Home | History | Annotate | Download | only in btu
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 1999-2012 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains functions that interface with the HCI transport. On
     22  *  the receive side, it routes events to the appropriate handler, e.g.
     23  *  L2CAP, ScoMgr. On the transmit side, it manages the command
     24  *  transmission.
     25  *
     26  ******************************************************************************/
     27 
     28 #include <stdlib.h>
     29 #include <string.h>
     30 #include <stdio.h>
     31 
     32 #include "gki.h"
     33 #include "bt_types.h"
     34 #include "hcimsgs.h"
     35 #include "btu.h"
     36 #include "l2c_int.h"
     37 #include "btm_api.h"
     38 #include "btm_int.h"
     39 
     40 // btla-specific ++
     41 #define LOG_TAG "BTLD"
     42 #if (defined(ANDROID_APP_INCLUDED) && (ANDROID_APP_INCLUDED == TRUE) && (!defined(LINUX_NATIVE)) )
     43 #include <cutils/log.h>
     44 #else
     45 #define LOGV(format, ...)  fprintf (stdout, LOG_TAG format"\n", ## __VA_ARGS__)
     46 #define LOGE(format, ...)  fprintf (stderr, LOG_TAG format"\n", ## __VA_ARGS__)
     47 #define LOGI(format, ...)  fprintf (stdout, LOG_TAG format"\n", ## __VA_ARGS__)
     48 #endif
     49 
     50 // btla-specific ++
     51 /* BTE application task */
     52 #if APPL_INCLUDED == TRUE
     53 #include "bte_appl.h"
     54 #endif
     55 // btla-specific --
     56 
     57 //Counter to track number of HCI command timeout
     58 static int num_hci_cmds_timed_out;
     59 
     60 /********************************************************************************/
     61 /*              L O C A L    F U N C T I O N     P R O T O T Y P E S            */
     62 /********************************************************************************/
     63 static void btu_hcif_inquiry_comp_evt (UINT8 *p, UINT16 evt_len);
     64 static void btu_hcif_inquiry_result_evt (UINT8 *p, UINT16 evt_len);
     65 static void btu_hcif_inquiry_rssi_result_evt (UINT8 *p, UINT16 evt_len);
     66 #if (BTM_EIR_CLIENT_INCLUDED == TRUE)
     67 static void btu_hcif_extended_inquiry_result_evt (UINT8 *p, UINT16 evt_len);
     68 #endif
     69 
     70 static void btu_hcif_connection_comp_evt (UINT8 *p, UINT16 evt_len);
     71 static void btu_hcif_connection_request_evt (UINT8 *p, UINT16 evt_len);
     72 static void btu_hcif_disconnection_comp_evt (UINT8 *p, UINT16 evt_len);
     73 static void btu_hcif_authentication_comp_evt (UINT8 *p, UINT16 evt_len);
     74 static void btu_hcif_rmt_name_request_comp_evt (UINT8 *p, UINT16 evt_len);
     75 static void btu_hcif_encryption_change_evt (UINT8 *p, UINT16 evt_len);
     76 static void btu_hcif_change_conn_link_key_evt (UINT8 *p, UINT16 evt_len);
     77 static void btu_hcif_master_link_key_comp_evt (UINT8 *p, UINT16 evt_len);
     78 static void btu_hcif_read_rmt_features_comp_evt (UINT8 *p, UINT16 evt_len);
     79 static void btu_hcif_read_rmt_ext_features_comp_evt (UINT8 *p, UINT16 evt_len);
     80 static void btu_hcif_read_rmt_version_comp_evt (UINT8 *p, UINT16 evt_len);
     81 static void btu_hcif_qos_setup_comp_evt (UINT8 *p, UINT16 evt_len);
     82 static void btu_hcif_command_complete_evt (UINT8 controller_id, UINT8 *p, UINT16 evt_len);
     83 static void btu_hcif_command_status_evt (UINT8 controller_id, UINT8 *p, UINT16 evt_len);
     84 static void btu_hcif_hardware_error_evt (UINT8 *p, UINT16 evt_len);
     85 static void btu_hcif_flush_occured_evt (UINT8 *p, UINT16 evt_len);
     86 static void btu_hcif_role_change_evt (UINT8 *p, UINT16 evt_len);
     87 static void btu_hcif_num_compl_data_pkts_evt (UINT8 *p, UINT16 evt_len);
     88 static void btu_hcif_mode_change_evt (UINT8 *p, UINT16 evt_len);
     89 static void btu_hcif_return_link_keys_evt (UINT8 *p, UINT16 evt_len);
     90 static void btu_hcif_pin_code_request_evt (UINT8 *p, UINT16 evt_len);
     91 static void btu_hcif_link_key_request_evt (UINT8 *p, UINT16 evt_len);
     92 static void btu_hcif_link_key_notification_evt (UINT8 *p, UINT16 evt_len);
     93 static void btu_hcif_loopback_command_evt (UINT8 *p, UINT16 evt_len);
     94 static void btu_hcif_data_buf_overflow_evt (UINT8 *p, UINT16 evt_len);
     95 static void btu_hcif_max_slots_changed_evt (UINT8 *p, UINT16 evt_len);
     96 static void btu_hcif_read_clock_off_comp_evt (UINT8 *p, UINT16 evt_len);
     97 static void btu_hcif_conn_pkt_type_change_evt (UINT8 *p, UINT16 evt_len);
     98 static void btu_hcif_qos_violation_evt (UINT8 *p, UINT16 evt_len);
     99 static void btu_hcif_page_scan_mode_change_evt (UINT8 *p, UINT16 evt_len);
    100 static void btu_hcif_page_scan_rep_mode_chng_evt (UINT8 *p, UINT16 evt_len);
    101 static void btu_hcif_esco_connection_comp_evt(UINT8 *p, UINT16 evt_len);
    102 static void btu_hcif_esco_connection_chg_evt(UINT8 *p, UINT16 evt_len);
    103 
    104 /* Simple Pairing Events */
    105 static void btu_hcif_host_support_evt (UINT8 *p, UINT16 evt_len);
    106 static void btu_hcif_io_cap_request_evt (UINT8 *p, UINT16 evt_len);
    107 static void btu_hcif_io_cap_response_evt (UINT8 *p, UINT16 evt_len);
    108 static void btu_hcif_user_conf_request_evt (UINT8 *p, UINT16 evt_len);
    109 static void btu_hcif_user_passkey_request_evt (UINT8 *p, UINT16 evt_len);
    110 static void btu_hcif_user_passkey_notif_evt (UINT8 *p, UINT16 evt_len);
    111 static void btu_hcif_keypress_notif_evt (UINT8 *p, UINT16 evt_len);
    112 static void btu_hcif_link_super_tout_evt (UINT8 *p, UINT16 evt_len);
    113 
    114     #if BTM_OOB_INCLUDED == TRUE
    115 static void btu_hcif_rem_oob_request_evt (UINT8 *p, UINT16 evt_len);
    116     #endif
    117 
    118 static void btu_hcif_simple_pair_complete_evt (UINT8 *p, UINT16 evt_len);
    119     #if L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE
    120 static void btu_hcif_enhanced_flush_complete_evt (UINT8 *p, UINT16 evt_len);
    121     #endif
    122 
    123     #if (BTM_SSR_INCLUDED == TRUE)
    124 static void btu_hcif_ssr_evt (UINT8 *p, UINT16 evt_len);
    125     #endif /* BTM_SSR_INCLUDED == TRUE */
    126 
    127     #if (HID_DEV_INCLUDED == TRUE) && (HID_DEV_PM_INCLUDED == TRUE)
    128 extern void hidd_pm_proc_mode_change( UINT8 hci_status, UINT8 mode, UINT16 interval );
    129     #endif
    130 
    131 
    132     #if BLE_INCLUDED == TRUE
    133 static void btu_ble_ll_conn_complete_evt (UINT8 *p, UINT16 evt_len);
    134 static void btu_ble_process_adv_pkt (UINT8 *p, UINT16 evt_len);
    135 static void btu_ble_read_remote_feat_evt (UINT8 *p, UINT16 evt_len);
    136 static void btu_ble_ll_conn_param_upd_evt (UINT8 *p, UINT16 evt_len);
    137 static void btu_ble_proc_ltk_req (UINT8 *p, UINT16 evt_len);
    138 static void btu_hcif_encyption_key_refresh_cmpl_evt (UINT8 *p, UINT16 evt_len);
    139     #endif
    140 /*******************************************************************************
    141 **
    142 ** Function         btu_hcif_store_cmd
    143 **
    144 ** Description      This function stores a copy of an outgoing command and
    145 **                  and sets a timer waiting for a event in response to the
    146 **                  command.
    147 **
    148 ** Returns          void
    149 **
    150 *******************************************************************************/
    151 static void btu_hcif_store_cmd (UINT8 controller_id, BT_HDR *p_buf)
    152 {
    153     tHCI_CMD_CB *p_hci_cmd_cb;
    154     UINT16  opcode;
    155     BT_HDR  *p_cmd;
    156     UINT8   *p;
    157 
    158     /* Validate controller ID */
    159     if (controller_id >= BTU_MAX_LOCAL_CTRLS)
    160         return;
    161 
    162     p_hci_cmd_cb = &(btu_cb.hci_cmd_cb[controller_id]);
    163     p = (UINT8 *)(p_buf + 1) + p_buf->offset;
    164 
    165     /* get command opcode */
    166     STREAM_TO_UINT16 (opcode, p);
    167 
    168     /* don't do anything for certain commands */
    169     if ((opcode == HCI_RESET) || (opcode == HCI_HOST_NUM_PACKETS_DONE))
    170     {
    171         return;
    172     }
    173 
    174     /* allocate buffer (HCI_GET_CMD_BUF will either get a buffer from HCI_CMD_POOL or from 'best-fit' pool) */
    175     if ((p_cmd = HCI_GET_CMD_BUF(p_buf->len + p_buf->offset - HCIC_PREAMBLE_SIZE)) == NULL)
    176     {
    177         return;
    178     }
    179 
    180     /* copy buffer */
    181     memcpy (p_cmd, p_buf, sizeof(BT_HDR));
    182 
    183     /* If vendor specific save the callback function */
    184     if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC
    185 #if BLE_INCLUDED == TRUE
    186         || (opcode == HCI_BLE_RAND )
    187         || (opcode == HCI_BLE_ENCRYPT)
    188 #endif
    189        )
    190     {
    191 #if 0
    192         BT_TRACE_2 (TRACE_LAYER_HCI, TRACE_TYPE_DEBUG,
    193                     "Storing VSC callback opcode=0x%04x, Callback function=0x%07x",
    194                     opcode, *(UINT32 *)(p_buf + 1));
    195 #endif
    196         memcpy ((UINT8 *)(p_cmd + 1), (UINT8 *)(p_buf + 1), sizeof(void *));
    197     }
    198 
    199     memcpy ((UINT8 *)(p_cmd + 1) + p_cmd->offset,
    200             (UINT8 *)(p_buf + 1) + p_buf->offset, p_buf->len);
    201 
    202     /* queue copy of cmd */
    203     GKI_enqueue(&(p_hci_cmd_cb->cmd_cmpl_q), p_cmd);
    204 
    205     /* start timer */
    206     if (BTU_CMD_CMPL_TIMEOUT > 0)
    207     {
    208 #if (defined(BTU_CMD_CMPL_TOUT_DOUBLE_CHECK) && BTU_CMD_CMPL_TOUT_DOUBLE_CHECK == TRUE)
    209         p_hci_cmd_cb->checked_hcisu = FALSE;
    210 #endif
    211         btu_start_timer (&(p_hci_cmd_cb->cmd_cmpl_timer),
    212                          (UINT16)(BTU_TTYPE_BTU_CMD_CMPL + controller_id),
    213                          BTU_CMD_CMPL_TIMEOUT);
    214     }
    215 }
    216 
    217 /*******************************************************************************
    218 **
    219 ** Function         btu_hcif_process_event
    220 **
    221 ** Description      This function is called when an event is received from
    222 **                  the Host Controller.
