xref: /btstack/src/hci.c (revision c67501cb47ee2dd3aee279a8910492c770c2020d)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 /*
39  *  hci.c
40  *
41  *  Created by Matthias Ringwald on 4/29/09.
42  *
43  */
44 
45 #include "btstack_config.h"
46 
47 
48 #ifdef HAVE_TICK
49 #include "btstack_run_loop_embedded.h"
50 #endif
51 
52 #ifdef HAVE_PLATFORM_IPHONE_OS
53 #include "../port/ios/src/bt_control_iphone.h"
54 #endif
55 
56 #ifdef ENABLE_BLE
57 #include "gap.h"
58 #endif
59 
60 #include <stdarg.h>
61 #include <string.h>
62 #include <stdio.h>
63 #include <inttypes.h>
64 
65 #include "btstack_debug.h"
66 #include "btstack_linked_list.h"
67 #include "btstack_memory.h"
68 #include "btstack_version.h"
69 #include "gap.h"
70 #include "hci.h"
71 #include "hci_cmd.h"
72 #include "hci_dump.h"
73 
74 
75 #define HCI_CONNECTION_TIMEOUT_MS 10000
76 
77 static void hci_update_scan_enable(void);
78 static gap_security_level_t gap_security_level_for_connection(hci_connection_t * connection);
79 static void hci_connection_timeout_handler(btstack_timer_source_t *timer);
80 static void hci_connection_timestamp(hci_connection_t *connection);
81 static int  hci_power_control_on(void);
82 static void hci_power_control_off(void);
83 static void hci_state_reset(void);
84 
85 #ifdef ENABLE_BLE
86 // called from test/ble_client/advertising_data_parser.c
87 void le_handle_advertisement_report(uint8_t *packet, int size);
88 static void hci_remove_from_whitelist(bd_addr_type_t address_type, bd_addr_t address);
89 #endif
90 
91 // the STACK is here
92 #ifndef HAVE_MALLOC
93 static hci_stack_t   hci_stack_static;
94 #endif
95 static hci_stack_t * hci_stack = NULL;
96 
97 // test helper
98 static uint8_t disable_l2cap_timeouts = 0;
99 
100 /**
101  * create connection for given address
102  *
103  * @return connection OR NULL, if no memory left
104  */
105 static hci_connection_t * create_connection_for_bd_addr_and_type(bd_addr_t addr, bd_addr_type_t addr_type){
106     log_info("create_connection_for_addr %s, type %x", bd_addr_to_str(addr), addr_type);
107     hci_connection_t * conn = btstack_memory_hci_connection_get();
108     if (!conn) return NULL;
109     memset(conn, 0, sizeof(hci_connection_t));
110     BD_ADDR_COPY(conn->address, addr);
111     conn->address_type = addr_type;
112     conn->con_handle = 0xffff;
113     conn->authentication_flags = AUTH_FLAGS_NONE;
114     conn->bonding_flags = 0;
115     conn->requested_security_level = LEVEL_0;
116     btstack_linked_item_set_user(&conn->timeout.item, conn);
117     conn->timeout.process = hci_connection_timeout_handler;
118     hci_connection_timestamp(conn);
119     conn->acl_recombination_length = 0;
120     conn->acl_recombination_pos = 0;
121     conn->num_acl_packets_sent = 0;
122     conn->num_sco_packets_sent = 0;
123     conn->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
124     btstack_linked_list_add(&hci_stack->connections, (btstack_linked_item_t *) conn);
125     return conn;
126 }
127 
128 
129 /**
130  * get le connection parameter range
131 *
132  * @return le connection parameter range struct
133  */
134 void gap_le_get_connection_parameter_range(le_connection_parameter_range_t range){
135     range = hci_stack->le_connection_parameter_range;
136 }
137 
138 /**
139  * set le connection parameter range
140  *
141  */
142 
143 void gap_le_set_connection_parameter_range(le_connection_parameter_range_t range){
144     hci_stack->le_connection_parameter_range = range;
145 }
146 
147 /**
148  * get hci connections iterator
149  *
150  * @return hci connections iterator
151  */
152 
153 void hci_connections_get_iterator(btstack_linked_list_iterator_t *it){
154     btstack_linked_list_iterator_init(it, &hci_stack->connections);
155 }
156 
157 /**
158  * get connection for a given handle
159  *
160  * @return connection OR NULL, if not found
161  */
162 hci_connection_t * hci_connection_for_handle(hci_con_handle_t con_handle){
163     btstack_linked_list_iterator_t it;
164     btstack_linked_list_iterator_init(&it, &hci_stack->connections);
165     while (btstack_linked_list_iterator_has_next(&it)){
166         hci_connection_t * item = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
167         if ( item->con_handle == con_handle ) {
168             return item;
169         }
170     }
171     return NULL;
172 }
173 
174 /**
175  * get connection for given address
176  *
177  * @return connection OR NULL, if not found
178  */
179 hci_connection_t * hci_connection_for_bd_addr_and_type(bd_addr_t  addr, bd_addr_type_t addr_type){
180     btstack_linked_list_iterator_t it;
181     btstack_linked_list_iterator_init(&it, &hci_stack->connections);
182     while (btstack_linked_list_iterator_has_next(&it)){
183         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
184         if (connection->address_type != addr_type)  continue;
185         if (memcmp(addr, connection->address, 6) != 0) continue;
186         return connection;
187     }
188     return NULL;
189 }
190 
191 static void hci_connection_timeout_handler(btstack_timer_source_t *timer){
192     hci_connection_t * connection = (hci_connection_t *) btstack_linked_item_get_user(&timer->item);
193 #ifdef HAVE_TIME
194     struct timeval tv;
195     gettimeofday(&tv, NULL);
196     if (tv.tv_sec >= connection->timestamp.tv_sec + HCI_CONNECTION_TIMEOUT_MS/1000) {
197         // connections might be timed out
198         hci_emit_l2cap_check_timeout(connection);
199     }
200 #endif
201 #ifdef HAVE_TICK
202     if (btstack_run_loop_embedded_get_ticks() > connection->timestamp + btstack_run_loop_embedded_ticks_for_ms(HCI_CONNECTION_TIMEOUT_MS)){
203         // connections might be timed out
204         hci_emit_l2cap_check_timeout(connection);
205     }
206 #endif
207 #ifdef HAVE_TIME_MS
208     if (btstack_run_loop_get_time_ms() > connection->timestamp + HCI_CONNECTION_TIMEOUT_MS){
209         // connections might be timed out
210         hci_emit_l2cap_check_timeout(connection);
211     }
212 #endif
213     btstack_run_loop_set_timer(timer, HCI_CONNECTION_TIMEOUT_MS);
214     btstack_run_loop_add_timer(timer);
215 }
216 
217 static void hci_connection_timestamp(hci_connection_t *connection){
218 #ifdef HAVE_TIME
219     gettimeofday(&connection->timestamp, NULL);
220 #endif
221 #ifdef HAVE_TICK
222     connection->timestamp = btstack_run_loop_embedded_get_ticks();
223 #endif
224 #ifdef HAVE_TIME_MS
225     connection->timestamp = btstack_run_loop_get_time_ms();
226 #endif
227 }
228 
229 
230 inline static void connectionSetAuthenticationFlags(hci_connection_t * conn, hci_authentication_flags_t flags){
231     conn->authentication_flags = (hci_authentication_flags_t)(conn->authentication_flags | flags);
232 }
233 
234 inline static void connectionClearAuthenticationFlags(hci_connection_t * conn, hci_authentication_flags_t flags){
235     conn->authentication_flags = (hci_authentication_flags_t)(conn->authentication_flags & ~flags);
236 }
237 
238 
239 /**
240  * add authentication flags and reset timer
241  * @note: assumes classic connection
242  * @note: bd_addr is passed in as litle endian uint8_t * as it is called from parsing packets
243  */
244 static void hci_add_connection_flags_for_flipped_bd_addr(uint8_t *bd_addr, hci_authentication_flags_t flags){
245     bd_addr_t addr;
246     bt_flip_addr(addr, bd_addr);
247     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
248     if (conn) {
249         connectionSetAuthenticationFlags(conn, flags);
250         hci_connection_timestamp(conn);
251     }
252 }
253 
254 int  hci_authentication_active_for_handle(hci_con_handle_t handle){
255     hci_connection_t * conn = hci_connection_for_handle(handle);
256     if (!conn) return 0;
257     if (conn->authentication_flags & LEGACY_PAIRING_ACTIVE) return 1;
258     if (conn->authentication_flags & SSP_PAIRING_ACTIVE) return 1;
259     return 0;
260 }
261 
262 void hci_drop_link_key_for_bd_addr(bd_addr_t addr){
263     if (hci_stack->remote_device_db) {
264         hci_stack->remote_device_db->delete_link_key(addr);
265     }
266 }
267 
268 int hci_is_le_connection(hci_connection_t * connection){
269     return  connection->address_type == BD_ADDR_TYPE_LE_PUBLIC ||
270     connection->address_type == BD_ADDR_TYPE_LE_RANDOM;
271 }
272 
273 
274 /**
275  * count connections
276  */
277 static int nr_hci_connections(void){
278     int count = 0;
279     btstack_linked_item_t *it;
280     for (it = (btstack_linked_item_t *) hci_stack->connections; it ; it = it->next, count++);
281     return count;
282 }
283 
284 /**
285  * Dummy handler called by HCI
286  */
287 static void dummy_handler(uint8_t packet_type, uint8_t *packet, uint16_t size){
288 }
289 
290 uint8_t hci_number_outgoing_packets(hci_con_handle_t handle){
291     hci_connection_t * connection = hci_connection_for_handle(handle);
292     if (!connection) {
293         log_error("hci_number_outgoing_packets: connection for handle %u does not exist!", handle);
294         return 0;
295     }
296     return connection->num_acl_packets_sent;
297 }
298 
299 uint8_t hci_number_free_acl_slots_for_handle(hci_con_handle_t con_handle){
300 
301     int num_packets_sent_classic = 0;
302     int num_packets_sent_le = 0;
303 
304     bd_addr_type_t address_type = BD_ADDR_TYPE_UNKNOWN;
305 
306     btstack_linked_item_t *it;
307     for (it = (btstack_linked_item_t *) hci_stack->connections; it ; it = it->next){
308         hci_connection_t * connection = (hci_connection_t *) it;
309         if (connection->address_type == BD_ADDR_TYPE_CLASSIC){
310             num_packets_sent_classic += connection->num_acl_packets_sent;
311         } else {
312             num_packets_sent_le += connection->num_acl_packets_sent;
313         }
314         // ignore connections that are not open, e.g., in state RECEIVED_DISCONNECTION_COMPLETE
315         if (connection->con_handle == con_handle && connection->state == OPEN){
316             address_type = connection->address_type;
317         }
318     }
319 
320     int free_slots_classic = hci_stack->acl_packets_total_num - num_packets_sent_classic;
321     int free_slots_le = 0;
322 
323     if (free_slots_classic < 0){
324         log_error("hci_number_free_acl_slots: outgoing classic packets (%u) > total classic packets (%u)", num_packets_sent_classic, hci_stack->acl_packets_total_num);
325         return 0;
326     }
327 
328     if (hci_stack->le_acl_packets_total_num){
329         // if we have LE slots, they are used
330         free_slots_le = hci_stack->le_acl_packets_total_num - num_packets_sent_le;
331         if (free_slots_le < 0){
332             log_error("hci_number_free_acl_slots: outgoing le packets (%u) > total le packets (%u)", num_packets_sent_le, hci_stack->le_acl_packets_total_num);
333             return 0;
334         }
335     } else {
336         // otherwise, classic slots are used for LE, too
337         free_slots_classic -= num_packets_sent_le;
338         if (free_slots_classic < 0){
339             log_error("hci_number_free_acl_slots: outgoing classic + le packets (%u + %u) > total packets (%u)", num_packets_sent_classic, num_packets_sent_le, hci_stack->acl_packets_total_num);
340             return 0;
341         }
342     }
343 
344     switch (address_type){
345         case BD_ADDR_TYPE_UNKNOWN:
346             log_error("hci_number_free_acl_slots: handle 0x%04x not in connection list", con_handle);
347             return 0;
348 
349         case BD_ADDR_TYPE_CLASSIC:
350             return free_slots_classic;
351 
352         default:
353            if (hci_stack->le_acl_packets_total_num){
354                return free_slots_le;
355            }
356            return free_slots_classic;
357     }
358 }
359 
360 static int hci_number_free_sco_slots_for_handle(hci_con_handle_t handle){
361     int num_sco_packets_sent = 0;
362     btstack_linked_item_t *it;
363     for (it = (btstack_linked_item_t *) hci_stack->connections; it ; it = it->next){
364         hci_connection_t * connection = (hci_connection_t *) it;
365         num_sco_packets_sent += connection->num_sco_packets_sent;
366     }
367     if (num_sco_packets_sent > hci_stack->sco_packets_total_num){
368         log_info("hci_number_free_sco_slots_for_handle: outgoing packets (%u) > total packets (%u)", num_sco_packets_sent, hci_stack->sco_packets_total_num);
369         return 0;
370     }
371     // log_info("hci_number_free_sco_slots_for_handle %x: sent %u", handle, num_sco_packets_sent);
372     return hci_stack->sco_packets_total_num - num_sco_packets_sent;
373 }
374 
375 // new functions replacing hci_can_send_packet_now[_using_packet_buffer]
376 int hci_can_send_command_packet_now(void){
377     if (hci_stack->hci_packet_buffer_reserved) return 0;
378 
379     // check for async hci transport implementations
380     if (hci_stack->hci_transport->can_send_packet_now){
381         if (!hci_stack->hci_transport->can_send_packet_now(HCI_COMMAND_DATA_PACKET)){
382             return 0;
383         }
384     }
385 
386     return hci_stack->num_cmd_packets > 0;
387 }
388 
389 int hci_can_send_prepared_acl_packet_now(hci_con_handle_t con_handle) {
390     // check for async hci transport implementations
391     if (hci_stack->hci_transport->can_send_packet_now){
392         if (!hci_stack->hci_transport->can_send_packet_now(HCI_ACL_DATA_PACKET)){
393             return 0;
394         }
395     }
396     return hci_number_free_acl_slots_for_handle(con_handle) > 0;
397 }
398 
399 int hci_can_send_acl_packet_now(hci_con_handle_t con_handle){
400     if (hci_stack->hci_packet_buffer_reserved) return 0;
401     return hci_can_send_prepared_acl_packet_now(con_handle);
402 }
403 
404 int hci_can_send_prepared_sco_packet_now(hci_con_handle_t con_handle){
405     if (hci_stack->hci_transport->can_send_packet_now){
406         if (!hci_stack->hci_transport->can_send_packet_now(HCI_SCO_DATA_PACKET)){
407             return 0;
408         }
409     }
410     if (!hci_stack->synchronous_flow_control_enabled) return 1;
411     return hci_number_free_sco_slots_for_handle(con_handle) > 0;
412 }
413 
414 int hci_can_send_sco_packet_now(hci_con_handle_t con_handle){
415     if (hci_stack->hci_packet_buffer_reserved) return 0;
416     return hci_can_send_prepared_sco_packet_now(con_handle);
417 }
418 
419 // used for internal checks in l2cap[-le].c
420 int hci_is_packet_buffer_reserved(void){
421     return hci_stack->hci_packet_buffer_reserved;
422 }
423 
424 // reserves outgoing packet buffer. @returns 1 if successful
425 int hci_reserve_packet_buffer(void){
426     if (hci_stack->hci_packet_buffer_reserved) {
427         log_error("hci_reserve_packet_buffer called but buffer already reserved");
428         return 0;
429     }
430     hci_stack->hci_packet_buffer_reserved = 1;
431     return 1;
432 }
433 
434 void hci_release_packet_buffer(void){
435     hci_stack->hci_packet_buffer_reserved = 0;
436 }
437 
438 // assumption: synchronous implementations don't provide can_send_packet_now as they don't keep the buffer after the call
439 static int hci_transport_synchronous(void){
440     return hci_stack->hci_transport->can_send_packet_now == NULL;
441 }
442 
443 uint16_t hci_max_acl_le_data_packet_length(void){
444     return hci_stack->le_data_packets_length > 0 ? hci_stack->le_data_packets_length : hci_stack->acl_data_packet_length;
445 }
446 
447 static int hci_send_acl_packet_fragments(hci_connection_t *connection){
448 
449     // log_info("hci_send_acl_packet_fragments  %u/%u (con 0x%04x)", hci_stack->acl_fragmentation_pos, hci_stack->acl_fragmentation_total_size, connection->con_handle);
450 
451     // max ACL data packet length depends on connection type (LE vs. Classic) and available buffers
452     uint16_t max_acl_data_packet_length = hci_stack->acl_data_packet_length;
453     if (hci_is_le_connection(connection) && hci_stack->le_data_packets_length > 0){
454         max_acl_data_packet_length = hci_stack->le_data_packets_length;
455     }
456 
457     // testing: reduce buffer to minimum
458     // max_acl_data_packet_length = 52;
459 
460     int err;
461     // multiple packets could be send on a synchronous HCI transport
462     while (1){
463 
464         // get current data
465         const uint16_t acl_header_pos = hci_stack->acl_fragmentation_pos - 4;
466         int current_acl_data_packet_length = hci_stack->acl_fragmentation_total_size - hci_stack->acl_fragmentation_pos;
467         int more_fragments = 0;
468 
469         // if ACL packet is larger than Bluetooth packet buffer, only send max_acl_data_packet_length
470         if (current_acl_data_packet_length > max_acl_data_packet_length){
471             more_fragments = 1;
472             current_acl_data_packet_length = max_acl_data_packet_length;
473         }
474 
475         // copy handle_and_flags if not first fragment and update packet boundary flags to be 01 (continuing fragmnent)
476         if (acl_header_pos > 0){
477             uint16_t handle_and_flags = READ_BT_16(hci_stack->hci_packet_buffer, 0);
478             handle_and_flags = (handle_and_flags & 0xcfff) | (1 << 12);
479             bt_store_16(hci_stack->hci_packet_buffer, acl_header_pos, handle_and_flags);
480         }
481 
482         // update header len
483         bt_store_16(hci_stack->hci_packet_buffer, acl_header_pos + 2, current_acl_data_packet_length);
484 
485         // count packet
486         connection->num_acl_packets_sent++;
487 
488         // send packet
489         uint8_t * packet = &hci_stack->hci_packet_buffer[acl_header_pos];
490         const int size = current_acl_data_packet_length + 4;
491         hci_dump_packet(HCI_ACL_DATA_PACKET, 0, packet, size);
492         err = hci_stack->hci_transport->send_packet(HCI_ACL_DATA_PACKET, packet, size);
493 
494         // done yet?
495         if (!more_fragments) break;
496 
497         // update start of next fragment to send
498         hci_stack->acl_fragmentation_pos += current_acl_data_packet_length;
499 
500         // can send more?
