1 /******************************************************************************
2 *
3 * Copyright (C) 2000-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /*****************************************************************************
20 *
21 * Name: btm_acl.cc
22 *
23 * Description: This file contains functions that handle ACL connections.
24 * This includes operations such as hold and sniff modes,
25 * supported packet types.
26 *
27 * This module contains both internal and external (API)
28 * functions. External (API) functions are distinguishable
29 * by their names beginning with uppercase BTM.
30 *
31 *
32 *****************************************************************************/
33
34 #include <stddef.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38
39 #include "bt_common.h"
40 #include "bt_target.h"
41 #include "bt_types.h"
42 #include "bt_utils.h"
43 #include "btm_api.h"
44 #include "btm_int.h"
45 #include "btu.h"
46 #include "device/include/controller.h"
47 #include "device/include/interop.h"
48 #include "hcidefs.h"
49 #include "hcimsgs.h"
50 #include "log/log.h"
51 #include "l2c_int.h"
52 #include "osi/include/osi.h"
53
54 static void btm_read_remote_features(uint16_t handle);
55 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
56 static void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
57 uint8_t num_read_pages);
58
59 /* 3 seconds timeout waiting for responses */
60 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
61
62 /*******************************************************************************
63 *
64 * Function btm_acl_init
65 *
66 * Description This function is called at BTM startup to initialize
67 *
68 * Returns void
69 *
70 ******************************************************************************/
btm_acl_init(void)71 void btm_acl_init(void) {
72 BTM_TRACE_DEBUG("btm_acl_init");
73 /* Initialize nonzero defaults */
74 btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
75 btm_cb.acl_disc_reason = 0xff;
76 }
77
78 /*******************************************************************************
79 *
80 * Function btm_bda_to_acl
81 *
82 * Description This function returns the FIRST acl_db entry for the passed
83 * BDA.
84 *
85 * Parameters bda : BD address of the remote device
86 * transport : Physical transport used for ACL connection
87 * (BR/EDR or LE)
88 *
89 * Returns Returns pointer to the ACL DB for the requested BDA if found.
90 * NULL if not found.
91 *
92 ******************************************************************************/
btm_bda_to_acl(const RawAddress & bda,tBT_TRANSPORT transport)93 tACL_CONN* btm_bda_to_acl(const RawAddress& bda, tBT_TRANSPORT transport) {
94 tACL_CONN* p = &btm_cb.acl_db[0];
95 uint16_t xx;
96 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
97 if ((p->in_use) && p->remote_addr == bda && p->transport == transport) {
98 BTM_TRACE_DEBUG("btm_bda_to_acl found");
99 return (p);
100 }
101 }
102
103 /* If here, no BD Addr found */
104 return ((tACL_CONN*)NULL);
105 }
106
107 /*******************************************************************************
108 *
109 * Function btm_handle_to_acl_index
110 *
111 * Description This function returns the FIRST acl_db entry for the passed
112 * hci_handle.
113 *
114 * Returns index to the acl_db or MAX_L2CAP_LINKS.
115 *
116 ******************************************************************************/
btm_handle_to_acl_index(uint16_t hci_handle)117 uint8_t btm_handle_to_acl_index(uint16_t hci_handle) {
118 tACL_CONN* p = &btm_cb.acl_db[0];
119 uint8_t xx;
120 BTM_TRACE_DEBUG("btm_handle_to_acl_index");
121 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
122 if ((p->in_use) && (p->hci_handle == hci_handle)) {
123 break;
124 }
125 }
126
127 /* If here, no BD Addr found */
128 return (xx);
129 }
130
131 #if (BLE_PRIVACY_SPT == TRUE)
132 /*******************************************************************************
133 *
134 * Function btm_ble_get_acl_remote_addr
135 *
136 * Description This function reads the active remote address used for the
137 * connection.
138 *
139 * Returns success return true, otherwise false.
140 *
141 ******************************************************************************/
btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC * p_dev_rec,RawAddress & conn_addr,tBLE_ADDR_TYPE * p_addr_type)142 bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec,
143 RawAddress& conn_addr,
144 tBLE_ADDR_TYPE* p_addr_type) {
145 bool st = true;
146
147 if (p_dev_rec == NULL) {
148 BTM_TRACE_ERROR("%s can not find device with matching address", __func__);
149 return false;
150 }
151
152 switch (p_dev_rec->ble.active_addr_type) {
153 case BTM_BLE_ADDR_PSEUDO:
154 conn_addr = p_dev_rec->bd_addr;
155 *p_addr_type = p_dev_rec->ble.ble_addr_type;
156 break;
157
158 case BTM_BLE_ADDR_RRA:
159 conn_addr = p_dev_rec->ble.cur_rand_addr;
160 *p_addr_type = BLE_ADDR_RANDOM;
161 break;
162
163 case BTM_BLE_ADDR_STATIC:
164 conn_addr = p_dev_rec->ble.static_addr;
165 *p_addr_type = p_dev_rec->ble.static_addr_type;
166 break;
167
168 default:
169 BTM_TRACE_ERROR("Unknown active address: %d",
170 p_dev_rec->ble.active_addr_type);
171 st = false;
172 break;
173 }
174
175 return st;
176 }
177 #endif
178 /*******************************************************************************
179 *
180 * Function btm_acl_created
181 *
182 * Description This function is called by L2CAP when an ACL connection
183 * is created.
184 *
185 * Returns void
186 *
187 ******************************************************************************/
btm_acl_created(const RawAddress & bda,DEV_CLASS dc,BD_NAME bdn,uint16_t hci_handle,uint8_t link_role,tBT_TRANSPORT transport)188 void btm_acl_created(const RawAddress& bda, DEV_CLASS dc, BD_NAME bdn,
189 uint16_t hci_handle, uint8_t link_role,
190 tBT_TRANSPORT transport) {
191 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
192 tACL_CONN* p;
193 uint8_t xx;
194
195 BTM_TRACE_DEBUG("btm_acl_created hci_handle=%d link_role=%d transport=%d",
196 hci_handle, link_role, transport);
197 /* Ensure we don't have duplicates */
198 p = btm_bda_to_acl(bda, transport);
199 if (p != (tACL_CONN*)NULL) {
200 p->hci_handle = hci_handle;
201 p->link_role = link_role;
202 p->transport = transport;
203 VLOG(1) << "Duplicate btm_acl_created: RemBdAddr: " << bda;
204 BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
205 return;
206 }
207
208 /* Allocate acl_db entry */
209 for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++) {
210 if (!p->in_use) {
211 p->in_use = true;
212 p->hci_handle = hci_handle;
213 p->link_role = link_role;
214 p->link_up_issued = false;
215 p->remote_addr = bda;
216
217 p->transport = transport;
218 #if (BLE_PRIVACY_SPT == TRUE)
219 if (transport == BT_TRANSPORT_LE)
220 btm_ble_refresh_local_resolvable_private_addr(
221 bda, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
222 #else
223 p->conn_addr_type = BLE_ADDR_PUBLIC;
224 p->conn_addr = *controller_get_interface()->get_address();
225
226 #endif
227 p->switch_role_failed_attempts = 0;
228 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
229
230 btm_pm_sm_alloc(xx);
231
232 if (dc) memcpy(p->remote_dc, dc, DEV_CLASS_LEN);
233
234 if (bdn) memcpy(p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
235
236 /* if BR/EDR do something more */
237 if (transport == BT_TRANSPORT_BR_EDR) {
238 btsnd_hcic_read_rmt_clk_offset(p->hci_handle);
239 btsnd_hcic_rmt_ver_req(p->hci_handle);
240 }
241 p_dev_rec = btm_find_dev_by_handle(hci_handle);
242
243 if (p_dev_rec) {
244 BTM_TRACE_DEBUG("device_type=0x%x", p_dev_rec->device_type);
245 }
246
247 if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
248 /* If remote features already known, copy them and continue connection
249 * setup */
250 if ((p_dev_rec->num_read_pages) &&
251 (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
252 memcpy(p->peer_lmp_feature_pages, p_dev_rec->feature_pages,
253 (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
254 p->num_read_pages = p_dev_rec->num_read_pages;
255
256 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
257
258 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
259 btm_sec_set_peer_sec_caps(p, p_dev_rec);
260
261 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
262 if (req_pend) {
263 /* Request for remaining Security Features (if any) */
264 l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
265 }
266 btm_establish_continue(p);
267 return;
268 }
269 }
270
271 /* If here, features are not known yet */
272 if (p_dev_rec && transport == BT_TRANSPORT_LE) {
273 #if (BLE_PRIVACY_SPT == TRUE)
274 btm_ble_get_acl_remote_addr(p_dev_rec, p->active_remote_addr,
275 &p->active_remote_addr_type);
276 #endif
277
278 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(
279 controller_get_interface()->get_features_ble()->as_array) ||
280 link_role == HCI_ROLE_MASTER) {
281 btsnd_hcic_ble_read_remote_feat(p->hci_handle);
282 } else {
283 btm_establish_continue(p);
284 }
285 } else {
286 btm_read_remote_features(p->hci_handle);
287 }
288
289 /* read page 1 - on rmt feature event for buffer reasons */
290 return;
291 }
292 }
293 }
294
btm_acl_update_conn_addr(uint16_t conn_handle,const RawAddress & address)295 void btm_acl_update_conn_addr(uint16_t conn_handle, const RawAddress& address) {
296 uint8_t idx = btm_handle_to_acl_index(conn_handle);
297 if (idx != MAX_L2CAP_LINKS) {
298 btm_cb.acl_db[idx].conn_addr = address;
299 }
300 }
301
302 /*******************************************************************************
303 *
304 * Function btm_acl_report_role_change
305 *
306 * Description This function is called when the local device is deemed
307 * to be down. It notifies L2CAP of the failure.
308 *
309 * Returns void
310 *
311 ******************************************************************************/
btm_acl_report_role_change(uint8_t hci_status,const RawAddress * bda)312 void btm_acl_report_role_change(uint8_t hci_status, const RawAddress* bda) {
313 tBTM_ROLE_SWITCH_CMPL ref_data;
314 BTM_TRACE_DEBUG("btm_acl_report_role_change");
315 if (btm_cb.devcb.p_switch_role_cb &&
316 (bda && btm_cb.devcb.switch_role_ref_data.remote_bd_addr == *bda)) {
317 memcpy(&ref_data, &btm_cb.devcb.switch_role_ref_data,
318 sizeof(tBTM_ROLE_SWITCH_CMPL));
319 ref_data.hci_status = hci_status;
320 (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
321 memset(&btm_cb.devcb.switch_role_ref_data, 0,
322 sizeof(tBTM_ROLE_SWITCH_CMPL));
323 btm_cb.devcb.p_switch_role_cb = NULL;
324 }
325 }
326
327 /*******************************************************************************
328 *
329 * Function btm_acl_removed
330 *
331 * Description This function is called by L2CAP when an ACL connection
332 * is removed. Since only L2CAP creates ACL links, we use
333 * the L2CAP link index as our index into the control blocks.
