• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /******************************************************************************
2  *
3  *  Copyright 2000-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /*****************************************************************************
20  *
21  *  Name:          btm_acl.cc
22  *
23  *  Description:   This file contains functions that handle ACL connections.
24  *                 This includes operations such as hold and sniff modes,
25  *                 supported packet types.
26  *
27  *                 This module contains both internal and external (API)
28  *                 functions. External (API) functions are distinguishable
29  *                 by their names beginning with uppercase BTM.
30  *
31  *
32  *****************************************************************************/
33 
34 #define LOG_TAG "btm_acl"
35 
36 #include <stddef.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40 
41 #include "bt_common.h"
42 #include "bt_target.h"
43 #include "bt_types.h"
44 #include "bt_utils.h"
45 #include "btm_api.h"
46 #include "btm_int.h"
47 #include "btu.h"
48 #include "common/metrics.h"
49 #include "device/include/controller.h"
50 #include "device/include/interop.h"
51 #include "hcidefs.h"
52 #include "hcimsgs.h"
53 #include "l2c_int.h"
54 #include "osi/include/log.h"
55 #include "osi/include/osi.h"
56 
57 static void btm_read_remote_features(uint16_t handle);
58 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
59 static void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
60                                             uint8_t num_read_pages);
61 
62 /* 3 seconds timeout waiting for responses */
63 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
64 
65 /*******************************************************************************
66  *
67  * Function         btm_acl_init
68  *
69  * Description      This function is called at BTM startup to initialize
70  *
71  * Returns          void
72  *
73  ******************************************************************************/
btm_acl_init(void)74 void btm_acl_init(void) {
75   BTM_TRACE_DEBUG("btm_acl_init");
76   /* Initialize nonzero defaults */
77   btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
78   btm_cb.acl_disc_reason = 0xff;
79 }
80 
81 /*******************************************************************************
82  *
83  * Function        btm_bda_to_acl
84  *
85  * Description     This function returns the FIRST acl_db entry for the passed
86  *                 BDA.
87  *
88  * Parameters      bda : BD address of the remote device
89  *                 transport : Physical transport used for ACL connection
90  *                 (BR/EDR or LE)
91  *
92  * Returns         Returns pointer to the ACL DB for the requested BDA if found.
93  *                 NULL if not found.
94  *
95  ******************************************************************************/
btm_bda_to_acl(const RawAddress & bda,tBT_TRANSPORT transport)96 tACL_CONN* btm_bda_to_acl(const RawAddress& bda, tBT_TRANSPORT transport) {
97   tACL_CONN* p = &btm_cb.acl_db[0];
98   uint16_t xx;
99   for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
100     if ((p->in_use) && p->remote_addr == bda && p->transport == transport) {
101       BTM_TRACE_DEBUG("btm_bda_to_acl found");
102       return (p);
103     }
104   }
105 
106   /* If here, no BD Addr found */
107   return ((tACL_CONN*)NULL);
108 }
109 
110 /*******************************************************************************
111  *
112  * Function         btm_handle_to_acl_index
113  *
114  * Description      This function returns the FIRST acl_db entry for the passed
115  *                  hci_handle.
116  *
117  * Returns          index to the acl_db or MAX_L2CAP_LINKS.
118  *
119  ******************************************************************************/
btm_handle_to_acl_index(uint16_t hci_handle)120 uint8_t btm_handle_to_acl_index(uint16_t hci_handle) {
121   tACL_CONN* p = &btm_cb.acl_db[0];
122   uint8_t xx;
123   BTM_TRACE_DEBUG("btm_handle_to_acl_index");
124   for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
125     if ((p->in_use) && (p->hci_handle == hci_handle)) {
126       break;
127     }
128   }
129 
130   /* If here, no BD Addr found */
131   return (xx);
132 }
133 
134 #if (BLE_PRIVACY_SPT == TRUE)
135 /*******************************************************************************
136  *
137  * Function         btm_ble_get_acl_remote_addr
138  *
139  * Description      This function reads the active remote address used for the
140  *                  connection.
141  *
142  * Returns          success return true, otherwise false.
143  *
144  ******************************************************************************/
btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC * p_dev_rec,RawAddress & conn_addr,tBLE_ADDR_TYPE * p_addr_type)145 bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec,
146                                  RawAddress& conn_addr,
147                                  tBLE_ADDR_TYPE* p_addr_type) {
148   bool st = true;
149 
150   if (p_dev_rec == NULL) {
151     BTM_TRACE_ERROR("%s can not find device with matching address", __func__);
152     return false;
153   }
154 
155   switch (p_dev_rec->ble.active_addr_type) {
156     case BTM_BLE_ADDR_PSEUDO:
157       conn_addr = p_dev_rec->bd_addr;
158       *p_addr_type = p_dev_rec->ble.ble_addr_type;
159       break;
160 
161     case BTM_BLE_ADDR_RRA:
162       conn_addr = p_dev_rec->ble.cur_rand_addr;
163       *p_addr_type = BLE_ADDR_RANDOM;
164       break;
165 
166     case BTM_BLE_ADDR_STATIC:
167       conn_addr = p_dev_rec->ble.identity_addr;
168       *p_addr_type = p_dev_rec->ble.identity_addr_type;
169       break;
170 
171     default:
172       BTM_TRACE_ERROR("Unknown active address: %d",
173                       p_dev_rec->ble.active_addr_type);
174       st = false;
175       break;
176   }
177 
178   return st;
179 }
180 #endif
181 /*******************************************************************************
182  *
183  * Function         btm_acl_created
184  *
185  * Description      This function is called by L2CAP when an ACL connection
186  *                  is created.
187  *
188  * Returns          void
189  *
190  ******************************************************************************/
btm_acl_created(const RawAddress & bda,DEV_CLASS dc,BD_NAME bdn,uint16_t hci_handle,uint8_t link_role,tBT_TRANSPORT transport)191 void btm_acl_created(const RawAddress& bda, DEV_CLASS dc, BD_NAME bdn,
192                      uint16_t hci_handle, uint8_t link_role,
193                      tBT_TRANSPORT transport) {
194   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
195   tACL_CONN* p;
196   uint8_t xx;
197 
198   BTM_TRACE_DEBUG("%s: peer %s hci_handle=%d link_role=%d  transport=%d",
199                   __func__, bda.ToString().c_str(), hci_handle, link_role,
200                   transport);
201   /* Ensure we don't have duplicates */
202   p = btm_bda_to_acl(bda, transport);
203   if (p != (tACL_CONN*)NULL) {
204     p->hci_handle = hci_handle;
205     p->link_role = link_role;
206     p->transport = transport;
207     VLOG(1) << "Duplicate btm_acl_created: RemBdAddr: " << bda;
208     BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
209     return;
210   }
211 
212   /* Allocate acl_db entry */
213   for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++) {
214     if (!p->in_use) {
215       p->in_use = true;
216       p->hci_handle = hci_handle;
217       p->link_role = link_role;
218       p->link_up_issued = false;
219       p->remote_addr = bda;
220 
221       p->transport = transport;
222 #if (BLE_PRIVACY_SPT == TRUE)
223       if (transport == BT_TRANSPORT_LE)
224         btm_ble_refresh_local_resolvable_private_addr(
225             bda, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
226 #else
227       p->conn_addr_type = BLE_ADDR_PUBLIC;
228       p->conn_addr = *controller_get_interface()->get_address();
229 
230 #endif
231       p->switch_role_failed_attempts = 0;
232       p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
233 
234       btm_pm_sm_alloc(xx);
235 
236       if (dc) memcpy(p->remote_dc, dc, DEV_CLASS_LEN);
237 
238       if (bdn) memcpy(p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
239 
240       /* if BR/EDR do something more */
241       if (transport == BT_TRANSPORT_BR_EDR) {
242         btsnd_hcic_read_rmt_clk_offset(p->hci_handle);
243         btsnd_hcic_rmt_ver_req(p->hci_handle);
244       }
245       p_dev_rec = btm_find_dev_by_handle(hci_handle);
246 
247       if (p_dev_rec) {
248         BTM_TRACE_DEBUG("%s: peer %s device_type=0x%x", __func__,
249                         bda.ToString().c_str(), p_dev_rec->device_type);
250       }
251 
252       if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
253         /* If remote features already known, copy them and continue connection
254          * setup */
255         if ((p_dev_rec->num_read_pages) &&
256             (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
257           memcpy(p->peer_lmp_feature_pages, p_dev_rec->feature_pages,
258                  (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
259           p->num_read_pages = p_dev_rec->num_read_pages;
260 
261           const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
262 
263           /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
264           btm_sec_set_peer_sec_caps(p, p_dev_rec);
265 
266           BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
267           if (req_pend) {
268             /* Request for remaining Security Features (if any) */
269             l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
270           }
271           btm_establish_continue(p);
272           return;
273         }
274       }
275 
276       /* If here, features are not known yet */
277       if (p_dev_rec && transport == BT_TRANSPORT_LE) {
278 #if (BLE_PRIVACY_SPT == TRUE)
279         btm_ble_get_acl_remote_addr(p_dev_rec, p->active_remote_addr,
280                                     &p->active_remote_addr_type);
281 #endif
282 
283         if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(
284                 controller_get_interface()->get_features_ble()->as_array) ||
285             link_role == HCI_ROLE_MASTER) {
286           btsnd_hcic_ble_read_remote_feat(p->hci_handle);
287         } else {
288           btm_establish_continue(p);
289         }
290       }
291 
292       /* read page 1 - on rmt feature event for buffer reasons */
293       return;
294     }
295   }
296 }
297 
btm_acl_update_conn_addr(uint16_t conn_handle,const RawAddress & address)298 void btm_acl_update_conn_addr(uint16_t conn_handle, const RawAddress& address) {
299   uint8_t idx = btm_handle_to_acl_index(conn_handle);
300   if (idx != MAX_L2CAP_LINKS) {
301     btm_cb.acl_db[idx].conn_addr = address;
302   }
303 }
304 
305 /*******************************************************************************
306  *
307  * Function         btm_acl_report_role_change
308  *
309  * Description      This function is called when the local device is deemed
310  *                  to be down. It notifies L2CAP of the failure.
311  *
312  * Returns          void
313  *
314  ******************************************************************************/
btm_acl_report_role_change(uint8_t hci_status,const RawAddress * bda)315 void btm_acl_report_role_change(uint8_t hci_status, const RawAddress* bda) {
316   tBTM_ROLE_SWITCH_CMPL ref_data;
317   BTM_TRACE_DEBUG("btm_acl_report_role_change");
318   if (btm_cb.devcb.p_switch_role_cb &&
319       (bda && btm_cb.devcb.switch_role_ref_data.remote_bd_addr == *bda)) {
320     memcpy(&ref_data, &btm_cb.devcb.switch_role_ref_data,
321            sizeof(tBTM_ROLE_SWITCH_CMPL));
322     ref_data.hci_status = hci_status;
323     (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
324     memset(&btm_cb.devcb.switch_role_ref_data, 0,
325            sizeof(tBTM_ROLE_SWITCH_CMPL));
326     btm_cb.devcb.p_switch_role_cb = NULL;
327   }
328 }
329 
330 /*******************************************************************************
331  *
332  * Function         btm_acl_removed
333  *
334  * Description      This function is called by L2CAP when an ACL connection
335  *                  is removed. Since only L2CAP creates ACL links, we use
336  *                  the L2CAP link index as our index into the control blocks.
