1 /******************************************************************************
3 * Copyright (C) 2000-2012 Broadcom Corporation
5 * Licensed under the Apache License, Version 2.0 (the "License");
6 * you may not use this file except in compliance with the License.
7 * You may obtain a copy of the License at:
9 * http://www.apache.org/licenses/LICENSE-2.0
11 * Unless required by applicable law or agreed to in writing, software
12 * distributed under the License is distributed on an "AS IS" BASIS,
13 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 * See the License for the specific language governing permissions and
15 * limitations under the License.
17 ******************************************************************************/
19 /*****************************************************************************
23 * Description: This file contains functions that handle ACL connections.
24 * This includes operations such as hold and sniff modes,
25 * supported packet types.
27 * This module contains both internal and external (API)
28 * functions. External (API) functions are distinguishable
29 * by their names beginning with uppercase BTM.
32 *****************************************************************************/
39 #include "bt_common.h"
40 #include "bt_target.h"
46 #include "device/include/controller.h"
47 #include "device/include/interop.h"
51 #include "osi/include/osi.h"
53 extern fixed_queue_t* btu_general_alarm_queue;
55 static void btm_read_remote_features(uint16_t handle);
56 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
57 static void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
58 uint8_t num_read_pages);
60 /* 3 seconds timeout waiting for responses */
61 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
63 /*******************************************************************************
65 * Function btm_acl_init
67 * Description This function is called at BTM startup to initialize
71 ******************************************************************************/
72 void btm_acl_init(void) {
73 BTM_TRACE_DEBUG("btm_acl_init");
74 /* Initialize nonzero defaults */
75 btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
76 btm_cb.acl_disc_reason = 0xff;
79 /*******************************************************************************
81 * Function btm_bda_to_acl
83 * Description This function returns the FIRST acl_db entry for the passed
86 * Parameters bda : BD address of the remote device
87 * transport : Physical transport used for ACL connection
90 * Returns Returns pointer to the ACL DB for the requested BDA if found.
93 ******************************************************************************/
94 tACL_CONN* btm_bda_to_acl(const BD_ADDR bda, tBT_TRANSPORT transport) {
95 tACL_CONN* p = &btm_cb.acl_db[0];
98 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
99 if ((p->in_use) && (!memcmp(p->remote_addr, bda, BD_ADDR_LEN)) &&
100 p->transport == transport) {
101 BTM_TRACE_DEBUG("btm_bda_to_acl found");
107 /* If here, no BD Addr found */
108 return ((tACL_CONN*)NULL);
111 /*******************************************************************************
113 * Function btm_handle_to_acl_index
115 * Description This function returns the FIRST acl_db entry for the passed
118 * Returns index to the acl_db or MAX_L2CAP_LINKS.
120 ******************************************************************************/
121 uint8_t btm_handle_to_acl_index(uint16_t hci_handle) {
122 tACL_CONN* p = &btm_cb.acl_db[0];
124 BTM_TRACE_DEBUG("btm_handle_to_acl_index");
125 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
126 if ((p->in_use) && (p->hci_handle == hci_handle)) {
131 /* If here, no BD Addr found */
135 #if (BLE_PRIVACY_SPT == TRUE)
136 /*******************************************************************************
138 * Function btm_ble_get_acl_remote_addr
140 * Description This function reads the active remote address used for the
143 * Returns success return true, otherwise false.
145 ******************************************************************************/
146 bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec, BD_ADDR conn_addr,
147 tBLE_ADDR_TYPE* p_addr_type) {
150 if (p_dev_rec == NULL) {
152 "btm_ble_get_acl_remote_addr can not find device with matching "
157 switch (p_dev_rec->ble.active_addr_type) {
158 case BTM_BLE_ADDR_PSEUDO:
159 memcpy(conn_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
160 *p_addr_type = p_dev_rec->ble.ble_addr_type;
163 case BTM_BLE_ADDR_RRA:
164 memcpy(conn_addr, p_dev_rec->ble.cur_rand_addr, BD_ADDR_LEN);
165 *p_addr_type = BLE_ADDR_RANDOM;
168 case BTM_BLE_ADDR_STATIC:
169 memcpy(conn_addr, p_dev_rec->ble.static_addr, BD_ADDR_LEN);
170 *p_addr_type = p_dev_rec->ble.static_addr_type;
174 BTM_TRACE_ERROR("Unknown active address: %d",
175 p_dev_rec->ble.active_addr_type);
183 /*******************************************************************************
185 * Function btm_acl_created
187 * Description This function is called by L2CAP when an ACL connection
192 ******************************************************************************/
193 void btm_acl_created(BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
194 uint16_t hci_handle, uint8_t link_role,
195 tBT_TRANSPORT transport) {
196 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
200 BTM_TRACE_DEBUG("btm_acl_created hci_handle=%d link_role=%d transport=%d",
201 hci_handle, link_role, transport);
202 /* Ensure we don't have duplicates */
203 p = btm_bda_to_acl(bda, transport);
204 if (p != (tACL_CONN*)NULL) {
205 p->hci_handle = hci_handle;
206 p->link_role = link_role;
207 p->transport = transport;
209 "Duplicate btm_acl_created: RemBdAddr: %02x%02x%02x%02x%02x%02x",
210 bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
211 BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
215 /* Allocate acl_db entry */
216 for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++) {
219 p->hci_handle = hci_handle;
220 p->link_role = link_role;
221 p->link_up_issued = false;
222 memcpy(p->remote_addr, bda, BD_ADDR_LEN);
224 p->transport = transport;
225 #if (BLE_PRIVACY_SPT == TRUE)
226 if (transport == BT_TRANSPORT_LE)
227 btm_ble_refresh_local_resolvable_private_addr(
228 bda, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
230 p->conn_addr_type = BLE_ADDR_PUBLIC;
231 memcpy(p->conn_addr, &controller_get_interface()->get_address()->address,
235 p->switch_role_failed_attempts = 0;
236 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
240 if (dc) memcpy(p->remote_dc, dc, DEV_CLASS_LEN);
242 if (bdn) memcpy(p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
244 /* if BR/EDR do something more */
245 if (transport == BT_TRANSPORT_BR_EDR) {
246 btsnd_hcic_read_rmt_clk_offset(p->hci_handle);
247 btsnd_hcic_rmt_ver_req(p->hci_handle);
249 p_dev_rec = btm_find_dev_by_handle(hci_handle);
252 BTM_TRACE_DEBUG("device_type=0x%x", p_dev_rec->device_type);
255 if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
256 /* If remote features already known, copy them and continue connection
258 if ((p_dev_rec->num_read_pages) &&
259 (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
260 memcpy(p->peer_lmp_feature_pages, p_dev_rec->feature_pages,
261 (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
262 p->num_read_pages = p_dev_rec->num_read_pages;
264 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
266 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
267 btm_sec_set_peer_sec_caps(p, p_dev_rec);
269 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
271 /* Request for remaining Security Features (if any) */
272 l2cu_resubmit_pending_sec_req(p_dev_rec->bd_addr);
274 btm_establish_continue(p);
279 /* If here, features are not known yet */
280 if (p_dev_rec && transport == BT_TRANSPORT_LE) {
281 #if (BLE_PRIVACY_SPT == TRUE)
282 btm_ble_get_acl_remote_addr(p_dev_rec, p->active_remote_addr,
283 &p->active_remote_addr_type);
286 if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(
287 controller_get_interface()->get_features_ble()->as_array) ||
288 link_role == HCI_ROLE_MASTER) {
289 btsnd_hcic_ble_read_remote_feat(p->hci_handle);
291 btm_establish_continue(p);
294 btm_read_remote_features(p->hci_handle);
297 /* read page 1 - on rmt feature event for buffer reasons */
303 void btm_acl_update_conn_addr(uint8_t conn_handle, BD_ADDR address) {
304 uint8_t idx = btm_handle_to_acl_index(conn_handle);
305 if (idx != MAX_L2CAP_LINKS) {
306 memcpy(btm_cb.acl_db[idx].conn_addr, address, BD_ADDR_LEN);
310 /*******************************************************************************
312 * Function btm_acl_report_role_change
314 * Description This function is called when the local device is deemed
315 * to be down. It notifies L2CAP of the failure.
319 ******************************************************************************/
320 void btm_acl_report_role_change(uint8_t hci_status, BD_ADDR bda) {
321 tBTM_ROLE_SWITCH_CMPL ref_data;
322 BTM_TRACE_DEBUG("btm_acl_report_role_change");
323 if (btm_cb.devcb.p_switch_role_cb &&
324 (bda && (0 == memcmp(btm_cb.devcb.switch_role_ref_data.remote_bd_addr,
325 bda, BD_ADDR_LEN)))) {
326 memcpy(&ref_data, &btm_cb.devcb.switch_role_ref_data,
327 sizeof(tBTM_ROLE_SWITCH_CMPL));
328 ref_data.hci_status = hci_status;
329 (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
330 memset(&btm_cb.devcb.switch_role_ref_data, 0,
331 sizeof(tBTM_ROLE_SWITCH_CMPL));
332 btm_cb.devcb.p_switch_role_cb = NULL;
336 /*******************************************************************************
338 * Function btm_acl_removed
340 * Description This function is called by L2CAP when an ACL connection
341 * is removed. Since only L2CAP creates ACL links, we use
342 * the L2CAP link index as our index into the control blocks.