501         if (!hci_can_send_prepared_acl_packet_now(connection->con_handle)) return err;
502     }
503 
504     // done
505     hci_stack->acl_fragmentation_pos = 0;
506     hci_stack->acl_fragmentation_total_size = 0;
507 
508     // release buffer now for synchronous transport
509     if (hci_transport_synchronous()){
510         hci_release_packet_buffer();
511         // notify upper stack that iit might be possible to send again
512         uint8_t event[] = { DAEMON_EVENT_HCI_PACKET_SENT, 0};
513         hci_stack->packet_handler(HCI_EVENT_PACKET, &event[0], sizeof(event));
514     }
515 
516     return err;
517 }
518 
519 // pre: caller has reserved the packet buffer
520 int hci_send_acl_packet_buffer(int size){
521 
522     // log_info("hci_send_acl_packet_buffer size %u", size);
523 
524     if (!hci_stack->hci_packet_buffer_reserved) {
525         log_error("hci_send_acl_packet_buffer called without reserving packet buffer");
526         return 0;
527     }
528 
529     uint8_t * packet = hci_stack->hci_packet_buffer;
530     hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);
531 
532     // check for free places on Bluetooth module
533     if (!hci_can_send_prepared_acl_packet_now(con_handle)) {
534         log_error("hci_send_acl_packet_buffer called but no free ACL buffers on controller");
535         hci_release_packet_buffer();
536         return BTSTACK_ACL_BUFFERS_FULL;
537     }
538 
539     hci_connection_t *connection = hci_connection_for_handle( con_handle);
540     if (!connection) {
541         log_error("hci_send_acl_packet_buffer called but no connection for handle 0x%04x", con_handle);
542         hci_release_packet_buffer();
543         return 0;
544     }
545     hci_connection_timestamp(connection);
546 
547     // hci_dump_packet( HCI_ACL_DATA_PACKET, 0, packet, size);
548 
549     // setup data
550     hci_stack->acl_fragmentation_total_size = size;
551     hci_stack->acl_fragmentation_pos = 4;   // start of L2CAP packet
552 
553     return hci_send_acl_packet_fragments(connection);
554 }
555 
556 // pre: caller has reserved the packet buffer
557 int hci_send_sco_packet_buffer(int size){
558 
559     // log_info("hci_send_acl_packet_buffer size %u", size);
560 
561     if (!hci_stack->hci_packet_buffer_reserved) {
562         log_error("hci_send_acl_packet_buffer called without reserving packet buffer");
563         return 0;
564     }
565 
566     uint8_t * packet = hci_stack->hci_packet_buffer;
567 
568     // skip checks in loopback mode
569     if (!hci_stack->loopback_mode){
570         hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);   // same for ACL and SCO
571 
572         // check for free places on Bluetooth module
573         if (!hci_can_send_prepared_sco_packet_now(con_handle)) {
574             log_error("hci_send_sco_packet_buffer called but no free ACL buffers on controller");
575             hci_release_packet_buffer();
576             return BTSTACK_ACL_BUFFERS_FULL;
577         }
578 
579         // track send packet in connection struct
580         hci_connection_t *connection = hci_connection_for_handle( con_handle);
581         if (!connection) {
582             log_error("hci_send_sco_packet_buffer called but no connection for handle 0x%04x", con_handle);
583             hci_release_packet_buffer();
584             return 0;
585         }
586         connection->num_sco_packets_sent++;
587     }
588 
589     hci_dump_packet( HCI_SCO_DATA_PACKET, 0, packet, size);
590     int err = hci_stack->hci_transport->send_packet(HCI_SCO_DATA_PACKET, packet, size);
591 
592     if (hci_transport_synchronous()){
593         hci_release_packet_buffer();
594         // notify upper stack that iit might be possible to send again
595         uint8_t event[] = { DAEMON_EVENT_HCI_PACKET_SENT, 0};
596         hci_stack->packet_handler(HCI_EVENT_PACKET, &event[0], sizeof(event));
597     }
598 
599     return err;
600 }
601 
602 static void acl_handler(uint8_t *packet, int size){
603 
604     // log_info("acl_handler: size %u", size);
605 
606     // get info
607     hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(packet);
608     hci_connection_t *conn      = hci_connection_for_handle(con_handle);
609     uint8_t  acl_flags          = READ_ACL_FLAGS(packet);
610     uint16_t acl_length         = READ_ACL_LENGTH(packet);
611 
612     // ignore non-registered handle
613     if (!conn){
614         log_error( "hci.c: acl_handler called with non-registered handle %u!" , con_handle);
615         return;
616     }
617 
618     // assert packet is complete
619     if (acl_length + 4 != size){
620         log_error("hci.c: acl_handler called with ACL packet of wrong size %u, expected %u => dropping packet", size, acl_length + 4);
621         return;
622     }
623 
624     // update idle timestamp
625     hci_connection_timestamp(conn);
626 
627     // handle different packet types
628     switch (acl_flags & 0x03) {
629 
630         case 0x01: // continuation fragment
631 
632             // sanity checks
633             if (conn->acl_recombination_pos == 0) {
634                 log_error( "ACL Cont Fragment but no first fragment for handle 0x%02x", con_handle);
635                 return;
636             }
637             if (conn->acl_recombination_pos + acl_length > 4 + HCI_ACL_BUFFER_SIZE){
638                 log_error( "ACL Cont Fragment to large: combined packet %u > buffer size %u for handle 0x%02x",
639                     conn->acl_recombination_pos + acl_length, 4 + HCI_ACL_BUFFER_SIZE, con_handle);
640                 conn->acl_recombination_pos = 0;
641                 return;
642             }
643 
644             // append fragment payload (header already stored)
645             memcpy(&conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE + conn->acl_recombination_pos], &packet[4], acl_length );
646             conn->acl_recombination_pos += acl_length;
647 
648             // log_error( "ACL Cont Fragment: acl_len %u, combined_len %u, l2cap_len %u", acl_length,
649             //        conn->acl_recombination_pos, conn->acl_recombination_length);
650 
651             // forward complete L2CAP packet if complete.
652             if (conn->acl_recombination_pos >= conn->acl_recombination_length + 4 + 4){ // pos already incl. ACL header
653 
654                 hci_stack->packet_handler(HCI_ACL_DATA_PACKET, &conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE], conn->acl_recombination_pos);
655                 // reset recombination buffer
656                 conn->acl_recombination_length = 0;
657                 conn->acl_recombination_pos = 0;
658             }
659             break;
660 
661         case 0x02: { // first fragment
662 
663             // sanity check
664             if (conn->acl_recombination_pos) {
665                 log_error( "ACL First Fragment but data in buffer for handle 0x%02x, dropping stale fragments", con_handle);
666                 conn->acl_recombination_pos = 0;
667             }
668 
669             // peek into L2CAP packet!
670             uint16_t l2cap_length = READ_L2CAP_LENGTH( packet );
671 
672             // log_info( "ACL First Fragment: acl_len %u, l2cap_len %u", acl_length, l2cap_length);
673 
674             // compare fragment size to L2CAP packet size
675             if (acl_length >= l2cap_length + 4){
676 
677                 // forward fragment as L2CAP packet
678                 hci_stack->packet_handler(HCI_ACL_DATA_PACKET, packet, acl_length + 4);
679 
680             } else {
681 
682                 if (acl_length > HCI_ACL_BUFFER_SIZE){
683                     log_error( "ACL First Fragment to large: fragment %u > buffer size %u for handle 0x%02x",
684                         4 + acl_length, 4 + HCI_ACL_BUFFER_SIZE, con_handle);
685                     return;
686                 }
687 
688                 // store first fragment and tweak acl length for complete package
689                 memcpy(&conn->acl_recombination_buffer[HCI_INCOMING_PRE_BUFFER_SIZE], packet, acl_length + 4);
690                 conn->acl_recombination_pos    = acl_length + 4;
691                 conn->acl_recombination_length = l2cap_length;
692                 bt_store_16(conn->acl_recombination_buffer, HCI_INCOMING_PRE_BUFFER_SIZE + 2, l2cap_length +4);
693             }
694             break;
695 
696         }
697         default:
698             log_error( "hci.c: acl_handler called with invalid packet boundary flags %u", acl_flags & 0x03);
699             return;
700     }
701 
702     // execute main loop
703     hci_run();
704 }
705 
706 static void hci_shutdown_connection(hci_connection_t *conn){
707     log_info("Connection closed: handle 0x%x, %s", conn->con_handle, bd_addr_to_str(conn->address));
708 
709     btstack_run_loop_remove_timer(&conn->timeout);
710 
711     btstack_linked_list_remove(&hci_stack->connections, (btstack_linked_item_t *) conn);
712     btstack_memory_hci_connection_free( conn );
713 
714     // now it's gone
715     hci_emit_nr_connections_changed();
716 }
717 
718 static const uint16_t packet_type_sizes[] = {
719     0, HCI_ACL_2DH1_SIZE, HCI_ACL_3DH1_SIZE, HCI_ACL_DM1_SIZE,
720     HCI_ACL_DH1_SIZE, 0, 0, 0,
721     HCI_ACL_2DH3_SIZE, HCI_ACL_3DH3_SIZE, HCI_ACL_DM3_SIZE, HCI_ACL_DH3_SIZE,
722     HCI_ACL_2DH5_SIZE, HCI_ACL_3DH5_SIZE, HCI_ACL_DM5_SIZE, HCI_ACL_DH5_SIZE
723 };
724 static const uint8_t  packet_type_feature_requirement_bit[] = {
725      0, // 3 slot packets
726      1, // 5 slot packets
727     25, // EDR 2 mpbs
728     26, // EDR 3 mbps
729     39, // 3 slot EDR packts
730     40, // 5 slot EDR packet
731 };
732 static const uint16_t packet_type_feature_packet_mask[] = {
733     0x0f00, // 3 slot packets
734     0xf000, // 5 slot packets
735     0x1102, // EDR 2 mpbs
736     0x2204, // EDR 3 mbps
737     0x0300, // 3 slot EDR packts
738     0x3000, // 5 slot EDR packet
739 };
740 
741 static uint16_t hci_acl_packet_types_for_buffer_size_and_local_features(uint16_t buffer_size, uint8_t * local_supported_features){
742     // enable packet types based on size
743     uint16_t packet_types = 0;
744     unsigned int i;
745     for (i=0;i<16;i++){
746         if (packet_type_sizes[i] == 0) continue;
747         if (packet_type_sizes[i] <= buffer_size){
748             packet_types |= 1 << i;
749         }
750     }
751     // disable packet types due to missing local supported features
752     for (i=0;i<sizeof(packet_type_feature_requirement_bit);i++){
753         int bit_idx = packet_type_feature_requirement_bit[i];
754         int feature_set = (local_supported_features[bit_idx >> 3] & (1<<(bit_idx & 7))) != 0;
755         if (feature_set) continue;
756         log_info("Features bit %02u is not set, removing packet types 0x%04x", bit_idx, packet_type_feature_packet_mask[i]);
757         packet_types &= ~packet_type_feature_packet_mask[i];
758     }
759     // flip bits for "may not be used"
760     packet_types ^= 0x3306;
761     return packet_types;
762 }
763 
764 uint16_t hci_usable_acl_packet_types(void){
765     return hci_stack->packet_types;
766 }
767 
768 uint8_t* hci_get_outgoing_packet_buffer(void){
769     // hci packet buffer is >= acl data packet length
770     return hci_stack->hci_packet_buffer;
771 }
772 
773 uint16_t hci_max_acl_data_packet_length(void){
774     return hci_stack->acl_data_packet_length;
775 }
776 
777 int hci_non_flushable_packet_boundary_flag_supported(void){
778     // No. 54, byte 6, bit 6
779     return (hci_stack->local_supported_features[6] & (1 << 6)) != 0;
780 }
781 
782 static int hci_ssp_supported(void){
783     // No. 51, byte 6, bit 3
784     return (hci_stack->local_supported_features[6] & (1 << 3)) != 0;
785 }
786 
787 static int hci_classic_supported(void){
788     // No. 37, byte 4, bit 5, = No BR/EDR Support
789     return (hci_stack->local_supported_features[4] & (1 << 5)) == 0;
790 }
791 
792 static int hci_le_supported(void){
793 #ifdef ENABLE_BLE
794     // No. 37, byte 4, bit 6 = LE Supported (Controller)
795     return (hci_stack->local_supported_features[4] & (1 << 6)) != 0;
796 #else
797     return 0;
798 #endif
799 }
800 
801 // get addr type and address used in advertisement packets
802 void hci_le_advertisement_address(uint8_t * addr_type, bd_addr_t  addr){
803     *addr_type = hci_stack->adv_addr_type;
804     if (hci_stack->adv_addr_type){
805         memcpy(addr, hci_stack->adv_address, 6);
806     } else {
807         memcpy(addr, hci_stack->local_bd_addr, 6);
808     }
809 }
810 
811 #ifdef ENABLE_BLE
812 void le_handle_advertisement_report(uint8_t *packet, int size){
813     int offset = 3;
814     int num_reports = packet[offset];
815     offset += 1;
816 
817     int i;
818     log_info("HCI: handle adv report with num reports: %d", num_reports);
819     uint8_t event[12 + LE_ADVERTISING_DATA_SIZE]; // use upper bound to avoid var size automatic var
820     for (i=0; i<num_reports;i++){
821         uint8_t data_length = packet[offset + 8];
822         uint8_t event_size = 10 + data_length;
823         int pos = 0;
824         event[pos++] = GAP_LE_ADVERTISING_REPORT;
825         event[pos++] = event_size;
826         memcpy(&event[pos], &packet[offset], 1+1+6); // event type + address type + address
827         offset += 8;
828         pos += 8;
829         event[pos++] = packet[offset + 1 + data_length]; // rssi
830         event[pos++] = packet[offset++]; //data_length;
831         memcpy(&event[pos], &packet[offset], data_length);
832         pos += data_length;
833         offset += data_length + 1; // rssi
834         hci_dump_packet( HCI_EVENT_PACKET, 0, event, pos);
835         hci_stack->packet_handler(HCI_EVENT_PACKET, event, pos);
836     }
837 }
838 #endif
839 
840 static uint32_t hci_transport_uart_get_main_baud_rate(void){
841     if (!hci_stack->config) return 0;
842     uint32_t baud_rate = ((hci_transport_config_uart_t *)hci_stack->config)->baudrate_main;
843     // Limit baud rate for Broadcom chipsets to 3 mbps
844     if (hci_stack->manufacturer == COMPANY_ID_BROADCOM_CORPORATION && baud_rate > 3000000){
845         baud_rate = 3000000;
846     }
847     return baud_rate;
848 }
849 
850 static void hci_initialization_timeout_handler(btstack_timer_source_t * ds){
851     switch (hci_stack->substate){
852         case HCI_INIT_W4_SEND_RESET:
853             log_info("Resend HCI Reset");
854             hci_stack->substate = HCI_INIT_SEND_RESET;
855             hci_stack->num_cmd_packets = 1;
856             hci_run();
857             break;
858         case HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT:
859             log_info("Resend HCI Reset - CSR Warm Boot");
860             hci_stack->substate = HCI_INIT_SEND_RESET_CSR_WARM_BOOT;
861             hci_stack->num_cmd_packets = 1;
862             hci_run();
863             break;
864         case HCI_INIT_W4_SEND_BAUD_CHANGE: {
865 			uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
866             log_info("Local baud rate change to %"PRIu32, baud_rate);
867             hci_stack->hci_transport->set_baudrate(baud_rate);
868             // For CSR, HCI Reset is sent on new baud rate
869             if (hci_stack->manufacturer == COMPANY_ID_CAMBRIDGE_SILICON_RADIO){
870                 hci_stack->substate = HCI_INIT_SEND_RESET_CSR_WARM_BOOT;
871                 hci_run();
872             }
873             break;
874         }
875         default:
876             break;
877     }
878 }
879 
880 static void hci_initializing_next_state(void){
881     hci_stack->substate = (hci_substate_t )( ((int) hci_stack->substate) + 1);
882 }
883 
884 // assumption: hci_can_send_command_packet_now() == true
885 static void hci_initializing_run(void){
886     log_info("hci_initializing_run: substate %u", hci_stack->substate);
887     switch (hci_stack->substate){
888         case HCI_INIT_SEND_RESET:
889             hci_state_reset();
890 
891 #ifndef HAVE_PLATFORM_IPHONE_OS
892             // prepare reset if command complete not received in 100ms
893             btstack_run_loop_set_timer(&hci_stack->timeout, 100);
894             btstack_run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
895             btstack_run_loop_add_timer(&hci_stack->timeout);
896 #endif
897             // send command
898             hci_stack->substate = HCI_INIT_W4_SEND_RESET;
899             hci_send_cmd(&hci_reset);
900             break;
901         case HCI_INIT_SEND_READ_LOCAL_VERSION_INFORMATION:
902             hci_send_cmd(&hci_read_local_version_information);
903             hci_stack->substate = HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION;
904             break;
905         case HCI_INIT_SEND_RESET_CSR_WARM_BOOT:
906             hci_state_reset();
907             // prepare reset if command complete not received in 100ms
908             btstack_run_loop_set_timer(&hci_stack->timeout, 100);
909             btstack_run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
910             btstack_run_loop_add_timer(&hci_stack->timeout);
911             // send command
912             hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT;
913             hci_send_cmd(&hci_reset);
914             break;
915         case HCI_INIT_SEND_RESET_ST_WARM_BOOT:
916             hci_state_reset();
917             hci_stack->substate = HCI_INIT_W4_SEND_RESET_ST_WARM_BOOT;
918             hci_send_cmd(&hci_reset);
919             break;
920         case HCI_INIT_SEND_BAUD_CHANGE: {
921             uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
922             hci_stack->control->baudrate_cmd(hci_stack->config, baud_rate, hci_stack->hci_packet_buffer);
923             hci_stack->last_cmd_opcode = READ_BT_16(hci_stack->hci_packet_buffer, 0);
924             hci_stack->substate = HCI_INIT_W4_SEND_BAUD_CHANGE;
925             hci_send_cmd_packet(hci_stack->hci_packet_buffer, 3 + hci_stack->hci_packet_buffer[2]);
926             // STLC25000D: baudrate change happens within 0.5 s after command was send,
927             // use timer to update baud rate after 100 ms (knowing exactly, when command was sent is non-trivial)
928             if (hci_stack->manufacturer == COMPANY_ID_ST_MICROELECTRONICS){
929                 btstack_run_loop_set_timer(&hci_stack->timeout, 100);
930                 btstack_run_loop_add_timer(&hci_stack->timeout);
931             }
932             break;
933         }
934         case HCI_INIT_SEND_BAUD_CHANGE_BCM: {
935             uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
936             hci_stack->control->baudrate_cmd(hci_stack->config, baud_rate, hci_stack->hci_packet_buffer);
937             hci_stack->last_cmd_opcode = READ_BT_16(hci_stack->hci_packet_buffer, 0);
938             hci_stack->substate = HCI_INIT_W4_SEND_BAUD_CHANGE_BCM;
939             hci_send_cmd_packet(hci_stack->hci_packet_buffer, 3 + hci_stack->hci_packet_buffer[2]);
940             break;
941         }
942         case HCI_INIT_CUSTOM_INIT:
943             log_info("Custom init");
944             // Custom initialization
945             if (hci_stack->control && hci_stack->control->next_cmd){
946                 int valid_cmd = (*hci_stack->control->next_cmd)(hci_stack->config, hci_stack->hci_packet_buffer);
947                 if (valid_cmd){
948                     int size = 3 + hci_stack->hci_packet_buffer[2];
949                     hci_stack->last_cmd_opcode = READ_BT_16(hci_stack->hci_packet_buffer, 0);
950                     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, hci_stack->hci_packet_buffer, size);
951                     switch (valid_cmd) {
952                         case 1:
953                         default:
954                             hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT;
955                             break;
956                         case 2: // CSR Warm Boot: Wait a bit, then send HCI Reset until HCI Command Complete
957                             log_info("CSR Warm Boot");
958                             btstack_run_loop_set_timer(&hci_stack->timeout, 100);
959                             btstack_run_loop_set_timer_handler(&hci_stack->timeout, hci_initialization_timeout_handler);
960                             btstack_run_loop_add_timer(&hci_stack->timeout);
961                             if (hci_stack->manufacturer == COMPANY_ID_CAMBRIDGE_SILICON_RADIO
962                                 && hci_stack->config
963                                 && hci_stack->control
964                                 // && hci_stack->control->baudrate_cmd -- there's no such command
965                                 && hci_stack->hci_transport->set_baudrate
966                                 && hci_transport_uart_get_main_baud_rate()){
967                                 hci_stack->substate = HCI_INIT_W4_SEND_BAUD_CHANGE;
968                             } else {
969                                hci_stack->substate = HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT;
970                             }
971                             break;
972                     }
973                     hci_stack->hci_transport->send_packet(HCI_COMMAND_DATA_PACKET, hci_stack->hci_packet_buffer, size);
974                     break;
975                 }
976                 log_info("hci_run: init script done");
977 
978                 // Init script download causes baud rate to reset on Broadcom chipsets, restore UART baud rate if needed
979                 if (hci_stack->manufacturer == COMPANY_ID_BROADCOM_CORPORATION){
980                     int need_baud_change = hci_stack->config
981                         && hci_stack->control
982                         && hci_stack->control->baudrate_cmd
983                         && hci_stack->hci_transport->set_baudrate
984                         && ((hci_transport_config_uart_t *)hci_stack->config)->baudrate_main;
985                     if (need_baud_change) {
986                         uint32_t baud_rate = ((hci_transport_config_uart_t *)hci_stack->config)->baudrate_init;
987                         log_info("Local baud rate change to %"PRIu32" after init script", baud_rate);
988                         hci_stack->hci_transport->set_baudrate(baud_rate);
989                     }
990                 }
991             }
992             // otherwise continue
993             hci_stack->substate = HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS;
994             hci_send_cmd(&hci_read_local_supported_commands);
995             break;
996         case HCI_INIT_SET_BD_ADDR:
997             log_info("Set Public BD ADDR to %s", bd_addr_to_str(hci_stack->custom_bd_addr));
998             hci_stack->control->set_bd_addr_cmd(hci_stack->config, hci_stack->custom_bd_addr, hci_stack->hci_packet_buffer);
999             hci_stack->last_cmd_opcode = READ_BT_16(hci_stack->hci_packet_buffer, 0);
1000             hci_stack->substate = HCI_INIT_W4_SET_BD_ADDR;
1001             hci_send_cmd_packet(hci_stack->hci_packet_buffer, 3 + hci_stack->hci_packet_buffer[2]);
1002             break;
1003         case HCI_INIT_READ_BD_ADDR:
1004             hci_stack->substate = HCI_INIT_W4_READ_BD_ADDR;
1005             hci_send_cmd(&hci_read_bd_addr);
1006             break;
1007         case HCI_INIT_READ_BUFFER_SIZE:
1008             hci_stack->substate = HCI_INIT_W4_READ_BUFFER_SIZE;
1009             hci_send_cmd(&hci_read_buffer_size);
1010             break;
1011         case HCI_INIT_READ_LOCAL_SUPPORTED_FEATURES:
1012             hci_stack->substate = HCI_INIT_W4_READ_LOCAL_SUPPORTED_FEATURES;
1013             hci_send_cmd(&hci_read_local_supported_features);
1014             break;
1015         case HCI_INIT_SET_EVENT_MASK:
1016             hci_stack->substate = HCI_INIT_W4_SET_EVENT_MASK;
1017             if (hci_le_supported()){
1018                 hci_send_cmd(&hci_set_event_mask,0xffffffff, 0x3FFFFFFF);
1019             } else {
1020                 // Kensington Bluetooth 2.1 USB Dongle (CSR Chipset) returns an error for 0xffff...