337  *
338  * Returns          void
339  *
340  ******************************************************************************/
btm_acl_removed(const RawAddress & bda,tBT_TRANSPORT transport)341 void btm_acl_removed(const RawAddress& bda, tBT_TRANSPORT transport) {
342   tACL_CONN* p;
343   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
344   BTM_TRACE_DEBUG("btm_acl_removed");
345   p = btm_bda_to_acl(bda, transport);
346   if (p != (tACL_CONN*)NULL) {
347     p->in_use = false;
348 
349     /* if the disconnected channel has a pending role switch, clear it now */
350     btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, &bda);
351 
352     /* Only notify if link up has had a chance to be issued */
353     if (p->link_up_issued) {
354       p->link_up_issued = false;
355 
356       /* If anyone cares, indicate the database changed */
357       if (btm_cb.p_bl_changed_cb) {
358         tBTM_BL_EVENT_DATA evt_data;
359         evt_data.event = BTM_BL_DISCN_EVT;
360         evt_data.discn.p_bda = &bda;
361         evt_data.discn.handle = p->hci_handle;
362         evt_data.discn.transport = p->transport;
363         (*btm_cb.p_bl_changed_cb)(&evt_data);
364       }
365 
366       btm_acl_update_busy_level(BTM_BLI_ACL_DOWN_EVT);
367     }
368 
369     BTM_TRACE_DEBUG(
370         "acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
371         p->hci_handle, p->transport, btm_cb.ble_ctr_cb.inq_var.connectable_mode,
372         p->link_role);
373 
374     p_dev_rec = btm_find_dev(bda);
375     if (p_dev_rec) {
376       BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x",
377                       p_dev_rec->sec_flags);
378       if (p->transport == BT_TRANSPORT_LE) {
379         BTM_TRACE_DEBUG("LE link down");
380         p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
381         if ((p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0) {
382           BTM_TRACE_DEBUG("Not Bonded");
383           p_dev_rec->sec_flags &=
384               ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
385         } else {
386           BTM_TRACE_DEBUG("Bonded");
387         }
388       } else {
389         BTM_TRACE_DEBUG("Bletooth link down");
390         p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED |
391                                   BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
392       }
393       BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x",
394                       p_dev_rec->sec_flags);
395     } else {
396       BTM_TRACE_ERROR("Device not found");
397     }
398 
399     /* Clear the ACL connection data */
400     memset(p, 0, sizeof(tACL_CONN));
401   }
402 }
403 
404 /*******************************************************************************
405  *
406  * Function         btm_acl_device_down
407  *
408  * Description      This function is called when the local device is deemed
409  *                  to be down. It notifies L2CAP of the failure.
410  *
411  * Returns          void
412  *
413  ******************************************************************************/
btm_acl_device_down(void)414 void btm_acl_device_down(void) {
415   tACL_CONN* p = &btm_cb.acl_db[0];
416   uint16_t xx;
417   BTM_TRACE_DEBUG("btm_acl_device_down");
418   for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
419     if (p->in_use) {
420       BTM_TRACE_DEBUG("hci_handle=%d HCI_ERR_HW_FAILURE ", p->hci_handle);
421       l2c_link_hci_disc_comp(p->hci_handle, HCI_ERR_HW_FAILURE);
422     }
423   }
424 }
425 
426 /*******************************************************************************
427  *
428  * Function         btm_acl_update_busy_level
429  *
430  * Description      This function is called to update the busy level of the
431  *                  system.
432  *
433  * Returns          void
434  *
435  ******************************************************************************/
btm_acl_update_busy_level(tBTM_BLI_EVENT event)436 void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
437   bool old_inquiry_state = btm_cb.is_inquiry;
438   tBTM_BL_UPDATE_DATA evt;
439   evt.busy_level_flags = 0;
440   switch (event) {
441     case BTM_BLI_ACL_UP_EVT:
442       BTM_TRACE_DEBUG("BTM_BLI_ACL_UP_EVT");
443       break;
444     case BTM_BLI_ACL_DOWN_EVT:
445       BTM_TRACE_DEBUG("BTM_BLI_ACL_DOWN_EVT");
446       break;
447     case BTM_BLI_PAGE_EVT:
448       BTM_TRACE_DEBUG("BTM_BLI_PAGE_EVT");
449       btm_cb.is_paging = true;
450       evt.busy_level_flags = BTM_BL_PAGING_STARTED;
451       break;
452     case BTM_BLI_PAGE_DONE_EVT:
453       BTM_TRACE_DEBUG("BTM_BLI_PAGE_DONE_EVT");
454       btm_cb.is_paging = false;
455       evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
456       break;
457     case BTM_BLI_INQ_EVT:
458       BTM_TRACE_DEBUG("BTM_BLI_INQ_EVT");
459       btm_cb.is_inquiry = true;
460       evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
461       break;
462     case BTM_BLI_INQ_CANCEL_EVT:
463       BTM_TRACE_DEBUG("BTM_BLI_INQ_CANCEL_EVT");
464       btm_cb.is_inquiry = false;
465       evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
466       break;
467     case BTM_BLI_INQ_DONE_EVT:
468       BTM_TRACE_DEBUG("BTM_BLI_INQ_DONE_EVT");
469       btm_cb.is_inquiry = false;
470       evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
471       break;
472   }
473 
474   uint8_t busy_level;
475   if (btm_cb.is_paging || btm_cb.is_inquiry)
476     busy_level = 10;
477   else
478     busy_level = BTM_GetNumAclLinks();
479 
480   if ((busy_level != btm_cb.busy_level) ||
481       (old_inquiry_state != btm_cb.is_inquiry)) {
482     evt.event = BTM_BL_UPDATE_EVT;
483     evt.busy_level = busy_level;
484     btm_cb.busy_level = busy_level;
485     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
486       tBTM_BL_EVENT_DATA btm_bl_event_data;
487       btm_bl_event_data.update = evt;
488       (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
489     }
490   }
491 }
492 
493 /*******************************************************************************
494  *
495  * Function         BTM_GetRole
496  *
497  * Description      This function is called to get the role of the local device
498  *                  for the ACL connection with the specified remote device
499  *
500  * Returns          BTM_SUCCESS if connection exists.
501  *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
502  *
503  ******************************************************************************/
BTM_GetRole(const RawAddress & remote_bd_addr,uint8_t * p_role)504 tBTM_STATUS BTM_GetRole(const RawAddress& remote_bd_addr, uint8_t* p_role) {
505   tACL_CONN* p;
506   BTM_TRACE_DEBUG("BTM_GetRole");
507   p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
508   if (p == NULL) {
509     *p_role = BTM_ROLE_UNDEFINED;
510     return (BTM_UNKNOWN_ADDR);
511   }
512 
513   /* Get the current role */
514   *p_role = p->link_role;
515   return (BTM_SUCCESS);
516 }
517 
518 /*******************************************************************************
519  *
520  * Function         BTM_SwitchRole
521  *
522  * Description      This function is called to switch role between master and
523  *                  slave.  If role is already set it will do nothing.  If the
524  *                  command was initiated, the callback function is called upon
525  *                  completion.
526  *
527  * Returns          BTM_SUCCESS if already in specified role.
528  *                  BTM_CMD_STARTED if command issued to controller.
529  *                  BTM_NO_RESOURCES if couldn't allocate memory to issue
530  *                                   command
531  *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
532  *                  BTM_MODE_UNSUPPORTED if local device does not support role
533  *                                       switching
534  *                  BTM_BUSY if the previous command is not completed
535  *
536  ******************************************************************************/
BTM_SwitchRole(const RawAddress & remote_bd_addr,uint8_t new_role,tBTM_CMPL_CB * p_cb)537 tBTM_STATUS BTM_SwitchRole(const RawAddress& remote_bd_addr, uint8_t new_role,
538                            tBTM_CMPL_CB* p_cb) {
539   tACL_CONN* p;
540   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
541   bool is_sco_active;
542   tBTM_STATUS status;
543   tBTM_PM_MODE pwr_mode;
544   tBTM_PM_PWR_MD settings;
545 
546   LOG_INFO(LOG_TAG, "%s: peer %s new_role=0x%x p_cb=%p p_switch_role_cb=%p",
547            __func__, remote_bd_addr.ToString().c_str(), new_role, p_cb,
548            btm_cb.devcb.p_switch_role_cb);
549 
550   /* Make sure the local device supports switching */
551   if (!controller_get_interface()->supports_master_slave_role_switch())
552     return (BTM_MODE_UNSUPPORTED);
553 
554   if (btm_cb.devcb.p_switch_role_cb && p_cb) {
555     VLOG(2) << "Role switch on other device is in progress "
556             << btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
557     return (BTM_BUSY);
558   }
559 
560   p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
561   if (p == NULL) return (BTM_UNKNOWN_ADDR);
562 
563   /* Finished if already in desired role */
564   if (p->link_role == new_role) return (BTM_SUCCESS);
565 
566   if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH, &remote_bd_addr))
567     return BTM_DEV_BLACKLISTED;
568 
569   /* Check if there is any SCO Active on this BD Address */
570   is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
571 
572   if (is_sco_active) return (BTM_NO_RESOURCES);
573 
574   /* Ignore role switch request if the previous request was not completed */
575   if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE) {
576     BTM_TRACE_DEBUG("BTM_SwitchRole busy: %d", p->switch_role_state);
577     return (BTM_BUSY);
578   }
579 
580   if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &remote_bd_addr)) {
581     BTM_TRACE_DEBUG("%s, Device blacklisted under INTEROP_DYNAMIC_ROLE_SWITCH.",
582                     __func__);
583     return BTM_DEV_BLACKLISTED;
584   }
585 
586   status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode);
587   if (status != BTM_SUCCESS) return (status);
588 
589   /* Wake up the link if in sniff or park before attempting switch */
590   if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF) {
591     memset((void*)&settings, 0, sizeof(settings));
592     settings.mode = BTM_PM_MD_ACTIVE;
593     status = BTM_SetPowerMode(BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
594     if (status != BTM_CMD_STARTED) return (BTM_WRONG_MODE);
595 
596     p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
597   }
598   /* some devices do not support switch while encryption is on */
599   else {
600     p_dev_rec = btm_find_dev(remote_bd_addr);
601     if ((p_dev_rec != NULL) &&
602         ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
603         !BTM_EPR_AVAILABLE(p)) {
604       /* bypass turning off encryption if change link key is already doing it */
605       if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF) {
606         btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
607         p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
608       }
609 
610       p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
611     } else {
612       btsnd_hcic_switch_role(remote_bd_addr, new_role);
613       p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
614 
615 #if (BTM_DISC_DURING_RS == TRUE)
616       if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
617 #endif
618     }
619   }
620 
621   /* Initialize return structure in case request fails */
622   if (p_cb) {
623     btm_cb.devcb.switch_role_ref_data.remote_bd_addr = remote_bd_addr;
624     btm_cb.devcb.switch_role_ref_data.role = new_role;
625     /* initialized to an error code */
626     btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
627     btm_cb.devcb.p_switch_role_cb = p_cb;
628   }
629   return (BTM_CMD_STARTED);
630 }
631 
632 /*******************************************************************************
633  *
634  * Function         btm_acl_encrypt_change
635  *
636  * Description      This function is when encryption of the connection is
637  *                  completed by the LM.  Checks to see if a role switch or
638  *                  change of link key was active and initiates or continues
639  *                  process if needed.
