xref: /btstack/src/l2cap.c (revision 5652b5ff9bff82ec18441600a1f00ace8e4974e8)
1 /*
2  * Copyright (C) 2009 by Matthias Ringwald
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY MATTHIAS RINGWALD AND CONTRIBUTORS
18  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
19  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
20  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
21  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
23  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
24  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
25  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
26  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
27  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28  * SUCH DAMAGE.
29  *
30  */
31 
32 /*
33  *  l2cap.c
34  *
35  *  Logical Link Control and Adaption Protocl (L2CAP)
36  *
37  *  Created by Matthias Ringwald on 5/16/09.
38  */
39 
40 #include "l2cap.h"
41 #include "hci.h"
42 #include "hci_dump.h"
43 #include "debug.h"
44 #include "btstack_memory.h"
45 
46 #include <stdarg.h>
47 #include <string.h>
48 
49 #include <stdio.h>
50 
51 // nr of buffered acl packets in outgoing queue to get max performance
52 #define NR_BUFFERED_ACL_PACKETS 3
53 
54 // used to cache l2cap rejects, echo, and informational requests
55 #define NR_PENDING_SIGNALING_RESPONSES 3
56 
57 // offsets for L2CAP SIGNALING COMMANDS
58 #define L2CAP_SIGNALING_COMMAND_CODE_OFFSET   0
59 #define L2CAP_SIGNALING_COMMAND_SIGID_OFFSET  1
60 #define L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET 2
61 #define L2CAP_SIGNALING_COMMAND_DATA_OFFSET   4
62 
63 static void null_packet_handler(void * connection, uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
64 static void l2cap_packet_handler(uint8_t packet_type, uint8_t *packet, uint16_t size);
65 
66 // used to cache l2cap rejects, echo, and informational requests
67 static l2cap_signaling_response_t signaling_responses[NR_PENDING_SIGNALING_RESPONSES];
68 static int signaling_responses_pending;
69 
70 static linked_list_t l2cap_channels = NULL;
71 static linked_list_t l2cap_services = NULL;
72 static void (*packet_handler) (void * connection, uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size) = null_packet_handler;
73 static int new_credits_blocked = 0;
74 
75 static btstack_packet_handler_t attribute_protocol_packet_handler = NULL;
76 static btstack_packet_handler_t security_protocol_packet_handler = NULL;
77 
78 // prototypes
79 static void l2cap_finialize_channel_close(l2cap_channel_t *channel);
80 static l2cap_service_t * l2cap_get_service(uint16_t psm);
81 static void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
82 static void l2cap_emit_channel_closed(l2cap_channel_t *channel);
83 static void l2cap_emit_connection_request(l2cap_channel_t *channel);
84 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel);
85 
86 
87 void l2cap_init(){
88     new_credits_blocked = 0;
89     signaling_responses_pending = 0;
90 
91     l2cap_channels = NULL;
92     l2cap_services = NULL;
93 
94     packet_handler = null_packet_handler;
95 
96     //
97     // register callback with HCI
98     //
99     hci_register_packet_handler(&l2cap_packet_handler);
100     hci_connectable_control(0); // no services yet
101 }
102 
103 
104 /** Register L2CAP packet handlers */
105 static void null_packet_handler(void * connection, uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
106 }
107 void l2cap_register_packet_handler(void (*handler)(void * connection, uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size)){
108     packet_handler = handler;
109 }
110 
111 //  notify client/protocol handler
112 void l2cap_dispatch(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size){
113     if (channel->packet_handler) {
114         (* (channel->packet_handler))(type, channel->local_cid, data, size);
115     } else {
116         (*packet_handler)(channel->connection, type, channel->local_cid, data, size);
117     }
118 }
119 
120 void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
121     uint8_t event[21];
122     event[0] = L2CAP_EVENT_CHANNEL_OPENED;
123     event[1] = sizeof(event) - 2;
124     event[2] = status;
125     bt_flip_addr(&event[3], channel->address);
126     bt_store_16(event,  9, channel->handle);
127     bt_store_16(event, 11, channel->psm);
128     bt_store_16(event, 13, channel->local_cid);
129     bt_store_16(event, 15, channel->remote_cid);
130     bt_store_16(event, 17, channel->local_mtu);
131     bt_store_16(event, 19, channel->remote_mtu);
132     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
133     l2cap_dispatch(channel, HCI_EVENT_PACKET, event, sizeof(event));
134 }
135 
136 void l2cap_emit_channel_closed(l2cap_channel_t *channel) {
137     uint8_t event[4];
138     event[0] = L2CAP_EVENT_CHANNEL_CLOSED;
139     event[1] = sizeof(event) - 2;
140     bt_store_16(event, 2, channel->local_cid);
141     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
142     l2cap_dispatch(channel, HCI_EVENT_PACKET, event, sizeof(event));
143 }
144 
145 void l2cap_emit_connection_request(l2cap_channel_t *channel) {
146     uint8_t event[16];
147     event[0] = L2CAP_EVENT_INCOMING_CONNECTION;
148     event[1] = sizeof(event) - 2;
149     bt_flip_addr(&event[2], channel->address);
150     bt_store_16(event,  8, channel->handle);
151     bt_store_16(event, 10, channel->psm);
152     bt_store_16(event, 12, channel->local_cid);
153     bt_store_16(event, 14, channel->remote_cid);