1021                 hci_send_cmd(&hci_set_event_mask,0xffffffff, 0x1FFFFFFF);
1022             }
1023             break;
1024         case HCI_INIT_WRITE_SIMPLE_PAIRING_MODE:
1025             hci_stack->substate = HCI_INIT_W4_WRITE_SIMPLE_PAIRING_MODE;
1026             hci_send_cmd(&hci_write_simple_pairing_mode, hci_stack->ssp_enable);
1027             break;
1028         case HCI_INIT_WRITE_PAGE_TIMEOUT:
1029             hci_stack->substate = HCI_INIT_W4_WRITE_PAGE_TIMEOUT;
1030             hci_send_cmd(&hci_write_page_timeout, 0x6000);  // ca. 15 sec
1031             break;
1032         case HCI_INIT_WRITE_CLASS_OF_DEVICE:
1033             hci_stack->substate = HCI_INIT_W4_WRITE_CLASS_OF_DEVICE;
1034             hci_send_cmd(&hci_write_class_of_device, hci_stack->class_of_device);
1035             break;
1036         case HCI_INIT_WRITE_LOCAL_NAME:
1037             hci_stack->substate = HCI_INIT_W4_WRITE_LOCAL_NAME;
1038             if (hci_stack->local_name){
1039                 hci_send_cmd(&hci_write_local_name, hci_stack->local_name);
1040             } else {
1041                 char local_name[30];
1042                 // BTstack-11:22:33:44:55:66
1043                 strcpy(local_name, "BTstack ");
1044                 strcat(local_name, bd_addr_to_str(hci_stack->local_bd_addr));
1045                 log_info("---> Name %s", local_name);
1046                 hci_send_cmd(&hci_write_local_name, local_name);
1047             }
1048             break;
1049         case HCI_INIT_WRITE_SCAN_ENABLE:
1050             hci_send_cmd(&hci_write_scan_enable, (hci_stack->connectable << 1) | hci_stack->discoverable); // page scan
1051             hci_stack->substate = HCI_INIT_W4_WRITE_SCAN_ENABLE;
1052             break;
1053         case HCI_INIT_WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE:
1054             hci_stack->substate = HCI_INIT_W4_WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE;
1055             hci_send_cmd(&hci_write_synchronous_flow_control_enable, 1); // SCO tracking enabled
1056             break;
1057 #ifdef ENABLE_BLE
1058         // LE INIT
1059         case HCI_INIT_LE_READ_BUFFER_SIZE:
1060             hci_stack->substate = HCI_INIT_W4_LE_READ_BUFFER_SIZE;
1061             hci_send_cmd(&hci_le_read_buffer_size);
1062             break;
1063         case HCI_INIT_WRITE_LE_HOST_SUPPORTED:
1064             // LE Supported Host = 1, Simultaneous Host = 0
1065             hci_stack->substate = HCI_INIT_W4_WRITE_LE_HOST_SUPPORTED;
1066             hci_send_cmd(&hci_write_le_host_supported, 1, 0);
1067             break;
1068         case HCI_INIT_READ_WHITE_LIST_SIZE:
1069             hci_stack->substate = HCI_INIT_W4_READ_WHITE_LIST_SIZE;
1070             hci_send_cmd(&hci_le_read_white_list_size);
1071             break;
1072         case HCI_INIT_LE_SET_SCAN_PARAMETERS:
1073             // LE Scan Parameters: active scanning, 300 ms interval, 30 ms window, public address, accept all advs
1074             hci_stack->substate = HCI_INIT_W4_LE_SET_SCAN_PARAMETERS;
1075             hci_send_cmd(&hci_le_set_scan_parameters, 1, 0x1e0, 0x30, 0, 0);
1076             break;
1077 #endif
1078         // DONE
1079         case HCI_INIT_DONE:
1080             // done.
1081             hci_stack->state = HCI_STATE_WORKING;
1082             hci_emit_state();
1083             return;
1084         default:
1085             return;
1086     }
1087 }
1088 
1089 static void hci_initializing_event_handler(uint8_t * packet, uint16_t size){
1090     uint8_t command_completed = 0;
1091 
1092     if (packet[0] == HCI_EVENT_COMMAND_COMPLETE){
1093         uint16_t opcode = READ_BT_16(packet,3);
1094         if (opcode == hci_stack->last_cmd_opcode){
1095             command_completed = 1;
1096             log_info("Command complete for expected opcode %04x at substate %u", opcode, hci_stack->substate);
1097         } else {
1098             log_info("Command complete for opcode %04x, expected %04x", opcode, hci_stack->last_cmd_opcode);
1099         }
1100     }
1101 
1102     if (packet[0] == HCI_EVENT_COMMAND_STATUS){
1103         uint8_t  status = packet[2];
1104         uint16_t opcode = READ_BT_16(packet,4);
1105         if (opcode == hci_stack->last_cmd_opcode){
1106             if (status){
1107                 command_completed = 1;
1108                 log_error("Command status error 0x%02x for expected opcode %04x at substate %u", status, opcode, hci_stack->substate);
1109             } else {
1110                 log_info("Command status OK for expected opcode %04x, waiting for command complete", opcode);
1111             }
1112         } else {
1113             log_info("Command status for opcode %04x, expected %04x", opcode, hci_stack->last_cmd_opcode);
1114         }
1115     }
1116 
1117     // Vendor == CSR
1118     if (hci_stack->substate == HCI_INIT_W4_CUSTOM_INIT && packet[0] == HCI_EVENT_VENDOR_SPECIFIC){
1119         // TODO: track actual command
1120         command_completed = 1;
1121     }
1122 
1123     // Vendor == Toshiba
1124     if (hci_stack->substate == HCI_INIT_W4_SEND_BAUD_CHANGE && packet[0] == HCI_EVENT_VENDOR_SPECIFIC){
1125         // TODO: track actual command
1126         command_completed = 1;
1127     }
1128 
1129     // Late response (> 100 ms) for HCI Reset e.g. on Toshiba TC35661:
1130     // Command complete for HCI Reset arrives after we've resent the HCI Reset command
1131     //
1132     // HCI Reset
1133     // Timeout 100 ms
1134     // HCI Reset
1135     // Command Complete Reset
1136     // HCI Read Local Version Information
1137     // Command Complete Reset - but we expected Command Complete Read Local Version Information
1138     // hang...
1139     //
1140     // Fix: Command Complete for HCI Reset in HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION trigger resend
1141     if (!command_completed
1142             && packet[0] == HCI_EVENT_COMMAND_COMPLETE
1143             && hci_stack->substate == HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION){
1144 
1145         uint16_t opcode = READ_BT_16(packet,3);
1146         if (opcode == hci_reset.opcode){
1147             hci_stack->substate = HCI_INIT_SEND_READ_LOCAL_VERSION_INFORMATION;
1148             return;
1149         }
1150     }
1151 
1152 
1153 
1154     if (!command_completed) return;
1155 
1156     int need_baud_change = hci_stack->config
1157                         && hci_stack->control
1158                         && hci_stack->control->baudrate_cmd
1159                         && hci_stack->hci_transport->set_baudrate
1160                         && ((hci_transport_config_uart_t *)hci_stack->config)->baudrate_main;
1161 
1162     int need_addr_change = hci_stack->custom_bd_addr_set
1163                         && hci_stack->control
1164                         && hci_stack->control->set_bd_addr_cmd;
1165 
1166     switch(hci_stack->substate){
1167         case HCI_INIT_W4_SEND_RESET:
1168             btstack_run_loop_remove_timer(&hci_stack->timeout);
1169             break;
1170         case HCI_INIT_W4_SEND_READ_LOCAL_VERSION_INFORMATION:
1171             if (need_baud_change){
1172                 hci_stack->substate = HCI_INIT_SEND_BAUD_CHANGE;
1173                 return;
1174             }
1175             // skip baud change
1176             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1177             return;
1178         case HCI_INIT_W4_SEND_BAUD_CHANGE:
1179             // for STLC2500D, baud rate change already happened.
1180             // for others, baud rate gets changed now
1181             if (hci_stack->manufacturer != COMPANY_ID_ST_MICROELECTRONICS){
1182                 uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
1183                 log_info("Local baud rate change to %"PRIu32, baud_rate);
1184                 hci_stack->hci_transport->set_baudrate(baud_rate);
1185             }
1186             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1187             return;
1188         case HCI_INIT_W4_CUSTOM_INIT_CSR_WARM_BOOT:
1189             btstack_run_loop_remove_timer(&hci_stack->timeout);
1190             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1191             return;
1192         case HCI_INIT_W4_CUSTOM_INIT:
1193             // repeat custom init
1194             hci_stack->substate = HCI_INIT_CUSTOM_INIT;
1195             return;
1196         case HCI_INIT_W4_READ_LOCAL_SUPPORTED_COMMANDS:
1197             if (need_baud_change && hci_stack->manufacturer == COMPANY_ID_BROADCOM_CORPORATION){
1198                 hci_stack->substate = HCI_INIT_SEND_BAUD_CHANGE_BCM;
1199                 return;
1200             }
1201             if (need_addr_change){
1202                 hci_stack->substate = HCI_INIT_SET_BD_ADDR;
1203                 return;
1204             }
1205             hci_stack->substate = HCI_INIT_READ_BD_ADDR;
1206             return;
1207         case HCI_INIT_W4_SEND_BAUD_CHANGE_BCM: {
1208             uint32_t baud_rate = hci_transport_uart_get_main_baud_rate();
1209             log_info("Local baud rate change to %"PRIu32" after init script", baud_rate);
1210             hci_stack->hci_transport->set_baudrate(baud_rate);
1211             if (need_addr_change){
1212                 hci_stack->substate = HCI_INIT_SET_BD_ADDR;
1213                 return;
1214             }
1215             hci_stack->substate = HCI_INIT_READ_BD_ADDR;
1216             return;
1217         }
1218         case HCI_INIT_W4_SET_BD_ADDR:
1219             // for STLC2500D, bd addr change only gets active after sending reset command
1220             if (hci_stack->manufacturer == COMPANY_ID_ST_MICROELECTRONICS){
1221                 hci_stack->substate = HCI_INIT_SEND_RESET_ST_WARM_BOOT;
1222                 return;
1223             }
1224             // skipping st warm boot
1225             hci_stack->substate = HCI_INIT_READ_BD_ADDR;
1226             return;
1227         case HCI_INIT_W4_SEND_RESET_ST_WARM_BOOT:
1228             hci_stack->substate = HCI_INIT_READ_BD_ADDR;
1229             return;
1230         case HCI_INIT_W4_READ_BD_ADDR:
1231             // only read buffer size if supported
1232             if (hci_stack->local_supported_commands[0] & 0x01) {
1233                 hci_stack->substate = HCI_INIT_READ_BUFFER_SIZE;
1234                 return;
1235             }
1236             // skipping read buffer size
1237             hci_stack->substate = HCI_INIT_READ_LOCAL_SUPPORTED_FEATURES;
1238             return;
1239         case HCI_INIT_W4_SET_EVENT_MASK:
1240             // skip Classic init commands for LE only chipsets
1241             if (!hci_classic_supported()){
1242                 if (hci_le_supported()){
1243                     hci_stack->substate = HCI_INIT_LE_READ_BUFFER_SIZE; // skip all classic command
1244                     return;
1245                 } else {
1246                     log_error("Neither BR/EDR nor LE supported");
1247                     hci_stack->substate = HCI_INIT_DONE; // skip all
1248                     return;
1249                 }
1250             }
1251             if (!hci_ssp_supported()){
1252                 hci_stack->substate = HCI_INIT_WRITE_PAGE_TIMEOUT;
1253                 return;
1254             }
1255             break;
1256         case HCI_INIT_W4_WRITE_PAGE_TIMEOUT:
1257             break;
1258         case HCI_INIT_W4_LE_READ_BUFFER_SIZE:
1259             // skip write le host if not supported (e.g. on LE only EM9301)
1260             if (hci_stack->local_supported_commands[0] & 0x02) break;
1261             hci_stack->substate = HCI_INIT_LE_SET_SCAN_PARAMETERS;
1262             return;
1263 
1264 #ifdef HAVE_SCO_OVER_HCI
1265         case HCI_INIT_W4_WRITE_SCAN_ENABLE:
1266             // just go to next state
1267             break;
1268         case HCI_INIT_W4_WRITE_SYNCHRONOUS_FLOW_CONTROL_ENABLE:
1269             if (!hci_le_supported()){
1270                 // SKIP LE init for Classic only configuration
1271                 hci_stack->substate = HCI_INIT_DONE;
1272                 return;
1273             }
1274             break;
1275 #else
1276         case HCI_INIT_W4_WRITE_SCAN_ENABLE:
1277             if (!hci_le_supported()){
1278                 // SKIP LE init for Classic only configuration
1279                 hci_stack->substate = HCI_INIT_DONE;
1280                 return;
1281             }
1282 #endif
1283             break;
1284         default:
1285             break;
1286     }
1287     hci_initializing_next_state();
1288 }
1289 
1290 static void event_handler(uint8_t *packet, int size){
1291 
1292     uint16_t event_length = packet[1];
1293 
1294     // assert packet is complete
1295     if (size != event_length + 2){
1296         log_error("hci.c: event_handler called with event packet of wrong size %u, expected %u => dropping packet", size, event_length + 2);
1297         return;
1298     }
1299 
1300     bd_addr_t addr;
1301     bd_addr_type_t addr_type;
1302     uint8_t link_type;
1303     hci_con_handle_t handle;
1304     hci_connection_t * conn;
1305     int i;
1306 
1307     // log_info("HCI:EVENT:%02x", packet[0]);
1308 
1309     switch (packet[0]) {
1310 
1311         case HCI_EVENT_COMMAND_COMPLETE:
1312             // get num cmd packets
1313             // log_info("HCI_EVENT_COMMAND_COMPLETE cmds old %u - new %u", hci_stack->num_cmd_packets, packet[2]);
1314             hci_stack->num_cmd_packets = packet[2];
1315 
1316             if (COMMAND_COMPLETE_EVENT(packet, hci_read_buffer_size)){
1317                 // from offset 5
1318                 // status
1319                 // "The HC_ACL_Data_Packet_Length return parameter will be used to determine the size of the L2CAP segments contained in ACL Data Packets"
1320                 hci_stack->acl_data_packet_length = READ_BT_16(packet, 6);
1321                 hci_stack->sco_data_packet_length = packet[8];
1322                 hci_stack->acl_packets_total_num  = READ_BT_16(packet, 9);
1323                 hci_stack->sco_packets_total_num  = READ_BT_16(packet, 11);
1324 
1325                 if (hci_stack->state == HCI_STATE_INITIALIZING){
1326                     // determine usable ACL payload size
1327                     if (HCI_ACL_PAYLOAD_SIZE < hci_stack->acl_data_packet_length){
1328                         hci_stack->acl_data_packet_length = HCI_ACL_PAYLOAD_SIZE;
1329                     }
1330                     log_info("hci_read_buffer_size: acl used size %u, count %u / sco size %u, count %u",
1331                              hci_stack->acl_data_packet_length, hci_stack->acl_packets_total_num,
1332                              hci_stack->sco_data_packet_length, hci_stack->sco_packets_total_num);
1333                 }
1334             }
1335 #ifdef ENABLE_BLE
1336             if (COMMAND_COMPLETE_EVENT(packet, hci_le_read_buffer_size)){
1337                 hci_stack->le_data_packets_length = READ_BT_16(packet, 6);
1338                 hci_stack->le_acl_packets_total_num  = packet[8];
1339                     // determine usable ACL payload size
1340                     if (HCI_ACL_PAYLOAD_SIZE < hci_stack->le_data_packets_length){
1341                         hci_stack->le_data_packets_length = HCI_ACL_PAYLOAD_SIZE;
1342                     }
1343                 log_info("hci_le_read_buffer_size: size %u, count %u", hci_stack->le_data_packets_length, hci_stack->le_acl_packets_total_num);
1344             }
1345             if (COMMAND_COMPLETE_EVENT(packet, hci_le_read_white_list_size)){
1346                 hci_stack->le_whitelist_capacity = READ_BT_16(packet, 6);
1347                 log_info("hci_le_read_white_list_size: size %u", hci_stack->le_whitelist_capacity);
1348             }
1349 #endif
1350             // Dump local address
1351             if (COMMAND_COMPLETE_EVENT(packet, hci_read_bd_addr)) {
1352                 bt_flip_addr(hci_stack->local_bd_addr, &packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE + 1]);
1353                 log_info("Local Address, Status: 0x%02x: Addr: %s",
1354                     packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE], bd_addr_to_str(hci_stack->local_bd_addr));
1355             }
1356             if (COMMAND_COMPLETE_EVENT(packet, hci_write_scan_enable)){
1357                 hci_emit_discoverable_enabled(hci_stack->discoverable);
