Home | History | Annotate | Download | only in btm
      1 /******************************************************************************
      2  *
      3  *  Copyright (C) 2008-2014 Broadcom Corporation
      4  *
      5  *  Licensed under the Apache License, Version 2.0 (the "License");
      6  *  you may not use this file except in compliance with the License.
      7  *  You may obtain a copy of the License at:
      8  *
      9  *  http://www.apache.org/licenses/LICENSE-2.0
     10  *
     11  *  Unless required by applicable law or agreed to in writing, software
     12  *  distributed under the License is distributed on an "AS IS" BASIS,
     13  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     14  *  See the License for the specific language governing permissions and
     15  *  limitations under the License.
     16  *
     17  ******************************************************************************/
     18 
     19 /******************************************************************************
     20  *
     21  *  This file contains functions for BLE GAP.
     22  *
     23  ******************************************************************************/
     24 
     25 #define LOG_TAG "bt_btm_ble"
     26 
     27 #include <base/bind.h>
     28 #include <base/callback.h>
     29 #include <base/strings/string_number_conversions.h>
     30 #include <stddef.h>
     31 #include <stdio.h>
     32 #include <string.h>
     33 #include <list>
     34 #include <vector>
     35 
     36 #include "bt_types.h"
     37 #include "bt_utils.h"
     38 #include "btm_ble_api.h"
     39 #include "btm_int.h"
     40 #include "btu.h"
     41 #include "device/include/controller.h"
     42 #include "gap_api.h"
     43 #include "hcimsgs.h"
     44 #include "osi/include/osi.h"
     45 
     46 #include "advertise_data_parser.h"
     47 #include "btm_ble_int.h"
     48 #include "gatt_int.h"
     49 #include "gattdefs.h"
     50 #include "l2c_int.h"
     51 #include "osi/include/log.h"
     52 
     53 #define BTM_BLE_NAME_SHORT 0x01
     54 #define BTM_BLE_NAME_CMPL 0x02
     55 
     56 #define BTM_BLE_FILTER_TARGET_UNKNOWN 0xff
     57 #define BTM_BLE_POLICY_UNKNOWN 0xff
     58 
     59 #define BTM_EXT_BLE_RMT_NAME_TIMEOUT_MS (30 * 1000)
     60 #define MIN_ADV_LENGTH 2
     61 #define BTM_VSC_CHIP_CAPABILITY_RSP_LEN_L_RELEASE 9
     62 
     63 namespace {
     64 
     65 class AdvertisingCache {
     66  public:
     67   /* Set the data to |data| for device |addr_type, addr| */
     68   const std::vector<uint8_t>& Set(uint8_t addr_type, const RawAddress& addr,
     69                                   std::vector<uint8_t> data) {
     70     auto it = Find(addr_type, addr);
     71     if (it != items.end()) {
     72       it->data = std::move(data);
     73       return it->data;
     74     }
     75 
     76     if (items.size() > cache_max) {
     77       items.pop_back();
     78     }
     79 
     80     items.emplace_front(addr_type, addr, std::move(data));
     81     return items.front().data;
     82   }
     83 
     84   /* Append |data| for device |addr_type, addr| */
     85   const std::vector<uint8_t>& Append(uint8_t addr_type, const RawAddress& addr,
     86                                      std::vector<uint8_t> data) {
     87     auto it = Find(addr_type, addr);
     88     if (it != items.end()) {
     89       it->data.insert(it->data.end(), data.begin(), data.end());
     90       return it->data;
     91     }
     92 
     93     if (items.size() > cache_max) {
     94       items.pop_back();
     95     }
     96 
     97     items.emplace_front(addr_type, addr, std::move(data));
     98     return items.front().data;
     99   }
    100 
    101   /* Clear data for device |addr_type, addr| */
    102   void Clear(uint8_t addr_type, const RawAddress& addr) {
    103     auto it = Find(addr_type, addr);
    104     if (it != items.end()) {
    105       items.erase(it);
    106     }
    107   }
    108 
    109  private:
    110   struct Item {
    111     uint8_t addr_type;
    112     RawAddress addr;
    113     std::vector<uint8_t> data;
    114 
    115     Item(uint8_t addr_type, const RawAddress& addr, std::vector<uint8_t> data)
    116         : addr_type(addr_type), addr(addr), data(data) {}
    117   };
    118 
    119   std::list<Item>::iterator Find(uint8_t addr_type, const RawAddress& addr) {
    120     for (auto it = items.begin(); it != items.end(); it++) {
    121       if (it->addr_type == addr_type && it->addr == addr) {
    122         return it;
    123       }
    124     }
    125     return items.end();
    126   }
    127 
    128   /* we keep maximum 7 devices in the cache */
    129   const size_t cache_max = 7;
    130   std::list<Item> items;
    131 };
    132 
    133 /* Devices in this cache are waiting for eiter scan response, or chained packets
    134  * on secondary channel */
    135 AdvertisingCache cache;
    136 
    137 }  // namespace
    138 
    139 #if (BLE_VND_INCLUDED == TRUE)
    140 static tBTM_BLE_CTRL_FEATURES_CBACK* p_ctrl_le_feature_rd_cmpl_cback = NULL;
    141 #endif
    142 
    143 /*******************************************************************************
    144  *  Local functions
    145  ******************************************************************************/
    146 static void btm_ble_update_adv_flag(uint8_t flag);
    147 static void btm_ble_process_adv_pkt_cont(
    148     uint16_t evt_type, uint8_t addr_type, const RawAddress& bda,
    149     uint8_t primary_phy, uint8_t secondary_phy, uint8_t advertising_sid,
    150     int8_t tx_power, int8_t rssi, uint16_t periodic_adv_int, uint8_t data_len,
    151     uint8_t* data);
    152 static uint8_t btm_set_conn_mode_adv_init_addr(tBTM_BLE_INQ_CB* p_cb,
    153                                                RawAddress& p_peer_addr_ptr,
    154                                                tBLE_ADDR_TYPE* p_peer_addr_type,
    155                                                tBLE_ADDR_TYPE* p_own_addr_type);
    156 static void btm_ble_stop_observe(void);
    157 static void btm_ble_fast_adv_timer_timeout(void* data);
    158 static void btm_ble_start_slow_adv(void);
    159 static void btm_ble_inquiry_timer_gap_limited_discovery_timeout(void* data);
    160 static void btm_ble_inquiry_timer_timeout(void* data);
    161 static void btm_ble_observer_timer_timeout(void* data);
    162 
    163 #define BTM_BLE_INQ_RESULT 0x01
    164 #define BTM_BLE_OBS_RESULT 0x02
    165 
    166 bool ble_evt_type_is_connectable(uint16_t evt_type) {
    167   return evt_type & (1 << BLE_EVT_CONNECTABLE_BIT);
    168 }
    169 
    170 bool ble_evt_type_is_scannable(uint16_t evt_type) {
    171   return evt_type & (1 << BLE_EVT_SCANNABLE_BIT);
    172 }
    173 
    174 bool ble_evt_type_is_directed(uint16_t evt_type) {
    175   return evt_type & (1 << BLE_EVT_DIRECTED_BIT);
    176 }
    177 
    178 bool ble_evt_type_is_scan_resp(uint16_t evt_type) {
    179   return evt_type & (1 << BLE_EVT_SCAN_RESPONSE_BIT);
    180 }
    181 
    182 bool ble_evt_type_is_legacy(uint16_t evt_type) {
    183   return evt_type & (1 << BLE_EVT_LEGACY_BIT);
    184 }
    185 
    186 uint8_t ble_evt_type_data_status(uint16_t evt_type) {
    187   return (evt_type >> 5) & 3;
    188 }
    189 
    190 constexpr uint8_t UNSUPPORTED = 255;
    191 
    192 /* LE states combo bit to check */
    193 const uint8_t btm_le_state_combo_tbl[BTM_BLE_STATE_MAX][BTM_BLE_STATE_MAX] = {
    194     {
    195         /* single state support */
    196         HCI_LE_STATES_CONN_ADV_BIT, /* conn_adv */
    197         HCI_LE_STATES_INIT_BIT,     /* init */
    198         HCI_LE_STATES_INIT_BIT,     /* master */
    199         HCI_LE_STATES_SLAVE_BIT,    /* slave */
    200         UNSUPPORTED,                /* todo: lo du dir adv, not covered ? */
    201         HCI_LE_STATES_HI_DUTY_DIR_ADV_BIT, /* hi duty dir adv */
    202         HCI_LE_STATES_NON_CONN_ADV_BIT,    /* non connectable adv */
    203         HCI_LE_STATES_PASS_SCAN_BIT,       /*  passive scan */
    204         HCI_LE_STATES_ACTIVE_SCAN_BIT,     /*   active scan */
    205         HCI_LE_STATES_SCAN_ADV_BIT         /* scanable adv */
    206     },
    207     {
    208         /* conn_adv =0 */
    209         UNSUPPORTED,                            /* conn_adv */
    210         HCI_LE_STATES_CONN_ADV_INIT_BIT,        /* init: 32 */
    211         HCI_LE_STATES_CONN_ADV_MASTER_BIT,      /* master: 35 */
    212         HCI_LE_STATES_CONN_ADV_SLAVE_BIT,       /* slave: 38,*/
    213         UNSUPPORTED,                            /* lo du dir adv */
    214         UNSUPPORTED,                            /* hi duty dir adv */
    215         UNSUPPORTED,                            /* non connectable adv */
    216         HCI_LE_STATES_CONN_ADV_PASS_SCAN_BIT,   /*  passive scan */
    217         HCI_LE_STATES_CONN_ADV_ACTIVE_SCAN_BIT, /*   active scan */
    218         UNSUPPORTED                             /* scanable adv */
    219     },
    220     {
    221         /* init */
    222         HCI_LE_STATES_CONN_ADV_INIT_BIT,        /* conn_adv: 32 */
    223         UNSUPPORTED,                            /* init */
    224         HCI_LE_STATES_INIT_MASTER_BIT,          /* master 28 */
    225         HCI_LE_STATES_INIT_MASTER_SLAVE_BIT,    /* slave 41 */
    226         HCI_LE_STATES_LO_DUTY_DIR_ADV_INIT_BIT, /* lo du dir adv 34 */
    227         HCI_LE_STATES_HI_DUTY_DIR_ADV_INIT_BIT, /* hi duty dir adv 33 */
    228         HCI_LE_STATES_NON_CONN_INIT_BIT,        /*  non connectable adv */
    229         HCI_LE_STATES_PASS_SCAN_INIT_BIT,       /* passive scan */
    230         HCI_LE_STATES_ACTIVE_SCAN_INIT_BIT,     /*  active scan */
    231         HCI_LE_STATES_SCAN_ADV_INIT_BIT         /* scanable adv */
    232 
    233     },
    234     {
    235         /* master */
    236         HCI_LE_STATES_CONN_ADV_MASTER_BIT,        /* conn_adv: 35 */
    237         HCI_LE_STATES_INIT_MASTER_BIT,            /* init 28 */
    238         HCI_LE_STATES_INIT_MASTER_BIT,            /* master 28 */
    239         HCI_LE_STATES_CONN_ADV_INIT_BIT,          /* slave: 32 */
    240         HCI_LE_STATES_LO_DUTY_DIR_ADV_MASTER_BIT, /* lo duty cycle adv 37 */
    241         HCI_LE_STATES_HI_DUTY_DIR_ADV_MASTER_BIT, /* hi duty cycle adv 36 */
    242         HCI_LE_STATES_NON_CONN_ADV_MASTER_BIT,    /*  non connectable adv*/
    243         HCI_LE_STATES_PASS_SCAN_MASTER_BIT,       /*  passive scan */
    244         HCI_LE_STATES_ACTIVE_SCAN_MASTER_BIT,     /*   active scan */
    245         HCI_LE_STATES_SCAN_ADV_MASTER_BIT         /*  scanable adv */
    246 
    247     },
    248     {
    249         /* slave */
    250         HCI_LE_STATES_CONN_ADV_SLAVE_BIT,        /* conn_adv: 38,*/
    251         HCI_LE_STATES_INIT_MASTER_SLAVE_BIT,     /* init 41 */
    252         HCI_LE_STATES_INIT_MASTER_SLAVE_BIT,     /* master 41 */
    253         HCI_LE_STATES_CONN_ADV_SLAVE_BIT,        /* slave: 38,*/
    254         HCI_LE_STATES_LO_DUTY_DIR_ADV_SLAVE_BIT, /* lo duty cycle adv 40 */
    255         HCI_LE_STATES_HI_DUTY_DIR_ADV_SLAVE_BIT, /* hi duty cycle adv 39 */
    256         HCI_LE_STATES_NON_CONN_ADV_SLAVE_BIT,    /* non connectable adv */
    257         HCI_LE_STATES_PASS_SCAN_SLAVE_BIT,       /* passive scan */
    258         HCI_LE_STATES_ACTIVE_SCAN_SLAVE_BIT,     /*  active scan */
    259         HCI_LE_STATES_SCAN_ADV_SLAVE_BIT         /* scanable adv */
    260 
    261     },
    262     {
    263         /* lo duty cycle adv */
    264         UNSUPPORTED,                              /* conn_adv: 38,*/
    265         HCI_LE_STATES_LO_DUTY_DIR_ADV_INIT_BIT,   /* init 34 */
    266         HCI_LE_STATES_LO_DUTY_DIR_ADV_MASTER_BIT, /* master 37 */
    267         HCI_LE_STATES_LO_DUTY_DIR_ADV_SLAVE_BIT,  /* slave: 40 */
    268         UNSUPPORTED,                              /* lo duty cycle adv 40 */
    269         UNSUPPORTED,                              /* hi duty cycle adv 39 */
    270         UNSUPPORTED,                              /*  non connectable adv */
    271         UNSUPPORTED, /* TODO: passive scan, not covered? */
    272         UNSUPPORTED, /* TODO:  active scan, not covered? */
    273         UNSUPPORTED  /*  scanable adv */
    274     },
    275     {
    276         /* hi duty cycle adv */
    277         UNSUPPORTED,                                 /* conn_adv: 38,*/
    278         HCI_LE_STATES_HI_DUTY_DIR_ADV_INIT_BIT,      /* init 33 */
    279         HCI_LE_STATES_HI_DUTY_DIR_ADV_MASTER_BIT,    /* master 36 */
    280         HCI_LE_STATES_HI_DUTY_DIR_ADV_SLAVE_BIT,     /* slave: 39*/
    281         UNSUPPORTED,                                 /* lo duty cycle adv 40 */
    282         UNSUPPORTED,                                 /* hi duty cycle adv 39 */
    283         UNSUPPORTED,                                 /* non connectable adv */
    284         HCI_LE_STATES_HI_DUTY_DIR_ADV_PASS_SCAN_BIT, /* passive scan */
    285         HCI_LE_STATES_HI_DUTY_DIR_ADV_ACTIVE_SCAN_BIT, /* active scan */
    286         UNSUPPORTED                                    /* scanable adv */
    287     },
    288     {
    289         /* non connectable adv */
    290         UNSUPPORTED,                                /* conn_adv: */
    291         HCI_LE_STATES_NON_CONN_INIT_BIT,            /* init  */
    292         HCI_LE_STATES_NON_CONN_ADV_MASTER_BIT,      /* master  */
    293         HCI_LE_STATES_NON_CONN_ADV_SLAVE_BIT,       /* slave: */
    294         UNSUPPORTED,                                /* lo duty cycle adv */
    295         UNSUPPORTED,                                /* hi duty cycle adv */
    296         UNSUPPORTED,                                /* non connectable adv */
    297         HCI_LE_STATES_NON_CONN_ADV_PASS_SCAN_BIT,   /* passive scan */
    298         HCI_LE_STATES_NON_CONN_ADV_ACTIVE_SCAN_BIT, /* active scan */
    299         UNSUPPORTED                                 /* scanable adv */
    300     },
    301     {
    302         /* passive scan */
    303         HCI_LE_STATES_CONN_ADV_PASS_SCAN_BIT,        /* conn_adv: */
    304         HCI_LE_STATES_PASS_SCAN_INIT_BIT,            /* init  */
    305         HCI_LE_STATES_PASS_SCAN_MASTER_BIT,          /* master  */
    306         HCI_LE_STATES_PASS_SCAN_SLAVE_BIT,           /* slave: */
    307         UNSUPPORTED,                                 /* lo duty cycle adv */
    308         HCI_LE_STATES_HI_DUTY_DIR_ADV_PASS_SCAN_BIT, /* hi duty cycle adv */
    309         HCI_LE_STATES_NON_CONN_ADV_PASS_SCAN_BIT,    /* non connectable adv */
    310         UNSUPPORTED,                                 /* passive scan */
    311         UNSUPPORTED,                                 /* active scan */
    312         HCI_LE_STATES_SCAN_ADV_PASS_SCAN_BIT         /* scanable adv */
    313     },
    314     {
    315         /* active scan */
    316         HCI_LE_STATES_CONN_ADV_ACTIVE_SCAN_BIT,        /* conn_adv: */
    317         HCI_LE_STATES_ACTIVE_SCAN_INIT_BIT,            /* init  */
    318         HCI_LE_STATES_ACTIVE_SCAN_MASTER_BIT,          /* master  */
    319         HCI_LE_STATES_ACTIVE_SCAN_SLAVE_BIT,           /* slave: */
    320         UNSUPPORTED,                                   /* lo duty cycle adv */
    321         HCI_LE_STATES_HI_DUTY_DIR_ADV_ACTIVE_SCAN_BIT, /* hi duty cycle adv */
    322         HCI_LE_STATES_NON_CONN_ADV_ACTIVE_SCAN_BIT, /*  non connectable adv */
    323         UNSUPPORTED,                                /* TODO: passive scan */
    324         UNSUPPORTED,                                /* TODO:  active scan */
    325         HCI_LE_STATES_SCAN_ADV_ACTIVE_SCAN_BIT      /*  scanable adv */
    326     },
    327     {
    328         /* scanable adv */
    329         UNSUPPORTED,                            /* conn_adv: */
    330         HCI_LE_STATES_SCAN_ADV_INIT_BIT,        /* init  */
    331         HCI_LE_STATES_SCAN_ADV_MASTER_BIT,      /* master  */
    332         HCI_LE_STATES_SCAN_ADV_SLAVE_BIT,       /* slave: */
    333         UNSUPPORTED,                            /* lo duty cycle adv */
    334         UNSUPPORTED,                            /* hi duty cycle adv */
    335         UNSUPPORTED,                            /* non connectable adv */
    336         HCI_LE_STATES_SCAN_ADV_PASS_SCAN_BIT,   /*  passive scan */
    337         HCI_LE_STATES_SCAN_ADV_ACTIVE_SCAN_BIT, /*  active scan */
    338         UNSUPPORTED                             /* scanable adv */
    339     }};
    340 
    341 /* check LE combo state supported */
    342 inline bool BTM_LE_STATES_SUPPORTED(const uint8_t* x, uint8_t bit_num) {
    343   uint8_t mask = 1 << (bit_num % 8);
    344   uint8_t offset = bit_num / 8;
    345   return ((x)[offset] & mask);
    346 }
    347 
    348 /*******************************************************************************
    349  *
    350  * Function         BTM_BleUpdateAdvFilterPolicy
    351  *
    352  * Description      This function update the filter policy of advertiser.
