1/******************************************************************************
2 *
3 *  Copyright (C) 2000-2012 Broadcom Corporation
4 *
5 *  Licensed under the Apache License, Version 2.0 (the "License");
6 *  you may not use this file except in compliance with the License.
7 *  You may obtain a copy of the License at:
8 *
9 *  http://www.apache.org/licenses/LICENSE-2.0
10 *
11 *  Unless required by applicable law or agreed to in writing, software
12 *  distributed under the License is distributed on an "AS IS" BASIS,
13 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 *  See the License for the specific language governing permissions and
15 *  limitations under the License.
16 *
17 ******************************************************************************/
18
19/******************************************************************************
20 *
21 *  This file contains functions that handle ACL connections. This includes
22 *  operations such as hold and sniff modes, supported packet types.
23 *
24 ******************************************************************************/
25
26#include <stdlib.h>
27#include <string.h>
28#include <stdio.h>
29#include <stddef.h>
30
31#include "bt_types.h"
32#include "bt_target.h"
33#include "gki.h"
34#include "hcimsgs.h"
35#include "btu.h"
36#include "btm_api.h"
37#include "btm_int.h"
38#include "l2c_int.h"
39#include "hcidefs.h"
40static void btm_establish_continue (tACL_CONN *p_acl_cb);
41
42#define BTM_DEV_REPLY_TIMEOUT   3       /* 3 second timeout waiting for responses */
43
44/*******************************************************************************
45**
46** Function         btm_acl_init
47**
48** Description      This function is called at BTM startup to initialize
49**
50** Returns          void
51**
52*******************************************************************************/
53void btm_acl_init (void)
54{
55    BTM_TRACE_DEBUG0 ("btm_acl_init");
56#if 0  /* cleared in btm_init; put back in if called from anywhere else! */
57    memset (&btm_cb.acl_db, 0, sizeof (btm_cb.acl_db));
58#if RFCOMM_INCLUDED == TRUE
59    memset (btm_cb.btm_scn, 0, BTM_MAX_SCN);          /* Initialize the SCN usage to FALSE */
60#endif
61    btm_cb.btm_def_link_policy     = 0;
62#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
63    btm_cb.p_bl_changed_cb         = NULL;
64#else
65    btm_cb.p_acl_changed_cb        = NULL;
66#endif
67#endif
68
69    /* Initialize nonzero defaults */
70    btm_cb.btm_def_link_super_tout = HCI_DEFAULT_INACT_TOUT;
71    btm_cb.acl_disc_reason         = 0xff ;
72}
73
74/*******************************************************************************
75**
76** Function         btm_bda_to_acl
77**
78** Description      This function returns the FIRST acl_db entry for the passed BDA.
79**
80** Returns          Returns pointer to the ACL DB for the requested BDA if found.
81**                  NULL if not found.
82**
83*******************************************************************************/
84tACL_CONN *btm_bda_to_acl (BD_ADDR bda)
85{
86    tACL_CONN   *p = &btm_cb.acl_db[0];
87    UINT16       xx;
88    if (bda)
89    {
90        for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
91        {
92            if ((p->in_use) && (!memcmp (p->remote_addr, bda, BD_ADDR_LEN)))
93            {
94                BTM_TRACE_DEBUG0 ("btm_bda_to_acl found");
95                return(p);
96            }
97        }
98    }
99    BTM_TRACE_DEBUG0 ("btm_bda_to_acl Not found");
100
101    /* If here, no BD Addr found */
102    return((tACL_CONN *)NULL);
103}
104
105/*******************************************************************************
106**
107** Function         btm_handle_to_acl_index
108**
109** Description      This function returns the FIRST acl_db entry for the passed hci_handle.
110**
111** Returns          index to the acl_db or MAX_L2CAP_LINKS.
112**
113*******************************************************************************/
114UINT8 btm_handle_to_acl_index (UINT16 hci_handle)
115{
116    tACL_CONN   *p = &btm_cb.acl_db[0];
117    UINT8       xx;
118    BTM_TRACE_DEBUG0 ("btm_handle_to_acl_index");
119    for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
120    {
121        if ((p->in_use) && (p->hci_handle == hci_handle))
122        {
123            break;
124        }
125    }
126
127    /* If here, no BD Addr found */
128    return(xx);
129}
130
131
132/*******************************************************************************
133**
134** Function         btm_acl_created
135**
136** Description      This function is called by L2CAP when an ACL connection
137**                  is created.
138**
139** Returns          void
140**
141*******************************************************************************/
142void btm_acl_created (BD_ADDR bda, DEV_CLASS dc, BD_NAME bdn,
143                      UINT16 hci_handle, UINT8 link_role, UINT8 is_le_link)
144{
145    tBTM_SEC_DEV_REC *p_dev_rec;
146    UINT8             yy;
147    tACL_CONN        *p;
148    UINT8             xx;
149
150    BTM_TRACE_DEBUG3 ("btm_acl_created hci_handle=%d link_role=%d  is_le_link=%d",
151                      hci_handle,link_role, is_le_link);
152    /* Ensure we don't have duplicates */
153    p = btm_bda_to_acl(bda);
154    if (p != (tACL_CONN *)NULL)
155    {
156        p->hci_handle = hci_handle;
157        p->link_role  = link_role;
158#if BLE_INCLUDED == TRUE
159        p->is_le_link = is_le_link;
160#endif
161        BTM_TRACE_DEBUG6 ("Duplicate btm_acl_created: RemBdAddr: %02x%02x%02x%02x%02x%02x",
162                          bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
163        BTM_SetLinkPolicy(p->remote_addr, &btm_cb.btm_def_link_policy);
164        return;
165    }
166
167    /* Allocate acl_db entry */
168    for (xx = 0, p = &btm_cb.acl_db[0]; xx < MAX_L2CAP_LINKS; xx++, p++)
169    {
170        if (!p->in_use)
171        {
172            p->in_use            = TRUE;
173            p->hci_handle        = hci_handle;
174            p->link_role         = link_role;
175            p->link_up_issued    = FALSE;
176#if BLE_INCLUDED == TRUE
177            p->is_le_link        = is_le_link;
178#endif
179            p->restore_pkt_types = 0;   /* Only exists while SCO is active */
180            p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
181
182#if BTM_PWR_MGR_INCLUDED == FALSE
183            p->mode             = BTM_ACL_MODE_NORMAL;
184#else
185            btm_pm_sm_alloc(xx);
186#endif /* BTM_PWR_MGR_INCLUDED == FALSE */
187
188            memcpy (p->remote_addr, bda, BD_ADDR_LEN);
189
190            if (dc)
191                memcpy (p->remote_dc, dc, DEV_CLASS_LEN);
192
193            if (bdn)
194                memcpy (p->remote_name, bdn, BTM_MAX_REM_BD_NAME_LEN);
195
196
197            /* Check if we already know features for this device */
198            p_dev_rec = btm_find_dev_by_handle (hci_handle);
199
200#if (BLE_INCLUDED == TRUE)
201            if (p_dev_rec )
202            {
203                BTM_TRACE_DEBUG1 ("device_type=0x%x", p_dev_rec->device_type);
204            }
205#endif
206
207
208            if (p_dev_rec
209#if (BLE_INCLUDED == TRUE)
210                && p_dev_rec->device_type != BT_DEVICE_TYPE_BLE
211#endif
212               )
213            {
214
215                /* if BR/EDR do something more */
216                btsnd_hcic_read_rmt_clk_offset (p->hci_handle);
217                btsnd_hcic_rmt_ver_req (p->hci_handle);
218
219                for (yy = 0; yy < BD_FEATURES_LEN; yy++)
220                {
221                    if (p_dev_rec->features[yy])
222                    {
223                        memcpy (p->features, p_dev_rec->features, BD_FEATURES_LEN);
224                        if (BTM_SEC_MODE_SP == btm_cb.security_mode &&
225                            HCI_SIMPLE_PAIRING_SUPPORTED(p->features))
226                        {
227                            /* if SM4 supported, check peer support for SM4
228                             * The remote controller supports SSP according to saved remote features
229                             * read the extended feature page 1 for the host support for SSP */
230                            if (btsnd_hcic_rmt_ext_features (p_dev_rec->hci_handle, 1))
231                                return;
232                        }
233                        /* peer does not support SSP */
234                        p_dev_rec->sm4 |= BTM_SM4_KNOWN;
235
236                        btm_establish_continue (p);
237                        return;
238                    }
239                }
240            }
241#if (BLE_INCLUDED == TRUE)
242            /* If here, features are not known yet */
243            if (p_dev_rec && p_dev_rec->device_type == BT_DEVICE_TYPE_BLE)
244            {
245                btm_establish_continue(p);
246
247                if (link_role == HCI_ROLE_MASTER)
248                {
249                    btm_ble_update_bg_state();
250                    btm_ble_resume_bg_conn (NULL, FALSE);
251
252                    btsnd_hcic_ble_read_remote_feat(p->hci_handle);
253                }
254            }
255            else
256#endif
257            {
258                btsnd_hcic_rmt_features_req (p->hci_handle);
259            }
260
261            /* read page 1 - on rmt feature event for buffer reasons */
262            return;
263        }
264    }
265}
266
267
268/*******************************************************************************
269**
270** Function         btm_acl_report_role_change
271**
272** Description      This function is called when the local device is deemed
273**                  to be down. It notifies L2CAP of the failure.
274**
275** Returns          void
276**
277*******************************************************************************/
278void btm_acl_report_role_change (UINT8 hci_status, BD_ADDR bda)
279{
280    tBTM_ROLE_SWITCH_CMPL   ref_data;
281    BTM_TRACE_DEBUG0 ("btm_acl_report_role_change");
282    if (btm_cb.devcb.p_switch_role_cb && (bda &&
283                                          (0 == memcmp(btm_cb.devcb.switch_role_ref_data.remote_bd_addr, bda, BD_ADDR_LEN))))
284    {
285        memset (&btm_cb.devcb.switch_role_ref_data, 0, sizeof(tBTM_ROLE_SWITCH_CMPL));
286        ref_data.hci_status = hci_status;
287        memcpy (&ref_data, &btm_cb.devcb.switch_role_ref_data, sizeof(tBTM_ROLE_SWITCH_CMPL));
288        (*btm_cb.devcb.p_switch_role_cb)(&ref_data);
289        btm_cb.devcb.p_switch_role_cb = NULL;
290    }
291}
292
293/*******************************************************************************
294**
295** Function         btm_acl_removed
296**
297** Description      This function is called by L2CAP when an ACL connection
298**                  is removed. Since only L2CAP creates ACL links, we use
299**                  the L2CAP link index as our index into the control blocks.
300**
301** Returns          void
302**
303*******************************************************************************/
304void btm_acl_removed (BD_ADDR bda)
305{
306    tACL_CONN   *p;
307#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
308    tBTM_BL_EVENT_DATA  evt_data;
309#endif
310#if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
311    tBTM_SEC_DEV_REC *p_dev_rec=NULL;
312    UINT16 combined_mode;
313#endif
314
315    BTM_TRACE_DEBUG0 ("btm_acl_removed");
316    p = btm_bda_to_acl(bda);
317    if (p != (tACL_CONN *)NULL)
318    {
319        p->in_use = FALSE;
320
321        /* if the disconnected channel has a pending role switch, clear it now */
322        btm_acl_report_role_change(HCI_ERR_NO_CONNECTION, bda);
323
324        /* Only notify if link up has had a chance to be issued */
325        if (p->link_up_issued)
326        {
327            p->link_up_issued = FALSE;
328
329            /* If anyone cares, tell him database changed */
330#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
331            if (btm_cb.p_bl_changed_cb)
332            {
333                evt_data.event = BTM_BL_DISCN_EVT;
334                evt_data.discn.p_bda = bda;
335
336                (*btm_cb.p_bl_changed_cb)(&evt_data);
337            }
338
339            btm_acl_update_busy_level (BTM_BLI_ACL_DOWN_EVT);
340#else
341            if (btm_cb.p_acl_changed_cb)
342                (*btm_cb.p_acl_changed_cb) (bda, NULL, NULL, NULL, FALSE);
343#endif
344        }
345
346#if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
347
348        BTM_TRACE_DEBUG4 ("acl hci_handle=%d is_le_link=%d connectable_mode=0x%0x link_role=%d",
349                          p->hci_handle,
350                          p->is_le_link,
351                          btm_cb.ble_ctr_cb.inq_var.connectable_mode,
352                          p->link_role);
353
354
355        /* If we are LE connectable, check if we need to start advertising again */
356        if ( p->is_le_link && (btm_cb.ble_ctr_cb.inq_var.connectable_mode != BTM_BLE_NON_CONNECTABLE) )
357        {
358            tACL_CONN   *pa = &btm_cb.acl_db[0];
359            UINT16       xx;
360
361            for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, pa++)
362            {
363                /* If any other LE link is up, we are still not connectable */
364                if (pa->in_use && pa->is_le_link)
365                    return;
366            }
367            combined_mode = (btm_cb.ble_ctr_cb.inq_var.connectable_mode | btm_cb.btm_inq_vars.connectable_mode);
368            btm_ble_set_connectability ( combined_mode );
369        }
370
371        p_dev_rec = btm_find_dev(bda);
372        if ( p_dev_rec)
373        {
374            BTM_TRACE_DEBUG1("before update p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
375            if (p->is_le_link)
376            {
377                BTM_TRACE_DEBUG0("LE link down");
378                p_dev_rec->sec_flags &= ~(BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
379                if ( (p_dev_rec->sec_flags & BTM_SEC_LINK_KEY_KNOWN) == 0)
380                {
381                    BTM_TRACE_DEBUG0("Not Bonded");
382                    p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHENTICATED | BTM_SEC_LINK_KEY_AUTHED);
383                }
384                else
385                {
386                    BTM_TRACE_DEBUG0("Bonded");
387                }
388            }
389            else
390            {
391                BTM_TRACE_DEBUG0("Bletooth link down");
392                p_dev_rec->sec_flags &= ~(BTM_SEC_AUTHORIZED | BTM_SEC_AUTHENTICATED | BTM_SEC_ENCRYPTED | BTM_SEC_ROLE_SWITCHED);
393            }
394            BTM_TRACE_DEBUG1("after update p_dev_rec->sec_flags=0x%x", p_dev_rec->sec_flags);
395        }
396        else
397        {
398            BTM_TRACE_ERROR0("Device not found");
399
400        }
401#endif
402
403        return;
404    }
405}
406
407
408/*******************************************************************************
409**
410** Function         btm_acl_device_down
411**
412** Description      This function is called when the local device is deemed
413**                  to be down. It notifies L2CAP of the failure.
