stack/btm/btm_acl.cc

   1 /******************************************************************************
   2  *
   3  *  Copyright (C) 2000-2012 Broadcom Corporation
   4  *
   5  *  Licensed under the Apache License, Version 2.0 (the "License");
   6  *  you may not use this file except in compliance with the License.
   7  *  You may obtain a copy of the License at:
   8  *
   9  *  http://www.apache.org/licenses/LICENSE-2.0
  10  *
  11  *  Unless required by applicable law or agreed to in writing, software
  12  *  distributed under the License is distributed on an "AS IS" BASIS,
  13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  14  *  See the License for the specific language governing permissions and
  15  *  limitations under the License.
  16  *
  17  ******************************************************************************/
  18
  19 /*****************************************************************************
  20  *
  21  *  Name:          btm_acl.cc
  22  *
  23  *  Description:   This file contains functions that handle ACL connections.
  24  *                 This includes operations such as hold and sniff modes,
  25  *                 supported packet types.
  26  *
  27  *                 This module contains both internal and external (API)
  28  *                 functions. External (API) functions are distinguishable
  29  *                 by their names beginning with uppercase BTM.
  30  *
  31  *
  32  *****************************************************************************/
  33
  34 #include <stddef.h>
  35 #include <stdio.h>
  36 #include <stdlib.h>
  37 #include <string.h>
  38
  39 #include "bt_common.h"
  40 #include "bt_target.h"
  41 #include "bt_types.h"
  42 #include "bt_utils.h"
  43 #include "btm_api.h"
  44 #include "btm_int.h"
  45 #include "btu.h"
  46 #include "device/include/controller.h"
  47 #include "device/include/interop.h"
  48 #include "hcidefs.h"
  49 #include "hcimsgs.h"
  50 #include "l2c_int.h"
  51 #include "osi/include/osi.h"
  52
  53 extern fixed_queue_t* btu_general_alarm_queue;
  54
  55 static void btm_read_remote_features(uint16_t handle);
  56 static void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number);
  57 static void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
  58                                             uint8_t num_read_pages);
  59
  60 /* 3 seconds timeout waiting for responses */
  61 #define BTM_DEV_REPLY_TIMEOUT_MS (3 * 1000)
  62
  63 /*******************************************************************************
  64  *
  65  * Function         btm_acl_init
  66  *
  67  * Description      This function is called at BTM startup to initialize
  68  *
  69  * Returns          void
  70  *
  71  ******************************************************************************/
  72 void btm_acl_init(void) {
  73   BTM_TRACE_DEBUG("btm_acl_init");
  74   /* Initialize nonzero defaults */
  75   btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
  76   btm_cb.acl_disc_reason = 0xff;
  77 }
  78
  79 /*******************************************************************************
  80  *
  81  * Function        btm_bda_to_acl
  82  *
  83  * Description     This function returns the FIRST acl_db entry for the passed
  84  *                 BDA.
  85  *
  86  * Parameters      bda : BD address of the remote device
  87  *                 transport : Physical transport used for ACL connection
  88  *                 (BR/EDR or LE)
  89  *
  90  * Returns         Returns pointer to the ACL DB for the requested BDA if found.
  91  *                 NULL if not found.
  92  *
  93  ******************************************************************************/
  94 tACL_CONN* btm_bda_to_acl(const BD_ADDR bda, tBT_TRANSPORT transport) {
  95   tACL_CONN* p = &btm_cb.acl_db[0];
  96   uint16_t xx;
  97   if (bda) {
  98     for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
  99       if ((p->in_use) && (!memcmp(p->remote_addr, bda, BD_ADDR_LEN)) &&
 100           p->transport == transport) {
 101         BTM_TRACE_DEBUG("btm_bda_to_acl found");
 102         return (p);
 103       }
 104     }
 105   }
 106
 107   /* If here, no BD Addr found */
 108   return ((tACL_CONN*)NULL);
 109 }
 110
 111 /*******************************************************************************
 112  *
 113  * Function         btm_handle_to_acl_index
 114  *
 115  * Description      This function returns the FIRST acl_db entry for the passed
 116  *                  hci_handle.
 117  *
 118  * Returns          index to the acl_db or MAX_L2CAP_LINKS.
 119  *
 120  ******************************************************************************/
 121 uint8_t btm_handle_to_acl_index(uint16_t hci_handle) {
 122   tACL_CONN* p = &btm_cb.acl_db[0];
 123   uint8_t xx;
 124   BTM_TRACE_DEBUG("btm_handle_to_acl_index");
 125   for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
 126     if ((p->in_use) && (p->hci_handle == hci_handle)) {
 127       break;
 128     }
 129   }
 130
 131   /* If here, no BD Addr found */
 132   return (xx);
 133 }
 134
 135 #if (BLE_PRIVACY_SPT == TRUE)
 136 /*******************************************************************************
 137  *
 138  * Function         btm_ble_get_acl_remote_addr
 139  *
 140  * Description      This function reads the active remote address used for the
 141  *                  connection.
 142  *
 143  * Returns          success return true, otherwise false.
 144  *
 145  ******************************************************************************/
 146 bool btm_ble_get_acl_remote_addr(tBTM_SEC_DEV_REC* p_dev_rec, BD_ADDR conn_addr,
 147                                  tBLE_ADDR_TYPE* p_addr_type) {
 148   bool st = true;
 149
 150   if (p_dev_rec == NULL) {
 151     BTM_TRACE_ERROR(
 152         "btm_ble_get_acl_remote_addr can not find device with matching "
 153         "address");
 154     return false;
 155   }
 156
 157   switch (p_dev_rec->ble.active_addr_type) {
 158     case BTM_BLE_ADDR_PSEUDO:
 159       memcpy(conn_addr, p_dev_rec->bd_addr, BD_ADDR_LEN);
 160       *p_addr_type = p_dev_rec->ble.ble_addr_type;
 161       break;
 162
 163     case BTM_BLE_ADDR_RRA:
 164       memcpy(conn_addr, p_dev_rec->ble.cur_rand_addr, BD_ADDR_LEN);
 165       *p_addr_type = BLE_ADDR_RANDOM;
 166       break;
 167
 168     case BTM_BLE_ADDR_STATIC:
 169       memcpy(conn_addr, p_dev_rec->ble.static_addr, BD_ADDR_LEN);
 170       *p_addr_type = p_dev_rec->ble.static_addr_type;
 171       break;
 172
 173     default:
 174       BTM_TRACE_ERROR("Unknown active address: %d",
 175                       p_dev_rec->ble.active_addr_type);
 176       st = false;
 177       break;
 178   }
 179
 180   return st;
 181 }
 182 #endif
 183 /*******************************************************************************
 184  *
 185  * Function         btm_acl_created
 186  *
 187  * Description      This function is called by L2CAP when an ACL connection
 188  *                  is created.
 189  *
 190  * Returns          void
 191  *
 192  ******************************************************************************/
 193 void btm_acl_created(BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
 194                      uint16_t hci_handle, uint8_t link_role,
 195                      tBT_TRANSPORT transport) {
 196   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
 197   tACL_CONN* p;
 198   uint8_t xx;
 199
 200   BTM_TRACE_DEBUG("btm_acl_created hci_handle=%d link_role=%d  transport=%d",
 201                   hci_handle, link_role, transport);
 202   /* Ensure we don't have duplicates */
 203   p = btm_bda_to_acl(bda, transport);
 204   if (p != (tACL_CONN*)NULL) {
 205     p->hci_handle = hci_handle;
 206     p->link_role = link_role;
 207     p->transport = transport;
 208     BTM_TRACE_DEBUG(
 209         "Duplicate btm_acl_created: RemBdAddr: %02x%02x%02x%02x%02x%02x",
 210         bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
 211     BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
 212     return;
 213   }
 214
 215   /* Allocate acl_db entry */
 216   for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++) {
 217     if (!p->in_use) {
 218       p->in_use = true;
 219       p->hci_handle = hci_handle;
 220       p->link_role = link_role;
 221       p->link_up_issued = false;
 222       memcpy(p->remote_addr, bda, BD_ADDR_LEN);
 223
 224       p->transport = transport;
 225 #if (BLE_PRIVACY_SPT == TRUE)
 226       if (transport == BT_TRANSPORT_LE)
 227         btm_ble_refresh_local_resolvable_private_addr(
 228             bda, btm_cb.ble_ctr_cb.addr_mgnt_cb.private_addr);
 229 #else
 230       p->conn_addr_type = BLE_ADDR_PUBLIC;
 231       memcpy(p->conn_addr, &controller_get_interface()->get_address()->address,
 232              BD_ADDR_LEN);
 233
 234 #endif
 235       p->switch_role_failed_attempts = 0;
 236       p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 237
 238       btm_pm_sm_alloc(xx);
 239
 240       if (dc) memcpy(p->remote_dc, dc, DEV_CLASS_LEN);
 241
 242       if (bdn) memcpy(p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
 243
 244       /* if BR/EDR do something more */
 245       if (transport == BT_TRANSPORT_BR_EDR) {
 246         btsnd_hcic_read_rmt_clk_offset(p->hci_handle);
 247         btsnd_hcic_rmt_ver_req(p->hci_handle);
 248       }
 249       p_dev_rec = btm_find_dev_by_handle(hci_handle);
 250
 251       if (p_dev_rec) {
 252         BTM_TRACE_DEBUG("device_type=0x%x", p_dev_rec->device_type);
 253       }
 254
 255       if (p_dev_rec && !(transport == BT_TRANSPORT_LE)) {
 256         /* If remote features already known, copy them and continue connection
 257          * setup */
 258         if ((p_dev_rec->num_read_pages) &&
 259             (p_dev_rec->num_read_pages <= (HCI_EXT_FEATURES_PAGE_MAX + 1))) {
 260           memcpy(p->peer_lmp_feature_pages, p_dev_rec->feature_pages,
 261                  (HCI_FEATURE_BYTES_PER_PAGE * p_dev_rec->num_read_pages));
 262           p->num_read_pages = p_dev_rec->num_read_pages;
 263
 264           const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 265
 266           /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
 267           btm_sec_set_peer_sec_caps(p, p_dev_rec);
 268
 269           BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
 270           if (req_pend) {
 271             /* Request for remaining Security Features (if any) */
 272             l2cu_resubmit_pending_sec_req(p_dev_rec->bd_addr);
 273           }
 274           btm_establish_continue(p);
 275           return;
 276         }
 277       }
 278
 279       /* If here, features are not known yet */
 280       if (p_dev_rec && transport == BT_TRANSPORT_LE) {
 281 #if (BLE_PRIVACY_SPT == TRUE)
 282         btm_ble_get_acl_remote_addr(p_dev_rec, p->active_remote_addr,
 283                                     &p->active_remote_addr_type);
 284 #endif
 285
 286         if (HCI_LE_SLAVE_INIT_FEAT_EXC_SUPPORTED(
 287                 controller_get_interface()->get_features_ble()->as_array) ||
 288             link_role == HCI_ROLE_MASTER) {
 289           btsnd_hcic_ble_read_remote_feat(p->hci_handle);
 290         } else {
 291           btm_establish_continue(p);
 292         }
 293       } else {
 294         btm_read_remote_features(p->hci_handle);
 295       }
 296
 297       /* read page 1 - on rmt feature event for buffer reasons */
 298       return;
 299     }
 300   }
 301 }
 302
 303 void btm_acl_update_conn_addr(uint8_t conn_handle, BD_ADDR address) {
 304   uint8_t idx = btm_handle_to_acl_index(conn_handle);
 305   if (idx != MAX_L2CAP_LINKS) {
 306     memcpy(btm_cb.acl_db[idx].conn_addr, address, BD_ADDR_LEN);
 307   }
 308 }
 309
 310 /*******************************************************************************
 311  *
 312  * Function         btm_acl_report_role_change
 313  *
 314  * Description      This function is called when the local device is deemed
 315  *                  to be down. It notifies L2CAP of the failure.