154     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
155     l2cap_dispatch(channel, HCI_EVENT_PACKET, event, sizeof(event));
156 }
157 
158 static void l2cap_emit_service_registered(void *connection, uint8_t status, uint16_t psm){
159     uint8_t event[5];
160     event[0] = L2CAP_EVENT_SERVICE_REGISTERED;
161     event[1] = sizeof(event) - 2;
162     event[2] = status;
163     bt_store_16(event, 3, psm);
164     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
165     (*packet_handler)(connection, HCI_EVENT_PACKET, 0, event, sizeof(event));
166 }
167 
168 void l2cap_emit_credits(l2cap_channel_t *channel, uint8_t credits) {
169     // track credits
170     channel->packets_granted += credits;
171     // log_info("l2cap_emit_credits for cid %u, credits given: %u (+%u)\n", channel->local_cid, channel->packets_granted, credits);
172 
173     uint8_t event[5];
174     event[0] = L2CAP_EVENT_CREDITS;
175     event[1] = sizeof(event) - 2;
176     bt_store_16(event, 2, channel->local_cid);
177     event[4] = credits;
178     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
179     l2cap_dispatch(channel, HCI_EVENT_PACKET, event, sizeof(event));
180 }
181 
182 void l2cap_block_new_credits(uint8_t blocked){
183     new_credits_blocked = blocked;
184 }
185 
186 void l2cap_hand_out_credits(void){
187 
188     if (new_credits_blocked) return;    // we're told not to. used by daemon
189 
190     linked_item_t *it;
191     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
192         if (!hci_number_free_acl_slots()) return;
193         l2cap_channel_t * channel = (l2cap_channel_t *) it;
194         if (channel->state != L2CAP_STATE_OPEN) continue;
195         if (hci_number_outgoing_packets(channel->handle) < NR_BUFFERED_ACL_PACKETS && channel->packets_granted == 0) {
196             l2cap_emit_credits(channel, 1);
197         }
198     }
199 }
200 
201 l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid){
202     linked_item_t *it;
203     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
204         l2cap_channel_t * channel = (l2cap_channel_t *) it;
205         if ( channel->local_cid == local_cid) {
206             return channel;
207         }
208     }
209     return NULL;
210 }
211 
212 int  l2cap_can_send_packet_now(uint16_t local_cid){
213     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
214     if (!channel) return 0;
215     if (!channel->packets_granted) return 0;
216     return hci_can_send_packet_now(HCI_ACL_DATA_PACKET);
217 }
218 
219 uint16_t l2cap_get_remote_mtu_for_local_cid(uint16_t local_cid){
220     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
221     if (channel) {
222         return channel->remote_mtu;
223     }
224     return 0;
225 }
226 
227 int l2cap_send_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, uint8_t identifier, ...){
228 
229     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
230         log_info("l2cap_send_signaling_packet, cannot send\n");
231         return BTSTACK_ACL_BUFFERS_FULL;
232     }
233 
234     // log_info("l2cap_send_signaling_packet type %u\n", cmd);
235     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
236     va_list argptr;
237     va_start(argptr, identifier);
238     uint16_t len = l2cap_create_signaling_internal(acl_buffer, handle, cmd, identifier, argptr);
239     va_end(argptr);
240     // log_info("l2cap_send_signaling_packet con %u!\n", handle);
241     return hci_send_acl_packet(acl_buffer, len);
242 }
243 
244 uint8_t *l2cap_get_outgoing_buffer(void){
245     return hci_get_outgoing_acl_packet_buffer() + COMPLETE_L2CAP_HEADER; // 8 bytes
246 }
247 
248 int l2cap_send_prepared(uint16_t local_cid, uint16_t len){
249 
250     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
251         log_info("l2cap_send_internal cid %u, cannot send\n", local_cid);
252         return BTSTACK_ACL_BUFFERS_FULL;
253     }
254 
255     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
256     if (!channel) {
257         log_error("l2cap_send_internal no channel for cid %u\n", local_cid);
258         return -1;   // TODO: define error
259     }
260 
261     if (channel->packets_granted == 0){
262         log_error("l2cap_send_internal cid %u, no credits!\n", local_cid);
263         return -1;  // TODO: define error
264     }
265 
266     --channel->packets_granted;
267 
268     log_debug("l2cap_send_internal cid %u, handle %u, 1 credit used, credits left %u;\n",
269                   local_cid, channel->handle, channel->packets_granted);
270 
271     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
272 
273     // 0 - Connection handle : PB=10 : BC=00
274     bt_store_16(acl_buffer, 0, channel->handle | (2 << 12) | (0 << 14));
275     // 2 - ACL length
276     bt_store_16(acl_buffer, 2,  len + 4);
277     // 4 - L2CAP packet length
278     bt_store_16(acl_buffer, 4,  len + 0);
279     // 6 - L2CAP channel DEST
280     bt_store_16(acl_buffer, 6, channel->remote_cid);
281     // send
282     int err = hci_send_acl_packet(acl_buffer, len+8);
283 
284     l2cap_hand_out_credits();
285 
286     return err;
287 }
288 
289 int l2cap_send_internal(uint16_t local_cid, uint8_t *data, uint16_t len){
290 
291     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
292         log_info("l2cap_send_internal cid %u, cannot send\n", local_cid);
293         return BTSTACK_ACL_BUFFERS_FULL;
294     }
295 
296     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
297 
298     memcpy(&acl_buffer[8], data, len);
299 