334 *
335 * Returns void
336 *
337 ******************************************************************************/
btm_acl_removed(const RawAddress & bda,tBT_TRANSPORT transport)338 void btm_acl_removed(const RawAddress& bda, tBT_TRANSPORT transport) {
339 tACL_CONN* p;
340 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
341 BTM_TRACE_DEBUG("btm_acl_removed");
342 p = btm_bda_to_acl(bda, transport);
343 if (p != (tACL_CONN*)NULL) {
344 p->in_use = false;
345
346 /* if the disconnected channel has a pending role switch, clear it now */
347 btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, &bda);
348
349 /* Only notify if link up has had a chance to be issued */
350 if (p->link_up_issued) {
351 p->link_up_issued = false;
352
353 /* If anyone cares, tell him database changed */
354 if (btm_cb.p_bl_changed_cb) {
355 tBTM_BL_EVENT_DATA evt_data;
356 evt_data.event = BTM_BL_DISCN_EVT;
357 evt_data.discn.p_bda = &bda;
358 evt_data.discn.handle = p->hci_handle;
359 evt_data.discn.transport = p->transport;
360 (*btm_cb.p_bl_changed_cb)(&evt_data);
361 }
362
363 btm_acl_update_busy_level(BTM_BLI_ACL_DOWN_EVT);
364 }
365
366 BTM_TRACE_DEBUG(
367 "acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
368 p->hci_handle, p->transport, btm_cb.ble_ctr_cb.inq_var.connectable_mode,
369 p->link_role);
370
371 p_dev_rec = btm_find_dev(bda);
372 if (p_dev_rec) {
373 BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x",
374 p_dev_rec->sec_flags);
375 if (p->transport == BT_TRANSPORT_LE) {
376 BTM_TRACE_DEBUG("LE link down");
377 p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
378 if ((p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0) {
379 BTM_TRACE_DEBUG("Not Bonded");
380 p_dev_rec->sec_flags &=
381 ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
382 } else {
383 BTM_TRACE_DEBUG("Bonded");
384 }
385 } else {
386 BTM_TRACE_DEBUG("Bletooth link down");
387 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED |
388 BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
389 }
390 BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x",
391 p_dev_rec->sec_flags);
392 } else {
393 BTM_TRACE_ERROR("Device not found");
394 }
395
396 /* Clear the ACL connection data */
397 memset(p, 0, sizeof(tACL_CONN));
398 }
399 }
400
401 /*******************************************************************************
402 *
403 * Function btm_acl_device_down
404 *
405 * Description This function is called when the local device is deemed
406 * to be down. It notifies L2CAP of the failure.
407 *
408 * Returns void
409 *
410 ******************************************************************************/
btm_acl_device_down(void)411 void btm_acl_device_down(void) {
412 tACL_CONN* p = &btm_cb.acl_db[0];
413 uint16_t xx;
414 BTM_TRACE_DEBUG("btm_acl_device_down");
415 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
416 if (p->in_use) {
417 BTM_TRACE_DEBUG("hci_handle=%d HCI_ERR_HW_FAILURE ", p->hci_handle);
418 l2c_link_hci_disc_comp(p->hci_handle, HCI_ERR_HW_FAILURE);
419 }
420 }
421 }
422
423 /*******************************************************************************
424 *
425 * Function btm_acl_update_busy_level
426 *
427 * Description This function is called to update the busy level of the
428 * system.
429 *
430 * Returns void
431 *
432 ******************************************************************************/
btm_acl_update_busy_level(tBTM_BLI_EVENT event)433 void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
434 bool old_inquiry_state = btm_cb.is_inquiry;
435 tBTM_BL_UPDATE_DATA evt;
436 evt.busy_level_flags = 0;
437 switch (event) {
438 case BTM_BLI_ACL_UP_EVT:
439 BTM_TRACE_DEBUG("BTM_BLI_ACL_UP_EVT");
440 break;
441 case BTM_BLI_ACL_DOWN_EVT:
442 BTM_TRACE_DEBUG("BTM_BLI_ACL_DOWN_EVT");
443 break;
444 case BTM_BLI_PAGE_EVT:
445 BTM_TRACE_DEBUG("BTM_BLI_PAGE_EVT");
446 btm_cb.is_paging = true;
447 evt.busy_level_flags = BTM_BL_PAGING_STARTED;
448 break;
449 case BTM_BLI_PAGE_DONE_EVT:
450 BTM_TRACE_DEBUG("BTM_BLI_PAGE_DONE_EVT");
451 btm_cb.is_paging = false;
452 evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
453 break;
454 case BTM_BLI_INQ_EVT:
455 BTM_TRACE_DEBUG("BTM_BLI_INQ_EVT");
456 btm_cb.is_inquiry = true;
457 evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
458 break;
459 case BTM_BLI_INQ_CANCEL_EVT:
460 BTM_TRACE_DEBUG("BTM_BLI_INQ_CANCEL_EVT");
461 btm_cb.is_inquiry = false;
462 evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
463 break;
464 case BTM_BLI_INQ_DONE_EVT:
465 BTM_TRACE_DEBUG("BTM_BLI_INQ_DONE_EVT");
466 btm_cb.is_inquiry = false;
467 evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
468 break;
469 }
470
471 uint8_t busy_level;
472 if (btm_cb.is_paging || btm_cb.is_inquiry)
473 busy_level = 10;
474 else
475 busy_level = BTM_GetNumAclLinks();
476
477 if ((busy_level != btm_cb.busy_level) ||
478 (old_inquiry_state != btm_cb.is_inquiry)) {
479 evt.event = BTM_BL_UPDATE_EVT;
480 evt.busy_level = busy_level;
481 btm_cb.busy_level = busy_level;
482 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
483 tBTM_BL_EVENT_DATA btm_bl_event_data;
484 btm_bl_event_data.update = evt;
485 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
486 }
487 }
488 }
489
490 /*******************************************************************************
491 *
492 * Function BTM_GetRole
493 *
494 * Description This function is called to get the role of the local device
495 * for the ACL connection with the specified remote device
496 *
497 * Returns BTM_SUCCESS if connection exists.
498 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
499 *
500 ******************************************************************************/
BTM_GetRole(const RawAddress & remote_bd_addr,uint8_t * p_role)501 tBTM_STATUS BTM_GetRole(const RawAddress& remote_bd_addr, uint8_t* p_role) {
502 tACL_CONN* p;
503 BTM_TRACE_DEBUG("BTM_GetRole");
504 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
505 if (p == NULL) {
506 *p_role = BTM_ROLE_UNDEFINED;
507 return (BTM_UNKNOWN_ADDR);
508 }
509
510 /* Get the current role */
511 *p_role = p->link_role;
512 return (BTM_SUCCESS);
513 }
514
515 /*******************************************************************************
516 *
517 * Function BTM_SwitchRole
518 *
519 * Description This function is called to switch role between master and
520 * slave. If role is already set it will do nothing. If the
521 * command was initiated, the callback function is called upon
522 * completion.
523 *
524 * Returns BTM_SUCCESS if already in specified role.
525 * BTM_CMD_STARTED if command issued to controller.
526 * BTM_NO_RESOURCES if couldn't allocate memory to issue
527 * command
528 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
529 * BTM_MODE_UNSUPPORTED if local device does not support role
530 * switching
531 * BTM_BUSY if the previous command is not completed
532 *
533 ******************************************************************************/
BTM_SwitchRole(const RawAddress & remote_bd_addr,uint8_t new_role,tBTM_CMPL_CB * p_cb)534 tBTM_STATUS BTM_SwitchRole(const RawAddress& remote_bd_addr, uint8_t new_role,
535 tBTM_CMPL_CB* p_cb) {
536 tACL_CONN* p;
537 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
538 #if (BTM_SCO_INCLUDED == TRUE)
539 bool is_sco_active;
540 #endif
541 tBTM_STATUS status;
542 tBTM_PM_MODE pwr_mode;
543 tBTM_PM_PWR_MD settings;
544 VLOG(1) << __func__ << " BDA: " << remote_bd_addr;
545
546 /* Make sure the local device supports switching */
547 if (!controller_get_interface()->supports_master_slave_role_switch())
548 return (BTM_MODE_UNSUPPORTED);
549
550 if (btm_cb.devcb.p_switch_role_cb && p_cb) {
551 VLOG(2) << "Role switch on other device is in progress "
552 << btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
553 return (BTM_BUSY);
554 }
555
556 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
557 if (p == NULL) return (BTM_UNKNOWN_ADDR);
558
559 /* Finished if already in desired role */
560 if (p->link_role == new_role) return (BTM_SUCCESS);
561
562 if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH, &remote_bd_addr))
563 return BTM_DEV_BLACKLISTED;
564
565 #if (BTM_SCO_INCLUDED == TRUE)
566 /* Check if there is any SCO Active on this BD Address */
567 is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
568
569 if (is_sco_active == true) return (BTM_NO_RESOURCES);
570 #endif
571
572 /* Ignore role switch request if the previous request was not completed */
573 if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE) {
574 BTM_TRACE_DEBUG("BTM_SwitchRole busy: %d", p->switch_role_state);
575 return (BTM_BUSY);
576 }
577
578 if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &remote_bd_addr)) {
579 BTM_TRACE_DEBUG("%s, Device blacklisted under INTEROP_DYNAMIC_ROLE_SWITCH.",
580 __func__);
581 return BTM_DEV_BLACKLISTED;
582 }
583
584 status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode);
585 if (status != BTM_SUCCESS) return (status);
586
587 /* Wake up the link if in sniff or park before attempting switch */
588 if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF) {
589 memset((void*)&settings, 0, sizeof(settings));
590 settings.mode = BTM_PM_MD_ACTIVE;
591 status = BTM_SetPowerMode(BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
592 if (status != BTM_CMD_STARTED) return (BTM_WRONG_MODE);
593
594 p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
595 }
596 /* some devices do not support switch while encryption is on */
597 else {
598 p_dev_rec = btm_find_dev(remote_bd_addr);
599 if ((p_dev_rec != NULL) &&
600 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
601 !BTM_EPR_AVAILABLE(p)) {
602 /* bypass turning off encryption if change link key is already doing it */
603 if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF) {
604 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
605 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
606 }
607
608 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
609 } else {
610 btsnd_hcic_switch_role(remote_bd_addr, new_role);
611 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
612
613 #if (BTM_DISC_DURING_RS == TRUE)
614 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
615 #endif
616 }
617 }
618
619 /* Initialize return structure in case request fails */
620 if (p_cb) {
621 btm_cb.devcb.switch_role_ref_data.remote_bd_addr = remote_bd_addr;
622 btm_cb.devcb.switch_role_ref_data.role = new_role;
623 /* initialized to an error code */
624 btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
625 btm_cb.devcb.p_switch_role_cb = p_cb;
626 }
627 return (BTM_CMD_STARTED);
628 }
629
630 /*******************************************************************************
631 *
632 * Function btm_acl_encrypt_change
633 *
634 * Description This function is when encryption of the connection is
635 * completed by the LM. Checks to see if a role switch or
636 * change of link key was active and initiates or continues
637 * process if needed.