    353  *
    354  * Parameter        adv_policy: advertising filter policy
    355  *
    356  * Return           void
    357  ******************************************************************************/
    358 void BTM_BleUpdateAdvFilterPolicy(tBTM_BLE_AFP adv_policy) {
    359   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
    360   tBLE_ADDR_TYPE init_addr_type = BLE_ADDR_PUBLIC;
    361   RawAddress adv_address = RawAddress::kEmpty;
    362   uint8_t adv_mode = p_cb->adv_mode;
    363 
    364   BTM_TRACE_EVENT("BTM_BleUpdateAdvFilterPolicy");
    365 
    366   if (!controller_get_interface()->supports_ble()) return;
    367 
    368   if (p_cb->afp != adv_policy) {
    369     p_cb->afp = adv_policy;
    370 
    371     /* if adv active, stop and restart */
    372     btm_ble_stop_adv();
    373 
    374     if (p_cb->connectable_mode & BTM_BLE_CONNECTABLE)
    375       p_cb->evt_type = btm_set_conn_mode_adv_init_addr(
    376           p_cb, adv_address, &init_addr_type, &p_cb->adv_addr_type);
    377 
    378     btsnd_hcic_ble_write_adv_params(
    379         (uint16_t)(p_cb->adv_interval_min ? p_cb->adv_interval_min
    380                                           : BTM_BLE_GAP_ADV_SLOW_INT),
    381         (uint16_t)(p_cb->adv_interval_max ? p_cb->adv_interval_max
    382                                           : BTM_BLE_GAP_ADV_SLOW_INT),
    383         p_cb->evt_type, p_cb->adv_addr_type, init_addr_type, adv_address,
    384         p_cb->adv_chnl_map, p_cb->afp);
    385 
    386     if (adv_mode == BTM_BLE_ADV_ENABLE) btm_ble_start_adv();
    387   }
    388 }
    389 
    390 /*******************************************************************************
    391  *
    392  * Function         BTM_BleObserve
    393  *
    394  * Description      This procedure keep the device listening for advertising
    395  *                  events from a broadcast device.
    396  *
    397  * Parameters       start: start or stop observe.
    398  *                  white_list: use white list in observer mode or not.
    399  *
    400  * Returns          void
    401  *
    402  ******************************************************************************/
    403 tBTM_STATUS BTM_BleObserve(bool start, uint8_t duration,
    404                            tBTM_INQ_RESULTS_CB* p_results_cb,
    405                            tBTM_CMPL_CB* p_cmpl_cb) {
    406   tBTM_BLE_INQ_CB* p_inq = &btm_cb.ble_ctr_cb.inq_var;
    407   tBTM_STATUS status = BTM_WRONG_MODE;
    408 
    409   uint32_t scan_interval =
    410       !p_inq->scan_interval ? BTM_BLE_GAP_DISC_SCAN_INT : p_inq->scan_interval;
    411   uint32_t scan_window =
    412       !p_inq->scan_window ? BTM_BLE_GAP_DISC_SCAN_WIN : p_inq->scan_window;
    413 
    414   BTM_TRACE_EVENT("%s : scan_type:%d, %d, %d", __func__,
    415                   btm_cb.btm_inq_vars.scan_type, p_inq->scan_interval,
    416                   p_inq->scan_window);
    417 
    418   if (!controller_get_interface()->supports_ble()) return BTM_ILLEGAL_VALUE;
    419 
    420   if (start) {
    421     /* shared inquiry database, do not allow observe if any inquiry is active */
    422     if (BTM_BLE_IS_OBS_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) {
    423       BTM_TRACE_ERROR("%s Observe Already Active", __func__);
    424       return status;
    425     }
    426 
    427     btm_cb.ble_ctr_cb.p_obs_results_cb = p_results_cb;
    428     btm_cb.ble_ctr_cb.p_obs_cmpl_cb = p_cmpl_cb;
    429     status = BTM_CMD_STARTED;
    430 
    431     /* scan is not started */
    432     if (!BTM_BLE_IS_SCAN_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) {
    433       /* allow config of scan type */
    434       p_inq->scan_type = (p_inq->scan_type == BTM_BLE_SCAN_MODE_NONE)
    435                              ? BTM_BLE_SCAN_MODE_ACTI
    436                              : p_inq->scan_type;
    437 /* assume observe always not using white list */
    438 #if (defined BLE_PRIVACY_SPT && BLE_PRIVACY_SPT == true)
    439       /* enable resolving list */
    440       btm_ble_enable_resolving_list_for_platform(BTM_BLE_RL_SCAN);
    441 #endif
    442 
    443       btm_send_hci_set_scan_params(
    444           p_inq->scan_type, (uint16_t)scan_interval, (uint16_t)scan_window,
    445           btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type, BTM_BLE_DEFAULT_SFP);
    446 
    447       p_inq->scan_duplicate_filter = BTM_BLE_DUPLICATE_DISABLE;
    448       status = btm_ble_start_scan();
    449     }
    450 
    451     if (status == BTM_CMD_STARTED) {
    452       btm_cb.ble_ctr_cb.scan_activity |= BTM_LE_OBSERVE_ACTIVE;
    453       if (duration != 0) {
    454         /* start observer timer */
    455         period_ms_t duration_ms = duration * 1000;
    456         alarm_set_on_mloop(btm_cb.ble_ctr_cb.observer_timer, duration_ms,
    457                            btm_ble_observer_timer_timeout, NULL);
    458       }
    459     }
    460   } else if (BTM_BLE_IS_OBS_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) {
    461     status = BTM_CMD_STARTED;
    462     btm_ble_stop_observe();
    463   } else {
    464     BTM_TRACE_ERROR("%s Observe not active", __func__);
    465   }
    466 
    467   return status;
    468 }
    469 
    470 #if (BLE_VND_INCLUDED == TRUE)
    471 /*******************************************************************************
    472  *
    473  * Function         btm_vsc_brcm_features_complete
    474  *
    475  * Description      Command Complete callback for HCI_BLE_VENDOR_CAP_OCF
    476  *
    477  * Returns          void
    478  *
    479  ******************************************************************************/
    480 static void btm_ble_vendor_capability_vsc_cmpl_cback(
    481     tBTM_VSC_CMPL* p_vcs_cplt_params) {
    482   uint8_t status = 0xFF;
    483   uint8_t* p;
    484 
    485   BTM_TRACE_DEBUG("%s", __func__);
    486 
    487   /* Check status of command complete event */
    488   if ((p_vcs_cplt_params->opcode == HCI_BLE_VENDOR_CAP_OCF) &&
    489       (p_vcs_cplt_params->param_len > 0)) {
    490     p = p_vcs_cplt_params->p_param_buf;
    491     STREAM_TO_UINT8(status, p);
    492   }
    493 
    494   if (status == HCI_SUCCESS) {
    495     STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.adv_inst_max, p);
    496     STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.rpa_offloading, p);
    497     STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.tot_scan_results_strg, p);
    498     STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.max_irk_list_sz, p);
    499     STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.filter_support, p);
    500     STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.max_filter, p);
    501     STREAM_TO_UINT8(btm_cb.cmn_ble_vsc_cb.energy_support, p);
    502 
    503     if (p_vcs_cplt_params->param_len >
    504         BTM_VSC_CHIP_CAPABILITY_RSP_LEN_L_RELEASE) {
    505       STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.version_supported, p);
    506     } else {
    507       btm_cb.cmn_ble_vsc_cb.version_supported =
    508           BTM_VSC_CHIP_CAPABILITY_L_VERSION;
    509     }
    510 
    511     if (btm_cb.cmn_ble_vsc_cb.version_supported >=
    512         BTM_VSC_CHIP_CAPABILITY_M_VERSION) {
    513       STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.total_trackable_advertisers, p);
    514       STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.extended_scan_support, p);
    515       STREAM_TO_UINT16(btm_cb.cmn_ble_vsc_cb.debug_logging_supported, p);
    516     }
    517     btm_cb.cmn_ble_vsc_cb.values_read = true;
    518   }
    519 
    520   BTM_TRACE_DEBUG(
    521       "%s: stat=%d, irk=%d, ADV ins:%d, rpa=%d, ener=%d, ext_scan=%d", __func__,
    522       status, btm_cb.cmn_ble_vsc_cb.max_irk_list_sz,
    523       btm_cb.cmn_ble_vsc_cb.adv_inst_max, btm_cb.cmn_ble_vsc_cb.rpa_offloading,
    524       btm_cb.cmn_ble_vsc_cb.energy_support,
    525       btm_cb.cmn_ble_vsc_cb.extended_scan_support);
    526 
    527   btm_ble_adv_init();
    528 
    529   if (btm_cb.cmn_ble_vsc_cb.max_filter > 0) btm_ble_adv_filter_init();
    530 
    531 #if (BLE_PRIVACY_SPT == TRUE)
    532   /* VS capability included and non-4.2 device */
    533   if (btm_cb.cmn_ble_vsc_cb.max_irk_list_sz > 0 &&
    534       controller_get_interface()->get_ble_resolving_list_max_size() == 0)
    535     btm_ble_resolving_list_init(btm_cb.cmn_ble_vsc_cb.max_irk_list_sz);
    536 #endif /* (BLE_PRIVACY_SPT == TRUE) */
    537 
    538   if (btm_cb.cmn_ble_vsc_cb.tot_scan_results_strg > 0) btm_ble_batchscan_init();
    539 
    540   if (p_ctrl_le_feature_rd_cmpl_cback != NULL)
    541     p_ctrl_le_feature_rd_cmpl_cback(status);
    542 }
    543 #endif /* (BLE_VND_INCLUDED == TRUE) */
    544 
    545 /*******************************************************************************
    546  *
    547  * Function         BTM_BleGetVendorCapabilities
    548  *
    549  * Description      This function reads local LE features
    550  *
    551  * Parameters       p_cmn_vsc_cb : Locala LE capability structure
    552  *
    553  * Returns          void
    554  *
    555  ******************************************************************************/
    556 extern void BTM_BleGetVendorCapabilities(tBTM_BLE_VSC_CB* p_cmn_vsc_cb) {
    557   BTM_TRACE_DEBUG("BTM_BleGetVendorCapabilities");
    558 
    559   if (NULL != p_cmn_vsc_cb) {
    560     *p_cmn_vsc_cb = btm_cb.cmn_ble_vsc_cb;
    561   }
    562 }
    563 
    564 /******************************************************************************
    565  *
    566  * Function         BTM_BleReadControllerFeatures
    567  *
    568  * Description      Reads BLE specific controller features
    569  *
    570  * Parameters:      tBTM_BLE_CTRL_FEATURES_CBACK : Callback to notify when
    571  *                  features are read
    572  *
    573  * Returns          void
    574  *
    575  ******************************************************************************/
    576 #if (BLE_VND_INCLUDED == TRUE)
    577 extern void BTM_BleReadControllerFeatures(
    578     tBTM_BLE_CTRL_FEATURES_CBACK* p_vsc_cback) {
    579   if (true == btm_cb.cmn_ble_vsc_cb.values_read) return;
    580 
    581   BTM_TRACE_DEBUG("BTM_BleReadControllerFeatures");
    582 
    583   p_ctrl_le_feature_rd_cmpl_cback = p_vsc_cback;
    584   BTM_VendorSpecificCommand(HCI_BLE_VENDOR_CAP_OCF, 0, NULL,
    585                             btm_ble_vendor_capability_vsc_cmpl_cback);
    586 }
    587 #else
    588 extern void BTM_BleReadControllerFeatures(
    589     UNUSED_ATTR tBTM_BLE_CTRL_FEATURES_CBACK* p_vsc_cback) {}
    590 #endif
    591 
    592 /*******************************************************************************
    593  *
    594  * Function         BTM_BleEnableMixedPrivacyMode
    595  *
    596  * Description      This function is called to enabled Mixed mode if privacy 1.2
    597  *                  is applicable in controller.
    598  *
    599  * Parameters       mixed_on:  mixed mode to be used or not.
    600  *
    601  * Returns          void
    602  *
    603  ******************************************************************************/
    604 void BTM_BleEnableMixedPrivacyMode(bool mixed_on) {
    605 #if (BLE_PRIVACY_SPT == TRUE)
    606   btm_cb.ble_ctr_cb.mixed_mode = mixed_on;
    607 
    608 /* TODO: send VSC to enabled mixed mode */
    609 #endif
    610 }
    611 
    612 /*******************************************************************************
    613  *
    614  * Function         BTM_BleConfigPrivacy
    615  *
    616  * Description      This function is called to enable or disable the privacy in
    617  *                   LE channel of the local device.
    618  *
    619  * Parameters       privacy_mode:  privacy mode on or off.
    620  *
    621  * Returns          bool    privacy mode set success; otherwise failed.