    223 **
    224 ** Returns          void
    225 **
    226 *******************************************************************************/
    227 void btu_hcif_process_event (UINT8 controller_id, BT_HDR *p_msg)
    228 {
    229     UINT8   *p = (UINT8 *)(p_msg + 1) + p_msg->offset;
    230     UINT8   hci_evt_code, hci_evt_len;
    231 #if BLE_INCLUDED == TRUE
    232     UINT8   ble_sub_code;
    233 #endif
    234     STREAM_TO_UINT8  (hci_evt_code, p);
    235     STREAM_TO_UINT8  (hci_evt_len, p);
    236 
    237     switch (hci_evt_code)
    238     {
    239         case HCI_INQUIRY_COMP_EVT:
    240             btu_hcif_inquiry_comp_evt (p, hci_evt_len);
    241             break;
    242         case HCI_INQUIRY_RESULT_EVT:
    243             btu_hcif_inquiry_result_evt (p, hci_evt_len);
    244             break;
    245         case HCI_INQUIRY_RSSI_RESULT_EVT:
    246             btu_hcif_inquiry_rssi_result_evt (p, hci_evt_len);
    247             break;
    248 #if (BTM_EIR_CLIENT_INCLUDED == TRUE)
    249         case HCI_EXTENDED_INQUIRY_RESULT_EVT:
    250             btu_hcif_extended_inquiry_result_evt (p, hci_evt_len);
    251             break;
    252 #endif
    253         case HCI_CONNECTION_COMP_EVT:
    254             btu_hcif_connection_comp_evt (p, hci_evt_len);
    255             break;
    256         case HCI_CONNECTION_REQUEST_EVT:
    257             btu_hcif_connection_request_evt (p, hci_evt_len);
    258             break;
    259         case HCI_DISCONNECTION_COMP_EVT:
    260             btu_hcif_disconnection_comp_evt (p, hci_evt_len);
    261             break;
    262         case HCI_AUTHENTICATION_COMP_EVT:
    263             btu_hcif_authentication_comp_evt (p, hci_evt_len);
    264             break;
    265         case HCI_RMT_NAME_REQUEST_COMP_EVT:
    266             btu_hcif_rmt_name_request_comp_evt (p, hci_evt_len);
    267             break;
    268         case HCI_ENCRYPTION_CHANGE_EVT:
    269             btu_hcif_encryption_change_evt (p, hci_evt_len);
    270             break;
    271 #if BLE_INCLUDED == TRUE
    272         case HCI_ENCRYPTION_KEY_REFRESH_COMP_EVT:
    273             btu_hcif_encyption_key_refresh_cmpl_evt(p, hci_evt_len);
    274             break;
    275 #endif
    276         case HCI_CHANGE_CONN_LINK_KEY_EVT:
    277             btu_hcif_change_conn_link_key_evt (p, hci_evt_len);
    278             break;
    279         case HCI_MASTER_LINK_KEY_COMP_EVT:
    280             btu_hcif_master_link_key_comp_evt (p, hci_evt_len);
    281             break;
    282         case HCI_READ_RMT_FEATURES_COMP_EVT:
    283             btu_hcif_read_rmt_features_comp_evt (p, hci_evt_len);
    284             break;
    285         case HCI_READ_RMT_EXT_FEATURES_COMP_EVT:
    286             btu_hcif_read_rmt_ext_features_comp_evt (p, hci_evt_len);
    287             break;
    288         case HCI_READ_RMT_VERSION_COMP_EVT:
    289             btu_hcif_read_rmt_version_comp_evt (p, hci_evt_len);
    290             break;
    291         case HCI_QOS_SETUP_COMP_EVT:
    292             btu_hcif_qos_setup_comp_evt (p, hci_evt_len);
    293             break;
    294         case HCI_COMMAND_COMPLETE_EVT:
    295             btu_hcif_command_complete_evt (controller_id, p, hci_evt_len);
    296             break;
    297         case HCI_COMMAND_STATUS_EVT:
    298             btu_hcif_command_status_evt (controller_id, p, hci_evt_len);
    299             break;
    300         case HCI_HARDWARE_ERROR_EVT:
    301             btu_hcif_hardware_error_evt (p, hci_evt_len);
    302             break;
    303         case HCI_FLUSH_OCCURED_EVT:
    304             btu_hcif_flush_occured_evt (p, hci_evt_len);
    305             break;
    306         case HCI_ROLE_CHANGE_EVT:
    307             btu_hcif_role_change_evt (p, hci_evt_len);
    308             break;
    309         case HCI_NUM_COMPL_DATA_PKTS_EVT:
    310             btu_hcif_num_compl_data_pkts_evt (p, hci_evt_len);
    311             break;
    312         case HCI_MODE_CHANGE_EVT:
    313             btu_hcif_mode_change_evt (p, hci_evt_len);
    314             break;
    315         case HCI_RETURN_LINK_KEYS_EVT:
    316             btu_hcif_return_link_keys_evt (p, hci_evt_len);
    317             break;
    318         case HCI_PIN_CODE_REQUEST_EVT:
    319             btu_hcif_pin_code_request_evt (p, hci_evt_len);
    320             break;
    321         case HCI_LINK_KEY_REQUEST_EVT:
    322             btu_hcif_link_key_request_evt (p, hci_evt_len);
    323             break;
    324         case HCI_LINK_KEY_NOTIFICATION_EVT:
    325             btu_hcif_link_key_notification_evt (p, hci_evt_len);
    326             break;
    327         case HCI_LOOPBACK_COMMAND_EVT:
    328             btu_hcif_loopback_command_evt (p, hci_evt_len);
    329             break;
    330         case HCI_DATA_BUF_OVERFLOW_EVT:
    331             btu_hcif_data_buf_overflow_evt (p, hci_evt_len);
    332             break;
    333         case HCI_MAX_SLOTS_CHANGED_EVT:
    334             btu_hcif_max_slots_changed_evt (p, hci_evt_len);
    335             break;
    336         case HCI_READ_CLOCK_OFF_COMP_EVT:
    337             btu_hcif_read_clock_off_comp_evt (p, hci_evt_len);
    338             break;
    339         case HCI_CONN_PKT_TYPE_CHANGE_EVT:
    340             btu_hcif_conn_pkt_type_change_evt (p, hci_evt_len);
    341             break;
    342         case HCI_QOS_VIOLATION_EVT:
    343             btu_hcif_qos_violation_evt (p, hci_evt_len);
    344             break;
    345         case HCI_PAGE_SCAN_MODE_CHANGE_EVT:
    346             btu_hcif_page_scan_mode_change_evt (p, hci_evt_len);
    347             break;
    348         case HCI_PAGE_SCAN_REP_MODE_CHNG_EVT:
    349             btu_hcif_page_scan_rep_mode_chng_evt (p, hci_evt_len);
    350             break;
    351         case HCI_ESCO_CONNECTION_COMP_EVT:
    352             btu_hcif_esco_connection_comp_evt (p, hci_evt_len);
    353             break;
    354         case HCI_ESCO_CONNECTION_CHANGED_EVT:
    355             btu_hcif_esco_connection_chg_evt (p, hci_evt_len);
    356             break;
    357 #if (BTM_SSR_INCLUDED == TRUE)
    358         case HCI_SNIFF_SUB_RATE_EVT:
    359             btu_hcif_ssr_evt (p, hci_evt_len);
    360             break;
    361 #endif  /* BTM_SSR_INCLUDED == TRUE */
    362         case HCI_RMT_HOST_SUP_FEAT_NOTIFY_EVT:
    363             btu_hcif_host_support_evt (p, hci_evt_len);
    364             break;
    365         case HCI_IO_CAPABILITY_REQUEST_EVT:
    366             btu_hcif_io_cap_request_evt (p, hci_evt_len);
    367             break;
    368         case HCI_IO_CAPABILITY_RESPONSE_EVT:
    369             btu_hcif_io_cap_response_evt (p, hci_evt_len);
    370             break;
    371         case HCI_USER_CONFIRMATION_REQUEST_EVT:
    372             btu_hcif_user_conf_request_evt (p, hci_evt_len);
    373             break;
    374         case HCI_USER_PASSKEY_REQUEST_EVT:
    375             btu_hcif_user_passkey_request_evt (p, hci_evt_len);
    376             break;
    377 #if BTM_OOB_INCLUDED == TRUE
    378         case HCI_REMOTE_OOB_DATA_REQUEST_EVT:
    379             btu_hcif_rem_oob_request_evt (p, hci_evt_len);
    380             break;
    381 #endif
    382         case HCI_SIMPLE_PAIRING_COMPLETE_EVT:
    383             btu_hcif_simple_pair_complete_evt (p, hci_evt_len);
    384             break;
    385         case HCI_USER_PASSKEY_NOTIFY_EVT:
    386             btu_hcif_user_passkey_notif_evt (p, hci_evt_len);
    387             break;
    388         case HCI_KEYPRESS_NOTIFY_EVT:
    389             btu_hcif_keypress_notif_evt (p, hci_evt_len);
    390             break;
    391         case HCI_LINK_SUPER_TOUT_CHANGED_EVT:
    392             btu_hcif_link_super_tout_evt (p, hci_evt_len);
    393             break;
    394 #if L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE
    395         case HCI_ENHANCED_FLUSH_COMPLETE_EVT:
    396             btu_hcif_enhanced_flush_complete_evt (p, hci_evt_len);
    397             break;
    398 #endif
    399 
    400 #if (BLE_INCLUDED == TRUE)
    401         case HCI_BLE_EVENT:
    402             STREAM_TO_UINT8  (ble_sub_code, p);
    403 
    404             BT_TRACE_2 (TRACE_LAYER_HCI, TRACE_TYPE_EVENT, "BLE HCI(id=%d) event = 0x%02x)",
    405                         hci_evt_code,  ble_sub_code);
    406 
    407             switch (ble_sub_code)
    408             {
    409                 case HCI_BLE_ADV_PKT_RPT_EVT: /* result of inquiry */
    410                     btu_ble_process_adv_pkt(p, hci_evt_len);
    411                     break;
    412                 case HCI_BLE_CONN_COMPLETE_EVT:
    413                     btu_ble_ll_conn_complete_evt(p, hci_evt_len);
    414                     break;
    415                 case HCI_BLE_LL_CONN_PARAM_UPD_EVT:
    416                     btu_ble_ll_conn_param_upd_evt(p, hci_evt_len);
    417                     break;
    418                 case HCI_BLE_READ_REMOTE_FEAT_CMPL_EVT:
    419                     btu_ble_read_remote_feat_evt(p, hci_evt_len);
    420                     break;
    421                 case HCI_BLE_LTK_REQ_EVT: /* received only at slave device */
    422                     btu_ble_proc_ltk_req(p, hci_evt_len);
    423                     break;
    424             }
    425             break;
    426 #endif /* BLE_INCLUDED */
    427         case HCI_VENDOR_SPECIFIC_EVT:
    428                 btm_vendor_specific_evt (p, hci_evt_len);
    429             break;
    430     }
    431     // reset the  num_hci_cmds_timed_out upon receving any event from controller.
    432     num_hci_cmds_timed_out = 0;
    433 }
    434 
    435 
    436 /*******************************************************************************
    437 **
    438 ** Function         btu_hcif_send_cmd
    439 **
    440 ** Description      This function is called to check if it can send commands
    441 **                  to the Host Controller. It may be passed the address of
    442 **                  a packet to send.
