xref: /btstack/src/l2cap.c (revision ad67156049bb89d399216ad8ea5b1a0d0d231258)
1 /*
2  * Copyright (C) 2009-2012 by Matthias Ringwald
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY MATTHIAS RINGWALD AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at [email protected]
34  *
35  */
36 
37 /*
38  *  l2cap.c
39  *
40  *  Logical Link Control and Adaption Protocl (L2CAP)
41  *
42  *  Created by Matthias Ringwald on 5/16/09.
43  */
44 
45 #include "l2cap.h"
46 #include "hci.h"
47 #include "hci_dump.h"
48 #include "debug.h"
49 #include "btstack_memory.h"
50 
51 #include <stdarg.h>
52 #include <string.h>
53 
54 #include <stdio.h>
55 
56 // nr of buffered acl packets in outgoing queue to get max performance
57 #define NR_BUFFERED_ACL_PACKETS 3
58 
59 // used to cache l2cap rejects, echo, and informational requests
60 #define NR_PENDING_SIGNALING_RESPONSES 3
61 
62 // offsets for L2CAP SIGNALING COMMANDS
63 #define L2CAP_SIGNALING_COMMAND_CODE_OFFSET   0
64 #define L2CAP_SIGNALING_COMMAND_SIGID_OFFSET  1
65 #define L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET 2
66 #define L2CAP_SIGNALING_COMMAND_DATA_OFFSET   4
67 
68 static void null_packet_handler(void * connection, uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
69 static void l2cap_packet_handler(uint8_t packet_type, uint8_t *packet, uint16_t size);
70 
71 // used to cache l2cap rejects, echo, and informational requests
72 static l2cap_signaling_response_t signaling_responses[NR_PENDING_SIGNALING_RESPONSES];
73 static int signaling_responses_pending;
74 
75 static linked_list_t l2cap_channels = NULL;
76 static linked_list_t l2cap_services = NULL;
77 static void (*packet_handler) (void * connection, uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size) = null_packet_handler;
78 static int new_credits_blocked = 0;
79 
80 static btstack_packet_handler_t attribute_protocol_packet_handler = NULL;
81 static btstack_packet_handler_t security_protocol_packet_handler = NULL;
82 
83 // prototypes
84 static void l2cap_finialize_channel_close(l2cap_channel_t *channel);
85 static l2cap_service_t * l2cap_get_service(uint16_t psm);
86 static void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
87 static void l2cap_emit_channel_closed(l2cap_channel_t *channel);
88 static void l2cap_emit_connection_request(l2cap_channel_t *channel);
89 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel);
90 
91 
92 void l2cap_init(){
93     new_credits_blocked = 0;
94     signaling_responses_pending = 0;
95 
96     l2cap_channels = NULL;
97     l2cap_services = NULL;
98 
99     packet_handler = null_packet_handler;
100 
101     //
102     // register callback with HCI
103     //
104     hci_register_packet_handler(&l2cap_packet_handler);
105     hci_connectable_control(0); // no services yet
106 }
107 
108 
109 /** Register L2CAP packet handlers */
110 static void null_packet_handler(void * connection, uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
111 }
112 void l2cap_register_packet_handler(void (*handler)(void * connection, uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size)){
113     packet_handler = handler;
114 }
115 
116 //  notify client/protocol handler
117 void l2cap_dispatch(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size){
118     if (channel->packet_handler) {
119         (* (channel->packet_handler))(type, channel->local_cid, data, size);
120     } else {
121         (*packet_handler)(channel->connection, type, channel->local_cid, data, size);
122     }
123 }
124 
125 void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
126     log_info("L2CAP_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u, flush_timeout %u",
127              status, bd_addr_to_str(channel->address), channel->handle, channel->psm,
128              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu, channel->flush_timeout);
129     uint8_t event[23];
130     event[0] = L2CAP_EVENT_CHANNEL_OPENED;
131     event[1] = sizeof(event) - 2;
132     event[2] = status;
133     bt_flip_addr(&event[3], channel->address);
134     bt_store_16(event,  9, channel->handle);
135     bt_store_16(event, 11, channel->psm);
136     bt_store_16(event, 13, channel->local_cid);
137     bt_store_16(event, 15, channel->remote_cid);
138     bt_store_16(event, 17, channel->local_mtu);
139     bt_store_16(event, 19, channel->remote_mtu);
140     bt_store_16(event, 19, channel->flush_timeout);
141     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
142     l2cap_dispatch(channel, HCI_EVENT_PACKET, event, sizeof(event));
143 }
144 
145 void l2cap_emit_channel_closed(l2cap_channel_t *channel) {
146     log_info("L2CAP_EVENT_CHANNEL_CLOSED local_cid 0x%x", channel->local_cid);
147     uint8_t event[4];
148     event[0] = L2CAP_EVENT_CHANNEL_CLOSED;
149     event[1] = sizeof(event) - 2;
150     bt_store_16(event, 2, channel->local_cid);
151     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
152     l2cap_dispatch(channel, HCI_EVENT_PACKET, event, sizeof(event));
153 }
154 
155 void l2cap_emit_connection_request(l2cap_channel_t *channel) {
156     log_info("L2CAP_EVENT_INCOMING_CONNECTION addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x",
157              bd_addr_to_str(channel->address), channel->handle,  channel->psm, channel->local_cid, channel->remote_cid);
158     uint8_t event[16];
159     event[0] = L2CAP_EVENT_INCOMING_CONNECTION;
160     event[1] = sizeof(event) - 2;
161     bt_flip_addr(&event[2], channel->address);
162     bt_store_16(event,  8, channel->handle);
163     bt_store_16(event, 10, channel->psm);
164     bt_store_16(event, 12, channel->local_cid);
165     bt_store_16(event, 14, channel->remote_cid);
166     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
167     l2cap_dispatch(channel, HCI_EVENT_PACKET, event, sizeof(event));
168 }
169 
170 static void l2cap_emit_service_registered(void *connection, uint8_t status, uint16_t psm){
171     log_info("L2CAP_EVENT_SERVICE_REGISTERED status 0x%x psm 0x%x", status, psm);
172     uint8_t event[5];
173     event[0] = L2CAP_EVENT_SERVICE_REGISTERED;
174     event[1] = sizeof(event) - 2;
175     event[2] = status;
176     bt_store_16(event, 3, psm);
177     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
178     (*packet_handler)(connection, HCI_EVENT_PACKET, 0, event, sizeof(event));
179 }
180 
181 void l2cap_emit_credits(l2cap_channel_t *channel, uint8_t credits) {
182 
183     log_info("L2CAP_EVENT_CREDITS local_cid 0x%x credits %u", channel->local_cid, credits);
184     // track credits
185     channel->packets_granted += credits;
186 
