xref: /btstack/src/l2cap.c (revision 2a424812a10affc43fcb1629015734924bcafbb9)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "l2cap.c"
39 
40 /*
41  *  l2cap.c
42  *
43  *  Logical Link Control and Adaption Protocl (L2CAP)
44  *
45  *  Created by Matthias Ringwald on 5/16/09.
46  */
47 
48 #include "l2cap.h"
49 #include "hci.h"
50 #include "hci_dump.h"
51 #include "bluetooth_sdp.h"
52 #include "btstack_debug.h"
53 #include "btstack_event.h"
54 #include "btstack_memory.h"
55 
56 #ifdef ENABLE_LE_DATA_CHANNELS
57 #include "ble/sm.h"
58 #endif
59 
60 #include <stdarg.h>
61 #include <string.h>
62 
63 #include <stdio.h>
64 
65 // nr of buffered acl packets in outgoing queue to get max performance
66 #define NR_BUFFERED_ACL_PACKETS 3
67 
68 // used to cache l2cap rejects, echo, and informational requests
69 #define NR_PENDING_SIGNALING_RESPONSES 3
70 
71 // nr of credits provided to remote if credits fall below watermark
72 #define L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_WATERMARK 5
73 #define L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_INCREMENT 5
74 
75 // offsets for L2CAP SIGNALING COMMANDS
76 #define L2CAP_SIGNALING_COMMAND_CODE_OFFSET   0
77 #define L2CAP_SIGNALING_COMMAND_SIGID_OFFSET  1
78 #define L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET 2
79 #define L2CAP_SIGNALING_COMMAND_DATA_OFFSET   4
80 
81 // internal table
82 #define L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL 0
83 #define L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL  1
84 #define L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL 2
85 #define L2CAP_FIXED_CHANNEL_TABLE_SIZE (L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL+1)
86 
87 #if defined(ENABLE_LE_DATA_CHANNELS) || defined(ENABLE_CLASSIC)
88 #define L2CAP_USES_CHANNELS
89 #endif
90 
91 // prototypes
92 static void l2cap_run(void);
93 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
94 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size );
95 static void l2cap_notify_channel_can_send(void);
96 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel);
97 #ifdef ENABLE_CLASSIC
98 static void l2cap_finialize_channel_close(l2cap_channel_t *channel);
99 static inline l2cap_service_t * l2cap_get_service(uint16_t psm);
100 static void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
101 static void l2cap_emit_channel_closed(l2cap_channel_t *channel);
102 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel);
103 static int  l2cap_channel_ready_for_open(l2cap_channel_t *channel);
104 #endif
105 #ifdef ENABLE_LE_DATA_CHANNELS
106 static void l2cap_emit_le_channel_opened(l2cap_channel_t *channel, uint8_t status);
107 static void l2cap_emit_le_incoming_connection(l2cap_channel_t *channel);
108 static l2cap_channel_t * l2cap_le_get_channel_for_local_cid(uint16_t local_cid);
109 static void l2cap_le_notify_channel_can_send(l2cap_channel_t *channel);
110 static void l2cap_le_finialize_channel_close(l2cap_channel_t *channel);
111 static inline l2cap_service_t * l2cap_le_get_service(uint16_t psm);
112 #endif
113 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
114 static int l2cap_ertm_num_unacknowledged_tx_packets(l2cap_channel_t * channel);
115 #endif
116 
117 typedef struct l2cap_fixed_channel {
118     btstack_packet_handler_t callback;
119     uint8_t waiting_for_can_send_now;
120 } l2cap_fixed_channel_t;
121 
122 #ifdef ENABLE_CLASSIC
123 static btstack_linked_list_t l2cap_channels;
124 static btstack_linked_list_t l2cap_services;
125 static uint8_t require_security_level2_for_outgoing_sdp;
126 #endif
127 
128 #ifdef ENABLE_LE_DATA_CHANNELS
129 static btstack_linked_list_t l2cap_le_channels;
130 static btstack_linked_list_t l2cap_le_services;
131 #endif
132 
133 // used to cache l2cap rejects, echo, and informational requests
134 static l2cap_signaling_response_t signaling_responses[NR_PENDING_SIGNALING_RESPONSES];
135 static int signaling_responses_pending;
136 
137 static btstack_packet_callback_registration_t hci_event_callback_registration;
138 static l2cap_fixed_channel_t fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_SIZE];
139 
140 #ifdef ENABLE_BLE
141 // only used for connection parameter update events
142 static btstack_packet_handler_t l2cap_event_packet_handler;
143 #endif
144 
145 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
146 
147 /*
148  * CRC lookup table for generator polynom D^16 + D^15 + D^2 + 1
149  */
150 static const uint16_t crc16_table[256] = {
151     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241, 0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
152     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40, 0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
153     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40, 0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
154     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641, 0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
155     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240, 0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
156     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41, 0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
157     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41, 0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
158     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640, 0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
159     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240, 0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
160     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41, 0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
161     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41, 0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
162     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640, 0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
163     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241, 0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
164     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40, 0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
165     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40, 0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
166     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641, 0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
167 };
168 
169 static uint16_t crc16_calc(uint8_t * data, uint16_t len){
170     uint16_t crc = 0;   // initial value = 0
171     while (len--){
172         crc = (crc >> 8) ^ crc16_table[ (crc ^ ((uint16_t) *data++)) & 0x00FF ];
173     }
174     return crc;
175 }
176 
177 #endif
178 
179 
180 static uint16_t l2cap_fixed_channel_table_channel_id_for_index(int index){
181     switch (index){
182         case L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL:
183             return L2CAP_CID_ATTRIBUTE_PROTOCOL;
184         case L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL:
185             return L2CAP_CID_SECURITY_MANAGER_PROTOCOL;
186         case L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL:
187             return L2CAP_CID_CONNECTIONLESS_CHANNEL;
188         default:
189             return 0;
190     }
191 }
192 static int l2cap_fixed_channel_table_index_for_channel_id(uint16_t channel_id){
193     switch (channel_id){
194         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
195             return L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL;
196         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
197             return  L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL;
198         case L2CAP_CID_CONNECTIONLESS_CHANNEL:
199             return  L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL;
200         default:
201             return -1;
202         }
203 }
204 
205 static int l2cap_fixed_channel_table_index_is_le(int index){
206     if (index == L2CAP_CID_CONNECTIONLESS_CHANNEL) return 0;
207     return 1;
208 }
209 
210 void l2cap_init(void){
211     signaling_responses_pending = 0;
212 
213     uint8_t test[] = {0x0E, 0x00, 0x40, 0x00, 0x02, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09 };
214     printf("crc16: %04x\n", crc16_calc(test, sizeof(test)));
215 
216 #ifdef ENABLE_CLASSIC
217     l2cap_channels = NULL;
218     l2cap_services = NULL;
219     require_security_level2_for_outgoing_sdp = 0;
220 #endif
221 
222 #ifdef ENABLE_LE_DATA_CHANNELS
223     l2cap_le_services = NULL;
224     l2cap_le_channels = NULL;
225 #endif
226 
227 #ifdef ENABLE_BLE
228     l2cap_event_packet_handler = NULL;
229 #endif
230     memset(fixed_channels, 0, sizeof(fixed_channels));
231 
232     //
233     // register callback with HCI
234     //
235     hci_event_callback_registration.callback = &l2cap_hci_event_handler;
236     hci_add_event_handler(&hci_event_callback_registration);
237 
238     hci_register_acl_packet_handler(&l2cap_acl_handler);
239 
240 #ifdef ENABLE_CLASSIC
241     gap_connectable_control(0); // no services yet
242 #endif
243 }
244 
245 void l2cap_register_packet_handler(void (*handler)(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size)){
246 #ifdef ENABLE_BLE
247     l2cap_event_packet_handler = handler;
248 #else
249     UNUSED(handler);
250 #endif
251 }
252 
253 void l2cap_request_can_send_fix_channel_now_event(hci_con_handle_t con_handle, uint16_t channel_id){
254     UNUSED(con_handle);
255 
256     int index = l2cap_fixed_channel_table_index_for_channel_id(channel_id);
257     if (index < 0) return;
258     fixed_channels[index].waiting_for_can_send_now = 1;
259     l2cap_notify_channel_can_send();
260 }
261 
262 int  l2cap_can_send_fixed_channel_packet_now(hci_con_handle_t con_handle, uint16_t channel_id){
263     UNUSED(channel_id);
264 
265     return hci_can_send_acl_packet_now(con_handle);
266 }
267 
268 uint8_t *l2cap_get_outgoing_buffer(void){
269     return hci_get_outgoing_packet_buffer() + COMPLETE_L2CAP_HEADER; // 8 bytes
270 }
271 
272 int l2cap_reserve_packet_buffer(void){
273     return hci_reserve_packet_buffer();
274 }
275 
276 void l2cap_release_packet_buffer(void){
277     hci_release_packet_buffer();
278 }
279 
280 static void l2cap_setup_header(uint8_t * acl_buffer, hci_con_handle_t con_handle, uint8_t packet_boundary, uint16_t remote_cid, uint16_t len){
281     // 0 - Connection handle : PB=pb : BC=00
282     little_endian_store_16(acl_buffer, 0, con_handle | (packet_boundary << 12) | (0 << 14));
283     // 2 - ACL length
284     little_endian_store_16(acl_buffer, 2,  len + 4);
285     // 4 - L2CAP packet length
286     little_endian_store_16(acl_buffer, 4,  len + 0);
287     // 6 - L2CAP channel DEST
288     little_endian_store_16(acl_buffer, 6,  remote_cid);
289 }
290 
291 // assumption - only on LE connections
292 int l2cap_send_prepared_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint16_t len){
293 
294     if (!hci_is_packet_buffer_reserved()){
295         log_error("l2cap_send_prepared_connectionless called without reserving packet first");
296         return BTSTACK_ACL_BUFFERS_FULL;
297     }
298 
299     if (!hci_can_send_prepared_acl_packet_now(con_handle)){
300         log_info("l2cap_send_prepared_connectionless handle 0x%02x, cid 0x%02x, cannot send", con_handle, cid);
301         return BTSTACK_ACL_BUFFERS_FULL;
302     }
303 
304     log_debug("l2cap_send_prepared_connectionless handle %u, cid 0x%02x", con_handle, cid);
305 
306     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
307     l2cap_setup_header(acl_buffer, con_handle, 0, cid, len);
308     // send
309     return hci_send_acl_packet_buffer(len+8);
310 }
311 
312 // assumption - only on LE connections
313 int l2cap_send_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint8_t *data, uint16_t len){
314 
315     if (!hci_can_send_acl_packet_now(con_handle)){
316         log_info("l2cap_send cid 0x%02x, cannot send", cid);
317         return BTSTACK_ACL_BUFFERS_FULL;
318     }
319 
320     hci_reserve_packet_buffer();
321     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
322 
323     memcpy(&acl_buffer[8], data, len);
324 
325     return l2cap_send_prepared_connectionless(con_handle, cid, len);
326 }
327 
328 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel) {
329     log_debug("L2CAP_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel);
330     uint8_t event[4];
331     event[0] = L2CAP_EVENT_CAN_SEND_NOW;
332     event[1] = sizeof(event) - 2;
333     little_endian_store_16(event, 2, channel);
334     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
335     packet_handler(HCI_EVENT_PACKET, channel, event, sizeof(event));
336 }
337 
338 #ifdef L2CAP_USES_CHANNELS
339 static void l2cap_dispatch_to_channel(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size){
340     (* (channel->packet_handler))(type, channel->local_cid, data, size);
341 }
342 
343 static void l2cap_emit_simple_event_with_cid(l2cap_channel_t * channel, uint8_t event_code){
344     uint8_t event[4];
345     event[0] = event_code;
346     event[1] = sizeof(event) - 2;
347     little_endian_store_16(event, 2, channel->local_cid);
348     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
349     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
350 }
351 #endif
352 
353 #ifdef ENABLE_CLASSIC
354 void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
355     log_info("L2CAP_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u, flush_timeout %u",
356              status, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
357              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu, channel->flush_timeout);
358     uint8_t event[24];
359     event[0] = L2CAP_EVENT_CHANNEL_OPENED;
360     event[1] = sizeof(event) - 2;
361     event[2] = status;
362     reverse_bd_addr(channel->address, &event[3]);
363     little_endian_store_16(event,  9, channel->con_handle);
364     little_endian_store_16(event, 11, channel->psm);
365     little_endian_store_16(event, 13, channel->local_cid);
366     little_endian_store_16(event, 15, channel->remote_cid);
367     little_endian_store_16(event, 17, channel->local_mtu);
368     little_endian_store_16(event, 19, channel->remote_mtu);
369     little_endian_store_16(event, 21, channel->flush_timeout);
370     event[23] = channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING ? 1 : 0;
371     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
372     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
373 }
374 
375 static void l2cap_emit_channel_closed(l2cap_channel_t *channel) {
376     log_info("L2CAP_EVENT_CHANNEL_CLOSED local_cid 0x%x", channel->local_cid);
377     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
378 }
379 
380 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel) {
381     log_info("L2CAP_EVENT_INCOMING_CONNECTION addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x",
382              bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid);
383     uint8_t event[16];
384     event[0] = L2CAP_EVENT_INCOMING_CONNECTION;
385     event[1] = sizeof(event) - 2;
386     reverse_bd_addr(channel->address, &event[2]);
387     little_endian_store_16(event,  8, channel->con_handle);
388     little_endian_store_16(event, 10, channel->psm);
389     little_endian_store_16(event, 12, channel->local_cid);
390     little_endian_store_16(event, 14, channel->remote_cid);
391     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
392     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
393 }
394 
395 static l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid){
396     btstack_linked_list_iterator_t it;
397     btstack_linked_list_iterator_init(&it, &l2cap_channels);
398     while (btstack_linked_list_iterator_has_next(&it)){
399         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
400         if ( channel->local_cid == local_cid) {
401             return channel;
402         }
403     }
404     return NULL;
405 }
406 
407 ///
408 
409 void l2cap_request_can_send_now_event(uint16_t local_cid){
410     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
411     if (!channel) return;
412     channel->waiting_for_can_send_now = 1;
413     l2cap_notify_channel_can_send();
414 }
415 
416 int  l2cap_can_send_packet_now(uint16_t local_cid){
417     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
418     if (!channel) return 0;
419     return hci_can_send_acl_packet_now(channel->con_handle);
420 }
421 
422 int  l2cap_can_send_prepared_packet_now(uint16_t local_cid){
423     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
424     if (!channel) return 0;
425     return hci_can_send_prepared_acl_packet_now(channel->con_handle);
426 }
427 uint16_t l2cap_get_remote_mtu_for_local_cid(uint16_t local_cid){
428     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
429     if (channel) {
430         return channel->remote_mtu;
431     }
432     return 0;
433 }
434 
435 static l2cap_channel_t * l2cap_channel_for_rtx_timer(btstack_timer_source_t * ts){
436     btstack_linked_list_iterator_t it;
437     btstack_linked_list_iterator_init(&it, &l2cap_channels);
438     while (btstack_linked_list_iterator_has_next(&it)){
439         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
440         if ( &channel->rtx == ts) {
441             return channel;
442         }
443     }
444     return NULL;
445 }
446 
447 static void l2cap_rtx_timeout(btstack_timer_source_t * ts){
448     l2cap_channel_t * channel = l2cap_channel_for_rtx_timer(ts);
449     if (!channel) return;
450 
451     log_info("l2cap_rtx_timeout for local cid 0x%02x", channel->local_cid);
452 
453     // "When terminating the channel, it is not necessary to send a L2CAP_DisconnectReq
454     //  and enter WAIT_DISCONNECT state. Channels can be transitioned directly to the CLOSED state."
