static void start_inquiry(bdaddr_t *local, uint8_t status, gboolean periodic)
608{
609	struct btd_adapter *adapter;
610	int state;
611
612	/* Don't send the signal if the cmd failed */
613	if (status) {
614		error("Inquiry Failed with status 0x%02x", status);
615		return;
616	}
617
618	adapter = manager_find_adapter(local);
619	if (!adapter) {
620		error("Unable to find matching adapter");
621		return;
622	}
623
624	state = adapter_get_state(adapter);
625
626	if (periodic)
627		state |= STATE_PINQ;
628	else
629		state |= STATE_STDINQ;
630
631	adapter_set_state(adapter, state);
632}
633
634static void inquiry_complete(bdaddr_t *local, uint8_t status, gboolean periodic)
635{
636	struct btd_adapter *adapter;
637	int state;
638
639	/* Don't send the signal if the cmd failed */
640	if (status) {
641		error("Inquiry Failed with status 0x%02x", status);
642		return;
643	}
644
645	adapter = manager_find_adapter(local);
646	if (!adapter) {
647		error("Unable to find matching adapter");
648		return;
649	}
650
651	state = adapter_get_state(adapter);
652	state &= ~(STATE_STDINQ | STATE_PINQ);
653	adapter_set_state(adapter, state);
654}
655
656static inline void remote_features_notify(int index, void *ptr)
657{
658	evt_remote_host_features_notify *evt = ptr;
659
660	if (evt->features[0] & 0x01)
661		btd_event_set_legacy_pairing(&BDADDR(index), &evt->bdaddr,
662									FALSE);
663	else
664		btd_event_set_legacy_pairing(&BDADDR(index), &evt->bdaddr,
665									TRUE);
666
667	write_features_info(&BDADDR(index), &evt->bdaddr, NULL, evt->features);
668}
669
670static void write_le_host_complete(bdaddr_t *sba, uint8_t status)
671{
672	struct btd_adapter *adapter;
673
674	if (status)
675		return;
676
677	adapter = manager_find_adapter(sba);
678	if (!adapter) {
679		error("No matching adapter found");
680		return;
681	}
682
683	btd_adapter_read_local_ext_features(adapter);
684}
685
686static void read_local_ext_features_complete(bdaddr_t *sba,
687				const read_local_ext_features_rp *rp)
688{
689	struct btd_adapter *adapter;
690
691	if (rp->status)
692		return;
693
694	adapter = manager_find_adapter(sba);
695	if (!adapter) {
696		error("No matching adapter found");
697		return;
698	}
699
700	/* Local Extended feature page number is 1 */
701	if (rp->page_num != 1)
702		return;
703
704	btd_adapter_update_local_ext_features(adapter, rp->features);
705}
706
707static void read_bd_addr_complete(int index, read_bd_addr_rp *rp)
708{
709	if (rp->status)
710		return;
711
712	bacpy(&BDADDR(index), &rp->bdaddr);
713
714	if (READY(index))
715		return;
716
717	READY(index) = TRUE;
718
719	info("Got bdaddr for hci%d", index);
720
721	if (UP(index))
722		manager_start_adapter(index);
723}
724
725static inline void cmd_status(int index, void *ptr)
726{
727	evt_cmd_status *evt = ptr;
728	uint16_t opcode = btohs(evt->opcode);
729
730	if (opcode == cmd_opcode_pack(OGF_LINK_CTL, OCF_INQUIRY))
731		start_inquiry(&BDADDR(index), evt->status, FALSE);
732}
733
734static void read_scan_complete(int index, uint8_t status, void *ptr)
735{
736	struct btd_adapter *adapter;
737	read_scan_enable_rp *rp = ptr;
738
739	adapter = manager_find_adapter(&BDADDR(index));
740
741	if (!adapter) {
742		error("Unable to find matching adapter");
743		return;
744	}
745
746	adapter_mode_changed(adapter, rp->enable);
747}
748
749static inline void cmd_complete(int index, void *ptr)
750{
751	evt_cmd_complete *evt = ptr;
752	uint16_t opcode = btohs(evt->opcode);
753	uint8_t status = *((uint8_t *) ptr + EVT_CMD_COMPLETE_SIZE);
754
755	switch (opcode) {
756	case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_LOCAL_EXT_FEATURES):
757		ptr += sizeof(evt_cmd_complete);
758		read_local_ext_features_complete(&BDADDR(index), ptr);
759		break;
760	case cmd_opcode_pack(OGF_INFO_PARAM, OCF_READ_BD_ADDR):
761		ptr += sizeof(evt_cmd_complete);
762		read_bd_addr_complete(index, ptr);
763		break;
764	case cmd_opcode_pack(OGF_LINK_CTL, OCF_PERIODIC_INQUIRY):
765		start_inquiry(&BDADDR(index), status, TRUE);
766		break;
767	case cmd_opcode_pack(OGF_LINK_CTL, OCF_EXIT_PERIODIC_INQUIRY):
768		inquiry_complete(&BDADDR(index), status, TRUE);
769		break;
770	case cmd_opcode_pack(OGF_LINK_CTL, OCF_INQUIRY_CANCEL):
771		inquiry_complete(&BDADDR(index), status, FALSE);
772		break;
773	case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_LE_HOST_SUPPORTED):
774		write_le_host_complete(&BDADDR(index), status);
775		break;
776	case cmd_opcode_pack(OGF_LE_CTL, OCF_LE_SET_SCAN_ENABLE):
777		btd_event_le_set_scan_enable_complete(&BDADDR(index), status);
778		break;
779	case cmd_opcode_pack(OGF_HOST_CTL, OCF_CHANGE_LOCAL_NAME):
780		adapter_setname_complete(&BDADDR(index), status);
781		break;
782	case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE):
783		btd_event_setscan_enable_complete(&BDADDR(index));
784		break;
785	case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_SCAN_ENABLE):
786		ptr += sizeof(evt_cmd_complete);
787		read_scan_complete(index, status, ptr);
788		break;
789	case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_CLASS_OF_DEV):
790		adapter_set_class_complete(&BDADDR(index), status);
791		break;
792	case cmd_opcode_pack(OGF_HOST_CTL, OCF_WRITE_SIMPLE_PAIRING_MODE):
793		btd_event_write_simple_pairing_mode_complete(&BDADDR(index));
794		break;
795	case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_SIMPLE_PAIRING_MODE):
796		ptr += sizeof(evt_cmd_complete);
797		btd_event_read_simple_pairing_mode_complete(&BDADDR(index),
798									ptr);
799		break;
800	case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_LOCAL_NAME):
801		ptr += sizeof(evt_cmd_complete);
802		adapter_update_local_name(&BDADDR(index), status, ptr);
803		break;
