stack/btm/btm_acl.c

   1 /******************************************************************************
   2  *
   3  *  Copyright (C) 2000-2012 Broadcom Corporation
   4  *
   5  *  Licensed under the Apache License, Version 2.0 (the "License");
   6  *  you may not use this file except in compliance with the License.
   7  *  You may obtain a copy of the License at:
   8  *
   9  *  http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  *  Unless required by applicable law or agreed to in writing, software
  12  *  distributed under the License is distributed on an "AS IS" BASIS,
  13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  *  See the License for the specific language governing permissions and
  15  *  limitations under the License.
  16  *
  17  ******************************************************************************/
  18
  19 /******************************************************************************
  20  *
  21  *  This file contains functions that handle ACL connections. This includes
  22  *  operations such as hold and sniff modes, supported packet types.
  23  *
  24  ******************************************************************************/
  25
  26 #include <stdlib.h>
  27 #include <string.h>
  28 #include <stdio.h>
  29 #include <stddef.h>
  30
  31 #include "bt_types.h"
  32 #include "bt_target.h"
  33 #include "controller.h"
  34 #include "gki.h"
  35 #include "hcimsgs.h"
  36 #include "btu.h"
  37 #include "btm_api.h"
  38 #include "btm_int.h"
  39 #include "l2c_int.h"
  40 #include "hcidefs.h"
  41 #include "bt_utils.h"
  42
  43 static void btm_read_remote_features (UINT16 handle);
  44 static void btm_read_remote_ext_features (UINT16 handle, UINT8 page_number);
  45 static void btm_process_remote_ext_features_page (tACL_CONN *p_acl_cb, tBTM_SEC_DEV_REC *p_dev_rec,
  46                                                   UINT8 page_idx);
  47 static void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages);
  48
  49 #define BTM_DEV_REPLY_TIMEOUT   3       /* 3 second timeout waiting for responses */
  50
  51 /*******************************************************************************
  52 **
  53 ** Function         btm_acl_init
  54 **
  55 ** Description      This function is called at BTM startup to initialize
  56 **
  57 ** Returns          void
  58 **
  59 *******************************************************************************/
  60 void btm_acl_init (void)
  61 {
  62     BTM_TRACE_DEBUG ("btm_acl_init");
  63 #if 0  /* cleared in btm_init; put back in if called from anywhere else! */
  64     memset (&btm_cb.acl_db, 0, sizeof (btm_cb.acl_db));
  65 #if RFCOMM_INCLUDED == TRUE
  66     memset (btm_cb.btm_scn, 0, BTM_MAX_SCN);          /* Initialize the SCN usage to FALSE */
  67 #endif
  68     btm_cb.btm_def_link_policy     = 0;
  69     btm_cb.p_bl_changed_cb         = NULL;
  70 #endif
  71
  72     /* Initialize nonzero defaults */
  73     btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
  74     btm_cb.acl_disc_reason         = 0xff ;
  75 }
  76
  77 /*******************************************************************************
  78 **
  79 ** Function         btm_bda_to_acl
  80 **
  81 ** Description      This function returns the FIRST acl_db entry for the passed BDA.
  82 **
  83 ** Parameters      bda : BD address of the remote device
  84 **                 transport : Physical transport used for ACL connection (BR/EDR or LE)
  85 **
  86 ** Returns          Returns pointer to the ACL DB for the requested BDA if found.
  87 **                  NULL if not found.
  88 **
  89 *******************************************************************************/
  90 tACL_CONN *btm_bda_to_acl (BD_ADDR bda, tBT_TRANSPORT transport)
  91 {
  92     tACL_CONN   *p = &btm_cb.acl_db[0];
  93     UINT16       xx;
  94     if (bda)
  95     {
  96         for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
  97         {
  98             if ((p->in_use) && (!memcmp (p->remote_addr, bda, BD_ADDR_LEN))
  99 #if BLE_INCLUDED == TRUE
 100                 && p->transport == transport
 101 #endif
 102                 )
 103             {
 104                 BTM_TRACE_DEBUG ("btm_bda_to_acl found");
 105                 return(p);
 106             }
 107         }
 108     }
 109
 110     /* If here, no BD Addr found */
 111     return((tACL_CONN *)NULL);
 112 }
 113
 114 /*******************************************************************************
 115 **
 116 ** Function         btm_handle_to_acl_index
 117 **
 118 ** Description      This function returns the FIRST acl_db entry for the passed hci_handle.
 119 **
 120 ** Returns          index to the acl_db or MAX_L2CAP_LINKS.
 121 **
 122 *******************************************************************************/
 123 UINT8 btm_handle_to_acl_index (UINT16 hci_handle)
 124 {
 125     tACL_CONN   *p = &btm_cb.acl_db[0];
 126     UINT8       xx;
 127     BTM_TRACE_DEBUG ("btm_handle_to_acl_index");
 128     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
 129     {
 130         if ((p->in_use) && (p->hci_handle == hci_handle))
 131         {
 132             break;
 133         }
 134     }
 135
 136     /* If here, no BD Addr found */
 137     return(xx);
 138 }
 139
 140 #if BLE_PRIVACY_SPT == TRUE
 141 /*******************************************************************************
 142 **
 143 ** Function         btm_ble_get_acl_remote_addr
 144 **
 145 ** Description      This function reads the active remote address used for the
 146 **                  connection.
 147 **
 148 ** Returns          success return TRUE, otherwise FALSE.
 149 **
 150 *******************************************************************************/
 151 BOOLEAN btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC *p_dev_rec, BD_ADDR conn_addr,
 152                                     tBLE_ADDR_TYPE *p_addr_type)
 153 {
 154 #if BLE_INCLUDED == TRUE
 155     BOOLEAN         st = TRUE;
 156
 157     if (p_dev_rec == NULL)
 158     {
 159         BTM_TRACE_ERROR("btm_ble_get_acl_remote_addr can not find device with matching address");
 160         return FALSE;
 161     }
 162
 163     switch (p_dev_rec->ble.active_addr_type)
 164     {
 165     case BTM_BLE_ADDR_PSEUDO:
 166         memcpy(conn_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
 167         * p_addr_type = p_dev_rec->ble.ble_addr_type;
 168         break;
 169
 170     case BTM_BLE_ADDR_RRA:
 171         memcpy(conn_addr, p_dev_rec->ble.cur_rand_addr, BD_ADDR_LEN);
 172         * p_addr_type = BLE_ADDR_RANDOM;
 173         break;
 174
 175     case BTM_BLE_ADDR_STATIC:
 176         memcpy(conn_addr, p_dev_rec->ble.static_addr, BD_ADDR_LEN);
 177         * p_addr_type = p_dev_rec->ble.static_addr_type;
 178         break;
 179
 180     default:
 181         BTM_TRACE_ERROR("Unknown active address: %d", p_dev_rec->ble.active_addr_type);
 182         st = FALSE;
 183         break;
 184     }
 185
 186     return st;
 187 #else
 188     UNUSED(p_dev_rec);
 189     UNUSED(conn_addr);
 190     UNUSED(p_addr_type);
 191     return FALSE;
 192 #endif
 193 }
 194 #endif
 195 /*******************************************************************************
 196 **
 197 ** Function         btm_acl_created
 198 **
 199 ** Description      This function is called by L2CAP when an ACL connection
 200 **                  is created.
 201 **
 202 ** Returns          void
 203 **
 204 *******************************************************************************/
 205 void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
 206                       UINT16 hci_handle, UINT8 link_role, tBT_TRANSPORT transport)
 207 {
 208     tBTM_SEC_DEV_REC *p_dev_rec = NULL;
 209     UINT8             yy;
 210     tACL_CONN        *p;
 211     UINT8             xx;
 212
 213     BTM_TRACE_DEBUG ("btm_acl_created hci_handle=%d link_role=%d  transport=%d",
 214                       hci_handle,link_role, transport);
 215     /* Ensure we don't have duplicates */
 216     p = btm_bda_to_acl(bda, transport);
 217     if (p != (tACL_CONN *)NULL)
 218     {
 219         p->hci_handle = hci_handle;
 220         p->link_role  = link_role;
 221 #if BLE_INCLUDED == TRUE
 222         p->transport = transport;
 223 #endif
 224         BTM_TRACE_DEBUG ("Duplicate btm_acl_created: RemBdAddr: %02x%02x%02x%02x%02x%02x",
 225                           bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
 226         BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
 227         return;
 228     }
 229
 230     /* Allocate acl_db entry */
 231     for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++)
 232     {
 233         if (!p->in_use)
 234         {
 235             p->in_use            = TRUE;
 236             p->hci_handle        = hci_handle;
 237             p->link_role         = link_role;
 238             p->link_up_issued    = FALSE;
 239
 240 #if BLE_INCLUDED == TRUE
 241             p->transport = transport;
 242             if (transport == BT_TRANSPORT_LE)
 243             {
 244 #if BLE_PRIVACY_SPT == TRUE
 245                 if (btm_cb.ble_ctr_cb.privacy)
 246                 {
 247                     p->conn_addr_type = btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type;
 248                     memcpy(p->conn_addr, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr, BD_ADDR_LEN);
 249                 }
 250                 else
 251 #endif
 252                 {
 253                     p->conn_addr_type = BLE_ADDR_PUBLIC;
 254                     memcpy(p->conn_addr, controller_get_interface()->get_address()->address, BD_ADDR_LEN);
 255                 }
 256             }
 257 #endif
 258             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 259
 260             btm_pm_sm_alloc(xx);
 261
 262             memcpy (p->remote_addr, bda, BD_ADDR_LEN);
 263
 264             if (dc)
 265                 memcpy (p->remote_dc, dc, DEV_CLASS_LEN);
 266
 267             if (bdn)
 268                 memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
 269
 270             /* if BR/EDR do something more */
 271             if (transport == BT_TRANSPORT_BR_EDR)
 272             {
 273                 btsnd_hcic_read_rmt_clk_offset (p->hci_handle);
 274                 btsnd_hcic_rmt_ver_req (p->hci_handle);
 275             }
 276             p_dev_rec = btm_find_dev_by_handle (hci_handle);
 277
 278 #if (BLE_INCLUDED == TRUE)
 279             if (p_dev_rec )
 280             {
 281                 BTM_TRACE_DEBUG ("device_type=0x%x", p_dev_rec->device_type);
 282             }
 283 #endif
 284
 285             if (p_dev_rec && !(transport == BT_TRANSPORT_LE))
 286             {
 287                 /* If remote features already known, copy them and continue connection setup */
 288                 if ((p_dev_rec->num_read_pages) &&
 289                     (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1)) /* sanity check */)
 290                 {
 291                     memcpy (p->peer_lmp_features, p_dev_rec->features,
 292                         (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
 293                     p->num_read_pages = p_dev_rec->num_read_pages;
 294
 295                     if (BTM_SEC_MODE_SP == btm_cb.security_mode
 296                         && HCI_SSP_HOST_SUPPORTED(p_dev_rec->features[HCI_EXT_FEATURES_PAGE_1])
 297                         && HCI_SIMPLE_PAIRING_SUPPORTED(p_dev_rec->features[HCI_EXT_FEATURES_PAGE_0]))
 298                     {
 299                         p_dev_rec->sm4 = BTM_SM4_TRUE;
 300                     }
 301                     else
 302                     {
 303                         p_dev_rec->sm4 |= BTM_SM4_KNOWN;
 304                     }
 305
 306                     btm_establish_continue (p);
 307                     return;
 308                 }
 309             }
 310
 311 #if (BLE_INCLUDED == TRUE)
 312             /* If here, features are not known yet */
 313             if (p_dev_rec && transport == BT_TRANSPORT_LE)
 314             {
 315 #if BLE_PRIVACY_SPT == TRUE
 316                 btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr,
 317                     &p->active_remote_addr_type);
 318 #endif
 319
 320                 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
 321                     || link_role == HCI_ROLE_MASTER)
 322                 {
 323                     btsnd_hcic_ble_read_remote_feat(p->hci_handle);
 324                 }
 325                 else
 326                 {
 327                     btm_establish_continue(p);
 328                 }
 329             }
 330             else
 331 #endif
 332             {
 333                 btm_read_remote_features (p->hci_handle);
 334             }
 335
 336             /* read page 1 - on rmt feature event for buffer reasons */
 337             return;
 338         }
 339     }
 340 }
 341
 342
 343 /*******************************************************************************
 344 **
 345 ** Function         btm_acl_report_role_change
 346 **
 347 ** Description      This function is called when the local device is deemed
 348 **                  to be down. It notifies L2CAP of the failure.
