1 /******************************************************************************
2 *
3 * Copyright 2000-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /*****************************************************************************
20 *
21 * Name: btm_acl.cc
22 *
23 * Description: This file contains functions that handle ACL connections.
24 * This includes operations such as hold and sniff modes,
25 * supported packet types.
26 *
27 * This module contains both internal and external (API)
28 * functions. External (API) functions are distinguishable
29 * by their names beginning with uppercase BTM.
30 *
31 *
32 *****************************************************************************/
33
34 #define LOG_TAG "btm_acl"
35
36 #include <stddef.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40
41 #include "bt_common.h"
42 #include "bt_target.h"
43 #include "bt_types.h"
44 #include "bt_utils.h"
45 #include "btm_api.h"
46 #include "btm_int.h"
47 #include "btu.h"
48 #include "common/metrics.h"
49 #include "device/include/controller.h"
50 #include "device/include/interop.h"
51 #include "hcidefs.h"
52 #include "hcimsgs.h"
53 #include "l2c_int.h"
54 #include "osi/include/log.h"
55 #include "osi/include/osi.h"
56
57 static void btm_read_remote_features(uint16_t handle);
58 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
59 static void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
60 uint8_t num_read_pages);
61
62 /* 3 seconds timeout waiting for responses */
63 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
64
65 /*******************************************************************************
66 *
67 * Function btm_acl_init
68 *
69 * Description This function is called at BTM startup to initialize
70 *
71 * Returns void
72 *
73 ******************************************************************************/
btm_acl_init(void)74 void btm_acl_init(void) {
75 BTM_TRACE_DEBUG("btm_acl_init");
76 /* Initialize nonzero defaults */
77 btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
78 btm_cb.acl_disc_reason = 0xff;
79 }
80
81 /*******************************************************************************
82 *
83 * Function btm_bda_to_acl
84 *
85 * Description This function returns the FIRST acl_db entry for the passed
86 * BDA.
87 *
88 * Parameters bda : BD address of the remote device
89 * transport : Physical transport used for ACL connection
90 * (BR/EDR or LE)
91 *
92 * Returns Returns pointer to the ACL DB for the requested BDA if found.
93 * NULL if not found.
94 *
95 ******************************************************************************/
btm_bda_to_acl(const RawAddress & bda,tBT_TRANSPORT transport)96 tACL_CONN* btm_bda_to_acl(const RawAddress& bda, tBT_TRANSPORT transport) {
97 tACL_CONN* p = &btm_cb.acl_db[0];
98 uint16_t xx;
99 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
100 if ((p->in_use) && p->remote_addr == bda && p->transport == transport) {
101 BTM_TRACE_DEBUG("btm_bda_to_acl found");
102 return (p);
103 }
104 }
105
106 /* If here, no BD Addr found */
107 return ((tACL_CONN*)NULL);
108 }
109
110 /*******************************************************************************
111 *
112 * Function btm_handle_to_acl_index
113 *
114 * Description This function returns the FIRST acl_db entry for the passed
115 * hci_handle.
116 *
117 * Returns index to the acl_db or MAX_L2CAP_LINKS.
118 *
119 ******************************************************************************/
btm_handle_to_acl_index(uint16_t hci_handle)120 uint8_t btm_handle_to_acl_index(uint16_t hci_handle) {
121 tACL_CONN* p = &btm_cb.acl_db[0];
122 uint8_t xx;
123 BTM_TRACE_DEBUG("btm_handle_to_acl_index");
124 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
125 if ((p->in_use) && (p->hci_handle == hci_handle)) {
126 break;
127 }
128 }
129
130 /* If here, no BD Addr found */
131 return (xx);
132 }
133
134 #if (BLE_PRIVACY_SPT == TRUE)
135 /*******************************************************************************
136 *
137 * Function btm_ble_get_acl_remote_addr
138 *
139 * Description This function reads the active remote address used for the
140 * connection.
141 *
142 * Returns success return true, otherwise false.
143 *
144 ******************************************************************************/
btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC * p_dev_rec,RawAddress & conn_addr,tBLE_ADDR_TYPE * p_addr_type)145 bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec,
146 RawAddress& conn_addr,
147 tBLE_ADDR_TYPE* p_addr_type) {
148 bool st = true;
149
150 if (p_dev_rec == NULL) {
151 BTM_TRACE_ERROR("%s can not find device with matching address", __func__);
152 return false;
153 }
154
155 switch (p_dev_rec->ble.active_addr_type) {
156 case BTM_BLE_ADDR_PSEUDO:
157 conn_addr = p_dev_rec->bd_addr;
158 *p_addr_type = p_dev_rec->ble.ble_addr_type;
159 break;
160
161 case BTM_BLE_ADDR_RRA:
162 conn_addr = p_dev_rec->ble.cur_rand_addr;
163 *p_addr_type = BLE_ADDR_RANDOM;
164 break;
165
166 case BTM_BLE_ADDR_STATIC:
167 conn_addr = p_dev_rec->ble.identity_addr;
168 *p_addr_type = p_dev_rec->ble.identity_addr_type;
169 break;
170
171 default:
172 BTM_TRACE_ERROR("Unknown active address: %d",
173 p_dev_rec->ble.active_addr_type);
174 st = false;
175 break;
176 }
177
178 return st;
179 }
180 #endif
181 /*******************************************************************************
182 *
183 * Function btm_acl_created
184 *
185 * Description This function is called by L2CAP when an ACL connection
186 * is created.
187 *
188 * Returns void
189 *
190 ******************************************************************************/
btm_acl_created(const RawAddress & bda,DEV_CLASS dc,BD_NAME bdn,uint16_t hci_handle,uint8_t link_role,tBT_TRANSPORT transport)191 void btm_acl_created(const RawAddress& bda, DEV_CLASS dc, BD_NAME bdn,
192 uint16_t hci_handle, uint8_t link_role,
193 tBT_TRANSPORT transport) {
194 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
195 tACL_CONN* p;
196 uint8_t xx;
197
198 BTM_TRACE_DEBUG("%s: peer %s hci_handle=%d link_role=%d transport=%d",
199 __func__, bda.ToString().c_str(), hci_handle, link_role,
200 transport);
201 /* Ensure we don't have duplicates */
202 p = btm_bda_to_acl(bda, transport);
203 if (p != (tACL_CONN*)NULL) {
204 p->hci_handle = hci_handle;
205 p->link_role = link_role;
206 p->transport = transport;
207 VLOG(1) << "Duplicate btm_acl_created: RemBdAddr: " << bda;
208 BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
209 return;
210 }
211
212 /* Allocate acl_db entry */
213 for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++) {
214 if (!p->in_use) {
215 p->in_use = true;
216 p->hci_handle = hci_handle;
217 p->link_role = link_role;
218 p->link_up_issued = false;
219 p->remote_addr = bda;
220
221 p->transport = transport;
222 #if (BLE_PRIVACY_SPT == TRUE)
223 if (transport == BT_TRANSPORT_LE)
224 btm_ble_refresh_local_resolvable_private_addr(
225 bda, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
226 #else
227 p->conn_addr_type = BLE_ADDR_PUBLIC;
228 p->conn_addr = *controller_get_interface()->get_address();
229
230 #endif
231 p->switch_role_failed_attempts = 0;
232 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
233
234 btm_pm_sm_alloc(xx);
235
236 if (dc) memcpy(p->remote_dc, dc, DEV_CLASS_LEN);
237
238 if (bdn) memcpy(p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
239
240 /* if BR/EDR do something more */
241 if (transport == BT_TRANSPORT_BR_EDR) {
242 btsnd_hcic_read_rmt_clk_offset(p->hci_handle);
243 btsnd_hcic_rmt_ver_req(p->hci_handle);
244 }
245 p_dev_rec = btm_find_dev_by_handle(hci_handle);
246
247 if (p_dev_rec) {
248 BTM_TRACE_DEBUG("%s: peer %s device_type=0x%x", __func__,
249 bda.ToString().c_str(), p_dev_rec->device_type);
250 }
251
252 if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
253 /* If remote features already known, copy them and continue connection
254 * setup */
255 if ((p_dev_rec->num_read_pages) &&
256 (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
257 memcpy(p->peer_lmp_feature_pages, p_dev_rec->feature_pages,
258 (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
259 p->num_read_pages = p_dev_rec->num_read_pages;
260
261 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
262
263 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
264 btm_sec_set_peer_sec_caps(p, p_dev_rec);
265
266 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
267 if (req_pend) {
268 /* Request for remaining Security Features (if any) */
269 l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
270 }
271 btm_establish_continue(p);
272 return;
273 }
274 }
275
276 /* If here, features are not known yet */
277 if (p_dev_rec && transport == BT_TRANSPORT_LE) {
278 #if (BLE_PRIVACY_SPT == TRUE)
279 btm_ble_get_acl_remote_addr(p_dev_rec, p->active_remote_addr,
280 &p->active_remote_addr_type);
281 #endif
282
283 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(
284 controller_get_interface()->get_features_ble()->as_array) ||
285 link_role == HCI_ROLE_MASTER) {
286 btsnd_hcic_ble_read_remote_feat(p->hci_handle);
287 } else {
288 btm_establish_continue(p);
289 }
290 }
291
292 /* read page 1 - on rmt feature event for buffer reasons */
293 return;
294 }
295 }
296 }
297
btm_acl_update_conn_addr(uint16_t conn_handle,const RawAddress & address)298 void btm_acl_update_conn_addr(uint16_t conn_handle, const RawAddress& address) {
299 uint8_t idx = btm_handle_to_acl_index(conn_handle);
300 if (idx != MAX_L2CAP_LINKS) {
301 btm_cb.acl_db[idx].conn_addr = address;
302 }
303 }
304
305 /*******************************************************************************
306 *
307 * Function btm_acl_report_role_change
308 *
309 * Description This function is called when the local device is deemed
310 * to be down. It notifies L2CAP of the failure.
311 *
312 * Returns void
313 *
314 ******************************************************************************/
btm_acl_report_role_change(uint8_t hci_status,const RawAddress * bda)315 void btm_acl_report_role_change(uint8_t hci_status, const RawAddress* bda) {
316 tBTM_ROLE_SWITCH_CMPL ref_data;
317 BTM_TRACE_DEBUG("btm_acl_report_role_change");
318 if (btm_cb.devcb.p_switch_role_cb &&
319 (bda && btm_cb.devcb.switch_role_ref_data.remote_bd_addr == *bda)) {
320 memcpy(&ref_data, &btm_cb.devcb.switch_role_ref_data,
321 sizeof(tBTM_ROLE_SWITCH_CMPL));
322 ref_data.hci_status = hci_status;
323 (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
324 memset(&btm_cb.devcb.switch_role_ref_data, 0,
325 sizeof(tBTM_ROLE_SWITCH_CMPL));
326 btm_cb.devcb.p_switch_role_cb = NULL;
327 }
328 }
329
330 /*******************************************************************************
331 *
332 * Function btm_acl_removed
333 *
334 * Description This function is called by L2CAP when an ACL connection
335 * is removed. Since only L2CAP creates ACL links, we use
336 * the L2CAP link index as our index into the control blocks.
