/*

 *

 *  BlueZ - Bluetooth protocol stack for Linux

 *

 *  Copyright (C) 2004-2010  Marcel Holtmann <marcel@holtmann.org>

 *  Copyright (C) 2014       Google Inc.

 *

 *

 *  This program is free software; you can redistribute it and/or modify

 *  it under the terms of the GNU General Public License as published by

 *  the Free Software Foundation; either version 2 of the License, or

 *  (at your option) any later version.

 *

 *  This program is distributed in the hope that it will be useful,

 *  but WITHOUT ANY WARRANTY; without even the implied warranty of

 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 *  GNU General Public License for more details.

 *

 *  You should have received a copy of the GNU General Public License

 *  along with this program; if not, write to the Free Software

 *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

 *

 */

#ifdef HAVE_CONFIG_H

#include <config.h>

#endif

#define _GNU_SOURCE

#include <stdlib.h>

#include <stdbool.h>

#include <errno.h>

#include <fcntl.h>

#include <unistd.h>

#include <sys/ioctl.h>

#include "lib/bluetooth.h"

#include "lib/hidp.h"

#include "lib/sdp.h"

#include "lib/sdp_lib.h"

#include "lib/uuid.h"

#include "gdbus/gdbus.h"

#include "btio/btio.h"

#include "src/log.h"

#include "src/adapter.h"

#include "src/device.h"

#include "src/profile.h"

#include "src/service.h"

#include "src/storage.h"

#include "src/dbus-common.h"

#include "src/error.h"

#include "src/sdp-client.h"

#include "src/shared/uhid.h"

#include "device.h"

#include "hidp_defs.h"

#define INPUT_INTERFACE "org.bluez.Input1"

enum reconnect_mode_t {

	RECONNECT_NONE = 0,

	RECONNECT_DEVICE,

	RECONNECT_HOST,

	RECONNECT_ANY

};

struct input_device {

	struct btd_service	*service;

	struct btd_device	*device;

	char			*path;

	bdaddr_t		src;

	bdaddr_t		dst;

	uint32_t		handle;

	GIOChannel		*ctrl_io;

	GIOChannel		*intr_io;

	guint			ctrl_watch;

	guint			intr_watch;

	guint			sec_watch;

	struct hidp_connadd_req *req;

	bool			disable_sdp;

	enum reconnect_mode_t	reconnect_mode;

	guint			reconnect_timer;

	uint32_t		reconnect_attempt;

	struct bt_uhid		*uhid;

	bool			uhid_created;

	uint8_t			report_req_pending;

	guint			report_req_timer;

	uint32_t		report_rsp_id;

};

static int idle_timeout = 0;

static bool uhid_enabled = false;

static bool classic_bonded_only = false;

void input_set_idle_timeout(int timeout)

{

	idle_timeout = timeout;

}

void input_enable_userspace_hid(bool state)

{

	uhid_enabled = state;

}

void input_set_classic_bonded_only(bool state)

{

	classic_bonded_only = state;

}

static void input_device_enter_reconnect_mode(struct input_device *idev);

static int connection_disconnect(struct input_device *idev, uint32_t flags);

static void input_device_free(struct input_device *idev)

{

	bt_uhid_unref(idev->uhid);

	btd_service_unref(idev->service);

	btd_device_unref(idev->device);

	g_free(idev->path);

	if (idev->ctrl_watch > 0)

		g_source_remove(idev->ctrl_watch);

	if (idev->intr_watch > 0)

		g_source_remove(idev->intr_watch);

	if (idev->sec_watch > 0)

		g_source_remove(idev->sec_watch);

	if (idev->intr_io)

		g_io_channel_unref(idev->intr_io);

	if (idev->ctrl_io)

		g_io_channel_unref(idev->ctrl_io);

	if (idev->req) {

		g_free(idev->req->rd_data);

		g_free(idev->req);

	}

	if (idev->reconnect_timer > 0)

		g_source_remove(idev->reconnect_timer);

	if (idev->report_req_timer > 0)

		g_source_remove(idev->report_req_timer);

	g_free(idev);

}

static bool hidp_send_message(GIOChannel *chan, uint8_t hdr,

					const uint8_t *data, size_t size)

{

	int fd;

	ssize_t len;

	uint8_t msg[size + 1];

	if (!chan) {

		error("BT socket not connected");

		return false;

	}

	if (data == NULL)

		size = 0;

	msg[0] = hdr;

	if (size > 0)

		memcpy(&msg[1], data, size);

