1/******************************************************************************
2 *
3 *  Copyright (C) 2009-2012 Broadcom Corporation
4 *
5 *  Licensed under the Apache License, Version 2.0 (the "License");
6 *  you may not use this file except in compliance with the License.
7 *  You may obtain a copy of the License at:
8 *
9 *  http://www.apache.org/licenses/LICENSE-2.0
10 *
11 *  Unless required by applicable law or agreed to in writing, software
12 *  distributed under the License is distributed on an "AS IS" BASIS,
13 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 *  See the License for the specific language governing permissions and
15 *  limitations under the License.
16 *
17 ******************************************************************************/
18
19/************************************************************************************
20 *
21 *  Filename:      btif_pan.c
22 *
23 *  Description:   PAN Profile Bluetooth Interface
24 *
25 *
26 ***********************************************************************************/
27#include <hardware/bluetooth.h>
28#include <hardware/bt_pan.h>
29#include <assert.h>
30#include <string.h>
31#include <signal.h>
32#include <ctype.h>
33#include <sys/select.h>
34#include <sys/poll.h>
35#include <sys/ioctl.h>
36#include <netinet/in.h>
37#include <netdb.h>
38#include <stdio.h>
39#include <string.h>
40#include <errno.h>
41#include <fcntl.h>
42#include <sys/socket.h>
43#include <sys/wait.h>
44#include <net/if.h>
45#include <linux/sockios.h>
46#include <sys/prctl.h>
47#include <linux/if_tun.h>
48#include <linux/if_ether.h>
49
50#define LOG_TAG "bt_btif_pan"
51#include "btif_common.h"
52#include "btif_util.h"
53#include "btm_api.h"
54#include "btcore/include/bdaddr.h"
55#include "device/include/controller.h"
56
57#include "bta_api.h"
58#include "bta_pan_api.h"
59#include "btif_sock_thread.h"
60#include "btif_sock_util.h"
61#include "btif_pan_internal.h"
62#include "gki.h"
63#include "osi/include/osi.h"
64#include "osi/include/log.h"
65
66#define FORWARD_IGNORE        1
67#define FORWARD_SUCCESS       0
68#define FORWARD_FAILURE     (-1)
69#define FORWARD_CONGEST     (-2)
70//#define PANU_DISABLED TRUE
71
72#if (PAN_NAP_DISABLED == TRUE) && (PANU_DISABLED == TRUE)
73#define BTPAN_LOCAL_ROLE BTPAN_ROLE_NONE
74#elif PAN_NAP_DISABLED == TRUE
75#define BTPAN_LOCAL_ROLE BTPAN_ROLE_PANU
76#elif PANU_DISABLED == TRUE
77#define BTPAN_LOCAL_ROLE BTPAN_ROLE_PANNAP
78#else
79#define BTPAN_LOCAL_ROLE (BTPAN_ROLE_PANU | BTPAN_ROLE_PANNAP)
80#endif
81
82#define asrt(s) if (!(s)) BTIF_TRACE_ERROR("btif_pan: ## %s assert %s failed at line:%d ##",__FUNCTION__, #s, __LINE__)
83
84#define MIN(x, y) (((x) < (y)) ? (x) : (y))
85
86btpan_cb_t btpan_cb;
87
88static bool jni_initialized;
89static bool stack_initialized;
90
91static bt_status_t btpan_jni_init(const btpan_callbacks_t* callbacks);
92static void btpan_jni_cleanup();
93static bt_status_t btpan_connect(const bt_bdaddr_t *bd_addr, int local_role, int remote_role);
94static bt_status_t btpan_disconnect(const bt_bdaddr_t *bd_addr);
95static bt_status_t btpan_enable(int local_role);
96static int btpan_get_local_role(void);
97
98static void btpan_tap_fd_signaled(int fd, int type, int flags, uint32_t user_id);
99static void btpan_cleanup_conn(btpan_conn_t* conn);
100static void bta_pan_callback(tBTA_PAN_EVT event, tBTA_PAN *p_data);
101static void btu_exec_tap_fd_read(void *p_param);
102
103static btpan_interface_t pan_if = {
104    sizeof(pan_if),
105    btpan_jni_init,
106    btpan_enable,
107    btpan_get_local_role,
108    btpan_connect,
109    btpan_disconnect,