455     // notify client
456     l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_RTX_TIMEOUT);
457 
458     // discard channel
459     // no need to stop timer here, it is removed from list during timer callback
460     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
461     btstack_memory_l2cap_channel_free(channel);
462 }
463 
464 static void l2cap_stop_rtx(l2cap_channel_t * channel){
465     log_info("l2cap_stop_rtx for local cid 0x%02x", channel->local_cid);
466     btstack_run_loop_remove_timer(&channel->rtx);
467 }
468 
469 static void l2cap_start_rtx(l2cap_channel_t * channel){
470     l2cap_stop_rtx(channel);
471     log_info("l2cap_start_rtx for local cid 0x%02x", channel->local_cid);
472     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
473     btstack_run_loop_set_timer(&channel->rtx, L2CAP_RTX_TIMEOUT_MS);
474     btstack_run_loop_add_timer(&channel->rtx);
475 }
476 
477 static void l2cap_start_ertx(l2cap_channel_t * channel){
478     log_info("l2cap_start_ertx for local cid 0x%02x", channel->local_cid);
479     l2cap_stop_rtx(channel);
480     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
481     btstack_run_loop_set_timer(&channel->rtx, L2CAP_ERTX_TIMEOUT_MS);
482     btstack_run_loop_add_timer(&channel->rtx);
483 }
484 
485 void l2cap_require_security_level_2_for_outgoing_sdp(void){
486     require_security_level2_for_outgoing_sdp = 1;
487 }
488 
489 static int l2cap_security_level_0_allowed_for_PSM(uint16_t psm){
490     return (psm == BLUETOOTH_PROTOCOL_SDP) && (!require_security_level2_for_outgoing_sdp);
491 }
492 
493 static int l2cap_send_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, uint8_t identifier, ...){
494     if (!hci_can_send_acl_packet_now(handle)){
495         log_info("l2cap_send_signaling_packet, cannot send");
496         return BTSTACK_ACL_BUFFERS_FULL;
497     }
498 
499     // log_info("l2cap_send_signaling_packet type %u", cmd);
500     hci_reserve_packet_buffer();
501     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
502     va_list argptr;
503     va_start(argptr, identifier);
504     uint16_t len = l2cap_create_signaling_classic(acl_buffer, handle, cmd, identifier, argptr);
505     va_end(argptr);
506     // log_info("l2cap_send_signaling_packet con %u!", handle);
507     return hci_send_acl_packet_buffer(len);
508 }
509 
510 // assumption - only on Classic connections
511 int l2cap_send_prepared(uint16_t local_cid, uint16_t len){
512 
513     if (!hci_is_packet_buffer_reserved()){
514         log_error("l2cap_send_prepared called without reserving packet first");
515         return BTSTACK_ACL_BUFFERS_FULL;
516     }
517 
518     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
519     if (!channel) {
520         log_error("l2cap_send_prepared no channel for cid 0x%02x", local_cid);
521         return -1;   // TODO: define error
522     }
523 
524     if (!hci_can_send_prepared_acl_packet_now(channel->con_handle)){
525         log_info("l2cap_send_prepared cid 0x%02x, cannot send", local_cid);
526         return BTSTACK_ACL_BUFFERS_FULL;
527     }
528 
529     log_debug("l2cap_send_prepared cid 0x%02x, handle %u, 1 credit used", local_cid, channel->con_handle);
530 
531     int fcs_size = 0;
532 
533 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
534     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
535         fcs_size = 2;
536     }
537 #endif
538 
539     // set non-flushable packet boundary flag if supported on Controller
540     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
541     uint8_t packet_boundary_flag = hci_non_flushable_packet_boundary_flag_supported() ? 0x00 : 0x02;
542     l2cap_setup_header(acl_buffer, channel->con_handle, packet_boundary_flag, channel->remote_cid, len + fcs_size);
543 
544 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
545     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
546         // calculate FCS over l2cap data
547         uint16_t fcs = crc16_calc(acl_buffer + 4, 4 + len);
548         log_info("I-Frame: fcs 0x%04x", fcs);
549         little_endian_store_16(acl_buffer, 8 + len, fcs);
550     }
551 #endif
552 
553     // send
554     return hci_send_acl_packet_buffer(len+8+fcs_size);
555 }
556 
557 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
558 static inline uint16_t l2cap_encanced_control_field_for_information_frame(uint8_t tx_seq, int final, uint8_t req_seq, l2cap_segmentation_and_reassembly_t sar){
559     return (((uint16_t) sar) << 14) | (req_seq << 8) | (final << 7) | (tx_seq << 1) | 0;
560 }
561 static inline uint16_t l2cap_encanced_control_field_for_supevisor_frame(l2cap_supervisory_function_t supervisory_function, int poll, int final, uint8_t req_seq){
562     return (req_seq << 8) | (final << 7) | (poll << 4) | (((int) supervisory_function) << 2) | 1;
563 }
564 static int l2cap_next_ertm_seq_nr(int seq_nr){
565     return (seq_nr + 1) & 0x3f;
566 }
567 static void l2cap_ertm_next_tx_write_index(l2cap_channel_t * channel){
568     channel->tx_write_index++;
569     if (channel->tx_write_index < channel->num_tx_buffers) return;
570     channel->tx_write_index = 0;
571 }
572 static int l2cap_ertm_send_information_frame(l2cap_channel_t * channel, int index){
573     l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[index];
574     hci_reserve_packet_buffer();
575     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
576     uint16_t control = l2cap_encanced_control_field_for_information_frame(tx_state->tx_seq, 0, 0, L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU);
577     log_info("I-Frame: control 0x%04x", control);
578     little_endian_store_16(acl_buffer, 8, control);
579     memcpy(&acl_buffer[8+2], &channel->tx_packets_data[index * channel->local_mtu], tx_state->len);
580     // send
581     return l2cap_send_prepared(channel->local_cid, 2 + tx_state->len);
582 }
583 static int l2cap_ertm_send(l2cap_channel_t * channel, uint8_t * data, uint16_t len){
584     if (len > channel->remote_mtu){
585         log_error("l2cap_send cid 0x%02x, data length exceeds remote MTU.", channel->local_cid);
586         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
587     }
588     // TODO: check tx_transmit
589     // store int tx packet bufferx
590     int index = channel->tx_write_index;
591     l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[index];
592     tx_state->tx_seq = channel->next_tx_seq;
593     tx_state->len = len;
594     memcpy(&channel->tx_packets_data[index * channel->local_mtu], data, len);
595     // update
596     channel->next_tx_seq = l2cap_next_ertm_seq_nr(channel->next_tx_seq);
597     l2cap_ertm_next_tx_write_index(channel);
598     // try to send
599     l2cap_run();
600     return 0;
601 }
602 #endif
603 
604 // assumption - only on Classic connections
605 int l2cap_send(uint16_t local_cid, uint8_t *data, uint16_t len){
606     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
607     if (!channel) {
608         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
609         return -1;   // TODO: define error
610     }
611 
612 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
613     // send in ERTM
614     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
615         return l2cap_ertm_send(channel, data, len);
616     }
617 #endif
618 
619     if (len > channel->remote_mtu){
620         log_error("l2cap_send cid 0x%02x, data length exceeds remote MTU.", local_cid);
621         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
622     }
623 
624     if (!hci_can_send_acl_packet_now(channel->con_handle)){
625         log_info("l2cap_send cid 0x%02x, cannot send", local_cid);
626         return BTSTACK_ACL_BUFFERS_FULL;
627     }
628 
629     hci_reserve_packet_buffer();
630     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
631     memcpy(&acl_buffer[8], data, len);
632     return l2cap_send_prepared(local_cid, len);
633 }
634 
635 int l2cap_send_echo_request(hci_con_handle_t con_handle, uint8_t *data, uint16_t len){
636     return l2cap_send_signaling_packet(con_handle, ECHO_REQUEST, 0x77, len, data);
637 }
638 
639 static inline void channelStateVarSetFlag(l2cap_channel_t *channel, L2CAP_CHANNEL_STATE_VAR flag){
640     channel->state_var = (L2CAP_CHANNEL_STATE_VAR) (channel->state_var | flag);
641 }
642 
643 static inline void channelStateVarClearFlag(l2cap_channel_t *channel, L2CAP_CHANNEL_STATE_VAR flag){
644     channel->state_var = (L2CAP_CHANNEL_STATE_VAR) (channel->state_var & ~flag);
645 }
646 #endif
647 
648 
649 #ifdef ENABLE_BLE
650 static int l2cap_send_le_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, uint8_t identifier, ...){
651 
652     if (!hci_can_send_acl_packet_now(handle)){
653         log_info("l2cap_send_le_signaling_packet, cannot send");
654         return BTSTACK_ACL_BUFFERS_FULL;
655     }
656 
657     // log_info("l2cap_send_le_signaling_packet type %u", cmd);
658     hci_reserve_packet_buffer();
659     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
660     va_list argptr;
661     va_start(argptr, identifier);
662     uint16_t len = l2cap_create_signaling_le(acl_buffer, handle, cmd, identifier, argptr);
663     va_end(argptr);
664     // log_info("l2cap_send_le_signaling_packet con %u!", handle);
665     return hci_send_acl_packet_buffer(len);
666 }
667 #endif
668 
669 uint16_t l2cap_max_mtu(void){
670     return HCI_ACL_PAYLOAD_SIZE - L2CAP_HEADER_SIZE;
671 }
672 
673 uint16_t l2cap_max_le_mtu(void){
674     return l2cap_max_mtu();
675 }
676 
677 static uint16_t l2cap_setup_options_mtu(l2cap_channel_t * channel, uint8_t * config_options){
678     config_options[0] = 1; // MTU
679     config_options[1] = 2; // len param
680     little_endian_store_16( (uint8_t*)&config_options, 2, channel->local_mtu);
681     return 4;
682 }
683 
684 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
685 static uint16_t l2cap_setup_options_ertm(l2cap_channel_t * channel, uint8_t * config_options){
686     config_options[0] = 0x04;   // RETRANSMISSION AND FLOW CONTROL OPTION
687     config_options[1] = 9;      // length
688     config_options[2] = (uint8_t) channel->mode;
689     config_options[3] = channel->num_rx_buffers;    // == TxWindows size
690     config_options[4] = channel->local_max_transmit;
691     little_endian_store_16( config_options, 5, channel->local_retransmission_timeout_ms);
692     little_endian_store_16( config_options, 7, channel->local_monitor_timeout_ms);
693     little_endian_store_16( config_options, 9, channel->local_mtu);
694     return 11;
695 }
696 static int l2cap_ertm_send_supervisor_frame(l2cap_channel_t * channel, uint16_t control){
697     hci_reserve_packet_buffer();
698     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
699     log_info("S-Frame: control 0x%04x", control);
700     little_endian_store_16(acl_buffer, 8, control);
701     return l2cap_send_prepared(channel->local_cid, 2);
702 }
703 static int l2cap_ertm_num_unacknowledged_tx_packets(l2cap_channel_t * channel){
704     int unacknowledged_packets = channel->tx_send_index - channel->tx_read_index;
705     if (unacknowledged_packets < 0){
706         unacknowledged_packets += channel->num_tx_buffers;
707     }
708     return unacknowledged_packets;
709 }
710 #endif
711 
712 static uint16_t l2cap_setup_options(l2cap_channel_t * channel, uint8_t * config_options){
713 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
714     // use ERTM options if supported
715     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
716     if ((connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_DONE) && (connection->l2cap_state.extended_feature_mask & 0x08)){
717         return l2cap_setup_options_ertm(channel, config_options);
718 
719     }
720 #endif
721     return l2cap_setup_options_mtu(channel, config_options);
722 }
723 
724 static uint32_t l2cap_extended_features_mask(void){
725     // extended features request supported, features: fixed channels, unicast connectionless data reception
726     uint32_t features = 0x280;
727 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
728     features |= 0x0008;
729 #endif
730     return features;
731 }
732 
733 // MARK: L2CAP_RUN
734 // process outstanding signaling tasks
735 static void l2cap_run(void){
736 
737     // log_info("l2cap_run: entered");
738 
739     // check pending signaling responses
740     while (signaling_responses_pending){
741 
742         hci_con_handle_t handle = signaling_responses[0].handle;
743 
744         if (!hci_can_send_acl_packet_now(handle)) break;
745 
746         uint8_t  sig_id        = signaling_responses[0].sig_id;
747         uint8_t  response_code = signaling_responses[0].code;
748         uint16_t infoType      = signaling_responses[0].data;  // INFORMATION_REQUEST
749         uint16_t result        = signaling_responses[0].data;  // CONNECTION_REQUEST, COMMAND_REJECT
750 #ifdef ENABLE_CLASSIC
751         uint16_t source_cid    = signaling_responses[0].cid;   // CONNECTION_REQUEST
752 #endif
753         UNUSED(infoType);
754 
755         // remove first item before sending (to avoid sending response mutliple times)
756         signaling_responses_pending--;
757         int i;
758         for (i=0; i < signaling_responses_pending; i++){
759             memcpy(&signaling_responses[i], &signaling_responses[i+1], sizeof(l2cap_signaling_response_t));
760         }
761 
762         switch (response_code){
763 #ifdef ENABLE_CLASSIC
764             case CONNECTION_REQUEST:
765                 l2cap_send_signaling_packet(handle, CONNECTION_RESPONSE, sig_id, source_cid, 0, result, 0);
766                 // also disconnect if result is 0x0003 - security blocked
767                 if (result == 0x0003){
768                     hci_disconnect_security_block(handle);
769                 }
770                 break;
771             case ECHO_REQUEST:
772                 l2cap_send_signaling_packet(handle, ECHO_RESPONSE, sig_id, 0, NULL);
773                 break;
774             case INFORMATION_REQUEST:
775                 switch (infoType){
776                     case 1: { // Connectionless MTU
777                             uint16_t connectionless_mtu = hci_max_acl_data_packet_length();
778                             l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(connectionless_mtu), &connectionless_mtu);
779                         }
780                         break;
781                     case 2: {  // Extended Features Supported
782                             uint32_t features = l2cap_extended_features_mask();
783                             l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(features), &features);
784                         }
785                         break;
786                     case 3: { // Fixed Channels Supported
787                             uint8_t map[8];
788                             memset(map, 0, 8);
789                             map[0] = 0x06;  // L2CAP Signaling Channel (0x02) + Connectionless reception (0x04)
790                             l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(map), &map);
791                         }
792                         break;
793                     default:
794                         // all other types are not supported
795                         l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 1, 0, NULL);
796                         break;
797                 }
798                 break;
799             case COMMAND_REJECT:
800                 l2cap_send_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
801                 break;
802 #endif
803 #ifdef ENABLE_BLE
804             case LE_CREDIT_BASED_CONNECTION_REQUEST:
805                 l2cap_send_le_signaling_packet(handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, sig_id, 0, 0, 0, 0, result);
806                 break;
807             case COMMAND_REJECT_LE:
808                 l2cap_send_le_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
809                 break;
810 #endif
811             default:
812                 // should not happen
813                 break;
814         }
815     }
816 
817     btstack_linked_list_iterator_t it;
818     UNUSED(it);
819 
820 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
821     // send l2cap information request if neccessary
822     hci_connections_get_iterator(&it);
823     while(btstack_linked_list_iterator_has_next(&it)){
824         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
825         if (connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST){
826             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W4_EXTENDED_FEATURE_RESPONSE;
827             // send information request for extended features
828             uint8_t sig_id = l2cap_next_sig_id();
829             uint8_t info_type = 2;
830             l2cap_send_signaling_packet(connection->con_handle, INFORMATION_REQUEST, sig_id, info_type);
831             return;
832         }
833     }
834 #endif
835 
836 #ifdef ENABLE_CLASSIC
837     uint8_t  config_options[10];
838     btstack_linked_list_iterator_init(&it, &l2cap_channels);
839     while (btstack_linked_list_iterator_has_next(&it)){
840 
841         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
842         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
843         switch (channel->state){
844 
845             case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
846             case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
847                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
848                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND) {
849                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND);
850                     l2cap_send_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid, 1, 0);
851                 }
852                 break;
853 
854             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
855                 if (!hci_can_send_command_packet_now()) break;
856                 // send connection request - set state first
857                 channel->state = L2CAP_STATE_WAIT_CONNECTION_COMPLETE;
858                 // BD_ADDR, Packet_Type, Page_Scan_Repetition_Mode, Reserved, Clock_Offset, Allow_Role_Switch
