1/******************************************************************************
2 *
3 *  Copyright (C) 1999-2012 Broadcom Corporation
4 *
5 *  Licensed under the Apache License, Version 2.0 (the "License");
6 *  you may not use this file except in compliance with the License.
7 *  You may obtain a copy of the License at:
8 *
9 *  http://www.apache.org/licenses/LICENSE-2.0
10 *
11 *  Unless required by applicable law or agreed to in writing, software
12 *  distributed under the License is distributed on an "AS IS" BASIS,
13 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14 *  See the License for the specific language governing permissions and
15 *  limitations under the License.
16 *
17 ******************************************************************************/
18
19/******************************************************************************
20 *
21 *  This file contains functions that handle BTM interface functions for the
22 *  Bluetooth device including Rest, HCI buffer size and others
23 *
24 ******************************************************************************/
25
26#include <stdlib.h>
27#include <string.h>
28#include <stdio.h>
29#include <stddef.h>
30
31#include "bt_types.h"
32#include "bt_utils.h"
33#include "hcimsgs.h"
34#include "btu.h"
35#include "btm_int.h"
36#include "l2c_int.h"
37
38#if BLE_INCLUDED == TRUE
39#include "gatt_int.h"
40
41#endif /* BLE_INCLUDED */
42
43/* BTM_APP_DEV_INIT should be defined if additional controller initialization is
44**      needed by the application to be performed after the HCI reset
45*/
46#ifdef BTM_APP_DEV_INIT
47extern void BTM_APP_DEV_INIT(void);
48#endif
49
50#ifdef BTA_PRM_CHECK_FW_VER
51extern BOOLEAN BTA_PRM_CHECK_FW_VER(UINT8 *p);
52#endif
53
54#ifndef TT_DEV_RESET_MASK
55#define TT_DEV_RESET_MASK 0xff
56#endif
57
58/********************************************************************************/
59/*                 L O C A L    D A T A    D E F I N I T I O N S                */
60/********************************************************************************/
61
62/* The default class of device. */
63#ifndef BTM_INIT_CLASS_OF_DEVICE
64#define BTM_INIT_CLASS_OF_DEVICE    "\x00\x1F\x00"
65#endif
66
67#ifndef BTM_DEV_RESET_TIMEOUT
68#define BTM_DEV_RESET_TIMEOUT   4
69#endif
70
71#define BTM_DEV_REPLY_TIMEOUT   2    /* 1 second expiration time is not good. Timer may start between 0 and 1 second. */
72                                     /* if it starts at the very end of the 0 second, timer will expire really easily. */
73
74#define BTM_INFO_TIMEOUT        5   /* 5 seconds for info response */
75
76/* After Reset a timeout can be specified in the target.h for specific targets
77 * that may require additional time to reset
78 * otherwise no timeout is required
79*/
80#ifndef BTM_AFTER_RESET_TIMEOUT
81#define BTM_AFTER_RESET_TIMEOUT 0
82#endif
83
84/* Internal baseband so the parameters such as local features, version etc. are known
85so there is no need to issue HCI commands and wait for responses at BTM initialization */
86#ifndef BTM_INTERNAL_BB
87#define BTM_INTERNAL_BB FALSE
88#endif
89
90/* The local version information in the format specified in the HCI read local version
91response message */
92#ifndef BTM_INTERNAL_LOCAL_VER
93#define BTM_INTERNAL_LOCAL_VER {0x00, 0x01, 0x05, 0x81, 0x01, 0x30, 0x00, 0x40, 0x8D}
94#endif
95
96/* The local features information in the format specified in the HCI read local features
97response message */
98#ifndef BTM_INTERNAL_LOCAL_FEA
99#define BTM_INTERNAL_LOCAL_FEA {0x00, 0xFF, 0xF9, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00}
100#endif
101
102#ifndef BTM_SET_DEV_NAME_UPON_RESET
103#define BTM_SET_DEV_NAME_UPON_RESET TRUE
104#endif
105
106/* host SCO buffer size */
107#ifndef BTM_SCO_HOST_BUF_SIZE
108#define BTM_SCO_HOST_BUF_SIZE       0xff
109#endif
110
111/********************************************************************************/
112/*              L O C A L    F U N C T I O N     P R O T O T Y P E S            */
113/********************************************************************************/
114static void btm_dev_reset (void);
115static void btm_after_reset_hold_complete (void);
116static void btm_continue_reset (void);
117
118static void btm_get_local_ext_features (UINT8 page_number);
119static void btm_decode_ext_features_page (UINT8 page_number, const BD_FEATURES p_features);
120static void btm_read_all_lmp_features_complete (UINT8 max_page_number);
121static void btm_set_lmp_features_host_may_support (UINT8 max_page_number);
122static void btm_get_local_features (void);
123static void btm_issue_host_support_for_lmp_features (void);
124static void btm_read_local_supported_cmds (UINT8 local_controller_id);
125
126#if BLE_INCLUDED == TRUE
127static void btm_read_ble_local_supported_features (void);
128#endif
129
130/*******************************************************************************
131**
132** Function         btm_dev_init
133**
134** Description      This function is on the BTM startup
135**
136** Returns          void
137**
138*******************************************************************************/
139void btm_dev_init (void)
140{
141#if 0  /* cleared in btm_init; put back in if called from anywhere else! */
142    memset (&btm_cb.devcb, 0, sizeof (tBTM_DEVCB));
143#endif
144
145    /* Initialize nonzero defaults */
146#if (BTM_MAX_LOC_BD_NAME_LEN > 0)
147    memset(btm_cb.cfg.bd_name, 0, sizeof(tBTM_LOC_BD_NAME));
148#endif
149
150    btm_cb.devcb.reset_timer.param  = (TIMER_PARAM_TYPE)TT_DEV_RESET;
151    btm_cb.devcb.rln_timer.param    = (TIMER_PARAM_TYPE)TT_DEV_RLN;
152    btm_cb.devcb.rlinkp_timer.param = (TIMER_PARAM_TYPE)TT_DEV_RLNKP;
153
154    btm_cb.btm_acl_pkt_types_supported = BTM_ACL_PKT_TYPES_MASK_DH1 + BTM_ACL_PKT_TYPES_MASK_DM1 +
155                                         BTM_ACL_PKT_TYPES_MASK_DH3 + BTM_ACL_PKT_TYPES_MASK_DM3 +
156                                         BTM_ACL_PKT_TYPES_MASK_DH5 + BTM_ACL_PKT_TYPES_MASK_DM5;
157
158    btm_cb.btm_sco_pkt_types_supported = BTM_SCO_PKT_TYPES_MASK_HV1 +
159                                         BTM_SCO_PKT_TYPES_MASK_HV2 +
160                                         BTM_SCO_PKT_TYPES_MASK_HV3 +
161                                         BTM_SCO_PKT_TYPES_MASK_EV3 +
162                                         BTM_SCO_PKT_TYPES_MASK_EV4 +
163                                         BTM_SCO_PKT_TYPES_MASK_EV5;
164
165    btm_cb.first_disabled_channel = 0xff; /* To allow disabling 0th channel alone */
166    btm_cb.last_disabled_channel = 0xff; /* To allow disabling 0th channel alone */
167
168#if (BTM_AUTOMATIC_HCI_RESET == TRUE)
169
170#if (BTM_FIRST_RESET_DELAY > 0)
171    btm_cb.devcb.state = BTM_DEV_STATE_WAIT_RESET_CMPLT;
172    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_FIRST_RESET_DELAY);
173#else
174    btm_dev_reset();
175#endif
176
177#else
178   BTM_TRACE_EVENT ("BTM_AUTOMATIC_HCI_RESET is FALSE, so skip btm reset for now");
179#endif
180
181}
182
183
184/*******************************************************************************
185**
186** Function         btm_db_reset
187**
188** Description      This function is called by BTM_DeviceReset and clears out any
189**                  pending callbacks for inquiries, discoveries, other pending
190**                  functions that may be in progress.
191**
192** Returns          void
193**
194*******************************************************************************/
195static void btm_db_reset (void)
196{
197    tBTM_CMPL_CB    *p_cb;
198    tBTM_STATUS      status = BTM_DEV_RESET;
199
200    btm_inq_db_reset();
201
202    if (btm_cb.devcb.p_rln_cmpl_cb)
203    {
204        p_cb = btm_cb.devcb.p_rln_cmpl_cb;
205        btm_cb.devcb.p_rln_cmpl_cb = NULL;
206
207        if (p_cb)
208            (*p_cb)((void *) NULL);
209    }
210
211    if (btm_cb.devcb.p_rlinkp_cmpl_cb)
212    {
213        p_cb = btm_cb.devcb.p_rlinkp_cmpl_cb;
214        btm_cb.devcb.p_rlinkp_cmpl_cb = NULL;
215
216        if (p_cb)
217            (*p_cb)((void *) &status);
218    }
219
220    if (btm_cb.devcb.p_rssi_cmpl_cb)
221    {
222        p_cb = btm_cb.devcb.p_rssi_cmpl_cb;
223        btm_cb.devcb.p_rssi_cmpl_cb = NULL;
224
225        if (p_cb)
226            (*p_cb)((tBTM_RSSI_RESULTS *) &status);
227    }
228}
229
230
231
232/*******************************************************************************
233**
234** Function         btm_dev_absent
235**
236** Description      This function is called by when it is detected that the
237**                  device is not connected any more.
238**
239** Returns          void
240**
241*******************************************************************************/
242void btm_dev_absent (void)
243{
244    btm_cb.devcb.state = BTM_DEV_STATE_WAIT_RESET_CMPLT;
245
246    btm_db_reset ();
247    btm_inq_db_reset();
248
249    /* If anyone wants device status notifications, give him one */
250    btm_report_device_status (BTM_DEV_STATUS_DOWN);
251
252    btu_stop_timer (&btm_cb.devcb.reset_timer);
253}
254
255
256/*******************************************************************************
257**
258** Function         BTM_DeviceReset
259**
260** Description      This function is called to reset the HCI.  Callback function
261**                  if provided is called when startup of the device is
262**                  completed.
263**
264** Returns          void
265**
266*******************************************************************************/
267void BTM_DeviceReset (tBTM_CMPL_CB *p_cb)
268{
269    tBTM_STATUS status;
270
271    /* If device is already resetting, do not allow another */
272    if ((!btm_cb.devcb.p_reset_cmpl_cb) || (btm_cb.devcb.p_reset_cmpl_cb == p_cb))
273    {
274        /* Flush all ACL connections */
275        btm_acl_device_down();
276
277        /* Clear the callback, so application would not hang on reset */
278        btm_db_reset();
279
280        /* Save address of the completion routine, if provided */
281        btm_cb.devcb.p_reset_cmpl_cb = p_cb;
282
283        btm_dev_reset ();
284    }
285    else
286    {
287        /* pass an error to the bad callback, another one was already provided */
288        if (p_cb)
289        {
290            status = BTM_ILLEGAL_VALUE;
291            p_cb (&status);
292        }
293    }
294}
295
296
297/*******************************************************************************
298**
299** Function         BTM_IsDeviceUp
300**
301** Description      This function is called to check if the device is up.