110    btpan_jni_cleanup
111};
112
113btpan_interface_t *btif_pan_get_interface()
114{
115    return &pan_if;
116}
117
118/*******************************************************************************
119 **
120 ** Function        btif_pan_init
121 **
122 ** Description     initializes the pan interface
123 **
124 ** Returns         bt_status_t
125 **
126 *******************************************************************************/
127void btif_pan_init()
128{
129    BTIF_TRACE_DEBUG("jni_initialized = %d, btpan_cb.enabled:%d", jni_initialized, btpan_cb.enabled);
130    stack_initialized = true;
131
132    if (jni_initialized && !btpan_cb.enabled)
133    {
134        BTIF_TRACE_DEBUG("Enabling PAN....");
135        memset(&btpan_cb, 0, sizeof(btpan_cb));
136        btpan_cb.tap_fd = INVALID_FD;
137        btpan_cb.flow = 1;
138        for (int i = 0; i < MAX_PAN_CONNS; i++)
139            btpan_cleanup_conn(&btpan_cb.conns[i]);
140        BTA_PanEnable(bta_pan_callback);
141        btpan_cb.enabled = 1;
142        btpan_enable(BTPAN_LOCAL_ROLE);
143    }
144}
145
146static void pan_disable()
147{
148    if (btpan_cb.enabled)
149    {
150        btpan_cb.enabled = 0;
151        BTA_PanDisable();
152        if (btpan_cb.tap_fd != INVALID_FD)
153        {
154            btpan_tap_close(btpan_cb.tap_fd);
155            btpan_cb.tap_fd = INVALID_FD;
156        }
157    }
158}
159
160void btif_pan_cleanup()
161{
162    if (!stack_initialized)
163        return;
164
165    // Bluetooth is shuting down, invalidate all BTA PAN handles
166    for (int i = 0; i < MAX_PAN_CONNS; i++)
167        btpan_cleanup_conn(&btpan_cb.conns[i]);
168
169    pan_disable();
170    stack_initialized = false;
171}
172
173static btpan_callbacks_t callback;
174static bt_status_t btpan_jni_init(const btpan_callbacks_t* callbacks)
175{
176    BTIF_TRACE_DEBUG("stack_initialized = %d, btpan_cb.enabled:%d", stack_initialized, btpan_cb.enabled);
177    callback = *callbacks;
178    jni_initialized = TRUE;
179    if (stack_initialized && !btpan_cb.enabled)
180        btif_pan_init();
181    return BT_STATUS_SUCCESS;
182}
183
184static void btpan_jni_cleanup()
185{
186    pan_disable();
187    jni_initialized = false;
188}
189
190static inline int bta_role_to_btpan(int bta_pan_role)
191{
192    int btpan_role = 0;
193    BTIF_TRACE_DEBUG("bta_pan_role:0x%x", bta_pan_role);
194    if (bta_pan_role & PAN_ROLE_NAP_SERVER)
195        btpan_role |= BTPAN_ROLE_PANNAP;
196    if (bta_pan_role & PAN_ROLE_CLIENT)
197        btpan_role |= BTPAN_ROLE_PANU;
198    return btpan_role;
199}
200
201static inline int btpan_role_to_bta(int btpan_role)
202{
203    int bta_pan_role = PAN_ROLE_INACTIVE;
204    BTIF_TRACE_DEBUG("btpan_role:0x%x", btpan_role);
205    if (btpan_role & BTPAN_ROLE_PANNAP)
206        bta_pan_role |= PAN_ROLE_NAP_SERVER;
207    if (btpan_role & BTPAN_ROLE_PANU)
208        bta_pan_role |= PAN_ROLE_CLIENT;
209    return bta_pan_role;
210}
211
212static volatile int btpan_dev_local_role;
213static tBTA_PAN_ROLE_INFO bta_panu_info = {PANU_SERVICE_NAME, 0, PAN_SECURITY};
214static tBTA_PAN_ROLE_INFO bta_pan_nap_info = {PAN_NAP_SERVICE_NAME, 1, PAN_SECURITY};
215
216static bt_status_t btpan_enable(int local_role)
217{
218#if BTA_PAN_INCLUDED == TRUE
219    BTIF_TRACE_DEBUG("%s - local_role: %d", __func__, local_role);
220    int bta_pan_role = btpan_role_to_bta(local_role);
221    BTA_PanSetRole(bta_pan_role, &bta_panu_info, NULL, &bta_pan_nap_info);
222    btpan_dev_local_role = local_role;
223    return BT_STATUS_SUCCESS;
224#else
225    return BT_STATUS_FAIL;
226#endif