414**
415** Returns          void
416**
417*******************************************************************************/
418void btm_acl_device_down (void)
419{
420    tACL_CONN   *p = &btm_cb.acl_db[0];
421    UINT16      xx;
422    BTM_TRACE_DEBUG0 ("btm_acl_device_down");
423    for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
424    {
425        if (p->in_use)
426        {
427            BTM_TRACE_DEBUG1 ("hci_handle=%d HCI_ERR_HW_FAILURE ",p->hci_handle );
428            l2c_link_hci_disc_comp (p->hci_handle, HCI_ERR_HW_FAILURE);
429        }
430    }
431}
432
433#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
434/*******************************************************************************
435**
436** Function         btm_acl_update_busy_level
437**
438** Description      This function is called to update the busy level of the system
439**                  .
440**
441** Returns          void
442**
443*******************************************************************************/
444void btm_acl_update_busy_level (tBTM_BLI_EVENT event)
445{
446    tBTM_BL_UPDATE_DATA  evt;
447    UINT8 busy_level;
448    BTM_TRACE_DEBUG0 ("btm_acl_update_busy_level");
449    switch (event)
450    {
451        case BTM_BLI_ACL_UP_EVT:
452            BTM_TRACE_DEBUG0 ("BTM_BLI_ACL_UP_EVT");
453            btm_cb.num_acl++;
454            busy_level = (UINT8)btm_cb.num_acl;
455            break;
456        case BTM_BLI_ACL_DOWN_EVT:
457            if (btm_cb.num_acl)
458            {
459                btm_cb.num_acl--;
460                BTM_TRACE_DEBUG1 ("BTM_BLI_ACL_DOWN_EVT", btm_cb.num_acl);
461            }
462            else
463            {
464                BTM_TRACE_ERROR0 ("BTM_BLI_ACL_DOWN_EVT issued, but num_acl already zero !!!");
465            }
466            busy_level = (UINT8)btm_cb.num_acl;
467            break;
468        case BTM_BLI_PAGE_EVT:
469            BTM_TRACE_DEBUG0 ("BTM_BLI_PAGE_EVT");
470            btm_cb.is_paging = TRUE;
471            busy_level = BTM_BL_PAGING_STARTED;
472            break;
473        case BTM_BLI_PAGE_DONE_EVT:
474            BTM_TRACE_DEBUG0 ("BTM_BLI_PAGE_DONE_EVT");
475            btm_cb.is_paging = FALSE;
476            busy_level = BTM_BL_PAGING_COMPLETE;
477            break;
478        case BTM_BLI_INQ_EVT:
479            BTM_TRACE_DEBUG0 ("BTM_BLI_INQ_EVT");
480            btm_cb.is_inquiry = TRUE;
481            busy_level = BTM_BL_INQUIRY_STARTED;
482            break;
483        case BTM_BLI_INQ_CANCEL_EVT:
484            BTM_TRACE_DEBUG0 ("BTM_BLI_INQ_CANCEL_EVT");
485            btm_cb.is_inquiry = FALSE;
486            busy_level = BTM_BL_INQUIRY_CANCELLED;
487            break;
488        case BTM_BLI_INQ_DONE_EVT:
489            BTM_TRACE_DEBUG0 ("BTM_BLI_INQ_DONE_EVT");
490            btm_cb.is_inquiry = FALSE;
491            busy_level = BTM_BL_INQUIRY_COMPLETE;
492            break;
493    }
494
495    if (busy_level != btm_cb.busy_level)
496    {
497        evt.event         = BTM_BL_UPDATE_EVT;
498        evt.busy_level    = busy_level;
499        btm_cb.busy_level = busy_level;
500        if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_UPDATE_MASK))
501        {
502            (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
503        }
504    }
505}
506#endif
507
508
509/*******************************************************************************
510**
511** Function         BTM_GetRole
512**
513** Description      This function is called to get the role of the local device
514**                  for the ACL connection with the specified remote device
515**
516** Returns          BTM_SUCCESS if connection exists.
517**                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
518**
519*******************************************************************************/
520tBTM_STATUS BTM_GetRole (BD_ADDR remote_bd_addr, UINT8 *p_role)
521{
522    tACL_CONN   *p;
523    BTM_TRACE_DEBUG0 ("BTM_GetRole");
524    if ((p = btm_bda_to_acl(remote_bd_addr)) == NULL)
525    {
526        *p_role = BTM_ROLE_UNDEFINED;
527        return(BTM_UNKNOWN_ADDR);
528    }
529
530    /* Get the current role */
531    *p_role = p->link_role;
532    return(BTM_SUCCESS);
533}
534
535
536/*******************************************************************************
537**
538** Function         BTM_SwitchRole
539**
540** Description      This function is called to switch role between master and
541**                  slave.  If role is already set it will do nothing.  If the
542**                  command was initiated, the callback function is called upon
543**                  completion.
544**
545** Returns          BTM_SUCCESS if already in specified role.
546**                  BTM_CMD_STARTED if command issued to controller.
547**                  BTM_NO_RESOURCES if couldn't allocate memory to issue command
548**                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
549**                  BTM_MODE_UNSUPPORTED if local device does not support role switching
550**                  BTM_BUSY if the previous command is not completed
551**
552*******************************************************************************/
553tBTM_STATUS BTM_SwitchRole (BD_ADDR remote_bd_addr, UINT8 new_role, tBTM_CMPL_CB *p_cb)
554{
555    tACL_CONN   *p;
556    tBTM_SEC_DEV_REC  *p_dev_rec = NULL;
557#if BTM_SCO_INCLUDED == TRUE
558    BOOLEAN    is_sco_active;
559#endif
560#if BTM_PWR_MGR_INCLUDED == TRUE
561    tBTM_STATUS  status;
562    tBTM_PM_MODE pwr_mode;
563    tBTM_PM_PWR_MD settings;
564#endif
565#if (BT_USE_TRACES == TRUE)
566    BD_ADDR_PTR  p_bda;
567#endif
568    BTM_TRACE_API6 ("BTM_SwitchRole BDA: %02x-%02x-%02x-%02x-%02x-%02x",
569                    remote_bd_addr[0], remote_bd_addr[1], remote_bd_addr[2],
570                    remote_bd_addr[3], remote_bd_addr[4], remote_bd_addr[5]);
571
572    /* Make sure the local device supports switching */
573    if (!(HCI_SWITCH_SUPPORTED(btm_cb.devcb.local_features)))
574        return(BTM_MODE_UNSUPPORTED);
575
576    if (btm_cb.devcb.p_switch_role_cb && p_cb)
577    {
578#if (BT_USE_TRACES == TRUE)
579        p_bda = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
580        BTM_TRACE_DEBUG6 ("Role switch on other device is in progress 0x%02x%02x%02x%02x%02x%02x",
581                          p_bda[0], p_bda[1], p_bda[2],
582                          p_bda[3], p_bda[4], p_bda[5]);
583#endif
584        return(BTM_BUSY);
585    }
586
587    if ((p = btm_bda_to_acl(remote_bd_addr)) == NULL)
588        return(BTM_UNKNOWN_ADDR);
589
590    /* Finished if already in desired role */
591    if (p->link_role == new_role)
592        return(BTM_SUCCESS);
593
594#if BTM_SCO_INCLUDED == TRUE
595    /* Check if there is any SCO Active on this BD Address */
596    is_sco_active = btm_is_sco_active_by_bdaddr(remote_bd_addr);
597
598    if (is_sco_active == TRUE)
599        return(BTM_NO_RESOURCES);
600#endif
601
602    /* Ignore role switch request if the previous request was not completed */
603    if (p->switch_role_state != BTM_ACL_SWKEY_STATE_IDLE)
604    {
605        BTM_TRACE_DEBUG1 ("BTM_SwitchRole busy: %d",
606                          p->switch_role_state);
607        return(BTM_BUSY);
608    }
609
610    /* Cannot switch role while parked or sniffing */
611#if BTM_PWR_MGR_INCLUDED == FALSE
612    if (p->mode == HCI_MODE_PARK)
613    {
614        if (!btsnd_hcic_exit_park_mode (p->hci_handle))
615            return(BTM_NO_RESOURCES);
616
617        p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
618    }
619    else if (p->mode == HCI_MODE_SNIFF)
620    {
621        if (!btsnd_hcic_exit_sniff_mode (p->hci_handle))
622            return(BTM_NO_RESOURCES);
623
624        p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
625    }
626#else   /* power manager is in use */
627
628    if ((status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode)) != BTM_SUCCESS)
629        return(status);
630
631    /* Wake up the link if in sniff or park before attempting switch */
632    if (pwr_mode == BTM_PM_MD_PARK || pwr_mode == BTM_PM_MD_SNIFF)
633    {
634/* Coverity FALSE-POSITIVE error from Coverity tool. Please do NOT remove following comment.     */
635/* coverity[uninit_use_in_call] False-positive: setting the mode to BTM_PM_MD_ACTIVE only uses settings.mode
636                                the other data members of tBTM_PM_PWR_MD are ignored
637*/
638        settings.mode = BTM_PM_MD_ACTIVE;
639        status = BTM_SetPowerMode (BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
640        if (status != BTM_CMD_STARTED)
641            return(BTM_WRONG_MODE);
642
643        p->switch_role_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
644    }
645#endif
646    /* some devices do not support switch while encryption is on */
647    else
648    {
649        if (((p_dev_rec = btm_find_dev (remote_bd_addr)) != NULL)
650            && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0)
651            && !BTM_EPR_AVAILABLE(p))
652        {
653            /* bypass turning off encryption if change link key is already doing it */
654            if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF)
655            {
656                if (!btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
657                    return(BTM_NO_RESOURCES);
658                else
659                    p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
660            }
661
662            p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
663        }
664        else
665        {
666            if (!btsnd_hcic_switch_role (remote_bd_addr, new_role))
667                return(BTM_NO_RESOURCES);
668
669            p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
670
671#if BTM_DISC_DURING_RS == TRUE
672            if (p_dev_rec)
673                p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
674#endif
675        }
676    }
677
678    /* Initialize return structure in case request fails */
679    if (p_cb)
680    {
681        memcpy (btm_cb.devcb.switch_role_ref_data.remote_bd_addr, remote_bd_addr,
682                BD_ADDR_LEN);
683        btm_cb.devcb.switch_role_ref_data.role = new_role;
684        /* initialized to an error code */
685        btm_cb.devcb.switch_role_ref_data.hci_status = HCI_ERR_UNSUPPORTED_VALUE;
686        btm_cb.devcb.p_switch_role_cb = p_cb;
687    }
688    return(BTM_CMD_STARTED);
689}
690
691/*******************************************************************************
692**
693** Function         BTM_ChangeLinkKey
694**
695** Description      This function is called to change the link key of the
696**                  connection.
697**
698** Returns          BTM_CMD_STARTED if command issued to controller.
699**                  BTM_NO_RESOURCES if couldn't allocate memory to issue command
700**                  BTM_UNKNOWN_ADDR if no active link with bd addr specified
701**                  BTM_BUSY if the previous command is not completed
702**
703*******************************************************************************/
704tBTM_STATUS BTM_ChangeLinkKey (BD_ADDR remote_bd_addr, tBTM_CMPL_CB *p_cb)
705{
706    tACL_CONN   *p;
707    tBTM_SEC_DEV_REC  *p_dev_rec = NULL;
708#if BTM_PWR_MGR_INCLUDED == TRUE
709    tBTM_STATUS  status;
710    tBTM_PM_MODE pwr_mode;
711    tBTM_PM_PWR_MD settings;
712#endif
713    BTM_TRACE_DEBUG0 ("BTM_ChangeLinkKey");
714    if ((p = btm_bda_to_acl(remote_bd_addr)) == NULL)
715        return(BTM_UNKNOWN_ADDR);
716
717    /* Ignore change link key request if the previsous request has not completed */
718    if (p->change_key_state != BTM_ACL_SWKEY_STATE_IDLE)
719    {
720        BTM_TRACE_DEBUG0 ("Link key change request declined since the previous request for this device has not completed ");
721        return(BTM_BUSY);
722    }
723
724    memset (&btm_cb.devcb.chg_link_key_ref_data, 0, sizeof(tBTM_CHANGE_KEY_CMPL));
725
726    /* Cannot change key while parked */
727#if BTM_PWR_MGR_INCLUDED == FALSE
728    if (p->mode == HCI_MODE_PARK)
729    {
730        if (!btsnd_hcic_exit_park_mode (p->hci_handle))
731            return(BTM_NO_RESOURCES);
732
733        p->change_key_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
734    }
735#else   /* power manager is in use */
736
737
738    if ((status = BTM_ReadPowerMode(p->remote_addr, &pwr_mode)) != BTM_SUCCESS)
739        return(status);
740
741    /* Wake up the link if in park before attempting to change link keys */
742    if (pwr_mode == BTM_PM_MD_PARK)
743    {
744/* Coverity: FALSE-POSITIVE error from Coverity tool. Please do NOT remove following comment. */
745/* coverity[uninit_use_in_call] False-positive: setting the mode to BTM_PM_MD_ACTIVE only uses settings.mode
746                                the other data members of tBTM_PM_PWR_MD are ignored
747*/
748        settings.mode = BTM_PM_MD_ACTIVE;
749        status = BTM_SetPowerMode (BTM_PM_SET_ONLY_ID, p->remote_addr, &settings);
750        if (status != BTM_CMD_STARTED)
751            return(BTM_WRONG_MODE);
752
753        p->change_key_state = BTM_ACL_SWKEY_STATE_MODE_CHANGE;
754    }
755#endif
756    /* some devices do not support change of link key while encryption is on */
757    else if (((p_dev_rec = btm_find_dev (remote_bd_addr)) != NULL)
758             && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0) && !BTM_EPR_AVAILABLE(p))
759    {
760        /* bypass turning off encryption if switch role is already doing it */
761        if (p->encrypt_state != BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF)
762        {
763            if (!btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
764                return(BTM_NO_RESOURCES);
765            else
766                p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
767        }
768
769        p->change_key_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
770    }
771    else    /* Ok to initiate change of link key */
772    {
773        if (!btsnd_hcic_change_link_key (p->hci_handle))
774            return(BTM_NO_RESOURCES);
775
776        p->change_key_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
777    }
778
779    /* Initialize return structure in case request fails */
780    memcpy (btm_cb.devcb.chg_link_key_ref_data.remote_bd_addr, remote_bd_addr,
781            BD_ADDR_LEN);
782    btm_cb.devcb.p_chg_link_key_cb = p_cb;
783    return(BTM_CMD_STARTED);
784}
785
786/*******************************************************************************
787**
788** Function         btm_acl_link_key_change
789**
790** Description      This function is called to when a change link key event
791**                  is received.
