xref: /btstack/src/hci.c (revision 2b6ecffc7fb32ca6316289f83fcad739ef69c659)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "hci.c"
39 
40 /*
41  *  hci.c
42  *
43  *  Created by Matthias Ringwald on 4/29/09.
44  *
45  */
46 
47 #include "btstack_config.h"
48 
49 
50 #ifdef ENABLE_CLASSIC
51 #ifdef HAVE_EMBEDDED_TICK
52 #include "btstack_run_loop_embedded.h"
53 #endif
54 #endif
55 
56 #ifdef HAVE_PLATFORM_IPHONE_OS
57 #include "../port/ios/src/btstack_control_iphone.h"
58 #endif
59 
60 #ifdef ENABLE_BLE
61 #include "gap.h"
62 #include "ble/le_device_db.h"
63 #endif
64 
65 #include <stdarg.h>
66 #include <string.h>
67 #include <inttypes.h>
68 
69 #include "btstack_debug.h"
70 #include "btstack_event.h"
71 #include "btstack_linked_list.h"
72 #include "btstack_memory.h"
73 #include "bluetooth_company_id.h"
74 #include "bluetooth_data_types.h"
75 #include "gap.h"
76 #include "hci.h"
77 #include "hci_cmd.h"
78 #include "hci_dump.h"
79 #include "ad_parser.h"
80 
81 #ifdef ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL
82 #ifndef HCI_HOST_ACL_PACKET_NUM
83 #error "ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL requires to define HCI_HOST_ACL_PACKET_NUM"
84 #endif
85 #ifndef HCI_HOST_ACL_PACKET_LEN
86 #error "ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL requires to define HCI_HOST_ACL_PACKET_LEN"
87 #endif
88 #ifndef HCI_HOST_SCO_PACKET_NUM
89 #error "ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL requires to define HCI_HOST_SCO_PACKET_NUM"
90 #endif
91 #ifndef HCI_HOST_SCO_PACKET_LEN
92 #error "ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL requires to define HCI_HOST_SCO_PACKET_LEN"
93 #endif
94 #endif
95 
96 #define HCI_CONNECTION_TIMEOUT_MS 10000
97 
98 #ifndef HCI_RESET_RESEND_TIMEOUT_MS
99 #define HCI_RESET_RESEND_TIMEOUT_MS 200
100 #endif
101 
102 // Names are arbitrarily shortened to 32 bytes if not requested otherwise
103 #ifndef GAP_INQUIRY_MAX_NAME_LEN
104 #define GAP_INQUIRY_MAX_NAME_LEN 32
105 #endif
106 
107 // GAP inquiry state: 0 = off, 0x01 - 0x30 = requested duration, 0xfe = active, 0xff = stop requested
108 #define GAP_INQUIRY_DURATION_MIN 0x01
109 #define GAP_INQUIRY_DURATION_MAX 0x30
110 #define GAP_INQUIRY_STATE_ACTIVE 0x80
111 #define GAP_INQUIRY_STATE_IDLE 0
112 #define GAP_INQUIRY_STATE_W2_CANCEL 0x81
113 #define GAP_INQUIRY_STATE_W4_CANCELLED 0x82
114 
115 // GAP Remote Name Request
116 #define GAP_REMOTE_NAME_STATE_IDLE 0
117 #define GAP_REMOTE_NAME_STATE_W2_SEND 1
118 #define GAP_REMOTE_NAME_STATE_W4_COMPLETE 2
119 
120 // GAP Pairing
121 #define GAP_PAIRING_STATE_IDLE                       0
122 #define GAP_PAIRING_STATE_SEND_PIN                   1
123 #define GAP_PAIRING_STATE_SEND_PIN_NEGATIVE          2
124 #define GAP_PAIRING_STATE_SEND_PASSKEY               3
125 #define GAP_PAIRING_STATE_SEND_PASSKEY_NEGATIVE      4
126 #define GAP_PAIRING_STATE_SEND_CONFIRMATION          5
127 #define GAP_PAIRING_STATE_SEND_CONFIRMATION_NEGATIVE 6
128 
129 
130 // prototypes
131 #ifdef ENABLE_CLASSIC
132 static void hci_update_scan_enable(void);
133 static void hci_emit_discoverable_enabled(uint8_t enabled);
134 static int  hci_local_ssp_activated(void);
135 static int  hci_remote_ssp_supported(hci_con_handle_t con_handle);
136 static bool hci_ssp_supported(hci_connection_t * connection);
137 static void hci_notify_if_sco_can_send_now(void);
138 static void hci_emit_connection_complete(bd_addr_t address, hci_con_handle_t con_handle, uint8_t status);
139 static gap_security_level_t gap_security_level_for_connection(hci_connection_t * connection);
140 static void hci_emit_security_level(hci_con_handle_t con_handle, gap_security_level_t level);
141 static void hci_connection_timeout_handler(btstack_timer_source_t *timer);
142 static void hci_connection_timestamp(hci_connection_t *connection);
143 static void hci_emit_l2cap_check_timeout(hci_connection_t *conn);
144 static void gap_inquiry_explode(uint8_t *packet, uint16_t size);
145 #endif
146 
147 static int  hci_power_control_on(void);
148 static void hci_power_control_off(void);
149 static void hci_state_reset(void);
150 static void hci_emit_transport_packet_sent(void);
151 static void hci_emit_disconnection_complete(hci_con_handle_t con_handle, uint8_t reason);
152 static void hci_emit_nr_connections_changed(void);
153 static void hci_emit_hci_open_failed(void);
154 static void hci_emit_dedicated_bonding_result(bd_addr_t address, uint8_t status);
155 static void hci_emit_event(uint8_t * event, uint16_t size, int dump);
156 static void hci_emit_acl_packet(uint8_t * packet, uint16_t size);
157 static void hci_run(void);
158 static int  hci_is_le_connection(hci_connection_t * connection);
159 static int  hci_number_free_acl_slots_for_connection_type( bd_addr_type_t address_type);
160 
161 #ifdef ENABLE_CLASSIC
162 static int hci_have_usb_transport(void);
163 #endif
164 
165 #ifdef ENABLE_BLE
166 #ifdef ENABLE_LE_CENTRAL
167 // called from test/ble_client/advertising_data_parser.c
168 void le_handle_advertisement_report(uint8_t *packet, uint16_t size);
169 static uint8_t hci_whitelist_remove(bd_addr_type_t address_type, const bd_addr_t address);
170 static hci_connection_t * gap_get_outgoing_connection(void);
171 #endif
172 #endif
173 
174 // the STACK is here
175 #ifndef HAVE_MALLOC
176 static hci_stack_t   hci_stack_static;
177 #endif
178 static hci_stack_t * hci_stack = NULL;
179 
180 #ifdef ENABLE_CLASSIC
181 // default name
182 static const char * default_classic_name = "BTstack 00:00:00:00:00:00";
183 
184 // test helper
185 static uint8_t disable_l2cap_timeouts = 0;
186 #endif
187 
188 /**
189  * create connection for given address
190  *
191  * @return connection OR NULL, if no memory left
192  */
193 static hci_connection_t * create_connection_for_bd_addr_and_type(const bd_addr_t addr, bd_addr_type_t addr_type){
194     log_info("create_connection_for_addr %s, type %x", bd_addr_to_str(addr), addr_type);
195     hci_connection_t * conn = btstack_memory_hci_connection_get();
196     if (!conn) return NULL;
197     bd_addr_copy(conn->address, addr);
198     conn->role = HCI_ROLE_INVALID;
199     conn->address_type = addr_type;
200     conn->con_handle = 0xffff;
201     conn->authentication_flags = AUTH_FLAGS_NONE;
202     conn->bonding_flags = 0;
203     conn->requested_security_level = LEVEL_0;
204 #ifdef ENABLE_CLASSIC
205     conn->request_role = HCI_ROLE_INVALID;
206     btstack_run_loop_set_timer_handler(&conn->timeout, hci_connection_timeout_handler);
207     btstack_run_loop_set_timer_context(&conn->timeout, conn);
208     hci_connection_timestamp(conn);
209 #endif
210     conn->acl_recombination_length = 0;
211     conn->acl_recombination_pos = 0;
212     conn->num_packets_sent = 0;
213 
214     conn->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
215 #ifdef ENABLE_BLE
216     conn->le_phy_update_all_phys = 0xff;
217 #endif
218 #ifdef ENABLE_LE_LIMIT_ACL_FRAGMENT_BY_MAX_OCTETS
219     conn->le_max_tx_octets = 27;
220 #endif
221     btstack_linked_list_add(&hci_stack->connections, (btstack_linked_item_t *) conn);
222     return conn;
223 }
224 
225 
226 /**
227  * get le connection parameter range
228 *
229  * @return le connection parameter range struct
230  */
231 void gap_get_connection_parameter_range(le_connection_parameter_range_t * range){
232     *range = hci_stack->le_connection_parameter_range;
233 }
234 
235 /**
236  * set le connection parameter range
237  *
238  */
239 
240 void gap_set_connection_parameter_range(le_connection_parameter_range_t *range){
241     hci_stack->le_connection_parameter_range = *range;
242 }
243 
244 /**
245  * @brief Test if connection parameters are inside in existing rage
246  * @param conn_interval_min (unit: 1.25ms)
247  * @param conn_interval_max (unit: 1.25ms)
248  * @param conn_latency
249  * @param supervision_timeout (unit: 10ms)
250  * @returns 1 if included
251  */
252 int gap_connection_parameter_range_included(le_connection_parameter_range_t * existing_range, uint16_t le_conn_interval_min, uint16_t le_conn_interval_max, uint16_t le_conn_latency, uint16_t le_supervision_timeout){
253     if (le_conn_interval_min < existing_range->le_conn_interval_min) return 0;
254     if (le_conn_interval_max > existing_range->le_conn_interval_max) return 0;
255 
256     if (le_conn_latency < existing_range->le_conn_latency_min) return 0;
257     if (le_conn_latency > existing_range->le_conn_latency_max) return 0;
258 
259     if (le_supervision_timeout < existing_range->le_supervision_timeout_min) return 0;
260     if (le_supervision_timeout > existing_range->le_supervision_timeout_max) return 0;
261 
262     return 1;
263 }
264 
265 /**
266  * @brief Set max number of connections in LE Peripheral role (if Bluetooth Controller supports it)
267  * @note: default: 1
268  * @param max_peripheral_connections
269  */
270 #ifdef ENABLE_LE_PERIPHERAL
271 void gap_set_max_number_peripheral_connections(int max_peripheral_connections){
272     hci_stack->le_max_number_peripheral_connections = max_peripheral_connections;
273 }
274 #endif
275 
276 /**
277  * get hci connections iterator
278  *
279  * @return hci connections iterator
280  */
281 
282 void hci_connections_get_iterator(btstack_linked_list_iterator_t *it){
283     btstack_linked_list_iterator_init(it, &hci_stack->connections);
284 }
285 
286 /**
287  * get connection for a given handle
288  *
289  * @return connection OR NULL, if not found
290  */
291 hci_connection_t * hci_connection_for_handle(hci_con_handle_t con_handle){
292     btstack_linked_list_iterator_t it;
293     btstack_linked_list_iterator_init(&it, &hci_stack->connections);
294     while (btstack_linked_list_iterator_has_next(&it)){
295         hci_connection_t * item = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
296         if ( item->con_handle == con_handle ) {
297             return item;
298         }
299     }
300     return NULL;
301 }
302 
303 /**
304  * get connection for given address
305  *
306  * @return connection OR NULL, if not found
307  */
308 hci_connection_t * hci_connection_for_bd_addr_and_type(const bd_addr_t  addr, bd_addr_type_t addr_type){
309     btstack_linked_list_iterator_t it;
310     btstack_linked_list_iterator_init(&it, &hci_stack->connections);
311     while (btstack_linked_list_iterator_has_next(&it)){
312         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
313         if (connection->address_type != addr_type)  continue;
314         if (memcmp(addr, connection->address, 6) != 0) continue;
315         return connection;
316     }
317     return NULL;
318 }
319 
320 inline static void connectionClearAuthenticationFlags(hci_connection_t * conn, hci_authentication_flags_t flags){
321     conn->authentication_flags = (hci_authentication_flags_t)(conn->authentication_flags & ~flags);
322 }
323 
324 inline static void connectionSetAuthenticationFlags(hci_connection_t * conn, hci_authentication_flags_t flags){
325     conn->authentication_flags = (hci_authentication_flags_t)(conn->authentication_flags | flags);
326 }
327 
328 #ifdef ENABLE_CLASSIC
329 
330 #ifdef ENABLE_SCO_OVER_HCI
331 static int hci_number_sco_connections(void){
332     int connections = 0;
333     btstack_linked_list_iterator_t it;
334     btstack_linked_list_iterator_init(&it, &hci_stack->connections);
335     while (btstack_linked_list_iterator_has_next(&it)){
336         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
337         if (connection->address_type != BD_ADDR_TYPE_SCO) continue;
338         connections++;
339     }
340     return connections;
341 }
342 #endif
343 
344 static void hci_connection_timeout_handler(btstack_timer_source_t *timer){
345     hci_connection_t * connection = (hci_connection_t *) btstack_run_loop_get_timer_context(timer);
346 #ifdef HAVE_EMBEDDED_TICK
347     if (btstack_run_loop_embedded_get_ticks() > connection->timestamp + btstack_run_loop_embedded_ticks_for_ms(HCI_CONNECTION_TIMEOUT_MS)){
348         // connections might be timed out
349         hci_emit_l2cap_check_timeout(connection);
350     }
351 #else
352     if (btstack_run_loop_get_time_ms() > (connection->timestamp + HCI_CONNECTION_TIMEOUT_MS)){
353         // connections might be timed out
354         hci_emit_l2cap_check_timeout(connection);
355     }
356 #endif
357 }
358 
359 static void hci_connection_timestamp(hci_connection_t *connection){
360 #ifdef HAVE_EMBEDDED_TICK
361     connection->timestamp = btstack_run_loop_embedded_get_ticks();
362 #else
363     connection->timestamp = btstack_run_loop_get_time_ms();
364 #endif
365 }
366 
367 /**
368  * add authentication flags and reset timer
369  * @note: assumes classic connection
370  * @note: bd_addr is passed in as litle endian uint8_t * as it is called from parsing packets
371  */
372 static void hci_add_connection_flags_for_flipped_bd_addr(uint8_t *bd_addr, hci_authentication_flags_t flags){
373     bd_addr_t addr;
374     reverse_bd_addr(bd_addr, addr);
375     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
376     if (conn) {
377         connectionSetAuthenticationFlags(conn, flags);
378         hci_connection_timestamp(conn);
379     }
380 }
381 
382 int  hci_authentication_active_for_handle(hci_con_handle_t handle){
383     hci_connection_t * conn = hci_connection_for_handle(handle);
384     if (!conn) return 0;
385     if (conn->authentication_flags & LEGACY_PAIRING_ACTIVE) return 1;
386     if (conn->authentication_flags & SSP_PAIRING_ACTIVE) return 1;
387     return 0;
388 }
389 
390 void gap_drop_link_key_for_bd_addr(bd_addr_t addr){
391     if (!hci_stack->link_key_db) return;
392     log_info("gap_drop_link_key_for_bd_addr: %s", bd_addr_to_str(addr));
393     hci_stack->link_key_db->delete_link_key(addr);
394 }
395 
396 void gap_store_link_key_for_bd_addr(bd_addr_t addr, link_key_t link_key, link_key_type_t type){
397     if (!hci_stack->link_key_db) return;
398     log_info("gap_store_link_key_for_bd_addr: %s, type %u", bd_addr_to_str(addr), type);
399     hci_stack->link_key_db->put_link_key(addr, link_key, type);
400 }
401 
402 bool gap_get_link_key_for_bd_addr(bd_addr_t addr, link_key_t link_key, link_key_type_t * type){
403 	if (!hci_stack->link_key_db) return false;
404 	int result = hci_stack->link_key_db->get_link_key(addr, link_key, type) != 0;
405 	log_info("link key for %s available %u, type %u", bd_addr_to_str(addr), result, (int) *type);
406 	return result;
407 }
408 
409 void gap_delete_all_link_keys(void){
410     bd_addr_t  addr;
411     link_key_t link_key;
412     link_key_type_t type;
413     btstack_link_key_iterator_t it;
414     int ok = gap_link_key_iterator_init(&it);
415     if (!ok) {
416         log_error("could not initialize iterator");
417         return;
418     }
419     while (gap_link_key_iterator_get_next(&it, addr, link_key, &type)){
420         gap_drop_link_key_for_bd_addr(addr);
421     }
422     gap_link_key_iterator_done(&it);
423 }
424 
425 int gap_link_key_iterator_init(btstack_link_key_iterator_t * it){
426     if (!hci_stack->link_key_db) return 0;
427     if (!hci_stack->link_key_db->iterator_init) return 0;
428     return hci_stack->link_key_db->iterator_init(it);
429 }
430 int gap_link_key_iterator_get_next(btstack_link_key_iterator_t * it, bd_addr_t bd_addr, link_key_t link_key, link_key_type_t * type){
431     if (!hci_stack->link_key_db) return 0;
432     return hci_stack->link_key_db->iterator_get_next(it, bd_addr, link_key, type);
433 }
434 void gap_link_key_iterator_done(btstack_link_key_iterator_t * it){
435     if (!hci_stack->link_key_db) return;
436     hci_stack->link_key_db->iterator_done(it);
437 }
438 #endif
439 
440 static bool hci_is_le_connection_type(bd_addr_type_t address_type){
441     switch (address_type){
442         case BD_ADDR_TYPE_LE_PUBLIC:
443         case BD_ADDR_TYPE_LE_RANDOM:
444         case BD_ADDR_TYPE_LE_PRIVAT_FALLBACK_PUBLIC:
445         case BD_ADDR_TYPE_LE_PRIVAT_FALLBACK_RANDOM:
446             return true;
447         default:
448             return false;
449     }
450 }
451 
452 static int hci_is_le_connection(hci_connection_t * connection){
453     return hci_is_le_connection_type(connection->address_type);
454 }
455 
456 /**
457  * count connections
458  */
459 static int nr_hci_connections(void){
460     int count = 0;
461     btstack_linked_item_t *it;
462     for (it = (btstack_linked_item_t *) hci_stack->connections; it != NULL ; it = it->next){
463         count++;
464     }
465     return count;
466 }
467 
468 static int hci_number_free_acl_slots_for_connection_type(bd_addr_type_t address_type){
469 
470     unsigned int num_packets_sent_classic = 0;
471     unsigned int num_packets_sent_le = 0;
472 
473     btstack_linked_item_t *it;
474     for (it = (btstack_linked_item_t *) hci_stack->connections; it != NULL; it = it->next){
475         hci_connection_t * connection = (hci_connection_t *) it;
476         if (hci_is_le_connection(connection)){
477             num_packets_sent_le += connection->num_packets_sent;
478         }
479         if (connection->address_type == BD_ADDR_TYPE_ACL){
480             num_packets_sent_classic += connection->num_packets_sent;
481         }
482     }
483     log_debug("ACL classic buffers: %u used of %u", num_packets_sent_classic, hci_stack->acl_packets_total_num);
484     int free_slots_classic = hci_stack->acl_packets_total_num - num_packets_sent_classic;
485     int free_slots_le = 0;
486 
487     if (free_slots_classic < 0){
488         log_error("hci_number_free_acl_slots: outgoing classic packets (%u) > total classic packets (%u)", num_packets_sent_classic, hci_stack->acl_packets_total_num);
489         return 0;
490     }
491 
492     if (hci_stack->le_acl_packets_total_num){
493         // if we have LE slots, they are used
494         free_slots_le = hci_stack->le_acl_packets_total_num - num_packets_sent_le;
495         if (free_slots_le < 0){
496             log_error("hci_number_free_acl_slots: outgoing le packets (%u) > total le packets (%u)", num_packets_sent_le, hci_stack->le_acl_packets_total_num);
497             return 0;
498         }
499     } else {
500         // otherwise, classic slots are used for LE, too
501         free_slots_classic -= num_packets_sent_le;
502         if (free_slots_classic < 0){
503             log_error("hci_number_free_acl_slots: outgoing classic + le packets (%u + %u) > total packets (%u)", num_packets_sent_classic, num_packets_sent_le, hci_stack->acl_packets_total_num);
504             return 0;
505         }
506     }
507 
508     switch (address_type){
509         case BD_ADDR_TYPE_UNKNOWN:
510             log_error("hci_number_free_acl_slots: unknown address type");
511             return 0;
512 
513         case BD_ADDR_TYPE_ACL:
514             return free_slots_classic;
515 
516         default:
517            if (hci_stack->le_acl_packets_total_num){
518                return free_slots_le;
519            }
520            return free_slots_classic;
521     }
522 }
523 
524 int hci_number_free_acl_slots_for_handle(hci_con_handle_t con_handle){
525     // get connection type
526     hci_connection_t * connection = hci_connection_for_handle(con_handle);
527     if (!connection){
528         log_error("hci_number_free_acl_slots: handle 0x%04x not in connection list", con_handle);
529         return 0;
530     }
531     return hci_number_free_acl_slots_for_connection_type(connection->address_type);
532 }
533 
534 #ifdef ENABLE_CLASSIC
535 static int hci_number_free_sco_slots(void){
536     unsigned int num_sco_packets_sent  = 0;
537     btstack_linked_item_t *it;
538     if (hci_stack->synchronous_flow_control_enabled){
539         // explicit flow control
540         for (it = (btstack_linked_item_t *) hci_stack->connections; it ; it = it->next){
541             hci_connection_t * connection = (hci_connection_t *) it;
542             if (connection->address_type != BD_ADDR_TYPE_SCO) continue;
543             num_sco_packets_sent += connection->num_packets_sent;
544         }
545         if (num_sco_packets_sent > hci_stack->sco_packets_total_num){
546             log_info("hci_number_free_sco_slots:packets (%u) > total packets (%u)", num_sco_packets_sent, hci_stack->sco_packets_total_num);
547             return 0;
548         }
549         return hci_stack->sco_packets_total_num - num_sco_packets_sent;
550     } else {
551         // implicit flow control -- TODO
552         int num_ready = 0;
553         for (it = (btstack_linked_item_t *) hci_stack->connections; it ; it = it->next){
554             hci_connection_t * connection = (hci_connection_t *) it;
555             if (connection->address_type != BD_ADDR_TYPE_SCO) continue;
556             if (connection->sco_tx_ready == 0) continue;
557             num_ready++;
558         }
559         return num_ready;
560     }
561 }
562 #endif
563 
564 // only used to send HCI Host Number Completed Packets
565 static int hci_can_send_comand_packet_transport(void){
566     if (hci_stack->hci_packet_buffer_reserved) return 0;
567 
568     // check for async hci transport implementations
569     if (hci_stack->hci_transport->can_send_packet_now){
570         if (!hci_stack->hci_transport->can_send_packet_now(HCI_COMMAND_DATA_PACKET)){
571             return 0;
572         }
573     }
574     return 1;
575 }
576 
577 // new functions replacing hci_can_send_packet_now[_using_packet_buffer]
578 int hci_can_send_command_packet_now(void){
579     if (hci_can_send_comand_packet_transport() == 0) return 0;
580     return hci_stack->num_cmd_packets > 0u;
581 }
582 
583 static int hci_transport_can_send_prepared_packet_now(uint8_t packet_type){
584     // check for async hci transport implementations
585     if (!hci_stack->hci_transport->can_send_packet_now) return 1;
586     return hci_stack->hci_transport->can_send_packet_now(packet_type);
587 }
588 
589 static int hci_can_send_prepared_acl_packet_for_address_type(bd_addr_type_t address_type){
590     if (!hci_transport_can_send_prepared_packet_now(HCI_ACL_DATA_PACKET)) return 0;
591     return hci_number_free_acl_slots_for_connection_type(address_type) > 0;
592 }
593 
594 int hci_can_send_acl_le_packet_now(void){
595     if (hci_stack->hci_packet_buffer_reserved) return 0;
596     return hci_can_send_prepared_acl_packet_for_address_type(BD_ADDR_TYPE_LE_PUBLIC);
597 }
598 
599 int hci_can_send_prepared_acl_packet_now(hci_con_handle_t con_handle) {
600     if (!hci_transport_can_send_prepared_packet_now(HCI_ACL_DATA_PACKET)) return 0;
601     return hci_number_free_acl_slots_for_handle(con_handle) > 0;
602 }
603 
604 int hci_can_send_acl_packet_now(hci_con_handle_t con_handle){
605     if (hci_stack->hci_packet_buffer_reserved) return 0;
606     return hci_can_send_prepared_acl_packet_now(con_handle);
607 }
608 
609 #ifdef ENABLE_CLASSIC
610 int hci_can_send_acl_classic_packet_now(void){
611     if (hci_stack->hci_packet_buffer_reserved) return 0;
612     return hci_can_send_prepared_acl_packet_for_address_type(BD_ADDR_TYPE_ACL);
613 }
614 
615 int hci_can_send_prepared_sco_packet_now(void){
616     if (!hci_transport_can_send_prepared_packet_now(HCI_SCO_DATA_PACKET)) return 0;
617     if (hci_have_usb_transport()){
618         return hci_stack->sco_can_send_now;
619     } else {
620         return hci_number_free_sco_slots() > 0;
621     }
622 }
623 
624 int hci_can_send_sco_packet_now(void){
625     if (hci_stack->hci_packet_buffer_reserved) return 0;
626     return hci_can_send_prepared_sco_packet_now();
627 }
628 
629 void hci_request_sco_can_send_now_event(void){
630     hci_stack->sco_waiting_for_can_send_now = 1;
631     hci_notify_if_sco_can_send_now();
632 }
633 #endif
634 
635 // used for internal checks in l2cap.c
636 int hci_is_packet_buffer_reserved(void){
637     return hci_stack->hci_packet_buffer_reserved;
638 }
639 
640 // reserves outgoing packet buffer. @returns 1 if successful
641 int hci_reserve_packet_buffer(void){
642     if (hci_stack->hci_packet_buffer_reserved) {
643         log_error("hci_reserve_packet_buffer called but buffer already reserved");
644         return 0;
645     }
646     hci_stack->hci_packet_buffer_reserved = 1;
647     return 1;
648 }
649 
650 void hci_release_packet_buffer(void){
651     hci_stack->hci_packet_buffer_reserved = 0;
652 }
653 
654 // assumption: synchronous implementations don't provide can_send_packet_now as they don't keep the buffer after the call
655 static int hci_transport_synchronous(void){
656     return hci_stack->hci_transport->can_send_packet_now == NULL;
657 }
658 
659 static int hci_send_acl_packet_fragments(hci_connection_t *connection){
660 
661     // log_info("hci_send_acl_packet_fragments  %u/%u (con 0x%04x)", hci_stack->acl_fragmentation_pos, hci_stack->acl_fragmentation_total_size, connection->con_handle);
662 
663     // max ACL data packet length depends on connection type (LE vs. Classic) and available buffers
664     uint16_t max_acl_data_packet_length = hci_stack->acl_data_packet_length;
665     if (hci_is_le_connection(connection) && (hci_stack->le_data_packets_length > 0u)){
666         max_acl_data_packet_length = hci_stack->le_data_packets_length;
667     }
668 
669 #ifdef ENABLE_LE_LIMIT_ACL_FRAGMENT_BY_MAX_OCTETS
670     if (hci_is_le_connection(connection)){
671         max_acl_data_packet_length = connection->le_max_tx_octets;
672     }
673 #endif
674 
675     log_debug("hci_send_acl_packet_fragments entered");
676 
677     int err;
678     // multiple packets could be send on a synchronous HCI transport
679     while (true){
680 
681         log_debug("hci_send_acl_packet_fragments loop entered");
682 
683         // get current data
684         const uint16_t acl_header_pos = hci_stack->acl_fragmentation_pos - 4u;
685         int current_acl_data_packet_length = hci_stack->acl_fragmentation_total_size - hci_stack->acl_fragmentation_pos;
686         int more_fragments = 0;
687 
688         // if ACL packet is larger than Bluetooth packet buffer, only send max_acl_data_packet_length
689         if (current_acl_data_packet_length > max_acl_data_packet_length){
690             more_fragments = 1;
691             current_acl_data_packet_length = max_acl_data_packet_length;
692         }
693 
694         // copy handle_and_flags if not first fragment and update packet boundary flags to be 01 (continuing fragmnent)
695         if (acl_header_pos > 0u){
696             uint16_t handle_and_flags = little_endian_read_16(hci_stack->hci_packet_buffer, 0);
697             handle_and_flags = (handle_and_flags & 0xcfffu) | (1u << 12u);
698             little_endian_store_16(hci_stack->hci_packet_buffer, acl_header_pos, handle_and_flags);
699         }
700 
701         // update header len
702         little_endian_store_16(hci_stack->hci_packet_buffer, acl_header_pos + 2u, current_acl_data_packet_length);
703 
704         // count packet
705         connection->num_packets_sent++;
706         log_debug("hci_send_acl_packet_fragments loop before send (more fragments %d)", more_fragments);
707 
708         // update state for next fragment (if any) as "transport done" might be sent during send_packet already
709         if (more_fragments){
710             // update start of next fragment to send
711             hci_stack->acl_fragmentation_pos += current_acl_data_packet_length;
712         } else {
713             // done
714             hci_stack->acl_fragmentation_pos = 0;
715             hci_stack->acl_fragmentation_total_size = 0;
716         }
717 
718         // send packet
719         uint8_t * packet = &hci_stack->hci_packet_buffer[acl_header_pos];
720         const int size = current_acl_data_packet_length + 4;
721         hci_dump_packet(HCI_ACL_DATA_PACKET, 0, packet, size);
722         hci_stack->acl_fragmentation_tx_active = 1;
723         err = hci_stack->hci_transport->send_packet(HCI_ACL_DATA_PACKET, packet, size);
724 
725         log_debug("hci_send_acl_packet_fragments loop after send (more fragments %d)", more_fragments);
726 
727         // done yet?
728         if (!more_fragments) break;
729 
730         // can send more?
731         if (!hci_can_send_prepared_acl_packet_now(connection->con_handle)) return err;
732     }
733 
734     log_debug("hci_send_acl_packet_fragments loop over");
735 
736     // release buffer now for synchronous transport
737     if (hci_transport_synchronous()){
738         hci_stack->acl_fragmentation_tx_active = 0;
739         hci_release_packet_buffer();
740         hci_emit_transport_packet_sent();
741     }
742 
743     return err;
744 }
745 
746 // pre: caller has reserved the packet buffer
747 int hci_send_acl_packet_buffer(int size){
748 
749     // log_info("hci_send_acl_packet_buffer size %u", size);
750 
751     if (!hci_stack->hci_packet_buffer_reserved) {
752         log_error("hci_send_acl_packet_buffer called without reserving packet buffer");
753         return 0;
754     }
755 
756     uint8_t * packet = hci_stack->hci_packet_buffer;
757     hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);
758 
759     // check for free places on Bluetooth module
760     if (!hci_can_send_prepared_acl_packet_now(con_handle)) {
761         log_error("hci_send_acl_packet_buffer called but no free ACL buffers on controller");
762         hci_release_packet_buffer();
763         hci_emit_transport_packet_sent();
764         return BTSTACK_ACL_BUFFERS_FULL;
765     }
766 
767     hci_connection_t *connection = hci_connection_for_handle( con_handle);
768     if (!connection) {
769         log_error("hci_send_acl_packet_buffer called but no connection for handle 0x%04x", con_handle);
770         hci_release_packet_buffer();
771         hci_emit_transport_packet_sent();
772         return 0;
773     }
774 
775 #ifdef ENABLE_CLASSIC
776     hci_connection_timestamp(connection);
777 #endif
778 
779     // hci_dump_packet( HCI_ACL_DATA_PACKET, 0, packet, size);
780 
781     // setup data
782     hci_stack->acl_fragmentation_total_size = size;
783     hci_stack->acl_fragmentation_pos = 4;   // start of L2CAP packet
784 
785     return hci_send_acl_packet_fragments(connection);
786 }
787 
788 #ifdef ENABLE_CLASSIC
789 // pre: caller has reserved the packet buffer
790 int hci_send_sco_packet_buffer(int size){
791 
792     // log_info("hci_send_acl_packet_buffer size %u", size);
793 
794     if (!hci_stack->hci_packet_buffer_reserved) {
795         log_error("hci_send_acl_packet_buffer called without reserving packet buffer");
796         return 0;
797     }
798 
799     uint8_t * packet = hci_stack->hci_packet_buffer;
800 
801     // skip checks in loopback mode
802     if (!hci_stack->loopback_mode){
803         hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);   // same for ACL and SCO
804 
805         // check for free places on Bluetooth module
806         if (!hci_can_send_prepared_sco_packet_now()) {
807             log_error("hci_send_sco_packet_buffer called but no free SCO buffers on controller");
808             hci_release_packet_buffer();
809             hci_emit_transport_packet_sent();
810             return BTSTACK_ACL_BUFFERS_FULL;
811         }
812 
813         // track send packet in connection struct
814         hci_connection_t *connection = hci_connection_for_handle( con_handle);
815         if (!connection) {
816             log_error("hci_send_sco_packet_buffer called but no connection for handle 0x%04x", con_handle);
817             hci_release_packet_buffer();
818             hci_emit_transport_packet_sent();
819             return 0;
820         }
821 
822         if (hci_have_usb_transport()){
823             // token used
824             hci_stack->sco_can_send_now = 0;
825         } else {
826             if (hci_stack->synchronous_flow_control_enabled){
827                 connection->num_packets_sent++;
828             } else {
829                 connection->sco_tx_ready--;
830             }
831         }
832     }
833 
834     hci_dump_packet( HCI_SCO_DATA_PACKET, 0, packet, size);
835     int err = hci_stack->hci_transport->send_packet(HCI_SCO_DATA_PACKET, packet, size);
836 
837     if (hci_transport_synchronous()){
838         hci_release_packet_buffer();
839         hci_emit_transport_packet_sent();
840     }
841 
842     return err;
843 }
844 #endif
845 
846 static void acl_handler(uint8_t *packet, uint16_t size){
847 
848     // get info
849     hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);
850     hci_connection_t *conn      = hci_connection_for_handle(con_handle);
851     uint8_t  acl_flags          = READ_ACL_FLAGS(packet);
852     uint16_t acl_length         = READ_ACL_LENGTH(packet);
853 
854     // ignore non-registered handle
855     if (!conn){
856         log_error("acl_handler called with non-registered handle %u!" , con_handle);
857         return;
858     }
859 
860     // assert packet is complete
861     if ((acl_length + 4u) != size){
862         log_error("acl_handler called with ACL packet of wrong size %d, expected %u => dropping packet", size, acl_length + 4);
863         return;
864     }
865 
866 #ifdef ENABLE_CLASSIC
867     // update idle timestamp
868     hci_connection_timestamp(conn);
869 #endif
870 
871 #ifdef ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL
872     hci_stack->host_completed_packets = 1;
873     conn->num_packets_completed++;
874 #endif
875 
876     // handle different packet types
877     switch (acl_flags & 0x03u) {
878 
879         case 0x01: // continuation fragment
880 
881             // sanity checks
882             if (conn->acl_recombination_pos == 0u) {
883                 log_error( "ACL Cont Fragment but no first fragment for handle 0x%02x", con_handle);
884                 return;
885             }
886             if ((conn->acl_recombination_pos + acl_length) > (4u + HCI_ACL_BUFFER_SIZE)){
887                 log_error( "ACL Cont Fragment to large: combined packet %u > buffer size %u for handle 0x%02x",
888                     conn->acl_recombination_pos + acl_length, 4 + HCI_ACL_BUFFER_SIZE, con_handle);
889                 conn->acl_recombination_pos = 0;
890                 return;
891             }
892 
893             // append fragment payload (header already stored)
894             (void)memcpy(&conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE + conn->acl_recombination_pos],
895                          &packet[4], acl_length);
896             conn->acl_recombination_pos += acl_length;
897 
898             // forward complete L2CAP packet if complete.