300     return l2cap_send_prepared(local_cid, len);
301 }
302 
303 static inline void channelStateVarSetFlag(l2cap_channel_t *channel, L2CAP_CHANNEL_STATE_VAR flag){
304     channel->state_var = (L2CAP_CHANNEL_STATE_VAR) (channel->state_var | flag);
305 }
306 
307 static inline void channelStateVarClearFlag(l2cap_channel_t *channel, L2CAP_CHANNEL_STATE_VAR flag){
308     channel->state_var = (L2CAP_CHANNEL_STATE_VAR) (channel->state_var & ~flag);
309 }
310 
311 
312 
313 // MARK: L2CAP_RUN
314 // process outstanding signaling tasks
315 void l2cap_run(void){
316 
317     // check pending signaling responses
318     while (signaling_responses_pending){
319 
320         if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)) break;
321 
322         hci_con_handle_t handle = signaling_responses[0].handle;
323         uint8_t sig_id = signaling_responses[0].sig_id;
324         uint16_t infoType = signaling_responses[0].data;    // INFORMATION_REQUEST
325         uint16_t result   = signaling_responses[0].data;    // CONNECTION_REQUEST
326 
327         switch (signaling_responses[0].code){
328             case CONNECTION_REQUEST:
329                 l2cap_send_signaling_packet(handle, CONNECTION_RESPONSE, sig_id, 0, 0, result, 0);
330                 break;
331             case ECHO_REQUEST:
332                 l2cap_send_signaling_packet(handle, ECHO_RESPONSE, sig_id, 0, NULL);
333                 break;
334             case INFORMATION_REQUEST:
335                 if (infoType == 2) {
336                     uint32_t features = 0;
337                     // extended features request supported, however no features present
338                     l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, 4, &features);
339                 } else {
340                     // all other types are not supported
341                     l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 1, 0, NULL);
342                 }
343                 break;
344             default:
345                 // should not happen
346                 break;
347         }
348 
349         // remove first item
350         signaling_responses_pending--;
351         int i;
352         for (i=0; i < signaling_responses_pending; i++){
353             memcpy(&signaling_responses[i], &signaling_responses[i+1], sizeof(l2cap_signaling_response_t));
354         }
355     }
356 
357     uint8_t  config_options[4];
358     linked_item_t *it;
359     linked_item_t *next;
360     for (it = (linked_item_t *) l2cap_channels; it ; it = next){
361         next = it->next;    // cache next item as current item might get freed
362 
363         if (!hci_can_send_packet_now(HCI_COMMAND_DATA_PACKET)) break;
364         if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)) break;
365 
366         l2cap_channel_t * channel = (l2cap_channel_t *) it;
367 
368         // log_info("l2cap_run: state %u, var 0x%02x\n", channel->state, channel->state_var);
369 
370 
371         switch (channel->state){
372 
373             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
374                 // send connection request - set state first
375                 channel->state = L2CAP_STATE_WAIT_CONNECTION_COMPLETE;
376                 // BD_ADDR, Packet_Type, Page_Scan_Repetition_Mode, Reserved, Clock_Offset, Allow_Role_Switch
377                 hci_send_cmd(&hci_create_connection, channel->address, hci_usable_acl_packet_types(), 0, 0, 0, 1);
378                 break;
379 
380             case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
381                 l2cap_send_signaling_packet(channel->handle, CONNECTION_RESPONSE, channel->remote_sig_id, 0, 0, channel->reason, 0);
382                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
383                 linked_list_remove(&l2cap_channels, (linked_item_t *) channel); // -- remove from list
384                 btstack_memory_l2cap_channel_free(channel);
385                 break;
386 
387             case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
388                 channel->state = L2CAP_STATE_CONFIG;
389                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
390                 l2cap_send_signaling_packet(channel->handle, CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid, 0, 0);
391                 break;
392 
393             case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
394                 // success, start l2cap handshake
395                 channel->local_sig_id = l2cap_next_sig_id();
396                 channel->state = L2CAP_STATE_WAIT_CONNECT_RSP;
397                 l2cap_send_signaling_packet( channel->handle, CONNECTION_REQUEST, channel->local_sig_id, channel->psm, channel->local_cid);
398                 break;
399 
400             case L2CAP_STATE_CONFIG:
401                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP){
402                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
403                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
404                     l2cap_send_signaling_packet(channel->handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, 0, 0, 0, NULL);
405                 }
406                 else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ){
407                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
408                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_REQ);
409                     channel->local_sig_id = l2cap_next_sig_id();
410                     config_options[0] = 1; // MTU
