xref: /btstack/src/hci.c (revision ac9c45e03c55070855f57d1c4fd0c70e74e1bad5)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 /*
39  *  hci.c
40  *
41  *  Created by Matthias Ringwald on 4/29/09.
42  *
43  */
44 
45 #include "btstack-config.h"
46 
47 #include "hci.h"
48 #include "gap.h"
49 
50 #ifdef HAVE_BLE
51 #include "gap_le.h"
52 #endif
53 
54 #include <stdarg.h>
55 #include <string.h>
56 #include <stdio.h>
57 
58 #ifndef EMBEDDED
59 #ifdef _WIN32
60 #include "Winsock2.h"
61 #else
62 #include <unistd.h> // gethostbyname
63 #endif
64 #include <btstack/version.h>
65 #endif
66 
67 #include "btstack_memory.h"
68 #include "debug.h"
69 #include "hci_dump.h"
70 
71 #include <btstack/linked_list.h>
72 #include <btstack/hci_cmds.h>
73 
74 #define HCI_CONNECTION_TIMEOUT_MS 10000
75 
76 #ifdef USE_BLUETOOL
77 #include "../platforms/ios/src/bt_control_iphone.h"
78 #endif
79 
80 static void hci_update_scan_enable(void);
81 static gap_security_level_t gap_security_level_for_connection(hci_connection_t * connection);
82 static void hci_connection_timeout_handler(timer_source_t *timer);
83 static void hci_connection_timestamp(hci_connection_t *connection);
84 static int  hci_power_control_on(void);
85 static void hci_power_control_off(void);
86 static void hci_state_reset(void);
87 
88 // the STACK is here
89 #ifndef HAVE_MALLOC
90 static hci_stack_t   hci_stack_static;
91 #endif
92 static hci_stack_t * hci_stack = NULL;
93 
94 // test helper
95 static uint8_t disable_l2cap_timeouts = 0;
96 
97 /**
98  * create connection for given address
99  *
100  * @return connection OR NULL, if no memory left
101  */
102 static hci_connection_t * create_connection_for_bd_addr_and_type(bd_addr_t addr, bd_addr_type_t addr_type){
103     log_info("create_connection_for_addr %s, type %x", bd_addr_to_str(addr), addr_type);
104     hci_connection_t * conn = btstack_memory_hci_connection_get();
105     if (!conn) return NULL;
106     memset(conn, 0, sizeof(hci_connection_t));
107     BD_ADDR_COPY(conn->address, addr);
108     conn->address_type = addr_type;
109     conn->con_handle = 0xffff;
110     conn->authentication_flags = AUTH_FLAGS_NONE;
111     conn->bonding_flags = 0;
112     conn->requested_security_level = LEVEL_0;
113     linked_item_set_user(&conn->timeout.item, conn);
114     conn->timeout.process = hci_connection_timeout_handler;
115     hci_connection_timestamp(conn);
116     conn->acl_recombination_length = 0;
117     conn->acl_recombination_pos = 0;
118     conn->num_acl_packets_sent = 0;
119     conn->num_sco_packets_sent = 0;
120     conn->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
121     linked_list_add(&hci_stack->connections, (linked_item_t *) conn);
122     return conn;
123 }
124 
125 
126 /**
127  * get le connection parameter range
128 *
129  * @return le connection parameter range struct
130  */
131 le_connection_parameter_range_t gap_le_get_connection_parameter_range(void){
132     return hci_stack->le_connection_parameter_range;
133 }
134 
135 /**
136  * set le connection parameter range
137  *
138  */
139 
140 void gap_le_set_connection_parameter_range(le_connection_parameter_range_t range){
141     hci_stack->le_connection_parameter_range.le_conn_interval_min = range.le_conn_interval_min;
142     hci_stack->le_connection_parameter_range.le_conn_interval_max = range.le_conn_interval_max;
143     hci_stack->le_connection_parameter_range.le_conn_interval_min = range.le_conn_latency_min;
144     hci_stack->le_connection_parameter_range.le_conn_interval_max = range.le_conn_latency_max;
145     hci_stack->le_connection_parameter_range.le_supervision_timeout_min = range.le_supervision_timeout_min;
146     hci_stack->le_connection_parameter_range.le_supervision_timeout_max = range.le_supervision_timeout_max;
147 }
148 
149 /**
150  * get hci connections iterator
151  *
152  * @return hci connections iterator
153  */
154 
155 void hci_connections_get_iterator(linked_list_iterator_t *it){
156     linked_list_iterator_init(it, &hci_stack->connections);
157 }
158 
159 /**
160  * get connection for a given handle
161  *
162  * @return connection OR NULL, if not found
163  */
164 hci_connection_t * hci_connection_for_handle(hci_con_handle_t con_handle){
165     linked_list_iterator_t it;
166     linked_list_iterator_init(&it, &hci_stack->connections);
167     while (linked_list_iterator_has_next(&it)){
168         hci_connection_t * item = (hci_connection_t *) linked_list_iterator_next(&it);
169         if ( item->con_handle == con_handle ) {
170             return item;
171         }
172     }
173     return NULL;
174 }
175 
176 /**
177  * get connection for given address
178  *
179  * @return connection OR NULL, if not found
180  */
181 hci_connection_t * hci_connection_for_bd_addr_and_type(bd_addr_t  addr, bd_addr_type_t addr_type){
182     linked_list_iterator_t it;
183     linked_list_iterator_init(&it, &hci_stack->connections);
184     while (linked_list_iterator_has_next(&it)){
185         hci_connection_t * connection = (hci_connection_t *) linked_list_iterator_next(&it);
186         if (connection->address_type != addr_type)  continue;
187         if (memcmp(addr, connection->address, 6) != 0) continue;
188         return connection;
189     }
190     return NULL;
191 }
192 
193 static void hci_connection_timeout_handler(timer_source_t *timer){
194     hci_connection_t * connection = (hci_connection_t *) linked_item_get_user(&timer->item);
195 #ifdef HAVE_TIME
196     struct timeval tv;
197     gettimeofday(&tv, NULL);
198     if (tv.tv_sec >= connection->timestamp.tv_sec + HCI_CONNECTION_TIMEOUT_MS/1000) {
199         // connections might be timed out
200         hci_emit_l2cap_check_timeout(connection);
201     }
202 #endif
203 #ifdef HAVE_TICK
204     if (embedded_get_ticks() > connection->timestamp + embedded_ticks_for_ms(HCI_CONNECTION_TIMEOUT_MS)){
205         // connections might be timed out
206         hci_emit_l2cap_check_timeout(connection);
207     }
208 #endif
209     run_loop_set_timer(timer, HCI_CONNECTION_TIMEOUT_MS);
210     run_loop_add_timer(timer);
211 }
212 
213 static void hci_connection_timestamp(hci_connection_t *connection){
214 #ifdef HAVE_TIME
215     gettimeofday(&connection->timestamp, NULL);
216 #endif
217 #ifdef HAVE_TICK
218     connection->timestamp = embedded_get_ticks();
219 #endif
220 }
221 
222 
223 inline static void connectionSetAuthenticationFlags(hci_connection_t * conn, hci_authentication_flags_t flags){
224     conn->authentication_flags = (hci_authentication_flags_t)(conn->authentication_flags | flags);
225 }
226 
227 inline static void connectionClearAuthenticationFlags(hci_connection_t * conn, hci_authentication_flags_t flags){
228     conn->authentication_flags = (hci_authentication_flags_t)(conn->authentication_flags & ~flags);
229 }
230 
231 
232 /**
233  * add authentication flags and reset timer
234  * @note: assumes classic connection
235  * @note: bd_addr is passed in as litle endian uint8_t * as it is called from parsing packets
236  */
237 static void hci_add_connection_flags_for_flipped_bd_addr(uint8_t *bd_addr, hci_authentication_flags_t flags){
238     bd_addr_t addr;
239     bt_flip_addr(addr, bd_addr);
240     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
241     if (conn) {
242         connectionSetAuthenticationFlags(conn, flags);
243         hci_connection_timestamp(conn);
244     }
245 }
246 
247 int  hci_authentication_active_for_handle(hci_con_handle_t handle){
248     hci_connection_t * conn = hci_connection_for_handle(handle);
249     if (!conn) return 0;
250     if (conn->authentication_flags & LEGACY_PAIRING_ACTIVE) return 1;
251     if (conn->authentication_flags & SSP_PAIRING_ACTIVE) return 1;
252     return 0;
253 }
254 
255 void hci_drop_link_key_for_bd_addr(bd_addr_t addr){
256     if (hci_stack->remote_device_db) {
257         hci_stack->remote_device_db->delete_link_key(addr);
258     }
259 }
260 
261 int hci_is_le_connection(hci_connection_t * connection){
262     return  connection->address_type == BD_ADDR_TYPE_LE_PUBLIC ||
263     connection->address_type == BD_ADDR_TYPE_LE_RANDOM;
264 }
265 
266 
267 /**
268  * count connections
269  */
270 static int nr_hci_connections(void){
271     int count = 0;
272     linked_item_t *it;
273     for (it = (linked_item_t *) hci_stack->connections; it ; it = it->next, count++);
274     return count;
275 }
276 
277 /**
278  * Dummy handler called by HCI
279  */
280 static void dummy_handler(uint8_t packet_type, uint8_t *packet, uint16_t size){
281 }
282 
283 uint8_t hci_number_outgoing_packets(hci_con_handle_t handle){
284     hci_connection_t * connection = hci_connection_for_handle(handle);
285     if (!connection) {
286         log_error("hci_number_outgoing_packets: connection for handle %u does not exist!", handle);
287         return 0;
288     }
289     return connection->num_acl_packets_sent;
290 }
291 
292 uint8_t hci_number_free_acl_slots_for_handle(hci_con_handle_t con_handle){
293 
294     int num_packets_sent_classic = 0;
295     int num_packets_sent_le = 0;
296 
297     bd_addr_type_t address_type = BD_ADDR_TYPE_UNKNOWN;
298 
299     linked_item_t *it;
300     for (it = (linked_item_t *) hci_stack->connections; it ; it = it->next){
301         hci_connection_t * connection = (hci_connection_t *) it;
302         if (connection->address_type == BD_ADDR_TYPE_CLASSIC){
303             num_packets_sent_classic += connection->num_acl_packets_sent;
304         } else {
305             num_packets_sent_le += connection->num_acl_packets_sent;
306         }
307         // ignore connections that are not open, e.g., in state RECEIVED_DISCONNECTION_COMPLETE
308         if (connection->con_handle == con_handle && connection->state == OPEN){
309             address_type = connection->address_type;
310         }
311     }
312 
313     int free_slots_classic = hci_stack->acl_packets_total_num - num_packets_sent_classic;
314     int free_slots_le = 0;
315 
316     if (free_slots_classic < 0){
317         log_error("hci_number_free_acl_slots: outgoing classic packets (%u) > total classic packets (%u)", num_packets_sent_classic, hci_stack->acl_packets_total_num);
318         return 0;
319     }
320 
321     if (hci_stack->le_acl_packets_total_num){
322         // if we have LE slots, they are used
323         free_slots_le = hci_stack->le_acl_packets_total_num - num_packets_sent_le;
324         if (free_slots_le < 0){
325             log_error("hci_number_free_acl_slots: outgoing le packets (%u) > total le packets (%u)", num_packets_sent_le, hci_stack->le_acl_packets_total_num);
326             return 0;
327         }
328     } else {
329         // otherwise, classic slots are used for LE, too
330         free_slots_classic -= num_packets_sent_le;
331         if (free_slots_classic < 0){
332             log_error("hci_number_free_acl_slots: outgoing classic + le packets (%u + %u) > total packets (%u)", num_packets_sent_classic, num_packets_sent_le, hci_stack->acl_packets_total_num);
333             return 0;
334         }
335     }
336 
337     switch (address_type){
338         case BD_ADDR_TYPE_UNKNOWN:
339             log_error("hci_number_free_acl_slots: handle 0x%04x not in connection list", con_handle);
340             return 0;
341 
342         case BD_ADDR_TYPE_CLASSIC:
343             return free_slots_classic;
344 
345         default:
346            if (hci_stack->le_acl_packets_total_num){
347                return free_slots_le;
348            }
349            return free_slots_classic;
350     }
351 }
352 
353 int hci_number_free_sco_slots_for_handle(hci_con_handle_t handle){
354     int num_sco_packets_sent = 0;
355     linked_item_t *it;
356     for (it = (linked_item_t *) hci_stack->connections; it ; it = it->next){
357         hci_connection_t * connection = (hci_connection_t *) it;
358         num_sco_packets_sent += connection->num_sco_packets_sent;
359     }
360     if (num_sco_packets_sent > hci_stack->sco_packets_total_num){
361         log_info("hci_number_free_sco_slots_for_handle: outgoing packets (%u) > total packets (%u)", num_sco_packets_sent, hci_stack->sco_packets_total_num);
362         return 0;
363     }
364     return hci_stack->sco_packets_total_num - num_sco_packets_sent;
365 }
366 
367 // new functions replacing hci_can_send_packet_now[_using_packet_buffer]
368 int hci_can_send_command_packet_now(void){
369     if (hci_stack->hci_packet_buffer_reserved) return 0;
370 
371     // check for async hci transport implementations
372     if (hci_stack->hci_transport->can_send_packet_now){
373         if (!hci_stack->hci_transport->can_send_packet_now(HCI_COMMAND_DATA_PACKET)){
374             return 0;
375         }
376     }
377 
378     return hci_stack->num_cmd_packets > 0;
379 }
380 
381 int hci_can_send_prepared_acl_packet_now(hci_con_handle_t con_handle) {
382     // check for async hci transport implementations
383     if (hci_stack->hci_transport->can_send_packet_now){
384         if (!hci_stack->hci_transport->can_send_packet_now(HCI_ACL_DATA_PACKET)){
385             return 0;
386         }
387     }
388     return hci_number_free_acl_slots_for_handle(con_handle) > 0;
389 }
390 
391 int hci_can_send_acl_packet_now(hci_con_handle_t con_handle){
392     if (hci_stack->hci_packet_buffer_reserved) return 0;
393     return hci_can_send_prepared_acl_packet_now(con_handle);
394 }
395 
396 int hci_can_send_prepared_sco_packet_now(hci_con_handle_t con_handle){
397     if (hci_stack->hci_transport->can_send_packet_now){
398         if (!hci_stack->hci_transport->can_send_packet_now(HCI_SCO_DATA_PACKET)){
399             return 0;
400         }
401     }
402     return hci_number_free_sco_slots_for_handle(con_handle) > 0;
403 }
404 
405 int hci_can_send_sco_packet_now(hci_con_handle_t con_handle){
406     if (hci_stack->hci_packet_buffer_reserved) return 0;
407     return hci_can_send_prepared_sco_packet_now(con_handle);
408 }
409 
410 // used for internal checks in l2cap[-le].c
411 int hci_is_packet_buffer_reserved(void){
412     return hci_stack->hci_packet_buffer_reserved;
413 }
414 
415 // reserves outgoing packet buffer. @returns 1 if successful
416 int hci_reserve_packet_buffer(void){
417     if (hci_stack->hci_packet_buffer_reserved) {
418         log_error("hci_reserve_packet_buffer called but buffer already reserved");
419         return 0;
420     }
421     hci_stack->hci_packet_buffer_reserved = 1;
422     return 1;
423 }
424 
425 void hci_release_packet_buffer(void){
426     hci_stack->hci_packet_buffer_reserved = 0;
427 }
428 
429 // assumption: synchronous implementations don't provide can_send_packet_now as they don't keep the buffer after the call
430 int hci_transport_synchronous(void){
431     return hci_stack->hci_transport->can_send_packet_now == NULL;
432 }
433 
434 uint16_t hci_max_acl_le_data_packet_length(void){
435     return hci_stack->le_data_packets_length > 0 ? hci_stack->le_data_packets_length : hci_stack->acl_data_packet_length;
436 }
437 
438 static int hci_send_acl_packet_fragments(hci_connection_t *connection){
439 
440     // log_info("hci_send_acl_packet_fragments  %u/%u (con 0x%04x)", hci_stack->acl_fragmentation_pos, hci_stack->acl_fragmentation_total_size, connection->con_handle);
441 
442     // max ACL data packet length depends on connection type (LE vs. Classic) and available buffers
443     uint16_t max_acl_data_packet_length = hci_stack->acl_data_packet_length;
444     if (hci_is_le_connection(connection) && hci_stack->le_data_packets_length > 0){
445         max_acl_data_packet_length = hci_stack->le_data_packets_length;
446     }
447 
448     // testing: reduce buffer to minimum
449     // max_acl_data_packet_length = 52;
450 
451     int err;
452     // multiple packets could be send on a synchronous HCI transport
453     while (1){
454 
455         // get current data
456         const uint16_t acl_header_pos = hci_stack->acl_fragmentation_pos - 4;
457         int current_acl_data_packet_length = hci_stack->acl_fragmentation_total_size - hci_stack->acl_fragmentation_pos;
458         int more_fragments = 0;
459 
460         // if ACL packet is larger than Bluetooth packet buffer, only send max_acl_data_packet_length
461         if (current_acl_data_packet_length > max_acl_data_packet_length){
462             more_fragments = 1;
463             current_acl_data_packet_length = max_acl_data_packet_length;
464         }
465 
466         // copy handle_and_flags if not first fragment and update packet boundary flags to be 01 (continuing fragmnent)
467         if (acl_header_pos > 0){
468             uint16_t handle_and_flags = READ_BT_16(hci_stack->hci_packet_buffer, 0);
469             handle_and_flags = (handle_and_flags & 0xcfff) | (1 << 12);
470             bt_store_16(hci_stack->hci_packet_buffer, acl_header_pos, handle_and_flags);
471         }
472 
473         // update header len
474         bt_store_16(hci_stack->hci_packet_buffer, acl_header_pos + 2, current_acl_data_packet_length);
475 
476         // count packet
477         connection->num_acl_packets_sent++;
478 
479         // send packet
480         uint8_t * packet = &hci_stack->hci_packet_buffer[acl_header_pos];
481         const int size = current_acl_data_packet_length + 4;
482         hci_dump_packet(HCI_ACL_DATA_PACKET, 0, packet, size);
483         err = hci_stack->hci_transport->send_packet(HCI_ACL_DATA_PACKET, packet, size);
484 
485         // done yet?
