• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /******************************************************************************
2  *
3  *  Copyright (C) 2000-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /*****************************************************************************
20 **
21 **  Name:          btm_acl.c
22 **
23 **  Description:   This file contains functions that handle ACL connections.
24 **                 This includes operations such as hold and sniff modes,
25 **                 supported packet types.
26 **
27 **                 This module contains both internal and external (API)
28 **                 functions. External (API) functions are distinguishable
29 **                 by their names beginning with uppercase BTM.
30 **
31 **
32 ******************************************************************************/
33 
34 #include <stdlib.h>
35 #include <string.h>
36 #include <stdio.h>
37 #include <stddef.h>
38 
39 #include "bt_types.h"
40 #include "bt_target.h"
41 #include "device/include/controller.h"
42 #include "bt_common.h"
43 #include "hcimsgs.h"
44 #include "btu.h"
45 #include "btm_api.h"
46 #include "btm_int.h"
47 #include "l2c_int.h"
48 #include "hcidefs.h"
49 #include "bt_utils.h"
50 
51 
52 extern fixed_queue_t *btu_general_alarm_queue;
53 
54 static void btm_read_remote_features (UINT16 handle);
55 static void btm_read_remote_ext_features (UINT16 handle, UINT8 page_number);
56 static void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages);
57 
58 /* 3 seconds timeout waiting for responses */
59 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
60 
61 /*******************************************************************************
62 **
63 ** Function         btm_acl_init
64 **
65 ** Description      This function is called at BTM startup to initialize
66 **
67 ** Returns          void
68 **
69 *******************************************************************************/
btm_acl_init(void)70 void btm_acl_init (void)
71 {
72     BTM_TRACE_DEBUG ("btm_acl_init");
73 #if 0  /* cleared in btm_init; put back in if called from anywhere else! */
74     memset (&btm_cb.acl_db, 0, sizeof (btm_cb.acl_db));
75     memset (btm_cb.btm_scn, 0, BTM_MAX_SCN);          /* Initialize the SCN usage to FALSE */
76     btm_cb.btm_def_link_policy     = 0;
77     btm_cb.p_bl_changed_cb         = NULL;
78 #endif
79 
80     /* Initialize nonzero defaults */
81     btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
82     btm_cb.acl_disc_reason         = 0xff ;
83 }
84 
85 /*******************************************************************************
86 **
87 ** Function         btm_bda_to_acl
88 **
89 ** Description      This function returns the FIRST acl_db entry for the passed BDA.
90 **
91 ** Parameters      bda : BD address of the remote device
92 **                 transport : Physical transport used for ACL connection (BR/EDR or LE)
93 **
94 ** Returns          Returns pointer to the ACL DB for the requested BDA if found.
95 **                  NULL if not found.
96 **
97 *******************************************************************************/
btm_bda_to_acl(const BD_ADDR bda,tBT_TRANSPORT transport)98 tACL_CONN *btm_bda_to_acl (const BD_ADDR bda, tBT_TRANSPORT transport)
99 {
100     tACL_CONN   *p = &btm_cb.acl_db[0];
101     UINT16       xx;
102     if (bda)
103     {
104         for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
105         {
106             if ((p->in_use) && (!memcmp (p->remote_addr, bda, BD_ADDR_LEN))
107 #if BLE_INCLUDED == TRUE
108                 && p->transport == transport
109 #endif
110                 )
111             {
112                 BTM_TRACE_DEBUG ("btm_bda_to_acl found");
113                 return(p);
114             }
115         }
116     }
117 
118     /* If here, no BD Addr found */
119     return((tACL_CONN *)NULL);
120 }
121 
122 /*******************************************************************************
123 **
124 ** Function         btm_handle_to_acl_index
125 **
126 ** Description      This function returns the FIRST acl_db entry for the passed hci_handle.
127 **
128 ** Returns          index to the acl_db or MAX_L2CAP_LINKS.
129 **
130 *******************************************************************************/
btm_handle_to_acl_index(UINT16 hci_handle)131 UINT8 btm_handle_to_acl_index (UINT16 hci_handle)
132 {
133     tACL_CONN   *p = &btm_cb.acl_db[0];
134     UINT8       xx;
135     BTM_TRACE_DEBUG ("btm_handle_to_acl_index");
136     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
137     {
138         if ((p->in_use) && (p->hci_handle == hci_handle))
139         {
140             break;
141         }
142     }
143 
144     /* If here, no BD Addr found */
145     return(xx);
146 }
147 
148 #if BLE_PRIVACY_SPT == TRUE
149 /*******************************************************************************
150 **
151 ** Function         btm_ble_get_acl_remote_addr
152 **
153 ** Description      This function reads the active remote address used for the
154 **                  connection.
155 **
156 ** Returns          success return TRUE, otherwise FALSE.
157 **
158 *******************************************************************************/
btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC * p_dev_rec,BD_ADDR conn_addr,tBLE_ADDR_TYPE * p_addr_type)159 BOOLEAN btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC *p_dev_rec, BD_ADDR conn_addr,
160                                     tBLE_ADDR_TYPE *p_addr_type)
161 {
162 #if BLE_INCLUDED == TRUE
163     BOOLEAN         st = TRUE;
164 
165     if (p_dev_rec == NULL)
166     {
167         BTM_TRACE_ERROR("btm_ble_get_acl_remote_addr can not find device with matching address");
168         return FALSE;
169     }
170 
171     switch (p_dev_rec->ble.active_addr_type)
172     {
173     case BTM_BLE_ADDR_PSEUDO:
174         memcpy(conn_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
175         * p_addr_type = p_dev_rec->ble.ble_addr_type;
176         break;
177 
178     case BTM_BLE_ADDR_RRA:
179         memcpy(conn_addr, p_dev_rec->ble.cur_rand_addr, BD_ADDR_LEN);
180         * p_addr_type = BLE_ADDR_RANDOM;
181         break;
182 
183     case BTM_BLE_ADDR_STATIC:
184         memcpy(conn_addr, p_dev_rec->ble.static_addr, BD_ADDR_LEN);
185         * p_addr_type = p_dev_rec->ble.static_addr_type;
186         break;
187 
188     default:
189         BTM_TRACE_ERROR("Unknown active address: %d", p_dev_rec->ble.active_addr_type);
190         st = FALSE;
191         break;
192     }
193 
194     return st;
195 #else
196     UNUSED(p_dev_rec);
197     UNUSED(conn_addr);
198     UNUSED(p_addr_type);
199     return FALSE;
200 #endif
201 }
202 #endif
203 /*******************************************************************************
204 **
205 ** Function         btm_acl_created
206 **
207 ** Description      This function is called by L2CAP when an ACL connection
208 **                  is created.
209 **
210 ** Returns          void
211 **
212 *******************************************************************************/
btm_acl_created(BD_ADDR bda,DEV_CLASS dc,BD_NAME bdn,UINT16 hci_handle,UINT8 link_role,tBT_TRANSPORT transport)213 void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
214                       UINT16 hci_handle, UINT8 link_role, tBT_TRANSPORT transport)
215 {
216     tBTM_SEC_DEV_REC *p_dev_rec = NULL;
217     tACL_CONN        *p;
218     UINT8             xx;
219 
220     BTM_TRACE_DEBUG ("btm_acl_created hci_handle=%d link_role=%d  transport=%d",
221                       hci_handle,link_role, transport);
222     /* Ensure we don't have duplicates */
223     p = btm_bda_to_acl(bda, transport);
224     if (p != (tACL_CONN *)NULL)
225     {
226         p->hci_handle = hci_handle;
227         p->link_role  = link_role;
228 #if BLE_INCLUDED == TRUE
229         p->transport = transport;
230 #endif
231         BTM_TRACE_DEBUG ("Duplicate btm_acl_created: RemBdAddr: %02x%02x%02x%02x%02x%02x",
232                           bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
233         BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
234         return;
235     }
236 
237     /* Allocate acl_db entry */
238     for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++)
239     {
240         if (!p->in_use)
241         {
242             p->in_use            = TRUE;
243             p->hci_handle        = hci_handle;
244             p->link_role         = link_role;
245             p->link_up_issued    = FALSE;
246             memcpy (p->remote_addr, bda, BD_ADDR_LEN);
247 
248 #if BLE_INCLUDED == TRUE
249             p->transport = transport;
250 #if BLE_PRIVACY_SPT == TRUE
251             if (transport == BT_TRANSPORT_LE)
252                 btm_ble_refresh_local_resolvable_private_addr(bda,
253                                                     btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
254 #else
255             p->conn_addr_type = BLE_ADDR_PUBLIC;
256             memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN);
257 
258 #endif
259 #endif
260             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
261 
262             btm_pm_sm_alloc(xx);
263 
264 
265             if (dc)
266                 memcpy (p->remote_dc, dc, DEV_CLASS_LEN);
267 
268             if (bdn)
269                 memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
270 
271             /* if BR/EDR do something more */
272             if (transport == BT_TRANSPORT_BR_EDR)
273             {
274                 btsnd_hcic_read_rmt_clk_offset (p->hci_handle);
275                 btsnd_hcic_rmt_ver_req (p->hci_handle);
276             }
277             p_dev_rec = btm_find_dev_by_handle (hci_handle);
278 
279 #if (BLE_INCLUDED == TRUE)
280             if (p_dev_rec )
281             {
282                 BTM_TRACE_DEBUG ("device_type=0x%x", p_dev_rec->device_type);
283             }
284 #endif
285 
286             if (p_dev_rec && !(transport == BT_TRANSPORT_LE))
287             {
288                 /* If remote features already known, copy them and continue connection setup */
289                 if ((p_dev_rec->num_read_pages) &&
290                     (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1)))
291                 {
292                     memcpy (p->peer_lmp_features, p_dev_rec->features,
293                         (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
294                     p->num_read_pages = p_dev_rec->num_read_pages;
295 
296                     const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
297 
298                     /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
299                     btm_sec_set_peer_sec_caps(p, p_dev_rec);
300 
301                     BTM_TRACE_API("%s: pend:%d", __FUNCTION__, req_pend);
302                     if (req_pend)
303                     {
304                         /* Request for remaining Security Features (if any) */
305                         l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
306                     }
307                     btm_establish_continue (p);
308                     return;
309                 }
310             }
311 
312 #if (BLE_INCLUDED == TRUE)
313             /* If here, features are not known yet */
314             if (p_dev_rec && transport == BT_TRANSPORT_LE)
315             {
316 #if BLE_PRIVACY_SPT == TRUE
317                 btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr,
318                     &p->active_remote_addr_type);
319 #endif
320 
321                 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
322                     || link_role == HCI_ROLE_MASTER)
323                 {
324                     btsnd_hcic_ble_read_remote_feat(p->hci_handle);
325                 }
326                 else
327                 {
328                     btm_establish_continue(p);
329                 }
330             }
331             else
332 #endif
333             {
334                 btm_read_remote_features (p->hci_handle);
335             }
336 
337             /* read page 1 - on rmt feature event for buffer reasons */
338             return;
339         }
340     }
341 }
342 
343 
344 /*******************************************************************************
345 **
346 ** Function         btm_acl_report_role_change
347 **
348 ** Description      This function is called when the local device is deemed
349 **                  to be down. It notifies L2CAP of the failure.
350 **
351 ** Returns          void
352 **
353 *******************************************************************************/
btm_acl_report_role_change(UINT8 hci_status,BD_ADDR bda)354 void btm_acl_report_role_change (UINT8 hci_status, BD_ADDR bda)
355 {
356     tBTM_ROLE_SWITCH_CMPL   ref_data;
357     BTM_TRACE_DEBUG ("btm_acl_report_role_change");
358     if (btm_cb.devcb.p_switch_role_cb
359         && (bda && (0 == memcmp(btm_cb.devcb.switch_role_ref_data.remote_bd_addr, bda, BD_ADDR_LEN))))
360     {
361         memcpy (&ref_data, &btm_cb.devcb.switch_role_ref_data, sizeof(tBTM_ROLE_SWITCH_CMPL));
362         ref_data.hci_status = hci_status;
363         (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
364         memset (&btm_cb.devcb.switch_role_ref_data, 0, sizeof(tBTM_ROLE_SWITCH_CMPL));
365         btm_cb.devcb.p_switch_role_cb = NULL;
366     }
367 }
368 
369 /*******************************************************************************
370 **
371 ** Function         btm_acl_removed
372 **
373 ** Description      This function is called by L2CAP when an ACL connection
374 **                  is removed. Since only L2CAP creates ACL links, we use
375 **                  the L2CAP link index as our index into the control blocks.