    443 **
    444 ** Returns          void
    445 **
    446 *******************************************************************************/
    447 void btu_hcif_send_cmd (UINT8 controller_id, BT_HDR *p_buf)
    448 {
    449     tHCI_CMD_CB * p_hci_cmd_cb = &(btu_cb.hci_cmd_cb[controller_id]);
    450 
    451 #if ((L2CAP_HOST_FLOW_CTRL == TRUE)||defined(HCI_TESTER))
    452     UINT8 *pp;
    453     UINT16 code;
    454 #endif
    455 
    456     /* If there are already commands in the queue, then enqueue this command */
    457     if ((p_buf) && (p_hci_cmd_cb->cmd_xmit_q.count))
    458     {
    459         GKI_enqueue (&(p_hci_cmd_cb->cmd_xmit_q), p_buf);
    460         p_buf = NULL;
    461     }
    462 
    463     /* Allow for startup case, where no acks may be received */
    464     if ( ((controller_id == LOCAL_BR_EDR_CONTROLLER_ID)
    465          && (p_hci_cmd_cb->cmd_window == 0)
    466          && (btm_cb.devcb.state == BTM_DEV_STATE_WAIT_RESET_CMPLT)) )
    467     {
    468         p_hci_cmd_cb->cmd_window = p_hci_cmd_cb->cmd_xmit_q.count + 1;
    469     }
    470 
    471     /* See if we can send anything */
    472     while (p_hci_cmd_cb->cmd_window != 0)
    473     {
    474         if (!p_buf)
    475             p_buf = (BT_HDR *)GKI_dequeue (&(p_hci_cmd_cb->cmd_xmit_q));
    476 
    477         if (p_buf)
    478         {
    479             btu_hcif_store_cmd(controller_id, p_buf);
    480 
    481 #if ((L2CAP_HOST_FLOW_CTRL == TRUE)||defined(HCI_TESTER))
    482             pp = (UINT8 *)(p_buf + 1) + p_buf->offset;
    483 
    484             STREAM_TO_UINT16 (code, pp);
    485 
    486             /*
    487              * We do not need to decrease window for host flow control,
    488              * host flow control does not receive an event back from controller
    489              */
    490             if (code != HCI_HOST_NUM_PACKETS_DONE)
    491 #endif
    492                 p_hci_cmd_cb->cmd_window--;
    493 
    494             if (controller_id == LOCAL_BR_EDR_CONTROLLER_ID)
    495             {
    496                 HCI_CMD_TO_LOWER(p_buf);
    497             }
    498             else
    499             {
    500                 /* Unknown controller */
    501                 BT_TRACE_1 (TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "BTU HCI(ctrl id=%d) controller ID not recognized", controller_id);
    502                 GKI_freebuf(p_buf);;
    503             }
    504 
    505             p_buf = NULL;
    506         }
    507         else
    508             break;
    509     }
    510 
    511     if (p_buf)
    512         GKI_enqueue (&(p_hci_cmd_cb->cmd_xmit_q), p_buf);
    513 
    514 #if (defined(HCILP_INCLUDED) && HCILP_INCLUDED == TRUE)
    515     if (controller_id == LOCAL_BR_EDR_CONTROLLER_ID)
    516     {
    517         /* check if controller can go to sleep */
    518         btu_check_bt_sleep ();
    519     }
    520 #endif
    521 
    522 }
    523 
    524 
    525 /*******************************************************************************
    526 **
    527 ** Function         btu_hcif_send_host_rdy_for_data
    528 **
    529 ** Description      This function is called to check if it can send commands
    530 **                  to the Host Controller. It may be passed the address of
    531 **                  a packet to send.
    532 **
    533 ** Returns          void
    534 **
    535 *******************************************************************************/
    536 void btu_hcif_send_host_rdy_for_data(void)
    537 {
    538     UINT16      num_pkts[MAX_L2CAP_LINKS + 4];      /* 3 SCO connections */
    539     UINT16      handles[MAX_L2CAP_LINKS + 4];
    540     UINT8       num_ents;
    541 
    542     /* Get the L2CAP numbers */
    543     num_ents = l2c_link_pkts_rcvd (num_pkts, handles);
    544 
    545     /* Get the SCO numbers */
    546     /* No SCO for now ?? */
    547 
    548     if (num_ents)
    549     {
    550         btsnd_hcic_host_num_xmitted_pkts (num_ents, handles, num_pkts);
    551     }
    552 }
    553 
    554 /*******************************************************************************
    555 **
    556 ** Function         btu_hcif_inquiry_comp_evt
    557 **
    558 ** Description      Process event HCI_INQUIRY_COMP_EVT
    559 **
    560 ** Returns          void
    561 **
    562 *******************************************************************************/
    563 static void btu_hcif_inquiry_comp_evt (UINT8 *p, UINT16 evt_len)
    564 {
    565     UINT8   status;
    566 
    567     STREAM_TO_UINT8    (status, p);
    568 
    569     /* Tell inquiry processing that we are done */
    570     btm_process_inq_complete(status, BTM_BR_INQUIRY_MASK);
    571 }
    572 
    573 
    574 /*******************************************************************************
    575 **
    576 ** Function         btu_hcif_inquiry_result_evt
    577 **
    578 ** Description      Process event HCI_INQUIRY_RESULT_EVT
    579 **
    580 ** Returns          void
    581 **
    582 *******************************************************************************/
    583 static void btu_hcif_inquiry_result_evt (UINT8 *p, UINT16 evt_len)
    584 {
    585     /* Store results in the cache */
    586     btm_process_inq_results (p, BTM_INQ_RESULT_STANDARD);
    587 }
    588 
    589 /*******************************************************************************
    590 **
    591 ** Function         btu_hcif_inquiry_rssi_result_evt
    592 **
    593 ** Description      Process event HCI_INQUIRY_RSSI_RESULT_EVT
    594 **
    595 ** Returns          void
    596 **
    597 *******************************************************************************/
    598 static void btu_hcif_inquiry_rssi_result_evt (UINT8 *p, UINT16 evt_len)
    599 {
    600     /* Store results in the cache */
    601     btm_process_inq_results (p, BTM_INQ_RESULT_WITH_RSSI);
    602 }
    603 
    604 /*******************************************************************************
    605 **
    606 ** Function         btu_hcif_extended_inquiry_result_evt
    607 **
    608 ** Description      Process event HCI_EXTENDED_INQUIRY_RESULT_EVT
    609 **
    610 ** Returns          void
    611 **
    612 *******************************************************************************/
    613 #if (BTM_EIR_CLIENT_INCLUDED == TRUE)
    614 static void btu_hcif_extended_inquiry_result_evt (UINT8 *p, UINT16 evt_len)
    615 {
    616     /* Store results in the cache */
    617     btm_process_inq_results (p, BTM_INQ_RESULT_EXTENDED);
    618 }
    619 #endif
    620 
    621 /*******************************************************************************
    622 **
    623 ** Function         btu_hcif_connection_comp_evt
    624 **
    625 ** Description      Process event HCI_CONNECTION_COMP_EVT
    626 **
    627 ** Returns          void
    628 **
    629 *******************************************************************************/
    630 static void btu_hcif_connection_comp_evt (UINT8 *p, UINT16 evt_len)
    631 {
    632     UINT8       status;
    633     UINT16      handle;
    634     BD_ADDR     bda;
    635     UINT8       link_type;
    636     UINT8       enc_mode;
    637 #if BTM_SCO_INCLUDED == TRUE
    638     tBTM_ESCO_DATA  esco_data;
    639 #endif
    640 
    641     STREAM_TO_UINT8    (status, p);
    642     STREAM_TO_UINT16   (handle, p);
    643     STREAM_TO_BDADDR   (bda, p);
    644     STREAM_TO_UINT8    (link_type, p);
    645     STREAM_TO_UINT8    (enc_mode, p);
    646 
    647     handle = HCID_GET_HANDLE (handle);
    648 
    649     if (link_type == HCI_LINK_TYPE_ACL)
    650     {
    651         btm_sec_connected (bda, handle, status, enc_mode);
    652 
    653         l2c_link_hci_conn_comp (status, handle, bda);
    654     }
    655 #if BTM_SCO_INCLUDED == TRUE
    656     else
    657     {
    658         memset(&esco_data, 0, sizeof(tBTM_ESCO_DATA));
    659         /* esco_data.link_type = HCI_LINK_TYPE_SCO; already zero */
    660         memcpy (esco_data.bd_addr, bda, BD_ADDR_LEN);
    661         btm_sco_connected (status, bda, handle, &esco_data);
    662     }
    663 #endif /* BTM_SCO_INCLUDED */
    664 }
    665 
    666 
    667 /*******************************************************************************
    668 **
    669 ** Function         btu_hcif_connection_request_evt
    670 **
    671 ** Description      Process event HCI_CONNECTION_REQUEST_EVT
    672 **
    673 ** Returns          void
    674 **
    675 *******************************************************************************/
    676 static void btu_hcif_connection_request_evt (UINT8 *p, UINT16 evt_len)
    677 {
    678     BD_ADDR     bda;
    679     DEV_CLASS   dc;
    680     UINT8       link_type;
    681 
    682     STREAM_TO_BDADDR   (bda, p);
    683     STREAM_TO_DEVCLASS (dc, p);
    684     STREAM_TO_UINT8    (link_type, p);
    685 
    686     /* Pass request to security manager to check connect filters before */
    687     /* passing request to l2cap */
    688     if (link_type == HCI_LINK_TYPE_ACL)
    689     {
    690         btm_sec_conn_req (bda, dc);
    691     }
    692 #if BTM_SCO_INCLUDED == TRUE
    693     else
    694     {
    695         btm_sco_conn_req (bda, dc, link_type);
    696     }
    697 #endif /* BTM_SCO_INCLUDED */
    698 }
    699 
    700 
    701 /*******************************************************************************
    702 **
    703 ** Function         btu_hcif_disconnection_comp_evt
    704 **
    705 ** Description      Process event HCI_DISCONNECTION_COMP_EVT
    706 **
    707 ** Returns          void
    708 **
    709 *******************************************************************************/
    710 static void btu_hcif_disconnection_comp_evt (UINT8 *p, UINT16 evt_len)
    711 {
    712     UINT8   status;
    713     UINT16  handle;
    714     UINT8   reason;
    715 
    716     STREAM_TO_UINT8  (status, p);
    717     STREAM_TO_UINT16 (handle, p);
    718     STREAM_TO_UINT8  (reason, p);
    719 
    720     handle = HCID_GET_HANDLE (handle);
    721 
    722 #if BTM_SCO_INCLUDED == TRUE
    723     /* If L2CAP doesn't know about it, send it to SCO */
    724     if (!l2c_link_hci_disc_comp (handle, reason))
    725         btm_sco_removed (handle, reason);
    726 #else
    727     l2c_link_hci_disc_comp (handle, reason);
    728 #endif /* BTM_SCO_INCLUDED */
    729 
    730     /* Notify security manager */
    731     btm_sec_disconnected (handle, reason);
    732 }
    733 
    734 /*******************************************************************************
    735 **
    736 ** Function         btu_hcif_authentication_comp_evt
    737 **
    738 ** Description      Process event HCI_AUTHENTICATION_COMP_EVT
    739 **
    740 ** Returns          void
    741 **
    742 *******************************************************************************/
    743 static void btu_hcif_authentication_comp_evt (UINT8 *p, UINT16 evt_len)
    744 {
    745     UINT8   status;
    746     UINT16  handle;
    747 
    748     STREAM_TO_UINT8  (status, p);
    749     STREAM_TO_UINT16 (handle, p);
    750 
    751     btm_sec_auth_complete (handle, status);
    752 }
    753 
    754 
    755 /*******************************************************************************
    756 **
    757 ** Function         btu_hcif_rmt_name_request_comp_evt
    758 **
    759 ** Description      Process event HCI_RMT_NAME_REQUEST_COMP_EVT
    760 **
    761 ** Returns          void
    762 **
    763 *******************************************************************************/
    764 static void btu_hcif_rmt_name_request_comp_evt (UINT8 *p, UINT16 evt_len)
    765 {
    766     UINT8   status;