640  *
641  * Returns          void
642  *
643  ******************************************************************************/
btm_acl_encrypt_change(uint16_t handle,uint8_t status,uint8_t encr_enable)644 void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
645                             uint8_t encr_enable) {
646   tACL_CONN* p;
647   uint8_t xx;
648   tBTM_SEC_DEV_REC* p_dev_rec;
649 
650   BTM_TRACE_DEBUG("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
651                   handle, status, encr_enable);
652   xx = btm_handle_to_acl_index(handle);
653   /* don't assume that we can never get a bad hci_handle */
654   if (xx < MAX_L2CAP_LINKS)
655     p = &btm_cb.acl_db[xx];
656   else
657     return;
658 
659   /* Process Role Switch if active */
660   if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF) {
661     /* if encryption turn off failed we still will try to switch role */
662     if (encr_enable) {
663       p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
664       p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
665     } else {
666       p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
667       p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
668     }
669 
670     btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
671 #if (BTM_DISC_DURING_RS == TRUE)
672     p_dev_rec = btm_find_dev(p->remote_addr);
673     if (p_dev_rec != NULL) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
674 #endif
675 
676   }
677   /* Finished enabling Encryption after role switch */
678   else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON) {
679     p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
680     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
681     btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status,
682                                &p->remote_addr);
683 
684     /* if role change event is registered, report it now */
685     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
686       tBTM_BL_ROLE_CHG_DATA evt;
687       evt.event = BTM_BL_ROLE_CHG_EVT;
688       evt.new_role = btm_cb.devcb.switch_role_ref_data.role;
689       evt.p_bda = &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
690       evt.hci_status = btm_cb.devcb.switch_role_ref_data.hci_status;
691       tBTM_BL_EVENT_DATA btm_bl_event_data;
692       btm_bl_event_data.role_chg = evt;
693       (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
694 
695       BTM_TRACE_DEBUG(
696           "%s: Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
697           __func__, evt.new_role, evt.hci_status, p->switch_role_state);
698     }
699 
700 #if (BTM_DISC_DURING_RS == TRUE)
701     /* If a disconnect is pending, issue it now that role switch has completed
702      */
703     p_dev_rec = btm_find_dev(p->remote_addr);
704     if (p_dev_rec != NULL) {
705       if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
706         BTM_TRACE_WARNING(
707             "btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
708         btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
709       }
710       BTM_TRACE_ERROR(
711           "btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
712           PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
713       p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
714     }
715 #endif
716   }
717 }
718 /*******************************************************************************
719  *
720  * Function         BTM_SetLinkPolicy
721  *
722  * Description      Create and send HCI "Write Policy Set" command
723  *
724  * Returns          status of the operation
725  *
726  ******************************************************************************/
BTM_SetLinkPolicy(const RawAddress & remote_bda,uint16_t * settings)727 tBTM_STATUS BTM_SetLinkPolicy(const RawAddress& remote_bda,
728                               uint16_t* settings) {
729   tACL_CONN* p;
730   uint8_t* localFeatures = BTM_ReadLocalFeatures();
731   BTM_TRACE_DEBUG("%s", __func__);
732   /*  BTM_TRACE_API ("%s: requested settings: 0x%04x", __func__, *settings ); */
733 
734   /* First, check if hold mode is supported */
735   if (*settings != HCI_DISABLE_ALL_LM_MODES) {
736     if ((*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
737         (!HCI_SWITCH_SUPPORTED(localFeatures))) {
738       *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
739       BTM_TRACE_API("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)",
740                     *settings);
741     }
742     if ((*settings & HCI_ENABLE_HOLD_MODE) &&
743         (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
744       *settings &= (~HCI_ENABLE_HOLD_MODE);
745       BTM_TRACE_API("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)",
746                     *settings);
747     }
748     if ((*settings & HCI_ENABLE_SNIFF_MODE) &&
749         (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
750       *settings &= (~HCI_ENABLE_SNIFF_MODE);
751       BTM_TRACE_API("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)",
752                     *settings);
753     }
754     if ((*settings & HCI_ENABLE_PARK_MODE) &&
755         (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
756       *settings &= (~HCI_ENABLE_PARK_MODE);
757       BTM_TRACE_API("BTM_SetLinkPolicy park not supported (settings: 0x%04x)",
758                     *settings);
759     }
760   }
761 
762   p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
763   if (p != NULL) {
764     btsnd_hcic_write_policy_set(p->hci_handle, *settings);
765     return BTM_CMD_STARTED;
766   }
767 
768   /* If here, no BD Addr found */
769   return (BTM_UNKNOWN_ADDR);
770 }
771 
772 /*******************************************************************************
773  *
774  * Function         BTM_SetDefaultLinkPolicy
775  *
776  * Description      Set the default value for HCI "Write Policy Set" command
777  *                  to use when an ACL link is created.
778  *
779  * Returns          void
780  *
781  ******************************************************************************/
BTM_SetDefaultLinkPolicy(uint16_t settings)782 void BTM_SetDefaultLinkPolicy(uint16_t settings) {
783   uint8_t* localFeatures = BTM_ReadLocalFeatures();
784 
785   BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
786 
787   if ((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
788       (!HCI_SWITCH_SUPPORTED(localFeatures))) {
789     settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
790     BTM_TRACE_DEBUG(
791         "BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)",
792         settings);
793   }
794   if ((settings & HCI_ENABLE_HOLD_MODE) &&
795       (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
796     settings &= ~HCI_ENABLE_HOLD_MODE;
797     BTM_TRACE_DEBUG(
798         "BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)",
799         settings);
800   }
801   if ((settings & HCI_ENABLE_SNIFF_MODE) &&
802       (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
803     settings &= ~HCI_ENABLE_SNIFF_MODE;
804     BTM_TRACE_DEBUG(
805         "BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)",
806         settings);
807   }
808   if ((settings & HCI_ENABLE_PARK_MODE) &&
809       (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
810     settings &= ~HCI_ENABLE_PARK_MODE;
811     BTM_TRACE_DEBUG(
812         "BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)",
813         settings);
814   }
815   BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
816 
817   btm_cb.btm_def_link_policy = settings;
818 
819   /* Set the default Link Policy of the controller */
820   btsnd_hcic_write_def_policy_set(settings);
821 }
822 
btm_use_preferred_conn_params(const RawAddress & bda)823 void btm_use_preferred_conn_params(const RawAddress& bda) {
824   tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
825   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
826 
827   /* If there are any preferred connection parameters, set them now */
828   if ((p_dev_rec->conn_params.min_conn_int >= BTM_BLE_CONN_INT_MIN) &&
829       (p_dev_rec->conn_params.min_conn_int <= BTM_BLE_CONN_INT_MAX) &&
830       (p_dev_rec->conn_params.max_conn_int >= BTM_BLE_CONN_INT_MIN) &&
831       (p_dev_rec->conn_params.max_conn_int <= BTM_BLE_CONN_INT_MAX) &&
832       (p_dev_rec->conn_params.slave_latency <= BTM_BLE_CONN_LATENCY_MAX) &&
833       (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
834       (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
835       ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
836         p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
837        (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
838        (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
839        (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout))) {
840     BTM_TRACE_DEBUG(
841         "%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d "
842         "supervision_tout=%d",
843         __func__, p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
844         p_dev_rec->conn_params.max_conn_int,
845         p_dev_rec->conn_params.slave_latency,
846         p_dev_rec->conn_params.supervision_tout);
847 
848     p_lcb->min_interval = p_dev_rec->conn_params.min_conn_int;
849     p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
850     p_lcb->timeout = p_dev_rec->conn_params.supervision_tout;
851     p_lcb->latency = p_dev_rec->conn_params.slave_latency;
852 
853     btsnd_hcic_ble_upd_ll_conn_params(
854         p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
855         p_dev_rec->conn_params.max_conn_int,
856         p_dev_rec->conn_params.slave_latency,
857         p_dev_rec->conn_params.supervision_tout, 0, 0);
858   }
859 }
860 
861 /*******************************************************************************
862  *
863  * Function         btm_read_remote_version_complete
864  *
865  * Description      This function is called when the command complete message
866  *                  is received from the HCI for the remote version info.
867  *
868  * Returns          void
869  *
870  ******************************************************************************/
btm_read_remote_version_complete(uint8_t * p)871 void btm_read_remote_version_complete(uint8_t* p) {
872   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
873   uint8_t status;
874   uint16_t handle;
875   int xx;
876   BTM_TRACE_DEBUG("btm_read_remote_version_complete");
877 
878   STREAM_TO_UINT8(status, p);
879   STREAM_TO_UINT16(handle, p);
880 
881   /* Look up the connection by handle and copy features */
882   for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++) {
883     if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle)) {
884       if (status == HCI_SUCCESS) {
885         STREAM_TO_UINT8(p_acl_cb->lmp_version, p);
886         STREAM_TO_UINT16(p_acl_cb->manufacturer, p);
887         STREAM_TO_UINT16(p_acl_cb->lmp_subversion, p);
888 
889         if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
890           btm_read_remote_features(p_acl_cb->hci_handle);
891         }
892         bluetooth::common::LogRemoteVersionInfo(
893             handle, status, p_acl_cb->lmp_version, p_acl_cb->manufacturer,
894             p_acl_cb->lmp_subversion);
895       } else {
896         bluetooth::common::LogRemoteVersionInfo(handle, status, 0, 0, 0);
897       }
898 
899       if (p_acl_cb->transport == BT_TRANSPORT_LE) {
900         l2cble_notify_le_connection(p_acl_cb->remote_addr);
901         btm_use_preferred_conn_params(p_acl_cb->remote_addr);
902       }
903       break;
904     }
905   }
906 }
907 
908 /*******************************************************************************
909  *
910  * Function         btm_process_remote_ext_features
911  *
912  * Description      Local function called to process all extended features pages
913  *                  read from a remote device.
914  *
915  * Returns          void
916  *
917  ******************************************************************************/
btm_process_remote_ext_features(tACL_CONN * p_acl_cb,uint8_t num_read_pages)918 void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
919                                      uint8_t num_read_pages) {
920   uint16_t handle = p_acl_cb->hci_handle;
921   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
922   uint8_t page_idx;
923 
924   BTM_TRACE_DEBUG("btm_process_remote_ext_features");
925 
926   /* Make sure we have the record to save remote features information */
927   if (p_dev_rec == NULL) {
928     /* Get a new device; might be doing dedicated bonding */
929     p_dev_rec = btm_find_or_alloc_dev(p_acl_cb->remote_addr);
930   }
931 
932   p_acl_cb->num_read_pages = num_read_pages;
933   p_dev_rec->num_read_pages = num_read_pages;
934 
935   /* Move the pages to placeholder */
936   for (page_idx = 0; page_idx < num_read_pages; page_idx++) {
937     if (page_idx > HCI_EXT_FEATURES_PAGE_MAX) {
938       BTM_TRACE_ERROR("%s: page=%d unexpected", __func__, page_idx);
939       break;
940     }
941     memcpy(p_dev_rec->feature_pages[page_idx],
942            p_acl_cb->peer_lmp_feature_pages[page_idx],
943            HCI_FEATURE_BYTES_PER_PAGE);
944   }
945 
946   if (!(p_dev_rec->sec_flags & BTM_SEC_NAME_KNOWN) ||
947       p_dev_rec->is_originator) {
948     BTM_TRACE_DEBUG("%s: Calling Next Security Procedure", __func__);
949     uint8_t status = btm_sec_execute_procedure(p_dev_rec);
950     if (status != BTM_CMD_STARTED) {
951       BTM_TRACE_ERROR("%s: Security procedure not started! status %d", __func__,
952                       status);
953       btm_sec_dev_rec_cback_event(p_dev_rec, status, false);
954     }
955   }
956   const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
957 
958   /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
959   btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
960 
961   BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
962   if (req_pend) {
963     /* Request for remaining Security Features (if any) */
964     l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
965   }
966 }
967 
968 /*******************************************************************************
969  *
970  * Function         btm_read_remote_features
971  *
972  * Description      Local function called to send a read remote supported
973  *                  features/remote extended features page[0].
974  *
975  * Returns          void
976  *
977  ******************************************************************************/
btm_read_remote_features(uint16_t handle)978 void btm_read_remote_features(uint16_t handle) {
979   uint8_t acl_idx;
980   tACL_CONN* p_acl_cb;
981 
982   BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
983 
984   acl_idx = btm_handle_to_acl_index(handle);
985   if (acl_idx >= MAX_L2CAP_LINKS) {
986     BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
987     return;
988   }
989 
990   p_acl_cb = &btm_cb.acl_db[acl_idx];
991   p_acl_cb->num_read_pages = 0;
992   memset(p_acl_cb->peer_lmp_feature_pages, 0,
993          sizeof(p_acl_cb->peer_lmp_feature_pages));
994 
995   /* first send read remote supported features HCI command */
996   /* because we don't know whether the remote support extended feature command
997    */
998   btsnd_hcic_rmt_features_req(handle);
999 }
1000 
1001 /*******************************************************************************
1002  *
1003  * Function         btm_read_remote_ext_features
1004  *
1005  * Description      Local function called to send a read remote extended
1006  *                  features
1007  *
1008  * Returns          void
1009  *
1010  ******************************************************************************/
btm_read_remote_ext_features(uint16_t handle,uint8_t page_number)1011 void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number) {
1012   BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle,
1013                   page_number);
1014 
1015   btsnd_hcic_rmt_ext_features(handle, page_number);
1016 }
1017 
1018 /*******************************************************************************
1019  *
1020  * Function         btm_read_remote_features_complete
1021  *
1022  * Description      This function is called when the remote supported features
1023  *                  complete event is received from the HCI.
