xref: /btstack/src/l2cap.c (revision b28dc8004dd8d4fb9020a6dcd2bc81f05d36a008)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "l2cap.c"
39 
40 /*
41  *  l2cap.c
42  *  Logical Link Control and Adaption Protocol (L2CAP)
43  */
44 
45 #include "l2cap.h"
46 #include "hci.h"
47 #include "hci_dump.h"
48 #include "bluetooth_sdp.h"
49 #include "bluetooth_psm.h"
50 #include "btstack_bool.h"
51 #include "btstack_debug.h"
52 #include "btstack_event.h"
53 #include "btstack_memory.h"
54 
55 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
56 // TODO avoid dependency on higher layer: used to trigger pairing for outgoing connections
57 #include "ble/sm.h"
58 #endif
59 
60 #include <stdarg.h>
61 #include <string.h>
62 
63 /*
64  * @brief L2CAP Supervisory function in S-Frames
65  */
66 typedef enum {
67     L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY = 0,
68     L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT,
69     L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY,
70     L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT
71 } l2cap_supervisory_function_t;
72 
73 /**
74  * @brief L2CAP Information Types used in Information Request & Response
75  */
76 typedef enum {
77   L2CAP_INFO_TYPE_CONNECTIONLESS_MTU = 1,
78   L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED,
79   L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED,
80 } l2cap_info_type_t;
81 
82 /**
83  * @brief L2CAP Configuration Option Types used in Configurateion Request & Response
84  */
85 typedef enum {
86   L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT = 1,
87   L2CAP_CONFIG_OPTION_TYPE_FLUSH_TIMEOUT,
88   L2CAP_CONFIG_OPTION_TYPE_QUALITY_OF_SERVICE,
89   L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL,
90   L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE,
91   L2CAP_CONFIG_OPTION_TYPE_EXTENDED_FLOW_SPECIFICATION,
92   L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE,
93 } l2cap_config_option_type_t;
94 
95 
96 #define L2CAP_SIG_ID_INVALID 0
97 
98 // size of HCI ACL + L2CAP Header for regular data packets (8)
99 #define COMPLETE_L2CAP_HEADER (HCI_ACL_HEADER_SIZE + L2CAP_HEADER_SIZE)
100 
101 // L2CAP Configuration Result Codes
102 #define L2CAP_CONF_RESULT_SUCCESS                  0x0000
103 #define L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS  0x0001
104 #define L2CAP_CONF_RESULT_REJECT                   0x0002
105 #define L2CAP_CONF_RESULT_UNKNOWN_OPTIONS          0x0003
106 #define L2CAP_CONF_RESULT_PENDING                  0x0004
107 #define L2CAP_CONF_RESULT_FLOW_SPEC_REJECTED       0x0005
108 
109 // L2CAP Reject Result Codes
110 #define L2CAP_REJ_CMD_UNKNOWN                      0x0000
111 
112 // Response Timeout eXpired
113 #define L2CAP_RTX_TIMEOUT_MS   10000
114 
115 // Extended Response Timeout eXpired
116 #define L2CAP_ERTX_TIMEOUT_MS 120000
117 
118 // nr of buffered acl packets in outgoing queue to get max performance
119 #define NR_BUFFERED_ACL_PACKETS 3
120 
121 // used to cache l2cap rejects, echo, and informational requests
122 #define NR_PENDING_SIGNALING_RESPONSES 3
123 
124 // nr of credits provided to remote if credits fall below watermark
125 #define L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_WATERMARK 5
126 #define L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_INCREMENT 5
127 
128 // offsets for L2CAP SIGNALING COMMANDS
129 #define L2CAP_SIGNALING_COMMAND_CODE_OFFSET   0
130 #define L2CAP_SIGNALING_COMMAND_SIGID_OFFSET  1
131 #define L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET 2
132 #define L2CAP_SIGNALING_COMMAND_DATA_OFFSET   4
133 
134 #ifdef ENABLE_LE_DATA_CHANNELS
135 #warning "ENABLE_LE_DATA_CHANNELS has been deprecated."
136 #warning "Please use ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE instead in btstack_config.h"
137 #define ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
138 #endif
139 
140 #if defined(ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE) || defined(ENABLE_L2CAP_ENHANCED_DATA_CHANNELS)
141 #define ENABLE_L2CAP_CREDIT_BASED_CHANNELS
142 #endif
143 
144 #if defined(ENABLE_L2CAP_CREDIT_BASED_CHANNELS) || defined(ENABLE_CLASSIC)
145 #define L2CAP_USES_CHANNELS
146 #endif
147 
148 // prototypes
149 static void l2cap_run(void);
150 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size);
151 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size );
152 static void l2cap_notify_channel_can_send(void);
153 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel);
154 static uint8_t  l2cap_next_sig_id(void);
155 static l2cap_fixed_channel_t * l2cap_fixed_channel_for_channel_id(uint16_t local_cid);
156 #ifdef ENABLE_CLASSIC
157 static void l2cap_handle_security_level_incoming_sufficient(l2cap_channel_t * channel);
158 static int l2cap_security_level_0_allowed_for_PSM(uint16_t psm);
159 static void l2cap_handle_remote_supported_features_received(l2cap_channel_t * channel);
160 static void l2cap_handle_connection_complete(hci_con_handle_t con_handle, l2cap_channel_t * channel);
161 static void l2cap_handle_information_request_complete(hci_connection_t * connection);
162 static inline l2cap_service_t * l2cap_get_service(uint16_t psm);
163 static void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status);
164 static void l2cap_emit_channel_closed(l2cap_channel_t *channel);
165 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel);
166 static int  l2cap_channel_ready_for_open(l2cap_channel_t *channel);
167 #endif
168 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
169 static void l2cap_emit_le_channel_opened(l2cap_channel_t *channel, uint8_t status);
170 static void l2cap_emit_le_channel_closed(l2cap_channel_t * channel);
171 static void l2cap_emit_le_incoming_connection(l2cap_channel_t *channel);
172 static void l2cap_le_notify_channel_can_send(l2cap_channel_t *channel);
173 static void l2cap_le_finialize_channel_close(l2cap_channel_t *channel);
174 static inline l2cap_service_t * l2cap_le_get_service(uint16_t psm);
175 #endif
176 #ifdef ENABLE_L2CAP_CREDIT_BASED_CHANNELS
177 static void l2cap_credit_based_send_pdu(l2cap_channel_t *channel);
178 static void l2cap_credit_based_send_credits(l2cap_channel_t *channel);
179 static bool l2cap_credit_based_handle_credit_indication(hci_con_handle_t handle, const uint8_t * command, uint16_t len);
180 static void l2cap_credit_based_handle_pdu(l2cap_channel_t * l2cap_channel, const uint8_t * packet, uint16_t size);
181 #endif
182 #ifdef L2CAP_USES_CHANNELS
183 static uint16_t l2cap_next_local_cid(void);
184 static l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid);
185 static void l2cap_emit_simple_event_with_cid(l2cap_channel_t * channel, uint8_t event_code);
186 static void l2cap_dispatch_to_channel(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size);
187 static l2cap_channel_t * l2cap_create_channel_entry(btstack_packet_handler_t packet_handler, l2cap_channel_type_t channel_type, bd_addr_t address, bd_addr_type_t address_type,
188         uint16_t psm, uint16_t local_mtu, gap_security_level_t security_level);
189 static void l2cap_finalize_channel_close(l2cap_channel_t *channel);
190 static void l2cap_free_channel_entry(l2cap_channel_t * channel);
191 #endif
192 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
193 static void l2cap_ertm_notify_channel_can_send(l2cap_channel_t * channel);
194 static void l2cap_ertm_monitor_timeout_callback(btstack_timer_source_t * ts);
195 static void l2cap_ertm_retransmission_timeout_callback(btstack_timer_source_t * ts);
196 #endif
197 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
198 static int l2cap_enhanced_signaling_handler_dispatch(hci_con_handle_t handle, uint16_t signaling_cid, uint8_t * command, uint8_t sig_id);
199 #endif
200 
201 // l2cap_fixed_channel_t entries
202 #ifdef ENABLE_BLE
203 static l2cap_fixed_channel_t l2cap_fixed_channel_att;
204 static l2cap_fixed_channel_t l2cap_fixed_channel_sm;
205 #endif
206 #ifdef ENABLE_CLASSIC
207 static l2cap_fixed_channel_t l2cap_fixed_channel_connectionless;
208 #endif
209 
210 #ifdef ENABLE_CLASSIC
211 static btstack_linked_list_t l2cap_services;
212 static uint8_t l2cap_require_security_level2_for_outgoing_sdp;
213 static bd_addr_t l2cap_outgoing_classic_addr;
214 #endif
215 
216 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
217 static btstack_linked_list_t l2cap_le_services;
218 #endif
219 
220 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
221 static btstack_linked_list_t l2cap_enhanced_services;
222 static uint16_t l2cap_enhanced_mps_min;
223 static uint16_t l2cap_enhanced_mps_max;
224 #endif
225 
226 // single list of channels for Classic Channels, LE Data Channels, Classic Connectionless, ATT, and SM
227 static btstack_linked_list_t l2cap_channels;
228 #ifdef L2CAP_USES_CHANNELS
229 // next channel id for new connections
230 static uint16_t  l2cap_local_source_cid;
231 #endif
232 // next signaling sequence number
233 static uint8_t   l2cap_sig_seq_nr;
234 
235 // used to cache l2cap rejects, echo, and informational requests
236 static l2cap_signaling_response_t l2cap_signaling_responses[NR_PENDING_SIGNALING_RESPONSES];
237 static int l2cap_signaling_responses_pending;
238 static btstack_packet_callback_registration_t l2cap_hci_event_callback_registration;
239 
240 static bool l2cap_call_notify_channel_in_run;
241 
242 #ifdef ENABLE_BLE
243 // only used for connection parameter update events
244 static uint16_t l2cap_le_custom_max_mtu;
245 #endif
246 
247 /* callbacks for events */
248 static btstack_linked_list_t l2cap_event_handlers;
249 
250 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
251 
252 // enable for testing
253 // #define L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL 16
254 
255 /*
256  * CRC lookup table for generator polynom D^16 + D^15 + D^2 + 1
257  */
258 static const uint16_t crc16_table[256] = {
259     0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241, 0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
260     0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40, 0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
261     0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40, 0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
262     0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641, 0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
263     0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240, 0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
264     0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41, 0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
265     0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41, 0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
266     0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640, 0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
267     0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240, 0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
268     0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41, 0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
269     0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41, 0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
270     0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640, 0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
271     0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241, 0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
272     0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40, 0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
273     0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40, 0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
274     0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641, 0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040,
275 };
276 
277 static uint16_t crc16_calc(uint8_t * data, uint16_t len){
278     uint16_t crc = 0;   // initial value = 0
279     while (len--){
280         crc = (crc >> 8) ^ crc16_table[ (crc ^ ((uint16_t) *data++)) & 0x00FF ];
281     }
282     return crc;
283 }
284 
285 static inline uint16_t l2cap_encanced_control_field_for_information_frame(uint8_t tx_seq, int final, uint8_t req_seq, l2cap_segmentation_and_reassembly_t sar){
286     return (((uint16_t) sar) << 14) | (req_seq << 8) | (final << 7) | (tx_seq << 1) | 0;
287 }
288 
289 static inline uint16_t l2cap_encanced_control_field_for_supevisor_frame(l2cap_supervisory_function_t supervisory_function, int poll, int final, uint8_t req_seq){
290     return (req_seq << 8) | (final << 7) | (poll << 4) | (((int) supervisory_function) << 2) | 1;
291 }
292 
293 static int l2cap_next_ertm_seq_nr(int seq_nr){
294     return (seq_nr + 1) & 0x3f;
295 }
296 
297 static bool l2cap_ertm_can_store_packet_now(l2cap_channel_t * channel){
298     // get num free tx buffers
299     int num_free_tx_buffers = channel->num_tx_buffers - channel->num_stored_tx_frames;
300     // calculate num tx buffers for remote MTU
301     int num_tx_buffers_for_max_remote_mtu;
302     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
303     if (channel->remote_mtu <= effective_mps){
304         // MTU fits into single packet
305         num_tx_buffers_for_max_remote_mtu = 1;
306     } else {
307         // include SDU Length
308         num_tx_buffers_for_max_remote_mtu = (channel->remote_mtu + 2 + (effective_mps - 1)) / effective_mps;
309     }
310     log_debug("num_free_tx_buffers %u, num_tx_buffers_for_max_remote_mtu %u", num_free_tx_buffers, num_tx_buffers_for_max_remote_mtu);
311     return num_tx_buffers_for_max_remote_mtu <= num_free_tx_buffers;
312 }
313 
314 static void l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel_t * l2cap_channel){
315     log_info("Retransmit unacknowleged frames");
316     l2cap_channel->unacked_frames = 0;;
317     l2cap_channel->tx_send_index  = l2cap_channel->tx_read_index;
318 }
319 
320 static void l2cap_ertm_next_tx_write_index(l2cap_channel_t * channel){
321     channel->tx_write_index++;
322     if (channel->tx_write_index < channel->num_tx_buffers) return;
323     channel->tx_write_index = 0;
324 }
325 
326 static void l2cap_ertm_start_monitor_timer(l2cap_channel_t * channel){
327     log_info("Start Monitor timer");
328     btstack_run_loop_remove_timer(&channel->monitor_timer);
329     btstack_run_loop_set_timer_handler(&channel->monitor_timer, &l2cap_ertm_monitor_timeout_callback);
330     btstack_run_loop_set_timer_context(&channel->monitor_timer, channel);
331     btstack_run_loop_set_timer(&channel->monitor_timer, channel->local_monitor_timeout_ms);
332     btstack_run_loop_add_timer(&channel->monitor_timer);
333 }
334 
335 static void l2cap_ertm_stop_monitor_timer(l2cap_channel_t * channel){
336     log_info("Stop Monitor timer");
337     btstack_run_loop_remove_timer(&channel->monitor_timer);
338 }
339 
340 static void l2cap_ertm_start_retransmission_timer(l2cap_channel_t * channel){
341     log_info("Start Retransmission timer");
342     btstack_run_loop_remove_timer(&channel->retransmission_timer);
343     btstack_run_loop_set_timer_handler(&channel->retransmission_timer, &l2cap_ertm_retransmission_timeout_callback);
344     btstack_run_loop_set_timer_context(&channel->retransmission_timer, channel);
345     btstack_run_loop_set_timer(&channel->retransmission_timer, channel->local_retransmission_timeout_ms);
346     btstack_run_loop_add_timer(&channel->retransmission_timer);
347 }
348 
349 static void l2cap_ertm_stop_retransmission_timer(l2cap_channel_t * l2cap_channel){
350     log_info("Stop Retransmission timer");
351     btstack_run_loop_remove_timer(&l2cap_channel->retransmission_timer);
352 }
353 
354 static void l2cap_ertm_monitor_timeout_callback(btstack_timer_source_t * ts){
355     log_info("Monitor timeout");
356     l2cap_channel_t * l2cap_channel = (l2cap_channel_t *) btstack_run_loop_get_timer_context(ts);
357 
358     // TODO: we assume that it's the oldest packet
359     l2cap_ertm_tx_packet_state_t * tx_state;
360     tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
361 
362     // check retry count
363     if (tx_state->retry_count < l2cap_channel->remote_max_transmit){
364         // increment retry count
365         tx_state->retry_count++;
366 
367         // start retransmit
368         l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
369 
370         // start monitor timer
371         l2cap_ertm_start_monitor_timer(l2cap_channel);
372 
373         // send RR/P=1
374         l2cap_channel->send_supervisor_frame_receiver_ready_poll = 1;
375     } else {
376         log_info("Monitor timer expired & retry count >= max transmit -> disconnect");
377         l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
378     }
379     l2cap_run();
380 }
381 
382 static void l2cap_ertm_retransmission_timeout_callback(btstack_timer_source_t * ts){
383     log_info("Retransmission timeout");
384     l2cap_channel_t * l2cap_channel = (l2cap_channel_t *) btstack_run_loop_get_timer_context(ts);
385 
386     // TODO: we assume that it's the oldest packet
387     l2cap_ertm_tx_packet_state_t * tx_state;
388     tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
389 
390     // set retry count = 1
391     tx_state->retry_count = 1;
392 
393     // start retransmit
394     l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
395 
396     // start monitor timer
397     l2cap_ertm_start_monitor_timer(l2cap_channel);
398 
399     // send RR/P=1
400     l2cap_channel->send_supervisor_frame_receiver_ready_poll = 1;
401     l2cap_run();
402 }
403 
404 static int l2cap_ertm_send_information_frame(l2cap_channel_t * channel, int index, int final){
405     l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[index];
406     hci_reserve_packet_buffer();
407     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
408     uint16_t control = l2cap_encanced_control_field_for_information_frame(tx_state->tx_seq, final, channel->req_seq, tx_state->sar);
409     log_info("I-Frame: control 0x%04x", control);
410     little_endian_store_16(acl_buffer, 8, control);
411     (void)memcpy(&acl_buffer[8 + 2],
412                  &channel->tx_packets_data[index * channel->local_mps],
413                  tx_state->len);
414     // (re-)start retransmission timer on
415     l2cap_ertm_start_retransmission_timer(channel);
416     // send
417     return l2cap_send_prepared(channel->local_cid, 2 + tx_state->len);
418 }
419 
420 static void l2cap_ertm_store_fragment(l2cap_channel_t * channel, l2cap_segmentation_and_reassembly_t sar, uint16_t sdu_length, uint8_t * data, uint16_t len){
421     // get next index for storing packets
422     int index = channel->tx_write_index;
423 
424     l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[index];
425     tx_state->tx_seq = channel->next_tx_seq;
426     tx_state->sar = sar;
427     tx_state->retry_count = 0;
428 
429     uint8_t * tx_packet = &channel->tx_packets_data[index * channel->local_mps];
430     log_debug("index %u, local mps %u, remote mps %u, packet tx %p, len %u", index, channel->local_mps, channel->remote_mps, tx_packet, len);
431     int pos = 0;
432     if (sar == L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU){
433         little_endian_store_16(tx_packet, 0, sdu_length);
434         pos += 2;
435     }
436     (void)memcpy(&tx_packet[pos], data, len);
437     tx_state->len = pos + len;
438 
439     // update
440     channel->num_stored_tx_frames++;
441     channel->next_tx_seq = l2cap_next_ertm_seq_nr(channel->next_tx_seq);
442     l2cap_ertm_next_tx_write_index(channel);
443 
444     log_info("l2cap_ertm_store_fragment: tx_read_index %u, tx_write_index %u, num stored %u", channel->tx_read_index, channel->tx_write_index, channel->num_stored_tx_frames);
445 
446 }
447 
448 static uint8_t l2cap_ertm_send(l2cap_channel_t * channel, uint8_t * data, uint16_t len){
449     if (len > channel->remote_mtu){
450         log_error("l2cap_ertm_send cid 0x%02x, data length exceeds remote MTU.", channel->local_cid);
451         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
452     }
453 
454     if (!l2cap_ertm_can_store_packet_now(channel)){
455         log_error("l2cap_ertm_send cid 0x%02x, fragment store full", channel->local_cid);
456         return BTSTACK_ACL_BUFFERS_FULL;
457     }
458 
459     // check if it needs to get fragmented
460     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
461     if (len > effective_mps){
462         // fragmentation needed.
463         l2cap_segmentation_and_reassembly_t sar =  L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU;
464         int chunk_len;
465         while (len){
466             switch (sar){
467                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
468                     chunk_len = effective_mps - 2;    // sdu_length
469                     l2cap_ertm_store_fragment(channel, sar, len, data, chunk_len);
470                     len -= chunk_len;
471                     sar = L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU;
472                     break;
473                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
474                     chunk_len = effective_mps;
475                     if (chunk_len >= len){
476                         sar = L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU;
477                         chunk_len = len;
478                     }
479                     l2cap_ertm_store_fragment(channel, sar, len, data, chunk_len);
480                     len -= chunk_len;
481                     break;
482                 default:
483                     break;
484             }
485         }
486 
487     } else {
488         l2cap_ertm_store_fragment(channel, L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU, 0, data, len);
489     }
490 
491     // try to send
492     l2cap_notify_channel_can_send();
493     return ERROR_CODE_SUCCESS;
494 }
495 
496 static uint16_t l2cap_setup_options_ertm_request(l2cap_channel_t * channel, uint8_t * config_options){
497     int pos = 0;
498     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL;
499     config_options[pos++] = 9;      // length
500     config_options[pos++] = (uint8_t) channel->mode;
501     config_options[pos++] = channel->num_rx_buffers;    // == TxWindows size
502     config_options[pos++] = channel->local_max_transmit;
503     little_endian_store_16( config_options, pos, channel->local_retransmission_timeout_ms);
504     pos += 2;
505     little_endian_store_16( config_options, pos, channel->local_monitor_timeout_ms);
506     pos += 2;
507     little_endian_store_16( config_options, pos, channel->local_mps);
508     pos += 2;
509     //
510     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT;
511     config_options[pos++] = 2;     // length
512     little_endian_store_16(config_options, pos, channel->local_mtu);
513     pos += 2;
514 
515     // Issue: iOS (e.g. 10.2) uses "No FCS" as default while Core 5.0 specifies "FCS" as default
516     // Workaround: try to actively negotiate FCS option
517     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE;
518     config_options[pos++] = 1;     // length
519     config_options[pos++] = channel->fcs_option;
520     return pos; // 11+4+3=18
521 }
522 
523 static uint16_t l2cap_setup_options_ertm_response(l2cap_channel_t * channel, uint8_t * config_options){
524     int pos = 0;
525     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL;
526     config_options[pos++] = 9;      // length
527     config_options[pos++] = (uint8_t) channel->mode;
528     // less or equal to remote tx window size
529     config_options[pos++] = btstack_min(channel->num_tx_buffers, channel->remote_tx_window_size);
530     // max transmit in response shall be ignored -> use sender values
531     config_options[pos++] = channel->remote_max_transmit;
532     // A value for the Retransmission time-out shall be sent in a positive Configuration Response
533     // and indicates the value that will be used by the sender of the Configuration Response -> use our value
534     little_endian_store_16( config_options, pos, channel->local_retransmission_timeout_ms);
535     pos += 2;
536     // A value for the Monitor time-out shall be sent in a positive Configuration Response
537     // and indicates the value that will be used by the sender of the Configuration Response -> use our value
538     little_endian_store_16( config_options, pos, channel->local_monitor_timeout_ms);
539     pos += 2;
540     // less or equal to remote mps
541     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
542     little_endian_store_16( config_options, pos, effective_mps);
543     pos += 2;
544     //
545     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT; // MTU
546     config_options[pos++] = 2;     // length
547     little_endian_store_16(config_options, pos, channel->remote_mtu);
548     pos += 2;
549 #if 0
550     //
551     config_options[pos++] = L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE;
552     config_options[pos++] = 1;     // length
553     config_options[pos++] = channel->fcs_option;
554 #endif
555     return pos; // 11+4=15
556 }
557 
558 static int l2cap_ertm_send_supervisor_frame(l2cap_channel_t * channel, uint16_t control){
559     hci_reserve_packet_buffer();
560     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
561     log_info("S-Frame: control 0x%04x", control);
562     little_endian_store_16(acl_buffer, 8, control);
563     return l2cap_send_prepared(channel->local_cid, 2);
564 }
565 
566 static uint8_t l2cap_ertm_validate_local_config(l2cap_ertm_config_t * ertm_config){
567 
568     uint8_t result = ERROR_CODE_SUCCESS;
569     if (ertm_config->max_transmit < 1){
570         log_error("max_transmit must be >= 1");
571         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
572     }
573     if (ertm_config->retransmission_timeout_ms < 2000){
574         log_error("retransmission_timeout_ms must be >= 2000 ms");
575         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
576     }
577     if (ertm_config->monitor_timeout_ms < 12000){
578         log_error("monitor_timeout_ms must be >= 12000 ms");
579         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
580     }
581     if (ertm_config->local_mtu < 48){
582         log_error("local_mtu must be >= 48");
583         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
584     }
585     if (ertm_config->num_rx_buffers < 1){
586         log_error("num_rx_buffers must be >= 1");
587         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
588     }
589     if (ertm_config->num_tx_buffers < 1){
590         log_error("num_rx_buffers must be >= 1");
591         result = ERROR_CODE_INVALID_HCI_COMMAND_PARAMETERS;
592     }
593     return result;
594 }
595 
596 static void l2cap_ertm_configure_channel(l2cap_channel_t * channel, l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size){
597 
598     channel->mode  = L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION;
599     channel->ertm_mandatory = ertm_config->ertm_mandatory;
600     channel->local_max_transmit = ertm_config->max_transmit;
601     channel->local_retransmission_timeout_ms = ertm_config->retransmission_timeout_ms;
602     channel->local_monitor_timeout_ms = ertm_config->monitor_timeout_ms;
603     channel->local_mtu = ertm_config->local_mtu;
604     channel->num_rx_buffers = ertm_config->num_rx_buffers;
605     channel->num_tx_buffers = ertm_config->num_tx_buffers;
606 
607     // align buffer to 16-byte boundary to assert l2cap_ertm_rx_packet_state_t is aligned
608     int bytes_till_alignment = 16 - (((uintptr_t) buffer) & 0x0f);
609     buffer += bytes_till_alignment;
610     size   -= bytes_till_alignment;
611 
612     // setup state buffers - use void cast to avoid -Wcast-align warning
613     uint32_t pos = 0;
614     channel->rx_packets_state = (l2cap_ertm_rx_packet_state_t *) (void *) &buffer[pos];
615     pos += ertm_config->num_rx_buffers * sizeof(l2cap_ertm_rx_packet_state_t);
616     channel->tx_packets_state = (l2cap_ertm_tx_packet_state_t *) (void *) &buffer[pos];
617     pos += ertm_config->num_tx_buffers * sizeof(l2cap_ertm_tx_packet_state_t);
618 
619     // setup reassembly buffer
620     channel->reassembly_buffer = &buffer[pos];
621     pos += ertm_config->local_mtu;
622 
623     // divide rest of data equally
624     channel->local_mps = (size - pos) / (ertm_config->num_rx_buffers + ertm_config->num_tx_buffers);
625     log_info("Local MPS: %u", channel->local_mps);
626     channel->rx_packets_data = &buffer[pos];
627     pos += ertm_config->num_rx_buffers * channel->local_mps;
628     channel->tx_packets_data = &buffer[pos];
629 
630     channel->fcs_option = ertm_config->fcs_option;
631 }
632 
633 uint8_t l2cap_create_ertm_channel(btstack_packet_handler_t packet_handler, bd_addr_t address, uint16_t psm,
634     l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size, uint16_t * out_local_cid){
635 
636     log_info("L2CAP_CREATE_ERTM_CHANNEL addr %s, psm 0x%x, local mtu %u", bd_addr_to_str(address), psm, ertm_config->local_mtu);
637 
638     // validate local config
639     uint8_t result = l2cap_ertm_validate_local_config(ertm_config);
640     if (result) return result;
641 
642     // determine security level based on psm
643     const gap_security_level_t security_level = l2cap_security_level_0_allowed_for_PSM(psm) ? LEVEL_0 : gap_get_security_level();
644 
645     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, address, BD_ADDR_TYPE_ACL, psm, ertm_config->local_mtu, security_level);
646     if (!channel) {
647         return BTSTACK_MEMORY_ALLOC_FAILED;
648     }
649 
650     // configure ERTM
651     l2cap_ertm_configure_channel(channel, ertm_config, buffer, size);
652 
653     // add to connections list
654     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
655 
656     // store local_cid
657     if (out_local_cid){
658        *out_local_cid = channel->local_cid;
659     }
660 
661     // check if hci connection is already usable
662     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_ACL);
663     if (conn){
664         log_info("l2cap_create_channel, hci connection already exists");
665         l2cap_handle_connection_complete(conn->con_handle, channel);
666         // check if remote supported fearures are already received
667         if (hci_remote_features_available(conn->con_handle)) {
668             l2cap_handle_remote_supported_features_received(channel);
669         } else {
670             hci_remote_features_query(conn->con_handle);
671         };
672     }
673 
674     l2cap_run();
675 
676     return 0;
677 }
678 
679 static void l2cap_ertm_notify_channel_can_send(l2cap_channel_t * channel){
680     if (l2cap_ertm_can_store_packet_now(channel)){
681         channel->waiting_for_can_send_now = 0;
682         l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
683     }
684 }
685 
686 uint8_t l2cap_accept_ertm_connection(uint16_t local_cid, l2cap_ertm_config_t * ertm_config, uint8_t * buffer, uint32_t size){
687 
688     log_info("L2CAP_ACCEPT_ERTM_CONNECTION local_cid 0x%x", local_cid);
689     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
690     if (!channel) {
691         log_error("l2cap_accept_connection called but local_cid 0x%x not found", local_cid);
692         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
693     }
694 
695     // validate local config
696     uint8_t result = l2cap_ertm_validate_local_config(ertm_config);
697     if (result) return result;
698 
699     // configure L2CAP ERTM
700     l2cap_ertm_configure_channel(channel, ertm_config, buffer, size);
701 
702     // already available?
