OSDN Git Service

DO NOT MERGE HID Host: Check L2CAP packet data length
[android-x86/system-bt.git] / stack / hid / hidh_conn.c
1 /******************************************************************************
2  *
3  *  Copyright (C) 2002-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18
19 /******************************************************************************
20  *
21  *  this file contains the connection interface functions
22  *
23  ******************************************************************************/
24
25 #include <stdlib.h>
26 #include <string.h>
27 #include <stdio.h>
28
29
30 #include "bt_common.h"
31 #include "bt_types.h"
32 #include "log/log.h"
33
34 #include "l2cdefs.h"
35 #include "l2c_api.h"
36
37 #include "btu.h"
38 #include "btm_api.h"
39 #include "btm_int.h"
40
41 #include "hiddefs.h"
42
43 #include "hidh_api.h"
44 #include "hidh_int.h"
45 #include "bt_utils.h"
46
47 #include "osi/include/osi.h"
48
49
50 extern fixed_queue_t *btu_general_alarm_queue;
51
52 static UINT8 find_conn_by_cid (UINT16 cid);
53 static void hidh_conn_retry (UINT8 dhandle);
54
55 /********************************************************************************/
56 /*              L O C A L    F U N C T I O N     P R O T O T Y P E S            */
57 /********************************************************************************/
58 static void hidh_l2cif_connect_ind (BD_ADDR  bd_addr, UINT16 l2cap_cid,
59                                     UINT16 psm, UINT8 l2cap_id);
60 static void hidh_l2cif_connect_cfm (UINT16 l2cap_cid, UINT16 result);
61 static void hidh_l2cif_config_ind (UINT16 l2cap_cid, tL2CAP_CFG_INFO *p_cfg);
62 static void hidh_l2cif_config_cfm (UINT16 l2cap_cid, tL2CAP_CFG_INFO *p_cfg);
63 static void hidh_l2cif_disconnect_ind (UINT16 l2cap_cid, BOOLEAN ack_needed);
64 static void hidh_l2cif_data_ind (UINT16 l2cap_cid, BT_HDR *p_msg);
65 static void hidh_l2cif_disconnect_cfm (UINT16 l2cap_cid, UINT16 result);
66 static void hidh_l2cif_cong_ind (UINT16 l2cap_cid, BOOLEAN congested);
67
68 static const tL2CAP_APPL_INFO hst_reg_info =
69 {
70     hidh_l2cif_connect_ind,
71     hidh_l2cif_connect_cfm,
72     NULL,
73     hidh_l2cif_config_ind,
74     hidh_l2cif_config_cfm,
75     hidh_l2cif_disconnect_ind,
76     hidh_l2cif_disconnect_cfm,
77     NULL,
78     hidh_l2cif_data_ind,
79     hidh_l2cif_cong_ind,
80     NULL                        /* tL2CA_TX_COMPLETE_CB */
81 };
82
83 /*******************************************************************************
84 **
85 ** Function         hidh_l2cif_reg
86 **
87 ** Description      This function initializes the SDP unit.
88 **
89 ** Returns          void
90 **
91 *******************************************************************************/
92 tHID_STATUS hidh_conn_reg (void)
93 {
94     int xx;
95
96     /* Initialize the L2CAP configuration. We only care about MTU and flush */
97     memset(&hh_cb.l2cap_cfg, 0, sizeof(tL2CAP_CFG_INFO));
98
99     hh_cb.l2cap_cfg.mtu_present          = TRUE;
100     hh_cb.l2cap_cfg.mtu                  = HID_HOST_MTU;
101     hh_cb.l2cap_cfg.flush_to_present     = TRUE;
102     hh_cb.l2cap_cfg.flush_to             = HID_HOST_FLUSH_TO;
103
104     /* Now, register with L2CAP */
105     if (!L2CA_Register (HID_PSM_CONTROL, (tL2CAP_APPL_INFO *) &hst_reg_info))
106     {
107         HIDH_TRACE_ERROR ("HID-Host Control Registration failed");
108         return (HID_ERR_L2CAP_FAILED) ;
109     }
110     if (!L2CA_Register (HID_PSM_INTERRUPT, (tL2CAP_APPL_INFO *) &hst_reg_info))
111     {
112         L2CA_Deregister( HID_PSM_CONTROL ) ;
113         HIDH_TRACE_ERROR ("HID-Host Interrupt Registration failed");
114         return (HID_ERR_L2CAP_FAILED) ;
115     }
116
117     for (xx = 0; xx < HID_HOST_MAX_DEVICES; xx++)
118     {
119         hh_cb.devices[xx].in_use = FALSE ;
120         hh_cb.devices[xx].conn.conn_state = HID_CONN_STATE_UNUSED;
121     }
122
123     return (HID_SUCCESS);
124 }
125
126 /*******************************************************************************
127 **
128 ** Function         hidh_conn_disconnect
129 **
130 ** Description      This function disconnects a connection.
131 **
132 ** Returns          TRUE if disconnect started, FALSE if already disconnected
133 **
134 *******************************************************************************/
135 tHID_STATUS hidh_conn_disconnect (UINT8 dhandle)
136 {
137     tHID_CONN *p_hcon = &hh_cb.devices[dhandle].conn;
138
139     HIDH_TRACE_EVENT ("HID-Host disconnect");
140
141     if ((p_hcon->ctrl_cid != 0) || (p_hcon->intr_cid != 0))
142     {
143         p_hcon->conn_state = HID_CONN_STATE_DISCONNECTING;
144
145         /* Set l2cap idle timeout to 0 (so ACL link is disconnected
146          * immediately after last channel is closed) */
147         L2CA_SetIdleTimeoutByBdAddr(hh_cb.devices[dhandle].addr, 0, BT_TRANSPORT_BR_EDR);
148         /* Disconnect both interrupt and control channels */
149         if (p_hcon->intr_cid)
150             L2CA_DisconnectReq (p_hcon->intr_cid);
151         else if (p_hcon->ctrl_cid)
152             L2CA_DisconnectReq (p_hcon->ctrl_cid);
153     }
154     else
155     {
156         p_hcon->conn_state = HID_CONN_STATE_UNUSED;
157     }
158
159     return (HID_SUCCESS);
160 }
161
162 /*******************************************************************************
163 **
164 ** Function         hidh_sec_check_complete_term
165 **
166 ** Description      HID security check complete callback function.