899             if (conn->acl_recombination_pos >= (conn->acl_recombination_length + 4u + 4u)){ // pos already incl. ACL header
900                 hci_emit_acl_packet(&conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE], conn->acl_recombination_pos);
901                 // reset recombination buffer
902                 conn->acl_recombination_length = 0;
903                 conn->acl_recombination_pos = 0;
904             }
905             break;
906 
907         case 0x02: { // first fragment
908 
909             // sanity check
910             if (conn->acl_recombination_pos) {
911                 log_error( "ACL First Fragment but data in buffer for handle 0x%02x, dropping stale fragments", con_handle);
912                 conn->acl_recombination_pos = 0;
913             }
914 
915             // peek into L2CAP packet!
916             uint16_t l2cap_length = READ_L2CAP_LENGTH( packet );
917 
918             // compare fragment size to L2CAP packet size
919             if (acl_length >= (l2cap_length + 4u)){
920                 // forward fragment as L2CAP packet
921                 hci_emit_acl_packet(packet, acl_length + 4u);
922             } else {
923 
924                 if (acl_length > HCI_ACL_BUFFER_SIZE){
925                     log_error( "ACL First Fragment to large: fragment %u > buffer size %u for handle 0x%02x",
926                         4 + acl_length, 4 + HCI_ACL_BUFFER_SIZE, con_handle);
927                     return;
928                 }
929 
930                 // store first fragment and tweak acl length for complete package
931                 (void)memcpy(&conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE],
932                              packet, acl_length + 4u);
933                 conn->acl_recombination_pos    = acl_length + 4u;
934                 conn->acl_recombination_length = l2cap_length;
935                 little_endian_store_16(conn->acl_recombination_buffer, HCI_INCOMING_PRE_BUFFER_SIZE + 2u, l2cap_length +4u);
936             }
937             break;
938 
939         }
940         default:
941             log_error( "acl_handler called with invalid packet boundary flags %u", acl_flags & 0x03);
942             return;
943     }
944 
945     // execute main loop
946     hci_run();
947 }
948 
949 static void hci_shutdown_connection(hci_connection_t *conn){
950     log_info("Connection closed: handle 0x%x, %s", conn->con_handle, bd_addr_to_str(conn->address));
951 
952 #ifdef ENABLE_CLASSIC
953 #ifdef ENABLE_SCO_OVER_HCI
954     int addr_type = conn->address_type;
955 #endif
956 #endif
957 
958     btstack_run_loop_remove_timer(&conn->timeout);
959 
960     btstack_linked_list_remove(&hci_stack->connections, (btstack_linked_item_t *) conn);
961     btstack_memory_hci_connection_free( conn );
962 
963     // now it's gone
964     hci_emit_nr_connections_changed();
965 
966 #ifdef ENABLE_CLASSIC
967 #ifdef ENABLE_SCO_OVER_HCI
968     // update SCO
969     if (addr_type == BD_ADDR_TYPE_SCO && hci_stack->hci_transport && hci_stack->hci_transport->set_sco_config){
970         hci_stack->hci_transport->set_sco_config(hci_stack->sco_voice_setting_active, hci_number_sco_connections());
971     }
972 #endif
973 #endif
974 }
975 
976 #ifdef ENABLE_CLASSIC
977 
978 static const uint16_t packet_type_sizes[] = {
979     0, HCI_ACL_2DH1_SIZE, HCI_ACL_3DH1_SIZE, HCI_ACL_DM1_SIZE,
980     HCI_ACL_DH1_SIZE, 0, 0, 0,
981     HCI_ACL_2DH3_SIZE, HCI_ACL_3DH3_SIZE, HCI_ACL_DM3_SIZE, HCI_ACL_DH3_SIZE,
982     HCI_ACL_2DH5_SIZE, HCI_ACL_3DH5_SIZE, HCI_ACL_DM5_SIZE, HCI_ACL_DH5_SIZE
983 };
984 static const uint8_t  packet_type_feature_requirement_bit[] = {
985      0, // 3 slot packets
986      1, // 5 slot packets
987     25, // EDR 2 mpbs
988     26, // EDR 3 mbps
989     39, // 3 slot EDR packts
990     40, // 5 slot EDR packet
991 };
992 static const uint16_t packet_type_feature_packet_mask[] = {
993     0x0f00, // 3 slot packets
994     0xf000, // 5 slot packets
995     0x1102, // EDR 2 mpbs
996     0x2204, // EDR 3 mbps
997     0x0300, // 3 slot EDR packts
998     0x3000, // 5 slot EDR packet
999 };
1000 
1001 static uint16_t hci_acl_packet_types_for_buffer_size_and_local_features(uint16_t buffer_size, uint8_t * local_supported_features){
1002     // enable packet types based on size
1003     uint16_t packet_types = 0;
1004     unsigned int i;
1005     for (i=0;i<16;i++){
1006         if (packet_type_sizes[i] == 0) continue;
1007         if (packet_type_sizes[i] <= buffer_size){
1008             packet_types |= 1 << i;
1009         }
1010     }
1011     // disable packet types due to missing local supported features
1012     for (i=0;i<sizeof(packet_type_feature_requirement_bit);i++){
1013         unsigned int bit_idx = packet_type_feature_requirement_bit[i];
1014         int feature_set = (local_supported_features[bit_idx >> 3] & (1<<(bit_idx & 7))) != 0;
1015         if (feature_set) continue;
1016         log_info("Features bit %02u is not set, removing packet types 0x%04x", bit_idx, packet_type_feature_packet_mask[i]);
1017         packet_types &= ~packet_type_feature_packet_mask[i];
1018     }
1019     // flip bits for "may not be used"
1020     packet_types ^= 0x3306;
1021     return packet_types;
1022 }
1023 
1024 uint16_t hci_usable_acl_packet_types(void){
1025     return hci_stack->packet_types;
1026 }
1027 #endif
1028 
1029 uint8_t* hci_get_outgoing_packet_buffer(void){
1030     // hci packet buffer is >= acl data packet length
1031     return hci_stack->hci_packet_buffer;
1032 }
1033 
1034 uint16_t hci_max_acl_data_packet_length(void){
1035     return hci_stack->acl_data_packet_length;
1036 }
1037 
1038 #ifdef ENABLE_CLASSIC
1039 int hci_extended_sco_link_supported(void){
1040     // No. 31, byte 3, bit 7
1041     return (hci_stack->local_supported_features[3] & (1 << 7)) != 0;
1042 }
1043 #endif
1044 
1045 int hci_non_flushable_packet_boundary_flag_supported(void){
1046     // No. 54, byte 6, bit 6
1047     return (hci_stack->local_supported_features[6u] & (1u << 6u)) != 0u;
1048 }
1049 
1050 static int gap_ssp_supported(void){
1051     // No. 51, byte 6, bit 3
1052     return (hci_stack->local_supported_features[6u] & (1u << 3u)) != 0u;
1053 }
1054 
1055 static int hci_classic_supported(void){
1056 #ifdef ENABLE_CLASSIC
1057     // No. 37, byte 4, bit 5, = No BR/EDR Support
1058     return (hci_stack->local_supported_features[4] & (1 << 5)) == 0;
1059 #else
1060     return 0;
1061 #endif
1062 }
1063 
1064 static int hci_le_supported(void){
1065 #ifdef ENABLE_BLE
1066     // No. 37, byte 4, bit 6 = LE Supported (Controller)
1067     return (hci_stack->local_supported_features[4u] & (1u << 6u)) != 0u;
1068 #else
1069     return 0;
1070 #endif
1071 }
1072 
1073 #ifdef ENABLE_BLE
1074 
1075 /**
1076  * @brief Get addr type and address used for LE in Advertisements, Scan Responses,
1077  */
1078 void gap_le_get_own_address(uint8_t * addr_type, bd_addr_t addr){
1079     *addr_type = hci_stack->le_own_addr_type;
1080     if (hci_stack->le_own_addr_type){
1081         (void)memcpy(addr, hci_stack->le_random_address, 6);
1082     } else {
1083         (void)memcpy(addr, hci_stack->local_bd_addr, 6);
1084     }
1085 }
1086 
1087 #ifdef ENABLE_LE_CENTRAL
1088 void le_handle_advertisement_report(uint8_t *packet, uint16_t size){
1089 
1090     int offset = 3;
1091     int num_reports = packet[offset];
1092     offset += 1;
1093 
1094     int i;
1095     // log_info("HCI: handle adv report with num reports: %d", num_reports);
1096     uint8_t event[12 + LE_ADVERTISING_DATA_SIZE]; // use upper bound to avoid var size automatic var
1097     for (i=0; (i<num_reports) && (offset < size);i++){
1098         // sanity checks on data_length:
1099         uint8_t data_length = packet[offset + 8];
1100         if (data_length > LE_ADVERTISING_DATA_SIZE) return;
1101         if ((offset + 9u + data_length + 1u) > size)    return;
1102         // setup event
1103         uint8_t event_size = 10u + data_length;
1104         int pos = 0;
1105         event[pos++] = GAP_EVENT_ADVERTISING_REPORT;
1106         event[pos++] = event_size;
1107         (void)memcpy(&event[pos], &packet[offset], 1 + 1 + 6); // event type + address type + address
1108         offset += 8;
1109         pos += 8;
1110         event[pos++] = packet[offset + 1 + data_length]; // rssi
1111         event[pos++] = data_length;
1112         offset++;
1113         (void)memcpy(&event[pos], &packet[offset], data_length);
1114         pos +=    data_length;
1115         offset += data_length + 1u; // rssi
1116         hci_emit_event(event, pos, 1);
1117     }
1118 }
1119 #endif
1120 #endif
1121 
1122 #ifdef ENABLE_BLE
1123 #ifdef ENABLE_LE_PERIPHERAL
1124 static void hci_update_advertisements_enabled_for_current_roles(void){
1125     if (hci_stack->le_advertisements_enabled){
1126         // get number of active le slave connections
1127         int num_slave_connections = 0;
1128         btstack_linked_list_iterator_t it;
1129         btstack_linked_list_iterator_init(&it, &hci_stack->connections);
1130         while (btstack_linked_list_iterator_has_next(&it)){
1131             hci_connection_t * con = (hci_connection_t*) btstack_linked_list_iterator_next(&it);
1132             log_info("state %u, role %u, le_con %u", con->state, con->role, hci_is_le_connection(con));
1133             if (con->state != OPEN) continue;
1134             if (con->role  != HCI_ROLE_SLAVE) continue;
1135             if (!hci_is_le_connection(con)) continue;
1136             num_slave_connections++;
1137         }
1138         log_info("Num LE Peripheral roles: %u of %u", num_slave_connections, hci_stack->le_max_number_peripheral_connections);
1139         hci_stack->le_advertisements_enabled_for_current_roles = num_slave_connections < hci_stack->le_max_number_peripheral_connections;
1140     } else {
1141         hci_stack->le_advertisements_enabled_for_current_roles = false;
1142     }
1143 }
1144 #endif
1145 #endif
1146 
1147 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
1148 
1149 static uint32_t hci_transport_uart_get_main_baud_rate(void){
1150     if (!hci_stack->config) return 0;
1151     uint32_t baud_rate = ((hci_transport_config_uart_t *)hci_stack->config)->baudrate_main;
1152     // Limit baud rate for Broadcom chipsets to 3 mbps
1153     if ((hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_BROADCOM_CORPORATION) && (baud_rate > 3000000)){
1154         baud_rate = 3000000;
1155     }
1156     return baud_rate;
1157 }
1158 
1159 static void hci_initialization_timeout_handler(btstack_timer_source_t * ds){
1160     UNUSED(ds);
1161 
1162     switch (hci_stack->substate){
1163         case HCI_INIT_W4_SEND_RESET:
1164             log_info("Resend HCI Reset");
1165             hci_stack->substate = HCI_INIT_SEND_RESET;
1166             hci_stack->num_cmd_packets = 1;
1167             hci_run();
1168             break;
1169         case HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT_LINK_RESET:
1170             log_info("Resend HCI Reset - CSR Warm Boot with Link Reset");
1171             if (hci_stack->hci_transport->reset_link){
1172                 hci_stack->hci_transport->reset_link();
1173             }
1174 
1175             /* fall through */
1176 
1177         case HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT:
1178             log_info("Resend HCI Reset - CSR Warm Boot");
1179             hci_stack->substate = HCI_INIT_SEND_RESET_CSR_WARM_BOOT;
1180             hci_stack->num_cmd_packets = 1;
1181             hci_run();
1182             break;
1183         case HCI_INIT_W4_SEND_BAUD_CHANGE:
1184             if (hci_stack->hci_transport->set_baudrate){
1185                 uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
1186                 log_info("Local baud rate change to %" PRIu32 "(timeout handler)", baud_rate);
1187                 hci_stack->hci_transport->set_baudrate(baud_rate);
1188             }
1189             // For CSR, HCI Reset is sent on new baud rate. Don't forget to reset link for H5/BCSP
1190             if (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_CAMBRIDGE_SILICON_RADIO){
1191                 if (hci_stack->hci_transport->reset_link){
1192                     log_info("Link Reset");
1193                     hci_stack->hci_transport->reset_link();
1194                 }
1195                 hci_stack->substate = HCI_INIT_SEND_RESET_CSR_WARM_BOOT;
1196                 hci_run();
1197             }
1198             break;
1199         case HCI_INIT_W4_CUSTOM_INIT_BCM_DELAY:
1200             // otherwise continue
1201             hci_stack->substate = HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS;
1202             hci_send_cmd(&hci_read_local_supported_commands);
1203             break;
1204         default:
1205             break;
1206     }
1207 }
1208 #endif
1209 
1210 static void hci_initializing_next_state(void){
1211     hci_stack->substate = (hci_substate_t )( ((int) hci_stack->substate) + 1);
1212 }
1213 
1214 // assumption: hci_can_send_command_packet_now() == true
1215 static void hci_initializing_run(void){
1216     log_debug("hci_initializing_run: substate %u, can send %u", hci_stack->substate, hci_can_send_command_packet_now());
1217     switch (hci_stack->substate){
1218         case HCI_INIT_SEND_RESET:
1219             hci_state_reset();
1220 
1221 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
1222             // prepare reset if command complete not received in 100ms
1223             btstack_run_loop_set_timer(&hci_stack->timeout, HCI_RESET_RESEND_TIMEOUT_MS);
1224             btstack_run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
1225             btstack_run_loop_add_timer(&hci_stack->timeout);
1226 #endif
1227             // send command
1228             hci_stack->substate = HCI_INIT_W4_SEND_RESET;
1229             hci_send_cmd(&hci_reset);
1230             break;
1231         case HCI_INIT_SEND_READ_LOCAL_VERSION_INFORMATION:
1232             hci_send_cmd(&hci_read_local_version_information);
1233             hci_stack->substate = HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION;
1234             break;
1235         case HCI_INIT_SEND_READ_LOCAL_NAME:
1236             hci_send_cmd(&hci_read_local_name);
1237             hci_stack->substate = HCI_INIT_W4_SEND_READ_LOCAL_NAME;
1238             break;
1239 
1240 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
1241         case HCI_INIT_SEND_RESET_CSR_WARM_BOOT:
1242             hci_state_reset();
1243             // prepare reset if command complete not received in 100ms
1244             btstack_run_loop_set_timer(&hci_stack->timeout, HCI_RESET_RESEND_TIMEOUT_MS);
1245             btstack_run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
1246             btstack_run_loop_add_timer(&hci_stack->timeout);
1247             // send command
1248             hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT;
1249             hci_send_cmd(&hci_reset);
1250             break;
1251         case HCI_INIT_SEND_RESET_ST_WARM_BOOT:
1252             hci_state_reset();
1253             hci_stack->substate = HCI_INIT_W4_SEND_RESET_ST_WARM_BOOT;
1254             hci_send_cmd(&hci_reset);
1255             break;
1256         case HCI_INIT_SEND_BAUD_CHANGE: {
1257             uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
1258             hci_stack->chipset->set_baudrate_command(baud_rate, hci_stack->hci_packet_buffer);
1259             hci_stack->last_cmd_opcode = little_endian_read_16(hci_stack->hci_packet_buffer, 0);
1260             hci_stack->substate = HCI_INIT_W4_SEND_BAUD_CHANGE;
1261             hci_send_cmd_packet(hci_stack->hci_packet_buffer, 3u + hci_stack->hci_packet_buffer[2u]);
1262             // STLC25000D: baudrate change happens within 0.5 s after command was send,
1263             // use timer to update baud rate after 100 ms (knowing exactly, when command was sent is non-trivial)
1264             if (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_ST_MICROELECTRONICS){
1265                 btstack_run_loop_set_timer(&hci_stack->timeout, HCI_RESET_RESEND_TIMEOUT_MS);
1266                 btstack_run_loop_add_timer(&hci_stack->timeout);
1267             }
1268             break;
1269         }
1270         case HCI_INIT_SEND_BAUD_CHANGE_BCM: {
1271             uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
1272             hci_stack->chipset->set_baudrate_command(baud_rate, hci_stack->hci_packet_buffer);
1273             hci_stack->last_cmd_opcode = little_endian_read_16(hci_stack->hci_packet_buffer, 0);
1274             hci_stack->substate = HCI_INIT_W4_SEND_BAUD_CHANGE_BCM;
1275             hci_send_cmd_packet(hci_stack->hci_packet_buffer, 3u + hci_stack->hci_packet_buffer[2u]);
1276             break;
1277         }
1278         case HCI_INIT_CUSTOM_INIT:
1279             // Custom initialization
1280             if (hci_stack->chipset && hci_stack->chipset->next_command){
1281                 hci_stack->chipset_result = (*hci_stack->chipset->next_command)(hci_stack->hci_packet_buffer);
1282                 int send_cmd = 0;
1283                 switch (hci_stack->chipset_result){
1284                     case BTSTACK_CHIPSET_VALID_COMMAND:
1285                         send_cmd = 1;
1286                         hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT;
1287                         break;
1288                     case BTSTACK_CHIPSET_WARMSTART_REQUIRED:
1289                         send_cmd = 1;
1290                         // CSR Warm Boot: Wait a bit, then send HCI Reset until HCI Command Complete
1291                         log_info("CSR Warm Boot");
1292                         btstack_run_loop_set_timer(&hci_stack->timeout, HCI_RESET_RESEND_TIMEOUT_MS);
1293                         btstack_run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
1294                         btstack_run_loop_add_timer(&hci_stack->timeout);
1295                         if ((hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_CAMBRIDGE_SILICON_RADIO)
1296                             && hci_stack->config
1297                             && hci_stack->chipset
1298                             // && hci_stack->chipset->set_baudrate_command -- there's no such command
1299                             && hci_stack->hci_transport->set_baudrate
1300                             && hci_transport_uart_get_main_baud_rate()){
1301                             hci_stack->substate = HCI_INIT_W4_SEND_BAUD_CHANGE;
1302                         } else {
1303                            hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT_LINK_RESET;
1304                         }
1305                         break;
1306                     default:
1307                         break;
1308                 }
1309 
1310                 if (send_cmd){
1311                     int size = 3u + hci_stack->hci_packet_buffer[2u];
1312                     hci_stack->last_cmd_opcode = little_endian_read_16(hci_stack->hci_packet_buffer, 0);
1313                     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, hci_stack->hci_packet_buffer, size);
1314                     hci_stack->hci_transport->send_packet(HCI_COMMAND_DATA_PACKET, hci_stack->hci_packet_buffer, size);
1315                     break;
1316                 }
1317                 log_info("Init script done");
1318 
1319                 // Init script download on Broadcom chipsets causes:
1320                 if ( (hci_stack->chipset_result != BTSTACK_CHIPSET_NO_INIT_SCRIPT) &&
1321                    (  (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_BROADCOM_CORPORATION)
1322                 ||    (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_EM_MICROELECTRONIC_MARIN_SA)) ){
1323 
1324                     // - baud rate to reset, restore UART baud rate if needed
1325                     int need_baud_change = hci_stack->config
1326                         && hci_stack->chipset
1327                         && hci_stack->chipset->set_baudrate_command
1328                         && hci_stack->hci_transport->set_baudrate
1329                         && ((hci_transport_config_uart_t *)hci_stack->config)->baudrate_main;
1330                     if (need_baud_change) {
1331                         uint32_t baud_rate = ((hci_transport_config_uart_t *)hci_stack->config)->baudrate_init;
1332                         log_info("Local baud rate change to %" PRIu32 " after init script (bcm)", baud_rate);
1333                         hci_stack->hci_transport->set_baudrate(baud_rate);
1334                     }
1335 
1336                     uint16_t bcm_delay_ms = 300;
1337                     // - UART may or may not be disabled during update and Controller RTS may or may not be high during this time
1338                     //   -> Work around: wait here.
1339                     log_info("BCM delay (%u ms) after init script", bcm_delay_ms);
1340                     hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT_BCM_DELAY;
1341                     btstack_run_loop_set_timer(&hci_stack->timeout, bcm_delay_ms);
1342                     btstack_run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
1343                     btstack_run_loop_add_timer(&hci_stack->timeout);
1344                     break;
1345                 }
1346             }
1347             // otherwise continue
1348             hci_stack->substate = HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS;
1349             hci_send_cmd(&hci_read_local_supported_commands);
1350             break;
1351         case HCI_INIT_SET_BD_ADDR:
1352             log_info("Set Public BD ADDR to %s", bd_addr_to_str(hci_stack->custom_bd_addr));
1353             hci_stack->chipset->set_bd_addr_command(hci_stack->custom_bd_addr, hci_stack->hci_packet_buffer);
1354             hci_stack->last_cmd_opcode = little_endian_read_16(hci_stack->hci_packet_buffer, 0);
1355             hci_stack->substate = HCI_INIT_W4_SET_BD_ADDR;
1356             hci_send_cmd_packet(hci_stack->hci_packet_buffer, 3u + hci_stack->hci_packet_buffer[2u]);
1357             break;
1358 #endif
1359 
1360         case HCI_INIT_READ_LOCAL_SUPPORTED_COMMANDS:
1361             log_info("Resend hci_read_local_supported_commands after CSR Warm Boot double reset");
1362             hci_stack->substate = HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS;
1363             hci_send_cmd(&hci_read_local_supported_commands);
1364             break;
1365         case HCI_INIT_READ_BD_ADDR:
1366             hci_stack->substate = HCI_INIT_W4_READ_BD_ADDR;
1367             hci_send_cmd(&hci_read_bd_addr);
1368             break;
1369         case HCI_INIT_READ_BUFFER_SIZE:
1370             hci_stack->substate = HCI_INIT_W4_READ_BUFFER_SIZE;
1371             hci_send_cmd(&hci_read_buffer_size);
1372             break;
1373         case HCI_INIT_READ_LOCAL_SUPPORTED_FEATURES:
1374             hci_stack->substate = HCI_INIT_W4_READ_LOCAL_SUPPORTED_FEATURES;
1375             hci_send_cmd(&hci_read_local_supported_features);
1376             break;
1377 
1378 #ifdef ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL
1379         case HCI_INIT_SET_CONTROLLER_TO_HOST_FLOW_CONTROL:
1380             hci_stack->substate = HCI_INIT_W4_SET_CONTROLLER_TO_HOST_FLOW_CONTROL;
1381             hci_send_cmd(&hci_set_controller_to_host_flow_control, 3);  // ACL + SCO Flow Control
1382             break;
1383         case HCI_INIT_HOST_BUFFER_SIZE:
1384             hci_stack->substate = HCI_INIT_W4_HOST_BUFFER_SIZE;
1385             hci_send_cmd(&hci_host_buffer_size, HCI_HOST_ACL_PACKET_LEN, HCI_HOST_SCO_PACKET_LEN,
1386                                                 HCI_HOST_ACL_PACKET_NUM, HCI_HOST_SCO_PACKET_NUM);
1387             break;
1388 #endif
1389 
1390         case HCI_INIT_SET_EVENT_MASK:
1391             hci_stack->substate = HCI_INIT_W4_SET_EVENT_MASK;
1392             if (hci_le_supported()){
1393                 hci_send_cmd(&hci_set_event_mask,0xffffffff, 0x3FFFFFFF);
1394             } else {
1395                 // Kensington Bluetooth 2.1 USB Dongle (CSR Chipset) returns an error for 0xffff...
1396                 hci_send_cmd(&hci_set_event_mask,0xffffffff, 0x1FFFFFFF);
1397             }
1398             break;
1399 
1400 #ifdef ENABLE_CLASSIC
1401         case HCI_INIT_WRITE_SIMPLE_PAIRING_MODE:
1402             hci_stack->substate = HCI_INIT_W4_WRITE_SIMPLE_PAIRING_MODE;
1403             hci_send_cmd(&hci_write_simple_pairing_mode, hci_stack->ssp_enable);
1404             break;
1405         case HCI_INIT_WRITE_PAGE_TIMEOUT:
1406             hci_stack->substate = HCI_INIT_W4_WRITE_PAGE_TIMEOUT;
1407             hci_send_cmd(&hci_write_page_timeout, 0x6000);  // ca. 15 sec
1408             break;
1409         case HCI_INIT_WRITE_DEFAULT_LINK_POLICY_SETTING:
1410             hci_stack->substate = HCI_INIT_W4_WRITE_DEFAULT_LINK_POLICY_SETTING;
1411             hci_send_cmd(&hci_write_default_link_policy_setting, hci_stack->default_link_policy_settings);
1412             break;
1413         case HCI_INIT_WRITE_CLASS_OF_DEVICE:
1414             hci_stack->substate = HCI_INIT_W4_WRITE_CLASS_OF_DEVICE;
1415             hci_send_cmd(&hci_write_class_of_device, hci_stack->class_of_device);
1416             break;
1417         case HCI_INIT_WRITE_LOCAL_NAME: {
1418             hci_stack->substate = HCI_INIT_W4_WRITE_LOCAL_NAME;
1419             hci_reserve_packet_buffer();
1420             uint8_t * packet = hci_stack->hci_packet_buffer;
1421             // construct HCI Command and send
1422             uint16_t opcode = hci_write_local_name.opcode;
1423             hci_stack->last_cmd_opcode = opcode;
1424             packet[0] = opcode & 0xff;
1425             packet[1] = opcode >> 8;
1426             packet[2] = DEVICE_NAME_LEN;
1427             memset(&packet[3], 0, DEVICE_NAME_LEN);
1428             uint16_t name_len = (uint16_t) strlen(hci_stack->local_name);
1429             uint16_t bytes_to_copy = btstack_min(name_len, DEVICE_NAME_LEN);
1430             // if shorter than DEVICE_NAME_LEN, it's implicitly NULL-terminated by memset call
1431             (void)memcpy(&packet[3], hci_stack->local_name, bytes_to_copy);
1432             // expand '00:00:00:00:00:00' in name with bd_addr
1433             btstack_replace_bd_addr_placeholder(&packet[3], bytes_to_copy, hci_stack->local_bd_addr);
1434             hci_send_cmd_packet(packet, HCI_CMD_HEADER_SIZE + DEVICE_NAME_LEN);
1435             break;
1436         }
1437         case HCI_INIT_WRITE_EIR_DATA: {
1438             hci_stack->substate = HCI_INIT_W4_WRITE_EIR_DATA;
1439             hci_reserve_packet_buffer();
1440             uint8_t * packet = hci_stack->hci_packet_buffer;
1441             // construct HCI Command in-place and send
1442             uint16_t opcode = hci_write_extended_inquiry_response.opcode;
1443             hci_stack->last_cmd_opcode = opcode;
1444             uint16_t offset = 0;
1445             packet[offset++] = opcode & 0xff;
1446             packet[offset++] = opcode >> 8;
1447             packet[offset++] = 1 + EXTENDED_INQUIRY_RESPONSE_DATA_LEN;
1448             packet[offset++] = 0;  // FEC not required
1449             memset(&packet[offset], 0, EXTENDED_INQUIRY_RESPONSE_DATA_LEN);
1450             if (hci_stack->eir_data){
1451                 // copy items and expand '00:00:00:00:00:00' in name with bd_addr
1452                 ad_context_t context;
1453                 for (ad_iterator_init(&context, EXTENDED_INQUIRY_RESPONSE_DATA_LEN, hci_stack->eir_data) ; ad_iterator_has_more(&context) ; ad_iterator_next(&context)) {
1454                     uint8_t data_type   = ad_iterator_get_data_type(&context);
1455                     uint8_t size        = ad_iterator_get_data_len(&context);
1456                     const uint8_t *data = ad_iterator_get_data(&context);
1457                     // copy item
1458                     packet[offset++] = size + 1;
1459                     packet[offset++] = data_type;
1460                     memcpy(&packet[offset], data, size);
1461                     // update name item
1462                     if ((data_type == BLUETOOTH_DATA_TYPE_SHORTENED_LOCAL_NAME) || (data_type == BLUETOOTH_DATA_TYPE_COMPLETE_LOCAL_NAME)){
1463                         btstack_replace_bd_addr_placeholder(&packet[offset], size, hci_stack->local_bd_addr);
1464                     }
1465                     offset += size;
1466                 }
1467             } else {
1468                 uint16_t name_len = (uint16_t) strlen(hci_stack->local_name);
1469                 uint16_t bytes_to_copy = btstack_min(name_len, EXTENDED_INQUIRY_RESPONSE_DATA_LEN - 2);
1470                 packet[offset++] = bytes_to_copy + 1;
1471                 packet[offset++] = BLUETOOTH_DATA_TYPE_COMPLETE_LOCAL_NAME;
1472                 (void)memcpy(&packet[6], hci_stack->local_name, bytes_to_copy);
1473                 // expand '00:00:00:00:00:00' in name with bd_addr
1474                 btstack_replace_bd_addr_placeholder(&packet[offset], bytes_to_copy, hci_stack->local_bd_addr);
1475             }
1476             hci_send_cmd_packet(packet, HCI_CMD_HEADER_SIZE + 1 + EXTENDED_INQUIRY_RESPONSE_DATA_LEN);
1477             break;
1478         }
1479         case HCI_INIT_WRITE_INQUIRY_MODE:
1480             hci_stack->substate = HCI_INIT_W4_WRITE_INQUIRY_MODE;
1481             hci_send_cmd(&hci_write_inquiry_mode, (int) hci_stack->inquiry_mode);
1482             break;
1483         case HCI_INIT_WRITE_SECURE_CONNECTIONS_HOST_ENABLE:
1484             hci_send_cmd(&hci_write_secure_connections_host_support, 1);
1485 			hci_stack->secure_connections_active = true;
1486             hci_stack->substate = HCI_INIT_W4_WRITE_SECURE_CONNECTIONS_HOST_ENABLE;
1487             break;
1488         case HCI_INIT_WRITE_SCAN_ENABLE:
1489             hci_send_cmd(&hci_write_scan_enable, (hci_stack->connectable << 1) | hci_stack->discoverable); // page scan
1490             hci_stack->substate = HCI_INIT_W4_WRITE_SCAN_ENABLE;
1491             break;
1492         // only sent if ENABLE_SCO_OVER_HCI is defined
1493         case HCI_INIT_WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE:
1494             hci_stack->substate = HCI_INIT_W4_WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE;
1495             hci_send_cmd(&hci_write_synchronous_flow_control_enable, 1); // SCO tracking enabled
1496             break;
1497         case HCI_INIT_WRITE_DEFAULT_ERRONEOUS_DATA_REPORTING:
1498             hci_stack->substate = HCI_INIT_W4_WRITE_DEFAULT_ERRONEOUS_DATA_REPORTING;
1499             hci_send_cmd(&hci_write_default_erroneous_data_reporting, 1);
1500             break;
1501         // only sent if manufacturer is Broadcom and ENABLE_SCO_OVER_HCI or ENABLE_SCO_OVER_PCM is defined
1502         case HCI_INIT_BCM_WRITE_SCO_PCM_INT:
1503             hci_stack->substate = HCI_INIT_W4_BCM_WRITE_SCO_PCM_INT;
1504 #ifdef ENABLE_SCO_OVER_HCI
1505             log_info("BCM: Route SCO data via HCI transport");
1506             hci_send_cmd(&hci_bcm_write_sco_pcm_int, 1, 0, 0, 0, 0);
1507 #endif
1508 #ifdef ENABLE_SCO_OVER_PCM
1509             log_info("BCM: Route SCO data via PCM interface");
1510             hci_send_cmd(&hci_bcm_write_sco_pcm_int, 0, 4, 0, 1, 1);
1511 #endif
1512             break;
1513 
1514 #endif
1515 #ifdef ENABLE_BLE
1516         // LE INIT
1517         case HCI_INIT_LE_READ_BUFFER_SIZE:
1518             hci_stack->substate = HCI_INIT_W4_LE_READ_BUFFER_SIZE;
1519             hci_send_cmd(&hci_le_read_buffer_size);
1520             break;
1521         case HCI_INIT_LE_SET_EVENT_MASK:
1522             hci_stack->substate = HCI_INIT_W4_LE_SET_EVENT_MASK;
1523             hci_send_cmd(&hci_le_set_event_mask, 0x809FF, 0x0); // bits 0-8, 11, 19
1524             break;
1525         case HCI_INIT_WRITE_LE_HOST_SUPPORTED:
1526             // LE Supported Host = 1, Simultaneous Host = 0
1527             hci_stack->substate = HCI_INIT_W4_WRITE_LE_HOST_SUPPORTED;
1528             hci_send_cmd(&hci_write_le_host_supported, 1, 0);
1529             break;
1530 #endif
1531 
1532 #ifdef ENABLE_LE_DATA_LENGTH_EXTENSION
1533         case HCI_INIT_LE_READ_MAX_DATA_LENGTH:
1534             hci_stack->substate = HCI_INIT_W4_LE_READ_MAX_DATA_LENGTH;
1535             hci_send_cmd(&hci_le_read_maximum_data_length);
1536             break;
1537         case HCI_INIT_LE_WRITE_SUGGESTED_DATA_LENGTH:
1538             hci_stack->substate = HCI_INIT_W4_LE_WRITE_SUGGESTED_DATA_LENGTH;
1539             hci_send_cmd(&hci_le_write_suggested_default_data_length, hci_stack->le_supported_max_tx_octets, hci_stack->le_supported_max_tx_time);
1540             break;
1541 #endif
1542 
1543 #ifdef ENABLE_LE_CENTRAL
1544         case HCI_INIT_READ_WHITE_LIST_SIZE:
1545             hci_stack->substate = HCI_INIT_W4_READ_WHITE_LIST_SIZE;
1546             hci_send_cmd(&hci_le_read_white_list_size);
1547             break;
1548         case HCI_INIT_LE_SET_SCAN_PARAMETERS:
1549             hci_stack->substate = HCI_INIT_W4_LE_SET_SCAN_PARAMETERS;
1550             hci_send_cmd(&hci_le_set_scan_parameters, hci_stack->le_scan_type, hci_stack->le_scan_interval, hci_stack->le_scan_window, hci_stack->le_own_addr_type, hci_stack->le_scan_filter_policy);
1551             break;
1552 #endif
1553         default:
1554             return;
1555     }
1556 }
1557 
1558 static void hci_init_done(void){
1559     // done. tell the app
1560     log_info("hci_init_done -> HCI_STATE_WORKING");
1561     hci_stack->state = HCI_STATE_WORKING;
1562     hci_emit_state();
1563     hci_run();
1564 }
1565 
1566 static bool hci_initializing_event_handler_command_completed(const uint8_t * packet){
1567     bool command_completed = false;
1568     if (hci_event_packet_get_type(packet) == HCI_EVENT_COMMAND_COMPLETE){
1569         uint16_t opcode = little_endian_read_16(packet,3);
1570         if (opcode == hci_stack->last_cmd_opcode){
1571             command_completed = true;
1572             log_debug("Command complete for expected opcode %04x at substate %u", opcode, hci_stack->substate);
1573         } else {
1574             log_info("Command complete for different opcode %04x, expected %04x, at substate %u", opcode, hci_stack->last_cmd_opcode, hci_stack->substate);
1575         }
1576     }
1577 
1578     if (hci_event_packet_get_type(packet) == HCI_EVENT_COMMAND_STATUS){
1579         uint8_t  status = packet[2];
1580         uint16_t opcode = little_endian_read_16(packet,4);
1581         if (opcode == hci_stack->last_cmd_opcode){
1582             if (status){
1583                 command_completed = true;
1584                 log_debug("Command status error 0x%02x for expected opcode %04x at substate %u", status, opcode, hci_stack->substate);
1585             } else {
1586                 log_info("Command status OK for expected opcode %04x, waiting for command complete", opcode);
1587             }
1588         } else {
1589             log_debug("Command status for opcode %04x, expected %04x", opcode, hci_stack->last_cmd_opcode);
1590         }
1591     }
1592 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
1593     // Vendor == CSR
1594     if ((hci_stack->substate == HCI_INIT_W4_CUSTOM_INIT) && (hci_event_packet_get_type(packet) == HCI_EVENT_VENDOR_SPECIFIC)){
1595         // TODO: track actual command
1596         command_completed = true;
1597     }
1598 
1599     // Vendor == Toshiba
1600     if ((hci_stack->substate == HCI_INIT_W4_SEND_BAUD_CHANGE) && (hci_event_packet_get_type(packet) == HCI_EVENT_VENDOR_SPECIFIC)){
1601         // TODO: track actual command
1602         command_completed = true;
1603         // Fix: no HCI Command Complete received, so num_cmd_packets not reset
1604         hci_stack->num_cmd_packets = 1;
1605     }
1606 #endif
1607 
1608     return command_completed;
1609 }
1610 
1611 static void hci_initializing_event_handler(const uint8_t * packet, uint16_t size){
1612 
1613     UNUSED(size);   // ok: less than 6 bytes are read from our buffer
1614 
1615     bool command_completed =  hci_initializing_event_handler_command_completed(packet);
1616 
1617 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
1618 
1619     // Late response (> 100 ms) for HCI Reset e.g. on Toshiba TC35661:
1620     // Command complete for HCI Reset arrives after we've resent the HCI Reset command
1621     //
1622     // HCI Reset
1623     // Timeout 100 ms
1624     // HCI Reset
1625     // Command Complete Reset
1626     // HCI Read Local Version Information
1627     // Command Complete Reset - but we expected Command Complete Read Local Version Information
1628     // hang...