703     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
704     btstack_assert(connection != NULL);
705 
706     // we need to know if ERTM is supported before sending a config response
707     switch (connection->l2cap_state.information_state){
708         case L2CAP_INFORMATION_STATE_DONE:
709             l2cap_handle_information_request_complete(connection);
710             break;
711         case L2CAP_INFORMATION_STATE_IDLE:
712             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
713         /* fall through */
714         default:
715             channel->state = L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES;
716             break;
717     }
718 
719     l2cap_run();
720 
721     return ERROR_CODE_SUCCESS;
722 }
723 
724 uint8_t l2cap_ertm_set_busy(uint16_t local_cid){
725     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
726     if (!channel) {
727         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
728         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
729     }
730     if (!channel->local_busy){
731         channel->local_busy = 1;
732         channel->send_supervisor_frame_receiver_not_ready = 1;
733         l2cap_run();
734     }
735     return ERROR_CODE_SUCCESS;
736 }
737 
738 uint8_t l2cap_ertm_set_ready(uint16_t local_cid){
739     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
740     if (!channel) {
741         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
742         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
743     }
744     if (channel->local_busy){
745         channel->local_busy = 0;
746         channel->send_supervisor_frame_receiver_ready_poll = 1;
747         l2cap_run();
748     }
749     return ERROR_CODE_SUCCESS;
750 }
751 
752 // Process-ReqSeq
753 static void l2cap_ertm_process_req_seq(l2cap_channel_t * l2cap_channel, uint8_t req_seq){
754     int num_buffers_acked = 0;
755     l2cap_ertm_tx_packet_state_t * tx_state;
756     log_info("l2cap_ertm_process_req_seq: tx_read_index %u, tx_write_index %u, req_seq %u", l2cap_channel->tx_read_index, l2cap_channel->tx_write_index, req_seq);
757     while (true){
758 
759         // no unack packets left
760         if (l2cap_channel->unacked_frames == 0) {
761             // stop retransmission timer
762             l2cap_ertm_stop_retransmission_timer(l2cap_channel);
763             break;
764         }
765 
766         tx_state = &l2cap_channel->tx_packets_state[l2cap_channel->tx_read_index];
767         // calc delta
768         int delta = (req_seq - tx_state->tx_seq) & 0x03f;
769         if (delta == 0) break;  // all packets acknowledged
770         if (delta > l2cap_channel->remote_tx_window_size) break;
771 
772         num_buffers_acked++;
773         l2cap_channel->num_stored_tx_frames--;
774         l2cap_channel->unacked_frames--;
775         log_info("RR seq %u => packet with tx_seq %u done", req_seq, tx_state->tx_seq);
776 
777         l2cap_channel->tx_read_index++;
778         if (l2cap_channel->tx_read_index >= l2cap_channel->num_rx_buffers){
779             l2cap_channel->tx_read_index = 0;
780         }
781     }
782     if (num_buffers_acked){
783         log_info("num_buffers_acked %u", num_buffers_acked);
784     l2cap_ertm_notify_channel_can_send(l2cap_channel);
785 }
786 }
787 
788 static l2cap_ertm_tx_packet_state_t * l2cap_ertm_get_tx_state(l2cap_channel_t * l2cap_channel, uint8_t tx_seq){
789     int i;
790     for (i=0;i<l2cap_channel->num_tx_buffers;i++){
791         l2cap_ertm_tx_packet_state_t * tx_state = &l2cap_channel->tx_packets_state[i];
792         if (tx_state->tx_seq == tx_seq) return tx_state;
793     }
794     return NULL;
795 }
796 
797 // @param delta number of frames in the future, >= 1
798 // @assumption size <= l2cap_channel->local_mps (checked in l2cap_acl_classic_handler)
799 static void l2cap_ertm_handle_out_of_sequence_sdu(l2cap_channel_t * l2cap_channel, l2cap_segmentation_and_reassembly_t sar, int delta, const uint8_t * payload, uint16_t size){
800     log_info("Store SDU with delta %u", delta);
801     // get rx state for packet to store
802     int index = l2cap_channel->rx_store_index + delta - 1;
803     if (index > l2cap_channel->num_rx_buffers){
804         index -= l2cap_channel->num_rx_buffers;
805     }
806     log_info("Index of packet to store %u", index);
807     l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
808     // check if buffer is free
809     if (rx_state->valid){
810         log_error("Packet buffer already used");
811         return;
812     }
813     rx_state->valid = 1;
814     rx_state->sar = sar;
815     rx_state->len = size;
816     uint8_t * rx_buffer = &l2cap_channel->rx_packets_data[index];
817     (void)memcpy(rx_buffer, payload, size);
818 }
819 
820 // @assumption size <= l2cap_channel->local_mps (checked in l2cap_acl_classic_handler)
821 static void l2cap_ertm_handle_in_sequence_sdu(l2cap_channel_t * l2cap_channel, l2cap_segmentation_and_reassembly_t sar, const uint8_t * payload, uint16_t size){
822     uint16_t reassembly_sdu_length;
823     switch (sar){
824         case L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU:
825             // assert total packet size <= our mtu
826             if (size > l2cap_channel->local_mtu) break;
827             // packet complete -> disapatch
828             l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, (uint8_t*) payload, size);
829             break;
830         case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
831             // read SDU len
832             reassembly_sdu_length = little_endian_read_16(payload, 0);
833             payload += 2;
834             size    -= 2;
835             // assert reassembled size <= our mtu
836             if (reassembly_sdu_length > l2cap_channel->local_mtu) break;
837             // store start segment
838             l2cap_channel->reassembly_sdu_length = reassembly_sdu_length;
839             (void)memcpy(&l2cap_channel->reassembly_buffer[0], payload, size);
840             l2cap_channel->reassembly_pos = size;
841             break;
842         case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
843             // assert size of reassembled data <= our mtu
844             if (l2cap_channel->reassembly_pos + size > l2cap_channel->local_mtu) break;
845             // store continuation segment
846             (void)memcpy(&l2cap_channel->reassembly_buffer[l2cap_channel->reassembly_pos],
847                          payload, size);
848             l2cap_channel->reassembly_pos += size;
849             break;
850         case L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU:
851             // assert size of reassembled data <= our mtu
852             if (l2cap_channel->reassembly_pos + size > l2cap_channel->local_mtu) break;
853             // store continuation segment
854             (void)memcpy(&l2cap_channel->reassembly_buffer[l2cap_channel->reassembly_pos],
855                          payload, size);
856             l2cap_channel->reassembly_pos += size;
857             // assert size of reassembled data matches announced sdu length
858             if (l2cap_channel->reassembly_pos != l2cap_channel->reassembly_sdu_length) break;
859             // packet complete -> disapatch
860             l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->reassembly_buffer, l2cap_channel->reassembly_pos);
861             l2cap_channel->reassembly_pos = 0;
862             break;
863         default:
864             btstack_assert(false);
865             break;
866     }
867 }
868 
869 static void l2cap_ertm_channel_send_information_frame(l2cap_channel_t * channel){
870     channel->unacked_frames++;
871     int index = channel->tx_send_index;
872     channel->tx_send_index++;
873     if (channel->tx_send_index >= channel->num_tx_buffers){
874         channel->tx_send_index = 0;
875     }
876     l2cap_ertm_send_information_frame(channel, index, 0);   // final = 0
877 }
878 
879 #endif
880 
881 #ifdef L2CAP_USES_CHANNELS
882 static uint16_t l2cap_next_local_cid(void){
883     do {
884         if (l2cap_local_source_cid == 0xfffeu) {
885             l2cap_local_source_cid = 0x40;
886         } else {
887             l2cap_local_source_cid++;
888         }
889     } while (l2cap_get_channel_for_local_cid(l2cap_local_source_cid) != NULL);
890     return l2cap_local_source_cid;
891 }
892 #endif
893 
894 static uint8_t l2cap_next_sig_id(void){
895     if (l2cap_sig_seq_nr == 0xffu) {
896         l2cap_sig_seq_nr = 1;
897     } else {
898         l2cap_sig_seq_nr++;
899     }
900     return l2cap_sig_seq_nr;
901 }
902 
903 void l2cap_init(void){
904 #ifdef L2CAP_USES_CHANNELS
905     l2cap_local_source_cid  = 0x40;
906 #endif
907     l2cap_sig_seq_nr  = 0xff;
908 
909 #ifdef ENABLE_CLASSIC
910     // Setup Connectionless Channel
911     l2cap_fixed_channel_connectionless.local_cid     = L2CAP_CID_CONNECTIONLESS_CHANNEL;
912     l2cap_fixed_channel_connectionless.channel_type  = L2CAP_CHANNEL_TYPE_CONNECTIONLESS;
913     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_connectionless);
914 #endif
915 
916 #ifdef ENABLE_BLE
917     // Setup fixed ATT Channel
918     l2cap_fixed_channel_att.local_cid    = L2CAP_CID_ATTRIBUTE_PROTOCOL;
919     l2cap_fixed_channel_att.channel_type = L2CAP_CHANNEL_TYPE_FIXED;
920     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_att);
921 
922     // Setup fixed SM Channel
923     l2cap_fixed_channel_sm.local_cid     = L2CAP_CID_SECURITY_MANAGER_PROTOCOL;
924     l2cap_fixed_channel_sm.channel_type  = L2CAP_CHANNEL_TYPE_FIXED;
925     btstack_linked_list_add(&l2cap_channels, (btstack_linked_item_t *) &l2cap_fixed_channel_sm);
926 #endif
927 
928 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
929     l2cap_enhanced_mps_min = 0x0001;
930     l2cap_enhanced_mps_max = 0xffff;
931 #endif
932 
933     //
934     // register callback with HCI
935     //
936     l2cap_hci_event_callback_registration.callback = &l2cap_hci_event_handler;
937     hci_add_event_handler(&l2cap_hci_event_callback_registration);
938 
939     hci_register_acl_packet_handler(&l2cap_acl_handler);
940 
941 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
942 #ifdef ENABLE_CLASSIC
943     gap_connectable_control(0); // no services yet
944 #endif
945 #endif
946 }
947 
948 /**
949  * @brief De-Init L2CAP
950  */
951 void l2cap_deinit(void){
952     l2cap_channels = NULL;
953     l2cap_signaling_responses_pending = 0;
954 #ifdef ENABLE_CLASSIC
955     l2cap_require_security_level2_for_outgoing_sdp = 0;
956     (void)memset(&l2cap_fixed_channel_connectionless, 0, sizeof(l2cap_fixed_channel_connectionless));
957     l2cap_services = NULL;
958     (void)memset(l2cap_outgoing_classic_addr, 0, 6);
959 #endif
960 #ifdef ENABLE_BLE
961     l2cap_le_custom_max_mtu = 0;
962     (void)memset(&l2cap_fixed_channel_att, 0, sizeof(l2cap_fixed_channel_att));
963     (void)memset(&l2cap_fixed_channel_sm, 0, sizeof(l2cap_fixed_channel_sm));
964 #endif
965 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
966     l2cap_le_services = NULL;
967 #endif
968 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
969     l2cap_enhanced_services = NULL;
970 #endif
971     l2cap_event_handlers = NULL;
972 }
973 
974 void l2cap_add_event_handler(btstack_packet_callback_registration_t * callback_handler){
975     btstack_linked_list_add_tail(&l2cap_event_handlers, (btstack_linked_item_t*) callback_handler);
976 }
977 
978 void l2cap_remove_event_handler(btstack_packet_callback_registration_t * callback_handler){
979     btstack_linked_list_remove(&l2cap_event_handlers, (btstack_linked_item_t*) callback_handler);
980 }
981 
982 static void l2cap_emit_event(uint8_t *event, uint16_t size) {
983     hci_dump_packet( HCI_EVENT_PACKET, 0, event, size);
984     // dispatch to all event handlers
985     btstack_linked_list_iterator_t it;
986     btstack_linked_list_iterator_init(&it, &l2cap_event_handlers);
987     while (btstack_linked_list_iterator_has_next(&it)){
988         btstack_packet_callback_registration_t * entry = (btstack_packet_callback_registration_t*) btstack_linked_list_iterator_next(&it);
989         entry->callback(HCI_EVENT_PACKET, 0, event, size);
990     }
991 }
992 
993 void l2cap_request_can_send_fix_channel_now_event(hci_con_handle_t con_handle, uint16_t channel_id){
994     UNUSED(con_handle);  // ok: there is no con handle
995 
996     l2cap_fixed_channel_t * channel = l2cap_fixed_channel_for_channel_id(channel_id);
997     if (!channel) return;
998     channel->waiting_for_can_send_now = 1;
999     l2cap_notify_channel_can_send();
1000 }
1001 
1002 bool l2cap_can_send_fixed_channel_packet_now(hci_con_handle_t con_handle, uint16_t channel_id){
1003     UNUSED(channel_id); // ok: only depends on Controller LE buffers
1004 
1005     return hci_can_send_acl_packet_now(con_handle);
1006 }
1007 
1008 uint8_t *l2cap_get_outgoing_buffer(void){
1009     return hci_get_outgoing_packet_buffer() + COMPLETE_L2CAP_HEADER; // 8 bytes
1010 }
1011 
1012 // only for L2CAP Basic Channels
1013 bool l2cap_reserve_packet_buffer(void){
1014     return hci_reserve_packet_buffer();
1015 }
1016 
1017 // only for L2CAP Basic Channels
1018 void l2cap_release_packet_buffer(void){
1019     hci_release_packet_buffer();
1020 }
1021 
1022 static void l2cap_setup_header(uint8_t * acl_buffer, hci_con_handle_t con_handle, uint8_t packet_boundary, uint16_t remote_cid, uint16_t len){
1023     // 0 - Connection handle : PB=pb : BC=00
1024     little_endian_store_16(acl_buffer, 0u, con_handle | (packet_boundary << 12u) | (0u << 14u));
1025     // 2 - ACL length
1026     little_endian_store_16(acl_buffer, 2u,  len + 4u);
1027     // 4 - L2CAP packet length
1028     little_endian_store_16(acl_buffer, 4u,  len + 0u);
1029     // 6 - L2CAP channel DEST
1030     little_endian_store_16(acl_buffer, 6,  remote_cid);
1031 }
1032 
1033 // assumption - only on LE connections
1034 uint8_t l2cap_send_prepared_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint16_t len){
1035 
1036     if (!hci_is_packet_buffer_reserved()){
1037         log_error("l2cap_send_prepared_connectionless called without reserving packet first");
1038         return BTSTACK_ACL_BUFFERS_FULL;
1039     }
1040 
1041     if (!hci_can_send_prepared_acl_packet_now(con_handle)){
1042         log_info("l2cap_send_prepared_connectionless handle 0x%02x, cid 0x%02x, cannot send", con_handle, cid);
1043         return BTSTACK_ACL_BUFFERS_FULL;
1044     }
1045 
1046     log_debug("l2cap_send_prepared_connectionless handle %u, cid 0x%02x", con_handle, cid);
1047 
1048     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1049     l2cap_setup_header(acl_buffer, con_handle, 0, cid, len);
1050     // send
1051     return hci_send_acl_packet_buffer(len+8u);
1052 }
1053 
1054 // assumption - only on LE connections
1055 uint8_t l2cap_send_connectionless(hci_con_handle_t con_handle, uint16_t cid, uint8_t *data, uint16_t len){
1056 
1057     if (!hci_can_send_acl_packet_now(con_handle)){
1058         log_info("l2cap_send cid 0x%02x, cannot send", cid);
1059         return BTSTACK_ACL_BUFFERS_FULL;
1060     }
1061 
1062     hci_reserve_packet_buffer();
1063     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1064 
1065     (void)memcpy(&acl_buffer[8], data, len);
1066 
1067     return l2cap_send_prepared_connectionless(con_handle, cid, len);
1068 }
1069 
1070 static void l2cap_emit_can_send_now(btstack_packet_handler_t packet_handler, uint16_t channel) {
1071     log_debug("L2CAP_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel);
1072     uint8_t event[4];
1073     event[0] = L2CAP_EVENT_CAN_SEND_NOW;
1074     event[1] = sizeof(event) - 2u;
1075     little_endian_store_16(event, 2, channel);
1076     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
1077     packet_handler(HCI_EVENT_PACKET, channel, event, sizeof(event));
1078 }
1079 
1080 #ifdef L2CAP_USES_CHANNELS
1081 static void l2cap_dispatch_to_channel(l2cap_channel_t *channel, uint8_t type, uint8_t * data, uint16_t size){
1082     (* (channel->packet_handler))(type, channel->local_cid, data, size);
1083 }
1084 
1085 static void l2cap_emit_simple_event_with_cid(l2cap_channel_t * channel, uint8_t event_code){
1086     uint8_t event[4];
1087     event[0] = event_code;
1088     event[1] = sizeof(event) - 2u;
1089     little_endian_store_16(event, 2, channel->local_cid);
1090     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
1091     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1092 }
1093 #endif
1094 
1095 #ifdef ENABLE_CLASSIC
1096 void l2cap_emit_channel_opened(l2cap_channel_t *channel, uint8_t status) {
1097     log_info("L2CAP_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u, flush_timeout %u",
1098              status, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
1099              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu, channel->flush_timeout);
1100     uint8_t event[26];
1101     event[0] = L2CAP_EVENT_CHANNEL_OPENED;
1102     event[1] = sizeof(event) - 2;
1103     event[2] = status;
1104     reverse_bd_addr(channel->address, &event[3]);
1105     little_endian_store_16(event,  9, channel->con_handle);
1106     little_endian_store_16(event, 11, channel->psm);
1107     little_endian_store_16(event, 13, channel->local_cid);
1108     little_endian_store_16(event, 15, channel->remote_cid);
1109     little_endian_store_16(event, 17, channel->local_mtu);
1110     little_endian_store_16(event, 19, channel->remote_mtu);
1111     little_endian_store_16(event, 21, channel->flush_timeout);
1112     event[23] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
1113 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1114     log_info("ERTM mode %u, fcs enabled %u", channel->mode, channel->fcs_option);
1115     event[24] = channel->mode;
1116     event[25] = channel->fcs_option;
1117 
1118 #else
1119     event[24] = L2CAP_CHANNEL_MODE_BASIC;
1120     event[25] = 0;
1121 #endif
1122     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
1123     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1124 }
1125 
1126 static void l2cap_emit_incoming_connection(l2cap_channel_t *channel) {
1127     log_info("L2CAP_EVENT_INCOMING_CONNECTION addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x",
1128              bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid);
1129     uint8_t event[16];
1130     event[0] = L2CAP_EVENT_INCOMING_CONNECTION;
1131     event[1] = sizeof(event) - 2;
1132     reverse_bd_addr(channel->address, &event[2]);
1133     little_endian_store_16(event,  8, channel->con_handle);
1134     little_endian_store_16(event, 10, channel->psm);
1135     little_endian_store_16(event, 12, channel->local_cid);
1136     little_endian_store_16(event, 14, channel->remote_cid);
1137     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
1138     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
1139 }
1140 
1141 static void l2cap_handle_channel_open_failed(l2cap_channel_t * channel, uint8_t status){
1142 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1143     // emit ertm buffer released, as it's not needed. if in basic mode, it was either not allocated or already released
1144     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1145         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1146     }
1147 #endif
1148     l2cap_emit_channel_opened(channel, status);
1149 }
1150 
1151 #endif
1152 
1153 #ifdef L2CAP_USES_CHANNELS
1154 
1155 static void l2cap_emit_channel_closed(l2cap_channel_t *channel) {
1156     log_info("L2CAP_EVENT_CHANNEL_CLOSED local_cid 0x%x", channel->local_cid);
1157     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
1158 }
1159 
1160 static void l2cap_handle_channel_closed(l2cap_channel_t * channel){
1161 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1162     // emit ertm buffer released, as it's not needed anymore. if in basic mode, it was either not allocated or already released
1163     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1164         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1165     }
1166 #endif
1167     l2cap_emit_channel_closed(channel);
1168 }
1169 #endif
1170 
1171 static l2cap_fixed_channel_t * l2cap_channel_item_by_cid(uint16_t cid){
1172     btstack_linked_list_iterator_t it;
1173     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1174     while (btstack_linked_list_iterator_has_next(&it)){
1175         l2cap_fixed_channel_t * channel = (l2cap_fixed_channel_t*) btstack_linked_list_iterator_next(&it);
1176         if (channel->local_cid == cid) {
1177             return channel;
1178         }
1179     }
1180     return NULL;
1181 }
1182 
1183 // used for fixed channels in LE (ATT/SM) and Classic (Connectionless Channel). CID < 0x04
1184 static l2cap_fixed_channel_t * l2cap_fixed_channel_for_channel_id(uint16_t local_cid){
1185     if (local_cid >= 0x40u) return NULL;
1186     return (l2cap_fixed_channel_t*) l2cap_channel_item_by_cid(local_cid);
1187 }
1188 
1189 #ifdef L2CAP_USES_CHANNELS
1190 
1191 static int l2cap_is_dynamic_channel_type(l2cap_channel_type_t channel_type) {
1192     switch (channel_type) {
1193         case L2CAP_CHANNEL_TYPE_CLASSIC:
1194         case L2CAP_CHANNEL_TYPE_LE_DATA_CHANNEL:
1195         case L2CAP_CHANNEL_TYPE_ENHANCED_DATA_CHANNEL:
1196             return 1;
1197         default:
1198             return 0;
1199     }
1200 }
1201 
1202 static l2cap_channel_t * l2cap_get_channel_for_local_cid(uint16_t local_cid){
1203     if (local_cid < 0x40u) return NULL;
1204     return (l2cap_channel_t*) l2cap_channel_item_by_cid(local_cid);
1205 }
1206 
1207 static l2cap_channel_t * l2cap_get_channel_for_local_cid_and_handle(uint16_t local_cid, hci_con_handle_t con_handle){
1208     if (local_cid < 0x40u) return NULL;
1209     l2cap_channel_t * l2cap_channel = (l2cap_channel_t*) l2cap_channel_item_by_cid(local_cid);
1210     if (l2cap_channel == NULL)  return NULL;
1211     if (l2cap_channel->con_handle != con_handle) return NULL;
1212     return l2cap_channel;
1213 }
1214 #endif
1215 
1216 #ifdef ENABLE_L2CAP_CREDIT_BASED_CHANNELS
1217 static l2cap_channel_t * l2cap_get_channel_for_remote_handle_and_cid(hci_con_handle_t con_handle, uint16_t remote_cid){
1218     btstack_linked_list_iterator_t it;
1219     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1220     while (btstack_linked_list_iterator_has_next(&it)){
1221         l2cap_fixed_channel_t * channel = (l2cap_fixed_channel_t*) btstack_linked_list_iterator_next(&it);
1222         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
1223         l2cap_channel_t * dynamic_channel = (l2cap_channel_t *) channel;
1224         if (dynamic_channel->con_handle != con_handle) continue;
1225         if (dynamic_channel->remote_cid != remote_cid) continue;
1226         return dynamic_channel;
1227     }
1228     return NULL;
1229 }
1230 #endif
1231 
1232 #ifdef ENABLE_CLASSIC
1233 void l2cap_request_can_send_now_event(uint16_t local_cid){
1234     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1235     if (!channel) return;
1236     channel->waiting_for_can_send_now = 1;
1237 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1238     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1239         l2cap_ertm_notify_channel_can_send(channel);
1240         return;
1241     }
1242 #endif
1243     l2cap_notify_channel_can_send();
1244 }
1245 
1246 bool l2cap_can_send_packet_now(uint16_t local_cid){
1247     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1248     if (!channel) return false;
1249 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1250     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1251         return l2cap_ertm_can_store_packet_now(channel);
1252     }
1253 #endif
1254     return hci_can_send_acl_packet_now(channel->con_handle);
1255 }
1256 
1257 bool l2cap_can_send_prepared_packet_now(uint16_t local_cid){
1258     l2cap_channel_t *channel = l2cap_get_channel_for_local_cid(local_cid);
1259     if (!channel) return false;
1260 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1261     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1262         return false;
1263     }
1264 #endif
1265     return hci_can_send_prepared_acl_packet_now(channel->con_handle);
1266 }
1267 
1268 uint16_t l2cap_get_remote_mtu_for_local_cid(uint16_t local_cid){
1269     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1270     if (channel) {
1271         return channel->remote_mtu;
1272     }
1273     return 0;
1274 }
1275 #endif
1276 
1277 #ifdef ENABLE_CLASSIC
1278 // RTX Timer only exist for dynamic channels
1279 static l2cap_channel_t * l2cap_channel_for_rtx_timer(btstack_timer_source_t * ts){
1280     btstack_linked_list_iterator_t it;
1281     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1282     while (btstack_linked_list_iterator_has_next(&it)){
1283         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1284         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
1285         if (&channel->rtx == ts) {
1286             return channel;
1287         }
1288     }
1289     return NULL;
1290 }
1291 
1292 static void l2cap_rtx_timeout(btstack_timer_source_t * ts){
1293     l2cap_channel_t * channel = l2cap_channel_for_rtx_timer(ts);
1294     if (!channel) return;
1295 
1296     log_info("l2cap_rtx_timeout for local cid 0x%02x", channel->local_cid);
1297 
1298     // "When terminating the channel, it is not necessary to send a L2CAP_DisconnectReq
1299     //  and enter WAIT_DISCONNECT state. Channels can be transitioned directly to the CLOSED state."