486         if (!more_fragments) break;
487 
488         // update start of next fragment to send
489         hci_stack->acl_fragmentation_pos += current_acl_data_packet_length;
490 
491         // can send more?
492         if (!hci_can_send_prepared_acl_packet_now(connection->con_handle)) return err;
493     }
494 
495     // done
496     hci_stack->acl_fragmentation_pos = 0;
497     hci_stack->acl_fragmentation_total_size = 0;
498 
499     // release buffer now for synchronous transport
500     if (hci_transport_synchronous()){
501         hci_release_packet_buffer();
502         // notify upper stack that iit might be possible to send again
503         uint8_t event[] = { DAEMON_EVENT_HCI_PACKET_SENT, 0};
504         hci_stack->packet_handler(HCI_EVENT_PACKET, &event[0], sizeof(event));
505     }
506 
507     return err;
508 }
509 
510 // pre: caller has reserved the packet buffer
511 int hci_send_acl_packet_buffer(int size){
512 
513     // log_info("hci_send_acl_packet_buffer size %u", size);
514 
515     if (!hci_stack->hci_packet_buffer_reserved) {
516         log_error("hci_send_acl_packet_buffer called without reserving packet buffer");
517         return 0;
518     }
519 
520     uint8_t * packet = hci_stack->hci_packet_buffer;
521     hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);
522 
523     // check for free places on Bluetooth module
524     if (!hci_can_send_prepared_acl_packet_now(con_handle)) {
525         log_error("hci_send_acl_packet_buffer called but no free ACL buffers on controller");
526         hci_release_packet_buffer();
527         return BTSTACK_ACL_BUFFERS_FULL;
528     }
529 
530     hci_connection_t *connection = hci_connection_for_handle( con_handle);
531     if (!connection) {
532         log_error("hci_send_acl_packet_buffer called but no connection for handle 0x%04x", con_handle);
533         hci_release_packet_buffer();
534         return 0;
535     }
536     hci_connection_timestamp(connection);
537 
538     // hci_dump_packet( HCI_ACL_DATA_PACKET, 0, packet, size);
539 
540     // setup data
541     hci_stack->acl_fragmentation_total_size = size;
542     hci_stack->acl_fragmentation_pos = 4;   // start of L2CAP packet
543 
544     return hci_send_acl_packet_fragments(connection);
545 }
546 
547 // pre: caller has reserved the packet buffer
548 int hci_send_sco_packet_buffer(int size){
549 
550     // log_info("hci_send_acl_packet_buffer size %u", size);
551 
552     if (!hci_stack->hci_packet_buffer_reserved) {
553         log_error("hci_send_acl_packet_buffer called without reserving packet buffer");
554         return 0;
555     }
556 
557     uint8_t * packet = hci_stack->hci_packet_buffer;
558     hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);   // same for ACL and SCO
559 
560     // check for free places on Bluetooth module
561     if (!hci_can_send_prepared_sco_packet_now(con_handle)) {
562         log_error("hci_send_sco_packet_buffer called but no free ACL buffers on controller");
563         hci_release_packet_buffer();
564         return BTSTACK_ACL_BUFFERS_FULL;
565     }
566 
567     // track send packet in connection struct
568     hci_connection_t *connection = hci_connection_for_handle( con_handle);
569     if (!connection) {
570         log_error("hci_send_sco_packet_buffer called but no connection for handle 0x%04x", con_handle);
571         hci_release_packet_buffer();
572         return 0;
573     }
574     connection->num_sco_packets_sent++;
575 
576     hci_dump_packet( HCI_SCO_DATA_PACKET, 0, packet, size);
577     return hci_stack->hci_transport->send_packet(HCI_SCO_DATA_PACKET, packet, size);
578 }
579 
580 static void acl_handler(uint8_t *packet, int size){
581 
582     // log_info("acl_handler: size %u", size);
583 
584     // get info
585     hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);
586     hci_connection_t *conn      = hci_connection_for_handle(con_handle);
587     uint8_t  acl_flags          = READ_ACL_FLAGS(packet);
588     uint16_t acl_length         = READ_ACL_LENGTH(packet);
589 
590     // ignore non-registered handle
591     if (!conn){
592         log_error( "hci.c: acl_handler called with non-registered handle %u!" , con_handle);
593         return;
594     }
595 
596     // assert packet is complete
597     if (acl_length + 4 != size){
598         log_error("hci.c: acl_handler called with ACL packet of wrong size %u, expected %u => dropping packet", size, acl_length + 4);
599         return;
600     }
601 
602     // update idle timestamp
603     hci_connection_timestamp(conn);
604 
605     // handle different packet types
606     switch (acl_flags & 0x03) {
607 
608         case 0x01: // continuation fragment
609 
610             // sanity checks
611             if (conn->acl_recombination_pos == 0) {
612                 log_error( "ACL Cont Fragment but no first fragment for handle 0x%02x", con_handle);
613                 return;
614             }
615             if (conn->acl_recombination_pos + acl_length > 4 + HCI_ACL_BUFFER_SIZE){
616                 log_error( "ACL Cont Fragment to large: combined packet %u > buffer size %u for handle 0x%02x",
617                     conn->acl_recombination_pos + acl_length, 4 + HCI_ACL_BUFFER_SIZE, con_handle);
618                 conn->acl_recombination_pos = 0;
619                 return;
620             }
621 
622             // append fragment payload (header already stored)
623             memcpy(&conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE + conn->acl_recombination_pos], &packet[4], acl_length );
624             conn->acl_recombination_pos += acl_length;
625 
626             // log_error( "ACL Cont Fragment: acl_len %u, combined_len %u, l2cap_len %u", acl_length,
627             //        conn->acl_recombination_pos, conn->acl_recombination_length);
628 
629             // forward complete L2CAP packet if complete.
630             if (conn->acl_recombination_pos >= conn->acl_recombination_length + 4 + 4){ // pos already incl. ACL header
631 
632                 hci_stack->packet_handler(HCI_ACL_DATA_PACKET, &conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE], conn->acl_recombination_pos);
633                 // reset recombination buffer
634                 conn->acl_recombination_length = 0;
635                 conn->acl_recombination_pos = 0;
636             }
637             break;
638 
639         case 0x02: { // first fragment
640 
641             // sanity check
642             if (conn->acl_recombination_pos) {
643                 log_error( "ACL First Fragment but data in buffer for handle 0x%02x, dropping stale fragments", con_handle);
644                 conn->acl_recombination_pos = 0;
645             }
646 
647             // peek into L2CAP packet!
648             uint16_t l2cap_length = READ_L2CAP_LENGTH( packet );
649 
650             // log_info( "ACL First Fragment: acl_len %u, l2cap_len %u", acl_length, l2cap_length);
651 
652             // compare fragment size to L2CAP packet size
653             if (acl_length >= l2cap_length + 4){
654 
655                 // forward fragment as L2CAP packet
656                 hci_stack->packet_handler(HCI_ACL_DATA_PACKET, packet, acl_length + 4);
657 
658             } else {
659 
660                 if (acl_length > HCI_ACL_BUFFER_SIZE){
661                     log_error( "ACL First Fragment to large: fragment %u > buffer size %u for handle 0x%02x",
662                         4 + acl_length, 4 + HCI_ACL_BUFFER_SIZE, con_handle);
663                     return;
664                 }
665 
666                 // store first fragment and tweak acl length for complete package
667                 memcpy(&conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE], packet, acl_length + 4);
668                 conn->acl_recombination_pos    = acl_length + 4;
669                 conn->acl_recombination_length = l2cap_length;
670                 bt_store_16(conn->acl_recombination_buffer, HCI_INCOMING_PRE_BUFFER_SIZE + 2, l2cap_length +4);
671             }
672             break;
673 
674         }
675         default:
676             log_error( "hci.c: acl_handler called with invalid packet boundary flags %u", acl_flags & 0x03);
677             return;
678     }
679 
680     // execute main loop
681     hci_run();
682 }
683 
684 static void hci_shutdown_connection(hci_connection_t *conn){
685     log_info("Connection closed: handle 0x%x, %s", conn->con_handle, bd_addr_to_str(conn->address));
686 
687     run_loop_remove_timer(&conn->timeout);
688 
689     linked_list_remove(&hci_stack->connections, (linked_item_t *) conn);
690     btstack_memory_hci_connection_free( conn );
691 
692     // now it's gone
693     hci_emit_nr_connections_changed();
694 }
695 
696 static const uint16_t packet_type_sizes[] = {
697     0, HCI_ACL_2DH1_SIZE, HCI_ACL_3DH1_SIZE, HCI_ACL_DM1_SIZE,
698     HCI_ACL_DH1_SIZE, 0, 0, 0,
699     HCI_ACL_2DH3_SIZE, HCI_ACL_3DH3_SIZE, HCI_ACL_DM3_SIZE, HCI_ACL_DH3_SIZE,
700     HCI_ACL_2DH5_SIZE, HCI_ACL_3DH5_SIZE, HCI_ACL_DM5_SIZE, HCI_ACL_DH5_SIZE
701 };
702 static const uint8_t  packet_type_feature_requirement_bit[] = {
703      0, // 3 slot packets
704      1, // 5 slot packets
705     25, // EDR 2 mpbs
706     26, // EDR 3 mbps
707     39, // 3 slot EDR packts
708     40, // 5 slot EDR packet
709 };
710 static const uint16_t packet_type_feature_packet_mask[] = {
711     0x0f00, // 3 slot packets
712     0xf000, // 5 slot packets
713     0x1102, // EDR 2 mpbs
714     0x2204, // EDR 3 mbps
715     0x0300, // 3 slot EDR packts
716     0x3000, // 5 slot EDR packet
717 };
718 
719 static uint16_t hci_acl_packet_types_for_buffer_size_and_local_features(uint16_t buffer_size, uint8_t * local_supported_features){
720     // enable packet types based on size
721     uint16_t packet_types = 0;
722     unsigned int i;
723     for (i=0;i<16;i++){
724         if (packet_type_sizes[i] == 0) continue;
725         if (packet_type_sizes[i] <= buffer_size){
726             packet_types |= 1 << i;
727         }
728     }
729     // disable packet types due to missing local supported features
730     for (i=0;i<sizeof(packet_type_feature_requirement_bit);i++){
731         int bit_idx = packet_type_feature_requirement_bit[i];
732         int feature_set = (local_supported_features[bit_idx >> 3] & (1<<(bit_idx & 7))) != 0;
733         if (feature_set) continue;
734         log_info("Features bit %02u is not set, removing packet types 0x%04x", bit_idx, packet_type_feature_packet_mask[i]);
735         packet_types &= ~packet_type_feature_packet_mask[i];
736     }
737     // flip bits for "may not be used"
738     packet_types ^= 0x3306;
739     return packet_types;
740 }
741 
742 uint16_t hci_usable_acl_packet_types(void){
743     return hci_stack->packet_types;
744 }
745 
746 uint8_t* hci_get_outgoing_packet_buffer(void){
747     // hci packet buffer is >= acl data packet length
748     return hci_stack->hci_packet_buffer;
749 }
750 
751 uint16_t hci_max_acl_data_packet_length(void){
752     return hci_stack->acl_data_packet_length;
753 }
754 
755 int hci_non_flushable_packet_boundary_flag_supported(void){
756     // No. 54, byte 6, bit 6
757     return (hci_stack->local_supported_features[6] & (1 << 6)) != 0;
758 }
759 
760 int hci_ssp_supported(void){
761     // No. 51, byte 6, bit 3
762     return (hci_stack->local_supported_features[6] & (1 << 3)) != 0;
763 }
764 
765 int hci_classic_supported(void){
766     // No. 37, byte 4, bit 5, = No BR/EDR Support
767     return (hci_stack->local_supported_features[4] & (1 << 5)) == 0;
768 }
769 
770 int hci_le_supported(void){
771 #ifdef HAVE_BLE
772     // No. 37, byte 4, bit 6 = LE Supported (Controller)
773     return (hci_stack->local_supported_features[4] & (1 << 6)) != 0;
774 #else
775     return 0;
776 #endif
777 }
778 
779 // get addr type and address used in advertisement packets
780 void hci_le_advertisement_address(uint8_t * addr_type, bd_addr_t  addr){
781     *addr_type = hci_stack->adv_addr_type;
782     if (hci_stack->adv_addr_type){
783         memcpy(addr, hci_stack->adv_address, 6);
784     } else {
785         memcpy(addr, hci_stack->local_bd_addr, 6);
786     }
787 }
788 
789 #ifdef HAVE_BLE
790 void le_handle_advertisement_report(uint8_t *packet, int size){
791     int offset = 3;
792     int num_reports = packet[offset];
793     offset += 1;
794 
795     int i;
796     log_info("HCI: handle adv report with num reports: %d", num_reports);
797     uint8_t event[12 + LE_ADVERTISING_DATA_SIZE]; // use upper bound to avoid var size automatic var
798     for (i=0; i<num_reports;i++){
799         uint8_t data_length = packet[offset + 8];
800         uint8_t event_size = 10 + data_length;
801         int pos = 0;
802         event[pos++] = GAP_LE_ADVERTISING_REPORT;
803         event[pos++] = event_size;
804         memcpy(&event[pos], &packet[offset], 1+1+6); // event type + address type + address
805         offset += 8;
806         pos += 8;
807         event[pos++] = packet[offset + 1 + data_length]; // rssi
808         event[pos++] = packet[offset++]; //data_length;
809         memcpy(&event[pos], &packet[offset], data_length);
810         pos += data_length;
811         offset += data_length + 1; // rssi
812         hci_dump_packet( HCI_EVENT_PACKET, 0, event, pos);
813         hci_stack->packet_handler(HCI_EVENT_PACKET, event, pos);
814     }
815 }
816 #endif
817 
818 static void hci_initialization_timeout_handler(timer_source_t * ds){
819     switch (hci_stack->substate){
820         case HCI_INIT_W4_SEND_RESET:
821             log_info("Resend HCI Reset");
822             hci_stack->substate = HCI_INIT_SEND_RESET;
823             hci_stack->num_cmd_packets = 1;
824             hci_run();
825             break;
826         case HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT:
827             log_info("Resend HCI Reset - CSR Warm Boot");
828             hci_stack->substate = HCI_INIT_SEND_RESET_CSR_WARM_BOOT;