1024  *
1025  * Returns          void
1026  *
1027  ******************************************************************************/
btm_read_remote_features_complete(uint8_t * p)1028 void btm_read_remote_features_complete(uint8_t* p) {
1029   tACL_CONN* p_acl_cb;
1030   uint8_t status;
1031   uint16_t handle;
1032   uint8_t acl_idx;
1033 
1034   BTM_TRACE_DEBUG("btm_read_remote_features_complete");
1035   STREAM_TO_UINT8(status, p);
1036 
1037   if (status != HCI_SUCCESS) {
1038     BTM_TRACE_ERROR("btm_read_remote_features_complete failed (status 0x%02x)",
1039                     status);
1040     return;
1041   }
1042 
1043   STREAM_TO_UINT16(handle, p);
1044 
1045   acl_idx = btm_handle_to_acl_index(handle);
1046   if (acl_idx >= MAX_L2CAP_LINKS) {
1047     BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid",
1048                     handle);
1049     return;
1050   }
1051 
1052   p_acl_cb = &btm_cb.acl_db[acl_idx];
1053 
1054   /* Copy the received features page */
1055   STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[0], p,
1056                   HCI_FEATURE_BYTES_PER_PAGE);
1057 
1058   if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_feature_pages[0])) &&
1059       (controller_get_interface()
1060            ->supports_reading_remote_extended_features())) {
1061     /* if the remote controller has extended features and local controller
1062        supports HCI_Read_Remote_Extended_Features command then start reading
1063        these feature starting with extended features page 1 */
1064     BTM_TRACE_DEBUG("Start reading remote extended features");
1065     btm_read_remote_ext_features(handle, 1);
1066     return;
1067   }
1068 
1069   /* Remote controller has no extended features. Process remote controller
1070      supported features (features page 0). */
1071   btm_process_remote_ext_features(p_acl_cb, 1);
1072 
1073   /* Continue with HCI connection establishment */
1074   btm_establish_continue(p_acl_cb);
1075 }
1076 
1077 /*******************************************************************************
1078  *
1079  * Function         btm_read_remote_ext_features_complete
1080  *
1081  * Description      This function is called when the remote extended features
1082  *                  complete event is received from the HCI.
1083  *
1084  * Returns          void
1085  *
1086  ******************************************************************************/
btm_read_remote_ext_features_complete(uint8_t * p,uint8_t evt_len)1087 void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
1088   tACL_CONN* p_acl_cb;
1089   uint8_t page_num, max_page;
1090   uint16_t handle;
1091   uint8_t acl_idx;
1092 
1093   BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
1094 
1095   if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
1096     android_errorWriteLog(0x534e4554, "141552859");
1097     BTM_TRACE_ERROR(
1098         "btm_read_remote_ext_features_complete evt length too short. length=%d",
1099         evt_len);
1100     return;
1101   }
1102 
1103   ++p;
1104   STREAM_TO_UINT16(handle, p);
1105   STREAM_TO_UINT8(page_num, p);
1106   STREAM_TO_UINT8(max_page, p);
1107 
1108   /* Validate parameters */
1109   acl_idx = btm_handle_to_acl_index(handle);
1110   if (acl_idx >= MAX_L2CAP_LINKS) {
1111     BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid",
1112                     handle);
1113     return;
1114   }
1115 
1116   if (max_page > HCI_EXT_FEATURES_PAGE_MAX) {
1117     BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown",
1118                     max_page);
1119     return;
1120   }
1121 
1122   if (page_num > HCI_EXT_FEATURES_PAGE_MAX) {
1123     android_errorWriteLog(0x534e4554, "141552859");
1124     BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",
1125                     page_num);
1126     return;
1127   }
1128 
1129   if (page_num > max_page) {
1130     BTM_TRACE_WARNING(
1131         "btm_read_remote_ext_features_complete num_page=%d, max_page=%d "
1132         "invalid", page_num, max_page);
1133   }
1134 
1135   p_acl_cb = &btm_cb.acl_db[acl_idx];
1136 
1137   /* Copy the received features page */
1138   STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[page_num], p,
1139                   HCI_FEATURE_BYTES_PER_PAGE);
1140 
1141   /* If there is the next remote features page and
1142    * we have space to keep this page data - read this page */
1143   if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX)) {
1144     page_num++;
1145     BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)",
1146                     page_num);
1147     btm_read_remote_ext_features(handle, page_num);
1148     return;
1149   }
1150 
1151   /* Reading of remote feature pages is complete */
1152   BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)",
1153                   page_num);
1154 
1155   /* Process the pages */
1156   btm_process_remote_ext_features(p_acl_cb, (uint8_t)(page_num + 1));
1157 
1158   /* Continue with HCI connection establishment */
1159   btm_establish_continue(p_acl_cb);
1160 }
1161 
1162 /*******************************************************************************
1163  *
1164  * Function         btm_read_remote_ext_features_failed
1165  *
1166  * Description      This function is called when the remote extended features
1167  *                  complete event returns a failed status.
1168  *
1169  * Returns          void
1170  *
1171  ******************************************************************************/
btm_read_remote_ext_features_failed(uint8_t status,uint16_t handle)1172 void btm_read_remote_ext_features_failed(uint8_t status, uint16_t handle) {
1173   tACL_CONN* p_acl_cb;
1174   uint8_t acl_idx;
1175 
1176   BTM_TRACE_WARNING(
1177       "btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1178       status, handle);
1179 
1180   acl_idx = btm_handle_to_acl_index(handle);
1181   if (acl_idx >= MAX_L2CAP_LINKS) {
1182     BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid",
1183                     handle);
1184     return;
1185   }
1186 
1187   p_acl_cb = &btm_cb.acl_db[acl_idx];
1188 
1189   /* Process supported features only */
1190   btm_process_remote_ext_features(p_acl_cb, 1);
1191 
1192   /* Continue HCI connection establishment */
1193   btm_establish_continue(p_acl_cb);
1194 }
1195 
1196 /*******************************************************************************
1197  *
1198  * Function         btm_establish_continue
1199  *
1200  * Description      This function is called when the command complete message
1201  *                  is received from the HCI for the read local link policy
1202  *                  request.
1203  *
1204  * Returns          void
1205  *
1206  ******************************************************************************/
btm_establish_continue(tACL_CONN * p_acl_cb)1207 void btm_establish_continue(tACL_CONN* p_acl_cb) {
1208   tBTM_BL_EVENT_DATA evt_data;
1209   BTM_TRACE_DEBUG("btm_establish_continue");
1210 #if (BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1211   if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
1212     /* For now there are a some devices that do not like sending */
1213     /* commands events and data at the same time. */
1214     /* Set the packet types to the default allowed by the device */
1215     btm_set_packet_types(p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1216 
1217     if (btm_cb.btm_def_link_policy)
1218       BTM_SetLinkPolicy(p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1219   }
1220 #endif
1221   if (p_acl_cb->link_up_issued) {
1222     BTM_TRACE_ERROR("%s: Already link is up ", __func__);
1223     return;
1224   }
1225   p_acl_cb->link_up_issued = true;
1226 
1227   /* If anyone cares, tell him database changed */
1228   if (btm_cb.p_bl_changed_cb) {
1229     evt_data.event = BTM_BL_CONN_EVT;
1230     evt_data.conn.p_bda = &p_acl_cb->remote_addr;
1231     evt_data.conn.p_bdn = p_acl_cb->remote_name;
1232     evt_data.conn.p_dc = p_acl_cb->remote_dc;
1233     evt_data.conn.p_features = p_acl_cb->peer_lmp_feature_pages[0];
1234     evt_data.conn.handle = p_acl_cb->hci_handle;
1235     evt_data.conn.transport = p_acl_cb->transport;
1236 
1237     (*btm_cb.p_bl_changed_cb)(&evt_data);
1238   }
1239   btm_acl_update_busy_level(BTM_BLI_ACL_UP_EVT);
1240 }
1241 
1242 /*******************************************************************************
1243  *
1244  * Function         BTM_SetDefaultLinkSuperTout
1245  *
1246  * Description      Set the default value for HCI "Write Link Supervision
1247  *                                                 Timeout"
1248  *                  command to use when an ACL link is created.
1249  *
1250  * Returns          void
1251  *
1252  ******************************************************************************/
BTM_SetDefaultLinkSuperTout(uint16_t timeout)1253 void BTM_SetDefaultLinkSuperTout(uint16_t timeout) {
1254   BTM_TRACE_DEBUG("BTM_SetDefaultLinkSuperTout");
1255   btm_cb.btm_def_link_super_tout = timeout;
1256 }
1257 
1258 /*******************************************************************************
1259  *
1260  * Function         BTM_GetLinkSuperTout
1261  *
1262  * Description      Read the link supervision timeout value of the connection
1263  *
1264  * Returns          status of the operation
1265  *
1266  ******************************************************************************/
BTM_GetLinkSuperTout(const RawAddress & remote_bda,uint16_t * p_timeout)1267 tBTM_STATUS BTM_GetLinkSuperTout(const RawAddress& remote_bda,
1268                                  uint16_t* p_timeout) {
1269   tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1270 
1271   BTM_TRACE_DEBUG("BTM_GetLinkSuperTout");
1272   if (p != (tACL_CONN*)NULL) {
1273     *p_timeout = p->link_super_tout;
1274     return (BTM_SUCCESS);
1275   }
1276   /* If here, no BD Addr found */
1277   return (BTM_UNKNOWN_ADDR);
1278 }
1279 
1280 /*******************************************************************************
1281  *
1282  * Function         BTM_SetLinkSuperTout
1283  *
1284  * Description      Create and send HCI "Write Link Supervision Timeout" command
1285  *
1286  * Returns          status of the operation
1287  *
1288  ******************************************************************************/
BTM_SetLinkSuperTout(const RawAddress & remote_bda,uint16_t timeout)1289 tBTM_STATUS BTM_SetLinkSuperTout(const RawAddress& remote_bda,
1290                                  uint16_t timeout) {
1291   tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1292 
1293   BTM_TRACE_DEBUG("BTM_SetLinkSuperTout");
1294   if (p != (tACL_CONN*)NULL) {
1295     p->link_super_tout = timeout;
1296 
1297     /* Only send if current role is Master; 2.0 spec requires this */
1298     if (p->link_role == BTM_ROLE_MASTER) {
1299       btsnd_hcic_write_link_super_tout(LOCAL_BR_EDR_CONTROLLER_ID,
1300                                        p->hci_handle, timeout);
1301       return (BTM_CMD_STARTED);
1302     } else {
1303       return (BTM_SUCCESS);
1304     }
1305   }
1306 
1307   /* If here, no BD Addr found */
1308   return (BTM_UNKNOWN_ADDR);
1309 }
1310 
1311 /*******************************************************************************
1312  *
1313  * Function         BTM_IsAclConnectionUp
1314  *
1315  * Description      This function is called to check if an ACL connection exists
1316  *                  to a specific remote BD Address.
1317  *
1318  * Returns          true if connection is up, else false.
1319  *
1320  ******************************************************************************/
BTM_IsAclConnectionUp(const RawAddress & remote_bda,tBT_TRANSPORT transport)1321 bool BTM_IsAclConnectionUp(const RawAddress& remote_bda,
1322                            tBT_TRANSPORT transport) {
1323   tACL_CONN* p;
1324 
1325   VLOG(2) << __func__ << " RemBdAddr: " << remote_bda;
1326 
1327   p = btm_bda_to_acl(remote_bda, transport);
1328   if (p != (tACL_CONN*)NULL) {
1329     return (true);
1330   }
1331 
1332   /* If here, no BD Addr found */
1333   return (false);
1334 }
1335 
1336 /*******************************************************************************
1337  *
1338  * Function         BTM_GetNumAclLinks
1339  *
1340  * Description      This function is called to count the number of
1341  *                  ACL links that are active.
1342  *
1343  * Returns          uint16_t Number of active ACL links
1344  *
1345  ******************************************************************************/
BTM_GetNumAclLinks(void)1346 uint16_t BTM_GetNumAclLinks(void) {
1347   uint16_t num_acl = 0;
1348 
1349   for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i) {
1350     if (btm_cb.acl_db[i].in_use) ++num_acl;
1351   }
1352 
1353   return num_acl;
1354 }
1355 
1356 /*******************************************************************************
1357  *
1358  * Function         btm_get_acl_disc_reason_code
1359  *
1360  * Description      This function is called to get the disconnection reason code
1361  *                  returned by the HCI at disconnection complete event.
1362  *
1363  * Returns          true if connection is up, else false.
1364  *
1365  ******************************************************************************/
btm_get_acl_disc_reason_code(void)1366 uint16_t btm_get_acl_disc_reason_code(void) {
1367   uint8_t res = btm_cb.acl_disc_reason;
1368   BTM_TRACE_DEBUG("btm_get_acl_disc_reason_code");
1369   return (res);
1370 }
1371 
1372 /*******************************************************************************
1373  *
1374  * Function         BTM_GetHCIConnHandle
1375  *
1376  * Description      This function is called to get the handle for an ACL
1377  *                  connection to a specific remote BD Address.