1629     //
1630     // Fix: Command Complete for HCI Reset in HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION trigger resend
1631     if (!command_completed
1632             && (hci_event_packet_get_type(packet) == HCI_EVENT_COMMAND_COMPLETE)
1633             && (hci_stack->substate == HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION)){
1634 
1635         uint16_t opcode = little_endian_read_16(packet,3);
1636         if (opcode == hci_reset.opcode){
1637             hci_stack->substate = HCI_INIT_SEND_READ_LOCAL_VERSION_INFORMATION;
1638             return;
1639         }
1640     }
1641 
1642     // CSR & H5
1643     // Fix: Command Complete for HCI Reset in HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION trigger resend
1644     if (!command_completed
1645             && (hci_event_packet_get_type(packet) == HCI_EVENT_COMMAND_COMPLETE)
1646             && (hci_stack->substate == HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS)){
1647 
1648         uint16_t opcode = little_endian_read_16(packet,3);
1649         if (opcode == hci_reset.opcode){
1650             hci_stack->substate = HCI_INIT_READ_LOCAL_SUPPORTED_COMMANDS;
1651             return;
1652         }
1653     }
1654 
1655     // on CSR with BCSP/H5, the reset resend timeout leads to substate == HCI_INIT_SEND_RESET or HCI_INIT_SEND_RESET_CSR_WARM_BOOT
1656     // fix: Correct substate and behave as command below
1657     if (command_completed){
1658         switch (hci_stack->substate){
1659             case HCI_INIT_SEND_RESET:
1660                 hci_stack->substate = HCI_INIT_W4_SEND_RESET;
1661                 break;
1662             case HCI_INIT_SEND_RESET_CSR_WARM_BOOT:
1663                 hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT;
1664                 break;
1665             default:
1666                 break;
1667         }
1668     }
1669 
1670 #endif
1671 
1672     if (!command_completed) return;
1673 
1674     bool need_baud_change = false;
1675     bool need_addr_change = false;
1676 
1677 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
1678     need_baud_change = hci_stack->config
1679                         && hci_stack->chipset
1680                         && hci_stack->chipset->set_baudrate_command
1681                         && hci_stack->hci_transport->set_baudrate
1682                         && ((hci_transport_config_uart_t *)hci_stack->config)->baudrate_main;
1683 
1684     need_addr_change = hci_stack->custom_bd_addr_set
1685                         && hci_stack->chipset
1686                         && hci_stack->chipset->set_bd_addr_command;
1687 #endif
1688 
1689     switch(hci_stack->substate){
1690 
1691 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
1692         case HCI_INIT_SEND_RESET:
1693             // on CSR with BCSP/H5, resend triggers resend of HCI Reset and leads to substate == HCI_INIT_SEND_RESET
1694             // fix: just correct substate and behave as command below
1695             hci_stack->substate = HCI_INIT_W4_SEND_RESET;
1696             btstack_run_loop_remove_timer(&hci_stack->timeout);
1697             break;
1698         case HCI_INIT_W4_SEND_RESET:
1699             btstack_run_loop_remove_timer(&hci_stack->timeout);
1700             break;
1701         case HCI_INIT_W4_SEND_READ_LOCAL_NAME:
1702             log_info("Received local name, need baud change %d", (int) need_baud_change);
1703             if (need_baud_change){
1704                 hci_stack->substate = HCI_INIT_SEND_BAUD_CHANGE;
1705                 return;
1706             }
1707             // skip baud change
1708             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1709             return;
1710         case HCI_INIT_W4_SEND_BAUD_CHANGE:
1711             // for STLC2500D, baud rate change already happened.
1712             // for others, baud rate gets changed now
1713             if ((hci_stack->manufacturer != BLUETOOTH_COMPANY_ID_ST_MICROELECTRONICS) && need_baud_change){
1714                 uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
1715                 log_info("Local baud rate change to %" PRIu32 "(w4_send_baud_change)", baud_rate);
1716                 hci_stack->hci_transport->set_baudrate(baud_rate);
1717             }
1718             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1719             return;
1720         case HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT:
1721             btstack_run_loop_remove_timer(&hci_stack->timeout);
1722             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1723             return;
1724         case HCI_INIT_W4_CUSTOM_INIT:
1725             // repeat custom init
1726             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1727             return;
1728 #else
1729         case HCI_INIT_W4_SEND_RESET:
1730             hci_stack->substate = HCI_INIT_READ_LOCAL_SUPPORTED_COMMANDS;
1731             return ;
1732 #endif
1733 
1734         case HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS:
1735             if (need_baud_change && (hci_stack->chipset_result != BTSTACK_CHIPSET_NO_INIT_SCRIPT) &&
1736               ((hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_BROADCOM_CORPORATION) ||
1737                (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_EM_MICROELECTRONIC_MARIN_SA))) {
1738                 hci_stack->substate = HCI_INIT_SEND_BAUD_CHANGE_BCM;
1739                 return;
1740             }
1741             if (need_addr_change){
1742                 hci_stack->substate = HCI_INIT_SET_BD_ADDR;
1743                 return;
1744             }
1745             hci_stack->substate = HCI_INIT_READ_BD_ADDR;
1746             return;
1747 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
1748         case HCI_INIT_W4_SEND_BAUD_CHANGE_BCM:
1749             if (need_baud_change){
1750                 uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
1751                 log_info("Local baud rate change to %" PRIu32 "(w4_send_baud_change_bcm))", baud_rate);
1752                 hci_stack->hci_transport->set_baudrate(baud_rate);
1753             }
1754             if (need_addr_change){
1755                 hci_stack->substate = HCI_INIT_SET_BD_ADDR;
1756                 return;
1757             }
1758             hci_stack->substate = HCI_INIT_READ_BD_ADDR;
1759             return;
1760         case HCI_INIT_W4_SET_BD_ADDR:
1761             // for STLC2500D + ATWILC3000, bd addr change only gets active after sending reset command
1762             if ((hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_ST_MICROELECTRONICS)
1763             ||  (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_ATMEL_CORPORATION)){
1764                 hci_stack->substate = HCI_INIT_SEND_RESET_ST_WARM_BOOT;
1765                 return;
1766             }
1767             // skipping st warm boot
1768             hci_stack->substate = HCI_INIT_READ_BD_ADDR;
1769             return;
1770         case HCI_INIT_W4_SEND_RESET_ST_WARM_BOOT:
1771             hci_stack->substate = HCI_INIT_READ_BD_ADDR;
1772             return;
1773 #endif
1774         case HCI_INIT_W4_READ_BD_ADDR:
1775             // only read buffer size if supported
1776             if (hci_stack->local_supported_commands[0u] & 0x01u) {
1777                 hci_stack->substate = HCI_INIT_READ_BUFFER_SIZE;
1778                 return;
1779             }
1780             // skipping read buffer size
1781             hci_stack->substate = HCI_INIT_READ_LOCAL_SUPPORTED_FEATURES;
1782             return;
1783         case HCI_INIT_W4_SET_EVENT_MASK:
1784             // skip Classic init commands for LE only chipsets
1785             if (!hci_classic_supported()){
1786 #ifdef ENABLE_BLE
1787                 if (hci_le_supported()){
1788                     hci_stack->substate = HCI_INIT_LE_READ_BUFFER_SIZE; // skip all classic command
1789                     return;
1790                 }
1791 #endif
1792                 log_error("Neither BR/EDR nor LE supported");
1793                 hci_init_done();
1794                 return;
1795             }
1796             if (!gap_ssp_supported()){
1797                 hci_stack->substate = HCI_INIT_WRITE_PAGE_TIMEOUT;
1798                 return;
1799             }
1800             break;
1801 #ifdef ENABLE_BLE
1802         case HCI_INIT_W4_LE_READ_BUFFER_SIZE:
1803             // skip write le host if not supported (e.g. on LE only EM9301)
1804             if (hci_stack->local_supported_commands[0u] & 0x02u) break;
1805             hci_stack->substate = HCI_INIT_LE_SET_EVENT_MASK;
1806             return;
1807 
1808 #ifdef ENABLE_LE_DATA_LENGTH_EXTENSION
1809         case HCI_INIT_W4_WRITE_LE_HOST_SUPPORTED:
1810             log_info("Supported commands %x", hci_stack->local_supported_commands[0] & 0x30);
1811             if ((hci_stack->local_supported_commands[0u] & 0x30u) == 0x30u){
1812                 hci_stack->substate = HCI_INIT_LE_SET_EVENT_MASK;
1813                 return;
1814             }
1815             // explicit fall through to reduce repetitions
1816 
1817 #ifdef ENABLE_LE_CENTRAL
1818             hci_stack->substate = HCI_INIT_READ_WHITE_LIST_SIZE;
1819 #else
1820             hci_init_done();
1821 #endif
1822             return;
1823 #endif  /* ENABLE_LE_DATA_LENGTH_EXTENSION */
1824 
1825 #endif  /* ENABLE_BLE */
1826 
1827         case HCI_INIT_W4_WRITE_INQUIRY_MODE:
1828             // skip write secure connections host support if not supported or disabled
1829             if (!hci_stack->secure_connections_enable || (hci_stack->local_supported_commands[1u] & 0x02u) == 0u) {
1830                 hci_stack->substate = HCI_INIT_WRITE_SCAN_ENABLE;
1831                 return;
1832             }
1833             break;
1834 
1835 #ifdef ENABLE_SCO_OVER_HCI
1836         case HCI_INIT_W4_WRITE_SCAN_ENABLE:
1837             // skip write synchronous flow control if not supported
1838             if (hci_stack->local_supported_commands[0] & 0x04) break;
1839             hci_stack->substate = HCI_INIT_W4_WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE;
1840 
1841             /* fall through */
1842 
1843         case HCI_INIT_W4_WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE:
1844             // skip write default erroneous data reporting if not supported
1845             if (hci_stack->local_supported_commands[0] & 0x08) break;
1846             hci_stack->substate = HCI_INIT_W4_WRITE_DEFAULT_ERRONEOUS_DATA_REPORTING;
1847 
1848             /* fall through */
1849 
1850         case HCI_INIT_W4_WRITE_DEFAULT_ERRONEOUS_DATA_REPORTING:
1851             // skip bcm set sco pcm config on non-Broadcom chipsets
1852             if (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_BROADCOM_CORPORATION) break;
1853             hci_stack->substate = HCI_INIT_W4_BCM_WRITE_SCO_PCM_INT;
1854 
1855             /* fall through */
1856 
1857         case HCI_INIT_W4_BCM_WRITE_SCO_PCM_INT:
1858             if (!hci_le_supported()){
1859                 // SKIP LE init for Classic only configuration
1860                 hci_init_done();
1861                 return;
1862             }
1863             break;
1864 
1865 #else /* !ENABLE_SCO_OVER_HCI */
1866 
1867         case HCI_INIT_W4_WRITE_SCAN_ENABLE:
1868 #ifdef ENABLE_SCO_OVER_PCM
1869             if (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_BROADCOM_CORPORATION) {
1870                 hci_stack->substate = HCI_INIT_BCM_WRITE_SCO_PCM_INT;
1871                 return;
1872             }
1873 #endif
1874             /* fall through */
1875 
1876         case HCI_INIT_W4_BCM_WRITE_SCO_PCM_INT:
1877 #ifdef ENABLE_BLE
1878             if (hci_le_supported()){
1879                 hci_stack->substate = HCI_INIT_LE_READ_BUFFER_SIZE;
1880                 return;
1881             }
1882 #endif
1883             // SKIP LE init for Classic only configuration
1884             hci_init_done();
1885             return;
1886 #endif /* ENABLE_SCO_OVER_HCI */
1887 
1888 // avoid compile error due to duplicate cases: HCI_INIT_W4_BCM_WRITE_SCO_PCM_INT == HCI_INIT_DONE-1
1889 #if defined(ENABLE_BLE) || defined(ENABLE_LE_DATA_LENGTH_EXTENSION) || defined(ENABLE_LE_CENTRAL)
1890         // Response to command before init done state -> init done
1891         case (HCI_INIT_DONE-1):
1892             hci_init_done();
1893             return;
1894 #endif
1895 
1896         default:
1897             break;
1898     }
1899     hci_initializing_next_state();
1900 }
1901 
1902 static void hci_handle_connection_failed(hci_connection_t * conn, uint8_t status){
1903     log_info("Outgoing connection to %s failed", bd_addr_to_str(conn->address));
1904     bd_addr_t bd_address;
1905     (void)memcpy(&bd_address, conn->address, 6);
1906 
1907 #ifdef ENABLE_CLASSIC
1908     // cache needed data
1909     int notify_dedicated_bonding_failed = conn->bonding_flags & BONDING_DEDICATED;
1910 #endif
1911 
1912     // connection failed, remove entry
1913     btstack_linked_list_remove(&hci_stack->connections, (btstack_linked_item_t *) conn);
1914     btstack_memory_hci_connection_free( conn );
1915 
1916 #ifdef ENABLE_CLASSIC
1917     // notify client if dedicated bonding
1918     if (notify_dedicated_bonding_failed){
1919         log_info("hci notify_dedicated_bonding_failed");
1920         hci_emit_dedicated_bonding_result(bd_address, status);
1921     }
1922 
1923     // if authentication error, also delete link key
1924     if (status == ERROR_CODE_AUTHENTICATION_FAILURE) {
1925         gap_drop_link_key_for_bd_addr(bd_address);
1926     }
1927 #else
1928     UNUSED(status);
1929 #endif
1930 }
1931 
1932 #ifdef ENABLE_CLASSIC
1933 static void hci_handle_remote_features_page_0(hci_connection_t * conn, const uint8_t * features){
1934     // SSP Controller
1935     if (features[6] & (1 << 3)){
1936         conn->bonding_flags |= BONDING_REMOTE_SUPPORTS_SSP_CONTROLLER;
1937     }
1938     // eSCO
1939     if (features[3] & (1<<7)){
1940         conn->remote_supported_features[0] |= 1;
1941     }
1942     // Extended features
1943     if (features[7] & (1<<7)){
1944         conn->remote_supported_features[0] |= 2;
1945     }
1946 }
1947 
1948 static void hci_handle_remote_features_page_1(hci_connection_t * conn, const uint8_t * features){
1949     // SSP Host
1950     if (features[0] & (1 << 0)){
1951         conn->bonding_flags |= BONDING_REMOTE_SUPPORTS_SSP_HOST;
1952     }
1953     // SC Host
1954     if (features[0] & (1 << 3)){
1955         conn->bonding_flags |= BONDING_REMOTE_SUPPORTS_SC_HOST;
1956     }
1957 }
1958 
1959 static void hci_handle_remote_features_page_2(hci_connection_t * conn, const uint8_t * features){
1960     // SC Controller
1961     if (features[1] & (1 << 0)){
1962         conn->bonding_flags |= BONDING_REMOTE_SUPPORTS_SC_CONTROLLER;
1963     }
1964 }
1965 
1966 static void hci_handle_remote_features_received(hci_connection_t * conn){
1967     conn->bonding_flags |= BONDING_RECEIVED_REMOTE_FEATURES;
1968     log_info("Remote features %02x, bonding flags %x", conn->remote_supported_features[0], conn->bonding_flags);
1969     if (conn->bonding_flags & BONDING_DEDICATED){
1970         conn->bonding_flags |= BONDING_SEND_AUTHENTICATE_REQUEST;
1971     }
1972 }
1973 #endif
1974 
1975 static void handle_event_for_current_stack_state(const uint8_t * packet, uint16_t size) {
1976     // handle BT initialization
1977     if (hci_stack->state == HCI_STATE_INITIALIZING) {
1978         hci_initializing_event_handler(packet, size);
1979     }
1980 
1981     // help with BT sleep
1982     if ((hci_stack->state == HCI_STATE_FALLING_ASLEEP)
1983         && (hci_stack->substate == HCI_FALLING_ASLEEP_W4_WRITE_SCAN_ENABLE)
1984         && HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_write_scan_enable)) {
1985         hci_initializing_next_state();
1986     }
1987 }
1988 
1989 #ifdef ENABLE_CLASSIC
1990 static void hci_handle_read_encryption_key_size_complete(hci_connection_t * conn, uint8_t encryption_key_size) {
1991     conn->authentication_flags |= CONNECTION_ENCRYPTED;
1992     conn->encryption_key_size = encryption_key_size;
1993 
1994     if ((conn->authentication_flags & CONNECTION_AUTHENTICATED) != 0) {
1995         hci_emit_security_level(conn->con_handle, gap_security_level_for_connection(conn));
1996         return;
1997     }
1998 
1999     // Request Authentication if not already done
2000     if ((conn->bonding_flags & BONDING_SENT_AUTHENTICATE_REQUEST) != 0) return;
2001     conn->bonding_flags |= BONDING_SEND_AUTHENTICATE_REQUEST;
2002 }
2003 #endif
2004 
2005 static void handle_command_complete_event(uint8_t * packet, uint16_t size){
2006     UNUSED(size);
2007 
2008     uint16_t manufacturer;
2009 #ifdef ENABLE_CLASSIC
2010     hci_con_handle_t handle;
2011     hci_connection_t * conn;
2012     uint8_t status;
2013 #endif
2014     // get num cmd packets - limit to 1 to reduce complexity
2015     hci_stack->num_cmd_packets = packet[2] ? 1 : 0;
2016 
2017     uint16_t opcode = hci_event_command_complete_get_command_opcode(packet);
2018     switch (opcode){
2019         case HCI_OPCODE_HCI_READ_LOCAL_NAME:
2020             if (packet[5]) break;
2021             // terminate, name 248 chars
2022             packet[6+248] = 0;
2023             log_info("local name: %s", &packet[6]);
2024             break;
2025         case HCI_OPCODE_HCI_READ_BUFFER_SIZE:
2026             // "The HC_ACL_Data_Packet_Length return parameter will be used to determine the size of the L2CAP segments contained in ACL Data Packets"
2027             if (hci_stack->state == HCI_STATE_INITIALIZING) {
2028                 uint16_t acl_len = little_endian_read_16(packet, 6);
2029                 uint16_t sco_len = packet[8];
2030 
2031                 // determine usable ACL/SCO payload size
2032                 hci_stack->acl_data_packet_length = btstack_min(acl_len, HCI_ACL_PAYLOAD_SIZE);
2033                 hci_stack->sco_data_packet_length = btstack_min(sco_len, HCI_ACL_PAYLOAD_SIZE);
2034 
2035                 hci_stack->acl_packets_total_num = little_endian_read_16(packet, 9);
2036                 hci_stack->sco_packets_total_num = little_endian_read_16(packet, 11);
2037 
2038                 log_info("hci_read_buffer_size: ACL size module %u -> used %u, count %u / SCO size %u, count %u",
2039                          acl_len, hci_stack->acl_data_packet_length, hci_stack->acl_packets_total_num,
2040                          hci_stack->sco_data_packet_length, hci_stack->sco_packets_total_num);
2041             }
2042             break;
2043         case HCI_OPCODE_HCI_READ_RSSI:
2044             if (packet[5] == ERROR_CODE_SUCCESS){
2045                 uint8_t event[5];
2046                 event[0] = GAP_EVENT_RSSI_MEASUREMENT;
2047                 event[1] = 3;
2048                 (void)memcpy(&event[2], &packet[6], 3);
2049                 hci_emit_event(event, sizeof(event), 1);
2050             }
2051             break;
2052 #ifdef ENABLE_BLE
2053         case HCI_OPCODE_HCI_LE_READ_BUFFER_SIZE:
2054             hci_stack->le_data_packets_length = little_endian_read_16(packet, 6);
2055             hci_stack->le_acl_packets_total_num = packet[8];
2056             // determine usable ACL payload size
2057             if (HCI_ACL_PAYLOAD_SIZE < hci_stack->le_data_packets_length){
2058                 hci_stack->le_data_packets_length = HCI_ACL_PAYLOAD_SIZE;
2059             }
2060             log_info("hci_le_read_buffer_size: size %u, count %u", hci_stack->le_data_packets_length, hci_stack->le_acl_packets_total_num);
2061             break;
2062 #endif
2063 #ifdef ENABLE_LE_DATA_LENGTH_EXTENSION
2064         case HCI_OPCODE_HCI_LE_READ_MAXIMUM_DATA_LENGTH:
2065             hci_stack->le_supported_max_tx_octets = little_endian_read_16(packet, 6);
2066             hci_stack->le_supported_max_tx_time = little_endian_read_16(packet, 8);
2067             log_info("hci_le_read_maximum_data_length: tx octets %u, tx time %u us", hci_stack->le_supported_max_tx_octets, hci_stack->le_supported_max_tx_time);
2068             break;
2069 #endif
2070 #ifdef ENABLE_LE_CENTRAL
2071         case HCI_OPCODE_HCI_LE_READ_WHITE_LIST_SIZE:
2072             hci_stack->le_whitelist_capacity = packet[6];
2073             log_info("hci_le_read_white_list_size: size %u", hci_stack->le_whitelist_capacity);
2074             break;
2075 #endif
2076         case HCI_OPCODE_HCI_READ_BD_ADDR:
2077             reverse_bd_addr(&packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], hci_stack->local_bd_addr);
2078             log_info("Local Address, Status: 0x%02x: Addr: %s", packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE], bd_addr_to_str(hci_stack->local_bd_addr));
2079 #ifdef ENABLE_CLASSIC
2080             if (hci_stack->link_key_db){
2081                 hci_stack->link_key_db->set_local_bd_addr(hci_stack->local_bd_addr);
2082             }
2083 #endif
2084             break;
2085 #ifdef ENABLE_CLASSIC
2086         case HCI_OPCODE_HCI_WRITE_SCAN_ENABLE:
2087             hci_emit_discoverable_enabled(hci_stack->discoverable);
2088             break;
2089         case HCI_OPCODE_HCI_INQUIRY_CANCEL:
2090             if (hci_stack->inquiry_state == GAP_INQUIRY_STATE_W4_CANCELLED){
2091                 hci_stack->inquiry_state = GAP_INQUIRY_STATE_IDLE;
2092                 uint8_t event[] = { GAP_EVENT_INQUIRY_COMPLETE, 1, 0};
2093                 hci_emit_event(event, sizeof(event), 1);
2094             }
2095             break;
2096 #endif
2097         case HCI_OPCODE_HCI_READ_LOCAL_SUPPORTED_FEATURES:
2098             (void)memcpy(hci_stack->local_supported_features, &packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1], 8);
2099 
2100 #ifdef ENABLE_CLASSIC
2101             // determine usable ACL packet types based on host buffer size and supported features
2102             hci_stack->packet_types = hci_acl_packet_types_for_buffer_size_and_local_features(HCI_ACL_PAYLOAD_SIZE, &hci_stack->local_supported_features[0]);
2103             log_info("Packet types %04x, eSCO %u", hci_stack->packet_types, hci_extended_sco_link_supported());
2104 #endif
2105             // Classic/LE
2106             log_info("BR/EDR support %u, LE support %u", hci_classic_supported(), hci_le_supported());
2107             break;
2108         case HCI_OPCODE_HCI_READ_LOCAL_VERSION_INFORMATION:
2109             manufacturer = little_endian_read_16(packet, 10);
2110             // map Cypress to Broadcom
2111             if (manufacturer  == BLUETOOTH_COMPANY_ID_CYPRESS_SEMICONDUCTOR){
2112                 log_info("Treat Cypress as Broadcom");
2113                 manufacturer = BLUETOOTH_COMPANY_ID_BROADCOM_CORPORATION;
2114                 little_endian_store_16(packet, 10, manufacturer);
2115             }
2116             hci_stack->manufacturer = manufacturer;
2117             log_info("Manufacturer: 0x%04x", hci_stack->manufacturer);
2118             break;
2119         case HCI_OPCODE_HCI_READ_LOCAL_SUPPORTED_COMMANDS:
2120             hci_stack->local_supported_commands[0] =
2121                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+14u] & 0x80u) >> 7u) |  // bit  0 = Octet 14, bit 7 / Read Buffer Size
2122                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+24u] & 0x40u) >> 5u) |  // bit  1 = Octet 24, bit 6 / Write Le Host Supported
2123                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+10u] & 0x10u) >> 2u) |  // bit  2 = Octet 10, bit 4 / Write Synchronous Flow Control Enable
2124                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+18u] & 0x08u)     )  |  // bit  3 = Octet 18, bit 3 / Write Default Erroneous Data Reporting
2125                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+34u] & 0x01u) << 4u) |  // bit  4 = Octet 34, bit 0 / LE Write Suggested Default Data Length
2126                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+35u] & 0x08u) << 2u) |  // bit  5 = Octet 35, bit 3 / LE Read Maximum Data Length
2127                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+35u] & 0x20u) << 1u) |  // bit  6 = Octet 35, bit 5 / LE Set Default PHY
2128                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+20u] & 0x10u) << 3u);   // bit  7 = Octet 20, bit 4 / Read Encryption Key Size
2129             hci_stack->local_supported_commands[1] =
2130                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+ 2u] & 0x40u) >> 6u) |  // bit  8 = Octet  2, bit 6 / Read Remote Extended Features
2131                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+32u] & 0x08u) >> 2u) |  // bit  9 = Octet 32, bit 3 / Write Secure Connections Host
2132                 ((packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1u+35u] & 0x02u) << 1u);   // bit 10 = Octet 35, bit 1 / LE Set Address Resolution Enable
2133             log_info("Local supported commands summary %02x - %02x", hci_stack->local_supported_commands[0],  hci_stack->local_supported_commands[1]);
2134             break;
2135 #ifdef ENABLE_CLASSIC
2136         case HCI_OPCODE_HCI_WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE:
2137             if (packet[5]) return;
2138             hci_stack->synchronous_flow_control_enabled = 1;
2139             break;
2140         case HCI_OPCODE_HCI_READ_ENCRYPTION_KEY_SIZE:
2141             status = packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE];
2142             handle = little_endian_read_16(packet, OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1);
2143             conn   = hci_connection_for_handle(handle);
2144             if (conn != NULL) {
2145                 uint8_t key_size = 0;
2146                 if (status == 0){
2147                     key_size = packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+3];
2148                     log_info("Handle %04x key Size: %u", handle, key_size);
2149                 } else {
2150                     log_info("Read Encryption Key Size failed 0x%02x-> assuming insecure connection with key size of 1", status);
2151                 }
2152                 hci_handle_read_encryption_key_size_complete(conn, key_size);
2153             }
2154             break;
2155 #endif
2156         default:
2157             break;
2158     }
2159 }
2160 
2161 #ifdef ENABLE_BLE
2162 static void event_handle_le_connection_complete(const uint8_t * packet){
2163 	bd_addr_t addr;
2164 	bd_addr_type_t addr_type;
2165 	hci_connection_t * conn;
2166 
2167 	// Connection management
2168 	reverse_bd_addr(&packet[8], addr);
2169 	addr_type = (bd_addr_type_t)packet[7];
2170 	log_info("LE Connection_complete (status=%u) type %u, %s", packet[3], addr_type, bd_addr_to_str(addr));
2171 	conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
2172 
2173 #ifdef ENABLE_LE_CENTRAL
2174 	// handle error: error is reported only to the initiator -> outgoing connection
2175 	if (packet[3]){
2176 
2177 		// handle cancelled outgoing connection
2178 		// "If the cancellation was successful then, after the Command Complete event for the LE_Create_Connection_Cancel command,
2179 		//  either an LE Connection Complete or an LE Enhanced Connection Complete event shall be generated.
2180 		//  In either case, the event shall be sent with the error code Unknown Connection Identifier (0x02)."
2181 		if (packet[3] == ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER){
2182 			// whitelist connect
2183 			if (hci_is_le_connection_type(addr_type)){
2184 				hci_stack->le_connecting_state   = LE_CONNECTING_IDLE;
2185 				hci_stack->le_connecting_request = LE_CONNECTING_IDLE;
2186 			}
2187 			// get outgoing connection conn struct for direct connect
2188 			conn = gap_get_outgoing_connection();
2189 		}
2190 
2191 		// outgoing le connection establishment is done
2192 		if (conn){
2193 			// remove entry
2194 			btstack_linked_list_remove(&hci_stack->connections, (btstack_linked_item_t *) conn);
2195 			btstack_memory_hci_connection_free( conn );
2196 		}
2197 		return;
2198 	}
2199 #endif
2200 
2201 	// on success, both hosts receive connection complete event
2202 	if (packet[6] == HCI_ROLE_MASTER){
2203 #ifdef ENABLE_LE_CENTRAL
2204 		// if we're master on an le connection, it was an outgoing connection and we're done with it
2205 		// note: no hci_connection_t object exists yet for connect with whitelist
2206 		if (hci_is_le_connection_type(addr_type)){
2207 			hci_stack->le_connecting_state   = LE_CONNECTING_IDLE;
2208 			hci_stack->le_connecting_request = LE_CONNECTING_IDLE;
2209 		}
2210 #endif
2211 	} else {
2212 #ifdef ENABLE_LE_PERIPHERAL
2213 		// if we're slave, it was an incoming connection, advertisements have stopped
2214 		hci_stack->le_advertisements_active = false;
2215 #endif
2216 	}
2217 
2218 	// LE connections are auto-accepted, so just create a connection if there isn't one already
2219 	if (!conn){
2220 		conn = create_connection_for_bd_addr_and_type(addr, addr_type);
2221 	}
2222 
2223 	// no memory, sorry.