1358             }
1359             // Note: HCI init checks
1360             if (COMMAND_COMPLETE_EVENT(packet, hci_read_local_supported_features)){
1361                 memcpy(hci_stack->local_supported_features, &packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1], 8);
1362 
1363                 // determine usable ACL packet types based on host buffer size and supported features
1364                 hci_stack->packet_types = hci_acl_packet_types_for_buffer_size_and_local_features(HCI_ACL_PAYLOAD_SIZE, &hci_stack->local_supported_features[0]);
1365                 log_info("packet types %04x", hci_stack->packet_types);
1366 
1367                 // Classic/LE
1368                 log_info("BR/EDR support %u, LE support %u", hci_classic_supported(), hci_le_supported());
1369             }
1370             if (COMMAND_COMPLETE_EVENT(packet, hci_read_local_version_information)){
1371                 // hci_stack->hci_version    = READ_BT_16(packet, 4);
1372                 // hci_stack->hci_revision   = READ_BT_16(packet, 6);
1373                 // hci_stack->lmp_version    = READ_BT_16(packet, 8);
1374                 hci_stack->manufacturer   = READ_BT_16(packet, 10);
1375                 // hci_stack->lmp_subversion = READ_BT_16(packet, 12);
1376                 log_info("Manufacturer: 0x%04x", hci_stack->manufacturer);
1377             }
1378             if (COMMAND_COMPLETE_EVENT(packet, hci_read_local_supported_commands)){
1379                 hci_stack->local_supported_commands[0] =
1380                     (packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1+14] & 0X80) >> 7 |  // Octet 14, bit 7
1381                     (packet[OFFSET_OF_DATA_IN_COMMAND_COMPLETE+1+24] & 0x40) >> 5;   // Octet 24, bit 6
1382             }
1383             if (COMMAND_COMPLETE_EVENT(packet, hci_write_synchronous_flow_control_enable)){
1384                 if (packet[5] == 0){
1385                     hci_stack->synchronous_flow_control_enabled = 1;
1386                 }
1387             }
1388             break;
1389 
1390         case HCI_EVENT_COMMAND_STATUS:
1391             // get num cmd packets
1392             // log_info("HCI_EVENT_COMMAND_STATUS cmds - old %u - new %u", hci_stack->num_cmd_packets, packet[3]);
1393             hci_stack->num_cmd_packets = packet[3];
1394             break;
1395 
1396         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:{
1397             int offset = 3;
1398             for (i=0; i<packet[2];i++){
1399                 handle = READ_BT_16(packet, offset);
1400                 offset += 2;
1401                 uint16_t num_packets = READ_BT_16(packet, offset);
1402                 offset += 2;
1403 
1404                 conn = hci_connection_for_handle(handle);
1405                 if (!conn){
1406                     log_error("hci_number_completed_packet lists unused con handle %u", handle);
1407                     continue;
1408                 }
1409 
1410                 if (conn->address_type == BD_ADDR_TYPE_SCO){
1411                     if (conn->num_sco_packets_sent >= num_packets){
1412                         conn->num_sco_packets_sent -= num_packets;
1413                     } else {
1414                         log_error("hci_number_completed_packets, more sco slots freed then sent.");
1415                         conn->num_sco_packets_sent = 0;
1416                     }
1417 
1418                 } else {
1419                     if (conn->num_acl_packets_sent >= num_packets){
1420                         conn->num_acl_packets_sent -= num_packets;
1421                     } else {
1422                         log_error("hci_number_completed_packets, more acl slots freed then sent.");
1423                         conn->num_acl_packets_sent = 0;
1424                     }
1425                 }
1426                 // log_info("hci_number_completed_packet %u processed for handle %u, outstanding %u", num_packets, handle, conn->num_acl_packets_sent);
1427             }
1428             break;
1429         }
1430         case HCI_EVENT_CONNECTION_REQUEST:
1431             bt_flip_addr(addr, &packet[2]);
1432             // TODO: eval COD 8-10
1433             link_type = packet[11];
1434             log_info("Connection_incoming: %s, type %u", bd_addr_to_str(addr), link_type);
1435             addr_type = link_type == 1 ? BD_ADDR_TYPE_CLASSIC : BD_ADDR_TYPE_SCO;
1436             conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
1437             if (!conn) {
1438                 conn = create_connection_for_bd_addr_and_type(addr, addr_type);
1439             }
1440             if (!conn) {
1441                 // CONNECTION REJECTED DUE TO LIMITED RESOURCES (0X0D)
1442                 hci_stack->decline_reason = 0x0d;
1443                 BD_ADDR_COPY(hci_stack->decline_addr, addr);
1444                 break;
1445             }
1446             conn->role  = HCI_ROLE_SLAVE;
1447             conn->state = RECEIVED_CONNECTION_REQUEST;
1448             // store info about eSCO
1449             if (link_type == 0x02){
1450                 conn->remote_supported_feature_eSCO = 1;
1451             }
1452             hci_run();
1453             break;
1454 
1455         case HCI_EVENT_CONNECTION_COMPLETE:
1456             // Connection management
1457             bt_flip_addr(addr, &packet[5]);
1458             log_info("Connection_complete (status=%u) %s", packet[2], bd_addr_to_str(addr));
1459             addr_type = BD_ADDR_TYPE_CLASSIC;
1460             conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
1461             if (conn) {
1462                 if (!packet[2]){
1463                     conn->state = OPEN;
1464                     conn->con_handle = READ_BT_16(packet, 3);
1465                     conn->bonding_flags |= BONDING_REQUEST_REMOTE_FEATURES;
1466 
1467                     // restart timer
1468                     btstack_run_loop_set_timer(&conn->timeout, HCI_CONNECTION_TIMEOUT_MS);
1469                     btstack_run_loop_add_timer(&conn->timeout);
1470 
1471                     log_info("New connection: handle %u, %s", conn->con_handle, bd_addr_to_str(conn->address));
1472 
1473                     hci_emit_nr_connections_changed();
1474                 } else {
1475                     int notify_dedicated_bonding_failed = conn->bonding_flags & BONDING_DEDICATED;
1476                     uint8_t status = packet[2];
1477                     bd_addr_t bd_address;
1478                     memcpy(&bd_address, conn->address, 6);
1479 
1480                     // connection failed, remove entry
1481                     btstack_linked_list_remove(&hci_stack->connections, (btstack_linked_item_t *) conn);
1482                     btstack_memory_hci_connection_free( conn );
1483 
1484                     // notify client if dedicated bonding
1485                     if (notify_dedicated_bonding_failed){
1486                         log_info("hci notify_dedicated_bonding_failed");
1487                         hci_emit_dedicated_bonding_result(bd_address, status);
1488                     }
1489 
1490                     // if authentication error, also delete link key
1491                     if (packet[2] == 0x05) {
1492                         hci_drop_link_key_for_bd_addr(addr);
1493                     }
1494                 }
1495             }
1496             break;
1497 
1498         case HCI_EVENT_SYNCHRONOUS_CONNECTION_COMPLETE:
1499             bt_flip_addr(addr, &packet[5]);
1500             log_info("Synchronous Connection Complete (status=%u) %s", packet[2], bd_addr_to_str(addr));
1501             if (packet[2]){
1502                 // connection failed
1503                 break;
1504             }
1505             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_SCO);
1506             if (!conn) {
1507                 conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_SCO);
1508             }
1509             if (!conn) {
1510                 break;
1511             }
1512             conn->state = OPEN;
1513             conn->con_handle = READ_BT_16(packet, 3);
1514             break;
1515 
1516         case HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE:
1517             handle = READ_BT_16(packet, 3);
1518             conn = hci_connection_for_handle(handle);
1519             if (!conn) break;
1520             if (!packet[2]){
1521                 uint8_t * features = &packet[5];
1522                 if (features[6] & (1 << 3)){
1523                     conn->bonding_flags |= BONDING_REMOTE_SUPPORTS_SSP;
1524                 }
1525                 if (features[3] & (1<<7)){
1526                     conn->remote_supported_feature_eSCO = 1;
1527                 }
1528             }
1529             conn->bonding_flags |= BONDING_RECEIVED_REMOTE_FEATURES;
1530             log_info("HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE, bonding flags %x, eSCO %u", conn->bonding_flags, conn->remote_supported_feature_eSCO);
1531             if (conn->bonding_flags & BONDING_DEDICATED){
1532                 conn->bonding_flags |= BONDING_SEND_AUTHENTICATE_REQUEST;
1533             }
1534             break;
1535 
1536         case HCI_EVENT_LINK_KEY_REQUEST:
1537             log_info("HCI_EVENT_LINK_KEY_REQUEST");
1538             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], RECV_LINK_KEY_REQUEST);
1539             // non-bondable mode: link key negative reply will be sent by HANDLE_LINK_KEY_REQUEST
1540             if (hci_stack->bondable && !hci_stack->remote_device_db) break;
1541             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], HANDLE_LINK_KEY_REQUEST);
1542             hci_run();
1543             // request handled by hci_run() as HANDLE_LINK_KEY_REQUEST gets set
1544             return;
1545 
1546         case HCI_EVENT_LINK_KEY_NOTIFICATION: {
1547             bt_flip_addr(addr, &packet[2]);
1548             conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
1549             if (!conn) break;
1550             conn->authentication_flags |= RECV_LINK_KEY_NOTIFICATION;
1551             link_key_type_t link_key_type = (link_key_type_t)packet[24];
1552             // Change Connection Encryption keeps link key type
1553             if (link_key_type != CHANGED_COMBINATION_KEY){
1554                 conn->link_key_type = link_key_type;
1555             }
1556             if (!hci_stack->remote_device_db) break;
1557             hci_stack->remote_device_db->put_link_key(addr, &packet[8], conn->link_key_type);
1558             // still forward event to allow dismiss of pairing dialog
1559             break;
1560         }
1561 
1562         case HCI_EVENT_PIN_CODE_REQUEST:
1563             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], LEGACY_PAIRING_ACTIVE);
1564             // non-bondable mode: pin code negative reply will be sent
1565             if (!hci_stack->bondable){
1566                 hci_add_connection_flags_for_flipped_bd_addr(&packet[2], DENY_PIN_CODE_REQUEST);
1567                 hci_run();
1568                 return;
1569             }
1570             // PIN CODE REQUEST means the link key request didn't succee -> delete stored link key
1571             if (!hci_stack->remote_device_db) break;
1572             bt_flip_addr(addr, &packet[2]);
1573             hci_stack->remote_device_db->delete_link_key(addr);
1574             break;
1575 
1576         case HCI_EVENT_IO_CAPABILITY_REQUEST:
1577             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], RECV_IO_CAPABILITIES_REQUEST);
1578             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_IO_CAPABILITIES_REPLY);
1579             break;
1580 
1581         case HCI_EVENT_USER_CONFIRMATION_REQUEST:
1582             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SSP_PAIRING_ACTIVE);
1583             if (!hci_stack->ssp_auto_accept) break;
1584             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_USER_CONFIRM_REPLY);
1585             break;
1586 
1587         case HCI_EVENT_USER_PASSKEY_REQUEST:
1588             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SSP_PAIRING_ACTIVE);
1589             if (!hci_stack->ssp_auto_accept) break;
1590             hci_add_connection_flags_for_flipped_bd_addr(&packet[2], SEND_USER_PASSKEY_REPLY);
1591             break;
1592 
1593         case HCI_EVENT_ENCRYPTION_CHANGE:
1594             handle = READ_BT_16(packet, 3);
1595             conn = hci_connection_for_handle(handle);
1596             if (!conn) break;
1597             if (packet[2] == 0) {
1598                 if (packet[5]){
1599                     conn->authentication_flags |= CONNECTION_ENCRYPTED;
1600                 } else {
1601                     conn->authentication_flags &= ~CONNECTION_ENCRYPTED;
1602                 }
1603             }
1604             hci_emit_security_level(handle, gap_security_level_for_connection(conn));
1605             break;
1606 
1607         case HCI_EVENT_AUTHENTICATION_COMPLETE_EVENT:
1608             handle = READ_BT_16(packet, 3);
1609             conn = hci_connection_for_handle(handle);
1610             if (!conn) break;
1611 
1612             // dedicated bonding: send result and disconnect
1613             if (conn->bonding_flags & BONDING_DEDICATED){
1614                 conn->bonding_flags &= ~BONDING_DEDICATED;
1615                 conn->bonding_flags |= BONDING_DISCONNECT_DEDICATED_DONE;
1616                 conn->bonding_status = packet[2];
1617                 break;
1618             }
1619 
1620             if (packet[2] == 0 && gap_security_level_for_link_key_type(conn->link_key_type) >= conn->requested_security_level){
1621                 // link key sufficient for requested security
1622                 conn->bonding_flags |= BONDING_SEND_ENCRYPTION_REQUEST;
1623                 break;
1624             }
1625             // not enough
1626             hci_emit_security_level(handle, gap_security_level_for_connection(conn));
1627             break;
1628 
1629         case HCI_EVENT_REMOTE_NAME_REQUEST_COMPLETE:
1630             if (!hci_stack->remote_device_db) break;
1631             if (packet[2]) break; // status not ok
1632             bt_flip_addr(addr, &packet[3]);
1633             // fix for invalid remote names - terminate on 0xff
1634             for (i=0; i<248;i++){
1635                 if (packet[9+i] == 0xff){
1636                     packet[9+i] = 0;
1637                     break;
1638                 }
1639             }
1640             packet[9+248] = 0;
1641             hci_stack->remote_device_db->put_name(addr, (device_name_t *)&packet[9]);
1642             break;
1643 
1644         case HCI_EVENT_INQUIRY_RESULT:
1645         case HCI_EVENT_INQUIRY_RESULT_WITH_RSSI:{
1646             if (!hci_stack->remote_device_db) break;
1647             // first send inq result packet
1648             hci_stack->packet_handler(HCI_EVENT_PACKET, packet, size);
1649             // then send cached remote names
1650             int offset = 3;
1651             for (i=0; i<packet[2];i++){
1652                 bt_flip_addr(addr, &packet[offset]);
1653 
1654                 // consider moving this daemon
1655                 uint8_t event[2+1+6+DEVICE_NAME_LEN+1]; // +1 for \0 in log_info
1656                 if (hci_stack->remote_device_db->get_name(addr, (device_name_t *) &event[9])){
1657                     event[0] = BTSTACK_EVENT_REMOTE_NAME_CACHED;
1658                     event[1] = sizeof(event) - 2 - 1;
1659                     event[2] = 0;   // just to be compatible with HCI_EVENT_REMOTE_NAME_REQUEST_COMPLETE
1660                     bt_flip_addr(&event[3], addr);
1661 
1662                     event[9+248] = 0;   // assert \0 for log_info
1663                     log_info("BTSTACK_EVENT_REMOTE_NAME_CACHED %s = '%s'", bd_addr_to_str(addr), &event[9]);
1664 
1665                     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event)-1);
1666                     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event)-1);
1667                 }
1668                 offset += 14; // 6 + 1 + 1 + 1 + 3 + 2;
1669             }
1670             return;
1671         }
1672 
1673         // HCI_EVENT_DISCONNECTION_COMPLETE
1674         // has been split, to first notify stack before shutting connection down
1675         // see end of function, too.