 349 **
 350 ** Returns          void
 351 **
 352 *******************************************************************************/
 353 void btm_acl_report_role_change (UINT8 hci_status, BD_ADDR bda)
 354 {
 355     tBTM_ROLE_SWITCH_CMPL   ref_data;
 356     BTM_TRACE_DEBUG ("btm_acl_report_role_change");
 357     if (btm_cb.devcb.p_switch_role_cb
 358         && (bda && (0 == memcmp(btm_cb.devcb.switch_role_ref_data.remote_bd_addr, bda, BD_ADDR_LEN))))
 359     {
 360         memcpy (&ref_data, &btm_cb.devcb.switch_role_ref_data, sizeof(tBTM_ROLE_SWITCH_CMPL));
 361         ref_data.hci_status = hci_status;
 362         (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
 363         memset (&btm_cb.devcb.switch_role_ref_data, 0, sizeof(tBTM_ROLE_SWITCH_CMPL));
 364         btm_cb.devcb.p_switch_role_cb = NULL;
 365     }
 366 }
 367
 368 /*******************************************************************************
 369 **
 370 ** Function         btm_acl_removed
 371 **
 372 ** Description      This function is called by L2CAP when an ACL connection
 373 **                  is removed. Since only L2CAP creates ACL links, we use
 374 **                  the L2CAP link index as our index into the control blocks.
 375 **
 376 ** Returns          void
 377 **
 378 *******************************************************************************/
 379 void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport)
 380 {
 381     tACL_CONN   *p;
 382     tBTM_BL_EVENT_DATA  evt_data;
 383 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
 384     tBTM_SEC_DEV_REC *p_dev_rec=NULL;
 385 #endif
 386     BTM_TRACE_DEBUG ("btm_acl_removed");
 387     p = btm_bda_to_acl(bda, transport);
 388     if (p != (tACL_CONN *)NULL)
 389     {
 390         p->in_use = FALSE;
 391
 392         /* if the disconnected channel has a pending role switch, clear it now */
 393         btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, bda);
 394
 395         /* Only notify if link up has had a chance to be issued */
 396         if (p->link_up_issued)
 397         {
 398             p->link_up_issued = FALSE;
 399
 400             /* If anyone cares, tell him database changed */
 401             if (btm_cb.p_bl_changed_cb)
 402             {
 403                 evt_data.event = BTM_BL_DISCN_EVT;
 404                 evt_data.discn.p_bda = bda;
 405 #if BLE_INCLUDED == TRUE
 406                 evt_data.discn.handle = p->hci_handle;
 407                 evt_data.discn.transport = p->transport;
 408 #endif
 409                 (*btm_cb.p_bl_changed_cb)(&evt_data);
 410             }
 411
 412             btm_acl_update_busy_level (BTM_BLI_ACL_DOWN_EVT);
 413         }
 414
 415 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
 416
 417         BTM_TRACE_DEBUG ("acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
 418                           p->hci_handle,
 419                           p->transport,
 420                           btm_cb.ble_ctr_cb.inq_var.connectable_mode,
 421                           p->link_role);
 422
 423         p_dev_rec = btm_find_dev(bda);
 424         if ( p_dev_rec)
 425         {
 426             BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
 427             if (p->transport == BT_TRANSPORT_LE)
 428             {
 429                 BTM_TRACE_DEBUG("LE link down");
 430                 p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
 431                 if ( (p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0)
 432                 {
 433                     BTM_TRACE_DEBUG("Not Bonded");
 434                     p_dev_rec->sec_flags &= ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
 435                 }
 436                 else
 437                 {
 438                     BTM_TRACE_DEBUG("Bonded");
 439                 }
 440             }
 441             else
 442             {
 443                 BTM_TRACE_DEBUG("Bletooth link down");
 444                 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED
 445                                         | BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
 446             }
 447             BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
 448         }
 449         else
 450         {
 451             BTM_TRACE_ERROR("Device not found");
 452
 453         }
 454 #endif
 455
 456         return;
 457     }
 458 }
 459
 460
 461 /*******************************************************************************
 462 **
 463 ** Function         btm_acl_device_down
 464 **
 465 ** Description      This function is called when the local device is deemed
 466 **                  to be down. It notifies L2CAP of the failure.
 467 **
 468 ** Returns          void
 469 **
 470 *******************************************************************************/
 471 void btm_acl_device_down (void)
 472 {
 473     tACL_CONN   *p = &btm_cb.acl_db[0];
 474     UINT16      xx;
 475     BTM_TRACE_DEBUG ("btm_acl_device_down");
 476     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
 477     {
 478         if (p->in_use)
 479         {
 480             BTM_TRACE_DEBUG ("hci_handle=%d HCI_ERR_HW_FAILURE ",p->hci_handle );
 481             l2c_link_hci_disc_comp (p->hci_handle, HCI_ERR_HW_FAILURE);
 482         }
 483     }
 484 }
 485
 486 /*******************************************************************************
 487 **
 488 ** Function         btm_acl_update_busy_level
 489 **
 490 ** Description      This function is called to update the busy level of the system
 491 **                  .
 492 **
 493 ** Returns          void
 494 **
 495 *******************************************************************************/
 496 void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
 497 {
 498     tBTM_BL_UPDATE_DATA  evt;
 499     UINT8 busy_level;
 500     BTM_TRACE_DEBUG ("btm_acl_update_busy_level");
 501     BOOLEAN old_inquiry_state = btm_cb.is_inquiry;
 502     switch (event)
 503     {
 504         case BTM_BLI_ACL_UP_EVT:
 505             BTM_TRACE_DEBUG ("BTM_BLI_ACL_UP_EVT");
 506             btm_cb.num_acl++;
 507             break;
 508         case BTM_BLI_ACL_DOWN_EVT:
 509             if (btm_cb.num_acl)
 510             {
 511                 btm_cb.num_acl--;
 512                 BTM_TRACE_DEBUG ("BTM_BLI_ACL_DOWN_EVT", btm_cb.num_acl);
 513             }
 514             else
 515             {
 516                 BTM_TRACE_ERROR ("BTM_BLI_ACL_DOWN_EVT issued, but num_acl already zero !!!");
 517             }
 518             break;
 519         case BTM_BLI_PAGE_EVT:
 520             BTM_TRACE_DEBUG ("BTM_BLI_PAGE_EVT");
 521             btm_cb.is_paging = TRUE;
 522             evt.busy_level_flags= BTM_BL_PAGING_STARTED;
 523             break;
 524         case BTM_BLI_PAGE_DONE_EVT:
 525             BTM_TRACE_DEBUG ("BTM_BLI_PAGE_DONE_EVT");
 526             btm_cb.is_paging = FALSE;
 527             evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
 528             break;
 529         case BTM_BLI_INQ_EVT:
 530             BTM_TRACE_DEBUG ("BTM_BLI_INQ_EVT");
 531             btm_cb.is_inquiry = TRUE;
 532             evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
 533             break;
 534         case BTM_BLI_INQ_CANCEL_EVT:
 535             BTM_TRACE_DEBUG ("BTM_BLI_INQ_CANCEL_EVT");
 536             btm_cb.is_inquiry = FALSE;
 537             evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
 538             break;
 539         case BTM_BLI_INQ_DONE_EVT:
 540             BTM_TRACE_DEBUG ("BTM_BLI_INQ_DONE_EVT");
 541             btm_cb.is_inquiry = FALSE;
 542             evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
 543             break;
 544     }
 545
 546     if (btm_cb.is_paging || btm_cb.is_inquiry)
 547         busy_level = 10;
 548     else
 549         busy_level = (UINT8)btm_cb.num_acl;
 550
 551     if ((busy_level != btm_cb.busy_level) ||(old_inquiry_state != btm_cb.is_inquiry))
 552     {
 553         evt.event         = BTM_BL_UPDATE_EVT;
 554         evt.busy_level    = busy_level;
 555         btm_cb.busy_level = busy_level;
 556         if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK))
 557         {
 558             (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
 559         }
 560     }
 561 }
 562
 563 /*******************************************************************************
 564 **
 565 ** Function         BTM_GetRole
 566 **
 567 ** Description      This function is called to get the role of the local device
 568 **                  for the ACL connection with the specified remote device
 569 **
 570 ** Returns          BTM_SUCCESS if connection exists.
 571 **                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
 572 **
 573 *******************************************************************************/
 574 tBTM_STATUS BTM_GetRole (BD_ADDR remote_bd_addr, UINT8 *p_role)
 575 {
 576     tACL_CONN   *p;
 577     BTM_TRACE_DEBUG ("BTM_GetRole");
 578     if ((p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
 579     {
 580         *p_role = BTM_ROLE_UNDEFINED;
 581         return(BTM_UNKNOWN_ADDR);
 582     }
 583
 584     /* Get the current role */
 585     *p_role = p->link_role;
 586     return(BTM_SUCCESS);
 587 }
 588
 589
 590 /*******************************************************************************
 591 **
 592 ** Function         BTM_SwitchRole
 593 **
 594 ** Description      This function is called to switch role between master and
 595 **                  slave.  If role is already set it will do nothing.  If the
 596 **                  command was initiated, the callback function is called upon
 597 **                  completion.
 598 **
 599 ** Returns          BTM_SUCCESS if already in specified role.
 600 **                  BTM_CMD_STARTED if command issued to controller.
 601 **                  BTM_NO_RESOURCES if couldn't allocate memory to issue command
 602 **                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
 603 **                  BTM_MODE_UNSUPPORTED if local device does not support role switching
 604 **                  BTM_BUSY if the previous command is not completed
 605 **
 606 *******************************************************************************/
 607 tBTM_STATUS BTM_SwitchRole (BD_ADDR remote_bd_addr, UINT8 new_role, tBTM_CMPL_CB *p_cb)
 608 {
 609     tACL_CONN   *p;
 610     tBTM_SEC_DEV_REC  *p_dev_rec = NULL;
 611 #if BTM_SCO_INCLUDED == TRUE
 612     BOOLEAN    is_sco_active;
 613 #endif
 614     tBTM_STATUS  status;
 615     tBTM_PM_MODE pwr_mode;
 616     tBTM_PM_PWR_MD settings;
 617 #if (BT_USE_TRACES == TRUE)
 618     BD_ADDR_PTR  p_bda;
 619 #endif
 620     BTM_TRACE_API ("BTM_SwitchRole BDA: %02x-%02x-%02x-%02x-%02x-%02x",
 621                     remote_bd_addr[0], remote_bd_addr[1], remote_bd_addr[2],
 622                     remote_bd_addr[3], remote_bd_addr[4], remote_bd_addr[5]);
 623
 624     /* Make sure the local device supports switching */
 625     if (!controller_get_interface()->supports_master_slave_role_switch())
 626         return(BTM_MODE_UNSUPPORTED);
 627
 628     if (btm_cb.devcb.p_switch_role_cb && p_cb)
 629     {
 630 #if (BT_USE_TRACES == TRUE)
 631         p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
 632         BTM_TRACE_DEBUG ("Role switch on other device is in progress 0x%02x%02x%02x%02x%02x%02x",
 633                           p_bda[0], p_bda[1], p_bda[2],
 634                           p_bda[3], p_bda[4], p_bda[5]);
 635 #endif
 636         return(BTM_BUSY);
 637     }
 638
 639     if ((p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
 640         return(BTM_UNKNOWN_ADDR);
 641
 642     /* Finished if already in desired role */
 643     if (p->link_role == new_role)
 644         return(BTM_SUCCESS);
 645
 646 #if BTM_SCO_INCLUDED == TRUE
 647     /* Check if there is any SCO Active on this BD Address */
 648     is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
 649
 650     if (is_sco_active == TRUE)
 651         return(BTM_NO_RESOURCES);
 652 #endif
 653
 654     /* Ignore role switch request if the previous request was not completed */
 655     if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE)
 656     {
 657         BTM_TRACE_DEBUG ("BTM_SwitchRole busy: %d",
 658                           p->switch_role_state);
 659         return(BTM_BUSY);
 660     }
 661
 662     if ((status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode)) != BTM_SUCCESS)
 663         return(status);
 664
 665     /* Wake up the link if in sniff or park before attempting switch */
 666     if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF)
 667     {
 668         memset( (void*)&settings, 0, sizeof(settings));
 669         settings.mode = BTM_PM_MD_ACTIVE;
 670         status = BTM_SetPowerMode (BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
 671         if (status != BTM_CMD_STARTED)
 672             return(BTM_WRONG_MODE);
 673
 674         p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
 675     }
 676     /* some devices do not support switch while encryption is on */
 677     else
 678     {
 679         p_dev_rec = btm_find_dev (remote_bd_addr);
 680         if ((p_dev_rec != NULL)
 681             && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0)
 682             && !BTM_EPR_AVAILABLE(p))
 683         {
 684             /* bypass turning off encryption if change link key is already doing it */
 685             if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF)
 686             {
 687                 if (!btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
 688                     return(BTM_NO_RESOURCES);
 689                 else
 690                     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
 691             }
 692
 693             p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
 694         }
 695         else
 696         {
 697             if (!btsnd_hcic_switch_role (remote_bd_addr, new_role))
 698                 return(BTM_NO_RESOURCES);
 699
 700             p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
 701
 702 #if BTM_DISC_DURING_RS == TRUE
 703             if (p_dev_rec)
 704                 p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
 705 #endif
 706         }
 707     }
 708
 709     /* Initialize return structure in case request fails */
 710     if (p_cb)
 711     {
 712         memcpy (btm_cb.devcb.switch_role_ref_data.remote_bd_addr, remote_bd_addr,
 713                 BD_ADDR_LEN);
 714         btm_cb.devcb.switch_role_ref_data.role = new_role;
 715         /* initialized to an error code */
 716         btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
 717         btm_cb.devcb.p_switch_role_cb = p_cb;
 718     }
 719     return(BTM_CMD_STARTED);
 720 }
 721
 722 /*******************************************************************************
 723 **
 724 ** Function         btm_acl_encrypt_change
 725 **
 726 ** Description      This function is when encryption of the connection is
 727 **                  completed by the LM.  Checks to see if a role switch or
 728 **                  change of link key was active and initiates or continues
 729 **                  process if needed.
