xref: /btstack/src/l2cap.c (revision 7703f6ed56ec57197ff8f07d363a367110e377f5)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "l2cap.c"
39 
40 /*
41  *  l2cap.c
42  *  Logical Link Control and Adaption Protocol (L2CAP)
43  */
44 
45 #include "l2cap.h"
46 #include "hci.h"
47 #include "hci_dump.h"
48 #include "bluetooth_sdp.h"
49 #include "bluetooth_psm.h"
50 #include "btstack_bool.h"
51 #include "btstack_debug.h"
52 #include "btstack_event.h"
53 #include "btstack_memory.h"
54 
55 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
56 // TODO avoid dependency on higher layer: used to trigger pairing for outgoing connections
57 #include "ble/sm.h"
58 #endif
59 
60 #include <stdarg.h>
61 #include <string.h>
62 
63 /*
64  * @brief L2CAP Supervisory function in S-Frames
65  */
66 typedef enum {
67     L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY = 0,
68     L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT,
69     L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY,
70     L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT
71 } l2cap_supervisory_function_t;
72 
73 /**
74  * @brief L2CAP Information Types used in Information Request & Response
75  */
76 typedef enum {
77   L2CAP_INFO_TYPE_CONNECTIONLESS_MTU = 1,
78   L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED,
79   L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED,
80 } l2cap_info_type_t;
81 
82 /**
83  * @brief L2CAP Configuration Option Types used in Configurateion Request & Response
84  */
85 typedef enum {
86   L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT = 1,
87   L2CAP_CONFIG_OPTION_TYPE_FLUSH_TIMEOUT,
88   L2CAP_CONFIG_OPTION_TYPE_QUALITY_OF_SERVICE,
89   L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL,
90   L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE,
91   L2CAP_CONFIG_OPTION_TYPE_EXTENDED_FLOW_SPECIFICATION,
92   L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE,
93 } l2cap_config_option_type_t;
94 
95 
96 #define L2CAP_SIG_ID_INVALID 0
97 
98 // size of HCI ACL + L2CAP Header for regular data packets (8)
99 #define COMPLETE_L2CAP_HEADER (HCI_ACL_HEADER_SIZE + L2CAP_HEADER_SIZE)
100 
101 // L2CAP Configuration Result Codes
102 #define L2CAP_CONF_RESULT_SUCCESS                  0x0000
103 #define L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS  0x0001
104 #define L2CAP_CONF_RESULT_REJECT                   0x0002
105 #define L2CAP_CONF_RESULT_UNKNOWN_OPTIONS          0x0003
106 #define L2CAP_CONF_RESULT_PENDING                  0x0004
107 #define L2CAP_CONF_RESULT_FLOW_SPEC_REJECTED       0x0005
108 
109 // L2CAP Reject Result Codes
110 #define L2CAP_REJ_CMD_UNKNOWN                      0x0000
111 
112 // Response Timeout eXpired
113 #define L2CAP_RTX_TIMEOUT_MS   10000
114 
115 // Extended Response Timeout eXpired
116 #define L2CAP_ERTX_TIMEOUT_MS 120000
117 
118 // nr of buffered acl packets in outgoing queue to get max performance
119 #define NR_BUFFERED_ACL_PACKETS 3
120 
121 // used to cache l2cap rejects, echo, and informational requests
122 #define NR_PENDING_SIGNALING_RESPONSES 3
123 
124 // nr of credits provided to remote if credits fall below watermark
125 #define L2CAP_CREDIT_BASED_FLOW_CONTROL_MODE_AUTOMATIC_CREDITS_WATERMARK 5
126 #define L2CAP_CREDIT_BASED_FLOW_CONTROL_MODE_AUTOMATIC_CREDITS_INCREMENT 5
127 
128 // offsets for L2CAP SIGNALING COMMANDS
129 #define L2CAP_SIGNALING_COMMAND_CODE_OFFSET   0
130 #define L2CAP_SIGNALING_COMMAND_SIGID_OFFSET  1
131 #define L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET 2
132 #define L2CAP_SIGNALING_COMMAND_DATA_OFFSET   4
133 
134 #if defined(ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE) && !defined(ENABLE_CLASSIC)
135 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE depends on ENABLE_CLASSIC."
136 #error "Please remove ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE or add ENABLE_CLASSIC in btstack_config.h"
137 #endif
138 
139 
140 #ifdef ENABLE_LE_DATA_CHANNELS
141 #warning "ENABLE_LE_DATA_CHANNELS has been deprecated."
142 #warning "Please use ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE instead in btstack_config.h"
143 #define ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
144 #endif
145 
146 #if defined(ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE) || defined(ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE)
147 #define L2CAP_USES_CREDIT_BASED_CHANNELS
148 #endif
149 
150 #if defined(L2CAP_USES_CREDIT_BASED_CHANNELS) || defined(ENABLE_CLASSIC)
151 #define L2CAP_USES_CHANNELS
152 #endif
153 
154 // prototypes
155 static void l2cap_run(void);
156 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
157 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size );
158 static void l2cap_notify_channel_can_send(void);
159 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel);
160 static uint8_t  l2cap_next_sig_id(void);
161 static l2cap_fixed_channel_t * l2cap_fixed_channel_for_channel_id(uint16_t local_cid);
162 #ifdef ENABLE_CLASSIC
163 static void l2cap_handle_security_level_incoming_sufficient(l2cap_channel_t * channel);
164 static int l2cap_security_level_0_allowed_for_PSM(uint16_t psm);
165 static void l2cap_handle_remote_supported_features_received(l2cap_channel_t * channel);
166 static void l2cap_handle_connection_complete(hci_con_handle_t con_handle, l2cap_channel_t * channel);
167 static void l2cap_handle_information_request_complete(hci_connection_t * connection);
168 static inline l2cap_service_t * l2cap_get_service(uint16_t psm);
169 static void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
170 static void l2cap_emit_channel_closed(l2cap_channel_t *channel);
171 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel);
172 static int  l2cap_channel_ready_for_open(l2cap_channel_t *channel);
173 static uint8_t l2cap_classic_send(l2cap_channel_t * channel, const uint8_t *data, uint16_t len);
174 #endif
175 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
176 static void l2cap_cbm_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
177 static void l2cap_cbm_emit_incoming_connection(l2cap_channel_t *channel);
178 static void l2cap_credit_based_notify_channel_can_send(l2cap_channel_t *channel);
179 static void l2cap_cbm_finialize_channel_close(l2cap_channel_t *channel);
180 static inline l2cap_service_t * l2cap_cbm_get_service(uint16_t le_psm);
181 #endif
182 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
183 static uint8_t l2cap_credit_based_send_data(l2cap_channel_t * channel, const uint8_t * data, uint16_t size);
184 static void l2cap_credit_based_send_pdu(l2cap_channel_t *channel);
185 static void l2cap_credit_based_send_credits(l2cap_channel_t *channel);
186 static bool l2cap_credit_based_handle_credit_indication(hci_con_handle_t handle, const uint8_t * command, uint16_t len);
187 static void l2cap_credit_based_handle_pdu(l2cap_channel_t * l2cap_channel, const uint8_t * packet, uint16_t size);
188 #endif
189 #ifdef L2CAP_USES_CHANNELS
190 static uint16_t l2cap_next_local_cid(void);
191 static l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid);
192 static void l2cap_emit_simple_event_with_cid(l2cap_channel_t * channel, uint8_t event_code);
193 static void l2cap_dispatch_to_channel(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size);
194 static l2cap_channel_t * l2cap_create_channel_entry(btstack_packet_handler_t packet_handler, l2cap_channel_type_t channel_type, bd_addr_t address, bd_addr_type_t address_type,
195         uint16_t psm, uint16_t local_mtu, gap_security_level_t security_level);
196 static void l2cap_finalize_channel_close(l2cap_channel_t *channel);
197 static void l2cap_free_channel_entry(l2cap_channel_t * channel);
198 #endif
199 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
200 static void l2cap_ertm_notify_channel_can_send(l2cap_channel_t * channel);
201 static void l2cap_ertm_monitor_timeout_callback(btstack_timer_source_t * ts);
202 static void l2cap_ertm_retransmission_timeout_callback(btstack_timer_source_t * ts);
203 #endif
204 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
205 static int l2cap_ecbm_signaling_handler_dispatch(hci_con_handle_t handle, uint16_t signaling_cid, uint8_t * command, uint8_t sig_id);
206 static void l2cap_run_trigger_callback(void * context);
207 #endif
208 
209 // l2cap_fixed_channel_t entries
210 #ifdef ENABLE_BLE
211 static l2cap_fixed_channel_t l2cap_fixed_channel_le_att;
212 static l2cap_fixed_channel_t l2cap_fixed_channel_le_sm;
213 #endif
214 #ifdef ENABLE_CLASSIC
215 static l2cap_fixed_channel_t l2cap_fixed_channel_classic_connectionless;
216 static l2cap_fixed_channel_t l2cap_fixed_channel_classic_sm;
217 #endif
218 
219 #ifdef ENABLE_CLASSIC
220 static btstack_linked_list_t l2cap_services;
221 static uint8_t l2cap_require_security_level2_for_outgoing_sdp;
222 static bd_addr_t l2cap_outgoing_classic_addr;
223 #endif
224 
225 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
226 static btstack_linked_list_t l2cap_le_services;
227 #endif
228 
229 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
230 static btstack_linked_list_t l2cap_enhanced_services;
231 static uint16_t l2cap_enhanced_mps_min;
232 static uint16_t l2cap_enhanced_mps_max;
233 static btstack_context_callback_registration_t l2cap_trigger_run_registration;
234 #endif
235 
236 // single list of channels for connection-oriented channels (basic, ertm, cbm, ecbf) Classic Connectionless, ATT, and SM
237 static btstack_linked_list_t l2cap_channels;
238 #ifdef L2CAP_USES_CHANNELS
239 // next channel id for new connections
240 static uint16_t  l2cap_local_source_cid;
241 #endif
242 // next signaling sequence number
243 static uint8_t   l2cap_sig_seq_nr;
244 
245 // used to cache l2cap rejects, echo, and informational requests
246 static l2cap_signaling_response_t l2cap_signaling_responses[NR_PENDING_SIGNALING_RESPONSES];
247 static int l2cap_signaling_responses_pending;
248 static btstack_packet_callback_registration_t l2cap_hci_event_callback_registration;
249 
250 static bool l2cap_call_notify_channel_in_run;
251 
252 #ifdef ENABLE_BLE
253 // only used for connection parameter update events
254 static uint16_t l2cap_le_custom_max_mtu;
255 #endif
256 
257 /* callbacks for events */
258 static btstack_linked_list_t l2cap_event_handlers;
259 
260 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
261 
262 // enable for testing
263 // #define L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL 16
264 
265 /*
266  * CRC lookup table for generator polynom D^16 + D^15 + D^2 + 1
267  */
268 static const uint16_t crc16_table[256] = {
269     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241, 0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
270     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40, 0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
271     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40, 0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
272     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641, 0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
273     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240, 0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
274     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41, 0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
275     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41, 0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
276     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640, 0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
277     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240, 0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
278     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41, 0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
279     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41, 0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
280     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640, 0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
281     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241, 0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
282     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40, 0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
283     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40, 0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
284     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641, 0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
285 };
286 
287 static uint16_t crc16_calc(uint8_t * data, uint16_t len){
288     uint16_t crc = 0;   // initial value = 0
289     while (len--){
290         crc = (crc >> 8) ^ crc16_table[ (crc ^ ((uint16_t) *data++)) & 0x00FF ];
291     }
292     return crc;
293 }
294 
295 static inline uint16_t l2cap_encanced_control_field_for_information_frame(uint8_t tx_seq, int final, uint8_t req_seq, l2cap_segmentation_and_reassembly_t sar){
296     return (((uint16_t) sar) << 14) | (req_seq << 8) | (final << 7) | (tx_seq << 1) | 0;
297 }
298 
299 static inline uint16_t l2cap_encanced_control_field_for_supevisor_frame(l2cap_supervisory_function_t supervisory_function, int poll, int final, uint8_t req_seq){
300     return (req_seq << 8) | (final << 7) | (poll << 4) | (((int) supervisory_function) << 2) | 1;
301 }
302 
303 static int l2cap_next_ertm_seq_nr(int seq_nr){
304     return (seq_nr + 1) & 0x3f;
305 }
306 
307 static bool l2cap_ertm_can_store_packet_now(l2cap_channel_t * channel){
308     // get num free tx buffers
309     int num_free_tx_buffers = channel->num_tx_buffers - channel->num_stored_tx_frames;
310     // calculate num tx buffers for remote MTU
311     int num_tx_buffers_for_max_remote_mtu;
312     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
313     if (channel->remote_mtu <= effective_mps){
314         // MTU fits into single packet
315         num_tx_buffers_for_max_remote_mtu = 1;
316     } else {
317         // include SDU Length
318         num_tx_buffers_for_max_remote_mtu = (channel->remote_mtu + 2 + (effective_mps - 1)) / effective_mps;
319     }
320     log_debug("num_free_tx_buffers %u, num_tx_buffers_for_max_remote_mtu %u", num_free_tx_buffers, num_tx_buffers_for_max_remote_mtu);
321     return num_tx_buffers_for_max_remote_mtu <= num_free_tx_buffers;
322 }
323 
324 static void l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel_t * l2cap_channel){
325     log_info("Retransmit unacknowleged frames");
326     l2cap_channel->unacked_frames = 0;;
327     l2cap_channel->tx_send_index  = l2cap_channel->tx_read_index;
328 }
329 
330 static void l2cap_ertm_next_tx_write_index(l2cap_channel_t * channel){
331     channel->tx_write_index++;
332     if (channel->tx_write_index < channel->num_tx_buffers) return;
333     channel->tx_write_index = 0;
334 }
335 
336 static void l2cap_ertm_start_monitor_timer(l2cap_channel_t * channel){
337     log_info("Start Monitor timer");
338     btstack_run_loop_remove_timer(&channel->monitor_timer);
339     btstack_run_loop_set_timer_handler(&channel->monitor_timer, &l2cap_ertm_monitor_timeout_callback);
340     btstack_run_loop_set_timer_context(&channel->monitor_timer, channel);
341     btstack_run_loop_set_timer(&channel->monitor_timer, channel->local_monitor_timeout_ms);
342     btstack_run_loop_add_timer(&channel->monitor_timer);
343 }
344 
345 static void l2cap_ertm_stop_monitor_timer(l2cap_channel_t * channel){
346     log_info("Stop Monitor timer");
347     btstack_run_loop_remove_timer(&channel->monitor_timer);
348 }
349 
350 static void l2cap_ertm_start_retransmission_timer(l2cap_channel_t * channel){
351     log_info("Start Retransmission timer");
352     btstack_run_loop_remove_timer(&channel->retransmission_timer);
353     btstack_run_loop_set_timer_handler(&channel->retransmission_timer, &l2cap_ertm_retransmission_timeout_callback);
354     btstack_run_loop_set_timer_context(&channel->retransmission_timer, channel);
355     btstack_run_loop_set_timer(&channel->retransmission_timer, channel->local_retransmission_timeout_ms);
356     btstack_run_loop_add_timer(&channel->retransmission_timer);
357 }
358 
359 static void l2cap_ertm_stop_retransmission_timer(l2cap_channel_t * l2cap_channel){
360     log_info("Stop Retransmission timer");
361     btstack_run_loop_remove_timer(&l2cap_channel->retransmission_timer);
362 }
363 
364 static void l2cap_ertm_monitor_timeout_callback(btstack_timer_source_t * ts){
365     log_info("Monitor timeout");
366     l2cap_channel_t * l2cap_channel = (l2cap_channel_t *) btstack_run_loop_get_timer_context(ts);
367 
368     // TODO: we assume that it's the oldest packet
369     l2cap_ertm_tx_packet_state_t * tx_state;
370     tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
371 
372     // check retry count
373     if (tx_state->retry_count < l2cap_channel->remote_max_transmit){
374         // increment retry count
375         tx_state->retry_count++;
376 
377         // start retransmit
378         l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
379 
380         // start monitor timer
381         l2cap_ertm_start_monitor_timer(l2cap_channel);
382 
383         // send RR/P=1
384         l2cap_channel->send_supervisor_frame_receiver_ready_poll = 1;
385     } else {
386         log_info("Monitor timer expired & retry count >= max transmit -> disconnect");
387         l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
388     }
389     l2cap_run();
390 }
391 
392 static void l2cap_ertm_retransmission_timeout_callback(btstack_timer_source_t * ts){
393     log_info("Retransmission timeout");
394     l2cap_channel_t * l2cap_channel = (l2cap_channel_t *) btstack_run_loop_get_timer_context(ts);
395 
396     // TODO: we assume that it's the oldest packet
397     l2cap_ertm_tx_packet_state_t * tx_state;
398     tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
399 
400     // set retry count = 1
401     tx_state->retry_count = 1;
402 
403     // start retransmit
404     l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
405 
406     // start monitor timer
407     l2cap_ertm_start_monitor_timer(l2cap_channel);
408 
409     // send RR/P=1
410     l2cap_channel->send_supervisor_frame_receiver_ready_poll = 1;
411     l2cap_run();
412 }
413 
414 static int l2cap_ertm_send_information_frame(l2cap_channel_t * channel, int index, int final){
415     l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[index];
416     hci_reserve_packet_buffer();
417     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
418     uint16_t control = l2cap_encanced_control_field_for_information_frame(tx_state->tx_seq, final, channel->req_seq, tx_state->sar);
419     log_info("I-Frame: control 0x%04x", control);
420     little_endian_store_16(acl_buffer, 8, control);
421     (void)memcpy(&acl_buffer[8 + 2],
422                  &channel->tx_packets_data[index * channel->local_mps],
423                  tx_state->len);
424     // (re-)start retransmission timer on
425     l2cap_ertm_start_retransmission_timer(channel);
426     // send
427     return l2cap_send_prepared(channel->local_cid, 2 + tx_state->len);
428 }
429 
430 static void l2cap_ertm_store_fragment(l2cap_channel_t * channel, l2cap_segmentation_and_reassembly_t sar, uint16_t sdu_length, const uint8_t * data, uint16_t len){
431     // get next index for storing packets
432     int index = channel->tx_write_index;
433 
434     l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[index];
435     tx_state->tx_seq = channel->next_tx_seq;
436     tx_state->sar = sar;
437     tx_state->retry_count = 0;
438 
439     uint8_t * tx_packet = &channel->tx_packets_data[index * channel->local_mps];
440     log_debug("index %u, local mps %u, remote mps %u, packet tx %p, len %u", index, channel->local_mps, channel->remote_mps, tx_packet, len);
441     int pos = 0;
442     if (sar == L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU){
443         little_endian_store_16(tx_packet, 0, sdu_length);
444         pos += 2;
445     }
446     (void)memcpy(&tx_packet[pos], data, len);
447     tx_state->len = pos + len;
448 
449     // update
450     channel->num_stored_tx_frames++;
451     channel->next_tx_seq = l2cap_next_ertm_seq_nr(channel->next_tx_seq);
452     l2cap_ertm_next_tx_write_index(channel);
453 
454     log_info("l2cap_ertm_store_fragment: tx_read_index %u, tx_write_index %u, num stored %u", channel->tx_read_index, channel->tx_write_index, channel->num_stored_tx_frames);
455 
456 }
457 
458 static uint8_t l2cap_ertm_send(l2cap_channel_t * channel, const uint8_t * data, uint16_t len){
459     if (len > channel->remote_mtu){
460         log_error("l2cap_ertm_send cid 0x%02x, data length exceeds remote MTU.", channel->local_cid);
461         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
462     }
463 
464     if (!l2cap_ertm_can_store_packet_now(channel)){
465         log_error("l2cap_ertm_send cid 0x%02x, fragment store full", channel->local_cid);
466         return BTSTACK_ACL_BUFFERS_FULL;
467     }
468 
469     // check if it needs to get fragmented
470     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
471     if (len > effective_mps){
472         // fragmentation needed.