2224 	if (!conn){
2225 		return;
2226 	}
2227 
2228 	conn->state = OPEN;
2229 	conn->role  = packet[6];
2230 	conn->con_handle             = hci_subevent_le_connection_complete_get_connection_handle(packet);
2231 	conn->le_connection_interval = hci_subevent_le_connection_complete_get_conn_interval(packet);
2232 
2233 #ifdef ENABLE_LE_PERIPHERAL
2234 	if (packet[6] == HCI_ROLE_SLAVE){
2235 		hci_update_advertisements_enabled_for_current_roles();
2236 	}
2237 #endif
2238 
2239     // init unenhanced att bearer mtu
2240     conn->att_connection.mtu = ATT_DEFAULT_MTU;
2241     conn->att_connection.mtu_exchanged = false;
2242 
2243     // TODO: store - role, peer address type, conn_interval, conn_latency, supervision timeout, master clock
2244 
2245 	// restart timer
2246 	// btstack_run_loop_set_timer(&conn->timeout, HCI_CONNECTION_TIMEOUT_MS);
2247 	// btstack_run_loop_add_timer(&conn->timeout);
2248 
2249 	log_info("New connection: handle %u, %s", conn->con_handle, bd_addr_to_str(conn->address));
2250 
2251 	hci_emit_nr_connections_changed();
2252 }
2253 #endif
2254 
2255 static void event_handler(uint8_t *packet, uint16_t size){
2256 
2257     uint16_t event_length = packet[1];
2258 
2259     // assert packet is complete
2260     if (size != (event_length + 2u)){
2261         log_error("event_handler called with packet of wrong size %d, expected %u => dropping packet", size, event_length + 2);
2262         return;
2263     }
2264 
2265     bd_addr_type_t addr_type;
2266     hci_con_handle_t handle;
2267     hci_connection_t * conn;
2268     int i;
2269     int create_connection_cmd;
2270 
2271 #ifdef ENABLE_CLASSIC
2272     uint8_t link_type;
2273     bd_addr_t addr;
2274 #endif
2275 
2276     // log_info("HCI:EVENT:%02x", hci_event_packet_get_type(packet));
2277 
2278     switch (hci_event_packet_get_type(packet)) {
2279 
2280         case HCI_EVENT_COMMAND_COMPLETE:
2281             handle_command_complete_event(packet, size);
2282             break;
2283 
2284         case HCI_EVENT_COMMAND_STATUS:
2285             // get num cmd packets - limit to 1 to reduce complexity
2286             hci_stack->num_cmd_packets = packet[3] ? 1 : 0;
2287 
2288             // check command status to detected failed outgoing connections
2289             create_connection_cmd = 0;
2290 #ifdef ENABLE_CLASSIC
2291             if (HCI_EVENT_IS_COMMAND_STATUS(packet, hci_create_connection)){
2292                 create_connection_cmd = 1;
2293             }
2294 #endif
2295 #ifdef ENABLE_LE_CENTRAL
2296             if (HCI_EVENT_IS_COMMAND_STATUS(packet, hci_le_create_connection)){
2297                 create_connection_cmd = 1;
2298             }
2299 #endif
2300             if (create_connection_cmd) {
2301                 uint8_t status = hci_event_command_status_get_status(packet);
2302                 addr_type = hci_stack->outgoing_addr_type;
2303                 conn = hci_connection_for_bd_addr_and_type(hci_stack->outgoing_addr, addr_type);
2304                 log_info("command status (create connection), status %x, connection %p, addr %s, type %x", status, conn, bd_addr_to_str(hci_stack->outgoing_addr), addr_type);
2305 
2306                 // reset outgoing address info
2307                 memset(hci_stack->outgoing_addr, 0, 6);
2308                 hci_stack->outgoing_addr_type = BD_ADDR_TYPE_UNKNOWN;
2309 
2310                 // on error
2311                 if (status != ERROR_CODE_SUCCESS){
2312 #ifdef ENABLE_LE_CENTRAL
2313                     if (hci_is_le_connection_type(addr_type)){
2314                         hci_stack->le_connecting_state = LE_CONNECTING_IDLE;
2315                         hci_stack->le_connecting_request = LE_CONNECTING_IDLE;
2316                     }
2317 #endif
2318                     // error => outgoing connection failed
2319                     if (conn != NULL){
2320                         hci_handle_connection_failed(conn, status);
2321                     }
2322                 }
2323             }
2324             break;
2325 
2326         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:{
2327             if (size < 3) return;
2328             uint16_t num_handles = packet[2];
2329             if (size != (3u + num_handles * 4u)) return;
2330             uint16_t offset = 3;
2331             for (i=0; i<num_handles;i++){
2332                 handle = little_endian_read_16(packet, offset) & 0x0fffu;
2333                 offset += 2u;
2334                 uint16_t num_packets = little_endian_read_16(packet, offset);
2335                 offset += 2u;
2336 
2337                 conn = hci_connection_for_handle(handle);
2338                 if (!conn){
2339                     log_error("hci_number_completed_packet lists unused con handle %u", handle);
2340                     continue;
2341                 }
2342 
2343                 if (conn->num_packets_sent >= num_packets){
2344                     conn->num_packets_sent -= num_packets;
2345                 } else {
2346                     log_error("hci_number_completed_packets, more packet slots freed then sent.");
2347                     conn->num_packets_sent = 0;
2348                 }
2349                 // log_info("hci_number_completed_packet %u processed for handle %u, outstanding %u", num_packets, handle, conn->num_packets_sent);
2350 
2351 #ifdef ENABLE_CLASSIC
2352                 // For SCO, we do the can_send_now_check here
2353                 hci_notify_if_sco_can_send_now();
2354 #endif
2355             }
2356             break;
2357         }
2358 
2359 #ifdef ENABLE_CLASSIC
2360         case HCI_EVENT_INQUIRY_COMPLETE:
2361             if (hci_stack->inquiry_state == GAP_INQUIRY_STATE_ACTIVE){
2362                 hci_stack->inquiry_state = GAP_INQUIRY_STATE_IDLE;
2363                 uint8_t event[] = { GAP_EVENT_INQUIRY_COMPLETE, 1, 0};
2364                 hci_emit_event(event, sizeof(event), 1);
2365             }
2366             break;
2367         case HCI_EVENT_REMOTE_NAME_REQUEST_COMPLETE:
2368             if (hci_stack->remote_name_state == GAP_REMOTE_NAME_STATE_W4_COMPLETE){
2369                 hci_stack->remote_name_state = GAP_REMOTE_NAME_STATE_IDLE;
2370             }
2371             break;
2372         case HCI_EVENT_CONNECTION_REQUEST:
2373             reverse_bd_addr(&packet[2], addr);
2374             if (hci_stack->gap_classic_accept_callback != NULL){
2375                 if ((*hci_stack->gap_classic_accept_callback)(addr) == 0){
2376                     hci_stack->decline_reason = ERROR_CODE_CONNECTION_REJECTED_DUE_TO_UNACCEPTABLE_BD_ADDR;
2377                     bd_addr_copy(hci_stack->decline_addr, addr);
2378                     break;
2379                 }
2380             }
2381 
2382             // TODO: eval COD 8-10
2383             link_type = packet[11];
2384             log_info("Connection_incoming: %s, type %u", bd_addr_to_str(addr), link_type);
2385             addr_type = (link_type == 1) ? BD_ADDR_TYPE_ACL : BD_ADDR_TYPE_SCO;
2386             conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
2387             if (!conn) {
2388                 conn = create_connection_for_bd_addr_and_type(addr, addr_type);
2389             }
2390             if (!conn) {
2391                 // CONNECTION REJECTED DUE TO LIMITED RESOURCES (0X0D)
2392                 hci_stack->decline_reason = ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES;
2393                 bd_addr_copy(hci_stack->decline_addr, addr);
2394                 break;
2395             }
2396             conn->role  = HCI_ROLE_SLAVE;
2397             conn->state = RECEIVED_CONNECTION_REQUEST;
2398             // store info about eSCO
2399             if (link_type == 0x02){
2400                 conn->remote_supported_features[0] |= 1;
2401             }
2402             hci_run();
2403             break;
2404 
2405         case HCI_EVENT_CONNECTION_COMPLETE:
2406             // Connection management
2407             reverse_bd_addr(&packet[5], addr);
2408             log_info("Connection_complete (status=%u) %s", packet[2], bd_addr_to_str(addr));
2409             addr_type = BD_ADDR_TYPE_ACL;
2410             conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
2411             if (conn) {
2412                 if (!packet[2]){
2413                     conn->state = OPEN;
2414                     conn->con_handle = little_endian_read_16(packet, 3);
2415 
2416                     // queue get remote feature
2417                     conn->bonding_flags |= BONDING_REQUEST_REMOTE_FEATURES_PAGE_0;
2418 
2419                     // queue set supervision timeout if we're master
2420                     if ((hci_stack->link_supervision_timeout != 0) && (conn->role == HCI_ROLE_MASTER)){
2421                         connectionSetAuthenticationFlags(conn, WRITE_SUPERVISION_TIMEOUT);
2422                     }
2423 
2424                     // restart timer
2425                     btstack_run_loop_set_timer(&conn->timeout, HCI_CONNECTION_TIMEOUT_MS);
2426                     btstack_run_loop_add_timer(&conn->timeout);
2427 
2428                     log_info("New connection: handle %u, %s", conn->con_handle, bd_addr_to_str(conn->address));
2429 
2430                     hci_emit_nr_connections_changed();
2431                 } else {
2432                     // connection failed
2433                     hci_handle_connection_failed(conn, packet[2]);
2434                 }
2435             }
2436             break;
2437 
2438         case HCI_EVENT_SYNCHRONOUS_CONNECTION_COMPLETE:
2439             reverse_bd_addr(&packet[5], addr);
2440             log_info("Synchronous Connection Complete (status=%u) %s", packet[2], bd_addr_to_str(addr));
2441             if (packet[2]){
2442                 // connection failed
2443                 break;
2444             }
2445             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_SCO);
2446             if (!conn) {
2447                 conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_SCO);
2448             }
2449             if (!conn) {
2450                 break;
2451             }
2452             conn->state = OPEN;
2453             conn->con_handle = little_endian_read_16(packet, 3);
2454 
2455 #ifdef ENABLE_SCO_OVER_HCI
2456             // update SCO
2457             if (conn->address_type == BD_ADDR_TYPE_SCO && hci_stack->hci_transport && hci_stack->hci_transport->set_sco_config){
2458                 hci_stack->hci_transport->set_sco_config(hci_stack->sco_voice_setting_active, hci_number_sco_connections());
2459             }
2460             // trigger can send now
2461             if (hci_have_usb_transport()){
2462                 hci_stack->sco_can_send_now = 1;
2463             }
2464 #endif
2465             break;
2466 
2467         case HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE:
2468             handle = little_endian_read_16(packet, 3);
2469             conn = hci_connection_for_handle(handle);
2470             if (!conn) break;
2471             if (!packet[2]){
2472                 const uint8_t * features = &packet[5];
2473                 hci_handle_remote_features_page_0(conn, features);
2474 
2475                 // read extended features if possible
2476                 if (((hci_stack->local_supported_commands[1] & 1) != 0) && ((conn->remote_supported_features[0] & 2) != 0)) {
2477                     conn->bonding_flags |= BONDING_REQUEST_REMOTE_FEATURES_PAGE_1;
2478                     break;
2479                 }
2480             }
2481             hci_handle_remote_features_received(conn);
2482             break;
2483 
2484         case HCI_EVENT_READ_REMOTE_EXTENDED_FEATURES_COMPLETE:
2485             handle = little_endian_read_16(packet, 3);
2486             conn = hci_connection_for_handle(handle);
2487             if (!conn) break;
2488             // status = ok, page = 1
2489             if (!packet[2]) {
2490                 uint8_t page_number = packet[5];
2491                 uint8_t maximum_page_number = packet[6];
2492                 const uint8_t * features = &packet[7];
2493                 bool done = false;
2494                 switch (page_number){
2495                     case 1:
2496                         hci_handle_remote_features_page_1(conn, features);
2497                         if (maximum_page_number >= 2){
2498                             // get Secure Connections (Controller) from Page 2 if available
2499                             conn->bonding_flags |= BONDING_REQUEST_REMOTE_FEATURES_PAGE_2;
2500                         } else {
2501                             // otherwise, assume SC (Controller) == SC (Host)
2502                             if ((conn->bonding_flags & BONDING_REMOTE_SUPPORTS_SC_HOST) != 0){
2503                                 conn->bonding_flags |= BONDING_REMOTE_SUPPORTS_SC_CONTROLLER;
2504                             }
2505                             done = true;
2506                         }
2507                         break;
2508                     case 2:
2509                         hci_handle_remote_features_page_2(conn, features);
2510                         done = true;
2511                         break;
2512                     default:
2513                         break;
2514                 }
2515                 if (!done) break;
2516             }
2517             hci_handle_remote_features_received(conn);
2518             break;
2519 
2520         case HCI_EVENT_LINK_KEY_REQUEST:
2521             log_info("HCI_EVENT_LINK_KEY_REQUEST");
2522             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], RECV_LINK_KEY_REQUEST);
2523             // request handled by hci_run()
2524             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], HANDLE_LINK_KEY_REQUEST);
2525             break;
2526 
2527         case HCI_EVENT_LINK_KEY_NOTIFICATION: {
2528             reverse_bd_addr(&packet[2], addr);
2529             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
2530             if (!conn) break;
2531             conn->authentication_flags |= RECV_LINK_KEY_NOTIFICATION;
2532             link_key_type_t link_key_type = (link_key_type_t)packet[24];
2533             // Change Connection Encryption keeps link key type
2534             if (link_key_type != CHANGED_COMBINATION_KEY){
2535                 conn->link_key_type = link_key_type;
2536             }
2537             gap_store_link_key_for_bd_addr(addr, &packet[8], conn->link_key_type);
2538             // still forward event to allow dismiss of pairing dialog
2539             break;
2540         }
2541 
2542         case HCI_EVENT_PIN_CODE_REQUEST:
2543             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], LEGACY_PAIRING_ACTIVE);
2544             // non-bondable mode: pin code negative reply will be sent
2545             if (!hci_stack->bondable){
2546                 hci_add_connection_flags_for_flipped_bd_addr(&packet[2], DENY_PIN_CODE_REQUEST);
2547                 hci_run();
2548                 return;
2549             }
2550             // PIN CODE REQUEST means the link key request didn't succee -> delete stored link key
2551             if (!hci_stack->link_key_db) break;
2552             hci_event_pin_code_request_get_bd_addr(packet, addr);
2553             hci_stack->link_key_db->delete_link_key(addr);
2554             break;
2555 
2556         case HCI_EVENT_IO_CAPABILITY_REQUEST:
2557             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], RECV_IO_CAPABILITIES_REQUEST);
2558             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_IO_CAPABILITIES_REPLY);
2559             break;
2560 
2561         case HCI_EVENT_USER_CONFIRMATION_REQUEST:
2562             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SSP_PAIRING_ACTIVE);
2563             if (!hci_stack->ssp_auto_accept) break;
2564             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_USER_CONFIRM_REPLY);
2565             break;
2566 
2567         case HCI_EVENT_USER_PASSKEY_REQUEST:
2568             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SSP_PAIRING_ACTIVE);
2569             if (!hci_stack->ssp_auto_accept) break;
2570             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_USER_PASSKEY_REPLY);
2571             break;
2572         case HCI_EVENT_MODE_CHANGE:
2573             handle = hci_event_mode_change_get_handle(packet);
2574             conn = hci_connection_for_handle(handle);
2575             if (!conn) break;
2576             conn->connection_mode = hci_event_mode_change_get_mode(packet);
2577             log_info("HCI_EVENT_MODE_CHANGE, handle 0x%04x, mode %u", handle, conn->connection_mode);
2578             break;
2579 #endif
2580 
2581         case HCI_EVENT_ENCRYPTION_CHANGE:
2582             handle = hci_event_encryption_change_get_connection_handle(packet);
2583             conn = hci_connection_for_handle(handle);
2584             if (!conn) break;
2585             if (hci_event_encryption_change_get_status(packet) == 0u) {
2586                 uint8_t encryption_enabled = hci_event_encryption_change_get_encryption_enabled(packet);
2587                 if (encryption_enabled){
2588                     if (hci_is_le_connection(conn)){
2589                         // For LE, we accept connection as encrypted
2590                         conn->authentication_flags |= CONNECTION_ENCRYPTED;
2591                     }
2592 #ifdef ENABLE_CLASSIC
2593                     else {
2594                         // Detect Secure Connection -> Legacy Connection Downgrade Attack (BIAS)
2595                         bool sc_used_during_pairing = gap_secure_connection_for_link_key_type(conn->link_key_type) != 0;
2596                         bool connected_uses_aes_ccm = encryption_enabled == 2;
2597                         if (hci_stack->secure_connections_active && sc_used_during_pairing && !connected_uses_aes_ccm){
2598                             log_info("SC during pairing, but only E0 now -> abort");
2599                             conn->bonding_flags |= BONDING_DISCONNECT_SECURITY_BLOCK;
2600                             break;
2601                         }
2602 
2603                         // if AES-CCM is used, authentication used SC -> authentication was mutual and we can skip explicit authentication
2604                         if (connected_uses_aes_ccm){
2605                             conn->authentication_flags |= CONNECTION_AUTHENTICATED;
2606                         }
2607 
2608                         if ((hci_stack->local_supported_commands[0] & 0x80) != 0){
2609                             // For Classic, we need to validate encryption key size first, if possible (== supported by Controller)
2610                             conn->bonding_flags |= BONDING_SEND_READ_ENCRYPTION_KEY_SIZE;
2611                         } else {
2612                             // if not, pretend everything is perfect
2613                             hci_handle_read_encryption_key_size_complete(conn, 16);
2614                         }
2615                     }
2616 #endif
2617                 } else {
2618                     conn->authentication_flags &= ~CONNECTION_ENCRYPTED;
2619                 }
2620             }
2621 
2622             break;
2623 
2624 #ifdef ENABLE_CLASSIC
2625         case HCI_EVENT_AUTHENTICATION_COMPLETE_EVENT:
2626             handle = hci_event_authentication_complete_get_connection_handle(packet);
2627             conn = hci_connection_for_handle(handle);
2628             if (!conn) break;
2629 
2630             // ignore authentication event if we didn't request it
2631             if ((conn->bonding_flags & BONDING_SENT_AUTHENTICATE_REQUEST) == 0) break;
2632 
2633             // dedicated bonding: send result and disconnect
2634             if (conn->bonding_flags & BONDING_DEDICATED){
2635                 conn->bonding_flags &= ~BONDING_DEDICATED;
2636                 conn->bonding_flags |= BONDING_DISCONNECT_DEDICATED_DONE;
2637                 conn->bonding_status = packet[2];
2638                 break;
2639             }
2640 
2641             // authenticated only if auth status == 0
2642             if (hci_event_authentication_complete_get_status(packet) == 0){
2643                 // authenticated
2644                 conn->authentication_flags |= CONNECTION_AUTHENTICATED;
2645 
2646                 // If link key sufficient for requested security and not already encrypted, start encryption
2647                 if (((gap_security_level_for_link_key_type(conn->link_key_type) >= conn->requested_security_level)) &&
2648                     ((conn->authentication_flags & CONNECTION_ENCRYPTED) == 0)){
2649                     conn->bonding_flags |= BONDING_SEND_ENCRYPTION_REQUEST;
2650                     break;
2651                 }
2652             }
2653 
2654             // emit updated security level
2655             hci_emit_security_level(handle, gap_security_level_for_connection(conn));
2656             break;
2657 #endif
2658 
2659         // HCI_EVENT_DISCONNECTION_COMPLETE
2660         // has been split, to first notify stack before shutting connection down
2661         // see end of function, too.
2662         case HCI_EVENT_DISCONNECTION_COMPLETE:
2663             if (packet[2]) break;   // status != 0
2664             handle = little_endian_read_16(packet, 3);
2665             // drop outgoing ACL fragments if it is for closed connection and release buffer if tx not active
2666             if (hci_stack->acl_fragmentation_total_size > 0u) {
2667                 if (handle == READ_ACL_CONNECTION_HANDLE(hci_stack->hci_packet_buffer)){
2668                     int release_buffer = hci_stack->acl_fragmentation_tx_active == 0u;
2669                     log_info("drop fragmented ACL data for closed connection, release buffer %u", release_buffer);
2670                     hci_stack->acl_fragmentation_total_size = 0;
2671                     hci_stack->acl_fragmentation_pos = 0;
2672                     if (release_buffer){
2673                         hci_release_packet_buffer();
2674                     }
2675                 }
2676             }
2677 
2678             conn = hci_connection_for_handle(handle);
2679             if (!conn) break;
2680             // mark connection for shutdown
2681             conn->state = RECEIVED_DISCONNECTION_COMPLETE;
2682 
2683             // emit dedicatd bonding event
2684             if (conn->bonding_flags & BONDING_EMIT_COMPLETE_ON_DISCONNECT){
2685                 hci_emit_dedicated_bonding_result(conn->address, conn->bonding_status);
2686             }
2687 
2688 #ifdef ENABLE_BLE
2689 #ifdef ENABLE_LE_PERIPHERAL
2690             // re-enable advertisements for le connections if active
2691             if (hci_is_le_connection(conn)){
2692                 hci_update_advertisements_enabled_for_current_roles();
2693             }
2694 #endif
2695 #endif
2696             break;
2697 
2698         case HCI_EVENT_HARDWARE_ERROR:
2699             log_error("Hardware Error: 0x%02x", packet[2]);
2700             if (hci_stack->hardware_error_callback){
2701                 (*hci_stack->hardware_error_callback)(packet[2]);
2702             } else {
2703                 // if no special requests, just reboot stack
2704                 hci_power_control_off();
2705                 hci_power_control_on();
2706             }
2707             break;
2708 
2709 #ifdef ENABLE_CLASSIC
2710         case HCI_EVENT_ROLE_CHANGE:
2711             if (packet[2]) break;   // status != 0
2712             reverse_bd_addr(&packet[3], addr);
2713             addr_type = BD_ADDR_TYPE_ACL;
2714             conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
2715             if (!conn) break;
2716             conn->role = packet[9];
2717             break;
2718 #endif
2719 
2720         case HCI_EVENT_TRANSPORT_PACKET_SENT:
2721             // release packet buffer only for asynchronous transport and if there are not further fragements
2722             if (hci_transport_synchronous()) {
2723                 log_error("Synchronous HCI Transport shouldn't send HCI_EVENT_TRANSPORT_PACKET_SENT");
2724                 return; // instead of break: to avoid re-entering hci_run()
2725             }
2726             hci_stack->acl_fragmentation_tx_active = 0;
2727             if (hci_stack->acl_fragmentation_total_size) break;
2728             hci_release_packet_buffer();
2729 
2730             // L2CAP receives this event via the hci_emit_event below
2731 
2732 #ifdef ENABLE_CLASSIC
2733             // For SCO, we do the can_send_now_check here
2734             hci_notify_if_sco_can_send_now();
2735 #endif
2736             break;
2737 
2738 #ifdef ENABLE_CLASSIC
2739         case HCI_EVENT_SCO_CAN_SEND_NOW:
2740             // For SCO, we do the can_send_now_check here
2741             hci_stack->sco_can_send_now = 1;
2742             hci_notify_if_sco_can_send_now();
2743             return;
2744 
2745         // explode inquriy results for easier consumption
2746         case HCI_EVENT_INQUIRY_RESULT:
2747         case HCI_EVENT_INQUIRY_RESULT_WITH_RSSI:
2748         case HCI_EVENT_EXTENDED_INQUIRY_RESPONSE:
2749             gap_inquiry_explode(packet, size);
2750             break;
2751 #endif
2752 
2753 #ifdef ENABLE_BLE
2754         case HCI_EVENT_LE_META:
2755             switch (packet[2]){
2756 #ifdef ENABLE_LE_CENTRAL
2757                 case HCI_SUBEVENT_LE_ADVERTISING_REPORT:
2758                     // log_info("advertising report received");
2759                     if (!hci_stack->le_scanning_enabled) break;
2760                     le_handle_advertisement_report(packet, size);
2761                     break;
2762 #endif
2763                 case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
2764 					event_handle_le_connection_complete(packet);
2765                     break;
2766 
2767                 // log_info("LE buffer size: %u, count %u", little_endian_read_16(packet,6), packet[8]);
2768                 case HCI_SUBEVENT_LE_CONNECTION_UPDATE_COMPLETE:
2769                     handle = hci_subevent_le_connection_update_complete_get_connection_handle(packet);
2770                     conn = hci_connection_for_handle(handle);
2771                     if (!conn) break;
2772                     conn->le_connection_interval = hci_subevent_le_connection_update_complete_get_conn_interval(packet);
2773                     break;
2774 
2775                 case HCI_SUBEVENT_LE_REMOTE_CONNECTION_PARAMETER_REQUEST:
2776                     // connection
2777                     handle = hci_subevent_le_remote_connection_parameter_request_get_connection_handle(packet);
2778                     conn = hci_connection_for_handle(handle);
2779                     if (conn) {
2780                         // read arguments
2781                         uint16_t le_conn_interval_min   = hci_subevent_le_remote_connection_parameter_request_get_interval_min(packet);
2782                         uint16_t le_conn_interval_max   = hci_subevent_le_remote_connection_parameter_request_get_interval_max(packet);
2783                         uint16_t le_conn_latency        = hci_subevent_le_remote_connection_parameter_request_get_latency(packet);
2784                         uint16_t le_supervision_timeout = hci_subevent_le_remote_connection_parameter_request_get_timeout(packet);
2785 
2786                         // validate against current connection parameter range
2787                         le_connection_parameter_range_t existing_range;
2788                         gap_get_connection_parameter_range(&existing_range);
2789                         int update_parameter = gap_connection_parameter_range_included(&existing_range, le_conn_interval_min, le_conn_interval_max, le_conn_latency, le_supervision_timeout);
2790                         if (update_parameter){
2791                             conn->le_con_parameter_update_state = CON_PARAMETER_UPDATE_REPLY;
2792                             conn->le_conn_interval_min = le_conn_interval_min;
2793                             conn->le_conn_interval_max = le_conn_interval_max;
2794                             conn->le_conn_latency = le_conn_latency;
2795                             conn->le_supervision_timeout = le_supervision_timeout;
2796                         } else {
2797                             conn->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NEGATIVE_REPLY;
2798                         }
2799                     }
2800                     break;
2801 #ifdef ENABLE_LE_LIMIT_ACL_FRAGMENT_BY_MAX_OCTETS
2802                 case HCI_SUBEVENT_LE_DATA_LENGTH_CHANGE:
2803                     handle = hci_subevent_le_data_length_change_get_connection_handle(packet);
2804                     conn = hci_connection_for_handle(handle);
2805                     if (conn) {
2806                         conn->le_max_tx_octets = hci_subevent_le_data_length_change_get_max_tx_octets(packet);
2807                     }
2808                     break;
2809 #endif
2810                 default:
2811                     break;
2812             }
2813             break;
2814 #endif
2815         case HCI_EVENT_VENDOR_SPECIFIC:
2816             // Vendor specific commands often create vendor specific event instead of num completed packets
2817             // To avoid getting stuck as num_cmds_packets is zero, reset it to 1 for controllers with this behaviour
2818             switch (hci_stack->manufacturer){
2819                 case BLUETOOTH_COMPANY_ID_CAMBRIDGE_SILICON_RADIO:
2820                     hci_stack->num_cmd_packets = 1;
2821                     break;
2822                 default:
2823                     break;
2824             }
2825             break;
2826         default:
2827             break;
2828     }
2829 
2830     handle_event_for_current_stack_state(packet, size);
2831 
2832     // notify upper stack
2833 	hci_emit_event(packet, size, 0);   // don't dump, already happened in packet handler
2834 
2835     // moved here to give upper stack a chance to close down everything with hci_connection_t intact
2836     if ((hci_event_packet_get_type(packet) == HCI_EVENT_DISCONNECTION_COMPLETE) && (packet[2] == 0)){
2837 		handle = little_endian_read_16(packet, 3);
2838 		hci_connection_t * aConn = hci_connection_for_handle(handle);
2839 		// discard connection if app did not trigger a reconnect in the event handler
2840 		if (aConn && aConn->state == RECEIVED_DISCONNECTION_COMPLETE){
2841 			hci_shutdown_connection(aConn);
2842 		}
2843     }
2844 
2845 	// execute main loop
2846 	hci_run();
2847 }
2848 
2849 #ifdef ENABLE_CLASSIC
2850 
2851 static void sco_tx_timeout_handler(btstack_timer_source_t * ts);
2852 static void sco_schedule_tx(hci_connection_t * conn);
2853 
2854 static void sco_tx_timeout_handler(btstack_timer_source_t * ts){
2855     log_debug("SCO TX Timeout");
2856     hci_con_handle_t con_handle = (hci_con_handle_t) (uintptr_t) btstack_run_loop_get_timer_context(ts);
2857     hci_connection_t * conn = hci_connection_for_handle(con_handle);
2858     if (!conn) return;
2859 
2860     // trigger send
2861     conn->sco_tx_ready = 1;
2862     // extra packet if CVSD but SCO buffer is too short
2863     if (((hci_stack->sco_voice_setting_active & 0x03) != 0x03) && (hci_stack->sco_data_packet_length < 123)){
2864         conn->sco_tx_ready++;
2865     }
2866     hci_notify_if_sco_can_send_now();
2867 }
2868 
2869 
2870 #define SCO_TX_AFTER_RX_MS (6)
2871 
2872 static void sco_schedule_tx(hci_connection_t * conn){
2873 
2874     uint32_t now = btstack_run_loop_get_time_ms();
2875     uint32_t sco_tx_ms = conn->sco_rx_ms + SCO_TX_AFTER_RX_MS;
2876     int time_delta_ms = sco_tx_ms - now;
2877 
2878     btstack_timer_source_t * timer = (conn->sco_rx_count & 1) ? &conn->timeout : &conn->timeout_sco;
2879 
2880     // log_error("SCO TX at %u in %u", (int) sco_tx_ms, time_delta_ms);
2881     btstack_run_loop_set_timer(timer, time_delta_ms);
2882     btstack_run_loop_set_timer_context(timer, (void *) (uintptr_t) conn->con_handle);
2883     btstack_run_loop_set_timer_handler(timer, &sco_tx_timeout_handler);
2884     btstack_run_loop_add_timer(timer);
2885 }
2886 
2887 static void sco_handler(uint8_t * packet, uint16_t size){
2888     // lookup connection struct
2889     hci_con_handle_t con_handle = READ_SCO_CONNECTION_HANDLE(packet);
2890     hci_connection_t * conn     = hci_connection_for_handle(con_handle);
2891     if (!conn) return;
2892 
2893     // CSR 8811 prefixes 60 byte SCO packet in transparent mode with 20 zero bytes -> skip first 20 payload bytes
2894     if (hci_stack->manufacturer == BLUETOOTH_COMPANY_ID_CAMBRIDGE_SILICON_RADIO){
2895         if ((size == 83) && ((hci_stack->sco_voice_setting_active & 0x03) == 0x03)){
2896             packet[2] = 0x3c;
2897             memmove(&packet[3], &packet[23], 63);
2898             size = 63;
2899         }
2900     }
2901 
2902     if (hci_have_usb_transport()){
2903         // Nothing to do
2904     } else {
2905         // log_debug("sco flow %u, handle 0x%04x, packets sent %u, bytes send %u", hci_stack->synchronous_flow_control_enabled, (int) con_handle, conn->num_packets_sent, conn->num_sco_bytes_sent);
2906         if (hci_stack->synchronous_flow_control_enabled == 0){
2907             uint32_t now = btstack_run_loop_get_time_ms();
2908 
2909             if (!conn->sco_rx_valid){
2910                 // ignore first 10 packets
2911                 conn->sco_rx_count++;
2912                 // log_debug("sco rx count %u", conn->sco_rx_count);
2913                 if (conn->sco_rx_count == 10) {
2914                     // use first timestamp as is and pretent it just started
2915                     conn->sco_rx_ms = now;
2916                     conn->sco_rx_valid = 1;
2917                     conn->sco_rx_count = 0;
2918                     sco_schedule_tx(conn);
2919                 }
2920             } else {
2921                 // track expected arrival timme
2922                 conn->sco_rx_count++;
2923                 conn->sco_rx_ms += 7;
2924                 int delta = (int32_t) (now - conn->sco_rx_ms);
2925                 if (delta > 0){
2926                     conn->sco_rx_ms++;
2927                 }
2928                 // log_debug("sco rx %u", conn->sco_rx_ms);
2929                 sco_schedule_tx(conn);
2930             }
2931         }
2932     }
2933     // deliver to app
2934     if (hci_stack->sco_packet_handler) {
2935         hci_stack->sco_packet_handler(HCI_SCO_DATA_PACKET, 0, packet, size);
2936     }
2937 
2938 #ifdef ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL
2939     conn->num_packets_completed++;
2940     hci_stack->host_completed_packets = 1;
2941     hci_run();
2942 #endif
2943 }
2944 #endif
2945 
2946 static void packet_handler(uint8_t packet_type, uint8_t *packet, uint16_t size){
2947     hci_dump_packet(packet_type, 1, packet, size);
2948     switch (packet_type) {
2949         case HCI_EVENT_PACKET:
2950             event_handler(packet, size);
2951             break;
2952         case HCI_ACL_DATA_PACKET:
2953             acl_handler(packet, size);
2954             break;
2955 #ifdef ENABLE_CLASSIC
2956         case HCI_SCO_DATA_PACKET:
2957             sco_handler(packet, size);
2958             break;
2959 #endif
2960         default:
2961             break;
2962     }
2963 }
2964 
2965 /**
2966  * @brief Add event packet handler.
2967  */
2968 void hci_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
2969     btstack_linked_list_add_tail(&hci_stack->event_handlers, (btstack_linked_item_t*) callback_handler);
2970 }
2971 
2972 
2973 /** Register HCI packet handlers */
2974 void hci_register_acl_packet_handler(btstack_packet_handler_t handler){
2975     hci_stack->acl_packet_handler = handler;
2976 }
2977 
2978 #ifdef ENABLE_CLASSIC
2979 /**
2980  * @brief Registers a packet handler for SCO data. Used for HSP and HFP profiles.
