xref: /btstack/src/l2cap.c (revision 53c4f8d8066a4de590dc0f14664c100bc0cd6384)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "l2cap.c"
39 
40 /*
41  *  l2cap.c
42  *  Logical Link Control and Adaption Protocol (L2CAP)
43  */
44 
45 #include "l2cap.h"
46 #include "hci.h"
47 #include "hci_dump.h"
48 #include "bluetooth_sdp.h"
49 #include "bluetooth_psm.h"
50 #include "btstack_bool.h"
51 #include "btstack_debug.h"
52 #include "btstack_event.h"
53 #include "btstack_memory.h"
54 
55 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
56 // TODO avoid dependency on higher layer: used to trigger pairing for outgoing connections
57 #include "ble/sm.h"
58 #endif
59 
60 #include <stdarg.h>
61 #include <string.h>
62 
63 /*
64  * @brief L2CAP Supervisory function in S-Frames
65  */
66 typedef enum {
67     L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY = 0,
68     L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT,
69     L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY,
70     L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT
71 } l2cap_supervisory_function_t;
72 
73 /**
74  * @brief L2CAP Information Types used in Information Request & Response
75  */
76 typedef enum {
77   L2CAP_INFO_TYPE_CONNECTIONLESS_MTU = 1,
78   L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED,
79   L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED,
80 } l2cap_info_type_t;
81 
82 /**
83  * @brief L2CAP Configuration Option Types used in Configurateion Request & Response
84  */
85 typedef enum {
86   L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT = 1,
87   L2CAP_CONFIG_OPTION_TYPE_FLUSH_TIMEOUT,
88   L2CAP_CONFIG_OPTION_TYPE_QUALITY_OF_SERVICE,
89   L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL,
90   L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE,
91   L2CAP_CONFIG_OPTION_TYPE_EXTENDED_FLOW_SPECIFICATION,
92   L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE,
93 } l2cap_config_option_type_t;
94 
95 
96 #define L2CAP_SIG_ID_INVALID 0
97 
98 // size of HCI ACL + L2CAP Header for regular data packets (8)
99 #define COMPLETE_L2CAP_HEADER (HCI_ACL_HEADER_SIZE + L2CAP_HEADER_SIZE)
100 
101 // L2CAP Configuration Result Codes
102 #define L2CAP_CONF_RESULT_SUCCESS                  0x0000
103 #define L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS  0x0001
104 #define L2CAP_CONF_RESULT_REJECT                   0x0002
105 #define L2CAP_CONF_RESULT_UNKNOWN_OPTIONS          0x0003
106 #define L2CAP_CONF_RESULT_PENDING                  0x0004
107 #define L2CAP_CONF_RESULT_FLOW_SPEC_REJECTED       0x0005
108 
109 // L2CAP Reject Result Codes
110 #define L2CAP_REJ_CMD_UNKNOWN                      0x0000
111 
112 // Response Timeout eXpired
113 #define L2CAP_RTX_TIMEOUT_MS   10000
114 
115 // Extended Response Timeout eXpired
116 #define L2CAP_ERTX_TIMEOUT_MS 120000
117 
118 // nr of buffered acl packets in outgoing queue to get max performance
119 #define NR_BUFFERED_ACL_PACKETS 3
120 
121 // used to cache l2cap rejects, echo, and informational requests
122 #define NR_PENDING_SIGNALING_RESPONSES 3
123 
124 // nr of credits provided to remote if credits fall below watermark
125 #define L2CAP_CREDIT_BASED_FLOW_CONTROL_MODE_AUTOMATIC_CREDITS_WATERMARK 5
126 #define L2CAP_CREDIT_BASED_FLOW_CONTROL_MODE_AUTOMATIC_CREDITS_INCREMENT 5
127 
128 // offsets for L2CAP SIGNALING COMMANDS
129 #define L2CAP_SIGNALING_COMMAND_CODE_OFFSET   0
130 #define L2CAP_SIGNALING_COMMAND_SIGID_OFFSET  1
131 #define L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET 2
132 #define L2CAP_SIGNALING_COMMAND_DATA_OFFSET   4
133 
134 #if defined(ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE) && !defined(ENABLE_CLASSIC)
135 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE depends on ENABLE_CLASSIC."
136 #error "Please remove ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE or add ENABLE_CLASSIC in btstack_config.h"
137 #endif
138 
139 
140 #ifdef ENABLE_LE_DATA_CHANNELS
141 #warning "ENABLE_LE_DATA_CHANNELS has been deprecated."
142 #warning "Please use ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE instead in btstack_config.h"
143 #define ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
144 #endif
145 
146 #if defined(ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE) || defined(ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE)
147 #define L2CAP_USES_CREDIT_BASED_CHANNELS
148 #endif
149 
150 #if defined(L2CAP_USES_CREDIT_BASED_CHANNELS) || defined(ENABLE_CLASSIC)
151 #define L2CAP_USES_CHANNELS
152 #endif
153 
154 // prototypes
155 static void l2cap_run(void);
156 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
157 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size );
158 static void l2cap_notify_channel_can_send(void);
159 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel);
160 static uint8_t  l2cap_next_sig_id(void);
161 static l2cap_fixed_channel_t * l2cap_fixed_channel_for_channel_id(uint16_t local_cid);
162 #ifdef ENABLE_CLASSIC
163 static void l2cap_handle_security_level_incoming_sufficient(l2cap_channel_t * channel);
164 static int l2cap_security_level_0_allowed_for_PSM(uint16_t psm);
165 static void l2cap_handle_remote_supported_features_received(l2cap_channel_t * channel);
166 static void l2cap_handle_connection_complete(hci_con_handle_t con_handle, l2cap_channel_t * channel);
167 static void l2cap_handle_information_request_complete(hci_connection_t * connection);
168 static inline l2cap_service_t * l2cap_get_service(uint16_t psm);
169 static void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
170 static void l2cap_emit_channel_closed(l2cap_channel_t *channel);
171 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel);
172 static int  l2cap_channel_ready_for_open(l2cap_channel_t *channel);
173 static uint8_t l2cap_classic_send(l2cap_channel_t * channel, const uint8_t *data, uint16_t len);
174 #endif
175 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
176 static void l2cap_cbm_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
177 static void l2cap_cbm_emit_incoming_connection(l2cap_channel_t *channel);
178 static void l2cap_credit_based_notify_channel_can_send(l2cap_channel_t *channel);
179 static void l2cap_cbm_finialize_channel_close(l2cap_channel_t *channel);
180 static inline l2cap_service_t * l2cap_cbm_get_service(uint16_t le_psm);
181 #endif
182 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
183 static uint8_t l2cap_credit_based_send_data(l2cap_channel_t * channel, const uint8_t * data, uint16_t size);
184 static void l2cap_credit_based_send_pdu(l2cap_channel_t *channel);
185 static void l2cap_credit_based_send_credits(l2cap_channel_t *channel);
186 static bool l2cap_credit_based_handle_credit_indication(hci_con_handle_t handle, const uint8_t * command, uint16_t len);
187 static void l2cap_credit_based_handle_pdu(l2cap_channel_t * l2cap_channel, const uint8_t * packet, uint16_t size);
188 #endif
189 #ifdef L2CAP_USES_CHANNELS
190 static uint16_t l2cap_next_local_cid(void);
191 static l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid);
192 static void l2cap_emit_simple_event_with_cid(l2cap_channel_t * channel, uint8_t event_code);
193 static void l2cap_dispatch_to_channel(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size);
194 static l2cap_channel_t * l2cap_create_channel_entry(btstack_packet_handler_t packet_handler, l2cap_channel_type_t channel_type, bd_addr_t address, bd_addr_type_t address_type,
195         uint16_t psm, uint16_t local_mtu, gap_security_level_t security_level);
196 static void l2cap_finalize_channel_close(l2cap_channel_t *channel);
197 static void l2cap_free_channel_entry(l2cap_channel_t * channel);
198 #endif
199 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
200 static void l2cap_ertm_notify_channel_can_send(l2cap_channel_t * channel);
201 static void l2cap_ertm_monitor_timeout_callback(btstack_timer_source_t * ts);
202 static void l2cap_ertm_retransmission_timeout_callback(btstack_timer_source_t * ts);
203 #endif
204 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
205 static int l2cap_ecbm_signaling_handler_dispatch(hci_con_handle_t handle, uint16_t signaling_cid, uint8_t * command, uint8_t sig_id);
206 static void l2cap_run_trigger_callback(void * context);
207 #endif
208 
209 // l2cap_fixed_channel_t entries
210 #ifdef ENABLE_BLE
211 static l2cap_fixed_channel_t l2cap_fixed_channel_le_att;
212 static l2cap_fixed_channel_t l2cap_fixed_channel_le_sm;
213 #endif
214 #ifdef ENABLE_CLASSIC
215 static l2cap_fixed_channel_t l2cap_fixed_channel_classic_connectionless;
216 static l2cap_fixed_channel_t l2cap_fixed_channel_classic_sm;
217 #endif
218 
219 #ifdef ENABLE_CLASSIC
220 static btstack_linked_list_t l2cap_services;
221 static uint8_t l2cap_require_security_level2_for_outgoing_sdp;
222 static bd_addr_t l2cap_outgoing_classic_addr;
223 #endif
224 
225 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
226 static btstack_linked_list_t l2cap_le_services;
227 #endif
228 
229 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
230 static btstack_linked_list_t l2cap_enhanced_services;
231 static uint16_t l2cap_enhanced_mps_min;
232 static uint16_t l2cap_enhanced_mps_max;
233 static btstack_context_callback_registration_t l2cap_trigger_run_registration;
234 #endif
235 
236 // single list of channels for connection-oriented channels (basic, ertm, cbm, ecbf) Classic Connectionless, ATT, and SM
237 static btstack_linked_list_t l2cap_channels;
238 #ifdef L2CAP_USES_CHANNELS
239 // next channel id for new connections
240 static uint16_t  l2cap_local_source_cid;
241 #endif
242 // next signaling sequence number
243 static uint8_t   l2cap_sig_seq_nr;
244 
245 // used to cache l2cap rejects, echo, and informational requests
246 static l2cap_signaling_response_t l2cap_signaling_responses[NR_PENDING_SIGNALING_RESPONSES];
247 static int l2cap_signaling_responses_pending;
248 static btstack_packet_callback_registration_t l2cap_hci_event_callback_registration;
249 
250 static bool l2cap_call_notify_channel_in_run;
251 
252 #ifdef ENABLE_BLE
253 // only used for connection parameter update events
254 static uint16_t l2cap_le_custom_max_mtu;
255 #endif
256 
257 /* callbacks for events */
258 static btstack_linked_list_t l2cap_event_handlers;
259 
260 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
261 
262 // enable for testing
263 // #define L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL 16
264 
265 /*
266  * CRC lookup table for generator polynom D^16 + D^15 + D^2 + 1
267  */
268 static const uint16_t crc16_table[256] = {
269     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241, 0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
270     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40, 0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
271     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40, 0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
272     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641, 0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
273     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240, 0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
274     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41, 0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
275     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41, 0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
276     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640, 0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
277     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240, 0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
278     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41, 0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
279     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41, 0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
280     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640, 0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
281     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241, 0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
282     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40, 0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
283     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40, 0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
284     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641, 0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
285 };
286 
287 static uint16_t crc16_calc(uint8_t * data, uint16_t len){
288     uint16_t crc = 0;   // initial value = 0
289     while (len--){
290         crc = (crc >> 8) ^ crc16_table[ (crc ^ ((uint16_t) *data++)) & 0x00FF ];
291     }
292     return crc;
293 }
294 
295 static inline uint16_t l2cap_encanced_control_field_for_information_frame(uint8_t tx_seq, int final, uint8_t req_seq, l2cap_segmentation_and_reassembly_t sar){
296     return (((uint16_t) sar) << 14) | (req_seq << 8) | (final << 7) | (tx_seq << 1) | 0;
297 }
298 
299 static inline uint16_t l2cap_encanced_control_field_for_supevisor_frame(l2cap_supervisory_function_t supervisory_function, int poll, int final, uint8_t req_seq){
300     return (req_seq << 8) | (final << 7) | (poll << 4) | (((int) supervisory_function) << 2) | 1;
301 }
302 
303 static int l2cap_next_ertm_seq_nr(int seq_nr){
304     return (seq_nr + 1) & 0x3f;
305 }
306 
307 static bool l2cap_ertm_can_store_packet_now(l2cap_channel_t * channel){
308     // get num free tx buffers
309     int num_free_tx_buffers = channel->num_tx_buffers - channel->num_stored_tx_frames;
310     // calculate num tx buffers for remote MTU
311     int num_tx_buffers_for_max_remote_mtu;
312     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
313     if (channel->remote_mtu <= effective_mps){
314         // MTU fits into single packet
315         num_tx_buffers_for_max_remote_mtu = 1;
316     } else {
317         // include SDU Length
318         num_tx_buffers_for_max_remote_mtu = (channel->remote_mtu + 2 + (effective_mps - 1)) / effective_mps;
319     }
320     log_debug("num_free_tx_buffers %u, num_tx_buffers_for_max_remote_mtu %u", num_free_tx_buffers, num_tx_buffers_for_max_remote_mtu);
321     return num_tx_buffers_for_max_remote_mtu <= num_free_tx_buffers;
322 }
323 
324 static void l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel_t * l2cap_channel){
325     log_info("Retransmit unacknowleged frames");
326     l2cap_channel->unacked_frames = 0;;
327     l2cap_channel->tx_send_index  = l2cap_channel->tx_read_index;
328 }
329 
330 static void l2cap_ertm_next_tx_write_index(l2cap_channel_t * channel){
331     channel->tx_write_index++;
332     if (channel->tx_write_index < channel->num_tx_buffers) return;
333     channel->tx_write_index = 0;
334 }
335 
336 static void l2cap_ertm_start_monitor_timer(l2cap_channel_t * channel){
337     log_info("Start Monitor timer");
338     btstack_run_loop_remove_timer(&channel->monitor_timer);
339     btstack_run_loop_set_timer_handler(&channel->monitor_timer, &l2cap_ertm_monitor_timeout_callback);
340     btstack_run_loop_set_timer_context(&channel->monitor_timer, channel);
341     btstack_run_loop_set_timer(&channel->monitor_timer, channel->local_monitor_timeout_ms);
342     btstack_run_loop_add_timer(&channel->monitor_timer);
343 }
344 
345 static void l2cap_ertm_stop_monitor_timer(l2cap_channel_t * channel){
346     log_info("Stop Monitor timer");
347     btstack_run_loop_remove_timer(&channel->monitor_timer);
348 }
349 
350 static void l2cap_ertm_start_retransmission_timer(l2cap_channel_t * channel){
351     log_info("Start Retransmission timer");
352     btstack_run_loop_remove_timer(&channel->retransmission_timer);
353     btstack_run_loop_set_timer_handler(&channel->retransmission_timer, &l2cap_ertm_retransmission_timeout_callback);
354     btstack_run_loop_set_timer_context(&channel->retransmission_timer, channel);
355     btstack_run_loop_set_timer(&channel->retransmission_timer, channel->local_retransmission_timeout_ms);
356     btstack_run_loop_add_timer(&channel->retransmission_timer);
357 }
358 
359 static void l2cap_ertm_stop_retransmission_timer(l2cap_channel_t * l2cap_channel){
360     log_info("Stop Retransmission timer");
361     btstack_run_loop_remove_timer(&l2cap_channel->retransmission_timer);
362 }
363 
364 static void l2cap_ertm_monitor_timeout_callback(btstack_timer_source_t * ts){
365     log_info("Monitor timeout");
366     l2cap_channel_t * l2cap_channel = (l2cap_channel_t *) btstack_run_loop_get_timer_context(ts);
367 
368     // TODO: we assume that it's the oldest packet
369     l2cap_ertm_tx_packet_state_t * tx_state;
370     tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
371 
372     // check retry count
373     if (tx_state->retry_count < l2cap_channel->remote_max_transmit){
374         // increment retry count
375         tx_state->retry_count++;
376 
377         // start retransmit
378         l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
379 
380         // start monitor timer
381         l2cap_ertm_start_monitor_timer(l2cap_channel);
382 
383         // send RR/P=1
384         l2cap_channel->send_supervisor_frame_receiver_ready_poll = 1;
385     } else {
386         log_info("Monitor timer expired & retry count >= max transmit -> disconnect");
387         l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
388     }
389     l2cap_run();
390 }
391 
392 static void l2cap_ertm_retransmission_timeout_callback(btstack_timer_source_t * ts){
393     log_info("Retransmission timeout");
394     l2cap_channel_t * l2cap_channel = (l2cap_channel_t *) btstack_run_loop_get_timer_context(ts);
395 
396     // TODO: we assume that it's the oldest packet
397     l2cap_ertm_tx_packet_state_t * tx_state;
398     tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
399 
400     // set retry count = 1
401     tx_state->retry_count = 1;
402 
403     // start retransmit
404     l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
405 
406     // start monitor timer
407     l2cap_ertm_start_monitor_timer(l2cap_channel);
408 
409     // send RR/P=1
410     l2cap_channel->send_supervisor_frame_receiver_ready_poll = 1;
411     l2cap_run();
412 }
413 
414 static int l2cap_ertm_send_information_frame(l2cap_channel_t * channel, int index, int final){
415     l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[index];
416     hci_reserve_packet_buffer();
417     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
418     uint16_t control = l2cap_encanced_control_field_for_information_frame(tx_state->tx_seq, final, channel->req_seq, tx_state->sar);
419     log_info("I-Frame: control 0x%04x", control);
420     little_endian_store_16(acl_buffer, 8, control);
421     (void)memcpy(&acl_buffer[8 + 2],
422                  &channel->tx_packets_data[index * channel->local_mps],
423                  tx_state->len);
424     // (re-)start retransmission timer on
425     l2cap_ertm_start_retransmission_timer(channel);
426     // send
427     return l2cap_send_prepared(channel->local_cid, 2 + tx_state->len);
428 }
429 
430 static void l2cap_ertm_store_fragment(l2cap_channel_t * channel, l2cap_segmentation_and_reassembly_t sar, uint16_t sdu_length, const uint8_t * data, uint16_t len){
431     // get next index for storing packets
432     int index = channel->tx_write_index;
433 
434     l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[index];
435     tx_state->tx_seq = channel->next_tx_seq;
436     tx_state->sar = sar;
437     tx_state->retry_count = 0;
438 
439     uint8_t * tx_packet = &channel->tx_packets_data[index * channel->local_mps];
440     log_debug("index %u, local mps %u, remote mps %u, packet tx %p, len %u", index, channel->local_mps, channel->remote_mps, tx_packet, len);
441     int pos = 0;
442     if (sar == L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU){
443         little_endian_store_16(tx_packet, 0, sdu_length);
444         pos += 2;
445     }
446     (void)memcpy(&tx_packet[pos], data, len);
447     tx_state->len = pos + len;
448 
449     // update
450     channel->num_stored_tx_frames++;
451     channel->next_tx_seq = l2cap_next_ertm_seq_nr(channel->next_tx_seq);
452     l2cap_ertm_next_tx_write_index(channel);
453 
454     log_info("l2cap_ertm_store_fragment: tx_read_index %u, tx_write_index %u, num stored %u", channel->tx_read_index, channel->tx_write_index, channel->num_stored_tx_frames);
455 
456 }
457 
458 static uint8_t l2cap_ertm_send(l2cap_channel_t * channel, const uint8_t * data, uint16_t len){
459     if (len > channel->remote_mtu){
460         log_error("l2cap_ertm_send cid 0x%02x, data length exceeds remote MTU.", channel->local_cid);
461         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
462     }
463 
464     if (!l2cap_ertm_can_store_packet_now(channel)){
465         log_error("l2cap_ertm_send cid 0x%02x, fragment store full", channel->local_cid);
466         return BTSTACK_ACL_BUFFERS_FULL;
467     }
468 
469     // check if it needs to get fragmented
470     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
471     if (len > effective_mps){
472         // fragmentation needed.
