stack/btm/btm_acl.c

   1 /******************************************************************************
   2  *
   3  *  Copyright (C) 2000-2012 Broadcom Corporation
   4  *
   5  *  Licensed under the Apache License, Version 2.0 (the "License");
   6  *  you may not use this file except in compliance with the License.
   7  *  You may obtain a copy of the License at:
   8  *
   9  *  http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  *  Unless required by applicable law or agreed to in writing, software
  12  *  distributed under the License is distributed on an "AS IS" BASIS,
  13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  *  See the License for the specific language governing permissions and
  15  *  limitations under the License.
  16  *
  17  ******************************************************************************/
  18
  19 /*****************************************************************************
  20 **
  21 **  Name:          btm_acl.c
  22 **
  23 **  Description:   This file contains functions that handle ACL connections.
  24 **                 This includes operations such as hold and sniff modes,
  25 **                 supported packet types.
  26 **
  27 **                 This module contains both internal and external (API)
  28 **                 functions. External (API) functions are distinguishable
  29 **                 by their names beginning with uppercase BTM.
  30 **
  31 **
  32 ******************************************************************************/
  33
  34 #include <stdlib.h>
  35 #include <string.h>
  36 #include <stdio.h>
  37 #include <stddef.h>
  38
  39 #include "bt_types.h"
  40 #include "bt_target.h"
  41 #include "device/include/controller.h"
  42 #include "bt_common.h"
  43 #include "hcimsgs.h"
  44 #include "btu.h"
  45 #include "btm_api.h"
  46 #include "btm_int.h"
  47 #include "l2c_int.h"
  48 #include "hcidefs.h"
  49 #include "bt_utils.h"
  50
  51
  52 extern fixed_queue_t *btu_general_alarm_queue;
  53
  54 static void btm_read_remote_features (UINT16 handle);
  55 static void btm_read_remote_ext_features (UINT16 handle, UINT8 page_number);
  56 static void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages);
  57
  58 /* 3 seconds timeout waiting for responses */
  59 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
  60
  61 /*******************************************************************************
  62 **
  63 ** Function         btm_acl_init
  64 **
  65 ** Description      This function is called at BTM startup to initialize
  66 **
  67 ** Returns          void
  68 **
  69 *******************************************************************************/
  70 void btm_acl_init (void)
  71 {
  72     BTM_TRACE_DEBUG ("btm_acl_init");
  73 #if 0  /* cleared in btm_init; put back in if called from anywhere else! */
  74     memset (&btm_cb.acl_db, 0, sizeof (btm_cb.acl_db));
  75     memset (btm_cb.btm_scn, 0, BTM_MAX_SCN);          /* Initialize the SCN usage to FALSE */
  76     btm_cb.btm_def_link_policy     = 0;
  77     btm_cb.p_bl_changed_cb         = NULL;
  78 #endif
  79
  80     /* Initialize nonzero defaults */
  81     btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
  82     btm_cb.acl_disc_reason         = 0xff ;
  83 }
  84
  85 /*******************************************************************************
  86 **
  87 ** Function         btm_bda_to_acl
  88 **
  89 ** Description      This function returns the FIRST acl_db entry for the passed BDA.
  90 **
  91 ** Parameters      bda : BD address of the remote device
  92 **                 transport : Physical transport used for ACL connection (BR/EDR or LE)
  93 **
  94 ** Returns          Returns pointer to the ACL DB for the requested BDA if found.
  95 **                  NULL if not found.
  96 **
  97 *******************************************************************************/
  98 tACL_CONN *btm_bda_to_acl (const BD_ADDR bda, tBT_TRANSPORT transport)
  99 {
 100     tACL_CONN   *p = &btm_cb.acl_db[0];
 101     UINT16       xx;
 102     if (bda)
 103     {
 104         for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
 105         {
 106             if ((p->in_use) && (!memcmp (p->remote_addr, bda, BD_ADDR_LEN))
 107 #if BLE_INCLUDED == TRUE
 108                 && p->transport == transport
 109 #endif
 110                 )
 111             {
 112                 BTM_TRACE_DEBUG ("btm_bda_to_acl found");
 113                 return(p);
 114             }
 115         }
 116     }
 117
 118     /* If here, no BD Addr found */
 119     return((tACL_CONN *)NULL);
 120 }
 121
 122 /*******************************************************************************
 123 **
 124 ** Function         btm_handle_to_acl_index
 125 **
 126 ** Description      This function returns the FIRST acl_db entry for the passed hci_handle.
 127 **
 128 ** Returns          index to the acl_db or MAX_L2CAP_LINKS.
 129 **
 130 *******************************************************************************/
 131 UINT8 btm_handle_to_acl_index (UINT16 hci_handle)
 132 {
 133     tACL_CONN   *p = &btm_cb.acl_db[0];
 134     UINT8       xx;
 135     BTM_TRACE_DEBUG ("btm_handle_to_acl_index");
 136     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
 137     {
 138         if ((p->in_use) && (p->hci_handle == hci_handle))
 139         {
 140             break;
 141         }
 142     }
 143
 144     /* If here, no BD Addr found */
 145     return(xx);
 146 }
 147
 148 #if BLE_PRIVACY_SPT == TRUE
 149 /*******************************************************************************
 150 **
 151 ** Function         btm_ble_get_acl_remote_addr
 152 **
 153 ** Description      This function reads the active remote address used for the
 154 **                  connection.
 155 **
 156 ** Returns          success return TRUE, otherwise FALSE.
 157 **
 158 *******************************************************************************/
 159 BOOLEAN btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC *p_dev_rec, BD_ADDR conn_addr,
 160                                     tBLE_ADDR_TYPE *p_addr_type)
 161 {
 162 #if BLE_INCLUDED == TRUE
 163     BOOLEAN         st = TRUE;
 164
 165     if (p_dev_rec == NULL)
 166     {
 167         BTM_TRACE_ERROR("btm_ble_get_acl_remote_addr can not find device with matching address");
 168         return FALSE;
 169     }
 170
 171     switch (p_dev_rec->ble.active_addr_type)
 172     {
 173     case BTM_BLE_ADDR_PSEUDO:
 174         memcpy(conn_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
 175         * p_addr_type = p_dev_rec->ble.ble_addr_type;
 176         break;
 177
 178     case BTM_BLE_ADDR_RRA:
 179         memcpy(conn_addr, p_dev_rec->ble.cur_rand_addr, BD_ADDR_LEN);
 180         * p_addr_type = BLE_ADDR_RANDOM;
 181         break;
 182
 183     case BTM_BLE_ADDR_STATIC:
 184         memcpy(conn_addr, p_dev_rec->ble.static_addr, BD_ADDR_LEN);
 185         * p_addr_type = p_dev_rec->ble.static_addr_type;
 186         break;
 187
 188     default:
 189         BTM_TRACE_ERROR("Unknown active address: %d", p_dev_rec->ble.active_addr_type);
 190         st = FALSE;
 191         break;
 192     }
 193
 194     return st;
 195 #else
 196     UNUSED(p_dev_rec);
 197     UNUSED(conn_addr);
 198     UNUSED(p_addr_type);
 199     return FALSE;
 200 #endif
 201 }
 202 #endif
 203 /*******************************************************************************
 204 **
 205 ** Function         btm_acl_created
 206 **
 207 ** Description      This function is called by L2CAP when an ACL connection
 208 **                  is created.
 209 **
 210 ** Returns          void
 211 **
 212 *******************************************************************************/
 213 void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
 214                       UINT16 hci_handle, UINT8 link_role, tBT_TRANSPORT transport)
 215 {
 216     tBTM_SEC_DEV_REC *p_dev_rec = NULL;
 217     tACL_CONN        *p;
 218     UINT8             xx;
 219
 220     BTM_TRACE_DEBUG ("btm_acl_created hci_handle=%d link_role=%d  transport=%d",
 221                       hci_handle,link_role, transport);
 222     /* Ensure we don't have duplicates */
 223     p = btm_bda_to_acl(bda, transport);
 224     if (p != (tACL_CONN *)NULL)
 225     {
 226         p->hci_handle = hci_handle;
 227         p->link_role  = link_role;
 228 #if BLE_INCLUDED == TRUE
 229         p->transport = transport;
 230 #endif
 231         BTM_TRACE_DEBUG ("Duplicate btm_acl_created: RemBdAddr: %02x%02x%02x%02x%02x%02x",
 232                           bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
 233         BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
 234         return;
 235     }
 236
 237     /* Allocate acl_db entry */
 238     for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++)
 239     {
 240         if (!p->in_use)
 241         {
 242             p->in_use            = TRUE;
 243             p->hci_handle        = hci_handle;
 244             p->link_role         = link_role;
 245             p->link_up_issued    = FALSE;
 246             memcpy (p->remote_addr, bda, BD_ADDR_LEN);
 247
 248 #if BLE_INCLUDED == TRUE
 249             p->transport = transport;
 250 #if BLE_PRIVACY_SPT == TRUE
 251             if (transport == BT_TRANSPORT_LE)
 252                 btm_ble_refresh_local_resolvable_private_addr(bda,
 253                                                     btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
 254 #else
 255             p->conn_addr_type = BLE_ADDR_PUBLIC;
 256             memcpy(p->conn_addr, &controller_get_interface()->get_address()->address, BD_ADDR_LEN);
 257
 258 #endif
 259 #endif
 260             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 261
 262             btm_pm_sm_alloc(xx);
 263
 264
 265             if (dc)
 266                 memcpy (p->remote_dc, dc, DEV_CLASS_LEN);
 267
 268             if (bdn)
 269                 memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
 270
 271             /* if BR/EDR do something more */
 272             if (transport == BT_TRANSPORT_BR_EDR)
 273             {
 274                 btsnd_hcic_read_rmt_clk_offset (p->hci_handle);
 275                 btsnd_hcic_rmt_ver_req (p->hci_handle);
 276             }
 277             p_dev_rec = btm_find_dev_by_handle (hci_handle);
 278
 279 #if (BLE_INCLUDED == TRUE)
 280             if (p_dev_rec )
 281             {
 282                 BTM_TRACE_DEBUG ("device_type=0x%x", p_dev_rec->device_type);
 283             }
 284 #endif
 285
 286             if (p_dev_rec && !(transport == BT_TRANSPORT_LE))
 287             {
 288                 /* If remote features already known, copy them and continue connection setup */
 289                 if ((p_dev_rec->num_read_pages) &&
 290                     (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1)))
 291                 {
 292                     memcpy (p->peer_lmp_features, p_dev_rec->features,
 293                         (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
 294                     p->num_read_pages = p_dev_rec->num_read_pages;
 295
 296                     const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 297
 298                     /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
 299                     btm_sec_set_peer_sec_caps(p, p_dev_rec);
 300
 301                     BTM_TRACE_API("%s: pend:%d", __FUNCTION__, req_pend);
 302                     if (req_pend)
 303                     {
 304                         /* Request for remaining Security Features (if any) */
 305                         l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
 306                     }
 307                     btm_establish_continue (p);
 308                     return;
 309                 }
 310             }
 311
 312 #if (BLE_INCLUDED == TRUE)
 313             /* If here, features are not known yet */
 314             if (p_dev_rec && transport == BT_TRANSPORT_LE)
 315             {
 316 #if BLE_PRIVACY_SPT == TRUE
 317                 btm_ble_get_acl_remote_addr (p_dev_rec, p->active_remote_addr,
 318                     &p->active_remote_addr_type);
 319 #endif
 320
 321                 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(controller_get_interface()->get_features_ble()->as_array)
 322                     || link_role == HCI_ROLE_MASTER)
 323                 {
 324                     btsnd_hcic_ble_read_remote_feat(p->hci_handle);
 325                 }
 326                 else
 327                 {
 328                     btm_establish_continue(p);
 329                 }
 330             }
 331             else
 332 #endif
 333             {
 334                 btm_read_remote_features (p->hci_handle);
 335             }
 336
 337             /* read page 1 - on rmt feature event for buffer reasons */
 338             return;
 339         }
 340     }
 341 }
 342
 343
 344 /*******************************************************************************
 345 **
 346 ** Function         btm_acl_report_role_change
 347 **
 348 ** Description      This function is called when the local device is deemed
 349 **                  to be down. It notifies L2CAP of the failure.