829             hci_stack->num_cmd_packets = 1;
830             hci_run();
831         case HCI_INIT_W4_SEND_BAUD_CHANGE:
832             log_info("Local baud rate change to %u", ((hci_uart_config_t *)hci_stack->config)->baudrate_main);
833             hci_stack->hci_transport->set_baudrate(((hci_uart_config_t *)hci_stack->config)->baudrate_main);
834             break;
835         default:
836             break;
837     }
838 }
839 
840 static void hci_initializing_next_state(void){
841     hci_stack->substate = (hci_substate_t )( ((int) hci_stack->substate) + 1);
842 }
843 
844 // assumption: hci_can_send_command_packet_now() == true
845 static void hci_initializing_run(void){
846     log_info("hci_initializing_run: substate %u", hci_stack->substate);
847     switch (hci_stack->substate){
848         case HCI_INIT_SEND_RESET:
849             hci_state_reset();
850 
851 #ifndef USE_BLUETOOL
852             // prepare reset if command complete not received in 100ms
853             run_loop_set_timer(&hci_stack->timeout, 100);
854             run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
855             run_loop_add_timer(&hci_stack->timeout);
856 #endif
857             // send command
858             hci_stack->substate = HCI_INIT_W4_SEND_RESET;
859             hci_send_cmd(&hci_reset);
860             break;
861         case HCI_INIT_SEND_READ_LOCAL_VERSION_INFORMATION:
862             hci_send_cmd(&hci_read_local_version_information);
863             hci_stack->substate = HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION;
864             break;
865         case HCI_INIT_SEND_RESET_CSR_WARM_BOOT:
866             hci_state_reset();
867             // prepare reset if command complete not received in 100ms
868             run_loop_set_timer(&hci_stack->timeout, 100);
869             run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
870             run_loop_add_timer(&hci_stack->timeout);
871             // send command
872             hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT;
873             hci_send_cmd(&hci_reset);
874             break;
875         case HCI_INIT_SEND_RESET_ST_WARM_BOOT:
876             hci_state_reset();
877             hci_stack->substate = HCI_INIT_W4_SEND_RESET_ST_WARM_BOOT;
878             hci_send_cmd(&hci_reset);
879             break;
880         case HCI_INIT_SET_BD_ADDR:
881             log_info("Set Public BD ADDR to %s", bd_addr_to_str(hci_stack->custom_bd_addr));
882             hci_stack->control->set_bd_addr_cmd(hci_stack->config, hci_stack->custom_bd_addr, hci_stack->hci_packet_buffer);
883             hci_stack->last_cmd_opcode = READ_BT_16(hci_stack->hci_packet_buffer, 0);
884             hci_stack->substate = HCI_INIT_W4_SET_BD_ADDR;
885             hci_send_cmd_packet(hci_stack->hci_packet_buffer, 3 + hci_stack->hci_packet_buffer[2]);
886             break;
887         case HCI_INIT_SEND_BAUD_CHANGE:
888             hci_stack->control->baudrate_cmd(hci_stack->config, ((hci_uart_config_t *)hci_stack->config)->baudrate_main, hci_stack->hci_packet_buffer);
889             hci_stack->last_cmd_opcode = READ_BT_16(hci_stack->hci_packet_buffer, 0);
890             hci_stack->substate = HCI_INIT_W4_SEND_BAUD_CHANGE;
891             hci_send_cmd_packet(hci_stack->hci_packet_buffer, 3 + hci_stack->hci_packet_buffer[2]);
892             // STLC25000D: baudrate change happens within 0.5 s after command was send,
893             // use timer to update baud rate after 100 ms (knowing exactly, when command was sent is non-trivial)
894             if (hci_stack->manufacturer == 0x0030){
895                 run_loop_set_timer(&hci_stack->timeout, 100);
896                 run_loop_add_timer(&hci_stack->timeout);
897             }
898             break;
899         case HCI_INIT_CUSTOM_INIT:
900             log_info("Custom init");
901             // Custom initialization
902             if (hci_stack->control && hci_stack->control->next_cmd){
903                 int valid_cmd = (*hci_stack->control->next_cmd)(hci_stack->config, hci_stack->hci_packet_buffer);
904                 if (valid_cmd){
905                     int size = 3 + hci_stack->hci_packet_buffer[2];
906                     hci_stack->last_cmd_opcode = READ_BT_16(hci_stack->hci_packet_buffer, 0);
907                     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, hci_stack->hci_packet_buffer, size);
908                     switch (valid_cmd) {
909                         case 1:
910                         default:
911                             hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT;
912                             break;
913                         case 2: // CSR Warm Boot: Wait a bit, then send HCI Reset until HCI Command Complete
914                             log_info("CSR Warm Boot");
915                             run_loop_set_timer(&hci_stack->timeout, 100);
916                             run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
917                             run_loop_add_timer(&hci_stack->timeout);
918                             hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT;
919                             break;
920                     }
921                     hci_stack->hci_transport->send_packet(HCI_COMMAND_DATA_PACKET, hci_stack->hci_packet_buffer, size);
922                     break;
923                 }
924                log_info("hci_run: init script done");
925             }
926             // otherwise continue
927             hci_stack->substate = HCI_INIT_W4_READ_BD_ADDR;
928             hci_send_cmd(&hci_read_bd_addr);
929             break;
930         case HCI_INIT_READ_LOCAL_SUPPORTED_COMMANDS:
931             hci_stack->substate = HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS;
932             hci_send_cmd(&hci_read_local_supported_commands);
933             break;
934         case HCI_INIT_READ_BUFFER_SIZE:
935             hci_stack->substate = HCI_INIT_W4_READ_BUFFER_SIZE;
936             hci_send_cmd(&hci_read_buffer_size);
937             break;
938         case HCI_INIT_READ_LOCAL_SUPPORTED_FEATUES:
939             hci_stack->substate = HCI_INIT_W4_READ_LOCAL_SUPPORTED_FEATUES;
940             hci_send_cmd(&hci_read_local_supported_features);
941             break;
942         case HCI_INIT_SET_EVENT_MASK:
943             hci_stack->substate = HCI_INIT_W4_SET_EVENT_MASK;
944             if (hci_le_supported()){
945                 hci_send_cmd(&hci_set_event_mask,0xffffffff, 0x3FFFFFFF);
946             } else {
947                 // Kensington Bluetooth 2.1 USB Dongle (CSR Chipset) returns an error for 0xffff...
948                 hci_send_cmd(&hci_set_event_mask,0xffffffff, 0x1FFFFFFF);
949             }
950             break;
951         case HCI_INIT_WRITE_SIMPLE_PAIRING_MODE:
952             hci_stack->substate = HCI_INIT_W4_WRITE_SIMPLE_PAIRING_MODE;
953             hci_send_cmd(&hci_write_simple_pairing_mode, hci_stack->ssp_enable);
954             break;
955         case HCI_INIT_WRITE_PAGE_TIMEOUT:
956             hci_stack->substate = HCI_INIT_W4_WRITE_PAGE_TIMEOUT;
957             hci_send_cmd(&hci_write_page_timeout, 0x6000);  // ca. 15 sec
958             break;
959         case HCI_INIT_WRITE_CLASS_OF_DEVICE:
960             hci_stack->substate = HCI_INIT_W4_WRITE_CLASS_OF_DEVICE;
961             hci_send_cmd(&hci_write_class_of_device, hci_stack->class_of_device);
962             break;
963         case HCI_INIT_WRITE_LOCAL_NAME:
964             hci_stack->substate = HCI_INIT_W4_WRITE_LOCAL_NAME;
965             if (hci_stack->local_name){
966                 hci_send_cmd(&hci_write_local_name, hci_stack->local_name);
967             } else {
968                 char hostname[30];
969 #ifdef EMBEDDED
970                 // BTstack-11:22:33:44:55:66
971                 strcpy(hostname, "BTstack ");
972                 strcat(hostname, bd_addr_to_str(hci_stack->local_bd_addr));
973                 log_info("---> Name %s", hostname);
974 #else
975                 // hostname for POSIX systems
976                 gethostname(hostname, 30);
977                 hostname[29] = '\0';
978 #endif
979                 hci_send_cmd(&hci_write_local_name, hostname);
980             }
981             break;
982         case HCI_INIT_WRITE_SCAN_ENABLE:
983             hci_send_cmd(&hci_write_scan_enable, (hci_stack->connectable << 1) | hci_stack->discoverable); // page scan
984             hci_stack->substate = HCI_INIT_W4_WRITE_SCAN_ENABLE;
985             break;
986 #ifdef HAVE_BLE
987         // LE INIT
988         case HCI_INIT_LE_READ_BUFFER_SIZE:
989             hci_stack->substate = HCI_INIT_W4_LE_READ_BUFFER_SIZE;
990             hci_send_cmd(&hci_le_read_buffer_size);
991             break;
992         case HCI_INIT_WRITE_LE_HOST_SUPPORTED:
993             // LE Supported Host = 1, Simultaneous Host = 0
994             hci_stack->substate = HCI_INIT_W4_WRITE_LE_HOST_SUPPORTED;
995             hci_send_cmd(&hci_write_le_host_supported, 1, 0);
996             break;
997         case HCI_INIT_READ_WHITE_LIST_SIZE:
998             hci_stack->substate = HCI_INIT_W4_READ_WHITE_LIST_SIZE;
999             hci_send_cmd(&hci_le_read_white_list_size);
1000             break;
1001         case HCI_INIT_LE_SET_SCAN_PARAMETERS:
1002             // LE Scan Parameters: active scanning, 300 ms interval, 30 ms window, public address, accept all advs
1003             hci_stack->substate = HCI_INIT_W4_LE_SET_SCAN_PARAMETERS;
1004             hci_send_cmd(&hci_le_set_scan_parameters, 1, 0x1e0, 0x30, 0, 0);
1005             break;
1006 #endif
1007         // DONE
1008         case HCI_INIT_DONE:
1009             // done.
1010             hci_stack->state = HCI_STATE_WORKING;
1011             hci_emit_state();
1012             return;
1013         default:
1014             return;
1015     }
1016 }
1017 
1018 static void hci_initializing_event_handler(uint8_t * packet, uint16_t size){
1019     uint8_t command_completed = 0;
1020 
1021     if (packet[0] == HCI_EVENT_COMMAND_COMPLETE){
1022         uint16_t opcode = READ_BT_16(packet,3);
1023         if (opcode == hci_stack->last_cmd_opcode){
1024             command_completed = 1;
1025             log_info("Command complete for expected opcode %04x at substate %u", opcode, hci_stack->substate);
1026         } else {
1027             log_info("Command complete for opcode %04x, expected %04x", opcode, hci_stack->last_cmd_opcode);
1028         }
1029     }
1030     if (packet[0] == HCI_EVENT_COMMAND_STATUS){
1031         uint8_t  status = packet[2];
1032         uint16_t opcode = READ_BT_16(packet,4);
1033         if (opcode == hci_stack->last_cmd_opcode){
1034             if (status){
1035                 command_completed = 1;
1036                 log_error("Command status error 0x%02x for expected opcode %04x at substate %u", status, opcode, hci_stack->substate);
1037             } else {
1038                 log_info("Command status OK for expected opcode %04x, waiting for command complete", opcode);
1039             }
1040         } else {
1041             log_info("Command status for opcode %04x, expected %04x", opcode, hci_stack->last_cmd_opcode);
1042         }
1043     }
1044     // Vendor == CSR
1045     if (hci_stack->substate == HCI_INIT_W4_CUSTOM_INIT && packet[0] == HCI_EVENT_VENDOR_SPECIFIC){
1046         // TODO: track actual command
1047         command_completed = 1;
1048     }
1049 
1050     if (!command_completed) return;
1051 
1052     int need_baud_change = hci_stack->config
1053                         && hci_stack->control
1054                         && hci_stack->control->baudrate_cmd
1055                         && hci_stack->hci_transport->set_baudrate
1056                         && ((hci_uart_config_t *)hci_stack->config)->baudrate_main;
1057 
1058     int need_addr_change = hci_stack->custom_bd_addr_set
1059                         && hci_stack->control
1060                         && hci_stack->control->set_bd_addr_cmd;
1061 
1062     switch(hci_stack->substate){
1063         case HCI_INIT_W4_SEND_RESET:
1064             run_loop_remove_timer(&hci_stack->timeout);
1065             break;
1066         case HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION:
1067             if (need_addr_change){
1068                 hci_stack->substate = HCI_INIT_SET_BD_ADDR;
1069                 return;
1070             }
1071             // skipping addr change
1072             if (need_baud_change){
1073                 hci_stack->substate = HCI_INIT_SEND_BAUD_CHANGE;
1074                 return;
1075             }
1076             // also skip baud change
1077             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1078             return;
1079         case HCI_INIT_W4_SET_BD_ADDR:
1080             // for STLC2500D, bd addr change only gets active after sending reset command
1081             if (hci_stack->manufacturer == 0x0030){
1082                 hci_stack->substate = HCI_INIT_SEND_RESET_ST_WARM_BOOT;
1083                 return;
1084             }
1085             // skipping warm boot on STLC2500D
1086             if (need_baud_change){
1087                 hci_stack->substate = HCI_INIT_SEND_BAUD_CHANGE;
1088                 return;
1089             }
1090             // skipping baud change
1091             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1092             return;
1093         case HCI_INIT_W4_SEND_RESET_ST_WARM_BOOT:
1094             if (need_baud_change){
1095                 hci_stack->substate = HCI_INIT_SEND_BAUD_CHANGE;
1096                 return;
1097             }
1098             // skipping baud change
1099             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1100             return;
1101         case HCI_INIT_W4_SEND_BAUD_CHANGE:
1102             // for STLC2500D, baud rate change already happened.