302**
303** Returns          TRUE if device is up, else FALSE
304**
305*******************************************************************************/
306BOOLEAN BTM_IsDeviceUp (void)
307{
308    return ((BOOLEAN) (btm_cb.devcb.state == BTM_DEV_STATE_READY));
309}
310
311/*******************************************************************************
312**
313** Function         BTM_SetAfhChannels
314**
315** Description      This function is called disable channels
316**
317** Returns          tBTM_STATUS
318**
319*******************************************************************************/
320tBTM_STATUS BTM_SetAfhChannels (UINT8 first, UINT8 last)
321{
322    BTM_TRACE_API ("BTM_SetAfhChannels first: %d (%d) last: %d (%d)",
323                       first, btm_cb.first_disabled_channel, last,
324                       btm_cb.last_disabled_channel);
325
326    /* Make sure the local device supports the feature before sending */
327    if ((!HCI_LMP_AFH_CAP_MASTR_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]))   &&
328        (!HCI_LMP_AFH_CLASS_SLAVE_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0])) &&
329        (!HCI_LMP_AFH_CLASS_MASTR_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0])))
330        return (BTM_MODE_UNSUPPORTED);
331
332    if (!BTM_IsDeviceUp())
333        return (BTM_WRONG_MODE);
334
335    if ((btm_cb.first_disabled_channel != first)
336     || (btm_cb.last_disabled_channel  != last))
337    {
338        if (btsnd_hcic_set_afh_channels (first, last))
339        {
340            btm_cb.first_disabled_channel = first;
341            btm_cb.last_disabled_channel  = last;
342        }
343        else
344            return (BTM_NO_RESOURCES);
345    }
346    return (BTM_SUCCESS);
347}
348
349/*******************************************************************************
350**
351** Function         BTM_SetAfhChannelAssessment
352**
353** Description      This function is called to set the channel assessment mode on or off
354**
355** Returns          none
356**
357*******************************************************************************/
358tBTM_STATUS BTM_SetAfhChannelAssessment (BOOLEAN enable_or_disable)
359{
360    /* whatever app wants if device is not 1.2 scan type should be STANDARD */
361    if (!HCI_LMP_AFH_CAP_SLAVE_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
362     return (BTM_MODE_UNSUPPORTED);
363
364    if (!btsnd_hcic_write_afh_channel_assessment_mode (enable_or_disable))
365        return (BTM_NO_RESOURCES);
366
367    return (BTM_SUCCESS);
368}
369
370/*******************************************************************************
371**
372** Function         BTM_ContinueReset
373**
374** Description      This function is called by the application to continue
375**                  initialization after the application has completed its
376**                  vendor specific sequence.  It is only used when
377**                  BTM_APP_DEV_INIT is defined in target.h.
378**
379** Returns          void
380**
381*******************************************************************************/
382void BTM_ContinueReset (void)
383{
384#ifdef BTM_APP_DEV_INIT
385    btm_continue_reset();
386#endif
387}
388
389/*******************************************************************************
390**
391** Function         btm_dev_reset
392**
393** Description      Local function called to send a reset command
394**
395** Returns          void
396**
397*******************************************************************************/
398static void btm_dev_reset (void)
399{
400    btm_cb.devcb.state = BTM_DEV_STATE_WAIT_RESET_CMPLT;
401
402    /* flush out the command complete queue and command transmit queue */
403    btu_hcif_flush_cmd_queue();
404
405    /* Start reset timer.  When timer expires we will send first command */
406    /* from the setup sequence */
407
408    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL,
409                     BTM_DEV_RESET_TIMEOUT);
410    btsnd_hcic_reset (LOCAL_BR_EDR_CONTROLLER_ID);
411}
412
413
414/*******************************************************************************
415**
416** Function         btm_get_hci_buf_size
417**
418** Description      Local function called to send a read buffer size command
419**
420** Returns          void
421**
422*******************************************************************************/
423void btm_get_hci_buf_size (void)
424{
425
426    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
427
428    /* Send a Read Buffer Size message to the Host Controller. */
429    btsnd_hcic_read_buffer_size ();
430
431}
432#if BLE_INCLUDED == TRUE
433/*******************************************************************************
434**
435** Function         btm_read_ble_wl_size
436**
437** Description      Local function called to send a read BLE buffer size command
438**
439** Returns          void
440**
441*******************************************************************************/
442void btm_read_ble_wl_size(void)
443{
444    BTM_TRACE_DEBUG("btm_read_ble_wl_size ");
445    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
446
447    /* Send a Read Buffer Size message to the Host Controller. */
448    btsnd_hcic_ble_read_white_list_size();
449}
450/*******************************************************************************
451**
452** Function         btm_get_ble_buffer_size
453**
454** Description      Local function called to send a read BLE buffer size command
455**
456** Returns          void
457**
458*******************************************************************************/
459void btm_get_ble_buffer_size(void)
460{
461    BTM_TRACE_DEBUG("btm_get_ble_buffer_size ");
462    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
463
464    /* Send a Read Buffer Size message to the Host Controller. */
465    btsnd_hcic_ble_read_buffer_size ();
466}
467
468/*******************************************************************************
469**
470** Function         btm_read_ble_local_supported_features
471**
472** Description      Local function called to send a read BLE local supported
473**                  features command
474**
475** Returns          void
476**
477*******************************************************************************/
478static void btm_read_ble_local_supported_features(void)
479{
480    BTM_TRACE_DEBUG("btm_read_ble_local_supported_features ");
481    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
482
483    /* Send a Read Local Supported Features message to the Host Controller. */
484    btsnd_hcic_ble_read_local_spt_feat ();
485}
486
487/*******************************************************************************
488**
489** Function         btm_read_ble_local_supported_states
490**
491** Description      Local function called to send a read BLE local supported
492**                  features command
493**
494** Returns          void
495**
496*******************************************************************************/
497static void btm_read_ble_local_supported_states(void)
498{
499    BTM_TRACE_DEBUG("btm_read_ble_local_supported_states ");
500    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
501
502    /* Send a Read Local Supported states message to the Host Controller. */
503    btsnd_hcic_ble_read_supported_states ();
504}
505#endif
506/*******************************************************************************
507**
508** Function         btm_get_local_version
509**
510** Description      Local function called to send a read local version to controller
511**
512** Returns          void
513**
514*******************************************************************************/
515void btm_get_local_version (void)
516{
517
518    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
519
520    /* Send a Read Local Version message to the Host Controller. */
521    btsnd_hcic_read_local_ver (LOCAL_BR_EDR_CONTROLLER_ID);
522    btsnd_hcic_read_bd_addr ();
523
524#if BTM_PWR_MGR_INCLUDED == TRUE
525        btm_pm_reset();
526#endif
527
528}
529
530/*******************************************************************************
531**
532** Function         btm_read_local_supported_cmds
533**
534** Description      Local function called to send a read local supported commands
535**
536** Returns          void
537**
538*******************************************************************************/
539static void btm_read_local_supported_cmds (UINT8 local_controller_id)
540{
541    BTM_TRACE_DEBUG("Start reading local supported commands");
542
543    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
544
545    btsnd_hcic_read_local_supported_cmds(local_controller_id);
546}
547
548/*******************************************************************************
549**
550** Function         btm_get_local_features
551**
552** Description      Local function called to send a read local features
553**
554** Returns          void
555**
556*******************************************************************************/
557static void btm_get_local_features (void)
558{
559    /* If this BT controller supports Read Extended Feature */
560    if (btm_cb.devcb.local_version.hci_version >= HCI_PROTO_VERSION_2_0)
561    {
562        btm_get_local_ext_features(HCI_EXT_FEATURES_PAGE_0);
563    }
564    /* else, if this is a very old BT controller */
565    else
566{
567    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
568
569        /* Just read the basic features (legacy HCI command) */
570    btsnd_hcic_read_local_features ();
571}
572}
573
574/*******************************************************************************
575**
576** Function         btm_get_local_ext_features
577**
578** Description      Local function called to send a read local extended features
579**
580** Returns          void
581**
582*******************************************************************************/
583static void btm_get_local_ext_features (UINT8 page_number)
584{
585    btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
586
587    btsnd_hcic_read_local_ext_features(page_number);
588}
589
590/*******************************************************************************
591**
592** Function         btm_dev_timeout
593**
594** Description      This function is called when a timer list entry expires.
595**
596** Returns          void
597**
598*******************************************************************************/
599void btm_dev_timeout (TIMER_LIST_ENT  *p_tle)
600{
601    TIMER_PARAM_TYPE timer_type = (TIMER_PARAM_TYPE)p_tle->param;
602
603    if ((timer_type & TT_DEV_RESET_MASK) == TT_DEV_RESET)
604    {
605        /* Call device reset as long as there is timeout*/
606        btm_dev_reset();
607    }
608    else if (timer_type == (TIMER_PARAM_TYPE)TT_DEV_RLN)
609    {
610        tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_rln_cmpl_cb;
611
612        btm_cb.devcb.p_rln_cmpl_cb = NULL;
613
614        if (p_cb)
615            (*p_cb)((void *) NULL);
616    }
617}
618
619/*******************************************************************************
620**
621** Function         btm_reset_complete
622**
623** Description      This function is called when command complete for HCI_Reset
624**                  is received.  It does not make sense to send next command
625**                  because device is resetting after command complete is
626**                  received.  Just start timer and set required state.
627**
628** Returns          void
629**
630*******************************************************************************/
631void btm_reset_complete (void)
632{
633    int devinx;
634
635    BTM_TRACE_EVENT ("btm_reset_complete");
636
637    /* Handle if btm initiated the reset */
638    if (btm_cb.devcb.state == BTM_DEV_STATE_WAIT_RESET_CMPLT)
639    {
640        /* Tell L2CAP that all connections are gone */
641        l2cu_device_reset ();
642
643        /* Clear current security state */
644        for (devinx = 0; devinx < BTM_SEC_MAX_DEVICE_RECORDS; devinx++)
645        {
646            btm_cb.sec_dev_rec[devinx].sec_state = BTM_SEC_STATE_IDLE;
647        }
648
649        /* After the reset controller should restore all parameters to defaults. */
650        btm_cb.btm_inq_vars.inq_counter       = 1;
651        btm_cb.btm_inq_vars.inq_scan_window   = HCI_DEF_INQUIRYSCAN_WINDOW;
652        btm_cb.btm_inq_vars.inq_scan_period   = HCI_DEF_INQUIRYSCAN_INTERVAL;
653        btm_cb.btm_inq_vars.inq_scan_type     = HCI_DEF_SCAN_TYPE;
654
655        btm_cb.btm_inq_vars.page_scan_window  = HCI_DEF_PAGESCAN_WINDOW;
656        btm_cb.btm_inq_vars.page_scan_period  = HCI_DEF_PAGESCAN_INTERVAL;
657        btm_cb.btm_inq_vars.page_scan_type    = HCI_DEF_SCAN_TYPE;
658
659#if (BTM_AFTER_RESET_TIMEOUT > 0)
660        btu_start_timer (&btm_cb.devcb.reset_timer, BTU_TTYPE_BTM_DEV_CTL,
661                         BTM_AFTER_RESET_TIMEOUT);
662#else
663        btm_cb.devcb.state = BTM_DEV_STATE_WAIT_AFTER_RESET;
664        btm_after_reset_hold_complete();
665#endif
666
667#if (BLE_INCLUDED == TRUE)
668     btm_cb.ble_ctr_cb.conn_state = BLE_CONN_IDLE;
669     btm_cb.ble_ctr_cb.bg_dev_num = 0;
670     btm_cb.ble_ctr_cb.bg_conn_type = BTM_BLE_CONN_NONE;
671     btm_cb.ble_ctr_cb.p_select_cback = NULL;
672     memset(&btm_cb.ble_ctr_cb.bg_dev_list, 0, (sizeof(tBTM_LE_BG_CONN_DEV)*BTM_BLE_MAX_BG_CONN_DEV_NUM));
673     gatt_reset_bgdev_list();
674#endif
675    }
676}
677
678/*******************************************************************************
679**
680** Function         btm_continue_reset
681**
682** Description      This function is called when wait period expired after
683**                  device reset or called by the application to continue
684**                  initialization after the application has completed its
685**                  vendor specific sequence.