167 **
168 ** Returns          Send L2CA_ConnectRsp OK if secutiry check succeed; otherwise
169 **                  send security block L2C connection response.
170 **
171 *******************************************************************************/
172 void hidh_sec_check_complete_term (BD_ADDR bd_addr, tBT_TRANSPORT transport, void *p_ref_data, UINT8 res)
173 {
174     tHID_HOST_DEV_CTB *p_dev= (tHID_HOST_DEV_CTB *) p_ref_data;
175     UNUSED(bd_addr);
176     UNUSED (transport);
177
178     if( res == BTM_SUCCESS && p_dev->conn.conn_state == HID_CONN_STATE_SECURITY )
179     {
180         p_dev->conn.disc_reason = HID_SUCCESS;  /* Authentication passed. Reset disc_reason (from HID_ERR_AUTH_FAILED) */
181
182         p_dev->conn.conn_state = HID_CONN_STATE_CONNECTING_INTR;
183
184         /* Send response to the L2CAP layer. */
185         L2CA_ConnectRsp (p_dev->addr, p_dev->conn.ctrl_id, p_dev->conn.ctrl_cid, L2CAP_CONN_OK, L2CAP_CONN_OK);
186
187         /* Send a Configuration Request. */
188         L2CA_ConfigReq (p_dev->conn.ctrl_cid, &hh_cb.l2cap_cfg);
189
190     }
191     /* security check fail */
192     else if (res != BTM_SUCCESS)
193     {
194         p_dev->conn.disc_reason = HID_ERR_AUTH_FAILED;      /* Save reason for disconnecting */
195         p_dev->conn.conn_state = HID_CONN_STATE_UNUSED;
196         L2CA_ConnectRsp (p_dev->addr, p_dev->conn.ctrl_id, p_dev->conn.ctrl_cid, L2CAP_CONN_SECURITY_BLOCK, L2CAP_CONN_OK);
197     }
198 }
199
200 /*******************************************************************************
201 **
202 ** Function         hidh_l2cif_connect_ind
203 **
204 ** Description      This function handles an inbound connection indication
205 **                  from L2CAP. This is the case where we are acting as a
206 **                  server.
207 **
208 ** Returns          void
209 **
210 *******************************************************************************/
211 static void hidh_l2cif_connect_ind (BD_ADDR  bd_addr, UINT16 l2cap_cid, UINT16 psm, UINT8 l2cap_id)
212 {
213     tHID_CONN    *p_hcon;
214     BOOLEAN      bAccept = TRUE;
215     UINT8        i = HID_HOST_MAX_DEVICES;
216     tHID_HOST_DEV_CTB *p_dev;
217
218     HIDH_TRACE_EVENT ("HID-Host Rcvd L2CAP conn ind, PSM: 0x%04x  CID 0x%x", psm, l2cap_cid);
219
220     /* always add incoming connection device into HID database by default */
221     if (HID_HostAddDev(bd_addr, HID_SEC_REQUIRED, &i) != HID_SUCCESS)
222     {
223         L2CA_ConnectRsp (bd_addr, l2cap_id, l2cap_cid, L2CAP_CONN_SECURITY_BLOCK, 0);
224         return;
225     }
226
227     p_hcon = &hh_cb.devices[i].conn;
228     p_dev  = &hh_cb.devices[i];
229
230     /* Check we are in the correct state for this */
231     if (psm == HID_PSM_INTERRUPT)
232     {
233         if (p_hcon->ctrl_cid == 0)
234         {
235             HIDH_TRACE_WARNING ("HID-Host Rcvd INTR L2CAP conn ind, but no CTL channel");
236             bAccept = FALSE;
237         }
238         if (p_hcon->conn_state != HID_CONN_STATE_CONNECTING_INTR)
239         {
240             HIDH_TRACE_WARNING ("HID-Host Rcvd INTR L2CAP conn ind, wrong state: %d",
241                                  p_hcon->conn_state);
242             bAccept = FALSE;
243         }
244     }
245     else /* CTRL channel */
246     {
247 #if defined(HID_HOST_ACPT_NEW_CONN) && (HID_HOST_ACPT_NEW_CONN == TRUE)
248         p_hcon->ctrl_cid = p_hcon->intr_cid = 0;
249         p_hcon->conn_state = HID_CONN_STATE_UNUSED;
250 #else
251         if (p_hcon->conn_state != HID_CONN_STATE_UNUSED)
252         {
253             HIDH_TRACE_WARNING ("HID-Host - Rcvd CTL L2CAP conn ind, wrong state: %d",
254                                  p_hcon->conn_state);
255             bAccept = FALSE;
256         }
257 #endif
258     }
259
260     if (!bAccept)
261     {
262         L2CA_ConnectRsp (bd_addr, l2cap_id, l2cap_cid, L2CAP_CONN_NO_RESOURCES, 0);
263         return;
264     }
265
266     if (psm == HID_PSM_CONTROL)
267     {
268         p_hcon->conn_flags = 0;
269         p_hcon->ctrl_cid   = l2cap_cid;
270         p_hcon->ctrl_id    = l2cap_id;
271         p_hcon->disc_reason = HID_L2CAP_CONN_FAIL;  /* In case disconnection occurs before security is completed, then set CLOSE_EVT reason code to 'connection failure' */
272
273         p_hcon->conn_state = HID_CONN_STATE_SECURITY;
274         if(btm_sec_mx_access_request (p_dev->addr, HID_PSM_CONTROL,
275             FALSE, BTM_SEC_PROTO_HID,
276             (p_dev->attr_mask & HID_SEC_REQUIRED) ? HID_SEC_CHN : HID_NOSEC_CHN,
277             &hidh_sec_check_complete_term, p_dev) == BTM_CMD_STARTED)
278         {
279             L2CA_ConnectRsp (bd_addr, l2cap_id, l2cap_cid, L2CAP_CONN_PENDING, L2CAP_CONN_OK);
280         }
281
282         return;
283     }
284
285     /* Transition to the next appropriate state, configuration */
286     p_hcon->conn_state = HID_CONN_STATE_CONFIG;
287     p_hcon->intr_cid   = l2cap_cid;
288
289     /* Send response to the L2CAP layer. */
290     L2CA_ConnectRsp (bd_addr, l2cap_id, l2cap_cid, L2CAP_CONN_OK, L2CAP_CONN_OK);
291
292     /* Send a Configuration Request. */
293     L2CA_ConfigReq (l2cap_cid, &hh_cb.l2cap_cfg);
294
295     HIDH_TRACE_EVENT ("HID-Host Rcvd L2CAP conn ind, sent config req, PSM: 0x%04x  CID 0x%x",
296                        psm, l2cap_cid);
297 }
298
299 void hidh_process_repage_timer_timeout(void *data)
300 {
301   uint8_t dhandle = PTR_TO_UINT(data);
302   hidh_try_repage(dhandle);
303 }
304
305 /*******************************************************************************
306 **
307 ** Function         hidh_try_repage
308 **
309 ** Description      This function processes timeout (to page device).