    767     BD_ADDR bd_addr;
    768 
    769     STREAM_TO_UINT8 (status, p);
    770     STREAM_TO_BDADDR (bd_addr, p);
    771 
    772     evt_len -= (1 + BD_ADDR_LEN);
    773 
    774     btm_process_remote_name (bd_addr, p, evt_len, status);
    775 
    776     btm_sec_rmt_name_request_complete (bd_addr, p, status);
    777 }
    778 
    779 
    780 /*******************************************************************************
    781 **
    782 ** Function         btu_hcif_encryption_change_evt
    783 **
    784 ** Description      Process event HCI_ENCRYPTION_CHANGE_EVT
    785 **
    786 ** Returns          void
    787 **
    788 *******************************************************************************/
    789 static void btu_hcif_encryption_change_evt (UINT8 *p, UINT16 evt_len)
    790 {
    791     UINT8   status;
    792     UINT16  handle;
    793     UINT8   encr_enable;
    794 
    795     STREAM_TO_UINT8  (status, p);
    796     STREAM_TO_UINT16 (handle, p);
    797     STREAM_TO_UINT8  (encr_enable, p);
    798 
    799     btm_acl_encrypt_change (handle, status, encr_enable);
    800     btm_sec_encrypt_change (handle, status, encr_enable);
    801 }
    802 
    803 
    804 /*******************************************************************************
    805 **
    806 ** Function         btu_hcif_change_conn_link_key_evt
    807 **
    808 ** Description      Process event HCI_CHANGE_CONN_LINK_KEY_EVT
    809 **
    810 ** Returns          void
    811 **
    812 *******************************************************************************/
    813 static void btu_hcif_change_conn_link_key_evt (UINT8 *p, UINT16 evt_len)
    814 {
    815     UINT8   status;
    816     UINT16  handle;
    817 
    818     STREAM_TO_UINT8  (status, p);
    819     STREAM_TO_UINT16 (handle, p);
    820 
    821     btm_acl_link_key_change (handle, status);
    822 }
    823 
    824 
    825 /*******************************************************************************
    826 **
    827 ** Function         btu_hcif_master_link_key_comp_evt
    828 **
    829 ** Description      Process event HCI_MASTER_LINK_KEY_COMP_EVT
    830 **
    831 ** Returns          void
    832 **
    833 *******************************************************************************/
    834 static void btu_hcif_master_link_key_comp_evt (UINT8 *p, UINT16 evt_len)
    835 {
    836     UINT8   status;
    837     UINT16  handle;
    838     UINT8   key_flg;
    839 
    840     STREAM_TO_UINT8  (status, p);
    841     STREAM_TO_UINT16 (handle, p);
    842     STREAM_TO_UINT8  (key_flg, p);
    843 
    844     btm_sec_mkey_comp_event (handle, status, key_flg);
    845 }
    846 
    847 
    848 /*******************************************************************************
    849 **
    850 ** Function         btu_hcif_read_rmt_features_comp_evt
    851 **
    852 ** Description      Process event HCI_READ_RMT_FEATURES_COMP_EVT
    853 **
    854 ** Returns          void
    855 **
    856 *******************************************************************************/
    857 static void btu_hcif_read_rmt_features_comp_evt (UINT8 *p, UINT16 evt_len)
    858 {
    859     btm_read_remote_features_complete(p);
    860 }
    861 
    862 /*******************************************************************************
    863 **
    864 ** Function         btu_hcif_read_rmt_ext_features_comp_evt
    865 **
    866 ** Description      Process event HCI_READ_RMT_EXT_FEATURES_COMP_EVT
    867 **
    868 ** Returns          void
    869 **
    870 *******************************************************************************/
    871 static void btu_hcif_read_rmt_ext_features_comp_evt (UINT8 *p, UINT16 evt_len)
    872 {
    873     UINT8 *p_cur = p;
    874     UINT8 status;
    875     UINT16 handle;
    876 
    877     STREAM_TO_UINT8 (status, p_cur);
    878 
    879     if (status == HCI_SUCCESS)
    880         btm_read_remote_ext_features_complete(p);
    881     else
    882     {
    883         STREAM_TO_UINT16 (handle, p_cur);
    884         btm_read_remote_ext_features_failed(status, handle);
    885     }
    886 }
    887 
    888 /*******************************************************************************
    889 **
    890 ** Function         btu_hcif_read_rmt_version_comp_evt
    891 **
    892 ** Description      Process event HCI_READ_RMT_VERSION_COMP_EVT
    893 **
    894 ** Returns          void
    895 **
    896 *******************************************************************************/
    897 static void btu_hcif_read_rmt_version_comp_evt (UINT8 *p, UINT16 evt_len)
    898 {
    899     btm_read_remote_version_complete (p);
    900 }
    901 
    902 
    903 /*******************************************************************************
    904 **
    905 ** Function         btu_hcif_qos_setup_comp_evt
    906 **
    907 ** Description      Process event HCI_QOS_SETUP_COMP_EVT
    908 **
    909 ** Returns          void
    910 **
    911 *******************************************************************************/
    912 static void btu_hcif_qos_setup_comp_evt (UINT8 *p, UINT16 evt_len)
    913 {
    914     UINT8 status;
    915     UINT16 handle;
    916     FLOW_SPEC flow;
    917 
    918     STREAM_TO_UINT8 (status, p);
    919     STREAM_TO_UINT16 (handle, p);
    920     STREAM_TO_UINT8 (flow.qos_flags, p);
    921     STREAM_TO_UINT8 (flow.service_type, p);
    922     STREAM_TO_UINT32 (flow.token_rate, p);
    923     STREAM_TO_UINT32 (flow.peak_bandwidth, p);
    924     STREAM_TO_UINT32 (flow.latency, p);
    925     STREAM_TO_UINT32 (flow.delay_variation, p);
    926 
    927     btm_qos_setup_complete(status, handle, &flow);
    928 }
    929 
    930 
    931 /*******************************************************************************
    932 **
    933 ** Function         btu_hcif_esco_connection_comp_evt
    934 **
    935 ** Description      Process event HCI_ESCO_CONNECTION_COMP_EVT
    936 **
    937 ** Returns          void
    938 **
    939 *******************************************************************************/
    940 static void btu_hcif_esco_connection_comp_evt (UINT8 *p, UINT16 evt_len)
    941 {
    942 #if BTM_SCO_INCLUDED == TRUE
    943     tBTM_ESCO_DATA  data;
    944     UINT16          handle;
    945     BD_ADDR         bda;
    946     UINT8           status;
    947 
    948     STREAM_TO_UINT8 (status, p);
    949     STREAM_TO_UINT16 (handle, p);
    950     STREAM_TO_BDADDR (bda, p);
    951 
    952     STREAM_TO_UINT8 (data.link_type, p);
    953     STREAM_TO_UINT8 (data.tx_interval, p);
    954     STREAM_TO_UINT8 (data.retrans_window, p);
    955     STREAM_TO_UINT16 (data.rx_pkt_len, p);
    956     STREAM_TO_UINT16 (data.tx_pkt_len, p);
    957     STREAM_TO_UINT8 (data.air_mode, p);
    958 
    959     memcpy (data.bd_addr, bda, BD_ADDR_LEN);
    960     btm_sco_connected (status, bda, handle, &data);
    961 #endif
    962 }
    963 
    964 
    965 /*******************************************************************************
    966 **
    967 ** Function         btu_hcif_esco_connection_chg_evt
    968 **
    969 ** Description      Process event HCI_ESCO_CONNECTION_CHANGED_EVT
    970 **
    971 ** Returns          void
    972 **
    973 *******************************************************************************/
    974 static void btu_hcif_esco_connection_chg_evt (UINT8 *p, UINT16 evt_len)
    975 {
    976 #if BTM_SCO_INCLUDED == TRUE
    977     UINT16  handle;
    978     UINT16  tx_pkt_len;
    979     UINT16  rx_pkt_len;
    980     UINT8   status;
    981     UINT8   tx_interval;
    982     UINT8   retrans_window;
    983 
    984     STREAM_TO_UINT8 (status, p);
    985     STREAM_TO_UINT16 (handle, p);
    986 
    987     STREAM_TO_UINT8 (tx_interval, p);
    988     STREAM_TO_UINT8 (retrans_window, p);
    989     STREAM_TO_UINT16 (rx_pkt_len, p);
    990     STREAM_TO_UINT16 (tx_pkt_len, p);
    991 
    992     btm_esco_proc_conn_chg (status, handle, tx_interval, retrans_window,
    993                             rx_pkt_len, tx_pkt_len);
    994 #endif
    995 }
    996 
    997 /*******************************************************************************
    998 **
    999 ** Function         btu_hcif_hdl_command_complete
   1000 **
   1001 ** Description      Handle command complete event
   1002 **
   1003 ** Returns          void
   1004 **
   1005 *******************************************************************************/
   1006 static void btu_hcif_hdl_command_complete (UINT16 opcode, UINT8 *p, UINT16 evt_len,
   1007                                            void *p_cplt_cback, UINT8 ctr_id)
   1008 {
   1009     switch (opcode)
   1010     {
   1011         case HCI_RESET:
   1012             btm_reset_complete ();  /* BR/EDR */
   1013             break;
   1014 
   1015         case HCI_INQUIRY_CANCEL:
   1016             /* Tell inquiry processing that we are done */
   1017             btm_process_cancel_complete(HCI_SUCCESS, BTM_BR_INQUIRY_MASK);
   1018             break;
   1019         case HCI_SET_EVENT_FILTER:
   1020             btm_event_filter_complete (p);
   1021             break;
   1022 
   1023         case HCI_READ_STORED_LINK_KEY:
   1024             btm_read_stored_link_key_complete (p);
   1025             break;
   1026 
   1027         case HCI_WRITE_STORED_LINK_KEY:
   1028             btm_write_stored_link_key_complete (p);
   1029             break;
   1030 
   1031         case HCI_DELETE_STORED_LINK_KEY:
   1032             btm_delete_stored_link_key_complete (p);
   1033             break;
   1034 
   1035         case HCI_READ_LOCAL_VERSION_INFO:
   1036             btm_read_local_version_complete (p, evt_len);
   1037             break;
   1038 
   1039         case HCI_READ_POLICY_SETTINGS:
   1040             btm_read_link_policy_complete (p);
   1041             break;
   1042 
   1043         case HCI_READ_BUFFER_SIZE:
   1044             btm_read_hci_buf_size_complete (p, evt_len);
   1045             break;
   1046 
   1047         case HCI_READ_LOCAL_SUPPORTED_CMDS:
   1048             btm_read_local_supported_cmds_complete (p);
   1049             break;
   1050 
   1051         case HCI_READ_LOCAL_FEATURES:
   1052             btm_read_local_features_complete (p, evt_len);
   1053             break;
   1054 
   1055         case HCI_READ_LOCAL_EXT_FEATURES:
   1056             btm_read_local_ext_features_complete (p, evt_len);
   1057             break;
   1058 
   1059         case HCI_READ_LOCAL_NAME:
   1060             btm_read_local_name_complete (p, evt_len);
   1061             break;
   1062 
   1063         case HCI_READ_BD_ADDR:
   1064             btm_read_local_addr_complete (p, evt_len);
   1065             break;
   1066 
   1067         case HCI_GET_LINK_QUALITY:
   1068             btm_read_link_quality_complete (p);
   1069             break;
   1070 
   1071         case HCI_READ_RSSI:
   1072             btm_read_rssi_complete (p);
   1073             break;
   1074 
   1075         case HCI_READ_TRANSMIT_POWER_LEVEL:
   1076             btm_read_tx_power_complete(p, FALSE);
   1077             break;
   1078 
   1079         case HCI_CREATE_CONNECTION_CANCEL:
   1080             btm_create_conn_cancel_complete(p);
   1081             break;
   1082 
   1083         case HCI_READ_LOCAL_OOB_DATA:
   1084 #if BTM_OOB_INCLUDED == TRUE
   1085             btm_read_local_oob_complete(p);
   1086 #endif
   1087             break;
   1088 
   1089 
   1090         case HCI_READ_INQ_TX_POWER_LEVEL:
   1091             btm_read_linq_tx_power_complete (p);
   1092             break;
   1093 
   1094         case HCI_WRITE_SIMPLE_PAIRING_MODE:
   1095             btm_write_simple_paring_mode_complete (p);