792**
793*******************************************************************************/
794void btm_acl_link_key_change (UINT16 handle, UINT8 status)
795{
796    tBTM_CHANGE_KEY_CMPL *p_data;
797    tACL_CONN            *p;
798    UINT8                xx;
799    BTM_TRACE_DEBUG0 ("btm_acl_link_key_change");
800    /* Look up the connection by handle and set the current mode */
801    xx = btm_handle_to_acl_index(handle);
802
803    /* don't assume that we can never get a bad hci_handle */
804    if (xx >= MAX_L2CAP_LINKS)
805        return;
806
807    p_data = &btm_cb.devcb.chg_link_key_ref_data;
808    p = &btm_cb.acl_db[xx];
809    p_data->hci_status = status;
810
811    /* if switching state is switching we need to turn encryption on */
812    /* if idle, we did not change encryption */
813    if (p->change_key_state == BTM_ACL_SWKEY_STATE_SWITCHING)
814    {
815        /* Make sure there's not also a role switch going on before re-enabling */
816        if (p->switch_role_state != BTM_ACL_SWKEY_STATE_SWITCHING)
817        {
818            if (btsnd_hcic_set_conn_encrypt (p->hci_handle, TRUE))
819            {
820                p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
821                p->change_key_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
822                return;
823            }
824        }
825        else    /* Set the state and wait for change link key */
826        {
827            p->change_key_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
828            return;
829        }
830    }
831
832    /* Set the switch_role_state to IDLE since the reply received from HCI */
833    /* regardless of its result either success or failed. */
834    if (p->change_key_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)
835    {
836        p->change_key_state = BTM_ACL_SWKEY_STATE_IDLE;
837        p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
838    }
839
840    if (btm_cb.devcb.p_chg_link_key_cb)
841    {
842        (*btm_cb.devcb.p_chg_link_key_cb)((void *)p_data);
843        btm_cb.devcb.p_chg_link_key_cb = NULL;
844    }
845
846    BTM_TRACE_ERROR2("Change Link Key Complete Event: Handle 0x%02x, HCI Status 0x%02x",
847                     handle, p_data->hci_status);
848}
849
850/*******************************************************************************
851**
852** Function         btm_acl_encrypt_change
853**
854** Description      This function is when encryption of the connection is
855**                  completed by the LM.  Checks to see if a role switch or
856**                  change of link key was active and initiates or continues
857**                  process if needed.
858**
859** Returns          void
860**
861*******************************************************************************/
862void btm_acl_encrypt_change (UINT16 handle, UINT8 status, UINT8 encr_enable)
863{
864    tACL_CONN *p;
865    UINT8     xx;
866#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
867    tBTM_BL_ROLE_CHG_DATA   evt;
868#endif
869#if BTM_DISC_DURING_RS == TRUE
870    tBTM_SEC_DEV_REC  *p_dev_rec;
871#endif
872    BTM_TRACE_DEBUG3 ("btm_acl_encrypt_change handle=%d status=%d encr_enabl=%d", handle, status, encr_enable);
873    xx = btm_handle_to_acl_index(handle);
874    /* don't assume that we can never get a bad hci_handle */
875    if (xx < MAX_L2CAP_LINKS)
876        p = &btm_cb.acl_db[xx];
877    else
878        return;
879
880    /* Process Role Switch if active */
881    if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF)
882    {
883        /* if encryption turn off failed we still will try to switch role */
884        if (encr_enable)
885        {
886            p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
887            p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
888        }
889        else
890        {
891            p->switch_role_state = BTM_ACL_SWKEY_STATE_SWITCHING;
892            p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
893        }
894
895        if (!btsnd_hcic_switch_role (p->remote_addr, (UINT8)!p->link_role))
896        {
897            p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
898            p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
899            btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status, p->remote_addr);
900        }
901#if BTM_DISC_DURING_RS == TRUE
902        else
903        {
904            if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL)
905                p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
906        }
907#endif
908
909    }
910    /* Finished enabling Encryption after role switch */
911    else if (p->switch_role_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON)
912    {
913        p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
914        p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
915        btm_acl_report_role_change(btm_cb.devcb.switch_role_ref_data.hci_status, p->remote_addr);
916
917#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
918        /* if role change event is registered, report it now */
919        if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK))
920        {
921            evt.event       = BTM_BL_ROLE_CHG_EVT;
922            evt.new_role    = btm_cb.devcb.switch_role_ref_data.role;
923            evt.p_bda       = btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
924            evt.hci_status  = btm_cb.devcb.switch_role_ref_data.hci_status;
925            (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
926
927            BTM_TRACE_DEBUG3("Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
928                             evt.new_role, evt.hci_status, p->switch_role_state);
929        }
930#endif
931
932#if BTM_DISC_DURING_RS == TRUE
933        /* If a disconnect is pending, issue it now that role switch has completed */
934        if ((p_dev_rec = btm_find_dev (p->remote_addr)) != NULL)
935        {
936            if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING)
937            {
938                BTM_TRACE_WARNING0("btm_acl_encrypt_change -> Issuing delayed HCI_Disconnect!!!");
939                btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
940            }
941            BTM_TRACE_ERROR2("btm_acl_encrypt_change: tBTM_SEC_DEV:0x%x rs_disc_pending=%d",
942                (UINT32)p_dev_rec, p_dev_rec->rs_disc_pending);
943            p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
944        }
945#endif
946    }
947
948
949    /* Process Change Link Key if active */
950    if (p->change_key_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF)
951    {
952        /* if encryption turn off failed we still will try to change link key */
953        if (encr_enable)
954        {
955            p->change_key_state = BTM_ACL_SWKEY_STATE_IDLE;
956            p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
957        }
958        else
959        {
960            p->encrypt_state = BTM_ACL_ENCRYPT_STATE_TEMP_FUNC;
961            p->change_key_state = BTM_ACL_SWKEY_STATE_SWITCHING;
962        }
963
964        if (!btsnd_hcic_change_link_key (p->hci_handle))
965        {
966            p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
967            p->change_key_state = BTM_ACL_SWKEY_STATE_IDLE;
968            if (btm_cb.devcb.p_chg_link_key_cb)
969            {
970                (*btm_cb.devcb.p_chg_link_key_cb)(&btm_cb.devcb.chg_link_key_ref_data);
971                btm_cb.devcb.p_chg_link_key_cb = NULL;
972            }
973        }
974    }
975    /* Finished enabling Encryption after changing link key */
976    else if (p->change_key_state == BTM_ACL_SWKEY_STATE_ENCRYPTION_ON)
977    {
978        p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
979        p->change_key_state = BTM_ACL_SWKEY_STATE_IDLE;
980        if (btm_cb.devcb.p_chg_link_key_cb)
981        {
982            (*btm_cb.devcb.p_chg_link_key_cb)(&btm_cb.devcb.chg_link_key_ref_data);
983            btm_cb.devcb.p_chg_link_key_cb = NULL;
984        }
985    }
986}
987/*******************************************************************************
988**
989** Function         BTM_SetLinkPolicy
990**
991** Description      Create and send HCI "Write Policy Set" command
992**
993** Returns          status of the operation
994**
995*******************************************************************************/
996tBTM_STATUS BTM_SetLinkPolicy (BD_ADDR remote_bda, UINT16 *settings)
997{
998    tACL_CONN   *p;
999    UINT8       *localFeatures = BTM_ReadLocalFeatures();
1000    BTM_TRACE_DEBUG0 ("BTM_SetLinkPolicy");
1001/*    BTM_TRACE_API1 ("BTM_SetLinkPolicy: requested settings: 0x%04x", *settings ); */
1002
1003    /* First, check if hold mode is supported */
1004    if (*settings != HCI_DISABLE_ALL_LM_MODES)
1005    {
1006        if ( (*settings & HCI_ENABLE_MASTER_SLAVE_SWITCH) && (!HCI_SWITCH_SUPPORTED(localFeatures)) )
1007        {
1008            *settings &= (~HCI_ENABLE_MASTER_SLAVE_SWITCH);
1009            BTM_TRACE_API1 ("BTM_SetLinkPolicy switch not supported (settings: 0x%04x)", *settings );
1010        }
1011        if ( (*settings & HCI_ENABLE_HOLD_MODE) && (!HCI_HOLD_MODE_SUPPORTED(localFeatures)) )
1012        {
1013            *settings &= (~HCI_ENABLE_HOLD_MODE);
1014            BTM_TRACE_API1 ("BTM_SetLinkPolicy hold not supported (settings: 0x%04x)", *settings );
1015        }
1016        if ( (*settings & HCI_ENABLE_SNIFF_MODE) && (!HCI_SNIFF_MODE_SUPPORTED(localFeatures)) )
1017        {
1018            *settings &= (~HCI_ENABLE_SNIFF_MODE);
1019            BTM_TRACE_API1 ("BTM_SetLinkPolicy sniff not supported (settings: 0x%04x)", *settings );
1020        }
1021        if ( (*settings & HCI_ENABLE_PARK_MODE) && (!HCI_PARK_MODE_SUPPORTED(localFeatures)) )
1022        {
1023            *settings &= (~HCI_ENABLE_PARK_MODE);
1024            BTM_TRACE_API1 ("BTM_SetLinkPolicy park not supported (settings: 0x%04x)", *settings );
1025        }
1026    }
1027
1028    if ((p = btm_bda_to_acl(remote_bda)) != NULL)
1029        return(btsnd_hcic_write_policy_set (p->hci_handle, *settings) ? BTM_CMD_STARTED : BTM_NO_RESOURCES);
1030
1031    /* If here, no BD Addr found */
1032    return(BTM_UNKNOWN_ADDR);
1033}
1034
1035/*******************************************************************************
1036**
1037** Function         BTM_SetDefaultLinkPolicy
1038**
1039** Description      Set the default value for HCI "Write Policy Set" command
1040**                  to use when an ACL link is created.
1041**
1042** Returns          void
1043**
1044*******************************************************************************/
1045void BTM_SetDefaultLinkPolicy (UINT16 settings)
1046{
1047    BTM_TRACE_DEBUG0 ("BTM_SetDefaultLinkPolicy");
1048    btm_cb.btm_def_link_policy = settings;
1049}
1050
1051
1052/*******************************************************************************
1053**
1054** Function         BTM_ReadLinkPolicy
1055**
1056** Description      This function is called to read the link policy settings.
1057**                  The address of link policy results are returned in the callback.
1058**                  (tBTM_LNK_POLICY_RESULTS)
1059**
1060** Returns          status of the operation
1061**
1062*******************************************************************************/
1063tBTM_STATUS BTM_ReadLinkPolicy (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
1064{
1065    tACL_CONN   *p;
1066
1067    BTM_TRACE_API6 ("BTM_ReadLinkPolicy: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1068                    remote_bda[0], remote_bda[1], remote_bda[2],
1069                    remote_bda[3], remote_bda[4], remote_bda[5]);
1070
1071    /* If someone already waiting on the version, do not allow another */
1072    if (btm_cb.devcb.p_rlinkp_cmpl_cb)
1073        return(BTM_BUSY);
1074
1075    p = btm_bda_to_acl(remote_bda);
1076    if (p != (tACL_CONN *)NULL)
1077    {
1078        btu_start_timer (&btm_cb.devcb.rlinkp_timer, BTU_TTYPE_BTM_ACL, BTM_DEV_REPLY_TIMEOUT);
1079        btm_cb.devcb.p_rlinkp_cmpl_cb = p_cb;
1080
1081        if (!btsnd_hcic_read_policy_set (p->hci_handle))
1082        {
1083            btu_stop_timer (&btm_cb.devcb.rlinkp_timer);
1084            btm_cb.devcb.p_rlinkp_cmpl_cb = NULL;
1085            return(BTM_NO_RESOURCES);
1086        }
1087
1088        return(BTM_CMD_STARTED);
1089    }
1090
1091    /* If here, no BD Addr found */
1092    return(BTM_UNKNOWN_ADDR);
1093}
1094
1095
1096/*******************************************************************************
1097**
1098** Function         btm_read_link_policy_complete
1099**
1100** Description      This function is called when the command complete message
1101**                  is received from the HCI for the read local link policy request.
1102**
1103** Returns          void
1104**
1105*******************************************************************************/
1106void btm_read_link_policy_complete (UINT8 *p)
1107{
1108    tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_rlinkp_cmpl_cb;
1109    tBTM_LNK_POLICY_RESULTS  lnkpol;
1110    UINT16                   handle;
1111    tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
1112    UINT16                   index;
1113    BTM_TRACE_DEBUG0 ("btm_read_link_policy_complete");
1114    btu_stop_timer (&btm_cb.devcb.rlinkp_timer);
1115
1116    /* If there was a callback address for read local version, call it */
1117    btm_cb.devcb.p_rlinkp_cmpl_cb = NULL;
1118
1119    if (p_cb)
1120    {
1121        STREAM_TO_UINT8  (lnkpol.hci_status, p);
1122
1123        if (lnkpol.hci_status == HCI_SUCCESS)
1124        {
1125            lnkpol.status = BTM_SUCCESS;
1126
1127            STREAM_TO_UINT16 (handle, p);
1128
1129            STREAM_TO_UINT16 (lnkpol.settings, p);
1130
1131            /* Search through the list of active channels for the correct BD Addr */
1132            for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
1133            {
1134                if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
1135                {
1136                    memcpy (lnkpol.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
1137                    break;
1138                }
1139            }
1140        }
1141        else
1142            lnkpol.status = BTM_ERR_PROCESSING;
1143
1144        (*p_cb)(&lnkpol);
1145    }
1146}
1147
1148
1149/*******************************************************************************
1150**
1151** Function         btm_read_remote_version_complete
1152**
1153** Description      This function is called when the command complete message
1154**                  is received from the HCI for the remote version info.
1155**
1156** Returns          void
1157**
1158*******************************************************************************/
1159void btm_read_remote_version_complete (UINT8 *p)
1160{
1161    tACL_CONN        *p_acl_cb = &btm_cb.acl_db[0];
1162    UINT8             status;
1163    UINT16            handle;
1164    int               xx;
1165    BTM_TRACE_DEBUG0 ("btm_read_remote_version_complete");
1166    STREAM_TO_UINT8  (status, p);
1167    if (status == HCI_SUCCESS)
1168    {
1169        STREAM_TO_UINT16 (handle, p);
1170
1171        /* Look up the connection by handle and copy features */
1172        for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++)
1173        {
1174            if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle))
1175            {
1176                STREAM_TO_UINT8  (p_acl_cb->lmp_version, p);
1177                STREAM_TO_UINT16 (p_acl_cb->manufacturer, p);
1178                STREAM_TO_UINT16 (p_acl_cb->lmp_subversion, p);
1179                break;
1180            }
1181        }
1182    }
1183}
1184
1185
1186/*******************************************************************************
1187**
1188** Function         btm_read_remote_features_complete
1189**
1190** Description      This function is called when the remote extended features
1191**                  complete event is received from the HCI.