686**
687** Returns          void
688**
689*******************************************************************************/
690void btm_continue_reset (void)
691{
692
693    /* Reinitialize the default class of device */
694#if BTM_INTERNAL_BB == TRUE
695    btsnd_hcic_read_bd_addr ();
696#if BTM_PWR_MGR_INCLUDED == TRUE
697    btm_pm_reset();
698#endif
699#endif
700
701    btm_get_hci_buf_size ();
702
703    /* default device class */
704    BTM_SetDeviceClass((UINT8 *) BTM_INIT_CLASS_OF_DEVICE);
705
706#if (BTM_MAX_LOC_BD_NAME_LEN > 0) && (BTM_SET_DEV_NAME_UPON_RESET == TRUE)
707    BTM_SetLocalDeviceName(btm_cb.cfg.bd_name);
708#endif
709
710    BTM_SetPinType (btm_cb.cfg.pin_type, btm_cb.cfg.pin_code, btm_cb.cfg.pin_code_len);
711}
712
713/*******************************************************************************
714**
715** Function         btm_after_reset_hold_complete
716**
717** Description      This function is called when wait period expired after
718**                  device reset.  Continue intitialization
719**
720** Returns          void
721**
722*******************************************************************************/
723void btm_after_reset_hold_complete (void)
724{
725#ifdef BTM_APP_DEV_INIT
726    btu_stop_timer(&btm_cb.devcb.reset_timer);
727    BTM_APP_DEV_INIT();
728#else
729    btm_continue_reset();
730#endif
731}
732
733
734/*******************************************************************************
735**
736** Function         btm_read_hci_buf_size_complete
737**
738** Description      This function is called when command complete for
739**                  get HCI buffer size is received.  Start timer and send
740**                  read local features request
741**
742** Returns          void
743**
744*******************************************************************************/
745void btm_read_hci_buf_size_complete (UINT8 *p, UINT16 evt_len)
746{
747    UINT8       status;
748    UINT8       lm_sco_buf_size;
749    UINT16      lm_num_acl_bufs;
750    UINT16      lm_num_sco_bufs;
751    UINT16      acl_buf_size;
752    UNUSED(evt_len);
753
754    STREAM_TO_UINT8  (status, p);
755    if (status == HCI_SUCCESS)
756    {
757        STREAM_TO_UINT16 (btu_cb.hcit_acl_data_size, p);
758        STREAM_TO_UINT8  (lm_sco_buf_size,   p);
759        STREAM_TO_UINT16 (lm_num_acl_bufs,   p);
760        STREAM_TO_UINT16 (lm_num_sco_bufs,   p);
761
762        btu_cb.hcit_acl_pkt_size = btu_cb.hcit_acl_data_size + HCI_DATA_PREAMBLE_SIZE;
763
764        l2c_link_processs_num_bufs (lm_num_acl_bufs);
765
766#if BTM_ACL_BUF_SIZE > 0
767        acl_buf_size = (BTM_ACL_BUF_SIZE < L2CAP_MTU_SIZE) ? BTM_ACL_BUF_SIZE : L2CAP_MTU_SIZE;
768#else
769        acl_buf_size = L2CAP_MTU_SIZE;
770#endif
771        /* Tell the controller what our buffer sizes are. ?? Need SCO info */
772        btsnd_hcic_set_host_buf_size (acl_buf_size, BTM_SCO_HOST_BUF_SIZE, L2CAP_HOST_FC_ACL_BUFS, 10);
773
774#if L2CAP_HOST_FLOW_CTRL == TRUE
775        btsnd_hcic_set_host_flow_ctrl (HCI_HOST_FLOW_CTRL_ACL_ON);
776#endif
777    }
778
779    /* Set the device into connectable and/or discoverable mode (if configured to do so) */
780#if BTM_IS_CONNECTABLE == TRUE
781    (void) BTM_SetConnectability (BTM_CONNECTABLE, BTM_DEFAULT_CONN_WINDOW, BTM_DEFAULT_CONN_INTERVAL);
782#endif
783
784#if BTM_IS_DISCOVERABLE == TRUE
785    (void) BTM_SetDiscoverability (BTM_DEFAULT_DISC_MODE, BTM_DEFAULT_DISC_WINDOW, BTM_DEFAULT_DISC_INTERVAL);
786#endif
787
788#if BTM_INTERNAL_BB == TRUE
789    {
790        UINT8 buf[9] = BTM_INTERNAL_LOCAL_VER;
791        btm_read_local_version_complete( buf, 9 );
792    }
793#else
794    btm_get_local_version ();
795#endif
796}
797
798#if (BLE_INCLUDED == TRUE)
799/*******************************************************************************
800**
801** Function         btm_read_ble_buf_size_complete
802**
803** Description      This function is called when command complete for
804**                  get HCI buffer size is received.  Start timer and send
805**                  read local supported features request
806**
807** Returns          void
808**
809*******************************************************************************/
810void btm_read_ble_buf_size_complete (UINT8 *p, UINT16 evt_len)
811{
812    UINT8       status;
813    UINT16      lm_num_le_bufs;
814    UNUSED(evt_len);
815
816    BTM_TRACE_DEBUG("btm_read_ble_buf_size_complete ");
817    STREAM_TO_UINT8  (status, p);
818    if (status == HCI_SUCCESS)
819    {
820        STREAM_TO_UINT16 (btu_cb.hcit_ble_acl_data_size, p);
821        STREAM_TO_UINT8 (lm_num_le_bufs,   p);
822
823        if (btu_cb.hcit_ble_acl_data_size == 0)
824            btu_cb.hcit_ble_acl_data_size = btu_cb.hcit_acl_data_size;
825
826        btu_cb.hcit_ble_acl_pkt_size = btu_cb.hcit_ble_acl_data_size + HCI_DATA_PREAMBLE_SIZE;
827
828        l2c_link_processs_ble_num_bufs (lm_num_le_bufs);
829    }
830    btm_read_ble_local_supported_states();
831}
832/*******************************************************************************
833**
834** Function         btm_read_ble_local_supported_states_complete
835**
836** Description      This function is called when command complete for
837**                  Read LE Local Supported states complete is received.
838**
839** Returns          void
840**
841*******************************************************************************/
842void btm_read_ble_local_supported_states_complete (UINT8 *p, UINT16 evt_len)
843{
844    UINT8       status;
845
846    UNUSED(evt_len);
847    BTM_TRACE_DEBUG("btm_read_ble_local_supported_states_complete ");
848
849    btu_stop_timer (&btm_cb.devcb.reset_timer);
850
851    STREAM_TO_UINT8  (status, p);
852    if (status == HCI_SUCCESS)
853    {
854        STREAM_TO_ARRAY(&btm_cb.devcb.le_supported_states, p, BTM_LE_SUPPORT_STATE_SIZE);
855    }
856    else
857    {
858        BTM_TRACE_WARNING ("btm_read_ble_local_supported_features_complete status = %d", status);
859    }
860
861    btm_read_ble_local_supported_features();
862}
863
864/*******************************************************************************
865**
866** Function         btm_read_ble_local_supported_features_complete
867**
868** Description      This function is called when command complete for
869**                  Read LE Local Supported Features is received.  Start timer and send
870**                  read LMP local features request
871**
872** Returns          void
873**
874*******************************************************************************/
875void btm_read_ble_local_supported_features_complete (UINT8 *p, UINT16 evt_len)
876{
877    UINT8       status;
878    UNUSED(evt_len);
879
880    BTM_TRACE_DEBUG("btm_read_ble_local_supported_features_complete ");
881
882    btu_stop_timer (&btm_cb.devcb.reset_timer);
883
884    STREAM_TO_UINT8  (status, p);
885    if (status == HCI_SUCCESS)
886    {
887        STREAM_TO_ARRAY(&btm_cb.devcb.local_le_features, p, HCI_FEATURE_BYTES_PER_PAGE);
888    }
889    else
890    {
891        BTM_TRACE_WARNING ("btm_read_ble_local_supported_features_complete status = %d", status);
892    }
893
894    btsnd_hcic_ble_set_evt_mask((UINT8 *)HCI_BLE_EVENT_MASK_DEF);
895
896#if BTM_INTERNAL_BB == TRUE
897    {
898        UINT8 buf[9] = BTM_INTERNAL_LOCAL_FEA;
899        btm_read_local_features_complete( buf, 9 );
900    }
901#else
902
903    /* get local feature if BRCM specific feature is not included  */
904    btm_reset_ctrlr_complete();
905#endif
906
907}
908
909/*******************************************************************************
910**
911** Function         btm_read_white_list_size_complete
912**
913** Description      This function read the current white list size.
914*******************************************************************************/
915void btm_read_white_list_size_complete(UINT8 *p, UINT16 evt_len)
916{
917    UINT8       status;
918    UNUSED(evt_len);
919
920    BTM_TRACE_DEBUG("btm_read_white_list_size_complete ");
921    STREAM_TO_UINT8  (status, p);
922
923    if (status == HCI_SUCCESS)
924    {
925        STREAM_TO_UINT8(btm_cb.ble_ctr_cb.max_filter_entries, p);
926        btm_cb.ble_ctr_cb.num_empty_filter = btm_cb.ble_ctr_cb.max_filter_entries;
927    }
928    /* write LE host support and simultatunous LE supported */
929    btsnd_hcic_ble_write_host_supported(BTM_BLE_HOST_SUPPORT, BTM_BLE_SIMULTANEOUS_HOST);
930
931    btm_get_ble_buffer_size();
932}
933
934#endif
935/*******************************************************************************
936**
937** Function         btm_read_local_version_complete
938**
939** Description      This function is called when local BD Addr read complete
940**                  message is received from the HCI.
941**
942** Returns          void
943**
944*******************************************************************************/
945void btm_read_local_version_complete (UINT8 *p, UINT16 evt_len)
946{
947    tBTM_VERSION_INFO   *p_vi = &btm_cb.devcb.local_version;
948    UINT8                status;
949    UNUSED(evt_len);
950
951#ifdef BTA_PRM_CHECK_FW_VER
952    if(BTA_PRM_CHECK_FW_VER(p))
953        return;
954#endif
955
956    STREAM_TO_UINT8  (status, p);
957    if (status == HCI_SUCCESS)
958    {
959
960        STREAM_TO_UINT8  (p_vi->hci_version, p);
961        STREAM_TO_UINT16 (p_vi->hci_revision, p);
962        STREAM_TO_UINT8  (p_vi->lmp_version, p);
963        STREAM_TO_UINT16 (p_vi->manufacturer, p);
964        STREAM_TO_UINT16 (p_vi->lmp_subversion, p);
965    }
966
967    if (p_vi->hci_version >= HCI_PROTO_VERSION_1_2)
968    {
969        btm_read_local_supported_cmds(LOCAL_BR_EDR_CONTROLLER_ID);
970    }
971    else
972    {
973        btm_get_local_features ();
974    }
975}
976
977/*******************************************************************************
978**
979** Function         btm_decode_ext_features_page
980**
981** Description      This function is decodes a features page.
