1 /******************************************************************************
2 *
3 * Copyright 2000-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /*****************************************************************************
20 *
21 * Name: btm_acl.cc
22 *
23 * Description: This file contains functions that handle ACL connections.
24 * This includes operations such as hold and sniff modes,
25 * supported packet types.
26 *
27 * This module contains both internal and external (API)
28 * functions. External (API) functions are distinguishable
29 * by their names beginning with uppercase BTM.
30 *
31 *
32 *****************************************************************************/
33
34 #define LOG_TAG "btm_acl"
35
36 #include <stddef.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40
41 #include "bt_common.h"
42 #include "bt_target.h"
43 #include "bt_types.h"
44 #include "bt_utils.h"
45 #include "btm_api.h"
46 #include "btm_int.h"
47 #include "btu.h"
48 #include "common/metrics.h"
49 #include "device/include/controller.h"
50 #include "device/include/interop.h"
51 #include "hcidefs.h"
52 #include "hcimsgs.h"
53 #include "l2c_int.h"
54 #include "osi/include/log.h"
55 #include "osi/include/osi.h"
56
57 static void btm_read_remote_features(uint16_t handle);
58 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
59 static void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
60 uint8_t num_read_pages);
61
62 /* 3 seconds timeout waiting for responses */
63 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
64
65 /*******************************************************************************
66 *
67 * Function btm_acl_init
68 *
69 * Description This function is called at BTM startup to initialize
70 *
71 * Returns void
72 *
73 ******************************************************************************/
btm_acl_init(void)74 void btm_acl_init(void) {
75 BTM_TRACE_DEBUG("btm_acl_init");
76 /* Initialize nonzero defaults */
77 btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
78 btm_cb.acl_disc_reason = 0xff;
79 }
80
81 /*******************************************************************************
82 *
83 * Function btm_bda_to_acl
84 *
85 * Description This function returns the FIRST acl_db entry for the passed
86 * BDA.
87 *
88 * Parameters bda : BD address of the remote device
89 * transport : Physical transport used for ACL connection
90 * (BR/EDR or LE)
91 *
92 * Returns Returns pointer to the ACL DB for the requested BDA if found.
93 * NULL if not found.
94 *
95 ******************************************************************************/
btm_bda_to_acl(const RawAddress & bda,tBT_TRANSPORT transport)96 tACL_CONN* btm_bda_to_acl(const RawAddress& bda, tBT_TRANSPORT transport) {
97 tACL_CONN* p = &btm_cb.acl_db[0];
98 uint16_t xx;
99 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
100 if ((p->in_use) && p->remote_addr == bda && p->transport == transport) {
101 BTM_TRACE_DEBUG("btm_bda_to_acl found");
102 return (p);
103 }
104 }
105
106 /* If here, no BD Addr found */
107 return ((tACL_CONN*)NULL);
108 }
109
110 /*******************************************************************************
111 *
112 * Function btm_handle_to_acl_index
113 *
114 * Description This function returns the FIRST acl_db entry for the passed
115 * hci_handle.
116 *
117 * Returns index to the acl_db or MAX_L2CAP_LINKS.
118 *
119 ******************************************************************************/
btm_handle_to_acl_index(uint16_t hci_handle)120 uint8_t btm_handle_to_acl_index(uint16_t hci_handle) {
121 tACL_CONN* p = &btm_cb.acl_db[0];
122 uint8_t xx;
123 BTM_TRACE_DEBUG("btm_handle_to_acl_index");
124 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
125 if ((p->in_use) && (p->hci_handle == hci_handle)) {
126 break;
127 }
128 }
129
130 /* If here, no BD Addr found */
131 return (xx);
132 }
133
134 #if (BLE_PRIVACY_SPT == TRUE)
135 /*******************************************************************************
136 *
137 * Function btm_ble_get_acl_remote_addr
138 *
139 * Description This function reads the active remote address used for the
140 * connection.
141 *
142 * Returns success return true, otherwise false.
143 *
144 ******************************************************************************/
btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC * p_dev_rec,RawAddress & conn_addr,tBLE_ADDR_TYPE * p_addr_type)145 bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec,
146 RawAddress& conn_addr,
147 tBLE_ADDR_TYPE* p_addr_type) {
148 bool st = true;
149
150 if (p_dev_rec == NULL) {
151 BTM_TRACE_ERROR("%s can not find device with matching address", __func__);
152 return false;
153 }
154
155 switch (p_dev_rec->ble.active_addr_type) {
156 case BTM_BLE_ADDR_PSEUDO:
157 conn_addr = p_dev_rec->bd_addr;
158 *p_addr_type = p_dev_rec->ble.ble_addr_type;
159 break;
160
161 case BTM_BLE_ADDR_RRA:
162 conn_addr = p_dev_rec->ble.cur_rand_addr;
163 *p_addr_type = BLE_ADDR_RANDOM;
164 break;
165
166 case BTM_BLE_ADDR_STATIC:
167 conn_addr = p_dev_rec->ble.identity_addr;
168 *p_addr_type = p_dev_rec->ble.identity_addr_type;
169 break;
170
171 default:
172 BTM_TRACE_ERROR("Unknown active address: %d",
173 p_dev_rec->ble.active_addr_type);
174 st = false;
175 break;
176 }
177
178 return st;
179 }
180 #endif
181 /*******************************************************************************
182 *
183 * Function btm_acl_created
184 *
185 * Description This function is called by L2CAP when an ACL connection
186 * is created.
187 *
188 * Returns void
189 *
190 ******************************************************************************/
btm_acl_created(const RawAddress & bda,DEV_CLASS dc,BD_NAME bdn,uint16_t hci_handle,uint8_t link_role,tBT_TRANSPORT transport)191 void btm_acl_created(const RawAddress& bda, DEV_CLASS dc, BD_NAME bdn,
192 uint16_t hci_handle, uint8_t link_role,
193 tBT_TRANSPORT transport) {
194 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
195 tACL_CONN* p;
196 uint8_t xx;
197
198 BTM_TRACE_DEBUG("%s: peer %s hci_handle=%d link_role=%d transport=%d",
199 __func__, bda.ToString().c_str(), hci_handle, link_role,
200 transport);
201 /* Ensure we don't have duplicates */
202 p = btm_bda_to_acl(bda, transport);
203 if (p != (tACL_CONN*)NULL) {
204 p->hci_handle = hci_handle;
205 p->link_role = link_role;
206 p->transport = transport;
207 VLOG(1) << "Duplicate btm_acl_created: RemBdAddr: " << bda;
208 BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
209 return;
210 }
211
212 /* Allocate acl_db entry */
213 for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++) {
214 if (!p->in_use) {
215 p->in_use = true;
216 p->hci_handle = hci_handle;
217 p->link_role = link_role;
218 p->link_up_issued = false;
219 p->remote_addr = bda;
220
221 p->transport = transport;
222 #if (BLE_PRIVACY_SPT == TRUE)
223 if (transport == BT_TRANSPORT_LE)
224 btm_ble_refresh_local_resolvable_private_addr(
225 bda, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
226 #else
227 p->conn_addr_type = BLE_ADDR_PUBLIC;
228 p->conn_addr = *controller_get_interface()->get_address();
229
230 #endif
231 p->switch_role_failed_attempts = 0;
232 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
233
234 btm_pm_sm_alloc(xx);
235
236 if (dc) memcpy(p->remote_dc, dc, DEV_CLASS_LEN);
237
238 if (bdn) memcpy(p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
239
240 /* if BR/EDR do something more */
241 if (transport == BT_TRANSPORT_BR_EDR) {
242 btsnd_hcic_read_rmt_clk_offset(p->hci_handle);
243 btsnd_hcic_rmt_ver_req(p->hci_handle);
244 }
245 p_dev_rec = btm_find_dev_by_handle(hci_handle);
246
247 if (p_dev_rec) {
248 BTM_TRACE_DEBUG("%s: peer %s device_type=0x%x", __func__,
249 bda.ToString().c_str(), p_dev_rec->device_type);
250 }
251
252 if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
253 /* If remote features already known, copy them and continue connection
254 * setup */
255 if ((p_dev_rec->num_read_pages) &&
256 (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
257 memcpy(p->peer_lmp_feature_pages, p_dev_rec->feature_pages,
258 (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
259 p->num_read_pages = p_dev_rec->num_read_pages;
260
261 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
262
263 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
264 btm_sec_set_peer_sec_caps(p, p_dev_rec);
265
266 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
267 if (req_pend) {
268 /* Request for remaining Security Features (if any) */
269 l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
270 }
271 btm_establish_continue(p);
272 return;
273 }
274 }
275
276 /* If here, features are not known yet */
277 if (p_dev_rec && transport == BT_TRANSPORT_LE) {
278 #if (BLE_PRIVACY_SPT == TRUE)
279 btm_ble_get_acl_remote_addr(p_dev_rec, p->active_remote_addr,
280 &p->active_remote_addr_type);
281 #endif
282
283 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(
284 controller_get_interface()->get_features_ble()->as_array) ||
285 link_role == HCI_ROLE_MASTER) {
286 btsnd_hcic_ble_read_remote_feat(p->hci_handle);
287 } else {
288 btm_establish_continue(p);
289 }
290 }
291
292 /* read page 1 - on rmt feature event for buffer reasons */
293 return;
294 }
295 }
296 }
297
btm_acl_update_conn_addr(uint16_t conn_handle,const RawAddress & address)298 void btm_acl_update_conn_addr(uint16_t conn_handle, const RawAddress& address) {
299 uint8_t idx = btm_handle_to_acl_index(conn_handle);
300 if (idx != MAX_L2CAP_LINKS) {
301 btm_cb.acl_db[idx].conn_addr = address;
302 }
303 }
304
305 /*******************************************************************************
306 *
307 * Function btm_acl_report_role_change
308 *
309 * Description This function is called when the local device is deemed
310 * to be down. It notifies L2CAP of the failure.
311 *
312 * Returns void
313 *
314 ******************************************************************************/
btm_acl_report_role_change(uint8_t hci_status,const RawAddress * bda)315 void btm_acl_report_role_change(uint8_t hci_status, const RawAddress* bda) {
316 tBTM_ROLE_SWITCH_CMPL ref_data;
317 BTM_TRACE_DEBUG("btm_acl_report_role_change");
318 if (btm_cb.devcb.p_switch_role_cb &&
319 (bda && btm_cb.devcb.switch_role_ref_data.remote_bd_addr == *bda)) {
320 memcpy(&ref_data, &btm_cb.devcb.switch_role_ref_data,
321 sizeof(tBTM_ROLE_SWITCH_CMPL));
322 ref_data.hci_status = hci_status;
323 (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
324 memset(&btm_cb.devcb.switch_role_ref_data, 0,
325 sizeof(tBTM_ROLE_SWITCH_CMPL));
326 btm_cb.devcb.p_switch_role_cb = NULL;
327 }
328 }
329
330 /*******************************************************************************
331 *
332 * Function btm_acl_removed
333 *
334 * Description This function is called by L2CAP when an ACL connection
335 * is removed. Since only L2CAP creates ACL links, we use
336 * the L2CAP link index as our index into the control blocks.
