xref: /btstack/src/classic/rfcomm.c (revision 046b44372d25c7bd6fe78e5cf6e5176a1979f437)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL MATTHIAS
24  * RINGWALD OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "rfcomm.c"
39 
40 /*
41  *  rfcomm.c
42  */
43 
44 #include <stdio.h>
45 #include <stdlib.h>
46 #include <string.h> // memcpy
47 #include <stdint.h>
48 
49 #include "bluetooth_sdp.h"
50 #include "btstack_debug.h"
51 #include "btstack_event.h"
52 #include "btstack_memory.h"
53 #include "btstack_util.h"
54 #include "classic/core.h"
55 #include "classic/rfcomm.h"
56 #include "hci.h"
57 #include "hci_cmd.h"
58 #include "hci_dump.h"
59 #include "l2cap.h"
60 
61 // workaround for missing PRIxPTR on mspgcc (16/20-bit MCU)
62 #ifndef PRIxPTR
63 #if defined(__MSP430X__)  &&  defined(__MSP430X_LARGE__)
64 #define PRIxPTR "lx"
65 #else
66 #define PRIxPTR "x"
67 #endif
68 #endif
69 
70 // ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
71 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM
72 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
73 #define RFCOMM_USE_OUTGOING_BUFFER
74 #define RFCOMM_USE_ERTM
75 #else
76 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE. "
77 #error "Please disable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM, or, "
78 #error "enable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE"
79 #endif
80 #endif
81 
82 #define RFCOMM_MULIPLEXER_TIMEOUT_MS 60000
83 
84 #define RFCOMM_CREDITS 10
85 
86 // FCS calc
87 #define BT_RFCOMM_CODE_WORD         0xE0 // pol = x8+x2+x1+1
88 #define BT_RFCOMM_CRC_CHECK_LEN     3
89 #define BT_RFCOMM_UIHCRC_CHECK_LEN  2
90 
91 
92 typedef enum {
93     CH_EVT_RCVD_SABM = 1,
94     CH_EVT_RCVD_UA,
95     CH_EVT_RCVD_PN,
96     CH_EVT_RCVD_PN_RSP,
97     CH_EVT_RCVD_DISC,
98     CH_EVT_RCVD_DM,
99     CH_EVT_RCVD_MSC_CMD,
100     CH_EVT_RCVD_MSC_RSP,
101     CH_EVT_RCVD_NSC_RSP,
102     CH_EVT_RCVD_RLS_CMD,
103     CH_EVT_RCVD_RLS_RSP,
104     CH_EVT_RCVD_RPN_CMD,
105     CH_EVT_RCVD_RPN_REQ,
106     CH_EVT_RCVD_CREDITS,
107     CH_EVT_MULTIPLEXER_READY,
108     CH_EVT_READY_TO_SEND,
109 } RFCOMM_CHANNEL_EVENT;
110 
111 typedef struct rfcomm_channel_event {
112     RFCOMM_CHANNEL_EVENT type;
113     uint16_t dummy; // force rfcomm_channel_event to be 2-byte aligned -> avoid -Wcast-align warning
114 } rfcomm_channel_event_t;
115 
116 typedef struct rfcomm_channel_event_pn {
117     rfcomm_channel_event_t super;
118     uint16_t max_frame_size;
119     uint8_t  priority;
120     uint8_t  credits_outgoing;
121 } rfcomm_channel_event_pn_t;
122 
123 typedef struct rfcomm_channel_event_rpn {
124     rfcomm_channel_event_t super;
125     rfcomm_rpn_data_t data;
126 } rfcomm_channel_event_rpn_t;
127 
128 typedef struct rfcomm_channel_event_rls {
129     rfcomm_channel_event_t super;
130     uint8_t line_status;
131 } rfcomm_channel_event_rls_t;
132 
133 typedef struct rfcomm_channel_event_msc {
134     rfcomm_channel_event_t super;
135     uint8_t modem_status;
136 } rfcomm_channel_event_msc_t;
137 
138 
139 // global rfcomm data
140 static uint16_t      rfcomm_client_cid_generator;  // used for client channel IDs
141 
142 // linked lists for all
143 static btstack_linked_list_t rfcomm_multiplexers = NULL;
144 static btstack_linked_list_t rfcomm_channels = NULL;
145 static btstack_linked_list_t rfcomm_services = NULL;
146 
147 static gap_security_level_t rfcomm_security_level;
148 
149 #ifdef RFCOMM_USE_ERTM
150 static uint16_t rfcomm_ertm_id;
151 void (*rfcomm_ertm_request_callback)(rfcomm_ertm_request_t * request);
152 void (*rfcomm_ertm_released_callback)(uint16_t ertm_id);
153 #endif
154 
155 #ifdef RFCOMM_USE_OUTGOING_BUFFER
156 static uint8_t outgoing_buffer[1030];
157 #endif
158 
159 static int  rfcomm_channel_can_send(rfcomm_channel_t * channel);
160 static int  rfcomm_channel_ready_for_open(rfcomm_channel_t *channel);
161 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel);
162 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid);
163 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event);
164 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel);
165 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer);
166 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event);
167 
168 // MARK: RFCOMM CLIENT EVENTS
169 
170 static rfcomm_channel_t * rfcomm_channel_for_rfcomm_cid(uint16_t rfcomm_cid){
171     btstack_linked_item_t *it;
172     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
173         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
174         if (channel->rfcomm_cid == rfcomm_cid) {
175             return channel;
176         };
177     }
178     return NULL;
179 }
180 
181 static uint16_t rfcomm_next_client_cid(void){
182     do {
183         if (rfcomm_client_cid_generator == 0xffff) {
184             // don't use 0 as channel id
185             rfcomm_client_cid_generator = 1;
186         } else {
187             rfcomm_client_cid_generator++;
188         }
189     } while (rfcomm_channel_for_rfcomm_cid(rfcomm_client_cid_generator) != NULL);
190     return rfcomm_client_cid_generator;
191 }
192 
193 #ifdef RFCOMM_USE_ERTM
194 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_ertm_id(uint16_t ertm_id) {
195     btstack_linked_item_t *it;
196     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
197         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
198         if (multiplexer->ertm_id == ertm_id) {
199             return multiplexer;
200         };
201     }
202     return NULL;
203 }
204 
205 static uint16_t rfcomm_next_ertm_id(void){
206     do {
207         if (rfcomm_ertm_id == 0xffff) {
208             // don't use 0 as channel id
209             rfcomm_ertm_id = 1;
210         } else {
211             rfcomm_ertm_id++;
212         }
213     } while (rfcomm_multiplexer_for_ertm_id(rfcomm_ertm_id) != NULL);
214     return rfcomm_ertm_id;
215 }
216 
217 #endif
218 
219 // data: event (8), len(8), address(48), channel (8), rfcomm_cid (16)
220 static void rfcomm_emit_connection_request(rfcomm_channel_t *channel) {
221     log_info("RFCOMM_EVENT_INCOMING_CONNECTION addr %s channel #%u cid 0x%02x",
222              bd_addr_to_str(channel->multiplexer->remote_addr), channel->dlci>>1, channel->rfcomm_cid);
223     uint8_t event[11];
224     event[0] = RFCOMM_EVENT_INCOMING_CONNECTION;
225     event[1] = sizeof(event) - 2;
226     reverse_bd_addr(channel->multiplexer->remote_addr, &event[2]);
227     event[8] = channel->dlci >> 1;
228     little_endian_store_16(event, 9, channel->rfcomm_cid);
229     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
230 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
231 }
232 
233 // API Change: BTstack-0.3.50x uses
234 // data: event(8), len(8), status (8), address (48), server channel(8), rfcomm_cid(16), max frame size(16)
235 // next Cydia release will use SVN version of this
236 // data: event(8), len(8), status (8), address (48), handle (16), server channel(8), rfcomm_cid(16), max frame size(16)
237 static void rfcomm_emit_channel_opened(rfcomm_channel_t *channel, uint8_t status) {
238     log_info("RFCOMM_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x channel #%u cid 0x%02x mtu %u",
239              status, bd_addr_to_str(channel->multiplexer->remote_addr), channel->multiplexer->con_handle,
240              channel->dlci>>1, channel->rfcomm_cid, channel->max_frame_size);
241     uint8_t event[18];
242     uint8_t pos = 0;
243     event[pos++] = RFCOMM_EVENT_CHANNEL_OPENED;  // 0
244     event[pos++] = sizeof(event) - 2;                   // 1
245     event[pos++] = status;                              // 2
246     reverse_bd_addr(channel->multiplexer->remote_addr, &event[pos]); pos += 6; // 3
247     little_endian_store_16(event,  pos, channel->multiplexer->con_handle);   pos += 2; // 9
248 	event[pos++] = channel->dlci >> 1;                                      // 11
249 	little_endian_store_16(event, pos, channel->rfcomm_cid); pos += 2;                 // 12 - channel ID
250 	little_endian_store_16(event, pos, channel->max_frame_size); pos += 2;   // max frame size
251     event[pos++] = channel->service ? 1 : 0;    // linked to service -> incoming
252     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
253 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, pos);
254 
255     // if channel opened successfully, also send can send now if possible
256     if (status) return;
257     if (rfcomm_channel_can_send(channel)){
258         rfcomm_emit_can_send_now(channel);
259     }
260 }
261 
262 // data: event(8), len(8), rfcomm_cid(16)
263 static void rfcomm_emit_channel_closed(rfcomm_channel_t * channel) {
264     log_info("RFCOMM_EVENT_CHANNEL_CLOSED cid 0x%02x", channel->rfcomm_cid);
265     uint8_t event[4];
266     event[0] = RFCOMM_EVENT_CHANNEL_CLOSED;
267     event[1] = sizeof(event) - 2;
268     little_endian_store_16(event, 2, channel->rfcomm_cid);
269     hci_dump_packet(HCI_EVENT_PACKET, 0, event, sizeof(event));
270 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
271 }
272 
273 static void rfcomm_emit_remote_line_status(rfcomm_channel_t *channel, uint8_t line_status){
274     log_info("RFCOMM_EVENT_REMOTE_LINE_STATUS cid 0x%02x c, line status 0x%x", channel->rfcomm_cid, line_status);
275     uint8_t event[5];
276     event[0] = RFCOMM_EVENT_REMOTE_LINE_STATUS;
277     event[1] = sizeof(event) - 2;
278     little_endian_store_16(event, 2, channel->rfcomm_cid);
279     event[4] = line_status;
280     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
281     (channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
282 }
283 
284 static void rfcomm_emit_port_configuration(rfcomm_channel_t *channel){
285     // notify client about new settings
286     uint8_t event[2+sizeof(rfcomm_rpn_data_t)];
287     event[0] = RFCOMM_EVENT_PORT_CONFIGURATION;
288     event[1] = sizeof(rfcomm_rpn_data_t);
289     memcpy(&event[2], (uint8_t*) &channel->rpn_data, sizeof(rfcomm_rpn_data_t));
290     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
291     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
292 }
293 
294 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel) {
295     log_debug("RFCOMM_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel->rfcomm_cid);
296     uint8_t event[4];
297     event[0] = RFCOMM_EVENT_CAN_SEND_NOW;
298     event[1] = sizeof(event) - 2;
299     little_endian_store_16(event, 2, channel->rfcomm_cid);
300     hci_dump_packet( HCI_EVENT_PACKET, 0, event, sizeof(event));
301     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
302 }
303 
304 // MARK RFCOMM RPN DATA HELPER
305 static void rfcomm_rpn_data_set_defaults(rfcomm_rpn_data_t * rpn_data){
306         rpn_data->baud_rate = RPN_BAUD_9600;  /* 9600 bps */
307         rpn_data->flags = 0x03;               /* 8-n-1 */
308         rpn_data->flow_control = 0;           /* no flow control */
309         rpn_data->xon  = 0xd1;                /* XON */
310         rpn_data->xoff = 0xd3;                /* XOFF */
311         rpn_data->parameter_mask_0 = 0x7f;    /* parameter mask, all values set */
312         rpn_data->parameter_mask_1 = 0x3f;    /* parameter mask, all values set */
313 }
314 
315 static void rfcomm_rpn_data_update(rfcomm_rpn_data_t * dest, rfcomm_rpn_data_t * src){
316     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_BAUD){
317         dest->baud_rate = src->baud_rate;
318     }
319     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_DATA_BITS){
320         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x03);
321     }
322     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_STOP_BITS){
323         dest->flags = (dest->flags & 0xfb) | (src->flags & 0x04);
324     }
325     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY){
