1 /******************************************************************************
2  *
3  *  Copyright 2003-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This file contains action functions for the audio gateway.
22  *
23  ******************************************************************************/
24 
25 #include <bluetooth/log.h>
26 #include <com_android_bluetooth_flags.h>
27 
28 #include <cstdint>
29 #include <cstring>
30 
31 #include "ag/bta_ag_at.h"
32 #include "bta/ag/bta_ag_int.h"
33 #include "bta/include/bta_dm_api.h"
34 #include "bta/include/bta_hfp_api.h"
35 #include "bta_ag_api.h"
36 #include "bta_ag_swb_aptx.h"
37 #include "bta_api.h"
38 #include "bta_sys.h"
39 #include "btm_api_types.h"
40 #include "device/include/device_iot_conf_defs.h"
41 #include "osi/include/alarm.h"
42 #include "sdp_status.h"
43 #include "types/bt_transport.h"
44 
45 #ifdef __ANDROID__
46 #endif
47 
48 #include "btif/include/btif_config.h"
49 #include "device/include/device_iot_config.h"
50 #include "stack/include/bt_uuid16.h"
51 #include "stack/include/btm_sec_api_types.h"
52 #include "stack/include/l2cap_interface.h"
53 #include "stack/include/port_api.h"
54 #include "stack/include/sdp_api.h"
55 #include "storage/config_keys.h"
56 #include "types/raw_address.h"
57 
58 using namespace bluetooth;
59 using namespace bluetooth::legacy::stack::sdp;
60 
61 /*****************************************************************************
62  *  Constants
63  ****************************************************************************/
64 
65 /* maximum length of data to read from RFCOMM */
66 #define BTA_AG_RFC_READ_MAX 512
67 
68 /* maximum AT command length */
69 #define BTA_AG_CMD_MAX 512
70 
71 const uint16_t bta_ag_uuid[BTA_AG_NUM_IDX] = {UUID_SERVCLASS_HEADSET_AUDIO_GATEWAY,
72                                               UUID_SERVCLASS_AG_HANDSFREE};
73 
74 const uint8_t bta_ag_sec_id[BTA_AG_NUM_IDX] = {BTM_SEC_SERVICE_HEADSET_AG,
75                                                BTM_SEC_SERVICE_AG_HANDSFREE};
76 
77 const tBTA_SERVICE_ID bta_ag_svc_id[BTA_AG_NUM_IDX] = {BTA_HSP_SERVICE_ID, BTA_HFP_SERVICE_ID};
78 
79 const tBTA_SERVICE_MASK bta_ag_svc_mask[BTA_AG_NUM_IDX] = {BTA_HSP_SERVICE_MASK,
80                                                            BTA_HFP_SERVICE_MASK};
81 
82 typedef void (*tBTA_AG_ATCMD_CBACK)(tBTA_AG_SCB* p_scb, uint16_t cmd, uint8_t arg_type, char* p_arg,
83                                     char* p_end, int16_t int_arg);
84 
85 const tBTA_AG_ATCMD_CBACK bta_ag_at_cback_tbl[BTA_AG_NUM_IDX] = {bta_ag_at_hsp_cback,
86                                                                  bta_ag_at_hfp_cback};
87 
88 /*******************************************************************************
89  *
90  * Function         bta_ag_cback_open
91  *
92  * Description      Send open callback event to application.
93  *
94  *
95  * Returns          void
96  *
97  ******************************************************************************/
bta_ag_cback_open(tBTA_AG_SCB * p_scb,const RawAddress & bd_addr,tBTA_AG_STATUS status)98 static void bta_ag_cback_open(tBTA_AG_SCB* p_scb, const RawAddress& bd_addr,
99                               tBTA_AG_STATUS status) {
100   tBTA_AG_OPEN open = {};
101 
102   /* call app callback with open event */
103   open.hdr.handle = bta_ag_scb_to_idx(p_scb);
104   open.hdr.app_id = p_scb->app_id;
105   open.status = status;
106   open.service_id = bta_ag_svc_id[p_scb->conn_service];
107   open.bd_addr = bd_addr;
108 
109   (*bta_ag_cb.p_cback)(BTA_AG_OPEN_EVT, (tBTA_AG*)&open);
110 }
111 
112 /*******************************************************************************
113  *
114  * Function         bta_ag_register
115  *
116  * Description      This function initializes values of the AG cb and sets up
117  *                  the SDP record for the services.
