1 /******************************************************************************
2 *
3 * Copyright 2000-2012 Broadcom Corporation
4 *
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
8 *
9 * http://www.apache.org/licenses/LICENSE-2.0
10 *
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
16 *
17 ******************************************************************************/
18
19 /*****************************************************************************
20 *
21 * Name: btm_acl.cc
22 *
23 * Description: This file contains functions that handle ACL connections.
24 * This includes operations such as hold and sniff modes,
25 * supported packet types.
26 *
27 * This module contains both internal and external (API)
28 * functions. External (API) functions are distinguishable
29 * by their names beginning with uppercase BTM.
30 *
31 *
32 *****************************************************************************/
33
34 #define LOG_TAG "btm_acl"
35
36 #include <stddef.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40
41 #include "bt_common.h"
42 #include "bt_target.h"
43 #include "bt_types.h"
44 #include "bt_utils.h"
45 #include "btm_api.h"
46 #include "btm_int.h"
47 #include "btu.h"
48 #include "device/include/controller.h"
49 #include "device/include/interop.h"
50 #include "hcidefs.h"
51 #include "hcimsgs.h"
52 #include "l2c_int.h"
53 #include "osi/include/log.h"
54 #include "osi/include/osi.h"
55
56 static void btm_read_remote_features(uint16_t handle);
57 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
58 static void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
59 uint8_t num_read_pages);
60
61 /* 3 seconds timeout waiting for responses */
62 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
63
64 /*******************************************************************************
65 *
66 * Function btm_acl_init
67 *
68 * Description This function is called at BTM startup to initialize
69 *
70 * Returns void
71 *
72 ******************************************************************************/
btm_acl_init(void)73 void btm_acl_init(void) {
74 BTM_TRACE_DEBUG("btm_acl_init");
75 /* Initialize nonzero defaults */
76 btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
77 btm_cb.acl_disc_reason = 0xff;
78 }
79
80 /*******************************************************************************
81 *
82 * Function btm_bda_to_acl
83 *
84 * Description This function returns the FIRST acl_db entry for the passed
85 * BDA.
86 *
87 * Parameters bda : BD address of the remote device
88 * transport : Physical transport used for ACL connection
89 * (BR/EDR or LE)
90 *
91 * Returns Returns pointer to the ACL DB for the requested BDA if found.
92 * NULL if not found.
93 *
94 ******************************************************************************/
btm_bda_to_acl(const RawAddress & bda,tBT_TRANSPORT transport)95 tACL_CONN* btm_bda_to_acl(const RawAddress& bda, tBT_TRANSPORT transport) {
96 tACL_CONN* p = &btm_cb.acl_db[0];
97 uint16_t xx;
98 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
99 if ((p->in_use) && p->remote_addr == bda && p->transport == transport) {
100 BTM_TRACE_DEBUG("btm_bda_to_acl found");
101 return (p);
102 }
103 }
104
105 /* If here, no BD Addr found */
106 return ((tACL_CONN*)NULL);
107 }
108
109 /*******************************************************************************
110 *
111 * Function btm_handle_to_acl_index
112 *
113 * Description This function returns the FIRST acl_db entry for the passed
114 * hci_handle.
115 *
116 * Returns index to the acl_db or MAX_L2CAP_LINKS.
117 *
118 ******************************************************************************/
btm_handle_to_acl_index(uint16_t hci_handle)119 uint8_t btm_handle_to_acl_index(uint16_t hci_handle) {
120 tACL_CONN* p = &btm_cb.acl_db[0];
121 uint8_t xx;
122 BTM_TRACE_DEBUG("btm_handle_to_acl_index");
123 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
124 if ((p->in_use) && (p->hci_handle == hci_handle)) {
125 break;
126 }
127 }
128
129 /* If here, no BD Addr found */
130 return (xx);
131 }
132
133 #if (BLE_PRIVACY_SPT == TRUE)
134 /*******************************************************************************
135 *
136 * Function btm_ble_get_acl_remote_addr
137 *
138 * Description This function reads the active remote address used for the
139 * connection.
140 *
141 * Returns success return true, otherwise false.
142 *
143 ******************************************************************************/
btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC * p_dev_rec,RawAddress & conn_addr,tBLE_ADDR_TYPE * p_addr_type)144 bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec,
145 RawAddress& conn_addr,
146 tBLE_ADDR_TYPE* p_addr_type) {
147 bool st = true;
148
149 if (p_dev_rec == NULL) {
150 BTM_TRACE_ERROR("%s can not find device with matching address", __func__);
151 return false;
152 }
153
154 switch (p_dev_rec->ble.active_addr_type) {
155 case BTM_BLE_ADDR_PSEUDO:
156 conn_addr = p_dev_rec->bd_addr;
157 *p_addr_type = p_dev_rec->ble.ble_addr_type;
158 break;
159
160 case BTM_BLE_ADDR_RRA:
161 conn_addr = p_dev_rec->ble.cur_rand_addr;
162 *p_addr_type = BLE_ADDR_RANDOM;
163 break;
164
165 case BTM_BLE_ADDR_STATIC:
166 conn_addr = p_dev_rec->ble.static_addr;
167 *p_addr_type = p_dev_rec->ble.static_addr_type;
168 break;
169
170 default:
171 BTM_TRACE_ERROR("Unknown active address: %d",
172 p_dev_rec->ble.active_addr_type);
173 st = false;
174 break;
175 }
176
177 return st;
178 }
179 #endif
180 /*******************************************************************************
181 *
182 * Function btm_acl_created
183 *
184 * Description This function is called by L2CAP when an ACL connection
185 * is created.
186 *
187 * Returns void
188 *
189 ******************************************************************************/
btm_acl_created(const RawAddress & bda,DEV_CLASS dc,BD_NAME bdn,uint16_t hci_handle,uint8_t link_role,tBT_TRANSPORT transport)190 void btm_acl_created(const RawAddress& bda, DEV_CLASS dc, BD_NAME bdn,
191 uint16_t hci_handle, uint8_t link_role,
192 tBT_TRANSPORT transport) {
193 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
194 tACL_CONN* p;
195 uint8_t xx;
196
197 BTM_TRACE_DEBUG("%s: peer %s hci_handle=%d link_role=%d transport=%d",
198 __func__, bda.ToString().c_str(), hci_handle, link_role,
199 transport);
200 /* Ensure we don't have duplicates */
201 p = btm_bda_to_acl(bda, transport);
202 if (p != (tACL_CONN*)NULL) {
203 p->hci_handle = hci_handle;
204 p->link_role = link_role;
205 p->transport = transport;
206 VLOG(1) << "Duplicate btm_acl_created: RemBdAddr: " << bda;
207 BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
208 return;
209 }
210
211 /* Allocate acl_db entry */
212 for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++) {
213 if (!p->in_use) {
214 p->in_use = true;
215 p->hci_handle = hci_handle;
216 p->link_role = link_role;
217 p->link_up_issued = false;
218 p->remote_addr = bda;
219
220 p->transport = transport;
221 #if (BLE_PRIVACY_SPT == TRUE)
222 if (transport == BT_TRANSPORT_LE)
223 btm_ble_refresh_local_resolvable_private_addr(
224 bda, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
225 #else
226 p->conn_addr_type = BLE_ADDR_PUBLIC;
227 p->conn_addr = *controller_get_interface()->get_address();
228
229 #endif
230 p->switch_role_failed_attempts = 0;
231 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
232
233 btm_pm_sm_alloc(xx);
234
235 if (dc) memcpy(p->remote_dc, dc, DEV_CLASS_LEN);
236
237 if (bdn) memcpy(p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
238
239 /* if BR/EDR do something more */
240 if (transport == BT_TRANSPORT_BR_EDR) {
241 btsnd_hcic_read_rmt_clk_offset(p->hci_handle);
242 btsnd_hcic_rmt_ver_req(p->hci_handle);
243 }
244 p_dev_rec = btm_find_dev_by_handle(hci_handle);
245
246 if (p_dev_rec) {
247 BTM_TRACE_DEBUG("%s: peer %s device_type=0x%x", __func__,
248 bda.ToString().c_str(), p_dev_rec->device_type);
249 }
250
251 if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
252 /* If remote features already known, copy them and continue connection
253 * setup */
254 if ((p_dev_rec->num_read_pages) &&
255 (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
256 memcpy(p->peer_lmp_feature_pages, p_dev_rec->feature_pages,
257 (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
258 p->num_read_pages = p_dev_rec->num_read_pages;
259
260 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
261
262 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
263 btm_sec_set_peer_sec_caps(p, p_dev_rec);
264
265 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
266 if (req_pend) {
267 /* Request for remaining Security Features (if any) */
268 l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
269 }
270 btm_establish_continue(p);
271 return;
272 }
273 }
274
275 /* If here, features are not known yet */
276 if (p_dev_rec && transport == BT_TRANSPORT_LE) {
277 #if (BLE_PRIVACY_SPT == TRUE)
278 btm_ble_get_acl_remote_addr(p_dev_rec, p->active_remote_addr,
279 &p->active_remote_addr_type);
280 #endif
281
282 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(
283 controller_get_interface()->get_features_ble()->as_array) ||
284 link_role == HCI_ROLE_MASTER) {
285 btsnd_hcic_ble_read_remote_feat(p->hci_handle);
286 } else {
287 btm_establish_continue(p);
288 }
289 }
290
291 /* read page 1 - on rmt feature event for buffer reasons */
292 return;
293 }
294 }
295 }
296
btm_acl_update_conn_addr(uint16_t conn_handle,const RawAddress & address)297 void btm_acl_update_conn_addr(uint16_t conn_handle, const RawAddress& address) {
298 uint8_t idx = btm_handle_to_acl_index(conn_handle);
299 if (idx != MAX_L2CAP_LINKS) {
300 btm_cb.acl_db[idx].conn_addr = address;
301 }
302 }
303
304 /*******************************************************************************
305 *
306 * Function btm_acl_report_role_change
307 *
308 * Description This function is called when the local device is deemed
309 * to be down. It notifies L2CAP of the failure.
310 *
311 * Returns void
312 *
313 ******************************************************************************/
btm_acl_report_role_change(uint8_t hci_status,const RawAddress * bda)314 void btm_acl_report_role_change(uint8_t hci_status, const RawAddress* bda) {
315 tBTM_ROLE_SWITCH_CMPL ref_data;
316 BTM_TRACE_DEBUG("btm_acl_report_role_change");
317 if (btm_cb.devcb.p_switch_role_cb &&
318 (bda && btm_cb.devcb.switch_role_ref_data.remote_bd_addr == *bda)) {
319 memcpy(&ref_data, &btm_cb.devcb.switch_role_ref_data,
320 sizeof(tBTM_ROLE_SWITCH_CMPL));
321 ref_data.hci_status = hci_status;
322 (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
323 memset(&btm_cb.devcb.switch_role_ref_data, 0,
324 sizeof(tBTM_ROLE_SWITCH_CMPL));
325 btm_cb.devcb.p_switch_role_cb = NULL;
326 }
327 }
328
329 /*******************************************************************************
330 *
331 * Function btm_acl_removed
332 *
333 * Description This function is called by L2CAP when an ACL connection
334 * is removed. Since only L2CAP creates ACL links, we use
335 * the L2CAP link index as our index into the control blocks.