1676         case HCI_EVENT_DISCONNECTION_COMPLETE:
1677             if (packet[2]) break;   // status != 0
1678             handle = READ_BT_16(packet, 3);
1679             conn = hci_connection_for_handle(handle);
1680             if (!conn) break;       // no conn struct anymore
1681             // re-enable advertisements for le connections if active
1682             if (hci_is_le_connection(conn) && hci_stack->le_advertisements_enabled){
1683                 hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_ENABLE;
1684             }
1685             conn->state = RECEIVED_DISCONNECTION_COMPLETE;
1686             break;
1687 
1688         case HCI_EVENT_HARDWARE_ERROR:
1689             if (hci_stack->hardware_error_callback){
1690                 (*hci_stack->hardware_error_callback)();
1691             } else if(hci_stack->control && hci_stack->control->hw_error){
1692                 (*hci_stack->control->hw_error)();
1693             } else {
1694                 // if no special requests, just reboot stack
1695                 hci_power_control_off();
1696                 hci_power_control_on();
1697             }
1698             break;
1699 
1700         case HCI_EVENT_ROLE_CHANGE:
1701             if (packet[2]) break;   // status != 0
1702             handle = READ_BT_16(packet, 3);
1703             conn = hci_connection_for_handle(handle);
1704             if (!conn) break;       // no conn
1705             conn->role = packet[9];
1706             break;
1707 
1708         case DAEMON_EVENT_HCI_PACKET_SENT:
1709             // release packet buffer only for asynchronous transport and if there are not further fragements
1710             if (hci_transport_synchronous()) {
1711                 log_error("Synchronous HCI Transport shouldn't send DAEMON_EVENT_HCI_PACKET_SENT");
1712                 return; // instead of break: to avoid re-entering hci_run()
1713             }
1714             if (hci_stack->acl_fragmentation_total_size) break;
1715             hci_release_packet_buffer();
1716             break;
1717 
1718 #ifdef ENABLE_BLE
1719         case HCI_EVENT_LE_META:
1720             switch (packet[2]){
1721                 case HCI_SUBEVENT_LE_ADVERTISING_REPORT:
1722                     log_info("advertising report received");
1723                     if (hci_stack->le_scanning_state != LE_SCANNING) break;
1724                     le_handle_advertisement_report(packet, size);
1725                     break;
1726                 case HCI_SUBEVENT_LE_CONNECTION_COMPLETE:
1727                     // Connection management
1728                     bt_flip_addr(addr, &packet[8]);
1729                     addr_type = (bd_addr_type_t)packet[7];
1730                     log_info("LE Connection_complete (status=%u) type %u, %s", packet[3], addr_type, bd_addr_to_str(addr));
1731                     conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
1732                     // if auto-connect, remove from whitelist in both roles
1733                     if (hci_stack->le_connecting_state == LE_CONNECTING_WHITELIST){
1734                         hci_remove_from_whitelist(addr_type, addr);
1735                     }
1736                     // handle error: error is reported only to the initiator -> outgoing connection
1737                     if (packet[3]){
1738                         // outgoing connection establishment is done
1739                         hci_stack->le_connecting_state = LE_CONNECTING_IDLE;
1740                         // remove entry
1741                         if (conn){
1742                             btstack_linked_list_remove(&hci_stack->connections, (btstack_linked_item_t *) conn);
1743                             btstack_memory_hci_connection_free( conn );
1744                         }
1745                         break;
1746                     }
1747                     // on success, both hosts receive connection complete event
1748                     if (packet[6] == HCI_ROLE_MASTER){
1749                         // if we're master, it was an outgoing connection and we're done with it
1750                         hci_stack->le_connecting_state = LE_CONNECTING_IDLE;
1751                     } else {
1752                         // if we're slave, it was an incoming connection, advertisements have stopped
1753                         hci_stack->le_advertisements_active = 0;
1754                     }
1755                     // LE connections are auto-accepted, so just create a connection if there isn't one already
1756                     if (!conn){
1757                         conn = create_connection_for_bd_addr_and_type(addr, addr_type);
1758                     }
1759                     // no memory, sorry.
1760                     if (!conn){
1761                         break;
1762                     }
1763 
1764                     conn->state = OPEN;
1765                     conn->role  = packet[6];
1766                     conn->con_handle = READ_BT_16(packet, 4);
1767 
1768                     // TODO: store - role, peer address type, conn_interval, conn_latency, supervision timeout, master clock
1769 
1770                     // restart timer
1771                     // btstack_run_loop_set_timer(&conn->timeout, HCI_CONNECTION_TIMEOUT_MS);
1772                     // btstack_run_loop_add_timer(&conn->timeout);
1773 
1774                     log_info("New connection: handle %u, %s", conn->con_handle, bd_addr_to_str(conn->address));
1775 
1776                     hci_emit_nr_connections_changed();
1777                     break;
1778 
1779             // log_info("LE buffer size: %u, count %u", READ_BT_16(packet,6), packet[8]);
1780 
1781                 default:
1782                     break;
1783             }
1784             break;
1785 #endif
1786         default:
1787             break;
1788     }
1789 
1790     // handle BT initialization
1791     if (hci_stack->state == HCI_STATE_INITIALIZING){
1792         hci_initializing_event_handler(packet, size);
1793     }
1794 
1795     // help with BT sleep
1796     if (hci_stack->state == HCI_STATE_FALLING_ASLEEP
1797         && hci_stack->substate == HCI_FALLING_ASLEEP_W4_WRITE_SCAN_ENABLE
1798         && COMMAND_COMPLETE_EVENT(packet, hci_write_scan_enable)){
1799         hci_initializing_next_state();
1800     }
1801 
1802     // notify upper stack
1803     hci_stack->packet_handler(HCI_EVENT_PACKET, packet, size);
1804 
1805     // moved here to give upper stack a chance to close down everything with hci_connection_t intact
1806     if (packet[0] == HCI_EVENT_DISCONNECTION_COMPLETE){
1807         if (!packet[2]){
1808             handle = READ_BT_16(packet, 3);
1809             hci_connection_t * aConn = hci_connection_for_handle(handle);
1810             if (aConn) {
1811                 uint8_t status = aConn->bonding_status;
1812                 uint16_t flags = aConn->bonding_flags;
1813                 bd_addr_t bd_address;
1814                 memcpy(&bd_address, aConn->address, 6);
1815                 hci_shutdown_connection(aConn);
1816                 // connection struct is gone, don't access anymore
1817                 if (flags & BONDING_EMIT_COMPLETE_ON_DISCONNECT){
1818                     hci_emit_dedicated_bonding_result(bd_address, status);
1819                 }
1820             }
1821         }
1822     }
1823 
1824 	// execute main loop
1825 	hci_run();
1826 }
1827 
1828 static void sco_handler(uint8_t * packet, uint16_t size){
1829     if (!hci_stack->sco_packet_handler) return;
1830     hci_stack->sco_packet_handler(HCI_SCO_DATA_PACKET, packet, size);
1831 }
1832 
1833 static void packet_handler(uint8_t packet_type, uint8_t *packet, uint16_t size){
1834     hci_dump_packet(packet_type, 1, packet, size);
1835     switch (packet_type) {
1836         case HCI_EVENT_PACKET:
1837             event_handler(packet, size);
1838             break;
1839         case HCI_ACL_DATA_PACKET:
1840             acl_handler(packet, size);
1841             break;
1842         case HCI_SCO_DATA_PACKET:
1843             sco_handler(packet, size);
1844         default:
1845             break;
1846     }
1847 }
1848 
1849 /** Register HCI packet handlers */
1850 void hci_register_packet_handler(void (*handler)(uint8_t packet_type, uint8_t *packet, uint16_t size)){
1851     hci_stack->packet_handler = handler;
1852 }
1853 
1854 /**
1855  * @brief Registers a packet handler for SCO data. Used for HSP and HFP profiles.
1856  */
1857 void hci_register_sco_packet_handler(void (*handler)(uint8_t packet_type, uint8_t *packet, uint16_t size)){
1858     hci_stack->sco_packet_handler = handler;
1859 }
1860 
1861 static void hci_state_reset(void){
1862     // no connections yet
1863     hci_stack->connections = NULL;
1864 
1865     // keep discoverable/connectable as this has been requested by the client(s)
1866     // hci_stack->discoverable = 0;
1867     // hci_stack->connectable = 0;
1868     // hci_stack->bondable = 1;
1869 
1870     // buffer is free
1871     hci_stack->hci_packet_buffer_reserved = 0;
1872 
1873     // no pending cmds
1874     hci_stack->decline_reason = 0;
1875     hci_stack->new_scan_enable_value = 0xff;
1876 
1877     // LE
1878     hci_stack->adv_addr_type = 0;
1879     memset(hci_stack->adv_address, 0, 6);
1880     hci_stack->le_scanning_state = LE_SCAN_IDLE;
1881     hci_stack->le_scan_type = 0xff;
1882     hci_stack->le_connecting_state = LE_CONNECTING_IDLE;
1883     hci_stack->le_whitelist = 0;
1884     hci_stack->le_whitelist_capacity = 0;
1885     hci_stack->le_connection_parameter_range.le_conn_interval_min =          6;
1886     hci_stack->le_connection_parameter_range.le_conn_interval_max =       3200;
1887     hci_stack->le_connection_parameter_range.le_conn_latency_min =           0;
1888     hci_stack->le_connection_parameter_range.le_conn_latency_max =         500;
1889     hci_stack->le_connection_parameter_range.le_supervision_timeout_min =   10;
1890     hci_stack->le_connection_parameter_range.le_supervision_timeout_max = 3200;
1891 }
1892 
1893 void hci_init(hci_transport_t *transport, void *config, bt_control_t *control, remote_device_db_t const* remote_device_db){
1894 
1895 #ifdef HAVE_MALLOC
1896     if (!hci_stack) {
1897         hci_stack = (hci_stack_t*) malloc(sizeof(hci_stack_t));
1898     }
1899 #else
1900     hci_stack = &hci_stack_static;
1901 #endif
1902     memset(hci_stack, 0, sizeof(hci_stack_t));
1903 
1904     // reference to use transport layer implementation
1905     hci_stack->hci_transport = transport;
1906 
1907     // references to used control implementation
1908     hci_stack->control = control;
1909 
1910     // reference to used config
1911     hci_stack->config = config;
1912 
1913     // init used chipset with NULL for now (already done my memset above)
1914 
1915     // higher level handler
1916     hci_stack->packet_handler = dummy_handler;
1917 
1918     // store and open remote device db
1919     hci_stack->remote_device_db = remote_device_db;
1920     if (hci_stack->remote_device_db) {
1921         hci_stack->remote_device_db->open();
1922     }
1923 
1924     // max acl payload size defined in config.h
1925     hci_stack->acl_data_packet_length = HCI_ACL_PAYLOAD_SIZE;
1926 
1927     // register packet handlers with transport
1928     transport->register_packet_handler(&packet_handler);
1929 
1930     hci_stack->state = HCI_STATE_OFF;
1931 
1932     // class of device
1933     hci_stack->class_of_device = 0x007a020c; // Smartphone
1934 
1935     // bondable by default
1936     hci_stack->bondable = 1;
1937 
1938     // Secure Simple Pairing default: enable, no I/O capabilities, general bonding, mitm not required, auto accept
1939     hci_stack->ssp_enable = 1;
1940     hci_stack->ssp_io_capability = SSP_IO_CAPABILITY_NO_INPUT_NO_OUTPUT;
1941     hci_stack->ssp_authentication_requirement = SSP_IO_AUTHREQ_MITM_PROTECTION_NOT_REQUIRED_GENERAL_BONDING;
1942     hci_stack->ssp_auto_accept = 1;
1943 
1944     // voice setting - signed 8 bit pcm data with CVSD over the air
1945     hci_stack->sco_voice_setting = 0x40;
1946 
1947     hci_state_reset();
1948 }
1949 
1950 void hci_close(void){
1951     // close remote device db
1952     if (hci_stack->remote_device_db) {
1953         hci_stack->remote_device_db->close();
1954     }
1955     while (hci_stack->connections) {
1956         // cancel all l2cap connections
1957         hci_emit_disconnection_complete(((hci_connection_t *) hci_stack->connections)->con_handle, 0x16); // terminated by local host
1958         hci_shutdown_connection((hci_connection_t *) hci_stack->connections);
1959     }
1960     hci_power_control(HCI_POWER_OFF);
1961 
1962 #ifdef HAVE_MALLOC
1963     free(hci_stack);
1964 #endif
1965     hci_stack = NULL;
1966 }
1967 
1968 void hci_set_class_of_device(uint32_t class_of_device){
1969     hci_stack->class_of_device = class_of_device;
1970 }
1971 
1972 // Set Public BD ADDR - passed on to Bluetooth chipset if supported in bt_control_h
1973 void hci_set_bd_addr(bd_addr_t addr){
1974     memcpy(hci_stack->custom_bd_addr, addr, 6);
1975     hci_stack->custom_bd_addr_set = 1;
1976 }
1977 
1978 void hci_disable_l2cap_timeout_check(void){
1979     disable_l2cap_timeouts = 1;
1980 }
1981 // State-Module-Driver overview
1982 // state                    module  low-level
1983 // HCI_STATE_OFF             off      close
1984 // HCI_STATE_INITIALIZING,   on       open
1985 // HCI_STATE_WORKING,        on       open
1986 // HCI_STATE_HALTING,        on       open
1987 // HCI_STATE_SLEEPING,    off/sleep   close
1988 // HCI_STATE_FALLING_ASLEEP  on       open
1989 
1990 static int hci_power_control_on(void){
1991 
1992     // power on
1993     int err = 0;
1994     if (hci_stack->control && hci_stack->control->on){
1995         err = (*hci_stack->control->on)(hci_stack->config);
1996     }
1997     if (err){
1998         log_error( "POWER_ON failed");
1999         hci_emit_hci_open_failed();
2000         return err;
2001     }
2002 
2003     // open low-level device
2004     err = hci_stack->hci_transport->open(hci_stack->config);
2005     if (err){
2006         log_error( "HCI_INIT failed, turning Bluetooth off again");
2007         if (hci_stack->control && hci_stack->control->off){
2008             (*hci_stack->control->off)(hci_stack->config);
2009         }
2010         hci_emit_hci_open_failed();
2011         return err;
2012     }
2013     return 0;
2014 }
2015 
2016 static void hci_power_control_off(void){
2017 
2018     log_info("hci_power_control_off");
2019 
2020     // close low-level device
2021     hci_stack->hci_transport->close(hci_stack->config);
2022 
2023     log_info("hci_power_control_off - hci_transport closed");
2024 
2025     // power off
2026     if (hci_stack->control && hci_stack->control->off){
2027         (*hci_stack->control->off)(hci_stack->config);
2028     }
2029 
2030     log_info("hci_power_control_off - control closed");
2031 
2032     hci_stack->state = HCI_STATE_OFF;
2033 }
2034 
2035 static void hci_power_control_sleep(void){
2036 
2037     log_info("hci_power_control_sleep");
2038 
2039 #if 0
2040     // don't close serial port during sleep
2041 
2042     // close low-level device
2043     hci_stack->hci_transport->close(hci_stack->config);
2044 #endif
2045 
2046     // sleep mode
2047     if (hci_stack->control && hci_stack->control->sleep){
2048         (*hci_stack->control->sleep)(hci_stack->config);
2049     }
2050 
2051     hci_stack->state = HCI_STATE_SLEEPING;
2052 }
2053 
2054 static int hci_power_control_wake(void){
2055 
2056     log_info("hci_power_control_wake");
2057 
2058     // wake on
2059     if (hci_stack->control && hci_stack->control->wake){
2060         (*hci_stack->control->wake)(hci_stack->config);
2061     }
2062 
2063 #if 0
2064     // open low-level device
2065     int err = hci_stack->hci_transport->open(hci_stack->config);
2066     if (err){
2067         log_error( "HCI_INIT failed, turning Bluetooth off again");
2068         if (hci_stack->control && hci_stack->control->off){
2069             (*hci_stack->control->off)(hci_stack->config);
2070         }
2071         hci_emit_hci_open_failed();
2072         return err;
2073     }
2074 #endif
2075 
2076     return 0;
2077 }
2078 
2079 static void hci_power_transition_to_initializing(void){
2080     // set up state machine
2081     hci_stack->num_cmd_packets = 1; // assume that one cmd can be sent
2082     hci_stack->hci_packet_buffer_reserved = 0;
2083     hci_stack->state = HCI_STATE_INITIALIZING;
2084     hci_stack->substate = HCI_INIT_SEND_RESET;
2085 }
2086 
2087 int hci_power_control(HCI_POWER_MODE power_mode){
2088 
2089     log_info("hci_power_control: %u, current mode %u", power_mode, hci_stack->state);
2090 
2091     int err = 0;
2092     switch (hci_stack->state){
2093 
2094         case HCI_STATE_OFF:
2095             switch (power_mode){
2096                 case HCI_POWER_ON:
2097                     err = hci_power_control_on();
2098                     if (err) {
2099                         log_error("hci_power_control_on() error %u", err);
2100                         return err;
2101                     }
2102                     hci_power_transition_to_initializing();
2103                     break;
2104                 case HCI_POWER_OFF:
2105                     // do nothing
2106                     break;
2107                 case HCI_POWER_SLEEP:
2108                     // do nothing (with SLEEP == OFF)
2109                     break;
2110             }
2111             break;
2112 
2113         case HCI_STATE_INITIALIZING:
2114             switch (power_mode){
2115                 case HCI_POWER_ON:
2116                     // do nothing
2117                     break;
2118                 case HCI_POWER_OFF:
2119                     // no connections yet, just turn it off
2120                     hci_power_control_off();
2121                     break;
2122                 case HCI_POWER_SLEEP:
2123                     // no connections yet, just turn it off
2124                     hci_power_control_sleep();
2125                     break;
2126             }
2127             break;
2128 
2129         case HCI_STATE_WORKING:
2130             switch (power_mode){
2131                 case HCI_POWER_ON:
2132                     // do nothing
2133                     break;
2134                 case HCI_POWER_OFF:
2135                     // see hci_run
2136                     hci_stack->state = HCI_STATE_HALTING;
2137                     break;
2138                 case HCI_POWER_SLEEP:
2139                     // see hci_run
2140                     hci_stack->state = HCI_STATE_FALLING_ASLEEP;
2141                     hci_stack->substate = HCI_FALLING_ASLEEP_DISCONNECT;
2142                     break;
2143             }
2144             break;
2145 
2146         case HCI_STATE_HALTING:
2147             switch (power_mode){
2148                 case HCI_POWER_ON:
2149                     hci_power_transition_to_initializing();
2150                     break;
2151                 case HCI_POWER_OFF:
2152                     // do nothing
2153                     break;
2154                 case HCI_POWER_SLEEP:
2155                     // see hci_run
2156                     hci_stack->state = HCI_STATE_FALLING_ASLEEP;
2157                     hci_stack->substate = HCI_FALLING_ASLEEP_DISCONNECT;
2158                     break;
2159             }
2160             break;
2161 
2162         case HCI_STATE_FALLING_ASLEEP:
2163             switch (power_mode){
2164                 case HCI_POWER_ON:
2165 
2166 #ifdef HAVE_PLATFORM_IPHONE_OS
2167                     // nothing to do, if H4 supports power management
2168                     if (bt_control_iphone_power_management_enabled()){
2169                         hci_stack->state = HCI_STATE_INITIALIZING;
2170                         hci_stack->substate = HCI_INIT_WRITE_SCAN_ENABLE;   // init after sleep
2171                         break;
2172                     }
2173 #endif
2174                     hci_power_transition_to_initializing();
2175                     break;
2176                 case HCI_POWER_OFF:
2177                     // see hci_run
2178                     hci_stack->state = HCI_STATE_HALTING;
2179                     break;
2180                 case HCI_POWER_SLEEP:
2181                     // do nothing
2182                     break;
2183             }
2184             break;
2185 
2186         case HCI_STATE_SLEEPING:
2187             switch (power_mode){
2188                 case HCI_POWER_ON:
2189 
2190 #ifdef HAVE_PLATFORM_IPHONE_OS
2191                     // nothing to do, if H4 supports power management
2192                     if (bt_control_iphone_power_management_enabled()){
2193                         hci_stack->state = HCI_STATE_INITIALIZING;