326         dest->flags = (dest->flags & 0xf7) | (src->flags & 0x08);
327     }
328     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY_TYPE){
329         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x30);
330     }
331     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XON_CHAR){
332         dest->xon = src->xon;
333     }
334     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XOFF_CHAR){
335         dest->xoff = src->xoff;
336     }
337     int i;
338     for (i=0; i < 6 ; i++){
339         uint8_t mask = 1 << i;
340         if (src->parameter_mask_1 & mask){
341             dest->flags = (dest->flags & ~mask) | (src->flags & mask);
342         }
343     }
344     // always copy parameter mask, too. informative for client, needed for response
345     dest->parameter_mask_0 = src->parameter_mask_0;
346     dest->parameter_mask_1 = src->parameter_mask_1;
347 }
348 // MARK: RFCOMM MULTIPLEXER HELPER
349 
350 static uint16_t rfcomm_max_frame_size_for_l2cap_mtu(uint16_t l2cap_mtu){
351     // Assume RFCOMM header without credits and 2 byte (14 bit) length field
352     uint16_t max_frame_size = l2cap_mtu - 5;
353     log_info("rfcomm_max_frame_size_for_l2cap_mtu:  %u -> %u", l2cap_mtu, max_frame_size);
354     return max_frame_size;
355 }
356 
357 static void rfcomm_multiplexer_initialize(rfcomm_multiplexer_t *multiplexer){
358     multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
359     multiplexer->fcon = 1;
360     multiplexer->send_dm_for_dlci = 0;
361     multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(l2cap_max_mtu());
362     multiplexer->test_data_len = 0;
363     multiplexer->nsc_command = 0;
364 }
365 
366 static rfcomm_multiplexer_t * rfcomm_multiplexer_create_for_addr(bd_addr_t addr){
367 
368     // alloc structure
369     rfcomm_multiplexer_t * multiplexer = btstack_memory_rfcomm_multiplexer_get();
370     if (!multiplexer) return NULL;
371 
372     // fill in
373     rfcomm_multiplexer_initialize(multiplexer);
374     bd_addr_copy(multiplexer->remote_addr, addr);
375 
376     // add to services list
377     btstack_linked_list_add(&rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
378 
379     return multiplexer;
380 }
381 
382 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_addr(bd_addr_t addr){
383     btstack_linked_item_t *it;
384     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
385         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
386         // ignore multiplexer in shutdown
387         if (multiplexer->state == RFCOMM_MULTIPLEXER_SHUTTING_DOWN) continue;
388         if (bd_addr_cmp(addr, multiplexer->remote_addr) == 0) {
389             return multiplexer;
390         };
391     }
392     return NULL;
393 }
394 
395 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_l2cap_cid(uint16_t l2cap_cid) {
396     btstack_linked_item_t *it;
397     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
398         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
399         if (multiplexer->l2cap_cid == l2cap_cid) {
400             return multiplexer;
401         };
402     }
403     return NULL;
404 }
405 
406 static int rfcomm_multiplexer_has_channels(rfcomm_multiplexer_t * multiplexer){
407     btstack_linked_item_t *it;
408     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
409         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
410         if (channel->multiplexer == multiplexer) {
411             return 1;
412         }
413     }
414     return 0;
415 }
416 
417 // MARK: RFCOMM CHANNEL HELPER
418 
419 static void rfcomm_dump_channels(void){
420     btstack_linked_item_t * it;
421     int channels = 0;
422     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
423         rfcomm_channel_t * channel = (rfcomm_channel_t *) it;
424         log_info("Channel #%u: addr %p, state %u", channels, channel, channel->state);
425         channels++;
426     }
427 }
428 
429 static void rfcomm_channel_initialize(rfcomm_channel_t *channel, rfcomm_multiplexer_t *multiplexer,
430                                rfcomm_service_t *service, uint8_t server_channel){
431 
432     // set defaults for port configuration (even for services)
433     rfcomm_rpn_data_set_defaults(&channel->rpn_data);
434 
435     channel->state            = RFCOMM_CHANNEL_CLOSED;
436     channel->state_var        = RFCOMM_CHANNEL_STATE_VAR_NONE;
437 
438     channel->multiplexer      = multiplexer;
439     channel->rfcomm_cid       = rfcomm_next_client_cid();
440     channel->max_frame_size   = multiplexer->max_frame_size;
441 
442     channel->credits_incoming = 0;
443     channel->credits_outgoing = 0;
444 
445     // incoming flow control not active
446     channel->new_credits_incoming  = RFCOMM_CREDITS;
447     channel->incoming_flow_control = 0;
448 
449     channel->rls_line_status       = RFCOMM_RLS_STATUS_INVALID;
450 
451     channel->service = service;
452 	if (service) {
453 		// incoming connection
454     	channel->dlci = (server_channel << 1) |  multiplexer->outgoing;
455         if (channel->max_frame_size > service->max_frame_size) {
456             channel->max_frame_size = service->max_frame_size;
457         }
458         channel->incoming_flow_control = service->incoming_flow_control;
459         channel->new_credits_incoming  = service->incoming_initial_credits;
460         channel->packet_handler        = service->packet_handler;
461 	} else {
462 		// outgoing connection
463 		channel->dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
464 	}
465 }
466 
467 // service == NULL -> outgoing channel
468 static rfcomm_channel_t * rfcomm_channel_create(rfcomm_multiplexer_t * multiplexer,
469                                                 rfcomm_service_t * service, uint8_t server_channel){
470 
471     log_info("rfcomm_channel_create for service %p, channel %u --- list of channels:", service, server_channel);
472     rfcomm_dump_channels();
473 
474     // alloc structure
475     rfcomm_channel_t * channel = btstack_memory_rfcomm_channel_get();
476     if (!channel) return NULL;
477 
478     // fill in
479     rfcomm_channel_initialize(channel, multiplexer, service, server_channel);
480 
481     // add to services list
482     btstack_linked_list_add(&rfcomm_channels, (btstack_linked_item_t *) channel);
483 
484     return channel;
485 }
486 
487 static void rfcomm_notify_channel_can_send(void){
488     btstack_linked_list_iterator_t it;
489     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
490     while (btstack_linked_list_iterator_has_next(&it)){
491         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
492         if (!channel->waiting_for_can_send_now) continue; // didn't try to send yet
493         if (!rfcomm_channel_can_send(channel)) continue;  // or cannot yet either
494 
495         channel->waiting_for_can_send_now = 0;
496         rfcomm_emit_can_send_now(channel);
497     }
498 }
499 
500 static rfcomm_channel_t * rfcomm_channel_for_multiplexer_and_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci){
501     btstack_linked_item_t *it;
502     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
503         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
504         if (channel->dlci == dlci && channel->multiplexer == multiplexer) {
505             return channel;
506         };
507     }
508     return NULL;
509 }
510 
511 static rfcomm_service_t * rfcomm_service_for_channel(uint8_t server_channel){
512     btstack_linked_item_t *it;
513     for (it = (btstack_linked_item_t *) rfcomm_services; it ; it = it->next){
514         rfcomm_service_t * service = ((rfcomm_service_t *) it);
515         if ( service->server_channel == server_channel){
516             return service;
517         };
518     }
519     return NULL;
520 }
521 
522 // MARK: RFCOMM SEND
523 
524 /**
525  * @param credits - only used for RFCOMM flow control in UIH wiht P/F = 1
526  */
527 static int rfcomm_send_packet_for_multiplexer(rfcomm_multiplexer_t *multiplexer, uint8_t address, uint8_t control, uint8_t credits, uint8_t *data, uint16_t len){
528 
529     if (!l2cap_can_send_packet_now(multiplexer->l2cap_cid)) return BTSTACK_ACL_BUFFERS_FULL;
530 
531 #ifdef RFCOMM_USE_OUTGOING_BUFFER
532     uint8_t * rfcomm_out_buffer = outgoing_buffer;
533 #else
534     l2cap_reserve_packet_buffer();
535     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
536 #endif
537 
538 	uint16_t pos = 0;
539 	uint8_t crc_fields = 3;
540 
541 	rfcomm_out_buffer[pos++] = address;
542 	rfcomm_out_buffer[pos++] = control;
543 
544 	// length field can be 1 or 2 octets
545 	if (len < 128){
546 		rfcomm_out_buffer[pos++] = (len << 1)| 1;     // bits 0-6
547 	} else {
548 		rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
549 		rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
550 		crc_fields++;
551 	}
552 
553 	// add credits for UIH frames when PF bit is set
554 	if (control == BT_RFCOMM_UIH_PF){
555 		rfcomm_out_buffer[pos++] = credits;
556 	}
557 
558 	// copy actual data
559 	if (len) {
560 		memcpy(&rfcomm_out_buffer[pos], data, len);
561 		pos += len;
562 	}
563 
564 	// UIH frames only calc FCS over address + control (5.1.1)
565 	if ((control & 0xef) == BT_RFCOMM_UIH){
566 		crc_fields = 2;
567 	}
568 	rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, crc_fields); // calc fcs
569 
570 #ifdef RFCOMM_USE_OUTGOING_BUFFER
571     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
572 #else
573     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
574 #endif
575 
576     return err;
577 }
578 
579 // simplified version of rfcomm_send_packet_for_multiplexer for prepared rfcomm packet (UIH, 2 byte len, no credits)
580 static int rfcomm_send_uih_prepared(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t len){
581 
582     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);
583     uint8_t control = BT_RFCOMM_UIH;
584 
585 #ifdef RFCOMM_USE_OUTGOING_BUFFER
586     uint8_t * rfcomm_out_buffer = outgoing_buffer;
587 #else
588     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
589 #endif
590 
591     uint16_t pos = 0;
592     rfcomm_out_buffer[pos++] = address;
593     rfcomm_out_buffer[pos++] = control;
594     rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
595     rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
596 
597     // actual data is already in place
598     pos += len;
599 
600     // UIH frames only calc FCS over address + control (5.1.1)
601     rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, 2); // calc fcs
602 
603 #ifdef RFCOMM_USE_OUTGOING_BUFFER
604     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
605 #else
606     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
607 #endif
608 
609     return err;
610 }
611 
612 // C/R Flag in Address
613 // - terms: initiator = station that creates multiplexer with SABM
614 // - terms: responder = station that responds to multiplexer setup with UA
615 // "For SABM, UA, DM and DISC frames C/R bit is set according to Table 1 in GSM 07.10, section 5.2.1.2"
616 //    - command initiator = 1 /response responder = 1
617 //    - command responder = 0 /response initiator = 0
618 // "For UIH frames, the C/R bit is always set according to section 5.4.3.1 in GSM 07.10.
619 //  This applies independently of what is contained wthin the UIH frames, either data or control messages."
620 //    - c/r = 1 for frames by initiating station, 0 = for frames by responding station
621 
622 // C/R Flag in Message
623 // "In the message level, the C/R bit in the command type field is set as stated in section 5.4.6.2 in GSM 07.10."
624 //   - If the C/R bit is set to 1 the message is a command
625 //   - if it is set to 0 the message is a response.