 730 **
 731 ** Returns          void
 732 **
 733 *******************************************************************************/
 734 void btm_acl_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
 735 {
 736     tACL_CONN *p;
 737     UINT8     xx;
 738     tBTM_SEC_DEV_REC  *p_dev_rec;
 739     tBTM_BL_ROLE_CHG_DATA   evt;
 740
 741     BTM_TRACE_DEBUG ("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
 742                       handle, status, encr_enable);
 743     xx = btm_handle_to_acl_index(handle);
 744     /* don't assume that we can never get a bad hci_handle */
 745     if (xx < MAX_L2CAP_LINKS)
 746         p = &btm_cb.acl_db[xx];
 747     else
 748         return;
 749
 750     /* Process Role Switch if active */
 751     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF)
 752     {
 753         /* if encryption turn off failed we still will try to switch role */
 754         if (encr_enable)
 755         {
 756             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 757             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
 758         }
 759         else
 760         {
 761             p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
 762             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
 763         }
 764
 765         if (!btsnd_hcic_switch_role (p->remote_addr, (UINT8)!p->link_role))
 766         {
 767             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 768             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
 769             btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status, p->remote_addr);
 770         }
 771 #if BTM_DISC_DURING_RS == TRUE
 772         else
 773         {
 774             if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL)
 775                 p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
 776         }
 777 #endif
 778
 779     }
 780     /* Finished enabling Encryption after role switch */
 781     else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON)
 782     {
 783         p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 784         p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
 785         btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status, p->remote_addr);
 786
 787         /* if role change event is registered, report it now */
 788         if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK))
 789         {
 790             evt.event       = BTM_BL_ROLE_CHG_EVT;
 791             evt.new_role    = btm_cb.devcb.switch_role_ref_data.role;
 792             evt.p_bda       = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
 793             evt.hci_status  = btm_cb.devcb.switch_role_ref_data.hci_status;
 794             (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
 795
 796             BTM_TRACE_DEBUG("Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
 797                              evt.new_role, evt.hci_status, p->switch_role_state);
 798         }
 799
 800 #if BTM_DISC_DURING_RS == TRUE
 801         /* If a disconnect is pending, issue it now that role switch has completed */
 802         if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL)
 803         {
 804             if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING)
 805             {
 806                 BTM_TRACE_WARNING("btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
 807                 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
 808             }
 809             BTM_TRACE_ERROR("btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
 810                 (UINT32)p_dev_rec, p_dev_rec->rs_disc_pending);
 811             p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
 812         }
 813 #endif
 814     }
 815 }
 816 /*******************************************************************************
 817 **
 818 ** Function         BTM_SetLinkPolicy
 819 **
 820 ** Description      Create and send HCI "Write Policy Set" command
 821 **
 822 ** Returns          status of the operation
 823 **
 824 *******************************************************************************/
 825 tBTM_STATUS BTM_SetLinkPolicy (BD_ADDR remote_bda, UINT16 *settings)
 826 {
 827     tACL_CONN   *p;
 828     UINT8       *localFeatures = BTM_ReadLocalFeatures();
 829     BTM_TRACE_DEBUG ("BTM_SetLinkPolicy");
 830 /*    BTM_TRACE_API ("BTM_SetLinkPolicy: requested settings: 0x%04x", *settings ); */
 831
 832     /* First, check if hold mode is supported */
 833     if (*settings != HCI_DISABLE_ALL_LM_MODES)
 834     {
 835         if ( (*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) && (!HCI_SWITCH_SUPPORTED(localFeatures)) )
 836         {
 837             *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
 838             BTM_TRACE_API ("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)", *settings );
 839         }
 840         if ( (*settings & HCI_ENABLE_HOLD_MODE) && (!HCI_HOLD_MODE_SUPPORTED(localFeatures)) )
 841         {
 842             *settings &= (~HCI_ENABLE_HOLD_MODE);
 843             BTM_TRACE_API ("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)", *settings );
 844         }
 845         if ( (*settings & HCI_ENABLE_SNIFF_MODE) && (!HCI_SNIFF_MODE_SUPPORTED(localFeatures)) )
 846         {
 847             *settings &= (~HCI_ENABLE_SNIFF_MODE);
 848             BTM_TRACE_API ("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)", *settings );
 849         }
 850         if ( (*settings & HCI_ENABLE_PARK_MODE) && (!HCI_PARK_MODE_SUPPORTED(localFeatures)) )
 851         {
 852             *settings &= (~HCI_ENABLE_PARK_MODE);
 853             BTM_TRACE_API ("BTM_SetLinkPolicy park not supported (settings: 0x%04x)", *settings );
 854         }
 855     }
 856
 857     if ((p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR)) != NULL)
 858         return(btsnd_hcic_write_policy_set (p->hci_handle, *settings) ? BTM_CMD_STARTED : BTM_NO_RESOURCES);
 859
 860     /* If here, no BD Addr found */
 861     return(BTM_UNKNOWN_ADDR);
 862 }
 863
 864 /*******************************************************************************
 865 **
 866 ** Function         BTM_SetDefaultLinkPolicy
 867 **
 868 ** Description      Set the default value for HCI "Write Policy Set" command
 869 **                  to use when an ACL link is created.
 870 **
 871 ** Returns          void
 872 **
 873 *******************************************************************************/
 874 void BTM_SetDefaultLinkPolicy (UINT16 settings)
 875 {
 876     UINT8 *localFeatures = BTM_ReadLocalFeatures();
 877
 878     BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
 879
 880     if((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) && (!HCI_SWITCH_SUPPORTED(localFeatures)))
 881     {
 882         settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
 883         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)", settings);
 884     }
 885     if ((settings & HCI_ENABLE_HOLD_MODE) && (!HCI_HOLD_MODE_SUPPORTED(localFeatures)))
 886     {
 887         settings &= ~HCI_ENABLE_HOLD_MODE;
 888         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)", settings);
 889     }
 890     if ((settings & HCI_ENABLE_SNIFF_MODE) && (!HCI_SNIFF_MODE_SUPPORTED(localFeatures)))
 891     {
 892         settings &= ~HCI_ENABLE_SNIFF_MODE;
 893         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)", settings);
 894     }
 895     if ((settings & HCI_ENABLE_PARK_MODE) && (!HCI_PARK_MODE_SUPPORTED(localFeatures)))
 896     {
 897         settings &= ~HCI_ENABLE_PARK_MODE;
 898         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)", settings);
 899     }
 900     BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
 901
 902     btm_cb.btm_def_link_policy = settings;
 903
 904     /* Set the default Link Policy of the controller */
 905     btsnd_hcic_write_def_policy_set(settings);
 906 }
 907
 908
 909 /*******************************************************************************
 910 **
 911 ** Function         BTM_ReadLinkPolicy
 912 **
 913 ** Description      This function is called to read the link policy settings.
 914 **                  The address of link policy results are returned in the callback.
 915 **                  (tBTM_LNK_POLICY_RESULTS)
 916 **
 917 ** Returns          status of the operation
 918 **
 919 *******************************************************************************/
 920 tBTM_STATUS BTM_ReadLinkPolicy (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
 921 {
 922     tACL_CONN   *p;
 923
 924     BTM_TRACE_API ("BTM_ReadLinkPolicy: RemBdAddr: %02x%02x%02x%02x%02x%02x",
 925                     remote_bda[0], remote_bda[1], remote_bda[2],
 926                     remote_bda[3], remote_bda[4], remote_bda[5]);
 927
 928     /* If someone already waiting on the version, do not allow another */
 929     if (btm_cb.devcb.p_rlinkp_cmpl_cb)
 930         return(BTM_BUSY);
 931
 932     p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
 933     if (p != (tACL_CONN *)NULL)
 934     {
 935         btu_start_timer (&btm_cb.devcb.rlinkp_timer, BTU_TTYPE_BTM_ACL, BTM_DEV_REPLY_TIMEOUT);
 936         btm_cb.devcb.p_rlinkp_cmpl_cb = p_cb;
 937
 938         if (!btsnd_hcic_read_policy_set (p->hci_handle))
 939         {
 940             btu_stop_timer (&btm_cb.devcb.rlinkp_timer);
 941             btm_cb.devcb.p_rlinkp_cmpl_cb = NULL;
 942             return(BTM_NO_RESOURCES);
 943         }
 944
 945         return(BTM_CMD_STARTED);
 946     }
 947
 948     /* If here, no BD Addr found */
 949     return(BTM_UNKNOWN_ADDR);
 950 }
 951
 952
 953 /*******************************************************************************
 954 **
 955 ** Function         btm_read_link_policy_complete
 956 **
 957 ** Description      This function is called when the command complete message
 958 **                  is received from the HCI for the read local link policy request.
 959 **
 960 ** Returns          void
 961 **
 962 *******************************************************************************/
 963 void btm_read_link_policy_complete (UINT8 *p)
 964 {
 965     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_rlinkp_cmpl_cb;
 966     tBTM_LNK_POLICY_RESULTS  lnkpol;
 967     UINT16                   handle;
 968     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
 969     UINT16                   index;
 970     BTM_TRACE_DEBUG ("btm_read_link_policy_complete");
 971     btu_stop_timer (&btm_cb.devcb.rlinkp_timer);
 972
 973     /* If there was a callback address for read local version, call it */
 974     btm_cb.devcb.p_rlinkp_cmpl_cb = NULL;
 975
 976     if (p_cb)
 977     {
 978         STREAM_TO_UINT8  (lnkpol.hci_status, p);
 979
 980         if (lnkpol.hci_status == HCI_SUCCESS)
 981         {
 982             lnkpol.status = BTM_SUCCESS;
 983
 984             STREAM_TO_UINT16 (handle, p);
 985
 986             STREAM_TO_UINT16 (lnkpol.settings, p);
 987
 988             /* Search through the list of active channels for the correct BD Addr */
 989             for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
 990             {
 991                 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
 992                 {
 993                     memcpy (lnkpol.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
 994                     break;
 995                 }
 996             }
 997         }
 998         else
 999             lnkpol.status = BTM_ERR_PROCESSING;
1000
1001         (*p_cb)(&lnkpol);
1002     }
1003 }
1004
1005
1006 /*******************************************************************************
1007 **
1008 ** Function         btm_read_remote_version_complete
1009 **
1010 ** Description      This function is called when the command complete message
1011 **                  is received from the HCI for the remote version info.
1012 **
1013 ** Returns          void
1014 **
1015 *******************************************************************************/
1016 void btm_read_remote_version_complete (UINT8 *p)
1017 {
1018     tACL_CONN        *p_acl_cb = &btm_cb.acl_db[0];
1019     UINT8             status;
1020     UINT16            handle;
1021     int               xx;
1022     BTM_TRACE_DEBUG ("btm_read_remote_version_complete");
1023     STREAM_TO_UINT8  (status, p);
1024     if (status == HCI_SUCCESS)
1025     {
1026         STREAM_TO_UINT16 (handle, p);
1027
1028         /* Look up the connection by handle and copy features */
1029         for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++)
1030         {
1031             if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle))
1032             {
1033                 STREAM_TO_UINT8  (p_acl_cb->lmp_version, p);
1034                 STREAM_TO_UINT16 (p_acl_cb->manufacturer, p);
1035                 STREAM_TO_UINT16 (p_acl_cb->lmp_subversion, p);
1036                 break;
1037             }
1038         }
1039     }
1040 }
1041
1042
1043 /*******************************************************************************
1044 **
1045 ** Function         btm_process_remote_ext_features
1046 **
1047 ** Description      Local function called to process all extended features pages
1048 **                  read from a remote device.