	++size;

	fd = g_io_channel_unix_get_fd(chan);

	len = write(fd, msg, size);

	if (len < 0) {

		error("BT socket write error: %s (%d)", strerror(errno), errno);

		return false;

	}

	if ((size_t) len < size) {

		error("BT socket write error: partial write (%zd of %zu bytes)",

								len, size);

		return false;

	}

	return true;

}

static bool hidp_send_ctrl_message(struct input_device *idev, uint8_t hdr,

					const uint8_t *data, size_t size)

{

	return hidp_send_message(idev->ctrl_io, hdr, data, size);

}

static bool hidp_send_intr_message(struct input_device *idev, uint8_t hdr,

					const uint8_t *data, size_t size)

{

	return hidp_send_message(idev->intr_io, hdr, data, size);

}

static bool uhid_send_feature_answer(struct input_device *idev,

					const uint8_t *data, size_t size,

					uint32_t id, uint16_t err)

{

	struct uhid_event ev;

	int ret;

	if (data == NULL)

		size = 0;

	if (size > sizeof(ev.u.feature_answer.data))

		size = sizeof(ev.u.feature_answer.data);

	if (!idev->uhid_created) {

		DBG("HID report (%zu bytes) dropped", size);

		return false;

	}

	memset(&ev, 0, sizeof(ev));

	ev.type = UHID_FEATURE_ANSWER;

	ev.u.feature_answer.id = id;

	ev.u.feature_answer.err = err;

	ev.u.feature_answer.size = size;

	if (size > 0)

		memcpy(ev.u.feature_answer.data, data, size);

	ret = bt_uhid_send(idev->uhid, &ev;;

	if (ret < 0) {

		error("bt_uhid_send: %s (%d)", strerror(-ret), -ret);

		return false;

	}

	DBG("HID report (%zu bytes)", size);

	return true;

}

static bool uhid_send_input_report(struct input_device *idev,

					const uint8_t *data, size_t size)

{

	struct uhid_event ev;

	int err;

	if (data == NULL)

		size = 0;

	if (size > sizeof(ev.u.input.data))

		size = sizeof(ev.u.input.data);

	if (!idev->uhid_created) {

		DBG("HID report (%zu bytes) dropped", size);

		return false;

	}

	memset(&ev, 0, sizeof(ev));

	ev.type = UHID_INPUT;

	ev.u.input.size = size;

	if (size > 0)

		memcpy(ev.u.input.data, data, size);

	err = bt_uhid_send(idev->uhid, &ev;;

	if (err < 0) {

		error("bt_uhid_send: %s (%d)", strerror(-err), -err);

		return false;

	}

	DBG("HID report (%zu bytes)", size);

	return true;

}

static bool hidp_recv_intr_data(GIOChannel *chan, struct input_device *idev)

{

	int fd;

	ssize_t len;

	uint8_t hdr;

	uint8_t data[UHID_DATA_MAX + 1];

	fd = g_io_channel_unix_get_fd(chan);

	len = read(fd, data, sizeof(data));

	if (len < 0) {

		error("BT socket read error: %s (%d)", strerror(errno), errno);

		return false;

	}

	if (len == 0) {

		DBG("BT socket read returned 0 bytes");

		return true;

	}

	hdr = data[0];

	if (hdr != (HIDP_TRANS_DATA | HIDP_DATA_RTYPE_INPUT)) {

		DBG("unsupported HIDP protocol header 0x%02x", hdr);

		return true;

	}

	if (len < 2) {

		DBG("received empty HID report");

		return true;

	}

	uhid_send_input_report(idev, data + 1, len - 1);

	return true;

}

static gboolean intr_watch_cb(GIOChannel *chan, GIOCondition cond, gpointer data)

{

	struct input_device *idev = data;

	char address[18];

	if (cond & G_IO_IN) {

		if (hidp_recv_intr_data(chan, idev) && (cond == G_IO_IN))

			return TRUE;

	}

	ba2str(&idev->dst, address);

	DBG("Device %s disconnected", address);

	/* Checking for ctrl_watch avoids a double g_io_channel_shutdown since

	 * it's likely that ctrl_watch_cb has been queued for dispatching in

	 * this mainloop iteration */

	if ((cond & (G_IO_HUP | G_IO_ERR)) && idev->ctrl_watch)

		g_io_channel_shutdown(chan, TRUE, NULL);

	idev->intr_watch = 0;

	if (idev->intr_io) {

		g_io_channel_unref(idev->intr_io);

		idev->intr_io = NULL;