1192**
1193** Returns          void
1194**
1195*******************************************************************************/
1196void btm_read_remote_features_complete (UINT8 *p)
1197{
1198    tACL_CONN        *p_acl_cb = &btm_cb.acl_db[0];
1199    UINT8             status;
1200    UINT16            handle;
1201    int               xx, yy;
1202    UINT8             req_pend;
1203    tBTM_SEC_DEV_REC *p_dev_rec;
1204    BTM_TRACE_DEBUG0 ("btm_read_remote_features_complete");
1205    STREAM_TO_UINT8  (status, p);
1206    if (status == HCI_SUCCESS)
1207    {
1208        STREAM_TO_UINT16 (handle, p);
1209
1210        /* Look up the connection by handle and copy features */
1211        for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++)
1212        {
1213            if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle))
1214            {
1215                for (yy = 0; yy < BD_FEATURES_LEN; yy++)
1216                    STREAM_TO_UINT8 (p_acl_cb->features[yy], p);
1217
1218                p_dev_rec = btm_find_dev_by_handle (handle);
1219                if (!p_dev_rec)
1220                {
1221                    /* Get a new device; might be doing dedicated bonding */
1222                    p_dev_rec = btm_find_or_alloc_dev (p_acl_cb->remote_addr);
1223                }
1224
1225                memcpy (p_dev_rec->features, p_acl_cb->features, BD_FEATURES_LEN);
1226
1227                if (BTM_SEC_MODE_SP == btm_cb.security_mode &&
1228                    HCI_SIMPLE_PAIRING_SUPPORTED(p_acl_cb->features))
1229                {
1230                    /* if SM4 supported, check peer support for SM4
1231                     * The remote controller supports SSP
1232                     * read the extended feature page 1 for the host support for SSP */
1233                    if (btsnd_hcic_rmt_ext_features (handle, 1))
1234                        break;
1235                }
1236                else
1237                {
1238                    req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
1239                    p_dev_rec->sm4 = BTM_SM4_KNOWN;
1240                    if (req_pend)
1241                    {
1242                        l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
1243                    }
1244                }
1245
1246                btm_establish_continue (p_acl_cb);
1247                break;
1248            }
1249        }
1250    }
1251}
1252
1253/*******************************************************************************
1254**
1255** Function         btm_read_remote_ext_features_complete
1256**
1257** Description      This function is called when the remote extended features
1258**                  complete event is received from the HCI.
1259**
1260** Returns          void
1261**
1262*******************************************************************************/
1263void btm_read_remote_ext_features_complete (UINT8 *p)
1264{
1265    tACL_CONN        *p_acl_cb = &btm_cb.acl_db[0];
1266    tBTM_SEC_DEV_REC *p_dev_rec;
1267    UINT8             status, page_num, max_page;
1268    UINT16            handle;
1269    int               xx;
1270    BD_FEATURES       ext_features;       /* extended Features suported by the device    */
1271    UINT8             req_pend;
1272    BTM_TRACE_DEBUG0 ("btm_read_remote_ext_features_complete");
1273    STREAM_TO_UINT8  (status, p);
1274    if (status == HCI_SUCCESS)
1275    {
1276        STREAM_TO_UINT16 (handle, p);
1277
1278        /* Look up the connection by handle and copy features */
1279        for (xx = 0; xx < MAX_L2CAP_LINKS; xx++, p_acl_cb++)
1280        {
1281            if ((p_acl_cb->in_use) && (p_acl_cb->hci_handle == handle))
1282            {
1283                STREAM_TO_UINT8  (page_num, p);
1284                STREAM_TO_UINT8  (max_page, p);
1285                p_dev_rec = btm_find_dev_by_handle (handle);
1286                if (!p_dev_rec)
1287                    p_dev_rec = btm_find_or_alloc_dev (p_acl_cb->remote_addr);
1288
1289                req_pend = (p_dev_rec->sm4 & BTM_SM4_REQ_PEND);
1290
1291                if (page_num == 1 && max_page >= 1)
1292                {
1293                    /* only the byte 0 of page 1 is used right now */
1294                    STREAM_TO_UINT8 (ext_features[0], p);
1295
1296                    if (HCI_SSP_HOST_SUPPORTED(ext_features))
1297                    {
1298                        p_dev_rec->sm4 = BTM_SM4_TRUE;
1299                    }
1300                }
1301
1302                BTM_TRACE_API5 ("ext_features_complt page_num:%d max_page:%d f[0]:x%02x, sm4:%x, pend:%d",
1303                                page_num, max_page, *p, p_dev_rec->sm4, req_pend);
1304
1305                if (!BTM_SEC_IS_SM4(p_dev_rec->sm4))
1306                {
1307                    p_dev_rec->sm4 = BTM_SM4_KNOWN;
1308                }
1309
1310                if (req_pend)
1311                    l2cu_resubmit_pending_sec_req (p_dev_rec->bd_addr);
1312
1313                btm_establish_continue (p_acl_cb);
1314
1315                break;
1316            }
1317        }
1318    }
1319}
1320
1321/*******************************************************************************
1322**
1323** Function         btm_read_remote_ext_features_failed
1324**
1325** Description      This function is called when the remote extended features
1326**                  complete event returns a failed status.
1327**
1328** Returns          void
1329**
1330*******************************************************************************/
1331void btm_read_remote_ext_features_failed (UINT8 status)
1332{
1333    BTM_TRACE_ERROR1 ("btm_read_remote_ext_features_failed (status 0x%02x)", status);
1334}
1335
1336/*******************************************************************************
1337**
1338** Function         btm_establish_continue
1339**
1340** Description      This function is called when the command complete message
1341**                  is received from the HCI for the read local link policy request.
1342**
1343** Returns          void
1344**
1345*******************************************************************************/
1346static void btm_establish_continue (tACL_CONN *p_acl_cb)
1347{
1348#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
1349    tBTM_BL_EVENT_DATA  evt_data;
1350#endif
1351    BTM_TRACE_DEBUG0 ("btm_establish_continue");
1352#if (!defined(BTM_BYPASS_EXTRA_ACL_SETUP) || BTM_BYPASS_EXTRA_ACL_SETUP == FALSE)
1353#if (defined BLE_INCLUDED && BLE_INCLUDED == TRUE)
1354    if (!p_acl_cb->is_le_link)
1355#endif
1356    {
1357        /* For now there are a some devices that do not like sending */
1358        /* commands events and data at the same time. */
1359        /* Set the packet types to the default allowed by the device */
1360        btm_set_packet_types (p_acl_cb, btm_cb.btm_acl_pkt_types_supported);
1361
1362        if (btm_cb.btm_def_link_policy)
1363            BTM_SetLinkPolicy (p_acl_cb->remote_addr, &btm_cb.btm_def_link_policy);
1364
1365        BTM_SetLinkSuperTout (p_acl_cb->remote_addr, btm_cb.btm_def_link_super_tout);
1366    }
1367#endif
1368    p_acl_cb->link_up_issued = TRUE;
1369
1370    /* If anyone cares, tell him database changed */
1371#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
1372    if (btm_cb.p_bl_changed_cb)
1373    {
1374        evt_data.event = BTM_BL_CONN_EVT;
1375        evt_data.conn.p_bda = p_acl_cb->remote_addr;
1376        evt_data.conn.p_bdn = p_acl_cb->remote_name;
1377        evt_data.conn.p_dc  = p_acl_cb->remote_dc;
1378        evt_data.conn.p_features = p_acl_cb->features;
1379
1380
1381        (*btm_cb.p_bl_changed_cb)(&evt_data);
1382    }
1383    btm_acl_update_busy_level (BTM_BLI_ACL_UP_EVT);
1384#else
1385    if (btm_cb.p_acl_changed_cb)
1386        (*btm_cb.p_acl_changed_cb) (p_acl_cb->remote_addr,
1387                                    p_acl_cb->remote_dc,
1388                                    p_acl_cb->remote_name,
1389                                    p_acl_cb->features,
1390                                    TRUE);
1391#endif
1392}
1393
1394
1395/*******************************************************************************
1396**
1397** Function         BTM_SetDefaultLinkSuperTout
1398**
1399** Description      Set the default value for HCI "Write Link Supervision Timeout"
1400**                  command to use when an ACL link is created.
1401**
1402** Returns          void
1403**
1404*******************************************************************************/
1405void BTM_SetDefaultLinkSuperTout (UINT16 timeout)
1406{
1407    BTM_TRACE_DEBUG0 ("BTM_SetDefaultLinkSuperTout");
1408    btm_cb.btm_def_link_super_tout = timeout;
1409}
1410
1411/*******************************************************************************
1412**
1413** Function         BTM_SetLinkSuperTout
1414**
1415** Description      Create and send HCI "Write Link Supervision Timeout" command
1416**
1417** Returns          status of the operation
1418**
1419*******************************************************************************/
1420tBTM_STATUS BTM_SetLinkSuperTout (BD_ADDR remote_bda, UINT16 timeout)
1421{
1422    tACL_CONN   *p = btm_bda_to_acl(remote_bda);
1423
1424    BTM_TRACE_DEBUG0 ("BTM_SetLinkSuperTout");
1425    if (p != (tACL_CONN *)NULL)
1426    {
1427        p->link_super_tout = timeout;
1428
1429        /* Only send if current role is Master; 2.0 spec requires this */
1430        if (p->link_role == BTM_ROLE_MASTER)
1431        {
1432            if (!btsnd_hcic_write_link_super_tout (LOCAL_BR_EDR_CONTROLLER_ID,
1433                                                   p->hci_handle, timeout))
1434                return(BTM_NO_RESOURCES);
1435
1436            return(BTM_CMD_STARTED);
1437        }
1438        else
1439            return(BTM_SUCCESS);
1440    }
1441
1442    /* If here, no BD Addr found */
1443    return(BTM_UNKNOWN_ADDR);
1444}
1445
1446/*******************************************************************************
1447**
1448** Function         BTM_RegForLstoEvt
1449**
1450** Description      register for the HCI "Link Supervision Timeout Change" event
1451**
1452** Returns          void
1453**
1454*******************************************************************************/
1455void BTM_RegForLstoEvt (tBTM_LSTO_CBACK *p_cback)
1456{
1457    BTM_TRACE_DEBUG0 ("BTM_RegForLstoEvt");
1458    btm_cb.p_lsto_cback = p_cback;
1459}
1460
1461/*******************************************************************************
1462**
1463** Function         btm_proc_lsto_evt
1464**
1465** Description      process the HCI "Link Supervision Timeout Change" event
1466**
1467** Returns          void
1468**
1469*******************************************************************************/
1470void btm_proc_lsto_evt(UINT16 handle, UINT16 timeout)
1471{
1472    UINT8 xx;
1473
1474    BTM_TRACE_DEBUG0 ("btm_proc_lsto_evt");
1475    if (btm_cb.p_lsto_cback)
1476    {
1477        /* Look up the connection by handle and set the current mode */
1478        xx = btm_handle_to_acl_index(handle);
1479
1480        /* don't assume that we can never get a bad hci_handle */
1481        if (xx < MAX_L2CAP_LINKS)
1482        {
1483            (*btm_cb.p_lsto_cback)(btm_cb.acl_db[xx].remote_addr, timeout);
1484        }
1485    }
1486}
1487
1488#if BTM_PWR_MGR_INCLUDED == FALSE
1489/*******************************************************************************
1490**
1491** Function         BTM_SetHoldMode
1492**
1493** Description      This function is called to set a connection into hold mode.
1494**                  A check is made if the connection is in sniff or park mode,
1495**                  and if yes, the hold mode is ignored.
1496**
1497** Returns          status of the operation
1498**
1499*******************************************************************************/
1500tBTM_STATUS BTM_SetHoldMode (BD_ADDR remote_bda, UINT16 min_interval, UINT16 max_interval)
1501{
1502    tACL_CONN   *p;
1503
1504    BTM_TRACE_DEBUG0 ("BTM_SetHoldMode");
1505    /* First, check if hold mode is supported */
1506    if (!HCI_HOLD_MODE_SUPPORTED(BTM_ReadLocalFeatures()))
1507        return(BTM_MODE_UNSUPPORTED);
1508
1509    p = btm_bda_to_acl(remote_bda);
1510    if (p != (tACL_CONN *)NULL)
1511    {
1512        /* If the connection is in park or sniff mode, forget about holding it */
1513        if (p->mode != BTM_ACL_MODE_NORMAL)
1514            return(BTM_SUCCESS);
1515
1516        if (!btsnd_hcic_hold_mode (p->hci_handle, max_interval, min_interval))
1517            return(BTM_NO_RESOURCES);
1518
1519        return(BTM_CMD_STARTED);
1520    }
1521
1522    /* If here, no BD Addr found */
1523    return(BTM_UNKNOWN_ADDR);
1524}
1525
1526
1527/*******************************************************************************
1528**
1529** Function         BTM_SetSniffMode
1530**
1531** Description      This function is called to set a connection into sniff mode.
1532**                  A check is made if the connection is already in sniff or park
1533**                  mode, and if yes, the sniff mode is ignored.
1534**
1535** Returns          status of the operation
1536**
1537*******************************************************************************/
1538tBTM_STATUS BTM_SetSniffMode (BD_ADDR remote_bda, UINT16 min_period, UINT16 max_period,
1539                              UINT16 attempt, UINT16 timeout)
1540{
1541    tACL_CONN   *p;
1542    BTM_TRACE_DEBUG0 ("BTM_SetSniffMode");
1543    /* First, check if sniff mode is supported */
1544    if (!HCI_SNIFF_MODE_SUPPORTED(BTM_ReadLocalFeatures()))
1545        return(BTM_MODE_UNSUPPORTED);
1546
1547    p = btm_bda_to_acl(remote_bda);
1548    if (p != (tACL_CONN *)NULL)
1549    {
1550        /* If the connection is in park mode, forget about sniffing it */
1551        if (p->mode != BTM_ACL_MODE_NORMAL)
1552            return(BTM_WRONG_MODE);
1553
1554        if (!btsnd_hcic_sniff_mode (p->hci_handle, max_period,
1555                                    min_period, attempt, timeout))
1556            return(BTM_NO_RESOURCES);
1557
1558        return(BTM_CMD_STARTED);
1559    }
1560
1561    /* If here, no BD Addr found */
1562    return(BTM_UNKNOWN_ADDR);
1563}
1564
1565
1566
1567
1568/*******************************************************************************
1569**
1570** Function         BTM_CancelSniffMode
1571**
1572** Description      This function is called to put a connection out of sniff mode.
1573**                  A check is made if the connection is already in sniff mode,
1574**                  and if not, the cancel sniff mode is ignored.
1575**
1576** Returns          status of the operation
1577**
1578*******************************************************************************/
1579tBTM_STATUS BTM_CancelSniffMode (BD_ADDR remote_bda)
1580{
1581    tACL_CONN   *p = btm_bda_to_acl(remote_bda);
1582    BTM_TRACE_DEBUG0 ("BTM_CancelSniffMode ");
1583    if (p == (tACL_CONN *)NULL)
1584        return(BTM_UNKNOWN_ADDR);
1585
1586    /* If the connection is not in sniff mode, cannot cancel */
1587    if (p->mode != BTM_ACL_MODE_SNIFF)
1588        return(BTM_WRONG_MODE);
1589
1590    if (!btsnd_hcic_exit_sniff_mode (p->hci_handle))
1591        return(BTM_NO_RESOURCES);
1592
1593    return(BTM_CMD_STARTED);
1594}
1595
1596
1597/*******************************************************************************
1598**
1599** Function         BTM_SetParkMode
1600**
1601** Description      This function is called to set a connection into park mode.