2194                         hci_stack->substate = HCI_INIT_AFTER_SLEEP;
2195                         hci_update_scan_enable();
2196                         break;
2197                     }
2198 #endif
2199                     err = hci_power_control_wake();
2200                     if (err) return err;
2201                     hci_power_transition_to_initializing();
2202                     break;
2203                 case HCI_POWER_OFF:
2204                     hci_stack->state = HCI_STATE_HALTING;
2205                     break;
2206                 case HCI_POWER_SLEEP:
2207                     // do nothing
2208                     break;
2209             }
2210             break;
2211     }
2212 
2213     // create internal event
2214 	hci_emit_state();
2215 
2216 	// trigger next/first action
2217 	hci_run();
2218 
2219     return 0;
2220 }
2221 
2222 static void hci_update_scan_enable(void){
2223     // 2 = page scan, 1 = inq scan
2224     hci_stack->new_scan_enable_value  = hci_stack->connectable << 1 | hci_stack->discoverable;
2225     hci_run();
2226 }
2227 
2228 void hci_discoverable_control(uint8_t enable){
2229     if (enable) enable = 1; // normalize argument
2230 
2231     if (hci_stack->discoverable == enable){
2232         hci_emit_discoverable_enabled(hci_stack->discoverable);
2233         return;
2234     }
2235 
2236     hci_stack->discoverable = enable;
2237     hci_update_scan_enable();
2238 }
2239 
2240 void hci_connectable_control(uint8_t enable){
2241     if (enable) enable = 1; // normalize argument
2242 
2243     // don't emit event
2244     if (hci_stack->connectable == enable) return;
2245 
2246     hci_stack->connectable = enable;
2247     hci_update_scan_enable();
2248 }
2249 
2250 void hci_local_bd_addr(bd_addr_t address_buffer){
2251     memcpy(address_buffer, hci_stack->local_bd_addr, 6);
2252 }
2253 
2254 void hci_run(void){
2255 
2256     // log_info("hci_run: entered");
2257     btstack_linked_item_t * it;
2258 
2259     // send continuation fragments first, as they block the prepared packet buffer
2260     if (hci_stack->acl_fragmentation_total_size > 0) {
2261         hci_con_handle_t con_handle = READ_ACL_CONNECTION_HANDLE(hci_stack->hci_packet_buffer);
2262         if (hci_can_send_prepared_acl_packet_now(con_handle)){
2263             hci_connection_t *connection = hci_connection_for_handle(con_handle);
2264             if (connection) {
2265                 hci_send_acl_packet_fragments(connection);
2266                 return;
2267             }
2268             // connection gone -> discard further fragments
2269             hci_stack->acl_fragmentation_total_size = 0;
2270             hci_stack->acl_fragmentation_pos = 0;
2271         }
2272     }
2273 
2274     if (!hci_can_send_command_packet_now()) return;
2275 
2276     // global/non-connection oriented commands
2277 
2278     // decline incoming connections
2279     if (hci_stack->decline_reason){
2280         uint8_t reason = hci_stack->decline_reason;
2281         hci_stack->decline_reason = 0;
2282         hci_send_cmd(&hci_reject_connection_request, hci_stack->decline_addr, reason);
2283         return;
2284     }
2285 
2286     // send scan enable
2287     if (hci_stack->state == HCI_STATE_WORKING && hci_stack->new_scan_enable_value != 0xff && hci_classic_supported()){
2288         hci_send_cmd(&hci_write_scan_enable, hci_stack->new_scan_enable_value);
2289         hci_stack->new_scan_enable_value = 0xff;
2290         return;
2291     }
2292 
2293 #ifdef ENABLE_BLE
2294     if (hci_stack->state == HCI_STATE_WORKING){
2295         // handle le scan
2296         switch(hci_stack->le_scanning_state){
2297             case LE_START_SCAN:
2298                 hci_stack->le_scanning_state = LE_SCANNING;
2299                 hci_send_cmd(&hci_le_set_scan_enable, 1, 0);
2300                 return;
2301 
2302             case LE_STOP_SCAN:
2303                 hci_stack->le_scanning_state = LE_SCAN_IDLE;
2304                 hci_send_cmd(&hci_le_set_scan_enable, 0, 0);
2305                 return;
2306             default:
2307                 break;
2308         }
2309         if (hci_stack->le_scan_type != 0xff){
2310             // defaults: active scanning, accept all advertisement packets
2311             int scan_type = hci_stack->le_scan_type;
2312             hci_stack->le_scan_type = 0xff;
2313             hci_send_cmd(&hci_le_set_scan_parameters, scan_type, hci_stack->le_scan_interval, hci_stack->le_scan_window, hci_stack->adv_addr_type, 0);
2314             return;
2315         }
2316         // le advertisement control
2317         if (hci_stack->le_advertisements_todo){
2318             log_info("hci_run: gap_le: adv todo: %x", hci_stack->le_advertisements_todo );
2319         }
2320         if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_DISABLE){
2321             hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_DISABLE;
2322             hci_send_cmd(&hci_le_set_advertise_enable, 0);
2323             return;
2324         }
2325         if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_SET_PARAMS){
2326             hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_SET_PARAMS;
2327             hci_send_cmd(&hci_le_set_advertising_parameters,
2328                  hci_stack->le_advertisements_interval_min,
2329                  hci_stack->le_advertisements_interval_max,
2330                  hci_stack->le_advertisements_type,
2331                  hci_stack->le_advertisements_own_address_type,
2332                  hci_stack->le_advertisements_direct_address_type,
2333                  hci_stack->le_advertisements_direct_address,
2334                  hci_stack->le_advertisements_channel_map,
2335                  hci_stack->le_advertisements_filter_policy);
2336             return;
2337         }
2338         if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_SET_DATA){
2339             hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_SET_DATA;
2340             hci_send_cmd(&hci_le_set_advertising_data, hci_stack->le_advertisements_data_len,
2341                 hci_stack->le_advertisements_data);
2342             return;
2343         }
2344         if (hci_stack->le_advertisements_todo & LE_ADVERTISEMENT_TASKS_ENABLE){
2345             hci_stack->le_advertisements_todo &= ~LE_ADVERTISEMENT_TASKS_ENABLE;
2346             hci_send_cmd(&hci_le_set_advertise_enable, 1);
2347             return;
2348         }
2349 
2350         //
2351         // LE Whitelist Management
2352         //
2353 
2354         // check if whitelist needs modification
2355         btstack_linked_list_iterator_t lit;
2356         int modification_pending = 0;
2357         btstack_linked_list_iterator_init(&lit, &hci_stack->le_whitelist);
2358         while (btstack_linked_list_iterator_has_next(&lit)){
2359             whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&lit);
2360             if (entry->state & (LE_WHITELIST_REMOVE_FROM_CONTROLLER | LE_WHITELIST_ADD_TO_CONTROLLER)){
2361                 modification_pending = 1;
2362                 break;
2363             }
2364         }
2365 
2366         if (modification_pending){
2367             // stop connnecting if modification pending
2368             if (hci_stack->le_connecting_state != LE_CONNECTING_IDLE){
2369                 hci_send_cmd(&hci_le_create_connection_cancel);
2370                 return;
2371             }
2372 
2373             // add/remove entries
2374             btstack_linked_list_iterator_init(&lit, &hci_stack->le_whitelist);
2375             while (btstack_linked_list_iterator_has_next(&lit)){
2376                 whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&lit);
2377                 if (entry->state & LE_WHITELIST_ADD_TO_CONTROLLER){
2378                     entry->state = LE_WHITELIST_ON_CONTROLLER;
2379                     hci_send_cmd(&hci_le_add_device_to_white_list, entry->address_type, entry->address);
2380                     return;
2381 
2382                 }
2383                 if (entry->state & LE_WHITELIST_REMOVE_FROM_CONTROLLER){
2384                     bd_addr_t address;
2385                     bd_addr_type_t address_type = entry->address_type;
2386                     memcpy(address, entry->address, 6);
2387                     btstack_linked_list_remove(&hci_stack->le_whitelist, (btstack_linked_item_t *) entry);
2388                     btstack_memory_whitelist_entry_free(entry);
2389                     hci_send_cmd(&hci_le_remove_device_from_white_list, address_type, address);
2390                     return;
2391                 }
2392             }
2393         }
2394 
2395         // start connecting
2396         if ( hci_stack->le_connecting_state == LE_CONNECTING_IDLE &&
2397             !btstack_linked_list_empty(&hci_stack->le_whitelist)){
2398             bd_addr_t null_addr;
2399             memset(null_addr, 0, 6);
2400             hci_send_cmd(&hci_le_create_connection,
2401                  0x0060,    // scan interval: 60 ms
2402                  0x0030,    // scan interval: 30 ms
2403                  1,         // use whitelist
2404                  0,         // peer address type
2405                  null_addr,      // peer bd addr
2406                  hci_stack->adv_addr_type, // our addr type:
2407                  0x0008,    // conn interval min
2408                  0x0018,    // conn interval max
2409                  0,         // conn latency
2410                  0x0048,    // supervision timeout
2411                  0x0001,    // min ce length
2412                  0x0001     // max ce length
2413                  );
2414             return;
2415         }
2416     }
2417 #endif
2418 
2419     // send pending HCI commands
2420     for (it = (btstack_linked_item_t *) hci_stack->connections; it ; it = it->next){
2421         hci_connection_t * connection = (hci_connection_t *) it;
2422 
2423         switch(connection->state){
2424             case SEND_CREATE_CONNECTION:
2425                 switch(connection->address_type){
2426                     case BD_ADDR_TYPE_CLASSIC:
2427                         log_info("sending hci_create_connection");
2428                         hci_send_cmd(&hci_create_connection, connection->address, hci_usable_acl_packet_types(), 0, 0, 0, 1);
2429                         break;
2430                     default:
2431 #ifdef ENABLE_BLE
2432                         log_info("sending hci_le_create_connection");
2433                         hci_send_cmd(&hci_le_create_connection,
2434                                      0x0060,    // scan interval: 60 ms
2435                                      0x0030,    // scan interval: 30 ms
2436                                      0,         // don't use whitelist
2437                                      connection->address_type, // peer address type
2438                                      connection->address,      // peer bd addr
2439                                      hci_stack->adv_addr_type, // our addr type:
2440                                      0x0008,    // conn interval min
2441                                      0x0018,    // conn interval max
2442                                      0,         // conn latency
2443                                      0x0048,    // supervision timeout
2444                                      0x0001,    // min ce length
2445                                      0x0001     // max ce length
2446                                      );
2447 
2448                         connection->state = SENT_CREATE_CONNECTION;
2449 #endif
2450                         break;
2451                 }
2452                 return;
2453 
2454             case RECEIVED_CONNECTION_REQUEST:
2455                 log_info("sending hci_accept_connection_request, remote eSCO %u", connection->remote_supported_feature_eSCO);
2456                 connection->state = ACCEPTED_CONNECTION_REQUEST;
2457                 connection->role  = HCI_ROLE_SLAVE;
2458                 if (connection->address_type == BD_ADDR_TYPE_CLASSIC){
2459                     hci_send_cmd(&hci_accept_connection_request, connection->address, 1);
2460                 } else {
2461                     // remote supported feature eSCO is set if link type is eSCO
2462                     uint16_t max_latency;
2463                     uint8_t  retransmission_effort;
2464                     uint16_t packet_types;
2465                     // remote supported feature eSCO is set if link type is eSCO
2466                     if (connection->remote_supported_feature_eSCO){
2467                         // eSCO: S4 - max latency == transmission interval = 0x000c == 12 ms,
2468                         max_latency = 0x000c;
2469                         retransmission_effort = 0x02;
2470                         packet_types = 0x388;
2471                     } else {
2472                         // SCO: max latency, retransmission interval: N/A. any packet type
2473                         max_latency = 0xffff;
2474                         retransmission_effort = 0xff;
2475                         packet_types = 0x003f;
2476                     }
2477                     hci_send_cmd(&hci_accept_synchronous_connection, connection->address, 8000, 8000, max_latency, hci_stack->sco_voice_setting, retransmission_effort, packet_types);
2478                 }
2479                 return;
2480 
2481 #ifdef ENABLE_BLE
2482             case SEND_CANCEL_CONNECTION:
2483                 connection->state = SENT_CANCEL_CONNECTION;
2484                 hci_send_cmd(&hci_le_create_connection_cancel);
2485                 return;
2486 #endif
2487             case SEND_DISCONNECT:
2488                 connection->state = SENT_DISCONNECT;
2489                 hci_send_cmd(&hci_disconnect, connection->con_handle, 0x13); // remote closed connection
2490                 return;
2491 
2492             default:
2493                 break;
2494         }
2495 
2496         if (connection->authentication_flags & HANDLE_LINK_KEY_REQUEST){
2497             log_info("responding to link key request");
2498             connectionClearAuthenticationFlags(connection, HANDLE_LINK_KEY_REQUEST);
2499             link_key_t link_key;
2500             link_key_type_t link_key_type;
2501             if ( hci_stack->remote_device_db
2502               && hci_stack->remote_device_db->get_link_key(connection->address, link_key, &link_key_type)
2503               && gap_security_level_for_link_key_type(link_key_type) >= connection->requested_security_level){
2504                connection->link_key_type = link_key_type;
2505                hci_send_cmd(&hci_link_key_request_reply, connection->address, &link_key);
2506             } else {
2507                hci_send_cmd(&hci_link_key_request_negative_reply, connection->address);
2508             }
2509             return;
2510         }
2511 
2512         if (connection->authentication_flags & DENY_PIN_CODE_REQUEST){
2513             log_info("denying to pin request");
2514             connectionClearAuthenticationFlags(connection, DENY_PIN_CODE_REQUEST);
2515             hci_send_cmd(&hci_pin_code_request_negative_reply, connection->address);
2516             return;
2517         }
2518 
2519         if (connection->authentication_flags & SEND_IO_CAPABILITIES_REPLY){
2520             connectionClearAuthenticationFlags(connection, SEND_IO_CAPABILITIES_REPLY);
2521             log_info("IO Capability Request received, stack bondable %u, io cap %u", hci_stack->bondable, hci_stack->ssp_io_capability);
2522             if (hci_stack->bondable && (hci_stack->ssp_io_capability != SSP_IO_CAPABILITY_UNKNOWN)){
2523                 // tweak authentication requirements
2524                 uint8_t authreq = hci_stack->ssp_authentication_requirement;
2525                 if (connection->bonding_flags & BONDING_DEDICATED){
2526                     authreq = SSP_IO_AUTHREQ_MITM_PROTECTION_NOT_REQUIRED_DEDICATED_BONDING;
2527                 }
2528                 if (gap_mitm_protection_required_for_security_level(connection->requested_security_level)){
2529                     authreq |= 1;
2530                 }
2531                 hci_send_cmd(&hci_io_capability_request_reply, &connection->address, hci_stack->ssp_io_capability, NULL, authreq);
2532             } else {
2533                 hci_send_cmd(&hci_io_capability_request_negative_reply, &connection->address, ERROR_CODE_PAIRING_NOT_ALLOWED);
2534             }
2535             return;
2536         }
2537 
2538         if (connection->authentication_flags & SEND_USER_CONFIRM_REPLY){
2539             connectionClearAuthenticationFlags(connection, SEND_USER_CONFIRM_REPLY);
2540             hci_send_cmd(&hci_user_confirmation_request_reply, &connection->address);
2541             return;
2542         }
2543 
2544         if (connection->authentication_flags & SEND_USER_PASSKEY_REPLY){
2545             connectionClearAuthenticationFlags(connection, SEND_USER_PASSKEY_REPLY);
2546             hci_send_cmd(&hci_user_passkey_request_reply, &connection->address, 000000);
2547             return;
2548         }
2549 
2550         if (connection->bonding_flags & BONDING_REQUEST_REMOTE_FEATURES){
2551             connection->bonding_flags &= ~BONDING_REQUEST_REMOTE_FEATURES;
2552             hci_send_cmd(&hci_read_remote_supported_features_command, connection->con_handle);
2553             return;
2554         }
2555 
2556         if (connection->bonding_flags & BONDING_DISCONNECT_SECURITY_BLOCK){
2557             connection->bonding_flags &= ~BONDING_DISCONNECT_SECURITY_BLOCK;
2558             hci_send_cmd(&hci_disconnect, connection->con_handle, 0x0005);  // authentication failure
2559             return;
2560         }
2561         if (connection->bonding_flags & BONDING_DISCONNECT_DEDICATED_DONE){
2562             connection->bonding_flags &= ~BONDING_DISCONNECT_DEDICATED_DONE;
2563             connection->bonding_flags |= BONDING_EMIT_COMPLETE_ON_DISCONNECT;
2564             hci_send_cmd(&hci_disconnect, connection->con_handle, 0x13);  // authentication done
2565             return;
2566         }
2567         if (connection->bonding_flags & BONDING_SEND_AUTHENTICATE_REQUEST){
2568             connection->bonding_flags &= ~BONDING_SEND_AUTHENTICATE_REQUEST;
2569             hci_send_cmd(&hci_authentication_requested, connection->con_handle);
2570             return;
2571         }
2572         if (connection->bonding_flags & BONDING_SEND_ENCRYPTION_REQUEST){
2573             connection->bonding_flags &= ~BONDING_SEND_ENCRYPTION_REQUEST;
2574             hci_send_cmd(&hci_set_connection_encryption, connection->con_handle, 1);
2575             return;
2576         }
2577 
2578 #ifdef ENABLE_BLE
2579         if (connection->le_con_parameter_update_state == CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS){
2580             connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
2581 
2582             uint16_t connection_interval_min = connection->le_conn_interval_min;
2583             connection->le_conn_interval_min = 0;
2584             hci_send_cmd(&hci_le_connection_update, connection->con_handle, connection_interval_min,
2585                 connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout,
2586                 0x0000, 0xffff);
2587         }
2588 #endif
2589     }
2590 
2591     hci_connection_t * connection;
2592     switch (hci_stack->state){
2593         case HCI_STATE_INITIALIZING:
2594             hci_initializing_run();
2595             break;
2596 
2597         case HCI_STATE_HALTING:
2598 
2599             log_info("HCI_STATE_HALTING");
2600 
2601             // free whitelist entries
2602 #ifdef ENABLE_BLE
2603             {
2604                 btstack_linked_list_iterator_t lit;
2605                 btstack_linked_list_iterator_init(&lit, &hci_stack->le_whitelist);
2606                 while (btstack_linked_list_iterator_has_next(&lit)){
2607                     whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&lit);
2608                     btstack_linked_list_remove(&hci_stack->le_whitelist, (btstack_linked_item_t *) entry);
2609                     btstack_memory_whitelist_entry_free(entry);
2610                 }
2611             }
2612 #endif
2613             // close all open connections
2614             connection =  (hci_connection_t *) hci_stack->connections;
2615             if (connection){
2616                 uint16_t con_handle = (uint16_t) connection->con_handle;
2617                 if (!hci_can_send_command_packet_now()) return;
2618 
2619                 log_info("HCI_STATE_HALTING, connection %p, handle %u", connection, con_handle);
2620 
2621                 // cancel all l2cap connections right away instead of waiting for disconnection complete event ...