1049 **
1050 ** Returns          void
1051 **
1052 *******************************************************************************/
1053 void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages)
1054 {
1055     UINT16              handle = p_acl_cb->hci_handle;
1056     tBTM_SEC_DEV_REC    *p_dev_rec = btm_find_dev_by_handle (handle);
1057     UINT8               page_idx;
1058
1059     BTM_TRACE_DEBUG ("btm_process_remote_ext_features");
1060
1061     /* Make sure we have the record to save remote features information */
1062     if (p_dev_rec == NULL)
1063     {
1064         /* Get a new device; might be doing dedicated bonding */
1065         p_dev_rec = btm_find_or_alloc_dev (p_acl_cb->remote_addr);
1066     }
1067
1068     p_acl_cb->num_read_pages = num_read_pages;
1069     p_dev_rec->num_read_pages = num_read_pages;
1070
1071     /* Process the pages one by one */
1072     for (page_idx = 0; page_idx < num_read_pages; page_idx++)
1073     {
1074         btm_process_remote_ext_features_page (p_acl_cb, p_dev_rec, page_idx);
1075     }
1076 }
1077
1078
1079 /*******************************************************************************
1080 **
1081 ** Function         btm_process_remote_ext_features_page
1082 **
1083 ** Description      Local function called to process the information located
1084 **                  in the specific extended features page read from a remote device.
1085 **
1086 ** Returns          void
1087 **
1088 *******************************************************************************/
1089 void btm_process_remote_ext_features_page (tACL_CONN *p_acl_cb, tBTM_SEC_DEV_REC *p_dev_rec,
1090                                            UINT8 page_idx)
1091 {
1092     UINT8             req_pend;
1093
1094     memcpy (p_dev_rec->features[page_idx], p_acl_cb->peer_lmp_features[page_idx],
1095             HCI_FEATURE_BYTES_PER_PAGE);
1096
1097     switch (page_idx)
1098     {
1099     /* Extended (Legacy) Page 0 */
1100     case HCI_EXT_FEATURES_PAGE_0:
1101         /* Page 0 indicates Controller support for SSP */
1102         if (btm_cb.security_mode < BTM_SEC_MODE_SP ||
1103             !HCI_SIMPLE_PAIRING_SUPPORTED(p_dev_rec->features[HCI_EXT_FEATURES_PAGE_0]))
1104         {
1105             req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
1106             p_dev_rec->sm4 = BTM_SM4_KNOWN;
1107             if (req_pend)
1108             {
1109                 l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
1110             }
1111         }
1112         break;
1113
1114     /* Extended Page 1 */
1115     case HCI_EXT_FEATURES_PAGE_1:
1116         /* Page 1 indicates Host support for SSP and SC */
1117         req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
1118
1119         if (btm_cb.security_mode == BTM_SEC_MODE_SP
1120             && HCI_SSP_HOST_SUPPORTED(p_dev_rec->features[HCI_EXT_FEATURES_PAGE_1])
1121             && HCI_SIMPLE_PAIRING_SUPPORTED(p_dev_rec->features[HCI_EXT_FEATURES_PAGE_0]))
1122         {
1123             p_dev_rec->sm4 = BTM_SM4_TRUE;
1124         }
1125         else
1126         {
1127             p_dev_rec->sm4 = BTM_SM4_KNOWN;
1128         }
1129
1130         BTM_TRACE_API ("ext_features_complt page_num:%d f[0]:x%02x, sm4:%x, pend:%d",
1131                         HCI_EXT_FEATURES_PAGE_1, *(p_dev_rec->features[HCI_EXT_FEATURES_PAGE_1]),
1132                         p_dev_rec->sm4, req_pend);
1133
1134         if (req_pend)
1135             l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
1136
1137         break;
1138
1139     /* Extended Page 2 */
1140     case HCI_EXT_FEATURES_PAGE_2:
1141         /* Page 2 indicates Ping support*/
1142         break;
1143
1144     default:
1145         BTM_TRACE_ERROR("btm_process_remote_ext_features_page page=%d unexpected", page_idx);
1146         break;
1147     }
1148 }
1149
1150
1151 /*******************************************************************************
1152 **
1153 ** Function         btm_read_remote_features
1154 **
1155 ** Description      Local function called to send a read remote supported features/
1156 **                  remote extended features page[0].
1157 **
1158 ** Returns          void
1159 **
1160 *******************************************************************************/
1161 void btm_read_remote_features (UINT16 handle)
1162 {
1163     UINT8       acl_idx;
1164     tACL_CONN   *p_acl_cb;
1165
1166     BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
1167
1168     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1169     {
1170         BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
1171         return;
1172     }
1173
1174     p_acl_cb = &btm_cb.acl_db[acl_idx];
1175     p_acl_cb->num_read_pages = 0;
1176     memset (p_acl_cb->peer_lmp_features, 0, sizeof(p_acl_cb->peer_lmp_features));
1177
1178     /* first send read remote supported features HCI command */
1179     /* because we don't know whether the remote support extended feature command */
1180     btsnd_hcic_rmt_features_req (handle);
1181 }
1182
1183
1184 /*******************************************************************************
1185 **
1186 ** Function         btm_read_remote_ext_features
1187 **
1188 ** Description      Local function called to send a read remote extended features
1189 **
1190 ** Returns          void
1191 **
1192 *******************************************************************************/
1193 void btm_read_remote_ext_features (UINT16 handle, UINT8 page_number)
1194 {
1195     BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle, page_number);
1196
1197     btsnd_hcic_rmt_ext_features(handle, page_number);
1198 }
1199
1200
1201 /*******************************************************************************
1202 **
1203 ** Function         btm_read_remote_features_complete
1204 **
1205 ** Description      This function is called when the remote supported features
1206 **                  complete event is received from the HCI.
1207 **
1208 ** Returns          void
1209 **
1210 *******************************************************************************/
1211 void btm_read_remote_features_complete (UINT8 *p)
1212 {
1213     tACL_CONN        *p_acl_cb;
1214     UINT8             status;
1215     UINT16            handle;
1216     UINT8            acl_idx;
1217
1218     BTM_TRACE_DEBUG ("btm_read_remote_features_complete");
1219     STREAM_TO_UINT8  (status, p);
1220
1221     if (status != HCI_SUCCESS)
1222     {
1223         BTM_TRACE_ERROR ("btm_read_remote_features_complete failed (status 0x%02x)", status);
1224         return;
1225     }
1226
1227         STREAM_TO_UINT16 (handle, p);
1228
1229     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1230         {
1231         BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid", handle);
1232         return;
1233                 }
1234
1235     p_acl_cb = &btm_cb.acl_db[acl_idx];
1236
1237     /* Copy the received features page */
1238     STREAM_TO_ARRAY(p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0], p,
1239                     HCI_FEATURE_BYTES_PER_PAGE);
1240
1241     if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])) &&
1242         (controller_get_interface()->supports_reading_remote_extended_features()))
1243     {
1244         /* if the remote controller has extended features and local controller supports
1245         ** HCI_Read_Remote_Extended_Features command then start reading these feature starting
1246         ** with extended features page 1 */
1247         BTM_TRACE_DEBUG ("Start reading remote extended features");
1248         btm_read_remote_ext_features(handle, HCI_EXT_FEATURES_PAGE_1);
1249         return;
1250     }
1251
1252     /* Remote controller has no extended features. Process remote controller supported features
1253        (features page HCI_EXT_FEATURES_PAGE_0). */
1254     btm_process_remote_ext_features (p_acl_cb, 1);
1255
1256     /* Continue with HCI connection establishment */
1257     btm_establish_continue (p_acl_cb);
1258 }
1259
1260 /*******************************************************************************
1261 **
1262 ** Function         btm_read_remote_ext_features_complete
1263 **
1264 ** Description      This function is called when the remote extended features
1265 **                  complete event is received from the HCI.
1266 **
1267 ** Returns          void
1268 **
1269 *******************************************************************************/
1270 void btm_read_remote_ext_features_complete (UINT8 *p)
1271 {
1272     tACL_CONN   *p_acl_cb;
1273     UINT8       page_num, max_page;
1274     UINT16      handle;
1275     UINT8       acl_idx;
1276
1277     BTM_TRACE_DEBUG ("btm_read_remote_ext_features_complete");
1278
1279     ++p;
1280     STREAM_TO_UINT16 (handle, p);
1281     STREAM_TO_UINT8  (page_num, p);
1282     STREAM_TO_UINT8  (max_page, p);
1283
1284     /* Validate parameters */
1285     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1286     {
1287         BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid", handle);
1288         return;
1289     }
1290
1291     if (max_page > HCI_EXT_FEATURES_PAGE_MAX)
1292     {
1293         BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown", max_page);
1294         return;
1295     }
1296
1297     p_acl_cb = &btm_cb.acl_db[acl_idx];
1298
1299     /* Copy the received features page */
1300     STREAM_TO_ARRAY(p_acl_cb->peer_lmp_features[page_num], p, HCI_FEATURE_BYTES_PER_PAGE);
1301
1302     /* If there is the next remote features page and
1303      * we have space to keep this page data - read this page */
1304     if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX))
1305     {
1306         page_num++;
1307         BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)", page_num);
1308         btm_read_remote_ext_features (handle, page_num);
1309         return;
1310     }
1311
1312     /* Reading of remote feature pages is complete */
1313     BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)", page_num);
1314
1315     /* Process the pages */
1316     btm_process_remote_ext_features (p_acl_cb, (UINT8) (page_num + 1));
1317
1318     /* Continue with HCI connection establishment */
1319     btm_establish_continue (p_acl_cb);
1320 }
1321
1322 /*******************************************************************************
1323 **
1324 ** Function         btm_read_remote_ext_features_failed
1325 **
1326 ** Description      This function is called when the remote extended features
1327 **                  complete event returns a failed status.
1328 **
1329 ** Returns          void
1330 **
1331 *******************************************************************************/
1332 void btm_read_remote_ext_features_failed (UINT8 status, UINT16 handle)
1333 {
1334     tACL_CONN   *p_acl_cb;
1335     UINT8       acl_idx;
1336
1337     BTM_TRACE_WARNING ("btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1338                          status, handle);
1339
1340     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1341     {
1342         BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid", handle);
1343         return;
1344     }
1345
1346     p_acl_cb = &btm_cb.acl_db[acl_idx];
1347
1348     /* Process supported features only */
1349     btm_process_remote_ext_features (p_acl_cb, 1);
1350
1351     /* Continue HCI connection establishment */
1352     btm_establish_continue (p_acl_cb);
1353 }
1354
1355 /*******************************************************************************
1356 **
1357 ** Function         btm_establish_continue
1358 **
1359 ** Description      This function is called when the command complete message
1360 **                  is received from the HCI for the read local link policy request.
1361 **
1362 ** Returns          void
1363 **
1364 *******************************************************************************/
1365 void btm_establish_continue (tACL_CONN *p_acl_cb)
1366 {
1367         tBTM_BL_EVENT_DATA  evt_data;
1368         BTM_TRACE_DEBUG ("btm_establish_continue");
1369 #if (!defined(BTM_BYPASS_EXTRA_ACL_SETUP) || BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1370 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
1371         if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR)
1372 #endif
1373         {
1374             /* For now there are a some devices that do not like sending */
1375             /* commands events and data at the same time. */
1376             /* Set the packet types to the default allowed by the device */
1377             btm_set_packet_types (p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1378
1379             if (btm_cb.btm_def_link_policy)
1380                 BTM_SetLinkPolicy (p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1381         }
1382 #endif
1383         p_acl_cb->link_up_issued = TRUE;
1384
1385         /* If anyone cares, tell him database changed */
1386         if (btm_cb.p_bl_changed_cb)
1387         {
1388             evt_data.event = BTM_BL_CONN_EVT;
1389             evt_data.conn.p_bda = p_acl_cb->remote_addr;
1390             evt_data.conn.p_bdn = p_acl_cb->remote_name;
1391             evt_data.conn.p_dc  = p_acl_cb->remote_dc;
1392             evt_data.conn.p_features = p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0];
1393 #if BLE_INCLUDED == TRUE
1394             evt_data.conn.handle = p_acl_cb->hci_handle;
1395             evt_data.conn.transport = p_acl_cb->transport;
1396 #endif
1397
1398             (*btm_cb.p_bl_changed_cb)(&evt_data);
1399         }
1400         btm_acl_update_busy_level (BTM_BLI_ACL_UP_EVT);
1401 }
1402
1403
1404 /*******************************************************************************
1405 **
1406 ** Function         BTM_SetDefaultLinkSuperTout
1407 **
1408 ** Description      Set the default value for HCI "Write Link Supervision Timeout"
1409 **                  command to use when an ACL link is created.