337 *
338 * Returns void
339 *
340 ******************************************************************************/
btm_acl_removed(const RawAddress & bda,tBT_TRANSPORT transport)341 void btm_acl_removed(const RawAddress& bda, tBT_TRANSPORT transport) {
342 tACL_CONN* p;
343 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
344 BTM_TRACE_DEBUG("btm_acl_removed");
345 p = btm_bda_to_acl(bda, transport);
346 if (p != (tACL_CONN*)NULL) {
347 p->in_use = false;
348
349 /* if the disconnected channel has a pending role switch, clear it now */
350 btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, &bda);
351
352 /* Only notify if link up has had a chance to be issued */
353 if (p->link_up_issued) {
354 p->link_up_issued = false;
355
356 /* If anyone cares, indicate the database changed */
357 if (btm_cb.p_bl_changed_cb) {
358 tBTM_BL_EVENT_DATA evt_data;
359 evt_data.event = BTM_BL_DISCN_EVT;
360 evt_data.discn.p_bda = &bda;
361 evt_data.discn.handle = p->hci_handle;
362 evt_data.discn.transport = p->transport;
363 (*btm_cb.p_bl_changed_cb)(&evt_data);
364 }
365
366 btm_acl_update_busy_level(BTM_BLI_ACL_DOWN_EVT);
367 }
368
369 BTM_TRACE_DEBUG(
370 "acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
371 p->hci_handle, p->transport, btm_cb.ble_ctr_cb.inq_var.connectable_mode,
372 p->link_role);
373
374 p_dev_rec = btm_find_dev(bda);
375 if (p_dev_rec) {
376 BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x",
377 p_dev_rec->sec_flags);
378 if (p->transport == BT_TRANSPORT_LE) {
379 BTM_TRACE_DEBUG("LE link down");
380 p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
381 if ((p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0) {
382 BTM_TRACE_DEBUG("Not Bonded");
383 p_dev_rec->sec_flags &=
384 ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
385 } else {
386 BTM_TRACE_DEBUG("Bonded");
387 }
388 } else {
389 BTM_TRACE_DEBUG("Bletooth link down");
390 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED |
391 BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
392 }
393 BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x",
394 p_dev_rec->sec_flags);
395 } else {
396 BTM_TRACE_ERROR("Device not found");
397 }
398
399 /* Clear the ACL connection data */
400 memset(p, 0, sizeof(tACL_CONN));
401 }
402 }
403
404 /*******************************************************************************
405 *
406 * Function btm_acl_device_down
407 *
408 * Description This function is called when the local device is deemed
409 * to be down. It notifies L2CAP of the failure.
410 *
411 * Returns void
412 *
413 ******************************************************************************/
btm_acl_device_down(void)414 void btm_acl_device_down(void) {
415 tACL_CONN* p = &btm_cb.acl_db[0];
416 uint16_t xx;
417 BTM_TRACE_DEBUG("btm_acl_device_down");
418 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
419 if (p->in_use) {
420 BTM_TRACE_DEBUG("hci_handle=%d HCI_ERR_HW_FAILURE ", p->hci_handle);
421 l2c_link_hci_disc_comp(p->hci_handle, HCI_ERR_HW_FAILURE);
422 }
423 }
424 }
425
426 /*******************************************************************************
427 *
428 * Function btm_acl_update_busy_level
429 *
430 * Description This function is called to update the busy level of the
431 * system.
432 *
433 * Returns void
434 *
435 ******************************************************************************/
btm_acl_update_busy_level(tBTM_BLI_EVENT event)436 void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
437 bool old_inquiry_state = btm_cb.is_inquiry;
438 tBTM_BL_UPDATE_DATA evt;
439 evt.busy_level_flags = 0;
440 switch (event) {
441 case BTM_BLI_ACL_UP_EVT:
442 BTM_TRACE_DEBUG("BTM_BLI_ACL_UP_EVT");
443 break;
444 case BTM_BLI_ACL_DOWN_EVT:
445 BTM_TRACE_DEBUG("BTM_BLI_ACL_DOWN_EVT");
446 break;
447 case BTM_BLI_PAGE_EVT:
448 BTM_TRACE_DEBUG("BTM_BLI_PAGE_EVT");
449 btm_cb.is_paging = true;
450 evt.busy_level_flags = BTM_BL_PAGING_STARTED;
451 break;
452 case BTM_BLI_PAGE_DONE_EVT:
453 BTM_TRACE_DEBUG("BTM_BLI_PAGE_DONE_EVT");
454 btm_cb.is_paging = false;
455 evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
456 break;
457 case BTM_BLI_INQ_EVT:
458 BTM_TRACE_DEBUG("BTM_BLI_INQ_EVT");
459 btm_cb.is_inquiry = true;
460 evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
461 break;
462 case BTM_BLI_INQ_CANCEL_EVT:
463 BTM_TRACE_DEBUG("BTM_BLI_INQ_CANCEL_EVT");
464 btm_cb.is_inquiry = false;
465 evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
466 break;
467 case BTM_BLI_INQ_DONE_EVT:
468 BTM_TRACE_DEBUG("BTM_BLI_INQ_DONE_EVT");
469 btm_cb.is_inquiry = false;
470 evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
471 break;
472 }
473
474 uint8_t busy_level;
475 if (btm_cb.is_paging || btm_cb.is_inquiry)
476 busy_level = 10;
477 else
478 busy_level = BTM_GetNumAclLinks();
479
480 if ((busy_level != btm_cb.busy_level) ||
481 (old_inquiry_state != btm_cb.is_inquiry)) {
482 evt.event = BTM_BL_UPDATE_EVT;
483 evt.busy_level = busy_level;
484 btm_cb.busy_level = busy_level;
485 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
486 tBTM_BL_EVENT_DATA btm_bl_event_data;
487 btm_bl_event_data.update = evt;
488 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
489 }
490 }
491 }
492
493 /*******************************************************************************
494 *
495 * Function BTM_GetRole
496 *
497 * Description This function is called to get the role of the local device
498 * for the ACL connection with the specified remote device
499 *
500 * Returns BTM_SUCCESS if connection exists.
501 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
502 *
503 ******************************************************************************/
BTM_GetRole(const RawAddress & remote_bd_addr,uint8_t * p_role)504 tBTM_STATUS BTM_GetRole(const RawAddress& remote_bd_addr, uint8_t* p_role) {
505 tACL_CONN* p;
506 BTM_TRACE_DEBUG("BTM_GetRole");
507 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
508 if (p == NULL) {
509 *p_role = BTM_ROLE_UNDEFINED;
510 return (BTM_UNKNOWN_ADDR);
511 }
512
513 /* Get the current role */
514 *p_role = p->link_role;
515 return (BTM_SUCCESS);
516 }
517
518 /*******************************************************************************
519 *
520 * Function BTM_SwitchRole
521 *
522 * Description This function is called to switch role between master and
523 * slave. If role is already set it will do nothing. If the
524 * command was initiated, the callback function is called upon
525 * completion.
526 *
527 * Returns BTM_SUCCESS if already in specified role.
528 * BTM_CMD_STARTED if command issued to controller.
529 * BTM_NO_RESOURCES if couldn't allocate memory to issue
530 * command
531 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
532 * BTM_MODE_UNSUPPORTED if local device does not support role
533 * switching
534 * BTM_BUSY if the previous command is not completed
535 *
536 ******************************************************************************/
BTM_SwitchRole(const RawAddress & remote_bd_addr,uint8_t new_role,tBTM_CMPL_CB * p_cb)537 tBTM_STATUS BTM_SwitchRole(const RawAddress& remote_bd_addr, uint8_t new_role,
538 tBTM_CMPL_CB* p_cb) {
539 tACL_CONN* p;
540 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
541 bool is_sco_active;
542 tBTM_STATUS status;
543 tBTM_PM_MODE pwr_mode;
544 tBTM_PM_PWR_MD settings;
545
546 LOG_INFO(LOG_TAG, "%s: peer %s new_role=0x%x p_cb=%p p_switch_role_cb=%p",
547 __func__, remote_bd_addr.ToString().c_str(), new_role, p_cb,
548 btm_cb.devcb.p_switch_role_cb);
549
550 /* Make sure the local device supports switching */
551 if (!controller_get_interface()->supports_master_slave_role_switch())
552 return (BTM_MODE_UNSUPPORTED);
553
554 if (btm_cb.devcb.p_switch_role_cb && p_cb) {
555 VLOG(2) << "Role switch on other device is in progress "
556 << btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
557 return (BTM_BUSY);
558 }
559
560 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
561 if (p == NULL) return (BTM_UNKNOWN_ADDR);
562
563 /* Finished if already in desired role */
564 if (p->link_role == new_role) return (BTM_SUCCESS);
565
566 if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH, &remote_bd_addr))
567 return BTM_DEV_BLACKLISTED;
568
569 /* Check if there is any SCO Active on this BD Address */
570 is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
571
572 if (is_sco_active) return (BTM_NO_RESOURCES);
573
574 /* Ignore role switch request if the previous request was not completed */
575 if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE) {
576 BTM_TRACE_DEBUG("BTM_SwitchRole busy: %d", p->switch_role_state);
577 return (BTM_BUSY);
578 }
579
580 if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &remote_bd_addr)) {
581 BTM_TRACE_DEBUG("%s, Device blacklisted under INTEROP_DYNAMIC_ROLE_SWITCH.",
582 __func__);
583 return BTM_DEV_BLACKLISTED;
584 }
585
586 status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode);
587 if (status != BTM_SUCCESS) return (status);
588
589 /* Wake up the link if in sniff or park before attempting switch */
590 if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF) {
591 memset((void*)&settings, 0, sizeof(settings));
592 settings.mode = BTM_PM_MD_ACTIVE;
593 status = BTM_SetPowerMode(BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
594 if (status != BTM_CMD_STARTED) return (BTM_WRONG_MODE);
595
596 p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
597 }
598 /* some devices do not support switch while encryption is on */
599 else {
600 p_dev_rec = btm_find_dev(remote_bd_addr);
601 if ((p_dev_rec != NULL) &&
602 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
603 !BTM_EPR_AVAILABLE(p)) {
604 /* bypass turning off encryption if change link key is already doing it */
605 if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF) {
606 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
607 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
608 }
609
610 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
611 } else {
612 btsnd_hcic_switch_role(remote_bd_addr, new_role);
613 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
614
615 #if (BTM_DISC_DURING_RS == TRUE)
616 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
617 #endif
618 }
619 }
620
621 /* Initialize return structure in case request fails */
622 if (p_cb) {
623 btm_cb.devcb.switch_role_ref_data.remote_bd_addr = remote_bd_addr;
624 btm_cb.devcb.switch_role_ref_data.role = new_role;
625 /* initialized to an error code */
626 btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
627 btm_cb.devcb.p_switch_role_cb = p_cb;
628 }
629 return (BTM_CMD_STARTED);
630 }
631
632 /*******************************************************************************
633 *
634 * Function btm_acl_encrypt_change
635 *
636 * Description This function is when encryption of the connection is
637 * completed by the LM. Checks to see if a role switch or
638 * change of link key was active and initiates or continues
639 * process if needed.
