[PATCH BlueZ 1/7] monitor: Add packet definitions for MSFT extension

@@ -24,6 +24,154 @@
 
 #include <stdint.h>
 
+#define MSFT_SUBCMD_READ_SUPPORTED_FEATURES	0x00
+
+struct msft_cmd_read_supported_features {
+	uint8_t subcmd;
+} __attribute__((packed));
+
+struct msft_rsp_read_supported_features {
+	uint8_t  status;
+	uint8_t  subcmd;
+	uint8_t  features[8];
+	uint8_t  evt_prefix_len;
+	uint8_t  evt_prefix[];
+} __attribute__((packed));
+
+#define MSFT_SUBCMD_MONITOR_RSSI		0x01
+
+struct msft_cmd_monitor_rssi {
+	uint8_t  subcmd;
+	uint16_t handle;
+	int8_t   rssi_high;
+	int8_t   rssi_low;
+	uint8_t  rssi_low_interval;
+	uint8_t  rssi_period;
+} __attribute__((packed));
+
+struct msft_rsp_monitor_rssi {
+	uint8_t  status;
+	uint8_t  subcmd;
+} __attribute__((packed));
+
+#define MSFT_SUBCMD_CANCEL_MONITOR_RSSI		0x02
+
+struct msft_cmd_cancel_monitor_rssi {
+	uint8_t  subcmd;
+	uint16_t handle;
+} __attribute__((packed));
+
+struct msft_rsp_cancel_monitor_rssi {
+	uint8_t  status;
+	uint8_t  subcmd;
+} __attribute__((packed));
+
+#define MSFT_SUBCMD_LE_MONITOR_ADV		0x03
+
+struct msft_le_monitor_pattern {
+	uint8_t  len;
+	uint8_t  type;
+	uint8_t  start;
+	uint8_t  data[];
+} __attribute__((packed));
+
+struct msft_le_monitor_adv_pattern_type {
+	uint8_t num_patterns;
+	struct msft_le_monitor_pattern data[];
+} __attribute__((packed));
+
+struct msft_le_monitor_adv_uuid_type {
+	uint8_t  type;
+	union {
+		uint16_t u16;
+		uint32_t u32;
+		uint8_t  u128[8];
+	} value;
+} __attribute__((packed));
+
+struct msft_le_monitor_adv_irk_type {
+	uint8_t  irk[8];
+} __attribute__((packed));
+
+#define MSFT_SUBCMD_LE_MONITOR_ADV_ADDR		0x04
+struct msft_le_monitor_adv_addr {
+	uint8_t  type;
+	uint8_t  addr[6];
+} __attribute__((packed));
+
+struct msft_cmd_le_monitor_adv {
+	uint8_t  subcmd;
+	int8_t   rssi_low;
+	int8_t   rssi_high;
+	uint8_t  rssi_low_interval;
+	uint8_t  rssi_period;
+	uint8_t  type;
+	uint8_t  data[];
+} __attribute__((packed));
+
+struct msft_rsp_le_monitor_adv {
+	uint8_t  status;
+	uint8_t  subcmd;
+	uint8_t  handle;
+} __attribute__((packed));
+
+#define MSFT_SUBCMD_LE_CANCEL_MONITOR_ADV	0x04
+
+struct msft_cmd_le_cancel_monitor_adv {
+	uint8_t  subcmd;
+	uint8_t  handle;
+} __attribute__((packed));
+
+struct msft_rsp_le_cancel_monitor_adv {
+	uint8_t  status;
+	uint8_t  subcmd;
+} __attribute__((packed));
+
+#define MSFT_SUBCMD_LE_MONITOR_ADV_ENABLE	0x05
+
+struct msft_cmd_le_monitor_adv_enable {
+	uint8_t  subcmd;
+	uint8_t  enable;
+} __attribute__((packed));
+
+struct msft_rsp_le_monitor_adv_enable {
+	uint8_t  status;
+	uint8_t  subcmd;
+} __attribute__((packed));
+
+#define MSFT_SUBCMD_READ_ABS_RSSI		0x06
+
+struct msft_cmd_read_abs_rssi {
+	uint8_t  subcmd;
+	uint16_t handle;
+} __attribute__((packed));
+
+struct msft_rsp_read_abs_rssi {
+	uint8_t  status;
+	uint8_t  subcmd;
+	uint16_t handle;
+	uint8_t  rssi;
+} __attribute__((packed));
+
+#define MSFT_SUBEVT_RSSI			0x01
+
+struct msft_evt_rssi {
+	uint8_t  subevt;
+	uint8_t  status;
+	uint16_t handle;
+	uint8_t  rssi;
+} __attribute__((packed));
+
+#define MSFT_SUBEVT_MONITOR_DEVICE		0x02
+
+struct msft_evt_monitor_device {
+	uint8_t  subevt;
+	uint8_t  addr_type;
+	uint8_t  addr[6];
+	uint8_t  handle;
+	uint8_t  state;
+} __attribute__((packed));
+
 struct vendor_ocf;
 struct vendor_evt;
 