626 
627 // temp/old messge construction
628 
629 // new object oriented version
630 static int rfcomm_send_sabm(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
631 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);   // command
632     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_SABM, 0, NULL, 0);
633 }
634 
635 static int rfcomm_send_disc(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
636 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);  // command
637     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DISC, 0, NULL, 0);
638 }
639 
640 static int rfcomm_send_ua(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
641 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
642     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UA, 0, NULL, 0);
643 }
644 
645 static int rfcomm_send_dm_pf(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
646 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
647     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DM_PF, 0, NULL, 0);
648 }
649 
650 static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fcon) {
651     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
652     uint8_t payload[2];
653     uint8_t pos = 0;
654     payload[pos++] = fcon ? BT_RFCOMM_FCON_RSP : BT_RFCOMM_FCOFF_RSP;
655     payload[pos++] = (0 << 1) | 1;  // len
656     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
657 }
658 
659 // static int rfcomm_send_uih_test_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
660 //     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
661 //     uint8_t payload[2+len];
662 //     uint8_t pos = 0;
663 //     payload[pos++] = BT_RFCOMM_TEST_CMD;
664 //     payload[pos++] = (len + 1) << 1 | 1;  // len
665 //     memcpy(&payload[pos], data, len);
666 //     pos += len;
667 //     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
668 // }
669 
670 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
671     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
672     uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN];
673     uint8_t pos = 0;
674     payload[pos++] = BT_RFCOMM_TEST_RSP;
675     if (len > RFCOMM_TEST_DATA_MAX_LEN) {
676         len = RFCOMM_TEST_DATA_MAX_LEN;
677     }
678     payload[pos++] = (len << 1) | 1;  // len
679     memcpy(&payload[pos], data, len);
680     pos += len;
681     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
682 }
683 
684 static int rfcomm_send_uih_msc_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
685 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
686 	uint8_t payload[4];
687 	uint8_t pos = 0;
688 	payload[pos++] = BT_RFCOMM_MSC_CMD;
689 	payload[pos++] = (2 << 1) | 1;  // len
690 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
691 	payload[pos++] = signals;
692 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
693 }
694 
695 static int rfcomm_send_uih_msc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
696 	uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
697 	uint8_t payload[4];
698 	uint8_t pos = 0;
699 	payload[pos++] = BT_RFCOMM_MSC_RSP;
700 	payload[pos++] = (2 << 1) | 1;  // len
701 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
702 	payload[pos++] = signals;
703 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
704 }
705 
706 static int rfcomm_send_uih_nsc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t command) {
707     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
708     uint8_t payload[3];
709     uint8_t pos = 0;
710     payload[pos++] = BT_RFCOMM_NSC_RSP;
711     payload[pos++] = (1 << 1) | 1;  // len
712     payload[pos++] = command;
713     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
714 }
715 
716 static int rfcomm_send_uih_pn_command(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t max_frame_size){
717 	uint8_t payload[10];
718 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
719 	uint8_t pos = 0;
720 	payload[pos++] = BT_RFCOMM_PN_CMD;
721 	payload[pos++] = (8 << 1) | 1;  // len
722 	payload[pos++] = dlci;
723 	payload[pos++] = 0xf0; // pre-defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
724 	payload[pos++] = 0; // priority
725 	payload[pos++] = 0; // max 60 seconds ack
726 	payload[pos++] = max_frame_size & 0xff; // max framesize low
727 	payload[pos++] = max_frame_size >> 8;   // max framesize high
728 	payload[pos++] = 0x00; // number of retransmissions
729 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
730 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
731 }
732 
733 // "The response may not change the DLCI, the priority, the convergence layer, or the timer value." rfcomm_tutorial.pdf
734 static int rfcomm_send_uih_pn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,
735                                        uint8_t priority, uint16_t max_frame_size){
736 	uint8_t payload[10];
737 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
738 	uint8_t pos = 0;
739 	payload[pos++] = BT_RFCOMM_PN_RSP;
740 	payload[pos++] = (8 << 1) | 1;  // len
741 	payload[pos++] = dlci;
742 	payload[pos++] = 0xe0; // pre defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
743 	payload[pos++] = priority; // priority
744 	payload[pos++] = 0; // max 60 seconds ack
745 	payload[pos++] = max_frame_size & 0xff; // max framesize low
746 	payload[pos++] = max_frame_size >> 8;   // max framesize high
747 	payload[pos++] = 0x00; // number of retransmissions
748 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
749 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
750 }
751 
752 static int rfcomm_send_uih_rls_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
753     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
754     uint8_t payload[4];
755     uint8_t pos = 0;
756     payload[pos++] = BT_RFCOMM_RLS_CMD;
757     payload[pos++] = (2 << 1) | 1;  // len
758     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
759     payload[pos++] = line_status;
760     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
761 }
762 
763 static int rfcomm_send_uih_rls_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
764     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
765     uint8_t payload[4];
766     uint8_t pos = 0;
767     payload[pos++] = BT_RFCOMM_RLS_RSP;
768     payload[pos++] = (2 << 1) | 1;  // len
769     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
770     payload[pos++] = line_status;
771     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
772 }
773 
774 static int rfcomm_send_uih_rpn_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
775     uint8_t payload[10];
776     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
777     uint8_t pos = 0;
778     payload[pos++] = BT_RFCOMM_RPN_CMD;
779     payload[pos++] = (8 << 1) | 1;  // len
780     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
781     payload[pos++] = rpn_data->baud_rate;
782     payload[pos++] = rpn_data->flags;
783     payload[pos++] = rpn_data->flow_control;
784     payload[pos++] = rpn_data->xon;
785     payload[pos++] = rpn_data->xoff;
786     payload[pos++] = rpn_data->parameter_mask_0;
787     payload[pos++] = rpn_data->parameter_mask_1;
788     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
789 }
790 
791 static int rfcomm_send_uih_rpn_req(rfcomm_multiplexer_t *multiplexer, uint8_t dlci) {
792     uint8_t payload[3];
793     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
794     uint8_t pos = 0;
795     payload[pos++] = BT_RFCOMM_RPN_CMD;
796     payload[pos++] = (1 << 1) | 1;  // len
797     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
798     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
799 }
800 
801 static int rfcomm_send_uih_rpn_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
802 	uint8_t payload[10];
803 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
804 	uint8_t pos = 0;
805 	payload[pos++] = BT_RFCOMM_RPN_RSP;
806 	payload[pos++] = (8 << 1) | 1;  // len
807 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
808 	payload[pos++] = rpn_data->baud_rate;
809 	payload[pos++] = rpn_data->flags;
810 	payload[pos++] = rpn_data->flow_control;
811 	payload[pos++] = rpn_data->xon;
812 	payload[pos++] = rpn_data->xoff;
813 	payload[pos++] = rpn_data->parameter_mask_0;
814 	payload[pos++] = rpn_data->parameter_mask_1;
815 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
816 }
817 
818 static void rfcomm_send_uih_credits(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,  uint8_t credits){
819     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) |  (dlci << 2);
820     rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH_PF, credits, NULL, 0);
821 }
822 
823 // depending on channel state emit channel opened with status or channel closed
824 static void rfcomm_channel_emit_final_event(rfcomm_channel_t * channel, uint8_t status){
825     // emit appropriate events
826     switch(channel->state){
827         case RFCOMM_CHANNEL_OPEN:
828         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
829             rfcomm_emit_channel_closed(channel);
830             break;
831         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
832             // remote didn't wait until we send the UA disc
833             // close event already emitted
834             break;
835         default:
836             rfcomm_emit_channel_opened(channel, status);
837             break;
838     }
839 }
840 
841 // MARK: RFCOMM MULTIPLEXER
842 static void rfcomm_multiplexer_stop_timer(rfcomm_multiplexer_t * multiplexer){
843     if (multiplexer->timer_active) {
844         btstack_run_loop_remove_timer(&multiplexer->timer);
845         multiplexer->timer_active = 0;
846     }
847 }
848 static void rfcomm_multiplexer_free(rfcomm_multiplexer_t * multiplexer){
849     btstack_linked_list_remove( &rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
850     btstack_memory_rfcomm_multiplexer_free(multiplexer);
851 }
852 
853 static void rfcomm_multiplexer_finalize(rfcomm_multiplexer_t * multiplexer){
854     // remove (potential) timer
855     rfcomm_multiplexer_stop_timer(multiplexer);
856 
857     // close and remove all channels
858     btstack_linked_item_t *it = (btstack_linked_item_t *) &rfcomm_channels;
859     while (it->next){
860         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
861         if (channel->multiplexer == multiplexer) {
862             // emit open with status or closed
863             rfcomm_channel_emit_final_event(channel, RFCOMM_MULTIPLEXER_STOPPED);
864             // remove from list
865             it->next = it->next->next;
866             // free channel struct
867             btstack_memory_rfcomm_channel_free(channel);
868         } else {
869             it = it->next;
870         }
871     }
872 
873     // remove mutliplexer
874     rfcomm_multiplexer_free(multiplexer);
875 }
876 
877 static void rfcomm_multiplexer_timer_handler(btstack_timer_source_t *timer){
878     rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t*) btstack_run_loop_get_timer_context(timer);
879     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
880 
881     log_info("rfcomm_multiplexer_timer_handler timeout: shutting down multiplexer! (no channels)");
882     uint16_t l2cap_cid = multiplexer->l2cap_cid;
883     rfcomm_multiplexer_finalize(multiplexer);
884     l2cap_disconnect(l2cap_cid, 0x13);
885 }
886 
887 static void rfcomm_multiplexer_prepare_idle_timer(rfcomm_multiplexer_t * multiplexer){
888     if (multiplexer->timer_active) {
889         btstack_run_loop_remove_timer(&multiplexer->timer);
890         multiplexer->timer_active = 0;
891     }
892     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
893 
894     // start idle timer for multiplexer timeout check as there are no rfcomm channels yet
895     btstack_run_loop_set_timer(&multiplexer->timer, RFCOMM_MULIPLEXER_TIMEOUT_MS);
896     btstack_run_loop_set_timer_handler(&multiplexer->timer, rfcomm_multiplexer_timer_handler);
897     btstack_run_loop_set_timer_context(&multiplexer->timer, multiplexer);
898     btstack_run_loop_add_timer(&multiplexer->timer);
899     multiplexer->timer_active = 1;
900 }
901 
902 static void rfcomm_multiplexer_opened(rfcomm_multiplexer_t *multiplexer){
903     log_info("Multiplexer up and running");
904     multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
905 
906     const rfcomm_channel_event_t event = { CH_EVT_MULTIPLEXER_READY, 0};
907 
908     // transition of channels that wait for multiplexer
909     btstack_linked_item_t *it;
910     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
911         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
912         if (channel->multiplexer != multiplexer) continue;
913         int rfcomm_channel_valid = 1;
914         rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
915         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
916             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
917         }
918     }
919     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
920 
921     // request can send now for multiplexer if ready
922     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
923         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
924     }
925 }
926 
927 static void rfcomm_handle_can_send_now(uint16_t l2cap_cid){
928 
929     log_debug("rfcomm_handle_can_send_now enter: %u", l2cap_cid);
930 
931     btstack_linked_list_iterator_t it;