804	case cmd_opcode_pack(OGF_HOST_CTL, OCF_READ_INQ_RESPONSE_TX_POWER_LEVEL):
805		ptr += sizeof(evt_cmd_complete);
806		adapter_update_tx_power(&BDADDR(index), status, ptr);
807		break;
808	};
809}
810
811static inline void remote_name_information(int index, void *ptr)
812{
813	evt_remote_name_req_complete *evt = ptr;
814	char name[MAX_NAME_LENGTH + 1];
815
816	memset(name, 0, sizeof(name));
817
818	if (!evt->status)
819		memcpy(name, evt->name, MAX_NAME_LENGTH);
820
821	btd_event_remote_name(&BDADDR(index), &evt->bdaddr, evt->status, name);
822}
823
824static inline void remote_version_information(int index, void *ptr)
825{
826	evt_read_remote_version_complete *evt = ptr;
827	bdaddr_t dba;
828
829	if (evt->status)
830		return;
831
832	if (get_bdaddr(index, btohs(evt->handle), &dba) < 0)
833		return;
834
835	write_version_info(&BDADDR(index), &dba, btohs(evt->manufacturer),
836				evt->lmp_ver, btohs(evt->lmp_subver));
837}
838
839static inline void inquiry_result(int index, int plen, void *ptr)
840{
841	uint8_t num = *(uint8_t *) ptr++;
842	int i;
843
844	for (i = 0; i < num; i++) {
845		inquiry_info *info = ptr;
846		uint32_t class = info->dev_class[0] |
847						(info->dev_class[1] << 8) |
848						(info->dev_class[2] << 16);
849
850		btd_event_inquiry_result(&BDADDR(index), &info->bdaddr, class,
851								0, NULL);
852
853		update_lastseen(&BDADDR(index), &info->bdaddr);
854
855		ptr += INQUIRY_INFO_SIZE;
856	}
857}
858
859static inline void inquiry_result_with_rssi(int index, int plen, void *ptr)
860{
861	uint8_t num = *(uint8_t *) ptr++;
862	int i;
863
864	if (!num)
865		return;
866
867	if ((plen - 1) / num == INQUIRY_INFO_WITH_RSSI_AND_PSCAN_MODE_SIZE) {
868		for (i = 0; i < num; i++) {
869			inquiry_info_with_rssi_and_pscan_mode *info = ptr;
870			uint32_t class = info->dev_class[0]
871						| (info->dev_class[1] << 8)
872						| (info->dev_class[2] << 16);
873
874			btd_event_inquiry_result(&BDADDR(index), &info->bdaddr,
875						class, info->rssi, NULL);
876
877			update_lastseen(&BDADDR(index), &info->bdaddr);
878
879			ptr += INQUIRY_INFO_WITH_RSSI_AND_PSCAN_MODE_SIZE;
880		}
881	} else {
882		for (i = 0; i < num; i++) {
883			inquiry_info_with_rssi *info = ptr;
884			uint32_t class = info->dev_class[0]
885						| (info->dev_class[1] << 8)
886						| (info->dev_class[2] << 16);
887
888			btd_event_inquiry_result(&BDADDR(index), &info->bdaddr,
889						class, info->rssi, NULL);
890
891			update_lastseen(&BDADDR(index), &info->bdaddr);
892
893			ptr += INQUIRY_INFO_WITH_RSSI_SIZE;
894		}
895	}
896}
897
898static inline void extended_inquiry_result(int index, int plen, void *ptr)
899{
900	uint8_t num = *(uint8_t *) ptr++;
901	int i;
902
903	for (i = 0; i < num; i++) {
904		extended_inquiry_info *info = ptr;
905		uint32_t class = info->dev_class[0]
906					| (info->dev_class[1] << 8)
907					| (info->dev_class[2] << 16);
908
909		btd_event_inquiry_result(&BDADDR(index), &info->bdaddr, class,
910						info->rssi, info->data);
911
912		update_lastseen(&BDADDR(index), &info->bdaddr);
913
914		ptr += EXTENDED_INQUIRY_INFO_SIZE;
915	}
916}
917
918static inline void remote_features_information(int index, void *ptr)
919{
920	evt_read_remote_features_complete *evt = ptr;
921	bdaddr_t dba;
922
923	if (evt->status)
924		return;
925
926	if (get_bdaddr(index, btohs(evt->handle), &dba) < 0)
927		return;
928
929	write_features_info(&BDADDR(index), &dba, evt->features, NULL);
930}
931
932static inline void conn_complete(int index, void *ptr)
933{
934	evt_conn_complete *evt = ptr;
935	char filename[PATH_MAX];
936	char local_addr[18], peer_addr[18], *str;
937	struct btd_adapter *adapter;
938
939	adapter = manager_find_adapter(&BDADDR(index));
940	if (!adapter) {
941		error("Unable to find matching adapter");
942		return;
943	}
944
945	if (evt->link_type != ACL_LINK)
946		return;
947
948	btd_event_conn_complete(&BDADDR(index), evt->status,
949					btohs(evt->handle), &evt->bdaddr);
950
951	if (evt->status)
952		return;
953
954	update_lastused(&BDADDR(index), &evt->bdaddr);
955
956	/* check if the remote version needs be requested */
957	ba2str(&BDADDR(index), local_addr);
958	ba2str(&evt->bdaddr, peer_addr);
959
960	create_name(filename, sizeof(filename), STORAGEDIR, local_addr,
961							"manufacturers");
962
963	str = textfile_get(filename, peer_addr);
964	if (!str)
965		btd_adapter_get_remote_version(adapter, btohs(evt->handle),
966									TRUE);
967	else
968		free(str);
969}
970
971static inline void disconn_complete(int index, void *ptr)
972{
973	evt_disconn_complete *evt = ptr;
974
975	btd_event_disconn_complete(&BDADDR(index), evt->status,
976					btohs(evt->handle), evt->reason);
977}
978
979static inline void auth_complete(int index, void *ptr)
980{
981	evt_auth_complete *evt = ptr;
982	bdaddr_t dba;
983
984	if (get_bdaddr(index, btohs(evt->handle), &dba) < 0)
985		return;
986
987	btd_event_bonding_process_complete(&BDADDR(index), &dba, evt->status);
988}
989
990static inline void simple_pairing_complete(int index, void *ptr)
991{
992	evt_simple_pairing_complete *evt = ptr;
993
994	btd_event_simple_pairing_complete(&BDADDR(index), &evt->bdaddr,
995								evt->status);
996}
997
998static inline void conn_request(int index, void *ptr)
999{
1000	evt_conn_request *evt = ptr;
1001	uint32_t class = evt->dev_class[0] | (evt->dev_class[1] << 8)
1002				| (evt->dev_class[2] << 16);
1003
1004	btd_event_remote_class(&BDADDR(index), &evt->bdaddr, class);
1005}
1006
1007static inline void le_metaevent(int index, void *ptr)
1008{
1009	evt_le_meta_event *meta = ptr;
1010	le_advertising_info *info;
1011	uint8_t *rssi, num, i;
1012
1013	DBG("LE Meta Event");
1014
1015	if (meta->subevent != EVT_LE_ADVERTISING_REPORT)