@@ -17,12 +17,14 @@
 #include <stdlib.h>
 #include <stdbool.h>
 #include <getopt.h>
+#include <sys/uio.h>
 
 #include "src/shared/mainloop.h"
 #include "src/shared/util.h"
 
 #include "serial.h"
 #include "server.h"
+#include "btdev.h"
 #include "vhci.h"
 #include "amp.h"
 #include "le.h"

@@ -90,7 +92,7 @@ int main(int argc, char *argv[])
 	int letest_count = 0;
 	int amptest_count = 0;
 	int vhci_count = 0;
-	enum vhci_type vhci_type = VHCI_TYPE_BREDRLE;
+	enum btdev_type type = BTDEV_TYPE_BREDRLE52;
 	int i;
 
 	mainloop_init();

@@ -120,13 +122,13 @@ int main(int argc, char *argv[])
 				vhci_count = 1;
 			break;
 		case 'L':
-			vhci_type = VHCI_TYPE_LE;
+			type = BTDEV_TYPE_LE;
 			break;
 		case 'B':
-			vhci_type = VHCI_TYPE_BREDR;
+			type = BTDEV_TYPE_BREDR;
 			break;
 		case 'A':
-			vhci_type = VHCI_TYPE_AMP;
+			type = BTDEV_TYPE_AMP;
 			break;
 		case 'U':
 			if (optarg)

@@ -182,7 +184,7 @@ int main(int argc, char *argv[])
 	for (i = 0; i < vhci_count; i++) {
 		struct vhci *vhci;
 
-		vhci = vhci_open(vhci_type);
+		vhci = vhci_open(type);
 		if (!vhci) {
 			fprintf(stderr, "Failed to open Virtual HCI device\n");
 			return EXIT_FAILURE;

@@ -29,10 +29,8 @@
 #include "btdev.h"
 #include "vhci.h"
 
-#define uninitialized_var(x) x = x
-
 struct vhci {
-	enum vhci_type type;
+	enum btdev_type type;
 	int fd;
 	struct btdev *btdev;
 };

@@ -91,32 +89,22 @@ bool vhci_set_debug(struct vhci *vhci, vhci_debug_func_t callback,
 	return btdev_set_debug(vhci->btdev, callback, user_data, destroy);
 }
 
-struct vhci *vhci_open(enum vhci_type type)
+struct vhci_create_req {
+	uint8_t  pkt_type;
+	uint8_t  opcode;
+} __attribute__((packed));
+
+struct vhci_create_rsp {
+	uint8_t  pkt_type;
+	uint8_t  opcode;
+	uint16_t index;
+} __attribute__((packed));
+
+struct vhci *vhci_open(uint8_t type)
 {
 	struct vhci *vhci;
-	enum btdev_type uninitialized_var(btdev_type);
-	unsigned char uninitialized_var(ctrl_type);
-	unsigned char setup_cmd[2];
-	static uint8_t id = 0x23;
-
-	switch (type) {
-	case VHCI_TYPE_BREDRLE:
-		btdev_type = BTDEV_TYPE_BREDRLE52;
-		ctrl_type = HCI_PRIMARY;
-		break;
-	case VHCI_TYPE_BREDR:
-		btdev_type = BTDEV_TYPE_BREDR;
-		ctrl_type = HCI_PRIMARY;
-		break;
-	case VHCI_TYPE_LE:
-		btdev_type = BTDEV_TYPE_LE;
-		ctrl_type = HCI_PRIMARY;
-		break;
-	case VHCI_TYPE_AMP:
-		btdev_type = BTDEV_TYPE_AMP;
-		ctrl_type = HCI_AMP;
-		break;
-	}
+	struct vhci_create_req req;
+	struct vhci_create_rsp rsp;
 
 	vhci = malloc(sizeof(*vhci));
 	if (!vhci)

@@ -131,16 +119,33 @@ struct vhci *vhci_open(enum vhci_type type)
 		return NULL;
 	}
 
-	setup_cmd[0] = HCI_VENDOR_PKT;
-	setup_cmd[1] = ctrl_type;
+	memset(&req, 0, sizeof(req));
+	req.pkt_type = HCI_VENDOR_PKT;
 
-	if (write(vhci->fd, setup_cmd, sizeof(setup_cmd)) < 0) {
+	switch (type) {
+	case BTDEV_TYPE_AMP:
+		req.opcode = HCI_AMP;
+		break;
+	default:
+		req.opcode = HCI_PRIMARY;
+		break;
+	}
+
+	if (write(vhci->fd, &req, sizeof(req)) < 0) {
+		close(vhci->fd);
+		free(vhci);
+		return NULL;
+	}
+
+	memset(&rsp, 0, sizeof(rsp));
+
+	if (read(vhci->fd, &rsp, sizeof(rsp)) < 0) {
 		close(vhci->fd);
 		free(vhci);
 		return NULL;
 	}
 