	}

	/* Close control channel */

	if (idev->ctrl_io && !(cond & G_IO_NVAL))

		g_io_channel_shutdown(idev->ctrl_io, TRUE, NULL);

	btd_service_disconnecting_complete(idev->service, 0);

	/* Enter the auto-reconnect mode if needed */

	input_device_enter_reconnect_mode(idev);

	return FALSE;

}

static void hidp_recv_ctrl_handshake(struct input_device *idev, uint8_t param)

{

	bool pending_req_complete = false;

	uint8_t pending_req_type;

	DBG("");

	pending_req_type = idev->report_req_pending & HIDP_HEADER_TRANS_MASK;

	switch (param) {

	case HIDP_HSHK_SUCCESSFUL:

		if (pending_req_type == HIDP_TRANS_SET_REPORT) {

			DBG("SET_REPORT successful");

			pending_req_complete = true;

		} else

			DBG("Spurious HIDP_HSHK_SUCCESSFUL");

		break;

	case HIDP_HSHK_NOT_READY:

	case HIDP_HSHK_ERR_INVALID_REPORT_ID:

	case HIDP_HSHK_ERR_UNSUPPORTED_REQUEST:

	case HIDP_HSHK_ERR_INVALID_PARAMETER:

	case HIDP_HSHK_ERR_UNKNOWN:

	case HIDP_HSHK_ERR_FATAL:

		if (pending_req_type == HIDP_TRANS_GET_REPORT) {

			DBG("GET_REPORT failed (%u)", param);

			uhid_send_feature_answer(idev, NULL, 0,

						idev->report_rsp_id, EIO);

			pending_req_complete = true;

		} else if (pending_req_type == HIDP_TRANS_SET_REPORT) {

			DBG("SET_REPORT failed (%u)", param);

			pending_req_complete = true;

		} else

			DBG("Spurious HIDP_HSHK_ERR");

		if (param == HIDP_HSHK_ERR_FATAL)

			hidp_send_ctrl_message(idev, HIDP_TRANS_HID_CONTROL |

						HIDP_CTRL_SOFT_RESET, NULL, 0);

		break;

	default:

		hidp_send_ctrl_message(idev, HIDP_TRANS_HANDSHAKE |

				HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);

		break;

	}

	if (pending_req_complete) {

		idev->report_req_pending = 0;

		if (idev->report_req_timer > 0) {

			g_source_remove(idev->report_req_timer);

			idev->report_req_timer = 0;

		}

		idev->report_rsp_id = 0;

	}

}

static void hidp_recv_ctrl_hid_control(struct input_device *idev, uint8_t param)

{

	DBG("");

	if (param == HIDP_CTRL_VIRTUAL_CABLE_UNPLUG)

		connection_disconnect(idev, 0);

}

static void hidp_recv_ctrl_data(struct input_device *idev, uint8_t param,

					const uint8_t *data, size_t size)

{

	uint8_t pending_req_type;

	uint8_t pending_req_param;

	DBG("");

	pending_req_type = idev->report_req_pending & HIDP_HEADER_TRANS_MASK;

	if (pending_req_type != HIDP_TRANS_GET_REPORT) {

		DBG("Spurious DATA on control channel");

		return;

	}

	pending_req_param = idev->report_req_pending & HIDP_HEADER_PARAM_MASK;

	if (pending_req_param != param) {

		DBG("Received DATA RTYPE doesn't match pending request RTYPE");

		return;

	}

	switch (param) {

	case HIDP_DATA_RTYPE_FEATURE:

	case HIDP_DATA_RTYPE_INPUT:

	case HIDP_DATA_RTYPE_OUPUT:

		uhid_send_feature_answer(idev, data + 1, size - 1,

							idev->report_rsp_id, 0);

		break;

	case HIDP_DATA_RTYPE_OTHER:

		DBG("Received DATA_RTYPE_OTHER");

		break;

	default:

		hidp_send_ctrl_message(idev, HIDP_TRANS_HANDSHAKE |

				HIDP_HSHK_ERR_INVALID_PARAMETER, NULL, 0);

		break;

	}

	idev->report_req_pending = 0;

	if (idev->report_req_timer > 0) {

		g_source_remove(idev->report_req_timer);

		idev->report_req_timer = 0;

	}

	idev->report_rsp_id = 0;

}

static bool hidp_recv_ctrl_message(GIOChannel *chan, struct input_device *idev)