337 *
338 * Returns void
339 *
340 ******************************************************************************/
btm_acl_removed(const RawAddress & bda,tBT_TRANSPORT transport)341 void btm_acl_removed(const RawAddress& bda, tBT_TRANSPORT transport) {
342 tACL_CONN* p;
343 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
344 BTM_TRACE_DEBUG("btm_acl_removed");
345 p = btm_bda_to_acl(bda, transport);
346 if (p != (tACL_CONN*)NULL) {
347 p->in_use = false;
348
349 /* if the disconnected channel has a pending role switch, clear it now */
350 btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, &bda);
351
352 /* Only notify if link up has had a chance to be issued */
353 if (p->link_up_issued) {
354 p->link_up_issued = false;
355
356 /* If anyone cares, indicate the database changed */
357 if (btm_cb.p_bl_changed_cb) {
358 tBTM_BL_EVENT_DATA evt_data;
359 evt_data.event = BTM_BL_DISCN_EVT;
360 evt_data.discn.p_bda = &bda;
361 evt_data.discn.handle = p->hci_handle;
362 evt_data.discn.transport = p->transport;
363 (*btm_cb.p_bl_changed_cb)(&evt_data);
364 }
365
366 btm_acl_update_busy_level(BTM_BLI_ACL_DOWN_EVT);
367 }
368
369 BTM_TRACE_DEBUG(
370 "acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
371 p->hci_handle, p->transport, btm_cb.ble_ctr_cb.inq_var.connectable_mode,
372 p->link_role);
373
374 p_dev_rec = btm_find_dev(bda);
375 if (p_dev_rec) {
376 BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x",
377 p_dev_rec->sec_flags);
378 if (p->transport == BT_TRANSPORT_LE) {
379 BTM_TRACE_DEBUG("LE link down");
380 p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
381 if ((p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0) {
382 BTM_TRACE_DEBUG("Not Bonded");
383 p_dev_rec->sec_flags &=
384 ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
385 } else {
386 BTM_TRACE_DEBUG("Bonded");
387 }
388 } else {
389 BTM_TRACE_DEBUG("Bletooth link down");
390 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED |
391 BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
392 }
393 BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x",
394 p_dev_rec->sec_flags);
395 } else {
396 BTM_TRACE_ERROR("Device not found");
397 }
398
399 /* Clear the ACL connection data */
400 memset(p, 0, sizeof(tACL_CONN));
401 }
402 }
403
404 /*******************************************************************************
405 *
406 * Function btm_acl_device_down
407 *
408 * Description This function is called when the local device is deemed
409 * to be down. It notifies L2CAP of the failure.
410 *
411 * Returns void
412 *
413 ******************************************************************************/
btm_acl_device_down(void)414 void btm_acl_device_down(void) {
415 tACL_CONN* p = &btm_cb.acl_db[0];
416 uint16_t xx;
417 BTM_TRACE_DEBUG("btm_acl_device_down");
418 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
419 if (p->in_use) {
420 BTM_TRACE_DEBUG("hci_handle=%d HCI_ERR_HW_FAILURE ", p->hci_handle);
421 l2c_link_hci_disc_comp(p->hci_handle, HCI_ERR_HW_FAILURE);
422 }
423 }
424 }
425
426 /*******************************************************************************
427 *
428 * Function btm_acl_update_busy_level
429 *
430 * Description This function is called to update the busy level of the
431 * system.
432 *
433 * Returns void
434 *
435 ******************************************************************************/
btm_acl_update_busy_level(tBTM_BLI_EVENT event)436 void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
437 bool old_inquiry_state = btm_cb.is_inquiry;
438 tBTM_BL_UPDATE_DATA evt;
439 evt.busy_level_flags = 0;
440 switch (event) {
441 case BTM_BLI_ACL_UP_EVT:
442 BTM_TRACE_DEBUG("BTM_BLI_ACL_UP_EVT");
443 break;
444 case BTM_BLI_ACL_DOWN_EVT:
445 BTM_TRACE_DEBUG("BTM_BLI_ACL_DOWN_EVT");
446 break;
447 case BTM_BLI_PAGE_EVT:
448 BTM_TRACE_DEBUG("BTM_BLI_PAGE_EVT");
449 btm_cb.is_paging = true;
450 evt.busy_level_flags = BTM_BL_PAGING_STARTED;
451 break;
452 case BTM_BLI_PAGE_DONE_EVT:
453 BTM_TRACE_DEBUG("BTM_BLI_PAGE_DONE_EVT");
454 btm_cb.is_paging = false;
455 evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
456 break;
457 case BTM_BLI_INQ_EVT:
458 BTM_TRACE_DEBUG("BTM_BLI_INQ_EVT");
459 btm_cb.is_inquiry = true;
460 evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
461 break;
462 case BTM_BLI_INQ_CANCEL_EVT:
463 BTM_TRACE_DEBUG("BTM_BLI_INQ_CANCEL_EVT");
464 btm_cb.is_inquiry = false;
465 evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
466 break;
467 case BTM_BLI_INQ_DONE_EVT:
468 BTM_TRACE_DEBUG("BTM_BLI_INQ_DONE_EVT");
469 btm_cb.is_inquiry = false;
470 evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
471 break;
472 }
473
474 uint8_t busy_level;
475 if (btm_cb.is_paging || btm_cb.is_inquiry)
476 busy_level = 10;
477 else
478 busy_level = BTM_GetNumAclLinks();
479
480 if ((busy_level != btm_cb.busy_level) ||
481 (old_inquiry_state != btm_cb.is_inquiry)) {
482 evt.event = BTM_BL_UPDATE_EVT;
483 evt.busy_level = busy_level;
484 btm_cb.busy_level = busy_level;
485 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
486 tBTM_BL_EVENT_DATA btm_bl_event_data;
487 btm_bl_event_data.update = evt;
488 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
489 }
490 }
491 }
492
493 /*******************************************************************************
494 *
495 * Function BTM_GetRole
496 *
497 * Description This function is called to get the role of the local device
498 * for the ACL connection with the specified remote device
499 *
500 * Returns BTM_SUCCESS if connection exists.
501 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
502 *
503 ******************************************************************************/
BTM_GetRole(const RawAddress & remote_bd_addr,uint8_t * p_role)504 tBTM_STATUS BTM_GetRole(const RawAddress& remote_bd_addr, uint8_t* p_role) {
505 tACL_CONN* p;
506 BTM_TRACE_DEBUG("BTM_GetRole");
507 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
508 if (p == NULL) {
509 *p_role = BTM_ROLE_UNDEFINED;
510 return (BTM_UNKNOWN_ADDR);
511 }
512
513 /* Get the current role */
514 *p_role = p->link_role;
515 return (BTM_SUCCESS);
516 }
517
518 /*******************************************************************************
519 *
520 * Function BTM_SwitchRole
521 *
522 * Description This function is called to switch role between master and
523 * slave. If role is already set it will do nothing. If the
524 * command was initiated, the callback function is called upon
525 * completion.
526 *
527 * Returns BTM_SUCCESS if already in specified role.
528 * BTM_CMD_STARTED if command issued to controller.
529 * BTM_NO_RESOURCES if couldn't allocate memory to issue
530 * command
531 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
532 * BTM_MODE_UNSUPPORTED if local device does not support role
533 * switching
534 * BTM_BUSY if the previous command is not completed
535 *
536 ******************************************************************************/
BTM_SwitchRole(const RawAddress & remote_bd_addr,uint8_t new_role,tBTM_CMPL_CB * p_cb)537 tBTM_STATUS BTM_SwitchRole(const RawAddress& remote_bd_addr, uint8_t new_role,
538 tBTM_CMPL_CB* p_cb) {
539 tACL_CONN* p;
540 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
541 bool is_sco_active;
542 tBTM_STATUS status;
543 tBTM_PM_MODE pwr_mode;
544 tBTM_PM_PWR_MD settings;
545
546 LOG_INFO(LOG_TAG, "%s: peer %s new_role=0x%x p_cb=%p p_switch_role_cb=%p",
547 __func__, remote_bd_addr.ToString().c_str(), new_role, p_cb,
548 btm_cb.devcb.p_switch_role_cb);
549
550 /* Make sure the local device supports switching */
551 if (!controller_get_interface()->supports_master_slave_role_switch())
552 return (BTM_MODE_UNSUPPORTED);
553
554 if (btm_cb.devcb.p_switch_role_cb && p_cb) {
555 VLOG(2) << "Role switch on other device is in progress "
556 << btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
557 return (BTM_BUSY);
558 }
559
560 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
561 if (p == NULL) return (BTM_UNKNOWN_ADDR);
562
563 /* Finished if already in desired role */
564 if (p->link_role == new_role) return (BTM_SUCCESS);
565
566 if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH, &remote_bd_addr))
567 return BTM_DEV_BLACKLISTED;
568
569 /* Check if there is any SCO Active on this BD Address */
570 is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
571
572 if (is_sco_active) return (BTM_NO_RESOURCES);
573
574 /* Ignore role switch request if the previous request was not completed */
575 if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE) {
576 BTM_TRACE_DEBUG("BTM_SwitchRole busy: %d", p->switch_role_state);
577 return (BTM_BUSY);
578 }
579
580 if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &remote_bd_addr)) {
581 BTM_TRACE_DEBUG("%s, Device blacklisted under INTEROP_DYNAMIC_ROLE_SWITCH.",
582 __func__);
583 return BTM_DEV_BLACKLISTED;
584 }
585
586 status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode);
587 if (status != BTM_SUCCESS) return (status);
588
589 /* Wake up the link if in sniff or park before attempting switch */
590 if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF) {
591 memset((void*)&settings, 0, sizeof(settings));
592 settings.mode = BTM_PM_MD_ACTIVE;
593 status = BTM_SetPowerMode(BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
594 if (status != BTM_CMD_STARTED) return (BTM_WRONG_MODE);
595
596 p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
597 }
598 /* some devices do not support switch while encryption is on */
599 else {
600 p_dev_rec = btm_find_dev(remote_bd_addr);
601 if ((p_dev_rec != NULL) &&
602 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
603 !BTM_EPR_AVAILABLE(p)) {
604 /* bypass turning off encryption if change link key is already doing it */
605 if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF) {
606 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
607 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
608 }
609
610 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
611 } else {
612 btsnd_hcic_switch_role(remote_bd_addr, new_role);
613 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
614
615 #if (BTM_DISC_DURING_RS == TRUE)
616 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
617 #endif
618 }
619 }
620
621 /* Initialize return structure in case request fails */
622 if (p_cb) {
623 btm_cb.devcb.switch_role_ref_data.remote_bd_addr = remote_bd_addr;
624 btm_cb.devcb.switch_role_ref_data.role = new_role;
625 /* initialized to an error code */
626 btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
627 btm_cb.devcb.p_switch_role_cb = p_cb;
628 }
629 return (BTM_CMD_STARTED);
630 }
631
632 /*******************************************************************************
633 *
634 * Function btm_acl_encrypt_change
635 *
636 * Description This function is when encryption of the connection is
637 * completed by the LM. Checks to see if a role switch or
638 * change of link key was active and initiates or continues
639 * process if needed.