-	vhci->btdev = btdev_create(btdev_type, id++);
+	vhci->btdev = btdev_create(type, rsp.index);
 	if (!vhci->btdev) {
 		close(vhci->fd);
 		free(vhci);

@@ -167,3 +172,11 @@ void vhci_close(struct vhci *vhci)
 
 	mainloop_remove_fd(vhci->fd);
 }
+
+struct btdev *vhci_get_btdev(struct vhci *vhci)
+{
+	if (!vhci)
+		return NULL;
+
+	return vhci->btdev;
+}

@@ -11,13 +11,6 @@
 
 #include <stdint.h>
 
-enum vhci_type {
-	VHCI_TYPE_BREDRLE,
-	VHCI_TYPE_BREDR,
-	VHCI_TYPE_LE,
-	VHCI_TYPE_AMP,
-};
-
 struct vhci;
 
 typedef void (*vhci_debug_func_t)(const char *str, void *user_data);

@@ -25,5 +18,7 @@ typedef void (*vhci_destroy_func_t)(void *user_data);
 bool vhci_set_debug(struct vhci *vhci, vhci_debug_func_t callback,
 			void *user_data, vhci_destroy_func_t destroy);
 
-struct vhci *vhci_open(enum vhci_type type);
+struct vhci *vhci_open(uint8_t type);
 void vhci_close(struct vhci *vhci);
+
+struct btdev *vhci_get_btdev(struct vhci *vhci);

@@ -30,6 +30,9 @@
 #include <stdio.h>
 #include <inttypes.h>
 
+#include "lib/bluetooth.h"
+#include "lib/uuid.h"
+
 #include "src/shared/util.h"
 #include "display.h"
 #include "packet.h"

@@ -49,46 +52,132 @@ static void null_rsp(const void *data, uint16_t size)
 
 static void read_supported_features_rsp(const void *data, uint16_t size)
 {
-	uint8_t evt_prefix_len = get_u8(data + 8);
+	const struct msft_rsp_read_supported_features *rsp = data;
+
+	packet_print_features_msft(rsp->features);
+	print_field("Event prefix length: %u", rsp->evt_prefix_len);
+	print_field("Event prefix:");
+	packet_hexdump(rsp->evt_prefix, rsp->evt_prefix_len);
+	packet_set_msft_evt_prefix(rsp->evt_prefix, rsp->evt_prefix_len);
+}
+
+static void monitor_rssi_cmd(const void *data, uint16_t size)
+{
+	const struct msft_cmd_monitor_rssi *cmd = data;
+
+	print_field("Connection handle: 0x%04x", cmd->handle);
+	packet_print_rssi("RSSI threshold high", cmd->rssi_high);
+	packet_print_rssi("RSSI threshold low", cmd->rssi_low);
+	print_field("RSSI threshold low time interval: %u sec (0x%2.2x)",
+						cmd->rssi_low_interval,
+						cmd->rssi_low_interval);
+	print_field("RSSI sampling period: %u msec (0x%2.2x)",
+						cmd->rssi_period * 100,
+						cmd->rssi_period);
+}
 
-	packet_print_features_msft(data);
-	print_field("Event prefix length: %u", evt_prefix_len);
-	packet_hexdump(data + 9, size - 9);
+static void cancel_monitor_rssi_cmd(const void *data, uint16_t size)
+{
+	const struct msft_cmd_cancel_monitor_rssi *cmd = data;
 
-	packet_set_msft_evt_prefix(data + 9, evt_prefix_len);
+	print_field("Connection handle: 0x%04x", cmd->handle);
 }
 
 static void le_monitor_advertisement_cmd(const void *data, uint16_t size)
 {
-	int8_t threshold_high = get_s8(data);
-	int8_t threshold_low = get_s8(data + 1);
-	uint8_t threshold_low_time_interval = get_u8(data + 2);
-	uint8_t sampling_period = get_u8(data + 3);
+	const struct msft_cmd_le_monitor_adv *cmd = data;
+	const struct msft_le_monitor_adv_patterns *patterns;
+	const struct msft_le_monitor_adv_uuid *uuid;
+	const struct msft_le_monitor_adv_irk *irk;
+	const struct msft_le_monitor_adv_addr *addr;
+	const char *str;
+	char uuidstr[MAX_LEN_UUID_STR];
 