1103             // for CC256x, baud rate gets changed now
1104             if (hci_stack->manufacturer != 0x0030){
1105                 uint32_t new_baud = ((hci_uart_config_t *)hci_stack->config)->baudrate_main;
1106                 log_info("Local baud rate change to %u", new_baud);
1107                 hci_stack->hci_transport->set_baudrate(new_baud);
1108             }
1109             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1110             return;
1111         case HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT:
1112             run_loop_remove_timer(&hci_stack->timeout);
1113             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1114             return;
1115         case HCI_INIT_W4_CUSTOM_INIT:
1116             // repeat custom init
1117             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1118             return;
1119         case HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS:
1120             // skip read buffer size if not supported
1121             if (hci_stack->local_supported_commands[0] & 0x01) break;
1122             hci_stack->substate = HCI_INIT_READ_LOCAL_SUPPORTED_FEATUES;
1123             return;
1124         case HCI_INIT_W4_SET_EVENT_MASK:
1125             // skip Classic init commands for LE only chipsets
1126             if (!hci_classic_supported()){
1127                 if (hci_le_supported()){
1128                     hci_stack->substate = HCI_INIT_LE_READ_BUFFER_SIZE; // skip all classic command
1129                     return;
1130                 } else {
1131                     log_error("Neither BR/EDR nor LE supported");
1132                     hci_stack->substate = HCI_INIT_DONE; // skip all
1133                     return;
1134                 }
1135             }
1136             if (!hci_ssp_supported()){
1137                 hci_stack->substate = HCI_INIT_WRITE_PAGE_TIMEOUT;
1138                 return;
1139             }
1140             break;
1141         case HCI_INIT_W4_LE_READ_BUFFER_SIZE:
1142             // skip write le host if not supported (e.g. on LE only EM9301)
1143             if (hci_stack->local_supported_commands[0] & 0x02) break;
1144             hci_stack->substate = HCI_INIT_LE_SET_SCAN_PARAMETERS;
1145             return;
1146         case HCI_INIT_W4_WRITE_SCAN_ENABLE:
1147             if (!hci_le_supported()){
1148                 // SKIP LE init for Classic only configuration
1149                 hci_stack->substate = HCI_INIT_DONE;
1150                 return;
1151             }
1152         default:
1153             break;
1154     }
1155     hci_initializing_next_state();
1156 }
1157 
1158 
1159 // avoid huge local variables
1160 #ifndef EMBEDDED
1161 static device_name_t device_name;
1162 #endif
1163 static void event_handler(uint8_t *packet, int size){
1164 
1165     uint16_t event_length = packet[1];
1166 
1167     // assert packet is complete
1168     if (size != event_length + 2){
1169         log_error("hci.c: event_handler called with event packet of wrong size %u, expected %u => dropping packet", size, event_length + 2);
1170         return;
1171     }
1172 
1173     bd_addr_t addr;
1174     bd_addr_type_t addr_type;
1175     uint8_t link_type;
1176     hci_con_handle_t handle;
1177     hci_connection_t * conn;
1178     int i;
1179 
1180     // log_info("HCI:EVENT:%02x", packet[0]);
1181 
1182     switch (packet[0]) {
1183 
1184         case HCI_EVENT_COMMAND_COMPLETE:
1185             // get num cmd packets
1186             // log_info("HCI_EVENT_COMMAND_COMPLETE cmds old %u - new %u", hci_stack->num_cmd_packets, packet[2]);
1187             hci_stack->num_cmd_packets = packet[2];
1188 
1189             if (COMMAND_COMPLETE_EVENT(packet, hci_read_buffer_size)){
1190                 // from offset 5
1191                 // status
1192                 // "The HC_ACL_Data_Packet_Length return parameter will be used to determine the size of the L2CAP segments contained in ACL Data Packets"
1193                 hci_stack->acl_data_packet_length = READ_BT_16(packet, 6);
1194                 hci_stack->sco_data_packet_length = packet[8];
1195                 hci_stack->acl_packets_total_num  = READ_BT_16(packet, 9);
1196                 hci_stack->sco_packets_total_num  = READ_BT_16(packet, 11);
1197 
1198                 if (hci_stack->state == HCI_STATE_INITIALIZING){
1199                     // determine usable ACL payload size
1200                     if (HCI_ACL_PAYLOAD_SIZE < hci_stack->acl_data_packet_length){
1201                         hci_stack->acl_data_packet_length = HCI_ACL_PAYLOAD_SIZE;
1202                     }
1203                     log_info("hci_read_buffer_size: acl used size %u, count %u / sco size %u, count %u",
1204                              hci_stack->acl_data_packet_length, hci_stack->acl_packets_total_num,
1205                              hci_stack->sco_data_packet_length, hci_stack->sco_packets_total_num);
1206                 }
1207             }
1208 #ifdef HAVE_BLE
1209             if (COMMAND_COMPLETE_EVENT(packet, hci_le_read_buffer_size)){
1210                 hci_stack->le_data_packets_length = READ_BT_16(packet, 6);
1211                 hci_stack->le_acl_packets_total_num  = packet[8];
1212                     // determine usable ACL payload size
1213                     if (HCI_ACL_PAYLOAD_SIZE < hci_stack->le_data_packets_length){
1214                         hci_stack->le_data_packets_length = HCI_ACL_PAYLOAD_SIZE;
1215                     }
1216                 log_info("hci_le_read_buffer_size: size %u, count %u", hci_stack->le_data_packets_length, hci_stack->le_acl_packets_total_num);
1217             }
1218             if (COMMAND_COMPLETE_EVENT(packet, hci_le_read_white_list_size)){
1219                 hci_stack->le_white_list_capacity = READ_BT_16(packet, 6);
1220                 log_info("hci_le_read_white_list_size: size %u", hci_stack->le_white_list_capacity);
1221             }
1222 #endif
1223             // Dump local address
1224             if (COMMAND_COMPLETE_EVENT(packet, hci_read_bd_addr)) {
1225                 bt_flip_addr(hci_stack->local_bd_addr, &packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1]);
1226                 log_info("Local Address, Status: 0x%02x: Addr: %s",
1227                     packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE], bd_addr_to_str(hci_stack->local_bd_addr));
1228             }
1229             if (COMMAND_COMPLETE_EVENT(packet, hci_write_scan_enable)){
1230                 hci_emit_discoverable_enabled(hci_stack->discoverable);
1231             }
1232             // Note: HCI init checks
1233             if (COMMAND_COMPLETE_EVENT(packet, hci_read_local_supported_features)){
1234                 memcpy(hci_stack->local_supported_features, &packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1], 8);
1235 
1236                 // determine usable ACL packet types based on host buffer size and supported features
1237                 hci_stack->packet_types = hci_acl_packet_types_for_buffer_size_and_local_features(HCI_ACL_PAYLOAD_SIZE, &hci_stack->local_supported_features[0]);
1238                 log_info("packet types %04x", hci_stack->packet_types);
1239 
1240                 // Classic/LE
1241                 log_info("BR/EDR support %u, LE support %u", hci_classic_supported(), hci_le_supported());
1242             }
1243             if (COMMAND_COMPLETE_EVENT(packet, hci_read_local_version_information)){
1244                 // hci_stack->hci_version    = READ_BT_16(packet, 4);
1245                 // hci_stack->hci_revision   = READ_BT_16(packet, 6);
1246                 // hci_stack->lmp_version    = READ_BT_16(packet, 8);
1247                 hci_stack->manufacturer   = READ_BT_16(packet, 10);
1248                 // hci_stack->lmp_subversion = READ_BT_16(packet, 12);
1249                 log_info("Manufacturer: 0x%04x", hci_stack->manufacturer);
1250             }
1251             if (COMMAND_COMPLETE_EVENT(packet, hci_read_local_supported_commands)){
1252                 hci_stack->local_supported_commands[0] =
1253                     (packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1+14] & 0X80) >> 7 |  // Octet 14, bit 7
1254                     (packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1+24] & 0x40) >> 5;   // Octet 24, bit 6
1255             }
1256             break;
1257 
1258         case HCI_EVENT_COMMAND_STATUS:
1259             // get num cmd packets
1260             // log_info("HCI_EVENT_COMMAND_STATUS cmds - old %u - new %u", hci_stack->num_cmd_packets, packet[3]);
1261             hci_stack->num_cmd_packets = packet[3];
1262             break;
1263 
1264         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:{
1265             int offset = 3;
1266             for (i=0; i<packet[2];i++){
1267                 handle = READ_BT_16(packet, offset);
1268                 offset += 2;
1269                 uint16_t num_packets = READ_BT_16(packet, offset);
1270                 offset += 2;
1271 
1272                 conn = hci_connection_for_handle(handle);
1273                 if (!conn){
1274                     log_error("hci_number_completed_packet lists unused con handle %u", handle);
1275                     continue;
1276                 }
1277 
1278                 if (conn->address_type == BD_ADDR_TYPE_SCO){
1279                     if (conn->num_sco_packets_sent >= num_packets){
1280                         conn->num_sco_packets_sent -= num_packets;
1281                     } else {
1282                         log_error("hci_number_completed_packets, more sco slots freed then sent.");
1283                         conn->num_sco_packets_sent = 0;
1284                     }
1285 
1286                 } else {
1287                     if (conn->num_acl_packets_sent >= num_packets){
1288                         conn->num_acl_packets_sent -= num_packets;
1289                     } else {
1290                         log_error("hci_number_completed_packets, more acl slots freed then sent.");
1291                         conn->num_acl_packets_sent = 0;
1292                     }
1293                 }
1294                 // log_info("hci_number_completed_packet %u processed for handle %u, outstanding %u", num_packets, handle, conn->num_acl_packets_sent);
1295             }
1296             break;
1297         }
1298         case HCI_EVENT_CONNECTION_REQUEST:
1299             bt_flip_addr(addr, &packet[2]);
1300             // TODO: eval COD 8-10
1301             link_type = packet[11];
1302             log_info("Connection_incoming: %s, type %u", bd_addr_to_str(addr), link_type);
1303             addr_type = link_type == 1 ? BD_ADDR_TYPE_CLASSIC : BD_ADDR_TYPE_SCO;
1304             conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
1305             if (!conn) {
1306                 conn = create_connection_for_bd_addr_and_type(addr, addr_type);
1307             }
1308             if (!conn) {
1309                 // CONNECTION REJECTED DUE TO LIMITED RESOURCES (0X0D)
1310                 hci_stack->decline_reason = 0x0d;
1311                 BD_ADDR_COPY(hci_stack->decline_addr, addr);
1312                 break;
1313             }
1314             conn->state = RECEIVED_CONNECTION_REQUEST;
1315             hci_run();
1316             break;
1317 
1318         case HCI_EVENT_CONNECTION_COMPLETE:
1319             // Connection management
1320             bt_flip_addr(addr, &packet[5]);
1321             log_info("Connection_complete (status=%u) %s", packet[2], bd_addr_to_str(addr));
1322             addr_type = BD_ADDR_TYPE_CLASSIC;
1323             conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
1324             if (conn) {
1325                 if (!packet[2]){
1326                     conn->state = OPEN;
1327                     conn->con_handle = READ_BT_16(packet, 3);
1328                     conn->bonding_flags |= BONDING_REQUEST_REMOTE_FEATURES;
1329 
1330                     // restart timer
1331                     run_loop_set_timer(&conn->timeout, HCI_CONNECTION_TIMEOUT_MS);
1332                     run_loop_add_timer(&conn->timeout);
1333 
1334                     log_info("New connection: handle %u, %s", conn->con_handle, bd_addr_to_str(conn->address));
1335 
1336                     hci_emit_nr_connections_changed();
1337                 } else {
1338                     int notify_dedicated_bonding_failed = conn->bonding_flags & BONDING_DEDICATED;
1339                     uint8_t status = packet[2];
1340                     bd_addr_t bd_address;
1341                     memcpy(&bd_address, conn->address, 6);
1342 
1343                     // connection failed, remove entry
1344                     linked_list_remove(&hci_stack->connections, (linked_item_t *) conn);
1345                     btstack_memory_hci_connection_free( conn );
1346 
1347                     // notify client if dedicated bonding
1348                     if (notify_dedicated_bonding_failed){
1349                         log_info("hci notify_dedicated_bonding_failed");
1350                         hci_emit_dedicated_bonding_result(bd_address, status);
1351                     }
1352 
1353                     // if authentication error, also delete link key
1354                     if (packet[2] == 0x05) {
1355                         hci_drop_link_key_for_bd_addr(addr);
1356                     }
1357                 }
1358             }
1359             break;
1360 
1361         case HCI_EVENT_SYNCHRONOUS_CONNECTION_COMPLETE:
1362             bt_flip_addr(addr, &packet[5]);
1363             log_info("Synchronous Connection Complete (status=%u) %s", packet[2], bd_addr_to_str(addr));
1364             if (packet[2]){
1365                 // connection failed
1366                 break;
1367             }
1368             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_SCO);
1369             if (!conn) {
1370                 conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_SCO);
1371             }
1372             if (!conn) {
1373                 break;
1374             }
1375             conn->state = OPEN;
1376             conn->con_handle = READ_BT_16(packet, 3);
1377             break;
1378 
1379         case HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE:
1380             handle = READ_BT_16(packet, 3);
1381             conn = hci_connection_for_handle(handle);
1382             if (!conn) break;
1383             if (!packet[2]){
1384                 uint8_t * features = &packet[5];
1385                 if (features[6] & (1 << 3)){
1386                     conn->bonding_flags |= BONDING_REMOTE_SUPPORTS_SSP;
1387                 }
1388             }
1389             conn->bonding_flags |= BONDING_RECEIVED_REMOTE_FEATURES;
1390             log_info("HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE, bonding flags %x", conn->bonding_flags);
1391             if (conn->bonding_flags & BONDING_DEDICATED){
1392                 conn->bonding_flags |= BONDING_SEND_AUTHENTICATE_REQUEST;
1393             }
1394             break;
1395 
1396         case HCI_EVENT_LINK_KEY_REQUEST:
1397             log_info("HCI_EVENT_LINK_KEY_REQUEST");
1398             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], RECV_LINK_KEY_REQUEST);
1399             // non-bondable mode: link key negative reply will be sent by HANDLE_LINK_KEY_REQUEST
1400             if (hci_stack->bondable && !hci_stack->remote_device_db) break;
1401             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], HANDLE_LINK_KEY_REQUEST);
1402             hci_run();
1403             // request handled by hci_run() as HANDLE_LINK_KEY_REQUEST gets set
1404             return;
1405 
1406         case HCI_EVENT_LINK_KEY_NOTIFICATION: {
1407             bt_flip_addr(addr, &packet[2]);
1408             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
1409             if (!conn) break;
1410             conn->authentication_flags |= RECV_LINK_KEY_NOTIFICATION;
1411             link_key_type_t link_key_type = (link_key_type_t)packet[24];
1412             // Change Connection Encryption keeps link key type
1413             if (link_key_type != CHANGED_COMBINATION_KEY){
1414                 conn->link_key_type = link_key_type;
1415             }
1416             if (!hci_stack->remote_device_db) break;
1417             hci_stack->remote_device_db->put_link_key(addr, &packet[8], conn->link_key_type);
1418             // still forward event to allow dismiss of pairing dialog
1419             break;
1420         }
1421 
1422         case HCI_EVENT_PIN_CODE_REQUEST:
1423             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], LEGACY_PAIRING_ACTIVE);
1424             // non-bondable mode: pin code negative reply will be sent
1425             if (!hci_stack->bondable){
1426                 hci_add_connection_flags_for_flipped_bd_addr(&packet[2], DENY_PIN_CODE_REQUEST);
1427                 hci_run();
1428                 return;
1429             }
1430             // PIN CODE REQUEST means the link key request didn't succee -> delete stored link key
1431             if (!hci_stack->remote_device_db) break;
1432             bt_flip_addr(addr, &packet[2]);
1433             hci_stack->remote_device_db->delete_link_key(addr);
1434             break;
1435 
1436         case HCI_EVENT_IO_CAPABILITY_REQUEST:
1437             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], RECV_IO_CAPABILITIES_REQUEST);
1438             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_IO_CAPABILITIES_REPLY);
1439             break;
1440 
1441         case HCI_EVENT_USER_CONFIRMATION_REQUEST:
1442             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SSP_PAIRING_ACTIVE);
1443             if (!hci_stack->ssp_auto_accept) break;
1444             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_USER_CONFIRM_REPLY);
1445             break;
1446 
1447         case HCI_EVENT_USER_PASSKEY_REQUEST:
1448             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SSP_PAIRING_ACTIVE);
1449             if (!hci_stack->ssp_auto_accept) break;
1450             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_USER_PASSKEY_REPLY);
1451             break;
1452 
1453         case HCI_EVENT_ENCRYPTION_CHANGE:
1454             handle = READ_BT_16(packet, 3);
1455             conn = hci_connection_for_handle(handle);
1456             if (!conn) break;
1457             if (packet[2] == 0) {
1458                 if (packet[5]){
1459                     conn->authentication_flags |= CONNECTION_ENCRYPTED;
1460                 } else {
1461                     conn->authentication_flags &= ~CONNECTION_ENCRYPTED;
1462                 }
1463             }
1464             hci_emit_security_level(handle, gap_security_level_for_connection(conn));
1465             break;
1466 
1467         case HCI_EVENT_AUTHENTICATION_COMPLETE_EVENT:
1468             handle = READ_BT_16(packet, 3);
1469             conn = hci_connection_for_handle(handle);
1470             if (!conn) break;
1471 
1472             // dedicated bonding: send result and disconnect
1473             if (conn->bonding_flags & BONDING_DEDICATED){
1474                 conn->bonding_flags &= ~BONDING_DEDICATED;
1475                 conn->bonding_flags |= BONDING_DISCONNECT_DEDICATED_DONE;
1476                 conn->bonding_status = packet[2];
1477                 break;
1478             }
1479 
1480             if (packet[2] == 0 && gap_security_level_for_link_key_type(conn->link_key_type) >= conn->requested_security_level){
1481                 // link key sufficient for requested security
1482                 conn->bonding_flags |= BONDING_SEND_ENCRYPTION_REQUEST;
1483                 break;
1484             }
1485             // not enough
1486             hci_emit_security_level(handle, gap_security_level_for_connection(conn));
1487             break;
1488 
1489 #ifndef EMBEDDED
1490         case HCI_EVENT_REMOTE_NAME_REQUEST_COMPLETE:
1491             if (!hci_stack->remote_device_db) break;
1492             if (packet[2]) break; // status not ok
1493             bt_flip_addr(addr, &packet[3]);
1494             // fix for invalid remote names - terminate on 0xff
1495             for (i=0; i<248;i++){
1496                 if (packet[9+i] == 0xff){
1497                     packet[9+i] = 0;
1498                     break;
1499                 }
1500             }
1501             memset(&device_name, 0, sizeof(device_name_t));
1502             strncpy((char*) device_name, (char*) &packet[9], 248);
1503             hci_stack->remote_device_db->put_name(addr, &device_name);
1504             break;
1505 
1506         case HCI_EVENT_INQUIRY_RESULT:
1507         case HCI_EVENT_INQUIRY_RESULT_WITH_RSSI:{
1508             if (!hci_stack->remote_device_db) break;
1509             // first send inq result packet
1510             hci_stack->packet_handler(HCI_EVENT_PACKET, packet, size);
1511             // then send cached remote names
1512             int offset = 3;
1513             for (i=0; i<packet[2];i++){
1514                 bt_flip_addr(addr, &packet[offset]);
1515                 offset += 14; // 6 + 1 + 1 + 1 + 3 + 2;
1516                 if (hci_stack->remote_device_db->get_name(addr, &device_name)){
1517                     hci_emit_remote_name_cached(addr, &device_name);
1518                 }
1519             }
1520             return;
1521         }
1522 #endif
1523 
1524         // HCI_EVENT_DISCONNECTION_COMPLETE
1525         // has been split, to first notify stack before shutting connection down
1526         // see end of function, too.