{

	int fd;

	ssize_t len;

	uint8_t hdr, type, param;

	uint8_t data[UHID_DATA_MAX + 1];

	fd = g_io_channel_unix_get_fd(chan);

	len = read(fd, data, sizeof(data));

	if (len < 0) {

		error("BT socket read error: %s (%d)", strerror(errno), errno);

		return false;

	}

	if (len == 0) {

		DBG("BT socket read returned 0 bytes");

		return true;

	}

	hdr = data[0];

	type = hdr & HIDP_HEADER_TRANS_MASK;

	param = hdr & HIDP_HEADER_PARAM_MASK;

	switch (type) {

	case HIDP_TRANS_HANDSHAKE:

		hidp_recv_ctrl_handshake(idev, param);

		break;

	case HIDP_TRANS_HID_CONTROL:

		hidp_recv_ctrl_hid_control(idev, param);

		break;

	case HIDP_TRANS_DATA:

		hidp_recv_ctrl_data(idev, param, data, len);

		break;

	default:

		error("unsupported HIDP control message");

		hidp_send_ctrl_message(idev, HIDP_TRANS_HANDSHAKE |

				HIDP_HSHK_ERR_UNSUPPORTED_REQUEST, NULL, 0);

		break;

	}

	return true;

}

static gboolean ctrl_watch_cb(GIOChannel *chan, GIOCondition cond, gpointer data)

{

	struct input_device *idev = data;

	char address[18];

	if (cond & G_IO_IN) {

		if (hidp_recv_ctrl_message(chan, idev) && (cond == G_IO_IN))

			return TRUE;

	}

	ba2str(&idev->dst, address);

	DBG("Device %s disconnected", address);

	/* Checking for intr_watch avoids a double g_io_channel_shutdown since

	 * it's likely that intr_watch_cb has been queued for dispatching in

	 * this mainloop iteration */

	if ((cond & (G_IO_HUP | G_IO_ERR)) && idev->intr_watch)

		g_io_channel_shutdown(chan, TRUE, NULL);

	idev->ctrl_watch = 0;

	if (idev->ctrl_io) {

		g_io_channel_unref(idev->ctrl_io);

		idev->ctrl_io = NULL;

	}

	/* Close interrupt channel */

	if (idev->intr_io && !(cond & G_IO_NVAL))

		g_io_channel_shutdown(idev->intr_io, TRUE, NULL);

	return FALSE;

}

#define REPORT_REQ_TIMEOUT  3

static gboolean hidp_report_req_timeout(gpointer data)

{

	struct input_device *idev = data;

	uint8_t pending_req_type;

	const char *req_type_str;

	char address[18];

	ba2str(&idev->dst, address);

	pending_req_type = idev->report_req_pending & HIDP_HEADER_TRANS_MASK;

	switch (pending_req_type) {

	case HIDP_TRANS_GET_REPORT:

		req_type_str = "GET_REPORT";

		break;

	case HIDP_TRANS_SET_REPORT:

		req_type_str = "SET_REPORT";

		break;

	default:

		/* Should never happen */

		req_type_str = "OTHER_TRANS";

		break;

	}

	DBG("Device %s HIDP %s request timed out", address, req_type_str);

	idev->report_req_pending = 0;

	idev->report_req_timer = 0;

	idev->report_rsp_id = 0;

	return FALSE;

}

static void hidp_send_set_report(struct uhid_event *ev, void *user_data)

{

	struct input_device *idev = user_data;

	uint8_t hdr;

	bool sent;

	DBG("");

	switch (ev->u.output.rtype) {

	case UHID_FEATURE_REPORT:

		/* Send SET_REPORT on control channel */

		if (idev->report_req_pending) {

			DBG("Old GET_REPORT or SET_REPORT still pending");

			return;

		}

		hdr = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;

		sent = hidp_send_ctrl_message(idev, hdr, ev->u.output.data,

							ev->u.output.size);

		if (sent) {

			idev->report_req_pending = hdr;

			idev->report_req_timer =

				g_timeout_add_seconds(REPORT_REQ_TIMEOUT,

						hidp_report_req_timeout, idev);

		}

		break;

	case UHID_OUTPUT_REPORT:

		/* Send DATA on interrupt channel */

		hdr = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;

		hidp_send_intr_message(idev, hdr, ev->u.output.data,

							ev->u.output.size);

		break;

	default:

		DBG("Unsupported HID report type %u", ev->u.output.rtype);

		return;

	}

}

static void hidp_send_get_report(struct uhid_event *ev, void *user_data)