227}
228
229static int btpan_get_local_role()
230{
231    BTIF_TRACE_DEBUG("btpan_dev_local_role:%d", btpan_dev_local_role);
232    return btpan_dev_local_role;
233}
234
235static bt_status_t btpan_connect(const bt_bdaddr_t *bd_addr, int local_role, int remote_role)
236{
237    BTIF_TRACE_DEBUG("local_role:%d, remote_role:%d", local_role, remote_role);
238    int bta_local_role = btpan_role_to_bta(local_role);
239    int bta_remote_role = btpan_role_to_bta(remote_role);
240    btpan_new_conn(-1, bd_addr->address, bta_local_role, bta_remote_role);
241    BTA_PanOpen((UINT8*)bd_addr->address, bta_local_role, bta_remote_role);
242    return BT_STATUS_SUCCESS;
243}
244
245static void btif_in_pan_generic_evt(UINT16 event, char *p_param)
246{
247    BTIF_TRACE_EVENT("%s: event=%d", __FUNCTION__, event);
248    switch (event) {
249        case BTIF_PAN_CB_DISCONNECTING:
250        {
251            bt_bdaddr_t *bd_addr = (bt_bdaddr_t*)p_param;
252            btpan_conn_t* conn = btpan_find_conn_addr(bd_addr->address);
253            int btpan_conn_local_role;
254            int btpan_remote_role;
255            asrt(conn != NULL);
256            if (conn) {
257                btpan_conn_local_role = bta_role_to_btpan(conn->local_role);
258                btpan_remote_role = bta_role_to_btpan(conn->remote_role);
259                callback.connection_state_cb(BTPAN_STATE_DISCONNECTING, BT_STATUS_SUCCESS,
260                        (const bt_bdaddr_t*)conn->peer, btpan_conn_local_role, btpan_remote_role);
261            }
262        } break;
263        default:
264        {
265            BTIF_TRACE_WARNING("%s : Unknown event 0x%x", __FUNCTION__, event);
266        }
267        break;
268    }
269}
270
271static bt_status_t btpan_disconnect(const bt_bdaddr_t *bd_addr)
272{
273    btpan_conn_t* conn = btpan_find_conn_addr(bd_addr->address);
274    if (conn && conn->handle >= 0)
275    {
276        BTA_PanClose(conn->handle);
277        /* Inform the application that the disconnect has been initiated successfully */
278        btif_transfer_context(btif_in_pan_generic_evt, BTIF_PAN_CB_DISCONNECTING,
279                              (char *)bd_addr, sizeof(bt_bdaddr_t), NULL);
280        return BT_STATUS_SUCCESS;
281    }
282    return BT_STATUS_FAIL;
283}
284
285static int pan_pth = -1;
286void create_tap_read_thread(int tap_fd)
287{
288    if (pan_pth < 0)
289        pan_pth = btsock_thread_create(btpan_tap_fd_signaled, NULL);
290    if (pan_pth >= 0)
291        btsock_thread_add_fd(pan_pth, tap_fd, 0, SOCK_THREAD_FD_RD, 0);
292}
293
294void destroy_tap_read_thread(void)
295{
296    if (pan_pth >= 0)
297    {
298        btsock_thread_exit(pan_pth);
299        pan_pth = -1;
300    }
301}
302
303static int tap_if_up(const char *devname, const bt_bdaddr_t *addr)
304{
305    struct ifreq ifr;
306    int sk, err;
307
308    sk = socket(AF_INET, SOCK_DGRAM, 0);
309    if (sk < 0)
310        return -1;
311
312    //set mac addr
313    memset(&ifr, 0, sizeof(ifr));
314    strncpy(ifr.ifr_name, devname, IFNAMSIZ - 1);
315    err = ioctl(sk, SIOCGIFHWADDR, &ifr);
316    if (err < 0)
317    {
318        BTIF_TRACE_ERROR("Could not get network hardware for interface:%s, errno:%s", devname, strerror(errno));
319        close(sk);
320        return -1;
321    }
322
323    strncpy(ifr.ifr_name, devname, IFNAMSIZ - 1);
324    memcpy(ifr.ifr_hwaddr.sa_data, addr->address, 6);
325
326    /* The IEEE has specified that the most significant bit of the most significant byte is used to
327     * determine a multicast address. If its a 1, that means multicast, 0 means unicast.