473         l2cap_segmentation_and_reassembly_t sar =  L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU;
474         uint16_t chunk_len = 0;
475         while (len){
476             switch (sar){
477                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
478                     chunk_len = effective_mps - 2;    // sdu_length
479                     l2cap_ertm_store_fragment(channel, sar, len, data, chunk_len);
480                     sar = L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU;
481                     break;
482                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
483                     chunk_len = effective_mps;
484                     if (chunk_len >= len){
485                         sar = L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU;
486                         chunk_len = len;
487                     }
488                     l2cap_ertm_store_fragment(channel, sar, len, data, chunk_len);
489                     break;
490                 default:
491                     btstack_unreachable();
492                     break;
493             }
494             len  -= chunk_len;
495             data += chunk_len;
496         }
497 
498     } else {
499         l2cap_ertm_store_fragment(channel, L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU, 0, data, len);
500     }
501 
502     // try to send
503     l2cap_notify_channel_can_send();
504     return ERROR_CODE_SUCCESS;
505 }
506 
507 static uint16_t l2cap_setup_options_ertm_request(l2cap_channel_t * channel, uint8_t * config_options){
508     int pos = 0;
509     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL;
510     config_options[pos++] = 9;      // length
511     config_options[pos++] = (uint8_t) channel->mode;
512     config_options[pos++] = channel->num_rx_buffers;    // == TxWindows size
513     config_options[pos++] = channel->local_max_transmit;
514     little_endian_store_16( config_options, pos, channel->local_retransmission_timeout_ms);
515     pos += 2;
516     little_endian_store_16( config_options, pos, channel->local_monitor_timeout_ms);
517     pos += 2;
518     little_endian_store_16( config_options, pos, channel->local_mps);
519     pos += 2;
520     //
521     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT;
522     config_options[pos++] = 2;     // length
523     little_endian_store_16(config_options, pos, channel->local_mtu);
524     pos += 2;
525 
526     // Issue: iOS (e.g. 10.2) uses "No FCS" as default while Core 5.0 specifies "FCS" as default
527     // Workaround: try to actively negotiate FCS option
528     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE;
529     config_options[pos++] = 1;     // length
530     config_options[pos++] = channel->fcs_option;
531     return pos; // 11+4+3=18
532 }
533 
534 static uint16_t l2cap_setup_options_ertm_response(l2cap_channel_t * channel, uint8_t * config_options){
535     int pos = 0;
536     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL;
537     config_options[pos++] = 9;      // length
538     config_options[pos++] = (uint8_t) channel->mode;
539     // less or equal to remote tx window size
540     config_options[pos++] = btstack_min(channel->num_tx_buffers, channel->remote_tx_window_size);
541     // max transmit in response shall be ignored -> use sender values
542     config_options[pos++] = channel->remote_max_transmit;
543     // A value for the Retransmission time-out shall be sent in a positive Configuration Response
544     // and indicates the value that will be used by the sender of the Configuration Response -> use our value
545     little_endian_store_16( config_options, pos, channel->local_retransmission_timeout_ms);
546     pos += 2;
547     // A value for the Monitor time-out shall be sent in a positive Configuration Response
548     // and indicates the value that will be used by the sender of the Configuration Response -> use our value
549     little_endian_store_16( config_options, pos, channel->local_monitor_timeout_ms);
550     pos += 2;
551     // less or equal to remote mps
552     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
553     little_endian_store_16( config_options, pos, effective_mps);
554     pos += 2;
555     //
556     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT; // MTU
557     config_options[pos++] = 2;     // length
558     little_endian_store_16(config_options, pos, channel->remote_mtu);
559     pos += 2;
560 #if 0
561     //
562     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE;
563     config_options[pos++] = 1;     // length
564     config_options[pos++] = channel->fcs_option;
565 #endif
566     return pos; // 11+4=15
567 }
568 
569 static int l2cap_ertm_send_supervisor_frame(l2cap_channel_t * channel, uint16_t control){
570     hci_reserve_packet_buffer();
571     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
572     log_info("S-Frame: control 0x%04x", control);
573     little_endian_store_16(acl_buffer, 8, control);
574     return l2cap_send_prepared(channel->local_cid, 2);
575 }
576 
577 static uint8_t l2cap_ertm_validate_local_config(l2cap_ertm_config_t * ertm_config){
578 
579     uint8_t result = ERROR_CODE_SUCCESS;
580     if (ertm_config->max_transmit < 1){
581         log_error("max_transmit must be >= 1");
582         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
583     }
584     if (ertm_config->retransmission_timeout_ms < 2000){
585         log_error("retransmission_timeout_ms must be >= 2000 ms");
586         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
587     }
588     if (ertm_config->monitor_timeout_ms < 12000){
589         log_error("monitor_timeout_ms must be >= 12000 ms");
590         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
591     }
592     if (ertm_config->local_mtu < 48){
593         log_error("local_mtu must be >= 48");
594         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
595     }
596     if (ertm_config->num_rx_buffers < 1){
597         log_error("num_rx_buffers must be >= 1");
598         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
599     }
600     if (ertm_config->num_tx_buffers < 1){
601         log_error("num_rx_buffers must be >= 1");
602         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
603     }
604     return result;
605 }
606 
607 static void l2cap_ertm_setup_buffers(l2cap_channel_t * channel, uint8_t * buffer, uint32_t size){
608     btstack_assert( (((uintptr_t) buffer) & 0x0f) == 0);
609 
610     // setup state buffers - use void cast to avoid -Wcast-align warning
611     uint32_t pos = 0;
612     channel->rx_packets_state = (l2cap_ertm_rx_packet_state_t *) (void *) &buffer[pos];
613     pos += channel->num_rx_buffers * sizeof(l2cap_ertm_rx_packet_state_t);
614     channel->tx_packets_state = (l2cap_ertm_tx_packet_state_t *) (void *) &buffer[pos];
615     pos += channel->num_tx_buffers * sizeof(l2cap_ertm_tx_packet_state_t);
616 
617     // setup reassembly buffer
618     channel->reassembly_buffer = &buffer[pos];
619     pos += channel->local_mtu;
620 
621     // setup rx buffers
622     channel->rx_packets_data = &buffer[pos];
623     pos += channel->num_rx_buffers * channel->local_mps;
624 
625     // setup tx buffers
626     channel->tx_packets_data = &buffer[pos];
627     pos += channel->num_rx_buffers * channel->remote_mps;
628 
629     btstack_assert(pos <= size);
630     UNUSED(pos);
631 }
632 
633 static void l2cap_ertm_configure_channel(l2cap_channel_t * channel, l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size){
634 
635     channel->mode  = L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION;
636     channel->ertm_mandatory = ertm_config->ertm_mandatory;
637     channel->local_max_transmit = ertm_config->max_transmit;
638     channel->local_retransmission_timeout_ms = ertm_config->retransmission_timeout_ms;
639     channel->local_monitor_timeout_ms = ertm_config->monitor_timeout_ms;
640     channel->local_mtu = ertm_config->local_mtu;
641     channel->num_rx_buffers = ertm_config->num_rx_buffers;
642     channel->num_tx_buffers = ertm_config->num_tx_buffers;
643     channel->fcs_option = ertm_config->fcs_option;
644 
645     // align buffer to 16-byte boundary to assert l2cap_ertm_rx_packet_state_t is aligned
646     int bytes_till_alignment = 16 - (((uintptr_t) buffer) & 0x0f);
647     buffer += bytes_till_alignment;
648     size   -= bytes_till_alignment;
649 
650     // calculate space for rx and tx buffers
651     uint32_t state_len = channel->num_rx_buffers * sizeof(l2cap_ertm_rx_packet_state_t) + channel->num_tx_buffers * sizeof(l2cap_ertm_tx_packet_state_t);
652     uint32_t buffer_space = size - state_len - channel->local_mtu;
653 
654     // divide rest of data equally for initial config
655     uint16_t mps = buffer_space / (ertm_config->num_rx_buffers + ertm_config->num_tx_buffers);
656     channel->local_mps  = mps;
657     channel->remote_mps = mps;
658     l2cap_ertm_setup_buffers(channel, buffer, size);
659 
660     log_info("Local MPS: %u", channel->local_mps);
661 }
662 
663 uint8_t l2cap_ertm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t address, uint16_t psm,
664     l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size, uint16_t * out_local_cid){
665 
666     log_info("l2cap_ertm_create_channel addr %s, psm 0x%x, local mtu %u", bd_addr_to_str(address), psm, ertm_config->local_mtu);
667 
668     // validate local config
669     uint8_t result = l2cap_ertm_validate_local_config(ertm_config);
670     if (result) return result;
671 
672     // determine security level based on psm
673     const gap_security_level_t security_level = l2cap_security_level_0_allowed_for_PSM(psm) ? LEVEL_0 : gap_get_security_level();
674 
675     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, address, BD_ADDR_TYPE_ACL, psm, ertm_config->local_mtu, security_level);
676     if (!channel) {
677         return BTSTACK_MEMORY_ALLOC_FAILED;
678     }
679 
680     // configure ERTM
681     l2cap_ertm_configure_channel(channel, ertm_config, buffer, size);
682 
683     // add to connections list
684     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
685 
686     // store local_cid
687     if (out_local_cid){
688        *out_local_cid = channel->local_cid;
689     }
690 
691     // check if hci connection is already usable
692     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_ACL);
693     if (conn){
694         log_info("l2cap_create_channel, hci connection already exists");
695         l2cap_handle_connection_complete(conn->con_handle, channel);
696         // check if remote supported fearures are already received
697         if (hci_remote_features_available(conn->con_handle)) {
698             l2cap_handle_remote_supported_features_received(channel);
699         } else {
700             hci_remote_features_query(conn->con_handle);
701         };
702     }
703 
704     l2cap_run();
705 
706     return 0;
707 }
708 
709 static void l2cap_ertm_notify_channel_can_send(l2cap_channel_t * channel){
710     if (l2cap_ertm_can_store_packet_now(channel)){
711         channel->waiting_for_can_send_now = 0;
712         l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
713     }
714 }
715 
716 uint8_t l2cap_ertm_accept_connection(uint16_t local_cid, l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size){
717 
718     log_info("l2cap_ertm_accept_connection local_cid 0x%x", local_cid);
719     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
720     if (!channel) {
721         log_error("l2cap_accept_connection called but local_cid 0x%x not found", local_cid);
722         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
723     }
724 
725     // validate local config
726     uint8_t result = l2cap_ertm_validate_local_config(ertm_config);
727     if (result) return result;
728 
729     // configure L2CAP ERTM
730     l2cap_ertm_configure_channel(channel, ertm_config, buffer, size);
731 
732     // we need to know if ERTM is supported before sending a config response
733     channel->state = L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES;
734     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
735     btstack_assert(connection != NULL);
736     switch (connection->l2cap_state.information_state){
737         case L2CAP_INFORMATION_STATE_IDLE:
738             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
739             break;
740         case L2CAP_INFORMATION_STATE_DONE:
741             l2cap_handle_information_request_complete(connection);
742             break;
743         default:
744             break;
745     }
746 
747     l2cap_run();
748 
749     return ERROR_CODE_SUCCESS;
750 }
751 
752 uint8_t l2cap_ertm_decline_connection(uint16_t local_cid){
753     l2cap_decline_connection(local_cid);
754     return ERROR_CODE_SUCCESS;
755 }
756 
757 uint8_t l2cap_ertm_set_busy(uint16_t local_cid){
758     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
759     if (!channel) {
760         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
761         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
762     }
763     if (!channel->local_busy){
764         channel->local_busy = 1;
765         channel->send_supervisor_frame_receiver_not_ready = 1;
766         l2cap_run();
767     }
768     return ERROR_CODE_SUCCESS;
769 }
770 
771 uint8_t l2cap_ertm_set_ready(uint16_t local_cid){
772     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
773     if (!channel) {
774         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
775         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
776     }
777     if (channel->local_busy){
778         channel->local_busy = 0;
779         channel->send_supervisor_frame_receiver_ready_poll = 1;
780         l2cap_run();
781     }
782     return ERROR_CODE_SUCCESS;
783 }
784 
785 // Process-ReqSeq
786 static void l2cap_ertm_process_req_seq(l2cap_channel_t * l2cap_channel, uint8_t req_seq){
787     int num_buffers_acked = 0;
788     l2cap_ertm_tx_packet_state_t * tx_state;
789     log_info("l2cap_ertm_process_req_seq: tx_read_index %u, tx_write_index %u, req_seq %u", l2cap_channel->tx_read_index, l2cap_channel->tx_write_index, req_seq);
790     while (true){
791 
792         // no unack packets left
793         if (l2cap_channel->unacked_frames == 0) {
794             // stop retransmission timer
795             l2cap_ertm_stop_retransmission_timer(l2cap_channel);
796             break;
797         }
798 
799         tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
800         // calc delta
801         int delta = (req_seq - tx_state->tx_seq) & 0x03f;
802         if (delta == 0) break;  // all packets acknowledged
803         if (delta > l2cap_channel->remote_tx_window_size) break;
804 
805         num_buffers_acked++;
806         l2cap_channel->num_stored_tx_frames--;
807         l2cap_channel->unacked_frames--;
808         log_info("RR seq %u => packet with tx_seq %u done", req_seq, tx_state->tx_seq);
809 
810         l2cap_channel->tx_read_index++;
811         if (l2cap_channel->tx_read_index >= l2cap_channel->num_rx_buffers){
812             l2cap_channel->tx_read_index = 0;
813         }
814     }
815     if (num_buffers_acked){
816         log_info("num_buffers_acked %u", num_buffers_acked);
817     l2cap_ertm_notify_channel_can_send(l2cap_channel);
818 }
819 }
820 
821 static l2cap_ertm_tx_packet_state_t * l2cap_ertm_get_tx_state(l2cap_channel_t * l2cap_channel, uint8_t tx_seq){
822     int i;
823     for (i=0;i<l2cap_channel->num_tx_buffers;i++){
824         l2cap_ertm_tx_packet_state_t * tx_state = &l2cap_channel->tx_packets_state[i];
825         if (tx_state->tx_seq == tx_seq) return tx_state;
826     }
827     return NULL;
828 }
829 
830 // @param delta number of frames in the future, >= 1
831 // @assumption size <= l2cap_channel->local_mps (checked in l2cap_acl_classic_handler)
832 static void l2cap_ertm_handle_out_of_sequence_sdu(l2cap_channel_t * l2cap_channel, l2cap_segmentation_and_reassembly_t sar, int delta, const uint8_t * payload, uint16_t size){
833     log_info("Store SDU with delta %u", delta);
834     // get rx state for packet to store
835     int index = l2cap_channel->rx_store_index + delta - 1;
836     if (index > l2cap_channel->num_rx_buffers){
837         index -= l2cap_channel->num_rx_buffers;
838     }
839     log_info("Index of packet to store %u", index);
840     l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
841     // check if buffer is free
842     if (rx_state->valid){
843         log_error("Packet buffer already used");
844         return;
845     }
846     rx_state->valid = 1;
847     rx_state->sar = sar;
848     rx_state->len = size;
849     uint8_t * rx_buffer = &l2cap_channel->rx_packets_data[index];
850     (void)memcpy(rx_buffer, payload, size);
851 }
852 
853 // @assumption size <= l2cap_channel->local_mps (checked in l2cap_acl_classic_handler)
854 static void l2cap_ertm_handle_in_sequence_sdu(l2cap_channel_t * l2cap_channel, l2cap_segmentation_and_reassembly_t sar, const uint8_t * payload, uint16_t size){
855     uint16_t reassembly_sdu_length;
856     switch (sar){
857         case L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU:
858             // assert total packet size <= our mtu
859             if (size > l2cap_channel->local_mtu) break;
860             // packet complete -> disapatch
861             l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, (uint8_t*) payload, size);
862             break;
863         case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
864             // read SDU len
865             reassembly_sdu_length = little_endian_read_16(payload, 0);
866             payload += 2;
867             size    -= 2;
868             // assert reassembled size <= our mtu
869             if (reassembly_sdu_length > l2cap_channel->local_mtu) break;
870             // store start segment
871             l2cap_channel->reassembly_sdu_length = reassembly_sdu_length;
872             (void)memcpy(&l2cap_channel->reassembly_buffer[0], payload, size);
873             l2cap_channel->reassembly_pos = size;
874             break;
875         case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
876             // assert size of reassembled data <= our mtu
877             if (l2cap_channel->reassembly_pos + size > l2cap_channel->local_mtu) break;
878             // store continuation segment
879             (void)memcpy(&l2cap_channel->reassembly_buffer[l2cap_channel->reassembly_pos],
880                          payload, size);
881             l2cap_channel->reassembly_pos += size;
882             break;
883         case L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU:
884             // assert size of reassembled data <= our mtu
885             if (l2cap_channel->reassembly_pos + size > l2cap_channel->local_mtu) break;
886             // store continuation segment
887             (void)memcpy(&l2cap_channel->reassembly_buffer[l2cap_channel->reassembly_pos],
888                          payload, size);
889             l2cap_channel->reassembly_pos += size;
890             // assert size of reassembled data matches announced sdu length
891             if (l2cap_channel->reassembly_pos != l2cap_channel->reassembly_sdu_length) break;
892             // packet complete -> disapatch
893             l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->reassembly_buffer, l2cap_channel->reassembly_pos);
894             l2cap_channel->reassembly_pos = 0;
895             break;
896         default:
897             btstack_assert(false);
898             break;
899     }
900 }
901 
902 static void l2cap_ertm_channel_send_information_frame(l2cap_channel_t * channel){
903     channel->unacked_frames++;
904     int index = channel->tx_send_index;
905     channel->tx_send_index++;
906     if (channel->tx_send_index >= channel->num_tx_buffers){
907         channel->tx_send_index = 0;
908     }
909     l2cap_ertm_send_information_frame(channel, index, 0);   // final = 0
910 }
911 
912 #endif
913 
914 #ifdef L2CAP_USES_CHANNELS
915 static uint16_t l2cap_next_local_cid(void){
916     do {
917         if (l2cap_local_source_cid == 0xfffeu) {
918             l2cap_local_source_cid = 0x40;
919         } else {
920             l2cap_local_source_cid++;
921         }
922     } while (l2cap_get_channel_for_local_cid(l2cap_local_source_cid) != NULL);
923     return l2cap_local_source_cid;
924 }
925 #endif
926 
927 static uint8_t l2cap_next_sig_id(void){
928     if (l2cap_sig_seq_nr == 0xffu) {
929         l2cap_sig_seq_nr = 1;
930     } else {
931         l2cap_sig_seq_nr++;
932     }
933     return l2cap_sig_seq_nr;
934 }
935 
936 void l2cap_init(void){
937 #ifdef L2CAP_USES_CHANNELS
938     l2cap_local_source_cid  = 0x40;
939 #endif
940     l2cap_sig_seq_nr  = 0xff;
941 
942 #ifdef ENABLE_CLASSIC
943     // Setup Connectionless Channel
944     l2cap_fixed_channel_classic_connectionless.local_cid     = L2CAP_CID_CONNECTIONLESS_CHANNEL;
945     l2cap_fixed_channel_classic_connectionless.channel_type  = L2CAP_CHANNEL_TYPE_CONNECTIONLESS;
946     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_classic_connectionless);
947 #endif
948 
949 #ifdef ENABLE_BLE
950     // Setup fixed ATT Channel
951     l2cap_fixed_channel_le_att.local_cid    = L2CAP_CID_ATTRIBUTE_PROTOCOL;
952     l2cap_fixed_channel_le_att.channel_type = L2CAP_CHANNEL_TYPE_FIXED_LE;
953     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_le_att);
954 
955     // Setup fixed SM Channel
956     l2cap_fixed_channel_le_sm.local_cid     = L2CAP_CID_SECURITY_MANAGER_PROTOCOL;
957     l2cap_fixed_channel_le_sm.channel_type  = L2CAP_CHANNEL_TYPE_FIXED_LE;
958     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_le_sm);
959 #endif
960 #ifdef ENABLE_CLASSIC
961     // Setup fixed SM Channel
962     l2cap_fixed_channel_classic_sm.local_cid     = L2CAP_CID_BR_EDR_SECURITY_MANAGER;
963     l2cap_fixed_channel_classic_sm.channel_type  = L2CAP_CHANNEL_TYPE_FIXED_CLASSIC;
964     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_classic_sm);
965 #endif
966 
967 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
968     l2cap_enhanced_mps_min = 0x0001;
969     l2cap_enhanced_mps_max = 0xffff;
970     l2cap_trigger_run_registration.callback = &l2cap_run_trigger_callback;
971 #endif
972 
973     //
974     // register callback with HCI
975     //
976     l2cap_hci_event_callback_registration.callback = &l2cap_hci_event_handler;
977     hci_add_event_handler(&l2cap_hci_event_callback_registration);
978 
979     hci_register_acl_packet_handler(&l2cap_acl_handler);
980 
981 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
982 #ifdef ENABLE_CLASSIC
983     gap_connectable_control(0); // no services yet
984 #endif
985 #endif
986 }
987 
988 /**
989  * @brief De-Init L2CAP
990  */
991 void l2cap_deinit(void){
992     l2cap_channels = NULL;
993     l2cap_signaling_responses_pending = 0;
994 #ifdef ENABLE_CLASSIC
995     l2cap_require_security_level2_for_outgoing_sdp = 0;
996     (void)memset(&l2cap_fixed_channel_classic_connectionless, 0, sizeof(l2cap_fixed_channel_classic_connectionless));
997     l2cap_services = NULL;
998     (void)memset(l2cap_outgoing_classic_addr, 0, 6);
999     (void)memset(&l2cap_fixed_channel_classic_sm, 0, sizeof(l2cap_fixed_channel_classic_sm));
1000 #endif
1001 #ifdef ENABLE_BLE
1002     l2cap_le_custom_max_mtu = 0;
1003     (void)memset(&l2cap_fixed_channel_le_att, 0, sizeof(l2cap_fixed_channel_le_att));
1004     (void)memset(&l2cap_fixed_channel_le_sm, 0, sizeof(l2cap_fixed_channel_le_sm));
1005 #endif
1006 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1007     l2cap_le_services = NULL;
1008 #endif
1009 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1010     l2cap_enhanced_services = NULL;
1011 #endif
1012     l2cap_event_handlers = NULL;
1013 }
1014 
1015 void l2cap_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
1016     btstack_linked_list_add_tail(&l2cap_event_handlers, (btstack_linked_item_t*) callback_handler);
1017 }
1018 
1019 void l2cap_remove_event_handler(btstack_packet_callback_registration_t * callback_handler){
1020     btstack_linked_list_remove(&l2cap_event_handlers, (btstack_linked_item_t*) callback_handler);
1021 }
1022 
1023 static void l2cap_emit_event(uint8_t *event, uint16_t size) {
1024     hci_dump_packet( HCI_EVENT_PACKET, 1, event, size);
1025     // dispatch to all event handlers
1026     btstack_linked_list_iterator_t it;
1027     btstack_linked_list_iterator_init(&it, &l2cap_event_handlers);
1028     while (btstack_linked_list_iterator_has_next(&it)){
1029         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
1030         entry->callback(HCI_EVENT_PACKET, 0, event, size);
1031     }
1032 }
1033 
1034 void l2cap_request_can_send_fix_channel_now_event(hci_con_handle_t con_handle, uint16_t channel_id){
1035     UNUSED(con_handle);  // ok: there is no con handle
1036 
1037     l2cap_fixed_channel_t * channel = l2cap_fixed_channel_for_channel_id(channel_id);
1038     if (!channel) return;
1039     channel->waiting_for_can_send_now = 1;
1040     l2cap_notify_channel_can_send();
1041 }
1042 
1043 bool l2cap_can_send_fixed_channel_packet_now(hci_con_handle_t con_handle, uint16_t channel_id){
1044     UNUSED(channel_id); // ok: only depends on Controller LE buffers
1045 
1046     return hci_can_send_acl_packet_now(con_handle);
1047 }
1048 
1049 uint8_t *l2cap_get_outgoing_buffer(void){
1050     return hci_get_outgoing_packet_buffer() + COMPLETE_L2CAP_HEADER; // 8 bytes
1051 }
1052 
1053 // only for L2CAP Basic Channels
1054 bool l2cap_reserve_packet_buffer(void){
1055     return hci_reserve_packet_buffer();
1056 }
1057 
1058 // only for L2CAP Basic Channels
1059 void l2cap_release_packet_buffer(void){
1060     hci_release_packet_buffer();
1061 }
1062 
1063 static void l2cap_setup_header(uint8_t * acl_buffer, hci_con_handle_t con_handle, uint8_t packet_boundary, uint16_t remote_cid, uint16_t len){
1064     // 0 - Connection handle : PB=pb : BC=00
1065     little_endian_store_16(acl_buffer, 0u, con_handle | (packet_boundary << 12u) | (0u << 14u));
1066     // 2 - ACL length
1067     little_endian_store_16(acl_buffer, 2u,  len + 4u);
1068     // 4 - L2CAP packet length
1069     little_endian_store_16(acl_buffer, 4u,  len + 0u);
1070     // 6 - L2CAP channel DEST
1071     little_endian_store_16(acl_buffer, 6,  remote_cid);
1072 }
1073 
1074 // assumption - only on LE connections
1075 uint8_t l2cap_send_prepared_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint16_t len){
1076 
1077     if (!hci_is_packet_buffer_reserved()){
1078         log_error("l2cap_send_prepared_connectionless called without reserving packet first");
1079         return BTSTACK_ACL_BUFFERS_FULL;
1080     }
1081 
1082     if (!hci_can_send_prepared_acl_packet_now(con_handle)){
1083         log_info("l2cap_send_prepared_connectionless handle 0x%02x, cid 0x%02x, cannot send", con_handle, cid);
1084         return BTSTACK_ACL_BUFFERS_FULL;
1085     }
1086 
1087     log_debug("l2cap_send_prepared_connectionless handle %u, cid 0x%02x", con_handle, cid);
1088 
1089     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1090     l2cap_setup_header(acl_buffer, con_handle, 0, cid, len);
1091     // send
1092     return hci_send_acl_packet_buffer(len+8u);
1093 }
1094 
1095 // assumption - only on LE connections
1096 uint8_t l2cap_send_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint8_t *data, uint16_t len){
1097 
1098     if (!hci_can_send_acl_packet_now(con_handle)){
1099         log_info("l2cap_send cid 0x%02x, cannot send", cid);
1100         return BTSTACK_ACL_BUFFERS_FULL;
1101     }
1102 
1103     hci_reserve_packet_buffer();
1104     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1105 
1106     (void)memcpy(&acl_buffer[8], data, len);
1107 
1108     return l2cap_send_prepared_connectionless(con_handle, cid, len);
1109 }
1110 
1111 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel) {
1112     log_debug("L2CAP_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel);
1113     uint8_t event[4];
1114     event[0] = L2CAP_EVENT_CAN_SEND_NOW;
1115     event[1] = sizeof(event) - 2u;
1116     little_endian_store_16(event, 2, channel);
1117     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
1118     packet_handler(HCI_EVENT_PACKET, channel, event, sizeof(event));
1119 }
1120 
1121 #ifdef L2CAP_USES_CHANNELS
1122 static void l2cap_dispatch_to_channel(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size){
1123     (* (channel->packet_handler))(type, channel->local_cid, data, size);
1124 }
1125 
1126 static void l2cap_emit_simple_event_with_cid(l2cap_channel_t * channel, uint8_t event_code){
1127     uint8_t event[4];
1128     event[0] = event_code;
1129     event[1] = sizeof(event) - 2u;
1130     little_endian_store_16(event, 2, channel->local_cid);
1131     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
1132     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1133 }
1134 #endif
1135 
1136 #ifdef ENABLE_CLASSIC
1137 void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
1138     log_info("L2CAP_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u, flush_timeout %u",
1139              status, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
1140              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu, channel->flush_timeout);
1141     uint8_t event[26];
1142     event[0] = L2CAP_EVENT_CHANNEL_OPENED;
1143     event[1] = sizeof(event) - 2;
1144     event[2] = status;
1145     reverse_bd_addr(channel->address, &event[3]);
1146     little_endian_store_16(event,  9, channel->con_handle);
1147     little_endian_store_16(event, 11, channel->psm);
1148     little_endian_store_16(event, 13, channel->local_cid);
1149     little_endian_store_16(event, 15, channel->remote_cid);
1150     little_endian_store_16(event, 17, channel->local_mtu);
1151     little_endian_store_16(event, 19, channel->remote_mtu);
1152     little_endian_store_16(event, 21, channel->flush_timeout);
1153     event[23] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
1154 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1155     log_info("ERTM mode %u, fcs enabled %u", channel->mode, channel->fcs_option);
1156     event[24] = channel->mode;
1157     event[25] = channel->fcs_option;
1158 
1159 #else
1160     event[24] = L2CAP_CHANNEL_MODE_BASIC;
1161     event[25] = 0;
1162 #endif
1163     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
1164     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1165 }
1166 
1167 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel) {
1168     log_info("L2CAP_EVENT_INCOMING_CONNECTION addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x",
1169              bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid);
1170     uint8_t event[16];
1171     event[0] = L2CAP_EVENT_INCOMING_CONNECTION;
1172     event[1] = sizeof(event) - 2;
1173     reverse_bd_addr(channel->address, &event[2]);
1174     little_endian_store_16(event,  8, channel->con_handle);
1175     little_endian_store_16(event, 10, channel->psm);
1176     little_endian_store_16(event, 12, channel->local_cid);
1177     little_endian_store_16(event, 14, channel->remote_cid);
1178     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
1179     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1180 }
1181 
1182 static void l2cap_handle_channel_open_failed(l2cap_channel_t * channel, uint8_t status){
1183 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1184     // emit ertm buffer released, as it's not needed. if in basic mode, it was either not allocated or already released
1185     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1186         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1187     }
1188 #endif
1189     l2cap_emit_channel_opened(channel, status);
1190 }
1191 
1192 #endif
1193 
1194 #ifdef L2CAP_USES_CHANNELS
1195 
1196 static void l2cap_emit_channel_closed(l2cap_channel_t *channel) {
1197     log_info("L2CAP_EVENT_CHANNEL_CLOSED local_cid 0x%x", channel->local_cid);
1198     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
1199 }
1200 
1201 static void l2cap_handle_channel_closed(l2cap_channel_t * channel){
1202 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1203     // emit ertm buffer released, as it's not needed anymore. if in basic mode, it was either not allocated or already released
1204     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1205         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1206     }
1207 #endif
1208     l2cap_emit_channel_closed(channel);
1209 }
1210 #endif
1211 
1212 static l2cap_fixed_channel_t * l2cap_channel_item_by_cid(uint16_t cid){
1213     btstack_linked_list_iterator_t it;
1214     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1215     while (btstack_linked_list_iterator_has_next(&it)){
1216         l2cap_fixed_channel_t * channel = (l2cap_fixed_channel_t*) btstack_linked_list_iterator_next(&it);
1217         if (channel->local_cid == cid) {
1218             return channel;
1219         }
1220     }
1221     return NULL;
1222 }
1223 
1224 // used for fixed channels in LE (ATT/SM) and Classic (Connectionless Channel). CID < 0x04
1225 static l2cap_fixed_channel_t * l2cap_fixed_channel_for_channel_id(uint16_t local_cid){
1226     if (local_cid >= 0x40u) return NULL;
1227     return (l2cap_fixed_channel_t*) l2cap_channel_item_by_cid(local_cid);
1228 }
1229 
1230 #ifdef L2CAP_USES_CHANNELS
1231 
1232 static int l2cap_is_dynamic_channel_type(l2cap_channel_type_t channel_type) {
1233     switch (channel_type) {
1234         case L2CAP_CHANNEL_TYPE_CLASSIC:
1235         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
1236         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
1237             return 1;
1238         default:
1239             return 0;
1240     }
1241 }
1242 
1243 static l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid){
1244     if (local_cid < 0x40u) return NULL;
1245     return (l2cap_channel_t*) l2cap_channel_item_by_cid(local_cid);
1246 }
1247 
1248 static l2cap_channel_t * l2cap_get_channel_for_local_cid_and_handle(uint16_t local_cid, hci_con_handle_t con_handle){
1249     if (local_cid < 0x40u) return NULL;
1250     l2cap_channel_t * l2cap_channel = (l2cap_channel_t*) l2cap_channel_item_by_cid(local_cid);
1251     if (l2cap_channel == NULL)  return NULL;
1252     if (l2cap_channel->con_handle != con_handle) return NULL;
1253     return l2cap_channel;
1254 }
1255 #endif
1256 
1257 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
1258 static l2cap_channel_t * l2cap_get_channel_for_remote_handle_and_cid(hci_con_handle_t con_handle, uint16_t remote_cid){
1259     btstack_linked_list_iterator_t it;
1260     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1261     while (btstack_linked_list_iterator_has_next(&it)){
1262         l2cap_fixed_channel_t * channel = (l2cap_fixed_channel_t*) btstack_linked_list_iterator_next(&it);
1263         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
1264         l2cap_channel_t * dynamic_channel = (l2cap_channel_t *) channel;
1265         if (dynamic_channel->con_handle != con_handle) continue;
1266         if (dynamic_channel->remote_cid != remote_cid) continue;
1267         return dynamic_channel;
1268     }
1269     return NULL;
1270 }
1271 #endif
1272 
1273 #ifdef L2CAP_USES_CHANNELS
1274 uint8_t l2cap_request_can_send_now_event(uint16_t local_cid){
1275     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1276     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
1277     channel->waiting_for_can_send_now = 1;
1278     switch (channel->channel_type){
1279         case L2CAP_CHANNEL_TYPE_CLASSIC:
1280 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1281             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1282                 l2cap_ertm_notify_channel_can_send(channel);
1283                 return ERROR_CODE_SUCCESS;
1284             }
1285 #endif
1286             l2cap_notify_channel_can_send();
1287             break;
1288 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1289         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
1290             l2cap_credit_based_notify_channel_can_send(channel);
1291             break;
1292 #endif
1293 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1294         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
1295             l2cap_credit_based_notify_channel_can_send(channel);
1296             break;
1297 #endif
1298         default:
1299             break;
1300     }
1301     return ERROR_CODE_SUCCESS;
1302 }
1303 
1304 bool l2cap_can_send_packet_now(uint16_t local_cid){
1305     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1306     if (!channel) return false;
1307     if (channel->state != L2CAP_STATE_OPEN) return false;
1308     switch (channel->channel_type){
1309         case L2CAP_CHANNEL_TYPE_CLASSIC:
1310 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1311             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1312                 return l2cap_ertm_can_store_packet_now(channel);
1313             }
1314 #endif
1315             return hci_can_send_acl_packet_now(channel->con_handle);
1316 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1317         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
1318             return channel->send_sdu_buffer == NULL;
1319 #endif
1320 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1321         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
1322             return channel->send_sdu_buffer == NULL;
1323 #endif
1324         default:
1325             return false;
1326     }
1327 }
1328 
1329 uint8_t l2cap_send(uint16_t local_cid, const uint8_t *data, uint16_t len){
1330     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1331     if (!channel) {
1332         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
1333         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
1334     }
1335     switch (channel->channel_type){
1336 #ifdef ENABLE_CLASSIC
1337         case L2CAP_CHANNEL_TYPE_CLASSIC:
1338             return l2cap_classic_send(channel, data, len);
1339 #endif
1340 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1341         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
1342             return l2cap_credit_based_send_data(channel, data, len);
1343 #endif
1344 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1345         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
1346             return l2cap_credit_based_send_data(channel, data, len);
1347 #endif
1348         default:
1349             return ERROR_CODE_UNSPECIFIED_ERROR;
1350     }
1351 }
1352 #endif
1353 
1354 #ifdef ENABLE_CLASSIC
1355 bool l2cap_can_send_prepared_packet_now(uint16_t local_cid){
1356     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1357     if (!channel) return false;
1358 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1359     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1360         return false;
1361     }
1362 #endif
1363     return hci_can_send_prepared_acl_packet_now(channel->con_handle);
1364 }
1365 
1366 uint16_t l2cap_get_remote_mtu_for_local_cid(uint16_t local_cid){
1367     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1368     if (channel) {
1369         return channel->remote_mtu;
1370     }
1371     return 0;
1372 }
1373 #endif
1374 
1375 #ifdef ENABLE_CLASSIC
1376 // RTX Timer only exist for dynamic channels
1377 static l2cap_channel_t * l2cap_channel_for_rtx_timer(btstack_timer_source_t * ts){
1378     btstack_linked_list_iterator_t it;
1379     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1380     while (btstack_linked_list_iterator_has_next(&it)){
1381         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1382         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
1383         if (&channel->rtx == ts) {
1384             return channel;
1385         }
1386     }
1387     return NULL;
1388 }
1389 
1390 static void l2cap_rtx_timeout(btstack_timer_source_t * ts){
1391     l2cap_channel_t * channel = l2cap_channel_for_rtx_timer(ts);
1392     if (!channel) return;
1393 
1394     log_info("l2cap_rtx_timeout for local cid 0x%02x", channel->local_cid);
1395 
1396     // "When terminating the channel, it is not necessary to send a L2CAP_DisconnectReq
1397     //  and enter WAIT_DISCONNECT state. Channels can be transitioned directly to the CLOSED state."