187     uint8_t event[5];
188     event[0] = L2CAP_EVENT_CREDITS;
189     event[1] = sizeof(event) - 2;
190     bt_store_16(event, 2, channel->local_cid);
191     event[4] = credits;
192     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
193     l2cap_dispatch(channel, HCI_EVENT_PACKET, event, sizeof(event));
194 }
195 
196 void l2cap_block_new_credits(uint8_t blocked){
197     new_credits_blocked = blocked;
198 }
199 
200 void l2cap_hand_out_credits(void){
201 
202     if (new_credits_blocked) return;    // we're told not to. used by daemon
203 
204     linked_item_t *it;
205     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
206         if (!hci_number_free_acl_slots()) return;
207         l2cap_channel_t * channel = (l2cap_channel_t *) it;
208         if (channel->state != L2CAP_STATE_OPEN) continue;
209         if (hci_number_outgoing_packets(channel->handle) < NR_BUFFERED_ACL_PACKETS && channel->packets_granted == 0) {
210             l2cap_emit_credits(channel, 1);
211         }
212     }
213 }
214 
215 l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid){
216     linked_item_t *it;
217     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
218         l2cap_channel_t * channel = (l2cap_channel_t *) it;
219         if ( channel->local_cid == local_cid) {
220             return channel;
221         }
222     }
223     return NULL;
224 }
225 
226 int  l2cap_can_send_packet_now(uint16_t local_cid){
227     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
228     if (!channel) return 0;
229     if (!channel->packets_granted) return 0;
230     return hci_can_send_packet_now(HCI_ACL_DATA_PACKET);
231 }
232 
233 uint16_t l2cap_get_remote_mtu_for_local_cid(uint16_t local_cid){
234     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
235     if (channel) {
236         return channel->remote_mtu;
237     }
238     return 0;
239 }
240 
241 static l2cap_channel_t * l2cap_channel_for_rtx_timer(timer_source_t * ts){
242     linked_item_t *it;
243     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
244         l2cap_channel_t * channel = (l2cap_channel_t *) it;
245         if ( &channel->rtx == ts) {
246             return channel;
247         }
248     }
249     return NULL;
250 }
251 
252 static void l2cap_rtx_timeout(timer_source_t * ts){
253     l2cap_channel_t * channel = l2cap_channel_for_rtx_timer(ts);
254     if (!ts) return;
255 
256     log_info("l2cap_rtx_timeout for local cid 0x%02x", channel->local_cid);
257 
258     // "When terminating the channel, it is not necessary to send a L2CAP_DisconnectReq
259     //  and enter WAIT_DISCONNECT state. Channels can be transitioned directly to the CLOSED state."
260     // notify client
261     l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_RTX_TIMEOUT);
262 
263     // discard channel
264     linked_list_remove(&l2cap_channels, (linked_item_t *) channel);
265     btstack_memory_l2cap_channel_free(channel);
266 }
267 
268 static void l2cap_stop_rtx(l2cap_channel_t * channel){
269     log_info("l2cap_stop_rtx for local cid 0x%02x", channel->local_cid);
270     run_loop_remove_timer(&channel->rtx);
271 }
272 
273 static void l2cap_start_rtx(l2cap_channel_t * channel){
274     log_info("l2cap_start_rtx for local cid 0x%02x", channel->local_cid);
275     l2cap_stop_rtx(channel);
276     run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
277     run_loop_set_timer(&channel->rtx, L2CAP_RTX_TIMEOUT_MS);
278     run_loop_add_timer(&channel->rtx);
279 }
280 
281 static void l2cap_start_ertx(l2cap_channel_t * channel){
282     log_info("l2cap_start_ertx for local cid 0x%02x", channel->local_cid);
283     l2cap_stop_rtx(channel);
284     run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
285     run_loop_set_timer(&channel->rtx, L2CAP_ERTX_TIMEOUT_MS);
286     run_loop_add_timer(&channel->rtx);
287 }
288 
289 
290 int l2cap_send_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, uint8_t identifier, ...){
291 
292     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
293         log_info("l2cap_send_signaling_packet, cannot send\n");
294         return BTSTACK_ACL_BUFFERS_FULL;
295     }
296 
297     // log_info("l2cap_send_signaling_packet type %u\n", cmd);
298     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
299     va_list argptr;
300     va_start(argptr, identifier);
301     uint16_t len = l2cap_create_signaling_internal(acl_buffer, handle, cmd, identifier, argptr);
302     va_end(argptr);
303     // log_info("l2cap_send_signaling_packet con %u!\n", handle);
304     return hci_send_acl_packet(acl_buffer, len);
305 }
306 
307 uint8_t *l2cap_get_outgoing_buffer(void){
308     return hci_get_outgoing_acl_packet_buffer() + COMPLETE_L2CAP_HEADER; // 8 bytes
309 }
310 
311 int l2cap_send_prepared(uint16_t local_cid, uint16_t len){
312 
313     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
314         log_info("l2cap_send_internal cid 0x%02x, cannot send\n", local_cid);
315         return BTSTACK_ACL_BUFFERS_FULL;
316     }
317 
318     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
319     if (!channel) {
320         log_error("l2cap_send_internal no channel for cid 0x%02x\n", local_cid);
321         return -1;   // TODO: define error
322     }
323 
324     if (channel->packets_granted == 0){
325         log_error("l2cap_send_internal cid 0x%02x, no credits!\n", local_cid);
326         return -1;  // TODO: define error
327     }
328 
329     --channel->packets_granted;
330 
331     log_debug("l2cap_send_internal cid 0x%02x, handle %u, 1 credit used, credits left %u;\n",
332                   local_cid, channel->handle, channel->packets_granted);
333 
334     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
335 
336     // 0 - Connection handle : PB=10 : BC=00
337     bt_store_16(acl_buffer, 0, channel->handle | (2 << 12) | (0 << 14));
338     // 2 - ACL length
339     bt_store_16(acl_buffer, 2,  len + 4);
340     // 4 - L2CAP packet length
341     bt_store_16(acl_buffer, 4,  len + 0);
342     // 6 - L2CAP channel DEST
343     bt_store_16(acl_buffer, 6, channel->remote_cid);
344     // send
345     int err = hci_send_acl_packet(acl_buffer, len+8);
346 
347     l2cap_hand_out_credits();
348 
349     return err;
350 }
351 
352 int l2cap_send_prepared_connectionless(uint16_t handle, uint16_t cid, uint16_t len){
353 
354     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
355         log_info("l2cap_send_prepared_to_handle cid 0x%02x, cannot send\n", cid);
356         return BTSTACK_ACL_BUFFERS_FULL;
357     }
358 