 316  *
 317  * Returns          void
 318  *
 319  ******************************************************************************/
 320 void btm_acl_report_role_change(uint8_t hci_status, BD_ADDR bda) {
 321   tBTM_ROLE_SWITCH_CMPL ref_data;
 322   BTM_TRACE_DEBUG("btm_acl_report_role_change");
 323   if (btm_cb.devcb.p_switch_role_cb &&
 324       (bda && (0 == memcmp(btm_cb.devcb.switch_role_ref_data.remote_bd_addr,
 325                            bda, BD_ADDR_LEN)))) {
 326     memcpy(&ref_data, &btm_cb.devcb.switch_role_ref_data,
 327            sizeof(tBTM_ROLE_SWITCH_CMPL));
 328     ref_data.hci_status = hci_status;
 329     (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
 330     memset(&btm_cb.devcb.switch_role_ref_data, 0,
 331            sizeof(tBTM_ROLE_SWITCH_CMPL));
 332     btm_cb.devcb.p_switch_role_cb = NULL;
 333   }
 334 }
 335
 336 /*******************************************************************************
 337  *
 338  * Function         btm_acl_removed
 339  *
 340  * Description      This function is called by L2CAP when an ACL connection
 341  *                  is removed. Since only L2CAP creates ACL links, we use
 342  *                  the L2CAP link index as our index into the control blocks.
 343  *
 344  * Returns          void
 345  *
 346  ******************************************************************************/
 347 void btm_acl_removed(BD_ADDR bda, tBT_TRANSPORT transport) {
 348   tACL_CONN* p;
 349   tBTM_BL_EVENT_DATA evt_data;
 350   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
 351   BTM_TRACE_DEBUG("btm_acl_removed");
 352   p = btm_bda_to_acl(bda, transport);
 353   if (p != (tACL_CONN*)NULL) {
 354     p->in_use = false;
 355
 356     /* if the disconnected channel has a pending role switch, clear it now */
 357     btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, bda);
 358
 359     /* Only notify if link up has had a chance to be issued */
 360     if (p->link_up_issued) {
 361       p->link_up_issued = false;
 362
 363       /* If anyone cares, tell him database changed */
 364       if (btm_cb.p_bl_changed_cb) {
 365         evt_data.event = BTM_BL_DISCN_EVT;
 366         evt_data.discn.p_bda = bda;
 367         evt_data.discn.handle = p->hci_handle;
 368         evt_data.discn.transport = p->transport;
 369         (*btm_cb.p_bl_changed_cb)(&evt_data);
 370       }
 371
 372       btm_acl_update_busy_level(BTM_BLI_ACL_DOWN_EVT);
 373     }
 374
 375     BTM_TRACE_DEBUG(
 376         "acl hci_handle=%d transport=%d connectable_mode=0x%0x link_role=%d",
 377         p->hci_handle, p->transport, btm_cb.ble_ctr_cb.inq_var.connectable_mode,
 378         p->link_role);
 379
 380     p_dev_rec = btm_find_dev(bda);
 381     if (p_dev_rec) {
 382       BTM_TRACE_DEBUG("before update p_dev_rec->sec_flags=0x%x",
 383                       p_dev_rec->sec_flags);
 384       if (p->transport == BT_TRANSPORT_LE) {
 385         BTM_TRACE_DEBUG("LE link down");
 386         p_dev_rec->sec_flags &= ~(BTM_SEC_LE_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
 387         if ((p_dev_rec->sec_flags & BTM_SEC_LE_LINK_KEY_KNOWN) == 0) {
 388           BTM_TRACE_DEBUG("Not Bonded");
 389           p_dev_rec->sec_flags &=
 390               ~(BTM_SEC_LE_LINK_KEY_AUTHED | BTM_SEC_LE_AUTHENTICATED);
 391         } else {
 392           BTM_TRACE_DEBUG("Bonded");
 393         }
 394       } else {
 395         BTM_TRACE_DEBUG("Bletooth link down");
 396         p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED |
 397                                   BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
 398       }
 399       BTM_TRACE_DEBUG("after update p_dev_rec->sec_flags=0x%x",
 400                       p_dev_rec->sec_flags);
 401     } else {
 402       BTM_TRACE_ERROR("Device not found");
 403     }
 404
 405     /* Clear the ACL connection data */
 406     memset(p, 0, sizeof(tACL_CONN));
 407   }
 408 }
 409
 410 /*******************************************************************************
 411  *
 412  * Function         btm_acl_device_down
 413  *
 414  * Description      This function is called when the local device is deemed
 415  *                  to be down. It notifies L2CAP of the failure.
 416  *
 417  * Returns          void
 418  *
 419  ******************************************************************************/
 420 void btm_acl_device_down(void) {
 421   tACL_CONN* p = &btm_cb.acl_db[0];
 422   uint16_t xx;
 423   BTM_TRACE_DEBUG("btm_acl_device_down");
 424   for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++) {
 425     if (p->in_use) {
 426       BTM_TRACE_DEBUG("hci_handle=%d HCI_ERR_HW_FAILURE ", p->hci_handle);
 427       l2c_link_hci_disc_comp(p->hci_handle, HCI_ERR_HW_FAILURE);
 428     }
 429   }
 430 }
 431
 432 /*******************************************************************************
 433  *
 434  * Function         btm_acl_update_busy_level
 435  *
 436  * Description      This function is called to update the busy level of the
 437  *                  system.
 438  *
 439  * Returns          void
 440  *
 441  ******************************************************************************/
 442 void btm_acl_update_busy_level(tBTM_BLI_EVENT event) {
 443   bool old_inquiry_state = btm_cb.is_inquiry;
 444   tBTM_BL_UPDATE_DATA evt;
 445   evt.busy_level_flags = 0;
 446   switch (event) {
 447     case BTM_BLI_ACL_UP_EVT:
 448       BTM_TRACE_DEBUG("BTM_BLI_ACL_UP_EVT");
 449       break;
 450     case BTM_BLI_ACL_DOWN_EVT:
 451       BTM_TRACE_DEBUG("BTM_BLI_ACL_DOWN_EVT");
 452       break;
 453     case BTM_BLI_PAGE_EVT:
 454       BTM_TRACE_DEBUG("BTM_BLI_PAGE_EVT");
 455       btm_cb.is_paging = true;
 456       evt.busy_level_flags = BTM_BL_PAGING_STARTED;
 457       break;
 458     case BTM_BLI_PAGE_DONE_EVT:
 459       BTM_TRACE_DEBUG("BTM_BLI_PAGE_DONE_EVT");
 460       btm_cb.is_paging = false;
 461       evt.busy_level_flags = BTM_BL_PAGING_COMPLETE;
 462       break;
 463     case BTM_BLI_INQ_EVT:
 464       BTM_TRACE_DEBUG("BTM_BLI_INQ_EVT");
 465       btm_cb.is_inquiry = true;
 466       evt.busy_level_flags = BTM_BL_INQUIRY_STARTED;
 467       break;
 468     case BTM_BLI_INQ_CANCEL_EVT:
 469       BTM_TRACE_DEBUG("BTM_BLI_INQ_CANCEL_EVT");
 470       btm_cb.is_inquiry = false;
 471       evt.busy_level_flags = BTM_BL_INQUIRY_CANCELLED;
 472       break;
 473     case BTM_BLI_INQ_DONE_EVT:
 474       BTM_TRACE_DEBUG("BTM_BLI_INQ_DONE_EVT");
 475       btm_cb.is_inquiry = false;
 476       evt.busy_level_flags = BTM_BL_INQUIRY_COMPLETE;
 477       break;
 478   }
 479
 480   uint8_t busy_level;
 481   if (btm_cb.is_paging || btm_cb.is_inquiry)
 482     busy_level = 10;
 483   else
 484     busy_level = BTM_GetNumAclLinks();
 485
 486   if ((busy_level != btm_cb.busy_level) ||
 487       (old_inquiry_state != btm_cb.is_inquiry)) {
 488     evt.event = BTM_BL_UPDATE_EVT;
 489     evt.busy_level = busy_level;
 490     btm_cb.busy_level = busy_level;
 491     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK)) {
 492       (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
 493     }
 494   }
 495 }
 496
 497 /*******************************************************************************
 498  *
 499  * Function         BTM_GetRole
 500  *
 501  * Description      This function is called to get the role of the local device
 502  *                  for the ACL connection with the specified remote device
 503  *
 504  * Returns          BTM_SUCCESS if connection exists.
 505  *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
 506  *
 507  ******************************************************************************/
 508 tBTM_STATUS BTM_GetRole(BD_ADDR remote_bd_addr, uint8_t* p_role) {
 509   tACL_CONN* p;
 510   BTM_TRACE_DEBUG("BTM_GetRole");
 511   p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
 512   if (p == NULL) {
 513     *p_role = BTM_ROLE_UNDEFINED;
 514     return (BTM_UNKNOWN_ADDR);
 515   }
 516
 517   /* Get the current role */
 518   *p_role = p->link_role;
 519   return (BTM_SUCCESS);
 520 }
 521
 522 /*******************************************************************************
 523  *
 524  * Function         BTM_SwitchRole
 525  *
 526  * Description      This function is called to switch role between master and
 527  *                  slave.  If role is already set it will do nothing.  If the
 528  *                  command was initiated, the callback function is called upon
 529  *                  completion.
 530  *
 531  * Returns          BTM_SUCCESS if already in specified role.
 532  *                  BTM_CMD_STARTED if command issued to controller.
 533  *                  BTM_NO_RESOURCES if couldn't allocate memory to issue
 534  *                                   command
 535  *                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
 536  *                  BTM_MODE_UNSUPPORTED if local device does not support role
 537  *                                       switching
 538  *                  BTM_BUSY if the previous command is not completed
 539  *
 540  ******************************************************************************/
 541 tBTM_STATUS BTM_SwitchRole(BD_ADDR remote_bd_addr, uint8_t new_role,
 542                            tBTM_CMPL_CB* p_cb) {
 543   tACL_CONN* p;
 544   tBTM_SEC_DEV_REC* p_dev_rec = NULL;
 545 #if (BTM_SCO_INCLUDED == TRUE)
 546   bool is_sco_active;
 547 #endif
 548   tBTM_STATUS status;
 549   tBTM_PM_MODE pwr_mode;
 550   tBTM_PM_PWR_MD settings;
 551   BD_ADDR_PTR p_bda;
 552   BTM_TRACE_API("BTM_SwitchRole BDA: %02x-%02x-%02x-%02x-%02x-%02x",
 553                 remote_bd_addr[0], remote_bd_addr[1], remote_bd_addr[2],
 554                 remote_bd_addr[3], remote_bd_addr[4], remote_bd_addr[5]);
 555
 556   /* Make sure the local device supports switching */
 557   if (!controller_get_interface()->supports_master_slave_role_switch())
 558     return (BTM_MODE_UNSUPPORTED);
 559
 560   if (btm_cb.devcb.p_switch_role_cb && p_cb) {
 561     p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
 562     BTM_TRACE_DEBUG(
 563         "Role switch on other device is in progress 0x%02x%02x%02x%02x%02x%02x",
 564         p_bda[0], p_bda[1], p_bda[2], p_bda[3], p_bda[4], p_bda[5]);
 565     return (BTM_BUSY);
 566   }
 567
 568   p = btm_bda_to_acl(remote_bd_addr, BT_TRANSPORT_BR_EDR);
 569   if (p == NULL) return (BTM_UNKNOWN_ADDR);
 570
 571   /* Finished if already in desired role */
 572   if (p->link_role == new_role) return (BTM_SUCCESS);
 573
 574   if (interop_match_addr(INTEROP_DISABLE_ROLE_SWITCH,
 575                          (const bt_bdaddr_t*)&remote_bd_addr)) {
 576     return BTM_DEV_BLACKLISTED;
 577   }
 578
 579 #if (BTM_SCO_INCLUDED == TRUE)
 580   /* Check if there is any SCO Active on this BD Address */
 581   is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
 582
 583   if (is_sco_active == true) return (BTM_NO_RESOURCES);
 584 #endif
 585
 586   /* Ignore role switch request if the previous request was not completed */
 587   if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE) {
 588     BTM_TRACE_DEBUG("BTM_SwitchRole busy: %d", p->switch_role_state);
 589     return (BTM_BUSY);
 590   }
 591
 592   if (interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH,
 593                          (const bt_bdaddr_t*)&remote_bd_addr)) {
 594     BTM_TRACE_DEBUG("%s, Device blacklisted under INTEROP_DYNAMIC_ROLE_SWITCH.",
 595                     __func__);
 596     return BTM_DEV_BLACKLISTED;
 597   }
 598
 599   status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode);
 600   if (status != BTM_SUCCESS) return (status);
 601
 602   /* Wake up the link if in sniff or park before attempting switch */
 603   if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF) {
 604     memset((void*)&settings, 0, sizeof(settings));
 605     settings.mode = BTM_PM_MD_ACTIVE;
 606     status = BTM_SetPowerMode(BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
 607     if (status != BTM_CMD_STARTED) return (BTM_WRONG_MODE);
 608
 609     p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
 610   }
 611   /* some devices do not support switch while encryption is on */
 612   else {
 613     p_dev_rec = btm_find_dev(remote_bd_addr);
 614     if ((p_dev_rec != NULL) &&
 615         ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
 616         !BTM_EPR_AVAILABLE(p)) {
 617       /* bypass turning off encryption if change link key is already doing it */
 618       if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF) {
 619         btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
 620         p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
 621       }
 622
 623       p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
 624     } else {
 625       btsnd_hcic_switch_role(remote_bd_addr, new_role);
 626       p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
 627
 628 #if (BTM_DISC_DURING_RS == TRUE)
 629       if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
 630 #endif
 631     }
 632   }
 633
 634   /* Initialize return structure in case request fails */
 635   if (p_cb) {
 636     memcpy(btm_cb.devcb.switch_role_ref_data.remote_bd_addr, remote_bd_addr,
 637            BD_ADDR_LEN);
 638     btm_cb.devcb.switch_role_ref_data.role = new_role;
 639     /* initialized to an error code */
 640     btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
 641     btm_cb.devcb.p_switch_role_cb = p_cb;
 642   }
 643   return (BTM_CMD_STARTED);
 644 }
 645
 646 /*******************************************************************************
 647  *
 648  * Function         btm_acl_encrypt_change
 649  *
 650  * Description      This function is when encryption of the connection is
 651  *                  completed by the LM.  Checks to see if a role switch or
 652  *                  change of link key was active and initiates or continues
 653  *                  process if needed.