336 *
337 * Returns void
338 *
339 ******************************************************************************/
btm_acl_removed(const RawAddress & bda,tBT_TRANSPORT transport)340 void btm_acl_removed(const RawAddress& bda, tBT_TRANSPORT transport) {
341 tACL_CONN* p;
342 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
343 BTM_TRACE_DEBUG("btm_acl_removed");
344 p = btm_bda_to_acl(bda, transport);
345 if (p != (tACL_CONN*)NULL) {
346 p->in_use = false;
347
348 /* if the disconnected channel has a pending role switch, clear it now */
349 btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, &bda);
350
351 /* Only notify if link up has had a chance to be issued */
352 if (p->link_up_issued) {
353 p->link_up_issued = false;
354
355 /* If anyone cares, indicate the database changed */
356 if (btm_cb.p_bl_changed_cb) {
357 tBTM_BL_EVENT_DATA evt_data;
358 evt_data.event = BTM_BL_DISCN_EVT;
359 evt_data.discn.p_bda = &bda;
360 evt_data.discn.handle = p->hci_handle;
361 evt_data.discn.transport = p->transport;
362 (*btm_cb.p_bl_changed_cb)(&evt_data);
363 }
364
365 btm_acl_update_busy_level(BTM_BLI_ACL_DOWN_EVT);
366 }
367
368 BTM_TRACE_DEBUG(
369 "acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
370 p->hci_handle, p->transport, btm_cb.ble_ctr_cb.inq_var.connectable_mode,
371 p->link_role);
372
373 p_dev_rec = btm_find_dev(bda);
374 if (p_dev_rec) {
375 BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x",
376 p_dev_rec->sec_flags);
377 if (p->transport == BT_TRANSPORT_LE) {
378 BTM_TRACE_DEBUG("LE link down");
379 p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
380 if ((p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0) {
381 BTM_TRACE_DEBUG("Not Bonded");
382 p_dev_rec->sec_flags &=
383 ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
384 } else {
385 BTM_TRACE_DEBUG("Bonded");
386 }
387 } else {
388 BTM_TRACE_DEBUG("Bletooth link down");
389 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED |
390 BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
391 }
392 BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x",
393 p_dev_rec->sec_flags);
394 } else {
395 BTM_TRACE_ERROR("Device not found");
396 }
397
398 /* Clear the ACL connection data */
399 memset(p, 0, sizeof(tACL_CONN));
400 }
401 }
402
403 /*******************************************************************************
404 *
405 * Function btm_acl_device_down
406 *
407 * Description This function is called when the local device is deemed
408 * to be down. It notifies L2CAP of the failure.
409 *
410 * Returns void
411 *
412 ******************************************************************************/
btm_acl_device_down(void)413 void btm_acl_device_down(void) {
414 tACL_CONN* p = &btm_cb.acl_db[0];
415 uint16_t xx;
416 BTM_TRACE_DEBUG("btm_acl_device_down");
417 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
418 if (p->in_use) {
419 BTM_TRACE_DEBUG("hci_handle=%d HCI_ERR_HW_FAILURE ", p->hci_handle);
420 l2c_link_hci_disc_comp(p->hci_handle, HCI_ERR_HW_FAILURE);
421 }
422 }
423 }
424
425 /*******************************************************************************
426 *
427 * Function btm_acl_update_busy_level
428 *
429 * Description This function is called to update the busy level of the
430 * system.
431 *
432 * Returns void
433 *
434 ******************************************************************************/
btm_acl_update_busy_level(tBTM_BLI_EVENT event)435 void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
436 bool old_inquiry_state = btm_cb.is_inquiry;
437 tBTM_BL_UPDATE_DATA evt;
438 evt.busy_level_flags = 0;
439 switch (event) {
440 case BTM_BLI_ACL_UP_EVT:
441 BTM_TRACE_DEBUG("BTM_BLI_ACL_UP_EVT");
442 break;
443 case BTM_BLI_ACL_DOWN_EVT:
444 BTM_TRACE_DEBUG("BTM_BLI_ACL_DOWN_EVT");
445 break;
446 case BTM_BLI_PAGE_EVT:
447 BTM_TRACE_DEBUG("BTM_BLI_PAGE_EVT");
448 btm_cb.is_paging = true;
449 evt.busy_level_flags = BTM_BL_PAGING_STARTED;
450 break;
451 case BTM_BLI_PAGE_DONE_EVT:
452 BTM_TRACE_DEBUG("BTM_BLI_PAGE_DONE_EVT");
453 btm_cb.is_paging = false;
454 evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
455 break;
456 case BTM_BLI_INQ_EVT:
457 BTM_TRACE_DEBUG("BTM_BLI_INQ_EVT");
458 btm_cb.is_inquiry = true;
459 evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
460 break;
461 case BTM_BLI_INQ_CANCEL_EVT:
462 BTM_TRACE_DEBUG("BTM_BLI_INQ_CANCEL_EVT");
463 btm_cb.is_inquiry = false;
464 evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
465 break;
466 case BTM_BLI_INQ_DONE_EVT:
467 BTM_TRACE_DEBUG("BTM_BLI_INQ_DONE_EVT");
468 btm_cb.is_inquiry = false;
469 evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
470 break;
471 }
472
473 uint8_t busy_level;
474 if (btm_cb.is_paging || btm_cb.is_inquiry)
475 busy_level = 10;
476 else
477 busy_level = BTM_GetNumAclLinks();
478
479 if ((busy_level != btm_cb.busy_level) ||
480 (old_inquiry_state != btm_cb.is_inquiry)) {
481 evt.event = BTM_BL_UPDATE_EVT;
482 evt.busy_level = busy_level;
483 btm_cb.busy_level = busy_level;
484 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
485 tBTM_BL_EVENT_DATA btm_bl_event_data;
486 btm_bl_event_data.update = evt;
487 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
488 }
489 }
490 }
491
492 /*******************************************************************************
493 *
494 * Function BTM_GetRole
495 *
496 * Description This function is called to get the role of the local device
497 * for the ACL connection with the specified remote device
498 *
499 * Returns BTM_SUCCESS if connection exists.
500 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
501 *
502 ******************************************************************************/
BTM_GetRole(const RawAddress & remote_bd_addr,uint8_t * p_role)503 tBTM_STATUS BTM_GetRole(const RawAddress& remote_bd_addr, uint8_t* p_role) {
504 tACL_CONN* p;
505 BTM_TRACE_DEBUG("BTM_GetRole");
506 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
507 if (p == NULL) {
508 *p_role = BTM_ROLE_UNDEFINED;
509 return (BTM_UNKNOWN_ADDR);
510 }
511
512 /* Get the current role */
513 *p_role = p->link_role;
514 return (BTM_SUCCESS);
515 }
516
517 /*******************************************************************************
518 *
519 * Function BTM_SwitchRole
520 *
521 * Description This function is called to switch role between master and
522 * slave. If role is already set it will do nothing. If the
523 * command was initiated, the callback function is called upon
524 * completion.
525 *
526 * Returns BTM_SUCCESS if already in specified role.
527 * BTM_CMD_STARTED if command issued to controller.
528 * BTM_NO_RESOURCES if couldn't allocate memory to issue
529 * command
530 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
531 * BTM_MODE_UNSUPPORTED if local device does not support role
532 * switching
533 * BTM_BUSY if the previous command is not completed
534 *
535 ******************************************************************************/
BTM_SwitchRole(const RawAddress & remote_bd_addr,uint8_t new_role,tBTM_CMPL_CB * p_cb)536 tBTM_STATUS BTM_SwitchRole(const RawAddress& remote_bd_addr, uint8_t new_role,
537 tBTM_CMPL_CB* p_cb) {
538 tACL_CONN* p;
539 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
540 #if (BTM_SCO_INCLUDED == TRUE)
541 bool is_sco_active;
542 #endif
543 tBTM_STATUS status;
544 tBTM_PM_MODE pwr_mode;
545 tBTM_PM_PWR_MD settings;
546
547 LOG_INFO(LOG_TAG, "%s: peer %s new_role=0x%x p_cb=%p p_switch_role_cb=%p",
548 __func__, remote_bd_addr.ToString().c_str(), new_role, p_cb,
549 btm_cb.devcb.p_switch_role_cb);
550
551 /* Make sure the local device supports switching */
552 if (!controller_get_interface()->supports_master_slave_role_switch())
553 return (BTM_MODE_UNSUPPORTED);
554
555 if (btm_cb.devcb.p_switch_role_cb && p_cb) {
556 VLOG(2) << "Role switch on other device is in progress "
557 << btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
558 return (BTM_BUSY);
559 }
560
561 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
562 if (p == NULL) return (BTM_UNKNOWN_ADDR);
563
564 /* Finished if already in desired role */
565 if (p->link_role == new_role) return (BTM_SUCCESS);
566
567 if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH, &remote_bd_addr))
568 return BTM_DEV_BLACKLISTED;
569
570 #if (BTM_SCO_INCLUDED == TRUE)
571 /* Check if there is any SCO Active on this BD Address */
572 is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
573
574 if (is_sco_active) return (BTM_NO_RESOURCES);
575 #endif
576
577 /* Ignore role switch request if the previous request was not completed */
578 if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE) {
579 BTM_TRACE_DEBUG("BTM_SwitchRole busy: %d", p->switch_role_state);
580 return (BTM_BUSY);
581 }
582
583 if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &remote_bd_addr)) {
584 BTM_TRACE_DEBUG("%s, Device blacklisted under INTEROP_DYNAMIC_ROLE_SWITCH.",
585 __func__);
586 return BTM_DEV_BLACKLISTED;
587 }
588
589 status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode);
590 if (status != BTM_SUCCESS) return (status);
591
592 /* Wake up the link if in sniff or park before attempting switch */
593 if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF) {
594 memset((void*)&settings, 0, sizeof(settings));
595 settings.mode = BTM_PM_MD_ACTIVE;
596 status = BTM_SetPowerMode(BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
597 if (status != BTM_CMD_STARTED) return (BTM_WRONG_MODE);
598
599 p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
600 }
601 /* some devices do not support switch while encryption is on */
602 else {
603 p_dev_rec = btm_find_dev(remote_bd_addr);
604 if ((p_dev_rec != NULL) &&
605 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
606 !BTM_EPR_AVAILABLE(p)) {
607 /* bypass turning off encryption if change link key is already doing it */
608 if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF) {
609 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
610 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
611 }
612
613 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
614 } else {
615 btsnd_hcic_switch_role(remote_bd_addr, new_role);
616 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
617
618 #if (BTM_DISC_DURING_RS == TRUE)
619 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
620 #endif
621 }
622 }
623
624 /* Initialize return structure in case request fails */
625 if (p_cb) {
626 btm_cb.devcb.switch_role_ref_data.remote_bd_addr = remote_bd_addr;
627 btm_cb.devcb.switch_role_ref_data.role = new_role;
628 /* initialized to an error code */
629 btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
630 btm_cb.devcb.p_switch_role_cb = p_cb;
631 }
632 return (BTM_CMD_STARTED);
633 }
634
635 /*******************************************************************************
636 *
637 * Function btm_acl_encrypt_change
638 *
639 * Description This function is when encryption of the connection is
640 * completed by the LM. Checks to see if a role switch or
641 * change of link key was active and initiates or continues
642 * process if needed.