118  *
119  *
120  * Returns          void
121  *
122  ******************************************************************************/
bta_ag_register(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)123 void bta_ag_register(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
124   /* initialize control block */
125   p_scb->reg_services = data.api_register.services;
126   p_scb->features = data.api_register.features;
127   p_scb->masked_features = data.api_register.features;
128   p_scb->app_id = data.api_register.app_id;
129 
130   /* create SDP records */
131   bta_ag_create_records(p_scb, data);
132 
133   /* start RFCOMM servers */
134   bta_ag_start_servers(p_scb, p_scb->reg_services);
135 
136   /* call app callback with register event */
137   tBTA_AG_REGISTER reg = {};
138   reg.hdr.handle = bta_ag_scb_to_idx(p_scb);
139   reg.hdr.app_id = p_scb->app_id;
140   reg.status = BTA_AG_SUCCESS;
141   (*bta_ag_cb.p_cback)(BTA_AG_REGISTER_EVT, (tBTA_AG*)&reg);
142 }
143 
144 /*******************************************************************************
145  *
146  * Function         bta_ag_deregister
147  *
148  * Description      This function removes the sdp records, closes the RFCOMM
149  *                  servers, and deallocates the service control block.
150  *
151  *
152  * Returns          void
153  *
154  ******************************************************************************/
bta_ag_deregister(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)155 void bta_ag_deregister(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /*data*/) {
156   /* set dealloc */
157   p_scb->dealloc = true;
158 
159   /* remove sdp records */
160   bta_ag_del_records(p_scb);
161 
162   /* remove rfcomm servers */
163   bta_ag_close_servers(p_scb, p_scb->reg_services);
164 
165   /* dealloc */
166   bta_ag_scb_dealloc(p_scb);
167 }
168 
169 /*******************************************************************************
170  *
171  * Function         bta_ag_start_dereg
172  *
173  * Description      Start a deregister event.
174  *
175  *
176  * Returns          void
177  *
178  ******************************************************************************/
bta_ag_start_dereg(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)179 void bta_ag_start_dereg(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /*data*/) {
180   /* set dealloc */
181   p_scb->dealloc = true;
182 
183   /* remove sdp records */
184   bta_ag_del_records(p_scb);
185 }
186 
187 /*******************************************************************************
188  *
189  * Function         bta_ag_start_open
190  *
191  * Description      This starts an AG open.
192  *
193  *
194  * Returns          void
195  *
196  ******************************************************************************/
bta_ag_start_open(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)197 void bta_ag_start_open(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
198   p_scb->peer_addr = data.api_open.bd_addr;
199   p_scb->open_services = p_scb->reg_services;
200 
201   /* Check if RFCOMM has any incoming connection to avoid collision. */
202   if (com::android::bluetooth::flags::rfcomm_prevent_unnecessary_collisions()) {
203     if (PORT_IsCollisionDetected(p_scb->peer_addr)) {
204       /* Let the incoming connection go through.                           */
205       /* Issue collision for this scb for now.                             */
206       /* We will decide what to do when we find incoming connection later. */
207       bta_ag_collision_cback(BTA_SYS_CONN_OPEN, BTA_ID_AG, 0, p_scb->peer_addr);
208       return;
209     }
210   } else {
211     RawAddress pending_bd_addr = RawAddress::kEmpty;
212     if (PORT_IsOpening(&pending_bd_addr)) {
213       /* Let the incoming connection go through.                           */
214       /* Issue collision for this scb for now.                             */
215       /* We will decide what to do when we find incoming connection later. */
216       bta_ag_collision_cback(BTA_SYS_CONN_OPEN, BTA_ID_AG, 0, p_scb->peer_addr);
217       return;
218     }
219   }
220 
221   /* close servers */
222   bta_ag_close_servers(p_scb, p_scb->reg_services);
223 
224   /* set role */
225   p_scb->role = BTA_AG_INT;
226 
227   /* do service search */
228   bta_ag_do_disc(p_scb, p_scb->open_services);
229 }
230 
231 /*******************************************************************************
232  *
233  * Function         bta_ag_disc_int_res
234  *
235  * Description      This function handles a discovery result when initiator.