 350 **
 351 ** Returns          void
 352 **
 353 *******************************************************************************/
 354 void btm_acl_report_role_change (UINT8 hci_status, BD_ADDR bda)
 355 {
 356     tBTM_ROLE_SWITCH_CMPL   ref_data;
 357     BTM_TRACE_DEBUG ("btm_acl_report_role_change");
 358     if (btm_cb.devcb.p_switch_role_cb
 359         && (bda && (0 == memcmp(btm_cb.devcb.switch_role_ref_data.remote_bd_addr, bda, BD_ADDR_LEN))))
 360     {
 361         memcpy (&ref_data, &btm_cb.devcb.switch_role_ref_data, sizeof(tBTM_ROLE_SWITCH_CMPL));
 362         ref_data.hci_status = hci_status;
 363         (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
 364         memset (&btm_cb.devcb.switch_role_ref_data, 0, sizeof(tBTM_ROLE_SWITCH_CMPL));
 365         btm_cb.devcb.p_switch_role_cb = NULL;
 366     }
 367 }
 368
 369 /*******************************************************************************
 370 **
 371 ** Function         btm_acl_removed
 372 **
 373 ** Description      This function is called by L2CAP when an ACL connection
 374 **                  is removed. Since only L2CAP creates ACL links, we use
 375 **                  the L2CAP link index as our index into the control blocks.
 376 **
 377 ** Returns          void
 378 **
 379 *******************************************************************************/
 380 void btm_acl_removed (BD_ADDR bda, tBT_TRANSPORT transport)
 381 {
 382     tACL_CONN   *p;
 383     tBTM_BL_EVENT_DATA  evt_data;
 384 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
 385     tBTM_SEC_DEV_REC *p_dev_rec=NULL;
 386 #endif
 387     BTM_TRACE_DEBUG ("btm_acl_removed");
 388     p = btm_bda_to_acl(bda, transport);
 389     if (p != (tACL_CONN *)NULL)
 390     {
 391         p->in_use = FALSE;
 392
 393         /* if the disconnected channel has a pending role switch, clear it now */
 394         btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, bda);
 395
 396         /* Only notify if link up has had a chance to be issued */
 397         if (p->link_up_issued)
 398         {
 399             p->link_up_issued = FALSE;
 400
 401             /* If anyone cares, tell him database changed */
 402             if (btm_cb.p_bl_changed_cb)
 403             {
 404                 evt_data.event = BTM_BL_DISCN_EVT;
 405                 evt_data.discn.p_bda = bda;
 406 #if BLE_INCLUDED == TRUE
 407                 evt_data.discn.handle = p->hci_handle;
 408                 evt_data.discn.transport = p->transport;
 409 #endif
 410                 (*btm_cb.p_bl_changed_cb)(&evt_data);
 411             }
 412
 413             btm_acl_update_busy_level (BTM_BLI_ACL_DOWN_EVT);
 414         }
 415
 416 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
 417
 418         BTM_TRACE_DEBUG ("acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
 419                           p->hci_handle,
 420                           p->transport,
 421                           btm_cb.ble_ctr_cb.inq_var.connectable_mode,
 422                           p->link_role);
 423
 424         p_dev_rec = btm_find_dev(bda);
 425         if ( p_dev_rec)
 426         {
 427             BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
 428             if (p->transport == BT_TRANSPORT_LE)
 429             {
 430                 BTM_TRACE_DEBUG("LE link down");
 431                 p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
 432                 if ( (p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0)
 433                 {
 434                     BTM_TRACE_DEBUG("Not Bonded");
 435                     p_dev_rec->sec_flags &= ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
 436                 }
 437                 else
 438                 {
 439                     BTM_TRACE_DEBUG("Bonded");
 440                 }
 441             }
 442             else
 443             {
 444                 BTM_TRACE_DEBUG("Bletooth link down");
 445                 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED
 446                                         | BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
 447             }
 448             BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
 449         }
 450         else
 451         {
 452             BTM_TRACE_ERROR("Device not found");
 453
 454         }
 455 #endif
 456
 457         /* Clear the ACL connection data */
 458         memset(p, 0, sizeof(tACL_CONN));
 459     }
 460 }
 461
 462
 463 /*******************************************************************************
 464 **
 465 ** Function         btm_acl_device_down
 466 **
 467 ** Description      This function is called when the local device is deemed
 468 **                  to be down. It notifies L2CAP of the failure.
 469 **
 470 ** Returns          void
 471 **
 472 *******************************************************************************/
 473 void btm_acl_device_down (void)
 474 {
 475     tACL_CONN   *p = &btm_cb.acl_db[0];
 476     UINT16      xx;
 477     BTM_TRACE_DEBUG ("btm_acl_device_down");
 478     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
 479     {
 480         if (p->in_use)
 481         {
 482             BTM_TRACE_DEBUG ("hci_handle=%d HCI_ERR_HW_FAILURE ",p->hci_handle );
 483             l2c_link_hci_disc_comp (p->hci_handle, HCI_ERR_HW_FAILURE);
 484         }
 485     }
 486 }
 487
 488 /*******************************************************************************
 489 **
 490 ** Function         btm_acl_update_busy_level
 491 **
 492 ** Description      This function is called to update the busy level of the system
 493 **                  .
 494 **
 495 ** Returns          void
 496 **
 497 *******************************************************************************/
 498 void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
 499 {
 500     tBTM_BL_UPDATE_DATA  evt;
 501     UINT8 busy_level;
 502     BTM_TRACE_DEBUG ("btm_acl_update_busy_level");
 503     BOOLEAN old_inquiry_state = btm_cb.is_inquiry;
 504     switch (event)
 505     {
 506         case BTM_BLI_ACL_UP_EVT:
 507             BTM_TRACE_DEBUG ("BTM_BLI_ACL_UP_EVT");
 508             break;
 509         case BTM_BLI_ACL_DOWN_EVT:
 510             BTM_TRACE_DEBUG ("BTM_BLI_ACL_DOWN_EVT");
 511             break;
 512         case BTM_BLI_PAGE_EVT:
 513             BTM_TRACE_DEBUG ("BTM_BLI_PAGE_EVT");
 514             btm_cb.is_paging = TRUE;
 515             evt.busy_level_flags= BTM_BL_PAGING_STARTED;
 516             break;
 517         case BTM_BLI_PAGE_DONE_EVT:
 518             BTM_TRACE_DEBUG ("BTM_BLI_PAGE_DONE_EVT");
 519             btm_cb.is_paging = FALSE;
 520             evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
 521             break;
 522         case BTM_BLI_INQ_EVT:
 523             BTM_TRACE_DEBUG ("BTM_BLI_INQ_EVT");
 524             btm_cb.is_inquiry = TRUE;
 525             evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
 526             break;
 527         case BTM_BLI_INQ_CANCEL_EVT:
 528             BTM_TRACE_DEBUG ("BTM_BLI_INQ_CANCEL_EVT");
 529             btm_cb.is_inquiry = FALSE;
 530             evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
 531             break;
 532         case BTM_BLI_INQ_DONE_EVT:
 533             BTM_TRACE_DEBUG ("BTM_BLI_INQ_DONE_EVT");
 534             btm_cb.is_inquiry = FALSE;
 535             evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
 536             break;
 537     }
 538
 539     if (btm_cb.is_paging || btm_cb.is_inquiry)
 540         busy_level = 10;
 541     else
 542         busy_level = BTM_GetNumAclLinks();
 543
 544     if ((busy_level != btm_cb.busy_level) ||(old_inquiry_state != btm_cb.is_inquiry))
 545     {
 546         evt.event         = BTM_BL_UPDATE_EVT;
 547         evt.busy_level    = busy_level;
 548         btm_cb.busy_level = busy_level;
 549         if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK))
 550         {
 551             (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
 552         }
 553     }
 554 }
 555
 556 /*******************************************************************************
 557 **
 558 ** Function         BTM_GetRole
 559 **
 560 ** Description      This function is called to get the role of the local device
 561 **                  for the ACL connection with the specified remote device
 562 **
 563 ** Returns          BTM_SUCCESS if connection exists.
 564 **                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
 565 **
 566 *******************************************************************************/
 567 tBTM_STATUS BTM_GetRole (BD_ADDR remote_bd_addr, UINT8 *p_role)
 568 {
 569     tACL_CONN   *p;
 570     BTM_TRACE_DEBUG ("BTM_GetRole");
 571     if ((p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
 572     {
 573         *p_role = BTM_ROLE_UNDEFINED;
 574         return(BTM_UNKNOWN_ADDR);
 575     }
 576
 577     /* Get the current role */
 578     *p_role = p->link_role;
 579     return(BTM_SUCCESS);
 580 }
 581
 582
 583 /*******************************************************************************
 584 **
 585 ** Function         BTM_SwitchRole
 586 **
 587 ** Description      This function is called to switch role between master and
 588 **                  slave.  If role is already set it will do nothing.  If the
 589 **                  command was initiated, the callback function is called upon
 590 **                  completion.
 591 **
 592 ** Returns          BTM_SUCCESS if already in specified role.
 593 **                  BTM_CMD_STARTED if command issued to controller.