    622  *
    623  ******************************************************************************/
    624 bool BTM_BleConfigPrivacy(bool privacy_mode) {
    625 #if (BLE_PRIVACY_SPT == TRUE)
    626   tBTM_BLE_CB* p_cb = &btm_cb.ble_ctr_cb;
    627 
    628   BTM_TRACE_EVENT("%s", __func__);
    629 
    630   /* if LE is not supported, return error */
    631   if (!controller_get_interface()->supports_ble()) return false;
    632 
    633   uint8_t addr_resolution = 0;
    634   if (!privacy_mode) /* if privacy disabled, always use public address */
    635   {
    636     p_cb->addr_mgnt_cb.own_addr_type = BLE_ADDR_PUBLIC;
    637     p_cb->privacy_mode = BTM_PRIVACY_NONE;
    638   } else /* privacy is turned on*/
    639   {
    640     /* always set host random address, used when privacy 1.1 or priavcy 1.2 is
    641      * disabled */
    642     p_cb->addr_mgnt_cb.own_addr_type = BLE_ADDR_RANDOM;
    643     btm_gen_resolvable_private_addr(base::Bind(&btm_gen_resolve_paddr_low));
    644 
    645     /* 4.2 controller only allow privacy 1.2 or mixed mode, resolvable private
    646      * address in controller */
    647     if (controller_get_interface()->supports_ble_privacy()) {
    648       addr_resolution = 1;
    649       /* check vendor specific capability */
    650       p_cb->privacy_mode =
    651           btm_cb.ble_ctr_cb.mixed_mode ? BTM_PRIVACY_MIXED : BTM_PRIVACY_1_2;
    652     } else /* 4.1/4.0 controller */
    653       p_cb->privacy_mode = BTM_PRIVACY_1_1;
    654   }
    655 
    656   GAP_BleAttrDBUpdate(GATT_UUID_GAP_CENTRAL_ADDR_RESOL,
    657                       (tGAP_BLE_ATTR_VALUE*)&addr_resolution);
    658 
    659   return true;
    660 #else
    661   return false;
    662 #endif
    663 }
    664 
    665 /*******************************************************************************
    666  *
    667  * Function          BTM_BleMaxMultiAdvInstanceCount
    668  *
    669  * Description        Returns max number of multi adv instances supported by
    670  *                  controller
    671  *
    672  * Returns          Max multi adv instance count
    673  *
    674  ******************************************************************************/
    675 extern uint8_t BTM_BleMaxMultiAdvInstanceCount(void) {
    676   return btm_cb.cmn_ble_vsc_cb.adv_inst_max < BTM_BLE_MULTI_ADV_MAX
    677              ? btm_cb.cmn_ble_vsc_cb.adv_inst_max
    678              : BTM_BLE_MULTI_ADV_MAX;
    679 }
    680 
    681 /*******************************************************************************
    682  *
    683  * Function         BTM_BleLocalPrivacyEnabled
    684  *
    685  * Description        Checks if local device supports private address
    686  *
    687  * Returns          Return true if local privacy is enabled else false
    688  *
    689  ******************************************************************************/
    690 bool BTM_BleLocalPrivacyEnabled(void) {
    691 #if (BLE_PRIVACY_SPT == TRUE)
    692   return (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE);
    693 #else
    694   return false;
    695 #endif
    696 }
    697 
    698 /**
    699  * Set BLE connectable mode to auto connect
    700  */
    701 void BTM_BleStartAutoConn() {
    702   BTM_TRACE_EVENT("%s", __func__);
    703   if (!controller_get_interface()->supports_ble()) return;
    704 
    705   if (btm_cb.ble_ctr_cb.bg_conn_type != BTM_BLE_CONN_AUTO) {
    706     btm_ble_start_auto_conn(true);
    707     btm_cb.ble_ctr_cb.bg_conn_type = BTM_BLE_CONN_AUTO;
    708   }
    709 }
    710 
    711 /*******************************************************************************
    712  *
    713  * Function         BTM_BleClearBgConnDev
    714  *
    715  * Description      This function is called to clear the whitelist,
    716  *                  end any pending whitelist connections,
    717  *                  and reset the local bg device list.
    718  *
    719  * Parameters       void
    720  *
    721  * Returns          void
    722  *
    723  ******************************************************************************/
    724 void BTM_BleClearBgConnDev(void) {
    725   btm_ble_start_auto_conn(false);
    726   btm_ble_clear_white_list();
    727   gatt_reset_bgdev_list();
    728 }
    729 
    730 /*******************************************************************************
    731  *
    732  * Function         BTM_BleUpdateBgConnDev
    733  *
    734  * Description      This function is called to add or remove a device into/from
    735  *                  background connection procedure. The background connection
    736  *                  procedure is decided by the background connection type, it
    737  *                  can be auto connection, or selective connection.
    738  *
    739  * Parameters       add_remove: true to add; false to remove.
    740  *                  remote_bda: device address to add/remove.
    741  *
    742  * Returns          void
    743  *
    744  ******************************************************************************/
    745 bool BTM_BleUpdateBgConnDev(bool add_remove, const RawAddress& remote_bda) {
    746   BTM_TRACE_EVENT("%s() add=%d", __func__, add_remove);
    747   return btm_update_dev_to_white_list(add_remove, remote_bda);
    748 }
    749 
    750 /*******************************************************************************
    751  *
    752  * Function         BTM_BleSetConnectableMode
    753  *
    754  * Description      This function is called to set BLE connectable mode for a
    755  *                  peripheral device.
    756  *
    757  * Parameters       conn_mode:  directed connectable mode, or non-directed. It
    758  *                              can be BTM_BLE_CONNECT_EVT,
    759  *                              BTM_BLE_CONNECT_DIR_EVT or
    760  *                              BTM_BLE_CONNECT_LO_DUTY_DIR_EVT
    761  *
    762  * Returns          BTM_ILLEGAL_VALUE if controller does not support BLE.
    763  *                  BTM_SUCCESS is status set successfully; otherwise failure.
    764  *
    765  ******************************************************************************/
    766 tBTM_STATUS BTM_BleSetConnectableMode(tBTM_BLE_CONN_MODE connectable_mode) {
    767   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
    768 
    769   BTM_TRACE_EVENT("%s connectable_mode = %d ", __func__, connectable_mode);
    770   if (!controller_get_interface()->supports_ble()) return BTM_ILLEGAL_VALUE;
    771 
    772   p_cb->directed_conn = connectable_mode;
    773   return btm_ble_set_connectability(p_cb->connectable_mode);
    774 }
    775 
    776 #if (BLE_PRIVACY_SPT == TRUE)
    777 static bool is_resolving_list_bit_set(void* data, void* context) {
    778   tBTM_SEC_DEV_REC* p_dev_rec = static_cast<tBTM_SEC_DEV_REC*>(data);
    779 
    780   if ((p_dev_rec->ble.in_controller_list & BTM_RESOLVING_LIST_BIT) != 0)
    781     return false;
    782 
    783   return true;
    784 }
    785 #endif
    786 
    787 /*******************************************************************************
    788  *
    789  * Function         btm_set_conn_mode_adv_init_addr
    790  *
    791  * Description      set initator address type and local address type based on
    792  *                  adv mode.
    793  *
    794  *
    795  ******************************************************************************/
    796 static uint8_t btm_set_conn_mode_adv_init_addr(
    797     tBTM_BLE_INQ_CB* p_cb, RawAddress& p_peer_addr_ptr,
    798     tBLE_ADDR_TYPE* p_peer_addr_type, tBLE_ADDR_TYPE* p_own_addr_type) {
    799   uint8_t evt_type;
    800 #if (BLE_PRIVACY_SPT == TRUE)
    801   tBTM_SEC_DEV_REC* p_dev_rec;
    802 #endif
    803 
    804   evt_type =
    805       (p_cb->connectable_mode == BTM_BLE_NON_CONNECTABLE)
    806           ? ((p_cb->scan_rsp) ? BTM_BLE_DISCOVER_EVT : BTM_BLE_NON_CONNECT_EVT)
    807           : BTM_BLE_CONNECT_EVT;
    808 
    809   if (evt_type == BTM_BLE_CONNECT_EVT) {
    810     evt_type = p_cb->directed_conn;
    811 
    812     if (p_cb->directed_conn == BTM_BLE_CONNECT_DIR_EVT ||
    813         p_cb->directed_conn == BTM_BLE_CONNECT_LO_DUTY_DIR_EVT) {
    814 #if (BLE_PRIVACY_SPT == TRUE)
    815       /* for privacy 1.2, convert peer address as static, own address set as ID
    816        * addr */
    817       if (btm_cb.ble_ctr_cb.privacy_mode == BTM_PRIVACY_1_2 ||
    818           btm_cb.ble_ctr_cb.privacy_mode == BTM_PRIVACY_MIXED) {
    819         /* only do so for bonded device */
    820         if ((p_dev_rec = btm_find_or_alloc_dev(p_cb->direct_bda.bda)) != NULL &&
    821             p_dev_rec->ble.in_controller_list & BTM_RESOLVING_LIST_BIT) {
    822           btm_ble_enable_resolving_list(BTM_BLE_RL_ADV);
    823           p_peer_addr_ptr = p_dev_rec->ble.static_addr;
    824           *p_peer_addr_type = p_dev_rec->ble.static_addr_type;
    825           *p_own_addr_type = BLE_ADDR_RANDOM_ID;
    826           return evt_type;
    827         }
    828         /* otherwise fall though as normal directed adv */
    829         else {
    830           btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, true);
    831         }
    832       }
    833 #endif
    834       /* direct adv mode does not have privacy, if privacy is not enabled  */
    835       *p_peer_addr_type = p_cb->direct_bda.type;
    836       p_peer_addr_ptr = p_cb->direct_bda.bda;
    837       return evt_type;
    838     }
    839   }
    840 
    841 /* undirect adv mode or non-connectable mode*/
    842 #if (BLE_PRIVACY_SPT == TRUE)
    843   /* when privacy 1.2 privacy only mode is used, or mixed mode */
    844   if ((btm_cb.ble_ctr_cb.privacy_mode == BTM_PRIVACY_1_2 &&
    845        p_cb->afp != AP_SCAN_CONN_ALL) ||
    846       btm_cb.ble_ctr_cb.privacy_mode == BTM_PRIVACY_MIXED) {
    847     list_node_t* n =
    848         list_foreach(btm_cb.sec_dev_rec, is_resolving_list_bit_set, NULL);
    849     if (n) {
    850       /* if enhanced privacy is required, set Identity address and matching IRK
    851        * peer */
    852       tBTM_SEC_DEV_REC* p_dev_rec =
    853           static_cast<tBTM_SEC_DEV_REC*>(list_node(n));
    854       p_peer_addr_ptr = p_dev_rec->ble.static_addr;
    855       *p_peer_addr_type = p_dev_rec->ble.static_addr_type;
    856 
    857       *p_own_addr_type = BLE_ADDR_RANDOM_ID;
    858     } else {
    859       /* resolving list is empty, not enabled */
    860       *p_own_addr_type = BLE_ADDR_RANDOM;
    861     }
    862   }
    863   /* privacy 1.1, or privacy 1.2, general discoverable/connectable mode, disable
    864      privacy in */
    865   /* controller fall back to host based privacy */
    866   else if (btm_cb.ble_ctr_cb.privacy_mode != BTM_PRIVACY_NONE) {
    867     *p_own_addr_type = BLE_ADDR_RANDOM;
    868   }
    869 #endif
    870 
    871   /* if no privacy,do not set any peer address,*/
    872   /* local address type go by global privacy setting */
    873   return evt_type;
    874 }
    875 
    876 /*******************************************************************************
    877  *
    878  * Function         BTM_BleSetAdvParams
    879  *
    880  * Description      This function is called to set advertising parameters.
    881  *
    882  * Parameters       adv_int_min: minimum advertising interval
    883  *                  adv_int_max: maximum advertising interval
    884  *                  p_dir_bda: connectable direct initiator's LE device address
    885  *                  chnl_map: advertising channel map.
    886  *
    887  * Returns          void
    888  *
    889  ******************************************************************************/
    890 tBTM_STATUS BTM_BleSetAdvParams(uint16_t adv_int_min, uint16_t adv_int_max,
    891                                 const RawAddress& p_dir_bda,
    892                                 tBTM_BLE_ADV_CHNL_MAP chnl_map) {
    893   tBTM_LE_RANDOM_CB* p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
    894   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
    895   tBTM_STATUS status = BTM_SUCCESS;
    896   RawAddress address = RawAddress::kEmpty;
    897   tBLE_ADDR_TYPE init_addr_type = BLE_ADDR_PUBLIC;
    898   tBLE_ADDR_TYPE own_addr_type = p_addr_cb->own_addr_type;
    899   uint8_t adv_mode = p_cb->adv_mode;
    900 
    901   BTM_TRACE_EVENT("BTM_BleSetAdvParams");
    902 
    903   if (!controller_get_interface()->supports_ble()) return BTM_ILLEGAL_VALUE;
    904 
    905   if (!BTM_BLE_ISVALID_PARAM(adv_int_min, BTM_BLE_ADV_INT_MIN,
    906                              BTM_BLE_ADV_INT_MAX) ||
    907       !BTM_BLE_ISVALID_PARAM(adv_int_max, BTM_BLE_ADV_INT_MIN,
    908                              BTM_BLE_ADV_INT_MAX)) {
    909     return BTM_ILLEGAL_VALUE;
    910   }
    911 
    912   p_cb->adv_interval_min = adv_int_min;
    913   p_cb->adv_interval_max = adv_int_max;
    914   p_cb->adv_chnl_map = chnl_map;
    915   p_cb->direct_bda.bda = p_dir_bda;
    916 
    917   BTM_TRACE_EVENT("update params for an active adv");
    918 
    919   btm_ble_stop_adv();
    920 
    921   p_cb->evt_type = btm_set_conn_mode_adv_init_addr(
    922       p_cb, address, &init_addr_type, &own_addr_type);
    923 
    924   /* update adv params */
    925   btsnd_hcic_ble_write_adv_params(
    926       p_cb->adv_interval_min, p_cb->adv_interval_max, p_cb->evt_type,
    927       own_addr_type, init_addr_type, address, p_cb->adv_chnl_map, p_cb->afp);
    928 
    929   if (adv_mode == BTM_BLE_ADV_ENABLE) btm_ble_start_adv();
    930 
    931   return status;
    932 }
    933 
    934 /**
    935  * This function is called to set scan parameters. |cb| is called with operation
    936  * status
    937  **/
    938 void BTM_BleSetScanParams(uint32_t scan_interval, uint32_t scan_window,
    939                           tBLE_SCAN_MODE scan_mode,
    940                           base::Callback<void(uint8_t)> cb) {
    941   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
    942   uint32_t max_scan_interval;
    943   uint32_t max_scan_window;
    944 
    945   BTM_TRACE_EVENT("%s", __func__);
    946   if (!controller_get_interface()->supports_ble()) return;
    947 
    948   /* If not supporting extended scan support, use the older range for checking
    949    */
    950   if (btm_cb.cmn_ble_vsc_cb.extended_scan_support == 0) {
    951     max_scan_interval = BTM_BLE_SCAN_INT_MAX;
    952     max_scan_window = BTM_BLE_SCAN_WIN_MAX;
    953   } else {
    954     /* If supporting extended scan support, use the new extended range for
    955      * checking */
    956     max_scan_interval = BTM_BLE_EXT_SCAN_INT_MAX;
    957     max_scan_window = BTM_BLE_EXT_SCAN_WIN_MAX;
    958   }
    959 
    960   if (BTM_BLE_ISVALID_PARAM(scan_interval, BTM_BLE_SCAN_INT_MIN,
    961                             max_scan_interval) &&
    962       BTM_BLE_ISVALID_PARAM(scan_window, BTM_BLE_SCAN_WIN_MIN,
    963                             max_scan_window) &&
    964       (scan_mode == BTM_BLE_SCAN_MODE_ACTI ||
    965        scan_mode == BTM_BLE_SCAN_MODE_PASS)) {
    966     p_cb->scan_type = scan_mode;
    967     p_cb->scan_interval = scan_interval;
    968     p_cb->scan_window = scan_window;
    969 
    970     cb.Run(BTM_SUCCESS);
    971   } else {
    972     cb.Run(BTM_ILLEGAL_VALUE);
    973 
    974     BTM_TRACE_ERROR("Illegal params: scan_interval = %d scan_window = %d",
    975                     scan_interval, scan_window);
    976   }
    977 }
    978 
    979 /*******************************************************************************
    980  *
    981  * Function         BTM_BleWriteScanRsp
    982  *
    983  * Description      This function is called to write LE scan response.
    984  *
    985  * Parameters:      p_scan_rsp: scan response information.
    986  *
    987  * Returns          void
    988  *
    989  ******************************************************************************/
    990 void BTM_BleWriteScanRsp(uint8_t* data, uint8_t length,
    991                          tBTM_BLE_ADV_DATA_CMPL_CBACK* p_adv_data_cback) {
    992   BTM_TRACE_EVENT("%s: length: %d", __func__, length);
    993   if (!controller_get_interface()->supports_ble()) {
    994     p_adv_data_cback(BTM_ILLEGAL_VALUE);
    995     return;
    996   }
    997 
    998   btsnd_hcic_ble_set_scan_rsp_data(length, data);
    999 
   1000   if (length != 0)
   1001     btm_cb.ble_ctr_cb.inq_var.scan_rsp = true;
   1002   else
   1003     btm_cb.ble_ctr_cb.inq_var.scan_rsp = false;
   1004 
   1005   p_adv_data_cback(BTM_SUCCESS);
   1006 }
   1007 
   1008 /*******************************************************************************
   1009  *
   1010  * Function         BTM__BLEReadDiscoverability
   1011  *
   1012  * Description      This function is called to read the current LE
   1013  *                  discoverability mode of the device.