 654  *
 655  * Returns          void
 656  *
 657  ******************************************************************************/
 658 void btm_acl_encrypt_change(uint16_t handle, uint8_t status,
 659                             uint8_t encr_enable) {
 660   tACL_CONN* p;
 661   uint8_t xx;
 662   tBTM_SEC_DEV_REC* p_dev_rec;
 663   tBTM_BL_ROLE_CHG_DATA evt;
 664
 665   BTM_TRACE_DEBUG("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d",
 666                   handle, status, encr_enable);
 667   xx = btm_handle_to_acl_index(handle);
 668   /* don't assume that we can never get a bad hci_handle */
 669   if (xx < MAX_L2CAP_LINKS)
 670     p = &btm_cb.acl_db[xx];
 671   else
 672     return;
 673
 674   /* Process Role Switch if active */
 675   if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF) {
 676     /* if encryption turn off failed we still will try to switch role */
 677     if (encr_enable) {
 678       p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 679       p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
 680     } else {
 681       p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
 682       p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
 683     }
 684
 685     btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
 686 #if (BTM_DISC_DURING_RS == TRUE)
 687     p_dev_rec = btm_find_dev(p->remote_addr);
 688     if (p_dev_rec != NULL) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
 689 #endif
 690
 691   }
 692   /* Finished enabling Encryption after role switch */
 693   else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON) {
 694     p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
 695     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
 696     btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status,
 697                                p->remote_addr);
 698
 699     /* if role change event is registered, report it now */
 700     if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
 701       evt.event = BTM_BL_ROLE_CHG_EVT;
 702       evt.new_role = btm_cb.devcb.switch_role_ref_data.role;
 703       evt.p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
 704       evt.hci_status = btm_cb.devcb.switch_role_ref_data.hci_status;
 705       (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
 706
 707       BTM_TRACE_DEBUG(
 708           "Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
 709           evt.new_role, evt.hci_status, p->switch_role_state);
 710     }
 711
 712 #if (BTM_DISC_DURING_RS == TRUE)
 713     /* If a disconnect is pending, issue it now that role switch has completed
 714      */
 715     p_dev_rec = btm_find_dev(p->remote_addr);
 716     if (p_dev_rec != NULL) {
 717       if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
 718         BTM_TRACE_WARNING(
 719             "btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
 720         btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
 721       }
 722       BTM_TRACE_ERROR(
 723           "btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
 724           PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
 725       p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
 726     }
 727 #endif
 728   }
 729 }
 730 /*******************************************************************************
 731  *
 732  * Function         BTM_SetLinkPolicy
 733  *
 734  * Description      Create and send HCI "Write Policy Set" command
 735  *
 736  * Returns          status of the operation
 737  *
 738  ******************************************************************************/
 739 tBTM_STATUS BTM_SetLinkPolicy(BD_ADDR remote_bda, uint16_t* settings) {
 740   tACL_CONN* p;
 741   uint8_t* localFeatures = BTM_ReadLocalFeatures();
 742   BTM_TRACE_DEBUG("%s", __func__);
 743   /*  BTM_TRACE_API ("%s: requested settings: 0x%04x", __func__, *settings ); */
 744
 745   /* First, check if hold mode is supported */
 746   if (*settings != HCI_DISABLE_ALL_LM_MODES) {
 747     if ((*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
 748         (!HCI_SWITCH_SUPPORTED(localFeatures))) {
 749       *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
 750       BTM_TRACE_API("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)",
 751                     *settings);
 752     }
 753     if ((*settings & HCI_ENABLE_HOLD_MODE) &&
 754         (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
 755       *settings &= (~HCI_ENABLE_HOLD_MODE);
 756       BTM_TRACE_API("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)",
 757                     *settings);
 758     }
 759     if ((*settings & HCI_ENABLE_SNIFF_MODE) &&
 760         (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
 761       *settings &= (~HCI_ENABLE_SNIFF_MODE);
 762       BTM_TRACE_API("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)",
 763                     *settings);
 764     }
 765     if ((*settings & HCI_ENABLE_PARK_MODE) &&
 766         (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
 767       *settings &= (~HCI_ENABLE_PARK_MODE);
 768       BTM_TRACE_API("BTM_SetLinkPolicy park not supported (settings: 0x%04x)",
 769                     *settings);
 770     }
 771   }
 772
 773   p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
 774   if (p != NULL) {
 775     btsnd_hcic_write_policy_set(p->hci_handle, *settings);
 776     return BTM_CMD_STARTED;
 777   }
 778
 779   /* If here, no BD Addr found */
 780   return (BTM_UNKNOWN_ADDR);
 781 }
 782
 783 /*******************************************************************************
 784  *
 785  * Function         BTM_SetDefaultLinkPolicy
 786  *
 787  * Description      Set the default value for HCI "Write Policy Set" command
 788  *                  to use when an ACL link is created.
 789  *
 790  * Returns          void
 791  *
 792  ******************************************************************************/
 793 void BTM_SetDefaultLinkPolicy(uint16_t settings) {
 794   uint8_t* localFeatures = BTM_ReadLocalFeatures();
 795
 796   BTM_TRACE_DEBUG("BTM_SetDefaultLinkPolicy setting:0x%04x", settings);
 797
 798   if ((settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) &&
 799       (!HCI_SWITCH_SUPPORTED(localFeatures))) {
 800     settings &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
 801     BTM_TRACE_DEBUG(
 802         "BTM_SetDefaultLinkPolicy switch not supported (settings: 0x%04x)",
 803         settings);
 804   }
 805   if ((settings & HCI_ENABLE_HOLD_MODE) &&
 806       (!HCI_HOLD_MODE_SUPPORTED(localFeatures))) {
 807     settings &= ~HCI_ENABLE_HOLD_MODE;
 808     BTM_TRACE_DEBUG(
 809         "BTM_SetDefaultLinkPolicy hold not supported (settings: 0x%04x)",
 810         settings);
 811   }
 812   if ((settings & HCI_ENABLE_SNIFF_MODE) &&
 813       (!HCI_SNIFF_MODE_SUPPORTED(localFeatures))) {
 814     settings &= ~HCI_ENABLE_SNIFF_MODE;
 815     BTM_TRACE_DEBUG(
 816         "BTM_SetDefaultLinkPolicy sniff not supported (settings: 0x%04x)",
 817         settings);
 818   }
 819   if ((settings & HCI_ENABLE_PARK_MODE) &&
 820       (!HCI_PARK_MODE_SUPPORTED(localFeatures))) {
 821     settings &= ~HCI_ENABLE_PARK_MODE;
 822     BTM_TRACE_DEBUG(
 823         "BTM_SetDefaultLinkPolicy park not supported (settings: 0x%04x)",
 824         settings);
 825   }
 826   BTM_TRACE_DEBUG("Set DefaultLinkPolicy:0x%04x", settings);
 827
 828   btm_cb.btm_def_link_policy = settings;
 829
 830   /* Set the default Link Policy of the controller */
 831   btsnd_hcic_write_def_policy_set(settings);
 832 }
 833
 834 void btm_use_preferred_conn_params(BD_ADDR bda) {
 835   tL2C_LCB* p_lcb = l2cu_find_lcb_by_bd_addr(bda, BT_TRANSPORT_LE);
 836   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_or_alloc_dev(bda);
 837
 838   /* If there are any preferred connection parameters, set them now */
 839   if ((p_dev_rec->conn_params.min_conn_int >= BTM_BLE_CONN_INT_MIN) &&
 840       (p_dev_rec->conn_params.min_conn_int <= BTM_BLE_CONN_INT_MAX) &&
 841       (p_dev_rec->conn_params.max_conn_int >= BTM_BLE_CONN_INT_MIN) &&
 842       (p_dev_rec->conn_params.max_conn_int <= BTM_BLE_CONN_INT_MAX) &&
 843       (p_dev_rec->conn_params.slave_latency <= BTM_BLE_CONN_LATENCY_MAX) &&
 844       (p_dev_rec->conn_params.supervision_tout >= BTM_BLE_CONN_SUP_TOUT_MIN) &&
 845       (p_dev_rec->conn_params.supervision_tout <= BTM_BLE_CONN_SUP_TOUT_MAX) &&
 846       ((p_lcb->min_interval < p_dev_rec->conn_params.min_conn_int &&
 847         p_dev_rec->conn_params.min_conn_int != BTM_BLE_CONN_PARAM_UNDEF) ||
 848        (p_lcb->min_interval > p_dev_rec->conn_params.max_conn_int) ||
 849        (p_lcb->latency > p_dev_rec->conn_params.slave_latency) ||
 850        (p_lcb->timeout > p_dev_rec->conn_params.supervision_tout))) {
 851     BTM_TRACE_DEBUG(
 852         "%s: HANDLE=%d min_conn_int=%d max_conn_int=%d slave_latency=%d "
 853         "supervision_tout=%d",
 854         __func__, p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
 855         p_dev_rec->conn_params.max_conn_int,
 856         p_dev_rec->conn_params.slave_latency,
 857         p_dev_rec->conn_params.supervision_tout);
 858
 859     p_lcb->min_interval = p_dev_rec->conn_params.min_conn_int;
 860     p_lcb->max_interval = p_dev_rec->conn_params.max_conn_int;
 861     p_lcb->timeout = p_dev_rec->conn_params.supervision_tout;
 862     p_lcb->latency = p_dev_rec->conn_params.slave_latency;
 863
 864     btsnd_hcic_ble_upd_ll_conn_params(
 865         p_lcb->handle, p_dev_rec->conn_params.min_conn_int,
 866         p_dev_rec->conn_params.max_conn_int,
 867         p_dev_rec->conn_params.slave_latency,
 868         p_dev_rec->conn_params.supervision_tout, 0, 0);
 869   }
 870 }
 871
 872 /*******************************************************************************
 873  *
 874  * Function         btm_read_remote_version_complete
 875  *
 876  * Description      This function is called when the command complete message
 877  *                  is received from the HCI for the remote version info.