1602**                  A check is made if the connection is already in sniff or park
1603**                  mode, and if yes, the park mode is ignored.
1604**
1605** Returns          status of the operation
1606**
1607*******************************************************************************/
1608tBTM_STATUS BTM_SetParkMode (BD_ADDR remote_bda, UINT16 beacon_min_period, UINT16 beacon_max_period)
1609{
1610    tACL_CONN   *p;
1611
1612    BTM_TRACE_DEBUG0 ("BTM_SetParkMode");
1613    /* First, check if park mode is supported */
1614    if (!HCI_PARK_MODE_SUPPORTED(BTM_ReadLocalFeatures()))
1615        return(BTM_MODE_UNSUPPORTED);
1616
1617    p = btm_bda_to_acl(remote_bda);
1618    if (p != (tACL_CONN *)NULL)
1619    {
1620        /* If the connection is in sniff mode, forget about parking it */
1621        if (p->mode != BTM_ACL_MODE_NORMAL)
1622            return(BTM_WRONG_MODE);
1623
1624        /* no park mode if SCO exists -- CR#1982, 1.1 errata 1124
1625           command status event should be returned /w error code 0x0C "Command Disallowed"
1626           Let LM do this.
1627        */
1628        if (!btsnd_hcic_park_mode (p->hci_handle,
1629                                   beacon_max_period, beacon_min_period))
1630            return(BTM_NO_RESOURCES);
1631
1632        return(BTM_CMD_STARTED);
1633    }
1634
1635    /* If here, no BD Addr found */
1636    return(BTM_UNKNOWN_ADDR);
1637}
1638
1639/*******************************************************************************
1640**
1641** Function         BTM_CancelParkMode
1642**
1643** Description      This function is called to put a connection out of park mode.
1644**                  A check is made if the connection is already in park mode,
1645**                  and if not, the cancel sniff mode is ignored.
1646**
1647** Returns          status of the operation
1648**
1649*******************************************************************************/
1650tBTM_STATUS BTM_CancelParkMode (BD_ADDR remote_bda)
1651{
1652    tACL_CONN   *p;
1653
1654    BTM_TRACE_DEBUG0 ("BTM_CancelParkMode");
1655    p = btm_bda_to_acl(remote_bda);
1656    if (p != (tACL_CONN *)NULL)
1657    {
1658        /* If the connection is not in park mode, cannot cancel */
1659        if (p->mode != BTM_ACL_MODE_PARK)
1660            return(BTM_WRONG_MODE);
1661
1662        if (!btsnd_hcic_exit_park_mode (p->hci_handle))
1663            return(BTM_NO_RESOURCES);
1664
1665        return(BTM_CMD_STARTED);
1666    }
1667
1668    /* If here, no BD Addr found */
1669    return(BTM_UNKNOWN_ADDR);
1670}
1671#endif /* BTM_PWR_MGR_INCLUDED == FALSE */
1672
1673
1674/*******************************************************************************
1675**
1676** Function         BTM_SetPacketTypes
1677**
1678** Description      This function is set the packet types used for a specific
1679**                  ACL connection,
1680**
1681** Returns          status of the operation
1682**
1683*******************************************************************************/
1684tBTM_STATUS BTM_SetPacketTypes (BD_ADDR remote_bda, UINT16 pkt_types)
1685{
1686    tACL_CONN   *p;
1687    BTM_TRACE_DEBUG0 ("BTM_SetPacketTypes");
1688
1689    if ((p = btm_bda_to_acl(remote_bda)) != NULL)
1690        return(btm_set_packet_types (p, pkt_types));
1691
1692    /* If here, no BD Addr found */
1693    return(BTM_UNKNOWN_ADDR);
1694}
1695
1696
1697/*******************************************************************************
1698**
1699** Function         BTM_ReadPacketTypes
1700**
1701** Description      This function is set the packet types used for a specific
1702**                  ACL connection,
1703**
1704** Returns          packet types supported for the connection, or 0 if no BD address
1705**
1706*******************************************************************************/
1707UINT16 BTM_ReadPacketTypes (BD_ADDR remote_bda)
1708{
1709    tACL_CONN   *p;
1710
1711    BTM_TRACE_DEBUG0 ("BTM_ReadPacketTypes");
1712    p = btm_bda_to_acl(remote_bda);
1713    if (p != (tACL_CONN *)NULL)
1714    {
1715        return(p->pkt_types_mask);
1716    }
1717
1718    /* If here, no BD Addr found */
1719    return(0);
1720}
1721
1722
1723/*******************************************************************************
1724**
1725** Function         BTM_ReadAclMode
1726**
1727** Description      This returns the current mode for a specific
1728**                  ACL connection.
1729**
1730** Input Param      remote_bda - device address of desired ACL connection
1731**
1732** Output Param     p_mode - address where the current mode is copied into.
1733**                          BTM_ACL_MODE_NORMAL
1734**                          BTM_ACL_MODE_HOLD
1735**                          BTM_ACL_MODE_SNIFF
1736**                          BTM_ACL_MODE_PARK
1737**                          (valid only if return code is BTM_SUCCESS)
1738**
1739** Returns          BTM_SUCCESS if successful,
1740**                  BTM_UNKNOWN_ADDR if bd addr is not active or bad
1741**
1742*******************************************************************************/
1743#if BTM_PWR_MGR_INCLUDED == FALSE
1744tBTM_STATUS BTM_ReadAclMode (BD_ADDR remote_bda, UINT8 *p_mode)
1745{
1746    tACL_CONN   *p;
1747
1748    BTM_TRACE_API6 ("BTM_ReadAclMode: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1749                    remote_bda[0], remote_bda[1], remote_bda[2],
1750                    remote_bda[3], remote_bda[4], remote_bda[5]);
1751
1752    p = btm_bda_to_acl(remote_bda);
1753    if (p != (tACL_CONN *)NULL)
1754    {
1755        *p_mode = p->mode;
1756        return(BTM_SUCCESS);
1757    }
1758
1759    /* If here, no BD Addr found */
1760    return(BTM_UNKNOWN_ADDR);
1761}
1762#endif /* BTM_PWR_MGR_INCLUDED == FALSE */
1763
1764/*******************************************************************************
1765**
1766** Function         BTM_ReadClockOffset
1767**
1768** Description      This returns the clock offset for a specific
1769**                  ACL connection.
1770**
1771** Input Param      remote_bda - device address of desired ACL connection
1772**
1773** Returns          clock-offset or 0 if unknown
1774**
1775*******************************************************************************/
1776UINT16 BTM_ReadClockOffset (BD_ADDR remote_bda)
1777{
1778    tACL_CONN   *p;
1779
1780    BTM_TRACE_API6 ("BTM_ReadClockOffset: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1781                    remote_bda[0], remote_bda[1], remote_bda[2],
1782                    remote_bda[3], remote_bda[4], remote_bda[5]);
1783
1784    if ( (p = btm_bda_to_acl(remote_bda)) != NULL)
1785        return(p->clock_offset);
1786
1787    /* If here, no BD Addr found */
1788    return(0);
1789}
1790
1791/*******************************************************************************
1792**
1793** Function         BTM_IsAclConnectionUp
1794**
1795** Description      This function is called to check if an ACL connection exists
1796**                  to a specific remote BD Address.
1797**
1798** Returns          TRUE if connection is up, else FALSE.
1799**
1800*******************************************************************************/
1801BOOLEAN BTM_IsAclConnectionUp (BD_ADDR remote_bda)
1802{
1803    tACL_CONN   *p;
1804
1805    BTM_TRACE_API6 ("BTM_ReadClockOffset: RemBdAddr: %02x%02x%02x%02x%02x%02x",
1806                    remote_bda[0], remote_bda[1], remote_bda[2],
1807                    remote_bda[3], remote_bda[4], remote_bda[5]);
1808
1809    p = btm_bda_to_acl(remote_bda);
1810    if (p != (tACL_CONN *)NULL)
1811    {
1812        return(TRUE);
1813    }
1814
1815    /* If here, no BD Addr found */
1816    return(FALSE);
1817}
1818
1819/*******************************************************************************
1820**
1821** Function         BTM_GetNumAclLinks
1822**
1823** Description      This function is called to count the number of
1824**                  ACL links that are active.
1825**
1826** Returns          UINT16  Number of active ACL links
1827**
1828*******************************************************************************/
1829UINT16 BTM_GetNumAclLinks (void)
1830{
1831#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
1832    return(UINT16)btm_cb.num_acl;
1833#else
1834    tACL_CONN   *p = &btm_cb.acl_db[0];
1835    UINT16      xx, yy;
1836    BTM_TRACE_DEBUG0 ("BTM_GetNumAclLinks");
1837    for (xx = yy = 0; xx < MAX_L2CAP_LINKS; xx++, p++)
1838    {
1839        if (p->in_use)
1840            yy++;
1841    }
1842
1843    return(yy);
1844#endif
1845}
1846
1847/*******************************************************************************
1848**
1849** Function         btm_get_acl_disc_reason_code
1850**
1851** Description      This function is called to get the disconnection reason code
1852**                  returned by the HCI at disconnection complete event.
1853**
1854** Returns          TRUE if connection is up, else FALSE.
1855**
1856*******************************************************************************/
1857UINT16 btm_get_acl_disc_reason_code (void)
1858{
1859    UINT8 res = btm_cb.acl_disc_reason;
1860    BTM_TRACE_DEBUG0 ("btm_get_acl_disc_reason_code");
1861    return(res);
1862}
1863
1864
1865/*******************************************************************************
1866**
1867** Function         BTM_GetHCIConnHandle
1868**
1869** Description      This function is called to get the handle for an ACL connection
1870**                  to a specific remote BD Address.
1871**
1872** Returns          the handle of the connection, or 0xFFFF if none.
1873**
1874*******************************************************************************/
1875UINT16 BTM_GetHCIConnHandle (BD_ADDR remote_bda)
1876{
1877    tACL_CONN   *p;
1878    BTM_TRACE_DEBUG0 ("BTM_GetHCIConnHandle");
1879    p = btm_bda_to_acl(remote_bda);
1880    if (p != (tACL_CONN *)NULL)
1881    {
1882        return(p->hci_handle);
1883    }
1884
1885    /* If here, no BD Addr found */
1886    return(0xFFFF);
1887}
1888
1889#if BTM_PWR_MGR_INCLUDED == FALSE
1890/*******************************************************************************
1891**
1892** Function         btm_process_mode_change
1893**
1894** Description      This function is called when an HCI mode change event occurs.
1895**
1896** Input Parms      hci_status - status of the event (HCI_SUCCESS if no errors)
1897**                  hci_handle - connection handle associated with the change
1898**                  mode - HCI_MODE_ACTIVE, HCI_MODE_HOLD, HCI_MODE_SNIFF, or HCI_MODE_PARK
1899**                  interval - number of baseband slots (meaning depends on mode)
1900**
1901** Returns          void
1902**
1903*******************************************************************************/
1904void btm_process_mode_change (UINT8 hci_status, UINT16 hci_handle, UINT8 mode, UINT16 interval)
1905{
1906    tACL_CONN        *p;
1907    UINT8             xx;
1908    BTM_TRACE_DEBUG0 ("btm_process_mode_change");
1909    if (hci_status != HCI_SUCCESS)
1910    {
1911        BTM_TRACE_WARNING1 ("BTM: HCI Mode Change Error Status: 0x%02x", hci_status);
1912    }
1913
1914    /* Look up the connection by handle and set the current mode */
1915    xx = btm_handle_to_acl_index(hci_handle);
1916
1917    /* don't assume that we can never get a bad hci_handle */
1918    if (xx >= MAX_L2CAP_LINKS)
1919        return;
1920
1921    p = &btm_cb.acl_db[xx];
1922
1923    /* If status is not success mode does not mean anything */
1924    if (hci_status == HCI_SUCCESS)
1925        p->mode = mode;
1926
1927    /* If mode change was because of an active role switch or change link key */
1928    btm_cont_rswitch_or_chglinkkey(p, btm_find_dev(p->remote_addr), hci_status);
1929}
1930#endif /* BTM_PWR_MGR_INCLUDED == FALSE */
1931
1932/*******************************************************************************
1933**
1934** Function         btm_process_clk_off_comp_evt
1935**
1936** Description      This function is called when clock offset command completes.
1937**
1938** Input Parms      hci_handle - connection handle associated with the change
1939**                  clock offset
1940**
1941** Returns          void
1942**
1943*******************************************************************************/
1944void btm_process_clk_off_comp_evt (UINT16 hci_handle, UINT16 clock_offset)
1945{
1946    UINT8      xx;
1947    BTM_TRACE_DEBUG0 ("btm_process_clk_off_comp_evt");
1948    /* Look up the connection by handle and set the current mode */
1949    if ((xx = btm_handle_to_acl_index(hci_handle)) < MAX_L2CAP_LINKS)
1950        btm_cb.acl_db[xx].clock_offset = clock_offset;
1951}
1952
1953/*******************************************************************************
1954**
1955** Function         btm_acl_role_changed
1956**
1957** Description      This function is called whan a link's master/slave role change
1958**                  event or command status event (with error) is received.
1959**                  It updates the link control block, and calls
1960**                  the registered callback with status and role (if registered).