-	packet_print_rssi("RSSI threshold high", threshold_high);
-	packet_print_rssi("RSSI threshold low", threshold_low);
+	packet_print_rssi("RSSI threshold high", cmd->rssi_high);
+	packet_print_rssi("RSSI threshold low", cmd->rssi_low);
 	print_field("RSSI threshold low time interval: %u sec (0x%2.2x)",
-						threshold_low_time_interval,
-						threshold_low_time_interval);
+						cmd->rssi_low_interval,
+						cmd->rssi_low_interval);
 	print_field("RSSI sampling period: %u msec (0x%2.2x)",
-						sampling_period * 100,
-						sampling_period);
-	packet_hexdump(data + 4, size - 4);
+						cmd->rssi_period * 100,
+						cmd->rssi_period);
+
+	switch (cmd->type) {
+	case MSFT_SUBCMD_LE_MONITOR_ADV_PATTERN:
+		print_field("Type: Pattern (0x%2.2x)", cmd->type);
+		patterns = (void *)cmd->data;
+		print_field("Number of patterns: %u", patterns->num);
+		packet_hexdump((void *)patterns->data,
+			       size - (sizeof(*cmd) + sizeof(*patterns)));
+		break;
+	case MSFT_SUBCMD_LE_MONITOR_ADV_UUID:
+		print_field("Type: UUID (0x%2.2x)", cmd->type);
+		uuid = (void *)cmd->data;
+
+		switch (uuid->type) {
+		case 0x01:
+			str = bt_uuid16_to_str(uuid->value.u16);
+			print_field("UUID: %s (0x%4.4x)", str, uuid->value.u16);
+			break;
+		case 0x02:
+			str = bt_uuid32_to_str(uuid->value.u32);
+			print_field("UUID: %s (0x%8.8x)", str, uuid->value.u32);
+			break;
+		case 0x03:
+			sprintf(uuidstr, "%8.8x-%4.4x-%4.4x-%4.4x-%8.8x%4.4x",
+				get_le32(uuid->value.u128 + 12),
+				get_le16(uuid->value.u128 + 10),
+				get_le16(uuid->value.u128 + 8),
+				get_le16(uuid->value.u128 + 6),
+				get_le32(uuid->value.u128 + 2),
+				get_le16(uuid->value.u128 + 0));
+			str = bt_uuidstr_to_str(uuidstr);
+			print_field("UUID: %s (%s)", str, uuidstr);
+			break;
+		default:
+			packet_hexdump((void *)&uuid->value,
+					size - sizeof(*cmd));
+			break;
+		}
+		break;
+	case MSFT_SUBCMD_LE_MONITOR_ADV_IRK:
+		print_field("Type: IRK (0x%2.2x)", cmd->type);
+		irk = (void *)cmd->data;
+		print_field("IRK:");
+		packet_hexdump(irk->irk, size - sizeof(*cmd));
+		break;
+	case MSFT_SUBCMD_LE_MONITOR_ADV_ADDR:
+		print_field("Type: Adderss (0x%2.2x)", cmd->type);
+		addr = (void *)cmd->data;
+		packet_print_addr(NULL, addr->addr, addr->type);
+		break;
+	default:
+		print_field("Type: Unknown (0x%2.2x)", cmd->type);
+		packet_hexdump(cmd->data, size - sizeof(*cmd));
+		break;
+	}
 }
 
 static void le_monitor_advertisement_rsp(const void *data, uint16_t size)
 {
-	uint8_t handle = get_u8(data);
+	const struct msft_rsp_le_monitor_adv *rsp = data;
+
+	print_field("Monitor handle: %u", rsp->handle);
+}
+
+static void le_cancel_monitor_adv_cmd(const void *data, uint16_t size)
+{
+	const struct msft_cmd_le_cancel_monitor_adv *cmd = data;
 
-	print_field("Monitor handle: %u", handle);
+	print_field("Monitor handle: %u", cmd->handle);
 }
 
 static void set_adv_filter_enable_cmd(const void *data, uint16_t size)
 {
-	uint8_t enable = get_u8(data);
+	const struct msft_cmd_le_monitor_adv_enable *cmd = data;
 	const char *str;
 
-	switch (enable) {
+	switch (cmd->enable) {
 	case 0x00:
 		str = "Current allow list";
 		break;

@@ -100,7 +189,7 @@ static void set_adv_filter_enable_cmd(const void *data, uint16_t size)
 		break;
 	}
 
-	print_field("Enable: %s (0x%2.2x)", str, enable);
+	print_field("Enable: %s (0x%2.2x)", str, cmd->enable);
 }
 
 typedef void (*func_t) (const void *data, uint16_t size);

@@ -114,12 +203,15 @@ static const struct {
 	{ 0x00, "Read Supported Features",
 			null_cmd,
 			read_supported_features_rsp },
-	{ 0x01, "Monitor RSSI" },
-	{ 0x02, "Cancel Monitor RSSI" },
+	{ 0x01, "Monitor RSSI",
+			monitor_rssi_cmd },
+	{ 0x02, "Cancel Monitor RSSI",
+			cancel_monitor_rssi_cmd },
 	{ 0x03, "LE Monitor Advertisement",
 			le_monitor_advertisement_cmd,
 			le_monitor_advertisement_rsp },
-	{ 0x04, "LE Cancel Monitor Advertisement" },
+	{ 0x04, "LE Cancel Monitor Advertisement",
+			le_cancel_monitor_adv_cmd },
 	{ 0x05, "LE Set Advertisement Filter Enable",
 			set_adv_filter_enable_cmd,
 			null_rsp },

@@ -156,7 +248,7 @@ static void msft_cmd(const void *data, uint8_t size)
 						" (0x%2.2x)", code);
 
 	if (code_func)
-		code_func(data + 1, size - 1);
+		code_func(data, size);
 	else
 		packet_hexdump(data + 1, size - 1);
 }