473         l2cap_segmentation_and_reassembly_t sar =  L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU;
474         uint16_t chunk_len = 0;
475         while (len){
476             switch (sar){
477                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
478                     chunk_len = effective_mps - 2;    // sdu_length
479                     l2cap_ertm_store_fragment(channel, sar, len, data, chunk_len);
480                     sar = L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU;
481                     break;
482                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
483                     chunk_len = effective_mps;
484                     if (chunk_len >= len){
485                         sar = L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU;
486                         chunk_len = len;
487                     }
488                     l2cap_ertm_store_fragment(channel, sar, len, data, chunk_len);
489                     break;
490                 default:
491                     btstack_unreachable();
492                     break;
493             }
494             len  -= chunk_len;
495             data += chunk_len;
496         }
497 
498     } else {
499         l2cap_ertm_store_fragment(channel, L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU, 0, data, len);
500     }
501 
502     // try to send
503     l2cap_notify_channel_can_send();
504     return ERROR_CODE_SUCCESS;
505 }
506 
507 static uint16_t l2cap_setup_options_ertm_request(l2cap_channel_t * channel, uint8_t * config_options){
508     int pos = 0;
509     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL;
510     config_options[pos++] = 9;      // length
511     config_options[pos++] = (uint8_t) channel->mode;
512     config_options[pos++] = channel->num_rx_buffers;    // == TxWindows size
513     config_options[pos++] = channel->local_max_transmit;
514     little_endian_store_16( config_options, pos, channel->local_retransmission_timeout_ms);
515     pos += 2;
516     little_endian_store_16( config_options, pos, channel->local_monitor_timeout_ms);
517     pos += 2;
518     little_endian_store_16( config_options, pos, channel->local_mps);
519     pos += 2;
520     //
521     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT;
522     config_options[pos++] = 2;     // length
523     little_endian_store_16(config_options, pos, channel->local_mtu);
524     pos += 2;
525 
526     // Issue: iOS (e.g. 10.2) uses "No FCS" as default while Core 5.0 specifies "FCS" as default
527     // Workaround: try to actively negotiate FCS option
528     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE;
529     config_options[pos++] = 1;     // length
530     config_options[pos++] = channel->fcs_option;
531     return pos; // 11+4+3=18
532 }
533 
534 static uint16_t l2cap_setup_options_ertm_response(l2cap_channel_t * channel, uint8_t * config_options){
535     int pos = 0;
536     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL;
537     config_options[pos++] = 9;      // length
538     config_options[pos++] = (uint8_t) channel->mode;
539     // less or equal to remote tx window size
540     config_options[pos++] = btstack_min(channel->num_tx_buffers, channel->remote_tx_window_size);
541     // max transmit in response shall be ignored -> use sender values
542     config_options[pos++] = channel->remote_max_transmit;
543     // A value for the Retransmission time-out shall be sent in a positive Configuration Response
544     // and indicates the value that will be used by the sender of the Configuration Response -> use our value
545     little_endian_store_16( config_options, pos, channel->local_retransmission_timeout_ms);
546     pos += 2;
547     // A value for the Monitor time-out shall be sent in a positive Configuration Response
548     // and indicates the value that will be used by the sender of the Configuration Response -> use our value
549     little_endian_store_16( config_options, pos, channel->local_monitor_timeout_ms);
550     pos += 2;
551     // less or equal to remote mps
552     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
553     little_endian_store_16( config_options, pos, effective_mps);
554     pos += 2;
555     //
556     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT; // MTU
557     config_options[pos++] = 2;     // length
558     little_endian_store_16(config_options, pos, channel->remote_mtu);
559     pos += 2;
560 #if 0
561     //
562     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE;
563     config_options[pos++] = 1;     // length
564     config_options[pos++] = channel->fcs_option;
565 #endif
566     return pos; // 11+4=15
567 }
568 
569 static int l2cap_ertm_send_supervisor_frame(l2cap_channel_t * channel, uint16_t control){
570     hci_reserve_packet_buffer();
571     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
572     log_info("S-Frame: control 0x%04x", control);
573     little_endian_store_16(acl_buffer, 8, control);
574     return l2cap_send_prepared(channel->local_cid, 2);
575 }
576 
577 static uint8_t l2cap_ertm_validate_local_config(l2cap_ertm_config_t * ertm_config){
578 
579     uint8_t result = ERROR_CODE_SUCCESS;
580     if (ertm_config->max_transmit < 1){
581         log_error("max_transmit must be >= 1");
582         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
583     }
584     if (ertm_config->retransmission_timeout_ms < 2000){
585         log_error("retransmission_timeout_ms must be >= 2000 ms");
586         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
587     }
588     if (ertm_config->monitor_timeout_ms < 12000){
589         log_error("monitor_timeout_ms must be >= 12000 ms");
590         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
591     }
592     if (ertm_config->local_mtu < 48){
593         log_error("local_mtu must be >= 48");
594         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
595     }
596     if (ertm_config->num_rx_buffers < 1){
597         log_error("num_rx_buffers must be >= 1");
598         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
599     }
600     if (ertm_config->num_tx_buffers < 1){
601         log_error("num_rx_buffers must be >= 1");
602         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
603     }
604     return result;
605 }
606 
607 static void l2cap_ertm_setup_buffers(l2cap_channel_t * channel, uint8_t * buffer, uint32_t size){
608     btstack_assert( (((uintptr_t) buffer) & 0x0f) == 0);
609 
610     // setup state buffers - use void cast to avoid -Wcast-align warning
611     uint32_t pos = 0;
612     channel->rx_packets_state = (l2cap_ertm_rx_packet_state_t *) (void *) &buffer[pos];
613     pos += channel->num_rx_buffers * sizeof(l2cap_ertm_rx_packet_state_t);
614     channel->tx_packets_state = (l2cap_ertm_tx_packet_state_t *) (void *) &buffer[pos];
615     pos += channel->num_tx_buffers * sizeof(l2cap_ertm_tx_packet_state_t);
616 
617     // setup reassembly buffer
618     channel->reassembly_buffer = &buffer[pos];
619     pos += channel->local_mtu;
620 
621     // setup rx buffers
622     channel->rx_packets_data = &buffer[pos];
623     pos += channel->num_rx_buffers * channel->local_mps;
624 
625     // setup tx buffers
626     channel->tx_packets_data = &buffer[pos];
627     pos += channel->num_rx_buffers * channel->remote_mps;
628 
629     btstack_assert(pos <= size);
630     UNUSED(pos);
631 }
632 
633 static void l2cap_ertm_configure_channel(l2cap_channel_t * channel, l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size){
634 
635     channel->mode  = L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION;
636     channel->ertm_mandatory = ertm_config->ertm_mandatory;
637     channel->local_max_transmit = ertm_config->max_transmit;
638     channel->local_retransmission_timeout_ms = ertm_config->retransmission_timeout_ms;
639     channel->local_monitor_timeout_ms = ertm_config->monitor_timeout_ms;
640     channel->local_mtu = ertm_config->local_mtu;
641     channel->num_rx_buffers = ertm_config->num_rx_buffers;
642     channel->num_tx_buffers = ertm_config->num_tx_buffers;
643     channel->fcs_option = ertm_config->fcs_option;
644 
645     // align buffer to 16-byte boundary to assert l2cap_ertm_rx_packet_state_t is aligned
646     int bytes_till_alignment = 16 - (((uintptr_t) buffer) & 0x0f);
647     buffer += bytes_till_alignment;
648     size   -= bytes_till_alignment;
649 
650     // calculate space for rx and tx buffers
651     uint32_t state_len = channel->num_rx_buffers * sizeof(l2cap_ertm_rx_packet_state_t) + channel->num_tx_buffers * sizeof(l2cap_ertm_tx_packet_state_t);
652     uint32_t buffer_space = size - state_len - channel->local_mtu;
653 
654     // divide rest of data equally for initial config
655     uint16_t mps = buffer_space / (ertm_config->num_rx_buffers + ertm_config->num_tx_buffers);
656     channel->local_mps  = mps;
657     channel->remote_mps = mps;
658     l2cap_ertm_setup_buffers(channel, buffer, size);
659 
660     log_info("Local MPS: %u", channel->local_mps);
661 }
662 
663 uint8_t l2cap_ertm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t address, uint16_t psm,
664     l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size, uint16_t * out_local_cid){
665 
666     log_info("l2cap_ertm_create_channel addr %s, psm 0x%x, local mtu %u", bd_addr_to_str(address), psm, ertm_config->local_mtu);
667 
668     // validate local config
669     uint8_t result = l2cap_ertm_validate_local_config(ertm_config);
670     if (result) return result;
671 
672     // determine security level based on psm
673     const gap_security_level_t security_level = l2cap_security_level_0_allowed_for_PSM(psm) ? LEVEL_0 : gap_get_security_level();
674 
675     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, address, BD_ADDR_TYPE_ACL, psm, ertm_config->local_mtu, security_level);
676     if (!channel) {
677         return BTSTACK_MEMORY_ALLOC_FAILED;
678     }
679 
680     // configure ERTM
681     l2cap_ertm_configure_channel(channel, ertm_config, buffer, size);
682 
683     // add to connections list
684     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
685 
686     // store local_cid
687     if (out_local_cid){
688        *out_local_cid = channel->local_cid;
689     }
690 
691     // check if hci connection is already usable
692     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_ACL);
693     if (conn){
694         log_info("l2cap_create_channel, hci connection already exists");
695         l2cap_handle_connection_complete(conn->con_handle, channel);
696         // check if remote supported fearures are already received
697         if (hci_remote_features_available(conn->con_handle)) {
698             l2cap_handle_remote_supported_features_received(channel);
699         } else {
700             hci_remote_features_query(conn->con_handle);
701         };
702     }
703 
704     l2cap_run();
705 
706     return 0;
707 }
708 
709 static void l2cap_ertm_notify_channel_can_send(l2cap_channel_t * channel){
710     if (l2cap_ertm_can_store_packet_now(channel)){
711         channel->waiting_for_can_send_now = 0;
712         l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
713     }
714 }
715 
716 uint8_t l2cap_ertm_accept_connection(uint16_t local_cid, l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size){
717 
718     log_info("l2cap_ertm_accept_connection local_cid 0x%x", local_cid);
719     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
720     if (!channel) {
721         log_error("l2cap_accept_connection called but local_cid 0x%x not found", local_cid);
722         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
723     }
724 
725     // validate local config
726     uint8_t result = l2cap_ertm_validate_local_config(ertm_config);
727     if (result) return result;
728 
729     // configure L2CAP ERTM
730     l2cap_ertm_configure_channel(channel, ertm_config, buffer, size);
731 
732     // we need to know if ERTM is supported before sending a config response
733     channel->state = L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES;
734     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
735     btstack_assert(connection != NULL);
736     switch (connection->l2cap_state.information_state){
737         case L2CAP_INFORMATION_STATE_IDLE:
738             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
739             break;
740         case L2CAP_INFORMATION_STATE_DONE:
741             l2cap_handle_information_request_complete(connection);
742             break;
743         default:
744             break;
745     }
746 
747     l2cap_run();
748 
749     return ERROR_CODE_SUCCESS;
750 }
751 
752 uint8_t l2cap_ertm_decline_connection(uint16_t local_cid){
753     l2cap_decline_connection(local_cid);
754     return ERROR_CODE_SUCCESS;
755 }
756 
757 uint8_t l2cap_ertm_set_busy(uint16_t local_cid){
758     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
759     if (!channel) {
760         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
761         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
762     }
763     if (!channel->local_busy){
764         channel->local_busy = 1;
765         channel->send_supervisor_frame_receiver_not_ready = 1;
766         l2cap_run();
767     }
768     return ERROR_CODE_SUCCESS;
769 }
770 
771 uint8_t l2cap_ertm_set_ready(uint16_t local_cid){
772     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
773     if (!channel) {
774         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
775         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
776     }
777     if (channel->local_busy){
778         channel->local_busy = 0;
779         channel->send_supervisor_frame_receiver_ready_poll = 1;
780         l2cap_run();
781     }
782     return ERROR_CODE_SUCCESS;
783 }
784 
785 // Process-ReqSeq
786 static void l2cap_ertm_process_req_seq(l2cap_channel_t * l2cap_channel, uint8_t req_seq){
787     int num_buffers_acked = 0;
788     l2cap_ertm_tx_packet_state_t * tx_state;
789     log_info("l2cap_ertm_process_req_seq: tx_read_index %u, tx_write_index %u, req_seq %u", l2cap_channel->tx_read_index, l2cap_channel->tx_write_index, req_seq);
790     while (true){
791 
792         // no unack packets left
793         if (l2cap_channel->unacked_frames == 0) {
794             // stop retransmission timer
795             l2cap_ertm_stop_retransmission_timer(l2cap_channel);
796             break;
797         }
798 
799         tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
800         // calc delta
801         int delta = (req_seq - tx_state->tx_seq) & 0x03f;
802         if (delta == 0) break;  // all packets acknowledged
803         if (delta > l2cap_channel->remote_tx_window_size) break;
804 
805         num_buffers_acked++;
806         l2cap_channel->num_stored_tx_frames--;
807         l2cap_channel->unacked_frames--;
808         log_info("RR seq %u => packet with tx_seq %u done", req_seq, tx_state->tx_seq);
809 
810         l2cap_channel->tx_read_index++;
811         if (l2cap_channel->tx_read_index >= l2cap_channel->num_rx_buffers){
812             l2cap_channel->tx_read_index = 0;
813         }
814     }
815     if (num_buffers_acked){
816         log_info("num_buffers_acked %u", num_buffers_acked);
817     l2cap_ertm_notify_channel_can_send(l2cap_channel);
818 }
819 }
820 
821 static l2cap_ertm_tx_packet_state_t * l2cap_ertm_get_tx_state(l2cap_channel_t * l2cap_channel, uint8_t tx_seq){
822     int i;
823     for (i=0;i<l2cap_channel->num_tx_buffers;i++){
824         l2cap_ertm_tx_packet_state_t * tx_state = &l2cap_channel->tx_packets_state[i];
825         if (tx_state->tx_seq == tx_seq) return tx_state;
826     }
827     return NULL;
828 }
829 
830 // @param delta number of frames in the future, >= 1
831 // @assumption size <= l2cap_channel->local_mps (checked in l2cap_acl_classic_handler)
832 static void l2cap_ertm_handle_out_of_sequence_sdu(l2cap_channel_t * l2cap_channel, l2cap_segmentation_and_reassembly_t sar, int delta, const uint8_t * payload, uint16_t size){
833     log_info("Store SDU with delta %u", delta);
834     // get rx state for packet to store
835     int index = l2cap_channel->rx_store_index + delta - 1;
836     if (index > l2cap_channel->num_rx_buffers){
837         index -= l2cap_channel->num_rx_buffers;
838     }
839     log_info("Index of packet to store %u", index);
840     l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
841     // check if buffer is free
842     if (rx_state->valid){
843         log_error("Packet buffer already used");
844         return;
845     }
846     rx_state->valid = 1;
847     rx_state->sar = sar;
848     rx_state->len = size;
849     uint8_t * rx_buffer = &l2cap_channel->rx_packets_data[index];
850     (void)memcpy(rx_buffer, payload, size);
851 }
852 
853 // @assumption size <= l2cap_channel->local_mps (checked in l2cap_acl_classic_handler)
854 static void l2cap_ertm_handle_in_sequence_sdu(l2cap_channel_t * l2cap_channel, l2cap_segmentation_and_reassembly_t sar, const uint8_t * payload, uint16_t size){
855     uint16_t reassembly_sdu_length;
856     switch (sar){
857         case L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU:
858             // assert total packet size <= our mtu
859             if (size > l2cap_channel->local_mtu) break;
860             // packet complete -> disapatch
861             l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, (uint8_t*) payload, size);
862             break;
863         case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
864             // read SDU len
865             reassembly_sdu_length = little_endian_read_16(payload, 0);
866             payload += 2;
867             size    -= 2;
868             // assert reassembled size <= our mtu
869             if (reassembly_sdu_length > l2cap_channel->local_mtu) break;
870             // store start segment
871             l2cap_channel->reassembly_sdu_length = reassembly_sdu_length;
872             (void)memcpy(&l2cap_channel->reassembly_buffer[0], payload, size);
873             l2cap_channel->reassembly_pos = size;
874             break;
875         case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
876             // assert size of reassembled data <= our mtu
877             if (l2cap_channel->reassembly_pos + size > l2cap_channel->local_mtu) break;
878             // store continuation segment
879             (void)memcpy(&l2cap_channel->reassembly_buffer[l2cap_channel->reassembly_pos],
880                          payload, size);
881             l2cap_channel->reassembly_pos += size;
882             break;
883         case L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU:
884             // assert size of reassembled data <= our mtu
885             if (l2cap_channel->reassembly_pos + size > l2cap_channel->local_mtu) break;
886             // store continuation segment
887             (void)memcpy(&l2cap_channel->reassembly_buffer[l2cap_channel->reassembly_pos],
888                          payload, size);
889             l2cap_channel->reassembly_pos += size;
890             // assert size of reassembled data matches announced sdu length
891             if (l2cap_channel->reassembly_pos != l2cap_channel->reassembly_sdu_length) break;
892             // packet complete -> disapatch
893             l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->reassembly_buffer, l2cap_channel->reassembly_pos);
894             l2cap_channel->reassembly_pos = 0;
895             break;
896         default:
897             btstack_assert(false);
898             break;
899     }
900 }
901 
902 static void l2cap_ertm_channel_send_information_frame(l2cap_channel_t * channel){
903     channel->unacked_frames++;
904     int index = channel->tx_send_index;
905     channel->tx_send_index++;
906     if (channel->tx_send_index >= channel->num_tx_buffers){
907         channel->tx_send_index = 0;
908     }
909     l2cap_ertm_send_information_frame(channel, index, 0);   // final = 0
910 }
911 
912 #endif
913 
914 #ifdef L2CAP_USES_CHANNELS
915 static uint16_t l2cap_next_local_cid(void){
916     do {
917         if (l2cap_local_source_cid == 0xfffeu) {
918             l2cap_local_source_cid = 0x40;
919         } else {
920             l2cap_local_source_cid++;
921         }
922     } while (l2cap_get_channel_for_local_cid(l2cap_local_source_cid) != NULL);
923     return l2cap_local_source_cid;
924 }
925 #endif
926 
927 static uint8_t l2cap_next_sig_id(void){
928     if (l2cap_sig_seq_nr == 0xffu) {
929         l2cap_sig_seq_nr = 1;
930     } else {
931         l2cap_sig_seq_nr++;
932     }
933     return l2cap_sig_seq_nr;
934 }
935 
936 void l2cap_init(void){
937 #ifdef L2CAP_USES_CHANNELS
938     l2cap_local_source_cid  = 0x40;
939 #endif
940     l2cap_sig_seq_nr  = 0xff;
941 
942 #ifdef ENABLE_CLASSIC
943     // Setup Connectionless Channel
944     l2cap_fixed_channel_classic_connectionless.local_cid     = L2CAP_CID_CONNECTIONLESS_CHANNEL;
945     l2cap_fixed_channel_classic_connectionless.channel_type  = L2CAP_CHANNEL_TYPE_CONNECTIONLESS;
946     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_classic_connectionless);
947 #endif
948 
949 #ifdef ENABLE_BLE
950     // Setup fixed ATT Channel
951     l2cap_fixed_channel_le_att.local_cid    = L2CAP_CID_ATTRIBUTE_PROTOCOL;
952     l2cap_fixed_channel_le_att.channel_type = L2CAP_CHANNEL_TYPE_FIXED_LE;
953     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_le_att);
954 
955     // Setup fixed SM Channel
956     l2cap_fixed_channel_le_sm.local_cid     = L2CAP_CID_SECURITY_MANAGER_PROTOCOL;
957     l2cap_fixed_channel_le_sm.channel_type  = L2CAP_CHANNEL_TYPE_FIXED_LE;
958     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_le_sm);
959 #endif
960 #ifdef ENABLE_CLASSIC
961     // Setup fixed SM Channel
962     l2cap_fixed_channel_classic_sm.local_cid     = L2CAP_CID_BR_EDR_SECURITY_MANAGER;
963     l2cap_fixed_channel_classic_sm.channel_type  = L2CAP_CHANNEL_TYPE_FIXED_CLASSIC;
964     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_classic_sm);
965 #endif
966 
967 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
968     l2cap_enhanced_mps_min = 0x0001;
969     l2cap_enhanced_mps_max = 0xffff;
970     l2cap_trigger_run_registration.callback = &l2cap_run_trigger_callback;
971 #endif
972 
973     //
974     // register callback with HCI
975     //
976     l2cap_hci_event_callback_registration.callback = &l2cap_hci_event_handler;
977     hci_add_event_handler(&l2cap_hci_event_callback_registration);
978 
979     hci_register_acl_packet_handler(&l2cap_acl_handler);
980 
981 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
982 #ifdef ENABLE_CLASSIC
983     gap_connectable_control(0); // no services yet
984 #endif
985 #endif
986 }
987 
988 /**
989  * @brief De-Init L2CAP
990  */
991 void l2cap_deinit(void){
992     l2cap_channels = NULL;
993     l2cap_signaling_responses_pending = 0;
994 #ifdef ENABLE_CLASSIC
995     l2cap_require_security_level2_for_outgoing_sdp = 0;
996     (void)memset(&l2cap_fixed_channel_classic_connectionless, 0, sizeof(l2cap_fixed_channel_classic_connectionless));
997     l2cap_services = NULL;
998     (void)memset(l2cap_outgoing_classic_addr, 0, 6);
999     (void)memset(&l2cap_fixed_channel_classic_sm, 0, sizeof(l2cap_fixed_channel_classic_sm));
1000 #endif
1001 #ifdef ENABLE_BLE
1002     l2cap_le_custom_max_mtu = 0;
1003     (void)memset(&l2cap_fixed_channel_le_att, 0, sizeof(l2cap_fixed_channel_le_att));
1004     (void)memset(&l2cap_fixed_channel_le_sm, 0, sizeof(l2cap_fixed_channel_le_sm));
1005 #endif
1006 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1007     l2cap_le_services = NULL;
1008 #endif
1009 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1010     l2cap_enhanced_services = NULL;
1011 #endif
1012     l2cap_event_handlers = NULL;
1013 }
1014 
1015 void l2cap_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
1016     btstack_linked_list_add_tail(&l2cap_event_handlers, (btstack_linked_item_t*) callback_handler);
1017 }
1018 
1019 void l2cap_remove_event_handler(btstack_packet_callback_registration_t * callback_handler){
1020     btstack_linked_list_remove(&l2cap_event_handlers, (btstack_linked_item_t*) callback_handler);
1021 }
1022 
1023 static void l2cap_emit_event(uint8_t *event, uint16_t size) {
1024     hci_dump_packet( HCI_EVENT_PACKET, 1, event, size);
1025     // dispatch to all event handlers
1026     btstack_linked_list_iterator_t it;
1027     btstack_linked_list_iterator_init(&it, &l2cap_event_handlers);
1028     while (btstack_linked_list_iterator_has_next(&it)){
1029         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
1030         entry->callback(HCI_EVENT_PACKET, 0, event, size);
1031     }
1032 }
1033 
1034 void l2cap_request_can_send_fix_channel_now_event(hci_con_handle_t con_handle, uint16_t channel_id){
1035     UNUSED(con_handle);  // ok: there is no con handle
1036 
1037     l2cap_fixed_channel_t * channel = l2cap_fixed_channel_for_channel_id(channel_id);
1038     if (!channel) return;
1039     channel->waiting_for_can_send_now = 1;
1040     l2cap_notify_channel_can_send();
1041 }
1042 
1043 bool l2cap_can_send_fixed_channel_packet_now(hci_con_handle_t con_handle, uint16_t channel_id){
1044     UNUSED(channel_id); // ok: only depends on Controller LE buffers
1045 
1046     return hci_can_send_acl_packet_now(con_handle);
1047 }
1048 
1049 uint8_t *l2cap_get_outgoing_buffer(void){
1050     return hci_get_outgoing_packet_buffer() + COMPLETE_L2CAP_HEADER; // 8 bytes
1051 }
1052 
1053 // only for L2CAP Basic Channels
1054 bool l2cap_reserve_packet_buffer(void){
1055     return hci_reserve_packet_buffer();
1056 }
1057 
1058 // only for L2CAP Basic Channels
1059 void l2cap_release_packet_buffer(void){
1060     hci_release_packet_buffer();
1061 }
1062 
1063 static void l2cap_setup_header(uint8_t * acl_buffer, hci_con_handle_t con_handle, uint8_t packet_boundary, uint16_t remote_cid, uint16_t len){
1064     // 0 - Connection handle : PB=pb : BC=00
1065     little_endian_store_16(acl_buffer, 0u, con_handle | (packet_boundary << 12u) | (0u << 14u));
1066     // 2 - ACL length
1067     little_endian_store_16(acl_buffer, 2u,  len + 4u);
1068     // 4 - L2CAP packet length
1069     little_endian_store_16(acl_buffer, 4u,  len + 0u);
1070     // 6 - L2CAP channel DEST
1071     little_endian_store_16(acl_buffer, 6,  remote_cid);
1072 }
1073 
1074 // assumption - only on LE connections
1075 uint8_t l2cap_send_prepared_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint16_t len){
1076 
1077     if (!hci_is_packet_buffer_reserved()){
1078         log_error("l2cap_send_prepared_connectionless called without reserving packet first");
1079         return BTSTACK_ACL_BUFFERS_FULL;
1080     }
1081 
1082     if (!hci_can_send_prepared_acl_packet_now(con_handle)){
1083         log_info("l2cap_send_prepared_connectionless handle 0x%02x, cid 0x%02x, cannot send", con_handle, cid);
1084         return BTSTACK_ACL_BUFFERS_FULL;
1085     }
1086 
1087     log_debug("l2cap_send_prepared_connectionless handle %u, cid 0x%02x", con_handle, cid);
1088 
1089     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1090     l2cap_setup_header(acl_buffer, con_handle, 0, cid, len);
1091     // send
1092     return hci_send_acl_packet_buffer(len+8u);
1093 }
1094 
1095 // assumption - only on LE connections
1096 uint8_t l2cap_send_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint8_t *data, uint16_t len){
1097 
1098     if (!hci_can_send_acl_packet_now(con_handle)){
1099         log_info("l2cap_send cid 0x%02x, cannot send", cid);
1100         return BTSTACK_ACL_BUFFERS_FULL;
1101     }
1102 
1103     hci_reserve_packet_buffer();
1104     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1105 
1106     (void)memcpy(&acl_buffer[8], data, len);
1107 
1108     return l2cap_send_prepared_connectionless(con_handle, cid, len);
1109 }
1110 
1111 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel) {
1112     log_debug("L2CAP_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel);
1113     uint8_t event[4];
1114     event[0] = L2CAP_EVENT_CAN_SEND_NOW;
1115     event[1] = sizeof(event) - 2u;
1116     little_endian_store_16(event, 2, channel);
1117     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
1118     packet_handler(HCI_EVENT_PACKET, channel, event, sizeof(event));
1119 }
1120 
1121 #ifdef L2CAP_USES_CHANNELS
1122 static void l2cap_dispatch_to_channel(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size){
1123     (* (channel->packet_handler))(type, channel->local_cid, data, size);
1124 }
1125 
1126 static void l2cap_emit_simple_event_with_cid(l2cap_channel_t * channel, uint8_t event_code){
1127     uint8_t event[4];
1128     event[0] = event_code;
1129     event[1] = sizeof(event) - 2u;
1130     little_endian_store_16(event, 2, channel->local_cid);
1131     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
1132     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1133 }
1134 #endif
1135 
1136 #ifdef ENABLE_CLASSIC
1137 void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
1138     log_info("L2CAP_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u, flush_timeout %u",
1139              status, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
1140              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu, channel->flush_timeout);
1141     uint8_t event[26];
1142     event[0] = L2CAP_EVENT_CHANNEL_OPENED;
1143     event[1] = sizeof(event) - 2;
1144     event[2] = status;
1145     reverse_bd_addr(channel->address, &event[3]);
1146     little_endian_store_16(event,  9, channel->con_handle);
1147     little_endian_store_16(event, 11, channel->psm);
1148     little_endian_store_16(event, 13, channel->local_cid);
1149     little_endian_store_16(event, 15, channel->remote_cid);
1150     little_endian_store_16(event, 17, channel->local_mtu);
1151     little_endian_store_16(event, 19, channel->remote_mtu);
1152     little_endian_store_16(event, 21, channel->flush_timeout);
1153     event[23] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
1154 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1155     log_info("ERTM mode %u, fcs enabled %u", channel->mode, channel->fcs_option);
1156     event[24] = channel->mode;
1157     event[25] = channel->fcs_option;
1158 
1159 #else
1160     event[24] = L2CAP_CHANNEL_MODE_BASIC;
1161     event[25] = 0;
1162 #endif
1163     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
1164     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1165 }
1166 
1167 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel) {
1168     log_info("L2CAP_EVENT_INCOMING_CONNECTION addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x",
1169              bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid);
1170     uint8_t event[16];
1171     event[0] = L2CAP_EVENT_INCOMING_CONNECTION;
1172     event[1] = sizeof(event) - 2;
1173     reverse_bd_addr(channel->address, &event[2]);
1174     little_endian_store_16(event,  8, channel->con_handle);
1175     little_endian_store_16(event, 10, channel->psm);
1176     little_endian_store_16(event, 12, channel->local_cid);
1177     little_endian_store_16(event, 14, channel->remote_cid);
1178     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
1179     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1180 }
1181 
1182 static void l2cap_handle_channel_open_failed(l2cap_channel_t * channel, uint8_t status){
1183 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1184     // emit ertm buffer released, as it's not needed. if in basic mode, it was either not allocated or already released
1185     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1186         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1187     }
1188 #endif
1189     l2cap_emit_channel_opened(channel, status);
1190 }
1191 
1192 #endif
1193 
1194 #ifdef L2CAP_USES_CHANNELS
1195 
1196 static void l2cap_emit_channel_closed(l2cap_channel_t *channel) {
1197     log_info("L2CAP_EVENT_CHANNEL_CLOSED local_cid 0x%x", channel->local_cid);
1198     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
1199 }
1200 
1201 static void l2cap_handle_channel_closed(l2cap_channel_t * channel){
1202 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1203     // emit ertm buffer released, as it's not needed anymore. if in basic mode, it was either not allocated or already released
1204     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1205         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1206     }
1207 #endif
1208     l2cap_emit_channel_closed(channel);
1209 }
1210 #endif
1211 
1212 static l2cap_fixed_channel_t * l2cap_channel_item_by_cid(uint16_t cid){
1213     btstack_linked_list_iterator_t it;
1214     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1215     while (btstack_linked_list_iterator_has_next(&it)){
1216         l2cap_fixed_channel_t * channel = (l2cap_fixed_channel_t*) btstack_linked_list_iterator_next(&it);
1217         if (channel->local_cid == cid) {
1218             return channel;
1219         }
1220     }
1221     return NULL;
1222 }
1223 
1224 // used for fixed channels in LE (ATT/SM) and Classic (Connectionless Channel). CID < 0x04
1225 static l2cap_fixed_channel_t * l2cap_fixed_channel_for_channel_id(uint16_t local_cid){
1226     if (local_cid >= 0x40u) return NULL;
1227     return (l2cap_fixed_channel_t*) l2cap_channel_item_by_cid(local_cid);
1228 }
1229 
1230 #ifdef L2CAP_USES_CHANNELS
1231 
1232 static int l2cap_is_dynamic_channel_type(l2cap_channel_type_t channel_type) {
1233     switch (channel_type) {
1234         case L2CAP_CHANNEL_TYPE_CLASSIC:
1235         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
1236         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
1237             return 1;
1238         default:
1239             return 0;
1240     }
1241 }
1242 
1243 static l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid){
1244     if (local_cid < 0x40u) return NULL;
1245     return (l2cap_channel_t*) l2cap_channel_item_by_cid(local_cid);
1246 }
1247 
1248 static l2cap_channel_t * l2cap_get_channel_for_local_cid_and_handle(uint16_t local_cid, hci_con_handle_t con_handle){
1249     if (local_cid < 0x40u) return NULL;
1250     l2cap_channel_t * l2cap_channel = (l2cap_channel_t*) l2cap_channel_item_by_cid(local_cid);
1251     if (l2cap_channel == NULL)  return NULL;
1252     if (l2cap_channel->con_handle != con_handle) return NULL;
1253     return l2cap_channel;
1254 }
1255 #endif
1256 
1257 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
1258 static l2cap_channel_t * l2cap_get_channel_for_remote_handle_and_cid(hci_con_handle_t con_handle, uint16_t remote_cid){
1259     btstack_linked_list_iterator_t it;
1260     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1261     while (btstack_linked_list_iterator_has_next(&it)){
1262         l2cap_fixed_channel_t * channel = (l2cap_fixed_channel_t*) btstack_linked_list_iterator_next(&it);
1263         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
1264         l2cap_channel_t * dynamic_channel = (l2cap_channel_t *) channel;
1265         if (dynamic_channel->con_handle != con_handle) continue;
1266         if (dynamic_channel->remote_cid != remote_cid) continue;
1267         return dynamic_channel;
1268     }
1269     return NULL;
1270 }
1271 #endif
1272 
1273 #ifdef L2CAP_USES_CHANNELS
1274 uint8_t l2cap_request_can_send_now_event(uint16_t local_cid){
1275     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1276     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
1277     channel->waiting_for_can_send_now = 1;
1278     switch (channel->channel_type){
1279         case L2CAP_CHANNEL_TYPE_CLASSIC:
1280 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1281             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1282                 l2cap_ertm_notify_channel_can_send(channel);
1283                 return ERROR_CODE_SUCCESS;
1284             }
1285 #endif
1286             l2cap_notify_channel_can_send();
1287             break;
1288 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1289         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
1290             l2cap_credit_based_notify_channel_can_send(channel);
1291             break;
1292 #endif
1293 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1294         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
1295             l2cap_credit_based_notify_channel_can_send(channel);
1296             break;
1297 #endif
1298         default:
1299             break;
1300     }
1301     return ERROR_CODE_SUCCESS;
1302 }
1303 
1304 bool l2cap_can_send_packet_now(uint16_t local_cid){
1305     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1306     if (!channel) return false;
1307     if (channel->state != L2CAP_STATE_OPEN) return false;
1308     switch (channel->channel_type){
1309         case L2CAP_CHANNEL_TYPE_CLASSIC:
1310 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1311             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1312                 return l2cap_ertm_can_store_packet_now(channel);
1313             }
1314 #endif
1315             return hci_can_send_acl_packet_now(channel->con_handle);
1316 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1317         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
1318             return channel->send_sdu_buffer == NULL;
1319 #endif
1320 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1321         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
1322             return channel->send_sdu_buffer == NULL;
1323 #endif
1324         default:
1325             return false;
1326     }
1327 }
1328 
1329 uint8_t l2cap_send(uint16_t local_cid, const uint8_t *data, uint16_t len){
1330     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1331     if (!channel) {
1332         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
1333         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
1334     }
1335     switch (channel->channel_type){
1336 #ifdef ENABLE_CLASSIC
1337         case L2CAP_CHANNEL_TYPE_CLASSIC:
1338             return l2cap_classic_send(channel, data, len);
1339 #endif
1340 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1341         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
1342             return l2cap_credit_based_send_data(channel, data, len);
1343 #endif
1344 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1345         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
1346             return l2cap_credit_based_send_data(channel, data, len);
1347 #endif
1348         default:
1349             return ERROR_CODE_UNSPECIFIED_ERROR;
1350     }
1351 }
1352 #endif
1353 
1354 #ifdef ENABLE_CLASSIC
1355 bool l2cap_can_send_prepared_packet_now(uint16_t local_cid){
1356     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1357     if (!channel) return false;
1358 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1359     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1360         return false;
1361     }
1362 #endif
1363     return hci_can_send_prepared_acl_packet_now(channel->con_handle);
1364 }
1365 
1366 uint16_t l2cap_get_remote_mtu_for_local_cid(uint16_t local_cid){
1367     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1368     if (channel) {
1369         return channel->remote_mtu;
1370     }
1371     return 0;
1372 }
1373 #endif
1374 
1375 #ifdef ENABLE_CLASSIC
1376 // RTX Timer only exist for dynamic channels
1377 static l2cap_channel_t * l2cap_channel_for_rtx_timer(btstack_timer_source_t * ts){
1378     btstack_linked_list_iterator_t it;
1379     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1380     while (btstack_linked_list_iterator_has_next(&it)){
1381         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1382         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
1383         if (&channel->rtx == ts) {
1384             return channel;
1385         }
1386     }
1387     return NULL;
1388 }
1389 
1390 static void l2cap_rtx_timeout(btstack_timer_source_t * ts){
1391     l2cap_channel_t * channel = l2cap_channel_for_rtx_timer(ts);
1392     if (!channel) return;
1393 
1394     log_info("l2cap_rtx_timeout for local cid 0x%02x", channel->local_cid);
1395 
1396     // "When terminating the channel, it is not necessary to send a L2CAP_DisconnectReq
1397     //  and enter WAIT_DISCONNECT state. Channels can be transitioned directly to the CLOSED state."