1300     // notify client
1301     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_RTX_TIMEOUT);
1302 
1303     // discard channel
1304     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1305     l2cap_free_channel_entry(channel);
1306 }
1307 
1308 #endif
1309 
1310 #ifdef L2CAP_USES_CHANNELS
1311 static void l2cap_stop_rtx(l2cap_channel_t * channel){
1312     log_info("l2cap_stop_rtx for local cid 0x%02x", channel->local_cid);
1313     btstack_run_loop_remove_timer(&channel->rtx);
1314 }
1315 #endif
1316 
1317 static uint8_t l2cap_send_signaling_packet(hci_con_handle_t handle, uint8_t pb_flags, uint16_t cid, L2CAP_SIGNALING_COMMANDS cmd, int identifier, va_list argptr){
1318     if (!hci_can_send_acl_packet_now(handle)){
1319         log_info("l2cap_send_classic_signaling_packet, cannot send");
1320         return BTSTACK_ACL_BUFFERS_FULL;
1321     }
1322     hci_reserve_packet_buffer();
1323     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1324     uint16_t len = l2cap_create_signaling_packet(acl_buffer, handle, pb_flags, cid, cmd, identifier, argptr);
1325     va_end(argptr);
1326     return hci_send_acl_packet_buffer(len);
1327 }
1328 
1329 #ifdef ENABLE_L2CAP_CREDIT_BASED_CHANNELS
1330 static int l2cap_send_general_signaling_packet(hci_con_handle_t handle, uint16_t signaling_cid, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1331     va_list argptr;
1332     va_start(argptr, identifier);
1333     uint8_t pb_flags = 0x00;
1334 #ifdef ENABLE_CLASSIC
1335     if ((signaling_cid == L2CAP_CID_SIGNALING) && (!hci_non_flushable_packet_boundary_flag_supported())){
1336         pb_flags = 0x02;
1337     }
1338 #endif
1339 uint8_t result = l2cap_send_signaling_packet(handle, pb_flags, signaling_cid, cmd, identifier, argptr);
1340     va_end(argptr);
1341     return result;
1342 }
1343 #endif
1344 
1345 #ifdef ENABLE_CLASSIC
1346 
1347 static void l2cap_start_rtx(l2cap_channel_t * channel){
1348     l2cap_stop_rtx(channel);
1349     log_info("l2cap_start_rtx for local cid 0x%02x", channel->local_cid);
1350     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
1351     btstack_run_loop_set_timer(&channel->rtx, L2CAP_RTX_TIMEOUT_MS);
1352     btstack_run_loop_add_timer(&channel->rtx);
1353 }
1354 
1355 static void l2cap_start_ertx(l2cap_channel_t * channel){
1356     log_info("l2cap_start_ertx for local cid 0x%02x", channel->local_cid);
1357     l2cap_stop_rtx(channel);
1358     btstack_run_loop_set_timer_handler(&channel->rtx, l2cap_rtx_timeout);
1359     btstack_run_loop_set_timer(&channel->rtx, L2CAP_ERTX_TIMEOUT_MS);
1360     btstack_run_loop_add_timer(&channel->rtx);
1361 }
1362 
1363 void l2cap_require_security_level_2_for_outgoing_sdp(void){
1364     l2cap_require_security_level2_for_outgoing_sdp = 1;
1365 }
1366 
1367 static int l2cap_security_level_0_allowed_for_PSM(uint16_t psm){
1368     return (psm == BLUETOOTH_PSM_SDP) && (!l2cap_require_security_level2_for_outgoing_sdp);
1369 }
1370 
1371 static int l2cap_send_classic_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1372     va_list argptr;
1373     va_start(argptr, identifier);
1374     uint8_t pb_flags = hci_non_flushable_packet_boundary_flag_supported() ? 0x00 : 0x02;
1375     uint8_t result = l2cap_send_signaling_packet(handle, pb_flags, L2CAP_CID_SIGNALING, cmd, identifier, argptr);
1376     va_end(argptr);
1377     return result;
1378 }
1379 
1380 // assumption - only on Classic connections
1381 // cannot be used for L2CAP ERTM
1382 uint8_t l2cap_send_prepared(uint16_t local_cid, uint16_t len){
1383 
1384     if (!hci_is_packet_buffer_reserved()){
1385         log_error("l2cap_send_prepared called without reserving packet first");
1386         return BTSTACK_ACL_BUFFERS_FULL;
1387     }
1388 
1389     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1390     if (!channel) {
1391         log_error("l2cap_send_prepared no channel for cid 0x%02x", local_cid);
1392         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1393     }
1394 
1395     if (!hci_can_send_prepared_acl_packet_now(channel->con_handle)){
1396         log_info("l2cap_send_prepared cid 0x%02x, cannot send", local_cid);
1397         return BTSTACK_ACL_BUFFERS_FULL;
1398     }
1399 
1400     log_debug("l2cap_send_prepared cid 0x%02x, handle %u, 1 credit used", local_cid, channel->con_handle);
1401 
1402     int fcs_size = 0;
1403 
1404 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1405     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION && channel->fcs_option){
1406         fcs_size = 2;
1407     }
1408 #endif
1409 
1410     // set non-flushable packet boundary flag if supported on Controller
1411     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1412     uint8_t packet_boundary_flag = hci_non_flushable_packet_boundary_flag_supported() ? 0x00 : 0x02;
1413     l2cap_setup_header(acl_buffer, channel->con_handle, packet_boundary_flag, channel->remote_cid, len + fcs_size);
1414 
1415 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1416     if (fcs_size){
1417         // calculate FCS over l2cap data
1418         uint16_t fcs = crc16_calc(acl_buffer + 4, 4 + len);
1419         log_info("I-Frame: fcs 0x%04x", fcs);
1420         little_endian_store_16(acl_buffer, 8 + len, fcs);
1421     }
1422 #endif
1423 
1424     // send
1425     return hci_send_acl_packet_buffer(len+8+fcs_size);
1426 }
1427 
1428 // assumption - only on Classic connections
1429 uint8_t l2cap_send(uint16_t local_cid, uint8_t *data, uint16_t len){
1430     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
1431     if (!channel) {
1432         log_error("l2cap_send no channel for cid 0x%02x", local_cid);
1433         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
1434     }
1435 
1436 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1437     // send in ERTM
1438     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1439         return l2cap_ertm_send(channel, data, len);
1440     }
1441 #endif
1442 
1443     if (len > channel->remote_mtu){
1444         log_error("l2cap_send cid 0x%02x, data length exceeds remote MTU.", local_cid);
1445         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
1446     }
1447 
1448     if (!hci_can_send_acl_packet_now(channel->con_handle)){
1449         log_info("l2cap_send cid 0x%02x, cannot send", local_cid);
1450         return BTSTACK_ACL_BUFFERS_FULL;
1451     }
1452 
1453     hci_reserve_packet_buffer();
1454     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
1455     (void)memcpy(&acl_buffer[8], data, len);
1456     return l2cap_send_prepared(local_cid, len);
1457 }
1458 
1459 int l2cap_send_echo_request(hci_con_handle_t con_handle, uint8_t *data, uint16_t len){
1460     return l2cap_send_classic_signaling_packet(con_handle, ECHO_REQUEST, l2cap_next_sig_id(), len, data);
1461 }
1462 
1463 static inline void channelStateVarSetFlag(l2cap_channel_t *channel, uint16_t flag){
1464     channel->state_var = channel->state_var | flag;
1465 }
1466 
1467 static inline void channelStateVarClearFlag(l2cap_channel_t *channel, uint16_t flag){
1468     channel->state_var = channel->state_var & ~flag;
1469 }
1470 #endif
1471 
1472 
1473 #ifdef ENABLE_BLE
1474 static int l2cap_send_le_signaling_packet(hci_con_handle_t handle, L2CAP_SIGNALING_COMMANDS cmd, int identifier, ...){
1475     va_list argptr;
1476     va_start(argptr, identifier);
1477     uint8_t pb_flags = 0x00;  // First non-automatically-flushable packet of a higher layer message
1478     uint8_t result = l2cap_send_signaling_packet(handle, pb_flags, L2CAP_CID_SIGNALING_LE, cmd, identifier, argptr);
1479     va_end(argptr);
1480     return result;
1481 }
1482 #endif
1483 
1484 uint16_t l2cap_max_mtu(void){
1485     return HCI_ACL_PAYLOAD_SIZE - L2CAP_HEADER_SIZE;
1486 }
1487 
1488 #ifdef ENABLE_BLE
1489 uint16_t l2cap_max_le_mtu(void){
1490     if (l2cap_le_custom_max_mtu != 0u) return l2cap_le_custom_max_mtu;
1491     return l2cap_max_mtu();
1492 }
1493 
1494 void l2cap_set_max_le_mtu(uint16_t max_mtu){
1495     if (max_mtu < l2cap_max_mtu()){
1496         l2cap_le_custom_max_mtu = max_mtu;
1497     }
1498 }
1499 #endif
1500 
1501 #ifdef ENABLE_CLASSIC
1502 
1503 static uint16_t l2cap_setup_options_mtu(uint8_t * config_options, uint16_t mtu){
1504     config_options[0] = L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT; // MTU
1505     config_options[1] = 2; // len param
1506     little_endian_store_16(config_options, 2, mtu);
1507     return 4;
1508 }
1509 
1510 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1511 static int l2cap_ertm_mode(l2cap_channel_t * channel){
1512     hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
1513     return ((connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_DONE)
1514         &&  (connection->l2cap_state.extended_feature_mask & 0x08));
1515 }
1516 #endif
1517 
1518 static uint16_t l2cap_setup_options_request(l2cap_channel_t * channel, uint8_t * config_options){
1519 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1520     // use ERTM options if supported by remote and channel ready to use it
1521     if (l2cap_ertm_mode(channel) && channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1522         return l2cap_setup_options_ertm_request(channel, config_options);
1523     }
1524 #endif
1525     uint16_t mtu = channel->local_mtu;
1526     return l2cap_setup_options_mtu(config_options, mtu);
1527 }
1528 
1529 static uint16_t l2cap_setup_options_mtu_response(l2cap_channel_t * channel, uint8_t * config_options){
1530     uint16_t mtu = btstack_min(channel->local_mtu, channel->remote_mtu);
1531     return l2cap_setup_options_mtu(config_options, mtu);
1532 }
1533 
1534 static uint32_t l2cap_extended_features_mask(void){
1535     // extended features request supported, features: fixed channels, unicast connectionless data reception
1536     uint32_t features = 0x280;
1537 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1538     features |= 0x0028;
1539 #endif
1540     return features;
1541 }
1542 #endif
1543 
1544 //
1545 #ifdef ENABLE_CLASSIC
1546 
1547 // returns true if channel was finalized
1548 static bool l2cap_run_for_classic_channel(l2cap_channel_t * channel){
1549 
1550 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1551     uint8_t  config_options[18];
1552 #else
1553     uint8_t  config_options[10];
1554 #endif
1555 
1556     switch (channel->state){
1557 
1558         case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
1559         case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
1560             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1561             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND) {
1562                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND);
1563                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONN_RESP_PEND);
1564                 l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1565                                                     channel->local_cid, channel->remote_cid, 1, 0);
1566             }
1567             break;
1568 
1569         case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
1570             if (!hci_can_send_command_packet_now()) break;
1571             // send connection request - set state first
1572             channel->state = L2CAP_STATE_WAIT_CONNECTION_COMPLETE;
1573             // BD_ADDR, Packet_Type, Page_Scan_Repetition_Mode, Reserved, Clock_Offset, Allow_Role_Switch
1574             (void)memcpy(l2cap_outgoing_classic_addr, channel->address, 6);
1575             hci_send_cmd(&hci_create_connection, channel->address, hci_usable_acl_packet_types(), 0, 0, 0, hci_get_allow_role_switch());
1576             break;
1577 
1578         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
1579             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1580             channel->state = L2CAP_STATE_INVALID;
1581             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1582                                                 channel->local_cid, channel->remote_cid, channel->reason, 0);
1583             // discard channel - l2cap_finialize_channel_close without sending l2cap close event
1584             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
1585             l2cap_free_channel_entry(channel);
1586             channel = NULL;
1587             break;
1588 
1589         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
1590             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1591             channel->state = L2CAP_STATE_CONFIG;
1592             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1593             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_RESPONSE, channel->remote_sig_id,
1594                                                 channel->local_cid, channel->remote_cid, 0, 0);
1595             break;
1596 
1597         case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
1598             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1599             // success, start l2cap handshake
1600             channel->local_sig_id = l2cap_next_sig_id();
1601             channel->state = L2CAP_STATE_WAIT_CONNECT_RSP;
1602             l2cap_send_classic_signaling_packet(channel->con_handle, CONNECTION_REQUEST, channel->local_sig_id,
1603                                                 channel->psm, channel->local_cid);
1604             l2cap_start_rtx(channel);
1605             break;
1606 
1607         case L2CAP_STATE_CONFIG:
1608             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1609 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1610             // fallback to basic mode if ERTM requested but not not supported by remote
1611             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
1612                 if (!l2cap_ertm_mode(channel)){
1613                     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
1614                     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
1615                 }
1616             }
1617 #endif
1618             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP){
1619                 uint16_t flags = 0;
1620                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
1621                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT) {
1622                     flags = 1;
1623                 } else {
1624                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1625                 }
1626                 if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID){
1627                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1628                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1629                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_UNKNOWN_OPTIONS,
1630                                                         1, &channel->unknown_option);
1631 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1632                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED){
1633                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
1634                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP);
1635                     uint16_t options_size = l2cap_setup_options_ertm_response(channel, config_options);
1636                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1637                                                         channel->remote_cid, flags,
1638                                                         L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS, options_size,
1639                                                         &config_options);
1640                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM){
1641                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
1642                     channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1643                     uint16_t options_size = l2cap_setup_options_ertm_response(channel, config_options);
1644                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1645                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS,
1646                                                         options_size, &config_options);
1647 #endif
1648                 } else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU){
1649                     channelStateVarClearFlag(channel,L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
1650                     uint16_t options_size = l2cap_setup_options_mtu_response(channel, config_options);
1651                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1652                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS,
1653                                                         options_size, &config_options);
1654                 } else {
1655                     l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_RESPONSE, channel->remote_sig_id,
1656                                                         channel->remote_cid, flags, L2CAP_CONF_RESULT_SUCCESS, 0, NULL);
1657                 }
1658                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
1659             }
1660             else if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ){
1661                 channelStateVarClearFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
1662                 channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SENT_CONF_REQ);
1663                 channel->local_sig_id = l2cap_next_sig_id();
1664                 uint16_t options_size = l2cap_setup_options_request(channel, config_options);
1665                 l2cap_send_classic_signaling_packet(channel->con_handle, CONFIGURE_REQUEST, channel->local_sig_id,
1666                                                     channel->remote_cid, 0, options_size, &config_options);
1667                 l2cap_start_rtx(channel);
1668             }
1669             if (l2cap_channel_ready_for_open(channel)){
1670                 channel->state = L2CAP_STATE_OPEN;
1671                 l2cap_emit_channel_opened(channel, 0);  // success
1672             }
1673             break;
1674 
1675         case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
1676             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1677             channel->state = L2CAP_STATE_INVALID;
1678             l2cap_send_classic_signaling_packet(channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id,
1679                                                 channel->local_cid, channel->remote_cid);
1680             // we don't start an RTX timer for a disconnect - there's no point in closing the channel if the other side doesn't respond :)
1681             l2cap_finalize_channel_close(channel);  // -- remove from list
1682             channel = NULL;
1683             break;
1684 
1685         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
1686             if (!hci_can_send_acl_packet_now(channel->con_handle)) return false;
1687             channel->local_sig_id = l2cap_next_sig_id();
1688             channel->state = L2CAP_STATE_WAIT_DISCONNECT;
1689             l2cap_send_classic_signaling_packet(channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id,
1690                                                 channel->remote_cid, channel->local_cid);
1691             break;
1692         default:
1693             break;
1694     }
1695 
1696     // handle channel finalize on L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE and L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE
1697     return channel == NULL;
1698 }
1699 
1700 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
1701 static void l2cap_run_for_classic_channel_ertm(l2cap_channel_t * channel){
1702 
1703     // ERTM mode
1704     if (channel->mode != L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) return;
1705 
1706     // check if we can still send
1707     if (channel->con_handle == HCI_CON_HANDLE_INVALID) return;
1708     if (!hci_can_send_acl_packet_now(channel->con_handle)) return;
1709 
1710     if (channel->send_supervisor_frame_receiver_ready){
1711         channel->send_supervisor_frame_receiver_ready = 0;
1712         log_info("Send S-Frame: RR %u, final %u", channel->req_seq, channel->set_final_bit_after_packet_with_poll_bit_set);
1713         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY, 0,  channel->set_final_bit_after_packet_with_poll_bit_set, channel->req_seq);
1714         channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1715         l2cap_ertm_send_supervisor_frame(channel, control);
1716         return;
1717     }
1718     if (channel->send_supervisor_frame_receiver_ready_poll){
1719         channel->send_supervisor_frame_receiver_ready_poll = 0;
1720         log_info("Send S-Frame: RR %u with poll=1 ", channel->req_seq);
1721         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY, 1, 0, channel->req_seq);
1722         l2cap_ertm_send_supervisor_frame(channel, control);
1723         return;
1724     }
1725     if (channel->send_supervisor_frame_receiver_not_ready){
1726         channel->send_supervisor_frame_receiver_not_ready = 0;
1727         log_info("Send S-Frame: RNR %u", channel->req_seq);
1728         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY, 0, 0, channel->req_seq);
1729         l2cap_ertm_send_supervisor_frame(channel, control);
1730         return;
1731     }
1732     if (channel->send_supervisor_frame_reject){
1733         channel->send_supervisor_frame_reject = 0;
1734         log_info("Send S-Frame: REJ %u", channel->req_seq);
1735         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT, 0, 0, channel->req_seq);
1736         l2cap_ertm_send_supervisor_frame(channel, control);
1737         return;
1738     }
1739     if (channel->send_supervisor_frame_selective_reject){
1740         channel->send_supervisor_frame_selective_reject = 0;
1741         log_info("Send S-Frame: SREJ %u", channel->expected_tx_seq);
1742         uint16_t control = l2cap_encanced_control_field_for_supevisor_frame( L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT, 0, channel->set_final_bit_after_packet_with_poll_bit_set, channel->expected_tx_seq);
1743         channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1744         l2cap_ertm_send_supervisor_frame(channel, control);
1745         return;
1746     }
1747 
1748     if (channel->srej_active){
1749         int i;
1750         for (i=0;i<channel->num_tx_buffers;i++){
1751             l2cap_ertm_tx_packet_state_t * tx_state = &channel->tx_packets_state[i];
1752             if (tx_state->retransmission_requested) {
1753                 tx_state->retransmission_requested = 0;
1754                 uint8_t final = channel->set_final_bit_after_packet_with_poll_bit_set;
1755                 channel->set_final_bit_after_packet_with_poll_bit_set = 0;
1756                 l2cap_ertm_send_information_frame(channel, i, final);
1757                 break;
1758             }
1759         }
1760         if (i == channel->num_tx_buffers){
1761             // no retransmission request found
1762             channel->srej_active = 0;
1763         } else {
1764             // packet was sent
1765             return;
1766         }
1767     }
1768 }
1769 #endif /* ERTM */
1770 #endif /* Classic */
1771 
1772 static void l2cap_run_signaling_response(void) {
1773 
1774     // check pending signaling responses
1775     while (l2cap_signaling_responses_pending){
1776 
1777         hci_con_handle_t handle = l2cap_signaling_responses[0].handle;
1778 
1779         if (!hci_can_send_acl_packet_now(handle)) break;
1780 
1781         uint8_t  sig_id        = l2cap_signaling_responses[0].sig_id;
1782         uint8_t  response_code = l2cap_signaling_responses[0].code;
1783         uint16_t result        = l2cap_signaling_responses[0].data;  // CONNECTION_REQUEST, COMMAND_REJECT, REJECT_SM_PAIRING, L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1784         uint8_t  buffer[2];                                          // REJECT_SM_PAIRING
1785         uint16_t source_cid    = l2cap_signaling_responses[0].cid;   // CONNECTION_REQUEST, REJECT_SM_PAIRING
1786 #ifdef ENABLE_CLASSIC
1787         uint16_t info_type     = l2cap_signaling_responses[0].data;  // INFORMATION_REQUEST
1788 #endif
1789 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
1790         uint8_t num_channels = l2cap_signaling_responses[0].cid >> 8;                 // L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1791         uint16_t signaling_cid = (uint16_t) l2cap_signaling_responses[0].cid & 0xff;  // L2CAP_CREDIT_BASED_CONNECTION_REQUEST, L2CAP_CREDIT_BASED_CONNECTION_REQUEST
1792 #endif
1793 
1794         // remove first item before sending (to avoid sending response mutliple times)
1795         l2cap_signaling_responses_pending--;
1796         int i;
1797         for (i=0; i < l2cap_signaling_responses_pending; i++){
1798             (void)memcpy(&l2cap_signaling_responses[i],
1799                          &l2cap_signaling_responses[i + 1],
1800                          sizeof(l2cap_signaling_response_t));
1801         }
1802 
1803         switch (response_code){
1804 #ifdef ENABLE_CLASSIC
1805             case CONNECTION_REQUEST:
1806                 l2cap_send_classic_signaling_packet(handle, CONNECTION_RESPONSE, sig_id, source_cid, 0, result, 0);
1807                 break;
1808             case ECHO_REQUEST:
1809                 l2cap_send_classic_signaling_packet(handle, ECHO_RESPONSE, sig_id, 0, NULL);
1810                 break;
1811             case INFORMATION_REQUEST:
1812                 switch (info_type){
1813                     case L2CAP_INFO_TYPE_CONNECTIONLESS_MTU: {
1814                             uint16_t connectionless_mtu = hci_max_acl_data_packet_length();
1815                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1816                                                             sizeof(connectionless_mtu), &connectionless_mtu);
1817                         }
1818                         break;
1819                     case L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED: {
1820                             uint32_t features = l2cap_extended_features_mask();
1821                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1822                                                             sizeof(features), &features);
1823                         }
1824                         break;
1825                     case L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED: {
1826                             uint8_t map[8];
1827                             memset(map, 0, 8);
1828                             // L2CAP Signaling Channel (bit 1) + Connectionless reception (bit 2)
1829                             map[0] = (1 << 1) | (1 << 2);
1830 #if defined(ENABLE_BLE) || defined (ENABLE_EXPLICIT_BR_EDR_SECURITY_MANAGER)
1831                             // BR/EDR Security Manager (bit 7)
1832                             map[0] |= (1 << 7);
1833 #endif
1834                             l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 0,
1835                                                             sizeof(map), &map);
1836                         }
1837                         break;
1838                     default:
1839                         // all other types are not supported
1840                         l2cap_send_classic_signaling_packet(handle, INFORMATION_RESPONSE, sig_id, info_type, 1, 0, NULL);
1841                         break;
1842                 }
1843                 break;
1844             case COMMAND_REJECT:
1845                 l2cap_send_classic_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
1846                 break;
1847 #endif
1848 #ifdef ENABLE_BLE
1849             case LE_CREDIT_BASED_CONNECTION_REQUEST:
1850                 l2cap_send_le_signaling_packet(handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, sig_id, 0, 0, 0, 0, result);
1851                 break;
1852             case COMMAND_REJECT_LE:
1853                 l2cap_send_le_signaling_packet(handle, COMMAND_REJECT, sig_id, result, 0, NULL);
1854                 break;
1855 #endif
1856 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
1857             case L2CAP_CREDIT_BASED_CONNECTION_REQUEST: {
1858                 // send variable size array or cids with each cid being zero
1859                 uint16_t cids[6];
1860                 (void) memset(cids, 0xff, sizeof(cids));
1861                 (void) memset(cids, 0x00, num_channels * sizeof(uint16_t));
1862                 l2cap_send_general_signaling_packet(handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_RESPONSE,
1863                                                     sig_id, 0, 0, 0, result, cids);
1864                 break;
1865             }
1866 
1867             case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
1868                 l2cap_send_general_signaling_packet(handle, signaling_cid, L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE,
1869                                                     sig_id, result);
1870                 break;
1871 #endif
1872             case SM_PAIRING_FAILED:
1873                 buffer[0] = SM_CODE_PAIRING_FAILED;
1874                 buffer[1] = result;
1875                 l2cap_send_connectionless(handle, source_cid, buffer, 2);
1876                 break;
1877             default:
1878                 // should not happen
1879                 break;
1880         }
1881     }
1882 }
1883 
1884 #ifdef ENABLE_CLASSIC
1885 static bool l2ap_run_information_requests(void){
1886     // send l2cap information request if requested
1887     btstack_linked_list_iterator_t it;
1888     hci_connections_get_iterator(&it);
1889     uint8_t info_type;
1890     l2cap_information_state_t new_state;
1891     while(btstack_linked_list_iterator_has_next(&it)){
1892         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
1893         switch (connection->l2cap_state.information_state){
1894             case L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST:
1895                 info_type = L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED;
1896                 new_state = L2CAP_INFORMATION_STATE_W4_EXTENDED_FEATURE_RESPONSE;
1897                 break;
1898             case L2CAP_INFORMATION_STATE_W2_SEND_FIXED_CHANNELS_REQUEST:
1899                 info_type = L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED;
1900                 new_state = L2CAP_INFORMATION_STATE_W4_FIXED_CHANNELS_RESPONSE;
1901                 break;
1902             default:
1903                 continue;
1904         }
1905         if (!hci_can_send_acl_packet_now(connection->con_handle)) break;
1906 
1907         connection->l2cap_state.information_state = new_state;
1908         uint8_t sig_id = l2cap_next_sig_id();
1909         l2cap_send_classic_signaling_packet(connection->con_handle, INFORMATION_REQUEST, sig_id, info_type);
1910     }
1911     return false;
1912 }
1913 #endif
1914 
1915 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
1916 static void l2cap_run_le_data_channels(void){
1917     btstack_linked_list_iterator_t it;
1918     btstack_linked_list_iterator_init(&it, &l2cap_channels);
1919     while (btstack_linked_list_iterator_has_next(&it)){
1920         uint16_t mps;
1921         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
1922 
1923         if (channel->channel_type != L2CAP_CHANNEL_TYPE_LE_DATA_CHANNEL) continue;
1924 
1925         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
1926         switch (channel->state){
1927             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST:
1928                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1929                 channel->state = L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE;
1930                 // le psm, source cid, mtu, mps, initial credits
1931                 channel->local_sig_id = l2cap_next_sig_id();
1932                 channel->credits_incoming =  channel->new_credits_incoming;
1933                 channel->new_credits_incoming = 0;
1934                 mps = btstack_min(l2cap_max_le_mtu(), channel->local_mtu);
1935                 l2cap_send_le_signaling_packet( channel->con_handle, LE_CREDIT_BASED_CONNECTION_REQUEST, channel->local_sig_id, channel->psm, channel->local_cid, channel->local_mtu, mps, channel->credits_incoming);
1936                 break;
1937             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT:
1938                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1939                 // TODO: support larger MPS
1940                 channel->state = L2CAP_STATE_OPEN;
1941                 channel->credits_incoming =  channel->new_credits_incoming;
1942                 channel->new_credits_incoming = 0;
1943                 mps = btstack_min(l2cap_max_le_mtu(), channel->local_mtu);
1944                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->local_mtu, mps, channel->credits_incoming, 0);
1945                 // notify client
1946                 l2cap_emit_le_channel_opened(channel, 0);
1947                 break;
1948             case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE:
1949                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1950                 channel->state = L2CAP_STATE_INVALID;
1951                 l2cap_send_le_signaling_packet(channel->con_handle, LE_CREDIT_BASED_CONNECTION_RESPONSE, channel->remote_sig_id, 0, 0, 0, 0, channel->reason);
1952                 // discard channel - l2cap_finialize_channel_close without sending l2cap close event
1953                 btstack_linked_list_iterator_remove(&it);
1954                 l2cap_free_channel_entry(channel);
1955                 break;
1956             case L2CAP_STATE_OPEN:
1957                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1958                 if (channel->new_credits_incoming){
1959                     l2cap_credit_based_send_credits(channel);
1960                 }
1961                 break;
1962             case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
1963                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1964                 channel->local_sig_id = l2cap_next_sig_id();
1965                 channel->state = L2CAP_STATE_WAIT_DISCONNECT;
1966                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_REQUEST, channel->local_sig_id, channel->remote_cid, channel->local_cid);
1967                 break;
1968             case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
1969                 if (!hci_can_send_acl_packet_now(channel->con_handle)) break;
1970                 channel->state = L2CAP_STATE_INVALID;
1971                 l2cap_send_le_signaling_packet( channel->con_handle, DISCONNECTION_RESPONSE, channel->remote_sig_id, channel->local_cid, channel->remote_cid);
1972                 l2cap_le_finialize_channel_close(channel);  // -- remove from list
1973                 break;
1974             default:
1975                 break;
1976         }
1977     }
1978 }
1979 #endif
1980 
1981 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
1982 
1983 // 11BH22222
1984 static void l2cap_emit_enhanced_data_channel_opened(l2cap_channel_t *channel, uint8_t status) {
1985     log_info("opened enhanced channel status 0x%x addr_type %u addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u",
1986             status, channel->address_type, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
1987             channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu);
1988     uint8_t event[23];
1989     event[0] = L2CAP_EVENT_DATA_CHANNEL_OPENED;
1990     event[1] = sizeof(event) - 2u;
1991     event[2] = status;
1992     event[3] = channel->address_type;
1993     reverse_bd_addr(channel->address, &event[4]);
1994     little_endian_store_16(event, 10, channel->con_handle);
1995     event[12] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
1996     little_endian_store_16(event, 13, channel->psm);
1997     little_endian_store_16(event, 15, channel->local_cid);
1998     little_endian_store_16(event, 17, channel->remote_cid);
1999     little_endian_store_16(event, 19, channel->local_mtu);
2000     little_endian_store_16(event, 21, channel->remote_mtu);
2001     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
2002     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2003 }
2004 
2005 static void l2cap_emit_enhanced_data_channel_reconfigure_complete(l2cap_channel_t *channel, uint16_t result) {
2006     // emit event
2007     uint8_t event[6];
2008     event[0] = L2CAP_EVENT_DATA_CHANNEL_RECONFIGURATION_COMPLETE;
2009     event[1] = sizeof(event) - 2;
2010     little_endian_store_16(event, 2, channel->local_cid);
2011     little_endian_store_16(event, 4, result);
2012     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
2013 }
2014 
2015 static void l2cap_run_enhanced_data_channels(void) {
2016     hci_con_handle_t con_handle = HCI_CON_HANDLE_INVALID;
2017     // num max channels + 1 for signaling pdu generator
2018     uint16_t cids[L2CAP_ENHANCED_DATA_CHANNEL_MAX_CID_ARRAY_SIZE + 1];
2019     uint8_t num_cids = 0;
2020     uint8_t sig_id;
2021     uint16_t spsm;
2022     L2CAP_STATE matching_state;
2023     bool match_remote_sig_cid;
2024     uint8_t result = 0;
2025     uint16_t local_mtu;
2026     uint16_t initial_credits;
2027     uint16_t signaling_cid;
2028     L2CAP_STATE new_state;
2029 
2030     // pick first channel that needs to send a combined signaling pdu and setup collection via break
2031     // then collect all others that belong to the same pdu
2032     btstack_linked_list_iterator_t it;
2033     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2034     while (btstack_linked_list_iterator_has_next(&it)) {
2035         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2036         if (channel->channel_type != L2CAP_CHANNEL_TYPE_ENHANCED_DATA_CHANNEL) continue;
2037         if (con_handle == HCI_CON_HANDLE_INVALID) {
2038             switch (channel->state) {
2039                 case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2040                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2041                     local_mtu = channel->local_mtu;
2042                     spsm = channel->psm;
2043                     result = channel->reason;
2044                     initial_credits = channel->credits_incoming;
2045                     sig_id = channel->local_sig_id;
2046                     new_state = L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE;
2047                     match_remote_sig_cid = false;
2048                     break;
2049                 case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE:
2050                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2051                     local_mtu = channel->local_mtu;
2052                     initial_credits = channel->credits_incoming;
2053                     sig_id = channel->remote_sig_id;
2054                     new_state = L2CAP_STATE_OPEN;
2055                     match_remote_sig_cid = true;
2056                     break;
2057                 case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2058                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2059                     sig_id = channel->local_sig_id;
2060                     local_mtu = channel->renegotiate_mtu;
2061                     new_state = L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE;
2062                     match_remote_sig_cid = false;
2063                     break;
2064                 case L2CAP_STATE_OPEN:
2065                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2066                     if (channel->new_credits_incoming) {
2067                         l2cap_credit_based_send_credits(channel);
2068                     }
2069                     continue;
2070                 case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2071                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2072                     channel->local_sig_id = l2cap_next_sig_id();