310 **
311 ** Returns          void
312 **
313 *******************************************************************************/
314 void hidh_try_repage(UINT8 dhandle)
315 {
316     tHID_HOST_DEV_CTB *device;
317
318     hidh_conn_initiate(dhandle);
319
320     device = &hh_cb.devices[dhandle];
321     device->conn_tries++;
322
323     hh_cb.callback(dhandle, device->addr, HID_HDEV_EVT_RETRYING,
324                    device->conn_tries, NULL ) ;
325 }
326
327 /*******************************************************************************
328 **
329 ** Function         hidh_sec_check_complete_orig
330 **
331 ** Description      This function checks to see if security procedures are being
332 **                  carried out or not..
333 **
334 ** Returns          void
335 **
336 *******************************************************************************/
337 void hidh_sec_check_complete_orig (BD_ADDR bd_addr, tBT_TRANSPORT transport, void *p_ref_data, UINT8 res)
338 {
339     tHID_HOST_DEV_CTB *p_dev = (tHID_HOST_DEV_CTB *) p_ref_data;
340     UINT8 dhandle;
341     UNUSED(bd_addr);
342     UNUSED (transport);
343
344     // TODO(armansito): This kind of math to determine a device handle is way
345     // too dirty and unnecessary. Why can't |p_dev| store it's handle?
346     dhandle = (PTR_TO_UINT(p_dev) - PTR_TO_UINT(&(hh_cb.devices[0])))/ sizeof(tHID_HOST_DEV_CTB);
347     if( res == BTM_SUCCESS && p_dev->conn.conn_state == HID_CONN_STATE_SECURITY )
348     {
349         HIDH_TRACE_EVENT ("HID-Host Originator security pass.");
350         p_dev->conn.disc_reason = HID_SUCCESS;  /* Authentication passed. Reset disc_reason (from HID_ERR_AUTH_FAILED) */
351
352         /* Transition to the next appropriate state, configuration */
353         p_dev->conn.conn_state = HID_CONN_STATE_CONFIG;
354         L2CA_ConfigReq (p_dev->conn.ctrl_cid, &hh_cb.l2cap_cfg);
355         HIDH_TRACE_EVENT ("HID-Host Got Control conn cnf, sent cfg req, CID: 0x%x", p_dev->conn.ctrl_cid);
356
357     }
358
359     if( res != BTM_SUCCESS && p_dev->conn.conn_state == HID_CONN_STATE_SECURITY )
360     {
361 #if (HID_HOST_MAX_CONN_RETRY > 0)
362         if( res == BTM_DEVICE_TIMEOUT )
363         {
364             if( p_dev->conn_tries <= HID_HOST_MAX_CONN_RETRY )
365             {
366                 hidh_conn_retry (dhandle);
367                 return;
368             }
369         }
370 #endif
371         p_dev->conn.disc_reason = HID_ERR_AUTH_FAILED;      /* Save reason for disconnecting */
372         hidh_conn_disconnect(dhandle);
373     }
374
375 }
376
377 /*******************************************************************************
378 **
379 ** Function         hidh_l2cif_connect_cfm
380 **
381 ** Description      This function handles the connect confirm events
382 **                  from L2CAP. This is the case when we are acting as a
383 **                  client and have sent a connect request.