376 **
377 ** Returns          void
378 **
379 *******************************************************************************/
btm_acl_removed(BD_ADDR bda,tBT_TRANSPORT transport)380 void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport)
381 {
382     tACL_CONN   *p;
383     tBTM_BL_EVENT_DATA  evt_data;
384 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
385     tBTM_SEC_DEV_REC *p_dev_rec=NULL;
386 #endif
387     BTM_TRACE_DEBUG ("btm_acl_removed");
388     p = btm_bda_to_acl(bda, transport);
389     if (p != (tACL_CONN *)NULL)
390     {
391         p->in_use = FALSE;
392 
393         /* if the disconnected channel has a pending role switch, clear it now */
394         btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, bda);
395 
396         /* Only notify if link up has had a chance to be issued */
397         if (p->link_up_issued)
398         {
399             p->link_up_issued = FALSE;
400 
401             /* If anyone cares, tell him database changed */
402             if (btm_cb.p_bl_changed_cb)
403             {
404                 evt_data.event = BTM_BL_DISCN_EVT;
405                 evt_data.discn.p_bda = bda;
406 #if BLE_INCLUDED == TRUE
407                 evt_data.discn.handle = p->hci_handle;
408                 evt_data.discn.transport = p->transport;
409 #endif
410                 (*btm_cb.p_bl_changed_cb)(&evt_data);
411             }
412 
413             btm_acl_update_busy_level (BTM_BLI_ACL_DOWN_EVT);
414         }
415 
416 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
417 
418         BTM_TRACE_DEBUG ("acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
419                           p->hci_handle,
420                           p->transport,
421                           btm_cb.ble_ctr_cb.inq_var.connectable_mode,
422                           p->link_role);
423 
424         p_dev_rec = btm_find_dev(bda);
425         if ( p_dev_rec)
426         {
427             BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
428             if (p->transport == BT_TRANSPORT_LE)
429             {
430                 BTM_TRACE_DEBUG("LE link down");
431                 p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
432                 if ( (p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0)
433                 {
434                     BTM_TRACE_DEBUG("Not Bonded");
435                     p_dev_rec->sec_flags &= ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
436                 }
437                 else
438                 {
439                     BTM_TRACE_DEBUG("Bonded");
440                 }
441             }
442             else
443             {
444                 BTM_TRACE_DEBUG("Bletooth link down");
445                 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED
446                                         | BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
447             }
448             BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
449         }
450         else
451         {
452             BTM_TRACE_ERROR("Device not found");
453 
454         }
455 #endif
456 
457         /* Clear the ACL connection data */
458         memset(p, 0, sizeof(tACL_CONN));
459     }
460 }
461 
462 
463 /*******************************************************************************
464 **
465 ** Function         btm_acl_device_down
466 **
467 ** Description      This function is called when the local device is deemed
468 **                  to be down. It notifies L2CAP of the failure.
469 **
470 ** Returns          void
471 **
472 *******************************************************************************/
btm_acl_device_down(void)473 void btm_acl_device_down (void)
474 {
475     tACL_CONN   *p = &btm_cb.acl_db[0];
476     UINT16      xx;
477     BTM_TRACE_DEBUG ("btm_acl_device_down");
478     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
479     {
480         if (p->in_use)
481         {
482             BTM_TRACE_DEBUG ("hci_handle=%d HCI_ERR_HW_FAILURE ",p->hci_handle );
483             l2c_link_hci_disc_comp (p->hci_handle, HCI_ERR_HW_FAILURE);
484         }
485     }
486 }
487 
488 /*******************************************************************************
489 **
490 ** Function         btm_acl_update_busy_level
491 **
492 ** Description      This function is called to update the busy level of the system
493 **                  .
494 **
495 ** Returns          void
496 **
497 *******************************************************************************/
btm_acl_update_busy_level(tBTM_BLI_EVENT event)498 void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
499 {
500     tBTM_BL_UPDATE_DATA  evt;
501     UINT8 busy_level;
502     BTM_TRACE_DEBUG ("btm_acl_update_busy_level");
503     BOOLEAN old_inquiry_state = btm_cb.is_inquiry;
504     switch (event)
505     {
506         case BTM_BLI_ACL_UP_EVT:
507             BTM_TRACE_DEBUG ("BTM_BLI_ACL_UP_EVT");
508             break;
509         case BTM_BLI_ACL_DOWN_EVT:
510             BTM_TRACE_DEBUG ("BTM_BLI_ACL_DOWN_EVT");
511             break;
512         case BTM_BLI_PAGE_EVT:
513             BTM_TRACE_DEBUG ("BTM_BLI_PAGE_EVT");
514             btm_cb.is_paging = TRUE;
515             evt.busy_level_flags= BTM_BL_PAGING_STARTED;
516             break;
517         case BTM_BLI_PAGE_DONE_EVT:
518             BTM_TRACE_DEBUG ("BTM_BLI_PAGE_DONE_EVT");
519             btm_cb.is_paging = FALSE;
520             evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
521             break;
522         case BTM_BLI_INQ_EVT:
523             BTM_TRACE_DEBUG ("BTM_BLI_INQ_EVT");
524             btm_cb.is_inquiry = TRUE;
525             evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
526             break;
527         case BTM_BLI_INQ_CANCEL_EVT:
528             BTM_TRACE_DEBUG ("BTM_BLI_INQ_CANCEL_EVT");
529             btm_cb.is_inquiry = FALSE;
530             evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
531             break;
532         case BTM_BLI_INQ_DONE_EVT:
533             BTM_TRACE_DEBUG ("BTM_BLI_INQ_DONE_EVT");
534             btm_cb.is_inquiry = FALSE;
535             evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
536             break;
537     }
538 
539     if (btm_cb.is_paging || btm_cb.is_inquiry)
540         busy_level = 10;
541     else
542         busy_level = BTM_GetNumAclLinks();
543 
544     if ((busy_level != btm_cb.busy_level) ||(old_inquiry_state != btm_cb.is_inquiry))
545     {
546         evt.event         = BTM_BL_UPDATE_EVT;
547         evt.busy_level    = busy_level;
548         btm_cb.busy_level = busy_level;
549         if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK))
550         {
551             (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
552         }
553     }
554 }
555 
556 /*******************************************************************************
557 **
558 ** Function         BTM_GetRole
559 **
560 ** Description      This function is called to get the role of the local device
561 **                  for the ACL connection with the specified remote device
562 **
563 ** Returns          BTM_SUCCESS if connection exists.
564 **                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
565 **
566 *******************************************************************************/
BTM_GetRole(BD_ADDR remote_bd_addr,UINT8 * p_role)567 tBTM_STATUS BTM_GetRole (BD_ADDR remote_bd_addr, UINT8 *p_role)
568 {
569     tACL_CONN   *p;
570     BTM_TRACE_DEBUG ("BTM_GetRole");
571     if ((p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
572     {
573         *p_role = BTM_ROLE_UNDEFINED;
574         return(BTM_UNKNOWN_ADDR);
575     }
576 
577     /* Get the current role */
578     *p_role = p->link_role;
579     return(BTM_SUCCESS);
580 }
581 
582 
583 /*******************************************************************************
584 **
585 ** Function         BTM_SwitchRole
586 **
587 ** Description      This function is called to switch role between master and
588 **                  slave.  If role is already set it will do nothing.  If the
589 **                  command was initiated, the callback function is called upon
590 **                  completion.
591 **
592 ** Returns          BTM_SUCCESS if already in specified role.
593 **                  BTM_CMD_STARTED if command issued to controller.
594 **                  BTM_NO_RESOURCES if couldn't allocate memory to issue command
595 **                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
596 **                  BTM_MODE_UNSUPPORTED if local device does not support role switching
597 **                  BTM_BUSY if the previous command is not completed
598 **
599 *******************************************************************************/
BTM_SwitchRole(BD_ADDR remote_bd_addr,UINT8 new_role,tBTM_CMPL_CB * p_cb)600 tBTM_STATUS BTM_SwitchRole (BD_ADDR remote_bd_addr, UINT8 new_role, tBTM_CMPL_CB *p_cb)
601 {
602     tACL_CONN   *p;
603     tBTM_SEC_DEV_REC  *p_dev_rec = NULL;
604 #if BTM_SCO_INCLUDED == TRUE
605     BOOLEAN    is_sco_active;
606 #endif
607     tBTM_STATUS  status;
608     tBTM_PM_MODE pwr_mode;
609     tBTM_PM_PWR_MD settings;
610 #if (BT_USE_TRACES == TRUE)
611     BD_ADDR_PTR  p_bda;
612 #endif
613     BTM_TRACE_API ("BTM_SwitchRole BDA: %02x-%02x-%02x-%02x-%02x-%02x",
614                     remote_bd_addr[0], remote_bd_addr[1], remote_bd_addr[2],
615                     remote_bd_addr[3], remote_bd_addr[4], remote_bd_addr[5]);
616 
617     /* Make sure the local device supports switching */
618     if (!controller_get_interface()->supports_master_slave_role_switch())
619         return(BTM_MODE_UNSUPPORTED);
620 
621     if (btm_cb.devcb.p_switch_role_cb && p_cb)
622     {
623 #if (BT_USE_TRACES == TRUE)
624         p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
625         BTM_TRACE_DEBUG ("Role switch on other device is in progress 0x%02x%02x%02x%02x%02x%02x",
626                           p_bda[0], p_bda[1], p_bda[2],
627                           p_bda[3], p_bda[4], p_bda[5]);
628 #endif
629         return(BTM_BUSY);
630     }
631 
632     if ((p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
633         return(BTM_UNKNOWN_ADDR);
634 
635     /* Finished if already in desired role */
636     if (p->link_role == new_role)
637         return(BTM_SUCCESS);
638 
639 #if BTM_SCO_INCLUDED == TRUE
640     /* Check if there is any SCO Active on this BD Address */
641     is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
642 
643     if (is_sco_active == TRUE)
644         return(BTM_NO_RESOURCES);
645 #endif
646 
647     /* Ignore role switch request if the previous request was not completed */
648     if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE)
649     {
650         BTM_TRACE_DEBUG ("BTM_SwitchRole busy: %d",
651                           p->switch_role_state);
652         return(BTM_BUSY);
653     }
654 
655     if ((status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode)) != BTM_SUCCESS)
656         return(status);
657 
658     /* Wake up the link if in sniff or park before attempting switch */
659     if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF)
660     {
661         memset( (void*)&settings, 0, sizeof(settings));
662         settings.mode = BTM_PM_MD_ACTIVE;
663         status = BTM_SetPowerMode (BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
664         if (status != BTM_CMD_STARTED)
665             return(BTM_WRONG_MODE);
666 
667         p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
668     }
669     /* some devices do not support switch while encryption is on */
670     else
671     {
672         p_dev_rec = btm_find_dev (remote_bd_addr);
673         if ((p_dev_rec != NULL)
674             && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0)
675             && !BTM_EPR_AVAILABLE(p))
676         {
677             /* bypass turning off encryption if change link key is already doing it */
678             if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF)
679             {
680                 if (!btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
681                     return(BTM_NO_RESOURCES);
682                 else
683                     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
684             }
685 
686             p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
687         }
688         else
689         {
690             if (!btsnd_hcic_switch_role (remote_bd_addr, new_role))
691                 return(BTM_NO_RESOURCES);
692 
693             p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
694 
695 #if BTM_DISC_DURING_RS == TRUE
696             if (p_dev_rec)
697                 p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
698 #endif
699         }
700     }
701 
702     /* Initialize return structure in case request fails */
703     if (p_cb)
704     {
705         memcpy (btm_cb.devcb.switch_role_ref_data.remote_bd_addr, remote_bd_addr,
706                 BD_ADDR_LEN);
707         btm_cb.devcb.switch_role_ref_data.role = new_role;
708         /* initialized to an error code */
709         btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
710         btm_cb.devcb.p_switch_role_cb = p_cb;
711     }
712     return(BTM_CMD_STARTED);
713 }
714 
715 /*******************************************************************************
716 **
717 ** Function         btm_acl_encrypt_change
718 **
719 ** Description      This function is when encryption of the connection is
720 **                  completed by the LM.  Checks to see if a role switch or
721 **                  change of link key was active and initiates or continues
722 **                  process if needed.