{

	struct input_device *idev = user_data;

	uint8_t hdr;

	bool sent;

	DBG("");

	if (idev->report_req_pending) {

		DBG("Old GET_REPORT or SET_REPORT still pending");

		uhid_send_feature_answer(idev, NULL, 0, ev->u.feature.id,

									EBUSY);

		return;

	}

	/* Send GET_REPORT on control channel */

	switch (ev->u.feature.rtype) {

	case UHID_FEATURE_REPORT:

		hdr = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_FEATURE;

		break;

	case UHID_INPUT_REPORT:

		hdr = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_INPUT;

		break;

	case UHID_OUTPUT_REPORT:

		hdr = HIDP_TRANS_GET_REPORT | HIDP_DATA_RTYPE_OUPUT;

		break;

	default:

		DBG("Unsupported HID report type %u", ev->u.feature.rtype);

		return;

	}

	sent = hidp_send_ctrl_message(idev, hdr, &ev->u.feature.rnum,

						sizeof(ev->u.feature.rnum));

	if (sent) {

		idev->report_req_pending = hdr;

		idev->report_req_timer =

			g_timeout_add_seconds(REPORT_REQ_TIMEOUT,

						hidp_report_req_timeout, idev);

		idev->report_rsp_id = ev->u.feature.id;

	}

}

static void epox_endian_quirk(unsigned char *data, int size)

{

	/* USAGE_PAGE (Keyboard)	05 07

	 * USAGE_MINIMUM (0)		19 00

	 * USAGE_MAXIMUM (65280)	2A 00 FF   <= must be FF 00

	 * LOGICAL_MINIMUM (0)		15 00

	 * LOGICAL_MAXIMUM (65280)	26 00 FF   <= must be FF 00

	 */

	unsigned char pattern[] = { 0x05, 0x07, 0x19, 0x00, 0x2a, 0x00, 0xff,

						0x15, 0x00, 0x26, 0x00, 0xff };

	unsigned int i;

	if (!data)

		return;

	for (i = 0; i < size - sizeof(pattern); i++) {

		if (!memcmp(data + i, pattern, sizeof(pattern))) {

			data[i + 5] = 0xff;

			data[i + 6] = 0x00;

			data[i + 10] = 0xff;

			data[i + 11] = 0x00;

		}

	}

}

static int create_hid_dev_name(sdp_record_t *rec, struct hidp_connadd_req *req)

{

	char sdesc[sizeof(req->name) / 2];

	if (sdp_get_service_desc(rec, sdesc, sizeof(sdesc)) == 0) {

		char pname[sizeof(req->name) / 2];

		if (sdp_get_provider_name(rec, pname, sizeof(pname)) == 0 &&

						strncmp(sdesc, pname, 5) != 0)

			snprintf(req->name, sizeof(req->name), "%s %s",

								pname, sdesc);

		else

			snprintf(req->name, sizeof(req->name), "%s", sdesc);

	} else {

		return sdp_get_service_name(rec, req->name, sizeof(req->name));

	}

	return 0;

}

/* See HID profile specification v1.0, "7.11.6 HIDDescriptorList" for details

 * on the attribute format. */

static int extract_hid_desc_data(sdp_record_t *rec,

						struct hidp_connadd_req *req)

{

	sdp_data_t *d;

	d = sdp_data_get(rec, SDP_ATTR_HID_DESCRIPTOR_LIST);

	if (!d)

		goto invalid_desc;

	if (!SDP_IS_SEQ(d->dtd))

		goto invalid_desc;

	/* First HIDDescriptor */

	d = d->val.dataseq;

	if (!SDP_IS_SEQ(d->dtd))

		goto invalid_desc;

	/* ClassDescriptorType */

	d = d->val.dataseq;

	if (d->dtd != SDP_UINT8)

		goto invalid_desc;

	/* ClassDescriptorData */

	d = d->next;

	if (!d || !SDP_IS_TEXT_STR(d->dtd))

		goto invalid_desc;

	req->rd_data = g_try_malloc0(d->unitSize);

	if (req->rd_data) {

		memcpy(req->rd_data, d->val.str, d->unitSize);

		req->rd_size = d->unitSize;

		epox_endian_quirk(req->rd_data, req->rd_size);

	}

	return 0;

invalid_desc:

	error("Missing or invalid HIDDescriptorList SDP attribute");

	return -EINVAL;

}

static int extract_hid_record(sdp_record_t *rec, struct hidp_connadd_req *req)

