xref: /btstack/src/l2cap.c (revision 450ad7ecde2839cb543ed7c54edf5881c459fa46)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define __BTSTACK_FILE__ "l2cap.c"
39 
40 /*
41  *  l2cap.c
42  *
43  *  Logical Link Control and Adaption Protocl (L2CAP)
44  *
45  *  Created by Matthias Ringwald on 5/16/09.
46  */
47 
48 #include "l2cap.h"
49 #include "hci.h"
50 #include "hci_dump.h"
51 #include "bluetooth_sdp.h"
52 #include "btstack_debug.h"
53 #include "btstack_event.h"
54 #include "btstack_memory.h"
55 
56 #ifdef ENABLE_LE_DATA_CHANNELS
57 #include "ble/sm.h"
58 #endif
59 
60 #include <stdarg.h>
61 #include <string.h>
62 
63 #include <stdio.h>
64 
65 // nr of buffered acl packets in outgoing queue to get max performance
66 #define NR_BUFFERED_ACL_PACKETS 3
67 
68 // used to cache l2cap rejects, echo, and informational requests
69 #define NR_PENDING_SIGNALING_RESPONSES 3
70 
71 // nr of credits provided to remote if credits fall below watermark
72 #define L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_WATERMARK 5
73 #define L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_INCREMENT 5
74 
75 // offsets for L2CAP SIGNALING COMMANDS
76 #define L2CAP_SIGNALING_COMMAND_CODE_OFFSET   0
77 #define L2CAP_SIGNALING_COMMAND_SIGID_OFFSET  1
78 #define L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET 2
79 #define L2CAP_SIGNALING_COMMAND_DATA_OFFSET   4
80 
81 // internal table
82 #define L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL 0
83 #define L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL  1
84 #define L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL 2
85 #define L2CAP_FIXED_CHANNEL_TABLE_SIZE (L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL+1)
86 
87 #if defined(ENABLE_LE_DATA_CHANNELS) || defined(ENABLE_CLASSIC)
88 #define L2CAP_USES_CHANNELS
89 #endif
90 
91 // prototypes
92 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
93 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size );
94 static void l2cap_notify_channel_can_send(void);
95 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel);
96 #ifdef ENABLE_CLASSIC
97 static void l2cap_finialize_channel_close(l2cap_channel_t *channel);
98 static inline l2cap_service_t * l2cap_get_service(uint16_t psm);
99 static void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
100 static void l2cap_emit_channel_closed(l2cap_channel_t *channel);
101 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel);
102 static int  l2cap_channel_ready_for_open(l2cap_channel_t *channel);
103 #endif
104 #ifdef ENABLE_LE_DATA_CHANNELS
105 static void l2cap_emit_le_channel_opened(l2cap_channel_t *channel, uint8_t status);
106 static void l2cap_emit_le_incoming_connection(l2cap_channel_t *channel);
107 static l2cap_channel_t * l2cap_le_get_channel_for_local_cid(uint16_t local_cid);
108 static void l2cap_le_notify_channel_can_send(l2cap_channel_t *channel);
109 static void l2cap_le_finialize_channel_close(l2cap_channel_t *channel);
110 static inline l2cap_service_t * l2cap_le_get_service(uint16_t psm);
111 #endif
112 
113 typedef struct l2cap_fixed_channel {
114     btstack_packet_handler_t callback;
115     uint8_t waiting_for_can_send_now;
116 } l2cap_fixed_channel_t;
117 
118 #ifdef ENABLE_CLASSIC
119 static btstack_linked_list_t l2cap_channels;
120 static btstack_linked_list_t l2cap_services;
121 static uint8_t require_security_level2_for_outgoing_sdp;
122 #endif
123 
124 #ifdef ENABLE_LE_DATA_CHANNELS
125 static btstack_linked_list_t l2cap_le_channels;
126 static btstack_linked_list_t l2cap_le_services;
127 #endif
128 
129 // used to cache l2cap rejects, echo, and informational requests
130 static l2cap_signaling_response_t signaling_responses[NR_PENDING_SIGNALING_RESPONSES];
131 static int signaling_responses_pending;
132 
133 static btstack_packet_callback_registration_t hci_event_callback_registration;
134 static l2cap_fixed_channel_t fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_SIZE];
135 
136 #ifdef ENABLE_BLE
137 // only used for connection parameter update events
138 static btstack_packet_handler_t l2cap_event_packet_handler;
139 #endif
140 
141 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
142 
143 /*
144  * CRC lookup table for generator polynom D^16 + D^15 + D^2 + 1
145  */
146 static const uint16_t crc16_table[256] = {
147     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241, 0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
148     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40, 0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
149     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40, 0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
150     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641, 0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
151     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240, 0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
152     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41, 0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
153     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41, 0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
154     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640, 0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
155     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240, 0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
156     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41, 0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
157     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41, 0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
158     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640, 0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
159     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241, 0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
160     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40, 0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
161     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40, 0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
162     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641, 0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
163 };
164 
165 static uint16_t crc16_calc(uint8_t * data, uint16_t len){
166     uint16_t crc = 0;   // initial value = 0
167     while (len--){
168         crc = (crc >> 8) ^ crc16_table[ (crc ^ ((uint16_t) *data++)) & 0x00FF ];
169     }
170     return crc;
171 }
172 
173 #endif
174 
175 
176 static uint16_t l2cap_fixed_channel_table_channel_id_for_index(int index){
177     switch (index){
178         case L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL:
179             return L2CAP_CID_ATTRIBUTE_PROTOCOL;
180         case L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL:
181             return L2CAP_CID_SECURITY_MANAGER_PROTOCOL;
182         case L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL:
183             return L2CAP_CID_CONNECTIONLESS_CHANNEL;
184         default:
185             return 0;
186     }
187 }
188 static int l2cap_fixed_channel_table_index_for_channel_id(uint16_t channel_id){
189     switch (channel_id){
190         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
191             return L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL;
192         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
193             return  L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL;
194         case L2CAP_CID_CONNECTIONLESS_CHANNEL:
195             return  L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL;
196         default:
197             return -1;
198         }
199 }
200 
201 static int l2cap_fixed_channel_table_index_is_le(int index){
202     if (index == L2CAP_CID_CONNECTIONLESS_CHANNEL) return 0;
203     return 1;
204 }
205 
206 void l2cap_init(void){
207     signaling_responses_pending = 0;
208 
209     uint8_t test[] = {0x0E, 0x00, 0x40, 0x00, 0x02, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09 };
210     printf("crc16: %04x\n", crc16_calc(test, sizeof(test)));
211 
212 #ifdef ENABLE_CLASSIC
213     l2cap_channels = NULL;
214     l2cap_services = NULL;
215     require_security_level2_for_outgoing_sdp = 0;
216 #endif
217 
218 #ifdef ENABLE_LE_DATA_CHANNELS
219     l2cap_le_services = NULL;
220     l2cap_le_channels = NULL;
221 #endif
222 
223 #ifdef ENABLE_BLE
224     l2cap_event_packet_handler = NULL;
225 #endif
226     memset(fixed_channels, 0, sizeof(fixed_channels));
227 
228     //
229     // register callback with HCI
230     //
231     hci_event_callback_registration.callback = &l2cap_hci_event_handler;
232     hci_add_event_handler(&hci_event_callback_registration);
233 
234     hci_register_acl_packet_handler(&l2cap_acl_handler);
235 
236 #ifdef ENABLE_CLASSIC
237     gap_connectable_control(0); // no services yet
238 #endif
239 }
240 
241 void l2cap_register_packet_handler(void (*handler)(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size)){
242 #ifdef ENABLE_BLE
243     l2cap_event_packet_handler = handler;
244 #else
245     UNUSED(handler);
246 #endif
247 }
248 
249 void l2cap_request_can_send_fix_channel_now_event(hci_con_handle_t con_handle, uint16_t channel_id){
250     UNUSED(con_handle);
251 
252     int index = l2cap_fixed_channel_table_index_for_channel_id(channel_id);
253     if (index < 0) return;
254     fixed_channels[index].waiting_for_can_send_now = 1;
255     l2cap_notify_channel_can_send();
256 }
257 
258 int  l2cap_can_send_fixed_channel_packet_now(hci_con_handle_t con_handle, uint16_t channel_id){
259     UNUSED(channel_id);
260 
261     return hci_can_send_acl_packet_now(con_handle);
262 }
263 
264 uint8_t *l2cap_get_outgoing_buffer(void){
265     return hci_get_outgoing_packet_buffer() + COMPLETE_L2CAP_HEADER; // 8 bytes
266 }
267 
268 int l2cap_reserve_packet_buffer(void){
269     return hci_reserve_packet_buffer();
270 }
271 
272 void l2cap_release_packet_buffer(void){
273     hci_release_packet_buffer();
274 }
275 
276 static void l2cap_setup_header(uint8_t * acl_buffer, hci_con_handle_t con_handle, uint8_t packet_boundary, uint16_t remote_cid, uint16_t len){
277     // 0 - Connection handle : PB=pb : BC=00
278     little_endian_store_16(acl_buffer, 0, con_handle | (packet_boundary << 12) | (0 << 14));
279     // 2 - ACL length
280     little_endian_store_16(acl_buffer, 2,  len + 4);
281     // 4 - L2CAP packet length
282     little_endian_store_16(acl_buffer, 4,  len + 0);
283     // 6 - L2CAP channel DEST
284     little_endian_store_16(acl_buffer, 6,  remote_cid);
285 }
286 
287 // assumption - only on LE connections
288 int l2cap_send_prepared_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint16_t len){
289 
290     if (!hci_is_packet_buffer_reserved()){
291         log_error("l2cap_send_prepared_connectionless called without reserving packet first");
292         return BTSTACK_ACL_BUFFERS_FULL;
293     }
294 
295     if (!hci_can_send_prepared_acl_packet_now(con_handle)){
296         log_info("l2cap_send_prepared_connectionless handle 0x%02x, cid 0x%02x, cannot send", con_handle, cid);
297         return BTSTACK_ACL_BUFFERS_FULL;
298     }
299 
300     log_debug("l2cap_send_prepared_connectionless handle %u, cid 0x%02x", con_handle, cid);
301 
302     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
303     l2cap_setup_header(acl_buffer, con_handle, 0, cid, len);
304     // send
305     return hci_send_acl_packet_buffer(len+8);
306 }
307 
308 // assumption - only on LE connections
309 int l2cap_send_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint8_t *data, uint16_t len){
310 
311     if (!hci_can_send_acl_packet_now(con_handle)){
312         log_info("l2cap_send cid 0x%02x, cannot send", cid);
313         return BTSTACK_ACL_BUFFERS_FULL;
314     }
315 
316     hci_reserve_packet_buffer();
317     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
318 
319     memcpy(&acl_buffer[8], data, len);
320 
321     return l2cap_send_prepared_connectionless(con_handle, cid, len);
322 }
323 
324 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel) {
325     log_debug("L2CAP_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel);
326     uint8_t event[4];
327     event[0] = L2CAP_EVENT_CAN_SEND_NOW;
328     event[1] = sizeof(event) - 2;
329     little_endian_store_16(event, 2, channel);
330     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
331     packet_handler(HCI_EVENT_PACKET, channel, event, sizeof(event));
332 }
333 
334 #ifdef L2CAP_USES_CHANNELS
335 static void l2cap_dispatch_to_channel(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size){
336     (* (channel->packet_handler))(type, channel->local_cid, data, size);
337 }
338 
339 static void l2cap_emit_simple_event_with_cid(l2cap_channel_t * channel, uint8_t event_code){
340     uint8_t event[4];
341     event[0] = event_code;
342     event[1] = sizeof(event) - 2;
343     little_endian_store_16(event, 2, channel->local_cid);
344     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
345     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
346 }
347 #endif
348 
349 #ifdef ENABLE_CLASSIC
350 void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
351     log_info("L2CAP_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u, flush_timeout %u",
352              status, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
353              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu, channel->flush_timeout);
354     uint8_t event[24];
355     event[0] = L2CAP_EVENT_CHANNEL_OPENED;
356     event[1] = sizeof(event) - 2;
357     event[2] = status;
358     reverse_bd_addr(channel->address, &event[3]);
359     little_endian_store_16(event,  9, channel->con_handle);
360     little_endian_store_16(event, 11, channel->psm);
361     little_endian_store_16(event, 13, channel->local_cid);
362     little_endian_store_16(event, 15, channel->remote_cid);
363     little_endian_store_16(event, 17, channel->local_mtu);
364     little_endian_store_16(event, 19, channel->remote_mtu);
365     little_endian_store_16(event, 21, channel->flush_timeout);
366     event[23] = channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING ? 1 : 0;
367     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
368     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
369 }
370 
371 static void l2cap_emit_channel_closed(l2cap_channel_t *channel) {
372     log_info("L2CAP_EVENT_CHANNEL_CLOSED local_cid 0x%x", channel->local_cid);
373     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
374 }
375 
376 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel) {
377     log_info("L2CAP_EVENT_INCOMING_CONNECTION addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x",
378              bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid);
379     uint8_t event[16];
380     event[0] = L2CAP_EVENT_INCOMING_CONNECTION;
381     event[1] = sizeof(event) - 2;
382     reverse_bd_addr(channel->address, &event[2]);
383     little_endian_store_16(event,  8, channel->con_handle);
384     little_endian_store_16(event, 10, channel->psm);
385     little_endian_store_16(event, 12, channel->local_cid);
386     little_endian_store_16(event, 14, channel->remote_cid);
387     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
388     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
389 }
390 
391 static l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid){
392     btstack_linked_list_iterator_t it;
393     btstack_linked_list_iterator_init(&it, &l2cap_channels);
394     while (btstack_linked_list_iterator_has_next(&it)){
395         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
396         if ( channel->local_cid == local_cid) {
397             return channel;
398         }
399     }
400     return NULL;
401 }
402 
403 ///
404 
405 void l2cap_request_can_send_now_event(uint16_t local_cid){
406     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
407     if (!channel) return;
408     channel->waiting_for_can_send_now = 1;
409     l2cap_notify_channel_can_send();
410 }
411 
412 int  l2cap_can_send_packet_now(uint16_t local_cid){
413     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
414     if (!channel) return 0;
415     return hci_can_send_acl_packet_now(channel->con_handle);
416 }
417 
418 int  l2cap_can_send_prepared_packet_now(uint16_t local_cid){
419     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
420     if (!channel) return 0;
421     return hci_can_send_prepared_acl_packet_now(channel->con_handle);
422 }
423 uint16_t l2cap_get_remote_mtu_for_local_cid(uint16_t local_cid){
424     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
425     if (channel) {
426         return channel->remote_mtu;
427     }
428     return 0;
429 }
430 
431 static l2cap_channel_t * l2cap_channel_for_rtx_timer(btstack_timer_source_t * ts){
432     btstack_linked_list_iterator_t it;
433     btstack_linked_list_iterator_init(&it, &l2cap_channels);
434     while (btstack_linked_list_iterator_has_next(&it)){
435         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
436         if ( &channel->rtx == ts) {
437             return channel;
438         }
439     }
440     return NULL;
441 }
442 
443 static void l2cap_rtx_timeout(btstack_timer_source_t * ts){
444     l2cap_channel_t * channel = l2cap_channel_for_rtx_timer(ts);
445     if (!channel) return;
446 
447     log_info("l2cap_rtx_timeout for local cid 0x%02x", channel->local_cid);
448 
449     // "When terminating the channel, it is not necessary to send a L2CAP_DisconnectReq
450     //  and enter WAIT_DISCONNECT state. Channels can be transitioned directly to the CLOSED state."