1016		return;
1017
1018	num = meta->data[0];
1019	info = (le_advertising_info *) (meta->data + 1);
1020
1021	for (i = 0; i < num; i++) {
1022		/* RSSI is last byte of the advertising report event */
1023		rssi = info->data + info->length;
1024		btd_event_inquiry_result(&BDADDR(index), &info->bdaddr, 0,
1025								*rssi, NULL);
1026		info = (le_advertising_info *) (rssi + 1);
1027	}
1028}
1029
1030static void stop_hci_dev(int index)
1031{
1032	GIOChannel *chan = CHANNEL(index);
1033
1034	if (!chan)
1035		return;
1036
1037	info("Stopping hci%d event socket", index);
1038
1039	g_source_remove(WATCH_ID(index));
1040	g_io_channel_unref(CHANNEL(index));
1041	hci_close_dev(SK(index));
1042	init_dev_info(index, -1);
1043}
1044
1045static gboolean io_security_event(GIOChannel *chan, GIOCondition cond,
1046								gpointer data)
1047{
1048	unsigned char buf[HCI_MAX_EVENT_SIZE], *ptr = buf;
1049	int type, index = GPOINTER_TO_INT(data);
1050	struct hci_dev_info di;
1051	size_t len;
1052	hci_event_hdr *eh;
1053	GIOError err;
1054	evt_cmd_status *evt;
1055
1056	if (cond & (G_IO_NVAL | G_IO_HUP | G_IO_ERR)) {
1057		stop_hci_dev(index);
1058		return FALSE;
1059	}
1060
1061	if ((err = g_io_channel_read(chan, (gchar *) buf, sizeof(buf), &len))) {
1062		if (err == G_IO_ERROR_AGAIN)
1063			return TRUE;
1064		stop_hci_dev(index);
1065		return FALSE;
1066	}
1067
1068	type = *ptr++;
1069
1070	if (type != HCI_EVENT_PKT)
1071		return TRUE;
1072
1073	eh = (hci_event_hdr *) ptr;
1074	ptr += HCI_EVENT_HDR_SIZE;
1075
1076	memset(&di, 0, sizeof(di));
1077	if (hci_devinfo(index, &di) == 0) {
1078		bacpy(&BDADDR(index), &di.bdaddr);
1079
1080		if (ignore_device(&di))
1081			return TRUE;
1082	}
1083
1084	switch (eh->evt) {
1085	case EVT_CMD_STATUS:
1086		cmd_status(index, ptr);
1087		break;
1088
1089	case EVT_CMD_COMPLETE:
1090		cmd_complete(index, ptr);
1091		break;
1092
1093	case EVT_REMOTE_NAME_REQ_COMPLETE:
1094		remote_name_information(index, ptr);
1095		break;
1096
1097	case EVT_READ_REMOTE_VERSION_COMPLETE:
1098		remote_version_information(index, ptr);
1099		break;
1100
1101	case EVT_READ_REMOTE_FEATURES_COMPLETE:
1102		remote_features_information(index, ptr);
1103		break;
1104
1105	case EVT_REMOTE_HOST_FEATURES_NOTIFY:
1106		remote_features_notify(index, ptr);
1107		break;
1108
1109	case EVT_INQUIRY_COMPLETE:
1110		evt = (evt_cmd_status *) ptr;
1111		inquiry_complete(&BDADDR(index), evt->status, FALSE);
1112		break;
1113
1114	case EVT_INQUIRY_RESULT:
1115		inquiry_result(index, eh->plen, ptr);
1116		break;
1117
1118	case EVT_INQUIRY_RESULT_WITH_RSSI:
1119		inquiry_result_with_rssi(index, eh->plen, ptr);
1120		break;
1121
1122	case EVT_EXTENDED_INQUIRY_RESULT:
1123		extended_inquiry_result(index, eh->plen, ptr);
1124		break;
1125
1126	case EVT_CONN_COMPLETE:
1127		conn_complete(index, ptr);
1128		break;
1129
1130	case EVT_DISCONN_COMPLETE:
1131		disconn_complete(index, ptr);
1132		break;
1133
1134	case EVT_AUTH_COMPLETE:
1135		auth_complete(index, ptr);
1136		break;
1137
1138	case EVT_SIMPLE_PAIRING_COMPLETE:
1139		simple_pairing_complete(index, ptr);
1140		break;
1141
1142	case EVT_CONN_REQUEST:
1143		conn_request(index, ptr);
1144		break;
1145	case EVT_LE_META_EVENT:
1146		le_metaevent(index, ptr);
1147		break;
1148	case EVT_PIN_CODE_REQ:
1149		pin_code_request(index, (bdaddr_t *) ptr);
1150		break;
1151
1152	case EVT_LINK_KEY_REQ:
1153		link_key_request(index, (bdaddr_t *) ptr);
1154		break;
1155
1156	case EVT_LINK_KEY_NOTIFY:
1157		link_key_notify(index, ptr);
1158		break;
1159
1160	case EVT_RETURN_LINK_KEYS:
1161		return_link_keys(index, ptr);
1162		break;
1163
1164	case EVT_IO_CAPABILITY_REQUEST:
1165		io_capa_request(index, ptr);
1166		break;
1167
1168	case EVT_IO_CAPABILITY_RESPONSE:
1169		io_capa_response(index, ptr);
1170		break;
1171
1172	case EVT_USER_CONFIRM_REQUEST:
1173		user_confirm_request(index, ptr);
1174		break;
1175
1176	case EVT_USER_PASSKEY_REQUEST:
1177		user_passkey_request(index, ptr);
1178		break;
1179
1180	case EVT_USER_PASSKEY_NOTIFY:
1181		user_passkey_notify(index, ptr);
1182		break;
1183
1184	case EVT_REMOTE_OOB_DATA_REQUEST:
1185		remote_oob_data_request(index, ptr);
1186		break;
1187	}
1188
1189	return TRUE;
1190}
1191
1192static void start_hci_dev(int index)
1193{
1194	GIOChannel *chan = CHANNEL(index);
1195	struct hci_filter flt;
1196
1197	if (chan)
1198		return;
1199
1200	info("Listening for HCI events on hci%d", index);
1201
1202	/* Set filter */
1203	hci_filter_clear(&flt);
1204	hci_filter_set_ptype(HCI_EVENT_PKT, &flt);
1205	hci_filter_set_event(EVT_CMD_STATUS, &flt);
1206	hci_filter_set_event(EVT_CMD_COMPLETE, &flt);
1207	hci_filter_set_event(EVT_PIN_CODE_REQ, &flt);
1208	hci_filter_set_event(EVT_LINK_KEY_REQ, &flt);
1209	hci_filter_set_event(EVT_LINK_KEY_NOTIFY, &flt);
1210	hci_filter_set_event(EVT_RETURN_LINK_KEYS, &flt);
1211	hci_filter_set_event(EVT_IO_CAPABILITY_REQUEST, &flt);
1212	hci_filter_set_event(EVT_IO_CAPABILITY_RESPONSE, &flt);
1213	hci_filter_set_event(EVT_USER_CONFIRM_REQUEST, &flt);
1214	hci_filter_set_event(EVT_USER_PASSKEY_REQUEST, &flt);
1215	hci_filter_set_event(EVT_REMOTE_OOB_DATA_REQUEST, &flt);
1216	hci_filter_set_event(EVT_USER_PASSKEY_NOTIFY, &flt);
1217	hci_filter_set_event(EVT_KEYPRESS_NOTIFY, &flt);
1218	hci_filter_set_event(EVT_SIMPLE_PAIRING_COMPLETE, &flt);
1219	hci_filter_set_event(EVT_AUTH_COMPLETE, &flt);
1220	hci_filter_set_event(EVT_REMOTE_NAME_REQ_COMPLETE, &flt);
1221	hci_filter_set_event(EVT_READ_REMOTE_VERSION_COMPLETE, &flt);
1222	hci_filter_set_event(EVT_READ_REMOTE_FEATURES_COMPLETE, &flt);
1223	hci_filter_set_event(EVT_REMOTE_HOST_FEATURES_NOTIFY, &flt);
1224	hci_filter_set_event(EVT_INQUIRY_COMPLETE, &flt);
1225	hci_filter_set_event(EVT_INQUIRY_RESULT, &flt);