643 *
644 * Returns void
645 *
646 ******************************************************************************/
btm_acl_encrypt_change(uint16_t handle,uint8_t status,uint8_t encr_enable)647 void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
648 uint8_t encr_enable) {
649 tACL_CONN* p;
650 uint8_t xx;
651 tBTM_SEC_DEV_REC* p_dev_rec;
652
653 BTM_TRACE_DEBUG("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
654 handle, status, encr_enable);
655 xx = btm_handle_to_acl_index(handle);
656 /* don't assume that we can never get a bad hci_handle */
657 if (xx < MAX_L2CAP_LINKS)
658 p = &btm_cb.acl_db[xx];
659 else
660 return;
661
662 /* Process Role Switch if active */
663 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF) {
664 /* if encryption turn off failed we still will try to switch role */
665 if (encr_enable) {
666 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
667 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
668 } else {
669 p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
670 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
671 }
672
673 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
674 #if (BTM_DISC_DURING_RS == TRUE)
675 p_dev_rec = btm_find_dev(p->remote_addr);
676 if (p_dev_rec != NULL) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
677 #endif
678
679 }
680 /* Finished enabling Encryption after role switch */
681 else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON) {
682 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
683 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
684 btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status,
685 &p->remote_addr);
686
687 /* if role change event is registered, report it now */
688 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
689 tBTM_BL_ROLE_CHG_DATA evt;
690 evt.event = BTM_BL_ROLE_CHG_EVT;
691 evt.new_role = btm_cb.devcb.switch_role_ref_data.role;
692 evt.p_bda = &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
693 evt.hci_status = btm_cb.devcb.switch_role_ref_data.hci_status;
694 tBTM_BL_EVENT_DATA btm_bl_event_data;
695 btm_bl_event_data.role_chg = evt;
696 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
697
698 BTM_TRACE_DEBUG(
699 "%s: Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
700 __func__, evt.new_role, evt.hci_status, p->switch_role_state);
701 }
702
703 #if (BTM_DISC_DURING_RS == TRUE)
704 /* If a disconnect is pending, issue it now that role switch has completed
705 */
706 p_dev_rec = btm_find_dev(p->remote_addr);
707 if (p_dev_rec != NULL) {
708 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
709 BTM_TRACE_WARNING(
710 "btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
711 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
712 }
713 BTM_TRACE_ERROR(
714 "btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
715 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
716 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
717 }
718 #endif
719 }
720 }
721 /*******************************************************************************
722 *
723 * Function BTM_SetLinkPolicy
724 *
725 * Description Create and send HCI "Write Policy Set" command
726 *
727 * Returns status of the operation
728 *
729 ******************************************************************************/
BTM_SetLinkPolicy(const RawAddress & remote_bda,uint16_t * settings)730 tBTM_STATUS BTM_SetLinkPolicy(const RawAddress& remote_bda,
731 uint16_t* settings) {
732 tACL_CONN* p;
733 uint8_t* localFeatures = BTM_ReadLocalFeatures();
734 BTM_TRACE_DEBUG("%s", __func__);
735 /* BTM_TRACE_API ("%s: requested settings: 0x%04x", __func__, *settings ); */
736
737 /* First, check if hold mode is supported */
738 if (*settings != HCI_DISABLE_ALL_LM_MODES) {
739 if ((*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
740 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
741 *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
742 BTM_TRACE_API("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)",
743 *settings);
744 }
745 if ((*settings & HCI_ENABLE_HOLD_MODE) &&
746 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
747 *settings &= (~HCI_ENABLE_HOLD_MODE);
748 BTM_TRACE_API("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)",
749 *settings);
750 }
751 if ((*settings & HCI_ENABLE_SNIFF_MODE) &&
752 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
753 *settings &= (~HCI_ENABLE_SNIFF_MODE);
754 BTM_TRACE_API("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)",
755 *settings);
756 }
757 if ((*settings & HCI_ENABLE_PARK_MODE) &&
758 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
759 *settings &= (~HCI_ENABLE_PARK_MODE);
760 BTM_TRACE_API("BTM_SetLinkPolicy park not supported (settings: 0x%04x)",
761 *settings);
762 }
763 }
764
765 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
766 if (p != NULL) {
767 btsnd_hcic_write_policy_set(p->hci_handle, *settings);
768 return BTM_CMD_STARTED;
769 }
770
771 /* If here, no BD Addr found */
772 return (BTM_UNKNOWN_ADDR);
773 }
774
775 /*******************************************************************************
776 *
777 * Function BTM_SetDefaultLinkPolicy
778 *
779 * Description Set the default value for HCI "Write Policy Set" command
780 * to use when an ACL link is created.
781 *
782 * Returns void
783 *
784 ******************************************************************************/
BTM_SetDefaultLinkPolicy(uint16_t settings)785 void BTM_SetDefaultLinkPolicy(uint16_t settings) {
786 uint8_t* localFeatures = BTM_ReadLocalFeatures();
787
788 BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
789
790 if ((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
791 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
792 settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
793 BTM_TRACE_DEBUG(
794 "BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)",
795 settings);
796 }
797 if ((settings & HCI_ENABLE_HOLD_MODE) &&
798 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
799 settings &= ~HCI_ENABLE_HOLD_MODE;
800 BTM_TRACE_DEBUG(
801 "BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)",
802 settings);
803 }
804 if ((settings & HCI_ENABLE_SNIFF_MODE) &&
805 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
806 settings &= ~HCI_ENABLE_SNIFF_MODE;
807 BTM_TRACE_DEBUG(
808 "BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)",
809 settings);
810 }
811 if ((settings & HCI_ENABLE_PARK_MODE) &&
812 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
813 settings &= ~HCI_ENABLE_PARK_MODE;
814 BTM_TRACE_DEBUG(
815 "BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)",
816 settings);
817 }
818 BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
819
820 btm_cb.btm_def_link_policy = settings;
821
822 /* Set the default Link Policy of the controller */
823 btsnd_hcic_write_def_policy_set(settings);
824 }
825
btm_use_preferred_conn_params(const RawAddress & bda)826 void btm_use_preferred_conn_params(const RawAddress& bda) {
827 tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
828 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
829
830 /* If there are any preferred connection parameters, set them now */
831 if ((p_dev_rec->conn_params.min_conn_int >= BTM_BLE_CONN_INT_MIN) &&
832 (p_dev_rec->conn_params.min_conn_int <= BTM_BLE_CONN_INT_MAX) &&
833 (p_dev_rec->conn_params.max_conn_int >= BTM_BLE_CONN_INT_MIN) &&
834 (p_dev_rec->conn_params.max_conn_int <= BTM_BLE_CONN_INT_MAX) &&
835 (p_dev_rec->conn_params.slave_latency <= BTM_BLE_CONN_LATENCY_MAX) &&
836 (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
837 (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
838 ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
839 p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
840 (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
841 (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
842 (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout))) {
843 BTM_TRACE_DEBUG(
844 "%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d "
845 "supervision_tout=%d",
846 __func__, p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
847 p_dev_rec->conn_params.max_conn_int,
848 p_dev_rec->conn_params.slave_latency,
849 p_dev_rec->conn_params.supervision_tout);
850
851 p_lcb->min_interval = p_dev_rec->conn_params.min_conn_int;
852 p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
853 p_lcb->timeout = p_dev_rec->conn_params.supervision_tout;
854 p_lcb->latency = p_dev_rec->conn_params.slave_latency;
855
856 btsnd_hcic_ble_upd_ll_conn_params(
857 p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
858 p_dev_rec->conn_params.max_conn_int,
859 p_dev_rec->conn_params.slave_latency,
860 p_dev_rec->conn_params.supervision_tout, 0, 0);
861 }
862 }
863
864 /*******************************************************************************
865 *
866 * Function btm_read_remote_version_complete
867 *
868 * Description This function is called when the command complete message
869 * is received from the HCI for the remote version info.
870 *
871 * Returns void
872 *
873 ******************************************************************************/
btm_read_remote_version_complete(uint8_t * p)874 void btm_read_remote_version_complete(uint8_t* p) {
875 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
876 uint8_t status;
877 uint16_t handle;
878 int xx;
879 BTM_TRACE_DEBUG("btm_read_remote_version_complete");
880
881 STREAM_TO_UINT8(status, p);
882 STREAM_TO_UINT16(handle, p);
883
884 /* Look up the connection by handle and copy features */
885 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++) {
886 if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle)) {
887 if (status == HCI_SUCCESS) {
888 STREAM_TO_UINT8(p_acl_cb->lmp_version, p);
889 STREAM_TO_UINT16(p_acl_cb->manufacturer, p);
890 STREAM_TO_UINT16(p_acl_cb->lmp_subversion, p);
891
892 if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
893 btm_read_remote_features(p_acl_cb->hci_handle);
894 }
895 }
896
897 if (p_acl_cb->transport == BT_TRANSPORT_LE) {
898 l2cble_notify_le_connection(p_acl_cb->remote_addr);
899 btm_use_preferred_conn_params(p_acl_cb->remote_addr);
900 }
901 break;
902 }
903 }
904 }
905
906 /*******************************************************************************
907 *
908 * Function btm_process_remote_ext_features
909 *
910 * Description Local function called to process all extended features pages
911 * read from a remote device.
912 *
913 * Returns void
914 *
915 ******************************************************************************/
btm_process_remote_ext_features(tACL_CONN * p_acl_cb,uint8_t num_read_pages)916 void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
917 uint8_t num_read_pages) {
918 uint16_t handle = p_acl_cb->hci_handle;
919 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
920 uint8_t page_idx;
921
922 BTM_TRACE_DEBUG("btm_process_remote_ext_features");
923
924 /* Make sure we have the record to save remote features information */
925 if (p_dev_rec == NULL) {
926 /* Get a new device; might be doing dedicated bonding */
927 p_dev_rec = btm_find_or_alloc_dev(p_acl_cb->remote_addr);
928 }
929
930 p_acl_cb->num_read_pages = num_read_pages;
931 p_dev_rec->num_read_pages = num_read_pages;
932
933 /* Move the pages to placeholder */
934 for (page_idx = 0; page_idx < num_read_pages; page_idx++) {
935 if (page_idx > HCI_EXT_FEATURES_PAGE_MAX) {
936 BTM_TRACE_ERROR("%s: page=%d unexpected", __func__, page_idx);
937 break;
938 }
939 memcpy(p_dev_rec->feature_pages[page_idx],
940 p_acl_cb->peer_lmp_feature_pages[page_idx],
941 HCI_FEATURE_BYTES_PER_PAGE);
942 }
943
944 if (!(p_dev_rec->sec_flags & BTM_SEC_NAME_KNOWN) ||
945 p_dev_rec->is_originator) {
946 BTM_TRACE_DEBUG("%s: Calling Next Security Procedure", __func__);
947 uint8_t status = btm_sec_execute_procedure(p_dev_rec);
948 if (status != BTM_CMD_STARTED) {
949 BTM_TRACE_ERROR("%s: Security procedure not started! status %d", __func__,
950 status);
951 btm_sec_dev_rec_cback_event(p_dev_rec, status, false);
952 }
953 }
954 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
955
956 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
957 btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
958
959 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
960 if (req_pend) {
961 /* Request for remaining Security Features (if any) */
962 l2cu_resubmit_pending_sec_req(&p_dev_rec->bd_addr);
963 }
964 }
965
966 /*******************************************************************************
967 *
968 * Function btm_read_remote_features
969 *
970 * Description Local function called to send a read remote supported
971 * features/remote extended features page[0].
972 *
973 * Returns void
974 *
975 ******************************************************************************/
btm_read_remote_features(uint16_t handle)976 void btm_read_remote_features(uint16_t handle) {
977 uint8_t acl_idx;
978 tACL_CONN* p_acl_cb;
979
980 BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
981
982 acl_idx = btm_handle_to_acl_index(handle);
983 if (acl_idx >= MAX_L2CAP_LINKS) {
984 BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
985 return;
986 }
987
988 p_acl_cb = &btm_cb.acl_db[acl_idx];
989 p_acl_cb->num_read_pages = 0;
990 memset(p_acl_cb->peer_lmp_feature_pages, 0,
991 sizeof(p_acl_cb->peer_lmp_feature_pages));
992
993 /* first send read remote supported features HCI command */
994 /* because we don't know whether the remote support extended feature command
995 */
996 btsnd_hcic_rmt_features_req(handle);
997 }
998
999 /*******************************************************************************
1000 *
1001 * Function btm_read_remote_ext_features
1002 *
1003 * Description Local function called to send a read remote extended
1004 * features
1005 *
1006 * Returns void
1007 *
1008 ******************************************************************************/
btm_read_remote_ext_features(uint16_t handle,uint8_t page_number)1009 void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number) {
1010 BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle,
1011 page_number);
1012
1013 btsnd_hcic_rmt_ext_features(handle, page_number);
1014 }
1015
1016 /*******************************************************************************
1017 *
1018 * Function btm_read_remote_features_complete
1019 *
1020 * Description This function is called when the remote supported features
1021 * complete event is received from the HCI.