 594 **                  BTM_NO_RESOURCES if couldn't allocate memory to issue command
 595 **                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
 596 **                  BTM_MODE_UNSUPPORTED if local device does not support role switching
 597 **                  BTM_BUSY if the previous command is not completed
 598 **
 599 *******************************************************************************/
 600 tBTM_STATUS BTM_SwitchRole (BD_ADDR remote_bd_addr, UINT8 new_role, tBTM_CMPL_CB *p_cb)
 601 {
 602     tACL_CONN   *p;
 603     tBTM_SEC_DEV_REC  *p_dev_rec = NULL;
 604 #if BTM_SCO_INCLUDED == TRUE
 605     BOOLEAN    is_sco_active;
 606 #endif
 607     tBTM_STATUS  status;
 608     tBTM_PM_MODE pwr_mode;
 609     tBTM_PM_PWR_MD settings;
 610 #if (BT_USE_TRACES == TRUE)
 611     BD_ADDR_PTR  p_bda;
 612 #endif
 613     BTM_TRACE_API ("BTM_SwitchRole BDA: %02x-%02x-%02x-%02x-%02x-%02x",
 614                     remote_bd_addr[0], remote_bd_addr[1], remote_bd_addr[2],
 615                     remote_bd_addr[3], remote_bd_addr[4], remote_bd_addr[5]);
 616
 617     /* Make sure the local device supports switching */
 618     if (!controller_get_interface()->supports_master_slave_role_switch())
 619         return(BTM_MODE_UNSUPPORTED);
 620
 621     if (btm_cb.devcb.p_switch_role_cb && p_cb)
 622     {
 623 #if (BT_USE_TRACES == TRUE)
 624         p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
 625         BTM_TRACE_DEBUG ("Role switch on other device is in progress 0x%02x%02x%02x%02x%02x%02x",
 626                           p_bda[0], p_bda[1], p_bda[2],
 627                           p_bda[3], p_bda[4], p_bda[5]);
 628 #endif
 629         return(BTM_BUSY);
 630     }
 631
 632     if ((p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR)) == NULL)
 633         return(BTM_UNKNOWN_ADDR);
 634
 635     /* Finished if already in desired role */
 636     if (p->link_role == new_role)
 637         return(BTM_SUCCESS);
 638
 639 #if BTM_SCO_INCLUDED == TRUE
 640     /* Check if there is any SCO Active on this BD Address */
 641     is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
 642
 643     if (is_sco_active == TRUE)
 644         return(BTM_NO_RESOURCES);
 645 #endif
 646
 647     /* Ignore role switch request if the previous request was not completed */
 648     if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE)
 649     {
 650         BTM_TRACE_DEBUG ("BTM_SwitchRole busy: %d",
 651                           p->switch_role_state);
 652         return(BTM_BUSY);
 653     }
 654
 655     if ((status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode)) != BTM_SUCCESS)
 656         return(status);
 657
 658     /* Wake up the link if in sniff or park before attempting switch */
 659     if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF)
 660     {
 661         memset( (void*)&settings, 0, sizeof(settings));
 662         settings.mode = BTM_PM_MD_ACTIVE;
 663         status = BTM_SetPowerMode (BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
 664         if (status != BTM_CMD_STARTED)
 665             return(BTM_WRONG_MODE);
 666
 667         p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
 668     }
 669     /* some devices do not support switch while encryption is on */
 670     else
 671     {
 672         p_dev_rec = btm_find_dev (remote_bd_addr);
 673         if ((p_dev_rec != NULL)
 674             && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0)
 675             && !BTM_EPR_AVAILABLE(p))
 676         {
 677             /* bypass turning off encryption if change link key is already doing it */
 678             if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF)
 679             {
 680                 if (!btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
 681                     return(BTM_NO_RESOURCES);
 682                 else
 683                     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
 684             }
 685
 686             p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
 687         }
 688         else
 689         {
 690             if (!btsnd_hcic_switch_role (remote_bd_addr, new_role))
 691                 return(BTM_NO_RESOURCES);
 692
 693             p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
 694
 695 #if BTM_DISC_DURING_RS == TRUE
 696             if (p_dev_rec)
 697                 p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
 698 #endif
 699         }
 700     }
 701
 702     /* Initialize return structure in case request fails */
 703     if (p_cb)
 704     {
 705         memcpy (btm_cb.devcb.switch_role_ref_data.remote_bd_addr, remote_bd_addr,
 706                 BD_ADDR_LEN);
 707         btm_cb.devcb.switch_role_ref_data.role = new_role;
 708         /* initialized to an error code */
 709         btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
 710         btm_cb.devcb.p_switch_role_cb = p_cb;
 711     }
 712     return(BTM_CMD_STARTED);
 713 }
 714
 715 /*******************************************************************************
 716 **
 717 ** Function         btm_acl_encrypt_change
 718 **
 719 ** Description      This function is when encryption of the connection is
 720 **                  completed by the LM.  Checks to see if a role switch or
 721 **                  change of link key was active and initiates or continues
 722 **                  process if needed.
 723 **
 724 ** Returns          void
 725 **
 726 *******************************************************************************/
 727 void btm_acl_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
 728 {
 729     tACL_CONN *p;
 730     UINT8     xx;
 731     tBTM_SEC_DEV_REC  *p_dev_rec;
 732     tBTM_BL_ROLE_CHG_DATA   evt;
 733
 734     BTM_TRACE_DEBUG ("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
 735                       handle, status, encr_enable);
 736     xx = btm_handle_to_acl_index(handle);
 737     /* don't assume that we can never get a bad hci_handle */
 738     if (xx < MAX_L2CAP_LINKS)
 739         p = &btm_cb.acl_db[xx];
 740     else
 741         return;
 742
 743     /* Process Role Switch if active */
 744     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF)
 745     {
 746         /* if encryption turn off failed we still will try to switch role */
 747         if (encr_enable)
 748         {
 749             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 750             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
 751         }
 752         else
 753         {
 754             p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
 755             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
 756         }
 757
 758         if (!btsnd_hcic_switch_role (p->remote_addr, (UINT8)!p->link_role))
 759         {
 760             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 761             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
 762             btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status, p->remote_addr);
 763         }
 764 #if BTM_DISC_DURING_RS == TRUE
 765         else
 766         {
 767             if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL)
 768                 p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
 769         }
 770 #endif
 771
 772     }
 773     /* Finished enabling Encryption after role switch */
 774     else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON)
 775     {
 776         p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 777         p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
 778         btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status, p->remote_addr);
 779
 780         /* if role change event is registered, report it now */
 781         if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK))
 782         {
 783             evt.event       = BTM_BL_ROLE_CHG_EVT;
 784             evt.new_role    = btm_cb.devcb.switch_role_ref_data.role;
 785             evt.p_bda       = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
 786             evt.hci_status  = btm_cb.devcb.switch_role_ref_data.hci_status;
 787             (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
 788
 789             BTM_TRACE_DEBUG("Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
 790                              evt.new_role, evt.hci_status, p->switch_role_state);
 791         }
 792
 793 #if BTM_DISC_DURING_RS == TRUE
 794         /* If a disconnect is pending, issue it now that role switch has completed */
 795         if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL)
 796         {
 797             if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING)
 798             {
 799                 BTM_TRACE_WARNING("btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
 800                 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
 801             }
 802             BTM_TRACE_ERROR("btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
 803                             PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
 804             p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
 805         }
 806 #endif
 807     }
 808 }
 809 /*******************************************************************************
 810 **
 811 ** Function         BTM_SetLinkPolicy
 812 **
 813 ** Description      Create and send HCI "Write Policy Set" command
 814 **
 815 ** Returns          status of the operation
 816 **
 817 *******************************************************************************/
 818 tBTM_STATUS BTM_SetLinkPolicy (BD_ADDR remote_bda, UINT16 *settings)
 819 {
 820     tACL_CONN   *p;
 821     UINT8       *localFeatures = BTM_ReadLocalFeatures();
 822     BTM_TRACE_DEBUG ("BTM_SetLinkPolicy");
 823 /*    BTM_TRACE_API ("BTM_SetLinkPolicy: requested settings: 0x%04x", *settings ); */
 824
 825     /* First, check if hold mode is supported */
 826     if (*settings != HCI_DISABLE_ALL_LM_MODES)
 827     {
 828         if ( (*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) && (!HCI_SWITCH_SUPPORTED(localFeatures)) )
 829         {
 830             *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
 831             BTM_TRACE_API ("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)", *settings );
 832         }
 833         if ( (*settings & HCI_ENABLE_HOLD_MODE) && (!HCI_HOLD_MODE_SUPPORTED(localFeatures)) )
 834         {
 835             *settings &= (~HCI_ENABLE_HOLD_MODE);
 836             BTM_TRACE_API ("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)", *settings );
 837         }
 838         if ( (*settings & HCI_ENABLE_SNIFF_MODE) && (!HCI_SNIFF_MODE_SUPPORTED(localFeatures)) )
 839         {
 840             *settings &= (~HCI_ENABLE_SNIFF_MODE);
 841             BTM_TRACE_API ("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)", *settings );
 842         }
 843         if ( (*settings & HCI_ENABLE_PARK_MODE) && (!HCI_PARK_MODE_SUPPORTED(localFeatures)) )
 844         {
 845             *settings &= (~HCI_ENABLE_PARK_MODE);
 846             BTM_TRACE_API ("BTM_SetLinkPolicy park not supported (settings: 0x%04x)", *settings );
 847         }
 848     }
 849
 850     if ((p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR)) != NULL)
 851         return(btsnd_hcic_write_policy_set (p->hci_handle, *settings) ? BTM_CMD_STARTED : BTM_NO_RESOURCES);
 852
 853     /* If here, no BD Addr found */
 854     return(BTM_UNKNOWN_ADDR);
 855 }
 856
 857 /*******************************************************************************
 858 **
 859 ** Function         BTM_SetDefaultLinkPolicy
 860 **
 861 ** Description      Set the default value for HCI "Write Policy Set" command
 862 **                  to use when an ACL link is created.
 863 **
 864 ** Returns          void
 865 **
 866 *******************************************************************************/
 867 void BTM_SetDefaultLinkPolicy (UINT16 settings)
 868 {
 869     UINT8 *localFeatures = BTM_ReadLocalFeatures();
 870
 871     BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
 872
 873     if((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) && (!HCI_SWITCH_SUPPORTED(localFeatures)))
 874     {
 875         settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
 876         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)", settings);
 877     }
 878     if ((settings & HCI_ENABLE_HOLD_MODE) && (!HCI_HOLD_MODE_SUPPORTED(localFeatures)))
 879     {
 880         settings &= ~HCI_ENABLE_HOLD_MODE;
 881         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)", settings);
 882     }
 883     if ((settings & HCI_ENABLE_SNIFF_MODE) && (!HCI_SNIFF_MODE_SUPPORTED(localFeatures)))
 884     {
 885         settings &= ~HCI_ENABLE_SNIFF_MODE;
 886         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)", settings);
 887     }
 888     if ((settings & HCI_ENABLE_PARK_MODE) && (!HCI_PARK_MODE_SUPPORTED(localFeatures)))
 889     {
 890         settings &= ~HCI_ENABLE_PARK_MODE;
 891         BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)", settings);
 892     }
 893     BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
 894
 895     btm_cb.btm_def_link_policy = settings;
 896
 897     /* Set the default Link Policy of the controller */
 898     btsnd_hcic_write_def_policy_set(settings);
 899 }
 900
 901
 902 void btm_use_preferred_conn_params(BD_ADDR bda) {
 903     tL2C_LCB *p_lcb = l2cu_find_lcb_by_bd_addr (bda, BT_TRANSPORT_LE);
 904     tBTM_SEC_DEV_REC    *p_dev_rec = btm_find_or_alloc_dev (bda);
 905
 906     /* If there are any preferred connection parameters, set them now */
 907     if ( (p_dev_rec->conn_params.min_conn_int     >= BTM_BLE_CONN_INT_MIN ) &&
 908          (p_dev_rec->conn_params.min_conn_int     <= BTM_BLE_CONN_INT_MAX ) &&
 909          (p_dev_rec->conn_params.max_conn_int     >= BTM_BLE_CONN_INT_MIN ) &&
 910          (p_dev_rec->conn_params.max_conn_int     <= BTM_BLE_CONN_INT_MAX ) &&
 911          (p_dev_rec->conn_params.slave_latency    <= BTM_BLE_CONN_LATENCY_MAX ) &&
 912          (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
 913          (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
 914          ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
 915           p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
 916           (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
 917           (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
 918           (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout)))
 919     {
 920         BTM_TRACE_DEBUG ("%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d supervision_tout=%d", __func__,
 921                             p_lcb->handle, p_dev_rec->conn_params.min_conn_int, p_dev_rec->conn_params.max_conn_int,
 922                             p_dev_rec->conn_params.slave_latency, p_dev_rec->conn_params.supervision_tout);
 923
 924         p_lcb->min_interval =  p_dev_rec->conn_params.min_conn_int;
 925         p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
 926         p_lcb->timeout      = p_dev_rec->conn_params.supervision_tout;
 927         p_lcb->latency      = p_dev_rec->conn_params.slave_latency;
 928
 929         btsnd_hcic_ble_upd_ll_conn_params (p_lcb->handle,
 930                                            p_dev_rec->conn_params.min_conn_int,
 931                                            p_dev_rec->conn_params.max_conn_int,
 932                                            p_dev_rec->conn_params.slave_latency,
 933                                            p_dev_rec->conn_params.supervision_tout,
 934                                            0, 0);
 935     }
 936 }
 937
 938 /*******************************************************************************
 939 **
 940 ** Function         btm_read_remote_version_complete
 941 **
 942 ** Description      This function is called when the command complete message
 943 **                  is received from the HCI for the remote version info.