451     // notify client
452     l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_RTX_TIMEOUT);
453 
454     // discard channel
455     // no need to stop timer here, it is removed from list during timer callback
456     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
457     btstack_memory_l2cap_channel_free(channel);
458 }
459 
460 static void l2cap_stop_rtx(l2cap_channel_t * channel){
461     log_info("l2cap_stop_rtx for local cid 0x%02x", channel->local_cid);
462     btstack_run_loop_remove_timer(&channel->rtx);
463 }
464 
465 static void l2cap_start_rtx(l2cap_channel_t * channel){
466     l2cap_stop_rtx(channel);
467     log_info("l2cap_start_rtx for local cid 0x%02x", channel->local_cid);
468     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
469     btstack_run_loop_set_timer(&channel->rtx, L2CAP_RTX_TIMEOUT_MS);
470     btstack_run_loop_add_timer(&channel->rtx);
471 }
472 
473 static void l2cap_start_ertx(l2cap_channel_t * channel){
474     log_info("l2cap_start_ertx for local cid 0x%02x", channel->local_cid);
475     l2cap_stop_rtx(channel);
476     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
477     btstack_run_loop_set_timer(&channel->rtx, L2CAP_ERTX_TIMEOUT_MS);
478     btstack_run_loop_add_timer(&channel->rtx);
479 }
480 
481 void l2cap_require_security_level_2_for_outgoing_sdp(void){
482     require_security_level2_for_outgoing_sdp = 1;
483 }
484 
485 static int l2cap_security_level_0_allowed_for_PSM(uint16_t psm){
486     return (psm == BLUETOOTH_PROTOCOL_SDP) && (!require_security_level2_for_outgoing_sdp);
487 }
488 
489 static int l2cap_send_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, uint8_t identifier, ...){
490     if (!hci_can_send_acl_packet_now(handle)){
491         log_info("l2cap_send_signaling_packet, cannot send");
492         return BTSTACK_ACL_BUFFERS_FULL;
493     }
494 
495     // log_info("l2cap_send_signaling_packet type %u", cmd);
496     hci_reserve_packet_buffer();
497     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
498     va_list argptr;
499     va_start(argptr, identifier);
500     uint16_t len = l2cap_create_signaling_classic(acl_buffer, handle, cmd, identifier, argptr);
501     va_end(argptr);
502     // log_info("l2cap_send_signaling_packet con %u!", handle);
503     return hci_send_acl_packet_buffer(len);
504 }
505 
506 // assumption - only on Classic connections
507 int l2cap_send_prepared(uint16_t local_cid, uint16_t len){
508 
509     if (!hci_is_packet_buffer_reserved()){
510         log_error("l2cap_send_prepared called without reserving packet first");
511         return BTSTACK_ACL_BUFFERS_FULL;
512     }
513 
514     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
515     if (!channel) {
516         log_error("l2cap_send_prepared no channel for cid 0x%02x", local_cid);
517         return -1;   // TODO: define error
518     }
519 
520     if (!hci_can_send_prepared_acl_packet_now(channel->con_handle)){
521         log_info("l2cap_send_prepared cid 0x%02x, cannot send", local_cid);
522         return BTSTACK_ACL_BUFFERS_FULL;
523     }
524 
525     log_debug("l2cap_send_prepared cid 0x%02x, handle %u, 1 credit used", local_cid, channel->con_handle);
526 
527     int fcs_size = 0;
528 
529 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
530     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
531         fcs_size = 2;
532     }
533 #endif
534 
535     // set non-flushable packet boundary flag if supported on Controller
536     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
537     uint8_t packet_boundary_flag = hci_non_flushable_packet_boundary_flag_supported() ? 0x00 : 0x02;
538     l2cap_setup_header(acl_buffer, channel->con_handle, packet_boundary_flag, channel->remote_cid, len + fcs_size);
539 
540 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
541     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
542         // calculate FCS over l2cap data
543         uint16_t fcs = crc16_calc(acl_buffer + 4, 4 + len);
544         log_info("I-Frame: fcs 0x%04x", fcs);
545         little_endian_store_16(acl_buffer, 8 + len, fcs);
546     }
547 #endif
548 
549     // send
550     return hci_send_acl_packet_buffer(len+8+fcs_size);
551 }
552 
553 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
554 static inline uint16_t l2cap_encanced_control_field_for_information_frame(uint8_t tx_seq, int final, uint8_t req_seq, l2cap_segmentation_and_reassembly_t sar){
555     return (((uint16_t) sar) << 14) | (req_seq << 8) | (final << 7) | (tx_seq << 1) | 0;
556 }
557 #if 0
558 static inline uint16_t l2cap_encanced_control_field_for_supevisor_frame(l2cap_supervisory_function_t supervisory_function, int poll, int final, uint8_t req_seq){
559     return (((uint16_t) sar) << 14) | (req_seq << 8) | (final << 7) | 1;
560 }
561 #endif
562 static int l2cap_next_ertm_seq_nr(int seq_nr){
563     return (seq_nr + 1) & 0x3f;
564 }
565 #endif
566 
567 // assumption - only on Classic connections
568 int l2cap_send(uint16_t local_cid, uint8_t *data, uint16_t len){
569 
570     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
571     if (!channel) {
572         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
573         return -1;   // TODO: define error
574     }
575 
576     if (len > channel->remote_mtu){
577         log_error("l2cap_send cid 0x%02x, data length exceeds remote MTU.", local_cid);
578         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
579     }
580 
581     if (!hci_can_send_acl_packet_now(channel->con_handle)){
582         log_info("l2cap_send cid 0x%02x, cannot send", local_cid);
583         return BTSTACK_ACL_BUFFERS_FULL;
584     }
585 
586     hci_reserve_packet_buffer();
587     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
588 
589     int control_size = 0;
590 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
591     // hack to send i-frames
592     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
593         uint16_t control = l2cap_encanced_control_field_for_information_frame(channel->next_tx_seq, 0, 0, L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU);
594         log_info("I-Frame: control 0x%04x", control);
595         little_endian_store_16(acl_buffer, 8, control);
596         channel->next_tx_seq = l2cap_next_ertm_seq_nr(channel->next_tx_seq);
597         control_size = 2;
598     }
599 #endif
600 
601     memcpy(&acl_buffer[8+control_size], data, len);
602 
603     return l2cap_send_prepared(local_cid, len+control_size);
604 }
605 
606 int l2cap_send_echo_request(hci_con_handle_t con_handle, uint8_t *data, uint16_t len){
607     return l2cap_send_signaling_packet(con_handle, ECHO_REQUEST, 0x77, len, data);
608 }
609 
610 static inline void channelStateVarSetFlag(l2cap_channel_t *channel, L2CAP_CHANNEL_STATE_VAR flag){
611     channel->state_var = (L2CAP_CHANNEL_STATE_VAR) (channel->state_var | flag);
612 }
613 
614 static inline void channelStateVarClearFlag(l2cap_channel_t *channel, L2CAP_CHANNEL_STATE_VAR flag){
615     channel->state_var = (L2CAP_CHANNEL_STATE_VAR) (channel->state_var & ~flag);
616 }
617 #endif
618 
619 
620 #ifdef ENABLE_BLE
621 static int l2cap_send_le_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, uint8_t identifier, ...){
622 
623     if (!hci_can_send_acl_packet_now(handle)){
624         log_info("l2cap_send_le_signaling_packet, cannot send");
625         return BTSTACK_ACL_BUFFERS_FULL;
626     }
627 
628     // log_info("l2cap_send_le_signaling_packet type %u", cmd);
629     hci_reserve_packet_buffer();
630     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
631     va_list argptr;
632     va_start(argptr, identifier);
633     uint16_t len = l2cap_create_signaling_le(acl_buffer, handle, cmd, identifier, argptr);
634     va_end(argptr);
635     // log_info("l2cap_send_le_signaling_packet con %u!", handle);
636     return hci_send_acl_packet_buffer(len);
637 }
638 #endif
639 
640 uint16_t l2cap_max_mtu(void){
641     return HCI_ACL_PAYLOAD_SIZE - L2CAP_HEADER_SIZE;
642 }
643 
644 uint16_t l2cap_max_le_mtu(void){
645     return l2cap_max_mtu();
646 }
647 
648 static uint16_t l2cap_setup_options_mtu(l2cap_channel_t * channel, uint8_t * config_options){
649     config_options[0] = 1; // MTU
650     config_options[1] = 2; // len param
651     little_endian_store_16( (uint8_t*)&config_options, 2, channel->local_mtu);
652     return 4;
653 }
654 
655 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
656 static uint16_t l2cap_setup_options_ertm(l2cap_channel_t * channel, uint8_t * config_options){
657     config_options[0] = 0x04;   // RETRANSMISSION AND FLOW CONTROL OPTION
658     config_options[1] = 9;      // length
659     config_options[2] = (uint8_t) channel->mode;
660     config_options[3] = 1;      // TxWindows size
661     config_options[4] = 1;      // max retransmit
662     little_endian_store_16( config_options, 5, 100); // Retransmission timeout: 100 ms
663     little_endian_store_16( config_options, 7, 300); // Monitor timeout: 300 ms
664     little_endian_store_16( config_options, 9, channel->local_mtu); // Max PDU size // TODO: use real MTU
665     return 11;
666 }
667 #endif
668 
669 static uint16_t l2cap_setup_options(l2cap_channel_t * channel, uint8_t * config_options){
670 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
671     // use ERTM options if supported
672     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
673     if ((connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_DONE) && (connection->l2cap_state.extended_feature_mask & 0x08)){
674         return l2cap_setup_options_ertm(channel, config_options);
675 
676     }
677 #endif
678     return l2cap_setup_options_mtu(channel, config_options);
679 }
680 
681 static uint32_t l2cap_extended_features_mask(void){
682     // extended features request supported, features: fixed channels, unicast connectionless data reception
683     uint32_t features = 0x280;
684 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
685     features |= 0x0008;
686 #endif
687     return features;
688 }
689 
690 // MARK: L2CAP_RUN
691 // process outstanding signaling tasks
692 static void l2cap_run(void){
693 
694     // log_info("l2cap_run: entered");
695 
696     // check pending signaling responses
697     while (signaling_responses_pending){
698 
699         hci_con_handle_t handle = signaling_responses[0].handle;
700 
701         if (!hci_can_send_acl_packet_now(handle)) break;
702 
703         uint8_t  sig_id        = signaling_responses[0].sig_id;
704         uint8_t  response_code = signaling_responses[0].code;
705         uint16_t infoType      = signaling_responses[0].data;  // INFORMATION_REQUEST
706         uint16_t result        = signaling_responses[0].data;  // CONNECTION_REQUEST, COMMAND_REJECT
707 #ifdef ENABLE_CLASSIC
708         uint16_t source_cid    = signaling_responses[0].cid;   // CONNECTION_REQUEST
709 #endif
710         UNUSED(infoType);
711 
712         // remove first item before sending (to avoid sending response mutliple times)
713         signaling_responses_pending--;
714         int i;
715         for (i=0; i < signaling_responses_pending; i++){
716             memcpy(&signaling_responses[i], &signaling_responses[i+1], sizeof(l2cap_signaling_response_t));
717         }
718 
719         switch (response_code){
720 #ifdef ENABLE_CLASSIC
721             case CONNECTION_REQUEST:
722                 l2cap_send_signaling_packet(handle, CONNECTION_RESPONSE, sig_id, source_cid, 0, result, 0);
723                 // also disconnect if result is 0x0003 - security blocked
724                 if (result == 0x0003){
725                     hci_disconnect_security_block(handle);
726                 }
727                 break;
728             case ECHO_REQUEST:
729                 l2cap_send_signaling_packet(handle, ECHO_RESPONSE, sig_id, 0, NULL);
730                 break;
731             case INFORMATION_REQUEST:
732                 switch (infoType){
733                     case 1: { // Connectionless MTU
734                             uint16_t connectionless_mtu = hci_max_acl_data_packet_length();
735                             l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(connectionless_mtu), &connectionless_mtu);
736                         }
737                         break;
738                     case 2: {  // Extended Features Supported
739                             uint32_t features = l2cap_extended_features_mask();
740                             l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(features), &features);
741                         }
742                         break;
743                     case 3: { // Fixed Channels Supported
744                             uint8_t map[8];
745                             memset(map, 0, 8);
746                             map[0] = 0x06;  // L2CAP Signaling Channel (0x02) + Connectionless reception (0x04)
747                             l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(map), &map);
748                         }
749                         break;
750                     default:
751                         // all other types are not supported
752                         l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 1, 0, NULL);
753                         break;
754                 }
755                 break;
756             case COMMAND_REJECT:
757                 l2cap_send_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
758                 break;
759 #endif
760 #ifdef ENABLE_BLE
761             case LE_CREDIT_BASED_CONNECTION_REQUEST:
762                 l2cap_send_le_signaling_packet(handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, sig_id, 0, 0, 0, 0, result);
763                 break;
764             case COMMAND_REJECT_LE:
765                 l2cap_send_le_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
766                 break;
767 #endif
768             default:
769                 // should not happen
770                 break;
771         }
772     }
773 
774     btstack_linked_list_iterator_t it;
775     UNUSED(it);
776 
777 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
778     // send l2cap information request if neccessary
779     hci_connections_get_iterator(&it);
780     while(btstack_linked_list_iterator_has_next(&it)){
781         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
782         if (connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST){
783             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W4_EXTENDED_FEATURE_RESPONSE;
784             // send information request for extended features
785             uint8_t sig_id = l2cap_next_sig_id();
786             uint8_t info_type = 2;
787             l2cap_send_signaling_packet(connection->con_handle, INFORMATION_REQUEST, sig_id, info_type);
788             return;
789         }
790     }
791 #endif
792 
793 #ifdef ENABLE_CLASSIC
794     uint8_t  config_options[10];
795     btstack_linked_list_iterator_init(&it, &l2cap_channels);
796     while (btstack_linked_list_iterator_has_next(&it)){
797 
798         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
799         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
800         switch (channel->state){
801 
802             case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
803             case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
804                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
805                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND) {
806                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND);
807                     l2cap_send_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid, 1, 0);
808                 }
809                 break;
810 
811             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