638 *
639 * Returns void
640 *
641 ******************************************************************************/
btm_acl_encrypt_change(uint16_t handle,uint8_t status,uint8_t encr_enable)642 void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
643 uint8_t encr_enable) {
644 tACL_CONN* p;
645 uint8_t xx;
646 tBTM_SEC_DEV_REC* p_dev_rec;
647
648 BTM_TRACE_DEBUG("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
649 handle, status, encr_enable);
650 xx = btm_handle_to_acl_index(handle);
651 /* don't assume that we can never get a bad hci_handle */
652 if (xx < MAX_L2CAP_LINKS)
653 p = &btm_cb.acl_db[xx];
654 else
655 return;
656
657 /* Process Role Switch if active */
658 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF) {
659 /* if encryption turn off failed we still will try to switch role */
660 if (encr_enable) {
661 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
662 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
663 } else {
664 p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
665 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
666 }
667
668 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
669 #if (BTM_DISC_DURING_RS == TRUE)
670 p_dev_rec = btm_find_dev(p->remote_addr);
671 if (p_dev_rec != NULL) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
672 #endif
673
674 }
675 /* Finished enabling Encryption after role switch */
676 else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON) {
677 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
678 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
679 btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status,
680 &p->remote_addr);
681
682 /* if role change event is registered, report it now */
683 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
684 tBTM_BL_ROLE_CHG_DATA evt;
685 evt.event = BTM_BL_ROLE_CHG_EVT;
686 evt.new_role = btm_cb.devcb.switch_role_ref_data.role;
687 evt.p_bda = &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
688 evt.hci_status = btm_cb.devcb.switch_role_ref_data.hci_status;
689 tBTM_BL_EVENT_DATA btm_bl_event_data;
690 btm_bl_event_data.role_chg = evt;
691 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
692
693 BTM_TRACE_DEBUG(
694 "Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
695 evt.new_role, evt.hci_status, p->switch_role_state);
696 }
697
698 #if (BTM_DISC_DURING_RS == TRUE)
699 /* If a disconnect is pending, issue it now that role switch has completed
700 */
701 p_dev_rec = btm_find_dev(p->remote_addr);
702 if (p_dev_rec != NULL) {
703 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
704 BTM_TRACE_WARNING(
705 "btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
706 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
707 }
708 BTM_TRACE_ERROR(
709 "btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
710 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
711 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
712 }
713 #endif
714 }
715 }
716 /*******************************************************************************
717 *
718 * Function BTM_SetLinkPolicy
719 *
720 * Description Create and send HCI "Write Policy Set" command
721 *
722 * Returns status of the operation
723 *
724 ******************************************************************************/
BTM_SetLinkPolicy(const RawAddress & remote_bda,uint16_t * settings)725 tBTM_STATUS BTM_SetLinkPolicy(const RawAddress& remote_bda,
726 uint16_t* settings) {
727 tACL_CONN* p;
728 uint8_t* localFeatures = BTM_ReadLocalFeatures();
729 BTM_TRACE_DEBUG("%s", __func__);
730 /* BTM_TRACE_API ("%s: requested settings: 0x%04x", __func__, *settings ); */
731
732 /* First, check if hold mode is supported */
733 if (*settings != HCI_DISABLE_ALL_LM_MODES) {
734 if ((*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
735 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
736 *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
737 BTM_TRACE_API("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)",
738 *settings);
739 }
740 if ((*settings & HCI_ENABLE_HOLD_MODE) &&
741 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
742 *settings &= (~HCI_ENABLE_HOLD_MODE);
743 BTM_TRACE_API("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)",
744 *settings);
745 }
746 if ((*settings & HCI_ENABLE_SNIFF_MODE) &&
747 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
748 *settings &= (~HCI_ENABLE_SNIFF_MODE);
749 BTM_TRACE_API("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)",
750 *settings);
751 }
752 if ((*settings & HCI_ENABLE_PARK_MODE) &&
753 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
754 *settings &= (~HCI_ENABLE_PARK_MODE);
755 BTM_TRACE_API("BTM_SetLinkPolicy park not supported (settings: 0x%04x)",
756 *settings);
757 }
758 }
759
760 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
761 if (p != NULL) {
762 btsnd_hcic_write_policy_set(p->hci_handle, *settings);
763 return BTM_CMD_STARTED;
764 }
765
766 /* If here, no BD Addr found */
767 return (BTM_UNKNOWN_ADDR);
768 }
769
770 /*******************************************************************************
771 *
772 * Function BTM_SetDefaultLinkPolicy
773 *
774 * Description Set the default value for HCI "Write Policy Set" command
775 * to use when an ACL link is created.
776 *
777 * Returns void
778 *
779 ******************************************************************************/
BTM_SetDefaultLinkPolicy(uint16_t settings)780 void BTM_SetDefaultLinkPolicy(uint16_t settings) {
781 uint8_t* localFeatures = BTM_ReadLocalFeatures();
782
783 BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
784
785 if ((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
786 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
787 settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
788 BTM_TRACE_DEBUG(
789 "BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)",
790 settings);
791 }
792 if ((settings & HCI_ENABLE_HOLD_MODE) &&
793 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
794 settings &= ~HCI_ENABLE_HOLD_MODE;
795 BTM_TRACE_DEBUG(
796 "BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)",
797 settings);
798 }
799 if ((settings & HCI_ENABLE_SNIFF_MODE) &&
800 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
801 settings &= ~HCI_ENABLE_SNIFF_MODE;
802 BTM_TRACE_DEBUG(
803 "BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)",
804 settings);
805 }
806 if ((settings & HCI_ENABLE_PARK_MODE) &&
807 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
808 settings &= ~HCI_ENABLE_PARK_MODE;
809 BTM_TRACE_DEBUG(
810 "BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)",
811 settings);
812 }
813 BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
814
815 btm_cb.btm_def_link_policy = settings;
816
817 /* Set the default Link Policy of the controller */
818 btsnd_hcic_write_def_policy_set(settings);
819 }
820
btm_use_preferred_conn_params(const RawAddress & bda)821 void btm_use_preferred_conn_params(const RawAddress& bda) {
822 tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
823 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
824
825 /* If there are any preferred connection parameters, set them now */
826 if ((p_dev_rec->conn_params.min_conn_int >= BTM_BLE_CONN_INT_MIN) &&
827 (p_dev_rec->conn_params.min_conn_int <= BTM_BLE_CONN_INT_MAX) &&
828 (p_dev_rec->conn_params.max_conn_int >= BTM_BLE_CONN_INT_MIN) &&
829 (p_dev_rec->conn_params.max_conn_int <= BTM_BLE_CONN_INT_MAX) &&
830 (p_dev_rec->conn_params.slave_latency <= BTM_BLE_CONN_LATENCY_MAX) &&
831 (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
832 (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
833 ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
834 p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
835 (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
836 (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
837 (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout))) {
838 BTM_TRACE_DEBUG(
839 "%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d "
840 "supervision_tout=%d",
841 __func__, p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
842 p_dev_rec->conn_params.max_conn_int,
843 p_dev_rec->conn_params.slave_latency,
844 p_dev_rec->conn_params.supervision_tout);
845
846 p_lcb->min_interval = p_dev_rec->conn_params.min_conn_int;
847 p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
848 p_lcb->timeout = p_dev_rec->conn_params.supervision_tout;
849 p_lcb->latency = p_dev_rec->conn_params.slave_latency;
850
851 btsnd_hcic_ble_upd_ll_conn_params(
852 p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
853 p_dev_rec->conn_params.max_conn_int,
854 p_dev_rec->conn_params.slave_latency,
855 p_dev_rec->conn_params.supervision_tout, 0, 0);
856 }
857 }
858
859 /*******************************************************************************
860 *
861 * Function btm_read_remote_version_complete
862 *
863 * Description This function is called when the command complete message
864 * is received from the HCI for the remote version info.
865 *
866 * Returns void
867 *
868 ******************************************************************************/
btm_read_remote_version_complete(uint8_t * p)869 void btm_read_remote_version_complete(uint8_t* p) {
870 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
871 uint8_t status;
872 uint16_t handle;
873 int xx;
874 BTM_TRACE_DEBUG("btm_read_remote_version_complete");
875
876 STREAM_TO_UINT8(status, p);
877 STREAM_TO_UINT16(handle, p);
878
879 /* Look up the connection by handle and copy features */
880 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++) {
881 if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle)) {
882 if (status == HCI_SUCCESS) {
883 STREAM_TO_UINT8(p_acl_cb->lmp_version, p);
884 STREAM_TO_UINT16(p_acl_cb->manufacturer, p);
885 STREAM_TO_UINT16(p_acl_cb->lmp_subversion, p);
886 }
887
888 if (p_acl_cb->transport == BT_TRANSPORT_LE) {
889 l2cble_notify_le_connection(p_acl_cb->remote_addr);
890 btm_use_preferred_conn_params(p_acl_cb->remote_addr);
891 }
892 break;
893 }
894 }
895 }
896
897 /*******************************************************************************
898 *
899 * Function btm_process_remote_ext_features
900 *
901 * Description Local function called to process all extended features pages
902 * read from a remote device.
903 *
904 * Returns void
905 *
906 ******************************************************************************/
btm_process_remote_ext_features(tACL_CONN * p_acl_cb,uint8_t num_read_pages)907 void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
908 uint8_t num_read_pages) {
909 uint16_t handle = p_acl_cb->hci_handle;
910 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
911 uint8_t page_idx;
912
913 BTM_TRACE_DEBUG("btm_process_remote_ext_features");
914
915 /* Make sure we have the record to save remote features information */
916 if (p_dev_rec == NULL) {
917 /* Get a new device; might be doing dedicated bonding */
918 p_dev_rec = btm_find_or_alloc_dev(p_acl_cb->remote_addr);
919 }
920
921 p_acl_cb->num_read_pages = num_read_pages;
922 p_dev_rec->num_read_pages = num_read_pages;
923
924 /* Move the pages to placeholder */
925 for (page_idx = 0; page_idx < num_read_pages; page_idx++) {
926 if (page_idx > HCI_EXT_FEATURES_PAGE_MAX) {
927 BTM_TRACE_ERROR("%s: page=%d unexpected", __func__, page_idx);
928 break;
929 }
930 memcpy(p_dev_rec->feature_pages[page_idx],
931 p_acl_cb->peer_lmp_feature_pages[page_idx],
932 HCI_FEATURE_BYTES_PER_PAGE);
933 }
934
935 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
936
937 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
938 btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
939
940 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
941 if (req_pend) {
942 /* Request for remaining Security Features (if any) */
943 l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
944 }
945 }
946
947 /*******************************************************************************
948 *
949 * Function btm_read_remote_features
950 *
951 * Description Local function called to send a read remote supported
952 * features/remote extended features page[0].
953 *
954 * Returns void
955 *
956 ******************************************************************************/
btm_read_remote_features(uint16_t handle)957 void btm_read_remote_features(uint16_t handle) {
958 uint8_t acl_idx;
959 tACL_CONN* p_acl_cb;
960
961 BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
962
963 acl_idx = btm_handle_to_acl_index(handle);
964 if (acl_idx >= MAX_L2CAP_LINKS) {
965 BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
966 return;
967 }
968
969 p_acl_cb = &btm_cb.acl_db[acl_idx];
970 p_acl_cb->num_read_pages = 0;
971 memset(p_acl_cb->peer_lmp_feature_pages, 0,
972 sizeof(p_acl_cb->peer_lmp_feature_pages));
973
974 /* first send read remote supported features HCI command */
975 /* because we don't know whether the remote support extended feature command
976 */
977 btsnd_hcic_rmt_features_req(handle);
978 }
979
980 /*******************************************************************************
981 *
982 * Function btm_read_remote_ext_features
983 *
984 * Description Local function called to send a read remote extended
985 * features
986 *
987 * Returns void
988 *
989 ******************************************************************************/
btm_read_remote_ext_features(uint16_t handle,uint8_t page_number)990 void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number) {
991 BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle,
992 page_number);
993
994 btsnd_hcic_rmt_ext_features(handle, page_number);
995 }
996
997 /*******************************************************************************
998 *
999 * Function btm_read_remote_features_complete
1000 *
1001 * Description This function is called when the remote supported features
1002 * complete event is received from the HCI.
1003 *
1004 * Returns void
1005 *
1006 ******************************************************************************/
btm_read_remote_features_complete(uint8_t * p)1007 void btm_read_remote_features_complete(uint8_t* p) {
1008 tACL_CONN* p_acl_cb;
1009 uint8_t status;
1010 uint16_t handle;
1011 uint8_t acl_idx;
1012
1013 BTM_TRACE_DEBUG("btm_read_remote_features_complete");
1014 STREAM_TO_UINT8(status, p);
1015
1016 if (status != HCI_SUCCESS) {
1017 BTM_TRACE_ERROR("btm_read_remote_features_complete failed (status 0x%02x)",
1018 status);
1019 return;
1020 }
1021
1022 STREAM_TO_UINT16(handle, p);
1023
1024 acl_idx = btm_handle_to_acl_index(handle);
1025 if (acl_idx >= MAX_L2CAP_LINKS) {
1026 BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid",
1027 handle);
1028 return;
1029 }
1030
1031 p_acl_cb = &btm_cb.acl_db[acl_idx];
1032
1033 /* Copy the received features page */
1034 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[0], p,
1035 HCI_FEATURE_BYTES_PER_PAGE);
1036
1037 if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_feature_pages[0])) &&
1038 (controller_get_interface()
1039 ->supports_reading_remote_extended_features())) {
1040 /* if the remote controller has extended features and local controller
1041 supports HCI_Read_Remote_Extended_Features command then start reading
1042 these feature starting with extended features page 1 */
1043 BTM_TRACE_DEBUG("Start reading remote extended features");
1044 btm_read_remote_ext_features(handle, 1);
1045 return;
1046 }
1047
1048 /* Remote controller has no extended features. Process remote controller
1049 supported features (features page 0). */
1050 btm_process_remote_ext_features(p_acl_cb, 1);
1051
1052 /* Continue with HCI connection establishment */
1053 btm_establish_continue(p_acl_cb);
1054 }
1055
1056 /*******************************************************************************
1057 *
1058 * Function btm_read_remote_ext_features_complete
1059 *
1060 * Description This function is called when the remote extended features
1061 * complete event is received from the HCI.