723 **
724 ** Returns          void
725 **
726 *******************************************************************************/
btm_acl_encrypt_change(UINT16 handle,UINT8 status,UINT8 encr_enable)727 void btm_acl_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
728 {
729     tACL_CONN *p;
730     UINT8     xx;
731     tBTM_SEC_DEV_REC  *p_dev_rec;
732     tBTM_BL_ROLE_CHG_DATA   evt;
733 
734     BTM_TRACE_DEBUG ("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
735                       handle, status, encr_enable);
736     xx = btm_handle_to_acl_index(handle);
737     /* don't assume that we can never get a bad hci_handle */
738     if (xx < MAX_L2CAP_LINKS)
739         p = &btm_cb.acl_db[xx];
740     else
741         return;
742 
743     /* Process Role Switch if active */
744     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF)
745     {
746         /* if encryption turn off failed we still will try to switch role */
747         if (encr_enable)
748         {
749             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
750             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
751         }
752         else
753         {
754             p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
755             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
756         }
757 
758         if (!btsnd_hcic_switch_role (p->remote_addr, (UINT8)!p->link_role))
759         {
760             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
761             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
762             btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status, p->remote_addr);
763         }
764 #if BTM_DISC_DURING_RS == TRUE
765         else
766         {
767             if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL)
768                 p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
769         }
770 #endif
771 
772     }
773     /* Finished enabling Encryption after role switch */
774     else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON)
775     {
776         p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
777         p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
778         btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status, p->remote_addr);
779 
780         /* if role change event is registered, report it now */
781         if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK))
782         {
783             evt.event       = BTM_BL_ROLE_CHG_EVT;
784             evt.new_role    = btm_cb.devcb.switch_role_ref_data.role;
785             evt.p_bda       = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
786             evt.hci_status  = btm_cb.devcb.switch_role_ref_data.hci_status;
787             (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
788 
789             BTM_TRACE_DEBUG("Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
790                              evt.new_role, evt.hci_status, p->switch_role_state);
791         }
792 
793 #if BTM_DISC_DURING_RS == TRUE
794         /* If a disconnect is pending, issue it now that role switch has completed */
795         if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL)
796         {
797             if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING)
798             {
799                 BTM_TRACE_WARNING("btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
800                 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
801             }
802             BTM_TRACE_ERROR("btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
803                             PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
804             p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
805         }
806 #endif
807     }
808 }
809 /*******************************************************************************
810 **
811 ** Function         BTM_SetLinkPolicy
812 **
813 ** Description      Create and send HCI "Write Policy Set" command
814 **
815 ** Returns          status of the operation
816 **
817 *******************************************************************************/
BTM_SetLinkPolicy(BD_ADDR remote_bda,UINT16 * settings)818 tBTM_STATUS BTM_SetLinkPolicy (BD_ADDR remote_bda, UINT16 *settings)
819 {
820     tACL_CONN   *p;
821     UINT8       *localFeatures = BTM_ReadLocalFeatures();
822     BTM_TRACE_DEBUG ("BTM_SetLinkPolicy");
823 /*    BTM_TRACE_API ("BTM_SetLinkPolicy: requested settings: 0x%04x", *settings ); */
824 
825     /* First, check if hold mode is supported */
826     if (*settings != HCI_DISABLE_ALL_LM_MODES)
827     {
828         if ( (*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) && (!HCI_SWITCH_SUPPORTED(localFeatures)) )
829         {
830             *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
831             BTM_TRACE_API ("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)", *settings );
832         }
833         if ( (*settings & HCI_ENABLE_HOLD_MODE) && (!HCI_HOLD_MODE_SUPPORTED(localFeatures)) )
834         {
835             *settings &= (~HCI_ENABLE_HOLD_MODE);
836             BTM_TRACE_API ("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)", *settings );
837         }
838         if ( (*settings & HCI_ENABLE_SNIFF_MODE) && (!HCI_SNIFF_MODE_SUPPORTED(localFeatures)) )
839         {
840             *settings &= (~HCI_ENABLE_SNIFF_MODE);
841             BTM_TRACE_API ("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)", *settings );
842         }
843         if ( (*settings & HCI_ENABLE_PARK_MODE) && (!HCI_PARK_MODE_SUPPORTED(localFeatures)) )
844         {
845             *settings &= (~HCI_ENABLE_PARK_MODE);
846             BTM_TRACE_API ("BTM_SetLinkPolicy park not supported (settings: 0x%04x)", *settings );
847         }
848     }
849 
850     if ((p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR)) != NULL)
851         return(btsnd_hcic_write_policy_set (p->hci_handle, *settings) ? BTM_CMD_STARTED : BTM_NO_RESOURCES);
852 
853     /* If here, no BD Addr found */
854     return(BTM_UNKNOWN_ADDR);
855 }
856 
857 /*******************************************************************************
858 **
859 ** Function         BTM_SetDefaultLinkPolicy
860 **
861 ** Description      Set the default value for HCI "Write Policy Set" command
862 **                  to use when an ACL link is created.
863 **
864 ** Returns          void
865 **
866 *******************************************************************************/
BTM_SetDefaultLinkPolicy(UINT16 settings)867 void BTM_SetDefaultLinkPolicy (UINT16 settings)
868 {
869     UINT8 *localFeatures = BTM_ReadLocalFeatures();
870 
871     BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
872 
873     if((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) && (!HCI_SWITCH_SUPPORTED(localFeatures)))
874     {
875         settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
876         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)", settings);
877     }
878     if ((settings & HCI_ENABLE_HOLD_MODE) && (!HCI_HOLD_MODE_SUPPORTED(localFeatures)))
879     {
880         settings &= ~HCI_ENABLE_HOLD_MODE;
881         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)", settings);
882     }
883     if ((settings & HCI_ENABLE_SNIFF_MODE) && (!HCI_SNIFF_MODE_SUPPORTED(localFeatures)))
884     {
885         settings &= ~HCI_ENABLE_SNIFF_MODE;
886         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)", settings);
887     }
888     if ((settings & HCI_ENABLE_PARK_MODE) && (!HCI_PARK_MODE_SUPPORTED(localFeatures)))
889     {
890         settings &= ~HCI_ENABLE_PARK_MODE;
891         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)", settings);
892     }
893     BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
894 
895     btm_cb.btm_def_link_policy = settings;
896 
897     /* Set the default Link Policy of the controller */
898     btsnd_hcic_write_def_policy_set(settings);
899 }
900 
901 
btm_use_preferred_conn_params(BD_ADDR bda)902 void btm_use_preferred_conn_params(BD_ADDR bda) {
903     tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr (bda, BT_TRANSPORT_LE);
904     tBTM_SEC_DEV_REC    *p_dev_rec = btm_find_or_alloc_dev (bda);
905 
906     /* If there are any preferred connection parameters, set them now */
907     if ( (p_dev_rec->conn_params.min_conn_int     >= BTM_BLE_CONN_INT_MIN ) &&
908          (p_dev_rec->conn_params.min_conn_int     <= BTM_BLE_CONN_INT_MAX ) &&
909          (p_dev_rec->conn_params.max_conn_int     >= BTM_BLE_CONN_INT_MIN ) &&
910          (p_dev_rec->conn_params.max_conn_int     <= BTM_BLE_CONN_INT_MAX ) &&
911          (p_dev_rec->conn_params.slave_latency    <= BTM_BLE_CONN_LATENCY_MAX ) &&
912          (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
913          (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
914          ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
915           p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
916           (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
917           (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
918           (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout)))
919     {
920         BTM_TRACE_DEBUG ("%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d supervision_tout=%d", __func__,
921                             p_lcb->handle, p_dev_rec->conn_params.min_conn_int, p_dev_rec->conn_params.max_conn_int,
922                             p_dev_rec->conn_params.slave_latency, p_dev_rec->conn_params.supervision_tout);
923 
924         p_lcb->min_interval =  p_dev_rec->conn_params.min_conn_int;
925         p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
926         p_lcb->timeout      = p_dev_rec->conn_params.supervision_tout;
927         p_lcb->latency      = p_dev_rec->conn_params.slave_latency;
928 
929         btsnd_hcic_ble_upd_ll_conn_params (p_lcb->handle,
930                                            p_dev_rec->conn_params.min_conn_int,
931                                            p_dev_rec->conn_params.max_conn_int,
932                                            p_dev_rec->conn_params.slave_latency,
933                                            p_dev_rec->conn_params.supervision_tout,
934                                            0, 0);
935     }
936 }
937 
938 /*******************************************************************************
939 **
940 ** Function         btm_read_remote_version_complete
941 **
942 ** Description      This function is called when the command complete message
943 **                  is received from the HCI for the remote version info.
944 **
945 ** Returns          void
946 **
947 *******************************************************************************/
btm_read_remote_version_complete(UINT8 * p)948 void btm_read_remote_version_complete (UINT8 *p)
949 {
950     tACL_CONN        *p_acl_cb = &btm_cb.acl_db[0];
951     UINT8             status;
952     UINT16            handle;
953     int               xx;
954     BTM_TRACE_DEBUG ("btm_read_remote_version_complete");
955 
956     STREAM_TO_UINT8  (status, p);
957     STREAM_TO_UINT16 (handle, p);
958 
959     /* Look up the connection by handle and copy features */
960     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++)
961     {
962         if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle))
963         {
964             if (status == HCI_SUCCESS)
965             {
966                 STREAM_TO_UINT8  (p_acl_cb->lmp_version, p);
967                 STREAM_TO_UINT16 (p_acl_cb->manufacturer, p);
968                 STREAM_TO_UINT16 (p_acl_cb->lmp_subversion, p);
969             }
970 
971 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
972             if (p_acl_cb->transport == BT_TRANSPORT_LE) {
973                 l2cble_notify_le_connection (p_acl_cb->remote_addr);
974                 btm_use_preferred_conn_params(p_acl_cb->remote_addr);
975             }
976 #endif  // (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
977             break;
978         }
979     }
980 }
981 
982 
983 /*******************************************************************************
984 **
985 ** Function         btm_process_remote_ext_features
986 **
987 ** Description      Local function called to process all extended features pages
988 **                  read from a remote device.