1226	hci_filter_set_event(EVT_INQUIRY_RESULT_WITH_RSSI, &flt);
1227	hci_filter_set_event(EVT_EXTENDED_INQUIRY_RESULT, &flt);
1228	hci_filter_set_event(EVT_CONN_REQUEST, &flt);
1229	hci_filter_set_event(EVT_CONN_COMPLETE, &flt);
1230	hci_filter_set_event(EVT_DISCONN_COMPLETE, &flt);
1231	hci_filter_set_event(EVT_LE_META_EVENT, &flt);
1232	if (setsockopt(SK(index), SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
1233		error("Can't set filter on hci%d: %s (%d)",
1234						index, strerror(errno), errno);
1235		return;
1236	}
1237
1238	chan = g_io_channel_unix_new(SK(index));
1239	WATCH_ID(index) = g_io_add_watch_full(chan, G_PRIORITY_LOW,
1240						G_IO_IN | G_IO_NVAL | G_IO_HUP | G_IO_ERR,
1241						io_security_event, GINT_TO_POINTER(index),
1242						NULL);
1243	CHANNEL(index) = chan;
1244	PIN_LENGTH(index) = -1;
1245
1246}
1247
1248/* End of HCI event callbacks */
1249
1250static gboolean child_exit(GIOChannel *io, GIOCondition cond, void *user_data)
1251{
1252	int status, fd = g_io_channel_unix_get_fd(io);
1253	pid_t child_pid;
1254
1255	if (read(fd, &child_pid, sizeof(child_pid)) != sizeof(child_pid)) {
1256		error("child_exit: unable to read child pid from pipe");
1257		return TRUE;
1258	}
1259
1260	if (waitpid(child_pid, &status, 0) != child_pid)
1261		error("waitpid(%d) failed", child_pid);
1262	else
1263		DBG("child %d exited", child_pid);
1264
1265	return TRUE;
1266}
1267
1268static void at_child_exit(void)
1269{
1270	pid_t pid = getpid();
1271
1272	if (write(child_pipe[1], &pid, sizeof(pid)) != sizeof(pid))
1273		error("unable to write to child pipe");
1274}
1275
1276static void device_devup_setup(int index)
1277{
1278	struct hci_dev_info di;
1279	uint16_t policy;
1280	read_stored_link_key_cp cp;
1281
1282	if (hci_devinfo(index, &di) < 0)
1283		return;
1284
1285	if (ignore_device(&di))
1286		return;
1287
1288	bacpy(&BDADDR(index), &di.bdaddr);
1289
1290	/* Set page timeout */
1291	if ((main_opts.flags & (1 << HCID_SET_PAGETO))) {
1292		write_page_timeout_cp cp;
1293
1294		cp.timeout = htobs(main_opts.pageto);
1295		hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_WRITE_PAGE_TIMEOUT,
1296					WRITE_PAGE_TIMEOUT_CP_SIZE, &cp);
1297	}
1298
1299	/* Set default link policy */
1300	policy = htobs(main_opts.link_policy);
1301	hci_send_cmd(SK(index), OGF_LINK_POLICY,
1302				OCF_WRITE_DEFAULT_LINK_POLICY, 2, &policy);
1303
1304	bacpy(&cp.bdaddr, BDADDR_ANY);
1305	cp.read_all = 1;
1306	hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_READ_STORED_LINK_KEY,
1307			READ_STORED_LINK_KEY_CP_SIZE, (void *) &cp);
1308
1309	if (READY(index))
1310		manager_start_adapter(index);
1311}
1312
1313static void init_device(int index)
1314{
1315	struct hci_dev_req dr;
1316	struct hci_dev_info di;
1317	int dd;
1318	pid_t pid;
1319
1320	dd = hci_open_dev(index);
1321	if (dd < 0) {
1322		error("Unable to open hci%d: %s (%d)", index,
1323						strerror(errno), errno);
1324		return;
1325	}
1326
1327	if (index > max_dev) {
1328		max_dev = index;
1329		devs = g_realloc(devs, sizeof(devs[0]) * (max_dev + 1));
1330	}
1331
1332	init_dev_info(index, dd);
1333	start_hci_dev(index);
1334
1335	/* Do initialization in the separate process */
1336	pid = fork();
1337	switch (pid) {
1338		case 0:
1339			atexit(at_child_exit);
1340			break;
1341		case -1:
1342			error("Fork failed. Can't init device hci%d: %s (%d)",
1343					index, strerror(errno), errno);
1344		default:
1345			DBG("child %d forked", pid);
1346			return;
1347	}
1348
1349	memset(&dr, 0, sizeof(dr));
1350	dr.dev_id = index;
1351
1352	/* Set link mode */
1353	dr.dev_opt = main_opts.link_mode;
1354	if (ioctl(dd, HCISETLINKMODE, (unsigned long) &dr) < 0)
1355		error("Can't set link mode on hci%d: %s (%d)",
1356						index, strerror(errno), errno);
1357
1358	/* Set link policy for BR/EDR HCI devices */
1359	if (hci_devinfo(index, &di) < 0)
1360		goto fail;
1361
1362	if (!ignore_device(&di)) {
1363		dr.dev_opt = main_opts.link_policy;
1364		if (ioctl(dd, HCISETLINKPOL, (unsigned long) &dr) < 0 &&
1365							errno != ENETDOWN) {
1366			error("Can't set link policy on hci%d: %s (%d)",
1367						index, strerror(errno), errno);
1368		}
1369	}
1370
1371	/* Start HCI device */
1372	if (ioctl(dd, HCIDEVUP, index) < 0 && errno != EALREADY) {
1373		error("Can't init device hci%d: %s (%d)",
1374					index, strerror(errno), errno);
1375		goto fail;
1376	}
1377
1378	hci_close_dev(dd);
1379	exit(0);
1380
1381fail:
1382	hci_close_dev(dd);
1383	exit(1);
1384}
1385
1386static void device_devreg_setup(int index)
1387{
1388	struct hci_dev_info di;
1389	gboolean devup;
1390
1391	init_device(index);
1392
1393	memset(&di, 0, sizeof(di));
1394
1395	if (hci_devinfo(index, &di) < 0)
1396		return;
1397
1398	devup = hci_test_bit(HCI_UP, &di.flags);
1399
1400	if (!ignore_device(&di))
1401		manager_register_adapter(index, devup);
1402}
1403
1404static void device_event(int event, int index)
1405{
1406	switch (event) {
1407	case HCI_DEV_REG:
1408		info("HCI dev %d registered", index);
1409		device_devreg_setup(index);
1410		break;
1411
1412	case HCI_DEV_UNREG:
1413		info("HCI dev %d unregistered", index);
1414		stop_hci_dev(index);
1415		manager_unregister_adapter(index);
1416		break;
1417
1418	case HCI_DEV_UP:
1419		info("HCI dev %d up", index);
1420		UP(index) = TRUE;
1421		device_devup_setup(index);
1422		break;
1423
1424	case HCI_DEV_DOWN:
1425		info("HCI dev %d down", index);
1426		UP(index) = FALSE;
1427		if (READY(index)) {
1428			manager_stop_adapter(index);
1429			READY(index) = FALSE;
1430		}
1431		break;
1432	}
1433}
1434
1435static gboolean init_known_adapters(gpointer user_data)
1436{
1437	struct hci_dev_list_req *dl;
1438	struct hci_dev_req *dr;