@@ -193,7 +285,7 @@ static void msft_rsp(const void *data, uint8_t size)
 	packet_print_error("Status", status);
 
 	if (code_func)
-		code_func(data + 2, size - 2);
+		code_func(data, size);
 	else
 		packet_hexdump(data + 2, size - 2);
 }

@@ -68,6 +68,7 @@ struct msft_rsp_cancel_monitor_rssi {
 
 #define MSFT_SUBCMD_LE_MONITOR_ADV		0x03
 
+#define MSFT_SUBCMD_LE_MONITOR_ADV_PATTERN	0x01
 struct msft_le_monitor_pattern {
 	uint8_t  len;
 	uint8_t  type;

@@ -75,12 +76,13 @@ struct msft_le_monitor_pattern {
 	uint8_t  data[];
 } __attribute__((packed));
 
-struct msft_le_monitor_adv_pattern_type {
-	uint8_t num_patterns;
+struct msft_le_monitor_adv_patterns {
+	uint8_t num;
 	struct msft_le_monitor_pattern data[];
 } __attribute__((packed));
 
-struct msft_le_monitor_adv_uuid_type {
+#define MSFT_SUBCMD_LE_MONITOR_ADV_UUID		0x02
+struct msft_le_monitor_adv_uuid {
 	uint8_t  type;
 	union {
 		uint16_t u16;

@@ -89,7 +91,8 @@ struct msft_le_monitor_adv_uuid_type {
 	} value;
 } __attribute__((packed));
 
-struct msft_le_monitor_adv_irk_type {
+#define MSFT_SUBCMD_LE_MONITOR_ADV_IRK		0x03
+struct msft_le_monitor_adv_irk {
 	uint8_t  irk[8];
 } __attribute__((packed));
 

@@ -24,14 +24,14 @@
 #include "lib/bluetooth.h"
 #include "lib/hci.h"
 
-#include "src/shared/mainloop.h"
+#include "src/shared/io.h"
 #include "monitor/bt.h"
 #include "btdev.h"
 #include "vhci.h"
 
 struct vhci {
 	enum btdev_type type;
-	int fd;
+	struct io *io;
 	struct btdev *btdev;
 };
 

@@ -40,8 +40,7 @@ static void vhci_destroy(void *user_data)
 	struct vhci *vhci = user_data;
 
 	btdev_destroy(vhci->btdev);
-
-	close(vhci->fd);
+	io_destroy(vhci->io);
 
 	free(vhci);
 }

@@ -52,23 +51,21 @@ static void vhci_write_callback(const struct iovec *iov, int iovlen,
 	struct vhci *vhci = user_data;
 	ssize_t written;
 
-	written = writev(vhci->fd, iov, iovlen);
+	written = io_send(vhci->io, iov, iovlen);
 	if (written < 0)
 		return;
 }
 
-static void vhci_read_callback(int fd, uint32_t events, void *user_data)
+static bool vhci_read_callback(struct io *io, void *user_data)
 {
 	struct vhci *vhci = user_data;
+	int fd = io_get_fd(vhci->io);
 	unsigned char buf[4096];
 	ssize_t len;
 
-	if (events & (EPOLLERR | EPOLLHUP))
-		return;
-
-	len = read(vhci->fd, buf, sizeof(buf));
+	len = read(fd, buf, sizeof(buf));
 	if (len < 1)
-		return;
+		return false;
 
 	switch (buf[0]) {
 	case BT_H4_CMD_PKT:

@@ -78,6 +75,8 @@ static void vhci_read_callback(int fd, uint32_t events, void *user_data)
 		btdev_receive_h4(vhci->btdev, buf, len);
 		break;
 	}
+
+	return true;
 }
 
 bool vhci_set_debug(struct vhci *vhci, vhci_debug_func_t callback,

@@ -105,19 +104,11 @@ struct vhci *vhci_open(uint8_t type)
 	struct vhci *vhci;
 	struct vhci_create_req req;
 	struct vhci_create_rsp rsp;
+	int fd;
 
-	vhci = malloc(sizeof(*vhci));
-	if (!vhci)
-		return NULL;
-
-	memset(vhci, 0, sizeof(*vhci));
-	vhci->type = type;
-
-	vhci->fd = open("/dev/vhci", O_RDWR | O_NONBLOCK);
-	if (vhci->fd < 0) {
-		free(vhci);
+	fd = open("/dev/vhci", O_RDWR | O_NONBLOCK);
+	if (fd < 0)
 		return NULL;
-	}
 
 	memset(&req, 0, sizeof(req));
 	req.pkt_type = HCI_VENDOR_PKT;

@@ -131,34 +122,38 @@ struct vhci *vhci_open(uint8_t type)
 		break;
 	}
 
-	if (write(vhci->fd, &req, sizeof(req)) < 0) {
-		close(vhci->fd);
-		free(vhci);
+	if (write(fd, &req, sizeof(req)) < 0) {
+		close(fd);
 		return NULL;
 	}
 
 	memset(&rsp, 0, sizeof(rsp));
 