 944 **
 945 ** Returns          void
 946 **
 947 *******************************************************************************/
 948 void btm_read_remote_version_complete (UINT8 *p)
 949 {
 950     tACL_CONN        *p_acl_cb = &btm_cb.acl_db[0];
 951     UINT8             status;
 952     UINT16            handle;
 953     int               xx;
 954     BTM_TRACE_DEBUG ("btm_read_remote_version_complete");
 955
 956     STREAM_TO_UINT8  (status, p);
 957     STREAM_TO_UINT16 (handle, p);
 958
 959     /* Look up the connection by handle and copy features */
 960     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++)
 961     {
 962         if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle))
 963         {
 964             if (status == HCI_SUCCESS)
 965             {
 966                 STREAM_TO_UINT8  (p_acl_cb->lmp_version, p);
 967                 STREAM_TO_UINT16 (p_acl_cb->manufacturer, p);
 968                 STREAM_TO_UINT16 (p_acl_cb->lmp_subversion, p);
 969             }
 970
 971 #if (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
 972             if (p_acl_cb->transport == BT_TRANSPORT_LE) {
 973                 l2cble_notify_le_connection (p_acl_cb->remote_addr);
 974                 btm_use_preferred_conn_params(p_acl_cb->remote_addr);
 975             }
 976 #endif  // (defined(BLE_INCLUDED) && (BLE_INCLUDED == TRUE))
 977             break;
 978         }
 979     }
 980 }
 981
 982
 983 /*******************************************************************************
 984 **
 985 ** Function         btm_process_remote_ext_features
 986 **
 987 ** Description      Local function called to process all extended features pages
 988 **                  read from a remote device.
 989 **
 990 ** Returns          void
 991 **
 992 *******************************************************************************/
 993 void btm_process_remote_ext_features (tACL_CONN *p_acl_cb, UINT8 num_read_pages)
 994 {
 995     UINT16              handle = p_acl_cb->hci_handle;
 996     tBTM_SEC_DEV_REC    *p_dev_rec = btm_find_dev_by_handle (handle);
 997     UINT8               page_idx;
 998
 999     BTM_TRACE_DEBUG ("btm_process_remote_ext_features");
1000
1001     /* Make sure we have the record to save remote features information */
1002     if (p_dev_rec == NULL)
1003     {
1004         /* Get a new device; might be doing dedicated bonding */
1005         p_dev_rec = btm_find_or_alloc_dev (p_acl_cb->remote_addr);
1006     }
1007
1008     p_acl_cb->num_read_pages = num_read_pages;
1009     p_dev_rec->num_read_pages = num_read_pages;
1010
1011     /* Move the pages to placeholder */
1012     for (page_idx = 0; page_idx < num_read_pages; page_idx++)
1013     {
1014         if (page_idx > HCI_EXT_FEATURES_PAGE_MAX)
1015         {
1016             BTM_TRACE_ERROR("%s: page=%d unexpected", __FUNCTION__, page_idx);
1017             break;
1018         }
1019         memcpy (p_dev_rec->features[page_idx], p_acl_cb->peer_lmp_features[page_idx],
1020                 HCI_FEATURE_BYTES_PER_PAGE);
1021     }
1022
1023     const UINT8 req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
1024
1025     /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
1026     btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
1027
1028     BTM_TRACE_API("%s: pend:%d", __FUNCTION__, req_pend);
1029     if (req_pend)
1030     {
1031         /* Request for remaining Security Features (if any) */
1032         l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
1033     }
1034 }
1035
1036
1037 /*******************************************************************************
1038 **
1039 ** Function         btm_read_remote_features
1040 **
1041 ** Description      Local function called to send a read remote supported features/
1042 **                  remote extended features page[0].
1043 **
1044 ** Returns          void
1045 **
1046 *******************************************************************************/
1047 void btm_read_remote_features (UINT16 handle)
1048 {
1049     UINT8       acl_idx;
1050     tACL_CONN   *p_acl_cb;
1051
1052     BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
1053
1054     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1055     {
1056         BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
1057         return;
1058     }
1059
1060     p_acl_cb = &btm_cb.acl_db[acl_idx];
1061     p_acl_cb->num_read_pages = 0;
1062     memset (p_acl_cb->peer_lmp_features, 0, sizeof(p_acl_cb->peer_lmp_features));
1063
1064     /* first send read remote supported features HCI command */
1065     /* because we don't know whether the remote support extended feature command */
1066     btsnd_hcic_rmt_features_req (handle);
1067 }
1068
1069
1070 /*******************************************************************************
1071 **
1072 ** Function         btm_read_remote_ext_features
1073 **
1074 ** Description      Local function called to send a read remote extended features
1075 **
1076 ** Returns          void
1077 **
1078 *******************************************************************************/
1079 void btm_read_remote_ext_features (UINT16 handle, UINT8 page_number)
1080 {
1081     BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle, page_number);
1082
1083     btsnd_hcic_rmt_ext_features(handle, page_number);
1084 }
1085
1086
1087 /*******************************************************************************
1088 **
1089 ** Function         btm_read_remote_features_complete
1090 **
1091 ** Description      This function is called when the remote supported features
1092 **                  complete event is received from the HCI.
1093 **
1094 ** Returns          void
1095 **
1096 *******************************************************************************/
1097 void btm_read_remote_features_complete (UINT8 *p)
1098 {
1099     tACL_CONN        *p_acl_cb;
1100     UINT8             status;
1101     UINT16            handle;
1102     UINT8            acl_idx;
1103
1104     BTM_TRACE_DEBUG ("btm_read_remote_features_complete");
1105     STREAM_TO_UINT8  (status, p);
1106
1107     if (status != HCI_SUCCESS)
1108     {
1109         BTM_TRACE_ERROR ("btm_read_remote_features_complete failed (status 0x%02x)", status);
1110         return;
1111     }
1112
1113         STREAM_TO_UINT16 (handle, p);
1114
1115     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1116         {
1117         BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid", handle);
1118         return;
1119                 }
1120
1121     p_acl_cb = &btm_cb.acl_db[acl_idx];
1122
1123     /* Copy the received features page */
1124     STREAM_TO_ARRAY(p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0], p,
1125                     HCI_FEATURE_BYTES_PER_PAGE);
1126
1127     if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])) &&
1128         (controller_get_interface()->supports_reading_remote_extended_features()))
1129     {
1130         /* if the remote controller has extended features and local controller supports
1131         ** HCI_Read_Remote_Extended_Features command then start reading these feature starting
1132         ** with extended features page 1 */
1133         BTM_TRACE_DEBUG ("Start reading remote extended features");
1134         btm_read_remote_ext_features(handle, HCI_EXT_FEATURES_PAGE_1);
1135         return;
1136     }
1137
1138     /* Remote controller has no extended features. Process remote controller supported features
1139        (features page HCI_EXT_FEATURES_PAGE_0). */
1140     btm_process_remote_ext_features (p_acl_cb, 1);
1141
1142     /* Continue with HCI connection establishment */
1143     btm_establish_continue (p_acl_cb);
1144 }
1145
1146 /*******************************************************************************
1147 **
1148 ** Function         btm_read_remote_ext_features_complete
1149 **
1150 ** Description      This function is called when the remote extended features
1151 **                  complete event is received from the HCI.
1152 **
1153 ** Returns          void
1154 **
1155 *******************************************************************************/
1156 void btm_read_remote_ext_features_complete (UINT8 *p)
1157 {
1158     tACL_CONN   *p_acl_cb;
1159     UINT8       page_num, max_page;
1160     UINT16      handle;
1161     UINT8       acl_idx;
1162
1163     BTM_TRACE_DEBUG ("btm_read_remote_ext_features_complete");
1164
1165     ++p;
1166     STREAM_TO_UINT16 (handle, p);
1167     STREAM_TO_UINT8  (page_num, p);
1168     STREAM_TO_UINT8  (max_page, p);
1169
1170     /* Validate parameters */
1171     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1172     {
1173         BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid", handle);
1174         return;
1175     }
1176
1177     if (max_page > HCI_EXT_FEATURES_PAGE_MAX)
1178     {
1179         BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown", max_page);
1180         return;
1181     }
1182
1183     p_acl_cb = &btm_cb.acl_db[acl_idx];
1184
1185     /* Copy the received features page */
1186     STREAM_TO_ARRAY(p_acl_cb->peer_lmp_features[page_num], p, HCI_FEATURE_BYTES_PER_PAGE);
1187
1188     /* If there is the next remote features page and
1189      * we have space to keep this page data - read this page */
1190     if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX))
1191     {
1192         page_num++;
1193         BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)", page_num);
1194         btm_read_remote_ext_features (handle, page_num);
1195         return;
1196     }
1197
1198     /* Reading of remote feature pages is complete */
1199     BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)", page_num);
1200
1201     /* Process the pages */
1202     btm_process_remote_ext_features (p_acl_cb, (UINT8) (page_num + 1));
1203
1204     /* Continue with HCI connection establishment */
1205     btm_establish_continue (p_acl_cb);
1206 }
1207
1208 /*******************************************************************************
1209 **
1210 ** Function         btm_read_remote_ext_features_failed
1211 **
1212 ** Description      This function is called when the remote extended features
1213 **                  complete event returns a failed status.
1214 **
1215 ** Returns          void
1216 **
1217 *******************************************************************************/
1218 void btm_read_remote_ext_features_failed (UINT8 status, UINT16 handle)
1219 {
1220     tACL_CONN   *p_acl_cb;
1221     UINT8       acl_idx;
1222
1223     BTM_TRACE_WARNING ("btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1224                          status, handle);
1225
1226     if ((acl_idx = btm_handle_to_acl_index(handle)) >= MAX_L2CAP_LINKS)
1227     {
1228         BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid", handle);
1229         return;
1230     }
1231
1232     p_acl_cb = &btm_cb.acl_db[acl_idx];
1233
1234     /* Process supported features only */
1235     btm_process_remote_ext_features (p_acl_cb, 1);
1236
1237     /* Continue HCI connection establishment */
1238     btm_establish_continue (p_acl_cb);
1239 }
1240
1241 /*******************************************************************************
1242 **
1243 ** Function         btm_establish_continue
1244 **
1245 ** Description      This function is called when the command complete message
1246 **                  is received from the HCI for the read local link policy request.
1247 **
1248 ** Returns          void
1249 **
1250 *******************************************************************************/
1251 void btm_establish_continue (tACL_CONN *p_acl_cb)
1252 {
1253         tBTM_BL_EVENT_DATA  evt_data;
1254         BTM_TRACE_DEBUG ("btm_establish_continue");
1255 #if (!defined(BTM_BYPASS_EXTRA_ACL_SETUP) || BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1256 #if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
1257         if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR)
1258 #endif
1259         {
1260             /* For now there are a some devices that do not like sending */
1261             /* commands events and data at the same time. */
1262             /* Set the packet types to the default allowed by the device */
1263             btm_set_packet_types (p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1264
1265             if (btm_cb.btm_def_link_policy)
1266                 BTM_SetLinkPolicy (p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1267         }
1268 #endif
1269         p_acl_cb->link_up_issued = TRUE;
1270
1271         /* If anyone cares, tell him database changed */
1272         if (btm_cb.p_bl_changed_cb)
1273         {
1274             evt_data.event = BTM_BL_CONN_EVT;
1275             evt_data.conn.p_bda = p_acl_cb->remote_addr;
1276             evt_data.conn.p_bdn = p_acl_cb->remote_name;
1277             evt_data.conn.p_dc  = p_acl_cb->remote_dc;
1278             evt_data.conn.p_features = p_acl_cb->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0];
1279 #if BLE_INCLUDED == TRUE
1280             evt_data.conn.handle = p_acl_cb->hci_handle;
1281             evt_data.conn.transport = p_acl_cb->transport;
1282 #endif
1283
1284             (*btm_cb.p_bl_changed_cb)(&evt_data);
1285         }
1286         btm_acl_update_busy_level (BTM_BLI_ACL_UP_EVT);
1287 }
1288
1289
1290 /*******************************************************************************
1291 **
1292 ** Function         BTM_SetDefaultLinkSuperTout
1293 **
1294 ** Description      Set the default value for HCI "Write Link Supervision Timeout"
1295 **                  command to use when an ACL link is created.