346 ******************************************************************************/
347 void btm_acl_removed(BD_ADDR bda, tBT_TRANSPORT transport) {
349 tBTM_BL_EVENT_DATA evt_data;
350 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
351 BTM_TRACE_DEBUG("btm_acl_removed");
352 p = btm_bda_to_acl(bda, transport);
353 if (p != (tACL_CONN*)NULL) {
356 /* if the disconnected channel has a pending role switch, clear it now */
357 btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, bda);
359 /* Only notify if link up has had a chance to be issued */
360 if (p->link_up_issued) {
361 p->link_up_issued = false;
363 /* If anyone cares, tell him database changed */
364 if (btm_cb.p_bl_changed_cb) {
365 evt_data.event = BTM_BL_DISCN_EVT;
366 evt_data.discn.p_bda = bda;
367 evt_data.discn.handle = p->hci_handle;
368 evt_data.discn.transport = p->transport;
369 (*btm_cb.p_bl_changed_cb)(&evt_data);
372 btm_acl_update_busy_level(BTM_BLI_ACL_DOWN_EVT);
376 "acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
377 p->hci_handle, p->transport, btm_cb.ble_ctr_cb.inq_var.connectable_mode,
380 p_dev_rec = btm_find_dev(bda);
382 BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x",
383 p_dev_rec->sec_flags);
384 if (p->transport == BT_TRANSPORT_LE) {
385 BTM_TRACE_DEBUG("LE link down");
386 p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
387 if ((p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0) {
388 BTM_TRACE_DEBUG("Not Bonded");
389 p_dev_rec->sec_flags &=
390 ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
392 BTM_TRACE_DEBUG("Bonded");
395 BTM_TRACE_DEBUG("Bletooth link down");
396 p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED |
397 BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
399 BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x",
400 p_dev_rec->sec_flags);
402 BTM_TRACE_ERROR("Device not found");
405 /* Clear the ACL connection data */
406 memset(p, 0, sizeof(tACL_CONN));
410 /*******************************************************************************
412 * Function btm_acl_device_down
414 * Description This function is called when the local device is deemed
415 * to be down. It notifies L2CAP of the failure.
419 ******************************************************************************/
420 void btm_acl_device_down(void) {
421 tACL_CONN* p = &btm_cb.acl_db[0];
423 BTM_TRACE_DEBUG("btm_acl_device_down");
424 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
426 BTM_TRACE_DEBUG("hci_handle=%d HCI_ERR_HW_FAILURE ", p->hci_handle);
427 l2c_link_hci_disc_comp(p->hci_handle, HCI_ERR_HW_FAILURE);
432 /*******************************************************************************
434 * Function btm_acl_update_busy_level
436 * Description This function is called to update the busy level of the
441 ******************************************************************************/
442 void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
443 bool old_inquiry_state = btm_cb.is_inquiry;
444 tBTM_BL_UPDATE_DATA evt;
445 evt.busy_level_flags = 0;
447 case BTM_BLI_ACL_UP_EVT:
448 BTM_TRACE_DEBUG("BTM_BLI_ACL_UP_EVT");
450 case BTM_BLI_ACL_DOWN_EVT:
451 BTM_TRACE_DEBUG("BTM_BLI_ACL_DOWN_EVT");
453 case BTM_BLI_PAGE_EVT:
454 BTM_TRACE_DEBUG("BTM_BLI_PAGE_EVT");
455 btm_cb.is_paging = true;
456 evt.busy_level_flags = BTM_BL_PAGING_STARTED;
458 case BTM_BLI_PAGE_DONE_EVT:
459 BTM_TRACE_DEBUG("BTM_BLI_PAGE_DONE_EVT");
460 btm_cb.is_paging = false;
461 evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
463 case BTM_BLI_INQ_EVT:
464 BTM_TRACE_DEBUG("BTM_BLI_INQ_EVT");
465 btm_cb.is_inquiry = true;
466 evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
468 case BTM_BLI_INQ_CANCEL_EVT:
469 BTM_TRACE_DEBUG("BTM_BLI_INQ_CANCEL_EVT");
470 btm_cb.is_inquiry = false;
471 evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
473 case BTM_BLI_INQ_DONE_EVT:
474 BTM_TRACE_DEBUG("BTM_BLI_INQ_DONE_EVT");
475 btm_cb.is_inquiry = false;
476 evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
481 if (btm_cb.is_paging || btm_cb.is_inquiry)
484 busy_level = BTM_GetNumAclLinks();
486 if ((busy_level != btm_cb.busy_level) ||
487 (old_inquiry_state != btm_cb.is_inquiry)) {
488 evt.event = BTM_BL_UPDATE_EVT;
489 evt.busy_level = busy_level;
490 btm_cb.busy_level = busy_level;
491 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
492 (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
497 /*******************************************************************************
499 * Function BTM_GetRole
501 * Description This function is called to get the role of the local device
502 * for the ACL connection with the specified remote device
504 * Returns BTM_SUCCESS if connection exists.
505 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
507 ******************************************************************************/
508 tBTM_STATUS BTM_GetRole(BD_ADDR remote_bd_addr, uint8_t* p_role) {
510 BTM_TRACE_DEBUG("BTM_GetRole");
511 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
513 *p_role = BTM_ROLE_UNDEFINED;
514 return (BTM_UNKNOWN_ADDR);
517 /* Get the current role */
518 *p_role = p->link_role;
519 return (BTM_SUCCESS);
522 /*******************************************************************************
524 * Function BTM_SwitchRole
526 * Description This function is called to switch role between master and
527 * slave. If role is already set it will do nothing. If the
528 * command was initiated, the callback function is called upon
531 * Returns BTM_SUCCESS if already in specified role.
532 * BTM_CMD_STARTED if command issued to controller.