236  *
237  *
238  * Returns          void
239  *
240  ******************************************************************************/
bta_ag_disc_int_res(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)241 void bta_ag_disc_int_res(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
242   uint16_t event = BTA_AG_DISC_FAIL_EVT;
243 
244   log::verbose("bta_ag_disc_int_res: Status: {}", data.disc_result.status);
245 
246   /* if found service */
247   if (data.disc_result.status == tSDP_STATUS::SDP_SUCCESS ||
248       data.disc_result.status == tSDP_STATUS::SDP_DB_FULL) {
249     /* get attributes */
250     if (bta_ag_sdp_find_attr(p_scb, p_scb->open_services)) {
251       /* set connected service */
252       p_scb->conn_service = bta_ag_service_to_idx(p_scb->open_services);
253 
254       /* send ourselves sdp ok event */
255       event = BTA_AG_DISC_OK_EVT;
256 
257       DEVICE_IOT_CONFIG_ADDR_SET_HEX_IF_GREATER(p_scb->peer_addr, IOT_CONF_KEY_HFP_VERSION,
258                                                 p_scb->peer_version, IOT_CONF_BYTE_NUM_2);
259     }
260   }
261 
262   /* free discovery db */
263   bta_ag_free_db(p_scb, data);
264 
265   /* if service not found check if we should search for other service */
266   if ((event == BTA_AG_DISC_FAIL_EVT) &&
267       (data.disc_result.status == tSDP_STATUS::SDP_SUCCESS ||
268        data.disc_result.status == tSDP_STATUS::SDP_DB_FULL ||
269        data.disc_result.status == tSDP_STATUS::SDP_NO_RECS_MATCH)) {
270     if ((p_scb->open_services & BTA_HFP_SERVICE_MASK) &&
271         (p_scb->open_services & BTA_HSP_SERVICE_MASK)) {
272       /* search for HSP */
273       p_scb->open_services &= ~BTA_HFP_SERVICE_MASK;
274       bta_ag_do_disc(p_scb, p_scb->open_services);
275     } else if ((p_scb->open_services & BTA_HSP_SERVICE_MASK) &&
276                (p_scb->hsp_version == HSP_VERSION_1_2)) {
277       /* search for UUID_SERVCLASS_HEADSET instead */
278       p_scb->hsp_version = HSP_VERSION_1_0;
279       bta_ag_do_disc(p_scb, p_scb->open_services);
280     } else {
281       /* send ourselves sdp ok/fail event */
282       bta_ag_sm_execute(p_scb, event, data);
283     }
284   } else {
285     /* send ourselves sdp ok/fail event */
286     bta_ag_sm_execute(p_scb, event, data);
287   }
288 }
289 
290 /*******************************************************************************
291  *
292  * Function         bta_ag_disc_acp_res
293  *
294  * Description      This function handles a discovery result when acceptor.
295  *
296  *
297  * Returns          void
298  *
299  ******************************************************************************/
bta_ag_disc_acp_res(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)300 void bta_ag_disc_acp_res(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
301   /* if found service */
302   if (data.disc_result.status == tSDP_STATUS::SDP_SUCCESS ||
303       data.disc_result.status == tSDP_STATUS::SDP_DB_FULL) {
304     /* get attributes */
305     bta_ag_sdp_find_attr(p_scb, bta_ag_svc_mask[p_scb->conn_service]);
306     DEVICE_IOT_CONFIG_ADDR_SET_HEX_IF_GREATER(p_scb->peer_addr, IOT_CONF_KEY_HFP_VERSION,
307                                               p_scb->peer_version, IOT_CONF_BYTE_NUM_2);
308   }
309 
310   /* free discovery db */
311   bta_ag_free_db(p_scb, data);
312 }
313 
314 /*******************************************************************************
315  *
316  * Function         bta_ag_disc_fail
317  *
318  * Description      This function handles a discovery failure.
319  *
320  *
321  * Returns          void
322  *
323  ******************************************************************************/
bta_ag_disc_fail(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)324 void bta_ag_disc_fail(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /* data */) {
325   /* reopen registered servers */
326   bta_ag_start_servers(p_scb, p_scb->reg_services);
327 
328   /* reinitialize stuff */
329 
330   /* clear the remote BD address */
331   RawAddress peer_addr = p_scb->peer_addr;
332   p_scb->peer_addr = RawAddress::kEmpty;
333 
334   /* call open cback w. failure */
335   bta_ag_cback_open(p_scb, peer_addr, BTA_AG_FAIL_SDP);
336 }
337 
338 /*******************************************************************************
339  *
340  * Function         bta_ag_open_fail
341  *
342  * Description      open connection failed.
343  *
344  *
345  * Returns          void
346  *
347  ******************************************************************************/
bta_ag_open_fail(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)348 void bta_ag_open_fail(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
349   /* call open cback w. failure */
350   log::debug("state {}", bta_ag_state_str(p_scb->state));
351   bta_ag_cback_open(p_scb, data.api_open.bd_addr, BTA_AG_FAIL_RESOURCES);
352 }
353 
354 /*******************************************************************************
355  *
356  * Function         bta_ag_rfc_fail
357  *
358  * Description      RFCOMM connection failed.
359  *
360  *
361  * Returns          void
362  *
363  ******************************************************************************/
bta_ag_rfc_fail(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)364 void bta_ag_rfc_fail(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /* data */) {
365   log::info("reset p_scb with index={}", bta_ag_scb_to_idx(p_scb));
366   RawAddress peer_addr = p_scb->peer_addr;
367   /* reinitialize stuff */
368   if (com::android::bluetooth::flags::reset_ag_state_on_collision()) {
369     p_scb->state = BTA_AG_INIT_ST;
370   }
371   p_scb->conn_handle = 0;
372   p_scb->conn_service = 0;
373   p_scb->peer_features = 0;
374   p_scb->peer_codecs = BTM_SCO_CODEC_CVSD;
375   p_scb->sco_codec = BTM_SCO_CODEC_CVSD;
376   p_scb->is_aptx_swb_codec = false;
377   p_scb->role = 0;
378   p_scb->svc_conn = false;
379   p_scb->hsp_version = HSP_VERSION_1_2;
380   /*Clear the BD address*/
381   p_scb->peer_addr = RawAddress::kEmpty;
382 
383   /* reopen registered servers */
384   bta_ag_start_servers(p_scb, p_scb->reg_services);
385 
386   /* call open cback w. failure */
387   bta_ag_cback_open(p_scb, peer_addr, BTA_AG_FAIL_RFCOMM);
388 }
389 
390 /*******************************************************************************
391  *
392  * Function         bta_ag_rfc_close
393  *
394  * Description      RFCOMM connection closed.