1527         case HCI_EVENT_DISCONNECTION_COMPLETE:
1528             if (packet[2]) break;   // status != 0
1529             handle = READ_BT_16(packet, 3);
1530             conn = hci_connection_for_handle(handle);
1531             if (!conn) break;       // no conn struct anymore
1532             // re-enable advertisements for le connections if active
1533             if (hci_is_le_connection(conn) && hci_stack->le_advertisements_enabled){
1534                 hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_ENABLE;
1535             }
1536             conn->state = RECEIVED_DISCONNECTION_COMPLETE;
1537             break;
1538 
1539         case HCI_EVENT_HARDWARE_ERROR:
1540             if (hci_stack->hardware_error_callback){
1541                 (*hci_stack->hardware_error_callback)();
1542             } else if(hci_stack->control && hci_stack->control->hw_error){
1543                 (*hci_stack->control->hw_error)();
1544             } else {
1545                 // if no special requests, just reboot stack
1546                 hci_power_control_off();
1547                 hci_power_control_on();
1548             }
1549             break;
1550 
1551         case DAEMON_EVENT_HCI_PACKET_SENT:
1552             // release packet buffer only for asynchronous transport and if there are not further fragements
1553             if (hci_transport_synchronous()) {
1554                 log_error("Synchronous HCI Transport shouldn't send DAEMON_EVENT_HCI_PACKET_SENT");
1555                 return; // instead of break: to avoid re-entering hci_run()
1556             }
1557             if (hci_stack->acl_fragmentation_total_size) break;
1558             hci_release_packet_buffer();
1559             break;
1560 
1561 #ifdef HAVE_BLE
1562         case HCI_EVENT_LE_META:
1563             switch (packet[2]){
1564                 case HCI_SUBEVENT_LE_ADVERTISING_REPORT:
1565                     log_info("advertising report received");
1566                     if (hci_stack->le_scanning_state != LE_SCANNING) break;
1567                     le_handle_advertisement_report(packet, size);
1568                     break;
1569                 case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
1570                     // Connection management
1571                     bt_flip_addr(addr, &packet[8]);
1572                     addr_type = (bd_addr_type_t)packet[7];
1573                     log_info("LE Connection_complete (status=%u) type %u, %s", packet[3], addr_type, bd_addr_to_str(addr));
1574                     conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
1575                     // handle error first
1576                     if (packet[3]){
1577                         if (conn){
1578                             // outgoing connection failed, remove entry
1579                             linked_list_remove(&hci_stack->connections, (linked_item_t *) conn);
1580                             btstack_memory_hci_connection_free( conn );
1581                         }
1582                         // if authentication error, also delete link key
1583                         if (packet[3] == 0x05) {
1584                             hci_drop_link_key_for_bd_addr(addr);
1585                         }
1586                         break;
1587                     }
1588                     if (!conn){
1589                         // advertisemts are stopped on incoming connection
1590                         hci_stack->le_advertisements_active = 0;
1591                         // LE connections are auto-accepted, so just create a connection if there isn't one already
1592                         conn = create_connection_for_bd_addr_and_type(addr, addr_type);
1593                     }
1594                     if (!conn){
1595                         // no memory
1596                         break;
1597                     }
1598 
1599                     conn->state = OPEN;
1600                     conn->con_handle = READ_BT_16(packet, 4);
1601 
1602                     // TODO: store - role, peer address type, conn_interval, conn_latency, supervision timeout, master clock
1603 
1604                     // restart timer
1605                     // run_loop_set_timer(&conn->timeout, HCI_CONNECTION_TIMEOUT_MS);
1606                     // run_loop_add_timer(&conn->timeout);
1607 
1608                     log_info("New connection: handle %u, %s", conn->con_handle, bd_addr_to_str(conn->address));
1609 
1610                     hci_emit_nr_connections_changed();
1611                     break;
1612 
1613             // log_info("LE buffer size: %u, count %u", READ_BT_16(packet,6), packet[8]);
1614 
1615                 default:
1616                     break;
1617             }
1618             break;
1619 #endif
1620         default:
1621             break;
1622     }
1623 
1624     // handle BT initialization
1625     if (hci_stack->state == HCI_STATE_INITIALIZING){
1626         hci_initializing_event_handler(packet, size);
1627     }
1628 
1629     // help with BT sleep
1630     if (hci_stack->state == HCI_STATE_FALLING_ASLEEP
1631         && hci_stack->substate == HCI_FALLING_ASLEEP_W4_WRITE_SCAN_ENABLE
1632         && COMMAND_COMPLETE_EVENT(packet, hci_write_scan_enable)){
1633         hci_initializing_next_state();
1634     }
1635 
1636     // notify upper stack
1637     hci_stack->packet_handler(HCI_EVENT_PACKET, packet, size);
1638 
1639     // moved here to give upper stack a chance to close down everything with hci_connection_t intact
1640     if (packet[0] == HCI_EVENT_DISCONNECTION_COMPLETE){
1641         if (!packet[2]){
1642             handle = READ_BT_16(packet, 3);
1643             hci_connection_t * conn = hci_connection_for_handle(handle);
1644             if (conn) {
1645                 uint8_t status = conn->bonding_status;
1646                 uint16_t flags = conn->bonding_flags;
1647                 bd_addr_t bd_address;
1648                 memcpy(&bd_address, conn->address, 6);
1649                 hci_shutdown_connection(conn);
1650                 // connection struct is gone, don't access anymore
1651                 if (flags & BONDING_EMIT_COMPLETE_ON_DISCONNECT){
1652                     hci_emit_dedicated_bonding_result(bd_address, status);
1653                 }
1654             }
1655         }
1656     }
1657 
1658 	// execute main loop
1659 	hci_run();
1660 }
1661 
1662 static void sco_handler(uint8_t * packet, uint16_t size){
1663     // not handled yet
1664 }
1665 
1666 static void packet_handler(uint8_t packet_type, uint8_t *packet, uint16_t size){
1667     hci_dump_packet(packet_type, 1, packet, size);
1668     switch (packet_type) {
1669         case HCI_EVENT_PACKET:
1670             event_handler(packet, size);
1671             break;
1672         case HCI_ACL_DATA_PACKET:
1673             acl_handler(packet, size);
1674             break;
1675         case HCI_SCO_DATA_PACKET:
1676             sco_handler(packet, size);
1677         default:
1678             break;
1679     }
1680 }
1681 
1682 /** Register HCI packet handlers */
1683 void hci_register_packet_handler(void (*handler)(uint8_t packet_type, uint8_t *packet, uint16_t size)){
1684     hci_stack->packet_handler = handler;
1685 }
1686 
1687 static void hci_state_reset(void){
1688     // no connections yet
1689     hci_stack->connections = NULL;
1690 
1691     // keep discoverable/connectable as this has been requested by the client(s)
1692     // hci_stack->discoverable = 0;
1693     // hci_stack->connectable = 0;
1694     // hci_stack->bondable = 1;
1695 
1696     // buffer is free
1697     hci_stack->hci_packet_buffer_reserved = 0;
1698 
1699     // no pending cmds
1700     hci_stack->decline_reason = 0;
1701     hci_stack->new_scan_enable_value = 0xff;
1702 
1703     // LE
1704     hci_stack->adv_addr_type = 0;
1705     memset(hci_stack->adv_address, 0, 6);
1706     hci_stack->le_scanning_state = LE_SCAN_IDLE;
1707     hci_stack->le_scan_type = 0xff;
1708     hci_stack->le_connecting_state = LE_CONNECTING_IDLE;
1709     hci_stack->le_connection_parameter_range.le_conn_interval_min = 0x0006;
1710     hci_stack->le_connection_parameter_range.le_conn_interval_max = 0x0C80;
1711     hci_stack->le_connection_parameter_range.le_conn_latency_min = 0x0000;
1712     hci_stack->le_connection_parameter_range.le_conn_latency_max = 0x03E8;
1713     hci_stack->le_connection_parameter_range.le_supervision_timeout_min = 0x000A;
1714     hci_stack->le_connection_parameter_range.le_supervision_timeout_max = 0x0C80;
1715 }
1716 
1717 void hci_init(hci_transport_t *transport, void *config, bt_control_t *control, remote_device_db_t const* remote_device_db){
1718 
1719 #ifdef HAVE_MALLOC
1720     if (!hci_stack) {
1721         hci_stack = (hci_stack_t*) malloc(sizeof(hci_stack_t));
1722     }
1723 #else
1724     hci_stack = &hci_stack_static;
1725 #endif
1726     memset(hci_stack, 0, sizeof(hci_stack_t));
1727 
1728     // reference to use transport layer implementation
1729     hci_stack->hci_transport = transport;
1730 
1731     // references to used control implementation
1732     hci_stack->control = control;
1733 
1734     // reference to used config
1735     hci_stack->config = config;
1736 
1737     // higher level handler
1738     hci_stack->packet_handler = dummy_handler;
1739 
1740     // store and open remote device db
1741     hci_stack->remote_device_db = remote_device_db;
1742     if (hci_stack->remote_device_db) {
1743         hci_stack->remote_device_db->open();
1744     }
1745 
1746     // max acl payload size defined in config.h
1747     hci_stack->acl_data_packet_length = HCI_ACL_PAYLOAD_SIZE;
1748 
1749     // register packet handlers with transport
1750     transport->register_packet_handler(&packet_handler);
1751 
1752     hci_stack->state = HCI_STATE_OFF;
1753 
1754     // class of device
1755     hci_stack->class_of_device = 0x007a020c; // Smartphone
1756 
1757     // bondable by default
1758     hci_stack->bondable = 1;
1759 
1760     // Secure Simple Pairing default: enable, no I/O capabilities, general bonding, mitm not required, auto accept
1761     hci_stack->ssp_enable = 1;
1762     hci_stack->ssp_io_capability = SSP_IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
1763     hci_stack->ssp_authentication_requirement = SSP_IO_AUTHREQ_MITM_PROTECTION_NOT_REQUIRED_GENERAL_BONDING;
1764     hci_stack->ssp_auto_accept = 1;
1765 
1766     hci_state_reset();
1767 }
1768 
1769 void hci_close(void){
1770     // close remote device db
1771     if (hci_stack->remote_device_db) {
1772         hci_stack->remote_device_db->close();
1773     }
1774     while (hci_stack->connections) {
1775         // cancel all l2cap connections
1776         hci_emit_disconnection_complete(((hci_connection_t *) hci_stack->connections)->con_handle, 0x16); // terminated by local host
1777         hci_shutdown_connection((hci_connection_t *) hci_stack->connections);
1778     }
1779     hci_power_control(HCI_POWER_OFF);
1780 
1781 #ifdef HAVE_MALLOC
1782     free(hci_stack);
1783 #endif
1784     hci_stack = NULL;
1785 }
1786 
1787 void hci_set_class_of_device(uint32_t class_of_device){
1788     hci_stack->class_of_device = class_of_device;
1789 }
1790 
1791 // Set Public BD ADDR - passed on to Bluetooth chipset if supported in bt_control_h
1792 void hci_set_bd_addr(bd_addr_t addr){
1793     memcpy(hci_stack->custom_bd_addr, addr, 6);
1794     hci_stack->custom_bd_addr_set = 1;
1795 }
1796 
1797 void hci_disable_l2cap_timeout_check(void){
1798     disable_l2cap_timeouts = 1;
1799 }
1800 // State-Module-Driver overview
1801 // state                    module  low-level
1802 // HCI_STATE_OFF             off      close
1803 // HCI_STATE_INITIALIZING,   on       open
1804 // HCI_STATE_WORKING,        on       open
1805 // HCI_STATE_HALTING,        on       open
1806 // HCI_STATE_SLEEPING,    off/sleep   close
1807 // HCI_STATE_FALLING_ASLEEP  on       open
1808 
1809 static int hci_power_control_on(void){
1810 
1811     // power on
1812     int err = 0;
1813     if (hci_stack->control && hci_stack->control->on){
1814         err = (*hci_stack->control->on)(hci_stack->config);
1815     }
1816     if (err){
1817         log_error( "POWER_ON failed");
1818         hci_emit_hci_open_failed();
1819         return err;
1820     }
1821 
1822     // open low-level device
1823     err = hci_stack->hci_transport->open(hci_stack->config);
1824     if (err){
1825         log_error( "HCI_INIT failed, turning Bluetooth off again");
1826         if (hci_stack->control && hci_stack->control->off){
1827             (*hci_stack->control->off)(hci_stack->config);
1828         }
1829         hci_emit_hci_open_failed();
1830         return err;
1831     }
1832     return 0;
1833 }
1834 
1835 static void hci_power_control_off(void){
1836 
1837     log_info("hci_power_control_off");
1838 
1839     // close low-level device
1840     hci_stack->hci_transport->close(hci_stack->config);
1841 
1842     log_info("hci_power_control_off - hci_transport closed");
1843 
1844     // power off
1845     if (hci_stack->control && hci_stack->control->off){
1846         (*hci_stack->control->off)(hci_stack->config);
1847     }
1848 
1849     log_info("hci_power_control_off - control closed");
1850 
1851     hci_stack->state = HCI_STATE_OFF;
1852 }
1853 
1854 static void hci_power_control_sleep(void){
1855 
1856     log_info("hci_power_control_sleep");
1857 
1858 #if 0
1859     // don't close serial port during sleep
1860 
1861     // close low-level device
1862     hci_stack->hci_transport->close(hci_stack->config);
1863 #endif
1864 
1865     // sleep mode
1866     if (hci_stack->control && hci_stack->control->sleep){
1867         (*hci_stack->control->sleep)(hci_stack->config);
1868     }
1869 
1870     hci_stack->state = HCI_STATE_SLEEPING;
1871 }
1872 
1873 static int hci_power_control_wake(void){
1874 
1875     log_info("hci_power_control_wake");
1876 
1877     // wake on
1878     if (hci_stack->control && hci_stack->control->wake){
1879         (*hci_stack->control->wake)(hci_stack->config);
1880     }
1881 
1882 #if 0
1883     // open low-level device
1884     int err = hci_stack->hci_transport->open(hci_stack->config);
1885     if (err){
1886         log_error( "HCI_INIT failed, turning Bluetooth off again");
1887         if (hci_stack->control && hci_stack->control->off){
1888             (*hci_stack->control->off)(hci_stack->config);
1889         }
1890         hci_emit_hci_open_failed();
1891         return err;
1892     }
1893 #endif
1894 
1895     return 0;
1896 }
1897 
1898 static void hci_power_transition_to_initializing(void){
1899     // set up state machine
1900     hci_stack->num_cmd_packets = 1; // assume that one cmd can be sent
1901     hci_stack->hci_packet_buffer_reserved = 0;
1902     hci_stack->state = HCI_STATE_INITIALIZING;
1903     hci_stack->substate = HCI_INIT_SEND_RESET;
1904 }
1905 
1906 int hci_power_control(HCI_POWER_MODE power_mode){
1907 
1908     log_info("hci_power_control: %u, current mode %u", power_mode, hci_stack->state);
1909 
1910     int err = 0;
1911     switch (hci_stack->state){
1912 
1913         case HCI_STATE_OFF:
1914             switch (power_mode){
1915                 case HCI_POWER_ON:
1916                     err = hci_power_control_on();
1917                     if (err) {
1918                         log_error("hci_power_control_on() error %u", err);
1919                         return err;
1920                     }
1921                     hci_power_transition_to_initializing();
1922                     break;
1923                 case HCI_POWER_OFF:
1924                     // do nothing
1925                     break;
1926                 case HCI_POWER_SLEEP:
1927                     // do nothing (with SLEEP == OFF)
1928                     break;
1929             }
1930             break;
1931 
1932         case HCI_STATE_INITIALIZING:
1933             switch (power_mode){
1934                 case HCI_POWER_ON:
1935                     // do nothing
1936                     break;
1937                 case HCI_POWER_OFF:
1938                     // no connections yet, just turn it off
1939                     hci_power_control_off();
1940                     break;
1941                 case HCI_POWER_SLEEP:
1942                     // no connections yet, just turn it off
1943                     hci_power_control_sleep();
1944                     break;
1945             }
1946             break;
1947 
1948         case HCI_STATE_WORKING:
1949             switch (power_mode){
1950                 case HCI_POWER_ON:
1951                     // do nothing
1952                     break;
1953                 case HCI_POWER_OFF:
1954                     // see hci_run
1955                     hci_stack->state = HCI_STATE_HALTING;
1956                     break;
1957                 case HCI_POWER_SLEEP:
1958                     // see hci_run
1959                     hci_stack->state = HCI_STATE_FALLING_ASLEEP;
1960                     hci_stack->substate = HCI_FALLING_ASLEEP_DISCONNECT;
1961                     break;
1962             }
1963             break;
1964 
1965         case HCI_STATE_HALTING:
1966             switch (power_mode){
1967                 case HCI_POWER_ON:
1968                     hci_power_transition_to_initializing();
1969                     break;
1970                 case HCI_POWER_OFF:
1971                     // do nothing
1972                     break;
1973                 case HCI_POWER_SLEEP:
1974                     // see hci_run