411                     config_options[1] = 2; // len param
412                     bt_store_16( (uint8_t*)&config_options, 2, channel->local_mtu);
413                     l2cap_send_signaling_packet(channel->handle, CONFIGURE_REQUEST, channel->local_sig_id, channel->remote_cid, 0, 4, &config_options);
414                 }
415                 if (l2cap_channel_ready_for_open(channel)){
416                     channel->state = L2CAP_STATE_OPEN;
417                     l2cap_emit_channel_opened(channel, 0);  // success
418                     l2cap_emit_credits(channel, 1);
419                 }
420                 break;
421 
422             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
423                 l2cap_send_signaling_packet( channel->handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
424                 l2cap_finialize_channel_close(channel);  // -- remove from list
425                 break;
426 
427             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
428                 channel->local_sig_id = l2cap_next_sig_id();
429                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
430                 l2cap_send_signaling_packet( channel->handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
431                 break;
432             default:
433                 break;
434         }
435     }
436 }
437 
438 uint16_t l2cap_max_mtu(void){
439     return hci_max_acl_data_packet_length() - L2CAP_HEADER_SIZE;
440 }
441 
442 // open outgoing L2CAP channel
443 void l2cap_create_channel_internal(void * connection, btstack_packet_handler_t packet_handler,
444                                    bd_addr_t address, uint16_t psm, uint16_t mtu){
445 
446     // alloc structure
447     l2cap_channel_t * chan = (l2cap_channel_t*) btstack_memory_l2cap_channel_get();
448     if (!chan) {
449         // emit error event
450         l2cap_channel_t dummy_channel;
451         BD_ADDR_COPY(dummy_channel.address, address);
452         dummy_channel.psm = psm;
453         l2cap_emit_channel_opened(&dummy_channel, BTSTACK_MEMORY_ALLOC_FAILED);
454         return;
455     }
456     // limit local mtu to max acl packet length
457     if (mtu > l2cap_max_mtu()) {
458         mtu = l2cap_max_mtu();
459     }
460 
461     // fill in
462     BD_ADDR_COPY(chan->address, address);
463     chan->psm = psm;
464     chan->handle = 0;
465     chan->connection = connection;
466     chan->packet_handler = packet_handler;
467     chan->remote_mtu = L2CAP_MINIMAL_MTU;
468     chan->local_mtu = mtu;
469     chan->packets_granted = 0;
470 
471     // set initial state
472     chan->state = L2CAP_STATE_WILL_SEND_CREATE_CONNECTION;
473     chan->state_var = L2CAP_CHANNEL_STATE_VAR_NONE;
474     chan->remote_sig_id = L2CAP_SIG_ID_INVALID;
475     chan->local_sig_id = L2CAP_SIG_ID_INVALID;
476 
477     // add to connections list
478     linked_list_add(&l2cap_channels, (linked_item_t *) chan);
479 
480     l2cap_run();
481 }
482 
483 void l2cap_disconnect_internal(uint16_t local_cid, uint8_t reason){
484     // find channel for local_cid
485     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
486     if (channel) {
487         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
488     }
489     // process
490     l2cap_run();
491 }
492 
493 static void l2cap_handle_connection_failed_for_addr(bd_addr_t address, uint8_t status){
494     linked_item_t *it = (linked_item_t *) &l2cap_channels;
495     while (it->next){
496         l2cap_channel_t * channel = (l2cap_channel_t *) it->next;
497         if ( ! BD_ADDR_CMP( channel->address, address) ){
498             if (channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE || channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION) {
499                 // failure, forward error code
500                 l2cap_emit_channel_opened(channel, status);
501                 // discard channel
502                 it->next = it->next->next;
503                 btstack_memory_l2cap_channel_free(channel);
504             }
505         } else {
506             it = it->next;
507         }
508     }
509 }
510 
511 static void l2cap_handle_connection_success_for_addr(bd_addr_t address, hci_con_handle_t handle){
512     linked_item_t *it;
513     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
514         l2cap_channel_t * channel = (l2cap_channel_t *) it;
515         if ( ! BD_ADDR_CMP( channel->address, address) ){
516             if (channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE || channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION) {
517                 // success, start l2cap handshake
518                 channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
519                 channel->handle = handle;
520                 channel->local_cid = l2cap_next_local_cid();
521             }
522         }
523     }
524     // process
525     l2cap_run();
526 }
527 
528 void l2cap_event_handler( uint8_t *packet, uint16_t size ){
529 
530     bd_addr_t address;
531     hci_con_handle_t handle;
532     l2cap_channel_t * channel;
533     linked_item_t *it;
534     int hci_con_used;
535 
536     switch(packet[0]){
537 
538         // handle connection complete events
539         case HCI_EVENT_CONNECTION_COMPLETE:
540             bt_flip_addr(address, &packet[5]);
541             if (packet[2] == 0){
542                 handle = READ_BT_16(packet, 3);
543                 l2cap_handle_connection_success_for_addr(address, handle);