359     log_debug("l2cap_send_prepared_to_handle cid 0x%02x, handle %u\n", cid, handle);
360 
361     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
362 
363     // 0 - Connection handle : PB=10 : BC=00
364     bt_store_16(acl_buffer, 0, handle | (2 << 12) | (0 << 14));
365     // 2 - ACL length
366     bt_store_16(acl_buffer, 2,  len + 4);
367     // 4 - L2CAP packet length
368     bt_store_16(acl_buffer, 4,  len + 0);
369     // 6 - L2CAP channel DEST
370     bt_store_16(acl_buffer, 6, cid);
371     // send
372     int err = hci_send_acl_packet(acl_buffer, len+8);
373 
374     l2cap_hand_out_credits();
375 
376     return err;
377 }
378 
379 int l2cap_send_internal(uint16_t local_cid, uint8_t *data, uint16_t len){
380 
381     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
382         log_info("l2cap_send_internal cid 0x%02x, cannot send\n", local_cid);
383         return BTSTACK_ACL_BUFFERS_FULL;
384     }
385 
386     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
387 
388     memcpy(&acl_buffer[8], data, len);
389 
390     return l2cap_send_prepared(local_cid, len);
391 }
392 
393 int l2cap_send_connectionless(uint16_t handle, uint16_t cid, uint8_t *data, uint16_t len){
394 
395     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
396         log_info("l2cap_send_internal cid 0x%02x, cannot send\n", cid);
397         return BTSTACK_ACL_BUFFERS_FULL;
398     }
399 
400     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
401 
402     memcpy(&acl_buffer[8], data, len);
403 
404     return l2cap_send_prepared_connectionless(handle, cid, len);
405 }
406 
407 static inline void channelStateVarSetFlag(l2cap_channel_t *channel, L2CAP_CHANNEL_STATE_VAR flag){
408     channel->state_var = (L2CAP_CHANNEL_STATE_VAR) (channel->state_var | flag);
409 }
410 
411 static inline void channelStateVarClearFlag(l2cap_channel_t *channel, L2CAP_CHANNEL_STATE_VAR flag){
412     channel->state_var = (L2CAP_CHANNEL_STATE_VAR) (channel->state_var & ~flag);
413 }
414 
415 
416 
417 // MARK: L2CAP_RUN
418 // process outstanding signaling tasks
419 void l2cap_run(void){
420 
421     // check pending signaling responses
422     while (signaling_responses_pending){
423 
424         if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)) break;
425 
426         hci_con_handle_t handle = signaling_responses[0].handle;
427         uint8_t sig_id = signaling_responses[0].sig_id;
428         uint16_t infoType = signaling_responses[0].data;    // INFORMATION_REQUEST
429         uint16_t result   = signaling_responses[0].data;    // CONNECTION_REQUEST, COMMAND_REJECT
430 
431         switch (signaling_responses[0].code){
432             case CONNECTION_REQUEST:
433                 l2cap_send_signaling_packet(handle, CONNECTION_RESPONSE, sig_id, 0, 0, result, 0);
434                 break;
435             case ECHO_REQUEST:
436                 l2cap_send_signaling_packet(handle, ECHO_RESPONSE, sig_id, 0, NULL);
437                 break;
438             case INFORMATION_REQUEST:
439                 switch (infoType){
440                     case 1: { // Connectionless MTU
441                         uint16_t connectionless_mtu = hci_max_acl_data_packet_length();
442                         l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(connectionless_mtu), &connectionless_mtu);
443                         break;
444                     }
445                     case 2: { // Extended Features Supported
446                         // extended features request supported, only supporing fixed channel map
447                         uint32_t features = 0x80;
448                         l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(features), &features);
449                         break;
450                     }
451                     case 3: { // Fixed Channels Supported
452                         uint8_t map[8];
453                         memset(map, 0, 8);
454                         map[0] = 0x01;  // L2CAP Signaling Channel
455                         l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 0, sizeof(map), &map);
456                         break;
457                     }
458                     default:
459                         // all other types are not supported
460                         l2cap_send_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, infoType, 1, 0, NULL);
461                         break;
462                 }
463                 break;
464             case COMMAND_REJECT:
465                 l2cap_send_signaling_packet(handle, COMMAND_REJECT, sig_id, result);
466                 break;
467             default:
468                 // should not happen
469                 break;
470         }
471 
472         // remove first item
473         signaling_responses_pending--;
474         int i;
475         for (i=0; i < signaling_responses_pending; i++){
476             memcpy(&signaling_responses[i], &signaling_responses[i+1], sizeof(l2cap_signaling_response_t));
477         }
478     }
479 
480     uint8_t  config_options[4];
481     linked_item_t *it;
482     linked_item_t *next;
483     for (it = (linked_item_t *) l2cap_channels; it ; it = next){
484         next = it->next;    // cache next item as current item might get freed
485 
486         if (!hci_can_send_packet_now(HCI_COMMAND_DATA_PACKET)) break;
487         if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)) break;
488 
489         l2cap_channel_t * channel = (l2cap_channel_t *) it;
490 
491         // log_info("l2cap_run: state %u, var 0x%02x\n", channel->state, channel->state_var);
492 
493 
494         switch (channel->state){
495 
496             case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
497                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND) {
498                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND);
499                     l2cap_send_signaling_packet(channel->handle, CONNECTION_RESPONSE, channel->remote_sig_id, 0, 0, 1, 0);
500                 }
501                 break;
502 
503             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
504                 // send connection request - set state first
505                 channel->state = L2CAP_STATE_WAIT_CONNECTION_COMPLETE;
506                 // BD_ADDR, Packet_Type, Page_Scan_Repetition_Mode, Reserved, Clock_Offset, Allow_Role_Switch
507                 hci_send_cmd(&hci_create_connection, channel->address, hci_usable_acl_packet_types(), 0, 0, 0, 1);
508                 break;
509 
510             case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