1378  *
1379  * Returns          the handle of the connection, or 0xFFFF if none.
1380  *
1381  ******************************************************************************/
BTM_GetHCIConnHandle(const RawAddress & remote_bda,tBT_TRANSPORT transport)1382 uint16_t BTM_GetHCIConnHandle(const RawAddress& remote_bda,
1383                               tBT_TRANSPORT transport) {
1384   tACL_CONN* p;
1385   BTM_TRACE_DEBUG("BTM_GetHCIConnHandle");
1386   p = btm_bda_to_acl(remote_bda, transport);
1387   if (p != (tACL_CONN*)NULL) {
1388     return (p->hci_handle);
1389   }
1390 
1391   /* If here, no BD Addr found */
1392   return (0xFFFF);
1393 }
1394 
1395 /*******************************************************************************
1396  *
1397  * Function         btm_process_clk_off_comp_evt
1398  *
1399  * Description      This function is called when clock offset command completes.
1400  *
1401  * Input Parms      hci_handle - connection handle associated with the change
1402  *                  clock offset
1403  *
1404  * Returns          void
1405  *
1406  ******************************************************************************/
btm_process_clk_off_comp_evt(uint16_t hci_handle,uint16_t clock_offset)1407 void btm_process_clk_off_comp_evt(uint16_t hci_handle, uint16_t clock_offset) {
1408   uint8_t xx;
1409   BTM_TRACE_DEBUG("btm_process_clk_off_comp_evt");
1410   /* Look up the connection by handle and set the current mode */
1411   xx = btm_handle_to_acl_index(hci_handle);
1412   if (xx < MAX_L2CAP_LINKS) btm_cb.acl_db[xx].clock_offset = clock_offset;
1413 }
1414 
1415 /*******************************************************************************
1416 *
1417 * Function         btm_blacklist_role_change_device
1418 *
1419 * Description      This function is used to blacklist the device if the role
1420 *                  switch fails for maximum number of times. It also removes
1421 *                  the device from the black list if the role switch succeeds.
1422 *
1423 * Input Parms      bd_addr - remote BD addr
1424 *                  hci_status - role switch status
1425 *
1426 * Returns          void
1427 *
1428 *******************************************************************************/
btm_blacklist_role_change_device(const RawAddress & bd_addr,uint8_t hci_status)1429 void btm_blacklist_role_change_device(const RawAddress& bd_addr,
1430                                       uint8_t hci_status) {
1431   tACL_CONN* p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
1432   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
1433 
1434   if (!p || !p_dev_rec) {
1435     return;
1436   }
1437   if (hci_status == HCI_SUCCESS) {
1438     p->switch_role_failed_attempts = 0;
1439     return;
1440   }
1441 
1442   /* check for carkits */
1443   const uint32_t cod_audio_device =
1444       (BTM_COD_SERVICE_AUDIO | BTM_COD_MAJOR_AUDIO) << 8;
1445   const uint32_t cod =
1446       ((p_dev_rec->dev_class[0] << 16) | (p_dev_rec->dev_class[1] << 8) |
1447        p_dev_rec->dev_class[2]) &
1448       0xffffff;
1449   if ((hci_status != HCI_SUCCESS) &&
1450       ((p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) ||
1451        (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)) &&
1452       ((cod & cod_audio_device) == cod_audio_device) &&
1453       (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr))) {
1454     p->switch_role_failed_attempts++;
1455     if (p->switch_role_failed_attempts == BTM_MAX_SW_ROLE_FAILED_ATTEMPTS) {
1456       BTM_TRACE_WARNING(
1457           "%s: Device %s blacklisted for role switching - "
1458           "multiple role switch failed attempts: %u",
1459           __func__, bd_addr.ToString().c_str(), p->switch_role_failed_attempts);
1460       interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr, 3);
1461     }
1462   }
1463 }
1464 
1465 /*******************************************************************************
1466  *
1467  * Function         btm_acl_role_changed
1468  *
1469  * Description      This function is called whan a link's master/slave role
1470  *                  change event or command status event (with error) is
1471  *                  received. It updates the link control block, and calls the
1472  *                  registered callback with status and role (if registered).
1473  *
1474  * Returns          void
1475  *
1476  ******************************************************************************/
btm_acl_role_changed(uint8_t hci_status,const RawAddress * bd_addr,uint8_t new_role)1477 void btm_acl_role_changed(uint8_t hci_status, const RawAddress* bd_addr,
1478                           uint8_t new_role) {
1479   const RawAddress* p_bda =
1480       (bd_addr) ? bd_addr : &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1481   tACL_CONN* p = btm_bda_to_acl(*p_bda, BT_TRANSPORT_BR_EDR);
1482   tBTM_ROLE_SWITCH_CMPL* p_data = &btm_cb.devcb.switch_role_ref_data;
1483   tBTM_SEC_DEV_REC* p_dev_rec;
1484 
1485   BTM_TRACE_DEBUG("%s: peer %s hci_status:0x%x new_role:%d", __func__,
1486                   (p_bda != nullptr) ? bd_addr->ToString().c_str() : "nullptr",
1487                   hci_status, new_role);
1488   /* Ignore any stray events */
1489   if (p == NULL) {
1490     /* it could be a failure */
1491     if (hci_status != HCI_SUCCESS)
1492       btm_acl_report_role_change(hci_status, bd_addr);
1493     return;
1494   }
1495 
1496   p_data->hci_status = hci_status;
1497 
1498   if (hci_status == HCI_SUCCESS) {
1499     p_data->role = new_role;
1500     p_data->remote_bd_addr = *p_bda;
1501 
1502     /* Update cached value */
1503     p->link_role = new_role;
1504 
1505     /* Reload LSTO: link supervision timeout is reset in the LM after a role
1506      * switch */
1507     if (new_role == BTM_ROLE_MASTER) {
1508       BTM_SetLinkSuperTout(p->remote_addr, p->link_super_tout);
1509     }
1510   } else {
1511     /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1512     new_role = p->link_role;
1513   }
1514 
1515   /* Check if any SCO req is pending for role change */
1516   btm_sco_chk_pend_rolechange(p->hci_handle);
1517 
1518   /* if switching state is switching we need to turn encryption on */
1519   /* if idle, we did not change encryption */
1520   if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) {
1521     btsnd_hcic_set_conn_encrypt(p->hci_handle, true);
1522     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1523     p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1524     return;
1525   }
1526 
1527   /* Set the switch_role_state to IDLE since the reply received from HCI */
1528   /* regardless of its result either success or failed. */
1529   if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS) {
1530     p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1531     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1532   }
1533 
1534   /* if role switch complete is needed, report it now */
1535   btm_acl_report_role_change(hci_status, bd_addr);
1536 
1537   /* if role change event is registered, report it now */
1538   if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
1539     tBTM_BL_ROLE_CHG_DATA evt;
1540     evt.event = BTM_BL_ROLE_CHG_EVT;
1541     evt.new_role = new_role;
1542     evt.p_bda = p_bda;
1543     evt.hci_status = hci_status;
1544     tBTM_BL_EVENT_DATA btm_bl_event_data;
1545     btm_bl_event_data.role_chg = evt;
1546     (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
1547   }
1548 
1549   BTM_TRACE_DEBUG(
1550       "%s: peer %s Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, "
1551       "rs_st:%d",
1552       __func__, (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr",
1553       p_data->role, p_data->hci_status, p->switch_role_state);
1554 
1555 #if (BTM_DISC_DURING_RS == TRUE)
1556   /* If a disconnect is pending, issue it now that role switch has completed */
1557   p_dev_rec = btm_find_dev(*p_bda);
1558   if (p_dev_rec != NULL) {
1559     if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
1560       BTM_TRACE_WARNING(
1561           "%s peer %s Issuing delayed HCI_Disconnect!!!", __func__,
1562           (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr");
1563       btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1564     }
1565     BTM_TRACE_ERROR("%s: peer %s tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1566                     __func__,
1567                     (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr",
1568                     PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1569     p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
1570   }
1571 
1572 #endif
1573 }
1574 
1575 /*******************************************************************************
1576  *
1577  * Function         BTM_AllocateSCN
1578  *
1579  * Description      Look through the Server Channel Numbers for a free one.
1580  *
1581  * Returns          Allocated SCN number or 0 if none.
1582  *
1583  ******************************************************************************/
1584 
BTM_AllocateSCN(void)1585 uint8_t BTM_AllocateSCN(void) {
1586   uint8_t x;
1587   BTM_TRACE_DEBUG("BTM_AllocateSCN");
1588 
1589   // stack reserves scn 1 for HFP, HSP we still do the correct way
1590   for (x = 1; x < BTM_MAX_SCN; x++) {
1591     if (!btm_cb.btm_scn[x]) {
1592       btm_cb.btm_scn[x] = true;
1593       return (x + 1);
1594     }
1595   }
1596 
1597   return (0); /* No free ports */
1598 }
1599 
1600 /*******************************************************************************
1601  *
1602  * Function         BTM_TryAllocateSCN
1603  *
1604  * Description      Try to allocate a fixed server channel
1605  *
1606  * Returns          Returns true if server channel was available
1607  *
1608  ******************************************************************************/
1609 
BTM_TryAllocateSCN(uint8_t scn)1610 bool BTM_TryAllocateSCN(uint8_t scn) {
1611   /* Make sure we don't exceed max port range.
1612    * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1613    */
1614   if ((scn >= BTM_MAX_SCN) || (scn == 1)) return false;
1615 
1616   /* check if this port is available */
1617   if (!btm_cb.btm_scn[scn - 1]) {
1618     btm_cb.btm_scn[scn - 1] = true;
1619     return true;
1620   }
1621 
1622   return (false); /* Port was busy */
1623 }
1624 
1625 /*******************************************************************************
1626  *
1627  * Function         BTM_FreeSCN
1628  *
1629  * Description      Free the specified SCN.
1630  *
1631  * Returns          true or false
1632  *
1633  ******************************************************************************/
BTM_FreeSCN(uint8_t scn)1634 bool BTM_FreeSCN(uint8_t scn) {
1635   BTM_TRACE_DEBUG("BTM_FreeSCN ");
1636   if (scn <= BTM_MAX_SCN) {
1637     btm_cb.btm_scn[scn - 1] = false;
1638     return (true);
1639   } else {
1640     return (false); /* Illegal SCN passed in */
1641   }
1642 }
1643 
1644 /*******************************************************************************
1645  *
1646  * Function         btm_set_packet_types
1647  *
1648  * Description      This function sets the packet types used for a specific
1649  *                  ACL connection. It is called internally by btm_acl_created
1650  *                  or by an application/profile by BTM_SetPacketTypes.