982**
983** Returns          void
984**
985*******************************************************************************/
986static void btm_decode_ext_features_page (UINT8 page_number, const UINT8 *p_features)
987{
988    UINT8 last;
989    UINT8 first;
990
991    BTM_TRACE_DEBUG ("btm_decode_ext_features_page page: %d", page_number);
992    switch (page_number)
993    {
994    /* Extended (Legacy) Page 0 */
995    case HCI_EXT_FEATURES_PAGE_0:
996
997        /* Create ACL supported packet types mask */
998        btm_cb.btm_acl_pkt_types_supported = (BTM_ACL_PKT_TYPES_MASK_DH1 +
999                                              BTM_ACL_PKT_TYPES_MASK_DM1);
1000
1001        if (HCI_3_SLOT_PACKETS_SUPPORTED(p_features))
1002            btm_cb.btm_acl_pkt_types_supported |= (BTM_ACL_PKT_TYPES_MASK_DH3 +
1003                                                   BTM_ACL_PKT_TYPES_MASK_DM3);
1004
1005        if (HCI_5_SLOT_PACKETS_SUPPORTED(p_features))
1006            btm_cb.btm_acl_pkt_types_supported |= (BTM_ACL_PKT_TYPES_MASK_DH5 +
1007                                                   BTM_ACL_PKT_TYPES_MASK_DM5);
1008
1009        /* _NO_X_DXX masks are reserved before ver 2.0.
1010           Set them only for later versions of controller */
1011        if (btm_cb.devcb.local_version.hci_version >= HCI_PROTO_VERSION_2_0)
1012        {
1013            /* Add in EDR related ACL types */
1014            if (!HCI_EDR_ACL_2MPS_SUPPORTED(p_features))
1015            {
1016                btm_cb.btm_acl_pkt_types_supported |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH1 +
1017                                                       BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
1018                                                       BTM_ACL_PKT_TYPES_MASK_NO_2_DH5);
1019            }
1020
1021            if (!HCI_EDR_ACL_3MPS_SUPPORTED(p_features))
1022            {
1023                btm_cb.btm_acl_pkt_types_supported |= (BTM_ACL_PKT_TYPES_MASK_NO_3_DH1 +
1024                                                       BTM_ACL_PKT_TYPES_MASK_NO_3_DH3 +
1025                                                       BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
1026            }
1027
1028            /* Check to see if 3 and 5 slot packets are available */
1029            if (HCI_EDR_ACL_2MPS_SUPPORTED(p_features) ||
1030                HCI_EDR_ACL_3MPS_SUPPORTED(p_features))
1031            {
1032                if (!HCI_3_SLOT_EDR_ACL_SUPPORTED(p_features))
1033                    btm_cb.btm_acl_pkt_types_supported |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH3 +
1034                                                           BTM_ACL_PKT_TYPES_MASK_NO_3_DH3);
1035
1036                if (!HCI_5_SLOT_EDR_ACL_SUPPORTED(p_features))
1037                    btm_cb.btm_acl_pkt_types_supported |= (BTM_ACL_PKT_TYPES_MASK_NO_2_DH5 +
1038                                                           BTM_ACL_PKT_TYPES_MASK_NO_3_DH5);
1039            }
1040        }
1041
1042        BTM_TRACE_DEBUG("Local supported ACL packet types: 0x%04x",
1043                         btm_cb.btm_acl_pkt_types_supported);
1044
1045        /* Create (e)SCO supported packet types mask */
1046        btm_cb.btm_sco_pkt_types_supported = 0;
1047#if BTM_SCO_INCLUDED == TRUE
1048        btm_cb.sco_cb.esco_supported = FALSE;
1049#endif
1050        if (HCI_SCO_LINK_SUPPORTED(p_features))
1051        {
1052            btm_cb.btm_sco_pkt_types_supported = BTM_SCO_PKT_TYPES_MASK_HV1;
1053
1054            if (HCI_HV2_PACKETS_SUPPORTED(p_features))
1055                btm_cb.btm_sco_pkt_types_supported |= BTM_SCO_PKT_TYPES_MASK_HV2;
1056
1057            if (HCI_HV3_PACKETS_SUPPORTED(p_features))
1058                btm_cb.btm_sco_pkt_types_supported |= BTM_SCO_PKT_TYPES_MASK_HV3;
1059        }
1060
1061        if (HCI_ESCO_EV3_SUPPORTED(p_features))
1062            btm_cb.btm_sco_pkt_types_supported |= BTM_SCO_PKT_TYPES_MASK_EV3;
1063
1064        if (HCI_ESCO_EV4_SUPPORTED(p_features))
1065            btm_cb.btm_sco_pkt_types_supported |= BTM_SCO_PKT_TYPES_MASK_EV4;
1066
1067        if (HCI_ESCO_EV5_SUPPORTED(p_features))
1068            btm_cb.btm_sco_pkt_types_supported |= BTM_SCO_PKT_TYPES_MASK_EV5;
1069#if BTM_SCO_INCLUDED == TRUE
1070        if (btm_cb.btm_sco_pkt_types_supported & BTM_ESCO_LINK_ONLY_MASK)
1071        {
1072            btm_cb.sco_cb.esco_supported = TRUE;
1073
1074            /* Add in EDR related eSCO types */
1075            if (HCI_EDR_ESCO_2MPS_SUPPORTED(p_features))
1076            {
1077                if (!HCI_3_SLOT_EDR_ESCO_SUPPORTED(p_features))
1078                    btm_cb.btm_sco_pkt_types_supported |= BTM_SCO_PKT_TYPES_MASK_NO_2_EV5;
1079            }
1080            else
1081            {
1082                btm_cb.btm_sco_pkt_types_supported |= (BTM_SCO_PKT_TYPES_MASK_NO_2_EV3 +
1083                                                       BTM_SCO_PKT_TYPES_MASK_NO_2_EV5);
1084            }
1085
1086            if (HCI_EDR_ESCO_3MPS_SUPPORTED(p_features))
1087            {
1088                if (!HCI_3_SLOT_EDR_ESCO_SUPPORTED(p_features))
1089                    btm_cb.btm_sco_pkt_types_supported |= BTM_SCO_PKT_TYPES_MASK_NO_3_EV5;
1090            }
1091            else
1092            {
1093                btm_cb.btm_sco_pkt_types_supported |= (BTM_SCO_PKT_TYPES_MASK_NO_3_EV3 +
1094                                                       BTM_SCO_PKT_TYPES_MASK_NO_3_EV5);
1095            }
1096        }
1097#endif
1098
1099        BTM_TRACE_DEBUG("Local supported SCO packet types: 0x%04x",
1100                         btm_cb.btm_sco_pkt_types_supported);
1101
1102        /* Create Default Policy Settings */
1103        if (HCI_SWITCH_SUPPORTED(p_features))
1104            btm_cb.btm_def_link_policy |= HCI_ENABLE_MASTER_SLAVE_SWITCH;
1105        else
1106            btm_cb.btm_def_link_policy &= ~HCI_ENABLE_MASTER_SLAVE_SWITCH;
1107
1108        if (HCI_HOLD_MODE_SUPPORTED(p_features))
1109            btm_cb.btm_def_link_policy |= HCI_ENABLE_HOLD_MODE;
1110        else
1111            btm_cb.btm_def_link_policy &= ~HCI_ENABLE_HOLD_MODE;
1112
1113        if (HCI_SNIFF_MODE_SUPPORTED(p_features))
1114            btm_cb.btm_def_link_policy |= HCI_ENABLE_SNIFF_MODE;
1115        else
1116            btm_cb.btm_def_link_policy &= ~HCI_ENABLE_SNIFF_MODE;
1117
1118        if (HCI_PARK_MODE_SUPPORTED(p_features))
1119            btm_cb.btm_def_link_policy |= HCI_ENABLE_PARK_MODE;
1120        else
1121            btm_cb.btm_def_link_policy &= ~HCI_ENABLE_PARK_MODE;
1122
1123        btm_sec_dev_reset ();
1124#if ((BTM_EIR_SERVER_INCLUDED == TRUE)||(BTM_EIR_CLIENT_INCLUDED == TRUE))
1125        if (HCI_LMP_INQ_RSSI_SUPPORTED(p_features))
1126        {
1127            if (HCI_EXT_INQ_RSP_SUPPORTED(p_features))
1128                BTM_SetInquiryMode (BTM_INQ_RESULT_EXTENDED);
1129            else
1130                BTM_SetInquiryMode (BTM_INQ_RESULT_WITH_RSSI);
1131        }
1132#else
1133        if (HCI_LMP_INQ_RSSI_SUPPORTED(p_features))
1134            BTM_SetInquiryMode (BTM_INQ_RESULT_WITH_RSSI);
1135#endif
1136#if L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE
1137        if( HCI_NON_FLUSHABLE_PB_SUPPORTED(p_features))
1138            l2cu_set_non_flushable_pbf(TRUE);
1139        else
1140            l2cu_set_non_flushable_pbf(FALSE);
1141#endif
1142        BTM_SetPageScanType (BTM_DEFAULT_SCAN_TYPE);
1143        BTM_SetInquiryScanType (BTM_DEFAULT_SCAN_TYPE);
1144
1145        break;
1146
1147    /* Extended Page 1 */
1148    case HCI_EXT_FEATURES_PAGE_1:
1149        /* Nothing to do for page 1 */
1150        break;
1151
1152    /* Extended Page 2 */
1153    case HCI_EXT_FEATURES_PAGE_2:
1154        /* Nothing to do for page 2 */
1155        break;
1156
1157    default:
1158        BTM_TRACE_ERROR("btm_decode_ext_features_page page=%d unknown", page_number);
1159        break;
1160    }
1161}
1162
1163/*******************************************************************************
1164**
1165** Function         btm_reset_ctrlr_complete
1166**
1167** Description      This is the last step of BR/EDR controller startup sequence.
1168**
1169** Returns          void
1170**
1171*******************************************************************************/
1172void btm_reset_ctrlr_complete ()
1173{
1174    tBTM_DEVCB     *p_devcb = &btm_cb.devcb;
1175    tBTM_CMPL_CB   *p_cb = p_devcb->p_reset_cmpl_cb;
1176    BOOLEAN         found = FALSE;
1177    UINT8           i, j, max_page_number;
1178
1179    btu_stop_timer (&btm_cb.devcb.reset_timer);
1180
1181    /* find the highest feature page number which contains non-zero bits */
1182    for (i = HCI_EXT_FEATURES_PAGE_MAX; ; i--)
1183    {
1184        for (j = 0; j < HCI_FEATURE_BYTES_PER_PAGE; j++)
1185        {
1186            if (p_devcb->local_lmp_features[i][j] != 0)
1187            {
1188                found = TRUE;
1189                break;
1190            }
1191        }
1192        if (found || !i)
1193        {
1194             break;
1195        }
1196    }
1197
1198    if (!found)
1199        BTM_TRACE_WARNING ("btm_reset_ctrlr_complete: NONE of local controller features is set");
1200
1201    max_page_number = i;
1202
1203    BTM_TRACE_DEBUG ("btm_reset_ctrlr_complete: max_page_number: %d", max_page_number);
1204
1205    /*
1206    * Set State to Ready (needs to be done before btm_decode_ext_features_page
1207    * to allow it to send some HCI configuration commands)
1208    */
1209    p_devcb->state = BTM_DEV_STATE_READY;
1210
1211    /* For every received/saved feature page */
1212    for (i = 0; i <= max_page_number; i++)
1213    {
1214        /* Decode the saved Feature Page */
1215        btm_decode_ext_features_page(i, p_devcb->local_lmp_features[i]);
1216    }
1217
1218    /* If there was a callback address for reset complete, reset it */
1219    p_devcb->p_reset_cmpl_cb = NULL;
1220
1221    /* If anyone wants device status notifications, give him one */
1222    btm_report_device_status(BTM_DEV_STATUS_UP);
1223
1224    /* Reset sequence is complete. If this was an application originated */
1225    /* reset, tell him its done.                                         */
1226    if (p_cb)
1227        (*p_cb)((void *) NULL);
1228}
1229
1230/*******************************************************************************
1231**
1232** Function         btm_issue_host_support_for_lmp_features
1233**
1234** Description      This function:
1235**                  - issues commands to set host supported LMP features (one at
1236**                    a time);
1237**                  - after this is done it issues command to re-read LMP features
1238**                    page 1;
1239**                  - after this is done it calls the last step of BR/EDR
1240**                    controller startup sequence.