1398     // notify client
1399     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_RTX_TIMEOUT);
1400 
1401     // discard channel
1402     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1403     l2cap_free_channel_entry(channel);
1404 }
1405 
1406 static uint8_t l2cap_classic_packet_boundary_flag(void){
1407     return (hci_non_flushable_packet_boundary_flag_supported() && (hci_automatic_flush_timeout() == 0)) ? 0x00 : 0x02;
1408 }
1409 #endif
1410 
1411 #ifdef L2CAP_USES_CHANNELS
1412 static void l2cap_stop_rtx(l2cap_channel_t * channel){
1413     log_info("l2cap_stop_rtx for local cid 0x%02x", channel->local_cid);
1414     btstack_run_loop_remove_timer(&channel->rtx);
1415 }
1416 #endif
1417 
1418 static uint8_t l2cap_send_signaling_packet(hci_con_handle_t handle, uint8_t pb_flags, uint16_t cid, L2CAP_SIGNALING_COMMANDS cmd, int identifier, va_list argptr){
1419     if (!hci_can_send_acl_packet_now(handle)){
1420         log_info("l2cap_send_classic_signaling_packet, cannot send");
1421         return BTSTACK_ACL_BUFFERS_FULL;
1422     }
1423     hci_reserve_packet_buffer();
1424     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1425     uint16_t len = l2cap_create_signaling_packet(acl_buffer, handle, pb_flags, cid, cmd, identifier, argptr);
1426     va_end(argptr);
1427     return hci_send_acl_packet_buffer(len);
1428 }
1429 
1430 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
1431 static int l2cap_send_general_signaling_packet(hci_con_handle_t handle, uint16_t signaling_cid, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1432     va_list argptr;
1433     va_start(argptr, identifier);
1434     uint8_t pb_flags = 0x00;
1435 #ifdef ENABLE_CLASSIC
1436     if (signaling_cid == L2CAP_CID_SIGNALING){
1437         pb_flags = l2cap_classic_packet_boundary_flag();
1438     }
1439 #endif
1440 uint8_t result = l2cap_send_signaling_packet(handle, pb_flags, signaling_cid, cmd, identifier, argptr);
1441     va_end(argptr);
1442     return result;
1443 }
1444 #endif
1445 
1446 #ifdef ENABLE_CLASSIC
1447 
1448 static void l2cap_start_rtx(l2cap_channel_t * channel){
1449     l2cap_stop_rtx(channel);
1450     log_info("l2cap_start_rtx for local cid 0x%02x", channel->local_cid);
1451     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
1452     btstack_run_loop_set_timer(&channel->rtx, L2CAP_RTX_TIMEOUT_MS);
1453     btstack_run_loop_add_timer(&channel->rtx);
1454 }
1455 
1456 static void l2cap_start_ertx(l2cap_channel_t * channel){
1457     log_info("l2cap_start_ertx for local cid 0x%02x", channel->local_cid);
1458     l2cap_stop_rtx(channel);
1459     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
1460     btstack_run_loop_set_timer(&channel->rtx, L2CAP_ERTX_TIMEOUT_MS);
1461     btstack_run_loop_add_timer(&channel->rtx);
1462 }
1463 
1464 void l2cap_require_security_level_2_for_outgoing_sdp(void){
1465     l2cap_require_security_level2_for_outgoing_sdp = 1;
1466 }
1467 
1468 static int l2cap_security_level_0_allowed_for_PSM(uint16_t psm){
1469     return (psm == BLUETOOTH_PSM_SDP) && (!l2cap_require_security_level2_for_outgoing_sdp);
1470 }
1471 
1472 static int l2cap_send_classic_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1473     va_list argptr;
1474     va_start(argptr, identifier);
1475     uint8_t pb_flag = l2cap_classic_packet_boundary_flag();
1476     uint8_t result = l2cap_send_signaling_packet(handle, pb_flag, L2CAP_CID_SIGNALING, cmd, identifier, argptr);
1477     va_end(argptr);
1478     return result;
1479 }
1480 
1481 // assumption - only on Classic connections
1482 // cannot be used for L2CAP ERTM
1483 uint8_t l2cap_send_prepared(uint16_t local_cid, uint16_t len){
1484 
1485     if (!hci_is_packet_buffer_reserved()){
1486         log_error("l2cap_send_prepared called without reserving packet first");
1487         return BTSTACK_ACL_BUFFERS_FULL;
1488     }
1489 
1490     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1491     if (!channel) {
1492         log_error("l2cap_send_prepared no channel for cid 0x%02x", local_cid);
1493         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
1494     }
1495 
1496     if (!hci_can_send_prepared_acl_packet_now(channel->con_handle)){
1497         log_info("l2cap_send_prepared cid 0x%02x, cannot send", local_cid);
1498         return BTSTACK_ACL_BUFFERS_FULL;
1499     }
1500 
1501     log_debug("l2cap_send_prepared cid 0x%02x, handle %u, 1 credit used", local_cid, channel->con_handle);
1502 
1503     int fcs_size = 0;
1504 
1505 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1506     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION && channel->fcs_option){
1507         fcs_size = 2;
1508     }
1509 #endif
1510 
1511     // set non-flushable packet boundary flag if supported on Controller
1512     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1513     uint8_t packet_boundary_flag = l2cap_classic_packet_boundary_flag();
1514     l2cap_setup_header(acl_buffer, channel->con_handle, packet_boundary_flag, channel->remote_cid, len + fcs_size);
1515 
1516 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1517     if (fcs_size){
1518         // calculate FCS over l2cap data
1519         uint16_t fcs = crc16_calc(acl_buffer + 4, 4 + len);
1520         log_info("I-Frame: fcs 0x%04x", fcs);
1521         little_endian_store_16(acl_buffer, 8 + len, fcs);
1522     }
1523 #endif
1524 
1525     // send
1526     return hci_send_acl_packet_buffer(len+8+fcs_size);
1527 }
1528 
1529 // assumption - only on Classic connections
1530 static uint8_t l2cap_classic_send(l2cap_channel_t * channel, const uint8_t *data, uint16_t len){
1531 
1532 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1533     // send in ERTM
1534     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1535         return l2cap_ertm_send(channel, data, len);
1536     }
1537 #endif
1538 
1539     if (len > channel->remote_mtu){
1540         log_error("l2cap_send cid 0x%02x, data length exceeds remote MTU.", channel->local_cid);
1541         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
1542     }
1543 
1544     if (!hci_can_send_acl_packet_now(channel->con_handle)){
1545         log_info("l2cap_send cid 0x%02x, cannot send", channel->local_cid);
1546         return BTSTACK_ACL_BUFFERS_FULL;
1547     }
1548 
1549     hci_reserve_packet_buffer();
1550     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1551     (void)memcpy(&acl_buffer[8], data, len);
1552     return l2cap_send_prepared(channel->local_cid, len);
1553 }
1554 
1555 int l2cap_send_echo_request(hci_con_handle_t con_handle, uint8_t *data, uint16_t len){
1556     return l2cap_send_classic_signaling_packet(con_handle, ECHO_REQUEST, l2cap_next_sig_id(), len, data);
1557 }
1558 
1559 static inline void channelStateVarSetFlag(l2cap_channel_t *channel, uint16_t flag){
1560     channel->state_var = channel->state_var | flag;
1561 }
1562 
1563 static inline void channelStateVarClearFlag(l2cap_channel_t *channel, uint16_t flag){
1564     channel->state_var = channel->state_var & ~flag;
1565 }
1566 #endif
1567 
1568 
1569 #ifdef ENABLE_BLE
1570 static int l2cap_send_le_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1571     va_list argptr;
1572     va_start(argptr, identifier);
1573     uint8_t pb_flags = 0x00;  // First non-automatically-flushable packet of a higher layer message
1574     uint8_t result = l2cap_send_signaling_packet(handle, pb_flags, L2CAP_CID_SIGNALING_LE, cmd, identifier, argptr);
1575     va_end(argptr);
1576     return result;
1577 }
1578 #endif
1579 
1580 uint16_t l2cap_max_mtu(void){
1581     return HCI_ACL_PAYLOAD_SIZE - L2CAP_HEADER_SIZE;
1582 }
1583 
1584 #ifdef ENABLE_BLE
1585 uint16_t l2cap_max_le_mtu(void){
1586     if (l2cap_le_custom_max_mtu != 0u) return l2cap_le_custom_max_mtu;
1587     return l2cap_max_mtu();
1588 }
1589 
1590 void l2cap_set_max_le_mtu(uint16_t max_mtu){
1591     if (max_mtu < l2cap_max_mtu()){
1592         l2cap_le_custom_max_mtu = max_mtu;
1593     }
1594 }
1595 #endif
1596 
1597 #ifdef ENABLE_CLASSIC
1598 
1599 static uint16_t l2cap_setup_options_mtu(uint8_t * config_options, uint16_t mtu){
1600     config_options[0] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT; // MTU
1601     config_options[1] = 2; // len param
1602     little_endian_store_16(config_options, 2, mtu);
1603     return 4;
1604 }
1605 
1606 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1607 static int l2cap_ertm_mode(l2cap_channel_t * channel){
1608     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
1609     return ((connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_DONE)
1610         &&  (connection->l2cap_state.extended_feature_mask & 0x08));
1611 }
1612 #endif
1613 
1614 static uint16_t l2cap_setup_options_request(l2cap_channel_t * channel, uint8_t * config_options){
1615 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1616     // use ERTM options if supported by remote and channel ready to use it
1617     if (l2cap_ertm_mode(channel) && channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1618         return l2cap_setup_options_ertm_request(channel, config_options);
1619     }
1620 #endif
1621     uint16_t mtu = channel->local_mtu;
1622     return l2cap_setup_options_mtu(config_options, mtu);
1623 }
1624 
1625 static uint16_t l2cap_setup_options_mtu_response(l2cap_channel_t * channel, uint8_t * config_options){
1626     uint16_t mtu = btstack_min(channel->local_mtu, channel->remote_mtu);
1627     return l2cap_setup_options_mtu(config_options, mtu);
1628 }
1629 
1630 static uint32_t l2cap_extended_features_mask(void){
1631     // extended features request supported, features: fixed channels, unicast connectionless data reception
1632     uint32_t features = 0x280;
1633 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1634     features |= 0x0028;
1635 #endif
1636     return features;
1637 }
1638 #endif
1639 
1640 //
1641 #ifdef ENABLE_CLASSIC
1642 
1643 // returns true if channel was finalized
1644 static bool l2cap_run_for_classic_channel(l2cap_channel_t * channel){
1645 
1646 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1647     uint8_t  config_options[18];
1648 #else
1649     uint8_t  config_options[10];
1650 #endif
1651 
1652     switch (channel->state){
1653 
1654         case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
1655         case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
1656             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1657             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND) {
1658                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND);
1659                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONN_RESP_PEND);
1660                 l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1661                                                     channel->local_cid, channel->remote_cid, 1, 0);
1662             }
1663             break;
1664 
1665         case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
1666             if (!hci_can_send_command_packet_now()) break;
1667             // send connection request - set state first
1668             channel->state = L2CAP_STATE_WAIT_CONNECTION_COMPLETE;
1669             // BD_ADDR, Packet_Type, Page_Scan_Repetition_Mode, Reserved, Clock_Offset, Allow_Role_Switch
1670             (void)memcpy(l2cap_outgoing_classic_addr, channel->address, 6);
1671             hci_send_cmd(&hci_create_connection, channel->address, hci_usable_acl_packet_types(), 0, 0, 0, hci_get_allow_role_switch());
1672             break;
1673 
1674         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
1675             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1676             channel->state = L2CAP_STATE_INVALID;
1677             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1678                                                 channel->local_cid, channel->remote_cid, channel->reason, 0);
1679             // discard channel - l2cap_finialize_channel_close without sending l2cap close event
1680             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1681             l2cap_free_channel_entry(channel);
1682             channel = NULL;
1683             break;
1684 
1685         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
1686             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1687             channel->state = L2CAP_STATE_CONFIG;
1688             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1689             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1690                                                 channel->local_cid, channel->remote_cid, 0, 0);
1691             break;
1692 
1693         case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
1694             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1695             // success, start l2cap handshake
1696             channel->local_sig_id = l2cap_next_sig_id();
1697             channel->state = L2CAP_STATE_WAIT_CONNECT_RSP;
1698             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_REQUEST, channel->local_sig_id,
1699                                                 channel->psm, channel->local_cid);
1700             l2cap_start_rtx(channel);
1701             break;
1702 
1703         case L2CAP_STATE_CONFIG:
1704             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1705 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1706             // fallback to basic mode if ERTM requested but not not supported by remote
1707             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1708                 if (!l2cap_ertm_mode(channel)){
1709                     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1710                     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
1711                 }
1712             }
1713 #endif
1714             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP){
1715                 uint16_t flags = 0;
1716                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
1717                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT) {
1718                     flags = 1;
1719                 } else {
1720                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1721                 }
1722                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID){
1723                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1724                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1725                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_UNKNOWN_OPTIONS,
1726                                                         1, &channel->unknown_option);
1727 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1728                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED){
1729                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
1730                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1731                     uint16_t options_size = l2cap_setup_options_ertm_response(channel, config_options);
1732                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1733                                                         channel->remote_cid, flags,
1734                                                         L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS, options_size,
1735                                                         &config_options);
1736                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM){
1737                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
1738                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1739                     uint16_t options_size = l2cap_setup_options_ertm_response(channel, config_options);
1740                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1741                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS,
1742                                                         options_size, &config_options);
1743 #endif
1744                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU){
1745                     channelStateVarClearFlag(channel,L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1746                     uint16_t options_size = l2cap_setup_options_mtu_response(channel, config_options);
1747                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1748                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS,
1749                                                         options_size, &config_options);
1750                 } else {
1751                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1752                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS, 0, NULL);
1753                 }
1754                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
1755             }
1756             else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ){
1757                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1758                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_REQ);
1759                 channel->local_sig_id = l2cap_next_sig_id();
1760                 uint16_t options_size = l2cap_setup_options_request(channel, config_options);
1761                 l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_REQUEST, channel->local_sig_id,
1762                                                     channel->remote_cid, 0, options_size, &config_options);
1763                 l2cap_start_rtx(channel);
1764             }
1765             if (l2cap_channel_ready_for_open(channel)){
1766                 channel->state = L2CAP_STATE_OPEN;
1767                 l2cap_emit_channel_opened(channel, 0);  // success
1768             }
1769             break;
1770 
1771         case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
1772             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1773             channel->state = L2CAP_STATE_INVALID;
1774             l2cap_send_classic_signaling_packet(channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id,
1775                                                 channel->local_cid, channel->remote_cid);
1776             // we don't start an RTX timer for a disconnect - there's no point in closing the channel if the other side doesn't respond :)
1777             l2cap_finalize_channel_close(channel);  // -- remove from list
1778             channel = NULL;
1779             break;
1780 
1781         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
1782             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1783             channel->local_sig_id = l2cap_next_sig_id();
1784             channel->state = L2CAP_STATE_WAIT_DISCONNECT;
1785             l2cap_send_classic_signaling_packet(channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id,
1786                                                 channel->remote_cid, channel->local_cid);
1787             break;
1788         default:
1789             break;
1790     }
1791 
1792     // handle channel finalize on L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE and L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE
1793     return channel == NULL;
1794 }
1795 
1796 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1797 static void l2cap_run_for_classic_channel_ertm(l2cap_channel_t * channel){
1798 
1799     // ERTM mode
1800     if (channel->mode != L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) return;
1801 
1802     // check if we can still send
1803     if (channel->con_handle == HCI_CON_HANDLE_INVALID) return;
1804     if (!hci_can_send_acl_packet_now(channel->con_handle)) return;
1805 
1806     if (channel->send_supervisor_frame_receiver_ready){
1807         channel->send_supervisor_frame_receiver_ready = 0;
1808         log_info("Send S-Frame: RR %u, final %u", channel->req_seq, channel->set_final_bit_after_packet_with_poll_bit_set);
1809         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY, 0,  channel->set_final_bit_after_packet_with_poll_bit_set, channel->req_seq);
1810         channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1811         l2cap_ertm_send_supervisor_frame(channel, control);
1812         return;
1813     }
1814     if (channel->send_supervisor_frame_receiver_ready_poll){
1815         channel->send_supervisor_frame_receiver_ready_poll = 0;
1816         log_info("Send S-Frame: RR %u with poll=1 ", channel->req_seq);
1817         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY, 1, 0, channel->req_seq);
1818         l2cap_ertm_send_supervisor_frame(channel, control);
1819         return;
1820     }
1821     if (channel->send_supervisor_frame_receiver_not_ready){
1822         channel->send_supervisor_frame_receiver_not_ready = 0;
1823         log_info("Send S-Frame: RNR %u", channel->req_seq);
1824         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY, 0, 0, channel->req_seq);
1825         l2cap_ertm_send_supervisor_frame(channel, control);
1826         return;
1827     }
1828     if (channel->send_supervisor_frame_reject){
1829         channel->send_supervisor_frame_reject = 0;
1830         log_info("Send S-Frame: REJ %u", channel->req_seq);
1831         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT, 0, 0, channel->req_seq);
1832         l2cap_ertm_send_supervisor_frame(channel, control);
1833         return;
1834     }
1835     if (channel->send_supervisor_frame_selective_reject){
1836         channel->send_supervisor_frame_selective_reject = 0;
1837         log_info("Send S-Frame: SREJ %u", channel->expected_tx_seq);
1838         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT, 0, channel->set_final_bit_after_packet_with_poll_bit_set, channel->expected_tx_seq);
1839         channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1840         l2cap_ertm_send_supervisor_frame(channel, control);
1841         return;
1842     }
1843 
1844     if (channel->srej_active){
1845         int i;
1846         for (i=0;i<channel->num_tx_buffers;i++){
1847             l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[i];
1848             if (tx_state->retransmission_requested) {
1849                 tx_state->retransmission_requested = 0;
1850                 uint8_t final = channel->set_final_bit_after_packet_with_poll_bit_set;
1851                 channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1852                 l2cap_ertm_send_information_frame(channel, i, final);
1853                 break;
1854             }
1855         }
1856         if (i == channel->num_tx_buffers){
1857             // no retransmission request found
1858             channel->srej_active = 0;
1859         } else {
1860             // packet was sent
1861             return;
1862         }
1863     }
1864 }
1865 #endif /* ERTM */
1866 #endif /* Classic */
1867 
1868 static void l2cap_run_signaling_response(void) {
1869 
1870     // check pending signaling responses
1871     while (l2cap_signaling_responses_pending){
1872 
1873         hci_con_handle_t handle = l2cap_signaling_responses[0].handle;
1874 
1875         if (!hci_can_send_acl_packet_now(handle)) break;
1876 
1877         uint8_t  sig_id        = l2cap_signaling_responses[0].sig_id;
1878         uint8_t  response_code = l2cap_signaling_responses[0].code;
1879         uint16_t result        = l2cap_signaling_responses[0].data;  // CONNECTION_REQUEST, COMMAND_REJECT, REJECT_SM_PAIRING, L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1880         uint8_t  buffer[2];                                          // REJECT_SM_PAIRING
1881         uint16_t source_cid    = l2cap_signaling_responses[0].cid;   // CONNECTION_REQUEST, REJECT_SM_PAIRING
1882 #ifdef ENABLE_CLASSIC
1883         uint16_t info_type     = l2cap_signaling_responses[0].data;  // INFORMATION_REQUEST
1884 #endif
1885 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1886         uint8_t num_channels = l2cap_signaling_responses[0].cid >> 8;                 // L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1887         uint16_t signaling_cid = (uint16_t) l2cap_signaling_responses[0].cid & 0xff;  // L2CAP_CREDIT_BASED_CONNECTION_REQUEST, L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1888 #endif
1889 
1890         // remove first item before sending (to avoid sending response mutliple times)
1891         l2cap_signaling_responses_pending--;
1892         int i;
1893         for (i=0; i < l2cap_signaling_responses_pending; i++){
1894             (void)memcpy(&l2cap_signaling_responses[i],
1895                          &l2cap_signaling_responses[i + 1],
1896                          sizeof(l2cap_signaling_response_t));
1897         }
1898 
1899         switch (response_code){
1900 #ifdef ENABLE_CLASSIC
1901             case CONNECTION_REQUEST:
1902                 l2cap_send_classic_signaling_packet(handle, CONNECTION_RESPONSE, sig_id, source_cid, 0, result, 0);
1903                 break;
1904             case ECHO_REQUEST:
1905                 l2cap_send_classic_signaling_packet(handle, ECHO_RESPONSE, sig_id, 0, NULL);
1906                 break;
1907             case INFORMATION_REQUEST:
1908                 switch (info_type){
1909                     case L2CAP_INFO_TYPE_CONNECTIONLESS_MTU: {
1910                             uint16_t connectionless_mtu = hci_max_acl_data_packet_length();
1911                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1912                                                             sizeof(connectionless_mtu), &connectionless_mtu);
1913                         }
1914                         break;
1915                     case L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED: {
1916                             uint32_t features = l2cap_extended_features_mask();
1917                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1918                                                             sizeof(features), &features);
1919                         }
1920                         break;
1921                     case L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED: {
1922                             uint8_t map[8];
1923                             memset(map, 0, 8);
1924                             // L2CAP Signaling Channel + Connectionless reception
1925                             map[0] = (1 << L2CAP_CID_SIGNALING) | (1 << L2CAP_CID_CONNECTIONLESS_CHANNEL);
1926 #if defined(ENABLE_BLE) || defined (ENABLE_EXPLICIT_BR_EDR_SECURITY_MANAGER)
1927                             // BR/EDR Security Manager (bit 7) if BR/EDR Secure Connections possible
1928                             if (gap_secure_connections_active()){
1929                                 map[0] |= (1 << L2CAP_CID_BR_EDR_SECURITY_MANAGER);
1930                             }
1931 #endif
1932                             l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1933                                                             sizeof(map), &map);
1934                         }
1935                         break;
1936                     default:
1937                         // all other types are not supported
1938                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 1, 0, NULL);
1939                         break;
1940                 }
1941                 break;
1942             case COMMAND_REJECT:
1943                 l2cap_send_classic_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
1944                 break;
1945 #endif
1946 #ifdef ENABLE_BLE
1947             case LE_CREDIT_BASED_CONNECTION_REQUEST:
1948                 l2cap_send_le_signaling_packet(handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, sig_id, 0, 0, 0, 0, result);
1949                 break;
1950             case COMMAND_REJECT_LE:
1951                 l2cap_send_le_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
1952                 break;
1953 #endif
1954 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
1955             case L2CAP_CREDIT_BASED_CONNECTION_REQUEST: {
1956                 // send variable size array or cids with each cid being zero
1957                 uint16_t cids[6];
1958                 (void) memset(cids, 0xff, sizeof(cids));
1959                 (void) memset(cids, 0x00, num_channels * sizeof(uint16_t));
1960                 l2cap_send_general_signaling_packet(handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_RESPONSE,
1961                                                     sig_id, 0, 0, 0, result, cids);
1962                 break;
1963             }
1964 
1965             case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
1966                 l2cap_send_general_signaling_packet(handle, signaling_cid, L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE,
1967                                                     sig_id, result);
1968                 break;
1969 #endif
1970             case SM_PAIRING_FAILED:
1971                 buffer[0] = SM_CODE_PAIRING_FAILED;
1972                 buffer[1] = (uint8_t) result;
1973                 l2cap_send_connectionless(handle, source_cid, buffer, 2);
1974                 break;
1975             default:
1976                 // should not happen
1977                 break;
1978         }
1979     }
1980 }
1981 
1982 #ifdef ENABLE_CLASSIC
1983 static bool l2ap_run_information_requests(void){
1984     // send l2cap information request if requested
1985     btstack_linked_list_iterator_t it;
1986     hci_connections_get_iterator(&it);
1987     uint8_t info_type;
1988     l2cap_information_state_t new_state;
1989     while(btstack_linked_list_iterator_has_next(&it)){
1990         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1991         switch (connection->l2cap_state.information_state){
1992             case L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST:
1993                 info_type = L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED;
1994                 new_state = L2CAP_INFORMATION_STATE_W4_EXTENDED_FEATURE_RESPONSE;
1995                 break;
1996             case L2CAP_INFORMATION_STATE_W2_SEND_FIXED_CHANNELS_REQUEST:
1997                 info_type = L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED;
1998                 new_state = L2CAP_INFORMATION_STATE_W4_FIXED_CHANNELS_RESPONSE;
1999                 break;
2000             default:
2001                 continue;
2002         }
2003         if (!hci_can_send_acl_packet_now(connection->con_handle)) break;
2004 
2005         connection->l2cap_state.information_state = new_state;
2006         uint8_t sig_id = l2cap_next_sig_id();
2007         l2cap_send_classic_signaling_packet(connection->con_handle, INFORMATION_REQUEST, sig_id, info_type);
2008     }
2009     return false;
2010 }
2011 #endif
2012 
2013 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2014 static void l2cap_cbm_run_channels(void){
2015     btstack_linked_list_iterator_t it;
2016     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2017     while (btstack_linked_list_iterator_has_next(&it)){
2018         uint16_t mps;
2019         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2020 
2021         if (channel->channel_type != L2CAP_CHANNEL_TYPE_CHANNEL_CBM) continue;
2022 
2023         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
2024         switch (channel->state){
2025             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST:
2026                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2027                 channel->state = L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE;