640 *
641 * Returns void
642 *
643 ******************************************************************************/
btm_acl_encrypt_change(uint16_t handle,uint8_t status,uint8_t encr_enable)644 void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
645 uint8_t encr_enable) {
646 tACL_CONN* p;
647 uint8_t xx;
648 tBTM_SEC_DEV_REC* p_dev_rec;
649
650 BTM_TRACE_DEBUG("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
651 handle, status, encr_enable);
652 xx = btm_handle_to_acl_index(handle);
653 /* don't assume that we can never get a bad hci_handle */
654 if (xx < MAX_L2CAP_LINKS)
655 p = &btm_cb.acl_db[xx];
656 else
657 return;
658
659 /* Process Role Switch if active */
660 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF) {
661 /* if encryption turn off failed we still will try to switch role */
662 if (encr_enable) {
663 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
664 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
665 } else {
666 p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
667 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
668 }
669
670 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
671 #if (BTM_DISC_DURING_RS == TRUE)
672 p_dev_rec = btm_find_dev(p->remote_addr);
673 if (p_dev_rec != NULL) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
674 #endif
675
676 }
677 /* Finished enabling Encryption after role switch */
678 else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON) {
679 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
680 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
681 btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status,
682 &p->remote_addr);
683
684 /* if role change event is registered, report it now */
685 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
686 tBTM_BL_ROLE_CHG_DATA evt;
687 evt.event = BTM_BL_ROLE_CHG_EVT;
688 evt.new_role = btm_cb.devcb.switch_role_ref_data.role;
689 evt.p_bda = &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
690 evt.hci_status = btm_cb.devcb.switch_role_ref_data.hci_status;
691 tBTM_BL_EVENT_DATA btm_bl_event_data;
692 btm_bl_event_data.role_chg = evt;
693 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
694
695 BTM_TRACE_DEBUG(
696 "%s: Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
697 __func__, evt.new_role, evt.hci_status, p->switch_role_state);
698 }
699
700 #if (BTM_DISC_DURING_RS == TRUE)
701 /* If a disconnect is pending, issue it now that role switch has completed
702 */
703 p_dev_rec = btm_find_dev(p->remote_addr);
704 if (p_dev_rec != NULL) {
705 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
706 BTM_TRACE_WARNING(
707 "btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
708 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
709 }
710 BTM_TRACE_ERROR(
711 "btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
712 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
713 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
714 }
715 #endif
716 }
717 }
718 /*******************************************************************************
719 *
720 * Function BTM_SetLinkPolicy
721 *
722 * Description Create and send HCI "Write Policy Set" command
723 *
724 * Returns status of the operation
725 *
726 ******************************************************************************/
BTM_SetLinkPolicy(const RawAddress & remote_bda,uint16_t * settings)727 tBTM_STATUS BTM_SetLinkPolicy(const RawAddress& remote_bda,
728 uint16_t* settings) {
729 tACL_CONN* p;
730 uint8_t* localFeatures = BTM_ReadLocalFeatures();
731 BTM_TRACE_DEBUG("%s", __func__);
732 /* BTM_TRACE_API ("%s: requested settings: 0x%04x", __func__, *settings ); */
733
734 /* First, check if hold mode is supported */
735 if (*settings != HCI_DISABLE_ALL_LM_MODES) {
736 if ((*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
737 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
738 *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
739 BTM_TRACE_API("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)",
740 *settings);
741 }
742 if ((*settings & HCI_ENABLE_HOLD_MODE) &&
743 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
744 *settings &= (~HCI_ENABLE_HOLD_MODE);
745 BTM_TRACE_API("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)",
746 *settings);
747 }
748 if ((*settings & HCI_ENABLE_SNIFF_MODE) &&
749 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
750 *settings &= (~HCI_ENABLE_SNIFF_MODE);
751 BTM_TRACE_API("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)",
752 *settings);
753 }
754 if ((*settings & HCI_ENABLE_PARK_MODE) &&
755 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
756 *settings &= (~HCI_ENABLE_PARK_MODE);
757 BTM_TRACE_API("BTM_SetLinkPolicy park not supported (settings: 0x%04x)",
758 *settings);
759 }
760 }
761
762 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
763 if (p != NULL) {
764 btsnd_hcic_write_policy_set(p->hci_handle, *settings);
765 return BTM_CMD_STARTED;
766 }
767
768 /* If here, no BD Addr found */
769 return (BTM_UNKNOWN_ADDR);
770 }
771
772 /*******************************************************************************
773 *
774 * Function BTM_SetDefaultLinkPolicy
775 *
776 * Description Set the default value for HCI "Write Policy Set" command
777 * to use when an ACL link is created.
778 *
779 * Returns void
780 *
781 ******************************************************************************/
BTM_SetDefaultLinkPolicy(uint16_t settings)782 void BTM_SetDefaultLinkPolicy(uint16_t settings) {
783 uint8_t* localFeatures = BTM_ReadLocalFeatures();
784
785 BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
786
787 if ((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
788 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
789 settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
790 BTM_TRACE_DEBUG(
791 "BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)",
792 settings);
793 }
794 if ((settings & HCI_ENABLE_HOLD_MODE) &&
795 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
796 settings &= ~HCI_ENABLE_HOLD_MODE;
797 BTM_TRACE_DEBUG(
798 "BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)",
799 settings);
800 }
801 if ((settings & HCI_ENABLE_SNIFF_MODE) &&
802 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
803 settings &= ~HCI_ENABLE_SNIFF_MODE;
804 BTM_TRACE_DEBUG(
805 "BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)",
806 settings);
807 }
808 if ((settings & HCI_ENABLE_PARK_MODE) &&
809 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
810 settings &= ~HCI_ENABLE_PARK_MODE;
811 BTM_TRACE_DEBUG(
812 "BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)",
813 settings);
814 }
815 BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
816
817 btm_cb.btm_def_link_policy = settings;
818
819 /* Set the default Link Policy of the controller */
820 btsnd_hcic_write_def_policy_set(settings);
821 }
822
btm_use_preferred_conn_params(const RawAddress & bda)823 void btm_use_preferred_conn_params(const RawAddress& bda) {
824 tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
825 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
826
827 /* If there are any preferred connection parameters, set them now */
828 if ((p_dev_rec->conn_params.min_conn_int >= BTM_BLE_CONN_INT_MIN) &&
829 (p_dev_rec->conn_params.min_conn_int <= BTM_BLE_CONN_INT_MAX) &&
830 (p_dev_rec->conn_params.max_conn_int >= BTM_BLE_CONN_INT_MIN) &&
831 (p_dev_rec->conn_params.max_conn_int <= BTM_BLE_CONN_INT_MAX) &&
832 (p_dev_rec->conn_params.slave_latency <= BTM_BLE_CONN_LATENCY_MAX) &&
833 (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
834 (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
835 ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
836 p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
837 (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
838 (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
839 (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout))) {
840 BTM_TRACE_DEBUG(
841 "%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d "
842 "supervision_tout=%d",
843 __func__, p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
844 p_dev_rec->conn_params.max_conn_int,
845 p_dev_rec->conn_params.slave_latency,
846 p_dev_rec->conn_params.supervision_tout);
847
848 p_lcb->min_interval = p_dev_rec->conn_params.min_conn_int;
849 p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
850 p_lcb->timeout = p_dev_rec->conn_params.supervision_tout;
851 p_lcb->latency = p_dev_rec->conn_params.slave_latency;
852
853 btsnd_hcic_ble_upd_ll_conn_params(
854 p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
855 p_dev_rec->conn_params.max_conn_int,
856 p_dev_rec->conn_params.slave_latency,
857 p_dev_rec->conn_params.supervision_tout, 0, 0);
858 }
859 }
860
861 /*******************************************************************************
862 *
863 * Function btm_read_remote_version_complete
864 *
865 * Description This function is called when the command complete message
866 * is received from the HCI for the remote version info.
867 *
868 * Returns void
869 *
870 ******************************************************************************/
btm_read_remote_version_complete(uint8_t * p)871 void btm_read_remote_version_complete(uint8_t* p) {
872 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
873 uint8_t status;
874 uint16_t handle;
875 int xx;
876 BTM_TRACE_DEBUG("btm_read_remote_version_complete");
877
878 STREAM_TO_UINT8(status, p);
879 STREAM_TO_UINT16(handle, p);
880
881 /* Look up the connection by handle and copy features */
882 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++) {
883 if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle)) {
884 if (status == HCI_SUCCESS) {
885 STREAM_TO_UINT8(p_acl_cb->lmp_version, p);
886 STREAM_TO_UINT16(p_acl_cb->manufacturer, p);
887 STREAM_TO_UINT16(p_acl_cb->lmp_subversion, p);
888
889 if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
890 btm_read_remote_features(p_acl_cb->hci_handle);
891 }
892 bluetooth::common::LogRemoteVersionInfo(
893 handle, status, p_acl_cb->lmp_version, p_acl_cb->manufacturer,
894 p_acl_cb->lmp_subversion);
895 } else {
896 bluetooth::common::LogRemoteVersionInfo(handle, status, 0, 0, 0);
897 }
898
899 if (p_acl_cb->transport == BT_TRANSPORT_LE) {
900 l2cble_notify_le_connection(p_acl_cb->remote_addr);
901 btm_use_preferred_conn_params(p_acl_cb->remote_addr);
902 }
903 break;
904 }
905 }
906 }
907
908 /*******************************************************************************
909 *
910 * Function btm_process_remote_ext_features
911 *
912 * Description Local function called to process all extended features pages
913 * read from a remote device.
914 *
915 * Returns void
916 *
917 ******************************************************************************/
btm_process_remote_ext_features(tACL_CONN * p_acl_cb,uint8_t num_read_pages)918 void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
919 uint8_t num_read_pages) {
920 uint16_t handle = p_acl_cb->hci_handle;
921 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
922 uint8_t page_idx;
923
924 BTM_TRACE_DEBUG("btm_process_remote_ext_features");
925
926 /* Make sure we have the record to save remote features information */
927 if (p_dev_rec == NULL) {
928 /* Get a new device; might be doing dedicated bonding */
929 p_dev_rec = btm_find_or_alloc_dev(p_acl_cb->remote_addr);
930 }
931
932 p_acl_cb->num_read_pages = num_read_pages;
933 p_dev_rec->num_read_pages = num_read_pages;
934
935 /* Move the pages to placeholder */
936 for (page_idx = 0; page_idx < num_read_pages; page_idx++) {
937 if (page_idx > HCI_EXT_FEATURES_PAGE_MAX) {
938 BTM_TRACE_ERROR("%s: page=%d unexpected", __func__, page_idx);
939 break;
940 }
941 memcpy(p_dev_rec->feature_pages[page_idx],
942 p_acl_cb->peer_lmp_feature_pages[page_idx],
943 HCI_FEATURE_BYTES_PER_PAGE);
944 }
945
946 if (!(p_dev_rec->sec_flags & BTM_SEC_NAME_KNOWN) ||
947 p_dev_rec->is_originator) {
948 BTM_TRACE_DEBUG("%s: Calling Next Security Procedure", __func__);
949 uint8_t status = btm_sec_execute_procedure(p_dev_rec);
950 if (status != BTM_CMD_STARTED) {
951 BTM_TRACE_ERROR("%s: Security procedure not started! status %d", __func__,
952 status);
953 btm_sec_dev_rec_cback_event(p_dev_rec, status, false);
954 }
955 }
956 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
957
958 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
959 btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
960
961 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
962 if (req_pend) {
963 /* Request for remaining Security Features (if any) */
964 l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
965 }
966 }
967
968 /*******************************************************************************
969 *
970 * Function btm_read_remote_features
971 *
972 * Description Local function called to send a read remote supported
973 * features/remote extended features page[0].
974 *
975 * Returns void
976 *
977 ******************************************************************************/
btm_read_remote_features(uint16_t handle)978 void btm_read_remote_features(uint16_t handle) {
979 uint8_t acl_idx;
980 tACL_CONN* p_acl_cb;
981
982 BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
983
984 acl_idx = btm_handle_to_acl_index(handle);
985 if (acl_idx >= MAX_L2CAP_LINKS) {
986 BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
987 return;
988 }
989
990 p_acl_cb = &btm_cb.acl_db[acl_idx];
991 p_acl_cb->num_read_pages = 0;
992 memset(p_acl_cb->peer_lmp_feature_pages, 0,
993 sizeof(p_acl_cb->peer_lmp_feature_pages));
994
995 /* first send read remote supported features HCI command */
996 /* because we don't know whether the remote support extended feature command
997 */
998 btsnd_hcic_rmt_features_req(handle);
999 }
1000
1001 /*******************************************************************************
1002 *
1003 * Function btm_read_remote_ext_features
1004 *
1005 * Description Local function called to send a read remote extended
1006 * features
1007 *
1008 * Returns void
1009 *
1010 ******************************************************************************/
btm_read_remote_ext_features(uint16_t handle,uint8_t page_number)1011 void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number) {
1012 BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle,
1013 page_number);
1014
1015 btsnd_hcic_rmt_ext_features(handle, page_number);
1016 }
1017
1018 /*******************************************************************************
1019 *
1020 * Function btm_read_remote_features_complete
1021 *
1022 * Description This function is called when the remote supported features
1023 * complete event is received from the HCI.
