• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /******************************************************************************
2  *
3  *  Copyright 1999-2012 Broadcom Corporation
4  *
5  *  Licensed under the Apache License, Version 2.0 (the "License");
6  *  you may not use this file except in compliance with the License.
7  *  You may obtain a copy of the License at:
8  *
9  *  http://www.apache.org/licenses/LICENSE-2.0
10  *
11  *  Unless required by applicable law or agreed to in writing, software
12  *  distributed under the License is distributed on an "AS IS" BASIS,
13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14  *  See the License for the specific language governing permissions and
15  *  limitations under the License.
16  *
17  ******************************************************************************/
18 
19 /******************************************************************************
20  *
21  *  This file contains functions that interface with the HCI transport. On
22  *  the receive side, it routes events to the appropriate handler, e.g.
23  *  L2CAP, ScoMgr. On the transmit side, it manages the command
24  *  transmission.
25  *
26  ******************************************************************************/
27 
28 #define LOG_TAG "bt_btu_hcif"
29 
30 #include <base/bind.h>
31 #include <base/callback.h>
32 #include <base/location.h>
33 #include <base/logging.h>
34 #include <base/threading/thread.h>
35 #include <log/log.h>
36 #include <statslog.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40 
41 #include "bt_common.h"
42 #include "bt_types.h"
43 #include "bt_utils.h"
44 #include "btm_api.h"
45 #include "btm_int.h"
46 #include "btu.h"
47 #include "device/include/controller.h"
48 #include "hci_layer.h"
49 #include "hcimsgs.h"
50 #include "l2c_int.h"
51 #include "osi/include/log.h"
52 #include "osi/include/osi.h"
53 
54 using tracked_objects::Location;
55 
56 extern void btm_process_cancel_complete(uint8_t status, uint8_t mode);
57 extern void btm_ble_test_command_complete(uint8_t* p);
58 
59 /******************************************************************************/
60 /*            L O C A L    F U N C T I O N     P R O T O T Y P E S            */
61 /******************************************************************************/
62 static void btu_hcif_inquiry_comp_evt(uint8_t* p);
63 static void btu_hcif_inquiry_result_evt(uint8_t* p);
64 static void btu_hcif_inquiry_rssi_result_evt(uint8_t* p);
65 static void btu_hcif_extended_inquiry_result_evt(uint8_t* p);
66 
67 static void btu_hcif_connection_comp_evt(uint8_t* p);
68 static void btu_hcif_connection_request_evt(uint8_t* p);
69 static void btu_hcif_disconnection_comp_evt(uint8_t* p);
70 static void btu_hcif_authentication_comp_evt(uint8_t* p);
71 static void btu_hcif_rmt_name_request_comp_evt(uint8_t* p, uint16_t evt_len);
72 static void btu_hcif_encryption_change_evt(uint8_t* p);
73 static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p);
74 static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
75                                                     uint8_t evt_len);
76 static void btu_hcif_read_rmt_version_comp_evt(uint8_t* p);
77 static void btu_hcif_qos_setup_comp_evt(uint8_t* p);
78 static void btu_hcif_command_complete_evt(BT_HDR* response, void* context);
79 static void btu_hcif_command_status_evt(uint8_t status, BT_HDR* command,
80                                         void* context);
81 static void btu_hcif_hardware_error_evt(uint8_t* p);
82 static void btu_hcif_flush_occured_evt(void);
83 static void btu_hcif_role_change_evt(uint8_t* p);
84 static void btu_hcif_num_compl_data_pkts_evt(uint8_t* p);
85 static void btu_hcif_mode_change_evt(uint8_t* p);
86 static void btu_hcif_pin_code_request_evt(uint8_t* p);
87 static void btu_hcif_link_key_request_evt(uint8_t* p);
88 static void btu_hcif_link_key_notification_evt(uint8_t* p);
89 static void btu_hcif_loopback_command_evt(void);
90 static void btu_hcif_data_buf_overflow_evt(void);
91 static void btu_hcif_max_slots_changed_evt(void);
92 static void btu_hcif_read_clock_off_comp_evt(uint8_t* p);
93 static void btu_hcif_conn_pkt_type_change_evt(void);
94 static void btu_hcif_qos_violation_evt(uint8_t* p);
95 static void btu_hcif_page_scan_mode_change_evt(void);
96 static void btu_hcif_page_scan_rep_mode_chng_evt(void);
97 static void btu_hcif_esco_connection_comp_evt(uint8_t* p);
98 static void btu_hcif_esco_connection_chg_evt(uint8_t* p);
99 
100 /* Simple Pairing Events */
101 static void btu_hcif_host_support_evt(uint8_t* p);
102 static void btu_hcif_io_cap_request_evt(uint8_t* p);
103 static void btu_hcif_io_cap_response_evt(uint8_t* p);
104 static void btu_hcif_user_conf_request_evt(uint8_t* p);
105 static void btu_hcif_user_passkey_request_evt(uint8_t* p);
106 static void btu_hcif_user_passkey_notif_evt(uint8_t* p);
107 static void btu_hcif_keypress_notif_evt(uint8_t* p);
108 static void btu_hcif_rem_oob_request_evt(uint8_t* p);
109 
110 static void btu_hcif_simple_pair_complete_evt(uint8_t* p);
111 #if L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE
112 static void btu_hcif_enhanced_flush_complete_evt(void);
113 #endif
114 
115 #if (BTM_SSR_INCLUDED == TRUE)
116 static void btu_hcif_ssr_evt(uint8_t* p, uint16_t evt_len);
117 #endif /* BTM_SSR_INCLUDED == TRUE */
118 
119 static void btu_ble_ll_conn_complete_evt(uint8_t* p, uint16_t evt_len);
120 static void btu_ble_read_remote_feat_evt(uint8_t* p);
121 static void btu_ble_ll_conn_param_upd_evt(uint8_t* p, uint16_t evt_len);
122 static void btu_ble_proc_ltk_req(uint8_t* p);
123 static void btu_hcif_encryption_key_refresh_cmpl_evt(uint8_t* p);
124 static void btu_ble_data_length_change_evt(uint8_t* p, uint16_t evt_len);
125 #if (BLE_LLT_INCLUDED == TRUE)
126 static void btu_ble_rc_param_req_evt(uint8_t* p);
127 #endif
128 #if (BLE_PRIVACY_SPT == TRUE)
129 static void btu_ble_proc_enhanced_conn_cmpl(uint8_t* p, uint16_t evt_len);
130 #endif
131 
do_in_hci_thread(const tracked_objects::Location & from_here,const base::Closure & task)132 static void do_in_hci_thread(const tracked_objects::Location& from_here,
133                              const base::Closure& task) {
134   base::MessageLoop* hci_message_loop = get_message_loop();
135   if (!hci_message_loop || !hci_message_loop->task_runner().get()) {
136     LOG_ERROR(LOG_TAG, "%s: HCI message loop not running, accessed from %s",
137               __func__, from_here.ToString().c_str());
138     return;
139   }
140 
141   hci_message_loop->task_runner()->PostTask(from_here, task);
142 }
143 
144 /*******************************************************************************
145  *
146  * Function         btu_hcif_process_event
147  *
148  * Description      This function is called when an event is received from
149  *                  the Host Controller.