544             } else {
545                 l2cap_handle_connection_failed_for_addr(address, packet[2]);
546             }
547             break;
548 
549         // handle successful create connection cancel command
550         case HCI_EVENT_COMMAND_COMPLETE:
551             if ( COMMAND_COMPLETE_EVENT(packet, hci_create_connection_cancel) ) {
552                 if (packet[5] == 0){
553                     bt_flip_addr(address, &packet[6]);
554                     // CONNECTION TERMINATED BY LOCAL HOST (0X16)
555                     l2cap_handle_connection_failed_for_addr(address, 0x16);
556                 }
557             }
558             l2cap_run();    // try sending signaling packets first
559             break;
560 
561         case HCI_EVENT_COMMAND_STATUS:
562             l2cap_run();    // try sending signaling packets first
563             break;
564 
565         // handle disconnection complete events
566         case HCI_EVENT_DISCONNECTION_COMPLETE:
567             // send l2cap disconnect events for all channels on this handle
568             handle = READ_BT_16(packet, 3);
569             it = (linked_item_t *) &l2cap_channels;
570             while (it->next){
571                 l2cap_channel_t * channel = (l2cap_channel_t *) it->next;
572                 if ( channel->handle == handle ){
573                     // update prev item before free'ing next element - don't call l2cap_finalize_channel_close
574                     it->next = it->next->next;
575                     l2cap_emit_channel_closed(channel);
576                     btstack_memory_l2cap_channel_free(channel);
577                 } else {
578                     it = it->next;
579                 }
580             }
581             break;
582 
583         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:
584             l2cap_run();    // try sending signaling packets first
585             l2cap_hand_out_credits();
586             break;
587 
588         // HCI Connection Timeouts
589         case L2CAP_EVENT_TIMEOUT_CHECK:
590             handle = READ_BT_16(packet, 2);
591             if (hci_authentication_active_for_handle(handle)) break;
592             hci_con_used = 0;
593             for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
594                 channel = (l2cap_channel_t *) it;
595                 if (channel->handle == handle) {
596                     hci_con_used = 1;
597                 }
598             }
599             if (hci_con_used) break;
600             if (!hci_can_send_packet_now(HCI_COMMAND_DATA_PACKET)) break;
601             hci_send_cmd(&hci_disconnect, handle, 0x13); // remote closed connection
602             break;
603 
604         case DAEMON_EVENT_HCI_PACKET_SENT:
605             for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
606                 channel = (l2cap_channel_t *) it;
607                 if (channel->packet_handler) {
608                     (* (channel->packet_handler))(HCI_EVENT_PACKET, channel->local_cid, packet, size);
609                 }
610             }
611             if (attribute_protocol_packet_handler) {
612                 (*attribute_protocol_packet_handler)(HCI_EVENT_PACKET, 0, packet, size);
613             }
614             if (security_protocol_packet_handler) {
615                 (*security_protocol_packet_handler)(SM_DATA_PACKET, 0, packet, size);
616             }
617             break;
618 
619         default:
620             break;
621     }
622 
623     // pass on
624     (*packet_handler)(NULL, HCI_EVENT_PACKET, 0, packet, size);
625 }
626 
627 static void l2cap_handle_disconnect_request(l2cap_channel_t *channel, uint16_t identifier){
628     channel->remote_sig_id = identifier;
629     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
630     l2cap_run();
631 }
632 
633 static void l2cap_register_signaling_response(hci_con_handle_t handle, uint8_t code, uint8_t sig_id, uint16_t data){
634     if (signaling_responses_pending < NR_PENDING_SIGNALING_RESPONSES) {
635         signaling_responses[signaling_responses_pending].handle = handle;
636         signaling_responses[signaling_responses_pending].code = code;
637         signaling_responses[signaling_responses_pending].sig_id = sig_id;
638         signaling_responses[signaling_responses_pending].data = data;
639         signaling_responses_pending++;
640         l2cap_run();
641     }
642 }
643 
644 static void l2cap_handle_connection_request(hci_con_handle_t handle, uint8_t sig_id, uint16_t psm, uint16_t source_cid){
645 
646     // log_info("l2cap_handle_connection_request for handle %u, psm %u cid %u\n", handle, psm, source_cid);
647     l2cap_service_t *service = l2cap_get_service(psm);
648     if (!service) {
649         // 0x0002 PSM not supported
650         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, 0x0002);
651         return;
652     }
653 
654     hci_connection_t * hci_connection = connection_for_handle( handle );
655     if (!hci_connection) {
656         //
657         log_error("no hci_connection for handle %u\n", handle);
658         return;
659     }
660     // alloc structure
661     // log_info("l2cap_handle_connection_request register channel\n");
662     l2cap_channel_t * channel = (l2cap_channel_t*) btstack_memory_l2cap_channel_get();
663     if (!channel){
664         // 0x0004 No resources available
665         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, 0x0004);
666         return;
667     }
668 
669     // fill in