328     * Kernel returns an error if we try to set a multicast address for the tun-tap ethernet interface.
329     * Mask this bit to avoid any issue with auto generated address.
330     */
331    if (ifr.ifr_hwaddr.sa_data[0] & 0x01) {
332        BTIF_TRACE_WARNING("Not a unicast MAC address, force multicast bit flipping");
333        ifr.ifr_hwaddr.sa_data[0] &= ~0x01;
334    }
335
336    err = ioctl(sk, SIOCSIFHWADDR, (caddr_t)&ifr);
337
338    if (err < 0) {
339        BTIF_TRACE_ERROR("Could not set bt address for interface:%s, errno:%s", devname, strerror(errno));
340        close(sk);
341        return -1;
342    }
343
344    //bring it up
345    memset(&ifr, 0, sizeof(ifr));
346    strncpy(ifr.ifr_name, devname, IF_NAMESIZE - 1);
347
348    ifr.ifr_flags |= IFF_UP;
349    ifr.ifr_flags |= IFF_MULTICAST;
350
351    err = ioctl(sk, SIOCSIFFLAGS, (caddr_t) &ifr);
352
353
354    if (err < 0) {
355        BTIF_TRACE_ERROR("Could not bring up network interface:%s, errno:%d", devname, errno);
356        close(sk);
357        return -1;
358    }
359    close(sk);
360    BTIF_TRACE_DEBUG("network interface: %s is up", devname);
361    return 0;
362}
363
364static int tap_if_down(const char *devname)
365{
366    struct ifreq ifr;
367    int sk;
368
369    sk = socket(AF_INET, SOCK_DGRAM, 0);
370    if (sk < 0)
371        return -1;
372
373    memset(&ifr, 0, sizeof(ifr));
374    strncpy(ifr.ifr_name, devname, IF_NAMESIZE - 1);
375
376    ifr.ifr_flags &= ~IFF_UP;
377
378    ioctl(sk, SIOCSIFFLAGS, (caddr_t) &ifr);
379
380    close(sk);
381
382    return 0;
383}
384
385void btpan_set_flow_control(BOOLEAN enable) {
386    if (btpan_cb.tap_fd == -1)
387        return;
388
389    btpan_cb.flow = enable;
390    if (enable) {
391        btsock_thread_add_fd(pan_pth, btpan_cb.tap_fd, 0, SOCK_THREAD_FD_RD, 0);
392        bta_dmexecutecallback(btu_exec_tap_fd_read, (void *)btpan_cb.tap_fd);
393    }
394}
395
396int btpan_tap_open()
397{
398    struct ifreq ifr;
399    int fd, err;
400    const char *clonedev = "/dev/tun";
401
402    /* open the clone device */
403
404    if ((fd = open(clonedev, O_RDWR)) < 0)
405    {
406        BTIF_TRACE_DEBUG("could not open %s, err:%d", clonedev, errno);
407        return fd;
408    }
409
410    memset(&ifr, 0, sizeof(ifr));
411    ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
412
413    strncpy(ifr.ifr_name, TAP_IF_NAME, IFNAMSIZ);
414
415    /* try to create the device */
416    if ((err = ioctl(fd, TUNSETIFF, (void *) &ifr)) < 0)
417    {
418        BTIF_TRACE_DEBUG("ioctl error:%d, errno:%s", err, strerror(errno));
419        close(fd);
420        return err;
421    }
422    if (tap_if_up(TAP_IF_NAME, controller_get_interface()->get_address()) == 0)
423    {
424        int flags = fcntl(fd, F_GETFL, 0);
425        fcntl(fd, F_SETFL, flags | O_NONBLOCK);
426        return fd;
427    }
428    BTIF_TRACE_ERROR("can not bring up tap interface:%s", TAP_IF_NAME);
429    close(fd);
430    return INVALID_FD;
431}
432
433int btpan_tap_send(int tap_fd, const BD_ADDR src, const BD_ADDR dst, UINT16 proto, const char* buf,
434                    UINT16 len, BOOLEAN ext, BOOLEAN forward)
435{
436    UNUSED(ext);
437    UNUSED(forward);
438    if (tap_fd != INVALID_FD)