1410 **
1411 ** Returns          void
1412 **
1413 *******************************************************************************/
1414 void BTM_SetDefaultLinkSuperTout (UINT16 timeout)
1415 {
1416     BTM_TRACE_DEBUG ("BTM_SetDefaultLinkSuperTout");
1417     btm_cb.btm_def_link_super_tout = timeout;
1418 }
1419
1420 /*******************************************************************************
1421 **
1422 ** Function         BTM_GetLinkSuperTout
1423 **
1424 ** Description      Read the link supervision timeout value of the connection
1425 **
1426 ** Returns          status of the operation
1427 **
1428 *******************************************************************************/
1429 tBTM_STATUS BTM_GetLinkSuperTout (BD_ADDR remote_bda, UINT16 *p_timeout)
1430 {
1431     tACL_CONN   *p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1432
1433     BTM_TRACE_DEBUG ("BTM_GetLinkSuperTout");
1434     if (p != (tACL_CONN *)NULL)
1435     {
1436         *p_timeout = p->link_super_tout;
1437         return(BTM_SUCCESS);
1438     }
1439     /* If here, no BD Addr found */
1440     return(BTM_UNKNOWN_ADDR);
1441 }
1442
1443
1444 /*******************************************************************************
1445 **
1446 ** Function         BTM_SetLinkSuperTout
1447 **
1448 ** Description      Create and send HCI "Write Link Supervision Timeout" command
1449 **
1450 ** Returns          status of the operation
1451 **
1452 *******************************************************************************/
1453 tBTM_STATUS BTM_SetLinkSuperTout (BD_ADDR remote_bda, UINT16 timeout)
1454 {
1455     tACL_CONN   *p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1456
1457     BTM_TRACE_DEBUG ("BTM_SetLinkSuperTout");
1458     if (p != (tACL_CONN *)NULL)
1459     {
1460         p->link_super_tout = timeout;
1461
1462         /* Only send if current role is Master; 2.0 spec requires this */
1463         if (p->link_role == BTM_ROLE_MASTER)
1464         {
1465             if (!btsnd_hcic_write_link_super_tout (LOCAL_BR_EDR_CONTROLLER_ID,
1466                                                    p->hci_handle, timeout))
1467                 return(BTM_NO_RESOURCES);
1468
1469             return(BTM_CMD_STARTED);
1470         }
1471         else
1472             return(BTM_SUCCESS);
1473     }
1474
1475     /* If here, no BD Addr found */
1476     return(BTM_UNKNOWN_ADDR);
1477 }
1478
1479 /*******************************************************************************
1480 **
1481 ** Function         BTM_RegForLstoEvt
1482 **
1483 ** Description      register for the HCI "Link Supervision Timeout Change" event
1484 **
1485 ** Returns          void
1486 **
1487 *******************************************************************************/
1488 void BTM_RegForLstoEvt (tBTM_LSTO_CBACK *p_cback)
1489 {
1490     BTM_TRACE_DEBUG ("BTM_RegForLstoEvt");
1491     btm_cb.p_lsto_cback = p_cback;
1492 }
1493
1494 /*******************************************************************************
1495 **
1496 ** Function         btm_proc_lsto_evt
1497 **
1498 ** Description      process the HCI "Link Supervision Timeout Change" event
1499 **
1500 ** Returns          void
1501 **
1502 *******************************************************************************/
1503 void btm_proc_lsto_evt(UINT16 handle, UINT16 timeout)
1504 {
1505     UINT8 xx;
1506
1507     BTM_TRACE_DEBUG ("btm_proc_lsto_evt");
1508     if (btm_cb.p_lsto_cback)
1509     {
1510         /* Look up the connection by handle and set the current mode */
1511         xx = btm_handle_to_acl_index(handle);
1512
1513         /* don't assume that we can never get a bad hci_handle */
1514         if (xx < MAX_L2CAP_LINKS)
1515         {
1516             (*btm_cb.p_lsto_cback)(btm_cb.acl_db[xx].remote_addr, timeout);
1517         }
1518     }
1519 }
1520
1521 /*******************************************************************************
1522 **
1523 ** Function         BTM_SetPacketTypes
1524 **
1525 ** Description      This function is set the packet types used for a specific
1526 **                  ACL connection,
1527 **
1528 ** Returns          status of the operation
1529 **
1530 *******************************************************************************/
1531 tBTM_STATUS BTM_SetPacketTypes (BD_ADDR remote_bda, UINT16 pkt_types)
1532 {
1533     tACL_CONN   *p;
1534     BTM_TRACE_DEBUG ("BTM_SetPacketTypes");
1535
1536     if ((p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR)) != NULL)
1537         return(btm_set_packet_types (p, pkt_types));
1538
1539     /* If here, no BD Addr found */
1540     return(BTM_UNKNOWN_ADDR);
1541 }
1542
1543
1544 /*******************************************************************************
1545 **
1546 ** Function         BTM_ReadPacketTypes
1547 **
1548 ** Description      This function is set the packet types used for a specific
1549 **                  ACL connection,
1550 **
1551 ** Returns          packet types supported for the connection, or 0 if no BD address
1552 **
1553 *******************************************************************************/
1554 UINT16 BTM_ReadPacketTypes (BD_ADDR remote_bda)
1555 {
1556     tACL_CONN   *p;
1557
1558     BTM_TRACE_DEBUG ("BTM_ReadPacketTypes");
1559     p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1560     if (p != (tACL_CONN *)NULL)
1561     {
1562         return(p->pkt_types_mask);
1563     }
1564
1565     /* If here, no BD Addr found */
1566     return(0);
1567 }
1568
1569 /*******************************************************************************
1570 **
1571 ** Function         BTM_ReadClockOffset
1572 **
1573 ** Description      This returns the clock offset for a specific
1574 **                  ACL connection.
1575 **
1576 ** Input Param      remote_bda - device address of desired ACL connection
1577 **
1578 ** Returns          clock-offset or 0 if unknown
1579 **
1580 *******************************************************************************/
1581 UINT16 BTM_ReadClockOffset (BD_ADDR remote_bda)
1582 {
1583     tACL_CONN   *p;
1584
1585     BTM_TRACE_API ("BTM_ReadClockOffset: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1586                     remote_bda[0], remote_bda[1], remote_bda[2],
1587                     remote_bda[3], remote_bda[4], remote_bda[5]);
1588
1589     if ( (p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR)) != NULL)
1590         return(p->clock_offset);
1591
1592     /* If here, no BD Addr found */
1593     return(0);
1594 }
1595
1596 /*******************************************************************************
1597 **
1598 ** Function         BTM_IsAclConnectionUp
1599 **
1600 ** Description      This function is called to check if an ACL connection exists
1601 **                  to a specific remote BD Address.
1602 **
1603 ** Returns          TRUE if connection is up, else FALSE.
1604 **
1605 *******************************************************************************/
1606 BOOLEAN BTM_IsAclConnectionUp (BD_ADDR remote_bda, tBT_TRANSPORT transport)
1607 {
1608     tACL_CONN   *p;
1609
1610     BTM_TRACE_API ("BTM_IsAclConnectionUp: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1611                     remote_bda[0], remote_bda[1], remote_bda[2],
1612                     remote_bda[3], remote_bda[4], remote_bda[5]);
1613
1614     p = btm_bda_to_acl(remote_bda, transport);
1615     if (p != (tACL_CONN *)NULL)
1616     {
1617         return(TRUE);
1618     }
1619
1620     /* If here, no BD Addr found */
1621     return(FALSE);
1622 }
1623
1624 /*******************************************************************************
1625 **
1626 ** Function         BTM_GetNumAclLinks
1627 **
1628 ** Description      This function is called to count the number of
1629 **                  ACL links that are active.
1630 **
1631 ** Returns          UINT16  Number of active ACL links
1632 **
1633 *******************************************************************************/
1634 UINT16 BTM_GetNumAclLinks (void)
1635 {
1636     return(UINT16)btm_cb.num_acl;
1637 }
1638
1639 /*******************************************************************************
1640 **
1641 ** Function         btm_get_acl_disc_reason_code
1642 **
1643 ** Description      This function is called to get the disconnection reason code
1644 **                  returned by the HCI at disconnection complete event.
1645 **
1646 ** Returns          TRUE if connection is up, else FALSE.
1647 **
1648 *******************************************************************************/
1649 UINT16 btm_get_acl_disc_reason_code (void)
1650 {
1651     UINT8 res = btm_cb.acl_disc_reason;
1652     BTM_TRACE_DEBUG ("btm_get_acl_disc_reason_code");
1653     return(res);
1654 }
1655
1656
1657 /*******************************************************************************
1658 **
1659 ** Function         BTM_GetHCIConnHandle
1660 **
1661 ** Description      This function is called to get the handle for an ACL connection
1662 **                  to a specific remote BD Address.
1663 **
1664 ** Returns          the handle of the connection, or 0xFFFF if none.
1665 **
1666 *******************************************************************************/
1667 UINT16 BTM_GetHCIConnHandle (BD_ADDR remote_bda, tBT_TRANSPORT transport)
1668 {
1669     tACL_CONN   *p;
1670     BTM_TRACE_DEBUG ("BTM_GetHCIConnHandle");
1671     p = btm_bda_to_acl(remote_bda, transport);
1672     if (p != (tACL_CONN *)NULL)
1673     {
1674         return(p->hci_handle);
1675     }
1676
1677     /* If here, no BD Addr found */
1678     return(0xFFFF);
1679 }
1680
1681 /*******************************************************************************
1682 **
1683 ** Function         btm_process_clk_off_comp_evt
1684 **
1685 ** Description      This function is called when clock offset command completes.
1686 **
1687 ** Input Parms      hci_handle - connection handle associated with the change
1688 **                  clock offset
1689 **
1690 ** Returns          void
1691 **
1692 *******************************************************************************/
1693 void btm_process_clk_off_comp_evt (UINT16 hci_handle, UINT16 clock_offset)
1694 {
1695     UINT8      xx;
1696     BTM_TRACE_DEBUG ("btm_process_clk_off_comp_evt");
1697     /* Look up the connection by handle and set the current mode */
1698     if ((xx = btm_handle_to_acl_index(hci_handle)) < MAX_L2CAP_LINKS)
1699         btm_cb.acl_db[xx].clock_offset = clock_offset;
1700 }
1701
1702 /*******************************************************************************
1703 **
1704 ** Function         btm_acl_role_changed
1705 **
1706 ** Description      This function is called whan a link's master/slave role change
1707 **                  event or command status event (with error) is received.
1708 **                  It updates the link control block, and calls
1709 **                  the registered callback with status and role (if registered).
1710 **
1711 ** Returns          void
1712 **
1713 *******************************************************************************/
1714 void btm_acl_role_changed (UINT8 hci_status, BD_ADDR bd_addr, UINT8 new_role)
1715 {
1716     UINT8                   *p_bda = (bd_addr) ? bd_addr :
1717                                         btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1718     tACL_CONN               *p = btm_bda_to_acl(p_bda, BT_TRANSPORT_BR_EDR);
1719     tBTM_ROLE_SWITCH_CMPL   *p_data = &btm_cb.devcb.switch_role_ref_data;
1720     tBTM_SEC_DEV_REC        *p_dev_rec;
1721     tBTM_BL_ROLE_CHG_DATA   evt;
1722
1723     BTM_TRACE_DEBUG ("btm_acl_role_changed");
1724     /* Ignore any stray events */
1725     if (p == NULL)
1726     {
1727         /* it could be a failure */
1728         if (hci_status != HCI_SUCCESS)
1729             btm_acl_report_role_change(hci_status, bd_addr);
1730         return;
1731     }
1732
1733     p_data->hci_status = hci_status;
1734
1735     if (hci_status == HCI_SUCCESS)
1736     {
1737         p_data->role = new_role;
1738         memcpy(p_data->remote_bd_addr, p_bda, BD_ADDR_LEN);
1739
1740         /* Update cached value */
1741         p->link_role = new_role;
1742
1743         /* Reload LSTO: link supervision timeout is reset in the LM after a role switch */
1744         if (new_role == BTM_ROLE_MASTER)
1745         {
1746             BTM_SetLinkSuperTout (p->remote_addr, p->link_super_tout);
1747         }
1748     }
1749     else
1750     {
1751         /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1752         new_role = p->link_role;
1753     }
1754
1755     /* Check if any SCO req is pending for role change */
1756     btm_sco_chk_pend_rolechange (p->hci_handle);
1757
1758     /* if switching state is switching we need to turn encryption on */
1759     /* if idle, we did not change encryption */
1760     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING)
1761     {
1762         if (btsnd_hcic_set_conn_encrypt (p->hci_handle, TRUE))
1763         {
1764             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1765             p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1766             return;
1767         }
1768     }
1769
1770     /* Set the switch_role_state to IDLE since the reply received from HCI */
1771     /* regardless of its result either success or failed. */
1772     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)
1773     {
1774         p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1775         p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1776     }
1777
1778     /* if role switch complete is needed, report it now */
1779     btm_acl_report_role_change(hci_status, bd_addr);
1780
1781     /* if role change event is registered, report it now */
1782     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK))
1783     {
1784         evt.event       = BTM_BL_ROLE_CHG_EVT;
1785         evt.new_role    = new_role;
1786         evt.p_bda       = p_bda;
1787         evt.hci_status  = hci_status;
1788         (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
1789     }
1790
1791     BTM_TRACE_DEBUG("Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
1792                      p_data->role, p_data->hci_status, p->switch_role_state);
1793
1794 #if BTM_DISC_DURING_RS == TRUE
1795     /* If a disconnect is pending, issue it now that role switch has completed */
1796     if ((p_dev_rec = btm_find_dev (p_bda)) != NULL)
1797     {
1798         if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING)
1799         {
1800             BTM_TRACE_WARNING("btm_acl_role_changed -> Issuing delayed HCI_Disconnect!!!");
1801             btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1802         }
1803         BTM_TRACE_ERROR("tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1804                          (UINT32)p_dev_rec, p_dev_rec->rs_disc_pending);
1805         p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
1806     }
1807
1808 #endif
1809
1810 }
1811
1812 #if (RFCOMM_INCLUDED==TRUE)
1813 /*******************************************************************************
1814 **
1815 ** Function         BTM_AllocateSCN
1816 **
1817 ** Description      Look through the Server Channel Numbers for a free one.