640 *
641 * Returns void
642 *
643 ******************************************************************************/
btm_acl_encrypt_change(uint16_t handle,uint8_t status,uint8_t encr_enable)644 void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
645 uint8_t encr_enable) {
646 tACL_CONN* p;
647 uint8_t xx;
648 tBTM_SEC_DEV_REC* p_dev_rec;
649
650 BTM_TRACE_DEBUG("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
651 handle, status, encr_enable);
652 xx = btm_handle_to_acl_index(handle);
653 /* don't assume that we can never get a bad hci_handle */
654 if (xx < MAX_L2CAP_LINKS)
655 p = &btm_cb.acl_db[xx];
656 else
657 return;
658
659 /* Process Role Switch if active */
660 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF) {
661 /* if encryption turn off failed we still will try to switch role */
662 if (encr_enable) {
663 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
664 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
665 } else {
666 p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
667 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
668 }
669
670 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
671 #if (BTM_DISC_DURING_RS == TRUE)
672 p_dev_rec = btm_find_dev(p->remote_addr);
673 if (p_dev_rec != NULL) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
674 #endif
675
676 }
677 /* Finished enabling Encryption after role switch */
678 else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON) {
679 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
680 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
681 btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status,
682 &p->remote_addr);
683
684 /* if role change event is registered, report it now */
685 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
686 tBTM_BL_ROLE_CHG_DATA evt;
687 evt.event = BTM_BL_ROLE_CHG_EVT;
688 evt.new_role = btm_cb.devcb.switch_role_ref_data.role;
689 evt.p_bda = &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
690 evt.hci_status = btm_cb.devcb.switch_role_ref_data.hci_status;
691 tBTM_BL_EVENT_DATA btm_bl_event_data;
692 btm_bl_event_data.role_chg = evt;
693 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
694
695 BTM_TRACE_DEBUG(
696 "%s: Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
697 __func__, evt.new_role, evt.hci_status, p->switch_role_state);
698 }
699
700 #if (BTM_DISC_DURING_RS == TRUE)
701 /* If a disconnect is pending, issue it now that role switch has completed
702 */
703 p_dev_rec = btm_find_dev(p->remote_addr);
704 if (p_dev_rec != NULL) {
705 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
706 BTM_TRACE_WARNING(
707 "btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
708 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
709 }
710 BTM_TRACE_ERROR(
711 "btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
712 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
713 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
714 }
715 #endif
716 }
717 }
718 /*******************************************************************************
719 *
720 * Function BTM_SetLinkPolicy
721 *
722 * Description Create and send HCI "Write Policy Set" command
723 *
724 * Returns status of the operation
725 *
726 ******************************************************************************/
BTM_SetLinkPolicy(const RawAddress & remote_bda,uint16_t * settings)727 tBTM_STATUS BTM_SetLinkPolicy(const RawAddress& remote_bda,
728 uint16_t* settings) {
729 tACL_CONN* p;
730 uint8_t* localFeatures = BTM_ReadLocalFeatures();
731 BTM_TRACE_DEBUG("%s", __func__);
732 /* BTM_TRACE_API ("%s: requested settings: 0x%04x", __func__, *settings ); */
733
734 /* First, check if hold mode is supported */
735 if (*settings != HCI_DISABLE_ALL_LM_MODES) {
736 if ((*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
737 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
738 *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
739 BTM_TRACE_API("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)",
740 *settings);
741 }
742 if ((*settings & HCI_ENABLE_HOLD_MODE) &&
743 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
744 *settings &= (~HCI_ENABLE_HOLD_MODE);
745 BTM_TRACE_API("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)",
746 *settings);
747 }
748 if ((*settings & HCI_ENABLE_SNIFF_MODE) &&
749 ((!HCI_SNIFF_MODE_SUPPORTED(localFeatures)) ||
750 interop_match_addr(INTEROP_DISABLE_SNIFF, &remote_bda))) {
751 *settings &= (~HCI_ENABLE_SNIFF_MODE);
752 BTM_TRACE_API("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)",
753 *settings);
754 }
755 if ((*settings & HCI_ENABLE_PARK_MODE) &&
756 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
757 *settings &= (~HCI_ENABLE_PARK_MODE);
758 BTM_TRACE_API("BTM_SetLinkPolicy park not supported (settings: 0x%04x)",
759 *settings);
760 }
761 }
762
763 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
764 if (p != NULL) {
765 btsnd_hcic_write_policy_set(p->hci_handle, *settings);
766 return BTM_CMD_STARTED;
767 }
768
769 /* If here, no BD Addr found */
770 return (BTM_UNKNOWN_ADDR);
771 }
772
773 /*******************************************************************************
774 *
775 * Function BTM_SetDefaultLinkPolicy
776 *
777 * Description Set the default value for HCI "Write Policy Set" command
778 * to use when an ACL link is created.
779 *
780 * Returns void
781 *
782 ******************************************************************************/
BTM_SetDefaultLinkPolicy(uint16_t settings)783 void BTM_SetDefaultLinkPolicy(uint16_t settings) {
784 uint8_t* localFeatures = BTM_ReadLocalFeatures();
785
786 BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
787
788 if ((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
789 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
790 settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
791 BTM_TRACE_DEBUG(
792 "BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)",
793 settings);
794 }
795 if ((settings & HCI_ENABLE_HOLD_MODE) &&
796 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
797 settings &= ~HCI_ENABLE_HOLD_MODE;
798 BTM_TRACE_DEBUG(
799 "BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)",
800 settings);
801 }
802 if ((settings & HCI_ENABLE_SNIFF_MODE) &&
803 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
804 settings &= ~HCI_ENABLE_SNIFF_MODE;
805 BTM_TRACE_DEBUG(
806 "BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)",
807 settings);
808 }
809 if ((settings & HCI_ENABLE_PARK_MODE) &&
810 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
811 settings &= ~HCI_ENABLE_PARK_MODE;
812 BTM_TRACE_DEBUG(
813 "BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)",
814 settings);
815 }
816 BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
817
818 btm_cb.btm_def_link_policy = settings;
819
820 /* Set the default Link Policy of the controller */
821 btsnd_hcic_write_def_policy_set(settings);
822 }
823
btm_use_preferred_conn_params(const RawAddress & bda)824 void btm_use_preferred_conn_params(const RawAddress& bda) {
825 tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
826 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
827
828 /* If there are any preferred connection parameters, set them now */
829 if ((p_lcb != NULL) && (p_dev_rec != NULL) &&
830 (p_dev_rec->conn_params.min_conn_int >= BTM_BLE_CONN_INT_MIN) &&
831 (p_dev_rec->conn_params.min_conn_int <= BTM_BLE_CONN_INT_MAX) &&
832 (p_dev_rec->conn_params.max_conn_int >= BTM_BLE_CONN_INT_MIN) &&
833 (p_dev_rec->conn_params.max_conn_int <= BTM_BLE_CONN_INT_MAX) &&
834 (p_dev_rec->conn_params.slave_latency <= BTM_BLE_CONN_LATENCY_MAX) &&
835 (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
836 (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
837 ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
838 p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
839 (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
840 (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
841 (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout))) {
842 BTM_TRACE_DEBUG(
843 "%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d "
844 "supervision_tout=%d",
845 __func__, p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
846 p_dev_rec->conn_params.max_conn_int,
847 p_dev_rec->conn_params.slave_latency,
848 p_dev_rec->conn_params.supervision_tout);
849
850 p_lcb->min_interval = p_dev_rec->conn_params.min_conn_int;
851 p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
852 p_lcb->timeout = p_dev_rec->conn_params.supervision_tout;
853 p_lcb->latency = p_dev_rec->conn_params.slave_latency;
854
855 btsnd_hcic_ble_upd_ll_conn_params(
856 p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
857 p_dev_rec->conn_params.max_conn_int,
858 p_dev_rec->conn_params.slave_latency,
859 p_dev_rec->conn_params.supervision_tout, 0, 0);
860 }
861 }
862
863 /*******************************************************************************
864 *
865 * Function btm_read_remote_version_complete
866 *
867 * Description This function is called when the command complete message
868 * is received from the HCI for the remote version info.
869 *
870 * Returns void
871 *
872 ******************************************************************************/
btm_read_remote_version_complete(uint8_t * p)873 void btm_read_remote_version_complete(uint8_t* p) {
874 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
875 uint8_t status;
876 uint16_t handle;
877 int xx;
878 BTM_TRACE_DEBUG("btm_read_remote_version_complete");
879
880 STREAM_TO_UINT8(status, p);
881 STREAM_TO_UINT16(handle, p);
882
883 /* Look up the connection by handle and copy features */
884 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++) {
885 if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle)) {
886 if (status == HCI_SUCCESS) {
887 STREAM_TO_UINT8(p_acl_cb->lmp_version, p);
888 STREAM_TO_UINT16(p_acl_cb->manufacturer, p);
889 STREAM_TO_UINT16(p_acl_cb->lmp_subversion, p);
890
891 if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
892 btm_read_remote_features(p_acl_cb->hci_handle);
893 }
894 bluetooth::common::LogRemoteVersionInfo(
895 handle, status, p_acl_cb->lmp_version, p_acl_cb->manufacturer,
896 p_acl_cb->lmp_subversion);
897 } else {
898 bluetooth::common::LogRemoteVersionInfo(handle, status, 0, 0, 0);
899 }
900
901 if (p_acl_cb->transport == BT_TRANSPORT_LE) {
902 l2cble_notify_le_connection(p_acl_cb->remote_addr);
903 btm_use_preferred_conn_params(p_acl_cb->remote_addr);
904 }
905 break;
906 }
907 }
908 }
909
910 /*******************************************************************************
911 *
912 * Function btm_process_remote_ext_features
913 *
914 * Description Local function called to process all extended features pages
915 * read from a remote device.
916 *
917 * Returns void
918 *
919 ******************************************************************************/
btm_process_remote_ext_features(tACL_CONN * p_acl_cb,uint8_t num_read_pages)920 void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
921 uint8_t num_read_pages) {
922 uint16_t handle = p_acl_cb->hci_handle;
923 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
924 uint8_t page_idx;
925
926 BTM_TRACE_DEBUG("btm_process_remote_ext_features");
927
928 /* Make sure we have the record to save remote features information */
929 if (p_dev_rec == NULL) {
930 /* Get a new device; might be doing dedicated bonding */
931 p_dev_rec = btm_find_or_alloc_dev(p_acl_cb->remote_addr);
932 }
933
934 p_acl_cb->num_read_pages = num_read_pages;
935 p_dev_rec->num_read_pages = num_read_pages;
936
937 /* Move the pages to placeholder */
938 for (page_idx = 0; page_idx < num_read_pages; page_idx++) {
939 if (page_idx > HCI_EXT_FEATURES_PAGE_MAX) {
940 BTM_TRACE_ERROR("%s: page=%d unexpected", __func__, page_idx);
941 break;
942 }
943 memcpy(p_dev_rec->feature_pages[page_idx],
944 p_acl_cb->peer_lmp_feature_pages[page_idx],
945 HCI_FEATURE_BYTES_PER_PAGE);
946 }
947
948 if (!(p_dev_rec->sec_flags & BTM_SEC_NAME_KNOWN) ||
949 p_dev_rec->is_originator) {
950 BTM_TRACE_DEBUG("%s: Calling Next Security Procedure", __func__);
951 uint8_t status = btm_sec_execute_procedure(p_dev_rec);
952 if (status != BTM_CMD_STARTED) {
953 BTM_TRACE_ERROR("%s: Security procedure not started! status %d", __func__,
954 status);
955 btm_sec_dev_rec_cback_event(p_dev_rec, status, false);
956 }
957 }
958 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
959
960 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
961 btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
962
963 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
964 if (req_pend) {
965 /* Request for remaining Security Features (if any) */
966 l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
967 }
968 }
969
970 /*******************************************************************************
971 *
972 * Function btm_read_remote_features
973 *
974 * Description Local function called to send a read remote supported
975 * features/remote extended features page[0].