511                 l2cap_send_signaling_packet(channel->handle, CONNECTION_RESPONSE, channel->remote_sig_id, 0, 0, channel->reason, 0);
512                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
513                 linked_list_remove(&l2cap_channels, (linked_item_t *) channel); // -- remove from list
514                 btstack_memory_l2cap_channel_free(channel);
515                 break;
516 
517             case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
518                 channel->state = L2CAP_STATE_CONFIG;
519                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
520                 l2cap_send_signaling_packet(channel->handle, CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid, 0, 0);
521                 break;
522 
523             case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
524                 // success, start l2cap handshake
525                 channel->local_sig_id = l2cap_next_sig_id();
526                 channel->state = L2CAP_STATE_WAIT_CONNECT_RSP;
527                 l2cap_send_signaling_packet( channel->handle, CONNECTION_REQUEST, channel->local_sig_id, channel->psm, channel->local_cid);
528                 l2cap_start_rtx(channel);
529                 break;
530 
531             case L2CAP_STATE_CONFIG:
532                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP){
533                     uint16_t flags = 0;
534                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
535                     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT) {
536                         flags = 1;
537                     } else {
538                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
539                     }
540                     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID){
541                         l2cap_send_signaling_packet(channel->handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, L2CAP_CONF_RESULT_UNKNOWN_OPTIONS, 0, NULL);
542                     } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU){
543                         config_options[0] = 1; // MTU
544                         config_options[1] = 2; // len param
545                         bt_store_16( (uint8_t*)&config_options, 2, channel->remote_mtu);
546                         l2cap_send_signaling_packet(channel->handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, 0, 4, &config_options);
547                         channelStateVarClearFlag(channel,L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
548                     } else {
549                         l2cap_send_signaling_packet(channel->handle, CONFIGURE_RESPONSE, channel->remote_sig_id, channel->remote_cid, flags, 0, 0, NULL);
550                     }
551                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
552                 }
553                 else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ){
554                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
555                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_REQ);
556                     channel->local_sig_id = l2cap_next_sig_id();
557                     config_options[0] = 1; // MTU
558                     config_options[1] = 2; // len param
559                     bt_store_16( (uint8_t*)&config_options, 2, channel->local_mtu);
560                     l2cap_send_signaling_packet(channel->handle, CONFIGURE_REQUEST, channel->local_sig_id, channel->remote_cid, 0, 4, &config_options);
561                     l2cap_start_rtx(channel);
562                 }
563                 if (l2cap_channel_ready_for_open(channel)){
564                     channel->state = L2CAP_STATE_OPEN;
565                     l2cap_emit_channel_opened(channel, 0);  // success
566                     l2cap_emit_credits(channel, 1);
567                 }
568                 break;
569 
570             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
571                 l2cap_send_signaling_packet( channel->handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
572                 // we don't start an RTX timer for a disconnect - there's no point in closing the channel if the other side doesn't respond :)
573                 l2cap_finialize_channel_close(channel);  // -- remove from list
574                 break;
575 
576             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
577                 channel->local_sig_id = l2cap_next_sig_id();
578                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
579                 l2cap_send_signaling_packet( channel->handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
580                 break;
581             default:
582                 break;
583         }
584     }
585 }
586 
587 uint16_t l2cap_max_mtu(void){
588     return hci_max_acl_data_packet_length() - L2CAP_HEADER_SIZE;
589 }
590 
591 // open outgoing L2CAP channel
592 void l2cap_create_channel_internal(void * connection, btstack_packet_handler_t packet_handler,
593                                    bd_addr_t address, uint16_t psm, uint16_t mtu){
594 
595     log_info("L2CAP_CREATE_CHANNEL_MTU addr %s psm 0x%x mtu %u", bd_addr_to_str(address), psm, mtu);
596 
597     // alloc structure
598     l2cap_channel_t * chan = (l2cap_channel_t*) btstack_memory_l2cap_channel_get();
599     if (!chan) {
600         // emit error event
601         l2cap_channel_t dummy_channel;
602         BD_ADDR_COPY(dummy_channel.address, address);
603         dummy_channel.psm = psm;
604         l2cap_emit_channel_opened(&dummy_channel, BTSTACK_MEMORY_ALLOC_FAILED);
605         return;
606     }
607     // limit local mtu to max acl packet length
608     if (mtu > l2cap_max_mtu()) {
609         mtu = l2cap_max_mtu();
610     }
611 
612     // fill in
613     BD_ADDR_COPY(chan->address, address);
614     chan->psm = psm;
615     chan->handle = 0;
616     chan->connection = connection;
617     chan->packet_handler = packet_handler;
618     chan->remote_mtu = L2CAP_MINIMAL_MTU;
619     chan->local_mtu = mtu;
620     chan->packets_granted = 0;
621 
622     // set initial state
623     chan->state = L2CAP_STATE_WILL_SEND_CREATE_CONNECTION;
624     chan->state_var = L2CAP_CHANNEL_STATE_VAR_NONE;
625     chan->remote_sig_id = L2CAP_SIG_ID_INVALID;
626     chan->local_sig_id = L2CAP_SIG_ID_INVALID;
627 
628     // add to connections list
629     linked_list_add(&l2cap_channels, (linked_item_t *) chan);
630 
631     l2cap_run();
632 }
633 
634 void l2cap_disconnect_internal(uint16_t local_cid, uint8_t reason){