1024 *
1025 * Returns void
1026 *
1027 ******************************************************************************/
btm_read_remote_features_complete(uint8_t * p)1028 void btm_read_remote_features_complete(uint8_t* p) {
1029 tACL_CONN* p_acl_cb;
1030 uint8_t status;
1031 uint16_t handle;
1032 uint8_t acl_idx;
1033
1034 BTM_TRACE_DEBUG("btm_read_remote_features_complete");
1035 STREAM_TO_UINT8(status, p);
1036
1037 if (status != HCI_SUCCESS) {
1038 BTM_TRACE_ERROR("btm_read_remote_features_complete failed (status 0x%02x)",
1039 status);
1040 return;
1041 }
1042
1043 STREAM_TO_UINT16(handle, p);
1044
1045 acl_idx = btm_handle_to_acl_index(handle);
1046 if (acl_idx >= MAX_L2CAP_LINKS) {
1047 BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid",
1048 handle);
1049 return;
1050 }
1051
1052 p_acl_cb = &btm_cb.acl_db[acl_idx];
1053
1054 /* Copy the received features page */
1055 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[0], p,
1056 HCI_FEATURE_BYTES_PER_PAGE);
1057
1058 if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_feature_pages[0])) &&
1059 (controller_get_interface()
1060 ->supports_reading_remote_extended_features())) {
1061 /* if the remote controller has extended features and local controller
1062 supports HCI_Read_Remote_Extended_Features command then start reading
1063 these feature starting with extended features page 1 */
1064 BTM_TRACE_DEBUG("Start reading remote extended features");
1065 btm_read_remote_ext_features(handle, 1);
1066 return;
1067 }
1068
1069 /* Remote controller has no extended features. Process remote controller
1070 supported features (features page 0). */
1071 btm_process_remote_ext_features(p_acl_cb, 1);
1072
1073 /* Continue with HCI connection establishment */
1074 btm_establish_continue(p_acl_cb);
1075 }
1076
1077 /*******************************************************************************
1078 *
1079 * Function btm_read_remote_ext_features_complete
1080 *
1081 * Description This function is called when the remote extended features
1082 * complete event is received from the HCI.
1083 *
1084 * Returns void
1085 *
1086 ******************************************************************************/
btm_read_remote_ext_features_complete(uint8_t * p,uint8_t evt_len)1087 void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
1088 tACL_CONN* p_acl_cb;
1089 uint8_t page_num, max_page;
1090 uint16_t handle;
1091 uint8_t acl_idx;
1092
1093 BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
1094
1095 if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
1096 android_errorWriteLog(0x534e4554, "141552859");
1097 BTM_TRACE_ERROR(
1098 "btm_read_remote_ext_features_complete evt length too short. length=%d",
1099 evt_len);
1100 return;
1101 }
1102
1103 ++p;
1104 STREAM_TO_UINT16(handle, p);
1105 STREAM_TO_UINT8(page_num, p);
1106 STREAM_TO_UINT8(max_page, p);
1107
1108 /* Validate parameters */
1109 acl_idx = btm_handle_to_acl_index(handle);
1110 if (acl_idx >= MAX_L2CAP_LINKS) {
1111 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid",
1112 handle);
1113 return;
1114 }
1115
1116 if (max_page > HCI_EXT_FEATURES_PAGE_MAX) {
1117 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown",
1118 max_page);
1119 return;
1120 }
1121
1122 if (page_num > HCI_EXT_FEATURES_PAGE_MAX) {
1123 android_errorWriteLog(0x534e4554, "141552859");
1124 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",
1125 page_num);
1126 return;
1127 }
1128
1129 if (page_num > max_page) {
1130 BTM_TRACE_WARNING(
1131 "btm_read_remote_ext_features_complete num_page=%d, max_page=%d "
1132 "invalid", page_num, max_page);
1133 }
1134
1135 p_acl_cb = &btm_cb.acl_db[acl_idx];
1136
1137 /* Copy the received features page */
1138 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[page_num], p,
1139 HCI_FEATURE_BYTES_PER_PAGE);
1140
1141 /* If there is the next remote features page and
1142 * we have space to keep this page data - read this page */
1143 if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX)) {
1144 page_num++;
1145 BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)",
1146 page_num);
1147 btm_read_remote_ext_features(handle, page_num);
1148 return;
1149 }
1150
1151 /* Reading of remote feature pages is complete */
1152 BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)",
1153 page_num);
1154
1155 /* Process the pages */
1156 btm_process_remote_ext_features(p_acl_cb, (uint8_t)(page_num + 1));
1157
1158 /* Continue with HCI connection establishment */
1159 btm_establish_continue(p_acl_cb);
1160 }
1161
1162 /*******************************************************************************
1163 *
1164 * Function btm_read_remote_ext_features_failed
1165 *
1166 * Description This function is called when the remote extended features
1167 * complete event returns a failed status.
1168 *
1169 * Returns void
1170 *
1171 ******************************************************************************/
btm_read_remote_ext_features_failed(uint8_t status,uint16_t handle)1172 void btm_read_remote_ext_features_failed(uint8_t status, uint16_t handle) {
1173 tACL_CONN* p_acl_cb;
1174 uint8_t acl_idx;
1175
1176 BTM_TRACE_WARNING(
1177 "btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1178 status, handle);
1179
1180 acl_idx = btm_handle_to_acl_index(handle);
1181 if (acl_idx >= MAX_L2CAP_LINKS) {
1182 BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid",
1183 handle);
1184 return;
1185 }
1186
1187 p_acl_cb = &btm_cb.acl_db[acl_idx];
1188
1189 /* Process supported features only */
1190 btm_process_remote_ext_features(p_acl_cb, 1);
1191
1192 /* Continue HCI connection establishment */
1193 btm_establish_continue(p_acl_cb);
1194 }
1195
1196 /*******************************************************************************
1197 *
1198 * Function btm_establish_continue
1199 *
1200 * Description This function is called when the command complete message
1201 * is received from the HCI for the read local link policy
1202 * request.
1203 *
1204 * Returns void
1205 *
1206 ******************************************************************************/
btm_establish_continue(tACL_CONN * p_acl_cb)1207 void btm_establish_continue(tACL_CONN* p_acl_cb) {
1208 tBTM_BL_EVENT_DATA evt_data;
1209 BTM_TRACE_DEBUG("btm_establish_continue");
1210 #if (BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1211 if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
1212 /* For now there are a some devices that do not like sending */
1213 /* commands events and data at the same time. */
1214 /* Set the packet types to the default allowed by the device */
1215 btm_set_packet_types(p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1216
1217 if (btm_cb.btm_def_link_policy)
1218 BTM_SetLinkPolicy(p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1219 }
1220 #endif
1221 if (p_acl_cb->link_up_issued) {
1222 BTM_TRACE_ERROR("%s: Already link is up ", __func__);
1223 return;
1224 }
1225 p_acl_cb->link_up_issued = true;
1226
1227 /* If anyone cares, tell him database changed */
1228 if (btm_cb.p_bl_changed_cb) {
1229 evt_data.event = BTM_BL_CONN_EVT;
1230 evt_data.conn.p_bda = &p_acl_cb->remote_addr;
1231 evt_data.conn.p_bdn = p_acl_cb->remote_name;
1232 evt_data.conn.p_dc = p_acl_cb->remote_dc;
1233 evt_data.conn.p_features = p_acl_cb->peer_lmp_feature_pages[0];
1234 evt_data.conn.handle = p_acl_cb->hci_handle;
1235 evt_data.conn.transport = p_acl_cb->transport;
1236
1237 (*btm_cb.p_bl_changed_cb)(&evt_data);
1238 }
1239 btm_acl_update_busy_level(BTM_BLI_ACL_UP_EVT);
1240 }
1241
1242 /*******************************************************************************
1243 *
1244 * Function BTM_SetDefaultLinkSuperTout
1245 *
1246 * Description Set the default value for HCI "Write Link Supervision
1247 * Timeout"
1248 * command to use when an ACL link is created.
1249 *
1250 * Returns void
1251 *
1252 ******************************************************************************/
BTM_SetDefaultLinkSuperTout(uint16_t timeout)1253 void BTM_SetDefaultLinkSuperTout(uint16_t timeout) {
1254 BTM_TRACE_DEBUG("BTM_SetDefaultLinkSuperTout");
1255 btm_cb.btm_def_link_super_tout = timeout;
1256 }
1257
1258 /*******************************************************************************
1259 *
1260 * Function BTM_GetLinkSuperTout
1261 *
1262 * Description Read the link supervision timeout value of the connection
1263 *
1264 * Returns status of the operation
1265 *
1266 ******************************************************************************/
BTM_GetLinkSuperTout(const RawAddress & remote_bda,uint16_t * p_timeout)1267 tBTM_STATUS BTM_GetLinkSuperTout(const RawAddress& remote_bda,
1268 uint16_t* p_timeout) {
1269 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1270
1271 BTM_TRACE_DEBUG("BTM_GetLinkSuperTout");
1272 if (p != (tACL_CONN*)NULL) {
1273 *p_timeout = p->link_super_tout;
1274 return (BTM_SUCCESS);
1275 }
1276 /* If here, no BD Addr found */
1277 return (BTM_UNKNOWN_ADDR);
1278 }
1279
1280 /*******************************************************************************
1281 *
1282 * Function BTM_SetLinkSuperTout
1283 *
1284 * Description Create and send HCI "Write Link Supervision Timeout" command
1285 *
1286 * Returns status of the operation
1287 *
1288 ******************************************************************************/
BTM_SetLinkSuperTout(const RawAddress & remote_bda,uint16_t timeout)1289 tBTM_STATUS BTM_SetLinkSuperTout(const RawAddress& remote_bda,
1290 uint16_t timeout) {
1291 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1292
1293 BTM_TRACE_DEBUG("BTM_SetLinkSuperTout");
1294 if (p != (tACL_CONN*)NULL) {
1295 p->link_super_tout = timeout;
1296
1297 /* Only send if current role is Master; 2.0 spec requires this */
1298 if (p->link_role == BTM_ROLE_MASTER) {
1299 btsnd_hcic_write_link_super_tout(LOCAL_BR_EDR_CONTROLLER_ID,
1300 p->hci_handle, timeout);
1301 return (BTM_CMD_STARTED);
1302 } else {
1303 return (BTM_SUCCESS);
1304 }
1305 }
1306
1307 /* If here, no BD Addr found */
1308 return (BTM_UNKNOWN_ADDR);
1309 }
1310
1311 /*******************************************************************************
1312 *
1313 * Function BTM_IsAclConnectionUp
1314 *
1315 * Description This function is called to check if an ACL connection exists
1316 * to a specific remote BD Address.
1317 *
1318 * Returns true if connection is up, else false.
1319 *
1320 ******************************************************************************/
BTM_IsAclConnectionUp(const RawAddress & remote_bda,tBT_TRANSPORT transport)1321 bool BTM_IsAclConnectionUp(const RawAddress& remote_bda,
1322 tBT_TRANSPORT transport) {
1323 tACL_CONN* p;
1324
1325 VLOG(2) << __func__ << " RemBdAddr: " << remote_bda;
1326
1327 p = btm_bda_to_acl(remote_bda, transport);
1328 if (p != (tACL_CONN*)NULL) {
1329 return (true);
1330 }
1331
1332 /* If here, no BD Addr found */
1333 return (false);
1334 }
1335
1336 /*******************************************************************************
1337 *
1338 * Function BTM_GetNumAclLinks
1339 *
1340 * Description This function is called to count the number of
1341 * ACL links that are active.
1342 *
1343 * Returns uint16_t Number of active ACL links
1344 *
1345 ******************************************************************************/
BTM_GetNumAclLinks(void)1346 uint16_t BTM_GetNumAclLinks(void) {
1347 uint16_t num_acl = 0;
1348
1349 for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i) {
1350 if (btm_cb.acl_db[i].in_use) ++num_acl;
1351 }
1352
1353 return num_acl;
1354 }
1355
1356 /*******************************************************************************
1357 *
1358 * Function btm_get_acl_disc_reason_code
1359 *
1360 * Description This function is called to get the disconnection reason code
1361 * returned by the HCI at disconnection complete event.
1362 *
1363 * Returns true if connection is up, else false.
1364 *
1365 ******************************************************************************/
btm_get_acl_disc_reason_code(void)1366 uint16_t btm_get_acl_disc_reason_code(void) {
1367 uint8_t res = btm_cb.acl_disc_reason;
1368 BTM_TRACE_DEBUG("btm_get_acl_disc_reason_code");
1369 return (res);
1370 }
1371
1372 /*******************************************************************************
1373 *
1374 * Function BTM_GetHCIConnHandle
1375 *
1376 * Description This function is called to get the handle for an ACL
1377 * connection to a specific remote BD Address.
