1 /*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19 #include <stdint.h>
20 #include <string.h>
21 #include <errno.h>
22 #include <stdio.h>
23 #include "os/os.h"
24 #include "nimble/hci_common.h"
25 #include "nimble/ble_hci_trans.h"
26 #include "host/ble_gap.h"
27 #include "host/ble_monitor.h"
28 #include "ble_hs_priv.h"
29 #include "ble_hs_dbg_priv.h"
30
31 _Static_assert(sizeof (struct hci_data_hdr) == BLE_HCI_DATA_HDR_SZ,
32 "struct hci_data_hdr must be 4 bytes");
33
34 typedef int ble_hs_hci_evt_fn(uint8_t event_code, uint8_t *data, int len);
35 static ble_hs_hci_evt_fn ble_hs_hci_evt_disconn_complete;
36 static ble_hs_hci_evt_fn ble_hs_hci_evt_encrypt_change;
37 static ble_hs_hci_evt_fn ble_hs_hci_evt_hw_error;
38 static ble_hs_hci_evt_fn ble_hs_hci_evt_num_completed_pkts;
39 static ble_hs_hci_evt_fn ble_hs_hci_evt_enc_key_refresh;
40 static ble_hs_hci_evt_fn ble_hs_hci_evt_le_meta;
41
42 typedef int ble_hs_hci_evt_le_fn(uint8_t subevent, uint8_t *data, int len);
43 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_conn_complete;
44 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_adv_rpt;
45 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_conn_upd_complete;
46 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_lt_key_req;
47 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_conn_parm_req;
48 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_dir_adv_rpt;
49 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_phy_update_complete;
50 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_ext_adv_rpt;
51 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_rd_rem_used_feat_complete;
52 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_scan_timeout;
53 static ble_hs_hci_evt_le_fn ble_hs_hci_evt_le_adv_set_terminated;
54
55 /* Statistics */
56 struct host_hci_stats
57 {
58 uint32_t events_rxd;
59 uint32_t good_acks_rxd;
60 uint32_t bad_acks_rxd;
61 uint32_t unknown_events_rxd;
62 };
63
64 #define BLE_HS_HCI_EVT_TIMEOUT 50 /* Milliseconds. */
65
66 /** Dispatch table for incoming HCI events. Sorted by event code field. */
67 struct ble_hs_hci_evt_dispatch_entry {
68 uint8_t event_code;
69 ble_hs_hci_evt_fn *cb;
70 };
71
72 static const struct ble_hs_hci_evt_dispatch_entry ble_hs_hci_evt_dispatch[] = {
73 { BLE_HCI_EVCODE_DISCONN_CMP, ble_hs_hci_evt_disconn_complete },
74 { BLE_HCI_EVCODE_ENCRYPT_CHG, ble_hs_hci_evt_encrypt_change },
75 { BLE_HCI_EVCODE_HW_ERROR, ble_hs_hci_evt_hw_error },
76 { BLE_HCI_EVCODE_NUM_COMP_PKTS, ble_hs_hci_evt_num_completed_pkts },
77 { BLE_HCI_EVCODE_ENC_KEY_REFRESH, ble_hs_hci_evt_enc_key_refresh },
78 { BLE_HCI_EVCODE_LE_META, ble_hs_hci_evt_le_meta },
79 };
80
81 #define BLE_HS_HCI_EVT_DISPATCH_SZ \
82 (sizeof ble_hs_hci_evt_dispatch / sizeof ble_hs_hci_evt_dispatch[0])
83
84 /** Dispatch table for incoming LE meta events. Sorted by subevent field. */
85 struct ble_hs_hci_evt_le_dispatch_entry {
86 uint8_t subevent;
87 ble_hs_hci_evt_le_fn *cb;
88 };
89
90 static const struct ble_hs_hci_evt_le_dispatch_entry
91 ble_hs_hci_evt_le_dispatch[] = {
92 { BLE_HCI_LE_SUBEV_CONN_COMPLETE, ble_hs_hci_evt_le_conn_complete },