1296 **
1297 ** Returns          void
1298 **
1299 *******************************************************************************/
1300 void BTM_SetDefaultLinkSuperTout (UINT16 timeout)
1301 {
1302     BTM_TRACE_DEBUG ("BTM_SetDefaultLinkSuperTout");
1303     btm_cb.btm_def_link_super_tout = timeout;
1304 }
1305
1306 /*******************************************************************************
1307 **
1308 ** Function         BTM_GetLinkSuperTout
1309 **
1310 ** Description      Read the link supervision timeout value of the connection
1311 **
1312 ** Returns          status of the operation
1313 **
1314 *******************************************************************************/
1315 tBTM_STATUS BTM_GetLinkSuperTout (BD_ADDR remote_bda, UINT16 *p_timeout)
1316 {
1317     tACL_CONN   *p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1318
1319     BTM_TRACE_DEBUG ("BTM_GetLinkSuperTout");
1320     if (p != (tACL_CONN *)NULL)
1321     {
1322         *p_timeout = p->link_super_tout;
1323         return(BTM_SUCCESS);
1324     }
1325     /* If here, no BD Addr found */
1326     return(BTM_UNKNOWN_ADDR);
1327 }
1328
1329
1330 /*******************************************************************************
1331 **
1332 ** Function         BTM_SetLinkSuperTout
1333 **
1334 ** Description      Create and send HCI "Write Link Supervision Timeout" command
1335 **
1336 ** Returns          status of the operation
1337 **
1338 *******************************************************************************/
1339 tBTM_STATUS BTM_SetLinkSuperTout (BD_ADDR remote_bda, UINT16 timeout)
1340 {
1341     tACL_CONN   *p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1342
1343     BTM_TRACE_DEBUG ("BTM_SetLinkSuperTout");
1344     if (p != (tACL_CONN *)NULL)
1345     {
1346         p->link_super_tout = timeout;
1347
1348         /* Only send if current role is Master; 2.0 spec requires this */
1349         if (p->link_role == BTM_ROLE_MASTER)
1350         {
1351             if (!btsnd_hcic_write_link_super_tout (LOCAL_BR_EDR_CONTROLLER_ID,
1352                                                    p->hci_handle, timeout))
1353                 return(BTM_NO_RESOURCES);
1354
1355             return(BTM_CMD_STARTED);
1356         }
1357         else
1358             return(BTM_SUCCESS);
1359     }
1360
1361     /* If here, no BD Addr found */
1362     return(BTM_UNKNOWN_ADDR);
1363 }
1364
1365 /*******************************************************************************
1366 **
1367 ** Function         BTM_IsAclConnectionUp
1368 **
1369 ** Description      This function is called to check if an ACL connection exists
1370 **                  to a specific remote BD Address.
1371 **
1372 ** Returns          TRUE if connection is up, else FALSE.
1373 **
1374 *******************************************************************************/
1375 BOOLEAN BTM_IsAclConnectionUp (BD_ADDR remote_bda, tBT_TRANSPORT transport)
1376 {
1377     tACL_CONN   *p;
1378
1379     BTM_TRACE_API ("BTM_IsAclConnectionUp: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1380                     remote_bda[0], remote_bda[1], remote_bda[2],
1381                     remote_bda[3], remote_bda[4], remote_bda[5]);
1382
1383     p = btm_bda_to_acl(remote_bda, transport);
1384     if (p != (tACL_CONN *)NULL)
1385     {
1386         return(TRUE);
1387     }
1388
1389     /* If here, no BD Addr found */
1390     return(FALSE);
1391 }
1392
1393 /*******************************************************************************
1394 **
1395 ** Function         BTM_GetNumAclLinks
1396 **
1397 ** Description      This function is called to count the number of
1398 **                  ACL links that are active.
1399 **
1400 ** Returns          UINT16  Number of active ACL links
1401 **
1402 *******************************************************************************/
1403 UINT16 BTM_GetNumAclLinks (void)
1404 {
1405     uint16_t num_acl = 0;
1406
1407     for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i)
1408     {
1409         if (btm_cb.acl_db[i].in_use)
1410             ++num_acl;
1411     }
1412
1413     return num_acl;
1414 }
1415
1416 /*******************************************************************************
1417 **
1418 ** Function         btm_get_acl_disc_reason_code
1419 **
1420 ** Description      This function is called to get the disconnection reason code
1421 **                  returned by the HCI at disconnection complete event.
1422 **
1423 ** Returns          TRUE if connection is up, else FALSE.
1424 **
1425 *******************************************************************************/
1426 UINT16 btm_get_acl_disc_reason_code (void)
1427 {
1428     UINT8 res = btm_cb.acl_disc_reason;
1429     BTM_TRACE_DEBUG ("btm_get_acl_disc_reason_code");
1430     return(res);
1431 }
1432
1433
1434 /*******************************************************************************
1435 **
1436 ** Function         BTM_GetHCIConnHandle
1437 **
1438 ** Description      This function is called to get the handle for an ACL connection
1439 **                  to a specific remote BD Address.
1440 **
1441 ** Returns          the handle of the connection, or 0xFFFF if none.
1442 **
1443 *******************************************************************************/
1444 UINT16 BTM_GetHCIConnHandle (const BD_ADDR remote_bda, tBT_TRANSPORT transport)
1445 {
1446     tACL_CONN   *p;
1447     BTM_TRACE_DEBUG ("BTM_GetHCIConnHandle");
1448     p = btm_bda_to_acl(remote_bda, transport);
1449     if (p != (tACL_CONN *)NULL)
1450     {
1451         return(p->hci_handle);
1452     }
1453
1454     /* If here, no BD Addr found */
1455     return(0xFFFF);
1456 }
1457
1458 /*******************************************************************************
1459 **
1460 ** Function         btm_process_clk_off_comp_evt
1461 **
1462 ** Description      This function is called when clock offset command completes.
1463 **
1464 ** Input Parms      hci_handle - connection handle associated with the change
1465 **                  clock offset
1466 **
1467 ** Returns          void
1468 **
1469 *******************************************************************************/
1470 void btm_process_clk_off_comp_evt (UINT16 hci_handle, UINT16 clock_offset)
1471 {
1472     UINT8      xx;
1473     BTM_TRACE_DEBUG ("btm_process_clk_off_comp_evt");
1474     /* Look up the connection by handle and set the current mode */
1475     if ((xx = btm_handle_to_acl_index(hci_handle)) < MAX_L2CAP_LINKS)
1476         btm_cb.acl_db[xx].clock_offset = clock_offset;
1477 }
1478
1479 /*******************************************************************************
1480 **
1481 ** Function         btm_acl_role_changed
1482 **
1483 ** Description      This function is called whan a link's master/slave role change
1484 **                  event or command status event (with error) is received.
1485 **                  It updates the link control block, and calls
1486 **                  the registered callback with status and role (if registered).
1487 **
1488 ** Returns          void
1489 **
1490 *******************************************************************************/
1491 void btm_acl_role_changed (UINT8 hci_status, BD_ADDR bd_addr, UINT8 new_role)
1492 {
1493     UINT8                   *p_bda = (bd_addr) ? bd_addr :
1494                                         btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1495     tACL_CONN               *p = btm_bda_to_acl(p_bda, BT_TRANSPORT_BR_EDR);
1496     tBTM_ROLE_SWITCH_CMPL   *p_data = &btm_cb.devcb.switch_role_ref_data;
1497     tBTM_SEC_DEV_REC        *p_dev_rec;
1498     tBTM_BL_ROLE_CHG_DATA   evt;
1499
1500     BTM_TRACE_DEBUG ("btm_acl_role_changed");
1501     /* Ignore any stray events */
1502     if (p == NULL)
1503     {
1504         /* it could be a failure */
1505         if (hci_status != HCI_SUCCESS)
1506             btm_acl_report_role_change(hci_status, bd_addr);
1507         return;
1508     }
1509
1510     p_data->hci_status = hci_status;
1511
1512     if (hci_status == HCI_SUCCESS)
1513     {
1514         p_data->role = new_role;
1515         memcpy(p_data->remote_bd_addr, p_bda, BD_ADDR_LEN);
1516
1517         /* Update cached value */
1518         p->link_role = new_role;
1519
1520         /* Reload LSTO: link supervision timeout is reset in the LM after a role switch */
1521         if (new_role == BTM_ROLE_MASTER)
1522         {
1523             BTM_SetLinkSuperTout (p->remote_addr, p->link_super_tout);
1524         }
1525     }
1526     else
1527     {
1528         /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1529         new_role = p->link_role;
1530     }
1531
1532     /* Check if any SCO req is pending for role change */
1533     btm_sco_chk_pend_rolechange (p->hci_handle);
1534
1535     /* if switching state is switching we need to turn encryption on */
1536     /* if idle, we did not change encryption */
1537     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING)
1538     {
1539         if (btsnd_hcic_set_conn_encrypt (p->hci_handle, TRUE))
1540         {
1541             p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1542             p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1543             return;
1544         }
1545     }
1546
1547     /* Set the switch_role_state to IDLE since the reply received from HCI */
1548     /* regardless of its result either success or failed. */
1549     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)
1550     {
1551         p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1552         p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1553     }
1554
1555     /* if role switch complete is needed, report it now */
1556     btm_acl_report_role_change(hci_status, bd_addr);
1557
1558     /* if role change event is registered, report it now */
1559     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK))
1560     {
1561         evt.event       = BTM_BL_ROLE_CHG_EVT;
1562         evt.new_role    = new_role;
1563         evt.p_bda       = p_bda;
1564         evt.hci_status  = hci_status;
1565         (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
1566     }
1567
1568     BTM_TRACE_DEBUG("Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
1569                      p_data->role, p_data->hci_status, p->switch_role_state);
1570
1571 #if BTM_DISC_DURING_RS == TRUE
1572     /* If a disconnect is pending, issue it now that role switch has completed */
1573     if ((p_dev_rec = btm_find_dev (p_bda)) != NULL)
1574     {
1575         if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING)
1576         {
1577             BTM_TRACE_WARNING("btm_acl_role_changed -> Issuing delayed HCI_Disconnect!!!");
1578             btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1579         }
1580         BTM_TRACE_ERROR("tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1581                         PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1582         p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
1583     }
1584
1585 #endif
1586
1587 }
1588
1589 /*******************************************************************************
1590 **
1591 ** Function         BTM_AllocateSCN
1592 **
1593 ** Description      Look through the Server Channel Numbers for a free one.
1594 **
1595 ** Returns          Allocated SCN number or 0 if none.
1596 **
1597 *******************************************************************************/
1598
1599 UINT8 BTM_AllocateSCN(void)
1600 {
1601     UINT8   x;
1602     BTM_TRACE_DEBUG ("BTM_AllocateSCN");
1603
1604     // stack reserves scn 1 for HFP, HSP we still do the correct way
1605     for (x = 1; x < BTM_MAX_SCN; x++)
1606     {
1607         if (!btm_cb.btm_scn[x])
1608         {
1609             btm_cb.btm_scn[x] = TRUE;
1610             return(x+1);
1611         }
1612     }
1613
1614     return(0);     /* No free ports */
1615 }
1616
1617 /*******************************************************************************
1618 **
1619 ** Function         BTM_TryAllocateSCN
1620 **
1621 ** Description      Try to allocate a fixed server channel
1622 **
1623 ** Returns          Returns TRUE if server channel was available
1624 **
1625 *******************************************************************************/
1626
1627 BOOLEAN BTM_TryAllocateSCN(UINT8 scn)
1628 {
1629     /* Make sure we don't exceed max port range.