1062 *
1063 * Returns void
1064 *
1065 ******************************************************************************/
btm_read_remote_ext_features_complete(uint8_t * p,uint8_t evt_len)1066 void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
1067 tACL_CONN* p_acl_cb;
1068 uint8_t page_num, max_page;
1069 uint16_t handle;
1070 uint8_t acl_idx;
1071
1072 BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
1073
1074 if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
1075 android_errorWriteLog(0x534e4554, "141552859");
1076 BTM_TRACE_ERROR(
1077 "btm_read_remote_ext_features_complete evt length too short. length=%d",
1078 evt_len);
1079 return;
1080 }
1081
1082 ++p;
1083 STREAM_TO_UINT16(handle, p);
1084 STREAM_TO_UINT8(page_num, p);
1085 STREAM_TO_UINT8(max_page, p);
1086
1087 /* Validate parameters */
1088 acl_idx = btm_handle_to_acl_index(handle);
1089 if (acl_idx >= MAX_L2CAP_LINKS) {
1090 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid",
1091 handle);
1092 return;
1093 }
1094
1095 if (max_page > HCI_EXT_FEATURES_PAGE_MAX) {
1096 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown",
1097 max_page);
1098 return;
1099 }
1100
1101 if (page_num > HCI_EXT_FEATURES_PAGE_MAX) {
1102 android_errorWriteLog(0x534e4554, "141552859");
1103 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",
1104 page_num);
1105 return;
1106 }
1107
1108 if (page_num > max_page) {
1109 BTM_TRACE_WARNING(
1110 "btm_read_remote_ext_features_complete num_page=%d, max_page=%d "
1111 "invalid", page_num, max_page);
1112 }
1113
1114 p_acl_cb = &btm_cb.acl_db[acl_idx];
1115
1116 /* Copy the received features page */
1117 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[page_num], p,
1118 HCI_FEATURE_BYTES_PER_PAGE);
1119
1120 /* If there is the next remote features page and
1121 * we have space to keep this page data - read this page */
1122 if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX)) {
1123 page_num++;
1124 BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)",
1125 page_num);
1126 btm_read_remote_ext_features(handle, page_num);
1127 return;
1128 }
1129
1130 /* Reading of remote feature pages is complete */
1131 BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)",
1132 page_num);
1133
1134 /* Process the pages */
1135 btm_process_remote_ext_features(p_acl_cb, (uint8_t)(page_num + 1));
1136
1137 /* Continue with HCI connection establishment */
1138 btm_establish_continue(p_acl_cb);
1139 }
1140
1141 /*******************************************************************************
1142 *
1143 * Function btm_read_remote_ext_features_failed
1144 *
1145 * Description This function is called when the remote extended features
1146 * complete event returns a failed status.
1147 *
1148 * Returns void
1149 *
1150 ******************************************************************************/
btm_read_remote_ext_features_failed(uint8_t status,uint16_t handle)1151 void btm_read_remote_ext_features_failed(uint8_t status, uint16_t handle) {
1152 tACL_CONN* p_acl_cb;
1153 uint8_t acl_idx;
1154
1155 BTM_TRACE_WARNING(
1156 "btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1157 status, handle);
1158
1159 acl_idx = btm_handle_to_acl_index(handle);
1160 if (acl_idx >= MAX_L2CAP_LINKS) {
1161 BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid",
1162 handle);
1163 return;
1164 }
1165
1166 p_acl_cb = &btm_cb.acl_db[acl_idx];
1167
1168 /* Process supported features only */
1169 btm_process_remote_ext_features(p_acl_cb, 1);
1170
1171 /* Continue HCI connection establishment */
1172 btm_establish_continue(p_acl_cb);
1173 }
1174
1175 /*******************************************************************************
1176 *
1177 * Function btm_establish_continue
1178 *
1179 * Description This function is called when the command complete message
1180 * is received from the HCI for the read local link policy
1181 * request.
1182 *
1183 * Returns void
1184 *
1185 ******************************************************************************/
btm_establish_continue(tACL_CONN * p_acl_cb)1186 void btm_establish_continue(tACL_CONN* p_acl_cb) {
1187 tBTM_BL_EVENT_DATA evt_data;
1188 BTM_TRACE_DEBUG("btm_establish_continue");
1189 #if (BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1190 if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
1191 /* For now there are a some devices that do not like sending */
1192 /* commands events and data at the same time. */
1193 /* Set the packet types to the default allowed by the device */
1194 btm_set_packet_types(p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1195
1196 if (btm_cb.btm_def_link_policy)
1197 BTM_SetLinkPolicy(p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1198 }
1199 #endif
1200 p_acl_cb->link_up_issued = true;
1201
1202 /* If anyone cares, tell him database changed */
1203 if (btm_cb.p_bl_changed_cb) {
1204 evt_data.event = BTM_BL_CONN_EVT;
1205 evt_data.conn.p_bda = &p_acl_cb->remote_addr;
1206 evt_data.conn.p_bdn = p_acl_cb->remote_name;
1207 evt_data.conn.p_dc = p_acl_cb->remote_dc;
1208 evt_data.conn.p_features = p_acl_cb->peer_lmp_feature_pages[0];
1209 evt_data.conn.handle = p_acl_cb->hci_handle;
1210 evt_data.conn.transport = p_acl_cb->transport;
1211
1212 (*btm_cb.p_bl_changed_cb)(&evt_data);
1213 }
1214 btm_acl_update_busy_level(BTM_BLI_ACL_UP_EVT);
1215 }
1216
1217 /*******************************************************************************
1218 *
1219 * Function BTM_SetDefaultLinkSuperTout
1220 *
1221 * Description Set the default value for HCI "Write Link Supervision
1222 * Timeout"
1223 * command to use when an ACL link is created.
1224 *
1225 * Returns void
1226 *
1227 ******************************************************************************/
BTM_SetDefaultLinkSuperTout(uint16_t timeout)1228 void BTM_SetDefaultLinkSuperTout(uint16_t timeout) {
1229 BTM_TRACE_DEBUG("BTM_SetDefaultLinkSuperTout");
1230 btm_cb.btm_def_link_super_tout = timeout;
1231 }
1232
1233 /*******************************************************************************
1234 *
1235 * Function BTM_GetLinkSuperTout
1236 *
1237 * Description Read the link supervision timeout value of the connection
1238 *
1239 * Returns status of the operation
1240 *
1241 ******************************************************************************/
BTM_GetLinkSuperTout(const RawAddress & remote_bda,uint16_t * p_timeout)1242 tBTM_STATUS BTM_GetLinkSuperTout(const RawAddress& remote_bda,
1243 uint16_t* p_timeout) {
1244 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1245
1246 BTM_TRACE_DEBUG("BTM_GetLinkSuperTout");
1247 if (p != (tACL_CONN*)NULL) {
1248 *p_timeout = p->link_super_tout;
1249 return (BTM_SUCCESS);
1250 }
1251 /* If here, no BD Addr found */
1252 return (BTM_UNKNOWN_ADDR);
1253 }
1254
1255 /*******************************************************************************
1256 *
1257 * Function BTM_SetLinkSuperTout
1258 *
1259 * Description Create and send HCI "Write Link Supervision Timeout" command
1260 *
1261 * Returns status of the operation
1262 *
1263 ******************************************************************************/
BTM_SetLinkSuperTout(const RawAddress & remote_bda,uint16_t timeout)1264 tBTM_STATUS BTM_SetLinkSuperTout(const RawAddress& remote_bda,
1265 uint16_t timeout) {
1266 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1267
1268 BTM_TRACE_DEBUG("BTM_SetLinkSuperTout");
1269 if (p != (tACL_CONN*)NULL) {
1270 p->link_super_tout = timeout;
1271
1272 /* Only send if current role is Master; 2.0 spec requires this */
1273 if (p->link_role == BTM_ROLE_MASTER) {
1274 btsnd_hcic_write_link_super_tout(LOCAL_BR_EDR_CONTROLLER_ID,
1275 p->hci_handle, timeout);
1276 return (BTM_CMD_STARTED);
1277 } else {
1278 return (BTM_SUCCESS);
1279 }
1280 }
1281
1282 /* If here, no BD Addr found */
1283 return (BTM_UNKNOWN_ADDR);
1284 }
1285
1286 /*******************************************************************************
1287 *
1288 * Function BTM_IsAclConnectionUp
1289 *
1290 * Description This function is called to check if an ACL connection exists
1291 * to a specific remote BD Address.
1292 *
1293 * Returns true if connection is up, else false.
1294 *
1295 ******************************************************************************/
BTM_IsAclConnectionUp(const RawAddress & remote_bda,tBT_TRANSPORT transport)1296 bool BTM_IsAclConnectionUp(const RawAddress& remote_bda,
1297 tBT_TRANSPORT transport) {
1298 tACL_CONN* p;
1299
1300 VLOG(2) << __func__ << " RemBdAddr: " << remote_bda;
1301
1302 p = btm_bda_to_acl(remote_bda, transport);
1303 if (p != (tACL_CONN*)NULL) {
1304 return (true);
1305 }
1306
1307 /* If here, no BD Addr found */
1308 return (false);
1309 }
1310
1311 /*******************************************************************************
1312 *
1313 * Function BTM_GetNumAclLinks
1314 *
1315 * Description This function is called to count the number of
1316 * ACL links that are active.
1317 *
1318 * Returns uint16_t Number of active ACL links
1319 *
1320 ******************************************************************************/
BTM_GetNumAclLinks(void)1321 uint16_t BTM_GetNumAclLinks(void) {
1322 uint16_t num_acl = 0;
1323
1324 for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i) {
1325 if (btm_cb.acl_db[i].in_use) ++num_acl;
1326 }
1327
1328 return num_acl;
1329 }
1330
1331 /*******************************************************************************
1332 *
1333 * Function btm_get_acl_disc_reason_code
1334 *
1335 * Description This function is called to get the disconnection reason code
1336 * returned by the HCI at disconnection complete event.
1337 *
1338 * Returns true if connection is up, else false.
1339 *
1340 ******************************************************************************/
btm_get_acl_disc_reason_code(void)1341 uint16_t btm_get_acl_disc_reason_code(void) {
1342 uint8_t res = btm_cb.acl_disc_reason;
1343 BTM_TRACE_DEBUG("btm_get_acl_disc_reason_code");
1344 return (res);
1345 }
1346
1347 /*******************************************************************************
1348 *
1349 * Function BTM_GetHCIConnHandle
1350 *
1351 * Description This function is called to get the handle for an ACL
1352 * connection to a specific remote BD Address.
1353 *
1354 * Returns the handle of the connection, or 0xFFFF if none.