1975                     hci_stack->state = HCI_STATE_FALLING_ASLEEP;
1976                     hci_stack->substate = HCI_FALLING_ASLEEP_DISCONNECT;
1977                     break;
1978             }
1979             break;
1980 
1981         case HCI_STATE_FALLING_ASLEEP:
1982             switch (power_mode){
1983                 case HCI_POWER_ON:
1984 
1985 #if defined(USE_POWERMANAGEMENT) && defined(USE_BLUETOOL)
1986                     // nothing to do, if H4 supports power management
1987                     if (bt_control_iphone_power_management_enabled()){
1988                         hci_stack->state = HCI_STATE_INITIALIZING;
1989                         hci_stack->substate = HCI_INIT_WRITE_SCAN_ENABLE;   // init after sleep
1990                         break;
1991                     }
1992 #endif
1993                     hci_power_transition_to_initializing();
1994                     break;
1995                 case HCI_POWER_OFF:
1996                     // see hci_run
1997                     hci_stack->state = HCI_STATE_HALTING;
1998                     break;
1999                 case HCI_POWER_SLEEP:
2000                     // do nothing
2001                     break;
2002             }
2003             break;
2004 
2005         case HCI_STATE_SLEEPING:
2006             switch (power_mode){
2007                 case HCI_POWER_ON:
2008 
2009 #if defined(USE_POWERMANAGEMENT) && defined(USE_BLUETOOL)
2010                     // nothing to do, if H4 supports power management
2011                     if (bt_control_iphone_power_management_enabled()){
2012                         hci_stack->state = HCI_STATE_INITIALIZING;
2013                         hci_stack->substate = HCI_INIT_AFTER_SLEEP;
2014                         hci_update_scan_enable();
2015                         break;
2016                     }
2017 #endif
2018                     err = hci_power_control_wake();
2019                     if (err) return err;
2020                     hci_power_transition_to_initializing();
2021                     break;
2022                 case HCI_POWER_OFF:
2023                     hci_stack->state = HCI_STATE_HALTING;
2024                     break;
2025                 case HCI_POWER_SLEEP:
2026                     // do nothing
2027                     break;
2028             }
2029             break;
2030     }
2031 
2032     // create internal event
2033 	hci_emit_state();
2034 
2035 	// trigger next/first action
2036 	hci_run();
2037 
2038     return 0;
2039 }
2040 
2041 static void hci_update_scan_enable(void){
2042     // 2 = page scan, 1 = inq scan
2043     hci_stack->new_scan_enable_value  = hci_stack->connectable << 1 | hci_stack->discoverable;
2044     hci_run();
2045 }
2046 
2047 void hci_discoverable_control(uint8_t enable){
2048     if (enable) enable = 1; // normalize argument
2049 
2050     if (hci_stack->discoverable == enable){
2051         hci_emit_discoverable_enabled(hci_stack->discoverable);
2052         return;
2053     }
2054 
2055     hci_stack->discoverable = enable;
2056     hci_update_scan_enable();
2057 }
2058 
2059 void hci_connectable_control(uint8_t enable){
2060     if (enable) enable = 1; // normalize argument
2061 
2062     // don't emit event
2063     if (hci_stack->connectable == enable) return;
2064 
2065     hci_stack->connectable = enable;
2066     hci_update_scan_enable();
2067 }
2068 
2069 void hci_local_bd_addr(bd_addr_t address_buffer){
2070     memcpy(address_buffer, hci_stack->local_bd_addr, 6);
2071 }
2072 
2073 void hci_run(void){
2074 
2075     // log_info("hci_run: entered");
2076     hci_connection_t * connection;
2077     linked_item_t * it;
2078 
2079     // send continuation fragments first, as they block the prepared packet buffer
2080     if (hci_stack->acl_fragmentation_total_size > 0) {
2081         hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(hci_stack->hci_packet_buffer);
2082         if (hci_can_send_prepared_acl_packet_now(con_handle)){
2083             hci_connection_t *connection = hci_connection_for_handle(con_handle);
2084             if (connection) {
2085                 hci_send_acl_packet_fragments(connection);
2086                 return;
2087             }
2088             // connection gone -> discard further fragments
2089             hci_stack->acl_fragmentation_total_size = 0;
2090             hci_stack->acl_fragmentation_pos = 0;
2091         }
2092     }
2093 
2094     if (!hci_can_send_command_packet_now()) return;
2095 
2096     // global/non-connection oriented commands
2097 
2098     // decline incoming connections
2099     if (hci_stack->decline_reason){
2100         uint8_t reason = hci_stack->decline_reason;
2101         hci_stack->decline_reason = 0;
2102         hci_send_cmd(&hci_reject_connection_request, hci_stack->decline_addr, reason);
2103         return;
2104     }
2105 
2106     // send scan enable
2107     if (hci_stack->state == HCI_STATE_WORKING && hci_stack->new_scan_enable_value != 0xff && hci_classic_supported()){
2108         hci_send_cmd(&hci_write_scan_enable, hci_stack->new_scan_enable_value);
2109         hci_stack->new_scan_enable_value = 0xff;
2110         return;
2111     }
2112 
2113 #ifdef HAVE_BLE
2114     if (hci_stack->state == HCI_STATE_WORKING){
2115         // handle le scan
2116         switch(hci_stack->le_scanning_state){
2117             case LE_START_SCAN:
2118                 hci_stack->le_scanning_state = LE_SCANNING;
2119                 hci_send_cmd(&hci_le_set_scan_enable, 1, 0);
2120                 return;
2121 
2122             case LE_STOP_SCAN:
2123                 hci_stack->le_scanning_state = LE_SCAN_IDLE;
2124                 hci_send_cmd(&hci_le_set_scan_enable, 0, 0);
2125                 return;
2126             default:
2127                 break;
2128         }
2129         if (hci_stack->le_scan_type != 0xff){
2130             // defaults: active scanning, accept all advertisement packets
2131             int scan_type = hci_stack->le_scan_type;
2132             hci_stack->le_scan_type = 0xff;
2133             hci_send_cmd(&hci_le_set_scan_parameters, scan_type, hci_stack->le_scan_interval, hci_stack->le_scan_window, hci_stack->adv_addr_type, 0);
2134             return;
2135         }
2136         // le advertisement control
2137         if (hci_stack->le_advertisements_todo){
2138             log_info("hci_run: gap_le: adv todo: %x", hci_stack->le_advertisements_todo );
2139         }
2140         if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_DISABLE){
2141             hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_DISABLE;
2142             hci_send_cmd(&hci_le_set_advertise_enable, 0);
2143             return;
2144         }
2145         if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_SET_PARAMS){
2146             hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_SET_PARAMS;
2147             hci_send_cmd(&hci_le_set_advertising_parameters,
2148                  hci_stack->le_advertisements_interval_min,
2149                  hci_stack->le_advertisements_interval_max,
2150                  hci_stack->le_advertisements_type,
2151                  hci_stack->le_advertisements_own_address_type,
2152                  hci_stack->le_advertisements_direct_address_type,
2153                  hci_stack->le_advertisements_direct_address,
2154                  hci_stack->le_advertisements_channel_map,
2155                  hci_stack->le_advertisements_filter_policy);
2156             return;
2157         }
2158         if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_SET_DATA){
2159             hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_SET_DATA;
2160             hci_send_cmd(&hci_le_set_advertising_data, hci_stack->le_advertisements_data_len,
2161                 hci_stack->le_advertisements_data);
2162             return;
2163         }
2164         if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_ENABLE){
2165             hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_ENABLE;
2166             hci_send_cmd(&hci_le_set_advertise_enable, 1);
2167             return;
2168         }
2169     }
2170 #endif
2171 
2172     // send pending HCI commands
2173     for (it = (linked_item_t *) hci_stack->connections; it ; it = it->next){
2174         connection = (hci_connection_t *) it;
2175 
2176         switch(connection->state){
2177             case SEND_CREATE_CONNECTION:
2178                 switch(connection->address_type){
2179                     case BD_ADDR_TYPE_CLASSIC:
2180                         log_info("sending hci_create_connection");
2181                         hci_send_cmd(&hci_create_connection, connection->address, hci_usable_acl_packet_types(), 0, 0, 0, 1);
2182                         break;
2183                     default:
2184 #ifdef HAVE_BLE
2185                         log_info("sending hci_le_create_connection");
2186                         hci_send_cmd(&hci_le_create_connection,
2187                                      0x0060,    // scan interval: 60 ms
2188                                      0x0030,    // scan interval: 30 ms
2189                                      0,         // don't use whitelist
2190                                      connection->address_type, // peer address type
2191                                      connection->address,      // peer bd addr
2192                                      hci_stack->adv_addr_type, // our addr type:
2193                                      0x0008,    // conn interval min
2194                                      0x0018,    // conn interval max
2195                                      0,         // conn latency
2196                                      0x0048,    // supervision timeout
2197                                      0x0001,    // min ce length
2198                                      0x0001     // max ce length
2199                                      );
2200 
2201                         connection->state = SENT_CREATE_CONNECTION;
2202 #endif
2203                         break;
2204                 }
2205                 return;
2206 
2207             case RECEIVED_CONNECTION_REQUEST:
2208                 log_info("sending hci_accept_connection_request");
2209                 connection->state = ACCEPTED_CONNECTION_REQUEST;
2210                 if (connection->address_type == BD_ADDR_TYPE_CLASSIC){
2211                     hci_send_cmd(&hci_accept_connection_request, connection->address, 1);
2212                 } else {
2213                     // TODO: allows to customize synchronous connection parameters
2214                     hci_send_cmd(&hci_accept_synchronous_connection, connection->address, 8000, 8000, 0xFFFF, 0x0060, 0xFF, 0x003F);
2215                 }
2216                 return;
2217 
2218 #ifdef HAVE_BLE
2219             case SEND_CANCEL_CONNECTION:
2220                 connection->state = SENT_CANCEL_CONNECTION;
2221                 hci_send_cmd(&hci_le_create_connection_cancel);
2222                 return;
2223 #endif
2224             case SEND_DISCONNECT:
2225                 connection->state = SENT_DISCONNECT;
2226                 hci_send_cmd(&hci_disconnect, connection->con_handle, 0x13); // remote closed connection
2227                 return;
2228 
2229             default:
2230                 break;
2231         }
2232 
2233         if (connection->authentication_flags & HANDLE_LINK_KEY_REQUEST){
2234             log_info("responding to link key request");
2235             connectionClearAuthenticationFlags(connection, HANDLE_LINK_KEY_REQUEST);
2236             link_key_t link_key;
2237             link_key_type_t link_key_type;
2238             if ( hci_stack->remote_device_db
2239               && hci_stack->remote_device_db->get_link_key(connection->address, link_key, &link_key_type)
2240               && gap_security_level_for_link_key_type(link_key_type) >= connection->requested_security_level){
2241                connection->link_key_type = link_key_type;
2242                hci_send_cmd(&hci_link_key_request_reply, connection->address, &link_key);
2243             } else {
2244                hci_send_cmd(&hci_link_key_request_negative_reply, connection->address);
2245             }
2246             return;
2247         }
2248 
2249         if (connection->authentication_flags & DENY_PIN_CODE_REQUEST){
2250             log_info("denying to pin request");
2251             connectionClearAuthenticationFlags(connection, DENY_PIN_CODE_REQUEST);
2252             hci_send_cmd(&hci_pin_code_request_negative_reply, connection->address);
2253             return;
2254         }
2255 
2256         if (connection->authentication_flags & SEND_IO_CAPABILITIES_REPLY){
2257             connectionClearAuthenticationFlags(connection, SEND_IO_CAPABILITIES_REPLY);
2258             log_info("IO Capability Request received, stack bondable %u, io cap %u", hci_stack->bondable, hci_stack->ssp_io_capability);
2259             if (hci_stack->bondable && (hci_stack->ssp_io_capability != SSP_IO_CAPABILITY_UNKNOWN)){
2260                 // tweak authentication requirements
2261                 uint8_t authreq = hci_stack->ssp_authentication_requirement;
2262                 if (connection->bonding_flags & BONDING_DEDICATED){
2263                     authreq = SSP_IO_AUTHREQ_MITM_PROTECTION_NOT_REQUIRED_DEDICATED_BONDING;
2264                 }
2265                 if (gap_mitm_protection_required_for_security_level(connection->requested_security_level)){
2266                     authreq |= 1;
2267                 }
2268                 hci_send_cmd(&hci_io_capability_request_reply, &connection->address, hci_stack->ssp_io_capability, NULL, authreq);
2269             } else {
2270                 hci_send_cmd(&hci_io_capability_request_negative_reply, &connection->address, ERROR_CODE_PAIRING_NOT_ALLOWED);
2271             }
2272             return;
2273         }
2274 
2275         if (connection->authentication_flags & SEND_USER_CONFIRM_REPLY){
2276             connectionClearAuthenticationFlags(connection, SEND_USER_CONFIRM_REPLY);
2277             hci_send_cmd(&hci_user_confirmation_request_reply, &connection->address);
2278             return;
2279         }
2280 
2281         if (connection->authentication_flags & SEND_USER_PASSKEY_REPLY){
2282             connectionClearAuthenticationFlags(connection, SEND_USER_PASSKEY_REPLY);
2283             hci_send_cmd(&hci_user_passkey_request_reply, &connection->address, 000000);
2284             return;
2285         }
2286 
2287         if (connection->bonding_flags & BONDING_REQUEST_REMOTE_FEATURES){
2288             connection->bonding_flags &= ~BONDING_REQUEST_REMOTE_FEATURES;
2289             hci_send_cmd(&hci_read_remote_supported_features_command, connection->con_handle);
2290             return;
2291         }
2292 
2293         if (connection->bonding_flags & BONDING_DISCONNECT_SECURITY_BLOCK){
2294             connection->bonding_flags &= ~BONDING_DISCONNECT_SECURITY_BLOCK;
2295             hci_send_cmd(&hci_disconnect, connection->con_handle, 0x0005);  // authentication failure
2296             return;
2297         }
2298         if (connection->bonding_flags & BONDING_DISCONNECT_DEDICATED_DONE){
2299             connection->bonding_flags &= ~BONDING_DISCONNECT_DEDICATED_DONE;
2300             connection->bonding_flags |= BONDING_EMIT_COMPLETE_ON_DISCONNECT;
2301             hci_send_cmd(&hci_disconnect, connection->con_handle, 0x13);  // authentication done
2302             return;
2303         }
2304         if (connection->bonding_flags & BONDING_SEND_AUTHENTICATE_REQUEST){
2305             connection->bonding_flags &= ~BONDING_SEND_AUTHENTICATE_REQUEST;
2306             hci_send_cmd(&hci_authentication_requested, connection->con_handle);
2307             return;
2308         }
2309         if (connection->bonding_flags & BONDING_SEND_ENCRYPTION_REQUEST){
2310             connection->bonding_flags &= ~BONDING_SEND_ENCRYPTION_REQUEST;
2311             hci_send_cmd(&hci_set_connection_encryption, connection->con_handle, 1);
2312             return;
2313         }
2314 
2315 #ifdef HAVE_BLE
2316         if (connection->le_con_parameter_update_state == CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS){
2317             connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
2318 
2319             uint16_t connection_interval_min = connection->le_conn_interval_min;
2320             connection->le_conn_interval_min = 0;
2321             hci_send_cmd(&hci_le_connection_update, connection->con_handle, connection_interval_min,
2322                 connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout,
2323                 0x0000, 0xffff);
2324         }
2325 #endif
2326     }
2327 
2328     switch (hci_stack->state){
2329         case HCI_STATE_INITIALIZING:
2330             hci_initializing_run();
2331             break;
2332 
2333         case HCI_STATE_HALTING:
2334 
2335             log_info("HCI_STATE_HALTING");
2336             // close all open connections
2337             connection =  (hci_connection_t *) hci_stack->connections;
2338             if (connection){
2339                 uint16_t con_handle = (uint16_t) connection->con_handle;
2340                 if (!hci_can_send_command_packet_now()) return;
2341 
2342                 log_info("HCI_STATE_HALTING, connection %p, handle %u", connection, con_handle);
2343 
2344                 // cancel all l2cap connections right away instead of waiting for disconnection complete event ...