395  *
396  *
397  * Returns          void
398  *
399  ******************************************************************************/
bta_ag_rfc_close(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)400 void bta_ag_rfc_close(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /* data */) {
401   tBTA_AG_CLOSE close = {};
402   tBTA_SERVICE_MASK services;
403   int i, num_active_conn = 0;
404 
405   /* reinitialize stuff */
406   p_scb->conn_service = 0;
407   p_scb->peer_features = 0;
408   p_scb->masked_features = p_scb->features;
409   p_scb->peer_codecs = BTM_SCO_CODEC_CVSD;
410   p_scb->sco_codec = BTM_SCO_CODEC_CVSD;
411   /* Clear these flags upon SLC teardown */
412   p_scb->codec_updated = false;
413   p_scb->codec_fallback = false;
414   p_scb->trying_cvsd_safe_settings = false;
415   p_scb->retransmission_effort_retries = 0;
416   p_scb->codec_msbc_settings = BTA_AG_SCO_MSBC_SETTINGS_T2;
417   p_scb->codec_cvsd_settings = BTA_AG_SCO_CVSD_SETTINGS_S4;
418   p_scb->codec_aptx_settings = BTA_AG_SCO_APTX_SWB_SETTINGS_Q0;
419   p_scb->is_aptx_swb_codec = false;
420   p_scb->codec_lc3_settings = BTA_AG_SCO_LC3_SETTINGS_T2;
421   p_scb->role = 0;
422   p_scb->svc_conn = false;
423   p_scb->hsp_version = HSP_VERSION_1_2;
424   bta_ag_at_reinit(&p_scb->at_cb);
425 
426   for (auto& peer_hf_indicator : p_scb->peer_hf_indicators) {
427     peer_hf_indicator = {};
428   }
429   for (auto& local_hf_indicator : p_scb->local_hf_indicators) {
430     local_hf_indicator = {};
431   }
432 
433   /* stop timers */
434   alarm_cancel(p_scb->ring_timer);
435   alarm_cancel(p_scb->codec_negotiation_timer);
436 
437   close.hdr.handle = bta_ag_scb_to_idx(p_scb);
438   close.hdr.app_id = p_scb->app_id;
439   close.bd_addr = p_scb->peer_addr;
440 
441   bta_sys_conn_close(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
442 
443   if (bta_ag_get_active_device() == p_scb->peer_addr) {
444     bta_clear_active_device();
445   }
446 
447   /* call close cback */
448   (*bta_ag_cb.p_cback)(BTA_AG_CLOSE_EVT, (tBTA_AG*)&close);
449 
450   /* if not deregistering (deallocating) reopen registered servers */
451   if (!p_scb->dealloc) {
452     /* Clear peer bd_addr so instance can be reused */
453     p_scb->peer_addr = RawAddress::kEmpty;
454 
455     /* start only unopened server */
456     services = p_scb->reg_services;
457     for (i = 0; i < BTA_AG_NUM_IDX && services != 0; i++) {
458       if (p_scb->serv_handle[i]) {
459         services &= ~((tBTA_SERVICE_MASK)1 << (BTA_HSP_SERVICE_ID + i));
460       }
461     }
462     bta_ag_start_servers(p_scb, services);
463 
464     p_scb->conn_handle = 0;
465 
466     /* Make sure SCO state is BTA_AG_SCO_SHUTDOWN_ST */
467     bta_ag_sco_shutdown(p_scb, tBTA_AG_DATA::kEmpty);
468 
469     /* Check if all the SLCs are down */
470     for (i = 0; i < BTA_AG_MAX_NUM_CLIENTS; i++) {
471       if (bta_ag_cb.scb[i].in_use && bta_ag_cb.scb[i].svc_conn) {
472         num_active_conn++;
473       }
474     }
475 
476     if (!num_active_conn) {
477       bta_sys_sco_unuse(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
478     }
479 
480     /* else close port and deallocate scb */
481   } else {
482     if (RFCOMM_RemoveServer(p_scb->conn_handle) != PORT_SUCCESS) {
483       log::warn("Unable to remove RFCOMM server peer:{} handle:{}", p_scb->peer_addr,
484                 p_scb->conn_handle);
485     }
486     bta_ag_scb_dealloc(p_scb);
487   }
488 }
489 
490 /*******************************************************************************
491  *
492  * Function         bta_ag_rfc_open
493  *
494  * Description      Handle RFCOMM channel open.