989 **
990 ** Returns          void
991 **
992 *******************************************************************************/
btm_process_remote_ext_features(tACL_CONN * p_acl_cb,UINT8 num_read_pages)993 void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages)
994 {
995     UINT16              handle = p_acl_cb->hci_handle;
996     tBTM_SEC_DEV_REC    *p_dev_rec = btm_find_dev_by_handle (handle);
997     UINT8               page_idx;
998 
999     BTM_TRACE_DEBUG ("btm_process_remote_ext_features");
1000 
1001     /* Make sure we have the record to save remote features information */
1002     if (p_dev_rec == NULL)
1003     {
1004         /* Get a new device; might be doing dedicated bonding */
1005         p_dev_rec = btm_find_or_alloc_dev (p_acl_cb->remote_addr);
1006     }
1007 
1008     p_acl_cb->num_read_pages = num_read_pages;
1009     p_dev_rec->num_read_pages = num_read_pages;
1010 
1011     /* Move the pages to placeholder */
1012     for (page_idx = 0; page_idx < num_read_pages; page_idx++)
1013     {
1014         if (page_idx > HCI_EXT_FEATURES_PAGE_MAX)
1015         {
1016             BTM_TRACE_ERROR("%s: page=%d unexpected", __FUNCTION__, page_idx);
1017             break;
1018         }
1019         memcpy (p_dev_rec->features[page_idx], p_acl_cb->peer_lmp_features[page_idx],
1020                 HCI_FEATURE_BYTES_PER_PAGE);
1021     }
1022 
1023     const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
1024 
1025     /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
1026     btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
1027 
1028     BTM_TRACE_API("%s: pend:%d", __FUNCTION__, req_pend);
1029     if (req_pend)
1030     {
1031         /* Request for remaining Security Features (if any) */
1032         l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
1033     }
1034 }
1035 
1036 
1037 /*******************************************************************************
1038 **
1039 ** Function         btm_read_remote_features
1040 **
1041 ** Description      Local function called to send a read remote supported features/
1042 **                  remote extended features page[0].
1043 **
1044 ** Returns          void
1045 **
1046 *******************************************************************************/
btm_read_remote_features(UINT16 handle)1047 void btm_read_remote_features (UINT16 handle)
1048 {
1049     UINT8       acl_idx;
1050     tACL_CONN   *p_acl_cb;
1051 
1052     BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
1053 
1054     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1055     {
1056         BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
1057         return;
1058     }
1059 
1060     p_acl_cb = &btm_cb.acl_db[acl_idx];
1061     p_acl_cb->num_read_pages = 0;
1062     memset (p_acl_cb->peer_lmp_features, 0, sizeof(p_acl_cb->peer_lmp_features));
1063 
1064     /* first send read remote supported features HCI command */
1065     /* because we don't know whether the remote support extended feature command */
1066     btsnd_hcic_rmt_features_req (handle);
1067 }
1068 
1069 
1070 /*******************************************************************************
1071 **
1072 ** Function         btm_read_remote_ext_features
1073 **
1074 ** Description      Local function called to send a read remote extended features
1075 **
1076 ** Returns          void
1077 **
1078 *******************************************************************************/
btm_read_remote_ext_features(UINT16 handle,UINT8 page_number)1079 void btm_read_remote_ext_features (UINT16 handle, UINT8 page_number)
1080 {
1081     BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle, page_number);
1082 
1083     btsnd_hcic_rmt_ext_features(handle, page_number);
1084 }
1085 
1086 
1087 /*******************************************************************************
1088 **
1089 ** Function         btm_read_remote_features_complete
1090 **
1091 ** Description      This function is called when the remote supported features
1092 **                  complete event is received from the HCI.
1093 **
1094 ** Returns          void
1095 **
1096 *******************************************************************************/
btm_read_remote_features_complete(UINT8 * p)1097 void btm_read_remote_features_complete (UINT8 *p)
1098 {
1099     tACL_CONN        *p_acl_cb;
1100     UINT8             status;
1101     UINT16            handle;
1102     UINT8            acl_idx;
1103 
1104     BTM_TRACE_DEBUG ("btm_read_remote_features_complete");
1105     STREAM_TO_UINT8  (status, p);
1106 
1107     if (status != HCI_SUCCESS)
1108     {
1109         BTM_TRACE_ERROR ("btm_read_remote_features_complete failed (status 0x%02x)", status);
1110         return;
1111     }
1112 
1113         STREAM_TO_UINT16 (handle, p);
1114 
1115     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1116         {
1117         BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid", handle);
1118         return;
1119                 }
1120 
1121     p_acl_cb = &btm_cb.acl_db[acl_idx];
1122 
1123     /* Copy the received features page */
1124     STREAM_TO_ARRAY(p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0], p,
1125                     HCI_FEATURE_BYTES_PER_PAGE);
1126 
1127     if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])) &&
1128         (controller_get_interface()->supports_reading_remote_extended_features()))
1129     {
1130         /* if the remote controller has extended features and local controller supports
1131         ** HCI_Read_Remote_Extended_Features command then start reading these feature starting
1132         ** with extended features page 1 */
1133         BTM_TRACE_DEBUG ("Start reading remote extended features");
1134         btm_read_remote_ext_features(handle, HCI_EXT_FEATURES_PAGE_1);
1135         return;
1136     }
1137 
1138     /* Remote controller has no extended features. Process remote controller supported features
1139        (features page HCI_EXT_FEATURES_PAGE_0). */
1140     btm_process_remote_ext_features (p_acl_cb, 1);
1141 
1142     /* Continue with HCI connection establishment */
1143     btm_establish_continue (p_acl_cb);
1144 }
1145 
1146 /*******************************************************************************
1147 **
1148 ** Function         btm_read_remote_ext_features_complete
1149 **
1150 ** Description      This function is called when the remote extended features
1151 **                  complete event is received from the HCI.
1152 **
1153 ** Returns          void
1154 **
1155 *******************************************************************************/
btm_read_remote_ext_features_complete(UINT8 * p)1156 void btm_read_remote_ext_features_complete (UINT8 *p)
1157 {
1158     tACL_CONN   *p_acl_cb;
1159     UINT8       page_num, max_page;
1160     UINT16      handle;
1161     UINT8       acl_idx;
1162 
1163     BTM_TRACE_DEBUG ("btm_read_remote_ext_features_complete");
1164 
1165     ++p;
1166     STREAM_TO_UINT16 (handle, p);
1167     STREAM_TO_UINT8  (page_num, p);
1168     STREAM_TO_UINT8  (max_page, p);
1169 
1170     /* Validate parameters */
1171     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1172     {
1173         BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid", handle);
1174         return;
1175     }
1176 
1177     if (max_page > HCI_EXT_FEATURES_PAGE_MAX)
1178     {
1179         BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown", max_page);
1180         return;
1181     }
1182 
1183     p_acl_cb = &btm_cb.acl_db[acl_idx];
1184 
1185     /* Copy the received features page */
1186     STREAM_TO_ARRAY(p_acl_cb->peer_lmp_features[page_num], p, HCI_FEATURE_BYTES_PER_PAGE);
1187 
1188     /* If there is the next remote features page and
1189      * we have space to keep this page data - read this page */
1190     if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX))
1191     {
1192         page_num++;
1193         BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)", page_num);
1194         btm_read_remote_ext_features (handle, page_num);
1195         return;
1196     }
1197 
1198     /* Reading of remote feature pages is complete */
1199     BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)", page_num);
1200 
1201     /* Process the pages */
1202     btm_process_remote_ext_features (p_acl_cb, (UINT8) (page_num + 1));
1203 
1204     /* Continue with HCI connection establishment */
1205     btm_establish_continue (p_acl_cb);
1206 }
1207 
1208 /*******************************************************************************
1209 **
1210 ** Function         btm_read_remote_ext_features_failed
1211 **
1212 ** Description      This function is called when the remote extended features
1213 **                  complete event returns a failed status.
1214 **
1215 ** Returns          void
1216 **
1217 *******************************************************************************/
btm_read_remote_ext_features_failed(UINT8 status,UINT16 handle)1218 void btm_read_remote_ext_features_failed (UINT8 status, UINT16 handle)
1219 {
1220     tACL_CONN   *p_acl_cb;
1221     UINT8       acl_idx;
1222 
1223     BTM_TRACE_WARNING ("btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1224                          status, handle);
1225 
1226     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1227     {
1228         BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid", handle);
1229         return;
1230     }
1231 
1232     p_acl_cb = &btm_cb.acl_db[acl_idx];
1233 
1234     /* Process supported features only */
1235     btm_process_remote_ext_features (p_acl_cb, 1);
1236 
1237     /* Continue HCI connection establishment */
1238     btm_establish_continue (p_acl_cb);
1239 }
1240 
1241 /*******************************************************************************
1242 **
1243 ** Function         btm_establish_continue
1244 **
1245 ** Description      This function is called when the command complete message
1246 **                  is received from the HCI for the read local link policy request.
1247 **
1248 ** Returns          void
1249 **
1250 *******************************************************************************/
btm_establish_continue(tACL_CONN * p_acl_cb)1251 void btm_establish_continue (tACL_CONN *p_acl_cb)
1252 {
1253         tBTM_BL_EVENT_DATA  evt_data;
1254         BTM_TRACE_DEBUG ("btm_establish_continue");
1255 #if (!defined(BTM_BYPASS_EXTRA_ACL_SETUP) || BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1256 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
1257         if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR)
1258 #endif
1259         {
1260             /* For now there are a some devices that do not like sending */
1261             /* commands events and data at the same time. */
1262             /* Set the packet types to the default allowed by the device */
1263             btm_set_packet_types (p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1264 
1265             if (btm_cb.btm_def_link_policy)
1266                 BTM_SetLinkPolicy (p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1267         }
1268 #endif
1269         p_acl_cb->link_up_issued = TRUE;
1270 
1271         /* If anyone cares, tell him database changed */
1272         if (btm_cb.p_bl_changed_cb)
1273         {
1274             evt_data.event = BTM_BL_CONN_EVT;
1275             evt_data.conn.p_bda = p_acl_cb->remote_addr;
1276             evt_data.conn.p_bdn = p_acl_cb->remote_name;
1277             evt_data.conn.p_dc  = p_acl_cb->remote_dc;
1278             evt_data.conn.p_features = p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0];
1279 #if BLE_INCLUDED == TRUE
1280             evt_data.conn.handle = p_acl_cb->hci_handle;
1281             evt_data.conn.transport = p_acl_cb->transport;
1282 #endif
1283 
1284             (*btm_cb.p_bl_changed_cb)(&evt_data);
1285         }
1286         btm_acl_update_busy_level (BTM_BLI_ACL_UP_EVT);
1287 }
1288 
1289 
1290 /*******************************************************************************
1291 **
1292 ** Function         BTM_SetDefaultLinkSuperTout
1293 **
1294 ** Description      Set the default value for HCI "Write Link Supervision Timeout"
1295 **                  command to use when an ACL link is created.
1296 **
1297 ** Returns          void
1298 **
1299 *******************************************************************************/
BTM_SetDefaultLinkSuperTout(UINT16 timeout)1300 void BTM_SetDefaultLinkSuperTout (UINT16 timeout)
1301 {
1302     BTM_TRACE_DEBUG ("BTM_SetDefaultLinkSuperTout");
1303     btm_cb.btm_def_link_super_tout = timeout;
1304 }
1305 
1306 /*******************************************************************************
1307 **
1308 ** Function         BTM_GetLinkSuperTout
1309 **
1310 ** Description      Read the link supervision timeout value of the connection
1311 **
1312 ** Returns          status of the operation
1313 **
1314 *******************************************************************************/
BTM_GetLinkSuperTout(BD_ADDR remote_bda,UINT16 * p_timeout)1315 tBTM_STATUS BTM_GetLinkSuperTout (BD_ADDR remote_bda, UINT16 *p_timeout)
1316 {
1317     tACL_CONN   *p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1318 
1319     BTM_TRACE_DEBUG ("BTM_GetLinkSuperTout");
1320     if (p != (tACL_CONN *)NULL)
1321     {
1322         *p_timeout = p->link_super_tout;
1323         return(BTM_SUCCESS);
1324     }
1325     /* If here, no BD Addr found */
1326     return(BTM_UNKNOWN_ADDR);
1327 }
1328 
1329 
1330 /*******************************************************************************
1331 **
1332 ** Function         BTM_SetLinkSuperTout
1333 **
1334 ** Description      Create and send HCI "Write Link Supervision Timeout" command
1335 **
1336 ** Returns          status of the operation
1337 **
1338 *******************************************************************************/
BTM_SetLinkSuperTout(BD_ADDR remote_bda,UINT16 timeout)1339 tBTM_STATUS BTM_SetLinkSuperTout (BD_ADDR remote_bda, UINT16 timeout)
1340 {
1341     tACL_CONN   *p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1342 
1343     BTM_TRACE_DEBUG ("BTM_SetLinkSuperTout");
1344     if (p != (tACL_CONN *)NULL)
1345     {
1346         p->link_super_tout = timeout;
1347 
1348         /* Only send if current role is Master; 2.0 spec requires this */
1349         if (p->link_role == BTM_ROLE_MASTER)
1350         {
1351             if (!btsnd_hcic_write_link_super_tout (LOCAL_BR_EDR_CONTROLLER_ID,
1352                                                    p->hci_handle, timeout))
1353                 return(BTM_NO_RESOURCES);
1354 
1355             return(BTM_CMD_STARTED);
1356         }
1357         else
1358             return(BTM_SUCCESS);
1359     }
1360 
1361     /* If here, no BD Addr found */
1362     return(BTM_UNKNOWN_ADDR);
1363 }
1364 
1365 /*******************************************************************************
1366 **
1367 ** Function         BTM_IsAclConnectionUp
1368 **
1369 ** Description      This function is called to check if an ACL connection exists
1370 **                  to a specific remote BD Address.