 878  *
 879  * Returns          void
 880  *
 881  ******************************************************************************/
 882 void btm_read_remote_version_complete(uint8_t* p) {
 883   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
 884   uint8_t status;
 885   uint16_t handle;
 886   int xx;
 887   BTM_TRACE_DEBUG("btm_read_remote_version_complete");
 888
 889   STREAM_TO_UINT8(status, p);
 890   STREAM_TO_UINT16(handle, p);
 891
 892   /* Look up the connection by handle and copy features */
 893   for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++) {
 894     if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle)) {
 895       if (status == HCI_SUCCESS) {
 896         STREAM_TO_UINT8(p_acl_cb->lmp_version, p);
 897         STREAM_TO_UINT16(p_acl_cb->manufacturer, p);
 898         STREAM_TO_UINT16(p_acl_cb->lmp_subversion, p);
 899       }
 900
 901       if (p_acl_cb->transport == BT_TRANSPORT_LE) {
 902         l2cble_notify_le_connection(p_acl_cb->remote_addr);
 903         btm_use_preferred_conn_params(p_acl_cb->remote_addr);
 904       }
 905       break;
 906     }
 907   }
 908 }
 909
 910 /*******************************************************************************
 911  *
 912  * Function         btm_process_remote_ext_features
 913  *
 914  * Description      Local function called to process all extended features pages
 915  *                  read from a remote device.
 916  *
 917  * Returns          void
 918  *
 919  ******************************************************************************/
 920 void btm_process_remote_ext_features(tACL_CONN* p_acl_cb,
 921                                      uint8_t num_read_pages) {
 922   uint16_t handle = p_acl_cb->hci_handle;
 923   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
 924   uint8_t page_idx;
 925
 926   BTM_TRACE_DEBUG("btm_process_remote_ext_features");
 927
 928   /* Make sure we have the record to save remote features information */
 929   if (p_dev_rec == NULL) {
 930     /* Get a new device; might be doing dedicated bonding */
 931     p_dev_rec = btm_find_or_alloc_dev(p_acl_cb->remote_addr);
 932   }
 933
 934   p_acl_cb->num_read_pages = num_read_pages;
 935   p_dev_rec->num_read_pages = num_read_pages;
 936
 937   /* Move the pages to placeholder */
 938   for (page_idx = 0; page_idx < num_read_pages; page_idx++) {
 939     if (page_idx > HCI_EXT_FEATURES_PAGE_MAX) {
 940       BTM_TRACE_ERROR("%s: page=%d unexpected", __func__, page_idx);
 941       break;
 942     }
 943     memcpy(p_dev_rec->feature_pages[page_idx],
 944            p_acl_cb->peer_lmp_feature_pages[page_idx],
 945            HCI_FEATURE_BYTES_PER_PAGE);
 946   }
 947
 948   const uint8_t req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
 949
 950   /* Store the Peer Security Capabilites (in SM4 and rmt_sec_caps) */
 951   btm_sec_set_peer_sec_caps(p_acl_cb, p_dev_rec);
 952
 953   BTM_TRACE_API("%s: pend:%d", __func__, req_pend);
 954   if (req_pend) {
 955     /* Request for remaining Security Features (if any) */
 956     l2cu_resubmit_pending_sec_req(p_dev_rec->bd_addr);
 957   }
 958 }
 959
 960 /*******************************************************************************
 961  *
 962  * Function         btm_read_remote_features
 963  *
 964  * Description      Local function called to send a read remote supported
 965  *                  features/remote extended features page[0].
 966  *
 967  * Returns          void
 968  *
 969  ******************************************************************************/
 970 void btm_read_remote_features(uint16_t handle) {
 971   uint8_t acl_idx;
 972   tACL_CONN* p_acl_cb;
 973
 974   BTM_TRACE_DEBUG("btm_read_remote_features() handle: %d", handle);
 975
 976   acl_idx = btm_handle_to_acl_index(handle);
 977   if (acl_idx >= MAX_L2CAP_LINKS) {
 978     BTM_TRACE_ERROR("btm_read_remote_features handle=%d invalid", handle);
 979     return;
 980   }
 981
 982   p_acl_cb = &btm_cb.acl_db[acl_idx];
 983   p_acl_cb->num_read_pages = 0;
 984   memset(p_acl_cb->peer_lmp_feature_pages, 0,
 985          sizeof(p_acl_cb->peer_lmp_feature_pages));
 986
 987   /* first send read remote supported features HCI command */
 988   /* because we don't know whether the remote support extended feature command
 989    */
 990   btsnd_hcic_rmt_features_req(handle);
 991 }
 992
 993 /*******************************************************************************
 994  *
 995  * Function         btm_read_remote_ext_features
 996  *
 997  * Description      Local function called to send a read remote extended
 998  *                  features
 999  *
1000  * Returns          void
1001  *
1002  ******************************************************************************/
1003 void btm_read_remote_ext_features(uint16_t handle, uint8_t page_number) {
1004   BTM_TRACE_DEBUG("btm_read_remote_ext_features() handle: %d page: %d", handle,
1005                   page_number);
1006
1007   btsnd_hcic_rmt_ext_features(handle, page_number);
1008 }
1009
1010 /*******************************************************************************
1011  *
1012  * Function         btm_read_remote_features_complete
1013  *
1014  * Description      This function is called when the remote supported features
1015  *                  complete event is received from the HCI.
1016  *
1017  * Returns          void
1018  *
1019  ******************************************************************************/
1020 void btm_read_remote_features_complete(uint8_t* p) {
1021   tACL_CONN* p_acl_cb;
1022   uint8_t status;
1023   uint16_t handle;
1024   uint8_t acl_idx;
1025
1026   BTM_TRACE_DEBUG("btm_read_remote_features_complete");
1027   STREAM_TO_UINT8(status, p);
1028
1029   if (status != HCI_SUCCESS) {
1030     BTM_TRACE_ERROR("btm_read_remote_features_complete failed (status 0x%02x)",
1031                     status);
1032     return;
1033   }
1034
1035   STREAM_TO_UINT16(handle, p);
1036
1037   acl_idx = btm_handle_to_acl_index(handle);
1038   if (acl_idx >= MAX_L2CAP_LINKS) {
1039     BTM_TRACE_ERROR("btm_read_remote_features_complete handle=%d invalid",
1040                     handle);
1041     return;
1042   }
1043
1044   p_acl_cb = &btm_cb.acl_db[acl_idx];
1045
1046   /* Copy the received features page */
1047   STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[0], p,
1048                   HCI_FEATURE_BYTES_PER_PAGE);
1049
1050   if ((HCI_LMP_EXTENDED_SUPPORTED(p_acl_cb->peer_lmp_feature_pages[0])) &&
1051       (controller_get_interface()
1052            ->supports_reading_remote_extended_features())) {
1053     /* if the remote controller has extended features and local controller
1054        supports HCI_Read_Remote_Extended_Features command then start reading
1055        these feature starting with extended features page 1 */
1056     BTM_TRACE_DEBUG("Start reading remote extended features");
1057     btm_read_remote_ext_features(handle, 1);
1058     return;
1059   }
1060
1061   /* Remote controller has no extended features. Process remote controller
1062      supported features (features page 0). */
1063   btm_process_remote_ext_features(p_acl_cb, 1);
1064
1065   /* Continue with HCI connection establishment */
1066   btm_establish_continue(p_acl_cb);
1067 }
1068
1069 /*******************************************************************************
1070  *
1071  * Function         btm_read_remote_ext_features_complete
1072  *
1073  * Description      This function is called when the remote extended features
1074  *                  complete event is received from the HCI.
1075  *
1076  * Returns          void
1077  *
1078  ******************************************************************************/
1079 void btm_read_remote_ext_features_complete(uint8_t* p) {
1080   tACL_CONN* p_acl_cb;
1081   uint8_t page_num, max_page;
1082   uint16_t handle;
1083   uint8_t acl_idx;
1084
1085   BTM_TRACE_DEBUG("btm_read_remote_ext_features_complete");
1086
1087   ++p;
1088   STREAM_TO_UINT16(handle, p);
1089   STREAM_TO_UINT8(page_num, p);
1090   STREAM_TO_UINT8(max_page, p);
1091
1092   /* Validate parameters */
1093   acl_idx = btm_handle_to_acl_index(handle);
1094   if (acl_idx >= MAX_L2CAP_LINKS) {
1095     BTM_TRACE_ERROR("btm_read_remote_ext_features_complete handle=%d invalid",
1096                     handle);
1097     return;
1098   }
1099
1100   if (max_page > HCI_EXT_FEATURES_PAGE_MAX) {
1101     BTM_TRACE_ERROR("btm_read_remote_ext_features_complete page=%d unknown",
1102                     max_page);
1103     return;
1104   }
1105
1106   p_acl_cb = &btm_cb.acl_db[acl_idx];
1107
1108   /* Copy the received features page */
1109   STREAM_TO_ARRAY(p_acl_cb->peer_lmp_feature_pages[page_num], p,
1110                   HCI_FEATURE_BYTES_PER_PAGE);
1111
1112   /* If there is the next remote features page and
1113    * we have space to keep this page data - read this page */
1114   if ((page_num < max_page) && (page_num < HCI_EXT_FEATURES_PAGE_MAX)) {
1115     page_num++;
1116     BTM_TRACE_DEBUG("BTM reads next remote extended features page (%d)",
1117                     page_num);
1118     btm_read_remote_ext_features(handle, page_num);
1119     return;
1120   }
1121
1122   /* Reading of remote feature pages is complete */
1123   BTM_TRACE_DEBUG("BTM reached last remote extended features page (%d)",
1124                   page_num);
1125
1126   /* Process the pages */
1127   btm_process_remote_ext_features(p_acl_cb, (uint8_t)(page_num + 1));
1128
1129   /* Continue with HCI connection establishment */
1130   btm_establish_continue(p_acl_cb);
1131 }
1132
1133 /*******************************************************************************
1134  *
1135  * Function         btm_read_remote_ext_features_failed
1136  *
1137  * Description      This function is called when the remote extended features
1138  *                  complete event returns a failed status.
1139  *
1140  * Returns          void
1141  *
1142  ******************************************************************************/
1143 void btm_read_remote_ext_features_failed(uint8_t status, uint16_t handle) {
1144   tACL_CONN* p_acl_cb;
1145   uint8_t acl_idx;
1146
1147   BTM_TRACE_WARNING(
1148       "btm_read_remote_ext_features_failed (status 0x%02x) for handle %d",
1149       status, handle);
1150
1151   acl_idx = btm_handle_to_acl_index(handle);
1152   if (acl_idx >= MAX_L2CAP_LINKS) {
1153     BTM_TRACE_ERROR("btm_read_remote_ext_features_failed handle=%d invalid",
1154                     handle);
1155     return;
1156   }
1157
1158   p_acl_cb = &btm_cb.acl_db[acl_idx];
1159
1160   /* Process supported features only */
1161   btm_process_remote_ext_features(p_acl_cb, 1);
1162
1163   /* Continue HCI connection establishment */
1164   btm_establish_continue(p_acl_cb);
1165 }
1166
1167 /*******************************************************************************
1168  *
1169  * Function         btm_establish_continue
1170  *
1171  * Description      This function is called when the command complete message
1172  *                  is received from the HCI for the read local link policy
1173  *                  request.