   1096             break;
   1097 
   1098         case HCI_WRITE_LE_HOST_SUPPORTED:
   1099             btm_write_le_host_supported_complete (p);
   1100             break;
   1101 
   1102 #if (BLE_INCLUDED == TRUE)
   1103 /* BLE Commands */
   1104         case HCI_BLE_READ_WHITE_LIST_SIZE :
   1105             btm_read_white_list_size_complete(p, evt_len);
   1106             break;
   1107 
   1108         case HCI_BLE_ADD_WHITE_LIST:
   1109             btm_ble_add_2_white_list_complete(*p);
   1110             break;
   1111 
   1112         case HCI_BLE_CLEAR_WHITE_LIST:
   1113             btm_ble_clear_white_list_complete(p, evt_len);
   1114             break;
   1115 
   1116         case HCI_BLE_REMOVE_WHITE_LIST:
   1117             btm_ble_remove_from_white_list_complete(p, evt_len);
   1118             break;
   1119 
   1120         case HCI_BLE_RAND:
   1121         case HCI_BLE_ENCRYPT:
   1122 
   1123             btm_ble_rand_enc_complete (p, opcode, (tBTM_RAND_ENC_CB *)p_cplt_cback);
   1124             break;
   1125         case HCI_BLE_READ_BUFFER_SIZE:
   1126             btm_read_ble_buf_size_complete(p, evt_len);
   1127             break;
   1128 
   1129         case HCI_BLE_READ_LOCAL_SPT_FEAT:
   1130             btm_read_ble_local_supported_features_complete(p, evt_len);
   1131             break;
   1132 
   1133         case HCI_BLE_READ_ADV_CHNL_TX_POWER:
   1134             btm_read_tx_power_complete(p, TRUE);
   1135             break;
   1136 
   1137         case HCI_BLE_WRITE_ADV_ENABLE:
   1138             btm_ble_write_adv_enable_complete(p);
   1139             break;
   1140 
   1141         case HCI_BLE_TRANSMITTER_TEST:
   1142         case HCI_BLE_RECEIVER_TEST:
   1143         case HCI_BLE_TEST_END:
   1144             btm_ble_test_command_complete(p);
   1145             break;
   1146 #endif /* (BLE_INCLUDED == TRUE) */
   1147 
   1148         default:
   1149             if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC)
   1150                 btm_vsc_complete (p, opcode, evt_len, (tBTM_CMPL_CB *)p_cplt_cback);
   1151             break;
   1152     }
   1153 }
   1154 
   1155 /*******************************************************************************
   1156 **
   1157 ** Function         btu_hcif_command_complete_evt
   1158 **
   1159 ** Description      Process event HCI_COMMAND_COMPLETE_EVT
   1160 **
   1161 ** Returns          void
   1162 **
   1163 *******************************************************************************/
   1164 static void btu_hcif_command_complete_evt (UINT8 controller_id, UINT8 *p, UINT16 evt_len)
   1165 {
   1166     tHCI_CMD_CB *p_hci_cmd_cb = &(btu_cb.hci_cmd_cb[controller_id]);
   1167     UINT16      cc_opcode;
   1168     BT_HDR      *p_cmd;
   1169     void        *p_cplt_cback = NULL;
   1170 
   1171     STREAM_TO_UINT8  (p_hci_cmd_cb->cmd_window, p);
   1172 
   1173 #if (defined(HCI_MAX_SIMUL_CMDS) && (HCI_MAX_SIMUL_CMDS > 0))
   1174     if (p_hci_cmd_cb->cmd_window > HCI_MAX_SIMUL_CMDS)
   1175         p_hci_cmd_cb->cmd_window = HCI_MAX_SIMUL_CMDS;
   1176 #endif
   1177 
   1178     STREAM_TO_UINT16 (cc_opcode, p);
   1179 
   1180     evt_len -= 3;
   1181 
   1182     /* only do this for certain commands */
   1183     if ((cc_opcode != HCI_RESET) && (cc_opcode != HCI_HOST_NUM_PACKETS_DONE) &&
   1184         (cc_opcode != HCI_COMMAND_NONE))
   1185     {
   1186         /* dequeue and free stored command */
   1187 
   1188 /* always use cmd code check, when one cmd timeout waiting for cmd_cmpl,
   1189    it'll cause the rest of the command goes in wrong order                  */
   1190         p_cmd = (BT_HDR *) GKI_getfirst (&p_hci_cmd_cb->cmd_cmpl_q);
   1191 
   1192         while (p_cmd)
   1193         {
   1194             UINT16 opcode_dequeued;
   1195             UINT8  *p_dequeued;
   1196 
   1197             /* Make sure dequeued command is for the command_cplt received */
   1198             p_dequeued = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
   1199             STREAM_TO_UINT16 (opcode_dequeued, p_dequeued);
   1200 
   1201             if (opcode_dequeued != cc_opcode)
   1202             {
   1203                 /* opcode does not match, check next command in the queue */
   1204                 p_cmd = (BT_HDR *) GKI_getnext(p_cmd);
   1205                 continue;
   1206             }
   1207             GKI_remove_from_queue(&p_hci_cmd_cb->cmd_cmpl_q, p_cmd);
   1208 
   1209             /* If command was a VSC, then extract command_complete callback */
   1210             if ((cc_opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC
   1211 #if BLE_INCLUDED == TRUE
   1212                 || (cc_opcode == HCI_BLE_RAND )
   1213                 || (cc_opcode == HCI_BLE_ENCRYPT)
   1214 #endif
   1215                )
   1216             {
   1217                 p_cplt_cback = *((void **)(p_cmd + 1));
   1218             }
   1219 
   1220             GKI_freebuf (p_cmd);
   1221 
   1222             break;
   1223         }
   1224 
   1225         /* if more commands in queue restart timer */
   1226         if (BTU_CMD_CMPL_TIMEOUT > 0)
   1227         {
   1228             if (!GKI_queue_is_empty (&(p_hci_cmd_cb->cmd_cmpl_q)))
   1229             {
   1230 #if (defined(BTU_CMD_CMPL_TOUT_DOUBLE_CHECK) && BTU_CMD_CMPL_TOUT_DOUBLE_CHECK == TRUE)
   1231                 p_hci_cmd_cb->checked_hcisu = FALSE;
   1232 #endif
   1233                 btu_start_timer (&(p_hci_cmd_cb->cmd_cmpl_timer),
   1234                                  (UINT16)(BTU_TTYPE_BTU_CMD_CMPL + controller_id),
   1235                                  BTU_CMD_CMPL_TIMEOUT);
   1236             }
   1237             else
   1238             {
   1239                 btu_stop_timer (&(p_hci_cmd_cb->cmd_cmpl_timer));
   1240             }
   1241         }
   1242     }
   1243 
   1244     /* handle event */
   1245     btu_hcif_hdl_command_complete (cc_opcode, p, evt_len, p_cplt_cback, controller_id);
   1246 
   1247     /* see if we can send more commands */
   1248     btu_hcif_send_cmd (controller_id, NULL);
   1249 }
   1250 
   1251 
   1252 /*******************************************************************************
   1253 **
   1254 ** Function         btu_hcif_hdl_command_status
   1255 **
   1256 ** Description      Handle a command status event
   1257 **
   1258 ** Returns          void
   1259 **
   1260 *******************************************************************************/
   1261 static void btu_hcif_hdl_command_status (UINT16 opcode, UINT8 status, UINT8 *p_cmd,
   1262                                          void *p_vsc_status_cback, UINT8 controller_id)
   1263 {
   1264     BD_ADDR         bd_addr;
   1265     UINT16          handle;
   1266 #if BTM_SCO_INCLUDED == TRUE
   1267     tBTM_ESCO_DATA  esco_data;
   1268 #endif
   1269 
   1270 #if BTM_PWR_MGR_INCLUDED == TRUE
   1271     switch (opcode)
   1272     {
   1273         case HCI_EXIT_SNIFF_MODE:
   1274         case HCI_EXIT_PARK_MODE:
   1275 #if BTM_SCO_WAKE_PARKED_LINK == TRUE
   1276             if (status != HCI_SUCCESS)
   1277             {
   1278                 /* Allow SCO initiation to continue if waiting for change mode event */
   1279                 if (p_cmd != NULL)
   1280                 {
   1281                     p_cmd++;    /* bypass length field */
   1282                     STREAM_TO_UINT16 (handle, p_cmd);
   1283                     btm_sco_chk_pend_unpark (status, handle);
   1284                 }
   1285             }
   1286 #endif
   1287             /* Case Falls Through */
   1288 
   1289         case HCI_HOLD_MODE:
   1290         case HCI_SNIFF_MODE:
   1291         case HCI_PARK_MODE:
   1292             btm_pm_proc_cmd_status(status);
   1293             break;
   1294 
   1295         default:
   1296 #endif  /* BTM_PWR_MGR_INCLUDED */
   1297             /* If command failed to start, we may need to tell BTM */
   1298             if (status != HCI_SUCCESS)
   1299             {
   1300                 switch (opcode)
   1301                 {
   1302                     case HCI_INQUIRY:
   1303                         /* Tell inquiry processing that we are done */
   1304                         btm_process_inq_complete(status, BTM_BR_INQUIRY_MASK);
   1305                         break;
   1306 
   1307                     case HCI_RMT_NAME_REQUEST:
   1308                         /* Tell inquiry processing that we are done */
   1309                         btm_process_remote_name (NULL, NULL, 0, status);
   1310 
   1311                         btm_sec_rmt_name_request_complete (NULL, NULL, status);
   1312                         break;
   1313 
   1314                     case HCI_CHANGE_CONN_LINK_KEY:
   1315                         /* Let host know we're done with error */
   1316                         /* read handle out of stored command */
   1317                         if (p_cmd != NULL)
   1318                         {
   1319                             p_cmd++;
   1320                             STREAM_TO_UINT16 (handle, p_cmd);
   1321 
   1322                             btm_acl_link_key_change (handle, status);
   1323                         }
   1324                         break;
   1325 
   1326                     case HCI_QOS_SETUP_COMP_EVT:
   1327                         /* Tell qos setup that we are done */
   1328                         btm_qos_setup_complete(status,0,NULL);
   1329                         break;
   1330 
   1331                     case HCI_SWITCH_ROLE:
   1332                         /* Tell BTM that the command failed */
   1333                         /* read bd addr out of stored command */
   1334                         if (p_cmd != NULL)
   1335                         {
   1336                             p_cmd++;
   1337                             STREAM_TO_BDADDR (bd_addr, p_cmd);
   1338                             btm_acl_role_changed(status, bd_addr, BTM_ROLE_UNDEFINED);
   1339                         }
   1340                         else
   1341                             btm_acl_role_changed(status, NULL, BTM_ROLE_UNDEFINED);
   1342                         l2c_link_role_changed (NULL, BTM_ROLE_UNDEFINED, HCI_ERR_COMMAND_DISALLOWED);
   1343                         break;
   1344 
   1345                     case HCI_CREATE_CONNECTION:
   1346                         /* read bd addr out of stored command */
   1347                         if (p_cmd != NULL)
   1348                         {
   1349                             p_cmd++;
   1350                             STREAM_TO_BDADDR (bd_addr, p_cmd);
   1351                             btm_sec_connected (bd_addr, HCI_INVALID_HANDLE, status, 0);
   1352                             l2c_link_hci_conn_comp (status, HCI_INVALID_HANDLE, bd_addr);
   1353                         }
   1354                         break;
   1355 
   1356                     case HCI_READ_RMT_EXT_FEATURES:
   1357                         if (p_cmd != NULL)
   1358                         {
   1359                             p_cmd++; /* skip command length */
   1360                             STREAM_TO_UINT16 (handle, p_cmd);
   1361                         }
   1362                         else
   1363                             handle = HCI_INVALID_HANDLE;
   1364 
   1365                         btm_read_remote_ext_features_failed(status, handle);
   1366                         break;
   1367 
   1368                     case HCI_AUTHENTICATION_REQUESTED:
   1369                         /* Device refused to start authentication.  That should be treated as authentication failure. */
   1370                         btm_sec_auth_complete (BTM_INVALID_HCI_HANDLE, status);
   1371                         break;
   1372 