384 **
385 ** Returns          void
386 **
387 *******************************************************************************/
388 static void hidh_l2cif_connect_cfm (UINT16 l2cap_cid, UINT16 result)
389 {
390     UINT8 dhandle;
391     tHID_CONN    *p_hcon = NULL;
392     UINT32  reason;
393     tHID_HOST_DEV_CTB *p_dev = NULL;
394
395     /* Find CCB based on CID, and verify we are in a state to accept this message */
396     if( (dhandle = find_conn_by_cid(l2cap_cid)) < HID_HOST_MAX_DEVICES )
397     {
398         p_dev = &hh_cb.devices[dhandle];
399         p_hcon = &hh_cb.devices[dhandle].conn;
400     }
401
402     if ((p_hcon == NULL)
403      || (!(p_hcon->conn_flags & HID_CONN_FLAGS_IS_ORIG))
404      || ((l2cap_cid == p_hcon->ctrl_cid) && (p_hcon->conn_state != HID_CONN_STATE_CONNECTING_CTRL))
405      || ((l2cap_cid == p_hcon->intr_cid) && (p_hcon->conn_state != HID_CONN_STATE_CONNECTING_INTR)
406      && (p_hcon->conn_state != HID_CONN_STATE_DISCONNECTING)))
407     {
408         HIDH_TRACE_WARNING ("HID-Host Rcvd unexpected conn cnf, CID 0x%x ", l2cap_cid);
409         return;
410     }
411
412     if (result != L2CAP_CONN_OK)
413     {
414         if (l2cap_cid == p_hcon->ctrl_cid)
415             p_hcon->ctrl_cid = 0;
416         else
417             p_hcon->intr_cid = 0;
418
419         hidh_conn_disconnect(dhandle);
420
421 #if (HID_HOST_MAX_CONN_RETRY > 0)
422         if( (hh_cb.devices[dhandle].conn_tries <= HID_HOST_MAX_CONN_RETRY) &&
423             (result == HCI_ERR_CONNECTION_TOUT || result == HCI_ERR_UNSPECIFIED ||
424              result == HCI_ERR_PAGE_TIMEOUT) )
425         {
426             hidh_conn_retry(dhandle);
427         }
428         else
429 #endif
430         {
431             reason = HID_L2CAP_CONN_FAIL | (UINT32) result ;
432             hh_cb.callback( dhandle, hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, reason, NULL ) ;
433         }
434         return;
435     }
436     /* receive Control Channel connect confirmation */
437     if (l2cap_cid == p_hcon->ctrl_cid)
438     {
439         /* check security requirement */
440         p_hcon->conn_state = HID_CONN_STATE_SECURITY;
441         p_hcon->disc_reason = HID_L2CAP_CONN_FAIL;  /* In case disconnection occurs before security is completed, then set CLOSE_EVT reason code to "connection failure" */
442
443         btm_sec_mx_access_request (p_dev->addr, HID_PSM_CONTROL,
444             TRUE, BTM_SEC_PROTO_HID,
445             (p_dev->attr_mask & HID_SEC_REQUIRED) ? HID_SEC_CHN : HID_NOSEC_CHN,
446             &hidh_sec_check_complete_orig, p_dev);
447     }
448     else
449     {
450         p_hcon->conn_state = HID_CONN_STATE_CONFIG;
451         /* Send a Configuration Request. */
452         L2CA_ConfigReq (l2cap_cid, &hh_cb.l2cap_cfg);
453         HIDH_TRACE_EVENT ("HID-Host got Interrupt conn cnf, sent cfg req, CID: 0x%x", l2cap_cid);
454     }
455
456     return;
457 }
458
459 /*******************************************************************************
460 **
461 ** Function         hidh_l2cif_config_ind
462 **
463 ** Description      This function processes the L2CAP configuration indication
464 **                  event.
465 **
466 ** Returns          void
467 **
468 *******************************************************************************/
469 static void hidh_l2cif_config_ind (UINT16 l2cap_cid, tL2CAP_CFG_INFO *p_cfg)
470 {
471     UINT8 dhandle;
472     tHID_CONN    *p_hcon = NULL;
473     UINT32  reason;
474
475     /* Find CCB based on CID */
476     if( (dhandle = find_conn_by_cid(l2cap_cid)) < HID_HOST_MAX_DEVICES )
477     {
478         p_hcon = &hh_cb.devices[dhandle].conn;
479     }
480
481     if (p_hcon == NULL)
482     {
483         HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP cfg ind, unknown CID: 0x%x", l2cap_cid);
484         return;
485     }
486
487     HIDH_TRACE_EVENT ("HID-Host Rcvd cfg ind, sent cfg cfm, CID: 0x%x", l2cap_cid);
488
489     /* Remember the remote MTU size */
490     if ((!p_cfg->mtu_present) || (p_cfg->mtu > HID_HOST_MTU))
491         p_hcon->rem_mtu_size = HID_HOST_MTU;
492     else
493         p_hcon->rem_mtu_size = p_cfg->mtu;
494
495     /* For now, always accept configuration from the other side */
496     p_cfg->flush_to_present = FALSE;
497     p_cfg->mtu_present      = FALSE;
498     p_cfg->result           = L2CAP_CFG_OK;
499
500     L2CA_ConfigRsp (l2cap_cid, p_cfg);
501
502     if (l2cap_cid == p_hcon->ctrl_cid)
503     {
504         p_hcon->conn_flags |= HID_CONN_FLAGS_HIS_CTRL_CFG_DONE;
505         if ((p_hcon->conn_flags & HID_CONN_FLAGS_IS_ORIG) &&
506            (p_hcon->conn_flags & HID_CONN_FLAGS_MY_CTRL_CFG_DONE))
507         {
508             /* Connect interrupt channel */
509             p_hcon->disc_reason = HID_L2CAP_CONN_FAIL;  /* Reset initial reason for CLOSE_EVT: Connection Attempt was made but failed */
510             if ((p_hcon->intr_cid = L2CA_ConnectReq (HID_PSM_INTERRUPT, hh_cb.devices[dhandle].addr)) == 0)
511             {
512                 HIDH_TRACE_WARNING ("HID-Host INTR Originate failed");
513                 reason = HID_L2CAP_REQ_FAIL ;
514                 p_hcon->conn_state = HID_CONN_STATE_UNUSED;
515                 hidh_conn_disconnect (dhandle);
516                 hh_cb.callback( dhandle, hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, reason, NULL ) ;
517                 return;
518             }
519             else
520             {
521                 /* Transition to the next appropriate state, waiting for connection confirm on interrupt channel. */
522                 p_hcon->conn_state = HID_CONN_STATE_CONNECTING_INTR;
523             }
524         }
525     }
526     else
527         p_hcon->conn_flags |= HID_CONN_FLAGS_HIS_INTR_CFG_DONE;
528
529     /* If all configuration is complete, change state and tell management we are up */
530     if (((p_hcon->conn_flags & HID_CONN_FLAGS_ALL_CONFIGURED) == HID_CONN_FLAGS_ALL_CONFIGURED)
531      && (p_hcon->conn_state == HID_CONN_STATE_CONFIG))
532     {
533         p_hcon->conn_state = HID_CONN_STATE_CONNECTED;
534         /* Reset disconnect reason to success, as connection successful */
535         p_hcon->disc_reason = HID_SUCCESS;
536
537         hh_cb.devices[dhandle].state = HID_DEV_CONNECTED;
538         hh_cb.callback( dhandle,  hh_cb.devices[dhandle].addr, HID_HDEV_EVT_OPEN, 0, NULL ) ;
539     }
540 }
541
542
543 /*******************************************************************************
544 **
545 ** Function         hidh_l2cif_config_cfm
546 **
547 ** Description      This function processes the L2CAP configuration confirmation
548 **                  event.