2073                     channel->state = L2CAP_STATE_WAIT_DISCONNECT;
2074                     signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2075                     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, DISCONNECTION_REQUEST,
2076                                                         channel->local_sig_id, channel->remote_cid, channel->local_cid);
2077                     continue;
2078                 case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
2079                     if (!hci_can_send_acl_packet_now(channel->con_handle)) continue;
2080                     channel->state = L2CAP_STATE_INVALID;
2081                     signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2082                     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, DISCONNECTION_RESPONSE,
2083                                                         channel->remote_sig_id, channel->local_cid,
2084                                                         channel->remote_cid);
2085                     l2cap_le_finialize_channel_close(channel);  // -- remove from list
2086                     continue;
2087                 default:
2088                     continue;
2089             }
2090 
2091             // channel picked - setup cid array and collect info
2092             (void) memset(cids, 0xff, sizeof(cids));
2093             (void) memset(cids, 0, channel->num_cids * sizeof(uint16_t));
2094             matching_state = channel->state;
2095             con_handle = channel->con_handle;
2096             signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
2097             num_cids = channel->num_cids;
2098 
2099         } else {
2100             // check if it matches first channel by state, con_handle, and signaling id
2101             if (matching_state != channel->state) continue;
2102             if (channel->con_handle != con_handle) continue;
2103             if (match_remote_sig_cid) {
2104                 if (channel->remote_sig_id != sig_id) continue;
2105             } else {
2106                 if (channel->local_sig_id != sig_id) continue;
2107             }
2108         }
2109 
2110         // add this cid
2111         cids[channel->cid_index] = channel->local_cid;
2112 
2113         // set new state
2114         channel->state = new_state;
2115 
2116         // handle open for L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE
2117         if (matching_state == L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE) {
2118             if (channel->reason == 0) {
2119                 l2cap_emit_enhanced_data_channel_opened(channel, ERROR_CODE_SUCCESS);
2120             } else {
2121                 result = channel->reason;
2122                 btstack_linked_list_iterator_remove(&it);
2123                 btstack_memory_l2cap_channel_free(channel);
2124             }
2125         }
2126     }
2127 
2128     if (con_handle != HCI_CON_HANDLE_INVALID) {
2129         // TODO: get MTU for both BR/EDR and LE
2130         uint16_t mps = btstack_min(l2cap_enhanced_mps_max, btstack_min(l2cap_max_le_mtu(), local_mtu));
2131         switch (matching_state) {
2132             case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2133                 log_info("send combined connection request for %u cids", num_cids);
2134                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_REQUEST,
2135                                                     sig_id, spsm, local_mtu, mps, initial_credits, cids);
2136                 break;
2137             case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE:
2138                 log_info("send combined connection response for %u cids", num_cids);
2139                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_CONNECTION_RESPONSE,
2140                                                     sig_id, local_mtu, mps, initial_credits, result, cids);
2141                 break;
2142             case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2143                 log_info("send combined renegotiation request for %u cids", num_cids);
2144                 l2cap_send_general_signaling_packet(con_handle, signaling_cid, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST,
2145                                                     sig_id, local_mtu, mps, cids);
2146                 break;
2147             default:
2148                 break;
2149         }
2150     }
2151 }
2152 #endif
2153 
2154 // MARK: L2CAP_RUN
2155 // process outstanding signaling tasks
2156 static void l2cap_run(void){
2157 
2158     // log_info("l2cap_run: entered");
2159     l2cap_run_signaling_response();
2160 
2161 #ifdef ENABLE_CLASSIC
2162     bool done = l2ap_run_information_requests();
2163     if (done) return;
2164 #endif
2165 
2166 #if defined(ENABLE_CLASSIC) || defined(ENABLE_BLE)
2167     btstack_linked_list_iterator_t it;
2168 #endif
2169 
2170 #ifdef ENABLE_CLASSIC
2171     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2172     while (btstack_linked_list_iterator_has_next(&it)){
2173 
2174         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2175 
2176         if (channel->channel_type != L2CAP_CHANNEL_TYPE_CLASSIC) continue;
2177 
2178         // log_info("l2cap_run: channel %p, state %u, var 0x%02x", channel, channel->state, channel->state_var);
2179         bool finalized = l2cap_run_for_classic_channel(channel);
2180 
2181         if (!finalized) {
2182 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2183             l2cap_run_for_classic_channel_ertm(channel);
2184 #endif
2185         }
2186     }
2187 #endif
2188 
2189 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2190     l2cap_run_le_data_channels();
2191 #endif
2192 
2193 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
2194     l2cap_run_enhanced_data_channels();
2195 #endif
2196 
2197 #ifdef ENABLE_BLE
2198     // send l2cap con paramter update if necessary
2199     hci_connections_get_iterator(&it);
2200     while(btstack_linked_list_iterator_has_next(&it)){
2201         hci_connection_t * connection = (hci_connection_t *) btstack_linked_list_iterator_next(&it);
2202         if ((connection->address_type != BD_ADDR_TYPE_LE_PUBLIC) && (connection->address_type != BD_ADDR_TYPE_LE_RANDOM)) continue;
2203         if (!hci_can_send_acl_packet_now(connection->con_handle)) continue;
2204         switch (connection->le_con_parameter_update_state){
2205             case CON_PARAMETER_UPDATE_SEND_REQUEST:
2206                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
2207                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_REQUEST, l2cap_next_sig_id(),
2208                                                connection->le_conn_interval_min, connection->le_conn_interval_max, connection->le_conn_latency, connection->le_supervision_timeout);
2209                 break;
2210             case CON_PARAMETER_UPDATE_SEND_RESPONSE:
2211                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_CHANGE_HCI_CON_PARAMETERS;
2212                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 0);
2213                 break;
2214             case CON_PARAMETER_UPDATE_DENY:
2215                 connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_NONE;
2216                 l2cap_send_le_signaling_packet(connection->con_handle, CONNECTION_PARAMETER_UPDATE_RESPONSE, connection->le_con_param_update_identifier, 1);
2217                 break;
2218             default:
2219                 break;
2220         }
2221     }
2222 #endif
2223 
2224     if (l2cap_call_notify_channel_in_run){
2225         l2cap_call_notify_channel_in_run = false;
2226         l2cap_notify_channel_can_send();
2227     }
2228 
2229     // log_info("l2cap_run: exit");
2230 }
2231 
2232 #ifdef ENABLE_CLASSIC
2233 static void l2cap_ready_to_connect(l2cap_channel_t * channel){
2234 
2235 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2236     // assumption: outgoing connection
2237     if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
2238         // ERTM requested: trigger information request if not already started then wait for response
2239         hci_connection_t * connection = hci_connection_for_handle(channel->con_handle);
2240         switch (connection->l2cap_state.information_state){
2241             case L2CAP_INFORMATION_STATE_DONE:
2242                 break;
2243             case L2CAP_INFORMATION_STATE_IDLE:
2244                 connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
2245                 /* fall through */
2246             default:
2247                 channel->state = L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES;
2248                 return;
2249         }
2250     }
2251 #endif
2252 
2253     // fine, go ahead
2254     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
2255 }
2256 
2257 static void l2cap_handle_connection_complete(hci_con_handle_t con_handle, l2cap_channel_t * channel){
2258     if ((channel->state == L2CAP_STATE_WAIT_CONNECTION_COMPLETE) || (channel->state == L2CAP_STATE_WILL_SEND_CREATE_CONNECTION)) {
2259         log_info("connection complete con_handle %04x - for channel %p cid 0x%04x", (int) con_handle, channel, channel->local_cid);
2260         channel->con_handle = con_handle;
2261         // query remote features if pairing is required
2262         if (channel->required_security_level > LEVEL_0){
2263             channel->state = L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES;
2264             hci_remote_features_query(con_handle);
2265         } else {
2266             l2cap_ready_to_connect(channel);
2267         }
2268     }
2269 }
2270 
2271 static void l2cap_handle_remote_supported_features_received(l2cap_channel_t * channel){
2272     if (channel->state != L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES) return;
2273     // double check if all feature pages are complete
2274 
2275     bool security_required = channel->required_security_level > LEVEL_0;
2276 
2277     // abort if Secure Connections Only Mode with legacy connection
2278     if (security_required && gap_get_secure_connections_only_mode() && gap_secure_connection(channel->con_handle) == 0){
2279         l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY);
2280         btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t  *) channel);
2281         l2cap_free_channel_entry(channel);
2282         return;
2283     }
2284 
2285     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) != 0){
2286 
2287         // Core V5.2, Vol 3, Part C, 5.2.2.2 - Security Mode 4
2288         //   When a remote device attempts to access a service offered by a Bluetooth device that is in security mode 4
2289         //   and a sufficient link key exists and authentication has not been performed the local device shall authenticate
2290         //   the remote device and enable encryption after the channel establishment request is received but before a channel
2291         //   establishment confirmation (L2CAP_ConnectRsp with result code of 0x0000 or a higher-level channel establishment
2292         //   confirmation such as that of RFCOMM) is sent.
2293 
2294         //   If the remote device has indicated support for Secure Simple Pairing, a channel establishment request is
2295         //   received for a service other than SDP, and encryption has not yet been enabled, then the local device shall
2296         //   disconnect the ACL link with error code 0x05 - Authentication Failure.
2297 
2298         // => Disconnect if l2cap request received in mode 4 and ssp supported, non-sdp psm, not encrypted, no link key available
2299         if ((gap_get_security_mode() == GAP_SECURITY_MODE_4)
2300         && gap_ssp_supported_on_both_sides(channel->con_handle)
2301         && (channel->psm != PSM_SDP)
2302         && (gap_encryption_key_size(channel->con_handle) == 0)
2303         && (gap_bonded(channel->con_handle) == false)){
2304             hci_disconnect_security_block(channel->con_handle);
2305             return;
2306         }
2307 
2308         // incoming: assert security requirements
2309         channel->state = L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE;
2310         if (channel->required_security_level <= gap_security_level(channel->con_handle)){
2311             l2cap_handle_security_level_incoming_sufficient(channel);
2312         } else {
2313             // send connection pending if not already done
2314             if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONN_RESP_PEND) == 0){
2315                 channel->state_var |= L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND;
2316             }
2317             gap_request_security_level(channel->con_handle, channel->required_security_level);
2318         }
2319     } else {
2320         // outgoing: we have been waiting for remote supported features
2321         if (security_required){
2322             // request security level
2323             channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
2324             gap_request_security_level(channel->con_handle, channel->required_security_level);
2325         } else {
2326             l2cap_ready_to_connect(channel);
2327         }
2328     }
2329 }
2330 #endif
2331 
2332 #ifdef L2CAP_USES_CHANNELS
2333 static l2cap_channel_t * l2cap_create_channel_entry(btstack_packet_handler_t packet_handler, l2cap_channel_type_t channel_type, bd_addr_t address, bd_addr_type_t address_type,
2334     uint16_t psm, uint16_t local_mtu, gap_security_level_t security_level){
2335 
2336     l2cap_channel_t * channel = btstack_memory_l2cap_channel_get();
2337     if (!channel) {
2338         return NULL;
2339     }
2340 
2341     // fill in
2342     channel->packet_handler = packet_handler;
2343     channel->channel_type   = channel_type;
2344     bd_addr_copy(channel->address, address);
2345     channel->address_type = address_type;
2346     channel->psm = psm;
2347     channel->local_mtu  = local_mtu;
2348     channel->remote_mtu = L2CAP_DEFAULT_MTU;
2349     channel->required_security_level = security_level;
2350 
2351     //
2352     channel->local_cid = l2cap_next_local_cid();
2353     channel->con_handle = HCI_CON_HANDLE_INVALID;
2354 
2355     // set initial state
2356     channel->state = L2CAP_STATE_WILL_SEND_CREATE_CONNECTION;
2357     channel->state_var = L2CAP_CHANNEL_STATE_VAR_NONE;
2358     channel->remote_sig_id = L2CAP_SIG_ID_INVALID;
2359     channel->local_sig_id = L2CAP_SIG_ID_INVALID;
2360 
2361     log_info("create channel %p, local_cid 0x%04x", channel, channel->local_cid);
2362 
2363     return channel;
2364 }
2365 
2366 static void l2cap_free_channel_entry(l2cap_channel_t * channel){
2367     log_info("free channel %p, local_cid 0x%04x", channel, channel->local_cid);
2368     // assert all timers are stopped
2369     l2cap_stop_rtx(channel);
2370 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2371     l2cap_ertm_stop_retransmission_timer(channel);
2372     l2cap_ertm_stop_monitor_timer(channel);
2373 #endif
2374     // free  memory
2375     btstack_memory_l2cap_channel_free(channel);
2376 }
2377 #endif
2378 
2379 #ifdef ENABLE_CLASSIC
2380 
2381 /**
2382  * @brief Creates L2CAP channel to the PSM of a remote device with baseband address. A new baseband connection will be initiated if necessary.
2383  * @param packet_handler
2384  * @param address
2385  * @param psm
2386  * @param mtu
2387  * @param local_cid
2388  */
2389 
2390 uint8_t l2cap_create_channel(btstack_packet_handler_t channel_packet_handler, bd_addr_t address, uint16_t psm, uint16_t mtu, uint16_t * out_local_cid){
2391     // limit MTU to the size of our outgoing HCI buffer
2392     uint16_t local_mtu = btstack_min(mtu, l2cap_max_mtu());
2393 
2394 	// determine security level based on psm
2395 	const gap_security_level_t security_level = l2cap_security_level_0_allowed_for_PSM(psm) ? LEVEL_0 : gap_get_security_level();
2396 	log_info("create channel addr %s psm 0x%x mtu %u -> local mtu %u, sec level %u", bd_addr_to_str(address), psm, mtu, local_mtu, (int) security_level);
2397 
2398     l2cap_channel_t * channel = l2cap_create_channel_entry(channel_packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, address, BD_ADDR_TYPE_ACL, psm, local_mtu, security_level);
2399     if (!channel) {
2400         return BTSTACK_MEMORY_ALLOC_FAILED;
2401     }
2402 
2403 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2404     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
2405 #endif
2406 
2407     // add to connections list
2408     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
2409 
2410     // store local_cid
2411     if (out_local_cid){
2412        *out_local_cid = channel->local_cid;
2413     }
2414 
2415 	// state: L2CAP_STATE_WILL_SEND_CREATE_CONNECTION
2416 
2417     // check if hci connection is already usable,
2418     hci_connection_t * conn = hci_connection_for_bd_addr_and_type(address, BD_ADDR_TYPE_ACL);
2419     if (conn && conn->state == OPEN){
2420     	// simulate connection complete
2421 	    l2cap_handle_connection_complete(conn->con_handle, channel);
2422 
2423 	    // state: L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES or L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST
2424 
2425         // simulate if remote supported features if requested and already received
2426         if ((channel->state == L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES) && hci_remote_features_available(conn->con_handle)) {
2427         	// simulate remote features received
2428             l2cap_handle_remote_supported_features_received(channel);
2429         }
2430     }
2431 
2432     l2cap_run();
2433 
2434     return ERROR_CODE_SUCCESS;
2435 }
2436 
2437 void l2cap_disconnect(uint16_t local_cid, uint8_t reason){
2438     log_info("disconnect local_cid 0x%x reason 0x%x", local_cid, reason);
2439     UNUSED(reason);
2440     // find channel for local_cid
2441     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
2442     if (channel) {
2443         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
2444     }
2445     // process
2446     l2cap_run();
2447 }
2448 
2449 static void l2cap_handle_connection_failed_for_addr(bd_addr_t address, uint8_t status){
2450     // mark all channels before emitting open events as these could trigger new connetion requests to the same device
2451     btstack_linked_list_iterator_t it;
2452     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2453     while (btstack_linked_list_iterator_has_next(&it)){
2454         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2455         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2456         if (bd_addr_cmp( channel->address, address) != 0) continue;
2457         // channel for this address found
2458         switch (channel->state){
2459             case L2CAP_STATE_WAIT_CONNECTION_COMPLETE:
2460             case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
2461                 channel->state = L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD;
2462                 break;
2463             default:
2464                 break;
2465         }
2466     }
2467     // emit and free marked entries. restart loop to deal with list changes
2468     int done = 0;
2469     while (!done) {
2470         done = 1;
2471         btstack_linked_list_iterator_init(&it, &l2cap_channels);
2472         while (btstack_linked_list_iterator_has_next(&it)){
2473             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2474             if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2475             if (channel->state == L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD){
2476                 done = 0;
2477                 // failure, forward error code
2478                 l2cap_handle_channel_open_failed(channel, status);
2479                 // discard channel
2480                 btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2481                 l2cap_free_channel_entry(channel);
2482                 break;
2483             }
2484         }
2485     }
2486 
2487 }
2488 
2489 static void l2cap_handle_connection_success_for_addr(bd_addr_t address, hci_con_handle_t handle){
2490     btstack_linked_list_iterator_t it;
2491     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2492     while (btstack_linked_list_iterator_has_next(&it)){
2493         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2494         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2495         if ( ! bd_addr_cmp( channel->address, address) ){
2496             l2cap_handle_connection_complete(handle, channel);
2497         }
2498     }
2499     // process
2500     l2cap_run();
2501 }
2502 #endif
2503 
2504 static bool l2cap_channel_ready_to_send(l2cap_channel_t * channel){
2505     switch (channel->channel_type){
2506 #ifdef ENABLE_CLASSIC
2507         case L2CAP_CHANNEL_TYPE_CLASSIC:
2508             if (channel->state != L2CAP_STATE_OPEN) return false;
2509 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2510             // send if we have more data and remote windows isn't full yet
2511             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) {
2512                 if (channel->unacked_frames >= btstack_min(channel->num_stored_tx_frames, channel->remote_tx_window_size)) return false;
2513                 return hci_can_send_acl_classic_packet_now() != 0;
2514             }
2515 #endif
2516             if (!channel->waiting_for_can_send_now) return false;
2517             return (hci_can_send_acl_classic_packet_now() != 0);
2518         case L2CAP_CHANNEL_TYPE_CONNECTIONLESS:
2519             if (!channel->waiting_for_can_send_now) return false;
2520             return hci_can_send_acl_classic_packet_now() != 0;
2521 #endif
2522 #ifdef ENABLE_BLE
2523         case L2CAP_CHANNEL_TYPE_FIXED:
2524             if (!channel->waiting_for_can_send_now) return false;
2525             return hci_can_send_acl_le_packet_now() != 0;
2526 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2527         case L2CAP_CHANNEL_TYPE_LE_DATA_CHANNEL:
2528             if (channel->state != L2CAP_STATE_OPEN) return false;
2529             if (channel->send_sdu_buffer == NULL) return false;
2530             if (channel->credits_outgoing == 0u) return false;
2531             return hci_can_send_acl_le_packet_now() != 0;
2532 #endif
2533 #endif
2534 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
2535         case L2CAP_CHANNEL_TYPE_ENHANCED_DATA_CHANNEL:
2536             if (channel->state != L2CAP_STATE_OPEN) return false;
2537             if (channel->send_sdu_buffer == NULL) return false;
2538             if (channel->credits_outgoing == 0u) return false;
2539             if (channel->address_type == BD_ADDR_TYPE_ACL) {
2540                 return hci_can_send_acl_classic_packet_now() != 0;
2541             } else {
2542                 return hci_can_send_acl_le_packet_now() != 0;
2543             }
2544 #endif
2545         default:
2546             return false;
2547     }
2548 }
2549 
2550 static void l2cap_channel_trigger_send(l2cap_channel_t * channel){
2551     switch (channel->channel_type){
2552 #ifdef ENABLE_CLASSIC
2553         case L2CAP_CHANNEL_TYPE_CLASSIC:
2554 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
2555             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) {
2556                 l2cap_ertm_channel_send_information_frame(channel);
2557                 return;
2558             }
2559 #endif
2560             channel->waiting_for_can_send_now = 0;
2561             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2562             break;
2563         case L2CAP_CHANNEL_TYPE_CONNECTIONLESS:
2564             channel->waiting_for_can_send_now = 0;
2565             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2566             break;
2567 #endif
2568 #ifdef ENABLE_BLE
2569         case L2CAP_CHANNEL_TYPE_FIXED:
2570             channel->waiting_for_can_send_now = 0;
2571             l2cap_emit_can_send_now(channel->packet_handler, channel->local_cid);
2572             break;
2573 #endif
2574 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2575         case L2CAP_CHANNEL_TYPE_LE_DATA_CHANNEL:
2576             l2cap_credit_based_send_pdu(channel);
2577             break;
2578 #endif
2579 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
2580         case L2CAP_CHANNEL_TYPE_ENHANCED_DATA_CHANNEL:
2581             l2cap_credit_based_send_pdu(channel);
2582             break;
2583 #endif
2584         default:
2585             break;
2586     }
2587 }
2588 
2589 static void l2cap_notify_channel_can_send(void){
2590     bool done = false;
2591     while (!done){
2592         done = true;
2593         btstack_linked_list_iterator_t it;
2594         btstack_linked_list_iterator_init(&it, &l2cap_channels);
2595         while (btstack_linked_list_iterator_has_next(&it)){
2596             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2597             bool ready = l2cap_channel_ready_to_send(channel);
2598             if (!ready) continue;
2599 
2600             // requeue channel for fairness
2601             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
2602             btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
2603 
2604             // trigger sending
2605             l2cap_channel_trigger_send(channel);
2606 
2607             // exit inner loop as we just broke the iterator, but try again
2608             done = false;
2609             break;
2610         }
2611     }
2612 }
2613 
2614 #ifdef L2CAP_USES_CHANNELS
2615 
2616 static int l2cap_send_open_failed_on_hci_disconnect(l2cap_channel_t * channel){
2617     // open cannot fail for for incoming connections
2618     if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) return 0;
2619 
2620     // check state
2621     switch (channel->state){
2622         case L2CAP_STATE_WILL_SEND_CREATE_CONNECTION:
2623         case L2CAP_STATE_WAIT_CONNECTION_COMPLETE:
2624         case L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES:
2625         case L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE:
2626         case L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT:
2627         case L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES:
2628         case L2CAP_STATE_WAIT_CONNECT_RSP:
2629         case L2CAP_STATE_CONFIG:
2630         case L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST:
2631         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST:
2632         case L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE:
2633         case L2CAP_STATE_EMIT_OPEN_FAILED_AND_DISCARD:
2634             return 1;
2635 
2636         case L2CAP_STATE_OPEN:
2637         case L2CAP_STATE_CLOSED:
2638         case L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES:
2639         case L2CAP_STATE_WAIT_DISCONNECT:
2640         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_INSUFFICIENT_SECURITY:
2641         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE:
2642         case L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT:
2643         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2644         case L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE:
2645         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE:
2646         case L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT:
2647         case L2CAP_STATE_INVALID:
2648         case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
2649             return 0;
2650 
2651         default:
2652             // get a "warning" about new states
2653             btstack_assert(false);
2654             return 0;
2655     }
2656 }
2657 #endif
2658 
2659 #ifdef ENABLE_CLASSIC
2660 static void l2cap_handle_hci_disconnect_event(l2cap_channel_t * channel){
2661     if (l2cap_send_open_failed_on_hci_disconnect(channel)){
2662         l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2663     } else {
2664         l2cap_handle_channel_closed(channel);
2665     }
2666     l2cap_free_channel_entry(channel);
2667 }
2668 #endif
2669 
2670 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2671 static void l2cap_handle_hci_le_disconnect_event(l2cap_channel_t * channel){
2672     if (l2cap_send_open_failed_on_hci_disconnect(channel)){
2673         l2cap_emit_le_channel_opened(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2674     } else {
2675         l2cap_emit_le_channel_closed(channel);
2676     }
2677     l2cap_free_channel_entry(channel);
2678 }
2679 #endif
2680 
2681 #ifdef ENABLE_CLASSIC
2682 static void l2cap_check_classic_timeout(hci_con_handle_t handle){
2683     if (gap_get_connection_type(handle) != GAP_CONNECTION_ACL) {
2684         return;
2685     }
2686     if (hci_authentication_active_for_handle(handle)) {
2687         return;
2688     }
2689     bool hci_con_used = false;
2690     btstack_linked_list_iterator_t it;
2691     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2692     while (btstack_linked_list_iterator_has_next(&it)){
2693         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2694         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2695         if (channel->con_handle != handle) continue;
2696         hci_con_used = true;
2697         break;
2698     }
2699     if (hci_con_used) {
2700         return;
2701     }
2702     if (!hci_can_send_command_packet_now()) {
2703         return;
2704     }
2705     hci_send_cmd(&hci_disconnect, handle, 0x13); // remote closed connection
2706 }
2707 
2708 static void l2cap_handle_features_complete(hci_con_handle_t handle){
2709     if (hci_remote_features_available(handle) == false){
2710         return;
2711     }
2712     btstack_linked_list_iterator_t it;
2713     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2714     while (btstack_linked_list_iterator_has_next(&it)){
2715         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2716         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2717         if (channel->con_handle != handle) continue;
2718         log_info("remote supported features, channel %p, cid %04x - state %u", channel, channel->local_cid, channel->state);
2719         l2cap_handle_remote_supported_features_received(channel);
2720     }
2721 }
2722 
2723 static void l2cap_handle_security_level_incoming_sufficient(l2cap_channel_t * channel){
2724     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
2725     l2cap_emit_incoming_connection(channel);
2726 }
2727 
2728 static void l2cap_handle_security_level(hci_con_handle_t handle, gap_security_level_t actual_level){
2729     log_info("security level update for handle 0x%04x", handle);
2730 
2731     // trigger l2cap information requests
2732     if (actual_level > LEVEL_0){
2733         hci_connection_t * hci_connection = hci_connection_for_handle(handle);
2734         btstack_assert(hci_connection != NULL);
2735         if (hci_connection->l2cap_state.information_state == L2CAP_INFORMATION_STATE_IDLE){
2736             hci_connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_EXTENDED_FEATURE_REQUEST;
2737         }
2738     }
2739 
2740     btstack_linked_list_iterator_t it;
2741     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2742     while (btstack_linked_list_iterator_has_next(&it)){
2743         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2744         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2745         if (channel->con_handle != handle) continue;
2746 
2747         gap_security_level_t required_level = channel->required_security_level;
2748 
2749         log_info("channel %p, cid %04x - state %u: actual %u >= required %u?", channel, channel->local_cid, channel->state, actual_level, required_level);
2750 
2751         switch (channel->state){
2752             case L2CAP_STATE_WAIT_INCOMING_SECURITY_LEVEL_UPDATE:
2753                 if (actual_level >= required_level){
2754                     l2cap_handle_security_level_incoming_sufficient(channel);
2755                 } else {
2756                     channel->reason = 0x0003; // security block
2757                     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
2758                 }
2759                 break;
2760 
2761             case L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE:
2762                 if (actual_level >= required_level){
2763                     l2cap_ready_to_connect(channel);
2764                 } else {
2765                     // security level insufficient, report error and free channel
2766                     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY);
2767                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t  *) channel);
2768                     l2cap_free_channel_entry(channel);
2769                 }
2770                 break;
2771 
2772             default:
2773                 break;
2774         }
2775     }
2776 }
2777 #endif
2778 
2779 #ifdef L2CAP_USES_CHANNELS
2780 static void l2cap_handle_disconnection_complete(hci_con_handle_t handle){
2781     // collect channels to close
2782     btstack_linked_list_t channels_to_close = NULL;
2783     btstack_linked_list_iterator_t it;
2784     btstack_linked_list_iterator_init(&it, &l2cap_channels);
2785     while (btstack_linked_list_iterator_has_next(&it)) {
2786         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2787         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
2788         if (channel->con_handle != handle) continue;
2789         btstack_linked_list_iterator_remove(&it);
2790         btstack_linked_list_add(&channels_to_close, (btstack_linked_item_t *) channel);
2791     }
2792     // send l2cap open failed or closed events for all channels on this handle and free them
2793     btstack_linked_list_iterator_init(&it, &channels_to_close);
2794     while (btstack_linked_list_iterator_has_next(&it)) {
2795         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
2796         btstack_linked_list_iterator_remove(&it);
2797         switch(channel->channel_type){
2798 #ifdef ENABLE_CLASSIC
2799             case L2CAP_CHANNEL_TYPE_CLASSIC:
2800                 l2cap_handle_hci_disconnect_event(channel);
2801                 break;
2802 #endif
2803 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
2804             case L2CAP_CHANNEL_TYPE_LE_DATA_CHANNEL:
2805                 l2cap_handle_hci_le_disconnect_event(channel);
2806                 break;
2807 #endif
2808 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
2809             case L2CAP_CHANNEL_TYPE_ENHANCED_DATA_CHANNEL:
2810                 switch (channel->state) {
2811                     case L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST:
2812                     case L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE:
2813                         // emit open failed if disconnected before connection complete
2814                         l2cap_emit_enhanced_data_channel_opened(channel, L2CAP_CONNECTION_BASEBAND_DISCONNECT);
2815                         break;
2816                     case L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST:
2817                     case L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE:
2818                         // emit reconfigure failure - result = 0xffff
2819                         l2cap_emit_enhanced_data_channel_reconfigure_complete(channel, 0xffff);
2820                         break;
2821                     default:
2822                         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_DATA_CHANNEL_CLOSED);
2823                         break;
2824                 }
2825                 l2cap_free_channel_entry(channel);
2826                 break;
2827 #endif
2828             default:
2829                 break;
2830         }
2831     }
2832 }
2833 #endif
2834 
2835 static void l2cap_hci_event_handler(uint8_t packet_type, uint16_t cid, uint8_t *packet, uint16_t size){
2836 
2837     UNUSED(packet_type); // ok: registered with hci_event_callback_registration
2838     UNUSED(cid);         // ok: there is no channel
2839     UNUSED(size);        // ok: fixed format events read from HCI buffer
2840 
2841 #ifdef ENABLE_CLASSIC
2842     bd_addr_t address;
2843     gap_security_level_t security_level;
2844 #endif
2845 #ifdef L2CAP_USES_CHANNELS
2846     hci_con_handle_t handle;
2847 #endif
2848 
2849     switch(hci_event_packet_get_type(packet)){
2850 
2851         // Notify channel packet handler if they can send now
2852         case HCI_EVENT_TRANSPORT_PACKET_SENT:
2853         case HCI_EVENT_NUMBER_OF_COMPLETED_PACKETS:
2854         case BTSTACK_EVENT_NR_CONNECTIONS_CHANGED:
2855             l2cap_call_notify_channel_in_run = true;
2856             break;
2857 
2858         case HCI_EVENT_COMMAND_STATUS:
2859 #ifdef ENABLE_CLASSIC
2860             // check command status for create connection for errors
2861             if (HCI_EVENT_IS_COMMAND_STATUS(packet, hci_create_connection)){
2862                 // cache outgoing address and reset
2863                 (void)memcpy(address, l2cap_outgoing_classic_addr, 6);
2864                 memset(l2cap_outgoing_classic_addr, 0, 6);
2865                 // error => outgoing connection failed
2866                 uint8_t status = hci_event_command_status_get_status(packet);
2867                 if (status){
2868                     l2cap_handle_connection_failed_for_addr(address, status);
2869                 }
2870             }
2871 #endif
2872             l2cap_run();    // try sending signaling packets first
2873             break;
2874 
2875 #ifdef ENABLE_CLASSIC
2876         // handle connection complete events
2877         case HCI_EVENT_CONNECTION_COMPLETE:
2878             reverse_bd_addr(&packet[5], address);
2879             if (packet[2] == 0){
2880                 handle = little_endian_read_16(packet, 3);
2881                 l2cap_handle_connection_success_for_addr(address, handle);
2882             } else {
2883                 l2cap_handle_connection_failed_for_addr(address, packet[2]);
2884             }
2885             break;
2886 
2887         // handle successful create connection cancel command
2888         case HCI_EVENT_COMMAND_COMPLETE:
2889             if (HCI_EVENT_IS_COMMAND_COMPLETE(packet, hci_create_connection_cancel)) {
2890                 if (packet[5] == 0){
2891                     reverse_bd_addr(&packet[6], address);
2892                     // CONNECTION TERMINATED BY LOCAL HOST (0X16)
2893                     l2cap_handle_connection_failed_for_addr(address, 0x16);
2894                 }
2895             }
2896             l2cap_run();    // try sending signaling packets first
2897             break;
2898 #endif
2899 
2900 #ifdef L2CAP_USES_CHANNELS
2901         // handle disconnection complete events
2902         case HCI_EVENT_DISCONNECTION_COMPLETE:
2903             handle = little_endian_read_16(packet, 3);
2904             l2cap_handle_disconnection_complete(handle);
2905             break;
2906 #endif
2907 
2908         // HCI Connection Timeouts
2909 #ifdef ENABLE_CLASSIC
2910         case L2CAP_EVENT_TIMEOUT_CHECK:
2911             handle = little_endian_read_16(packet, 2);
2912             l2cap_check_classic_timeout(handle);
2913             break;
2914 
2915         case HCI_EVENT_READ_REMOTE_SUPPORTED_FEATURES_COMPLETE:
2916         case HCI_EVENT_READ_REMOTE_EXTENDED_FEATURES_COMPLETE:
2917             handle = little_endian_read_16(packet, 3);
2918             l2cap_handle_features_complete(handle);
2919             break;
2920 
2921         case GAP_EVENT_SECURITY_LEVEL:
2922             handle = little_endian_read_16(packet, 2);
2923             security_level = (gap_security_level_t) packet[4];
2924             l2cap_handle_security_level(handle, security_level);
2925             break;
2926 #endif
2927         default:
2928             break;
2929     }
2930 
2931     l2cap_run();
2932 }
2933 
2934 static void l2cap_register_signaling_response(hci_con_handle_t handle, uint8_t code, uint8_t sig_id, uint16_t cid, uint16_t data){
2935     // Vol 3, Part A, 4.3: "The DCID and SCID fields shall be ignored when the result field indicates the connection was refused."