1439	int i, err, ctl = GPOINTER_TO_INT(user_data);
1440	size_t req_size;
1441
1442	req_size = HCI_MAX_DEV * sizeof(struct hci_dev_req) + sizeof(uint16_t);
1443
1444	dl = g_try_malloc0(req_size);
1445	if (!dl) {
1446		error("Can't allocate devlist buffer");
1447		return FALSE;
1448	}
1449
1450	dl->dev_num = HCI_MAX_DEV;
1451	dr = dl->dev_req;
1452
1453	if (ioctl(ctl, HCIGETDEVLIST, dl) < 0) {
1454		err = -errno;
1455		error("Can't get device list: %s (%d)", strerror(-err), -err);
1456		g_free(dl);
1457		return FALSE;
1458	}
1459
1460	for (i = 0; i < dl->dev_num; i++, dr++) {
1461		device_event(HCI_DEV_REG, dr->dev_id);
1462
1463		if (hci_test_bit(HCI_UP, &dr->dev_opt))
1464			device_event(HCI_DEV_UP, dr->dev_id);
1465	}
1466
1467	g_free(dl);
1468
1469	return FALSE;
1470}
1471
1472static gboolean io_stack_event(GIOChannel *chan, GIOCondition cond,
1473								gpointer data)
1474{
1475	unsigned char buf[HCI_MAX_FRAME_SIZE], *ptr;
1476	evt_stack_internal *si;
1477	evt_si_device *sd;
1478	hci_event_hdr *eh;
1479	int type;
1480	size_t len;
1481	GIOError err;
1482
1483	ptr = buf;
1484
1485	err = g_io_channel_read(chan, (gchar *) buf, sizeof(buf), &len);
1486	if (err) {
1487		if (err == G_IO_ERROR_AGAIN)
1488			return TRUE;
1489
1490		error("Read from control socket failed: %s (%d)",
1491						strerror(errno), errno);
1492		return FALSE;
1493	}
1494
1495	type = *ptr++;
1496
1497	if (type != HCI_EVENT_PKT)
1498		return TRUE;
1499
1500	eh = (hci_event_hdr *) ptr;
1501	if (eh->evt != EVT_STACK_INTERNAL)
1502		return TRUE;
1503
1504	ptr += HCI_EVENT_HDR_SIZE;
1505
1506	si = (evt_stack_internal *) ptr;
1507	switch (si->type) {
1508	case EVT_SI_DEVICE:
1509		sd = (void *) &si->data;
1510		device_event(sd->event, sd->dev_id);
1511		break;
1512	}
1513
1514	return TRUE;
1515}
1516
1517static int hciops_setup(void)
1518{
1519	struct sockaddr_hci addr;
1520	struct hci_filter flt;
1521	GIOChannel *ctl_io, *child_io;
1522	int sock, err;
1523
1524	if (child_pipe[0] != -1)
1525		return -EALREADY;
1526
1527	if (pipe(child_pipe) < 0) {
1528		err = -errno;
1529		error("pipe(): %s (%d)", strerror(-err), -err);
1530		return err;
1531	}
1532
1533	child_io = g_io_channel_unix_new(child_pipe[0]);
1534	g_io_channel_set_close_on_unref(child_io, TRUE);
1535	child_io_id = g_io_add_watch(child_io,
1536				G_IO_IN | G_IO_ERR | G_IO_HUP | G_IO_NVAL,
1537				child_exit, NULL);
1538	g_io_channel_unref(child_io);
1539
1540	/* Create and bind HCI socket */
1541	sock = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
1542	if (sock < 0) {
1543		err = -errno;
1544		error("Can't open HCI socket: %s (%d)", strerror(-err),
1545								-err);
1546		return err;
1547	}
1548
1549	/* Set filter */
1550	hci_filter_clear(&flt);
1551	hci_filter_set_ptype(HCI_EVENT_PKT, &flt);
1552	hci_filter_set_event(EVT_STACK_INTERNAL, &flt);
1553	if (setsockopt(sock, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
1554		err = -errno;
1555		error("Can't set filter: %s (%d)", strerror(-err), -err);
1556		return err;
1557	}
1558
1559	memset(&addr, 0, sizeof(addr));
1560	addr.hci_family = AF_BLUETOOTH;
1561	addr.hci_dev = HCI_DEV_NONE;
1562	if (bind(sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
1563		err = -errno;
1564		error("Can't bind HCI socket: %s (%d)", strerror(-err), -err);
1565		return err;
1566	}
1567
1568	ctl_io = g_io_channel_unix_new(sock);
1569	g_io_channel_set_close_on_unref(ctl_io, TRUE);
1570
1571	ctl_io_id = g_io_add_watch(ctl_io, G_IO_IN, io_stack_event, NULL);
1572
1573	g_io_channel_unref(ctl_io);
1574
1575	g_idle_add(init_known_adapters, GINT_TO_POINTER(sock));
1576
1577	return 0;
1578}
1579
1580static void hciops_cleanup(void)
1581{
1582	int i;
1583
1584	for (i = 0; i <= max_dev; i++) {
1585		if (SK(i) >= 0)
1586			hci_close_dev(SK(i));
1587	}
1588
1589	g_free(devs);
1590	devs = NULL;
1591	max_dev = -1;
1592
1593	if (child_io_id) {
1594		g_source_remove(child_io_id);
1595		child_io_id = 0;
1596	}
1597
1598	if (ctl_io_id) {
1599		g_source_remove(ctl_io_id);
1600		ctl_io_id = 0;
1601	}
1602
1603	if (child_pipe[0] >= 0) {
1604		close(child_pipe[0]);
1605		child_pipe[0] = -1;
1606	}
1607
1608	if (child_pipe[1] >= 0) {
1609		close(child_pipe[1]);
1610		child_pipe[1] = -1;
1611	}
1612}
1613
1614static int hciops_start(int index)
1615{
1616	int err;
1617
1618	if (ioctl(SK(index), HCIDEVUP, index) == 0)
1619		return 0;
1620
1621	if (errno == EALREADY)
1622		return 0;
1623
1624	err = -errno;
1625	error("Can't init device hci%d: %s (%d)",
1626					index, strerror(-err), -err);
1627
1628	return err;
1629}
1630
1631static int hciops_stop(int index)
1632{
1633	int err = 0;
1634
1635	if (ioctl(SK(index), HCIDEVDOWN, index) == 0)
1636		goto done; /* on success */
1637
1638	if (errno != EALREADY) {
1639		err = -errno;
1640		error("Can't stop device hci%d: %s (%d)",
1641				index, strerror(-err), -err);
1642	}
1643
1644done:
1645	return err;
1646}
1647
1648static int hciops_powered(int index, gboolean powered)
1649{
1650	uint8_t mode = SCAN_DISABLED;
1651
1652	if (powered)
1653		return hciops_start(index);
1654
1655	if (hci_send_cmd(SK(index), OGF_HOST_CTL,
1656					OCF_WRITE_SCAN_ENABLE, 1, &mode) < 0)
1657		return -errno;
1658
1659	return hciops_stop(index);
1660}
1661
1662static int hciops_connectable(int index)
1663{
1664	uint8_t mode = SCAN_PAGE;
1665
1666	if (hci_send_cmd(SK(index), OGF_HOST_CTL,
1667					OCF_WRITE_SCAN_ENABLE, 1, &mode) < 0)
1668		return -errno;
1669
1670	return 0;
1671}
1672
1673static int hciops_discoverable(int index)
1674{
1675	uint8_t mode = (SCAN_PAGE | SCAN_INQUIRY);
1676
1677	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE,
1678								1, &mode) < 0)
1679		return -errno;
1680
1681	return 0;
1682}
1683