670     BD_ADDR_COPY(channel->address, hci_connection->address);
671     channel->psm = psm;
672     channel->handle = handle;
673     channel->connection = service->connection;
674     channel->packet_handler = service->packet_handler;
675     channel->local_cid  = l2cap_next_local_cid();
676     channel->remote_cid = source_cid;
677     channel->local_mtu  = service->mtu;
678     channel->remote_mtu = L2CAP_DEFAULT_MTU;
679     channel->packets_granted = 0;
680     channel->remote_sig_id = sig_id;
681 
682     // limit local mtu to max acl packet length
683     if (channel->local_mtu > l2cap_max_mtu()) {
684         channel->local_mtu = l2cap_max_mtu();
685     }
686 
687     // set initial state
688     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
689     channel->state_var = L2CAP_CHANNEL_STATE_VAR_NONE;
690 
691     // add to connections list
692     linked_list_add(&l2cap_channels, (linked_item_t *) channel);
693 
694     // emit incoming connection request
695     l2cap_emit_connection_request(channel);
696 }
697 
698 void l2cap_accept_connection_internal(uint16_t local_cid){
699     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
700     if (!channel) {
701         log_error("l2cap_accept_connection_internal called but local_cid 0x%x not found", local_cid);
702         return;
703     }
704 
705     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
706 
707     // process
708     l2cap_run();
709 }
710 
711 void l2cap_decline_connection_internal(uint16_t local_cid, uint8_t reason){
712     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
713     if (!channel) {
714         log_error( "l2cap_decline_connection_internal called but local_cid 0x%x not found", local_cid);
715         return;
716     }
717     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
718     channel->reason = reason;
719     l2cap_run();
720 }
721 
722 void l2cap_signaling_handle_configure_request(l2cap_channel_t *channel, uint8_t *command){
723 
724     channel->remote_sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
725 
726     // accept the other's configuration options
727     uint16_t end_pos = 4 + READ_BT_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
728     uint16_t pos     = 8;
729     while (pos < end_pos){
730         uint8_t type   = command[pos++];
731         uint8_t length = command[pos++];
732         // MTU { type(8): 1, len(8):2, MTU(16) }
733         if ((type & 0x7f) == 1 && length == 2){
734             channel->remote_mtu = READ_BT_16(command, pos);
735             // log_info("l2cap cid %u, remote mtu %u\n", channel->local_cid, channel->remote_mtu);
736         }
737         pos += length;
738     }
739 }
740 
741 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel){
742     // log_info("l2cap_channel_ready_for_open 0x%02x\n", channel->state_var);
743     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP) == 0) return 0;
744     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP) == 0) return 0;
745     return 1;
746 }
747 
748 
749 void l2cap_signaling_handler_channel(l2cap_channel_t *channel, uint8_t *command){
750 
751     uint8_t  code       = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
752     uint8_t  identifier = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
753     uint16_t result = 0;
754 
755     log_info("L2CAP signaling handler code %u, state %u\n", code, channel->state);
756 
757     // handle DISCONNECT REQUESTS seperately
758     if (code == DISCONNECTION_REQUEST){
759         switch (channel->state){
760             case L2CAP_STATE_CONFIG:
761             case L2CAP_STATE_OPEN:
762             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
763             case L2CAP_STATE_WAIT_DISCONNECT:
764                 l2cap_handle_disconnect_request(channel, identifier);
765                 break;
766 
767             default:
768                 // ignore in other states
769                 break;
770         }
771         return;
772     }
773 
774     // @STATEMACHINE(l2cap)
775     switch (channel->state) {
776 
777         case L2CAP_STATE_WAIT_CONNECT_RSP:
778             switch (code){
779                 case CONNECTION_RESPONSE:
780                     result = READ_BT_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
781                     switch (result) {
782                         case 0:
783                             // successful connection
784                             channel->remote_cid = READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
785                             channel->state = L2CAP_STATE_CONFIG;
786                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
787                             break;
788                         case 1:
789                             // connection pending. get some coffee
790                             break;
791                         default:
792                             // channel closed
793                             channel->state = L2CAP_STATE_CLOSED;
794 
795                             // map l2cap connection response result to BTstack status enumeration
796                             l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result);
797 
798                             // drop link key if security block
799                             if (L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result == L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY){
800                                 hci_drop_link_key_for_bd_addr(&channel->address);