549 **
550 ** Returns          void
551 **
552 *******************************************************************************/
553 static void hidh_l2cif_config_cfm (UINT16 l2cap_cid, tL2CAP_CFG_INFO *p_cfg)
554 {
555     UINT8 dhandle;
556     tHID_CONN    *p_hcon = NULL;
557     UINT32  reason;
558
559     HIDH_TRACE_EVENT ("HID-Host Rcvd cfg cfm, CID: 0x%x  Result: %d", l2cap_cid, p_cfg->result);
560
561     /* Find CCB based on CID */
562     if( (dhandle = find_conn_by_cid(l2cap_cid)) < HID_HOST_MAX_DEVICES )
563         p_hcon = &hh_cb.devices[dhandle].conn;
564
565     if (p_hcon == NULL)
566     {
567         HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP cfg ind, unknown CID: 0x%x", l2cap_cid);
568         return;
569     }
570
571     /* If configuration failed, disconnect the channel(s) */
572     if (p_cfg->result != L2CAP_CFG_OK)
573     {
574         hidh_conn_disconnect (dhandle);
575         reason = HID_L2CAP_CFG_FAIL | (UINT32) p_cfg->result ;
576         hh_cb.callback( dhandle, hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, reason, NULL ) ;
577         return;
578     }
579
580     if (l2cap_cid == p_hcon->ctrl_cid)
581     {
582         p_hcon->conn_flags |= HID_CONN_FLAGS_MY_CTRL_CFG_DONE;
583         if ((p_hcon->conn_flags & HID_CONN_FLAGS_IS_ORIG) &&
584            (p_hcon->conn_flags & HID_CONN_FLAGS_HIS_CTRL_CFG_DONE))
585         {
586             /* Connect interrupt channel */
587             p_hcon->disc_reason = HID_L2CAP_CONN_FAIL;  /* Reset initial reason for CLOSE_EVT: Connection Attempt was made but failed */
588             if ((p_hcon->intr_cid = L2CA_ConnectReq (HID_PSM_INTERRUPT, hh_cb.devices[dhandle].addr)) == 0)
589             {
590                 HIDH_TRACE_WARNING ("HID-Host INTR Originate failed");
591                 reason = HID_L2CAP_REQ_FAIL ;
592                 p_hcon->conn_state = HID_CONN_STATE_UNUSED;
593                 hidh_conn_disconnect (dhandle);
594                 hh_cb.callback( dhandle, hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, reason, NULL ) ;
595                 return;
596             }
597             else
598             {
599                 /* Transition to the next appropriate state, waiting for connection confirm on interrupt channel. */
600                 p_hcon->conn_state = HID_CONN_STATE_CONNECTING_INTR;
601             }
602         }
603     }
604     else
605         p_hcon->conn_flags |= HID_CONN_FLAGS_MY_INTR_CFG_DONE;
606
607     /* If all configuration is complete, change state and tell management we are up */
608     if (((p_hcon->conn_flags & HID_CONN_FLAGS_ALL_CONFIGURED) == HID_CONN_FLAGS_ALL_CONFIGURED)
609      && (p_hcon->conn_state == HID_CONN_STATE_CONFIG))
610     {
611         p_hcon->conn_state = HID_CONN_STATE_CONNECTED;
612         /* Reset disconnect reason to success, as connection successful */
613         p_hcon->disc_reason = HID_SUCCESS;
614
615         hh_cb.devices[dhandle].state = HID_DEV_CONNECTED;
616         hh_cb.callback( dhandle, hh_cb.devices[dhandle].addr, HID_HDEV_EVT_OPEN, 0, NULL ) ;
617     }
618 }
619
620
621 /*******************************************************************************
622 **
623 ** Function         hidh_l2cif_disconnect_ind
624 **
625 ** Description      This function handles a disconnect event from L2CAP. If
626 **                  requested to, we ack the disconnect before dropping the CCB
627 **
628 ** Returns          void
629 **
630 *******************************************************************************/
631 static void hidh_l2cif_disconnect_ind (UINT16 l2cap_cid, BOOLEAN ack_needed)
632 {
633     UINT8 dhandle;
634     tHID_CONN    *p_hcon = NULL;
635     UINT16 disc_res = HCI_SUCCESS;
636     UINT16 hid_close_evt_reason;
637
638     /* Find CCB based on CID */
639     if( (dhandle = find_conn_by_cid(l2cap_cid)) < HID_HOST_MAX_DEVICES )
640         p_hcon = &hh_cb.devices[dhandle].conn;
641
642     if (p_hcon == NULL)
643     {
644         HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP disc, unknown CID: 0x%x", l2cap_cid);
645         return;
646     }
647
648     if (ack_needed)
649         L2CA_DisconnectRsp (l2cap_cid);
650
651     HIDH_TRACE_EVENT ("HID-Host Rcvd L2CAP disc, CID: 0x%x", l2cap_cid);
652
653     p_hcon->conn_state = HID_CONN_STATE_DISCONNECTING;
654
655     if (l2cap_cid == p_hcon->ctrl_cid)
656         p_hcon->ctrl_cid = 0;
657     else
658         p_hcon->intr_cid = 0;
659
660     if ((p_hcon->ctrl_cid == 0) && (p_hcon->intr_cid == 0))
661     {
662         hh_cb.devices[dhandle].state = HID_DEV_NO_CONN;
663         p_hcon->conn_state = HID_CONN_STATE_UNUSED;
664
665         if( !ack_needed )
666             disc_res = btm_get_acl_disc_reason_code();
667
668 #if (HID_HOST_MAX_CONN_RETRY > 0)
669         if( (disc_res == HCI_ERR_CONNECTION_TOUT || disc_res == HCI_ERR_UNSPECIFIED) &&
670             (!(hh_cb.devices[dhandle].attr_mask & HID_RECONN_INIT)) &&
671             (hh_cb.devices[dhandle].attr_mask & HID_NORMALLY_CONNECTABLE))
672         {
673             hh_cb.devices[dhandle].conn_tries = 0;