976 *
977 * Returns void
978 *
979 ******************************************************************************/
btm_read_remote_features(uint16_t handle)980 void btm_read_remote_features(uint16_t handle) {
981 uint8_t acl_idx;
982 tACL_CONN* p_acl_cb;
983
984 BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
985
986 acl_idx = btm_handle_to_acl_index(handle);
987 if (acl_idx >= MAX_L2CAP_LINKS) {
988 BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
989 return;
990 }
991
992 p_acl_cb = &btm_cb.acl_db[acl_idx];
993 p_acl_cb->num_read_pages = 0;
994 memset(p_acl_cb->peer_lmp_feature_pages, 0,
995 sizeof(p_acl_cb->peer_lmp_feature_pages));
996
997 /* first send read remote supported features HCI command */
998 /* because we don't know whether the remote support extended feature command
999 */
1000 btsnd_hcic_rmt_features_req(handle);
1001 }
1002
1003 /*******************************************************************************
1004 *
1005 * Function btm_read_remote_ext_features
1006 *
1007 * Description Local function called to send a read remote extended
1008 * features
1009 *
1010 * Returns void
1011 *
1012 ******************************************************************************/
btm_read_remote_ext_features(uint16_t handle,uint8_t page_number)1013 void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number) {
1014 BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle,
1015 page_number);
1016
1017 btsnd_hcic_rmt_ext_features(handle, page_number);
1018 }
1019
1020 /*******************************************************************************
1021 *
1022 * Function btm_read_remote_features_complete
1023 *
1024 * Description This function is called when the remote supported features
1025 * complete event is received from the HCI.
1026 *
1027 * Returns void
1028 *
1029 ******************************************************************************/
btm_read_remote_features_complete(uint8_t * p)1030 void btm_read_remote_features_complete(uint8_t* p) {
1031 tACL_CONN* p_acl_cb;
1032 uint8_t status;
1033 uint16_t handle;
1034 uint8_t acl_idx;
1035
1036 BTM_TRACE_DEBUG("btm_read_remote_features_complete");
1037 STREAM_TO_UINT8(status, p);
1038
1039 if (status != HCI_SUCCESS) {
1040 BTM_TRACE_ERROR("btm_read_remote_features_complete failed (status 0x%02x)",
1041 status);
1042 return;
1043 }
1044
1045 STREAM_TO_UINT16(handle, p);
1046
1047 acl_idx = btm_handle_to_acl_index(handle);
1048 if (acl_idx >= MAX_L2CAP_LINKS) {
1049 BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid",
1050 handle);
1051 return;
1052 }
1053
1054 p_acl_cb = &btm_cb.acl_db[acl_idx];
1055
1056 /* Copy the received features page */
1057 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[0], p,
1058 HCI_FEATURE_BYTES_PER_PAGE);
1059
1060 if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_feature_pages[0])) &&
1061 (controller_get_interface()
1062 ->supports_reading_remote_extended_features())) {
1063 /* if the remote controller has extended features and local controller
1064 supports HCI_Read_Remote_Extended_Features command then start reading
1065 these feature starting with extended features page 1 */
1066 BTM_TRACE_DEBUG("Start reading remote extended features");
1067 btm_read_remote_ext_features(handle, 1);
1068 return;
1069 }
1070
1071 /* Remote controller has no extended features. Process remote controller
1072 supported features (features page 0). */
1073 btm_process_remote_ext_features(p_acl_cb, 1);
1074
1075 /* Continue with HCI connection establishment */
1076 btm_establish_continue(p_acl_cb);
1077 }
1078
1079 /*******************************************************************************
1080 *
1081 * Function btm_read_remote_ext_features_complete
1082 *
1083 * Description This function is called when the remote extended features
1084 * complete event is received from the HCI.
1085 *
1086 * Returns void
1087 *
1088 ******************************************************************************/
btm_read_remote_ext_features_complete(uint8_t * p,uint8_t evt_len)1089 void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
1090 tACL_CONN* p_acl_cb;
1091 uint8_t page_num, max_page;
1092 uint16_t handle;
1093 uint8_t acl_idx;
1094
1095 BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
1096
1097 if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
1098 android_errorWriteLog(0x534e4554, "141552859");
1099 BTM_TRACE_ERROR(
1100 "btm_read_remote_ext_features_complete evt length too short. length=%d",
1101 evt_len);
1102 return;
1103 }
1104
1105 ++p;
1106 STREAM_TO_UINT16(handle, p);
1107 STREAM_TO_UINT8(page_num, p);
1108 STREAM_TO_UINT8(max_page, p);
1109
1110 /* Validate parameters */
1111 acl_idx = btm_handle_to_acl_index(handle);
1112 if (acl_idx >= MAX_L2CAP_LINKS) {
1113 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid",
1114 handle);
1115 return;
1116 }
1117
1118 if (max_page > HCI_EXT_FEATURES_PAGE_MAX) {
1119 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown",
1120 max_page);
1121 return;
1122 }
1123
1124 if (page_num > HCI_EXT_FEATURES_PAGE_MAX) {
1125 android_errorWriteLog(0x534e4554, "141552859");
1126 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",
1127 page_num);
1128 return;
1129 }
1130
1131 if (page_num > max_page) {
1132 BTM_TRACE_WARNING(
1133 "btm_read_remote_ext_features_complete num_page=%d, max_page=%d "
1134 "invalid", page_num, max_page);
1135 }
1136
1137 p_acl_cb = &btm_cb.acl_db[acl_idx];
1138
1139 /* Copy the received features page */
1140 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[page_num], p,
1141 HCI_FEATURE_BYTES_PER_PAGE);
1142
1143 /* If there is the next remote features page and
1144 * we have space to keep this page data - read this page */
1145 if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX)) {
1146 page_num++;
1147 BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)",
1148 page_num);
1149 btm_read_remote_ext_features(handle, page_num);
1150 return;
1151 }
1152
1153 /* Reading of remote feature pages is complete */
1154 BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)",
1155 page_num);
1156
1157 /* Process the pages */
1158 btm_process_remote_ext_features(p_acl_cb, (uint8_t)(page_num + 1));
1159
1160 /* Continue with HCI connection establishment */
1161 btm_establish_continue(p_acl_cb);
1162 }
1163
1164 /*******************************************************************************
1165 *
1166 * Function btm_read_remote_ext_features_failed
1167 *
1168 * Description This function is called when the remote extended features
1169 * complete event returns a failed status.
1170 *
1171 * Returns void
1172 *
1173 ******************************************************************************/
btm_read_remote_ext_features_failed(uint8_t status,uint16_t handle)1174 void btm_read_remote_ext_features_failed(uint8_t status, uint16_t handle) {
1175 tACL_CONN* p_acl_cb;
1176 uint8_t acl_idx;
1177
1178 BTM_TRACE_WARNING(
1179 "btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1180 status, handle);
1181
1182 acl_idx = btm_handle_to_acl_index(handle);
1183 if (acl_idx >= MAX_L2CAP_LINKS) {
1184 BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid",
1185 handle);
1186 return;
1187 }
1188
1189 p_acl_cb = &btm_cb.acl_db[acl_idx];
1190
1191 /* Process supported features only */
1192 btm_process_remote_ext_features(p_acl_cb, 1);
1193
1194 /* Continue HCI connection establishment */
1195 btm_establish_continue(p_acl_cb);
1196 }
1197
1198 /*******************************************************************************
1199 *
1200 * Function btm_establish_continue
1201 *
1202 * Description This function is called when the command complete message
1203 * is received from the HCI for the read local link policy
1204 * request.
1205 *
1206 * Returns void
1207 *
1208 ******************************************************************************/
btm_establish_continue(tACL_CONN * p_acl_cb)1209 void btm_establish_continue(tACL_CONN* p_acl_cb) {
1210 tBTM_BL_EVENT_DATA evt_data;
1211 BTM_TRACE_DEBUG("btm_establish_continue");
1212 #if (BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1213 if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
1214 /* For now there are a some devices that do not like sending */
1215 /* commands events and data at the same time. */
1216 /* Set the packet types to the default allowed by the device */
1217 btm_set_packet_types(p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1218
1219 if (btm_cb.btm_def_link_policy)
1220 BTM_SetLinkPolicy(p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1221 }
1222 #endif
1223 if (p_acl_cb->link_up_issued) {
1224 BTM_TRACE_ERROR("%s: Already link is up ", __func__);
1225 return;
1226 }
1227 p_acl_cb->link_up_issued = true;
1228
1229 /* If anyone cares, tell him database changed */
1230 if (btm_cb.p_bl_changed_cb) {
1231 evt_data.event = BTM_BL_CONN_EVT;
1232 evt_data.conn.p_bda = &p_acl_cb->remote_addr;
1233 evt_data.conn.p_bdn = p_acl_cb->remote_name;
1234 evt_data.conn.p_dc = p_acl_cb->remote_dc;
1235 evt_data.conn.p_features = p_acl_cb->peer_lmp_feature_pages[0];
1236 evt_data.conn.handle = p_acl_cb->hci_handle;
1237 evt_data.conn.transport = p_acl_cb->transport;
1238
1239 (*btm_cb.p_bl_changed_cb)(&evt_data);
1240 }
1241 btm_acl_update_busy_level(BTM_BLI_ACL_UP_EVT);
1242 }
1243
1244 /*******************************************************************************
1245 *
1246 * Function BTM_SetDefaultLinkSuperTout
1247 *
1248 * Description Set the default value for HCI "Write Link Supervision
1249 * Timeout"
1250 * command to use when an ACL link is created.
1251 *
1252 * Returns void
1253 *
1254 ******************************************************************************/
BTM_SetDefaultLinkSuperTout(uint16_t timeout)1255 void BTM_SetDefaultLinkSuperTout(uint16_t timeout) {
1256 BTM_TRACE_DEBUG("BTM_SetDefaultLinkSuperTout");
1257 btm_cb.btm_def_link_super_tout = timeout;
1258 }
1259
1260 /*******************************************************************************
1261 *
1262 * Function BTM_GetLinkSuperTout
1263 *
1264 * Description Read the link supervision timeout value of the connection
1265 *
1266 * Returns status of the operation
1267 *
1268 ******************************************************************************/
BTM_GetLinkSuperTout(const RawAddress & remote_bda,uint16_t * p_timeout)1269 tBTM_STATUS BTM_GetLinkSuperTout(const RawAddress& remote_bda,
1270 uint16_t* p_timeout) {
1271 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1272
1273 BTM_TRACE_DEBUG("BTM_GetLinkSuperTout");
1274 if (p != (tACL_CONN*)NULL) {
1275 *p_timeout = p->link_super_tout;
1276 return (BTM_SUCCESS);
1277 }
1278 /* If here, no BD Addr found */
1279 return (BTM_UNKNOWN_ADDR);
1280 }
1281
1282 /*******************************************************************************
1283 *
1284 * Function BTM_SetLinkSuperTout
1285 *
1286 * Description Create and send HCI "Write Link Supervision Timeout" command
1287 *
1288 * Returns status of the operation
1289 *
1290 ******************************************************************************/
BTM_SetLinkSuperTout(const RawAddress & remote_bda,uint16_t timeout)1291 tBTM_STATUS BTM_SetLinkSuperTout(const RawAddress& remote_bda,
1292 uint16_t timeout) {
1293 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1294
1295 BTM_TRACE_DEBUG("BTM_SetLinkSuperTout");
1296 if (p != (tACL_CONN*)NULL) {
1297 p->link_super_tout = timeout;
1298
1299 /* Only send if current role is Master; 2.0 spec requires this */
1300 if (p->link_role == BTM_ROLE_MASTER) {
1301 btsnd_hcic_write_link_super_tout(LOCAL_BR_EDR_CONTROLLER_ID,
1302 p->hci_handle, timeout);
1303 return (BTM_CMD_STARTED);
1304 } else {
1305 return (BTM_SUCCESS);
1306 }
1307 }
1308
1309 /* If here, no BD Addr found */
1310 return (BTM_UNKNOWN_ADDR);
1311 }
1312
1313 /*******************************************************************************
1314 *
1315 * Function BTM_IsAclConnectionUp
1316 *
1317 * Description This function is called to check if an ACL connection exists
1318 * to a specific remote BD Address.