1961**
1962** Returns          void
1963**
1964*******************************************************************************/
1965void btm_acl_role_changed (UINT8 hci_status, BD_ADDR bd_addr, UINT8 new_role)
1966{
1967    UINT8                   *p_bda = (bd_addr) ? bd_addr : btm_cb.devcb.switch_role_ref_data.remote_bd_addr;
1968    tACL_CONN               *p = btm_bda_to_acl(p_bda);
1969    tBTM_ROLE_SWITCH_CMPL   *p_data = &btm_cb.devcb.switch_role_ref_data;
1970#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
1971    tBTM_BL_ROLE_CHG_DATA   evt;
1972#endif
1973#if BTM_DISC_DURING_RS == TRUE
1974    tBTM_SEC_DEV_REC  *p_dev_rec;
1975#endif
1976    BTM_TRACE_DEBUG0 ("btm_acl_role_changed");
1977    /* Ignore any stray events */
1978    if (p == NULL)
1979    {
1980        /* it could be a failure */
1981        if (hci_status != HCI_SUCCESS)
1982            btm_acl_report_role_change(hci_status, bd_addr);
1983        return;
1984    }
1985
1986    p_data->hci_status = hci_status;
1987
1988    if (hci_status == HCI_SUCCESS)
1989    {
1990        p_data->role = new_role;
1991        memcpy(p_data->remote_bd_addr, p_bda, BD_ADDR_LEN);
1992
1993        /* Update cached value */
1994        p->link_role = new_role;
1995
1996        /* Reload LSTO: link supervision timeout is reset in the LM after a role switch */
1997        if (new_role == BTM_ROLE_MASTER)
1998        {
1999            BTM_SetLinkSuperTout (p->remote_addr, p->link_super_tout);
2000        }
2001    }
2002    else
2003    {
2004        /* so the BTM_BL_ROLE_CHG_EVT uses the old role */
2005        new_role = p->link_role;
2006    }
2007
2008    /* Check if any SCO req is pending for role change */
2009    btm_sco_chk_pend_rolechange (p->hci_handle);
2010
2011    /* if switching state is switching we need to turn encryption on */
2012    /* if idle, we did not change encryption */
2013    if (p->switch_role_state == BTM_ACL_SWKEY_STATE_SWITCHING)
2014    {
2015        /* Make sure there's not also a change link key going on before re-enabling */
2016        if (p->change_key_state != BTM_ACL_SWKEY_STATE_SWITCHING)
2017        {
2018            if (btsnd_hcic_set_conn_encrypt (p->hci_handle, TRUE))
2019            {
2020                p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_ON;
2021                p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
2022                return;
2023            }
2024        }
2025        else    /* Set the state and wait for change link key */
2026        {
2027            p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_ON;
2028            return;
2029        }
2030    }
2031
2032    /* Set the switch_role_state to IDLE since the reply received from HCI */
2033    /* regardless of its result either success or failed. */
2034    if (p->switch_role_state == BTM_ACL_SWKEY_STATE_IN_PROGRESS)
2035    {
2036        p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
2037        p->encrypt_state = BTM_ACL_ENCRYPT_STATE_IDLE;
2038    }
2039
2040    /* if role switch complete is needed, report it now */
2041    btm_acl_report_role_change(hci_status, bd_addr);
2042
2043#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
2044    /* if role change event is registered, report it now */
2045    if (btm_cb.p_bl_changed_cb && (btm_cb.bl_evt_mask & BTM_BL_ROLE_CHG_MASK))
2046    {
2047        evt.event       = BTM_BL_ROLE_CHG_EVT;
2048        evt.new_role    = new_role;
2049        evt.p_bda       = p_bda;
2050        evt.hci_status  = hci_status;
2051        (*btm_cb.p_bl_changed_cb)((tBTM_BL_EVENT_DATA *)&evt);
2052    }
2053
2054    BTM_TRACE_DEBUG3("Role Switch Event: new_role 0x%02x, HCI Status 0x%02x, rs_st:%d",
2055                     p_data->role, p_data->hci_status, p->switch_role_state);
2056#endif
2057
2058#if BTM_DISC_DURING_RS == TRUE
2059    /* If a disconnect is pending, issue it now that role switch has completed */
2060    if ((p_dev_rec = btm_find_dev (p_bda)) != NULL)
2061    {
2062        if (p_dev_rec->rs_disc_pending == BTM_SEC_DISC_PENDING)
2063        {
2064            BTM_TRACE_WARNING0("btm_acl_role_changed -> Issuing delayed HCI_Disconnect!!!");
2065            btsnd_hcic_disconnect(p_dev_rec->hci_handle, HCI_ERR_PEER_USER);
2066        }
2067        BTM_TRACE_ERROR2("tBTM_SEC_DEV:0x%x rs_disc_pending=%d", (UINT32)p_dev_rec, p_dev_rec->rs_disc_pending);
2068        p_dev_rec->rs_disc_pending = BTM_SEC_RS_NOT_PENDING;     /* reset flag */
2069    }
2070
2071#endif
2072
2073}
2074
2075#if (RFCOMM_INCLUDED==TRUE)
2076/*******************************************************************************
2077**
2078** Function         BTM_AllocateSCN
2079**
2080** Description      Look through the Server Channel Numbers for a free one.
2081**
2082** Returns          Allocated SCN number or 0 if none.
2083**
2084*******************************************************************************/
2085
2086UINT8 BTM_AllocateSCN(void)
2087{
2088    UINT8   x;
2089    BTM_TRACE_DEBUG0 ("BTM_AllocateSCN");
2090
2091    // stack reserves scn 1 for HFP, HSP we still do the correct way
2092    for (x = 1; x < BTM_MAX_SCN; x++)
2093    {
2094        if (!btm_cb.btm_scn[x])
2095        {
2096            btm_cb.btm_scn[x] = TRUE;
2097            return(x+1);
2098        }
2099    }
2100
2101    return(0);     /* No free ports */
2102}
2103
2104/*******************************************************************************
2105**
2106** Function         BTM_TryAllocateSCN
2107**
2108** Description      Try to allocate a fixed server channel
2109**
2110** Returns          Returns TRUE if server channel was available
2111**
2112*******************************************************************************/
2113
2114BOOLEAN BTM_TryAllocateSCN(UINT8 scn)
2115{
2116    UINT8   x;
2117
2118    /* Make sure we don't exceed max port range.
2119     * Stack reserves scn 1 for HFP, HSP we still do the correct way.
2120     */
2121    if ( (scn>=BTM_MAX_SCN) || (scn == 1) )
2122        return FALSE;
2123
2124    /* check if this port is available */
2125    if (!btm_cb.btm_scn[scn-1])
2126    {
2127        btm_cb.btm_scn[scn-1] = TRUE;
2128        return TRUE;
2129    }
2130
2131    return (FALSE);     /* Port was busy */
2132}
2133
2134/*******************************************************************************
2135**
2136** Function         BTM_FreeSCN
2137**
2138** Description      Free the specified SCN.
2139**
2140** Returns          TRUE or FALSE
2141**
2142*******************************************************************************/
2143BOOLEAN BTM_FreeSCN(UINT8 scn)
2144{
2145    BTM_TRACE_DEBUG0 ("BTM_FreeSCN ");
2146    if (scn <= BTM_MAX_SCN)
2147    {
2148        btm_cb.btm_scn[scn-1] = FALSE;
2149        return(TRUE);
2150    }
2151    else
2152        return(FALSE);      /* Illegal SCN passed in */
2153}
2154
2155#else
2156
2157/* Make dummy functions for the RPC to link against */
2158UINT8 BTM_AllocateSCN(void)
2159{
2160    return(0);
2161}
2162
2163BOOLEAN BTM_FreeSCN(UINT8 scn)
2164{
2165    return(FALSE);
2166}
2167
2168#endif
2169
2170
2171/*******************************************************************************
2172**
2173** Function         btm_acl_timeout
2174**
2175** Description      This function is called when a timer list entry expires.
2176**
2177** Returns          void
2178**
2179*******************************************************************************/
2180void btm_acl_timeout (TIMER_LIST_ENT  *p_tle)
2181{
2182    UINT32 timer_type = p_tle->param;
2183
2184    BTM_TRACE_DEBUG0 ("btm_acl_timeout");
2185    if (timer_type == TT_DEV_RLNKP)
2186    {
2187        tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_rlinkp_cmpl_cb;
2188        tBTM_LNK_POLICY_RESULTS  lnkpol;
2189
2190        lnkpol.status = BTM_ERR_PROCESSING;
2191        lnkpol.settings = 0;
2192
2193        btm_cb.devcb.p_rlinkp_cmpl_cb = NULL;
2194
2195        if (p_cb)
2196            (*p_cb)(&lnkpol);
2197    }
2198}
2199
2200/*******************************************************************************
2201**
2202** Function         btm_set_packet_types
2203**
2204** Description      This function sets the packet types used for a specific
2205**                  ACL connection. It is called internally by btm_acl_created
2206**                  or by an application/profile by BTM_SetPacketTypes.
2207**
2208** Returns          status of the operation
2209**
2210*******************************************************************************/
2211tBTM_STATUS btm_set_packet_types (tACL_CONN *p, UINT16 pkt_types)
2212{
2213    UINT16 temp_pkt_types;
2214    BTM_TRACE_DEBUG0 ("btm_set_packet_types");
2215    /* Save in the ACL control blocks, types that we support */
2216    temp_pkt_types = (pkt_types & BTM_ACL_SUPPORTED_PKTS_MASK &
2217                      btm_cb.btm_acl_pkt_types_supported);
2218
2219    /* OR in any exception packet types if at least 2.0 version of spec */
2220    if (btm_cb.devcb.local_version.hci_version >= HCI_PROTO_VERSION_2_0)
2221    {
2222        temp_pkt_types |= ((pkt_types & BTM_ACL_EXCEPTION_PKTS_MASK) |
2223                           (btm_cb.btm_acl_pkt_types_supported & BTM_ACL_EXCEPTION_PKTS_MASK));
2224    }
2225    else
2226    {
2227        temp_pkt_types &= (~BTM_ACL_EXCEPTION_PKTS_MASK);
2228    }
2229
2230    /* Exclude packet types not supported by the peer */
2231    btm_acl_chk_peer_pkt_type_support (p, &temp_pkt_types);
2232
2233    BTM_TRACE_DEBUG1 ("SetPacketType Mask -> 0x%04x", temp_pkt_types);
2234
2235    if (!btsnd_hcic_change_conn_type (p->hci_handle, temp_pkt_types))
2236    {
2237        return(BTM_NO_RESOURCES);
2238    }
2239
2240    p->pkt_types_mask = temp_pkt_types;
2241
2242    return(BTM_CMD_STARTED);
2243}
2244
2245/*******************************************************************************
2246**
2247** Function         btm_get_max_packet_size
2248**
2249** Returns          Returns maximum packet size that can be used for current
2250**                  connection, 0 if connection is not established
2251**
2252*******************************************************************************/
2253UINT16 btm_get_max_packet_size (BD_ADDR addr)
2254{
2255    tACL_CONN   *p = btm_bda_to_acl(addr);
2256    UINT16      pkt_types = 0;
2257    UINT16      pkt_size = 0;
2258    BTM_TRACE_DEBUG0 ("btm_get_max_packet_size");
2259    if (p != NULL)
2260    {
2261        pkt_types = p->pkt_types_mask;
2262    }
2263    else
2264    {
2265        /* Special case for when info for the local device is requested */
2266        if (memcmp (btm_cb.devcb.local_addr, addr, BD_ADDR_LEN) == 0)
2267        {
2268            pkt_types = btm_cb.btm_acl_pkt_types_supported;
2269        }
2270    }
2271
2272    if (pkt_types)
2273    {
2274        if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH5))
2275            pkt_size = HCI_EDR3_DH5_PACKET_SIZE;
2276        else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH5))
2277            pkt_size = HCI_EDR2_DH5_PACKET_SIZE;
2278        else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH3))
2279            pkt_size = HCI_EDR3_DH3_PACKET_SIZE;
2280        else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH5)
2281            pkt_size = HCI_DH5_PACKET_SIZE;
2282        else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH3))
2283            pkt_size = HCI_EDR2_DH3_PACKET_SIZE;
2284        else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM5)
2285            pkt_size = HCI_DM5_PACKET_SIZE;
2286        else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH3)
2287            pkt_size = HCI_DH3_PACKET_SIZE;
2288        else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM3)
2289            pkt_size = HCI_DM3_PACKET_SIZE;
2290        else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_3_DH1))
2291            pkt_size = HCI_EDR3_DH1_PACKET_SIZE;
2292        else if (!(pkt_types & BTM_ACL_PKT_TYPES_MASK_NO_2_DH1))
2293            pkt_size = HCI_EDR2_DH1_PACKET_SIZE;
2294        else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DH1)
2295            pkt_size = HCI_DH1_PACKET_SIZE;
2296        else if (pkt_types & BTM_ACL_PKT_TYPES_MASK_DM1)
2297            pkt_size = HCI_DM1_PACKET_SIZE;
2298    }
2299
2300#ifdef BRCM_VS
2301    /* Using HCI size 1017 instead of 1021 */
2302    if ((pkt_size == HCI_EDR3_DH5_PACKET_SIZE)
2303        && (btu_cb.hcit_acl_data_size == 1017))
2304        pkt_size = 1017;
2305#endif
2306
2307    return(pkt_size);
2308}
2309
2310/*******************************************************************************
2311**
2312** Function         BTM_ReadRemoteVersion
2313**
2314** Returns          If connected report peer device info
2315**
2316*******************************************************************************/
2317tBTM_STATUS BTM_ReadRemoteVersion (BD_ADDR addr, UINT8 *lmp_version,
2318                                   UINT16 *manufacturer, UINT16 *lmp_sub_version)
2319{
2320    tACL_CONN        *p = btm_bda_to_acl(addr);
2321    BTM_TRACE_DEBUG0 ("BTM_ReadRemoteVersion");
2322    if (p == NULL)
2323        return(BTM_UNKNOWN_ADDR);
2324
2325    if (lmp_version)
2326        *lmp_version = p->lmp_version;
2327
2328    if (manufacturer)
2329        *manufacturer = p->manufacturer;
2330
2331    if (lmp_sub_version)
2332        *lmp_sub_version = p->lmp_subversion;
2333
2334    return(BTM_SUCCESS);
2335}
2336
2337/*******************************************************************************
2338**
2339** Function         BTM_ReadRemoteFeatures
2340**
2341** Returns          pointer to the features string
2342**
2343*******************************************************************************/
2344UINT8 *BTM_ReadRemoteFeatures (BD_ADDR addr)
2345{
2346    tACL_CONN        *p = btm_bda_to_acl(addr);
2347    BTM_TRACE_DEBUG0 ("BTM_ReadRemoteFeatures");
2348    if (p == NULL)
2349    {
2350        return(NULL);
2351    }
2352
2353    return(p->features);
2354}
2355
2356/*******************************************************************************
2357**
2358** Function         BTM_RegBusyLevelNotif
2359**
2360** Description      This function is called to register a callback to receive
2361**                  busy level change events.
2362**
2363** Returns          BTM_SUCCESS if successfully registered, otherwise error
2364**
2365*******************************************************************************/
2366#if (defined(BTM_BUSY_LEVEL_CHANGE_INCLUDED) && BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
2367tBTM_STATUS BTM_RegBusyLevelNotif (tBTM_BL_CHANGE_CB *p_cb, UINT8 *p_level,
2368                                   tBTM_BL_EVENT_MASK evt_mask)
2369{
2370    BTM_TRACE_DEBUG0 ("BTM_RegBusyLevelNotif");
2371    if (p_level)
2372        *p_level = btm_cb.busy_level;
2373
2374    btm_cb.bl_evt_mask = evt_mask;
2375
2376    if (!p_cb)
2377        btm_cb.p_bl_changed_cb = NULL;
2378    else if (btm_cb.p_bl_changed_cb)
2379        return(BTM_BUSY);
2380    else
2381        btm_cb.p_bl_changed_cb = p_cb;
2382
2383    return(BTM_SUCCESS);
2384}
2385#else
2386/*******************************************************************************
2387**
2388** Function         BTM_AclRegisterForChanges
2389**
2390** Returns          This function is called to register a callback for when the
2391**                  ACL database changes, i.e. new entry or entry deleted.