859                 hci_send_cmd(&hci_create_connection, channel->address, hci_usable_acl_packet_types(), 0, 0, 0, 1);
860                 break;
861 
862             case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
863                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
864                 channel->state = L2CAP_STATE_INVALID;
865                 l2cap_send_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid, channel->reason, 0);
866                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
867                 l2cap_stop_rtx(channel);
868                 btstack_linked_list_iterator_remove(&it);
869                 btstack_memory_l2cap_channel_free(channel);
870                 break;
871 
872             case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
873                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
874                 channel->state = L2CAP_STATE_CONFIG;
875                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
876                 l2cap_send_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid, 0, 0);
877                 break;
878 
879             case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
880                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
881                 // success, start l2cap handshake
882                 channel->local_sig_id = l2cap_next_sig_id();
883                 channel->state = L2CAP_STATE_WAIT_CONNECT_RSP;
884                 l2cap_send_signaling_packet( channel->con_handle, CONNECTION_REQUEST, channel->local_sig_id, channel->psm, channel->local_cid);
885                 l2cap_start_rtx(channel);
886                 break;
887 
888             case L2CAP_STATE_CONFIG:
889                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
890                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP){
891                     uint16_t flags = 0;
892                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
893                     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT) {
894                         flags = 1;
895                     } else {
896                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
897                     }
898                     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID){
899                         channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
900                         l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_UNKNOWN_OPTIONS, 0, NULL);
901 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
902                     } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED){
903                         channelStateVarClearFlag(channel,L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
904                         channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
905                         uint16_t options_size = l2cap_setup_options(channel, config_options);
906                         l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS, options_size, &config_options);
907 #endif
908                     } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU){
909                         channelStateVarClearFlag(channel,L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
910                         uint16_t options_size = l2cap_setup_options(channel, config_options);
911                         l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS, options_size, &config_options);
912                     } else {
913                         l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS, 0, NULL);
914                     }
915                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
916                 }
917                 else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ){
918                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
919                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_REQ);
920                     channel->local_sig_id = l2cap_next_sig_id();
921                     uint16_t options_size = l2cap_setup_options(channel, config_options);
922                     l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_REQUEST, channel->local_sig_id, channel->remote_cid, 0, options_size, &config_options);
923                     l2cap_start_rtx(channel);
924                 }
925                 if (l2cap_channel_ready_for_open(channel)){
926                     channel->state = L2CAP_STATE_OPEN;
927                     l2cap_emit_channel_opened(channel, 0);  // success
928                 }
929                 break;
930 
931             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
932                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
933                 channel->state = L2CAP_STATE_INVALID;
934                 l2cap_send_signaling_packet( channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
935                 // we don't start an RTX timer for a disconnect - there's no point in closing the channel if the other side doesn't respond :)
936                 l2cap_finialize_channel_close(channel);  // -- remove from list
937                 break;
938 
939             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
940                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
941                 channel->local_sig_id = l2cap_next_sig_id();
942                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
943                 l2cap_send_signaling_packet( channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
944                 break;
945             default:
946                 break;
947         }
948 
949 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
950         // send s-frame to acknowledge received packets
951         if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
952 
953         if (channel->tx_send_index != channel->tx_write_index){
954             int unacknowledged_packets = l2cap_ertm_num_unacknowledged_tx_packets(channel);
955             // check remote tx window
956             log_info("unacknowledged_packets %u, remote tx window size %u", unacknowledged_packets, channel->remote_tx_window_size);
957             if (unacknowledged_packets < channel->remote_tx_window_size){
958                 int index = channel->tx_send_index;
959                 channel->tx_send_index++;
960                 if (channel->tx_send_index >= channel->num_tx_buffers){
961                     channel->tx_send_index = 0;
962                 }
963                 l2cap_ertm_send_information_frame(channel, index);
964                 continue;
965             }
966         }
967 
968         if (channel->send_supervisor_frame_receiver_ready){
969             channel->send_supervisor_frame_receiver_ready = 0;;
970             log_info("Send S-Frame: RR %u", channel->req_seq);
971             uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY, 0, 0, channel->req_seq);
972             l2cap_ertm_send_supervisor_frame(channel, control);
973             continue;
974         }
975 #endif
976 
977     }
978 #endif
979 
980 #ifdef ENABLE_LE_DATA_CHANNELS
981     btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
982     while (btstack_linked_list_iterator_has_next(&it)){
983         uint8_t  * acl_buffer;
984         uint8_t  * l2cap_payload;
985         uint16_t pos;
986         uint16_t payload_size;
987         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
988         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
989         switch (channel->state){
990             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST:
991                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
992                 channel->state = L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE;
993                 // le psm, source cid, mtu, mps, initial credits
994                 channel->local_sig_id = l2cap_next_sig_id();
995                 channel->credits_incoming =  channel->new_credits_incoming;
996                 channel->new_credits_incoming = 0;
997                 l2cap_send_le_signaling_packet( channel->con_handle, LE_CREDIT_BASED_CONNECTION_REQUEST, channel->local_sig_id, channel->psm, channel->local_cid, channel->local_mtu, 23, channel->credits_incoming);
998                 break;
999             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT:
1000                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1001                 // TODO: support larger MPS
1002                 channel->state = L2CAP_STATE_OPEN;
1003                 channel->credits_incoming =  channel->new_credits_incoming;
1004                 channel->new_credits_incoming = 0;
1005                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->local_mtu, 23, channel->credits_incoming, 0);
1006                 // notify client
1007                 l2cap_emit_le_channel_opened(channel, 0);
1008                 break;
1009             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE:
1010                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1011                 channel->state = L2CAP_STATE_INVALID;
1012                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, 0, 0, 0, 0, channel->reason);
1013                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
1014                 l2cap_stop_rtx(channel);
1015                 btstack_linked_list_iterator_remove(&it);
1016                 btstack_memory_l2cap_channel_free(channel);
1017                 break;
1018             case L2CAP_STATE_OPEN:
1019                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1020 
1021                 // send credits
1022                 if (channel->new_credits_incoming){
1023                     log_info("l2cap: sending %u credits", channel->new_credits_incoming);
1024                     channel->local_sig_id = l2cap_next_sig_id();
1025                     uint16_t new_credits = channel->new_credits_incoming;
1026                     channel->new_credits_incoming = 0;
1027                     channel->credits_incoming += new_credits;
1028                     l2cap_send_le_signaling_packet(channel->con_handle, LE_FLOW_CONTROL_CREDIT, channel->local_sig_id, channel->remote_cid, new_credits);
1029                     break;
1030                 }
1031 
1032                 // send data
1033                 if (!channel->send_sdu_buffer) break;
1034                 if (!channel->credits_outgoing) break;
1035 
1036                 // send part of SDU
1037                 hci_reserve_packet_buffer();
1038                 acl_buffer = hci_get_outgoing_packet_buffer();
1039                 l2cap_payload = acl_buffer + 8;
1040                 pos = 0;
1041                 if (!channel->send_sdu_pos){
1042                     // store SDU len
1043                     channel->send_sdu_pos += 2;
1044                     little_endian_store_16(l2cap_payload, pos, channel->send_sdu_len);
1045                     pos += 2;
1046                 }
1047                 payload_size = btstack_min(channel->send_sdu_len + 2 - channel->send_sdu_pos, channel->remote_mps - pos);
1048                 log_info("len %u, pos %u => payload %u, credits %u", channel->send_sdu_len, channel->send_sdu_pos, payload_size, channel->credits_outgoing);
1049                 memcpy(&l2cap_payload[pos], &channel->send_sdu_buffer[channel->send_sdu_pos-2], payload_size); // -2 for virtual SDU len
1050                 pos += payload_size;
1051                 channel->send_sdu_pos += payload_size;
1052                 l2cap_setup_header(acl_buffer, channel->con_handle, 0, channel->remote_cid, pos);
1053                 // done
1054 
1055                 channel->credits_outgoing--;
1056 
1057                 if (channel->send_sdu_pos >= channel->send_sdu_len + 2){
1058                     channel->send_sdu_buffer = NULL;
1059                     // send done event
1060                     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_LE_PACKET_SENT);
1061                     // inform about can send now
1062                     l2cap_le_notify_channel_can_send(channel);
1063                 }
1064                 hci_send_acl_packet_buffer(8 + pos);
1065                 break;
1066             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
1067                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1068                 channel->local_sig_id = l2cap_next_sig_id();
1069                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
1070                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
1071                 break;
1072             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
1073                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1074                 channel->state = L2CAP_STATE_INVALID;
1075                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
1076                 l2cap_le_finialize_channel_close(channel);  // -- remove from list
1077                 break;
1078             default:
1079                 break;
1080         }
1081     }
1082 #endif
1083 
1084 #ifdef ENABLE_BLE
1085     // send l2cap con paramter update if necessary
1086     hci_connections_get_iterator(&it);
1087     while(btstack_linked_list_iterator_has_next(&it)){
1088         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1089         if (connection->address_type != BD_ADDR_TYPE_LE_PUBLIC && connection->address_type != BD_ADDR_TYPE_LE_RANDOM) continue;
1090         if (!hci_can_send_acl_packet_now(connection->con_handle)) continue;
1091         switch (connection->le_con_parameter_update_state){
1092             case CON_PARAMETER_UPDATE_SEND_REQUEST:
1093                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
1094                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_REQUEST, connection->le_con_param_update_identifier,
1095                                                connection->le_conn_interval_min, connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout);
1096                 break;
1097             case CON_PARAMETER_UPDATE_SEND_RESPONSE:
1098                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS;
1099                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 0);
1100                 break;
1101             case CON_PARAMETER_UPDATE_DENY:
1102                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
1103                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 1);
1104                 break;
1105             default:
1106                 break;
1107         }
1108     }
1109 #endif
1110 
1111     // log_info("l2cap_run: exit");
1112 }
1113 
1114 #ifdef ENABLE_CLASSIC
1115 static void l2cap_handle_connection_complete(hci_con_handle_t con_handle, l2cap_channel_t * channel){
1116     if (channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE || channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION) {
1117         log_info("l2cap_handle_connection_complete expected state");
1118         // success, start l2cap handshake
1119         channel->con_handle = con_handle;
1120         // check remote SSP feature first
1121         channel->state = L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES;
1122     }
1123 }
1124 
1125 static void l2cap_ready_to_connect(l2cap_channel_t * channel){
1126 
1127 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1128     // assumption: outgoing connection
1129     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
1130     if (connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_IDLE){
1131         connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
1132         channel->state = L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES;
1133         return;
1134     }
1135 #endif
1136 
1137     // fine, go ahead
1138     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
1139 }
1140 
1141 static void l2cap_handle_remote_supported_features_received(l2cap_channel_t * channel){
1142     if (channel->state != L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES) return;
1143 
1144     // we have been waiting for remote supported features, if both support SSP,
1145     log_info("l2cap received remote supported features, sec_level_0_allowed for psm %u = %u", channel->psm, l2cap_security_level_0_allowed_for_PSM(channel->psm));
1146     if (gap_ssp_supported_on_both_sides(channel->con_handle) && !l2cap_security_level_0_allowed_for_PSM(channel->psm)){
1147         // request security level 2
1148         channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
1149         gap_request_security_level(channel->con_handle, LEVEL_2);
1150         return;
1151     }
1152 
1153     l2cap_ready_to_connect(channel);
1154 }
1155 #endif
1156 
1157 #ifdef L2CAP_USES_CHANNELS
1158 static l2cap_channel_t * l2cap_create_channel_entry(btstack_packet_handler_t packet_handler, bd_addr_t address, bd_addr_type_t address_type,
1159     uint16_t psm, uint16_t local_mtu, gap_security_level_t security_level){
1160 
1161     l2cap_channel_t * channel = btstack_memory_l2cap_channel_get();
1162     if (!channel) {
1163         return NULL;
1164     }
1165 
1166      // Init memory (make valgrind happy)
1167     memset(channel, 0, sizeof(l2cap_channel_t));
1168 
1169     // fill in
1170     channel->packet_handler = packet_handler;
1171     bd_addr_copy(channel->address, address);
1172     channel->address_type = address_type;
1173     channel->psm = psm;
1174     channel->local_mtu  = local_mtu;
1175     channel->remote_mtu = L2CAP_MINIMAL_MTU;
1176     channel->required_security_level = security_level;
1177 
1178     //
1179     channel->local_cid = l2cap_next_local_cid();
1180     channel->con_handle = 0;
1181 
1182     // set initial state
1183     channel->state = L2CAP_STATE_WILL_SEND_CREATE_CONNECTION;
1184     channel->state_var = L2CAP_CHANNEL_STATE_VAR_NONE;
1185     channel->remote_sig_id = L2CAP_SIG_ID_INVALID;
1186     channel->local_sig_id = L2CAP_SIG_ID_INVALID;
1187 
1188     return channel;
1189 }
1190 #endif
1191 
1192 #ifdef ENABLE_CLASSIC
1193 
1194 /**
1195  * @brief Creates L2CAP channel to the PSM of a remote device with baseband address. A new baseband connection will be initiated if necessary.