495  *
496  *
497  * Returns          void
498  *
499  ******************************************************************************/
bta_ag_rfc_open(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)500 void bta_ag_rfc_open(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
501   /* initialize AT feature variables */
502   p_scb->clip_enabled = false;
503   p_scb->ccwa_enabled = false;
504   p_scb->cmer_enabled = false;
505   p_scb->cmee_enabled = false;
506   p_scb->inband_enabled = ((p_scb->features & BTA_AG_FEAT_INBAND) == BTA_AG_FEAT_INBAND);
507   if (p_scb->conn_service == BTA_AG_HFP) {
508     size_t version_value_size = sizeof(p_scb->peer_version);
509     if (!btif_config_get_bin(p_scb->peer_addr.ToString(), BTIF_STORAGE_KEY_HFP_VERSION,
510                              (uint8_t*)&p_scb->peer_version, &version_value_size)) {
511       log::warn("Failed read cached peer HFP version for {}", p_scb->peer_addr);
512       p_scb->peer_version = HFP_HSP_VERSION_UNKNOWN;
513     }
514     size_t sdp_features_size = sizeof(p_scb->peer_sdp_features);
515     if (btif_config_get_bin(p_scb->peer_addr.ToString(), BTIF_STORAGE_KEY_HFP_SDP_FEATURES,
516                             (uint8_t*)&p_scb->peer_sdp_features, &sdp_features_size)) {
517       bool sdp_wbs_support = p_scb->peer_sdp_features & BTA_AG_FEAT_WBS_SUPPORT;
518       if (!p_scb->received_at_bac && sdp_wbs_support) {
519         p_scb->codec_updated = true;
520         p_scb->peer_codecs = BTM_SCO_CODEC_CVSD | BTM_SCO_CODEC_MSBC;
521         p_scb->sco_codec = BTM_SCO_CODEC_MSBC;
522       }
523       bool sdp_swb_support = p_scb->peer_sdp_features & BTA_AG_FEAT_SWB_SUPPORT;
524       if (!p_scb->received_at_bac && sdp_swb_support) {
525         p_scb->codec_updated = true;
526         p_scb->peer_codecs |= BTM_SCO_CODEC_LC3;
527         p_scb->sco_codec = BTM_SCO_CODEC_LC3;
528       }
529     } else {
530       log::warn("Failed read cached peer HFP SDP features for {}", p_scb->peer_addr);
531     }
532   }
533 
534   /* set up AT command interpreter */
535   p_scb->at_cb.p_at_tbl = bta_ag_at_tbl[p_scb->conn_service];
536   p_scb->at_cb.p_cmd_cback = bta_ag_at_cback_tbl[p_scb->conn_service];
537   p_scb->at_cb.p_err_cback = bta_ag_at_err_cback;
538   p_scb->at_cb.p_user = p_scb;
539   p_scb->at_cb.cmd_max_len = BTA_AG_CMD_MAX;
540   bta_ag_at_init(&p_scb->at_cb);
541 
542   bta_sys_conn_open(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
543 
544   bta_ag_cback_open(p_scb, p_scb->peer_addr, BTA_AG_SUCCESS);
545 
546   if (p_scb->conn_service == BTA_AG_HFP) {
547     /* if hfp start timer for service level conn */
548     bta_sys_start_timer(p_scb->ring_timer, p_bta_ag_cfg->conn_tout, BTA_AG_SVC_TIMEOUT_EVT,
549                         bta_ag_scb_to_idx(p_scb));
550   } else {
551     /* else service level conn is open */
552     bta_ag_svc_conn_open(p_scb, data);
553   }
554 }
555 
556 /*******************************************************************************
557  *
558  * Function         bta_ag_rfc_acp_open
559  *
560  * Description      Handle RFCOMM channel open when accepting connection.