-	if (read(vhci->fd, &rsp, sizeof(rsp)) < 0) {
-		close(vhci->fd);
-		free(vhci);
+	if (read(fd, &rsp, sizeof(rsp)) < 0) {
+		close(fd);
 		return NULL;
 	}
 
+	vhci = malloc(sizeof(*vhci));
+	if (!vhci)
+		return NULL;
+
+	memset(vhci, 0, sizeof(*vhci));
+	vhci->type = type;
+	vhci->io = io_new(fd);
+
+	io_set_close_on_destroy(vhci->io, true);
+
 	vhci->btdev = btdev_create(type, rsp.index);
 	if (!vhci->btdev) {
-		close(vhci->fd);
-		free(vhci);
+		vhci_destroy(vhci);
 		return NULL;
 	}
 
 	btdev_set_send_handler(vhci->btdev, vhci_write_callback, vhci);
 
-	if (mainloop_add_fd(vhci->fd, EPOLLIN, vhci_read_callback,
-						vhci, vhci_destroy) < 0) {
-		btdev_destroy(vhci->btdev);
-		close(vhci->fd);
-		free(vhci);
+	if (!io_set_read_handler(vhci->io, vhci_read_callback, vhci, NULL)) {
+		vhci_destroy(vhci);
 		return NULL;
 	}
 

@@ -170,7 +165,7 @@ void vhci_close(struct vhci *vhci)
 	if (!vhci)
 		return;
 
-	mainloop_remove_fd(vhci->fd);
+	vhci_destroy(vhci);
 }
 
 struct btdev *vhci_get_btdev(struct vhci *vhci)

@@ -115,6 +115,7 @@ tools_3dsp_LDADD = src/libshared-mainloop.la
 
 tools_mgmt_tester_SOURCES = tools/mgmt-tester.c monitor/bt.h \
 				emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c

@@ -123,6 +124,7 @@ tools_mgmt_tester_LDADD = lib/libbluetooth-internal.la \
 
 tools_l2cap_tester_SOURCES = tools/l2cap-tester.c monitor/bt.h \
 				emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c

@@ -131,6 +133,7 @@ tools_l2cap_tester_LDADD = lib/libbluetooth-internal.la \
 
 tools_rfcomm_tester_SOURCES = tools/rfcomm-tester.c monitor/bt.h \
 				emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c

@@ -139,6 +142,7 @@ tools_rfcomm_tester_LDADD = lib/libbluetooth-internal.la \
 
 tools_bnep_tester_SOURCES = tools/bnep-tester.c monitor/bt.h \
 				emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c

@@ -147,6 +151,7 @@ tools_bnep_tester_LDADD = lib/libbluetooth-internal.la \
 
 tools_smp_tester_SOURCES = tools/smp-tester.c monitor/bt.h \
 				emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c

@@ -155,6 +160,7 @@ tools_smp_tester_LDADD = lib/libbluetooth-internal.la \
 
 tools_gap_tester_SOURCES = tools/gap-tester.c monitor/bt.h \
 				emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c

@@ -165,6 +171,7 @@ tools_gap_tester_LDADD =  lib/libbluetooth-internal.la \
 
 tools_sco_tester_SOURCES = tools/sco-tester.c monitor/bt.h \
 				emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c

@@ -176,6 +183,7 @@ tools_hci_tester_LDADD = src/libshared-glib.la $(GLIB_LIBS)
 
 tools_userchan_tester_SOURCES = tools/userchan-tester.c monitor/bt.h \
 				emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c

@@ -148,6 +148,7 @@ android_haltest_LDADD = -ldl -lm
 noinst_PROGRAMS += android/android-tester
 
 android_android_tester_SOURCES = emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c \

@@ -172,6 +173,7 @@ android_android_tester_LDFLAGS = $(AM_LDFLAGS) -pthread
 noinst_PROGRAMS += android/ipc-tester
 
 android_ipc_tester_SOURCES = emulator/hciemu.h emulator/hciemu.c \
+				emulator/vhci.h emulator/vhci.c \
 				emulator/btdev.h emulator/btdev.c \
 				emulator/bthost.h emulator/bthost.c \
 				emulator/smp.c \

@@ -21,6 +21,8 @@
 #include <sys/uio.h>
 #include <stdint.h>
 #include <errno.h>
+#include <fcntl.h>
+#include <unistd.h>
 
 #include "lib/bluetooth.h"
 #include "lib/hci.h"

@@ -44,6 +46,8 @@
 #define ISO_HANDLE 257
 #define SCO_HANDLE 257
 
+#define DEBUGFS_PATH "/sys/kernel/debug/bluetooth"
+
 struct hook {
 	btdev_hook_func handler;
 	void *user_data;

@@ -93,6 +97,7 @@ struct le_ext_adv {
 
 struct btdev {
 	enum btdev_type type;
+	uint16_t id;
 
 	struct queue *conns;
 