150  *
151  * Returns          void
152  *
153  ******************************************************************************/
btu_hcif_process_event(UNUSED_ATTR uint8_t controller_id,BT_HDR * p_msg)154 void btu_hcif_process_event(UNUSED_ATTR uint8_t controller_id, BT_HDR* p_msg) {
155   uint8_t* p = (uint8_t*)(p_msg + 1) + p_msg->offset;
156   uint8_t hci_evt_code, hci_evt_len;
157   uint8_t ble_sub_code;
158   STREAM_TO_UINT8(hci_evt_code, p);
159   STREAM_TO_UINT8(hci_evt_len, p);
160 
161   switch (hci_evt_code) {
162     case HCI_INQUIRY_COMP_EVT:
163       btu_hcif_inquiry_comp_evt(p);
164       break;
165     case HCI_INQUIRY_RESULT_EVT:
166       btu_hcif_inquiry_result_evt(p);
167       break;
168     case HCI_INQUIRY_RSSI_RESULT_EVT:
169       btu_hcif_inquiry_rssi_result_evt(p);
170       break;
171     case HCI_EXTENDED_INQUIRY_RESULT_EVT:
172       btu_hcif_extended_inquiry_result_evt(p);
173       break;
174     case HCI_CONNECTION_COMP_EVT:
175       btu_hcif_connection_comp_evt(p);
176       break;
177     case HCI_CONNECTION_REQUEST_EVT:
178       btu_hcif_connection_request_evt(p);
179       break;
180     case HCI_DISCONNECTION_COMP_EVT:
181       btu_hcif_disconnection_comp_evt(p);
182       break;
183     case HCI_AUTHENTICATION_COMP_EVT:
184       btu_hcif_authentication_comp_evt(p);
185       break;
186     case HCI_RMT_NAME_REQUEST_COMP_EVT:
187       btu_hcif_rmt_name_request_comp_evt(p, hci_evt_len);
188       break;
189     case HCI_ENCRYPTION_CHANGE_EVT:
190       btu_hcif_encryption_change_evt(p);
191       break;
192     case HCI_ENCRYPTION_KEY_REFRESH_COMP_EVT:
193       btu_hcif_encryption_key_refresh_cmpl_evt(p);
194       break;
195     case HCI_READ_RMT_FEATURES_COMP_EVT:
196       btu_hcif_read_rmt_features_comp_evt(p);
197       break;
198     case HCI_READ_RMT_EXT_FEATURES_COMP_EVT:
199       btu_hcif_read_rmt_ext_features_comp_evt(p, hci_evt_len);
200       break;
201     case HCI_READ_RMT_VERSION_COMP_EVT:
202       btu_hcif_read_rmt_version_comp_evt(p);
203       break;
204     case HCI_QOS_SETUP_COMP_EVT:
205       btu_hcif_qos_setup_comp_evt(p);
206       break;
207     case HCI_COMMAND_COMPLETE_EVT:
208       LOG_ERROR(LOG_TAG,
209                 "%s should not have received a command complete event. "
210                 "Someone didn't go through the hci transmit_command function.",
211                 __func__);
212       break;
213     case HCI_COMMAND_STATUS_EVT:
214       LOG_ERROR(LOG_TAG,
215                 "%s should not have received a command status event. "
216                 "Someone didn't go through the hci transmit_command function.",
217                 __func__);
218       break;
219     case HCI_HARDWARE_ERROR_EVT:
220       btu_hcif_hardware_error_evt(p);
221       break;
222     case HCI_FLUSH_OCCURED_EVT:
223       btu_hcif_flush_occured_evt();
224       break;
225     case HCI_ROLE_CHANGE_EVT:
226       btu_hcif_role_change_evt(p);
227       break;
228     case HCI_NUM_COMPL_DATA_PKTS_EVT:
229       btu_hcif_num_compl_data_pkts_evt(p);
230       break;
231     case HCI_MODE_CHANGE_EVT:
232       btu_hcif_mode_change_evt(p);
233       break;
234     case HCI_PIN_CODE_REQUEST_EVT:
235       btu_hcif_pin_code_request_evt(p);
236       break;
237     case HCI_LINK_KEY_REQUEST_EVT:
238       btu_hcif_link_key_request_evt(p);
239       break;
240     case HCI_LINK_KEY_NOTIFICATION_EVT:
241       btu_hcif_link_key_notification_evt(p);
242       break;
243     case HCI_LOOPBACK_COMMAND_EVT:
244       btu_hcif_loopback_command_evt();
245       break;
246     case HCI_DATA_BUF_OVERFLOW_EVT:
247       btu_hcif_data_buf_overflow_evt();
248       break;
249     case HCI_MAX_SLOTS_CHANGED_EVT:
250       btu_hcif_max_slots_changed_evt();
251       break;
252     case HCI_READ_CLOCK_OFF_COMP_EVT:
253       btu_hcif_read_clock_off_comp_evt(p);
254       break;
255     case HCI_CONN_PKT_TYPE_CHANGE_EVT:
256       btu_hcif_conn_pkt_type_change_evt();
257       break;
258     case HCI_QOS_VIOLATION_EVT:
259       btu_hcif_qos_violation_evt(p);
260       break;
261     case HCI_PAGE_SCAN_MODE_CHANGE_EVT:
262       btu_hcif_page_scan_mode_change_evt();
263       break;
264     case HCI_PAGE_SCAN_REP_MODE_CHNG_EVT:
265       btu_hcif_page_scan_rep_mode_chng_evt();
266       break;
267     case HCI_ESCO_CONNECTION_COMP_EVT:
268       btu_hcif_esco_connection_comp_evt(p);
269       break;
270     case HCI_ESCO_CONNECTION_CHANGED_EVT:
271       btu_hcif_esco_connection_chg_evt(p);
272       break;
273 #if (BTM_SSR_INCLUDED == TRUE)
274     case HCI_SNIFF_SUB_RATE_EVT:
275       btu_hcif_ssr_evt(p, hci_evt_len);
276       break;
277 #endif /* BTM_SSR_INCLUDED == TRUE */
278     case HCI_RMT_HOST_SUP_FEAT_NOTIFY_EVT:
279       btu_hcif_host_support_evt(p);
280       break;
281     case HCI_IO_CAPABILITY_REQUEST_EVT:
282       btu_hcif_io_cap_request_evt(p);
283       break;
284     case HCI_IO_CAPABILITY_RESPONSE_EVT:
285       btu_hcif_io_cap_response_evt(p);
286       break;
287     case HCI_USER_CONFIRMATION_REQUEST_EVT:
288       btu_hcif_user_conf_request_evt(p);
289       break;
290     case HCI_USER_PASSKEY_REQUEST_EVT:
291       btu_hcif_user_passkey_request_evt(p);
292       break;
293     case HCI_REMOTE_OOB_DATA_REQUEST_EVT:
294       btu_hcif_rem_oob_request_evt(p);
295       break;
296     case HCI_SIMPLE_PAIRING_COMPLETE_EVT:
297       btu_hcif_simple_pair_complete_evt(p);
298       break;
299     case HCI_USER_PASSKEY_NOTIFY_EVT:
300       btu_hcif_user_passkey_notif_evt(p);
301       break;
302     case HCI_KEYPRESS_NOTIFY_EVT:
303       btu_hcif_keypress_notif_evt(p);
304       break;
305 #if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
306     case HCI_ENHANCED_FLUSH_COMPLETE_EVT:
307       btu_hcif_enhanced_flush_complete_evt();
308       break;
309 #endif
310 
311     case HCI_BLE_EVENT: {
312       STREAM_TO_UINT8(ble_sub_code, p);
313 
314       HCI_TRACE_EVENT("BLE HCI(id=%d) event = 0x%02x)", hci_evt_code,
315                       ble_sub_code);
316 
317       uint8_t ble_evt_len = hci_evt_len - 1;
318       switch (ble_sub_code) {
319         case HCI_BLE_ADV_PKT_RPT_EVT: /* result of inquiry */
320           HCI_TRACE_EVENT("HCI_BLE_ADV_PKT_RPT_EVT");
321           btm_ble_process_adv_pkt(ble_evt_len, p);
322           break;
323         case HCI_BLE_CONN_COMPLETE_EVT:
324           btu_ble_ll_conn_complete_evt(p, hci_evt_len);
325           break;
326         case HCI_BLE_LL_CONN_PARAM_UPD_EVT:
327           btu_ble_ll_conn_param_upd_evt(p, hci_evt_len);
328           break;
329         case HCI_BLE_READ_REMOTE_FEAT_CMPL_EVT:
330           btu_ble_read_remote_feat_evt(p);
331           break;
332         case HCI_BLE_LTK_REQ_EVT: /* received only at slave device */
333           btu_ble_proc_ltk_req(p);
334           break;
335 #if (BLE_PRIVACY_SPT == TRUE)
336         case HCI_BLE_ENHANCED_CONN_COMPLETE_EVT:
337           btu_ble_proc_enhanced_conn_cmpl(p, hci_evt_len);
338           break;
339 #endif
340 #if (BLE_LLT_INCLUDED == TRUE)
341         case HCI_BLE_RC_PARAM_REQ_EVT:
342           btu_ble_rc_param_req_evt(p);
343           break;
344 #endif
345         case HCI_BLE_DATA_LENGTH_CHANGE_EVT:
346           btu_ble_data_length_change_evt(p, hci_evt_len);
347           break;
348 
349         case HCI_BLE_PHY_UPDATE_COMPLETE_EVT:
350           btm_ble_process_phy_update_pkt(ble_evt_len, p);
351           break;
352 
353         case HCI_LE_EXTENDED_ADVERTISING_REPORT_EVT:
354           btm_ble_process_ext_adv_pkt(hci_evt_len, p);
355           break;
356 
357         case HCI_LE_ADVERTISING_SET_TERMINATED_EVT:
358           btm_le_on_advertising_set_terminated(p, hci_evt_len);
359           break;
360       }
361       break;
362     }
363 
364     case HCI_VENDOR_SPECIFIC_EVT:
365       btm_vendor_specific_evt(p, hci_evt_len);
366       break;
367   }
368 }
369 
370 /*******************************************************************************
371  *
372  * Function         btu_hcif_send_cmd
373  *
374  * Description      This function is called to send commands to the Host
375  *                  Controller.