93 { BLE_HCI_LE_SUBEV_ADV_RPT, ble_hs_hci_evt_le_adv_rpt },
94 { BLE_HCI_LE_SUBEV_CONN_UPD_COMPLETE,
95 ble_hs_hci_evt_le_conn_upd_complete },
96 { BLE_HCI_LE_SUBEV_LT_KEY_REQ, ble_hs_hci_evt_le_lt_key_req },
97 { BLE_HCI_LE_SUBEV_REM_CONN_PARM_REQ, ble_hs_hci_evt_le_conn_parm_req },
98 { BLE_HCI_LE_SUBEV_ENH_CONN_COMPLETE, ble_hs_hci_evt_le_conn_complete },
99 { BLE_HCI_LE_SUBEV_DIRECT_ADV_RPT, ble_hs_hci_evt_le_dir_adv_rpt },
100 { BLE_HCI_LE_SUBEV_PHY_UPDATE_COMPLETE,
101 ble_hs_hci_evt_le_phy_update_complete },
102 { BLE_HCI_LE_SUBEV_EXT_ADV_RPT, ble_hs_hci_evt_le_ext_adv_rpt },
103 { BLE_HCI_LE_SUBEV_RD_REM_USED_FEAT,
104 ble_hs_hci_evt_le_rd_rem_used_feat_complete },
105 { BLE_HCI_LE_SUBEV_SCAN_TIMEOUT,
106 ble_hs_hci_evt_le_scan_timeout },
107 { BLE_HCI_LE_SUBEV_ADV_SET_TERMINATED,
108 ble_hs_hci_evt_le_adv_set_terminated },
109 };
110
111 #define BLE_HS_HCI_EVT_LE_DISPATCH_SZ \
112 (sizeof ble_hs_hci_evt_le_dispatch / sizeof ble_hs_hci_evt_le_dispatch[0])
113
114 static const struct ble_hs_hci_evt_dispatch_entry *
ble_hs_hci_evt_dispatch_find(uint8_t event_code)115 ble_hs_hci_evt_dispatch_find(uint8_t event_code)
116 {
117 const struct ble_hs_hci_evt_dispatch_entry *entry;
118 int i;
119
120 for (i = 0; i < BLE_HS_HCI_EVT_DISPATCH_SZ; i++) {
121 entry = ble_hs_hci_evt_dispatch + i;
122 if (entry->event_code == event_code) {
123 return entry;
124 }
125 }
126
127 return NULL;
128 }
129
130 static const struct ble_hs_hci_evt_le_dispatch_entry *
ble_hs_hci_evt_le_dispatch_find(uint8_t event_code)131 ble_hs_hci_evt_le_dispatch_find(uint8_t event_code)
132 {
133 const struct ble_hs_hci_evt_le_dispatch_entry *entry;
134 int i;
135
136 for (i = 0; i < BLE_HS_HCI_EVT_LE_DISPATCH_SZ; i++) {
137 entry = ble_hs_hci_evt_le_dispatch + i;
138 if (entry->subevent == event_code) {
139 return entry;
140 }
141 }
142
143 return NULL;
144 }
145
146 static int
ble_hs_hci_evt_disconn_complete(uint8_t event_code,uint8_t * data,int len)147 ble_hs_hci_evt_disconn_complete(uint8_t event_code, uint8_t *data, int len)
148 {
149 struct hci_disconn_complete evt;
150 const struct ble_hs_conn *conn;
151
152 if (len < BLE_HCI_EVENT_DISCONN_COMPLETE_LEN) {
153 return BLE_HS_ECONTROLLER;
154 }
155
156 evt.status = data[2];
157 evt.connection_handle = get_le16(data + 3);
158 evt.reason = data[5];
159
160 ble_hs_lock();
161 conn = ble_hs_conn_find(evt.connection_handle);
162 if (conn != NULL) {
163 ble_hs_hci_add_avail_pkts(conn->bhc_outstanding_pkts);
164 }
165 ble_hs_unlock();
166
167 ble_gap_rx_disconn_complete(&evt);
168
169 return 0;
170 }
171
172 static int
ble_hs_hci_evt_encrypt_change(uint8_t event_code,uint8_t * data,int len)173 ble_hs_hci_evt_encrypt_change(uint8_t event_code, uint8_t *data, int len)
174 {
175 struct hci_encrypt_change evt;
176
177 if (len < BLE_HCI_EVENT_ENCRYPT_CHG_LEN) {
178 return BLE_HS_ECONTROLLER;
179 }
180
181 evt.status = data[2];
182 evt.connection_handle = get_le16(data + 3);
183 evt.encryption_enabled = data[5];
184
185 ble_sm_enc_change_rx(&evt);
186
187 return 0;
188 }
189
190 static int
ble_hs_hci_evt_hw_error(uint8_t event_code,uint8_t * data,int len)191 ble_hs_hci_evt_hw_error(uint8_t event_code, uint8_t *data, int len)