561  *
562  *
563  * Returns          void
564  *
565  ******************************************************************************/
bta_ag_rfc_acp_open(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)566 void bta_ag_rfc_acp_open(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
567   log::verbose("serv_handle0 = {} serv_handle = {}", p_scb->serv_handle[0], p_scb->serv_handle[1]);
568   /* set role */
569   p_scb->role = BTA_AG_ACP;
570 
571   /* get bd addr of peer */
572   uint16_t lcid = 0;
573   uint16_t hfp_version = 0;
574   RawAddress dev_addr = RawAddress::kEmpty;
575   int status = PORT_CheckConnection(data.rfc.port_handle, &dev_addr, &lcid);
576   if (status != PORT_SUCCESS) {
577     log::error("PORT_CheckConnection returned {}", status);
578     return;
579   }
580 
581   /* Collision Handling */
582   for (tBTA_AG_SCB& ag_scb : bta_ag_cb.scb) {
583     // Cancel any pending collision timers
584     if (ag_scb.in_use && alarm_is_scheduled(ag_scb.collision_timer)) {
585       log::verbose("cancel collision alarm for {}", ag_scb.peer_addr);
586       alarm_cancel(ag_scb.collision_timer);
587       if (dev_addr != ag_scb.peer_addr && p_scb != &ag_scb) {
588         // Resume outgoing connection if incoming is not on the same device
589         bta_ag_resume_open(&ag_scb);
590       }
591     }
592     if (dev_addr == ag_scb.peer_addr && p_scb != &ag_scb) {
593       log::info("close outgoing connection before accepting {} with conn_handle={}",
594                 ag_scb.peer_addr, ag_scb.conn_handle);
595 
596       // If client port is opened, close it, state machine will handle rfcomm
597       // closed in opening state as failure and pass to upper layer
598       if (ag_scb.conn_handle > 0) {
599         status = RFCOMM_RemoveConnection(ag_scb.conn_handle);
600         if (status != PORT_SUCCESS) {
601           log::warn("RFCOMM_RemoveConnection failed for {}, handle {}, error {}", dev_addr,
602                     ag_scb.conn_handle, status);
603         }
604       } else {
605         // As no existing outgoing rfcomm connection, then manual reset current
606         // state, and use the incoming one
607         bta_ag_rfc_fail(&ag_scb, tBTA_AG_DATA::kEmpty);
608       }
609     }
610     log::info("dev_addr={}, peer_addr={}, in_use={}, index={}", dev_addr, ag_scb.peer_addr,
611               ag_scb.in_use, bta_ag_scb_to_idx(p_scb));
612   }
613 
614   p_scb->peer_addr = dev_addr;
615 
616   /* determine connected service from port handle */
617   for (uint8_t i = 0; i < BTA_AG_NUM_IDX; i++) {
618     log::verbose("bta_ag_rfc_acp_open: i = {} serv_handle = {} port_handle = {}", i,
619                  p_scb->serv_handle[i], data.rfc.port_handle);
620 
621     if (p_scb->serv_handle[i] == data.rfc.port_handle) {
622       p_scb->conn_service = i;
623       p_scb->conn_handle = data.rfc.port_handle;
624       break;
625     }
626   }
627 
628   log::verbose("bta_ag_rfc_acp_open: conn_service = {} conn_handle = {}", p_scb->conn_service,
629                p_scb->conn_handle);
630 
631   /* close any unopened server */
632   bta_ag_close_servers(p_scb, (p_scb->reg_services & ~bta_ag_svc_mask[p_scb->conn_service]));
633 
634   size_t version_value_size = sizeof(hfp_version);
635   bool get_version = btif_config_get_bin(p_scb->peer_addr.ToString(), BTIF_STORAGE_KEY_HFP_VERSION,
636                                          (uint8_t*)&hfp_version, &version_value_size);
637 
638   if (p_scb->conn_service == BTA_AG_HFP && get_version) {
639     DEVICE_IOT_CONFIG_ADDR_SET_HEX_IF_GREATER(p_scb->peer_addr, IOT_CONF_KEY_HFP_VERSION,
640                                               hfp_version, IOT_CONF_BYTE_NUM_2);
641   }
642   /* do service discovery to get features */
643   bta_ag_do_disc(p_scb, bta_ag_svc_mask[p_scb->conn_service]);
644 
645   /* continue with common open processing */
646   bta_ag_rfc_open(p_scb, data);
647 }
648 
649 /*******************************************************************************
650  *
651  * Function         bta_ag_rfc_data
652  *
653  * Description      Read and process data from RFCOMM.
654  *
655  *
656  * Returns          void
657  *
658  ******************************************************************************/
bta_ag_rfc_data(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)659 void bta_ag_rfc_data(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /* data */) {
660   uint16_t len;
661   char buf[BTA_AG_RFC_READ_MAX] = "";
662 
663   log::verbose("");
664 
665   /* do the following */
666   for (;;) {
667     /* read data from rfcomm; if bad status, we're done */
668     if (PORT_ReadData(p_scb->conn_handle, buf, BTA_AG_RFC_READ_MAX, &len) != PORT_SUCCESS) {
669       log::error("failed to read data {}", p_scb->peer_addr);
670       break;
671     }
672 
673     /* if no data, we're done */
674     if (len == 0) {
675       log::warn("no data for {}", p_scb->peer_addr);
676       break;
677     }
678 
679     /* run AT command interpreter on data */
680     bta_sys_busy(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
681     bta_ag_at_parse(&p_scb->at_cb, buf, len);
682     if ((p_scb->sco_idx != BTM_INVALID_SCO_INDEX) && bta_ag_sco_is_open(p_scb)) {
683       log::verbose("change link policy for SCO");
684       bta_sys_sco_open(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
685     } else {
686       bta_sys_idle(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
687     }
688 
689     /* no more data to read, we're done */
690     if (len < BTA_AG_RFC_READ_MAX) {
691       break;
692     }
693   }
694 }
695 
696 /*******************************************************************************
697  *
698  * Function         bta_ag_start_close
699  *
700  * Description      Start the process of closing SCO and RFCOMM connection.