376  *
377  * Returns          void
378  *
379  ******************************************************************************/
btu_hcif_send_cmd(UNUSED_ATTR uint8_t controller_id,BT_HDR * p_buf)380 void btu_hcif_send_cmd(UNUSED_ATTR uint8_t controller_id, BT_HDR* p_buf) {
381   if (!p_buf) return;
382 
383   uint16_t opcode;
384   uint8_t* stream = p_buf->data + p_buf->offset;
385   void* vsc_callback = NULL;
386 
387   STREAM_TO_UINT16(opcode, stream);
388 
389   // Eww...horrible hackery here
390   /* If command was a VSC, then extract command_complete callback */
391   if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC ||
392       (opcode == HCI_BLE_RAND) || (opcode == HCI_BLE_ENCRYPT)) {
393     vsc_callback = *((void**)(p_buf + 1));
394   }
395 
396   hci_layer_get_interface()->transmit_command(
397       p_buf, btu_hcif_command_complete_evt, btu_hcif_command_status_evt,
398       vsc_callback);
399 }
400 
401 using hci_cmd_cb = base::Callback<void(uint8_t* /* return_parameters */,
402                                        uint16_t /* return_parameters_length*/)>;
403 
404 struct cmd_with_cb_data {
405   hci_cmd_cb cb;
406   Location posted_from;
407 };
408 
cmd_with_cb_data_init(cmd_with_cb_data * cb_wrapper)409 void cmd_with_cb_data_init(cmd_with_cb_data* cb_wrapper) {
410   new (&cb_wrapper->cb) hci_cmd_cb;
411   new (&cb_wrapper->posted_from) Location;
412 }
413 
cmd_with_cb_data_cleanup(cmd_with_cb_data * cb_wrapper)414 void cmd_with_cb_data_cleanup(cmd_with_cb_data* cb_wrapper) {
415   cb_wrapper->cb.~hci_cmd_cb();
416   cb_wrapper->posted_from.~Location();
417 }
418 
btu_hcif_command_complete_evt_with_cb_on_task(BT_HDR * event,void * context)419 static void btu_hcif_command_complete_evt_with_cb_on_task(BT_HDR* event,
420                                                           void* context) {
421   command_opcode_t opcode;
422   uint8_t* stream =
423       event->data + event->offset +
424       3;  // 2 to skip the event headers, 1 to skip the command credits
425   STREAM_TO_UINT16(opcode, stream);
426 
427   cmd_with_cb_data* cb_wrapper = (cmd_with_cb_data*)context;
428   HCI_TRACE_DEBUG("command complete for: %s",
429                   cb_wrapper->posted_from.ToString().c_str());
430   cb_wrapper->cb.Run(stream, event->len - 5);
431   cmd_with_cb_data_cleanup(cb_wrapper);
432   osi_free(cb_wrapper);
433 
434   osi_free(event);
435 }
436 
btu_hcif_command_complete_evt_with_cb(BT_HDR * response,void * context)437 static void btu_hcif_command_complete_evt_with_cb(BT_HDR* response,
438                                                   void* context) {
439   do_in_hci_thread(FROM_HERE,
440                    base::Bind(btu_hcif_command_complete_evt_with_cb_on_task,
441                               response, context));
442 }
443 
btu_hcif_command_status_evt_with_cb_on_task(uint8_t status,BT_HDR * event,void * context)444 static void btu_hcif_command_status_evt_with_cb_on_task(uint8_t status,
445                                                         BT_HDR* event,
446                                                         void* context) {
447   command_opcode_t opcode;
448   uint8_t* stream = event->data + event->offset;
449   STREAM_TO_UINT16(opcode, stream);
450 
451   CHECK(status != 0);
452 
453   // report command status error
454   cmd_with_cb_data* cb_wrapper = (cmd_with_cb_data*)context;
455   HCI_TRACE_DEBUG("command status for: %s",
456                   cb_wrapper->posted_from.ToString().c_str());
457   cb_wrapper->cb.Run(&status, sizeof(uint16_t));
458   cmd_with_cb_data_cleanup(cb_wrapper);
459   osi_free(cb_wrapper);
460 
461   osi_free(event);
462 }
463 
btu_hcif_command_status_evt_with_cb(uint8_t status,BT_HDR * command,void * context)464 static void btu_hcif_command_status_evt_with_cb(uint8_t status, BT_HDR* command,
465                                                 void* context) {
466   // Command is pending, we  report only error.
467   if (!status) {
468     osi_free(command);
469     return;
470   }
471 
472   do_in_hci_thread(
473       FROM_HERE, base::Bind(btu_hcif_command_status_evt_with_cb_on_task, status,
474                             command, context));
475 }
476 
477 /* This function is called to send commands to the Host Controller. |cb| is
478  * called when command status event is called with error code, or when the
479  * command complete event is received. */
btu_hcif_send_cmd_with_cb(const tracked_objects::Location & posted_from,uint16_t opcode,uint8_t * params,uint8_t params_len,hci_cmd_cb cb)480 void btu_hcif_send_cmd_with_cb(const tracked_objects::Location& posted_from,
481                                uint16_t opcode, uint8_t* params,
482                                uint8_t params_len, hci_cmd_cb cb) {
483   BT_HDR* p = (BT_HDR*)osi_malloc(HCI_CMD_BUF_SIZE);
484   uint8_t* pp = (uint8_t*)(p + 1);
485 
486   p->len = HCIC_PREAMBLE_SIZE + params_len;
487   p->offset = 0;
488 
489   UINT16_TO_STREAM(pp, opcode);
490   UINT8_TO_STREAM(pp, params_len);
491   if (params) {
492     memcpy(pp, params, params_len);
493   }
494 
495   cmd_with_cb_data* cb_wrapper =
496       (cmd_with_cb_data*)osi_malloc(sizeof(cmd_with_cb_data));
497 
498   cmd_with_cb_data_init(cb_wrapper);
499   cb_wrapper->cb = cb;
500   cb_wrapper->posted_from = posted_from;
501 
502   hci_layer_get_interface()->transmit_command(
503       p, btu_hcif_command_complete_evt_with_cb,
504       btu_hcif_command_status_evt_with_cb, (void*)cb_wrapper);
505 }
506 
507 /*******************************************************************************
508  *
509  * Function         btu_hcif_inquiry_comp_evt
510  *
511  * Description      Process event HCI_INQUIRY_COMP_EVT
512  *
513  * Returns          void
514  *
515  ******************************************************************************/
btu_hcif_inquiry_comp_evt(uint8_t * p)516 static void btu_hcif_inquiry_comp_evt(uint8_t* p) {
517   uint8_t status;
518 
519   STREAM_TO_UINT8(status, p);
520 
521   /* Tell inquiry processing that we are done */
522   btm_process_inq_complete(status, BTM_BR_INQUIRY_MASK);
523 }
524 
525 /*******************************************************************************
526  *
527  * Function         btu_hcif_inquiry_result_evt
528  *
529  * Description      Process event HCI_INQUIRY_RESULT_EVT
530  *
531  * Returns          void
532  *
533  ******************************************************************************/
btu_hcif_inquiry_result_evt(uint8_t * p)534 static void btu_hcif_inquiry_result_evt(uint8_t* p) {
535   /* Store results in the cache */
536   btm_process_inq_results(p, BTM_INQ_RESULT_STANDARD);
537 }
538 
539 /*******************************************************************************
540  *
541  * Function         btu_hcif_inquiry_rssi_result_evt
542  *
543  * Description      Process event HCI_INQUIRY_RSSI_RESULT_EVT
544  *
545  * Returns          void
546  *
547  ******************************************************************************/
btu_hcif_inquiry_rssi_result_evt(uint8_t * p)548 static void btu_hcif_inquiry_rssi_result_evt(uint8_t* p) {
549   /* Store results in the cache */
550   btm_process_inq_results(p, BTM_INQ_RESULT_WITH_RSSI);
551 }
552 
553 /*******************************************************************************
554  *
555  * Function         btu_hcif_extended_inquiry_result_evt
556  *
557  * Description      Process event HCI_EXTENDED_INQUIRY_RESULT_EVT
558  *
559  * Returns          void
560  *
561  ******************************************************************************/
btu_hcif_extended_inquiry_result_evt(uint8_t * p)562 static void btu_hcif_extended_inquiry_result_evt(uint8_t* p) {
563   /* Store results in the cache */
564   btm_process_inq_results(p, BTM_INQ_RESULT_EXTENDED);
565 }
566 
567 /*******************************************************************************
568  *
569  * Function         btu_hcif_connection_comp_evt
570  *
571  * Description      Process event HCI_CONNECTION_COMP_EVT
572  *
573  * Returns          void
574  *
575  ******************************************************************************/
btu_hcif_connection_comp_evt(uint8_t * p)576 static void btu_hcif_connection_comp_evt(uint8_t* p) {
577   uint8_t status;
578   uint16_t handle;
579   RawAddress bda;
580   uint8_t link_type;
581   uint8_t enc_mode;
582 #if (BTM_SCO_INCLUDED == TRUE)
583   tBTM_ESCO_DATA esco_data;
584 #endif
585 
586   STREAM_TO_UINT8(status, p);
587   STREAM_TO_UINT16(handle, p);
588   STREAM_TO_BDADDR(bda, p);
589   STREAM_TO_UINT8(link_type, p);
590   STREAM_TO_UINT8(enc_mode, p);
591 
592   handle = HCID_GET_HANDLE(handle);
593 
594   if (status != HCI_SUCCESS) {
595     HCI_TRACE_DEBUG(
596         "%s: Connection failed: status=%d, handle=%d, link_type=%d, "
597         "enc_mode=%d",
598         __func__, status, handle, link_type, enc_mode);
599   }
600 
601   if (link_type == HCI_LINK_TYPE_ACL) {
602     btm_sec_connected(bda, handle, status, enc_mode);
603 
604     l2c_link_hci_conn_comp(status, handle, bda);
605   }
606 #if (BTM_SCO_INCLUDED == TRUE)
607   else {
608     memset(&esco_data, 0, sizeof(tBTM_ESCO_DATA));
609     /* esco_data.link_type = HCI_LINK_TYPE_SCO; already zero */
610     esco_data.bd_addr = bda;