192 {
193 uint8_t hw_code;
194
195 if (len < BLE_HCI_EVENT_HW_ERROR_LEN) {
196 return BLE_HS_ECONTROLLER;
197 }
198
199 hw_code = data[0];
200 ble_hs_hw_error(hw_code);
201
202 return 0;
203 }
204
205 static int
ble_hs_hci_evt_enc_key_refresh(uint8_t event_code,uint8_t * data,int len)206 ble_hs_hci_evt_enc_key_refresh(uint8_t event_code, uint8_t *data, int len)
207 {
208 struct hci_encrypt_key_refresh evt;
209
210 if (len < BLE_HCI_EVENT_ENC_KEY_REFRESH_LEN) {
211 return BLE_HS_ECONTROLLER;
212 }
213
214 evt.status = data[2];
215 evt.connection_handle = get_le16(data + 3);
216
217 ble_sm_enc_key_refresh_rx(&evt);
218
219 return 0;
220 }
221
222 static int
ble_hs_hci_evt_num_completed_pkts(uint8_t event_code,uint8_t * data,int len)223 ble_hs_hci_evt_num_completed_pkts(uint8_t event_code, uint8_t *data, int len)
224 {
225 struct ble_hs_conn *conn;
226 uint16_t num_pkts;
227 uint16_t handle;
228 uint8_t num_handles;
229 int tx_outstanding;
230 int off;
231 int i;
232
233 if (len < BLE_HCI_EVENT_HDR_LEN + BLE_HCI_EVENT_NUM_COMP_PKTS_HDR_LEN) {
234 return BLE_HS_ECONTROLLER;
235 }
236
237 off = BLE_HCI_EVENT_HDR_LEN;
238 num_handles = data[off];
239 if (len < BLE_HCI_EVENT_NUM_COMP_PKTS_HDR_LEN +
240 num_handles * BLE_HCI_EVENT_NUM_COMP_PKTS_ENT_LEN) {
241 return BLE_HS_ECONTROLLER;
242 }
243 off++;
244
245 /* If we were previously blocked due to controller buffer exhaustion, and
246 * this event indicates that some buffers have been freed, then the host
247 * needs to resume transmitting. `tx_outstanding` keeps track of whether
248 * this is the case.
249 */
250 tx_outstanding = 0;
251
252 for (i = 0; i < num_handles; i++) {
253 handle = get_le16(data + off);
254 num_pkts = get_le16(data + off + 2);
255 off += (2 * sizeof(uint16_t));
256
257 if (num_pkts > 0) {
258 ble_hs_lock();
259 conn = ble_hs_conn_find(handle);
260 if (conn != NULL) {
261 if (conn->bhc_outstanding_pkts < num_pkts) {
262 ble_hs_sched_reset(BLE_HS_ECONTROLLER);
263 } else {
264 conn->bhc_outstanding_pkts -= num_pkts;
265 }
266
267 if (ble_hs_hci_avail_pkts == 0) {
268 tx_outstanding = 1;
269 }
270
271 ble_hs_hci_add_avail_pkts(num_pkts);
272 }
273 ble_hs_unlock();
274 }
275 }
276
277 if (tx_outstanding) {
278 ble_hs_wakeup_tx();
279 }
280
281 return 0;
282 }
283
284 static int
ble_hs_hci_evt_le_meta(uint8_t event_code,uint8_t * data,int len)285 ble_hs_hci_evt_le_meta(uint8_t event_code, uint8_t *data, int len)
286 {
287 const struct ble_hs_hci_evt_le_dispatch_entry *entry;
288 uint8_t subevent;
289 int rc;
290
291 if (len < BLE_HCI_EVENT_HDR_LEN + BLE_HCI_LE_MIN_LEN) {
292 return BLE_HS_ECONTROLLER;
293 }
294
295 subevent = data[2];
296 entry = ble_hs_hci_evt_le_dispatch_find(subevent);
297 if (entry != NULL) {
298 rc = entry->cb(subevent, data + BLE_HCI_EVENT_HDR_LEN,
299 len - BLE_HCI_EVENT_HDR_LEN);
300 if (rc != 0) {
301 return rc;
302 }
303 }
304
305 return 0;
306 }
307
308 #if MYNEWT_VAL(BLE_EXT_ADV)
309 static struct hci_le_conn_complete pend_conn_complete;
310 #endif
311
312 static int
ble_hs_hci_evt_le_conn_complete(uint8_t subevent,uint8_t * data,int len)313 ble_hs_hci_evt_le_conn_complete(uint8_t subevent, uint8_t *data, int len)