2028                 // le psm, source cid, mtu, mps, initial credits
2029                 channel->local_sig_id = l2cap_next_sig_id();
2030                 channel->credits_incoming =  channel->new_credits_incoming;
2031                 channel->new_credits_incoming = 0;
2032                 channel->local_mps = btstack_min(l2cap_max_le_mtu(), channel->local_mtu);
2033                 l2cap_send_le_signaling_packet( channel->con_handle, LE_CREDIT_BASED_CONNECTION_REQUEST,
2034                                                 channel->local_sig_id, channel->psm, channel->local_cid, channel->local_mtu,
2035                                                 channel->local_mps, channel->credits_incoming);
2036                 break;
2037             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT:
2038                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2039                 // TODO: support larger MPS
2040                 channel->state = L2CAP_STATE_OPEN;
2041                 channel->credits_incoming =  channel->new_credits_incoming;
2042                 channel->new_credits_incoming = 0;
2043                 mps = btstack_min(l2cap_max_le_mtu(), channel->local_mtu);
2044                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->local_mtu, mps, channel->credits_incoming, 0);
2045                 // notify client
2046                 l2cap_cbm_emit_channel_opened(channel, ERROR_CODE_SUCCESS);
2047                 break;
2048             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE:
2049                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2050                 channel->state = L2CAP_STATE_INVALID;
2051                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, 0, 0, 0, 0, channel->reason);
2052                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
2053                 btstack_linked_list_iterator_remove(&it);
2054                 l2cap_free_channel_entry(channel);
2055                 break;
2056             case L2CAP_STATE_OPEN:
2057                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2058                 if (channel->new_credits_incoming){
2059                     l2cap_credit_based_send_credits(channel);
2060                 }
2061                 break;
2062             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2063                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2064                 channel->local_sig_id = l2cap_next_sig_id();
2065                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
2066                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
2067                 break;
2068             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
2069                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
2070                 channel->state = L2CAP_STATE_INVALID;
2071                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
2072                 l2cap_cbm_finialize_channel_close(channel);  // -- remove from list
2073                 break;
2074             default:
2075                 break;
2076         }
2077     }
2078 }
2079 
2080 static inline uint8_t l2cap_cbm_status_for_result(uint16_t result) {
2081     switch (result) {
2082         case L2CAP_CBM_CONNECTION_RESULT_SUCCESS:
2083             return ERROR_CODE_SUCCESS;
2084         case L2CAP_CBM_CONNECTION_RESULT_SPSM_NOT_SUPPORTED:
2085             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_PSM;
2086         case L2CAP_CBM_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE:
2087             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_RESOURCES;
2088         case L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_AUTHENTICATION:
2089         case L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_AUTHORIZATION:
2090         case L2CAP_CBM_CONNECTION_RESULT_ENCYRPTION_KEY_SIZE_TOO_SHORT:
2091         case L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_ENCRYPTION:
2092             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY;
2093         default:
2094             // invalid Source CID, Source CID already allocated, unacceptable parameters
2095             return L2CAP_CONNECTION_RESPONSE_UNKNOWN_ERROR;
2096     }
2097 }
2098 
2099 #endif
2100 
2101 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2102 
2103 static void l2cap_run_trigger_callback(void * context){
2104     UNUSED(context);
2105     l2cap_run();
2106 }
2107 
2108 static void l2cap_run_trigger(void){
2109     btstack_run_loop_execute_on_main_thread(&l2cap_trigger_run_registration);
2110 }
2111 
2112 // 11BH22222
2113 static void l2cap_ecbm_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
2114     log_info("opened ecbm channel status 0x%x addr_type %u addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u",
2115             status, channel->address_type, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
2116             channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu);
2117     uint8_t event[23];
2118     event[0] = L2CAP_EVENT_ECBM_CHANNEL_OPENED;
2119     event[1] = sizeof(event) - 2u;
2120     event[2] = status;
2121     event[3] = channel->address_type;
2122     reverse_bd_addr(channel->address, &event[4]);
2123     little_endian_store_16(event, 10, channel->con_handle);
2124     event[12] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
2125     little_endian_store_16(event, 13, channel->psm);
2126     little_endian_store_16(event, 15, channel->local_cid);
2127     little_endian_store_16(event, 17, channel->remote_cid);
2128     little_endian_store_16(event, 19, channel->local_mtu);
2129     little_endian_store_16(event, 21, channel->remote_mtu);
2130     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
2131     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2132 }
2133 
2134 static void l2cap_ecbm_emit_reconfigure_complete(l2cap_channel_t *channel, uint16_t result) {
2135     // emit event
2136     uint8_t event[6];
2137     event[0] = L2CAP_EVENT_ECBM_RECONFIGURATION_COMPLETE;
2138     event[1] = sizeof(event) - 2;
2139     little_endian_store_16(event, 2, channel->local_cid);
2140     little_endian_store_16(event, 4, result);
2141     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2142 }
2143 
2144 static void l2cap_ecbm_run_channels(void) {
2145     hci_con_handle_t con_handle = HCI_CON_HANDLE_INVALID;
2146     // num max channels + 1 for signaling pdu generator
2147     uint16_t cids[L2CAP_ECBM_MAX_CID_ARRAY_SIZE + 1];
2148     uint8_t num_cids = 0;
2149     uint8_t sig_id;
2150     uint16_t spsm;
2151     L2CAP_STATE matching_state;
2152     bool match_remote_sig_cid;
2153     uint8_t result = 0;
2154     uint16_t local_mtu;
2155     uint16_t initial_credits;
2156     uint16_t signaling_cid;
2157     L2CAP_STATE new_state;
2158     uint16_t local_mps;
2159 
2160     // pick first channel that needs to send a combined signaling pdu and setup collection via break
2161     // then collect all others that belong to the same pdu
2162     btstack_linked_list_iterator_t it;
2163     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2164     while (btstack_linked_list_iterator_has_next(&it)) {
2165         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2166         if (channel->channel_type != L2CAP_CHANNEL_TYPE_CHANNEL_ECBM) continue;
2167         if (con_handle == HCI_CON_HANDLE_INVALID) {
2168             switch (channel->state) {
2169                 case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2170                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2171                     local_mtu = channel->local_mtu;
2172                     local_mps = channel->local_mps;
2173                     spsm = channel->psm;
2174                     result = channel->reason;
2175                     initial_credits = channel->credits_incoming;
2176                     sig_id = channel->local_sig_id;
2177                     new_state = L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE;
2178                     match_remote_sig_cid = false;
2179                     break;
2180                 case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE:
2181                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2182                     local_mtu = channel->local_mtu;
2183                     local_mps = channel->local_mps;
2184                     initial_credits = channel->credits_incoming;
2185                     sig_id = channel->remote_sig_id;
2186                     new_state = L2CAP_STATE_OPEN;
2187                     match_remote_sig_cid = true;
2188                     break;
2189                 case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2190                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2191                     sig_id = channel->local_sig_id;
2192                     local_mtu = channel->renegotiate_mtu;
2193                     local_mps = channel->local_mps;
2194                     new_state = L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE;
2195                     match_remote_sig_cid = false;
2196                     break;
2197                 case L2CAP_STATE_OPEN:
2198                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2199                     if (channel->new_credits_incoming) {
2200                         l2cap_credit_based_send_credits(channel);
2201                     }
2202                     continue;
2203                 case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2204                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2205                     channel->local_sig_id = l2cap_next_sig_id();
2206                     channel->state = L2CAP_STATE_WAIT_DISCONNECT;
2207                     signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2208                     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, DISCONNECTION_REQUEST,
2209                                                         channel->local_sig_id, channel->remote_cid, channel->local_cid);
2210                     continue;
2211                 case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
2212                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2213                     channel->state = L2CAP_STATE_INVALID;
2214                     signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2215                     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, DISCONNECTION_RESPONSE,
2216                                                         channel->remote_sig_id, channel->local_cid,
2217                                                         channel->remote_cid);
2218                     l2cap_cbm_finialize_channel_close(channel);  // -- remove from list
2219                     continue;
2220                 default:
2221                     continue;
2222             }
2223 
2224             // channel picked - setup cid array and collect info
2225             (void) memset(cids, 0xff, sizeof(cids));
2226             (void) memset(cids, 0, channel->num_cids * sizeof(uint16_t));
2227             matching_state = channel->state;
2228             con_handle = channel->con_handle;
2229             signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2230             num_cids = channel->num_cids;
2231 
2232         } else {
2233             // check if it matches first channel by state, con_handle, and signaling id
2234             if (matching_state != channel->state) continue;
2235             if (channel->con_handle != con_handle) continue;
2236             if (match_remote_sig_cid) {
2237                 if (channel->remote_sig_id != sig_id) continue;
2238             } else {
2239                 if (channel->local_sig_id != sig_id) continue;
2240             }
2241         }
2242 
2243         // add this cid
2244         cids[channel->cid_index] = channel->local_cid;
2245 
2246         // set new state
2247         channel->state = new_state;
2248 
2249         // handle open for L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE
2250         if (matching_state == L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE) {
2251             if (channel->reason == L2CAP_ECBM_CONNECTION_RESULT_ALL_SUCCESS) {
2252                 l2cap_ecbm_emit_channel_opened(channel, ERROR_CODE_SUCCESS);
2253             } else {
2254                 result = channel->reason;
2255                 btstack_linked_list_iterator_remove(&it);
2256                 btstack_memory_l2cap_channel_free(channel);
2257             }
2258         }
2259     }
2260 
2261     if (con_handle != HCI_CON_HANDLE_INVALID) {
2262         switch (matching_state) {
2263             case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2264                 log_info("send combined connection request for %u cids", num_cids);
2265                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_REQUEST,
2266                                                     sig_id, spsm, local_mtu, local_mps, initial_credits, cids);
2267                 break;
2268             case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE:
2269                 log_info("send combined connection response for %u cids", num_cids);
2270                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_RESPONSE,
2271                                                     sig_id, local_mtu, local_mps, initial_credits, result, cids);
2272                 break;
2273             case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2274                 log_info("send combined renegotiation request for %u cids", num_cids);
2275                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST,
2276                                                     sig_id, local_mtu, local_mps, cids);
2277                 break;
2278             default:
2279                 break;
2280         }
2281     }
2282 }
2283 #endif
2284 
2285 // MARK: L2CAP_RUN
2286 // process outstanding signaling tasks
2287 static void l2cap_run(void){
2288 
2289     // log_info("l2cap_run: entered");
2290     l2cap_run_signaling_response();
2291 
2292 #ifdef ENABLE_CLASSIC
2293     bool done = l2ap_run_information_requests();
2294     if (done) return;
2295 #endif
2296 
2297 #if defined(ENABLE_CLASSIC) || defined(ENABLE_BLE)
2298     btstack_linked_list_iterator_t it;
2299 #endif
2300 
2301 #ifdef ENABLE_CLASSIC
2302     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2303     while (btstack_linked_list_iterator_has_next(&it)){
2304 
2305         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2306 
2307         if (channel->channel_type != L2CAP_CHANNEL_TYPE_CLASSIC) continue;
2308 
2309         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
2310         bool finalized = l2cap_run_for_classic_channel(channel);
2311 
2312         if (!finalized) {
2313 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2314             l2cap_run_for_classic_channel_ertm(channel);
2315 #endif
2316         }
2317     }
2318 #endif
2319 
2320 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2321     l2cap_cbm_run_channels();
2322 #endif
2323 
2324 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2325     l2cap_ecbm_run_channels();
2326 #endif
2327 
2328 #ifdef ENABLE_BLE
2329     // send l2cap con paramter update if necessary
2330     hci_connections_get_iterator(&it);
2331     while(btstack_linked_list_iterator_has_next(&it)){
2332         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2333         if ((connection->address_type != BD_ADDR_TYPE_LE_PUBLIC) && (connection->address_type != BD_ADDR_TYPE_LE_RANDOM)) continue;
2334         if (!hci_can_send_acl_packet_now(connection->con_handle)) continue;
2335         switch (connection->le_con_parameter_update_state){
2336             case CON_PARAMETER_UPDATE_SEND_REQUEST:
2337                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
2338                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_REQUEST, l2cap_next_sig_id(),
2339                                                connection->le_conn_interval_min, connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout);
2340                 break;
2341             case CON_PARAMETER_UPDATE_SEND_RESPONSE:
2342                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS;
2343                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 0);
2344                 break;
2345             case CON_PARAMETER_UPDATE_DENY:
2346                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
2347                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 1);
2348                 break;
2349             default:
2350                 break;
2351         }
2352     }
2353 #endif
2354 
2355     if (l2cap_call_notify_channel_in_run){
2356         l2cap_call_notify_channel_in_run = false;
2357         l2cap_notify_channel_can_send();
2358     }
2359 
2360     // log_info("l2cap_run: exit");
2361 }
2362 
2363 #ifdef ENABLE_CLASSIC
2364 static void l2cap_ready_to_connect(l2cap_channel_t * channel){
2365 
2366 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2367     // assumption: outgoing connection
2368     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
2369         // ERTM requested: trigger information request if not already started then wait for response
2370         hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
2371         switch (connection->l2cap_state.information_state){
2372             case L2CAP_INFORMATION_STATE_DONE:
2373                 break;
2374             case L2CAP_INFORMATION_STATE_IDLE:
2375                 connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
2376                 /* fall through */
2377             default:
2378                 channel->state = L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES;
2379                 return;
2380         }
2381     }
2382 #endif
2383 
2384     // fine, go ahead
2385     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
2386 }
2387 
2388 static void l2cap_handle_connection_complete(hci_con_handle_t con_handle, l2cap_channel_t * channel){
2389     if ((channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE) || (channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION)) {
2390         log_info("connection complete con_handle %04x - for channel %p cid 0x%04x", (int) con_handle, channel, channel->local_cid);
2391         channel->con_handle = con_handle;
2392         // query remote features if pairing is required
2393         if (channel->required_security_level > LEVEL_0){
2394             channel->state = L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES;
2395             hci_remote_features_query(con_handle);
2396         } else {
2397             l2cap_ready_to_connect(channel);
2398         }
2399     }
2400 }
2401 
2402 static void l2cap_handle_remote_supported_features_received(l2cap_channel_t * channel){
2403     if (channel->state != L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES) return;
2404 
2405     bool security_required = channel->required_security_level > LEVEL_0;
2406 
2407     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) != 0){
2408 
2409         // Core V5.2, Vol 3, Part C, 5.2.2.2 - Security Mode 4
2410         //   When a remote device attempts to access a service offered by a Bluetooth device that is in security mode 4
2411         //   and a sufficient link key exists and authentication has not been performed the local device shall authenticate
2412         //   the remote device and enable encryption after the channel establishment request is received but before a channel
2413         //   establishment confirmation (L2CAP_ConnectRsp with result code of 0x0000 or a higher-level channel establishment
2414         //   confirmation such as that of RFCOMM) is sent.
2415 
2416         //   If the remote device has indicated support for Secure Simple Pairing, a channel establishment request is
2417         //   received for a service other than SDP, and encryption has not yet been enabled, then the local device shall
2418         //   disconnect the ACL link with error code 0x05 - Authentication Failure.
2419 
2420         // => Disconnect if l2cap request received in mode 4 and ssp supported, non-sdp psm, not encrypted, no link key available
2421         if ((gap_get_security_mode() == GAP_SECURITY_MODE_4)
2422         && gap_ssp_supported_on_both_sides(channel->con_handle)
2423         && (channel->psm != PSM_SDP)
2424         && (gap_encryption_key_size(channel->con_handle) == 0)){
2425             hci_disconnect_security_block(channel->con_handle);
2426             return;
2427         }
2428 
2429         // incoming: assert security requirements
2430         channel->state = L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE;
2431         if (channel->required_security_level <= gap_security_level(channel->con_handle)){
2432             l2cap_handle_security_level_incoming_sufficient(channel);
2433         } else {
2434             // send connection pending if not already done
2435             if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONN_RESP_PEND) == 0){
2436                 channel->state_var |= L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND;
2437             }
2438             gap_request_security_level(channel->con_handle, channel->required_security_level);
2439         }
2440     } else {
2441         // outgoing: we have been waiting for remote supported features
2442         if (security_required){
2443             // request security level
2444             channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
2445             gap_request_security_level(channel->con_handle, channel->required_security_level);
2446         } else {
2447             l2cap_ready_to_connect(channel);
2448         }
2449     }
2450 }
2451 #endif
2452 
2453 #ifdef L2CAP_USES_CHANNELS
2454 static l2cap_channel_t * l2cap_create_channel_entry(btstack_packet_handler_t packet_handler, l2cap_channel_type_t channel_type, bd_addr_t address, bd_addr_type_t address_type,
2455     uint16_t psm, uint16_t local_mtu, gap_security_level_t security_level){
2456 
2457     l2cap_channel_t * channel = btstack_memory_l2cap_channel_get();
2458     if (!channel) {
2459         return NULL;
2460     }
2461 
2462     // fill in
2463     channel->packet_handler = packet_handler;
2464     channel->channel_type   = channel_type;
2465     bd_addr_copy(channel->address, address);
2466     channel->address_type = address_type;
2467     channel->psm = psm;
2468     channel->local_mtu  = local_mtu;
2469     channel->remote_mtu = L2CAP_DEFAULT_MTU;
2470     channel->required_security_level = security_level;
2471 
2472     //
2473     channel->local_cid = l2cap_next_local_cid();
2474     channel->con_handle = HCI_CON_HANDLE_INVALID;
2475 
2476     // set initial state
2477     channel->state = L2CAP_STATE_WILL_SEND_CREATE_CONNECTION;
2478     channel->state_var = L2CAP_CHANNEL_STATE_VAR_NONE;
2479     channel->remote_sig_id = L2CAP_SIG_ID_INVALID;
2480     channel->local_sig_id = L2CAP_SIG_ID_INVALID;
2481 
2482     log_info("create channel %p, local_cid 0x%04x", channel, channel->local_cid);
2483 
2484     return channel;
2485 }
2486 
2487 static void l2cap_free_channel_entry(l2cap_channel_t * channel){
2488     log_info("free channel %p, local_cid 0x%04x", channel, channel->local_cid);
2489     // assert all timers are stopped
2490     l2cap_stop_rtx(channel);
2491 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2492     l2cap_ertm_stop_retransmission_timer(channel);
2493     l2cap_ertm_stop_monitor_timer(channel);
2494 #endif
2495     // free  memory
2496     btstack_memory_l2cap_channel_free(channel);
2497 }
2498 #endif
2499 
2500 #ifdef ENABLE_CLASSIC
2501 
2502 /**
2503  * @brief Creates L2CAP channel to the PSM of a remote device with baseband address. A new baseband connection will be initiated if necessary.
2504  * @param packet_handler
2505  * @param address
2506  * @param psm
2507  * @param mtu
2508  * @param local_cid
2509  */
2510 
2511 uint8_t l2cap_create_channel(btstack_packet_handler_t channel_packet_handler, bd_addr_t address, uint16_t psm, uint16_t mtu, uint16_t * out_local_cid){
2512     // limit MTU to the size of our outgoing HCI buffer
2513     uint16_t local_mtu = btstack_min(mtu, l2cap_max_mtu());
2514 
2515 	// determine security level based on psm
2516 	const gap_security_level_t security_level = l2cap_security_level_0_allowed_for_PSM(psm) ? LEVEL_0 : gap_get_security_level();
2517 	log_info("create channel addr %s psm 0x%x mtu %u -> local mtu %u, sec level %u", bd_addr_to_str(address), psm, mtu, local_mtu, (int) security_level);
2518 
2519     l2cap_channel_t * channel = l2cap_create_channel_entry(channel_packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, address, BD_ADDR_TYPE_ACL, psm, local_mtu, security_level);
2520     if (!channel) {
2521         return BTSTACK_MEMORY_ALLOC_FAILED;
2522     }
2523 
2524 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2525     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
2526 #endif
2527 
2528     // add to connections list
2529     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
2530 
2531     // store local_cid
2532     if (out_local_cid){
2533        *out_local_cid = channel->local_cid;
2534     }
2535 
2536 	// state: L2CAP_STATE_WILL_SEND_CREATE_CONNECTION
2537 
2538     // check if hci connection is already usable,
2539     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_ACL);
2540     if (conn && conn->state == OPEN){
2541     	// simulate connection complete
2542 	    l2cap_handle_connection_complete(conn->con_handle, channel);
2543 
2544 	    // state: L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES or L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST
2545 
2546         // simulate if remote supported features if requested and already received
2547         if ((channel->state == L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES) && hci_remote_features_available(conn->con_handle)) {
2548         	// simulate remote features received
2549             l2cap_handle_remote_supported_features_received(channel);
2550         }
2551     }
2552 
2553     l2cap_run();
2554 
2555     return ERROR_CODE_SUCCESS;
2556 }
2557 
2558 static void l2cap_handle_connection_failed_for_addr(bd_addr_t address, uint8_t status){
2559     // mark all channels before emitting open events as these could trigger new connetion requests to the same device
2560     btstack_linked_list_iterator_t it;
2561     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2562     while (btstack_linked_list_iterator_has_next(&it)){
2563         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2564         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2565         if (bd_addr_cmp( channel->address, address) != 0) continue;
2566         // channel for this address found
2567         switch (channel->state){
2568             case L2CAP_STATE_WAIT_CONNECTION_COMPLETE:
2569             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
2570                 channel->state = L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD;
2571                 break;
2572             default:
2573                 break;
2574         }
2575     }
2576     // emit and free marked entries. restart loop to deal with list changes
2577     int done = 0;
2578     while (!done) {
2579         done = 1;
2580         btstack_linked_list_iterator_init(&it, &l2cap_channels);
2581         while (btstack_linked_list_iterator_has_next(&it)){
2582             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2583             if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2584             if (channel->state == L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD){
2585                 done = 0;
2586                 // failure, forward error code
2587                 l2cap_handle_channel_open_failed(channel, status);
2588                 // discard channel
2589                 btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2590                 l2cap_free_channel_entry(channel);
2591                 break;
2592             }
2593         }
2594     }
2595 
2596 }
2597 
2598 static void l2cap_handle_connection_success_for_addr(bd_addr_t address, hci_con_handle_t handle){
2599     btstack_linked_list_iterator_t it;
2600     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2601     while (btstack_linked_list_iterator_has_next(&it)){
2602         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2603         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2604         if ( ! bd_addr_cmp( channel->address, address) ){
2605             l2cap_handle_connection_complete(handle, channel);
2606         }
2607     }
2608 
2609 #ifdef ENABLE_L2CAP_INFORMATION_REQUESTS_ON_CONNECT
2610     // trigger query of extended features and fixed channels right away (instead of later)
2611     hci_connection_t * hci_connection = hci_connection_for_handle(handle);
2612     btstack_assert(hci_connection != NULL);
2613     hci_connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
2614 #endif
2615 
2616     // process
2617     l2cap_run();
2618 }
2619 #endif
2620 
2621 static bool l2cap_channel_ready_to_send(l2cap_channel_t * channel){
2622     switch (channel->channel_type){
2623 #ifdef ENABLE_CLASSIC
2624         case L2CAP_CHANNEL_TYPE_CLASSIC:
2625             if (channel->state != L2CAP_STATE_OPEN) return false;
2626 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2627             // send if we have more data and remote windows isn't full yet
2628             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) {
2629                 if (channel->unacked_frames >= btstack_min(channel->num_stored_tx_frames, channel->remote_tx_window_size)) return false;
2630                 return hci_can_send_acl_packet_now(channel->con_handle);
2631             }
2632 #endif
2633             if (!channel->waiting_for_can_send_now) return false;
2634             return hci_can_send_acl_packet_now(channel->con_handle);
2635         case L2CAP_CHANNEL_TYPE_FIXED_CLASSIC:
2636         case L2CAP_CHANNEL_TYPE_CONNECTIONLESS:
2637             if (!channel->waiting_for_can_send_now) return false;
2638             return hci_can_send_acl_classic_packet_now();
2639 #endif
2640 #ifdef ENABLE_BLE
2641         case L2CAP_CHANNEL_TYPE_FIXED_LE:
2642             if (!channel->waiting_for_can_send_now) return false;
2643             return hci_can_send_acl_le_packet_now();
2644 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2645         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
2646             if (channel->state != L2CAP_STATE_OPEN) return false;
2647             if (channel->send_sdu_buffer == NULL) return false;
2648             if (channel->credits_outgoing == 0u) return false;
2649             return hci_can_send_acl_packet_now(channel->con_handle);
2650 #endif
2651 #endif
2652 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2653         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
2654             if (channel->state != L2CAP_STATE_OPEN) return false;
2655             if (channel->send_sdu_buffer == NULL) return false;
2656             if (channel->credits_outgoing == 0u) return false;
2657             return hci_can_send_acl_packet_now(channel->con_handle);
2658 #endif
2659         default:
2660             return false;
2661     }
2662 }
2663 
2664 static void l2cap_channel_trigger_send(l2cap_channel_t * channel){