2981  */
2982 void hci_register_sco_packet_handler(btstack_packet_handler_t handler){
2983     hci_stack->sco_packet_handler = handler;
2984 }
2985 #endif
2986 
2987 static void hci_state_reset(void){
2988     // no connections yet
2989     hci_stack->connections = NULL;
2990 
2991     // keep discoverable/connectable as this has been requested by the client(s)
2992     // hci_stack->discoverable = 0;
2993     // hci_stack->connectable = 0;
2994     // hci_stack->bondable = 1;
2995     // hci_stack->own_addr_type = 0;
2996 
2997     // buffer is free
2998     hci_stack->hci_packet_buffer_reserved = 0;
2999 
3000     // no pending cmds
3001     hci_stack->decline_reason = 0;
3002     hci_stack->new_scan_enable_value = 0xff;
3003 
3004     hci_stack->secure_connections_active = false;
3005 
3006     // LE
3007 #ifdef ENABLE_BLE
3008     memset(hci_stack->le_random_address, 0, 6);
3009     hci_stack->le_random_address_set = 0;
3010 #endif
3011 #ifdef ENABLE_LE_CENTRAL
3012     hci_stack->le_scanning_active  = 0;
3013     hci_stack->le_connecting_state = LE_CONNECTING_IDLE;
3014     hci_stack->le_connecting_request = LE_CONNECTING_IDLE;
3015     hci_stack->le_whitelist_capacity = 0;
3016 #endif
3017 }
3018 
3019 #ifdef ENABLE_CLASSIC
3020 /**
3021  * @brief Configure Bluetooth hardware control. Has to be called before power on.
3022  */
3023 void hci_set_link_key_db(btstack_link_key_db_t const * link_key_db){
3024     // store and open remote device db
3025     hci_stack->link_key_db = link_key_db;
3026     if (hci_stack->link_key_db) {
3027         hci_stack->link_key_db->open();
3028     }
3029 }
3030 #endif
3031 
3032 void hci_init(const hci_transport_t *transport, const void *config){
3033 
3034 #ifdef HAVE_MALLOC
3035     if (!hci_stack) {
3036         hci_stack = (hci_stack_t*) malloc(sizeof(hci_stack_t));
3037     }
3038 #else
3039     hci_stack = &hci_stack_static;
3040 #endif
3041     memset(hci_stack, 0, sizeof(hci_stack_t));
3042 
3043     // reference to use transport layer implementation
3044     hci_stack->hci_transport = transport;
3045 
3046     // reference to used config
3047     hci_stack->config = config;
3048 
3049     // setup pointer for outgoing packet buffer
3050     hci_stack->hci_packet_buffer = &hci_stack->hci_packet_buffer_data[HCI_OUTGOING_PRE_BUFFER_SIZE];
3051 
3052     // max acl payload size defined in config.h
3053     hci_stack->acl_data_packet_length = HCI_ACL_PAYLOAD_SIZE;
3054 
3055     // register packet handlers with transport
3056     transport->register_packet_handler(&packet_handler);
3057 
3058     hci_stack->state = HCI_STATE_OFF;
3059 
3060     // class of device
3061     hci_stack->class_of_device = 0x007a020c; // Smartphone
3062 
3063     // bondable by default
3064     hci_stack->bondable = 1;
3065 
3066 #ifdef ENABLE_CLASSIC
3067     // classic name
3068     hci_stack->local_name = default_classic_name;
3069 
3070     // Master slave policy
3071     hci_stack->master_slave_policy = 1;
3072 
3073     // Allow Role Switch
3074     hci_stack->allow_role_switch = 1;
3075 
3076     // Default / minimum security level = 2
3077     hci_stack->gap_security_level = LEVEL_2;
3078 
3079     // Errata-11838 mandates 7 bytes for GAP Security Level 1-3
3080     hci_stack->gap_required_encyrption_key_size = 7;
3081 #endif
3082 
3083     // Secure Simple Pairing default: enable, no I/O capabilities, general bonding, mitm not required, auto accept
3084     hci_stack->ssp_enable = 1;
3085     hci_stack->ssp_io_capability = SSP_IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
3086     hci_stack->ssp_authentication_requirement = SSP_IO_AUTHREQ_MITM_PROTECTION_NOT_REQUIRED_GENERAL_BONDING;
3087     hci_stack->ssp_auto_accept = 1;
3088 
3089     // Secure Connections: enable (requires support from Controller)
3090     hci_stack->secure_connections_enable = true;
3091 
3092     // voice setting - signed 16 bit pcm data with CVSD over the air
3093     hci_stack->sco_voice_setting = 0x60;
3094 
3095 #ifdef ENABLE_LE_CENTRAL
3096     // connection parameter to use for outgoing connections
3097     hci_stack->le_connection_scan_interval = 0x0060;   // 60ms
3098     hci_stack->le_connection_scan_window  = 0x0030;    // 30ms
3099     hci_stack->le_connection_interval_min = 0x0008;    // 10 ms
3100     hci_stack->le_connection_interval_max = 0x0018;    // 30 ms
3101     hci_stack->le_connection_latency      = 4;         // 4
3102     hci_stack->le_supervision_timeout     = 0x0048;    // 720 ms
3103     hci_stack->le_minimum_ce_length       = 2;         // 1.25 ms
3104     hci_stack->le_maximum_ce_length       = 0x0030;    // 30 ms
3105 
3106     // default LE Scanning
3107     hci_stack->le_scan_type     =   0x1; // active
3108     hci_stack->le_scan_interval = 0x1e0; // 300 ms
3109     hci_stack->le_scan_window   =  0x30; //  30 ms
3110 #endif
3111 
3112 #ifdef ENABLE_LE_PERIPHERAL
3113     hci_stack->le_max_number_peripheral_connections = 1; // only single connection as peripheral
3114 #endif
3115 
3116     // connection parameter range used to answer connection parameter update requests in l2cap
3117     hci_stack->le_connection_parameter_range.le_conn_interval_min =          6;
3118     hci_stack->le_connection_parameter_range.le_conn_interval_max =       3200;
3119     hci_stack->le_connection_parameter_range.le_conn_latency_min =           0;
3120     hci_stack->le_connection_parameter_range.le_conn_latency_max =         500;
3121     hci_stack->le_connection_parameter_range.le_supervision_timeout_min =   10;
3122     hci_stack->le_connection_parameter_range.le_supervision_timeout_max = 3200;
3123 
3124     hci_state_reset();
3125 }
3126 
3127 void hci_deinit(void){
3128 #ifdef HAVE_MALLOC
3129     if (hci_stack) {
3130         free(hci_stack);
3131     }
3132 #endif
3133     hci_stack = NULL;
3134 
3135 #ifdef ENABLE_CLASSIC
3136     disable_l2cap_timeouts = 0;
3137 #endif
3138 }
3139 
3140 /**
3141  * @brief Configure Bluetooth chipset driver. Has to be called before power on, or right after receiving the local version information
3142  */
3143 void hci_set_chipset(const btstack_chipset_t *chipset_driver){
3144     hci_stack->chipset = chipset_driver;
3145 
3146     // reset chipset driver - init is also called on power_up
3147     if (hci_stack->chipset && hci_stack->chipset->init){
3148         hci_stack->chipset->init(hci_stack->config);
3149     }
3150 }
3151 
3152 /**
3153  * @brief Configure Bluetooth hardware control. Has to be called after hci_init() but before power on.
3154  */
3155 void hci_set_control(const btstack_control_t *hardware_control){
3156     // references to used control implementation
3157     hci_stack->control = hardware_control;
3158     // init with transport config
3159     hardware_control->init(hci_stack->config);
3160 }
3161 
3162 void hci_close(void){
3163     // close remote device db
3164     if (hci_stack->link_key_db) {
3165         hci_stack->link_key_db->close();
3166     }
3167 
3168     btstack_linked_list_iterator_t lit;
3169     btstack_linked_list_iterator_init(&lit, &hci_stack->connections);
3170     while (btstack_linked_list_iterator_has_next(&lit)){
3171         // cancel all l2cap connections by emitting dicsconnection complete before shutdown (free) connection
3172         hci_connection_t * connection = (hci_connection_t*) btstack_linked_list_iterator_next(&lit);
3173         hci_emit_disconnection_complete(connection->con_handle, 0x16); // terminated by local host
3174         hci_shutdown_connection(connection);
3175     }
3176 
3177     hci_power_control(HCI_POWER_OFF);
3178 
3179 #ifdef HAVE_MALLOC
3180     free(hci_stack);
3181 #endif
3182     hci_stack = NULL;
3183 }
3184 
3185 #ifdef ENABLE_CLASSIC
3186 void gap_set_required_encryption_key_size(uint8_t encryption_key_size){
3187     // validate ranage and set
3188     if (encryption_key_size < 7)  return;
3189     if (encryption_key_size > 16) return;
3190     hci_stack->gap_required_encyrption_key_size = encryption_key_size;
3191 }
3192 
3193 void gap_set_security_level(gap_security_level_t security_level){
3194     hci_stack->gap_security_level = security_level;
3195 }
3196 
3197 gap_security_level_t gap_get_security_level(void){
3198     return hci_stack->gap_security_level;
3199 }
3200 #endif
3201 
3202 #ifdef ENABLE_CLASSIC
3203 void gap_set_class_of_device(uint32_t class_of_device){
3204     hci_stack->class_of_device = class_of_device;
3205 }
3206 
3207 void gap_set_default_link_policy_settings(uint16_t default_link_policy_settings){
3208     hci_stack->default_link_policy_settings = default_link_policy_settings;
3209 }
3210 
3211 void gap_set_allow_role_switch(bool allow_role_switch){
3212     hci_stack->allow_role_switch = allow_role_switch ? 1 : 0;
3213 }
3214 
3215 uint8_t hci_get_allow_role_switch(void){
3216     return  hci_stack->allow_role_switch;
3217 }
3218 
3219 void gap_set_link_supervision_timeout(uint16_t link_supervision_timeout){
3220     hci_stack->link_supervision_timeout = link_supervision_timeout;
3221 }
3222 
3223 void hci_disable_l2cap_timeout_check(void){
3224     disable_l2cap_timeouts = 1;
3225 }
3226 #endif
3227 
3228 #if !defined(HAVE_PLATFORM_IPHONE_OS) && !defined (HAVE_HOST_CONTROLLER_API)
3229 // Set Public BD ADDR - passed on to Bluetooth chipset if supported in bt_control_h
3230 void hci_set_bd_addr(bd_addr_t addr){
3231     (void)memcpy(hci_stack->custom_bd_addr, addr, 6);
3232     hci_stack->custom_bd_addr_set = 1;
3233 }
3234 #endif
3235 
3236 // State-Module-Driver overview
3237 // state                    module  low-level
3238 // HCI_STATE_OFF             off      close
3239 // HCI_STATE_INITIALIZING,   on       open
3240 // HCI_STATE_WORKING,        on       open
3241 // HCI_STATE_HALTING,        on       open
3242 // HCI_STATE_SLEEPING,    off/sleep   close
3243 // HCI_STATE_FALLING_ASLEEP  on       open
3244 
3245 static int hci_power_control_on(void){
3246 
3247     // power on
3248     int err = 0;
3249     if (hci_stack->control && hci_stack->control->on){
3250         err = (*hci_stack->control->on)();
3251     }
3252     if (err){
3253         log_error( "POWER_ON failed");
3254         hci_emit_hci_open_failed();
3255         return err;
3256     }
3257 
3258     // int chipset driver
3259     if (hci_stack->chipset && hci_stack->chipset->init){
3260         hci_stack->chipset->init(hci_stack->config);
3261     }
3262 
3263     // init transport
3264     if (hci_stack->hci_transport->init){
3265         hci_stack->hci_transport->init(hci_stack->config);
3266     }
3267 
3268     // open transport
3269     err = hci_stack->hci_transport->open();
3270     if (err){
3271         log_error( "HCI_INIT failed, turning Bluetooth off again");
3272         if (hci_stack->control && hci_stack->control->off){
3273             (*hci_stack->control->off)();
3274         }
3275         hci_emit_hci_open_failed();
3276         return err;
3277     }
3278     return 0;
3279 }
3280 
3281 static void hci_power_control_off(void){
3282 
3283     log_info("hci_power_control_off");
3284 
3285     // close low-level device
3286     hci_stack->hci_transport->close();
3287 
3288     log_info("hci_power_control_off - hci_transport closed");
3289 
3290     // power off
3291     if (hci_stack->control && hci_stack->control->off){
3292         (*hci_stack->control->off)();
3293     }
3294 
3295     log_info("hci_power_control_off - control closed");
3296 
3297     hci_stack->state = HCI_STATE_OFF;
3298 }
3299 
3300 static void hci_power_control_sleep(void){
3301 
3302     log_info("hci_power_control_sleep");
3303 
3304 #if 0
3305     // don't close serial port during sleep
3306 
3307     // close low-level device
3308     hci_stack->hci_transport->close(hci_stack->config);
3309 #endif
3310 
3311     // sleep mode
3312     if (hci_stack->control && hci_stack->control->sleep){
3313         (*hci_stack->control->sleep)();
3314     }
3315 
3316     hci_stack->state = HCI_STATE_SLEEPING;
3317 }
3318 
3319 static int hci_power_control_wake(void){
3320 
3321     log_info("hci_power_control_wake");
3322 
3323     // wake on
3324     if (hci_stack->control && hci_stack->control->wake){
3325         (*hci_stack->control->wake)();
3326     }
3327 
3328 #if 0
3329     // open low-level device
3330     int err = hci_stack->hci_transport->open(hci_stack->config);
3331     if (err){
3332         log_error( "HCI_INIT failed, turning Bluetooth off again");
3333         if (hci_stack->control && hci_stack->control->off){
3334             (*hci_stack->control->off)();
3335         }
3336         hci_emit_hci_open_failed();
3337         return err;
3338     }
3339 #endif
3340 
3341     return 0;
3342 }
3343 
3344 static void hci_power_transition_to_initializing(void){
3345     // set up state machine
3346     hci_stack->num_cmd_packets = 1; // assume that one cmd can be sent
3347     hci_stack->hci_packet_buffer_reserved = 0;
3348     hci_stack->state = HCI_STATE_INITIALIZING;
3349     hci_stack->substate = HCI_INIT_SEND_RESET;
3350 }
3351 
3352 int hci_power_control(HCI_POWER_MODE power_mode){
3353 
3354     log_info("hci_power_control: %d, current mode %u", power_mode, hci_stack->state);
3355 
3356     int err = 0;
3357     switch (hci_stack->state){
3358 
3359         case HCI_STATE_OFF:
3360             switch (power_mode){
3361                 case HCI_POWER_ON:
3362                     err = hci_power_control_on();
3363                     if (err) {
3364                         log_error("hci_power_control_on() error %d", err);
3365                         return err;
3366                     }
3367                     hci_power_transition_to_initializing();
3368                     break;
3369                 case HCI_POWER_OFF:
3370                     // do nothing
3371                     break;
3372                 case HCI_POWER_SLEEP:
3373                     // do nothing (with SLEEP == OFF)
3374                     break;
3375                 default:
3376                     btstack_assert(false);
3377                     break;
3378             }
3379             break;
3380 
3381         case HCI_STATE_INITIALIZING:
3382             switch (power_mode){
3383                 case HCI_POWER_ON:
3384                     // do nothing
3385                     break;
3386                 case HCI_POWER_OFF:
3387                     // no connections yet, just turn it off
3388                     hci_power_control_off();
3389                     break;
3390                 case HCI_POWER_SLEEP:
3391                     // no connections yet, just turn it off
3392                     hci_power_control_sleep();
3393                     break;
3394                 default:
3395                     btstack_assert(false);
3396                     break;
3397             }
3398             break;
3399 
3400         case HCI_STATE_WORKING:
3401             switch (power_mode){
3402                 case HCI_POWER_ON:
3403                     // do nothing
3404                     break;
3405                 case HCI_POWER_OFF:
3406                     // see hci_run
3407                     hci_stack->state = HCI_STATE_HALTING;
3408                     hci_stack->substate = HCI_HALTING_DISCONNECT_ALL_NO_TIMER;
3409                     break;
3410                 case HCI_POWER_SLEEP:
3411                     // see hci_run
3412                     hci_stack->state = HCI_STATE_FALLING_ASLEEP;
3413                     hci_stack->substate = HCI_FALLING_ASLEEP_DISCONNECT;
3414                     break;
3415                 default:
3416                     btstack_assert(false);
3417                     break;
3418             }
3419             break;
3420 
3421         case HCI_STATE_HALTING:
3422             switch (power_mode){
3423                 case HCI_POWER_ON:
3424                     hci_power_transition_to_initializing();
3425                     break;
3426                 case HCI_POWER_OFF:
3427                     // do nothing
3428                     break;
3429                 case HCI_POWER_SLEEP:
3430                     // see hci_run
3431                     hci_stack->state = HCI_STATE_FALLING_ASLEEP;
3432                     hci_stack->substate = HCI_FALLING_ASLEEP_DISCONNECT;
3433                     break;
3434                 default:
3435                     btstack_assert(false);
3436                     break;
3437             }
3438             break;
3439 
3440         case HCI_STATE_FALLING_ASLEEP:
3441             switch (power_mode){
3442                 case HCI_POWER_ON:
3443 
3444 #ifdef HAVE_PLATFORM_IPHONE_OS
3445                     // nothing to do, if H4 supports power management
3446                     if (btstack_control_iphone_power_management_enabled()){
3447                         hci_stack->state = HCI_STATE_INITIALIZING;
3448                         hci_stack->substate = HCI_INIT_WRITE_SCAN_ENABLE;   // init after sleep
3449                         break;
3450                     }
3451 #endif
3452                     hci_power_transition_to_initializing();
3453                     break;
3454                 case HCI_POWER_OFF:
3455                     // see hci_run
3456                     hci_stack->state = HCI_STATE_HALTING;
3457                     hci_stack->substate = HCI_HALTING_DISCONNECT_ALL_NO_TIMER;
3458                     break;
3459                 case HCI_POWER_SLEEP:
3460                     // do nothing
3461                     break;
3462                 default:
3463                     btstack_assert(false);
3464                     break;
3465             }
3466             break;
3467 
3468         case HCI_STATE_SLEEPING:
3469             switch (power_mode){
3470                 case HCI_POWER_ON:
3471 
3472 #ifdef HAVE_PLATFORM_IPHONE_OS
3473                     // nothing to do, if H4 supports power management
3474                     if (btstack_control_iphone_power_management_enabled()){
3475                         hci_stack->state = HCI_STATE_INITIALIZING;
3476                         hci_stack->substate = HCI_INIT_AFTER_SLEEP;
3477                         hci_update_scan_enable();
3478                         break;
3479                     }
3480 #endif
3481                     err = hci_power_control_wake();
3482                     if (err) return err;
3483                     hci_power_transition_to_initializing();
3484                     break;
3485                 case HCI_POWER_OFF:
3486                     hci_stack->state = HCI_STATE_HALTING;
3487                     hci_stack->substate = HCI_HALTING_DISCONNECT_ALL_NO_TIMER;
3488                     break;
3489                 case HCI_POWER_SLEEP:
3490                     // do nothing
3491                     break;
3492                 default:
3493                     btstack_assert(false);
3494                     break;
3495             }
3496             break;
3497 
3498         default:
3499             btstack_assert(false);
3500             break;
3501     }
3502 
3503     // create internal event
3504 	hci_emit_state();
3505 
3506 	// trigger next/first action
3507 	hci_run();
3508 
3509     return 0;
3510 }
3511 
3512 
3513 #ifdef ENABLE_CLASSIC
3514 
3515 static void hci_update_scan_enable(void){
3516     // 2 = page scan, 1 = inq scan
3517     hci_stack->new_scan_enable_value  = (hci_stack->connectable << 1) | hci_stack->discoverable;
3518     hci_run();
3519 }
3520 
3521 void gap_discoverable_control(uint8_t enable){
3522     if (enable) enable = 1; // normalize argument
3523 
3524     if (hci_stack->discoverable == enable){
3525         hci_emit_discoverable_enabled(hci_stack->discoverable);
3526         return;
3527     }
3528 
3529     hci_stack->discoverable = enable;
3530     hci_update_scan_enable();
3531 }
3532 
3533 void gap_connectable_control(uint8_t enable){
3534     if (enable) enable = 1; // normalize argument
3535 
3536     // don't emit event
3537     if (hci_stack->connectable == enable) return;
3538 
3539     hci_stack->connectable = enable;
3540     hci_update_scan_enable();
3541 }
3542 #endif
3543 
3544 void gap_local_bd_addr(bd_addr_t address_buffer){
3545     (void)memcpy(address_buffer, hci_stack->local_bd_addr, 6);
3546 }
3547 
3548 #ifdef ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL
3549 static void hci_host_num_completed_packets(void){
3550 
3551     // create packet manually as arrays are not supported and num_commands should not get reduced
3552     hci_reserve_packet_buffer();
3553     uint8_t * packet = hci_get_outgoing_packet_buffer();
3554 
3555     uint16_t size = 0;
3556     uint16_t num_handles = 0;
3557     packet[size++] = 0x35;
3558     packet[size++] = 0x0c;
3559     size++;  // skip param len
3560     size++;  // skip num handles
3561 
3562     // add { handle, packets } entries
3563     btstack_linked_item_t * it;
3564     for (it = (btstack_linked_item_t *) hci_stack->connections; it ; it = it->next){
3565         hci_connection_t * connection = (hci_connection_t *) it;
3566         if (connection->num_packets_completed){
3567             little_endian_store_16(packet, size, connection->con_handle);
3568             size += 2;
3569             little_endian_store_16(packet, size, connection->num_packets_completed);
3570             size += 2;
3571             //
3572             num_handles++;
3573             connection->num_packets_completed = 0;
3574         }
3575     }
3576 
3577     packet[2] = size - 3;
3578     packet[3] = num_handles;
3579 
3580     hci_stack->host_completed_packets = 0;
3581 
3582     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, packet, size);
3583     hci_stack->hci_transport->send_packet(HCI_COMMAND_DATA_PACKET, packet, size);
3584 
3585     // release packet buffer for synchronous transport implementations
3586     if (hci_transport_synchronous()){
3587         hci_release_packet_buffer();
3588         hci_emit_transport_packet_sent();
3589     }
3590 }
3591 #endif
3592 
3593 static void hci_halting_timeout_handler(btstack_timer_source_t * ds){
3594     UNUSED(ds);
3595     hci_stack->substate = HCI_HALTING_CLOSE;
3596     // allow packet handlers to defer final shutdown
3597     hci_emit_state();
3598     hci_run();
3599 }
3600 
3601 static bool hci_run_acl_fragments(void){
3602     if (hci_stack->acl_fragmentation_total_size > 0u) {
3603         hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(hci_stack->hci_packet_buffer);
3604         hci_connection_t *connection = hci_connection_for_handle(con_handle);
3605         if (connection) {
3606             if (hci_can_send_prepared_acl_packet_now(con_handle)){
3607                 hci_send_acl_packet_fragments(connection);
3608                 return true;
3609             }
3610         } else {
3611             // connection gone -> discard further fragments
3612             log_info("hci_run: fragmented ACL packet no connection -> discard fragment");
3613             hci_stack->acl_fragmentation_total_size = 0;
3614             hci_stack->acl_fragmentation_pos = 0;
3615         }
3616     }
3617     return false;
3618 }
3619 
3620 #ifdef ENABLE_CLASSIC
3621 static bool hci_run_general_gap_classic(void){
3622 
3623     // decline incoming connections
3624     if (hci_stack->decline_reason){
3625         uint8_t reason = hci_stack->decline_reason;
3626         hci_stack->decline_reason = 0;
3627         hci_send_cmd(&hci_reject_connection_request, hci_stack->decline_addr, reason);
3628         return true;
3629     }
3630     // send scan enable
3631     if ((hci_stack->state == HCI_STATE_WORKING) && (hci_stack->new_scan_enable_value != 0xff) && hci_classic_supported()){
3632         hci_send_cmd(&hci_write_scan_enable, hci_stack->new_scan_enable_value);
3633         hci_stack->new_scan_enable_value = 0xff;
3634         return true;
3635     }
3636     // start/stop inquiry
3637     if ((hci_stack->inquiry_state >= GAP_INQUIRY_DURATION_MIN) && (hci_stack->inquiry_state <= GAP_INQUIRY_DURATION_MAX)){
3638         uint8_t duration = hci_stack->inquiry_state;
3639         hci_stack->inquiry_state = GAP_INQUIRY_STATE_ACTIVE;
3640         hci_send_cmd(&hci_inquiry, GAP_IAC_GENERAL_INQUIRY, duration, 0);
3641         return true;
3642     }
3643     if (hci_stack->inquiry_state == GAP_INQUIRY_STATE_W2_CANCEL){
3644         hci_stack->inquiry_state = GAP_INQUIRY_STATE_W4_CANCELLED;
3645         hci_send_cmd(&hci_inquiry_cancel);
3646         return true;
3647     }
3648     // remote name request
3649     if (hci_stack->remote_name_state == GAP_REMOTE_NAME_STATE_W2_SEND){
3650         hci_stack->remote_name_state = GAP_REMOTE_NAME_STATE_W4_COMPLETE;
3651         hci_send_cmd(&hci_remote_name_request, hci_stack->remote_name_addr,
3652                      hci_stack->remote_name_page_scan_repetition_mode, 0, hci_stack->remote_name_clock_offset);
3653         return true;
3654     }
3655     // pairing
3656     if (hci_stack->gap_pairing_state != GAP_PAIRING_STATE_IDLE){
3657         uint8_t state = hci_stack->gap_pairing_state;
3658         hci_stack->gap_pairing_state = GAP_PAIRING_STATE_IDLE;
3659         switch (state){
3660             case GAP_PAIRING_STATE_SEND_PIN:
3661                 hci_send_cmd(&hci_pin_code_request_reply, hci_stack->gap_pairing_addr, hci_stack->gap_pairing_pin_len, hci_stack->gap_pairing_input.gap_pairing_pin);
3662                 break;
3663             case GAP_PAIRING_STATE_SEND_PIN_NEGATIVE:
3664                 hci_send_cmd(&hci_pin_code_request_negative_reply, hci_stack->gap_pairing_addr);
3665                 break;
3666             case GAP_PAIRING_STATE_SEND_PASSKEY:
3667                 hci_send_cmd(&hci_user_passkey_request_reply, hci_stack->gap_pairing_addr, hci_stack->gap_pairing_input.gap_pairing_passkey);
3668                 break;
3669             case GAP_PAIRING_STATE_SEND_PASSKEY_NEGATIVE:
3670                 hci_send_cmd(&hci_user_passkey_request_negative_reply, hci_stack->gap_pairing_addr);
3671                 break;
3672             case GAP_PAIRING_STATE_SEND_CONFIRMATION:
3673                 hci_send_cmd(&hci_user_confirmation_request_reply, hci_stack->gap_pairing_addr);
3674                 break;
3675             case GAP_PAIRING_STATE_SEND_CONFIRMATION_NEGATIVE:
3676                 hci_send_cmd(&hci_user_confirmation_request_negative_reply, hci_stack->gap_pairing_addr);
3677                 break;
3678             default:
3679                 break;
3680         }
3681         return true;
3682     }
3683     return false;
3684 }
3685 #endif
3686 
3687 #ifdef ENABLE_BLE
3688 static bool hci_run_general_gap_le(void){
3689 
3690     // advertisements, active scanning, and creating connections requires random address to be set if using private address
3691 
3692     if (hci_stack->state != HCI_STATE_WORKING) return false;
3693     if ( (hci_stack->le_own_addr_type != BD_ADDR_TYPE_LE_PUBLIC) && (hci_stack->le_random_address_set == 0u) ) return false;
3694 
3695 
3696     // Phase 1: collect what to stop
3697 
3698     bool scanning_stop = false;
3699     bool connecting_stop = false;
3700     bool advertising_stop = false;
3701 
3702 #ifndef ENABLE_LE_CENTRAL
3703     UNUSED(scanning_stop);
3704     UNUSED(connecting_stop);
3705 #endif
3706 #ifndef ENABLE_LE_PERIPHERAL
3707     UNUSED(advertising_stop);
3708 #endif
3709 
3710     // check if whitelist needs modification
3711     bool whitelist_modification_pending = false;
3712     btstack_linked_list_iterator_t lit;
3713     btstack_linked_list_iterator_init(&lit, &hci_stack->le_whitelist);
3714     while (btstack_linked_list_iterator_has_next(&lit)){
3715         whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&lit);
3716         if (entry->state & (LE_WHITELIST_REMOVE_FROM_CONTROLLER | LE_WHITELIST_ADD_TO_CONTROLLER)){
3717             whitelist_modification_pending = true;
3718             break;
3719         }
3720     }
3721     // check if resolving list needs modification
3722     bool resolving_list_modification_pending = false;
3723 #ifdef ENABLE_LE_PRIVACY_ADDRESS_RESOLUTION
3724     bool resolving_list_supported = (hci_stack->local_supported_commands[1] & (1 << 2)) != 0;
3725 	if (resolving_list_supported && hci_stack->le_resolving_list_state != LE_RESOLVING_LIST_DONE){
3726         resolving_list_modification_pending = true;
3727     }
3728 #endif
3729 
3730 #ifdef ENABLE_LE_CENTRAL
3731     // scanning control
3732     if (hci_stack->le_scanning_active) {
3733         // stop if:
3734         // - parameter change required
3735         // - it's disabled
3736         // - whitelist change required but used for scanning
3737         // - resolving list modified
3738         bool scanning_uses_whitelist = (hci_stack->le_scan_filter_policy & 1) == 1;
3739         if ((hci_stack->le_scanning_param_update) ||
3740             !hci_stack->le_scanning_enabled ||
3741             scanning_uses_whitelist ||
3742             resolving_list_modification_pending){
3743 
3744             scanning_stop = true;
3745         }
3746     }
3747 #endif
3748 
3749 #ifdef ENABLE_LE_CENTRAL
3750     // connecting control
3751     if (hci_stack->le_connecting_state != LE_CONNECTING_IDLE){
3752         // stop connecting if:
3753         // - connecting uses white and whitelist modification pending
3754         // - if it got disabled
3755         // - resolving list modified
3756         bool connecting_uses_whitelist = hci_stack->le_connecting_request == LE_CONNECTING_WHITELIST;
3757         if ((connecting_uses_whitelist && whitelist_modification_pending) ||
3758             (hci_stack->le_connecting_request == LE_CONNECTING_IDLE) ||
3759             resolving_list_modification_pending) {
3760 
3761             connecting_stop = true;
3762         }
3763     }
3764 #endif
3765 
3766 #ifdef ENABLE_LE_PERIPHERAL
3767     // le advertisement control
3768     if (hci_stack->le_advertisements_active){
3769         // stop if:
3770         // - parameter change required
3771         // - it's disabled
3772         // - whitelist change required but used for advertisement filter policy
3773         // - resolving list modified
3774         bool advertising_uses_whitelist = hci_stack->le_advertisements_filter_policy > 0;
3775         if ((hci_stack->le_advertisements_todo != 0) ||
3776             !hci_stack->le_advertisements_enabled_for_current_roles ||
3777             (advertising_uses_whitelist & whitelist_modification_pending) ||
3778             resolving_list_modification_pending) {
3779 
3780             advertising_stop = true;
3781         }
3782     }
3783 #endif
3784 
3785 
3786     // Phase 2: stop everything that should be off during modifications
3787 
3788 #ifdef ENABLE_LE_CENTRAL
3789     if (scanning_stop){
3790         hci_stack->le_scanning_active = false;
3791         hci_send_cmd(&hci_le_set_scan_enable, 0, 0);
3792         return true;
3793     }
3794 #endif
3795 
3796 #ifdef ENABLE_LE_CENTRAL
3797     if (connecting_stop){
3798         if (hci_stack->le_connecting_state != LE_CONNECTING_CANCEL){
3799             hci_send_cmd(&hci_le_create_connection_cancel);
3800             return true;
3801         }
3802     }
3803 #endif
3804 
3805 #ifdef ENABLE_LE_PERIPHERAL
3806     if (advertising_stop){
3807         hci_stack->le_advertisements_active = false;
3808         hci_send_cmd(&hci_le_set_advertise_enable, 0);
3809         return true;
3810     }
3811 #endif
3812 
3813     // Phase 3: modify
3814 
3815 #ifdef ENABLE_LE_CENTRAL
3816     if (hci_stack->le_scanning_param_update){
3817         hci_stack->le_scanning_param_update = false;
3818         hci_send_cmd(&hci_le_set_scan_parameters, hci_stack->le_scan_type, hci_stack->le_scan_interval, hci_stack->le_scan_window,
3819                      hci_stack->le_own_addr_type, hci_stack->le_scan_filter_policy);
3820         return true;
3821     }
3822 #endif
3823 
3824 #ifdef ENABLE_LE_PERIPHERAL
3825     if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_SET_PARAMS){
3826         hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_SET_PARAMS;
3827         hci_send_cmd(&hci_le_set_advertising_parameters,
3828                      hci_stack->le_advertisements_interval_min,
3829                      hci_stack->le_advertisements_interval_max,
3830                      hci_stack->le_advertisements_type,
3831                      hci_stack->le_own_addr_type,
3832                      hci_stack->le_advertisements_direct_address_type,
3833                      hci_stack->le_advertisements_direct_address,
3834                      hci_stack->le_advertisements_channel_map,
3835                      hci_stack->le_advertisements_filter_policy);
3836         return true;
3837     }
3838     if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_SET_ADV_DATA){
3839         hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_SET_ADV_DATA;
3840         uint8_t adv_data_clean[31];
3841         memset(adv_data_clean, 0, sizeof(adv_data_clean));
3842         (void)memcpy(adv_data_clean, hci_stack->le_advertisements_data,
3843                      hci_stack->le_advertisements_data_len);
3844         btstack_replace_bd_addr_placeholder(adv_data_clean, hci_stack->le_advertisements_data_len, hci_stack->local_bd_addr);
3845         hci_send_cmd(&hci_le_set_advertising_data, hci_stack->le_advertisements_data_len, adv_data_clean);
3846         return true;
3847     }
3848     if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_SET_SCAN_DATA){
3849         hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_SET_SCAN_DATA;
3850         uint8_t scan_data_clean[31];
3851         memset(scan_data_clean, 0, sizeof(scan_data_clean));
3852         (void)memcpy(scan_data_clean, hci_stack->le_scan_response_data,
3853                      hci_stack->le_scan_response_data_len);
3854         btstack_replace_bd_addr_placeholder(scan_data_clean, hci_stack->le_scan_response_data_len, hci_stack->local_bd_addr);
3855         hci_send_cmd(&hci_le_set_scan_response_data, hci_stack->le_scan_response_data_len, scan_data_clean);
3856         return true;
3857     }
3858 #endif
3859 
3860 
3861 #ifdef ENABLE_LE_CENTRAL
3862     // if connect with whitelist was active and is not cancelled yet, wait until next time
3863     if (hci_stack->le_connecting_state == LE_CONNECTING_CANCEL) return false;
3864 #endif
3865 
3866     // LE Whitelist Management
3867     if (whitelist_modification_pending){
3868         // add/remove entries
3869         btstack_linked_list_iterator_init(&lit, &hci_stack->le_whitelist);
3870         while (btstack_linked_list_iterator_has_next(&lit)){
3871             whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&lit);
3872 			if (entry->state & LE_WHITELIST_REMOVE_FROM_CONTROLLER){
3873 				entry->state &= ~LE_WHITELIST_REMOVE_FROM_CONTROLLER;
3874 				hci_send_cmd(&hci_le_remove_device_from_white_list, entry->address_type, entry->address);
3875 				return true;
3876 			}
3877             if (entry->state & LE_WHITELIST_ADD_TO_CONTROLLER){