@@ -135,6 +140,7 @@ struct btdev {
 	uint8_t  le_features[8];
 	uint8_t  le_states[8];
 	const struct btdev_cmd *cmds;
+	uint16_t msft_opcode;
 
 	uint16_t default_link_policy;
 	uint8_t  event_mask[8];

@@ -6230,7 +6236,7 @@ struct btdev *btdev_create(enum btdev_type type, uint16_t id)
 	}
 
 	btdev->type = type;
-
+	btdev->id = id;
 	btdev->manufacturer = 63;
 	btdev->revision = 0x0000;
 

@@ -28,6 +28,7 @@
 #include "lib/hci.h"
 
 #include "monitor/bt.h"
+#include "emulator/vhci.h"
 #include "emulator/btdev.h"
 #include "emulator/bthost.h"
 #include "src/shared/util.h"

@@ -45,9 +46,8 @@ struct hciemu_client {
 struct hciemu {
 	int ref_count;
 	enum btdev_type btdev_type;
-	struct btdev *dev;
+	struct vhci *vhci;
 	struct queue *clients;
-	guint source;
 	struct queue *post_command_hooks;
 	char bdaddr_str[18];
 

@@ -221,37 +221,15 @@ static guint create_source_btdev(int fd, struct btdev *btdev)
 
 static bool create_vhci(struct hciemu *hciemu)
 {
-	struct btdev *btdev;
-	uint8_t create_req[2];
-	ssize_t written;
-	int fd;
-
-	btdev = btdev_create(hciemu->btdev_type, 0x00);
-	if (!btdev)
-		return false;
+	struct vhci *vhci;
 
-	btdev_set_command_handler(btdev, central_command_callback, hciemu);
-
-	fd = open("/dev/vhci", O_RDWR | O_NONBLOCK | O_CLOEXEC);
-	if (fd < 0) {
-		perror("Opening /dev/vhci failed");
-		btdev_destroy(btdev);
-		return false;
-	}
-
-	create_req[0] = HCI_VENDOR_PKT;
-	create_req[1] = HCI_PRIMARY;
-
-	written = write(fd, create_req, sizeof(create_req));
-	if (written < 0) {
-		close(fd);
-		btdev_destroy(btdev);
+	vhci = vhci_open(hciemu->btdev_type);
+	if (!vhci)
 		return false;
-	}
 
-	hciemu->dev = btdev;
-
-	hciemu->source = create_source_btdev(fd, btdev);
+	btdev_set_command_handler(vhci_get_btdev(vhci),
+					central_command_callback, hciemu);
+	hciemu->vhci = vhci;
 
 	return true;
 }

@@ -448,8 +426,7 @@ void hciemu_unref(struct hciemu *hciemu)
 	queue_destroy(hciemu->post_command_hooks, destroy_command_hook);
 	queue_destroy(hciemu->clients, hciemu_client_destroy);
 
-	g_source_remove(hciemu->source);
-	btdev_destroy(hciemu->dev);
+	vhci_close(hciemu->vhci);
 
 	free(hciemu);
 }

@@ -462,12 +439,12 @@ static void bthost_print(const char *str, void *user_data)
 					"bthost: %s", str);
 }
 
-static void btdev_central_debug(const char *str, void *user_data)
+static void vhci_debug(const char *str, void *user_data)
 {
 	struct hciemu *hciemu = user_data;
 
 	util_debug(hciemu->debug_callback, hciemu->debug_data,
-					"btdev: %s", str);
+					"vhci: %s", str);
 }
 
 static void btdev_client_debug(const char *str, void *user_data)

@@ -475,7 +452,7 @@ static void btdev_client_debug(const char *str, void *user_data)
 	struct hciemu *hciemu = user_data;
 
 	util_debug(hciemu->debug_callback, hciemu->debug_data,
-					"btdev[bthost]: %s", str);
+					"btdev: %s", str);
 }
 
 static void hciemu_client_set_debug(void *data, void *user_data)

@@ -500,7 +477,7 @@ bool hciemu_set_debug(struct hciemu *hciemu, hciemu_debug_func_t callback,
 	hciemu->debug_destroy = destroy;
 	hciemu->debug_data = user_data;
 
-	btdev_set_debug(hciemu->dev, btdev_central_debug, hciemu, NULL);
+	vhci_set_debug(hciemu->vhci, vhci_debug, hciemu, NULL);
 
 	queue_foreach(hciemu->clients, hciemu_client_set_debug, hciemu);
 

@@ -510,11 +487,16 @@ bool hciemu_set_debug(struct hciemu *hciemu, hciemu_debug_func_t callback,
 const char *hciemu_get_address(struct hciemu *hciemu)
 {
 	const uint8_t *addr;
+	struct btdev *dev;
+
+	if (!hciemu || !hciemu->vhci)
+		return NULL;
 
-	if (!hciemu || !hciemu->dev)
+	dev = vhci_get_btdev(hciemu->vhci);
+	if (!dev)
 		return NULL;
 