1398     // notify client
1399     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_RTX_TIMEOUT);
1400 
1401     // discard channel
1402     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1403     l2cap_free_channel_entry(channel);
1404 }
1405 
1406 static uint8_t l2cap_classic_packet_boundary_flag(void){
1407     return (hci_non_flushable_packet_boundary_flag_supported() && (hci_automatic_flush_timeout() == 0)) ? 0x00 : 0x02;
1408 }
1409 #endif
1410 
1411 #ifdef L2CAP_USES_CHANNELS
1412 static void l2cap_stop_rtx(l2cap_channel_t * channel){
1413     log_info("l2cap_stop_rtx for local cid 0x%02x", channel->local_cid);
1414     btstack_run_loop_remove_timer(&channel->rtx);
1415 }
1416 #endif
1417 
1418 static uint8_t l2cap_send_signaling_packet(hci_con_handle_t handle, uint8_t pb_flags, uint16_t cid, L2CAP_SIGNALING_COMMANDS cmd, int identifier, va_list argptr){
1419     if (!hci_can_send_acl_packet_now(handle)){
1420         log_info("l2cap_send_classic_signaling_packet, cannot send");
1421         return BTSTACK_ACL_BUFFERS_FULL;
1422     }
1423     hci_reserve_packet_buffer();
1424     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1425     uint16_t len = l2cap_create_signaling_packet(acl_buffer, handle, pb_flags, cid, cmd, identifier, argptr);
1426     va_end(argptr);
1427     return hci_send_acl_packet_buffer(len);
1428 }
1429 
1430 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
1431 static int l2cap_send_general_signaling_packet(hci_con_handle_t handle, uint16_t signaling_cid, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1432     va_list argptr;
1433     va_start(argptr, identifier);
1434     uint8_t pb_flags = 0x00;
1435 #ifdef ENABLE_CLASSIC
1436     if (signaling_cid == L2CAP_CID_SIGNALING){
1437         pb_flags = l2cap_classic_packet_boundary_flag();
1438     }
1439 #endif
1440 uint8_t result = l2cap_send_signaling_packet(handle, pb_flags, signaling_cid, cmd, identifier, argptr);
1441     va_end(argptr);
1442     return result;
1443 }
1444 #endif
1445 
1446 #ifdef ENABLE_CLASSIC
1447 
1448 static void l2cap_start_rtx(l2cap_channel_t * channel){
1449     l2cap_stop_rtx(channel);
1450     log_info("l2cap_start_rtx for local cid 0x%02x", channel->local_cid);
1451     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
1452     btstack_run_loop_set_timer(&channel->rtx, L2CAP_RTX_TIMEOUT_MS);
1453     btstack_run_loop_add_timer(&channel->rtx);
1454 }
1455 
1456 static void l2cap_start_ertx(l2cap_channel_t * channel){
1457     log_info("l2cap_start_ertx for local cid 0x%02x", channel->local_cid);
1458     l2cap_stop_rtx(channel);
1459     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
1460     btstack_run_loop_set_timer(&channel->rtx, L2CAP_ERTX_TIMEOUT_MS);
1461     btstack_run_loop_add_timer(&channel->rtx);
1462 }
1463 
1464 void l2cap_require_security_level_2_for_outgoing_sdp(void){
1465     l2cap_require_security_level2_for_outgoing_sdp = 1;
1466 }
1467 
1468 static int l2cap_security_level_0_allowed_for_PSM(uint16_t psm){
1469     return (psm == BLUETOOTH_PSM_SDP) && (!l2cap_require_security_level2_for_outgoing_sdp);
1470 }
1471 
1472 static int l2cap_send_classic_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1473     va_list argptr;
1474     va_start(argptr, identifier);
1475     uint8_t pb_flag = l2cap_classic_packet_boundary_flag();
1476     uint8_t result = l2cap_send_signaling_packet(handle, pb_flag, L2CAP_CID_SIGNALING, cmd, identifier, argptr);
1477     va_end(argptr);
1478     return result;
1479 }
1480 
1481 // assumption - only on Classic connections
1482 // cannot be used for L2CAP ERTM
1483 uint8_t l2cap_send_prepared(uint16_t local_cid, uint16_t len){
1484 
1485     if (!hci_is_packet_buffer_reserved()){
1486         log_error("l2cap_send_prepared called without reserving packet first");
1487         return BTSTACK_ACL_BUFFERS_FULL;
1488     }
1489 
1490     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1491     if (!channel) {
1492         log_error("l2cap_send_prepared no channel for cid 0x%02x", local_cid);
1493         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
1494     }
1495 
1496     if (!hci_can_send_prepared_acl_packet_now(channel->con_handle)){
1497         log_info("l2cap_send_prepared cid 0x%02x, cannot send", local_cid);
1498         return BTSTACK_ACL_BUFFERS_FULL;
1499     }
1500 
1501     log_debug("l2cap_send_prepared cid 0x%02x, handle %u, 1 credit used", local_cid, channel->con_handle);
1502 
1503     int fcs_size = 0;
1504 
1505 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1506     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION && channel->fcs_option){
1507         fcs_size = 2;
1508     }
1509 #endif
1510 
1511     // set non-flushable packet boundary flag if supported on Controller
1512     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1513     uint8_t packet_boundary_flag = l2cap_classic_packet_boundary_flag();
1514     l2cap_setup_header(acl_buffer, channel->con_handle, packet_boundary_flag, channel->remote_cid, len + fcs_size);
1515 
1516 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1517     if (fcs_size){
1518         // calculate FCS over l2cap data
1519         uint16_t fcs = crc16_calc(acl_buffer + 4, 4 + len);
1520         log_info("I-Frame: fcs 0x%04x", fcs);
1521         little_endian_store_16(acl_buffer, 8 + len, fcs);
1522     }
1523 #endif
1524 
1525     // send
1526     return hci_send_acl_packet_buffer(len+8+fcs_size);
1527 }
1528 
1529 // assumption - only on Classic connections
1530 static uint8_t l2cap_classic_send(l2cap_channel_t * channel, const uint8_t *data, uint16_t len){
1531 
1532 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1533     // send in ERTM
1534     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1535         return l2cap_ertm_send(channel, data, len);
1536     }
1537 #endif
1538 
1539     if (len > channel->remote_mtu){
1540         log_error("l2cap_send cid 0x%02x, data length exceeds remote MTU.", channel->local_cid);
1541         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
1542     }
1543 
1544     if (!hci_can_send_acl_packet_now(channel->con_handle)){
1545         log_info("l2cap_send cid 0x%02x, cannot send", channel->local_cid);
1546         return BTSTACK_ACL_BUFFERS_FULL;
1547     }
1548 
1549     hci_reserve_packet_buffer();
1550     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1551     (void)memcpy(&acl_buffer[8], data, len);
1552     return l2cap_send_prepared(channel->local_cid, len);
1553 }
1554 
1555 int l2cap_send_echo_request(hci_con_handle_t con_handle, uint8_t *data, uint16_t len){
1556     return l2cap_send_classic_signaling_packet(con_handle, ECHO_REQUEST, l2cap_next_sig_id(), len, data);
1557 }
1558 
1559 static inline void channelStateVarSetFlag(l2cap_channel_t *channel, uint16_t flag){
1560     channel->state_var = channel->state_var | flag;
1561 }
1562 
1563 static inline void channelStateVarClearFlag(l2cap_channel_t *channel, uint16_t flag){
1564     channel->state_var = channel->state_var & ~flag;
1565 }
1566 #endif
1567 
1568 
1569 #ifdef ENABLE_BLE
1570 static int l2cap_send_le_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1571     va_list argptr;
1572     va_start(argptr, identifier);
1573     uint8_t pb_flags = 0x00;  // First non-automatically-flushable packet of a higher layer message
1574     uint8_t result = l2cap_send_signaling_packet(handle, pb_flags, L2CAP_CID_SIGNALING_LE, cmd, identifier, argptr);
1575     va_end(argptr);
1576     return result;
1577 }
1578 #endif
1579 
1580 uint16_t l2cap_max_mtu(void){
1581     return HCI_ACL_PAYLOAD_SIZE - L2CAP_HEADER_SIZE;
1582 }
1583 
1584 #ifdef ENABLE_BLE
1585 uint16_t l2cap_max_le_mtu(void){
1586     if (l2cap_le_custom_max_mtu != 0u) return l2cap_le_custom_max_mtu;
1587     return l2cap_max_mtu();
1588 }
1589 
1590 void l2cap_set_max_le_mtu(uint16_t max_mtu){
1591     if (max_mtu < l2cap_max_mtu()){
1592         l2cap_le_custom_max_mtu = max_mtu;
1593     }
1594 }
1595 #endif
1596 
1597 #ifdef ENABLE_CLASSIC
1598 
1599 static uint16_t l2cap_setup_options_mtu(uint8_t * config_options, uint16_t mtu){
1600     config_options[0] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT; // MTU
1601     config_options[1] = 2; // len param
1602     little_endian_store_16(config_options, 2, mtu);
1603     return 4;
1604 }
1605 
1606 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1607 static int l2cap_ertm_mode(l2cap_channel_t * channel){
1608     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
1609     return ((connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_DONE)
1610         &&  (connection->l2cap_state.extended_feature_mask & 0x08));
1611 }
1612 #endif
1613 
1614 static uint16_t l2cap_setup_options_request(l2cap_channel_t * channel, uint8_t * config_options){
1615 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1616     // use ERTM options if supported by remote and channel ready to use it
1617     if (l2cap_ertm_mode(channel) && channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1618         return l2cap_setup_options_ertm_request(channel, config_options);
1619     }
1620 #endif
1621     uint16_t mtu = channel->local_mtu;
1622     return l2cap_setup_options_mtu(config_options, mtu);
1623 }
1624 
1625 static uint16_t l2cap_setup_options_mtu_response(l2cap_channel_t * channel, uint8_t * config_options){
1626     uint16_t mtu = btstack_min(channel->local_mtu, channel->remote_mtu);
1627     return l2cap_setup_options_mtu(config_options, mtu);
1628 }
1629 
1630 static uint32_t l2cap_extended_features_mask(void){
1631     // extended features request supported, features: fixed channels, unicast connectionless data reception
1632     uint32_t features = 0x280;
1633 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1634     features |= 0x0028;
1635 #endif
1636     return features;
1637 }
1638 #endif
1639 
1640 //
1641 #ifdef ENABLE_CLASSIC
1642 
1643 // returns true if channel was finalized
1644 static bool l2cap_run_for_classic_channel(l2cap_channel_t * channel){
1645 
1646 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1647     uint8_t  config_options[18];
1648 #else
1649     uint8_t  config_options[10];
1650 #endif
1651 
1652     switch (channel->state){
1653 
1654         case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
1655         case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
1656             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1657             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND) {
1658                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND);
1659                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONN_RESP_PEND);
1660                 l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1661                                                     channel->local_cid, channel->remote_cid, 1, 0);
1662             }
1663             break;
1664 
1665         case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
1666             if (!hci_can_send_command_packet_now()) break;
1667             // send connection request - set state first
1668             channel->state = L2CAP_STATE_WAIT_CONNECTION_COMPLETE;
1669             // BD_ADDR, Packet_Type, Page_Scan_Repetition_Mode, Reserved, Clock_Offset, Allow_Role_Switch
1670             (void)memcpy(l2cap_outgoing_classic_addr, channel->address, 6);
1671             hci_send_cmd(&hci_create_connection, channel->address, hci_usable_acl_packet_types(), 0, 0, 0, hci_get_allow_role_switch());
1672             break;
1673 
1674         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
1675             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1676             channel->state = L2CAP_STATE_INVALID;
1677             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1678                                                 channel->local_cid, channel->remote_cid, channel->reason, 0);
1679             // discard channel - l2cap_finialize_channel_close without sending l2cap close event
1680             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1681             l2cap_free_channel_entry(channel);
1682             channel = NULL;
1683             break;
1684 
1685         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
1686             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1687             channel->state = L2CAP_STATE_CONFIG;
1688             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1689             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1690                                                 channel->local_cid, channel->remote_cid, 0, 0);
1691             break;
1692 
1693         case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
1694             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1695             // success, start l2cap handshake
1696             channel->local_sig_id = l2cap_next_sig_id();
1697             channel->state = L2CAP_STATE_WAIT_CONNECT_RSP;
1698             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_REQUEST, channel->local_sig_id,
1699                                                 channel->psm, channel->local_cid);
1700             l2cap_start_rtx(channel);
1701             break;
1702 
1703         case L2CAP_STATE_CONFIG:
1704             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1705 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1706             // fallback to basic mode if ERTM requested but not not supported by remote
1707             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1708                 if (!l2cap_ertm_mode(channel)){
1709                     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1710                     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
1711                 }
1712             }
1713 #endif
1714             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP){
1715                 uint16_t flags = 0;
1716                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
1717                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT) {
1718                     flags = 1;
1719                 } else {
1720                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1721                 }
1722                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID){
1723                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1724                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1725                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_UNKNOWN_OPTIONS,
1726                                                         1, &channel->unknown_option);
1727 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1728                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED){
1729                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
1730                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1731                     uint16_t options_size = l2cap_setup_options_ertm_response(channel, config_options);
1732                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1733                                                         channel->remote_cid, flags,
1734                                                         L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS, options_size,
1735                                                         &config_options);
1736                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM){
1737                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
1738                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1739                     uint16_t options_size = l2cap_setup_options_ertm_response(channel, config_options);
1740                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1741                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS,
1742                                                         options_size, &config_options);
1743 #endif
1744                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU){
1745                     channelStateVarClearFlag(channel,L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1746                     uint16_t options_size = l2cap_setup_options_mtu_response(channel, config_options);
1747                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1748                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS,
1749                                                         options_size, &config_options);
1750                 } else {
1751                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1752                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS, 0, NULL);
1753                 }
1754                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
1755             }
1756             else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ){
1757                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1758                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_REQ);
1759                 channel->local_sig_id = l2cap_next_sig_id();
1760                 uint16_t options_size = l2cap_setup_options_request(channel, config_options);
1761                 l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_REQUEST, channel->local_sig_id,
1762                                                     channel->remote_cid, 0, options_size, &config_options);
1763                 l2cap_start_rtx(channel);
1764             }
1765             if (l2cap_channel_ready_for_open(channel)){
1766                 channel->state = L2CAP_STATE_OPEN;
1767                 l2cap_emit_channel_opened(channel, 0);  // success
1768             }
1769             break;
1770 
1771         case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
1772             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1773             channel->state = L2CAP_STATE_INVALID;
1774             l2cap_send_classic_signaling_packet(channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id,
1775                                                 channel->local_cid, channel->remote_cid);
1776             // we don't start an RTX timer for a disconnect - there's no point in closing the channel if the other side doesn't respond :)
1777             l2cap_finalize_channel_close(channel);  // -- remove from list
1778             channel = NULL;
1779             break;
1780 
1781         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
1782             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1783             channel->local_sig_id = l2cap_next_sig_id();
1784             channel->state = L2CAP_STATE_WAIT_DISCONNECT;
1785             l2cap_send_classic_signaling_packet(channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id,
1786                                                 channel->remote_cid, channel->local_cid);
1787             break;
1788         default:
1789             break;
1790     }
1791 
1792     // handle channel finalize on L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE and L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE
1793     return channel == NULL;
1794 }
1795 
1796 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1797 static void l2cap_run_for_classic_channel_ertm(l2cap_channel_t * channel){
1798 
1799     // ERTM mode
1800     if (channel->mode != L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) return;
1801 
1802     // check if we can still send
1803     if (channel->con_handle == HCI_CON_HANDLE_INVALID) return;
1804     if (!hci_can_send_acl_packet_now(channel->con_handle)) return;
1805 
1806     if (channel->send_supervisor_frame_receiver_ready){
1807         channel->send_supervisor_frame_receiver_ready = 0;
1808         log_info("Send S-Frame: RR %u, final %u", channel->req_seq, channel->set_final_bit_after_packet_with_poll_bit_set);
1809         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY, 0,  channel->set_final_bit_after_packet_with_poll_bit_set, channel->req_seq);
1810         channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1811         l2cap_ertm_send_supervisor_frame(channel, control);
1812         return;
1813     }
1814     if (channel->send_supervisor_frame_receiver_ready_poll){
1815         channel->send_supervisor_frame_receiver_ready_poll = 0;
1816         log_info("Send S-Frame: RR %u with poll=1 ", channel->req_seq);
1817         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY, 1, 0, channel->req_seq);
1818         l2cap_ertm_send_supervisor_frame(channel, control);
1819         return;
1820     }
1821     if (channel->send_supervisor_frame_receiver_not_ready){
1822         channel->send_supervisor_frame_receiver_not_ready = 0;
1823         log_info("Send S-Frame: RNR %u", channel->req_seq);
1824         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY, 0, 0, channel->req_seq);
1825         l2cap_ertm_send_supervisor_frame(channel, control);
1826         return;
1827     }
1828     if (channel->send_supervisor_frame_reject){
1829         channel->send_supervisor_frame_reject = 0;
1830         log_info("Send S-Frame: REJ %u", channel->req_seq);
1831         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT, 0, 0, channel->req_seq);
1832         l2cap_ertm_send_supervisor_frame(channel, control);
1833         return;
1834     }
1835     if (channel->send_supervisor_frame_selective_reject){
1836         channel->send_supervisor_frame_selective_reject = 0;
1837         log_info("Send S-Frame: SREJ %u", channel->expected_tx_seq);
1838         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT, 0, channel->set_final_bit_after_packet_with_poll_bit_set, channel->expected_tx_seq);
1839         channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1840         l2cap_ertm_send_supervisor_frame(channel, control);
1841         return;
1842     }
1843 
1844     if (channel->srej_active){
1845         int i;
1846         for (i=0;i<channel->num_tx_buffers;i++){
1847             l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[i];
1848             if (tx_state->retransmission_requested) {
1849                 tx_state->retransmission_requested = 0;
1850                 uint8_t final = channel->set_final_bit_after_packet_with_poll_bit_set;
1851                 channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1852                 l2cap_ertm_send_information_frame(channel, i, final);
1853                 break;
1854             }
1855         }
1856         if (i == channel->num_tx_buffers){
1857             // no retransmission request found
1858             channel->srej_active = 0;
1859         } else {
1860             // packet was sent
1861             return;
1862         }
1863     }
1864 }
1865 #endif /* ERTM */
1866 #endif /* Classic */
1867 
1868 static void l2cap_run_signaling_response(void) {
1869 
1870     // check pending signaling responses
1871     while (l2cap_signaling_responses_pending){
1872 
1873         hci_con_handle_t handle = l2cap_signaling_responses[0].handle;
1874 
1875         if (!hci_can_send_acl_packet_now(handle)) break;
1876 
1877         uint8_t  sig_id        = l2cap_signaling_responses[0].sig_id;
1878         uint8_t  response_code = l2cap_signaling_responses[0].code;
1879         uint16_t result        = l2cap_signaling_responses[0].data;  // CONNECTION_REQUEST, COMMAND_REJECT, REJECT_SM_PAIRING, L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1880         uint8_t  buffer[2];                                          // REJECT_SM_PAIRING
1881         uint16_t source_cid    = l2cap_signaling_responses[0].cid;   // CONNECTION_REQUEST, REJECT_SM_PAIRING
1882 #ifdef ENABLE_CLASSIC
1883         uint16_t info_type     = l2cap_signaling_responses[0].data;  // INFORMATION_REQUEST
1884 #endif
1885 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1886         uint8_t num_channels = l2cap_signaling_responses[0].cid >> 8;                 // L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1887         uint16_t signaling_cid = (uint16_t) l2cap_signaling_responses[0].cid & 0xff;  // L2CAP_CREDIT_BASED_CONNECTION_REQUEST, L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1888 #endif
1889 
1890         // remove first item before sending (to avoid sending response mutliple times)
1891         l2cap_signaling_responses_pending--;
1892         int i;
1893         for (i=0; i < l2cap_signaling_responses_pending; i++){
1894             (void)memcpy(&l2cap_signaling_responses[i],
1895                          &l2cap_signaling_responses[i + 1],
1896                          sizeof(l2cap_signaling_response_t));
1897         }
1898 
1899         switch (response_code){
1900 #ifdef ENABLE_CLASSIC
1901             case CONNECTION_REQUEST:
1902                 l2cap_send_classic_signaling_packet(handle, CONNECTION_RESPONSE, sig_id, source_cid, 0, result, 0);
1903                 break;
1904             case ECHO_REQUEST:
1905                 l2cap_send_classic_signaling_packet(handle, ECHO_RESPONSE, sig_id, 0, NULL);
1906                 break;
1907             case INFORMATION_REQUEST:
1908                 switch (info_type){
1909                     case L2CAP_INFO_TYPE_CONNECTIONLESS_MTU: {
1910                             uint16_t connectionless_mtu = hci_max_acl_data_packet_length();
1911                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1912                                                             sizeof(connectionless_mtu), &connectionless_mtu);
1913                         }
1914                         break;
1915                     case L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED: {
1916                             uint32_t features = l2cap_extended_features_mask();
1917                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1918                                                             sizeof(features), &features);
1919                         }
1920                         break;
1921                     case L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED: {
1922                             uint8_t map[8];
1923                             memset(map, 0, 8);
1924                             // L2CAP Signaling Channel + Connectionless reception
1925                             map[0] = (1 << L2CAP_CID_SIGNALING) | (1 << L2CAP_CID_CONNECTIONLESS_CHANNEL);
1926 #if defined(ENABLE_BLE) || defined (ENABLE_EXPLICIT_BR_EDR_SECURITY_MANAGER)
1927                             // BR/EDR Security Manager (bit 7) if BR/EDR Secure Connections possible
1928                             if (gap_secure_connections_active()){
1929                                 map[0] |= (1 << L2CAP_CID_BR_EDR_SECURITY_MANAGER);
1930                             }
1931 #endif
1932                             l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1933                                                             sizeof(map), &map);
1934                         }
1935                         break;
1936                     default:
1937                         // all other types are not supported
1938                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 1, 0, NULL);
1939                         break;
1940                 }
1941                 break;
1942             case COMMAND_REJECT:
1943                 l2cap_send_classic_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
1944                 break;
1945 #endif
1946 #ifdef ENABLE_BLE
1947             case LE_CREDIT_BASED_CONNECTION_REQUEST:
1948                 l2cap_send_le_signaling_packet(handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, sig_id, 0, 0, 0, 0, result);
1949                 break;
1950             case COMMAND_REJECT_LE:
1951                 l2cap_send_le_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
1952                 break;
1953 #endif
1954 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1955             case L2CAP_CREDIT_BASED_CONNECTION_REQUEST: {
1956                 // send variable size array or cids with each cid being zero
1957                 uint16_t cids[6];
1958                 (void) memset(cids, 0xff, sizeof(cids));
1959                 (void) memset(cids, 0x00, num_channels * sizeof(uint16_t));
1960                 l2cap_send_general_signaling_packet(handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_RESPONSE,
1961                                                     sig_id, 0, 0, 0, result, cids);
1962                 break;
1963             }
1964 
1965             case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
1966                 l2cap_send_general_signaling_packet(handle, signaling_cid, L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE,
1967                                                     sig_id, result);
1968                 break;
1969 #endif
1970             case SM_PAIRING_FAILED:
1971                 buffer[0] = SM_CODE_PAIRING_FAILED;
1972                 buffer[1] = (uint8_t) result;
1973                 l2cap_send_connectionless(handle, source_cid, buffer, 2);
1974                 break;
1975             default:
1976                 // should not happen
1977                 break;
1978         }
1979     }
1980 }
1981 
1982 #ifdef ENABLE_CLASSIC
1983 static bool l2ap_run_information_requests(void){
1984     // send l2cap information request if requested
1985     btstack_linked_list_iterator_t it;
1986     hci_connections_get_iterator(&it);
1987     uint8_t info_type;
1988     l2cap_information_state_t new_state;
1989     while(btstack_linked_list_iterator_has_next(&it)){
1990         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1991         switch (connection->l2cap_state.information_state){
1992             case L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST:
1993                 info_type = L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED;
1994                 new_state = L2CAP_INFORMATION_STATE_W4_EXTENDED_FEATURE_RESPONSE;
1995                 break;
1996             case L2CAP_INFORMATION_STATE_W2_SEND_FIXED_CHANNELS_REQUEST:
1997                 info_type = L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED;
1998                 new_state = L2CAP_INFORMATION_STATE_W4_FIXED_CHANNELS_RESPONSE;
1999                 break;
2000             default:
2001                 continue;
2002         }
2003         if (!hci_can_send_acl_packet_now(connection->con_handle)) break;
2004 
2005         connection->l2cap_state.information_state = new_state;
2006         uint8_t sig_id = l2cap_next_sig_id();
2007         l2cap_send_classic_signaling_packet(connection->con_handle, INFORMATION_REQUEST, sig_id, info_type);
2008     }
2009     return false;
2010 }
2011 #endif
2012 
2013 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2014 static void l2cap_cbm_run_channels(void){
2015     btstack_linked_list_iterator_t it;
2016     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2017     while (btstack_linked_list_iterator_has_next(&it)){
2018         uint16_t mps;
2019         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2020 
2021         if (channel->channel_type != L2CAP_CHANNEL_TYPE_CHANNEL_CBM) continue;
2022 
2023         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
2024         switch (channel->state){
2025             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST:
2026                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2027                 channel->state = L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE;