1378 *
1379 * Returns the handle of the connection, or 0xFFFF if none.
1380 *
1381 ******************************************************************************/
BTM_GetHCIConnHandle(const RawAddress & remote_bda,tBT_TRANSPORT transport)1382 uint16_t BTM_GetHCIConnHandle(const RawAddress& remote_bda,
1383 tBT_TRANSPORT transport) {
1384 tACL_CONN* p;
1385 BTM_TRACE_DEBUG("BTM_GetHCIConnHandle");
1386 p = btm_bda_to_acl(remote_bda, transport);
1387 if (p != (tACL_CONN*)NULL) {
1388 return (p->hci_handle);
1389 }
1390
1391 /* If here, no BD Addr found */
1392 return (0xFFFF);
1393 }
1394
1395 /*******************************************************************************
1396 *
1397 * Function btm_process_clk_off_comp_evt
1398 *
1399 * Description This function is called when clock offset command completes.
1400 *
1401 * Input Parms hci_handle - connection handle associated with the change
1402 * clock offset
1403 *
1404 * Returns void
1405 *
1406 ******************************************************************************/
btm_process_clk_off_comp_evt(uint16_t hci_handle,uint16_t clock_offset)1407 void btm_process_clk_off_comp_evt(uint16_t hci_handle, uint16_t clock_offset) {
1408 uint8_t xx;
1409 BTM_TRACE_DEBUG("btm_process_clk_off_comp_evt");
1410 /* Look up the connection by handle and set the current mode */
1411 xx = btm_handle_to_acl_index(hci_handle);
1412 if (xx < MAX_L2CAP_LINKS) btm_cb.acl_db[xx].clock_offset = clock_offset;
1413 }
1414
1415 /*******************************************************************************
1416 *
1417 * Function btm_blacklist_role_change_device
1418 *
1419 * Description This function is used to blacklist the device if the role
1420 * switch fails for maximum number of times. It also removes
1421 * the device from the black list if the role switch succeeds.
1422 *
1423 * Input Parms bd_addr - remote BD addr
1424 * hci_status - role switch status
1425 *
1426 * Returns void
1427 *
1428 *******************************************************************************/
btm_blacklist_role_change_device(const RawAddress & bd_addr,uint8_t hci_status)1429 void btm_blacklist_role_change_device(const RawAddress& bd_addr,
1430 uint8_t hci_status) {
1431 tACL_CONN* p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
1432 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
1433
1434 if (!p || !p_dev_rec) {
1435 return;
1436 }
1437 if (hci_status == HCI_SUCCESS) {
1438 p->switch_role_failed_attempts = 0;
1439 return;
1440 }
1441
1442 /* check for carkits */
1443 const uint32_t cod_audio_device =
1444 (BTM_COD_SERVICE_AUDIO | BTM_COD_MAJOR_AUDIO) << 8;
1445 const uint32_t cod =
1446 ((p_dev_rec->dev_class[0] << 16) | (p_dev_rec->dev_class[1] << 8) |
1447 p_dev_rec->dev_class[2]) &
1448 0xffffff;
1449 if ((hci_status != HCI_SUCCESS) &&
1450 ((p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) ||
1451 (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)) &&
1452 ((cod & cod_audio_device) == cod_audio_device) &&
1453 (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr))) {
1454 p->switch_role_failed_attempts++;
1455 if (p->switch_role_failed_attempts == BTM_MAX_SW_ROLE_FAILED_ATTEMPTS) {
1456 BTM_TRACE_WARNING(
1457 "%s: Device %s blacklisted for role switching - "
1458 "multiple role switch failed attempts: %u",
1459 __func__, bd_addr.ToString().c_str(), p->switch_role_failed_attempts);
1460 interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr, 3);
1461 }
1462 }
1463 }
1464
1465 /*******************************************************************************
1466 *
1467 * Function btm_acl_role_changed
1468 *
1469 * Description This function is called whan a link's master/slave role
1470 * change event or command status event (with error) is
1471 * received. It updates the link control block, and calls the
1472 * registered callback with status and role (if registered).
1473 *
1474 * Returns void
1475 *
1476 ******************************************************************************/
btm_acl_role_changed(uint8_t hci_status,const RawAddress * bd_addr,uint8_t new_role)1477 void btm_acl_role_changed(uint8_t hci_status, const RawAddress* bd_addr,
1478 uint8_t new_role) {
1479 const RawAddress* p_bda =
1480 (bd_addr) ? bd_addr : &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1481 tACL_CONN* p = btm_bda_to_acl(*p_bda, BT_TRANSPORT_BR_EDR);
1482 tBTM_ROLE_SWITCH_CMPL* p_data = &btm_cb.devcb.switch_role_ref_data;
1483 tBTM_SEC_DEV_REC* p_dev_rec;
1484
1485 BTM_TRACE_DEBUG("%s: peer %s hci_status:0x%x new_role:%d", __func__,
1486 (p_bda != nullptr) ? bd_addr->ToString().c_str() : "nullptr",
1487 hci_status, new_role);
1488 /* Ignore any stray events */
1489 if (p == NULL) {
1490 /* it could be a failure */
1491 if (hci_status != HCI_SUCCESS)
1492 btm_acl_report_role_change(hci_status, bd_addr);
1493 return;
1494 }
1495
1496 p_data->hci_status = hci_status;
1497
1498 if (hci_status == HCI_SUCCESS) {
1499 p_data->role = new_role;
1500 p_data->remote_bd_addr = *p_bda;
1501
1502 /* Update cached value */
1503 p->link_role = new_role;
1504
1505 /* Reload LSTO: link supervision timeout is reset in the LM after a role
1506 * switch */
1507 if (new_role == BTM_ROLE_MASTER) {
1508 BTM_SetLinkSuperTout(p->remote_addr, p->link_super_tout);
1509 }
1510 } else {
1511 /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1512 new_role = p->link_role;
1513 }
1514
1515 /* Check if any SCO req is pending for role change */
1516 btm_sco_chk_pend_rolechange(p->hci_handle);
1517
1518 /* if switching state is switching we need to turn encryption on */
1519 /* if idle, we did not change encryption */
1520 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) {
1521 btsnd_hcic_set_conn_encrypt(p->hci_handle, true);
1522 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1523 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1524 return;
1525 }
1526
1527 /* Set the switch_role_state to IDLE since the reply received from HCI */
1528 /* regardless of its result either success or failed. */
1529 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS) {
1530 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1531 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1532 }
1533
1534 /* if role switch complete is needed, report it now */
1535 btm_acl_report_role_change(hci_status, bd_addr);
1536
1537 /* if role change event is registered, report it now */
1538 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
1539 tBTM_BL_ROLE_CHG_DATA evt;
1540 evt.event = BTM_BL_ROLE_CHG_EVT;
1541 evt.new_role = new_role;
1542 evt.p_bda = p_bda;
1543 evt.hci_status = hci_status;
1544 tBTM_BL_EVENT_DATA btm_bl_event_data;
1545 btm_bl_event_data.role_chg = evt;
1546 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
1547 }
1548
1549 BTM_TRACE_DEBUG(
1550 "%s: peer %s Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, "
1551 "rs_st:%d",
1552 __func__, (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr",
1553 p_data->role, p_data->hci_status, p->switch_role_state);
1554
1555 #if (BTM_DISC_DURING_RS == TRUE)
1556 /* If a disconnect is pending, issue it now that role switch has completed */
1557 p_dev_rec = btm_find_dev(*p_bda);
1558 if (p_dev_rec != NULL) {
1559 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
1560 BTM_TRACE_WARNING(
1561 "%s peer %s Issuing delayed HCI_Disconnect!!!", __func__,
1562 (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr");
1563 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1564 }
1565 BTM_TRACE_ERROR("%s: peer %s tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1566 __func__,
1567 (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr",
1568 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1569 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
1570 }
1571
1572 #endif
1573 }
1574
1575 /*******************************************************************************
1576 *
1577 * Function BTM_AllocateSCN
1578 *
1579 * Description Look through the Server Channel Numbers for a free one.
1580 *
1581 * Returns Allocated SCN number or 0 if none.
1582 *
1583 ******************************************************************************/
1584
BTM_AllocateSCN(void)1585 uint8_t BTM_AllocateSCN(void) {
1586 uint8_t x;
1587 BTM_TRACE_DEBUG("BTM_AllocateSCN");
1588
1589 // stack reserves scn 1 for HFP, HSP we still do the correct way
1590 for (x = 1; x < BTM_MAX_SCN; x++) {
1591 if (!btm_cb.btm_scn[x]) {
1592 btm_cb.btm_scn[x] = true;
1593 return (x + 1);
1594 }
1595 }
1596
1597 return (0); /* No free ports */
1598 }
1599
1600 /*******************************************************************************
1601 *
1602 * Function BTM_TryAllocateSCN
1603 *
1604 * Description Try to allocate a fixed server channel
1605 *
1606 * Returns Returns true if server channel was available
1607 *
1608 ******************************************************************************/
1609
BTM_TryAllocateSCN(uint8_t scn)1610 bool BTM_TryAllocateSCN(uint8_t scn) {
1611 /* Make sure we don't exceed max port range.
1612 * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1613 */
1614 if ((scn >= BTM_MAX_SCN) || (scn == 1)) return false;
1615
1616 /* check if this port is available */
1617 if (!btm_cb.btm_scn[scn - 1]) {
1618 btm_cb.btm_scn[scn - 1] = true;
1619 return true;
1620 }
1621
1622 return (false); /* Port was busy */
1623 }
1624
1625 /*******************************************************************************
1626 *
1627 * Function BTM_FreeSCN
1628 *
1629 * Description Free the specified SCN.
1630 *
1631 * Returns true or false
1632 *
1633 ******************************************************************************/
BTM_FreeSCN(uint8_t scn)1634 bool BTM_FreeSCN(uint8_t scn) {
1635 BTM_TRACE_DEBUG("BTM_FreeSCN ");
1636 if (scn <= BTM_MAX_SCN) {
1637 btm_cb.btm_scn[scn - 1] = false;
1638 return (true);
1639 } else {
1640 return (false); /* Illegal SCN passed in */
1641 }
1642 }
1643
1644 /*******************************************************************************
1645 *
1646 * Function btm_set_packet_types
1647 *
1648 * Description This function sets the packet types used for a specific
1649 * ACL connection. It is called internally by btm_acl_created
1650 * or by an application/profile by BTM_SetPacketTypes.