2936     if (l2cap_signaling_responses_pending < NR_PENDING_SIGNALING_RESPONSES) {
2937         l2cap_signaling_responses[l2cap_signaling_responses_pending].handle = handle;
2938         l2cap_signaling_responses[l2cap_signaling_responses_pending].code = code;
2939         l2cap_signaling_responses[l2cap_signaling_responses_pending].sig_id = sig_id;
2940         l2cap_signaling_responses[l2cap_signaling_responses_pending].cid = cid;
2941         l2cap_signaling_responses[l2cap_signaling_responses_pending].data = data;
2942         l2cap_signaling_responses_pending++;
2943         l2cap_run();
2944     }
2945 }
2946 
2947 #ifdef ENABLE_CLASSIC
2948 static void l2cap_handle_disconnect_request(l2cap_channel_t *channel, uint16_t identifier){
2949     switch (channel->state){
2950         case L2CAP_STATE_CONFIG:
2951         case L2CAP_STATE_OPEN:
2952         case L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST:
2953         case L2CAP_STATE_WAIT_DISCONNECT:
2954             break;
2955         default:
2956             // ignore in other states
2957             return;
2958     }
2959 
2960     channel->remote_sig_id = identifier;
2961     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
2962     l2cap_run();
2963 }
2964 
2965 static void l2cap_handle_connection_request(hci_con_handle_t handle, uint8_t sig_id, uint16_t psm, uint16_t source_cid){
2966 
2967     // log_info("l2cap_handle_connection_request for handle %u, psm %u cid 0x%02x", handle, psm, source_cid);
2968     l2cap_service_t *service = l2cap_get_service(psm);
2969     if (!service) {
2970         // 0x0002 PSM not supported
2971         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, 0x0002);
2972         return;
2973     }
2974 
2975     hci_connection_t * hci_connection = hci_connection_for_handle( handle );
2976     if (!hci_connection) {
2977         //
2978         log_error("no hci_connection for handle %u", handle);
2979         return;
2980     }
2981 
2982     // alloc structure
2983     gap_security_level_t required_level = service->required_security_level;
2984     if (gap_get_secure_connections_only_mode() && (required_level != LEVEL_0)){
2985         required_level = LEVEL_4;
2986     }
2987     l2cap_channel_t * channel = l2cap_create_channel_entry(service->packet_handler, L2CAP_CHANNEL_TYPE_CLASSIC, hci_connection->address, BD_ADDR_TYPE_ACL,
2988     psm, service->mtu, required_level);
2989     if (!channel){
2990         // 0x0004 No resources available
2991         l2cap_register_signaling_response(handle, CONNECTION_REQUEST, sig_id, source_cid, 0x0004);
2992         return;
2993     }
2994 
2995     channel->con_handle = handle;
2996     channel->remote_cid = source_cid;
2997     channel->remote_sig_id = sig_id;
2998 
2999     // limit local mtu to max acl packet length - l2cap header
3000     if (channel->local_mtu > l2cap_max_mtu()) {
3001         channel->local_mtu = l2cap_max_mtu();
3002     }
3003 
3004     // set initial state
3005     channel->state =     L2CAP_STATE_WAIT_REMOTE_SUPPORTED_FEATURES;
3006     channel->state_var = L2CAP_CHANNEL_STATE_VAR_INCOMING;
3007 
3008     // add to connections list
3009     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
3010 
3011     //
3012     if (required_level > LEVEL_0){
3013         // send conn resp pending if remote supported features have not been received yet
3014         if (hci_remote_features_available(handle)) {
3015             l2cap_handle_remote_supported_features_received(channel);
3016         } else {
3017             channel->state_var |= L2CAP_CHANNEL_STATE_VAR_SEND_CONN_RESP_PEND;
3018             hci_remote_features_query(handle);
3019         }
3020     } else {
3021         l2cap_handle_security_level_incoming_sufficient(channel);
3022     }
3023 }
3024 
3025 void l2cap_accept_connection(uint16_t local_cid){
3026     log_info("L2CAP_ACCEPT_CONNECTION local_cid 0x%x", local_cid);
3027     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
3028     if (!channel) {
3029         log_error("accept called but local_cid 0x%x not found", local_cid);
3030         return;
3031     }
3032 
3033 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3034     // configure L2CAP Basic mode
3035     channel->mode  = L2CAP_CHANNEL_MODE_BASIC;
3036 #endif
3037 
3038     channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
3039 
3040     // process
3041     l2cap_run();
3042 }
3043 
3044 void l2cap_decline_connection(uint16_t local_cid){
3045     log_info("decline local_cid 0x%x", local_cid);
3046     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid( local_cid);
3047     if (!channel) {
3048         log_error( "l2cap_decline_connection called but local_cid 0x%x not found", local_cid);
3049         return;
3050     }
3051     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
3052     channel->reason = 0x04; // no resources available
3053     l2cap_run();
3054 }
3055 
3056 // @pre command len is valid, see check in l2cap_signaling_handler_channel
3057 static void l2cap_signaling_handle_configure_request(l2cap_channel_t *channel, uint8_t *command){
3058 
3059 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3060     uint8_t use_fcs = 1;
3061 #endif
3062 
3063     channel->remote_sig_id = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3064 
3065     uint16_t flags = little_endian_read_16(command, 6);
3066     if (flags & 1) {
3067         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT);
3068     }
3069 
3070     // accept the other's configuration options
3071     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3072     uint16_t pos     = 8;
3073     while (pos < end_pos){
3074         uint8_t option_hint = command[pos] >> 7;
3075         uint8_t option_type = command[pos] & 0x7f;
3076         // log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
3077         pos++;
3078         uint8_t length = command[pos++];
3079         // MTU { type(8): 1, len(8):2, MTU(16) }
3080         if ((option_type == L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT) && (length == 2)){
3081             channel->remote_mtu = little_endian_read_16(command, pos);
3082             log_info("Remote MTU %u", channel->remote_mtu);
3083             if (channel->remote_mtu > l2cap_max_mtu()){
3084                 log_info("Remote MTU %u larger than outgoing buffer, only using MTU = %u", channel->remote_mtu, l2cap_max_mtu());
3085                 channel->remote_mtu = l2cap_max_mtu();
3086             }
3087             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_MTU);
3088         }
3089         // Flush timeout { type(8):2, len(8): 2, Flush Timeout(16)}
3090         if ((option_type == L2CAP_CONFIG_OPTION_TYPE_FLUSH_TIMEOUT) && (length == 2)){
3091             channel->flush_timeout = little_endian_read_16(command, pos);
3092             log_info("Flush timeout: %u ms", channel->flush_timeout);
3093         }
3094 
3095 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3096         // Retransmission and Flow Control Option
3097         if (option_type == L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL && length == 9){
3098             l2cap_channel_mode_t mode = (l2cap_channel_mode_t) command[pos];
3099             switch(channel->mode){
3100                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3101                     // Store remote config
3102                     channel->remote_tx_window_size = command[pos+1];
3103                     channel->remote_max_transmit   = command[pos+2];
3104                     channel->remote_retransmission_timeout_ms = little_endian_read_16(command, pos + 3);
3105                     channel->remote_monitor_timeout_ms = little_endian_read_16(command, pos + 5);
3106                     channel->remote_mps = little_endian_read_16(command, pos + 7);
3107                     log_info("FC&C config: tx window: %u, max transmit %u, retrans timeout %u, monitor timeout %u, mps %u",
3108                         channel->remote_tx_window_size,
3109                         channel->remote_max_transmit,
3110                         channel->remote_retransmission_timeout_ms,
3111                         channel->remote_monitor_timeout_ms,
3112                         channel->remote_mps);
3113                     // If ERTM mandatory, but remote doens't offer ERTM -> disconnect
3114                     if (channel->ertm_mandatory && mode != L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
3115                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3116                     } else {
3117                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
3118                     }
3119                     break;
3120                 case L2CAP_CHANNEL_MODE_BASIC:
3121                     switch (mode){
3122                         case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3123                             // remote asks for ERTM, but we want basic mode. disconnect if this happens a second time
3124                             if (channel->state_var & L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED){
3125                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3126                             }
3127                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_BASIC_FALLBACK_TRIED);
3128                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_REJECTED);
3129                             break;
3130                         default: // case L2CAP_CHANNEL_MODE_BASIC:
3131                             // TODO store and evaluate configuration
3132                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM);
3133                             break;
3134                     }
3135                     break;
3136                 default:
3137                     break;
3138             }
3139         }
3140         if (option_type == L2CAP_CONFIG_OPTION_TYPE_FRAME_CHECK_SEQUENCE && length == 1){
3141             use_fcs = command[pos];
3142         }
3143 #endif
3144         // check for unknown options
3145         if ((option_hint == 0) && ((option_type < L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT) || (option_type > L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE))){
3146             log_info("l2cap cid %u, unknown option 0x%02x", channel->local_cid, option_type);
3147             channel->unknown_option = option_type;
3148             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
3149         }
3150         pos += length;
3151     }
3152 
3153 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3154         // "FCS" has precedence over "No FCS"
3155         uint8_t update = channel->fcs_option || use_fcs;
3156         log_info("local fcs: %u, remote fcs: %u -> %u", channel->fcs_option, use_fcs, update);
3157         channel->fcs_option = update;
3158         // If ERTM mandatory, but remote didn't send Retransmission and Flowcontrol options -> disconnect
3159         if (((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_ERTM) == 0) & (channel->ertm_mandatory)){
3160             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3161         }
3162 #endif
3163 }
3164 
3165 // @pre command len is valid, see check in l2cap_signaling_handler_channel
3166 static void l2cap_signaling_handle_configure_response(l2cap_channel_t *channel, uint8_t result, uint8_t *command){
3167     log_info("l2cap_signaling_handle_configure_response");
3168 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3169     uint16_t end_pos = 4 + little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3170     uint16_t pos     = 10;
3171     while (pos < end_pos){
3172         uint8_t option_hint = command[pos] >> 7;
3173         uint8_t option_type = command[pos] & 0x7f;
3174         // log_info("l2cap cid %u, hint %u, type %u", channel->local_cid, option_hint, option_type);
3175         pos++;
3176         uint8_t length = command[pos++];
3177 
3178         // Retransmission and Flow Control Option
3179         if (option_type == L2CAP_CONFIG_OPTION_TYPE_RETRANSMISSION_AND_FLOW_CONTROL && length == 9){
3180             switch (channel->mode){
3181                 case L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION:
3182                     if (channel->ertm_mandatory){
3183                         // ??
3184                     } else {
3185                         // On 'Reject - Unacceptable Parameters' to our optional ERTM request, fall back to BASIC mode
3186                         if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
3187                             l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3188                             channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3189                         }
3190                     }
3191                     break;
3192                 case L2CAP_CHANNEL_MODE_BASIC:
3193                     if (result == L2CAP_CONF_RESULT_UNACCEPTABLE_PARAMETERS){
3194                         // On 'Reject - Unacceptable Parameters' to our Basic mode request, disconnect
3195                         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3196                     }
3197                     break;
3198                 default:
3199                     break;
3200             }
3201         }
3202 
3203         // check for unknown options
3204         if (option_hint == 0 && (option_type < L2CAP_CONFIG_OPTION_TYPE_MAX_TRANSMISSION_UNIT || option_type > L2CAP_CONFIG_OPTION_TYPE_EXTENDED_WINDOW_SIZE)){
3205             log_info("l2cap cid %u, unknown option 0x%02x", channel->local_cid, option_type);
3206             channel->unknown_option = option_type;
3207             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_INVALID);
3208         }
3209 
3210         pos += length;
3211     }
3212 #else
3213     UNUSED(channel);  // ok: no code
3214     UNUSED(result);   // ok: no code
3215     UNUSED(command);  // ok: no code
3216 #endif
3217 }
3218 
3219 static int l2cap_channel_ready_for_open(l2cap_channel_t *channel){
3220     // log_info("l2cap_channel_ready_for_open 0x%02x", channel->state_var);
3221     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP) == 0) return 0;
3222     if ((channel->state_var & L2CAP_CHANNEL_STATE_VAR_SENT_CONF_RSP) == 0) return 0;
3223     // addition check that fixes re-entrance issue causing l2cap event channel opened twice
3224     if (channel->state == L2CAP_STATE_OPEN) return 0;
3225     return 1;
3226 }
3227 
3228 
3229 // @pre command len is valid, see check in l2cap_signaling_handler_dispatch
3230 static void l2cap_signaling_handler_channel(l2cap_channel_t *channel, uint8_t *command){
3231 
3232     uint8_t  code       = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3233     uint8_t  identifier = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3234     uint16_t cmd_len    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3235     uint16_t result = 0;
3236 
3237     log_info("L2CAP signaling handler code %u, state %u", code, channel->state);
3238 
3239     // handle DISCONNECT REQUESTS seperately
3240     if (code == DISCONNECTION_REQUEST){
3241         l2cap_handle_disconnect_request(channel, identifier);
3242         return;
3243     }
3244 
3245     // @STATEMACHINE(l2cap)
3246     switch (channel->state) {
3247 
3248         case L2CAP_STATE_WAIT_CONNECT_RSP:
3249             switch (code){
3250                 case CONNECTION_RESPONSE:
3251                     if (cmd_len < 8){
3252                         // command imcomplete
3253                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3254                         break;
3255                     }
3256                     l2cap_stop_rtx(channel);
3257                     result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3258                     switch (result) {
3259                         case 0:
3260                             // successful connection
3261                             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3262                             channel->state = L2CAP_STATE_CONFIG;
3263                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
3264                             break;
3265                         case 1:
3266                             // connection pending. get some coffee, but start the ERTX
3267                             l2cap_start_ertx(channel);
3268                             break;
3269                         default:
3270                             // channel closed
3271                             channel->state = L2CAP_STATE_CLOSED;
3272                             // map l2cap connection response result to BTstack status enumeration
3273                             l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result);
3274 
3275                             // drop link key if security block
3276                             if ((L2CAP_CONNECTION_RESPONSE_RESULT_SUCCESSFUL + result) == L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY){
3277                                 gap_drop_link_key_for_bd_addr(channel->address);
3278                             }
3279 
3280                             // discard channel
3281                             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
3282                             l2cap_free_channel_entry(channel);
3283                             break;
3284                     }
3285                     break;
3286 
3287                 default:
3288                     //@TODO: implement other signaling packets
3289                     break;
3290             }
3291             break;
3292 
3293         case L2CAP_STATE_CONFIG:
3294             switch (code) {
3295                 case CONFIGURE_REQUEST:
3296                     if (cmd_len < 4){
3297                         // command incomplete
3298                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3299                         break;
3300                     }
3301                     channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP);
3302                     l2cap_signaling_handle_configure_request(channel, command);
3303                     if (!(channel->state_var & L2CAP_CHANNEL_STATE_VAR_SEND_CONF_RSP_CONT)){
3304                         // only done if continuation not set
3305                         channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_REQ);
3306                     }
3307                     break;
3308                 case CONFIGURE_RESPONSE:
3309                     if (cmd_len < 6){
3310                         // command incomplete
3311                         l2cap_register_signaling_response(channel->con_handle, COMMAND_REJECT, identifier, 0, L2CAP_REJ_CMD_UNKNOWN);
3312                         break;
3313                     }
3314                     result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3315                     l2cap_stop_rtx(channel);
3316                     l2cap_signaling_handle_configure_response(channel, result, command);
3317                     switch (result){
3318                         case 0: // success
3319                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_RCVD_CONF_RSP);
3320                             break;
3321                         case 4: // pending
3322                             l2cap_start_ertx(channel);
3323                             break;
3324                         default:
3325 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3326                             if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION && channel->ertm_mandatory){
3327                                 // remote does not offer ertm but it's required
3328                                 channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
3329                                 break;
3330                             }
3331 #endif
3332                             // retry on negative result
3333                             channelStateVarSetFlag(channel, L2CAP_CHANNEL_STATE_VAR_SEND_CONF_REQ);
3334                             break;
3335                     }
3336                     break;
3337                 default:
3338                     break;
3339             }
3340             if (l2cap_channel_ready_for_open(channel)){
3341 
3342 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3343                 // assert that packet can be stored in fragment buffers in ertm
3344                 if (channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
3345                     uint16_t effective_mps = btstack_min(channel->remote_mps, channel->local_mps);
3346                     uint16_t usable_mtu = channel->num_tx_buffers == 1 ? effective_mps : channel->num_tx_buffers * effective_mps - 2;
3347                     if (usable_mtu < channel->remote_mtu){
3348                         log_info("Remote MTU %u > max storable ERTM packet, only using MTU = %u", channel->remote_mtu, usable_mtu);
3349                         channel->remote_mtu = usable_mtu;
3350                     }
3351                 }
3352 #endif
3353                 // for open:
3354                 channel->state = L2CAP_STATE_OPEN;
3355                 l2cap_emit_channel_opened(channel, 0);
3356             }
3357             break;
3358 
3359         case L2CAP_STATE_WAIT_DISCONNECT:
3360             switch (code) {
3361                 case DISCONNECTION_RESPONSE:
3362                     l2cap_finalize_channel_close(channel);
3363                     break;
3364                 default:
3365                     //@TODO: implement other signaling packets
3366                     break;
3367             }
3368             break;
3369 
3370         case L2CAP_STATE_CLOSED:
3371             // @TODO handle incoming requests
3372             break;
3373 
3374         case L2CAP_STATE_OPEN:
3375             //@TODO: implement other signaling packets, e.g. re-configure
3376             break;
3377         default:
3378             break;
3379     }
3380     // log_info("new state %u", channel->state);
3381 }
3382 
3383 #ifdef ENABLE_CLASSIC
3384 static void l2cap_handle_information_request_complete(hci_connection_t * connection){
3385 
3386     connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_DONE;
3387 
3388     // emit event
3389     uint8_t event[8];
3390     event[0] = L2CAP_EVENT_INFORMATION_RESPONSE;
3391     event[1] = sizeof(event) - 2;
3392     little_endian_store_16(event, 2, connection->con_handle);
3393     little_endian_store_16(event, 4, connection->l2cap_state.extended_feature_mask);
3394     little_endian_store_16(event, 6, connection->l2cap_state.fixed_channels_supported);
3395     l2cap_emit_event(event, sizeof(event));
3396 
3397     // trigger connection request
3398     btstack_linked_list_iterator_t it;
3399     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3400     while (btstack_linked_list_iterator_has_next(&it)){
3401         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3402         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3403         if (channel->con_handle != connection->con_handle) continue;
3404 
3405         // incoming connection: information request was triggered after user has accepted connection,
3406         // now: verify channel configuration, esp. if ertm will be mandatory
3407         if (channel->state == L2CAP_STATE_WAIT_INCOMING_EXTENDED_FEATURES){
3408             // default: continue
3409             channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_ACCEPT;
3410 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3411             if ((channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) && ((connection->l2cap_state.extended_feature_mask & 0x08) == 0)){
3412                 // ERTM not possible, select basic mode and release buffer
3413                 channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3414                 l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3415 
3416                 // bail if ERTM is mandatory
3417                 if (channel->ertm_mandatory){
3418                     // We chose 'no resources available' for "ERTM mandatory but you don't even know ERTM exists"
3419                     log_info("ERTM mandatory -> reject connection");
3420                     channel->state  = L2CAP_STATE_WILL_SEND_CONNECTION_RESPONSE_DECLINE;
3421                     channel->reason = 0x04; // no resources available
3422                 }  else {
3423                     log_info("ERTM not supported by remote -> use Basic mode");
3424                 }
3425             }
3426 #endif
3427             continue;
3428         }
3429 
3430         // outgoing connection: information request is triggered before connection request
3431         if (channel->state == L2CAP_STATE_WAIT_OUTGOING_EXTENDED_FEATURES){
3432 
3433 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
3434             // if ERTM was requested, but is not listed in extended feature mask:
3435             if ((channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION) && ((connection->l2cap_state.extended_feature_mask & 0x08) == 0)){
3436 
3437                 if (channel->ertm_mandatory){
3438                     // bail if ERTM is mandatory
3439                     channel->state = L2CAP_STATE_CLOSED;
3440                     // map l2cap connection response result to BTstack status enumeration
3441                     l2cap_handle_channel_open_failed(channel, L2CAP_CONNECTION_RESPONSE_RESULT_ERTM_NOT_SUPPORTED);
3442                     // discard channel
3443                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
3444                     l2cap_free_channel_entry(channel);
3445                     continue;
3446 
3447                 } else {
3448                     // fallback to Basic mode
3449                     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_ERTM_BUFFER_RELEASED);
3450                     channel->mode = L2CAP_CHANNEL_MODE_BASIC;
3451                 }
3452             }
3453 #endif
3454 
3455             // respond to connection request
3456             channel->state = L2CAP_STATE_WILL_SEND_CONNECTION_REQUEST;
3457             continue;
3458         }
3459     }
3460 }
3461 #endif
3462 
3463 // @pre command len is valid, see check in l2cap_acl_classic_handler
3464 static void l2cap_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t * command){
3465 
3466     hci_connection_t * connection;
3467     btstack_linked_list_iterator_t it;
3468 
3469     // get code, signal identifier and command len
3470     uint8_t code     = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3471     uint8_t sig_id   = command[L2CAP_SIGNALING_COMMAND_SIGID_OFFSET];
3472     uint16_t cmd_len = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3473 
3474     // general commands without an assigned channel
3475     switch(code) {
3476 
3477         case CONNECTION_REQUEST:
3478             if (cmd_len == 4){
3479                 uint16_t psm =        little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3480                 uint16_t source_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3481                 l2cap_handle_connection_request(handle, sig_id, psm, source_cid);
3482             } else {
3483                 l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
3484             }
3485             return;
3486 
3487         case ECHO_REQUEST:
3488             l2cap_register_signaling_response(handle, code, sig_id, 0, 0);
3489             return;
3490 
3491         case INFORMATION_REQUEST:
3492             if (cmd_len == 2) {
3493                 uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3494                 l2cap_register_signaling_response(handle, code, sig_id, 0, info_type);
3495                 return;
3496             }
3497             break;
3498 
3499         case INFORMATION_RESPONSE:
3500             connection = hci_connection_for_handle(handle);
3501             if (!connection) return;
3502             switch (connection->l2cap_state.information_state){
3503                 case L2CAP_INFORMATION_STATE_W4_EXTENDED_FEATURE_RESPONSE:
3504                     // get extended features from response if valid
3505                     if (cmd_len >= 6) {
3506                         uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3507                         uint16_t result    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3508                         if (result == 0 && info_type == L2CAP_INFO_TYPE_EXTENDED_FEATURES_SUPPORTED) {
3509                             connection->l2cap_state.extended_feature_mask = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
3510                         }
3511                         log_info("extended features mask 0x%02x", connection->l2cap_state.extended_feature_mask);
3512                         if ((connection->l2cap_state.extended_feature_mask & 0x80) != 0){
3513                             connection->l2cap_state.information_state = L2CAP_INFORMATION_STATE_W2_SEND_FIXED_CHANNELS_REQUEST;
3514                         } else {
3515                             // information request complete
3516                             l2cap_handle_information_request_complete(connection);
3517                         }
3518                     }
3519                     break;
3520                 case L2CAP_INFORMATION_STATE_W4_FIXED_CHANNELS_RESPONSE:
3521                     if (cmd_len >= 12) {
3522                         uint16_t info_type = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3523                         uint16_t result    = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
3524                         if (result == 0 && info_type == L2CAP_INFO_TYPE_FIXED_CHANNELS_SUPPORTED) {
3525                             connection->l2cap_state.fixed_channels_supported = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
3526                         }
3527                         log_info("fixed channels mask 0x%02x", connection->l2cap_state.fixed_channels_supported);
3528                         // information request complete
3529                         l2cap_handle_information_request_complete(connection);
3530                     }
3531                     break;
3532                 default:
3533                     break;
3534             }
3535             return;
3536 
3537 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
3538         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
3539         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
3540         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
3541         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
3542             l2cap_enhanced_signaling_handler_dispatch(handle, L2CAP_CID_SIGNALING, command, sig_id);
3543             return;
3544         case L2CAP_FLOW_CONTROL_CREDIT_INDICATION:
3545             // return if valid
3546             if (l2cap_credit_based_handle_credit_indication(handle, command, cmd_len)) return;
3547             break;
3548 
3549         case COMMAND_REJECT:
3550             btstack_linked_list_iterator_init(&it, &l2cap_channels);
3551             while (btstack_linked_list_iterator_has_next(&it)) {
3552                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3553                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3554                 if (channel->con_handle != handle) continue;
3555                 if (channel->local_sig_id != sig_id) continue;
3556                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE) continue;
3557 
3558                 // open failed
3559                 channel->state = L2CAP_STATE_CLOSED;
3560                 l2cap_emit_enhanced_data_channel_opened(channel,
3561                                                         ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
3562                 // drop failed channel
3563                 btstack_linked_list_iterator_remove(&it);
3564                 l2cap_free_channel_entry(channel);
3565             }
3566             break;
3567 #endif
3568 
3569         default:
3570             break;
3571     }
3572 
3573     // Get potential destination CID
3574     uint16_t dest_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3575 
3576     // Find channel for this sig_id and connection handle
3577     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3578     while (btstack_linked_list_iterator_has_next(&it)){
3579         l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3580         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3581         if (channel->con_handle != handle) continue;
3582         if (code & 1) {
3583             // match odd commands (responses) by previous signaling identifier
3584             if (channel->local_sig_id == sig_id) {
3585                 l2cap_signaling_handler_channel(channel, command);
3586                 return;
3587             }
3588         } else {
3589             // match even commands (requests) by local channel id
3590             if (channel->local_cid == dest_cid) {
3591                 l2cap_signaling_handler_channel(channel, command);
3592                 return;
3593             }
3594         }
3595     }
3596 
3597     // send command reject
3598     l2cap_register_signaling_response(handle, COMMAND_REJECT, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
3599 }
3600 #endif
3601 
3602 #ifdef L2CAP_USES_CHANNELS
3603 static l2cap_service_t * l2cap_get_service_internal(btstack_linked_list_t * services, uint16_t psm){
3604     btstack_linked_list_iterator_t it;
3605     btstack_linked_list_iterator_init(&it, services);
3606     while (btstack_linked_list_iterator_has_next(&it)){
3607         l2cap_service_t * service = (l2cap_service_t *) btstack_linked_list_iterator_next(&it);
3608         if ( service->psm == psm){
3609             return service;
3610         };
3611     }
3612     return NULL;
3613 }
3614 #endif
3615 
3616 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
3617 
3618 static uint8_t l2cap_enhanced_setup_channels(btstack_linked_list_t * channels,
3619                                              btstack_packet_handler_t packet_handler, uint8_t num_channels,
3620                                              hci_connection_t * connection, uint16_t psm, uint16_t mtu, gap_security_level_t security_level){
3621     uint8_t i;
3622     uint8_t status = ERROR_CODE_SUCCESS;
3623     for (i=0;i<num_channels;i++){
3624         l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_ENHANCED_DATA_CHANNEL, connection->address, connection->address_type, psm, mtu, security_level);
3625         if (!channel) {
3626             status = BTSTACK_MEMORY_ALLOC_FAILED;
3627             break;
3628         }
3629         channel->con_handle = connection->con_handle;
3630         btstack_linked_list_add_tail(channels, (btstack_linked_item_t *) channel);
3631     }
3632 
3633     // free channels if not all allocated
3634     if (status != ERROR_CODE_SUCCESS){
3635         while (true) {
3636             l2cap_channel_t * channel = (l2cap_channel_t *) btstack_linked_list_pop(channels);
3637             if (channel == NULL) break;
3638             l2cap_free_channel_entry(channel);
3639         }
3640     }
3641 
3642     return status;
3643 }
3644 