533 * BTM_NO_RESOURCES if couldn't allocate memory to issue
535 * BTM_UNKNOWN_ADDR if no active link with bd addr specified
536 * BTM_MODE_UNSUPPORTED if local device does not support role
538 * BTM_BUSY if the previous command is not completed
540 ******************************************************************************/
541 tBTM_STATUS BTM_SwitchRole(BD_ADDR remote_bd_addr, uint8_t new_role,
542 tBTM_CMPL_CB* p_cb) {
544 tBTM_SEC_DEV_REC* p_dev_rec = NULL;
545 #if (BTM_SCO_INCLUDED == TRUE)
549 tBTM_PM_MODE pwr_mode;
550 tBTM_PM_PWR_MD settings;
552 BTM_TRACE_API("BTM_SwitchRole BDA: %02x-%02x-%02x-%02x-%02x-%02x",
553 remote_bd_addr[0], remote_bd_addr[1], remote_bd_addr[2],
554 remote_bd_addr[3], remote_bd_addr[4], remote_bd_addr[5]);
556 /* Make sure the local device supports switching */
557 if (!controller_get_interface()->supports_master_slave_role_switch())
558 return (BTM_MODE_UNSUPPORTED);
560 if (btm_cb.devcb.p_switch_role_cb && p_cb) {
561 p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
563 "Role switch on other device is in progress 0x%02x%02x%02x%02x%02x%02x",
564 p_bda[0], p_bda[1], p_bda[2], p_bda[3], p_bda[4], p_bda[5]);
568 p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
569 if (p == NULL) return (BTM_UNKNOWN_ADDR);
571 /* Finished if already in desired role */
572 if (p->link_role == new_role) return (BTM_SUCCESS);
574 if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH,
575 (const bt_bdaddr_t*)&remote_bd_addr)) {
576 return BTM_DEV_BLACKLISTED;
579 #if (BTM_SCO_INCLUDED == TRUE)
580 /* Check if there is any SCO Active on this BD Address */
581 is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
583 if (is_sco_active == true) return (BTM_NO_RESOURCES);
586 /* Ignore role switch request if the previous request was not completed */
587 if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE) {
588 BTM_TRACE_DEBUG("BTM_SwitchRole busy: %d", p->switch_role_state);
592 if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH,
593 (const bt_bdaddr_t*)&remote_bd_addr)) {
594 BTM_TRACE_DEBUG("%s, Device blacklisted under INTEROP_DYNAMIC_ROLE_SWITCH.",
596 return BTM_DEV_BLACKLISTED;
599 status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode);
600 if (status != BTM_SUCCESS) return (status);
602 /* Wake up the link if in sniff or park before attempting switch */
603 if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF) {
604 memset((void*)&settings, 0, sizeof(settings));
605 settings.mode = BTM_PM_MD_ACTIVE;
606 status = BTM_SetPowerMode(BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
607 if (status != BTM_CMD_STARTED) return (BTM_WRONG_MODE);
609 p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
611 /* some devices do not support switch while encryption is on */
613 p_dev_rec = btm_find_dev(remote_bd_addr);
614 if ((p_dev_rec != NULL) &&
615 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
616 !BTM_EPR_AVAILABLE(p)) {
617 /* bypass turning off encryption if change link key is already doing it */
618 if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF) {
619 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
620 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
623 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
625 btsnd_hcic_switch_role(remote_bd_addr, new_role);
626 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
628 #if (BTM_DISC_DURING_RS == TRUE)
629 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
634 /* Initialize return structure in case request fails */
636 memcpy(btm_cb.devcb.switch_role_ref_data.remote_bd_addr, remote_bd_addr,
638 btm_cb.devcb.switch_role_ref_data.role = new_role;
639 /* initialized to an error code */
640 btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
641 btm_cb.devcb.p_switch_role_cb = p_cb;
643 return (BTM_CMD_STARTED);
646 /*******************************************************************************
648 * Function btm_acl_encrypt_change
650 * Description This function is when encryption of the connection is
651 * completed by the LM. Checks to see if a role switch or
652 * change of link key was active and initiates or continues
657 ******************************************************************************/
658 void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
659 uint8_t encr_enable) {
662 tBTM_SEC_DEV_REC* p_dev_rec;
663 tBTM_BL_ROLE_CHG_DATA evt;
665 BTM_TRACE_DEBUG("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
666 handle, status, encr_enable);
667 xx = btm_handle_to_acl_index(handle);
668 /* don't assume that we can never get a bad hci_handle */
669 if (xx < MAX_L2CAP_LINKS)
670 p = &btm_cb.acl_db[xx];
674 /* Process Role Switch if active */
675 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF) {
676 /* if encryption turn off failed we still will try to switch role */
678 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
679 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
681 p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
682 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
685 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
686 #if (BTM_DISC_DURING_RS == TRUE)
687 p_dev_rec = btm_find_dev(p->remote_addr);
688 if (p_dev_rec != NULL) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
692 /* Finished enabling Encryption after role switch */
693 else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON) {
694 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
695 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
696 btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status,
699 /* if role change event is registered, report it now */
700 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
701 evt.event = BTM_BL_ROLE_CHG_EVT;
702 evt.new_role = btm_cb.devcb.switch_role_ref_data.role;
703 evt.p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
704 evt.hci_status = btm_cb.devcb.switch_role_ref_data.hci_status;
705 (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
708 "Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
709 evt.new_role, evt.hci_status, p->switch_role_state);
712 #if (BTM_DISC_DURING_RS == TRUE)
713 /* If a disconnect is pending, issue it now that role switch has completed
715 p_dev_rec = btm_find_dev(p->remote_addr);
716 if (p_dev_rec != NULL) {
717 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
719 "btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
720 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
723 "btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
724 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
725 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
730 /*******************************************************************************
732 * Function BTM_SetLinkPolicy
734 * Description Create and send HCI "Write Policy Set" command
736 * Returns status of the operation
738 ******************************************************************************/
739 tBTM_STATUS BTM_SetLinkPolicy(BD_ADDR remote_bda, uint16_t* settings) {
741 uint8_t* localFeatures = BTM_ReadLocalFeatures();
742 BTM_TRACE_DEBUG("%s", __func__);
743 /* BTM_TRACE_API ("%s: requested settings: 0x%04x", __func__, *settings ); */
745 /* First, check if hold mode is supported */
746 if (*settings != HCI_DISABLE_ALL_LM_MODES) {
747 if ((*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
748 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
749 *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
750 BTM_TRACE_API("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)",
753 if ((*settings & HCI_ENABLE_HOLD_MODE) &&
754 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
755 *settings &= (~HCI_ENABLE_HOLD_MODE);
756 BTM_TRACE_API("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)",
759 if ((*settings & HCI_ENABLE_SNIFF_MODE) &&
760 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
761 *settings &= (~HCI_ENABLE_SNIFF_MODE);
762 BTM_TRACE_API("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)",
765 if ((*settings & HCI_ENABLE_PARK_MODE) &&
766 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
767 *settings &= (~HCI_ENABLE_PARK_MODE);
768 BTM_TRACE_API("BTM_SetLinkPolicy park not supported (settings: 0x%04x)",
773 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
775 btsnd_hcic_write_policy_set(p->hci_handle, *settings);
776 return BTM_CMD_STARTED;
779 /* If here, no BD Addr found */
780 return (BTM_UNKNOWN_ADDR);
783 /*******************************************************************************
785 * Function BTM_SetDefaultLinkPolicy
787 * Description Set the default value for HCI "Write Policy Set" command
788 * to use when an ACL link is created.
792 ******************************************************************************/
793 void BTM_SetDefaultLinkPolicy(uint16_t settings) {
794 uint8_t* localFeatures = BTM_ReadLocalFeatures();
796 BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
798 if ((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
799 (!HCI_SWITCH_SUPPORTED(localFeatures))) {
800 settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
802 "BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)",
805 if ((settings & HCI_ENABLE_HOLD_MODE) &&
806 (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
807 settings &= ~HCI_ENABLE_HOLD_MODE;
809 "BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)",
812 if ((settings & HCI_ENABLE_SNIFF_MODE) &&
813 (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
814 settings &= ~HCI_ENABLE_SNIFF_MODE;
816 "BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)",
819 if ((settings & HCI_ENABLE_PARK_MODE) &&
820 (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
821 settings &= ~HCI_ENABLE_PARK_MODE;
823 "BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)",
826 BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
828 btm_cb.btm_def_link_policy = settings;
830 /* Set the default Link Policy of the controller */
831 btsnd_hcic_write_def_policy_set(settings);
834 void btm_use_preferred_conn_params(BD_ADDR bda) {
835 tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
836 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
838 /* If there are any preferred connection parameters, set them now */
839 if ((p_dev_rec->conn_params.min_conn_int >= BTM_BLE_CONN_INT_MIN) &&
840 (p_dev_rec->conn_params.min_conn_int <= BTM_BLE_CONN_INT_MAX) &&
841 (p_dev_rec->conn_params.max_conn_int >= BTM_BLE_CONN_INT_MIN) &&
842 (p_dev_rec->conn_params.max_conn_int <= BTM_BLE_CONN_INT_MAX) &&
843 (p_dev_rec->conn_params.slave_latency <= BTM_BLE_CONN_LATENCY_MAX) &&
844 (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
845 (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
846 ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
847 p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
848 (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
849 (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
850 (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout))) {
852 "%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d "
853 "supervision_tout=%d",
854 __func__, p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
855 p_dev_rec->conn_params.max_conn_int,
856 p_dev_rec->conn_params.slave_latency,
857 p_dev_rec->conn_params.supervision_tout);
859 p_lcb->min_interval = p_dev_rec->conn_params.min_conn_int;
860 p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
861 p_lcb->timeout = p_dev_rec->conn_params.supervision_tout;
862 p_lcb->latency = p_dev_rec->conn_params.slave_latency;
864 btsnd_hcic_ble_upd_ll_conn_params(
865 p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
866 p_dev_rec->conn_params.max_conn_int,
867 p_dev_rec->conn_params.slave_latency,
868 p_dev_rec->conn_params.supervision_tout, 0, 0);
872 /*******************************************************************************
874 * Function btm_read_remote_version_complete
876 * Description This function is called when the command complete message
877 * is received from the HCI for the remote version info.
881 ******************************************************************************/
882 void btm_read_remote_version_complete(uint8_t* p) {
883 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
887 BTM_TRACE_DEBUG("btm_read_remote_version_complete");
889 STREAM_TO_UINT8(status, p);
890 STREAM_TO_UINT16(handle, p);
892 /* Look up the connection by handle and copy features */
893 for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++) {
894 if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle)) {
895 if (status == HCI_SUCCESS) {
896 STREAM_TO_UINT8(p_acl_cb->lmp_version, p);
897 STREAM_TO_UINT16(p_acl_cb->manufacturer, p);
898 STREAM_TO_UINT16(p_acl_cb->lmp_subversion, p);
901 if (p_acl_cb->transport == BT_TRANSPORT_LE) {
902 l2cble_notify_le_connection(p_acl_cb->remote_addr);
903 btm_use_preferred_conn_params(p_acl_cb->remote_addr);
910 /*******************************************************************************
912 * Function btm_process_remote_ext_features
914 * Description Local function called to process all extended features pages
915 * read from a remote device.