1355 *
1356 ******************************************************************************/
BTM_GetHCIConnHandle(const RawAddress & remote_bda,tBT_TRANSPORT transport)1357 uint16_t BTM_GetHCIConnHandle(const RawAddress& remote_bda,
1358 tBT_TRANSPORT transport) {
1359 tACL_CONN* p;
1360 BTM_TRACE_DEBUG("BTM_GetHCIConnHandle");
1361 p = btm_bda_to_acl(remote_bda, transport);
1362 if (p != (tACL_CONN*)NULL) {
1363 return (p->hci_handle);
1364 }
1365
1366 /* If here, no BD Addr found */
1367 return (0xFFFF);
1368 }
1369
1370 /*******************************************************************************
1371 *
1372 * Function btm_process_clk_off_comp_evt
1373 *
1374 * Description This function is called when clock offset command completes.
1375 *
1376 * Input Parms hci_handle - connection handle associated with the change
1377 * clock offset
1378 *
1379 * Returns void
1380 *
1381 ******************************************************************************/
btm_process_clk_off_comp_evt(uint16_t hci_handle,uint16_t clock_offset)1382 void btm_process_clk_off_comp_evt(uint16_t hci_handle, uint16_t clock_offset) {
1383 uint8_t xx;
1384 BTM_TRACE_DEBUG("btm_process_clk_off_comp_evt");
1385 /* Look up the connection by handle and set the current mode */
1386 xx = btm_handle_to_acl_index(hci_handle);
1387 if (xx < MAX_L2CAP_LINKS) btm_cb.acl_db[xx].clock_offset = clock_offset;
1388 }
1389
1390 /*******************************************************************************
1391 *
1392 * Function btm_blacklist_role_change_device
1393 *
1394 * Description This function is used to blacklist the device if the role
1395 * switch fails for maximum number of times. It also removes
1396 * the device from the black list if the role switch succeeds.
1397 *
1398 * Input Parms bd_addr - remote BD addr
1399 * hci_status - role switch status
1400 *
1401 * Returns void
1402 *
1403 *******************************************************************************/
btm_blacklist_role_change_device(const RawAddress & bd_addr,uint8_t hci_status)1404 void btm_blacklist_role_change_device(const RawAddress& bd_addr,
1405 uint8_t hci_status) {
1406 tACL_CONN* p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
1407 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
1408
1409 if (!p || !p_dev_rec) {
1410 return;
1411 }
1412 if (hci_status == HCI_SUCCESS) {
1413 p->switch_role_failed_attempts = 0;
1414 return;
1415 }
1416
1417 /* check for carkits */
1418 const uint32_t cod_audio_device =
1419 (BTM_COD_SERVICE_AUDIO | BTM_COD_MAJOR_AUDIO) << 8;
1420 const uint32_t cod =
1421 ((p_dev_rec->dev_class[0] << 16) | (p_dev_rec->dev_class[1] << 8) |
1422 p_dev_rec->dev_class[2]) &
1423 0xffffff;
1424 if ((hci_status != HCI_SUCCESS) &&
1425 ((p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) ||
1426 (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)) &&
1427 ((cod & cod_audio_device) == cod_audio_device) &&
1428 (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr))) {
1429 p->switch_role_failed_attempts++;
1430 if (p->switch_role_failed_attempts == BTM_MAX_SW_ROLE_FAILED_ATTEMPTS) {
1431 BTM_TRACE_WARNING(
1432 "%s: Device %s blacklisted for role switching - "
1433 "multiple role switch failed attempts: %u",
1434 __func__, bd_addr.ToString().c_str(), p->switch_role_failed_attempts);
1435 interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr, 3);
1436 }
1437 }
1438 }
1439
1440 /*******************************************************************************
1441 *
1442 * Function btm_acl_role_changed
1443 *
1444 * Description This function is called whan a link's master/slave role
1445 * change event or command status event (with error) is
1446 * received. It updates the link control block, and calls the
1447 * registered callback with status and role (if registered).
1448 *
1449 * Returns void
1450 *
1451 ******************************************************************************/
btm_acl_role_changed(uint8_t hci_status,const RawAddress * bd_addr,uint8_t new_role)1452 void btm_acl_role_changed(uint8_t hci_status, const RawAddress* bd_addr,
1453 uint8_t new_role) {
1454 const RawAddress* p_bda =
1455 (bd_addr) ? bd_addr : &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1456 tACL_CONN* p = btm_bda_to_acl(*p_bda, BT_TRANSPORT_BR_EDR);
1457 tBTM_ROLE_SWITCH_CMPL* p_data = &btm_cb.devcb.switch_role_ref_data;
1458 tBTM_SEC_DEV_REC* p_dev_rec;
1459
1460 BTM_TRACE_DEBUG("btm_acl_role_changed");
1461 /* Ignore any stray events */
1462 if (p == NULL) {
1463 /* it could be a failure */
1464 if (hci_status != HCI_SUCCESS)
1465 btm_acl_report_role_change(hci_status, bd_addr);
1466 return;
1467 }
1468
1469 p_data->hci_status = hci_status;
1470
1471 if (hci_status == HCI_SUCCESS) {
1472 p_data->role = new_role;
1473 p_data->remote_bd_addr = *p_bda;
1474
1475 /* Update cached value */
1476 p->link_role = new_role;
1477
1478 /* Reload LSTO: link supervision timeout is reset in the LM after a role
1479 * switch */
1480 if (new_role == BTM_ROLE_MASTER) {
1481 BTM_SetLinkSuperTout(p->remote_addr, p->link_super_tout);
1482 }
1483 } else {
1484 /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1485 new_role = p->link_role;
1486 }
1487
1488 /* Check if any SCO req is pending for role change */
1489 btm_sco_chk_pend_rolechange(p->hci_handle);
1490
1491 /* if switching state is switching we need to turn encryption on */
1492 /* if idle, we did not change encryption */
1493 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) {
1494 btsnd_hcic_set_conn_encrypt(p->hci_handle, true);
1495 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1496 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1497 return;
1498 }
1499
1500 /* Set the switch_role_state to IDLE since the reply received from HCI */
1501 /* regardless of its result either success or failed. */
1502 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS) {
1503 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1504 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1505 }
1506
1507 /* if role switch complete is needed, report it now */
1508 btm_acl_report_role_change(hci_status, bd_addr);
1509
1510 /* if role change event is registered, report it now */
1511 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
1512 tBTM_BL_ROLE_CHG_DATA evt;
1513 evt.event = BTM_BL_ROLE_CHG_EVT;
1514 evt.new_role = new_role;
1515 evt.p_bda = p_bda;
1516 evt.hci_status = hci_status;
1517 tBTM_BL_EVENT_DATA btm_bl_event_data;
1518 btm_bl_event_data.role_chg = evt;
1519 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
1520 }
1521
1522 BTM_TRACE_DEBUG(
1523 "Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
1524 p_data->role, p_data->hci_status, p->switch_role_state);
1525
1526 #if (BTM_DISC_DURING_RS == TRUE)
1527 /* If a disconnect is pending, issue it now that role switch has completed */
1528 p_dev_rec = btm_find_dev(*p_bda);
1529 if (p_dev_rec != NULL) {
1530 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
1531 BTM_TRACE_WARNING(
1532 "btm_acl_role_changed -> Issuing delayed HCI_Disconnect!!!");
1533 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1534 }
1535 BTM_TRACE_ERROR("tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1536 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1537 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
1538 }
1539
1540 #endif
1541 }
1542
1543 /*******************************************************************************
1544 *
1545 * Function BTM_AllocateSCN
1546 *
1547 * Description Look through the Server Channel Numbers for a free one.
1548 *
1549 * Returns Allocated SCN number or 0 if none.
1550 *
1551 ******************************************************************************/
1552
BTM_AllocateSCN(void)1553 uint8_t BTM_AllocateSCN(void) {
1554 uint8_t x;
1555 BTM_TRACE_DEBUG("BTM_AllocateSCN");
1556
1557 // stack reserves scn 1 for HFP, HSP we still do the correct way
1558 for (x = 1; x < BTM_MAX_SCN; x++) {
1559 if (!btm_cb.btm_scn[x]) {
1560 btm_cb.btm_scn[x] = true;
1561 return (x + 1);
1562 }
1563 }
1564
1565 return (0); /* No free ports */
1566 }
1567
1568 /*******************************************************************************
1569 *
1570 * Function BTM_TryAllocateSCN
1571 *
1572 * Description Try to allocate a fixed server channel
1573 *
1574 * Returns Returns true if server channel was available
1575 *
1576 ******************************************************************************/
1577
BTM_TryAllocateSCN(uint8_t scn)1578 bool BTM_TryAllocateSCN(uint8_t scn) {
1579 /* Make sure we don't exceed max port range.
1580 * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1581 */
1582 if ((scn >= BTM_MAX_SCN) || (scn == 1)) return false;
1583
1584 /* check if this port is available */
1585 if (!btm_cb.btm_scn[scn - 1]) {
1586 btm_cb.btm_scn[scn - 1] = true;
1587 return true;
1588 }
1589
1590 return (false); /* Port was busy */
1591 }
1592
1593 /*******************************************************************************
1594 *
1595 * Function BTM_FreeSCN
1596 *
1597 * Description Free the specified SCN.
1598 *
1599 * Returns true or false
1600 *
1601 ******************************************************************************/
BTM_FreeSCN(uint8_t scn)1602 bool BTM_FreeSCN(uint8_t scn) {
1603 BTM_TRACE_DEBUG("BTM_FreeSCN ");
1604 if (scn <= BTM_MAX_SCN) {
1605 btm_cb.btm_scn[scn - 1] = false;
1606 return (true);
1607 } else {
1608 return (false); /* Illegal SCN passed in */
1609 }
1610 }
1611
1612 /*******************************************************************************
1613 *
1614 * Function btm_set_packet_types
1615 *
1616 * Description This function sets the packet types used for a specific
1617 * ACL connection. It is called internally by btm_acl_created
1618 * or by an application/profile by BTM_SetPacketTypes.