3645 static inline l2cap_service_t * l2cap_enhanced_get_service(uint16_t spsm){
3646     return l2cap_get_service_internal(&l2cap_enhanced_services, spsm);
3647 }
3648 
3649 static inline uint8_t l2cap_enhanced_status_for_result(uint16_t result) {
3650     switch (result) {
3651         case 0x0000:
3652             return ERROR_CODE_SUCCESS;
3653         case 0x0002:
3654             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_PSM;
3655         case 0x0004:
3656             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_RESOURCES;
3657         case 0x0005:
3658         case 0x0006:
3659         case 0x0007:
3660         case 0x0008:
3661             return L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_SECURITY;
3662         default:
3663             // invalid Source CID, Source CID already allocated, unacceptable parameters
3664             return L2CAP_CONNECTION_RESPONSE_UNKNOWN_ERROR;
3665     }
3666 }
3667 
3668 static int l2cap_enhanced_signaling_handler_dispatch(hci_con_handle_t handle, uint16_t signaling_cid, uint8_t *command,
3669                                                      uint8_t sig_id) {
3670 
3671     hci_connection_t *connection;
3672     btstack_linked_list_iterator_t it;
3673     l2cap_service_t *service;
3674     uint16_t spsm;
3675     uint8_t num_channels;
3676     uint16_t num_channels_and_signaling_cid;
3677     uint8_t i;
3678     uint16_t new_mtu;
3679     uint16_t new_mps;
3680     uint16_t initial_credits;
3681     uint16_t result;
3682     uint8_t status;
3683 
3684     uint8_t code = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
3685     uint16_t len = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
3686     log_info("enhanced dispatch: command 0x%02x, sig id %u, len %u", code, sig_id, len);
3687 
3688     switch (code) {
3689         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
3690             // check size
3691             if (len < 10u) return 0u;
3692 
3693             // get hci connection, bail if not found (must not happen)
3694             connection = hci_connection_for_handle(handle);
3695             btstack_assert(connection != NULL);
3696 
3697             // get num channels to establish
3698             num_channels = (len - 8) / sizeof(uint16_t);
3699 
3700             // combine signaling cid and number channels for l2cap_register_signaling_response
3701             num_channels_and_signaling_cid = (num_channels << 8) | signaling_cid;
3702 
3703             // check if service registered
3704             spsm = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
3705             service = l2cap_enhanced_get_service(spsm);
3706 
3707             if (service) {
3708 
3709                 uint16_t remote_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
3710                 uint16_t remote_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
3711                 uint16_t credits_outgoing = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
3712 
3713                 // param: check remote mtu
3714                 if (service->mtu > remote_mtu) {
3715                     // 0x000B All connections refused – invalid parameters
3716                     l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3717                                                       num_channels_and_signaling_cid, 0x000C);
3718                     return 1;
3719                 }
3720 
3721                 // security: check authentication
3722                 if (service->required_security_level >= LEVEL_3) {
3723                     if (!gap_authenticated(handle)) {
3724                         // 0x0005 Connection refused – insufficient authentication
3725                         l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3726                                                           num_channels_and_signaling_cid, 0x0005);
3727                         return 1;
3728                     }
3729                 }
3730 
3731                 // security: check encryption
3732                 // L2CAP.TS.p31 does not check for 0x0008 Connection refused - insufficient encryption which might be send for no encryption
3733                 if (service->required_security_level >= LEVEL_2) {
3734                     if (gap_encryption_key_size(handle) < 16) {
3735                         // 0x0007 Connection refused – insufficient encryption key size
3736                         l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3737                                                           num_channels_and_signaling_cid, 0x0007);
3738                         return 1;
3739                     }
3740                 }
3741 
3742                 // report the last result code != 0
3743                 result = 0;
3744                 // store one of the local cids for the event
3745                 uint16_t a_local_cid = 0;
3746                 for (i = 0; i < num_channels; i++) {
3747 
3748                     // check source cids
3749                     uint16_t source_cid = little_endian_read_16(command, 12 + (i * 2));
3750                     if (source_cid < 0x40u) {
3751                         // 0x0009 Connection refused - Invalid Source CID
3752                         result = 0x0009;
3753                         continue;
3754                     }
3755 
3756                     // go through list of channels for this ACL connection and check if we get a match
3757                     btstack_linked_list_iterator_init(&it, &l2cap_channels);
3758                     bool source_cid_allocated = false;
3759                     while (btstack_linked_list_iterator_has_next(&it)) {
3760                         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3761                         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3762                         if (channel->con_handle != handle) continue;
3763                         if (channel->remote_cid != source_cid) continue;
3764                         source_cid_allocated = true;
3765                         break;
3766                     }
3767                     if (source_cid_allocated) {
3768                         result = 0x00a;
3769                         continue;
3770                     }
3771 
3772                     // setup channel
3773                     l2cap_channel_t *channel = l2cap_create_channel_entry(service->packet_handler,
3774                                                                           L2CAP_CHANNEL_TYPE_ENHANCED_DATA_CHANNEL,
3775                                                                           connection->address,
3776                                                                           connection->address_type, spsm,
3777                                                                           service->mtu,
3778                                                                           service->required_security_level);
3779 
3780                     if (channel == NULL) {
3781                         // Some connections refused – insufficient resources available
3782                         result = 0x004;
3783                         continue;
3784                     }
3785 
3786                     // setup state
3787                     channel->state = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
3788                     channel->state_var |= L2CAP_CHANNEL_STATE_VAR_INCOMING;
3789                     channel->con_handle = connection->con_handle;
3790                     channel->remote_sig_id = sig_id;
3791                     channel->remote_cid = source_cid;
3792                     channel->remote_mtu = remote_mtu;
3793                     channel->remote_mps = remote_mps;
3794                     channel->credits_outgoing = credits_outgoing;
3795                     channel->cid_index = i;
3796                     channel->num_cids = num_channels;
3797 
3798                     // if more than one error, we can report any of them
3799                     channel->reason = result;
3800 
3801                     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
3802 
3803                     a_local_cid = channel->local_cid;
3804                 }
3805 
3806                 // if no channels have been created, all have been refused, and we can respond right away
3807                 if (a_local_cid == 0) {
3808                     l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3809                                                       num_channels_and_signaling_cid, result);
3810                     return 1;
3811                 }
3812 
3813                 // emit incoming data connection event
3814                 uint8_t event[16];
3815                 event[0] = L2CAP_EVENT_DATA_CHANNEL_INCOMING;
3816                 event[1] = sizeof(event) - 2;
3817                 event[2] = connection->address_type;
3818                 reverse_bd_addr(connection->address, &event[3]);
3819                 little_endian_store_16(event, 9, connection->con_handle);
3820                 little_endian_store_16(event, 11, spsm);
3821                 event[13] = num_channels;
3822                 little_endian_store_16(event, 14, a_local_cid);
3823                 hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
3824                 (*service->packet_handler)(HCI_EVENT_PACKET, a_local_cid, event, sizeof(event));
3825 
3826             } else {
3827                 // All connections refused – SPSM not supported
3828                 l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_CONNECTION_REQUEST, sig_id,
3829                                                   num_channels_and_signaling_cid, 0x0002);
3830             }
3831             return 1;
3832 
3833         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
3834             // check size
3835             if (len < 10u) return 0u;
3836 
3837             // get hci connection, ignore if not found
3838             connection = hci_connection_for_handle(handle);
3839             if (connection == NULL) return 0;
3840 
3841             // get channel config: mtu, mps, initial credits, result
3842             new_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
3843             new_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
3844             initial_credits = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
3845             result = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
3846             status = l2cap_enhanced_status_for_result(result);
3847 
3848             // get num channels to modify
3849             num_channels = (len - 8) / sizeof(uint16_t);
3850             btstack_linked_list_iterator_init(&it, &l2cap_channels);
3851             while (btstack_linked_list_iterator_has_next(&it)) {
3852                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3853                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3854                 if (channel->con_handle != handle) continue;
3855                 if (channel->local_sig_id != sig_id) continue;
3856                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE) continue;
3857                 if (channel->cid_index < num_channels) {
3858                     uint16_t remote_cid = little_endian_read_16(command, 12 + channel->cid_index * sizeof(uint16_t));
3859                     if (remote_cid != 0) {
3860                         channel->state = L2CAP_STATE_OPEN;
3861                         channel->remote_cid = remote_cid;
3862                         channel->remote_mtu = new_mtu;
3863                         channel->remote_mps = new_mps;
3864                         channel->credits_outgoing = initial_credits;
3865                         l2cap_emit_enhanced_data_channel_opened(channel, ERROR_CODE_SUCCESS);
3866                         continue;
3867                     }
3868                 }
3869                 // open failed
3870                 l2cap_emit_enhanced_data_channel_opened(channel, status);
3871                 // drop failed channel
3872                 btstack_linked_list_iterator_remove(&it);
3873                 btstack_memory_l2cap_channel_free(channel);
3874             }
3875             return 1;
3876 
3877         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
3878             // check minimal size
3879             if (len < 6) return 0u;
3880 
3881             // get hci connection, bail if not found (must not happen)
3882             connection = hci_connection_for_handle(handle);
3883             btstack_assert(connection != NULL);
3884 
3885             // get num channels to modify
3886             num_channels = (len - 4) / sizeof(uint16_t);
3887 
3888             // get new mtu and mps
3889             new_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
3890             new_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
3891 
3892             // validate request
3893             result = 0;
3894             for (i = 0; i < num_channels; i++) {
3895                 // check cid
3896                 uint16_t remote_cid = little_endian_read_16(command, 8 + (i * sizeof(uint16_t)));
3897                 l2cap_channel_t *channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
3898                 if (channel == NULL) {
3899                     // 0x0003 Reconfiguration failed - one or more Destination CIDs invalid
3900                     result = 0x0003;
3901                     break;
3902                 }
3903                 // check MTU is not reduced
3904                 if (channel->remote_mtu > new_mtu) {
3905                     // 0x0001 Reconfiguration failed - reduction in size of MTU not allowed
3906                     result = 0x0001;
3907                     break;
3908                 }
3909                 // check MPS reduction
3910                 if ((num_channels > 1) && (channel->remote_mps > new_mps)) {
3911                     // 0x002 Reconfiguration failed - reduction in size of MPS not allowed for more than one channel at a time
3912                     result = 0x0002;
3913                     break;
3914                 }
3915                 // check MPS valid
3916                 if (new_mps < l2cap_enhanced_mps_min) {
3917                     // 0x0002 Reconfiguration failed - other unacceptable parameters
3918                     result = 0x0004;
3919                     break;
3920                 }
3921             }
3922 
3923             // send reject
3924             if (result != 0) {
3925                 l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST, sig_id, signaling_cid,
3926                                                   result);
3927                 return 1;
3928             }
3929 
3930             // update channels
3931             for (i = 0; i < num_channels; i++) {
3932                 uint16_t remote_cid = little_endian_read_16(command, 8 + (i * sizeof(uint16_t)));
3933                 l2cap_channel_t *channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
3934                 channel->remote_mps = new_mps;
3935                 channel->remote_mtu = new_mtu;
3936                 // emit event
3937                 uint8_t event[8];
3938                 event[0] = L2CAP_EVENT_DATA_CHANNEL_RECONFIGURED;
3939                 event[1] = sizeof(event) - 2;
3940                 little_endian_store_16(event, 2, channel->local_cid);
3941                 little_endian_store_16(event, 4, new_mtu);
3942                 little_endian_store_16(event, 6, new_mps);
3943                 l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
3944             }
3945 
3946             // send accept
3947             l2cap_register_signaling_response(handle, L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST, sig_id, signaling_cid, 0);
3948             return 1;
3949 
3950         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
3951             // check size
3952             if (len < 2u) return 0u;
3953 
3954             result = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
3955             btstack_linked_list_iterator_init(&it, &l2cap_channels);
3956             while (btstack_linked_list_iterator_has_next(&it)) {
3957                 l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
3958                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
3959                 if (channel->con_handle != handle) continue;
3960                 if (channel->local_sig_id != sig_id) continue;
3961                 if (channel->state != L2CAP_STATE_WAIT_ENHANCED_RENEGOTIATION_RESPONSE) continue;
3962                 // complete request
3963                 if (result == 0) {
3964                     channel->receive_sdu_buffer = channel->renegotiate_sdu_buffer;
3965                     channel->local_mtu = channel->renegotiate_mtu;
3966                 }
3967                 channel->state = L2CAP_STATE_OPEN;
3968                 // emit event
3969                 l2cap_emit_enhanced_data_channel_reconfigure_complete(channel, result);
3970             }
3971             break;
3972 
3973         default:
3974             btstack_unreachable();
3975             break;
3976     }
3977     return 0;
3978 }
3979 
3980 #endif
3981 
3982 #ifdef ENABLE_BLE
3983 
3984 static void l2cap_emit_connection_parameter_update_response(hci_con_handle_t con_handle, uint16_t result){
3985     uint8_t event[6];
3986     event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_RESPONSE;
3987     event[1] = 4;
3988     little_endian_store_16(event, 2, con_handle);
3989     little_endian_store_16(event, 4, result);
3990     l2cap_emit_event(event, sizeof(event));
3991 }
3992 
3993 // @return valid
3994 static int l2cap_le_signaling_handler_dispatch(hci_con_handle_t handle, uint8_t * command, uint8_t sig_id){
3995     hci_connection_t * connection;
3996     uint16_t result;
3997     uint8_t  event[12];
3998 
3999 #ifdef ENABLE_L2CAP_CREDIT_BASED_CHANNELS
4000     l2cap_channel_t * channel;
4001     btstack_linked_list_iterator_t it;
4002 #endif
4003 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4004     uint16_t local_cid;
4005     uint16_t le_psm;
4006     l2cap_service_t * service;
4007     uint16_t source_cid;
4008 #endif
4009 
4010     uint8_t code   = command[L2CAP_SIGNALING_COMMAND_CODE_OFFSET];
4011     uint16_t len   = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
4012     log_info("le dispatch: command 0x%02x, sig id %u, len %u", code, sig_id, len);
4013 
4014     switch (code){
4015 
4016         case CONNECTION_PARAMETER_UPDATE_REQUEST:
4017             // check size
4018             if (len < 8u) return 0u;
4019             connection = hci_connection_for_handle(handle);
4020             if (connection != NULL){
4021                 if (connection->role != HCI_ROLE_MASTER){
4022                     // reject command without notifying upper layer when not in master role
4023                     return 0;
4024                 }
4025                 le_connection_parameter_range_t existing_range;
4026                 gap_get_connection_parameter_range(&existing_range);
4027                 uint16_t le_conn_interval_min   = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET);
4028                 uint16_t le_conn_interval_max   = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+2);
4029                 uint16_t le_conn_latency        = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+4);
4030                 uint16_t le_supervision_timeout = little_endian_read_16(command,L2CAP_SIGNALING_COMMAND_DATA_OFFSET+6);
4031 
4032                 int update_parameter = gap_connection_parameter_range_included(&existing_range, le_conn_interval_min, le_conn_interval_max, le_conn_latency, le_supervision_timeout);
4033                 if (update_parameter){
4034                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_SEND_RESPONSE;
4035                     connection->le_conn_interval_min = le_conn_interval_min;
4036                     connection->le_conn_interval_max = le_conn_interval_max;
4037                     connection->le_conn_latency = le_conn_latency;
4038                     connection->le_supervision_timeout = le_supervision_timeout;
4039                 } else {
4040                     connection->le_con_parameter_update_state = CON_PARAMETER_UPDATE_DENY;
4041                 }
4042                 connection->le_con_param_update_identifier = sig_id;
4043             }
4044 
4045             event[0] = L2CAP_EVENT_CONNECTION_PARAMETER_UPDATE_REQUEST;
4046             event[1] = 8;
4047             little_endian_store_16(event, 2, handle);
4048             (void)memcpy(&event[4], &command[4], 8);
4049             l2cap_emit_event(event, sizeof(event));
4050             break;
4051 
4052         case CONNECTION_PARAMETER_UPDATE_RESPONSE:
4053             // check size
4054             if (len < 2u) return 0u;
4055             result = little_endian_read_16(command, 4);
4056             l2cap_emit_connection_parameter_update_response(handle, result);
4057             break;
4058 
4059 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
4060         case L2CAP_CREDIT_BASED_CONNECTION_REQUEST:
4061         case L2CAP_CREDIT_BASED_CONNECTION_RESPONSE:
4062         case L2CAP_CREDIT_BASED_RECONFIGURE_REQUEST:
4063         case L2CAP_CREDIT_BASED_RECONFIGURE_RESPONSE:
4064             return l2cap_enhanced_signaling_handler_dispatch(handle, L2CAP_CID_SIGNALING_LE, command, sig_id);
4065 #endif
4066 
4067 #ifdef ENABLE_L2CAP_CREDIT_BASED_CHANNELS
4068         case COMMAND_REJECT:
4069             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4070             while (btstack_linked_list_iterator_has_next(&it)){
4071                 channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4072                 if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
4073                 if (channel->con_handle   != handle) continue;
4074                 if (channel->local_sig_id != sig_id) continue;
4075 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4076                 // if received while waiting for le connection response, assume legacy device
4077                 if (channel->state == L2CAP_STATE_WAIT_LE_CONNECTION_RESPONSE){
4078                     channel->state = L2CAP_STATE_CLOSED;
4079                     // no official value for this, use: Connection refused – LE_PSM not supported - 0x0002
4080                     l2cap_emit_le_channel_opened(channel, 0x0002);
4081 
4082                     // discard channel
4083                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4084                     l2cap_free_channel_entry(channel);
4085                     continue;
4086                 }
4087 #endif
4088 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
4089                 // if received while waiting for le connection response, assume legacy device
4090                 if (channel->state == L2CAP_STATE_WAIT_ENHANCED_CONNECTION_RESPONSE){
4091                     channel->state = L2CAP_STATE_CLOSED;
4092                     // treat as SPSM not supported
4093                     l2cap_emit_enhanced_data_channel_opened(channel, L2CAP_CONNECTION_RESPONSE_RESULT_REFUSED_PSM);
4094 
4095                     // discard channel
4096                     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4097                     l2cap_free_channel_entry(channel);
4098                     continue;
4099                 }
4100 #endif
4101             }
4102             break;
4103 #endif
4104 
4105 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4106         case LE_CREDIT_BASED_CONNECTION_REQUEST:
4107             // check size
4108             if (len < 10u) return 0u;
4109 
4110             // get hci connection, bail if not found (must not happen)
4111             connection = hci_connection_for_handle(handle);
4112             if (!connection) return 0;
4113 
4114             // check if service registered
4115             le_psm  = little_endian_read_16(command, 4);
4116             service = l2cap_le_get_service(le_psm);
4117             source_cid = little_endian_read_16(command, 6);
4118 
4119             if (service){
4120                 if (source_cid < 0x40u){
4121                     // 0x0009 Connection refused - Invalid Source CID
4122                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0009);
4123                     return 1;
4124                 }
4125 
4126                 // go through list of channels for this ACL connection and check if we get a match
4127                 btstack_linked_list_iterator_init(&it, &l2cap_channels);
4128                 while (btstack_linked_list_iterator_has_next(&it)){
4129                     l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4130                     if (!l2cap_is_dynamic_channel_type(a_channel->channel_type)) continue;
4131                     if (a_channel->con_handle != handle) continue;
4132                     if (a_channel->remote_cid != source_cid) continue;
4133                     // 0x000a Connection refused - Source CID already allocated
4134                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x000a);
4135                     return 1;
4136                 }
4137 
4138                 // security: check encryption
4139                 if (service->required_security_level >= LEVEL_2){
4140                     if (gap_encryption_key_size(handle) == 0){
4141                         // 0x0008 Connection refused - insufficient encryption
4142                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0008);
4143                         return 1;
4144                     }
4145                     // anything less than 16 byte key size is insufficient
4146                     if (gap_encryption_key_size(handle) < 16){
4147                         // 0x0007 Connection refused – insufficient encryption key size
4148                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0007);
4149                         return 1;
4150                     }
4151                 }
4152 
4153                 // security: check authencation
4154                 if (service->required_security_level >= LEVEL_3){
4155                     if (!gap_authenticated(handle)){
4156                         // 0x0005 Connection refused – insufficient authentication
4157                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0005);
4158                         return 1;
4159                     }
4160                 }
4161 
4162                 // security: check authorization
4163                 if (service->required_security_level >= LEVEL_4){
4164                     if (gap_authorization_state(handle) != AUTHORIZATION_GRANTED){
4165                         // 0x0006 Connection refused – insufficient authorization
4166                         l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0006);
4167                         return 1;
4168                     }
4169                 }
4170 
4171                 // allocate channel
4172                 channel = l2cap_create_channel_entry(service->packet_handler, L2CAP_CHANNEL_TYPE_LE_DATA_CHANNEL, connection->address,
4173                     BD_ADDR_TYPE_LE_RANDOM, le_psm, service->mtu, service->required_security_level);
4174                 if (!channel){
4175                     // 0x0004 Connection refused – no resources available
4176                     l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0004);
4177                     return 1;
4178                 }
4179 
4180                 channel->con_handle = handle;
4181                 channel->remote_cid = source_cid;
4182                 channel->remote_sig_id = sig_id;
4183                 channel->remote_mtu = little_endian_read_16(command, 8);
4184                 channel->remote_mps = little_endian_read_16(command, 10);
4185                 channel->credits_outgoing = little_endian_read_16(command, 12);
4186 
4187                 // set initial state
4188                 channel->state      = L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT;
4189                 channel->state_var |= L2CAP_CHANNEL_STATE_VAR_INCOMING;
4190 
4191                 // add to connections list
4192                 btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
4193 
4194                 // post connection request event
4195                 l2cap_emit_le_incoming_connection(channel);
4196 
4197             } else {
4198                 // Connection refused – LE_PSM not supported
4199                 l2cap_register_signaling_response(handle, LE_CREDIT_BASED_CONNECTION_REQUEST, sig_id, source_cid, 0x0002);
4200             }
4201             break;
4202 
4203         case LE_CREDIT_BASED_CONNECTION_RESPONSE:
4204             // check size
4205             if (len < 10u) return 0u;
4206 
4207             // Find channel for this sig_id and connection handle
4208             channel = NULL;
4209             btstack_linked_list_iterator_init(&it, &l2cap_channels);
4210             while (btstack_linked_list_iterator_has_next(&it)){
4211                 l2cap_channel_t * a_channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
4212                 if (!l2cap_is_dynamic_channel_type(a_channel->channel_type)) continue;
4213                 if (a_channel->con_handle   != handle) continue;
4214                 if (a_channel->local_sig_id != sig_id) continue;
4215                 channel = a_channel;
4216                 break;
4217             }
4218             if (!channel) break;
4219 
4220             // cid + 0
4221             result = little_endian_read_16 (command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET+8);
4222             if (result){
4223                 channel->state = L2CAP_STATE_CLOSED;
4224                 // map l2cap connection response result to BTstack status enumeration
4225                 l2cap_emit_le_channel_opened(channel, result);
4226 
4227                 // discard channel
4228                 btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4229                 l2cap_free_channel_entry(channel);
4230                 break;
4231             }
4232 
4233             // success
4234             channel->remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4235             channel->remote_mtu = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
4236             channel->remote_mps = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 4);
4237             channel->credits_outgoing = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 6);
4238             channel->state = L2CAP_STATE_OPEN;
4239             l2cap_emit_le_channel_opened(channel, result);
4240             break;
4241 #endif
4242 
4243 #ifdef ENABLE_L2CAP_CREDIT_BASED_CHANNELS
4244         case L2CAP_FLOW_CONTROL_CREDIT_INDICATION:
4245             return l2cap_credit_based_handle_credit_indication(handle, command, len) ? 1 : 0;
4246 
4247         case DISCONNECTION_REQUEST:
4248 
4249             // check size
4250             if (len < 4u) return 0u;
4251 
4252             // find channel
4253             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4254             channel = l2cap_get_channel_for_local_cid_and_handle(local_cid, handle);
4255             if (!channel) {
4256                 log_error("credit: no channel for cid 0x%02x", local_cid);
4257                 break;
4258             }
4259             channel->remote_sig_id = sig_id;
4260             channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_RESPONSE;
4261             break;
4262 
4263         case DISCONNECTION_RESPONSE:
4264             // check size
4265             if (len < 4u) return 0u;
4266 
4267             // find channel
4268             local_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4269             channel = l2cap_get_channel_for_local_cid_and_handle(local_cid, handle);
4270             if (!channel) break;
4271             if (channel->local_sig_id == sig_id) {
4272                 if (channel->state == L2CAP_STATE_WAIT_DISCONNECT){
4273                     l2cap_finalize_channel_close(channel);
4274                 }
4275             }
4276             break;
4277 #endif
4278 
4279         default:
4280             // command unknown -> reject command
4281             return 0;
4282     }
4283     return 1;
4284 }
4285 #endif
4286 
4287 #ifdef ENABLE_CLASSIC
4288 static void l2cap_acl_classic_handler_for_channel(l2cap_channel_t * l2cap_channel, uint8_t * packet, uint16_t size){
4289 
4290     // forward data only in OPEN state
4291     if (l2cap_channel->state != L2CAP_STATE_OPEN) return;
4292 
4293 #ifdef ENABLE_L2CAP_CREDIT_BASED_CHANNELS
4294     if (l2cap_channel->channel_type == L2CAP_CHANNEL_TYPE_ENHANCED_DATA_CHANNEL){
4295         l2cap_credit_based_handle_pdu(l2cap_channel, packet, size);
4296         return;
4297     }
4298 #endif
4299 
4300 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
4301     if (l2cap_channel->mode == L2CAP_CHANNEL_MODE_ENHANCED_RETRANSMISSION){
4302 
4303         int fcs_size = l2cap_channel->fcs_option ? 2 : 0;
4304 
4305         // assert control + FCS fields are inside
4306         if (size < COMPLETE_L2CAP_HEADER+2+fcs_size) return;
4307 
4308         if (l2cap_channel->fcs_option){
4309             // verify FCS (required if one side requested it)
4310             uint16_t fcs_calculated = crc16_calc(&packet[4], size - (4+2));
4311             uint16_t fcs_packet     = little_endian_read_16(packet, size-2);
4312 
4313 #ifdef L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL
4314             // simulate fcs error
4315             static int counter = 0;
4316             if (++counter == L2CAP_ERTM_SIMULATE_FCS_ERROR_INTERVAL) {
4317                 log_info("Simulate fcs error");
4318                 fcs_calculated++;
4319                 counter = 0;
4320             }
4321 #endif
4322 
4323             if (fcs_calculated == fcs_packet){
4324                 log_info("Packet FCS 0x%04x verified", fcs_packet);
4325             } else {
4326                 log_error("FCS mismatch! Packet 0x%04x, calculated 0x%04x", fcs_packet, fcs_calculated);
4327                 // ERTM State Machine in Bluetooth Spec does not handle 'I-Frame with invalid FCS'
4328                 return;
4329             }
4330         }
4331 
4332         // switch on packet type
4333         uint16_t control = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
4334         uint8_t  req_seq = (control >> 8) & 0x3f;
4335         int final = (control >> 7) & 0x01;
4336         if (control & 1){
4337             // S-Frame
4338             int poll  = (control >> 4) & 0x01;
4339             l2cap_supervisory_function_t s = (l2cap_supervisory_function_t) ((control >> 2) & 0x03);
4340             log_info("Control: 0x%04x => Supervisory function %u, ReqSeq %02u", control, (int) s, req_seq);
4341             l2cap_ertm_tx_packet_state_t * tx_state;
4342             switch (s){
4343                 case L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY:
4344                     log_info("L2CAP_SUPERVISORY_FUNCTION_RR_RECEIVER_READY");
4345                     l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4346                     if (poll && final){
4347                         // S-frames shall not be transmitted with both the F-bit and the P-bit set to 1 at the same time.