2665     switch (channel->channel_type){
2666 #ifdef ENABLE_CLASSIC
2667         case L2CAP_CHANNEL_TYPE_CLASSIC:
2668 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2669             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) {
2670                 l2cap_ertm_channel_send_information_frame(channel);
2671                 return;
2672             }
2673 #endif
2674             channel->waiting_for_can_send_now = 0;
2675             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2676             break;
2677         case L2CAP_CHANNEL_TYPE_CONNECTIONLESS:
2678         case L2CAP_CHANNEL_TYPE_FIXED_CLASSIC:
2679             channel->waiting_for_can_send_now = 0;
2680             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2681             break;
2682 #endif
2683 #ifdef ENABLE_BLE
2684         case L2CAP_CHANNEL_TYPE_FIXED_LE:
2685             channel->waiting_for_can_send_now = 0;
2686             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2687             break;
2688 #endif
2689 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2690         case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
2691             l2cap_credit_based_send_pdu(channel);
2692             break;
2693 #endif
2694 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2695         case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
2696             l2cap_credit_based_send_pdu(channel);
2697             break;
2698 #endif
2699         default:
2700             btstack_unreachable();
2701             break;
2702     }
2703 }
2704 
2705 static void l2cap_notify_channel_can_send(void){
2706     bool done = false;
2707     while (!done){
2708         done = true;
2709         btstack_linked_list_iterator_t it;
2710         btstack_linked_list_iterator_init(&it, &l2cap_channels);
2711         while (btstack_linked_list_iterator_has_next(&it)){
2712             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2713             bool ready = l2cap_channel_ready_to_send(channel);
2714             if (!ready) continue;
2715 
2716             // requeue channel for fairness
2717             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2718             btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
2719 
2720             // trigger sending
2721             l2cap_channel_trigger_send(channel);
2722 
2723             // exit inner loop as we just broke the iterator, but try again
2724             done = false;
2725             break;
2726         }
2727     }
2728 }
2729 
2730 #ifdef L2CAP_USES_CHANNELS
2731 
2732 uint8_t l2cap_disconnect(uint16_t local_cid){
2733     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
2734     if (!channel) {
2735         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
2736     }
2737     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
2738     l2cap_run();
2739     return ERROR_CODE_SUCCESS;
2740 }
2741 
2742 static int l2cap_send_open_failed_on_hci_disconnect(l2cap_channel_t * channel){
2743     // open cannot fail for for incoming connections
2744     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) return 0;
2745 
2746     // check state
2747     switch (channel->state){
2748         case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
2749         case L2CAP_STATE_WAIT_CONNECTION_COMPLETE:
2750         case L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES:
2751         case L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE:
2752         case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
2753         case L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES:
2754         case L2CAP_STATE_WAIT_CONNECT_RSP:
2755         case L2CAP_STATE_CONFIG:
2756         case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
2757         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST:
2758         case L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE:
2759         case L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD:
2760             return 1;
2761 
2762         case L2CAP_STATE_OPEN:
2763         case L2CAP_STATE_CLOSED:
2764         case L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES:
2765         case L2CAP_STATE_WAIT_DISCONNECT:
2766         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_INSUFFICIENT_SECURITY:
2767         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
2768         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
2769         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2770         case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
2771         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE:
2772         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT:
2773         case L2CAP_STATE_INVALID:
2774         case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
2775             return 0;
2776 
2777         default:
2778             // get a "warning" about new states
2779             btstack_assert(false);
2780             return 0;
2781     }
2782 }
2783 #endif
2784 
2785 #ifdef ENABLE_CLASSIC
2786 static void l2cap_handle_hci_disconnect_event(l2cap_channel_t * channel){
2787     if (l2cap_send_open_failed_on_hci_disconnect(channel)){
2788         l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2789     } else {
2790         l2cap_handle_channel_closed(channel);
2791     }
2792     l2cap_free_channel_entry(channel);
2793 }
2794 #endif
2795 
2796 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2797 static void l2cap_handle_hci_le_disconnect_event(l2cap_channel_t * channel){
2798     if (l2cap_send_open_failed_on_hci_disconnect(channel)){
2799         l2cap_cbm_emit_channel_opened(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2800     } else {
2801         l2cap_emit_channel_closed(channel);
2802     }
2803     l2cap_free_channel_entry(channel);
2804 }
2805 #endif
2806 
2807 #ifdef ENABLE_CLASSIC
2808 static void l2cap_check_classic_timeout(hci_con_handle_t handle){
2809     if (gap_get_connection_type(handle) != GAP_CONNECTION_ACL) {
2810         return;
2811     }
2812     if (hci_authentication_active_for_handle(handle)) {
2813         return;
2814     }
2815     bool hci_con_used = false;
2816     btstack_linked_list_iterator_t it;
2817     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2818     while (btstack_linked_list_iterator_has_next(&it)){
2819         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2820         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2821         if (channel->con_handle != handle) continue;
2822         hci_con_used = true;
2823         break;
2824     }
2825     if (hci_con_used) {
2826         return;
2827     }
2828     if (!hci_can_send_command_packet_now()) {
2829         return;
2830     }
2831     hci_send_cmd(&hci_disconnect, handle, 0x13); // remote closed connection
2832 }
2833 
2834 static void l2cap_handle_features_complete(hci_con_handle_t handle){
2835     if (hci_remote_features_available(handle) == false){
2836         return;
2837     }
2838     btstack_linked_list_iterator_t it;
2839     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2840     while (btstack_linked_list_iterator_has_next(&it)){
2841         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2842         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2843         if (channel->con_handle != handle) continue;
2844         log_info("remote supported features, channel %p, cid %04x - state %u", channel, channel->local_cid, channel->state);
2845         l2cap_handle_remote_supported_features_received(channel);
2846     }
2847 }
2848 
2849 static void l2cap_handle_security_level_incoming_sufficient(l2cap_channel_t * channel){
2850     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
2851     l2cap_emit_incoming_connection(channel);
2852 }
2853 
2854 static void l2cap_handle_security_level(hci_con_handle_t handle, gap_security_level_t actual_level){
2855     log_info("security level update for handle 0x%04x", handle);
2856 
2857     // trigger l2cap information requests
2858     if (actual_level > LEVEL_0){
2859         hci_connection_t * hci_connection = hci_connection_for_handle(handle);
2860         btstack_assert(hci_connection != NULL);
2861         if (hci_connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_IDLE){
2862             hci_connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
2863         }
2864     }
2865 
2866     btstack_linked_list_iterator_t it;
2867     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2868     while (btstack_linked_list_iterator_has_next(&it)){
2869         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2870         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2871         if (channel->con_handle != handle) continue;
2872 
2873         gap_security_level_t required_level = channel->required_security_level;
2874 
2875         log_info("channel %p, cid %04x - state %u: actual %u >= required %u?", channel, channel->local_cid, channel->state, actual_level, required_level);
2876 
2877         switch (channel->state){
2878             case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
2879                 if (actual_level >= required_level){
2880                     l2cap_handle_security_level_incoming_sufficient(channel);
2881                 } else {
2882                     channel->reason = L2CAP_CONNECTION_RESULT_SECURITY_BLOCK;
2883                     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
2884                 }
2885                 break;
2886 
2887             case L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE:
2888                 if (actual_level >= required_level){
2889                     l2cap_ready_to_connect(channel);
2890                 } else {
2891                     // security level insufficient, report error and free channel
2892                     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY);
2893                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t  *) channel);
2894                     l2cap_free_channel_entry(channel);
2895                 }
2896                 break;
2897 
2898             default:
2899                 break;
2900         }
2901     }
2902 }
2903 #endif
2904 
2905 #ifdef L2CAP_USES_CHANNELS
2906 static void l2cap_handle_disconnection_complete(hci_con_handle_t handle){
2907     // collect channels to close
2908     btstack_linked_list_t channels_to_close = NULL;
2909     btstack_linked_list_iterator_t it;
2910     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2911     while (btstack_linked_list_iterator_has_next(&it)) {
2912         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2913         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2914         if (channel->con_handle != handle) continue;
2915         btstack_linked_list_iterator_remove(&it);
2916         btstack_linked_list_add(&channels_to_close, (btstack_linked_item_t *) channel);
2917     }
2918     // send l2cap open failed or closed events for all channels on this handle and free them
2919     btstack_linked_list_iterator_init(&it, &channels_to_close);
2920     while (btstack_linked_list_iterator_has_next(&it)) {
2921         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2922         btstack_linked_list_iterator_remove(&it);
2923         switch(channel->channel_type){
2924 #ifdef ENABLE_CLASSIC
2925             case L2CAP_CHANNEL_TYPE_CLASSIC:
2926                 l2cap_handle_hci_disconnect_event(channel);
2927                 break;
2928 #endif
2929 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2930             case L2CAP_CHANNEL_TYPE_CHANNEL_CBM:
2931                 l2cap_handle_hci_le_disconnect_event(channel);
2932                 break;
2933 #endif
2934 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
2935             case L2CAP_CHANNEL_TYPE_CHANNEL_ECBM:
2936                 switch (channel->state) {
2937                     case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2938                     case L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE:
2939                         // emit open failed if disconnected before connection complete
2940                         l2cap_ecbm_emit_channel_opened(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2941                         break;
2942                     case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2943                     case L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE:
2944                         // emit reconfigure failure - result = 0xffff
2945                         l2cap_ecbm_emit_reconfigure_complete(channel, 0xffff);
2946                         break;
2947                     default:
2948                         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
2949                         break;
2950                 }
2951                 l2cap_free_channel_entry(channel);
2952                 break;
2953 #endif
2954             default:
2955                 break;
2956         }
2957     }
2958 }
2959 #endif
2960 
2961 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t cid, uint8_t *packet, uint16_t size){
2962 
2963     UNUSED(packet_type); // ok: registered with hci_event_callback_registration
2964     UNUSED(cid);         // ok: there is no channel
2965     UNUSED(size);        // ok: fixed format events read from HCI buffer
2966 
2967 #ifdef ENABLE_CLASSIC
2968     bd_addr_t address;
2969     gap_security_level_t security_level;
2970 #endif
2971 #ifdef L2CAP_USES_CHANNELS
2972     hci_con_handle_t handle;
2973 #endif
2974 
2975     switch(hci_event_packet_get_type(packet)){
2976 
2977         // Notify channel packet handler if they can send now
2978         case HCI_EVENT_TRANSPORT_PACKET_SENT:
2979         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:
2980         case BTSTACK_EVENT_NR_CONNECTIONS_CHANGED:
2981 #ifdef ENABLE_TESTING_SUPPORT
2982         case HCI_EVENT_NOP:
2983 #endif
2984             l2cap_call_notify_channel_in_run = true;
2985             break;
2986 
2987         case HCI_EVENT_COMMAND_STATUS:
2988 #ifdef ENABLE_CLASSIC
2989             // check command status for create connection for errors
2990             if (hci_event_command_status_get_command_opcode(packet) == HCI_OPCODE_HCI_CREATE_CONNECTION){
2991                 // cache outgoing address and reset
2992                 (void)memcpy(address, l2cap_outgoing_classic_addr, 6);
2993                 memset(l2cap_outgoing_classic_addr, 0, 6);
2994                 // error => outgoing connection failed
2995                 uint8_t status = hci_event_command_status_get_status(packet);
2996                 if (status){
2997                     l2cap_handle_connection_failed_for_addr(address, status);
2998                 }
2999             }
3000 #endif
3001             l2cap_run();    // try sending signaling packets first
3002             break;
3003 
3004 #ifdef ENABLE_CLASSIC
3005         // handle connection complete events
3006         case HCI_EVENT_CONNECTION_COMPLETE:
3007             reverse_bd_addr(&packet[5], address);
3008             if (packet[2] == 0){
3009                 handle = little_endian_read_16(packet, 3);
3010                 l2cap_handle_connection_success_for_addr(address, handle);
3011             } else {
3012                 l2cap_handle_connection_failed_for_addr(address, packet[2]);
3013             }
3014             break;
3015 
3016         // handle successful create connection cancel command
3017         case HCI_EVENT_COMMAND_COMPLETE:
3018             if (hci_event_command_complete_get_command_opcode(packet) == HCI_OPCODE_HCI_CREATE_CONNECTION_CANCEL) {
3019                 if (packet[5] == 0){
3020                     reverse_bd_addr(&packet[6], address);
3021                     // CONNECTION TERMINATED BY LOCAL HOST (0X16)
3022                     l2cap_handle_connection_failed_for_addr(address, 0x16);
3023                 }
3024             }
3025             l2cap_run();    // try sending signaling packets first
3026             break;
3027 #endif
3028 
3029 #ifdef L2CAP_USES_CHANNELS
3030         // handle disconnection complete events
3031         case HCI_EVENT_DISCONNECTION_COMPLETE:
3032             handle = little_endian_read_16(packet, 3);
3033             l2cap_handle_disconnection_complete(handle);
3034             break;
3035 #endif
3036 
3037         // HCI Connection Timeouts
3038 #ifdef ENABLE_CLASSIC
3039         case L2CAP_EVENT_TIMEOUT_CHECK:
3040             handle = little_endian_read_16(packet, 2);
3041             l2cap_check_classic_timeout(handle);
3042             break;
3043 
3044         case HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE:
3045         case HCI_EVENT_READ_REMOTE_EXTENDED_FEATURES_COMPLETE:
3046             handle = little_endian_read_16(packet, 3);
3047             l2cap_handle_features_complete(handle);
3048             break;
3049 
3050         case GAP_EVENT_SECURITY_LEVEL:
3051             handle = little_endian_read_16(packet, 2);
3052             security_level = (gap_security_level_t) packet[4];
3053             l2cap_handle_security_level(handle, security_level);
3054             break;
3055 #endif
3056         default:
3057             break;
3058     }
3059 
3060     l2cap_run();
3061 }
3062 
3063 static void l2cap_register_signaling_response(hci_con_handle_t handle, uint8_t code, uint8_t sig_id, uint16_t cid, uint16_t data){
3064     // Vol 3, Part A, 4.3: "The DCID and SCID fields shall be ignored when the result field indicates the connection was refused."
3065     if (l2cap_signaling_responses_pending < NR_PENDING_SIGNALING_RESPONSES) {
3066         l2cap_signaling_responses[l2cap_signaling_responses_pending].handle = handle;
3067         l2cap_signaling_responses[l2cap_signaling_responses_pending].code = code;
3068         l2cap_signaling_responses[l2cap_signaling_responses_pending].sig_id = sig_id;
3069         l2cap_signaling_responses[l2cap_signaling_responses_pending].cid = cid;
3070         l2cap_signaling_responses[l2cap_signaling_responses_pending].data = data;
3071         l2cap_signaling_responses_pending++;
3072         l2cap_run();
3073     }
3074 }
3075 
3076 #ifdef ENABLE_CLASSIC
3077 static void l2cap_handle_disconnect_request(l2cap_channel_t *channel, uint8_t identifier){
3078     switch (channel->state){
3079         case L2CAP_STATE_CONFIG:
3080         case L2CAP_STATE_OPEN:
3081         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
3082         case L2CAP_STATE_WAIT_DISCONNECT:
3083             break;
3084         default:
3085             // ignore in other states
3086             return;
3087     }
3088 
3089     channel->remote_sig_id = identifier;
3090     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
3091     l2cap_run();
3092 }
3093 
3094 static void l2cap_handle_connection_request(hci_con_handle_t handle, uint8_t sig_id, uint16_t psm, uint16_t source_cid){
3095 
3096     // log_info("l2cap_handle_connection_request for handle %u, psm %u cid 0x%02x", handle, psm, source_cid);
3097     l2cap_service_t *service = l2cap_get_service(psm);
3098     if (!service) {
3099         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CONNECTION_RESULT_PSM_NOT_SUPPORTED);
3100         return;
3101     }
3102 
3103     hci_connection_t * hci_connection = hci_connection_for_handle( handle );
3104     if (!hci_connection) {
3105         //
3106         log_error("no hci_connection for handle %u", handle);
3107         return;
3108     }
3109 
3110     // if SC only mode is active and service requires encryption, reject connection if SC not active or use security level
3111     gap_security_level_t required_level = service->required_security_level;
3112     if (gap_get_secure_connections_only_mode() && (required_level != LEVEL_0)){
3113         if (gap_secure_connection(handle)){
3114             required_level = LEVEL_4;
3115         } else {
3116             l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CONNECTION_RESULT_SECURITY_BLOCK);
3117             return;
3118         }
3119     }
3120 
3121     // alloc structure
3122     l2cap_channel_t * channel = l2cap_create_channel_entry(service->packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, hci_connection->address, BD_ADDR_TYPE_ACL,
3123     psm, service->mtu, required_level);
3124     if (!channel){
3125         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE);
3126         return;
3127     }
3128 
3129     channel->con_handle = handle;
3130     channel->remote_cid = source_cid;
3131     channel->remote_sig_id = sig_id;
3132 
3133     // limit local mtu to max acl packet length - l2cap header
3134     if (channel->local_mtu > l2cap_max_mtu()) {
3135         channel->local_mtu = l2cap_max_mtu();
3136     }
3137 
3138     // set initial state
3139     channel->state =     L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES;
3140     channel->state_var = L2CAP_CHANNEL_STATE_VAR_INCOMING;
3141 
3142     // add to connections list
3143     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
3144 
3145     //
3146     if (required_level > LEVEL_0){
3147         // send conn resp pending if remote supported features have not been received yet
3148         if (hci_remote_features_available(handle)) {
3149             l2cap_handle_remote_supported_features_received(channel);
3150         } else {
3151             channel->state_var |= L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND;
3152             hci_remote_features_query(handle);
3153         }
3154     } else {
3155         l2cap_handle_security_level_incoming_sufficient(channel);
3156     }
3157 }
3158 
3159 void l2cap_accept_connection(uint16_t local_cid){
3160     log_info("L2CAP_ACCEPT_CONNECTION local_cid 0x%x", local_cid);
3161     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
3162     if (!channel) {
3163         log_error("accept called but local_cid 0x%x not found", local_cid);
3164         return;
3165     }
3166 
3167 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3168     // configure L2CAP Basic mode
3169     channel->mode  = L2CAP_CHANNEL_MODE_BASIC;
3170 #endif
3171 
3172     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
3173 
3174     // process
3175     l2cap_run();
3176 }
3177 
3178 void l2cap_decline_connection(uint16_t local_cid){
3179     log_info("decline local_cid 0x%x", local_cid);
3180     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
3181     if (!channel) {
3182         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
3183         return;
3184     }
3185     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
3186     channel->reason = L2CAP_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE;
3187     l2cap_run();
3188 }
3189 
3190 // @pre command len is valid, see check in l2cap_signaling_handler_channel
3191 static void l2cap_signaling_handle_configure_request(l2cap_channel_t *channel, uint8_t *command){
3192 
3193 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3194     uint8_t use_fcs = 1;
3195 #endif
3196 
3197     channel->remote_sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3198 
3199     uint16_t flags = little_endian_read_16(command, 6);
3200     if (flags & 1) {
3201         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
3202     }
3203 
3204     // accept the other's configuration options
3205     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3206     uint16_t pos     = 8;
3207     while (pos < end_pos){
3208         uint8_t option_hint = command[pos] >> 7;
3209         uint8_t option_type = command[pos] & 0x7f;
3210         // log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
3211         pos++;
3212         uint8_t length = command[pos++];
3213         // MTU { type(8): 1, len(8):2, MTU(16) }
3214         if ((option_type == L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT) && (length == 2)){
3215             channel->remote_mtu = little_endian_read_16(command, pos);
3216             log_info("Remote MTU %u", channel->remote_mtu);
3217             if (channel->remote_mtu > l2cap_max_mtu()){
3218                 log_info("Remote MTU %u larger than outgoing buffer, only using MTU = %u", channel->remote_mtu, l2cap_max_mtu());
3219                 channel->remote_mtu = l2cap_max_mtu();
3220             }
3221             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
3222         }
3223         // Flush timeout { type(8):2, len(8): 2, Flush Timeout(16)}
3224         if ((option_type == L2CAP_CONFIG_OPTION_TYPE_FLUSH_TIMEOUT) && (length == 2)){
3225             channel->flush_timeout = little_endian_read_16(command, pos);
3226             log_info("Flush timeout: %u ms", channel->flush_timeout);
3227         }
3228 
3229 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3230         // Retransmission and Flow Control Option
3231         if (option_type == L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL && length == 9){
3232             l2cap_channel_mode_t mode = (l2cap_channel_mode_t) command[pos];
3233             switch(channel->mode){
3234                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3235                     // Store remote config
3236                     channel->remote_tx_window_size = command[pos+1];
3237                     channel->remote_max_transmit   = command[pos+2];
3238                     channel->remote_retransmission_timeout_ms = little_endian_read_16(command, pos + 3);
3239                     channel->remote_monitor_timeout_ms = little_endian_read_16(command, pos + 5);
3240                     {
3241                         uint16_t remote_mps = little_endian_read_16(command, pos + 7);
3242                         // optimize our tx buffer configuration based on actual remote mps if remote mps is smaller than planned
3243                         if (remote_mps < channel->remote_mps){
3244                             // get current tx storage
3245                             uint16_t num_bytes_per_tx_buffer_before = sizeof(l2cap_ertm_tx_packet_state_t) + channel->remote_mps;
3246                             uint16_t tx_storage = channel->num_tx_buffers * num_bytes_per_tx_buffer_before;
3247 
3248                             channel->remote_mps = remote_mps;
3249                             uint16_t num_bytes_per_tx_buffer_now = sizeof(l2cap_ertm_tx_packet_state_t) + channel->remote_mps;
3250                             channel->num_tx_buffers = tx_storage / num_bytes_per_tx_buffer_now;
3251                             uint32_t total_storage = (sizeof(l2cap_ertm_rx_packet_state_t) + channel->local_mps) * channel->num_rx_buffers + tx_storage + channel->local_mtu;
3252                             l2cap_ertm_setup_buffers(channel, (uint8_t *) channel->rx_packets_state, total_storage);
3253                         }
3254                         // limit remote mtu by our tx buffers. Include 2 bytes SDU Length
3255                         uint16_t effective_mtu = channel->remote_mps * channel->num_tx_buffers - 2;
3256                         channel->remote_mtu    = btstack_min( effective_mtu, channel->remote_mtu);
3257                     }
3258                     log_info("FC&C config: tx window: %u, max transmit %u, retrans timeout %u, monitor timeout %u, mps %u",
3259                         channel->remote_tx_window_size,
3260                         channel->remote_max_transmit,
3261                         channel->remote_retransmission_timeout_ms,
3262                         channel->remote_monitor_timeout_ms,
3263                         channel->remote_mps);
3264                     // If ERTM mandatory, but remote doens't offer ERTM -> disconnect
3265                     if (channel->ertm_mandatory && mode != L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
3266                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3267                     } else {
3268                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
3269                     }
3270                     break;
3271                 case L2CAP_CHANNEL_MODE_BASIC:
3272                     switch (mode){
3273                         case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3274                             // remote asks for ERTM, but we want basic mode. disconnect if this happens a second time
3275                             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED){
3276                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3277                             }
3278                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED);
3279                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
3280                             break;
3281                         default: // case L2CAP_CHANNEL_MODE_BASIC:
3282                             // TODO store and evaluate configuration
3283                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
3284                             break;
3285                     }
3286                     break;
3287                 default:
3288                     break;
3289             }
3290         }
3291         if (option_type == L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE && length == 1){
3292             use_fcs = command[pos];
3293         }
3294 #endif
3295         // check for unknown options
3296         if ((option_hint == 0) && ((option_type < L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT) || (option_type > L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE))){
3297             log_info("l2cap cid %u, unknown option 0x%02x", channel->local_cid, option_type);
3298             channel->unknown_option = option_type;
3299             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
3300         }
3301         pos += length;
3302     }
3303 
3304 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3305         // "FCS" has precedence over "No FCS"
3306         uint8_t update = channel->fcs_option || use_fcs;
3307         log_info("local fcs: %u, remote fcs: %u -> %u", channel->fcs_option, use_fcs, update);
3308         channel->fcs_option = update;
3309         // If ERTM mandatory, but remote didn't send Retransmission and Flowcontrol options -> disconnect
3310         if (((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM) == 0) & (channel->ertm_mandatory)){
3311             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3312         }
3313 #endif
3314 }
3315 
3316 // @pre command len is valid, see check in l2cap_signaling_handler_channel
3317 static void l2cap_signaling_handle_configure_response(l2cap_channel_t *channel, uint16_t result, uint8_t *command){
3318     log_info("l2cap_signaling_handle_configure_response");
3319 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3320     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3321     uint16_t pos     = 10;
3322     while (pos < end_pos){
3323         uint8_t option_hint = command[pos] >> 7;
3324         uint8_t option_type = command[pos] & 0x7f;
3325         // log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
3326         pos++;
3327         uint8_t length = command[pos++];
3328 
3329         // Retransmission and Flow Control Option
3330         if (option_type == L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL && length == 9){
3331             switch (channel->mode){
3332                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3333                     if (channel->ertm_mandatory){
3334                         // ??