635     log_info("L2CAP_DISCONNECT local_cid 0x%x reason 0x%x", local_cid, reason);
636     // find channel for local_cid
637     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
638     if (channel) {
639         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
640     }
641     // process
642     l2cap_run();
643 }
644 
645 static void l2cap_handle_connection_failed_for_addr(bd_addr_t address, uint8_t status){
646     linked_item_t *it = (linked_item_t *) &l2cap_channels;
647     while (it->next){
648         l2cap_channel_t * channel = (l2cap_channel_t *) it->next;
649         if ( ! BD_ADDR_CMP( channel->address, address) ){
650             if (channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE || channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION) {
651                 // failure, forward error code
652                 l2cap_emit_channel_opened(channel, status);
653                 // discard channel
654                 it->next = it->next->next;
655                 btstack_memory_l2cap_channel_free(channel);
656             }
657         } else {
658             it = it->next;
659         }
660     }
661 }
662 
663 static void l2cap_handle_connection_success_for_addr(bd_addr_t address, hci_con_handle_t handle){
664     linked_item_t *it;
665     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
666         l2cap_channel_t * channel = (l2cap_channel_t *) it;
667         if ( ! BD_ADDR_CMP( channel->address, address) ){
668             if (channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE || channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION) {
669                 // success, start l2cap handshake
670                 channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
671                 channel->handle = handle;
672                 channel->local_cid = l2cap_next_local_cid();
673             }
674         }
675     }
676     // process
677     l2cap_run();
678 }
679 
680 void l2cap_event_handler( uint8_t *packet, uint16_t size ){
681 
682     bd_addr_t address;
683     hci_con_handle_t handle;
684     l2cap_channel_t * channel;
685     linked_item_t *it;
686     int hci_con_used;
687 
688     switch(packet[0]){
689 
690         // handle connection complete events
691         case HCI_EVENT_CONNECTION_COMPLETE:
692             bt_flip_addr(address, &packet[5]);
693             if (packet[2] == 0){
694                 handle = READ_BT_16(packet, 3);
695                 l2cap_handle_connection_success_for_addr(address, handle);
696             } else {
697                 l2cap_handle_connection_failed_for_addr(address, packet[2]);
698             }
699             break;
700 
701         // handle successful create connection cancel command
702         case HCI_EVENT_COMMAND_COMPLETE:
703             if ( COMMAND_COMPLETE_EVENT(packet, hci_create_connection_cancel) ) {
704                 if (packet[5] == 0){
705                     bt_flip_addr(address, &packet[6]);
706                     // CONNECTION TERMINATED BY LOCAL HOST (0X16)
707                     l2cap_handle_connection_failed_for_addr(address, 0x16);
708                 }
709             }
710             l2cap_run();    // try sending signaling packets first
711             break;
712 
713         case HCI_EVENT_COMMAND_STATUS:
714             l2cap_run();    // try sending signaling packets first
715             break;
716 
717         // handle disconnection complete events
718         case HCI_EVENT_DISCONNECTION_COMPLETE:
719             // send l2cap disconnect events for all channels on this handle
720             handle = READ_BT_16(packet, 3);
721             it = (linked_item_t *) &l2cap_channels;
722             while (it->next){
723                 l2cap_channel_t * channel = (l2cap_channel_t *) it->next;
724                 if ( channel->handle == handle ){
725                     // update prev item before free'ing next element - don't call l2cap_finalize_channel_close
726                     it->next = it->next->next;
727                     l2cap_emit_channel_closed(channel);
728                     btstack_memory_l2cap_channel_free(channel);
729                 } else {
730                     it = it->next;
731                 }
732             }
733             break;
734 
735         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:
736             l2cap_run();    // try sending signaling packets first
737             l2cap_hand_out_credits();
738             break;
739 
740         // HCI Connection Timeouts
741         case L2CAP_EVENT_TIMEOUT_CHECK:
742             handle = READ_BT_16(packet, 2);
743             if (hci_authentication_active_for_handle(handle)) break;
744             hci_con_used = 0;
745             for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
746                 channel = (l2cap_channel_t *) it;
747                 if (channel->handle == handle) {
748                     hci_con_used = 1;
749                 }
750             }
751             if (hci_con_used) break;
752             if (!hci_can_send_packet_now(HCI_COMMAND_DATA_PACKET)) break;
753             hci_send_cmd(&hci_disconnect, handle, 0x13); // remote closed connection
754             break;
755 
756         case DAEMON_EVENT_HCI_PACKET_SENT:
757             for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
758                 channel = (l2cap_channel_t *) it;
759                 if (channel->packet_handler) {
760                     (* (channel->packet_handler))(HCI_EVENT_PACKET, channel->local_cid, packet, size);
761                 }
762             }
763             if (attribute_protocol_packet_handler) {
764                 (*attribute_protocol_packet_handler)(HCI_EVENT_PACKET, 0, packet, size);
765             }
766             if (security_protocol_packet_handler) {
767                 (*security_protocol_packet_handler)(HCI_EVENT_PACKET, 0, packet, size);
768             }
769             break;
770 
771         default:
772             break;
773     }
774 
775     // pass on
776     (*packet_handler)(NULL, HCI_EVENT_PACKET, 0, packet, size);
777 }
778 
779 static void l2cap_handle_disconnect_request(l2cap_channel_t *channel, uint16_t identifier){
780     channel->remote_sig_id = identifier;
781     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
782     l2cap_run();
783 }
784 
785 static void l2cap_register_signaling_response(hci_con_handle_t handle, uint8_t code, uint8_t sig_id, uint16_t data){
786     // Vol 3, Part A, 4.3: "The DCID and SCID fields shall be ignored when the result field indi- cates the connection was refused."