1630      * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1631      */
1632     if ( (scn>=BTM_MAX_SCN) || (scn == 1) )
1633         return FALSE;
1634
1635     /* check if this port is available */
1636     if (!btm_cb.btm_scn[scn-1])
1637     {
1638         btm_cb.btm_scn[scn-1] = TRUE;
1639         return TRUE;
1640     }
1641
1642     return (FALSE);     /* Port was busy */
1643 }
1644
1645 /*******************************************************************************
1646 **
1647 ** Function         BTM_FreeSCN
1648 **
1649 ** Description      Free the specified SCN.
1650 **
1651 ** Returns          TRUE or FALSE
1652 **
1653 *******************************************************************************/
1654 BOOLEAN BTM_FreeSCN(UINT8 scn)
1655 {
1656     BTM_TRACE_DEBUG ("BTM_FreeSCN ");
1657     if (scn <= BTM_MAX_SCN)
1658     {
1659         btm_cb.btm_scn[scn-1] = FALSE;
1660         return(TRUE);
1661     }
1662     else
1663         return(FALSE);      /* Illegal SCN passed in */
1664 }
1665
1666 /*******************************************************************************
1667 **
1668 ** Function         btm_set_packet_types
1669 **
1670 ** Description      This function sets the packet types used for a specific
1671 **                  ACL connection. It is called internally by btm_acl_created
1672 **                  or by an application/profile by BTM_SetPacketTypes.
1673 **
1674 ** Returns          status of the operation
1675 **
1676 *******************************************************************************/
1677 tBTM_STATUS btm_set_packet_types (tACL_CONN *p, UINT16 pkt_types)
1678 {
1679     UINT16 temp_pkt_types;
1680     BTM_TRACE_DEBUG ("btm_set_packet_types");
1681     /* Save in the ACL control blocks, types that we support */
1682     temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1683                       btm_cb.btm_acl_pkt_types_supported);
1684
1685     /* OR in any exception packet types if at least 2.0 version of spec */
1686     temp_pkt_types |= ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1687                        (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1688
1689     /* Exclude packet types not supported by the peer */
1690     btm_acl_chk_peer_pkt_type_support (p, &temp_pkt_types);
1691
1692     BTM_TRACE_DEBUG ("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1693
1694     if (!btsnd_hcic_change_conn_type (p->hci_handle, temp_pkt_types))
1695     {
1696         return(BTM_NO_RESOURCES);
1697     }
1698
1699     p->pkt_types_mask = temp_pkt_types;
1700
1701     return(BTM_CMD_STARTED);
1702 }
1703
1704 /*******************************************************************************
1705 **
1706 ** Function         btm_get_max_packet_size
1707 **
1708 ** Returns          Returns maximum packet size that can be used for current
1709 **                  connection, 0 if connection is not established
1710 **
1711 *******************************************************************************/
1712 UINT16 btm_get_max_packet_size (BD_ADDR addr)
1713 {
1714     tACL_CONN   *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1715     UINT16      pkt_types = 0;
1716     UINT16      pkt_size = 0;
1717     BTM_TRACE_DEBUG ("btm_get_max_packet_size");
1718     if (p != NULL)
1719     {
1720         pkt_types = p->pkt_types_mask;
1721     }
1722     else
1723     {
1724         /* Special case for when info for the local device is requested */
1725         if (memcmp (controller_get_interface()->get_address(), addr, BD_ADDR_LEN) == 0)
1726         {
1727             pkt_types = btm_cb.btm_acl_pkt_types_supported;
1728         }
1729     }
1730
1731     if (pkt_types)
1732     {
1733         if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1734             pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1735         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1736             pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1737         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1738             pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1739         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1740             pkt_size = HCI_DH5_PACKET_SIZE;
1741         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1742             pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1743         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1744             pkt_size = HCI_DM5_PACKET_SIZE;
1745         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1746             pkt_size = HCI_DH3_PACKET_SIZE;
1747         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1748             pkt_size = HCI_DM3_PACKET_SIZE;
1749         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1750             pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1751         else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1752             pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1753         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1754             pkt_size = HCI_DH1_PACKET_SIZE;
1755         else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1756             pkt_size = HCI_DM1_PACKET_SIZE;
1757     }
1758
1759    return(pkt_size);
1760 }
1761
1762 /*******************************************************************************
1763 **
1764 ** Function         BTM_ReadRemoteVersion
1765 **
1766 ** Returns          If connected report peer device info
1767 **
1768 *******************************************************************************/
1769 tBTM_STATUS BTM_ReadRemoteVersion (BD_ADDR addr, UINT8 *lmp_version,
1770                                    UINT16 *manufacturer, UINT16 *lmp_sub_version)
1771 {
1772     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1773     BTM_TRACE_DEBUG ("BTM_ReadRemoteVersion");
1774     if (p == NULL)
1775         return(BTM_UNKNOWN_ADDR);
1776
1777     if (lmp_version)
1778         *lmp_version = p->lmp_version;
1779
1780     if (manufacturer)
1781         *manufacturer = p->manufacturer;
1782
1783     if (lmp_sub_version)
1784         *lmp_sub_version = p->lmp_subversion;
1785
1786     return(BTM_SUCCESS);
1787 }
1788
1789 /*******************************************************************************
1790 **
1791 ** Function         BTM_ReadRemoteFeatures
1792 **
1793 ** Returns          pointer to the remote supported features mask (8 bytes)
1794 **
1795 *******************************************************************************/
1796 UINT8 *BTM_ReadRemoteFeatures (BD_ADDR addr)
1797 {
1798     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1799     BTM_TRACE_DEBUG ("BTM_ReadRemoteFeatures");
1800     if (p == NULL)
1801     {
1802         return(NULL);
1803     }
1804
1805     return(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]);
1806 }
1807
1808 /*******************************************************************************
1809 **
1810 ** Function         BTM_ReadRemoteExtendedFeatures
1811 **
1812 ** Returns          pointer to the remote extended features mask (8 bytes)
1813 **                  or NULL if bad page
1814 **
1815 *******************************************************************************/
1816 UINT8 *BTM_ReadRemoteExtendedFeatures (BD_ADDR addr, UINT8 page_number)
1817 {
1818     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1819     BTM_TRACE_DEBUG ("BTM_ReadRemoteExtendedFeatures");
1820     if (p == NULL)
1821     {
1822         return(NULL);
1823     }
1824
1825     if (page_number > HCI_EXT_FEATURES_PAGE_MAX)
1826     {
1827         BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown", page_number);
1828         return NULL;
1829     }
1830
1831     return(p->peer_lmp_features[page_number]);
1832 }
1833
1834 /*******************************************************************************
1835 **
1836 ** Function         BTM_ReadNumberRemoteFeaturesPages
1837 **
1838 ** Returns          number of features pages read from the remote device.
1839 **
1840 *******************************************************************************/
1841 UINT8 BTM_ReadNumberRemoteFeaturesPages (BD_ADDR addr)
1842 {
1843     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1844     BTM_TRACE_DEBUG ("BTM_ReadNumberRemoteFeaturesPages");
1845     if (p == NULL)
1846     {
1847         return(0);
1848     }
1849
1850     return(p->num_read_pages);
1851 }
1852
1853 /*******************************************************************************
1854 **
1855 ** Function         BTM_ReadAllRemoteFeatures
1856 **
1857 ** Returns          pointer to all features of the remote (24 bytes).
1858 **
1859 *******************************************************************************/
1860 UINT8 *BTM_ReadAllRemoteFeatures (BD_ADDR addr)
1861 {
1862     tACL_CONN        *p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1863     BTM_TRACE_DEBUG ("BTM_ReadAllRemoteFeatures");
1864     if (p == NULL)
1865     {
1866         return(NULL);
1867     }
1868
1869     return(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]);
1870 }
1871
1872 /*******************************************************************************
1873 **
1874 ** Function         BTM_RegBusyLevelNotif
1875 **
1876 ** Description      This function is called to register a callback to receive
1877 **                  busy level change events.
1878 **
1879 ** Returns          BTM_SUCCESS if successfully registered, otherwise error
1880 **
1881 *******************************************************************************/
1882 tBTM_STATUS BTM_RegBusyLevelNotif (tBTM_BL_CHANGE_CB *p_cb, UINT8 *p_level,
1883                                    tBTM_BL_EVENT_MASK evt_mask)
1884 {
1885     BTM_TRACE_DEBUG ("BTM_RegBusyLevelNotif");
1886     if (p_level)
1887         *p_level = btm_cb.busy_level;
1888
1889     btm_cb.bl_evt_mask = evt_mask;
1890
1891     if (!p_cb)
1892         btm_cb.p_bl_changed_cb = NULL;
1893     else if (btm_cb.p_bl_changed_cb)
1894         return(BTM_BUSY);
1895     else
1896         btm_cb.p_bl_changed_cb = p_cb;
1897
1898     return(BTM_SUCCESS);
1899 }
1900
1901 /*******************************************************************************
1902 **
1903 ** Function         BTM_SetQoS
1904 **
1905 ** Description      This function is called to setup QoS
1906 **
1907 ** Returns          status of the operation
1908 **
1909 *******************************************************************************/
1910 tBTM_STATUS BTM_SetQoS (BD_ADDR bd, FLOW_SPEC *p_flow, tBTM_CMPL_CB *p_cb)
1911 {
1912     tACL_CONN   *p = &btm_cb.acl_db[0];
1913
1914     BTM_TRACE_API ("BTM_SetQoS: BdAddr: %02x%02x%02x%02x%02x%02x",
1915                     bd[0], bd[1], bd[2],
1916                     bd[3], bd[4], bd[5]);
1917
1918     /* If someone already waiting on the version, do not allow another */
1919     if (btm_cb.devcb.p_qos_setup_cmpl_cb)
1920         return(BTM_BUSY);
1921
1922     if ( (p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR)) != NULL)
1923     {
1924         btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
1925         alarm_set_on_queue(btm_cb.devcb.qos_setup_timer,
1926                            BTM_DEV_REPLY_TIMEOUT_MS,
1927                            btm_qos_setup_timeout, NULL,
1928                            btu_general_alarm_queue);
1929
1930         if (!btsnd_hcic_qos_setup (p->hci_handle, p_flow->qos_flags, p_flow->service_type,
1931                                    p_flow->token_rate, p_flow->peak_bandwidth,
1932                                    p_flow->latency,p_flow->delay_variation))
1933         {
1934             btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1935             alarm_cancel(btm_cb.devcb.qos_setup_timer);
1936             return(BTM_NO_RESOURCES);
1937         }
1938         else
1939             return(BTM_CMD_STARTED);
1940     }
1941
1942     /* If here, no BD Addr found */
1943     return(BTM_UNKNOWN_ADDR);
1944 }
1945
1946 /*******************************************************************************
1947 **
1948 ** Function         btm_qos_setup_timeout
1949 **
1950 ** Description      Callback when QoS setup times out.
1951 **
1952 ** Returns          void
1953 **
1954 *******************************************************************************/
1955 void btm_qos_setup_timeout(UNUSED_ATTR void *data)
1956 {
1957     tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1958     btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1959     if (p_cb)
1960         (*p_cb)((void *) NULL);
1961 }
1962
1963 /*******************************************************************************
1964 **
1965 ** Function         btm_qos_setup_complete
1966 **
1967 ** Description      This function is called when the command complete message
1968 **                  is received from the HCI for the qos setup request.