812                 if (!hci_can_send_command_packet_now()) break;
813                 // send connection request - set state first
814                 channel->state = L2CAP_STATE_WAIT_CONNECTION_COMPLETE;
815                 // BD_ADDR, Packet_Type, Page_Scan_Repetition_Mode, Reserved, Clock_Offset, Allow_Role_Switch
816                 hci_send_cmd(&hci_create_connection, channel->address, hci_usable_acl_packet_types(), 0, 0, 0, 1);
817                 break;
818 
819             case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
820                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
821                 channel->state = L2CAP_STATE_INVALID;
822                 l2cap_send_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid, channel->reason, 0);
823                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
824                 l2cap_stop_rtx(channel);
825                 btstack_linked_list_iterator_remove(&it);
826                 btstack_memory_l2cap_channel_free(channel);
827                 break;
828 
829             case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
830                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
831                 channel->state = L2CAP_STATE_CONFIG;
832                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
833                 l2cap_send_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid, 0, 0);
834                 break;
835 
836             case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
837                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
838                 // success, start l2cap handshake
839                 channel->local_sig_id = l2cap_next_sig_id();
840                 channel->state = L2CAP_STATE_WAIT_CONNECT_RSP;
841                 l2cap_send_signaling_packet( channel->con_handle, CONNECTION_REQUEST, channel->local_sig_id, channel->psm, channel->local_cid);
842                 l2cap_start_rtx(channel);
843                 break;
844 
845             case L2CAP_STATE_CONFIG:
846                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
847                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP){
848                     uint16_t flags = 0;
849                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
850                     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT) {
851                         flags = 1;
852                     } else {
853                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
854                     }
855                     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID){
856                         channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
857                         l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_UNKNOWN_OPTIONS, 0, NULL);
858 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
859                     } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED){
860                         channelStateVarClearFlag(channel,L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
861                         channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
862                         uint16_t options_size = l2cap_setup_options(channel, config_options);
863                         l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS, options_size, &config_options);
864 #endif
865                     } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU){
866                         channelStateVarClearFlag(channel,L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
867                         uint16_t options_size = l2cap_setup_options(channel, config_options);
868                         l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS, options_size, &config_options);
869                     } else {
870                         l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS, 0, NULL);
871                     }
872                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
873                 }
874                 else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ){
875                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
876                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_REQ);
877                     channel->local_sig_id = l2cap_next_sig_id();
878                     uint16_t options_size = l2cap_setup_options(channel, config_options);
879                     l2cap_send_signaling_packet(channel->con_handle, CONFIGURE_REQUEST, channel->local_sig_id, channel->remote_cid, 0, options_size, &config_options);
880                     l2cap_start_rtx(channel);
881                 }
882                 if (l2cap_channel_ready_for_open(channel)){
883                     channel->state = L2CAP_STATE_OPEN;
884                     l2cap_emit_channel_opened(channel, 0);  // success
885                 }
886                 break;
887 
888             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
889                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
890                 channel->state = L2CAP_STATE_INVALID;
891                 l2cap_send_signaling_packet( channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
892                 // we don't start an RTX timer for a disconnect - there's no point in closing the channel if the other side doesn't respond :)
893                 l2cap_finialize_channel_close(channel);  // -- remove from list
894                 break;
895 
896             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
897                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
898                 channel->local_sig_id = l2cap_next_sig_id();
899                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
900                 l2cap_send_signaling_packet( channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
901                 break;
902             default:
903                 break;
904         }
905     }
906 #endif
907 
908 #ifdef ENABLE_LE_DATA_CHANNELS
909     btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
910     while (btstack_linked_list_iterator_has_next(&it)){
911         uint8_t  * acl_buffer;
912         uint8_t  * l2cap_payload;
913         uint16_t pos;
914         uint16_t payload_size;
915         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
916         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
917         switch (channel->state){
918             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST:
919                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
920                 channel->state = L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE;
921                 // le psm, source cid, mtu, mps, initial credits
922                 channel->local_sig_id = l2cap_next_sig_id();
923                 channel->credits_incoming =  channel->new_credits_incoming;
924                 channel->new_credits_incoming = 0;
925                 l2cap_send_le_signaling_packet( channel->con_handle, LE_CREDIT_BASED_CONNECTION_REQUEST, channel->local_sig_id, channel->psm, channel->local_cid, channel->local_mtu, 23, channel->credits_incoming);
926                 break;
927             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT:
928                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
929                 // TODO: support larger MPS
930                 channel->state = L2CAP_STATE_OPEN;
931                 channel->credits_incoming =  channel->new_credits_incoming;
932                 channel->new_credits_incoming = 0;
933                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->local_mtu, 23, channel->credits_incoming, 0);
934                 // notify client
935                 l2cap_emit_le_channel_opened(channel, 0);
936                 break;
937             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE:
938                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
939                 channel->state = L2CAP_STATE_INVALID;
940                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, 0, 0, 0, 0, channel->reason);
941                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
942                 l2cap_stop_rtx(channel);
943                 btstack_linked_list_iterator_remove(&it);
944                 btstack_memory_l2cap_channel_free(channel);
945                 break;
946             case L2CAP_STATE_OPEN:
947                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
948 
949                 // send credits
950                 if (channel->new_credits_incoming){
951                     log_info("l2cap: sending %u credits", channel->new_credits_incoming);
952                     channel->local_sig_id = l2cap_next_sig_id();
953                     uint16_t new_credits = channel->new_credits_incoming;
954                     channel->new_credits_incoming = 0;
955                     channel->credits_incoming += new_credits;
956                     l2cap_send_le_signaling_packet(channel->con_handle, LE_FLOW_CONTROL_CREDIT, channel->local_sig_id, channel->remote_cid, new_credits);
957                     break;
958                 }
959 
960                 // send data
961                 if (!channel->send_sdu_buffer) break;
962                 if (!channel->credits_outgoing) break;
963 
964                 // send part of SDU
965                 hci_reserve_packet_buffer();
966                 acl_buffer = hci_get_outgoing_packet_buffer();
967                 l2cap_payload = acl_buffer + 8;
968                 pos = 0;
969                 if (!channel->send_sdu_pos){
970                     // store SDU len
971                     channel->send_sdu_pos += 2;
972                     little_endian_store_16(l2cap_payload, pos, channel->send_sdu_len);
973                     pos += 2;
974                 }
975                 payload_size = btstack_min(channel->send_sdu_len + 2 - channel->send_sdu_pos, channel->remote_mps - pos);
976                 log_info("len %u, pos %u => payload %u, credits %u", channel->send_sdu_len, channel->send_sdu_pos, payload_size, channel->credits_outgoing);
977                 memcpy(&l2cap_payload[pos], &channel->send_sdu_buffer[channel->send_sdu_pos-2], payload_size); // -2 for virtual SDU len
978                 pos += payload_size;
979                 channel->send_sdu_pos += payload_size;
980                 l2cap_setup_header(acl_buffer, channel->con_handle, 0, channel->remote_cid, pos);
981                 // done
982 
983                 channel->credits_outgoing--;
984 
985                 if (channel->send_sdu_pos >= channel->send_sdu_len + 2){
986                     channel->send_sdu_buffer = NULL;
987                     // send done event
988                     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_LE_PACKET_SENT);
989                     // inform about can send now
990                     l2cap_le_notify_channel_can_send(channel);
991                 }
992                 hci_send_acl_packet_buffer(8 + pos);
993                 break;
994             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
995                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
996                 channel->local_sig_id = l2cap_next_sig_id();
997                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
998                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
999                 break;
1000             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
1001                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1002                 channel->state = L2CAP_STATE_INVALID;
1003                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
1004                 l2cap_le_finialize_channel_close(channel);  // -- remove from list
1005                 break;
1006             default:
1007                 break;
1008         }
1009     }
1010 #endif
1011 
1012 #ifdef ENABLE_BLE
1013     // send l2cap con paramter update if necessary
1014     hci_connections_get_iterator(&it);
1015     while(btstack_linked_list_iterator_has_next(&it)){
1016         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1017         if (connection->address_type != BD_ADDR_TYPE_LE_PUBLIC && connection->address_type != BD_ADDR_TYPE_LE_RANDOM) continue;
1018         if (!hci_can_send_acl_packet_now(connection->con_handle)) continue;
1019         switch (connection->le_con_parameter_update_state){
1020             case CON_PARAMETER_UPDATE_SEND_REQUEST:
1021                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
1022                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_REQUEST, connection->le_con_param_update_identifier,
1023                                                connection->le_conn_interval_min, connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout);
1024                 break;
1025             case CON_PARAMETER_UPDATE_SEND_RESPONSE:
1026                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS;
1027                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 0);
1028                 break;
1029             case CON_PARAMETER_UPDATE_DENY:
1030                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
1031                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 1);
1032                 break;
1033             default:
1034                 break;
1035         }
1036     }
1037 #endif
1038 
1039     // log_info("l2cap_run: exit");
1040 }
1041 
1042 #ifdef ENABLE_CLASSIC
1043 static void l2cap_handle_connection_complete(hci_con_handle_t con_handle, l2cap_channel_t * channel){
1044     if (channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE || channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION) {
1045         log_info("l2cap_handle_connection_complete expected state");
1046         // success, start l2cap handshake
1047         channel->con_handle = con_handle;
1048         // check remote SSP feature first
1049         channel->state = L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES;
1050     }
1051 }
1052 
1053 static void l2cap_ready_to_connect(l2cap_channel_t * channel){
1054 
1055 
1056 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1057     // TODO: we assume outgoing connection
1058     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1059         // get hci_connection
1060         hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
1061         if (connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_IDLE){
1062             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
1063             channel->state = L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES;
1064             return;
1065         }
1066     }
1067 #endif
1068 
1069     // fine, go ahead
1070     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
1071 }
1072 
1073 static void l2cap_handle_remote_supported_features_received(l2cap_channel_t * channel){
1074     if (channel->state != L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES) return;
1075 
1076     // we have been waiting for remote supported features, if both support SSP,
1077     log_info("l2cap received remote supported features, sec_level_0_allowed for psm %u = %u", channel->psm, l2cap_security_level_0_allowed_for_PSM(channel->psm));
1078     if (gap_ssp_supported_on_both_sides(channel->con_handle) && !l2cap_security_level_0_allowed_for_PSM(channel->psm)){
1079         // request security level 2
1080         channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
1081         gap_request_security_level(channel->con_handle, LEVEL_2);
1082         return;
1083     }
1084 
1085     l2cap_ready_to_connect(channel);
1086 }
1087 #endif
1088 
1089 #ifdef L2CAP_USES_CHANNELS