314 {
315 struct hci_le_conn_complete evt;
316 int extended_offset = 0;
317
318 if (len < BLE_HCI_LE_CONN_COMPLETE_LEN) {
319 return BLE_HS_ECONTROLLER;
320 }
321
322 /* this code processes two different events that are really similar */
323 if ((subevent == BLE_HCI_LE_SUBEV_ENH_CONN_COMPLETE) &&
324 ( len < BLE_HCI_LE_ENH_CONN_COMPLETE_LEN)) {
325 return BLE_HS_ECONTROLLER;
326 }
327
328 memset(&evt, 0, sizeof(evt));
329
330 evt.subevent_code = data[0];
331 evt.status = data[1];
332
333 if (evt.status == BLE_ERR_SUCCESS) {
334 evt.connection_handle = get_le16(data + 2);
335 evt.role = data[4];
336 evt.peer_addr_type = data[5];
337 memcpy(evt.peer_addr, data + 6, BLE_DEV_ADDR_LEN);
338
339 /* enhanced connection event has the same information with these
340 * extra fields stuffed into the middle */
341 if (subevent == BLE_HCI_LE_SUBEV_ENH_CONN_COMPLETE) {
342 memcpy(evt.local_rpa, data + 12, BLE_DEV_ADDR_LEN);
343 memcpy(evt.peer_rpa, data + 18, BLE_DEV_ADDR_LEN);
344 extended_offset = 12;
345 } else {
346 memset(evt.local_rpa, 0, BLE_DEV_ADDR_LEN);
347 memset(evt.peer_rpa, 0, BLE_DEV_ADDR_LEN);
348 }
349
350 evt.conn_itvl = get_le16(data + 12 + extended_offset);
351 evt.conn_latency = get_le16(data + 14 + extended_offset);
352 evt.supervision_timeout = get_le16(data + 16 + extended_offset);
353 evt.master_clk_acc = data[18 + extended_offset];
354 } else {
355 #if MYNEWT_VAL(BLE_HS_DEBUG)
356 evt.connection_handle = BLE_HS_CONN_HANDLE_NONE;
357 #endif
358 }
359
360 #if MYNEWT_VAL(BLE_EXT_ADV)
361 if (evt.status == BLE_ERR_DIR_ADV_TMO ||
362 evt.role == BLE_HCI_LE_CONN_COMPLETE_ROLE_SLAVE) {
363 /* store this until we get set terminated event with adv handle */
364 memcpy(&pend_conn_complete, &evt, sizeof(evt));
365 return 0;
366 }
367 #endif
368 return ble_gap_rx_conn_complete(&evt, 0);
369 }
370
371 static int
ble_hs_hci_evt_le_adv_rpt_first_pass(uint8_t * data,int len)372 ble_hs_hci_evt_le_adv_rpt_first_pass(uint8_t *data, int len)
373 {
374 uint8_t num_reports;
375 int off;
376 int i;
377
378 if (len < BLE_HCI_LE_ADV_RPT_MIN_LEN) {
379 return BLE_HS_ECONTROLLER;
380 }
381
382 num_reports = data[1];
383 if (num_reports < BLE_HCI_LE_ADV_RPT_NUM_RPTS_MIN ||
384 num_reports > BLE_HCI_LE_ADV_RPT_NUM_RPTS_MAX) {
385 return BLE_HS_EBADDATA;
386 }
387
388 off = 2; /* Subevent code and num reports. */
389 for (i = 0; i < num_reports; i++) {
390 /* Move past event type (1), address type (1) and address (6) */
391 off += 8;
392
393 /* Add advertising data length (N), length (1) and rssi (1) */
394 off += data[off];
395 off += 2;
396
397 /* Make sure we are not past length */
398 if (off > len) {
399 return BLE_HS_ECONTROLLER;
400 }
401 }
402
403 /* Make sure length was correct */
404 if (off != len) {
405 return BLE_HS_ECONTROLLER;
406 }
407
408 return 0;
409 }
410
411 static int
ble_hs_hci_evt_le_adv_rpt(uint8_t subevent,uint8_t * data,int len)412 ble_hs_hci_evt_le_adv_rpt(uint8_t subevent, uint8_t *data, int len)
413 {
414 struct ble_gap_disc_desc desc = {0};
415 uint8_t num_reports;
416 int off;
417 int rc;
418 int i;
419
420 /* Validate the event is formatted correctly */