1196  * @param packet_handler
1197  * @param address
1198  * @param psm
1199  * @param mtu
1200  * @param local_cid
1201  */
1202 
1203 uint8_t l2cap_create_channel(btstack_packet_handler_t channel_packet_handler, bd_addr_t address, uint16_t psm, uint16_t mtu, uint16_t * out_local_cid){
1204     // limit MTU to the size of our outtgoing HCI buffer
1205     uint16_t local_mtu = btstack_min(mtu, l2cap_max_mtu());
1206 
1207     log_info("L2CAP_CREATE_CHANNEL addr %s psm 0x%x mtu %u -> local mtu %u", bd_addr_to_str(address), psm, mtu, local_mtu);
1208 
1209     l2cap_channel_t * channel = l2cap_create_channel_entry(channel_packet_handler, address, BD_ADDR_TYPE_CLASSIC, psm, local_mtu, LEVEL_0);
1210     if (!channel) {
1211         return BTSTACK_MEMORY_ALLOC_FAILED;
1212     }
1213 
1214 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1215     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
1216 #endif
1217 
1218     // add to connections list
1219     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) channel);
1220 
1221     // store local_cid
1222     if (out_local_cid){
1223        *out_local_cid = channel->local_cid;
1224     }
1225 
1226     // check if hci connection is already usable
1227     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_CLASSIC);
1228     if (conn){
1229         log_info("l2cap_create_channel, hci connection already exists");
1230         l2cap_handle_connection_complete(conn->con_handle, channel);
1231         // check if remote supported fearures are already received
1232         if (conn->bonding_flags & BONDING_RECEIVED_REMOTE_FEATURES) {
1233             l2cap_handle_remote_supported_features_received(channel);
1234         }
1235     }
1236 
1237     l2cap_run();
1238 
1239     return 0;
1240 }
1241 
1242 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1243 
1244 static uint8_t l2cap_ertm_validate_local_config(uint8_t max_transmit, uint16_t retransmission_timeout_ms,
1245     uint16_t monitor_timeout_ms, uint8_t num_tx_buffers, uint8_t num_rx_buffers, uint8_t * buffer, uint32_t size){
1246     UNUSED(buffer);
1247     UNUSED(size);
1248 
1249     uint8_t result = ERROR_CODE_SUCCESS;
1250     if (max_transmit < 1){
1251         log_error("max_transmit must be >= 1");
1252         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1253     }
1254     if (retransmission_timeout_ms < 2000){
1255         log_error("retransmission_timeout_ms must be >= 2000 ms");
1256         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1257     }
1258     if (monitor_timeout_ms < 12000){
1259         log_error("monitor_timeout_ms must be >= 12000 ms");
1260         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1261     }
1262     if (num_rx_buffers < 1){
1263         log_error("num_rx_buffers must be >= 1");
1264         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1265     }
1266     if (num_tx_buffers < 1){
1267         log_error("num_rx_buffers must be >= 1");
1268         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
1269     }
1270     return result;
1271 }
1272 
1273 static void l2cap_ertm_configure_channel(l2cap_channel_t * channel, int ertm_mandatory, uint8_t max_transmit,
1274     uint16_t retransmission_timeout_ms, uint16_t monitor_timeout_ms, uint8_t num_tx_buffers, uint8_t num_rx_buffers, uint8_t * buffer, uint32_t size){
1275 
1276     channel->mode  = L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION;
1277     channel->ertm_mandatory = ertm_mandatory;
1278     channel->local_max_transmit = max_transmit;
1279     channel->local_retransmission_timeout_ms = retransmission_timeout_ms;
1280     channel->local_monitor_timeout_ms = monitor_timeout_ms;
1281     channel->num_rx_buffers = num_rx_buffers;
1282     channel->num_tx_buffers = num_tx_buffers;
1283 
1284     // TODO: align buffer pointer
1285     uint32_t pos = 0;
1286     channel->rx_packets_state = (l2cap_ertm_rx_packet_state_t *) &buffer[pos];
1287     pos += num_rx_buffers * sizeof(l2cap_ertm_rx_packet_state_t);
1288     channel->tx_packets_state = (l2cap_ertm_tx_packet_state_t *) &buffer[pos];
1289     pos += num_tx_buffers * sizeof(l2cap_ertm_tx_packet_state_t);
1290     // calculate MTU
1291     channel->local_mtu = (size - pos) / (num_rx_buffers + num_tx_buffers);
1292     log_info("Local ERTM MTU: %u", channel->local_mtu);
1293     channel->rx_packets_data = &buffer[pos];
1294     pos += num_rx_buffers * channel->local_mtu;
1295     channel->tx_packets_data = &buffer[pos];
1296     log_info("RX packets %p, TX packets %p", channel->rx_packets_data, channel->tx_packets_data);
1297 }
1298 
1299 uint8_t l2cap_create_ertm_channel(btstack_packet_handler_t packet_handler, bd_addr_t address, uint16_t psm,
1300     int ertm_mandatory, uint8_t max_transmit, uint16_t retransmission_timeout_ms, uint16_t monitor_timeout_ms,
1301     uint8_t num_tx_buffers, uint8_t num_rx_buffers, uint8_t * buffer, uint32_t size, uint16_t * out_local_cid){
1302 
1303     // limit MTU to the size of our outtgoing HCI buffer
1304     uint16_t local_mtu = l2cap_max_mtu();
1305 
1306     log_info("L2CAP_CREATE_CHANNEL addr %s psm 0x%x -> local mtu %u", bd_addr_to_str(address), psm, local_mtu);
1307 
1308     // validate local config
1309     uint8_t result = l2cap_ertm_validate_local_config(max_transmit, retransmission_timeout_ms, monitor_timeout_ms, num_tx_buffers, num_rx_buffers, buffer, size);
1310     if (result) return result;
1311 
1312     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, address, BD_ADDR_TYPE_CLASSIC, psm, local_mtu, LEVEL_0);
1313     if (!channel) {
1314         return BTSTACK_MEMORY_ALLOC_FAILED;
1315     }
1316 
1317     // configure ERTM
1318     l2cap_ertm_configure_channel(channel, ertm_mandatory, max_transmit, retransmission_timeout_ms,
1319         monitor_timeout_ms, num_tx_buffers, num_rx_buffers, buffer, size);
1320 
1321     // add to connections list
1322     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) channel);
1323 
1324     // store local_cid
1325     if (out_local_cid){
1326        *out_local_cid = channel->local_cid;
1327     }
1328 
1329     // check if hci connection is already usable
1330     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_CLASSIC);
1331     if (conn){
1332         log_info("l2cap_create_channel, hci connection already exists");
1333         l2cap_handle_connection_complete(conn->con_handle, channel);
1334         // check if remote supported fearures are already received
1335         if (conn->bonding_flags & BONDING_RECEIVED_REMOTE_FEATURES) {
1336             l2cap_handle_remote_supported_features_received(channel);
1337         }
1338     }
1339 
1340     l2cap_run();
1341 
1342     return 0;
1343 }
1344 #endif
1345 
1346 void
1347 l2cap_disconnect(uint16_t local_cid, uint8_t reason){
1348     log_info("L2CAP_DISCONNECT local_cid 0x%x reason 0x%x", local_cid, reason);
1349     // find channel for local_cid
1350     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1351     if (channel) {
1352         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1353     }
1354     // process
1355     l2cap_run();
1356 }
1357 
1358 static void l2cap_handle_connection_failed_for_addr(bd_addr_t address, uint8_t status){
1359     btstack_linked_list_iterator_t it;
1360     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1361     while (btstack_linked_list_iterator_has_next(&it)){
1362         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1363         if ( bd_addr_cmp( channel->address, address) != 0) continue;
1364         // channel for this address found
1365         switch (channel->state){
1366             case L2CAP_STATE_WAIT_CONNECTION_COMPLETE:
1367             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
1368                 // failure, forward error code
1369                 l2cap_emit_channel_opened(channel, status);
1370                 // discard channel
1371                 l2cap_stop_rtx(channel);
1372                 btstack_linked_list_iterator_remove(&it);
1373                 btstack_memory_l2cap_channel_free(channel);
1374                 break;
1375             default:
1376                 break;
1377         }
1378     }
1379 }
1380 
1381 static void l2cap_handle_connection_success_for_addr(bd_addr_t address, hci_con_handle_t handle){
1382     btstack_linked_list_iterator_t it;
1383     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1384     while (btstack_linked_list_iterator_has_next(&it)){
1385         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1386         if ( ! bd_addr_cmp( channel->address, address) ){
1387             l2cap_handle_connection_complete(handle, channel);
1388         }
1389     }
1390     // process
1391     l2cap_run();
1392 }
1393 #endif
1394 
1395 static void l2cap_notify_channel_can_send(void){
1396 
1397 #ifdef ENABLE_CLASSIC
1398     btstack_linked_list_iterator_t it;
1399     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1400     while (btstack_linked_list_iterator_has_next(&it)){
1401         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1402         if (!channel->waiting_for_can_send_now) continue;
1403         if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
1404         channel->waiting_for_can_send_now = 0;
1405         l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
1406     }
1407 #endif
1408 
1409     int i;
1410     for (i=0;i<L2CAP_FIXED_CHANNEL_TABLE_SIZE;i++){
1411         if (!fixed_channels[i].callback) continue;
1412         if (!fixed_channels[i].waiting_for_can_send_now) continue;
1413         int can_send = 0;
1414         if (l2cap_fixed_channel_table_index_is_le(i)){
1415 #ifdef ENABLE_BLE
1416             can_send = hci_can_send_acl_le_packet_now();
1417 #endif
1418         } else {
1419 #ifdef ENABLE_CLASSIC
1420             can_send = hci_can_send_acl_classic_packet_now();
1421 #endif
1422         }
1423         if (!can_send) continue;
1424         fixed_channels[i].waiting_for_can_send_now = 0;
1425         l2cap_emit_can_send_now(fixed_channels[i].callback, l2cap_fixed_channel_table_channel_id_for_index(i));
1426     }
1427 }
1428 
1429 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t cid, uint8_t *packet, uint16_t size){
1430 
1431     UNUSED(packet_type);
1432     UNUSED(cid);
1433     UNUSED(size);
1434 
1435     bd_addr_t address;
1436     hci_con_handle_t handle;
1437     int hci_con_used;
1438     btstack_linked_list_iterator_t it;
1439 
1440     // avoid unused warnings
1441     UNUSED(address);
1442     UNUSED(hci_con_used);
1443     UNUSED(it);
1444     UNUSED(handle);
1445 
1446     switch(hci_event_packet_get_type(packet)){
1447 
1448         // Notify channel packet handler if they can send now
1449         case HCI_EVENT_TRANSPORT_PACKET_SENT:
1450         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:
1451             l2cap_run();    // try sending signaling packets first
1452             l2cap_notify_channel_can_send();
1453             break;
1454 
1455         case HCI_EVENT_COMMAND_STATUS:
1456             l2cap_run();    // try sending signaling packets first
1457             break;
1458 
1459 #ifdef ENABLE_CLASSIC
1460         // handle connection complete events
1461         case HCI_EVENT_CONNECTION_COMPLETE:
1462             reverse_bd_addr(&packet[5], address);
1463             if (packet[2] == 0){
1464                 handle = little_endian_read_16(packet, 3);
1465                 l2cap_handle_connection_success_for_addr(address, handle);
1466             } else {
1467                 l2cap_handle_connection_failed_for_addr(address, packet[2]);
1468             }
1469             break;
1470 
1471         // handle successful create connection cancel command
1472         case HCI_EVENT_COMMAND_COMPLETE:
1473             if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_create_connection_cancel)) {
1474                 if (packet[5] == 0){
1475                     reverse_bd_addr(&packet[6], address);
1476                     // CONNECTION TERMINATED BY LOCAL HOST (0X16)
1477                     l2cap_handle_connection_failed_for_addr(address, 0x16);
1478                 }
1479             }
1480             l2cap_run();    // try sending signaling packets first
1481             break;
1482 #endif
1483 
1484         // handle disconnection complete events
1485         case HCI_EVENT_DISCONNECTION_COMPLETE:
1486             // send l2cap disconnect events for all channels on this handle and free them
1487 #ifdef ENABLE_CLASSIC
1488             handle = little_endian_read_16(packet, 3);
1489             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1490             while (btstack_linked_list_iterator_has_next(&it)){
1491                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1492                 if (channel->con_handle != handle) continue;
1493                 l2cap_emit_channel_closed(channel);
1494                 l2cap_stop_rtx(channel);
1495                 btstack_linked_list_iterator_remove(&it);
1496                 btstack_memory_l2cap_channel_free(channel);
1497             }
1498 #endif
1499 #ifdef ENABLE_LE_DATA_CHANNELS
1500             handle = little_endian_read_16(packet, 3);
1501             btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
1502             while (btstack_linked_list_iterator_has_next(&it)){
1503                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1504                 if (channel->con_handle != handle) continue;
1505                 l2cap_emit_channel_closed(channel);
1506                 btstack_linked_list_iterator_remove(&it);
1507                 btstack_memory_l2cap_channel_free(channel);
1508             }
1509 #endif
1510             break;
1511 
1512         // HCI Connection Timeouts
1513 #ifdef ENABLE_CLASSIC
1514         case L2CAP_EVENT_TIMEOUT_CHECK:
1515             handle = little_endian_read_16(packet, 2);
1516             if (gap_get_connection_type(handle) != GAP_CONNECTION_ACL) break;
1517             if (hci_authentication_active_for_handle(handle)) break;
1518             hci_con_used = 0;
1519             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1520             while (btstack_linked_list_iterator_has_next(&it)){
1521                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1522                 if (channel->con_handle != handle) continue;
1523                 hci_con_used = 1;
1524                 break;
1525             }
1526             if (hci_con_used) break;
1527             if (!hci_can_send_command_packet_now()) break;
1528             hci_send_cmd(&hci_disconnect, handle, 0x13); // remote closed connection
1529             break;
1530 
1531         case HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE:
1532             handle = little_endian_read_16(packet, 3);
1533             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1534             while (btstack_linked_list_iterator_has_next(&it)){
1535                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1536                 if (channel->con_handle != handle) continue;
1537                 l2cap_handle_remote_supported_features_received(channel);
1538                 break;
1539             }
1540             break;
1541 
1542         case GAP_EVENT_SECURITY_LEVEL:
1543             handle = little_endian_read_16(packet, 2);
1544             log_info("l2cap - security level update");
1545             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1546             while (btstack_linked_list_iterator_has_next(&it)){
1547                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1548                 if (channel->con_handle != handle) continue;
1549 
1550                 log_info("l2cap - state %u", channel->state);
1551 
1552                 gap_security_level_t actual_level = (gap_security_level_t) packet[4];
1553                 gap_security_level_t required_level = channel->required_security_level;
1554 
1555                 switch (channel->state){
1556                     case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
1557                         if (actual_level >= required_level){
1558 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1559                             // we need to know if ERTM is supported before sending a config response
1560                             hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
1561                             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
1562                             channel->state = L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES;
1563 #else
1564                             channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
1565                             l2cap_emit_incoming_connection(channel);
1566 #endif
1567                         } else {
1568                             channel->reason = 0x0003; // security block
1569                             channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
1570                         }
1571                         break;
1572 
1573                     case L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE:
1574                         if (actual_level >= required_level){
1575                             l2cap_ready_to_connect(channel);
1576                         } else {
1577                             // disconnnect, authentication not good enough
1578                             hci_disconnect_security_block(handle);
1579                         }
1580                         break;
1581 
1582                     default:
1583                         break;
1584                 }
1585             }
1586             break;
1587 #endif
1588 
1589         default:
1590             break;
1591     }
1592 
1593     l2cap_run();
1594 }
1595 
1596 static void l2cap_register_signaling_response(hci_con_handle_t handle, uint8_t code, uint8_t sig_id, uint16_t cid, uint16_t data){
1597     // Vol 3, Part A, 4.3: "The DCID and SCID fields shall be ignored when the result field indi- cates the connection was refused."