932     int token_consumed = 0;
933 
934     // forward token to multiplexer
935     btstack_linked_list_iterator_init(&it, &rfcomm_multiplexers);
936     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
937         rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t *) btstack_linked_list_iterator_next(&it);
938         if (multiplexer->l2cap_cid != l2cap_cid) continue;
939         if (rfcomm_multiplexer_ready_to_send(multiplexer)){
940             log_debug("rfcomm_handle_can_send_now enter: multiplexer token");
941             token_consumed = 1;
942             rfcomm_multiplexer_state_machine(multiplexer, MULT_EV_READY_TO_SEND);
943         }
944     }
945 
946     // forward token to channel state machine
947     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
948     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
949         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
950         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
951         // channel state machine
952         if (rfcomm_channel_ready_to_send(channel)){
953             log_debug("rfcomm_handle_can_send_now enter: channel token");
954             token_consumed = 1;
955             const rfcomm_channel_event_t event = { CH_EVT_READY_TO_SEND, 0 };
956             int rfcomm_channel_valid = 1;
957             rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
958         }
959     }
960 
961     // forward token to client
962     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
963     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
964         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
965         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
966         // client waiting for can send now
967         if (!channel->waiting_for_can_send_now)    continue;
968         if ((channel->multiplexer->fcon & 1) == 0) continue;
969         if (!channel->credits_outgoing){
970             log_debug("rfcomm_handle_can_send_now waiting to send but no credits (ignore)");
971             continue;
972         }
973 
974         log_debug("rfcomm_handle_can_send_now enter: client token");
975         token_consumed = 1;
976         channel->waiting_for_can_send_now = 0;
977         rfcomm_emit_can_send_now(channel);
978     }
979 
980     // if token was consumed, request another one
981     if (token_consumed) {
982         l2cap_request_can_send_now_event(l2cap_cid);
983     }
984 
985     log_debug("rfcomm_handle_can_send_now exit");
986 }
987 
988 static void rfcomm_multiplexer_set_state_and_request_can_send_now_event(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_STATE state){
989     multiplexer->state = state;
990     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
991 }
992 
993 /**
994  * @return handled packet
995  */
996 static int rfcomm_hci_event_handler(uint8_t *packet, uint16_t size){
997 
998     UNUSED(size);   // ok: handling own l2cap events
999 
1000     bd_addr_t event_addr;
1001     uint16_t  psm;
1002     uint16_t l2cap_cid;
1003     hci_con_handle_t con_handle;
1004     rfcomm_multiplexer_t *multiplexer = NULL;
1005     uint8_t status;
1006 
1007     switch (hci_event_packet_get_type(packet)) {
1008 
1009         // accept incoming rfcomm connection if no multiplexer exists yet
1010         case L2CAP_EVENT_INCOMING_CONNECTION:
1011             // data: event(8), len(8), address(48), handle (16),  psm (16), source cid(16) dest cid(16)
1012             reverse_bd_addr(&packet[2], event_addr);
1013             con_handle = little_endian_read_16(packet,  8);
1014             psm        = little_endian_read_16(packet, 10);
1015             l2cap_cid  = little_endian_read_16(packet, 12);
1016 
1017             if (psm != BLUETOOTH_PROTOCOL_RFCOMM) break;
1018 
1019             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1020 
1021             if (multiplexer) {
1022                 log_info("INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => decline - multiplexer already exists", l2cap_cid);
1023                 l2cap_decline_connection(l2cap_cid);
1024                 return 1;
1025             }
1026 
1027             // create and inititialize new multiplexer instance (incoming)
1028             multiplexer = rfcomm_multiplexer_create_for_addr(event_addr);
1029             if (!multiplexer){
1030                 log_info("INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => decline - no memory left", l2cap_cid);
1031                 l2cap_decline_connection(l2cap_cid);
1032                 return 1;
1033             }
1034 
1035             multiplexer->con_handle = con_handle;
1036             multiplexer->l2cap_cid = l2cap_cid;
1037             //
1038             multiplexer->state = RFCOMM_MULTIPLEXER_W4_SABM_0;
1039             log_info("L2CAP_EVENT_INCOMING_CONNECTION (l2cap_cid 0x%02x) for BLUETOOTH_PROTOCOL_RFCOMM => accept", l2cap_cid);
1040 
1041 #ifdef RFCOMM_USE_ERTM
1042             // request
1043             rfcomm_ertm_request_t request;
1044             memset(&request, 0, sizeof(rfcomm_ertm_request_t));
1045             memcpy(request.addr, event_addr, 6);
1046             request.ertm_id = rfcomm_next_ertm_id();
1047             if (rfcomm_ertm_request_callback){
1048                 (*rfcomm_ertm_request_callback)(&request);
1049             }
1050             if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
1051                 multiplexer->ertm_id = request.ertm_id;
1052                 l2cap_accept_ertm_connection(l2cap_cid, request.ertm_config, request.ertm_buffer, request.ertm_buffer_size);
1053                 return 1;
1054             }
1055 #endif
1056 
1057             l2cap_accept_connection(l2cap_cid);
1058             return 1;
1059 
1060         // l2cap connection opened -> store l2cap_cid, remote_addr
1061         case L2CAP_EVENT_CHANNEL_OPENED:
1062 
1063             if (little_endian_read_16(packet, 11) != BLUETOOTH_PROTOCOL_RFCOMM) break;
1064 
1065             status = packet[2];
1066             log_info("L2CAP_EVENT_CHANNEL_OPENED for BLUETOOTH_PROTOCOL_RFCOMM, status %u", status);
1067 
1068             // get multiplexer for remote addr
1069             con_handle = little_endian_read_16(packet, 9);
1070             l2cap_cid = little_endian_read_16(packet, 13);
1071             reverse_bd_addr(&packet[3], event_addr);
1072             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1073             if (!multiplexer) {
1074                 log_error("L2CAP_EVENT_CHANNEL_OPENED but no multiplexer prepared");
1075                 return 1;
1076             }
1077 
1078             // on l2cap open error discard everything
1079             if (status){
1080 
1081                 // remove (potential) timer
1082                 rfcomm_multiplexer_stop_timer(multiplexer);
1083 
1084                 // mark multiplexer as shutting down
1085                 multiplexer->state = RFCOMM_MULTIPLEXER_SHUTTING_DOWN;
1086 
1087                 // emit rfcomm_channel_opened with status and free channel
1088                 // note: repeatedly go over list until full iteration causes no further change
1089                 int done;
1090                 do {
1091                     done = 1;
1092                     btstack_linked_item_t * it = (btstack_linked_item_t *) &rfcomm_channels;
1093                     while (it->next) {
1094                         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
1095                         if (channel->multiplexer == multiplexer){
1096                             done = 0;
1097                             rfcomm_emit_channel_opened(channel, status);
1098                             btstack_linked_list_remove(&rfcomm_channels, (btstack_linked_item_t *) channel);
1099                             btstack_memory_rfcomm_channel_free(channel);
1100                             break;
1101                         } else {
1102                             it = it->next;
1103                         }
1104                     }
1105                 } while (!done);
1106 
1107                 // free multiplexer
1108                 rfcomm_multiplexer_free(multiplexer);
1109                 return 1;
1110             }
1111 
1112             // following could be: rfcom_multiplexer_state_machein(..., EVENT_L2CAP_OPENED)
1113 
1114             // set max frame size based on l2cap MTU
1115             multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(little_endian_read_16(packet, 17));
1116 
1117             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_CONNECT) {
1118                 log_info("L2CAP_EVENT_CHANNEL_OPENED: outgoing connection");
1119                 // wrong remote addr
1120                 if (bd_addr_cmp(event_addr, multiplexer->remote_addr)) break;
1121                 multiplexer->l2cap_cid = l2cap_cid;
1122                 multiplexer->con_handle = con_handle;
1123                 // send SABM #0
1124                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_SABM_0);
1125 
1126             }
1127             return 1;
1128 
1129             // l2cap disconnect -> state = RFCOMM_MULTIPLEXER_CLOSED;
1130 
1131         // Notify channel packet handler if they can send now
1132         case L2CAP_EVENT_CAN_SEND_NOW:
1133             l2cap_cid = l2cap_event_can_send_now_get_local_cid(packet);
1134             rfcomm_handle_can_send_now(l2cap_cid);
1135             return 1;
1136 
1137         case L2CAP_EVENT_CHANNEL_CLOSED:
1138             // data: event (8), len(8), channel (16)
1139             l2cap_cid = little_endian_read_16(packet, 2);
1140             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1141             log_info("L2CAP_EVENT_CHANNEL_CLOSED cid 0x%0x, mult %p", l2cap_cid, multiplexer);
1142             if (!multiplexer) break;
1143             log_info("L2CAP_EVENT_CHANNEL_CLOSED state %u", multiplexer->state);
1144             // no need to call l2cap_disconnect here, as it's already closed
1145             rfcomm_multiplexer_finalize(multiplexer);
1146             return 1;
1147 
1148 #ifdef RFCOMM_USE_ERTM
1149         case L2CAP_EVENT_ERTM_BUFFER_RELEASED:
1150             l2cap_cid = l2cap_event_ertm_buffer_released_get_local_cid(packet);
1151             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1152             if (multiplexer) {
1153                 log_info("buffer for ertm id %u released", multiplexer->ertm_id);
1154                 if (rfcomm_ertm_released_callback){
1155                     (*rfcomm_ertm_released_callback)(multiplexer->ertm_id);
1156                 }
1157             }
1158             break;
1159 #endif
1160 
1161         default:
1162             break;
1163     }
1164     return 0;
1165 }
1166 
1167 static int rfcomm_multiplexer_l2cap_packet_handler(uint16_t channel, uint8_t *packet, uint16_t size){
1168     // get or create a multiplexer for a certain device
1169     rfcomm_multiplexer_t *multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1170     if (!multiplexer) return 0;
1171 
1172     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1173 
1174 	// but only care for multiplexer control channel
1175     uint8_t frame_dlci = packet[0] >> 2;
1176     if (frame_dlci) return 0;
1177     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1178     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1179     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1180     switch (packet[1]){
1181 
1182         case BT_RFCOMM_SABM:
1183             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0){
1184                 log_info("Received SABM #0");
1185                 multiplexer->outgoing = 0;
1186                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0);
1187                 return 1;
1188             }
1189             break;
1190 
1191         case BT_RFCOMM_UA:
1192             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_UA_0) {
1193                 // UA #0 -> send UA #0, state = RFCOMM_MULTIPLEXER_OPEN
1194                 log_info("Received UA #0 ");
1195                 rfcomm_multiplexer_opened(multiplexer);
1196                 return 1;
1197             }
1198             break;
1199 
1200         case BT_RFCOMM_DISC:
1201             // DISC #0 -> send UA #0, close multiplexer
1202             log_info("Received DISC #0, (ougoing = %u)", multiplexer->outgoing);
1203             rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC);
1204             return 1;
1205 
1206         case BT_RFCOMM_DM:
1207             // DM #0 - we shouldn't get this, just give up
1208             log_info("Received DM #0");
1209             log_info("-> Closing down multiplexer");
1210             rfcomm_multiplexer_finalize(multiplexer);
1211             l2cap_disconnect(l2cap_cid, 0x13);
1212             return 1;
1213 
1214         case BT_RFCOMM_UIH:
1215             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){
1216                 // Multiplexer close down (CLD) -> close mutliplexer
1217                 log_info("Received Multiplexer close down command");
1218                 log_info("-> Closing down multiplexer");
1219                 rfcomm_multiplexer_finalize(multiplexer);
1220                 l2cap_disconnect(l2cap_cid, 0x13);
1221                 return 1;
1222             }
1223             switch (packet[payload_offset]){
1224                 case BT_RFCOMM_CLD_CMD:
1225                      // Multiplexer close down (CLD) -> close mutliplexer