2028                 // le psm, source cid, mtu, mps, initial credits
2029                 channel->local_sig_id = l2cap_next_sig_id();
2030                 channel->credits_incoming =  channel->new_credits_incoming;
2031                 channel->new_credits_incoming = 0;
2032                 mps = btstack_min(l2cap_max_le_mtu(), channel->local_mtu);
2033                 l2cap_send_le_signaling_packet( channel->con_handle, LE_CREDIT_BASED_CONNECTION_REQUEST, channel->local_sig_id, channel->psm, channel->local_cid, channel->local_mtu, mps, channel->credits_incoming);
2034                 break;
2035             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT:
2036                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2037                 // TODO: support larger MPS
2038                 channel->state = L2CAP_STATE_OPEN;
2039                 channel->credits_incoming =  channel->new_credits_incoming;
2040                 channel->new_credits_incoming = 0;
2041                 mps = btstack_min(l2cap_max_le_mtu(), channel->local_mtu);
2042                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->local_mtu, mps, channel->credits_incoming, 0);
2043                 // notify client
2044                 l2cap_cbm_emit_channel_opened(channel, ERROR_CODE_SUCCESS);
2045                 break;
2046             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE:
2047                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2048                 channel->state = L2CAP_STATE_INVALID;
2049                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, 0, 0, 0, 0, channel->reason);
2050                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
2051                 btstack_linked_list_iterator_remove(&it);
2052                 l2cap_free_channel_entry(channel);
2053                 break;
2054             case L2CAP_STATE_OPEN:
2055                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2056                 if (channel->new_credits_incoming){
2057                     l2cap_credit_based_send_credits(channel);
2058                 }
2059                 break;
2060             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2061                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2062                 channel->local_sig_id = l2cap_next_sig_id();
2063                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
2064                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
2065                 break;
2066             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
2067                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2068                 channel->state = L2CAP_STATE_INVALID;
2069                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
2070                 l2cap_cbm_finialize_channel_close(channel);  // -- remove from list
2071                 break;
2072             default:
2073                 break;
2074         }
2075     }
2076 }
2077 
2078 static inline uint8_t l2cap_cbm_status_for_result(uint16_t result) {
2079     switch (result) {
2080         case L2CAP_CBM_CONNECTION_RESULT_SUCCESS:
2081             return ERROR_CODE_SUCCESS;
2082         case L2CAP_CBM_CONNECTION_RESULT_SPSM_NOT_SUPPORTED:
2083             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_PSM;
2084         case L2CAP_CBM_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE:
2085             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_RESOURCES;
2086         case L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_AUTHENTICATION:
2087         case L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_AUTHORIZATION:
2088         case L2CAP_CBM_CONNECTION_RESULT_ENCYRPTION_KEY_SIZE_TOO_SHORT:
2089         case L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_ENCRYPTION:
2090             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY;
2091         default:
2092             // invalid Source CID, Source CID already allocated, unacceptable parameters
2093             return L2CAP_CONNECTION_RESPONSE_UNKNOWN_ERROR;
2094     }
2095 }
2096 
2097 #endif
2098 
2099 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2100 
2101 static void l2cap_run_trigger_callback(void * context){
2102     UNUSED(context);
2103     l2cap_run();
2104 }
2105 
2106 static void l2cap_run_trigger(void){
2107     btstack_run_loop_execute_on_main_thread(&l2cap_trigger_run_registration);
2108 }
2109 
2110 // 11BH22222
2111 static void l2cap_ecbm_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
2112     log_info("opened ecbm channel status 0x%x addr_type %u addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u",
2113             status, channel->address_type, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
2114             channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu);
2115     uint8_t event[23];
2116     event[0] = L2CAP_EVENT_ECBM_CHANNEL_OPENED;
2117     event[1] = sizeof(event) - 2u;
2118     event[2] = status;
2119     event[3] = channel->address_type;
2120     reverse_bd_addr(channel->address, &event[4]);
2121     little_endian_store_16(event, 10, channel->con_handle);
2122     event[12] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
2123     little_endian_store_16(event, 13, channel->psm);
2124     little_endian_store_16(event, 15, channel->local_cid);
2125     little_endian_store_16(event, 17, channel->remote_cid);
2126     little_endian_store_16(event, 19, channel->local_mtu);
2127     little_endian_store_16(event, 21, channel->remote_mtu);
2128     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
2129     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2130 }
2131 
2132 static void l2cap_ecbm_emit_reconfigure_complete(l2cap_channel_t *channel, uint16_t result) {
2133     // emit event
2134     uint8_t event[6];
2135     event[0] = L2CAP_EVENT_ECBM_RECONFIGURATION_COMPLETE;
2136     event[1] = sizeof(event) - 2;
2137     little_endian_store_16(event, 2, channel->local_cid);
2138     little_endian_store_16(event, 4, result);
2139     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2140 }
2141 
2142 static void l2cap_ecbm_run_channels(void) {
2143     hci_con_handle_t con_handle = HCI_CON_HANDLE_INVALID;
2144     // num max channels + 1 for signaling pdu generator
2145     uint16_t cids[L2CAP_ECBM_MAX_CID_ARRAY_SIZE + 1];
2146     uint8_t num_cids = 0;
2147     uint8_t sig_id;
2148     uint16_t spsm;
2149     L2CAP_STATE matching_state;
2150     bool match_remote_sig_cid;
2151     uint8_t result = 0;
2152     uint16_t local_mtu;
2153     uint16_t initial_credits;
2154     uint16_t signaling_cid;
2155     L2CAP_STATE new_state;
2156 
2157     // pick first channel that needs to send a combined signaling pdu and setup collection via break
2158     // then collect all others that belong to the same pdu
2159     btstack_linked_list_iterator_t it;
2160     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2161     while (btstack_linked_list_iterator_has_next(&it)) {
2162         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2163         if (channel->channel_type != L2CAP_CHANNEL_TYPE_CHANNEL_ECBM) continue;
2164         if (con_handle == HCI_CON_HANDLE_INVALID) {
2165             switch (channel->state) {
2166                 case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2167                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2168                     local_mtu = channel->local_mtu;
2169                     spsm = channel->psm;
2170                     result = channel->reason;
2171                     initial_credits = channel->credits_incoming;
2172                     sig_id = channel->local_sig_id;
2173                     new_state = L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE;
2174                     match_remote_sig_cid = false;
2175                     break;
2176                 case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE:
2177                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2178                     local_mtu = channel->local_mtu;
2179                     initial_credits = channel->credits_incoming;
2180                     sig_id = channel->remote_sig_id;
2181                     new_state = L2CAP_STATE_OPEN;
2182                     match_remote_sig_cid = true;
2183                     break;
2184                 case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2185                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2186                     sig_id = channel->local_sig_id;
2187                     local_mtu = channel->renegotiate_mtu;
2188                     new_state = L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE;
2189                     match_remote_sig_cid = false;
2190                     break;
2191                 case L2CAP_STATE_OPEN:
2192                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2193                     if (channel->new_credits_incoming) {
2194                         l2cap_credit_based_send_credits(channel);
2195                     }
2196                     continue;
2197                 case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2198                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2199                     channel->local_sig_id = l2cap_next_sig_id();
2200                     channel->state = L2CAP_STATE_WAIT_DISCONNECT;
2201                     signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2202                     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, DISCONNECTION_REQUEST,
2203                                                         channel->local_sig_id, channel->remote_cid, channel->local_cid);
2204                     continue;
2205                 case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
2206                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2207                     channel->state = L2CAP_STATE_INVALID;
2208                     signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2209                     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, DISCONNECTION_RESPONSE,
2210                                                         channel->remote_sig_id, channel->local_cid,
2211                                                         channel->remote_cid);
2212                     l2cap_cbm_finialize_channel_close(channel);  // -- remove from list
2213                     continue;
2214                 default:
2215                     continue;
2216             }
2217 
2218             // channel picked - setup cid array and collect info
2219             (void) memset(cids, 0xff, sizeof(cids));
2220             (void) memset(cids, 0, channel->num_cids * sizeof(uint16_t));
2221             matching_state = channel->state;
2222             con_handle = channel->con_handle;
2223             signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2224             num_cids = channel->num_cids;
2225 
2226         } else {
2227             // check if it matches first channel by state, con_handle, and signaling id
2228             if (matching_state != channel->state) continue;
2229             if (channel->con_handle != con_handle) continue;
2230             if (match_remote_sig_cid) {
2231                 if (channel->remote_sig_id != sig_id) continue;
2232             } else {
2233                 if (channel->local_sig_id != sig_id) continue;
2234             }
2235         }
2236 
2237         // add this cid
2238         cids[channel->cid_index] = channel->local_cid;
2239 
2240         // set new state
2241         channel->state = new_state;
2242 
2243         // handle open for L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE
2244         if (matching_state == L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE) {
2245             if (channel->reason == L2CAP_ECBM_CONNECTION_RESULT_ALL_SUCCESS) {
2246                 l2cap_ecbm_emit_channel_opened(channel, ERROR_CODE_SUCCESS);
2247             } else {
2248                 result = channel->reason;
2249                 btstack_linked_list_iterator_remove(&it);
2250                 btstack_memory_l2cap_channel_free(channel);
2251             }
2252         }
2253     }
2254 
2255     if (con_handle != HCI_CON_HANDLE_INVALID) {
2256         // TODO: get MTU for both BR/EDR and LE
2257         uint16_t mps = btstack_min(l2cap_enhanced_mps_max, btstack_min(l2cap_max_le_mtu(), local_mtu));
2258         switch (matching_state) {
2259             case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2260                 log_info("send combined connection request for %u cids", num_cids);
2261                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_REQUEST,
2262                                                     sig_id, spsm, local_mtu, mps, initial_credits, cids);
2263                 break;
2264             case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE:
2265                 log_info("send combined connection response for %u cids", num_cids);
2266                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_RESPONSE,
2267                                                     sig_id, local_mtu, mps, initial_credits, result, cids);
2268                 break;
2269             case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2270                 log_info("send combined renegotiation request for %u cids", num_cids);
2271                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST,
2272                                                     sig_id, local_mtu, mps, cids);
2273                 break;
2274             default:
2275                 break;
2276         }
2277     }
2278 }
2279 #endif
2280 
2281 // MARK: L2CAP_RUN
2282 // process outstanding signaling tasks
2283 static void l2cap_run(void){
2284 
2285     // log_info("l2cap_run: entered");
2286     l2cap_run_signaling_response();
2287 
2288 #ifdef ENABLE_CLASSIC
2289     bool done = l2ap_run_information_requests();
2290     if (done) return;
2291 #endif
2292 
2293 #if defined(ENABLE_CLASSIC) || defined(ENABLE_BLE)
2294     btstack_linked_list_iterator_t it;
2295 #endif
2296 
2297 #ifdef ENABLE_CLASSIC
2298     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2299     while (btstack_linked_list_iterator_has_next(&it)){
2300 
2301         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2302 
2303         if (channel->channel_type != L2CAP_CHANNEL_TYPE_CLASSIC) continue;
2304 
2305         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
2306         bool finalized = l2cap_run_for_classic_channel(channel);
2307 
2308         if (!finalized) {
2309 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2310             l2cap_run_for_classic_channel_ertm(channel);
2311 #endif
2312         }
2313     }
2314 #endif
2315 
2316 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2317     l2cap_cbm_run_channels();
2318 #endif
2319 
2320 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2321     l2cap_ecbm_run_channels();
2322 #endif
2323 
2324 #ifdef ENABLE_BLE
2325     // send l2cap con paramter update if necessary
2326     hci_connections_get_iterator(&it);
2327     while(btstack_linked_list_iterator_has_next(&it)){
2328         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2329         if ((connection->address_type != BD_ADDR_TYPE_LE_PUBLIC) && (connection->address_type != BD_ADDR_TYPE_LE_RANDOM)) continue;
2330         if (!hci_can_send_acl_packet_now(connection->con_handle)) continue;
2331         switch (connection->le_con_parameter_update_state){
2332             case CON_PARAMETER_UPDATE_SEND_REQUEST:
2333                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
2334                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_REQUEST, l2cap_next_sig_id(),
2335                                                connection->le_conn_interval_min, connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout);
2336                 break;
2337             case CON_PARAMETER_UPDATE_SEND_RESPONSE:
2338                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS;
2339                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 0);
2340                 break;
2341             case CON_PARAMETER_UPDATE_DENY:
2342                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
2343                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 1);
2344                 break;
2345             default:
2346                 break;
2347         }
2348     }
2349 #endif
2350 
2351     if (l2cap_call_notify_channel_in_run){
2352         l2cap_call_notify_channel_in_run = false;
2353         l2cap_notify_channel_can_send();
2354     }
2355 
2356     // log_info("l2cap_run: exit");
2357 }
2358 
2359 #ifdef ENABLE_CLASSIC
2360 static void l2cap_ready_to_connect(l2cap_channel_t * channel){
2361 
2362 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2363     // assumption: outgoing connection
2364     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
2365         // ERTM requested: trigger information request if not already started then wait for response
2366         hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
2367         switch (connection->l2cap_state.information_state){
2368             case L2CAP_INFORMATION_STATE_DONE:
2369                 break;
2370             case L2CAP_INFORMATION_STATE_IDLE:
2371                 connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
2372                 /* fall through */
2373             default:
2374                 channel->state = L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES;
2375                 return;
2376         }
2377     }
2378 #endif
2379 
2380     // fine, go ahead
2381     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
2382 }
2383 
2384 static void l2cap_handle_connection_complete(hci_con_handle_t con_handle, l2cap_channel_t * channel){
2385     if ((channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE) || (channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION)) {
2386         log_info("connection complete con_handle %04x - for channel %p cid 0x%04x", (int) con_handle, channel, channel->local_cid);
2387         channel->con_handle = con_handle;
2388         // query remote features if pairing is required
2389         if (channel->required_security_level > LEVEL_0){
2390             channel->state = L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES;
2391             hci_remote_features_query(con_handle);
2392         } else {
2393             l2cap_ready_to_connect(channel);
2394         }
2395     }
2396 }
2397 
2398 static void l2cap_handle_remote_supported_features_received(l2cap_channel_t * channel){
2399     if (channel->state != L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES) return;
2400 
2401     bool security_required = channel->required_security_level > LEVEL_0;
2402 
2403     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) != 0){
2404 
2405         // Core V5.2, Vol 3, Part C, 5.2.2.2 - Security Mode 4
2406         //   When a remote device attempts to access a service offered by a Bluetooth device that is in security mode 4
2407         //   and a sufficient link key exists and authentication has not been performed the local device shall authenticate
2408         //   the remote device and enable encryption after the channel establishment request is received but before a channel
2409         //   establishment confirmation (L2CAP_ConnectRsp with result code of 0x0000 or a higher-level channel establishment
2410         //   confirmation such as that of RFCOMM) is sent.
2411 
2412         //   If the remote device has indicated support for Secure Simple Pairing, a channel establishment request is
2413         //   received for a service other than SDP, and encryption has not yet been enabled, then the local device shall
2414         //   disconnect the ACL link with error code 0x05 - Authentication Failure.
2415 
2416         // => Disconnect if l2cap request received in mode 4 and ssp supported, non-sdp psm, not encrypted, no link key available
2417         if ((gap_get_security_mode() == GAP_SECURITY_MODE_4)
2418         && gap_ssp_supported_on_both_sides(channel->con_handle)
2419         && (channel->psm != PSM_SDP)
2420         && (gap_encryption_key_size(channel->con_handle) == 0)){
2421             hci_disconnect_security_block(channel->con_handle);
2422             return;
2423         }
2424 
2425         // incoming: assert security requirements
2426         channel->state = L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE;
2427         if (channel->required_security_level <= gap_security_level(channel->con_handle)){
2428             l2cap_handle_security_level_incoming_sufficient(channel);
2429         } else {
2430             // send connection pending if not already done
2431             if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONN_RESP_PEND) == 0){
2432                 channel->state_var |= L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND;
2433             }
2434             gap_request_security_level(channel->con_handle, channel->required_security_level);
2435         }
2436     } else {
2437         // outgoing: we have been waiting for remote supported features
2438         if (security_required){
2439             // request security level
2440             channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
2441             gap_request_security_level(channel->con_handle, channel->required_security_level);
2442         } else {
2443             l2cap_ready_to_connect(channel);
2444         }
2445     }
2446 }
2447 #endif
2448 
2449 #ifdef L2CAP_USES_CHANNELS
2450 static l2cap_channel_t * l2cap_create_channel_entry(btstack_packet_handler_t packet_handler, l2cap_channel_type_t channel_type, bd_addr_t address, bd_addr_type_t address_type,
2451     uint16_t psm, uint16_t local_mtu, gap_security_level_t security_level){
2452 
2453     l2cap_channel_t * channel = btstack_memory_l2cap_channel_get();
2454     if (!channel) {
2455         return NULL;
2456     }
2457 
2458     // fill in
2459     channel->packet_handler = packet_handler;
2460     channel->channel_type   = channel_type;
2461     bd_addr_copy(channel->address, address);
2462     channel->address_type = address_type;
2463     channel->psm = psm;
2464     channel->local_mtu  = local_mtu;
2465     channel->remote_mtu = L2CAP_DEFAULT_MTU;
2466     channel->required_security_level = security_level;
2467 
2468     //
2469     channel->local_cid = l2cap_next_local_cid();
2470     channel->con_handle = HCI_CON_HANDLE_INVALID;
2471 
2472     // set initial state
2473     channel->state = L2CAP_STATE_WILL_SEND_CREATE_CONNECTION;
2474     channel->state_var = L2CAP_CHANNEL_STATE_VAR_NONE;
2475     channel->remote_sig_id = L2CAP_SIG_ID_INVALID;
2476     channel->local_sig_id = L2CAP_SIG_ID_INVALID;
2477 
2478     log_info("create channel %p, local_cid 0x%04x", channel, channel->local_cid);
2479 
2480     return channel;
2481 }
2482 
2483 static void l2cap_free_channel_entry(l2cap_channel_t * channel){
2484     log_info("free channel %p, local_cid 0x%04x", channel, channel->local_cid);
2485     // assert all timers are stopped
2486     l2cap_stop_rtx(channel);
2487 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2488     l2cap_ertm_stop_retransmission_timer(channel);
2489     l2cap_ertm_stop_monitor_timer(channel);
2490 #endif
2491     // free  memory
2492     btstack_memory_l2cap_channel_free(channel);
2493 }
2494 #endif
2495 
2496 #ifdef ENABLE_CLASSIC
2497 
2498 /**
2499  * @brief Creates L2CAP channel to the PSM of a remote device with baseband address. A new baseband connection will be initiated if necessary.
2500  * @param packet_handler
2501  * @param address
2502  * @param psm
2503  * @param mtu
2504  * @param local_cid
2505  */
2506 
2507 uint8_t l2cap_create_channel(btstack_packet_handler_t channel_packet_handler, bd_addr_t address, uint16_t psm, uint16_t mtu, uint16_t * out_local_cid){
2508     // limit MTU to the size of our outgoing HCI buffer
2509     uint16_t local_mtu = btstack_min(mtu, l2cap_max_mtu());
2510 
2511 	// determine security level based on psm
2512 	const gap_security_level_t security_level = l2cap_security_level_0_allowed_for_PSM(psm) ? LEVEL_0 : gap_get_security_level();
2513 	log_info("create channel addr %s psm 0x%x mtu %u -> local mtu %u, sec level %u", bd_addr_to_str(address), psm, mtu, local_mtu, (int) security_level);
2514 
2515     l2cap_channel_t * channel = l2cap_create_channel_entry(channel_packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, address, BD_ADDR_TYPE_ACL, psm, local_mtu, security_level);
2516     if (!channel) {
2517         return BTSTACK_MEMORY_ALLOC_FAILED;
2518     }
2519 
2520 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2521     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
2522 #endif
2523 
2524     // add to connections list
2525     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
2526 
2527     // store local_cid
2528     if (out_local_cid){
2529        *out_local_cid = channel->local_cid;
2530     }
2531 
2532 	// state: L2CAP_STATE_WILL_SEND_CREATE_CONNECTION
2533 
2534     // check if hci connection is already usable,
2535     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_ACL);
2536     if (conn && conn->state == OPEN){
2537     	// simulate connection complete
2538 	    l2cap_handle_connection_complete(conn->con_handle, channel);
2539 
2540 	    // state: L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES or L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST
2541 
2542         // simulate if remote supported features if requested and already received
2543         if ((channel->state == L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES) && hci_remote_features_available(conn->con_handle)) {
2544         	// simulate remote features received
2545             l2cap_handle_remote_supported_features_received(channel);
2546         }
2547     }
2548 
2549     l2cap_run();
2550 
2551     return ERROR_CODE_SUCCESS;
2552 }
2553 
2554 static void l2cap_handle_connection_failed_for_addr(bd_addr_t address, uint8_t status){
2555     // mark all channels before emitting open events as these could trigger new connetion requests to the same device
2556     btstack_linked_list_iterator_t it;
2557     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2558     while (btstack_linked_list_iterator_has_next(&it)){
2559         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2560         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2561         if (bd_addr_cmp( channel->address, address) != 0) continue;
2562         // channel for this address found
2563         switch (channel->state){
2564             case L2CAP_STATE_WAIT_CONNECTION_COMPLETE:
2565             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
2566                 channel->state = L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD;
2567                 break;
2568             default:
2569                 break;
2570         }
2571     }
2572     // emit and free marked entries. restart loop to deal with list changes
2573     int done = 0;
2574     while (!done) {
2575         done = 1;
2576         btstack_linked_list_iterator_init(&it, &l2cap_channels);
2577         while (btstack_linked_list_iterator_has_next(&it)){
2578             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2579             if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2580             if (channel->state == L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD){
2581                 done = 0;
2582                 // failure, forward error code
2583                 l2cap_handle_channel_open_failed(channel, status);
2584                 // discard channel
2585                 btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2586                 l2cap_free_channel_entry(channel);
2587                 break;
2588             }
2589         }
2590     }
2591 
2592 }
2593 
2594 static void l2cap_handle_connection_success_for_addr(bd_addr_t address, hci_con_handle_t handle){
2595     btstack_linked_list_iterator_t it;
2596     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2597     while (btstack_linked_list_iterator_has_next(&it)){
2598         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2599         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2600         if ( ! bd_addr_cmp( channel->address, address) ){
2601             l2cap_handle_connection_complete(handle, channel);
2602         }
2603     }
2604 
2605 #ifdef ENABLE_L2CAP_INFORMATION_REQUESTS_ON_CONNECT
2606     // trigger query of extended features and fixed channels right away (instead of later)
2607     hci_connection_t * hci_connection = hci_connection_for_handle(handle);
2608     btstack_assert(hci_connection != NULL);
2609     hci_connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
2610 #endif
2611 
2612     // process
2613     l2cap_run();
2614 }
2615 #endif
2616 
2617 static bool l2cap_channel_ready_to_send(l2cap_channel_t * channel){
2618     switch (channel->channel_type){
2619 #ifdef ENABLE_CLASSIC
2620         case L2CAP_CHANNEL_TYPE_CLASSIC:
2621             if (channel->state != L2CAP_STATE_OPEN) return false;
2622 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2623             // send if we have more data and remote windows isn't full yet
2624             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) {
2625                 if (channel->unacked_frames >= btstack_min(channel->num_stored_tx_frames, channel->remote_tx_window_size)) return false;
2626                 return hci_can_send_acl_packet_now(channel->con_handle);
2627             }
2628 #endif
2629             if (!channel->waiting_for_can_send_now) return false;
2630             return hci_can_send_acl_packet_now(channel->con_handle);
2631         case L2CAP_CHANNEL_TYPE_FIXED_CLASSIC:
2632         case L2CAP_CHANNEL_TYPE_CONNECTIONLESS:
2633             if (!channel->waiting_for_can_send_now) return false;
2634             return hci_can_send_acl_classic_packet_now();
2635 #endif
2636 #ifdef ENABLE_BLE
2637         case L2CAP_CHANNEL_TYPE_FIXED_LE:
2638             if (!channel->waiting_for_can_send_now) return false;
2639             return hci_can_send_acl_le_packet_now();
2640 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2641         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
2642             if (channel->state != L2CAP_STATE_OPEN) return false;
2643             if (channel->send_sdu_buffer == NULL) return false;
2644             if (channel->credits_outgoing == 0u) return false;
2645             return hci_can_send_acl_packet_now(channel->con_handle);
2646 #endif
2647 #endif
2648 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2649         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
2650             if (channel->state != L2CAP_STATE_OPEN) return false;
2651             if (channel->send_sdu_buffer == NULL) return false;
2652             if (channel->credits_outgoing == 0u) return false;
2653             return hci_can_send_acl_packet_now(channel->con_handle);
2654 #endif
2655         default:
2656             return false;
2657     }
2658 }
2659 
2660 static void l2cap_channel_trigger_send(l2cap_channel_t * channel){
2661     switch (channel->channel_type){