1651 *
1652 * Returns status of the operation
1653 *
1654 ******************************************************************************/
btm_set_packet_types(tACL_CONN * p,uint16_t pkt_types)1655 tBTM_STATUS btm_set_packet_types(tACL_CONN* p, uint16_t pkt_types) {
1656 uint16_t temp_pkt_types;
1657 BTM_TRACE_DEBUG("btm_set_packet_types");
1658 /* Save in the ACL control blocks, types that we support */
1659 temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1660 btm_cb.btm_acl_pkt_types_supported);
1661
1662 /* OR in any exception packet types if at least 2.0 version of spec */
1663 temp_pkt_types |=
1664 ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1665 (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1666
1667 /* Exclude packet types not supported by the peer */
1668 btm_acl_chk_peer_pkt_type_support(p, &temp_pkt_types);
1669
1670 BTM_TRACE_DEBUG("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1671
1672 btsnd_hcic_change_conn_type(p->hci_handle, temp_pkt_types);
1673 p->pkt_types_mask = temp_pkt_types;
1674
1675 return (BTM_CMD_STARTED);
1676 }
1677
1678 /*******************************************************************************
1679 *
1680 * Function btm_get_max_packet_size
1681 *
1682 * Returns Returns maximum packet size that can be used for current
1683 * connection, 0 if connection is not established
1684 *
1685 ******************************************************************************/
btm_get_max_packet_size(const RawAddress & addr)1686 uint16_t btm_get_max_packet_size(const RawAddress& addr) {
1687 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1688 uint16_t pkt_types = 0;
1689 uint16_t pkt_size = 0;
1690 BTM_TRACE_DEBUG("btm_get_max_packet_size");
1691 if (p != NULL) {
1692 pkt_types = p->pkt_types_mask;
1693 } else {
1694 /* Special case for when info for the local device is requested */
1695 if (addr == *controller_get_interface()->get_address()) {
1696 pkt_types = btm_cb.btm_acl_pkt_types_supported;
1697 }
1698 }
1699
1700 if (pkt_types) {
1701 if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1702 pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1703 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1704 pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1705 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1706 pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1707 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1708 pkt_size = HCI_DH5_PACKET_SIZE;
1709 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1710 pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1711 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1712 pkt_size = HCI_DM5_PACKET_SIZE;
1713 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1714 pkt_size = HCI_DH3_PACKET_SIZE;
1715 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1716 pkt_size = HCI_DM3_PACKET_SIZE;
1717 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1718 pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1719 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1720 pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1721 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1722 pkt_size = HCI_DH1_PACKET_SIZE;
1723 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1724 pkt_size = HCI_DM1_PACKET_SIZE;
1725 }
1726
1727 return (pkt_size);
1728 }
1729
1730 /*******************************************************************************
1731 *
1732 * Function BTM_ReadRemoteVersion
1733 *
1734 * Returns If connected report peer device info
1735 *
1736 ******************************************************************************/
BTM_ReadRemoteVersion(const RawAddress & addr,uint8_t * lmp_version,uint16_t * manufacturer,uint16_t * lmp_sub_version)1737 tBTM_STATUS BTM_ReadRemoteVersion(const RawAddress& addr, uint8_t* lmp_version,
1738 uint16_t* manufacturer,
1739 uint16_t* lmp_sub_version) {
1740 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1741 BTM_TRACE_DEBUG("BTM_ReadRemoteVersion");
1742 if (p == NULL) return (BTM_UNKNOWN_ADDR);
1743
1744 if (lmp_version) *lmp_version = p->lmp_version;
1745
1746 if (manufacturer) *manufacturer = p->manufacturer;
1747
1748 if (lmp_sub_version) *lmp_sub_version = p->lmp_subversion;
1749
1750 return (BTM_SUCCESS);
1751 }
1752
1753 /*******************************************************************************
1754 *
1755 * Function BTM_ReadRemoteFeatures
1756 *
1757 * Returns pointer to the remote supported features mask (8 bytes)
1758 *
1759 ******************************************************************************/
BTM_ReadRemoteFeatures(const RawAddress & addr)1760 uint8_t* BTM_ReadRemoteFeatures(const RawAddress& addr) {
1761 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1762 BTM_TRACE_DEBUG("BTM_ReadRemoteFeatures");
1763 if (p == NULL) {
1764 return (NULL);
1765 }
1766
1767 return (p->peer_lmp_feature_pages[0]);
1768 }
1769
1770 /*******************************************************************************
1771 *
1772 * Function BTM_ReadRemoteExtendedFeatures
1773 *
1774 * Returns pointer to the remote extended features mask (8 bytes)
1775 * or NULL if bad page
1776 *
1777 ******************************************************************************/
BTM_ReadRemoteExtendedFeatures(const RawAddress & addr,uint8_t page_number)1778 uint8_t* BTM_ReadRemoteExtendedFeatures(const RawAddress& addr,
1779 uint8_t page_number) {
1780 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1781 BTM_TRACE_DEBUG("BTM_ReadRemoteExtendedFeatures");
1782 if (p == NULL) {
1783 return (NULL);
1784 }
1785
1786 if (page_number > HCI_EXT_FEATURES_PAGE_MAX) {
1787 BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown",
1788 page_number);
1789 return NULL;
1790 }
1791
1792 return (p->peer_lmp_feature_pages[page_number]);
1793 }
1794
1795 /*******************************************************************************
1796 *
1797 * Function BTM_ReadNumberRemoteFeaturesPages
1798 *
1799 * Returns number of features pages read from the remote device.
1800 *
1801 ******************************************************************************/
BTM_ReadNumberRemoteFeaturesPages(const RawAddress & addr)1802 uint8_t BTM_ReadNumberRemoteFeaturesPages(const RawAddress& addr) {
1803 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1804 BTM_TRACE_DEBUG("BTM_ReadNumberRemoteFeaturesPages");
1805 if (p == NULL) {
1806 return (0);
1807 }
1808
1809 return (p->num_read_pages);
1810 }
1811
1812 /*******************************************************************************
1813 *
1814 * Function BTM_ReadAllRemoteFeatures
1815 *
1816 * Returns pointer to all features of the remote (24 bytes).
1817 *
1818 ******************************************************************************/
BTM_ReadAllRemoteFeatures(const RawAddress & addr)1819 uint8_t* BTM_ReadAllRemoteFeatures(const RawAddress& addr) {
1820 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1821 BTM_TRACE_DEBUG("BTM_ReadAllRemoteFeatures");
1822 if (p == NULL) {
1823 return (NULL);
1824 }
1825
1826 return (p->peer_lmp_feature_pages[0]);
1827 }
1828
1829 /*******************************************************************************
1830 *
1831 * Function BTM_RegBusyLevelNotif
1832 *
1833 * Description This function is called to register a callback to receive
1834 * busy level change events.
1835 *
1836 * Returns BTM_SUCCESS if successfully registered, otherwise error
1837 *
1838 ******************************************************************************/
BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB * p_cb,uint8_t * p_level,tBTM_BL_EVENT_MASK evt_mask)1839 tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
1840 tBTM_BL_EVENT_MASK evt_mask) {
1841 BTM_TRACE_DEBUG("BTM_RegBusyLevelNotif");
1842 if (p_level) *p_level = btm_cb.busy_level;
1843
1844 btm_cb.bl_evt_mask = evt_mask;
1845
1846 if (!p_cb)
1847 btm_cb.p_bl_changed_cb = NULL;
1848 else if (btm_cb.p_bl_changed_cb)
1849 return (BTM_BUSY);
1850 else
1851 btm_cb.p_bl_changed_cb = p_cb;
1852
1853 return (BTM_SUCCESS);
1854 }
1855
1856 /*******************************************************************************
1857 *
1858 * Function BTM_SetQoS
1859 *
1860 * Description This function is called to setup QoS
1861 *
1862 * Returns status of the operation
1863 *
1864 ******************************************************************************/
BTM_SetQoS(const RawAddress & bd,FLOW_SPEC * p_flow,tBTM_CMPL_CB * p_cb)1865 tBTM_STATUS BTM_SetQoS(const RawAddress& bd, FLOW_SPEC* p_flow,
1866 tBTM_CMPL_CB* p_cb) {
1867 tACL_CONN* p = &btm_cb.acl_db[0];
1868
1869 VLOG(2) << __func__ << " BdAddr: " << bd;
1870
1871 /* If someone already waiting on the version, do not allow another */
1872 if (btm_cb.devcb.p_qos_setup_cmpl_cb) return (BTM_BUSY);
1873
1874 p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR);
1875 if (p != NULL) {
1876 btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
1877 alarm_set_on_mloop(btm_cb.devcb.qos_setup_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1878 btm_qos_setup_timeout, NULL);
1879
1880 btsnd_hcic_qos_setup(p->hci_handle, p_flow->qos_flags, p_flow->service_type,
1881 p_flow->token_rate, p_flow->peak_bandwidth,
1882 p_flow->latency, p_flow->delay_variation);
1883 return (BTM_CMD_STARTED);
1884 }
1885
1886 /* If here, no BD Addr found */
1887 return (BTM_UNKNOWN_ADDR);
1888 }
1889
1890 /*******************************************************************************
1891 *
1892 * Function btm_qos_setup_timeout
1893 *
1894 * Description Callback when QoS setup times out.
1895 *
1896 * Returns void
1897 *
1898 ******************************************************************************/
btm_qos_setup_timeout(UNUSED_ATTR void * data)1899 void btm_qos_setup_timeout(UNUSED_ATTR void* data) {
1900 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1901 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1902 if (p_cb) (*p_cb)((void*)NULL);
1903 }
1904
1905 /*******************************************************************************
1906 *
1907 * Function btm_qos_setup_complete
1908 *
1909 * Description This function is called when the command complete message
1910 * is received from the HCI for the qos setup request.
1911 *
1912 * Returns void
1913 *
1914 ******************************************************************************/
btm_qos_setup_complete(uint8_t status,uint16_t handle,FLOW_SPEC * p_flow)1915 void btm_qos_setup_complete(uint8_t status, uint16_t handle,
1916 FLOW_SPEC* p_flow) {
1917 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1918 tBTM_QOS_SETUP_CMPL qossu;
1919
1920 BTM_TRACE_DEBUG("%s", __func__);
1921 alarm_cancel(btm_cb.devcb.qos_setup_timer);
1922 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1923
1924 /* If there was a registered callback, call it */
1925 if (p_cb) {
1926 memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1927 qossu.status = status;
1928 qossu.handle = handle;
1929 if (p_flow != NULL) {
1930 qossu.flow.qos_flags = p_flow->qos_flags;
1931 qossu.flow.service_type = p_flow->service_type;
1932 qossu.flow.token_rate = p_flow->token_rate;
1933 qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1934 qossu.flow.latency = p_flow->latency;
1935 qossu.flow.delay_variation = p_flow->delay_variation;
1936 }
1937 BTM_TRACE_DEBUG("BTM: p_flow->delay_variation: 0x%02x",
1938 qossu.flow.delay_variation);
1939 (*p_cb)(&qossu);
1940 }
1941 }
1942
1943 /*******************************************************************************
1944 *
1945 * Function BTM_ReadRSSI
1946 *
1947 * Description This function is called to read the link policy settings.
1948 * The address of link policy results are returned in the
1949 * callback.
1950 * (tBTM_RSSI_RESULT)
1951 *
1952 * Returns BTM_CMD_STARTED if successfully initiated or error code
1953 *
1954 ******************************************************************************/
BTM_ReadRSSI(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1955 tBTM_STATUS BTM_ReadRSSI(const RawAddress& remote_bda, tBTM_CMPL_CB* p_cb) {
1956 tACL_CONN* p = NULL;
1957 tBT_DEVICE_TYPE dev_type;
1958 tBLE_ADDR_TYPE addr_type;
1959
1960 /* If someone already waiting on the version, do not allow another */
1961 if (btm_cb.devcb.p_rssi_cmpl_cb) return (BTM_BUSY);
1962
1963 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1964
1965 if (dev_type & BT_DEVICE_TYPE_BLE) {
1966 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_LE);
1967 }
1968
1969 if (p == NULL && dev_type & BT_DEVICE_TYPE_BREDR) {
1970 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1971 }
1972
1973 if (p) {
1974 btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
1975 alarm_set_on_mloop(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1976 btm_read_rssi_timeout, NULL);
1977
1978 btsnd_hcic_read_rssi(p->hci_handle);
1979 return (BTM_CMD_STARTED);
1980 }
1981
1982 /* If here, no BD Addr found */
1983 return (BTM_UNKNOWN_ADDR);
1984 }
1985
1986 /*******************************************************************************
1987 *
1988 * Function BTM_ReadFailedContactCounter
1989 *
1990 * Description This function is called to read the failed contact counter.
1991 * The result is returned in the callback.
1992 * (tBTM_FAILED_CONTACT_COUNTER_RESULT)
1993 *
1994 * Returns BTM_CMD_STARTED if successfully initiated or error code
1995 *
1996 ******************************************************************************/
BTM_ReadFailedContactCounter(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1997 tBTM_STATUS BTM_ReadFailedContactCounter(const RawAddress& remote_bda,
1998 tBTM_CMPL_CB* p_cb) {
1999 tACL_CONN* p;
2000 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2001 tBT_DEVICE_TYPE dev_type;
2002 tBLE_ADDR_TYPE addr_type;
2003
2004 /* If someone already waiting on the result, do not allow another */
2005 if (btm_cb.devcb.p_failed_contact_counter_cmpl_cb) return (BTM_BUSY);
2006
2007 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2008 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
2009
2010 p = btm_bda_to_acl(remote_bda, transport);
2011 if (p != (tACL_CONN*)NULL) {
2012 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = p_cb;
2013 alarm_set_on_mloop(btm_cb.devcb.read_failed_contact_counter_timer,
2014 BTM_DEV_REPLY_TIMEOUT_MS,
2015 btm_read_failed_contact_counter_timeout, NULL);
2016
2017 btsnd_hcic_read_failed_contact_counter(p->hci_handle);
2018 return (BTM_CMD_STARTED);
2019 }
2020
2021 /* If here, no BD Addr found */
2022 return (BTM_UNKNOWN_ADDR);
2023 }
2024
2025 /*******************************************************************************
2026 *
2027 * Function BTM_ReadAutomaticFlushTimeout
2028 *
2029 * Description This function is called to read the automatic flush timeout.