1319 *
1320 * Returns true if connection is up, else false.
1321 *
1322 ******************************************************************************/
BTM_IsAclConnectionUp(const RawAddress & remote_bda,tBT_TRANSPORT transport)1323 bool BTM_IsAclConnectionUp(const RawAddress& remote_bda,
1324 tBT_TRANSPORT transport) {
1325 tACL_CONN* p;
1326
1327 VLOG(2) << __func__ << " RemBdAddr: " << remote_bda;
1328
1329 p = btm_bda_to_acl(remote_bda, transport);
1330 if (p != (tACL_CONN*)NULL) {
1331 return (true);
1332 }
1333
1334 /* If here, no BD Addr found */
1335 return (false);
1336 }
1337
1338 /*******************************************************************************
1339 *
1340 * Function BTM_GetNumAclLinks
1341 *
1342 * Description This function is called to count the number of
1343 * ACL links that are active.
1344 *
1345 * Returns uint16_t Number of active ACL links
1346 *
1347 ******************************************************************************/
BTM_GetNumAclLinks(void)1348 uint16_t BTM_GetNumAclLinks(void) {
1349 uint16_t num_acl = 0;
1350
1351 for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i) {
1352 if (btm_cb.acl_db[i].in_use) ++num_acl;
1353 }
1354
1355 return num_acl;
1356 }
1357
1358 /*******************************************************************************
1359 *
1360 * Function btm_get_acl_disc_reason_code
1361 *
1362 * Description This function is called to get the disconnection reason code
1363 * returned by the HCI at disconnection complete event.
1364 *
1365 * Returns true if connection is up, else false.
1366 *
1367 ******************************************************************************/
btm_get_acl_disc_reason_code(void)1368 uint16_t btm_get_acl_disc_reason_code(void) {
1369 uint8_t res = btm_cb.acl_disc_reason;
1370 BTM_TRACE_DEBUG("btm_get_acl_disc_reason_code");
1371 return (res);
1372 }
1373
1374 /*******************************************************************************
1375 *
1376 * Function BTM_GetHCIConnHandle
1377 *
1378 * Description This function is called to get the handle for an ACL
1379 * connection to a specific remote BD Address.
1380 *
1381 * Returns the handle of the connection, or 0xFFFF if none.
1382 *
1383 ******************************************************************************/
BTM_GetHCIConnHandle(const RawAddress & remote_bda,tBT_TRANSPORT transport)1384 uint16_t BTM_GetHCIConnHandle(const RawAddress& remote_bda,
1385 tBT_TRANSPORT transport) {
1386 tACL_CONN* p;
1387 BTM_TRACE_DEBUG("BTM_GetHCIConnHandle");
1388 p = btm_bda_to_acl(remote_bda, transport);
1389 if (p != (tACL_CONN*)NULL) {
1390 return (p->hci_handle);
1391 }
1392
1393 /* If here, no BD Addr found */
1394 return (0xFFFF);
1395 }
1396
1397 /*******************************************************************************
1398 *
1399 * Function btm_process_clk_off_comp_evt
1400 *
1401 * Description This function is called when clock offset command completes.
1402 *
1403 * Input Parms hci_handle - connection handle associated with the change
1404 * clock offset
1405 *
1406 * Returns void
1407 *
1408 ******************************************************************************/
btm_process_clk_off_comp_evt(uint16_t hci_handle,uint16_t clock_offset)1409 void btm_process_clk_off_comp_evt(uint16_t hci_handle, uint16_t clock_offset) {
1410 uint8_t xx;
1411 BTM_TRACE_DEBUG("btm_process_clk_off_comp_evt");
1412 /* Look up the connection by handle and set the current mode */
1413 xx = btm_handle_to_acl_index(hci_handle);
1414 if (xx < MAX_L2CAP_LINKS) btm_cb.acl_db[xx].clock_offset = clock_offset;
1415 }
1416
1417 /*******************************************************************************
1418 *
1419 * Function btm_blacklist_role_change_device
1420 *
1421 * Description This function is used to blacklist the device if the role
1422 * switch fails for maximum number of times. It also removes
1423 * the device from the black list if the role switch succeeds.
1424 *
1425 * Input Parms bd_addr - remote BD addr
1426 * hci_status - role switch status
1427 *
1428 * Returns void
1429 *
1430 *******************************************************************************/
btm_blacklist_role_change_device(const RawAddress & bd_addr,uint8_t hci_status)1431 void btm_blacklist_role_change_device(const RawAddress& bd_addr,
1432 uint8_t hci_status) {
1433 tACL_CONN* p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
1434 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
1435
1436 if (!p || !p_dev_rec) {
1437 return;
1438 }
1439 if (hci_status == HCI_SUCCESS) {
1440 p->switch_role_failed_attempts = 0;
1441 return;
1442 }
1443
1444 /* check for carkits */
1445 const uint32_t cod_audio_device =
1446 (BTM_COD_SERVICE_AUDIO | BTM_COD_MAJOR_AUDIO) << 8;
1447 const uint32_t cod =
1448 ((p_dev_rec->dev_class[0] << 16) | (p_dev_rec->dev_class[1] << 8) |
1449 p_dev_rec->dev_class[2]) &
1450 0xffffff;
1451 if ((hci_status != HCI_SUCCESS) &&
1452 ((p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) ||
1453 (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)) &&
1454 ((cod & cod_audio_device) == cod_audio_device) &&
1455 (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr))) {
1456 p->switch_role_failed_attempts++;
1457 if (p->switch_role_failed_attempts == BTM_MAX_SW_ROLE_FAILED_ATTEMPTS) {
1458 BTM_TRACE_WARNING(
1459 "%s: Device %s blacklisted for role switching - "
1460 "multiple role switch failed attempts: %u",
1461 __func__, bd_addr.ToString().c_str(), p->switch_role_failed_attempts);
1462 interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr, 3);
1463 }
1464 }
1465 }
1466
1467 /*******************************************************************************
1468 *
1469 * Function btm_acl_role_changed
1470 *
1471 * Description This function is called whan a link's master/slave role
1472 * change event or command status event (with error) is
1473 * received. It updates the link control block, and calls the
1474 * registered callback with status and role (if registered).
1475 *
1476 * Returns void
1477 *
1478 ******************************************************************************/
btm_acl_role_changed(uint8_t hci_status,const RawAddress * bd_addr,uint8_t new_role)1479 void btm_acl_role_changed(uint8_t hci_status, const RawAddress* bd_addr,
1480 uint8_t new_role) {
1481 const RawAddress* p_bda =
1482 (bd_addr) ? bd_addr : &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1483 tACL_CONN* p = btm_bda_to_acl(*p_bda, BT_TRANSPORT_BR_EDR);
1484 tBTM_ROLE_SWITCH_CMPL* p_data = &btm_cb.devcb.switch_role_ref_data;
1485 tBTM_SEC_DEV_REC* p_dev_rec;
1486
1487 BTM_TRACE_DEBUG("%s: peer %s hci_status:0x%x new_role:%d", __func__,
1488 (p_bda != nullptr) ? bd_addr->ToString().c_str() : "nullptr",
1489 hci_status, new_role);
1490 /* Ignore any stray events */
1491 if (p == NULL) {
1492 /* it could be a failure */
1493 if (hci_status != HCI_SUCCESS)
1494 btm_acl_report_role_change(hci_status, bd_addr);
1495 return;
1496 }
1497
1498 p_data->hci_status = hci_status;
1499
1500 if (hci_status == HCI_SUCCESS) {
1501 p_data->role = new_role;
1502 p_data->remote_bd_addr = *p_bda;
1503
1504 /* Update cached value */
1505 p->link_role = new_role;
1506
1507 /* Reload LSTO: link supervision timeout is reset in the LM after a role
1508 * switch */
1509 if (new_role == BTM_ROLE_MASTER) {
1510 BTM_SetLinkSuperTout(p->remote_addr, p->link_super_tout);
1511 }
1512 } else {
1513 /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1514 new_role = p->link_role;
1515 }
1516
1517 /* Check if any SCO req is pending for role change */
1518 btm_sco_chk_pend_rolechange(p->hci_handle);
1519
1520 /* if switching state is switching we need to turn encryption on */
1521 /* if idle, we did not change encryption */
1522 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) {
1523 btsnd_hcic_set_conn_encrypt(p->hci_handle, true);
1524 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1525 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1526 return;
1527 }
1528
1529 /* Set the switch_role_state to IDLE since the reply received from HCI */
1530 /* regardless of its result either success or failed. */
1531 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS) {
1532 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1533 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1534 }
1535
1536 /* if role switch complete is needed, report it now */
1537 btm_acl_report_role_change(hci_status, bd_addr);
1538
1539 /* if role change event is registered, report it now */
1540 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
1541 tBTM_BL_ROLE_CHG_DATA evt;
1542 evt.event = BTM_BL_ROLE_CHG_EVT;
1543 evt.new_role = new_role;
1544 evt.p_bda = p_bda;
1545 evt.hci_status = hci_status;
1546 tBTM_BL_EVENT_DATA btm_bl_event_data;
1547 btm_bl_event_data.role_chg = evt;
1548 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
1549 }
1550
1551 BTM_TRACE_DEBUG(
1552 "%s: peer %s Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, "
1553 "rs_st:%d",
1554 __func__, (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr",
1555 p_data->role, p_data->hci_status, p->switch_role_state);
1556
1557 #if (BTM_DISC_DURING_RS == TRUE)
1558 /* If a disconnect is pending, issue it now that role switch has completed */
1559 p_dev_rec = btm_find_dev(*p_bda);
1560 if (p_dev_rec != NULL) {
1561 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
1562 BTM_TRACE_WARNING(
1563 "%s peer %s Issuing delayed HCI_Disconnect!!!", __func__,
1564 (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr");
1565 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1566 }
1567 BTM_TRACE_ERROR("%s: peer %s tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1568 __func__,
1569 (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr",
1570 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1571 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
1572 }
1573
1574 #endif
1575 }
1576
1577 /*******************************************************************************
1578 *
1579 * Function BTM_AllocateSCN
1580 *
1581 * Description Look through the Server Channel Numbers for a free one.
1582 *
1583 * Returns Allocated SCN number or 0 if none.
1584 *
1585 ******************************************************************************/
1586
BTM_AllocateSCN(void)1587 uint8_t BTM_AllocateSCN(void) {
1588 uint8_t x;
1589 BTM_TRACE_DEBUG("BTM_AllocateSCN");
1590
1591 // stack reserves scn 1 for HFP, HSP we still do the correct way
1592 for (x = 1; x < BTM_MAX_SCN; x++) {
1593 if (!btm_cb.btm_scn[x]) {
1594 btm_cb.btm_scn[x] = true;
1595 return (x + 1);
1596 }
1597 }
1598
1599 return (0); /* No free ports */
1600 }
1601
1602 /*******************************************************************************
1603 *
1604 * Function BTM_TryAllocateSCN
1605 *
1606 * Description Try to allocate a fixed server channel
1607 *
1608 * Returns Returns true if server channel was available
1609 *
1610 ******************************************************************************/
1611
BTM_TryAllocateSCN(uint8_t scn)1612 bool BTM_TryAllocateSCN(uint8_t scn) {
1613 /* Make sure we don't exceed max port range.