611     btm_sco_connected(status, &bda, handle, &esco_data);
612   }
613 #endif /* BTM_SCO_INCLUDED */
614 }
615 
616 /*******************************************************************************
617  *
618  * Function         btu_hcif_connection_request_evt
619  *
620  * Description      Process event HCI_CONNECTION_REQUEST_EVT
621  *
622  * Returns          void
623  *
624  ******************************************************************************/
btu_hcif_connection_request_evt(uint8_t * p)625 static void btu_hcif_connection_request_evt(uint8_t* p) {
626   RawAddress bda;
627   DEV_CLASS dc;
628   uint8_t link_type;
629 
630   STREAM_TO_BDADDR(bda, p);
631   STREAM_TO_DEVCLASS(dc, p);
632   STREAM_TO_UINT8(link_type, p);
633 
634   /* Pass request to security manager to check connect filters before */
635   /* passing request to l2cap */
636   if (link_type == HCI_LINK_TYPE_ACL) {
637     btm_sec_conn_req(bda, dc);
638   }
639 #if (BTM_SCO_INCLUDED == TRUE)
640   else {
641     btm_sco_conn_req(bda, dc, link_type);
642   }
643 #endif /* BTM_SCO_INCLUDED */
644 }
645 
646 /*******************************************************************************
647  *
648  * Function         btu_hcif_disconnection_comp_evt
649  *
650  * Description      Process event HCI_DISCONNECTION_COMP_EVT
651  *
652  * Returns          void
653  *
654  ******************************************************************************/
btu_hcif_disconnection_comp_evt(uint8_t * p)655 static void btu_hcif_disconnection_comp_evt(uint8_t* p) {
656   uint16_t handle;
657   uint8_t reason;
658 
659   ++p;
660   STREAM_TO_UINT16(handle, p);
661   STREAM_TO_UINT8(reason, p);
662 
663   handle = HCID_GET_HANDLE(handle);
664 
665   if ((reason != HCI_ERR_CONN_CAUSE_LOCAL_HOST) &&
666       (reason != HCI_ERR_PEER_USER)) {
667     /* Uncommon disconnection reasons */
668     HCI_TRACE_DEBUG("%s: Got Disconn Complete Event: reason=%d, handle=%d",
669                     __func__, reason, handle);
670   }
671 
672 #if (BTM_SCO_INCLUDED == TRUE)
673   /* If L2CAP doesn't know about it, send it to SCO */
674   if (!l2c_link_hci_disc_comp(handle, reason)) btm_sco_removed(handle, reason);
675 #else
676   l2c_link_hci_disc_comp(handle, reason);
677 #endif /* BTM_SCO_INCLUDED */
678 
679   /* Notify security manager */
680   btm_sec_disconnected(handle, reason);
681 }
682 
683 /*******************************************************************************
684  *
685  * Function         btu_hcif_authentication_comp_evt
686  *
687  * Description      Process event HCI_AUTHENTICATION_COMP_EVT
688  *
689  * Returns          void
690  *
691  ******************************************************************************/
btu_hcif_authentication_comp_evt(uint8_t * p)692 static void btu_hcif_authentication_comp_evt(uint8_t* p) {
693   uint8_t status;
694   uint16_t handle;
695 
696   STREAM_TO_UINT8(status, p);
697   STREAM_TO_UINT16(handle, p);
698 
699   btm_sec_auth_complete(handle, status);
700 }
701 
702 /*******************************************************************************
703  *
704  * Function         btu_hcif_rmt_name_request_comp_evt
705  *
706  * Description      Process event HCI_RMT_NAME_REQUEST_COMP_EVT
707  *
708  * Returns          void
709  *
710  ******************************************************************************/
btu_hcif_rmt_name_request_comp_evt(uint8_t * p,uint16_t evt_len)711 static void btu_hcif_rmt_name_request_comp_evt(uint8_t* p, uint16_t evt_len) {
712   uint8_t status;
713   RawAddress bd_addr;
714 
715   STREAM_TO_UINT8(status, p);
716   STREAM_TO_BDADDR(bd_addr, p);
717 
718   evt_len -= (1 + BD_ADDR_LEN);
719 
720   btm_process_remote_name(&bd_addr, p, evt_len, status);
721 
722   btm_sec_rmt_name_request_complete(&bd_addr, p, status);
723 }
724 
725 constexpr uint8_t MIN_KEY_SIZE = 7;
726 
read_encryption_key_size_complete_after_encryption_change(uint8_t status,uint16_t handle,uint8_t key_size)727 static void read_encryption_key_size_complete_after_encryption_change(
728     uint8_t status, uint16_t handle, uint8_t key_size) {
729   int ret = android::util::stats_write(
730       android::util::BLUETOOTH_CLASSIC_PAIRING_EVENT_REPORTED, "", handle,
731       HCI_READ_ENCR_KEY_SIZE, HCI_COMMAND_COMPLETE_EVT, status, 0, key_size);
732   if (ret < 0) {
733     LOG(WARNING) << __func__ << ": failed to log encryption key size "
734                  << std::to_string(key_size);
735   }
736 
737   if (status == HCI_ERR_INSUFFCIENT_SECURITY) {
738     /* If remote device stop the encryption before we call "Read Encryption Key
739      * Size", we might receive Insufficient Security, which means that link is
740      * no longer encrypted. */
741     LOG(INFO) << __func__ << ": encryption stopped on link: " << loghex(handle);
742     return;
743   }
744 
745   if (status != HCI_SUCCESS) {
746     LOG(INFO) << __func__ << ": disconnecting, status: " << loghex(status);
747     btsnd_hcic_disconnect(handle, HCI_ERR_PEER_USER);
748     return;
749   }
750 
751   if (key_size < MIN_KEY_SIZE) {
752     android_errorWriteLog(0x534e4554, "124301137");
753     LOG(ERROR) << __func__
754                << " encryption key too short, disconnecting. handle: "
755                << loghex(handle) << " key_size: " << +key_size;
756 
757     btsnd_hcic_disconnect(handle, HCI_ERR_HOST_REJECT_SECURITY);
758     return;
759   }
760 
761   // good key size - succeed
762   btm_acl_encrypt_change(handle, status, 1 /* enable */);
763   btm_sec_encrypt_change(handle, status, 1 /* enable */);
764 }
765 /*******************************************************************************
766  *
767  * Function         btu_hcif_encryption_change_evt
768  *
769  * Description      Process event HCI_ENCRYPTION_CHANGE_EVT
770  *
771  * Returns          void
772  *
773  ******************************************************************************/
btu_hcif_encryption_change_evt(uint8_t * p)774 static void btu_hcif_encryption_change_evt(uint8_t* p) {
775   uint8_t status;
776   uint16_t handle;
777   uint8_t encr_enable;
778 
779   STREAM_TO_UINT8(status, p);
780   STREAM_TO_UINT16(handle, p);
781   STREAM_TO_UINT8(encr_enable, p);
782 
783   if (status != HCI_SUCCESS || encr_enable == 0 ||
784       BTM_IsBleConnection(handle)) {
785     btm_acl_encrypt_change(handle, status, encr_enable);
786     btm_sec_encrypt_change(handle, status, encr_enable);
787   } else {
788     btsnd_hcic_read_encryption_key_size(
789         handle,
790         base::Bind(&read_encryption_key_size_complete_after_encryption_change));
791   }
792 }
793 
794 /*******************************************************************************
795  *
796  * Function         btu_hcif_read_rmt_features_comp_evt
797  *
798  * Description      Process event HCI_READ_RMT_FEATURES_COMP_EVT
799  *
800  * Returns          void
801  *
802  ******************************************************************************/
btu_hcif_read_rmt_features_comp_evt(uint8_t * p)803 static void btu_hcif_read_rmt_features_comp_evt(uint8_t* p) {
804   btm_read_remote_features_complete(p);
805 }
806 
807 /*******************************************************************************
808  *
809  * Function         btu_hcif_read_rmt_ext_features_comp_evt
810  *
811  * Description      Process event HCI_READ_RMT_EXT_FEATURES_COMP_EVT
812  *
813  * Returns          void
814  *
815  ******************************************************************************/
btu_hcif_read_rmt_ext_features_comp_evt(uint8_t * p,uint8_t evt_len)816 static void btu_hcif_read_rmt_ext_features_comp_evt(uint8_t* p,
817                                                     uint8_t evt_len) {
818   uint8_t* p_cur = p;
819   uint8_t status;
820   uint16_t handle;
821 
822   STREAM_TO_UINT8(status, p_cur);
823 
824   if (status == HCI_SUCCESS)
825     btm_read_remote_ext_features_complete(p, evt_len);
826   else {
827     STREAM_TO_UINT16(handle, p_cur);
828     btm_read_remote_ext_features_failed(status, handle);
829   }
830 }
831 
832 /*******************************************************************************
833  *
834  * Function         btu_hcif_read_rmt_version_comp_evt
835  *
836  * Description      Process event HCI_READ_RMT_VERSION_COMP_EVT
837  *
838  * Returns          void
839  *
840  ******************************************************************************/
btu_hcif_read_rmt_version_comp_evt(uint8_t * p)841 static void btu_hcif_read_rmt_version_comp_evt(uint8_t* p) {
842   btm_read_remote_version_complete(p);
843 }
844 
845 /*******************************************************************************
846  *
847  * Function         btu_hcif_qos_setup_comp_evt
848  *
849  * Description      Process event HCI_QOS_SETUP_COMP_EVT
850  *
851  * Returns          void
852  *
853  ******************************************************************************/
btu_hcif_qos_setup_comp_evt(uint8_t * p)854 static void btu_hcif_qos_setup_comp_evt(uint8_t* p) {
855   uint8_t status;
856   uint16_t handle;
857   FLOW_SPEC flow;
858 
859   STREAM_TO_UINT8(status, p);
860   STREAM_TO_UINT16(handle, p);
861   STREAM_TO_UINT8(flow.qos_flags, p);
862   STREAM_TO_UINT8(flow.service_type, p);
863   STREAM_TO_UINT32(flow.token_rate, p);