1818 **
1819 ** Returns          Allocated SCN number or 0 if none.
1820 **
1821 *******************************************************************************/
1822
1823 UINT8 BTM_AllocateSCN(void)
1824 {
1825     UINT8   x;
1826     BTM_TRACE_DEBUG ("BTM_AllocateSCN");
1827
1828     // stack reserves scn 1 for HFP, HSP we still do the correct way
1829     for (x = 1; x < BTM_MAX_SCN; x++)
1830     {
1831         if (!btm_cb.btm_scn[x])
1832         {
1833             btm_cb.btm_scn[x] = TRUE;
1834             return(x+1);
1835         }
1836     }
1837
1838     return(0);     /* No free ports */
1839 }
1840
1841 /*******************************************************************************
1842 **
1843 ** Function         BTM_TryAllocateSCN
1844 **
1845 ** Description      Try to allocate a fixed server channel
1846 **
1847 ** Returns          Returns TRUE if server channel was available
1848 **
1849 *******************************************************************************/
1850
1851 BOOLEAN BTM_TryAllocateSCN(UINT8 scn)
1852 {
1853     UINT8   x;
1854
1855     /* Make sure we don't exceed max port range.
1856      * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1857      */
1858     if ( (scn>=BTM_MAX_SCN) || (scn == 1) )
1859         return FALSE;
1860
1861     /* check if this port is available */
1862     if (!btm_cb.btm_scn[scn-1])
1863     {
1864         btm_cb.btm_scn[scn-1] = TRUE;
1865         return TRUE;
1866     }
1867
1868     return (FALSE);     /* Port was busy */
1869 }
1870
1871 /*******************************************************************************
1872 **
1873 ** Function         BTM_FreeSCN
1874 **
1875 ** Description      Free the specified SCN.
1876 **
1877 ** Returns          TRUE or FALSE
1878 **
1879 *******************************************************************************/
1880 BOOLEAN BTM_FreeSCN(UINT8 scn)
1881 {
1882     BTM_TRACE_DEBUG ("BTM_FreeSCN ");
1883     if (scn <= BTM_MAX_SCN)
1884     {
1885         btm_cb.btm_scn[scn-1] = FALSE;
1886         return(TRUE);
1887     }
1888     else
1889         return(FALSE);      /* Illegal SCN passed in */
1890 }
1891
1892 #else
1893
1894 /* Make dummy functions for the RPC to link against */
1895 UINT8 BTM_AllocateSCN(void)
1896 {
1897     return(0);
1898 }
1899
1900 BOOLEAN BTM_FreeSCN(UINT8 scn)
1901 {
1902     return(FALSE);
1903 }
1904
1905 #endif
1906
1907
1908 /*******************************************************************************
1909 **
1910 ** Function         btm_acl_timeout
1911 **
1912 ** Description      This function is called when a timer list entry expires.
1913 **
1914 ** Returns          void
1915 **
1916 *******************************************************************************/
1917 void btm_acl_timeout (TIMER_LIST_ENT  *p_tle)
1918 {
1919     UINT32 timer_type = p_tle->param;
1920
1921     BTM_TRACE_DEBUG ("btm_acl_timeout");
1922     if (timer_type == TT_DEV_RLNKP)
1923     {
1924         tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_rlinkp_cmpl_cb;
1925         tBTM_LNK_POLICY_RESULTS  lnkpol;
1926
1927         lnkpol.status = BTM_ERR_PROCESSING;
1928         lnkpol.settings = 0;
1929
1930         btm_cb.devcb.p_rlinkp_cmpl_cb = NULL;
1931
1932         if (p_cb)
1933             (*p_cb)(&lnkpol);
1934     }
1935 }
1936
1937 /*******************************************************************************
1938 **
1939 ** Function         btm_set_packet_types
1940 **
1941 ** Description      This function sets the packet types used for a specific
1942 **                  ACL connection. It is called internally by btm_acl_created
1943 **                  or by an application/profile by BTM_SetPacketTypes.
1944 **
1945 ** Returns          status of the operation
1946 **
1947 *******************************************************************************/
1948 tBTM_STATUS btm_set_packet_types (tACL_CONN *p, UINT16 pkt_types)
1949 {
1950     UINT16 temp_pkt_types;
1951     BTM_TRACE_DEBUG ("btm_set_packet_types");
1952     /* Save in the ACL control blocks, types that we support */
1953     temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1954                       btm_cb.btm_acl_pkt_types_supported);
1955
1956     /* OR in any exception packet types if at least 2.0 version of spec */
1957     temp_pkt_types |= ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1958                        (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1959
1960     /* Exclude packet types not supported by the peer */
1961     btm_acl_chk_peer_pkt_type_support (p, &temp_pkt_types);
1962
1963     BTM_TRACE_DEBUG ("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1964
1965     if (!btsnd_hcic_change_conn_type (p->hci_handle, temp_pkt_types))
1966     {
1967         return(BTM_NO_RESOURCES);
1968     }
1969
1970     p->pkt_types_mask = temp_pkt_types;
1971
1972     return(BTM_CMD_STARTED);
1973 }
1974
1975 /*******************************************************************************
1976 **
1977 ** Function         btm_get_max_packet_size
1978 **
1979 ** Returns          Returns maximum packet size that can be used for current
1980 **                  connection, 0 if connection is not established
1981 **
1982 *******************************************************************************/
1983 UINT16 btm_get_max_packet_size (BD_ADDR addr)
1984 {
1985     tACL_CONN   *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1986     UINT16      pkt_types = 0;
1987     UINT16      pkt_size = 0;
1988     BTM_TRACE_DEBUG ("btm_get_max_packet_size");
1989     if (p != NULL)
1990     {
1991         pkt_types = p->pkt_types_mask;
1992     }
1993     else
1994     {
1995         /* Special case for when info for the local device is requested */
1996         if (memcmp (controller_get_interface()->get_address(), addr, BD_ADDR_LEN) == 0)
1997         {
1998             pkt_types = btm_cb.btm_acl_pkt_types_supported;
1999         }
2000     }
2001
2002     if (pkt_types)
2003     {
2004         if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
2005             pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
2006         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
2007             pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
2008         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
2009             pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
2010         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
2011             pkt_size = HCI_DH5_PACKET_SIZE;
2012         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
2013             pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
2014         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
2015             pkt_size = HCI_DM5_PACKET_SIZE;
2016         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
2017             pkt_size = HCI_DH3_PACKET_SIZE;
2018         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
2019             pkt_size = HCI_DM3_PACKET_SIZE;
2020         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
2021             pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
2022         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
2023             pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
2024         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
2025             pkt_size = HCI_DH1_PACKET_SIZE;
2026         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
2027             pkt_size = HCI_DM1_PACKET_SIZE;
2028     }
2029
2030    return(pkt_size);
2031 }
2032
2033 /*******************************************************************************
2034 **
2035 ** Function         BTM_ReadRemoteVersion
2036 **
2037 ** Returns          If connected report peer device info
2038 **
2039 *******************************************************************************/
2040 tBTM_STATUS BTM_ReadRemoteVersion (BD_ADDR addr, UINT8 *lmp_version,
2041                                    UINT16 *manufacturer, UINT16 *lmp_sub_version)
2042 {
2043     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
2044     BTM_TRACE_DEBUG ("BTM_ReadRemoteVersion");
2045     if (p == NULL)
2046         return(BTM_UNKNOWN_ADDR);
2047
2048     if (lmp_version)
2049         *lmp_version = p->lmp_version;
2050
2051     if (manufacturer)
2052         *manufacturer = p->manufacturer;
2053
2054     if (lmp_sub_version)
2055         *lmp_sub_version = p->lmp_subversion;
2056
2057     return(BTM_SUCCESS);
2058 }
2059
2060 /*******************************************************************************
2061 **
2062 ** Function         BTM_ReadRemoteFeatures
2063 **
2064 ** Returns          pointer to the remote supported features mask (8 bytes)
2065 **
2066 *******************************************************************************/
2067 UINT8 *BTM_ReadRemoteFeatures (BD_ADDR addr)
2068 {
2069     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
2070     BTM_TRACE_DEBUG ("BTM_ReadRemoteFeatures");
2071     if (p == NULL)
2072     {
2073         return(NULL);
2074     }
2075
2076     return(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]);
2077 }
2078
2079 /*******************************************************************************
2080 **
2081 ** Function         BTM_ReadRemoteExtendedFeatures
2082 **
2083 ** Returns          pointer to the remote extended features mask (8 bytes)
2084 **                  or NULL if bad page
2085 **
2086 *******************************************************************************/
2087 UINT8 *BTM_ReadRemoteExtendedFeatures (BD_ADDR addr, UINT8 page_number)
2088 {
2089     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
2090     BTM_TRACE_DEBUG ("BTM_ReadRemoteExtendedFeatures");
2091     if (p == NULL)
2092     {
2093         return(NULL);
2094     }
2095
2096     if (page_number > HCI_EXT_FEATURES_PAGE_MAX)
2097     {
2098         BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown", page_number);
2099         return NULL;
2100     }
2101
2102     return(p->peer_lmp_features[page_number]);
2103 }
2104
2105 /*******************************************************************************
2106 **
2107 ** Function         BTM_ReadNumberRemoteFeaturesPages
2108 **
2109 ** Returns          number of features pages read from the remote device.
2110 **
2111 *******************************************************************************/
2112 UINT8 BTM_ReadNumberRemoteFeaturesPages (BD_ADDR addr)
2113 {
2114     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
2115     BTM_TRACE_DEBUG ("BTM_ReadNumberRemoteFeaturesPages");
2116     if (p == NULL)
2117     {
2118         return(0);
2119     }
2120
2121     return(p->num_read_pages);
2122 }
2123
2124 /*******************************************************************************
2125 **
2126 ** Function         BTM_ReadAllRemoteFeatures
2127 **
2128 ** Returns          pointer to all features of the remote (24 bytes).
2129 **
2130 *******************************************************************************/
2131 UINT8 *BTM_ReadAllRemoteFeatures (BD_ADDR addr)
2132 {
2133     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
2134     BTM_TRACE_DEBUG ("BTM_ReadAllRemoteFeatures");
2135     if (p == NULL)
2136     {
2137         return(NULL);
2138     }
2139
2140     return(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]);
2141 }
2142
2143 /*******************************************************************************
2144 **
2145 ** Function         BTM_RegBusyLevelNotif
2146 **
2147 ** Description      This function is called to register a callback to receive
2148 **                  busy level change events.