787     if (signaling_responses_pending < NR_PENDING_SIGNALING_RESPONSES) {
788         signaling_responses[signaling_responses_pending].handle = handle;
789         signaling_responses[signaling_responses_pending].code = code;
790         signaling_responses[signaling_responses_pending].sig_id = sig_id;
791         signaling_responses[signaling_responses_pending].data = data;
792         signaling_responses_pending++;
793         l2cap_run();
794     }
795 }
796 
797 static void l2cap_handle_connection_request(hci_con_handle_t handle, uint8_t sig_id, uint16_t psm, uint16_t source_cid){
798 
799     // log_info("l2cap_handle_connection_request for handle %u, psm %u cid 0x%02x\n", handle, psm, source_cid);
800     l2cap_service_t *service = l2cap_get_service(psm);
801     if (!service) {
802         // 0x0002 PSM not supported
803         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, 0x0002);
804         return;
805     }
806 
807     hci_connection_t * hci_connection = hci_connection_for_handle( handle );
808     if (!hci_connection) {
809         //
810         log_error("no hci_connection for handle %u\n", handle);
811         return;
812     }
813     // alloc structure
814     // log_info("l2cap_handle_connection_request register channel\n");
815     l2cap_channel_t * channel = (l2cap_channel_t*) btstack_memory_l2cap_channel_get();
816     if (!channel){
817         // 0x0004 No resources available
818         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, 0x0004);
819         return;
820     }
821 
822     // fill in
823     BD_ADDR_COPY(channel->address, hci_connection->address);
824     channel->psm = psm;
825     channel->handle = handle;
826     channel->connection = service->connection;
827     channel->packet_handler = service->packet_handler;
828     channel->local_cid  = l2cap_next_local_cid();
829     channel->remote_cid = source_cid;
830     channel->local_mtu  = service->mtu;
831     channel->remote_mtu = L2CAP_DEFAULT_MTU;
832     channel->packets_granted = 0;
833     channel->remote_sig_id = sig_id;
834 
835     // limit local mtu to max acl packet length
836     if (channel->local_mtu > l2cap_max_mtu()) {
837         channel->local_mtu = l2cap_max_mtu();
838     }
839 
840     // set initial state
841     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
842     channel->state_var = L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND;
843 
844     // add to connections list
845     linked_list_add(&l2cap_channels, (linked_item_t *) channel);
846 
847     //
848     // gap_security_level_t current_level  = gap_security_level(handle);
849     // gap_security_level_t required_level = LEVEL_2;
850     // if (current_level < required_level){
851     //     gap_request_security_level(handle, required_level);
852     //     return;
853     // }
854 
855     // emit incoming connection request
856     l2cap_emit_connection_request(channel);
857 }
858 
859 void l2cap_accept_connection_internal(uint16_t local_cid){
860     log_info("L2CAP_ACCEPT_CONNECTION local_cid 0x%x", local_cid);
861     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
862     if (!channel) {
863         log_error("l2cap_accept_connection_internal called but local_cid 0x%x not found", local_cid);
864         return;
865     }
866 
867     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
868 
869     // process
870     l2cap_run();
871 }
872 
873 void l2cap_decline_connection_internal(uint16_t local_cid, uint8_t reason){
874     log_info("L2CAP_DECLINE_CONNECTION local_cid 0x%x, reason %x", local_cid, reason);
875     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
876     if (!channel) {
877         log_error( "l2cap_decline_connection_internal called but local_cid 0x%x not found", local_cid);
878         return;
879     }
880     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
881     channel->reason = reason;
882     l2cap_run();
883 }
884 
885 void l2cap_signaling_handle_configure_request(l2cap_channel_t *channel, uint8_t *command){
886 
887     channel->remote_sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
888 
889     uint16_t flags = READ_BT_16(command, 6);
890     if (flags & 1) {
891         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
892     }
893 
894     // accept the other's configuration options
895     uint16_t end_pos = 4 + READ_BT_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
896     uint16_t pos     = 8;
897     while (pos < end_pos){
898         uint8_t option_hint = command[pos] >> 7;
899         uint8_t option_type = command[pos] & 0x7f;
900         log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
901         pos++;
902         uint8_t length = command[pos++];
903         // MTU { type(8): 1, len(8):2, MTU(16) }
904         if (option_type == 1 && length == 2){
905             channel->remote_mtu = READ_BT_16(command, pos);
906             // log_info("l2cap cid 0x%02x, remote mtu %u\n", channel->local_cid, channel->remote_mtu);
907             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
908         }
909         // Flush timeout { type(8):2, len(8): 2, Flush Timeout(16)}
910         if (option_type == 2 && length == 2){
911             channel->flush_timeout = READ_BT_16(command, pos);
912         }
913         // check for unknown options
914         if (option_hint == 0 && (option_type == 0 || option_type >= 0x07)){
915             log_info("l2cap cid %u, unknown options", channel->local_cid);
916             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
917         }
918         pos += length;
919     }
920 }
921 
922 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel){
923     // log_info("l2cap_channel_ready_for_open 0x%02x\n", channel->state_var);
924     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP) == 0) return 0;
925     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP) == 0) return 0;
926     return 1;
927 }
928 
929 
930 void l2cap_signaling_handler_channel(l2cap_channel_t *channel, uint8_t *command){
931 
932     uint8_t  code       = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
933     uint8_t  identifier = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
934     uint16_t result = 0;
935 
936     log_info("L2CAP signaling handler code %u, state %u\n", code, channel->state);
937 
938     // handle DISCONNECT REQUESTS seperately
939     if (code == DISCONNECTION_REQUEST){
940         switch (channel->state){
941             case L2CAP_STATE_CONFIG:
942             case L2CAP_STATE_OPEN:
943             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
944             case L2CAP_STATE_WAIT_DISCONNECT:
945                 l2cap_handle_disconnect_request(channel, identifier);
946                 break;
947 
948             default:
949                 // ignore in other states
950                 break;
951         }
952         return;
953     }
954 
955     // @STATEMACHINE(l2cap)
956     switch (channel->state) {
957 
958         case L2CAP_STATE_WAIT_CONNECT_RSP:
959             switch (code){
960                 case CONNECTION_RESPONSE:
961                     l2cap_stop_rtx(channel);
962                     result = READ_BT_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