3878 				entry->state &= ~LE_WHITELIST_ADD_TO_CONTROLLER;
3879                 entry->state |= LE_WHITELIST_ON_CONTROLLER;
3880                 hci_send_cmd(&hci_le_add_device_to_white_list, entry->address_type, entry->address);
3881                 return true;
3882             }
3883             if ((entry->state & LE_WHITELIST_ON_CONTROLLER) == 0){
3884 				btstack_linked_list_remove(&hci_stack->le_whitelist, (btstack_linked_item_t *) entry);
3885 				btstack_memory_whitelist_entry_free(entry);
3886             }
3887         }
3888     }
3889 
3890 #ifdef ENABLE_LE_PRIVACY_ADDRESS_RESOLUTION
3891     // LE Resolving List Management
3892     if (resolving_list_supported) {
3893 		uint16_t i;
3894 		switch (hci_stack->le_resolving_list_state) {
3895 			case LE_RESOLVING_LIST_SEND_ENABLE_ADDRESS_RESOLUTION:
3896 				hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_READ_SIZE;
3897 				hci_send_cmd(&hci_le_set_address_resolution_enabled, 1);
3898 				return true;
3899 			case LE_RESOLVING_LIST_READ_SIZE:
3900 				hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_SEND_CLEAR;
3901 				hci_send_cmd(&hci_le_read_resolving_list_size);
3902 				return true;
3903 			case LE_RESOLVING_LIST_SEND_CLEAR:
3904 				hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_REMOVE_ENTRIES;
3905 				(void) memset(hci_stack->le_resolving_list_add_entries, 0xff,
3906 							  sizeof(hci_stack->le_resolving_list_add_entries));
3907 				(void) memset(hci_stack->le_resolving_list_remove_entries, 0,
3908 							  sizeof(hci_stack->le_resolving_list_remove_entries));
3909 				hci_send_cmd(&hci_le_clear_resolving_list);
3910 				return true;
3911 			case LE_RESOLVING_LIST_REMOVE_ENTRIES:
3912 				for (i = 0; i < MAX_NUM_RESOLVING_LIST_ENTRIES && i < le_device_db_max_count(); i++) {
3913 					uint8_t offset = i >> 3;
3914 					uint8_t mask = 1 << (i & 7);
3915 					if ((hci_stack->le_resolving_list_remove_entries[offset] & mask) == 0) continue;
3916 					hci_stack->le_resolving_list_remove_entries[offset] &= ~mask;
3917 					bd_addr_t peer_identity_addreses;
3918 					int peer_identity_addr_type = (int) BD_ADDR_TYPE_UNKNOWN;
3919 					sm_key_t peer_irk;
3920 					le_device_db_info(i, &peer_identity_addr_type, peer_identity_addreses, peer_irk);
3921 					if (peer_identity_addr_type == BD_ADDR_TYPE_UNKNOWN) continue;
3922 
3923 #ifdef ENABLE_LE_WHITELIST_TOUCH_AFTER_RESOLVING_LIST_UPDATE
3924 					// trigger whitelist entry 'update' (work around for controller bug)
3925 					btstack_linked_list_iterator_init(&lit, &hci_stack->le_whitelist);
3926 					while (btstack_linked_list_iterator_has_next(&lit)) {
3927 						whitelist_entry_t *entry = (whitelist_entry_t *) btstack_linked_list_iterator_next(&lit);
3928 						if (entry->address_type != peer_identity_addr_type) continue;
3929 						if (memcmp(entry->address, peer_identity_addreses, 6) != 0) continue;
3930 						log_info("trigger whitelist update %s", bd_addr_to_str(peer_identity_addreses));
3931 						entry->state |= LE_WHITELIST_REMOVE_FROM_CONTROLLER | LE_WHITELIST_ADD_TO_CONTROLLER;
3932 					}
3933 #endif
3934 
3935 					hci_send_cmd(&hci_le_remove_device_from_resolving_list, peer_identity_addr_type,
3936 								 peer_identity_addreses);
3937 					return true;
3938 				}
3939 
3940 				hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_ADD_ENTRIES;
3941 
3942 				/* fall through */
3943 
3944 			case LE_RESOLVING_LIST_ADD_ENTRIES:
3945 				for (i = 0; i < MAX_NUM_RESOLVING_LIST_ENTRIES && i < le_device_db_max_count(); i++) {
3946 					uint8_t offset = i >> 3;
3947 					uint8_t mask = 1 << (i & 7);
3948 					if ((hci_stack->le_resolving_list_add_entries[offset] & mask) == 0) continue;
3949 					hci_stack->le_resolving_list_add_entries[offset] &= ~mask;
3950 					bd_addr_t peer_identity_addreses;
3951 					int peer_identity_addr_type = (int) BD_ADDR_TYPE_UNKNOWN;
3952 					sm_key_t peer_irk;
3953 					le_device_db_info(i, &peer_identity_addr_type, peer_identity_addreses, peer_irk);
3954 					if (peer_identity_addr_type == BD_ADDR_TYPE_UNKNOWN) continue;
3955 					const uint8_t *local_irk = gap_get_persistent_irk();
3956 					// command uses format specifier 'P' that stores 16-byte value without flip
3957 					uint8_t local_irk_flipped[16];
3958 					uint8_t peer_irk_flipped[16];
3959 					reverse_128(local_irk, local_irk_flipped);
3960 					reverse_128(peer_irk, peer_irk_flipped);
3961 					hci_send_cmd(&hci_le_add_device_to_resolving_list, peer_identity_addr_type, peer_identity_addreses,
3962 								 peer_irk_flipped, local_irk_flipped);
3963 					return true;
3964 				}
3965 				hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_DONE;
3966 				break;
3967 
3968 			default:
3969 				break;
3970 		}
3971 	}
3972     hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_DONE;
3973 #endif
3974 
3975     // Phase 4: restore state
3976 
3977 #ifdef ENABLE_LE_CENTRAL
3978     // re-start scanning
3979     if ((hci_stack->le_scanning_enabled && !hci_stack->le_scanning_active)){
3980         hci_stack->le_scanning_active = true;
3981         hci_send_cmd(&hci_le_set_scan_enable, 1, 0);
3982         return true;
3983     }
3984 #endif
3985 
3986 #ifdef ENABLE_LE_CENTRAL
3987     // re-start connecting
3988     if ( (hci_stack->le_connecting_state == LE_CONNECTING_IDLE) && (hci_stack->le_connecting_request == LE_CONNECTING_WHITELIST)){
3989         bd_addr_t null_addr;
3990         memset(null_addr, 0, 6);
3991         hci_send_cmd(&hci_le_create_connection,
3992                      hci_stack->le_connection_scan_interval,    // scan interval: 60 ms
3993                      hci_stack->le_connection_scan_window,    // scan interval: 30 ms
3994                      1,         // use whitelist
3995                      0,         // peer address type
3996                      null_addr, // peer bd addr
3997                      hci_stack->le_own_addr_type, // our addr type:
3998                      hci_stack->le_connection_interval_min,    // conn interval min
3999                      hci_stack->le_connection_interval_max,    // conn interval max
4000                      hci_stack->le_connection_latency,         // conn latency
4001                      hci_stack->le_supervision_timeout,        // conn latency
4002                      hci_stack->le_minimum_ce_length,          // min ce length
4003                      hci_stack->le_maximum_ce_length           // max ce length
4004         );
4005         return true;
4006     }
4007 #endif
4008 
4009 #ifdef ENABLE_LE_PERIPHERAL
4010     // re-start advertising
4011     if (hci_stack->le_advertisements_enabled_for_current_roles && !hci_stack->le_advertisements_active){
4012         // check if advertisements should be enabled given
4013         hci_stack->le_advertisements_active = true;
4014         hci_send_cmd(&hci_le_set_advertise_enable, 1);
4015         return true;
4016     }
4017 #endif
4018 
4019     return false;
4020 }
4021 #endif
4022 
4023 static bool hci_run_general_pending_commands(void){
4024     btstack_linked_item_t * it;
4025     for (it = (btstack_linked_item_t *) hci_stack->connections; it != NULL; it = it->next){
4026         hci_connection_t * connection = (hci_connection_t *) it;
4027 
4028         switch(connection->state){
4029             case SEND_CREATE_CONNECTION:
4030                 switch(connection->address_type){
4031 #ifdef ENABLE_CLASSIC
4032                     case BD_ADDR_TYPE_ACL:
4033                         log_info("sending hci_create_connection");
4034                         hci_send_cmd(&hci_create_connection, connection->address, hci_usable_acl_packet_types(), 0, 0, 0, hci_stack->allow_role_switch);
4035                         break;
4036 #endif
4037                     default:
4038 #ifdef ENABLE_BLE
4039 #ifdef ENABLE_LE_CENTRAL
4040                         log_info("sending hci_le_create_connection");
4041                         hci_send_cmd(&hci_le_create_connection,
4042                                      hci_stack->le_connection_scan_interval,    // conn scan interval
4043                                      hci_stack->le_connection_scan_window,      // conn scan windows
4044                                      0,         // don't use whitelist
4045                                      connection->address_type, // peer address type
4046                                      connection->address,      // peer bd addr
4047                                      hci_stack->le_own_addr_type, // our addr type:
4048                                      hci_stack->le_connection_interval_min,    // conn interval min
4049                                      hci_stack->le_connection_interval_max,    // conn interval max
4050                                      hci_stack->le_connection_latency,         // conn latency
4051                                      hci_stack->le_supervision_timeout,        // conn latency
4052                                      hci_stack->le_minimum_ce_length,          // min ce length
4053                                      hci_stack->le_maximum_ce_length          // max ce length
4054                         );
4055                         connection->state = SENT_CREATE_CONNECTION;
4056 #endif
4057 #endif
4058                         break;
4059                 }
4060                 return true;
4061 
4062 #ifdef ENABLE_CLASSIC
4063             case RECEIVED_CONNECTION_REQUEST:
4064                 connection->role  = HCI_ROLE_SLAVE;
4065                 if (connection->address_type == BD_ADDR_TYPE_ACL){
4066                     log_info("sending hci_accept_connection_request");
4067                     connection->state = ACCEPTED_CONNECTION_REQUEST;
4068                     hci_send_cmd(&hci_accept_connection_request, connection->address, hci_stack->master_slave_policy);
4069                 }
4070                 return true;
4071 #endif
4072 
4073 #ifdef ENABLE_BLE
4074 #ifdef ENABLE_LE_CENTRAL
4075             case SEND_CANCEL_CONNECTION:
4076                 connection->state = SENT_CANCEL_CONNECTION;
4077                 hci_send_cmd(&hci_le_create_connection_cancel);
4078                 return true;
4079 #endif
4080 #endif
4081             case SEND_DISCONNECT:
4082                 connection->state = SENT_DISCONNECT;
4083                 hci_send_cmd(&hci_disconnect, connection->con_handle, ERROR_CODE_REMOTE_USER_TERMINATED_CONNECTION);
4084                 return true;
4085 
4086             default:
4087                 break;
4088         }
4089 
4090         // no further commands if connection is about to get shut down
4091         if (connection->state == SENT_DISCONNECT) continue;
4092 
4093         if (connection->authentication_flags & READ_RSSI){
4094             connectionClearAuthenticationFlags(connection, READ_RSSI);
4095             hci_send_cmd(&hci_read_rssi, connection->con_handle);
4096             return true;
4097         }
4098 
4099 #ifdef ENABLE_CLASSIC
4100 
4101         if (connection->authentication_flags & WRITE_SUPERVISION_TIMEOUT){
4102             connectionClearAuthenticationFlags(connection, WRITE_SUPERVISION_TIMEOUT);
4103             hci_send_cmd(&hci_write_link_supervision_timeout, connection->con_handle, hci_stack->link_supervision_timeout);
4104             return true;
4105         }
4106 
4107         if (connection->authentication_flags & HANDLE_LINK_KEY_REQUEST){
4108             log_info("responding to link key request, have link key db: %u", hci_stack->link_key_db != NULL);
4109             connectionClearAuthenticationFlags(connection, HANDLE_LINK_KEY_REQUEST);
4110 
4111             link_key_t link_key;
4112             link_key_type_t link_key_type;
4113             bool have_link_key = hci_stack->link_key_db && hci_stack->link_key_db->get_link_key(connection->address, link_key, &link_key_type);
4114 
4115             const uint16_t sc_enabled_mask = BONDING_REMOTE_SUPPORTS_SC_HOST | BONDING_REMOTE_SUPPORTS_SC_CONTROLLER;
4116             bool sc_enabled_remote = (connection->bonding_flags & sc_enabled_mask) == sc_enabled_mask;
4117             bool sc_downgrade = have_link_key && (gap_secure_connection_for_link_key_type(link_key_type) == 1) && !sc_enabled_remote;
4118             if (sc_downgrade){
4119                 log_info("Link key based on SC, but remote does not support SC -> disconnect");
4120                 connection->state = SENT_DISCONNECT;
4121                 hci_send_cmd(&hci_disconnect, connection->con_handle, ERROR_CODE_AUTHENTICATION_FAILURE);
4122                 return true;
4123             }
4124 
4125             bool security_level_sufficient = have_link_key && (gap_security_level_for_link_key_type(link_key_type) >= connection->requested_security_level);
4126             if (have_link_key && security_level_sufficient){
4127                 connection->link_key_type = link_key_type;
4128                 hci_send_cmd(&hci_link_key_request_reply, connection->address, &link_key);
4129             } else {
4130                 hci_send_cmd(&hci_link_key_request_negative_reply, connection->address);
4131             }
4132             return true;
4133         }
4134 
4135         if (connection->authentication_flags & DENY_PIN_CODE_REQUEST){
4136             log_info("denying to pin request");
4137             connectionClearAuthenticationFlags(connection, DENY_PIN_CODE_REQUEST);
4138             hci_send_cmd(&hci_pin_code_request_negative_reply, connection->address);
4139             return true;
4140         }
4141 
4142         if (connection->authentication_flags & SEND_IO_CAPABILITIES_REPLY){
4143             connectionClearAuthenticationFlags(connection, SEND_IO_CAPABILITIES_REPLY);
4144             log_info("IO Capability Request received, stack bondable %u, io cap %u", hci_stack->bondable, hci_stack->ssp_io_capability);
4145             if (hci_stack->bondable && (hci_stack->ssp_io_capability != SSP_IO_CAPABILITY_UNKNOWN)){
4146                 // tweak authentication requirements
4147                 uint8_t authreq = hci_stack->ssp_authentication_requirement;
4148                 if (connection->bonding_flags & BONDING_DEDICATED){
4149                     authreq = SSP_IO_AUTHREQ_MITM_PROTECTION_NOT_REQUIRED_DEDICATED_BONDING;
4150                 }
4151                 if (gap_mitm_protection_required_for_security_level(connection->requested_security_level)){
4152                     authreq |= 1;
4153                 }
4154                 hci_send_cmd(&hci_io_capability_request_reply, &connection->address, hci_stack->ssp_io_capability, NULL, authreq);
4155             } else {
4156                 hci_send_cmd(&hci_io_capability_request_negative_reply, &connection->address, ERROR_CODE_PAIRING_NOT_ALLOWED);
4157             }
4158             return true;
4159         }
4160 
4161         if (connection->authentication_flags & SEND_USER_CONFIRM_REPLY){
4162             connectionClearAuthenticationFlags(connection, SEND_USER_CONFIRM_REPLY);
4163             hci_send_cmd(&hci_user_confirmation_request_reply, &connection->address);
4164             return true;
4165         }
4166 
4167         if (connection->authentication_flags & SEND_USER_PASSKEY_REPLY){
4168             connectionClearAuthenticationFlags(connection, SEND_USER_PASSKEY_REPLY);
4169             hci_send_cmd(&hci_user_passkey_request_reply, &connection->address, 000000);
4170             return true;
4171         }
4172 
4173         if (connection->bonding_flags & BONDING_REQUEST_REMOTE_FEATURES_PAGE_0){
4174             connection->bonding_flags &= ~BONDING_REQUEST_REMOTE_FEATURES_PAGE_0;
4175             hci_send_cmd(&hci_read_remote_supported_features_command, connection->con_handle);
4176             return true;
4177         }
4178 
4179         if (connection->bonding_flags & BONDING_REQUEST_REMOTE_FEATURES_PAGE_1){
4180             connection->bonding_flags &= ~BONDING_REQUEST_REMOTE_FEATURES_PAGE_1;
4181             hci_send_cmd(&hci_read_remote_extended_features_command, connection->con_handle, 1);
4182             return true;
4183         }
4184 
4185         if (connection->bonding_flags & BONDING_REQUEST_REMOTE_FEATURES_PAGE_2){
4186             connection->bonding_flags &= ~BONDING_REQUEST_REMOTE_FEATURES_PAGE_2;
4187             hci_send_cmd(&hci_read_remote_extended_features_command, connection->con_handle, 2);
4188             return true;
4189         }
4190 
4191         if (connection->bonding_flags & BONDING_DISCONNECT_DEDICATED_DONE){
4192             connection->bonding_flags &= ~BONDING_DISCONNECT_DEDICATED_DONE;
4193             connection->bonding_flags |= BONDING_EMIT_COMPLETE_ON_DISCONNECT;
4194             connection->state = SENT_DISCONNECT;
4195             hci_send_cmd(&hci_disconnect, connection->con_handle, ERROR_CODE_REMOTE_USER_TERMINATED_CONNECTION);
4196             return true;
4197         }
4198 
4199         if (connection->bonding_flags & BONDING_SEND_AUTHENTICATE_REQUEST){
4200             connection->bonding_flags &= ~BONDING_SEND_AUTHENTICATE_REQUEST;
4201             connection->bonding_flags |= BONDING_SENT_AUTHENTICATE_REQUEST;
4202             hci_send_cmd(&hci_authentication_requested, connection->con_handle);
4203             return true;
4204         }
4205 
4206         if (connection->bonding_flags & BONDING_SEND_ENCRYPTION_REQUEST){
4207             connection->bonding_flags &= ~BONDING_SEND_ENCRYPTION_REQUEST;
4208             hci_send_cmd(&hci_set_connection_encryption, connection->con_handle, 1);
4209             return true;
4210         }
4211         if (connection->bonding_flags & BONDING_SEND_READ_ENCRYPTION_KEY_SIZE){
4212             connection->bonding_flags &= ~BONDING_SEND_READ_ENCRYPTION_KEY_SIZE;
4213             hci_send_cmd(&hci_read_encryption_key_size, connection->con_handle, 1);
4214             return true;
4215         }
4216 #endif
4217 
4218         if (connection->bonding_flags & BONDING_DISCONNECT_SECURITY_BLOCK){
4219             connection->bonding_flags &= ~BONDING_DISCONNECT_SECURITY_BLOCK;
4220             if (connection->state != SENT_DISCONNECT){
4221                 connection->state = SENT_DISCONNECT;
4222                 hci_send_cmd(&hci_disconnect, connection->con_handle, ERROR_CODE_AUTHENTICATION_FAILURE);
4223                 return true;
4224             }
4225         }
4226 
4227 #ifdef ENABLE_CLASSIC
4228         uint16_t sniff_min_interval;
4229         switch (connection->sniff_min_interval){
4230             case 0:
4231                 break;
4232             case 0xffff:
4233                 connection->sniff_min_interval = 0;
4234                 hci_send_cmd(&hci_exit_sniff_mode, connection->con_handle);
4235                 return true;
4236             default:
4237                 sniff_min_interval = connection->sniff_min_interval;
4238                 connection->sniff_min_interval = 0;
4239                 hci_send_cmd(&hci_sniff_mode, connection->con_handle, connection->sniff_max_interval, sniff_min_interval, connection->sniff_attempt, connection->sniff_timeout);
4240                 return true;
4241         }
4242 
4243         if (connection->request_role != HCI_ROLE_INVALID){
4244             hci_role_t  role = connection->request_role;
4245             connection->request_role = HCI_ROLE_INVALID;
4246             hci_send_cmd(&hci_switch_role_command, connection->address, role);
4247             return true;
4248         }
4249 #endif
4250 
4251 #ifdef ENABLE_BLE
4252         switch (connection->le_con_parameter_update_state){
4253             // response to L2CAP CON PARAMETER UPDATE REQUEST
4254             case CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS:
4255                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
4256                 hci_send_cmd(&hci_le_connection_update, connection->con_handle, connection->le_conn_interval_min,
4257                              connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout,
4258                              0x0000, 0xffff);
4259                 return true;
4260             case CON_PARAMETER_UPDATE_REPLY:
4261                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
4262                 hci_send_cmd(&hci_le_remote_connection_parameter_request_reply, connection->con_handle, connection->le_conn_interval_min,
4263                              connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout,
4264                              0x0000, 0xffff);
4265                 return true;
4266             case CON_PARAMETER_UPDATE_NEGATIVE_REPLY:
4267                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
4268                 hci_send_cmd(&hci_le_remote_connection_parameter_request_negative_reply, ERROR_CODE_UNSUPPORTED_LMP_PARAMETER_VALUE_UNSUPPORTED_LL_PARAMETER_VALUE);
4269                 return true;
4270             default:
4271                 break;
4272         }
4273         if (connection->le_phy_update_all_phys != 0xffu){
4274             uint8_t all_phys = connection->le_phy_update_all_phys;
4275             connection->le_phy_update_all_phys = 0xff;
4276             hci_send_cmd(&hci_le_set_phy, connection->con_handle, all_phys, connection->le_phy_update_tx_phys, connection->le_phy_update_rx_phys, connection->le_phy_update_phy_options);
4277             return true;
4278         }
4279 #endif
4280     }
4281     return false;
4282 }
4283 
4284 static void hci_run(void){
4285 
4286     bool done;
4287 
4288     // send continuation fragments first, as they block the prepared packet buffer
4289     done = hci_run_acl_fragments();
4290     if (done) return;
4291 
4292 #ifdef ENABLE_HCI_CONTROLLER_TO_HOST_FLOW_CONTROL
4293     // send host num completed packets next as they don't require num_cmd_packets > 0
4294     if (!hci_can_send_comand_packet_transport()) return;
4295     if (hci_stack->host_completed_packets){
4296         hci_host_num_completed_packets();
4297         return;
4298     }
4299 #endif
4300 
4301     if (!hci_can_send_command_packet_now()) return;
4302 
4303     // global/non-connection oriented commands
4304 
4305 
4306 #ifdef ENABLE_CLASSIC
4307     // general gap classic
4308     done = hci_run_general_gap_classic();
4309     if (done) return;
4310 #endif
4311 
4312 #ifdef ENABLE_BLE
4313     // general gap le
4314     done = hci_run_general_gap_le();
4315     if (done) return;
4316 #endif
4317 
4318     // send pending HCI commands
4319     done = hci_run_general_pending_commands();
4320     if (done) return;
4321 
4322     // stack state sub statemachines
4323     hci_connection_t * connection;
4324     switch (hci_stack->state){
4325         case HCI_STATE_INITIALIZING:
4326             hci_initializing_run();
4327             break;
4328 
4329         case HCI_STATE_HALTING:
4330 
4331             log_info("HCI_STATE_HALTING, substate %x\n", hci_stack->substate);
4332             switch (hci_stack->substate){
4333                 case HCI_HALTING_DISCONNECT_ALL_NO_TIMER:
4334                 case HCI_HALTING_DISCONNECT_ALL_TIMER:
4335 
4336 #ifdef ENABLE_BLE
4337 #ifdef ENABLE_LE_CENTRAL
4338                     // free whitelist entries
4339                     {
4340                         btstack_linked_list_iterator_t lit;
4341                         btstack_linked_list_iterator_init(&lit, &hci_stack->le_whitelist);
4342                         while (btstack_linked_list_iterator_has_next(&lit)){
4343                             whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&lit);
4344                             btstack_linked_list_remove(&hci_stack->le_whitelist, (btstack_linked_item_t *) entry);
4345                             btstack_memory_whitelist_entry_free(entry);
4346                         }
4347                     }
4348 #endif
4349 #endif
4350                     // close all open connections
4351                     connection =  (hci_connection_t *) hci_stack->connections;
4352                     if (connection){
4353                         hci_con_handle_t con_handle = (uint16_t) connection->con_handle;
4354                         if (!hci_can_send_command_packet_now()) return;
4355 
4356                         // check state
4357                         if (connection->state == SENT_DISCONNECT) return;
4358                         connection->state = SENT_DISCONNECT;
4359 
4360                         log_info("HCI_STATE_HALTING, connection %p, handle %u", connection, con_handle);
4361 
4362                         // cancel all l2cap connections right away instead of waiting for disconnection complete event ...
4363                         hci_emit_disconnection_complete(con_handle, 0x16); // terminated by local host
4364 
4365                         // ... which would be ignored anyway as we shutdown (free) the connection now
4366                         hci_shutdown_connection(connection);
4367 
4368                         // finally, send the disconnect command
4369                         hci_send_cmd(&hci_disconnect, con_handle, ERROR_CODE_REMOTE_USER_TERMINATED_CONNECTION);
4370                         return;
4371                     }
4372 
4373                     if (hci_stack->substate == HCI_HALTING_DISCONNECT_ALL_TIMER){
4374                         // no connections left, wait a bit to assert that btstack_cyrpto isn't waiting for an HCI event
4375                         log_info("HCI_STATE_HALTING: wait 50 ms");
4376                         hci_stack->substate = HCI_HALTING_W4_TIMER;
4377                         btstack_run_loop_set_timer(&hci_stack->timeout, 50);
4378                         btstack_run_loop_set_timer_handler(&hci_stack->timeout, hci_halting_timeout_handler);
4379                         btstack_run_loop_add_timer(&hci_stack->timeout);
4380                         break;
4381                     }
4382 
4383                     /* fall through */
4384 
4385                 case HCI_HALTING_CLOSE:
4386                     log_info("HCI_STATE_HALTING, calling off");
4387 
4388                     // switch mode
4389                     hci_power_control_off();
4390 
4391                     log_info("HCI_STATE_HALTING, emitting state");
4392                     hci_emit_state();
4393                     log_info("HCI_STATE_HALTING, done");
4394                     break;
4395 
4396                 case HCI_HALTING_W4_TIMER:
4397                     // keep waiting
4398 
4399                     break;
4400                 default:
4401                     break;
4402             }
4403 
4404             break;
4405 
4406         case HCI_STATE_FALLING_ASLEEP:
4407             switch(hci_stack->substate) {
4408                 case HCI_FALLING_ASLEEP_DISCONNECT:
4409                     log_info("HCI_STATE_FALLING_ASLEEP");
4410                     // close all open connections
4411                     connection =  (hci_connection_t *) hci_stack->connections;
4412 
4413 #ifdef HAVE_PLATFORM_IPHONE_OS
4414                     // don't close connections, if H4 supports power management
4415                     if (btstack_control_iphone_power_management_enabled()){
4416                         connection = NULL;
4417                     }
4418 #endif
4419                     if (connection){
4420 
4421                         // send disconnect
4422                         if (!hci_can_send_command_packet_now()) return;
4423 
4424                         log_info("HCI_STATE_FALLING_ASLEEP, connection %p, handle %u", connection, (uint16_t)connection->con_handle);
4425                         hci_send_cmd(&hci_disconnect, connection->con_handle, ERROR_CODE_REMOTE_USER_TERMINATED_CONNECTION);
4426 
4427                         // send disconnected event right away - causes higher layer connections to get closed, too.
4428                         hci_shutdown_connection(connection);
4429                         return;
4430                     }
4431 
4432                     if (hci_classic_supported()){
4433                         // disable page and inquiry scan
4434                         if (!hci_can_send_command_packet_now()) return;
4435 
4436                         log_info("HCI_STATE_HALTING, disabling inq scans");
4437                         hci_send_cmd(&hci_write_scan_enable, hci_stack->connectable << 1); // drop inquiry scan but keep page scan
4438 
4439                         // continue in next sub state
4440                         hci_stack->substate = HCI_FALLING_ASLEEP_W4_WRITE_SCAN_ENABLE;
4441                         break;
4442                     }
4443 
4444                     /* fall through */
4445 
4446                 case HCI_FALLING_ASLEEP_COMPLETE:
4447                     log_info("HCI_STATE_HALTING, calling sleep");
4448 #ifdef HAVE_PLATFORM_IPHONE_OS
4449                     // don't actually go to sleep, if H4 supports power management
4450                     if (btstack_control_iphone_power_management_enabled()){
4451                         // SLEEP MODE reached
4452                         hci_stack->state = HCI_STATE_SLEEPING;
4453                         hci_emit_state();
4454                         break;
4455                     }
4456 #endif
4457                     // switch mode
4458                     hci_power_control_sleep();  // changes hci_stack->state to SLEEP
4459                     hci_emit_state();
4460                     break;
4461 
4462                 default:
4463                     break;
4464             }
4465             break;
4466 
4467         default:
4468             break;
4469     }
4470 }
4471 
4472 int hci_send_cmd_packet(uint8_t *packet, int size){
4473     // house-keeping
4474 
4475 #ifdef ENABLE_CLASSIC
4476     bd_addr_t addr;
4477     hci_connection_t * conn;
4478 #endif
4479 #ifdef ENABLE_LE_CENTRAL
4480     uint8_t initiator_filter_policy;
4481 #endif
4482 
4483     uint16_t opcode = little_endian_read_16(packet, 0);
4484     switch (opcode) {
4485         case HCI_OPCODE_HCI_WRITE_LOOPBACK_MODE:
4486             hci_stack->loopback_mode = packet[3];
4487             break;
4488 
4489 #ifdef ENABLE_CLASSIC
4490         case HCI_OPCODE_HCI_CREATE_CONNECTION:
4491             reverse_bd_addr(&packet[3], addr);
4492             log_info("Create_connection to %s", bd_addr_to_str(addr));
4493 
4494             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
4495             if (!conn) {
4496                 conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
4497                 if (!conn) {
4498                     // notify client that alloc failed
4499                     hci_emit_connection_complete(addr, 0, BTSTACK_MEMORY_ALLOC_FAILED);
4500                     return -1; // packet not sent to controller
4501                 }
4502                 conn->state = SEND_CREATE_CONNECTION;
4503                 conn->role  = HCI_ROLE_MASTER;
4504             }
4505             log_info("conn state %u", conn->state);
4506             switch (conn->state) {
4507                 // if connection active exists
4508                 case OPEN:
4509                     // and OPEN, emit connection complete command
4510                     hci_emit_connection_complete(addr, conn->con_handle, 0);
4511                     return -1; // packet not sent to controller
4512                 case RECEIVED_DISCONNECTION_COMPLETE:
4513                     // create connection triggered in disconnect complete event, let's do it now
4514                     break;
4515                 case SEND_CREATE_CONNECTION:
4516                     // connection created by hci, e.g. dedicated bonding, but not executed yet, let's do it now
4517                     break;
4518                 default:
4519                     // otherwise, just ignore as it is already in the open process
4520                     return -1; // packet not sent to controller
4521             }
4522             conn->state = SENT_CREATE_CONNECTION;
4523 
4524             // track outgoing connection
4525             hci_stack->outgoing_addr_type = BD_ADDR_TYPE_ACL;
4526             (void) memcpy(hci_stack->outgoing_addr, addr, 6);
4527             break;
4528         case HCI_OPCODE_HCI_LINK_KEY_REQUEST_REPLY:
4529             hci_add_connection_flags_for_flipped_bd_addr(&packet[3], SENT_LINK_KEY_REPLY);
4530             break;
4531         case HCI_OPCODE_HCI_LINK_KEY_REQUEST_NEGATIVE_REPLY:
4532             hci_add_connection_flags_for_flipped_bd_addr(&packet[3], SENT_LINK_KEY_NEGATIVE_REQUEST);
4533             break;
4534         case HCI_OPCODE_HCI_DELETE_STORED_LINK_KEY:
4535             if (hci_stack->link_key_db) {
4536                 reverse_bd_addr(&packet[3], addr);
4537                 hci_stack->link_key_db->delete_link_key(addr);
4538             }
4539             break;
4540         case HCI_OPCODE_HCI_PIN_CODE_REQUEST_NEGATIVE_REPLY:
4541         case HCI_OPCODE_HCI_PIN_CODE_REQUEST_REPLY:
4542             reverse_bd_addr(&packet[3], addr);
4543             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
4544             if (conn) {
4545                 connectionClearAuthenticationFlags(conn, LEGACY_PAIRING_ACTIVE);
4546             }
4547             break;
4548         case HCI_OPCODE_HCI_USER_CONFIRMATION_REQUEST_NEGATIVE_REPLY:
4549         case HCI_OPCODE_HCI_USER_CONFIRMATION_REQUEST_REPLY:
4550         case HCI_OPCODE_HCI_USER_PASSKEY_REQUEST_NEGATIVE_REPLY:
4551         case HCI_OPCODE_HCI_USER_PASSKEY_REQUEST_REPLY:
4552             reverse_bd_addr(&packet[3], addr);
4553             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
4554             if (conn) {
4555                 connectionClearAuthenticationFlags(conn, SSP_PAIRING_ACTIVE);
4556             }
4557             break;
4558 
4559 #ifdef ENABLE_SCO_OVER_HCI
4560         case HCI_OPCODE_HCI_SETUP_SYNCHRONOUS_CONNECTION:
4561             // setup_synchronous_connection? Voice setting at offset 22
4562             // TODO: compare to current setting if sco connection already active
4563             hci_stack->sco_voice_setting_active = little_endian_read_16(packet, 15);
4564             break;
4565         case HCI_OPCODE_HCI_ACCEPT_SYNCHRONOUS_CONNECTION:
4566             // accept_synchronus_connection? Voice setting at offset 18
4567             // TODO: compare to current setting if sco connection already active
4568             hci_stack->sco_voice_setting_active = little_endian_read_16(packet, 19);
4569             break;
4570 #endif
4571 #endif
4572 
4573 #ifdef ENABLE_BLE
4574         case HCI_OPCODE_HCI_LE_SET_RANDOM_ADDRESS:
4575             hci_stack->le_random_address_set = 1;
4576             reverse_bd_addr(&packet[3], hci_stack->le_random_address);
4577             break;
4578 #ifdef ENABLE_LE_PERIPHERAL
4579         case HCI_OPCODE_HCI_LE_SET_ADVERTISE_ENABLE:
4580             hci_stack->le_advertisements_active = packet[3] != 0;
4581             break;
4582 #endif
4583 #ifdef ENABLE_LE_CENTRAL
4584         case HCI_OPCODE_HCI_LE_CREATE_CONNECTION:
4585             // white list used?