864   STREAM_TO_UINT32(flow.peak_bandwidth, p);
865   STREAM_TO_UINT32(flow.latency, p);
866   STREAM_TO_UINT32(flow.delay_variation, p);
867 
868   btm_qos_setup_complete(status, handle, &flow);
869 }
870 
871 /*******************************************************************************
872  *
873  * Function         btu_hcif_esco_connection_comp_evt
874  *
875  * Description      Process event HCI_ESCO_CONNECTION_COMP_EVT
876  *
877  * Returns          void
878  *
879  ******************************************************************************/
btu_hcif_esco_connection_comp_evt(uint8_t * p)880 static void btu_hcif_esco_connection_comp_evt(uint8_t* p) {
881 #if (BTM_SCO_INCLUDED == TRUE)
882   tBTM_ESCO_DATA data;
883   uint16_t handle;
884   RawAddress bda;
885   uint8_t status;
886 
887   STREAM_TO_UINT8(status, p);
888   STREAM_TO_UINT16(handle, p);
889   STREAM_TO_BDADDR(bda, p);
890 
891   STREAM_TO_UINT8(data.link_type, p);
892   STREAM_TO_UINT8(data.tx_interval, p);
893   STREAM_TO_UINT8(data.retrans_window, p);
894   STREAM_TO_UINT16(data.rx_pkt_len, p);
895   STREAM_TO_UINT16(data.tx_pkt_len, p);
896   STREAM_TO_UINT8(data.air_mode, p);
897 
898   data.bd_addr = bda;
899   btm_sco_connected(status, &bda, handle, &data);
900 #endif
901 }
902 
903 /*******************************************************************************
904  *
905  * Function         btu_hcif_esco_connection_chg_evt
906  *
907  * Description      Process event HCI_ESCO_CONNECTION_CHANGED_EVT
908  *
909  * Returns          void
910  *
911  ******************************************************************************/
btu_hcif_esco_connection_chg_evt(uint8_t * p)912 static void btu_hcif_esco_connection_chg_evt(uint8_t* p) {
913 #if (BTM_SCO_INCLUDED == TRUE)
914   uint16_t handle;
915   uint16_t tx_pkt_len;
916   uint16_t rx_pkt_len;
917   uint8_t status;
918   uint8_t tx_interval;
919   uint8_t retrans_window;
920 
921   STREAM_TO_UINT8(status, p);
922   STREAM_TO_UINT16(handle, p);
923 
924   STREAM_TO_UINT8(tx_interval, p);
925   STREAM_TO_UINT8(retrans_window, p);
926   STREAM_TO_UINT16(rx_pkt_len, p);
927   STREAM_TO_UINT16(tx_pkt_len, p);
928 
929   btm_esco_proc_conn_chg(status, handle, tx_interval, retrans_window,
930                          rx_pkt_len, tx_pkt_len);
931 #endif
932 }
933 
934 /*******************************************************************************
935  *
936  * Function         btu_hcif_hdl_command_complete
937  *
938  * Description      Handle command complete event
939  *
940  * Returns          void
941  *
942  ******************************************************************************/
btu_hcif_hdl_command_complete(uint16_t opcode,uint8_t * p,uint16_t evt_len,void * p_cplt_cback)943 static void btu_hcif_hdl_command_complete(uint16_t opcode, uint8_t* p,
944                                           uint16_t evt_len,
945                                           void* p_cplt_cback) {
946   switch (opcode) {
947     case HCI_INQUIRY_CANCEL:
948       /* Tell inquiry processing that we are done */
949       btm_process_cancel_complete(HCI_SUCCESS, BTM_BR_INQUIRY_MASK);
950       break;
951     case HCI_SET_EVENT_FILTER:
952       btm_event_filter_complete(p);
953       break;
954 
955     case HCI_DELETE_STORED_LINK_KEY:
956       btm_delete_stored_link_key_complete(p);
957       break;
958 
959     case HCI_READ_LOCAL_NAME:
960       btm_read_local_name_complete(p, evt_len);
961       break;
962 
963     case HCI_GET_LINK_QUALITY:
964       btm_read_link_quality_complete(p);
965       break;
966 
967     case HCI_READ_RSSI:
968       btm_read_rssi_complete(p);
969       break;
970 
971     case HCI_READ_FAILED_CONTACT_COUNTER:
972       btm_read_failed_contact_counter_complete(p);
973       break;
974 
975     case HCI_READ_AUTOMATIC_FLUSH_TIMEOUT:
976       btm_read_automatic_flush_timeout_complete(p);
977       break;
978 
979     case HCI_READ_TRANSMIT_POWER_LEVEL:
980       btm_read_tx_power_complete(p, false);
981       break;
982 
983     case HCI_CREATE_CONNECTION_CANCEL:
984       btm_create_conn_cancel_complete(p);
985       break;
986 
987     case HCI_READ_LOCAL_OOB_DATA:
988       btm_read_local_oob_complete(p);
989       break;
990 
991     case HCI_READ_INQ_TX_POWER_LEVEL:
992       btm_read_inq_tx_power_complete(p);
993       break;
994 
995     /* BLE Commands sComplete*/
996     case HCI_BLE_ADD_WHITE_LIST:
997       btm_ble_add_2_white_list_complete(*p);
998       break;
999 
1000     case HCI_BLE_CLEAR_WHITE_LIST:
1001       btm_ble_clear_white_list_complete(p, evt_len);
1002       break;
1003 
1004     case HCI_BLE_REMOVE_WHITE_LIST:
1005       btm_ble_remove_from_white_list_complete(p, evt_len);
1006       break;
1007 
1008     case HCI_BLE_RAND:
1009     case HCI_BLE_ENCRYPT:
1010       btm_ble_rand_enc_complete(p, opcode, (tBTM_RAND_ENC_CB*)p_cplt_cback);
1011       break;
1012 
1013     case HCI_BLE_READ_ADV_CHNL_TX_POWER:
1014       btm_read_tx_power_complete(p, true);
1015       break;
1016 
1017     case HCI_BLE_WRITE_ADV_ENABLE:
1018       btm_ble_write_adv_enable_complete(p);
1019       break;
1020 
1021     case HCI_BLE_CREATE_LL_CONN:
1022     case HCI_LE_EXTENDED_CREATE_CONNECTION:
1023       // No command complete event for those commands according to spec
1024       LOG(ERROR) << "No command complete expected, but received!";
1025       break;
1026 
1027     case HCI_BLE_CREATE_CONN_CANCEL:
1028       btm_ble_create_conn_cancel_complete(p);
1029       break;
1030 
1031     case HCI_BLE_TRANSMITTER_TEST:
1032     case HCI_BLE_RECEIVER_TEST:
1033     case HCI_BLE_TEST_END:
1034       btm_ble_test_command_complete(p);
1035       break;
1036 
1037 #if (BLE_PRIVACY_SPT == TRUE)
1038     case HCI_BLE_ADD_DEV_RESOLVING_LIST:
1039       btm_ble_add_resolving_list_entry_complete(p, evt_len);
1040       break;
1041 
1042     case HCI_BLE_RM_DEV_RESOLVING_LIST:
1043       btm_ble_remove_resolving_list_entry_complete(p, evt_len);
1044       break;
1045 
1046     case HCI_BLE_CLEAR_RESOLVING_LIST:
1047       btm_ble_clear_resolving_list_complete(p, evt_len);
1048       break;
1049 
1050     case HCI_BLE_READ_RESOLVABLE_ADDR_PEER:
1051       btm_ble_read_resolving_list_entry_complete(p, evt_len);
1052       break;
1053 
1054     case HCI_BLE_READ_RESOLVABLE_ADDR_LOCAL:
1055     case HCI_BLE_SET_ADDR_RESOLUTION_ENABLE:
1056     case HCI_BLE_SET_RAND_PRIV_ADDR_TIMOUT:
1057       break;
1058 #endif
1059     default:
1060       if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC)
1061         btm_vsc_complete(p, opcode, evt_len, (tBTM_VSC_CMPL_CB*)p_cplt_cback);
1062       break;
1063   }
1064 }
1065 
1066 /*******************************************************************************
1067  *
1068  * Function         btu_hcif_command_complete_evt
1069  *
1070  * Description      Process event HCI_COMMAND_COMPLETE_EVT
1071  *
1072  * Returns          void
1073  *
1074  ******************************************************************************/
btu_hcif_command_complete_evt_on_task(BT_HDR * event,void * context)1075 static void btu_hcif_command_complete_evt_on_task(BT_HDR* event,
1076                                                   void* context) {
1077   command_opcode_t opcode;
1078   uint8_t* stream =
1079       event->data + event->offset +
1080       3;  // 2 to skip the event headers, 1 to skip the command credits
1081   STREAM_TO_UINT16(opcode, stream);
1082 
1083   btu_hcif_hdl_command_complete(
1084       opcode, stream,
1085       event->len -
1086           5,  // 3 for the command complete headers, 2 for the event headers
1087       context);
1088 
1089   osi_free(event);
1090 }
1091 
btu_hcif_command_complete_evt(BT_HDR * response,void * context)1092 static void btu_hcif_command_complete_evt(BT_HDR* response, void* context) {
1093   do_in_hci_thread(FROM_HERE, base::Bind(btu_hcif_command_complete_evt_on_task,
1094                                          response, context));
1095 }
1096 
1097 /*******************************************************************************
1098  *
1099  * Function         btu_hcif_hdl_command_status
1100  *
1101  * Description      Handle a command status event
1102  *
1103  * Returns          void
1104  *
1105  ******************************************************************************/
btu_hcif_hdl_command_status(uint16_t opcode,uint8_t status,uint8_t * p_cmd,void * p_vsc_status_cback)1106 static void btu_hcif_hdl_command_status(uint16_t opcode, uint8_t status,
1107                                         uint8_t* p_cmd,
1108                                         void* p_vsc_status_cback) {
1109   RawAddress bd_addr;
1110   uint16_t handle;
1111 #if (BTM_SCO_INCLUDED == TRUE)
1112   tBTM_ESCO_DATA esco_data;
1113 #endif
1114 
1115   switch (opcode) {
1116     case HCI_EXIT_SNIFF_MODE:
1117     case HCI_EXIT_PARK_MODE:
1118 #if (BTM_SCO_WAKE_PARKED_LINK == TRUE)
1119       if (status != HCI_SUCCESS) {
1120         /* Allow SCO initiation to continue if waiting for change mode event */
1121         if (p_cmd != NULL) {
1122           p_cmd++; /* bypass length field */
1123           STREAM_TO_UINT16(handle, p_cmd);
1124           btm_sco_chk_pend_unpark(status, handle);
1125         }
1126       }
1127 #endif