   1014  *
   1015  * Returns          BTM_BLE_NON_DISCOVERABLE ,BTM_BLE_LIMITED_DISCOVERABLE or
   1016  *                     BTM_BLE_GENRAL_DISCOVERABLE
   1017  *
   1018  ******************************************************************************/
   1019 uint16_t BTM_BleReadDiscoverability() {
   1020   BTM_TRACE_API("%s", __func__);
   1021 
   1022   return (btm_cb.ble_ctr_cb.inq_var.discoverable_mode);
   1023 }
   1024 
   1025 /*******************************************************************************
   1026  *
   1027  * Function         BTM__BLEReadConnectability
   1028  *
   1029  * Description      This function is called to read the current LE
   1030  *                  connectability mode of the device.
   1031  *
   1032  * Returns          BTM_BLE_NON_CONNECTABLE or BTM_BLE_CONNECTABLE
   1033  *
   1034  ******************************************************************************/
   1035 uint16_t BTM_BleReadConnectability() {
   1036   BTM_TRACE_API("%s", __func__);
   1037 
   1038   return (btm_cb.ble_ctr_cb.inq_var.connectable_mode);
   1039 }
   1040 
   1041 /*******************************************************************************
   1042  *
   1043  * Function         btm_ble_select_adv_interval
   1044  *
   1045  * Description      select adv interval based on device mode
   1046  *
   1047  * Returns          void
   1048  *
   1049  ******************************************************************************/
   1050 void btm_ble_select_adv_interval(tBTM_BLE_INQ_CB* p_cb, uint8_t evt_type,
   1051                                  uint16_t* p_adv_int_min,
   1052                                  uint16_t* p_adv_int_max) {
   1053   if (p_cb->adv_interval_min && p_cb->adv_interval_max) {
   1054     *p_adv_int_min = p_cb->adv_interval_min;
   1055     *p_adv_int_max = p_cb->adv_interval_max;
   1056   } else {
   1057     switch (evt_type) {
   1058       case BTM_BLE_CONNECT_EVT:
   1059       case BTM_BLE_CONNECT_LO_DUTY_DIR_EVT:
   1060         *p_adv_int_min = *p_adv_int_max = BTM_BLE_GAP_ADV_FAST_INT_1;
   1061         break;
   1062 
   1063       case BTM_BLE_NON_CONNECT_EVT:
   1064       case BTM_BLE_DISCOVER_EVT:
   1065         *p_adv_int_min = *p_adv_int_max = BTM_BLE_GAP_ADV_FAST_INT_2;
   1066         break;
   1067 
   1068       /* connectable directed event */
   1069       case BTM_BLE_CONNECT_DIR_EVT:
   1070         *p_adv_int_min = BTM_BLE_GAP_ADV_DIR_MIN_INT;
   1071         *p_adv_int_max = BTM_BLE_GAP_ADV_DIR_MAX_INT;
   1072         break;
   1073 
   1074       default:
   1075         *p_adv_int_min = *p_adv_int_max = BTM_BLE_GAP_ADV_SLOW_INT;
   1076         break;
   1077     }
   1078   }
   1079   return;
   1080 }
   1081 
   1082 /*******************************************************************************
   1083  *
   1084  * Function         btm_ble_update_dmt_flag_bits
   1085  *
   1086  * Description      Obtain updated adv flag value based on connect and
   1087  *                  discoverability mode. Also, setup DMT support value in the
   1088  *                  flag based on whether the controller supports both LE and
   1089  *                  BR/EDR.
   1090  *
   1091  * Parameters:      flag_value (Input / Output) - flag value
   1092  *                  connect_mode (Input) - Connect mode value
   1093  *                  disc_mode (Input) - discoverability mode
   1094  *
   1095  * Returns          void
   1096  *
   1097  ******************************************************************************/
   1098 void btm_ble_update_dmt_flag_bits(uint8_t* adv_flag_value,
   1099                                   const uint16_t connect_mode,
   1100                                   const uint16_t disc_mode) {
   1101   /* BR/EDR non-discoverable , non-connectable */
   1102   if ((disc_mode & BTM_DISCOVERABLE_MASK) == 0 &&
   1103       (connect_mode & BTM_CONNECTABLE_MASK) == 0)
   1104     *adv_flag_value |= BTM_BLE_BREDR_NOT_SPT;
   1105   else
   1106     *adv_flag_value &= ~BTM_BLE_BREDR_NOT_SPT;
   1107 
   1108   /* if local controller support, mark both controller and host support in flag
   1109    */
   1110   if (controller_get_interface()->supports_simultaneous_le_bredr())
   1111     *adv_flag_value |= (BTM_BLE_DMT_CONTROLLER_SPT | BTM_BLE_DMT_HOST_SPT);
   1112   else
   1113     *adv_flag_value &= ~(BTM_BLE_DMT_CONTROLLER_SPT | BTM_BLE_DMT_HOST_SPT);
   1114 }
   1115 
   1116 /*******************************************************************************
   1117  *
   1118  * Function         btm_ble_set_adv_flag
   1119  *
   1120  * Description      Set adv flag in adv data.
   1121  *
   1122  * Parameters:      connect_mode (Input)- Connect mode value
   1123  *                  disc_mode (Input) - discoverability mode
   1124  *
   1125  * Returns          void
   1126  *
   1127  ******************************************************************************/
   1128 void btm_ble_set_adv_flag(uint16_t connect_mode, uint16_t disc_mode) {
   1129   uint8_t flag = 0, old_flag = 0;
   1130   tBTM_BLE_LOCAL_ADV_DATA* p_adv_data = &btm_cb.ble_ctr_cb.inq_var.adv_data;
   1131 
   1132   if (p_adv_data->p_flags != NULL) flag = old_flag = *(p_adv_data->p_flags);
   1133 
   1134   btm_ble_update_dmt_flag_bits(&flag, connect_mode, disc_mode);
   1135 
   1136   LOG_DEBUG(LOG_TAG, "disc_mode %04x", disc_mode);
   1137   /* update discoverable flag */
   1138   if (disc_mode & BTM_BLE_LIMITED_DISCOVERABLE) {
   1139     flag &= ~BTM_BLE_GEN_DISC_FLAG;
   1140     flag |= BTM_BLE_LIMIT_DISC_FLAG;
   1141   } else if (disc_mode & BTM_BLE_GENERAL_DISCOVERABLE) {
   1142     flag |= BTM_BLE_GEN_DISC_FLAG;
   1143     flag &= ~BTM_BLE_LIMIT_DISC_FLAG;
   1144   } else /* remove all discoverable flags */
   1145   {
   1146     flag &= ~(BTM_BLE_LIMIT_DISC_FLAG | BTM_BLE_GEN_DISC_FLAG);
   1147   }
   1148 
   1149   if (flag != old_flag) {
   1150     btm_ble_update_adv_flag(flag);
   1151   }
   1152 }
   1153 /*******************************************************************************
   1154  *
   1155  * Function         btm_ble_set_discoverability
   1156  *
   1157  * Description      This function is called to set BLE discoverable mode.
   1158  *
   1159  * Parameters:      combined_mode: discoverability mode.
   1160  *
   1161  * Returns          BTM_SUCCESS is status set successfully; otherwise failure.
   1162  *
   1163  ******************************************************************************/
   1164 tBTM_STATUS btm_ble_set_discoverability(uint16_t combined_mode) {
   1165   tBTM_LE_RANDOM_CB* p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
   1166   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
   1167   uint16_t mode = (combined_mode & BTM_BLE_DISCOVERABLE_MASK);
   1168   uint8_t new_mode = BTM_BLE_ADV_ENABLE;
   1169   uint8_t evt_type;
   1170   tBTM_STATUS status = BTM_SUCCESS;
   1171   RawAddress address = RawAddress::kEmpty;
   1172   tBLE_ADDR_TYPE init_addr_type = BLE_ADDR_PUBLIC,
   1173                  own_addr_type = p_addr_cb->own_addr_type;
   1174   uint16_t adv_int_min, adv_int_max;
   1175 
   1176   BTM_TRACE_EVENT("%s mode=0x%0x combined_mode=0x%x", __func__, mode,
   1177                   combined_mode);
   1178 
   1179   /*** Check mode parameter ***/
   1180   if (mode > BTM_BLE_MAX_DISCOVERABLE) return (BTM_ILLEGAL_VALUE);
   1181 
   1182   p_cb->discoverable_mode = mode;
   1183 
   1184   evt_type = btm_set_conn_mode_adv_init_addr(p_cb, address, &init_addr_type,
   1185                                              &own_addr_type);
   1186 
   1187   if (p_cb->connectable_mode == BTM_BLE_NON_CONNECTABLE &&
   1188       mode == BTM_BLE_NON_DISCOVERABLE)
   1189     new_mode = BTM_BLE_ADV_DISABLE;
   1190 
   1191   btm_ble_select_adv_interval(p_cb, evt_type, &adv_int_min, &adv_int_max);
   1192 
   1193   alarm_cancel(p_cb->fast_adv_timer);
   1194 
   1195   /* update adv params if start advertising */
   1196   BTM_TRACE_EVENT("evt_type=0x%x p-cb->evt_type=0x%x ", evt_type,
   1197                   p_cb->evt_type);
   1198 
   1199   if (new_mode == BTM_BLE_ADV_ENABLE) {
   1200     btm_ble_set_adv_flag(btm_cb.btm_inq_vars.connectable_mode, combined_mode);
   1201 
   1202     if (evt_type != p_cb->evt_type || p_cb->adv_addr_type != own_addr_type ||
   1203         !p_cb->fast_adv_on) {
   1204       btm_ble_stop_adv();
   1205 
   1206       /* update adv params */
   1207       btsnd_hcic_ble_write_adv_params(adv_int_min, adv_int_max, evt_type,
   1208                                       own_addr_type, init_addr_type, address,
   1209                                       p_cb->adv_chnl_map, p_cb->afp);
   1210       p_cb->evt_type = evt_type;
   1211       p_cb->adv_addr_type = own_addr_type;
   1212     }
   1213   }
   1214 
   1215   if (status == BTM_SUCCESS && p_cb->adv_mode != new_mode) {
   1216     if (new_mode == BTM_BLE_ADV_ENABLE)
   1217       status = btm_ble_start_adv();
   1218     else
   1219       status = btm_ble_stop_adv();
   1220   }
   1221 
   1222   if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
   1223     p_cb->fast_adv_on = true;
   1224     /* start initial GAP mode adv timer */
   1225     alarm_set_on_mloop(p_cb->fast_adv_timer, BTM_BLE_GAP_FAST_ADV_TIMEOUT_MS,
   1226                        btm_ble_fast_adv_timer_timeout, NULL);
   1227   } else {
   1228 #if (BLE_PRIVACY_SPT == TRUE)
   1229     btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, true);
   1230 #endif
   1231   }
   1232 
   1233   /* set up stop advertising timer */
   1234   if (status == BTM_SUCCESS && mode == BTM_BLE_LIMITED_DISCOVERABLE) {
   1235     BTM_TRACE_EVENT("start timer for limited disc mode duration=%d ms",
   1236                     BTM_BLE_GAP_LIM_TIMEOUT_MS);
   1237     /* start Tgap(lim_timeout) */
   1238     alarm_set_on_mloop(p_cb->inquiry_timer, BTM_BLE_GAP_LIM_TIMEOUT_MS,
   1239                        btm_ble_inquiry_timer_gap_limited_discovery_timeout,
   1240                        NULL);
   1241   }
   1242   return status;
   1243 }
   1244 
   1245 /*******************************************************************************
   1246  *
   1247  * Function         btm_ble_set_connectability
   1248  *
   1249  * Description      This function is called to set BLE connectability mode.
   1250  *
   1251  * Parameters:      combined_mode: connectability mode.
   1252  *
   1253  * Returns          BTM_SUCCESS is status set successfully; otherwise failure.
   1254  *
   1255  ******************************************************************************/
   1256 tBTM_STATUS btm_ble_set_connectability(uint16_t combined_mode) {
   1257   tBTM_LE_RANDOM_CB* p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
   1258   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
   1259   uint16_t mode = (combined_mode & BTM_BLE_CONNECTABLE_MASK);
   1260   uint8_t new_mode = BTM_BLE_ADV_ENABLE;
   1261   uint8_t evt_type;
   1262   tBTM_STATUS status = BTM_SUCCESS;
   1263   RawAddress address = RawAddress::kEmpty;
   1264   tBLE_ADDR_TYPE peer_addr_type = BLE_ADDR_PUBLIC,
   1265                  own_addr_type = p_addr_cb->own_addr_type;
   1266   uint16_t adv_int_min, adv_int_max;
   1267 
   1268   BTM_TRACE_EVENT("%s mode=0x%0x combined_mode=0x%x", __func__, mode,
   1269                   combined_mode);
   1270 
   1271   /*** Check mode parameter ***/
   1272   if (mode > BTM_BLE_MAX_CONNECTABLE) return (BTM_ILLEGAL_VALUE);
   1273 
   1274   p_cb->connectable_mode = mode;
   1275 
   1276   evt_type = btm_set_conn_mode_adv_init_addr(p_cb, address, &peer_addr_type,
   1277                                              &own_addr_type);
   1278 
   1279   if (mode == BTM_BLE_NON_CONNECTABLE &&
   1280       p_cb->discoverable_mode == BTM_BLE_NON_DISCOVERABLE)
   1281     new_mode = BTM_BLE_ADV_DISABLE;
   1282 
   1283   btm_ble_select_adv_interval(p_cb, evt_type, &adv_int_min, &adv_int_max);
   1284 
   1285   alarm_cancel(p_cb->fast_adv_timer);
   1286   /* update adv params if needed */
   1287   if (new_mode == BTM_BLE_ADV_ENABLE) {
   1288     btm_ble_set_adv_flag(combined_mode, btm_cb.btm_inq_vars.discoverable_mode);
   1289     if (p_cb->evt_type != evt_type ||
   1290         p_cb->adv_addr_type != p_addr_cb->own_addr_type || !p_cb->fast_adv_on) {
   1291       btm_ble_stop_adv();
   1292 
   1293       btsnd_hcic_ble_write_adv_params(adv_int_min, adv_int_max, evt_type,
   1294                                       own_addr_type, peer_addr_type, address,
   1295                                       p_cb->adv_chnl_map, p_cb->afp);
   1296       p_cb->evt_type = evt_type;
   1297       p_cb->adv_addr_type = own_addr_type;
   1298     }
   1299   }
   1300 
   1301   /* update advertising mode */
   1302   if (status == BTM_SUCCESS && new_mode != p_cb->adv_mode) {
   1303     if (new_mode == BTM_BLE_ADV_ENABLE)
   1304       status = btm_ble_start_adv();
   1305     else
   1306       status = btm_ble_stop_adv();
   1307   }
   1308 
   1309   if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
   1310     p_cb->fast_adv_on = true;
   1311     /* start initial GAP mode adv timer */
   1312     alarm_set_on_mloop(p_cb->fast_adv_timer, BTM_BLE_GAP_FAST_ADV_TIMEOUT_MS,
   1313                        btm_ble_fast_adv_timer_timeout, NULL);
   1314   } else {
   1315 #if (BLE_PRIVACY_SPT == TRUE)
   1316     btm_ble_disable_resolving_list(BTM_BLE_RL_ADV, true);
   1317 #endif
   1318   }
   1319   return status;
   1320 }
   1321 
   1322 void btm_send_hci_scan_enable(uint8_t enable, uint8_t filter_duplicates) {
   1323   if (controller_get_interface()->supports_ble_extended_advertising()) {
   1324     btsnd_hcic_ble_set_extended_scan_enable(enable, filter_duplicates, 0x0000,
   1325                                             0x0000);
   1326   } else {
   1327     btsnd_hcic_ble_set_scan_enable(enable, filter_duplicates);
   1328   }
   1329 }
   1330 
   1331 void btm_send_hci_set_scan_params(uint8_t scan_type, uint16_t scan_int,
   1332                                   uint16_t scan_win, uint8_t addr_type_own,
   1333                                   uint8_t scan_filter_policy) {
   1334   if (controller_get_interface()->supports_ble_extended_advertising()) {
   1335     scanning_phy_cfg phy_cfg;
   1336     phy_cfg.scan_type = scan_type;
   1337     phy_cfg.scan_int = scan_int;
   1338     phy_cfg.scan_win = scan_win;
   1339 
   1340     btsnd_hcic_ble_set_extended_scan_params(addr_type_own, scan_filter_policy,
   1341                                             1, &phy_cfg);
   1342   } else {
   1343     btsnd_hcic_ble_set_scan_params(scan_type, scan_int, scan_win, addr_type_own,
   1344                                    scan_filter_policy);
   1345   }
   1346 }
   1347 
   1348 /*******************************************************************************
   1349  *
   1350  * Function         btm_ble_start_inquiry
   1351  *
   1352  * Description      This function is called to start BLE inquiry procedure.