3335                     } else {
3336                         // On 'Reject - Unacceptable Parameters' to our optional ERTM request, fall back to BASIC mode
3337                         if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
3338                             l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3339                             channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3340                         }
3341                     }
3342                     break;
3343                 case L2CAP_CHANNEL_MODE_BASIC:
3344                     if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
3345                         // On 'Reject - Unacceptable Parameters' to our Basic mode request, disconnect
3346                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3347                     }
3348                     break;
3349                 default:
3350                     break;
3351             }
3352         }
3353 
3354         // check for unknown options
3355         if (option_hint == 0 && (option_type < L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT || option_type > L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE)){
3356             log_info("l2cap cid %u, unknown option 0x%02x", channel->local_cid, option_type);
3357             channel->unknown_option = option_type;
3358             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
3359         }
3360 
3361         pos += length;
3362     }
3363 #else
3364     UNUSED(channel);  // ok: no code
3365     UNUSED(result);   // ok: no code
3366     UNUSED(command);  // ok: no code
3367 #endif
3368 }
3369 
3370 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel){
3371     // log_info("l2cap_channel_ready_for_open 0x%02x", channel->state_var);
3372     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP) == 0) return 0;
3373     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP) == 0) return 0;
3374     // addition check that fixes re-entrance issue causing l2cap event channel opened twice
3375     if (channel->state == L2CAP_STATE_OPEN) return 0;
3376     return 1;
3377 }
3378 
3379 
3380 // @pre command len is valid, see check in l2cap_signaling_handler_dispatch
3381 static void l2cap_signaling_handler_channel(l2cap_channel_t *channel, uint8_t *command){
3382 
3383     uint8_t  code       = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3384     uint8_t  identifier = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3385     uint16_t cmd_len    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3386     uint16_t result = 0;
3387 
3388     log_info("L2CAP signaling handler code %u, state %u", code, channel->state);
3389 
3390     // handle DISCONNECT REQUESTS seperately
3391     if (code == DISCONNECTION_REQUEST){
3392         l2cap_handle_disconnect_request(channel, identifier);
3393         return;
3394     }
3395 
3396     // @STATEMACHINE(l2cap)
3397     switch (channel->state) {
3398 
3399         case L2CAP_STATE_WAIT_CONNECT_RSP:
3400             switch (code){
3401                 case CONNECTION_RESPONSE:
3402                     if (cmd_len < 8){
3403                         // command imcomplete
3404                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3405                         break;
3406                     }
3407                     l2cap_stop_rtx(channel);
3408                     result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3409                     switch (result) {
3410                         case 0:
3411                             // successful connection
3412                             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3413                             channel->state = L2CAP_STATE_CONFIG;
3414                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
3415                             break;
3416                         case 1:
3417                             // connection pending. get some coffee, but start the ERTX
3418                             l2cap_start_ertx(channel);
3419                             break;
3420                         default:
3421                             // channel closed
3422                             channel->state = L2CAP_STATE_CLOSED;
3423                             // map l2cap connection response result to BTstack status enumeration
3424                             l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result);
3425 
3426                             // drop link key if security block
3427                             if ((L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result) == L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY){
3428                                 gap_drop_link_key_for_bd_addr(channel->address);
3429                             }
3430 
3431                             // discard channel
3432                             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
3433                             l2cap_free_channel_entry(channel);
3434                             break;
3435                     }
3436                     break;
3437 
3438                 default:
3439                     //@TODO: implement other signaling packets
3440                     break;
3441             }
3442             break;
3443 
3444         case L2CAP_STATE_CONFIG:
3445             switch (code) {
3446                 case CONFIGURE_REQUEST:
3447                     if (cmd_len < 4){
3448                         // command incomplete
3449                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3450                         break;
3451                     }
3452                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
3453                     l2cap_signaling_handle_configure_request(channel, command);
3454                     if (!(channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT)){
3455                         // only done if continuation not set
3456                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_REQ);
3457                     }
3458                     break;
3459                 case CONFIGURE_RESPONSE:
3460                     if (cmd_len < 6){
3461                         // command incomplete
3462                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3463                         break;
3464                     }
3465                     result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3466                     l2cap_stop_rtx(channel);
3467                     l2cap_signaling_handle_configure_response(channel, result, command);
3468                     switch (result){
3469                         case 0: // success
3470                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP);
3471                             break;
3472                         case 4: // pending
3473                             l2cap_start_ertx(channel);
3474                             break;
3475                         default:
3476 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3477                             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION && channel->ertm_mandatory){
3478                                 // remote does not offer ertm but it's required
3479                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3480                                 break;
3481                             }
3482 #endif
3483                             // retry on negative result
3484                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
3485                             break;
3486                     }
3487                     break;
3488                 default:
3489                     break;
3490             }
3491             if (l2cap_channel_ready_for_open(channel)){
3492 
3493 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3494                 // assert that packet can be stored in fragment buffers in ertm
3495                 if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
3496                     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
3497                     uint16_t usable_mtu = channel->num_tx_buffers == 1 ? effective_mps : channel->num_tx_buffers * effective_mps - 2;
3498                     if (usable_mtu < channel->remote_mtu){
3499                         log_info("Remote MTU %u > max storable ERTM packet, only using MTU = %u", channel->remote_mtu, usable_mtu);
3500                         channel->remote_mtu = usable_mtu;
3501                     }
3502                 }
3503 #endif
3504                 // for open:
3505                 channel->state = L2CAP_STATE_OPEN;
3506                 l2cap_emit_channel_opened(channel, 0);
3507             }
3508             break;
3509 
3510         case L2CAP_STATE_WAIT_DISCONNECT:
3511             switch (code) {
3512                 case DISCONNECTION_RESPONSE:
3513                     l2cap_finalize_channel_close(channel);
3514                     break;
3515                 default:
3516                     //@TODO: implement other signaling packets
3517                     break;
3518             }
3519             break;
3520 
3521         case L2CAP_STATE_CLOSED:
3522             // @TODO handle incoming requests
3523             break;
3524 
3525         case L2CAP_STATE_OPEN:
3526             //@TODO: implement other signaling packets, e.g. re-configure
3527             break;
3528         default:
3529             break;
3530     }
3531     // log_info("new state %u", channel->state);
3532 }
3533 
3534 #ifdef ENABLE_CLASSIC
3535 static void l2cap_handle_information_request_complete(hci_connection_t * connection){
3536 
3537     connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_DONE;
3538 
3539     // emit event
3540     uint8_t event[8];
3541     event[0] = L2CAP_EVENT_INFORMATION_RESPONSE;
3542     event[1] = sizeof(event) - 2;
3543     little_endian_store_16(event, 2, connection->con_handle);
3544     little_endian_store_16(event, 4, connection->l2cap_state.extended_feature_mask);
3545     little_endian_store_16(event, 6, connection->l2cap_state.fixed_channels_supported);
3546     l2cap_emit_event(event, sizeof(event));
3547 
3548     // trigger connection request
3549     btstack_linked_list_iterator_t it;
3550     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3551     while (btstack_linked_list_iterator_has_next(&it)){
3552         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3553         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3554         if (channel->con_handle != connection->con_handle) continue;
3555 
3556         // incoming connection: information request was triggered after user has accepted connection,
3557         // now: verify channel configuration, esp. if ertm will be mandatory
3558         if (channel->state == L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES){
3559             // default: continue
3560             channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
3561 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3562             if ((channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) && ((connection->l2cap_state.extended_feature_mask & 0x08) == 0)){
3563                 // ERTM not possible, select basic mode and release buffer
3564                 channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3565                 l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3566 
3567                 // bail if ERTM is mandatory
3568                 if (channel->ertm_mandatory){
3569                     // We chose 'no resources available' for "ERTM mandatory but you don't even know ERTM exists"
3570                     log_info("ERTM mandatory -> reject connection");
3571                     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
3572                     channel->reason = L2CAP_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE;
3573                 }  else {
3574                     log_info("ERTM not supported by remote -> use Basic mode");
3575                 }
3576             }
3577 #endif
3578             continue;
3579         }
3580 
3581         // outgoing connection: information request is triggered before connection request
3582         if (channel->state == L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES){
3583 
3584 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3585             // if ERTM was requested, but is not listed in extended feature mask:
3586             if ((channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) && ((connection->l2cap_state.extended_feature_mask & 0x08) == 0)){
3587 
3588                 if (channel->ertm_mandatory){
3589                     // bail if ERTM is mandatory
3590                     channel->state = L2CAP_STATE_CLOSED;
3591                     // map l2cap connection response result to BTstack status enumeration
3592                     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_ERTM_NOT_SUPPORTED);
3593                     // discard channel
3594                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
3595                     l2cap_free_channel_entry(channel);
3596                     continue;
3597 
3598                 } else {
3599                     // fallback to Basic mode
3600                     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3601                     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3602                 }
3603             }
3604 #endif
3605 
3606             // respond to connection request
3607             channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
3608             continue;
3609         }
3610     }
3611 }
3612 #endif
3613 
3614 // @pre command len is valid, see check in l2cap_acl_classic_handler
3615 static void l2cap_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t * command){
3616 
3617     hci_connection_t * connection;
3618     btstack_linked_list_iterator_t it;
3619 
3620     // get code, signal identifier and command len
3621     uint8_t code     = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3622     uint8_t sig_id   = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3623     uint16_t cmd_len = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3624 
3625     // general commands without an assigned channel
3626     switch(code) {
3627 
3628         case CONNECTION_REQUEST:
3629             if (cmd_len == 4){
3630                 uint16_t psm =        little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3631                 uint16_t source_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3632                 l2cap_handle_connection_request(handle, sig_id, psm, source_cid);
3633             } else {
3634                 l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
3635             }
3636             return;
3637 
3638         case ECHO_REQUEST:
3639             l2cap_register_signaling_response(handle, code, sig_id, 0, 0);
3640             return;
3641 
3642         case INFORMATION_REQUEST:
3643             if (cmd_len == 2) {
3644                 uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3645                 l2cap_register_signaling_response(handle, code, sig_id, 0, info_type);
3646                 return;
3647             }
3648             break;
3649 
3650         case INFORMATION_RESPONSE:
3651             connection = hci_connection_for_handle(handle);
3652             if (!connection) return;
3653             switch (connection->l2cap_state.information_state){
3654                 case L2CAP_INFORMATION_STATE_W4_EXTENDED_FEATURE_RESPONSE:
3655                     // get extended features from response if valid
3656                     if (cmd_len >= 6) {
3657                         uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3658                         uint16_t result    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3659                         if (result == 0 && info_type == L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED) {
3660                             connection->l2cap_state.extended_feature_mask = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3661                         }
3662                         log_info("extended features mask 0x%02x", connection->l2cap_state.extended_feature_mask);
3663                         if ((connection->l2cap_state.extended_feature_mask & 0x80) != 0){
3664                             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_FIXED_CHANNELS_REQUEST;
3665                         } else {
3666                             // information request complete
3667                             l2cap_handle_information_request_complete(connection);
3668                         }
3669                     }
3670                     break;
3671                 case L2CAP_INFORMATION_STATE_W4_FIXED_CHANNELS_RESPONSE:
3672                     if (cmd_len >= 12) {
3673                         uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3674                         uint16_t result    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3675                         if (result == 0 && info_type == L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED) {
3676                             connection->l2cap_state.fixed_channels_supported = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
3677                         }
3678                         log_info("fixed channels mask 0x%02x", connection->l2cap_state.fixed_channels_supported);
3679                         // information request complete
3680                         l2cap_handle_information_request_complete(connection);
3681                     }
3682                     break;
3683                 default:
3684                     break;
3685             }
3686             return;
3687 
3688 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
3689         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
3690         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
3691         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
3692         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
3693             l2cap_ecbm_signaling_handler_dispatch(handle, L2CAP_CID_SIGNALING, command, sig_id);
3694             return;
3695         case L2CAP_FLOW_CONTROL_CREDIT_INDICATION:
3696             // return if valid
3697             if (l2cap_credit_based_handle_credit_indication(handle, command, cmd_len)) return;
3698             break;
3699 
3700         case COMMAND_REJECT:
3701             btstack_linked_list_iterator_init(&it, &l2cap_channels);
3702             while (btstack_linked_list_iterator_has_next(&it)) {
3703                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3704                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3705                 if (channel->con_handle != handle) continue;
3706                 if (channel->local_sig_id != sig_id) continue;
3707                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE) continue;
3708 
3709                 // open failed
3710                 channel->state = L2CAP_STATE_CLOSED;
3711                 l2cap_ecbm_emit_channel_opened(channel,
3712                                                ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
3713                 // drop failed channel
3714                 btstack_linked_list_iterator_remove(&it);
3715                 l2cap_free_channel_entry(channel);
3716             }
3717             break;
3718 #endif
3719 
3720         default:
3721             break;
3722     }
3723 
3724     // Get potential destination CID
3725     uint16_t dest_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3726 
3727     // Find channel for this sig_id and connection handle
3728     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3729     while (btstack_linked_list_iterator_has_next(&it)){
3730         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3731         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3732         if (channel->con_handle != handle) continue;
3733         if (code & 1) {
3734             // match odd commands (responses) by previous signaling identifier
3735             if (channel->local_sig_id == sig_id) {
3736                 l2cap_signaling_handler_channel(channel, command);
3737                 return;
3738             }
3739         } else {
3740             // match even commands (requests) by local channel id
3741             if (channel->local_cid == dest_cid) {
3742                 l2cap_signaling_handler_channel(channel, command);
3743                 return;
3744             }
3745         }
3746     }
3747 
3748     // send command reject
3749     l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
3750 }
3751 #endif
3752 
3753 #ifdef L2CAP_USES_CHANNELS
3754 static l2cap_service_t * l2cap_get_service_internal(btstack_linked_list_t * services, uint16_t psm){
3755     btstack_linked_list_iterator_t it;
3756     btstack_linked_list_iterator_init(&it, services);
3757     while (btstack_linked_list_iterator_has_next(&it)){
3758         l2cap_service_t * service = (l2cap_service_t *) btstack_linked_list_iterator_next(&it);
3759         if ( service->psm == psm){
3760             return service;
3761         };
3762     }
3763     return NULL;
3764 }
3765 #endif
3766 
3767 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
3768 
3769 static uint8_t l2cap_ecbm_setup_channels(btstack_linked_list_t * channels,
3770                                          btstack_packet_handler_t packet_handler, uint8_t num_channels,
3771                                          hci_connection_t * connection, uint16_t psm, uint16_t mtu, gap_security_level_t security_level){
3772     uint8_t i;
3773     uint8_t status = ERROR_CODE_SUCCESS;
3774     for (i=0;i<num_channels;i++){
3775         l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_CHANNEL_ECBM, connection->address, connection->address_type, psm, mtu, security_level);
3776         if (!channel) {
3777             status = BTSTACK_MEMORY_ALLOC_FAILED;
3778             break;
3779         }
3780         channel->con_handle = connection->con_handle;
3781         btstack_linked_list_add_tail(channels, (btstack_linked_item_t *) channel);
3782     }
3783 
3784     // free channels if not all allocated
3785     if (status != ERROR_CODE_SUCCESS){
3786         while (true) {
3787             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_pop(channels);
3788             if (channel == NULL) break;
3789             l2cap_free_channel_entry(channel);
3790         }
3791     }
3792 
3793     return status;
3794 }
3795 
3796 static inline l2cap_service_t * l2cap_ecbm_get_service(uint16_t spsm){
3797     return l2cap_get_service_internal(&l2cap_enhanced_services, spsm);
3798 }
3799 
3800 static inline uint8_t l2cap_ecbm_status_for_result(uint16_t result) {
3801     switch (result) {
3802         case L2CAP_ECBM_CONNECTION_RESULT_ALL_SUCCESS:
3803             return ERROR_CODE_SUCCESS;
3804         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_SPSM_NOT_SUPPORTED:
3805             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_PSM;
3806         case L2CAP_ECBM_CONNECTION_RESULT_SOME_REFUSED_INSUFFICIENT_RESOURCES_AVAILABLE:
3807             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_RESOURCES;
3808         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_AUTHENTICATION:
3809         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_AUTHORIZATION:
3810         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_ENCYRPTION_KEY_SIZE_TOO_SHORT:
3811         case L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_ENCRYPTION:
3812             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY;
3813         default:
3814             // invalid Source CID, Source CID already allocated, unacceptable parameters
3815             return L2CAP_CONNECTION_RESPONSE_UNKNOWN_ERROR;
3816     }
3817 }
3818 
3819 static void
3820 l2cap_ecbm_emit_incoming_connection(l2cap_channel_t *channel, uint8_t num_channels) {
3821     uint8_t event[16];
3822     event[0] = L2CAP_EVENT_ECBM_INCOMING_CONNECTION;
3823     event[1] = sizeof(event) - 2;
3824     event[2] = channel->address_type;
3825     reverse_bd_addr(channel->address, &event[3]);
3826     little_endian_store_16(event, 9, channel->con_handle);
3827     little_endian_store_16(event, 11, channel->psm);
3828     event[13] = num_channels;
3829     little_endian_store_16(event, 14, channel->local_cid);
3830     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
3831     (*channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
3832 }
3833 
3834 static int l2cap_ecbm_signaling_handler_dispatch(hci_con_handle_t handle, uint16_t signaling_cid, uint8_t *command,
3835                                                  uint8_t sig_id) {
3836 
3837     hci_connection_t *connection;
3838     btstack_linked_list_iterator_t it;
3839     l2cap_service_t *service;
3840     uint16_t spsm;
3841     uint8_t num_channels;
3842     uint16_t num_channels_and_signaling_cid;
3843     uint8_t i;
3844     uint16_t new_mtu;
3845     uint16_t new_mps;
3846     uint16_t initial_credits;
3847     uint16_t result;
3848     uint8_t status;
3849 
3850     uint8_t code = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3851     uint16_t len = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3852     log_info("enhanced dispatch: command 0x%02x, sig id %u, len %u", code, sig_id, len);
3853 
3854     switch (code) {
3855         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
3856             // check size
3857             if (len < 10u) return 0u;
3858 
3859             // get hci connection, bail if not found (must not happen)
3860             connection = hci_connection_for_handle(handle);
3861             btstack_assert(connection != NULL);
3862 
3863             // get num channels to establish
3864             num_channels = (len - 8) / sizeof(uint16_t);
3865 
3866             // combine signaling cid and number channels for l2cap_register_signaling_response
3867             num_channels_and_signaling_cid = (num_channels << 8) | signaling_cid;
3868 
3869             // check if service registered
3870             spsm = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3871             service = l2cap_ecbm_get_service(spsm);
3872 
3873             if (service) {
3874 
3875                 uint16_t remote_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
3876                 uint16_t remote_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
3877                 uint16_t credits_outgoing = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
3878 
3879                 // param: check remote mtu
3880                 if (service->mtu > remote_mtu) {
3881                     l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3882                                                       num_channels_and_signaling_cid, L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INVALID_PARAMETERS);
3883                     return 1;
3884                 }
3885 
3886                 // check security in increasing error priority
3887                 uint8_t security_status = L2CAP_ECBM_CONNECTION_RESULT_ALL_SUCCESS;
3888 
3889                 // security: check encryption
3890                 if (service->required_security_level >= LEVEL_2) {
3891                     if (gap_encryption_key_size(handle) < 16) {
3892                         security_status = L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_ENCYRPTION_KEY_SIZE_TOO_SHORT;
3893                     }
3894                     if (gap_encryption_key_size(handle) == 0){
3895                         security_status = L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_ENCRYPTION;
3896                     }
3897                 }
3898 
3899                 // security: check authentication
3900                 if (service->required_security_level >= LEVEL_3) {
3901                     if (!gap_authenticated(handle)) {
3902                         security_status = L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_INSUFFICIENT_AUTHENTICATION;
3903                         return 1;
3904                     }
3905                 }
3906 
3907                 if (security_status != L2CAP_ECBM_CONNECTION_RESULT_ALL_SUCCESS){
3908                     l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3909                                                       num_channels_and_signaling_cid, security_status);
3910                     return 1;
3911                 }
3912 
3913                 // report the last result code != 0
3914                 result = 0;
3915                 // store one of the local channels for the event
3916                 l2cap_channel_t * a_channel = NULL;
3917                 for (i = 0; i < num_channels; i++) {
3918 
3919                     // check source cids
3920                     uint16_t source_cid = little_endian_read_16(command, 12 + (i * 2));
3921                     if (source_cid < 0x40u) {
3922                         result = L2CAP_ECBM_CONNECTION_RESULT_SOME_REFUSED_INVALID_SOURCE_CID;
3923                         continue;
3924                     }
3925 
3926                     // go through list of channels for this ACL connection and check if we get a match
3927                     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3928                     bool source_cid_allocated = false;
3929                     while (btstack_linked_list_iterator_has_next(&it)) {
3930                         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3931                         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3932                         if (channel->con_handle != handle) continue;
3933                         if (channel->remote_cid != source_cid) continue;
3934                         source_cid_allocated = true;
3935                         break;
3936                     }
3937                     if (source_cid_allocated) {
3938                         result = 0x00a;
3939                         continue;
3940                     }
3941 
3942                     // setup channel
3943                     l2cap_channel_t *channel = l2cap_create_channel_entry(service->packet_handler,
3944                                                                           L2CAP_CHANNEL_TYPE_CHANNEL_ECBM,
3945                                                                           connection->address,
3946                                                                           connection->address_type, spsm,
3947                                                                           service->mtu,
3948                                                                           service->required_security_level);
3949 
3950                     if (channel == NULL) {
3951                         // Some connections refused – insufficient resources available
3952                         result = 0x004;
3953                         continue;
3954                     }
3955 
3956                     // setup state
3957                     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
3958                     channel->state_var |= L2CAP_CHANNEL_STATE_VAR_INCOMING;
3959                     channel->con_handle = connection->con_handle;
3960                     channel->remote_sig_id = sig_id;
3961                     channel->remote_cid = source_cid;
3962                     channel->remote_mtu = remote_mtu;
3963                     channel->remote_mps = remote_mps;
3964                     channel->credits_outgoing = credits_outgoing;
3965                     channel->cid_index = i;
3966                     channel->num_cids = num_channels;
3967 
3968                     // if more than one error, we can report any of them
3969                     channel->reason = result;
3970 
3971                     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
3972 
3973                     a_channel = channel;
3974                 }
3975 
3976                 // if no channels have been created, all have been refused, and we can respond right away
3977                 if (a_channel == NULL) {
3978                     l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3979                                                       num_channels_and_signaling_cid, result);
3980                     return 1;
3981                 }
3982 
3983                 l2cap_ecbm_emit_incoming_connection(a_channel, num_channels);
3984 
3985 
3986             } else {
3987                 l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3988                                                   num_channels_and_signaling_cid, L2CAP_ECBM_CONNECTION_RESULT_ALL_REFUSED_SPSM_NOT_SUPPORTED);
3989             }
3990             return 1;
3991 
3992         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
3993             // check size
3994             if (len < 10u) return 0u;
3995 
3996             // get hci connection, ignore if not found
3997             connection = hci_connection_for_handle(handle);
3998             if (connection == NULL) return 0;
3999 
4000             // get channel config: mtu, mps, initial credits, result
4001             new_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4002             new_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
4003             initial_credits = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
4004             result = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
4005             status = l2cap_ecbm_status_for_result(result);
4006 
4007             // get num channels to modify
4008             num_channels = (len - 8) / sizeof(uint16_t);
4009             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4010             while (btstack_linked_list_iterator_has_next(&it)) {
4011                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4012                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
4013                 if (channel->con_handle != handle) continue;
4014                 if (channel->local_sig_id != sig_id) continue;
4015                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE) continue;
4016                 if (channel->cid_index < num_channels) {
4017                     uint16_t remote_cid = little_endian_read_16(command, 12 + channel->cid_index * sizeof(uint16_t));
4018                     if (remote_cid != 0) {
4019                         channel->state = L2CAP_STATE_OPEN;
4020                         channel->remote_cid = remote_cid;
4021                         channel->remote_mtu = new_mtu;
4022                         channel->remote_mps = new_mps;
4023                         channel->credits_outgoing = initial_credits;
4024                         l2cap_ecbm_emit_channel_opened(channel, ERROR_CODE_SUCCESS);
4025                         continue;
4026                     }
4027                 }
4028                 // open failed
4029                 l2cap_ecbm_emit_channel_opened(channel, status);
4030                 // drop failed channel
4031                 btstack_linked_list_iterator_remove(&it);
4032                 btstack_memory_l2cap_channel_free(channel);
4033             }
4034             return 1;
4035 
4036         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
4037             // check minimal size
4038             if (len < 6) return 0u;
4039 
4040             // get hci connection, bail if not found (must not happen)
4041             connection = hci_connection_for_handle(handle);
4042             btstack_assert(connection != NULL);
4043 
4044             // get num channels to modify
4045             num_channels = (len - 4) / sizeof(uint16_t);
4046 
4047             // get new mtu and mps
4048             new_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4049             new_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
4050 
4051             // validate request
4052             result = 0;
4053             for (i = 0; i < num_channels; i++) {
4054                 // check cid
4055                 uint16_t remote_cid = little_endian_read_16(command, 8 + (i * sizeof(uint16_t)));
4056                 l2cap_channel_t *channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
4057                 if (channel == NULL) {
4058                     result = L2CAP_ECBM_RECONFIGURE_FAILED_DESTINATION_CID_INVALID;
4059                     break;
4060                 }
4061                 // check MTU is not reduced
4062                 if (channel->remote_mtu > new_mtu) {
4063                     result = L2CAP_ECBM_RECONFIGURE_FAILED_MTU_REDUCTION_NOT_ALLOWED;
4064                     break;
4065                 }
4066                 // check MPS reduction
4067                 if ((num_channels > 1) && (channel->remote_mps > new_mps)) {
4068                     result = L2CAP_ECBM_RECONFIGURE_FAILED_MPS_REDUCTION_MULTIPLE_CHANNELS;
4069                     break;
4070                 }
4071                 // check MPS valid
4072                 if (new_mps < l2cap_enhanced_mps_min) {
4073                     result = L2CAP_ECBM_RECONFIGURE_FAILED_UNACCEPTABLE_PARAMETERS;
4074                     break;
4075                 }
4076             }
4077 
4078             // send reject
4079             if (result != 0) {
4080                 l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST, sig_id, signaling_cid,
4081                                                   result);
4082                 return 1;
4083             }
4084 
4085             // update channels
4086             for (i = 0; i < num_channels; i++) {
4087                 uint16_t remote_cid = little_endian_read_16(command, 8 + (i * sizeof(uint16_t)));
4088                 l2cap_channel_t *channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
4089                 channel->remote_mps = new_mps;
4090                 channel->remote_mtu = new_mtu;
4091                 // emit event
4092                 uint8_t event[8];
4093                 event[0] = L2CAP_EVENT_ECBM_RECONFIGURED;
4094                 event[1] = sizeof(event) - 2;
4095                 little_endian_store_16(event, 2, channel->local_cid);
4096                 little_endian_store_16(event, 4, new_mtu);
4097                 little_endian_store_16(event, 6, new_mps);
4098                 l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
4099             }
4100 
4101             // send accept
4102             l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST, sig_id, signaling_cid, 0);
4103             return 1;
4104 
4105         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
4106             // check size
4107             if (len < 2u) return 0u;
4108 
4109             result = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4110             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4111             while (btstack_linked_list_iterator_has_next(&it)) {
4112                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4113                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
4114                 if (channel->con_handle != handle) continue;
4115                 if (channel->local_sig_id != sig_id) continue;
4116                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE) continue;
4117                 // complete request
4118                 if (result == 0) {
4119                     channel->receive_sdu_buffer = channel->renegotiate_sdu_buffer;
4120                     channel->local_mtu = channel->renegotiate_mtu;
4121                 }
4122                 channel->state = L2CAP_STATE_OPEN;
4123                 // emit event
4124                 l2cap_ecbm_emit_reconfigure_complete(channel, result);
4125             }
4126             break;
4127 
4128         default:
4129             btstack_unreachable();
4130             break;
4131     }
4132     return 0;
4133 }
4134 
4135 #endif
4136 
4137 #ifdef ENABLE_BLE
4138 
4139 static void l2cap_emit_connection_parameter_update_response(hci_con_handle_t con_handle, uint16_t result){
4140     uint8_t event[6];
4141     event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_RESPONSE;
4142     event[1] = 4;
4143     little_endian_store_16(event, 2, con_handle);
4144     little_endian_store_16(event, 4, result);
4145     l2cap_emit_event(event, sizeof(event));
4146 }
4147 
4148 // @return valid
4149 static int l2cap_le_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t * command, uint8_t sig_id){
4150     hci_connection_t * connection;
4151     uint16_t result;
4152     uint8_t  event[12];
4153 
4154 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4155     l2cap_channel_t * channel;
4156     btstack_linked_list_iterator_t it;
4157 #endif
4158 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4159     uint16_t local_cid;
4160     uint16_t le_psm;
4161     l2cap_service_t * service;
4162     uint16_t source_cid;
4163 #endif
4164 
4165     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
4166     uint16_t len   = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
4167     log_info("le dispatch: command 0x%02x, sig id %u, len %u", code, sig_id, len);
4168 
4169     switch (code){
4170 
4171         case CONNECTION_PARAMETER_UPDATE_REQUEST:
4172             // check size
4173             if (len < 8u) return 0u;
4174             connection = hci_connection_for_handle(handle);
4175             if (connection != NULL){
4176                 if (connection->role != HCI_ROLE_MASTER){
4177                     // reject command without notifying upper layer when not in master role
4178                     return 0;
4179                 }
4180                 le_connection_parameter_range_t existing_range;
4181                 gap_get_connection_parameter_range(&existing_range);
4182                 uint16_t le_conn_interval_min   = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
4183                 uint16_t le_conn_interval_max   = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
4184                 uint16_t le_conn_latency        = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
4185                 uint16_t le_supervision_timeout = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+6);
4186 
4187                 int update_parameter = gap_connection_parameter_range_included(&existing_range, le_conn_interval_min, le_conn_interval_max, le_conn_latency, le_supervision_timeout);
4188                 if (update_parameter){
4189                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_SEND_RESPONSE;
4190                     connection->le_conn_interval_min = le_conn_interval_min;
4191                     connection->le_conn_interval_max = le_conn_interval_max;
4192                     connection->le_conn_latency = le_conn_latency;
4193                     connection->le_supervision_timeout = le_supervision_timeout;
4194                 } else {
4195                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_DENY;
4196                 }
4197                 connection->le_con_param_update_identifier = sig_id;
4198             }
4199 
4200             event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_REQUEST;
4201             event[1] = 10;
4202             little_endian_store_16(event, 2, handle);
4203             (void)memcpy(&event[4], &command[4], 8);
4204             l2cap_emit_event(event, sizeof(event));
4205             break;
4206 
4207         case CONNECTION_PARAMETER_UPDATE_RESPONSE:
4208             // check size
4209             if (len < 2u) return 0u;
4210             result = little_endian_read_16(command, 4);
4211             l2cap_emit_connection_parameter_update_response(handle, result);
4212             break;
4213 
4214 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
4215         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
4216         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
4217         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
4218         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
4219             return l2cap_ecbm_signaling_handler_dispatch(handle, L2CAP_CID_SIGNALING_LE, command, sig_id);
4220 #endif
4221 
4222 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4223         case COMMAND_REJECT:
4224             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4225             while (btstack_linked_list_iterator_has_next(&it)){
4226                 channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4227                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
4228                 if (channel->con_handle   != handle) continue;
4229                 if (channel->local_sig_id != sig_id) continue;
4230 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4231                 // if received while waiting for le connection response, assume legacy device
4232                 if (channel->state == L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE){
4233                     channel->state = L2CAP_STATE_CLOSED;
4234                     // no official value for this, use: Connection refused – LE_PSM not supported
4235                     l2cap_cbm_emit_channel_opened(channel, L2CAP_CBM_CONNECTION_RESULT_SPSM_NOT_SUPPORTED);
4236 
4237                     // discard channel
4238                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4239                     l2cap_free_channel_entry(channel);
4240                     continue;
4241                 }
4242 #endif
4243 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
4244                 // if received while waiting for le connection response, assume legacy device
4245                 if (channel->state == L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE){
4246                     channel->state = L2CAP_STATE_CLOSED;
4247                     // treat as SPSM not supported
4248                     l2cap_ecbm_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_PSM);
4249 
4250                     // discard channel
4251                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4252                     l2cap_free_channel_entry(channel);
4253                     continue;
4254                 }
4255 #endif
4256             }
4257             break;
4258 #endif
4259 
4260 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4261         case LE_CREDIT_BASED_CONNECTION_REQUEST:
4262             // check size
4263             if (len < 10u) return 0u;
4264 
4265             // get hci connection, bail if not found (must not happen)
4266             connection = hci_connection_for_handle(handle);
4267             if (!connection) return 0;
4268 
4269             // check if service registered
4270             le_psm  = little_endian_read_16(command, 4);
4271             service = l2cap_cbm_get_service(le_psm);
4272             source_cid = little_endian_read_16(command, 6);
4273 
4274             if (service){
4275                 if (source_cid < 0x40u){
4276                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_INVALID_SOURCE_CID);
4277                     return 1;
4278                 }
4279 
4280                 // go through list of channels for this ACL connection and check if we get a match
4281                 btstack_linked_list_iterator_init(&it, &l2cap_channels);
4282                 while (btstack_linked_list_iterator_has_next(&it)){
4283                     l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4284                     if (!l2cap_is_dynamic_channel_type(a_channel->channel_type)) continue;
4285                     if (a_channel->con_handle != handle) continue;
4286                     if (a_channel->remote_cid != source_cid) continue;
4287                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_SOURCE_CID_ALREADY_ALLOCATED);
4288                     return 1;
4289                 }
4290 
4291                 // security: check encryption
4292                 if (service->required_security_level >= LEVEL_2){
4293                     if (gap_encryption_key_size(handle) == 0){
4294                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_ENCRYPTION);
4295                         return 1;
4296                     }
4297                     // anything less than 16 byte key size is insufficient
4298                     if (gap_encryption_key_size(handle) < 16){
4299                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_ENCYRPTION_KEY_SIZE_TOO_SHORT);
4300                         return 1;
4301                     }
4302                 }
4303 
4304                 // security: check authentication
4305                 if (service->required_security_level >= LEVEL_3){
4306                     if (!gap_authenticated(handle)){
4307                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_AUTHENTICATION);
4308                         return 1;
4309                     }
4310                 }
4311 
4312                 // security: check authorization
4313                 if (service->required_security_level >= LEVEL_4){
4314                     if (gap_authorization_state(handle) != AUTHORIZATION_GRANTED){
4315                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_INSUFFICIENT_AUTHORIZATION);
4316                         return 1;
4317                     }
4318                 }
4319 
4320                 // allocate channel
4321                 channel = l2cap_create_channel_entry(service->packet_handler, L2CAP_CHANNEL_TYPE_CHANNEL_CBM, connection->address,
4322                                                      BD_ADDR_TYPE_LE_RANDOM, le_psm, service->mtu, service->required_security_level);
4323                 if (!channel){
4324                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE);
4325                     return 1;
4326                 }
4327 
4328                 channel->con_handle = handle;
4329                 channel->remote_cid = source_cid;
4330                 channel->remote_sig_id = sig_id;
4331                 channel->remote_mtu = little_endian_read_16(command, 8);
4332                 channel->remote_mps = little_endian_read_16(command, 10);
4333                 channel->credits_outgoing = little_endian_read_16(command, 12);
4334 
4335                 // set initial state
4336                 channel->state      = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
4337                 channel->state_var |= L2CAP_CHANNEL_STATE_VAR_INCOMING;
4338 
4339                 // add to connections list
4340                 btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
4341 
4342                 // post connection request event
4343                 l2cap_cbm_emit_incoming_connection(channel);
4344 
4345             } else {
4346                 l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, L2CAP_CBM_CONNECTION_RESULT_SPSM_NOT_SUPPORTED);
4347             }
4348             break;
4349 
4350         case LE_CREDIT_BASED_CONNECTION_RESPONSE:
4351             // check size
4352             if (len < 10u) return 0u;
4353 
4354             // Find channel for this sig_id and connection handle
4355             channel = NULL;
4356             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4357             while (btstack_linked_list_iterator_has_next(&it)){
4358                 l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4359                 if (!l2cap_is_dynamic_channel_type(a_channel->channel_type)) continue;
4360                 if (a_channel->con_handle   != handle) continue;
4361                 if (a_channel->local_sig_id != sig_id) continue;
4362                 channel = a_channel;
4363                 break;
4364             }
4365             if (!channel) break;
4366 
4367             // cid + 0
4368             result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+8);
4369             if (result){
4370                 channel->state = L2CAP_STATE_CLOSED;
4371                 uint8_t status = l2cap_cbm_status_for_result(result);
4372                 l2cap_cbm_emit_channel_opened(channel, status);
4373 
4374                 // discard channel
4375                 btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4376                 l2cap_free_channel_entry(channel);
4377                 break;
4378             }
4379 
4380             // success
4381             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4382             channel->remote_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
4383             channel->remote_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
4384             channel->credits_outgoing = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
4385             channel->state = L2CAP_STATE_OPEN;
4386             l2cap_cbm_emit_channel_opened(channel, ERROR_CODE_SUCCESS);
4387             break;
4388 #endif
4389 
4390 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4391         case L2CAP_FLOW_CONTROL_CREDIT_INDICATION:
4392             return l2cap_credit_based_handle_credit_indication(handle, command, len) ? 1 : 0;
4393 
4394         case DISCONNECTION_REQUEST:
4395 
4396             // check size
4397             if (len < 4u) return 0u;
4398 
4399             // find channel
4400             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4401             channel = l2cap_get_channel_for_local_cid_and_handle(local_cid, handle);
4402             if (!channel) {
4403                 log_error("credit: no channel for cid 0x%02x", local_cid);
4404                 break;
4405             }
4406             channel->remote_sig_id = sig_id;
4407             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
4408             break;
4409 
4410         case DISCONNECTION_RESPONSE:
4411             // check size
4412             if (len < 4u) return 0u;
4413 
4414             // find channel
4415             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4416             channel = l2cap_get_channel_for_local_cid_and_handle(local_cid, handle);
4417             if (!channel) break;
4418             if (channel->local_sig_id == sig_id) {
4419                 if (channel->state == L2CAP_STATE_WAIT_DISCONNECT){
4420                     l2cap_finalize_channel_close(channel);
4421                 }
4422             }
4423             break;
4424 #endif
4425 
4426         default:
4427             // command unknown -> reject command
4428             return 0;
4429     }
4430     return 1;
4431 }
4432 #endif
4433 
4434 #ifdef ENABLE_CLASSIC
4435 static void l2cap_acl_classic_handler_for_channel(l2cap_channel_t * l2cap_channel, uint8_t * packet, uint16_t size){
4436 
4437     // forward data only in OPEN state
4438     if (l2cap_channel->state != L2CAP_STATE_OPEN) return;
4439 
4440 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4441     if (l2cap_channel->channel_type == L2CAP_CHANNEL_TYPE_CHANNEL_ECBM){
4442         l2cap_credit_based_handle_pdu(l2cap_channel, packet, size);
4443         return;
4444     }
4445 #endif
4446 
4447 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
4448     if (l2cap_channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
4449 
4450         int fcs_size = l2cap_channel->fcs_option ? 2 : 0;
4451 
4452         // assert control + FCS fields are inside
4453         if (size < COMPLETE_L2CAP_HEADER+2+fcs_size) return;
4454 
4455         if (l2cap_channel->fcs_option){
4456             // verify FCS (required if one side requested it)
4457             uint16_t fcs_calculated = crc16_calc(&packet[4], size - (4+2));
4458             uint16_t fcs_packet     = little_endian_read_16(packet, size-2);
4459 
4460 #ifdef L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL
4461             // simulate fcs error
4462             static int counter = 0;
4463             if (++counter == L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL) {
4464                 log_info("Simulate fcs error");
4465                 fcs_calculated++;
4466                 counter = 0;
4467             }
4468 #endif
4469 
4470             if (fcs_calculated == fcs_packet){
4471                 log_info("Packet FCS 0x%04x verified", fcs_packet);
4472             } else {
4473                 log_error("FCS mismatch! Packet 0x%04x, calculated 0x%04x", fcs_packet, fcs_calculated);
4474                 // ERTM State Machine in Bluetooth Spec does not handle 'I-Frame with invalid FCS'
4475                 return;
4476             }
4477         }
4478 
4479         // switch on packet type
4480         uint16_t control = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
4481         uint8_t  req_seq = (control >> 8) & 0x3f;
4482         int final = (control >> 7) & 0x01;
4483         if (control & 1){
4484             // S-Frame
4485             int poll  = (control >> 4) & 0x01;
4486             l2cap_supervisory_function_t s = (l2cap_supervisory_function_t) ((control >> 2) & 0x03);
4487             log_info("Control: 0x%04x => Supervisory function %u, ReqSeq %02u", control, (int) s, req_seq);
4488             l2cap_ertm_tx_packet_state_t * tx_state;
4489             switch (s){
4490                 case L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY:
4491                     log_info("L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY");
4492                     l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4493                     if (poll && final){
4494                         // S-frames shall not be transmitted with both the F-bit and the P-bit set to 1 at the same time.