1371 **
1372 ** Returns          TRUE if connection is up, else FALSE.
1373 **
1374 *******************************************************************************/
BTM_IsAclConnectionUp(BD_ADDR remote_bda,tBT_TRANSPORT transport)1375 BOOLEAN BTM_IsAclConnectionUp (BD_ADDR remote_bda, tBT_TRANSPORT transport)
1376 {
1377     tACL_CONN   *p;
1378 
1379     BTM_TRACE_API ("BTM_IsAclConnectionUp: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1380                     remote_bda[0], remote_bda[1], remote_bda[2],
1381                     remote_bda[3], remote_bda[4], remote_bda[5]);
1382 
1383     p = btm_bda_to_acl(remote_bda, transport);
1384     if (p != (tACL_CONN *)NULL)
1385     {
1386         return(TRUE);
1387     }
1388 
1389     /* If here, no BD Addr found */
1390     return(FALSE);
1391 }
1392 
1393 /*******************************************************************************
1394 **
1395 ** Function         BTM_GetNumAclLinks
1396 **
1397 ** Description      This function is called to count the number of
1398 **                  ACL links that are active.
1399 **
1400 ** Returns          UINT16  Number of active ACL links
1401 **
1402 *******************************************************************************/
BTM_GetNumAclLinks(void)1403 UINT16 BTM_GetNumAclLinks (void)
1404 {
1405     uint16_t num_acl = 0;
1406 
1407     for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i)
1408     {
1409         if (btm_cb.acl_db[i].in_use)
1410             ++num_acl;
1411     }
1412 
1413     return num_acl;
1414 }
1415 
1416 /*******************************************************************************
1417 **
1418 ** Function         btm_get_acl_disc_reason_code
1419 **
1420 ** Description      This function is called to get the disconnection reason code
1421 **                  returned by the HCI at disconnection complete event.
1422 **
1423 ** Returns          TRUE if connection is up, else FALSE.
1424 **
1425 *******************************************************************************/
btm_get_acl_disc_reason_code(void)1426 UINT16 btm_get_acl_disc_reason_code (void)
1427 {
1428     UINT8 res = btm_cb.acl_disc_reason;
1429     BTM_TRACE_DEBUG ("btm_get_acl_disc_reason_code");
1430     return(res);
1431 }
1432 
1433 
1434 /*******************************************************************************
1435 **
1436 ** Function         BTM_GetHCIConnHandle
1437 **
1438 ** Description      This function is called to get the handle for an ACL connection
1439 **                  to a specific remote BD Address.
1440 **
1441 ** Returns          the handle of the connection, or 0xFFFF if none.
1442 **
1443 *******************************************************************************/
BTM_GetHCIConnHandle(const BD_ADDR remote_bda,tBT_TRANSPORT transport)1444 UINT16 BTM_GetHCIConnHandle (const BD_ADDR remote_bda, tBT_TRANSPORT transport)
1445 {
1446     tACL_CONN   *p;
1447     BTM_TRACE_DEBUG ("BTM_GetHCIConnHandle");
1448     p = btm_bda_to_acl(remote_bda, transport);
1449     if (p != (tACL_CONN *)NULL)
1450     {
1451         return(p->hci_handle);
1452     }
1453 
1454     /* If here, no BD Addr found */
1455     return(0xFFFF);
1456 }
1457 
1458 /*******************************************************************************
1459 **
1460 ** Function         btm_process_clk_off_comp_evt
1461 **
1462 ** Description      This function is called when clock offset command completes.
1463 **
1464 ** Input Parms      hci_handle - connection handle associated with the change
1465 **                  clock offset
1466 **
1467 ** Returns          void
1468 **
1469 *******************************************************************************/
btm_process_clk_off_comp_evt(UINT16 hci_handle,UINT16 clock_offset)1470 void btm_process_clk_off_comp_evt (UINT16 hci_handle, UINT16 clock_offset)
1471 {
1472     UINT8      xx;
1473     BTM_TRACE_DEBUG ("btm_process_clk_off_comp_evt");
1474     /* Look up the connection by handle and set the current mode */
1475     if ((xx = btm_handle_to_acl_index(hci_handle)) < MAX_L2CAP_LINKS)
1476         btm_cb.acl_db[xx].clock_offset = clock_offset;
1477 }
1478 
1479 /*******************************************************************************
1480 **
1481 ** Function         btm_acl_role_changed
1482 **
1483 ** Description      This function is called whan a link's master/slave role change
1484 **                  event or command status event (with error) is received.
1485 **                  It updates the link control block, and calls
1486 **                  the registered callback with status and role (if registered).
1487 **
1488 ** Returns          void
1489 **
1490 *******************************************************************************/
btm_acl_role_changed(UINT8 hci_status,BD_ADDR bd_addr,UINT8 new_role)1491 void btm_acl_role_changed (UINT8 hci_status, BD_ADDR bd_addr, UINT8 new_role)
1492 {
1493     UINT8                   *p_bda = (bd_addr) ? bd_addr :
1494                                         btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1495     tACL_CONN               *p = btm_bda_to_acl(p_bda, BT_TRANSPORT_BR_EDR);
1496     tBTM_ROLE_SWITCH_CMPL   *p_data = &btm_cb.devcb.switch_role_ref_data;
1497     tBTM_SEC_DEV_REC        *p_dev_rec;
1498     tBTM_BL_ROLE_CHG_DATA   evt;
1499 
1500     BTM_TRACE_DEBUG ("btm_acl_role_changed");
1501     /* Ignore any stray events */
1502     if (p == NULL)
1503     {
1504         /* it could be a failure */
1505         if (hci_status != HCI_SUCCESS)
1506             btm_acl_report_role_change(hci_status, bd_addr);
1507         return;
1508     }
1509 
1510     p_data->hci_status = hci_status;
1511 
1512     if (hci_status == HCI_SUCCESS)
1513     {
1514         p_data->role = new_role;
1515         memcpy(p_data->remote_bd_addr, p_bda, BD_ADDR_LEN);
1516 
1517         /* Update cached value */
1518         p->link_role = new_role;
1519 
1520         /* Reload LSTO: link supervision timeout is reset in the LM after a role switch */
1521         if (new_role == BTM_ROLE_MASTER)
1522         {
1523             BTM_SetLinkSuperTout (p->remote_addr, p->link_super_tout);
1524         }
1525     }
1526     else
1527     {
1528         /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1529         new_role = p->link_role;
1530     }
1531 
1532     /* Check if any SCO req is pending for role change */
1533     btm_sco_chk_pend_rolechange (p->hci_handle);
1534 
1535     /* if switching state is switching we need to turn encryption on */
1536     /* if idle, we did not change encryption */
1537     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING)
1538     {
1539         if (btsnd_hcic_set_conn_encrypt (p->hci_handle, TRUE))
1540         {
1541             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1542             p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1543             return;
1544         }
1545     }
1546 
1547     /* Set the switch_role_state to IDLE since the reply received from HCI */
1548     /* regardless of its result either success or failed. */
1549     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)
1550     {
1551         p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1552         p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1553     }
1554 
1555     /* if role switch complete is needed, report it now */
1556     btm_acl_report_role_change(hci_status, bd_addr);
1557 
1558     /* if role change event is registered, report it now */
1559     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK))
1560     {
1561         evt.event       = BTM_BL_ROLE_CHG_EVT;
1562         evt.new_role    = new_role;
1563         evt.p_bda       = p_bda;
1564         evt.hci_status  = hci_status;
1565         (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
1566     }
1567 
1568     BTM_TRACE_DEBUG("Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
1569                      p_data->role, p_data->hci_status, p->switch_role_state);
1570 
1571 #if BTM_DISC_DURING_RS == TRUE
1572     /* If a disconnect is pending, issue it now that role switch has completed */
1573     if ((p_dev_rec = btm_find_dev (p_bda)) != NULL)
1574     {
1575         if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING)
1576         {
1577             BTM_TRACE_WARNING("btm_acl_role_changed -> Issuing delayed HCI_Disconnect!!!");
1578             btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1579         }
1580         BTM_TRACE_ERROR("tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1581                         PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1582         p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
1583     }
1584 
1585 #endif
1586 
1587 }
1588 
1589 /*******************************************************************************
1590 **
1591 ** Function         BTM_AllocateSCN
1592 **
1593 ** Description      Look through the Server Channel Numbers for a free one.
1594 **
1595 ** Returns          Allocated SCN number or 0 if none.
1596 **
1597 *******************************************************************************/
1598 
BTM_AllocateSCN(void)1599 UINT8 BTM_AllocateSCN(void)
1600 {
1601     UINT8   x;
1602     BTM_TRACE_DEBUG ("BTM_AllocateSCN");
1603 
1604     // stack reserves scn 1 for HFP, HSP we still do the correct way
1605     for (x = 1; x < BTM_MAX_SCN; x++)
1606     {
1607         if (!btm_cb.btm_scn[x])
1608         {
1609             btm_cb.btm_scn[x] = TRUE;
1610             return(x+1);
1611         }
1612     }
1613 
1614     return(0);     /* No free ports */
1615 }
1616 
1617 /*******************************************************************************
1618 **
1619 ** Function         BTM_TryAllocateSCN
1620 **
1621 ** Description      Try to allocate a fixed server channel
1622 **
1623 ** Returns          Returns TRUE if server channel was available
1624 **
1625 *******************************************************************************/
1626 
BTM_TryAllocateSCN(UINT8 scn)1627 BOOLEAN BTM_TryAllocateSCN(UINT8 scn)
1628 {
1629     /* Make sure we don't exceed max port range.
1630      * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1631      */
1632     if ( (scn>=BTM_MAX_SCN) || (scn == 1) )
1633         return FALSE;
1634 
1635     /* check if this port is available */
1636     if (!btm_cb.btm_scn[scn-1])
1637     {
1638         btm_cb.btm_scn[scn-1] = TRUE;
1639         return TRUE;
1640     }
1641 
1642     return (FALSE);     /* Port was busy */
1643 }
1644 
1645 /*******************************************************************************
1646 **
1647 ** Function         BTM_FreeSCN
1648 **
1649 ** Description      Free the specified SCN.
1650 **
1651 ** Returns          TRUE or FALSE
1652 **
1653 *******************************************************************************/
BTM_FreeSCN(UINT8 scn)1654 BOOLEAN BTM_FreeSCN(UINT8 scn)
1655 {
1656     BTM_TRACE_DEBUG ("BTM_FreeSCN ");
1657     if (scn <= BTM_MAX_SCN)
1658     {
1659         btm_cb.btm_scn[scn-1] = FALSE;
1660         return(TRUE);
1661     }
1662     else
1663         return(FALSE);      /* Illegal SCN passed in */
1664 }
1665 
1666 /*******************************************************************************
1667 **
1668 ** Function         btm_set_packet_types
1669 **
1670 ** Description      This function sets the packet types used for a specific
1671 **                  ACL connection. It is called internally by btm_acl_created
1672 **                  or by an application/profile by BTM_SetPacketTypes.