1022 *
1023 * Returns void
1024 *
1025 ******************************************************************************/
btm_read_remote_features_complete(uint8_t * p)1026 void btm_read_remote_features_complete(uint8_t* p) {
1027 tACL_CONN* p_acl_cb;
1028 uint8_t status;
1029 uint16_t handle;
1030 uint8_t acl_idx;
1031
1032 BTM_TRACE_DEBUG("btm_read_remote_features_complete");
1033 STREAM_TO_UINT8(status, p);
1034
1035 if (status != HCI_SUCCESS) {
1036 BTM_TRACE_ERROR("btm_read_remote_features_complete failed (status 0x%02x)",
1037 status);
1038 return;
1039 }
1040
1041 STREAM_TO_UINT16(handle, p);
1042
1043 acl_idx = btm_handle_to_acl_index(handle);
1044 if (acl_idx >= MAX_L2CAP_LINKS) {
1045 BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid",
1046 handle);
1047 return;
1048 }
1049
1050 p_acl_cb = &btm_cb.acl_db[acl_idx];
1051
1052 /* Copy the received features page */
1053 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[0], p,
1054 HCI_FEATURE_BYTES_PER_PAGE);
1055
1056 if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_feature_pages[0])) &&
1057 (controller_get_interface()
1058 ->supports_reading_remote_extended_features())) {
1059 /* if the remote controller has extended features and local controller
1060 supports HCI_Read_Remote_Extended_Features command then start reading
1061 these feature starting with extended features page 1 */
1062 BTM_TRACE_DEBUG("Start reading remote extended features");
1063 btm_read_remote_ext_features(handle, 1);
1064 return;
1065 }
1066
1067 /* Remote controller has no extended features. Process remote controller
1068 supported features (features page 0). */
1069 btm_process_remote_ext_features(p_acl_cb, 1);
1070
1071 /* Continue with HCI connection establishment */
1072 btm_establish_continue(p_acl_cb);
1073 }
1074
1075 /*******************************************************************************
1076 *
1077 * Function btm_read_remote_ext_features_complete
1078 *
1079 * Description This function is called when the remote extended features
1080 * complete event is received from the HCI.
1081 *
1082 * Returns void
1083 *
1084 ******************************************************************************/
btm_read_remote_ext_features_complete(uint8_t * p,uint8_t evt_len)1085 void btm_read_remote_ext_features_complete(uint8_t* p, uint8_t evt_len) {
1086 tACL_CONN* p_acl_cb;
1087 uint8_t page_num, max_page;
1088 uint16_t handle;
1089 uint8_t acl_idx;
1090
1091 BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
1092
1093 if (evt_len < HCI_EXT_FEATURES_SUCCESS_EVT_LEN) {
1094 android_errorWriteLog(0x534e4554, "141552859");
1095 BTM_TRACE_ERROR(
1096 "btm_read_remote_ext_features_complete evt length too short. length=%d",
1097 evt_len);
1098 return;
1099 }
1100
1101 ++p;
1102 STREAM_TO_UINT16(handle, p);
1103 STREAM_TO_UINT8(page_num, p);
1104 STREAM_TO_UINT8(max_page, p);
1105
1106 /* Validate parameters */
1107 acl_idx = btm_handle_to_acl_index(handle);
1108 if (acl_idx >= MAX_L2CAP_LINKS) {
1109 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid",
1110 handle);
1111 return;
1112 }
1113
1114 if (max_page > HCI_EXT_FEATURES_PAGE_MAX) {
1115 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown",
1116 max_page);
1117 return;
1118 }
1119
1120 if (page_num > HCI_EXT_FEATURES_PAGE_MAX) {
1121 android_errorWriteLog(0x534e4554, "141552859");
1122 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete num_page=%d invalid",
1123 page_num);
1124 return;
1125 }
1126
1127 if (page_num > max_page) {
1128 BTM_TRACE_WARNING(
1129 "btm_read_remote_ext_features_complete num_page=%d, max_page=%d "
1130 "invalid", page_num, max_page);
1131 }
1132
1133 p_acl_cb = &btm_cb.acl_db[acl_idx];
1134
1135 /* Copy the received features page */
1136 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[page_num], p,
1137 HCI_FEATURE_BYTES_PER_PAGE);
1138
1139 /* If there is the next remote features page and
1140 * we have space to keep this page data - read this page */
1141 if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX)) {
1142 page_num++;
1143 BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)",
1144 page_num);
1145 btm_read_remote_ext_features(handle, page_num);
1146 return;
1147 }
1148
1149 /* Reading of remote feature pages is complete */
1150 BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)",
1151 page_num);
1152
1153 /* Process the pages */
1154 btm_process_remote_ext_features(p_acl_cb, (uint8_t)(page_num + 1));
1155
1156 /* Continue with HCI connection establishment */
1157 btm_establish_continue(p_acl_cb);
1158 }
1159
1160 /*******************************************************************************
1161 *
1162 * Function btm_read_remote_ext_features_failed
1163 *
1164 * Description This function is called when the remote extended features
1165 * complete event returns a failed status.
1166 *
1167 * Returns void
1168 *
1169 ******************************************************************************/
btm_read_remote_ext_features_failed(uint8_t status,uint16_t handle)1170 void btm_read_remote_ext_features_failed(uint8_t status, uint16_t handle) {
1171 tACL_CONN* p_acl_cb;
1172 uint8_t acl_idx;
1173
1174 BTM_TRACE_WARNING(
1175 "btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1176 status, handle);
1177
1178 acl_idx = btm_handle_to_acl_index(handle);
1179 if (acl_idx >= MAX_L2CAP_LINKS) {
1180 BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid",
1181 handle);
1182 return;
1183 }
1184
1185 p_acl_cb = &btm_cb.acl_db[acl_idx];
1186
1187 /* Process supported features only */
1188 btm_process_remote_ext_features(p_acl_cb, 1);
1189
1190 /* Continue HCI connection establishment */
1191 btm_establish_continue(p_acl_cb);
1192 }
1193
1194 /*******************************************************************************
1195 *
1196 * Function btm_establish_continue
1197 *
1198 * Description This function is called when the command complete message
1199 * is received from the HCI for the read local link policy
1200 * request.
1201 *
1202 * Returns void
1203 *
1204 ******************************************************************************/
btm_establish_continue(tACL_CONN * p_acl_cb)1205 void btm_establish_continue(tACL_CONN* p_acl_cb) {
1206 tBTM_BL_EVENT_DATA evt_data;
1207 BTM_TRACE_DEBUG("btm_establish_continue");
1208 #if (BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1209 if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
1210 /* For now there are a some devices that do not like sending */
1211 /* commands events and data at the same time. */
1212 /* Set the packet types to the default allowed by the device */
1213 btm_set_packet_types(p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1214
1215 if (btm_cb.btm_def_link_policy)
1216 BTM_SetLinkPolicy(p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1217 }
1218 #endif
1219 if (p_acl_cb->link_up_issued) {
1220 BTM_TRACE_ERROR("%s: Already link is up ", __func__);
1221 return;
1222 }
1223 p_acl_cb->link_up_issued = true;
1224
1225 /* If anyone cares, tell him database changed */
1226 if (btm_cb.p_bl_changed_cb) {
1227 evt_data.event = BTM_BL_CONN_EVT;
1228 evt_data.conn.p_bda = &p_acl_cb->remote_addr;
1229 evt_data.conn.p_bdn = p_acl_cb->remote_name;
1230 evt_data.conn.p_dc = p_acl_cb->remote_dc;
1231 evt_data.conn.p_features = p_acl_cb->peer_lmp_feature_pages[0];
1232 evt_data.conn.handle = p_acl_cb->hci_handle;
1233 evt_data.conn.transport = p_acl_cb->transport;
1234
1235 (*btm_cb.p_bl_changed_cb)(&evt_data);
1236 }
1237 btm_acl_update_busy_level(BTM_BLI_ACL_UP_EVT);
1238 }
1239
1240 /*******************************************************************************
1241 *
1242 * Function BTM_SetDefaultLinkSuperTout
1243 *
1244 * Description Set the default value for HCI "Write Link Supervision
1245 * Timeout"
1246 * command to use when an ACL link is created.
1247 *
1248 * Returns void
1249 *
1250 ******************************************************************************/
BTM_SetDefaultLinkSuperTout(uint16_t timeout)1251 void BTM_SetDefaultLinkSuperTout(uint16_t timeout) {
1252 BTM_TRACE_DEBUG("BTM_SetDefaultLinkSuperTout");
1253 btm_cb.btm_def_link_super_tout = timeout;
1254 }
1255
1256 /*******************************************************************************
1257 *
1258 * Function BTM_GetLinkSuperTout
1259 *
1260 * Description Read the link supervision timeout value of the connection
1261 *
1262 * Returns status of the operation
1263 *
1264 ******************************************************************************/
BTM_GetLinkSuperTout(const RawAddress & remote_bda,uint16_t * p_timeout)1265 tBTM_STATUS BTM_GetLinkSuperTout(const RawAddress& remote_bda,
1266 uint16_t* p_timeout) {
1267 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1268
1269 BTM_TRACE_DEBUG("BTM_GetLinkSuperTout");
1270 if (p != (tACL_CONN*)NULL) {
1271 *p_timeout = p->link_super_tout;
1272 return (BTM_SUCCESS);
1273 }
1274 /* If here, no BD Addr found */
1275 return (BTM_UNKNOWN_ADDR);
1276 }
1277
1278 /*******************************************************************************
1279 *
1280 * Function BTM_SetLinkSuperTout
1281 *
1282 * Description Create and send HCI "Write Link Supervision Timeout" command
1283 *
1284 * Returns status of the operation
1285 *
1286 ******************************************************************************/
BTM_SetLinkSuperTout(const RawAddress & remote_bda,uint16_t timeout)1287 tBTM_STATUS BTM_SetLinkSuperTout(const RawAddress& remote_bda,
1288 uint16_t timeout) {
1289 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1290
1291 BTM_TRACE_DEBUG("BTM_SetLinkSuperTout");
1292 if (p != (tACL_CONN*)NULL) {
1293 p->link_super_tout = timeout;
1294
1295 /* Only send if current role is Master; 2.0 spec requires this */
1296 if (p->link_role == BTM_ROLE_MASTER) {
1297 btsnd_hcic_write_link_super_tout(LOCAL_BR_EDR_CONTROLLER_ID,
1298 p->hci_handle, timeout);
1299 return (BTM_CMD_STARTED);
1300 } else {
1301 return (BTM_SUCCESS);
1302 }
1303 }
1304
1305 /* If here, no BD Addr found */
1306 return (BTM_UNKNOWN_ADDR);
1307 }
1308
1309 /*******************************************************************************
1310 *
1311 * Function BTM_IsAclConnectionUp
1312 *
1313 * Description This function is called to check if an ACL connection exists
1314 * to a specific remote BD Address.
1315 *
1316 * Returns true if connection is up, else false.
1317 *
1318 ******************************************************************************/
BTM_IsAclConnectionUp(const RawAddress & remote_bda,tBT_TRANSPORT transport)1319 bool BTM_IsAclConnectionUp(const RawAddress& remote_bda,
1320 tBT_TRANSPORT transport) {
1321 tACL_CONN* p;
1322
1323 VLOG(2) << __func__ << " RemBdAddr: " << remote_bda;
1324
1325 p = btm_bda_to_acl(remote_bda, transport);
1326 if (p != (tACL_CONN*)NULL) {
1327 return (true);
1328 }
1329
1330 /* If here, no BD Addr found */
1331 return (false);
1332 }
1333
1334 /*******************************************************************************
1335 *
1336 * Function BTM_GetNumAclLinks
1337 *
1338 * Description This function is called to count the number of
1339 * ACL links that are active.
1340 *
1341 * Returns uint16_t Number of active ACL links
1342 *
1343 ******************************************************************************/
BTM_GetNumAclLinks(void)1344 uint16_t BTM_GetNumAclLinks(void) {
1345 uint16_t num_acl = 0;
1346
1347 for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i) {
1348 if (btm_cb.acl_db[i].in_use) ++num_acl;
1349 }
1350
1351 return num_acl;
1352 }
1353
1354 /*******************************************************************************
1355 *
1356 * Function btm_get_acl_disc_reason_code
1357 *
1358 * Description This function is called to get the disconnection reason code
1359 * returned by the HCI at disconnection complete event.
1360 *
1361 * Returns true if connection is up, else false.
1362 *
1363 ******************************************************************************/
btm_get_acl_disc_reason_code(void)1364 uint16_t btm_get_acl_disc_reason_code(void) {
1365 uint8_t res = btm_cb.acl_disc_reason;
1366 BTM_TRACE_DEBUG("btm_get_acl_disc_reason_code");
1367 return (res);
1368 }
1369
1370 /*******************************************************************************
1371 *
1372 * Function BTM_GetHCIConnHandle
1373 *
1374 * Description This function is called to get the handle for an ACL
1375 * connection to a specific remote BD Address.
1376 *
1377 * Returns the handle of the connection, or 0xFFFF if none.