-	addr = btdev_get_bdaddr(hciemu->dev);
+	addr = btdev_get_bdaddr(dev);
 	sprintf(hciemu->bdaddr_str, "%2.2X:%2.2X:%2.2X:%2.2X:%2.2X:%2.2X",
 			addr[5], addr[4], addr[3], addr[2], addr[1], addr[0]);
 	return hciemu->bdaddr_str;

@@ -522,18 +504,30 @@ const char *hciemu_get_address(struct hciemu *hciemu)
 
 uint8_t *hciemu_get_features(struct hciemu *hciemu)
 {
-	if (!hciemu || !hciemu->dev)
+	struct btdev *dev;
+
+	if (!hciemu || !hciemu->vhci)
 		return NULL;
 
-	return btdev_get_features(hciemu->dev);
+	dev = vhci_get_btdev(hciemu->vhci);
+	if (!dev)
+		return NULL;
+
+	return btdev_get_features(dev);
 }
 
 const uint8_t *hciemu_get_central_bdaddr(struct hciemu *hciemu)
 {
-	if (!hciemu || !hciemu->dev)
+	struct btdev *dev;
+
+	if (!hciemu || !hciemu->vhci)
+		return NULL;
+
+	dev = vhci_get_btdev(hciemu->vhci);
+	if (!dev)
 		return NULL;
 
-	return btdev_get_bdaddr(hciemu->dev);
+	return btdev_get_bdaddr(dev);
 }
 
 const uint8_t *hciemu_client_bdaddr(struct hciemu_client *client)

@@ -558,27 +552,45 @@ const uint8_t *hciemu_get_client_bdaddr(struct hciemu *hciemu)
 
 uint8_t hciemu_get_central_scan_enable(struct hciemu *hciemu)
 {
-	if (!hciemu || !hciemu->dev)
+	struct btdev *dev;
+
+	if (!hciemu || !hciemu->vhci)
+		return 0;
+
+	dev = vhci_get_btdev(hciemu->vhci);
+	if (!dev)
 		return 0;
 
-	return btdev_get_scan_enable(hciemu->dev);
+	return btdev_get_scan_enable(dev);
 }
 
 uint8_t hciemu_get_central_le_scan_enable(struct hciemu *hciemu)
 {
-	if (!hciemu || !hciemu->dev)
+	struct btdev *dev;
+
+	if (!hciemu || !hciemu->vhci)
 		return 0;
 
-	return btdev_get_le_scan_enable(hciemu->dev);
+	dev = vhci_get_btdev(hciemu->vhci);
+	if (!dev)
+		return 0;
+
+	return btdev_get_le_scan_enable(dev);
 }
 
 void hciemu_set_central_le_states(struct hciemu *hciemu,
 						const uint8_t *le_states)
 {
-	if (!hciemu || !hciemu->dev)
+	struct btdev *dev;
+
+	if (!hciemu || !hciemu->vhci)
+		return;
+
+	dev = vhci_get_btdev(hciemu->vhci);
+	if (!dev)
 		return;
 
-	btdev_set_le_states(hciemu->dev, le_states);
+	btdev_set_le_states(dev, le_states);
 }
 
 bool hciemu_add_central_post_command_hook(struct hciemu *hciemu,

@@ -619,10 +631,15 @@ int hciemu_add_hook(struct hciemu *hciemu, enum hciemu_hook_type type,
 				void *user_data)
 {
 	enum btdev_hook_type hook_type;
+	struct btdev *dev;
 
-	if (!hciemu)
+	if (!hciemu || !hciemu->vhci)
 		return -1;
 
+	dev = vhci_get_btdev(hciemu->vhci);
+	if (!dev)
+		return 0;
+
 	switch (type) {
 	case HCIEMU_HOOK_PRE_CMD:
 		hook_type = BTDEV_HOOK_PRE_CMD;

@@ -640,16 +657,20 @@ int hciemu_add_hook(struct hciemu *hciemu, enum hciemu_hook_type type,
 		return -1;
 	}
 
-	return btdev_add_hook(hciemu->dev, hook_type, opcode, function,
-								user_data);
+	return btdev_add_hook(dev, hook_type, opcode, function, user_data);
 }
 
 bool hciemu_del_hook(struct hciemu *hciemu, enum hciemu_hook_type type,
 								uint16_t opcode)
 {
 	enum btdev_hook_type hook_type;
+	struct btdev *dev;
 
-	if (!hciemu)
+	if (!hciemu || !hciemu->vhci)
+		return false;
+
+	dev = vhci_get_btdev(hciemu->vhci);
+	if (!dev)
 		return false;
 
 	switch (type) {

@@ -669,5 +690,5 @@ bool hciemu_del_hook(struct hciemu *hciemu, enum hciemu_hook_type type,
 		return false;
 	}
 
-	return btdev_del_hook(hciemu->dev, hook_type, opcode);
+	return btdev_del_hook(dev, hook_type, opcode);
 }