1684static int hciops_set_class(int index, uint32_t class)
1685{
1686	write_class_of_dev_cp cp;
1687
1688	memcpy(cp.dev_class, &class, 3);
1689
1690	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_WRITE_CLASS_OF_DEV,
1691					WRITE_CLASS_OF_DEV_CP_SIZE, &cp) < 0)
1692		return -errno;
1693
1694	return 0;
1695}
1696
1697static int hciops_set_limited_discoverable(int index, uint32_t class,
1698							gboolean limited)
1699{
1700	int num = (limited ? 2 : 1);
1701	uint8_t lap[] = { 0x33, 0x8b, 0x9e, 0x00, 0x8b, 0x9e };
1702	write_current_iac_lap_cp cp;
1703
1704	/*
1705	 * 1: giac
1706	 * 2: giac + liac
1707	 */
1708	memset(&cp, 0, sizeof(cp));
1709	cp.num_current_iac = num;
1710	memcpy(&cp.lap, lap, num * 3);
1711
1712	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_WRITE_CURRENT_IAC_LAP,
1713						(num * 3 + 1), &cp) < 0)
1714		return -errno;
1715
1716	return hciops_set_class(index, class);
1717}
1718
1719static int hciops_start_inquiry(int index, uint8_t length, gboolean periodic)
1720{
1721	uint8_t lap[3] = { 0x33, 0x8b, 0x9e };
1722	int err;
1723
1724	if (periodic) {
1725		periodic_inquiry_cp cp;
1726
1727		memset(&cp, 0, sizeof(cp));
1728		memcpy(&cp.lap, lap, 3);
1729		cp.max_period = htobs(24);
1730		cp.min_period = htobs(16);
1731		cp.length  = length;
1732		cp.num_rsp = 0x00;
1733
1734		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
1735						OCF_PERIODIC_INQUIRY,
1736						PERIODIC_INQUIRY_CP_SIZE, &cp);
1737	} else {
1738		inquiry_cp inq_cp;
1739
1740		memset(&inq_cp, 0, sizeof(inq_cp));
1741		memcpy(&inq_cp.lap, lap, 3);
1742		inq_cp.length = length;
1743		inq_cp.num_rsp = 0x00;
1744
1745		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
1746					OCF_INQUIRY, INQUIRY_CP_SIZE, &inq_cp);
1747	}
1748
1749	if (err < 0)
1750		err = -errno;
1751
1752	return err;
1753}
1754
1755static int hciops_stop_inquiry(int index)
1756{
1757	struct hci_dev_info di;
1758	int err;
1759
1760	if (hci_devinfo(index, &di) < 0)
1761		return -errno;
1762
1763	if (hci_test_bit(HCI_INQUIRY, &di.flags))
1764		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
1765						OCF_INQUIRY_CANCEL, 0, 0);
1766	else
1767		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
1768					OCF_EXIT_PERIODIC_INQUIRY, 0, 0);
1769	if (err < 0)
1770		err = -errno;
1771
1772	return err;
1773}
1774
1775static int hciops_start_scanning(int index)
1776{
1777	if (hci_le_set_scan_parameters(SK(index), 0x01, htobs(0x0010),
1778					htobs(0x0010), 0x00, 0x00) < 0)
1779		return -errno;
1780
1781	if (hci_le_set_scan_enable(SK(index), 0x01, 0x00) < 0)
1782		return -errno;
1783
1784	return 0;
1785}
1786
1787static int hciops_stop_scanning(int index)
1788{
1789	if (hci_le_set_scan_enable(SK(index), 0x00, 0x00) < 0)
1790		return -errno;
1791
1792	return 0;
1793}
1794
1795static int hciops_resolve_name(int index, bdaddr_t *bdaddr)
1796{
1797	remote_name_req_cp cp;
1798
1799	memset(&cp, 0, sizeof(cp));
1800	bacpy(&cp.bdaddr, bdaddr);
1801	cp.pscan_rep_mode = 0x02;
1802
1803	if (hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_REMOTE_NAME_REQ,
1804					REMOTE_NAME_REQ_CP_SIZE, &cp) < 0)
1805		return -errno;
1806
1807	return 0;
1808}
1809
1810static int hciops_set_name(int index, const char *name)
1811{
1812	change_local_name_cp cp;
1813
1814	memset(&cp, 0, sizeof(cp));
1815	strncpy((char *) cp.name, name, sizeof(cp.name));
1816
1817	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_CHANGE_LOCAL_NAME,
1818				CHANGE_LOCAL_NAME_CP_SIZE, &cp) < 0)
1819		return -errno;
1820
1821	return 0;
1822}
1823
1824static int hciops_read_name(int index)
1825{
1826	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_READ_LOCAL_NAME,
1827								0, 0) < 0)
1828		return -errno;
1829
1830	return 0;
1831}
1832
1833static int hciops_cancel_resolve_name(int index, bdaddr_t *bdaddr)
1834{
1835	remote_name_req_cancel_cp cp;
1836
1837	memset(&cp, 0, sizeof(cp));
1838	bacpy(&cp.bdaddr, bdaddr);
1839
1840	if (hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_REMOTE_NAME_REQ_CANCEL,
1841				REMOTE_NAME_REQ_CANCEL_CP_SIZE, &cp) < 0)
1842		return -errno;
1843
1844	return 0;
1845}
1846
1847static int hciops_fast_connectable(int index, gboolean enable)
1848{
1849	write_page_activity_cp cp;
1850	uint8_t type;
1851
1852	if (enable) {
1853		type = PAGE_SCAN_TYPE_INTERLACED;
1854		cp.interval = 0x0024;	/* 22.5 msec page scan interval */
1855	} else {
1856		type = PAGE_SCAN_TYPE_STANDARD;	/* default */
1857		cp.interval = 0x0800;	/* default 1.28 sec page scan */
1858	}
1859
1860	cp.window = 0x0012;	/* default 11.25 msec page scan window */
1861
1862	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_WRITE_PAGE_ACTIVITY,
1863					WRITE_PAGE_ACTIVITY_CP_SIZE, &cp) < 0)
1864		return -errno;
1865	else if (hci_send_cmd(SK(index), OGF_HOST_CTL,
1866				OCF_WRITE_PAGE_SCAN_TYPE, 1, &type) < 0)
1867		return -errno;
1868
1869	return 0;
1870}
1871
1872static int hciops_read_clock(int index, int handle, int which, int timeout,
1873					uint32_t *clock, uint16_t *accuracy)
1874{
1875	if (hci_read_clock(SK(index), handle, which, clock, accuracy,
1876								timeout) < 0)
1877		return -errno;
1878
1879	return 0;
1880}
1881
1882static int hciops_conn_handle(int index, const bdaddr_t *bdaddr, int *handle)
1883{
1884	int err;
1885	struct hci_conn_info_req *cr;
1886
1887	cr = g_malloc0(sizeof(*cr) + sizeof(struct hci_conn_info));
1888	bacpy(&cr->bdaddr, bdaddr);
1889	cr->type = ACL_LINK;
1890
1891	if (ioctl(SK(index), HCIGETCONNINFO, (unsigned long) cr) < 0) {
1892		err = -errno;
1893		goto fail;
1894	}
1895
1896	err = 0;
1897	*handle = htobs(cr->conn_info->handle);
1898
1899fail:
1900	g_free(cr);
1901	return err;
1902}
1903
1904static int hciops_write_eir_data(int index, uint8_t *data)