2392**
2393*******************************************************************************/
2394tBTM_STATUS BTM_AclRegisterForChanges (tBTM_ACL_DB_CHANGE_CB *p_cb)
2395{
2396    BTM_TRACE_DEBUG0 ("BTM_AclRegisterForChanges");
2397    if (!p_cb)
2398        btm_cb.p_acl_changed_cb = NULL;
2399    else if (btm_cb.p_acl_changed_cb)
2400        return(BTM_BUSY);
2401    else
2402        btm_cb.p_acl_changed_cb = p_cb;
2403
2404    return(BTM_SUCCESS);
2405}
2406#endif
2407
2408/*******************************************************************************
2409**
2410** Function         BTM_SetQoS
2411**
2412** Description      This function is called to setup QoS
2413**
2414** Returns          status of the operation
2415**
2416*******************************************************************************/
2417tBTM_STATUS BTM_SetQoS (BD_ADDR bd, FLOW_SPEC *p_flow, tBTM_CMPL_CB *p_cb)
2418{
2419    tACL_CONN   *p = &btm_cb.acl_db[0];
2420
2421    BTM_TRACE_API6 ("BTM_SetQoS: BdAddr: %02x%02x%02x%02x%02x%02x",
2422                    bd[0], bd[1], bd[2],
2423                    bd[3], bd[4], bd[5]);
2424
2425    /* If someone already waiting on the version, do not allow another */
2426    if (btm_cb.devcb.p_qossu_cmpl_cb)
2427        return(BTM_BUSY);
2428
2429    if ( (p = btm_bda_to_acl(bd)) != NULL)
2430    {
2431        btu_start_timer (&btm_cb.devcb.qossu_timer, BTU_TTYPE_BTM_ACL, BTM_DEV_REPLY_TIMEOUT);
2432        btm_cb.devcb.p_qossu_cmpl_cb = p_cb;
2433
2434        if (!btsnd_hcic_qos_setup (p->hci_handle, p_flow->qos_flags, p_flow->service_type,
2435                                   p_flow->token_rate, p_flow->peak_bandwidth, p_flow->latency,p_flow->delay_variation))
2436        {
2437            btm_cb.devcb.p_qossu_cmpl_cb = NULL;
2438            btu_stop_timer(&btm_cb.devcb.qossu_timer);
2439            return(BTM_NO_RESOURCES);
2440        }
2441        else
2442            return(BTM_CMD_STARTED);
2443    }
2444
2445    /* If here, no BD Addr found */
2446    return(BTM_UNKNOWN_ADDR);
2447}
2448
2449/*******************************************************************************
2450**
2451** Function         btm_qos_setup_complete
2452**
2453** Description      This function is called when the command complete message
2454**                  is received from the HCI for the qos setup request.
2455**
2456** Returns          void
2457**
2458*******************************************************************************/
2459void btm_qos_setup_complete (UINT8 status, UINT16 handle, FLOW_SPEC *p_flow)
2460{
2461    tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_qossu_cmpl_cb;
2462    tBTM_QOS_SETUP_CMPL     qossu;
2463    BTM_TRACE_DEBUG0 ("btm_qos_setup_complete");
2464    btu_stop_timer (&btm_cb.devcb.qossu_timer);
2465
2466    btm_cb.devcb.p_qossu_cmpl_cb = NULL;
2467
2468    if (p_cb)
2469    {
2470        memset(&qossu, 0, sizeof(tBTM_QOS_SETUP_CMPL));
2471        qossu.status = status;
2472        qossu.handle = handle;
2473        if (p_flow != NULL)
2474        {
2475            qossu.flow.qos_flags = p_flow->qos_flags;
2476            qossu.flow.service_type = p_flow->service_type;
2477            qossu.flow.token_rate = p_flow->token_rate;
2478            qossu.flow.peak_bandwidth = p_flow->peak_bandwidth;
2479            qossu.flow.latency = p_flow->latency;
2480            qossu.flow.delay_variation = p_flow->delay_variation;
2481        }
2482        BTM_TRACE_DEBUG1 ("BTM: p_flow->delay_variation: 0x%02x",
2483                          qossu.flow.delay_variation);
2484        (*p_cb)(&qossu);
2485    }
2486}
2487
2488
2489/*******************************************************************************
2490**
2491** Function         BTM_ReadRSSI
2492**
2493** Description      This function is called to read the link policy settings.
2494**                  The address of link policy results are returned in the callback.
2495**                  (tBTM_RSSI_RESULTS)
2496**
2497** Returns          BTM_CMD_STARTED if successfully initiated or error code
2498**
2499*******************************************************************************/
2500tBTM_STATUS BTM_ReadRSSI (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2501{
2502    tACL_CONN   *p;
2503
2504    BTM_TRACE_API6 ("BTM_ReadRSSI: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2505                    remote_bda[0], remote_bda[1], remote_bda[2],
2506                    remote_bda[3], remote_bda[4], remote_bda[5]);
2507
2508    /* If someone already waiting on the version, do not allow another */
2509    if (btm_cb.devcb.p_rssi_cmpl_cb)
2510        return(BTM_BUSY);
2511
2512    p = btm_bda_to_acl(remote_bda);
2513    if (p != (tACL_CONN *)NULL)
2514    {
2515        btu_start_timer (&btm_cb.devcb.rssi_timer, BTU_TTYPE_BTM_ACL,
2516                         BTM_DEV_REPLY_TIMEOUT);
2517
2518        btm_cb.devcb.p_rssi_cmpl_cb = p_cb;
2519
2520        if (!btsnd_hcic_read_rssi (p->hci_handle))
2521        {
2522            btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2523            btu_stop_timer (&btm_cb.devcb.rssi_timer);
2524            return(BTM_NO_RESOURCES);
2525        }
2526        else
2527            return(BTM_CMD_STARTED);
2528    }
2529
2530    /* If here, no BD Addr found */
2531    return(BTM_UNKNOWN_ADDR);
2532}
2533
2534/*******************************************************************************
2535**
2536** Function         BTM_ReadLinkQuality
2537**
2538** Description      This function is called to read the link qulaity.
2539**                  The value of the link quality is returned in the callback.
2540**                  (tBTM_LINK_QUALITY_RESULTS)
2541**
2542** Returns          BTM_CMD_STARTED if successfully initiated or error code
2543**
2544*******************************************************************************/
2545tBTM_STATUS BTM_ReadLinkQuality (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2546{
2547    tACL_CONN   *p;
2548
2549    BTM_TRACE_API6 ("BTM_ReadLinkQuality: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2550                    remote_bda[0], remote_bda[1], remote_bda[2],
2551                    remote_bda[3], remote_bda[4], remote_bda[5]);
2552
2553    /* If someone already waiting on the version, do not allow another */
2554    if (btm_cb.devcb.p_lnk_qual_cmpl_cb)
2555        return(BTM_BUSY);
2556
2557    p = btm_bda_to_acl(remote_bda);
2558    if (p != (tACL_CONN *)NULL)
2559    {
2560        btu_start_timer (&btm_cb.devcb.lnk_quality_timer, BTU_TTYPE_BTM_ACL,
2561                         BTM_DEV_REPLY_TIMEOUT);
2562        btm_cb.devcb.p_lnk_qual_cmpl_cb = p_cb;
2563
2564        if (!btsnd_hcic_get_link_quality (p->hci_handle))
2565        {
2566            btu_stop_timer (&btm_cb.devcb.lnk_quality_timer);
2567            btm_cb.devcb.p_lnk_qual_cmpl_cb = NULL;
2568            return(BTM_NO_RESOURCES);
2569        }
2570        else
2571            return(BTM_CMD_STARTED);
2572    }
2573
2574    /* If here, no BD Addr found */
2575    return(BTM_UNKNOWN_ADDR);
2576}
2577
2578/*******************************************************************************
2579**
2580** Function         BTM_ReadTxPower
2581**
2582** Description      This function is called to read the current
2583**                  TX power of the connection. The tx power level results
2584**                  are returned in the callback.
2585**                  (tBTM_RSSI_RESULTS)
2586**
2587** Returns          BTM_CMD_STARTED if successfully initiated or error code
2588**
2589*******************************************************************************/
2590tBTM_STATUS BTM_ReadTxPower (BD_ADDR remote_bda, tBTM_CMPL_CB *p_cb)
2591{
2592    tACL_CONN   *p;
2593    BOOLEAN     ret;
2594#define BTM_READ_RSSI_TYPE_CUR  0x00
2595#define BTM_READ_RSSI_TYPE_MAX  0X01
2596
2597    BTM_TRACE_API6 ("BTM_ReadTxPower: RemBdAddr: %02x%02x%02x%02x%02x%02x",
2598                    remote_bda[0], remote_bda[1], remote_bda[2],
2599                    remote_bda[3], remote_bda[4], remote_bda[5]);
2600
2601    /* If someone already waiting on the version, do not allow another */
2602    if (btm_cb.devcb.p_tx_power_cmpl_cb)
2603        return(BTM_BUSY);
2604
2605    p = btm_bda_to_acl(remote_bda);
2606    if (p != (tACL_CONN *)NULL)
2607    {
2608        btu_start_timer (&btm_cb.devcb.tx_power_timer, BTU_TTYPE_BTM_ACL,
2609                         BTM_DEV_REPLY_TIMEOUT);
2610
2611        btm_cb.devcb.p_tx_power_cmpl_cb = p_cb;
2612
2613#if BLE_INCLUDED == TRUE
2614        if (p->is_le_link)
2615        {
2616            memcpy(btm_cb.devcb.read_tx_pwr_addr, remote_bda, BD_ADDR_LEN);
2617            ret = btsnd_hcic_ble_read_adv_chnl_tx_power();
2618        }
2619        else
2620#endif
2621        {
2622            ret = btsnd_hcic_read_tx_power (p->hci_handle, BTM_READ_RSSI_TYPE_CUR);
2623        }
2624        if (!ret)
2625        {
2626            btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2627            btu_stop_timer (&btm_cb.devcb.tx_power_timer);
2628            return(BTM_NO_RESOURCES);
2629        }
2630        else
2631            return(BTM_CMD_STARTED);
2632    }
2633
2634    /* If here, no BD Addr found */
2635    return (BTM_UNKNOWN_ADDR);
2636}
2637/*******************************************************************************
2638**
2639** Function         btm_read_tx_power_complete
2640**
2641** Description      This function is called when the command complete message
2642**                  is received from the HCI for the read tx power request.
2643**
2644** Returns          void
2645**
2646*******************************************************************************/
2647void btm_read_tx_power_complete (UINT8 *p, BOOLEAN is_ble)
2648{
2649    tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_tx_power_cmpl_cb;
2650    tBTM_TX_POWER_RESULTS   results;
2651    UINT16                   handle;
2652    tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2653    UINT16                   index;
2654    BTM_TRACE_DEBUG0 ("btm_read_tx_power_complete");
2655    btu_stop_timer (&btm_cb.devcb.tx_power_timer);
2656
2657    /* If there was a callback registered for read rssi, call it */
2658    btm_cb.devcb.p_tx_power_cmpl_cb = NULL;
2659
2660    if (p_cb)
2661    {
2662        STREAM_TO_UINT8  (results.hci_status, p);
2663
2664        if (results.hci_status == HCI_SUCCESS)
2665        {
2666            results.status = BTM_SUCCESS;
2667
2668            if (!is_ble)
2669            {
2670                STREAM_TO_UINT16 (handle, p);
2671                STREAM_TO_UINT8 (results.tx_power, p);
2672
2673                /* Search through the list of active channels for the correct BD Addr */
2674                for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2675                {
2676                    if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2677                    {
2678                        memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2679                        break;
2680                    }
2681                }
2682            }
2683#if BLE_INCLUDED == TRUE
2684            else
2685            {
2686                STREAM_TO_UINT8 (results.tx_power, p);
2687                memcpy(results.rem_bda, btm_cb.devcb.read_tx_pwr_addr, BD_ADDR_LEN);
2688            }
2689#endif
2690            BTM_TRACE_DEBUG2 ("BTM TX power Complete: tx_power %d, hci status 0x%02x",
2691                                  results.tx_power, results.hci_status);
2692        }
2693        else
2694            results.status = BTM_ERR_PROCESSING;
2695
2696        (*p_cb)(&results);
2697    }
2698}
2699
2700/*******************************************************************************
2701**
2702** Function         btm_read_rssi_complete
2703**
2704** Description      This function is called when the command complete message
2705**                  is received from the HCI for the read rssi request.
2706**
2707** Returns          void
2708**
2709*******************************************************************************/
2710void btm_read_rssi_complete (UINT8 *p)
2711{
2712    tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
2713    tBTM_RSSI_RESULTS        results;
2714    UINT16                   handle;
2715    tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2716    UINT16                   index;
2717    BTM_TRACE_DEBUG0 ("btm_read_rssi_complete");
2718    btu_stop_timer (&btm_cb.devcb.rssi_timer);
2719
2720    /* If there was a callback registered for read rssi, call it */
2721    btm_cb.devcb.p_rssi_cmpl_cb = NULL;
2722
2723    if (p_cb)
2724    {
2725        STREAM_TO_UINT8  (results.hci_status, p);
2726
2727        if (results.hci_status == HCI_SUCCESS)
2728        {
2729            results.status = BTM_SUCCESS;
2730
2731            STREAM_TO_UINT16 (handle, p);
2732
2733            STREAM_TO_UINT8 (results.rssi, p);
2734            BTM_TRACE_DEBUG2 ("BTM RSSI Complete: rssi %d, hci status 0x%02x",
2735                              results.rssi, results.hci_status);
2736
2737            /* Search through the list of active channels for the correct BD Addr */
2738            for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2739            {
2740                if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2741                {
2742                    memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2743                    break;
2744                }
2745            }
2746        }
2747        else
2748            results.status = BTM_ERR_PROCESSING;
2749
2750        (*p_cb)(&results);
2751    }
2752}
2753
2754/*******************************************************************************
2755**
2756** Function         btm_read_link_quality_complete
2757**
2758** Description      This function is called when the command complete message
2759**                  is received from the HCI for the read link quality.