1174  *
1175  * Returns          void
1176  *
1177  ******************************************************************************/
1178 void btm_establish_continue(tACL_CONN* p_acl_cb) {
1179   tBTM_BL_EVENT_DATA evt_data;
1180   BTM_TRACE_DEBUG("btm_establish_continue");
1181 #if (BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1182   if (p_acl_cb->transport == BT_TRANSPORT_BR_EDR) {
1183     /* For now there are a some devices that do not like sending */
1184     /* commands events and data at the same time. */
1185     /* Set the packet types to the default allowed by the device */
1186     btm_set_packet_types(p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1187
1188     if (btm_cb.btm_def_link_policy)
1189       BTM_SetLinkPolicy(p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1190   }
1191 #endif
1192   p_acl_cb->link_up_issued = true;
1193
1194   /* If anyone cares, tell him database changed */
1195   if (btm_cb.p_bl_changed_cb) {
1196     evt_data.event = BTM_BL_CONN_EVT;
1197     evt_data.conn.p_bda = p_acl_cb->remote_addr;
1198     evt_data.conn.p_bdn = p_acl_cb->remote_name;
1199     evt_data.conn.p_dc = p_acl_cb->remote_dc;
1200     evt_data.conn.p_features = p_acl_cb->peer_lmp_feature_pages[0];
1201     evt_data.conn.handle = p_acl_cb->hci_handle;
1202     evt_data.conn.transport = p_acl_cb->transport;
1203
1204     (*btm_cb.p_bl_changed_cb)(&evt_data);
1205   }
1206   btm_acl_update_busy_level(BTM_BLI_ACL_UP_EVT);
1207 }
1208
1209 /*******************************************************************************
1210  *
1211  * Function         BTM_SetDefaultLinkSuperTout
1212  *
1213  * Description      Set the default value for HCI "Write Link Supervision
1214  *                                                 Timeout"
1215  *                  command to use when an ACL link is created.
1216  *
1217  * Returns          void
1218  *
1219  ******************************************************************************/
1220 void BTM_SetDefaultLinkSuperTout(uint16_t timeout) {
1221   BTM_TRACE_DEBUG("BTM_SetDefaultLinkSuperTout");
1222   btm_cb.btm_def_link_super_tout = timeout;
1223 }
1224
1225 /*******************************************************************************
1226  *
1227  * Function         BTM_GetLinkSuperTout
1228  *
1229  * Description      Read the link supervision timeout value of the connection
1230  *
1231  * Returns          status of the operation
1232  *
1233  ******************************************************************************/
1234 tBTM_STATUS BTM_GetLinkSuperTout(BD_ADDR remote_bda, uint16_t* p_timeout) {
1235   tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1236
1237   BTM_TRACE_DEBUG("BTM_GetLinkSuperTout");
1238   if (p != (tACL_CONN*)NULL) {
1239     *p_timeout = p->link_super_tout;
1240     return (BTM_SUCCESS);
1241   }
1242   /* If here, no BD Addr found */
1243   return (BTM_UNKNOWN_ADDR);
1244 }
1245
1246 /*******************************************************************************
1247  *
1248  * Function         BTM_SetLinkSuperTout
1249  *
1250  * Description      Create and send HCI "Write Link Supervision Timeout" command
1251  *
1252  * Returns          status of the operation
1253  *
1254  ******************************************************************************/
1255 tBTM_STATUS BTM_SetLinkSuperTout(BD_ADDR remote_bda, uint16_t timeout) {
1256   tACL_CONN* p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1257
1258   BTM_TRACE_DEBUG("BTM_SetLinkSuperTout");
1259   if (p != (tACL_CONN*)NULL) {
1260     p->link_super_tout = timeout;
1261
1262     /* Only send if current role is Master; 2.0 spec requires this */
1263     if (p->link_role == BTM_ROLE_MASTER) {
1264       btsnd_hcic_write_link_super_tout(LOCAL_BR_EDR_CONTROLLER_ID,
1265                                        p->hci_handle, timeout);
1266       return (BTM_CMD_STARTED);
1267     } else
1268       return (BTM_SUCCESS);
1269   }
1270
1271   /* If here, no BD Addr found */
1272   return (BTM_UNKNOWN_ADDR);
1273 }
1274
1275 /*******************************************************************************
1276  *
1277  * Function         BTM_IsAclConnectionUp
1278  *
1279  * Description      This function is called to check if an ACL connection exists
1280  *                  to a specific remote BD Address.
1281  *
1282  * Returns          true if connection is up, else false.
1283  *
1284  ******************************************************************************/
1285 bool BTM_IsAclConnectionUp(BD_ADDR remote_bda, tBT_TRANSPORT transport) {
1286   tACL_CONN* p;
1287
1288   BTM_TRACE_API("BTM_IsAclConnectionUp: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1289                 remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
1290                 remote_bda[4], remote_bda[5]);
1291
1292   p = btm_bda_to_acl(remote_bda, transport);
1293   if (p != (tACL_CONN*)NULL) {
1294     return (true);
1295   }
1296
1297   /* If here, no BD Addr found */
1298   return (false);
1299 }
1300
1301 /*******************************************************************************
1302  *
1303  * Function         BTM_GetNumAclLinks
1304  *
1305  * Description      This function is called to count the number of
1306  *                  ACL links that are active.
1307  *
1308  * Returns          uint16_t Number of active ACL links
1309  *
1310  ******************************************************************************/
1311 uint16_t BTM_GetNumAclLinks(void) {
1312   uint16_t num_acl = 0;
1313
1314   for (uint16_t i = 0; i < MAX_L2CAP_LINKS; ++i) {
1315     if (btm_cb.acl_db[i].in_use) ++num_acl;
1316   }
1317
1318   return num_acl;
1319 }
1320
1321 /*******************************************************************************
1322  *
1323  * Function         btm_get_acl_disc_reason_code
1324  *
1325  * Description      This function is called to get the disconnection reason code
1326  *                  returned by the HCI at disconnection complete event.
1327  *
1328  * Returns          true if connection is up, else false.
1329  *
1330  ******************************************************************************/
1331 uint16_t btm_get_acl_disc_reason_code(void) {
1332   uint8_t res = btm_cb.acl_disc_reason;
1333   BTM_TRACE_DEBUG("btm_get_acl_disc_reason_code");
1334   return (res);
1335 }
1336
1337 /*******************************************************************************
1338  *
1339  * Function         BTM_GetHCIConnHandle
1340  *
1341  * Description      This function is called to get the handle for an ACL
1342  *                  connection to a specific remote BD Address.
1343  *
1344  * Returns          the handle of the connection, or 0xFFFF if none.
1345  *
1346  ******************************************************************************/
1347 uint16_t BTM_GetHCIConnHandle(const BD_ADDR remote_bda,
1348                               tBT_TRANSPORT transport) {
1349   tACL_CONN* p;
1350   BTM_TRACE_DEBUG("BTM_GetHCIConnHandle");
1351   p = btm_bda_to_acl(remote_bda, transport);
1352   if (p != (tACL_CONN*)NULL) {
1353     return (p->hci_handle);
1354   }
1355
1356   /* If here, no BD Addr found */
1357   return (0xFFFF);
1358 }
1359
1360 /*******************************************************************************
1361  *
1362  * Function         btm_process_clk_off_comp_evt
1363  *
1364  * Description      This function is called when clock offset command completes.
1365  *
1366  * Input Parms      hci_handle - connection handle associated with the change
1367  *                  clock offset
1368  *
1369  * Returns          void
1370  *
1371  ******************************************************************************/
1372 void btm_process_clk_off_comp_evt(uint16_t hci_handle, uint16_t clock_offset) {
1373   uint8_t xx;
1374   BTM_TRACE_DEBUG("btm_process_clk_off_comp_evt");
1375   /* Look up the connection by handle and set the current mode */
1376   xx = btm_handle_to_acl_index(hci_handle);
1377   if (xx < MAX_L2CAP_LINKS) btm_cb.acl_db[xx].clock_offset = clock_offset;
1378 }
1379
1380 /*******************************************************************************
1381 *
1382 * Function         btm_blacklist_role_change_device
1383 *
1384 * Description      This function is used to blacklist the device if the role
1385 *                  switch fails for maximum number of times. It also removes
1386 *                  the device from the black list if the role switch succeeds.
1387 *
1388 * Input Parms      bd_addr - remote BD addr
1389 *                  hci_status - role switch status
1390 *
1391 * Returns          void
1392 *
1393 *******************************************************************************/
1394 void btm_blacklist_role_change_device(BD_ADDR bd_addr, uint8_t hci_status) {
1395   tACL_CONN* p = btm_bda_to_acl(bd_addr, BT_TRANSPORT_BR_EDR);
1396   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
1397
1398   if (!p || !p_dev_rec) {
1399     return;
1400   }
1401   if (hci_status == HCI_SUCCESS) {
1402     p->switch_role_failed_attempts = 0;
1403     return;
1404   }
1405
1406   /* check for carkits */
1407   const uint32_t cod_audio_device =
1408       (BTM_COD_SERVICE_AUDIO | BTM_COD_MAJOR_AUDIO) << 8;
1409   const uint32_t cod =
1410       ((p_dev_rec->dev_class[0] << 16) | (p_dev_rec->dev_class[1] << 8) |
1411        p_dev_rec->dev_class[2]) &
1412       0xffffff;
1413   if ((hci_status != HCI_SUCCESS) &&
1414       ((p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) ||
1415        (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)) &&
1416       ((cod & cod_audio_device) == cod_audio_device) &&
1417       (!interop_match_addr(INTEROP_DYNAMIC_ROLE_SWITCH,
1418                            (const bt_bdaddr_t*)&bd_addr))) {
1419     p->switch_role_failed_attempts++;
1420     if (p->switch_role_failed_attempts == BTM_MAX_SW_ROLE_FAILED_ATTEMPTS) {
1421       BTM_TRACE_WARNING(
1422           "%s: Device %02x:%02x:%02x:%02x:%02x:%02x blacklisted for role "
1423           "switching - multiple role switch failed attempts: %u",
1424           __func__, bd_addr[0], bd_addr[1], bd_addr[2], bd_addr[3], bd_addr[4],
1425           bd_addr[5], p->switch_role_failed_attempts);
1426       interop_database_add(INTEROP_DYNAMIC_ROLE_SWITCH,
1427                            (const bt_bdaddr_t*)&bd_addr, 3);
1428     }
1429   }
1430 }
1431
1432 /*******************************************************************************
1433  *
1434  * Function         btm_acl_role_changed
1435  *
1436  * Description      This function is called whan a link's master/slave role
1437  *                  change event or command status event (with error) is
1438  *                  received. It updates the link control block, and calls the
1439  *                  registered callback with status and role (if registered).
1440  *
1441  * Returns          void
1442  *
1443  ******************************************************************************/
1444 void btm_acl_role_changed(uint8_t hci_status, BD_ADDR bd_addr,
1445                           uint8_t new_role) {
1446   uint8_t* p_bda =
1447       (bd_addr) ? bd_addr : btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1448   tACL_CONN* p = btm_bda_to_acl(p_bda, BT_TRANSPORT_BR_EDR);
1449   tBTM_ROLE_SWITCH_CMPL* p_data = &btm_cb.devcb.switch_role_ref_data;
1450   tBTM_SEC_DEV_REC* p_dev_rec;
1451   tBTM_BL_ROLE_CHG_DATA evt;
1452
1453   BTM_TRACE_DEBUG("btm_acl_role_changed");
1454   /* Ignore any stray events */
1455   if (p == NULL) {
1456     /* it could be a failure */
1457     if (hci_status != HCI_SUCCESS)
1458       btm_acl_report_role_change(hci_status, bd_addr);
1459     return;
1460   }
1461
1462   p_data->hci_status = hci_status;
1463
1464   if (hci_status == HCI_SUCCESS) {
1465     p_data->role = new_role;
1466     memcpy(p_data->remote_bd_addr, p_bda, BD_ADDR_LEN);
1467
1468     /* Update cached value */
1469     p->link_role = new_role;
1470
1471     /* Reload LSTO: link supervision timeout is reset in the LM after a role
1472      * switch */
1473     if (new_role == BTM_ROLE_MASTER) {
1474       BTM_SetLinkSuperTout(p->remote_addr, p->link_super_tout);
1475     }
1476   } else {
1477     /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
1478     new_role = p->link_role;
1479   }
1480
1481   /* Check if any SCO req is pending for role change */
1482   btm_sco_chk_pend_rolechange(p->hci_handle);
1483
1484   /* if switching state is switching we need to turn encryption on */
1485   /* if idle, we did not change encryption */
1486   if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING) {
1487     btsnd_hcic_set_conn_encrypt(p->hci_handle, true);
1488     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
1489     p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
1490     return;
1491   }
1492
1493   /* Set the switch_role_state to IDLE since the reply received from HCI */
1494   /* regardless of its result either success or failed. */
1495   if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS) {
1496     p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
1497     p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
1498   }
1499
1500   /* if role switch complete is needed, report it now */
1501   btm_acl_report_role_change(hci_status, bd_addr);
1502
1503   /* if role change event is registered, report it now */
1504   if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK)) {
1505     evt.event = BTM_BL_ROLE_CHG_EVT;
1506     evt.new_role = new_role;
1507     evt.p_bda = p_bda;
1508     evt.hci_status = hci_status;
1509     (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA*)&evt);
1510   }
1511
1512   BTM_TRACE_DEBUG(
1513       "Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
1514       p_data->role, p_data->hci_status, p->switch_role_state);
1515
1516 #if (BTM_DISC_DURING_RS == TRUE)
1517   /* If a disconnect is pending, issue it now that role switch has completed */
1518   p_dev_rec = btm_find_dev(p_bda);
1519   if (p_dev_rec != NULL) {
1520     if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING) {
1521       BTM_TRACE_WARNING(
1522           "btm_acl_role_changed -> Issuing delayed HCI_Disconnect!!!");
1523       btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
1524     }
1525     BTM_TRACE_ERROR("tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
1526                     PTR_TO_UINT(p_dev_rec), p_dev_rec->rs_disc_pending);
1527     p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING; /* reset flag */
1528   }
1529
1530 #endif
1531 }
1532
1533 /*******************************************************************************
1534  *
1535  * Function         BTM_AllocateSCN
1536  *
1537  * Description      Look through the Server Channel Numbers for a free one.