   1353  *                  If the duration is zero, the periodic inquiry mode is
   1354  *                  cancelled.
   1355  *
   1356  * Parameters:      mode - GENERAL or LIMITED inquiry
   1357  *                  p_inq_params - pointer to the BLE inquiry parameter.
   1358  *                  p_results_cb - callback returning pointer to results
   1359  *                                 (tBTM_INQ_RESULTS)
   1360  *                  p_cmpl_cb - callback indicating the end of an inquiry
   1361  *
   1362  *
   1363  *
   1364  * Returns          BTM_CMD_STARTED if successfully started
   1365  *                  BTM_NO_RESOURCES if could not allocate a message buffer
   1366  *                  BTM_BUSY - if an inquiry is already active
   1367  *
   1368  ******************************************************************************/
   1369 tBTM_STATUS btm_ble_start_inquiry(uint8_t mode, uint8_t duration) {
   1370   tBTM_STATUS status = BTM_CMD_STARTED;
   1371   tBTM_BLE_CB* p_ble_cb = &btm_cb.ble_ctr_cb;
   1372   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   1373 
   1374   BTM_TRACE_DEBUG("btm_ble_start_inquiry: mode = %02x inq_active = 0x%02x",
   1375                   mode, btm_cb.btm_inq_vars.inq_active);
   1376 
   1377   /* if selective connection is active, or inquiry is already active, reject it
   1378    */
   1379   if (BTM_BLE_IS_INQ_ACTIVE(p_ble_cb->scan_activity)) {
   1380     BTM_TRACE_ERROR("LE Inquiry is active, can not start inquiry");
   1381     return (BTM_BUSY);
   1382   }
   1383 
   1384   if (!BTM_BLE_IS_SCAN_ACTIVE(p_ble_cb->scan_activity)) {
   1385     btm_send_hci_set_scan_params(
   1386         BTM_BLE_SCAN_MODE_ACTI, BTM_BLE_LOW_LATENCY_SCAN_INT,
   1387         BTM_BLE_LOW_LATENCY_SCAN_WIN,
   1388         btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type, SP_ADV_ALL);
   1389 #if (BLE_PRIVACY_SPT == TRUE)
   1390     /* enable IRK list */
   1391     btm_ble_enable_resolving_list_for_platform(BTM_BLE_RL_SCAN);
   1392 #endif
   1393     p_ble_cb->inq_var.scan_duplicate_filter = BTM_BLE_DUPLICATE_DISABLE;
   1394     status = btm_ble_start_scan();
   1395   } else if ((p_ble_cb->inq_var.scan_interval !=
   1396               BTM_BLE_LOW_LATENCY_SCAN_INT) ||
   1397              (p_ble_cb->inq_var.scan_window != BTM_BLE_LOW_LATENCY_SCAN_WIN)) {
   1398     BTM_TRACE_DEBUG("%s, restart LE scan with low latency scan params",
   1399                     __func__);
   1400     btm_send_hci_scan_enable(BTM_BLE_SCAN_DISABLE, BTM_BLE_DUPLICATE_ENABLE);
   1401     btm_send_hci_set_scan_params(
   1402         BTM_BLE_SCAN_MODE_ACTI, BTM_BLE_LOW_LATENCY_SCAN_INT,
   1403         BTM_BLE_LOW_LATENCY_SCAN_WIN,
   1404         btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type, SP_ADV_ALL);
   1405     btm_send_hci_scan_enable(BTM_BLE_SCAN_ENABLE, BTM_BLE_DUPLICATE_DISABLE);
   1406   }
   1407 
   1408   if (status == BTM_CMD_STARTED) {
   1409     p_inq->inq_active |= mode;
   1410     p_ble_cb->scan_activity |= mode;
   1411 
   1412     BTM_TRACE_DEBUG("btm_ble_start_inquiry inq_active = 0x%02x",
   1413                     p_inq->inq_active);
   1414 
   1415     if (duration != 0) {
   1416       /* start inquiry timer */
   1417       period_ms_t duration_ms = duration * 1000;
   1418       alarm_set_on_mloop(p_ble_cb->inq_var.inquiry_timer, duration_ms,
   1419                          btm_ble_inquiry_timer_timeout, NULL);
   1420     }
   1421   }
   1422 
   1423   return status;
   1424 }
   1425 
   1426 /*******************************************************************************
   1427  *
   1428  * Function         btm_ble_read_remote_name_cmpl
   1429  *
   1430  * Description      This function is called when BLE remote name is received.
   1431  *
   1432  * Returns          void
   1433  *
   1434  ******************************************************************************/
   1435 void btm_ble_read_remote_name_cmpl(bool status, const RawAddress& bda,
   1436                                    uint16_t length, char* p_name) {
   1437   uint8_t hci_status = HCI_SUCCESS;
   1438   BD_NAME bd_name;
   1439 
   1440   memset(bd_name, 0, (BD_NAME_LEN + 1));
   1441   if (length > BD_NAME_LEN) {
   1442     length = BD_NAME_LEN;
   1443   }
   1444   memcpy((uint8_t*)bd_name, p_name, length);
   1445 
   1446   if ((!status) || (length == 0)) {
   1447     hci_status = HCI_ERR_HOST_TIMEOUT;
   1448   }
   1449 
   1450   btm_process_remote_name(&bda, bd_name, length + 1, hci_status);
   1451   btm_sec_rmt_name_request_complete(&bda, (uint8_t*)p_name, hci_status);
   1452 }
   1453 
   1454 /*******************************************************************************
   1455  *
   1456  * Function         btm_ble_read_remote_name
   1457  *
   1458  * Description      This function read remote LE device name using GATT read
   1459  *                  procedure.
   1460  *
   1461  * Parameters:       None.
   1462  *
   1463  * Returns          void
   1464  *
   1465  ******************************************************************************/
   1466 tBTM_STATUS btm_ble_read_remote_name(const RawAddress& remote_bda,
   1467                                      tBTM_CMPL_CB* p_cb) {
   1468   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   1469 
   1470   if (!controller_get_interface()->supports_ble()) return BTM_ERR_PROCESSING;
   1471 
   1472   tINQ_DB_ENT* p_i = btm_inq_db_find(remote_bda);
   1473   if (p_i && !ble_evt_type_is_connectable(p_i->inq_info.results.ble_evt_type)) {
   1474     BTM_TRACE_DEBUG("name request to non-connectable device failed.");
   1475     return BTM_ERR_PROCESSING;
   1476   }
   1477 
   1478   /* read remote device name using GATT procedure */
   1479   if (p_inq->remname_active) return BTM_BUSY;
   1480 
   1481   if (!GAP_BleReadPeerDevName(remote_bda, btm_ble_read_remote_name_cmpl))
   1482     return BTM_BUSY;
   1483 
   1484   p_inq->p_remname_cmpl_cb = p_cb;
   1485   p_inq->remname_active = true;
   1486   p_inq->remname_bda = remote_bda;
   1487 
   1488   alarm_set_on_mloop(p_inq->remote_name_timer, BTM_EXT_BLE_RMT_NAME_TIMEOUT_MS,
   1489                      btm_inq_remote_name_timer_timeout, NULL);
   1490 
   1491   return BTM_CMD_STARTED;
   1492 }
   1493 
   1494 /*******************************************************************************
   1495  *
   1496  * Function         btm_ble_cancel_remote_name
   1497  *
   1498  * Description      This function cancel read remote LE device name.
   1499  *
   1500  * Parameters:       None.
   1501  *
   1502  * Returns          void
   1503  *
   1504  ******************************************************************************/
   1505 bool btm_ble_cancel_remote_name(const RawAddress& remote_bda) {
   1506   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   1507   bool status;
   1508 
   1509   status = GAP_BleCancelReadPeerDevName(remote_bda);
   1510 
   1511   p_inq->remname_active = false;
   1512   p_inq->remname_bda = RawAddress::kEmpty;
   1513   alarm_cancel(p_inq->remote_name_timer);
   1514 
   1515   return status;
   1516 }
   1517 
   1518 /*******************************************************************************
   1519  *
   1520  * Function         btm_ble_update_adv_flag
   1521  *
   1522  * Description      This function update the limited discoverable flag in the
   1523  *                  adv data.
   1524  *
   1525  * Parameters:       None.
   1526  *
   1527  * Returns          void
   1528  *
   1529  ******************************************************************************/
   1530 static void btm_ble_update_adv_flag(uint8_t flag) {
   1531   tBTM_BLE_LOCAL_ADV_DATA* p_adv_data = &btm_cb.ble_ctr_cb.inq_var.adv_data;
   1532   uint8_t* p;
   1533 
   1534   BTM_TRACE_DEBUG("btm_ble_update_adv_flag new=0x%x", flag);
   1535 
   1536   if (p_adv_data->p_flags != NULL) {
   1537     BTM_TRACE_DEBUG("btm_ble_update_adv_flag old=0x%x", *p_adv_data->p_flags);
   1538     *p_adv_data->p_flags = flag;
   1539   } else /* no FLAGS in ADV data*/
   1540   {
   1541     p = (p_adv_data->p_pad == NULL) ? p_adv_data->ad_data : p_adv_data->p_pad;
   1542     /* need 3 bytes space to stuff in the flags, if not */
   1543     /* erase all written data, just for flags */
   1544     if ((BTM_BLE_AD_DATA_LEN - (p - p_adv_data->ad_data)) < 3) {
   1545       p = p_adv_data->p_pad = p_adv_data->ad_data;
   1546       memset(p_adv_data->ad_data, 0, BTM_BLE_AD_DATA_LEN);
   1547     }
   1548 
   1549     *p++ = 2;
   1550     *p++ = BTM_BLE_AD_TYPE_FLAG;
   1551     p_adv_data->p_flags = p;
   1552     *p++ = flag;
   1553     p_adv_data->p_pad = p;
   1554   }
   1555 
   1556   btsnd_hcic_ble_set_adv_data(
   1557       (uint8_t)(p_adv_data->p_pad - p_adv_data->ad_data), p_adv_data->ad_data);
   1558   p_adv_data->data_mask |= BTM_BLE_AD_BIT_FLAGS;
   1559 }
   1560 
   1561 /**
   1562  * Check ADV flag to make sure device is discoverable and match the search
   1563  * condition
   1564  */
   1565 uint8_t btm_ble_is_discoverable(const RawAddress& bda,
   1566                                 std::vector<uint8_t> const& adv_data) {
   1567   uint8_t flag = 0, rt = 0;
   1568   uint8_t data_len;
   1569   tBTM_INQ_PARMS* p_cond = &btm_cb.btm_inq_vars.inqparms;
   1570 
   1571   /* for observer, always "discoverable */
   1572   if (BTM_BLE_IS_OBS_ACTIVE(btm_cb.ble_ctr_cb.scan_activity))
   1573     rt |= BTM_BLE_OBS_RESULT;
   1574 
   1575   /* does not match filter condition */
   1576   if (p_cond->filter_cond_type == BTM_FILTER_COND_BD_ADDR &&
   1577       bda != p_cond->filter_cond.bdaddr_cond) {
   1578     BTM_TRACE_DEBUG("BD ADDR does not meet filter condition");
   1579     return rt;
   1580   }
   1581 
   1582   if (!adv_data.empty()) {
   1583     const uint8_t* p_flag = AdvertiseDataParser::GetFieldByType(
   1584         adv_data, BTM_BLE_AD_TYPE_FLAG, &data_len);
   1585     if (p_flag != NULL) {
   1586       flag = *p_flag;
   1587 
   1588       if ((btm_cb.btm_inq_vars.inq_active & BTM_BLE_GENERAL_INQUIRY) &&
   1589           (flag & (BTM_BLE_LIMIT_DISC_FLAG | BTM_BLE_GEN_DISC_FLAG)) != 0) {
   1590         BTM_TRACE_DEBUG("Find Generable Discoverable device");
   1591         rt |= BTM_BLE_INQ_RESULT;
   1592       }
   1593 
   1594       else if (btm_cb.btm_inq_vars.inq_active & BTM_BLE_LIMITED_INQUIRY &&
   1595                (flag & BTM_BLE_LIMIT_DISC_FLAG) != 0) {
   1596         BTM_TRACE_DEBUG("Find limited discoverable device");
   1597         rt |= BTM_BLE_INQ_RESULT;
   1598       }
   1599     }
   1600   }
   1601   return rt;
   1602 }
   1603 
   1604 static void btm_ble_appearance_to_cod(uint16_t appearance, uint8_t* dev_class) {
   1605   dev_class[0] = 0;
   1606 
   1607   switch (appearance) {
   1608     case BTM_BLE_APPEARANCE_GENERIC_PHONE:
   1609       dev_class[1] = BTM_COD_MAJOR_PHONE;
   1610       dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
   1611       break;
   1612     case BTM_BLE_APPEARANCE_GENERIC_COMPUTER:
   1613       dev_class[1] = BTM_COD_MAJOR_COMPUTER;
   1614       dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
   1615       break;
   1616     case BTM_BLE_APPEARANCE_GENERIC_REMOTE:
   1617       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1618       dev_class[2] = BTM_COD_MINOR_REMOTE_CONTROL;
   1619       break;
   1620     case BTM_BLE_APPEARANCE_GENERIC_THERMOMETER:
   1621     case BTM_BLE_APPEARANCE_THERMOMETER_EAR:
   1622       dev_class[1] = BTM_COD_MAJOR_HEALTH;
   1623       dev_class[2] = BTM_COD_MINOR_THERMOMETER;
   1624       break;
   1625     case BTM_BLE_APPEARANCE_GENERIC_HEART_RATE:
   1626     case BTM_BLE_APPEARANCE_HEART_RATE_BELT:
   1627       dev_class[1] = BTM_COD_MAJOR_HEALTH;
   1628       dev_class[2] = BTM_COD_MINOR_HEART_PULSE_MONITOR;
   1629       break;
   1630     case BTM_BLE_APPEARANCE_GENERIC_BLOOD_PRESSURE:
   1631     case BTM_BLE_APPEARANCE_BLOOD_PRESSURE_ARM:
   1632     case BTM_BLE_APPEARANCE_BLOOD_PRESSURE_WRIST:
   1633       dev_class[1] = BTM_COD_MAJOR_HEALTH;
   1634       dev_class[2] = BTM_COD_MINOR_BLOOD_MONITOR;
   1635       break;
   1636     case BTM_BLE_APPEARANCE_GENERIC_PULSE_OXIMETER:
   1637     case BTM_BLE_APPEARANCE_PULSE_OXIMETER_FINGERTIP:
   1638     case BTM_BLE_APPEARANCE_PULSE_OXIMETER_WRIST:
   1639       dev_class[1] = BTM_COD_MAJOR_HEALTH;
   1640       dev_class[2] = BTM_COD_MINOR_PULSE_OXIMETER;
   1641       break;
   1642     case BTM_BLE_APPEARANCE_GENERIC_GLUCOSE:
   1643       dev_class[1] = BTM_COD_MAJOR_HEALTH;
   1644       dev_class[2] = BTM_COD_MINOR_GLUCOSE_METER;
   1645       break;
   1646     case BTM_BLE_APPEARANCE_GENERIC_WEIGHT:
   1647       dev_class[1] = BTM_COD_MAJOR_HEALTH;
   1648       dev_class[2] = BTM_COD_MINOR_WEIGHING_SCALE;
   1649       break;
   1650     case BTM_BLE_APPEARANCE_GENERIC_WALKING:
   1651     case BTM_BLE_APPEARANCE_WALKING_IN_SHOE:
   1652     case BTM_BLE_APPEARANCE_WALKING_ON_SHOE:
   1653     case BTM_BLE_APPEARANCE_WALKING_ON_HIP:
   1654       dev_class[1] = BTM_COD_MAJOR_HEALTH;
   1655       dev_class[2] = BTM_COD_MINOR_STEP_COUNTER;
   1656       break;
   1657     case BTM_BLE_APPEARANCE_GENERIC_WATCH:
   1658     case BTM_BLE_APPEARANCE_SPORTS_WATCH:
   1659       dev_class[1] = BTM_COD_MAJOR_WEARABLE;
   1660       dev_class[2] = BTM_COD_MINOR_WRIST_WATCH;
   1661       break;
   1662     case BTM_BLE_APPEARANCE_GENERIC_EYEGLASSES:
   1663       dev_class[1] = BTM_COD_MAJOR_WEARABLE;
   1664       dev_class[2] = BTM_COD_MINOR_GLASSES;
   1665       break;
   1666     case BTM_BLE_APPEARANCE_GENERIC_DISPLAY:
   1667       dev_class[1] = BTM_COD_MAJOR_IMAGING;
   1668       dev_class[2] = BTM_COD_MINOR_DISPLAY;
   1669       break;
   1670     case BTM_BLE_APPEARANCE_GENERIC_MEDIA_PLAYER:
   1671       dev_class[1] = BTM_COD_MAJOR_AUDIO;
   1672       dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
   1673       break;
   1674     case BTM_BLE_APPEARANCE_GENERIC_BARCODE_SCANNER:
   1675     case BTM_BLE_APPEARANCE_HID_BARCODE_SCANNER:
   1676     case BTM_BLE_APPEARANCE_GENERIC_HID:
   1677       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1678       dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
   1679       break;
   1680     case BTM_BLE_APPEARANCE_HID_KEYBOARD:
   1681       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1682       dev_class[2] = BTM_COD_MINOR_KEYBOARD;
   1683       break;
   1684     case BTM_BLE_APPEARANCE_HID_MOUSE:
   1685       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1686       dev_class[2] = BTM_COD_MINOR_POINTING;
   1687       break;
   1688     case BTM_BLE_APPEARANCE_HID_JOYSTICK:
   1689       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1690       dev_class[2] = BTM_COD_MINOR_JOYSTICK;
   1691       break;
   1692     case BTM_BLE_APPEARANCE_HID_GAMEPAD:
   1693       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1694       dev_class[2] = BTM_COD_MINOR_GAMEPAD;
   1695       break;
   1696     case BTM_BLE_APPEARANCE_HID_DIGITIZER_TABLET:
   1697       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1698       dev_class[2] = BTM_COD_MINOR_DIGITIZING_TABLET;
   1699       break;
   1700     case BTM_BLE_APPEARANCE_HID_CARD_READER:
   1701       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1702       dev_class[2] = BTM_COD_MINOR_CARD_READER;
   1703       break;
   1704     case BTM_BLE_APPEARANCE_HID_DIGITAL_PEN:
   1705       dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1706       dev_class[2] = BTM_COD_MINOR_DIGITAL_PAN;
   1707       break;
   1708     case BTM_BLE_APPEARANCE_UKNOWN:
   1709     case BTM_BLE_APPEARANCE_GENERIC_CLOCK:
   1710     case BTM_BLE_APPEARANCE_GENERIC_TAG:
   1711     case BTM_BLE_APPEARANCE_GENERIC_KEYRING:
   1712     case BTM_BLE_APPEARANCE_GENERIC_CYCLING:
   1713     case BTM_BLE_APPEARANCE_CYCLING_COMPUTER:
   1714     case BTM_BLE_APPEARANCE_CYCLING_SPEED:
   1715     case BTM_BLE_APPEARANCE_CYCLING_CADENCE:
   1716     case BTM_BLE_APPEARANCE_CYCLING_POWER:
   1717     case BTM_BLE_APPEARANCE_CYCLING_SPEED_CADENCE:
   1718     case BTM_BLE_APPEARANCE_GENERIC_OUTDOOR_SPORTS:
   1719     case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION:
   1720     case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_AND_NAV:
   1721     case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD:
   1722     case BTM_BLE_APPEARANCE_OUTDOOR_SPORTS_LOCATION_POD_AND_NAV:
   1723     default:
   1724       dev_class[1] = BTM_COD_MAJOR_UNCLASSIFIED;
   1725       dev_class[2] = BTM_COD_MINOR_UNCLASSIFIED;
   1726   };
   1727 }
   1728 
   1729 /**
   1730  * Update adv packet information into inquiry result.