2622                 hci_emit_disconnection_complete(con_handle, 0x16); // terminated by local host
2623 
2624                 // ... which would be ignored anyway as we shutdown (free) the connection now
2625                 hci_shutdown_connection(connection);
2626 
2627                 // finally, send the disconnect command
2628                 hci_send_cmd(&hci_disconnect, con_handle, 0x13);  // remote closed connection
2629                 return;
2630             }
2631             log_info("HCI_STATE_HALTING, calling off");
2632 
2633             // switch mode
2634             hci_power_control_off();
2635 
2636             log_info("HCI_STATE_HALTING, emitting state");
2637             hci_emit_state();
2638             log_info("HCI_STATE_HALTING, done");
2639             break;
2640 
2641         case HCI_STATE_FALLING_ASLEEP:
2642             switch(hci_stack->substate) {
2643                 case HCI_FALLING_ASLEEP_DISCONNECT:
2644                     log_info("HCI_STATE_FALLING_ASLEEP");
2645                     // close all open connections
2646                     connection =  (hci_connection_t *) hci_stack->connections;
2647 
2648 #ifdef HAVE_PLATFORM_IPHONE_OS
2649                     // don't close connections, if H4 supports power management
2650                     if (bt_control_iphone_power_management_enabled()){
2651                         connection = NULL;
2652                     }
2653 #endif
2654                     if (connection){
2655 
2656                         // send disconnect
2657                         if (!hci_can_send_command_packet_now()) return;
2658 
2659                         log_info("HCI_STATE_FALLING_ASLEEP, connection %p, handle %u", connection, (uint16_t)connection->con_handle);
2660                         hci_send_cmd(&hci_disconnect, connection->con_handle, 0x13);  // remote closed connection
2661 
2662                         // send disconnected event right away - causes higher layer connections to get closed, too.
2663                         hci_shutdown_connection(connection);
2664                         return;
2665                     }
2666 
2667                     if (hci_classic_supported()){
2668                         // disable page and inquiry scan
2669                         if (!hci_can_send_command_packet_now()) return;
2670 
2671                         log_info("HCI_STATE_HALTING, disabling inq scans");
2672                         hci_send_cmd(&hci_write_scan_enable, hci_stack->connectable << 1); // drop inquiry scan but keep page scan
2673 
2674                         // continue in next sub state
2675                         hci_stack->substate = HCI_FALLING_ASLEEP_W4_WRITE_SCAN_ENABLE;
2676                         break;
2677                     }
2678                     // fall through for ble-only chips
2679 
2680                 case HCI_FALLING_ASLEEP_COMPLETE:
2681                     log_info("HCI_STATE_HALTING, calling sleep");
2682 #ifdef HAVE_PLATFORM_IPHONE_OS
2683                     // don't actually go to sleep, if H4 supports power management
2684                     if (bt_control_iphone_power_management_enabled()){
2685                         // SLEEP MODE reached
2686                         hci_stack->state = HCI_STATE_SLEEPING;
2687                         hci_emit_state();
2688                         break;
2689                     }
2690 #endif
2691                     // switch mode
2692                     hci_power_control_sleep();  // changes hci_stack->state to SLEEP
2693                     hci_emit_state();
2694                     break;
2695 
2696                 default:
2697                     break;
2698             }
2699             break;
2700 
2701         default:
2702             break;
2703     }
2704 }
2705 
2706 int hci_send_cmd_packet(uint8_t *packet, int size){
2707     bd_addr_t addr;
2708     hci_connection_t * conn;
2709     // house-keeping
2710 
2711     // create_connection?
2712     if (IS_COMMAND(packet, hci_create_connection)){
2713         bt_flip_addr(addr, &packet[3]);
2714         log_info("Create_connection to %s", bd_addr_to_str(addr));
2715 
2716         conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
2717         if (!conn){
2718             conn = create_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
2719             if (!conn){
2720                 // notify client that alloc failed
2721                 hci_emit_connection_complete(conn, BTSTACK_MEMORY_ALLOC_FAILED);
2722                 return 0; // don't sent packet to controller
2723             }
2724             conn->state = SEND_CREATE_CONNECTION;
2725         }
2726         log_info("conn state %u", conn->state);
2727         switch (conn->state){
2728             // if connection active exists
2729             case OPEN:
2730                 // and OPEN, emit connection complete command, don't send to controller
2731                 hci_emit_connection_complete(conn, 0);
2732                 return 0;
2733             case SEND_CREATE_CONNECTION:
2734                 // connection created by hci, e.g. dedicated bonding
2735                 break;
2736             default:
2737                 // otherwise, just ignore as it is already in the open process
2738                 return 0;
2739         }
2740         conn->state = SENT_CREATE_CONNECTION;
2741     }
2742     if (IS_COMMAND(packet, hci_link_key_request_reply)){
2743         hci_add_connection_flags_for_flipped_bd_addr(&packet[3], SENT_LINK_KEY_REPLY);
2744     }
2745     if (IS_COMMAND(packet, hci_link_key_request_negative_reply)){
2746         hci_add_connection_flags_for_flipped_bd_addr(&packet[3], SENT_LINK_KEY_NEGATIVE_REQUEST);
2747     }
2748 
2749     if (IS_COMMAND(packet, hci_delete_stored_link_key)){
2750         if (hci_stack->remote_device_db){
2751             bt_flip_addr(addr, &packet[3]);
2752             hci_stack->remote_device_db->delete_link_key(addr);
2753         }
2754     }
2755 
2756     if (IS_COMMAND(packet, hci_pin_code_request_negative_reply)
2757     ||  IS_COMMAND(packet, hci_pin_code_request_reply)){
2758         bt_flip_addr(addr, &packet[3]);
2759         conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
2760         if (conn){
2761             connectionClearAuthenticationFlags(conn, LEGACY_PAIRING_ACTIVE);
2762         }
2763     }
2764 
2765     if (IS_COMMAND(packet, hci_user_confirmation_request_negative_reply)
2766     ||  IS_COMMAND(packet, hci_user_confirmation_request_reply)
2767     ||  IS_COMMAND(packet, hci_user_passkey_request_negative_reply)
2768     ||  IS_COMMAND(packet, hci_user_passkey_request_reply)) {
2769         bt_flip_addr(addr, &packet[3]);
2770         conn = hci_connection_for_bd_addr_and_type(addr, BD_ADDR_TYPE_CLASSIC);
2771         if (conn){
2772             connectionClearAuthenticationFlags(conn, SSP_PAIRING_ACTIVE);
2773         }
2774     }
2775 
2776     if (IS_COMMAND(packet, hci_write_loopback_mode)){
2777         hci_stack->loopback_mode = packet[3];
2778     }
2779 
2780 #ifdef ENABLE_BLE
2781     if (IS_COMMAND(packet, hci_le_set_advertising_parameters)){
2782         hci_stack->adv_addr_type = packet[8];
2783     }
2784     if (IS_COMMAND(packet, hci_le_set_random_address)){
2785         bt_flip_addr(hci_stack->adv_address, &packet[3]);
2786     }
2787     if (IS_COMMAND(packet, hci_le_set_advertise_enable)){
2788         hci_stack->le_advertisements_active = packet[3];
2789     }
2790     if (IS_COMMAND(packet, hci_le_create_connection)){
2791         // white list used?
2792         uint8_t initiator_filter_policy = packet[7];
2793         switch (initiator_filter_policy){
2794             case 0:
2795                 // whitelist not used
2796                 hci_stack->le_connecting_state = LE_CONNECTING_DIRECT;
2797                 break;
2798             case 1:
2799                 hci_stack->le_connecting_state = LE_CONNECTING_WHITELIST;
2800                 break;
2801             default:
2802                 log_error("Invalid initiator_filter_policy in LE Create Connection %u", initiator_filter_policy);
2803                 break;
2804         }
2805     }
2806     if (IS_COMMAND(packet, hci_le_create_connection_cancel)){
2807         hci_stack->le_connecting_state = LE_CONNECTING_IDLE;
2808     }
2809 #endif
2810 
2811     hci_stack->num_cmd_packets--;
2812 
2813     hci_dump_packet(HCI_COMMAND_DATA_PACKET, 0, packet, size);
2814     int err = hci_stack->hci_transport->send_packet(HCI_COMMAND_DATA_PACKET, packet, size);
2815 
2816     // release packet buffer for synchronous transport implementations
2817     if (hci_transport_synchronous() && (packet == hci_stack->hci_packet_buffer)){
2818         hci_stack->hci_packet_buffer_reserved = 0;
2819     }
2820 
2821     return err;
2822 }
2823 
2824 // disconnect because of security block
2825 void hci_disconnect_security_block(hci_con_handle_t con_handle){
2826     hci_connection_t * connection = hci_connection_for_handle(con_handle);
2827     if (!connection) return;
2828     connection->bonding_flags |= BONDING_DISCONNECT_SECURITY_BLOCK;
2829 }
2830 
2831 
2832 // Configure Secure Simple Pairing
2833 
2834 // enable will enable SSP during init
2835 void hci_ssp_set_enable(int enable){
2836     hci_stack->ssp_enable = enable;
2837 }
2838 
2839 int hci_local_ssp_activated(void){
2840     return hci_ssp_supported() && hci_stack->ssp_enable;
2841 }
2842 
2843 // if set, BTstack will respond to io capability request using authentication requirement
2844 void hci_ssp_set_io_capability(int io_capability){
2845     hci_stack->ssp_io_capability = io_capability;
2846 }
2847 void hci_ssp_set_authentication_requirement(int authentication_requirement){
2848     hci_stack->ssp_authentication_requirement = authentication_requirement;
2849 }
2850 
2851 // if set, BTstack will confirm a numberic comparion and enter '000000' if requested
2852 void hci_ssp_set_auto_accept(int auto_accept){
2853     hci_stack->ssp_auto_accept = auto_accept;
2854 }
2855 
2856 /**
2857  * pre: numcmds >= 0 - it's allowed to send a command to the controller
2858  */
2859 int hci_send_cmd(const hci_cmd_t *cmd, ...){
2860 
2861     if (!hci_can_send_command_packet_now()){
2862         log_error("hci_send_cmd called but cannot send packet now");
2863         return 0;
2864     }
2865 
2866     // for HCI INITIALIZATION
2867     // log_info("hci_send_cmd: opcode %04x", cmd->opcode);
2868     hci_stack->last_cmd_opcode = cmd->opcode;
2869 
2870     hci_reserve_packet_buffer();
2871     uint8_t * packet = hci_stack->hci_packet_buffer;
2872 
2873     va_list argptr;
2874     va_start(argptr, cmd);
2875     uint16_t size = hci_cmd_create_from_template(packet, cmd, argptr);
2876     va_end(argptr);
2877 
2878     return hci_send_cmd_packet(packet, size);
2879 }
2880 
2881 // Create various non-HCI events.
2882 // TODO: generalize, use table similar to hci_create_command
2883 
2884 void hci_emit_state(void){
2885     log_info("BTSTACK_EVENT_STATE %u", hci_stack->state);
2886     uint8_t event[3];
2887     event[0] = BTSTACK_EVENT_STATE;
2888     event[1] = sizeof(event) - 2;
2889     event[2] = hci_stack->state;
2890     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2891     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2892 }
2893 
2894 void hci_emit_connection_complete(hci_connection_t *conn, uint8_t status){
2895     uint8_t event[13];
2896     event[0] = HCI_EVENT_CONNECTION_COMPLETE;
2897     event[1] = sizeof(event) - 2;
2898     event[2] = status;
2899     bt_store_16(event, 3, conn->con_handle);
2900     bt_flip_addr(&event[5], conn->address);
2901     event[11] = 1; // ACL connection
2902     event[12] = 0; // encryption disabled
2903     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2904     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2905 }
2906 
2907 static void hci_emit_le_connection_complete(uint8_t address_type, bd_addr_t address, uint16_t conn_handle, uint8_t status){
2908     uint8_t event[21];
2909     event[0] = HCI_EVENT_LE_META;
2910     event[1] = sizeof(event) - 2;
2911     event[2] = HCI_SUBEVENT_LE_CONNECTION_COMPLETE;
2912     event[3] = status;
2913     bt_store_16(event, 4, conn_handle);
2914     event[6] = 0; // TODO: role
2915     event[7] = address_type;
2916     bt_flip_addr(&event[8], address);
2917     bt_store_16(event, 14, 0); // interval
2918     bt_store_16(event, 16, 0); // latency
2919     bt_store_16(event, 18, 0); // supervision timeout
2920     event[20] = 0; // master clock accuracy
2921     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2922     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2923 }
2924 
2925 void hci_emit_disconnection_complete(uint16_t handle, uint8_t reason){
2926     uint8_t event[6];
2927     event[0] = HCI_EVENT_DISCONNECTION_COMPLETE;
2928     event[1] = sizeof(event) - 2;
2929     event[2] = 0; // status = OK
2930     bt_store_16(event, 3, handle);
2931     event[5] = reason;
2932     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2933     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2934 }
2935 
2936 void hci_emit_l2cap_check_timeout(hci_connection_t *conn){
2937     if (disable_l2cap_timeouts) return;
2938     log_info("L2CAP_EVENT_TIMEOUT_CHECK");
2939     uint8_t event[4];
2940     event[0] = L2CAP_EVENT_TIMEOUT_CHECK;
2941     event[1] = sizeof(event) - 2;
2942     bt_store_16(event, 2, conn->con_handle);
2943     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2944     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2945 }
2946 
2947 void hci_emit_nr_connections_changed(void){
2948     log_info("BTSTACK_EVENT_NR_CONNECTIONS_CHANGED %u", nr_hci_connections());
2949     uint8_t event[3];
2950     event[0] = BTSTACK_EVENT_NR_CONNECTIONS_CHANGED;
2951     event[1] = sizeof(event) - 2;
2952     event[2] = nr_hci_connections();
2953     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2954     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2955 }
2956 
2957 void hci_emit_hci_open_failed(void){
2958     log_info("BTSTACK_EVENT_POWERON_FAILED");
2959     uint8_t event[2];
2960     event[0] = BTSTACK_EVENT_POWERON_FAILED;
2961     event[1] = sizeof(event) - 2;
2962     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2963     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2964 }
2965 
2966 void hci_emit_btstack_version(void){
2967     log_info("BTSTACK_EVENT_VERSION %u.%u", BTSTACK_MAJOR, BTSTACK_MINOR);
2968     uint8_t event[6];
2969     event[0] = BTSTACK_EVENT_VERSION;
2970     event[1] = sizeof(event) - 2;
2971     event[2] = BTSTACK_MAJOR;
2972     event[3] = BTSTACK_MINOR;
2973     bt_store_16(event, 4, 3257);    // last SVN commit on Google Code + 1
2974     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2975     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2976 }
2977 
2978 void hci_emit_system_bluetooth_enabled(uint8_t enabled){
2979     log_info("BTSTACK_EVENT_SYSTEM_BLUETOOTH_ENABLED %u", enabled);
2980     uint8_t event[3];
2981     event[0] = BTSTACK_EVENT_SYSTEM_BLUETOOTH_ENABLED;
2982     event[1] = sizeof(event) - 2;
2983     event[2] = enabled;
2984     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2985     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
2986 }
2987 
2988 void hci_emit_remote_name_cached(bd_addr_t addr, device_name_t *name){
2989     uint8_t event[2+1+6+248+1]; // +1 for \0 in log_info
2990     event[0] = BTSTACK_EVENT_REMOTE_NAME_CACHED;
2991     event[1] = sizeof(event) - 2 - 1;
2992     event[2] = 0;   // just to be compatible with HCI_EVENT_REMOTE_NAME_REQUEST_COMPLETE
2993     bt_flip_addr(&event[3], addr);
2994     memcpy(&event[9], name, 248);
2995 
2996     event[9+248] = 0;   // assert \0 for log_info
2997     log_info("BTSTACK_EVENT_REMOTE_NAME_CACHED %s = '%s'", bd_addr_to_str(addr), &event[9]);
2998 
2999     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event)-1);
3000     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event)-1);
3001 }
3002 
3003 void hci_emit_discoverable_enabled(uint8_t enabled){
3004     log_info("BTSTACK_EVENT_DISCOVERABLE_ENABLED %u", enabled);
3005     uint8_t event[3];
3006     event[0] = BTSTACK_EVENT_DISCOVERABLE_ENABLED;
3007     event[1] = sizeof(event) - 2;
3008     event[2] = enabled;
3009     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
3010     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
3011 }
3012 
3013 void hci_emit_security_level(hci_con_handle_t con_handle, gap_security_level_t level){
3014     log_info("hci_emit_security_level %u for handle %x", level, con_handle);
3015     uint8_t event[5];
3016     int pos = 0;
3017     event[pos++] = GAP_SECURITY_LEVEL;
3018     event[pos++] = sizeof(event) - 2;
3019     bt_store_16(event, 2, con_handle);
3020     pos += 2;
3021     event[pos++] = level;
3022     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
3023     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
3024 }
3025 
3026 void hci_emit_dedicated_bonding_result(bd_addr_t address, uint8_t status){
3027     log_info("hci_emit_dedicated_bonding_result %u ", status);
3028     uint8_t event[9];
3029     int pos = 0;
3030     event[pos++] = GAP_DEDICATED_BONDING_COMPLETED;
3031     event[pos++] = sizeof(event) - 2;
3032     event[pos++] = status;
3033     bt_flip_addr( &event[pos], address);
3034     pos += 6;
3035     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
3036     hci_stack->packet_handler(HCI_EVENT_PACKET, event, sizeof(event));
3037 }
3038 
3039 // query if remote side supports eSCO
3040 int hci_remote_eSCO_supported(hci_con_handle_t con_handle){
3041     hci_connection_t * connection = hci_connection_for_handle(con_handle);
3042     if (!connection) return 0;
3043     return connection->remote_supported_feature_eSCO;
3044 }
3045 
3046 // query if remote side supports SSP
3047 int hci_remote_ssp_supported(hci_con_handle_t con_handle){
3048     hci_connection_t * connection = hci_connection_for_handle(con_handle);
3049     if (!connection) return 0;
3050     return (connection->bonding_flags & BONDING_REMOTE_SUPPORTS_SSP) ? 1 : 0;
3051 }
3052 
3053 int hci_ssp_supported_on_both_sides(hci_con_handle_t handle){
3054     return hci_local_ssp_activated() && hci_remote_ssp_supported(handle);
3055 }
3056 
3057 // GAP API
3058 /**
3059  * @bbrief enable/disable bonding. default is enabled
3060  * @praram enabled
3061  */
3062 void gap_set_bondable_mode(int enable){
3063     hci_stack->bondable = enable ? 1 : 0;
3064 }
3065 /**
3066  * @brief Get bondable mode.