4495                         log_error("P=F=1 in S-Frame");
4496                         break;
4497                     }
4498                     if (poll){
4499                         // check if we did request selective retransmission before <==> we have stored SDU segments
4500                         int i;
4501                         int num_stored_out_of_order_packets = 0;
4502                         for (i=0;i<l2cap_channel->num_rx_buffers;i++){
4503                             int index = l2cap_channel->rx_store_index + i;
4504                             if (index >= l2cap_channel->num_rx_buffers){
4505                                 index -= l2cap_channel->num_rx_buffers;
4506                             }
4507                             l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
4508                             if (!rx_state->valid) continue;
4509                             num_stored_out_of_order_packets++;
4510                         }
4511                         if (num_stored_out_of_order_packets){
4512                             l2cap_channel->send_supervisor_frame_selective_reject = 1;
4513                         } else {
4514                             l2cap_channel->send_supervisor_frame_receiver_ready   = 1;
4515                         }
4516                         l2cap_channel->set_final_bit_after_packet_with_poll_bit_set = 1;
4517                     }
4518                     if (final){
4519                         // Stop-MonitorTimer
4520                         l2cap_ertm_stop_monitor_timer(l2cap_channel);
4521                         // If UnackedFrames > 0 then Start-RetransTimer
4522                         if (l2cap_channel->unacked_frames){
4523                             l2cap_ertm_start_retransmission_timer(l2cap_channel);
4524                         }
4525                         // final bit set <- response to RR with poll bit set. All not acknowledged packets need to be retransmitted
4526                         l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4527                     }
4528                     break;
4529                 case L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT:
4530                     log_info("L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT");
4531                     l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4532                     // restart transmittion from last unacknowledted packet (earlier packets already freed in l2cap_ertm_process_req_seq)
4533                     l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4534                     break;
4535                 case L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY:
4536                     log_error("L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY");
4537                     break;
4538                 case L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT:
4539                     log_info("L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT");
4540                     if (poll){
4541                         l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4542                     }
4543                     // find requested i-frame
4544                     tx_state = l2cap_ertm_get_tx_state(l2cap_channel, req_seq);
4545                     if (tx_state){
4546                         log_info("Retransmission for tx_seq %u requested", req_seq);
4547                         l2cap_channel->set_final_bit_after_packet_with_poll_bit_set = poll;
4548                         tx_state->retransmission_requested = 1;
4549                         l2cap_channel->srej_active = 1;
4550                     }
4551                     break;
4552                 default:
4553                     break;
4554             }
4555         } else {
4556             // I-Frame
4557             // get control
4558             l2cap_segmentation_and_reassembly_t sar = (l2cap_segmentation_and_reassembly_t) (control >> 14);
4559             uint8_t tx_seq = (control >> 1) & 0x3f;
4560             log_info("Control: 0x%04x => SAR %u, ReqSeq %02u, R?, TxSeq %02u", control, (int) sar, req_seq, tx_seq);
4561             log_info("SAR: pos %u", l2cap_channel->reassembly_pos);
4562             log_info("State: expected_tx_seq %02u, req_seq %02u", l2cap_channel->expected_tx_seq, l2cap_channel->req_seq);
4563             l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4564             if (final){
4565                 // final bit set <- response to RR with poll bit set. All not acknowledged packets need to be retransmitted
4566                 l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4567             }
4568 
4569             // get SDU
4570             const uint8_t * payload_data = &packet[COMPLETE_L2CAP_HEADER+2];
4571             uint16_t        payload_len  = size-(COMPLETE_L2CAP_HEADER+2+fcs_size);
4572 
4573             // assert SDU size is smaller or equal to our buffers
4574             uint16_t max_payload_size = 0;
4575             switch (sar){
4576                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU:
4577                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
4578                     // SDU Length + MPS
4579                     max_payload_size = l2cap_channel->local_mps + 2;
4580                     break;
4581                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
4582                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU:
4583                     max_payload_size = l2cap_channel->local_mps;
4584                     break;
4585                 default:
4586                     btstack_assert(false);
4587                     break;
4588             }
4589             if (payload_len > max_payload_size){
4590                 log_info("payload len %u > max payload %u -> drop packet", payload_len, max_payload_size);
4591                 return;
4592             }
4593 
4594             // check ordering
4595             if (l2cap_channel->expected_tx_seq == tx_seq){
4596                 log_info("Received expected frame with TxSeq == ExpectedTxSeq == %02u", tx_seq);
4597                 l2cap_channel->expected_tx_seq = l2cap_next_ertm_seq_nr(l2cap_channel->expected_tx_seq);
4598                 l2cap_channel->req_seq         = l2cap_channel->expected_tx_seq;
4599 
4600                 // process SDU
4601                 l2cap_ertm_handle_in_sequence_sdu(l2cap_channel, sar, payload_data, payload_len);
4602 
4603                 // process stored segments
4604                 while (true){
4605                     int index = l2cap_channel->rx_store_index;
4606                     l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
4607                     if (!rx_state->valid) break;
4608 
4609                     log_info("Processing stored frame with TxSeq == ExpectedTxSeq == %02u", l2cap_channel->expected_tx_seq);
4610                     l2cap_channel->expected_tx_seq = l2cap_next_ertm_seq_nr(l2cap_channel->expected_tx_seq);
4611                     l2cap_channel->req_seq         = l2cap_channel->expected_tx_seq;
4612 
4613                     rx_state->valid = 0;
4614                     l2cap_ertm_handle_in_sequence_sdu(l2cap_channel, rx_state->sar, &l2cap_channel->rx_packets_data[index], rx_state->len);
4615 
4616                     // update rx store index
4617                     index++;
4618                     if (index >= l2cap_channel->num_rx_buffers){
4619                         index = 0;
4620                     }
4621                     l2cap_channel->rx_store_index = index;
4622                 }
4623 
4624                 //
4625                 l2cap_channel->send_supervisor_frame_receiver_ready = 1;
4626 
4627             } else {
4628                 int delta = (tx_seq - l2cap_channel->expected_tx_seq) & 0x3f;
4629                 if (delta < 2){
4630                     // store segment
4631                     l2cap_ertm_handle_out_of_sequence_sdu(l2cap_channel, sar, delta, payload_data, payload_len);
4632 
4633                     log_info("Received unexpected frame TxSeq %u but expected %u -> send S-SREJ", tx_seq, l2cap_channel->expected_tx_seq);
4634                     l2cap_channel->send_supervisor_frame_selective_reject = 1;
4635                 } else {
4636                     log_info("Received unexpected frame TxSeq %u but expected %u -> send S-REJ", tx_seq, l2cap_channel->expected_tx_seq);
4637                     l2cap_channel->send_supervisor_frame_reject = 1;
4638                 }
4639             }
4640         }
4641         return;
4642     }
4643 #endif
4644 
4645     // check size
4646     uint16_t payload_size = size - COMPLETE_L2CAP_HEADER;
4647     if (l2cap_channel->local_mtu < payload_size) return;
4648 
4649     l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, &packet[COMPLETE_L2CAP_HEADER], payload_size);
4650 }
4651 #endif
4652 
4653 static void l2cap_acl_classic_handler(hci_con_handle_t handle, uint8_t *packet, uint16_t size){
4654 #ifdef ENABLE_CLASSIC
4655     l2cap_channel_t * l2cap_channel;
4656     l2cap_fixed_channel_t * l2cap_fixed_channel;
4657 
4658     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
4659     uint8_t  broadcast_flag = READ_ACL_FLAGS(packet) >> 2;
4660     switch (channel_id) {
4661 
4662         case L2CAP_CID_SIGNALING: {
4663             if (broadcast_flag != 0) break;
4664             uint32_t command_offset = 8;
4665             while ((command_offset + L2CAP_SIGNALING_COMMAND_DATA_OFFSET) < size) {
4666                 // assert signaling command is fully inside packet
4667                 uint16_t data_len = little_endian_read_16(packet, command_offset + L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
4668                 uint32_t next_command_offset = command_offset + L2CAP_SIGNALING_COMMAND_DATA_OFFSET + data_len;
4669                 if (next_command_offset > size){
4670                     log_error("l2cap signaling command len invalid -> drop");
4671                     break;
4672                 }
4673                 // handle signaling command
4674                 l2cap_signaling_handler_dispatch(handle, &packet[command_offset]);
4675                 // go to next command
4676                 command_offset = next_command_offset;
4677             }
4678             break;
4679         }
4680 
4681         case L2CAP_CID_CONNECTIONLESS_CHANNEL:
4682             if (broadcast_flag == 0) break;
4683             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_CONNECTIONLESS_CHANNEL);
4684             if (!l2cap_fixed_channel) break;
4685             if (!l2cap_fixed_channel->packet_handler) break;
4686             (*l2cap_fixed_channel->packet_handler)(UCD_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4687             break;
4688 
4689 #ifdef ENABLE_BLE
4690         case L2CAP_CID_BR_EDR_SECURITY_MANAGER:
4691             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_BR_EDR_SECURITY_MANAGER);
4692             if ((l2cap_fixed_channel == NULL) || (l2cap_fixed_channel->packet_handler == NULL)){
4693                 // Pairing Failed
4694                 l2cap_register_signaling_response(handle, (uint8_t) SM_PAIRING_FAILED, 0, L2CAP_CID_BR_EDR_SECURITY_MANAGER, SM_REASON_PAIRING_NOT_SUPPORTED);
4695             } else {
4696                 (*l2cap_fixed_channel->packet_handler)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4697             }
4698             break;
4699 #endif
4700 
4701         default:
4702             if (broadcast_flag != 0) break;
4703             // Find channel for this channel_id and connection handle
4704             l2cap_channel = l2cap_get_channel_for_local_cid_and_handle(channel_id, handle);
4705             if (l2cap_channel != NULL){
4706                 l2cap_acl_classic_handler_for_channel(l2cap_channel, packet, size);
4707             }
4708             break;
4709     }
4710 #else
4711     UNUSED(handle); // ok: no code
4712     UNUSED(packet); // ok: no code
4713     UNUSED(size);   // ok: no code
4714 #endif
4715 }
4716 
4717 static void l2cap_acl_le_handler(hci_con_handle_t handle, uint8_t *packet, uint16_t size){
4718 #ifdef ENABLE_BLE
4719 
4720     l2cap_fixed_channel_t * l2cap_fixed_channel;
4721 
4722 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4723     l2cap_channel_t * l2cap_channel;
4724 #endif
4725     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
4726     switch (channel_id) {
4727 
4728         case L2CAP_CID_SIGNALING_LE: {
4729             uint8_t sig_id = packet[COMPLETE_L2CAP_HEADER + 1];
4730             uint16_t len = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER + 2);
4731             if ((COMPLETE_L2CAP_HEADER + 4u + len) > size) break;
4732             int      valid  = l2cap_le_signaling_handler_dispatch(handle, &packet[COMPLETE_L2CAP_HEADER], sig_id);
4733             if (!valid){
4734                 l2cap_register_signaling_response(handle, COMMAND_REJECT_LE, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
4735             }
4736             break;
4737         }
4738 
4739         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
4740             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_ATTRIBUTE_PROTOCOL);
4741             if (!l2cap_fixed_channel) break;
4742             if (!l2cap_fixed_channel->packet_handler) break;
4743             (*l2cap_fixed_channel->packet_handler)(ATT_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4744             break;
4745 
4746         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
4747             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
4748             if ((l2cap_fixed_channel == NULL) || (l2cap_fixed_channel->packet_handler == NULL)){
4749                 // Pairing Failed
4750                 l2cap_register_signaling_response(handle, (uint8_t) SM_PAIRING_FAILED, 0, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, SM_REASON_PAIRING_NOT_SUPPORTED);
4751             } else {
4752                 (*l2cap_fixed_channel->packet_handler)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4753             }
4754             break;
4755 
4756         default:
4757 
4758 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4759             l2cap_channel = l2cap_get_channel_for_local_cid_and_handle(channel_id, handle);
4760             if (l2cap_channel != NULL) {
4761                 l2cap_credit_based_handle_pdu(l2cap_channel, packet, size);
4762             }
4763 #endif
4764             break;
4765     }
4766 #else
4767     UNUSED(handle); // ok: no code
4768     UNUSED(packet); // ok: no code
4769     UNUSED(size);   // ok: no code
4770 #endif
4771 }
4772 
4773 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
4774     UNUSED(packet_type);    // ok: registered with hci_register_acl_packet_handler
4775     UNUSED(channel);        // ok: there is no channel
4776 
4777     // Assert full L2CAP header present
4778     if (size < COMPLETE_L2CAP_HEADER) return;
4779 
4780     // Dispatch to Classic or LE handler (SCO packets are not dispatched to L2CAP)
4781     hci_con_handle_t handle = READ_ACL_CONNECTION_HANDLE(packet);
4782     hci_connection_t *conn = hci_connection_for_handle(handle);
4783     if (!conn) return;
4784     if (conn->address_type == BD_ADDR_TYPE_ACL){
4785         l2cap_acl_classic_handler(handle, packet, size);
4786     } else {
4787         l2cap_acl_le_handler(handle, packet, size);
4788     }
4789 
4790     l2cap_run();
4791 }
4792 
4793 // Bluetooth 4.0 - allows to register handler for Attribute Protocol and Security Manager Protocol
4794 void l2cap_register_fixed_channel(btstack_packet_handler_t packet_handler, uint16_t channel_id) {
4795     l2cap_fixed_channel_t * channel = l2cap_fixed_channel_for_channel_id(channel_id);
4796     if (!channel) return;
4797     channel->packet_handler = packet_handler;
4798 }
4799 
4800 #ifdef L2CAP_USES_CHANNELS
4801 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
4802 void l2cap_finalize_channel_close(l2cap_channel_t * channel){
4803     channel->state = L2CAP_STATE_CLOSED;
4804     l2cap_handle_channel_closed(channel);
4805     // discard channel
4806     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4807     l2cap_free_channel_entry(channel);
4808 }
4809 #endif
4810 
4811 #ifdef ENABLE_CLASSIC
4812 static inline l2cap_service_t * l2cap_get_service(uint16_t psm){
4813     return l2cap_get_service_internal(&l2cap_services, psm);
4814 }
4815 
4816 static void l2cap_update_minimal_security_level(void){
4817     // update minimal service security level
4818     gap_security_level_t minimal_level = LEVEL_1;
4819     btstack_linked_list_iterator_t it;
4820     btstack_linked_list_iterator_init(&it, &l2cap_services);
4821     while (btstack_linked_list_iterator_has_next(&it)){
4822         l2cap_service_t * service = (l2cap_service_t *) btstack_linked_list_iterator_next(&it);
4823         if (service->required_security_level > minimal_level){
4824             minimal_level = service->required_security_level;
4825         };
4826     }
4827     gap_set_minimal_service_security_level(minimal_level);
4828 }
4829 
4830 uint8_t l2cap_register_service(btstack_packet_handler_t service_packet_handler, uint16_t psm, uint16_t mtu, gap_security_level_t security_level){
4831 
4832     log_info("L2CAP_REGISTER_SERVICE psm 0x%x mtu %u", psm, mtu);
4833 
4834     // check for alread registered psm
4835     l2cap_service_t *service = l2cap_get_service(psm);
4836     if (service) {
4837         log_error("register: PSM %u already registered", psm);
4838         return L2CAP_SERVICE_ALREADY_REGISTERED;
4839     }
4840 
4841     // alloc structure
4842     service = btstack_memory_l2cap_service_get();
4843     if (!service) {
4844         log_error("register: no memory for l2cap_service_t");
4845         return BTSTACK_MEMORY_ALLOC_FAILED;
4846     }
4847 
4848     // fill in
4849     service->psm = psm;
4850     service->mtu = mtu;
4851     service->packet_handler = service_packet_handler;
4852     service->required_security_level = security_level;
4853 
4854     // add to services list
4855     btstack_linked_list_add(&l2cap_services, (btstack_linked_item_t *) service);
4856 
4857     l2cap_update_minimal_security_level();
4858 
4859 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
4860     // enable page scan
4861     gap_connectable_control(1);
4862 #endif
4863 
4864 
4865     return ERROR_CODE_SUCCESS;
4866 }
4867 
4868 uint8_t l2cap_unregister_service(uint16_t psm){
4869 
4870     log_info("unregister psm 0x%x", psm);
4871 
4872     l2cap_service_t *service = l2cap_get_service(psm);
4873     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
4874     btstack_linked_list_remove(&l2cap_services, (btstack_linked_item_t *) service);
4875     btstack_memory_l2cap_service_free(service);
4876 
4877     l2cap_update_minimal_security_level();
4878 
4879 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
4880     // disable page scan when no services registered
4881     if (btstack_linked_list_empty(&l2cap_services)) {
4882         gap_connectable_control(0);
4883     }
4884 #endif
4885 
4886     return ERROR_CODE_SUCCESS;
4887 }
4888 #endif
4889 
4890 
4891 #ifdef L2CAP_USES_CREDIT_BASED_CHANNELS
4892 
4893 static void l2cap_credit_based_send_pdu(l2cap_channel_t *channel) {
4894     btstack_assert(channel != NULL);
4895     btstack_assert(channel->send_sdu_buffer != NULL);
4896     btstack_assert(channel->credits_outgoing > 0);
4897 
4898     // send part of SDU
4899     hci_reserve_packet_buffer();
4900     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
4901     uint8_t *l2cap_payload = acl_buffer + 8;
4902     uint16_t pos = 0;
4903     if (!channel->send_sdu_pos) {
4904         // store SDU len
4905         channel->send_sdu_pos += 2u;
4906         little_endian_store_16(l2cap_payload, pos, channel->send_sdu_len);
4907         pos += 2u;
4908     }
4909     uint16_t payload_size = btstack_min(channel->send_sdu_len + 2u - channel->send_sdu_pos, channel->remote_mps - pos);
4910     log_info("len %u, pos %u => payload %u, credits %u", channel->send_sdu_len, channel->send_sdu_pos, payload_size,
4911              channel->credits_outgoing);
4912     (void) memcpy(&l2cap_payload[pos],
4913                   &channel->send_sdu_buffer[channel->send_sdu_pos - 2u],
4914                   payload_size); // -2 for virtual SDU len
4915     pos += payload_size;
4916     channel->send_sdu_pos += payload_size;
4917     l2cap_setup_header(acl_buffer, channel->con_handle, 0, channel->remote_cid, pos);
4918 
4919     channel->credits_outgoing--;
4920 
4921     // update state (mark SDU as done) before calling hci_send_acl_packet_buffer (trigger l2cap_le_send_pdu again)
4922     bool done = channel->send_sdu_pos >= (channel->send_sdu_len + 2u);
4923     if (done) {
4924         channel->send_sdu_buffer = NULL;
4925     }
4926 
4927     hci_send_acl_packet_buffer(8u + pos);
4928 
4929     if (done) {
4930         // send done event
4931         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_PACKET_SENT);
4932         // inform about can send now
4933         l2cap_credit_based_notify_channel_can_send(channel);
4934     }
4935 }
4936 
4937 static uint8_t l2cap_credit_based_send_data(l2cap_channel_t * channel, const uint8_t * data, uint16_t size){
4938 
4939     if (size > channel->remote_mtu){
4940         log_error("l2cap send, cid 0x%02x, data length exceeds remote MTU.", channel->local_cid);
4941         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
4942     }
4943 
4944     if (channel->send_sdu_buffer){
4945         log_info("l2cap send, cid 0x%02x, cannot send", channel->local_cid);
4946         return BTSTACK_ACL_BUFFERS_FULL;
4947     }
4948 
4949     channel->send_sdu_buffer = data;
4950     channel->send_sdu_len    = size;
4951     channel->send_sdu_pos    = 0;
4952 
4953     l2cap_notify_channel_can_send();
4954     return ERROR_CODE_SUCCESS;
4955 }
4956 
4957 static uint8_t l2cap_credit_based_provide_credits(uint16_t local_cid, uint16_t credits){
4958     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
4959     if (!channel) {
4960         log_error("le credits no channel for cid 0x%02x", local_cid);
4961         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
4962     }
4963 
4964     // check state
4965     if (channel->state != L2CAP_STATE_OPEN){
4966         log_error("le credits but channel 0x%02x not open yet", local_cid);
4967     }
4968 
4969     // ignore if set to automatic credits
4970     if (channel->automatic_credits) return ERROR_CODE_SUCCESS;
4971 
4972     // assert incoming credits + credits <= 0xffff
4973     uint32_t total_credits = channel->credits_incoming;
4974     total_credits += channel->new_credits_incoming;
4975     total_credits += credits;
4976     if (total_credits > 0xffffu){
4977         log_error("le credits overrun: current %u, scheduled %u, additional %u", channel->credits_incoming,
4978                   channel->new_credits_incoming, credits);
4979     }
4980 
4981     // set credits_granted
4982     channel->new_credits_incoming += credits;
4983 
4984     // go
4985     l2cap_run();
4986     return ERROR_CODE_SUCCESS;
4987 }
4988 
4989 static void l2cap_credit_based_send_credits(l2cap_channel_t *channel) {
4990     log_info("l2cap: sending %u credits", channel->new_credits_incoming);
4991     channel->local_sig_id = l2cap_next_sig_id();
4992     uint16_t new_credits = channel->new_credits_incoming;
4993     channel->new_credits_incoming = 0;
4994     channel->credits_incoming += new_credits;
4995     uint16_t signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
4996     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, L2CAP_FLOW_CONTROL_CREDIT_INDICATION, channel->local_sig_id, channel->local_cid, new_credits);
4997 }
4998 
4999 // @return valid
5000 static bool l2cap_credit_based_handle_credit_indication(hci_con_handle_t handle, const uint8_t * command, uint16_t len){
5001     // check size
5002     if (len < 4u) return false;
5003 
5004     // find channel
5005     uint16_t remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
5006     l2cap_channel_t * channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
5007     if (!channel) {
5008         log_error("credit: no channel for handle 0x%04x/cid 0x%02x", handle, remote_cid);
5009         return true;
5010     }
5011     uint16_t new_credits = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
5012     uint16_t credits_before = channel->credits_outgoing;
5013     channel->credits_outgoing += new_credits;
5014     // check for credit overrun
5015     if (credits_before > channel->credits_outgoing) {
5016         log_error("credit: new credits caused overrrun for cid 0x%02x, disconnecting", channel->local_cid);
5017         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
5018         return true;
5019     }
5020     log_info("credit: %u credits for 0x%02x, now %u", new_credits, channel->local_cid, channel->credits_outgoing);
5021     l2cap_call_notify_channel_in_run = true;
5022     return true;
5023 }
5024 
5025 static void l2cap_credit_based_handle_pdu(l2cap_channel_t * l2cap_channel, const uint8_t * packet, uint16_t size){
5026     // ignore empty packets
5027     if (size == COMPLETE_L2CAP_HEADER) return;
5028 
5029     // credit counting
5030     if (l2cap_channel->credits_incoming == 0u){
5031         log_info("(e)CBM: packet received but no incoming credits");
5032         l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
5033         return;
5034     }
5035     l2cap_channel->credits_incoming--;
5036 
5037     // automatic credits
5038     if ((l2cap_channel->credits_incoming < L2CAP_CREDIT_BASED_FLOW_CONTROL_MODE_AUTOMATIC_CREDITS_WATERMARK) && l2cap_channel->automatic_credits){
5039         l2cap_channel->new_credits_incoming = L2CAP_CREDIT_BASED_FLOW_CONTROL_MODE_AUTOMATIC_CREDITS_INCREMENT;
5040     }
5041 
5042     // first fragment
5043     uint16_t pos = 0;
5044     if (!l2cap_channel->receive_sdu_len){
5045         if (size < (COMPLETE_L2CAP_HEADER + 2)) return;
5046         uint16_t sdu_len = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
5047         if (sdu_len > l2cap_channel->local_mtu) {
5048             log_info("(e)CBM: packet received larger than MTU");
5049             l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
5050             return;
5051         }
5052         l2cap_channel->receive_sdu_len = sdu_len;
5053         l2cap_channel->receive_sdu_pos = 0;
5054         pos  += 2u;
5055         size -= 2u;
5056     }
5057 
5058     uint16_t fragment_size   = size-COMPLETE_L2CAP_HEADER;
5059 
5060     // check fragment_size
5061     if (fragment_size > l2cap_channel->local_mps) {
5062         log_info("(e)CBM: fragment larger than local MPS");
5063         l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
5064         return;
5065     }
5066 
5067     // check sdu overrun
5068     if ((l2cap_channel->receive_sdu_pos + fragment_size) > l2cap_channel->receive_sdu_len){
5069         log_info("(e)CBM: fragments larger than SDU");
5070         l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
5071         return;
5072     }
5073 
5074     (void)memcpy(&l2cap_channel->receive_sdu_buffer[l2cap_channel->receive_sdu_pos],
5075                  &packet[COMPLETE_L2CAP_HEADER + pos],
5076                  fragment_size);
5077     l2cap_channel->receive_sdu_pos += fragment_size;
5078 
5079     // done?