439    {
440        tETH_HDR eth_hdr;
441        memcpy(&eth_hdr.h_dest, dst, ETH_ADDR_LEN);
442        memcpy(&eth_hdr.h_src, src, ETH_ADDR_LEN);
443        eth_hdr.h_proto = htons(proto);
444        char packet[TAP_MAX_PKT_WRITE_LEN + sizeof(tETH_HDR)];
445        memcpy(packet, &eth_hdr, sizeof(tETH_HDR));
446        if (len > TAP_MAX_PKT_WRITE_LEN)
447        {
448            LOG_ERROR("btpan_tap_send eth packet size:%d is exceeded limit!", len);
449            return -1;
450        }
451        memcpy(packet + sizeof(tETH_HDR), buf, len);
452
453        /* Send data to network interface */
454        int ret = write(tap_fd, packet, len + sizeof(tETH_HDR));
455        BTIF_TRACE_DEBUG("ret:%d", ret);
456        return ret;
457    }
458    return -1;
459
460}
461
462int btpan_tap_close(int fd)
463{
464    if (tap_if_down(TAP_IF_NAME) == 0)
465        close(fd);
466    if (pan_pth >= 0)
467        btsock_thread_wakeup(pan_pth);
468    return 0;
469}
470
471btpan_conn_t * btpan_find_conn_handle(UINT16 handle)
472{
473    for (int i = 0; i < MAX_PAN_CONNS; i++)
474    {
475        if (btpan_cb.conns[i].handle == handle)
476            return &btpan_cb.conns[i];
477    }
478    return NULL;
479}
480
481btpan_conn_t* btpan_find_conn_addr(const BD_ADDR addr)
482{
483    for (int i = 0; i < MAX_PAN_CONNS; i++)
484    {
485        if (memcmp(btpan_cb.conns[i].peer, addr, sizeof(BD_ADDR)) == 0)
486            return &btpan_cb.conns[i];
487    }
488    return NULL;
489}
490
491static void btpan_cleanup_conn(btpan_conn_t* conn)
492{
493    if (conn)
494    {
495        conn->handle = -1;
496        conn->state = -1;
497        memset(&conn->peer, 0, sizeof(conn->peer));
498        memset(&conn->eth_addr, 0, sizeof(conn->eth_addr));
499        conn->local_role = conn->remote_role = 0;
500    }
501}
502
503btpan_conn_t* btpan_new_conn(int handle, const BD_ADDR addr, int local_role, int remote_role)
504{
505    for (int i = 0; i < MAX_PAN_CONNS; i++)
506    {
507        BTIF_TRACE_DEBUG("conns[%d]:%d", i, btpan_cb.conns[i].handle);
508        if (btpan_cb.conns[i].handle == -1)
509        {
510            BTIF_TRACE_DEBUG("handle:%d, local_role:%d, remote_role:%d", handle, local_role, remote_role);
511
512            btpan_cb.conns[i].handle = handle;
513            bdcpy(btpan_cb.conns[i].peer, addr);
514            btpan_cb.conns[i].local_role = local_role;
515            btpan_cb.conns[i].remote_role = remote_role;
516            return &btpan_cb.conns[i];
517        }
518    }
519    BTIF_TRACE_DEBUG("MAX_PAN_CONNS:%d exceeded, return NULL as failed", MAX_PAN_CONNS);
520    return NULL;
521}
522
523void btpan_close_handle(btpan_conn_t *p)
524{
525    BTIF_TRACE_DEBUG("btpan_close_handle : close handle %d", p->handle);
526    p->handle = -1;
527    p->local_role = -1;
528    p->remote_role = -1;
529    memset(&p->peer, 0, 6);
530}
531
532static inline bool should_forward(tETH_HDR* hdr)
533{
534    uint16_t proto = ntohs(hdr->h_proto);
535    if (proto == ETH_P_IP || proto == ETH_P_ARP || proto == ETH_P_IPV6)
536        return true;
537    BTIF_TRACE_DEBUG("unknown proto:%x", proto);
538    return false;
539}
540
541static int forward_bnep(tETH_HDR* eth_hdr, BT_HDR *hdr) {