1651  *
1652  * Returns          status of the operation
1653  *
1654  ******************************************************************************/
btm_set_packet_types(tACL_CONN * p,uint16_t pkt_types)1655 tBTM_STATUS btm_set_packet_types(tACL_CONN* p, uint16_t pkt_types) {
1656   uint16_t temp_pkt_types;
1657   BTM_TRACE_DEBUG("btm_set_packet_types");
1658   /* Save in the ACL control blocks, types that we support */
1659   temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1660                     btm_cb.btm_acl_pkt_types_supported);
1661 
1662   /* OR in any exception packet types if at least 2.0 version of spec */
1663   temp_pkt_types |=
1664       ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1665        (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1666 
1667   /* Exclude packet types not supported by the peer */
1668   btm_acl_chk_peer_pkt_type_support(p, &temp_pkt_types);
1669 
1670   BTM_TRACE_DEBUG("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1671 
1672   btsnd_hcic_change_conn_type(p->hci_handle, temp_pkt_types);
1673   p->pkt_types_mask = temp_pkt_types;
1674 
1675   return (BTM_CMD_STARTED);
1676 }
1677 
1678 /*******************************************************************************
1679  *
1680  * Function         btm_get_max_packet_size
1681  *
1682  * Returns          Returns maximum packet size that can be used for current
1683  *                  connection, 0 if connection is not established
1684  *
1685  ******************************************************************************/
btm_get_max_packet_size(const RawAddress & addr)1686 uint16_t btm_get_max_packet_size(const RawAddress& addr) {
1687   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1688   uint16_t pkt_types = 0;
1689   uint16_t pkt_size = 0;
1690   BTM_TRACE_DEBUG("btm_get_max_packet_size");
1691   if (p != NULL) {
1692     pkt_types = p->pkt_types_mask;
1693   } else {
1694     /* Special case for when info for the local device is requested */
1695     if (addr == *controller_get_interface()->get_address()) {
1696       pkt_types = btm_cb.btm_acl_pkt_types_supported;
1697     }
1698   }
1699 
1700   if (pkt_types) {
1701     if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1702       pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1703     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1704       pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1705     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1706       pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1707     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1708       pkt_size = HCI_DH5_PACKET_SIZE;
1709     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1710       pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1711     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1712       pkt_size = HCI_DM5_PACKET_SIZE;
1713     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1714       pkt_size = HCI_DH3_PACKET_SIZE;
1715     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1716       pkt_size = HCI_DM3_PACKET_SIZE;
1717     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1718       pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1719     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1720       pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1721     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1722       pkt_size = HCI_DH1_PACKET_SIZE;
1723     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1724       pkt_size = HCI_DM1_PACKET_SIZE;
1725   }
1726 
1727   return (pkt_size);
1728 }
1729 
1730 /*******************************************************************************
1731  *
1732  * Function         BTM_ReadRemoteVersion
1733  *
1734  * Returns          If connected report peer device info
1735  *
1736  ******************************************************************************/
BTM_ReadRemoteVersion(const RawAddress & addr,uint8_t * lmp_version,uint16_t * manufacturer,uint16_t * lmp_sub_version)1737 tBTM_STATUS BTM_ReadRemoteVersion(const RawAddress& addr, uint8_t* lmp_version,
1738                                   uint16_t* manufacturer,
1739                                   uint16_t* lmp_sub_version) {
1740   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1741   BTM_TRACE_DEBUG("BTM_ReadRemoteVersion");
1742   if (p == NULL) return (BTM_UNKNOWN_ADDR);
1743 
1744   if (lmp_version) *lmp_version = p->lmp_version;
1745 
1746   if (manufacturer) *manufacturer = p->manufacturer;
1747 
1748   if (lmp_sub_version) *lmp_sub_version = p->lmp_subversion;
1749 
1750   return (BTM_SUCCESS);
1751 }
1752 
1753 /*******************************************************************************
1754  *
1755  * Function         BTM_ReadRemoteFeatures
1756  *
1757  * Returns          pointer to the remote supported features mask (8 bytes)
1758  *
1759  ******************************************************************************/
BTM_ReadRemoteFeatures(const RawAddress & addr)1760 uint8_t* BTM_ReadRemoteFeatures(const RawAddress& addr) {
1761   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1762   BTM_TRACE_DEBUG("BTM_ReadRemoteFeatures");
1763   if (p == NULL) {
1764     return (NULL);
1765   }
1766 
1767   return (p->peer_lmp_feature_pages[0]);
1768 }
1769 
1770 /*******************************************************************************
1771  *
1772  * Function         BTM_ReadRemoteExtendedFeatures
1773  *
1774  * Returns          pointer to the remote extended features mask (8 bytes)
1775  *                  or NULL if bad page
1776  *
1777  ******************************************************************************/
BTM_ReadRemoteExtendedFeatures(const RawAddress & addr,uint8_t page_number)1778 uint8_t* BTM_ReadRemoteExtendedFeatures(const RawAddress& addr,
1779                                         uint8_t page_number) {
1780   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1781   BTM_TRACE_DEBUG("BTM_ReadRemoteExtendedFeatures");
1782   if (p == NULL) {
1783     return (NULL);
1784   }
1785 
1786   if (page_number > HCI_EXT_FEATURES_PAGE_MAX) {
1787     BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown",
1788                     page_number);
1789     return NULL;
1790   }
1791 
1792   return (p->peer_lmp_feature_pages[page_number]);
1793 }
1794 
1795 /*******************************************************************************
1796  *
1797  * Function         BTM_ReadNumberRemoteFeaturesPages
1798  *
1799  * Returns          number of features pages read from the remote device.
1800  *
1801  ******************************************************************************/
BTM_ReadNumberRemoteFeaturesPages(const RawAddress & addr)1802 uint8_t BTM_ReadNumberRemoteFeaturesPages(const RawAddress& addr) {
1803   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1804   BTM_TRACE_DEBUG("BTM_ReadNumberRemoteFeaturesPages");
1805   if (p == NULL) {
1806     return (0);
1807   }
1808 
1809   return (p->num_read_pages);
1810 }
1811 
1812 /*******************************************************************************
1813  *
1814  * Function         BTM_ReadAllRemoteFeatures
1815  *
1816  * Returns          pointer to all features of the remote (24 bytes).
1817  *
1818  ******************************************************************************/
BTM_ReadAllRemoteFeatures(const RawAddress & addr)1819 uint8_t* BTM_ReadAllRemoteFeatures(const RawAddress& addr) {
1820   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1821   BTM_TRACE_DEBUG("BTM_ReadAllRemoteFeatures");
1822   if (p == NULL) {
1823     return (NULL);
1824   }
1825 
1826   return (p->peer_lmp_feature_pages[0]);
1827 }
1828 
1829 /*******************************************************************************
1830  *
1831  * Function         BTM_RegBusyLevelNotif
1832  *
1833  * Description      This function is called to register a callback to receive
1834  *                  busy level change events.
1835  *
1836  * Returns          BTM_SUCCESS if successfully registered, otherwise error
1837  *
1838  ******************************************************************************/
BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB * p_cb,uint8_t * p_level,tBTM_BL_EVENT_MASK evt_mask)1839 tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
1840                                   tBTM_BL_EVENT_MASK evt_mask) {
1841   BTM_TRACE_DEBUG("BTM_RegBusyLevelNotif");
1842   if (p_level) *p_level = btm_cb.busy_level;
1843 
1844   btm_cb.bl_evt_mask = evt_mask;
1845 
1846   if (!p_cb)
1847     btm_cb.p_bl_changed_cb = NULL;
1848   else if (btm_cb.p_bl_changed_cb)
1849     return (BTM_BUSY);
1850   else
1851     btm_cb.p_bl_changed_cb = p_cb;
1852 
1853   return (BTM_SUCCESS);
1854 }
1855 
1856 /*******************************************************************************
1857  *
1858  * Function         BTM_SetQoS
1859  *
1860  * Description      This function is called to setup QoS
1861  *
1862  * Returns          status of the operation
1863  *
1864  ******************************************************************************/
BTM_SetQoS(const RawAddress & bd,FLOW_SPEC * p_flow,tBTM_CMPL_CB * p_cb)1865 tBTM_STATUS BTM_SetQoS(const RawAddress& bd, FLOW_SPEC* p_flow,
1866                        tBTM_CMPL_CB* p_cb) {
1867   tACL_CONN* p = &btm_cb.acl_db[0];
1868 
1869   VLOG(2) << __func__ << " BdAddr: " << bd;
1870 
1871   /* If someone already waiting on the version, do not allow another */
1872   if (btm_cb.devcb.p_qos_setup_cmpl_cb) return (BTM_BUSY);
1873 
1874   p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR);
1875   if (p != NULL) {
1876     btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
1877     alarm_set_on_mloop(btm_cb.devcb.qos_setup_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1878                        btm_qos_setup_timeout, NULL);
1879 
1880     btsnd_hcic_qos_setup(p->hci_handle, p_flow->qos_flags, p_flow->service_type,
1881                          p_flow->token_rate, p_flow->peak_bandwidth,
1882                          p_flow->latency, p_flow->delay_variation);
1883     return (BTM_CMD_STARTED);
1884   }
1885 
1886   /* If here, no BD Addr found */
1887   return (BTM_UNKNOWN_ADDR);
1888 }
1889 
1890 /*******************************************************************************
1891  *
1892  * Function         btm_qos_setup_timeout
1893  *
1894  * Description      Callback when QoS setup times out.
1895  *
1896  * Returns          void
1897  *
1898  ******************************************************************************/
btm_qos_setup_timeout(UNUSED_ATTR void * data)1899 void btm_qos_setup_timeout(UNUSED_ATTR void* data) {
1900   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1901   btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1902   if (p_cb) (*p_cb)((void*)NULL);
1903 }
1904 
1905 /*******************************************************************************
1906  *
1907  * Function         btm_qos_setup_complete
1908  *
1909  * Description      This function is called when the command complete message
1910  *                  is received from the HCI for the qos setup request.
1911  *
1912  * Returns          void
1913  *
1914  ******************************************************************************/
btm_qos_setup_complete(uint8_t status,uint16_t handle,FLOW_SPEC * p_flow)1915 void btm_qos_setup_complete(uint8_t status, uint16_t handle,
1916                             FLOW_SPEC* p_flow) {
1917   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1918   tBTM_QOS_SETUP_CMPL qossu;
1919 
1920   BTM_TRACE_DEBUG("%s", __func__);
1921   alarm_cancel(btm_cb.devcb.qos_setup_timer);
1922   btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1923 
1924   /* If there was a registered callback, call it */
1925   if (p_cb) {
1926     memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1927     qossu.status = status;
1928     qossu.handle = handle;
1929     if (p_flow != NULL) {
1930       qossu.flow.qos_flags = p_flow->qos_flags;
1931       qossu.flow.service_type = p_flow->service_type;
1932       qossu.flow.token_rate = p_flow->token_rate;
1933       qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1934       qossu.flow.latency = p_flow->latency;
1935       qossu.flow.delay_variation = p_flow->delay_variation;
1936     }
1937     BTM_TRACE_DEBUG("BTM: p_flow->delay_variation: 0x%02x",
1938                     qossu.flow.delay_variation);
1939     (*p_cb)(&qossu);
1940   }
1941 }
1942 
1943 /*******************************************************************************
1944  *
1945  * Function         BTM_ReadRSSI
1946  *
1947  * Description      This function is called to read the link policy settings.
1948  *                  The address of link policy results are returned in the
1949  *                  callback.
1950  *                  (tBTM_RSSI_RESULT)
1951  *
1952  * Returns          BTM_CMD_STARTED if successfully initiated or error code
1953  *
1954  ******************************************************************************/
BTM_ReadRSSI(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1955 tBTM_STATUS BTM_ReadRSSI(const RawAddress& remote_bda, tBTM_CMPL_CB* p_cb) {
1956   tACL_CONN* p = NULL;
1957   tBT_DEVICE_TYPE dev_type;
1958   tBLE_ADDR_TYPE addr_type;
1959 
1960   /* If someone already waiting on the version, do not allow another */
1961   if (btm_cb.devcb.p_rssi_cmpl_cb) return (BTM_BUSY);
1962 
1963   BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1964 
1965   if (dev_type & BT_DEVICE_TYPE_BLE) {
1966     p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_LE);
1967   }
1968 
1969   if (p == NULL && dev_type & BT_DEVICE_TYPE_BREDR) {
1970     p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1971   }
1972 
1973   if (p) {
1974     btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
1975     alarm_set_on_mloop(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1976                        btm_read_rssi_timeout, NULL);
1977 
1978     btsnd_hcic_read_rssi(p->hci_handle);
1979     return (BTM_CMD_STARTED);
1980   }
1981 
1982   /* If here, no BD Addr found */
1983   return (BTM_UNKNOWN_ADDR);
1984 }
1985 
1986 /*******************************************************************************
1987  *
1988  * Function         BTM_ReadFailedContactCounter
1989  *
1990  * Description      This function is called to read the failed contact counter.
1991  *                  The result is returned in the callback.
1992  *                  (tBTM_FAILED_CONTACT_COUNTER_RESULT)
1993  *
1994  * Returns          BTM_CMD_STARTED if successfully initiated or error code
1995  *
1996  ******************************************************************************/
BTM_ReadFailedContactCounter(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1997 tBTM_STATUS BTM_ReadFailedContactCounter(const RawAddress& remote_bda,
1998                                          tBTM_CMPL_CB* p_cb) {
1999   tACL_CONN* p;
2000   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2001   tBT_DEVICE_TYPE dev_type;
2002   tBLE_ADDR_TYPE addr_type;
2003 
2004   /* If someone already waiting on the result, do not allow another */
2005   if (btm_cb.devcb.p_failed_contact_counter_cmpl_cb) return (BTM_BUSY);
2006 
2007   BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2008   if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
2009 
2010   p = btm_bda_to_acl(remote_bda, transport);
2011   if (p != (tACL_CONN*)NULL) {
2012     btm_cb.devcb.p_failed_contact_counter_cmpl_cb = p_cb;
2013     alarm_set_on_mloop(btm_cb.devcb.read_failed_contact_counter_timer,
2014                        BTM_DEV_REPLY_TIMEOUT_MS,
2015                        btm_read_failed_contact_counter_timeout, NULL);
2016 
2017     btsnd_hcic_read_failed_contact_counter(p->hci_handle);
2018     return (BTM_CMD_STARTED);
2019   }
2020 
2021   /* If here, no BD Addr found */
2022   return (BTM_UNKNOWN_ADDR);
2023 }
2024 
2025 /*******************************************************************************
2026  *
2027  * Function         BTM_ReadAutomaticFlushTimeout
2028  *
2029  * Description      This function is called to read the automatic flush timeout.