2662 #ifdef ENABLE_CLASSIC
2663         case L2CAP_CHANNEL_TYPE_CLASSIC:
2664 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2665             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) {
2666                 l2cap_ertm_channel_send_information_frame(channel);
2667                 return;
2668             }
2669 #endif
2670             channel->waiting_for_can_send_now = 0;
2671             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2672             break;
2673         case L2CAP_CHANNEL_TYPE_CONNECTIONLESS:
2674         case L2CAP_CHANNEL_TYPE_FIXED_CLASSIC:
2675             channel->waiting_for_can_send_now = 0;
2676             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2677             break;
2678 #endif
2679 #ifdef ENABLE_BLE
2680         case L2CAP_CHANNEL_TYPE_FIXED_LE:
2681             channel->waiting_for_can_send_now = 0;
2682             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2683             break;
2684 #endif
2685 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2686         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
2687             l2cap_credit_based_send_pdu(channel);
2688             break;
2689 #endif
2690 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2691         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
2692             l2cap_credit_based_send_pdu(channel);
2693             break;
2694 #endif
2695         default:
2696             btstack_unreachable();
2697             break;
2698     }
2699 }
2700 
2701 static void l2cap_notify_channel_can_send(void){
2702     bool done = false;
2703     while (!done){
2704         done = true;
2705         btstack_linked_list_iterator_t it;
2706         btstack_linked_list_iterator_init(&it, &l2cap_channels);
2707         while (btstack_linked_list_iterator_has_next(&it)){
2708             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2709             bool ready = l2cap_channel_ready_to_send(channel);
2710             if (!ready) continue;
2711 
2712             // requeue channel for fairness
2713             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2714             btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
2715 
2716             // trigger sending
2717             l2cap_channel_trigger_send(channel);
2718 
2719             // exit inner loop as we just broke the iterator, but try again
2720             done = false;
2721             break;
2722         }
2723     }
2724 }
2725 
2726 #ifdef L2CAP_USES_CHANNELS
2727 
2728 uint8_t l2cap_disconnect(uint16_t local_cid){
2729     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
2730     if (!channel) {
2731         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2732     }
2733     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
2734     l2cap_run();
2735     return ERROR_CODE_SUCCESS;
2736 }
2737 
2738 static int l2cap_send_open_failed_on_hci_disconnect(l2cap_channel_t * channel){
2739     // open cannot fail for for incoming connections
2740     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) return 0;
2741 
2742     // check state
2743     switch (channel->state){
2744         case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
2745         case L2CAP_STATE_WAIT_CONNECTION_COMPLETE:
2746         case L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES:
2747         case L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE:
2748         case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
2749         case L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES:
2750         case L2CAP_STATE_WAIT_CONNECT_RSP:
2751         case L2CAP_STATE_CONFIG:
2752         case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
2753         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST:
2754         case L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE:
2755         case L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD:
2756             return 1;
2757 
2758         case L2CAP_STATE_OPEN:
2759         case L2CAP_STATE_CLOSED:
2760         case L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES:
2761         case L2CAP_STATE_WAIT_DISCONNECT:
2762         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_INSUFFICIENT_SECURITY:
2763         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
2764         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
2765         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2766         case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
2767         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE:
2768         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT:
2769         case L2CAP_STATE_INVALID:
2770         case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
2771             return 0;
2772 
2773         default:
2774             // get a "warning" about new states
2775             btstack_assert(false);
2776             return 0;
2777     }
2778 }
2779 #endif
2780 
2781 #ifdef ENABLE_CLASSIC
2782 static void l2cap_handle_hci_disconnect_event(l2cap_channel_t * channel){
2783     if (l2cap_send_open_failed_on_hci_disconnect(channel)){
2784         l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2785     } else {
2786         l2cap_handle_channel_closed(channel);
2787     }
2788     l2cap_free_channel_entry(channel);
2789 }
2790 #endif
2791 
2792 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2793 static void l2cap_handle_hci_le_disconnect_event(l2cap_channel_t * channel){
2794     if (l2cap_send_open_failed_on_hci_disconnect(channel)){
2795         l2cap_cbm_emit_channel_opened(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2796     } else {
2797         l2cap_emit_channel_closed(channel);
2798     }
2799     l2cap_free_channel_entry(channel);
2800 }
2801 #endif
2802 
2803 #ifdef ENABLE_CLASSIC
2804 static void l2cap_check_classic_timeout(hci_con_handle_t handle){
2805     if (gap_get_connection_type(handle) != GAP_CONNECTION_ACL) {
2806         return;
2807     }
2808     if (hci_authentication_active_for_handle(handle)) {
2809         return;
2810     }
2811     bool hci_con_used = false;
2812     btstack_linked_list_iterator_t it;
2813     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2814     while (btstack_linked_list_iterator_has_next(&it)){
2815         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2816         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2817         if (channel->con_handle != handle) continue;
2818         hci_con_used = true;
2819         break;
2820     }
2821     if (hci_con_used) {
2822         return;
2823     }
2824     if (!hci_can_send_command_packet_now()) {
2825         return;
2826     }
2827     hci_send_cmd(&hci_disconnect, handle, 0x13); // remote closed connection
2828 }
2829 
2830 static void l2cap_handle_features_complete(hci_con_handle_t handle){
2831     if (hci_remote_features_available(handle) == false){
2832         return;
2833     }
2834     btstack_linked_list_iterator_t it;
2835     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2836     while (btstack_linked_list_iterator_has_next(&it)){
2837         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2838         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2839         if (channel->con_handle != handle) continue;
2840         log_info("remote supported features, channel %p, cid %04x - state %u", channel, channel->local_cid, channel->state);
2841         l2cap_handle_remote_supported_features_received(channel);
2842     }
2843 }
2844 
2845 static void l2cap_handle_security_level_incoming_sufficient(l2cap_channel_t * channel){
2846     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
2847     l2cap_emit_incoming_connection(channel);
2848 }
2849 
2850 static void l2cap_handle_security_level(hci_con_handle_t handle, gap_security_level_t actual_level){
2851     log_info("security level update for handle 0x%04x", handle);
2852 
2853     // trigger l2cap information requests
2854     if (actual_level > LEVEL_0){
2855         hci_connection_t * hci_connection = hci_connection_for_handle(handle);
2856         btstack_assert(hci_connection != NULL);
2857         if (hci_connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_IDLE){
2858             hci_connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
2859         }
2860     }
2861 
2862     btstack_linked_list_iterator_t it;
2863     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2864     while (btstack_linked_list_iterator_has_next(&it)){
2865         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2866         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2867         if (channel->con_handle != handle) continue;
2868 
2869         gap_security_level_t required_level = channel->required_security_level;
2870 
2871         log_info("channel %p, cid %04x - state %u: actual %u >= required %u?", channel, channel->local_cid, channel->state, actual_level, required_level);
2872 
2873         switch (channel->state){
2874             case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
2875                 if (actual_level >= required_level){
2876                     l2cap_handle_security_level_incoming_sufficient(channel);
2877                 } else {
2878                     channel->reason = L2CAP_CONNECTION_RESULT_SECURITY_BLOCK;
2879                     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
2880                 }
2881                 break;
2882 
2883             case L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE:
2884                 if (actual_level >= required_level){
2885                     l2cap_ready_to_connect(channel);
2886                 } else {
2887                     // security level insufficient, report error and free channel
2888                     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY);
2889                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t  *) channel);
2890                     l2cap_free_channel_entry(channel);
2891                 }
2892                 break;
2893 
2894             default:
2895                 break;
2896         }
2897     }
2898 }
2899 #endif
2900 
2901 #ifdef L2CAP_USES_CHANNELS
2902 static void l2cap_handle_disconnection_complete(hci_con_handle_t handle){
2903     // collect channels to close
2904     btstack_linked_list_t channels_to_close = NULL;
2905     btstack_linked_list_iterator_t it;
2906     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2907     while (btstack_linked_list_iterator_has_next(&it)) {
2908         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2909         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2910         if (channel->con_handle != handle) continue;
2911         btstack_linked_list_iterator_remove(&it);
2912         btstack_linked_list_add(&channels_to_close, (btstack_linked_item_t *) channel);
2913     }
2914     // send l2cap open failed or closed events for all channels on this handle and free them
2915     btstack_linked_list_iterator_init(&it, &channels_to_close);
2916     while (btstack_linked_list_iterator_has_next(&it)) {
2917         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2918         btstack_linked_list_iterator_remove(&it);
2919         switch(channel->channel_type){
2920 #ifdef ENABLE_CLASSIC
2921             case L2CAP_CHANNEL_TYPE_CLASSIC:
2922                 l2cap_handle_hci_disconnect_event(channel);
2923                 break;
2924 #endif
2925 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2926             case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
2927                 l2cap_handle_hci_le_disconnect_event(channel);
2928                 break;
2929 #endif
2930 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2931             case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
2932                 switch (channel->state) {
2933                     case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2934                     case L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE:
2935                         // emit open failed if disconnected before connection complete
2936                         l2cap_ecbm_emit_channel_opened(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2937                         break;
2938                     case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2939                     case L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE:
2940                         // emit reconfigure failure - result = 0xffff
2941                         l2cap_ecbm_emit_reconfigure_complete(channel, 0xffff);
2942                         break;
2943                     default:
2944                         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
2945                         break;
2946                 }
2947                 l2cap_free_channel_entry(channel);
2948                 break;
2949 #endif
2950             default:
2951                 break;
2952         }
2953     }
2954 }
2955 #endif
2956 
2957 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t cid, uint8_t *packet, uint16_t size){
2958 
2959     UNUSED(packet_type); // ok: registered with hci_event_callback_registration
2960     UNUSED(cid);         // ok: there is no channel
2961     UNUSED(size);        // ok: fixed format events read from HCI buffer
2962 
2963 #ifdef ENABLE_CLASSIC
2964     bd_addr_t address;
2965     gap_security_level_t security_level;
2966 #endif
2967 #ifdef L2CAP_USES_CHANNELS
2968     hci_con_handle_t handle;
2969 #endif
2970 
2971     switch(hci_event_packet_get_type(packet)){
2972 
2973         // Notify channel packet handler if they can send now
2974         case HCI_EVENT_TRANSPORT_PACKET_SENT:
2975         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:
2976         case BTSTACK_EVENT_NR_CONNECTIONS_CHANGED:
2977 #ifdef ENABLE_TESTING_SUPPORT
2978         case HCI_EVENT_NOP:
2979 #endif
2980             l2cap_call_notify_channel_in_run = true;
2981             break;
2982 
2983         case HCI_EVENT_COMMAND_STATUS:
2984 #ifdef ENABLE_CLASSIC
2985             // check command status for create connection for errors
2986             if (hci_event_command_status_get_command_opcode(packet) == HCI_OPCODE_HCI_CREATE_CONNECTION){
2987                 // cache outgoing address and reset
2988                 (void)memcpy(address, l2cap_outgoing_classic_addr, 6);
2989                 memset(l2cap_outgoing_classic_addr, 0, 6);
2990                 // error => outgoing connection failed
2991                 uint8_t status = hci_event_command_status_get_status(packet);
2992                 if (status){
2993                     l2cap_handle_connection_failed_for_addr(address, status);
2994                 }
2995             }
2996 #endif
2997             l2cap_run();    // try sending signaling packets first
2998             break;
2999 
3000 #ifdef ENABLE_CLASSIC
3001         // handle connection complete events
3002         case HCI_EVENT_CONNECTION_COMPLETE:
3003             reverse_bd_addr(&packet[5], address);
3004             if (packet[2] == 0){
3005                 handle = little_endian_read_16(packet, 3);
3006                 l2cap_handle_connection_success_for_addr(address, handle);
3007             } else {
3008                 l2cap_handle_connection_failed_for_addr(address, packet[2]);
3009             }
3010             break;
3011 
3012         // handle successful create connection cancel command
3013         case HCI_EVENT_COMMAND_COMPLETE:
3014             if (hci_event_command_complete_get_command_opcode(packet) == HCI_OPCODE_HCI_CREATE_CONNECTION_CANCEL) {
3015                 if (packet[5] == 0){
3016                     reverse_bd_addr(&packet[6], address);
3017                     // CONNECTION TERMINATED BY LOCAL HOST (0X16)
3018                     l2cap_handle_connection_failed_for_addr(address, 0x16);
3019                 }
3020             }
3021             l2cap_run();    // try sending signaling packets first
3022             break;
3023 #endif
3024 
3025 #ifdef L2CAP_USES_CHANNELS
3026         // handle disconnection complete events
3027         case HCI_EVENT_DISCONNECTION_COMPLETE:
3028             handle = little_endian_read_16(packet, 3);
3029             l2cap_handle_disconnection_complete(handle);
3030             break;
3031 #endif
3032 
3033         // HCI Connection Timeouts
3034 #ifdef ENABLE_CLASSIC
3035         case L2CAP_EVENT_TIMEOUT_CHECK:
3036             handle = little_endian_read_16(packet, 2);
3037             l2cap_check_classic_timeout(handle);
3038             break;
3039 
3040         case HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE:
3041         case HCI_EVENT_READ_REMOTE_EXTENDED_FEATURES_COMPLETE:
3042             handle = little_endian_read_16(packet, 3);
3043             l2cap_handle_features_complete(handle);
3044             break;
3045 
3046         case GAP_EVENT_SECURITY_LEVEL:
3047             handle = little_endian_read_16(packet, 2);
3048             security_level = (gap_security_level_t) packet[4];
3049             l2cap_handle_security_level(handle, security_level);
3050             break;
3051 #endif
3052         default:
3053             break;
3054     }
3055 
3056     l2cap_run();
3057 }
3058 
3059 static void l2cap_register_signaling_response(hci_con_handle_t handle, uint8_t code, uint8_t sig_id, uint16_t cid, uint16_t data){
3060     // Vol 3, Part A, 4.3: "The DCID and SCID fields shall be ignored when the result field indicates the connection was refused."
3061     if (l2cap_signaling_responses_pending < NR_PENDING_SIGNALING_RESPONSES) {
3062         l2cap_signaling_responses[l2cap_signaling_responses_pending].handle = handle;
3063         l2cap_signaling_responses[l2cap_signaling_responses_pending].code = code;
3064         l2cap_signaling_responses[l2cap_signaling_responses_pending].sig_id = sig_id;
3065         l2cap_signaling_responses[l2cap_signaling_responses_pending].cid = cid;
3066         l2cap_signaling_responses[l2cap_signaling_responses_pending].data = data;
3067         l2cap_signaling_responses_pending++;
3068         l2cap_run();
3069     }
3070 }
3071 
3072 #ifdef ENABLE_CLASSIC
3073 static void l2cap_handle_disconnect_request(l2cap_channel_t *channel, uint8_t identifier){
3074     switch (channel->state){
3075         case L2CAP_STATE_CONFIG:
3076         case L2CAP_STATE_OPEN:
3077         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
3078         case L2CAP_STATE_WAIT_DISCONNECT:
3079             break;
3080         default:
3081             // ignore in other states
3082             return;
3083     }
3084 
3085     channel->remote_sig_id = identifier;
3086     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
3087     l2cap_run();
3088 }
3089 
3090 static void l2cap_handle_connection_request(hci_con_handle_t handle, uint8_t sig_id, uint16_t psm, uint16_t source_cid){
3091 
3092     // log_info("l2cap_handle_connection_request for handle %u, psm %u cid 0x%02x", handle, psm, source_cid);
3093     l2cap_service_t *service = l2cap_get_service(psm);
3094     if (!service) {
3095         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CONNECTION_RESULT_PSM_NOT_SUPPORTED);
3096         return;
3097     }
3098 
3099     hci_connection_t * hci_connection = hci_connection_for_handle( handle );
3100     if (!hci_connection) {
3101         //
3102         log_error("no hci_connection for handle %u", handle);
3103         return;
3104     }
3105 
3106     // if SC only mode is active and service requires encryption, reject connection if SC not active or use security level
3107     gap_security_level_t required_level = service->required_security_level;
3108     if (gap_get_secure_connections_only_mode() && (required_level != LEVEL_0)){
3109         if (gap_secure_connection(handle)){
3110             required_level = LEVEL_4;
3111         } else {
3112             l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CONNECTION_RESULT_SECURITY_BLOCK);
3113             return;
3114         }
3115     }
3116 
3117     // alloc structure
3118     l2cap_channel_t * channel = l2cap_create_channel_entry(service->packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, hci_connection->address, BD_ADDR_TYPE_ACL,
3119     psm, service->mtu, required_level);
3120     if (!channel){
3121         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE);
3122         return;
3123     }
3124 
3125     channel->con_handle = handle;
3126     channel->remote_cid = source_cid;
3127     channel->remote_sig_id = sig_id;
3128 
3129     // limit local mtu to max acl packet length - l2cap header
3130     if (channel->local_mtu > l2cap_max_mtu()) {
3131         channel->local_mtu = l2cap_max_mtu();
3132     }
3133 
3134     // set initial state
3135     channel->state =     L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES;
3136     channel->state_var = L2CAP_CHANNEL_STATE_VAR_INCOMING;
3137 
3138     // add to connections list
3139     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
3140 
3141     //
3142     if (required_level > LEVEL_0){
3143         // send conn resp pending if remote supported features have not been received yet
3144         if (hci_remote_features_available(handle)) {
3145             l2cap_handle_remote_supported_features_received(channel);
3146         } else {
3147             channel->state_var |= L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND;
3148             hci_remote_features_query(handle);
3149         }
3150     } else {
3151         l2cap_handle_security_level_incoming_sufficient(channel);
3152     }
3153 }
3154 
3155 void l2cap_accept_connection(uint16_t local_cid){
3156     log_info("L2CAP_ACCEPT_CONNECTION local_cid 0x%x", local_cid);
3157     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
3158     if (!channel) {
3159         log_error("accept called but local_cid 0x%x not found", local_cid);
3160         return;
3161     }
3162 
3163 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3164     // configure L2CAP Basic mode
3165     channel->mode  = L2CAP_CHANNEL_MODE_BASIC;
3166 #endif
3167 
3168     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
3169 
3170     // process
3171     l2cap_run();
3172 }
3173 
3174 void l2cap_decline_connection(uint16_t local_cid){
3175     log_info("decline local_cid 0x%x", local_cid);
3176     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
3177     if (!channel) {
3178         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
3179         return;
3180     }
3181     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
3182     channel->reason = L2CAP_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE;
3183     l2cap_run();
3184 }
3185 
3186 // @pre command len is valid, see check in l2cap_signaling_handler_channel
3187 static void l2cap_signaling_handle_configure_request(l2cap_channel_t *channel, uint8_t *command){
3188 
3189 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3190     uint8_t use_fcs = 1;
3191 #endif
3192 
3193     channel->remote_sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3194 
3195     uint16_t flags = little_endian_read_16(command, 6);
3196     if (flags & 1) {
3197         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
3198     }
3199 
3200     // accept the other's configuration options
3201     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3202     uint16_t pos     = 8;
3203     while (pos < end_pos){
3204         uint8_t option_hint = command[pos] >> 7;
3205         uint8_t option_type = command[pos] & 0x7f;
3206         // log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
3207         pos++;
3208         uint8_t length = command[pos++];
3209         // MTU { type(8): 1, len(8):2, MTU(16) }
3210         if ((option_type == L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT) && (length == 2)){
3211             channel->remote_mtu = little_endian_read_16(command, pos);
3212             log_info("Remote MTU %u", channel->remote_mtu);
3213             if (channel->remote_mtu > l2cap_max_mtu()){
3214                 log_info("Remote MTU %u larger than outgoing buffer, only using MTU = %u", channel->remote_mtu, l2cap_max_mtu());
3215                 channel->remote_mtu = l2cap_max_mtu();
3216             }
3217             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
3218         }
3219         // Flush timeout { type(8):2, len(8): 2, Flush Timeout(16)}
3220         if ((option_type == L2CAP_CONFIG_OPTION_TYPE_FLUSH_TIMEOUT) && (length == 2)){
3221             channel->flush_timeout = little_endian_read_16(command, pos);
3222             log_info("Flush timeout: %u ms", channel->flush_timeout);
3223         }
3224 
3225 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3226         // Retransmission and Flow Control Option
3227         if (option_type == L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL && length == 9){
3228             l2cap_channel_mode_t mode = (l2cap_channel_mode_t) command[pos];
3229             switch(channel->mode){
3230                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3231                     // Store remote config
3232                     channel->remote_tx_window_size = command[pos+1];
3233                     channel->remote_max_transmit   = command[pos+2];
3234                     channel->remote_retransmission_timeout_ms = little_endian_read_16(command, pos + 3);
3235                     channel->remote_monitor_timeout_ms = little_endian_read_16(command, pos + 5);
3236                     {
3237                         uint16_t remote_mps = little_endian_read_16(command, pos + 7);
3238                         // optimize our tx buffer configuration based on actual remote mps if remote mps is smaller than planned
3239                         if (remote_mps < channel->remote_mps){
3240                             // get current tx storage
3241                             uint16_t num_bytes_per_tx_buffer_before = sizeof(l2cap_ertm_tx_packet_state_t) + channel->remote_mps;
3242                             uint16_t tx_storage = channel->num_tx_buffers * num_bytes_per_tx_buffer_before;
3243 
3244                             channel->remote_mps = remote_mps;
3245                             uint16_t num_bytes_per_tx_buffer_now = sizeof(l2cap_ertm_tx_packet_state_t) + channel->remote_mps;
3246                             channel->num_tx_buffers = tx_storage / num_bytes_per_tx_buffer_now;
3247                             uint32_t total_storage = (sizeof(l2cap_ertm_rx_packet_state_t) + channel->local_mps) * channel->num_rx_buffers + tx_storage + channel->local_mtu;
3248                             l2cap_ertm_setup_buffers(channel, (uint8_t *) channel->rx_packets_state, total_storage);
3249                         }
3250                         // limit remote mtu by our tx buffers. Include 2 bytes SDU Length
3251                         uint16_t effective_mtu = channel->remote_mps * channel->num_tx_buffers - 2;
3252                         channel->remote_mtu    = btstack_min( effective_mtu, channel->remote_mtu);
3253                     }
3254                     log_info("FC&C config: tx window: %u, max transmit %u, retrans timeout %u, monitor timeout %u, mps %u",
3255                         channel->remote_tx_window_size,
3256                         channel->remote_max_transmit,
3257                         channel->remote_retransmission_timeout_ms,
3258                         channel->remote_monitor_timeout_ms,
3259                         channel->remote_mps);
3260                     // If ERTM mandatory, but remote doens't offer ERTM -> disconnect
3261                     if (channel->ertm_mandatory && mode != L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
3262                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3263                     } else {
3264                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
3265                     }
3266                     break;
3267                 case L2CAP_CHANNEL_MODE_BASIC:
3268                     switch (mode){
3269                         case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3270                             // remote asks for ERTM, but we want basic mode. disconnect if this happens a second time
3271                             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED){
3272                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3273                             }
3274                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED);
3275                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
3276                             break;
3277                         default: // case L2CAP_CHANNEL_MODE_BASIC:
3278                             // TODO store and evaluate configuration
3279                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
3280                             break;
3281                     }
3282                     break;
3283                 default:
3284                     break;
3285             }
3286         }
3287         if (option_type == L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE && length == 1){
3288             use_fcs = command[pos];
3289         }
3290 #endif
3291         // check for unknown options
3292         if ((option_hint == 0) && ((option_type < L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT) || (option_type > L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE))){
3293             log_info("l2cap cid %u, unknown option 0x%02x", channel->local_cid, option_type);
3294             channel->unknown_option = option_type;
3295             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
3296         }
3297         pos += length;
3298     }
3299 
3300 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3301         // "FCS" has precedence over "No FCS"
3302         uint8_t update = channel->fcs_option || use_fcs;
3303         log_info("local fcs: %u, remote fcs: %u -> %u", channel->fcs_option, use_fcs, update);
3304         channel->fcs_option = update;
3305         // If ERTM mandatory, but remote didn't send Retransmission and Flowcontrol options -> disconnect
3306         if (((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM) == 0) & (channel->ertm_mandatory)){
3307             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3308         }
3309 #endif
3310 }
3311 
3312 // @pre command len is valid, see check in l2cap_signaling_handler_channel
3313 static void l2cap_signaling_handle_configure_response(l2cap_channel_t *channel, uint16_t result, uint8_t *command){
3314     log_info("l2cap_signaling_handle_configure_response");
3315 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3316     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3317     uint16_t pos     = 10;
3318     while (pos < end_pos){
3319         uint8_t option_hint = command[pos] >> 7;
3320         uint8_t option_type = command[pos] & 0x7f;
3321         // log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
3322         pos++;
3323         uint8_t length = command[pos++];
3324 
3325         // Retransmission and Flow Control Option
3326         if (option_type == L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL && length == 9){
3327             switch (channel->mode){
3328                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3329                     if (channel->ertm_mandatory){
3330                         // ??