   1373                     case HCI_SET_CONN_ENCRYPTION:
   1374                         /* Device refused to start encryption.  That should be treated as encryption failure. */
   1375                         btm_sec_encrypt_change (BTM_INVALID_HCI_HANDLE, status, FALSE);
   1376                         break;
   1377 
   1378 #if BTM_SCO_INCLUDED == TRUE
   1379                     case HCI_SETUP_ESCO_CONNECTION:
   1380                         /* read handle out of stored command */
   1381                         if (p_cmd != NULL)
   1382                         {
   1383                             p_cmd++;
   1384                             STREAM_TO_UINT16 (handle, p_cmd);
   1385 
   1386                             /* Determine if initial connection failed or is a change of setup */
   1387                             if (btm_is_sco_active(handle))
   1388                                 btm_esco_proc_conn_chg (status, handle, 0, 0, 0, 0);
   1389                             else
   1390                                 btm_sco_connected (status, NULL, handle, &esco_data);
   1391                         }
   1392                         break;
   1393 #endif
   1394 
   1395 /* This is commented out until an upper layer cares about returning event
   1396 #if L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE
   1397             case HCI_ENHANCED_FLUSH:
   1398                 break;
   1399 #endif
   1400 */
   1401                     default:
   1402                         if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC)
   1403                             btm_vsc_complete (&status, opcode, 1, (tBTM_CMPL_CB *)p_vsc_status_cback);
   1404                         break;
   1405                 }
   1406 
   1407             }
   1408             else
   1409             {
   1410                 if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC)
   1411                     btm_vsc_complete (&status, opcode, 1, (tBTM_CMPL_CB *)p_vsc_status_cback);
   1412             }
   1413 #if BTM_PWR_MGR_INCLUDED == TRUE
   1414     }
   1415 #endif
   1416 }
   1417 
   1418 /*******************************************************************************
   1419 **
   1420 ** Function         btu_hcif_command_status_evt
   1421 **
   1422 ** Description      Process event HCI_COMMAND_STATUS_EVT
   1423 **
   1424 ** Returns          void
   1425 **
   1426 *******************************************************************************/
   1427 static void btu_hcif_command_status_evt (UINT8 controller_id, UINT8 *p, UINT16 evt_len)
   1428 {
   1429     tHCI_CMD_CB * p_hci_cmd_cb = &(btu_cb.hci_cmd_cb[controller_id]);
   1430     UINT8       status;
   1431     UINT16      opcode;
   1432     UINT16      cmd_opcode;
   1433     BT_HDR      *p_cmd = NULL;
   1434     UINT8       *p_data = NULL;
   1435     void        *p_vsc_status_cback = NULL;
   1436 
   1437     STREAM_TO_UINT8  (status, p);
   1438     STREAM_TO_UINT8  (p_hci_cmd_cb->cmd_window, p);
   1439 
   1440 #if (defined(HCI_MAX_SIMUL_CMDS) && (HCI_MAX_SIMUL_CMDS > 0))
   1441     if (p_hci_cmd_cb->cmd_window > HCI_MAX_SIMUL_CMDS)
   1442         p_hci_cmd_cb->cmd_window = HCI_MAX_SIMUL_CMDS;
   1443 #endif
   1444 
   1445     STREAM_TO_UINT16 (opcode, p);
   1446 
   1447     /* only do this for certain commands */
   1448     if ((opcode != HCI_RESET) && (opcode != HCI_HOST_NUM_PACKETS_DONE) &&
   1449         (opcode != HCI_COMMAND_NONE))
   1450     {
   1451         /*look for corresponding command in cmd_queue*/
   1452         p_cmd = (BT_HDR *) GKI_getfirst(&(p_hci_cmd_cb->cmd_cmpl_q));
   1453         while (p_cmd)
   1454         {
   1455             p_data = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
   1456             STREAM_TO_UINT16 (cmd_opcode, p_data);
   1457 
   1458             /* Make sure this  command is for the command_status received */
   1459             if (cmd_opcode != opcode)
   1460             {
   1461                 /* opcode does not match, check next command in the queue */
   1462                 p_cmd = (BT_HDR *) GKI_getnext(p_cmd);
   1463                 continue;
   1464             }
   1465             else
   1466             {
   1467                 GKI_remove_from_queue(&p_hci_cmd_cb->cmd_cmpl_q, p_cmd);
   1468 
   1469                 /* If command was a VSC, then extract command_status callback */
   1470                  if ((cmd_opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC)
   1471                 {
   1472                     p_vsc_status_cback = *((void **)(p_cmd + 1));
   1473                 }
   1474                 break;
   1475             }
   1476         }
   1477 
   1478         /* if more commands in queue restart timer */
   1479         if (BTU_CMD_CMPL_TIMEOUT > 0)
   1480         {
   1481             if (!GKI_queue_is_empty (&(p_hci_cmd_cb->cmd_cmpl_q)))
   1482             {
   1483 #if (defined(BTU_CMD_CMPL_TOUT_DOUBLE_CHECK) && BTU_CMD_CMPL_TOUT_DOUBLE_CHECK == TRUE)
   1484                 p_hci_cmd_cb->checked_hcisu = FALSE;
   1485 #endif
   1486                 btu_start_timer (&(p_hci_cmd_cb->cmd_cmpl_timer),
   1487                                  (UINT16)(BTU_TTYPE_BTU_CMD_CMPL + controller_id),
   1488                                  BTU_CMD_CMPL_TIMEOUT);
   1489             }
   1490             else
   1491             {
   1492                 btu_stop_timer (&(p_hci_cmd_cb->cmd_cmpl_timer));
   1493             }
   1494         }
   1495     }
   1496 
   1497     /* handle command */
   1498     btu_hcif_hdl_command_status (opcode, status, p_data, p_vsc_status_cback, controller_id);
   1499 
   1500     /* free stored command */
   1501     if (p_cmd != NULL)
   1502     {
   1503         GKI_freebuf (p_cmd);
   1504     }
   1505     else
   1506     {
   1507         BT_TRACE_1 (TRACE_LAYER_HCI, TRACE_TYPE_WARNING,
   1508                     "No command in queue matching opcode %d", opcode);
   1509     }
   1510 
   1511     /* See if we can forward any more commands */
   1512     btu_hcif_send_cmd (controller_id, NULL);
   1513 }
   1514 
   1515 /*******************************************************************************
   1516 **
   1517 ** Function         btu_hcif_cmd_timeout
   1518 **
   1519 ** Description      Handle a command timeout
   1520 **
   1521 ** Returns          void
   1522 **
   1523 *******************************************************************************/
   1524 void btu_hcif_cmd_timeout (UINT8 controller_id)
   1525 {
   1526     tHCI_CMD_CB * p_hci_cmd_cb = &(btu_cb.hci_cmd_cb[controller_id]);
   1527     BT_HDR  *p_cmd;
   1528     UINT8   *p;
   1529     void    *p_cplt_cback = NULL;
   1530     UINT16  opcode;
   1531     UINT16  event;
   1532 
   1533 #if (defined(BTU_CMD_CMPL_TOUT_DOUBLE_CHECK) && BTU_CMD_CMPL_TOUT_DOUBLE_CHECK == TRUE)
   1534     if (!(p_hci_cmd_cb->checked_hcisu))
   1535     {
   1536         BT_TRACE_1 (TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "BTU HCI(id=%d) command timeout - double check HCISU", controller_id);
   1537 
   1538         /* trigger HCISU to read any pending data in transport buffer */
   1539         GKI_send_event(HCISU_TASK, HCISU_EVT_MASK);
   1540 
   1541         btu_start_timer (&(p_hci_cmd_cb->cmd_cmpl_timer),
   1542                          (UINT16)(BTU_TTYPE_BTU_CMD_CMPL + controller_id),
   1543                          2); /* start short timer, if timer is set to 1 then it could expire before HCISU checks. */
   1544 
   1545         p_hci_cmd_cb->checked_hcisu = TRUE;
   1546 
   1547         return;
   1548     }
   1549 #endif
   1550 
   1551     /* set the controller cmd window to 1, as if we received a response, so
   1552     ** the flow of commands from the stack doesn't hang */
   1553     p_hci_cmd_cb->cmd_window = 1;
   1554 
   1555     /* get queued command */
   1556     if ((p_cmd = (BT_HDR *) GKI_dequeue (&(p_hci_cmd_cb->cmd_cmpl_q))) == NULL)
   1557     {
   1558         BT_TRACE_0 (TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "Cmd timeout; no cmd in queue");
   1559         return;
   1560     }
   1561 
   1562     /* if more commands in queue restart timer */
   1563     if (BTU_CMD_CMPL_TIMEOUT > 0)
   1564     {
   1565         if (!GKI_queue_is_empty (&(p_hci_cmd_cb->cmd_cmpl_q)))
   1566         {
   1567 #if (defined(BTU_CMD_CMPL_TOUT_DOUBLE_CHECK) && BTU_CMD_CMPL_TOUT_DOUBLE_CHECK == TRUE)
   1568             p_hci_cmd_cb->checked_hcisu = FALSE;
   1569 #endif
   1570             btu_start_timer (&(p_hci_cmd_cb->cmd_cmpl_timer),
   1571                              (UINT16)(BTU_TTYPE_BTU_CMD_CMPL + controller_id),
   1572                              BTU_CMD_CMPL_TIMEOUT);
   1573         }
   1574     }
   1575 
   1576     p = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
   1577 #if (NFC_INCLUDED == TRUE)
   1578     if (controller_id == NFC_CONTROLLER_ID)
   1579     {
   1580         //TODO call nfc_ncif_cmd_timeout
   1581         BT_TRACE_2 (TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "BTU NCI command timeout - header 0x%02x%02x", p[0], p[1]);
   1582         return;
   1583     }
   1584 #endif
   1585 
   1586     /* get opcode from stored command */
   1587     STREAM_TO_UINT16 (opcode, p);
   1588 
   1589 // btla-specific ++
   1590 #if (defined(ANDROID_APP_INCLUDED) && (ANDROID_APP_INCLUDED == TRUE))
   1591     ALOGE("######################################################################");
   1592     ALOGE("#");
   1593     ALOGE("# WARNING : BTU HCI(id=%d) command timeout. opcode=0x%x", controller_id, opcode);
   1594     ALOGE("#");
   1595     ALOGE("######################################################################");
   1596 #else
   1597     BT_TRACE_2 (TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "BTU HCI(id=%d) command timeout. opcode=0x%x", controller_id, opcode);
   1598 #endif
   1599 // btla-specific ++
   1600 
   1601     /* send stack a fake command complete or command status, but first determine
   1602     ** which to send
   1603     */
   1604     switch (opcode)
   1605     {
   1606         case HCI_HOLD_MODE:
   1607         case HCI_SNIFF_MODE:
   1608         case HCI_EXIT_SNIFF_MODE:
   1609         case HCI_PARK_MODE:
   1610         case HCI_EXIT_PARK_MODE:
   1611         case HCI_INQUIRY:
   1612         case HCI_RMT_NAME_REQUEST:
   1613         case HCI_QOS_SETUP_COMP_EVT:
   1614         case HCI_CREATE_CONNECTION:
   1615         case HCI_CHANGE_CONN_LINK_KEY:
   1616         case HCI_SWITCH_ROLE:
   1617         case HCI_READ_RMT_EXT_FEATURES:
   1618         case HCI_AUTHENTICATION_REQUESTED:
   1619         case HCI_SET_CONN_ENCRYPTION:
   1620 #if BTM_SCO_INCLUDED == TRUE
   1621         case HCI_SETUP_ESCO_CONNECTION:
   1622 #endif
   1623             /* fake a command status */
   1624             btu_hcif_hdl_command_status (opcode, HCI_ERR_UNSPECIFIED, p, NULL, controller_id);
   1625             break;
   1626 
   1627         default:
   1628             /* If vendor specific restore the callback function */
   1629             if ((opcode & HCI_GRP_VENDOR_SPECIFIC) == HCI_GRP_VENDOR_SPECIFIC
   1630 #if BLE_INCLUDED == TRUE
   1631                 || (opcode == HCI_BLE_RAND ) ||
   1632                 (opcode == HCI_BLE_ENCRYPT)
   1633 #endif
   1634                )
   1635             {
   1636                 p_cplt_cback = *((void **)(p_cmd + 1));
   1637 #if 0
   1638                 BT_TRACE_2 (TRACE_LAYER_HCI, TRACE_TYPE_DEBUG,
   1639                             "Restoring VSC callback for opcode=0x%04x, Callback function=0x%07x",
   1640                             opcode, (UINT32)p_cplt_cback);
   1641 #endif
   1642             }
   1643 
   1644             /* fake a command complete; first create a fake event */
   1645             event = HCI_ERR_UNSPECIFIED;