542    int broadcast = eth_hdr->h_dest[0] & 1;
543
544    // Find the right connection to send this frame over.
545    for (int i = 0; i < MAX_PAN_CONNS; i++)
546    {
547        UINT16 handle = btpan_cb.conns[i].handle;
548        if (handle != (UINT16)-1 &&
549                (broadcast || memcmp(btpan_cb.conns[i].eth_addr, eth_hdr->h_dest, sizeof(BD_ADDR)) == 0
550                 || memcmp(btpan_cb.conns[i].peer, eth_hdr->h_dest, sizeof(BD_ADDR)) == 0)) {
551            int result = PAN_WriteBuf(handle, eth_hdr->h_dest, eth_hdr->h_src, ntohs(eth_hdr->h_proto), hdr, 0);
552            switch (result) {
553                case PAN_Q_SIZE_EXCEEDED:
554                    return FORWARD_CONGEST;
555                case PAN_SUCCESS:
556                    return FORWARD_SUCCESS;
557                default:
558                    return FORWARD_FAILURE;
559            }
560        }
561    }
562    GKI_freebuf(hdr);
563    return FORWARD_IGNORE;
564}
565
566static void bta_pan_callback_transfer(UINT16 event, char *p_param)
567{
568    tBTA_PAN *p_data = (tBTA_PAN *)p_param;
569
570    switch(event)
571    {
572        case BTA_PAN_ENABLE_EVT:
573            BTIF_TRACE_DEBUG("BTA_PAN_ENABLE_EVT");
574            break;
575        case BTA_PAN_SET_ROLE_EVT:
576            {
577                int btpan_role = bta_role_to_btpan(p_data->set_role.role);
578                bt_status_t status = p_data->set_role.status == BTA_PAN_SUCCESS ? BT_STATUS_SUCCESS : BT_STATUS_FAIL;
579                btpan_control_state_t state = btpan_role == 0 ? BTPAN_STATE_DISABLED : BTPAN_STATE_ENABLED;
580                callback.control_state_cb(state, btpan_role, status, TAP_IF_NAME);
581                break;
582            }
583        case BTA_PAN_OPENING_EVT:
584            {
585                btpan_conn_t* conn;
586                bdstr_t bds;
587                bdaddr_to_string((bt_bdaddr_t *)p_data->opening.bd_addr, bds, sizeof(bds));
588                BTIF_TRACE_DEBUG("BTA_PAN_OPENING_EVT handle %d, addr: %s", p_data->opening.handle, bds);
589                conn = btpan_find_conn_addr(p_data->opening.bd_addr);
590
591                asrt(conn != NULL);
592                if (conn)
593                {
594                    conn->handle = p_data->opening.handle;
595                    int btpan_conn_local_role = bta_role_to_btpan(conn->local_role);
596                    int btpan_remote_role = bta_role_to_btpan(conn->remote_role);
597                    callback.connection_state_cb(BTPAN_STATE_CONNECTING, BT_STATUS_SUCCESS,
598                            (const bt_bdaddr_t*)p_data->opening.bd_addr, btpan_conn_local_role, btpan_remote_role);
599                }
600                else
601                    BTIF_TRACE_ERROR("connection not found");
602                break;
603            }
604        case BTA_PAN_OPEN_EVT:
605            {
606                btpan_connection_state_t state;
607                bt_status_t status;
608                btpan_conn_t *conn = btpan_find_conn_handle(p_data->open.handle);
609
610                LOG_VERBOSE("%s pan connection open status: %d", __func__, p_data->open.status);
611                if (p_data->open.status == BTA_PAN_SUCCESS)
612                {