1226                     log_info("Received Multiplexer close down command");
1227                     log_info("-> Closing down multiplexer");
1228                     rfcomm_multiplexer_finalize(multiplexer);
1229                     l2cap_disconnect(l2cap_cid, 0x13);
1230                     return 1;
1231 
1232                 case BT_RFCOMM_FCON_CMD:
1233                     multiplexer->fcon = 0x81;
1234                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1235                     return 1;
1236 
1237                 case BT_RFCOMM_FCOFF_CMD:
1238                     multiplexer->fcon = 0x80;
1239                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1240                     return 1;
1241 
1242                 case BT_RFCOMM_TEST_CMD: {
1243                     log_info("Received test command");
1244                     int len = packet[payload_offset+1] >> 1; // length < 125
1245                     if (len > RFCOMM_TEST_DATA_MAX_LEN){
1246                         len = RFCOMM_TEST_DATA_MAX_LEN;
1247                     }
1248                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak
1249                     multiplexer->test_data_len = len;
1250                     memcpy(multiplexer->test_data, &packet[payload_offset + 2], len);
1251                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1252                     return 1;
1253                 }
1254                 default:
1255                     break;
1256             }
1257             break;
1258 
1259         default:
1260             break;
1261 
1262     }
1263     return 0;
1264 }
1265 
1266 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer){
1267     if (multiplexer->send_dm_for_dlci) return 1;
1268     if (multiplexer->nsc_command) return 1;
1269     if (multiplexer->fcon & 0x80) return 1;
1270     switch (multiplexer->state){
1271         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1272         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1273         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1274             return 1;
1275         case RFCOMM_MULTIPLEXER_OPEN:
1276             if (multiplexer->test_data_len) {
1277                 return 1;
1278             }
1279             break;
1280         default:
1281             break;
1282     }
1283     return 0;
1284 }
1285 
1286 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event){
1287 
1288     if (event != MULT_EV_READY_TO_SEND) return;
1289 
1290     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1291 
1292     // process stored DM responses
1293     if (multiplexer->send_dm_for_dlci){
1294         uint8_t dlci = multiplexer->send_dm_for_dlci;
1295         multiplexer->send_dm_for_dlci = 0;
1296         rfcomm_send_dm_pf(multiplexer, dlci);
1297         return;
1298     }
1299 
1300     if (multiplexer->nsc_command){
1301         uint8_t command = multiplexer->nsc_command;
1302         multiplexer->nsc_command = 0;
1303         rfcomm_send_uih_nsc_rsp(multiplexer, command);
1304         return;
1305     }
1306 
1307     if (multiplexer->fcon & 0x80){
1308         multiplexer->fcon &= 0x01;
1309         rfcomm_send_uih_fc_rsp(multiplexer, multiplexer->fcon);
1310 
1311         if (multiplexer->fcon == 0) return;
1312         // trigger client to send again after sending FCon Response
1313         rfcomm_notify_channel_can_send();
1314         return;
1315     }
1316 
1317     switch (multiplexer->state) {
1318         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1319             log_info("Sending SABM #0 - (multi 0x%p)", multiplexer);
1320             multiplexer->state = RFCOMM_MULTIPLEXER_W4_UA_0;
1321             rfcomm_send_sabm(multiplexer, 0);
1322             break;
1323         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1324             log_info("Sending UA #0");
1325             multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
1326             rfcomm_send_ua(multiplexer, 0);
1327 
1328             rfcomm_multiplexer_opened(multiplexer);
1329             break;
1330         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1331             log_info("Sending UA #0");
1332             log_info("Closing down multiplexer");
1333             multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
1334             rfcomm_send_ua(multiplexer, 0);
1335 
1336             rfcomm_multiplexer_finalize(multiplexer);
1337             l2cap_disconnect(l2cap_cid, 0x13);
1338             break;
1339         case RFCOMM_MULTIPLEXER_OPEN:
1340             // respond to test command
1341             if (multiplexer->test_data_len){
1342                 int len = multiplexer->test_data_len;
1343                 log_info("Sending TEST Response with %u bytes", len);
1344                 multiplexer->test_data_len = 0;
1345                 rfcomm_send_uih_test_rsp(multiplexer, multiplexer->test_data, len);
1346                 return;
1347             }
1348             break;
1349         default:
1350             break;
1351     }
1352 }
1353 
1354 // MARK: RFCOMM CHANNEL
1355 
1356 static void rfcomm_channel_send_credits(rfcomm_channel_t *channel, uint8_t credits){
1357     channel->credits_incoming += credits;
1358     rfcomm_send_uih_credits(channel->multiplexer, channel->dlci, credits);
1359 }
1360 
1361 static int rfcomm_channel_can_send(rfcomm_channel_t * channel){
1362     if (!channel->credits_outgoing) return 0;
1363     if ((channel->multiplexer->fcon & 1) == 0) return 0;
1364     return l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid);
1365 }
1366 
1367 static void rfcomm_channel_opened(rfcomm_channel_t *rfChannel){
1368 
1369     log_info("rfcomm_channel_opened!");
1370 
1371     rfChannel->state = RFCOMM_CHANNEL_OPEN;
1372     rfcomm_emit_channel_opened(rfChannel, 0);
1373     rfcomm_emit_port_configuration(rfChannel);
1374 
1375     // remove (potential) timer
1376     rfcomm_multiplexer_t *multiplexer = rfChannel->multiplexer;
1377     if (multiplexer->timer_active) {
1378         btstack_run_loop_remove_timer(&multiplexer->timer);
1379         multiplexer->timer_active = 0;
1380     }
1381     // hack for problem detecting authentication failure
1382     multiplexer->at_least_one_connection = 1;
1383 
1384     // request can send now if channel ready
1385     if (rfcomm_channel_ready_to_send(rfChannel)){
1386         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1387     }
1388 }
1389 
1390 static void rfcomm_channel_packet_handler_uih(rfcomm_multiplexer_t *multiplexer, uint8_t * packet, uint16_t size){
1391     const uint8_t frame_dlci = packet[0] >> 2;
1392     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1393     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1394     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1395     int request_can_send_now = 0;
1396 
1397     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, frame_dlci);
1398     if (!channel) return;
1399 
1400     // handle new outgoing credits
1401     if (packet[1] == BT_RFCOMM_UIH_PF) {
1402 
1403         // add them
1404         uint16_t new_credits = packet[3+length_offset];
1405         channel->credits_outgoing += new_credits;
1406         log_info( "RFCOMM data UIH_PF, new credits channel 0x%02x: %u, now %u", channel->rfcomm_cid, new_credits, channel->credits_outgoing);
1407 
1408         // notify channel statemachine
1409         rfcomm_channel_event_t channel_event = { CH_EVT_RCVD_CREDITS, 0 };
1410         log_debug("rfcomm_channel_state_machine_with_channel, waiting_for_can_send_now %u", channel->waiting_for_can_send_now);
1411         int rfcomm_channel_valid = 1;
1412         rfcomm_channel_state_machine_with_channel(channel, &channel_event, &rfcomm_channel_valid);
1413         if (rfcomm_channel_valid){
1414             if (rfcomm_channel_ready_to_send(channel) || channel->waiting_for_can_send_now){
1415                 request_can_send_now = 1;
1416             }
1417         }
1418     }
1419 
1420     // contains payload?
1421     if (size - 1 > payload_offset){
1422 
1423         // log_info( "RFCOMM data UIH_PF, size %u, channel %p", size-payload_offset-1, rfChannel->connection);
1424 
1425         // decrease incoming credit counter
1426         if (channel->credits_incoming > 0){
1427             channel->credits_incoming--;
1428         }
1429 
1430         // deliver payload
1431         (channel->packet_handler)(RFCOMM_DATA_PACKET, channel->rfcomm_cid,
1432                               &packet[payload_offset], size-payload_offset-1);
1433     }
1434 
1435     // automatically provide new credits to remote device, if no incoming flow control
1436     if (!channel->incoming_flow_control && channel->credits_incoming < 5){
1437         channel->new_credits_incoming = RFCOMM_CREDITS;
1438         request_can_send_now = 1;
1439     }
1440 
1441     if (request_can_send_now){
1442         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1443     }
1444 }
1445 
1446 static void rfcomm_channel_accept_pn(rfcomm_channel_t *channel, rfcomm_channel_event_pn_t *event){
1447     // priority of client request
1448     channel->pn_priority = event->priority;
1449 
1450     // new credits
1451     channel->credits_outgoing = event->credits_outgoing;
1452 
1453     // negotiate max frame size
1454     if (channel->max_frame_size > channel->multiplexer->max_frame_size) {
1455         channel->max_frame_size = channel->multiplexer->max_frame_size;
1456     }
1457     if (channel->max_frame_size > event->max_frame_size) {
1458         channel->max_frame_size = event->max_frame_size;
1459     }
1460 
1461 }
1462 
1463 static void rfcomm_channel_finalize(rfcomm_channel_t *channel){
1464 
1465     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1466 
1467     // remove from list
1468     btstack_linked_list_remove( &rfcomm_channels, (btstack_linked_item_t *) channel);
1469 
1470     // free channel
1471     btstack_memory_rfcomm_channel_free(channel);
1472 
1473     // update multiplexer timeout after channel was removed from list
1474     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
1475 }
1476 
1477 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event){
1478 
1479     // TODO: if client max frame size is smaller than RFCOMM_DEFAULT_SIZE, send PN
1480 
1481 
1482     // lookup existing channel
1483     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
1484 
1485     // log_info("rfcomm_channel_state_machine_with_dlci lookup dlci #%u = 0x%08x - event %u", dlci, (int) channel, event->type);
1486 
1487     if (channel) {
1488         int rfcomm_channel_valid = 1;
1489         rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1490         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1491             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1492         }
1493         return;
1494     }
1495 
1496     // service registered?
1497     rfcomm_service_t * service = rfcomm_service_for_channel(dlci >> 1);
1498     // log_info("rfcomm_channel_state_machine_with_dlci service dlci #%u = 0x%08x", dlci, (int) service);
1499     if (!service) {
1500         // discard request by sending disconnected mode
1501         multiplexer->send_dm_for_dlci = dlci;
1502         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1503         return;
1504     }
1505 
1506     // create channel for some events
1507     switch (event->type) {
1508         case CH_EVT_RCVD_SABM:
1509         case CH_EVT_RCVD_PN:
1510         case CH_EVT_RCVD_RPN_REQ:
1511         case CH_EVT_RCVD_RPN_CMD:
1512             // setup incoming channel
1513             channel = rfcomm_channel_create(multiplexer, service, dlci >> 1);
1514             if (!channel){
1515                 // discard request by sending disconnected mode
1516                 multiplexer->send_dm_for_dlci = dlci;
1517                 l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1518             }
1519             break;
1520         default:
1521             break;
1522     }
1523 
1524     if (!channel) {
1525         // discard request by sending disconnected mode
1526         multiplexer->send_dm_for_dlci = dlci;
1527         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1528         return;
1529     }
1530 
1531     int rfcomm_channel_valid = 1;
1532     rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1533     if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1534         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1535     }
1536 }
1537 
1538 static void rfcomm_channel_packet_handler(rfcomm_multiplexer_t * multiplexer,  uint8_t *packet, uint16_t size){
1539 
1540     UNUSED(size);   // ok: fixed format messages
1541 
1542     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1543     const uint8_t frame_dlci = packet[0] >> 2;
1544     uint8_t message_dlci; // used by commands in UIH(_PF) packets
1545 	uint8_t message_len;  //   "
1546 
1547     // rfcomm: (1) command/control
1548     // -- credits_offset = 1 if command == BT_RFCOMM_UIH_PF
1549     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1550     // rfcomm: (2) length. if bit 0 is cleared, 2 byte length is used. (little endian)
1551     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1552     // rfcomm: (3+length_offset) credits if credits_offset == 1
1553     // rfcomm: (3+length_offest+credits_offset)
1554     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1555 