{

	sdp_data_t *pdlist;

	uint8_t attr_val;

	int err;

	err = create_hid_dev_name(rec, req);

	if (err < 0)

		DBG("No valid Service Name or Service Description found");

	pdlist = sdp_data_get(rec, SDP_ATTR_HID_PARSER_VERSION);

	req->parser = pdlist ? pdlist->val.uint16 : 0x0100;

	pdlist = sdp_data_get(rec, SDP_ATTR_HID_DEVICE_SUBCLASS);

	req->subclass = pdlist ? pdlist->val.uint8 : 0;

	pdlist = sdp_data_get(rec, SDP_ATTR_HID_COUNTRY_CODE);

	req->country = pdlist ? pdlist->val.uint8 : 0;

	pdlist = sdp_data_get(rec, SDP_ATTR_HID_VIRTUAL_CABLE);

	attr_val = pdlist ? pdlist->val.uint8 : 0;

	if (attr_val)

		req->flags |= (1 << HIDP_VIRTUAL_CABLE_UNPLUG);

	pdlist = sdp_data_get(rec, SDP_ATTR_HID_BOOT_DEVICE);

	attr_val = pdlist ? pdlist->val.uint8 : 0;

	if (attr_val)

		req->flags |= (1 << HIDP_BOOT_PROTOCOL_MODE);

	err = extract_hid_desc_data(rec, req);

	if (err < 0)

		return err;

	return 0;

}

static int ioctl_connadd(struct hidp_connadd_req *req)

{

	int ctl, err = 0;

	ctl = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HIDP);

	if (ctl < 0)

		return -errno;

	if (ioctl(ctl, HIDPCONNADD, req) < 0)

		err = -errno;

	close(ctl);

	return err;

}

static bool ioctl_is_connected(struct input_device *idev)

{

	struct hidp_conninfo ci;

	int ctl;

	/* Standard HID */

	ctl = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HIDP);

	if (ctl < 0) {

		error("Can't open HIDP control socket");

		return false;

	}

	memset(&ci, 0, sizeof(ci));

	bacpy(&ci.bdaddr, &idev->dst);

	if (ioctl(ctl, HIDPGETCONNINFO, &ci) < 0) {

		error("Can't get HIDP connection info");

		close(ctl);

		return false;

	}

	close(ctl);

	if (ci.state != BT_CONNECTED)

		return false;

	return true;

}

static int ioctl_disconnect(struct input_device *idev, uint32_t flags)

{

	struct hidp_conndel_req req;

	struct hidp_conninfo ci;

	int ctl, err = 0;

	ctl = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HIDP);

	if (ctl < 0) {

		error("Can't open HIDP control socket");

		return -errno;

	}

	memset(&ci, 0, sizeof(ci));

	bacpy(&ci.bdaddr, &idev->dst);

	if ((ioctl(ctl, HIDPGETCONNINFO, &ci) < 0) ||

						(ci.state != BT_CONNECTED)) {

		close(ctl);

		return -ENOTCONN;

	}

	memset(&req, 0, sizeof(req));

	bacpy(&req.bdaddr, &idev->dst);

	req.flags = flags;

	if (ioctl(ctl, HIDPCONNDEL, &req) < 0) {

		err = -errno;

		error("Can't delete the HID device: %s (%d)",

							strerror(-err), -err);

	}

	close(ctl);

	return err;

}

static int uhid_connadd(struct input_device *idev, struct hidp_connadd_req *req)

{

	int err;

	struct uhid_event ev;

	if (idev->uhid_created)

		return 0;

	/* create uHID device */

	memset(&ev, 0, sizeof(ev));

	ev.type = UHID_CREATE;

	strncpy((char *) ev.u.create.name, req->name, sizeof(ev.u.create.name));

	ba2str(&idev->src, (char *) ev.u.create.phys);

	ba2str(&idev->dst, (char *) ev.u.create.uniq);

	ev.u.create.vendor = req->vendor;

	ev.u.create.product = req->product;

	ev.u.create.version = req->version;

	ev.u.create.country = req->country;

	ev.u.create.bus = BUS_BLUETOOTH;

	ev.u.create.rd_data = req->rd_data;

	ev.u.create.rd_size = req->rd_size;

	err = bt_uhid_send(idev->uhid, &ev;;

	if (err < 0) {

		error("bt_uhid_send: %s", strerror(-err));

		return err;

	}

	bt_uhid_register(idev->uhid, UHID_OUTPUT, hidp_send_set_report, idev);