1241**
1242** Returns          void
1243**
1244*******************************************************************************/
1245static void btm_issue_host_support_for_lmp_features (void)
1246{
1247    BTM_TRACE_DEBUG("btm_issue_host_support_for_lmp_features lmp_features_host_may_support: 0x%02x", btm_cb.devcb.lmp_features_host_may_support);
1248
1249    if (btm_cb.devcb.lmp_features_host_may_support & BTM_HOST_MAY_SUPP_SSP)
1250    {
1251        btsnd_hcic_write_simple_pairing_mode(HCI_SP_MODE_ENABLED);
1252        return;
1253    }
1254
1255#if (BLE_INCLUDED == TRUE)
1256    if (btm_cb.devcb.lmp_features_host_may_support & BTM_HOST_MAY_SUPP_LE)
1257    {
1258        if (btm_cb.devcb.lmp_features_host_may_support & BTM_HOST_MAY_SUPP_SIMULT_BR_LE)
1259        {
1260            btsnd_hcic_ble_write_host_supported(BTM_BLE_HOST_SUPPORT, BTM_BLE_SIMULTANEOUS_HOST);
1261        }
1262        else
1263        {
1264            btsnd_hcic_ble_write_host_supported(BTM_BLE_HOST_SUPPORT, 0);
1265        }
1266        return;
1267    }
1268#endif
1269
1270    if (btm_cb.devcb.lmp_features_host_may_support & BTM_RE_READ_1ST_PAGE)
1271    {
1272        btm_get_local_ext_features(HCI_EXT_FEATURES_PAGE_1);
1273        return;
1274    }
1275
1276    if (!btm_cb.devcb.lmp_features_host_may_support)
1277    {
1278#if BLE_INCLUDED == TRUE
1279        if (HCI_LE_HOST_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_1]))
1280        {
1281            btm_read_ble_wl_size();
1282        }
1283        else
1284#elif BTM_INTERNAL_BB == TRUE
1285        {
1286            UINT8 buf[9] = BTM_INTERNAL_LOCAL_FEA;
1287            btm_read_local_features_complete( buf, 9 );
1288        }
1289#endif
1290        {
1291            btm_reset_ctrlr_complete();
1292        }
1293        return;
1294    }
1295
1296    BTM_TRACE_ERROR("%s lmp_features_host_may_support: 0x%02x. This is unexpected.",__FUNCTION__,
1297                      btm_cb.devcb.lmp_features_host_may_support);
1298}
1299
1300/*******************************************************************************
1301**
1302** Function         btm_set_lmp_features_host_may_support
1303**
1304** Description      This function is called after all LMP features provided by
1305**                  controller are read. It sets the mask that indicates LMP
1306**                  features the host may support based on LMP features supported
1307**                  by controller.
1308**                  Example:
1309**                  Host may set SSP (host support) bit only if SSP (controller
1310**                  support) bit is set by controller.
1311**
1312** Returns          void
1313**
1314*******************************************************************************/
1315static void btm_set_lmp_features_host_may_support (UINT8 max_page_number)
1316{
1317    btm_cb.devcb.lmp_features_host_may_support = 0;
1318
1319    /* LMP page 0 is always read */
1320    if (HCI_SIMPLE_PAIRING_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
1321    {
1322        /* host may support SSP */
1323        btm_cb.devcb.lmp_features_host_may_support |= BTM_HOST_MAY_SUPP_SSP;
1324    }
1325
1326#if (BLE_INCLUDED == TRUE)
1327    if (HCI_LE_SPT_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
1328    {
1329        /* host may support LE */
1330        btm_cb.devcb.lmp_features_host_may_support |= BTM_HOST_MAY_SUPP_LE;
1331
1332        if (HCI_SIMUL_LE_BREDR_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]))
1333        {
1334            /* host may support BR/EDR and LE simultaneously */
1335            btm_cb.devcb.lmp_features_host_may_support |= BTM_HOST_MAY_SUPP_SIMULT_BR_LE;
1336        }
1337    }
1338#endif
1339
1340    if (max_page_number >= HCI_EXT_FEATURES_PAGE_1)
1341    {
1342        /* nothing yet for HCI_EXT_FEATURES_PAGE_1 */
1343    }
1344
1345    if (max_page_number >= HCI_EXT_FEATURES_PAGE_1)
1346    {
1347        /* nothing yet for HCI_EXT_FEATURES_PAGE_2 */
1348    }
1349
1350    if (btm_cb.devcb.lmp_features_host_may_support)
1351        btm_cb.devcb.lmp_features_host_may_support |= BTM_RE_READ_1ST_PAGE;
1352}
1353
1354/*******************************************************************************
1355**
1356** Function         btm_read_all_lmp_features_complete
1357**
1358** Description      This function is called after all LMP features provided by
1359**                  controller are read.
1360**                  It works with controller supported LMP features which host
1361**                  may support too.
1362**
1363** Returns          void
1364**
1365*******************************************************************************/
1366static void btm_read_all_lmp_features_complete (UINT8 max_page_number)
1367{
1368    btm_set_lmp_features_host_may_support(max_page_number);
1369
1370    btm_issue_host_support_for_lmp_features();
1371}
1372
1373/*******************************************************************************
1374**
1375** Function         btm_read_local_features_complete
1376**
1377** Description      This function is called when local supported features read
1378**                  is complete.
1379**
1380** Returns          void
1381**
1382*******************************************************************************/
1383void btm_read_local_features_complete (UINT8 *p, UINT16 evt_len)
1384{
1385    tBTM_DEVCB     *p_devcb = &btm_cb.devcb;
1386    UINT8           status;
1387    UNUSED(evt_len);
1388
1389    btu_stop_timer (&p_devcb->reset_timer);
1390
1391    STREAM_TO_UINT8  (status, p);
1392    if (status == HCI_SUCCESS)
1393    {
1394        /* Save the Feature Page 0 */
1395        STREAM_TO_ARRAY(p_devcb->local_lmp_features[0],
1396                p, HCI_FEATURE_BYTES_PER_PAGE);
1397
1398        if ((HCI_LMP_EXTENDED_SUPPORTED(p_devcb->local_lmp_features[HCI_EXT_FEATURES_PAGE_0])) &&
1399            (HCI_READ_LOCAL_EXT_FEATURES_SUPPORTED(p_devcb->supported_cmds)))
1400        {
1401            /* if local controller has extended features and supports
1402            **HCI_Read_Local_Extended_Features command,
1403            ** then start reading these feature starting with extended features page 1 */
1404            BTM_TRACE_DEBUG ("Start reading local extended features");
1405            btm_get_local_ext_features(HCI_EXT_FEATURES_PAGE_1);
1406        }
1407        else
1408        {
1409            btm_read_all_lmp_features_complete (HCI_EXT_FEATURES_PAGE_0);
1410        }
1411    }
1412}
1413
1414/*******************************************************************************
1415**
1416** Function         btm_read_local_ext_features_complete
1417**
1418** Description      This function is called when read local extended features
1419**                  command complete message is received from the HCI.
1420**
1421** Returns          void
1422**
1423*******************************************************************************/
1424void btm_read_local_ext_features_complete (UINT8 *p, UINT16 evt_len)
1425{
1426    tBTM_DEVCB     *p_devcb = &btm_cb.devcb;
1427    tBTM_CMPL_CB   *p_cb = p_devcb->p_reset_cmpl_cb;
1428    UINT8           status;
1429    UINT8           page_number;
1430    UINT8           page_number_max;
1431    UNUSED(evt_len);
1432
1433    btu_stop_timer (&btm_cb.devcb.reset_timer);
1434
1435    STREAM_TO_UINT8 (status, p);
1436
1437    if (status != HCI_SUCCESS)
1438    {
1439        BTM_TRACE_WARNING("btm_read_local_ext_features_complete status = 0x%02X", status);
1440        btm_read_all_lmp_features_complete (HCI_EXT_FEATURES_PAGE_0);
1441        return;
1442    }
1443
1444    /* Extract Page number */
1445    STREAM_TO_UINT8  (page_number, p);
1446
1447    /* Extract Page number Max */
1448    STREAM_TO_UINT8  (page_number_max, p);
1449
1450    if (page_number > HCI_EXT_FEATURES_PAGE_MAX)
1451    {
1452        BTM_TRACE_ERROR("btm_read_local_ext_features_complete page=%d unknown",
1453                page_number);
1454        return;
1455    }
1456
1457    /* Save the extended features Page received */
1458    STREAM_TO_ARRAY(btm_cb.devcb.local_lmp_features[page_number],
1459            p, HCI_FEATURE_BYTES_PER_PAGE);
1460
1461    /* If this is re-read of the 1-st extended page after host supported LMP features are set */
1462    if ((page_number == HCI_EXT_FEATURES_PAGE_1) &&
1463        (btm_cb.devcb.lmp_features_host_may_support == BTM_RE_READ_1ST_PAGE))
1464    {
1465        btm_cb.devcb.lmp_features_host_may_support &= ~BTM_RE_READ_1ST_PAGE;
1466        btm_issue_host_support_for_lmp_features();
1467        return;
1468    }
1469
1470    /* If this is the last page supported by the local BT controller OR */
1471    /* if this is the last page supported by the Host */
1472    if ((page_number == page_number_max) ||
1473        (page_number == HCI_EXT_FEATURES_PAGE_MAX))
1474    {
1475        BTM_TRACE_DEBUG("BTM reached last extended features page (%d)", page_number);
1476        btm_read_all_lmp_features_complete(page_number);
1477    }
1478    /* Else (another page must be read) */
1479    else
1480    {
1481        /* Read the next features page */
1482        page_number++;
1483        BTM_TRACE_DEBUG("BTM reads next extended features page (%d)", page_number);
1484        btm_get_local_ext_features(page_number);
1485    }
1486}
1487
1488/*******************************************************************************
1489**
1490** Function         btm_read_local_supported_cmds_complete
1491**
1492** Description      This function is called when local supported commands read
1493**                  is complete.
1494**
1495** Returns          void
1496**
1497*******************************************************************************/
1498void btm_read_local_supported_cmds_complete (UINT8 *p)
1499{
1500    tBTM_DEVCB     *p_devcb = &btm_cb.devcb;
1501    UINT8           status;
1502
1503    btu_stop_timer (&(p_devcb->reset_timer));
1504
1505    STREAM_TO_UINT8  (status, p);
1506    BTM_TRACE_DEBUG("btm_read_local_supported_cmds_complete status (0x%02x)", status);
1507
1508    if (status == HCI_SUCCESS)
1509    {
1510        /* Save the supported commands bit mask */
1511        STREAM_TO_ARRAY(p_devcb->supported_cmds, p, HCI_NUM_SUPP_COMMANDS_BYTES);
1512    }
1513
1514    btm_get_local_features();
1515}
1516
1517/*******************************************************************************
1518**
1519** Function         btm_write_simple_paring_mode_complete
1520**
1521** Description      This function is called when the command complete message
1522**                  is received from the HCI for the write simple pairing mode
1523**                  command.