1598     if (signaling_responses_pending < NR_PENDING_SIGNALING_RESPONSES) {
1599         signaling_responses[signaling_responses_pending].handle = handle;
1600         signaling_responses[signaling_responses_pending].code = code;
1601         signaling_responses[signaling_responses_pending].sig_id = sig_id;
1602         signaling_responses[signaling_responses_pending].cid = cid;
1603         signaling_responses[signaling_responses_pending].data = data;
1604         signaling_responses_pending++;
1605         l2cap_run();
1606     }
1607 }
1608 
1609 #ifdef ENABLE_CLASSIC
1610 static void l2cap_handle_disconnect_request(l2cap_channel_t *channel, uint16_t identifier){
1611     channel->remote_sig_id = identifier;
1612     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
1613     l2cap_run();
1614 }
1615 
1616 static void l2cap_handle_connection_request(hci_con_handle_t handle, uint8_t sig_id, uint16_t psm, uint16_t source_cid){
1617 
1618     // log_info("l2cap_handle_connection_request for handle %u, psm %u cid 0x%02x", handle, psm, source_cid);
1619     l2cap_service_t *service = l2cap_get_service(psm);
1620     if (!service) {
1621         // 0x0002 PSM not supported
1622         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, 0x0002);
1623         return;
1624     }
1625 
1626     hci_connection_t * hci_connection = hci_connection_for_handle( handle );
1627     if (!hci_connection) {
1628         //
1629         log_error("no hci_connection for handle %u", handle);
1630         return;
1631     }
1632 
1633     // alloc structure
1634     // log_info("l2cap_handle_connection_request register channel");
1635     l2cap_channel_t * channel = l2cap_create_channel_entry(service->packet_handler, hci_connection->address, BD_ADDR_TYPE_CLASSIC,
1636     psm, service->mtu, service->required_security_level);
1637     if (!channel){
1638         // 0x0004 No resources available
1639         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, 0x0004);
1640         return;
1641     }
1642 
1643     channel->con_handle = handle;
1644     channel->remote_cid = source_cid;
1645     channel->remote_sig_id = sig_id;
1646 
1647     // limit local mtu to max acl packet length - l2cap header
1648     if (channel->local_mtu > l2cap_max_mtu()) {
1649         channel->local_mtu = l2cap_max_mtu();
1650     }
1651 
1652     // set initial state
1653     channel->state =      L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE;
1654     channel->state_var  = (L2CAP_CHANNEL_STATE_VAR) (L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND | L2CAP_CHANNEL_STATE_VAR_INCOMING);
1655 
1656     // add to connections list
1657     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) channel);
1658 
1659     // assert security requirements
1660     gap_request_security_level(handle, channel->required_security_level);
1661 }
1662 
1663 void l2cap_accept_connection(uint16_t local_cid){
1664     log_info("L2CAP_ACCEPT_CONNECTION local_cid 0x%x", local_cid);
1665     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1666     if (!channel) {
1667         log_error("l2cap_accept_connection called but local_cid 0x%x not found", local_cid);
1668         return;
1669     }
1670 
1671 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1672     // configure L2CAP Basic mode
1673     channel->mode  = L2CAP_CHANNEL_MODE_BASIC;
1674 #endif
1675 
1676     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
1677 
1678     // process
1679     l2cap_run();
1680 }
1681 
1682 
1683 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1684 uint8_t l2cap_accept_ertm_connection(uint16_t local_cid, int ertm_mandatory, uint8_t max_transmit,
1685     uint16_t retransmission_timeout_ms, uint16_t monitor_timeout_ms, uint8_t num_tx_buffers, uint8_t num_rx_buffers, uint8_t * buffer, uint32_t size){
1686 
1687     log_info("L2CAP_ACCEPT_ERTM_CONNECTION local_cid 0x%x", local_cid);
1688     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1689     if (!channel) {
1690         log_error("l2cap_accept_connection called but local_cid 0x%x not found", local_cid);
1691         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
1692     }
1693 
1694     // validate local config
1695     uint8_t result = l2cap_ertm_validate_local_config(max_transmit, retransmission_timeout_ms, monitor_timeout_ms, num_tx_buffers, num_rx_buffers, buffer, size);
1696     if (result) return result;
1697 
1698     // configure L2CAP ERTM
1699     l2cap_ertm_configure_channel(channel, ertm_mandatory, max_transmit, retransmission_timeout_ms, monitor_timeout_ms, num_tx_buffers, num_rx_buffers, buffer, size);
1700 
1701     // continue
1702     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
1703 
1704     // process
1705     l2cap_run();
1706 
1707     return ERROR_CODE_SUCCESS;
1708 }
1709 
1710 static void l2cap_ertm_handle_req_seq(l2cap_channel_t * l2cap_channel, uint8_t req_seq){
1711     l2cap_ertm_tx_packet_state_t * tx_state;
1712     tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
1713     if ( ((req_seq - 1) & 0x3f) == tx_state->tx_seq){
1714         log_info("RR seq %u == seq of oldest tx packet -> packet done", req_seq);
1715         l2cap_channel->tx_read_index++;
1716         if (l2cap_channel->tx_read_index >= l2cap_channel->num_rx_buffers){
1717             l2cap_channel->tx_read_index = 0;
1718         }
1719     } else {
1720         log_info("RR seq %u != seq of oldest tx packet %u ???", req_seq, tx_state->tx_seq);
1721     }
1722 }
1723 #endif
1724 
1725 
1726 void l2cap_decline_connection(uint16_t local_cid){
1727     log_info("L2CAP_DECLINE_CONNECTION local_cid 0x%x", local_cid);
1728     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
1729     if (!channel) {
1730         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
1731         return;
1732     }
1733     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
1734     channel->reason = 0x04; // no resources available
1735     l2cap_run();
1736 }
1737 
1738 static void l2cap_signaling_handle_configure_request(l2cap_channel_t *channel, uint8_t *command){
1739 
1740     channel->remote_sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
1741 
1742     uint16_t flags = little_endian_read_16(command, 6);
1743     if (flags & 1) {
1744         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
1745     }
1746 
1747     // accept the other's configuration options
1748     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
1749     uint16_t pos     = 8;
1750     while (pos < end_pos){
1751         uint8_t option_hint = command[pos] >> 7;
1752         uint8_t option_type = command[pos] & 0x7f;
1753         log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
1754         pos++;
1755         uint8_t length = command[pos++];
1756         // MTU { type(8): 1, len(8):2, MTU(16) }
1757         if (option_type == 1 && length == 2){
1758             channel->remote_mtu = little_endian_read_16(command, pos);
1759             if (channel->remote_mtu > l2cap_max_mtu()){
1760                 log_info("Remote MTU %u larger than outgoing buffer, only using MTU = %u", channel->remote_mtu, l2cap_max_mtu());
1761                 channel->remote_mtu = l2cap_max_mtu();
1762             }
1763             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1764         }
1765         // Flush timeout { type(8):2, len(8): 2, Flush Timeout(16)}
1766         if (option_type == 2 && length == 2){
1767             channel->flush_timeout = little_endian_read_16(command, pos);
1768         }
1769 
1770 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1771         // Retransmission and Flow Control Option
1772         if (option_type == 4 && length == 9){
1773             l2cap_channel_mode_t mode = (l2cap_channel_mode_t) command[pos];
1774             switch(channel->mode){
1775                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
1776                     // Store remote config
1777                     channel->remote_tx_window_size = command[pos+1];
1778                     channel->remote_max_transmit   = command[pos+2];
1779                     channel->remote_retransmission_timeout_ms = little_endian_read_16(command, pos + 3);
1780                     channel->remote_monitor_timeout_ms = little_endian_read_16(command, pos + 5);
1781                     log_info("FC&C config: tx window: %u, max transmit %u, retrans timeout %u, monitor timeout %u",
1782                         channel->remote_tx_window_size,
1783                         channel->remote_max_transmit,
1784                         channel->remote_retransmission_timeout_ms,
1785                         channel->remote_monitor_timeout_ms);
1786                     // we store remote MPS in remote_mtu, might need to get re-evaluated
1787                     channel->remote_mtu = little_endian_read_16(command, pos + 7);
1788                     // If ERTM mandatory, but remote doens't offer ERTM -> disconnect
1789                     if (channel->ertm_mandatory && mode != L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1790                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1791                     } else {
1792                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1793                     }
1794                     break;
1795                 case L2CAP_CHANNEL_MODE_BASIC:
1796                     switch (mode){
1797                         case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
1798                             // remote asks for ERTM, but we want basic mode. disconnect if this happens a second time
1799                             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED){
1800                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1801                             }
1802                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED);
1803                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
1804                             break;
1805                         default: // case L2CAP_CHANNEL_MODE_BASIC:
1806                             // TODO store and evaluate configuration
1807                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1808                             break;
1809                     }
1810                     break;
1811                 default:
1812                     break;
1813             }
1814         }
1815 #endif
1816         // check for unknown options
1817         if (option_hint == 0 && (option_type == 0 || option_type >= 0x07)){
1818             log_info("l2cap cid %u, unknown options", channel->local_cid);
1819             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
1820         }
1821         pos += length;
1822     }
1823 }
1824 
1825 static void l2cap_signaling_handle_configure_response(l2cap_channel_t *channel, uint8_t result, uint8_t *command){
1826     log_info("l2cap_signaling_handle_configure_response");
1827 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1828     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
1829     uint16_t pos     = 10;
1830     while (pos < end_pos){
1831         uint8_t option_hint = command[pos] >> 7;
1832         uint8_t option_type = command[pos] & 0x7f;
1833         log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
1834         pos++;
1835         uint8_t length = command[pos++];
1836 
1837         // Retransmission and Flow Control Option
1838         if (option_type == 4 && length == 9){
1839             switch (channel->mode){
1840                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
1841                     if (channel->ertm_mandatory){
1842                         // ??