613                    state = BTPAN_STATE_CONNECTED;
614                    status = BT_STATUS_SUCCESS;
615                }
616                else
617                {
618                    state = BTPAN_STATE_DISCONNECTED;
619                    status = BT_STATUS_FAIL;
620                    btpan_cleanup_conn(conn);
621                }
622                /* debug("BTA_PAN_OPEN_EVT handle:%d, conn:%p",  p_data->open.handle, conn); */
623                /* debug("conn bta local_role:%d, bta remote role:%d", conn->local_role, conn->remote_role); */
624                int btpan_conn_local_role = bta_role_to_btpan(p_data->open.local_role);
625                int btpan_remote_role = bta_role_to_btpan(p_data->open.peer_role);
626                callback.connection_state_cb(state, status, (const bt_bdaddr_t*)p_data->open.bd_addr,
627                        btpan_conn_local_role, btpan_remote_role);
628                break;
629            }
630        case BTA_PAN_CLOSE_EVT:
631            {
632                btpan_conn_t* conn = btpan_find_conn_handle(p_data->close.handle);
633
634                LOG_INFO("%s: event = BTA_PAN_CLOSE_EVT handle %d", __FUNCTION__, p_data->close.handle);
635
636                if (conn && conn->handle >= 0)
637                {
638                    int btpan_conn_local_role = bta_role_to_btpan(conn->local_role);
639                    int btpan_remote_role = bta_role_to_btpan(conn->remote_role);
640                    callback.connection_state_cb(BTPAN_STATE_DISCONNECTED, 0, (const bt_bdaddr_t*)conn->peer,
641                            btpan_conn_local_role, btpan_remote_role);
642                    btpan_cleanup_conn(conn);
643                }
644                else
645                    BTIF_TRACE_ERROR("pan handle not found (%d)", p_data->close.handle);
646                break;
647            }
648        default:
649            BTIF_TRACE_WARNING("Unknown pan event %d", event);
650            break;
651    }
652}
653
654static void bta_pan_callback(tBTA_PAN_EVT event, tBTA_PAN *p_data)
655{
656    btif_transfer_context(bta_pan_callback_transfer, event, (char*)p_data, sizeof(tBTA_PAN), NULL);
657}
658
659#define IS_EXCEPTION(e) ((e) & (POLLHUP | POLLRDHUP | POLLERR | POLLNVAL))
660static void btu_exec_tap_fd_read(void *p_param) {
661    struct pollfd ufd;
662    int fd = (int)p_param;
663
664    if (fd == INVALID_FD || fd != btpan_cb.tap_fd)
665        return;
666
667    // Don't occupy BTU context too long, avoid GKI buffer overruns and
668    // give other profiles a chance to run by limiting the amount of memory
669    // PAN can use from the shared pool buffer.
670    for (int i = 0; i < PAN_POOL_MAX && btif_is_enabled() && btpan_cb.flow; i++) {
671        BT_HDR *buffer = (BT_HDR *)GKI_getpoolbuf(PAN_POOL_ID);
672        if (!buffer) {
673            BTIF_TRACE_WARNING("%s unable to allocate buffer for packet.", __func__);
674            break;
675        }
676        buffer->offset = PAN_MINIMUM_OFFSET;
677        buffer->len = GKI_get_buf_size(buffer) - sizeof(BT_HDR) - buffer->offset;
678
679        UINT8 *packet = (UINT8 *)buffer + sizeof(BT_HDR) + buffer->offset;
680
681        // If we don't have an undelivered packet left over, pull one from the TAP driver.