1378 *
1379 ******************************************************************************/
BTM_GetHCIConnHandle(const RawAddress & remote_bda,tBT_TRANSPORT transport)1380 uint16_t BTM_GetHCIConnHandle(const RawAddress& remote_bda,
1381 tBT_TRANSPORT transport) {
1382 tACL_CONN* p;
1383 BTM_TRACE_DEBUG("BTM_GetHCIConnHandle");
1384 p = btm_bda_to_acl(remote_bda, transport);
1385 if (p != (tACL_CONN*)NULL) {
1386 return (p->hci_handle);
1387 }
1388
1389 /* If here, no BD Addr found */
1390 return (0xFFFF);
1391 }
1392
1393 /*******************************************************************************
1394 *
1395 * Function btm_process_clk_off_comp_evt
1396 *
1397 * Description This function is called when clock offset command completes.
1398 *
1399 * Input Parms hci_handle - connection handle associated with the change
1400 * clock offset
1401 *
1402 * Returns void
1403 *
1404 ******************************************************************************/
btm_process_clk_off_comp_evt(uint16_t hci_handle,uint16_t clock_offset)1405 void btm_process_clk_off_comp_evt(uint16_t hci_handle, uint16_t clock_offset) {
1406 uint8_t xx;
1407 BTM_TRACE_DEBUG("btm_process_clk_off_comp_evt");
1408 /* Look up the connection by handle and set the current mode */
1409 xx = btm_handle_to_acl_index(hci_handle);
1410 if (xx < MAX_L2CAP_LINKS) btm_cb.acl_db[xx].clock_offset = clock_offset;
1411 }
1412
1413 /*******************************************************************************
1414 *
1415 * Function btm_blacklist_role_change_device
1416 *
1417 * Description This function is used to blacklist the device if the role
1418 * switch fails for maximum number of times. It also removes
1419 * the device from the black list if the role switch succeeds.
1420 *
1421 * Input Parms bd_addr - remote BD addr
1422 * hci_status - role switch status
1423 *
1424 * Returns void
1425 *
1426 *******************************************************************************/
btm_blacklist_role_change_device(const RawAddress & bd_addr,uint8_t hci_status)1427 void btm_blacklist_role_change_device(const RawAddress& bd_addr,
1428 uint8_t hci_status) {
1429 tACL_CONN* p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
1430 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
1431
1432 if (!p || !p_dev_rec) {
1433 return;
1434 }
1435 if (hci_status == HCI_SUCCESS) {
1436 p->switch_role_failed_attempts = 0;
1437 return;
1438 }
1439
1440 /* check for carkits */
1441 const uint32_t cod_audio_device =
1442 (BTM_COD_SERVICE_AUDIO | BTM_COD_MAJOR_AUDIO) << 8;
1443 const uint32_t cod =
1444 ((p_dev_rec->dev_class[0] << 16) | (p_dev_rec->dev_class[1] << 8) |
1445 p_dev_rec->dev_class[2]) &
1446 0xffffff;
1447 if ((hci_status != HCI_SUCCESS) &&
1448 ((p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) ||
1449 (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)) &&
1450 ((cod & cod_audio_device) == cod_audio_device) &&
1451 (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr))) {
1452 p->switch_role_failed_attempts++;
1453 if (p->switch_role_failed_attempts == BTM_MAX_SW_ROLE_FAILED_ATTEMPTS) {
1454 BTM_TRACE_WARNING(
1455 "%s: Device %s blacklisted for role switching - "
1456 "multiple role switch failed attempts: %u",
1457 __func__, bd_addr.ToString().c_str(), p->switch_role_failed_attempts);
1458 interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH, &bd_addr, 3);
1459 }
1460 }
1461 }
1462
1463 /*******************************************************************************
1464 *
1465 * Function btm_acl_role_changed
1466 *
1467 * Description This function is called whan a link's master/slave role
1468 * change event or command status event (with error) is
1469 * received. It updates the link control block, and calls the
1470 * registered callback with status and role (if registered).
1471 *
1472 * Returns void
1473 *
1474 ******************************************************************************/
btm_acl_role_changed(uint8_t hci_status,const RawAddress * bd_addr,uint8_t new_role)1475 void btm_acl_role_changed(uint8_t hci_status, const RawAddress* bd_addr,
1476 uint8_t new_role) {
1477 const RawAddress* p_bda =
1478 (bd_addr) ? bd_addr : &btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1479 tACL_CONN* p = btm_bda_to_acl(*p_bda, BT_TRANSPORT_BR_EDR);
1480 tBTM_ROLE_SWITCH_CMPL* p_data = &btm_cb.devcb.switch_role_ref_data;
1481 tBTM_SEC_DEV_REC* p_dev_rec;
1482
1483 BTM_TRACE_DEBUG("%s: peer %s hci_status:0x%x new_role:%d", __func__,
1484 (p_bda != nullptr) ? bd_addr->ToString().c_str() : "nullptr",
1485 hci_status, new_role);
1486 /* Ignore any stray events */
1487 if (p == NULL) {
1488 /* it could be a failure */
1489 if (hci_status != HCI_SUCCESS)
1490 btm_acl_report_role_change(hci_status, bd_addr);
1491 return;
1492 }
1493
1494 p_data->hci_status = hci_status;
1495
1496 if (hci_status == HCI_SUCCESS) {
1497 p_data->role = new_role;
1498 p_data->remote_bd_addr = *p_bda;
1499
1500 /* Update cached value */
1501 p->link_role = new_role;
1502
1503 /* Reload LSTO: link supervision timeout is reset in the LM after a role
1504 * switch */
1505 if (new_role == BTM_ROLE_MASTER) {
1506 BTM_SetLinkSuperTout(p->remote_addr, p->link_super_tout);
1507 }
1508 } else {
1509 /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1510 new_role = p->link_role;
1511 }
1512
1513 /* Check if any SCO req is pending for role change */
1514 btm_sco_chk_pend_rolechange(p->hci_handle);
1515
1516 /* if switching state is switching we need to turn encryption on */
1517 /* if idle, we did not change encryption */
1518 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) {
1519 btsnd_hcic_set_conn_encrypt(p->hci_handle, true);
1520 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1521 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1522 return;
1523 }
1524
1525 /* Set the switch_role_state to IDLE since the reply received from HCI */
1526 /* regardless of its result either success or failed. */
1527 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS) {
1528 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1529 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1530 }
1531
1532 /* if role switch complete is needed, report it now */
1533 btm_acl_report_role_change(hci_status, bd_addr);
1534
1535 /* if role change event is registered, report it now */
1536 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
1537 tBTM_BL_ROLE_CHG_DATA evt;
1538 evt.event = BTM_BL_ROLE_CHG_EVT;
1539 evt.new_role = new_role;
1540 evt.p_bda = p_bda;
1541 evt.hci_status = hci_status;
1542 tBTM_BL_EVENT_DATA btm_bl_event_data;
1543 btm_bl_event_data.role_chg = evt;
1544 (*btm_cb.p_bl_changed_cb)(&btm_bl_event_data);
1545 }
1546
1547 BTM_TRACE_DEBUG(
1548 "%s: peer %s Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, "
1549 "rs_st:%d",
1550 __func__, (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr",
1551 p_data->role, p_data->hci_status, p->switch_role_state);
1552
1553 #if (BTM_DISC_DURING_RS == TRUE)
1554 /* If a disconnect is pending, issue it now that role switch has completed */
1555 p_dev_rec = btm_find_dev(*p_bda);
1556 if (p_dev_rec != NULL) {
1557 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
1558 BTM_TRACE_WARNING(
1559 "%s peer %s Issuing delayed HCI_Disconnect!!!", __func__,
1560 (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr");
1561 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1562 }
1563 BTM_TRACE_ERROR("%s: peer %s tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1564 __func__,
1565 (p_bda != nullptr) ? p_bda->ToString().c_str() : "nullptr",
1566 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1567 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
1568 }
1569
1570 #endif
1571 }
1572
1573 /*******************************************************************************
1574 *
1575 * Function BTM_AllocateSCN
1576 *
1577 * Description Look through the Server Channel Numbers for a free one.
1578 *
1579 * Returns Allocated SCN number or 0 if none.
1580 *
1581 ******************************************************************************/
1582
BTM_AllocateSCN(void)1583 uint8_t BTM_AllocateSCN(void) {
1584 uint8_t x;
1585 BTM_TRACE_DEBUG("BTM_AllocateSCN");
1586
1587 // stack reserves scn 1 for HFP, HSP we still do the correct way
1588 for (x = 1; x < BTM_MAX_SCN; x++) {
1589 if (!btm_cb.btm_scn[x]) {
1590 btm_cb.btm_scn[x] = true;
1591 return (x + 1);
1592 }
1593 }
1594
1595 return (0); /* No free ports */
1596 }
1597
1598 /*******************************************************************************
1599 *
1600 * Function BTM_TryAllocateSCN
1601 *
1602 * Description Try to allocate a fixed server channel
1603 *
1604 * Returns Returns true if server channel was available
1605 *
1606 ******************************************************************************/
1607
BTM_TryAllocateSCN(uint8_t scn)1608 bool BTM_TryAllocateSCN(uint8_t scn) {
1609 /* Make sure we don't exceed max port range.
1610 * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1611 */
1612 if ((scn >= BTM_MAX_SCN) || (scn == 1)) return false;
1613
1614 /* check if this port is available */
1615 if (!btm_cb.btm_scn[scn - 1]) {
1616 btm_cb.btm_scn[scn - 1] = true;
1617 return true;
1618 }
1619
1620 return (false); /* Port was busy */
1621 }
1622
1623 /*******************************************************************************
1624 *
1625 * Function BTM_FreeSCN
1626 *
1627 * Description Free the specified SCN.
1628 *
1629 * Returns true or false
1630 *
1631 ******************************************************************************/
BTM_FreeSCN(uint8_t scn)1632 bool BTM_FreeSCN(uint8_t scn) {
1633 BTM_TRACE_DEBUG("BTM_FreeSCN ");
1634 if (scn <= BTM_MAX_SCN) {
1635 btm_cb.btm_scn[scn - 1] = false;
1636 return (true);
1637 } else {
1638 return (false); /* Illegal SCN passed in */
1639 }
1640 }
1641
1642 /*******************************************************************************
1643 *
1644 * Function btm_set_packet_types
1645 *
1646 * Description This function sets the packet types used for a specific
1647 * ACL connection. It is called internally by btm_acl_created
1648 * or by an application/profile by BTM_SetPacketTypes.