5080     log_debug("le packet pos %u, len %u", l2cap_channel->receive_sdu_pos, l2cap_channel->receive_sdu_len);
5081     if (l2cap_channel->receive_sdu_pos >= l2cap_channel->receive_sdu_len){
5082         l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->receive_sdu_buffer, l2cap_channel->receive_sdu_len);
5083         l2cap_channel->receive_sdu_len = 0;
5084     }
5085 }
5086 
5087 static void l2cap_credit_based_notify_channel_can_send(l2cap_channel_t *channel){
5088     if (!channel->waiting_for_can_send_now) return;
5089     if (channel->send_sdu_buffer) return;
5090     channel->waiting_for_can_send_now = 0;
5091     log_debug("le can send now, local_cid 0x%x", channel->local_cid);
5092     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CAN_SEND_NOW);
5093 }
5094 #endif
5095 
5096 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
5097 // 1BH2222
5098 static void l2cap_cbm_emit_incoming_connection(l2cap_channel_t *channel) {
5099     log_info("le incoming addr_type %u, addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x, remote_mtu %u",
5100              channel->address_type, bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid, channel->remote_mtu);
5101     uint8_t event[19];
5102     event[0] = L2CAP_EVENT_CBM_INCOMING_CONNECTION;
5103     event[1] = sizeof(event) - 2u;
5104     event[2] = channel->address_type;
5105     reverse_bd_addr(channel->address, &event[3]);
5106     little_endian_store_16(event,  9, channel->con_handle);
5107     little_endian_store_16(event, 11, channel->psm);
5108     little_endian_store_16(event, 13, channel->local_cid);
5109     little_endian_store_16(event, 15, channel->remote_cid);
5110     little_endian_store_16(event, 17, channel->remote_mtu);
5111     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
5112     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
5113 }
5114 // 11BH22222
5115 static void l2cap_cbm_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
5116     log_info("opened le channel status 0x%x addr_type %u addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u",
5117              status, channel->address_type, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
5118              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu);
5119     uint8_t event[23];
5120     event[0] = L2CAP_EVENT_CBM_CHANNEL_OPENED;
5121     event[1] = sizeof(event) - 2u;
5122     event[2] = status;
5123     event[3] = channel->address_type;
5124     reverse_bd_addr(channel->address, &event[4]);
5125     little_endian_store_16(event, 10, channel->con_handle);
5126     event[12] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
5127     little_endian_store_16(event, 13, channel->psm);
5128     little_endian_store_16(event, 15, channel->local_cid);
5129     little_endian_store_16(event, 17, channel->remote_cid);
5130     little_endian_store_16(event, 19, channel->local_mtu);
5131     little_endian_store_16(event, 21, channel->remote_mtu);
5132     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
5133     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
5134 }
5135 
5136 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
5137 void l2cap_cbm_finialize_channel_close(l2cap_channel_t * channel){
5138     channel->state = L2CAP_STATE_CLOSED;
5139     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
5140     // discard channel
5141     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
5142     l2cap_free_channel_entry(channel);
5143 }
5144 
5145 static inline l2cap_service_t * l2cap_cbm_get_service(uint16_t le_psm){
5146     return l2cap_get_service_internal(&l2cap_le_services, le_psm);
5147 }
5148 
5149 uint8_t l2cap_cbm_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, gap_security_level_t security_level){
5150 
5151     log_info("l2cap_cbm_register_service psm 0x%x", psm);
5152 
5153     // check for alread registered psm
5154     l2cap_service_t *service = l2cap_cbm_get_service(psm);
5155     if (service) {
5156         return L2CAP_SERVICE_ALREADY_REGISTERED;
5157     }
5158 
5159     // alloc structure
5160     service = btstack_memory_l2cap_service_get();
5161     if (!service) {
5162         log_error("register: no memory for l2cap_service_t");
5163         return BTSTACK_MEMORY_ALLOC_FAILED;
5164     }
5165 
5166     // fill in
5167     service->psm = psm;
5168     service->mtu = 0;
5169     service->packet_handler = packet_handler;
5170     service->required_security_level = security_level;
5171 
5172     // add to services list
5173     btstack_linked_list_add(&l2cap_le_services, (btstack_linked_item_t *) service);
5174 
5175     // done
5176     return ERROR_CODE_SUCCESS;
5177 }
5178 
5179 uint8_t l2cap_cbm_unregister_service(uint16_t psm) {
5180     log_info("l2cap_cbm_unregister_service psm 0x%x", psm);
5181     l2cap_service_t *service = l2cap_cbm_get_service(psm);
5182     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
5183 
5184     btstack_linked_list_remove(&l2cap_le_services, (btstack_linked_item_t *) service);
5185     btstack_memory_l2cap_service_free(service);
5186     return ERROR_CODE_SUCCESS;
5187 }
5188 
5189 uint8_t l2cap_cbm_accept_connection(uint16_t local_cid, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits){
5190     // get channel
5191     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5192     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5193 
5194     // validate state
5195     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
5196         return ERROR_CODE_COMMAND_DISALLOWED;
5197     }
5198 
5199     // set state accept connection
5200     channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT;
5201     channel->receive_sdu_buffer = receive_sdu_buffer;
5202     channel->local_mtu = mtu;
5203     channel->new_credits_incoming = initial_credits;
5204     channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5205 
5206     // go
5207     l2cap_run();
5208     return ERROR_CODE_SUCCESS;
5209 }
5210 
5211 uint8_t l2cap_cbm_decline_connection(uint16_t local_cid, uint16_t result) {
5212     // get channel
5213     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5214     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5215 
5216     // validate state
5217     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
5218         return ERROR_CODE_COMMAND_DISALLOWED;
5219     }
5220 
5221     // set state decline connection
5222     channel->state  = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE;
5223     channel->reason = result;
5224     l2cap_run();
5225     return ERROR_CODE_SUCCESS;
5226 }
5227 
5228 static gap_security_level_t l2cap_cbm_security_level_for_connection(hci_con_handle_t con_handle){
5229     uint8_t encryption_key_size = gap_encryption_key_size(con_handle);
5230     if (encryption_key_size == 0) return LEVEL_0;
5231 
5232     bool authenticated = gap_authenticated(con_handle);
5233     if (!authenticated) return LEVEL_2;
5234 
5235     return encryption_key_size == 16 ? LEVEL_4 : LEVEL_3;
5236 }
5237 
5238 // used to handle pairing complete after triggering to increase
5239 static void l2cap_cbm_sm_packet_handler(uint8_t packet_type, uint16_t channel_nr, uint8_t *packet, uint16_t size) {
5240     UNUSED(channel_nr);
5241     UNUSED(size);
5242     UNUSED(packet_type);
5243     btstack_assert(packet_type == HCI_EVENT_PACKET);
5244     if (hci_event_packet_get_type(packet) != SM_EVENT_PAIRING_COMPLETE) return;
5245     hci_con_handle_t con_handle = sm_event_pairing_complete_get_handle(packet);
5246     btstack_linked_list_iterator_t it;
5247     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5248     while (btstack_linked_list_iterator_has_next(&it)) {
5249         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5250         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5251         if (channel->con_handle != con_handle) continue;
5252         if (channel->state != L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE) continue;
5253 
5254         // found channel, check security level
5255         if (l2cap_cbm_security_level_for_connection(con_handle) < channel->required_security_level){
5256             // pairing failed or wasn't good enough, inform user
5257             l2cap_cbm_emit_channel_opened(channel, ERROR_CODE_INSUFFICIENT_SECURITY);
5258             // discard channel
5259             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
5260             l2cap_free_channel_entry(channel);
5261         } else {
5262             // send conn request now
5263             channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5264             l2cap_run();
5265         }
5266     }
5267 }
5268 
5269 uint8_t l2cap_cbm_create_channel(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
5270     uint16_t psm, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits, gap_security_level_t security_level,
5271     uint16_t * out_local_cid) {
5272 
5273     static btstack_packet_callback_registration_t sm_event_callback_registration;
5274     static bool sm_callback_registered = false;
5275 
5276     log_info("create, handle 0x%04x psm 0x%x mtu %u", con_handle, psm, mtu);
5277 
5278     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5279     if (!connection) {
5280         log_error("no hci_connection for handle 0x%04x", con_handle);
5281         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5282     }
5283 
5284     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_CHANNEL_CBM, connection->address, connection->address_type, psm, mtu, security_level);
5285     if (!channel) {
5286         return BTSTACK_MEMORY_ALLOC_FAILED;
5287     }
5288     log_info("created %p", channel);
5289 
5290     // store local_cid
5291     if (out_local_cid){
5292        *out_local_cid = channel->local_cid;
5293     }
5294 
5295     // setup channel entry
5296     channel->con_handle = con_handle;
5297     channel->receive_sdu_buffer = receive_sdu_buffer;
5298     channel->new_credits_incoming = initial_credits;
5299     channel->automatic_credits    = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5300 
5301     // add to connections list
5302     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
5303 
5304     // check security level
5305     if (l2cap_cbm_security_level_for_connection(con_handle) < channel->required_security_level){
5306         if (!sm_callback_registered){
5307             sm_callback_registered = true;
5308             // lazy registration for SM events
5309             sm_event_callback_registration.callback = &l2cap_cbm_sm_packet_handler;
5310             sm_add_event_handler(&sm_event_callback_registration);
5311         }
5312 
5313         // start pairing
5314         channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
5315         sm_request_pairing(con_handle);
5316     } else {
5317         // send conn request right away
5318         channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5319         l2cap_run();
5320     }
5321 
5322     return ERROR_CODE_SUCCESS;
5323 }
5324 
5325 uint8_t l2cap_cbm_provide_credits(uint16_t local_cid, uint16_t credits){
5326     return l2cap_credit_based_provide_credits(local_cid, credits);
5327 }
5328 #endif
5329 
5330 #ifdef ENABLE_L2CAP_ENHANCED_CREDIT_BASED_FLOW_CONTROL_MODE
5331 
5332 uint8_t l2cap_ecbm_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, uint16_t min_remote_mtu, gap_security_level_t security_level){
5333 
5334     // check for already registered psm
5335     l2cap_service_t *service = l2cap_cbm_get_service(psm);
5336     if (service) {
5337         return L2CAP_SERVICE_ALREADY_REGISTERED;
5338     }
5339 
5340     // alloc structure
5341     service = btstack_memory_l2cap_service_get();
5342     if (!service) {
5343         log_error("register: no memory for l2cap_service_t");
5344         return BTSTACK_MEMORY_ALLOC_FAILED;
5345     }
5346 
5347     // fill in
5348     service->psm = psm;
5349     service->mtu = min_remote_mtu;
5350     service->packet_handler = packet_handler;
5351     service->required_security_level = security_level;
5352 
5353     // add to services list
5354     btstack_linked_list_add(&l2cap_enhanced_services, (btstack_linked_item_t *) service);
5355 
5356     // done
5357     return ERROR_CODE_SUCCESS;
5358 }
5359 
5360 uint8_t l2cap_ecbm_unregister_service(uint16_t psm) {
5361     l2cap_service_t *service = l2cap_cbm_get_service(psm);
5362     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
5363 
5364     btstack_linked_list_remove(&l2cap_enhanced_services, (btstack_linked_item_t *) service);
5365     btstack_memory_l2cap_service_free(service);
5366     return ERROR_CODE_SUCCESS;
5367 }
5368 
5369 void l2cap_ecbm_mps_set_min(uint16_t mps_min){
5370     l2cap_enhanced_mps_min = mps_min;
5371 }
5372 
5373 void l2cap_ecbm_mps_set_max(uint16_t mps_max){
5374     l2cap_enhanced_mps_max = mps_max;
5375 }
5376 
5377 uint8_t l2cap_ecbm_create_channels(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
5378                                        gap_security_level_t security_level,
5379                                        uint16_t psm, uint8_t num_channels, uint16_t initial_credits, uint16_t mtu,
5380                                        uint8_t ** receive_sdu_buffers, uint16_t * out_local_cid){
5381 
5382     log_info("create enhanced, handle 0x%04x psm 0x%x mtu %u", con_handle, psm, mtu);
5383 
5384     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5385     if (!connection) {
5386         log_error("no hci_connection for handle 0x%04x", con_handle);
5387         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5388     }
5389 
5390     // setup all channels
5391     btstack_linked_list_t channels = NULL;
5392     uint8_t status = l2cap_ecbm_setup_channels(&channels, packet_handler, num_channels, connection, psm, mtu,
5393                                                security_level);
5394     uint16_t local_mps = btstack_min(l2cap_enhanced_mps_max, btstack_min(l2cap_max_le_mtu(), mtu));
5395 
5396     // add to connections list and set state + local_sig_id
5397     l2cap_channel_t * channel;
5398     uint8_t i = 0;
5399     uint8_t local_sig_id = l2cap_next_sig_id();
5400     while (true) {
5401         channel = (l2cap_channel_t *) btstack_linked_list_pop(&channels);
5402         if (channel == NULL) break;
5403         channel->state              = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST;
5404         channel->local_sig_id       = local_sig_id;
5405         channel->local_mps = local_mps;
5406         channel->cid_index = i;
5407         channel->num_cids = num_channels;
5408         channel->credits_incoming   = initial_credits;
5409         channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5410         channel->receive_sdu_buffer = receive_sdu_buffers[i];
5411         // store local_cid
5412         if (out_local_cid){
5413             out_local_cid[i] = channel->local_cid;
5414         }
5415         btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
5416         i++;
5417     }
5418 
5419 #if 0
5420     // check security level
5421     if (l2cap_le_security_level_for_connection(con_handle) < channel->required_security_level){
5422         if (!sm_callback_registered){
5423             sm_callback_registered = true;
5424             // lazy registration for SM events
5425             sm_event_callback_registration.callback = &l2cap_sm_packet_handler;
5426             sm_add_event_handler(&sm_event_callback_registration);
5427         }
5428 
5429         // start pairing
5430         channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
5431         sm_request_pairing(con_handle);
5432     } else {
5433         // send conn request right away
5434         channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5435         l2cap_run();
5436     }
5437 #endif
5438 
5439     l2cap_run();
5440 
5441     return status;
5442 }
5443 
5444 uint8_t l2cap_ecbm_accept_channels(uint16_t local_cid, uint8_t num_channels, uint16_t initial_credits,
5445                                             uint16_t receive_buffer_size, uint8_t ** receive_buffers, uint16_t * out_local_cids){
5446 
5447     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5448     if (!channel) {
5449 
5450         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5451     }
5452 
5453     uint16_t local_mps = btstack_min(l2cap_enhanced_mps_max, btstack_min(l2cap_max_le_mtu(), receive_buffer_size));
5454 
5455     //
5456     hci_con_handle_t  con_handle    = channel->con_handle;
5457     uint8_t           local_sig_id  = channel->local_sig_id;
5458     uint8_t           channel_index = 0;
5459     btstack_linked_list_iterator_t it;
5460     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5461     while (btstack_linked_list_iterator_has_next(&it)) {
5462         channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5463         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5464         if (channel->con_handle != con_handle) continue;
5465         if (channel->local_sig_id != local_sig_id) continue;
5466         if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT) continue;
5467 
5468         if (channel_index < num_channels){
5469             // assign buffer and cid
5470             out_local_cids[channel_index] = channel->local_cid;
5471             channel->receive_sdu_buffer = receive_buffers[channel_index];
5472             channel->local_mtu = receive_buffer_size;
5473             channel->local_mps = local_mps;
5474             channel->credits_incoming   = initial_credits;
5475             channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5476             channel_index++;
5477         } else {
5478             // clear local cid for response packet
5479             channel->local_cid = 0;
5480             channel->reason = L2CAP_ECBM_CONNECTION_RESULT_SOME_REFUSED_INSUFFICIENT_RESOURCES_AVAILABLE;
5481         }
5482         // update state
5483         channel->state = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE;
5484     }
5485     l2cap_run_trigger();
5486     return ERROR_CODE_SUCCESS;
5487 }
5488 
5489 uint8_t l2cap_ecbm_decline_channels(uint16_t local_cid, uint16_t result){
5490     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5491     if (!channel) {
5492         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5493     }
5494     //
5495     hci_con_handle_t  con_handle    = channel->con_handle;
5496     uint8_t           local_sig_id  = channel->local_sig_id;
5497     btstack_linked_list_iterator_t it;
5498     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5499     while (btstack_linked_list_iterator_has_next(&it)) {
5500         channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5501         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5502         if (channel->con_handle != con_handle) continue;
5503         if (channel->local_sig_id != local_sig_id) continue;
5504         if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT) continue;
5505 
5506         // prepare response
5507         channel->local_cid = 0;
5508         channel->reason = result;
5509         channel->state = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE;
5510     }
5511     l2cap_run_trigger();
5512     return ERROR_CODE_SUCCESS;
5513 }
5514 
5515 uint8_t l2cap_ecbm_reconfigure_channels(uint8_t num_cids, uint16_t * local_cids, int16_t receive_buffer_size, uint8_t ** receive_buffers){
5516     btstack_assert(receive_buffers != NULL);
5517     btstack_assert(local_cids != NULL);
5518 
5519     if (num_cids > L2CAP_ECBM_MAX_CID_ARRAY_SIZE){
5520         return ERROR_CODE_UNACCEPTABLE_CONNECTION_PARAMETERS;
5521     }
5522 
5523     // check if all cids exist and have the same con handle
5524     uint8_t i;
5525     hci_con_handle_t con_handle = HCI_CON_HANDLE_INVALID;
5526     for (i = 0 ; i < num_cids ; i++){
5527         l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cids[i]);
5528         if (!channel) {
5529             return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5530         }
5531         if (channel->state != L2CAP_STATE_OPEN){
5532             return ERROR_CODE_COMMAND_DISALLOWED;
5533         }
5534         if (con_handle == HCI_CON_HANDLE_INVALID){
5535             con_handle = channel->con_handle;
5536         } else if (con_handle != channel->con_handle){
5537             return ERROR_CODE_UNACCEPTABLE_CONNECTION_PARAMETERS;
5538         }
5539     }
5540     // set renegotiation data and state
5541     uint8_t sig_id = l2cap_next_sig_id();
5542     for (i = 0 ; i < num_cids ; i++){
5543         l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cids[i]);
5544         channel->cid_index = i;
5545         channel->num_cids = num_cids;
5546         channel->local_sig_id = sig_id;
5547         channel->renegotiate_mtu = receive_buffer_size;
5548         channel->renegotiate_sdu_buffer = receive_buffers[i];
5549         channel->state = L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST;
5550     }
5551 
5552 
5553     l2cap_run();
5554     return ERROR_CODE_SUCCESS;
5555 }
5556 
5557 uint8_t l2cap_ecbm_provide_credits(uint16_t local_cid, uint16_t credits){
5558     return l2cap_credit_based_provide_credits(local_cid, credits);
5559 }
5560 #endif
5561 
5562 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
5563 // @deprecated - please use l2cap_ertm_create_channel
5564 uint8_t l2cap_create_ertm_channel(btstack_packet_handler_t packet_handler, bd_addr_t address, uint16_t psm,
5565                                   l2cap_ertm_config_t * ertm_contig, uint8_t * buffer, uint32_t size, uint16_t * out_local_cid){
5566     log_error("deprecated - please use l2cap_ertm_create_channel");
5567     return l2cap_ertm_create_channel(packet_handler, address, psm, ertm_contig, buffer, size, out_local_cid);
5568 };
5569 
5570 // @deprecated - please use l2cap_ertm_accept_connection
5571 uint8_t l2cap_accept_ertm_connection(uint16_t local_cid, l2cap_ertm_config_t * ertm_contig, uint8_t * buffer, uint32_t size){
5572     log_error("deprecated - please use l2cap_ertm_accept_connection");
5573     return l2cap_ertm_accept_connection(local_cid, ertm_contig, buffer, size);
5574 }
5575 #endif
5576 
5577 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
5578 // @deprecated - please use l2cap_cbm_register_service
5579 uint8_t l2cap_le_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, gap_security_level_t security_level){
5580     log_error("deprecated - please use l2cap_cbm_register_service");
5581     return l2cap_cbm_register_service(packet_handler, psm, security_level);
5582 }
5583 
5584 // @deprecated - please use l2cap_cbm_unregister_service
5585 uint8_t l2cap_le_unregister_service(uint16_t psm){
5586     log_error("deprecated - please use l2cap_cbm_unregister_service");
5587     return l2cap_cbm_unregister_service(psm);
5588 }
5589 
5590 // @deprecated - please use l2cap_cbm_accept_connection
5591 uint8_t l2cap_le_accept_connection(uint16_t local_cid, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits){
5592     log_error("deprecated - please use l2cap_cbm_accept_connection");
5593     return l2cap_cbm_accept_connection(local_cid, receive_sdu_buffer, mtu, initial_credits);
5594 }
5595 
5596 // @deprecated - please use l2cap_cbm_decline_connection
5597 uint8_t l2cap_le_decline_connection(uint16_t local_cid){
5598     log_error("deprecated - please use l2cap_cbm_decline_connection");
5599     return l2cap_cbm_decline_connection(local_cid, L2CAP_CBM_CONNECTION_RESULT_NO_RESOURCES_AVAILABLE);
5600 }
5601 
5602 // @deprecated - please use l2cap_cbm_create_channel
5603 uint8_t l2cap_le_create_channel(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
5604                                 uint16_t psm, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits, gap_security_level_t security_level,
5605                                 uint16_t * out_local_cid){
5606     log_error("deprecated - please use l2cap_cbm_create_channel");
5607     return l2cap_cbm_create_channel(packet_handler, con_handle, psm, receive_sdu_buffer, mtu, initial_credits, security_level, out_local_cid);
5608 }
5609 
5610 // @deprecated - please use l2cap_cbm_provide_credits
5611 uint8_t l2cap_le_provide_credits(uint16_t local_cid, uint16_t credits){
5612     log_error("deprecated - please use l2cap_cbm_provide_credits");
5613     return l2cap_cbm_provide_credits(local_cid, credits);
5614 }
5615 
5616 // @deprecated - please use l2cap_can_send_packet_now
5617 bool l2cap_le_can_send_now(uint16_t local_cid){
5618     log_error("deprecated - please use l2cap_can_send_packet_now");
5619     return l2cap_can_send_packet_now(local_cid);
5620 }
5621 
5622 // @deprecated - please use l2cap_request_can_send_now_event
5623 uint8_t l2cap_le_request_can_send_now_event(uint16_t local_cid){
5624     log_error("deprecated - please use l2cap_request_can_send_now_event");
5625     return l2cap_request_can_send_now_event(local_cid);
5626 }
5627 
5628 // @deprecated - please use l2cap_cbm_send_data
5629 uint8_t l2cap_le_send_data(uint16_t local_cid, const uint8_t * data, uint16_t size){
5630     log_error("deprecated - please use l2cap_cbm_send_data");
5631     return l2cap_send(local_cid, data, size);
5632 }
5633 
5634 // @deprecated - please use l2cap_disconnect
5635 uint8_t l2cap_le_disconnect(uint16_t local_cid){
5636     log_error("deprecated - please use l2cap_disconnect");
5637     return l2cap_disconnect(local_cid);
5638 }
5639 #endif
5640