421 rc = ble_hs_hci_evt_le_adv_rpt_first_pass(data, len);
422 if (rc != 0) {
423 return rc;
424 }
425
426 desc.direct_addr = *BLE_ADDR_ANY;
427
428 off = 2; /* skip sub-event and num reports */
429 num_reports = data[1];
430 for (i = 0; i < num_reports; i++) {
431 desc.event_type = data[off];
432 ++off;
433
434 desc.addr.type = data[off];
435 ++off;
436
437 memcpy(desc.addr.val, data + off, 6);
438 off += 6;
439
440 desc.length_data = data[off];
441 ++off;
442
443 desc.data = data + off;
444 off += desc.length_data;
445
446 desc.rssi = data[off];
447 ++off;
448
449 ble_gap_rx_adv_report(&desc);
450 }
451
452 return 0;
453 }
454
455 static int
ble_hs_hci_evt_le_dir_adv_rpt(uint8_t subevent,uint8_t * data,int len)456 ble_hs_hci_evt_le_dir_adv_rpt(uint8_t subevent, uint8_t *data, int len)
457 {
458 struct ble_gap_disc_desc desc = {0};
459 uint8_t num_reports;
460 int suboff;
461 int off;
462 int i;
463
464 if (len < BLE_HCI_LE_ADV_DIRECT_RPT_LEN) {
465 return BLE_HS_ECONTROLLER;
466 }
467
468 num_reports = data[1];
469 if (len != 2 + num_reports * BLE_HCI_LE_ADV_DIRECT_RPT_SUB_LEN) {
470 return BLE_HS_ECONTROLLER;
471 }
472
473 /* Data fields not present in a direct advertising report. */
474 desc.data = NULL;
475 desc.length_data = 0;
476
477 for (i = 0; i < num_reports; i++) {
478 suboff = 0;
479
480 off = 2 + suboff * num_reports + i;
481 desc.event_type = data[off];
482 suboff++;
483
484 off = 2 + suboff * num_reports + i;
485 desc.addr.type = data[off];
486 suboff++;
487
488 off = 2 + suboff * num_reports + i * 6;
489 memcpy(desc.addr.val, data + off, 6);
490 suboff += 6;
491
492 off = 2 + suboff * num_reports + i;
493 desc.direct_addr.type = data[off];
494 suboff++;
495
496 off = 2 + suboff * num_reports + i * 6;
497 memcpy(desc.direct_addr.val, data + off, 6);
498 suboff += 6;
499
500 off = 2 + suboff * num_reports + i;
501 desc.rssi = data[off];
502 suboff++;
503
504 ble_gap_rx_adv_report(&desc);
505 }
506
507 return 0;
508 }
509
510 static int
ble_hs_hci_evt_le_rd_rem_used_feat_complete(uint8_t subevent,uint8_t * data,int len)511 ble_hs_hci_evt_le_rd_rem_used_feat_complete(uint8_t subevent, uint8_t *data,
512 int len)
513 {
514 struct hci_le_rd_rem_supp_feat_complete evt;
515
516 if (len < BLE_HCI_LE_RD_REM_USED_FEAT_LEN) {
517 return BLE_HS_ECONTROLLER;
518 }
519
520 evt.subevent_code = data[0];
521 evt.status = data[1];
522 evt.connection_handle = get_le16(data + 2);
523 memcpy(evt.features, data + 4, 8);
524
525 ble_gap_rx_rd_rem_sup_feat_complete(&evt);
526
527 return 0;
528 }
529
530 #if MYNEWT_VAL(BLE_EXT_ADV)
531 static int
ble_hs_hci_decode_legacy_type(uint16_t evt_type)532 ble_hs_hci_decode_legacy_type(uint16_t evt_type)
533 {
534 switch (evt_type) {
535 case BLE_HCI_LEGACY_ADV_EVTYPE_ADV_IND:
536 return BLE_HCI_ADV_RPT_EVTYPE_ADV_IND;
537 case BLE_HCI_LEGACY_ADV_EVTYPE_ADV_DIRECT_IND:
538 return BLE_HCI_ADV_RPT_EVTYPE_DIR_IND;
539 case BLE_HCI_LEGACY_ADV_EVTYPE_ADV_SCAN_IND:
540 return BLE_HCI_ADV_RPT_EVTYPE_SCAN_IND;
541 case BLE_HCI_LEGACY_ADV_EVTYPE_ADV_NONCON_IND:
542 return BLE_HCI_ADV_RPT_EVTYPE_NONCONN_IND;
543 case BLE_HCI_LEGACY_ADV_EVTYPE_SCAN_RSP_ADV_IND:
544 return BLE_HCI_ADV_RPT_EVTYPE_SCAN_RSP;