801                             }
802 
803                             // discard channel
804                             linked_list_remove(&l2cap_channels, (linked_item_t *) channel);
805                             btstack_memory_l2cap_channel_free(channel);
806                             break;
807                     }
808                     break;
809 
810                 default:
811                     //@TODO: implement other signaling packets
812                     break;
813             }
814             break;
815 
816         case L2CAP_STATE_CONFIG:
817             switch (code) {
818                 case CONFIGURE_REQUEST:
819                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_REQ);
820                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
821                     l2cap_signaling_handle_configure_request(channel, command);
822                     break;
823                 case CONFIGURE_RESPONSE:
824                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP);
825                     break;
826                 default:
827                     break;
828             }
829             if (l2cap_channel_ready_for_open(channel)){
830                 // for open:
831                 channel->state = L2CAP_STATE_OPEN;
832                 l2cap_emit_channel_opened(channel, 0);
833                 l2cap_emit_credits(channel, 1);
834             }
835             break;
836 
837         case L2CAP_STATE_WAIT_DISCONNECT:
838             switch (code) {
839                 case DISCONNECTION_RESPONSE:
840                     l2cap_finialize_channel_close(channel);
841                     break;
842                 default:
843                     //@TODO: implement other signaling packets
844                     break;
845             }
846             break;
847 
848         case L2CAP_STATE_CLOSED:
849             // @TODO handle incoming requests
850             break;
851 
852         case L2CAP_STATE_OPEN:
853             //@TODO: implement other signaling packets, e.g. re-configure
854             break;
855         default:
856             break;
857     }
858     // log_info("new state %u\n", channel->state);
859 }
860 
861 
862 void l2cap_signaling_handler_dispatch( hci_con_handle_t handle, uint8_t * command){
863 
864     // get code, signalind identifier and command len
865     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
866     uint8_t sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
867 
868     // not for a particular channel, and not CONNECTION_REQUEST, ECHO_[REQUEST|RESPONSE], INFORMATION_REQUEST
869     if (code < 1 || code == ECHO_RESPONSE || code > INFORMATION_REQUEST){
870         return;
871     }
872 
873     // general commands without an assigned channel
874     switch(code) {
875 
876         case CONNECTION_REQUEST: {
877             uint16_t psm =        READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
878             uint16_t source_cid = READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
879             l2cap_handle_connection_request(handle, sig_id, psm, source_cid);
880             return;
881         }
882 
883         case ECHO_REQUEST:
884             l2cap_register_signaling_response(handle, code, sig_id, 0);
885             return;
886 
887         case INFORMATION_REQUEST: {
888             uint16_t infoType = READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
889             l2cap_register_signaling_response(handle, code, sig_id, infoType);
890             return;
891         }
892 
893         default:
894             break;
895     }
896 
897 
898     // Get potential destination CID
899     uint16_t dest_cid = READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
900 
901     // Find channel for this sig_id and connection handle
902     linked_item_t *it;
903     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
904         l2cap_channel_t * channel = (l2cap_channel_t *) it;
905         if (channel->handle == handle) {
906             if (code & 1) {
907                 // match odd commands (responses) by previous signaling identifier
908                 if (channel->local_sig_id == sig_id) {
909                     l2cap_signaling_handler_channel(channel, command);
910                     break;
911                 }
912             } else {
913                 // match even commands (requests) by local channel id
914                 if (channel->local_cid == dest_cid) {
915                     l2cap_signaling_handler_channel(channel, command);
916                     break;
917                 }
918             }
919         }
920     }
921 }
922 
923 void l2cap_acl_handler( uint8_t *packet, uint16_t size ){
924 
925     // Get Channel ID
926     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
927     hci_con_handle_t handle = READ_ACL_CONNECTION_HANDLE(packet);
928 
929     switch (channel_id) {
930 
931         case L2CAP_CID_SIGNALING: {
932 
933             uint16_t command_offset = 8;
934             while (command_offset < size) {
935 
936                 // handle signaling commands
937                 l2cap_signaling_handler_dispatch(handle, &packet[command_offset]);
938 
939                 // increment command_offset
940                 command_offset += L2CAP_SIGNALING_COMMAND_DATA_OFFSET + READ_BT_16(packet, command_offset + L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
941             }
942             break;
943         }
944 