3331                     } else {
3332                         // On 'Reject - Unacceptable Parameters' to our optional ERTM request, fall back to BASIC mode
3333                         if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
3334                             l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3335                             channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3336                         }
3337                     }
3338                     break;
3339                 case L2CAP_CHANNEL_MODE_BASIC:
3340                     if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
3341                         // On 'Reject - Unacceptable Parameters' to our Basic mode request, disconnect
3342                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3343                     }
3344                     break;
3345                 default:
3346                     break;
3347             }
3348         }
3349 
3350         // check for unknown options
3351         if (option_hint == 0 && (option_type < L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT || option_type > L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE)){
3352             log_info("l2cap cid %u, unknown option 0x%02x", channel->local_cid, option_type);
3353             channel->unknown_option = option_type;
3354             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
3355         }
3356 
3357         pos += length;
3358     }
3359 #else
3360     UNUSED(channel);  // ok: no code
3361     UNUSED(result);   // ok: no code
3362     UNUSED(command);  // ok: no code
3363 #endif
3364 }
3365 
3366 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel){
3367     // log_info("l2cap_channel_ready_for_open 0x%02x", channel->state_var);
3368     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP) == 0) return 0;
3369     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP) == 0) return 0;
3370     // addition check that fixes re-entrance issue causing l2cap event channel opened twice
3371     if (channel->state == L2CAP_STATE_OPEN) return 0;
3372     return 1;
3373 }
3374 
3375 
3376 // @pre command len is valid, see check in l2cap_signaling_handler_dispatch
3377 static void l2cap_signaling_handler_channel(l2cap_channel_t *channel, uint8_t *command){
3378 
3379     uint8_t  code       = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3380     uint8_t  identifier = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3381     uint16_t cmd_len    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3382     uint16_t result = 0;
3383 
3384     log_info("L2CAP signaling handler code %u, state %u", code, channel->state);
3385 
3386     // handle DISCONNECT REQUESTS seperately
3387     if (code == DISCONNECTION_REQUEST){
3388         l2cap_handle_disconnect_request(channel, identifier);
3389         return;
3390     }
3391 
3392     // @STATEMACHINE(l2cap)
3393     switch (channel->state) {
3394 
3395         case L2CAP_STATE_WAIT_CONNECT_RSP:
3396             switch (code){
3397                 case CONNECTION_RESPONSE:
3398                     if (cmd_len < 8){
3399                         // command imcomplete
3400                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3401                         break;
3402                     }
3403                     l2cap_stop_rtx(channel);
3404                     result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3405                     switch (result) {
3406                         case 0:
3407                             // successful connection
3408                             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3409                             channel->state = L2CAP_STATE_CONFIG;
3410                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
3411                             break;
3412                         case 1:
3413                             // connection pending. get some coffee, but start the ERTX
3414                             l2cap_start_ertx(channel);
3415                             break;
3416                         default:
3417                             // channel closed
3418                             channel->state = L2CAP_STATE_CLOSED;
3419                             // map l2cap connection response result to BTstack status enumeration
3420                             l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result);
3421 
3422                             // drop link key if security block
3423                             if ((L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result) == L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY){
3424                                 gap_drop_link_key_for_bd_addr(channel->address);
3425                             }
3426 
3427                             // discard channel
3428                             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
3429                             l2cap_free_channel_entry(channel);
3430                             break;
3431                     }
3432                     break;
3433 
3434                 default:
3435                     //@TODO: implement other signaling packets
3436                     break;
3437             }
3438             break;
3439 
3440         case L2CAP_STATE_CONFIG:
3441             switch (code) {
3442                 case CONFIGURE_REQUEST:
3443                     if (cmd_len < 4){
3444                         // command incomplete
3445                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3446                         break;
3447                     }
3448                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
3449                     l2cap_signaling_handle_configure_request(channel, command);
3450                     if (!(channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT)){
3451                         // only done if continuation not set
3452                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_REQ);
3453                     }
3454                     break;
3455                 case CONFIGURE_RESPONSE:
3456                     if (cmd_len < 6){
3457                         // command incomplete
3458                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3459                         break;
3460                     }
3461                     result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3462                     l2cap_stop_rtx(channel);
3463                     l2cap_signaling_handle_configure_response(channel, result, command);
3464                     switch (result){
3465                         case 0: // success
3466                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP);
3467                             break;
3468                         case 4: // pending
3469                             l2cap_start_ertx(channel);
3470                             break;
3471                         default:
3472 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3473                             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION && channel->ertm_mandatory){
3474                                 // remote does not offer ertm but it's required
3475                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3476                                 break;
3477                             }
3478 #endif
3479                             // retry on negative result
3480                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
3481                             break;
3482                     }
3483                     break;
3484                 default:
3485                     break;
3486             }
3487             if (l2cap_channel_ready_for_open(channel)){
3488 
3489 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3490                 // assert that packet can be stored in fragment buffers in ertm
3491                 if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
3492                     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
3493                     uint16_t usable_mtu = channel->num_tx_buffers == 1 ? effective_mps : channel->num_tx_buffers * effective_mps - 2;
3494                     if (usable_mtu < channel->remote_mtu){
3495                         log_info("Remote MTU %u > max storable ERTM packet, only using MTU = %u", channel->remote_mtu, usable_mtu);
3496                         channel->remote_mtu = usable_mtu;
3497                     }
3498                 }
3499 #endif
3500                 // for open:
3501                 channel->state = L2CAP_STATE_OPEN;
3502                 l2cap_emit_channel_opened(channel, 0);
3503             }
3504             break;
3505 
3506         case L2CAP_STATE_WAIT_DISCONNECT:
3507             switch (code) {
3508                 case DISCONNECTION_RESPONSE:
3509                     l2cap_finalize_channel_close(channel);
3510                     break;
3511                 default:
3512                     //@TODO: implement other signaling packets
3513                     break;
3514             }
3515             break;
3516 
3517         case L2CAP_STATE_CLOSED:
3518             // @TODO handle incoming requests
3519             break;
3520 
3521         case L2CAP_STATE_OPEN:
3522             //@TODO: implement other signaling packets, e.g. re-configure
3523             break;
3524         default:
3525             break;
3526     }
3527     // log_info("new state %u", channel->state);
3528 }
3529 
3530 #ifdef ENABLE_CLASSIC
3531 static void l2cap_handle_information_request_complete(hci_connection_t * connection){
3532 
3533     connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_DONE;
3534 
3535     // emit event
3536     uint8_t event[8];
3537     event[0] = L2CAP_EVENT_INFORMATION_RESPONSE;
3538     event[1] = sizeof(event) - 2;
3539     little_endian_store_16(event, 2, connection->con_handle);
3540     little_endian_store_16(event, 4, connection->l2cap_state.extended_feature_mask);
3541     little_endian_store_16(event, 6, connection->l2cap_state.fixed_channels_supported);
3542     l2cap_emit_event(event, sizeof(event));
3543 
3544     // trigger connection request
3545     btstack_linked_list_iterator_t it;
3546     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3547     while (btstack_linked_list_iterator_has_next(&it)){
3548         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3549         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3550         if (channel->con_handle != connection->con_handle) continue;
3551 
3552         // incoming connection: information request was triggered after user has accepted connection,
3553         // now: verify channel configuration, esp. if ertm will be mandatory
3554         if (channel->state == L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES){
3555             // default: continue
3556             channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
3557 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3558             if ((channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) && ((connection->l2cap_state.extended_feature_mask & 0x08) == 0)){
3559                 // ERTM not possible, select basic mode and release buffer
3560                 channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3561                 l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3562 
3563                 // bail if ERTM is mandatory
3564                 if (channel->ertm_mandatory){
3565                     // We chose 'no resources available' for "ERTM mandatory but you don't even know ERTM exists"
3566                     log_info("ERTM mandatory -> reject connection");
3567                     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
3568                     channel->reason = L2CAP_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE;
3569                 }  else {
3570                     log_info("ERTM not supported by remote -> use Basic mode");
3571                 }
3572             }
3573 #endif
3574             continue;
3575         }
3576 
3577         // outgoing connection: information request is triggered before connection request
3578         if (channel->state == L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES){
3579 
3580 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3581             // if ERTM was requested, but is not listed in extended feature mask:
3582             if ((channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) && ((connection->l2cap_state.extended_feature_mask & 0x08) == 0)){
3583 
3584                 if (channel->ertm_mandatory){
3585                     // bail if ERTM is mandatory
3586                     channel->state = L2CAP_STATE_CLOSED;
3587                     // map l2cap connection response result to BTstack status enumeration
3588                     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_ERTM_NOT_SUPPORTED);
3589                     // discard channel
3590                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
3591                     l2cap_free_channel_entry(channel);
3592                     continue;
3593 
3594                 } else {
3595                     // fallback to Basic mode
3596                     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3597                     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3598                 }
3599             }
3600 #endif
3601 
3602             // respond to connection request
3603             channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
3604             continue;
3605         }
3606     }
3607 }
3608 #endif
3609 
3610 // @pre command len is valid, see check in l2cap_acl_classic_handler
3611 static void l2cap_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t * command){
3612 
3613     hci_connection_t * connection;
3614     btstack_linked_list_iterator_t it;
3615 
3616     // get code, signal identifier and command len
3617     uint8_t code     = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3618     uint8_t sig_id   = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3619     uint16_t cmd_len = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3620 
3621     // general commands without an assigned channel
3622     switch(code) {
3623 
3624         case CONNECTION_REQUEST:
3625             if (cmd_len == 4){
3626                 uint16_t psm =        little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3627                 uint16_t source_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3628                 l2cap_handle_connection_request(handle, sig_id, psm, source_cid);
3629             } else {
3630                 l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
3631             }
3632             return;
3633 
3634         case ECHO_REQUEST:
3635             l2cap_register_signaling_response(handle, code, sig_id, 0, 0);
3636             return;
3637 
3638         case INFORMATION_REQUEST:
3639             if (cmd_len == 2) {
3640                 uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3641                 l2cap_register_signaling_response(handle, code, sig_id, 0, info_type);
3642                 return;
3643             }
3644             break;
3645 
3646         case INFORMATION_RESPONSE:
3647             connection = hci_connection_for_handle(handle);
3648             if (!connection) return;
3649             switch (connection->l2cap_state.information_state){
3650                 case L2CAP_INFORMATION_STATE_W4_EXTENDED_FEATURE_RESPONSE:
3651                     // get extended features from response if valid
3652                     if (cmd_len >= 6) {
3653                         uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3654                         uint16_t result    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3655                         if (result == 0 && info_type == L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED) {
3656                             connection->l2cap_state.extended_feature_mask = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3657                         }
3658                         log_info("extended features mask 0x%02x", connection->l2cap_state.extended_feature_mask);
3659                         if ((connection->l2cap_state.extended_feature_mask & 0x80) != 0){
3660                             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_FIXED_CHANNELS_REQUEST;
3661                         } else {
3662                             // information request complete
3663                             l2cap_handle_information_request_complete(connection);
3664                         }
3665                     }
3666                     break;
3667                 case L2CAP_INFORMATION_STATE_W4_FIXED_CHANNELS_RESPONSE:
3668                     if (cmd_len >= 12) {
3669                         uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3670                         uint16_t result    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3671                         if (result == 0 && info_type == L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED) {
3672                             connection->l2cap_state.fixed_channels_supported = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
3673                         }
3674                         log_info("fixed channels mask 0x%02x", connection->l2cap_state.fixed_channels_supported);
3675                         // information request complete
3676                         l2cap_handle_information_request_complete(connection);
3677                     }
3678                     break;
3679                 default:
3680                     break;
3681             }
3682             return;
3683 
3684 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
3685         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
3686         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
3687         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
3688         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
3689             l2cap_ecbm_signaling_handler_dispatch(handle, L2CAP_CID_SIGNALING, command, sig_id);
3690             return;
3691         case L2CAP_FLOW_CONTROL_CREDIT_INDICATION:
3692             // return if valid
3693             if (l2cap_credit_based_handle_credit_indication(handle, command, cmd_len)) return;
3694             break;
3695 
3696         case COMMAND_REJECT:
3697             btstack_linked_list_iterator_init(&it, &l2cap_channels);
3698             while (btstack_linked_list_iterator_has_next(&it)) {
3699                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3700                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3701                 if (channel->con_handle != handle) continue;
3702                 if (channel->local_sig_id != sig_id) continue;
3703                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE) continue;
3704 
3705                 // open failed
3706                 channel->state = L2CAP_STATE_CLOSED;
3707                 l2cap_ecbm_emit_channel_opened(channel,
3708                                                ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
3709                 // drop failed channel
3710                 btstack_linked_list_iterator_remove(&it);
3711                 l2cap_free_channel_entry(channel);
3712             }
3713             break;
3714 #endif
3715 
3716         default:
3717             break;
3718     }
3719 
3720     // Get potential destination CID
3721     uint16_t dest_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3722 
3723     // Find channel for this sig_id and connection handle
3724     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3725     while (btstack_linked_list_iterator_has_next(&it)){
3726         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3727         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3728         if (channel->con_handle != handle) continue;
3729         if (code & 1) {
3730             // match odd commands (responses) by previous signaling identifier
3731             if (channel->local_sig_id == sig_id) {
3732                 l2cap_signaling_handler_channel(channel, command);
3733                 return;
3734             }
3735         } else {
3736             // match even commands (requests) by local channel id
3737             if (channel->local_cid == dest_cid) {
3738                 l2cap_signaling_handler_channel(channel, command);
3739                 return;
3740             }
3741         }
3742     }
3743 
3744     // send command reject
3745     l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
3746 }
3747 #endif
3748 
3749 #ifdef L2CAP_USES_CHANNELS
3750 static l2cap_service_t * l2cap_get_service_internal(btstack_linked_list_t * services, uint16_t psm){
3751     btstack_linked_list_iterator_t it;
3752     btstack_linked_list_iterator_init(&it, services);
3753     while (btstack_linked_list_iterator_has_next(&it)){
3754         l2cap_service_t * service = (l2cap_service_t *) btstack_linked_list_iterator_next(&it);
3755         if ( service->psm == psm){
3756             return service;
3757         };
3758     }
3759     return NULL;
3760 }
3761 #endif
3762 
3763 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
3764 
3765 static uint8_t l2cap_ecbm_setup_channels(btstack_linked_list_t * channels,
3766                                          btstack_packet_handler_t packet_handler, uint8_t num_channels,
3767                                          hci_connection_t * connection, uint16_t psm, uint16_t mtu, gap_security_level_t security_level){
3768     uint8_t i;
3769     uint8_t status = ERROR_CODE_SUCCESS;
3770     for (i=0;i<num_channels;i++){
3771         l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_CHANNEL_ECBM, connection->address, connection->address_type, psm, mtu, security_level);
3772         if (!channel) {
3773             status = BTSTACK_MEMORY_ALLOC_FAILED;
3774             break;
3775         }
3776         channel->con_handle = connection->con_handle;
3777         btstack_linked_list_add_tail(channels, (btstack_linked_item_t *) channel);
3778     }
3779 
3780     // free channels if not all allocated
3781     if (status != ERROR_CODE_SUCCESS){
3782         while (true) {
3783             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_pop(channels);
3784             if (channel == NULL) break;
3785             l2cap_free_channel_entry(channel);
3786         }
3787     }
3788 
3789     return status;
3790 }
3791 
3792 static inline l2cap_service_t * l2cap_ecbm_get_service(uint16_t spsm){
3793     return l2cap_get_service_internal(&l2cap_enhanced_services, spsm);
3794 }
3795 
3796 static inline uint8_t l2cap_ecbm_status_for_result(uint16_t result) {
3797     switch (result) {
3798         case L2CAP_ECBM_CONNECTION_RESULT_ALL_SUCCESS:
3799             return ERROR_CODE_SUCCESS;
3800         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_SPSM_NOT_SUPPORTED:
3801             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_PSM;
3802         case L2CAP_ECBM_CONNECTION_RESULT_SOME_REFUSED_INSUFFICIENT_RESOURCES_AVAILABLE:
3803             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_RESOURCES;
3804         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_AUTHENTICATION:
3805         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_AUTHORIZATION:
3806         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_ENCYRPTION_KEY_SIZE_TOO_SHORT:
3807         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_ENCRYPTION:
3808             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY;
3809         default:
3810             // invalid Source CID, Source CID already allocated, unacceptable parameters
3811             return L2CAP_CONNECTION_RESPONSE_UNKNOWN_ERROR;
3812     }
3813 }
3814 
3815 static int l2cap_ecbm_signaling_handler_dispatch(hci_con_handle_t handle, uint16_t signaling_cid, uint8_t *command,
3816                                                  uint8_t sig_id) {
3817 
3818     hci_connection_t *connection;
3819     btstack_linked_list_iterator_t it;
3820     l2cap_service_t *service;
3821     uint16_t spsm;
3822     uint8_t num_channels;
3823     uint16_t num_channels_and_signaling_cid;
3824     uint8_t i;
3825     uint16_t new_mtu;
3826     uint16_t new_mps;
3827     uint16_t initial_credits;
3828     uint16_t result;
3829     uint8_t status;
3830 
3831     uint8_t code = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3832     uint16_t len = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3833     log_info("enhanced dispatch: command 0x%02x, sig id %u, len %u", code, sig_id, len);
3834 
3835     switch (code) {
3836         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
3837             // check size
3838             if (len < 10u) return 0u;
3839 
3840             // get hci connection, bail if not found (must not happen)
3841             connection = hci_connection_for_handle(handle);
3842             btstack_assert(connection != NULL);
3843 
3844             // get num channels to establish
3845             num_channels = (len - 8) / sizeof(uint16_t);
3846 
3847             // combine signaling cid and number channels for l2cap_register_signaling_response
3848             num_channels_and_signaling_cid = (num_channels << 8) | signaling_cid;
3849 
3850             // check if service registered
3851             spsm = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3852             service = l2cap_ecbm_get_service(spsm);
3853 
3854             if (service) {
3855 
3856                 uint16_t remote_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
3857                 uint16_t remote_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
3858                 uint16_t credits_outgoing = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
3859 
3860                 // param: check remote mtu
3861                 if (service->mtu > remote_mtu) {
3862                     l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3863                                                       num_channels_and_signaling_cid, L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INVALID_PARAMETERS);
3864                     return 1;
3865                 }
3866 
3867                 // security: check authentication
3868                 if (service->required_security_level >= LEVEL_3) {
3869                     if (!gap_authenticated(handle)) {
3870                         l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3871                                                           num_channels_and_signaling_cid, L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_AUTHENTICATION);
3872                         return 1;
3873                     }
3874                 }
3875 
3876                 // security: check encryption
3877                 // L2CAP.TS.p31 does not check for Connection refused - insufficient encryption which might be send for no encryption
3878                 if (service->required_security_level >= LEVEL_2) {
3879                     if (gap_encryption_key_size(handle) < 16) {
3880                         l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3881                                                           num_channels_and_signaling_cid, L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_ENCYRPTION_KEY_SIZE_TOO_SHORT);
3882                         return 1;
3883                     }
3884                 }
3885 
3886                 // report the last result code != 0
3887                 result = 0;
3888                 // store one of the local cids for the event
3889                 uint16_t a_local_cid = 0;
3890                 for (i = 0; i < num_channels; i++) {
3891 
3892                     // check source cids
3893                     uint16_t source_cid = little_endian_read_16(command, 12 + (i * 2));
3894                     if (source_cid < 0x40u) {
3895                         result = L2CAP_ECBM_CONNECTION_RESULT_SOME_REFUSED_INVALID_SOURCE_CID;
3896                         continue;
3897                     }
3898 
3899                     // go through list of channels for this ACL connection and check if we get a match
3900                     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3901                     bool source_cid_allocated = false;
3902                     while (btstack_linked_list_iterator_has_next(&it)) {
3903                         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3904                         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3905                         if (channel->con_handle != handle) continue;
3906                         if (channel->remote_cid != source_cid) continue;
3907                         source_cid_allocated = true;
3908                         break;
3909                     }
3910                     if (source_cid_allocated) {
3911                         result = 0x00a;
3912                         continue;
3913                     }
3914 
3915                     // setup channel
3916                     l2cap_channel_t *channel = l2cap_create_channel_entry(service->packet_handler,
3917                                                                           L2CAP_CHANNEL_TYPE_CHANNEL_ECBM,
3918                                                                           connection->address,
3919                                                                           connection->address_type, spsm,
3920                                                                           service->mtu,
3921                                                                           service->required_security_level);
3922 
3923                     if (channel == NULL) {
3924                         // Some connections refused – insufficient resources available
3925                         result = 0x004;
3926                         continue;
3927                     }
3928 
3929                     // setup state
3930                     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
3931                     channel->state_var |= L2CAP_CHANNEL_STATE_VAR_INCOMING;
3932                     channel->con_handle = connection->con_handle;
3933                     channel->remote_sig_id = sig_id;
3934                     channel->remote_cid = source_cid;
3935                     channel->remote_mtu = remote_mtu;
3936                     channel->remote_mps = remote_mps;
3937                     channel->credits_outgoing = credits_outgoing;
3938                     channel->cid_index = i;
3939                     channel->num_cids = num_channels;
3940 
3941                     // if more than one error, we can report any of them
3942                     channel->reason = result;
3943 
3944                     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
3945 
3946                     a_local_cid = channel->local_cid;
3947                 }
3948 
3949                 // if no channels have been created, all have been refused, and we can respond right away
3950                 if (a_local_cid == 0) {
3951                     l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3952                                                       num_channels_and_signaling_cid, result);
3953                     return 1;
3954                 }
3955 
3956                 // emit incoming data connection event
3957                 uint8_t event[16];
3958                 event[0] = L2CAP_EVENT_ECBM_INCOMING_CONNECTION;
3959                 event[1] = sizeof(event) - 2;
3960                 event[2] = connection->address_type;
3961                 reverse_bd_addr(connection->address, &event[3]);
3962                 little_endian_store_16(event, 9, connection->con_handle);
3963                 little_endian_store_16(event, 11, spsm);
3964                 event[13] = num_channels;
3965                 little_endian_store_16(event, 14, a_local_cid);
3966                 hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
3967                 (*service->packet_handler)(HCI_EVENT_PACKET, a_local_cid, event, sizeof(event));
3968 
3969             } else {
3970                 l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3971                                                   num_channels_and_signaling_cid, L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_SPSM_NOT_SUPPORTED);
3972             }
3973             return 1;
3974 
3975         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
3976             // check size
3977             if (len < 10u) return 0u;
3978 
3979             // get hci connection, ignore if not found
3980             connection = hci_connection_for_handle(handle);
3981             if (connection == NULL) return 0;
3982 
3983             // get channel config: mtu, mps, initial credits, result
3984             new_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
3985             new_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
3986             initial_credits = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
3987             result = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
3988             status = l2cap_ecbm_status_for_result(result);
3989 
3990             // get num channels to modify
3991             num_channels = (len - 8) / sizeof(uint16_t);
3992             btstack_linked_list_iterator_init(&it, &l2cap_channels);
3993             while (btstack_linked_list_iterator_has_next(&it)) {
3994                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3995                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3996                 if (channel->con_handle != handle) continue;
3997                 if (channel->local_sig_id != sig_id) continue;
3998                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE) continue;
3999                 if (channel->cid_index < num_channels) {
4000                     uint16_t remote_cid = little_endian_read_16(command, 12 + channel->cid_index * sizeof(uint16_t));
4001                     if (remote_cid != 0) {
4002                         channel->state = L2CAP_STATE_OPEN;
4003                         channel->remote_cid = remote_cid;
4004                         channel->remote_mtu = new_mtu;
4005                         channel->remote_mps = new_mps;
4006                         channel->credits_outgoing = initial_credits;
4007                         l2cap_ecbm_emit_channel_opened(channel, ERROR_CODE_SUCCESS);
4008                         continue;
4009                     }
4010                 }
4011                 // open failed
4012                 l2cap_ecbm_emit_channel_opened(channel, status);
4013                 // drop failed channel
4014                 btstack_linked_list_iterator_remove(&it);
4015                 btstack_memory_l2cap_channel_free(channel);
4016             }
4017             return 1;
4018 
4019         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
4020             // check minimal size
4021             if (len < 6) return 0u;
4022 
4023             // get hci connection, bail if not found (must not happen)
4024             connection = hci_connection_for_handle(handle);
4025             btstack_assert(connection != NULL);
4026 
4027             // get num channels to modify
4028             num_channels = (len - 4) / sizeof(uint16_t);
4029 
4030             // get new mtu and mps
4031             new_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4032             new_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
4033 
4034             // validate request
4035             result = 0;
4036             for (i = 0; i < num_channels; i++) {
4037                 // check cid
4038                 uint16_t remote_cid = little_endian_read_16(command, 8 + (i * sizeof(uint16_t)));
4039                 l2cap_channel_t *channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
4040                 if (channel == NULL) {
4041                     result = L2CAP_ECBM_RECONFIGURE_FAILED_DESTINATION_CID_INVALID;
4042                     break;
4043                 }
4044                 // check MTU is not reduced
4045                 if (channel->remote_mtu > new_mtu) {
4046                     result = L2CAP_ECBM_RECONFIGURE_FAILED_MTU_REDUCTION_NOT_ALLOWED;
4047                     break;
4048                 }
4049                 // check MPS reduction
4050                 if ((num_channels > 1) && (channel->remote_mps > new_mps)) {
4051                     result = L2CAP_ECBM_RECONFIGURE_FAILED_MPS_REDUCTION_MULTIPLE_CHANNELS;
4052                     break;
4053                 }
4054                 // check MPS valid
4055                 if (new_mps < l2cap_enhanced_mps_min) {
4056                     result = L2CAP_ECBM_RECONFIGURE_FAILED_UNACCEPTABLE_PARAMETERS;
4057                     break;
4058                 }
4059             }
4060 
4061             // send reject
4062             if (result != 0) {
4063                 l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST, sig_id, signaling_cid,
4064                                                   result);
4065                 return 1;
4066             }
4067 
4068             // update channels
4069             for (i = 0; i < num_channels; i++) {
4070                 uint16_t remote_cid = little_endian_read_16(command, 8 + (i * sizeof(uint16_t)));
4071                 l2cap_channel_t *channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
4072                 channel->remote_mps = new_mps;
4073                 channel->remote_mtu = new_mtu;
4074                 // emit event
4075                 uint8_t event[8];
4076                 event[0] = L2CAP_EVENT_ECBM_RECONFIGURED;
4077                 event[1] = sizeof(event) - 2;
4078                 little_endian_store_16(event, 2, channel->local_cid);
4079                 little_endian_store_16(event, 4, new_mtu);
4080                 little_endian_store_16(event, 6, new_mps);
4081                 l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
4082             }
4083 
4084             // send accept
4085             l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST, sig_id, signaling_cid, 0);
4086             return 1;
4087 
4088         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
4089             // check size
4090             if (len < 2u) return 0u;
4091 
4092             result = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4093             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4094             while (btstack_linked_list_iterator_has_next(&it)) {
4095                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4096                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
4097                 if (channel->con_handle != handle) continue;
4098                 if (channel->local_sig_id != sig_id) continue;
4099                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE) continue;
4100                 // complete request
4101                 if (result == 0) {
4102                     channel->receive_sdu_buffer = channel->renegotiate_sdu_buffer;
4103                     channel->local_mtu = channel->renegotiate_mtu;
4104                 }
4105                 channel->state = L2CAP_STATE_OPEN;
4106                 // emit event
4107                 l2cap_ecbm_emit_reconfigure_complete(channel, result);
4108             }
4109             break;
4110 
4111         default:
4112             btstack_unreachable();
4113             break;
4114     }
4115     return 0;
4116 }
4117 
4118 #endif
4119 
4120 #ifdef ENABLE_BLE
4121 
4122 static void l2cap_emit_connection_parameter_update_response(hci_con_handle_t con_handle, uint16_t result){
4123     uint8_t event[6];
4124     event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_RESPONSE;
4125     event[1] = 4;
4126     little_endian_store_16(event, 2, con_handle);
4127     little_endian_store_16(event, 4, result);
4128     l2cap_emit_event(event, sizeof(event));
4129 }
4130 
4131 // @return valid
4132 static int l2cap_le_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t * command, uint8_t sig_id){
4133     hci_connection_t * connection;
4134     uint16_t result;
4135     uint8_t  event[12];
4136 
4137 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4138     l2cap_channel_t * channel;
4139     btstack_linked_list_iterator_t it;
4140 #endif
4141 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4142     uint16_t local_cid;
4143     uint16_t le_psm;
4144     l2cap_service_t * service;
4145     uint16_t source_cid;
4146 #endif
4147 
4148     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
4149     uint16_t len   = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
4150     log_info("le dispatch: command 0x%02x, sig id %u, len %u", code, sig_id, len);
4151 
4152     switch (code){
4153 
4154         case CONNECTION_PARAMETER_UPDATE_REQUEST:
4155             // check size
4156             if (len < 8u) return 0u;
4157             connection = hci_connection_for_handle(handle);
4158             if (connection != NULL){
4159                 if (connection->role != HCI_ROLE_MASTER){
4160                     // reject command without notifying upper layer when not in master role
4161                     return 0;
4162                 }
4163                 le_connection_parameter_range_t existing_range;
4164                 gap_get_connection_parameter_range(&existing_range);
4165                 uint16_t le_conn_interval_min   = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
4166                 uint16_t le_conn_interval_max   = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
4167                 uint16_t le_conn_latency        = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
4168                 uint16_t le_supervision_timeout = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+6);
4169 
4170                 int update_parameter = gap_connection_parameter_range_included(&existing_range, le_conn_interval_min, le_conn_interval_max, le_conn_latency, le_supervision_timeout);
4171                 if (update_parameter){
4172                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_SEND_RESPONSE;
4173                     connection->le_conn_interval_min = le_conn_interval_min;
4174                     connection->le_conn_interval_max = le_conn_interval_max;
4175                     connection->le_conn_latency = le_conn_latency;
4176                     connection->le_supervision_timeout = le_supervision_timeout;
4177                 } else {
4178                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_DENY;
4179                 }
4180                 connection->le_con_param_update_identifier = sig_id;
4181             }
4182 
4183             event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_REQUEST;
4184             event[1] = 10;
4185             little_endian_store_16(event, 2, handle);
4186             (void)memcpy(&event[4], &command[4], 8);
4187             l2cap_emit_event(event, sizeof(event));
4188             break;
4189 
4190         case CONNECTION_PARAMETER_UPDATE_RESPONSE:
4191             // check size
4192             if (len < 2u) return 0u;
4193             result = little_endian_read_16(command, 4);
4194             l2cap_emit_connection_parameter_update_response(handle, result);
4195             break;
4196 
4197 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
4198         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
4199         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
4200         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
4201         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
4202             return l2cap_ecbm_signaling_handler_dispatch(handle, L2CAP_CID_SIGNALING_LE, command, sig_id);
4203 #endif
4204 
4205 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4206         case COMMAND_REJECT:
4207             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4208             while (btstack_linked_list_iterator_has_next(&it)){
4209                 channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4210                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
4211                 if (channel->con_handle   != handle) continue;
4212                 if (channel->local_sig_id != sig_id) continue;
4213 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4214                 // if received while waiting for le connection response, assume legacy device
4215                 if (channel->state == L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE){
4216                     channel->state = L2CAP_STATE_CLOSED;
4217                     // no official value for this, use: Connection refused – LE_PSM not supported
4218                     l2cap_cbm_emit_channel_opened(channel, L2CAP_CBM_CONNECTION_RESULT_SPSM_NOT_SUPPORTED);
4219 
4220                     // discard channel
4221                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4222                     l2cap_free_channel_entry(channel);
4223                     continue;
4224                 }
4225 #endif
4226 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
4227                 // if received while waiting for le connection response, assume legacy device
4228                 if (channel->state == L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE){
4229                     channel->state = L2CAP_STATE_CLOSED;
4230                     // treat as SPSM not supported
4231                     l2cap_ecbm_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_PSM);
4232 
4233                     // discard channel
4234                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4235                     l2cap_free_channel_entry(channel);
4236                     continue;
4237                 }
4238 #endif
4239             }
4240             break;
4241 #endif
4242 
4243 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4244         case LE_CREDIT_BASED_CONNECTION_REQUEST:
4245             // check size
4246             if (len < 10u) return 0u;
4247 
4248             // get hci connection, bail if not found (must not happen)
4249             connection = hci_connection_for_handle(handle);
4250             if (!connection) return 0;
4251 
4252             // check if service registered
4253             le_psm  = little_endian_read_16(command, 4);
4254             service = l2cap_cbm_get_service(le_psm);
4255             source_cid = little_endian_read_16(command, 6);
4256 
4257             if (service){
4258                 if (source_cid < 0x40u){
4259                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_INVALID_SOURCE_CID);
4260                     return 1;
4261                 }
4262 
4263                 // go through list of channels for this ACL connection and check if we get a match
4264                 btstack_linked_list_iterator_init(&it, &l2cap_channels);
4265                 while (btstack_linked_list_iterator_has_next(&it)){
4266                     l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4267                     if (!l2cap_is_dynamic_channel_type(a_channel->channel_type)) continue;
4268                     if (a_channel->con_handle != handle) continue;
4269                     if (a_channel->remote_cid != source_cid) continue;
4270                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_SOURCE_CID_ALREADY_ALLOCATED);
4271                     return 1;
4272                 }
4273 
4274                 // security: check encryption
4275                 if (service->required_security_level >= LEVEL_2){
4276                     if (gap_encryption_key_size(handle) == 0){
4277                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_ENCRYPTION);
4278                         return 1;
4279                     }
4280                     // anything less than 16 byte key size is insufficient
4281                     if (gap_encryption_key_size(handle) < 16){
4282                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_ENCYRPTION_KEY_SIZE_TOO_SHORT);
4283                         return 1;
4284                     }
4285                 }
4286 
4287                 // security: check authentication
4288                 if (service->required_security_level >= LEVEL_3){
4289                     if (!gap_authenticated(handle)){
4290                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_AUTHENTICATION);
4291                         return 1;
4292                     }
4293                 }
4294 
4295                 // security: check authorization
4296                 if (service->required_security_level >= LEVEL_4){
4297                     if (gap_authorization_state(handle) != AUTHORIZATION_GRANTED){
4298                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_AUTHORIZATION);
4299                         return 1;
4300                     }
4301                 }
4302 
4303                 // allocate channel
4304                 channel = l2cap_create_channel_entry(service->packet_handler, L2CAP_CHANNEL_TYPE_CHANNEL_CBM, connection->address,
4305                                                      BD_ADDR_TYPE_LE_RANDOM, le_psm, service->mtu, service->required_security_level);
4306                 if (!channel){
4307                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE);
4308                     return 1;
4309                 }
4310 
4311                 channel->con_handle = handle;
4312                 channel->remote_cid = source_cid;
4313                 channel->remote_sig_id = sig_id;
4314                 channel->remote_mtu = little_endian_read_16(command, 8);
4315                 channel->remote_mps = little_endian_read_16(command, 10);
4316                 channel->credits_outgoing = little_endian_read_16(command, 12);
4317 
4318                 // set initial state
4319                 channel->state      = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
4320                 channel->state_var |= L2CAP_CHANNEL_STATE_VAR_INCOMING;
4321 
4322                 // add to connections list
4323                 btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
4324 
4325                 // post connection request event
4326                 l2cap_cbm_emit_incoming_connection(channel);
4327 
4328             } else {
4329                 l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_SPSM_NOT_SUPPORTED);
4330             }
4331             break;
4332 
4333         case LE_CREDIT_BASED_CONNECTION_RESPONSE:
4334             // check size
4335             if (len < 10u) return 0u;
4336 
4337             // Find channel for this sig_id and connection handle
4338             channel = NULL;
4339             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4340             while (btstack_linked_list_iterator_has_next(&it)){
4341                 l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4342                 if (!l2cap_is_dynamic_channel_type(a_channel->channel_type)) continue;
4343                 if (a_channel->con_handle   != handle) continue;
4344                 if (a_channel->local_sig_id != sig_id) continue;
4345                 channel = a_channel;
4346                 break;
4347             }
4348             if (!channel) break;
4349 
4350             // cid + 0
4351             result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+8);
4352             if (result){
4353                 channel->state = L2CAP_STATE_CLOSED;
4354                 uint8_t status = l2cap_cbm_status_for_result(result);
4355                 l2cap_cbm_emit_channel_opened(channel, status);
4356 
4357                 // discard channel
4358                 btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4359                 l2cap_free_channel_entry(channel);
4360                 break;
4361             }
4362 
4363             // success
4364             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4365             channel->remote_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
4366             channel->remote_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
4367             channel->credits_outgoing = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
4368             channel->state = L2CAP_STATE_OPEN;
4369             l2cap_cbm_emit_channel_opened(channel, ERROR_CODE_SUCCESS);
4370             break;
4371 #endif
4372 
4373 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4374         case L2CAP_FLOW_CONTROL_CREDIT_INDICATION:
4375             return l2cap_credit_based_handle_credit_indication(handle, command, len) ? 1 : 0;
4376 
4377         case DISCONNECTION_REQUEST:
4378 
4379             // check size
4380             if (len < 4u) return 0u;
4381 
4382             // find channel
4383             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4384             channel = l2cap_get_channel_for_local_cid_and_handle(local_cid, handle);
4385             if (!channel) {
4386                 log_error("credit: no channel for cid 0x%02x", local_cid);
4387                 break;
4388             }
4389             channel->remote_sig_id = sig_id;
4390             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
4391             break;
4392 
4393         case DISCONNECTION_RESPONSE:
4394             // check size
4395             if (len < 4u) return 0u;
4396 
4397             // find channel
4398             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4399             channel = l2cap_get_channel_for_local_cid_and_handle(local_cid, handle);
4400             if (!channel) break;
4401             if (channel->local_sig_id == sig_id) {
4402                 if (channel->state == L2CAP_STATE_WAIT_DISCONNECT){
4403                     l2cap_finalize_channel_close(channel);
4404                 }
4405             }
4406             break;
4407 #endif
4408 
4409         default:
4410             // command unknown -> reject command
4411             return 0;
4412     }
4413     return 1;
4414 }
4415 #endif
4416 
4417 #ifdef ENABLE_CLASSIC
4418 static void l2cap_acl_classic_handler_for_channel(l2cap_channel_t * l2cap_channel, uint8_t * packet, uint16_t size){
4419 
4420     // forward data only in OPEN state
4421     if (l2cap_channel->state != L2CAP_STATE_OPEN) return;
4422 
4423 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4424     if (l2cap_channel->channel_type == L2CAP_CHANNEL_TYPE_CHANNEL_ECBM){
4425         l2cap_credit_based_handle_pdu(l2cap_channel, packet, size);
4426         return;
4427     }
4428 #endif
4429 
4430 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
4431     if (l2cap_channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
4432 
4433         int fcs_size = l2cap_channel->fcs_option ? 2 : 0;
4434 
4435         // assert control + FCS fields are inside
4436         if (size < COMPLETE_L2CAP_HEADER+2+fcs_size) return;
4437 
4438         if (l2cap_channel->fcs_option){
4439             // verify FCS (required if one side requested it)
4440             uint16_t fcs_calculated = crc16_calc(&packet[4], size - (4+2));
4441             uint16_t fcs_packet     = little_endian_read_16(packet, size-2);
4442 
4443 #ifdef L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL
4444             // simulate fcs error
4445             static int counter = 0;
4446             if (++counter == L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL) {
4447                 log_info("Simulate fcs error");
4448                 fcs_calculated++;
4449                 counter = 0;
4450             }
4451 #endif
4452 
4453             if (fcs_calculated == fcs_packet){
4454                 log_info("Packet FCS 0x%04x verified", fcs_packet);
4455             } else {
4456                 log_error("FCS mismatch! Packet 0x%04x, calculated 0x%04x", fcs_packet, fcs_calculated);
4457                 // ERTM State Machine in Bluetooth Spec does not handle 'I-Frame with invalid FCS'
4458                 return;
4459             }
4460         }
4461 
4462         // switch on packet type
4463         uint16_t control = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
4464         uint8_t  req_seq = (control >> 8) & 0x3f;
4465         int final = (control >> 7) & 0x01;
4466         if (control & 1){
4467             // S-Frame
4468             int poll  = (control >> 4) & 0x01;
4469             l2cap_supervisory_function_t s = (l2cap_supervisory_function_t) ((control >> 2) & 0x03);
4470             log_info("Control: 0x%04x => Supervisory function %u, ReqSeq %02u", control, (int) s, req_seq);
4471             l2cap_ertm_tx_packet_state_t * tx_state;
4472             switch (s){
4473                 case L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY:
4474                     log_info("L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY");
4475                     l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4476                     if (poll && final){
4477                         // S-frames shall not be transmitted with both the F-bit and the P-bit set to 1 at the same time.