1556     rfcomm_channel_event_t event;
1557     rfcomm_channel_event_pn_t event_pn;
1558     rfcomm_channel_event_rpn_t event_rpn;
1559     rfcomm_channel_event_msc_t event_msc;
1560 
1561     // switch by rfcomm message type
1562     switch(packet[1]) {
1563 
1564         case BT_RFCOMM_SABM:
1565             event.type = CH_EVT_RCVD_SABM;
1566             log_info("Received SABM #%u", frame_dlci);
1567             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1568             break;
1569 
1570         case BT_RFCOMM_UA:
1571             event.type = CH_EVT_RCVD_UA;
1572             log_info("Received UA #%u",frame_dlci);
1573             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1574             break;
1575 
1576         case BT_RFCOMM_DISC:
1577             event.type = CH_EVT_RCVD_DISC;
1578             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1579             break;
1580 
1581         case BT_RFCOMM_DM:
1582         case BT_RFCOMM_DM_PF:
1583             event.type = CH_EVT_RCVD_DM;
1584             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1585             break;
1586 
1587         case BT_RFCOMM_UIH_PF:
1588         case BT_RFCOMM_UIH:
1589 
1590             message_len  = packet[payload_offset+1] >> 1;
1591 
1592             switch (packet[payload_offset]) {
1593                 case BT_RFCOMM_PN_CMD:
1594                     message_dlci = packet[payload_offset+2];
1595                     event_pn.super.type = CH_EVT_RCVD_PN;
1596                     event_pn.priority = packet[payload_offset+4];
1597                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1598                     event_pn.credits_outgoing = packet[payload_offset+9];
1599                     log_info("Received UIH Parameter Negotiation Command for #%u, credits %u",
1600                         message_dlci, event_pn.credits_outgoing);
1601                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1602                     break;
1603 
1604                 case BT_RFCOMM_PN_RSP:
1605                     message_dlci = packet[payload_offset+2];
1606                     event_pn.super.type = CH_EVT_RCVD_PN_RSP;
1607                     event_pn.priority = packet[payload_offset+4];
1608                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1609                     event_pn.credits_outgoing = packet[payload_offset+9];
1610                     log_info("Received UIH Parameter Negotiation Response max frame %u, credits %u",
1611                             event_pn.max_frame_size, event_pn.credits_outgoing);
1612                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1613                     break;
1614 
1615                 case BT_RFCOMM_MSC_CMD:
1616                     message_dlci = packet[payload_offset+2] >> 2;
1617                     event_msc.super.type = CH_EVT_RCVD_MSC_CMD;
1618                     event_msc.modem_status = packet[payload_offset+3];
1619                     log_info("Received MSC CMD for #%u, ", message_dlci);
1620                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_msc);
1621                     break;
1622 
1623                 case BT_RFCOMM_MSC_RSP:
1624                     message_dlci = packet[payload_offset+2] >> 2;
1625                     event.type = CH_EVT_RCVD_MSC_RSP;
1626                     log_info("Received MSC RSP for #%u", message_dlci);
1627                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1628                     break;
1629 
1630                 case BT_RFCOMM_RPN_CMD:
1631                     message_dlci = packet[payload_offset+2] >> 2;
1632                     switch (message_len){
1633                         case 1:
1634                             log_info("Received Remote Port Negotiation Request for #%u", message_dlci);
1635                             event.type = CH_EVT_RCVD_RPN_REQ;
1636                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1637                             break;
1638                         case 8:
1639                             log_info("Received Remote Port Negotiation Update for #%u", message_dlci);
1640                             event_rpn.super.type = CH_EVT_RCVD_RPN_CMD;
1641                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1642                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1643                             break;
1644                         default:
1645                             break;
1646                     }
1647                     break;
1648 
1649                 case BT_RFCOMM_RPN_RSP:
1650                     log_info("Received RPN response");
1651                     break;
1652 
1653                 case BT_RFCOMM_RLS_CMD: {
1654                     log_info("Received RLS command");
1655                     message_dlci = packet[payload_offset+2] >> 2;
1656                     rfcomm_channel_event_rls_t event_rls;
1657                     event_rls.super.type = CH_EVT_RCVD_RLS_CMD;
1658                     event_rls.line_status = packet[payload_offset+3];
1659                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rls);
1660                     break;
1661                 }
1662 
1663                 case BT_RFCOMM_RLS_RSP:
1664                     log_info("Received RLS response");
1665                     break;
1666 
1667                 // Following commands are handled by rfcomm_multiplexer_l2cap_packet_handler
1668                 // case BT_RFCOMM_TEST_CMD:
1669                 // case BT_RFCOMM_FCOFF_CMD:
1670                 // case BT_RFCOMM_FCON_CMD:
1671                 // everything else is an not supported command
1672                 default: {
1673                     log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);
1674                     multiplexer->nsc_command = packet[payload_offset];
1675                     break;
1676                 }
1677             }
1678             break;
1679 
1680         default:
1681             log_error("Received unknown RFCOMM message type %x", packet[1]);
1682             break;
1683     }
1684 
1685     // trigger next action - example W4_PN_RSP: transition to SEND_SABM which only depends on "can send"
1686     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
1687         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1688     }
1689 }
1690 
1691 static void rfcomm_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1692 
1693     if (packet_type == HCI_EVENT_PACKET){
1694         rfcomm_hci_event_handler(packet, size);
1695         return;
1696     }
1697 
1698     // we only handle l2cap packets for:
1699     if (packet_type != L2CAP_DATA_PACKET) return;
1700 
1701     //  - multiplexer itself
1702     int handled = rfcomm_multiplexer_l2cap_packet_handler(channel, packet, size);
1703 
1704     if (handled) return;
1705 
1706     // - channel over open mutliplexer
1707     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1708     if (!multiplexer || multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) return;
1709 
1710     // channel data ?
1711     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1712     const uint8_t frame_dlci = packet[0] >> 2;
1713 
1714     if (frame_dlci && (packet[1] == BT_RFCOMM_UIH || packet[1] == BT_RFCOMM_UIH_PF)) {
1715         rfcomm_channel_packet_handler_uih(multiplexer, packet, size);
1716         return;
1717     }
1718 
1719     rfcomm_channel_packet_handler(multiplexer, packet, size);
1720 }
1721 
1722 static int rfcomm_channel_ready_for_open(rfcomm_channel_t *channel){
1723     // note: exchanging MSC isn't neccessary to consider channel open
1724     // note: having outgoing credits is also not necessary to consider channel open
1725     // log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u, l2cap credits %u ", channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS, channel->state_var, channel->credits_outgoing, channel->multiplexer->l2cap_credits);
1726     // if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP) == 0) return 0;
1727     // if (channel->credits_outgoing == 0) return 0;
1728     log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u",
1729          channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP, channel->state_var, channel->credits_outgoing);
1730     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP) == 0) return 0;
1731     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS) == 0) return 0;
1732 
1733     return 1;
1734 }
1735 
1736 static int rfcomm_channel_ready_for_incoming_dlc_setup(rfcomm_channel_t * channel){
1737     log_info("rfcomm_channel_ready_for_incoming_dlc_setup state var %04x", channel->state_var);
1738     // Client accept and SABM/UA is required, PN RSP is needed if PN was received
1739     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) == 0) return 0;
1740     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM      ) == 0) return 0;
1741     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA        ) != 0) return 0;
1742     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP    ) != 0) return 0;
1743     return 1;
1744 }
1745 
1746 inline static void rfcomm_channel_state_add(rfcomm_channel_t *channel, RFCOMM_CHANNEL_STATE_VAR event){
1747     channel->state_var = (RFCOMM_CHANNEL_STATE_VAR) (channel->state_var | event);
1748 }
1749 inline static void rfcomm_channel_state_remove(rfcomm_channel_t *channel, RFCOMM_CHANNEL_STATE_VAR event){
1750     channel->state_var = (RFCOMM_CHANNEL_STATE_VAR) (channel->state_var & ~event);
1751 }
1752 
1753 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel){
1754     switch (channel->state){
1755         case RFCOMM_CHANNEL_SEND_UIH_PN:
1756             log_debug("ch-ready: state %u", channel->state);
1757             return 1;
1758         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1759             log_debug("ch-ready: state %u", channel->state);
1760             return 1;
1761         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
1762             log_debug("ch-ready: state %u", channel->state);
1763             return 1;
1764         case RFCOMM_CHANNEL_SEND_DISC:
1765             log_debug("ch-ready: state %u", channel->state);
1766             return 1;
1767         case RFCOMM_CHANNEL_SEND_DM:
1768             log_debug("ch-ready: state %u", channel->state);
1769             return 1;
1770         case RFCOMM_CHANNEL_OPEN:
1771             if (channel->new_credits_incoming) {
1772                 log_debug("ch-ready: channel open & new_credits_incoming") ;
1773                 return 1;
1774             }
1775             break;
1776         case RFCOMM_CHANNEL_DLC_SETUP:
1777             if (channel->state_var & (
1778                 RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD  |
1779                 RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS
1780              )) {
1781                 log_debug("ch-ready: channel dlc setup & send msc cmd or send credits") ;
1782                 return 1;
1783             }
1784             break;
1785 
1786         default:
1787             break;
1788     }
1789 
1790     if (channel->state_var & (
1791         RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP   |
1792         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_INFO |
1793         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP  |
1794         RFCOMM_CHANNEL_STATE_VAR_SEND_UA       |
1795         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP
1796                              )){
1797         log_debug("ch-ready: state %x, state var %x", channel->state, channel->state_var);
1798         return 1;
1799     }
1800 
1801     if (channel->rls_line_status != RFCOMM_RLS_STATUS_INVALID) {
1802         log_debug("ch-ready: rls_line_status");
1803         return 1;
1804     }
1805 
1806     return 0;
1807 }
1808 
1809 
1810 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid){
1811 
1812     // log_info("rfcomm_channel_state_machine_with_channel: state %u, state_var %04x, event %u", channel->state, channel->state_var ,event->type);
1813 
1814     // channel != NULL -> channel valid
1815     *out_channel_valid = 1;
1816 
1817     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1818 
1819     // TODO: integrate in common switch
1820     if (event->type == CH_EVT_RCVD_DISC){
1821         rfcomm_emit_channel_closed(channel);
1822         channel->state = RFCOMM_CHANNEL_SEND_UA_AFTER_DISC;
1823         return;
1824     }
1825 
1826     // TODO: integrate in common switch
1827     if (event->type == CH_EVT_RCVD_DM){
1828         log_info("Received DM message for #%u", channel->dlci);
1829         log_info("-> Closing channel locally for #%u", channel->dlci);
1830         rfcomm_channel_emit_final_event(channel, ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
1831         rfcomm_channel_finalize(channel);
1832         *out_channel_valid = 0;
1833         return;
1834     }
1835 
1836     // remote port negotiation command - just accept everything for now
1837     //
1838     // "The RPN command can be used before a new DLC is opened and should be used whenever the port settings change."
1839     // "The RPN command is specified as optional in TS 07.10, but it is mandatory to recognize and respond to it in RFCOMM.
1840     //   (Although the handling of individual settings are implementation-dependent.)"