2030 * The result is returned in the callback.
2031 * (tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT)
2032 *
2033 * Returns BTM_CMD_STARTED if successfully initiated or error code
2034 *
2035 ******************************************************************************/
BTM_ReadAutomaticFlushTimeout(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)2036 tBTM_STATUS BTM_ReadAutomaticFlushTimeout(const RawAddress& remote_bda,
2037 tBTM_CMPL_CB* p_cb) {
2038 tACL_CONN* p;
2039 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2040 tBT_DEVICE_TYPE dev_type;
2041 tBLE_ADDR_TYPE addr_type;
2042
2043 /* If someone already waiting on the result, do not allow another */
2044 if (btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb) return (BTM_BUSY);
2045
2046 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2047 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
2048
2049 p = btm_bda_to_acl(remote_bda, transport);
2050 if (!p) return BTM_UNKNOWN_ADDR;
2051
2052 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = p_cb;
2053 alarm_set_on_mloop(btm_cb.devcb.read_automatic_flush_timeout_timer,
2054 BTM_DEV_REPLY_TIMEOUT_MS,
2055 btm_read_automatic_flush_timeout_timeout, nullptr);
2056
2057 btsnd_hcic_read_automatic_flush_timeout(p->hci_handle);
2058 return BTM_CMD_STARTED;
2059 }
2060
2061 /*******************************************************************************
2062 *
2063 * Function BTM_ReadLinkQuality
2064 *
2065 * Description This function is called to read the link qulaity.
2066 * The value of the link quality is returned in the callback.
2067 * (tBTM_LINK_QUALITY_RESULT)
2068 *
2069 * Returns BTM_CMD_STARTED if successfully initiated or error code
2070 *
2071 ******************************************************************************/
BTM_ReadLinkQuality(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)2072 tBTM_STATUS BTM_ReadLinkQuality(const RawAddress& remote_bda,
2073 tBTM_CMPL_CB* p_cb) {
2074 VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
2075
2076 /* If someone already waiting on the version, do not allow another */
2077 if (btm_cb.devcb.p_link_qual_cmpl_cb) return (BTM_BUSY);
2078
2079 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
2080 if (p != (tACL_CONN*)NULL) {
2081 btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
2082 alarm_set_on_mloop(btm_cb.devcb.read_link_quality_timer,
2083 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_link_quality_timeout,
2084 NULL);
2085
2086 btsnd_hcic_get_link_quality(p->hci_handle);
2087 return (BTM_CMD_STARTED);
2088 }
2089
2090 /* If here, no BD Addr found */
2091 return (BTM_UNKNOWN_ADDR);
2092 }
2093
2094 /*******************************************************************************
2095 *
2096 * Function BTM_ReadTxPower
2097 *
2098 * Description This function is called to read the current
2099 * TX power of the connection. The tx power level results
2100 * are returned in the callback.
2101 * (tBTM_RSSI_RESULT)
2102 *
2103 * Returns BTM_CMD_STARTED if successfully initiated or error code
2104 *
2105 ******************************************************************************/
BTM_ReadTxPower(const RawAddress & remote_bda,tBT_TRANSPORT transport,tBTM_CMPL_CB * p_cb)2106 tBTM_STATUS BTM_ReadTxPower(const RawAddress& remote_bda,
2107 tBT_TRANSPORT transport, tBTM_CMPL_CB* p_cb) {
2108 tACL_CONN* p;
2109 #define BTM_READ_RSSI_TYPE_CUR 0x00
2110 #define BTM_READ_RSSI_TYPE_MAX 0X01
2111
2112 VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
2113
2114 /* If someone already waiting on the version, do not allow another */
2115 if (btm_cb.devcb.p_tx_power_cmpl_cb) return (BTM_BUSY);
2116
2117 p = btm_bda_to_acl(remote_bda, transport);
2118 if (p != (tACL_CONN*)NULL) {
2119 btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2120 alarm_set_on_mloop(btm_cb.devcb.read_tx_power_timer,
2121 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_tx_power_timeout,
2122 NULL);
2123
2124 if (p->transport == BT_TRANSPORT_LE) {
2125 btm_cb.devcb.read_tx_pwr_addr = remote_bda;
2126 btsnd_hcic_ble_read_adv_chnl_tx_power();
2127 } else {
2128 btsnd_hcic_read_tx_power(p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2129 }
2130
2131 return (BTM_CMD_STARTED);
2132 }
2133
2134 /* If here, no BD Addr found */
2135 return (BTM_UNKNOWN_ADDR);
2136 }
2137
2138 /*******************************************************************************
2139 *
2140 * Function btm_read_tx_power_timeout
2141 *
2142 * Description Callback when reading the tx power times out.
2143 *
2144 * Returns void
2145 *
2146 ******************************************************************************/
btm_read_tx_power_timeout(UNUSED_ATTR void * data)2147 void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {
2148 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2149 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2150 if (p_cb) (*p_cb)((void*)NULL);
2151 }
2152
2153 /*******************************************************************************
2154 *
2155 * Function btm_read_tx_power_complete
2156 *
2157 * Description This function is called when the command complete message
2158 * is received from the HCI for the read tx power request.
2159 *
2160 * Returns void
2161 *
2162 ******************************************************************************/
btm_read_tx_power_complete(uint8_t * p,bool is_ble)2163 void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
2164 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2165 tBTM_TX_POWER_RESULT result;
2166 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2167
2168 BTM_TRACE_DEBUG("%s", __func__);
2169 alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2170 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2171
2172 /* If there was a registered callback, call it */
2173 if (p_cb) {
2174 STREAM_TO_UINT8(result.hci_status, p);
2175
2176 if (result.hci_status == HCI_SUCCESS) {
2177 result.status = BTM_SUCCESS;
2178
2179 if (!is_ble) {
2180 uint16_t handle;
2181 STREAM_TO_UINT16(handle, p);
2182 STREAM_TO_UINT8(result.tx_power, p);
2183
2184 /* Search through the list of active channels for the correct BD Addr */
2185 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2186 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2187 result.rem_bda = p_acl_cb->remote_addr;
2188 break;
2189 }
2190 }
2191 } else {
2192 STREAM_TO_UINT8(result.tx_power, p);
2193 result.rem_bda = btm_cb.devcb.read_tx_pwr_addr;
2194 }
2195 BTM_TRACE_DEBUG("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2196 result.tx_power, result.hci_status);
2197 } else {
2198 result.status = BTM_ERR_PROCESSING;
2199 }
2200
2201 (*p_cb)(&result);
2202 }
2203 }
2204
2205 /*******************************************************************************
2206 *
2207 * Function btm_read_rssi_timeout
2208 *
2209 * Description Callback when reading the RSSI times out.
2210 *
2211 * Returns void
2212 *
2213 ******************************************************************************/
btm_read_rssi_timeout(UNUSED_ATTR void * data)2214 void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
2215 tBTM_RSSI_RESULT result;
2216 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2217 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2218 result.status = BTM_DEVICE_TIMEOUT;
2219 if (p_cb) (*p_cb)(&result);
2220 }
2221
2222 /*******************************************************************************
2223 *
2224 * Function btm_read_rssi_complete
2225 *
2226 * Description This function is called when the command complete message
2227 * is received from the HCI for the read rssi request.
2228 *
2229 * Returns void
2230 *
2231 ******************************************************************************/
btm_read_rssi_complete(uint8_t * p)2232 void btm_read_rssi_complete(uint8_t* p) {
2233 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2234 tBTM_RSSI_RESULT result;
2235 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2236
2237 BTM_TRACE_DEBUG("%s", __func__);
2238 alarm_cancel(btm_cb.devcb.read_rssi_timer);
2239 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2240
2241 /* If there was a registered callback, call it */
2242 if (p_cb) {
2243 STREAM_TO_UINT8(result.hci_status, p);
2244
2245 if (result.hci_status == HCI_SUCCESS) {
2246 uint16_t handle;
2247 result.status = BTM_SUCCESS;
2248
2249 STREAM_TO_UINT16(handle, p);
2250
2251 STREAM_TO_UINT8(result.rssi, p);
2252 BTM_TRACE_DEBUG("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2253 result.rssi, result.hci_status);
2254
2255 /* Search through the list of active channels for the correct BD Addr */
2256 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2257 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2258 result.rem_bda = p_acl_cb->remote_addr;
2259 break;
2260 }
2261 }
2262 } else {
2263 result.status = BTM_ERR_PROCESSING;
2264 }
2265
2266 (*p_cb)(&result);
2267 }
2268 }
2269
2270 /*******************************************************************************
2271 *
2272 * Function btm_read_failed_contact_counter_timeout
2273 *
2274 * Description Callback when reading the failed contact counter times out.
2275 *
2276 * Returns void
2277 *
2278 ******************************************************************************/
btm_read_failed_contact_counter_timeout(UNUSED_ATTR void * data)2279 void btm_read_failed_contact_counter_timeout(UNUSED_ATTR void* data) {
2280 tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2281 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2282 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2283 result.status = BTM_DEVICE_TIMEOUT;
2284 if (p_cb) (*p_cb)(&result);
2285 }
2286
2287 /*******************************************************************************
2288 *
2289 * Function btm_read_failed_contact_counter_complete
2290 *
2291 * Description This function is called when the command complete message
2292 * is received from the HCI for the read failed contact
2293 * counter request.
2294 *
2295 * Returns void
2296 *
2297 ******************************************************************************/
btm_read_failed_contact_counter_complete(uint8_t * p)2298 void btm_read_failed_contact_counter_complete(uint8_t* p) {
2299 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2300 tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2301 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2302
2303 BTM_TRACE_DEBUG("%s", __func__);
2304 alarm_cancel(btm_cb.devcb.read_failed_contact_counter_timer);
2305 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2306
2307 /* If there was a registered callback, call it */
2308 if (p_cb) {
2309 uint16_t handle;
2310 STREAM_TO_UINT8(result.hci_status, p);
2311
2312 if (result.hci_status == HCI_SUCCESS) {
2313 result.status = BTM_SUCCESS;
2314
2315 STREAM_TO_UINT16(handle, p);
2316
2317 STREAM_TO_UINT16(result.failed_contact_counter, p);
2318 BTM_TRACE_DEBUG(
2319 "BTM Failed Contact Counter Complete: counter %u, hci status 0x%02x",
2320 result.failed_contact_counter, result.hci_status);
2321
2322 /* Search through the list of active channels for the correct BD Addr */
2323 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2324 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2325 result.rem_bda = p_acl_cb->remote_addr;
2326 break;
2327 }
2328 }
2329 } else {
2330 result.status = BTM_ERR_PROCESSING;
2331 }
2332
2333 (*p_cb)(&result);
2334 }
2335 }
2336
2337 /*******************************************************************************
2338 *
2339 * Function btm_read_automatic_flush_timeout_timeout
2340 *
2341 * Description Callback when reading the automatic flush timeout times out.
2342 *
2343 * Returns void
2344 *
2345 ******************************************************************************/
btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void * data)2346 void btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void* data) {
2347 tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2348 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2349 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2350 result.status = BTM_DEVICE_TIMEOUT;
2351 if (p_cb) (*p_cb)(&result);
2352 }
2353
2354 /*******************************************************************************
2355 *
2356 * Function btm_read_automatic_flush_timeout_complete
2357 *
2358 * Description This function is called when the command complete message
2359 * is received from the HCI for the read automatic flush
2360 * timeout request.