2760**
2761** Returns          void
2762**
2763*******************************************************************************/
2764void btm_read_link_quality_complete (UINT8 *p)
2765{
2766    tBTM_CMPL_CB            *p_cb = btm_cb.devcb.p_lnk_qual_cmpl_cb;
2767    tBTM_LINK_QUALITY_RESULTS results;
2768    UINT16                   handle;
2769    tACL_CONN               *p_acl_cb = &btm_cb.acl_db[0];
2770    UINT16                   index;
2771    BTM_TRACE_DEBUG0 ("btm_read_link_quality_complete");
2772    btu_stop_timer (&btm_cb.devcb.rssi_timer);
2773
2774    /* If there was a callback registered for read rssi, call it */
2775    btm_cb.devcb.p_lnk_qual_cmpl_cb = NULL;
2776
2777    if (p_cb)
2778    {
2779        STREAM_TO_UINT8  (results.hci_status, p);
2780
2781        if (results.hci_status == HCI_SUCCESS)
2782        {
2783            results.status = BTM_SUCCESS;
2784
2785            STREAM_TO_UINT16 (handle, p);
2786
2787            STREAM_TO_UINT8 (results.link_quality, p);
2788            BTM_TRACE_DEBUG2 ("BTM Link Quality Complete: Link Quality %d, hci status 0x%02x",
2789                              results.link_quality, results.hci_status);
2790
2791            /* Search through the list of active channels for the correct BD Addr */
2792            for (index = 0; index < MAX_L2CAP_LINKS; index++, p_acl_cb++)
2793            {
2794                if ((p_acl_cb->in_use) && (handle == p_acl_cb->hci_handle))
2795                {
2796                    memcpy (results.rem_bda, p_acl_cb->remote_addr, BD_ADDR_LEN);
2797                    break;
2798                }
2799            }
2800        }
2801        else
2802            results.status = BTM_ERR_PROCESSING;
2803
2804        (*p_cb)(&results);
2805    }
2806}
2807
2808/*******************************************************************************
2809**
2810** Function         btm_remove_acl
2811**
2812** Description      This function is called to disconnect an ACL connection
2813**
2814** Returns          BTM_SUCCESS if successfully initiated, otherwise BTM_NO_RESOURCES.
2815**
2816*******************************************************************************/
2817tBTM_STATUS btm_remove_acl (BD_ADDR bd_addr)
2818{
2819    UINT16  hci_handle = BTM_GetHCIConnHandle(bd_addr);
2820    tBTM_STATUS status = BTM_SUCCESS;
2821
2822    BTM_TRACE_DEBUG0 ("btm_remove_acl");
2823#if BTM_DISC_DURING_RS == TRUE
2824    tBTM_SEC_DEV_REC  *p_dev_rec = btm_find_dev (bd_addr);
2825
2826    /* Role Switch is pending, postpone until completed */
2827    if (p_dev_rec && (p_dev_rec->rs_disc_pending == BTM_SEC_RS_PENDING))
2828    {
2829        p_dev_rec->rs_disc_pending = BTM_SEC_DISC_PENDING;
2830    }
2831    else    /* otherwise can disconnect right away */
2832#endif
2833
2834    if (hci_handle != 0xFFFF)
2835    {
2836        if (!btsnd_hcic_disconnect (hci_handle, HCI_ERR_PEER_USER))
2837            status = BTM_NO_RESOURCES;
2838    }
2839    else
2840        status = BTM_UNKNOWN_ADDR;
2841
2842    return status;
2843}
2844
2845
2846/*******************************************************************************
2847**
2848** Function         BTM_SetTraceLevel
2849**
2850** Description      This function sets the trace level for BTM.  If called with
2851**                  a value of 0xFF, it simply returns the current trace level.
2852**
2853** Returns          The new or current trace level
2854**
2855*******************************************************************************/
2856UINT8 BTM_SetTraceLevel (UINT8 new_level)
2857{
2858    BTM_TRACE_DEBUG0 ("BTM_SetTraceLevel");
2859    if (new_level != 0xFF)
2860        btm_cb.trace_level = new_level;
2861
2862    return(btm_cb.trace_level);
2863}
2864
2865/*******************************************************************************
2866**
2867** Function         btm_cont_rswitch_or_chglinkkey
2868**
2869** Description      This function is called to continue processing an active
2870**                  role switch or change of link key procedure.  It first
2871**                  disables encryption if enabled and EPR is not supported
2872**
2873** Returns          void
2874**
2875*******************************************************************************/
2876void btm_cont_rswitch_or_chglinkkey (tACL_CONN *p, tBTM_SEC_DEV_REC *p_dev_rec,
2877                                     UINT8 hci_status)
2878{
2879    BOOLEAN sw_ok = TRUE;
2880    BOOLEAN chlk_ok = TRUE;
2881    BTM_TRACE_DEBUG0 ("btm_cont_rswitch_or_chglinkkey ");
2882    /* Check to see if encryption needs to be turned off if pending
2883       change of link key or role switch */
2884    if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE ||
2885        p->change_key_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2886    {
2887        /* Must turn off Encryption first if necessary */
2888        /* Some devices do not support switch or change of link key while encryption is on */
2889        if (p_dev_rec != NULL && ((p_dev_rec->sec_flags & BTM_SEC_ENCRYPTED) != 0)
2890            && !BTM_EPR_AVAILABLE(p))
2891        {
2892            if (btsnd_hcic_set_conn_encrypt (p->hci_handle, FALSE))
2893            {
2894                p->encrypt_state = BTM_ACL_ENCRYPT_STATE_ENCRYPT_OFF;
2895                if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2896                    p->switch_role_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2897
2898                if (p->change_key_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2899                    p->change_key_state = BTM_ACL_SWKEY_STATE_ENCRYPTION_OFF;
2900            }
2901            else
2902            {
2903                /* Error occurred; set states back to Idle */
2904                if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2905                    sw_ok = FALSE;
2906
2907                if (p->change_key_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2908                    chlk_ok = FALSE;
2909            }
2910        }
2911        else    /* Encryption not used or EPR supported, continue with switch
2912                   and/or change of link key */
2913        {
2914            if (p->switch_role_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2915            {
2916                p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2917#if BTM_DISC_DURING_RS == TRUE
2918                if (p_dev_rec)
2919                    p_dev_rec->rs_disc_pending = BTM_SEC_RS_PENDING;
2920#endif
2921                sw_ok = btsnd_hcic_switch_role (p->remote_addr, (UINT8)!p->link_role);
2922            }
2923
2924            if (p->change_key_state == BTM_ACL_SWKEY_STATE_MODE_CHANGE)
2925            {
2926                p->switch_role_state = BTM_ACL_SWKEY_STATE_IN_PROGRESS;
2927                chlk_ok = btsnd_hcic_change_link_key (p->hci_handle);
2928            }
2929        }
2930
2931        if (!sw_ok)
2932        {
2933            p->switch_role_state = BTM_ACL_SWKEY_STATE_IDLE;
2934            btm_acl_report_role_change(hci_status, p->remote_addr);
2935        }
2936
2937        if (!chlk_ok)
2938        {
2939            p->change_key_state = BTM_ACL_SWKEY_STATE_IDLE;
2940            if (btm_cb.devcb.p_chg_link_key_cb)
2941            {
2942                btm_cb.devcb.chg_link_key_ref_data.hci_status = hci_status;
2943                (*btm_cb.devcb.p_chg_link_key_cb)(&btm_cb.devcb.chg_link_key_ref_data);
2944                btm_cb.devcb.p_chg_link_key_cb = NULL;
2945            }
2946        }
2947    }
2948}
2949
2950/*******************************************************************************
2951**
2952** Function         btm_acl_resubmit_page
2953**
2954** Description      send pending page request
2955**
2956*******************************************************************************/
2957void btm_acl_resubmit_page (void)
2958{
2959    tBTM_SEC_DEV_REC *p_dev_rec;
2960    BT_HDR  *p_buf;
2961    UINT8   *pp;
2962    BD_ADDR bda;
2963    BTM_TRACE_DEBUG0 ("btm_acl_resubmit_page");
2964    /* If there were other page request schedule can start the next one */
2965    if ((p_buf = (BT_HDR *)GKI_dequeue (&btm_cb.page_queue)) != NULL)
2966    {
2967        /* skip 3 (2 bytes opcode and 1 byte len) to get to the bd_addr
2968         * for both create_conn and rmt_name */
2969        pp = (UINT8 *)(p_buf + 1) + p_buf->offset + 3;
2970
2971        STREAM_TO_BDADDR (bda, pp);
2972
2973        p_dev_rec = btm_find_or_alloc_dev (bda);
2974
2975        memcpy (btm_cb.connecting_bda, p_dev_rec->bd_addr,   BD_ADDR_LEN);
2976        memcpy (btm_cb.connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);
2977
2978        btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p_buf);
2979    }
2980    else
2981        btm_cb.paging = FALSE;
2982}
2983
2984/*******************************************************************************
2985**
2986** Function         btm_acl_reset_paging
2987**
2988** Description      set paging to FALSE and free the page queue - called at hci_reset
2989**
2990*******************************************************************************/
2991void  btm_acl_reset_paging (void)
2992{
2993    BT_HDR *p;
2994    BTM_TRACE_DEBUG0 ("btm_acl_reset_paging");
2995    /* If we sent reset we are definitely not paging any more */
2996    while ((p = (BT_HDR *)GKI_dequeue(&btm_cb.page_queue)) != NULL)
2997        GKI_freebuf (p);
2998
2999    btm_cb.paging = FALSE;
3000}
3001
3002/*******************************************************************************
3003**
3004** Function         btm_acl_set_discing
3005**
3006** Description      set discing to the given value
3007**
3008*******************************************************************************/
3009void  btm_acl_set_discing (BOOLEAN discing)
3010{
3011    BTM_TRACE_DEBUG0 ("btm_acl_set_discing");
3012    btm_cb.discing = discing;
3013}
3014
3015/*******************************************************************************
3016**
3017** Function         btm_acl_paging
3018**
3019** Description      send a paging command or queue it in btm_cb
3020**
3021*******************************************************************************/
3022void  btm_acl_paging (BT_HDR *p, BD_ADDR bda)
3023{
3024    tBTM_SEC_DEV_REC *p_dev_rec;
3025
3026    BTM_TRACE_DEBUG4 ("btm_acl_paging discing:%d, paging:%d BDA: %06x%06x",
3027                      btm_cb.discing, btm_cb.paging,
3028                      (bda[0]<<16) + (bda[1]<<8) + bda[2], (bda[3]<<16) + (bda[4] << 8) + bda[5]);
3029    if (btm_cb.discing)
3030    {
3031        btm_cb.paging = TRUE;
3032        GKI_enqueue (&btm_cb.page_queue, p);
3033    }
3034    else
3035    {
3036        if (!BTM_ACL_IS_CONNECTED (bda))
3037        {
3038            BTM_TRACE_DEBUG2 ("connecting_bda: %06x%06x",
3039                              (btm_cb.connecting_bda[0]<<16) + (btm_cb.connecting_bda[1]<<8) + btm_cb.connecting_bda[2],
3040                              (btm_cb.connecting_bda[3]<<16) + (btm_cb.connecting_bda[4] << 8) + btm_cb.connecting_bda[5]);
3041            if (btm_cb.paging &&
3042                memcmp (bda, btm_cb.connecting_bda, BD_ADDR_LEN) != 0)
3043            {
3044                GKI_enqueue (&btm_cb.page_queue, p);
3045            }
3046            else
3047            {
3048                p_dev_rec = btm_find_or_alloc_dev (bda);
3049                memcpy (btm_cb.connecting_bda, p_dev_rec->bd_addr,   BD_ADDR_LEN);
3050                memcpy (btm_cb.connecting_dc,  p_dev_rec->dev_class, DEV_CLASS_LEN);
3051
3052                btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
3053            }
3054
3055            btm_cb.paging = TRUE;
3056        }
3057        else /* ACL is already up */
3058        {
3059            btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
3060        }
3061    }
3062}
3063
3064/*******************************************************************************
3065**
3066** Function         btm_acl_notif_conn_collision
3067**
3068** Description      Send connection collision event to upper layer if registered
3069**
3070** Returns          TRUE if sent out to upper layer,
3071**                  FALSE if BTM_BUSY_LEVEL_CHANGE_INCLUDED == FALSE, or no one
3072**                  needs the notification.
3073**
3074**          Note: Function only used if BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE
3075**
3076*******************************************************************************/
3077BOOLEAN  btm_acl_notif_conn_collision (BD_ADDR bda)
3078{
3079#if (BTM_BUSY_LEVEL_CHANGE_INCLUDED == TRUE)
3080    tBTM_BL_EVENT_DATA  evt_data;
3081
3082    /* Report possible collision to the upper layer. */
3083    if (btm_cb.p_bl_changed_cb)
3084    {
3085        BTM_TRACE_DEBUG6 ("btm_acl_notif_conn_collision: RemBdAddr: %02x%02x%02x%02x%02x%02x",
3086                          bda[0], bda[1], bda[2], bda[3], bda[4], bda[5]);
3087
3088        evt_data.event = BTM_BL_COLLISION_EVT;
3089        evt_data.conn.p_bda = bda;
3090        (*btm_cb.p_bl_changed_cb)(&evt_data);
3091        return TRUE;
3092    }
3093    else
3094        return FALSE;
3095#else
3096    return FALSE;
3097#endif
3098}
3099
3100
3101/*******************************************************************************
3102**
3103** Function         btm_acl_chk_peer_pkt_type_support
3104**
3105** Description      Check if peer supports requested packets
3106**
3107*******************************************************************************/
3108void btm_acl_chk_peer_pkt_type_support (tACL_CONN *p, UINT16 *p_pkt_type)
3109{
3110    /* 3 and 5 slot packets? */
3111    if (!HCI_3_SLOT_PACKETS_SUPPORTED(p->features))
3112        *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH3 +BTM_ACL_PKT_TYPES_MASK_DM3);
3113
3114    if (!HCI_5_SLOT_PACKETS_SUPPORTED(p->features))
3115        *p_pkt_type &= ~(BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5);
3116
3117    /* If HCI version > 2.0, then also check EDR packet types */
3118    if (btm_cb.devcb.local_version.hci_version >= HCI_PROTO_VERSION_2_0)
3119    {
3120        /* 2 and 3 MPS support? */
3121        if (!HCI_EDR_ACL_2MPS_SUPPORTED(p->features))
3122            /* Not supported. Add 'not_supported' mask for all 2MPS packet types */
3123            *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
3124
3125        if (!HCI_EDR_ACL_3MPS_SUPPORTED(p->features))
3126            /* Not supported. Add 'not_supported' mask for all 3MPS packet types */
3127            *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
3128
3129        /* EDR 3 and 5 slot support? */
3130        if (HCI_EDR_ACL_2MPS_SUPPORTED(p->features) || HCI_EDR_ACL_3MPS_SUPPORTED(p->features))
3131        {
3132            if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p->features))
3133                /* Not supported. Add 'not_supported' mask for all 3-slot EDR packet types */
3134                *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
3135
3136            if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p->features))
3137                /* Not supported. Add 'not_supported' mask for all 5-slot EDR packet types */
3138                *p_pkt_type |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 + BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
3139        }
3140    }
3141}
3142