1538  *
1539  * Returns          Allocated SCN number or 0 if none.
1540  *
1541  ******************************************************************************/
1542
1543 uint8_t BTM_AllocateSCN(void) {
1544   uint8_t x;
1545   BTM_TRACE_DEBUG("BTM_AllocateSCN");
1546
1547   // stack reserves scn 1 for HFP, HSP we still do the correct way
1548   for (x = 1; x < BTM_MAX_SCN; x++) {
1549     if (!btm_cb.btm_scn[x]) {
1550       btm_cb.btm_scn[x] = true;
1551       return (x + 1);
1552     }
1553   }
1554
1555   return (0); /* No free ports */
1556 }
1557
1558 /*******************************************************************************
1559  *
1560  * Function         BTM_TryAllocateSCN
1561  *
1562  * Description      Try to allocate a fixed server channel
1563  *
1564  * Returns          Returns true if server channel was available
1565  *
1566  ******************************************************************************/
1567
1568 bool BTM_TryAllocateSCN(uint8_t scn) {
1569   /* Make sure we don't exceed max port range.
1570    * Stack reserves scn 1 for HFP, HSP we still do the correct way.
1571    */
1572   if ((scn >= BTM_MAX_SCN) || (scn == 1)) return false;
1573
1574   /* check if this port is available */
1575   if (!btm_cb.btm_scn[scn - 1]) {
1576     btm_cb.btm_scn[scn - 1] = true;
1577     return true;
1578   }
1579
1580   return (false); /* Port was busy */
1581 }
1582
1583 /*******************************************************************************
1584  *
1585  * Function         BTM_FreeSCN
1586  *
1587  * Description      Free the specified SCN.
1588  *
1589  * Returns          true or false
1590  *
1591  ******************************************************************************/
1592 bool BTM_FreeSCN(uint8_t scn) {
1593   BTM_TRACE_DEBUG("BTM_FreeSCN ");
1594   if (scn <= BTM_MAX_SCN) {
1595     btm_cb.btm_scn[scn - 1] = false;
1596     return (true);
1597   } else
1598     return (false); /* Illegal SCN passed in */
1599 }
1600
1601 /*******************************************************************************
1602  *
1603  * Function         btm_set_packet_types
1604  *
1605  * Description      This function sets the packet types used for a specific
1606  *                  ACL connection. It is called internally by btm_acl_created
1607  *                  or by an application/profile by BTM_SetPacketTypes.
1608  *
1609  * Returns          status of the operation
1610  *
1611  ******************************************************************************/
1612 tBTM_STATUS btm_set_packet_types(tACL_CONN* p, uint16_t pkt_types) {
1613   uint16_t temp_pkt_types;
1614   BTM_TRACE_DEBUG("btm_set_packet_types");
1615   /* Save in the ACL control blocks, types that we support */
1616   temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
1617                     btm_cb.btm_acl_pkt_types_supported);
1618
1619   /* OR in any exception packet types if at least 2.0 version of spec */
1620   temp_pkt_types |=
1621       ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
1622        (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
1623
1624   /* Exclude packet types not supported by the peer */
1625   btm_acl_chk_peer_pkt_type_support(p, &temp_pkt_types);
1626
1627   BTM_TRACE_DEBUG("SetPacketType Mask -> 0x%04x", temp_pkt_types);
1628
1629   btsnd_hcic_change_conn_type(p->hci_handle, temp_pkt_types);
1630   p->pkt_types_mask = temp_pkt_types;
1631
1632   return (BTM_CMD_STARTED);
1633 }
1634
1635 /*******************************************************************************
1636  *
1637  * Function         btm_get_max_packet_size
1638  *
1639  * Returns          Returns maximum packet size that can be used for current
1640  *                  connection, 0 if connection is not established
1641  *
1642  ******************************************************************************/
1643 uint16_t btm_get_max_packet_size(BD_ADDR addr) {
1644   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1645   uint16_t pkt_types = 0;
1646   uint16_t pkt_size = 0;
1647   BTM_TRACE_DEBUG("btm_get_max_packet_size");
1648   if (p != NULL) {
1649     pkt_types = p->pkt_types_mask;
1650   } else {
1651     /* Special case for when info for the local device is requested */
1652     if (memcmp(controller_get_interface()->get_address(), addr, BD_ADDR_LEN) ==
1653         0) {
1654       pkt_types = btm_cb.btm_acl_pkt_types_supported;
1655     }
1656   }
1657
1658   if (pkt_types) {
1659     if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
1660       pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
1661     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
1662       pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
1663     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
1664       pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
1665     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
1666       pkt_size = HCI_DH5_PACKET_SIZE;
1667     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
1668       pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
1669     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
1670       pkt_size = HCI_DM5_PACKET_SIZE;
1671     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
1672       pkt_size = HCI_DH3_PACKET_SIZE;
1673     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
1674       pkt_size = HCI_DM3_PACKET_SIZE;
1675     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
1676       pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
1677     else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
1678       pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
1679     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
1680       pkt_size = HCI_DH1_PACKET_SIZE;
1681     else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
1682       pkt_size = HCI_DM1_PACKET_SIZE;
1683   }
1684
1685   return (pkt_size);
1686 }
1687
1688 /*******************************************************************************
1689  *
1690  * Function         BTM_ReadRemoteVersion
1691  *
1692  * Returns          If connected report peer device info
1693  *
1694  ******************************************************************************/
1695 tBTM_STATUS BTM_ReadRemoteVersion(BD_ADDR addr, uint8_t* lmp_version,
1696                                   uint16_t* manufacturer,
1697                                   uint16_t* lmp_sub_version) {
1698   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1699   BTM_TRACE_DEBUG("BTM_ReadRemoteVersion");
1700   if (p == NULL) return (BTM_UNKNOWN_ADDR);
1701
1702   if (lmp_version) *lmp_version = p->lmp_version;
1703
1704   if (manufacturer) *manufacturer = p->manufacturer;
1705
1706   if (lmp_sub_version) *lmp_sub_version = p->lmp_subversion;
1707
1708   return (BTM_SUCCESS);
1709 }
1710
1711 /*******************************************************************************
1712  *
1713  * Function         BTM_ReadRemoteFeatures
1714  *
1715  * Returns          pointer to the remote supported features mask (8 bytes)
1716  *
1717  ******************************************************************************/
1718 uint8_t* BTM_ReadRemoteFeatures(BD_ADDR addr) {
1719   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1720   BTM_TRACE_DEBUG("BTM_ReadRemoteFeatures");
1721   if (p == NULL) {
1722     return (NULL);
1723   }
1724
1725   return (p->peer_lmp_feature_pages[0]);
1726 }
1727
1728 /*******************************************************************************
1729  *
1730  * Function         BTM_ReadRemoteExtendedFeatures
1731  *
1732  * Returns          pointer to the remote extended features mask (8 bytes)
1733  *                  or NULL if bad page
1734  *
1735  ******************************************************************************/
1736 uint8_t* BTM_ReadRemoteExtendedFeatures(BD_ADDR addr, uint8_t page_number) {
1737   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1738   BTM_TRACE_DEBUG("BTM_ReadRemoteExtendedFeatures");
1739   if (p == NULL) {
1740     return (NULL);
1741   }
1742
1743   if (page_number > HCI_EXT_FEATURES_PAGE_MAX) {
1744     BTM_TRACE_ERROR("Warning: BTM_ReadRemoteExtendedFeatures page %d unknown",
1745                     page_number);
1746     return NULL;
1747   }
1748
1749   return (p->peer_lmp_feature_pages[page_number]);
1750 }
1751
1752 /*******************************************************************************
1753  *
1754  * Function         BTM_ReadNumberRemoteFeaturesPages
1755  *
1756  * Returns          number of features pages read from the remote device.
1757  *
1758  ******************************************************************************/
1759 uint8_t BTM_ReadNumberRemoteFeaturesPages(BD_ADDR addr) {
1760   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1761   BTM_TRACE_DEBUG("BTM_ReadNumberRemoteFeaturesPages");
1762   if (p == NULL) {
1763     return (0);
1764   }
1765
1766   return (p->num_read_pages);
1767 }
1768
1769 /*******************************************************************************
1770  *
1771  * Function         BTM_ReadAllRemoteFeatures
1772  *
1773  * Returns          pointer to all features of the remote (24 bytes).
1774  *
1775  ******************************************************************************/
1776 uint8_t* BTM_ReadAllRemoteFeatures(BD_ADDR addr) {
1777   tACL_CONN* p = btm_bda_to_acl(addr, BT_TRANSPORT_BR_EDR);
1778   BTM_TRACE_DEBUG("BTM_ReadAllRemoteFeatures");
1779   if (p == NULL) {
1780     return (NULL);
1781   }
1782
1783   return (p->peer_lmp_feature_pages[0]);
1784 }
1785
1786 /*******************************************************************************
1787  *
1788  * Function         BTM_RegBusyLevelNotif
1789  *
1790  * Description      This function is called to register a callback to receive
1791  *                  busy level change events.
1792  *
1793  * Returns          BTM_SUCCESS if successfully registered, otherwise error
1794  *
1795  ******************************************************************************/
1796 tBTM_STATUS BTM_RegBusyLevelNotif(tBTM_BL_CHANGE_CB* p_cb, uint8_t* p_level,
1797                                   tBTM_BL_EVENT_MASK evt_mask) {
1798   BTM_TRACE_DEBUG("BTM_RegBusyLevelNotif");
1799   if (p_level) *p_level = btm_cb.busy_level;
1800
1801   btm_cb.bl_evt_mask = evt_mask;
1802
1803   if (!p_cb)
1804     btm_cb.p_bl_changed_cb = NULL;
1805   else if (btm_cb.p_bl_changed_cb)
1806     return (BTM_BUSY);
1807   else
1808     btm_cb.p_bl_changed_cb = p_cb;
1809
1810   return (BTM_SUCCESS);
1811 }
1812
1813 /*******************************************************************************
1814  *
1815  * Function         BTM_SetQoS
1816  *
1817  * Description      This function is called to setup QoS
1818  *
1819  * Returns          status of the operation
1820  *
1821  ******************************************************************************/
1822 tBTM_STATUS BTM_SetQoS(BD_ADDR bd, FLOW_SPEC* p_flow, tBTM_CMPL_CB* p_cb) {
1823   tACL_CONN* p = &btm_cb.acl_db[0];
1824
1825   BTM_TRACE_API("BTM_SetQoS: BdAddr: %02x%02x%02x%02x%02x%02x", bd[0], bd[1],
1826                 bd[2], bd[3], bd[4], bd[5]);
1827
1828   /* If someone already waiting on the version, do not allow another */
1829   if (btm_cb.devcb.p_qos_setup_cmpl_cb) return (BTM_BUSY);
1830
1831   p = btm_bda_to_acl(bd, BT_TRANSPORT_BR_EDR);
1832   if (p != NULL) {
1833     btm_cb.devcb.p_qos_setup_cmpl_cb = p_cb;
1834     alarm_set_on_queue(btm_cb.devcb.qos_setup_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1835                        btm_qos_setup_timeout, NULL, btu_general_alarm_queue);
1836
1837     btsnd_hcic_qos_setup(p->hci_handle, p_flow->qos_flags, p_flow->service_type,
1838                          p_flow->token_rate, p_flow->peak_bandwidth,
1839                          p_flow->latency, p_flow->delay_variation);
1840     return (BTM_CMD_STARTED);
1841   }
1842
1843   /* If here, no BD Addr found */
1844   return (BTM_UNKNOWN_ADDR);
1845 }
1846
1847 /*******************************************************************************
1848  *
1849  * Function         btm_qos_setup_timeout
1850  *
1851  * Description      Callback when QoS setup times out.