1614 * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1615 */
1616 if ((scn >= BTM_MAX_SCN) || (scn == 1) || (scn == 0)) return false;
1617
1618 /* check if this port is available */
1619 if (!btm_cb.btm_scn[scn - 1]) {
1620 btm_cb.btm_scn[scn - 1] = true;
1621 return true;
1622 }
1623
1624 return (false); /* Port was busy */
1625 }
1626
1627 /*******************************************************************************
1628 *
1629 * Function BTM_FreeSCN
1630 *
1631 * Description Free the specified SCN.
1632 *
1633 * Returns true or false
1634 *
1635 ******************************************************************************/
BTM_FreeSCN(uint8_t scn)1636 bool BTM_FreeSCN(uint8_t scn) {
1637 BTM_TRACE_DEBUG("BTM_FreeSCN ");
1638 if (scn <= BTM_MAX_SCN && scn > 0) {
1639 btm_cb.btm_scn[scn - 1] = false;
1640 return (true);
1641 } else {
1642 return (false); /* Illegal SCN passed in */
1643 }
1644 }
1645
1646 /*******************************************************************************
1647 *
1648 * Function btm_set_packet_types
1649 *
1650 * Description This function sets the packet types used for a specific
1651 * ACL connection. It is called internally by btm_acl_created
1652 * or by an application/profile by BTM_SetPacketTypes.
1653 *
1654 * Returns status of the operation
1655 *
1656 ******************************************************************************/
btm_set_packet_types(tACL_CONN * p,uint16_t pkt_types)1657 tBTM_STATUS btm_set_packet_types(tACL_CONN* p, uint16_t pkt_types) {
1658 uint16_t temp_pkt_types;
1659 BTM_TRACE_DEBUG("btm_set_packet_types");
1660 /* Save in the ACL control blocks, types that we support */
1661 temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1662 btm_cb.btm_acl_pkt_types_supported);
1663
1664 /* OR in any exception packet types if at least 2.0 version of spec */
1665 temp_pkt_types |=
1666 ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1667 (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1668
1669 /* Exclude packet types not supported by the peer */
1670 btm_acl_chk_peer_pkt_type_support(p, &temp_pkt_types);
1671
1672 BTM_TRACE_DEBUG("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1673
1674 btsnd_hcic_change_conn_type(p->hci_handle, temp_pkt_types);
1675 p->pkt_types_mask = temp_pkt_types;
1676
1677 return (BTM_CMD_STARTED);
1678 }
1679
1680 /*******************************************************************************
1681 *
1682 * Function btm_get_max_packet_size
1683 *
1684 * Returns Returns maximum packet size that can be used for current
1685 * connection, 0 if connection is not established
1686 *
1687 ******************************************************************************/
btm_get_max_packet_size(const RawAddress & addr)1688 uint16_t btm_get_max_packet_size(const RawAddress& addr) {
1689 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1690 uint16_t pkt_types = 0;
1691 uint16_t pkt_size = 0;
1692 BTM_TRACE_DEBUG("btm_get_max_packet_size");
1693 if (p != NULL) {
1694 pkt_types = p->pkt_types_mask;
1695 } else {
1696 /* Special case for when info for the local device is requested */
1697 if (addr == *controller_get_interface()->get_address()) {
1698 pkt_types = btm_cb.btm_acl_pkt_types_supported;
1699 }
1700 }
1701
1702 if (pkt_types) {
1703 if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1704 pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1705 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1706 pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1707 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1708 pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1709 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1710 pkt_size = HCI_DH5_PACKET_SIZE;
1711 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1712 pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1713 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1714 pkt_size = HCI_DM5_PACKET_SIZE;
1715 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1716 pkt_size = HCI_DH3_PACKET_SIZE;
1717 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1718 pkt_size = HCI_DM3_PACKET_SIZE;
1719 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1720 pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1721 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1722 pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1723 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1724 pkt_size = HCI_DH1_PACKET_SIZE;
1725 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1726 pkt_size = HCI_DM1_PACKET_SIZE;
1727 }
1728
1729 return (pkt_size);
1730 }
1731
1732 /*******************************************************************************
1733 *
1734 * Function BTM_ReadRemoteVersion
1735 *
1736 * Returns If connected report peer device info
1737 *
1738 ******************************************************************************/
BTM_ReadRemoteVersion(const RawAddress & addr,uint8_t * lmp_version,uint16_t * manufacturer,uint16_t * lmp_sub_version)1739 tBTM_STATUS BTM_ReadRemoteVersion(const RawAddress& addr, uint8_t* lmp_version,
1740 uint16_t* manufacturer,
1741 uint16_t* lmp_sub_version) {
1742 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1743 BTM_TRACE_DEBUG("BTM_ReadRemoteVersion");
1744 if (p == NULL) return (BTM_UNKNOWN_ADDR);
1745
1746 if (lmp_version) *lmp_version = p->lmp_version;
1747
1748 if (manufacturer) *manufacturer = p->manufacturer;
1749
1750 if (lmp_sub_version) *lmp_sub_version = p->lmp_subversion;
1751
1752 return (BTM_SUCCESS);
1753 }
1754
1755 /*******************************************************************************
1756 *
1757 * Function BTM_ReadRemoteFeatures
1758 *
1759 * Returns pointer to the remote supported features mask (8 bytes)
1760 *
1761 ******************************************************************************/
BTM_ReadRemoteFeatures(const RawAddress & addr)1762 uint8_t* BTM_ReadRemoteFeatures(const RawAddress& addr) {
1763 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1764 BTM_TRACE_DEBUG("BTM_ReadRemoteFeatures");
1765 if (p == NULL) {
1766 return (NULL);
1767 }
1768
1769 return (p->peer_lmp_feature_pages[0]);
1770 }
1771
1772 /*******************************************************************************
1773 *
1774 * Function BTM_RegBusyLevelNotif
1775 *
1776 * Description This function is called to register a callback to receive
1777 * busy level change events.
1778 *
1779 * Returns BTM_SUCCESS if successfully registered, otherwise error
1780 *
1781 ******************************************************************************/
BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB * p_cb,uint8_t * p_level,tBTM_BL_EVENT_MASK evt_mask)1782 tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
1783 tBTM_BL_EVENT_MASK evt_mask) {
1784 BTM_TRACE_DEBUG("BTM_RegBusyLevelNotif");
1785 if (p_level) *p_level = btm_cb.busy_level;
1786
1787 btm_cb.bl_evt_mask = evt_mask;
1788
1789 if (!p_cb)
1790 btm_cb.p_bl_changed_cb = NULL;
1791 else if (btm_cb.p_bl_changed_cb)
1792 return (BTM_BUSY);
1793 else
1794 btm_cb.p_bl_changed_cb = p_cb;
1795
1796 return (BTM_SUCCESS);
1797 }
1798
1799 /*******************************************************************************
1800 *
1801 * Function btm_qos_setup_timeout
1802 *
1803 * Description Callback when QoS setup times out.
1804 *
1805 * Returns void
1806 *
1807 ******************************************************************************/
btm_qos_setup_timeout(UNUSED_ATTR void * data)1808 void btm_qos_setup_timeout(UNUSED_ATTR void* data) {
1809 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1810 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1811 if (p_cb) (*p_cb)((void*)NULL);
1812 }
1813
1814 /*******************************************************************************
1815 *
1816 * Function btm_qos_setup_complete
1817 *
1818 * Description This function is called when the command complete message
1819 * is received from the HCI for the qos setup request.
1820 *
1821 * Returns void
1822 *
1823 ******************************************************************************/
btm_qos_setup_complete(uint8_t status,uint16_t handle,FLOW_SPEC * p_flow)1824 void btm_qos_setup_complete(uint8_t status, uint16_t handle,
1825 FLOW_SPEC* p_flow) {
1826 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1827 tBTM_QOS_SETUP_CMPL qossu;
1828
1829 BTM_TRACE_DEBUG("%s", __func__);
1830 alarm_cancel(btm_cb.devcb.qos_setup_timer);
1831 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1832
1833 /* If there was a registered callback, call it */
1834 if (p_cb) {
1835 memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1836 qossu.status = status;
1837 qossu.handle = handle;
1838 if (p_flow != NULL) {
1839 qossu.flow.qos_flags = p_flow->qos_flags;
1840 qossu.flow.service_type = p_flow->service_type;
1841 qossu.flow.token_rate = p_flow->token_rate;
1842 qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1843 qossu.flow.latency = p_flow->latency;
1844 qossu.flow.delay_variation = p_flow->delay_variation;
1845 }
1846 BTM_TRACE_DEBUG("BTM: p_flow->delay_variation: 0x%02x",
1847 qossu.flow.delay_variation);
1848 (*p_cb)(&qossu);
1849 }
1850 }
1851
1852 /*******************************************************************************
1853 *
1854 * Function BTM_ReadRSSI
1855 *
1856 * Description This function is called to read the link policy settings.
1857 * The address of link policy results are returned in the
1858 * callback.
1859 * (tBTM_RSSI_RESULT)
1860 *
1861 * Returns BTM_CMD_STARTED if successfully initiated or error code
1862 *
1863 ******************************************************************************/
BTM_ReadRSSI(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1864 tBTM_STATUS BTM_ReadRSSI(const RawAddress& remote_bda, tBTM_CMPL_CB* p_cb) {
1865 tACL_CONN* p = NULL;
1866 tBT_DEVICE_TYPE dev_type;
1867 tBLE_ADDR_TYPE addr_type;
1868
1869 /* If someone already waiting on the version, do not allow another */
1870 if (btm_cb.devcb.p_rssi_cmpl_cb) return (BTM_BUSY);
1871
1872 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1873
1874 if (dev_type & BT_DEVICE_TYPE_BLE) {
1875 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_LE);
1876 }
1877
1878 if (p == NULL && dev_type & BT_DEVICE_TYPE_BREDR) {
1879 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1880 }
1881
1882 if (p) {
1883 btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
1884 alarm_set_on_mloop(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1885 btm_read_rssi_timeout, NULL);
1886
1887 btsnd_hcic_read_rssi(p->hci_handle);
1888 return (BTM_CMD_STARTED);
1889 }
1890
1891 /* If here, no BD Addr found */
1892 return (BTM_UNKNOWN_ADDR);
1893 }
1894
1895 /*******************************************************************************
1896 *
1897 * Function BTM_ReadFailedContactCounter
1898 *
1899 * Description This function is called to read the failed contact counter.
1900 * The result is returned in the callback.