1649 *
1650 * Returns status of the operation
1651 *
1652 ******************************************************************************/
btm_set_packet_types(tACL_CONN * p,uint16_t pkt_types)1653 tBTM_STATUS btm_set_packet_types(tACL_CONN* p, uint16_t pkt_types) {
1654 uint16_t temp_pkt_types;
1655 BTM_TRACE_DEBUG("btm_set_packet_types");
1656 /* Save in the ACL control blocks, types that we support */
1657 temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1658 btm_cb.btm_acl_pkt_types_supported);
1659
1660 /* OR in any exception packet types if at least 2.0 version of spec */
1661 temp_pkt_types |=
1662 ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1663 (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1664
1665 /* Exclude packet types not supported by the peer */
1666 btm_acl_chk_peer_pkt_type_support(p, &temp_pkt_types);
1667
1668 BTM_TRACE_DEBUG("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1669
1670 btsnd_hcic_change_conn_type(p->hci_handle, temp_pkt_types);
1671 p->pkt_types_mask = temp_pkt_types;
1672
1673 return (BTM_CMD_STARTED);
1674 }
1675
1676 /*******************************************************************************
1677 *
1678 * Function btm_get_max_packet_size
1679 *
1680 * Returns Returns maximum packet size that can be used for current
1681 * connection, 0 if connection is not established
1682 *
1683 ******************************************************************************/
btm_get_max_packet_size(const RawAddress & addr)1684 uint16_t btm_get_max_packet_size(const RawAddress& addr) {
1685 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1686 uint16_t pkt_types = 0;
1687 uint16_t pkt_size = 0;
1688 BTM_TRACE_DEBUG("btm_get_max_packet_size");
1689 if (p != NULL) {
1690 pkt_types = p->pkt_types_mask;
1691 } else {
1692 /* Special case for when info for the local device is requested */
1693 if (addr == *controller_get_interface()->get_address()) {
1694 pkt_types = btm_cb.btm_acl_pkt_types_supported;
1695 }
1696 }
1697
1698 if (pkt_types) {
1699 if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1700 pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1701 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1702 pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1703 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1704 pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1705 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1706 pkt_size = HCI_DH5_PACKET_SIZE;
1707 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1708 pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1709 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1710 pkt_size = HCI_DM5_PACKET_SIZE;
1711 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1712 pkt_size = HCI_DH3_PACKET_SIZE;
1713 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1714 pkt_size = HCI_DM3_PACKET_SIZE;
1715 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1716 pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1717 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1718 pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1719 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1720 pkt_size = HCI_DH1_PACKET_SIZE;
1721 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1722 pkt_size = HCI_DM1_PACKET_SIZE;
1723 }
1724
1725 return (pkt_size);
1726 }
1727
1728 /*******************************************************************************
1729 *
1730 * Function BTM_ReadRemoteVersion
1731 *
1732 * Returns If connected report peer device info
1733 *
1734 ******************************************************************************/
BTM_ReadRemoteVersion(const RawAddress & addr,uint8_t * lmp_version,uint16_t * manufacturer,uint16_t * lmp_sub_version)1735 tBTM_STATUS BTM_ReadRemoteVersion(const RawAddress& addr, uint8_t* lmp_version,
1736 uint16_t* manufacturer,
1737 uint16_t* lmp_sub_version) {
1738 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1739 BTM_TRACE_DEBUG("BTM_ReadRemoteVersion");
1740 if (p == NULL) return (BTM_UNKNOWN_ADDR);
1741
1742 if (lmp_version) *lmp_version = p->lmp_version;
1743
1744 if (manufacturer) *manufacturer = p->manufacturer;
1745
1746 if (lmp_sub_version) *lmp_sub_version = p->lmp_subversion;
1747
1748 return (BTM_SUCCESS);
1749 }
1750
1751 /*******************************************************************************
1752 *
1753 * Function BTM_ReadRemoteFeatures
1754 *
1755 * Returns pointer to the remote supported features mask (8 bytes)
1756 *
1757 ******************************************************************************/
BTM_ReadRemoteFeatures(const RawAddress & addr)1758 uint8_t* BTM_ReadRemoteFeatures(const RawAddress& addr) {
1759 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1760 BTM_TRACE_DEBUG("BTM_ReadRemoteFeatures");
1761 if (p == NULL) {
1762 return (NULL);
1763 }
1764
1765 return (p->peer_lmp_feature_pages[0]);
1766 }
1767
1768 /*******************************************************************************
1769 *
1770 * Function BTM_ReadRemoteExtendedFeatures
1771 *
1772 * Returns pointer to the remote extended features mask (8 bytes)
1773 * or NULL if bad page
1774 *
1775 ******************************************************************************/
BTM_ReadRemoteExtendedFeatures(const RawAddress & addr,uint8_t page_number)1776 uint8_t* BTM_ReadRemoteExtendedFeatures(const RawAddress& addr,
1777 uint8_t page_number) {
1778 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1779 BTM_TRACE_DEBUG("BTM_ReadRemoteExtendedFeatures");
1780 if (p == NULL) {
1781 return (NULL);
1782 }
1783
1784 if (page_number > HCI_EXT_FEATURES_PAGE_MAX) {
1785 BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown",
1786 page_number);
1787 return NULL;
1788 }
1789
1790 return (p->peer_lmp_feature_pages[page_number]);
1791 }
1792
1793 /*******************************************************************************
1794 *
1795 * Function BTM_ReadNumberRemoteFeaturesPages
1796 *
1797 * Returns number of features pages read from the remote device.
1798 *
1799 ******************************************************************************/
BTM_ReadNumberRemoteFeaturesPages(const RawAddress & addr)1800 uint8_t BTM_ReadNumberRemoteFeaturesPages(const RawAddress& addr) {
1801 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1802 BTM_TRACE_DEBUG("BTM_ReadNumberRemoteFeaturesPages");
1803 if (p == NULL) {
1804 return (0);
1805 }
1806
1807 return (p->num_read_pages);
1808 }
1809
1810 /*******************************************************************************
1811 *
1812 * Function BTM_ReadAllRemoteFeatures
1813 *
1814 * Returns pointer to all features of the remote (24 bytes).
1815 *
1816 ******************************************************************************/
BTM_ReadAllRemoteFeatures(const RawAddress & addr)1817 uint8_t* BTM_ReadAllRemoteFeatures(const RawAddress& addr) {
1818 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1819 BTM_TRACE_DEBUG("BTM_ReadAllRemoteFeatures");
1820 if (p == NULL) {
1821 return (NULL);
1822 }
1823
1824 return (p->peer_lmp_feature_pages[0]);
1825 }
1826
1827 /*******************************************************************************
1828 *
1829 * Function BTM_RegBusyLevelNotif
1830 *
1831 * Description This function is called to register a callback to receive
1832 * busy level change events.
1833 *
1834 * Returns BTM_SUCCESS if successfully registered, otherwise error
1835 *
1836 ******************************************************************************/
BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB * p_cb,uint8_t * p_level,tBTM_BL_EVENT_MASK evt_mask)1837 tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
1838 tBTM_BL_EVENT_MASK evt_mask) {
1839 BTM_TRACE_DEBUG("BTM_RegBusyLevelNotif");
1840 if (p_level) *p_level = btm_cb.busy_level;
1841
1842 btm_cb.bl_evt_mask = evt_mask;
1843
1844 if (!p_cb)
1845 btm_cb.p_bl_changed_cb = NULL;
1846 else if (btm_cb.p_bl_changed_cb)
1847 return (BTM_BUSY);
1848 else
1849 btm_cb.p_bl_changed_cb = p_cb;
1850
1851 return (BTM_SUCCESS);
1852 }
1853
1854 /*******************************************************************************
1855 *
1856 * Function BTM_SetQoS
1857 *
1858 * Description This function is called to setup QoS
1859 *
1860 * Returns status of the operation
1861 *
1862 ******************************************************************************/
BTM_SetQoS(const RawAddress & bd,FLOW_SPEC * p_flow,tBTM_CMPL_CB * p_cb)1863 tBTM_STATUS BTM_SetQoS(const RawAddress& bd, FLOW_SPEC* p_flow,
1864 tBTM_CMPL_CB* p_cb) {
1865 tACL_CONN* p = &btm_cb.acl_db[0];
1866
1867 VLOG(2) << __func__ << " BdAddr: " << bd;
1868
1869 /* If someone already waiting on the version, do not allow another */
1870 if (btm_cb.devcb.p_qos_setup_cmpl_cb) return (BTM_BUSY);
1871
1872 p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR);
1873 if (p != NULL) {
1874 btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
1875 alarm_set_on_mloop(btm_cb.devcb.qos_setup_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1876 btm_qos_setup_timeout, NULL);
1877
1878 btsnd_hcic_qos_setup(p->hci_handle, p_flow->qos_flags, p_flow->service_type,
1879 p_flow->token_rate, p_flow->peak_bandwidth,
1880 p_flow->latency, p_flow->delay_variation);
1881 return (BTM_CMD_STARTED);
1882 }
1883
1884 /* If here, no BD Addr found */
1885 return (BTM_UNKNOWN_ADDR);
1886 }
1887
1888 /*******************************************************************************
1889 *
1890 * Function btm_qos_setup_timeout
1891 *
1892 * Description Callback when QoS setup times out.
1893 *
1894 * Returns void
1895 *
1896 ******************************************************************************/
btm_qos_setup_timeout(UNUSED_ATTR void * data)1897 void btm_qos_setup_timeout(UNUSED_ATTR void* data) {
1898 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1899 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1900 if (p_cb) (*p_cb)((void*)NULL);
1901 }
1902
1903 /*******************************************************************************
1904 *
1905 * Function btm_qos_setup_complete
1906 *
1907 * Description This function is called when the command complete message
1908 * is received from the HCI for the qos setup request.
1909 *
1910 * Returns void
1911 *
1912 ******************************************************************************/
btm_qos_setup_complete(uint8_t status,uint16_t handle,FLOW_SPEC * p_flow)1913 void btm_qos_setup_complete(uint8_t status, uint16_t handle,
1914 FLOW_SPEC* p_flow) {
1915 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1916 tBTM_QOS_SETUP_CMPL qossu;
1917
1918 BTM_TRACE_DEBUG("%s", __func__);
1919 alarm_cancel(btm_cb.devcb.qos_setup_timer);
1920 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1921
1922 /* If there was a registered callback, call it */
1923 if (p_cb) {
1924 memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1925 qossu.status = status;
1926 qossu.handle = handle;
1927 if (p_flow != NULL) {
1928 qossu.flow.qos_flags = p_flow->qos_flags;
1929 qossu.flow.service_type = p_flow->service_type;
1930 qossu.flow.token_rate = p_flow->token_rate;
1931 qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1932 qossu.flow.latency = p_flow->latency;
1933 qossu.flow.delay_variation = p_flow->delay_variation;
1934 }
1935 BTM_TRACE_DEBUG("BTM: p_flow->delay_variation: 0x%02x",
1936 qossu.flow.delay_variation);
1937 (*p_cb)(&qossu);
1938 }
1939 }
1940
1941 /*******************************************************************************
1942 *
1943 * Function BTM_ReadRSSI
1944 *
1945 * Description This function is called to read the link policy settings.
1946 * The address of link policy results are returned in the
1947 * callback.
1948 * (tBTM_RSSI_RESULT)
1949 *
1950 * Returns BTM_CMD_STARTED if successfully initiated or error code
1951 *
1952 ******************************************************************************/
BTM_ReadRSSI(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1953 tBTM_STATUS BTM_ReadRSSI(const RawAddress& remote_bda, tBTM_CMPL_CB* p_cb) {
1954 tACL_CONN* p = NULL;
1955 tBT_DEVICE_TYPE dev_type;
1956 tBLE_ADDR_TYPE addr_type;
1957
1958 /* If someone already waiting on the version, do not allow another */
1959 if (btm_cb.devcb.p_rssi_cmpl_cb) return (BTM_BUSY);
1960
1961 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1962
1963 if (dev_type & BT_DEVICE_TYPE_BLE) {
1964 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_LE);
1965 }
1966
1967 if (p == NULL && dev_type & BT_DEVICE_TYPE_BREDR) {
1968 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1969 }
1970
1971 if (p) {
1972 btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
1973 alarm_set_on_mloop(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1974 btm_read_rssi_timeout, NULL);
1975
1976 btsnd_hcic_read_rssi(p->hci_handle);
1977 return (BTM_CMD_STARTED);
1978 }
1979
1980 /* If here, no BD Addr found */
1981 return (BTM_UNKNOWN_ADDR);
1982 }
1983
1984 /*******************************************************************************
1985 *
1986 * Function BTM_ReadFailedContactCounter
1987 *
1988 * Description This function is called to read the failed contact counter.
1989 * The result is returned in the callback.
1990 * (tBTM_FAILED_CONTACT_COUNTER_RESULT)
1991 *
1992 * Returns BTM_CMD_STARTED if successfully initiated or error code
1993 *
1994 ******************************************************************************/
BTM_ReadFailedContactCounter(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)1995 tBTM_STATUS BTM_ReadFailedContactCounter(const RawAddress& remote_bda,
1996 tBTM_CMPL_CB* p_cb) {
1997 tACL_CONN* p;
1998 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
1999 tBT_DEVICE_TYPE dev_type;
2000 tBLE_ADDR_TYPE addr_type;
2001
2002 /* If someone already waiting on the result, do not allow another */
2003 if (btm_cb.devcb.p_failed_contact_counter_cmpl_cb) return (BTM_BUSY);
2004
2005 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2006 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
2007
2008 p = btm_bda_to_acl(remote_bda, transport);
2009 if (p != (tACL_CONN*)NULL) {
2010 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = p_cb;
2011 alarm_set_on_mloop(btm_cb.devcb.read_failed_contact_counter_timer,
2012 BTM_DEV_REPLY_TIMEOUT_MS,
2013 btm_read_failed_contact_counter_timeout, NULL);
2014
2015 btsnd_hcic_read_failed_contact_counter(p->hci_handle);
2016 return (BTM_CMD_STARTED);
2017 }
2018
2019 /* If here, no BD Addr found */
2020 return (BTM_UNKNOWN_ADDR);
2021 }
2022
2023 /*******************************************************************************
2024 *
2025 * Function BTM_ReadAutomaticFlushTimeout
2026 *
2027 * Description This function is called to read the automatic flush timeout.