   1646             btu_hcif_hdl_command_complete (opcode, (UINT8 *)&event, 1, p_cplt_cback, controller_id);
   1647             break;
   1648     }
   1649 
   1650     /* free stored command */
   1651     GKI_freebuf(p_cmd);
   1652 
   1653     num_hci_cmds_timed_out++;
   1654     /* When we receive consecutive HCI cmd timeouts for >=BTM_MAX_HCI_CMD_TOUT_BEFORE_RESTART
   1655      times, Bluetooth process will be killed and restarted */
   1656     if (num_hci_cmds_timed_out >= BTM_MAX_HCI_CMD_TOUT_BEFORE_RESTART)
   1657     {
   1658         BT_TRACE_1(TRACE_LAYER_HCI, TRACE_TYPE_ERROR,
   1659                   "Num consecutive HCI Cmd tout =%d Restarting BT process",num_hci_cmds_timed_out);
   1660 
   1661         usleep(10000); /* 10 milliseconds */
   1662         /* Killing the process to force a restart as part of fault tolerance */
   1663         kill(getpid(), SIGKILL);
   1664     }
   1665     else
   1666     {
   1667         BT_TRACE_1 (TRACE_LAYER_HCI, TRACE_TYPE_WARNING, "HCI Cmd timeout counter %d",
   1668                     num_hci_cmds_timed_out);
   1669 
   1670         /* If anyone wants device status notifications, give him one */
   1671         btm_report_device_status (BTM_DEV_STATUS_CMD_TOUT);
   1672     }
   1673     /* See if we can forward any more commands */
   1674     btu_hcif_send_cmd (controller_id, NULL);
   1675 }
   1676 
   1677 /*******************************************************************************
   1678 **
   1679 ** Function         btu_hcif_hardware_error_evt
   1680 **
   1681 ** Description      Process event HCI_HARDWARE_ERROR_EVT
   1682 **
   1683 ** Returns          void
   1684 **
   1685 *******************************************************************************/
   1686 static void btu_hcif_hardware_error_evt (UINT8 *p, UINT16 evt_len)
   1687 {
   1688     BT_TRACE_1 (TRACE_LAYER_HCI, TRACE_TYPE_ERROR, "Ctlr H/w error event - code:0x%x", *p);
   1689 
   1690     /* If anyone wants device status notifications, give him one. */
   1691     btm_report_device_status (BTM_DEV_STATUS_DOWN);
   1692 
   1693     /* Reset the controller */
   1694     if (BTM_IsDeviceUp())
   1695         BTM_DeviceReset (NULL);
   1696 }
   1697 
   1698 
   1699 /*******************************************************************************
   1700 **
   1701 ** Function         btu_hcif_flush_occured_evt
   1702 **
   1703 ** Description      Process event HCI_FLUSH_OCCURED_EVT
   1704 **
   1705 ** Returns          void
   1706 **
   1707 *******************************************************************************/
   1708 static void btu_hcif_flush_occured_evt (UINT8 *p, UINT16 evt_len)
   1709 {
   1710 }
   1711 
   1712 
   1713 /*******************************************************************************
   1714 **
   1715 ** Function         btu_hcif_role_change_evt
   1716 **
   1717 ** Description      Process event HCI_ROLE_CHANGE_EVT
   1718 **
   1719 ** Returns          void
   1720 **
   1721 *******************************************************************************/
   1722 static void btu_hcif_role_change_evt (UINT8 *p, UINT16 evt_len)
   1723 {
   1724     UINT8       status;
   1725     BD_ADDR     bda;
   1726     UINT8       role;
   1727 
   1728     STREAM_TO_UINT8 (status, p);
   1729     STREAM_TO_BDADDR (bda, p);
   1730     STREAM_TO_UINT8  (role, p);
   1731 
   1732     l2c_link_role_changed (bda, role, status);
   1733     btm_acl_role_changed(status, bda, role);
   1734 }
   1735 
   1736 
   1737 /*******************************************************************************
   1738 **
   1739 ** Function         btu_hcif_num_compl_data_pkts_evt
   1740 **
   1741 ** Description      Process event HCI_NUM_COMPL_DATA_PKTS_EVT
   1742 **
   1743 ** Returns          void
   1744 **
   1745 *******************************************************************************/
   1746 static void btu_hcif_num_compl_data_pkts_evt (UINT8 *p, UINT16 evt_len)
   1747 {
   1748     /* Process for L2CAP and SCO */
   1749     l2c_link_process_num_completed_pkts (p);
   1750 
   1751     /* Send on to SCO */
   1752     /*?? No SCO for now */
   1753 }
   1754 
   1755 /*******************************************************************************
   1756 **
   1757 ** Function         btu_hcif_mode_change_evt
   1758 **
   1759 ** Description      Process event HCI_MODE_CHANGE_EVT
   1760 **
   1761 ** Returns          void
   1762 **
   1763 *******************************************************************************/
   1764 static void btu_hcif_mode_change_evt (UINT8 *p, UINT16 evt_len)
   1765 {
   1766     UINT8       status;
   1767     UINT16      handle;
   1768     UINT8       current_mode;
   1769     UINT16      interval;
   1770 
   1771     STREAM_TO_UINT8 (status, p);
   1772 
   1773     STREAM_TO_UINT16 (handle, p);
   1774     STREAM_TO_UINT8 (current_mode, p);
   1775     STREAM_TO_UINT16 (interval, p);
   1776 #if BTM_PWR_MGR_INCLUDED == TRUE
   1777 #if BTM_SCO_WAKE_PARKED_LINK == TRUE
   1778     btm_sco_chk_pend_unpark (status, handle);
   1779 #endif
   1780     btm_pm_proc_mode_change (status, handle, current_mode, interval);
   1781 #else
   1782     btm_process_mode_change (status, handle, current_mode, interval);
   1783 #endif /* BTM_PWR_MGR_INCLUDED == TRUE */
   1784 
   1785 #if (HID_DEV_INCLUDED == TRUE) && (HID_DEV_PM_INCLUDED == TRUE)
   1786     hidd_pm_proc_mode_change( status, current_mode, interval ) ;
   1787 #endif
   1788 }
   1789 
   1790 /*******************************************************************************
   1791 **
   1792 ** Function         btu_hcif_ssr_evt
   1793 **
   1794 ** Description      Process event HCI_SNIFF_SUB_RATE_EVT
   1795 **
   1796 ** Returns          void
   1797 **
   1798 *******************************************************************************/
   1799     #if (BTM_SSR_INCLUDED == TRUE)
   1800 static void btu_hcif_ssr_evt (UINT8 *p, UINT16 evt_len)
   1801 {
   1802 #if (BTM_PWR_MGR_INCLUDED == TRUE)
   1803     btm_pm_proc_ssr_evt(p, evt_len);
   1804 #endif
   1805 }
   1806     #endif
   1807 
   1808 
   1809 /*******************************************************************************
   1810 **
   1811 ** Function         btu_hcif_return_link_keys_evt
   1812 **
   1813 ** Description      Process event HCI_RETURN_LINK_KEYS_EVT
   1814 **
   1815 ** Returns          void
   1816 **
   1817 *******************************************************************************/
   1818 
   1819 static void btu_hcif_return_link_keys_evt (UINT8 *p, UINT16 evt_len)
   1820 {
   1821     UINT8                       num_keys;
   1822     tBTM_RETURN_LINK_KEYS_EVT   *result;
   1823 
   1824     /* get the number of link keys */
   1825     num_keys = *p;
   1826 
   1827     /* If there are no link keys don't call the call back */
   1828     if (!num_keys)
   1829         return;
   1830 
   1831     /* Take one extra byte at the beginning to specify event */
   1832     result = (tBTM_RETURN_LINK_KEYS_EVT *)(--p);
   1833     result->event = BTM_CB_EVT_RETURN_LINK_KEYS;
   1834 
   1835     /* Call the BTM function to pass the link keys to application */
   1836     btm_return_link_keys_evt (result);
   1837 }
   1838 
   1839 
   1840 /*******************************************************************************
   1841 **
   1842 ** Function         btu_hcif_pin_code_request_evt
   1843 **
   1844 ** Description      Process event HCI_PIN_CODE_REQUEST_EVT
   1845 **
   1846 ** Returns          void
   1847 **
   1848 *******************************************************************************/
   1849 static void btu_hcif_pin_code_request_evt (UINT8 *p, UINT16 evt_len)
   1850 {
   1851     BD_ADDR  bda;
   1852 
   1853     STREAM_TO_BDADDR (bda, p);
   1854 
   1855     /* Tell L2CAP that there was a PIN code request,  */
   1856     /* it may need to stretch timeouts                */
   1857     l2c_pin_code_request (bda);
   1858 
   1859     btm_sec_pin_code_request (bda);
   1860 }
   1861 
   1862 
   1863 /*******************************************************************************
   1864 **
   1865 ** Function         btu_hcif_link_key_request_evt
   1866 **
   1867 ** Description      Process event HCI_LINK_KEY_REQUEST_EVT
   1868 **
   1869 ** Returns          void
   1870 **
   1871 *******************************************************************************/
   1872 static void btu_hcif_link_key_request_evt (UINT8 *p, UINT16 evt_len)
   1873 {
   1874     BD_ADDR  bda;
   1875 
   1876     STREAM_TO_BDADDR (bda, p);
   1877     btm_sec_link_key_request (bda);
   1878 }
   1879 
   1880 
   1881 /*******************************************************************************
   1882 **
   1883 ** Function         btu_hcif_link_key_notification_evt
   1884 **
   1885 ** Description      Process event HCI_LINK_KEY_NOTIFICATION_EVT
   1886 **
   1887 ** Returns          void
   1888 **
   1889 *******************************************************************************/
   1890 static void btu_hcif_link_key_notification_evt (UINT8 *p, UINT16 evt_len)
   1891 {
   1892     BD_ADDR  bda;
   1893     LINK_KEY key;
   1894     UINT8    key_type;
   1895 
   1896     STREAM_TO_BDADDR (bda, p);
   1897     STREAM_TO_ARRAY16 (key, p);
   1898     STREAM_TO_UINT8 (key_type, p);
   1899 
   1900     btm_sec_link_key_notification (bda, key, key_type);
   1901 }
   1902 
   1903 
   1904 /*******************************************************************************
   1905 **
   1906 ** Function         btu_hcif_loopback_command_evt
   1907 **
   1908 ** Description      Process event HCI_LOOPBACK_COMMAND_EVT
   1909 **
   1910 ** Returns          void
   1911 **
   1912 *******************************************************************************/
   1913 static void btu_hcif_loopback_command_evt (UINT8 *p, UINT16 evt_len)
   1914 {
   1915 }
   1916 
   1917 
   1918 /*******************************************************************************
   1919 **
   1920 ** Function         btu_hcif_data_buf_overflow_evt
   1921 **
   1922 ** Description      Process event HCI_DATA_BUF_OVERFLOW_EVT
   1923 **
   1924 ** Returns          void
   1925 **
   1926 *******************************************************************************/
   1927 static void btu_hcif_data_buf_overflow_evt (UINT8 *p, UINT16 evt_len)
   1928 {
   1929 }
   1930 
   1931 
   1932 /*******************************************************************************
   1933 **
   1934 ** Function         btu_hcif_max_slots_changed_evt
   1935 **
   1936 ** Description      Process event HCI_MAX_SLOTS_CHANGED_EVT
   1937 **
   1938 ** Returns          void
   1939 **
   1940 *******************************************************************************/
   1941 static void btu_hcif_max_slots_changed_evt (UINT8 *p, UINT16 evt_len)
   1942 {
   1943 }
   1944 
   1945 
   1946 /*******************************************************************************
   1947 **
   1948 ** Function         btu_hcif_read_clock_off_comp_evt
   1949 **
   1950 ** Description      Process event HCI_READ_CLOCK_OFF_COMP_EVT
   1951 **
   1952 ** Returns          void
   1953 **
   1954 *******************************************************************************/
   1955 static void btu_hcif_read_clock_off_comp_evt (UINT8 *p, UINT16 evt_len)
   1956 {
   1957     UINT8       status;
   1958     UINT16      handle;
   1959     UINT16      clock_offset;
   1960 
   1961     STREAM_TO_UINT8  (status, p);
   1962 
   1963     /* If failed to get clock offset just drop the result */
   1964     if (status != HCI_SUCCESS)
   1965         return;
   1966 
   1967     STREAM_TO_UINT16 (handle, p);
   1968     STREAM_TO_UINT16 (clock_offset, p);
   1969 