2361 *
2362 * Returns void
2363 *
2364 ******************************************************************************/
btm_read_automatic_flush_timeout_complete(uint8_t * p)2365 void btm_read_automatic_flush_timeout_complete(uint8_t* p) {
2366 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2367 tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2368 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2369
2370 BTM_TRACE_DEBUG("%s", __func__);
2371 alarm_cancel(btm_cb.devcb.read_automatic_flush_timeout_timer);
2372 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2373
2374 /* If there was a registered callback, call it */
2375 if (p_cb) {
2376 uint16_t handle;
2377 STREAM_TO_UINT8(result.hci_status, p);
2378
2379 if (result.hci_status == HCI_SUCCESS) {
2380 result.status = BTM_SUCCESS;
2381
2382 STREAM_TO_UINT16(handle, p);
2383
2384 STREAM_TO_UINT16(result.automatic_flush_timeout, p);
2385 BTM_TRACE_DEBUG(
2386 "BTM Automatic Flush Timeout Complete: timeout %u, hci status 0x%02x",
2387 result.automatic_flush_timeout, result.hci_status);
2388
2389 /* Search through the list of active channels for the correct BD Addr */
2390 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2391 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2392 result.rem_bda = p_acl_cb->remote_addr;
2393 break;
2394 }
2395 }
2396 } else {
2397 result.status = BTM_ERR_PROCESSING;
2398 }
2399
2400 (*p_cb)(&result);
2401 }
2402 }
2403
2404 /*******************************************************************************
2405 *
2406 * Function btm_read_link_quality_timeout
2407 *
2408 * Description Callback when reading the link quality times out.
2409 *
2410 * Returns void
2411 *
2412 ******************************************************************************/
btm_read_link_quality_timeout(UNUSED_ATTR void * data)2413 void btm_read_link_quality_timeout(UNUSED_ATTR void* data) {
2414 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2415 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2416 if (p_cb) (*p_cb)((void*)NULL);
2417 }
2418
2419 /*******************************************************************************
2420 *
2421 * Function btm_read_link_quality_complete
2422 *
2423 * Description This function is called when the command complete message
2424 * is received from the HCI for the read link quality.
2425 *
2426 * Returns void
2427 *
2428 ******************************************************************************/
btm_read_link_quality_complete(uint8_t * p)2429 void btm_read_link_quality_complete(uint8_t* p) {
2430 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2431 tBTM_LINK_QUALITY_RESULT result;
2432 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2433
2434 BTM_TRACE_DEBUG("%s", __func__);
2435 alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2436 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2437
2438 /* If there was a registered callback, call it */
2439 if (p_cb) {
2440 STREAM_TO_UINT8(result.hci_status, p);
2441
2442 if (result.hci_status == HCI_SUCCESS) {
2443 uint16_t handle;
2444 result.status = BTM_SUCCESS;
2445
2446 STREAM_TO_UINT16(handle, p);
2447
2448 STREAM_TO_UINT8(result.link_quality, p);
2449 BTM_TRACE_DEBUG(
2450 "BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2451 result.link_quality, result.hci_status);
2452
2453 /* Search through the list of active channels for the correct BD Addr */
2454 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2455 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2456 result.rem_bda = p_acl_cb->remote_addr;
2457 break;
2458 }
2459 }
2460 } else {
2461 result.status = BTM_ERR_PROCESSING;
2462 }
2463
2464 (*p_cb)(&result);
2465 }
2466 }
2467
2468 /*******************************************************************************
2469 *
2470 * Function btm_remove_acl
2471 *
2472 * Description This function is called to disconnect an ACL connection
2473 *
2474 * Returns BTM_SUCCESS if successfully initiated, otherwise
2475 * BTM_NO_RESOURCES.
2476 *
2477 ******************************************************************************/
btm_remove_acl(const RawAddress & bd_addr,tBT_TRANSPORT transport)2478 tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr, tBT_TRANSPORT transport) {
2479 uint16_t hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2480 tBTM_STATUS status = BTM_SUCCESS;
2481
2482 BTM_TRACE_DEBUG("btm_remove_acl");
2483 #if (BTM_DISC_DURING_RS == TRUE)
2484 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
2485
2486 /* Role Switch is pending, postpone until completed */
2487 if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING)) {
2488 p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2489 } else /* otherwise can disconnect right away */
2490 #endif
2491 {
2492 if (hci_handle != 0xFFFF && p_dev_rec &&
2493 p_dev_rec->sec_state != BTM_SEC_STATE_DISCONNECTING) {
2494 btsnd_hcic_disconnect(hci_handle, HCI_ERR_PEER_USER);
2495 } else {
2496 status = BTM_UNKNOWN_ADDR;
2497 }
2498 }
2499
2500 return status;
2501 }
2502
2503 /*******************************************************************************
2504 *
2505 * Function BTM_SetTraceLevel
2506 *
2507 * Description This function sets the trace level for BTM. If called with
2508 * a value of 0xFF, it simply returns the current trace level.
2509 *
2510 * Returns The new or current trace level
2511 *
2512 ******************************************************************************/
BTM_SetTraceLevel(uint8_t new_level)2513 uint8_t BTM_SetTraceLevel(uint8_t new_level) {
2514 BTM_TRACE_DEBUG("BTM_SetTraceLevel");
2515 if (new_level != 0xFF) btm_cb.trace_level = new_level;
2516
2517 return (btm_cb.trace_level);
2518 }
2519
2520 /*******************************************************************************
2521 *
2522 * Function btm_cont_rswitch
2523 *
2524 * Description This function is called to continue processing an active
2525 * role switch. It first disables encryption if enabled and
2526 * EPR is not supported
2527 *
2528 * Returns void
2529 *
2530 ******************************************************************************/
btm_cont_rswitch(tACL_CONN * p,tBTM_SEC_DEV_REC * p_dev_rec,uint8_t hci_status)2531 void btm_cont_rswitch(tACL_CONN* p, tBTM_SEC_DEV_REC* p_dev_rec,
2532 uint8_t hci_status) {
2533 BTM_TRACE_DEBUG("btm_cont_rswitch");
2534 /* Check to see if encryption needs to be turned off if pending
2535 change of link key or role switch */
2536 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2537 /* Must turn off Encryption first if necessary */
2538 /* Some devices do not support switch or change of link key while encryption
2539 * is on */
2540 if (p_dev_rec != NULL &&
2541 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
2542 !BTM_EPR_AVAILABLE(p)) {
2543 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
2544 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2545 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2546 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2547 } else /* Encryption not used or EPR supported, continue with switch
2548 and/or change of link key */
2549 {
2550 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2551 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2552 #if (BTM_DISC_DURING_RS == TRUE)
2553 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2554 #endif
2555 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
2556 }
2557 }
2558 }
2559 }
2560
2561 /*******************************************************************************
2562 *
2563 * Function btm_acl_resubmit_page
2564 *
2565 * Description send pending page request
2566 *
2567 ******************************************************************************/
btm_acl_resubmit_page(void)2568 void btm_acl_resubmit_page(void) {
2569 tBTM_SEC_DEV_REC* p_dev_rec;
2570 BT_HDR* p_buf;
2571 uint8_t* pp;
2572 BTM_TRACE_DEBUG("btm_acl_resubmit_page");
2573 /* If there were other page request schedule can start the next one */
2574 p_buf = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue);
2575 if (p_buf != NULL) {
2576 /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2577 * for both create_conn and rmt_name */
2578 pp = (uint8_t*)(p_buf + 1) + p_buf->offset + 3;
2579
2580 RawAddress bda;
2581 STREAM_TO_BDADDR(bda, pp);
2582
2583 p_dev_rec = btm_find_or_alloc_dev(bda);
2584
2585 btm_cb.connecting_bda = p_dev_rec->bd_addr;
2586 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2587
2588 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2589 } else {
2590 btm_cb.paging = false;
2591 }
2592 }
2593
2594 /*******************************************************************************
2595 *
2596 * Function btm_acl_reset_paging
2597 *
2598 * Description set paging to false and free the page queue - called at
2599 * hci_reset
2600 *
2601 ******************************************************************************/
btm_acl_reset_paging(void)2602 void btm_acl_reset_paging(void) {
2603 BT_HDR* p;
2604 BTM_TRACE_DEBUG("btm_acl_reset_paging");
2605 /* If we sent reset we are definitely not paging any more */
2606 while ((p = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2607 osi_free(p);
2608
2609 btm_cb.paging = false;
2610 }
2611
2612 /*******************************************************************************
2613 *
2614 * Function btm_acl_paging
2615 *
2616 * Description send a paging command or queue it in btm_cb
2617 *
2618 ******************************************************************************/
btm_acl_paging(BT_HDR * p,const RawAddress & bda)2619 void btm_acl_paging(BT_HDR* p, const RawAddress& bda) {
2620 tBTM_SEC_DEV_REC* p_dev_rec;
2621
2622 VLOG(2) << __func__ << ":" << btm_cb.discing << " , paging:" << btm_cb.paging
2623 << " BDA: " << bda;
2624
2625 if (btm_cb.discing) {
2626 btm_cb.paging = true;
2627 fixed_queue_enqueue(btm_cb.page_queue, p);
2628 } else {
2629 if (!BTM_ACL_IS_CONNECTED(bda)) {
2630 VLOG(1) << "connecting_bda: " << btm_cb.connecting_bda;
2631 if (btm_cb.paging && bda != btm_cb.connecting_bda) {
2632 fixed_queue_enqueue(btm_cb.page_queue, p);
2633 } else {
2634 p_dev_rec = btm_find_or_alloc_dev(bda);
2635 btm_cb.connecting_bda = p_dev_rec->bd_addr;
2636 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2637
2638 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2639 }
2640
2641 btm_cb.paging = true;
2642 } else /* ACL is already up */
2643 {
2644 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2645 }
2646 }
2647 }
2648
2649 /*******************************************************************************
2650 *
2651 * Function btm_acl_notif_conn_collision
2652 *
2653 * Description Send connection collision event to upper layer if registered
2654 *
2655 * Returns true if sent out to upper layer,
2656 * false if no one needs the notification.
2657 *
2658 ******************************************************************************/
btm_acl_notif_conn_collision(const RawAddress & bda)2659 bool btm_acl_notif_conn_collision(const RawAddress& bda) {
2660 /* Report possible collision to the upper layer. */
2661 if (btm_cb.p_bl_changed_cb) {
2662 VLOG(1) << __func__ << " RemBdAddr: " << bda;
2663
2664 tBTM_BL_EVENT_DATA evt_data;
2665 evt_data.event = BTM_BL_COLLISION_EVT;
2666 evt_data.conn.p_bda = &bda;
2667 evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2668 evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2669 (*btm_cb.p_bl_changed_cb)(&evt_data);
2670 return true;
2671 } else {
2672 return false;
2673 }
2674 }
2675
2676 /*******************************************************************************
2677 *
2678 * Function btm_acl_chk_peer_pkt_type_support
2679 *
2680 * Description Check if peer supports requested packets
2681 *
2682 ******************************************************************************/
btm_acl_chk_peer_pkt_type_support(tACL_CONN * p,uint16_t * p_pkt_type)2683 void btm_acl_chk_peer_pkt_type_support(tACL_CONN* p, uint16_t* p_pkt_type) {
2684 /* 3 and 5 slot packets? */
2685 if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2686 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 + BTM_ACL_PKT_TYPES_MASK_DM3);
2687
2688 if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2689 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2690
2691 /* 2 and 3 MPS support? */
2692 if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2693 /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2694 *p_pkt_type |=
2695 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2696 BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2697
2698 if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2699 /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2700 *p_pkt_type |=
2701 (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2702 BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2703
2704 /* EDR 3 and 5 slot support? */
2705 if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]) ||
2706 HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0])) {
2707 if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2708 /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types
2709 */
2710 *p_pkt_type |=
2711 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2712
2713 if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2714 /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types
2715 */
2716 *p_pkt_type |=
2717 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2718 }
2719 }
2720