2028 * The result is returned in the callback.
2029 * (tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT)
2030 *
2031 * Returns BTM_CMD_STARTED if successfully initiated or error code
2032 *
2033 ******************************************************************************/
BTM_ReadAutomaticFlushTimeout(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)2034 tBTM_STATUS BTM_ReadAutomaticFlushTimeout(const RawAddress& remote_bda,
2035 tBTM_CMPL_CB* p_cb) {
2036 tACL_CONN* p;
2037 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2038 tBT_DEVICE_TYPE dev_type;
2039 tBLE_ADDR_TYPE addr_type;
2040
2041 /* If someone already waiting on the result, do not allow another */
2042 if (btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb) return (BTM_BUSY);
2043
2044 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2045 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
2046
2047 p = btm_bda_to_acl(remote_bda, transport);
2048 if (!p) return BTM_UNKNOWN_ADDR;
2049
2050 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = p_cb;
2051 alarm_set_on_mloop(btm_cb.devcb.read_automatic_flush_timeout_timer,
2052 BTM_DEV_REPLY_TIMEOUT_MS,
2053 btm_read_automatic_flush_timeout_timeout, nullptr);
2054
2055 btsnd_hcic_read_automatic_flush_timeout(p->hci_handle);
2056 return BTM_CMD_STARTED;
2057 }
2058
2059 /*******************************************************************************
2060 *
2061 * Function BTM_ReadLinkQuality
2062 *
2063 * Description This function is called to read the link qulaity.
2064 * The value of the link quality is returned in the callback.
2065 * (tBTM_LINK_QUALITY_RESULT)
2066 *
2067 * Returns BTM_CMD_STARTED if successfully initiated or error code
2068 *
2069 ******************************************************************************/
BTM_ReadLinkQuality(const RawAddress & remote_bda,tBTM_CMPL_CB * p_cb)2070 tBTM_STATUS BTM_ReadLinkQuality(const RawAddress& remote_bda,
2071 tBTM_CMPL_CB* p_cb) {
2072 VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
2073
2074 /* If someone already waiting on the version, do not allow another */
2075 if (btm_cb.devcb.p_link_qual_cmpl_cb) return (BTM_BUSY);
2076
2077 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
2078 if (p != (tACL_CONN*)NULL) {
2079 btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
2080 alarm_set_on_mloop(btm_cb.devcb.read_link_quality_timer,
2081 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_link_quality_timeout,
2082 NULL);
2083
2084 btsnd_hcic_get_link_quality(p->hci_handle);
2085 return (BTM_CMD_STARTED);
2086 }
2087
2088 /* If here, no BD Addr found */
2089 return (BTM_UNKNOWN_ADDR);
2090 }
2091
2092 /*******************************************************************************
2093 *
2094 * Function BTM_ReadTxPower
2095 *
2096 * Description This function is called to read the current
2097 * TX power of the connection. The tx power level results
2098 * are returned in the callback.
2099 * (tBTM_RSSI_RESULT)
2100 *
2101 * Returns BTM_CMD_STARTED if successfully initiated or error code
2102 *
2103 ******************************************************************************/
BTM_ReadTxPower(const RawAddress & remote_bda,tBT_TRANSPORT transport,tBTM_CMPL_CB * p_cb)2104 tBTM_STATUS BTM_ReadTxPower(const RawAddress& remote_bda,
2105 tBT_TRANSPORT transport, tBTM_CMPL_CB* p_cb) {
2106 tACL_CONN* p;
2107 #define BTM_READ_RSSI_TYPE_CUR 0x00
2108 #define BTM_READ_RSSI_TYPE_MAX 0X01
2109
2110 VLOG(2) << __func__ << ": RemBdAddr: " << remote_bda;
2111
2112 /* If someone already waiting on the version, do not allow another */
2113 if (btm_cb.devcb.p_tx_power_cmpl_cb) return (BTM_BUSY);
2114
2115 p = btm_bda_to_acl(remote_bda, transport);
2116 if (p != (tACL_CONN*)NULL) {
2117 btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2118 alarm_set_on_mloop(btm_cb.devcb.read_tx_power_timer,
2119 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_tx_power_timeout,
2120 NULL);
2121
2122 if (p->transport == BT_TRANSPORT_LE) {
2123 btm_cb.devcb.read_tx_pwr_addr = remote_bda;
2124 btsnd_hcic_ble_read_adv_chnl_tx_power();
2125 } else {
2126 btsnd_hcic_read_tx_power(p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2127 }
2128
2129 return (BTM_CMD_STARTED);
2130 }
2131
2132 /* If here, no BD Addr found */
2133 return (BTM_UNKNOWN_ADDR);
2134 }
2135
2136 /*******************************************************************************
2137 *
2138 * Function btm_read_tx_power_timeout
2139 *
2140 * Description Callback when reading the tx power times out.
2141 *
2142 * Returns void
2143 *
2144 ******************************************************************************/
btm_read_tx_power_timeout(UNUSED_ATTR void * data)2145 void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {
2146 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2147 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2148 if (p_cb) (*p_cb)((void*)NULL);
2149 }
2150
2151 /*******************************************************************************
2152 *
2153 * Function btm_read_tx_power_complete
2154 *
2155 * Description This function is called when the command complete message
2156 * is received from the HCI for the read tx power request.
2157 *
2158 * Returns void
2159 *
2160 ******************************************************************************/
btm_read_tx_power_complete(uint8_t * p,bool is_ble)2161 void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
2162 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2163 tBTM_TX_POWER_RESULT result;
2164 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2165
2166 BTM_TRACE_DEBUG("%s", __func__);
2167 alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2168 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2169
2170 /* If there was a registered callback, call it */
2171 if (p_cb) {
2172 STREAM_TO_UINT8(result.hci_status, p);
2173
2174 if (result.hci_status == HCI_SUCCESS) {
2175 result.status = BTM_SUCCESS;
2176
2177 if (!is_ble) {
2178 uint16_t handle;
2179 STREAM_TO_UINT16(handle, p);
2180 STREAM_TO_UINT8(result.tx_power, p);
2181
2182 /* Search through the list of active channels for the correct BD Addr */
2183 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2184 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2185 result.rem_bda = p_acl_cb->remote_addr;
2186 break;
2187 }
2188 }
2189 } else {
2190 STREAM_TO_UINT8(result.tx_power, p);
2191 result.rem_bda = btm_cb.devcb.read_tx_pwr_addr;
2192 }
2193 BTM_TRACE_DEBUG("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2194 result.tx_power, result.hci_status);
2195 } else {
2196 result.status = BTM_ERR_PROCESSING;
2197 }
2198
2199 (*p_cb)(&result);
2200 }
2201 }
2202
2203 /*******************************************************************************
2204 *
2205 * Function btm_read_rssi_timeout
2206 *
2207 * Description Callback when reading the RSSI times out.
2208 *
2209 * Returns void
2210 *
2211 ******************************************************************************/
btm_read_rssi_timeout(UNUSED_ATTR void * data)2212 void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
2213 tBTM_RSSI_RESULT result;
2214 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2215 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2216 result.status = BTM_DEVICE_TIMEOUT;
2217 if (p_cb) (*p_cb)(&result);
2218 }
2219
2220 /*******************************************************************************
2221 *
2222 * Function btm_read_rssi_complete
2223 *
2224 * Description This function is called when the command complete message
2225 * is received from the HCI for the read rssi request.
2226 *
2227 * Returns void
2228 *
2229 ******************************************************************************/
btm_read_rssi_complete(uint8_t * p)2230 void btm_read_rssi_complete(uint8_t* p) {
2231 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2232 tBTM_RSSI_RESULT result;
2233 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2234
2235 BTM_TRACE_DEBUG("%s", __func__);
2236 alarm_cancel(btm_cb.devcb.read_rssi_timer);
2237 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2238
2239 /* If there was a registered callback, call it */
2240 if (p_cb) {
2241 STREAM_TO_UINT8(result.hci_status, p);
2242
2243 if (result.hci_status == HCI_SUCCESS) {
2244 uint16_t handle;
2245 result.status = BTM_SUCCESS;
2246
2247 STREAM_TO_UINT16(handle, p);
2248
2249 STREAM_TO_UINT8(result.rssi, p);
2250 BTM_TRACE_DEBUG("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2251 result.rssi, result.hci_status);
2252
2253 /* Search through the list of active channels for the correct BD Addr */
2254 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2255 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2256 result.rem_bda = p_acl_cb->remote_addr;
2257 break;
2258 }
2259 }
2260 } else {
2261 result.status = BTM_ERR_PROCESSING;
2262 }
2263
2264 (*p_cb)(&result);
2265 }
2266 }
2267
2268 /*******************************************************************************
2269 *
2270 * Function btm_read_failed_contact_counter_timeout
2271 *
2272 * Description Callback when reading the failed contact counter times out.
2273 *
2274 * Returns void
2275 *
2276 ******************************************************************************/
btm_read_failed_contact_counter_timeout(UNUSED_ATTR void * data)2277 void btm_read_failed_contact_counter_timeout(UNUSED_ATTR void* data) {
2278 tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2279 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2280 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2281 result.status = BTM_DEVICE_TIMEOUT;
2282 if (p_cb) (*p_cb)(&result);
2283 }
2284
2285 /*******************************************************************************
2286 *
2287 * Function btm_read_failed_contact_counter_complete
2288 *
2289 * Description This function is called when the command complete message
2290 * is received from the HCI for the read failed contact
2291 * counter request.
2292 *
2293 * Returns void
2294 *
2295 ******************************************************************************/
btm_read_failed_contact_counter_complete(uint8_t * p)2296 void btm_read_failed_contact_counter_complete(uint8_t* p) {
2297 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_failed_contact_counter_cmpl_cb;
2298 tBTM_FAILED_CONTACT_COUNTER_RESULT result;
2299 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2300
2301 BTM_TRACE_DEBUG("%s", __func__);
2302 alarm_cancel(btm_cb.devcb.read_failed_contact_counter_timer);
2303 btm_cb.devcb.p_failed_contact_counter_cmpl_cb = NULL;
2304
2305 /* If there was a registered callback, call it */
2306 if (p_cb) {
2307 uint16_t handle;
2308 STREAM_TO_UINT8(result.hci_status, p);
2309
2310 if (result.hci_status == HCI_SUCCESS) {
2311 result.status = BTM_SUCCESS;
2312
2313 STREAM_TO_UINT16(handle, p);
2314
2315 STREAM_TO_UINT16(result.failed_contact_counter, p);
2316 BTM_TRACE_DEBUG(
2317 "BTM Failed Contact Counter Complete: counter %u, hci status 0x%02x",
2318 result.failed_contact_counter, result.hci_status);
2319
2320 /* Search through the list of active channels for the correct BD Addr */
2321 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2322 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2323 result.rem_bda = p_acl_cb->remote_addr;
2324 break;
2325 }
2326 }
2327 } else {
2328 result.status = BTM_ERR_PROCESSING;
2329 }
2330
2331 (*p_cb)(&result);
2332 }
2333 }
2334
2335 /*******************************************************************************
2336 *
2337 * Function btm_read_automatic_flush_timeout_timeout
2338 *
2339 * Description Callback when reading the automatic flush timeout times out.
2340 *
2341 * Returns void
2342 *
2343 ******************************************************************************/
btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void * data)2344 void btm_read_automatic_flush_timeout_timeout(UNUSED_ATTR void* data) {
2345 tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2346 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2347 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2348 result.status = BTM_DEVICE_TIMEOUT;
2349 if (p_cb) (*p_cb)(&result);
2350 }
2351
2352 /*******************************************************************************
2353 *
2354 * Function btm_read_automatic_flush_timeout_complete
2355 *
2356 * Description This function is called when the command complete message
2357 * is received from the HCI for the read automatic flush
2358 * timeout request.