1128     /* Case Falls Through */
1129 
1130     case HCI_HOLD_MODE:
1131     case HCI_SNIFF_MODE:
1132     case HCI_PARK_MODE:
1133       btm_pm_proc_cmd_status(status);
1134       break;
1135 
1136     default:
1137       /* If command failed to start, we may need to tell BTM */
1138       if (status != HCI_SUCCESS) {
1139         switch (opcode) {
1140           case HCI_INQUIRY:
1141             /* Tell inquiry processing that we are done */
1142             btm_process_inq_complete(status, BTM_BR_INQUIRY_MASK);
1143             break;
1144 
1145           case HCI_RMT_NAME_REQUEST:
1146             /* Tell inquiry processing that we are done */
1147             btm_process_remote_name(NULL, NULL, 0, status);
1148 
1149             btm_sec_rmt_name_request_complete(NULL, NULL, status);
1150             break;
1151 
1152           case HCI_QOS_SETUP_COMP_EVT:
1153             /* Tell qos setup that we are done */
1154             btm_qos_setup_complete(status, 0, NULL);
1155             break;
1156 
1157           case HCI_SWITCH_ROLE:
1158             /* Tell BTM that the command failed */
1159             /* read bd addr out of stored command */
1160             if (p_cmd != NULL) {
1161               p_cmd++;
1162               STREAM_TO_BDADDR(bd_addr, p_cmd);
1163               btm_acl_role_changed(status, &bd_addr, BTM_ROLE_UNDEFINED);
1164             } else
1165               btm_acl_role_changed(status, NULL, BTM_ROLE_UNDEFINED);
1166             l2c_link_role_changed(nullptr, BTM_ROLE_UNDEFINED,
1167                                   HCI_ERR_COMMAND_DISALLOWED);
1168             break;
1169 
1170           case HCI_CREATE_CONNECTION:
1171             /* read bd addr out of stored command */
1172             if (p_cmd != NULL) {
1173               p_cmd++;
1174               STREAM_TO_BDADDR(bd_addr, p_cmd);
1175               btm_sec_connected(bd_addr, HCI_INVALID_HANDLE, status, 0);
1176               l2c_link_hci_conn_comp(status, HCI_INVALID_HANDLE, bd_addr);
1177             }
1178             break;
1179 
1180           case HCI_READ_RMT_EXT_FEATURES:
1181             if (p_cmd != NULL) {
1182               p_cmd++; /* skip command length */
1183               STREAM_TO_UINT16(handle, p_cmd);
1184             } else
1185               handle = HCI_INVALID_HANDLE;
1186 
1187             btm_read_remote_ext_features_failed(status, handle);
1188             break;
1189 
1190           case HCI_AUTHENTICATION_REQUESTED:
1191             /* Device refused to start authentication.  That should be treated
1192              * as authentication failure. */
1193             btm_sec_auth_complete(BTM_INVALID_HCI_HANDLE, status);
1194             break;
1195 
1196           case HCI_SET_CONN_ENCRYPTION:
1197             /* Device refused to start encryption.  That should be treated as
1198              * encryption failure. */
1199             btm_sec_encrypt_change(BTM_INVALID_HCI_HANDLE, status, false);
1200             break;
1201 
1202           case HCI_BLE_CREATE_LL_CONN:
1203           case HCI_LE_EXTENDED_CREATE_CONNECTION:
1204             btm_ble_create_ll_conn_complete(status);
1205             break;
1206 
1207 #if (BTM_SCO_INCLUDED == TRUE)
1208           case HCI_SETUP_ESCO_CONNECTION:
1209           case HCI_ENH_SETUP_ESCO_CONNECTION:
1210             /* read handle out of stored command */
1211             if (p_cmd != NULL) {
1212               p_cmd++;
1213               STREAM_TO_UINT16(handle, p_cmd);
1214 
1215               /* Determine if initial connection failed or is a change
1216                * of setup */
1217               if (btm_is_sco_active(handle))
1218                 btm_esco_proc_conn_chg(status, handle, 0, 0, 0, 0);
1219               else
1220                 btm_sco_connected(status, NULL, handle, &esco_data);
1221             }
1222             break;
1223 #endif
1224 
1225           /* This is commented out until an upper layer cares about returning
1226           event
1227           #if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
1228                       case HCI_ENHANCED_FLUSH:
1229                           break;
1230           #endif
1231           */
1232           default:
1233             if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC)
1234               btm_vsc_complete(&status, opcode, 1,
1235                                (tBTM_VSC_CMPL_CB*)p_vsc_status_cback);
1236             break;
1237         }
1238 
1239       } else {
1240         if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC)
1241           btm_vsc_complete(&status, opcode, 1,
1242                            (tBTM_VSC_CMPL_CB*)p_vsc_status_cback);
1243       }
1244   }
1245 }
1246 
1247 /*******************************************************************************
1248  *
1249  * Function         btu_hcif_command_status_evt
1250  *
1251  * Description      Process event HCI_COMMAND_STATUS_EVT
1252  *
1253  * Returns          void
1254  *
1255  ******************************************************************************/
btu_hcif_command_status_evt_on_task(uint8_t status,BT_HDR * event,void * context)1256 static void btu_hcif_command_status_evt_on_task(uint8_t status, BT_HDR* event,
1257                                                 void* context) {
1258   command_opcode_t opcode;
1259   uint8_t* stream = event->data + event->offset;
1260   STREAM_TO_UINT16(opcode, stream);
1261 
1262   btu_hcif_hdl_command_status(opcode, status, stream, context);
1263   osi_free(event);
1264 }
1265 
btu_hcif_command_status_evt(uint8_t status,BT_HDR * command,void * context)1266 static void btu_hcif_command_status_evt(uint8_t status, BT_HDR* command,
1267                                         void* context) {
1268   do_in_hci_thread(FROM_HERE, base::Bind(btu_hcif_command_status_evt_on_task,
1269                                          status, command, context));
1270 }
1271 
1272 /*******************************************************************************
1273  *
1274  * Function         btu_hcif_hardware_error_evt
1275  *
1276  * Description      Process event HCI_HARDWARE_ERROR_EVT
1277  *
1278  * Returns          void
1279  *
1280  ******************************************************************************/
btu_hcif_hardware_error_evt(uint8_t * p)1281 static void btu_hcif_hardware_error_evt(uint8_t* p) {
1282   HCI_TRACE_ERROR("Ctlr H/w error event - code:0x%x", *p);
1283 
1284   /* If anyone wants device status notifications, give him one. */
1285   btm_report_device_status(BTM_DEV_STATUS_DOWN);
1286 
1287   /* Reset the controller */
1288   if (BTM_IsDeviceUp()) BTM_DeviceReset(NULL);
1289 }
1290 
1291 /*******************************************************************************
1292  *
1293  * Function         btu_hcif_flush_occured_evt
1294  *
1295  * Description      Process event HCI_FLUSH_OCCURED_EVT
1296  *
1297  * Returns          void
1298  *
1299  ******************************************************************************/
btu_hcif_flush_occured_evt(void)1300 static void btu_hcif_flush_occured_evt(void) {}
1301 
1302 /*******************************************************************************
1303  *
1304  * Function         btu_hcif_role_change_evt
1305  *
1306  * Description      Process event HCI_ROLE_CHANGE_EVT
1307  *
1308  * Returns          void
1309  *
1310  ******************************************************************************/
btu_hcif_role_change_evt(uint8_t * p)1311 static void btu_hcif_role_change_evt(uint8_t* p) {
1312   uint8_t status;
1313   RawAddress bda;
1314   uint8_t role;
1315 
1316   STREAM_TO_UINT8(status, p);
1317   STREAM_TO_BDADDR(bda, p);
1318   STREAM_TO_UINT8(role, p);
1319 
1320   btm_blacklist_role_change_device(bda, status);
1321   l2c_link_role_changed(&bda, role, status);
1322   btm_acl_role_changed(status, &bda, role);
1323 }
1324 
1325 /*******************************************************************************
1326  *
1327  * Function         btu_hcif_num_compl_data_pkts_evt
1328  *
1329  * Description      Process event HCI_NUM_COMPL_DATA_PKTS_EVT
1330  *
1331  * Returns          void
1332  *
1333  ******************************************************************************/
btu_hcif_num_compl_data_pkts_evt(uint8_t * p)1334 static void btu_hcif_num_compl_data_pkts_evt(uint8_t* p) {
1335   /* Process for L2CAP and SCO */
1336   l2c_link_process_num_completed_pkts(p);
1337 
1338   /* Send on to SCO */
1339   /*?? No SCO for now */
1340 }
1341 
1342 /*******************************************************************************
1343  *
1344  * Function         btu_hcif_mode_change_evt
1345  *
1346  * Description      Process event HCI_MODE_CHANGE_EVT
1347  *
1348  * Returns          void
1349  *
1350  ******************************************************************************/
btu_hcif_mode_change_evt(uint8_t * p)1351 static void btu_hcif_mode_change_evt(uint8_t* p) {
1352   uint8_t status;
1353   uint16_t handle;
1354   uint8_t current_mode;
1355   uint16_t interval;
1356 
1357   STREAM_TO_UINT8(status, p);
1358 
1359   STREAM_TO_UINT16(handle, p);
1360   STREAM_TO_UINT8(current_mode, p);
1361   STREAM_TO_UINT16(interval, p);
1362 #if (BTM_SCO_WAKE_PARKED_LINK == TRUE)
1363   btm_sco_chk_pend_unpark(status, handle);