1843                     } else {
1844                         // On 'Reject - Unacceptable Parameters' to our optional ERTM request, fall back to BASIC mode
1845                         if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
1846                             channel->mode = L2CAP_CHANNEL_MODE_BASIC;
1847                         }
1848                     }
1849                     break;
1850                 case L2CAP_CHANNEL_MODE_BASIC:
1851                     if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
1852                         // On 'Reject - Unacceptable Parameters' to our Basic mode request, disconnect
1853                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1854                     }
1855                     break;
1856                 default:
1857                     break;
1858             }
1859         }
1860 
1861         // check for unknown options
1862         if (option_hint == 0 && (option_type == 0 || option_type >= 0x07)){
1863             log_info("l2cap cid %u, unknown options", channel->local_cid);
1864             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
1865         }
1866 
1867         pos += length;
1868     }
1869 #endif
1870 }
1871 
1872 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel){
1873     // log_info("l2cap_channel_ready_for_open 0x%02x", channel->state_var);
1874     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP) == 0) return 0;
1875     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP) == 0) return 0;
1876     // addition check that fixes re-entrance issue causing l2cap event channel opened twice
1877     if (channel->state == L2CAP_STATE_OPEN) return 0;
1878     return 1;
1879 }
1880 
1881 
1882 static void l2cap_signaling_handler_channel(l2cap_channel_t *channel, uint8_t *command){
1883 
1884     uint8_t  code       = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
1885     uint8_t  identifier = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
1886     uint16_t result = 0;
1887 
1888     log_info("L2CAP signaling handler code %u, state %u", code, channel->state);
1889 
1890     // handle DISCONNECT REQUESTS seperately
1891     if (code == DISCONNECTION_REQUEST){
1892         switch (channel->state){
1893             case L2CAP_STATE_CONFIG:
1894             case L2CAP_STATE_OPEN:
1895             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
1896             case L2CAP_STATE_WAIT_DISCONNECT:
1897                 l2cap_handle_disconnect_request(channel, identifier);
1898                 break;
1899 
1900             default:
1901                 // ignore in other states
1902                 break;
1903         }
1904         return;
1905     }
1906 
1907     // @STATEMACHINE(l2cap)
1908     switch (channel->state) {
1909 
1910         case L2CAP_STATE_WAIT_CONNECT_RSP:
1911             switch (code){
1912                 case CONNECTION_RESPONSE:
1913                     l2cap_stop_rtx(channel);
1914                     result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
1915                     switch (result) {
1916                         case 0:
1917                             // successful connection
1918                             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1919                             channel->state = L2CAP_STATE_CONFIG;
1920                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1921                             break;
1922                         case 1:
1923                             // connection pending. get some coffee, but start the ERTX
1924                             l2cap_start_ertx(channel);
1925                             break;
1926                         default:
1927                             // channel closed
1928                             channel->state = L2CAP_STATE_CLOSED;
1929                             // map l2cap connection response result to BTstack status enumeration
1930                             l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result);
1931 
1932                             // drop link key if security block
1933                             if (L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result == L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY){
1934                                 gap_drop_link_key_for_bd_addr(channel->address);
1935                             }
1936 
1937                             // discard channel
1938                             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1939                             btstack_memory_l2cap_channel_free(channel);
1940                             break;
1941                     }
1942                     break;
1943 
1944                 default:
1945                     //@TODO: implement other signaling packets
1946                     break;
1947             }
1948             break;
1949 
1950         case L2CAP_STATE_CONFIG:
1951             result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
1952             switch (code) {
1953                 case CONFIGURE_REQUEST:
1954                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
1955                     l2cap_signaling_handle_configure_request(channel, command);
1956                     if (!(channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT)){
1957                         // only done if continuation not set
1958                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_REQ);
1959                     }
1960                     break;
1961                 case CONFIGURE_RESPONSE:
1962                     l2cap_stop_rtx(channel);
1963                     l2cap_signaling_handle_configure_response(channel, result, command);
1964                     switch (result){
1965                         case 0: // success
1966                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP);
1967                             break;
1968                         case 4: // pending
1969                             l2cap_start_ertx(channel);
1970                             break;
1971                         default:
1972 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1973                             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION && channel->ertm_mandatory){
1974                                 // remote does not offer ertm but it's required
1975                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1976                                 break;
1977                             }
1978 #endif
1979                             // retry on negative result
1980                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1981                             break;
1982                     }
1983                     break;
1984                 default:
1985                     break;
1986             }
1987             if (l2cap_channel_ready_for_open(channel)){
1988                 // for open:
1989                 channel->state = L2CAP_STATE_OPEN;
1990                 l2cap_emit_channel_opened(channel, 0);
1991             }
1992             break;
1993 
1994         case L2CAP_STATE_WAIT_DISCONNECT:
1995             switch (code) {
1996                 case DISCONNECTION_RESPONSE:
1997                     l2cap_finialize_channel_close(channel);
1998                     break;
1999                 default:
2000                     //@TODO: implement other signaling packets
2001                     break;
2002             }
2003             break;
2004 
2005         case L2CAP_STATE_CLOSED:
2006             // @TODO handle incoming requests
2007             break;
2008 
2009         case L2CAP_STATE_OPEN:
2010             //@TODO: implement other signaling packets, e.g. re-configure
2011             break;
2012         default:
2013             break;
2014     }
2015     // log_info("new state %u", channel->state);
2016 }
2017 
2018 
2019 static void l2cap_signaling_handler_dispatch( hci_con_handle_t handle, uint8_t * command){
2020 
2021     btstack_linked_list_iterator_t it;
2022 
2023     // get code, signalind identifier and command len
2024     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
2025     uint8_t sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
2026 
2027     // not for a particular channel, and not CONNECTION_REQUEST, ECHO_[REQUEST|RESPONSE], INFORMATION_RESPONSE
2028     if (code < 1 || code == ECHO_RESPONSE || code > INFORMATION_RESPONSE){
2029         l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
2030         return;
2031     }
2032 
2033     // general commands without an assigned channel
2034     switch(code) {
2035 
2036         case CONNECTION_REQUEST: {
2037             uint16_t psm =        little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
2038             uint16_t source_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
2039             l2cap_handle_connection_request(handle, sig_id, psm, source_cid);
2040             return;
2041         }
2042 
2043         case ECHO_REQUEST:
2044             l2cap_register_signaling_response(handle, code, sig_id, 0, 0);
2045             return;
2046 
2047         case INFORMATION_REQUEST: {
2048             uint16_t infoType = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
2049             l2cap_register_signaling_response(handle, code, sig_id, 0, infoType);
2050             return;
2051         }
2052 
2053 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2054         case INFORMATION_RESPONSE: {
2055             hci_connection_t * connection = hci_connection_for_handle(handle);
2056             if (!connection) return;
2057             uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
2058             uint16_t result =  little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
2059             if (result != 0) return;
2060             if (info_type != 0x02) return;
2061             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_DONE;
2062             connection->l2cap_state.extended_feature_mask = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
2063             log_info("extended features mask 0x%02x", connection->l2cap_state.extended_feature_mask);
2064             // trigger connection request
2065             btstack_linked_list_iterator_init(&it, &l2cap_channels);
2066             while (btstack_linked_list_iterator_has_next(&it)){
2067                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2068                 if (channel->con_handle != handle) continue;
2069                 // bail if ERTM was requested but is not supported
2070                 if ((channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) && ((connection->l2cap_state.extended_feature_mask & 0x08) == 0)){
2071                     if (channel->ertm_mandatory){
2072                         // channel closed
2073                         channel->state = L2CAP_STATE_CLOSED;
2074                         // map l2cap connection response result to BTstack status enumeration
2075                         l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_ERTM_NOT_SUPPORTD);
2076                         // discard channel
2077                         btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2078                         btstack_memory_l2cap_channel_free(channel);
2079                         continue;
2080                     } else {
2081                         // fallback to Basic mode
2082                         channel->mode = L2CAP_CHANNEL_MODE_BASIC;
2083                     }
2084                 }
2085                 // start connecting
2086                 if (channel->state == L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES){
2087                     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
2088                 }
2089                 // respond to connection request
2090                 if (channel->state == L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES){
2091                     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
2092                     l2cap_emit_incoming_connection(channel);
2093                 }
2094             }
2095             return;
2096         }
2097 #endif
2098 
2099         default:
2100             break;
2101     }
2102 
2103 
2104     // Get potential destination CID
2105     uint16_t dest_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
2106 
2107     // Find channel for this sig_id and connection handle
2108     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2109     while (btstack_linked_list_iterator_has_next(&it)){
2110         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2111         if (channel->con_handle != handle) continue;
2112         if (code & 1) {
2113             // match odd commands (responses) by previous signaling identifier
2114             if (channel->local_sig_id == sig_id) {
2115                 l2cap_signaling_handler_channel(channel, command);
2116                 break;
2117             }
2118         } else {
2119             // match even commands (requests) by local channel id
2120             if (channel->local_cid == dest_cid) {
2121                 l2cap_signaling_handler_channel(channel, command);
2122                 break;
2123             }
2124         }
2125     }
2126 }
2127 #endif
2128 
2129 #ifdef ENABLE_BLE
2130 
2131 static void l2cap_emit_connection_parameter_update_response(hci_con_handle_t con_handle, uint16_t result){
2132     uint8_t event[6];
2133     event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_RESPONSE;
2134     event[1] = 4;
2135     little_endian_store_16(event, 2, con_handle);
2136     little_endian_store_16(event, 4, result);
2137     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2138     if (!l2cap_event_packet_handler) return;
2139     (*l2cap_event_packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
2140 }
2141 
2142 // @returns valid
2143 static int l2cap_le_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t * command, uint8_t sig_id){
2144     hci_connection_t * connection;
2145     uint16_t result;
2146     uint8_t  event[10];
2147 
2148 #ifdef ENABLE_LE_DATA_CHANNELS
2149     btstack_linked_list_iterator_t it;
2150     l2cap_channel_t * channel;
2151     uint16_t local_cid;
2152     uint16_t le_psm;
2153     uint16_t new_credits;
2154     uint16_t credits_before;
2155     l2cap_service_t * service;
2156     uint16_t source_cid;
2157 #endif
2158 
2159     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
2160     log_info("l2cap_le_signaling_handler_dispatch: command 0x%02x, sig id %u", code, sig_id);
2161 
2162     switch (code){
2163 
2164         case CONNECTION_PARAMETER_UPDATE_RESPONSE:
2165             result = little_endian_read_16(command, 4);
2166             l2cap_emit_connection_parameter_update_response(handle, result);
2167             break;
2168 
2169         case CONNECTION_PARAMETER_UPDATE_REQUEST:
2170             connection = hci_connection_for_handle(handle);
2171             if (connection){
2172                 if (connection->role != HCI_ROLE_MASTER){
2173                     // reject command without notifying upper layer when not in master role
2174                     return 0;
2175                 }
2176                 int update_parameter = 1;
2177                 le_connection_parameter_range_t existing_range;
2178                 gap_get_connection_parameter_range(&existing_range);
2179                 uint16_t le_conn_interval_min = little_endian_read_16(command,8);
2180                 uint16_t le_conn_interval_max = little_endian_read_16(command,10);
2181                 uint16_t le_conn_latency = little_endian_read_16(command,12);
2182                 uint16_t le_supervision_timeout = little_endian_read_16(command,14);
2183 
2184                 if (le_conn_interval_min < existing_range.le_conn_interval_min) update_parameter = 0;
2185                 if (le_conn_interval_max > existing_range.le_conn_interval_max) update_parameter = 0;
2186 
2187                 if (le_conn_latency < existing_range.le_conn_latency_min) update_parameter = 0;
2188                 if (le_conn_latency > existing_range.le_conn_latency_max) update_parameter = 0;
2189 
2190                 if (le_supervision_timeout < existing_range.le_supervision_timeout_min) update_parameter = 0;
2191                 if (le_supervision_timeout > existing_range.le_supervision_timeout_max) update_parameter = 0;
2192 
2193                 if (update_parameter){
2194                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_SEND_RESPONSE;
2195                     connection->le_conn_interval_min = le_conn_interval_min;
2196                     connection->le_conn_interval_max = le_conn_interval_max;
2197                     connection->le_conn_latency = le_conn_latency;
2198                     connection->le_supervision_timeout = le_supervision_timeout;
2199                 } else {
2200                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_DENY;
2201                 }
2202                 connection->le_con_param_update_identifier = sig_id;
2203             }
2204 
2205             if (!l2cap_event_packet_handler) break;
2206 
2207             event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_REQUEST;
2208             event[1] = 8;
2209             memcpy(&event[2], &command[4], 8);
2210             hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2211             (*l2cap_event_packet_handler)( HCI_EVENT_PACKET, 0, event, sizeof(event));
2212             break;
2213 
2214 #ifdef ENABLE_LE_DATA_CHANNELS
2215 
2216         case COMMAND_REJECT:
2217             // Find channel for this sig_id and connection handle
2218             channel = NULL;
2219             btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
2220             while (btstack_linked_list_iterator_has_next(&it)){
2221                 l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2222                 if (a_channel->con_handle   != handle) continue;
2223                 if (a_channel->local_sig_id != sig_id) continue;
2224                 channel = a_channel;
2225                 break;
2226             }
2227             if (!channel) break;
2228 
2229             // if received while waiting for le connection response, assume legacy device
2230             if (channel->state == L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE){
2231                 channel->state = L2CAP_STATE_CLOSED;
2232                 // no official value for this, use: Connection refused – LE_PSM not supported - 0x0002
2233                 l2cap_emit_le_channel_opened(channel, 0x0002);
2234 
2235                 // discard channel
2236                 btstack_linked_list_remove(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2237                 btstack_memory_l2cap_channel_free(channel);
2238                 break;
2239             }
2240             break;
2241 
2242         case LE_CREDIT_BASED_CONNECTION_REQUEST:
2243 
2244             // get hci connection, bail if not found (must not happen)
2245             connection = hci_connection_for_handle(handle);
2246             if (!connection) return 0;
2247 
2248             // check if service registered
2249             le_psm  = little_endian_read_16(command, 4);
2250             service = l2cap_le_get_service(le_psm);
2251             source_cid = little_endian_read_16(command, 6);
2252 
2253             if (service){
2254                 if (source_cid < 0x40){
2255                     // 0x0009 Connection refused - Invalid Source CID
2256                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0009);
2257                     return 1;
2258                 }
2259 
2260                 // go through list of channels for this ACL connection and check if we get a match
2261                 btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
2262                 while (btstack_linked_list_iterator_has_next(&it)){
2263                     l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2264                     if (a_channel->con_handle != handle) continue;
2265                     if (a_channel->remote_cid != source_cid) continue;
2266                     // 0x000a Connection refused - Source CID already allocated
2267                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x000a);
2268                     return 1;
2269                 }
2270 
2271                 // security: check encryption
2272                 if (service->required_security_level >= LEVEL_2){
2273                     if (sm_encryption_key_size(handle) == 0){
2274                         // 0x0008 Connection refused - insufficient encryption
2275                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0008);
2276                         return 1;
2277                     }
2278                     // anything less than 16 byte key size is insufficient
2279                     if (sm_encryption_key_size(handle) < 16){
2280                         // 0x0007 Connection refused – insufficient encryption key size
2281                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0007);
2282                         return 1;
2283                     }
2284                 }
2285 
2286                 // security: check authencation
2287                 if (service->required_security_level >= LEVEL_3){
2288                     if (!sm_authenticated(handle)){
2289                         // 0x0005 Connection refused – insufficient authentication
2290                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0005);
2291                         return 1;
2292                     }
2293                 }
2294 
2295                 // security: check authorization
2296                 if (service->required_security_level >= LEVEL_4){
2297                     if (sm_authorization_state(handle) != AUTHORIZATION_GRANTED){
2298                         // 0x0006 Connection refused – insufficient authorization
2299                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0006);
2300                         return 1;
2301                     }
2302                 }
2303 
2304                 // allocate channel
2305                 channel = l2cap_create_channel_entry(service->packet_handler, connection->address,
2306                     BD_ADDR_TYPE_LE_RANDOM, le_psm, service->mtu, service->required_security_level);
2307                 if (!channel){
2308                     // 0x0004 Connection refused – no resources available
2309                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0004);
2310                     return 1;
2311                 }
2312 
2313                 channel->con_handle = handle;
2314                 channel->remote_cid = source_cid;
2315                 channel->remote_sig_id = sig_id;
2316                 channel->remote_mtu = little_endian_read_16(command, 8);
2317                 channel->remote_mps = little_endian_read_16(command, 10);
2318                 channel->credits_outgoing = little_endian_read_16(command, 12);
2319 
2320                 // set initial state
2321                 channel->state      = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
2322                 channel->state_var |= L2CAP_CHANNEL_STATE_VAR_INCOMING;
2323 
2324                 // add to connections list
2325                 btstack_linked_list_add(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2326 
2327                 // post connection request event
2328                 l2cap_emit_le_incoming_connection(channel);
2329 
2330             } else {
2331                 // Connection refused – LE_PSM not supported
2332                 l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0002);
2333             }
2334             break;
2335 
2336         case LE_CREDIT_BASED_CONNECTION_RESPONSE:
2337             // Find channel for this sig_id and connection handle
2338             channel = NULL;
2339             btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
2340             while (btstack_linked_list_iterator_has_next(&it)){
2341                 l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2342                 if (a_channel->con_handle   != handle) continue;
2343                 if (a_channel->local_sig_id != sig_id) continue;
2344                 channel = a_channel;
2345                 break;
2346             }
2347             if (!channel) break;
2348 
2349             // cid + 0
2350             result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+8);
2351             if (result){
2352                 channel->state = L2CAP_STATE_CLOSED;
2353                 // map l2cap connection response result to BTstack status enumeration
2354                 l2cap_emit_le_channel_opened(channel, result);
2355 
2356                 // discard channel
2357                 btstack_linked_list_remove(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2358                 btstack_memory_l2cap_channel_free(channel);
2359                 break;
2360             }
2361 
2362             // success
2363             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
2364             channel->remote_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
2365             channel->remote_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
2366             channel->credits_outgoing = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
2367             channel->state = L2CAP_STATE_OPEN;
2368             l2cap_emit_le_channel_opened(channel, result);
2369             break;
2370 
2371         case LE_FLOW_CONTROL_CREDIT:
2372             // find channel
2373             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
2374             channel = l2cap_le_get_channel_for_local_cid(local_cid);
2375             if (!channel) {
2376                 log_error("l2cap: no channel for cid 0x%02x", local_cid);
2377                 break;
2378             }
2379             new_credits = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
2380             credits_before = channel->credits_outgoing;
2381             channel->credits_outgoing += new_credits;
2382             // check for credit overrun
2383             if (credits_before > channel->credits_outgoing){
2384                 log_error("l2cap: new credits caused overrrun for cid 0x%02x, disconnecting", local_cid);
2385                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
2386                 break;
2387             }
2388             log_info("l2cap: %u credits for 0x%02x, now %u", new_credits, local_cid, channel->credits_outgoing);
2389             break;
2390 
2391         case DISCONNECTION_REQUEST:
2392             // find channel
2393             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
2394             channel = l2cap_le_get_channel_for_local_cid(local_cid);
2395             if (!channel) {
2396                 log_error("l2cap: no channel for cid 0x%02x", local_cid);
2397                 break;
2398             }
2399             channel->remote_sig_id = sig_id;
2400             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
2401             break;
2402 
2403 #endif
2404 
2405         case DISCONNECTION_RESPONSE:
2406             break;
2407 
2408         default:
2409             // command unknown -> reject command
2410             return 0;
2411     }
2412     return 1;
2413 }
2414 #endif
2415 
2416 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size ){
2417     UNUSED(packet_type);
2418     UNUSED(channel);
2419 
2420     l2cap_channel_t * l2cap_channel;
2421     UNUSED(l2cap_channel);
2422 
2423     // Get Channel ID
2424     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
2425     hci_con_handle_t handle = READ_ACL_CONNECTION_HANDLE(packet);
2426 
2427     switch (channel_id) {
2428 
2429 #ifdef ENABLE_CLASSIC
2430         case L2CAP_CID_SIGNALING: {
2431             uint16_t command_offset = 8;
2432             while (command_offset < size) {
2433                 // handle signaling commands
2434                 l2cap_signaling_handler_dispatch(handle, &packet[command_offset]);
2435 
2436                 // increment command_offset
2437                 command_offset += L2CAP_SIGNALING_COMMAND_DATA_OFFSET + little_endian_read_16(packet, command_offset + L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
2438             }
2439             break;
2440         }
2441 #endif
2442 
2443 #ifdef ENABLE_BLE
2444         case L2CAP_CID_SIGNALING_LE: {
2445             uint16_t sig_id = packet[COMPLETE_L2CAP_HEADER + 1];
2446             int      valid  = l2cap_le_signaling_handler_dispatch(handle, &packet[COMPLETE_L2CAP_HEADER], sig_id);
2447             if (!valid){
2448                 l2cap_register_signaling_response(handle, COMMAND_REJECT_LE, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
2449             }
2450             break;
2451         }
2452 #endif
2453 
2454         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
2455             if (fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL].callback) {
2456                 (*fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL].callback)(ATT_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
2457             }
2458             break;
2459 
2460         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
2461             if (fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL].callback) {
2462                 (*fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL].callback)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
2463             }
2464             break;
2465 
2466         case L2CAP_CID_CONNECTIONLESS_CHANNEL:
2467             if (fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL].callback) {
2468                 (*fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL].callback)(UCD_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
2469             }
2470             break;
2471 
2472         default:
2473 #ifdef ENABLE_CLASSIC
2474             // Find channel for this channel_id and connection handle
2475             l2cap_channel = l2cap_get_channel_for_local_cid(channel_id);
2476             if (l2cap_channel) {
2477 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2478                 if (l2cap_channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
2479 
2480                     // verify FCS
2481                     uint16_t fcs_calculated = crc16_calc(&packet[4], size - (4+2));
2482                     uint16_t fcs_packet     = little_endian_read_16(packet, size-2);
2483                     log_info("Packet FCS 0x%04x, calculated FCS 0x%04x", fcs_packet, fcs_calculated);
2484                     if (fcs_calculated != fcs_packet){
2485                         log_error("FCS mismatch! Packet 0x%04x, calculated 0x%04x", fcs_packet, fcs_calculated);
2486                         // TODO: trigger retransmission or something like that
2487                         break;
2488                     }
2489 
2490                     // switch on packet type
2491                     uint16_t control = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
2492                     uint8_t  req_seq = (control >> 8) & 0x3f;
2493                     if (control & 1){
2494                         // S-Frame
2495                         // int poll = (control >> 7) & 0x01;
2496                         l2cap_supervisory_function_t s = (l2cap_supervisory_function_t) ((control >> 2) & 0x03);
2497                         switch (s){
2498                             case L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY:
2499                                 l2cap_ertm_handle_req_seq(l2cap_channel, req_seq);
2500                                 break;
2501                             default:
2502                                 break;
2503                         }
2504                         break;
2505                     } else {
2506                         // I-Frame
2507                         // get control
2508                         l2cap_segmentation_and_reassembly_t sar = (l2cap_segmentation_and_reassembly_t) (control >> 14);
2509                         uint8_t tx_seq = (control >> 1) & 0x3f;
2510                         log_info("Control: 0x%04x => SAR %u, ReqSeq %02u, R?, TxSeq %02u", control, (int) sar, req_seq, tx_seq);
2511                         log_info("SAR: pos %u", l2cap_channel->rx_packets_state->pos);
2512                         log_info("State: expected_tx_seq %02u, req_seq %02u", l2cap_channel->expected_tx_seq, l2cap_channel->req_seq);
2513                         l2cap_ertm_handle_req_seq(l2cap_channel, req_seq);
2514                         // check ordering
2515                         if (l2cap_channel->expected_tx_seq == tx_seq){
2516                             log_info("Received expected frame with TxSeq == ExpectedTxSeq == %02u", tx_seq);
2517                             l2cap_channel->req_seq = tx_seq;
2518                             l2cap_channel->send_supervisor_frame_receiver_ready = 1;
2519                             l2cap_channel->expected_tx_seq = l2cap_next_ertm_seq_nr(l2cap_channel->expected_tx_seq);
2520                             uint16_t sdu_length;
2521                             uint16_t segment_length;
2522                             uint16_t payload_offset;
2523                             switch (sar){
2524                                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU:
2525                                     payload_offset = COMPLETE_L2CAP_HEADER+2;
2526                                     segment_length = payload_offset-2;
2527                                     l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, &packet[COMPLETE_L2CAP_HEADER+2], segment_length);
2528                                     break;
2529                                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
2530                                     // TODO: use current packet
2531                                     // TODO: check if reassembly started
2532                                     // TODO: check len against local mtu
2533                                     sdu_length = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER+2);
2534                                     payload_offset = COMPLETE_L2CAP_HEADER+4;
2535                                     segment_length = size - payload_offset-2;
2536                                     memcpy(&l2cap_channel->rx_packets_data[0], &packet[payload_offset], segment_length);
2537                                     l2cap_channel->rx_packets_state->sdu_length = sdu_length;
2538                                     l2cap_channel->rx_packets_state->pos = segment_length;
2539                                     break;
2540                                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU:
2541                                     payload_offset = COMPLETE_L2CAP_HEADER+2;
2542                                     segment_length = size - payload_offset-2;
2543                                     memcpy(&l2cap_channel->rx_packets_data[l2cap_channel->rx_packets_state->pos], &packet[payload_offset], segment_length);
2544                                     l2cap_channel->rx_packets_state->pos += segment_length;
2545                                     l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->rx_packets_data, l2cap_channel->rx_packets_state[0].pos);
2546                                     break;
2547                                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
2548                                     payload_offset = COMPLETE_L2CAP_HEADER+2;
2549                                     segment_length = size - payload_offset-2;
2550                                     memcpy(&l2cap_channel->rx_packets_data[l2cap_channel->rx_packets_state->pos], &packet[payload_offset], segment_length);
2551                                     l2cap_channel->rx_packets_state->pos += segment_length;
2552                                     break;
2553                                 }
2554                             }
2555                         }
2556                     break;
2557                 }
2558 #endif
2559                 l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
2560             }
2561 #endif
2562 #ifdef ENABLE_LE_DATA_CHANNELS
2563             l2cap_channel = l2cap_le_get_channel_for_local_cid(channel_id);
2564             if (l2cap_channel) {
2565                 // credit counting
2566                 if (l2cap_channel->credits_incoming == 0){
2567                     log_error("LE Data Channel packet received but no incoming credits");
2568                     l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
2569                     break;
2570                 }
2571                 l2cap_channel->credits_incoming--;
2572 
2573                 // automatic credits
2574                 if (l2cap_channel->credits_incoming < L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_WATERMARK && l2cap_channel->automatic_credits){
2575                     l2cap_channel->new_credits_incoming = L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_INCREMENT;
2576                 }
2577 
2578                 // first fragment
2579                 uint16_t pos = 0;
2580                 if (!l2cap_channel->receive_sdu_len){
2581                     l2cap_channel->receive_sdu_len = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
2582                     l2cap_channel->receive_sdu_pos = 0;
2583                     pos  += 2;
2584                     size -= 2;
2585                 }
2586                 memcpy(&l2cap_channel->receive_sdu_buffer[l2cap_channel->receive_sdu_pos], &packet[COMPLETE_L2CAP_HEADER+pos], size-COMPLETE_L2CAP_HEADER);
2587                 l2cap_channel->receive_sdu_pos += size - COMPLETE_L2CAP_HEADER;
2588                 // done?