1841     //
1842 
1843     // TODO: integrate in common switch
1844     if (event->type == CH_EVT_RCVD_RPN_CMD){
1845         // control port parameters
1846         rfcomm_channel_event_rpn_t *event_rpn = (rfcomm_channel_event_rpn_t*) event;
1847         rfcomm_rpn_data_update(&channel->rpn_data, &event_rpn->data);
1848         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1849         // notify client about new settings
1850         rfcomm_emit_port_configuration(channel);
1851         return;
1852     }
1853 
1854     // TODO: integrate in common switch
1855     if (event->type == CH_EVT_RCVD_RPN_REQ){
1856         // no values got accepted (no values have beens sent)
1857         channel->rpn_data.parameter_mask_0 = 0x00;
1858         channel->rpn_data.parameter_mask_1 = 0x00;
1859         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1860         return;
1861     }
1862 
1863     if (event->type == CH_EVT_RCVD_RLS_CMD){
1864         rfcomm_channel_event_rls_t * event_rls = (rfcomm_channel_event_rls_t*) event;
1865         channel->rls_line_status = event_rls->line_status & 0x0f;
1866         log_info("CH_EVT_RCVD_RLS_CMD setting line status to 0x%0x", channel->rls_line_status);
1867         rfcomm_emit_remote_line_status(channel, event_rls->line_status);
1868         return;
1869     }
1870 
1871     // TODO: integrate in common switch
1872     if (event->type == CH_EVT_READY_TO_SEND){
1873         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP){
1874             log_info("Sending Remote Port Negotiation RSP for #%u", channel->dlci);
1875             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RSP);
1876             rfcomm_send_uih_rpn_rsp(multiplexer, channel->dlci, &channel->rpn_data);
1877             return;
1878         }
1879         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP){
1880             log_info("Sending MSC RSP for #%u", channel->dlci);
1881             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1882             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP);
1883             rfcomm_send_uih_msc_rsp(multiplexer, channel->dlci, 0x8d);  // ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
1884             return;
1885         }
1886         if (channel->rls_line_status != RFCOMM_RLS_STATUS_INVALID){
1887             log_info("Sending RLS RSP 0x%0x", channel->rls_line_status);
1888             uint8_t line_status = channel->rls_line_status;
1889             channel->rls_line_status = RFCOMM_RLS_STATUS_INVALID;
1890             rfcomm_send_uih_rls_rsp(multiplexer, channel->dlci, line_status);
1891             return;
1892         }
1893     }
1894 
1895     // emit MSC status to app
1896     if (event->type == CH_EVT_RCVD_MSC_CMD){
1897         // notify client about new settings
1898         rfcomm_channel_event_msc_t *event_msc = (rfcomm_channel_event_msc_t*) event;
1899         uint8_t modem_status_event[2+1];
1900         modem_status_event[0] = RFCOMM_EVENT_REMOTE_MODEM_STATUS;
1901         modem_status_event[1] = 1;
1902         modem_status_event[2] = event_msc->modem_status;
1903         (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, (uint8_t*)&modem_status_event, sizeof(modem_status_event));
1904         // no return, MSC_CMD will be handled by state machine below
1905     }
1906 
1907     rfcomm_channel_event_pn_t * event_pn = (rfcomm_channel_event_pn_t*) event;
1908 
1909     switch (channel->state) {
1910         case RFCOMM_CHANNEL_CLOSED:
1911             switch (event->type){
1912                 case CH_EVT_RCVD_SABM:
1913                     log_info("-> Inform app");
1914                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1915                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1916                     rfcomm_emit_connection_request(channel);
1917                     break;
1918                 case CH_EVT_RCVD_PN:
1919                     rfcomm_channel_accept_pn(channel, event_pn);
1920                     log_info("-> Inform app");
1921                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1922                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1923                     rfcomm_emit_connection_request(channel);
1924                     break;
1925                 default:
1926                     break;
1927             }
1928             break;
1929 
1930         case RFCOMM_CHANNEL_INCOMING_SETUP:
1931             switch (event->type){
1932                 case CH_EVT_RCVD_SABM:
1933                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1934                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1935                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1936                     }
1937                     break;
1938                 case CH_EVT_RCVD_PN:
1939                     rfcomm_channel_accept_pn(channel, event_pn);
1940                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1941                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
1942                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1943                     }
1944                     break;
1945                 case CH_EVT_READY_TO_SEND:
1946                     // if / else if is used to check for state transition after sending
1947                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP){
1948                         log_info("Sending UIH Parameter Negotiation Respond for #%u", channel->dlci);
1949                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
1950                         rfcomm_send_uih_pn_response(multiplexer, channel->dlci, channel->pn_priority, channel->max_frame_size);
1951                     } else if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA){
1952                         log_info("Sending UA #%u", channel->dlci);
1953                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
1954                         rfcomm_send_ua(multiplexer, channel->dlci);
1955                     }
1956                     if (rfcomm_channel_ready_for_incoming_dlc_setup(channel)){
1957                         log_info("Incomping setup done, requesting send MSC CMD and send Credits");
1958                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1959                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
1960                         channel->state = RFCOMM_CHANNEL_DLC_SETUP;
1961                      }
1962                     break;
1963                 default:
1964                     break;
1965             }
1966             break;
1967 
1968         case RFCOMM_CHANNEL_W4_MULTIPLEXER:
1969             switch (event->type) {
1970                 case CH_EVT_MULTIPLEXER_READY:
1971                     log_info("Muliplexer opened, sending UIH PN next");
1972                     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
1973                     break;
1974                 default:
1975                     break;
1976             }
1977             break;
1978 
1979         case RFCOMM_CHANNEL_SEND_UIH_PN:
1980             switch (event->type) {
1981                 case CH_EVT_READY_TO_SEND:
1982                     // update mtu
1983                     channel->max_frame_size = btstack_min(multiplexer->max_frame_size, channel->max_frame_size);
1984                     log_info("Sending UIH Parameter Negotiation Command for #%u (channel 0x%p) mtu %u", channel->dlci, channel, channel->max_frame_size );
1985                     channel->state = RFCOMM_CHANNEL_W4_PN_RSP;
1986                     rfcomm_send_uih_pn_command(multiplexer, channel->dlci, channel->max_frame_size);
1987                     break;
1988                 default:
1989                     break;
1990             }
1991             break;
1992 
1993         case RFCOMM_CHANNEL_W4_PN_RSP:
1994             switch (event->type){
1995                 case CH_EVT_RCVD_PN_RSP:
1996                     // update max frame size
1997                     if (channel->max_frame_size > event_pn->max_frame_size) {
1998                         channel->max_frame_size = event_pn->max_frame_size;
1999                     }
2000                     // new credits
2001                     channel->credits_outgoing = event_pn->credits_outgoing;
2002                     channel->state = RFCOMM_CHANNEL_SEND_SABM_W4_UA;
2003                     break;
2004                 default:
2005                     break;
2006             }
2007             break;
2008 
2009         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
2010             switch (event->type) {
2011                 case CH_EVT_READY_TO_SEND:
2012                     log_info("Sending SABM #%u", channel->dlci);
2013                     channel->state = RFCOMM_CHANNEL_W4_UA;
2014                     rfcomm_send_sabm(multiplexer, channel->dlci);
2015                     break;
2016                 default:
2017                     break;
2018             }
2019             break;
2020 
2021         case RFCOMM_CHANNEL_W4_UA:
2022             switch (event->type){
2023                 case CH_EVT_RCVD_UA:
2024                     channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2025                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2026                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2027                     break;
2028                 default:
2029                     break;
2030             }
2031             break;
2032 
2033         case RFCOMM_CHANNEL_DLC_SETUP:
2034             switch (event->type){
2035                 case CH_EVT_RCVD_MSC_CMD:
2036                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_CMD);
2037                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2038                     break;
2039                 case CH_EVT_RCVD_MSC_RSP:
2040                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP);
2041                     break;
2042 
2043                 case CH_EVT_READY_TO_SEND:
2044                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD){
2045                         log_info("Sending MSC CMD for #%u", channel->dlci);
2046                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2047                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_CMD);
2048                         rfcomm_send_uih_msc_cmd(multiplexer, channel->dlci , 0x8d);  // ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
2049                         break;
2050                     }
2051                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS){
2052                         log_info("Providing credits for #%u", channel->dlci);
2053                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2054                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS);
2055 
2056                         if (channel->new_credits_incoming) {
2057                             uint8_t new_credits = channel->new_credits_incoming;
2058                             channel->new_credits_incoming = 0;
2059                             rfcomm_channel_send_credits(channel, new_credits);
2060                         }
2061                         break;
2062 
2063                     }
2064                     break;
2065                 default:
2066                     break;
2067             }
2068             // finally done?
2069             if (rfcomm_channel_ready_for_open(channel)){
2070                 channel->state = RFCOMM_CHANNEL_OPEN;
2071                 rfcomm_channel_opened(channel);
2072             }
2073             break;
2074 
2075         case RFCOMM_CHANNEL_OPEN:
2076             switch (event->type){
2077                 case CH_EVT_RCVD_MSC_CMD:
2078                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2079                     break;
2080                 case CH_EVT_READY_TO_SEND:
2081                     if (channel->new_credits_incoming) {
2082                         uint8_t new_credits = channel->new_credits_incoming;
2083                         channel->new_credits_incoming = 0;
2084                         rfcomm_channel_send_credits(channel, new_credits);
2085                         break;
2086                     }
2087                     break;
2088                 case CH_EVT_RCVD_CREDITS:
2089                     rfcomm_notify_channel_can_send();
2090                     break;
2091                 default:
2092                     break;
2093             }
2094             break;
2095 
2096         case RFCOMM_CHANNEL_SEND_DM:
2097             switch (event->type) {
2098                 case CH_EVT_READY_TO_SEND:
2099                     log_info("Sending DM_PF for #%u", channel->dlci);
2100                     // don't emit channel closed - channel was never open
2101                     channel->state = RFCOMM_CHANNEL_CLOSED;
2102                     rfcomm_send_dm_pf(multiplexer, channel->dlci);
2103                     rfcomm_channel_finalize(channel);
2104                     *out_channel_valid = 0;
2105                     break;
2106                 default:
2107                     break;
2108             }
2109             break;
2110 
2111         case RFCOMM_CHANNEL_SEND_DISC:
2112             switch (event->type) {
2113                 case CH_EVT_READY_TO_SEND:
2114                     channel->state = RFCOMM_CHANNEL_W4_UA_AFTER_DISC;
2115                     rfcomm_send_disc(multiplexer, channel->dlci);
2116                     break;
2117                 default:
2118                     break;
2119             }
2120             break;
2121 
2122         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
2123             switch (event->type){
2124                 case CH_EVT_RCVD_UA:
2125                     channel->state = RFCOMM_CHANNEL_CLOSED;
2126                     rfcomm_emit_channel_closed(channel);
2127                     rfcomm_channel_finalize(channel);
2128                     *out_channel_valid = 0;
2129                     break;
2130                 default:
2131                     break;
2132             }
2133             break;
2134 
2135         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
2136             switch (event->type) {
2137                 case CH_EVT_READY_TO_SEND:
2138                     log_info("Sending UA after DISC for #%u", channel->dlci);
2139                     channel->state = RFCOMM_CHANNEL_CLOSED;
2140                     rfcomm_send_ua(multiplexer, channel->dlci);
2141                     rfcomm_channel_finalize(channel);
2142                     *out_channel_valid = 0;
2143                     break;
2144                 default:
2145                     break;
2146             }
2147             break;
2148 
2149         default:
2150             break;
2151     }
2152 }
2153 
2154 // MARK: RFCOMM BTstack API
2155 
2156 void rfcomm_init(void){
2157     rfcomm_client_cid_generator = 0;
2158     rfcomm_multiplexers = NULL;
2159     rfcomm_services     = NULL;
2160     rfcomm_channels     = NULL;
2161     rfcomm_security_level = LEVEL_2;
2162 }
2163 
2164 void rfcomm_set_required_security_level(gap_security_level_t security_level){
2165     rfcomm_security_level = security_level;
2166 }
2167 
2168 int rfcomm_can_send_packet_now(uint16_t rfcomm_cid){
2169     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2170     if (!channel){
2171         log_error("rfcomm_send cid 0x%02x doesn't exist!", rfcomm_cid);
2172         return 0;
2173     }
2174     return rfcomm_channel_can_send(channel);
2175 }
2176 
2177 void rfcomm_request_can_send_now_event(uint16_t rfcomm_cid){
2178     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2179     if (!channel){
2180         log_error("rfcomm_send cid 0x%02x doesn't exist!", rfcomm_cid);
2181         return;
2182     }
2183     channel->waiting_for_can_send_now = 1;
2184     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2185 }
2186 
2187 static int rfcomm_assert_send_valid(rfcomm_channel_t * channel , uint16_t len){
2188     if (len > channel->max_frame_size){
2189         log_error("rfcomm_send cid 0x%02x, rfcomm data lenght exceeds MTU!", channel->rfcomm_cid);
2190         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2191     }
2192 
2193 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2194     if (len > rfcomm_max_frame_size_for_l2cap_mtu(sizeof(outgoing_buffer))){
2195         log_error("rfcomm_send cid 0x%02x, length exceeds outgoing rfcomm_out_buffer", channel->rfcomm_cid);
2196         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2197     }
2198 #endif
2199 
2200     if (!channel->credits_outgoing){
2201         log_info("rfcomm_send cid 0x%02x, no rfcomm outgoing credits!", channel->rfcomm_cid);
2202         return RFCOMM_NO_OUTGOING_CREDITS;
2203     }
2204 
2205     if ((channel->multiplexer->fcon & 1) == 0){
2206         log_info("rfcomm_send cid 0x%02x, aggregate flow off!", channel->rfcomm_cid);
2207         return RFCOMM_AGGREGATE_FLOW_OFF;
2208     }
2209     return 0;
2210 }
2211 
2212 uint16_t rfcomm_get_max_frame_size(uint16_t rfcomm_cid){
2213     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2214     if (!channel){
2215         log_error("rfcomm_get_max_frame_size cid 0x%02x doesn't exist!", rfcomm_cid);
2216         return 0;
2217     }
2218     return channel->max_frame_size;
2219 }
2220 
2221 // pre: rfcomm_can_send_packet_now(rfcomm_cid) == true
2222 int rfcomm_reserve_packet_buffer(void){
2223 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2224     log_error("rfcomm_reserve_packet_buffer should not get called with ERTM");
2225     return 0;
2226 #else
2227     return l2cap_reserve_packet_buffer();
2228 #endif
2229 }
2230 
2231 void rfcomm_release_packet_buffer(void){
2232 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2233     log_error("rfcomm_release_packet_buffer should not get called with ERTM");
2234 #else
2235     l2cap_release_packet_buffer();
2236 #endif
2237 }
2238 
2239 uint8_t * rfcomm_get_outgoing_buffer(void){
2240 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2241     uint8_t * rfcomm_out_buffer = outgoing_buffer;
2242 #else
2243     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
2244 #endif
2245     // address + control + length (16) + no credit field
2246     return &rfcomm_out_buffer[4];
2247 }
2248 
2249 int rfcomm_send_prepared(uint16_t rfcomm_cid, uint16_t len){
2250     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2251     if (!channel){
2252         log_error("rfcomm_send_prepared cid 0x%02x doesn't exist!", rfcomm_cid);
2253         return 0;
2254     }
2255 
2256     int err = rfcomm_assert_send_valid(channel, len);
2257     if (err) return err;
2258 
2259 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2260     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2261         log_error("rfcomm_send_prepared: l2cap cannot send now");
2262         return BTSTACK_ACL_BUFFERS_FULL;
2263     }
2264 #else
2265     if (!l2cap_can_send_prepared_packet_now(channel->multiplexer->l2cap_cid)){
2266         log_error("rfcomm_send_prepared: l2cap cannot send now");
2267         return BTSTACK_ACL_BUFFERS_FULL;
2268     }
2269 #endif
2270 
2271     // send might cause l2cap to emit new credits, update counters first
2272     if (len){
2273         channel->credits_outgoing--;
2274     } else {
2275         log_info("sending empty RFCOMM packet for cid %02x", rfcomm_cid);
2276     }
2277 
2278     int result = rfcomm_send_uih_prepared(channel->multiplexer, channel->dlci, len);
2279 
2280     if (result != 0) {
2281         if (len) {
2282             channel->credits_outgoing++;
2283         }
2284         log_error("rfcomm_send_prepared: error %d", result);
2285         return result;
2286     }
2287 
2288     return result;
2289 }
2290 
2291 int rfcomm_send(uint16_t rfcomm_cid, uint8_t *data, uint16_t len){
2292     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2293     if (!channel){
2294         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2295         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2296     }
2297 
2298     int err = rfcomm_assert_send_valid(channel, len);
2299     if (err) return err;
2300     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2301         log_error("rfcomm_send_internal: l2cap cannot send now");
2302         return BTSTACK_ACL_BUFFERS_FULL;
2303     }
2304 
2305 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2306 #else
2307     rfcomm_reserve_packet_buffer();
2308 #endif
2309     uint8_t * rfcomm_payload = rfcomm_get_outgoing_buffer();
2310 
2311     memcpy(rfcomm_payload, data, len);
2312     err = rfcomm_send_prepared(rfcomm_cid, len);
2313 
2314 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2315 #else
2316     if (err){
2317         rfcomm_release_packet_buffer();
2318     }
2319 #endif
2320 
2321     return err;
2322 }
2323 
2324 // Sends Local Lnie Status, see LINE_STATUS_..