1619 *
1620 * Returns status of the operation
1621 *
1622 ******************************************************************************/
btm_set_packet_types(tACL_CONN * p,uint16_t pkt_types)1623 tBTM_STATUS btm_set_packet_types(tACL_CONN* p, uint16_t pkt_types) {
1624 uint16_t temp_pkt_types;
1625 BTM_TRACE_DEBUG("btm_set_packet_types");
1626 /* Save in the ACL control blocks, types that we support */
1627 temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1628 btm_cb.btm_acl_pkt_types_supported);
1629
1630 /* OR in any exception packet types if at least 2.0 version of spec */
1631 temp_pkt_types |=
1632 ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1633 (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1634
1635 /* Exclude packet types not supported by the peer */
1636 btm_acl_chk_peer_pkt_type_support(p, &temp_pkt_types);
1637
1638 BTM_TRACE_DEBUG("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1639
1640 btsnd_hcic_change_conn_type(p->hci_handle, temp_pkt_types);
1641 p->pkt_types_mask = temp_pkt_types;
1642
1643 return (BTM_CMD_STARTED);
1644 }
1645
1646 /*******************************************************************************
1647 *
1648 * Function btm_get_max_packet_size
1649 *
1650 * Returns Returns maximum packet size that can be used for current
1651 * connection, 0 if connection is not established
1652 *
1653 ******************************************************************************/
btm_get_max_packet_size(const RawAddress & addr)1654 uint16_t btm_get_max_packet_size(const RawAddress& addr) {
1655 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1656 uint16_t pkt_types = 0;
1657 uint16_t pkt_size = 0;
1658 BTM_TRACE_DEBUG("btm_get_max_packet_size");
1659 if (p != NULL) {
1660 pkt_types = p->pkt_types_mask;
1661 } else {
1662 /* Special case for when info for the local device is requested */
1663 if (addr == *controller_get_interface()->get_address()) {
1664 pkt_types = btm_cb.btm_acl_pkt_types_supported;
1665 }
1666 }
1667
1668 if (pkt_types) {
1669 if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1670 pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1671 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1672 pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1673 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1674 pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1675 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1676 pkt_size = HCI_DH5_PACKET_SIZE;
1677 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1678 pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1679 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1680 pkt_size = HCI_DM5_PACKET_SIZE;
1681 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1682 pkt_size = HCI_DH3_PACKET_SIZE;
1683 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1684 pkt_size = HCI_DM3_PACKET_SIZE;
1685 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1686 pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1687 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1688 pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1689 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1690 pkt_size = HCI_DH1_PACKET_SIZE;
1691 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1692 pkt_size = HCI_DM1_PACKET_SIZE;
1693 }
1694
1695 return (pkt_size);
1696 }
1697
1698 /*******************************************************************************
1699 *
1700 * Function BTM_ReadRemoteVersion
1701 *
1702 * Returns If connected report peer device info
1703 *
1704 ******************************************************************************/
BTM_ReadRemoteVersion(const RawAddress & addr,uint8_t * lmp_version,uint16_t * manufacturer,uint16_t * lmp_sub_version)1705 tBTM_STATUS BTM_ReadRemoteVersion(const RawAddress& addr, uint8_t* lmp_version,
1706 uint16_t* manufacturer,
1707 uint16_t* lmp_sub_version) {
1708 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1709 BTM_TRACE_DEBUG("BTM_ReadRemoteVersion");
1710 if (p == NULL) return (BTM_UNKNOWN_ADDR);
1711
1712 if (lmp_version) *lmp_version = p->lmp_version;
1713
1714 if (manufacturer) *manufacturer = p->manufacturer;
1715
1716 if (lmp_sub_version) *lmp_sub_version = p->lmp_subversion;
1717
1718 return (BTM_SUCCESS);
1719 }
1720
1721 /*******************************************************************************
1722 *
1723 * Function BTM_ReadRemoteFeatures
1724 *
1725 * Returns pointer to the remote supported features mask (8 bytes)
1726 *
1727 ******************************************************************************/
BTM_ReadRemoteFeatures(const RawAddress & addr)1728 uint8_t* BTM_ReadRemoteFeatures(const RawAddress& addr) {
1729 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1730 BTM_TRACE_DEBUG("BTM_ReadRemoteFeatures");
1731 if (p == NULL) {
1732 return (NULL);
1733 }
1734
1735 return (p->peer_lmp_feature_pages[0]);
1736 }
1737
1738 /*******************************************************************************
1739 *
1740 * Function BTM_ReadRemoteExtendedFeatures
1741 *
1742 * Returns pointer to the remote extended features mask (8 bytes)
1743 * or NULL if bad page
1744 *
1745 ******************************************************************************/
BTM_ReadRemoteExtendedFeatures(const RawAddress & addr,uint8_t page_number)1746 uint8_t* BTM_ReadRemoteExtendedFeatures(const RawAddress& addr,
1747 uint8_t page_number) {
1748 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1749 BTM_TRACE_DEBUG("BTM_ReadRemoteExtendedFeatures");
1750 if (p == NULL) {
1751 return (NULL);
1752 }
1753
1754 if (page_number > HCI_EXT_FEATURES_PAGE_MAX) {
1755 BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown",
1756 page_number);
1757 return NULL;
1758 }
1759
1760 return (p->peer_lmp_feature_pages[page_number]);
1761 }
1762
1763 /*******************************************************************************
1764 *
1765 * Function BTM_ReadNumberRemoteFeaturesPages
1766 *
1767 * Returns number of features pages read from the remote device.
1768 *
1769 ******************************************************************************/
BTM_ReadNumberRemoteFeaturesPages(const RawAddress & addr)1770 uint8_t BTM_ReadNumberRemoteFeaturesPages(const RawAddress& addr) {
1771 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1772 BTM_TRACE_DEBUG("BTM_ReadNumberRemoteFeaturesPages");
1773 if (p == NULL) {
1774 return (0);
1775 }
1776
1777 return (p->num_read_pages);
1778 }
1779
1780 /*******************************************************************************
1781 *
1782 * Function BTM_ReadAllRemoteFeatures
1783 *
1784 * Returns pointer to all features of the remote (24 bytes).
1785 *
1786 ******************************************************************************/
BTM_ReadAllRemoteFeatures(const RawAddress & addr)1787 uint8_t* BTM_ReadAllRemoteFeatures(const RawAddress& addr) {
1788 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1789 BTM_TRACE_DEBUG("BTM_ReadAllRemoteFeatures");
1790 if (p == NULL) {
1791 return (NULL);
1792 }
1793
1794 return (p->peer_lmp_feature_pages[0]);
1795 }
1796
1797 /*******************************************************************************
1798 *
1799 * Function BTM_RegBusyLevelNotif
1800 *
1801 * Description This function is called to register a callback to receive
1802 * busy level change events.
1803 *
1804 * Returns BTM_SUCCESS if successfully registered, otherwise error
1805 *
1806 ******************************************************************************/
BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB * p_cb,uint8_t * p_level,tBTM_BL_EVENT_MASK evt_mask)1807 tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
1808 tBTM_BL_EVENT_MASK evt_mask) {
1809 BTM_TRACE_DEBUG("BTM_RegBusyLevelNotif");
1810 if (p_level) *p_level = btm_cb.busy_level;
1811
1812 btm_cb.bl_evt_mask = evt_mask;
1813
1814 if (!p_cb)
1815 btm_cb.p_bl_changed_cb = NULL;
1816 else if (btm_cb.p_bl_changed_cb)
1817 return (BTM_BUSY);
1818 else
1819 btm_cb.p_bl_changed_cb = p_cb;
1820
1821 return (BTM_SUCCESS);
1822 }
1823
1824 /*******************************************************************************
1825 *
1826 * Function BTM_SetQoS
1827 *
1828 * Description This function is called to setup QoS
1829 *
1830 * Returns status of the operation
1831 *
1832 ******************************************************************************/
BTM_SetQoS(const RawAddress & bd,FLOW_SPEC * p_flow,tBTM_CMPL_CB * p_cb)1833 tBTM_STATUS BTM_SetQoS(const RawAddress& bd, FLOW_SPEC* p_flow,
1834 tBTM_CMPL_CB* p_cb) {
1835 tACL_CONN* p = &btm_cb.acl_db[0];
1836
1837 VLOG(2) << __func__ << " BdAddr: " << bd;
1838
1839 /* If someone already waiting on the version, do not allow another */
1840 if (btm_cb.devcb.p_qos_setup_cmpl_cb) return (BTM_BUSY);
1841
1842 p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR);
1843 if (p != NULL) {
1844 btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
1845 alarm_set_on_mloop(btm_cb.devcb.qos_setup_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1846 btm_qos_setup_timeout, NULL);
1847
1848 btsnd_hcic_qos_setup(p->hci_handle, p_flow->qos_flags, p_flow->service_type,
1849 p_flow->token_rate, p_flow->peak_bandwidth,
1850 p_flow->latency, p_flow->delay_variation);
1851 return (BTM_CMD_STARTED);
1852 }
1853
1854 /* If here, no BD Addr found */
1855 return (BTM_UNKNOWN_ADDR);
1856 }
1857
1858 /*******************************************************************************
1859 *
1860 * Function btm_qos_setup_timeout
1861 *
1862 * Description Callback when QoS setup times out.
1863 *
1864 * Returns void
1865 *
1866 ******************************************************************************/
btm_qos_setup_timeout(UNUSED_ATTR void * data)1867 void btm_qos_setup_timeout(UNUSED_ATTR void* data) {
1868 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1869 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1870 if (p_cb) (*p_cb)((void*)NULL);
1871 }
1872
1873 /*******************************************************************************
1874 *
1875 * Function btm_qos_setup_complete
1876 *
1877 * Description This function is called when the command complete message
1878 * is received from the HCI for the qos setup request.
1879 *
1880 * Returns void
1881 *
1882 ******************************************************************************/
btm_qos_setup_complete(uint8_t status,uint16_t handle,FLOW_SPEC * p_flow)1883 void btm_qos_setup_complete(uint8_t status, uint16_t handle,
1884 FLOW_SPEC* p_flow) {
1885 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1886 tBTM_QOS_SETUP_CMPL qossu;
1887
1888 BTM_TRACE_DEBUG("%s", __func__);
1889 alarm_cancel(btm_cb.devcb.qos_setup_timer);
1890 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1891
1892 /* If there was a registered callback, call it */
1893 if (p_cb) {
1894 memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1895 qossu.status = status;
1896 qossu.handle = handle;
1897 if (p_flow != NULL) {
1898 qossu.flow.qos_flags = p_flow->qos_flags;
1899 qossu.flow.service_type = p_flow->service_type;
1900 qossu.flow.token_rate = p_flow->token_rate;
1901 qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1902 qossu.flow.latency = p_flow->latency;
1903 qossu.flow.delay_variation = p_flow->delay_variation;
1904 }
1905 BTM_TRACE_DEBUG("BTM: p_flow->delay_variation: 0x%02x",
1906 qossu.flow.delay_variation);
1907 (*p_cb)(&qossu);
1908 }
1909 }
1910
1911 /*******************************************************************************
1912 *
1913 * Function BTM_ReadRSSI
1914 *
1915 * Description This function is called to read the link policy settings.
1916 * The address of link policy results are returned in the
1917 * callback.
1918 * (tBTM_RSSI_RESULT)
1919 *
1920 * Returns BTM_CMD_STARTED if successfully initiated or error code
1921 *
1922 ******************************************************************************/
BTM_ReadRSSI(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1923 tBTM_STATUS BTM_ReadRSSI(const RawAddress& remote_bda, tBTM_CMPL_CB* p_cb) {
1924 tACL_CONN* p;
1925 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
1926 tBT_DEVICE_TYPE dev_type;
1927 tBLE_ADDR_TYPE addr_type;
1928
1929 /* If someone already waiting on the version, do not allow another */
1930 if (btm_cb.devcb.p_rssi_cmpl_cb) return (BTM_BUSY);
1931
1932 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1933 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
1934
1935 p = btm_bda_to_acl(remote_bda, transport);
1936 if (p != (tACL_CONN*)NULL) {
1937 btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
1938 alarm_set_on_mloop(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1939 btm_read_rssi_timeout, NULL);
1940
1941 btsnd_hcic_read_rssi(p->hci_handle);
1942 return (BTM_CMD_STARTED);
1943 }
1944
1945 /* If here, no BD Addr found */
1946 return (BTM_UNKNOWN_ADDR);
1947 }
1948
1949 /*******************************************************************************
1950 *
1951 * Function BTM_ReadFailedContactCounter
1952 *
1953 * Description This function is called to read the failed contact counter.
1954 * The result is returned in the callback.
1955 * (tBTM_FAILED_CONTACT_COUNTER_RESULT)
1956 *
1957 * Returns BTM_CMD_STARTED if successfully initiated or error code
1958 *
1959 ******************************************************************************/
BTM_ReadFailedContactCounter(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1960 tBTM_STATUS BTM_ReadFailedContactCounter(const RawAddress& remote_bda,
1961 tBTM_CMPL_CB* p_cb) {
1962 tACL_CONN* p;
1963 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
1964 tBT_DEVICE_TYPE dev_type;
1965 tBLE_ADDR_TYPE addr_type;
1966
1967 /* If someone already waiting on the result, do not allow another */
1968 if (btm_cb.devcb.p_failed_contact_counter_cmpl_cb) return (BTM_BUSY);
1969
1970 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1971 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
1972
1973 p = btm_bda_to_acl(remote_bda, transport);
1974 if (p != (tACL_CONN*)NULL) {
1975 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = p_cb;
1976 alarm_set_on_mloop(btm_cb.devcb.read_failed_contact_counter_timer,
1977 BTM_DEV_REPLY_TIMEOUT_MS,
1978 btm_read_failed_contact_counter_timeout, NULL);
1979
1980 btsnd_hcic_read_failed_contact_counter(p->hci_handle);
1981 return (BTM_CMD_STARTED);
1982 }
1983
1984 /* If here, no BD Addr found */
1985 return (BTM_UNKNOWN_ADDR);
1986 }
1987
1988 /*******************************************************************************
1989 *
1990 * Function BTM_ReadAutomaticFlushTimeout
1991 *
1992 * Description This function is called to read the automatic flush timeout.