1905{
1906	write_ext_inquiry_response_cp cp;
1907
1908	memset(&cp, 0, sizeof(cp));
1909	memcpy(cp.data, data, 240);
1910
1911	if (hci_send_cmd(SK(index), OGF_HOST_CTL,
1912				OCF_WRITE_EXT_INQUIRY_RESPONSE,
1913				WRITE_EXT_INQUIRY_RESPONSE_CP_SIZE, &cp) < 0)
1914		return -errno;
1915
1916	return 0;
1917}
1918
1919static int hciops_read_bdaddr(int index, bdaddr_t *bdaddr)
1920{
1921	bacpy(bdaddr, &BDADDR(index));
1922	return 0;
1923}
1924
1925static int hciops_set_event_mask(int index, uint8_t *events, size_t count)
1926{
1927	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_SET_EVENT_MASK,
1928							count, events) < 0)
1929		return -errno;
1930
1931	return 0;
1932}
1933
1934static int hciops_write_inq_mode(int index, uint8_t mode)
1935{
1936	write_inquiry_mode_cp cp;
1937
1938	memset(&cp, 0, sizeof(cp));
1939	cp.mode = mode;
1940
1941	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_WRITE_INQUIRY_MODE,
1942					WRITE_INQUIRY_MODE_CP_SIZE, &cp) < 0)
1943		return -errno;
1944
1945	return 0;
1946}
1947
1948static int hciops_read_inq_tx_pwr(int index)
1949{
1950	if (hci_send_cmd(SK(index), OGF_HOST_CTL,
1951			OCF_READ_INQ_RESPONSE_TX_POWER_LEVEL, 0, NULL) < 0)
1952		return -errno;
1953
1954	return 0;
1955}
1956
1957static int hciops_block_device(int index, bdaddr_t *bdaddr)
1958{
1959	if (ioctl(SK(index), HCIBLOCKADDR, bdaddr) < 0)
1960		return -errno;
1961
1962	return 0;
1963}
1964
1965static int hciops_unblock_device(int index, bdaddr_t *bdaddr)
1966{
1967	if (ioctl(SK(index), HCIUNBLOCKADDR, bdaddr) < 0)
1968		return -errno;
1969
1970	return 0;
1971}
1972
1973static int hciops_get_conn_list(int index, GSList **conns)
1974{
1975	struct hci_conn_list_req *cl;
1976	struct hci_conn_info *ci;
1977	int err, i;
1978
1979	cl = g_malloc0(10 * sizeof(*ci) + sizeof(*cl));
1980
1981	cl->dev_id = index;
1982	cl->conn_num = 10;
1983	ci = cl->conn_info;
1984
1985	if (ioctl(SK(index), HCIGETCONNLIST, cl) < 0) {
1986		err = -errno;
1987		goto fail;
1988	}
1989
1990	err = 0;
1991	*conns = NULL;
1992
1993	for (i = 0; i < cl->conn_num; i++, ci++)
1994		*conns = g_slist_append(*conns, g_memdup(ci, sizeof(*ci)));
1995
1996fail:
1997	g_free(cl);
1998	return err;
1999}
2000
2001static int hciops_read_local_version(int index, struct hci_version *ver)
2002{
2003	if (hci_read_local_version(SK(index), ver, HCI_REQ_TIMEOUT) < 0)
2004		return -errno;
2005
2006	return 0;
2007}
2008
2009static int hciops_read_local_features(int index, uint8_t *features)
2010{
2011	if (hci_read_local_features(SK(index), features,
2012							HCI_REQ_TIMEOUT) < 0)
2013		return -errno;
2014
2015	return  0;
2016}
2017
2018static int hciops_read_local_ext_features(int index)
2019{
2020	uint8_t page_num = 1;
2021
2022	if (hci_send_cmd(SK(index), OGF_INFO_PARAM,
2023				OCF_READ_LOCAL_EXT_FEATURES, 1, &page_num) < 0)
2024		return -errno;
2025
2026	return 0;
2027}
2028
2029static int hciops_init_ssp_mode(int index, uint8_t *mode)
2030{
2031	write_simple_pairing_mode_cp cp;
2032
2033	if (ioctl(SK(index), HCIGETAUTHINFO, NULL) < 0 && errno == EINVAL)
2034		return 0;
2035
2036	memset(&cp, 0, sizeof(cp));
2037	cp.mode = 0x01;
2038
2039	if (hci_send_cmd(SK(index), OGF_HOST_CTL,
2040				OCF_WRITE_SIMPLE_PAIRING_MODE,
2041				WRITE_SIMPLE_PAIRING_MODE_CP_SIZE, &cp) < 0)
2042		return -errno;
2043
2044	return 0;
2045}
2046
2047static int hciops_read_link_policy(int index)
2048{
2049	if (hci_send_cmd(SK(index), OGF_LINK_POLICY,
2050				OCF_READ_DEFAULT_LINK_POLICY, 0, NULL) < 0)
2051		return -errno;
2052
2053	return 0;
2054}
2055
2056static int hciops_disconnect(int index, uint16_t handle)
2057{
2058	disconnect_cp cp;
2059
2060	memset(&cp, 0, sizeof(cp));
2061	cp.handle = htobs(handle);
2062	cp.reason = HCI_OE_USER_ENDED_CONNECTION;
2063
2064	if (hci_send_cmd(SK(index), OGF_LINK_CTL, OCF_DISCONNECT,
2065						DISCONNECT_CP_SIZE, &cp) < 0)
2066		return -errno;
2067
2068	return 0;
2069}
2070
2071static int hciops_remove_bonding(int index, bdaddr_t *bdaddr)
2072{
2073	delete_stored_link_key_cp cp;
2074
2075	memset(&cp, 0, sizeof(cp));
2076	bacpy(&cp.bdaddr, bdaddr);
2077
2078	/* Delete the link key from the Bluetooth chip */
2079	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_DELETE_STORED_LINK_KEY,
2080				DELETE_STORED_LINK_KEY_CP_SIZE, &cp) < 0)
2081		return -errno;
2082
2083	return 0;
2084}
2085
2086static int hciops_request_authentication(int index, uint16_t handle,
2087							uint8_t *status)
2088{
2089	struct hci_request rq;
2090	auth_requested_cp cp;
2091	evt_cmd_status rp;
2092
2093	memset(&rp, 0, sizeof(rp));
2094
2095	memset(&cp, 0, sizeof(cp));
2096	cp.handle = htobs(handle);
2097
2098	memset(&rq, 0, sizeof(rq));
2099	rq.ogf    = OGF_LINK_CTL;
2100	rq.ocf    = OCF_AUTH_REQUESTED;
2101	rq.cparam = &cp;
2102	rq.clen   = AUTH_REQUESTED_CP_SIZE;
2103	rq.rparam = &rp;
2104	rq.rlen   = EVT_CMD_STATUS_SIZE;
2105	rq.event  = EVT_CMD_STATUS;
2106
2107	if (hci_send_req(SK(index), &rq, HCI_REQ_TIMEOUT) < 0)
2108		return -errno;
2109
2110	if (status)
2111		*status = rp.status;
2112
2113	return 0;
2114}
2115
2116static int hciops_pincode_reply(int index, bdaddr_t *bdaddr, const char *pin)
2117{
2118	int err;
2119
2120	if (pin) {
2121		pin_code_reply_cp pr;
2122		size_t len = strlen(pin);
2123
2124		PIN_LENGTH(index) = len;
2125
2126		memset(&pr, 0, sizeof(pr));
2127		bacpy(&pr.bdaddr, bdaddr);
2128		memcpy(pr.pin_code, pin, len);
2129		pr.pin_len = len;
2130		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
2131						OCF_PIN_CODE_REPLY,
2132						PIN_CODE_REPLY_CP_SIZE, &pr);
2133	} else
2134		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
2135					OCF_PIN_CODE_NEG_REPLY, 6, bdaddr);
2136
2137	if (err < 0)
2138		err = -errno;