1090 static l2cap_channel_t * l2cap_create_channel_entry(btstack_packet_handler_t packet_handler, bd_addr_t address, bd_addr_type_t address_type,
1091     uint16_t psm, uint16_t local_mtu, gap_security_level_t security_level){
1092 
1093     l2cap_channel_t * channel = btstack_memory_l2cap_channel_get();
1094     if (!channel) {
1095         return NULL;
1096     }
1097 
1098      // Init memory (make valgrind happy)
1099     memset(channel, 0, sizeof(l2cap_channel_t));
1100 
1101     // fill in
1102     channel->packet_handler = packet_handler;
1103     bd_addr_copy(channel->address, address);
1104     channel->address_type = address_type;
1105     channel->psm = psm;
1106     channel->local_mtu  = local_mtu;
1107     channel->remote_mtu = L2CAP_MINIMAL_MTU;
1108     channel->required_security_level = security_level;
1109 
1110     //
1111     channel->local_cid = l2cap_next_local_cid();
1112     channel->con_handle = 0;
1113 
1114     // set initial state
1115     channel->state = L2CAP_STATE_WILL_SEND_CREATE_CONNECTION;
1116     channel->state_var = L2CAP_CHANNEL_STATE_VAR_NONE;
1117     channel->remote_sig_id = L2CAP_SIG_ID_INVALID;
1118     channel->local_sig_id = L2CAP_SIG_ID_INVALID;
1119     return channel;
1120 }
1121 #endif
1122 
1123 #ifdef ENABLE_CLASSIC
1124 
1125 /**
1126  * @brief Creates L2CAP channel to the PSM of a remote device with baseband address. A new baseband connection will be initiated if necessary.
1127  * @param packet_handler
1128  * @param address
1129  * @param psm
1130  * @param mtu
1131  * @param local_cid
1132  */
1133 
1134 uint8_t l2cap_create_channel(btstack_packet_handler_t channel_packet_handler, bd_addr_t address, uint16_t psm, uint16_t mtu, uint16_t * out_local_cid){
1135     // limit MTU to the size of our outtgoing HCI buffer
1136     uint16_t local_mtu = btstack_min(mtu, l2cap_max_mtu());
1137 
1138     log_info("L2CAP_CREATE_CHANNEL addr %s psm 0x%x mtu %u -> local mtu %u", bd_addr_to_str(address), psm, mtu, local_mtu);
1139 
1140     l2cap_channel_t * channel = l2cap_create_channel_entry(channel_packet_handler, address, BD_ADDR_TYPE_CLASSIC, psm, local_mtu, LEVEL_0);
1141     if (!channel) {
1142         return BTSTACK_MEMORY_ALLOC_FAILED;
1143     }
1144 
1145 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1146     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
1147 #endif
1148 
1149     // add to connections list
1150     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) channel);
1151 
1152     // store local_cid
1153     if (out_local_cid){
1154        *out_local_cid = channel->local_cid;
1155     }
1156 
1157     // check if hci connection is already usable
1158     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_CLASSIC);
1159     if (conn){
1160         log_info("l2cap_create_channel, hci connection already exists");
1161         l2cap_handle_connection_complete(conn->con_handle, channel);
1162         // check if remote supported fearures are already received
1163         if (conn->bonding_flags & BONDING_RECEIVED_REMOTE_FEATURES) {
1164             l2cap_handle_remote_supported_features_received(channel);
1165         }
1166     }
1167 
1168     l2cap_run();
1169 
1170     return 0;
1171 }
1172 
1173 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1174 uint8_t l2cap_create_ertm_channel(btstack_packet_handler_t channel_packet_handler, bd_addr_t address, uint16_t psm, uint16_t mtu, int ertm_mandatory, uint16_t * out_local_cid){
1175     // limit MTU to the size of our outtgoing HCI buffer
1176     uint16_t local_mtu = btstack_min(mtu, l2cap_max_mtu());
1177 
1178     log_info("L2CAP_CREATE_CHANNEL addr %s psm 0x%x mtu %u -> local mtu %u", bd_addr_to_str(address), psm, mtu, local_mtu);
1179 
1180     l2cap_channel_t * channel = l2cap_create_channel_entry(channel_packet_handler, address, BD_ADDR_TYPE_CLASSIC, psm, local_mtu, LEVEL_0);
1181     if (!channel) {
1182         return BTSTACK_MEMORY_ALLOC_FAILED;
1183     }
1184 
1185     channel->mode = L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION;
1186     channel->ertm_mandatory = ertm_mandatory;
1187 
1188     // add to connections list
1189     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) channel);
1190 
1191     // store local_cid
1192     if (out_local_cid){
1193        *out_local_cid = channel->local_cid;
1194     }
1195 
1196     // check if hci connection is already usable
1197     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_CLASSIC);
1198     if (conn){
1199         log_info("l2cap_create_channel, hci connection already exists");
1200         l2cap_handle_connection_complete(conn->con_handle, channel);
1201         // check if remote supported fearures are already received
1202         if (conn->bonding_flags & BONDING_RECEIVED_REMOTE_FEATURES) {
1203             l2cap_handle_remote_supported_features_received(channel);
1204         }
1205     }
1206 
1207     l2cap_run();
1208 
1209     return 0;
1210 }
1211 #endif
1212 
1213 void
1214 l2cap_disconnect(uint16_t local_cid, uint8_t reason){
1215     log_info("L2CAP_DISCONNECT local_cid 0x%x reason 0x%x", local_cid, reason);
1216     // find channel for local_cid
1217     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1218     if (channel) {
1219         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1220     }
1221     // process
1222     l2cap_run();
1223 }
1224 
1225 static void l2cap_handle_connection_failed_for_addr(bd_addr_t address, uint8_t status){
1226     btstack_linked_list_iterator_t it;
1227     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1228     while (btstack_linked_list_iterator_has_next(&it)){
1229         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1230         if ( bd_addr_cmp( channel->address, address) != 0) continue;
1231         // channel for this address found
1232         switch (channel->state){
1233             case L2CAP_STATE_WAIT_CONNECTION_COMPLETE:
1234             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
1235                 // failure, forward error code
1236                 l2cap_emit_channel_opened(channel, status);
1237                 // discard channel
1238                 l2cap_stop_rtx(channel);
1239                 btstack_linked_list_iterator_remove(&it);
1240                 btstack_memory_l2cap_channel_free(channel);
1241                 break;
1242             default:
1243                 break;
1244         }
1245     }
1246 }
1247 
1248 static void l2cap_handle_connection_success_for_addr(bd_addr_t address, hci_con_handle_t handle){
1249     btstack_linked_list_iterator_t it;
1250     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1251     while (btstack_linked_list_iterator_has_next(&it)){
1252         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1253         if ( ! bd_addr_cmp( channel->address, address) ){
1254             l2cap_handle_connection_complete(handle, channel);
1255         }
1256     }
1257     // process
1258     l2cap_run();
1259 }
1260 #endif
1261 
1262 static void l2cap_notify_channel_can_send(void){
1263 
1264 #ifdef ENABLE_CLASSIC
1265     btstack_linked_list_iterator_t it;
1266     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1267     while (btstack_linked_list_iterator_has_next(&it)){
1268         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1269         if (!channel->waiting_for_can_send_now) continue;
1270         if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
1271         channel->waiting_for_can_send_now = 0;
1272         l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
1273     }
1274 #endif
1275 
1276     int i;
1277     for (i=0;i<L2CAP_FIXED_CHANNEL_TABLE_SIZE;i++){
1278         if (!fixed_channels[i].callback) continue;
1279         if (!fixed_channels[i].waiting_for_can_send_now) continue;
1280         int can_send = 0;
1281         if (l2cap_fixed_channel_table_index_is_le(i)){
1282 #ifdef ENABLE_BLE
1283             can_send = hci_can_send_acl_le_packet_now();
1284 #endif
1285         } else {
1286 #ifdef ENABLE_CLASSIC
1287             can_send = hci_can_send_acl_classic_packet_now();
1288 #endif
1289         }
1290         if (!can_send) continue;
1291         fixed_channels[i].waiting_for_can_send_now = 0;
1292         l2cap_emit_can_send_now(fixed_channels[i].callback, l2cap_fixed_channel_table_channel_id_for_index(i));
1293     }
1294 }
1295 
1296 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t cid, uint8_t *packet, uint16_t size){
1297 
1298     UNUSED(packet_type);
1299     UNUSED(cid);
1300     UNUSED(size);
1301 
1302     bd_addr_t address;
1303     hci_con_handle_t handle;
1304     int hci_con_used;
1305     btstack_linked_list_iterator_t it;
1306 
1307     // avoid unused warnings
1308     UNUSED(address);
1309     UNUSED(hci_con_used);
1310     UNUSED(it);
1311     UNUSED(handle);
1312 
1313     switch(hci_event_packet_get_type(packet)){
1314 
1315         // Notify channel packet handler if they can send now
1316         case HCI_EVENT_TRANSPORT_PACKET_SENT:
1317         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:
1318             l2cap_run();    // try sending signaling packets first
1319             l2cap_notify_channel_can_send();
1320             break;
1321 
1322         case HCI_EVENT_COMMAND_STATUS:
1323             l2cap_run();    // try sending signaling packets first
1324             break;
1325 
1326 #ifdef ENABLE_CLASSIC
1327         // handle connection complete events
1328         case HCI_EVENT_CONNECTION_COMPLETE:
1329             reverse_bd_addr(&packet[5], address);
1330             if (packet[2] == 0){
1331                 handle = little_endian_read_16(packet, 3);
1332                 l2cap_handle_connection_success_for_addr(address, handle);
1333             } else {
1334                 l2cap_handle_connection_failed_for_addr(address, packet[2]);
1335             }
1336             break;
1337 
1338         // handle successful create connection cancel command
1339         case HCI_EVENT_COMMAND_COMPLETE:
1340             if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_create_connection_cancel)) {
1341                 if (packet[5] == 0){
1342                     reverse_bd_addr(&packet[6], address);
1343                     // CONNECTION TERMINATED BY LOCAL HOST (0X16)
1344                     l2cap_handle_connection_failed_for_addr(address, 0x16);
1345                 }
1346             }
1347             l2cap_run();    // try sending signaling packets first
1348             break;
1349 #endif
1350 
1351         // handle disconnection complete events
1352         case HCI_EVENT_DISCONNECTION_COMPLETE:
1353             // send l2cap disconnect events for all channels on this handle and free them
1354 #ifdef ENABLE_CLASSIC
1355             handle = little_endian_read_16(packet, 3);
1356             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1357             while (btstack_linked_list_iterator_has_next(&it)){
1358                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1359                 if (channel->con_handle != handle) continue;
1360                 l2cap_emit_channel_closed(channel);
1361                 l2cap_stop_rtx(channel);
1362                 btstack_linked_list_iterator_remove(&it);
1363                 btstack_memory_l2cap_channel_free(channel);
1364             }
1365 #endif
1366 #ifdef ENABLE_LE_DATA_CHANNELS
1367             handle = little_endian_read_16(packet, 3);
1368             btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
1369             while (btstack_linked_list_iterator_has_next(&it)){
1370                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1371                 if (channel->con_handle != handle) continue;
1372                 l2cap_emit_channel_closed(channel);
1373                 btstack_linked_list_iterator_remove(&it);
1374                 btstack_memory_l2cap_channel_free(channel);
1375             }
1376 #endif
1377             break;
1378 
1379         // HCI Connection Timeouts
1380 #ifdef ENABLE_CLASSIC
1381         case L2CAP_EVENT_TIMEOUT_CHECK:
1382             handle = little_endian_read_16(packet, 2);
1383             if (gap_get_connection_type(handle) != GAP_CONNECTION_ACL) break;
1384             if (hci_authentication_active_for_handle(handle)) break;
1385             hci_con_used = 0;
1386             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1387             while (btstack_linked_list_iterator_has_next(&it)){
1388                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1389                 if (channel->con_handle != handle) continue;
1390                 hci_con_used = 1;
1391                 break;
1392             }
1393             if (hci_con_used) break;
1394             if (!hci_can_send_command_packet_now()) break;
1395             hci_send_cmd(&hci_disconnect, handle, 0x13); // remote closed connection
1396             break;
1397 
1398         case HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE:
1399             handle = little_endian_read_16(packet, 3);
1400             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1401             while (btstack_linked_list_iterator_has_next(&it)){
1402                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1403                 if (channel->con_handle != handle) continue;
1404                 l2cap_handle_remote_supported_features_received(channel);
1405                 break;
1406             }
1407             break;
1408 
1409         case GAP_EVENT_SECURITY_LEVEL:
1410             handle = little_endian_read_16(packet, 2);
1411             log_info("l2cap - security level update");
1412             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1413             while (btstack_linked_list_iterator_has_next(&it)){
1414                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1415                 if (channel->con_handle != handle) continue;
1416 
1417                 log_info("l2cap - state %u", channel->state);
1418 
1419                 gap_security_level_t actual_level = (gap_security_level_t) packet[4];
1420                 gap_security_level_t required_level = channel->required_security_level;
1421 
1422                 switch (channel->state){
1423                     case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
1424                         if (actual_level >= required_level){
1425                             channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
1426                             l2cap_emit_incoming_connection(channel);
1427                         } else {
1428                             channel->reason = 0x0003; // security block
1429                             channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
1430                         }
1431                         break;
1432 
1433                     case L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE:
1434                         if (actual_level >= required_level){
1435                             l2cap_ready_to_connect(channel);
1436                         } else {
1437                             // disconnnect, authentication not good enough
1438                             hci_disconnect_security_block(handle);
1439                         }
1440                         break;
1441 
1442                     default:
1443                         break;
1444                 }
1445             }
1446             break;
1447 #endif
1448 
1449         default:
1450             break;
1451     }
1452 
1453     l2cap_run();
1454 }
1455 
1456 static void l2cap_register_signaling_response(hci_con_handle_t handle, uint8_t code, uint8_t sig_id, uint16_t cid, uint16_t data){
1457     // Vol 3, Part A, 4.3: "The DCID and SCID fields shall be ignored when the result field indi- cates the connection was refused."