4478                         log_error("P=F=1 in S-Frame");
4479                         break;
4480                     }
4481                     if (poll){
4482                         // check if we did request selective retransmission before <==> we have stored SDU segments
4483                         int i;
4484                         int num_stored_out_of_order_packets = 0;
4485                         for (i=0;i<l2cap_channel->num_rx_buffers;i++){
4486                             int index = l2cap_channel->rx_store_index + i;
4487                             if (index >= l2cap_channel->num_rx_buffers){
4488                                 index -= l2cap_channel->num_rx_buffers;
4489                             }
4490                             l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
4491                             if (!rx_state->valid) continue;
4492                             num_stored_out_of_order_packets++;
4493                         }
4494                         if (num_stored_out_of_order_packets){
4495                             l2cap_channel->send_supervisor_frame_selective_reject = 1;
4496                         } else {
4497                             l2cap_channel->send_supervisor_frame_receiver_ready   = 1;
4498                         }
4499                         l2cap_channel->set_final_bit_after_packet_with_poll_bit_set = 1;
4500                     }
4501                     if (final){
4502                         // Stop-MonitorTimer
4503                         l2cap_ertm_stop_monitor_timer(l2cap_channel);
4504                         // If UnackedFrames > 0 then Start-RetransTimer
4505                         if (l2cap_channel->unacked_frames){
4506                             l2cap_ertm_start_retransmission_timer(l2cap_channel);
4507                         }
4508                         // final bit set <- response to RR with poll bit set. All not acknowledged packets need to be retransmitted
4509                         l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4510                     }
4511                     break;
4512                 case L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT:
4513                     log_info("L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT");
4514                     l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4515                     // restart transmittion from last unacknowledted packet (earlier packets already freed in l2cap_ertm_process_req_seq)
4516                     l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4517                     break;
4518                 case L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY:
4519                     log_error("L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY");
4520                     break;
4521                 case L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT:
4522                     log_info("L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT");
4523                     if (poll){
4524                         l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4525                     }
4526                     // find requested i-frame
4527                     tx_state = l2cap_ertm_get_tx_state(l2cap_channel, req_seq);
4528                     if (tx_state){
4529                         log_info("Retransmission for tx_seq %u requested", req_seq);
4530                         l2cap_channel->set_final_bit_after_packet_with_poll_bit_set = poll;
4531                         tx_state->retransmission_requested = 1;
4532                         l2cap_channel->srej_active = 1;
4533                     }
4534                     break;
4535                 default:
4536                     break;
4537             }
4538         } else {
4539             // I-Frame
4540             // get control
4541             l2cap_segmentation_and_reassembly_t sar = (l2cap_segmentation_and_reassembly_t) (control >> 14);
4542             uint8_t tx_seq = (control >> 1) & 0x3f;
4543             log_info("Control: 0x%04x => SAR %u, ReqSeq %02u, R?, TxSeq %02u", control, (int) sar, req_seq, tx_seq);
4544             log_info("SAR: pos %u", l2cap_channel->reassembly_pos);
4545             log_info("State: expected_tx_seq %02u, req_seq %02u", l2cap_channel->expected_tx_seq, l2cap_channel->req_seq);
4546             l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4547             if (final){
4548                 // final bit set <- response to RR with poll bit set. All not acknowledged packets need to be retransmitted
4549                 l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4550             }
4551 
4552             // get SDU
4553             const uint8_t * payload_data = &packet[COMPLETE_L2CAP_HEADER+2];
4554             uint16_t        payload_len  = size-(COMPLETE_L2CAP_HEADER+2+fcs_size);
4555 
4556             // assert SDU size is smaller or equal to our buffers
4557             uint16_t max_payload_size = 0;
4558             switch (sar){
4559                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU:
4560                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
4561                     // SDU Length + MPS
4562                     max_payload_size = l2cap_channel->local_mps + 2;
4563                     break;
4564                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
4565                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU:
4566                     max_payload_size = l2cap_channel->local_mps;
4567                     break;
4568                 default:
4569                     btstack_assert(false);
4570                     break;
4571             }
4572             if (payload_len > max_payload_size){
4573                 log_info("payload len %u > max payload %u -> drop packet", payload_len, max_payload_size);
4574                 return;
4575             }
4576 
4577             // check ordering
4578             if (l2cap_channel->expected_tx_seq == tx_seq){
4579                 log_info("Received expected frame with TxSeq == ExpectedTxSeq == %02u", tx_seq);
4580                 l2cap_channel->expected_tx_seq = l2cap_next_ertm_seq_nr(l2cap_channel->expected_tx_seq);
4581                 l2cap_channel->req_seq         = l2cap_channel->expected_tx_seq;
4582 
4583                 // process SDU
4584                 l2cap_ertm_handle_in_sequence_sdu(l2cap_channel, sar, payload_data, payload_len);
4585 
4586                 // process stored segments
4587                 while (true){
4588                     int index = l2cap_channel->rx_store_index;
4589                     l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
4590                     if (!rx_state->valid) break;
4591 
4592                     log_info("Processing stored frame with TxSeq == ExpectedTxSeq == %02u", l2cap_channel->expected_tx_seq);
4593                     l2cap_channel->expected_tx_seq = l2cap_next_ertm_seq_nr(l2cap_channel->expected_tx_seq);
4594                     l2cap_channel->req_seq         = l2cap_channel->expected_tx_seq;
4595 
4596                     rx_state->valid = 0;
4597                     l2cap_ertm_handle_in_sequence_sdu(l2cap_channel, rx_state->sar, &l2cap_channel->rx_packets_data[index], rx_state->len);
4598 
4599                     // update rx store index
4600                     index++;
4601                     if (index >= l2cap_channel->num_rx_buffers){
4602                         index = 0;
4603                     }
4604                     l2cap_channel->rx_store_index = index;
4605                 }
4606 
4607                 //
4608                 l2cap_channel->send_supervisor_frame_receiver_ready = 1;
4609 
4610             } else {
4611                 int delta = (tx_seq - l2cap_channel->expected_tx_seq) & 0x3f;
4612                 if (delta < 2){
4613                     // store segment
4614                     l2cap_ertm_handle_out_of_sequence_sdu(l2cap_channel, sar, delta, payload_data, payload_len);
4615 
4616                     log_info("Received unexpected frame TxSeq %u but expected %u -> send S-SREJ", tx_seq, l2cap_channel->expected_tx_seq);
4617                     l2cap_channel->send_supervisor_frame_selective_reject = 1;
4618                 } else {
4619                     log_info("Received unexpected frame TxSeq %u but expected %u -> send S-REJ", tx_seq, l2cap_channel->expected_tx_seq);
4620                     l2cap_channel->send_supervisor_frame_reject = 1;
4621                 }
4622             }
4623         }
4624         return;
4625     }
4626 #endif
4627 
4628     // check size
4629     uint16_t payload_size = size - COMPLETE_L2CAP_HEADER;
4630     if (l2cap_channel->local_mtu < payload_size) return;
4631 
4632     l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, &packet[COMPLETE_L2CAP_HEADER], payload_size);
4633 }
4634 #endif
4635 
4636 static void l2cap_acl_classic_handler(hci_con_handle_t handle, uint8_t *packet, uint16_t size){
4637 #ifdef ENABLE_CLASSIC
4638     l2cap_channel_t * l2cap_channel;
4639     l2cap_fixed_channel_t * l2cap_fixed_channel;
4640 
4641     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
4642     uint8_t  broadcast_flag = READ_ACL_FLAGS(packet) >> 2;
4643     switch (channel_id) {
4644 
4645         case L2CAP_CID_SIGNALING: {
4646             if (broadcast_flag != 0) break;
4647             uint32_t command_offset = 8;
4648             while ((command_offset + L2CAP_SIGNALING_COMMAND_DATA_OFFSET) < size) {
4649                 // assert signaling command is fully inside packet
4650                 uint16_t data_len = little_endian_read_16(packet, command_offset + L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
4651                 uint32_t next_command_offset = command_offset + L2CAP_SIGNALING_COMMAND_DATA_OFFSET + data_len;
4652                 if (next_command_offset > size){
4653                     log_error("l2cap signaling command len invalid -> drop");
4654                     break;
4655                 }
4656                 // handle signaling command
4657                 l2cap_signaling_handler_dispatch(handle, &packet[command_offset]);
4658                 // go to next command
4659                 command_offset = next_command_offset;
4660             }
4661             break;
4662         }
4663 
4664         case L2CAP_CID_CONNECTIONLESS_CHANNEL:
4665             if (broadcast_flag == 0) break;
4666             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_CONNECTIONLESS_CHANNEL);
4667             if (!l2cap_fixed_channel) break;
4668             if (!l2cap_fixed_channel->packet_handler) break;
4669             (*l2cap_fixed_channel->packet_handler)(UCD_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4670             break;
4671 
4672 #ifdef ENABLE_BLE
4673         case L2CAP_CID_BR_EDR_SECURITY_MANAGER:
4674             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_BR_EDR_SECURITY_MANAGER);
4675             if ((l2cap_fixed_channel == NULL) || (l2cap_fixed_channel->packet_handler == NULL)){
4676                 // Pairing Failed
4677                 l2cap_register_signaling_response(handle, (uint8_t) SM_PAIRING_FAILED, 0, L2CAP_CID_BR_EDR_SECURITY_MANAGER, SM_REASON_PAIRING_NOT_SUPPORTED);
4678             } else {
4679                 (*l2cap_fixed_channel->packet_handler)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4680             }
4681             break;
4682 #endif
4683 
4684         default:
4685             if (broadcast_flag != 0) break;
4686             // Find channel for this channel_id and connection handle
4687             l2cap_channel = l2cap_get_channel_for_local_cid_and_handle(channel_id, handle);
4688             if (l2cap_channel != NULL){
4689                 l2cap_acl_classic_handler_for_channel(l2cap_channel, packet, size);
4690             }
4691             break;
4692     }
4693 #else
4694     UNUSED(handle); // ok: no code
4695     UNUSED(packet); // ok: no code
4696     UNUSED(size);   // ok: no code
4697 #endif
4698 }
4699 
4700 static void l2cap_acl_le_handler(hci_con_handle_t handle, uint8_t *packet, uint16_t size){
4701 #ifdef ENABLE_BLE
4702 
4703     l2cap_fixed_channel_t * l2cap_fixed_channel;
4704 
4705 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4706     l2cap_channel_t * l2cap_channel;
4707 #endif
4708     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
4709     switch (channel_id) {
4710 
4711         case L2CAP_CID_SIGNALING_LE: {
4712             uint8_t sig_id = packet[COMPLETE_L2CAP_HEADER + 1];
4713             uint16_t len = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER + 2);
4714             if ((COMPLETE_L2CAP_HEADER + 4u + len) > size) break;
4715             int      valid  = l2cap_le_signaling_handler_dispatch(handle, &packet[COMPLETE_L2CAP_HEADER], sig_id);
4716             if (!valid){
4717                 l2cap_register_signaling_response(handle, COMMAND_REJECT_LE, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
4718             }
4719             break;
4720         }
4721 
4722         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
4723             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_ATTRIBUTE_PROTOCOL);
4724             if (!l2cap_fixed_channel) break;
4725             if (!l2cap_fixed_channel->packet_handler) break;
4726             (*l2cap_fixed_channel->packet_handler)(ATT_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4727             break;
4728 
4729         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
4730             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
4731             if ((l2cap_fixed_channel == NULL) || (l2cap_fixed_channel->packet_handler == NULL)){
4732                 // Pairing Failed
4733                 l2cap_register_signaling_response(handle, (uint8_t) SM_PAIRING_FAILED, 0, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, SM_REASON_PAIRING_NOT_SUPPORTED);
4734             } else {
4735                 (*l2cap_fixed_channel->packet_handler)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4736             }
4737             break;
4738 
4739         default:
4740 
4741 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4742             l2cap_channel = l2cap_get_channel_for_local_cid_and_handle(channel_id, handle);
4743             if (l2cap_channel != NULL) {
4744                 l2cap_credit_based_handle_pdu(l2cap_channel, packet, size);
4745             }
4746 #endif
4747             break;
4748     }
4749 #else
4750     UNUSED(handle); // ok: no code
4751     UNUSED(packet); // ok: no code
4752     UNUSED(size);   // ok: no code
4753 #endif
4754 }
4755 
4756 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
4757     UNUSED(packet_type);    // ok: registered with hci_register_acl_packet_handler
4758     UNUSED(channel);        // ok: there is no channel
4759 
4760     // Assert full L2CAP header present
4761     if (size < COMPLETE_L2CAP_HEADER) return;
4762 
4763     // Dispatch to Classic or LE handler (SCO packets are not dispatched to L2CAP)
4764     hci_con_handle_t handle = READ_ACL_CONNECTION_HANDLE(packet);
4765     hci_connection_t *conn = hci_connection_for_handle(handle);
4766     if (!conn) return;
4767     if (conn->address_type == BD_ADDR_TYPE_ACL){
4768         l2cap_acl_classic_handler(handle, packet, size);
4769     } else {
4770         l2cap_acl_le_handler(handle, packet, size);
4771     }
4772 
4773     l2cap_run();
4774 }
4775 
4776 // Bluetooth 4.0 - allows to register handler for Attribute Protocol and Security Manager Protocol
4777 void l2cap_register_fixed_channel(btstack_packet_handler_t packet_handler, uint16_t channel_id) {
4778     l2cap_fixed_channel_t * channel = l2cap_fixed_channel_for_channel_id(channel_id);
4779     if (!channel) return;
4780     channel->packet_handler = packet_handler;
4781 }
4782 
4783 #ifdef L2CAP_USES_CHANNELS
4784 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
4785 void l2cap_finalize_channel_close(l2cap_channel_t * channel){
4786     channel->state = L2CAP_STATE_CLOSED;
4787     l2cap_handle_channel_closed(channel);
4788     // discard channel
4789     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4790     l2cap_free_channel_entry(channel);
4791 }
4792 #endif
4793 
4794 #ifdef ENABLE_CLASSIC
4795 static inline l2cap_service_t * l2cap_get_service(uint16_t psm){
4796     return l2cap_get_service_internal(&l2cap_services, psm);
4797 }
4798 
4799 static void l2cap_update_minimal_security_level(void){
4800     // update minimal service security level
4801     gap_security_level_t minimal_level = LEVEL_1;
4802     btstack_linked_list_iterator_t it;
4803     btstack_linked_list_iterator_init(&it, &l2cap_services);
4804     while (btstack_linked_list_iterator_has_next(&it)){
4805         l2cap_service_t * service = (l2cap_service_t *) btstack_linked_list_iterator_next(&it);
4806         if (service->required_security_level > minimal_level){
4807             minimal_level = service->required_security_level;
4808         };
4809     }
4810     gap_set_minimal_service_security_level(minimal_level);
4811 }
4812 
4813 uint8_t l2cap_register_service(btstack_packet_handler_t service_packet_handler, uint16_t psm, uint16_t mtu, gap_security_level_t security_level){
4814 
4815     log_info("L2CAP_REGISTER_SERVICE psm 0x%x mtu %u", psm, mtu);
4816 
4817     // check for alread registered psm
4818     l2cap_service_t *service = l2cap_get_service(psm);
4819     if (service) {
4820         log_error("register: PSM %u already registered", psm);
4821         return L2CAP_SERVICE_ALREADY_REGISTERED;
4822     }
4823 
4824     // alloc structure
4825     service = btstack_memory_l2cap_service_get();
4826     if (!service) {
4827         log_error("register: no memory for l2cap_service_t");
4828         return BTSTACK_MEMORY_ALLOC_FAILED;
4829     }
4830 
4831     // fill in
4832     service->psm = psm;
4833     service->mtu = mtu;
4834     service->packet_handler = service_packet_handler;
4835     service->required_security_level = security_level;
4836 
4837     // add to services list
4838     btstack_linked_list_add(&l2cap_services, (btstack_linked_item_t *) service);
4839 
4840     l2cap_update_minimal_security_level();
4841 
4842 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
4843     // enable page scan
4844     gap_connectable_control(1);
4845 #endif
4846 
4847 
4848     return ERROR_CODE_SUCCESS;
4849 }
4850 
4851 uint8_t l2cap_unregister_service(uint16_t psm){
4852 
4853     log_info("unregister psm 0x%x", psm);
4854 
4855     l2cap_service_t *service = l2cap_get_service(psm);
4856     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
4857     btstack_linked_list_remove(&l2cap_services, (btstack_linked_item_t *) service);
4858     btstack_memory_l2cap_service_free(service);
4859 
4860     l2cap_update_minimal_security_level();
4861 
4862 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
4863     // disable page scan when no services registered
4864     if (btstack_linked_list_empty(&l2cap_services)) {
4865         gap_connectable_control(0);
4866     }
4867 #endif
4868 
4869     return ERROR_CODE_SUCCESS;
4870 }
4871 #endif
4872 
4873 
4874 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4875 
4876 static void l2cap_credit_based_send_pdu(l2cap_channel_t *channel) {
4877     btstack_assert(channel != NULL);
4878     btstack_assert(channel->send_sdu_buffer != NULL);
4879     btstack_assert(channel->credits_outgoing > 0);
4880 
4881     // send part of SDU
4882     hci_reserve_packet_buffer();
4883     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
4884     uint8_t *l2cap_payload = acl_buffer + 8;
4885     uint16_t pos = 0;
4886     if (!channel->send_sdu_pos) {
4887         // store SDU len
4888         channel->send_sdu_pos += 2u;
4889         little_endian_store_16(l2cap_payload, pos, channel->send_sdu_len);
4890         pos += 2u;
4891     }
4892     uint16_t payload_size = btstack_min(channel->send_sdu_len + 2u - channel->send_sdu_pos, channel->remote_mps - pos);
4893     log_info("len %u, pos %u => payload %u, credits %u", channel->send_sdu_len, channel->send_sdu_pos, payload_size,
4894              channel->credits_outgoing);
4895     (void) memcpy(&l2cap_payload[pos],
4896                   &channel->send_sdu_buffer[channel->send_sdu_pos - 2u],
4897                   payload_size); // -2 for virtual SDU len
4898     pos += payload_size;
4899     channel->send_sdu_pos += payload_size;
4900     l2cap_setup_header(acl_buffer, channel->con_handle, 0, channel->remote_cid, pos);
4901 
4902     channel->credits_outgoing--;
4903 
4904     // update state (mark SDU as done) before calling hci_send_acl_packet_buffer (trigger l2cap_le_send_pdu again)
4905     bool done = channel->send_sdu_pos >= (channel->send_sdu_len + 2u);
4906     if (done) {
4907         channel->send_sdu_buffer = NULL;
4908     }
4909 
4910     hci_send_acl_packet_buffer(8u + pos);
4911 
4912     if (done) {
4913         // send done event
4914         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_PACKET_SENT);
4915         // inform about can send now
4916         l2cap_credit_based_notify_channel_can_send(channel);
4917     }
4918 }
4919 
4920 static uint8_t l2cap_credit_based_send_data(l2cap_channel_t * channel, const uint8_t * data, uint16_t size){
4921 
4922     if (size > channel->remote_mtu){
4923         log_error("l2cap send, cid 0x%02x, data length exceeds remote MTU.", channel->local_cid);
4924         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
4925     }
4926 
4927     if (channel->send_sdu_buffer){
4928         log_info("l2cap send, cid 0x%02x, cannot send", channel->local_cid);
4929         return BTSTACK_ACL_BUFFERS_FULL;
4930     }
4931 
4932     channel->send_sdu_buffer = data;
4933     channel->send_sdu_len    = size;
4934     channel->send_sdu_pos    = 0;
4935 
4936     l2cap_notify_channel_can_send();
4937     return ERROR_CODE_SUCCESS;
4938 }
4939 
4940 static uint8_t l2cap_credit_based_provide_credits(uint16_t local_cid, uint16_t credits){
4941     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
4942     if (!channel) {
4943         log_error("le credits no channel for cid 0x%02x", local_cid);
4944         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
4945     }
4946 
4947     // check state
4948     if (channel->state != L2CAP_STATE_OPEN){
4949         log_error("le credits but channel 0x%02x not open yet", local_cid);
4950     }
4951 
4952     // ignore if set to automatic credits
4953     if (channel->automatic_credits) return ERROR_CODE_SUCCESS;
4954 
4955     // assert incoming credits + credits <= 0xffff
4956     uint32_t total_credits = channel->credits_incoming;
4957     total_credits += channel->new_credits_incoming;
4958     total_credits += credits;
4959     if (total_credits > 0xffffu){
4960         log_error("le credits overrun: current %u, scheduled %u, additional %u", channel->credits_incoming,
4961                   channel->new_credits_incoming, credits);
4962     }
4963 
4964     // set credits_granted
4965     channel->new_credits_incoming += credits;
4966 
4967     // go
4968     l2cap_run();
4969     return ERROR_CODE_SUCCESS;
4970 }
4971 
4972 static void l2cap_credit_based_send_credits(l2cap_channel_t *channel) {
4973     log_info("l2cap: sending %u credits", channel->new_credits_incoming);
4974     channel->local_sig_id = l2cap_next_sig_id();
4975     uint16_t new_credits = channel->new_credits_incoming;
4976     channel->new_credits_incoming = 0;
4977     channel->credits_incoming += new_credits;
4978     uint16_t signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
4979     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, L2CAP_FLOW_CONTROL_CREDIT_INDICATION, channel->local_sig_id, channel->local_cid, new_credits);
4980 }
4981 
4982 // @return valid
4983 static bool l2cap_credit_based_handle_credit_indication(hci_con_handle_t handle, const uint8_t * command, uint16_t len){
4984     // check size
4985     if (len < 4u) return false;
4986 
4987     // find channel
4988     uint16_t remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4989     l2cap_channel_t * channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
4990     if (!channel) {
4991         log_error("credit: no channel for handle 0x%04x/cid 0x%02x", handle, remote_cid);
4992         return true;
4993     }
4994     uint16_t new_credits = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
4995     uint16_t credits_before = channel->credits_outgoing;
4996     channel->credits_outgoing += new_credits;
4997     // check for credit overrun
4998     if (credits_before > channel->credits_outgoing) {
4999         log_error("credit: new credits caused overrrun for cid 0x%02x, disconnecting", channel->local_cid);
5000         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
5001         return true;
5002     }
5003     log_info("credit: %u credits for 0x%02x, now %u", new_credits, channel->local_cid, channel->credits_outgoing);
5004     l2cap_call_notify_channel_in_run = true;
5005     return true;
5006 }
5007 
5008 static void l2cap_credit_based_handle_pdu(l2cap_channel_t * l2cap_channel, const uint8_t * packet, uint16_t size){
5009     // ignore empty packets
5010     if (size == COMPLETE_L2CAP_HEADER) return;
5011 
5012     // credit counting
5013     if (l2cap_channel->credits_incoming == 0u){
5014         log_info("(e)CBM: packet received but no incoming credits");
5015         l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
5016         return;
5017     }
5018     l2cap_channel->credits_incoming--;
5019 
5020     // automatic credits
5021     if ((l2cap_channel->credits_incoming < L2CAP_CREDIT_BASED_FLOW_CONTROL_MODE_AUTOMATIC_CREDITS_WATERMARK) && l2cap_channel->automatic_credits){
5022         l2cap_channel->new_credits_incoming = L2CAP_CREDIT_BASED_FLOW_CONTROL_MODE_AUTOMATIC_CREDITS_INCREMENT;
5023     }
5024 
5025     // first fragment
5026     uint16_t pos = 0;
5027     if (!l2cap_channel->receive_sdu_len){
5028         if (size < (COMPLETE_L2CAP_HEADER + 2)) return;
5029         uint16_t sdu_len = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
5030         if(sdu_len > l2cap_channel->local_mtu) return;   // SDU would be larger than our buffer
5031         l2cap_channel->receive_sdu_len = sdu_len;
5032         l2cap_channel->receive_sdu_pos = 0;
5033         pos  += 2u;
5034         size -= 2u;
5035     }
5036     uint16_t fragment_size   = size-COMPLETE_L2CAP_HEADER;
5037     uint16_t remaining_space = l2cap_channel->local_mtu - l2cap_channel->receive_sdu_pos;
5038     if (fragment_size > remaining_space) return;         // SDU would cause buffer overrun
5039     (void)memcpy(&l2cap_channel->receive_sdu_buffer[l2cap_channel->receive_sdu_pos],
5040                  &packet[COMPLETE_L2CAP_HEADER + pos],
5041                  fragment_size);
5042     l2cap_channel->receive_sdu_pos += size - COMPLETE_L2CAP_HEADER;
5043     // done?