1993 * The result is returned in the callback.
1994 * (tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT)
1995 *
1996 * Returns BTM_CMD_STARTED if successfully initiated or error code
1997 *
1998 ******************************************************************************/
BTM_ReadAutomaticFlushTimeout(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1999 tBTM_STATUS BTM_ReadAutomaticFlushTimeout(const RawAddress& remote_bda,
2000 tBTM_CMPL_CB* p_cb) {
2001 tACL_CONN* p;
2002 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2003 tBT_DEVICE_TYPE dev_type;
2004 tBLE_ADDR_TYPE addr_type;
2005
2006 /* If someone already waiting on the result, do not allow another */
2007 if (btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb) return (BTM_BUSY);
2008
2009 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2010 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
2011
2012 p = btm_bda_to_acl(remote_bda, transport);
2013 if (!p) return BTM_UNKNOWN_ADDR;
2014
2015 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = p_cb;
2016 alarm_set_on_mloop(btm_cb.devcb.read_automatic_flush_timeout_timer,
2017 BTM_DEV_REPLY_TIMEOUT_MS,
2018 btm_read_automatic_flush_timeout_timeout, nullptr);
2019
2020 btsnd_hcic_read_automatic_flush_timeout(p->hci_handle);
2021 return BTM_CMD_STARTED;
2022 }
2023
2024 /*******************************************************************************
2025 *
2026 * Function BTM_ReadLinkQuality
2027 *
2028 * Description This function is called to read the link qulaity.
2029 * The value of the link quality is returned in the callback.
2030 * (tBTM_LINK_QUALITY_RESULT)
2031 *
2032 * Returns BTM_CMD_STARTED if successfully initiated or error code
2033 *
2034 ******************************************************************************/
BTM_ReadLinkQuality(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)2035 tBTM_STATUS BTM_ReadLinkQuality(const RawAddress& remote_bda,
2036 tBTM_CMPL_CB* p_cb) {
2037 VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
2038
2039 /* If someone already waiting on the version, do not allow another */
2040 if (btm_cb.devcb.p_link_qual_cmpl_cb) return (BTM_BUSY);
2041
2042 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
2043 if (p != (tACL_CONN*)NULL) {
2044 btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
2045 alarm_set_on_mloop(btm_cb.devcb.read_link_quality_timer,
2046 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_link_quality_timeout,
2047 NULL);
2048
2049 btsnd_hcic_get_link_quality(p->hci_handle);
2050 return (BTM_CMD_STARTED);
2051 }
2052
2053 /* If here, no BD Addr found */
2054 return (BTM_UNKNOWN_ADDR);
2055 }
2056
2057 /*******************************************************************************
2058 *
2059 * Function BTM_ReadTxPower
2060 *
2061 * Description This function is called to read the current
2062 * TX power of the connection. The tx power level results
2063 * are returned in the callback.
2064 * (tBTM_RSSI_RESULT)
2065 *
2066 * Returns BTM_CMD_STARTED if successfully initiated or error code
2067 *
2068 ******************************************************************************/
BTM_ReadTxPower(const RawAddress & remote_bda,tBT_TRANSPORT transport,tBTM_CMPL_CB * p_cb)2069 tBTM_STATUS BTM_ReadTxPower(const RawAddress& remote_bda,
2070 tBT_TRANSPORT transport, tBTM_CMPL_CB* p_cb) {
2071 tACL_CONN* p;
2072 #define BTM_READ_RSSI_TYPE_CUR 0x00
2073 #define BTM_READ_RSSI_TYPE_MAX 0X01
2074
2075 VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
2076
2077 /* If someone already waiting on the version, do not allow another */
2078 if (btm_cb.devcb.p_tx_power_cmpl_cb) return (BTM_BUSY);
2079
2080 p = btm_bda_to_acl(remote_bda, transport);
2081 if (p != (tACL_CONN*)NULL) {
2082 btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2083 alarm_set_on_mloop(btm_cb.devcb.read_tx_power_timer,
2084 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_tx_power_timeout,
2085 NULL);
2086
2087 if (p->transport == BT_TRANSPORT_LE) {
2088 btm_cb.devcb.read_tx_pwr_addr = remote_bda;
2089 btsnd_hcic_ble_read_adv_chnl_tx_power();
2090 } else {
2091 btsnd_hcic_read_tx_power(p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2092 }
2093
2094 return (BTM_CMD_STARTED);
2095 }
2096
2097 /* If here, no BD Addr found */
2098 return (BTM_UNKNOWN_ADDR);
2099 }
2100
2101 /*******************************************************************************
2102 *
2103 * Function btm_read_tx_power_timeout
2104 *
2105 * Description Callback when reading the tx power times out.
2106 *
2107 * Returns void
2108 *
2109 ******************************************************************************/
btm_read_tx_power_timeout(UNUSED_ATTR void * data)2110 void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {
2111 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2112 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2113 if (p_cb) (*p_cb)((void*)NULL);
2114 }
2115
2116 /*******************************************************************************
2117 *
2118 * Function btm_read_tx_power_complete
2119 *
2120 * Description This function is called when the command complete message
2121 * is received from the HCI for the read tx power request.
2122 *
2123 * Returns void
2124 *
2125 ******************************************************************************/
btm_read_tx_power_complete(uint8_t * p,bool is_ble)2126 void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
2127 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2128 tBTM_TX_POWER_RESULT result;
2129 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2130
2131 BTM_TRACE_DEBUG("%s", __func__);
2132 alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2133 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2134
2135 /* If there was a registered callback, call it */
2136 if (p_cb) {
2137 STREAM_TO_UINT8(result.hci_status, p);
2138
2139 if (result.hci_status == HCI_SUCCESS) {
2140 result.status = BTM_SUCCESS;
2141
2142 if (!is_ble) {
2143 uint16_t handle;
2144 STREAM_TO_UINT16(handle, p);
2145 STREAM_TO_UINT8(result.tx_power, p);
2146
2147 /* Search through the list of active channels for the correct BD Addr */
2148 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2149 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2150 result.rem_bda = p_acl_cb->remote_addr;
2151 break;
2152 }
2153 }
2154 } else {
2155 STREAM_TO_UINT8(result.tx_power, p);
2156 result.rem_bda = btm_cb.devcb.read_tx_pwr_addr;
2157 }
2158 BTM_TRACE_DEBUG("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2159 result.tx_power, result.hci_status);
2160 } else {
2161 result.status = BTM_ERR_PROCESSING;
2162 }
2163
2164 (*p_cb)(&result);
2165 }
2166 }
2167
2168 /*******************************************************************************
2169 *
2170 * Function btm_read_rssi_timeout
2171 *
2172 * Description Callback when reading the RSSI times out.
2173 *
2174 * Returns void
2175 *
2176 ******************************************************************************/
btm_read_rssi_timeout(UNUSED_ATTR void * data)2177 void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
2178 tBTM_RSSI_RESULT result;
2179 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2180 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2181 result.status = BTM_DEVICE_TIMEOUT;
2182 if (p_cb) (*p_cb)(&result);
2183 }
2184
2185 /*******************************************************************************
2186 *
2187 * Function btm_read_rssi_complete
2188 *
2189 * Description This function is called when the command complete message
2190 * is received from the HCI for the read rssi request.
2191 *
2192 * Returns void
2193 *
2194 ******************************************************************************/
btm_read_rssi_complete(uint8_t * p)2195 void btm_read_rssi_complete(uint8_t* p) {
2196 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2197 tBTM_RSSI_RESULT result;
2198 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2199
2200 BTM_TRACE_DEBUG("%s", __func__);
2201 alarm_cancel(btm_cb.devcb.read_rssi_timer);
2202 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2203
2204 /* If there was a registered callback, call it */
2205 if (p_cb) {
2206 STREAM_TO_UINT8(result.hci_status, p);
2207
2208 if (result.hci_status == HCI_SUCCESS) {
2209 uint16_t handle;
2210 result.status = BTM_SUCCESS;
2211
2212 STREAM_TO_UINT16(handle, p);
2213
2214 STREAM_TO_UINT8(result.rssi, p);
2215 BTM_TRACE_DEBUG("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2216 result.rssi, result.hci_status);
2217
2218 /* Search through the list of active channels for the correct BD Addr */
2219 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2220 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2221 result.rem_bda = p_acl_cb->remote_addr;
2222 break;
2223 }
2224 }
2225 } else {
2226 result.status = BTM_ERR_PROCESSING;
2227 }
2228
2229 (*p_cb)(&result);
2230 }
2231 }
2232
2233 /*******************************************************************************
2234 *
2235 * Function btm_read_failed_contact_counter_timeout
2236 *
2237 * Description Callback when reading the failed contact counter times out.
2238 *
2239 * Returns void
2240 *
2241 ******************************************************************************/
btm_read_failed_contact_counter_timeout(UNUSED_ATTR void * data)2242 void btm_read_failed_contact_counter_timeout(UNUSED_ATTR void* data) {
2243 tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2244 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2245 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2246 result.status = BTM_DEVICE_TIMEOUT;
2247 if (p_cb) (*p_cb)(&result);
2248 }
2249
2250 /*******************************************************************************
2251 *
2252 * Function btm_read_failed_contact_counter_complete
2253 *
2254 * Description This function is called when the command complete message
2255 * is received from the HCI for the read failed contact
2256 * counter request.
2257 *
2258 * Returns void
2259 *
2260 ******************************************************************************/
btm_read_failed_contact_counter_complete(uint8_t * p)2261 void btm_read_failed_contact_counter_complete(uint8_t* p) {
2262 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2263 tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2264 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2265
2266 BTM_TRACE_DEBUG("%s", __func__);
2267 alarm_cancel(btm_cb.devcb.read_failed_contact_counter_timer);
2268 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2269
2270 /* If there was a registered callback, call it */
2271 if (p_cb) {
2272 uint16_t handle;
2273 STREAM_TO_UINT8(result.hci_status, p);
2274
2275 if (result.hci_status == HCI_SUCCESS) {
2276 result.status = BTM_SUCCESS;
2277
2278 STREAM_TO_UINT16(handle, p);
2279
2280 STREAM_TO_UINT16(result.failed_contact_counter, p);
2281 BTM_TRACE_DEBUG(
2282 "BTM Failed Contact Counter Complete: counter %u, hci status 0x%02x",
2283 result.failed_contact_counter, result.hci_status);
2284
2285 /* Search through the list of active channels for the correct BD Addr */
2286 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2287 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2288 result.rem_bda = p_acl_cb->remote_addr;
2289 break;
2290 }
2291 }
2292 } else {
2293 result.status = BTM_ERR_PROCESSING;
2294 }
2295
2296 (*p_cb)(&result);
2297 }
2298 }
2299
2300 /*******************************************************************************
2301 *
2302 * Function btm_read_automatic_flush_timeout_timeout
2303 *
2304 * Description Callback when reading the automatic flush timeout times out.
2305 *
2306 * Returns void
2307 *
2308 ******************************************************************************/
btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void * data)2309 void btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void* data) {
2310 tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2311 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2312 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2313 result.status = BTM_DEVICE_TIMEOUT;
2314 if (p_cb) (*p_cb)(&result);
2315 }
2316
2317 /*******************************************************************************
2318 *
2319 * Function btm_read_automatic_flush_timeout_complete
2320 *
2321 * Description This function is called when the command complete message
2322 * is received from the HCI for the read automatic flush
2323 * timeout request.