2589                 log_info("le packet pos %u, len %u", l2cap_channel->receive_sdu_pos, l2cap_channel->receive_sdu_len);
2590                 if (l2cap_channel->receive_sdu_pos >= l2cap_channel->receive_sdu_len){
2591                     l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->receive_sdu_buffer, l2cap_channel->receive_sdu_len);
2592                     l2cap_channel->receive_sdu_len = 0;
2593                 }
2594             } else {
2595                 log_error("LE Data Channel packet received but no channel found for cid 0x%02x", channel_id);
2596             }
2597 #endif
2598             break;
2599     }
2600 
2601     l2cap_run();
2602 }
2603 
2604 // Bluetooth 4.0 - allows to register handler for Attribute Protocol and Security Manager Protocol
2605 void l2cap_register_fixed_channel(btstack_packet_handler_t the_packet_handler, uint16_t channel_id) {
2606     int index = l2cap_fixed_channel_table_index_for_channel_id(channel_id);
2607     if (index < 0) return;
2608     fixed_channels[index].callback = the_packet_handler;
2609 }
2610 
2611 #ifdef ENABLE_CLASSIC
2612 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
2613 void l2cap_finialize_channel_close(l2cap_channel_t * channel){
2614     channel->state = L2CAP_STATE_CLOSED;
2615     l2cap_emit_channel_closed(channel);
2616     // discard channel
2617     l2cap_stop_rtx(channel);
2618     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2619     btstack_memory_l2cap_channel_free(channel);
2620 }
2621 
2622 static l2cap_service_t * l2cap_get_service_internal(btstack_linked_list_t * services, uint16_t psm){
2623     btstack_linked_list_iterator_t it;
2624     btstack_linked_list_iterator_init(&it, services);
2625     while (btstack_linked_list_iterator_has_next(&it)){
2626         l2cap_service_t * service = (l2cap_service_t *) btstack_linked_list_iterator_next(&it);
2627         if ( service->psm == psm){
2628             return service;
2629         };
2630     }
2631     return NULL;
2632 }
2633 
2634 static inline l2cap_service_t * l2cap_get_service(uint16_t psm){
2635     return l2cap_get_service_internal(&l2cap_services, psm);
2636 }
2637 
2638 
2639 uint8_t l2cap_register_service(btstack_packet_handler_t service_packet_handler, uint16_t psm, uint16_t mtu, gap_security_level_t security_level){
2640 
2641     log_info("L2CAP_REGISTER_SERVICE psm 0x%x mtu %u", psm, mtu);
2642 
2643     // check for alread registered psm
2644     l2cap_service_t *service = l2cap_get_service(psm);
2645     if (service) {
2646         log_error("l2cap_register_service: PSM %u already registered", psm);
2647         return L2CAP_SERVICE_ALREADY_REGISTERED;
2648     }
2649 
2650     // alloc structure
2651     service = btstack_memory_l2cap_service_get();
2652     if (!service) {
2653         log_error("l2cap_register_service: no memory for l2cap_service_t");
2654         return BTSTACK_MEMORY_ALLOC_FAILED;
2655     }
2656 
2657     // fill in
2658     service->psm = psm;
2659     service->mtu = mtu;
2660     service->packet_handler = service_packet_handler;
2661     service->required_security_level = security_level;
2662 
2663     // add to services list
2664     btstack_linked_list_add(&l2cap_services, (btstack_linked_item_t *) service);
2665 
2666     // enable page scan
2667     gap_connectable_control(1);
2668 
2669     return 0;
2670 }
2671 
2672 uint8_t l2cap_unregister_service(uint16_t psm){
2673 
2674     log_info("L2CAP_UNREGISTER_SERVICE psm 0x%x", psm);
2675 
2676     l2cap_service_t *service = l2cap_get_service(psm);
2677     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
2678     btstack_linked_list_remove(&l2cap_services, (btstack_linked_item_t *) service);
2679     btstack_memory_l2cap_service_free(service);
2680 
2681     // disable page scan when no services registered
2682     if (btstack_linked_list_empty(&l2cap_services)) {
2683         gap_connectable_control(0);
2684     }
2685     return 0;
2686 }
2687 #endif
2688 
2689 
2690 #ifdef ENABLE_LE_DATA_CHANNELS
2691 
2692 static void l2cap_le_notify_channel_can_send(l2cap_channel_t *channel){
2693     if (!channel->waiting_for_can_send_now) return;
2694     if (channel->send_sdu_buffer) return;
2695     channel->waiting_for_can_send_now = 0;
2696     log_info("L2CAP_EVENT_CHANNEL_LE_CAN_SEND_NOW local_cid 0x%x", channel->local_cid);
2697     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_LE_CAN_SEND_NOW);
2698 }
2699 
2700 // 1BH2222
2701 static void l2cap_emit_le_incoming_connection(l2cap_channel_t *channel) {
2702     log_info("L2CAP_EVENT_LE_INCOMING_CONNECTION addr_type %u, addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x, remote_mtu %u",
2703              channel->address_type, bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid, channel->remote_mtu);
2704     uint8_t event[19];
2705     event[0] = L2CAP_EVENT_LE_INCOMING_CONNECTION;
2706     event[1] = sizeof(event) - 2;
2707     event[2] = channel->address_type;
2708     reverse_bd_addr(channel->address, &event[3]);
2709     little_endian_store_16(event,  9, channel->con_handle);
2710     little_endian_store_16(event, 11, channel->psm);
2711     little_endian_store_16(event, 13, channel->local_cid);
2712     little_endian_store_16(event, 15, channel->remote_cid);
2713     little_endian_store_16(event, 17, channel->remote_mtu);
2714     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2715     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2716 }
2717 // 11BH22222
2718 static void l2cap_emit_le_channel_opened(l2cap_channel_t *channel, uint8_t status) {
2719     log_info("L2CAP_EVENT_LE_CHANNEL_OPENED status 0x%x addr_type %u addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u",
2720              status, channel->address_type, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
2721              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu);
2722     uint8_t event[23];
2723     event[0] = L2CAP_EVENT_LE_CHANNEL_OPENED;
2724     event[1] = sizeof(event) - 2;
2725     event[2] = status;
2726     event[3] = channel->address_type;
2727     reverse_bd_addr(channel->address, &event[4]);
2728     little_endian_store_16(event, 10, channel->con_handle);
2729     event[12] = channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING ? 1 : 0;
2730     little_endian_store_16(event, 13, channel->psm);
2731     little_endian_store_16(event, 15, channel->local_cid);
2732     little_endian_store_16(event, 17, channel->remote_cid);
2733     little_endian_store_16(event, 19, channel->local_mtu);
2734     little_endian_store_16(event, 21, channel->remote_mtu);
2735     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2736     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2737 }
2738 
2739 static l2cap_channel_t * l2cap_le_get_channel_for_local_cid(uint16_t local_cid){
2740     btstack_linked_list_iterator_t it;
2741     btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
2742     while (btstack_linked_list_iterator_has_next(&it)){
2743         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2744         if ( channel->local_cid == local_cid) {
2745             return channel;
2746         }
2747     }
2748     return NULL;
2749 }
2750 
2751 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
2752 void l2cap_le_finialize_channel_close(l2cap_channel_t * channel){
2753     channel->state = L2CAP_STATE_CLOSED;
2754     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
2755     // discard channel
2756     btstack_linked_list_remove(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2757     btstack_memory_l2cap_channel_free(channel);
2758 }
2759 
2760 static inline l2cap_service_t * l2cap_le_get_service(uint16_t le_psm){
2761     return l2cap_get_service_internal(&l2cap_le_services, le_psm);
2762 }
2763 
2764 uint8_t l2cap_le_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, gap_security_level_t security_level){
2765 
2766     log_info("L2CAP_LE_REGISTER_SERVICE psm 0x%x", psm);
2767 
2768     // check for alread registered psm
2769     l2cap_service_t *service = l2cap_le_get_service(psm);
2770     if (service) {
2771         return L2CAP_SERVICE_ALREADY_REGISTERED;
2772     }
2773 
2774     // alloc structure
2775     service = btstack_memory_l2cap_service_get();
2776     if (!service) {
2777         log_error("l2cap_register_service_internal: no memory for l2cap_service_t");
2778         return BTSTACK_MEMORY_ALLOC_FAILED;
2779     }
2780 
2781     // fill in
2782     service->psm = psm;
2783     service->mtu = 0;
2784     service->packet_handler = packet_handler;
2785     service->required_security_level = security_level;
2786 
2787     // add to services list
2788     btstack_linked_list_add(&l2cap_le_services, (btstack_linked_item_t *) service);
2789 
2790     // done
2791     return 0;
2792 }
2793 
2794 uint8_t l2cap_le_unregister_service(uint16_t psm) {
2795     log_info("L2CAP_LE_UNREGISTER_SERVICE psm 0x%x", psm);
2796     l2cap_service_t *service = l2cap_le_get_service(psm);
2797     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
2798 
2799     btstack_linked_list_remove(&l2cap_le_services, (btstack_linked_item_t *) service);
2800     btstack_memory_l2cap_service_free(service);
2801     return 0;
2802 }
2803 
2804 uint8_t l2cap_le_accept_connection(uint16_t local_cid, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits){
2805     // get channel
2806     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2807     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2808 
2809     // validate state
2810     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
2811         return ERROR_CODE_COMMAND_DISALLOWED;
2812     }
2813 
2814     // set state accept connection
2815     channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT;
2816     channel->receive_sdu_buffer = receive_sdu_buffer;
2817     channel->local_mtu = mtu;
2818     channel->new_credits_incoming = initial_credits;
2819     channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
2820 
2821     // test
2822     // channel->new_credits_incoming = 1;
2823 
2824     // go
2825     l2cap_run();
2826     return 0;
2827 }
2828 
2829 /**
2830  * @brief Deny incoming LE Data Channel connection due to resource constraints
2831  * @param local_cid             L2CAP LE Data Channel Identifier
2832  */
2833 
2834 uint8_t l2cap_le_decline_connection(uint16_t local_cid){
2835     // get channel
2836     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2837     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2838 
2839     // validate state
2840     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
2841         return ERROR_CODE_COMMAND_DISALLOWED;
2842     }
2843 
2844     // set state decline connection
2845     channel->state  = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE;
2846     channel->reason = 0x04; // no resources available
2847     l2cap_run();
2848     return 0;
2849 }
2850 
2851 uint8_t l2cap_le_create_channel(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
2852     uint16_t psm, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits, gap_security_level_t security_level,
2853     uint16_t * out_local_cid) {
2854 
2855     log_info("L2CAP_LE_CREATE_CHANNEL handle 0x%04x psm 0x%x mtu %u", con_handle, psm, mtu);
2856 
2857 
2858     hci_connection_t * connection = hci_connection_for_handle(con_handle);
2859     if (!connection) {
2860         log_error("no hci_connection for handle 0x%04x", con_handle);
2861         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2862     }
2863 
2864     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, connection->address, connection->address_type, psm, mtu, security_level);
2865     if (!channel) {
2866         return BTSTACK_MEMORY_ALLOC_FAILED;
2867     }
2868     log_info("l2cap_le_create_channel %p", channel);
2869 
2870     // store local_cid
2871     if (out_local_cid){
2872        *out_local_cid = channel->local_cid;
2873     }
2874 
2875     // provide buffer
2876     channel->con_handle = con_handle;
2877     channel->receive_sdu_buffer = receive_sdu_buffer;
2878     channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
2879     channel->new_credits_incoming = initial_credits;
2880     channel->automatic_credits    = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
2881 
2882     // add to connections list
2883     btstack_linked_list_add(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2884 
2885     // go
2886     l2cap_run();
2887     return 0;
2888 }
2889 
2890 /**
2891  * @brief Provide credtis for LE Data Channel
2892  * @param local_cid             L2CAP LE Data Channel Identifier
2893  * @param credits               Number additional credits for peer
2894  */
2895 uint8_t l2cap_le_provide_credits(uint16_t local_cid, uint16_t credits){
2896 
2897     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2898     if (!channel) {
2899         log_error("l2cap_le_provide_credits no channel for cid 0x%02x", local_cid);
2900         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2901     }
2902 
2903     // check state
2904     if (channel->state != L2CAP_STATE_OPEN){
2905         log_error("l2cap_le_provide_credits but channel 0x%02x not open yet", local_cid);
2906     }
2907 
2908     // assert incoming credits + credits <= 0xffff
2909     uint32_t total_credits = channel->credits_incoming;
2910     total_credits += channel->new_credits_incoming;
2911     total_credits += credits;
2912     if (total_credits > 0xffff){
2913         log_error("l2cap_le_provide_credits overrun: current %u, scheduled %u, additional %u", channel->credits_incoming,
2914             channel->new_credits_incoming, credits);
2915     }
2916 
2917     // set credits_granted
2918     channel->new_credits_incoming += credits;
2919 
2920     // go
2921     l2cap_run();
2922     return 0;
2923 }
2924 
2925 /**
2926  * @brief Check if outgoing buffer is available and that there's space on the Bluetooth module
2927  * @param local_cid             L2CAP LE Data Channel Identifier
2928  */
2929 int l2cap_le_can_send_now(uint16_t local_cid){
2930     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2931     if (!channel) {
2932         log_error("l2cap_le_provide_credits no channel for cid 0x%02x", local_cid);
2933         return 0;
2934     }
2935 
2936     // check state
2937     if (channel->state != L2CAP_STATE_OPEN) return 0;
2938 
2939     // check queue
2940     if (channel->send_sdu_buffer) return 0;
2941 
2942     // fine, go ahead
2943     return 1;
2944 }
2945 
2946 /**
2947  * @brief Request emission of L2CAP_EVENT_CAN_SEND_NOW as soon as possible
2948  * @note L2CAP_EVENT_CAN_SEND_NOW might be emitted during call to this function
2949  *       so packet handler should be ready to handle it
2950  * @param local_cid             L2CAP LE Data Channel Identifier
2951  */
2952 uint8_t l2cap_le_request_can_send_now_event(uint16_t local_cid){
2953     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2954     if (!channel) {
2955         log_error("l2cap_le_request_can_send_now_event no channel for cid 0x%02x", local_cid);
2956         return 0;
2957     }
2958     channel->waiting_for_can_send_now = 1;
2959     l2cap_le_notify_channel_can_send(channel);
2960     return 0;
2961 }
2962 
2963 /**
2964  * @brief Send data via LE Data Channel
2965  * @note Since data larger then the maximum PDU needs to be segmented into multiple PDUs, data needs to stay valid until ... event
2966  * @param local_cid             L2CAP LE Data Channel Identifier
2967  * @param data                  data to send
2968  * @param size                  data size
2969  */
2970 uint8_t l2cap_le_send_data(uint16_t local_cid, uint8_t * data, uint16_t len){
2971 
2972     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2973     if (!channel) {
2974         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
2975         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2976     }
2977 
2978     if (len > channel->remote_mtu){
2979         log_error("l2cap_send cid 0x%02x, data length exceeds remote MTU.", local_cid);
2980         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
2981     }
2982 
2983     if (channel->send_sdu_buffer){
2984         log_info("l2cap_send cid 0x%02x, cannot send", local_cid);
2985         return BTSTACK_ACL_BUFFERS_FULL;
2986     }
2987 
2988     channel->send_sdu_buffer = data;
2989     channel->send_sdu_len    = len;
2990     channel->send_sdu_pos    = 0;
2991 
2992     l2cap_run();
2993     return 0;
2994 }
2995 
2996 /**
2997  * @brief Disconnect from LE Data Channel
2998  * @param local_cid             L2CAP LE Data Channel Identifier
2999  */
3000 uint8_t l2cap_le_disconnect(uint16_t local_cid)
3001 {
3002     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
3003     if (!channel) {
3004         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
3005         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
3006     }
3007 
3008     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3009     l2cap_run();
3010     return 0;
3011 }
3012 
3013 #endif
3014