1458     if (signaling_responses_pending < NR_PENDING_SIGNALING_RESPONSES) {
1459         signaling_responses[signaling_responses_pending].handle = handle;
1460         signaling_responses[signaling_responses_pending].code = code;
1461         signaling_responses[signaling_responses_pending].sig_id = sig_id;
1462         signaling_responses[signaling_responses_pending].cid = cid;
1463         signaling_responses[signaling_responses_pending].data = data;
1464         signaling_responses_pending++;
1465         l2cap_run();
1466     }
1467 }
1468 
1469 #ifdef ENABLE_CLASSIC
1470 static void l2cap_handle_disconnect_request(l2cap_channel_t *channel, uint16_t identifier){
1471     channel->remote_sig_id = identifier;
1472     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
1473     l2cap_run();
1474 }
1475 
1476 static void l2cap_handle_connection_request(hci_con_handle_t handle, uint8_t sig_id, uint16_t psm, uint16_t source_cid){
1477 
1478     // log_info("l2cap_handle_connection_request for handle %u, psm %u cid 0x%02x", handle, psm, source_cid);
1479     l2cap_service_t *service = l2cap_get_service(psm);
1480     if (!service) {
1481         // 0x0002 PSM not supported
1482         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, 0x0002);
1483         return;
1484     }
1485 
1486     hci_connection_t * hci_connection = hci_connection_for_handle( handle );
1487     if (!hci_connection) {
1488         //
1489         log_error("no hci_connection for handle %u", handle);
1490         return;
1491     }
1492 
1493     // alloc structure
1494     // log_info("l2cap_handle_connection_request register channel");
1495     l2cap_channel_t * channel = l2cap_create_channel_entry(service->packet_handler, hci_connection->address, BD_ADDR_TYPE_CLASSIC,
1496     psm, service->mtu, service->required_security_level);
1497     if (!channel){
1498         // 0x0004 No resources available
1499         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, 0x0004);
1500         return;
1501     }
1502 
1503     channel->con_handle = handle;
1504     channel->remote_cid = source_cid;
1505     channel->remote_sig_id = sig_id;
1506 
1507     // limit local mtu to max acl packet length - l2cap header
1508     if (channel->local_mtu > l2cap_max_mtu()) {
1509         channel->local_mtu = l2cap_max_mtu();
1510     }
1511 
1512     // set initial state
1513     channel->state =      L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE;
1514     channel->state_var  = (L2CAP_CHANNEL_STATE_VAR) (L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND | L2CAP_CHANNEL_STATE_VAR_INCOMING);
1515 
1516     // add to connections list
1517     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) channel);
1518 
1519     // assert security requirements
1520     gap_request_security_level(handle, channel->required_security_level);
1521 }
1522 
1523 void l2cap_accept_connection(uint16_t local_cid){
1524     log_info("L2CAP_ACCEPT_CONNECTION local_cid 0x%x", local_cid);
1525     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1526     if (!channel) {
1527         log_error("l2cap_accept_connection called but local_cid 0x%x not found", local_cid);
1528         return;
1529     }
1530 
1531 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1532     // configure L2CAP Basic mode
1533     channel->mode  = L2CAP_CHANNEL_MODE_BASIC;
1534 #endif
1535 
1536     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
1537 
1538     // process
1539     l2cap_run();
1540 }
1541 
1542 
1543 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1544 void l2cap_accept_ertm_connection(uint16_t local_cid, int ertm_mandatory){
1545     log_info("L2CAP_ACCEPT_ERTM_CONNECTION local_cid 0x%x", local_cid);
1546     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1547     if (!channel) {
1548         log_error("l2cap_accept_connection called but local_cid 0x%x not found", local_cid);
1549         return;
1550     }
1551 
1552     // configure L2CAP ERTM
1553     channel->mode  = L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION;
1554     channel->ertm_mandatory = ertm_mandatory;
1555 
1556     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
1557 
1558     // process
1559     l2cap_run();
1560 }
1561 #endif
1562 
1563 
1564 void l2cap_decline_connection(uint16_t local_cid){
1565     log_info("L2CAP_DECLINE_CONNECTION local_cid 0x%x", local_cid);
1566     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
1567     if (!channel) {
1568         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
1569         return;
1570     }
1571     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
1572     channel->reason = 0x04; // no resources available
1573     l2cap_run();
1574 }
1575 
1576 static void l2cap_signaling_handle_configure_request(l2cap_channel_t *channel, uint8_t *command){
1577 
1578     channel->remote_sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
1579 
1580     uint16_t flags = little_endian_read_16(command, 6);
1581     if (flags & 1) {
1582         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
1583     }
1584 
1585     // accept the other's configuration options
1586     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
1587     uint16_t pos     = 8;
1588     while (pos < end_pos){
1589         uint8_t option_hint = command[pos] >> 7;
1590         uint8_t option_type = command[pos] & 0x7f;
1591         log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
1592         pos++;
1593         uint8_t length = command[pos++];
1594         // MTU { type(8): 1, len(8):2, MTU(16) }
1595         if (option_type == 1 && length == 2){
1596             channel->remote_mtu = little_endian_read_16(command, pos);
1597             if (channel->remote_mtu > l2cap_max_mtu()){
1598                 log_info("Remote MTU %u larger than outgoing buffer, only using MTU = %u", channel->remote_mtu, l2cap_max_mtu());
1599                 channel->remote_mtu = l2cap_max_mtu();
1600             }
1601             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1602         }
1603         // Flush timeout { type(8):2, len(8): 2, Flush Timeout(16)}
1604         if (option_type == 2 && length == 2){
1605             channel->flush_timeout = little_endian_read_16(command, pos);
1606         }
1607 
1608 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1609         // Retransmission and Flow Control Option
1610         if (option_type == 4 && length == 9){
1611             l2cap_channel_mode_t mode = (l2cap_channel_mode_t) command[pos];
1612             switch(channel->mode){
1613                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
1614                     if (channel->ertm_mandatory){
1615                         // ERTM mandatory, but remote doens't offer ERTM -> disconnect
1616                         if (mode != L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1617                             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1618                         } else {
1619                             // Both sides selected ERTM
1620                             // TODO store and evaluate configuration
1621                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1622                         }
1623                     } else {
1624                         // ERTM is optional
1625                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1626                     }
1627                     break;
1628                 case L2CAP_CHANNEL_MODE_BASIC:
1629                     switch (mode){
1630                         case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
1631                             // remote asks for ERTM, but we want basic mode. disconnect if this happens a second time
1632                             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED){
1633                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1634                             }
1635                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED);
1636                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
1637                             break;
1638                         default: // case L2CAP_CHANNEL_MODE_BASIC:
1639                             // TODO store and evaluate configuration
1640                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1641                             break;
1642                     }
1643                     break;
1644                 default:
1645                     break;
1646             }
1647         }
1648 #endif
1649         // check for unknown options
1650         if (option_hint == 0 && (option_type == 0 || option_type >= 0x07)){
1651             log_info("l2cap cid %u, unknown options", channel->local_cid);
1652             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
1653         }
1654         pos += length;
1655     }
1656 }
1657 
1658 static void l2cap_signaling_handle_configure_response(l2cap_channel_t *channel, uint8_t result, uint8_t *command){
1659     log_info("l2cap_signaling_handle_configure_response");
1660 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1661     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
1662     uint16_t pos     = 10;
1663     while (pos < end_pos){
1664         uint8_t option_hint = command[pos] >> 7;
1665         uint8_t option_type = command[pos] & 0x7f;
1666         log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
1667         pos++;
1668         uint8_t length = command[pos++];
1669 
1670         // Retransmission and Flow Control Option
1671         if (option_type == 4 && length == 9){
1672             switch (channel->mode){
1673                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
1674                     if (channel->ertm_mandatory){
1675                         // ??