919 ******************************************************************************/
920 void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
921 uint8_t num_read_pages) {
922 uint16_t handle = p_acl_cb->hci_handle;
923 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
926 BTM_TRACE_DEBUG("btm_process_remote_ext_features");
928 /* Make sure we have the record to save remote features information */
929 if (p_dev_rec == NULL) {
930 /* Get a new device; might be doing dedicated bonding */
931 p_dev_rec = btm_find_or_alloc_dev(p_acl_cb->remote_addr);
934 p_acl_cb->num_read_pages = num_read_pages;
935 p_dev_rec->num_read_pages = num_read_pages;
937 /* Move the pages to placeholder */
938 for (page_idx = 0; page_idx < num_read_pages; page_idx++) {
939 if (page_idx > HCI_EXT_FEATURES_PAGE_MAX) {
940 BTM_TRACE_ERROR("%s: page=%d unexpected", __func__, page_idx);
943 memcpy(p_dev_rec->feature_pages[page_idx],
944 p_acl_cb->peer_lmp_feature_pages[page_idx],
945 HCI_FEATURE_BYTES_PER_PAGE);
948 const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
950 /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
951 btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
953 BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
955 /* Request for remaining Security Features (if any) */
956 l2cu_resubmit_pending_sec_req(p_dev_rec->bd_addr);
960 /*******************************************************************************
962 * Function btm_read_remote_features
964 * Description Local function called to send a read remote supported
965 * features/remote extended features page[0].
969 ******************************************************************************/
970 void btm_read_remote_features(uint16_t handle) {
974 BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
976 acl_idx = btm_handle_to_acl_index(handle);
977 if (acl_idx >= MAX_L2CAP_LINKS) {
978 BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
982 p_acl_cb = &btm_cb.acl_db[acl_idx];
983 p_acl_cb->num_read_pages = 0;
984 memset(p_acl_cb->peer_lmp_feature_pages, 0,
985 sizeof(p_acl_cb->peer_lmp_feature_pages));
987 /* first send read remote supported features HCI command */
988 /* because we don't know whether the remote support extended feature command
990 btsnd_hcic_rmt_features_req(handle);
993 /*******************************************************************************
995 * Function btm_read_remote_ext_features
997 * Description Local function called to send a read remote extended
1002 ******************************************************************************/
1003 void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number) {
1004 BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle,
1007 btsnd_hcic_rmt_ext_features(handle, page_number);
1010 /*******************************************************************************
1012 * Function btm_read_remote_features_complete
1014 * Description This function is called when the remote supported features
1015 * complete event is received from the HCI.
1019 ******************************************************************************/
1020 void btm_read_remote_features_complete(uint8_t* p) {
1021 tACL_CONN* p_acl_cb;
1026 BTM_TRACE_DEBUG("btm_read_remote_features_complete");
1027 STREAM_TO_UINT8(status, p);
1029 if (status != HCI_SUCCESS) {
1030 BTM_TRACE_ERROR("btm_read_remote_features_complete failed (status 0x%02x)",
1035 STREAM_TO_UINT16(handle, p);
1037 acl_idx = btm_handle_to_acl_index(handle);
1038 if (acl_idx >= MAX_L2CAP_LINKS) {
1039 BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid",
1044 p_acl_cb = &btm_cb.acl_db[acl_idx];
1046 /* Copy the received features page */
1047 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[0], p,
1048 HCI_FEATURE_BYTES_PER_PAGE);
1050 if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_feature_pages[0])) &&
1051 (controller_get_interface()
1052 ->supports_reading_remote_extended_features())) {
1053 /* if the remote controller has extended features and local controller
1054 supports HCI_Read_Remote_Extended_Features command then start reading
1055 these feature starting with extended features page 1 */
1056 BTM_TRACE_DEBUG("Start reading remote extended features");
1057 btm_read_remote_ext_features(handle, 1);
1061 /* Remote controller has no extended features. Process remote controller
1062 supported features (features page 0). */
1063 btm_process_remote_ext_features(p_acl_cb, 1);
1065 /* Continue with HCI connection establishment */
1066 btm_establish_continue(p_acl_cb);
1069 /*******************************************************************************
1071 * Function btm_read_remote_ext_features_complete
1073 * Description This function is called when the remote extended features
1074 * complete event is received from the HCI.
1078 ******************************************************************************/
1079 void btm_read_remote_ext_features_complete(uint8_t* p) {
1080 tACL_CONN* p_acl_cb;
1081 uint8_t page_num, max_page;
1085 BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
1088 STREAM_TO_UINT16(handle, p);
1089 STREAM_TO_UINT8(page_num, p);
1090 STREAM_TO_UINT8(max_page, p);
1092 /* Validate parameters */
1093 acl_idx = btm_handle_to_acl_index(handle);
1094 if (acl_idx >= MAX_L2CAP_LINKS) {
1095 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid",
1100 if (max_page > HCI_EXT_FEATURES_PAGE_MAX) {
1101 BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown",
1106 p_acl_cb = &btm_cb.acl_db[acl_idx];
1108 /* Copy the received features page */
1109 STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[page_num], p,
1110 HCI_FEATURE_BYTES_PER_PAGE);
1112 /* If there is the next remote features page and
1113 * we have space to keep this page data - read this page */
1114 if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX)) {
1116 BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)",
1118 btm_read_remote_ext_features(handle, page_num);
1122 /* Reading of remote feature pages is complete */
1123 BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)",
1126 /* Process the pages */
1127 btm_process_remote_ext_features(p_acl_cb, (uint8_t)(page_num + 1));
1129 /* Continue with HCI connection establishment */
1130 btm_establish_continue(p_acl_cb);
1133 /*******************************************************************************
1135 * Function btm_read_remote_ext_features_failed
1137 * Description This function is called when the remote extended features
1138 * complete event returns a failed status.
1142 ******************************************************************************/
1143 void btm_read_remote_ext_features_failed(uint8_t status, uint16_t handle) {
1144 tACL_CONN* p_acl_cb;
1148 "btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1151 acl_idx = btm_handle_to_acl_index(handle);
1152 if (acl_idx >= MAX_L2CAP_LINKS) {
1153 BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid",
1158 p_acl_cb = &btm_cb.acl_db[acl_idx];
1160 /* Process supported features only */
1161 btm_process_remote_ext_features(p_acl_cb, 1);
1163 /* Continue HCI connection establishment */
1164 btm_establish_continue(p_acl_cb);
1167 /*******************************************************************************
1169 * Function btm_establish_continue
1171 * Description This function is called when the command complete message
1172 * is received from the HCI for the read local link policy
1177 ******************************************************************************/
1178 void btm_establish_continue(tACL_CONN* p_acl_cb) {
1179 tBTM_BL_EVENT_DATA evt_data;
1180 BTM_TRACE_DEBUG("btm_establish_continue");
1181 #if (BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1182 if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
1183 /* For now there are a some devices that do not like sending */
1184 /* commands events and data at the same time. */
1185 /* Set the packet types to the default allowed by the device */
1186 btm_set_packet_types(p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1188 if (btm_cb.btm_def_link_policy)
1189 BTM_SetLinkPolicy(p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1192 p_acl_cb->link_up_issued = true;
1194 /* If anyone cares, tell him database changed */
1195 if (btm_cb.p_bl_changed_cb) {
1196 evt_data.event = BTM_BL_CONN_EVT;
1197 evt_data.conn.p_bda = p_acl_cb->remote_addr;
1198 evt_data.conn.p_bdn = p_acl_cb->remote_name;
1199 evt_data.conn.p_dc = p_acl_cb->remote_dc;
1200 evt_data.conn.p_features = p_acl_cb->peer_lmp_feature_pages[0];
1201 evt_data.conn.handle = p_acl_cb->hci_handle;
1202 evt_data.conn.transport = p_acl_cb->transport;
1204 (*btm_cb.p_bl_changed_cb)(&evt_data);
1206 btm_acl_update_busy_level(BTM_BLI_ACL_UP_EVT);
1209 /*******************************************************************************
1211 * Function BTM_SetDefaultLinkSuperTout
1213 * Description Set the default value for HCI "Write Link Supervision
1215 * command to use when an ACL link is created.