963                     switch (result) {
964                         case 0:
965                             // successful connection
966                             channel->remote_cid = READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
967                             channel->state = L2CAP_STATE_CONFIG;
968                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
969                             break;
970                         case 1:
971                             // connection pending. get some coffee, but start the ERTX
972                             l2cap_start_ertx(channel);
973                             break;
974                         default:
975                             // channel closed
976                             channel->state = L2CAP_STATE_CLOSED;
977                             // map l2cap connection response result to BTstack status enumeration
978                             l2cap_emit_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result);
979 
980                             // drop link key if security block
981                             if (L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result == L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY){
982                                 hci_drop_link_key_for_bd_addr(&channel->address);
983                             }
984 
985                             // discard channel
986                             linked_list_remove(&l2cap_channels, (linked_item_t *) channel);
987                             btstack_memory_l2cap_channel_free(channel);
988                             break;
989                     }
990                     break;
991 
992                 default:
993                     //@TODO: implement other signaling packets
994                     break;
995             }
996             break;
997 
998         case L2CAP_STATE_CONFIG:
999             result = READ_BT_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
1000             switch (code) {
1001                 case CONFIGURE_REQUEST:
1002                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
1003                     l2cap_signaling_handle_configure_request(channel, command);
1004                     if (!(channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT)){
1005                         // only done if continuation not set
1006                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_REQ);
1007                     }
1008                     break;
1009                 case CONFIGURE_RESPONSE:
1010                     l2cap_stop_rtx(channel);
1011                     switch (result){
1012                         case 0: // success
1013                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP);
1014                             break;
1015                         case 4: // pending
1016                             l2cap_start_ertx(channel);
1017                             break;
1018                         default:
1019                             // retry on negative result
1020                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1021                             break;
1022                     }
1023                     break;
1024                 default:
1025                     break;
1026             }
1027             if (l2cap_channel_ready_for_open(channel)){
1028                 // for open:
1029                 channel->state = L2CAP_STATE_OPEN;
1030                 l2cap_emit_channel_opened(channel, 0);
1031                 l2cap_emit_credits(channel, 1);
1032             }
1033             break;
1034 
1035         case L2CAP_STATE_WAIT_DISCONNECT:
1036             switch (code) {
1037                 case DISCONNECTION_RESPONSE:
1038                     l2cap_finialize_channel_close(channel);
1039                     break;
1040                 default:
1041                     //@TODO: implement other signaling packets
1042                     break;
1043             }
1044             break;
1045 
1046         case L2CAP_STATE_CLOSED:
1047             // @TODO handle incoming requests
1048             break;
1049 
1050         case L2CAP_STATE_OPEN:
1051             //@TODO: implement other signaling packets, e.g. re-configure
1052             break;
1053         default:
1054             break;
1055     }
1056     // log_info("new state %u\n", channel->state);
1057 }
1058 
1059 
1060 void l2cap_signaling_handler_dispatch( hci_con_handle_t handle, uint8_t * command){
1061 
1062     // get code, signalind identifier and command len
1063     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
1064     uint8_t sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
1065 
1066     // not for a particular channel, and not CONNECTION_REQUEST, ECHO_[REQUEST|RESPONSE], INFORMATION_REQUEST
1067     if (code < 1 || code == ECHO_RESPONSE || code > INFORMATION_REQUEST){
1068         l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, L2CAP_REJ_CMD_UNKNOWN);
1069         return;
1070     }
1071 
1072     // general commands without an assigned channel
1073     switch(code) {
1074 
1075         case CONNECTION_REQUEST: {
1076             uint16_t psm =        READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1077             uint16_t source_cid = READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
1078             l2cap_handle_connection_request(handle, sig_id, psm, source_cid);
1079             return;
1080         }
1081 
1082         case ECHO_REQUEST:
1083             l2cap_register_signaling_response(handle, code, sig_id, 0);
1084             return;
1085 
1086         case INFORMATION_REQUEST: {
1087             uint16_t infoType = READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1088             l2cap_register_signaling_response(handle, code, sig_id, infoType);
1089             return;
1090         }
1091 
1092         default:
1093             break;
1094     }
1095 
1096 
1097     // Get potential destination CID
1098     uint16_t dest_cid = READ_BT_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
1099 
1100     // Find channel for this sig_id and connection handle
1101     linked_item_t *it;
1102     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
1103         l2cap_channel_t * channel = (l2cap_channel_t *) it;
1104         if (channel->handle == handle) {
1105             if (code & 1) {
1106                 // match odd commands (responses) by previous signaling identifier
1107                 if (channel->local_sig_id == sig_id) {
1108                     l2cap_signaling_handler_channel(channel, command);
1109                     break;
1110                 }
1111             } else {
1112                 // match even commands (requests) by local channel id
1113                 if (channel->local_cid == dest_cid) {
1114                     l2cap_signaling_handler_channel(channel, command);
1115                     break;
1116                 }
1117             }
1118         }
1119     }
1120 }
1121 
1122 void l2cap_acl_handler( uint8_t *packet, uint16_t size ){
1123 
1124     // Get Channel ID
1125     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