4586             initiator_filter_policy = packet[7];
4587             switch (initiator_filter_policy) {
4588                 case 0:
4589                     // whitelist not used
4590                     hci_stack->le_connecting_state = LE_CONNECTING_DIRECT;
4591                     break;
4592                 case 1:
4593                     hci_stack->le_connecting_state = LE_CONNECTING_WHITELIST;
4594                     break;
4595                 default:
4596                     log_error("Invalid initiator_filter_policy in LE Create Connection %u", initiator_filter_policy);
4597                     break;
4598             }
4599             // track outgoing connection
4600             hci_stack->outgoing_addr_type = (bd_addr_type_t) packet[8]; // peer addres type
4601             reverse_bd_addr( &packet[9], hci_stack->outgoing_addr); // peer address
4602             break;
4603         case HCI_OPCODE_HCI_LE_CREATE_CONNECTION_CANCEL:
4604             hci_stack->le_connecting_state = LE_CONNECTING_CANCEL;
4605             break;
4606 #endif
4607 #endif
4608         default:
4609             break;
4610     }
4611 
4612     hci_stack->num_cmd_packets--;
4613 
4614     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, packet, size);
4615     return hci_stack->hci_transport->send_packet(HCI_COMMAND_DATA_PACKET, packet, size);
4616 }
4617 
4618 // disconnect because of security block
4619 void hci_disconnect_security_block(hci_con_handle_t con_handle){
4620     hci_connection_t * connection = hci_connection_for_handle(con_handle);
4621     if (!connection) return;
4622     connection->bonding_flags |= BONDING_DISCONNECT_SECURITY_BLOCK;
4623 }
4624 
4625 
4626 // Configure Secure Simple Pairing
4627 
4628 #ifdef ENABLE_CLASSIC
4629 
4630 // enable will enable SSP during init
4631 void gap_ssp_set_enable(int enable){
4632     hci_stack->ssp_enable = enable;
4633 }
4634 
4635 static int hci_local_ssp_activated(void){
4636     return gap_ssp_supported() && hci_stack->ssp_enable;
4637 }
4638 
4639 // if set, BTstack will respond to io capability request using authentication requirement
4640 void gap_ssp_set_io_capability(int io_capability){
4641     hci_stack->ssp_io_capability = io_capability;
4642 }
4643 void gap_ssp_set_authentication_requirement(int authentication_requirement){
4644     hci_stack->ssp_authentication_requirement = authentication_requirement;
4645 }
4646 
4647 // if set, BTstack will confirm a numberic comparion and enter '000000' if requested
4648 void gap_ssp_set_auto_accept(int auto_accept){
4649     hci_stack->ssp_auto_accept = auto_accept;
4650 }
4651 
4652 void gap_secure_connections_enable(bool enable){
4653     hci_stack->secure_connections_enable = enable;
4654 }
4655 
4656 #endif
4657 
4658 // va_list part of hci_send_cmd
4659 int hci_send_cmd_va_arg(const hci_cmd_t *cmd, va_list argptr){
4660     if (!hci_can_send_command_packet_now()){
4661         log_error("hci_send_cmd called but cannot send packet now");
4662         return 0;
4663     }
4664 
4665     // for HCI INITIALIZATION
4666     // log_info("hci_send_cmd: opcode %04x", cmd->opcode);
4667     hci_stack->last_cmd_opcode = cmd->opcode;
4668 
4669     hci_reserve_packet_buffer();
4670     uint8_t * packet = hci_stack->hci_packet_buffer;
4671     uint16_t size = hci_cmd_create_from_template(packet, cmd, argptr);
4672     int err = hci_send_cmd_packet(packet, size);
4673 
4674     // release packet buffer on error or for synchronous transport implementations
4675     if ((err < 0) || hci_transport_synchronous()){
4676         hci_release_packet_buffer();
4677         hci_emit_transport_packet_sent();
4678     }
4679 
4680     return err;
4681 }
4682 
4683 /**
4684  * pre: numcmds >= 0 - it's allowed to send a command to the controller
4685  */
4686 int hci_send_cmd(const hci_cmd_t *cmd, ...){
4687     va_list argptr;
4688     va_start(argptr, cmd);
4689     int res = hci_send_cmd_va_arg(cmd, argptr);
4690     va_end(argptr);
4691     return res;
4692 }
4693 
4694 // Create various non-HCI events.
4695 // TODO: generalize, use table similar to hci_create_command
4696 
4697 static void hci_emit_event(uint8_t * event, uint16_t size, int dump){
4698     // dump packet
4699     if (dump) {
4700         hci_dump_packet( HCI_EVENT_PACKET, 0, event, size);
4701     }
4702 
4703     // dispatch to all event handlers
4704     btstack_linked_list_iterator_t it;
4705     btstack_linked_list_iterator_init(&it, &hci_stack->event_handlers);
4706     while (btstack_linked_list_iterator_has_next(&it)){
4707         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
4708         entry->callback(HCI_EVENT_PACKET, 0, event, size);
4709     }
4710 }
4711 
4712 static void hci_emit_acl_packet(uint8_t * packet, uint16_t size){
4713     if (!hci_stack->acl_packet_handler) return;
4714     hci_stack->acl_packet_handler(HCI_ACL_DATA_PACKET, 0, packet, size);
4715 }
4716 
4717 #ifdef ENABLE_CLASSIC
4718 static void hci_notify_if_sco_can_send_now(void){
4719     // notify SCO sender if waiting
4720     if (!hci_stack->sco_waiting_for_can_send_now) return;
4721     if (hci_can_send_sco_packet_now()){
4722         hci_stack->sco_waiting_for_can_send_now = 0;
4723         uint8_t event[2] = { HCI_EVENT_SCO_CAN_SEND_NOW, 0 };
4724         hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
4725         hci_stack->sco_packet_handler(HCI_EVENT_PACKET, 0, event, sizeof(event));
4726     }
4727 }
4728 
4729 // parsing end emitting has been merged to reduce code size
4730 static void gap_inquiry_explode(uint8_t *packet, uint16_t size) {
4731     uint8_t event[19+GAP_INQUIRY_MAX_NAME_LEN];
4732 
4733     uint8_t * eir_data;
4734     ad_context_t context;
4735     const uint8_t * name;
4736     uint8_t         name_len;
4737 
4738     if (size < 3) return;
4739 
4740     int event_type = hci_event_packet_get_type(packet);
4741     int num_reserved_fields = (event_type == HCI_EVENT_INQUIRY_RESULT) ? 2 : 1;    // 2 for old event, 1 otherwise
4742     int num_responses       = hci_event_inquiry_result_get_num_responses(packet);
4743 
4744     switch (event_type){
4745         case HCI_EVENT_INQUIRY_RESULT:
4746         case HCI_EVENT_INQUIRY_RESULT_WITH_RSSI:
4747             if (size != (3 + (num_responses * 14))) return;
4748             break;
4749         case HCI_EVENT_EXTENDED_INQUIRY_RESPONSE:
4750             if (size != 257) return;
4751             if (num_responses != 1) return;
4752             break;
4753         default:
4754             return;
4755     }
4756 
4757     // event[1] is set at the end
4758     int i;
4759     for (i=0; i<num_responses;i++){
4760         memset(event, 0, sizeof(event));
4761         event[0] = GAP_EVENT_INQUIRY_RESULT;
4762         uint8_t event_size = 18;    // if name is not set by EIR
4763 
4764         (void)memcpy(&event[2], &packet[3 + (i * 6)], 6); // bd_addr
4765         event[8] =          packet[3 + (num_responses*(6))                         + (i*1)];     // page_scan_repetition_mode
4766         (void)memcpy(&event[9],
4767                      &packet[3 + (num_responses * (6 + 1 + num_reserved_fields)) + (i * 3)],
4768                      3); // class of device
4769         (void)memcpy(&event[12],
4770                      &packet[3 + (num_responses * (6 + 1 + num_reserved_fields + 3)) + (i * 2)],
4771                      2); // clock offset
4772 
4773         switch (event_type){
4774             case HCI_EVENT_INQUIRY_RESULT:
4775                 // 14,15,16,17 = 0, size 18
4776                 break;
4777             case HCI_EVENT_INQUIRY_RESULT_WITH_RSSI:
4778                 event[14] = 1;
4779                 event[15] = packet [3 + (num_responses*(6+1+num_reserved_fields+3+2)) + (i*1)]; // rssi
4780                 // 16,17 = 0, size 18
4781                 break;
4782             case HCI_EVENT_EXTENDED_INQUIRY_RESPONSE:
4783                 event[14] = 1;
4784                 event[15] = packet [3 + (num_responses*(6+1+num_reserved_fields+3+2)) + (i*1)]; // rssi
4785                 // EIR packets only contain a single inquiry response
4786                 eir_data = &packet[3 + (6+1+num_reserved_fields+3+2+1)];
4787                 name = NULL;
4788                 // Iterate over EIR data
4789                 for (ad_iterator_init(&context, EXTENDED_INQUIRY_RESPONSE_DATA_LEN, eir_data) ; ad_iterator_has_more(&context) ; ad_iterator_next(&context)){
4790                     uint8_t data_type    = ad_iterator_get_data_type(&context);
4791                     uint8_t data_size    = ad_iterator_get_data_len(&context);
4792                     const uint8_t * data = ad_iterator_get_data(&context);
4793                     // Prefer Complete Local Name over Shortend Local Name
4794                     switch (data_type){
4795                         case BLUETOOTH_DATA_TYPE_SHORTENED_LOCAL_NAME:
4796                             if (name) continue;
4797                             /* fall through */
4798                         case BLUETOOTH_DATA_TYPE_COMPLETE_LOCAL_NAME:
4799                             name = data;
4800                             name_len = data_size;
4801                             break;
4802                         default:
4803                             break;
4804                     }
4805                 }
4806                 if (name){
4807                     event[16] = 1;
4808                     // truncate name if needed
4809                     int len = btstack_min(name_len, GAP_INQUIRY_MAX_NAME_LEN);
4810                     event[17] = len;
4811                     (void)memcpy(&event[18], name, len);
4812                     event_size += len;
4813                 }
4814                 break;
4815             default:
4816                 return;
4817         }
4818         event[1] = event_size - 2;
4819         hci_emit_event(event, event_size, 1);
4820     }
4821 }
4822 #endif
4823 
4824 void hci_emit_state(void){
4825     log_info("BTSTACK_EVENT_STATE %u", hci_stack->state);
4826     uint8_t event[3];
4827     event[0] = BTSTACK_EVENT_STATE;
4828     event[1] = sizeof(event) - 2u;
4829     event[2] = hci_stack->state;
4830     hci_emit_event(event, sizeof(event), 1);
4831 }
4832 
4833 #ifdef ENABLE_CLASSIC
4834 static void hci_emit_connection_complete(bd_addr_t address, hci_con_handle_t con_handle, uint8_t status){
4835     uint8_t event[13];
4836     event[0] = HCI_EVENT_CONNECTION_COMPLETE;
4837     event[1] = sizeof(event) - 2;
4838     event[2] = status;
4839     little_endian_store_16(event, 3, con_handle);
4840     reverse_bd_addr(address, &event[5]);
4841     event[11] = 1; // ACL connection
4842     event[12] = 0; // encryption disabled
4843     hci_emit_event(event, sizeof(event), 1);
4844 }
4845 static void hci_emit_l2cap_check_timeout(hci_connection_t *conn){
4846     if (disable_l2cap_timeouts) return;
4847     log_info("L2CAP_EVENT_TIMEOUT_CHECK");
4848     uint8_t event[4];
4849     event[0] = L2CAP_EVENT_TIMEOUT_CHECK;
4850     event[1] = sizeof(event) - 2;
4851     little_endian_store_16(event, 2, conn->con_handle);
4852     hci_emit_event(event, sizeof(event), 1);
4853 }
4854 #endif
4855 
4856 #ifdef ENABLE_BLE
4857 #ifdef ENABLE_LE_CENTRAL
4858 static void hci_emit_le_connection_complete(uint8_t address_type, const bd_addr_t address, hci_con_handle_t con_handle, uint8_t status){
4859     uint8_t event[21];
4860     event[0] = HCI_EVENT_LE_META;
4861     event[1] = sizeof(event) - 2u;
4862     event[2] = HCI_SUBEVENT_LE_CONNECTION_COMPLETE;
4863     event[3] = status;
4864     little_endian_store_16(event, 4, con_handle);
4865     event[6] = 0; // TODO: role
4866     event[7] = address_type;
4867     reverse_bd_addr(address, &event[8]);
4868     little_endian_store_16(event, 14, 0); // interval
4869     little_endian_store_16(event, 16, 0); // latency
4870     little_endian_store_16(event, 18, 0); // supervision timeout
4871     event[20] = 0; // master clock accuracy
4872     hci_emit_event(event, sizeof(event), 1);
4873 }
4874 #endif
4875 #endif
4876 
4877 static void hci_emit_transport_packet_sent(void){
4878     // notify upper stack that it might be possible to send again
4879     uint8_t event[] = { HCI_EVENT_TRANSPORT_PACKET_SENT, 0};
4880     hci_emit_event(&event[0], sizeof(event), 0);  // don't dump
4881 }
4882 
4883 static void hci_emit_disconnection_complete(hci_con_handle_t con_handle, uint8_t reason){
4884     uint8_t event[6];
4885     event[0] = HCI_EVENT_DISCONNECTION_COMPLETE;
4886     event[1] = sizeof(event) - 2u;
4887     event[2] = 0; // status = OK
4888     little_endian_store_16(event, 3, con_handle);
4889     event[5] = reason;
4890     hci_emit_event(event, sizeof(event), 1);
4891 }
4892 
4893 static void hci_emit_nr_connections_changed(void){
4894     log_info("BTSTACK_EVENT_NR_CONNECTIONS_CHANGED %u", nr_hci_connections());
4895     uint8_t event[3];
4896     event[0] = BTSTACK_EVENT_NR_CONNECTIONS_CHANGED;
4897     event[1] = sizeof(event) - 2u;
4898     event[2] = nr_hci_connections();
4899     hci_emit_event(event, sizeof(event), 1);
4900 }
4901 
4902 static void hci_emit_hci_open_failed(void){
4903     log_info("BTSTACK_EVENT_POWERON_FAILED");
4904     uint8_t event[2];
4905     event[0] = BTSTACK_EVENT_POWERON_FAILED;
4906     event[1] = sizeof(event) - 2u;
4907     hci_emit_event(event, sizeof(event), 1);
4908 }
4909 
4910 static void hci_emit_dedicated_bonding_result(bd_addr_t address, uint8_t status){
4911     log_info("hci_emit_dedicated_bonding_result %u ", status);
4912     uint8_t event[9];
4913     int pos = 0;
4914     event[pos++] = GAP_EVENT_DEDICATED_BONDING_COMPLETED;
4915     event[pos++] = sizeof(event) - 2u;
4916     event[pos++] = status;
4917     reverse_bd_addr(address, &event[pos]);
4918     hci_emit_event(event, sizeof(event), 1);
4919 }
4920 
4921 
4922 #ifdef ENABLE_CLASSIC
4923 
4924 static void hci_emit_security_level(hci_con_handle_t con_handle, gap_security_level_t level){
4925     log_info("hci_emit_security_level %u for handle %x", level, con_handle);
4926     uint8_t event[5];
4927     int pos = 0;
4928     event[pos++] = GAP_EVENT_SECURITY_LEVEL;
4929     event[pos++] = sizeof(event) - 2;
4930     little_endian_store_16(event, 2, con_handle);
4931     pos += 2;
4932     event[pos++] = level;
4933     hci_emit_event(event, sizeof(event), 1);
4934 }
4935 
4936 static gap_security_level_t gap_security_level_for_connection(hci_connection_t * connection){
4937     if (!connection) return LEVEL_0;
4938     if ((connection->authentication_flags & CONNECTION_ENCRYPTED) == 0) return LEVEL_0;
4939     if ((connection->authentication_flags & CONNECTION_AUTHENTICATED) == 0) return LEVEL_0;
4940     if (connection->encryption_key_size < hci_stack->gap_required_encyrption_key_size) return LEVEL_0;
4941     gap_security_level_t security_level = gap_security_level_for_link_key_type(connection->link_key_type);
4942     // LEVEL 4 always requires 128 bit encrytion key size
4943     if ((security_level == LEVEL_4) && (connection->encryption_key_size < 16)){
4944         security_level = LEVEL_3;
4945     }
4946     return security_level;
4947 }
4948 
4949 static void hci_emit_discoverable_enabled(uint8_t enabled){
4950     log_info("BTSTACK_EVENT_DISCOVERABLE_ENABLED %u", enabled);
4951     uint8_t event[3];
4952     event[0] = BTSTACK_EVENT_DISCOVERABLE_ENABLED;
4953     event[1] = sizeof(event) - 2;
4954     event[2] = enabled;
4955     hci_emit_event(event, sizeof(event), 1);
4956 }
4957 
4958 // query if remote side supports eSCO
4959 int hci_remote_esco_supported(hci_con_handle_t con_handle){
4960     hci_connection_t * connection = hci_connection_for_handle(con_handle);
4961     if (!connection) return 0;
4962     return (connection->remote_supported_features[0] & 1) != 0;
4963 }
4964 
4965 static bool hci_ssp_supported(hci_connection_t * connection){
4966     const uint8_t mask = BONDING_REMOTE_SUPPORTS_SSP_CONTROLLER | BONDING_REMOTE_SUPPORTS_SSP_HOST;
4967     return (connection->bonding_flags & mask) == mask;
4968 }
4969 
4970 // query if remote side supports SSP
4971 int hci_remote_ssp_supported(hci_con_handle_t con_handle){
4972     hci_connection_t * connection = hci_connection_for_handle(con_handle);
4973     if (!connection) return 0;
4974     return hci_ssp_supported(connection) ? 1 : 0;
4975 }
4976 
4977 int gap_ssp_supported_on_both_sides(hci_con_handle_t handle){
4978     return hci_local_ssp_activated() && hci_remote_ssp_supported(handle);
4979 }
4980 
4981 // GAP API
4982 /**
4983  * @bbrief enable/disable bonding. default is enabled
4984  * @praram enabled
4985  */
4986 void gap_set_bondable_mode(int enable){
4987     hci_stack->bondable = enable ? 1 : 0;
4988 }
4989 /**
4990  * @brief Get bondable mode.
4991  * @return 1 if bondable
4992  */
4993 int gap_get_bondable_mode(void){
4994     return hci_stack->bondable;
4995 }
4996 
4997 /**
4998  * @brief map link keys to security levels
4999  */
5000 gap_security_level_t gap_security_level_for_link_key_type(link_key_type_t link_key_type){
5001     switch (link_key_type){
5002         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256:
5003             return LEVEL_4;
5004         case COMBINATION_KEY:
5005         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P192:
5006             return LEVEL_3;
5007         default:
5008             return LEVEL_2;
5009     }
5010 }
5011 
5012 /**
5013  * @brief map link keys to secure connection yes/no
5014  */
5015 int gap_secure_connection_for_link_key_type(link_key_type_t link_key_type){
5016     switch (link_key_type){
5017         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256:
5018         case UNAUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256:
5019             return 1;
5020         default:
5021             return 0;
5022     }
5023 }
5024 
5025 /**
5026  * @brief map link keys to authenticated
5027  */
5028 int gap_authenticated_for_link_key_type(link_key_type_t link_key_type){
5029     switch (link_key_type){
5030         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256:
5031         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P192:
5032             return 1;
5033         default:
5034             return 0;
5035     }
5036 }
5037 
5038 int gap_mitm_protection_required_for_security_level(gap_security_level_t level){
5039     log_info("gap_mitm_protection_required_for_security_level %u", level);
5040     return level > LEVEL_2;
5041 }
5042 
5043 /**
5044  * @brief get current security level
5045  */
5046 gap_security_level_t gap_security_level(hci_con_handle_t con_handle){
5047     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5048     if (!connection) return LEVEL_0;
5049     return gap_security_level_for_connection(connection);
5050 }
5051 
5052 /**
5053  * @brief request connection to device to
5054  * @result GAP_AUTHENTICATION_RESULT
5055  */
5056 void gap_request_security_level(hci_con_handle_t con_handle, gap_security_level_t requested_level){
5057     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5058     if (!connection){
5059         hci_emit_security_level(con_handle, LEVEL_0);
5060         return;
5061     }
5062 
5063     btstack_assert(hci_is_le_connection(connection) == false);
5064 
5065     gap_security_level_t current_level = gap_security_level(con_handle);
5066     log_info("gap_request_security_level requested level %u, planned level %u, current level %u",
5067         requested_level, connection->requested_security_level, current_level);
5068 
5069     // assumption: earlier requested security higher than current level => security request is active
5070     if (current_level < connection->requested_security_level){
5071         if (connection->requested_security_level < requested_level){
5072             // increase requested level as new level is higher
5073 
5074             // TODO: handle re-authentication when done
5075 
5076             connection->requested_security_level = requested_level;
5077         }
5078         return;
5079     }
5080 
5081     // no request active, notify if security sufficient
5082     if (requested_level <= current_level){
5083         hci_emit_security_level(con_handle, current_level);
5084         return;
5085     }
5086 
5087     // store request
5088     connection->requested_security_level = requested_level;
5089 
5090     // start to authenticate connection if authentication not already active
5091     if ((connection->bonding_flags & BONDING_SENT_AUTHENTICATE_REQUEST) != 0) return;
5092     connection->bonding_flags |= BONDING_SEND_AUTHENTICATE_REQUEST;
5093     hci_run();
5094 }
5095 
5096 /**
5097  * @brief start dedicated bonding with device. disconnect after bonding
5098  * @param device
5099  * @param request MITM protection
5100  * @result GAP_DEDICATED_BONDING_COMPLETE
5101  */
5102 int gap_dedicated_bonding(bd_addr_t device, int mitm_protection_required){
5103 
5104     // create connection state machine
5105     hci_connection_t * connection = create_connection_for_bd_addr_and_type(device, BD_ADDR_TYPE_ACL);
5106 
5107     if (!connection){
5108         return BTSTACK_MEMORY_ALLOC_FAILED;
5109     }
5110 
5111     // delete linkn key
5112     gap_drop_link_key_for_bd_addr(device);
5113 
5114     // configure LEVEL_2/3, dedicated bonding
5115     connection->state = SEND_CREATE_CONNECTION;
5116     connection->requested_security_level = mitm_protection_required ? LEVEL_3 : LEVEL_2;
5117     log_info("gap_dedicated_bonding, mitm %d -> level %u", mitm_protection_required, connection->requested_security_level);
5118     connection->bonding_flags = BONDING_DEDICATED;
5119 
5120     // wait for GAP Security Result and send GAP Dedicated Bonding complete
5121 
5122     // handle: connnection failure (connection complete != ok)
5123     // handle: authentication failure
5124     // handle: disconnect on done
5125 
5126     hci_run();
5127 
5128     return 0;
5129 }
5130 #endif
5131 
5132 void gap_set_local_name(const char * local_name){
5133     hci_stack->local_name = local_name;
5134 }
5135 
5136 
5137 #ifdef ENABLE_BLE
5138 
5139 #ifdef ENABLE_LE_CENTRAL
5140 void gap_start_scan(void){
5141     hci_stack->le_scanning_enabled = true;
5142     hci_run();
5143 }
5144 
5145 void gap_stop_scan(void){
5146     hci_stack->le_scanning_enabled = false;
5147     hci_run();
5148 }
5149 
5150 void gap_set_scan_params(uint8_t scan_type, uint16_t scan_interval, uint16_t scan_window, uint8_t scanning_filter_policy){
5151     hci_stack->le_scan_type          = scan_type;
5152     hci_stack->le_scan_filter_policy = scanning_filter_policy;
5153     hci_stack->le_scan_interval      = scan_interval;
5154     hci_stack->le_scan_window        = scan_window;
5155     hci_stack->le_scanning_param_update = true;
5156     hci_run();
5157 }
5158 
5159 void gap_set_scan_parameters(uint8_t scan_type, uint16_t scan_interval, uint16_t scan_window){
5160     gap_set_scan_params(scan_type, scan_interval, scan_window, 0);
5161 }
5162 
5163 uint8_t gap_connect(const bd_addr_t addr, bd_addr_type_t addr_type){
5164     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
5165     if (!conn){
5166         // disallow if le connection is already outgoing
5167         if (hci_is_le_connection_type(addr_type) && hci_stack->le_connecting_request != LE_CONNECTING_IDLE){
5168             log_error("le connection already active");
5169             return ERROR_CODE_COMMAND_DISALLOWED;
5170         }
5171 
5172         log_info("gap_connect: no connection exists yet, creating context");
5173         conn = create_connection_for_bd_addr_and_type(addr, addr_type);
5174         if (!conn){
5175             // notify client that alloc failed
5176             hci_emit_le_connection_complete(addr_type, addr, 0, BTSTACK_MEMORY_ALLOC_FAILED);
5177             log_info("gap_connect: failed to alloc hci_connection_t");
5178             return GATT_CLIENT_NOT_CONNECTED; // don't sent packet to controller
5179         }
5180 
5181         // set le connecting state
5182         if (hci_is_le_connection_type(addr_type)){
5183             hci_stack->le_connecting_request = LE_CONNECTING_DIRECT;
5184         }
5185 
5186         conn->state = SEND_CREATE_CONNECTION;
5187         log_info("gap_connect: send create connection next");
5188         hci_run();
5189         return ERROR_CODE_SUCCESS;
5190     }
5191 
5192     if (!hci_is_le_connection(conn) ||
5193         (conn->state == SEND_CREATE_CONNECTION) ||
5194         (conn->state == SENT_CREATE_CONNECTION)) {
5195         hci_emit_le_connection_complete(conn->address_type, conn->address, 0, ERROR_CODE_COMMAND_DISALLOWED);
5196         log_error("gap_connect: classic connection or connect is already being created");
5197         return GATT_CLIENT_IN_WRONG_STATE;
5198     }
5199 
5200     // check if connection was just disconnected
5201     if (conn->state == RECEIVED_DISCONNECTION_COMPLETE){
5202         log_info("gap_connect: send create connection (again)");
5203         conn->state = SEND_CREATE_CONNECTION;
5204         hci_run();
5205         return ERROR_CODE_SUCCESS;
5206     }
5207 
5208     log_info("gap_connect: context exists with state %u", conn->state);
5209     hci_emit_le_connection_complete(conn->address_type, conn->address, conn->con_handle, ERROR_CODE_SUCCESS);
5210     hci_run();
5211     return ERROR_CODE_SUCCESS;
5212 }
5213 
5214 // @assumption: only a single outgoing LE Connection exists
5215 static hci_connection_t * gap_get_outgoing_connection(void){
5216     btstack_linked_item_t *it;
5217     for (it = (btstack_linked_item_t *) hci_stack->connections; it != NULL; it = it->next){
5218         hci_connection_t * conn = (hci_connection_t *) it;
5219         if (!hci_is_le_connection(conn)) continue;
5220         switch (conn->state){
5221             case SEND_CREATE_CONNECTION:
5222             case SENT_CREATE_CONNECTION:
5223             case SENT_CANCEL_CONNECTION:
5224                 return conn;
5225             default:
5226                 break;
5227         };
5228     }
5229     return NULL;
5230 }
5231 
5232 uint8_t gap_connect_cancel(void){
5233     hci_connection_t * conn = gap_get_outgoing_connection();
5234     if (!conn) return 0;
5235     switch (conn->state){
5236         case SEND_CREATE_CONNECTION:
5237             // skip sending create connection and emit event instead
5238             hci_emit_le_connection_complete(conn->address_type, conn->address, 0, ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER);
5239             btstack_linked_list_remove(&hci_stack->connections, (btstack_linked_item_t *) conn);
5240             btstack_memory_hci_connection_free( conn );
5241             break;
5242         case SENT_CREATE_CONNECTION:
5243             // request to send cancel connection
5244             conn->state = SEND_CANCEL_CONNECTION;
5245             hci_run();
5246             break;
5247         default:
5248             break;
5249     }
5250     return 0;
5251 }
5252 #endif
5253 
5254 #ifdef ENABLE_LE_CENTRAL
5255 /**
5256  * @brief Set connection parameters for outgoing connections
5257  * @param conn_scan_interval (unit: 0.625 msec), default: 60 ms
5258  * @param conn_scan_window (unit: 0.625 msec), default: 30 ms
5259  * @param conn_interval_min (unit: 1.25ms), default: 10 ms
5260  * @param conn_interval_max (unit: 1.25ms), default: 30 ms
5261  * @param conn_latency, default: 4
5262  * @param supervision_timeout (unit: 10ms), default: 720 ms
5263  * @param min_ce_length (unit: 0.625ms), default: 10 ms
5264  * @param max_ce_length (unit: 0.625ms), default: 30 ms
5265  */
5266 
5267 void gap_set_connection_parameters(uint16_t conn_scan_interval, uint16_t conn_scan_window,
5268     uint16_t conn_interval_min, uint16_t conn_interval_max, uint16_t conn_latency,
5269     uint16_t supervision_timeout, uint16_t min_ce_length, uint16_t max_ce_length){
5270     hci_stack->le_connection_scan_interval = conn_scan_interval;
5271     hci_stack->le_connection_scan_window = conn_scan_window;
5272     hci_stack->le_connection_interval_min = conn_interval_min;
5273     hci_stack->le_connection_interval_max = conn_interval_max;
5274     hci_stack->le_connection_latency = conn_latency;
5275     hci_stack->le_supervision_timeout = supervision_timeout;
5276     hci_stack->le_minimum_ce_length = min_ce_length;
5277     hci_stack->le_maximum_ce_length = max_ce_length;
5278 }
5279 #endif
5280 
5281 /**
5282  * @brief Updates the connection parameters for a given LE connection
5283  * @param handle
5284  * @param conn_interval_min (unit: 1.25ms)
5285  * @param conn_interval_max (unit: 1.25ms)
5286  * @param conn_latency
5287  * @param supervision_timeout (unit: 10ms)
5288  * @returns 0 if ok
5289  */
5290 int gap_update_connection_parameters(hci_con_handle_t con_handle, uint16_t conn_interval_min,
5291     uint16_t conn_interval_max, uint16_t conn_latency, uint16_t supervision_timeout){
5292     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5293     if (!connection) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5294     connection->le_conn_interval_min = conn_interval_min;
5295     connection->le_conn_interval_max = conn_interval_max;
5296     connection->le_conn_latency = conn_latency;
5297     connection->le_supervision_timeout = supervision_timeout;
5298     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS;
5299     hci_run();
5300     return 0;
5301 }
5302 
5303 /**
5304  * @brief Request an update of the connection parameter for a given LE connection
5305  * @param handle
5306  * @param conn_interval_min (unit: 1.25ms)
5307  * @param conn_interval_max (unit: 1.25ms)
5308  * @param conn_latency
5309  * @param supervision_timeout (unit: 10ms)
5310  * @returns 0 if ok
5311  */
5312 int gap_request_connection_parameter_update(hci_con_handle_t con_handle, uint16_t conn_interval_min,
5313     uint16_t conn_interval_max, uint16_t conn_latency, uint16_t supervision_timeout){
5314     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5315     if (!connection) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5316     connection->le_conn_interval_min = conn_interval_min;
5317     connection->le_conn_interval_max = conn_interval_max;
5318     connection->le_conn_latency = conn_latency;
5319     connection->le_supervision_timeout = supervision_timeout;
5320     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_SEND_REQUEST;
5321     uint8_t l2cap_trigger_run_event[2] = { L2CAP_EVENT_TRIGGER_RUN, 0};
5322     hci_emit_event(l2cap_trigger_run_event, sizeof(l2cap_trigger_run_event), 0);
5323     return 0;
5324 }
5325 
5326 #ifdef ENABLE_LE_PERIPHERAL
5327 
5328 /**
5329  * @brief Set Advertisement Data
5330  * @param advertising_data_length
5331  * @param advertising_data (max 31 octets)
5332  * @note data is not copied, pointer has to stay valid
5333  */
5334 void gap_advertisements_set_data(uint8_t advertising_data_length, uint8_t * advertising_data){
5335     hci_stack->le_advertisements_data_len = advertising_data_length;
5336     hci_stack->le_advertisements_data = advertising_data;
5337     hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_SET_ADV_DATA;
5338     hci_run();
5339 }
5340 
5341 /**
5342  * @brief Set Scan Response Data
5343  * @param advertising_data_length
5344  * @param advertising_data (max 31 octets)
5345  * @note data is not copied, pointer has to stay valid
5346  */
5347 void gap_scan_response_set_data(uint8_t scan_response_data_length, uint8_t * scan_response_data){
5348     hci_stack->le_scan_response_data_len = scan_response_data_length;
5349     hci_stack->le_scan_response_data = scan_response_data;
5350     hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_SET_SCAN_DATA;
5351     hci_run();
5352 }
5353 
5354 /**
5355  * @brief Set Advertisement Parameters
5356  * @param adv_int_min
5357  * @param adv_int_max
5358  * @param adv_type
5359  * @param direct_address_type
5360  * @param direct_address
5361  * @param channel_map
5362  * @param filter_policy
5363  *
5364  * @note internal use. use gap_advertisements_set_params from gap_le.h instead.