1673 **
1674 ** Returns          status of the operation
1675 **
1676 *******************************************************************************/
btm_set_packet_types(tACL_CONN * p,UINT16 pkt_types)1677 tBTM_STATUS btm_set_packet_types (tACL_CONN *p, UINT16 pkt_types)
1678 {
1679     UINT16 temp_pkt_types;
1680     BTM_TRACE_DEBUG ("btm_set_packet_types");
1681     /* Save in the ACL control blocks, types that we support */
1682     temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1683                       btm_cb.btm_acl_pkt_types_supported);
1684 
1685     /* OR in any exception packet types if at least 2.0 version of spec */
1686     temp_pkt_types |= ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1687                        (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1688 
1689     /* Exclude packet types not supported by the peer */
1690     btm_acl_chk_peer_pkt_type_support (p, &temp_pkt_types);
1691 
1692     BTM_TRACE_DEBUG ("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1693 
1694     if (!btsnd_hcic_change_conn_type (p->hci_handle, temp_pkt_types))
1695     {
1696         return(BTM_NO_RESOURCES);
1697     }
1698 
1699     p->pkt_types_mask = temp_pkt_types;
1700 
1701     return(BTM_CMD_STARTED);
1702 }
1703 
1704 /*******************************************************************************
1705 **
1706 ** Function         btm_get_max_packet_size
1707 **
1708 ** Returns          Returns maximum packet size that can be used for current
1709 **                  connection, 0 if connection is not established
1710 **
1711 *******************************************************************************/
btm_get_max_packet_size(BD_ADDR addr)1712 UINT16 btm_get_max_packet_size (BD_ADDR addr)
1713 {
1714     tACL_CONN   *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1715     UINT16      pkt_types = 0;
1716     UINT16      pkt_size = 0;
1717     BTM_TRACE_DEBUG ("btm_get_max_packet_size");
1718     if (p != NULL)
1719     {
1720         pkt_types = p->pkt_types_mask;
1721     }
1722     else
1723     {
1724         /* Special case for when info for the local device is requested */
1725         if (memcmp (controller_get_interface()->get_address(), addr, BD_ADDR_LEN) == 0)
1726         {
1727             pkt_types = btm_cb.btm_acl_pkt_types_supported;
1728         }
1729     }
1730 
1731     if (pkt_types)
1732     {
1733         if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1734             pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1735         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1736             pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1737         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1738             pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1739         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1740             pkt_size = HCI_DH5_PACKET_SIZE;
1741         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1742             pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1743         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1744             pkt_size = HCI_DM5_PACKET_SIZE;
1745         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1746             pkt_size = HCI_DH3_PACKET_SIZE;
1747         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1748             pkt_size = HCI_DM3_PACKET_SIZE;
1749         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1750             pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1751         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1752             pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1753         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1754             pkt_size = HCI_DH1_PACKET_SIZE;
1755         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1756             pkt_size = HCI_DM1_PACKET_SIZE;
1757     }
1758 
1759    return(pkt_size);
1760 }
1761 
1762 /*******************************************************************************
1763 **
1764 ** Function         BTM_ReadRemoteVersion
1765 **
1766 ** Returns          If connected report peer device info
1767 **
1768 *******************************************************************************/
BTM_ReadRemoteVersion(BD_ADDR addr,UINT8 * lmp_version,UINT16 * manufacturer,UINT16 * lmp_sub_version)1769 tBTM_STATUS BTM_ReadRemoteVersion (BD_ADDR addr, UINT8 *lmp_version,
1770                                    UINT16 *manufacturer, UINT16 *lmp_sub_version)
1771 {
1772     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1773     BTM_TRACE_DEBUG ("BTM_ReadRemoteVersion");
1774     if (p == NULL)
1775         return(BTM_UNKNOWN_ADDR);
1776 
1777     if (lmp_version)
1778         *lmp_version = p->lmp_version;
1779 
1780     if (manufacturer)
1781         *manufacturer = p->manufacturer;
1782 
1783     if (lmp_sub_version)
1784         *lmp_sub_version = p->lmp_subversion;
1785 
1786     return(BTM_SUCCESS);
1787 }
1788 
1789 /*******************************************************************************
1790 **
1791 ** Function         BTM_ReadRemoteFeatures
1792 **
1793 ** Returns          pointer to the remote supported features mask (8 bytes)
1794 **
1795 *******************************************************************************/
BTM_ReadRemoteFeatures(BD_ADDR addr)1796 UINT8 *BTM_ReadRemoteFeatures (BD_ADDR addr)
1797 {
1798     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1799     BTM_TRACE_DEBUG ("BTM_ReadRemoteFeatures");
1800     if (p == NULL)
1801     {
1802         return(NULL);
1803     }
1804 
1805     return(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]);
1806 }
1807 
1808 /*******************************************************************************
1809 **
1810 ** Function         BTM_ReadRemoteExtendedFeatures
1811 **
1812 ** Returns          pointer to the remote extended features mask (8 bytes)
1813 **                  or NULL if bad page
1814 **
1815 *******************************************************************************/
BTM_ReadRemoteExtendedFeatures(BD_ADDR addr,UINT8 page_number)1816 UINT8 *BTM_ReadRemoteExtendedFeatures (BD_ADDR addr, UINT8 page_number)
1817 {
1818     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1819     BTM_TRACE_DEBUG ("BTM_ReadRemoteExtendedFeatures");
1820     if (p == NULL)
1821     {
1822         return(NULL);
1823     }
1824 
1825     if (page_number > HCI_EXT_FEATURES_PAGE_MAX)
1826     {
1827         BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown", page_number);
1828         return NULL;
1829     }
1830 
1831     return(p->peer_lmp_features[page_number]);
1832 }
1833 
1834 /*******************************************************************************
1835 **
1836 ** Function         BTM_ReadNumberRemoteFeaturesPages
1837 **
1838 ** Returns          number of features pages read from the remote device.
1839 **
1840 *******************************************************************************/
BTM_ReadNumberRemoteFeaturesPages(BD_ADDR addr)1841 UINT8 BTM_ReadNumberRemoteFeaturesPages (BD_ADDR addr)
1842 {
1843     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1844     BTM_TRACE_DEBUG ("BTM_ReadNumberRemoteFeaturesPages");
1845     if (p == NULL)
1846     {
1847         return(0);
1848     }
1849 
1850     return(p->num_read_pages);
1851 }
1852 
1853 /*******************************************************************************
1854 **
1855 ** Function         BTM_ReadAllRemoteFeatures
1856 **
1857 ** Returns          pointer to all features of the remote (24 bytes).
1858 **
1859 *******************************************************************************/
BTM_ReadAllRemoteFeatures(BD_ADDR addr)1860 UINT8 *BTM_ReadAllRemoteFeatures (BD_ADDR addr)
1861 {
1862     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1863     BTM_TRACE_DEBUG ("BTM_ReadAllRemoteFeatures");
1864     if (p == NULL)
1865     {
1866         return(NULL);
1867     }
1868 
1869     return(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]);
1870 }
1871 
1872 /*******************************************************************************
1873 **
1874 ** Function         BTM_RegBusyLevelNotif
1875 **
1876 ** Description      This function is called to register a callback to receive
1877 **                  busy level change events.
1878 **
1879 ** Returns          BTM_SUCCESS if successfully registered, otherwise error
1880 **
1881 *******************************************************************************/
BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB * p_cb,UINT8 * p_level,tBTM_BL_EVENT_MASK evt_mask)1882 tBTM_STATUS BTM_RegBusyLevelNotif (tBTM_BL_CHANGE_CB *p_cb, UINT8 *p_level,
1883                                    tBTM_BL_EVENT_MASK evt_mask)
1884 {
1885     BTM_TRACE_DEBUG ("BTM_RegBusyLevelNotif");
1886     if (p_level)
1887         *p_level = btm_cb.busy_level;
1888 
1889     btm_cb.bl_evt_mask = evt_mask;
1890 
1891     if (!p_cb)
1892         btm_cb.p_bl_changed_cb = NULL;
1893     else if (btm_cb.p_bl_changed_cb)
1894         return(BTM_BUSY);
1895     else
1896         btm_cb.p_bl_changed_cb = p_cb;
1897 
1898     return(BTM_SUCCESS);
1899 }
1900 
1901 /*******************************************************************************
1902 **
1903 ** Function         BTM_SetQoS
1904 **
1905 ** Description      This function is called to setup QoS
1906 **
1907 ** Returns          status of the operation
1908 **
1909 *******************************************************************************/
BTM_SetQoS(BD_ADDR bd,FLOW_SPEC * p_flow,tBTM_CMPL_CB * p_cb)1910 tBTM_STATUS BTM_SetQoS (BD_ADDR bd, FLOW_SPEC *p_flow, tBTM_CMPL_CB *p_cb)
1911 {
1912     tACL_CONN   *p = &btm_cb.acl_db[0];
1913 
1914     BTM_TRACE_API ("BTM_SetQoS: BdAddr: %02x%02x%02x%02x%02x%02x",
1915                     bd[0], bd[1], bd[2],
1916                     bd[3], bd[4], bd[5]);
1917 
1918     /* If someone already waiting on the version, do not allow another */
1919     if (btm_cb.devcb.p_qos_setup_cmpl_cb)
1920         return(BTM_BUSY);
1921 
1922     if ( (p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR)) != NULL)
1923     {
1924         btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
1925         alarm_set_on_queue(btm_cb.devcb.qos_setup_timer,
1926                            BTM_DEV_REPLY_TIMEOUT_MS,
1927                            btm_qos_setup_timeout, NULL,
1928                            btu_general_alarm_queue);
1929 
1930         if (!btsnd_hcic_qos_setup (p->hci_handle, p_flow->qos_flags, p_flow->service_type,
1931                                    p_flow->token_rate, p_flow->peak_bandwidth,
1932                                    p_flow->latency,p_flow->delay_variation))
1933         {
1934             btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1935             alarm_cancel(btm_cb.devcb.qos_setup_timer);
1936             return(BTM_NO_RESOURCES);
1937         }
1938         else
1939             return(BTM_CMD_STARTED);
1940     }
1941 
1942     /* If here, no BD Addr found */
1943     return(BTM_UNKNOWN_ADDR);
1944 }
1945 
1946 /*******************************************************************************
1947 **
1948 ** Function         btm_qos_setup_timeout
1949 **
1950 ** Description      Callback when QoS setup times out.
1951 **
1952 ** Returns          void
1953 **
1954 *******************************************************************************/
btm_qos_setup_timeout(UNUSED_ATTR void * data)1955 void btm_qos_setup_timeout(UNUSED_ATTR void *data)
1956 {
1957     tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1958     btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1959     if (p_cb)
1960         (*p_cb)((void *) NULL);
1961 }
1962 
1963 /*******************************************************************************
1964 **
1965 ** Function         btm_qos_setup_complete
1966 **
1967 ** Description      This function is called when the command complete message
1968 **                  is received from the HCI for the qos setup request.
1969 **
1970 ** Returns          void
1971 **
1972 *******************************************************************************/
btm_qos_setup_complete(UINT8 status,UINT16 handle,FLOW_SPEC * p_flow)1973 void btm_qos_setup_complete(UINT8 status, UINT16 handle, FLOW_SPEC *p_flow)
1974 {
1975     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1976     tBTM_QOS_SETUP_CMPL     qossu;
1977 
1978     BTM_TRACE_DEBUG("%s", __func__);
1979     alarm_cancel(btm_cb.devcb.qos_setup_timer);
1980     btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1981 
1982     /* If there was a registered callback, call it */
1983     if (p_cb)
1984     {
1985         memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1986         qossu.status = status;
1987         qossu.handle = handle;
1988         if (p_flow != NULL)
1989         {
1990             qossu.flow.qos_flags = p_flow->qos_flags;
1991             qossu.flow.service_type = p_flow->service_type;
1992             qossu.flow.token_rate = p_flow->token_rate;
1993             qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1994             qossu.flow.latency = p_flow->latency;
1995             qossu.flow.delay_variation = p_flow->delay_variation;
1996         }
1997         BTM_TRACE_DEBUG ("BTM: p_flow->delay_variation: 0x%02x",
1998                           qossu.flow.delay_variation);
1999         (*p_cb)(&qossu);
2000     }
2001 }
2002 
2003 /*******************************************************************************
2004 **
2005 ** Function         BTM_ReadRSSI
2006 **
2007 ** Description      This function is called to read the link policy settings.