1969 **
1970 ** Returns          void
1971 **
1972 *******************************************************************************/
1973 void btm_qos_setup_complete(UINT8 status, UINT16 handle, FLOW_SPEC *p_flow)
1974 {
1975     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1976     tBTM_QOS_SETUP_CMPL     qossu;
1977
1978     BTM_TRACE_DEBUG("%s", __func__);
1979     alarm_cancel(btm_cb.devcb.qos_setup_timer);
1980     btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1981
1982     /* If there was a registered callback, call it */
1983     if (p_cb)
1984     {
1985         memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1986         qossu.status = status;
1987         qossu.handle = handle;
1988         if (p_flow != NULL)
1989         {
1990             qossu.flow.qos_flags = p_flow->qos_flags;
1991             qossu.flow.service_type = p_flow->service_type;
1992             qossu.flow.token_rate = p_flow->token_rate;
1993             qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1994             qossu.flow.latency = p_flow->latency;
1995             qossu.flow.delay_variation = p_flow->delay_variation;
1996         }
1997         BTM_TRACE_DEBUG ("BTM: p_flow->delay_variation: 0x%02x",
1998                           qossu.flow.delay_variation);
1999         (*p_cb)(&qossu);
2000     }
2001 }
2002
2003 /*******************************************************************************
2004 **
2005 ** Function         BTM_ReadRSSI
2006 **
2007 ** Description      This function is called to read the link policy settings.
2008 **                  The address of link policy results are returned in the callback.
2009 **                  (tBTM_RSSI_RESULTS)
2010 **
2011 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2012 **
2013 *******************************************************************************/
2014 tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2015 {
2016     tACL_CONN   *p;
2017     tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
2018 #if BLE_INCLUDED == TRUE
2019     tBT_DEVICE_TYPE dev_type;
2020     tBLE_ADDR_TYPE  addr_type;
2021 #endif
2022     BTM_TRACE_API ("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2023                     remote_bda[0], remote_bda[1], remote_bda[2],
2024                     remote_bda[3], remote_bda[4], remote_bda[5]);
2025
2026     /* If someone already waiting on the version, do not allow another */
2027     if (btm_cb.devcb.p_rssi_cmpl_cb)
2028         return(BTM_BUSY);
2029
2030 #if BLE_INCLUDED == TRUE
2031     BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
2032     if (dev_type == BT_DEVICE_TYPE_BLE)
2033         transport = BT_TRANSPORT_LE;
2034 #endif
2035
2036     p = btm_bda_to_acl(remote_bda, transport);
2037     if (p != (tACL_CONN *)NULL)
2038     {
2039         btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
2040         alarm_set_on_queue(btm_cb.devcb.read_rssi_timer,
2041                            BTM_DEV_REPLY_TIMEOUT_MS, btm_read_rssi_timeout,
2042                            NULL, btu_general_alarm_queue);
2043
2044         if (!btsnd_hcic_read_rssi (p->hci_handle))
2045         {
2046             btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2047             alarm_cancel(btm_cb.devcb.read_rssi_timer);
2048             return(BTM_NO_RESOURCES);
2049         }
2050         else
2051             return(BTM_CMD_STARTED);
2052     }
2053
2054     /* If here, no BD Addr found */
2055     return(BTM_UNKNOWN_ADDR);
2056 }
2057
2058 /*******************************************************************************
2059 **
2060 ** Function         BTM_ReadLinkQuality
2061 **
2062 ** Description      This function is called to read the link qulaity.
2063 **                  The value of the link quality is returned in the callback.
2064 **                  (tBTM_LINK_QUALITY_RESULTS)
2065 **
2066 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2067 **
2068 *******************************************************************************/
2069 tBTM_STATUS BTM_ReadLinkQuality (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2070 {
2071     tACL_CONN   *p;
2072
2073     BTM_TRACE_API ("BTM_ReadLinkQuality: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2074                     remote_bda[0], remote_bda[1], remote_bda[2],
2075                     remote_bda[3], remote_bda[4], remote_bda[5]);
2076
2077     /* If someone already waiting on the version, do not allow another */
2078     if (btm_cb.devcb.p_link_qual_cmpl_cb)
2079         return(BTM_BUSY);
2080
2081     p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
2082     if (p != (tACL_CONN *)NULL)
2083     {
2084         btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
2085         alarm_set_on_queue(btm_cb.devcb.read_link_quality_timer,
2086                            BTM_DEV_REPLY_TIMEOUT_MS,
2087                            btm_read_link_quality_timeout, NULL,
2088                            btu_general_alarm_queue);
2089
2090         if (!btsnd_hcic_get_link_quality (p->hci_handle))
2091         {
2092             btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2093             alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2094             return(BTM_NO_RESOURCES);
2095         }
2096         else
2097             return(BTM_CMD_STARTED);
2098     }
2099
2100     /* If here, no BD Addr found */
2101     return(BTM_UNKNOWN_ADDR);
2102 }
2103
2104 /*******************************************************************************
2105 **
2106 ** Function         BTM_ReadTxPower
2107 **
2108 ** Description      This function is called to read the current
2109 **                  TX power of the connection. The tx power level results
2110 **                  are returned in the callback.
2111 **                  (tBTM_RSSI_RESULTS)
2112 **
2113 ** Returns          BTM_CMD_STARTED if successfully initiated or error code
2114 **
2115 *******************************************************************************/
2116 tBTM_STATUS BTM_ReadTxPower (BD_ADDR remote_bda, tBT_TRANSPORT transport, tBTM_CMPL_CB *p_cb)
2117 {
2118     tACL_CONN   *p;
2119     BOOLEAN     ret;
2120 #define BTM_READ_RSSI_TYPE_CUR  0x00
2121 #define BTM_READ_RSSI_TYPE_MAX  0X01
2122
2123     BTM_TRACE_API ("BTM_ReadTxPower: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2124                     remote_bda[0], remote_bda[1], remote_bda[2],
2125                     remote_bda[3], remote_bda[4], remote_bda[5]);
2126
2127     /* If someone already waiting on the version, do not allow another */
2128     if (btm_cb.devcb.p_tx_power_cmpl_cb)
2129         return(BTM_BUSY);
2130
2131     p = btm_bda_to_acl(remote_bda, transport);
2132     if (p != (tACL_CONN *)NULL)
2133     {
2134         btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2135         alarm_set_on_queue(btm_cb.devcb.read_tx_power_timer,
2136                        BTM_DEV_REPLY_TIMEOUT_MS,
2137                        btm_read_tx_power_timeout, NULL,
2138                        btu_general_alarm_queue);
2139
2140 #if BLE_INCLUDED == TRUE
2141         if (p->transport == BT_TRANSPORT_LE)
2142         {
2143             memcpy(btm_cb.devcb.read_tx_pwr_addr, remote_bda, BD_ADDR_LEN);
2144             ret = btsnd_hcic_ble_read_adv_chnl_tx_power();
2145         }
2146         else
2147 #endif
2148         {
2149             ret = btsnd_hcic_read_tx_power (p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2150         }
2151         if (!ret)
2152         {
2153             btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2154             alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2155             return(BTM_NO_RESOURCES);
2156         }
2157         else
2158             return(BTM_CMD_STARTED);
2159     }
2160
2161     /* If here, no BD Addr found */
2162     return (BTM_UNKNOWN_ADDR);
2163 }
2164
2165 /*******************************************************************************
2166 **
2167 ** Function         btm_read_tx_power_timeout
2168 **
2169 ** Description      Callback when reading the tx power times out.
2170 **
2171 ** Returns          void
2172 **
2173 *******************************************************************************/
2174 void btm_read_tx_power_timeout(UNUSED_ATTR void *data)
2175 {
2176     tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2177     btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2178     if (p_cb)
2179         (*p_cb)((void *) NULL);
2180 }
2181
2182 /*******************************************************************************
2183 **
2184 ** Function         btm_read_tx_power_complete
2185 **
2186 ** Description      This function is called when the command complete message
2187 **                  is received from the HCI for the read tx power request.
2188 **
2189 ** Returns          void
2190 **
2191 *******************************************************************************/
2192 void btm_read_tx_power_complete(UINT8 *p, BOOLEAN is_ble)
2193 {
2194     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2195     tBTM_TX_POWER_RESULTS   results;
2196     UINT16                   handle;
2197     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2198     UINT16                   index;
2199
2200     BTM_TRACE_DEBUG("%s", __func__);
2201     alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2202     btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2203
2204     /* If there was a registered callback, call it */
2205     if (p_cb)
2206     {
2207         STREAM_TO_UINT8  (results.hci_status, p);
2208
2209         if (results.hci_status == HCI_SUCCESS)
2210         {
2211             results.status = BTM_SUCCESS;
2212
2213             if (!is_ble)
2214             {
2215                 STREAM_TO_UINT16 (handle, p);
2216                 STREAM_TO_UINT8 (results.tx_power, p);
2217
2218                 /* Search through the list of active channels for the correct BD Addr */
2219                 for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2220                 {
2221                     if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2222                     {
2223                         memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2224                         break;
2225                     }
2226                 }
2227             }
2228 #if BLE_INCLUDED == TRUE
2229             else
2230             {
2231                 STREAM_TO_UINT8 (results.tx_power, p);
2232                 memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN);
2233             }
2234 #endif
2235             BTM_TRACE_DEBUG ("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2236                                   results.tx_power, results.hci_status);
2237         }
2238         else
2239             results.status = BTM_ERR_PROCESSING;
2240
2241         (*p_cb)(&results);
2242     }
2243 }
2244
2245 /*******************************************************************************
2246 **
2247 ** Function         btm_read_rssi_timeout
2248 **
2249 ** Description      Callback when reading the RSSI times out.
2250 **
2251 ** Returns          void
2252 **
2253 *******************************************************************************/
2254 void btm_read_rssi_timeout(UNUSED_ATTR void *data)
2255 {
2256     tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2257     btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2258     if (p_cb)
2259         (*p_cb)((void *) NULL);
2260 }
2261
2262 /*******************************************************************************
2263 **
2264 ** Function         btm_read_rssi_complete
2265 **
2266 ** Description      This function is called when the command complete message
2267 **                  is received from the HCI for the read rssi request.
2268 **
2269 ** Returns          void
2270 **
2271 *******************************************************************************/
2272 void btm_read_rssi_complete (UINT8 *p)
2273 {
2274     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2275     tBTM_RSSI_RESULTS        results;
2276     UINT16                   handle;
2277     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2278     UINT16                   index;
2279
2280     BTM_TRACE_DEBUG("%s", __func__);
2281     alarm_cancel(btm_cb.devcb.read_rssi_timer);
2282     btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2283
2284     /* If there was a registered callback, call it */
2285     if (p_cb)
2286     {
2287         STREAM_TO_UINT8  (results.hci_status, p);
2288
2289         if (results.hci_status == HCI_SUCCESS)
2290         {
2291             results.status = BTM_SUCCESS;
2292
2293             STREAM_TO_UINT16 (handle, p);
2294
2295             STREAM_TO_UINT8 (results.rssi, p);
2296             BTM_TRACE_DEBUG ("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2297                               results.rssi, results.hci_status);
2298
2299             /* Search through the list of active channels for the correct BD Addr */
2300             for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2301             {
2302                 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2303                 {
2304                     memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2305                     break;
2306                 }
2307             }
2308         }
2309         else
2310             results.status = BTM_ERR_PROCESSING;
2311
2312         (*p_cb)(&results);
2313     }
2314 }
2315
2316 /*******************************************************************************
2317 **
2318 ** Function         btm_read_link_quality_timeout
2319 **
2320 ** Description      Callback when reading the link quality times out.