682        // We save it in the congest_packet right away in case we can't deliver it in this
683        // attempt.
684        if (!btpan_cb.congest_packet_size) {
685            ssize_t ret = read(fd, btpan_cb.congest_packet, sizeof(btpan_cb.congest_packet));
686            switch (ret) {
687                case -1:
688                    BTIF_TRACE_ERROR("%s unable to read from driver: %s", __func__, strerror(errno));
689                    GKI_freebuf(buffer);
690                    //add fd back to monitor thread to try it again later
691                    btsock_thread_add_fd(pan_pth, fd, 0, SOCK_THREAD_FD_RD, 0);
692                    return;
693                case 0:
694                    BTIF_TRACE_WARNING("%s end of file reached.", __func__);
695                    GKI_freebuf(buffer);
696                    //add fd back to monitor thread to process the exception
697                    btsock_thread_add_fd(pan_pth, fd, 0, SOCK_THREAD_FD_RD, 0);
698                    return;
699                default:
700                    btpan_cb.congest_packet_size = ret;
701                    break;
702            }
703        }
704
705        memcpy(packet, btpan_cb.congest_packet, MIN(btpan_cb.congest_packet_size, buffer->len));
706        buffer->len = MIN(btpan_cb.congest_packet_size, buffer->len);
707
708        if (buffer->len > sizeof(tETH_HDR) && should_forward((tETH_HDR *)packet)) {
709            // Extract the ethernet header from the buffer since the PAN_WriteBuf inside
710            // forward_bnep can't handle two pointers that point inside the same GKI buffer.
711            tETH_HDR hdr;
712            memcpy(&hdr, packet, sizeof(tETH_HDR));
713
714            // Skip the ethernet header.
715            buffer->len -= sizeof(tETH_HDR);
716            buffer->offset += sizeof(tETH_HDR);
717            if (forward_bnep(&hdr, buffer) != FORWARD_CONGEST)
718                btpan_cb.congest_packet_size = 0;
719        } else {
720            BTIF_TRACE_WARNING("%s dropping packet of length %d", __func__, buffer->len);
721            btpan_cb.congest_packet_size = 0;
722            GKI_freebuf(buffer);
723        }
724
725        // Bail out of the loop if reading from the TAP fd would block.
726        ufd.fd = fd;
727        ufd.events = POLLIN;
728        ufd.revents = 0;
729        if (poll(&ufd, 1, 0) <= 0 || IS_EXCEPTION(ufd.revents))
730            break;
731    }
732    //add fd back to monitor thread
733    btsock_thread_add_fd(pan_pth, fd, 0, SOCK_THREAD_FD_RD, 0);
734}
735
736static void btif_pan_close_all_conns() {
737    if (!stack_initialized)
738        return;
739
740    for (int i = 0; i < MAX_PAN_CONNS; ++i)
741    {
742        if (btpan_cb.conns[i].handle != -1)
743            BTA_PanClose(btpan_cb.conns[i].handle);
744    }
745}
746
747static void btpan_tap_fd_signaled(int fd, int type, int flags, uint32_t user_id) {
748    assert(btpan_cb.tap_fd == INVALID_FD || btpan_cb.tap_fd == fd);
749
750    if (btpan_cb.tap_fd != fd) {
751        BTIF_TRACE_WARNING("%s Signaled on mismatched fds exp:%d act:%d\n",
752                __func__, btpan_cb.tap_fd, fd);
753        return;
754    }
755
756    if (flags & SOCK_THREAD_FD_EXCEPTION) {
757        btpan_cb.tap_fd = INVALID_FD;
758        btpan_tap_close(fd);
759        btif_pan_close_all_conns();
760    } else if (flags & SOCK_THREAD_FD_RD)
761        bta_dmexecutecallback(btu_exec_tap_fd_read, (void *)fd);
762}
763