1524**
1525** Returns          void
1526**
1527*******************************************************************************/
1528void btm_write_simple_paring_mode_complete (UINT8 *p)
1529{
1530    UINT8   status;
1531
1532    STREAM_TO_UINT8 (status, p);
1533
1534    if (status != HCI_SUCCESS)
1535    {
1536        BTM_TRACE_WARNING("btm_write_simple_paring_mode_complete status: 0x%02x", status);
1537    }
1538
1539    if (btm_cb.devcb.lmp_features_host_may_support & BTM_HOST_MAY_SUPP_SSP)
1540    {
1541        btm_cb.devcb.lmp_features_host_may_support &= ~BTM_HOST_MAY_SUPP_SSP;
1542        btm_issue_host_support_for_lmp_features();
1543    }
1544}
1545
1546/*******************************************************************************
1547**
1548** Function         btm_write_le_host_supported_complete
1549**
1550** Description      This function is called when the command complete message
1551**                  is received from the HCI for the write LE host supported
1552**                  command.
1553**
1554** Returns          void
1555**
1556*******************************************************************************/
1557void btm_write_le_host_supported_complete (UINT8 *p)
1558{
1559    UINT8   status;
1560
1561    STREAM_TO_UINT8 (status, p);
1562
1563    if (status != HCI_SUCCESS)
1564    {
1565        BTM_TRACE_WARNING("btm_write_le_host_supported_complete status: 0x%02x", status);
1566    }
1567
1568    if (btm_cb.devcb.lmp_features_host_may_support & BTM_HOST_MAY_SUPP_LE)
1569    {
1570        btm_cb.devcb.lmp_features_host_may_support &= ~BTM_HOST_MAY_SUPP_LE;
1571        if (btm_cb.devcb.lmp_features_host_may_support & BTM_HOST_MAY_SUPP_SIMULT_BR_LE)
1572        {
1573            btm_cb.devcb.lmp_features_host_may_support &= ~BTM_HOST_MAY_SUPP_SIMULT_BR_LE;
1574        }
1575        btm_issue_host_support_for_lmp_features();
1576    }
1577}
1578
1579/*******************************************************************************
1580**
1581** Function         btm_get_voice_coding_support
1582**
1583** Description      This function is provides a way to get the voice coding schemes
1584**                  supported the device.
1585**
1586** Returns          A bit mask - Bit 0 if set indicates CVSD support
1587**                               Bit 1 if set indicates PCM A-law support
1588**                               Bit 2 if set indicates PCM Mu-law support
1589**
1590*******************************************************************************/
1591
1592UINT8 btm_get_voice_coding_support( void )
1593{
1594    UINT8 code = 0;
1595
1596    if( HCI_LMP_CVSD_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]) ) code |= 0x01 ;
1597    if( HCI_LMP_A_LAW_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]) ) code |= 0x02 ;
1598    if( HCI_LMP_U_LAW_SUPPORTED(btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]) )  code |= 0x04 ;
1599
1600    return code ;
1601}
1602
1603/*******************************************************************************
1604**
1605** Function         BTM_SetLocalDeviceName
1606**
1607** Description      This function is called to set the local device name.
1608**
1609** Returns          status of the operation
1610**
1611*******************************************************************************/
1612tBTM_STATUS BTM_SetLocalDeviceName (char *p_name)
1613{
1614    UINT8    *p;
1615
1616    if (!p_name || !p_name[0] || (strlen ((char *)p_name) > BD_NAME_LEN))
1617        return (BTM_ILLEGAL_VALUE);
1618
1619    if (btm_cb.devcb.state == BTM_DEV_STATE_WAIT_RESET_CMPLT ||
1620        btm_cb.devcb.state == BTM_DEV_STATE_WAIT_AFTER_RESET)
1621        return (BTM_DEV_RESET);
1622
1623#if BTM_MAX_LOC_BD_NAME_LEN > 0
1624    /* Save the device name if local storage is enabled */
1625    p = (UINT8 *)btm_cb.cfg.bd_name;
1626    if (p != (UINT8 *)p_name)
1627    {
1628        BCM_STRNCPY_S(btm_cb.cfg.bd_name, sizeof(btm_cb.cfg.bd_name), p_name, BTM_MAX_LOC_BD_NAME_LEN);
1629        btm_cb.cfg.bd_name[BTM_MAX_LOC_BD_NAME_LEN] = '\0';
1630    }
1631#else
1632    p = (UINT8 *)p_name;
1633#endif
1634
1635    if (btsnd_hcic_change_name(p))
1636        return (BTM_CMD_STARTED);
1637    else
1638        return (BTM_NO_RESOURCES);
1639}
1640
1641
1642
1643/*******************************************************************************
1644**
1645** Function         BTM_ReadLocalDeviceName
1646**
1647** Description      This function is called to read the local device name.
1648**
1649** Returns          status of the operation
1650**                  If success, BTM_SUCCESS is returned and p_name points stored
1651**                              local device name
1652**                  If BTM doesn't store local device name, BTM_NO_RESOURCES is
1653**                              is returned and p_name is set to NULL
1654**
1655*******************************************************************************/
1656tBTM_STATUS BTM_ReadLocalDeviceName (char **p_name)
1657{
1658#if BTM_MAX_LOC_BD_NAME_LEN > 0
1659    *p_name = btm_cb.cfg.bd_name;
1660    return(BTM_SUCCESS);
1661#else
1662    *p_name = NULL;
1663    return(BTM_NO_RESOURCES);
1664#endif
1665}
1666
1667
1668/*******************************************************************************
1669**
1670** Function         BTM_ReadLocalDeviceNameFromController
1671**
1672** Description      Get local device name from controller. Do not use cached
1673**                  name (used to get chip-id prior to btm reset complete).
1674**
1675** Returns          BTM_CMD_STARTED if successful, otherwise an error
1676**
1677*******************************************************************************/
1678tBTM_STATUS BTM_ReadLocalDeviceNameFromController (tBTM_CMPL_CB *p_rln_cmpl_cback)
1679{
1680    /* Check if rln already in progress */
1681    if (btm_cb.devcb.p_rln_cmpl_cb)
1682        return(BTM_NO_RESOURCES);
1683
1684    /* Save callback */
1685    btm_cb.devcb.p_rln_cmpl_cb = p_rln_cmpl_cback;
1686
1687    btsnd_hcic_read_name();
1688    btu_start_timer (&btm_cb.devcb.rln_timer, BTU_TTYPE_BTM_DEV_CTL, BTM_DEV_REPLY_TIMEOUT);
1689
1690    return BTM_CMD_STARTED;
1691}
1692
1693/*******************************************************************************
1694**
1695** Function         btm_read_local_name_complete
1696**
1697** Description      This function is called when local name read complete.
1698**                  message is received from the HCI.
1699**
1700** Returns          void
1701**
1702*******************************************************************************/
1703void btm_read_local_name_complete (UINT8 *p, UINT16 evt_len)
1704{
1705    tBTM_CMPL_CB   *p_cb = btm_cb.devcb.p_rln_cmpl_cb;
1706    UINT8           status;
1707    UNUSED(evt_len);
1708
1709    btu_stop_timer (&btm_cb.devcb.rln_timer);
1710
1711    /* If there was a callback address for read local name, call it */
1712    btm_cb.devcb.p_rln_cmpl_cb = NULL;
1713
1714    if (p_cb)
1715    {
1716        STREAM_TO_UINT8  (status, p);
1717
1718        if (status == HCI_SUCCESS)
1719            (*p_cb)(p);
1720        else
1721            (*p_cb)(NULL);
1722    }
1723}
1724
1725
1726/*******************************************************************************
1727**
1728** Function         BTM_GetLocalDeviceAddr
1729**
1730** Description      This function is called to read the local device address
1731**
1732** Returns          void
1733**                  the local device address is copied into bd_addr
1734**
1735*******************************************************************************/
1736void BTM_GetLocalDeviceAddr (BD_ADDR bd_addr)
1737{
1738    memcpy (bd_addr, btm_cb.devcb.local_addr, BD_ADDR_LEN);
1739}
1740
1741/*******************************************************************************
1742**
1743** Function         BTM_ReadLocalDeviceAddr
1744**
1745** Description      This function is called to read the local device address
1746**
1747** Returns          status of the operation
1748**
1749*******************************************************************************/
1750tBTM_STATUS BTM_ReadLocalDeviceAddr (tBTM_CMPL_CB *p_cb)
1751{
1752    if(p_cb)
1753        (*p_cb)(btm_cb.devcb.local_addr);
1754
1755    return (BTM_SUCCESS);
1756}
1757
1758
1759/*******************************************************************************
1760**
1761** Function         btm_read_local_addr_complete
1762**
1763** Description      This function is called when local BD Addr read complete
1764**                  message is received from the HCI.
1765**
1766** Returns          void
1767**
1768*******************************************************************************/
1769void btm_read_local_addr_complete (UINT8 *p, UINT16 evt_len)
1770{
1771    UINT8           status;
1772    UNUSED(evt_len);
1773
1774    STREAM_TO_UINT8  (status, p);
1775
1776    if (status == HCI_SUCCESS)
1777    {
1778        STREAM_TO_BDADDR (btm_cb.devcb.local_addr, p);
1779    }
1780}
1781
1782
1783/*******************************************************************************
1784**
1785** Function         BTM_ReadLocalVersion
1786**
1787** Description      This function is called to read the local device version
1788**
1789** Returns          status of the operation
1790**
1791*******************************************************************************/
1792tBTM_STATUS BTM_ReadLocalVersion (tBTM_VERSION_INFO *p_vers)
1793{
1794    /* Make sure the device has retrieved the info (not being reset) */
1795    if (btm_cb.devcb.state < BTM_DEV_STATE_READY)
1796        return (BTM_DEV_RESET);
1797
1798    *p_vers = btm_cb.devcb.local_version;
1799
1800    return (BTM_SUCCESS);
1801}
1802
1803
1804
1805
1806/*******************************************************************************
1807**
1808** Function         BTM_SetDeviceClass
1809**
1810** Description      This function is called to set the local device class
1811**
1812** Returns          status of the operation
1813**
1814*******************************************************************************/
1815tBTM_STATUS BTM_SetDeviceClass (DEV_CLASS dev_class)
1816{
1817    if(!memcmp (btm_cb.devcb.dev_class, dev_class, DEV_CLASS_LEN))
1818        return(BTM_SUCCESS);
1819
1820    memcpy (btm_cb.devcb.dev_class, dev_class, DEV_CLASS_LEN);
1821
1822    if (btm_cb.devcb.state == BTM_DEV_STATE_WAIT_RESET_CMPLT ||
1823        btm_cb.devcb.state == BTM_DEV_STATE_WAIT_AFTER_RESET)
1824        return (BTM_DEV_RESET);
1825
1826    if (!btsnd_hcic_write_dev_class (dev_class))
1827        return (BTM_NO_RESOURCES);
1828
1829    return (BTM_SUCCESS);
1830}
1831
1832
1833/*******************************************************************************
1834**
1835** Function         BTM_ReadDeviceClass
1836**
1837** Description      This function is called to read the local device class
1838**
1839** Returns          pointer to the device class
1840**
1841*******************************************************************************/
1842UINT8 *BTM_ReadDeviceClass (void)
1843{
1844    return ((UINT8 *)btm_cb.devcb.dev_class);
1845}
1846
1847
1848/*******************************************************************************
1849**
1850** Function         BTM_ReadLocalFeatures
1851**
1852** Description      This function is called to read the local features
1853**
1854** Returns          pointer to the local features string
1855**
1856*******************************************************************************/
1857UINT8 *BTM_ReadLocalFeatures (void)
1858{
1859    return (btm_cb.devcb.local_lmp_features[HCI_EXT_FEATURES_PAGE_0]);
1860}
1861
1862/*******************************************************************************
1863**
1864** Function         BTM_ReadLocalExtendedFeatures
1865**
1866** Description      This function is called to read the local extended features
1867**
1868** Returns          pointer to the local extended features mask or NULL if bad
1869**                  page
1870**
1871*******************************************************************************/
1872UINT8 *BTM_ReadLocalExtendedFeatures (UINT8 page_number)
1873{
1874    if (page_number <= HCI_EXT_FEATURES_PAGE_MAX)
1875        return (btm_cb.devcb.local_lmp_features[page_number]);
1876
1877    BTM_TRACE_ERROR("Warning: BTM_ReadLocalExtendedFeatures page %d unknown",
1878            page_number);
1879    return NULL;
1880}
1881
1882/*******************************************************************************
1883**
1884** Function         BTM_ReadBrcmFeatures
1885**
1886** Description      This function is called to read the Broadcom specific features
1887**
1888** Returns          pointer to the Broadcom features string
1889**
1890*******************************************************************************/
1891UINT8 *BTM_ReadBrcmFeatures (void)
1892{
1893    return (btm_cb.devcb.brcm_features);
1894}
1895
1896/*******************************************************************************
1897**
1898** Function         BTM_RegisterForDeviceStatusNotif
1899**
1900** Description      This function is called to register for device status
1901**                  change notifications.