2345                 hci_emit_disconnection_complete(con_handle, 0x16); // terminated by local host
2346 
2347                 // ... which would be ignored anyway as we shutdown (free) the connection now
2348                 hci_shutdown_connection(connection);
2349 
2350                 // finally, send the disconnect command
2351                 hci_send_cmd(&hci_disconnect, con_handle, 0x13);  // remote closed connection
2352                 return;
2353             }
2354             log_info("HCI_STATE_HALTING, calling off");
2355 
2356             // switch mode
2357             hci_power_control_off();
2358 
2359             log_info("HCI_STATE_HALTING, emitting state");
2360             hci_emit_state();
2361             log_info("HCI_STATE_HALTING, done");
2362             break;
2363 
2364         case HCI_STATE_FALLING_ASLEEP:
2365             switch(hci_stack->substate) {
2366                 case HCI_FALLING_ASLEEP_DISCONNECT:
2367                     log_info("HCI_STATE_FALLING_ASLEEP");
2368                     // close all open connections
2369                     connection =  (hci_connection_t *) hci_stack->connections;
2370 
2371 #if defined(USE_POWERMANAGEMENT) && defined(USE_BLUETOOL)
2372                     // don't close connections, if H4 supports power management
2373                     if (bt_control_iphone_power_management_enabled()){
2374                         connection = NULL;
2375                     }
2376 #endif
2377                     if (connection){
2378 
2379                         // send disconnect
2380                         if (!hci_can_send_command_packet_now()) return;
2381 
2382                         log_info("HCI_STATE_FALLING_ASLEEP, connection %p, handle %u", connection, (uint16_t)connection->con_handle);
2383                         hci_send_cmd(&hci_disconnect, connection->con_handle, 0x13);  // remote closed connection
2384 
2385                         // send disconnected event right away - causes higher layer connections to get closed, too.
2386                         hci_shutdown_connection(connection);
2387                         return;
2388                     }
2389 
2390                     if (hci_classic_supported()){
2391                         // disable page and inquiry scan
2392                         if (!hci_can_send_command_packet_now()) return;
2393 
2394                         log_info("HCI_STATE_HALTING, disabling inq scans");
2395                         hci_send_cmd(&hci_write_scan_enable, hci_stack->connectable << 1); // drop inquiry scan but keep page scan
2396 
2397                         // continue in next sub state
2398                         hci_stack->substate = HCI_FALLING_ASLEEP_W4_WRITE_SCAN_ENABLE;
2399                         break;
2400                     }
2401                     // fall through for ble-only chips
2402 
2403                 case HCI_FALLING_ASLEEP_COMPLETE:
2404                     log_info("HCI_STATE_HALTING, calling sleep");
2405 #if defined(USE_POWERMANAGEMENT) && defined(USE_BLUETOOL)
2406                     // don't actually go to sleep, if H4 supports power management
2407                     if (bt_control_iphone_power_management_enabled()){
2408                         // SLEEP MODE reached
2409                         hci_stack->state = HCI_STATE_SLEEPING;
2410                         hci_emit_state();
2411                         break;
2412                     }
2413 #endif
2414                     // switch mode
2415                     hci_power_control_sleep();  // changes hci_stack->state to SLEEP
2416                     hci_emit_state();
2417                     break;
2418 
2419                 default:
2420                     break;
2421             }
2422             break;
2423 
2424         default:
2425             break;
2426     }
2427 }
2428 
2429 int hci_send_cmd_packet(uint8_t *packet, int size){
2430     bd_addr_t addr;
2431     hci_connection_t * conn;
2432     // house-keeping
2433 
2434     // create_connection?
2435     if (IS_COMMAND(packet, hci_create_connection)){
2436         bt_flip_addr(addr, &packet[3]);
2437         log_info("Create_connection to %s", bd_addr_to_str(addr));
2438 
2439         conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
2440         if (!conn){
2441             conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
2442             if (!conn){
2443                 // notify client that alloc failed
2444                 hci_emit_connection_complete(conn, BTSTACK_MEMORY_ALLOC_FAILED);
2445                 return 0; // don't sent packet to controller
2446             }
2447             conn->state = SEND_CREATE_CONNECTION;
2448         }
2449         log_info("conn state %u", conn->state);
2450         switch (conn->state){
2451             // if connection active exists
2452             case OPEN:
2453                 // and OPEN, emit connection complete command, don't send to controller
2454                 hci_emit_connection_complete(conn, 0);
2455                 return 0;
2456             case SEND_CREATE_CONNECTION:
2457                 // connection created by hci, e.g. dedicated bonding
2458                 break;
2459             default:
2460                 // otherwise, just ignore as it is already in the open process
2461                 return 0;
2462         }
2463         conn->state = SENT_CREATE_CONNECTION;
2464     }
2465     if (IS_COMMAND(packet, hci_link_key_request_reply)){
2466         hci_add_connection_flags_for_flipped_bd_addr(&packet[3], SENT_LINK_KEY_REPLY);
2467     }
2468     if (IS_COMMAND(packet, hci_link_key_request_negative_reply)){
2469         hci_add_connection_flags_for_flipped_bd_addr(&packet[3], SENT_LINK_KEY_NEGATIVE_REQUEST);
2470     }
2471 
2472     if (IS_COMMAND(packet, hci_delete_stored_link_key)){
2473         if (hci_stack->remote_device_db){
2474             bt_flip_addr(addr, &packet[3]);
2475             hci_stack->remote_device_db->delete_link_key(addr);
2476         }
2477     }
2478 
2479     if (IS_COMMAND(packet, hci_pin_code_request_negative_reply)
2480     ||  IS_COMMAND(packet, hci_pin_code_request_reply)){
2481         bt_flip_addr(addr, &packet[3]);
2482         conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
2483         if (conn){
2484             connectionClearAuthenticationFlags(conn, LEGACY_PAIRING_ACTIVE);
2485         }
2486     }
2487 
2488     if (IS_COMMAND(packet, hci_user_confirmation_request_negative_reply)
2489     ||  IS_COMMAND(packet, hci_user_confirmation_request_reply)
2490     ||  IS_COMMAND(packet, hci_user_passkey_request_negative_reply)
2491     ||  IS_COMMAND(packet, hci_user_passkey_request_reply)) {
2492         bt_flip_addr(addr, &packet[3]);
2493         conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
2494         if (conn){
2495             connectionClearAuthenticationFlags(conn, SSP_PAIRING_ACTIVE);
2496         }
2497     }
2498 
2499 #ifdef HAVE_BLE
2500     if (IS_COMMAND(packet, hci_le_set_advertising_parameters)){
2501         hci_stack->adv_addr_type = packet[8];
2502     }
2503     if (IS_COMMAND(packet, hci_le_set_random_address)){
2504         bt_flip_addr(hci_stack->adv_address, &packet[3]);
2505     }
2506     if (IS_COMMAND(packet, hci_le_set_advertise_enable)){
2507         hci_stack->le_advertisements_active = packet[3];
2508     }
2509     if (IS_COMMAND(packet, hci_le_create_connection)){
2510         // white list used?
2511         uint8_t initiator_filter_policy = packet[7];
2512         switch (initiator_filter_policy){
2513             case 0:
2514                 // whitelist not used
2515                 hci_stack->le_connecting_state = LE_CONNECTING_DIRECT;
2516                 break;
2517             case 1:
2518                 hci_stack->le_connecting_state = LE_CONNECTING_WHITELIST;
2519                 break;
2520             default:
2521                 log_error("Invalid initiator_filter_policy in LE Create Connection %u", initiator_filter_policy);
2522                 break;
2523         }
2524     }
2525     if (IS_COMMAND(packet, hci_le_create_connection_cancel)){
2526         hci_stack->le_connecting_state = LE_CONNECTING_IDLE;
2527     }
2528 #endif
2529 
2530     hci_stack->num_cmd_packets--;
2531 
2532     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, packet, size);
2533     int err = hci_stack->hci_transport->send_packet(HCI_COMMAND_DATA_PACKET, packet, size);
2534 
2535     // release packet buffer for synchronous transport implementations
2536     if (hci_transport_synchronous() && (packet == hci_stack->hci_packet_buffer)){
2537         hci_stack->hci_packet_buffer_reserved = 0;
2538     }
2539 
2540     return err;
2541 }
2542 
2543 // disconnect because of security block
2544 void hci_disconnect_security_block(hci_con_handle_t con_handle){
2545     hci_connection_t * connection = hci_connection_for_handle(con_handle);
2546     if (!connection) return;
2547     connection->bonding_flags |= BONDING_DISCONNECT_SECURITY_BLOCK;
2548 }
2549 
2550 
2551 // Configure Secure Simple Pairing
2552 
2553 // enable will enable SSP during init
2554 void hci_ssp_set_enable(int enable){
2555     hci_stack->ssp_enable = enable;
2556 }
2557 
2558 int hci_local_ssp_activated(void){
2559     return hci_ssp_supported() && hci_stack->ssp_enable;
2560 }
2561 
2562 // if set, BTstack will respond to io capability request using authentication requirement
2563 void hci_ssp_set_io_capability(int io_capability){
2564     hci_stack->ssp_io_capability = io_capability;
2565 }
2566 void hci_ssp_set_authentication_requirement(int authentication_requirement){
2567     hci_stack->ssp_authentication_requirement = authentication_requirement;
2568 }
2569 
2570 // if set, BTstack will confirm a numberic comparion and enter '000000' if requested
2571 void hci_ssp_set_auto_accept(int auto_accept){
2572     hci_stack->ssp_auto_accept = auto_accept;
2573 }
2574 
2575 /**
2576  * pre: numcmds >= 0 - it's allowed to send a command to the controller
2577  */
2578 int hci_send_cmd(const hci_cmd_t *cmd, ...){
2579 
2580     if (!hci_can_send_command_packet_now()){
2581         log_error("hci_send_cmd called but cannot send packet now");
2582         return 0;
2583     }
2584 
2585     // for HCI INITIALIZATION
2586     // log_info("hci_send_cmd: opcode %04x", cmd->opcode);
2587     hci_stack->last_cmd_opcode = cmd->opcode;
2588 
2589     hci_reserve_packet_buffer();
2590     uint8_t * packet = hci_stack->hci_packet_buffer;
2591 
2592     va_list argptr;
2593     va_start(argptr, cmd);
2594     uint16_t size = hci_create_cmd_internal(packet, cmd, argptr);
2595     va_end(argptr);
2596 
2597     return hci_send_cmd_packet(packet, size);
2598 }
2599 
2600 // Create various non-HCI events.
2601 // TODO: generalize, use table similar to hci_create_command
2602 
2603 void hci_emit_state(void){
2604     log_info("BTSTACK_EVENT_STATE %u", hci_stack->state);
2605     uint8_t event[3];
2606     event[0] = BTSTACK_EVENT_STATE;
2607     event[1] = sizeof(event) - 2;
2608     event[2] = hci_stack->state;
2609     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2610     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2611 }
2612 
2613 void hci_emit_connection_complete(hci_connection_t *conn, uint8_t status){
2614     uint8_t event[13];
2615     event[0] = HCI_EVENT_CONNECTION_COMPLETE;
2616     event[1] = sizeof(event) - 2;
2617     event[2] = status;
2618     bt_store_16(event, 3, conn->con_handle);
2619     bt_flip_addr(&event[5], conn->address);
2620     event[11] = 1; // ACL connection
2621     event[12] = 0; // encryption disabled
2622     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2623     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2624 }
2625 
2626 void hci_emit_le_connection_complete(uint8_t address_type, bd_addr_t address, uint16_t conn_handle, uint8_t status){
2627     uint8_t event[21];
2628     event[0] = HCI_EVENT_LE_META;
2629     event[1] = sizeof(event) - 2;
2630     event[2] = HCI_SUBEVENT_LE_CONNECTION_COMPLETE;
2631     event[3] = status;
2632     bt_store_16(event, 4, conn_handle);
2633     event[6] = 0; // TODO: role
2634     event[7] = address_type;
2635     bt_flip_addr(&event[8], address);
2636     bt_store_16(event, 14, 0); // interval
2637     bt_store_16(event, 16, 0); // latency
2638     bt_store_16(event, 18, 0); // supervision timeout
2639     event[20] = 0; // master clock accuracy
2640     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2641     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2642 }
2643 
2644 void hci_emit_disconnection_complete(uint16_t handle, uint8_t reason){
2645     uint8_t event[6];
2646     event[0] = HCI_EVENT_DISCONNECTION_COMPLETE;
2647     event[1] = sizeof(event) - 2;
2648     event[2] = 0; // status = OK
2649     bt_store_16(event, 3, handle);
2650     event[5] = reason;
2651     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2652     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2653 }
2654 
2655 void hci_emit_l2cap_check_timeout(hci_connection_t *conn){
2656     if (disable_l2cap_timeouts) return;
2657     log_info("L2CAP_EVENT_TIMEOUT_CHECK");
2658     uint8_t event[4];
2659     event[0] = L2CAP_EVENT_TIMEOUT_CHECK;
2660     event[1] = sizeof(event) - 2;
2661     bt_store_16(event, 2, conn->con_handle);
2662     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2663     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2664 }
2665 
2666 void hci_emit_nr_connections_changed(void){
2667     log_info("BTSTACK_EVENT_NR_CONNECTIONS_CHANGED %u", nr_hci_connections());
2668     uint8_t event[3];
2669     event[0] = BTSTACK_EVENT_NR_CONNECTIONS_CHANGED;
2670     event[1] = sizeof(event) - 2;
2671     event[2] = nr_hci_connections();
2672     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2673     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2674 }
2675 
2676 void hci_emit_hci_open_failed(void){
2677     log_info("BTSTACK_EVENT_POWERON_FAILED");
2678     uint8_t event[2];
2679     event[0] = BTSTACK_EVENT_POWERON_FAILED;
2680     event[1] = sizeof(event) - 2;
2681     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2682     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2683 }
2684 
2685 #ifndef EMBEDDED
2686 void hci_emit_btstack_version(void){
2687     log_info("BTSTACK_EVENT_VERSION %u.%u", BTSTACK_MAJOR, BTSTACK_MINOR);
2688     uint8_t event[6];
2689     event[0] = BTSTACK_EVENT_VERSION;
2690     event[1] = sizeof(event) - 2;
2691     event[2] = BTSTACK_MAJOR;
2692     event[3] = BTSTACK_MINOR;
2693     bt_store_16(event, 4, 3257);    // last SVN commit on Google Code + 1
2694     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2695     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2696 }
2697 #endif
2698 
2699 void hci_emit_system_bluetooth_enabled(uint8_t enabled){
2700     log_info("BTSTACK_EVENT_SYSTEM_BLUETOOTH_ENABLED %u", enabled);
2701     uint8_t event[3];
2702     event[0] = BTSTACK_EVENT_SYSTEM_BLUETOOTH_ENABLED;
2703     event[1] = sizeof(event) - 2;
2704     event[2] = enabled;
2705     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2706     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2707 }
2708 
2709 void hci_emit_remote_name_cached(bd_addr_t addr, device_name_t *name){
2710     uint8_t event[2+1+6+248+1]; // +1 for \0 in log_info
2711     event[0] = BTSTACK_EVENT_REMOTE_NAME_CACHED;
2712     event[1] = sizeof(event) - 2 - 1;
2713     event[2] = 0;   // just to be compatible with HCI_EVENT_REMOTE_NAME_REQUEST_COMPLETE
2714     bt_flip_addr(&event[3], addr);
2715     memcpy(&event[9], name, 248);
2716 
2717     event[9+248] = 0;   // assert \0 for log_info
2718     log_info("BTSTACK_EVENT_REMOTE_NAME_CACHED %s = '%s'", bd_addr_to_str(addr), &event[9]);
2719 
2720     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event)-1);
2721     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event)-1);
2722 }
2723 
2724 void hci_emit_discoverable_enabled(uint8_t enabled){
2725     log_info("BTSTACK_EVENT_DISCOVERABLE_ENABLED %u", enabled);
2726     uint8_t event[3];
2727     event[0] = BTSTACK_EVENT_DISCOVERABLE_ENABLED;
2728     event[1] = sizeof(event) - 2;
2729     event[2] = enabled;
2730     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2731     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2732 }
2733 
2734 void hci_emit_security_level(hci_con_handle_t con_handle, gap_security_level_t level){
2735     log_info("hci_emit_security_level %u for handle %x", level, con_handle);
2736     uint8_t event[5];
2737     int pos = 0;
2738     event[pos++] = GAP_SECURITY_LEVEL;
2739     event[pos++] = sizeof(event) - 2;
2740     bt_store_16(event, 2, con_handle);
2741     pos += 2;
2742     event[pos++] = level;
2743     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2744     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2745 }
2746 
2747 void hci_emit_dedicated_bonding_result(bd_addr_t address, uint8_t status){
2748     log_info("hci_emit_dedicated_bonding_result %u ", status);
2749     uint8_t event[9];
2750     int pos = 0;
2751     event[pos++] = GAP_DEDICATED_BONDING_COMPLETED;
2752     event[pos++] = sizeof(event) - 2;
2753     event[pos++] = status;
2754     bt_flip_addr( &event[pos], address);
2755     pos += 6;
2756     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2757     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2758 }
2759 
2760 // query if remote side supports SSP
2761 int hci_remote_ssp_supported(hci_con_handle_t con_handle){
2762     hci_connection_t * connection = hci_connection_for_handle(con_handle);
2763     if (!connection) return 0;
2764     return (connection->bonding_flags & BONDING_REMOTE_SUPPORTS_SSP) ? 1 : 0;
2765 }
2766 
2767 int hci_ssp_supported_on_both_sides(hci_con_handle_t handle){
2768     return hci_local_ssp_activated() && hci_remote_ssp_supported(handle);
2769 }
2770 
2771 // GAP API
2772 /**
2773  * @bbrief enable/disable bonding. default is enabled
2774  * @praram enabled
2775  */
2776 void gap_set_bondable_mode(int enable){
2777     hci_stack->bondable = enable ? 1 : 0;
2778 }
2779 
2780 /**
2781  * @brief map link keys to security levels
2782  */
2783 gap_security_level_t gap_security_level_for_link_key_type(link_key_type_t link_key_type){
2784     switch (link_key_type){
2785         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256:
2786             return LEVEL_4;
2787         case COMBINATION_KEY:
2788         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P192:
2789             return LEVEL_3;
2790         default:
2791             return LEVEL_2;
2792     }
2793 }
2794 
2795 static gap_security_level_t gap_security_level_for_connection(hci_connection_t * connection){
2796     if (!connection) return LEVEL_0;
2797     if ((connection->authentication_flags & CONNECTION_ENCRYPTED) == 0) return LEVEL_0;
2798     return gap_security_level_for_link_key_type(connection->link_key_type);
2799 }
2800 
2801 
2802 int gap_mitm_protection_required_for_security_level(gap_security_level_t level){
2803     log_info("gap_mitm_protection_required_for_security_level %u", level);
2804     return level > LEVEL_2;
2805 }
2806 
2807 /**
2808  * @brief get current security level
2809  */
2810 gap_security_level_t gap_security_level(hci_con_handle_t con_handle){
2811     hci_connection_t * connection = hci_connection_for_handle(con_handle);
2812     if (!connection) return LEVEL_0;
2813     return gap_security_level_for_connection(connection);
2814 }
2815 
2816 /**
2817  * @brief request connection to device to
2818  * @result GAP_AUTHENTICATION_RESULT
2819  */
2820 void gap_request_security_level(hci_con_handle_t con_handle, gap_security_level_t requested_level){
2821     hci_connection_t * connection = hci_connection_for_handle(con_handle);
2822     if (!connection){
2823         hci_emit_security_level(con_handle, LEVEL_0);
2824         return;
2825     }
2826     gap_security_level_t current_level = gap_security_level(con_handle);
2827     log_info("gap_request_security_level %u, current level %u", requested_level, current_level);
2828     if (current_level >= requested_level){
2829         hci_emit_security_level(con_handle, current_level);
2830         return;
2831     }
2832 
2833     connection->requested_security_level = requested_level;
2834 
2835 #if 0
2836     // sending encryption request without a link key results in an error.