1364 #endif
1365   btm_pm_proc_mode_change(status, handle, current_mode, interval);
1366 
1367 #if (HID_DEV_INCLUDED == TRUE && HID_DEV_PM_INCLUDED == TRUE)
1368   hidd_pm_proc_mode_change(status, current_mode, interval);
1369 #endif
1370 }
1371 
1372 /*******************************************************************************
1373  *
1374  * Function         btu_hcif_ssr_evt
1375  *
1376  * Description      Process event HCI_SNIFF_SUB_RATE_EVT
1377  *
1378  * Returns          void
1379  *
1380  ******************************************************************************/
1381 #if (BTM_SSR_INCLUDED == TRUE)
btu_hcif_ssr_evt(uint8_t * p,uint16_t evt_len)1382 static void btu_hcif_ssr_evt(uint8_t* p, uint16_t evt_len) {
1383   btm_pm_proc_ssr_evt(p, evt_len);
1384 }
1385 #endif
1386 
1387 /*******************************************************************************
1388  *
1389  * Function         btu_hcif_pin_code_request_evt
1390  *
1391  * Description      Process event HCI_PIN_CODE_REQUEST_EVT
1392  *
1393  * Returns          void
1394  *
1395  ******************************************************************************/
btu_hcif_pin_code_request_evt(uint8_t * p)1396 static void btu_hcif_pin_code_request_evt(uint8_t* p) {
1397   RawAddress bda;
1398 
1399   STREAM_TO_BDADDR(bda, p);
1400 
1401   /* Tell L2CAP that there was a PIN code request,  */
1402   /* it may need to stretch timeouts                */
1403   l2c_pin_code_request(bda);
1404 
1405   btm_sec_pin_code_request(bda);
1406 }
1407 
1408 /*******************************************************************************
1409  *
1410  * Function         btu_hcif_link_key_request_evt
1411  *
1412  * Description      Process event HCI_LINK_KEY_REQUEST_EVT
1413  *
1414  * Returns          void
1415  *
1416  ******************************************************************************/
btu_hcif_link_key_request_evt(uint8_t * p)1417 static void btu_hcif_link_key_request_evt(uint8_t* p) {
1418   RawAddress bda;
1419 
1420   STREAM_TO_BDADDR(bda, p);
1421   btm_sec_link_key_request(bda);
1422 }
1423 
1424 /*******************************************************************************
1425  *
1426  * Function         btu_hcif_link_key_notification_evt
1427  *
1428  * Description      Process event HCI_LINK_KEY_NOTIFICATION_EVT
1429  *
1430  * Returns          void
1431  *
1432  ******************************************************************************/
btu_hcif_link_key_notification_evt(uint8_t * p)1433 static void btu_hcif_link_key_notification_evt(uint8_t* p) {
1434   RawAddress bda;
1435   LINK_KEY key;
1436   uint8_t key_type;
1437 
1438   STREAM_TO_BDADDR(bda, p);
1439   STREAM_TO_ARRAY16(key, p);
1440   STREAM_TO_UINT8(key_type, p);
1441 
1442   btm_sec_link_key_notification(bda, key, key_type);
1443 }
1444 
1445 /*******************************************************************************
1446  *
1447  * Function         btu_hcif_loopback_command_evt
1448  *
1449  * Description      Process event HCI_LOOPBACK_COMMAND_EVT
1450  *
1451  * Returns          void
1452  *
1453  ******************************************************************************/
btu_hcif_loopback_command_evt(void)1454 static void btu_hcif_loopback_command_evt(void) {}
1455 
1456 /*******************************************************************************
1457  *
1458  * Function         btu_hcif_data_buf_overflow_evt
1459  *
1460  * Description      Process event HCI_DATA_BUF_OVERFLOW_EVT
1461  *
1462  * Returns          void
1463  *
1464  ******************************************************************************/
btu_hcif_data_buf_overflow_evt(void)1465 static void btu_hcif_data_buf_overflow_evt(void) {}
1466 
1467 /*******************************************************************************
1468  *
1469  * Function         btu_hcif_max_slots_changed_evt
1470  *
1471  * Description      Process event HCI_MAX_SLOTS_CHANGED_EVT
1472  *
1473  * Returns          void
1474  *
1475  ******************************************************************************/
btu_hcif_max_slots_changed_evt(void)1476 static void btu_hcif_max_slots_changed_evt(void) {}
1477 
1478 /*******************************************************************************
1479  *
1480  * Function         btu_hcif_read_clock_off_comp_evt
1481  *
1482  * Description      Process event HCI_READ_CLOCK_OFF_COMP_EVT
1483  *
1484  * Returns          void
1485  *
1486  ******************************************************************************/
btu_hcif_read_clock_off_comp_evt(uint8_t * p)1487 static void btu_hcif_read_clock_off_comp_evt(uint8_t* p) {
1488   uint8_t status;
1489   uint16_t handle;
1490   uint16_t clock_offset;
1491 
1492   STREAM_TO_UINT8(status, p);
1493 
1494   /* If failed to get clock offset just drop the result */
1495   if (status != HCI_SUCCESS) return;
1496 
1497   STREAM_TO_UINT16(handle, p);
1498   STREAM_TO_UINT16(clock_offset, p);
1499 
1500   handle = HCID_GET_HANDLE(handle);
1501 
1502   btm_process_clk_off_comp_evt(handle, clock_offset);
1503   btm_sec_update_clock_offset(handle, clock_offset);
1504 }
1505 
1506 /*******************************************************************************
1507  *
1508  * Function         btu_hcif_conn_pkt_type_change_evt
1509  *
1510  * Description      Process event HCI_CONN_PKT_TYPE_CHANGE_EVT
1511  *
1512  * Returns          void
1513  *
1514  ******************************************************************************/
btu_hcif_conn_pkt_type_change_evt(void)1515 static void btu_hcif_conn_pkt_type_change_evt(void) {}
1516 
1517 /*******************************************************************************
1518  *
1519  * Function         btu_hcif_qos_violation_evt
1520  *
1521  * Description      Process event HCI_QOS_VIOLATION_EVT
1522  *
1523  * Returns          void
1524  *
1525  ******************************************************************************/
btu_hcif_qos_violation_evt(uint8_t * p)1526 static void btu_hcif_qos_violation_evt(uint8_t* p) {
1527   uint16_t handle;
1528 
1529   STREAM_TO_UINT16(handle, p);
1530 
1531   handle = HCID_GET_HANDLE(handle);
1532 
1533   l2c_link_hci_qos_violation(handle);
1534 }
1535 
1536 /*******************************************************************************
1537  *
1538  * Function         btu_hcif_page_scan_mode_change_evt
1539  *
1540  * Description      Process event HCI_PAGE_SCAN_MODE_CHANGE_EVT
1541  *
1542  * Returns          void
1543  *
1544  ******************************************************************************/
btu_hcif_page_scan_mode_change_evt(void)1545 static void btu_hcif_page_scan_mode_change_evt(void) {}
1546 
1547 /*******************************************************************************
1548  *
1549  * Function         btu_hcif_page_scan_rep_mode_chng_evt
1550  *
1551  * Description      Process event HCI_PAGE_SCAN_REP_MODE_CHNG_EVT
1552  *
1553  * Returns          void
1554  *
1555  ******************************************************************************/
btu_hcif_page_scan_rep_mode_chng_evt(void)1556 static void btu_hcif_page_scan_rep_mode_chng_evt(void) {}
1557 
1558 /**********************************************
1559  * Simple Pairing Events
1560  **********************************************/
1561 
1562 /*******************************************************************************
1563  *
1564  * Function         btu_hcif_host_support_evt
1565  *
1566  * Description      Process event HCI_RMT_HOST_SUP_FEAT_NOTIFY_EVT
1567  *
1568  * Returns          void
1569  *
1570  ******************************************************************************/
btu_hcif_host_support_evt(uint8_t * p)1571 static void btu_hcif_host_support_evt(uint8_t* p) {
1572   btm_sec_rmt_host_support_feat_evt(p);
1573 }
1574 
1575 /*******************************************************************************
1576  *
1577  * Function         btu_hcif_io_cap_request_evt
1578  *
1579  * Description      Process event HCI_IO_CAPABILITY_REQUEST_EVT
1580  *
1581  * Returns          void
1582  *
1583  ******************************************************************************/
btu_hcif_io_cap_request_evt(uint8_t * p)1584 static void btu_hcif_io_cap_request_evt(uint8_t* p) {
1585   RawAddress bda;
1586   STREAM_TO_BDADDR(bda, p);
1587   btm_io_capabilities_req(bda);
1588 }
1589 
1590 /*******************************************************************************
1591  *
1592  * Function         btu_hcif_io_cap_response_evt
1593  *
1594  * Description      Process event HCI_IO_CAPABILITY_RESPONSE_EVT
1595  *
1596  * Returns          void
1597  *
1598  ******************************************************************************/
btu_hcif_io_cap_response_evt(uint8_t * p)1599 static void btu_hcif_io_cap_response_evt(uint8_t* p) {
1600   btm_io_capabilities_rsp(p);
1601 }
1602 
1603 /*******************************************************************************
1604  *
1605  * Function         btu_hcif_user_conf_request_evt
1606  *
1607  * Description      Process event HCI_USER_CONFIRMATION_REQUEST_EVT
1608  *
1609  * Returns          void
1610  *
1611  ******************************************************************************/