2139
2140	return err;
2141}
2142
2143static int hciops_confirm_reply(int index, bdaddr_t *bdaddr, gboolean success)
2144{
2145	int err;
2146	user_confirm_reply_cp cp;
2147
2148	memset(&cp, 0, sizeof(cp));
2149	bacpy(&cp.bdaddr, bdaddr);
2150
2151	if (success)
2152		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
2153					OCF_USER_CONFIRM_REPLY,
2154					USER_CONFIRM_REPLY_CP_SIZE, &cp);
2155	else
2156		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
2157					OCF_USER_CONFIRM_NEG_REPLY,
2158					USER_CONFIRM_REPLY_CP_SIZE, &cp);
2159
2160	if (err < 0)
2161		err = -errno;
2162
2163	return err;
2164}
2165
2166static int hciops_passkey_reply(int index, bdaddr_t *bdaddr, uint32_t passkey)
2167{
2168	int err;
2169
2170	if (passkey != INVALID_PASSKEY) {
2171		user_passkey_reply_cp cp;
2172
2173		memset(&cp, 0, sizeof(cp));
2174		bacpy(&cp.bdaddr, bdaddr);
2175		cp.passkey = passkey;
2176
2177		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
2178					OCF_USER_PASSKEY_REPLY,
2179					USER_PASSKEY_REPLY_CP_SIZE, &cp);
2180	} else
2181		err = hci_send_cmd(SK(index), OGF_LINK_CTL,
2182					OCF_USER_PASSKEY_NEG_REPLY, 6, bdaddr);
2183
2184	if (err < 0)
2185		err = -errno;
2186
2187	return err;
2188}
2189
2190static int hciops_get_auth_info(int index, bdaddr_t *bdaddr, uint8_t *auth)
2191{
2192	struct hci_auth_info_req req;
2193
2194	memset(&req, 0, sizeof(req));
2195	bacpy(&req.bdaddr, bdaddr);
2196
2197	if (ioctl(SK(index), HCIGETAUTHINFO, (unsigned long) &req) < 0)
2198		return -errno;
2199
2200	if (auth)
2201		*auth = req.type;
2202
2203	return 0;
2204}
2205
2206static int hciops_read_scan_enable(int index)
2207{
2208	if (hci_send_cmd(SK(index), OGF_HOST_CTL, OCF_READ_SCAN_ENABLE,
2209								0, NULL) < 0)
2210		return -errno;
2211
2212	return 0;
2213}
2214
2215static int hciops_read_ssp_mode(int index)
2216{
2217	if (hci_send_cmd(SK(index), OGF_HOST_CTL,
2218				OCF_READ_SIMPLE_PAIRING_MODE, 0, NULL) < 0)
2219		return -errno;
2220
2221	return 0;
2222}
2223
2224static int hciops_write_le_host(int index, uint8_t le, uint8_t simul)
2225{
2226	write_le_host_supported_cp cp;
2227
2228	memset(&cp, 0, sizeof(cp));
2229	cp.le = le;
2230	cp.simul = simul;
2231
2232	if (hci_send_cmd(SK(index), OGF_HOST_CTL,
2233				OCF_WRITE_LE_HOST_SUPPORTED,
2234				WRITE_LE_HOST_SUPPORTED_CP_SIZE, &cp) < 0)
2235		return -errno;
2236
2237	return 0;
2238}
2239
2240struct remote_version_req {
2241	int index;
2242	uint16_t handle;
2243};
2244
2245static gboolean get_remote_version(gpointer user_data)
2246{
2247	struct remote_version_req *req = user_data;
2248	read_remote_version_cp cp;
2249
2250	memset(&cp, 0, sizeof(cp));
2251	cp.handle = htobs(req->handle);
2252
2253	hci_send_cmd(SK(req->index), OGF_LINK_CTL, OCF_READ_REMOTE_VERSION,
2254					READ_REMOTE_VERSION_CP_SIZE, &cp);
2255
2256	return FALSE;
2257}
2258
2259static int hciops_get_remote_version(int index, uint16_t handle,
2260							gboolean delayed)
2261{
2262	struct remote_version_req *req;
2263
2264	req = g_new0(struct remote_version_req, 1);
2265	req->handle = handle;
2266	req->index = index;
2267
2268	if (!delayed) {
2269		get_remote_version(req);
2270		g_free(req);
2271		return 0;
2272	}
2273
2274	g_timeout_add_seconds_full(G_PRIORITY_DEFAULT, 1, get_remote_version,
2275								req, g_free);
2276
2277	return 0;
2278}
2279
2280static struct btd_adapter_ops hci_ops = {
2281	.setup = hciops_setup,
2282	.cleanup = hciops_cleanup,
2283	.start = hciops_start,
2284	.stop = hciops_stop,
2285	.set_powered = hciops_powered,
2286	.set_connectable = hciops_connectable,
2287	.set_discoverable = hciops_discoverable,
2288	.set_limited_discoverable = hciops_set_limited_discoverable,
2289	.start_inquiry = hciops_start_inquiry,
2290	.stop_inquiry = hciops_stop_inquiry,
2291	.start_scanning = hciops_start_scanning,
2292	.stop_scanning = hciops_stop_scanning,
2293	.resolve_name = hciops_resolve_name,
2294	.cancel_resolve_name = hciops_cancel_resolve_name,
2295	.set_name = hciops_set_name,
2296	.read_name = hciops_read_name,
2297	.set_class = hciops_set_class,
2298	.set_fast_connectable = hciops_fast_connectable,
2299	.read_clock = hciops_read_clock,
2300	.get_conn_handle = hciops_conn_handle,
2301	.write_eir_data = hciops_write_eir_data,
2302	.read_bdaddr = hciops_read_bdaddr,
2303	.set_event_mask = hciops_set_event_mask,
2304	.write_inq_mode = hciops_write_inq_mode,
2305	.read_inq_tx_pwr = hciops_read_inq_tx_pwr,
2306	.block_device = hciops_block_device,
2307	.unblock_device = hciops_unblock_device,
2308	.get_conn_list = hciops_get_conn_list,
2309	.read_local_version = hciops_read_local_version,
2310	.read_local_features = hciops_read_local_features,
2311	.read_local_ext_features = hciops_read_local_ext_features,
2312	.init_ssp_mode = hciops_init_ssp_mode,
2313	.read_link_policy = hciops_read_link_policy,
2314	.disconnect = hciops_disconnect,
2315	.remove_bonding = hciops_remove_bonding,
2316	.request_authentication = hciops_request_authentication,
2317	.pincode_reply = hciops_pincode_reply,
2318	.confirm_reply = hciops_confirm_reply,
2319	.passkey_reply = hciops_passkey_reply,
2320	.get_auth_info = hciops_get_auth_info,
2321	.read_scan_enable = hciops_read_scan_enable,
2322	.read_ssp_mode = hciops_read_ssp_mode,
2323	.write_le_host = hciops_write_le_host,
2324	.get_remote_version = hciops_get_remote_version,
2325	.encrypt_link = hciops_encrypt_link,
2326};
2327
2328static int hciops_init(void)
2329{
2330	return btd_register_adapter_ops(&hci_ops, FALSE);
2331}
2332
2333static void hciops_exit(void)
2334{
2335	btd_adapter_cleanup_ops(&hci_ops);
2336}
2337
2338BLUETOOTH_PLUGIN_DEFINE(hciops, VERSION,
2339		BLUETOOTH_PLUGIN_PRIORITY_LOW, hciops_init, hciops_exit)
2340