2837     // TODO: figure out how to use it properly
2838 
2839     // would enabling ecnryption suffice (>= LEVEL_2)?
2840     if (hci_stack->remote_device_db){
2841         link_key_type_t link_key_type;
2842         link_key_t      link_key;
2843         if (hci_stack->remote_device_db->get_link_key( &connection->address, &link_key, &link_key_type)){
2844             if (gap_security_level_for_link_key_type(link_key_type) >= requested_level){
2845                 connection->bonding_flags |= BONDING_SEND_ENCRYPTION_REQUEST;
2846                 return;
2847             }
2848         }
2849     }
2850 #endif
2851 
2852     // try to authenticate connection
2853     connection->bonding_flags |= BONDING_SEND_AUTHENTICATE_REQUEST;
2854     hci_run();
2855 }
2856 
2857 /**
2858  * @brief start dedicated bonding with device. disconnect after bonding
2859  * @param device
2860  * @param request MITM protection
2861  * @result GAP_DEDICATED_BONDING_COMPLETE
2862  */
2863 int gap_dedicated_bonding(bd_addr_t device, int mitm_protection_required){
2864 
2865     // create connection state machine
2866     hci_connection_t * connection = create_connection_for_bd_addr_and_type(device, BD_ADDR_TYPE_CLASSIC);
2867 
2868     if (!connection){
2869         return BTSTACK_MEMORY_ALLOC_FAILED;
2870     }
2871 
2872     // delete linkn key
2873     hci_drop_link_key_for_bd_addr(device);
2874 
2875     // configure LEVEL_2/3, dedicated bonding
2876     connection->state = SEND_CREATE_CONNECTION;
2877     connection->requested_security_level = mitm_protection_required ? LEVEL_3 : LEVEL_2;
2878     log_info("gap_dedicated_bonding, mitm %u -> level %u", mitm_protection_required, connection->requested_security_level);
2879     connection->bonding_flags = BONDING_DEDICATED;
2880 
2881     // wait for GAP Security Result and send GAP Dedicated Bonding complete
2882 
2883     // handle: connnection failure (connection complete != ok)
2884     // handle: authentication failure
2885     // handle: disconnect on done
2886 
2887     hci_run();
2888 
2889     return 0;
2890 }
2891 
2892 void gap_set_local_name(const char * local_name){
2893     hci_stack->local_name = local_name;
2894 }
2895 
2896 le_command_status_t le_central_start_scan(void){
2897     if (hci_stack->le_scanning_state == LE_SCANNING) return BLE_PERIPHERAL_OK;
2898     hci_stack->le_scanning_state = LE_START_SCAN;
2899     hci_run();
2900     return BLE_PERIPHERAL_OK;
2901 }
2902 
2903 le_command_status_t le_central_stop_scan(void){
2904     if ( hci_stack->le_scanning_state == LE_SCAN_IDLE) return BLE_PERIPHERAL_OK;
2905     hci_stack->le_scanning_state = LE_STOP_SCAN;
2906     hci_run();
2907     return BLE_PERIPHERAL_OK;
2908 }
2909 
2910 void le_central_set_scan_parameters(uint8_t scan_type, uint16_t scan_interval, uint16_t scan_window){
2911     hci_stack->le_scan_type     = scan_type;
2912     hci_stack->le_scan_interval = scan_interval;
2913     hci_stack->le_scan_window   = scan_window;
2914     hci_run();
2915 }
2916 
2917 le_command_status_t le_central_connect(bd_addr_t  addr, bd_addr_type_t addr_type){
2918     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
2919     if (!conn){
2920         log_info("le_central_connect: no connection exists yet, creating context");
2921         conn = create_connection_for_bd_addr_and_type(addr, addr_type);
2922         if (!conn){
2923             // notify client that alloc failed
2924             hci_emit_le_connection_complete(addr_type, addr, 0, BTSTACK_MEMORY_ALLOC_FAILED);
2925             log_info("le_central_connect: failed to alloc hci_connection_t");
2926             return BLE_PERIPHERAL_NOT_CONNECTED; // don't sent packet to controller
2927         }
2928         conn->state = SEND_CREATE_CONNECTION;
2929         log_info("le_central_connect: send create connection next");
2930         hci_run();
2931         return BLE_PERIPHERAL_OK;
2932     }
2933 
2934     if (!hci_is_le_connection(conn) ||
2935         conn->state == SEND_CREATE_CONNECTION ||
2936         conn->state == SENT_CREATE_CONNECTION) {
2937         hci_emit_le_connection_complete(conn->address_type, conn->address, 0, ERROR_CODE_COMMAND_DISALLOWED);
2938         log_error("le_central_connect: classic connection or connect is already being created");
2939         return BLE_PERIPHERAL_IN_WRONG_STATE;
2940     }
2941 
2942     log_info("le_central_connect: context exists with state %u", conn->state);
2943     hci_emit_le_connection_complete(conn->address_type, conn->address, conn->con_handle, 0);
2944     hci_run();
2945     return BLE_PERIPHERAL_OK;
2946 }
2947 
2948 // @assumption: only a single outgoing LE Connection exists
2949 static hci_connection_t * le_central_get_outgoing_connection(void){
2950     linked_item_t *it;
2951     for (it = (linked_item_t *) hci_stack->connections; it ; it = it->next){
2952         hci_connection_t * conn = (hci_connection_t *) it;
2953         if (!hci_is_le_connection(conn)) continue;
2954         switch (conn->state){
2955             case SEND_CREATE_CONNECTION:
2956             case SENT_CREATE_CONNECTION:
2957                 return conn;
2958             default:
2959                 break;
2960         };
2961     }
2962     return NULL;
2963 }
2964 
2965 le_command_status_t le_central_connect_cancel(void){
2966     hci_connection_t * conn = le_central_get_outgoing_connection();
2967     switch (conn->state){
2968         case SEND_CREATE_CONNECTION:
2969             // skip sending create connection and emit event instead
2970             hci_emit_le_connection_complete(conn->address_type, conn->address, 0, ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER);
2971             linked_list_remove(&hci_stack->connections, (linked_item_t *) conn);
2972             btstack_memory_hci_connection_free( conn );
2973             break;
2974         case SENT_CREATE_CONNECTION:
2975             // request to send cancel connection
2976             conn->state = SEND_CANCEL_CONNECTION;
2977             hci_run();
2978             break;
2979         default:
2980             break;
2981     }
2982     return BLE_PERIPHERAL_OK;
2983 }
2984 
2985 /**
2986  * @brief Updates the connection parameters for a given LE connection
2987  * @param handle
2988  * @param conn_interval_min (unit: 1.25ms)
2989  * @param conn_interval_max (unit: 1.25ms)
2990  * @param conn_latency
2991  * @param supervision_timeout (unit: 10ms)
2992  * @returns 0 if ok
2993  */
2994 int gap_update_connection_parameters(hci_con_handle_t con_handle, uint16_t conn_interval_min,
2995     uint16_t conn_interval_max, uint16_t conn_latency, uint16_t supervision_timeout){
2996     hci_connection_t * connection = hci_connection_for_handle(con_handle);
2997     if (!connection) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2998     connection->le_conn_interval_min = conn_interval_min;
2999     connection->le_conn_interval_max = conn_interval_max;
3000     connection->le_conn_latency = conn_latency;
3001     connection->le_supervision_timeout = supervision_timeout;
3002     hci_run();
3003     return 0;
3004 }
3005 
3006 /**
3007  * @brief Set Advertisement Data
3008  * @param advertising_data_length
3009  * @param advertising_data (max 31 octets)
3010  * @note data is not copied, pointer has to stay valid
3011  */
3012 void gap_advertisements_set_data(uint8_t advertising_data_length, uint8_t * advertising_data){
3013     hci_stack->le_advertisements_data_len = advertising_data_length;
3014     hci_stack->le_advertisements_data = advertising_data;
3015     hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_SET_DATA;
3016     // disable advertisements before setting data
3017     if (hci_stack->le_advertisements_enabled){
3018         hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_DISABLE | LE_ADVERTISEMENT_TASKS_ENABLE;
3019     }
3020     hci_run();
3021 }
3022 
3023 /**
3024  * @brief Set Advertisement Parameters
3025  * @param adv_int_min
3026  * @param adv_int_max
3027  * @param adv_type
3028  * @param own_address_type
3029  * @param direct_address_type
3030  * @param direct_address
3031  * @param channel_map
3032  * @param filter_policy
3033  *
3034  * @note internal use. use gap_advertisements_set_params from gap_le.h instead.
3035  */
3036  void hci_le_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
3037     uint8_t own_address_type, uint8_t direct_address_typ, bd_addr_t direct_address,
3038     uint8_t channel_map, uint8_t filter_policy) {
3039 
3040     hci_stack->le_advertisements_interval_min = adv_int_min;
3041     hci_stack->le_advertisements_interval_max = adv_int_max;
3042     hci_stack->le_advertisements_type = adv_type;
3043     hci_stack->le_advertisements_own_address_type = own_address_type;
3044     hci_stack->le_advertisements_direct_address_type = direct_address_typ;
3045     hci_stack->le_advertisements_channel_map = channel_map;
3046     hci_stack->le_advertisements_filter_policy = filter_policy;
3047     memcpy(hci_stack->le_advertisements_direct_address, direct_address, 6);
3048 
3049     hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_SET_PARAMS;
3050     // disable advertisements before changing params
3051     if (hci_stack->le_advertisements_enabled){
3052         hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_DISABLE | LE_ADVERTISEMENT_TASKS_ENABLE;
3053     }
3054     hci_run();
3055  }
3056 
3057 /**
3058  * @brief Enable/Disable Advertisements
3059  * @param enabled
3060  */
3061 void gap_advertisements_enable(int enabled){
3062     hci_stack->le_advertisements_enabled = enabled;
3063     if (enabled && !hci_stack->le_advertisements_active){
3064         hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_ENABLE;
3065     }
3066     if (!enabled && hci_stack->le_advertisements_active){
3067         hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_DISABLE;
3068     }
3069     hci_run();
3070 }
3071 
3072 
3073 le_command_status_t gap_disconnect(hci_con_handle_t handle){
3074     hci_connection_t * conn = hci_connection_for_handle(handle);
3075     if (!conn){
3076         hci_emit_disconnection_complete(handle, 0);
3077         return BLE_PERIPHERAL_OK;
3078     }
3079     conn->state = SEND_DISCONNECT;
3080     hci_run();
3081     return BLE_PERIPHERAL_OK;
3082 }
3083 
3084 /**
3085  * @brief Auto Connection Establishment - Start Connecting to device
3086  * @param address_typ
3087  * @param address
3088  * @returns 0 if ok
3089  */
3090 int gap_auto_connection_start(uint8_t address_typ, bd_addr_t address){
3091     log_error("gap_auto_connection_start not implemented yet");
3092     return 1;
3093 }
3094 
3095 /**
3096  * @brief Auto Connection Establishment - Stop Connecting to device
3097  * @param address_typ
3098  * @param address
3099  * @returns 0 if ok
3100  */
3101 int gap_auto_connection_stop(uint8_t address_typ, bd_addr_t address){
3102     log_error("gap_auto_connection_stop not implemented yet");
3103     return 1;
3104 }
3105 
3106 /**
3107  * @brief Auto Connection Establishment - Stop everything
3108  * @note  Convenience function to stop all active auto connection attempts
3109  */
3110 void gap_auto_connection_stop_all(void){
3111     log_error("gap_auto_connection_stop_all not implemented yet");
3112 }
3113 
3114 /**
3115  * @brief Set callback for Bluetooth Hardware Error
3116  */
3117 void hci_set_hardware_error_callback(void (*fn)(void)){
3118     hci_stack->hardware_error_callback = fn;
3119 }
3120 
3121 
3122 void hci_disconnect_all(void){
3123     linked_list_iterator_t it;
3124     linked_list_iterator_init(&it, &hci_stack->connections);
3125     while (linked_list_iterator_has_next(&it)){
3126         hci_connection_t * con = (hci_connection_t*) linked_list_iterator_next(&it);
3127         if (con->state == SENT_DISCONNECT) continue;
3128         con->state = SEND_DISCONNECT;
3129     }
3130     hci_run();
3131 }
3132