2321 **
2322 ** Returns          void
2323 **
2324 *******************************************************************************/
2325 void btm_read_link_quality_timeout(UNUSED_ATTR void *data)
2326 {
2327     tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2328     btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2329     if (p_cb)
2330         (*p_cb)((void *) NULL);
2331 }
2332
2333 /*******************************************************************************
2334 **
2335 ** Function         btm_read_link_quality_complete
2336 **
2337 ** Description      This function is called when the command complete message
2338 **                  is received from the HCI for the read link quality.
2339 **
2340 ** Returns          void
2341 **
2342 *******************************************************************************/
2343 void btm_read_link_quality_complete(UINT8 *p)
2344 {
2345     tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2346     tBTM_LINK_QUALITY_RESULTS results;
2347     UINT16                   handle;
2348     tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2349     UINT16                   index;
2350
2351     BTM_TRACE_DEBUG("%s", __func__);
2352     alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2353     btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2354
2355     /* If there was a registered callback, call it */
2356     if (p_cb)
2357     {
2358         STREAM_TO_UINT8  (results.hci_status, p);
2359
2360         if (results.hci_status == HCI_SUCCESS)
2361         {
2362             results.status = BTM_SUCCESS;
2363
2364             STREAM_TO_UINT16 (handle, p);
2365
2366             STREAM_TO_UINT8 (results.link_quality, p);
2367             BTM_TRACE_DEBUG ("BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2368                               results.link_quality, results.hci_status);
2369
2370             /* Search through the list of active channels for the correct BD Addr */
2371             for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2372             {
2373                 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2374                 {
2375                     memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2376                     break;
2377                 }
2378             }
2379         }
2380         else
2381             results.status = BTM_ERR_PROCESSING;
2382
2383         (*p_cb)(&results);
2384     }
2385 }
2386
2387 /*******************************************************************************
2388 **
2389 ** Function         btm_remove_acl
2390 **
2391 ** Description      This function is called to disconnect an ACL connection
2392 **
2393 ** Returns          BTM_SUCCESS if successfully initiated, otherwise BTM_NO_RESOURCES.
2394 **
2395 *******************************************************************************/
2396 tBTM_STATUS btm_remove_acl (BD_ADDR bd_addr, tBT_TRANSPORT transport)
2397 {
2398     UINT16  hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2399     tBTM_STATUS status = BTM_SUCCESS;
2400
2401     BTM_TRACE_DEBUG ("btm_remove_acl");
2402 #if BTM_DISC_DURING_RS == TRUE
2403     tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_dev (bd_addr);
2404
2405     /* Role Switch is pending, postpone until completed */
2406     if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING))
2407     {
2408         p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2409     }
2410     else    /* otherwise can disconnect right away */
2411 #endif
2412     {
2413         if (hci_handle != 0xFFFF && p_dev_rec &&
2414              p_dev_rec->sec_state!= BTM_SEC_STATE_DISCONNECTING)
2415         {
2416             if (!btsnd_hcic_disconnect (hci_handle, HCI_ERR_PEER_USER))
2417                 status = BTM_NO_RESOURCES;
2418         }
2419         else
2420             status = BTM_UNKNOWN_ADDR;
2421     }
2422
2423     return status;
2424 }
2425
2426
2427 /*******************************************************************************
2428 **
2429 ** Function         BTM_SetTraceLevel
2430 **
2431 ** Description      This function sets the trace level for BTM.  If called with
2432 **                  a value of 0xFF, it simply returns the current trace level.
2433 **
2434 ** Returns          The new or current trace level
2435 **
2436 *******************************************************************************/
2437 UINT8 BTM_SetTraceLevel (UINT8 new_level)
2438 {
2439     BTM_TRACE_DEBUG ("BTM_SetTraceLevel");
2440     if (new_level != 0xFF)
2441         btm_cb.trace_level = new_level;
2442
2443     return(btm_cb.trace_level);
2444 }
2445
2446 /*******************************************************************************
2447 **
2448 ** Function         btm_cont_rswitch
2449 **
2450 ** Description      This function is called to continue processing an active
2451 **                  role switch. It first disables encryption if enabled and
2452 **                  EPR is not supported
2453 **
2454 ** Returns          void
2455 **
2456 *******************************************************************************/
2457 void btm_cont_rswitch (tACL_CONN *p, tBTM_SEC_DEV_REC *p_dev_rec,
2458                                      UINT8 hci_status)
2459 {
2460     BOOLEAN sw_ok = TRUE;
2461     BTM_TRACE_DEBUG ("btm_cont_rswitch");
2462     /* Check to see if encryption needs to be turned off if pending
2463        change of link key or role switch */
2464     if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2465     {
2466         /* Must turn off Encryption first if necessary */
2467         /* Some devices do not support switch or change of link key while encryption is on */
2468         if (p_dev_rec != NULL && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0)
2469             && !BTM_EPR_AVAILABLE(p))
2470         {
2471             if (btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
2472             {
2473                 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2474                 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2475                     p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2476             }
2477             else
2478             {
2479                 /* Error occurred; set states back to Idle */
2480                 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2481                     sw_ok = FALSE;
2482             }
2483         }
2484         else    /* Encryption not used or EPR supported, continue with switch
2485                    and/or change of link key */
2486         {
2487             if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2488             {
2489                 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2490 #if BTM_DISC_DURING_RS == TRUE
2491                 if (p_dev_rec)
2492                     p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2493 #endif
2494                 sw_ok = btsnd_hcic_switch_role (p->remote_addr, (UINT8)!p->link_role);
2495             }
2496         }
2497
2498         if (!sw_ok)
2499         {
2500             p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
2501             btm_acl_report_role_change(hci_status, p->remote_addr);
2502         }
2503     }
2504 }
2505
2506 /*******************************************************************************
2507 **
2508 ** Function         btm_acl_resubmit_page
2509 **
2510 ** Description      send pending page request
2511 **
2512 *******************************************************************************/
2513 void btm_acl_resubmit_page (void)
2514 {
2515     tBTM_SEC_DEV_REC *p_dev_rec;
2516     BT_HDR  *p_buf;
2517     UINT8   *pp;
2518     BD_ADDR bda;
2519     BTM_TRACE_DEBUG ("btm_acl_resubmit_page");
2520     /* If there were other page request schedule can start the next one */
2521     if ((p_buf = (BT_HDR *)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2522     {
2523         /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2524          * for both create_conn and rmt_name */
2525         pp = (UINT8 *)(p_buf + 1) + p_buf->offset + 3;
2526
2527         STREAM_TO_BDADDR (bda, pp);
2528
2529         p_dev_rec = btm_find_or_alloc_dev (bda);
2530
2531         memcpy (btm_cb.connecting_bda, p_dev_rec->bd_addr,   BD_ADDR_LEN);
2532         memcpy (btm_cb.connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);
2533
2534         btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2535     }
2536     else
2537         btm_cb.paging = FALSE;
2538 }
2539
2540 /*******************************************************************************
2541 **
2542 ** Function         btm_acl_reset_paging
2543 **
2544 ** Description      set paging to FALSE and free the page queue - called at hci_reset
2545 **
2546 *******************************************************************************/
2547 void  btm_acl_reset_paging (void)
2548 {
2549     BT_HDR *p;
2550     BTM_TRACE_DEBUG ("btm_acl_reset_paging");
2551     /* If we sent reset we are definitely not paging any more */
2552     while ((p = (BT_HDR *)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2553         osi_free(p);
2554
2555     btm_cb.paging = FALSE;
2556 }
2557
2558 /*******************************************************************************
2559 **
2560 ** Function         btm_acl_paging
2561 **
2562 ** Description      send a paging command or queue it in btm_cb
2563 **
2564 *******************************************************************************/
2565 void  btm_acl_paging (BT_HDR *p, BD_ADDR bda)
2566 {
2567     tBTM_SEC_DEV_REC *p_dev_rec;
2568
2569     BTM_TRACE_DEBUG ("btm_acl_paging discing:%d, paging:%d BDA: %06x%06x",
2570                       btm_cb.discing, btm_cb.paging,
2571                       (bda[0]<<16) + (bda[1]<<8) + bda[2], (bda[3]<<16) + (bda[4] << 8) + bda[5]);
2572     if (btm_cb.discing)
2573     {
2574         btm_cb.paging = TRUE;
2575         fixed_queue_enqueue(btm_cb.page_queue, p);
2576     }
2577     else
2578     {
2579         if (!BTM_ACL_IS_CONNECTED (bda))
2580         {
2581             BTM_TRACE_DEBUG ("connecting_bda: %06x%06x",
2582                               (btm_cb.connecting_bda[0]<<16) + (btm_cb.connecting_bda[1]<<8) +
2583                                btm_cb.connecting_bda[2],
2584                               (btm_cb.connecting_bda[3]<<16) + (btm_cb.connecting_bda[4] << 8) +
2585                                btm_cb.connecting_bda[5]);
2586             if (btm_cb.paging &&
2587                 memcmp (bda, btm_cb.connecting_bda, BD_ADDR_LEN) != 0)
2588             {
2589                 fixed_queue_enqueue(btm_cb.page_queue, p);
2590             }
2591             else
2592             {
2593                 p_dev_rec = btm_find_or_alloc_dev (bda);
2594                 memcpy (btm_cb.connecting_bda, p_dev_rec->bd_addr,   BD_ADDR_LEN);
2595                 memcpy (btm_cb.connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);
2596
2597                 btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
2598             }
2599
2600             btm_cb.paging = TRUE;
2601         }
2602         else /* ACL is already up */
2603         {
2604             btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
2605         }
2606     }
2607 }
2608
2609 /*******************************************************************************
2610 **
2611 ** Function         btm_acl_notif_conn_collision
2612 **
2613 ** Description      Send connection collision event to upper layer if registered
2614 **
2615 ** Returns          TRUE if sent out to upper layer,
2616 **                  FALSE if no one needs the notification.
2617 **
2618 *******************************************************************************/
2619 BOOLEAN  btm_acl_notif_conn_collision (BD_ADDR bda)
2620 {
2621     tBTM_BL_EVENT_DATA  evt_data;
2622
2623     /* Report possible collision to the upper layer. */
2624     if (btm_cb.p_bl_changed_cb)
2625     {
2626         BTM_TRACE_DEBUG ("btm_acl_notif_conn_collision: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2627                           bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
2628
2629         evt_data.event = BTM_BL_COLLISION_EVT;
2630         evt_data.conn.p_bda = bda;
2631
2632 #if BLE_INCLUDED == TRUE
2633         evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2634         evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2635 #endif
2636         (*btm_cb.p_bl_changed_cb)(&evt_data);
2637         return TRUE;
2638     }
2639     else
2640         return FALSE;
2641 }
2642
2643
2644 /*******************************************************************************
2645 **
2646 ** Function         btm_acl_chk_peer_pkt_type_support
2647 **
2648 ** Description      Check if peer supports requested packets
2649 **
2650 *******************************************************************************/
2651 void btm_acl_chk_peer_pkt_type_support (tACL_CONN *p, UINT16 *p_pkt_type)
2652 {
2653     /* 3 and 5 slot packets? */
2654     if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2655         *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 +BTM_ACL_PKT_TYPES_MASK_DM3);
2656
2657     if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2658         *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2659
2660     /* 2 and 3 MPS support? */
2661     if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2662         /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2663         *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2664                             BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2665
2666     if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2667         /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2668         *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2669                             BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2670
2671     /* EDR 3 and 5 slot support? */
2672     if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0])
2673      || HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2674     {
2675         if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2676             /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types */
2677             *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2678
2679         if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
2680             /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types */
2681             *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2682     }
2683 }