1676                     } else {
1677                         // On 'Reject - Unacceptable Parameters' to our optional ERTM request, fall back to BASIC mode
1678                         if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
1679                             channel->mode = L2CAP_CHANNEL_MODE_BASIC;
1680                         }
1681                     }
1682                     break;
1683                 case L2CAP_CHANNEL_MODE_BASIC:
1684                     if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
1685                         // On 'Reject - Unacceptable Parameters' to our Basic mode request, disconnect
1686                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1687                     }
1688                     break;
1689                 default:
1690                     break;
1691             }
1692         }
1693 
1694         // check for unknown options
1695         if (option_hint == 0 && (option_type == 0 || option_type >= 0x07)){
1696             log_info("l2cap cid %u, unknown options", channel->local_cid);
1697             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
1698         }
1699 
1700         pos += length;
1701     }
1702 #endif
1703 }
1704 
1705 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel){
1706     // log_info("l2cap_channel_ready_for_open 0x%02x", channel->state_var);
1707     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP) == 0) return 0;
1708     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP) == 0) return 0;
1709     // addition check that fixes re-entrance issue causing l2cap event channel opened twice
1710     if (channel->state == L2CAP_STATE_OPEN) return 0;
1711     return 1;
1712 }
1713 
1714 
1715 static void l2cap_signaling_handler_channel(l2cap_channel_t *channel, uint8_t *command){
1716 
1717     uint8_t  code       = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
1718     uint8_t  identifier = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
1719     uint16_t result = 0;
1720 
1721     log_info("L2CAP signaling handler code %u, state %u", code, channel->state);
1722 
1723     // handle DISCONNECT REQUESTS seperately
1724     if (code == DISCONNECTION_REQUEST){
1725         switch (channel->state){
1726             case L2CAP_STATE_CONFIG:
1727             case L2CAP_STATE_OPEN:
1728             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
1729             case L2CAP_STATE_WAIT_DISCONNECT:
1730                 l2cap_handle_disconnect_request(channel, identifier);
1731                 break;
1732 
1733             default:
1734                 // ignore in other states
1735                 break;
1736         }
1737         return;
1738     }
1739 
1740     // @STATEMACHINE(l2cap)
1741     switch (channel->state) {
1742 
1743         case L2CAP_STATE_WAIT_CONNECT_RSP:
1744             switch (code){
1745                 case CONNECTION_RESPONSE:
1746                     l2cap_stop_rtx(channel);
1747                     result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
1748                     switch (result) {
1749                         case 0:
1750                             // successful connection
1751                             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1752                             channel->state = L2CAP_STATE_CONFIG;
1753                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1754                             break;
1755                         case 1:
1756                             // connection pending. get some coffee, but start the ERTX
1757                             l2cap_start_ertx(channel);
1758                             break;
1759                         default:
1760                             // channel closed
1761                             channel->state = L2CAP_STATE_CLOSED;
1762                             // map l2cap connection response result to BTstack status enumeration
1763                             l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result);
1764 
1765                             // drop link key if security block
1766                             if (L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result == L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY){
1767                                 gap_drop_link_key_for_bd_addr(channel->address);
1768                             }
1769 
1770                             // discard channel
1771                             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1772                             btstack_memory_l2cap_channel_free(channel);
1773                             break;
1774                     }
1775                     break;
1776 
1777                 default:
1778                     //@TODO: implement other signaling packets
1779                     break;
1780             }
1781             break;
1782 
1783         case L2CAP_STATE_CONFIG:
1784             result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
1785             switch (code) {
1786                 case CONFIGURE_REQUEST:
1787                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
1788                     l2cap_signaling_handle_configure_request(channel, command);
1789                     if (!(channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT)){
1790                         // only done if continuation not set
1791                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_REQ);
1792                     }
1793                     break;
1794                 case CONFIGURE_RESPONSE:
1795                     l2cap_stop_rtx(channel);
1796                     l2cap_signaling_handle_configure_response(channel, result, command);
1797                     switch (result){
1798                         case 0: // success
1799                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP);
1800                             break;
1801                         case 4: // pending
1802                             l2cap_start_ertx(channel);
1803                             break;
1804                         default:
1805 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1806                             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION && channel->ertm_mandatory){
1807                                 // remote does not offer ertm but it's required
1808                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1809                                 break;
1810                             }
1811 #endif
1812                             // retry on negative result
1813                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1814                             break;
1815                     }
1816                     break;
1817                 default:
1818                     break;
1819             }
1820             if (l2cap_channel_ready_for_open(channel)){
1821                 // for open:
1822                 channel->state = L2CAP_STATE_OPEN;
1823                 l2cap_emit_channel_opened(channel, 0);
1824             }
1825             break;
1826 
1827         case L2CAP_STATE_WAIT_DISCONNECT:
1828             switch (code) {
1829                 case DISCONNECTION_RESPONSE:
1830                     l2cap_finialize_channel_close(channel);
1831                     break;
1832                 default:
1833                     //@TODO: implement other signaling packets
1834                     break;
1835             }
1836             break;
1837 
1838         case L2CAP_STATE_CLOSED:
1839             // @TODO handle incoming requests
1840             break;
1841 
1842         case L2CAP_STATE_OPEN:
1843             //@TODO: implement other signaling packets, e.g. re-configure
1844             break;
1845         default:
1846             break;
1847     }
1848     // log_info("new state %u", channel->state);
1849 }
1850 
1851 
1852 static void l2cap_signaling_handler_dispatch( hci_con_handle_t handle, uint8_t * command){
1853 
1854     btstack_linked_list_iterator_t it;
1855 
1856     // get code, signalind identifier and command len
1857     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
1858     uint8_t sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
1859 
1860     // not for a particular channel, and not CONNECTION_REQUEST, ECHO_[REQUEST|RESPONSE], INFORMATION_RESPONSE
1861     if (code < 1 || code == ECHO_RESPONSE || code > INFORMATION_RESPONSE){
1862         l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
1863         return;
1864     }
1865 
1866     // general commands without an assigned channel
1867     switch(code) {
1868 
1869         case CONNECTION_REQUEST: {
1870             uint16_t psm =        little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1871             uint16_t source_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
1872             l2cap_handle_connection_request(handle, sig_id, psm, source_cid);
1873             return;
1874         }
1875 
1876         case ECHO_REQUEST:
1877             l2cap_register_signaling_response(handle, code, sig_id, 0, 0);
1878             return;
1879 
1880         case INFORMATION_REQUEST: {
1881             uint16_t infoType = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1882             l2cap_register_signaling_response(handle, code, sig_id, 0, infoType);
1883             return;
1884         }
1885 
1886 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1887         case INFORMATION_RESPONSE: {
1888             hci_connection_t * connection = hci_connection_for_handle(handle);
1889             if (!connection) return;
1890             uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1891             uint16_t result =  little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
1892             if (result != 0) return;
1893             if (info_type != 0x02) return;
1894             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_DONE;
1895             connection->l2cap_state.extended_feature_mask = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
1896             log_info("extended features mask 0x%02x", connection->l2cap_state.extended_feature_mask);
1897             // trigger connection request
1898             btstack_linked_list_iterator_init(&it, &l2cap_channels);
1899             while (btstack_linked_list_iterator_has_next(&it)){
1900                 l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1901                 if (channel->con_handle != handle) continue;
1902                 // bail if ERTM was requested but is not supported
1903                 if ((channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) && ((connection->l2cap_state.extended_feature_mask & 0x08) == 0)){
1904                     if (channel->ertm_mandatory){
1905                         // channel closed
1906                         channel->state = L2CAP_STATE_CLOSED;
1907                         // map l2cap connection response result to BTstack status enumeration
1908                         l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_ERTM_NOT_SUPPORTD);
1909                         // discard channel
1910                         btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1911                         btstack_memory_l2cap_channel_free(channel);
1912                         continue;
1913                     } else {
1914                         // fallback to Basic mode
1915                         channel->mode = L2CAP_CHANNEL_MODE_BASIC;
1916                     }
1917                 }
1918                 // start connecting
1919                 if (channel->state == L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES){
1920                     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
1921                 }
1922             }
1923             return;
1924         }
1925 #endif
1926 
1927         default:
1928             break;
1929     }
1930 
1931 
1932     // Get potential destination CID
1933     uint16_t dest_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1934 
1935     // Find channel for this sig_id and connection handle
1936     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1937     while (btstack_linked_list_iterator_has_next(&it)){
1938         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1939         if (channel->con_handle != handle) continue;
1940         if (code & 1) {
1941             // match odd commands (responses) by previous signaling identifier
1942             if (channel->local_sig_id == sig_id) {
1943                 l2cap_signaling_handler_channel(channel, command);
1944                 break;
1945             }
1946         } else {
1947             // match even commands (requests) by local channel id
1948             if (channel->local_cid == dest_cid) {
1949                 l2cap_signaling_handler_channel(channel, command);
1950                 break;
1951             }
1952         }
1953     }
1954 }
1955 #endif
1956 
1957 #ifdef ENABLE_BLE
1958 
1959 static void l2cap_emit_connection_parameter_update_response(hci_con_handle_t con_handle, uint16_t result){
1960     uint8_t event[6];
1961     event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_RESPONSE;
1962     event[1] = 4;
1963     little_endian_store_16(event, 2, con_handle);
1964     little_endian_store_16(event, 4, result);
1965     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
1966     if (!l2cap_event_packet_handler) return;
1967     (*l2cap_event_packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
1968 }
1969 
1970 // @returns valid
1971 static int l2cap_le_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t * command, uint8_t sig_id){
1972     hci_connection_t * connection;
1973     uint16_t result;
1974     uint8_t  event[10];
1975 
1976 #ifdef ENABLE_LE_DATA_CHANNELS
1977     btstack_linked_list_iterator_t it;
1978     l2cap_channel_t * channel;
1979     uint16_t local_cid;
1980     uint16_t le_psm;
1981     uint16_t new_credits;
1982     uint16_t credits_before;
1983     l2cap_service_t * service;
1984     uint16_t source_cid;
1985 #endif
1986 
1987     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
1988     log_info("l2cap_le_signaling_handler_dispatch: command 0x%02x, sig id %u", code, sig_id);
1989 
1990     switch (code){
1991 
1992         case CONNECTION_PARAMETER_UPDATE_RESPONSE:
1993             result = little_endian_read_16(command, 4);
1994             l2cap_emit_connection_parameter_update_response(handle, result);
1995             break;
1996 
1997         case CONNECTION_PARAMETER_UPDATE_REQUEST:
1998             connection = hci_connection_for_handle(handle);
1999             if (connection){
2000                 if (connection->role != HCI_ROLE_MASTER){
2001                     // reject command without notifying upper layer when not in master role
2002                     return 0;
2003                 }
2004                 int update_parameter = 1;
2005                 le_connection_parameter_range_t existing_range;
2006                 gap_get_connection_parameter_range(&existing_range);
2007                 uint16_t le_conn_interval_min = little_endian_read_16(command,8);
2008                 uint16_t le_conn_interval_max = little_endian_read_16(command,10);
2009                 uint16_t le_conn_latency = little_endian_read_16(command,12);
2010                 uint16_t le_supervision_timeout = little_endian_read_16(command,14);
2011 
2012                 if (le_conn_interval_min < existing_range.le_conn_interval_min) update_parameter = 0;
2013                 if (le_conn_interval_max > existing_range.le_conn_interval_max) update_parameter = 0;
2014 
2015                 if (le_conn_latency < existing_range.le_conn_latency_min) update_parameter = 0;