   1970     handle = HCID_GET_HANDLE (handle);
   1971 
   1972     btm_process_clk_off_comp_evt (handle, clock_offset);
   1973     btm_sec_update_clock_offset (handle, clock_offset);
   1974 }
   1975 
   1976 
   1977 /*******************************************************************************
   1978 **
   1979 ** Function         btu_hcif_conn_pkt_type_change_evt
   1980 **
   1981 ** Description      Process event HCI_CONN_PKT_TYPE_CHANGE_EVT
   1982 **
   1983 ** Returns          void
   1984 **
   1985 *******************************************************************************/
   1986 static void btu_hcif_conn_pkt_type_change_evt (UINT8 *p, UINT16 evt_len)
   1987 {
   1988 }
   1989 
   1990 
   1991 /*******************************************************************************
   1992 **
   1993 ** Function         btu_hcif_qos_violation_evt
   1994 **
   1995 ** Description      Process event HCI_QOS_VIOLATION_EVT
   1996 **
   1997 ** Returns          void
   1998 **
   1999 *******************************************************************************/
   2000 static void btu_hcif_qos_violation_evt (UINT8 *p, UINT16 evt_len)
   2001 {
   2002     UINT16   handle;
   2003 
   2004     STREAM_TO_UINT16 (handle, p);
   2005 
   2006     handle = HCID_GET_HANDLE (handle);
   2007 
   2008 
   2009     l2c_link_hci_qos_violation (handle);
   2010 }
   2011 
   2012 
   2013 /*******************************************************************************
   2014 **
   2015 ** Function         btu_hcif_page_scan_mode_change_evt
   2016 **
   2017 ** Description      Process event HCI_PAGE_SCAN_MODE_CHANGE_EVT
   2018 **
   2019 ** Returns          void
   2020 **
   2021 *******************************************************************************/
   2022 static void btu_hcif_page_scan_mode_change_evt (UINT8 *p, UINT16 evt_len)
   2023 {
   2024 }
   2025 
   2026 
   2027 /*******************************************************************************
   2028 **
   2029 ** Function         btu_hcif_page_scan_rep_mode_chng_evt
   2030 **
   2031 ** Description      Process event HCI_PAGE_SCAN_REP_MODE_CHNG_EVT
   2032 **
   2033 ** Returns          void
   2034 **
   2035 *******************************************************************************/
   2036 static void btu_hcif_page_scan_rep_mode_chng_evt (UINT8 *p, UINT16 evt_len)
   2037 {
   2038 }
   2039 
   2040 /**********************************************
   2041 ** Simple Pairing Events
   2042 ***********************************************/
   2043 
   2044 /*******************************************************************************
   2045 **
   2046 ** Function         btu_hcif_host_support_evt
   2047 **
   2048 ** Description      Process event HCI_RMT_HOST_SUP_FEAT_NOTIFY_EVT
   2049 **
   2050 ** Returns          void
   2051 **
   2052 *******************************************************************************/
   2053 static void btu_hcif_host_support_evt (UINT8 *p, UINT16 evt_len)
   2054 {
   2055     btm_sec_rmt_host_support_feat_evt(p);
   2056 }
   2057 
   2058 /*******************************************************************************
   2059 **
   2060 ** Function         btu_hcif_io_cap_request_evt
   2061 **
   2062 ** Description      Process event HCI_IO_CAPABILITY_REQUEST_EVT
   2063 **
   2064 ** Returns          void
   2065 **
   2066 *******************************************************************************/
   2067 static void btu_hcif_io_cap_request_evt (UINT8 *p, UINT16 evt_len)
   2068 {
   2069     btm_io_capabilities_req(p);
   2070 }
   2071 
   2072 
   2073 /*******************************************************************************
   2074 **
   2075 ** Function         btu_hcif_io_cap_response_evt
   2076 **
   2077 ** Description      Process event HCI_IO_CAPABILITY_RESPONSE_EVT
   2078 **
   2079 ** Returns          void
   2080 **
   2081 *******************************************************************************/
   2082 static void btu_hcif_io_cap_response_evt (UINT8 *p, UINT16 evt_len)
   2083 {
   2084     btm_io_capabilities_rsp(p);
   2085 }
   2086 
   2087 
   2088 /*******************************************************************************
   2089 **
   2090 ** Function         btu_hcif_user_conf_request_evt
   2091 **
   2092 ** Description      Process event HCI_USER_CONFIRMATION_REQUEST_EVT
   2093 **
   2094 ** Returns          void
   2095 **
   2096 *******************************************************************************/
   2097 static void btu_hcif_user_conf_request_evt (UINT8 *p, UINT16 evt_len)
   2098 {
   2099     btm_proc_sp_req_evt(BTM_SP_CFM_REQ_EVT, p);
   2100 }
   2101 
   2102 
   2103 /*******************************************************************************
   2104 **
   2105 ** Function         btu_hcif_user_passkey_request_evt
   2106 **
   2107 ** Description      Process event HCI_USER_PASSKEY_REQUEST_EVT
   2108 **
   2109 ** Returns          void
   2110 **
   2111 *******************************************************************************/
   2112 static void btu_hcif_user_passkey_request_evt (UINT8 *p, UINT16 evt_len)
   2113 {
   2114     btm_proc_sp_req_evt(BTM_SP_KEY_REQ_EVT, p);
   2115 }
   2116 
   2117 /*******************************************************************************
   2118 **
   2119 ** Function         btu_hcif_user_passkey_notif_evt
   2120 **
   2121 ** Description      Process event HCI_USER_PASSKEY_NOTIFY_EVT
   2122 **
   2123 ** Returns          void
   2124 **
   2125 *******************************************************************************/
   2126 static void btu_hcif_user_passkey_notif_evt (UINT8 *p, UINT16 evt_len)
   2127 {
   2128     btm_proc_sp_req_evt(BTM_SP_KEY_NOTIF_EVT, p);
   2129 }
   2130 
   2131 /*******************************************************************************
   2132 **
   2133 ** Function         btu_hcif_keypress_notif_evt
   2134 **
   2135 ** Description      Process event HCI_KEYPRESS_NOTIFY_EVT
   2136 **
   2137 ** Returns          void
   2138 **
   2139 *******************************************************************************/
   2140 static void btu_hcif_keypress_notif_evt (UINT8 *p, UINT16 evt_len)
   2141 {
   2142     btm_keypress_notif_evt(p);
   2143 }
   2144 
   2145 /*******************************************************************************
   2146 **
   2147 ** Function         btu_hcif_link_super_tout_evt
   2148 **
   2149 ** Description      Process event HCI_LINK_SUPER_TOUT_CHANGED_EVT
   2150 **
   2151 ** Returns          void
   2152 **
   2153 *******************************************************************************/
   2154 static void btu_hcif_link_super_tout_evt (UINT8 *p, UINT16 evt_len)
   2155 {
   2156     UINT16 handle, timeout;
   2157     STREAM_TO_UINT16 (handle, p);
   2158     STREAM_TO_UINT16 (timeout, p);
   2159 
   2160     btm_proc_lsto_evt(handle, timeout);
   2161 }
   2162 
   2163 /*******************************************************************************
   2164 **
   2165 ** Function         btu_hcif_rem_oob_request_evt
   2166 **
   2167 ** Description      Process event HCI_REMOTE_OOB_DATA_REQUEST_EVT
   2168 **
   2169 ** Returns          void
   2170 **
   2171 *******************************************************************************/
   2172     #if BTM_OOB_INCLUDED == TRUE
   2173 static void btu_hcif_rem_oob_request_evt (UINT8 *p, UINT16 evt_len)
   2174 {
   2175     btm_rem_oob_req(p);
   2176 }
   2177     #endif
   2178 
   2179 /*******************************************************************************
   2180 **
   2181 ** Function         btu_hcif_simple_pair_complete_evt
   2182 **
   2183 ** Description      Process event HCI_SIMPLE_PAIRING_COMPLETE_EVT
   2184 **
   2185 ** Returns          void
   2186 **
   2187 *******************************************************************************/
   2188 static void btu_hcif_simple_pair_complete_evt (UINT8 *p, UINT16 evt_len)
   2189 {
   2190     btm_simple_pair_complete(p);
   2191 }
   2192 /*******************************************************************************
   2193 **
   2194 ** Function         btu_hcif_flush_cmd_queue
   2195 **
   2196 ** Description      Flush the HCI command complete queue and transmit queue when
   2197 **                  needed.
   2198 **
   2199 ** Returns          void
   2200 **
   2201 *******************************************************************************/
   2202 void btu_hcif_flush_cmd_queue(void)
   2203 {
   2204     BT_HDR *p_cmd;
   2205 
   2206     btu_cb.hci_cmd_cb[0].cmd_window = 0;
   2207     while ((p_cmd = (BT_HDR *) GKI_dequeue (&btu_cb.hci_cmd_cb[0].cmd_cmpl_q)) != NULL)
   2208     {
   2209         GKI_freebuf (p_cmd);
   2210     }
   2211     while ((p_cmd = (BT_HDR *) GKI_dequeue (&btu_cb.hci_cmd_cb[0].cmd_xmit_q)) != NULL)
   2212     {
   2213         GKI_freebuf (p_cmd);
   2214     }
   2215 }
   2216 
   2217 /*******************************************************************************
   2218 **
   2219 ** Function         btu_hcif_enhanced_flush_complete_evt
   2220 **
   2221 ** Description      Process event HCI_ENHANCED_FLUSH_COMPLETE_EVT
   2222 **
   2223 ** Returns          void
   2224 **
   2225 *******************************************************************************/
   2226 #if L2CAP_NON_FLUSHABLE_PB_INCLUDED == TRUE
   2227 static void btu_hcif_enhanced_flush_complete_evt (UINT8 *p, UINT16 evt_len)
   2228 {
   2229 /* This is empty until an upper layer cares about returning event */
   2230 }
   2231 #endif
   2232 /**********************************************
   2233 ** End of Simple Pairing Events
   2234 ***********************************************/
   2235 
   2236 
   2237 /**********************************************
   2238 ** BLE Events
   2239 ***********************************************/
   2240 #if (defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE)
   2241 static void btu_hcif_encyption_key_refresh_cmpl_evt (UINT8 *p, UINT16 evt_len)
   2242 {
   2243     UINT8   status;
   2244     UINT8   enc_enable = 0;
   2245     UINT16  handle;
   2246 
   2247     STREAM_TO_UINT8  (status, p);
   2248     STREAM_TO_UINT16 (handle, p);
   2249 
   2250     if (status == HCI_SUCCESS) enc_enable = 1;
   2251 
   2252     btm_sec_encrypt_change (handle, status, enc_enable);
   2253 }
   2254 
   2255 static void btu_ble_process_adv_pkt (UINT8 *p, UINT16 evt_len)
   2256 {
   2257     BT_TRACE_0 (TRACE_LAYER_HCI, TRACE_TYPE_EVENT, "btu_ble_process_adv_pkt");
   2258 
   2259     btm_ble_process_adv_pkt(p);
   2260 }
   2261 
   2262 static void btu_ble_ll_conn_complete_evt ( UINT8 *p, UINT16 evt_len)
   2263 {
   2264     btm_ble_conn_complete(p, evt_len);
   2265 }
   2266 
   2267 static void btu_ble_ll_conn_param_upd_evt (UINT8 *p, UINT16 evt_len)
   2268 {
   2269 /* This is empty until an upper layer cares about returning event */
   2270 }
   2271 
   2272 static void btu_ble_read_remote_feat_evt (UINT8 *p, UINT16 evt_len)
   2273 {
   2274     btm_ble_read_remote_features_complete(p);
   2275 }
   2276 
   2277 static void btu_ble_proc_ltk_req (UINT8 *p, UINT16 evt_len)
   2278 {
   2279     UINT16 ediv, handle;
   2280     UINT8   *pp;
   2281 
   2282     STREAM_TO_UINT16(handle, p);
   2283     pp = p + 8;
   2284     STREAM_TO_UINT16(ediv, pp);
   2285 #if BLE_INCLUDED == TRUE && SMP_INCLUDED == TRUE
   2286     btm_ble_ltk_request(handle, p, ediv);
   2287 #endif
   2288     /* This is empty until an upper layer cares about returning event */
   2289 }
   2290 /**********************************************
   2291 ** End of BLE Events Handler
   2292 ***********************************************/
   2293 #endif /* BLE_INCLUDED */
   2294 
   2295