1852  *
1853  * Returns          void
1854  *
1855  ******************************************************************************/
1856 void btm_qos_setup_timeout(UNUSED_ATTR void* data) {
1857   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1858   btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1859   if (p_cb) (*p_cb)((void*)NULL);
1860 }
1861
1862 /*******************************************************************************
1863  *
1864  * Function         btm_qos_setup_complete
1865  *
1866  * Description      This function is called when the command complete message
1867  *                  is received from the HCI for the qos setup request.
1868  *
1869  * Returns          void
1870  *
1871  ******************************************************************************/
1872 void btm_qos_setup_complete(uint8_t status, uint16_t handle,
1873                             FLOW_SPEC* p_flow) {
1874   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_qos_setup_cmpl_cb;
1875   tBTM_QOS_SETUP_CMPL qossu;
1876
1877   BTM_TRACE_DEBUG("%s", __func__);
1878   alarm_cancel(btm_cb.devcb.qos_setup_timer);
1879   btm_cb.devcb.p_qos_setup_cmpl_cb = NULL;
1880
1881   /* If there was a registered callback, call it */
1882   if (p_cb) {
1883     memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
1884     qossu.status = status;
1885     qossu.handle = handle;
1886     if (p_flow != NULL) {
1887       qossu.flow.qos_flags = p_flow->qos_flags;
1888       qossu.flow.service_type = p_flow->service_type;
1889       qossu.flow.token_rate = p_flow->token_rate;
1890       qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
1891       qossu.flow.latency = p_flow->latency;
1892       qossu.flow.delay_variation = p_flow->delay_variation;
1893     }
1894     BTM_TRACE_DEBUG("BTM: p_flow->delay_variation: 0x%02x",
1895                     qossu.flow.delay_variation);
1896     (*p_cb)(&qossu);
1897   }
1898 }
1899
1900 /*******************************************************************************
1901  *
1902  * Function         BTM_ReadRSSI
1903  *
1904  * Description      This function is called to read the link policy settings.
1905  *                  The address of link policy results are returned in the
1906  *                  callback.
1907  *                  (tBTM_RSSI_RESULTS)
1908  *
1909  * Returns          BTM_CMD_STARTED if successfully initiated or error code
1910  *
1911  ******************************************************************************/
1912 tBTM_STATUS BTM_ReadRSSI(const BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
1913   tACL_CONN* p;
1914   tBT_TRANSPORT transport = BT_TRANSPORT_BR_EDR;
1915   tBT_DEVICE_TYPE dev_type;
1916   tBLE_ADDR_TYPE addr_type;
1917   BTM_TRACE_API("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1918                 remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
1919                 remote_bda[4], remote_bda[5]);
1920
1921   /* If someone already waiting on the version, do not allow another */
1922   if (btm_cb.devcb.p_rssi_cmpl_cb) return (BTM_BUSY);
1923
1924   BTM_ReadDevInfo(remote_bda, &dev_type, &addr_type);
1925   if (dev_type == BT_DEVICE_TYPE_BLE) transport = BT_TRANSPORT_LE;
1926
1927   p = btm_bda_to_acl(remote_bda, transport);
1928   if (p != (tACL_CONN*)NULL) {
1929     btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
1930     alarm_set_on_queue(btm_cb.devcb.read_rssi_timer, BTM_DEV_REPLY_TIMEOUT_MS,
1931                        btm_read_rssi_timeout, NULL, btu_general_alarm_queue);
1932
1933     btsnd_hcic_read_rssi(p->hci_handle);
1934     return (BTM_CMD_STARTED);
1935   }
1936
1937   /* If here, no BD Addr found */
1938   return (BTM_UNKNOWN_ADDR);
1939 }
1940
1941 /*******************************************************************************
1942  *
1943  * Function         BTM_ReadLinkQuality
1944  *
1945  * Description      This function is called to read the link qulaity.
1946  *                  The value of the link quality is returned in the callback.
1947  *                  (tBTM_LINK_QUALITY_RESULTS)
1948  *
1949  * Returns          BTM_CMD_STARTED if successfully initiated or error code
1950  *
1951  ******************************************************************************/
1952 tBTM_STATUS BTM_ReadLinkQuality(BD_ADDR remote_bda, tBTM_CMPL_CB* p_cb) {
1953   tACL_CONN* p;
1954
1955   BTM_TRACE_API("BTM_ReadLinkQuality: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1956                 remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
1957                 remote_bda[4], remote_bda[5]);
1958
1959   /* If someone already waiting on the version, do not allow another */
1960   if (btm_cb.devcb.p_link_qual_cmpl_cb) return (BTM_BUSY);
1961
1962   p = btm_bda_to_acl(remote_bda, BT_TRANSPORT_BR_EDR);
1963   if (p != (tACL_CONN*)NULL) {
1964     btm_cb.devcb.p_link_qual_cmpl_cb = p_cb;
1965     alarm_set_on_queue(btm_cb.devcb.read_link_quality_timer,
1966                        BTM_DEV_REPLY_TIMEOUT_MS, btm_read_link_quality_timeout,
1967                        NULL, btu_general_alarm_queue);
1968
1969     btsnd_hcic_get_link_quality(p->hci_handle);
1970     return (BTM_CMD_STARTED);
1971   }
1972
1973   /* If here, no BD Addr found */
1974   return (BTM_UNKNOWN_ADDR);
1975 }
1976
1977 /*******************************************************************************
1978  *
1979  * Function         BTM_ReadTxPower
1980  *
1981  * Description      This function is called to read the current
1982  *                  TX power of the connection. The tx power level results
1983  *                  are returned in the callback.
1984  *                  (tBTM_RSSI_RESULTS)
1985  *
1986  * Returns          BTM_CMD_STARTED if successfully initiated or error code
1987  *
1988  ******************************************************************************/
1989 tBTM_STATUS BTM_ReadTxPower(BD_ADDR remote_bda, tBT_TRANSPORT transport,
1990                             tBTM_CMPL_CB* p_cb) {
1991   tACL_CONN* p;
1992 #define BTM_READ_RSSI_TYPE_CUR 0x00
1993 #define BTM_READ_RSSI_TYPE_MAX 0X01
1994
1995   BTM_TRACE_API("BTM_ReadTxPower: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1996                 remote_bda[0], remote_bda[1], remote_bda[2], remote_bda[3],
1997                 remote_bda[4], remote_bda[5]);
1998
1999   /* If someone already waiting on the version, do not allow another */
2000   if (btm_cb.devcb.p_tx_power_cmpl_cb) return (BTM_BUSY);
2001
2002   p = btm_bda_to_acl(remote_bda, transport);
2003   if (p != (tACL_CONN*)NULL) {
2004     btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2005     alarm_set_on_queue(btm_cb.devcb.read_tx_power_timer,
2006                        BTM_DEV_REPLY_TIMEOUT_MS, btm_read_tx_power_timeout,
2007                        NULL, btu_general_alarm_queue);
2008
2009     if (p->transport == BT_TRANSPORT_LE) {
2010       memcpy(btm_cb.devcb.read_tx_pwr_addr, remote_bda, BD_ADDR_LEN);
2011       btsnd_hcic_ble_read_adv_chnl_tx_power();
2012     } else {
2013       btsnd_hcic_read_tx_power(p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2014     }
2015
2016     return (BTM_CMD_STARTED);
2017   }
2018
2019   /* If here, no BD Addr found */
2020   return (BTM_UNKNOWN_ADDR);
2021 }
2022
2023 /*******************************************************************************
2024  *
2025  * Function         btm_read_tx_power_timeout
2026  *
2027  * Description      Callback when reading the tx power times out.
2028  *
2029  * Returns          void
2030  *
2031  ******************************************************************************/
2032 void btm_read_tx_power_timeout(UNUSED_ATTR void* data) {
2033   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2034   btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2035   if (p_cb) (*p_cb)((void*)NULL);
2036 }
2037
2038 /*******************************************************************************
2039  *
2040  * Function         btm_read_tx_power_complete
2041  *
2042  * Description      This function is called when the command complete message
2043  *                  is received from the HCI for the read tx power request.
2044  *
2045  * Returns          void
2046  *
2047  ******************************************************************************/
2048 void btm_read_tx_power_complete(uint8_t* p, bool is_ble) {
2049   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2050   tBTM_TX_POWER_RESULTS results;
2051   uint16_t handle;
2052   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2053   uint16_t index;
2054
2055   BTM_TRACE_DEBUG("%s", __func__);
2056   alarm_cancel(btm_cb.devcb.read_tx_power_timer);
2057   btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2058
2059   /* If there was a registered callback, call it */
2060   if (p_cb) {
2061     STREAM_TO_UINT8(results.hci_status, p);
2062
2063     if (results.hci_status == HCI_SUCCESS) {
2064       results.status = BTM_SUCCESS;
2065
2066       if (!is_ble) {
2067         STREAM_TO_UINT16(handle, p);
2068         STREAM_TO_UINT8(results.tx_power, p);
2069
2070         /* Search through the list of active channels for the correct BD Addr */
2071         for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2072           if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2073             memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2074             break;
2075           }
2076         }
2077       } else {
2078         STREAM_TO_UINT8(results.tx_power, p);
2079         memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN);
2080       }
2081       BTM_TRACE_DEBUG("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2082                       results.tx_power, results.hci_status);
2083     } else
2084       results.status = BTM_ERR_PROCESSING;
2085
2086     (*p_cb)(&results);
2087   }
2088 }
2089
2090 /*******************************************************************************
2091  *
2092  * Function         btm_read_rssi_timeout
2093  *
2094  * Description      Callback when reading the RSSI times out.
2095  *
2096  * Returns          void
2097  *
2098  ******************************************************************************/
2099 void btm_read_rssi_timeout(UNUSED_ATTR void* data) {
2100   tBTM_RSSI_RESULTS  results;
2101   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2102   btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2103   results.status = BTM_DEVICE_TIMEOUT;
2104   if (p_cb)
2105       (*p_cb)(&results);
2106 }
2107
2108 /*******************************************************************************
2109  *
2110  * Function         btm_read_rssi_complete
2111  *
2112  * Description      This function is called when the command complete message
2113  *                  is received from the HCI for the read rssi request.
2114  *
2115  * Returns          void
2116  *
2117  ******************************************************************************/
2118 void btm_read_rssi_complete(uint8_t* p) {
2119   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2120   tBTM_RSSI_RESULTS results;
2121   uint16_t handle;
2122   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2123   uint16_t index;
2124
2125   BTM_TRACE_DEBUG("%s", __func__);
2126   alarm_cancel(btm_cb.devcb.read_rssi_timer);
2127   btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2128
2129   /* If there was a registered callback, call it */
2130   if (p_cb) {
2131     STREAM_TO_UINT8(results.hci_status, p);
2132
2133     if (results.hci_status == HCI_SUCCESS) {
2134       results.status = BTM_SUCCESS;
2135
2136       STREAM_TO_UINT16(handle, p);
2137
2138       STREAM_TO_UINT8(results.rssi, p);
2139       BTM_TRACE_DEBUG("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2140                       results.rssi, results.hci_status);
2141
2142       /* Search through the list of active channels for the correct BD Addr */
2143       for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2144         if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2145           memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2146           break;
2147         }
2148       }
2149     } else
2150       results.status = BTM_ERR_PROCESSING;
2151
2152     (*p_cb)(&results);
2153   }
2154 }
2155
2156 /*******************************************************************************
2157  *
2158  * Function         btm_read_link_quality_timeout
2159  *
2160  * Description      Callback when reading the link quality times out.