1902**
1903**                  If one registration is already there calling function should
1904**                  save the pointer to the function that is return and
1905**                  call it when processing of the event is complete
1906**
1907** Returns          status of the operation
1908**
1909*******************************************************************************/
1910tBTM_DEV_STATUS_CB *BTM_RegisterForDeviceStatusNotif (tBTM_DEV_STATUS_CB *p_cb)
1911{
1912    tBTM_DEV_STATUS_CB *p_prev = btm_cb.devcb.p_dev_status_cb;
1913
1914    btm_cb.devcb.p_dev_status_cb = p_cb;
1915    return (p_prev);
1916}
1917
1918/*******************************************************************************
1919**
1920** Function         BTM_VendorSpecificCommand
1921**
1922** Description      Send a vendor specific HCI command to the controller.
1923**
1924** Returns
1925**      BTM_SUCCESS         Command sent. Does not expect command complete
1926**                              event. (command cmpl callback param is NULL)
1927**      BTM_CMD_STARTED     Command sent. Waiting for command cmpl event.
1928**
1929** Notes
1930**      Opcode will be OR'd with HCI_GRP_VENDOR_SPECIFIC.
1931**
1932*******************************************************************************/
1933tBTM_STATUS BTM_VendorSpecificCommand(UINT16 opcode, UINT8 param_len,
1934                                      UINT8 *p_param_buf, tBTM_VSC_CMPL_CB *p_cb)
1935{
1936    void *p_buf;
1937
1938    BTM_TRACE_EVENT ("BTM: BTM_VendorSpecificCommand: Opcode: 0x%04X, ParamLen: %i.",
1939                      opcode, param_len);
1940
1941    /* Allocate a buffer to hold HCI command plus the callback function */
1942    if ((p_buf = GKI_getbuf((UINT16)(sizeof(BT_HDR) + sizeof (tBTM_CMPL_CB *) +
1943                            param_len + HCIC_PREAMBLE_SIZE))) != NULL)
1944    {
1945        /* Send the HCI command (opcode will be OR'd with HCI_GRP_VENDOR_SPECIFIC) */
1946        btsnd_hcic_vendor_spec_cmd (p_buf, opcode, param_len, p_param_buf, (void *)p_cb);
1947
1948        /* Return value */
1949        if (p_cb != NULL)
1950            return (BTM_CMD_STARTED);
1951        else
1952            return (BTM_SUCCESS);
1953    }
1954    else
1955        return (BTM_NO_RESOURCES);
1956
1957}
1958
1959
1960/*******************************************************************************
1961**
1962** Function         btm_vsc_complete
1963**
1964** Description      This function is called when local HCI Vendor Specific
1965**                  Command complete message is received from the HCI.
1966**
1967** Returns          void
1968**
1969*******************************************************************************/
1970void btm_vsc_complete (UINT8 *p, UINT16 opcode, UINT16 evt_len,
1971                       tBTM_CMPL_CB *p_vsc_cplt_cback)
1972{
1973    tBTM_VSC_CMPL   vcs_cplt_params;
1974
1975    /* If there was a callback address for vcs complete, call it */
1976    if (p_vsc_cplt_cback)
1977    {
1978        /* Pass paramters to the callback function */
1979        vcs_cplt_params.opcode = opcode;        /* Number of bytes in return info */
1980        vcs_cplt_params.param_len = evt_len;    /* Number of bytes in return info */
1981        vcs_cplt_params.p_param_buf = p;
1982        (*p_vsc_cplt_cback)(&vcs_cplt_params);  /* Call the VSC complete callback function */
1983    }
1984}
1985
1986/*******************************************************************************
1987**
1988** Function         BTM_RegisterForVSEvents
1989**
1990** Description      This function is called to register/deregister for vendor
1991**                  specific HCI events.
1992**
1993**                  If is_register=TRUE, then the function will be registered;
1994**                  if is_register=FALSE, then the function will be deregistered.
1995**
1996** Returns          BTM_SUCCESS if successful,
1997**                  BTM_BUSY if maximum number of callbacks have already been
1998**                           registered.
1999**
2000*******************************************************************************/
2001tBTM_STATUS BTM_RegisterForVSEvents (tBTM_VS_EVT_CB *p_cb, BOOLEAN is_register)
2002{
2003    tBTM_STATUS retval = BTM_SUCCESS;
2004    UINT8 i, free_idx = BTM_MAX_VSE_CALLBACKS;
2005
2006    /* See if callback is already registered */
2007    for (i=0; i<BTM_MAX_VSE_CALLBACKS; i++)
2008    {
2009        if (btm_cb.devcb.p_vend_spec_cb[i] == NULL)
2010        {
2011            /* Found a free slot. Store index */
2012            free_idx = i;
2013        }
2014        else if (btm_cb.devcb.p_vend_spec_cb[i] == p_cb)
2015        {
2016            /* Found callback in lookup table. If deregistering, clear the entry. */
2017            if (is_register == FALSE)
2018            {
2019                btm_cb.devcb.p_vend_spec_cb[i] = NULL;
2020                BTM_TRACE_EVENT("BTM Deregister For VSEvents is successfully");
2021            }
2022            return (BTM_SUCCESS);
2023        }
2024    }
2025
2026    /* Didn't find callback. Add callback to free slot if registering */
2027    if (is_register)
2028    {
2029        if (free_idx < BTM_MAX_VSE_CALLBACKS)
2030        {
2031            btm_cb.devcb.p_vend_spec_cb[free_idx] = p_cb;
2032            BTM_TRACE_EVENT("BTM Register For VSEvents is successfully");
2033        }
2034        else
2035        {
2036            /* No free entries available */
2037            BTM_TRACE_ERROR ("BTM_RegisterForVSEvents: too many callbacks registered");
2038
2039            retval = BTM_NO_RESOURCES;
2040        }
2041    }
2042
2043    return (retval);
2044}
2045
2046/*******************************************************************************
2047**
2048** Function         btm_vendor_specific_evt
2049**
2050** Description      Process event HCI_VENDOR_SPECIFIC_EVT
2051**
2052**                  Note: Some controllers do not send command complete, so
2053**                  the callback and busy flag are cleared here also.
2054**
2055** Returns          void
2056**
2057*******************************************************************************/
2058void btm_vendor_specific_evt (UINT8 *p, UINT8 evt_len)
2059{
2060    UINT8 i;
2061
2062    BTM_TRACE_DEBUG ("BTM Event: Vendor Specific event from controller");
2063
2064    for (i=0; i<BTM_MAX_VSE_CALLBACKS; i++)
2065    {
2066        if (btm_cb.devcb.p_vend_spec_cb[i])
2067            (*btm_cb.devcb.p_vend_spec_cb[i])(evt_len, p);
2068    }
2069}
2070
2071
2072/*******************************************************************************
2073**
2074** Function         BTM_WritePageTimeout
2075**
2076** Description      Send HCI Write Page Timeout.
2077**
2078** Returns
2079**      BTM_SUCCESS         Command sent.
2080**      BTM_NO_RESOURCES     If out of resources to send the command.
2081**
2082**
2083*******************************************************************************/
2084tBTM_STATUS BTM_WritePageTimeout(UINT16 timeout)
2085{
2086    BTM_TRACE_EVENT ("BTM: BTM_WritePageTimeout: Timeout: %d.", timeout);
2087
2088    /* Send the HCI command */
2089    if (btsnd_hcic_write_page_tout (timeout))
2090        return (BTM_SUCCESS);
2091    else
2092        return (BTM_NO_RESOURCES);
2093}
2094
2095/*******************************************************************************
2096**
2097** Function         BTM_WriteVoiceSettings
2098**
2099** Description      Send HCI Write Voice Settings command.
2100**                  See hcidefs.h for settings bitmask values.
2101**
2102** Returns
2103**      BTM_SUCCESS         Command sent.
2104**      BTM_NO_RESOURCES     If out of resources to send the command.
2105**
2106**
2107*******************************************************************************/
2108tBTM_STATUS BTM_WriteVoiceSettings(UINT16 settings)
2109{
2110    BTM_TRACE_EVENT ("BTM: BTM_WriteVoiceSettings: Settings: 0x%04x.", settings);
2111
2112    /* Send the HCI command */
2113    if (btsnd_hcic_write_voice_settings ((UINT16)(settings & 0x03ff)))
2114        return (BTM_SUCCESS);
2115
2116    return (BTM_NO_RESOURCES);
2117}
2118
2119/*******************************************************************************
2120**
2121** Function         BTM_EnableTestMode
2122**
2123** Description      Send HCI the enable device under test command.
2124**
2125**                  Note: Controller can only be taken out of this mode by
2126**                      resetting the controller.
2127**
2128** Returns
2129**      BTM_SUCCESS         Command sent.
2130**      BTM_NO_RESOURCES    If out of resources to send the command.
2131**
2132**
2133*******************************************************************************/
2134tBTM_STATUS BTM_EnableTestMode(void)
2135{
2136    UINT8   cond;
2137
2138    BTM_TRACE_EVENT ("BTM: BTM_EnableTestMode");
2139
2140    /* set auto accept connection as this is needed during test mode */
2141    /* Allocate a buffer to hold HCI command */
2142    cond = HCI_DO_AUTO_ACCEPT_CONNECT;
2143    if (!btsnd_hcic_set_event_filter(HCI_FILTER_CONNECTION_SETUP,
2144                                     HCI_FILTER_COND_NEW_DEVICE,
2145                                     &cond, sizeof(cond)))
2146    {
2147        return (BTM_NO_RESOURCES);
2148    }
2149
2150    /* put device to connectable mode */
2151    if (!BTM_SetConnectability(BTM_CONNECTABLE, BTM_DEFAULT_CONN_WINDOW,
2152                               BTM_DEFAULT_CONN_INTERVAL) == BTM_SUCCESS)
2153    {
2154        return BTM_NO_RESOURCES;
2155    }
2156
2157    /* put device to discoverable mode */
2158    if (!BTM_SetDiscoverability(BTM_GENERAL_DISCOVERABLE, BTM_DEFAULT_DISC_WINDOW,
2159                                BTM_DEFAULT_DISC_INTERVAL) == BTM_SUCCESS)
2160    {
2161        return BTM_NO_RESOURCES;
2162    }
2163
2164    /* mask off all of event from controller */
2165    if (!btsnd_hcic_set_event_mask(LOCAL_BR_EDR_CONTROLLER_ID,
2166                                   (UINT8 *)"\x00\x00\x00\x00\x00\x00\x00\x00"))
2167    {
2168        return BTM_NO_RESOURCES;
2169    }
2170
2171    /* Send the HCI command */
2172    if (btsnd_hcic_enable_test_mode ())
2173        return (BTM_SUCCESS);
2174    else
2175        return (BTM_NO_RESOURCES);
2176}
2177
2178/*******************************************************************************
2179**
2180** Function         btm_get_hci_version
2181**
2182** Description      Local function called to retrieve the current HCI version
2183**
2184** Returns          Bluetooth HCI Version returned by the controller
2185**
2186*******************************************************************************/
2187UINT8 btm_get_hci_version (void)
2188{
2189    return (btm_cb.devcb.local_version.hci_version);
2190}
2191
2192
2193
2194/*******************************************************************************
2195**
2196** Function         BTM_ReadStoredLinkKey
2197**
2198** Description      This function is called to obtain link key for the specified
2199**                  device from the NVRAM storage attached to the Bluetooth
2200**                  controller.