2016                 if (le_conn_latency > existing_range.le_conn_latency_max) update_parameter = 0;
2017 
2018                 if (le_supervision_timeout < existing_range.le_supervision_timeout_min) update_parameter = 0;
2019                 if (le_supervision_timeout > existing_range.le_supervision_timeout_max) update_parameter = 0;
2020 
2021                 if (update_parameter){
2022                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_SEND_RESPONSE;
2023                     connection->le_conn_interval_min = le_conn_interval_min;
2024                     connection->le_conn_interval_max = le_conn_interval_max;
2025                     connection->le_conn_latency = le_conn_latency;
2026                     connection->le_supervision_timeout = le_supervision_timeout;
2027                 } else {
2028                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_DENY;
2029                 }
2030                 connection->le_con_param_update_identifier = sig_id;
2031             }
2032 
2033             if (!l2cap_event_packet_handler) break;
2034 
2035             event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_REQUEST;
2036             event[1] = 8;
2037             memcpy(&event[2], &command[4], 8);
2038             hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2039             (*l2cap_event_packet_handler)( HCI_EVENT_PACKET, 0, event, sizeof(event));
2040             break;
2041 
2042 #ifdef ENABLE_LE_DATA_CHANNELS
2043 
2044         case COMMAND_REJECT:
2045             // Find channel for this sig_id and connection handle
2046             channel = NULL;
2047             btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
2048             while (btstack_linked_list_iterator_has_next(&it)){
2049                 l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2050                 if (a_channel->con_handle   != handle) continue;
2051                 if (a_channel->local_sig_id != sig_id) continue;
2052                 channel = a_channel;
2053                 break;
2054             }
2055             if (!channel) break;
2056 
2057             // if received while waiting for le connection response, assume legacy device
2058             if (channel->state == L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE){
2059                 channel->state = L2CAP_STATE_CLOSED;
2060                 // no official value for this, use: Connection refused – LE_PSM not supported - 0x0002
2061                 l2cap_emit_le_channel_opened(channel, 0x0002);
2062 
2063                 // discard channel
2064                 btstack_linked_list_remove(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2065                 btstack_memory_l2cap_channel_free(channel);
2066                 break;
2067             }
2068             break;
2069 
2070         case LE_CREDIT_BASED_CONNECTION_REQUEST:
2071 
2072             // get hci connection, bail if not found (must not happen)
2073             connection = hci_connection_for_handle(handle);
2074             if (!connection) return 0;
2075 
2076             // check if service registered
2077             le_psm  = little_endian_read_16(command, 4);
2078             service = l2cap_le_get_service(le_psm);
2079             source_cid = little_endian_read_16(command, 6);
2080 
2081             if (service){
2082                 if (source_cid < 0x40){
2083                     // 0x0009 Connection refused - Invalid Source CID
2084                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0009);
2085                     return 1;
2086                 }
2087 
2088                 // go through list of channels for this ACL connection and check if we get a match
2089                 btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
2090                 while (btstack_linked_list_iterator_has_next(&it)){
2091                     l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2092                     if (a_channel->con_handle != handle) continue;
2093                     if (a_channel->remote_cid != source_cid) continue;
2094                     // 0x000a Connection refused - Source CID already allocated
2095                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x000a);
2096                     return 1;
2097                 }
2098 
2099                 // security: check encryption
2100                 if (service->required_security_level >= LEVEL_2){
2101                     if (sm_encryption_key_size(handle) == 0){
2102                         // 0x0008 Connection refused - insufficient encryption
2103                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0008);
2104                         return 1;
2105                     }
2106                     // anything less than 16 byte key size is insufficient
2107                     if (sm_encryption_key_size(handle) < 16){
2108                         // 0x0007 Connection refused – insufficient encryption key size
2109                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0007);
2110                         return 1;
2111                     }
2112                 }
2113 
2114                 // security: check authencation
2115                 if (service->required_security_level >= LEVEL_3){
2116                     if (!sm_authenticated(handle)){
2117                         // 0x0005 Connection refused – insufficient authentication
2118                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0005);
2119                         return 1;
2120                     }
2121                 }
2122 
2123                 // security: check authorization
2124                 if (service->required_security_level >= LEVEL_4){
2125                     if (sm_authorization_state(handle) != AUTHORIZATION_GRANTED){
2126                         // 0x0006 Connection refused – insufficient authorization
2127                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0006);
2128                         return 1;
2129                     }
2130                 }
2131 
2132                 // allocate channel
2133                 channel = l2cap_create_channel_entry(service->packet_handler, connection->address,
2134                     BD_ADDR_TYPE_LE_RANDOM, le_psm, service->mtu, service->required_security_level);
2135                 if (!channel){
2136                     // 0x0004 Connection refused – no resources available
2137                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0004);
2138                     return 1;
2139                 }
2140 
2141                 channel->con_handle = handle;
2142                 channel->remote_cid = source_cid;
2143                 channel->remote_sig_id = sig_id;
2144                 channel->remote_mtu = little_endian_read_16(command, 8);
2145                 channel->remote_mps = little_endian_read_16(command, 10);
2146                 channel->credits_outgoing = little_endian_read_16(command, 12);
2147 
2148                 // set initial state
2149                 channel->state      = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
2150                 channel->state_var |= L2CAP_CHANNEL_STATE_VAR_INCOMING;
2151 
2152                 // add to connections list
2153                 btstack_linked_list_add(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2154 
2155                 // post connection request event
2156                 l2cap_emit_le_incoming_connection(channel);
2157 
2158             } else {
2159                 // Connection refused – LE_PSM not supported
2160                 l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0002);
2161             }
2162             break;
2163 
2164         case LE_CREDIT_BASED_CONNECTION_RESPONSE:
2165             // Find channel for this sig_id and connection handle
2166             channel = NULL;
2167             btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
2168             while (btstack_linked_list_iterator_has_next(&it)){
2169                 l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2170                 if (a_channel->con_handle   != handle) continue;
2171                 if (a_channel->local_sig_id != sig_id) continue;
2172                 channel = a_channel;
2173                 break;
2174             }
2175             if (!channel) break;
2176 
2177             // cid + 0
2178             result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+8);
2179             if (result){
2180                 channel->state = L2CAP_STATE_CLOSED;
2181                 // map l2cap connection response result to BTstack status enumeration
2182                 l2cap_emit_le_channel_opened(channel, result);
2183 
2184                 // discard channel
2185                 btstack_linked_list_remove(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2186                 btstack_memory_l2cap_channel_free(channel);
2187                 break;
2188             }
2189 
2190             // success
2191             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
2192             channel->remote_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
2193             channel->remote_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
2194             channel->credits_outgoing = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
2195             channel->state = L2CAP_STATE_OPEN;
2196             l2cap_emit_le_channel_opened(channel, result);
2197             break;
2198 
2199         case LE_FLOW_CONTROL_CREDIT:
2200             // find channel
2201             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
2202             channel = l2cap_le_get_channel_for_local_cid(local_cid);
2203             if (!channel) {
2204                 log_error("l2cap: no channel for cid 0x%02x", local_cid);
2205                 break;
2206             }
2207             new_credits = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
2208             credits_before = channel->credits_outgoing;
2209             channel->credits_outgoing += new_credits;
2210             // check for credit overrun
2211             if (credits_before > channel->credits_outgoing){
2212                 log_error("l2cap: new credits caused overrrun for cid 0x%02x, disconnecting", local_cid);
2213                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
2214                 break;
2215             }
2216             log_info("l2cap: %u credits for 0x%02x, now %u", new_credits, local_cid, channel->credits_outgoing);
2217             break;
2218 
2219         case DISCONNECTION_REQUEST:
2220             // find channel
2221             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
2222             channel = l2cap_le_get_channel_for_local_cid(local_cid);
2223             if (!channel) {
2224                 log_error("l2cap: no channel for cid 0x%02x", local_cid);
2225                 break;
2226             }
2227             channel->remote_sig_id = sig_id;
2228             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
2229             break;
2230 
2231 #endif
2232 
2233         case DISCONNECTION_RESPONSE:
2234             break;
2235 
2236         default:
2237             // command unknown -> reject command
2238             return 0;
2239     }
2240     return 1;
2241 }
2242 #endif
2243 
2244 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size ){
2245     UNUSED(packet_type);
2246     UNUSED(channel);
2247 
2248     l2cap_channel_t * l2cap_channel;
2249     UNUSED(l2cap_channel);
2250 
2251     // Get Channel ID
2252     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
2253     hci_con_handle_t handle = READ_ACL_CONNECTION_HANDLE(packet);
2254 
2255     switch (channel_id) {
2256 
2257 #ifdef ENABLE_CLASSIC
2258         case L2CAP_CID_SIGNALING: {
2259             uint16_t command_offset = 8;
2260             while (command_offset < size) {
2261                 // handle signaling commands
2262                 l2cap_signaling_handler_dispatch(handle, &packet[command_offset]);
2263 
2264                 // increment command_offset
2265                 command_offset += L2CAP_SIGNALING_COMMAND_DATA_OFFSET + little_endian_read_16(packet, command_offset + L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
2266             }
2267             break;
2268         }
2269 #endif
2270 
2271 #ifdef ENABLE_BLE
2272         case L2CAP_CID_SIGNALING_LE: {
2273             uint16_t sig_id = packet[COMPLETE_L2CAP_HEADER + 1];
2274             int      valid  = l2cap_le_signaling_handler_dispatch(handle, &packet[COMPLETE_L2CAP_HEADER], sig_id);
2275             if (!valid){
2276                 l2cap_register_signaling_response(handle, COMMAND_REJECT_LE, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
2277             }
2278             break;
2279         }
2280 #endif
2281 
2282         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
2283             if (fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL].callback) {
2284                 (*fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_ATTRIBUTE_PROTOCOL].callback)(ATT_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
2285             }
2286             break;
2287 
2288         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
2289             if (fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL].callback) {
2290                 (*fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_SECURITY_MANAGER_PROTOCOL].callback)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
2291             }
2292             break;
2293 
2294         case L2CAP_CID_CONNECTIONLESS_CHANNEL:
2295             if (fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL].callback) {
2296                 (*fixed_channels[L2CAP_FIXED_CHANNEL_TABLE_INDEX_CONNECTIONLESS_CHANNEL].callback)(UCD_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
2297             }
2298             break;
2299 
2300         default:
2301 #ifdef ENABLE_CLASSIC
2302             // Find channel for this channel_id and connection handle
2303             l2cap_channel = l2cap_get_channel_for_local_cid(channel_id);
2304             if (l2cap_channel) {
2305                 l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
2306             }
2307 #endif
2308 #ifdef ENABLE_LE_DATA_CHANNELS
2309             l2cap_channel = l2cap_le_get_channel_for_local_cid(channel_id);
2310             if (l2cap_channel) {
2311                 // credit counting
2312                 if (l2cap_channel->credits_incoming == 0){
2313                     log_error("LE Data Channel packet received but no incoming credits");
2314                     l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
2315                     break;
2316                 }
2317                 l2cap_channel->credits_incoming--;
2318 
2319                 // automatic credits
2320                 if (l2cap_channel->credits_incoming < L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_WATERMARK && l2cap_channel->automatic_credits){
2321                     l2cap_channel->new_credits_incoming = L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_INCREMENT;
2322                 }
2323 
2324                 // first fragment
2325                 uint16_t pos = 0;
2326                 if (!l2cap_channel->receive_sdu_len){
2327                     l2cap_channel->receive_sdu_len = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
2328                     l2cap_channel->receive_sdu_pos = 0;
2329                     pos  += 2;
2330                     size -= 2;
2331                 }
2332                 memcpy(&l2cap_channel->receive_sdu_buffer[l2cap_channel->receive_sdu_pos], &packet[COMPLETE_L2CAP_HEADER+pos], size-COMPLETE_L2CAP_HEADER);
2333                 l2cap_channel->receive_sdu_pos += size - COMPLETE_L2CAP_HEADER;
2334                 // done?