674             period_ms_t interval_ms = HID_HOST_REPAGE_WIN * 1000;
675             alarm_set_on_queue(hh_cb.devices[dhandle].conn.process_repage_timer,
676                                interval_ms, hidh_process_repage_timer_timeout,
677                                UINT_TO_PTR(dhandle), btu_general_alarm_queue);
678             hh_cb.callback( dhandle,  hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, disc_res, NULL);
679         }
680         else
681 #endif
682         {
683             /* Set reason code for HID_HDEV_EVT_CLOSE */
684             hid_close_evt_reason = p_hcon->disc_reason;
685
686             /* If we got baseband sent HCI_DISCONNECT_COMPLETE_EVT due to security failure, then set reason to HID_ERR_AUTH_FAILED */
687             if ((disc_res == HCI_ERR_AUTH_FAILURE)                        ||
688                 (disc_res == HCI_ERR_KEY_MISSING)                         ||
689                 (disc_res == HCI_ERR_HOST_REJECT_SECURITY)                ||
690                 (disc_res == HCI_ERR_PAIRING_NOT_ALLOWED)                 ||
691                 (disc_res == HCI_ERR_UNIT_KEY_USED)                       ||
692                 (disc_res == HCI_ERR_PAIRING_WITH_UNIT_KEY_NOT_SUPPORTED) ||
693                 (disc_res == HCI_ERR_ENCRY_MODE_NOT_ACCEPTABLE)           ||
694                 (disc_res == HCI_ERR_REPEATED_ATTEMPTS))
695             {
696                 hid_close_evt_reason = HID_ERR_AUTH_FAILED;
697             }
698
699             hh_cb.callback( dhandle,  hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, hid_close_evt_reason, NULL ) ;
700         }
701     }
702 }
703
704
705 /*******************************************************************************
706 **
707 ** Function         hidh_l2cif_disconnect_cfm
708 **
709 ** Description      This function handles a disconnect confirm event from L2CAP.
710 **
711 ** Returns          void
712 **
713 *******************************************************************************/
714 static void hidh_l2cif_disconnect_cfm (UINT16 l2cap_cid, UINT16 result)
715 {
716     UINT8 dhandle;
717     tHID_CONN    *p_hcon = NULL;
718     UNUSED(result);
719
720     /* Find CCB based on CID */
721     if( (dhandle = find_conn_by_cid(l2cap_cid)) < HID_HOST_MAX_DEVICES )
722         p_hcon = &hh_cb.devices[dhandle].conn;
723
724     if (p_hcon == NULL)
725     {
726         HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP disc cfm, unknown CID: 0x%x", l2cap_cid);
727         return;
728     }
729
730     HIDH_TRACE_EVENT ("HID-Host Rcvd L2CAP disc cfm, CID: 0x%x", l2cap_cid);
731
732     if (l2cap_cid == p_hcon->ctrl_cid)
733         p_hcon->ctrl_cid = 0;
734     else
735     {
736         p_hcon->intr_cid = 0;
737         if (p_hcon->ctrl_cid)
738         {
739             HIDH_TRACE_EVENT ("HID-Host Initiating L2CAP Ctrl disconnection");
740             L2CA_DisconnectReq (p_hcon->ctrl_cid);
741         }
742     }
743
744     if ((p_hcon->ctrl_cid == 0) && (p_hcon->intr_cid == 0))
745     {
746         hh_cb.devices[dhandle].state = HID_DEV_NO_CONN;
747         p_hcon->conn_state = HID_CONN_STATE_UNUSED;
748         hh_cb.callback( dhandle, hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE, p_hcon->disc_reason, NULL ) ;
749     }
750 }
751
752
753 /*******************************************************************************
754 **
755 ** Function         hidh_l2cif_cong_ind
756 **
757 ** Description      This function handles a congestion status event from L2CAP.
758 **
759 ** Returns          void
760 **
761 *******************************************************************************/
762 static void hidh_l2cif_cong_ind (UINT16 l2cap_cid, BOOLEAN congested)
763 {
764     UINT8 dhandle;
765     tHID_CONN    *p_hcon = NULL;
766
767     /* Find CCB based on CID */
768     if( (dhandle = find_conn_by_cid(l2cap_cid)) < HID_HOST_MAX_DEVICES )
769         p_hcon = &hh_cb.devices[dhandle].conn;
770
771     if (p_hcon == NULL)
772     {
773         HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP congestion status, unknown CID: 0x%x", l2cap_cid);
774         return;
775     }
776
777     HIDH_TRACE_EVENT ("HID-Host Rcvd L2CAP congestion status, CID: 0x%x  Cong: %d", l2cap_cid, congested);
778
779     if (congested)
780         p_hcon->conn_flags |= HID_CONN_FLAGS_CONGESTED;
781     else
782     {
783         p_hcon->conn_flags &= ~HID_CONN_FLAGS_CONGESTED;
784
785     }
786 }
787
788
789 /*******************************************************************************
790 **
791 ** Function         hidh_l2cif_data_ind
792 **
793 ** Description      This function is called when data is received from L2CAP.
794 **                  if we are the originator of the connection, we are the SDP
795 **                  client, and the received message is queued up for the client.
796 **
797 **                  If we are the destination of the connection, we are the SDP
798 **                  server, so the message is passed to the server processing
799 **                  function.