945         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
946             if (attribute_protocol_packet_handler) {
947                 (*attribute_protocol_packet_handler)(ATT_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
948             }
949             break;
950 
951         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
952             if (security_protocol_packet_handler) {
953                 (*security_protocol_packet_handler)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
954             }
955             break;
956 
957         default: {
958             // Find channel for this channel_id and connection handle
959             l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(channel_id);
960             if (channel) {
961                 l2cap_dispatch(channel, L2CAP_DATA_PACKET, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
962             }
963             break;
964         }
965     }
966 
967     l2cap_run();
968 }
969 
970 static void l2cap_packet_handler(uint8_t packet_type, uint8_t *packet, uint16_t size){
971     switch (packet_type) {
972         case HCI_EVENT_PACKET:
973             l2cap_event_handler(packet, size);
974             break;
975         case HCI_ACL_DATA_PACKET:
976             l2cap_acl_handler(packet, size);
977             break;
978         default:
979             break;
980     }
981 }
982 
983 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
984 void l2cap_finialize_channel_close(l2cap_channel_t *channel){
985     channel->state = L2CAP_STATE_CLOSED;
986     l2cap_emit_channel_closed(channel);
987     // discard channel
988     linked_list_remove(&l2cap_channels, (linked_item_t *) channel);
989     btstack_memory_l2cap_channel_free(channel);
990 }
991 
992 l2cap_service_t * l2cap_get_service(uint16_t psm){
993     linked_item_t *it;
994 
995     // close open channels
996     for (it = (linked_item_t *) l2cap_services; it ; it = it->next){
997         l2cap_service_t * service = ((l2cap_service_t *) it);
998         if ( service->psm == psm){
999             return service;
1000         };
1001     }
1002     return NULL;
1003 }
1004 
1005 void l2cap_register_service_internal(void *connection, btstack_packet_handler_t packet_handler, uint16_t psm, uint16_t mtu){
1006     // check for alread registered psm
1007     // TODO: emit error event
1008     l2cap_service_t *service = l2cap_get_service(psm);
1009     if (service) {
1010         log_error("l2cap_register_service_internal: PSM %u already registered\n", psm);
1011         l2cap_emit_service_registered(connection, L2CAP_SERVICE_ALREADY_REGISTERED, psm);
1012         return;
1013     }
1014 
1015     // alloc structure
1016     // TODO: emit error event
1017     service = (l2cap_service_t *) btstack_memory_l2cap_service_get();
1018     if (!service) {
1019         log_error("l2cap_register_service_internal: no memory for l2cap_service_t\n");
1020         l2cap_emit_service_registered(connection, BTSTACK_MEMORY_ALLOC_FAILED, psm);
1021         return;
1022     }
1023 
1024     // fill in
1025     service->psm = psm;
1026     service->mtu = mtu;
1027     service->connection = connection;
1028     service->packet_handler = packet_handler;
1029 
1030     // add to services list
1031     linked_list_add(&l2cap_services, (linked_item_t *) service);
1032 
1033     // enable page scan
1034     hci_connectable_control(1);
1035 
1036     // done
1037     l2cap_emit_service_registered(connection, 0, psm);
1038 }
1039 
1040 void l2cap_unregister_service_internal(void *connection, uint16_t psm){
1041     l2cap_service_t *service = l2cap_get_service(psm);
1042     if (!service) return;
1043     linked_list_remove(&l2cap_services, (linked_item_t *) service);
1044     btstack_memory_l2cap_service_free(service);
1045 
1046     // disable page scan when no services registered
1047     if (!linked_list_empty(&l2cap_services)) return;
1048     hci_connectable_control(0);
1049 }
1050 
1051 //
1052 void l2cap_close_connection(void *connection){
1053     linked_item_t *it;
1054 
1055     // close open channels - note to myself: no channel is freed, so no new for fancy iterator tricks
1056     l2cap_channel_t * channel;
1057     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
1058         channel = (l2cap_channel_t *) it;
1059         if (channel->connection == connection) {
1060             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1061         }
1062     }
1063 
1064     // unregister services
1065     it = (linked_item_t *) &l2cap_services;
1066     while (it->next) {
1067         l2cap_service_t * service = (l2cap_service_t *) it->next;
1068         if (service->connection == connection){
1069             it->next = it->next->next;
1070             btstack_memory_l2cap_service_free(service);
1071         } else {
1072             it = it->next;
1073         }
1074     }
1075 
1076     // process
1077     l2cap_run();
1078 }
1079 
1080 // Bluetooth 4.0 - allows to register handler for Attribute Protocol and Security Manager Protocol
1081 void l2cap_register_fixed_channel(btstack_packet_handler_t packet_handler, uint16_t channel_id) {
1082     switch(channel_id){
1083         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
1084             attribute_protocol_packet_handler = packet_handler;
1085             break;
1086         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
1087             security_protocol_packet_handler = packet_handler;
1088             break;
1089     }
1090 }
1091 
1092