5365  */
5366  void hci_le_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
5367     uint8_t direct_address_typ, bd_addr_t direct_address,
5368     uint8_t channel_map, uint8_t filter_policy) {
5369 
5370     hci_stack->le_advertisements_interval_min = adv_int_min;
5371     hci_stack->le_advertisements_interval_max = adv_int_max;
5372     hci_stack->le_advertisements_type = adv_type;
5373     hci_stack->le_advertisements_direct_address_type = direct_address_typ;
5374     hci_stack->le_advertisements_channel_map = channel_map;
5375     hci_stack->le_advertisements_filter_policy = filter_policy;
5376     (void)memcpy(hci_stack->le_advertisements_direct_address, direct_address,
5377                  6);
5378 
5379     hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_SET_PARAMS;
5380     hci_run();
5381  }
5382 
5383 /**
5384  * @brief Enable/Disable Advertisements
5385  * @param enabled
5386  */
5387 void gap_advertisements_enable(int enabled){
5388     hci_stack->le_advertisements_enabled = enabled != 0;
5389     hci_update_advertisements_enabled_for_current_roles();
5390     hci_run();
5391 }
5392 
5393 #endif
5394 
5395 void hci_le_set_own_address_type(uint8_t own_address_type){
5396     log_info("hci_le_set_own_address_type: old %u, new %u", hci_stack->le_own_addr_type, own_address_type);
5397     if (own_address_type == hci_stack->le_own_addr_type) return;
5398     hci_stack->le_own_addr_type = own_address_type;
5399 
5400 #ifdef ENABLE_LE_PERIPHERAL
5401     // update advertisement parameters, too
5402     hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_SET_PARAMS;
5403     hci_run();
5404 #endif
5405 #ifdef ENABLE_LE_CENTRAL
5406     // note: we don't update scan parameters or modify ongoing connection attempts
5407 #endif
5408 }
5409 
5410 #endif
5411 
5412 uint8_t gap_disconnect(hci_con_handle_t handle){
5413     hci_connection_t * conn = hci_connection_for_handle(handle);
5414     if (!conn){
5415         hci_emit_disconnection_complete(handle, 0);
5416         return 0;
5417     }
5418     // ignore if already disconnected
5419     if (conn->state == RECEIVED_DISCONNECTION_COMPLETE){
5420         return 0;
5421     }
5422     conn->state = SEND_DISCONNECT;
5423     hci_run();
5424     return 0;
5425 }
5426 
5427 int gap_read_rssi(hci_con_handle_t con_handle){
5428     hci_connection_t * hci_connection = hci_connection_for_handle(con_handle);
5429     if (hci_connection == NULL) return 0;
5430     connectionSetAuthenticationFlags(hci_connection, READ_RSSI);
5431     hci_run();
5432     return 1;
5433 }
5434 
5435 /**
5436  * @brief Get connection type
5437  * @param con_handle
5438  * @result connection_type
5439  */
5440 gap_connection_type_t gap_get_connection_type(hci_con_handle_t connection_handle){
5441     hci_connection_t * conn = hci_connection_for_handle(connection_handle);
5442     if (!conn) return GAP_CONNECTION_INVALID;
5443     switch (conn->address_type){
5444         case BD_ADDR_TYPE_LE_PUBLIC:
5445         case BD_ADDR_TYPE_LE_RANDOM:
5446             return GAP_CONNECTION_LE;
5447         case BD_ADDR_TYPE_SCO:
5448             return GAP_CONNECTION_SCO;
5449         case BD_ADDR_TYPE_ACL:
5450             return GAP_CONNECTION_ACL;
5451         default:
5452             return GAP_CONNECTION_INVALID;
5453     }
5454 }
5455 
5456 hci_role_t gap_get_role(hci_con_handle_t connection_handle){
5457     hci_connection_t * conn = hci_connection_for_handle(connection_handle);
5458     if (!conn) return HCI_ROLE_INVALID;
5459     return (hci_role_t) conn->role;
5460 }
5461 
5462 
5463 #ifdef ENABLE_CLASSIC
5464 uint8_t gap_request_role(const bd_addr_t addr, hci_role_t role){
5465     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
5466     if (!conn) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5467     conn->request_role = role;
5468     hci_run();
5469     return ERROR_CODE_SUCCESS;
5470 }
5471 #endif
5472 
5473 #ifdef ENABLE_BLE
5474 
5475 uint8_t gap_le_set_phy(hci_con_handle_t connection_handle, uint8_t all_phys, uint8_t tx_phys, uint8_t rx_phys, uint8_t phy_options){
5476     hci_connection_t * conn = hci_connection_for_handle(connection_handle);
5477     if (!conn) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5478 
5479     conn->le_phy_update_all_phys    = all_phys;
5480     conn->le_phy_update_tx_phys     = tx_phys;
5481     conn->le_phy_update_rx_phys     = rx_phys;
5482     conn->le_phy_update_phy_options = phy_options;
5483 
5484     hci_run();
5485 
5486     return 0;
5487 }
5488 
5489 static uint8_t hci_whitelist_add(bd_addr_type_t address_type, const bd_addr_t address){
5490     // check if already in list
5491     btstack_linked_list_iterator_t it;
5492     btstack_linked_list_iterator_init(&it, &hci_stack->le_whitelist);
5493     while (btstack_linked_list_iterator_has_next(&it)) {
5494         whitelist_entry_t *entry = (whitelist_entry_t *) btstack_linked_list_iterator_next(&it);
5495         if (entry->address_type != address_type) {
5496             continue;
5497         }
5498         if (memcmp(entry->address, address, 6) != 0) {
5499             continue;
5500         }
5501 		// disallow if already scheduled to add
5502 		if ((entry->state & LE_WHITELIST_ADD_TO_CONTROLLER) != 0){
5503 			return ERROR_CODE_COMMAND_DISALLOWED;
5504 		}
5505 		// still on controller, but scheduled to remove -> re-add
5506 		entry->state |= LE_WHITELIST_ADD_TO_CONTROLLER;
5507 		return ERROR_CODE_SUCCESS;
5508     }
5509     // alloc and add to list
5510     whitelist_entry_t * entry = btstack_memory_whitelist_entry_get();
5511     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
5512     entry->address_type = address_type;
5513     (void)memcpy(entry->address, address, 6);
5514     entry->state = LE_WHITELIST_ADD_TO_CONTROLLER;
5515     btstack_linked_list_add(&hci_stack->le_whitelist, (btstack_linked_item_t*) entry);
5516     return ERROR_CODE_SUCCESS;
5517 }
5518 
5519 static uint8_t hci_whitelist_remove(bd_addr_type_t address_type, const bd_addr_t address){
5520     btstack_linked_list_iterator_t it;
5521     btstack_linked_list_iterator_init(&it, &hci_stack->le_whitelist);
5522     while (btstack_linked_list_iterator_has_next(&it)){
5523         whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&it);
5524         if (entry->address_type != address_type) {
5525             continue;
5526         }
5527         if (memcmp(entry->address, address, 6) != 0) {
5528             continue;
5529         }
5530         if (entry->state & LE_WHITELIST_ON_CONTROLLER){
5531             // remove from controller if already present
5532             entry->state |= LE_WHITELIST_REMOVE_FROM_CONTROLLER;
5533         }  else {
5534             // directly remove entry from whitelist
5535             btstack_linked_list_iterator_remove(&it);
5536             btstack_memory_whitelist_entry_free(entry);
5537         }
5538         return ERROR_CODE_SUCCESS;
5539     }
5540     return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5541 }
5542 
5543 static void hci_whitelist_clear(void){
5544     btstack_linked_list_iterator_t it;
5545     btstack_linked_list_iterator_init(&it, &hci_stack->le_whitelist);
5546     while (btstack_linked_list_iterator_has_next(&it)){
5547         whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&it);
5548         if (entry->state & LE_WHITELIST_ON_CONTROLLER){
5549             // remove from controller if already present
5550             entry->state |= LE_WHITELIST_REMOVE_FROM_CONTROLLER;
5551             continue;
5552         }
5553         // directly remove entry from whitelist
5554         btstack_linked_list_iterator_remove(&it);
5555         btstack_memory_whitelist_entry_free(entry);
5556     }
5557 }
5558 
5559 /**
5560  * @brief Clear Whitelist
5561  * @returns 0 if ok
5562  */
5563 uint8_t gap_whitelist_clear(void){
5564     hci_whitelist_clear();
5565     hci_run();
5566     return ERROR_CODE_SUCCESS;
5567 }
5568 
5569 /**
5570  * @brief Add Device to Whitelist
5571  * @param address_typ
5572  * @param address
5573  * @returns 0 if ok
5574  */
5575 uint8_t gap_whitelist_add(bd_addr_type_t address_type, const bd_addr_t address){
5576     uint8_t status = hci_whitelist_add(address_type, address);
5577     if (status){
5578         return status;
5579     }
5580     hci_run();
5581     return ERROR_CODE_SUCCESS;
5582 }
5583 
5584 /**
5585  * @brief Remove Device from Whitelist
5586  * @param address_typ
5587  * @param address
5588  * @returns 0 if ok
5589  */
5590 uint8_t gap_whitelist_remove(bd_addr_type_t address_type, const bd_addr_t address){
5591     uint8_t status = hci_whitelist_remove(address_type, address);
5592     if (status){
5593         return status;
5594     }
5595     hci_run();
5596     return ERROR_CODE_SUCCESS;
5597 }
5598 
5599 #ifdef ENABLE_LE_CENTRAL
5600 /**
5601  *  @brief Connect with Whitelist
5602  *  @note Explicit whitelist management and this connect with whitelist replace deprecated gap_auto_connection_* functions
5603  *  @returns - if ok
5604  */
5605 uint8_t gap_connect_with_whitelist(void){
5606     if (hci_stack->le_connecting_request != LE_CONNECTING_IDLE){
5607         return ERROR_CODE_COMMAND_DISALLOWED;
5608     }
5609     hci_stack->le_connecting_request = LE_CONNECTING_WHITELIST;
5610     hci_run();
5611     return ERROR_CODE_SUCCESS;
5612 }
5613 
5614 /**
5615  * @brief Auto Connection Establishment - Start Connecting to device
5616  * @param address_typ
5617  * @param address
5618  * @returns 0 if ok
5619  */
5620 uint8_t gap_auto_connection_start(bd_addr_type_t address_type, const bd_addr_t address){
5621     if (hci_stack->le_connecting_request == LE_CONNECTING_DIRECT){
5622         return ERROR_CODE_COMMAND_DISALLOWED;
5623     }
5624 
5625     uint8_t status = hci_whitelist_add(address_type, address);
5626     if (status == BTSTACK_MEMORY_ALLOC_FAILED) {
5627         return status;
5628     }
5629 
5630     hci_stack->le_connecting_request = LE_CONNECTING_WHITELIST;
5631 
5632     hci_run();
5633     return ERROR_CODE_SUCCESS;
5634 }
5635 
5636 /**
5637  * @brief Auto Connection Establishment - Stop Connecting to device
5638  * @param address_typ
5639  * @param address
5640  * @returns 0 if ok
5641  */
5642 uint8_t gap_auto_connection_stop(bd_addr_type_t address_type, const bd_addr_t address){
5643     if (hci_stack->le_connecting_request == LE_CONNECTING_DIRECT){
5644         return ERROR_CODE_COMMAND_DISALLOWED;
5645     }
5646 
5647     hci_whitelist_remove(address_type, address);
5648     if (btstack_linked_list_empty(&hci_stack->le_whitelist)){
5649         hci_stack->le_connecting_request = LE_CONNECTING_IDLE;
5650     }
5651     hci_run();
5652     return 0;
5653 }
5654 
5655 /**
5656  * @brief Auto Connection Establishment - Stop everything
5657  * @note  Convenience function to stop all active auto connection attempts
5658  */
5659 uint8_t gap_auto_connection_stop_all(void){
5660     if (hci_stack->le_connecting_request == LE_CONNECTING_DIRECT) {
5661         return ERROR_CODE_COMMAND_DISALLOWED;
5662     }
5663     hci_whitelist_clear();
5664     hci_stack->le_connecting_request = LE_CONNECTING_IDLE;
5665     hci_run();
5666     return ERROR_CODE_SUCCESS;
5667 }
5668 
5669 uint16_t gap_le_connection_interval(hci_con_handle_t connection_handle){
5670     hci_connection_t * conn = hci_connection_for_handle(connection_handle);
5671     if (!conn) return 0;
5672     return conn->le_connection_interval;
5673 }
5674 #endif
5675 #endif
5676 
5677 #ifdef ENABLE_CLASSIC
5678 /**
5679  * @brief Set Extended Inquiry Response data
5680  * @param eir_data size HCI_EXTENDED_INQUIRY_RESPONSE_DATA_LEN (240) bytes, is not copied make sure memory is accessible during stack startup
5681  * @note has to be done before stack starts up
5682  */
5683 void gap_set_extended_inquiry_response(const uint8_t * data){
5684     hci_stack->eir_data = data;
5685 }
5686 
5687 /**
5688  * @brief Start GAP Classic Inquiry
5689  * @param duration in 1.28s units
5690  * @return 0 if ok
5691  * @events: GAP_EVENT_INQUIRY_RESULT, GAP_EVENT_INQUIRY_COMPLETE
5692  */
5693 int gap_inquiry_start(uint8_t duration_in_1280ms_units){
5694     if (hci_stack->state != HCI_STATE_WORKING) return ERROR_CODE_COMMAND_DISALLOWED;
5695     if (hci_stack->inquiry_state != GAP_INQUIRY_STATE_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
5696     if ((duration_in_1280ms_units < GAP_INQUIRY_DURATION_MIN) || (duration_in_1280ms_units > GAP_INQUIRY_DURATION_MAX)){
5697         return ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
5698     }
5699     hci_stack->inquiry_state = duration_in_1280ms_units;
5700     hci_run();
5701     return 0;
5702 }
5703 
5704 /**
5705  * @brief Stop GAP Classic Inquiry
5706  * @returns 0 if ok
5707  */
5708 int gap_inquiry_stop(void){
5709     if ((hci_stack->inquiry_state >= GAP_INQUIRY_DURATION_MIN) && (hci_stack->inquiry_state <= GAP_INQUIRY_DURATION_MAX)) {
5710         // emit inquiry complete event, before it even started
5711         uint8_t event[] = { GAP_EVENT_INQUIRY_COMPLETE, 1, 0};
5712         hci_emit_event(event, sizeof(event), 1);
5713         return 0;
5714     }
5715     if (hci_stack->inquiry_state != GAP_INQUIRY_STATE_ACTIVE) return ERROR_CODE_COMMAND_DISALLOWED;
5716     hci_stack->inquiry_state = GAP_INQUIRY_STATE_W2_CANCEL;
5717     hci_run();
5718     return 0;
5719 }
5720 
5721 
5722 /**
5723  * @brief Remote Name Request
5724  * @param addr
5725  * @param page_scan_repetition_mode
5726  * @param clock_offset only used when bit 15 is set
5727  * @events: HCI_EVENT_REMOTE_NAME_REQUEST_COMPLETE
5728  */
5729 int gap_remote_name_request(const bd_addr_t addr, uint8_t page_scan_repetition_mode, uint16_t clock_offset){
5730     if (hci_stack->remote_name_state != GAP_REMOTE_NAME_STATE_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
5731     (void)memcpy(hci_stack->remote_name_addr, addr, 6);
5732     hci_stack->remote_name_page_scan_repetition_mode = page_scan_repetition_mode;
5733     hci_stack->remote_name_clock_offset = clock_offset;
5734     hci_stack->remote_name_state = GAP_REMOTE_NAME_STATE_W2_SEND;
5735     hci_run();
5736     return 0;
5737 }
5738 
5739 static int gap_pairing_set_state_and_run(const bd_addr_t addr, uint8_t state){
5740     hci_stack->gap_pairing_state = state;
5741     (void)memcpy(hci_stack->gap_pairing_addr, addr, 6);
5742     hci_run();
5743     return 0;
5744 }
5745 
5746 /**
5747  * @brief Legacy Pairing Pin Code Response for binary data / non-strings
5748  * @param addr
5749  * @param pin_data
5750  * @param pin_len
5751  * @return 0 if ok
5752  */
5753 int gap_pin_code_response_binary(const bd_addr_t addr, const uint8_t * pin_data, uint8_t pin_len){
5754     if (hci_stack->gap_pairing_state != GAP_PAIRING_STATE_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
5755     hci_stack->gap_pairing_input.gap_pairing_pin = pin_data;
5756     hci_stack->gap_pairing_pin_len = pin_len;
5757     return gap_pairing_set_state_and_run(addr, GAP_PAIRING_STATE_SEND_PIN);
5758 }
5759 
5760 /**
5761  * @brief Legacy Pairing Pin Code Response
5762  * @param addr
5763  * @param pin
5764  * @return 0 if ok
5765  */
5766 int gap_pin_code_response(const bd_addr_t addr, const char * pin){
5767     return gap_pin_code_response_binary(addr, (const uint8_t*) pin, strlen(pin));
5768 }
5769 
5770 /**
5771  * @brief Abort Legacy Pairing
5772  * @param addr
5773  * @param pin
5774  * @return 0 if ok
5775  */
5776 int gap_pin_code_negative(bd_addr_t addr){
5777     if (hci_stack->gap_pairing_state != GAP_PAIRING_STATE_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
5778     return gap_pairing_set_state_and_run(addr, GAP_PAIRING_STATE_SEND_PIN_NEGATIVE);
5779 }
5780 
5781 /**
5782  * @brief SSP Passkey Response
5783  * @param addr
5784  * @param passkey
5785  * @return 0 if ok
5786  */
5787 int gap_ssp_passkey_response(const bd_addr_t addr, uint32_t passkey){
5788     if (hci_stack->gap_pairing_state != GAP_PAIRING_STATE_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
5789     hci_stack->gap_pairing_input.gap_pairing_passkey = passkey;
5790     return gap_pairing_set_state_and_run(addr, GAP_PAIRING_STATE_SEND_PASSKEY);
5791 }
5792 
5793 /**
5794  * @brief Abort SSP Passkey Entry/Pairing
5795  * @param addr
5796  * @param pin
5797  * @return 0 if ok
5798  */
5799 int gap_ssp_passkey_negative(const bd_addr_t addr){
5800     if (hci_stack->gap_pairing_state != GAP_PAIRING_STATE_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
5801     return gap_pairing_set_state_and_run(addr, GAP_PAIRING_STATE_SEND_PASSKEY_NEGATIVE);
5802 }
5803 
5804 /**
5805  * @brief Accept SSP Numeric Comparison
5806  * @param addr
5807  * @param passkey
5808  * @return 0 if ok
5809  */
5810 int gap_ssp_confirmation_response(const bd_addr_t addr){
5811     if (hci_stack->gap_pairing_state != GAP_PAIRING_STATE_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
5812     return gap_pairing_set_state_and_run(addr, GAP_PAIRING_STATE_SEND_CONFIRMATION);
5813 }
5814 
5815 /**
5816  * @brief Abort SSP Numeric Comparison/Pairing
5817  * @param addr
5818  * @param pin
5819  * @return 0 if ok
5820  */
5821 int gap_ssp_confirmation_negative(const bd_addr_t addr){
5822     if (hci_stack->gap_pairing_state != GAP_PAIRING_STATE_IDLE) return ERROR_CODE_COMMAND_DISALLOWED;
5823     return gap_pairing_set_state_and_run(addr, GAP_PAIRING_STATE_SEND_CONFIRMATION_NEGATIVE);
5824 }
5825 
5826 /**
5827  * @brief Set inquiry mode: standard, with RSSI, with RSSI + Extended Inquiry Results. Has to be called before power on.
5828  * @param inquiry_mode see bluetooth_defines.h
5829  */
5830 void hci_set_inquiry_mode(inquiry_mode_t mode){
5831     hci_stack->inquiry_mode = mode;
5832 }
5833 
5834 /**
5835  * @brief Configure Voice Setting for use with SCO data in HSP/HFP
5836  */
5837 void hci_set_sco_voice_setting(uint16_t voice_setting){
5838     hci_stack->sco_voice_setting = voice_setting;
5839 }
5840 
5841 /**
5842  * @brief Get SCO Voice Setting
5843  * @return current voice setting
5844  */
5845 uint16_t hci_get_sco_voice_setting(void){
5846     return hci_stack->sco_voice_setting;
5847 }
5848 
5849 static int hci_have_usb_transport(void){
5850     if (!hci_stack->hci_transport) return 0;
5851     const char * transport_name = hci_stack->hci_transport->name;
5852     if (!transport_name) return 0;
5853     return (transport_name[0] == 'H') && (transport_name[1] == '2');
5854 }
5855 
5856 /** @brief Get SCO packet length for current SCO Voice setting
5857  *  @note  Using SCO packets of the exact length is required for USB transfer
5858  *  @return Length of SCO packets in bytes (not audio frames)
5859  */
5860 int hci_get_sco_packet_length(void){
5861     int sco_packet_length = 0;
5862 
5863 #ifdef ENABLE_SCO_OVER_HCI
5864 
5865     // Transparent = mSBC => 1, CVSD with 16-bit samples requires twice as much bytes
5866     int multiplier = ((hci_stack->sco_voice_setting_active & 0x03) == 0x03) ? 1 : 2;
5867 
5868     if (hci_have_usb_transport()){
5869         // see Core Spec for H2 USB Transfer.
5870         // 3 byte SCO header + 24 bytes per connection
5871         int num_sco_connections = btstack_max(1, hci_number_sco_connections());
5872         sco_packet_length = 3 + 24 * num_sco_connections * multiplier;
5873     } else {
5874         // 3 byte SCO header + SCO packet size over the air (60 bytes)
5875         sco_packet_length = 3 + 60 * multiplier;
5876         // assert that it still fits inside an SCO buffer
5877         if (sco_packet_length > hci_stack->sco_data_packet_length){
5878             sco_packet_length = 3 + 60;
5879         }
5880     }
5881 #endif
5882     return sco_packet_length;
5883 }
5884 
5885 /**
5886 * @brief Sets the master/slave policy
5887 * @param policy (0: attempt to become master, 1: let connecting device decide)
5888 */
5889 void hci_set_master_slave_policy(uint8_t policy){
5890     hci_stack->master_slave_policy = policy;
5891 }
5892 
5893 #endif
5894 
5895 HCI_STATE hci_get_state(void){
5896     return hci_stack->state;
5897 }
5898 
5899 #ifdef ENABLE_CLASSIC
5900 void gap_register_classic_connection_filter(int (*accept_callback)(bd_addr_t addr)){
5901     hci_stack->gap_classic_accept_callback = accept_callback;
5902 }
5903 #endif
5904 
5905 /**
5906  * @brief Set callback for Bluetooth Hardware Error
5907  */
5908 void hci_set_hardware_error_callback(void (*fn)(uint8_t error)){
5909     hci_stack->hardware_error_callback = fn;
5910 }
5911 
5912 void hci_disconnect_all(void){
5913     btstack_linked_list_iterator_t it;
5914     btstack_linked_list_iterator_init(&it, &hci_stack->connections);
5915     while (btstack_linked_list_iterator_has_next(&it)){
5916         hci_connection_t * con = (hci_connection_t*) btstack_linked_list_iterator_next(&it);
5917         if (con->state == SENT_DISCONNECT) continue;
5918         con->state = SEND_DISCONNECT;
5919     }
5920     hci_run();
5921 }
5922 
5923 uint16_t hci_get_manufacturer(void){
5924     return hci_stack->manufacturer;
5925 }
5926 
5927 #ifdef ENABLE_BLE
5928 
5929 static sm_connection_t * sm_get_connection_for_handle(hci_con_handle_t con_handle){
5930     hci_connection_t * hci_con = hci_connection_for_handle(con_handle);
5931     if (!hci_con) return NULL;
5932     return &hci_con->sm_connection;
5933 }
5934 
5935 // extracted from sm.c to allow enabling of l2cap le data channels without adding sm.c to the build
5936 // without sm.c default values from create_connection_for_bd_addr_and_type() resulg in non-encrypted, not-authenticated
5937 
5938 int gap_encryption_key_size(hci_con_handle_t con_handle){
5939     hci_connection_t * hci_connection = hci_connection_for_handle(con_handle);
5940     if (hci_connection == NULL) return 0;
5941     if (hci_is_le_connection(hci_connection)){
5942         sm_connection_t * sm_conn = &hci_connection->sm_connection;
5943         if (sm_conn->sm_connection_encrypted) {
5944             return sm_conn->sm_actual_encryption_key_size;
5945         }
5946     }
5947 #ifdef ENABLE_CLASSIC
5948     else {
5949         if ((hci_connection->authentication_flags & CONNECTION_ENCRYPTED)){
5950             return hci_connection->encryption_key_size;
5951         }
5952     }
5953 #endif
5954     return 0;
5955 }
5956 
5957 int gap_authenticated(hci_con_handle_t con_handle){
5958     hci_connection_t * hci_connection = hci_connection_for_handle(con_handle);
5959     if (hci_connection == NULL) return 0;
5960 
5961     switch (hci_connection->address_type){
5962         case BD_ADDR_TYPE_LE_PUBLIC:
5963         case BD_ADDR_TYPE_LE_RANDOM:
5964             if (hci_connection->sm_connection.sm_connection_encrypted == 0) return 0; // unencrypted connection cannot be authenticated
5965             return hci_connection->sm_connection.sm_connection_authenticated;
5966 #ifdef ENABLE_CLASSIC
5967         case BD_ADDR_TYPE_SCO:
5968         case BD_ADDR_TYPE_ACL:
5969             return gap_authenticated_for_link_key_type(hci_connection->link_key_type);
5970 #endif
5971         default:
5972             return 0;
5973     }
5974 }
5975 
5976 int gap_secure_connection(hci_con_handle_t con_handle){
5977     hci_connection_t * hci_connection = hci_connection_for_handle(con_handle);
5978     if (hci_connection == NULL) return 0;
5979 
5980     switch (hci_connection->address_type){
5981         case BD_ADDR_TYPE_LE_PUBLIC:
5982         case BD_ADDR_TYPE_LE_RANDOM:
5983             if (hci_connection->sm_connection.sm_connection_encrypted == 0) return 0; // unencrypted connection cannot be authenticated
5984             return hci_connection->sm_connection.sm_connection_sc;
5985 #ifdef ENABLE_CLASSIC
5986         case BD_ADDR_TYPE_SCO:
5987         case BD_ADDR_TYPE_ACL:
5988             return gap_secure_connection_for_link_key_type(hci_connection->link_key_type);
5989 #endif
5990         default:
5991             return 0;
5992     }
5993 }
5994 
5995 bool gap_bonded(hci_con_handle_t con_handle){
5996 	hci_connection_t * hci_connection = hci_connection_for_handle(con_handle);
5997 	if (hci_connection == NULL) return 0;
5998 
5999 #ifdef ENABLE_CLASSIC
6000 	link_key_t link_key;
6001 	link_key_type_t link_key_type;
6002 #endif
6003 	switch (hci_connection->address_type){
6004 		case BD_ADDR_TYPE_LE_PUBLIC:
6005 		case BD_ADDR_TYPE_LE_RANDOM:
6006 			return hci_connection->sm_connection.sm_le_db_index >= 0;
6007 #ifdef ENABLE_CLASSIC
6008 		case BD_ADDR_TYPE_SCO:
6009 		case BD_ADDR_TYPE_ACL:
6010 			return hci_stack->link_key_db && hci_stack->link_key_db->get_link_key(hci_connection->address, link_key, &link_key_type);
6011 #endif
6012 		default:
6013 			return false;
6014 	}
6015 }
6016 
6017 
6018 authorization_state_t gap_authorization_state(hci_con_handle_t con_handle){
6019     sm_connection_t * sm_conn = sm_get_connection_for_handle(con_handle);
6020     if (!sm_conn) return AUTHORIZATION_UNKNOWN;     // wrong connection
6021     if (!sm_conn->sm_connection_encrypted)               return AUTHORIZATION_UNKNOWN; // unencrypted connection cannot be authorized
6022     if (!sm_conn->sm_connection_authenticated)           return AUTHORIZATION_UNKNOWN; // unauthenticatd connection cannot be authorized
6023     return sm_conn->sm_connection_authorization_state;
6024 }
6025 #endif
6026 
6027 #ifdef ENABLE_CLASSIC
6028 uint8_t gap_sniff_mode_enter(hci_con_handle_t con_handle, uint16_t sniff_min_interval, uint16_t sniff_max_interval, uint16_t sniff_attempt, uint16_t sniff_timeout){
6029     hci_connection_t * conn = hci_connection_for_handle(con_handle);
6030     if (!conn) return GAP_CONNECTION_INVALID;
6031     conn->sniff_min_interval = sniff_min_interval;
6032     conn->sniff_max_interval = sniff_max_interval;
6033     conn->sniff_attempt = sniff_attempt;
6034     conn->sniff_timeout = sniff_timeout;
6035     hci_run();
6036     return 0;
6037 }
6038 
6039 /**
6040  * @brief Exit Sniff mode
6041  * @param con_handle
6042  @ @return 0 if ok
6043  */
6044 uint8_t gap_sniff_mode_exit(hci_con_handle_t con_handle){
6045     hci_connection_t * conn = hci_connection_for_handle(con_handle);
6046     if (!conn) return GAP_CONNECTION_INVALID;
6047     conn->sniff_min_interval = 0xffff;
6048     hci_run();
6049     return 0;
6050 }
6051 #endif
6052 
6053 void hci_halting_defer(void){
6054     if (hci_stack->state != HCI_STATE_HALTING) return;
6055     switch (hci_stack->substate){
6056         case HCI_HALTING_DISCONNECT_ALL_NO_TIMER:
6057         case HCI_HALTING_CLOSE:
6058             hci_stack->substate = HCI_HALTING_DISCONNECT_ALL_TIMER;
6059             break;
6060         default:
6061             break;
6062     }
6063 }
6064 
6065 #ifdef ENABLE_LE_PRIVACY_ADDRESS_RESOLUTION
6066 void hci_load_le_device_db_entry_into_resolving_list(uint16_t le_device_db_index){
6067     if (le_device_db_index >= MAX_NUM_RESOLVING_LIST_ENTRIES) return;
6068     if (le_device_db_index >= le_device_db_max_count()) return;
6069     uint8_t offset = le_device_db_index >> 3;
6070     uint8_t mask = 1 << (le_device_db_index & 7);
6071     hci_stack->le_resolving_list_add_entries[offset] |= mask;
6072     if (hci_stack->le_resolving_list_state == LE_RESOLVING_LIST_DONE){
6073     	// note: go back to remove entries, otherwise, a remove + add will skip the add
6074         hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_REMOVE_ENTRIES;
6075     }
6076 }
6077 
6078 void hci_remove_le_device_db_entry_from_resolving_list(uint16_t le_device_db_index){
6079 	if (le_device_db_index >= MAX_NUM_RESOLVING_LIST_ENTRIES) return;
6080 	if (le_device_db_index >= le_device_db_max_count()) return;
6081 	uint8_t offset = le_device_db_index >> 3;
6082 	uint8_t mask = 1 << (le_device_db_index & 7);
6083 	hci_stack->le_resolving_list_remove_entries[offset] |= mask;
6084 	if (hci_stack->le_resolving_list_state == LE_RESOLVING_LIST_DONE){
6085 		hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_REMOVE_ENTRIES;
6086 	}
6087 }
6088 
6089 uint8_t gap_load_resolving_list_from_le_device_db(void){
6090 	if ((hci_stack->local_supported_commands[1] & (1 << 2)) == 0) {
6091 		return ERROR_CODE_UNSUPPORTED_FEATURE_OR_PARAMETER_VALUE;
6092 	}
6093 	if (hci_stack->le_resolving_list_state != LE_RESOLVING_LIST_SEND_ENABLE_ADDRESS_RESOLUTION){
6094 		// restart le resolving list update
6095 		hci_stack->le_resolving_list_state = LE_RESOLVING_LIST_READ_SIZE;
6096 	}
6097 	return ERROR_CODE_SUCCESS;
6098 }
6099 #endif
6100 
6101 #ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
6102 void hci_setup_test_connections_fuzz(void){
6103     hci_connection_t * conn;
6104 
6105     // default address: 66:55:44:33:00:01
6106     bd_addr_t addr = { 0x66, 0x55, 0x44, 0x33, 0x00, 0x00};
6107 
6108     // setup Controller info
6109     hci_stack->num_cmd_packets = 255;
6110     hci_stack->acl_packets_total_num = 255;
6111 
6112     // setup incoming Classic ACL connection with con handle 0x0001, 66:55:44:33:22:01
6113     addr[5] = 0x01;
6114     conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
6115     conn->con_handle = addr[5];
6116     conn->role  = HCI_ROLE_SLAVE;
6117     conn->state = RECEIVED_CONNECTION_REQUEST;
6118     conn->sm_connection.sm_role = HCI_ROLE_SLAVE;
6119 
6120     // setup incoming Classic SCO connection with con handle 0x0002
6121     addr[5] = 0x02;
6122     conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_SCO);
6123     conn->con_handle = addr[5];
6124     conn->role  = HCI_ROLE_SLAVE;
6125     conn->state = RECEIVED_CONNECTION_REQUEST;
6126     conn->sm_connection.sm_role = HCI_ROLE_SLAVE;
6127 
6128     // setup ready Classic ACL connection with con handle 0x0003
6129     addr[5] = 0x03;
6130     conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_ACL);
6131     conn->con_handle = addr[5];
6132     conn->role  = HCI_ROLE_SLAVE;
6133     conn->state = OPEN;
6134     conn->sm_connection.sm_role = HCI_ROLE_SLAVE;
6135 
6136     // setup ready Classic SCO connection with con handle 0x0004
6137     addr[5] = 0x04;
6138     conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_SCO);
6139     conn->con_handle = addr[5];
6140     conn->role  = HCI_ROLE_SLAVE;
6141     conn->state = OPEN;
6142     conn->sm_connection.sm_role = HCI_ROLE_SLAVE;
6143 
6144     // setup ready LE ACL connection with con handle 0x005 and public address
6145     addr[5] = 0x05;
6146     conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_LE_PUBLIC);
6147     conn->con_handle = addr[5];
6148     conn->role  = HCI_ROLE_SLAVE;
6149     conn->state = OPEN;
6150     conn->sm_connection.sm_role = HCI_ROLE_SLAVE;
6151 }
6152 
6153 void hci_free_connections_fuzz(void){
6154     btstack_linked_list_iterator_t it;
6155     btstack_linked_list_iterator_init(&it, &hci_stack->connections);
6156     while (btstack_linked_list_iterator_has_next(&it)){
6157         hci_connection_t * con = (hci_connection_t*) btstack_linked_list_iterator_next(&it);
6158         btstack_linked_list_iterator_remove(&it);
6159         btstack_memory_hci_connection_free(con);
6160     }
6161 }
6162 void hci_simulate_working_fuzz(void){
6163     hci_init_done();
6164     hci_stack->num_cmd_packets = 255;
6165 }
6166 #endif
6167