1219 ******************************************************************************/
1220 void BTM_SetDefaultLinkSuperTout(uint16_t timeout) {
1221 BTM_TRACE_DEBUG("BTM_SetDefaultLinkSuperTout");
1222 btm_cb.btm_def_link_super_tout = timeout;
1225 /*******************************************************************************
1227 * Function BTM_GetLinkSuperTout
1229 * Description Read the link supervision timeout value of the connection
1231 * Returns status of the operation
1233 ******************************************************************************/
1234 tBTM_STATUS BTM_GetLinkSuperTout(BD_ADDR remote_bda, uint16_t* p_timeout) {
1235 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1237 BTM_TRACE_DEBUG("BTM_GetLinkSuperTout");
1238 if (p != (tACL_CONN*)NULL) {
1239 *p_timeout = p->link_super_tout;
1240 return (BTM_SUCCESS);
1242 /* If here, no BD Addr found */
1243 return (BTM_UNKNOWN_ADDR);
1246 /*******************************************************************************
1248 * Function BTM_SetLinkSuperTout
1250 * Description Create and send HCI "Write Link Supervision Timeout" command
1252 * Returns status of the operation
1254 ******************************************************************************/
1255 tBTM_STATUS BTM_SetLinkSuperTout(BD_ADDR remote_bda, uint16_t timeout) {
1256 tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1258 BTM_TRACE_DEBUG("BTM_SetLinkSuperTout");
1259 if (p != (tACL_CONN*)NULL) {
1260 p->link_super_tout = timeout;
1262 /* Only send if current role is Master; 2.0 spec requires this */
1263 if (p->link_role == BTM_ROLE_MASTER) {
1264 btsnd_hcic_write_link_super_tout(LOCAL_BR_EDR_CONTROLLER_ID,
1265 p->hci_handle, timeout);
1266 return (BTM_CMD_STARTED);
1268 return (BTM_SUCCESS);
1271 /* If here, no BD Addr found */
1272 return (BTM_UNKNOWN_ADDR);
1275 /*******************************************************************************
1277 * Function BTM_IsAclConnectionUp
1279 * Description This function is called to check if an ACL connection exists
1280 * to a specific remote BD Address.
1282 * Returns true if connection is up, else false.
1284 ******************************************************************************/
1285 bool BTM_IsAclConnectionUp(BD_ADDR remote_bda, tBT_TRANSPORT transport) {
1288 BTM_TRACE_API("BTM_IsAclConnectionUp: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1289 remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
1290 remote_bda[4], remote_bda[5]);
1292 p = btm_bda_to_acl(remote_bda, transport);
1293 if (p != (tACL_CONN*)NULL) {
1297 /* If here, no BD Addr found */
1301 /*******************************************************************************
1303 * Function BTM_GetNumAclLinks
1305 * Description This function is called to count the number of
1306 * ACL links that are active.
1308 * Returns uint16_t Number of active ACL links
1310 ******************************************************************************/
1311 uint16_t BTM_GetNumAclLinks(void) {
1312 uint16_t num_acl = 0;
1314 for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i) {
1315 if (btm_cb.acl_db[i].in_use) ++num_acl;
1321 /*******************************************************************************
1323 * Function btm_get_acl_disc_reason_code
1325 * Description This function is called to get the disconnection reason code
1326 * returned by the HCI at disconnection complete event.
1328 * Returns true if connection is up, else false.
1330 ******************************************************************************/
1331 uint16_t btm_get_acl_disc_reason_code(void) {
1332 uint8_t res = btm_cb.acl_disc_reason;
1333 BTM_TRACE_DEBUG("btm_get_acl_disc_reason_code");
1337 /*******************************************************************************
1339 * Function BTM_GetHCIConnHandle
1341 * Description This function is called to get the handle for an ACL
1342 * connection to a specific remote BD Address.
1344 * Returns the handle of the connection, or 0xFFFF if none.
1346 ******************************************************************************/
1347 uint16_t BTM_GetHCIConnHandle(const BD_ADDR remote_bda,
1348 tBT_TRANSPORT transport) {
1350 BTM_TRACE_DEBUG("BTM_GetHCIConnHandle");
1351 p = btm_bda_to_acl(remote_bda, transport);
1352 if (p != (tACL_CONN*)NULL) {
1353 return (p->hci_handle);
1356 /* If here, no BD Addr found */
1360 /*******************************************************************************
1362 * Function btm_process_clk_off_comp_evt
1364 * Description This function is called when clock offset command completes.
1366 * Input Parms hci_handle - connection handle associated with the change
1371 ******************************************************************************/
1372 void btm_process_clk_off_comp_evt(uint16_t hci_handle, uint16_t clock_offset) {
1374 BTM_TRACE_DEBUG("btm_process_clk_off_comp_evt");
1375 /* Look up the connection by handle and set the current mode */
1376 xx = btm_handle_to_acl_index(hci_handle);
1377 if (xx < MAX_L2CAP_LINKS) btm_cb.acl_db[xx].clock_offset = clock_offset;
1380 /*******************************************************************************
1382 * Function btm_blacklist_role_change_device
1384 * Description This function is used to blacklist the device if the role
1385 * switch fails for maximum number of times. It also removes
1386 * the device from the black list if the role switch succeeds.
1388 * Input Parms bd_addr - remote BD addr
1389 * hci_status - role switch status
1393 *******************************************************************************/
1394 void btm_blacklist_role_change_device(BD_ADDR bd_addr, uint8_t hci_status) {
1395 tACL_CONN* p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
1396 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
1398 if (!p || !p_dev_rec) {
1401 if (hci_status == HCI_SUCCESS) {
1402 p->switch_role_failed_attempts = 0;
1406 /* check for carkits */
1407 const uint32_t cod_audio_device =
1408 (BTM_COD_SERVICE_AUDIO | BTM_COD_MAJOR_AUDIO) << 8;
1409 const uint32_t cod =
1410 ((p_dev_rec->dev_class[0] << 16) | (p_dev_rec->dev_class[1] << 8) |
1411 p_dev_rec->dev_class[2]) &
1413 if ((hci_status != HCI_SUCCESS) &&
1414 ((p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) ||
1415 (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)) &&
1416 ((cod & cod_audio_device) == cod_audio_device) &&
1417 (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH,
1418 (const bt_bdaddr_t*)&bd_addr))) {
1419 p->switch_role_failed_attempts++;
1420 if (p->switch_role_failed_attempts == BTM_MAX_SW_ROLE_FAILED_ATTEMPTS) {
1422 "%s: Device %02x:%02x:%02x:%02x:%02x:%02x blacklisted for role "
1423 "switching - multiple role switch failed attempts: %u",
1424 __func__, bd_addr[0], bd_addr[1], bd_addr[2], bd_addr[3], bd_addr[4],
1425 bd_addr[5], p->switch_role_failed_attempts);
1426 interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH,
1427 (const bt_bdaddr_t*)&bd_addr, 3);
1432 /*******************************************************************************
1434 * Function btm_acl_role_changed
1436 * Description This function is called whan a link's master/slave role
1437 * change event or command status event (with error) is
1438 * received. It updates the link control block, and calls the
1439 * registered callback with status and role (if registered).
1443 ******************************************************************************/
1444 void btm_acl_role_changed(uint8_t hci_status, BD_ADDR bd_addr,
1447 (bd_addr) ? bd_addr : btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1448 tACL_CONN* p = btm_bda_to_acl(p_bda, BT_TRANSPORT_BR_EDR);
1449 tBTM_ROLE_SWITCH_CMPL* p_data = &btm_cb.devcb.switch_role_ref_data;
1450 tBTM_SEC_DEV_REC* p_dev_rec;
1451 tBTM_BL_ROLE_CHG_DATA evt;
1453 BTM_TRACE_DEBUG("btm_acl_role_changed");
1454 /* Ignore any stray events */
1456 /* it could be a failure */
1457 if (hci_status != HCI_SUCCESS)
1458 btm_acl_report_role_change(hci_status, bd_addr);
1462 p_data->hci_status = hci_status;
1464 if (hci_status == HCI_SUCCESS) {
1465 p_data->role = new_role;
1466 memcpy(p_data->remote_bd_addr, p_bda, BD_ADDR_LEN);
1468 /* Update cached value */
1469 p->link_role = new_role;
1471 /* Reload LSTO: link supervision timeout is reset in the LM after a role
1473 if (new_role == BTM_ROLE_MASTER) {
1474 BTM_SetLinkSuperTout(p->remote_addr, p->link_super_tout);
1477 /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1478 new_role = p->link_role;
1481 /* Check if any SCO req is pending for role change */
1482 btm_sco_chk_pend_rolechange(p->hci_handle);
1484 /* if switching state is switching we need to turn encryption on */
1485 /* if idle, we did not change encryption */
1486 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) {
1487 btsnd_hcic_set_conn_encrypt(p->hci_handle, true);
1488 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1489 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1493 /* Set the switch_role_state to IDLE since the reply received from HCI */
1494 /* regardless of its result either success or failed. */
1495 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS) {
1496 p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1497 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1500 /* if role switch complete is needed, report it now */
1501 btm_acl_report_role_change(hci_status, bd_addr);
1503 /* if role change event is registered, report it now */
1504 if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
1505 evt.event = BTM_BL_ROLE_CHG_EVT;
1506 evt.new_role = new_role;
1508 evt.hci_status = hci_status;
1509 (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
1513 "Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
1514 p_data->role, p_data->hci_status, p->switch_role_state);
1516 #if (BTM_DISC_DURING_RS == TRUE)
1517 /* If a disconnect is pending, issue it now that role switch has completed */
1518 p_dev_rec = btm_find_dev(p_bda);
1519 if (p_dev_rec != NULL) {
1520 if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
1522 "btm_acl_role_changed -> Issuing delayed HCI_Disconnect!!!");
1523 btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1525 BTM_TRACE_ERROR("tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1526 PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1527 p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
1533 /*******************************************************************************
1535 * Function BTM_AllocateSCN
1537 * Description Look through the Server Channel Numbers for a free one.