2335                 log_info("le packet pos %u, len %u", l2cap_channel->receive_sdu_pos, l2cap_channel->receive_sdu_len);
2336                 if (l2cap_channel->receive_sdu_pos >= l2cap_channel->receive_sdu_len){
2337                     l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->receive_sdu_buffer, l2cap_channel->receive_sdu_len);
2338                     l2cap_channel->receive_sdu_len = 0;
2339                 }
2340             } else {
2341                 log_error("LE Data Channel packet received but no channel found for cid 0x%02x", channel_id);
2342             }
2343 #endif
2344             break;
2345     }
2346 
2347     l2cap_run();
2348 }
2349 
2350 // Bluetooth 4.0 - allows to register handler for Attribute Protocol and Security Manager Protocol
2351 void l2cap_register_fixed_channel(btstack_packet_handler_t the_packet_handler, uint16_t channel_id) {
2352     int index = l2cap_fixed_channel_table_index_for_channel_id(channel_id);
2353     if (index < 0) return;
2354     fixed_channels[index].callback = the_packet_handler;
2355 }
2356 
2357 #ifdef ENABLE_CLASSIC
2358 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
2359 void l2cap_finialize_channel_close(l2cap_channel_t * channel){
2360     channel->state = L2CAP_STATE_CLOSED;
2361     l2cap_emit_channel_closed(channel);
2362     // discard channel
2363     l2cap_stop_rtx(channel);
2364     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2365     btstack_memory_l2cap_channel_free(channel);
2366 }
2367 
2368 static l2cap_service_t * l2cap_get_service_internal(btstack_linked_list_t * services, uint16_t psm){
2369     btstack_linked_list_iterator_t it;
2370     btstack_linked_list_iterator_init(&it, services);
2371     while (btstack_linked_list_iterator_has_next(&it)){
2372         l2cap_service_t * service = (l2cap_service_t *) btstack_linked_list_iterator_next(&it);
2373         if ( service->psm == psm){
2374             return service;
2375         };
2376     }
2377     return NULL;
2378 }
2379 
2380 static inline l2cap_service_t * l2cap_get_service(uint16_t psm){
2381     return l2cap_get_service_internal(&l2cap_services, psm);
2382 }
2383 
2384 
2385 uint8_t l2cap_register_service(btstack_packet_handler_t service_packet_handler, uint16_t psm, uint16_t mtu, gap_security_level_t security_level){
2386 
2387     log_info("L2CAP_REGISTER_SERVICE psm 0x%x mtu %u", psm, mtu);
2388 
2389     // check for alread registered psm
2390     l2cap_service_t *service = l2cap_get_service(psm);
2391     if (service) {
2392         log_error("l2cap_register_service: PSM %u already registered", psm);
2393         return L2CAP_SERVICE_ALREADY_REGISTERED;
2394     }
2395 
2396     // alloc structure
2397     service = btstack_memory_l2cap_service_get();
2398     if (!service) {
2399         log_error("l2cap_register_service: no memory for l2cap_service_t");
2400         return BTSTACK_MEMORY_ALLOC_FAILED;
2401     }
2402 
2403     // fill in
2404     service->psm = psm;
2405     service->mtu = mtu;
2406     service->packet_handler = service_packet_handler;
2407     service->required_security_level = security_level;
2408 
2409     // add to services list
2410     btstack_linked_list_add(&l2cap_services, (btstack_linked_item_t *) service);
2411 
2412     // enable page scan
2413     gap_connectable_control(1);
2414 
2415     return 0;
2416 }
2417 
2418 uint8_t l2cap_unregister_service(uint16_t psm){
2419 
2420     log_info("L2CAP_UNREGISTER_SERVICE psm 0x%x", psm);
2421 
2422     l2cap_service_t *service = l2cap_get_service(psm);
2423     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
2424     btstack_linked_list_remove(&l2cap_services, (btstack_linked_item_t *) service);
2425     btstack_memory_l2cap_service_free(service);
2426 
2427     // disable page scan when no services registered
2428     if (btstack_linked_list_empty(&l2cap_services)) {
2429         gap_connectable_control(0);
2430     }
2431     return 0;
2432 }
2433 #endif
2434 
2435 
2436 #ifdef ENABLE_LE_DATA_CHANNELS
2437 
2438 static void l2cap_le_notify_channel_can_send(l2cap_channel_t *channel){
2439     if (!channel->waiting_for_can_send_now) return;
2440     if (channel->send_sdu_buffer) return;
2441     channel->waiting_for_can_send_now = 0;
2442     log_info("L2CAP_EVENT_CHANNEL_LE_CAN_SEND_NOW local_cid 0x%x", channel->local_cid);
2443     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_LE_CAN_SEND_NOW);
2444 }
2445 
2446 // 1BH2222
2447 static void l2cap_emit_le_incoming_connection(l2cap_channel_t *channel) {
2448     log_info("L2CAP_EVENT_LE_INCOMING_CONNECTION addr_type %u, addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x, remote_mtu %u",
2449              channel->address_type, bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid, channel->remote_mtu);
2450     uint8_t event[19];
2451     event[0] = L2CAP_EVENT_LE_INCOMING_CONNECTION;
2452     event[1] = sizeof(event) - 2;
2453     event[2] = channel->address_type;
2454     reverse_bd_addr(channel->address, &event[3]);
2455     little_endian_store_16(event,  9, channel->con_handle);
2456     little_endian_store_16(event, 11, channel->psm);
2457     little_endian_store_16(event, 13, channel->local_cid);
2458     little_endian_store_16(event, 15, channel->remote_cid);
2459     little_endian_store_16(event, 17, channel->remote_mtu);
2460     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2461     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2462 }
2463 // 11BH22222
2464 static void l2cap_emit_le_channel_opened(l2cap_channel_t *channel, uint8_t status) {
2465     log_info("L2CAP_EVENT_LE_CHANNEL_OPENED status 0x%x addr_type %u addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u",
2466              status, channel->address_type, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
2467              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu);
2468     uint8_t event[23];
2469     event[0] = L2CAP_EVENT_LE_CHANNEL_OPENED;
2470     event[1] = sizeof(event) - 2;
2471     event[2] = status;
2472     event[3] = channel->address_type;
2473     reverse_bd_addr(channel->address, &event[4]);
2474     little_endian_store_16(event, 10, channel->con_handle);
2475     event[12] = channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING ? 1 : 0;
2476     little_endian_store_16(event, 13, channel->psm);
2477     little_endian_store_16(event, 15, channel->local_cid);
2478     little_endian_store_16(event, 17, channel->remote_cid);
2479     little_endian_store_16(event, 19, channel->local_mtu);
2480     little_endian_store_16(event, 21, channel->remote_mtu);
2481     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
2482     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2483 }
2484 
2485 static l2cap_channel_t * l2cap_le_get_channel_for_local_cid(uint16_t local_cid){
2486     btstack_linked_list_iterator_t it;
2487     btstack_linked_list_iterator_init(&it, &l2cap_le_channels);
2488     while (btstack_linked_list_iterator_has_next(&it)){
2489         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2490         if ( channel->local_cid == local_cid) {
2491             return channel;
2492         }
2493     }
2494     return NULL;
2495 }
2496 
2497 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
2498 void l2cap_le_finialize_channel_close(l2cap_channel_t * channel){
2499     channel->state = L2CAP_STATE_CLOSED;
2500     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
2501     // discard channel
2502     btstack_linked_list_remove(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2503     btstack_memory_l2cap_channel_free(channel);
2504 }
2505 
2506 static inline l2cap_service_t * l2cap_le_get_service(uint16_t le_psm){
2507     return l2cap_get_service_internal(&l2cap_le_services, le_psm);
2508 }
2509 
2510 uint8_t l2cap_le_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, gap_security_level_t security_level){
2511 
2512     log_info("L2CAP_LE_REGISTER_SERVICE psm 0x%x", psm);
2513 
2514     // check for alread registered psm
2515     l2cap_service_t *service = l2cap_le_get_service(psm);
2516     if (service) {
2517         return L2CAP_SERVICE_ALREADY_REGISTERED;
2518     }
2519 
2520     // alloc structure
2521     service = btstack_memory_l2cap_service_get();
2522     if (!service) {
2523         log_error("l2cap_register_service_internal: no memory for l2cap_service_t");
2524         return BTSTACK_MEMORY_ALLOC_FAILED;
2525     }
2526 
2527     // fill in
2528     service->psm = psm;
2529     service->mtu = 0;
2530     service->packet_handler = packet_handler;
2531     service->required_security_level = security_level;
2532 
2533     // add to services list
2534     btstack_linked_list_add(&l2cap_le_services, (btstack_linked_item_t *) service);
2535 
2536     // done
2537     return 0;
2538 }
2539 
2540 uint8_t l2cap_le_unregister_service(uint16_t psm) {
2541     log_info("L2CAP_LE_UNREGISTER_SERVICE psm 0x%x", psm);
2542     l2cap_service_t *service = l2cap_le_get_service(psm);
2543     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
2544 
2545     btstack_linked_list_remove(&l2cap_le_services, (btstack_linked_item_t *) service);
2546     btstack_memory_l2cap_service_free(service);
2547     return 0;
2548 }
2549 
2550 uint8_t l2cap_le_accept_connection(uint16_t local_cid, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits){
2551     // get channel
2552     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2553     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2554 
2555     // validate state
2556     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
2557         return ERROR_CODE_COMMAND_DISALLOWED;
2558     }
2559 
2560     // set state accept connection
2561     channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT;
2562     channel->receive_sdu_buffer = receive_sdu_buffer;
2563     channel->local_mtu = mtu;
2564     channel->new_credits_incoming = initial_credits;
2565     channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
2566 
2567     // test
2568     // channel->new_credits_incoming = 1;
2569 
2570     // go
2571     l2cap_run();
2572     return 0;
2573 }
2574 
2575 /**
2576  * @brief Deny incoming LE Data Channel connection due to resource constraints
2577  * @param local_cid             L2CAP LE Data Channel Identifier
2578  */
2579 
2580 uint8_t l2cap_le_decline_connection(uint16_t local_cid){
2581     // get channel
2582     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2583     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2584 
2585     // validate state
2586     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
2587         return ERROR_CODE_COMMAND_DISALLOWED;
2588     }
2589 
2590     // set state decline connection
2591     channel->state  = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE;
2592     channel->reason = 0x04; // no resources available
2593     l2cap_run();
2594     return 0;
2595 }
2596 
2597 uint8_t l2cap_le_create_channel(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
2598     uint16_t psm, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits, gap_security_level_t security_level,
2599     uint16_t * out_local_cid) {
2600 
2601     log_info("L2CAP_LE_CREATE_CHANNEL handle 0x%04x psm 0x%x mtu %u", con_handle, psm, mtu);
2602 
2603 
2604     hci_connection_t * connection = hci_connection_for_handle(con_handle);
2605     if (!connection) {
2606         log_error("no hci_connection for handle 0x%04x", con_handle);
2607         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2608     }
2609 
2610     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, connection->address, connection->address_type, psm, mtu, security_level);
2611     if (!channel) {
2612         return BTSTACK_MEMORY_ALLOC_FAILED;
2613     }
2614     log_info("l2cap_le_create_channel %p", channel);
2615 
2616     // store local_cid
2617     if (out_local_cid){
2618        *out_local_cid = channel->local_cid;
2619     }
2620 
2621     // provide buffer
2622     channel->con_handle = con_handle;
2623     channel->receive_sdu_buffer = receive_sdu_buffer;
2624     channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
2625     channel->new_credits_incoming = initial_credits;
2626     channel->automatic_credits    = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
2627 
2628     // add to connections list
2629     btstack_linked_list_add(&l2cap_le_channels, (btstack_linked_item_t *) channel);
2630 
2631     // go
2632     l2cap_run();
2633     return 0;
2634 }
2635 
2636 /**
2637  * @brief Provide credtis for LE Data Channel
2638  * @param local_cid             L2CAP LE Data Channel Identifier
2639  * @param credits               Number additional credits for peer
2640  */
2641 uint8_t l2cap_le_provide_credits(uint16_t local_cid, uint16_t credits){
2642 
2643     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2644     if (!channel) {
2645         log_error("l2cap_le_provide_credits no channel for cid 0x%02x", local_cid);
2646         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2647     }
2648 
2649     // check state
2650     if (channel->state != L2CAP_STATE_OPEN){
2651         log_error("l2cap_le_provide_credits but channel 0x%02x not open yet", local_cid);
2652     }
2653 
2654     // assert incoming credits + credits <= 0xffff
2655     uint32_t total_credits = channel->credits_incoming;
2656     total_credits += channel->new_credits_incoming;
2657     total_credits += credits;
2658     if (total_credits > 0xffff){
2659         log_error("l2cap_le_provide_credits overrun: current %u, scheduled %u, additional %u", channel->credits_incoming,
2660             channel->new_credits_incoming, credits);
2661     }
2662 
2663     // set credits_granted
2664     channel->new_credits_incoming += credits;
2665 
2666     // go
2667     l2cap_run();
2668     return 0;
2669 }
2670 
2671 /**
2672  * @brief Check if outgoing buffer is available and that there's space on the Bluetooth module
2673  * @param local_cid             L2CAP LE Data Channel Identifier
2674  */
2675 int l2cap_le_can_send_now(uint16_t local_cid){
2676     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2677     if (!channel) {
2678         log_error("l2cap_le_provide_credits no channel for cid 0x%02x", local_cid);
2679         return 0;
2680     }
2681 
2682     // check state
2683     if (channel->state != L2CAP_STATE_OPEN) return 0;
2684 
2685     // check queue
2686     if (channel->send_sdu_buffer) return 0;
2687 
2688     // fine, go ahead
2689     return 1;
2690 }
2691 
2692 /**
2693  * @brief Request emission of L2CAP_EVENT_CAN_SEND_NOW as soon as possible
2694  * @note L2CAP_EVENT_CAN_SEND_NOW might be emitted during call to this function
2695  *       so packet handler should be ready to handle it
2696  * @param local_cid             L2CAP LE Data Channel Identifier
2697  */
2698 uint8_t l2cap_le_request_can_send_now_event(uint16_t local_cid){
2699     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2700     if (!channel) {
2701         log_error("l2cap_le_request_can_send_now_event no channel for cid 0x%02x", local_cid);
2702         return 0;
2703     }
2704     channel->waiting_for_can_send_now = 1;
2705     l2cap_le_notify_channel_can_send(channel);
2706     return 0;
2707 }
2708 
2709 /**
2710  * @brief Send data via LE Data Channel
2711  * @note Since data larger then the maximum PDU needs to be segmented into multiple PDUs, data needs to stay valid until ... event
2712  * @param local_cid             L2CAP LE Data Channel Identifier
2713  * @param data                  data to send
2714  * @param size                  data size
2715  */
2716 uint8_t l2cap_le_send_data(uint16_t local_cid, uint8_t * data, uint16_t len){
2717 
2718     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2719     if (!channel) {
2720         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
2721         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2722     }
2723 
2724     if (len > channel->remote_mtu){
2725         log_error("l2cap_send cid 0x%02x, data length exceeds remote MTU.", local_cid);
2726         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
2727     }
2728 
2729     if (channel->send_sdu_buffer){
2730         log_info("l2cap_send cid 0x%02x, cannot send", local_cid);
2731         return BTSTACK_ACL_BUFFERS_FULL;
2732     }
2733 
2734     channel->send_sdu_buffer = data;
2735     channel->send_sdu_len    = len;
2736     channel->send_sdu_pos    = 0;
2737 
2738     l2cap_run();
2739     return 0;
2740 }
2741 
2742 /**
2743  * @brief Disconnect from LE Data Channel
2744  * @param local_cid             L2CAP LE Data Channel Identifier
2745  */
2746 uint8_t l2cap_le_disconnect(uint16_t local_cid)
2747 {
2748     l2cap_channel_t * channel = l2cap_le_get_channel_for_local_cid(local_cid);
2749     if (!channel) {
2750         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
2751         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2752     }
2753 
2754     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
2755     l2cap_run();
2756     return 0;
2757 }
2758 
2759 #endif
2760