800 **
801 ** Returns          void
802 **
803 *******************************************************************************/
804 static void hidh_l2cif_data_ind (UINT16 l2cap_cid, BT_HDR *p_msg)
805 {
806     UINT8           *p_data = (UINT8 *)(p_msg + 1) + p_msg->offset;
807     UINT8           ttype, param, rep_type, evt;
808     UINT8 dhandle;
809     tHID_CONN    *p_hcon = NULL;
810
811     HIDH_TRACE_DEBUG ("HID-Host hidh_l2cif_data_ind [l2cap_cid=0x%04x]", l2cap_cid);
812
813     /* Find CCB based on CID */
814      if ((dhandle = find_conn_by_cid(l2cap_cid)) < HID_HOST_MAX_DEVICES)
815         p_hcon = &hh_cb.devices[dhandle].conn;
816
817     if (p_hcon == NULL)
818     {
819         HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP data, unknown CID: 0x%x", l2cap_cid);
820         osi_free(p_msg);
821         return;
822     }
823
824     if (p_msg->len < 1)
825     {
826         HIDH_TRACE_WARNING ("HID-Host Rcvd L2CAP data, invalid length");
827         osi_free(p_msg);
828         android_errorWriteLog(0x534e4554, "80493272");
829         return;
830     }
831
832     ttype    = HID_GET_TRANS_FROM_HDR(*p_data);
833     param    = HID_GET_PARAM_FROM_HDR(*p_data);
834     rep_type = param & HID_PAR_REP_TYPE_MASK;
835     p_data++;
836
837     /* Get rid of the data type */
838     p_msg->len--;
839     p_msg->offset++;
840
841     switch (ttype)
842     {
843     case HID_TRANS_HANDSHAKE:
844         hh_cb.callback(dhandle,  hh_cb.devices[dhandle].addr, HID_HDEV_EVT_HANDSHAKE, param, NULL);
845         osi_free(p_msg);
846         break;
847
848     case HID_TRANS_CONTROL:
849         switch (param)
850         {
851         case HID_PAR_CONTROL_VIRTUAL_CABLE_UNPLUG:
852             hidh_conn_disconnect( dhandle ) ;
853             /* Device is unplugging from us. Tell USB */
854             hh_cb.callback(dhandle,  hh_cb.devices[dhandle].addr, HID_HDEV_EVT_VC_UNPLUG, 0, NULL);
855             break;
856
857         default:
858             break;
859         }
860         osi_free(p_msg);
861         break;
862
863
864     case HID_TRANS_DATA:
865         evt = (hh_cb.devices[dhandle].conn.intr_cid == l2cap_cid) ?
866                     HID_HDEV_EVT_INTR_DATA : HID_HDEV_EVT_CTRL_DATA;
867         hh_cb.callback(dhandle, hh_cb.devices[dhandle].addr, evt, rep_type, p_msg);
868         break;
869
870     case HID_TRANS_DATAC:
871         evt = (hh_cb.devices[dhandle].conn.intr_cid == l2cap_cid) ?
872                     HID_HDEV_EVT_INTR_DATC : HID_HDEV_EVT_CTRL_DATC;
873         hh_cb.callback(dhandle,  hh_cb.devices[dhandle].addr, evt, rep_type, p_msg);
874         break;
875
876     default:
877         osi_free(p_msg);
878         break;
879     }
880 }
881
882 /*******************************************************************************
883 **
884 ** Function         hidh_conn_snd_data
885 **
886 ** Description      This function is sends out data.
887 **
888 ** Returns          tHID_STATUS
889 **
890 *******************************************************************************/
891 tHID_STATUS hidh_conn_snd_data (UINT8 dhandle, UINT8 trans_type, UINT8 param,
892                                 UINT16 data, UINT8 report_id, BT_HDR *buf)
893 {
894     tHID_CONN   *p_hcon = &hh_cb.devices[dhandle].conn;
895     BT_HDR      *p_buf;
896     UINT8       *p_out;
897     UINT16      bytes_copied;
898     BOOLEAN     seg_req = FALSE;
899     UINT16      data_size;
900     UINT16      cid;
901     UINT16      buf_size;
902     UINT8       use_data = 0 ;
903     BOOLEAN     blank_datc = FALSE;
904
905     if (!BTM_IsAclConnectionUp(hh_cb.devices[dhandle].addr, BT_TRANSPORT_BR_EDR))
906     {
907         osi_free(buf);
908         return HID_ERR_NO_CONNECTION;
909     }
910
911     if (p_hcon->conn_flags & HID_CONN_FLAGS_CONGESTED)
912     {
913         osi_free(buf);
914         return HID_ERR_CONGESTED;
915     }
916
917     switch( trans_type )
918     {
919     case HID_TRANS_CONTROL:
920     case HID_TRANS_GET_REPORT:
921     case HID_TRANS_SET_REPORT:
922     case HID_TRANS_GET_PROTOCOL:
923     case HID_TRANS_SET_PROTOCOL:
924     case HID_TRANS_GET_IDLE:
925     case HID_TRANS_SET_IDLE:
926         cid = p_hcon->ctrl_cid;
927         buf_size = HID_CONTROL_BUF_SIZE;
928         break;
929     case HID_TRANS_DATA:
930         cid = p_hcon->intr_cid;
931         buf_size = HID_INTERRUPT_BUF_SIZE;
932         break;
933     default:
934         return (HID_ERR_INVALID_PARAM) ;
935     }
936
937     if( trans_type == HID_TRANS_SET_IDLE )
938         use_data = 1;
939     else if( (trans_type == HID_TRANS_GET_REPORT) && (param & 0x08) )
940         use_data = 2;
941
942     do
943     {
944         if ( buf == NULL || blank_datc )
945         {
946             p_buf = (BT_HDR *)osi_malloc(buf_size);
947
948             p_buf->offset = L2CAP_MIN_OFFSET;
949             seg_req = FALSE;
950             data_size = 0;
951             bytes_copied = 0;
952             blank_datc = FALSE;
953         }
954         else if ( (buf->len > (p_hcon->rem_mtu_size - 1)))
955         {
956             p_buf = (BT_HDR *)osi_malloc(buf_size);
957
958             p_buf->offset = L2CAP_MIN_OFFSET;
959             seg_req = TRUE;
960             data_size = buf->len;
961             bytes_copied = p_hcon->rem_mtu_size - 1;
962         }
963         else
964         {
965             p_buf = buf ;
966             p_buf->offset -= 1;
967             seg_req = FALSE;
968             data_size = buf->len;
969             bytes_copied = buf->len;
970         }
971
972         p_out         = (UINT8 *)(p_buf + 1) + p_buf->offset;
973         *p_out++      = HID_BUILD_HDR(trans_type, param);
974
975         /* If report ID required for this device */
976         if( (trans_type == HID_TRANS_GET_REPORT) && (report_id != 0) )
977         {
978             *p_out = report_id;
979             data_size = bytes_copied = 1;
980         }
981
982
983         if (seg_req)
984         {
985             memcpy (p_out, (((UINT8 *)(buf+1)) + buf->offset), bytes_copied);
986             buf->offset += bytes_copied;
987             buf->len -= bytes_copied;
988         }
989         else if( use_data == 1)
990         {
991             *(p_out+bytes_copied) = data & 0xff;
992         }
993         else if( use_data == 2 )
994         {
995             *(p_out+bytes_copied) = data & 0xff;
996             *(p_out+bytes_copied+1) = (data >> 8) & 0xff ;
997         }
998
999         p_buf->len   = bytes_copied + 1 + use_data;
1000         data_size    -= bytes_copied;
1001
1002         /* Send the buffer through L2CAP */
1003         if ((p_hcon->conn_flags & HID_CONN_FLAGS_CONGESTED) || (!L2CA_DataWrite (cid, p_buf)))
1004             return (HID_ERR_CONGESTED);
1005
1006         if (data_size)
1007             trans_type = HID_TRANS_DATAC;
1008         else if( bytes_copied == (p_hcon->rem_mtu_size - 1) )
1009         {
1010             trans_type = HID_TRANS_DATAC;
1011             blank_datc = TRUE;
1012         }
1013
1014     } while ((data_size != 0) || blank_datc ) ;
1015
1016     return (HID_SUCCESS);
1017 }
1018 /*******************************************************************************
1019 **
1020 ** Function         hidh_conn_initiate
1021 **
1022 ** Description      This function is called by the management to create a connection.