701  *
702  *
703  * Returns          void
704  *
705  ******************************************************************************/
bta_ag_start_close(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)706 void bta_ag_start_close(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
707   /* Take the link out of sniff and set L2C idle time to 0 */
708   bta_dm_pm_active(p_scb->peer_addr);
709   if (!stack::l2cap::get_interface().L2CA_SetIdleTimeoutByBdAddr(p_scb->peer_addr, 0,
710                                                                  BT_TRANSPORT_BR_EDR)) {
711     log::warn("Unable to set idle timeout peer:{}", p_scb->peer_addr);
712   }
713 
714   /* if SCO is open close SCO and wait on RFCOMM close */
715   if (bta_ag_sco_is_open(p_scb)) {
716     p_scb->post_sco = BTA_AG_POST_SCO_CLOSE_RFC;
717   } else {
718     p_scb->post_sco = BTA_AG_POST_SCO_NONE;
719     bta_ag_rfc_do_close(p_scb, data);
720   }
721 
722   /* always do SCO shutdown to handle all SCO corner cases */
723   bta_ag_sco_shutdown(p_scb, data);
724 }
725 
726 /*******************************************************************************
727  *
728  * Function         bta_ag_post_sco_open
729  *
730  * Description      Perform post-SCO open action, if any
731  *
732  *
733  * Returns          void
734  *
735  ******************************************************************************/
bta_ag_post_sco_open(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)736 void bta_ag_post_sco_open(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
737   switch (p_scb->post_sco) {
738     case BTA_AG_POST_SCO_RING:
739       bta_ag_send_ring(p_scb, data);
740       p_scb->post_sco = BTA_AG_POST_SCO_NONE;
741       break;
742 
743     case BTA_AG_POST_SCO_CALL_CONN:
744       bta_ag_send_call_inds(p_scb, BTA_AG_IN_CALL_CONN_RES);
745       p_scb->post_sco = BTA_AG_POST_SCO_NONE;
746       break;
747 
748     default:
749       break;
750   }
751 }
752 
753 /*******************************************************************************
754  *
755  * Function         bta_ag_post_sco_close
756  *
757  * Description      Perform post-SCO close action, if any
758  *
759  *
760  * Returns          void
761  *
762  ******************************************************************************/
bta_ag_post_sco_close(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)763 void bta_ag_post_sco_close(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
764   switch (p_scb->post_sco) {
765     case BTA_AG_POST_SCO_CLOSE_RFC:
766       bta_ag_rfc_do_close(p_scb, data);
767       p_scb->post_sco = BTA_AG_POST_SCO_NONE;
768       break;
769 
770     case BTA_AG_POST_SCO_CALL_CONN:
771       bta_ag_send_call_inds(p_scb, BTA_AG_IN_CALL_CONN_RES);
772       p_scb->post_sco = BTA_AG_POST_SCO_NONE;
773       break;
774 
775     case BTA_AG_POST_SCO_CALL_ORIG:
776       bta_ag_send_call_inds(p_scb, BTA_AG_OUT_CALL_ORIG_RES);
777       p_scb->post_sco = BTA_AG_POST_SCO_NONE;
778       break;
779 
780     case BTA_AG_POST_SCO_CALL_END:
781       bta_ag_send_call_inds(p_scb, BTA_AG_END_CALL_RES);
782       p_scb->post_sco = BTA_AG_POST_SCO_NONE;
783       break;
784 
785     case BTA_AG_POST_SCO_CALL_END_INCALL:
786       bta_ag_send_call_inds(p_scb, BTA_AG_END_CALL_RES);
787 
788       /* Sending callsetup IND and Ring were deferred to after SCO close. */
789       bta_ag_send_call_inds(p_scb, BTA_AG_IN_CALL_RES);
790 
791       if (bta_ag_inband_enabled(p_scb) && !(p_scb->features & BTA_AG_FEAT_NOSCO)) {
792         p_scb->post_sco = BTA_AG_POST_SCO_RING;
793         if (!bta_ag_is_sco_open_allowed(p_scb, "BTA_AG_POST_SCO_CALL_END_INCALL")) {
794           break;
795         }
796         if (bta_ag_is_sco_managed_by_audio()) {
797           // let Audio HAL open the SCO
798           break;
799         }
800         bta_ag_sco_open(p_scb, data);
801       } else {
802         p_scb->post_sco = BTA_AG_POST_SCO_NONE;
803         bta_ag_send_ring(p_scb, data);
804       }
805       break;
806 
807     default:
808       break;
809   }
810 }
811 
812 /*******************************************************************************
813  *
814  * Function         bta_ag_svc_conn_open
815  *
816  * Description      Service level connection opened
817  *
818  *
819  * Returns          void
820  *
821  ******************************************************************************/