2201**
2202** Parameters:      bd_addr      - Address of the device
2203**                  p_cb         - Call back function to be called to return
2204**                                 the results
2205**
2206*******************************************************************************/
2207tBTM_STATUS BTM_ReadStoredLinkKey (BD_ADDR bd_addr,	tBTM_CMPL_CB *p_cb)
2208{
2209    BD_ADDR local_bd_addr;
2210    BOOLEAN read_all_flag = FALSE;
2211
2212    /* Check if the previous command is completed */
2213    if (btm_cb.devcb.p_stored_link_key_cmpl_cb)
2214        return (BTM_BUSY);
2215
2216    if (!bd_addr)
2217    {
2218        /* This is to read all the link keys */
2219        read_all_flag = TRUE;
2220
2221        /* We don't care the BD address. Just pass a non zero pointer */
2222        bd_addr = local_bd_addr;
2223    }
2224
2225    BTM_TRACE_EVENT ("BTM: BTM_ReadStoredLinkKey: Read_All: %s",
2226                        read_all_flag ? "TRUE" : "FALSE");
2227
2228    /* Send the HCI command */
2229    btm_cb.devcb.p_stored_link_key_cmpl_cb = p_cb;
2230    if (btsnd_hcic_read_stored_key (bd_addr, read_all_flag))
2231        return (BTM_SUCCESS);
2232    else
2233        return (BTM_NO_RESOURCES);
2234
2235}
2236
2237
2238/*******************************************************************************
2239**
2240** Function         BTM_WriteStoredLinkKey
2241**
2242** Description      This function is called to write link keys for the specified
2243**                  device addresses to the NVRAM storage attached to the Bluetooth
2244**                  controller.
2245**
2246** Parameters:      num_keys     - Number of link keys
2247**                  bd_addr      - Addresses of the devices
2248**                  link_key     - Link Keys to be stored
2249**                  p_cb         - Call back function to be called to return
2250**                                 the results
2251**
2252*******************************************************************************/
2253tBTM_STATUS BTM_WriteStoredLinkKey (UINT8 num_keys,
2254                                    BD_ADDR *bd_addr,
2255                                    LINK_KEY *link_key,
2256                                    tBTM_CMPL_CB *p_cb)
2257{
2258    /* Check if the previous command is completed */
2259    if (btm_cb.devcb.p_stored_link_key_cmpl_cb)
2260        return (BTM_BUSY);
2261
2262    BTM_TRACE_EVENT ("BTM: BTM_WriteStoredLinkKey: num_keys: %d", num_keys);
2263
2264    /* Check the maximum number of link keys */
2265    if(num_keys > HCI_MAX_NUM_OF_LINK_KEYS_PER_CMMD)
2266        num_keys = HCI_MAX_NUM_OF_LINK_KEYS_PER_CMMD;
2267
2268    /* Send the HCI command */
2269    btm_cb.devcb.p_stored_link_key_cmpl_cb = p_cb;
2270    if (btsnd_hcic_write_stored_key (num_keys, bd_addr, link_key))
2271        return (BTM_SUCCESS);
2272    else
2273        return (BTM_NO_RESOURCES);
2274
2275}
2276
2277
2278/*******************************************************************************
2279**
2280** Function         BTM_DeleteStoredLinkKey
2281**
2282** Description      This function is called to delete link key for the specified
2283**                  device addresses from the NVRAM storage attached to the Bluetooth
2284**                  controller.
2285**
2286** Parameters:      bd_addr      - Addresses of the devices
2287**                  p_cb         - Call back function to be called to return
2288**                                 the results
2289**
2290*******************************************************************************/
2291tBTM_STATUS BTM_DeleteStoredLinkKey(BD_ADDR bd_addr, tBTM_CMPL_CB *p_cb)
2292{
2293    BD_ADDR local_bd_addr;
2294    BOOLEAN delete_all_flag = FALSE;
2295
2296    /* Check if the previous command is completed */
2297    if (btm_cb.devcb.p_stored_link_key_cmpl_cb)
2298        return (BTM_BUSY);
2299
2300    if (!bd_addr)
2301    {
2302        /* This is to delete all link keys */
2303        delete_all_flag = TRUE;
2304
2305        /* We don't care the BD address. Just pass a non zero pointer */
2306        bd_addr = local_bd_addr;
2307    }
2308
2309    BTM_TRACE_EVENT ("BTM: BTM_DeleteStoredLinkKey: delete_all_flag: %s",
2310                        delete_all_flag ? "TRUE" : "FALSE");
2311
2312    /* Send the HCI command */
2313    btm_cb.devcb.p_stored_link_key_cmpl_cb = p_cb;
2314    if (!btsnd_hcic_delete_stored_key (bd_addr, delete_all_flag))
2315    {
2316        return (BTM_NO_RESOURCES);
2317    }
2318    else
2319        return (BTM_SUCCESS);
2320}
2321
2322
2323/*******************************************************************************
2324**
2325** Function         btm_read_stored_link_key_complete
2326**
2327** Description      This function is called when the command complete message
2328**                  is received from the HCI for the read stored link key command.
2329**
2330** Returns          void
2331**
2332*******************************************************************************/
2333void btm_read_stored_link_key_complete (UINT8 *p)
2334{
2335    tBTM_CMPL_CB      *p_cb = btm_cb.devcb.p_stored_link_key_cmpl_cb;
2336    tBTM_READ_STORED_LINK_KEY_COMPLETE  result;
2337
2338    /* If there was a callback registered for read stored link key, call it */
2339    btm_cb.devcb.p_stored_link_key_cmpl_cb = NULL;
2340
2341    if (p_cb)
2342    {
2343        /* Set the call back event to indicate command complete */
2344        result.event = BTM_CB_EVT_READ_STORED_LINK_KEYS;
2345
2346        /* Extract the result fields from the HCI event if status is success */
2347        STREAM_TO_UINT8  (result.status, p);
2348        if (result.status == HCI_SUCCESS)
2349        {
2350            STREAM_TO_UINT16 (result.max_keys, p);
2351            STREAM_TO_UINT16 (result.read_keys, p);
2352        }
2353        else
2354        {
2355            BTM_TRACE_WARNING("Read stored link key status %d", result.status);
2356            result.max_keys = 0;
2357            result.read_keys = 0;
2358        }
2359        /* Call the call back and pass the result */
2360        (*p_cb)(&result);
2361    }
2362}
2363
2364
2365/*******************************************************************************
2366**
2367** Function         btm_write_stored_link_key_complete
2368**
2369** Description      This function is called when the command complete message
2370**                  is received from the HCI for the write stored link key command.
2371**
2372** Returns          void
2373**
2374*******************************************************************************/
2375void btm_write_stored_link_key_complete (UINT8 *p)
2376{
2377    tBTM_CMPL_CB       *p_cb = btm_cb.devcb.p_stored_link_key_cmpl_cb;
2378    tBTM_WRITE_STORED_LINK_KEY_COMPLETE  result;
2379
2380    /* If there was a callback registered for read stored link key, call it */
2381    btm_cb.devcb.p_stored_link_key_cmpl_cb = NULL;
2382
2383    if (p_cb)
2384    {
2385        /* Set the call back event to indicate command complete */
2386        result.event = BTM_CB_EVT_WRITE_STORED_LINK_KEYS;
2387
2388        /* Extract the result fields from the HCI event */
2389        STREAM_TO_UINT8 (result.status, p);
2390        STREAM_TO_UINT8 (result.num_keys, p);
2391
2392        /* Call the call back and pass the result */
2393        (*p_cb)(&result);
2394    }
2395}
2396
2397
2398/*******************************************************************************
2399**
2400** Function         btm_delete_stored_link_key_complete
2401**
2402** Description      This function is called when the command complete message
2403**                  is received from the HCI for the delete stored link key command.
2404**
2405** Returns          void
2406**
2407*******************************************************************************/
2408void btm_delete_stored_link_key_complete (UINT8 *p)
2409{
2410    tBTM_CMPL_CB         *p_cb = btm_cb.devcb.p_stored_link_key_cmpl_cb;
2411    tBTM_DELETE_STORED_LINK_KEY_COMPLETE  result;
2412
2413    /* If there was a callback registered for read stored link key, call it */
2414    btm_cb.devcb.p_stored_link_key_cmpl_cb = NULL;
2415
2416    if (p_cb)
2417    {
2418        /* Set the call back event to indicate command complete */
2419        result.event = BTM_CB_EVT_DELETE_STORED_LINK_KEYS;
2420
2421        /* Extract the result fields from the HCI event */
2422        STREAM_TO_UINT8  (result.status, p);
2423        STREAM_TO_UINT16 (result.num_keys, p);
2424
2425        /* Call the call back and pass the result */
2426        (*p_cb)(&result);
2427    }
2428}
2429
2430
2431/*******************************************************************************
2432**
2433** Function         btm_return_link_keys_evt
2434**
2435** Description      This function is called when the return link keys event
2436**                  is received from the HCI for the read stored link key command.
2437**
2438** Returns          void
2439**
2440*******************************************************************************/
2441void btm_return_link_keys_evt (tBTM_RETURN_LINK_KEYS_EVT *result)
2442{
2443    tBTM_CMPL_CB  *p_cb = btm_cb.devcb.p_stored_link_key_cmpl_cb;
2444    UINT8          i, *p, *p1;
2445    UINT8          bd_addr[BD_ADDR_LEN];
2446    UINT8          link_key[LINK_KEY_LEN];
2447
2448    /* Call the call back to pass the link keys to application */
2449    if (p_cb)
2450    {
2451        /* Change the BD addr and Link key in to big endian order */
2452        p = (UINT8 *)(result + 1);
2453        for (i=0; i<result->num_keys; i++)
2454        {
2455            /* Initialize the backup pointer */
2456            p1 = p;
2457
2458            /* Extract the BD Addr and Link Key */
2459            REVERSE_STREAM_TO_ARRAY(bd_addr, p1, BD_ADDR_LEN);
2460            REVERSE_STREAM_TO_ARRAY(link_key, p1, LINK_KEY_LEN);
2461
2462            /* Write the BD Addr and Link Key back in big endian format */
2463            ARRAY_TO_STREAM(p, bd_addr, BD_ADDR_LEN);
2464            ARRAY_TO_STREAM(p, link_key, LINK_KEY_LEN);
2465        }
2466
2467        (*p_cb)(result);
2468    }
2469}
2470
2471
2472
2473/*******************************************************************************
2474**
2475** Function         btm_report_device_status
2476**
2477** Description      This function is called when there is a change in the device
2478**                  status. This function will report the new device status to
2479**                  the application
2480**
2481** Returns          void
2482**
2483*******************************************************************************/
2484void btm_report_device_status (tBTM_DEV_STATUS status)
2485{
2486    tBTM_DEV_STATUS_CB *p_cb = btm_cb.devcb.p_dev_status_cb;
2487
2488    /* Call the call back to pass the device status to application */
2489    if (p_cb)
2490        (*p_cb)(status);
2491}
2492
2493
2494