545 default:
546 return -1;
547 }
548 }
549 #endif
550
551 static int
ble_hs_hci_evt_le_ext_adv_rpt(uint8_t subevent,uint8_t * data,int len)552 ble_hs_hci_evt_le_ext_adv_rpt(uint8_t subevent, uint8_t *data, int len)
553 {
554 #if MYNEWT_VAL(BLE_EXT_ADV)
555 struct ble_gap_ext_disc_desc desc;
556 struct hci_ext_adv_report *ext_adv;
557 struct hci_ext_adv_report_param *params;
558 int num_reports;
559 int i;
560 int legacy_event_type;
561
562 if (len < sizeof(*ext_adv)) {
563 return BLE_HS_EBADDATA;
564 }
565
566 ext_adv = (struct hci_ext_adv_report *) data;
567 num_reports = ext_adv->num_reports;
568 if (num_reports < BLE_HCI_LE_ADV_RPT_NUM_RPTS_MIN ||
569 num_reports > BLE_HCI_LE_ADV_RPT_NUM_RPTS_MAX) {
570
571 return BLE_HS_EBADDATA;
572 }
573
574 if (len < (sizeof(*ext_adv) + ext_adv->num_reports * sizeof(*params))) {
575 return BLE_HS_ECONTROLLER;
576 }
577
578 params = &ext_adv->params[0];
579 for (i = 0; i < num_reports; i++) {
580 memset(&desc, 0, sizeof(desc));
581
582 desc.props = (params->evt_type) & 0x1F;
583 if (desc.props & BLE_HCI_ADV_LEGACY_MASK) {
584 legacy_event_type = ble_hs_hci_decode_legacy_type(params->evt_type);
585 if (legacy_event_type < 0) {
586 params += 1;
587 continue;
588 }
589 desc.legacy_event_type = legacy_event_type;
590 desc.data_status = BLE_GAP_EXT_ADV_DATA_STATUS_COMPLETE;
591 } else {
592 switch(params->evt_type & BLE_HCI_ADV_DATA_STATUS_MASK) {
593 case BLE_HCI_ADV_DATA_STATUS_COMPLETE:
594 desc.data_status = BLE_GAP_EXT_ADV_DATA_STATUS_COMPLETE;
595 break;
596 case BLE_HCI_ADV_DATA_STATUS_INCOMPLETE:
597 desc.data_status = BLE_GAP_EXT_ADV_DATA_STATUS_INCOMPLETE;
598 break;
599 case BLE_HCI_ADV_DATA_STATUS_TRUNCATED:
600 desc.data_status = BLE_GAP_EXT_ADV_DATA_STATUS_TRUNCATED;
601 break;
602 default:
603 assert(false);
604 }
605 }
606 desc.addr.type = params->addr_type;
607 memcpy(desc.addr.val, params->addr, 6);
608 desc.length_data = params->adv_data_len;
609 desc.data = params->adv_data;
610 desc.rssi = params->rssi;
611 desc.tx_power = params->tx_power;
612 memcpy(desc.direct_addr.val, params->dir_addr, 6);
613 desc.direct_addr.type = params->dir_addr_type;
614 desc.sid = params->sid;
615 desc.prim_phy = params->prim_phy;
616 desc.sec_phy = params->sec_phy;
617 ble_gap_rx_ext_adv_report(&desc);
618 params += 1;
619 }
620 #endif
621 return 0;
622 }
623
624 static int
ble_hs_hci_evt_le_scan_timeout(uint8_t subevent,uint8_t * data,int len)625 ble_hs_hci_evt_le_scan_timeout(uint8_t subevent, uint8_t *data, int len)
626 {
627 #if MYNEWT_VAL(BLE_EXT_ADV) && NIMBLE_BLE_SCAN
628 ble_gap_rx_le_scan_timeout();
629 #endif
630 return 0;
631 }
632
633 static int
ble_hs_hci_evt_le_adv_set_terminated(uint8_t subevent,uint8_t * data,int len)634 ble_hs_hci_evt_le_adv_set_terminated(uint8_t subevent, uint8_t *data, int len)
635 {
636 #if MYNEWT_VAL(BLE_EXT_ADV)
637 struct hci_le_adv_set_terminated evt;
638
639 if (len < BLE_HCI_LE_SUBEV_ADV_SET_TERMINATED_LEN) {
640 return BLE_HS_ECONTROLLER;
641 }
642
643 evt.subevent_code = data[0];
644 evt.status = data[1];
645 evt.adv_handle = data[2];
646 evt.conn_handle = get_le16(data + 3);
647 evt.completed_events = data[5];