2359 *
2360 * Returns void
2361 *
2362 ******************************************************************************/
btm_read_automatic_flush_timeout_complete(uint8_t * p)2363 void btm_read_automatic_flush_timeout_complete(uint8_t* p) {
2364 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb;
2365 tBTM_AUTOMATIC_FLUSH_TIMEOUT_RESULT result;
2366 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2367
2368 BTM_TRACE_DEBUG("%s", __func__);
2369 alarm_cancel(btm_cb.devcb.read_automatic_flush_timeout_timer);
2370 btm_cb.devcb.p_automatic_flush_timeout_cmpl_cb = nullptr;
2371
2372 /* If there was a registered callback, call it */
2373 if (p_cb) {
2374 uint16_t handle;
2375 STREAM_TO_UINT8(result.hci_status, p);
2376
2377 if (result.hci_status == HCI_SUCCESS) {
2378 result.status = BTM_SUCCESS;
2379
2380 STREAM_TO_UINT16(handle, p);
2381
2382 STREAM_TO_UINT16(result.automatic_flush_timeout, p);
2383 BTM_TRACE_DEBUG(
2384 "BTM Automatic Flush Timeout Complete: timeout %u, hci status 0x%02x",
2385 result.automatic_flush_timeout, result.hci_status);
2386
2387 /* Search through the list of active channels for the correct BD Addr */
2388 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2389 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2390 result.rem_bda = p_acl_cb->remote_addr;
2391 break;
2392 }
2393 }
2394 } else {
2395 result.status = BTM_ERR_PROCESSING;
2396 }
2397
2398 (*p_cb)(&result);
2399 }
2400 }
2401
2402 /*******************************************************************************
2403 *
2404 * Function btm_read_link_quality_timeout
2405 *
2406 * Description Callback when reading the link quality times out.
2407 *
2408 * Returns void
2409 *
2410 ******************************************************************************/
btm_read_link_quality_timeout(UNUSED_ATTR void * data)2411 void btm_read_link_quality_timeout(UNUSED_ATTR void* data) {
2412 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2413 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2414 if (p_cb) (*p_cb)((void*)NULL);
2415 }
2416
2417 /*******************************************************************************
2418 *
2419 * Function btm_read_link_quality_complete
2420 *
2421 * Description This function is called when the command complete message
2422 * is received from the HCI for the read link quality.
2423 *
2424 * Returns void
2425 *
2426 ******************************************************************************/
btm_read_link_quality_complete(uint8_t * p)2427 void btm_read_link_quality_complete(uint8_t* p) {
2428 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2429 tBTM_LINK_QUALITY_RESULT result;
2430 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2431
2432 BTM_TRACE_DEBUG("%s", __func__);
2433 alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2434 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2435
2436 /* If there was a registered callback, call it */
2437 if (p_cb) {
2438 STREAM_TO_UINT8(result.hci_status, p);
2439
2440 if (result.hci_status == HCI_SUCCESS) {
2441 uint16_t handle;
2442 result.status = BTM_SUCCESS;
2443
2444 STREAM_TO_UINT16(handle, p);
2445
2446 STREAM_TO_UINT8(result.link_quality, p);
2447 BTM_TRACE_DEBUG(
2448 "BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2449 result.link_quality, result.hci_status);
2450
2451 /* Search through the list of active channels for the correct BD Addr */
2452 for (uint16_t index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2453 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2454 result.rem_bda = p_acl_cb->remote_addr;
2455 break;
2456 }
2457 }
2458 } else {
2459 result.status = BTM_ERR_PROCESSING;
2460 }
2461
2462 (*p_cb)(&result);
2463 }
2464 }
2465
2466 /*******************************************************************************
2467 *
2468 * Function btm_remove_acl
2469 *
2470 * Description This function is called to disconnect an ACL connection
2471 *
2472 * Returns BTM_SUCCESS if successfully initiated, otherwise
2473 * BTM_NO_RESOURCES.
2474 *
2475 ******************************************************************************/
btm_remove_acl(const RawAddress & bd_addr,tBT_TRANSPORT transport)2476 tBTM_STATUS btm_remove_acl(const RawAddress& bd_addr, tBT_TRANSPORT transport) {
2477 uint16_t hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2478 tBTM_STATUS status = BTM_SUCCESS;
2479
2480 BTM_TRACE_DEBUG("btm_remove_acl");
2481 #if (BTM_DISC_DURING_RS == TRUE)
2482 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
2483
2484 /* Role Switch is pending, postpone until completed */
2485 if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING)) {
2486 p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2487 } else /* otherwise can disconnect right away */
2488 #endif
2489 {
2490 if (hci_handle != 0xFFFF && p_dev_rec &&
2491 p_dev_rec->sec_state != BTM_SEC_STATE_DISCONNECTING) {
2492 btsnd_hcic_disconnect(hci_handle, HCI_ERR_PEER_USER);
2493 } else {
2494 status = BTM_UNKNOWN_ADDR;
2495 }
2496 }
2497
2498 return status;
2499 }
2500
2501 /*******************************************************************************
2502 *
2503 * Function BTM_SetTraceLevel
2504 *
2505 * Description This function sets the trace level for BTM. If called with
2506 * a value of 0xFF, it simply returns the current trace level.
2507 *
2508 * Returns The new or current trace level
2509 *
2510 ******************************************************************************/
BTM_SetTraceLevel(uint8_t new_level)2511 uint8_t BTM_SetTraceLevel(uint8_t new_level) {
2512 BTM_TRACE_DEBUG("BTM_SetTraceLevel");
2513 if (new_level != 0xFF) btm_cb.trace_level = new_level;
2514
2515 return (btm_cb.trace_level);
2516 }
2517
2518 /*******************************************************************************
2519 *
2520 * Function btm_cont_rswitch
2521 *
2522 * Description This function is called to continue processing an active
2523 * role switch. It first disables encryption if enabled and
2524 * EPR is not supported
2525 *
2526 * Returns void
2527 *
2528 ******************************************************************************/
btm_cont_rswitch(tACL_CONN * p,tBTM_SEC_DEV_REC * p_dev_rec,uint8_t hci_status)2529 void btm_cont_rswitch(tACL_CONN* p, tBTM_SEC_DEV_REC* p_dev_rec,
2530 uint8_t hci_status) {
2531 BTM_TRACE_DEBUG("btm_cont_rswitch");
2532 /* Check to see if encryption needs to be turned off if pending
2533 change of link key or role switch */
2534 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2535 /* Must turn off Encryption first if necessary */
2536 /* Some devices do not support switch or change of link key while encryption
2537 * is on */
2538 if (p_dev_rec != NULL &&
2539 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
2540 !BTM_EPR_AVAILABLE(p)) {
2541 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
2542 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2543 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2544 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2545 } else /* Encryption not used or EPR supported, continue with switch
2546 and/or change of link key */
2547 {
2548 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2549 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2550 #if (BTM_DISC_DURING_RS == TRUE)
2551 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2552 #endif
2553 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
2554 }
2555 }
2556 }
2557 }
2558
2559 /*******************************************************************************
2560 *
2561 * Function btm_acl_resubmit_page
2562 *
2563 * Description send pending page request
2564 *
2565 ******************************************************************************/
btm_acl_resubmit_page(void)2566 void btm_acl_resubmit_page(void) {
2567 tBTM_SEC_DEV_REC* p_dev_rec;
2568 BT_HDR* p_buf;
2569 uint8_t* pp;
2570 BTM_TRACE_DEBUG("btm_acl_resubmit_page");
2571 /* If there were other page request schedule can start the next one */
2572 p_buf = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue);
2573 if (p_buf != NULL) {
2574 /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2575 * for both create_conn and rmt_name */
2576 pp = (uint8_t*)(p_buf + 1) + p_buf->offset + 3;
2577
2578 RawAddress bda;
2579 STREAM_TO_BDADDR(bda, pp);
2580
2581 p_dev_rec = btm_find_or_alloc_dev(bda);
2582
2583 btm_cb.connecting_bda = p_dev_rec->bd_addr;
2584 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2585
2586 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2587 } else {
2588 btm_cb.paging = false;
2589 }
2590 }
2591
2592 /*******************************************************************************
2593 *
2594 * Function btm_acl_reset_paging
2595 *
2596 * Description set paging to false and free the page queue - called at
2597 * hci_reset
2598 *
2599 ******************************************************************************/
btm_acl_reset_paging(void)2600 void btm_acl_reset_paging(void) {
2601 BT_HDR* p;
2602 BTM_TRACE_DEBUG("btm_acl_reset_paging");
2603 /* If we sent reset we are definitely not paging any more */
2604 while ((p = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2605 osi_free(p);
2606
2607 btm_cb.paging = false;
2608 }
2609
2610 /*******************************************************************************
2611 *
2612 * Function btm_acl_paging
2613 *
2614 * Description send a paging command or queue it in btm_cb
2615 *
2616 ******************************************************************************/
btm_acl_paging(BT_HDR * p,const RawAddress & bda)2617 void btm_acl_paging(BT_HDR* p, const RawAddress& bda) {
2618 tBTM_SEC_DEV_REC* p_dev_rec;
2619
2620 VLOG(2) << __func__ << ":" << btm_cb.discing << " , paging:" << btm_cb.paging
2621 << " BDA: " << bda;
2622
2623 if (btm_cb.discing) {
2624 btm_cb.paging = true;
2625 fixed_queue_enqueue(btm_cb.page_queue, p);
2626 } else {
2627 if (!BTM_ACL_IS_CONNECTED(bda)) {
2628 VLOG(1) << "connecting_bda: " << btm_cb.connecting_bda;
2629 if (btm_cb.paging && bda != btm_cb.connecting_bda) {
2630 fixed_queue_enqueue(btm_cb.page_queue, p);
2631 } else {
2632 p_dev_rec = btm_find_or_alloc_dev(bda);
2633 btm_cb.connecting_bda = p_dev_rec->bd_addr;
2634 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2635
2636 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2637 }
2638
2639 btm_cb.paging = true;
2640 } else /* ACL is already up */
2641 {
2642 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2643 }
2644 }
2645 }
2646
2647 /*******************************************************************************
2648 *
2649 * Function btm_acl_notif_conn_collision
2650 *
2651 * Description Send connection collision event to upper layer if registered
2652 *
2653 * Returns true if sent out to upper layer,
2654 * false if no one needs the notification.
2655 *
2656 ******************************************************************************/
btm_acl_notif_conn_collision(const RawAddress & bda)2657 bool btm_acl_notif_conn_collision(const RawAddress& bda) {
2658 /* Report possible collision to the upper layer. */
2659 if (btm_cb.p_bl_changed_cb) {
2660 VLOG(1) << __func__ << " RemBdAddr: " << bda;
2661
2662 tBTM_BL_EVENT_DATA evt_data;
2663 evt_data.event = BTM_BL_COLLISION_EVT;
2664 evt_data.conn.p_bda = &bda;
2665 evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2666 evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2667 (*btm_cb.p_bl_changed_cb)(&evt_data);
2668 return true;
2669 } else {
2670 return false;
2671 }
2672 }
2673
2674 /*******************************************************************************
2675 *
2676 * Function btm_acl_chk_peer_pkt_type_support
2677 *
2678 * Description Check if peer supports requested packets
2679 *
2680 ******************************************************************************/
btm_acl_chk_peer_pkt_type_support(tACL_CONN * p,uint16_t * p_pkt_type)2681 void btm_acl_chk_peer_pkt_type_support(tACL_CONN* p, uint16_t* p_pkt_type) {
2682 /* 3 and 5 slot packets? */
2683 if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2684 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 + BTM_ACL_PKT_TYPES_MASK_DM3);
2685
2686 if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2687 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2688
2689 /* 2 and 3 MPS support? */
2690 if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2691 /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2692 *p_pkt_type |=
2693 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2694 BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2695
2696 if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2697 /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2698 *p_pkt_type |=
2699 (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2700 BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2701
2702 /* EDR 3 and 5 slot support? */
2703 if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]) ||
2704 HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0])) {
2705 if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2706 /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types
2707 */
2708 *p_pkt_type |=
2709 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2710
2711 if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2712 /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types
2713 */
2714 *p_pkt_type |=
2715 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2716 }
2717 }
2718