2161  *
2162  * Returns          void
2163  *
2164  ******************************************************************************/
2165 void btm_read_link_quality_timeout(UNUSED_ATTR void* data) {
2166   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2167   btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2168   if (p_cb) (*p_cb)((void*)NULL);
2169 }
2170
2171 /*******************************************************************************
2172  *
2173  * Function         btm_read_link_quality_complete
2174  *
2175  * Description      This function is called when the command complete message
2176  *                  is received from the HCI for the read link quality.
2177  *
2178  * Returns          void
2179  *
2180  ******************************************************************************/
2181 void btm_read_link_quality_complete(uint8_t* p) {
2182   tBTM_CMPL_CB* p_cb = btm_cb.devcb.p_link_qual_cmpl_cb;
2183   tBTM_LINK_QUALITY_RESULTS results;
2184   uint16_t handle;
2185   tACL_CONN* p_acl_cb = &btm_cb.acl_db[0];
2186   uint16_t index;
2187
2188   BTM_TRACE_DEBUG("%s", __func__);
2189   alarm_cancel(btm_cb.devcb.read_link_quality_timer);
2190   btm_cb.devcb.p_link_qual_cmpl_cb = NULL;
2191
2192   /* If there was a registered callback, call it */
2193   if (p_cb) {
2194     STREAM_TO_UINT8(results.hci_status, p);
2195
2196     if (results.hci_status == HCI_SUCCESS) {
2197       results.status = BTM_SUCCESS;
2198
2199       STREAM_TO_UINT16(handle, p);
2200
2201       STREAM_TO_UINT8(results.link_quality, p);
2202       BTM_TRACE_DEBUG(
2203           "BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2204           results.link_quality, results.hci_status);
2205
2206       /* Search through the list of active channels for the correct BD Addr */
2207       for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++) {
2208         if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle)) {
2209           memcpy(results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2210           break;
2211         }
2212       }
2213     } else
2214       results.status = BTM_ERR_PROCESSING;
2215
2216     (*p_cb)(&results);
2217   }
2218 }
2219
2220 /*******************************************************************************
2221  *
2222  * Function         btm_remove_acl
2223  *
2224  * Description      This function is called to disconnect an ACL connection
2225  *
2226  * Returns          BTM_SUCCESS if successfully initiated, otherwise
2227  *                  BTM_NO_RESOURCES.
2228  *
2229  ******************************************************************************/
2230 tBTM_STATUS btm_remove_acl(BD_ADDR bd_addr, tBT_TRANSPORT transport) {
2231   uint16_t hci_handle = BTM_GetHCIConnHandle(bd_addr, transport);
2232   tBTM_STATUS status = BTM_SUCCESS;
2233
2234   BTM_TRACE_DEBUG("btm_remove_acl");
2235 #if (BTM_DISC_DURING_RS == TRUE)
2236   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev(bd_addr);
2237
2238   /* Role Switch is pending, postpone until completed */
2239   if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING)) {
2240     p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2241   } else /* otherwise can disconnect right away */
2242 #endif
2243   {
2244     if (hci_handle != 0xFFFF && p_dev_rec &&
2245         p_dev_rec->sec_state != BTM_SEC_STATE_DISCONNECTING) {
2246       btsnd_hcic_disconnect(hci_handle, HCI_ERR_PEER_USER);
2247     } else
2248       status = BTM_UNKNOWN_ADDR;
2249   }
2250
2251   return status;
2252 }
2253
2254 /*******************************************************************************
2255  *
2256  * Function         BTM_SetTraceLevel
2257  *
2258  * Description      This function sets the trace level for BTM.  If called with
2259  *                  a value of 0xFF, it simply returns the current trace level.
2260  *
2261  * Returns          The new or current trace level
2262  *
2263  ******************************************************************************/
2264 uint8_t BTM_SetTraceLevel(uint8_t new_level) {
2265   BTM_TRACE_DEBUG("BTM_SetTraceLevel");
2266   if (new_level != 0xFF) btm_cb.trace_level = new_level;
2267
2268   return (btm_cb.trace_level);
2269 }
2270
2271 /*******************************************************************************
2272  *
2273  * Function         btm_cont_rswitch
2274  *
2275  * Description      This function is called to continue processing an active
2276  *                  role switch. It first disables encryption if enabled and
2277  *                  EPR is not supported
2278  *
2279  * Returns          void
2280  *
2281  ******************************************************************************/
2282 void btm_cont_rswitch(tACL_CONN* p, tBTM_SEC_DEV_REC* p_dev_rec,
2283                       uint8_t hci_status) {
2284   BTM_TRACE_DEBUG("btm_cont_rswitch");
2285   /* Check to see if encryption needs to be turned off if pending
2286      change of link key or role switch */
2287   if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2288     /* Must turn off Encryption first if necessary */
2289     /* Some devices do not support switch or change of link key while encryption
2290      * is on */
2291     if (p_dev_rec != NULL &&
2292         ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) &&
2293         !BTM_EPR_AVAILABLE(p)) {
2294       btsnd_hcic_set_conn_encrypt(p->hci_handle, false);
2295       p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2296       if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2297         p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2298     } else /* Encryption not used or EPR supported, continue with switch
2299               and/or change of link key */
2300     {
2301       if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE) {
2302         p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2303 #if (BTM_DISC_DURING_RS == TRUE)
2304         if (p_dev_rec) p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2305 #endif
2306         btsnd_hcic_switch_role(p->remote_addr, (uint8_t)!p->link_role);
2307       }
2308     }
2309   }
2310 }
2311
2312 /*******************************************************************************
2313  *
2314  * Function         btm_acl_resubmit_page
2315  *
2316  * Description      send pending page request
2317  *
2318  ******************************************************************************/
2319 void btm_acl_resubmit_page(void) {
2320   tBTM_SEC_DEV_REC* p_dev_rec;
2321   BT_HDR* p_buf;
2322   uint8_t* pp;
2323   BD_ADDR bda;
2324   BTM_TRACE_DEBUG("btm_acl_resubmit_page");
2325   /* If there were other page request schedule can start the next one */
2326   p_buf = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue);
2327   if (p_buf != NULL) {
2328     /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2329      * for both create_conn and rmt_name */
2330     pp = (uint8_t*)(p_buf + 1) + p_buf->offset + 3;
2331
2332     STREAM_TO_BDADDR(bda, pp);
2333
2334     p_dev_rec = btm_find_or_alloc_dev(bda);
2335
2336     memcpy(btm_cb.connecting_bda, p_dev_rec->bd_addr, BD_ADDR_LEN);
2337     memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2338
2339     btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2340   } else
2341     btm_cb.paging = false;
2342 }
2343
2344 /*******************************************************************************
2345  *
2346  * Function         btm_acl_reset_paging
2347  *
2348  * Description      set paging to false and free the page queue - called at
2349  *                  hci_reset
2350  *
2351  ******************************************************************************/
2352 void btm_acl_reset_paging(void) {
2353   BT_HDR* p;
2354   BTM_TRACE_DEBUG("btm_acl_reset_paging");
2355   /* If we sent reset we are definitely not paging any more */
2356   while ((p = (BT_HDR*)fixed_queue_try_dequeue(btm_cb.page_queue)) != NULL)
2357     osi_free(p);
2358
2359   btm_cb.paging = false;
2360 }
2361
2362 /*******************************************************************************
2363  *
2364  * Function         btm_acl_paging
2365  *
2366  * Description      send a paging command or queue it in btm_cb
2367  *
2368  ******************************************************************************/
2369 void btm_acl_paging(BT_HDR* p, BD_ADDR bda) {
2370   tBTM_SEC_DEV_REC* p_dev_rec;
2371
2372   BTM_TRACE_DEBUG("btm_acl_paging discing:%d, paging:%d BDA: %06x%06x",
2373                   btm_cb.discing, btm_cb.paging,
2374                   (bda[0] << 16) + (bda[1] << 8) + bda[2],
2375                   (bda[3] << 16) + (bda[4] << 8) + bda[5]);
2376   if (btm_cb.discing) {
2377     btm_cb.paging = true;
2378     fixed_queue_enqueue(btm_cb.page_queue, p);
2379   } else {
2380     if (!BTM_ACL_IS_CONNECTED(bda)) {
2381       BTM_TRACE_DEBUG(
2382           "connecting_bda: %06x%06x",
2383           (btm_cb.connecting_bda[0] << 16) + (btm_cb.connecting_bda[1] << 8) +
2384               btm_cb.connecting_bda[2],
2385           (btm_cb.connecting_bda[3] << 16) + (btm_cb.connecting_bda[4] << 8) +
2386               btm_cb.connecting_bda[5]);
2387       if (btm_cb.paging &&
2388           memcmp(bda, btm_cb.connecting_bda, BD_ADDR_LEN) != 0) {
2389         fixed_queue_enqueue(btm_cb.page_queue, p);
2390       } else {
2391         p_dev_rec = btm_find_or_alloc_dev(bda);
2392         memcpy(btm_cb.connecting_bda, p_dev_rec->bd_addr, BD_ADDR_LEN);
2393         memcpy(btm_cb.connecting_dc, p_dev_rec->dev_class, DEV_CLASS_LEN);
2394
2395         btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2396       }
2397
2398       btm_cb.paging = true;
2399     } else /* ACL is already up */
2400     {
2401       btu_hcif_send_cmd(LOCAL_BR_EDR_CONTROLLER_ID, p);
2402     }
2403   }
2404 }
2405
2406 /*******************************************************************************
2407  *
2408  * Function         btm_acl_notif_conn_collision
2409  *
2410  * Description      Send connection collision event to upper layer if registered
2411  *
2412  * Returns          true if sent out to upper layer,
2413  *                  false if no one needs the notification.
2414  *
2415  ******************************************************************************/
2416 bool btm_acl_notif_conn_collision(BD_ADDR bda) {
2417   tBTM_BL_EVENT_DATA evt_data;
2418
2419   /* Report possible collision to the upper layer. */
2420   if (btm_cb.p_bl_changed_cb) {
2421     BTM_TRACE_DEBUG(
2422         "btm_acl_notif_conn_collision: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2423         bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
2424
2425     evt_data.event = BTM_BL_COLLISION_EVT;
2426     evt_data.conn.p_bda = bda;
2427     evt_data.conn.transport = BT_TRANSPORT_BR_EDR;
2428     evt_data.conn.handle = BTM_INVALID_HCI_HANDLE;
2429     (*btm_cb.p_bl_changed_cb)(&evt_data);
2430     return true;
2431   } else
2432     return false;
2433 }
2434
2435 /*******************************************************************************
2436  *
2437  * Function         btm_acl_chk_peer_pkt_type_support
2438  *
2439  * Description      Check if peer supports requested packets
2440  *
2441  ******************************************************************************/
2442 void btm_acl_chk_peer_pkt_type_support(tACL_CONN* p, uint16_t* p_pkt_type) {
2443   /* 3 and 5 slot packets? */
2444   if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2445     *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 + BTM_ACL_PKT_TYPES_MASK_DM3);
2446
2447   if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2448     *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
2449
2450   /* 2 and 3 MPS support? */
2451   if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2452     /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
2453     *p_pkt_type |=
2454         (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
2455          BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
2456
2457   if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0]))
2458     /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
2459     *p_pkt_type |=
2460         (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
2461          BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2462
2463   /* EDR 3 and 5 slot support? */
2464   if (HCI_EDR_ACL_2MPS_SUPPORTED(p->peer_lmp_feature_pages[0]) ||
2465       HCI_EDR_ACL_3MPS_SUPPORTED(p->peer_lmp_feature_pages[0])) {
2466     if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2467       /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types
2468        */
2469       *p_pkt_type |=
2470           (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
2471
2472     if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->peer_lmp_feature_pages[0]))
2473       /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types
2474        */
2475       *p_pkt_type |=
2476           (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
2477   }
2478 }