2030  *                  The result is returned in the callback.
2031  *                  (tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT)
2032  *
2033  * Returns          BTM_CMD_STARTED if successfully initiated or error code
2034  *
2035  ******************************************************************************/
BTM_ReadAutomaticFlushTimeout(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)2036 tBTM_STATUS BTM_ReadAutomaticFlushTimeout(const RawAddress& remote_bda,
2037                                           tBTM_CMPL_CB* p_cb) {
2038   tACL_CONN* p;
2039   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2040   tBT_DEVICE_TYPE dev_type;
2041   tBLE_ADDR_TYPE addr_type;
2042 
2043   /* If someone already waiting on the result, do not allow another */
2044   if (btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb) return (BTM_BUSY);
2045 
2046   BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2047   if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
2048 
2049   p = btm_bda_to_acl(remote_bda, transport);
2050   if (!p) return BTM_UNKNOWN_ADDR;
2051 
2052   btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = p_cb;
2053   alarm_set_on_mloop(btm_cb.devcb.read_automatic_flush_timeout_timer,
2054                      BTM_DEV_REPLY_TIMEOUT_MS,
2055                      btm_read_automatic_flush_timeout_timeout, nullptr);
2056 
2057   btsnd_hcic_read_automatic_flush_timeout(p->hci_handle);
2058   return BTM_CMD_STARTED;
2059 }
2060 
2061 /*******************************************************************************
2062  *
2063  * Function         BTM_ReadLinkQuality
2064  *
2065  * Description      This function is called to read the link qulaity.
2066  *                  The value of the link quality is returned in the callback.
2067  *                  (tBTM_LINK_QUALITY_RESULT)
2068  *
2069  * Returns          BTM_CMD_STARTED if successfully initiated or error code
2070  *
2071  ******************************************************************************/
BTM_ReadLinkQuality(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)2072 tBTM_STATUS BTM_ReadLinkQuality(const RawAddress& remote_bda,
2073                                 tBTM_CMPL_CB* p_cb) {
2074   VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
2075 
2076   /* If someone already waiting on the version, do not allow another */
2077   if (btm_cb.devcb.p_link_qual_cmpl_cb) return (BTM_BUSY);
2078 
2079   tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
2080   if (p != (tACL_CONN*)NULL) {
2081     btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
2082     alarm_set_on_mloop(btm_cb.devcb.read_link_quality_timer,
2083                        BTM_DEV_REPLY_TIMEOUT_MS, btm_read_link_quality_timeout,
2084                        NULL);
2085 
2086     btsnd_hcic_get_link_quality(p->hci_handle);
2087     return (BTM_CMD_STARTED);
2088   }
2089 
2090   /* If here, no BD Addr found */
2091   return (BTM_UNKNOWN_ADDR);
2092 }
2093 
2094 /*******************************************************************************
2095  *
2096  * Function         BTM_ReadTxPower
2097  *
2098  * Description      This function is called to read the current
2099  *                  TX power of the connection. The tx power level results
2100  *                  are returned in the callback.
2101  *                  (tBTM_RSSI_RESULT)
2102  *
2103  * Returns          BTM_CMD_STARTED if successfully initiated or error code
2104  *
2105  ******************************************************************************/
BTM_ReadTxPower(const RawAddress & remote_bda,tBT_TRANSPORT transport,tBTM_CMPL_CB * p_cb)2106 tBTM_STATUS BTM_ReadTxPower(const RawAddress& remote_bda,
2107                             tBT_TRANSPORT transport, tBTM_CMPL_CB* p_cb) {
2108   tACL_CONN* p;
2109 #define BTM_READ_RSSI_TYPE_CUR 0x00
2110 #define BTM_READ_RSSI_TYPE_MAX 0X01
2111 
2112   VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
2113 
2114   /* If someone already waiting on the version, do not allow another */
2115   if (btm_cb.devcb.p_tx_power_cmpl_cb) return (BTM_BUSY);
2116 
2117   p = btm_bda_to_acl(remote_bda, transport);
2118   if (p != (tACL_CONN*)NULL) {
2119     btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2120     alarm_set_on_mloop(btm_cb.devcb.read_tx_power_timer,
2121                        BTM_DEV_REPLY_TIMEOUT_MS, btm_read_tx_power_timeout,
2122                        NULL);
2123 
2124     if (p->transport == BT_TRANSPORT_LE) {
2125       btm_cb.devcb.read_tx_pwr_addr = remote_bda;
2126       btsnd_hcic_ble_read_adv_chnl_tx_power();
2127     } else {
2128       btsnd_hcic_read_tx_power(p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2129     }
2130 
2131     return (BTM_CMD_STARTED);
2132   }
2133 
2134   /* If here, no BD Addr found */
2135   return (BTM_UNKNOWN_ADDR);
2136 }
2137 
2138 /*******************************************************************************
2139  *
2140  * Function         btm_read_tx_power_timeout
2141  *
2142  * Description      Callback when reading the tx power times out.
2143  *
2144  * Returns          void
2145  *
2146  ******************************************************************************/
btm_read_tx_power_timeout(UNUSED_ATTR void * data)2147 void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {
2148   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2149   btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2150   if (p_cb) (*p_cb)((void*)NULL);
2151 }
2152 
2153 /*******************************************************************************
2154  *
2155  * Function         btm_read_tx_power_complete
2156  *
2157  * Description      This function is called when the command complete message
2158  *                  is received from the HCI for the read tx power request.
2159  *
2160  * Returns          void
2161  *
2162  ******************************************************************************/
btm_read_tx_power_complete(uint8_t * p,bool is_ble)2163 void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
2164   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2165   tBTM_TX_POWER_RESULT result;
2166   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2167 
2168   BTM_TRACE_DEBUG("%s", __func__);
2169   alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2170   btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2171 
2172   /* If there was a registered callback, call it */
2173   if (p_cb) {
2174     STREAM_TO_UINT8(result.hci_status, p);
2175 
2176     if (result.hci_status == HCI_SUCCESS) {
2177       result.status = BTM_SUCCESS;
2178 
2179       if (!is_ble) {
2180         uint16_t handle;
2181         STREAM_TO_UINT16(handle, p);
2182         STREAM_TO_UINT8(result.tx_power, p);
2183 
2184         /* Search through the list of active channels for the correct BD Addr */
2185         for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2186           if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2187             result.rem_bda = p_acl_cb->remote_addr;
2188             break;
2189           }
2190         }
2191       } else {
2192         STREAM_TO_UINT8(result.tx_power, p);
2193         result.rem_bda = btm_cb.devcb.read_tx_pwr_addr;
2194       }
2195       BTM_TRACE_DEBUG("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2196                       result.tx_power, result.hci_status);
2197     } else {
2198       result.status = BTM_ERR_PROCESSING;
2199     }
2200 
2201     (*p_cb)(&result);
2202   }
2203 }
2204 
2205 /*******************************************************************************
2206  *
2207  * Function         btm_read_rssi_timeout
2208  *
2209  * Description      Callback when reading the RSSI times out.
2210  *
2211  * Returns          void
2212  *
2213  ******************************************************************************/
btm_read_rssi_timeout(UNUSED_ATTR void * data)2214 void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
2215   tBTM_RSSI_RESULT result;
2216   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2217   btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2218   result.status = BTM_DEVICE_TIMEOUT;
2219   if (p_cb) (*p_cb)(&result);
2220 }
2221 
2222 /*******************************************************************************
2223  *
2224  * Function         btm_read_rssi_complete
2225  *
2226  * Description      This function is called when the command complete message
2227  *                  is received from the HCI for the read rssi request.
2228  *
2229  * Returns          void
2230  *
2231  ******************************************************************************/
btm_read_rssi_complete(uint8_t * p)2232 void btm_read_rssi_complete(uint8_t* p) {
2233   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2234   tBTM_RSSI_RESULT result;
2235   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2236 
2237   BTM_TRACE_DEBUG("%s", __func__);
2238   alarm_cancel(btm_cb.devcb.read_rssi_timer);
2239   btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2240 
2241   /* If there was a registered callback, call it */
2242   if (p_cb) {
2243     STREAM_TO_UINT8(result.hci_status, p);
2244 
2245     if (result.hci_status == HCI_SUCCESS) {
2246       uint16_t handle;
2247       result.status = BTM_SUCCESS;
2248 
2249       STREAM_TO_UINT16(handle, p);
2250 
2251       STREAM_TO_UINT8(result.rssi, p);
2252       BTM_TRACE_DEBUG("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2253                       result.rssi, result.hci_status);
2254 
2255       /* Search through the list of active channels for the correct BD Addr */
2256       for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2257         if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2258           result.rem_bda = p_acl_cb->remote_addr;
2259           break;
2260         }
2261       }
2262     } else {
2263       result.status = BTM_ERR_PROCESSING;
2264     }
2265 
2266     (*p_cb)(&result);
2267   }
2268 }
2269 
2270 /*******************************************************************************
2271  *
2272  * Function         btm_read_failed_contact_counter_timeout
2273  *
2274  * Description      Callback when reading the failed contact counter times out.
2275  *
2276  * Returns          void
2277  *
2278  ******************************************************************************/
btm_read_failed_contact_counter_timeout(UNUSED_ATTR void * data)2279 void btm_read_failed_contact_counter_timeout(UNUSED_ATTR void* data) {
2280   tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2281   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2282   btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2283   result.status = BTM_DEVICE_TIMEOUT;
2284   if (p_cb) (*p_cb)(&result);
2285 }
2286 
2287 /*******************************************************************************
2288  *
2289  * Function         btm_read_failed_contact_counter_complete
2290  *
2291  * Description      This function is called when the command complete message
2292  *                  is received from the HCI for the read failed contact
2293  *                  counter request.
2294  *
2295  * Returns          void
2296  *
2297  ******************************************************************************/
btm_read_failed_contact_counter_complete(uint8_t * p)2298 void btm_read_failed_contact_counter_complete(uint8_t* p) {
2299   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2300   tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2301   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2302 
2303   BTM_TRACE_DEBUG("%s", __func__);
2304   alarm_cancel(btm_cb.devcb.read_failed_contact_counter_timer);
2305   btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2306 
2307   /* If there was a registered callback, call it */
2308   if (p_cb) {
2309     uint16_t handle;
2310     STREAM_TO_UINT8(result.hci_status, p);
2311 
2312     if (result.hci_status == HCI_SUCCESS) {
2313       result.status = BTM_SUCCESS;
2314 
2315       STREAM_TO_UINT16(handle, p);
2316 
2317       STREAM_TO_UINT16(result.failed_contact_counter, p);
2318       BTM_TRACE_DEBUG(
2319           "BTM Failed Contact Counter Complete: counter %u, hci status 0x%02x",
2320           result.failed_contact_counter, result.hci_status);
2321 
2322       /* Search through the list of active channels for the correct BD Addr */
2323       for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2324         if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2325           result.rem_bda = p_acl_cb->remote_addr;
2326           break;
2327         }
2328       }
2329     } else {
2330       result.status = BTM_ERR_PROCESSING;
2331     }
2332 
2333     (*p_cb)(&result);
2334   }
2335 }
2336 
2337 /*******************************************************************************
2338  *
2339  * Function         btm_read_automatic_flush_timeout_timeout
2340  *
2341  * Description      Callback when reading the automatic flush timeout times out.
2342  *
2343  * Returns          void
2344  *
2345  ******************************************************************************/
btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void * data)2346 void btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void* data) {
2347   tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2348   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2349   btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2350   result.status = BTM_DEVICE_TIMEOUT;
2351   if (p_cb) (*p_cb)(&result);
2352 }
2353 
2354 /*******************************************************************************
2355  *
2356  * Function         btm_read_automatic_flush_timeout_complete
2357  *
2358  * Description      This function is called when the command complete message
2359  *                  is received from the HCI for the read automatic flush
2360  *                  timeout request.