2008 **                  The address of link policy results are returned in the callback.
2009 **                  (tBTM_RSSI_RESULTS)
2010 **
2011 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2012 **
2013 *******************************************************************************/
BTM_ReadRSSI(BD_ADDR remote_bda,tBTM_CMPL_CB * p_cb)2014 tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2015 {
2016     tACL_CONN   *p;
2017     tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2018 #if BLE_INCLUDED == TRUE
2019     tBT_DEVICE_TYPE dev_type;
2020     tBLE_ADDR_TYPE  addr_type;
2021 #endif
2022     BTM_TRACE_API ("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2023                     remote_bda[0], remote_bda[1], remote_bda[2],
2024                     remote_bda[3], remote_bda[4], remote_bda[5]);
2025 
2026     /* If someone already waiting on the version, do not allow another */
2027     if (btm_cb.devcb.p_rssi_cmpl_cb)
2028         return(BTM_BUSY);
2029 
2030 #if BLE_INCLUDED == TRUE
2031     BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2032     if (dev_type == BT_DEVICE_TYPE_BLE)
2033         transport = BT_TRANSPORT_LE;
2034 #endif
2035 
2036     p = btm_bda_to_acl(remote_bda, transport);
2037     if (p != (tACL_CONN *)NULL)
2038     {
2039         btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
2040         alarm_set_on_queue(btm_cb.devcb.read_rssi_timer,
2041                            BTM_DEV_REPLY_TIMEOUT_MS, btm_read_rssi_timeout,
2042                            NULL, btu_general_alarm_queue);
2043 
2044         if (!btsnd_hcic_read_rssi (p->hci_handle))
2045         {
2046             btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2047             alarm_cancel(btm_cb.devcb.read_rssi_timer);
2048             return(BTM_NO_RESOURCES);
2049         }
2050         else
2051             return(BTM_CMD_STARTED);
2052     }
2053 
2054     /* If here, no BD Addr found */
2055     return(BTM_UNKNOWN_ADDR);
2056 }
2057 
2058 /*******************************************************************************
2059 **
2060 ** Function         BTM_ReadLinkQuality
2061 **
2062 ** Description      This function is called to read the link qulaity.
2063 **                  The value of the link quality is returned in the callback.
2064 **                  (tBTM_LINK_QUALITY_RESULTS)
2065 **
2066 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2067 **
2068 *******************************************************************************/
BTM_ReadLinkQuality(BD_ADDR remote_bda,tBTM_CMPL_CB * p_cb)2069 tBTM_STATUS BTM_ReadLinkQuality (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2070 {
2071     tACL_CONN   *p;
2072 
2073     BTM_TRACE_API ("BTM_ReadLinkQuality: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2074                     remote_bda[0], remote_bda[1], remote_bda[2],
2075                     remote_bda[3], remote_bda[4], remote_bda[5]);
2076 
2077     /* If someone already waiting on the version, do not allow another */
2078     if (btm_cb.devcb.p_link_qual_cmpl_cb)
2079         return(BTM_BUSY);
2080 
2081     p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
2082     if (p != (tACL_CONN *)NULL)
2083     {
2084         btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
2085         alarm_set_on_queue(btm_cb.devcb.read_link_quality_timer,
2086                            BTM_DEV_REPLY_TIMEOUT_MS,
2087                            btm_read_link_quality_timeout, NULL,
2088                            btu_general_alarm_queue);
2089 
2090         if (!btsnd_hcic_get_link_quality (p->hci_handle))
2091         {
2092             btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2093             alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2094             return(BTM_NO_RESOURCES);
2095         }
2096         else
2097             return(BTM_CMD_STARTED);
2098     }
2099 
2100     /* If here, no BD Addr found */
2101     return(BTM_UNKNOWN_ADDR);
2102 }
2103 
2104 /*******************************************************************************
2105 **
2106 ** Function         BTM_ReadTxPower
2107 **
2108 ** Description      This function is called to read the current
2109 **                  TX power of the connection. The tx power level results
2110 **                  are returned in the callback.
2111 **                  (tBTM_RSSI_RESULTS)
2112 **
2113 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2114 **
2115 *******************************************************************************/
BTM_ReadTxPower(BD_ADDR remote_bda,tBT_TRANSPORT transport,tBTM_CMPL_CB * p_cb)2116 tBTM_STATUS BTM_ReadTxPower (BD_ADDR remote_bda, tBT_TRANSPORT transport, tBTM_CMPL_CB *p_cb)
2117 {
2118     tACL_CONN   *p;
2119     BOOLEAN     ret;
2120 #define BTM_READ_RSSI_TYPE_CUR  0x00
2121 #define BTM_READ_RSSI_TYPE_MAX  0X01
2122 
2123     BTM_TRACE_API ("BTM_ReadTxPower: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2124                     remote_bda[0], remote_bda[1], remote_bda[2],
2125                     remote_bda[3], remote_bda[4], remote_bda[5]);
2126 
2127     /* If someone already waiting on the version, do not allow another */
2128     if (btm_cb.devcb.p_tx_power_cmpl_cb)
2129         return(BTM_BUSY);
2130 
2131     p = btm_bda_to_acl(remote_bda, transport);
2132     if (p != (tACL_CONN *)NULL)
2133     {
2134         btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2135         alarm_set_on_queue(btm_cb.devcb.read_tx_power_timer,
2136                        BTM_DEV_REPLY_TIMEOUT_MS,
2137                        btm_read_tx_power_timeout, NULL,
2138                        btu_general_alarm_queue);
2139 
2140 #if BLE_INCLUDED == TRUE
2141         if (p->transport == BT_TRANSPORT_LE)
2142         {
2143             memcpy(btm_cb.devcb.read_tx_pwr_addr, remote_bda, BD_ADDR_LEN);
2144             ret = btsnd_hcic_ble_read_adv_chnl_tx_power();
2145         }
2146         else
2147 #endif
2148         {
2149             ret = btsnd_hcic_read_tx_power (p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2150         }
2151         if (!ret)
2152         {
2153             btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2154             alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2155             return(BTM_NO_RESOURCES);
2156         }
2157         else
2158             return(BTM_CMD_STARTED);
2159     }
2160 
2161     /* If here, no BD Addr found */
2162     return (BTM_UNKNOWN_ADDR);
2163 }
2164 
2165 /*******************************************************************************
2166 **
2167 ** Function         btm_read_tx_power_timeout
2168 **
2169 ** Description      Callback when reading the tx power times out.
2170 **
2171 ** Returns          void
2172 **
2173 *******************************************************************************/
btm_read_tx_power_timeout(UNUSED_ATTR void * data)2174 void btm_read_tx_power_timeout(UNUSED_ATTR void *data)
2175 {
2176     tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2177     btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2178     if (p_cb)
2179         (*p_cb)((void *) NULL);
2180 }
2181 
2182 /*******************************************************************************
2183 **
2184 ** Function         btm_read_tx_power_complete
2185 **
2186 ** Description      This function is called when the command complete message
2187 **                  is received from the HCI for the read tx power request.
2188 **
2189 ** Returns          void
2190 **
2191 *******************************************************************************/
btm_read_tx_power_complete(UINT8 * p,BOOLEAN is_ble)2192 void btm_read_tx_power_complete(UINT8 *p, BOOLEAN is_ble)
2193 {
2194     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2195     tBTM_TX_POWER_RESULTS   results;
2196     UINT16                   handle;
2197     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2198     UINT16                   index;
2199 
2200     BTM_TRACE_DEBUG("%s", __func__);
2201     alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2202     btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2203 
2204     /* If there was a registered callback, call it */
2205     if (p_cb)
2206     {
2207         STREAM_TO_UINT8  (results.hci_status, p);
2208 
2209         if (results.hci_status == HCI_SUCCESS)
2210         {
2211             results.status = BTM_SUCCESS;
2212 
2213             if (!is_ble)
2214             {
2215                 STREAM_TO_UINT16 (handle, p);
2216                 STREAM_TO_UINT8 (results.tx_power, p);
2217 
2218                 /* Search through the list of active channels for the correct BD Addr */
2219                 for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2220                 {
2221                     if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2222                     {
2223                         memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2224                         break;
2225                     }
2226                 }
2227             }
2228 #if BLE_INCLUDED == TRUE
2229             else
2230             {
2231                 STREAM_TO_UINT8 (results.tx_power, p);
2232                 memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN);
2233             }
2234 #endif
2235             BTM_TRACE_DEBUG ("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2236                                   results.tx_power, results.hci_status);
2237         }
2238         else
2239             results.status = BTM_ERR_PROCESSING;
2240 
2241         (*p_cb)(&results);
2242     }
2243 }
2244 
2245 /*******************************************************************************
2246 **
2247 ** Function         btm_read_rssi_timeout
2248 **
2249 ** Description      Callback when reading the RSSI times out.
2250 **
2251 ** Returns          void
2252 **
2253 *******************************************************************************/
btm_read_rssi_timeout(UNUSED_ATTR void * data)2254 void btm_read_rssi_timeout(UNUSED_ATTR void *data)
2255 {
2256     tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2257     btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2258     if (p_cb)
2259         (*p_cb)((void *) NULL);
2260 }
2261 
2262 /*******************************************************************************
2263 **
2264 ** Function         btm_read_rssi_complete
2265 **
2266 ** Description      This function is called when the command complete message
2267 **                  is received from the HCI for the read rssi request.
2268 **
2269 ** Returns          void
2270 **
2271 *******************************************************************************/
btm_read_rssi_complete(UINT8 * p)2272 void btm_read_rssi_complete (UINT8 *p)
2273 {
2274     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2275     tBTM_RSSI_RESULTS        results;
2276     UINT16                   handle;
2277     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2278     UINT16                   index;
2279 
2280     BTM_TRACE_DEBUG("%s", __func__);
2281     alarm_cancel(btm_cb.devcb.read_rssi_timer);
2282     btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2283 
2284     /* If there was a registered callback, call it */
2285     if (p_cb)
2286     {
2287         STREAM_TO_UINT8  (results.hci_status, p);
2288 
2289         if (results.hci_status == HCI_SUCCESS)
2290         {
2291             results.status = BTM_SUCCESS;
2292 
2293             STREAM_TO_UINT16 (handle, p);
2294 
2295             STREAM_TO_UINT8 (results.rssi, p);
2296             BTM_TRACE_DEBUG ("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2297                               results.rssi, results.hci_status);
2298 
2299             /* Search through the list of active channels for the correct BD Addr */
2300             for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2301             {
2302                 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2303                 {
2304                     memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2305                     break;
2306                 }
2307             }
2308         }
2309         else
2310             results.status = BTM_ERR_PROCESSING;
2311 
2312         (*p_cb)(&results);
2313     }
2314 }
2315 
2316 /*******************************************************************************
2317 **
2318 ** Function         btm_read_link_quality_timeout
2319 **
2320 ** Description      Callback when reading the link quality times out.
2321 **
2322 ** Returns          void
2323 **
2324 *******************************************************************************/
btm_read_link_quality_timeout(UNUSED_ATTR void * data)2325 void btm_read_link_quality_timeout(UNUSED_ATTR void *data)
2326 {
2327     tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2328     btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2329     if (p_cb)
2330         (*p_cb)((void *) NULL);
2331 }
2332 
2333 /*******************************************************************************
2334 **
2335 ** Function         btm_read_link_quality_complete
2336 **
2337 ** Description      This function is called when the command complete message
2338 **                  is received from the HCI for the read link quality.