   1731  */
   1732 void btm_ble_update_inq_result(tINQ_DB_ENT* p_i, uint8_t addr_type,
   1733                                const RawAddress& bda, uint16_t evt_type,
   1734                                uint8_t primary_phy, uint8_t secondary_phy,
   1735                                uint8_t advertising_sid, int8_t tx_power,
   1736                                int8_t rssi, uint16_t periodic_adv_int,
   1737                                std::vector<uint8_t> const& data) {
   1738   tBTM_INQ_RESULTS* p_cur = &p_i->inq_info.results;
   1739   uint8_t len;
   1740   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   1741 
   1742   /* Save the info */
   1743   p_cur->inq_result_type = BTM_INQ_RESULT_BLE;
   1744   p_cur->ble_addr_type = addr_type;
   1745   p_cur->rssi = rssi;
   1746   p_cur->ble_primary_phy = primary_phy;
   1747   p_cur->ble_secondary_phy = secondary_phy;
   1748   p_cur->ble_advertising_sid = advertising_sid;
   1749   p_cur->ble_tx_power = tx_power;
   1750   p_cur->ble_periodic_adv_int = periodic_adv_int;
   1751 
   1752   if (btm_cb.ble_ctr_cb.inq_var.scan_type == BTM_BLE_SCAN_MODE_ACTI &&
   1753       ble_evt_type_is_scannable(evt_type) &&
   1754       !ble_evt_type_is_scan_resp(evt_type)) {
   1755     p_i->scan_rsp = false;
   1756   } else
   1757     p_i->scan_rsp = true;
   1758 
   1759   if (p_i->inq_count != p_inq->inq_counter)
   1760     p_cur->device_type = BT_DEVICE_TYPE_BLE;
   1761   else
   1762     p_cur->device_type |= BT_DEVICE_TYPE_BLE;
   1763 
   1764   if (evt_type != BTM_BLE_SCAN_RSP_EVT) p_cur->ble_evt_type = evt_type;
   1765 
   1766   p_i->inq_count = p_inq->inq_counter; /* Mark entry for current inquiry */
   1767 
   1768   if (!data.empty()) {
   1769     const uint8_t* p_flag =
   1770         AdvertiseDataParser::GetFieldByType(data, BTM_BLE_AD_TYPE_FLAG, &len);
   1771     if (p_flag != NULL) p_cur->flag = *p_flag;
   1772   }
   1773 
   1774   if (!data.empty()) {
   1775     /* Check to see the BLE device has the Appearance UUID in the advertising
   1776      * data.  If it does
   1777      * then try to convert the appearance value to a class of device value
   1778      * Bluedroid can use.
   1779      * Otherwise fall back to trying to infer if it is a HID device based on the
   1780      * service class.
   1781      */
   1782     const uint8_t* p_uuid16 = AdvertiseDataParser::GetFieldByType(
   1783         data, BTM_BLE_AD_TYPE_APPEARANCE, &len);
   1784     if (p_uuid16 && len == 2) {
   1785       btm_ble_appearance_to_cod((uint16_t)p_uuid16[0] | (p_uuid16[1] << 8),
   1786                                 p_cur->dev_class);
   1787     } else {
   1788       p_uuid16 = AdvertiseDataParser::GetFieldByType(
   1789           data, BTM_BLE_AD_TYPE_16SRV_CMPL, &len);
   1790       if (p_uuid16 != NULL) {
   1791         uint8_t i;
   1792         for (i = 0; i + 2 <= len; i = i + 2) {
   1793           /* if this BLE device support HID over LE, set HID Major in class of
   1794            * device */
   1795           if ((p_uuid16[i] | (p_uuid16[i + 1] << 8)) == UUID_SERVCLASS_LE_HID) {
   1796             p_cur->dev_class[0] = 0;
   1797             p_cur->dev_class[1] = BTM_COD_MAJOR_PERIPHERAL;
   1798             p_cur->dev_class[2] = 0;
   1799             break;
   1800           }
   1801         }
   1802       }
   1803     }
   1804   }
   1805 
   1806   /* if BR/EDR not supported is not set, assume is a DUMO device */
   1807   if ((p_cur->flag & BTM_BLE_BREDR_NOT_SPT) == 0 &&
   1808       !ble_evt_type_is_directed(evt_type)) {
   1809     if (p_cur->ble_addr_type != BLE_ADDR_RANDOM) {
   1810       BTM_TRACE_DEBUG("BR/EDR NOT support bit not set, treat as DUMO");
   1811       p_cur->device_type |= BT_DEVICE_TYPE_DUMO;
   1812     } else {
   1813       BTM_TRACE_DEBUG("Random address, treating device as LE only");
   1814     }
   1815   } else {
   1816     BTM_TRACE_DEBUG("BR/EDR NOT SUPPORT bit set, LE only device");
   1817   }
   1818 }
   1819 
   1820 /*******************************************************************************
   1821  *
   1822  * Function         btm_clear_all_pending_le_entry
   1823  *
   1824  * Description      This function is called to clear all LE pending entry in
   1825  *                  inquiry database.
   1826  *
   1827  * Returns          void
   1828  *
   1829  ******************************************************************************/
   1830 void btm_clear_all_pending_le_entry(void) {
   1831   uint16_t xx;
   1832   tINQ_DB_ENT* p_ent = btm_cb.btm_inq_vars.inq_db;
   1833 
   1834   for (xx = 0; xx < BTM_INQ_DB_SIZE; xx++, p_ent++) {
   1835     /* mark all pending LE entry as unused if an LE only device has scan
   1836      * response outstanding */
   1837     if ((p_ent->in_use) &&
   1838         (p_ent->inq_info.results.device_type == BT_DEVICE_TYPE_BLE) &&
   1839         !p_ent->scan_rsp)
   1840       p_ent->in_use = false;
   1841   }
   1842 }
   1843 
   1844 void btm_ble_process_adv_addr(RawAddress& bda, uint8_t addr_type) {
   1845 #if (BLE_PRIVACY_SPT == TRUE)
   1846   /* map address to security record */
   1847   bool match = btm_identity_addr_to_random_pseudo(&bda, &addr_type, false);
   1848 
   1849   VLOG(1) << __func__ << ": bda=" << bda;
   1850   /* always do RRA resolution on host */
   1851   if (!match && BTM_BLE_IS_RESOLVE_BDA(bda)) {
   1852     tBTM_SEC_DEV_REC* match_rec = btm_ble_resolve_random_addr(bda);
   1853     if (match_rec) {
   1854       match_rec->ble.active_addr_type = BTM_BLE_ADDR_RRA;
   1855       match_rec->ble.cur_rand_addr = bda;
   1856 
   1857       if (btm_ble_init_pseudo_addr(match_rec, bda)) {
   1858         bda = match_rec->bd_addr;
   1859       } else {
   1860         // Assign the original address to be the current report address
   1861         bda = match_rec->ble.pseudo_addr;
   1862       }
   1863     }
   1864   }
   1865 #endif
   1866 }
   1867 
   1868 /**
   1869  * This function is called when extended advertising report event is received .
   1870  * It updates the inquiry database. If the inquiry database is full, the oldest
   1871  * entry is discarded.
   1872  */
   1873 void btm_ble_process_ext_adv_pkt(uint8_t data_len, uint8_t* data) {
   1874   RawAddress bda, direct_address;
   1875   uint8_t* p = data;
   1876   uint8_t addr_type, num_reports, pkt_data_len, primary_phy, secondary_phy,
   1877       advertising_sid;
   1878   int8_t rssi, tx_power;
   1879   uint16_t event_type, periodic_adv_int, direct_address_type;
   1880 
   1881   /* Only process the results if the inquiry is still active */
   1882   if (!BTM_BLE_IS_SCAN_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) return;
   1883 
   1884   /* Extract the number of reports in this event. */
   1885   STREAM_TO_UINT8(num_reports, p);
   1886 
   1887   while (num_reports--) {
   1888     if (p > data + data_len) {
   1889       // TODO(jpawlowski): we should crash the stack here
   1890       BTM_TRACE_ERROR(
   1891           "Malformed LE Extended Advertising Report Event from controller - "
   1892           "can't loop the data");
   1893       return;
   1894     }
   1895 
   1896     /* Extract inquiry results */
   1897     STREAM_TO_UINT16(event_type, p);
   1898     STREAM_TO_UINT8(addr_type, p);
   1899     STREAM_TO_BDADDR(bda, p);
   1900     STREAM_TO_UINT8(primary_phy, p);
   1901     STREAM_TO_UINT8(secondary_phy, p);
   1902     STREAM_TO_UINT8(advertising_sid, p);
   1903     STREAM_TO_INT8(tx_power, p);
   1904     STREAM_TO_INT8(rssi, p);
   1905     STREAM_TO_UINT16(periodic_adv_int, p);
   1906     STREAM_TO_UINT8(direct_address_type, p);
   1907     STREAM_TO_BDADDR(direct_address, p);
   1908     STREAM_TO_UINT8(pkt_data_len, p);
   1909 
   1910     uint8_t* pkt_data = p;
   1911     p += pkt_data_len; /* Advance to the the next packet*/
   1912 
   1913     if (rssi >= 21 && rssi <= 126) {
   1914       BTM_TRACE_ERROR("%s: bad rssi value in advertising report: ", __func__,
   1915                       pkt_data_len, rssi);
   1916     }
   1917 
   1918     btm_ble_process_adv_addr(bda, addr_type);
   1919     btm_ble_process_adv_pkt_cont(event_type, addr_type, bda, primary_phy,
   1920                                  secondary_phy, advertising_sid, tx_power, rssi,
   1921                                  periodic_adv_int, pkt_data_len, pkt_data);
   1922   }
   1923 }
   1924 
   1925 /**
   1926  * This function is called when advertising report event is received. It updates
   1927  * the inquiry database. If the inquiry database is full, the oldest entry is
   1928  * discarded.
   1929  */
   1930 void btm_ble_process_adv_pkt(uint8_t data_len, uint8_t* data) {
   1931   RawAddress bda;
   1932   uint8_t* p = data;
   1933   uint8_t legacy_evt_type, addr_type, num_reports, pkt_data_len;
   1934   int8_t rssi;
   1935 
   1936   /* Only process the results if the inquiry is still active */
   1937   if (!BTM_BLE_IS_SCAN_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) return;
   1938 
   1939   /* Extract the number of reports in this event. */
   1940   STREAM_TO_UINT8(num_reports, p);
   1941 
   1942   while (num_reports--) {
   1943     if (p > data + data_len) {
   1944       // TODO(jpawlowski): we should crash the stack here
   1945       BTM_TRACE_ERROR("Malformed LE Advertising Report Event from controller");
   1946       return;
   1947     }
   1948 
   1949     /* Extract inquiry results */
   1950     STREAM_TO_UINT8(legacy_evt_type, p);
   1951     STREAM_TO_UINT8(addr_type, p);
   1952     STREAM_TO_BDADDR(bda, p);
   1953     STREAM_TO_UINT8(pkt_data_len, p);
   1954 
   1955     uint8_t* pkt_data = p;
   1956     p += pkt_data_len; /* Advance to the the rssi byte */
   1957 
   1958     STREAM_TO_INT8(rssi, p);
   1959 
   1960     if (rssi >= 21 && rssi <= 126) {
   1961       BTM_TRACE_ERROR("%s: bad rssi value in advertising report: ", __func__,
   1962                       pkt_data_len, rssi);
   1963     }
   1964 
   1965     btm_ble_process_adv_addr(bda, addr_type);
   1966 
   1967     uint16_t event_type;
   1968     if (legacy_evt_type == 0x00) {  // ADV_IND;
   1969       event_type = 0x0013;
   1970     } else if (legacy_evt_type == 0x01) {  // ADV_DIRECT_IND;
   1971       event_type = 0x0015;
   1972     } else if (legacy_evt_type == 0x02) {  // ADV_SCAN_IND;
   1973       event_type = 0x0012;
   1974     } else if (legacy_evt_type == 0x03) {  // ADV_NONCONN_IND;
   1975       event_type = 0x0010;
   1976     } else if (legacy_evt_type == 0x04) {  // SCAN_RSP;
   1977       // We can't distinguish between "SCAN_RSP to an ADV_IND", and "SCAN_RSP to
   1978       // an ADV_SCAN_IND", so always return "SCAN_RSP to an ADV_IND"
   1979       event_type = 0x001B;
   1980     } else {
   1981       BTM_TRACE_ERROR(
   1982           "Malformed LE Advertising Report Event - unsupported "
   1983           "legacy_event_type 0x%02x",
   1984           legacy_evt_type);
   1985       return;
   1986     }
   1987 
   1988     btm_ble_process_adv_pkt_cont(
   1989         event_type, addr_type, bda, PHY_LE_1M, PHY_LE_NO_PACKET, NO_ADI_PRESENT,
   1990         TX_POWER_NOT_PRESENT, rssi, 0x00 /* no periodic adv */, pkt_data_len,
   1991         pkt_data);
   1992   }
   1993 }
   1994 
   1995 /**
   1996  * This function is called after random address resolution is done, and proceed
   1997  * to process adv packet.