2324 *
2325 * Returns void
2326 *
2327 ******************************************************************************/
btm_read_automatic_flush_timeout_complete(uint8_t * p)2328 void btm_read_automatic_flush_timeout_complete(uint8_t* p) {
2329 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2330 tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2331 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2332
2333 BTM_TRACE_DEBUG("%s", __func__);
2334 alarm_cancel(btm_cb.devcb.read_automatic_flush_timeout_timer);
2335 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2336
2337 /* If there was a registered callback, call it */
2338 if (p_cb) {
2339 uint16_t handle;
2340 STREAM_TO_UINT8(result.hci_status, p);
2341
2342 if (result.hci_status == HCI_SUCCESS) {
2343 result.status = BTM_SUCCESS;
2344
2345 STREAM_TO_UINT16(handle, p);
2346
2347 STREAM_TO_UINT16(result.automatic_flush_timeout, p);
2348 BTM_TRACE_DEBUG(
2349 "BTM Automatic Flush Timeout Complete: timeout %u, hci status 0x%02x",
2350 result.automatic_flush_timeout, result.hci_status);
2351
2352 /* Search through the list of active channels for the correct BD Addr */
2353 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2354 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2355 result.rem_bda = p_acl_cb->remote_addr;
2356 break;
2357 }
2358 }
2359 } else {
2360 result.status = BTM_ERR_PROCESSING;
2361 }
2362
2363 (*p_cb)(&result);
2364 }
2365 }
2366
2367 /*******************************************************************************
2368 *
2369 * Function btm_read_link_quality_timeout
2370 *
2371 * Description Callback when reading the link quality times out.
2372 *
2373 * Returns void
2374 *
2375 ******************************************************************************/
btm_read_link_quality_timeout(UNUSED_ATTR void * data)2376 void btm_read_link_quality_timeout(UNUSED_ATTR void* data) {
2377 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2378 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2379 if (p_cb) (*p_cb)((void*)NULL);
2380 }
2381
2382 /*******************************************************************************
2383 *
2384 * Function btm_read_link_quality_complete
2385 *
2386 * Description This function is called when the command complete message
2387 * is received from the HCI for the read link quality.
2388 *
2389 * Returns void
2390 *
2391 ******************************************************************************/
btm_read_link_quality_complete(uint8_t * p)2392 void btm_read_link_quality_complete(uint8_t* p) {
2393 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2394 tBTM_LINK_QUALITY_RESULT result;
2395 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2396
2397 BTM_TRACE_DEBUG("%s", __func__);
2398 alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2399 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2400
2401 /* If there was a registered callback, call it */
2402 if (p_cb) {
2403 STREAM_TO_UINT8(result.hci_status, p);
2404
2405 if (result.hci_status == HCI_SUCCESS) {
2406 uint16_t handle;
2407 result.status = BTM_SUCCESS;
2408
2409 STREAM_TO_UINT16(handle, p);
2410
2411 STREAM_TO_UINT8(result.link_quality, p);
2412 BTM_TRACE_DEBUG(
2413 "BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2414 result.link_quality, result.hci_status);
2415
2416 /* Search through the list of active channels for the correct BD Addr */
2417 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2418 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2419 result.rem_bda = p_acl_cb->remote_addr;
2420 break;
2421 }
2422 }
2423 } else {
2424 result.status = BTM_ERR_PROCESSING;
2425 }
2426
2427 (*p_cb)(&result);
2428 }
2429 }
2430
2431 /*******************************************************************************
2432 *
2433 * Function btm_remove_acl
2434 *
2435 * Description This function is called to disconnect an ACL connection
2436 *
2437 * Returns BTM_SUCCESS if successfully initiated, otherwise
2438 * BTM_NO_RESOURCES.
2439 *
2440 ******************************************************************************/
btm_remove_acl(const RawAddress & bd_addr,tBT_TRANSPORT transport)2441 tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr, tBT_TRANSPORT transport) {
2442 uint16_t hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2443 tBTM_STATUS status = BTM_SUCCESS;
2444
2445 BTM_TRACE_DEBUG("btm_remove_acl");
2446 #if (BTM_DISC_DURING_RS == TRUE)
2447 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
2448
2449 /* Role Switch is pending, postpone until completed */
2450 if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING)) {
2451 p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2452 } else /* otherwise can disconnect right away */
2453 #endif
2454 {
2455 if (hci_handle != 0xFFFF && p_dev_rec &&
2456 p_dev_rec->sec_state != BTM_SEC_STATE_DISCONNECTING) {
2457 btsnd_hcic_disconnect(hci_handle, HCI_ERR_PEER_USER);
2458 } else {
2459 status = BTM_UNKNOWN_ADDR;
2460 }
2461 }
2462
2463 return status;
2464 }
2465
2466 /*******************************************************************************
2467 *
2468 * Function BTM_SetTraceLevel
2469 *
2470 * Description This function sets the trace level for BTM. If called with
2471 * a value of 0xFF, it simply returns the current trace level.
2472 *
2473 * Returns The new or current trace level
2474 *
2475 ******************************************************************************/
BTM_SetTraceLevel(uint8_t new_level)2476 uint8_t BTM_SetTraceLevel(uint8_t new_level) {
2477 BTM_TRACE_DEBUG("BTM_SetTraceLevel");
2478 if (new_level != 0xFF) btm_cb.trace_level = new_level;
2479
2480 return (btm_cb.trace_level);
2481 }
2482
2483 /*******************************************************************************
2484 *
2485 * Function btm_cont_rswitch
2486 *
2487 * Description This function is called to continue processing an active
2488 * role switch. It first disables encryption if enabled and
2489 * EPR is not supported
2490 *
2491 * Returns void
2492 *
2493 ******************************************************************************/
btm_cont_rswitch(tACL_CONN * p,tBTM_SEC_DEV_REC * p_dev_rec,uint8_t hci_status)2494 void btm_cont_rswitch(tACL_CONN* p, tBTM_SEC_DEV_REC* p_dev_rec,
2495 uint8_t hci_status) {
2496 BTM_TRACE_DEBUG("btm_cont_rswitch");
2497 /* Check to see if encryption needs to be turned off if pending
2498 change of link key or role switch */
2499 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2500 /* Must turn off Encryption first if necessary */
2501 /* Some devices do not support switch or change of link key while encryption
2502 * is on */
2503 if (p_dev_rec != NULL &&
2504 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
2505 !BTM_EPR_AVAILABLE(p)) {
2506 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
2507 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2508 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2509 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2510 } else /* Encryption not used or EPR supported, continue with switch
2511 and/or change of link key */
2512 {
2513 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2514 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2515 #if (BTM_DISC_DURING_RS == TRUE)
2516 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2517 #endif
2518 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
2519 }
2520 }
2521 }
2522 }
2523
2524 /*******************************************************************************
2525 *
2526 * Function btm_acl_resubmit_page
2527 *
2528 * Description send pending page request
2529 *
2530 ******************************************************************************/
btm_acl_resubmit_page(void)2531 void btm_acl_resubmit_page(void) {
2532 tBTM_SEC_DEV_REC* p_dev_rec;
2533 BT_HDR* p_buf;
2534 uint8_t* pp;
2535 BTM_TRACE_DEBUG("btm_acl_resubmit_page");
2536 /* If there were other page request schedule can start the next one */
2537 p_buf = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue);
2538 if (p_buf != NULL) {
2539 /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2540 * for both create_conn and rmt_name */
2541 pp = (uint8_t*)(p_buf + 1) + p_buf->offset + 3;
2542
2543 RawAddress bda;
2544 STREAM_TO_BDADDR(bda, pp);
2545
2546 p_dev_rec = btm_find_or_alloc_dev(bda);
2547
2548 btm_cb.connecting_bda = p_dev_rec->bd_addr;
2549 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2550
2551 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2552 } else {
2553 btm_cb.paging = false;
2554 }
2555 }
2556
2557 /*******************************************************************************
2558 *
2559 * Function btm_acl_reset_paging
2560 *
2561 * Description set paging to false and free the page queue - called at
2562 * hci_reset
2563 *
2564 ******************************************************************************/
btm_acl_reset_paging(void)2565 void btm_acl_reset_paging(void) {
2566 BT_HDR* p;
2567 BTM_TRACE_DEBUG("btm_acl_reset_paging");
2568 /* If we sent reset we are definitely not paging any more */
2569 while ((p = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2570 osi_free(p);
2571
2572 btm_cb.paging = false;
2573 }
2574
2575 /*******************************************************************************
2576 *
2577 * Function btm_acl_paging
2578 *
2579 * Description send a paging command or queue it in btm_cb
2580 *
2581 ******************************************************************************/
btm_acl_paging(BT_HDR * p,const RawAddress & bda)2582 void btm_acl_paging(BT_HDR* p, const RawAddress& bda) {
2583 tBTM_SEC_DEV_REC* p_dev_rec;
2584
2585 VLOG(2) << __func__ << ":" << btm_cb.discing << " , paging:" << btm_cb.paging
2586 << " BDA: " << bda;
2587
2588 if (btm_cb.discing) {
2589 btm_cb.paging = true;
2590 fixed_queue_enqueue(btm_cb.page_queue, p);
2591 } else {
2592 if (!BTM_ACL_IS_CONNECTED(bda)) {
2593 VLOG(1) << "connecting_bda: " << btm_cb.connecting_bda;
2594 if (btm_cb.paging && bda != btm_cb.connecting_bda) {
2595 fixed_queue_enqueue(btm_cb.page_queue, p);
2596 } else {
2597 p_dev_rec = btm_find_or_alloc_dev(bda);
2598 btm_cb.connecting_bda = p_dev_rec->bd_addr;
2599 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2600
2601 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2602 }
2603
2604 btm_cb.paging = true;
2605 } else /* ACL is already up */
2606 {
2607 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2608 }
2609 }
2610 }
2611
2612 /*******************************************************************************
2613 *
2614 * Function btm_acl_notif_conn_collision
2615 *
2616 * Description Send connection collision event to upper layer if registered
2617 *
2618 * Returns true if sent out to upper layer,
2619 * false if no one needs the notification.
2620 *
2621 ******************************************************************************/
btm_acl_notif_conn_collision(const RawAddress & bda)2622 bool btm_acl_notif_conn_collision(const RawAddress& bda) {
2623 /* Report possible collision to the upper layer. */
2624 if (btm_cb.p_bl_changed_cb) {
2625 VLOG(1) << __func__ << " RemBdAddr: " << bda;
2626
2627 tBTM_BL_EVENT_DATA evt_data;
2628 evt_data.event = BTM_BL_COLLISION_EVT;
2629 evt_data.conn.p_bda = &bda;
2630 evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2631 evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2632 (*btm_cb.p_bl_changed_cb)(&evt_data);
2633 return true;
2634 } else {
2635 return false;
2636 }
2637 }
2638
2639 /*******************************************************************************
2640 *
2641 * Function btm_acl_chk_peer_pkt_type_support
2642 *
2643 * Description Check if peer supports requested packets
2644 *
2645 ******************************************************************************/
btm_acl_chk_peer_pkt_type_support(tACL_CONN * p,uint16_t * p_pkt_type)2646 void btm_acl_chk_peer_pkt_type_support(tACL_CONN* p, uint16_t* p_pkt_type) {
2647 /* 3 and 5 slot packets? */
2648 if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2649 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 + BTM_ACL_PKT_TYPES_MASK_DM3);
2650
2651 if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2652 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2653
2654 /* 2 and 3 MPS support? */
2655 if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2656 /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2657 *p_pkt_type |=
2658 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2659 BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2660
2661 if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2662 /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2663 *p_pkt_type |=
2664 (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2665 BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2666
2667 /* EDR 3 and 5 slot support? */
2668 if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]) ||
2669 HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0])) {
2670 if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2671 /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types
2672 */
2673 *p_pkt_type |=
2674 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2675
2676 if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2677 /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types
2678 */
2679 *p_pkt_type |=
2680 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2681 }
2682 }
2683