2149 **
2150 ** Returns          BTM_SUCCESS if successfully registered, otherwise error
2151 **
2152 *******************************************************************************/
2153 tBTM_STATUS BTM_RegBusyLevelNotif (tBTM_BL_CHANGE_CB *p_cb, UINT8 *p_level,
2154                                    tBTM_BL_EVENT_MASK evt_mask)
2155 {
2156     BTM_TRACE_DEBUG ("BTM_RegBusyLevelNotif");
2157     if (p_level)
2158         *p_level = btm_cb.busy_level;
2159
2160     btm_cb.bl_evt_mask = evt_mask;
2161
2162     if (!p_cb)
2163         btm_cb.p_bl_changed_cb = NULL;
2164     else if (btm_cb.p_bl_changed_cb)
2165         return(BTM_BUSY);
2166     else
2167         btm_cb.p_bl_changed_cb = p_cb;
2168
2169     return(BTM_SUCCESS);
2170 }
2171
2172 /*******************************************************************************
2173 **
2174 ** Function         BTM_SetQoS
2175 **
2176 ** Description      This function is called to setup QoS
2177 **
2178 ** Returns          status of the operation
2179 **
2180 *******************************************************************************/
2181 tBTM_STATUS BTM_SetQoS (BD_ADDR bd, FLOW_SPEC *p_flow, tBTM_CMPL_CB *p_cb)
2182 {
2183     tACL_CONN   *p = &btm_cb.acl_db[0];
2184
2185     BTM_TRACE_API ("BTM_SetQoS: BdAddr: %02x%02x%02x%02x%02x%02x",
2186                     bd[0], bd[1], bd[2],
2187                     bd[3], bd[4], bd[5]);
2188
2189     /* If someone already waiting on the version, do not allow another */
2190     if (btm_cb.devcb.p_qossu_cmpl_cb)
2191         return(BTM_BUSY);
2192
2193     if ( (p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR)) != NULL)
2194     {
2195         btu_start_timer (&btm_cb.devcb.qossu_timer, BTU_TTYPE_BTM_ACL, BTM_DEV_REPLY_TIMEOUT);
2196         btm_cb.devcb.p_qossu_cmpl_cb = p_cb;
2197
2198         if (!btsnd_hcic_qos_setup (p->hci_handle, p_flow->qos_flags, p_flow->service_type,
2199                                    p_flow->token_rate, p_flow->peak_bandwidth,
2200                                    p_flow->latency,p_flow->delay_variation))
2201         {
2202             btm_cb.devcb.p_qossu_cmpl_cb = NULL;
2203             btu_stop_timer(&btm_cb.devcb.qossu_timer);
2204             return(BTM_NO_RESOURCES);
2205         }
2206         else
2207             return(BTM_CMD_STARTED);
2208     }
2209
2210     /* If here, no BD Addr found */
2211     return(BTM_UNKNOWN_ADDR);
2212 }
2213
2214 /*******************************************************************************
2215 **
2216 ** Function         btm_qos_setup_complete
2217 **
2218 ** Description      This function is called when the command complete message
2219 **                  is received from the HCI for the qos setup request.
2220 **
2221 ** Returns          void
2222 **
2223 *******************************************************************************/
2224 void btm_qos_setup_complete (UINT8 status, UINT16 handle, FLOW_SPEC *p_flow)
2225 {
2226     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_qossu_cmpl_cb;
2227     tBTM_QOS_SETUP_CMPL     qossu;
2228     BTM_TRACE_DEBUG ("btm_qos_setup_complete");
2229     btu_stop_timer (&btm_cb.devcb.qossu_timer);
2230
2231     btm_cb.devcb.p_qossu_cmpl_cb = NULL;
2232
2233     if (p_cb)
2234     {
2235         memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
2236         qossu.status = status;
2237         qossu.handle = handle;
2238         if (p_flow != NULL)
2239         {
2240             qossu.flow.qos_flags = p_flow->qos_flags;
2241             qossu.flow.service_type = p_flow->service_type;
2242             qossu.flow.token_rate = p_flow->token_rate;
2243             qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
2244             qossu.flow.latency = p_flow->latency;
2245             qossu.flow.delay_variation = p_flow->delay_variation;
2246         }
2247         BTM_TRACE_DEBUG ("BTM: p_flow->delay_variation: 0x%02x",
2248                           qossu.flow.delay_variation);
2249         (*p_cb)(&qossu);
2250     }
2251 }
2252
2253
2254 /*******************************************************************************
2255 **
2256 ** Function         BTM_ReadRSSI
2257 **
2258 ** Description      This function is called to read the link policy settings.
2259 **                  The address of link policy results are returned in the callback.
2260 **                  (tBTM_RSSI_RESULTS)
2261 **
2262 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2263 **
2264 *******************************************************************************/
2265 tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2266 {
2267     tACL_CONN   *p;
2268     tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2269 #if BLE_INCLUDED == TRUE
2270     tBT_DEVICE_TYPE dev_type;
2271     tBLE_ADDR_TYPE  addr_type;
2272 #endif
2273     BTM_TRACE_API ("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2274                     remote_bda[0], remote_bda[1], remote_bda[2],
2275                     remote_bda[3], remote_bda[4], remote_bda[5]);
2276
2277     /* If someone already waiting on the version, do not allow another */
2278     if (btm_cb.devcb.p_rssi_cmpl_cb)
2279         return(BTM_BUSY);
2280
2281 #if BLE_INCLUDED == TRUE
2282     BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2283     if (dev_type == BT_DEVICE_TYPE_BLE)
2284         transport = BT_TRANSPORT_LE;
2285 #endif
2286
2287     p = btm_bda_to_acl(remote_bda, transport);
2288     if (p != (tACL_CONN *)NULL)
2289     {
2290         btu_start_timer (&btm_cb.devcb.rssi_timer, BTU_TTYPE_BTM_ACL,
2291                          BTM_DEV_REPLY_TIMEOUT);
2292
2293         btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
2294
2295         if (!btsnd_hcic_read_rssi (p->hci_handle))
2296         {
2297             btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2298             btu_stop_timer (&btm_cb.devcb.rssi_timer);
2299             return(BTM_NO_RESOURCES);
2300         }
2301         else
2302             return(BTM_CMD_STARTED);
2303     }
2304
2305     /* If here, no BD Addr found */
2306     return(BTM_UNKNOWN_ADDR);
2307 }
2308
2309 /*******************************************************************************
2310 **
2311 ** Function         BTM_ReadLinkQuality
2312 **
2313 ** Description      This function is called to read the link qulaity.
2314 **                  The value of the link quality is returned in the callback.
2315 **                  (tBTM_LINK_QUALITY_RESULTS)
2316 **
2317 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2318 **
2319 *******************************************************************************/
2320 tBTM_STATUS BTM_ReadLinkQuality (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2321 {
2322     tACL_CONN   *p;
2323
2324     BTM_TRACE_API ("BTM_ReadLinkQuality: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2325                     remote_bda[0], remote_bda[1], remote_bda[2],
2326                     remote_bda[3], remote_bda[4], remote_bda[5]);
2327
2328     /* If someone already waiting on the version, do not allow another */
2329     if (btm_cb.devcb.p_lnk_qual_cmpl_cb)
2330         return(BTM_BUSY);
2331
2332     p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
2333     if (p != (tACL_CONN *)NULL)
2334     {
2335         btu_start_timer (&btm_cb.devcb.lnk_quality_timer, BTU_TTYPE_BTM_ACL,
2336                          BTM_DEV_REPLY_TIMEOUT);
2337         btm_cb.devcb.p_lnk_qual_cmpl_cb = p_cb;
2338
2339         if (!btsnd_hcic_get_link_quality (p->hci_handle))
2340         {
2341             btu_stop_timer (&btm_cb.devcb.lnk_quality_timer);
2342             btm_cb.devcb.p_lnk_qual_cmpl_cb = NULL;
2343             return(BTM_NO_RESOURCES);
2344         }
2345         else
2346             return(BTM_CMD_STARTED);
2347     }
2348
2349     /* If here, no BD Addr found */
2350     return(BTM_UNKNOWN_ADDR);
2351 }
2352
2353 /*******************************************************************************
2354 **
2355 ** Function         BTM_ReadTxPower
2356 **
2357 ** Description      This function is called to read the current
2358 **                  TX power of the connection. The tx power level results
2359 **                  are returned in the callback.
2360 **                  (tBTM_RSSI_RESULTS)
2361 **
2362 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2363 **
2364 *******************************************************************************/
2365 tBTM_STATUS BTM_ReadTxPower (BD_ADDR remote_bda, tBT_TRANSPORT transport, tBTM_CMPL_CB *p_cb)
2366 {
2367     tACL_CONN   *p;
2368     BOOLEAN     ret;
2369 #define BTM_READ_RSSI_TYPE_CUR  0x00
2370 #define BTM_READ_RSSI_TYPE_MAX  0X01
2371
2372     BTM_TRACE_API ("BTM_ReadTxPower: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2373                     remote_bda[0], remote_bda[1], remote_bda[2],
2374                     remote_bda[3], remote_bda[4], remote_bda[5]);
2375
2376     /* If someone already waiting on the version, do not allow another */
2377     if (btm_cb.devcb.p_tx_power_cmpl_cb)
2378         return(BTM_BUSY);
2379
2380     p = btm_bda_to_acl(remote_bda, transport);
2381     if (p != (tACL_CONN *)NULL)
2382     {
2383         btu_start_timer (&btm_cb.devcb.tx_power_timer, BTU_TTYPE_BTM_ACL,
2384                          BTM_DEV_REPLY_TIMEOUT);
2385
2386         btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2387
2388 #if BLE_INCLUDED == TRUE
2389         if (p->transport == BT_TRANSPORT_LE)
2390         {
2391             memcpy(btm_cb.devcb.read_tx_pwr_addr, remote_bda, BD_ADDR_LEN);
2392             ret = btsnd_hcic_ble_read_adv_chnl_tx_power();
2393         }
2394         else
2395 #endif
2396         {
2397             ret = btsnd_hcic_read_tx_power (p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2398         }
2399         if (!ret)
2400         {
2401             btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2402             btu_stop_timer (&btm_cb.devcb.tx_power_timer);
2403             return(BTM_NO_RESOURCES);
2404         }
2405         else
2406             return(BTM_CMD_STARTED);
2407     }
2408
2409     /* If here, no BD Addr found */
2410     return (BTM_UNKNOWN_ADDR);
2411 }
2412 /*******************************************************************************
2413 **
2414 ** Function         btm_read_tx_power_complete
2415 **
2416 ** Description      This function is called when the command complete message
2417 **                  is received from the HCI for the read tx power request.
2418 **
2419 ** Returns          void
2420 **
2421 *******************************************************************************/
2422 void btm_read_tx_power_complete (UINT8 *p, BOOLEAN is_ble)
2423 {
2424     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2425     tBTM_TX_POWER_RESULTS   results;
2426     UINT16                   handle;
2427     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2428     UINT16                   index;
2429     BTM_TRACE_DEBUG ("btm_read_tx_power_complete");
2430     btu_stop_timer (&btm_cb.devcb.tx_power_timer);
2431
2432     /* If there was a callback registered for read rssi, call it */
2433     btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2434
2435     if (p_cb)
2436     {
2437         STREAM_TO_UINT8  (results.hci_status, p);
2438
2439         if (results.hci_status == HCI_SUCCESS)
2440         {
2441             results.status = BTM_SUCCESS;
2442
2443             if (!is_ble)
2444             {
2445                 STREAM_TO_UINT16 (handle, p);
2446                 STREAM_TO_UINT8 (results.tx_power, p);
2447
2448                 /* Search through the list of active channels for the correct BD Addr */
2449                 for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2450                 {
2451                     if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2452                     {
2453                         memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2454                         break;
2455                     }
2456                 }
2457             }
2458 #if BLE_INCLUDED == TRUE
2459             else
2460             {
2461                 STREAM_TO_UINT8 (results.tx_power, p);
2462                 memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN);
2463             }
2464 #endif
2465             BTM_TRACE_DEBUG ("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2466                                   results.tx_power, results.hci_status);
2467         }
2468         else
2469             results.status = BTM_ERR_PROCESSING;
2470
2471         (*p_cb)(&results);
2472     }
2473 }
2474
2475 /*******************************************************************************
2476 **
2477 ** Function         btm_read_rssi_complete
2478 **
2479 ** Description      This function is called when the command complete message
2480 **                  is received from the HCI for the read rssi request.