1539 * Returns Allocated SCN number or 0 if none.
1541 ******************************************************************************/
1543 uint8_t BTM_AllocateSCN(void) {
1545 BTM_TRACE_DEBUG("BTM_AllocateSCN");
1547 // stack reserves scn 1 for HFP, HSP we still do the correct way
1548 for (x = 1; x < BTM_MAX_SCN; x++) {
1549 if (!btm_cb.btm_scn[x]) {
1550 btm_cb.btm_scn[x] = true;
1555 return (0); /* No free ports */
1558 /*******************************************************************************
1560 * Function BTM_TryAllocateSCN
1562 * Description Try to allocate a fixed server channel
1564 * Returns Returns true if server channel was available
1566 ******************************************************************************/
1568 bool BTM_TryAllocateSCN(uint8_t scn) {
1569 /* Make sure we don't exceed max port range.
1570 * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1572 if ((scn >= BTM_MAX_SCN) || (scn == 1)) return false;
1574 /* check if this port is available */
1575 if (!btm_cb.btm_scn[scn - 1]) {
1576 btm_cb.btm_scn[scn - 1] = true;
1580 return (false); /* Port was busy */
1583 /*******************************************************************************
1585 * Function BTM_FreeSCN
1587 * Description Free the specified SCN.
1589 * Returns true or false
1591 ******************************************************************************/
1592 bool BTM_FreeSCN(uint8_t scn) {
1593 BTM_TRACE_DEBUG("BTM_FreeSCN ");
1594 if (scn <= BTM_MAX_SCN) {
1595 btm_cb.btm_scn[scn - 1] = false;
1598 return (false); /* Illegal SCN passed in */
1601 /*******************************************************************************
1603 * Function btm_set_packet_types
1605 * Description This function sets the packet types used for a specific
1606 * ACL connection. It is called internally by btm_acl_created
1607 * or by an application/profile by BTM_SetPacketTypes.
1609 * Returns status of the operation
1611 ******************************************************************************/
1612 tBTM_STATUS btm_set_packet_types(tACL_CONN* p, uint16_t pkt_types) {
1613 uint16_t temp_pkt_types;
1614 BTM_TRACE_DEBUG("btm_set_packet_types");
1615 /* Save in the ACL control blocks, types that we support */
1616 temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1617 btm_cb.btm_acl_pkt_types_supported);
1619 /* OR in any exception packet types if at least 2.0 version of spec */
1621 ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1622 (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1624 /* Exclude packet types not supported by the peer */
1625 btm_acl_chk_peer_pkt_type_support(p, &temp_pkt_types);
1627 BTM_TRACE_DEBUG("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1629 btsnd_hcic_change_conn_type(p->hci_handle, temp_pkt_types);
1630 p->pkt_types_mask = temp_pkt_types;
1632 return (BTM_CMD_STARTED);
1635 /*******************************************************************************
1637 * Function btm_get_max_packet_size
1639 * Returns Returns maximum packet size that can be used for current
1640 * connection, 0 if connection is not established
1642 ******************************************************************************/
1643 uint16_t btm_get_max_packet_size(BD_ADDR addr) {
1644 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1645 uint16_t pkt_types = 0;
1646 uint16_t pkt_size = 0;
1647 BTM_TRACE_DEBUG("btm_get_max_packet_size");
1649 pkt_types = p->pkt_types_mask;
1651 /* Special case for when info for the local device is requested */
1652 if (memcmp(controller_get_interface()->get_address(), addr, BD_ADDR_LEN) ==
1654 pkt_types = btm_cb.btm_acl_pkt_types_supported;
1659 if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1660 pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1661 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1662 pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1663 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1664 pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1665 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1666 pkt_size = HCI_DH5_PACKET_SIZE;
1667 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1668 pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1669 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1670 pkt_size = HCI_DM5_PACKET_SIZE;
1671 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1672 pkt_size = HCI_DH3_PACKET_SIZE;
1673 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1674 pkt_size = HCI_DM3_PACKET_SIZE;
1675 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1676 pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1677 else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1678 pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1679 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1680 pkt_size = HCI_DH1_PACKET_SIZE;
1681 else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1682 pkt_size = HCI_DM1_PACKET_SIZE;
1688 /*******************************************************************************
1690 * Function BTM_ReadRemoteVersion
1692 * Returns If connected report peer device info
1694 ******************************************************************************/
1695 tBTM_STATUS BTM_ReadRemoteVersion(BD_ADDR addr, uint8_t* lmp_version,
1696 uint16_t* manufacturer,
1697 uint16_t* lmp_sub_version) {
1698 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1699 BTM_TRACE_DEBUG("BTM_ReadRemoteVersion");
1700 if (p == NULL) return (BTM_UNKNOWN_ADDR);
1702 if (lmp_version) *lmp_version = p->lmp_version;
1704 if (manufacturer) *manufacturer = p->manufacturer;
1706 if (lmp_sub_version) *lmp_sub_version = p->lmp_subversion;
1708 return (BTM_SUCCESS);
1711 /*******************************************************************************
1713 * Function BTM_ReadRemoteFeatures
1715 * Returns pointer to the remote supported features mask (8 bytes)
1717 ******************************************************************************/
1718 uint8_t* BTM_ReadRemoteFeatures(BD_ADDR addr) {
1719 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1720 BTM_TRACE_DEBUG("BTM_ReadRemoteFeatures");
1725 return (p->peer_lmp_feature_pages[0]);
1728 /*******************************************************************************
1730 * Function BTM_ReadRemoteExtendedFeatures
1732 * Returns pointer to the remote extended features mask (8 bytes)
1733 * or NULL if bad page
1735 ******************************************************************************/
1736 uint8_t* BTM_ReadRemoteExtendedFeatures(BD_ADDR addr, uint8_t page_number) {
1737 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1738 BTM_TRACE_DEBUG("BTM_ReadRemoteExtendedFeatures");
1743 if (page_number > HCI_EXT_FEATURES_PAGE_MAX) {
1744 BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown",
1749 return (p->peer_lmp_feature_pages[page_number]);
1752 /*******************************************************************************
1754 * Function BTM_ReadNumberRemoteFeaturesPages
1756 * Returns number of features pages read from the remote device.
1758 ******************************************************************************/
1759 uint8_t BTM_ReadNumberRemoteFeaturesPages(BD_ADDR addr) {
1760 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1761 BTM_TRACE_DEBUG("BTM_ReadNumberRemoteFeaturesPages");
1766 return (p->num_read_pages);
1769 /*******************************************************************************
1771 * Function BTM_ReadAllRemoteFeatures
1773 * Returns pointer to all features of the remote (24 bytes).
1775 ******************************************************************************/
1776 uint8_t* BTM_ReadAllRemoteFeatures(BD_ADDR addr) {
1777 tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1778 BTM_TRACE_DEBUG("BTM_ReadAllRemoteFeatures");
1783 return (p->peer_lmp_feature_pages[0]);
1786 /*******************************************************************************
1788 * Function BTM_RegBusyLevelNotif
1790 * Description This function is called to register a callback to receive
1791 * busy level change events.
1793 * Returns BTM_SUCCESS if successfully registered, otherwise error
1795 ******************************************************************************/
1796 tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
1797 tBTM_BL_EVENT_MASK evt_mask) {
1798 BTM_TRACE_DEBUG("BTM_RegBusyLevelNotif");
1799 if (p_level) *p_level = btm_cb.busy_level;
1801 btm_cb.bl_evt_mask = evt_mask;
1804 btm_cb.p_bl_changed_cb = NULL;
1805 else if (btm_cb.p_bl_changed_cb)
1808 btm_cb.p_bl_changed_cb = p_cb;
1810 return (BTM_SUCCESS);
1813 /*******************************************************************************
1815 * Function BTM_SetQoS
1817 * Description This function is called to setup QoS
1819 * Returns status of the operation
1821 ******************************************************************************/
1822 tBTM_STATUS BTM_SetQoS(BD_ADDR bd, FLOW_SPEC* p_flow, tBTM_CMPL_CB* p_cb) {
1823 tACL_CONN* p = &btm_cb.acl_db[0];
1825 BTM_TRACE_API("BTM_SetQoS: BdAddr: %02x%02x%02x%02x%02x%02x", bd[0], bd[1],
1826 bd[2], bd[3], bd[4], bd[5]);
1828 /* If someone already waiting on the version, do not allow another */
1829 if (btm_cb.devcb.p_qos_setup_cmpl_cb) return (BTM_BUSY);
1831 p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR);
1833 btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
1834 alarm_set_on_queue(btm_cb.devcb.qos_setup_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1835 btm_qos_setup_timeout, NULL, btu_general_alarm_queue);
1837 btsnd_hcic_qos_setup(p->hci_handle, p_flow->qos_flags, p_flow->service_type,
1838 p_flow->token_rate, p_flow->peak_bandwidth,
1839 p_flow->latency, p_flow->delay_variation);
1840 return (BTM_CMD_STARTED);
1843 /* If here, no BD Addr found */
1844 return (BTM_UNKNOWN_ADDR);
1847 /*******************************************************************************
1849 * Function btm_qos_setup_timeout
1851 * Description Callback when QoS setup times out.