2339 **
2340 ** Returns          void
2341 **
2342 *******************************************************************************/
btm_read_link_quality_complete(UINT8 * p)2343 void btm_read_link_quality_complete(UINT8 *p)
2344 {
2345     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2346     tBTM_LINK_QUALITY_RESULTS results;
2347     UINT16                   handle;
2348     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2349     UINT16                   index;
2350 
2351     BTM_TRACE_DEBUG("%s", __func__);
2352     alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2353     btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2354 
2355     /* If there was a registered callback, call it */
2356     if (p_cb)
2357     {
2358         STREAM_TO_UINT8  (results.hci_status, p);
2359 
2360         if (results.hci_status == HCI_SUCCESS)
2361         {
2362             results.status = BTM_SUCCESS;
2363 
2364             STREAM_TO_UINT16 (handle, p);
2365 
2366             STREAM_TO_UINT8 (results.link_quality, p);
2367             BTM_TRACE_DEBUG ("BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2368                               results.link_quality, results.hci_status);
2369 
2370             /* Search through the list of active channels for the correct BD Addr */
2371             for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2372             {
2373                 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2374                 {
2375                     memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2376                     break;
2377                 }
2378             }
2379         }
2380         else
2381             results.status = BTM_ERR_PROCESSING;
2382 
2383         (*p_cb)(&results);
2384     }
2385 }
2386 
2387 /*******************************************************************************
2388 **
2389 ** Function         btm_remove_acl
2390 **
2391 ** Description      This function is called to disconnect an ACL connection
2392 **
2393 ** Returns          BTM_SUCCESS if successfully initiated, otherwise BTM_NO_RESOURCES.
2394 **
2395 *******************************************************************************/
btm_remove_acl(BD_ADDR bd_addr,tBT_TRANSPORT transport)2396 tBTM_STATUS btm_remove_acl (BD_ADDR bd_addr, tBT_TRANSPORT transport)
2397 {
2398     UINT16  hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2399     tBTM_STATUS status = BTM_SUCCESS;
2400 
2401     BTM_TRACE_DEBUG ("btm_remove_acl");
2402 #if BTM_DISC_DURING_RS == TRUE
2403     tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_dev (bd_addr);
2404 
2405     /* Role Switch is pending, postpone until completed */
2406     if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING))
2407     {
2408         p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2409     }
2410     else    /* otherwise can disconnect right away */
2411 #endif
2412     {
2413         if (hci_handle != 0xFFFF && p_dev_rec &&
2414              p_dev_rec->sec_state!= BTM_SEC_STATE_DISCONNECTING)
2415         {
2416             if (!btsnd_hcic_disconnect (hci_handle, HCI_ERR_PEER_USER))
2417                 status = BTM_NO_RESOURCES;
2418         }
2419         else
2420             status = BTM_UNKNOWN_ADDR;
2421     }
2422 
2423     return status;
2424 }
2425 
2426 
2427 /*******************************************************************************
2428 **
2429 ** Function         BTM_SetTraceLevel
2430 **
2431 ** Description      This function sets the trace level for BTM.  If called with
2432 **                  a value of 0xFF, it simply returns the current trace level.
2433 **
2434 ** Returns          The new or current trace level
2435 **
2436 *******************************************************************************/
BTM_SetTraceLevel(UINT8 new_level)2437 UINT8 BTM_SetTraceLevel (UINT8 new_level)
2438 {
2439     BTM_TRACE_DEBUG ("BTM_SetTraceLevel");
2440     if (new_level != 0xFF)
2441         btm_cb.trace_level = new_level;
2442 
2443     return(btm_cb.trace_level);
2444 }
2445 
2446 /*******************************************************************************
2447 **
2448 ** Function         btm_cont_rswitch
2449 **
2450 ** Description      This function is called to continue processing an active
2451 **                  role switch. It first disables encryption if enabled and
2452 **                  EPR is not supported
2453 **
2454 ** Returns          void
2455 **
2456 *******************************************************************************/
btm_cont_rswitch(tACL_CONN * p,tBTM_SEC_DEV_REC * p_dev_rec,UINT8 hci_status)2457 void btm_cont_rswitch (tACL_CONN *p, tBTM_SEC_DEV_REC *p_dev_rec,
2458                                      UINT8 hci_status)
2459 {
2460     BOOLEAN sw_ok = TRUE;
2461     BTM_TRACE_DEBUG ("btm_cont_rswitch");
2462     /* Check to see if encryption needs to be turned off if pending
2463        change of link key or role switch */
2464     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2465     {
2466         /* Must turn off Encryption first if necessary */
2467         /* Some devices do not support switch or change of link key while encryption is on */
2468         if (p_dev_rec != NULL && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0)
2469             && !BTM_EPR_AVAILABLE(p))
2470         {
2471             if (btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
2472             {
2473                 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2474                 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2475                     p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2476             }
2477             else
2478             {
2479                 /* Error occurred; set states back to Idle */
2480                 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2481                     sw_ok = FALSE;
2482             }
2483         }
2484         else    /* Encryption not used or EPR supported, continue with switch
2485                    and/or change of link key */
2486         {
2487             if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2488             {
2489                 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2490 #if BTM_DISC_DURING_RS == TRUE
2491                 if (p_dev_rec)
2492                     p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2493 #endif
2494                 sw_ok = btsnd_hcic_switch_role (p->remote_addr, (UINT8)!p->link_role);
2495             }
2496         }
2497 
2498         if (!sw_ok)
2499         {
2500             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
2501             btm_acl_report_role_change(hci_status, p->remote_addr);
2502         }
2503     }
2504 }
2505 
2506 /*******************************************************************************
2507 **
2508 ** Function         btm_acl_resubmit_page
2509 **
2510 ** Description      send pending page request
2511 **
2512 *******************************************************************************/
btm_acl_resubmit_page(void)2513 void btm_acl_resubmit_page (void)
2514 {
2515     tBTM_SEC_DEV_REC *p_dev_rec;
2516     BT_HDR  *p_buf;
2517     UINT8   *pp;
2518     BD_ADDR bda;
2519     BTM_TRACE_DEBUG ("btm_acl_resubmit_page");
2520     /* If there were other page request schedule can start the next one */
2521     if ((p_buf = (BT_HDR *)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2522     {
2523         /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2524          * for both create_conn and rmt_name */
2525         pp = (UINT8 *)(p_buf + 1) + p_buf->offset + 3;
2526 
2527         STREAM_TO_BDADDR (bda, pp);
2528 
2529         p_dev_rec = btm_find_or_alloc_dev (bda);
2530 
2531         memcpy (btm_cb.connecting_bda, p_dev_rec->bd_addr,   BD_ADDR_LEN);
2532         memcpy (btm_cb.connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);
2533 
2534         btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2535     }
2536     else
2537         btm_cb.paging = FALSE;
2538 }
2539 
2540 /*******************************************************************************
2541 **
2542 ** Function         btm_acl_reset_paging
2543 **
2544 ** Description      set paging to FALSE and free the page queue - called at hci_reset
2545 **
2546 *******************************************************************************/
btm_acl_reset_paging(void)2547 void  btm_acl_reset_paging (void)
2548 {
2549     BT_HDR *p;
2550     BTM_TRACE_DEBUG ("btm_acl_reset_paging");
2551     /* If we sent reset we are definitely not paging any more */
2552     while ((p = (BT_HDR *)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2553         osi_free(p);
2554 
2555     btm_cb.paging = FALSE;
2556 }
2557 
2558 /*******************************************************************************
2559 **
2560 ** Function         btm_acl_paging
2561 **
2562 ** Description      send a paging command or queue it in btm_cb
2563 **
2564 *******************************************************************************/
btm_acl_paging(BT_HDR * p,BD_ADDR bda)2565 void  btm_acl_paging (BT_HDR *p, BD_ADDR bda)
2566 {
2567     tBTM_SEC_DEV_REC *p_dev_rec;
2568 
2569     BTM_TRACE_DEBUG ("btm_acl_paging discing:%d, paging:%d BDA: %06x%06x",
2570                       btm_cb.discing, btm_cb.paging,
2571                       (bda[0]<<16) + (bda[1]<<8) + bda[2], (bda[3]<<16) + (bda[4] << 8) + bda[5]);
2572     if (btm_cb.discing)
2573     {
2574         btm_cb.paging = TRUE;
2575         fixed_queue_enqueue(btm_cb.page_queue, p);
2576     }
2577     else
2578     {
2579         if (!BTM_ACL_IS_CONNECTED (bda))
2580         {
2581             BTM_TRACE_DEBUG ("connecting_bda: %06x%06x",
2582                               (btm_cb.connecting_bda[0]<<16) + (btm_cb.connecting_bda[1]<<8) +
2583                                btm_cb.connecting_bda[2],
2584                               (btm_cb.connecting_bda[3]<<16) + (btm_cb.connecting_bda[4] << 8) +
2585                                btm_cb.connecting_bda[5]);
2586             if (btm_cb.paging &&
2587                 memcmp (bda, btm_cb.connecting_bda, BD_ADDR_LEN) != 0)
2588             {
2589                 fixed_queue_enqueue(btm_cb.page_queue, p);
2590             }
2591             else
2592             {
2593                 p_dev_rec = btm_find_or_alloc_dev (bda);
2594                 memcpy (btm_cb.connecting_bda, p_dev_rec->bd_addr,   BD_ADDR_LEN);
2595                 memcpy (btm_cb.connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);
2596 
2597                 btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
2598             }
2599 
2600             btm_cb.paging = TRUE;
2601         }
2602         else /* ACL is already up */
2603         {
2604             btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
2605         }
2606     }
2607 }
2608 
2609 /*******************************************************************************
2610 **
2611 ** Function         btm_acl_notif_conn_collision
2612 **
2613 ** Description      Send connection collision event to upper layer if registered
2614 **
2615 ** Returns          TRUE if sent out to upper layer,
2616 **                  FALSE if no one needs the notification.
2617 **
2618 *******************************************************************************/
btm_acl_notif_conn_collision(BD_ADDR bda)2619 BOOLEAN  btm_acl_notif_conn_collision (BD_ADDR bda)
2620 {
2621     tBTM_BL_EVENT_DATA  evt_data;
2622 
2623     /* Report possible collision to the upper layer. */
2624     if (btm_cb.p_bl_changed_cb)
2625     {
2626         BTM_TRACE_DEBUG ("btm_acl_notif_conn_collision: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2627                           bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
2628 
2629         evt_data.event = BTM_BL_COLLISION_EVT;
2630         evt_data.conn.p_bda = bda;
2631 
2632 #if BLE_INCLUDED == TRUE
2633         evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2634         evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2635 #endif
2636         (*btm_cb.p_bl_changed_cb)(&evt_data);
2637         return TRUE;
2638     }
2639     else
2640         return FALSE;
2641 }
2642 
2643 
2644 /*******************************************************************************
2645 **
2646 ** Function         btm_acl_chk_peer_pkt_type_support
2647 **
2648 ** Description      Check if peer supports requested packets
2649 **
2650 *******************************************************************************/
btm_acl_chk_peer_pkt_type_support(tACL_CONN * p,UINT16 * p_pkt_type)2651 void btm_acl_chk_peer_pkt_type_support (tACL_CONN *p, UINT16 *p_pkt_type)
2652 {
2653     /* 3 and 5 slot packets? */
2654     if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2655         *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 +BTM_ACL_PKT_TYPES_MASK_DM3);
2656 
2657     if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2658         *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2659 
2660     /* 2 and 3 MPS support? */
2661     if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2662         /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2663         *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2664                             BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2665 
2666     if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2667         /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2668         *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2669                             BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2670 
2671     /* EDR 3 and 5 slot support? */
2672     if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])
2673      || HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2674     {
2675         if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2676             /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types */
2677             *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2678 
2679         if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2680             /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types */
2681             *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2682     }
2683 }
2684