2481 **
2482 ** Returns          void
2483 **
2484 *******************************************************************************/
2485 void btm_read_rssi_complete (UINT8 *p)
2486 {
2487     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2488     tBTM_RSSI_RESULTS        results;
2489     UINT16                   handle;
2490     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2491     UINT16                   index;
2492     BTM_TRACE_DEBUG ("btm_read_rssi_complete");
2493     btu_stop_timer (&btm_cb.devcb.rssi_timer);
2494
2495     /* If there was a callback registered for read rssi, call it */
2496     btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2497
2498     if (p_cb)
2499     {
2500         STREAM_TO_UINT8  (results.hci_status, p);
2501
2502         if (results.hci_status == HCI_SUCCESS)
2503         {
2504             results.status = BTM_SUCCESS;
2505
2506             STREAM_TO_UINT16 (handle, p);
2507
2508             STREAM_TO_UINT8 (results.rssi, p);
2509             BTM_TRACE_DEBUG ("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2510                               results.rssi, results.hci_status);
2511
2512             /* Search through the list of active channels for the correct BD Addr */
2513             for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2514             {
2515                 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2516                 {
2517                     memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2518                     break;
2519                 }
2520             }
2521         }
2522         else
2523             results.status = BTM_ERR_PROCESSING;
2524
2525         (*p_cb)(&results);
2526     }
2527 }
2528
2529 /*******************************************************************************
2530 **
2531 ** Function         btm_read_link_quality_complete
2532 **
2533 ** Description      This function is called when the command complete message
2534 **                  is received from the HCI for the read link quality.
2535 **
2536 ** Returns          void
2537 **
2538 *******************************************************************************/
2539 void btm_read_link_quality_complete (UINT8 *p)
2540 {
2541     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_lnk_qual_cmpl_cb;
2542     tBTM_LINK_QUALITY_RESULTS results;
2543     UINT16                   handle;
2544     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2545     UINT16                   index;
2546     BTM_TRACE_DEBUG ("btm_read_link_quality_complete");
2547     btu_stop_timer (&btm_cb.devcb.lnk_quality_timer);
2548
2549     /* If there was a callback registered for read rssi, call it */
2550     btm_cb.devcb.p_lnk_qual_cmpl_cb = NULL;
2551
2552     if (p_cb)
2553     {
2554         STREAM_TO_UINT8  (results.hci_status, p);
2555
2556         if (results.hci_status == HCI_SUCCESS)
2557         {
2558             results.status = BTM_SUCCESS;
2559
2560             STREAM_TO_UINT16 (handle, p);
2561
2562             STREAM_TO_UINT8 (results.link_quality, p);
2563             BTM_TRACE_DEBUG ("BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2564                               results.link_quality, results.hci_status);
2565
2566             /* Search through the list of active channels for the correct BD Addr */
2567             for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2568             {
2569                 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2570                 {
2571                     memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2572                     break;
2573                 }
2574             }
2575         }
2576         else
2577             results.status = BTM_ERR_PROCESSING;
2578
2579         (*p_cb)(&results);
2580     }
2581 }
2582
2583 /*******************************************************************************
2584 **
2585 ** Function         btm_remove_acl
2586 **
2587 ** Description      This function is called to disconnect an ACL connection
2588 **
2589 ** Returns          BTM_SUCCESS if successfully initiated, otherwise BTM_NO_RESOURCES.
2590 **
2591 *******************************************************************************/
2592 tBTM_STATUS btm_remove_acl (BD_ADDR bd_addr, tBT_TRANSPORT transport)
2593 {
2594     UINT16  hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2595     tBTM_STATUS status = BTM_SUCCESS;
2596
2597     BTM_TRACE_DEBUG ("btm_remove_acl");
2598 #if BTM_DISC_DURING_RS == TRUE
2599     tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_dev (bd_addr);
2600
2601     /* Role Switch is pending, postpone until completed */
2602     if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING))
2603     {
2604         p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2605     }
2606     else    /* otherwise can disconnect right away */
2607 #endif
2608     {
2609         if (hci_handle != 0xFFFF && p_dev_rec &&
2610              p_dev_rec->sec_state!= BTM_SEC_STATE_DISCONNECTING)
2611         {
2612             if (!btsnd_hcic_disconnect (hci_handle, HCI_ERR_PEER_USER))
2613                 status = BTM_NO_RESOURCES;
2614         }
2615         else
2616             status = BTM_UNKNOWN_ADDR;
2617     }
2618
2619     return status;
2620 }
2621
2622
2623 /*******************************************************************************
2624 **
2625 ** Function         BTM_SetTraceLevel
2626 **
2627 ** Description      This function sets the trace level for BTM.  If called with
2628 **                  a value of 0xFF, it simply returns the current trace level.
2629 **
2630 ** Returns          The new or current trace level
2631 **
2632 *******************************************************************************/
2633 UINT8 BTM_SetTraceLevel (UINT8 new_level)
2634 {
2635     BTM_TRACE_DEBUG ("BTM_SetTraceLevel");
2636     if (new_level != 0xFF)
2637         btm_cb.trace_level = new_level;
2638
2639     return(btm_cb.trace_level);
2640 }
2641
2642 /*******************************************************************************
2643 **
2644 ** Function         btm_cont_rswitch
2645 **
2646 ** Description      This function is called to continue processing an active
2647 **                  role switch. It first disables encryption if enabled and
2648 **                  EPR is not supported
2649 **
2650 ** Returns          void
2651 **
2652 *******************************************************************************/
2653 void btm_cont_rswitch (tACL_CONN *p, tBTM_SEC_DEV_REC *p_dev_rec,
2654                                      UINT8 hci_status)
2655 {
2656     BOOLEAN sw_ok = TRUE;
2657     BTM_TRACE_DEBUG ("btm_cont_rswitch");
2658     /* Check to see if encryption needs to be turned off if pending
2659        change of link key or role switch */
2660     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2661     {
2662         /* Must turn off Encryption first if necessary */
2663         /* Some devices do not support switch or change of link key while encryption is on */
2664         if (p_dev_rec != NULL && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0)
2665             && !BTM_EPR_AVAILABLE(p))
2666         {
2667             if (btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
2668             {
2669                 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2670                 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2671                     p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2672             }
2673             else
2674             {
2675                 /* Error occurred; set states back to Idle */
2676                 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2677                     sw_ok = FALSE;
2678             }
2679         }
2680         else    /* Encryption not used or EPR supported, continue with switch
2681                    and/or change of link key */
2682         {
2683             if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2684             {
2685                 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2686 #if BTM_DISC_DURING_RS == TRUE
2687                 if (p_dev_rec)
2688                     p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2689 #endif
2690                 sw_ok = btsnd_hcic_switch_role (p->remote_addr, (UINT8)!p->link_role);
2691             }
2692         }
2693
2694         if (!sw_ok)
2695         {
2696             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
2697             btm_acl_report_role_change(hci_status, p->remote_addr);
2698         }
2699     }
2700 }
2701
2702 /*******************************************************************************
2703 **
2704 ** Function         btm_acl_resubmit_page
2705 **
2706 ** Description      send pending page request
2707 **
2708 *******************************************************************************/
2709 void btm_acl_resubmit_page (void)
2710 {
2711     tBTM_SEC_DEV_REC *p_dev_rec;
2712     BT_HDR  *p_buf;
2713     UINT8   *pp;
2714     BD_ADDR bda;
2715     BTM_TRACE_DEBUG ("btm_acl_resubmit_page");
2716     /* If there were other page request schedule can start the next one */
2717     if ((p_buf = (BT_HDR *)GKI_dequeue (&btm_cb.page_queue)) != NULL)
2718     {
2719         /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2720          * for both create_conn and rmt_name */
2721         pp = (UINT8 *)(p_buf + 1) + p_buf->offset + 3;
2722
2723         STREAM_TO_BDADDR (bda, pp);
2724
2725         p_dev_rec = btm_find_or_alloc_dev (bda);
2726
2727         memcpy (btm_cb.connecting_bda, p_dev_rec->bd_addr,   BD_ADDR_LEN);
2728         memcpy (btm_cb.connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);
2729
2730         btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2731     }
2732     else
2733         btm_cb.paging = FALSE;
2734 }
2735
2736 /*******************************************************************************
2737 **
2738 ** Function         btm_acl_reset_paging
2739 **
2740 ** Description      set paging to FALSE and free the page queue - called at hci_reset
2741 **
2742 *******************************************************************************/
2743 void  btm_acl_reset_paging (void)
2744 {
2745     BT_HDR *p;
2746     BTM_TRACE_DEBUG ("btm_acl_reset_paging");
2747     /* If we sent reset we are definitely not paging any more */
2748     while ((p = (BT_HDR *)GKI_dequeue(&btm_cb.page_queue)) != NULL)
2749         GKI_freebuf (p);
2750
2751     btm_cb.paging = FALSE;
2752 }
2753
2754 /*******************************************************************************
2755 **
2756 ** Function         btm_acl_set_discing
2757 **
2758 ** Description      set discing to the given value
2759 **
2760 *******************************************************************************/
2761 void  btm_acl_set_discing (BOOLEAN discing)
2762 {
2763     BTM_TRACE_DEBUG ("btm_acl_set_discing");
2764     btm_cb.discing = discing;
2765 }
2766
2767 /*******************************************************************************
2768 **
2769 ** Function         btm_acl_paging
2770 **
2771 ** Description      send a paging command or queue it in btm_cb
2772 **
2773 *******************************************************************************/
2774 void  btm_acl_paging (BT_HDR *p, BD_ADDR bda)
2775 {
2776     tBTM_SEC_DEV_REC *p_dev_rec;
2777
2778     BTM_TRACE_DEBUG ("btm_acl_paging discing:%d, paging:%d BDA: %06x%06x",
2779                       btm_cb.discing, btm_cb.paging,
2780                       (bda[0]<<16) + (bda[1]<<8) + bda[2], (bda[3]<<16) + (bda[4] << 8) + bda[5]);
2781     if (btm_cb.discing)
2782     {
2783         btm_cb.paging = TRUE;
2784         GKI_enqueue (&btm_cb.page_queue, p);
2785     }
2786     else
2787     {
2788         if (!BTM_ACL_IS_CONNECTED (bda))
2789         {
2790             BTM_TRACE_DEBUG ("connecting_bda: %06x%06x",
2791                               (btm_cb.connecting_bda[0]<<16) + (btm_cb.connecting_bda[1]<<8) +
2792                                btm_cb.connecting_bda[2],
2793                               (btm_cb.connecting_bda[3]<<16) + (btm_cb.connecting_bda[4] << 8) +
2794                                btm_cb.connecting_bda[5]);
2795             if (btm_cb.paging &&
2796                 memcmp (bda, btm_cb.connecting_bda, BD_ADDR_LEN) != 0)
2797             {
2798                 GKI_enqueue (&btm_cb.page_queue, p);
2799             }
2800             else
2801             {
2802                 p_dev_rec = btm_find_or_alloc_dev (bda);
2803                 memcpy (btm_cb.connecting_bda, p_dev_rec->bd_addr,   BD_ADDR_LEN);
2804                 memcpy (btm_cb.connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);
2805
2806                 btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
2807             }
2808
2809             btm_cb.paging = TRUE;
2810         }
2811         else /* ACL is already up */
2812         {
2813             btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
2814         }
2815     }
2816 }
2817
2818 /*******************************************************************************
2819 **
2820 ** Function         btm_acl_notif_conn_collision
2821 **
2822 ** Description      Send connection collision event to upper layer if registered
2823 **
2824 ** Returns          TRUE if sent out to upper layer,
2825 **                  FALSE if no one needs the notification.
2826 **
2827 *******************************************************************************/
2828 BOOLEAN  btm_acl_notif_conn_collision (BD_ADDR bda)
2829 {
2830     tBTM_BL_EVENT_DATA  evt_data;
2831
2832     /* Report possible collision to the upper layer. */
2833     if (btm_cb.p_bl_changed_cb)
2834     {
2835         BTM_TRACE_DEBUG ("btm_acl_notif_conn_collision: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2836                           bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
2837
2838         evt_data.event = BTM_BL_COLLISION_EVT;
2839         evt_data.conn.p_bda = bda;
2840
2841 #if BLE_INCLUDED == TRUE
2842         evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2843         evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2844 #endif
2845         (*btm_cb.p_bl_changed_cb)(&evt_data);
2846         return TRUE;
2847     }
2848     else
2849         return FALSE;
2850 }
2851
2852
2853 /*******************************************************************************
2854 **
2855 ** Function         btm_acl_chk_peer_pkt_type_support
2856 **
2857 ** Description      Check if peer supports requested packets
2858 **
2859 *******************************************************************************/
2860 void btm_acl_chk_peer_pkt_type_support (tACL_CONN *p, UINT16 *p_pkt_type)
2861 {
2862     /* 3 and 5 slot packets? */
2863     if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2864         *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 +BTM_ACL_PKT_TYPES_MASK_DM3);
2865
2866     if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2867         *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2868
2869     /* 2 and 3 MPS support? */
2870     if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2871         /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2872         *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2873                             BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2874
2875     if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2876         /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2877         *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2878                             BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2879
2880     /* EDR 3 and 5 slot support? */
2881     if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])
2882      || HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2883     {
2884         if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2885             /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types */
2886             *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2887
2888         if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2889             /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types */
2890             *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2891     }
2892 }