3067  * @return 1 if bondable
3068  */
3069 int gap_get_bondable_mode(void){
3070     return hci_stack->bondable;
3071 }
3072 
3073 /**
3074  * @brief map link keys to security levels
3075  */
3076 gap_security_level_t gap_security_level_for_link_key_type(link_key_type_t link_key_type){
3077     switch (link_key_type){
3078         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P256:
3079             return LEVEL_4;
3080         case COMBINATION_KEY:
3081         case AUTHENTICATED_COMBINATION_KEY_GENERATED_FROM_P192:
3082             return LEVEL_3;
3083         default:
3084             return LEVEL_2;
3085     }
3086 }
3087 
3088 static gap_security_level_t gap_security_level_for_connection(hci_connection_t * connection){
3089     if (!connection) return LEVEL_0;
3090     if ((connection->authentication_flags & CONNECTION_ENCRYPTED) == 0) return LEVEL_0;
3091     return gap_security_level_for_link_key_type(connection->link_key_type);
3092 }
3093 
3094 
3095 int gap_mitm_protection_required_for_security_level(gap_security_level_t level){
3096     log_info("gap_mitm_protection_required_for_security_level %u", level);
3097     return level > LEVEL_2;
3098 }
3099 
3100 /**
3101  * @brief get current security level
3102  */
3103 gap_security_level_t gap_security_level(hci_con_handle_t con_handle){
3104     hci_connection_t * connection = hci_connection_for_handle(con_handle);
3105     if (!connection) return LEVEL_0;
3106     return gap_security_level_for_connection(connection);
3107 }
3108 
3109 /**
3110  * @brief request connection to device to
3111  * @result GAP_AUTHENTICATION_RESULT
3112  */
3113 void gap_request_security_level(hci_con_handle_t con_handle, gap_security_level_t requested_level){
3114     hci_connection_t * connection = hci_connection_for_handle(con_handle);
3115     if (!connection){
3116         hci_emit_security_level(con_handle, LEVEL_0);
3117         return;
3118     }
3119     gap_security_level_t current_level = gap_security_level(con_handle);
3120     log_info("gap_request_security_level %u, current level %u", requested_level, current_level);
3121     if (current_level >= requested_level){
3122         hci_emit_security_level(con_handle, current_level);
3123         return;
3124     }
3125 
3126     connection->requested_security_level = requested_level;
3127 
3128 #if 0
3129     // sending encryption request without a link key results in an error.
3130     // TODO: figure out how to use it properly
3131 
3132     // would enabling ecnryption suffice (>= LEVEL_2)?
3133     if (hci_stack->remote_device_db){
3134         link_key_type_t link_key_type;
3135         link_key_t      link_key;
3136         if (hci_stack->remote_device_db->get_link_key( &connection->address, &link_key, &link_key_type)){
3137             if (gap_security_level_for_link_key_type(link_key_type) >= requested_level){
3138                 connection->bonding_flags |= BONDING_SEND_ENCRYPTION_REQUEST;
3139                 return;
3140             }
3141         }
3142     }
3143 #endif
3144 
3145     // try to authenticate connection
3146     connection->bonding_flags |= BONDING_SEND_AUTHENTICATE_REQUEST;
3147     hci_run();
3148 }
3149 
3150 /**
3151  * @brief start dedicated bonding with device. disconnect after bonding
3152  * @param device
3153  * @param request MITM protection
3154  * @result GAP_DEDICATED_BONDING_COMPLETE
3155  */
3156 int gap_dedicated_bonding(bd_addr_t device, int mitm_protection_required){
3157 
3158     // create connection state machine
3159     hci_connection_t * connection = create_connection_for_bd_addr_and_type(device, BD_ADDR_TYPE_CLASSIC);
3160 
3161     if (!connection){
3162         return BTSTACK_MEMORY_ALLOC_FAILED;
3163     }
3164 
3165     // delete linkn key
3166     hci_drop_link_key_for_bd_addr(device);
3167 
3168     // configure LEVEL_2/3, dedicated bonding
3169     connection->state = SEND_CREATE_CONNECTION;
3170     connection->requested_security_level = mitm_protection_required ? LEVEL_3 : LEVEL_2;
3171     log_info("gap_dedicated_bonding, mitm %u -> level %u", mitm_protection_required, connection->requested_security_level);
3172     connection->bonding_flags = BONDING_DEDICATED;
3173 
3174     // wait for GAP Security Result and send GAP Dedicated Bonding complete
3175 
3176     // handle: connnection failure (connection complete != ok)
3177     // handle: authentication failure
3178     // handle: disconnect on done
3179 
3180     hci_run();
3181 
3182     return 0;
3183 }
3184 
3185 void gap_set_local_name(const char * local_name){
3186     hci_stack->local_name = local_name;
3187 }
3188 
3189 uint8_t le_central_start_scan(void){
3190     if (hci_stack->le_scanning_state == LE_SCANNING) return 0;
3191     hci_stack->le_scanning_state = LE_START_SCAN;
3192     hci_run();
3193     return 0;
3194 }
3195 
3196 uint8_t le_central_stop_scan(void){
3197     if ( hci_stack->le_scanning_state == LE_SCAN_IDLE) return 0;
3198     hci_stack->le_scanning_state = LE_STOP_SCAN;
3199     hci_run();
3200     return 0;
3201 }
3202 
3203 void le_central_set_scan_parameters(uint8_t scan_type, uint16_t scan_interval, uint16_t scan_window){
3204     hci_stack->le_scan_type     = scan_type;
3205     hci_stack->le_scan_interval = scan_interval;
3206     hci_stack->le_scan_window   = scan_window;
3207     hci_run();
3208 }
3209 
3210 uint8_t le_central_connect(bd_addr_t addr, bd_addr_type_t addr_type){
3211     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(addr, addr_type);
3212     if (!conn){
3213         log_info("le_central_connect: no connection exists yet, creating context");
3214         conn = create_connection_for_bd_addr_and_type(addr, addr_type);
3215         if (!conn){
3216             // notify client that alloc failed
3217             hci_emit_le_connection_complete(addr_type, addr, 0, BTSTACK_MEMORY_ALLOC_FAILED);
3218             log_info("le_central_connect: failed to alloc hci_connection_t");
3219             return GATT_CLIENT_NOT_CONNECTED; // don't sent packet to controller
3220         }
3221         conn->state = SEND_CREATE_CONNECTION;
3222         log_info("le_central_connect: send create connection next");
3223         hci_run();
3224         return 0;
3225     }
3226 
3227     if (!hci_is_le_connection(conn) ||
3228         conn->state == SEND_CREATE_CONNECTION ||
3229         conn->state == SENT_CREATE_CONNECTION) {
3230         hci_emit_le_connection_complete(conn->address_type, conn->address, 0, ERROR_CODE_COMMAND_DISALLOWED);
3231         log_error("le_central_connect: classic connection or connect is already being created");
3232         return GATT_CLIENT_IN_WRONG_STATE;
3233     }
3234 
3235     log_info("le_central_connect: context exists with state %u", conn->state);
3236     hci_emit_le_connection_complete(conn->address_type, conn->address, conn->con_handle, 0);
3237     hci_run();
3238     return 0;
3239 }
3240 
3241 // @assumption: only a single outgoing LE Connection exists
3242 static hci_connection_t * le_central_get_outgoing_connection(void){
3243     btstack_linked_item_t *it;
3244     for (it = (btstack_linked_item_t *) hci_stack->connections; it ; it = it->next){
3245         hci_connection_t * conn = (hci_connection_t *) it;
3246         if (!hci_is_le_connection(conn)) continue;
3247         switch (conn->state){
3248             case SEND_CREATE_CONNECTION:
3249             case SENT_CREATE_CONNECTION:
3250                 return conn;
3251             default:
3252                 break;
3253         };
3254     }
3255     return NULL;
3256 }
3257 
3258 uint8_t le_central_connect_cancel(void){
3259     hci_connection_t * conn = le_central_get_outgoing_connection();
3260     if (!conn) return 0;
3261     switch (conn->state){
3262         case SEND_CREATE_CONNECTION:
3263             // skip sending create connection and emit event instead
3264             hci_emit_le_connection_complete(conn->address_type, conn->address, 0, ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER);
3265             btstack_linked_list_remove(&hci_stack->connections, (btstack_linked_item_t *) conn);
3266             btstack_memory_hci_connection_free( conn );
3267             break;
3268         case SENT_CREATE_CONNECTION:
3269             // request to send cancel connection
3270             conn->state = SEND_CANCEL_CONNECTION;
3271             hci_run();
3272             break;
3273         default:
3274             break;
3275     }
3276     return 0;
3277 }
3278 
3279 /**
3280  * @brief Updates the connection parameters for a given LE connection
3281  * @param handle
3282  * @param conn_interval_min (unit: 1.25ms)
3283  * @param conn_interval_max (unit: 1.25ms)
3284  * @param conn_latency
3285  * @param supervision_timeout (unit: 10ms)
3286  * @returns 0 if ok
3287  */
3288 int gap_update_connection_parameters(hci_con_handle_t con_handle, uint16_t conn_interval_min,
3289     uint16_t conn_interval_max, uint16_t conn_latency, uint16_t supervision_timeout){
3290     hci_connection_t * connection = hci_connection_for_handle(con_handle);
3291     if (!connection) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
3292     connection->le_conn_interval_min = conn_interval_min;
3293     connection->le_conn_interval_max = conn_interval_max;
3294     connection->le_conn_latency = conn_latency;
3295     connection->le_supervision_timeout = supervision_timeout;
3296     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS;
3297     hci_run();
3298     return 0;
3299 }
3300 
3301 /**
3302  * @brief Request an update of the connection parameter for a given LE connection
3303  * @param handle
3304  * @param conn_interval_min (unit: 1.25ms)
3305  * @param conn_interval_max (unit: 1.25ms)
3306  * @param conn_latency
3307  * @param supervision_timeout (unit: 10ms)
3308  * @returns 0 if ok
3309  */
3310 int gap_request_connection_parameter_update(hci_con_handle_t con_handle, uint16_t conn_interval_min,
3311     uint16_t conn_interval_max, uint16_t conn_latency, uint16_t supervision_timeout){
3312     hci_connection_t * connection = hci_connection_for_handle(con_handle);
3313     if (!connection) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
3314     connection->le_conn_interval_min = conn_interval_min;
3315     connection->le_conn_interval_max = conn_interval_max;
3316     connection->le_conn_latency = conn_latency;
3317     connection->le_supervision_timeout = supervision_timeout;
3318     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_SEND_REQUEST;
3319     hci_run();
3320     return 0;
3321 }
3322 
3323 /**
3324  * @brief Set Advertisement Data
3325  * @param advertising_data_length
3326  * @param advertising_data (max 31 octets)
3327  * @note data is not copied, pointer has to stay valid
3328  */
3329 void gap_advertisements_set_data(uint8_t advertising_data_length, uint8_t * advertising_data){
3330     hci_stack->le_advertisements_data_len = advertising_data_length;
3331     hci_stack->le_advertisements_data = advertising_data;
3332     hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_SET_DATA;
3333     // disable advertisements before setting data
3334     if (hci_stack->le_advertisements_active){
3335         hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_DISABLE | LE_ADVERTISEMENT_TASKS_ENABLE;
3336     }
3337     hci_run();
3338 }
3339 
3340 /**
3341  * @brief Set Advertisement Parameters
3342  * @param adv_int_min
3343  * @param adv_int_max
3344  * @param adv_type
3345  * @param own_address_type
3346  * @param direct_address_type
3347  * @param direct_address
3348  * @param channel_map
3349  * @param filter_policy
3350  *
3351  * @note internal use. use gap_advertisements_set_params from gap_le.h instead.
3352  */
3353  void hci_le_advertisements_set_params(uint16_t adv_int_min, uint16_t adv_int_max, uint8_t adv_type,
3354     uint8_t own_address_type, uint8_t direct_address_typ, bd_addr_t direct_address,
3355     uint8_t channel_map, uint8_t filter_policy) {
3356 
3357     hci_stack->le_advertisements_interval_min = adv_int_min;
3358     hci_stack->le_advertisements_interval_max = adv_int_max;
3359     hci_stack->le_advertisements_type = adv_type;
3360     hci_stack->le_advertisements_own_address_type = own_address_type;
3361     hci_stack->le_advertisements_direct_address_type = direct_address_typ;
3362     hci_stack->le_advertisements_channel_map = channel_map;
3363     hci_stack->le_advertisements_filter_policy = filter_policy;
3364     memcpy(hci_stack->le_advertisements_direct_address, direct_address, 6);
3365 
3366     hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_SET_PARAMS;
3367     // disable advertisements before changing params
3368     if (hci_stack->le_advertisements_active){
3369         hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_DISABLE | LE_ADVERTISEMENT_TASKS_ENABLE;
3370     }
3371     hci_run();
3372  }
3373 
3374 /**
3375  * @brief Enable/Disable Advertisements
3376  * @param enabled
3377  */
3378 void gap_advertisements_enable(int enabled){
3379     hci_stack->le_advertisements_enabled = enabled;
3380     if (enabled && !hci_stack->le_advertisements_active){
3381         hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_ENABLE;
3382     }
3383     if (!enabled && hci_stack->le_advertisements_active){
3384         hci_stack->le_advertisements_todo |= LE_ADVERTISEMENT_TASKS_DISABLE;
3385     }
3386     hci_run();
3387 }
3388 
3389 
3390 uint8_t gap_disconnect(hci_con_handle_t handle){
3391     hci_connection_t * conn = hci_connection_for_handle(handle);
3392     if (!conn){
3393         hci_emit_disconnection_complete(handle, 0);
3394         return 0;
3395     }
3396     conn->state = SEND_DISCONNECT;
3397     hci_run();
3398     return 0;
3399 }
3400 
3401 /**
3402  * @brief Get connection type
3403  * @param con_handle
3404  * @result connection_type
3405  */
3406 gap_connection_type_t gap_get_connection_type(hci_con_handle_t connection_handle){
3407     hci_connection_t * conn = hci_connection_for_handle(connection_handle);
3408     if (!conn) return GAP_CONNECTION_INVALID;
3409     switch (conn->address_type){
3410         case BD_ADDR_TYPE_LE_PUBLIC:
3411         case BD_ADDR_TYPE_LE_RANDOM:
3412             return GAP_CONNECTION_LE;
3413         case BD_ADDR_TYPE_SCO:
3414             return GAP_CONNECTION_SCO;
3415         case BD_ADDR_TYPE_CLASSIC:
3416             return GAP_CONNECTION_ACL;
3417         default:
3418             return GAP_CONNECTION_INVALID;
3419     }
3420 }
3421 
3422 #ifdef ENABLE_BLE
3423 
3424 /**
3425  * @brief Auto Connection Establishment - Start Connecting to device
3426  * @param address_typ
3427  * @param address
3428  * @returns 0 if ok
3429  */
3430 int gap_auto_connection_start(bd_addr_type_t address_type, bd_addr_t address){
3431     // check capacity
3432     int num_entries = btstack_linked_list_count(&hci_stack->le_whitelist);
3433     if (num_entries >= hci_stack->le_whitelist_capacity) return ERROR_CODE_MEMORY_CAPACITY_EXCEEDED;
3434     whitelist_entry_t * entry = btstack_memory_whitelist_entry_get();
3435     if (!entry) return BTSTACK_MEMORY_ALLOC_FAILED;
3436     entry->address_type = address_type;
3437     memcpy(entry->address, address, 6);
3438     entry->state = LE_WHITELIST_ADD_TO_CONTROLLER;
3439     btstack_linked_list_add(&hci_stack->le_whitelist, (btstack_linked_item_t*) entry);
3440     hci_run();
3441     return 0;
3442 }
3443 
3444 static void hci_remove_from_whitelist(bd_addr_type_t address_type, bd_addr_t address){
3445     btstack_linked_list_iterator_t it;
3446     btstack_linked_list_iterator_init(&it, &hci_stack->le_whitelist);
3447     while (btstack_linked_list_iterator_has_next(&it)){
3448         whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&it);
3449         if (entry->address_type != address_type) continue;
3450         if (memcmp(entry->address, address, 6) != 0) continue;
3451         if (entry->state & LE_WHITELIST_ON_CONTROLLER){
3452             // remove from controller if already present
3453             entry->state |= LE_WHITELIST_REMOVE_FROM_CONTROLLER;
3454             continue;
3455         }
3456         // direclty remove entry from whitelist
3457         btstack_linked_list_iterator_remove(&it);
3458         btstack_memory_whitelist_entry_free(entry);
3459     }
3460 }
3461 
3462 /**
3463  * @brief Auto Connection Establishment - Stop Connecting to device
3464  * @param address_typ
3465  * @param address
3466  * @returns 0 if ok
3467  */
3468 int gap_auto_connection_stop(bd_addr_type_t address_type, bd_addr_t address){
3469     hci_remove_from_whitelist(address_type, address);
3470     hci_run();
3471     return 0;
3472 }
3473 
3474 /**
3475  * @brief Auto Connection Establishment - Stop everything
3476  * @note  Convenience function to stop all active auto connection attempts
3477  */
3478 void gap_auto_connection_stop_all(void){
3479     btstack_linked_list_iterator_t it;
3480     btstack_linked_list_iterator_init(&it, &hci_stack->le_whitelist);
3481     while (btstack_linked_list_iterator_has_next(&it)){
3482         whitelist_entry_t * entry = (whitelist_entry_t*) btstack_linked_list_iterator_next(&it);
3483         if (entry->state & LE_WHITELIST_ON_CONTROLLER){
3484             // remove from controller if already present
3485             entry->state |= LE_WHITELIST_REMOVE_FROM_CONTROLLER;
3486             continue;
3487         }
3488         // directly remove entry from whitelist
3489         btstack_linked_list_iterator_remove(&it);
3490         btstack_memory_whitelist_entry_free(entry);
3491     }
3492     hci_run();
3493 }
3494 
3495 #endif
3496 
3497 /**
3498  * @brief Configure Voice Setting for use with SCO data in HSP/HFP
3499  */
3500 void hci_set_sco_voice_setting(uint16_t voice_setting){
3501     hci_stack->sco_voice_setting = voice_setting;
3502 }
3503 
3504 /**
3505  * @brief Get SCO Voice Setting
3506  * @return current voice setting
3507  */
3508 uint16_t hci_get_sco_voice_setting(){
3509     return hci_stack->sco_voice_setting;
3510 }
3511 
3512 /** @brief Get SCO packet length for current SCO Voice setting
3513  *  @note  Using SCO packets of the exact length is required for USB transfer
3514  *  @return Length of SCO packets in bytes (not audio frames)
3515  */
3516 int hci_get_sco_packet_length(void){
3517     // see Core Spec for H2 USB Transfer.
3518     if (hci_stack->sco_voice_setting & 0x0020) return 51;
3519     return 27;
3520 }
3521 
3522 /**
3523  * @brief Set callback for Bluetooth Hardware Error
3524  */
3525 void hci_set_hardware_error_callback(void (*fn)(void)){
3526     hci_stack->hardware_error_callback = fn;
3527 }
3528 
3529 
3530 void hci_disconnect_all(void){
3531     btstack_linked_list_iterator_t it;
3532     btstack_linked_list_iterator_init(&it, &hci_stack->connections);
3533     while (btstack_linked_list_iterator_has_next(&it)){
3534         hci_connection_t * con = (hci_connection_t*) btstack_linked_list_iterator_next(&it);
3535         if (con->state == SENT_DISCONNECT) continue;
3536         con->state = SEND_DISCONNECT;
3537     }
3538     hci_run();
3539 }
3540