1855 ******************************************************************************/
1856 void btm_qos_setup_timeout(UNUSED_ATTR void* data) {
1857 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1858 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1859 if (p_cb) (*p_cb)((void*)NULL);
1862 /*******************************************************************************
1864 * Function btm_qos_setup_complete
1866 * Description This function is called when the command complete message
1867 * is received from the HCI for the qos setup request.
1871 ******************************************************************************/
1872 void btm_qos_setup_complete(uint8_t status, uint16_t handle,
1873 FLOW_SPEC* p_flow) {
1874 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1875 tBTM_QOS_SETUP_CMPL qossu;
1877 BTM_TRACE_DEBUG("%s", __func__);
1878 alarm_cancel(btm_cb.devcb.qos_setup_timer);
1879 btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1881 /* If there was a registered callback, call it */
1883 memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1884 qossu.status = status;
1885 qossu.handle = handle;
1886 if (p_flow != NULL) {
1887 qossu.flow.qos_flags = p_flow->qos_flags;
1888 qossu.flow.service_type = p_flow->service_type;
1889 qossu.flow.token_rate = p_flow->token_rate;
1890 qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1891 qossu.flow.latency = p_flow->latency;
1892 qossu.flow.delay_variation = p_flow->delay_variation;
1894 BTM_TRACE_DEBUG("BTM: p_flow->delay_variation: 0x%02x",
1895 qossu.flow.delay_variation);
1900 /*******************************************************************************
1902 * Function BTM_ReadRSSI
1904 * Description This function is called to read the link policy settings.
1905 * The address of link policy results are returned in the
1907 * (tBTM_RSSI_RESULTS)
1909 * Returns BTM_CMD_STARTED if successfully initiated or error code
1911 ******************************************************************************/
1912 tBTM_STATUS BTM_ReadRSSI(const BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
1914 tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
1915 tBT_DEVICE_TYPE dev_type;
1916 tBLE_ADDR_TYPE addr_type;
1917 BTM_TRACE_API("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1918 remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
1919 remote_bda[4], remote_bda[5]);
1921 /* If someone already waiting on the version, do not allow another */
1922 if (btm_cb.devcb.p_rssi_cmpl_cb) return (BTM_BUSY);
1924 BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1925 if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
1927 p = btm_bda_to_acl(remote_bda, transport);
1928 if (p != (tACL_CONN*)NULL) {
1929 btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
1930 alarm_set_on_queue(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1931 btm_read_rssi_timeout, NULL, btu_general_alarm_queue);
1933 btsnd_hcic_read_rssi(p->hci_handle);
1934 return (BTM_CMD_STARTED);
1937 /* If here, no BD Addr found */
1938 return (BTM_UNKNOWN_ADDR);
1941 /*******************************************************************************
1943 * Function BTM_ReadLinkQuality
1945 * Description This function is called to read the link qulaity.
1946 * The value of the link quality is returned in the callback.
1947 * (tBTM_LINK_QUALITY_RESULTS)
1949 * Returns BTM_CMD_STARTED if successfully initiated or error code
1951 ******************************************************************************/
1952 tBTM_STATUS BTM_ReadLinkQuality(BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
1955 BTM_TRACE_API("BTM_ReadLinkQuality: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1956 remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
1957 remote_bda[4], remote_bda[5]);
1959 /* If someone already waiting on the version, do not allow another */
1960 if (btm_cb.devcb.p_link_qual_cmpl_cb) return (BTM_BUSY);
1962 p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1963 if (p != (tACL_CONN*)NULL) {
1964 btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
1965 alarm_set_on_queue(btm_cb.devcb.read_link_quality_timer,
1966 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_link_quality_timeout,
1967 NULL, btu_general_alarm_queue);
1969 btsnd_hcic_get_link_quality(p->hci_handle);
1970 return (BTM_CMD_STARTED);
1973 /* If here, no BD Addr found */
1974 return (BTM_UNKNOWN_ADDR);
1977 /*******************************************************************************
1979 * Function BTM_ReadTxPower
1981 * Description This function is called to read the current
1982 * TX power of the connection. The tx power level results
1983 * are returned in the callback.
1984 * (tBTM_RSSI_RESULTS)
1986 * Returns BTM_CMD_STARTED if successfully initiated or error code
1988 ******************************************************************************/
1989 tBTM_STATUS BTM_ReadTxPower(BD_ADDR remote_bda, tBT_TRANSPORT transport,
1990 tBTM_CMPL_CB* p_cb) {
1992 #define BTM_READ_RSSI_TYPE_CUR 0x00
1993 #define BTM_READ_RSSI_TYPE_MAX 0X01
1995 BTM_TRACE_API("BTM_ReadTxPower: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1996 remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
1997 remote_bda[4], remote_bda[5]);
1999 /* If someone already waiting on the version, do not allow another */
2000 if (btm_cb.devcb.p_tx_power_cmpl_cb) return (BTM_BUSY);
2002 p = btm_bda_to_acl(remote_bda, transport);
2003 if (p != (tACL_CONN*)NULL) {
2004 btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2005 alarm_set_on_queue(btm_cb.devcb.read_tx_power_timer,
2006 BTM_DEV_REPLY_TIMEOUT_MS, btm_read_tx_power_timeout,
2007 NULL, btu_general_alarm_queue);
2009 if (p->transport == BT_TRANSPORT_LE) {
2010 memcpy(btm_cb.devcb.read_tx_pwr_addr, remote_bda, BD_ADDR_LEN);
2011 btsnd_hcic_ble_read_adv_chnl_tx_power();
2013 btsnd_hcic_read_tx_power(p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2016 return (BTM_CMD_STARTED);
2019 /* If here, no BD Addr found */
2020 return (BTM_UNKNOWN_ADDR);
2023 /*******************************************************************************
2025 * Function btm_read_tx_power_timeout
2027 * Description Callback when reading the tx power times out.
2031 ******************************************************************************/
2032 void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {
2033 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2034 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2035 if (p_cb) (*p_cb)((void*)NULL);
2038 /*******************************************************************************
2040 * Function btm_read_tx_power_complete
2042 * Description This function is called when the command complete message
2043 * is received from the HCI for the read tx power request.
2047 ******************************************************************************/
2048 void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
2049 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2050 tBTM_TX_POWER_RESULTS results;
2052 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2055 BTM_TRACE_DEBUG("%s", __func__);
2056 alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2057 btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2059 /* If there was a registered callback, call it */
2061 STREAM_TO_UINT8(results.hci_status, p);
2063 if (results.hci_status == HCI_SUCCESS) {
2064 results.status = BTM_SUCCESS;
2067 STREAM_TO_UINT16(handle, p);
2068 STREAM_TO_UINT8(results.tx_power, p);
2070 /* Search through the list of active channels for the correct BD Addr */
2071 for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2072 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2073 memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2078 STREAM_TO_UINT8(results.tx_power, p);
2079 memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN);
2081 BTM_TRACE_DEBUG("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2082 results.tx_power, results.hci_status);
2084 results.status = BTM_ERR_PROCESSING;
2090 /*******************************************************************************
2092 * Function btm_read_rssi_timeout
2094 * Description Callback when reading the RSSI times out.
2098 ******************************************************************************/
2099 void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
2100 tBTM_RSSI_RESULTS results;
2101 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2102 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2103 results.status = BTM_DEVICE_TIMEOUT;
2108 /*******************************************************************************
2110 * Function btm_read_rssi_complete
2112 * Description This function is called when the command complete message
2113 * is received from the HCI for the read rssi request.
2117 ******************************************************************************/
2118 void btm_read_rssi_complete(uint8_t* p) {
2119 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2120 tBTM_RSSI_RESULTS results;
2122 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2125 BTM_TRACE_DEBUG("%s", __func__);
2126 alarm_cancel(btm_cb.devcb.read_rssi_timer);
2127 btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2129 /* If there was a registered callback, call it */
2131 STREAM_TO_UINT8(results.hci_status, p);
2133 if (results.hci_status == HCI_SUCCESS) {
2134 results.status = BTM_SUCCESS;
2136 STREAM_TO_UINT16(handle, p);
2138 STREAM_TO_UINT8(results.rssi, p);
2139 BTM_TRACE_DEBUG("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2140 results.rssi, results.hci_status);
2142 /* Search through the list of active channels for the correct BD Addr */
2143 for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2144 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2145 memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2150 results.status = BTM_ERR_PROCESSING;
2156 /*******************************************************************************
2158 * Function btm_read_link_quality_timeout
2160 * Description Callback when reading the link quality times out.