1901 * (tBTM_FAILED_CONTACT_COUNTER_RESULT)
1902 *
1903 * Returns BTM_CMD_STARTED if successfully initiated or error code
1904 *
1905 ******************************************************************************/
BTM_ReadFailedContactCounter(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1906 tBTM_STATUS BTM_ReadFailedContactCounter(const RawAddress& remote_bda,
1907 tBTM_CMPL_CB* p_cb) {
1908 tACL_CONN* p;
1909 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
1910 tBT_DEVICE_TYPE dev_type;
1911 tBLE_ADDR_TYPE addr_type;
1912
1913 /* If someone already waiting on the result, do not allow another */
1914 if (btm_cb.devcb.p_failed_contact_counter_cmpl_cb) return (BTM_BUSY);
1915
1916 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1917 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
1918
1919 p = btm_bda_to_acl(remote_bda, transport);
1920 if (p != (tACL_CONN*)NULL) {
1921 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = p_cb;
1922 alarm_set_on_mloop(btm_cb.devcb.read_failed_contact_counter_timer,
1923 BTM_DEV_REPLY_TIMEOUT_MS,
1924 btm_read_failed_contact_counter_timeout, NULL);
1925
1926 btsnd_hcic_read_failed_contact_counter(p->hci_handle);
1927 return (BTM_CMD_STARTED);
1928 }
1929
1930 /* If here, no BD Addr found */
1931 return (BTM_UNKNOWN_ADDR);
1932 }
1933
1934 /*******************************************************************************
1935 *
1936 * Function BTM_ReadAutomaticFlushTimeout
1937 *
1938 * Description This function is called to read the automatic flush timeout.
1939 * The result is returned in the callback.
1940 * (tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT)
1941 *
1942 * Returns BTM_CMD_STARTED if successfully initiated or error code
1943 *
1944 ******************************************************************************/
BTM_ReadAutomaticFlushTimeout(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1945 tBTM_STATUS BTM_ReadAutomaticFlushTimeout(const RawAddress& remote_bda,
1946 tBTM_CMPL_CB* p_cb) {
1947 tACL_CONN* p;
1948 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
1949 tBT_DEVICE_TYPE dev_type;
1950 tBLE_ADDR_TYPE addr_type;
1951
1952 /* If someone already waiting on the result, do not allow another */
1953 if (btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb) return (BTM_BUSY);
1954
1955 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1956 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
1957
1958 p = btm_bda_to_acl(remote_bda, transport);
1959 if (!p) return BTM_UNKNOWN_ADDR;
1960
1961 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = p_cb;
1962 alarm_set_on_mloop(btm_cb.devcb.read_automatic_flush_timeout_timer,
1963 BTM_DEV_REPLY_TIMEOUT_MS,
1964 btm_read_automatic_flush_timeout_timeout, nullptr);
1965
1966 btsnd_hcic_read_automatic_flush_timeout(p->hci_handle);
1967 return BTM_CMD_STARTED;
1968 }
1969
1970 /*******************************************************************************
1971 *
1972 * Function BTM_ReadTxPower
1973 *
1974 * Description This function is called to read the current
1975 * TX power of the connection. The tx power level results
1976 * are returned in the callback.
1977 * (tBTM_RSSI_RESULT)
1978 *
1979 * Returns BTM_CMD_STARTED if successfully initiated or error code
1980 *
1981 ******************************************************************************/
BTM_ReadTxPower(const RawAddress & remote_bda,tBT_TRANSPORT transport,tBTM_CMPL_CB * p_cb)1982 tBTM_STATUS BTM_ReadTxPower(const RawAddress& remote_bda,
1983 tBT_TRANSPORT transport, tBTM_CMPL_CB* p_cb) {
1984 tACL_CONN* p;
1985 #define BTM_READ_RSSI_TYPE_CUR 0x00
1986 #define BTM_READ_RSSI_TYPE_MAX 0X01
1987
1988 VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
1989
1990 /* If someone already waiting on the version, do not allow another */
1991 if (btm_cb.devcb.p_tx_power_cmpl_cb) return (BTM_BUSY);
1992
1993 p = btm_bda_to_acl(remote_bda, transport);
1994 if (p != (tACL_CONN*)NULL) {
1995 btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
1996 alarm_set_on_mloop(btm_cb.devcb.read_tx_power_timer,
1997 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_tx_power_timeout,
1998 NULL);
1999
2000 if (p->transport == BT_TRANSPORT_LE) {
2001 btm_cb.devcb.read_tx_pwr_addr = remote_bda;
2002 btsnd_hcic_ble_read_adv_chnl_tx_power();
2003 } else {
2004 btsnd_hcic_read_tx_power(p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2005 }
2006
2007 return (BTM_CMD_STARTED);
2008 }
2009
2010 /* If here, no BD Addr found */
2011 return (BTM_UNKNOWN_ADDR);
2012 }
2013
2014 /*******************************************************************************
2015 *
2016 * Function btm_read_tx_power_timeout
2017 *
2018 * Description Callback when reading the tx power times out.
2019 *
2020 * Returns void
2021 *
2022 ******************************************************************************/
btm_read_tx_power_timeout(UNUSED_ATTR void * data)2023 void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {
2024 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2025 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2026 if (p_cb) (*p_cb)((void*)NULL);
2027 }
2028
2029 /*******************************************************************************
2030 *
2031 * Function btm_read_tx_power_complete
2032 *
2033 * Description This function is called when the command complete message
2034 * is received from the HCI for the read tx power request.
2035 *
2036 * Returns void
2037 *
2038 ******************************************************************************/
btm_read_tx_power_complete(uint8_t * p,bool is_ble)2039 void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
2040 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2041 tBTM_TX_POWER_RESULT result;
2042 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2043
2044 BTM_TRACE_DEBUG("%s", __func__);
2045 alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2046 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2047
2048 /* If there was a registered callback, call it */
2049 if (p_cb) {
2050 STREAM_TO_UINT8(result.hci_status, p);
2051
2052 if (result.hci_status == HCI_SUCCESS) {
2053 result.status = BTM_SUCCESS;
2054
2055 if (!is_ble) {
2056 uint16_t handle;
2057 STREAM_TO_UINT16(handle, p);
2058 STREAM_TO_UINT8(result.tx_power, p);
2059
2060 /* Search through the list of active channels for the correct BD Addr */
2061 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2062 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2063 result.rem_bda = p_acl_cb->remote_addr;
2064 break;
2065 }
2066 }
2067 } else {
2068 STREAM_TO_UINT8(result.tx_power, p);
2069 result.rem_bda = btm_cb.devcb.read_tx_pwr_addr;
2070 }
2071 BTM_TRACE_DEBUG("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2072 result.tx_power, result.hci_status);
2073 } else {
2074 result.status = BTM_ERR_PROCESSING;
2075 }
2076
2077 (*p_cb)(&result);
2078 }
2079 }
2080
2081 /*******************************************************************************
2082 *
2083 * Function btm_read_rssi_timeout
2084 *
2085 * Description Callback when reading the RSSI times out.
2086 *
2087 * Returns void
2088 *
2089 ******************************************************************************/
btm_read_rssi_timeout(UNUSED_ATTR void * data)2090 void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
2091 tBTM_RSSI_RESULT result;
2092 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2093 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2094 result.status = BTM_DEVICE_TIMEOUT;
2095 if (p_cb) (*p_cb)(&result);
2096 }
2097
2098 /*******************************************************************************
2099 *
2100 * Function btm_read_rssi_complete
2101 *
2102 * Description This function is called when the command complete message
2103 * is received from the HCI for the read rssi request.
2104 *
2105 * Returns void
2106 *
2107 ******************************************************************************/
btm_read_rssi_complete(uint8_t * p)2108 void btm_read_rssi_complete(uint8_t* p) {
2109 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2110 tBTM_RSSI_RESULT result;
2111 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2112
2113 BTM_TRACE_DEBUG("%s", __func__);
2114 alarm_cancel(btm_cb.devcb.read_rssi_timer);
2115 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2116
2117 /* If there was a registered callback, call it */
2118 if (p_cb) {
2119 STREAM_TO_UINT8(result.hci_status, p);
2120
2121 if (result.hci_status == HCI_SUCCESS) {
2122 uint16_t handle;
2123 result.status = BTM_SUCCESS;
2124
2125 STREAM_TO_UINT16(handle, p);
2126
2127 STREAM_TO_UINT8(result.rssi, p);
2128 BTM_TRACE_DEBUG("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2129 result.rssi, result.hci_status);
2130
2131 /* Search through the list of active channels for the correct BD Addr */
2132 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2133 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2134 result.rem_bda = p_acl_cb->remote_addr;
2135 break;
2136 }
2137 }
2138 } else {
2139 result.status = BTM_ERR_PROCESSING;
2140 }
2141
2142 (*p_cb)(&result);
2143 }
2144 }
2145
2146 /*******************************************************************************
2147 *
2148 * Function btm_read_failed_contact_counter_timeout
2149 *
2150 * Description Callback when reading the failed contact counter times out.
2151 *
2152 * Returns void
2153 *
2154 ******************************************************************************/
btm_read_failed_contact_counter_timeout(UNUSED_ATTR void * data)2155 void btm_read_failed_contact_counter_timeout(UNUSED_ATTR void* data) {
2156 tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2157 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2158 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2159 result.status = BTM_DEVICE_TIMEOUT;
2160 if (p_cb) (*p_cb)(&result);
2161 }
2162
2163 /*******************************************************************************
2164 *
2165 * Function btm_read_failed_contact_counter_complete
2166 *
2167 * Description This function is called when the command complete message
2168 * is received from the HCI for the read failed contact
2169 * counter request.
2170 *
2171 * Returns void
2172 *
2173 ******************************************************************************/
btm_read_failed_contact_counter_complete(uint8_t * p)2174 void btm_read_failed_contact_counter_complete(uint8_t* p) {
2175 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2176 tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2177 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2178
2179 BTM_TRACE_DEBUG("%s", __func__);
2180 alarm_cancel(btm_cb.devcb.read_failed_contact_counter_timer);
2181 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2182
2183 /* If there was a registered callback, call it */
2184 if (p_cb) {
2185 uint16_t handle;
2186 STREAM_TO_UINT8(result.hci_status, p);
2187
2188 if (result.hci_status == HCI_SUCCESS) {
2189 result.status = BTM_SUCCESS;
2190
2191 STREAM_TO_UINT16(handle, p);
2192
2193 STREAM_TO_UINT16(result.failed_contact_counter, p);
2194 BTM_TRACE_DEBUG(
2195 "BTM Failed Contact Counter Complete: counter %u, hci status 0x%02x",
2196 result.failed_contact_counter, result.hci_status);
2197
2198 /* Search through the list of active channels for the correct BD Addr */
2199 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2200 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2201 result.rem_bda = p_acl_cb->remote_addr;
2202 break;
2203 }
2204 }
2205 } else {
2206 result.status = BTM_ERR_PROCESSING;
2207 }
2208
2209 (*p_cb)(&result);
2210 }
2211 }
2212
2213 /*******************************************************************************
2214 *
2215 * Function btm_read_automatic_flush_timeout_timeout
2216 *
2217 * Description Callback when reading the automatic flush timeout times out.
2218 *
2219 * Returns void
2220 *
2221 ******************************************************************************/
btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void * data)2222 void btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void* data) {
2223 tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2224 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2225 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2226 result.status = BTM_DEVICE_TIMEOUT;
2227 if (p_cb) (*p_cb)(&result);
2228 }
2229
2230 /*******************************************************************************
2231 *
2232 * Function btm_read_automatic_flush_timeout_complete
2233 *
2234 * Description This function is called when the command complete message
2235 * is received from the HCI for the read automatic flush
2236 * timeout request.