btu_hcif_user_conf_request_evt(uint8_t * p)1612 static void btu_hcif_user_conf_request_evt(uint8_t* p) {
1613   btm_proc_sp_req_evt(BTM_SP_CFM_REQ_EVT, p);
1614 }
1615 
1616 /*******************************************************************************
1617  *
1618  * Function         btu_hcif_user_passkey_request_evt
1619  *
1620  * Description      Process event HCI_USER_PASSKEY_REQUEST_EVT
1621  *
1622  * Returns          void
1623  *
1624  ******************************************************************************/
btu_hcif_user_passkey_request_evt(uint8_t * p)1625 static void btu_hcif_user_passkey_request_evt(uint8_t* p) {
1626   btm_proc_sp_req_evt(BTM_SP_KEY_REQ_EVT, p);
1627 }
1628 
1629 /*******************************************************************************
1630  *
1631  * Function         btu_hcif_user_passkey_notif_evt
1632  *
1633  * Description      Process event HCI_USER_PASSKEY_NOTIFY_EVT
1634  *
1635  * Returns          void
1636  *
1637  ******************************************************************************/
btu_hcif_user_passkey_notif_evt(uint8_t * p)1638 static void btu_hcif_user_passkey_notif_evt(uint8_t* p) {
1639   btm_proc_sp_req_evt(BTM_SP_KEY_NOTIF_EVT, p);
1640 }
1641 
1642 /*******************************************************************************
1643  *
1644  * Function         btu_hcif_keypress_notif_evt
1645  *
1646  * Description      Process event HCI_KEYPRESS_NOTIFY_EVT
1647  *
1648  * Returns          void
1649  *
1650  ******************************************************************************/
btu_hcif_keypress_notif_evt(uint8_t * p)1651 static void btu_hcif_keypress_notif_evt(uint8_t* p) {
1652   btm_keypress_notif_evt(p);
1653 }
1654 
1655 /*******************************************************************************
1656  *
1657  * Function         btu_hcif_rem_oob_request_evt
1658  *
1659  * Description      Process event HCI_REMOTE_OOB_DATA_REQUEST_EVT
1660  *
1661  * Returns          void
1662  *
1663  ******************************************************************************/
btu_hcif_rem_oob_request_evt(uint8_t * p)1664 static void btu_hcif_rem_oob_request_evt(uint8_t* p) { btm_rem_oob_req(p); }
1665 
1666 /*******************************************************************************
1667  *
1668  * Function         btu_hcif_simple_pair_complete_evt
1669  *
1670  * Description      Process event HCI_SIMPLE_PAIRING_COMPLETE_EVT
1671  *
1672  * Returns          void
1673  *
1674  ******************************************************************************/
btu_hcif_simple_pair_complete_evt(uint8_t * p)1675 static void btu_hcif_simple_pair_complete_evt(uint8_t* p) {
1676   btm_simple_pair_complete(p);
1677 }
1678 
1679 /*******************************************************************************
1680  *
1681  * Function         btu_hcif_enhanced_flush_complete_evt
1682  *
1683  * Description      Process event HCI_ENHANCED_FLUSH_COMPLETE_EVT
1684  *
1685  * Returns          void
1686  *
1687  ******************************************************************************/
1688 #if (L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE)
btu_hcif_enhanced_flush_complete_evt(void)1689 static void btu_hcif_enhanced_flush_complete_evt(void) {
1690   /* This is empty until an upper layer cares about returning event */
1691 }
1692 #endif
1693 /**********************************************
1694  * End of Simple Pairing Events
1695  **********************************************/
1696 
read_encryption_key_size_complete_after_key_refresh(uint8_t status,uint16_t handle,uint8_t key_size)1697 static void read_encryption_key_size_complete_after_key_refresh(
1698     uint8_t status, uint16_t handle, uint8_t key_size) {
1699   int ret = android::util::stats_write(
1700       android::util::BLUETOOTH_CLASSIC_PAIRING_EVENT_REPORTED, "", handle,
1701       HCI_READ_ENCR_KEY_SIZE, HCI_COMMAND_COMPLETE_EVT, status, 0, key_size);
1702   if (ret < 0) {
1703     LOG(WARNING) << __func__ << ": failed to log encryption key size "
1704                  << std::to_string(key_size);
1705   }
1706 
1707   if (status == HCI_ERR_INSUFFCIENT_SECURITY) {
1708     /* If remote device stop the encryption before we call "Read Encryption Key
1709      * Size", we might receive Insufficient Security, which means that link is
1710      * no longer encrypted. */
1711     LOG(INFO) << __func__ << ": encryption stopped on link: " << loghex(handle);
1712     return;
1713   }
1714 
1715   if (status != HCI_SUCCESS) {
1716     LOG(INFO) << __func__ << ": disconnecting, status: " << loghex(status);
1717     btsnd_hcic_disconnect(handle, HCI_ERR_PEER_USER);
1718     return;
1719   }
1720 
1721   if (key_size < MIN_KEY_SIZE) {
1722     android_errorWriteLog(0x534e4554, "124301137");
1723     LOG(ERROR) << __func__
1724                << " encryption key too short, disconnecting. handle: "
1725                << loghex(handle) << " key_size: " << +key_size;
1726 
1727     btsnd_hcic_disconnect(handle, HCI_ERR_HOST_REJECT_SECURITY);
1728     return;
1729   }
1730 
1731   btm_sec_encrypt_change(handle, status, 1 /* enc_enable */);
1732 }
1733 
btu_hcif_encryption_key_refresh_cmpl_evt(uint8_t * p)1734 static void btu_hcif_encryption_key_refresh_cmpl_evt(uint8_t* p) {
1735   uint8_t status;
1736   uint16_t handle;
1737 
1738   STREAM_TO_UINT8(status, p);
1739   STREAM_TO_UINT16(handle, p);
1740 
1741   if (status != HCI_SUCCESS || BTM_IsBleConnection(handle)) {
1742     btm_sec_encrypt_change(handle, status, (status == HCI_SUCCESS) ? 1 : 0);
1743   } else {
1744     btsnd_hcic_read_encryption_key_size(
1745         handle,
1746         base::Bind(&read_encryption_key_size_complete_after_key_refresh));
1747   }
1748 }
1749 
1750 /**********************************************
1751  * BLE Events
1752  **********************************************/
1753 
btu_ble_ll_conn_complete_evt(uint8_t * p,uint16_t evt_len)1754 static void btu_ble_ll_conn_complete_evt(uint8_t* p, uint16_t evt_len) {
1755   btm_ble_conn_complete(p, evt_len, false);
1756 }
1757 #if (BLE_PRIVACY_SPT == TRUE)
btu_ble_proc_enhanced_conn_cmpl(uint8_t * p,uint16_t evt_len)1758 static void btu_ble_proc_enhanced_conn_cmpl(uint8_t* p, uint16_t evt_len) {
1759   btm_ble_conn_complete(p, evt_len, true);
1760 }
1761 #endif
1762 
1763 extern void gatt_notify_conn_update(uint16_t handle, uint16_t interval,
1764                                     uint16_t latency, uint16_t timeout,
1765                                     uint8_t status);
1766 
btu_ble_ll_conn_param_upd_evt(uint8_t * p,uint16_t evt_len)1767 static void btu_ble_ll_conn_param_upd_evt(uint8_t* p, uint16_t evt_len) {
1768   /* LE connection update has completed successfully as a master. */
1769   /* We can enable the update request if the result is a success. */
1770   /* extract the HCI handle first */
1771   uint8_t status;
1772   uint16_t handle;
1773   uint16_t interval;
1774   uint16_t latency;
1775   uint16_t timeout;
1776 
1777   STREAM_TO_UINT8(status, p);
1778   STREAM_TO_UINT16(handle, p);
1779   STREAM_TO_UINT16(interval, p);
1780   STREAM_TO_UINT16(latency, p);
1781   STREAM_TO_UINT16(timeout, p);
1782 
1783   l2cble_process_conn_update_evt(handle, status, interval, latency, timeout);
1784 
1785   gatt_notify_conn_update(handle & 0x0FFF, interval, latency, timeout, status);
1786 }
1787 
btu_ble_read_remote_feat_evt(uint8_t * p)1788 static void btu_ble_read_remote_feat_evt(uint8_t* p) {
1789   btm_ble_read_remote_features_complete(p);
1790 }
1791 
btu_ble_proc_ltk_req(uint8_t * p)1792 static void btu_ble_proc_ltk_req(uint8_t* p) {
1793   uint16_t ediv, handle;
1794   uint8_t* pp;
1795 
1796   STREAM_TO_UINT16(handle, p);
1797   pp = p + 8;
1798   STREAM_TO_UINT16(ediv, pp);
1799   btm_ble_ltk_request(handle, p, ediv);
1800   /* This is empty until an upper layer cares about returning event */
1801 }
1802 
btu_ble_data_length_change_evt(uint8_t * p,uint16_t evt_len)1803 static void btu_ble_data_length_change_evt(uint8_t* p, uint16_t evt_len) {
1804   uint16_t handle;
1805   uint16_t tx_data_len;
1806   uint16_t rx_data_len;
1807 
1808   if (!controller_get_interface()->supports_ble_packet_extension()) {
1809     HCI_TRACE_WARNING("%s, request not supported", __func__);
1810     return;
1811   }
1812 
1813   STREAM_TO_UINT16(handle, p);
1814   STREAM_TO_UINT16(tx_data_len, p);
1815   p += 2; /* Skip the TxTimer */
1816   STREAM_TO_UINT16(rx_data_len, p);
1817 
1818   l2cble_process_data_length_change_event(handle, tx_data_len, rx_data_len);
1819 }
1820 
1821 /**********************************************
1822  * End of BLE Events Handler
1823  **********************************************/
1824 #if (BLE_LLT_INCLUDED == TRUE)
btu_ble_rc_param_req_evt(uint8_t * p)1825 static void btu_ble_rc_param_req_evt(uint8_t* p) {
1826   uint16_t handle;
1827   uint16_t int_min, int_max, latency, timeout;
1828 
1829   STREAM_TO_UINT16(handle, p);
1830   STREAM_TO_UINT16(int_min, p);
1831   STREAM_TO_UINT16(int_max, p);
1832   STREAM_TO_UINT16(latency, p);
1833   STREAM_TO_UINT16(timeout, p);
1834 
1835   l2cble_process_rc_param_request_evt(handle, int_min, int_max, latency,
1836                                       timeout);
1837 }
1838 #endif /* BLE_LLT_INCLUDED */
1839