2361  *
2362  * Returns          void
2363  *
2364  ******************************************************************************/
btm_read_automatic_flush_timeout_complete(uint8_t * p)2365 void btm_read_automatic_flush_timeout_complete(uint8_t* p) {
2366   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2367   tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2368   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2369 
2370   BTM_TRACE_DEBUG("%s", __func__);
2371   alarm_cancel(btm_cb.devcb.read_automatic_flush_timeout_timer);
2372   btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2373 
2374   /* If there was a registered callback, call it */
2375   if (p_cb) {
2376     uint16_t handle;
2377     STREAM_TO_UINT8(result.hci_status, p);
2378 
2379     if (result.hci_status == HCI_SUCCESS) {
2380       result.status = BTM_SUCCESS;
2381 
2382       STREAM_TO_UINT16(handle, p);
2383 
2384       STREAM_TO_UINT16(result.automatic_flush_timeout, p);
2385       BTM_TRACE_DEBUG(
2386           "BTM Automatic Flush Timeout Complete: timeout %u, hci status 0x%02x",
2387           result.automatic_flush_timeout, result.hci_status);
2388 
2389       /* Search through the list of active channels for the correct BD Addr */
2390       for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2391         if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2392           result.rem_bda = p_acl_cb->remote_addr;
2393           break;
2394         }
2395       }
2396     } else {
2397       result.status = BTM_ERR_PROCESSING;
2398     }
2399 
2400     (*p_cb)(&result);
2401   }
2402 }
2403 
2404 /*******************************************************************************
2405  *
2406  * Function         btm_read_link_quality_timeout
2407  *
2408  * Description      Callback when reading the link quality times out.
2409  *
2410  * Returns          void
2411  *
2412  ******************************************************************************/
btm_read_link_quality_timeout(UNUSED_ATTR void * data)2413 void btm_read_link_quality_timeout(UNUSED_ATTR void* data) {
2414   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2415   btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2416   if (p_cb) (*p_cb)((void*)NULL);
2417 }
2418 
2419 /*******************************************************************************
2420  *
2421  * Function         btm_read_link_quality_complete
2422  *
2423  * Description      This function is called when the command complete message
2424  *                  is received from the HCI for the read link quality.
2425  *
2426  * Returns          void
2427  *
2428  ******************************************************************************/
btm_read_link_quality_complete(uint8_t * p)2429 void btm_read_link_quality_complete(uint8_t* p) {
2430   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2431   tBTM_LINK_QUALITY_RESULT result;
2432   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2433 
2434   BTM_TRACE_DEBUG("%s", __func__);
2435   alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2436   btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2437 
2438   /* If there was a registered callback, call it */
2439   if (p_cb) {
2440     STREAM_TO_UINT8(result.hci_status, p);
2441 
2442     if (result.hci_status == HCI_SUCCESS) {
2443       uint16_t handle;
2444       result.status = BTM_SUCCESS;
2445 
2446       STREAM_TO_UINT16(handle, p);
2447 
2448       STREAM_TO_UINT8(result.link_quality, p);
2449       BTM_TRACE_DEBUG(
2450           "BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2451           result.link_quality, result.hci_status);
2452 
2453       /* Search through the list of active channels for the correct BD Addr */
2454       for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2455         if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2456           result.rem_bda = p_acl_cb->remote_addr;
2457           break;
2458         }
2459       }
2460     } else {
2461       result.status = BTM_ERR_PROCESSING;
2462     }
2463 
2464     (*p_cb)(&result);
2465   }
2466 }
2467 
2468 /*******************************************************************************
2469  *
2470  * Function         btm_remove_acl
2471  *
2472  * Description      This function is called to disconnect an ACL connection
2473  *
2474  * Returns          BTM_SUCCESS if successfully initiated, otherwise
2475  *                  BTM_NO_RESOURCES.
2476  *
2477  ******************************************************************************/
btm_remove_acl(const RawAddress & bd_addr,tBT_TRANSPORT transport)2478 tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr, tBT_TRANSPORT transport) {
2479   uint16_t hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2480   tBTM_STATUS status = BTM_SUCCESS;
2481 
2482   BTM_TRACE_DEBUG("btm_remove_acl");
2483 #if (BTM_DISC_DURING_RS == TRUE)
2484   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
2485 
2486   /* Role Switch is pending, postpone until completed */
2487   if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING)) {
2488     p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2489   } else /* otherwise can disconnect right away */
2490 #endif
2491   {
2492     if (hci_handle != 0xFFFF && p_dev_rec &&
2493         p_dev_rec->sec_state != BTM_SEC_STATE_DISCONNECTING) {
2494       btsnd_hcic_disconnect(hci_handle, HCI_ERR_PEER_USER);
2495     } else {
2496       status = BTM_UNKNOWN_ADDR;
2497     }
2498   }
2499 
2500   return status;
2501 }
2502 
2503 /*******************************************************************************
2504  *
2505  * Function         BTM_SetTraceLevel
2506  *
2507  * Description      This function sets the trace level for BTM.  If called with
2508  *                  a value of 0xFF, it simply returns the current trace level.
2509  *
2510  * Returns          The new or current trace level
2511  *
2512  ******************************************************************************/
BTM_SetTraceLevel(uint8_t new_level)2513 uint8_t BTM_SetTraceLevel(uint8_t new_level) {
2514   BTM_TRACE_DEBUG("BTM_SetTraceLevel");
2515   if (new_level != 0xFF) btm_cb.trace_level = new_level;
2516 
2517   return (btm_cb.trace_level);
2518 }
2519 
2520 /*******************************************************************************
2521  *
2522  * Function         btm_cont_rswitch
2523  *
2524  * Description      This function is called to continue processing an active
2525  *                  role switch. It first disables encryption if enabled and
2526  *                  EPR is not supported
2527  *
2528  * Returns          void
2529  *
2530  ******************************************************************************/
btm_cont_rswitch(tACL_CONN * p,tBTM_SEC_DEV_REC * p_dev_rec,uint8_t hci_status)2531 void btm_cont_rswitch(tACL_CONN* p, tBTM_SEC_DEV_REC* p_dev_rec,
2532                       uint8_t hci_status) {
2533   BTM_TRACE_DEBUG("btm_cont_rswitch");
2534   /* Check to see if encryption needs to be turned off if pending
2535      change of link key or role switch */
2536   if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2537     /* Must turn off Encryption first if necessary */
2538     /* Some devices do not support switch or change of link key while encryption
2539      * is on */
2540     if (p_dev_rec != NULL &&
2541         ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
2542         !BTM_EPR_AVAILABLE(p)) {
2543       btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
2544       p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2545       if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2546         p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2547     } else /* Encryption not used or EPR supported, continue with switch
2548               and/or change of link key */
2549     {
2550       if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2551         p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2552 #if (BTM_DISC_DURING_RS == TRUE)
2553         if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2554 #endif
2555         btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
2556       }
2557     }
2558   }
2559 }
2560 
2561 /*******************************************************************************
2562  *
2563  * Function         btm_acl_resubmit_page
2564  *
2565  * Description      send pending page request
2566  *
2567  ******************************************************************************/
btm_acl_resubmit_page(void)2568 void btm_acl_resubmit_page(void) {
2569   tBTM_SEC_DEV_REC* p_dev_rec;
2570   BT_HDR* p_buf;
2571   uint8_t* pp;
2572   BTM_TRACE_DEBUG("btm_acl_resubmit_page");
2573   /* If there were other page request schedule can start the next one */
2574   p_buf = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue);
2575   if (p_buf != NULL) {
2576     /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2577      * for both create_conn and rmt_name */
2578     pp = (uint8_t*)(p_buf + 1) + p_buf->offset + 3;
2579 
2580     RawAddress bda;
2581     STREAM_TO_BDADDR(bda, pp);
2582 
2583     p_dev_rec = btm_find_or_alloc_dev(bda);
2584 
2585     btm_cb.connecting_bda = p_dev_rec->bd_addr;
2586     memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2587 
2588     btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2589   } else {
2590     btm_cb.paging = false;
2591   }
2592 }
2593 
2594 /*******************************************************************************
2595  *
2596  * Function         btm_acl_reset_paging
2597  *
2598  * Description      set paging to false and free the page queue - called at
2599  *                  hci_reset
2600  *
2601  ******************************************************************************/
btm_acl_reset_paging(void)2602 void btm_acl_reset_paging(void) {
2603   BT_HDR* p;
2604   BTM_TRACE_DEBUG("btm_acl_reset_paging");
2605   /* If we sent reset we are definitely not paging any more */
2606   while ((p = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2607     osi_free(p);
2608 
2609   btm_cb.paging = false;
2610 }
2611 
2612 /*******************************************************************************
2613  *
2614  * Function         btm_acl_paging
2615  *
2616  * Description      send a paging command or queue it in btm_cb
2617  *
2618  ******************************************************************************/
btm_acl_paging(BT_HDR * p,const RawAddress & bda)2619 void btm_acl_paging(BT_HDR* p, const RawAddress& bda) {
2620   tBTM_SEC_DEV_REC* p_dev_rec;
2621 
2622   VLOG(2) << __func__ << ":" << btm_cb.discing << " , paging:" << btm_cb.paging
2623           << " BDA: " << bda;
2624 
2625   if (btm_cb.discing) {
2626     btm_cb.paging = true;
2627     fixed_queue_enqueue(btm_cb.page_queue, p);
2628   } else {
2629     if (!BTM_ACL_IS_CONNECTED(bda)) {
2630       VLOG(1) << "connecting_bda: " << btm_cb.connecting_bda;
2631       if (btm_cb.paging && bda != btm_cb.connecting_bda) {
2632         fixed_queue_enqueue(btm_cb.page_queue, p);
2633       } else {
2634         p_dev_rec = btm_find_or_alloc_dev(bda);
2635         btm_cb.connecting_bda = p_dev_rec->bd_addr;
2636         memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2637 
2638         btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2639       }
2640 
2641       btm_cb.paging = true;
2642     } else /* ACL is already up */
2643     {
2644       btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2645     }
2646   }
2647 }
2648 
2649 /*******************************************************************************
2650  *
2651  * Function         btm_acl_notif_conn_collision
2652  *
2653  * Description      Send connection collision event to upper layer if registered
2654  *
2655  * Returns          true if sent out to upper layer,
2656  *                  false if no one needs the notification.
2657  *
2658  ******************************************************************************/
btm_acl_notif_conn_collision(const RawAddress & bda)2659 bool btm_acl_notif_conn_collision(const RawAddress& bda) {
2660   /* Report possible collision to the upper layer. */
2661   if (btm_cb.p_bl_changed_cb) {
2662     VLOG(1) << __func__ << " RemBdAddr: " << bda;
2663 
2664     tBTM_BL_EVENT_DATA evt_data;
2665     evt_data.event = BTM_BL_COLLISION_EVT;
2666     evt_data.conn.p_bda = &bda;
2667     evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2668     evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2669     (*btm_cb.p_bl_changed_cb)(&evt_data);
2670     return true;
2671   } else {
2672     return false;
2673   }
2674 }
2675 
2676 /*******************************************************************************
2677  *
2678  * Function         btm_acl_chk_peer_pkt_type_support
2679  *
2680  * Description      Check if peer supports requested packets
2681  *
2682  ******************************************************************************/
btm_acl_chk_peer_pkt_type_support(tACL_CONN * p,uint16_t * p_pkt_type)2683 void btm_acl_chk_peer_pkt_type_support(tACL_CONN* p, uint16_t* p_pkt_type) {
2684   /* 3 and 5 slot packets? */
2685   if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2686     *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 + BTM_ACL_PKT_TYPES_MASK_DM3);
2687 
2688   if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2689     *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2690 
2691   /* 2 and 3 MPS support? */
2692   if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2693     /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2694     *p_pkt_type |=
2695         (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2696          BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2697 
2698   if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2699     /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2700     *p_pkt_type |=
2701         (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2702          BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2703 
2704   /* EDR 3 and 5 slot support? */
2705   if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]) ||
2706       HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0])) {
2707     if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2708       /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types
2709        */
2710       *p_pkt_type |=
2711           (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2712 
2713     if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2714       /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types
2715        */
2716       *p_pkt_type |=
2717           (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2718   }
2719 }
2720