2237 *
2238 * Returns void
2239 *
2240 ******************************************************************************/
btm_read_automatic_flush_timeout_complete(uint8_t * p)2241 void btm_read_automatic_flush_timeout_complete(uint8_t* p) {
2242 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2243 tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2244 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2245
2246 BTM_TRACE_DEBUG("%s", __func__);
2247 alarm_cancel(btm_cb.devcb.read_automatic_flush_timeout_timer);
2248 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2249
2250 /* If there was a registered callback, call it */
2251 if (p_cb) {
2252 uint16_t handle;
2253 STREAM_TO_UINT8(result.hci_status, p);
2254
2255 if (result.hci_status == HCI_SUCCESS) {
2256 result.status = BTM_SUCCESS;
2257
2258 STREAM_TO_UINT16(handle, p);
2259
2260 STREAM_TO_UINT16(result.automatic_flush_timeout, p);
2261 BTM_TRACE_DEBUG(
2262 "BTM Automatic Flush Timeout Complete: timeout %u, hci status 0x%02x",
2263 result.automatic_flush_timeout, result.hci_status);
2264
2265 /* Search through the list of active channels for the correct BD Addr */
2266 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2267 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2268 result.rem_bda = p_acl_cb->remote_addr;
2269 break;
2270 }
2271 }
2272 } else {
2273 result.status = BTM_ERR_PROCESSING;
2274 }
2275
2276 (*p_cb)(&result);
2277 }
2278 }
2279
2280 /*******************************************************************************
2281 *
2282 * Function btm_read_link_quality_timeout
2283 *
2284 * Description Callback when reading the link quality times out.
2285 *
2286 * Returns void
2287 *
2288 ******************************************************************************/
btm_read_link_quality_timeout(UNUSED_ATTR void * data)2289 void btm_read_link_quality_timeout(UNUSED_ATTR void* data) {
2290 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2291 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2292 if (p_cb) (*p_cb)((void*)NULL);
2293 }
2294
2295 /*******************************************************************************
2296 *
2297 * Function btm_read_link_quality_complete
2298 *
2299 * Description This function is called when the command complete message
2300 * is received from the HCI for the read link quality.
2301 *
2302 * Returns void
2303 *
2304 ******************************************************************************/
btm_read_link_quality_complete(uint8_t * p)2305 void btm_read_link_quality_complete(uint8_t* p) {
2306 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2307 tBTM_LINK_QUALITY_RESULT result;
2308 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2309
2310 BTM_TRACE_DEBUG("%s", __func__);
2311 alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2312 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2313
2314 /* If there was a registered callback, call it */
2315 if (p_cb) {
2316 STREAM_TO_UINT8(result.hci_status, p);
2317
2318 if (result.hci_status == HCI_SUCCESS) {
2319 uint16_t handle;
2320 result.status = BTM_SUCCESS;
2321
2322 STREAM_TO_UINT16(handle, p);
2323
2324 STREAM_TO_UINT8(result.link_quality, p);
2325 BTM_TRACE_DEBUG(
2326 "BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2327 result.link_quality, result.hci_status);
2328
2329 /* Search through the list of active channels for the correct BD Addr */
2330 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2331 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2332 result.rem_bda = p_acl_cb->remote_addr;
2333 break;
2334 }
2335 }
2336 } else {
2337 result.status = BTM_ERR_PROCESSING;
2338 }
2339
2340 (*p_cb)(&result);
2341 }
2342 }
2343
2344 /*******************************************************************************
2345 *
2346 * Function btm_remove_acl
2347 *
2348 * Description This function is called to disconnect an ACL connection
2349 *
2350 * Returns BTM_SUCCESS if successfully initiated, otherwise
2351 * BTM_NO_RESOURCES.
2352 *
2353 ******************************************************************************/
btm_remove_acl(const RawAddress & bd_addr,tBT_TRANSPORT transport)2354 tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr, tBT_TRANSPORT transport) {
2355 uint16_t hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2356 tBTM_STATUS status = BTM_SUCCESS;
2357
2358 BTM_TRACE_DEBUG("btm_remove_acl");
2359 #if (BTM_DISC_DURING_RS == TRUE)
2360 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
2361
2362 /* Role Switch is pending, postpone until completed */
2363 if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING)) {
2364 p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2365 } else /* otherwise can disconnect right away */
2366 #endif
2367 {
2368 if (hci_handle != 0xFFFF && p_dev_rec &&
2369 p_dev_rec->sec_state != BTM_SEC_STATE_DISCONNECTING) {
2370 btsnd_hcic_disconnect(hci_handle, HCI_ERR_PEER_USER);
2371 } else {
2372 status = BTM_UNKNOWN_ADDR;
2373 }
2374 }
2375
2376 return status;
2377 }
2378
2379 /*******************************************************************************
2380 *
2381 * Function BTM_SetTraceLevel
2382 *
2383 * Description This function sets the trace level for BTM. If called with
2384 * a value of 0xFF, it simply returns the current trace level.
2385 *
2386 * Returns The new or current trace level
2387 *
2388 ******************************************************************************/
BTM_SetTraceLevel(uint8_t new_level)2389 uint8_t BTM_SetTraceLevel(uint8_t new_level) {
2390 BTM_TRACE_DEBUG("BTM_SetTraceLevel");
2391 if (new_level != 0xFF) btm_cb.trace_level = new_level;
2392
2393 return (btm_cb.trace_level);
2394 }
2395
2396 /*******************************************************************************
2397 *
2398 * Function btm_cont_rswitch
2399 *
2400 * Description This function is called to continue processing an active
2401 * role switch. It first disables encryption if enabled and
2402 * EPR is not supported
2403 *
2404 * Returns void
2405 *
2406 ******************************************************************************/
btm_cont_rswitch(tACL_CONN * p,tBTM_SEC_DEV_REC * p_dev_rec,uint8_t hci_status)2407 void btm_cont_rswitch(tACL_CONN* p, tBTM_SEC_DEV_REC* p_dev_rec,
2408 uint8_t hci_status) {
2409 BTM_TRACE_DEBUG("btm_cont_rswitch");
2410 /* Check to see if encryption needs to be turned off if pending
2411 change of link key or role switch */
2412 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2413 /* Must turn off Encryption first if necessary */
2414 /* Some devices do not support switch or change of link key while encryption
2415 * is on */
2416 if (p_dev_rec != NULL &&
2417 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
2418 !BTM_EPR_AVAILABLE(p)) {
2419 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
2420 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2421 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2422 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2423 } else /* Encryption not used or EPR supported, continue with switch
2424 and/or change of link key */
2425 {
2426 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2427 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2428 #if (BTM_DISC_DURING_RS == TRUE)
2429 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2430 #endif
2431 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
2432 }
2433 }
2434 }
2435 }
2436
2437 /*******************************************************************************
2438 *
2439 * Function btm_acl_resubmit_page
2440 *
2441 * Description send pending page request
2442 *
2443 ******************************************************************************/
btm_acl_resubmit_page(void)2444 void btm_acl_resubmit_page(void) {
2445 tBTM_SEC_DEV_REC* p_dev_rec;
2446 BT_HDR* p_buf;
2447 uint8_t* pp;
2448 BTM_TRACE_DEBUG("btm_acl_resubmit_page");
2449 /* If there were other page request schedule can start the next one */
2450 p_buf = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue);
2451 if (p_buf != NULL) {
2452 /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2453 * for both create_conn and rmt_name */
2454 pp = (uint8_t*)(p_buf + 1) + p_buf->offset + 3;
2455
2456 RawAddress bda;
2457 STREAM_TO_BDADDR(bda, pp);
2458
2459 p_dev_rec = btm_find_or_alloc_dev(bda);
2460
2461 btm_cb.connecting_bda = p_dev_rec->bd_addr;
2462 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2463
2464 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2465 } else {
2466 btm_cb.paging = false;
2467 }
2468 }
2469
2470 /*******************************************************************************
2471 *
2472 * Function btm_acl_reset_paging
2473 *
2474 * Description set paging to false and free the page queue - called at
2475 * hci_reset
2476 *
2477 ******************************************************************************/
btm_acl_reset_paging(void)2478 void btm_acl_reset_paging(void) {
2479 BT_HDR* p;
2480 BTM_TRACE_DEBUG("btm_acl_reset_paging");
2481 /* If we sent reset we are definitely not paging any more */
2482 while ((p = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2483 osi_free(p);
2484
2485 btm_cb.paging = false;
2486 }
2487
2488 /*******************************************************************************
2489 *
2490 * Function btm_acl_paging
2491 *
2492 * Description send a paging command or queue it in btm_cb
2493 *
2494 ******************************************************************************/
btm_acl_paging(BT_HDR * p,const RawAddress & bda)2495 void btm_acl_paging(BT_HDR* p, const RawAddress& bda) {
2496 tBTM_SEC_DEV_REC* p_dev_rec;
2497
2498 VLOG(2) << __func__ << ":" << btm_cb.discing << " , paging:" << btm_cb.paging
2499 << " BDA: " << bda;
2500
2501 if (btm_cb.discing) {
2502 btm_cb.paging = true;
2503 fixed_queue_enqueue(btm_cb.page_queue, p);
2504 } else {
2505 if (!BTM_ACL_IS_CONNECTED(bda)) {
2506 VLOG(1) << "connecting_bda: " << btm_cb.connecting_bda;
2507 if (btm_cb.paging && bda == btm_cb.connecting_bda) {
2508 fixed_queue_enqueue(btm_cb.page_queue, p);
2509 } else {
2510 p_dev_rec = btm_find_or_alloc_dev(bda);
2511 btm_cb.connecting_bda = p_dev_rec->bd_addr;
2512 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2513
2514 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2515 }
2516
2517 btm_cb.paging = true;
2518 } else /* ACL is already up */
2519 {
2520 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2521 }
2522 }
2523 }
2524
2525 /*******************************************************************************
2526 *
2527 * Function btm_acl_notif_conn_collision
2528 *
2529 * Description Send connection collision event to upper layer if registered
2530 *
2531 * Returns true if sent out to upper layer,
2532 * false if no one needs the notification.
2533 *
2534 ******************************************************************************/
btm_acl_notif_conn_collision(const RawAddress & bda)2535 bool btm_acl_notif_conn_collision(const RawAddress& bda) {
2536 /* Report possible collision to the upper layer. */
2537 if (btm_cb.p_bl_changed_cb) {
2538 VLOG(1) << __func__ << " RemBdAddr: " << bda;
2539
2540 tBTM_BL_EVENT_DATA evt_data;
2541 evt_data.event = BTM_BL_COLLISION_EVT;
2542 evt_data.conn.p_bda = &bda;
2543 evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2544 evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2545 (*btm_cb.p_bl_changed_cb)(&evt_data);
2546 return true;
2547 } else {
2548 return false;
2549 }
2550 }
2551
2552 /*******************************************************************************
2553 *
2554 * Function btm_acl_chk_peer_pkt_type_support
2555 *
2556 * Description Check if peer supports requested packets
2557 *
2558 ******************************************************************************/
btm_acl_chk_peer_pkt_type_support(tACL_CONN * p,uint16_t * p_pkt_type)2559 void btm_acl_chk_peer_pkt_type_support(tACL_CONN* p, uint16_t* p_pkt_type) {
2560 /* 3 and 5 slot packets? */
2561 if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2562 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 + BTM_ACL_PKT_TYPES_MASK_DM3);
2563
2564 if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2565 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2566
2567 /* 2 and 3 MPS support? */
2568 if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2569 /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2570 *p_pkt_type |=
2571 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2572 BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2573
2574 if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2575 /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2576 *p_pkt_type |=
2577 (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2578 BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2579
2580 /* EDR 3 and 5 slot support? */
2581 if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]) ||
2582 HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0])) {
2583 if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2584 /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types
2585 */
2586 *p_pkt_type |=
2587 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2588
2589 if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2590 /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types
2591 */
2592 *p_pkt_type |=
2593 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2594 }
2595 }
2596