4348                         log_error("P=F=1 in S-Frame");
4349                         break;
4350                     }
4351                     if (poll){
4352                         // check if we did request selective retransmission before <==> we have stored SDU segments
4353                         int i;
4354                         int num_stored_out_of_order_packets = 0;
4355                         for (i=0;i<l2cap_channel->num_rx_buffers;i++){
4356                             int index = l2cap_channel->rx_store_index + i;
4357                             if (index >= l2cap_channel->num_rx_buffers){
4358                                 index -= l2cap_channel->num_rx_buffers;
4359                             }
4360                             l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
4361                             if (!rx_state->valid) continue;
4362                             num_stored_out_of_order_packets++;
4363                         }
4364                         if (num_stored_out_of_order_packets){
4365                             l2cap_channel->send_supervisor_frame_selective_reject = 1;
4366                         } else {
4367                             l2cap_channel->send_supervisor_frame_receiver_ready   = 1;
4368                         }
4369                         l2cap_channel->set_final_bit_after_packet_with_poll_bit_set = 1;
4370                     }
4371                     if (final){
4372                         // Stop-MonitorTimer
4373                         l2cap_ertm_stop_monitor_timer(l2cap_channel);
4374                         // If UnackedFrames > 0 then Start-RetransTimer
4375                         if (l2cap_channel->unacked_frames){
4376                             l2cap_ertm_start_retransmission_timer(l2cap_channel);
4377                         }
4378                         // final bit set <- response to RR with poll bit set. All not acknowledged packets need to be retransmitted
4379                         l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4380                     }
4381                     break;
4382                 case L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT:
4383                     log_info("L2CAP_SUPERVISORY_FUNCTION_REJ_REJECT");
4384                     l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4385                     // restart transmittion from last unacknowledted packet (earlier packets already freed in l2cap_ertm_process_req_seq)
4386                     l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4387                     break;
4388                 case L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY:
4389                     log_error("L2CAP_SUPERVISORY_FUNCTION_RNR_RECEIVER_NOT_READY");
4390                     break;
4391                 case L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT:
4392                     log_info("L2CAP_SUPERVISORY_FUNCTION_SREJ_SELECTIVE_REJECT");
4393                     if (poll){
4394                         l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4395                     }
4396                     // find requested i-frame
4397                     tx_state = l2cap_ertm_get_tx_state(l2cap_channel, req_seq);
4398                     if (tx_state){
4399                         log_info("Retransmission for tx_seq %u requested", req_seq);
4400                         l2cap_channel->set_final_bit_after_packet_with_poll_bit_set = poll;
4401                         tx_state->retransmission_requested = 1;
4402                         l2cap_channel->srej_active = 1;
4403                     }
4404                     break;
4405                 default:
4406                     break;
4407             }
4408         } else {
4409             // I-Frame
4410             // get control
4411             l2cap_segmentation_and_reassembly_t sar = (l2cap_segmentation_and_reassembly_t) (control >> 14);
4412             uint8_t tx_seq = (control >> 1) & 0x3f;
4413             log_info("Control: 0x%04x => SAR %u, ReqSeq %02u, R?, TxSeq %02u", control, (int) sar, req_seq, tx_seq);
4414             log_info("SAR: pos %u", l2cap_channel->reassembly_pos);
4415             log_info("State: expected_tx_seq %02u, req_seq %02u", l2cap_channel->expected_tx_seq, l2cap_channel->req_seq);
4416             l2cap_ertm_process_req_seq(l2cap_channel, req_seq);
4417             if (final){
4418                 // final bit set <- response to RR with poll bit set. All not acknowledged packets need to be retransmitted
4419                 l2cap_ertm_retransmit_unacknowleded_frames(l2cap_channel);
4420             }
4421 
4422             // get SDU
4423             const uint8_t * payload_data = &packet[COMPLETE_L2CAP_HEADER+2];
4424             uint16_t        payload_len  = size-(COMPLETE_L2CAP_HEADER+2+fcs_size);
4425 
4426             // assert SDU size is smaller or equal to our buffers
4427             uint16_t max_payload_size = 0;
4428             switch (sar){
4429                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_UNSEGMENTED_L2CAP_SDU:
4430                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_START_OF_L2CAP_SDU:
4431                     // SDU Length + MPS
4432                     max_payload_size = l2cap_channel->local_mps + 2;
4433                     break;
4434                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_CONTINUATION_OF_L2CAP_SDU:
4435                 case L2CAP_SEGMENTATION_AND_REASSEMBLY_END_OF_L2CAP_SDU:
4436                     max_payload_size = l2cap_channel->local_mps;
4437                     break;
4438                 default:
4439                     btstack_assert(false);
4440                     break;
4441             }
4442             if (payload_len > max_payload_size){
4443                 log_info("payload len %u > max payload %u -> drop packet", payload_len, max_payload_size);
4444                 return;
4445             }
4446 
4447             // check ordering
4448             if (l2cap_channel->expected_tx_seq == tx_seq){
4449                 log_info("Received expected frame with TxSeq == ExpectedTxSeq == %02u", tx_seq);
4450                 l2cap_channel->expected_tx_seq = l2cap_next_ertm_seq_nr(l2cap_channel->expected_tx_seq);
4451                 l2cap_channel->req_seq         = l2cap_channel->expected_tx_seq;
4452 
4453                 // process SDU
4454                 l2cap_ertm_handle_in_sequence_sdu(l2cap_channel, sar, payload_data, payload_len);
4455 
4456                 // process stored segments
4457                 while (true){
4458                     int index = l2cap_channel->rx_store_index;
4459                     l2cap_ertm_rx_packet_state_t * rx_state = &l2cap_channel->rx_packets_state[index];
4460                     if (!rx_state->valid) break;
4461 
4462                     log_info("Processing stored frame with TxSeq == ExpectedTxSeq == %02u", l2cap_channel->expected_tx_seq);
4463                     l2cap_channel->expected_tx_seq = l2cap_next_ertm_seq_nr(l2cap_channel->expected_tx_seq);
4464                     l2cap_channel->req_seq         = l2cap_channel->expected_tx_seq;
4465 
4466                     rx_state->valid = 0;
4467                     l2cap_ertm_handle_in_sequence_sdu(l2cap_channel, rx_state->sar, &l2cap_channel->rx_packets_data[index], rx_state->len);
4468 
4469                     // update rx store index
4470                     index++;
4471                     if (index >= l2cap_channel->num_rx_buffers){
4472                         index = 0;
4473                     }
4474                     l2cap_channel->rx_store_index = index;
4475                 }
4476 
4477                 //
4478                 l2cap_channel->send_supervisor_frame_receiver_ready = 1;
4479 
4480             } else {
4481                 int delta = (tx_seq - l2cap_channel->expected_tx_seq) & 0x3f;
4482                 if (delta < 2){
4483                     // store segment
4484                     l2cap_ertm_handle_out_of_sequence_sdu(l2cap_channel, sar, delta, payload_data, payload_len);
4485 
4486                     log_info("Received unexpected frame TxSeq %u but expected %u -> send S-SREJ", tx_seq, l2cap_channel->expected_tx_seq);
4487                     l2cap_channel->send_supervisor_frame_selective_reject = 1;
4488                 } else {
4489                     log_info("Received unexpected frame TxSeq %u but expected %u -> send S-REJ", tx_seq, l2cap_channel->expected_tx_seq);
4490                     l2cap_channel->send_supervisor_frame_reject = 1;
4491                 }
4492             }
4493         }
4494         return;
4495     }
4496 #endif
4497 
4498     // check size
4499     uint16_t payload_size = size - COMPLETE_L2CAP_HEADER;
4500     if (l2cap_channel->local_mtu < payload_size) return;
4501 
4502     l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, &packet[COMPLETE_L2CAP_HEADER], payload_size);
4503 }
4504 #endif
4505 
4506 static void l2cap_acl_classic_handler(hci_con_handle_t handle, uint8_t *packet, uint16_t size){
4507 #ifdef ENABLE_CLASSIC
4508     l2cap_channel_t * l2cap_channel;
4509     l2cap_fixed_channel_t * l2cap_fixed_channel;
4510 
4511     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
4512     uint8_t  broadcast_flag = READ_ACL_FLAGS(packet) >> 2;
4513     switch (channel_id) {
4514 
4515         case L2CAP_CID_SIGNALING: {
4516             if (broadcast_flag != 0) break;
4517             uint32_t command_offset = 8;
4518             while ((command_offset + L2CAP_SIGNALING_COMMAND_DATA_OFFSET) < size) {
4519                 // assert signaling command is fully inside packet
4520                 uint16_t data_len = little_endian_read_16(packet, command_offset + L2CAP_SIGNALING_COMMAND_LENGTH_OFFSET);
4521                 uint32_t next_command_offset = command_offset + L2CAP_SIGNALING_COMMAND_DATA_OFFSET + data_len;
4522                 if (next_command_offset > size){
4523                     log_error("l2cap signaling command len invalid -> drop");
4524                     break;
4525                 }
4526                 // handle signaling command
4527                 l2cap_signaling_handler_dispatch(handle, &packet[command_offset]);
4528                 // go to next command
4529                 command_offset = next_command_offset;
4530             }
4531             break;
4532         }
4533 
4534         case L2CAP_CID_CONNECTIONLESS_CHANNEL:
4535             if (broadcast_flag == 0) break;
4536             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_CONNECTIONLESS_CHANNEL);
4537             if (!l2cap_fixed_channel) break;
4538             if (!l2cap_fixed_channel->packet_handler) break;
4539             (*l2cap_fixed_channel->packet_handler)(UCD_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4540             break;
4541 
4542 #ifdef ENABLE_BLE
4543         case L2CAP_CID_BR_EDR_SECURITY_MANAGER:
4544             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
4545             if ((l2cap_fixed_channel == NULL) || (l2cap_fixed_channel->packet_handler == NULL)){
4546                 // Pairing Failed
4547                 l2cap_register_signaling_response(handle, (uint8_t) SM_PAIRING_FAILED, 0, L2CAP_CID_BR_EDR_SECURITY_MANAGER, SM_REASON_PAIRING_NOT_SUPPORTED);
4548             } else {
4549                 (*l2cap_fixed_channel->packet_handler)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4550             }
4551             break;
4552 #endif
4553 
4554         default:
4555             if (broadcast_flag != 0) break;
4556             // Find channel for this channel_id and connection handle
4557             l2cap_channel = l2cap_get_channel_for_local_cid_and_handle(channel_id, handle);
4558             if (l2cap_channel != NULL){
4559                 l2cap_acl_classic_handler_for_channel(l2cap_channel, packet, size);
4560             }
4561             break;
4562     }
4563 #else
4564     UNUSED(handle); // ok: no code
4565     UNUSED(packet); // ok: no code
4566     UNUSED(size);   // ok: no code
4567 #endif
4568 }
4569 
4570 static void l2cap_acl_le_handler(hci_con_handle_t handle, uint8_t *packet, uint16_t size){
4571 #ifdef ENABLE_BLE
4572 
4573     l2cap_fixed_channel_t * l2cap_fixed_channel;
4574 
4575 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4576     l2cap_channel_t * l2cap_channel;
4577 #endif
4578     uint16_t channel_id = READ_L2CAP_CHANNEL_ID(packet);
4579     switch (channel_id) {
4580 
4581         case L2CAP_CID_SIGNALING_LE: {
4582             uint16_t sig_id = packet[COMPLETE_L2CAP_HEADER + 1];
4583             uint16_t len = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER + 2);
4584             if ((COMPLETE_L2CAP_HEADER + 4u + len) > size) break;
4585             int      valid  = l2cap_le_signaling_handler_dispatch(handle, &packet[COMPLETE_L2CAP_HEADER], sig_id);
4586             if (!valid){
4587                 l2cap_register_signaling_response(handle, COMMAND_REJECT_LE, sig_id, 0, L2CAP_REJ_CMD_UNKNOWN);
4588             }
4589             break;
4590         }
4591 
4592         case L2CAP_CID_ATTRIBUTE_PROTOCOL:
4593             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_ATTRIBUTE_PROTOCOL);
4594             if (!l2cap_fixed_channel) break;
4595             if (!l2cap_fixed_channel->packet_handler) break;
4596             (*l2cap_fixed_channel->packet_handler)(ATT_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4597             break;
4598 
4599         case L2CAP_CID_SECURITY_MANAGER_PROTOCOL:
4600             l2cap_fixed_channel = l2cap_fixed_channel_for_channel_id(L2CAP_CID_SECURITY_MANAGER_PROTOCOL);
4601             if ((l2cap_fixed_channel == NULL) || (l2cap_fixed_channel->packet_handler == NULL)){
4602                 // Pairing Failed
4603                 l2cap_register_signaling_response(handle, (uint8_t) SM_PAIRING_FAILED, 0, L2CAP_CID_SECURITY_MANAGER_PROTOCOL, SM_REASON_PAIRING_NOT_SUPPORTED);
4604             } else {
4605                 (*l2cap_fixed_channel->packet_handler)(SM_DATA_PACKET, handle, &packet[COMPLETE_L2CAP_HEADER], size-COMPLETE_L2CAP_HEADER);
4606             }
4607             break;
4608 
4609         default:
4610 
4611 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4612             l2cap_channel = l2cap_get_channel_for_local_cid_and_handle(channel_id, handle);
4613             if (l2cap_channel != NULL) {
4614                 l2cap_credit_based_handle_pdu(l2cap_channel, packet, size);
4615             }
4616 #endif
4617             break;
4618     }
4619 #else
4620     UNUSED(handle); // ok: no code
4621     UNUSED(packet); // ok: no code
4622     UNUSED(size);   // ok: no code
4623 #endif
4624 }
4625 
4626 static void l2cap_acl_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
4627     UNUSED(packet_type);    // ok: registered with hci_register_acl_packet_handler
4628     UNUSED(channel);        // ok: there is no channel
4629 
4630     // Assert full L2CAP header present
4631     if (size < COMPLETE_L2CAP_HEADER) return;
4632 
4633     // Dispatch to Classic or LE handler (SCO packets are not dispatched to L2CAP)
4634     hci_con_handle_t handle = READ_ACL_CONNECTION_HANDLE(packet);
4635     hci_connection_t *conn = hci_connection_for_handle(handle);
4636     if (!conn) return;
4637     if (conn->address_type == BD_ADDR_TYPE_ACL){
4638         l2cap_acl_classic_handler(handle, packet, size);
4639     } else {
4640         l2cap_acl_le_handler(handle, packet, size);
4641     }
4642 
4643     l2cap_run();
4644 }
4645 
4646 // Bluetooth 4.0 - allows to register handler for Attribute Protocol and Security Manager Protocol
4647 void l2cap_register_fixed_channel(btstack_packet_handler_t packet_handler, uint16_t channel_id) {
4648     l2cap_fixed_channel_t * channel = l2cap_fixed_channel_for_channel_id(channel_id);
4649     if (!channel) return;
4650     channel->packet_handler = packet_handler;
4651 }
4652 
4653 #ifdef L2CAP_USES_CHANNELS
4654 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
4655 void l2cap_finalize_channel_close(l2cap_channel_t * channel){
4656     channel->state = L2CAP_STATE_CLOSED;
4657     l2cap_handle_channel_closed(channel);
4658     // discard channel
4659     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
4660     l2cap_free_channel_entry(channel);
4661 }
4662 #endif
4663 
4664 #ifdef ENABLE_CLASSIC
4665 static inline l2cap_service_t * l2cap_get_service(uint16_t psm){
4666     return l2cap_get_service_internal(&l2cap_services, psm);
4667 }
4668 
4669 static void l2cap_update_minimal_security_level(void){
4670     // update minimal service security level
4671     gap_security_level_t minimal_level = LEVEL_1;
4672     btstack_linked_list_iterator_t it;
4673     btstack_linked_list_iterator_init(&it, &l2cap_services);
4674     while (btstack_linked_list_iterator_has_next(&it)){
4675         l2cap_service_t * service = (l2cap_service_t *) btstack_linked_list_iterator_next(&it);
4676         if (service->required_security_level > minimal_level){
4677             minimal_level = service->required_security_level;
4678         };
4679     }
4680     gap_set_minimal_service_security_level(minimal_level);
4681 }
4682 
4683 uint8_t l2cap_register_service(btstack_packet_handler_t service_packet_handler, uint16_t psm, uint16_t mtu, gap_security_level_t security_level){
4684 
4685     log_info("L2CAP_REGISTER_SERVICE psm 0x%x mtu %u", psm, mtu);
4686 
4687     // check for alread registered psm
4688     l2cap_service_t *service = l2cap_get_service(psm);
4689     if (service) {
4690         log_error("register: PSM %u already registered", psm);
4691         return L2CAP_SERVICE_ALREADY_REGISTERED;
4692     }
4693 
4694     // alloc structure
4695     service = btstack_memory_l2cap_service_get();
4696     if (!service) {
4697         log_error("register: no memory for l2cap_service_t");
4698         return BTSTACK_MEMORY_ALLOC_FAILED;
4699     }
4700 
4701     // fill in
4702     service->psm = psm;
4703     service->mtu = mtu;
4704     service->packet_handler = service_packet_handler;
4705     service->required_security_level = security_level;
4706 
4707     // add to services list
4708     btstack_linked_list_add(&l2cap_services, (btstack_linked_item_t *) service);
4709 
4710     l2cap_update_minimal_security_level();
4711 
4712 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
4713     // enable page scan
4714     gap_connectable_control(1);
4715 #endif
4716 
4717 
4718     return ERROR_CODE_SUCCESS;
4719 }
4720 
4721 uint8_t l2cap_unregister_service(uint16_t psm){
4722 
4723     log_info("unregister psm 0x%x", psm);
4724 
4725     l2cap_service_t *service = l2cap_get_service(psm);
4726     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
4727     btstack_linked_list_remove(&l2cap_services, (btstack_linked_item_t *) service);
4728     btstack_memory_l2cap_service_free(service);
4729 
4730     l2cap_update_minimal_security_level();
4731 
4732 #ifndef ENABLE_EXPLICIT_CONNECTABLE_MODE_CONTROL
4733     // disable page scan when no services registered
4734     if (btstack_linked_list_empty(&l2cap_services)) {
4735         gap_connectable_control(0);
4736     }
4737 #endif
4738 
4739     return ERROR_CODE_SUCCESS;
4740 }
4741 #endif
4742 
4743 
4744 #ifdef ENABLE_L2CAP_CREDIT_BASED_CHANNELS
4745 
4746 static void l2cap_credit_based_send_pdu(l2cap_channel_t *channel) {
4747     btstack_assert(channel != NULL);
4748     btstack_assert(channel->send_sdu_buffer != NULL);
4749     btstack_assert(channel->credits_outgoing > 0);
4750 
4751     // send part of SDU
4752     hci_reserve_packet_buffer();
4753     uint8_t *acl_buffer = hci_get_outgoing_packet_buffer();
4754     uint8_t *l2cap_payload = acl_buffer + 8;
4755     uint16_t pos = 0;
4756     if (!channel->send_sdu_pos) {
4757         // store SDU len
4758         channel->send_sdu_pos += 2u;
4759         little_endian_store_16(l2cap_payload, pos, channel->send_sdu_len);
4760         pos += 2u;
4761     }
4762     uint16_t payload_size = btstack_min(channel->send_sdu_len + 2u - channel->send_sdu_pos, channel->remote_mps - pos);
4763     log_info("len %u, pos %u => payload %u, credits %u", channel->send_sdu_len, channel->send_sdu_pos, payload_size,
4764              channel->credits_outgoing);
4765     (void) memcpy(&l2cap_payload[pos],
4766                   &channel->send_sdu_buffer[channel->send_sdu_pos - 2u],
4767                   payload_size); // -2 for virtual SDU len
4768     pos += payload_size;
4769     channel->send_sdu_pos += payload_size;
4770     l2cap_setup_header(acl_buffer, channel->con_handle, 0, channel->remote_cid, pos);
4771 
4772     channel->credits_outgoing--;
4773 
4774     // update state (mark SDU as done) before calling hci_send_acl_packet_buffer (trigger l2cap_le_send_pdu again)
4775     bool done = channel->send_sdu_pos >= (channel->send_sdu_len + 2u);
4776     if (done) {
4777         channel->send_sdu_buffer = NULL;
4778     }
4779 
4780     hci_send_acl_packet_buffer(8u + pos);
4781 
4782     if (done) {
4783         // send done event
4784         l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_LE_PACKET_SENT);
4785         // inform about can send now
4786         l2cap_le_notify_channel_can_send(channel);
4787     }
4788 }
4789 
4790 static uint8_t l2cap_credit_based_send_data(uint16_t local_cid, const uint8_t * data, uint16_t size){
4791 
4792     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
4793     if (!channel) {
4794         log_error("l2cap send, no channel for cid 0x%02x", local_cid);
4795         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
4796     }
4797 
4798     if (size > channel->remote_mtu){
4799         log_error("l2cap send, cid 0x%02x, data length exceeds remote MTU.", local_cid);
4800         return L2CAP_DATA_LEN_EXCEEDS_REMOTE_MTU;
4801     }
4802 
4803     if (channel->send_sdu_buffer){
4804         log_info("l2cap send, cid 0x%02x, cannot send", local_cid);
4805         return BTSTACK_ACL_BUFFERS_FULL;
4806     }
4807 
4808     channel->send_sdu_buffer = data;
4809     channel->send_sdu_len    = size;
4810     channel->send_sdu_pos    = 0;
4811 
4812     l2cap_notify_channel_can_send();
4813     return ERROR_CODE_SUCCESS;
4814 }
4815 
4816 static uint8_t l2cap_credit_based_provide_credits(uint16_t local_cid, uint16_t credits){
4817     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
4818     if (!channel) {
4819         log_error("le credits no channel for cid 0x%02x", local_cid);
4820         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
4821     }
4822 
4823     // check state
4824     if (channel->state != L2CAP_STATE_OPEN){
4825         log_error("le credits but channel 0x%02x not open yet", local_cid);
4826     }
4827 
4828     // ignore if set to automatic credits
4829     if (channel->automatic_credits) return ERROR_CODE_SUCCESS;
4830 
4831     // assert incoming credits + credits <= 0xffff
4832     uint32_t total_credits = channel->credits_incoming;
4833     total_credits += channel->new_credits_incoming;
4834     total_credits += credits;
4835     if (total_credits > 0xffffu){
4836         log_error("le credits overrun: current %u, scheduled %u, additional %u", channel->credits_incoming,
4837                   channel->new_credits_incoming, credits);
4838     }
4839 
4840     // set credits_granted
4841     channel->new_credits_incoming += credits;
4842 
4843     // go
4844     l2cap_run();
4845     return ERROR_CODE_SUCCESS;
4846 }
4847 
4848 static void l2cap_credit_based_send_credits(l2cap_channel_t *channel) {
4849     log_info("l2cap: sending %u credits", channel->new_credits_incoming);
4850     channel->local_sig_id = l2cap_next_sig_id();
4851     uint16_t new_credits = channel->new_credits_incoming;
4852     channel->new_credits_incoming = 0;
4853     channel->credits_incoming += new_credits;
4854     uint16_t signaling_cid = channel->address_type == BD_ADDR_TYPE_ACL ? L2CAP_CID_SIGNALING : L2CAP_CID_SIGNALING_LE;
4855     l2cap_send_general_signaling_packet(channel->con_handle, signaling_cid, L2CAP_FLOW_CONTROL_CREDIT_INDICATION, channel->local_sig_id, channel->local_cid, new_credits);
4856 }
4857 
4858 // @return valid
4859 static bool l2cap_credit_based_handle_credit_indication(hci_con_handle_t handle, const uint8_t * command, uint16_t len){
4860     // check size
4861     if (len < 4u) return false;
4862 
4863     // find channel
4864     uint16_t remote_cid = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 0);
4865     l2cap_channel_t * channel = l2cap_get_channel_for_remote_handle_and_cid(handle, remote_cid);
4866     if (!channel) {
4867         log_error("credit: no channel for handle 0x%04x/cid 0x%02x", handle, remote_cid);
4868         return true;
4869     }
4870     uint16_t new_credits = little_endian_read_16(command, L2CAP_SIGNALING_COMMAND_DATA_OFFSET + 2);
4871     uint16_t credits_before = channel->credits_outgoing;
4872     channel->credits_outgoing += new_credits;
4873     // check for credit overrun
4874     if (credits_before > channel->credits_outgoing) {
4875         log_error("credit: new credits caused overrrun for cid 0x%02x, disconnecting", channel->local_cid);
4876         channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
4877         return true;
4878     }
4879     log_info("credit: %u credits for 0x%02x, now %u", new_credits, channel->local_cid, channel->credits_outgoing);
4880     l2cap_call_notify_channel_in_run = true;
4881     return true;
4882 }
4883 
4884 static void l2cap_credit_based_handle_pdu(l2cap_channel_t * l2cap_channel, const uint8_t * packet, uint16_t size){
4885     // ignore empty packets
4886     if (size == COMPLETE_L2CAP_HEADER) return;
4887 
4888     // credit counting
4889     if (l2cap_channel->credits_incoming == 0u){
4890         log_info("Data Channel packet received but no incoming credits");
4891         l2cap_channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
4892         return;
4893     }
4894     l2cap_channel->credits_incoming--;
4895 
4896     // automatic credits
4897     if ((l2cap_channel->credits_incoming < L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_WATERMARK) && l2cap_channel->automatic_credits){
4898         l2cap_channel->new_credits_incoming = L2CAP_LE_DATA_CHANNELS_AUTOMATIC_CREDITS_INCREMENT;
4899     }
4900 
4901     // first fragment
4902     uint16_t pos = 0;
4903     if (!l2cap_channel->receive_sdu_len){
4904         if (size < (COMPLETE_L2CAP_HEADER + 2)) return;
4905         uint16_t sdu_len = little_endian_read_16(packet, COMPLETE_L2CAP_HEADER);
4906         if(sdu_len > l2cap_channel->local_mtu) return;   // SDU would be larger than our buffer
4907         l2cap_channel->receive_sdu_len = sdu_len;
4908         l2cap_channel->receive_sdu_pos = 0;
4909         pos  += 2u;
4910         size -= 2u;
4911     }
4912     uint16_t fragment_size   = size-COMPLETE_L2CAP_HEADER;
4913     uint16_t remaining_space = l2cap_channel->local_mtu - l2cap_channel->receive_sdu_pos;
4914     if (fragment_size > remaining_space) return;         // SDU would cause buffer overrun
4915     (void)memcpy(&l2cap_channel->receive_sdu_buffer[l2cap_channel->receive_sdu_pos],
4916                  &packet[COMPLETE_L2CAP_HEADER + pos],
4917                  fragment_size);
4918     l2cap_channel->receive_sdu_pos += size - COMPLETE_L2CAP_HEADER;
4919     // done?