   1998  */
   1999 static void btm_ble_process_adv_pkt_cont(
   2000     uint16_t evt_type, uint8_t addr_type, const RawAddress& bda,
   2001     uint8_t primary_phy, uint8_t secondary_phy, uint8_t advertising_sid,
   2002     int8_t tx_power, int8_t rssi, uint16_t periodic_adv_int, uint8_t data_len,
   2003     uint8_t* data) {
   2004   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   2005   bool update = true;
   2006 
   2007   std::vector<uint8_t> tmp;
   2008   if (data_len != 0) tmp.insert(tmp.begin(), data, data + data_len);
   2009 
   2010   bool is_scannable = ble_evt_type_is_scannable(evt_type);
   2011   bool is_scan_resp = ble_evt_type_is_scan_resp(evt_type);
   2012 
   2013   bool is_start =
   2014       ble_evt_type_is_legacy(evt_type) && is_scannable && !is_scan_resp;
   2015 
   2016   if (is_start) AdvertiseDataParser::RemoveTrailingZeros(tmp);
   2017 
   2018   // We might have send scan request to this device before, but didn't get the
   2019   // response. In such case make sure data is put at start, not appended to
   2020   // already existing data.
   2021   std::vector<uint8_t> const& adv_data =
   2022       is_start ? cache.Set(addr_type, bda, std::move(tmp))
   2023                : cache.Append(addr_type, bda, std::move(tmp));
   2024 
   2025   bool data_complete = (ble_evt_type_data_status(evt_type) != 0x01);
   2026 
   2027   if (!data_complete) {
   2028     // If we didn't receive whole adv data yet, don't report the device.
   2029     DVLOG(1) << "Data not complete yet, waiting for more " << bda;
   2030     return;
   2031   }
   2032 
   2033   bool is_active_scan =
   2034       btm_cb.ble_ctr_cb.inq_var.scan_type == BTM_BLE_SCAN_MODE_ACTI;
   2035   if (is_active_scan && is_scannable && !is_scan_resp) {
   2036     // If we didn't receive scan response yet, don't report the device.
   2037     DVLOG(1) << " Waiting for scan response " << bda;
   2038     return;
   2039   }
   2040 
   2041   if (!AdvertiseDataParser::IsValid(adv_data)) {
   2042     DVLOG(1) << __func__ << "Dropping bad advertisement packet: "
   2043              << base::HexEncode(adv_data.data(), adv_data.size());
   2044     return;
   2045   }
   2046 
   2047   tINQ_DB_ENT* p_i = btm_inq_db_find(bda);
   2048 
   2049   /* Check if this address has already been processed for this inquiry */
   2050   if (btm_inq_find_bdaddr(bda)) {
   2051     /* never been report as an LE device */
   2052     if (p_i && (!(p_i->inq_info.results.device_type & BT_DEVICE_TYPE_BLE) ||
   2053                 /* scan repsonse to be updated */
   2054                 (!p_i->scan_rsp))) {
   2055       update = true;
   2056     } else if (BTM_BLE_IS_OBS_ACTIVE(btm_cb.ble_ctr_cb.scan_activity)) {
   2057       update = false;
   2058     } else {
   2059       /* if yes, skip it */
   2060       return; /* assumption: one result per event */
   2061     }
   2062   }
   2063   /* If existing entry, use that, else get  a new one (possibly reusing the
   2064    * oldest) */
   2065   if (p_i == NULL) {
   2066     p_i = btm_inq_db_new(bda);
   2067     if (p_i != NULL) {
   2068       p_inq->inq_cmpl_info.num_resp++;
   2069     } else
   2070       return;
   2071   } else if (p_i->inq_count !=
   2072              p_inq->inq_counter) /* first time seen in this inquiry */
   2073   {
   2074     p_inq->inq_cmpl_info.num_resp++;
   2075   }
   2076 
   2077   /* update the LE device information in inquiry database */
   2078   btm_ble_update_inq_result(p_i, addr_type, bda, evt_type, primary_phy,
   2079                             secondary_phy, advertising_sid, tx_power, rssi,
   2080                             periodic_adv_int, adv_data);
   2081 
   2082   uint8_t result = btm_ble_is_discoverable(bda, adv_data);
   2083   if (result == 0) {
   2084     cache.Clear(addr_type, bda);
   2085     LOG_WARN(LOG_TAG,
   2086              "%s device no longer discoverable, discarding advertising packet",
   2087              __func__);
   2088     return;
   2089   }
   2090 
   2091   if (!update) result &= ~BTM_BLE_INQ_RESULT;
   2092   /* If the number of responses found and limited, issue a cancel inquiry */
   2093   if (p_inq->inqparms.max_resps &&
   2094       p_inq->inq_cmpl_info.num_resp == p_inq->inqparms.max_resps) {
   2095     /* new device */
   2096     if (p_i == NULL ||
   2097         /* assume a DUMO device, BR/EDR inquiry is always active */
   2098         (p_i &&
   2099          (p_i->inq_info.results.device_type & BT_DEVICE_TYPE_BLE) ==
   2100              BT_DEVICE_TYPE_BLE &&
   2101          p_i->scan_rsp)) {
   2102       BTM_TRACE_WARNING(
   2103           "INQ RES: Extra Response Received...cancelling inquiry..");
   2104 
   2105       /* if is non-periodic inquiry active, cancel now */
   2106       if ((p_inq->inq_active & BTM_BR_INQ_ACTIVE_MASK) != 0 &&
   2107           (p_inq->inq_active & BTM_PERIODIC_INQUIRY_ACTIVE) == 0)
   2108         btsnd_hcic_inq_cancel();
   2109 
   2110       btm_ble_stop_inquiry();
   2111 
   2112       btm_acl_update_busy_level(BTM_BLI_INQ_DONE_EVT);
   2113     }
   2114   }
   2115 
   2116   tBTM_INQ_RESULTS_CB* p_inq_results_cb = p_inq->p_inq_results_cb;
   2117   if (p_inq_results_cb && (result & BTM_BLE_INQ_RESULT)) {
   2118     (p_inq_results_cb)((tBTM_INQ_RESULTS*)&p_i->inq_info.results,
   2119                        const_cast<uint8_t*>(adv_data.data()), adv_data.size());
   2120   }
   2121 
   2122   tBTM_INQ_RESULTS_CB* p_obs_results_cb = btm_cb.ble_ctr_cb.p_obs_results_cb;
   2123   if (p_obs_results_cb && (result & BTM_BLE_OBS_RESULT)) {
   2124     (p_obs_results_cb)((tBTM_INQ_RESULTS*)&p_i->inq_info.results,
   2125                        const_cast<uint8_t*>(adv_data.data()), adv_data.size());
   2126   }
   2127 
   2128   cache.Clear(addr_type, bda);
   2129 }
   2130 
   2131 void btm_ble_process_phy_update_pkt(uint8_t len, uint8_t* data) {
   2132   uint8_t status, tx_phy, rx_phy;
   2133   uint16_t handle;
   2134 
   2135   LOG_ASSERT(len == 5);
   2136   uint8_t* p = data;
   2137   STREAM_TO_UINT8(status, p);
   2138   STREAM_TO_UINT16(handle, p);
   2139   handle = handle & 0x0FFF;
   2140   STREAM_TO_UINT8(tx_phy, p);
   2141   STREAM_TO_UINT8(rx_phy, p);
   2142 
   2143   tBTM_SEC_DEV_REC* p_dev_rec = btm_find_dev_by_handle(handle);
   2144   if (!p_dev_rec) {
   2145     BTM_TRACE_WARNING("%s: No Device Found!", __func__);
   2146     return;
   2147   }
   2148 
   2149   tGATT_TCB* p_tcb =
   2150       gatt_find_tcb_by_addr(p_dev_rec->ble.pseudo_addr, BT_TRANSPORT_LE);
   2151   if (p_tcb == NULL) return;
   2152 
   2153   gatt_notify_phy_updated(p_tcb, tx_phy, rx_phy, status);
   2154 }
   2155 
   2156 /*******************************************************************************
   2157  *
   2158  * Function         btm_ble_start_scan
   2159  *
   2160  * Description      Start the BLE scan.
   2161  *
   2162  * Returns          void
   2163  *
   2164  ******************************************************************************/
   2165 tBTM_STATUS btm_ble_start_scan(void) {
   2166   tBTM_BLE_INQ_CB* p_inq = &btm_cb.ble_ctr_cb.inq_var;
   2167   /* start scan, disable duplicate filtering */
   2168   btm_send_hci_scan_enable(BTM_BLE_SCAN_ENABLE, p_inq->scan_duplicate_filter);
   2169 
   2170   if (p_inq->scan_type == BTM_BLE_SCAN_MODE_ACTI)
   2171     btm_ble_set_topology_mask(BTM_BLE_STATE_ACTIVE_SCAN_BIT);
   2172   else
   2173     btm_ble_set_topology_mask(BTM_BLE_STATE_PASSIVE_SCAN_BIT);
   2174 
   2175   return BTM_CMD_STARTED;
   2176 }
   2177 
   2178 /*******************************************************************************
   2179  *
   2180  * Function         btm_ble_stop_scan
   2181  *
   2182  * Description      Stop the BLE scan.
   2183  *
   2184  * Returns          void
   2185  *
   2186  ******************************************************************************/
   2187 void btm_ble_stop_scan(void) {
   2188   BTM_TRACE_EVENT("btm_ble_stop_scan ");
   2189 
   2190   if (btm_cb.ble_ctr_cb.inq_var.scan_type == BTM_BLE_SCAN_MODE_ACTI)
   2191     btm_ble_clear_topology_mask(BTM_BLE_STATE_ACTIVE_SCAN_BIT);
   2192   else
   2193     btm_ble_clear_topology_mask(BTM_BLE_STATE_PASSIVE_SCAN_BIT);
   2194 
   2195   /* Clear the inquiry callback if set */
   2196   btm_cb.ble_ctr_cb.inq_var.scan_type = BTM_BLE_SCAN_MODE_NONE;
   2197 
   2198   /* stop discovery now */
   2199   btm_send_hci_scan_enable(BTM_BLE_SCAN_DISABLE, BTM_BLE_DUPLICATE_ENABLE);
   2200 
   2201   btm_update_scanner_filter_policy(SP_ADV_ALL);
   2202 }
   2203 /*******************************************************************************
   2204  *
   2205  * Function         btm_ble_stop_inquiry
   2206  *
   2207  * Description      Stop the BLE Inquiry.
   2208  *
   2209  * Returns          void
   2210  *
   2211  ******************************************************************************/
   2212 void btm_ble_stop_inquiry(void) {
   2213   tBTM_INQUIRY_VAR_ST* p_inq = &btm_cb.btm_inq_vars;
   2214   tBTM_BLE_CB* p_ble_cb = &btm_cb.ble_ctr_cb;
   2215 
   2216   alarm_cancel(p_ble_cb->inq_var.inquiry_timer);
   2217 
   2218   p_ble_cb->scan_activity &= ~BTM_BLE_INQUIRY_MASK;
   2219 
   2220   /* If no more scan activity, stop LE scan now */
   2221   if (!BTM_BLE_IS_SCAN_ACTIVE(p_ble_cb->scan_activity))
   2222     btm_ble_stop_scan();
   2223   else if ((p_ble_cb->inq_var.scan_interval != BTM_BLE_LOW_LATENCY_SCAN_INT) ||
   2224            (p_ble_cb->inq_var.scan_window != BTM_BLE_LOW_LATENCY_SCAN_WIN)) {
   2225     BTM_TRACE_DEBUG("%s: setting default params for ongoing observe", __func__);
   2226     btm_ble_stop_scan();
   2227     btm_ble_start_scan();
   2228   }
   2229 
   2230   /* If we have a callback registered for inquiry complete, call it */
   2231   BTM_TRACE_DEBUG("BTM Inq Compl Callback: status 0x%02x, num results %d",
   2232                   p_inq->inq_cmpl_info.status, p_inq->inq_cmpl_info.num_resp);
   2233 
   2234   btm_process_inq_complete(
   2235       HCI_SUCCESS, (uint8_t)(p_inq->inqparms.mode & BTM_BLE_INQUIRY_MASK));
   2236 }
   2237 
   2238 /*******************************************************************************
   2239  *
   2240  * Function         btm_ble_stop_observe
   2241  *
   2242  * Description      Stop the BLE Observe.
   2243  *
   2244  * Returns          void
   2245  *
   2246  ******************************************************************************/
   2247 static void btm_ble_stop_observe(void) {
   2248   tBTM_BLE_CB* p_ble_cb = &btm_cb.ble_ctr_cb;
   2249   tBTM_CMPL_CB* p_obs_cb = p_ble_cb->p_obs_cmpl_cb;
   2250 
   2251   alarm_cancel(p_ble_cb->observer_timer);
   2252 
   2253   p_ble_cb->scan_activity &= ~BTM_LE_OBSERVE_ACTIVE;
   2254 
   2255   p_ble_cb->p_obs_results_cb = NULL;
   2256   p_ble_cb->p_obs_cmpl_cb = NULL;
   2257 
   2258   if (!BTM_BLE_IS_SCAN_ACTIVE(p_ble_cb->scan_activity)) btm_ble_stop_scan();
   2259 
   2260   if (p_obs_cb)
   2261     (p_obs_cb)((tBTM_INQUIRY_CMPL*)&btm_cb.btm_inq_vars.inq_cmpl_info);
   2262 }
   2263 /*******************************************************************************
   2264  *
   2265  * Function         btm_ble_adv_states_operation
   2266  *
   2267  * Description      Set or clear adv states in topology mask
   2268  *
   2269  * Returns          operation status. true if sucessful, false otherwise.
   2270  *
   2271  ******************************************************************************/
   2272 typedef bool(BTM_TOPOLOGY_FUNC_PTR)(tBTM_BLE_STATE_MASK);
   2273 static bool btm_ble_adv_states_operation(BTM_TOPOLOGY_FUNC_PTR* p_handler,
   2274                                          uint8_t adv_evt) {
   2275   bool rt = false;
   2276 
   2277   switch (adv_evt) {
   2278     case BTM_BLE_CONNECT_EVT:
   2279       rt = (*p_handler)(BTM_BLE_STATE_CONN_ADV_BIT);
   2280       break;
   2281 
   2282     case BTM_BLE_NON_CONNECT_EVT:
   2283       rt = (*p_handler)(BTM_BLE_STATE_NON_CONN_ADV_BIT);
   2284       break;
   2285     case BTM_BLE_CONNECT_DIR_EVT:
   2286       rt = (*p_handler)(BTM_BLE_STATE_HI_DUTY_DIR_ADV_BIT);
   2287       break;
   2288 
   2289     case BTM_BLE_DISCOVER_EVT:
   2290       rt = (*p_handler)(BTM_BLE_STATE_SCAN_ADV_BIT);
   2291       break;
   2292 
   2293     case BTM_BLE_CONNECT_LO_DUTY_DIR_EVT:
   2294       rt = (*p_handler)(BTM_BLE_STATE_LO_DUTY_DIR_ADV_BIT);
   2295       break;
   2296 
   2297     default:
   2298       BTM_TRACE_ERROR("unknown adv event : %d", adv_evt);
   2299       break;
   2300   }
   2301 
   2302   return rt;
   2303 }
   2304 
   2305 /*******************************************************************************
   2306  *
   2307  * Function         btm_ble_start_adv
   2308  *
   2309  * Description      start the BLE advertising.
   2310  *
   2311  * Returns          void
   2312  *
   2313  ******************************************************************************/
   2314 tBTM_STATUS btm_ble_start_adv(void) {
   2315   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
   2316 
   2317   if (!btm_ble_adv_states_operation(btm_ble_topology_check, p_cb->evt_type))
   2318     return BTM_WRONG_MODE;
   2319 
   2320 #if (BLE_PRIVACY_SPT == TRUE)
   2321   /* To relax resolving list,  always have resolving list enabled, unless
   2322    * directed adv */
   2323   if (p_cb->evt_type != BTM_BLE_CONNECT_LO_DUTY_DIR_EVT &&
   2324       p_cb->evt_type != BTM_BLE_CONNECT_DIR_EVT)
   2325     /* enable resolving list is desired */
   2326     btm_ble_enable_resolving_list_for_platform(BTM_BLE_RL_ADV);
   2327 #endif
   2328 
   2329   btsnd_hcic_ble_set_adv_enable(BTM_BLE_ADV_ENABLE);
   2330   p_cb->adv_mode = BTM_BLE_ADV_ENABLE;
   2331   btm_ble_adv_states_operation(btm_ble_set_topology_mask, p_cb->evt_type);
   2332   return BTM_SUCCESS;
   2333 }
   2334 
   2335 /*******************************************************************************
   2336  *
   2337  * Function         btm_ble_stop_adv
   2338  *
   2339  * Description      Stop the BLE advertising.