5044     log_debug("le packet pos %u, len %u", l2cap_channel->receive_sdu_pos, l2cap_channel->receive_sdu_len);
5045     if (l2cap_channel->receive_sdu_pos >= l2cap_channel->receive_sdu_len){
5046         l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->receive_sdu_buffer, l2cap_channel->receive_sdu_len);
5047         l2cap_channel->receive_sdu_len = 0;
5048     }
5049 }
5050 
5051 static void l2cap_credit_based_notify_channel_can_send(l2cap_channel_t *channel){
5052     if (!channel->waiting_for_can_send_now) return;
5053     if (channel->send_sdu_buffer) return;
5054     channel->waiting_for_can_send_now = 0;
5055     log_debug("le can send now, local_cid 0x%x", channel->local_cid);
5056     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CAN_SEND_NOW);
5057 }
5058 #endif
5059 
5060 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
5061 // 1BH2222
5062 static void l2cap_cbm_emit_incoming_connection(l2cap_channel_t *channel) {
5063     log_info("le incoming addr_type %u, addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x, remote_mtu %u",
5064              channel->address_type, bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid, channel->remote_mtu);
5065     uint8_t event[19];
5066     event[0] = L2CAP_EVENT_CBM_INCOMING_CONNECTION;
5067     event[1] = sizeof(event) - 2u;
5068     event[2] = channel->address_type;
5069     reverse_bd_addr(channel->address, &event[3]);
5070     little_endian_store_16(event,  9, channel->con_handle);
5071     little_endian_store_16(event, 11, channel->psm);
5072     little_endian_store_16(event, 13, channel->local_cid);
5073     little_endian_store_16(event, 15, channel->remote_cid);
5074     little_endian_store_16(event, 17, channel->remote_mtu);
5075     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
5076     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
5077 }
5078 // 11BH22222
5079 static void l2cap_cbm_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
5080     log_info("opened le channel status 0x%x addr_type %u addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u",
5081              status, channel->address_type, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
5082              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu);
5083     uint8_t event[23];
5084     event[0] = L2CAP_EVENT_CBM_CHANNEL_OPENED;
5085     event[1] = sizeof(event) - 2u;
5086     event[2] = status;
5087     event[3] = channel->address_type;
5088     reverse_bd_addr(channel->address, &event[4]);
5089     little_endian_store_16(event, 10, channel->con_handle);
5090     event[12] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
5091     little_endian_store_16(event, 13, channel->psm);
5092     little_endian_store_16(event, 15, channel->local_cid);
5093     little_endian_store_16(event, 17, channel->remote_cid);
5094     little_endian_store_16(event, 19, channel->local_mtu);
5095     little_endian_store_16(event, 21, channel->remote_mtu);
5096     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
5097     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
5098 }
5099 
5100 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
5101 void l2cap_cbm_finialize_channel_close(l2cap_channel_t * channel){
5102     channel->state = L2CAP_STATE_CLOSED;
5103     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
5104     // discard channel
5105     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
5106     l2cap_free_channel_entry(channel);
5107 }
5108 
5109 static inline l2cap_service_t * l2cap_cbm_get_service(uint16_t le_psm){
5110     return l2cap_get_service_internal(&l2cap_le_services, le_psm);
5111 }
5112 
5113 uint8_t l2cap_cbm_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, gap_security_level_t security_level){
5114 
5115     log_info("l2cap_cbm_register_service psm 0x%x", psm);
5116 
5117     // check for alread registered psm
5118     l2cap_service_t *service = l2cap_cbm_get_service(psm);
5119     if (service) {
5120         return L2CAP_SERVICE_ALREADY_REGISTERED;
5121     }
5122 
5123     // alloc structure
5124     service = btstack_memory_l2cap_service_get();
5125     if (!service) {
5126         log_error("register: no memory for l2cap_service_t");
5127         return BTSTACK_MEMORY_ALLOC_FAILED;
5128     }
5129 
5130     // fill in
5131     service->psm = psm;
5132     service->mtu = 0;
5133     service->packet_handler = packet_handler;
5134     service->required_security_level = security_level;
5135 
5136     // add to services list
5137     btstack_linked_list_add(&l2cap_le_services, (btstack_linked_item_t *) service);
5138 
5139     // done
5140     return ERROR_CODE_SUCCESS;
5141 }
5142 
5143 uint8_t l2cap_cbm_unregister_service(uint16_t psm) {
5144     log_info("l2cap_cbm_unregister_service psm 0x%x", psm);
5145     l2cap_service_t *service = l2cap_cbm_get_service(psm);
5146     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
5147 
5148     btstack_linked_list_remove(&l2cap_le_services, (btstack_linked_item_t *) service);
5149     btstack_memory_l2cap_service_free(service);
5150     return ERROR_CODE_SUCCESS;
5151 }
5152 
5153 uint8_t l2cap_cbm_accept_connection(uint16_t local_cid, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits){
5154     // get channel
5155     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5156     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5157 
5158     // validate state
5159     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
5160         return ERROR_CODE_COMMAND_DISALLOWED;
5161     }
5162 
5163     // set state accept connection
5164     channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT;
5165     channel->receive_sdu_buffer = receive_sdu_buffer;
5166     channel->local_mtu = mtu;
5167     channel->new_credits_incoming = initial_credits;
5168     channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5169 
5170     // go
5171     l2cap_run();
5172     return ERROR_CODE_SUCCESS;
5173 }
5174 
5175 uint8_t l2cap_cbm_decline_connection(uint16_t local_cid, uint16_t result) {
5176     // get channel
5177     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5178     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5179 
5180     // validate state
5181     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
5182         return ERROR_CODE_COMMAND_DISALLOWED;
5183     }
5184 
5185     // set state decline connection
5186     channel->state  = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE;
5187     channel->reason = result;
5188     l2cap_run();
5189     return ERROR_CODE_SUCCESS;
5190 }
5191 
5192 static gap_security_level_t l2cap_cbm_security_level_for_connection(hci_con_handle_t con_handle){
5193     uint8_t encryption_key_size = gap_encryption_key_size(con_handle);
5194     if (encryption_key_size == 0) return LEVEL_0;
5195 
5196     bool authenticated = gap_authenticated(con_handle);
5197     if (!authenticated) return LEVEL_2;
5198 
5199     return encryption_key_size == 16 ? LEVEL_4 : LEVEL_3;
5200 }
5201 
5202 // used to handle pairing complete after triggering to increase
5203 static void l2cap_cbm_sm_packet_handler(uint8_t packet_type, uint16_t channel_nr, uint8_t *packet, uint16_t size) {
5204     UNUSED(channel_nr);
5205     UNUSED(size);
5206     UNUSED(packet_type);
5207     btstack_assert(packet_type == HCI_EVENT_PACKET);
5208     if (hci_event_packet_get_type(packet) != SM_EVENT_PAIRING_COMPLETE) return;
5209     hci_con_handle_t con_handle = sm_event_pairing_complete_get_handle(packet);
5210     btstack_linked_list_iterator_t it;
5211     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5212     while (btstack_linked_list_iterator_has_next(&it)) {
5213         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5214         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5215         if (channel->con_handle != con_handle) continue;
5216         if (channel->state != L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE) continue;
5217 
5218         // found channel, check security level
5219         if (l2cap_cbm_security_level_for_connection(con_handle) < channel->required_security_level){
5220             // pairing failed or wasn't good enough, inform user
5221             l2cap_cbm_emit_channel_opened(channel, ERROR_CODE_INSUFFICIENT_SECURITY);
5222             // discard channel
5223             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
5224             l2cap_free_channel_entry(channel);
5225         } else {
5226             // send conn request now
5227             channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5228             l2cap_run();
5229         }
5230     }
5231 }
5232 
5233 uint8_t l2cap_cbm_create_channel(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
5234     uint16_t psm, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits, gap_security_level_t security_level,
5235     uint16_t * out_local_cid) {
5236 
5237     static btstack_packet_callback_registration_t sm_event_callback_registration;
5238     static bool sm_callback_registered = false;
5239 
5240     log_info("create, handle 0x%04x psm 0x%x mtu %u", con_handle, psm, mtu);
5241 
5242     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5243     if (!connection) {
5244         log_error("no hci_connection for handle 0x%04x", con_handle);
5245         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5246     }
5247 
5248     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_CHANNEL_CBM, connection->address, connection->address_type, psm, mtu, security_level);
5249     if (!channel) {
5250         return BTSTACK_MEMORY_ALLOC_FAILED;
5251     }
5252     log_info("created %p", channel);
5253 
5254     // store local_cid
5255     if (out_local_cid){
5256        *out_local_cid = channel->local_cid;
5257     }
5258 
5259     // setup channel entry
5260     channel->con_handle = con_handle;
5261     channel->receive_sdu_buffer = receive_sdu_buffer;
5262     channel->new_credits_incoming = initial_credits;
5263     channel->automatic_credits    = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5264 
5265     // add to connections list
5266     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
5267 
5268     // check security level
5269     if (l2cap_cbm_security_level_for_connection(con_handle) < channel->required_security_level){
5270         if (!sm_callback_registered){
5271             sm_callback_registered = true;
5272             // lazy registration for SM events
5273             sm_event_callback_registration.callback = &l2cap_cbm_sm_packet_handler;
5274             sm_add_event_handler(&sm_event_callback_registration);
5275         }
5276 
5277         // start pairing
5278         channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
5279         sm_request_pairing(con_handle);
5280     } else {
5281         // send conn request right away
5282         channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5283         l2cap_run();
5284     }
5285 
5286     return ERROR_CODE_SUCCESS;
5287 }
5288 
5289 uint8_t l2cap_cbm_provide_credits(uint16_t local_cid, uint16_t credits){
5290     return l2cap_credit_based_provide_credits(local_cid, credits);
5291 }
5292 #endif
5293 
5294 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
5295 
5296 uint8_t l2cap_ecbm_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, uint16_t min_remote_mtu, gap_security_level_t security_level){
5297 
5298     // check for already registered psm
5299     l2cap_service_t *service = l2cap_cbm_get_service(psm);
5300     if (service) {
5301         return L2CAP_SERVICE_ALREADY_REGISTERED;
5302     }
5303 
5304     // alloc structure
5305     service = btstack_memory_l2cap_service_get();
5306     if (!service) {
5307         log_error("register: no memory for l2cap_service_t");
5308         return BTSTACK_MEMORY_ALLOC_FAILED;
5309     }
5310 
5311     // fill in
5312     service->psm = psm;
5313     service->mtu = min_remote_mtu;
5314     service->packet_handler = packet_handler;
5315     service->required_security_level = security_level;
5316 
5317     // add to services list
5318     btstack_linked_list_add(&l2cap_enhanced_services, (btstack_linked_item_t *) service);
5319 
5320     // done
5321     return ERROR_CODE_SUCCESS;
5322 }
5323 
5324 uint8_t l2cap_ecbm_unregister_service(uint16_t psm) {
5325     l2cap_service_t *service = l2cap_cbm_get_service(psm);
5326     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
5327 
5328     btstack_linked_list_remove(&l2cap_enhanced_services, (btstack_linked_item_t *) service);
5329     btstack_memory_l2cap_service_free(service);
5330     return ERROR_CODE_SUCCESS;
5331 }
5332 
5333 void l2cap_ecbm_mps_set_min(uint16_t mps_min){
5334     l2cap_enhanced_mps_min = mps_min;
5335 }
5336 
5337 void l2cap_ecbm_mps_set_max(uint16_t mps_max){
5338     l2cap_enhanced_mps_max = mps_max;
5339 }
5340 
5341 uint8_t l2cap_ecbm_create_channels(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
5342                                        gap_security_level_t security_level,
5343                                        uint16_t psm, uint8_t num_channels, uint16_t initial_credits, uint16_t mtu,
5344                                        uint8_t ** receive_sdu_buffers, uint16_t * out_local_cid){
5345 
5346     log_info("create enhanced, handle 0x%04x psm 0x%x mtu %u", con_handle, psm, mtu);
5347 
5348     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5349     if (!connection) {
5350         log_error("no hci_connection for handle 0x%04x", con_handle);
5351         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5352     }
5353 
5354     // setup all channels
5355     btstack_linked_list_t channels = NULL;
5356     uint8_t status = l2cap_ecbm_setup_channels(&channels, packet_handler, num_channels, connection, psm, mtu,
5357                                                security_level);
5358 
5359     // add to connections list and set state + local_sig_id
5360     l2cap_channel_t * channel;
5361     uint8_t i = 0;
5362     uint8_t local_sig_id = l2cap_next_sig_id();
5363     while (true) {
5364         channel = (l2cap_channel_t *) btstack_linked_list_pop(&channels);
5365         if (channel == NULL) break;
5366         channel->state              = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST;
5367         channel->local_sig_id       = local_sig_id;
5368         channel->cid_index = i;
5369         channel->num_cids = num_channels;
5370         channel->credits_incoming   = initial_credits;
5371         channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5372         channel->receive_sdu_buffer = receive_sdu_buffers[i];
5373         // store local_cid
5374         if (out_local_cid){
5375             out_local_cid[i] = channel->local_cid;
5376         }
5377         btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
5378         i++;
5379     }
5380 
5381 #if 0
5382     // check security level
5383     if (l2cap_le_security_level_for_connection(con_handle) < channel->required_security_level){
5384         if (!sm_callback_registered){
5385             sm_callback_registered = true;
5386             // lazy registration for SM events
5387             sm_event_callback_registration.callback = &l2cap_sm_packet_handler;
5388             sm_add_event_handler(&sm_event_callback_registration);
5389         }
5390 
5391         // start pairing
5392         channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
5393         sm_request_pairing(con_handle);
5394     } else {
5395         // send conn request right away
5396         channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5397         l2cap_run();
5398     }
5399 #endif
5400 
5401     l2cap_run();
5402 
5403     return status;
5404 }
5405 
5406 uint8_t l2cap_ecbm_accept_channels(uint16_t local_cid, uint8_t num_channels, uint16_t initial_credits,
5407                                             uint16_t receive_buffer_size, uint8_t ** receive_buffers, uint16_t * out_local_cids){
5408 
5409     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5410     if (!channel) {
5411 
5412         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5413     }
5414     //
5415     hci_con_handle_t  con_handle    = channel->con_handle;
5416     uint8_t           local_sig_id  = channel->local_sig_id;
5417     uint8_t           channel_index = 0;
5418     btstack_linked_list_iterator_t it;
5419     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5420     while (btstack_linked_list_iterator_has_next(&it)) {
5421         channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5422         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5423         if (channel->con_handle != con_handle) continue;
5424         if (channel->local_sig_id != local_sig_id) continue;
5425         if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT) continue;
5426 
5427         if (channel_index < num_channels){
5428             // assign buffer and cid
5429             out_local_cids[channel_index] = channel->local_cid;
5430             channel->receive_sdu_buffer = receive_buffers[channel_index];
5431             channel->local_mtu = receive_buffer_size;
5432             channel->credits_incoming   = initial_credits;
5433             channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5434             channel_index++;
5435         } else {
5436             // clear local cid for response packet
5437             channel->local_cid = 0;
5438             channel->reason = L2CAP_ECBM_CONNECTION_RESULT_SOME_REFUSED_INSUFFICIENT_RESOURCES_AVAILABLE;
5439         }
5440         // update state
5441         channel->state = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE;
5442     }
5443     l2cap_run_trigger();
5444     return ERROR_CODE_SUCCESS;
5445 }
5446 
5447 uint8_t l2cap_ecbm_decline_channels(uint16_t local_cid, uint16_t result){
5448     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5449     if (!channel) {
5450         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5451     }
5452     //
5453     hci_con_handle_t  con_handle    = channel->con_handle;
5454     uint8_t           local_sig_id  = channel->local_sig_id;
5455     btstack_linked_list_iterator_t it;
5456     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5457     while (btstack_linked_list_iterator_has_next(&it)) {
5458         channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5459         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5460         if (channel->con_handle != con_handle) continue;
5461         if (channel->local_sig_id != local_sig_id) continue;
5462         if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT) continue;
5463 
5464         // prepare response
5465         channel->local_cid = 0;
5466         channel->reason = result;
5467         channel->state = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE;
5468     }
5469     l2cap_run_trigger();
5470     return ERROR_CODE_SUCCESS;
5471 }
5472 
5473 uint8_t l2cap_ecbm_reconfigure_channels(uint8_t num_cids, uint16_t * local_cids, int16_t receive_buffer_size, uint8_t ** receive_buffers){
5474     btstack_assert(receive_buffers != NULL);
5475     btstack_assert(local_cids != NULL);
5476 
5477     if (num_cids > L2CAP_ECBM_MAX_CID_ARRAY_SIZE){
5478         return ERROR_CODE_UNACCEPTABLE_CONNECTION_PARAMETERS;
5479     }
5480 
5481     // check if all cids exist and have the same con handle
5482     uint8_t i;
5483     hci_con_handle_t con_handle = HCI_CON_HANDLE_INVALID;
5484     for (i = 0 ; i < num_cids ; i++){
5485         l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cids[i]);
5486         if (!channel) {
5487             return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5488         }
5489         if (channel->state != L2CAP_STATE_OPEN){
5490             return ERROR_CODE_COMMAND_DISALLOWED;
5491         }
5492         if (con_handle == HCI_CON_HANDLE_INVALID){
5493             con_handle = channel->con_handle;
5494         } else if (con_handle != channel->con_handle){
5495             return ERROR_CODE_UNACCEPTABLE_CONNECTION_PARAMETERS;
5496         }
5497     }
5498     // set renegotiation data and state
5499     uint8_t sig_id = l2cap_next_sig_id();
5500     for (i = 0 ; i < num_cids ; i++){
5501         l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cids[i]);
5502         channel->cid_index = i;
5503         channel->num_cids = num_cids;
5504         channel->local_sig_id = sig_id;
5505         channel->renegotiate_mtu = receive_buffer_size;
5506         channel->renegotiate_sdu_buffer = receive_buffers[i];
5507         channel->state = L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST;
5508     }
5509 
5510 
5511     l2cap_run();
5512     return ERROR_CODE_SUCCESS;
5513 }
5514 
5515 uint8_t l2cap_ecbm_provide_credits(uint16_t local_cid, uint16_t credits){
5516     return l2cap_credit_based_provide_credits(local_cid, credits);
5517 }
5518 #endif
5519 
5520 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
5521 // @deprecated - please use l2cap_ertm_create_channel
5522 uint8_t l2cap_create_ertm_channel(btstack_packet_handler_t packet_handler, bd_addr_t address, uint16_t psm,
5523                                   l2cap_ertm_config_t * ertm_contig, uint8_t * buffer, uint32_t size, uint16_t * out_local_cid){
5524     log_error("deprecated - please use l2cap_ertm_create_channel");
5525     return l2cap_ertm_create_channel(packet_handler, address, psm, ertm_contig, buffer, size, out_local_cid);
5526 };
5527 
5528 // @deprecated - please use l2cap_ertm_accept_connection
5529 uint8_t l2cap_accept_ertm_connection(uint16_t local_cid, l2cap_ertm_config_t * ertm_contig, uint8_t * buffer, uint32_t size){
5530     log_error("deprecated - please use l2cap_ertm_accept_connection");
5531     return l2cap_ertm_accept_connection(local_cid, ertm_contig, buffer, size);
5532 }
5533 #endif
5534 
5535 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
5536 // @deprecated - please use l2cap_cbm_register_service
5537 uint8_t l2cap_le_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, gap_security_level_t security_level){
5538     log_error("deprecated - please use l2cap_cbm_register_service");
5539     return l2cap_cbm_register_service(packet_handler, psm, security_level);
5540 }
5541 
5542 // @deprecated - please use l2cap_cbm_unregister_service
5543 uint8_t l2cap_le_unregister_service(uint16_t psm){
5544     log_error("deprecated - please use l2cap_cbm_unregister_service");
5545     return l2cap_cbm_unregister_service(psm);
5546 }
5547 
5548 // @deprecated - please use l2cap_cbm_accept_connection
5549 uint8_t l2cap_le_accept_connection(uint16_t local_cid, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits){
5550     log_error("deprecated - please use l2cap_cbm_accept_connection");
5551     return l2cap_cbm_accept_connection(local_cid, receive_sdu_buffer, mtu, initial_credits);
5552 }
5553 
5554 // @deprecated - please use l2cap_cbm_decline_connection
5555 uint8_t l2cap_le_decline_connection(uint16_t local_cid){
5556     log_error("deprecated - please use l2cap_cbm_decline_connection");
5557     return l2cap_cbm_decline_connection(local_cid, L2CAP_CBM_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE);
5558 }
5559 
5560 // @deprecated - please use l2cap_cbm_create_channel
5561 uint8_t l2cap_le_create_channel(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
5562                                 uint16_t psm, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits, gap_security_level_t security_level,
5563                                 uint16_t * out_local_cid){
5564     log_error("deprecated - please use l2cap_cbm_create_channel");
5565     return l2cap_cbm_create_channel(packet_handler, con_handle, psm, receive_sdu_buffer, mtu, initial_credits, security_level, out_local_cid);
5566 }
5567 
5568 // @deprecated - please use l2cap_cbm_provide_credits
5569 uint8_t l2cap_le_provide_credits(uint16_t local_cid, uint16_t credits){
5570     log_error("deprecated - please use l2cap_cbm_provide_credits");
5571     return l2cap_cbm_provide_credits(local_cid, credits);
5572 }
5573 
5574 // @deprecated - please use l2cap_can_send_packet_now
5575 bool l2cap_le_can_send_now(uint16_t local_cid){
5576     log_error("deprecated - please use l2cap_can_send_packet_now");
5577     return l2cap_can_send_packet_now(local_cid);
5578 }
5579 
5580 // @deprecated - please use l2cap_request_can_send_now_event
5581 uint8_t l2cap_le_request_can_send_now_event(uint16_t local_cid){
5582     log_error("deprecated - please use l2cap_request_can_send_now_event");
5583     return l2cap_request_can_send_now_event(local_cid);
5584 }
5585 
5586 // @deprecated - please use l2cap_cbm_send_data
5587 uint8_t l2cap_le_send_data(uint16_t local_cid, const uint8_t * data, uint16_t size){
5588     log_error("deprecated - please use l2cap_cbm_send_data");
5589     return l2cap_send(local_cid, data, size);
5590 }
5591 
5592 // @deprecated - please use l2cap_disconnect
5593 uint8_t l2cap_le_disconnect(uint16_t local_cid){
5594     log_error("deprecated - please use l2cap_disconnect");
5595     return l2cap_disconnect(local_cid);
5596 }
5597 #endif
5598