bta_ag_svc_conn_open(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)822 void bta_ag_svc_conn_open(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /* data */) {
823   tBTA_AG_CONN evt = {};
824 
825   if (!p_scb->svc_conn) {
826     /* set state variable */
827     p_scb->svc_conn = true;
828 
829     /* Clear AT+BIA mask from previous SLC if any. */
830     p_scb->bia_masked_out = 0;
831 
832     alarm_cancel(p_scb->ring_timer);
833 
834     /* call callback */
835     evt.hdr.handle = bta_ag_scb_to_idx(p_scb);
836     evt.hdr.app_id = p_scb->app_id;
837     evt.peer_feat = p_scb->peer_features;
838     evt.bd_addr = p_scb->peer_addr;
839     evt.peer_codec = p_scb->peer_codecs;
840 
841     if ((p_scb->call_ind != BTA_AG_CALL_INACTIVE) ||
842         (p_scb->callsetup_ind != BTA_AG_CALLSETUP_NONE)) {
843       bta_sys_sco_use(BTA_ID_AG, p_scb->app_id, p_scb->peer_addr);
844     }
845     if (bta_ag_get_active_device().IsEmpty()) {
846       bta_ag_api_set_active_device(p_scb->peer_addr);
847     }
848     (*bta_ag_cb.p_cback)(BTA_AG_CONN_EVT, (tBTA_AG*)&evt);
849   }
850 }
851 
852 /*******************************************************************************
853  *
854  * Function         bta_ag_setcodec
855  *
856  * Description      Handle API SetCodec
857  *
858  *
859  * Returns          void
860  *
861  ******************************************************************************/
bta_ag_setcodec(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA & data)862 void bta_ag_setcodec(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& data) {
863   tBTA_AG_PEER_CODEC codec_type = data.api_setcodec.codec;
864   tBTA_AG_VAL val = {};
865   const bool aptx_voice =
866           is_hfp_aptx_voice_enabled() && (codec_type == BTA_AG_SCO_APTX_SWB_SETTINGS_Q0);
867   log::verbose("aptx_voice={}, codec_type={:#x}", aptx_voice, codec_type);
868 
869   val.hdr.handle = bta_ag_scb_to_idx(p_scb);
870 
871   /* Check if the requested codec type is valid */
872   if ((codec_type != BTM_SCO_CODEC_NONE) && (codec_type != BTM_SCO_CODEC_CVSD) &&
873       (codec_type != BTM_SCO_CODEC_MSBC) && (codec_type != BTM_SCO_CODEC_LC3) && !aptx_voice) {
874     val.num = codec_type;
875     val.hdr.status = BTA_AG_FAIL_RESOURCES;
876     log::error("bta_ag_setcodec error: unsupported codec type {}", codec_type);
877     (*bta_ag_cb.p_cback)(BTA_AG_CODEC_EVT, (tBTA_AG*)&val);
878     return;
879   }
880 
881   if ((p_scb->peer_codecs & codec_type) || (codec_type == BTM_SCO_CODEC_NONE) ||
882       (codec_type == BTM_SCO_CODEC_CVSD)) {
883     p_scb->sco_codec = codec_type;
884     p_scb->codec_updated = true;
885     val.num = codec_type;
886     val.hdr.status = BTA_AG_SUCCESS;
887     log::verbose("bta_ag_setcodec: Updated codec type {}", codec_type);
888   } else {
889     val.num = codec_type;
890     val.hdr.status = BTA_AG_FAIL_RESOURCES;
891     log::error("bta_ag_setcodec error: unsupported codec type {}", codec_type);
892   }
893 
894   (*bta_ag_cb.p_cback)(BTA_AG_CODEC_EVT, (tBTA_AG*)&val);
895 }
896 
bta_ag_collision_timer_cback(void * data)897 static void bta_ag_collision_timer_cback(void* data) {
898   if (data == nullptr) {
899     log::error("data should never be null in a timer callback");
900     return;
901   }
902   /* If the peer haven't opened AG connection     */
903   /* we will restart opening process.             */
904   bta_ag_resume_open(static_cast<tBTA_AG_SCB*>(data));
905 }
906 
bta_ag_handle_collision(tBTA_AG_SCB * p_scb,const tBTA_AG_DATA &)907 void bta_ag_handle_collision(tBTA_AG_SCB* p_scb, const tBTA_AG_DATA& /* data */) {
908   /* Cancel SDP if it had been started. */
909   if (p_scb->p_disc_db) {
910     if (!get_legacy_stack_sdp_api()->service.SDP_CancelServiceSearch(p_scb->p_disc_db)) {
911       log::warn("Unable to cancel SDP service discovery search peer:{}", p_scb->peer_addr);
912     }
913     bta_ag_free_db(p_scb, tBTA_AG_DATA::kEmpty);
914   }
915 
916   /* reopen registered servers */
917   /* Collision may be detected before or after we close servers. */
918   if (bta_ag_is_server_closed(p_scb)) {
919     bta_ag_start_servers(p_scb, p_scb->reg_services);
920   }
921 
922   /* Start timer to han */
923   alarm_set_on_mloop(p_scb->collision_timer, BTA_AG_COLLISION_TIMEOUT_MS,
924                      bta_ag_collision_timer_cback, p_scb);
925 }
926