   2340  *
   2341  * Returns          void
   2342  *
   2343  ******************************************************************************/
   2344 tBTM_STATUS btm_ble_stop_adv(void) {
   2345   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
   2346 
   2347   if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
   2348     btsnd_hcic_ble_set_adv_enable(BTM_BLE_ADV_DISABLE);
   2349 
   2350     p_cb->fast_adv_on = false;
   2351     p_cb->adv_mode = BTM_BLE_ADV_DISABLE;
   2352 
   2353     /* clear all adv states */
   2354     btm_ble_clear_topology_mask(BTM_BLE_STATE_ALL_ADV_MASK);
   2355   }
   2356   return BTM_SUCCESS;
   2357 }
   2358 
   2359 static void btm_ble_fast_adv_timer_timeout(UNUSED_ATTR void* data) {
   2360   /* fast adv is completed, fall back to slow adv interval */
   2361   btm_ble_start_slow_adv();
   2362 }
   2363 
   2364 /*******************************************************************************
   2365  *
   2366  * Function         btm_ble_start_slow_adv
   2367  *
   2368  * Description      Restart adv with slow adv interval
   2369  *
   2370  * Returns          void
   2371  *
   2372  ******************************************************************************/
   2373 static void btm_ble_start_slow_adv(void) {
   2374   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
   2375 
   2376   if (p_cb->adv_mode == BTM_BLE_ADV_ENABLE) {
   2377     tBTM_LE_RANDOM_CB* p_addr_cb = &btm_cb.ble_ctr_cb.addr_mgnt_cb;
   2378     RawAddress address = RawAddress::kEmpty;
   2379     tBLE_ADDR_TYPE init_addr_type = BLE_ADDR_PUBLIC;
   2380     tBLE_ADDR_TYPE own_addr_type = p_addr_cb->own_addr_type;
   2381 
   2382     btm_ble_stop_adv();
   2383 
   2384     p_cb->evt_type = btm_set_conn_mode_adv_init_addr(
   2385         p_cb, address, &init_addr_type, &own_addr_type);
   2386 
   2387     /* slow adv mode never goes into directed adv */
   2388     btsnd_hcic_ble_write_adv_params(
   2389         BTM_BLE_GAP_ADV_SLOW_INT, BTM_BLE_GAP_ADV_SLOW_INT, p_cb->evt_type,
   2390         own_addr_type, init_addr_type, address, p_cb->adv_chnl_map, p_cb->afp);
   2391 
   2392     btm_ble_start_adv();
   2393   }
   2394 }
   2395 
   2396 static void btm_ble_inquiry_timer_gap_limited_discovery_timeout(
   2397     UNUSED_ATTR void* data) {
   2398   /* lim_timeout expired, limited discovery should exit now */
   2399   btm_cb.btm_inq_vars.discoverable_mode &= ~BTM_BLE_LIMITED_DISCOVERABLE;
   2400   btm_ble_set_adv_flag(btm_cb.btm_inq_vars.connectable_mode,
   2401                        btm_cb.btm_inq_vars.discoverable_mode);
   2402 }
   2403 
   2404 static void btm_ble_inquiry_timer_timeout(UNUSED_ATTR void* data) {
   2405   btm_ble_stop_inquiry();
   2406 }
   2407 
   2408 static void btm_ble_observer_timer_timeout(UNUSED_ATTR void* data) {
   2409   btm_ble_stop_observe();
   2410 }
   2411 
   2412 void btm_ble_refresh_raddr_timer_timeout(UNUSED_ATTR void* data) {
   2413   if (btm_cb.ble_ctr_cb.addr_mgnt_cb.own_addr_type == BLE_ADDR_RANDOM) {
   2414     /* refresh the random addr */
   2415     btm_gen_resolvable_private_addr(base::Bind(&btm_gen_resolve_paddr_low));
   2416   }
   2417 }
   2418 
   2419 /*******************************************************************************
   2420  *
   2421  * Function         btm_ble_read_remote_features_complete
   2422  *
   2423  * Description      This function is called when the command complete message
   2424  *                  is received from the HCI for the read LE remote feature
   2425  *                  supported complete event.
   2426  *
   2427  * Returns          void
   2428  *
   2429  ******************************************************************************/
   2430 void btm_ble_read_remote_features_complete(uint8_t* p) {
   2431   BTM_TRACE_EVENT("%s", __func__);
   2432 
   2433   uint16_t handle;
   2434   uint8_t status;
   2435   STREAM_TO_UINT8(status, p);
   2436   STREAM_TO_UINT16(handle, p);
   2437   handle = handle & 0x0FFF;  // only 12 bits meaningful
   2438 
   2439   if (status != HCI_SUCCESS) {
   2440     BTM_TRACE_ERROR("%s: failed for handle: 0x%04d, status 0x%02x", __func__,
   2441                     handle, status);
   2442     if (status != HCI_ERR_UNSUPPORTED_REM_FEATURE) return;
   2443   }
   2444 
   2445   int idx = btm_handle_to_acl_index(handle);
   2446   if (idx == MAX_L2CAP_LINKS) {
   2447     BTM_TRACE_ERROR("%s: can't find acl for handle: 0x%04d", __func__, handle);
   2448     return;
   2449   }
   2450 
   2451   if (status == HCI_SUCCESS) {
   2452     STREAM_TO_ARRAY(btm_cb.acl_db[idx].peer_le_features, p, BD_FEATURES_LEN);
   2453   }
   2454 
   2455   btsnd_hcic_rmt_ver_req(handle);
   2456 }
   2457 
   2458 /*******************************************************************************
   2459  *
   2460  * Function         btm_ble_write_adv_enable_complete
   2461  *
   2462  * Description      This function process the write adv enable command complete.
   2463  *
   2464  * Returns          void
   2465  *
   2466  ******************************************************************************/
   2467 void btm_ble_write_adv_enable_complete(uint8_t* p) {
   2468   tBTM_BLE_INQ_CB* p_cb = &btm_cb.ble_ctr_cb.inq_var;
   2469 
   2470   /* if write adv enable/disbale not succeed */
   2471   if (*p != HCI_SUCCESS) {
   2472     /* toggle back the adv mode */
   2473     p_cb->adv_mode = !p_cb->adv_mode;
   2474   }
   2475 }
   2476 
   2477 /*******************************************************************************
   2478  *
   2479  * Function         btm_ble_dir_adv_tout
   2480  *
   2481  * Description      when directed adv time out
   2482  *
   2483  * Returns          void
   2484  *
   2485  ******************************************************************************/
   2486 void btm_ble_dir_adv_tout(void) {
   2487   btm_cb.ble_ctr_cb.inq_var.adv_mode = BTM_BLE_ADV_DISABLE;
   2488 
   2489   /* make device fall back into undirected adv mode by default */
   2490   btm_cb.ble_ctr_cb.inq_var.directed_conn = false;
   2491 }
   2492 
   2493 /*******************************************************************************
   2494  *
   2495  * Function         btm_ble_set_topology_mask
   2496  *
   2497  * Description      set BLE topology mask
   2498  *
   2499  * Returns          true is request is allowed, false otherwise.
   2500  *
   2501  ******************************************************************************/
   2502 bool btm_ble_set_topology_mask(tBTM_BLE_STATE_MASK request_state_mask) {
   2503   request_state_mask &= BTM_BLE_STATE_ALL_MASK;
   2504   btm_cb.ble_ctr_cb.cur_states |= (request_state_mask & BTM_BLE_STATE_ALL_MASK);
   2505   return true;
   2506 }
   2507 
   2508 /*******************************************************************************
   2509  *
   2510  * Function         btm_ble_clear_topology_mask
   2511  *
   2512  * Description      Clear BLE topology bit mask
   2513  *
   2514  * Returns          true is request is allowed, false otherwise.
   2515  *
   2516  ******************************************************************************/
   2517 bool btm_ble_clear_topology_mask(tBTM_BLE_STATE_MASK request_state_mask) {
   2518   request_state_mask &= BTM_BLE_STATE_ALL_MASK;
   2519   btm_cb.ble_ctr_cb.cur_states &= ~request_state_mask;
   2520   return true;
   2521 }
   2522 
   2523 /*******************************************************************************
   2524  *
   2525  * Function         btm_ble_update_link_topology_mask
   2526  *
   2527  * Description      This function update the link topology mask
   2528  *
   2529  * Returns          void
   2530  *
   2531  ******************************************************************************/
   2532 void btm_ble_update_link_topology_mask(uint8_t link_role, bool increase) {
   2533   btm_ble_clear_topology_mask(BTM_BLE_STATE_ALL_CONN_MASK);
   2534 
   2535   if (increase)
   2536     btm_cb.ble_ctr_cb.link_count[link_role]++;
   2537   else if (btm_cb.ble_ctr_cb.link_count[link_role] > 0)
   2538     btm_cb.ble_ctr_cb.link_count[link_role]--;
   2539 
   2540   if (btm_cb.ble_ctr_cb.link_count[HCI_ROLE_MASTER])
   2541     btm_ble_set_topology_mask(BTM_BLE_STATE_MASTER_BIT);
   2542 
   2543   if (btm_cb.ble_ctr_cb.link_count[HCI_ROLE_SLAVE])
   2544     btm_ble_set_topology_mask(BTM_BLE_STATE_SLAVE_BIT);
   2545 
   2546   if (link_role == HCI_ROLE_SLAVE && increase) {
   2547     btm_cb.ble_ctr_cb.inq_var.adv_mode = BTM_BLE_ADV_DISABLE;
   2548     /* make device fall back into undirected adv mode by default */
   2549     btm_cb.ble_ctr_cb.inq_var.directed_conn = BTM_BLE_CONNECT_EVT;
   2550     /* clear all adv states */
   2551     btm_ble_clear_topology_mask(BTM_BLE_STATE_ALL_ADV_MASK);
   2552   }
   2553 }
   2554 
   2555 /*******************************************************************************
   2556  *
   2557  * Function         btm_ble_update_mode_operation
   2558  *
   2559  * Description      This function update the GAP role operation when a link
   2560  *                  status is updated.
   2561  *
   2562  * Returns          void
   2563  *
   2564  ******************************************************************************/
   2565 void btm_ble_update_mode_operation(uint8_t link_role, const RawAddress* bd_addr,
   2566                                    uint8_t status) {
   2567   if (status == HCI_ERR_DIRECTED_ADVERTISING_TIMEOUT) {
   2568     btm_cb.ble_ctr_cb.inq_var.adv_mode = BTM_BLE_ADV_DISABLE;
   2569     /* make device fall back into undirected adv mode by default */
   2570     btm_cb.ble_ctr_cb.inq_var.directed_conn = BTM_BLE_CONNECT_EVT;
   2571     /* clear all adv states */
   2572     btm_ble_clear_topology_mask(BTM_BLE_STATE_ALL_ADV_MASK);
   2573   }
   2574 
   2575   if (btm_cb.ble_ctr_cb.inq_var.connectable_mode == BTM_BLE_CONNECTABLE) {
   2576     btm_ble_set_connectability(btm_cb.btm_inq_vars.connectable_mode |
   2577                                btm_cb.ble_ctr_cb.inq_var.connectable_mode);
   2578   }
   2579 
   2580   /* in case of disconnected, we must cancel bgconn and restart
   2581      in order to add back device to white list in order to reconnect */
   2582   btm_ble_bgconn_cancel_if_disconnected(*bd_addr);
   2583 
   2584   /* when no connection is attempted, and controller is not rejecting last
   2585      request
   2586      due to resource limitation, start next direct connection or background
   2587      connection
   2588      now in order */
   2589   if (btm_ble_get_conn_st() == BLE_CONN_IDLE &&
   2590       status != HCI_ERR_HOST_REJECT_RESOURCES &&
   2591       status != HCI_ERR_MAX_NUM_OF_CONNECTIONS &&
   2592       !btm_send_pending_direct_conn()) {
   2593     btm_ble_resume_bg_conn();
   2594   }
   2595 }
   2596 
   2597 /*******************************************************************************
   2598  *
   2599  * Function         btm_ble_init
   2600  *
   2601  * Description      Initialize the control block variable values.
   2602  *
   2603  * Returns          void
   2604  *
   2605  ******************************************************************************/
   2606 void btm_ble_init(void) {
   2607   tBTM_BLE_CB* p_cb = &btm_cb.ble_ctr_cb;
   2608 
   2609   BTM_TRACE_DEBUG("%s", __func__);
   2610 
   2611   alarm_free(p_cb->observer_timer);
   2612   alarm_free(p_cb->inq_var.fast_adv_timer);
   2613   memset(p_cb, 0, sizeof(tBTM_BLE_CB));
   2614   memset(&(btm_cb.cmn_ble_vsc_cb), 0, sizeof(tBTM_BLE_VSC_CB));
   2615   btm_cb.cmn_ble_vsc_cb.values_read = false;
   2616 
   2617   p_cb->observer_timer = alarm_new("btm_ble.observer_timer");
   2618   p_cb->cur_states = 0;
   2619   p_cb->conn_pending_q = fixed_queue_new(SIZE_MAX);
   2620 
   2621   p_cb->inq_var.adv_mode = BTM_BLE_ADV_DISABLE;
   2622   p_cb->inq_var.scan_type = BTM_BLE_SCAN_MODE_NONE;
   2623   p_cb->inq_var.adv_chnl_map = BTM_BLE_DEFAULT_ADV_CHNL_MAP;
   2624   p_cb->inq_var.afp = BTM_BLE_DEFAULT_AFP;
   2625   p_cb->inq_var.sfp = BTM_BLE_DEFAULT_SFP;
   2626   p_cb->inq_var.connectable_mode = BTM_BLE_NON_CONNECTABLE;
   2627   p_cb->inq_var.discoverable_mode = BTM_BLE_NON_DISCOVERABLE;
   2628   p_cb->inq_var.fast_adv_timer = alarm_new("btm_ble_inq.fast_adv_timer");
   2629   p_cb->inq_var.inquiry_timer = alarm_new("btm_ble_inq.inquiry_timer");
   2630 
   2631   /* for background connection, reset connection params to be undefined */
   2632   p_cb->scan_int = p_cb->scan_win = BTM_BLE_SCAN_PARAM_UNDEF;
   2633 
   2634   p_cb->inq_var.evt_type = BTM_BLE_NON_CONNECT_EVT;
   2635 
   2636   p_cb->addr_mgnt_cb.refresh_raddr_timer =
   2637       alarm_new("btm_ble_addr.refresh_raddr_timer");
   2638 
   2639 #if (BLE_VND_INCLUDED == FALSE)
   2640   btm_ble_adv_filter_init();
   2641 #endif
   2642 }
   2643 
   2644 /*******************************************************************************
   2645  *
   2646  * Function         btm_ble_topology_check
   2647  *
   2648  * Description      check to see requested state is supported. One state check
   2649  *                  at a time is supported
   2650  *
   2651  * Returns          true is request is allowed, false otherwise.
   2652  *
   2653  ******************************************************************************/
   2654 bool btm_ble_topology_check(tBTM_BLE_STATE_MASK request_state_mask) {
   2655   bool rt = false;
   2656 
   2657   uint8_t state_offset = 0;
   2658   uint16_t cur_states = btm_cb.ble_ctr_cb.cur_states;
   2659   uint8_t request_state = 0;
   2660 
   2661   /* check only one bit is set and within valid range */
   2662   if (request_state_mask == BTM_BLE_STATE_INVALID ||
   2663       request_state_mask > BTM_BLE_STATE_SCAN_ADV_BIT ||
   2664       (request_state_mask & (request_state_mask - 1)) != 0) {
   2665     BTM_TRACE_ERROR("illegal state requested: %d", request_state_mask);
   2666     return rt;
   2667   }
   2668 
   2669   while (request_state_mask) {
   2670     request_state_mask >>= 1;
   2671     request_state++;
   2672   }
   2673 
   2674   /* check if the requested state is supported or not */
   2675   uint8_t bit_num = btm_le_state_combo_tbl[0][request_state - 1];
   2676   const uint8_t* ble_supported_states =
   2677       controller_get_interface()->get_ble_supported_states();
   2678 
   2679   if (!BTM_LE_STATES_SUPPORTED(ble_supported_states, bit_num)) {
   2680     BTM_TRACE_ERROR("state requested not supported: %d", request_state);
   2681     return rt;
   2682   }
   2683 
   2684   rt = true;
   2685   /* make sure currently active states are all supported in conjunction with the
   2686      requested state. If the bit in table is UNSUPPORTED, the combination is not
   2687      supported */
   2688   while (cur_states != 0) {
   2689     if (cur_states & 0x01) {
   2690       uint8_t bit_num = btm_le_state_combo_tbl[request_state][state_offset];
   2691       if (bit_num != UNSUPPORTED) {
   2692         if (!BTM_LE_STATES_SUPPORTED(ble_supported_states, bit_num)) {
   2693           rt = false;
   2694           break;
   2695         }
   2696       }
   2697     }
   2698     cur_states >>= 1;
   2699     state_offset++;
   2700   }
   2701   return rt;
   2702 }
   2703