2164 ******************************************************************************/
2165 void btm_read_link_quality_timeout(UNUSED_ATTR void* data) {
2166 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2167 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2168 if (p_cb) (*p_cb)((void*)NULL);
2171 /*******************************************************************************
2173 * Function btm_read_link_quality_complete
2175 * Description This function is called when the command complete message
2176 * is received from the HCI for the read link quality.
2180 ******************************************************************************/
2181 void btm_read_link_quality_complete(uint8_t* p) {
2182 tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2183 tBTM_LINK_QUALITY_RESULTS results;
2185 tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2188 BTM_TRACE_DEBUG("%s", __func__);
2189 alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2190 btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2192 /* If there was a registered callback, call it */
2194 STREAM_TO_UINT8(results.hci_status, p);
2196 if (results.hci_status == HCI_SUCCESS) {
2197 results.status = BTM_SUCCESS;
2199 STREAM_TO_UINT16(handle, p);
2201 STREAM_TO_UINT8(results.link_quality, p);
2203 "BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2204 results.link_quality, results.hci_status);
2206 /* Search through the list of active channels for the correct BD Addr */
2207 for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2208 if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2209 memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2214 results.status = BTM_ERR_PROCESSING;
2220 /*******************************************************************************
2222 * Function btm_remove_acl
2224 * Description This function is called to disconnect an ACL connection
2226 * Returns BTM_SUCCESS if successfully initiated, otherwise
2229 ******************************************************************************/
2230 tBTM_STATUS btm_remove_acl(BD_ADDR bd_addr, tBT_TRANSPORT transport) {
2231 uint16_t hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2232 tBTM_STATUS status = BTM_SUCCESS;
2234 BTM_TRACE_DEBUG("btm_remove_acl");
2235 #if (BTM_DISC_DURING_RS == TRUE)
2236 tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
2238 /* Role Switch is pending, postpone until completed */
2239 if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING)) {
2240 p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2241 } else /* otherwise can disconnect right away */
2244 if (hci_handle != 0xFFFF && p_dev_rec &&
2245 p_dev_rec->sec_state != BTM_SEC_STATE_DISCONNECTING) {
2246 btsnd_hcic_disconnect(hci_handle, HCI_ERR_PEER_USER);
2248 status = BTM_UNKNOWN_ADDR;
2254 /*******************************************************************************
2256 * Function BTM_SetTraceLevel
2258 * Description This function sets the trace level for BTM. If called with
2259 * a value of 0xFF, it simply returns the current trace level.
2261 * Returns The new or current trace level
2263 ******************************************************************************/
2264 uint8_t BTM_SetTraceLevel(uint8_t new_level) {
2265 BTM_TRACE_DEBUG("BTM_SetTraceLevel");
2266 if (new_level != 0xFF) btm_cb.trace_level = new_level;
2268 return (btm_cb.trace_level);
2271 /*******************************************************************************
2273 * Function btm_cont_rswitch
2275 * Description This function is called to continue processing an active
2276 * role switch. It first disables encryption if enabled and
2277 * EPR is not supported
2281 ******************************************************************************/
2282 void btm_cont_rswitch(tACL_CONN* p, tBTM_SEC_DEV_REC* p_dev_rec,
2283 uint8_t hci_status) {
2284 BTM_TRACE_DEBUG("btm_cont_rswitch");
2285 /* Check to see if encryption needs to be turned off if pending
2286 change of link key or role switch */
2287 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2288 /* Must turn off Encryption first if necessary */
2289 /* Some devices do not support switch or change of link key while encryption
2291 if (p_dev_rec != NULL &&
2292 ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
2293 !BTM_EPR_AVAILABLE(p)) {
2294 btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
2295 p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2296 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2297 p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2298 } else /* Encryption not used or EPR supported, continue with switch
2299 and/or change of link key */
2301 if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2302 p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2303 #if (BTM_DISC_DURING_RS == TRUE)
2304 if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2306 btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
2312 /*******************************************************************************
2314 * Function btm_acl_resubmit_page
2316 * Description send pending page request
2318 ******************************************************************************/
2319 void btm_acl_resubmit_page(void) {
2320 tBTM_SEC_DEV_REC* p_dev_rec;
2324 BTM_TRACE_DEBUG("btm_acl_resubmit_page");
2325 /* If there were other page request schedule can start the next one */
2326 p_buf = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue);
2327 if (p_buf != NULL) {
2328 /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2329 * for both create_conn and rmt_name */
2330 pp = (uint8_t*)(p_buf + 1) + p_buf->offset + 3;
2332 STREAM_TO_BDADDR(bda, pp);
2334 p_dev_rec = btm_find_or_alloc_dev(bda);
2336 memcpy(btm_cb.connecting_bda, p_dev_rec->bd_addr, BD_ADDR_LEN);
2337 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2339 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2341 btm_cb.paging = false;
2344 /*******************************************************************************
2346 * Function btm_acl_reset_paging
2348 * Description set paging to false and free the page queue - called at
2351 ******************************************************************************/
2352 void btm_acl_reset_paging(void) {
2354 BTM_TRACE_DEBUG("btm_acl_reset_paging");
2355 /* If we sent reset we are definitely not paging any more */
2356 while ((p = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2359 btm_cb.paging = false;
2362 /*******************************************************************************
2364 * Function btm_acl_paging
2366 * Description send a paging command or queue it in btm_cb
2368 ******************************************************************************/
2369 void btm_acl_paging(BT_HDR* p, BD_ADDR bda) {
2370 tBTM_SEC_DEV_REC* p_dev_rec;
2372 BTM_TRACE_DEBUG("btm_acl_paging discing:%d, paging:%d BDA: %06x%06x",
2373 btm_cb.discing, btm_cb.paging,
2374 (bda[0] << 16) + (bda[1] << 8) + bda[2],
2375 (bda[3] << 16) + (bda[4] << 8) + bda[5]);
2376 if (btm_cb.discing) {
2377 btm_cb.paging = true;
2378 fixed_queue_enqueue(btm_cb.page_queue, p);
2380 if (!BTM_ACL_IS_CONNECTED(bda)) {
2382 "connecting_bda: %06x%06x",
2383 (btm_cb.connecting_bda[0] << 16) + (btm_cb.connecting_bda[1] << 8) +
2384 btm_cb.connecting_bda[2],
2385 (btm_cb.connecting_bda[3] << 16) + (btm_cb.connecting_bda[4] << 8) +
2386 btm_cb.connecting_bda[5]);
2387 if (btm_cb.paging &&
2388 memcmp(bda, btm_cb.connecting_bda, BD_ADDR_LEN) != 0) {
2389 fixed_queue_enqueue(btm_cb.page_queue, p);
2391 p_dev_rec = btm_find_or_alloc_dev(bda);
2392 memcpy(btm_cb.connecting_bda, p_dev_rec->bd_addr, BD_ADDR_LEN);
2393 memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2395 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2398 btm_cb.paging = true;
2399 } else /* ACL is already up */
2401 btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2406 /*******************************************************************************
2408 * Function btm_acl_notif_conn_collision
2410 * Description Send connection collision event to upper layer if registered
2412 * Returns true if sent out to upper layer,
2413 * false if no one needs the notification.
2415 ******************************************************************************/
2416 bool btm_acl_notif_conn_collision(BD_ADDR bda) {
2417 tBTM_BL_EVENT_DATA evt_data;
2419 /* Report possible collision to the upper layer. */
2420 if (btm_cb.p_bl_changed_cb) {
2422 "btm_acl_notif_conn_collision: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2423 bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
2425 evt_data.event = BTM_BL_COLLISION_EVT;
2426 evt_data.conn.p_bda = bda;
2427 evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2428 evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2429 (*btm_cb.p_bl_changed_cb)(&evt_data);
2435 /*******************************************************************************
2437 * Function btm_acl_chk_peer_pkt_type_support
2439 * Description Check if peer supports requested packets
2441 ******************************************************************************/
2442 void btm_acl_chk_peer_pkt_type_support(tACL_CONN* p, uint16_t* p_pkt_type) {
2443 /* 3 and 5 slot packets? */
2444 if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2445 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 + BTM_ACL_PKT_TYPES_MASK_DM3);
2447 if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2448 *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2450 /* 2 and 3 MPS support? */
2451 if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2452 /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2454 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2455 BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2457 if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2458 /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2460 (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2461 BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2463 /* EDR 3 and 5 slot support? */
2464 if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]) ||
2465 HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0])) {
2466 if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2467 /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types
2470 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2472 if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2473 /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types
2476 (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);