1126     hci_con_handle_t handle = READ_ACL_CONNECTION_HANDLE(packet);
1127 
1128     switch (channel_id) {
1129 
1130         case L2CAP_CID_SIGNALING: {
1131 
1132             uint16_t command_offset = 8;
1133             while (command_offset < size) {
1134 
1135                 // handle signaling commands
1136                 l2cap_signaling_handler_dispatch(handle, &packet[command_offset]);
1137 
1138                 // increment command_offset
1139                 command_offset += L2CAP_SIGNALING_COMMAND_DATA_OFFSET + READ_BT_16(packet, command_offset + L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
1140             }
1141             break;
1142         }
1143 
1144         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
1145             if (attribute_protocol_packet_handler) {
1146                 (*attribute_protocol_packet_handler)(ATT_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
1147             }
1148             break;
1149 
1150         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
1151             if (security_protocol_packet_handler) {
1152                 (*security_protocol_packet_handler)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
1153             }
1154             break;
1155 
1156         default: {
1157             // Find channel for this channel_id and connection handle
1158             l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(channel_id);
1159             if (channel) {
1160                 l2cap_dispatch(channel, L2CAP_DATA_PACKET, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
1161             }
1162             break;
1163         }
1164     }
1165 
1166     l2cap_run();
1167 }
1168 
1169 static void l2cap_packet_handler(uint8_t packet_type, uint8_t *packet, uint16_t size){
1170     switch (packet_type) {
1171         case HCI_EVENT_PACKET:
1172             l2cap_event_handler(packet, size);
1173             break;
1174         case HCI_ACL_DATA_PACKET:
1175             l2cap_acl_handler(packet, size);
1176             break;
1177         default:
1178             break;
1179     }
1180 }
1181 
1182 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
1183 void l2cap_finialize_channel_close(l2cap_channel_t *channel){
1184     channel->state = L2CAP_STATE_CLOSED;
1185     l2cap_emit_channel_closed(channel);
1186     // discard channel
1187     linked_list_remove(&l2cap_channels, (linked_item_t *) channel);
1188     btstack_memory_l2cap_channel_free(channel);
1189 }
1190 
1191 l2cap_service_t * l2cap_get_service(uint16_t psm){
1192     linked_item_t *it;
1193 
1194     // close open channels
1195     for (it = (linked_item_t *) l2cap_services; it ; it = it->next){
1196         l2cap_service_t * service = ((l2cap_service_t *) it);
1197         if ( service->psm == psm){
1198             return service;
1199         };
1200     }
1201     return NULL;
1202 }
1203 
1204 void l2cap_register_service_internal(void *connection, btstack_packet_handler_t packet_handler, uint16_t psm, uint16_t mtu){
1205 
1206     log_info("L2CAP_REGISTER_SERVICE psm 0x%x mtu %u", psm, mtu);
1207 
1208     // check for alread registered psm
1209     // TODO: emit error event
1210     l2cap_service_t *service = l2cap_get_service(psm);
1211     if (service) {
1212         log_error("l2cap_register_service_internal: PSM %u already registered\n", psm);
1213         l2cap_emit_service_registered(connection, L2CAP_SERVICE_ALREADY_REGISTERED, psm);
1214         return;
1215     }
1216 
1217     // alloc structure
1218     // TODO: emit error event
1219     service = (l2cap_service_t *) btstack_memory_l2cap_service_get();
1220     if (!service) {
1221         log_error("l2cap_register_service_internal: no memory for l2cap_service_t\n");
1222         l2cap_emit_service_registered(connection, BTSTACK_MEMORY_ALLOC_FAILED, psm);
1223         return;
1224     }
1225 
1226     // fill in
1227     service->psm = psm;
1228     service->mtu = mtu;
1229     service->connection = connection;
1230     service->packet_handler = packet_handler;
1231 
1232     // add to services list
1233     linked_list_add(&l2cap_services, (linked_item_t *) service);
1234 
1235     // enable page scan
1236     hci_connectable_control(1);
1237 
1238     // done
1239     l2cap_emit_service_registered(connection, 0, psm);
1240 }
1241 
1242 void l2cap_unregister_service_internal(void *connection, uint16_t psm){
1243 
1244     log_info("L2CAP_UNREGISTER_SERVICE psm 0x%x", psm);
1245 
1246     l2cap_service_t *service = l2cap_get_service(psm);
1247     if (!service) return;
1248     linked_list_remove(&l2cap_services, (linked_item_t *) service);
1249     btstack_memory_l2cap_service_free(service);
1250 
1251     // disable page scan when no services registered
1252     if (!linked_list_empty(&l2cap_services)) return;
1253     hci_connectable_control(0);
1254 }
1255 
1256 //
1257 void l2cap_close_connection(void *connection){
1258     linked_item_t *it;
1259 
1260     // close open channels - note to myself: no channel is freed, so no new for fancy iterator tricks
1261     l2cap_channel_t * channel;
1262     for (it = (linked_item_t *) l2cap_channels; it ; it = it->next){
1263         channel = (l2cap_channel_t *) it;
1264         if (channel->connection == connection) {
1265             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
1266         }
1267     }
1268 
1269     // unregister services
1270     it = (linked_item_t *) &l2cap_services;
1271     while (it->next) {
1272         l2cap_service_t * service = (l2cap_service_t *) it->next;
1273         if (service->connection == connection){
1274             it->next = it->next->next;
1275             btstack_memory_l2cap_service_free(service);
1276         } else {
1277             it = it->next;
1278         }
1279     }
1280 
1281     // process
1282     l2cap_run();
1283 }
1284 
1285 // Bluetooth 4.0 - allows to register handler for Attribute Protocol and Security Manager Protocol
1286 void l2cap_register_fixed_channel(btstack_packet_handler_t packet_handler, uint16_t channel_id) {
1287     switch(channel_id){
1288         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
1289             attribute_protocol_packet_handler = packet_handler;
1290             break;
1291         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
1292             security_protocol_packet_handler = packet_handler;
1293             break;
1294     }
1295 }
1296 
1297 #ifdef HAVE_BLE
1298 // Request LE connection parameter update
1299 int l2cap_le_request_connection_parameter_update(uint16_t handle, uint16_t interval_min, uint16_t interval_max, uint16_t slave_latency, uint16_t timeout_multiplier){
1300     if (!hci_can_send_packet_now(HCI_ACL_DATA_PACKET)){
1301         log_info("l2cap_send_signaling_packet, cannot send\n");
1302         return BTSTACK_ACL_BUFFERS_FULL;
1303     }
1304     // log_info("l2cap_send_signaling_packet type %u\n", cmd);
1305     uint8_t *acl_buffer = hci_get_outgoing_acl_packet_buffer();
1306     uint16_t len = l2cap_le_create_connection_parameter_update_request(acl_buffer, handle, interval_min, interval_max, slave_latency, timeout_multiplier);
1307     return hci_send_acl_packet(acl_buffer, len);
1308 }
1309 #endif
1310 
1311