648
649 if (evt.status == 0) {
650 /* ignore return code as we need to terminate advertising set anyway */
651 ble_gap_rx_conn_complete(&pend_conn_complete, evt.adv_handle);
652 }
653 ble_gap_rx_adv_set_terminated(&evt);
654 #endif
655
656 return 0;
657 }
658
659 static int
ble_hs_hci_evt_le_conn_upd_complete(uint8_t subevent,uint8_t * data,int len)660 ble_hs_hci_evt_le_conn_upd_complete(uint8_t subevent, uint8_t *data, int len)
661 {
662 struct hci_le_conn_upd_complete evt;
663
664 if (len < BLE_HCI_LE_CONN_UPD_LEN) {
665 return BLE_HS_ECONTROLLER;
666 }
667
668 evt.subevent_code = data[0];
669 evt.status = data[1];
670 evt.connection_handle = get_le16(data + 2);
671 evt.conn_itvl = get_le16(data + 4);
672 evt.conn_latency = get_le16(data + 6);
673 evt.supervision_timeout = get_le16(data + 8);
674
675 if (evt.status == 0) {
676 if (evt.conn_itvl < BLE_HCI_CONN_ITVL_MIN ||
677 evt.conn_itvl > BLE_HCI_CONN_ITVL_MAX) {
678
679 return BLE_HS_EBADDATA;
680 }
681 if (evt.conn_latency < BLE_HCI_CONN_LATENCY_MIN ||
682 evt.conn_latency > BLE_HCI_CONN_LATENCY_MAX) {
683
684 return BLE_HS_EBADDATA;
685 }
686 if (evt.supervision_timeout < BLE_HCI_CONN_SPVN_TIMEOUT_MIN ||
687 evt.supervision_timeout > BLE_HCI_CONN_SPVN_TIMEOUT_MAX) {
688
689 return BLE_HS_EBADDATA;
690 }
691 }
692
693 ble_gap_rx_update_complete(&evt);
694
695 return 0;
696 }
697
698 static int
ble_hs_hci_evt_le_lt_key_req(uint8_t subevent,uint8_t * data,int len)699 ble_hs_hci_evt_le_lt_key_req(uint8_t subevent, uint8_t *data, int len)
700 {
701 struct hci_le_lt_key_req evt;
702
703 if (len < BLE_HCI_LE_LT_KEY_REQ_LEN) {
704 return BLE_HS_ECONTROLLER;
705 }
706
707 evt.subevent_code = data[0];
708 evt.connection_handle = get_le16(data + 1);
709 evt.random_number = get_le64(data + 3);
710 evt.encrypted_diversifier = get_le16(data + 11);
711
712 ble_sm_ltk_req_rx(&evt);
713
714 return 0;
715 }
716
717 static int
ble_hs_hci_evt_le_conn_parm_req(uint8_t subevent,uint8_t * data,int len)718 ble_hs_hci_evt_le_conn_parm_req(uint8_t subevent, uint8_t *data, int len)
719 {
720 struct hci_le_conn_param_req evt;
721
722 if (len < BLE_HCI_LE_REM_CONN_PARM_REQ_LEN) {
723 return BLE_HS_ECONTROLLER;
724 }
725
726 evt.subevent_code = data[0];
727 evt.connection_handle = get_le16(data + 1);
728 evt.itvl_min = get_le16(data + 3);
729 evt.itvl_max = get_le16(data + 5);
730 evt.latency = get_le16(data + 7);
731 evt.timeout = get_le16(data + 9);
732
733 if (evt.itvl_min < BLE_HCI_CONN_ITVL_MIN ||
734 evt.itvl_max > BLE_HCI_CONN_ITVL_MAX ||
735 evt.itvl_min > evt.itvl_max) {
736
737 return BLE_HS_EBADDATA;
738 }
739 if (evt.latency < BLE_HCI_CONN_LATENCY_MIN ||
740 evt.latency > BLE_HCI_CONN_LATENCY_MAX) {
741
742 return BLE_HS_EBADDATA;
743 }
744 if (evt.timeout < BLE_HCI_CONN_SPVN_TIMEOUT_MIN ||
745 evt.timeout > BLE_HCI_CONN_SPVN_TIMEOUT_MAX) {
746
747 return BLE_HS_EBADDATA;
748 }
749
750 ble_gap_rx_param_req(&evt);
751
752 return 0;
753 }
754
755 static int
ble_hs_hci_evt_le_phy_update_complete(uint8_t subevent,uint8_t * data,int len)756 ble_hs_hci_evt_le_phy_update_complete(uint8_t subevent, uint8_t *data, int len)
757 {
758 struct hci_le_phy_upd_complete evt;