4920     log_debug("le packet pos %u, len %u", l2cap_channel->receive_sdu_pos, l2cap_channel->receive_sdu_len);
4921     if (l2cap_channel->receive_sdu_pos >= l2cap_channel->receive_sdu_len){
4922         l2cap_dispatch_to_channel(l2cap_channel, L2CAP_DATA_PACKET, l2cap_channel->receive_sdu_buffer, l2cap_channel->receive_sdu_len);
4923         l2cap_channel->receive_sdu_len = 0;
4924     }
4925 }
4926 
4927 static uint8_t l2cap_credit_based_disconnect(uint16_t local_cid){
4928     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
4929     if (!channel) {
4930         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
4931     }
4932     channel->state = L2CAP_STATE_WILL_SEND_DISCONNECT_REQUEST;
4933     l2cap_run();
4934     return ERROR_CODE_SUCCESS;
4935 }
4936 #endif
4937 
4938 #ifdef ENABLE_L2CAP_LE_CREDIT_BASED_FLOW_CONTROL_MODE
4939 
4940 static void l2cap_le_notify_channel_can_send(l2cap_channel_t *channel){
4941     if (!channel->waiting_for_can_send_now) return;
4942     if (channel->send_sdu_buffer) return;
4943     channel->waiting_for_can_send_now = 0;
4944     log_debug("le can send now, local_cid 0x%x", channel->local_cid);
4945     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_LE_CAN_SEND_NOW);
4946 }
4947 
4948 // 1BH2222
4949 static void l2cap_emit_le_incoming_connection(l2cap_channel_t *channel) {
4950     log_info("le incoming addr_type %u, addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x, remote_mtu %u",
4951              channel->address_type, bd_addr_to_str(channel->address), channel->con_handle,  channel->psm, channel->local_cid, channel->remote_cid, channel->remote_mtu);
4952     uint8_t event[19];
4953     event[0] = L2CAP_EVENT_LE_INCOMING_CONNECTION;
4954     event[1] = sizeof(event) - 2u;
4955     event[2] = channel->address_type;
4956     reverse_bd_addr(channel->address, &event[3]);
4957     little_endian_store_16(event,  9, channel->con_handle);
4958     little_endian_store_16(event, 11, channel->psm);
4959     little_endian_store_16(event, 13, channel->local_cid);
4960     little_endian_store_16(event, 15, channel->remote_cid);
4961     little_endian_store_16(event, 17, channel->remote_mtu);
4962     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
4963     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
4964 }
4965 // 11BH22222
4966 static void l2cap_emit_le_channel_opened(l2cap_channel_t *channel, uint8_t status) {
4967     log_info("opened le channel status 0x%x addr_type %u addr %s handle 0x%x psm 0x%x local_cid 0x%x remote_cid 0x%x local_mtu %u, remote_mtu %u",
4968              status, channel->address_type, bd_addr_to_str(channel->address), channel->con_handle, channel->psm,
4969              channel->local_cid, channel->remote_cid, channel->local_mtu, channel->remote_mtu);
4970     uint8_t event[23];
4971     event[0] = L2CAP_EVENT_LE_CHANNEL_OPENED;
4972     event[1] = sizeof(event) - 2u;
4973     event[2] = status;
4974     event[3] = channel->address_type;
4975     reverse_bd_addr(channel->address, &event[4]);
4976     little_endian_store_16(event, 10, channel->con_handle);
4977     event[12] = (channel->state_var & L2CAP_CHANNEL_STATE_VAR_INCOMING) ? 1 : 0;
4978     little_endian_store_16(event, 13, channel->psm);
4979     little_endian_store_16(event, 15, channel->local_cid);
4980     little_endian_store_16(event, 17, channel->remote_cid);
4981     little_endian_store_16(event, 19, channel->local_mtu);
4982     little_endian_store_16(event, 21, channel->remote_mtu);
4983     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
4984     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
4985 }
4986 // 2
4987 static void l2cap_emit_le_channel_closed(l2cap_channel_t * channel){
4988     log_info("closed local_cid 0x%x", channel->local_cid);
4989     uint8_t event[4];
4990     event[0] = L2CAP_EVENT_LE_CHANNEL_CLOSED;
4991     event[1] = sizeof(event) - 2u;
4992     little_endian_store_16(event, 2, channel->local_cid);
4993     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
4994     l2cap_dispatch_to_channel(channel, HCI_EVENT_PACKET, event, sizeof(event));
4995 }
4996 
4997 // finalize closed channel - l2cap_handle_disconnect_request & DISCONNECTION_RESPONSE
4998 void l2cap_le_finialize_channel_close(l2cap_channel_t * channel){
4999     channel->state = L2CAP_STATE_CLOSED;
5000     l2cap_emit_simple_event_with_cid(channel, L2CAP_EVENT_CHANNEL_CLOSED);
5001     // discard channel
5002     btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
5003     l2cap_free_channel_entry(channel);
5004 }
5005 
5006 static inline l2cap_service_t * l2cap_le_get_service(uint16_t le_psm){
5007     return l2cap_get_service_internal(&l2cap_le_services, le_psm);
5008 }
5009 
5010 uint8_t l2cap_le_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, gap_security_level_t security_level){
5011 
5012     log_info("L2CAP_LE_REGISTER_SERVICE psm 0x%x", psm);
5013 
5014     // check for alread registered psm
5015     l2cap_service_t *service = l2cap_le_get_service(psm);
5016     if (service) {
5017         return L2CAP_SERVICE_ALREADY_REGISTERED;
5018     }
5019 
5020     // alloc structure
5021     service = btstack_memory_l2cap_service_get();
5022     if (!service) {
5023         log_error("register: no memory for l2cap_service_t");
5024         return BTSTACK_MEMORY_ALLOC_FAILED;
5025     }
5026 
5027     // fill in
5028     service->psm = psm;
5029     service->mtu = 0;
5030     service->packet_handler = packet_handler;
5031     service->required_security_level = security_level;
5032 
5033     // add to services list
5034     btstack_linked_list_add(&l2cap_le_services, (btstack_linked_item_t *) service);
5035 
5036     // done
5037     return ERROR_CODE_SUCCESS;
5038 }
5039 
5040 uint8_t l2cap_le_unregister_service(uint16_t psm) {
5041     log_info("L2CAP_LE_UNREGISTER_SERVICE psm 0x%x", psm);
5042     l2cap_service_t *service = l2cap_le_get_service(psm);
5043     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
5044 
5045     btstack_linked_list_remove(&l2cap_le_services, (btstack_linked_item_t *) service);
5046     btstack_memory_l2cap_service_free(service);
5047     return ERROR_CODE_SUCCESS;
5048 }
5049 
5050 uint8_t l2cap_le_accept_connection(uint16_t local_cid, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits){
5051     // get channel
5052     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5053     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5054 
5055     // validate state
5056     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
5057         return ERROR_CODE_COMMAND_DISALLOWED;
5058     }
5059 
5060     // set state accept connection
5061     channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_ACCEPT;
5062     channel->receive_sdu_buffer = receive_sdu_buffer;
5063     channel->local_mtu = mtu;
5064     channel->new_credits_incoming = initial_credits;
5065     channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5066 
5067     // go
5068     l2cap_run();
5069     return ERROR_CODE_SUCCESS;
5070 }
5071 
5072 /**
5073  * @brief Deny incoming LE Data Channel connection due to resource constraints
5074  * @param local_cid             L2CAP LE Data Channel Identifier
5075  */
5076 
5077 uint8_t l2cap_le_decline_connection(uint16_t local_cid){
5078     // get channel
5079     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5080     if (!channel) return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5081 
5082     // validate state
5083     if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT){
5084         return ERROR_CODE_COMMAND_DISALLOWED;
5085     }
5086 
5087     // set state decline connection
5088     channel->state  = L2CAP_STATE_WILL_SEND_LE_CONNECTION_RESPONSE_DECLINE;
5089     channel->reason = 0x04; // no resources available
5090     l2cap_run();
5091     return ERROR_CODE_SUCCESS;
5092 }
5093 
5094 static gap_security_level_t l2cap_le_security_level_for_connection(hci_con_handle_t con_handle){
5095     uint8_t encryption_key_size = gap_encryption_key_size(con_handle);
5096     if (encryption_key_size == 0) return LEVEL_0;
5097 
5098     uint8_t authenticated = gap_authenticated(con_handle);
5099     if (!authenticated) return LEVEL_2;
5100 
5101     return encryption_key_size == 16 ? LEVEL_4 : LEVEL_3;
5102 }
5103 
5104 // used to handle pairing complete after triggering to increase
5105 static void l2cap_sm_packet_handler(uint8_t packet_type, uint16_t channel_nr, uint8_t *packet, uint16_t size) {
5106     UNUSED(channel_nr);
5107     UNUSED(size);
5108     UNUSED(packet_type);
5109     btstack_assert(packet_type == HCI_EVENT_PACKET);
5110     if (hci_event_packet_get_type(packet) != SM_EVENT_PAIRING_COMPLETE) return;
5111     hci_con_handle_t con_handle = sm_event_pairing_complete_get_handle(packet);
5112     btstack_linked_list_iterator_t it;
5113     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5114     while (btstack_linked_list_iterator_has_next(&it)) {
5115         l2cap_channel_t *channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5116         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5117         if (channel->con_handle != con_handle) continue;
5118         if (channel->state != L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE) continue;
5119 
5120         // found channel, check security level
5121         if (l2cap_le_security_level_for_connection(con_handle) < channel->required_security_level){
5122             // pairing failed or wasn't good enough, inform user
5123             l2cap_emit_le_channel_opened(channel, ERROR_CODE_INSUFFICIENT_SECURITY);
5124             // discard channel
5125             btstack_linked_list_remove(&l2cap_channels, (btstack_linked_item_t *) channel);
5126             l2cap_free_channel_entry(channel);
5127         } else {
5128             // send conn request now
5129             channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5130             l2cap_run();
5131         }
5132     }
5133 }
5134 
5135 uint8_t l2cap_le_create_channel(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
5136     uint16_t psm, uint8_t * receive_sdu_buffer, uint16_t mtu, uint16_t initial_credits, gap_security_level_t security_level,
5137     uint16_t * out_local_cid) {
5138 
5139     static btstack_packet_callback_registration_t sm_event_callback_registration;
5140     static bool sm_callback_registered = false;
5141 
5142     log_info("create, handle 0x%04x psm 0x%x mtu %u", con_handle, psm, mtu);
5143 
5144     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5145     if (!connection) {
5146         log_error("no hci_connection for handle 0x%04x", con_handle);
5147         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5148     }
5149 
5150     l2cap_channel_t * channel = l2cap_create_channel_entry(packet_handler, L2CAP_CHANNEL_TYPE_LE_DATA_CHANNEL, connection->address, connection->address_type, psm, mtu, security_level);
5151     if (!channel) {
5152         return BTSTACK_MEMORY_ALLOC_FAILED;
5153     }
5154     log_info("created %p", channel);
5155 
5156     // store local_cid
5157     if (out_local_cid){
5158        *out_local_cid = channel->local_cid;
5159     }
5160 
5161     // setup channel entry
5162     channel->con_handle = con_handle;
5163     channel->receive_sdu_buffer = receive_sdu_buffer;
5164     channel->new_credits_incoming = initial_credits;
5165     channel->automatic_credits    = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5166 
5167     // add to connections list
5168     btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
5169 
5170     // check security level
5171     if (l2cap_le_security_level_for_connection(con_handle) < channel->required_security_level){
5172         if (!sm_callback_registered){
5173             sm_callback_registered = true;
5174             // lazy registration for SM events
5175             sm_event_callback_registration.callback = &l2cap_sm_packet_handler;
5176             sm_add_event_handler(&sm_event_callback_registration);
5177         }
5178 
5179         // start pairing
5180         channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
5181         sm_request_pairing(con_handle);
5182     } else {
5183         // send conn request right away
5184         channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5185         l2cap_run();
5186     }
5187 
5188     return ERROR_CODE_SUCCESS;
5189 }
5190 
5191 /**
5192  * @brief Provide credtis for LE Data Channel
5193  * @param local_cid             L2CAP LE Data Channel Identifier
5194  * @param credits               Number additional credits for peer
5195  */
5196 uint8_t l2cap_le_provide_credits(uint16_t local_cid, uint16_t credits){
5197     return l2cap_credit_based_provide_credits(local_cid, credits);
5198 }
5199 
5200 /**
5201  * @brief Check if outgoing buffer is available and that there's space on the Bluetooth module
5202  * @param local_cid             L2CAP LE Data Channel Identifier
5203  */
5204 bool l2cap_le_can_send_now(uint16_t local_cid){
5205     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5206     if (!channel) {
5207         log_error("le can send now, no channel for cid 0x%02x", local_cid);
5208         return false;
5209     }
5210 
5211     // check state
5212     if (channel->state != L2CAP_STATE_OPEN) return false;
5213 
5214     // check queue
5215     if (channel->send_sdu_buffer) return false;
5216 
5217     // fine, go ahead
5218     return true;
5219 }
5220 
5221 /**
5222  * @brief Request emission of L2CAP_EVENT_CAN_SEND_NOW as soon as possible
5223  * @note L2CAP_EVENT_CAN_SEND_NOW might be emitted during call to this function
5224  *       so packet handler should be ready to handle it
5225  * @param local_cid             L2CAP LE Data Channel Identifier
5226  */
5227 uint8_t l2cap_le_request_can_send_now_event(uint16_t local_cid){
5228     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5229     if (!channel) {
5230         log_error("can send now, no channel for cid 0x%02x", local_cid);
5231         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5232     }
5233     channel->waiting_for_can_send_now = 1;
5234     l2cap_le_notify_channel_can_send(channel);
5235     return ERROR_CODE_SUCCESS;
5236 }
5237 
5238 /**
5239  * @brief Send data via LE Data Channel
5240  * @note Since data larger then the maximum PDU needs to be segmented into multiple PDUs, data needs to stay valid until ... event
5241  * @param local_cid             L2CAP LE Data Channel Identifier
5242  * @param data                  data to send
5243  * @param size                  data size
5244  */
5245 uint8_t l2cap_le_send_data(uint16_t local_cid, uint8_t * data, uint16_t size){
5246     return l2cap_credit_based_send_data(local_cid, data, size);
5247 }
5248 
5249 
5250 /**
5251  * @brief Disconnect from LE Data Channel
5252  * @param local_cid             L2CAP LE Data Channel Identifier
5253  */
5254 uint8_t l2cap_le_disconnect(uint16_t local_cid){
5255     return l2cap_credit_based_disconnect(local_cid);
5256 }
5257 #endif
5258 
5259 #ifdef ENABLE_L2CAP_ENHANCED_DATA_CHANNELS
5260 
5261 uint8_t l2cap_enhanced_register_service(btstack_packet_handler_t packet_handler, uint16_t psm, uint16_t min_remote_mtu, gap_security_level_t security_level){
5262 
5263     // check for already registered psm
5264     l2cap_service_t *service = l2cap_le_get_service(psm);
5265     if (service) {
5266         return L2CAP_SERVICE_ALREADY_REGISTERED;
5267     }
5268 
5269     // alloc structure
5270     service = btstack_memory_l2cap_service_get();
5271     if (!service) {
5272         log_error("register: no memory for l2cap_service_t");
5273         return BTSTACK_MEMORY_ALLOC_FAILED;
5274     }
5275 
5276     // fill in
5277     service->psm = psm;
5278     service->mtu = min_remote_mtu;
5279     service->packet_handler = packet_handler;
5280     service->required_security_level = security_level;
5281 
5282     // add to services list
5283     btstack_linked_list_add(&l2cap_enhanced_services, (btstack_linked_item_t *) service);
5284 
5285     // done
5286     return ERROR_CODE_SUCCESS;
5287 }
5288 
5289 uint8_t l2cap_enhanced_unregister_service(uint16_t psm) {
5290     l2cap_service_t *service = l2cap_le_get_service(psm);
5291     if (!service) return L2CAP_SERVICE_DOES_NOT_EXIST;
5292 
5293     btstack_linked_list_remove(&l2cap_enhanced_services, (btstack_linked_item_t *) service);
5294     btstack_memory_l2cap_service_free(service);
5295     return ERROR_CODE_SUCCESS;
5296 }
5297 
5298 void l2cap_enhanced_mps_set_min(uint16_t mps_min){
5299     l2cap_enhanced_mps_min = mps_min;
5300 }
5301 
5302 void l2cap_enhanced_mps_set_max(uint16_t mps_max){
5303     l2cap_enhanced_mps_max = mps_max;
5304 }
5305 
5306 uint8_t l2cap_enhanced_create_channels(btstack_packet_handler_t packet_handler, hci_con_handle_t con_handle,
5307                                        gap_security_level_t security_level,
5308                                        uint16_t psm, uint8_t num_channels, uint16_t initial_credits, uint16_t mtu,
5309                                        uint8_t ** receive_sdu_buffers, uint16_t * out_local_cid){
5310 
5311     log_info("create enhanced, handle 0x%04x psm 0x%x mtu %u", con_handle, psm, mtu);
5312 
5313     hci_connection_t * connection = hci_connection_for_handle(con_handle);
5314     if (!connection) {
5315         log_error("no hci_connection for handle 0x%04x", con_handle);
5316         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
5317     }
5318 
5319     // setup all channels
5320     btstack_linked_list_t channels = NULL;
5321     uint8_t status = l2cap_enhanced_setup_channels(&channels, packet_handler, num_channels, connection,  psm, mtu, security_level);
5322 
5323     // add to connections list and set state + local_sig_id
5324     l2cap_channel_t * channel;
5325     uint8_t i = 0;
5326     uint8_t local_sig_id = l2cap_next_sig_id();
5327     while (true) {
5328         channel = (l2cap_channel_t *) btstack_linked_list_pop(&channels);
5329         if (channel == NULL) break;
5330         channel->state              = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_REQUEST;
5331         channel->local_sig_id       = local_sig_id;
5332         channel->cid_index = i;
5333         channel->num_cids = num_channels;
5334         channel->credits_incoming   = initial_credits;
5335         channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5336         channel->receive_sdu_buffer = receive_sdu_buffers[i];
5337         // store local_cid
5338         if (out_local_cid){
5339             out_local_cid[i] = channel->local_cid;
5340         }
5341         btstack_linked_list_add_tail(&l2cap_channels, (btstack_linked_item_t *) channel);
5342         i++;
5343     }
5344 
5345 #if 0
5346     // check security level
5347     if (l2cap_le_security_level_for_connection(con_handle) < channel->required_security_level){
5348         if (!sm_callback_registered){
5349             sm_callback_registered = true;
5350             // lazy registration for SM events
5351             sm_event_callback_registration.callback = &l2cap_sm_packet_handler;
5352             sm_add_event_handler(&sm_event_callback_registration);
5353         }
5354 
5355         // start pairing
5356         channel->state = L2CAP_STATE_WAIT_OUTGOING_SECURITY_LEVEL_UPDATE;
5357         sm_request_pairing(con_handle);
5358     } else {
5359         // send conn request right away
5360         channel->state = L2CAP_STATE_WILL_SEND_LE_CONNECTION_REQUEST;
5361         l2cap_run();
5362     }
5363 #endif
5364 
5365     l2cap_run();
5366 
5367     return status;
5368 }
5369 
5370 uint8_t l2cap_enhanced_accept_data_channels(uint16_t local_cid, uint8_t num_channels, uint16_t initial_credits,
5371                                             uint16_t receive_buffer_size, uint8_t ** receive_buffers, uint16_t * out_local_cids){
5372 
5373     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5374     if (!channel) {
5375 
5376         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5377     }
5378     //
5379     hci_con_handle_t  con_handle    = channel->con_handle;
5380     uint8_t           local_sig_id  = channel->local_sig_id;
5381     uint8_t           channel_index = 0;
5382     btstack_linked_list_iterator_t it;
5383     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5384     while (btstack_linked_list_iterator_has_next(&it)) {
5385         channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5386         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5387         if (channel->con_handle != con_handle) continue;
5388         if (channel->local_sig_id != local_sig_id) continue;
5389         if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT) continue;
5390 
5391         if (channel_index < num_channels){
5392             // assign buffer and cid
5393             out_local_cids[channel_index] = channel->local_cid;
5394             channel->receive_sdu_buffer = receive_buffers[channel_index];
5395             channel->local_mtu = receive_buffer_size;
5396             channel->credits_incoming   = initial_credits;
5397             channel->automatic_credits  = initial_credits == L2CAP_LE_AUTOMATIC_CREDITS;
5398             channel_index++;
5399         } else {
5400             // clear local cid for response packet
5401             channel->local_cid = 0;
5402             // Some connections refused – insufficient resources available
5403             channel->reason = 0x004;
5404         }
5405         // update state
5406         channel->state = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE;
5407     }
5408     l2cap_run();
5409     return ERROR_CODE_SUCCESS;
5410 }
5411 
5412 
5413 
5414 
5415 
5416 
5417 uint8_t l2cap_enhanced_decline_data_channels(uint16_t local_cid, uint16_t result){
5418     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5419     if (!channel) {
5420         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5421     }
5422     //
5423     hci_con_handle_t  con_handle    = channel->con_handle;
5424     uint8_t           local_sig_id  = channel->local_sig_id;
5425     btstack_linked_list_iterator_t it;
5426     btstack_linked_list_iterator_init(&it, &l2cap_channels);
5427     while (btstack_linked_list_iterator_has_next(&it)) {
5428         channel = (l2cap_channel_t *) btstack_linked_list_iterator_next(&it);
5429         if (!l2cap_is_dynamic_channel_type(channel->channel_type)) continue;
5430         if (channel->con_handle != con_handle) continue;
5431         if (channel->local_sig_id != local_sig_id) continue;
5432         if (channel->state != L2CAP_STATE_WAIT_CLIENT_ACCEPT_OR_REJECT) continue;
5433 
5434         // prepare response
5435         channel->local_cid = 0;
5436         channel->reason = result;
5437         channel->state = L2CAP_STATE_WILL_SEND_ENHANCED_CONNECTION_RESPONSE;
5438     }
5439     l2cap_run();
5440     return ERROR_CODE_SUCCESS;
5441 }
5442 
5443 uint8_t l2cap_enhanced_data_channel_request_can_send_now_event(uint16_t local_cid){
5444     l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cid);
5445     if (!channel) {
5446         log_error("can send now, no channel for cid 0x%02x", local_cid);
5447         return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5448     }
5449     channel->waiting_for_can_send_now = 1;
5450     l2cap_le_notify_channel_can_send(channel);
5451     return ERROR_CODE_SUCCESS;
5452 }
5453 
5454 uint8_t l2cap_enhanced_reconfigure(uint8_t num_cids, uint16_t * local_cids, int16_t receive_buffer_size, uint8_t ** receive_buffers){
5455     btstack_assert(receive_buffers != NULL);
5456     btstack_assert(local_cids != NULL);
5457 
5458     if (num_cids > L2CAP_ENHANCED_DATA_CHANNEL_MAX_CID_ARRAY_SIZE){
5459         return ERROR_CODE_UNACCEPTABLE_CONNECTION_PARAMETERS;
5460     }
5461 
5462     // check if all cids exist and have the same con handle
5463     uint8_t i;
5464     hci_con_handle_t con_handle = HCI_CON_HANDLE_INVALID;
5465     for (i = 0 ; i < num_cids ; i++){
5466         l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cids[i]);
5467         if (!channel) {
5468             return L2CAP_LOCAL_CID_DOES_NOT_EXIST;
5469         }
5470         if (channel->state != L2CAP_STATE_OPEN){
5471             return ERROR_CODE_COMMAND_DISALLOWED;
5472         }
5473         if (con_handle == HCI_CON_HANDLE_INVALID){
5474             con_handle = channel->con_handle;
5475         } else if (con_handle != channel->con_handle){
5476             return ERROR_CODE_UNACCEPTABLE_CONNECTION_PARAMETERS;
5477         }
5478     }
5479     // set renegotiation data and state
5480     uint8_t sig_id = l2cap_next_sig_id();
5481     for (i = 0 ; i < num_cids ; i++){
5482         l2cap_channel_t * channel = l2cap_get_channel_for_local_cid(local_cids[i]);
5483         channel->cid_index = i;
5484         channel->num_cids = num_cids;
5485         channel->local_sig_id = sig_id;
5486         channel->renegotiate_mtu = receive_buffer_size;
5487         channel->renegotiate_sdu_buffer = receive_buffers[i];
5488         channel->state = L2CAP_STATE_WILL_SEND_EHNANCED_RENEGOTIATION_REQUEST;
5489     }
5490 
5491 
5492     l2cap_run();
5493     return ERROR_CODE_SUCCESS;
5494 }
5495 
5496 uint8_t l2cap_enhanced_send_data(uint16_t local_cid, const uint8_t * data, uint16_t size){
5497     return l2cap_credit_based_send_data(local_cid, data, size);
5498 }
5499 
5500 uint8_t l2cap_enhanced_provide_credits(uint16_t local_cid, uint16_t credits){
5501     return l2cap_credit_based_provide_credits(local_cid, credits);
5502 }
5503 
5504 uint8_t l2cap_enhanced_disconnect(uint16_t local_cid){
5505     return l2cap_credit_based_disconnect(local_cid);
5506 }
5507 
5508 #endif
5509