1023 **
1024 ** Returns          void
1025 **
1026 *******************************************************************************/
1027 tHID_STATUS hidh_conn_initiate (UINT8 dhandle)
1028 {
1029     UINT8   service_id = BTM_SEC_SERVICE_HIDH_NOSEC_CTRL;
1030     UINT32  mx_chan_id = HID_NOSEC_CHN;
1031
1032     tHID_HOST_DEV_CTB *p_dev = &hh_cb.devices[dhandle];
1033
1034     if( p_dev->conn.conn_state != HID_CONN_STATE_UNUSED )
1035         return( HID_ERR_CONN_IN_PROCESS );
1036
1037     p_dev->conn.ctrl_cid = 0;
1038     p_dev->conn.intr_cid = 0;
1039     p_dev->conn.disc_reason = HID_L2CAP_CONN_FAIL;  /* Reset initial reason for CLOSE_EVT: Connection Attempt was made but failed */
1040
1041     /* We are the originator of this connection */
1042     p_dev->conn.conn_flags = HID_CONN_FLAGS_IS_ORIG;
1043
1044     if(p_dev->attr_mask & HID_SEC_REQUIRED)
1045     {
1046         service_id = BTM_SEC_SERVICE_HIDH_SEC_CTRL;
1047         mx_chan_id = HID_SEC_CHN;
1048     }
1049     BTM_SetOutService (p_dev->addr, service_id, mx_chan_id);
1050
1051     /* Check if L2CAP started the connection process */
1052     if ((p_dev->conn.ctrl_cid = L2CA_ConnectReq (HID_PSM_CONTROL, p_dev->addr)) == 0)
1053     {
1054         HIDH_TRACE_WARNING ("HID-Host Originate failed");
1055         hh_cb.callback( dhandle,  hh_cb.devices[dhandle].addr, HID_HDEV_EVT_CLOSE,
1056                                 HID_ERR_L2CAP_FAILED, NULL ) ;
1057     }
1058     else
1059     {
1060         /* Transition to the next appropriate state, waiting for connection confirm on control channel. */
1061         p_dev->conn.conn_state = HID_CONN_STATE_CONNECTING_CTRL;
1062     }
1063
1064     return( HID_SUCCESS );
1065 }
1066
1067
1068 /*******************************************************************************
1069 **
1070 ** Function         find_conn_by_cid
1071 **
1072 ** Description      This function finds a connection control block based on CID
1073 **
1074 ** Returns          address of control block, or NULL if not found
1075 **
1076 *******************************************************************************/
1077 static UINT8 find_conn_by_cid (UINT16 cid)
1078 {
1079     UINT8      xx;
1080
1081     for (xx = 0; xx < HID_HOST_MAX_DEVICES; xx++)
1082     {
1083         if ((hh_cb.devices[xx].in_use) && (hh_cb.devices[xx].conn.conn_state != HID_CONN_STATE_UNUSED)
1084             && ((hh_cb.devices[xx].conn.ctrl_cid == cid) || (hh_cb.devices[xx].conn.intr_cid == cid)))
1085             break;
1086     }
1087
1088     return (xx);
1089 }
1090
1091 void hidh_conn_dereg( void )
1092 {
1093     L2CA_Deregister (HID_PSM_CONTROL);
1094     L2CA_Deregister (HID_PSM_INTERRUPT);
1095 }
1096
1097 /*******************************************************************************
1098 **
1099 ** Function         hidh_conn_retry
1100 **
1101 ** Description      This function is called to retry a failed connection.
1102 **
1103 ** Returns          void
1104 **
1105 *******************************************************************************/
1106 static void hidh_conn_retry(  UINT8 dhandle )
1107 {
1108     tHID_HOST_DEV_CTB *p_dev = &hh_cb.devices[dhandle];
1109
1110     p_dev->conn.conn_state = HID_CONN_STATE_UNUSED;
1111 #if (HID_HOST_REPAGE_WIN > 0)
1112     period_ms_t interval_ms = HID_HOST_REPAGE_WIN * 1000;
1113     alarm_set_on_queue(p_dev->conn.process_repage_timer,
1114                        interval_ms, hidh_process_repage_timer_timeout,
1115                        UINT_TO_PTR(dhandle), btu_general_alarm_queue);
1116 #else
1117     hidh_process_repage_process(dhandle);
1118 #endif
1119 }