759
760 if (len < BLE_HCI_LE_PHY_UPD_LEN) {
761 return BLE_HS_ECONTROLLER;
762 }
763
764 evt.subevent_code = data[0];
765 evt.status = data[1];
766 evt.connection_handle = get_le16(data + 2);
767 evt.tx_phy = data[4];
768 evt.rx_phy = data[5];
769
770 ble_gap_rx_phy_update_complete(&evt);
771
772 return 0;
773 }
774
775 int
ble_hs_hci_evt_process(uint8_t * data)776 ble_hs_hci_evt_process(uint8_t *data)
777 {
778 const struct ble_hs_hci_evt_dispatch_entry *entry;
779 uint8_t event_code;
780 uint8_t param_len;
781 int event_len;
782 int rc;
783
784 /* Count events received */
785 STATS_INC(ble_hs_stats, hci_event);
786
787 /* Display to console */
788 ble_hs_dbg_event_disp(data);
789
790 /* Process the event */
791 event_code = data[0];
792 param_len = data[1];
793
794 event_len = param_len + 2;
795
796 entry = ble_hs_hci_evt_dispatch_find(event_code);
797 if (entry == NULL) {
798 STATS_INC(ble_hs_stats, hci_unknown_event);
799 rc = BLE_HS_ENOTSUP;
800 } else {
801 rc = entry->cb(event_code, data, event_len);
802 }
803
804 ble_hci_trans_buf_free(data);
805
806 return rc;
807 }
808
809 /**
810 * Called when a data packet is received from the controller. This function
811 * consumes the supplied mbuf, regardless of the outcome.
812 *
813 * @param om The incoming data packet, beginning with the
814 * HCI ACL data header.
815 *
816 * @return 0 on success; nonzero on failure.
817 */
818 int
ble_hs_hci_evt_acl_process(struct os_mbuf * om)819 ble_hs_hci_evt_acl_process(struct os_mbuf *om)
820 {
821 struct hci_data_hdr hci_hdr;
822 struct ble_hs_conn *conn;
823 ble_l2cap_rx_fn *rx_cb;
824 uint16_t conn_handle;
825 int reject_cid;
826 int rc;
827
828 rc = ble_hs_hci_util_data_hdr_strip(om, &hci_hdr);
829 if (rc != 0) {
830 goto err;
831 }
832
833 #if (BLETEST_THROUGHPUT_TEST == 0)
834 #if !BLE_MONITOR
835 BLE_HS_LOG(DEBUG, "ble_hs_hci_evt_acl_process(): conn_handle=%u pb=%x "
836 "len=%u data=",
837 BLE_HCI_DATA_HANDLE(hci_hdr.hdh_handle_pb_bc),
838 BLE_HCI_DATA_PB(hci_hdr.hdh_handle_pb_bc),
839 hci_hdr.hdh_len);
840 ble_hs_log_mbuf(om);
841 BLE_HS_LOG(DEBUG, "\n");
842 #endif
843 #endif
844
845 if (hci_hdr.hdh_len != OS_MBUF_PKTHDR(om)->omp_len) {
846 rc = BLE_HS_EBADDATA;
847 goto err;
848 }
849
850 conn_handle = BLE_HCI_DATA_HANDLE(hci_hdr.hdh_handle_pb_bc);
851
852 ble_hs_lock();
853
854 conn = ble_hs_conn_find(conn_handle);
855 if (conn == NULL) {
856 /* Peer not connected; quietly discard packet. */
857 rc = BLE_HS_ENOTCONN;
858 reject_cid = -1;
859 } else {
860 /* Forward ACL data to L2CAP. */
861 rc = ble_l2cap_rx(conn, &hci_hdr, om, &rx_cb, &reject_cid);
862 om = NULL;
863 }
864
865 ble_hs_unlock();
866
867 switch (rc) {
868 case 0:
869 /* Final fragment received. */
870 BLE_HS_DBG_ASSERT(rx_cb != NULL);
871 rc = rx_cb(conn->bhc_rx_chan);
872 ble_l2cap_remove_rx(conn, conn->bhc_rx_chan);
873 break;
874
875 case BLE_HS_EAGAIN:
876 /* More fragments on the way. */
877 break;
878
879 default:
880 if (reject_cid != -1) {
881 ble_l2cap_sig_reject_invalid_cid_tx(conn_handle, 0, 0, reject_cid);
882 }
883 goto err;
884 }
885
886 return 0;
887
888 err:
889 os_mbuf_free_chain(om);
890 return rc;
891 }
892