2325 int rfcomm_send_local_line_status(uint16_t rfcomm_cid, uint8_t line_status){
2326     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2327     if (!channel){
2328         log_error("rfcomm_send_local_line_status cid 0x%02x doesn't exist!", rfcomm_cid);
2329         return 0;
2330     }
2331     return rfcomm_send_uih_rls_cmd(channel->multiplexer, channel->dlci, line_status);
2332 }
2333 
2334 // Sned local modem status. see MODEM_STAUS_..
2335 int rfcomm_send_modem_status(uint16_t rfcomm_cid, uint8_t modem_status){
2336     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2337     if (!channel){
2338         log_error("rfcomm_send_modem_status cid 0x%02x doesn't exist!", rfcomm_cid);
2339         return 0;
2340     }
2341     return rfcomm_send_uih_msc_cmd(channel->multiplexer, channel->dlci, modem_status);
2342 }
2343 
2344 // Configure remote port
2345 int rfcomm_send_port_configuration(uint16_t rfcomm_cid, rpn_baud_t baud_rate, rpn_data_bits_t data_bits, rpn_stop_bits_t stop_bits, rpn_parity_t parity, rpn_flow_control_t flow_control){
2346     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2347     if (!channel){
2348         log_error("rfcomm_send_port_configuration cid 0x%02x doesn't exist!", rfcomm_cid);
2349         return 0;
2350     }
2351     rfcomm_rpn_data_t rpn_data;
2352     rpn_data.baud_rate = baud_rate;
2353     rpn_data.flags = data_bits | (stop_bits << 2) | (parity << 3);
2354     rpn_data.flow_control = flow_control;
2355     rpn_data.xon = 0;
2356     rpn_data.xoff = 0;
2357     rpn_data.parameter_mask_0 = 0x1f;   // all but xon/xoff
2358     rpn_data.parameter_mask_1 = 0x3f;   // all flow control options
2359     return rfcomm_send_uih_rpn_cmd(channel->multiplexer, channel->dlci, &rpn_data);
2360 }
2361 
2362 // Query remote port
2363 int rfcomm_query_port_configuration(uint16_t rfcomm_cid){
2364     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2365     if (!channel){
2366         log_error("rfcomm_query_port_configuration cid 0x%02x doesn't exist!", rfcomm_cid);
2367         return 0;
2368     }
2369     return rfcomm_send_uih_rpn_req(channel->multiplexer, channel->dlci);
2370 }
2371 
2372 
2373 static uint8_t rfcomm_channel_create_internal(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t incoming_flow_control, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2374     log_info("RFCOMM_CREATE_CHANNEL addr %s channel #%u init credits %u",  bd_addr_to_str(addr), server_channel, initial_credits);
2375 
2376     // create new multiplexer if necessary
2377     uint8_t status = 0;
2378     uint8_t dlci = 0;
2379     int new_multiplexer = 0;
2380     rfcomm_channel_t * channel = NULL;
2381     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_addr(addr);
2382     if (!multiplexer) {
2383         multiplexer = rfcomm_multiplexer_create_for_addr(addr);
2384         if (!multiplexer){
2385             status = BTSTACK_MEMORY_ALLOC_FAILED;
2386             goto fail;
2387         }
2388         multiplexer->outgoing = 1;
2389         multiplexer->state = RFCOMM_MULTIPLEXER_W4_CONNECT;
2390         new_multiplexer = 1;
2391     }
2392 
2393     // check if channel for this remote service already exists
2394     dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
2395     channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
2396     if (channel){
2397         status = RFCOMM_CHANNEL_ALREADY_REGISTERED;
2398         goto fail;
2399     }
2400 
2401     // prepare channel
2402     channel = rfcomm_channel_create(multiplexer, NULL, server_channel);
2403     if (!channel){
2404         status = BTSTACK_MEMORY_ALLOC_FAILED;
2405         goto fail;
2406     }
2407 
2408     // rfcomm_cid is already assigned by rfcomm_channel_create
2409     channel->incoming_flow_control = incoming_flow_control;
2410     channel->new_credits_incoming  = initial_credits;
2411     channel->packet_handler = packet_handler;
2412 
2413     // return rfcomm_cid
2414     if (out_rfcomm_cid){
2415         *out_rfcomm_cid = channel->rfcomm_cid;
2416     }
2417 
2418     // start multiplexer setup
2419     if (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) {
2420         channel->state = RFCOMM_CHANNEL_W4_MULTIPLEXER;
2421         uint16_t l2cap_cid = 0;
2422 #ifdef RFCOMM_USE_ERTM
2423         // request
2424         rfcomm_ertm_request_t request;
2425         memset(&request, 0, sizeof(rfcomm_ertm_request_t));
2426         memcpy(request.addr, addr, 6);
2427         request.ertm_id = rfcomm_next_ertm_id();
2428         if (rfcomm_ertm_request_callback){
2429             (*rfcomm_ertm_request_callback)(&request);
2430         }
2431         if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
2432             multiplexer->ertm_id = request.ertm_id;
2433             status = l2cap_create_ertm_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM,
2434                         request.ertm_config, request.ertm_buffer, request.ertm_buffer_size, &l2cap_cid);
2435         }
2436         else
2437 #endif
2438         {
2439             status = l2cap_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM, l2cap_max_mtu(), &l2cap_cid);
2440         }
2441         if (status) goto fail;
2442         multiplexer->l2cap_cid = l2cap_cid;
2443         return 0;
2444     }
2445 
2446     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2447 
2448     // start connecting, if multiplexer is already up and running
2449     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
2450     return 0;
2451 
2452 fail:
2453     if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2454     if (channel)         btstack_memory_rfcomm_channel_free(channel);
2455     return status;
2456 }
2457 
2458 uint8_t rfcomm_create_channel_with_initial_credits(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2459     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 1, initial_credits, out_rfcomm_cid);
2460 }
2461 
2462 uint8_t rfcomm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint16_t * out_rfcomm_cid){
2463     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 0, RFCOMM_CREDITS, out_rfcomm_cid);
2464 }
2465 
2466 void rfcomm_disconnect(uint16_t rfcomm_cid){
2467     log_info("RFCOMM_DISCONNECT cid 0x%02x", rfcomm_cid);
2468     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2469     if (!channel) return;
2470 
2471     channel->state = RFCOMM_CHANNEL_SEND_DISC;
2472     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2473 }
2474 
2475 static uint8_t rfcomm_register_service_internal(btstack_packet_handler_t packet_handler,
2476     uint8_t channel, uint16_t max_frame_size, uint8_t incoming_flow_control, uint8_t initial_credits){
2477 
2478     log_info("RFCOMM_REGISTER_SERVICE channel #%u mtu %u flow_control %u credits %u",
2479              channel, max_frame_size, incoming_flow_control, initial_credits);
2480 
2481     // check if already registered
2482     rfcomm_service_t * service = rfcomm_service_for_channel(channel);
2483     if (service){
2484         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2485     }
2486 
2487     // alloc structure
2488     service = btstack_memory_rfcomm_service_get();
2489     if (!service) {
2490         return BTSTACK_MEMORY_ALLOC_FAILED;
2491     }
2492 
2493     // register with l2cap if not registered before, max MTU
2494     if (btstack_linked_list_empty(&rfcomm_services)){
2495         l2cap_register_service(rfcomm_packet_handler, BLUETOOTH_PROTOCOL_RFCOMM, 0xffff, rfcomm_security_level);
2496     }
2497 
2498     // fill in
2499     service->packet_handler = packet_handler;
2500     service->server_channel = channel;
2501     service->max_frame_size = max_frame_size;
2502     service->incoming_flow_control = incoming_flow_control;
2503     service->incoming_initial_credits = initial_credits;
2504 
2505     // add to services list
2506     btstack_linked_list_add(&rfcomm_services, (btstack_linked_item_t *) service);
2507 
2508     return 0;
2509 }
2510 
2511 uint8_t rfcomm_register_service_with_initial_credits(btstack_packet_handler_t packet_handler,
2512     uint8_t channel, uint16_t max_frame_size, uint8_t initial_credits){
2513 
2514     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 1, initial_credits);
2515 }
2516 
2517 uint8_t rfcomm_register_service(btstack_packet_handler_t packet_handler, uint8_t channel,
2518     uint16_t max_frame_size){
2519 
2520     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 0,RFCOMM_CREDITS);
2521 }
2522 
2523 void rfcomm_unregister_service(uint8_t service_channel){
2524     log_info("RFCOMM_UNREGISTER_SERVICE #%u", service_channel);
2525     rfcomm_service_t *service = rfcomm_service_for_channel(service_channel);
2526     if (!service) return;
2527     btstack_linked_list_remove(&rfcomm_services, (btstack_linked_item_t *) service);
2528     btstack_memory_rfcomm_service_free(service);
2529 
2530     // unregister if no services active
2531     if (btstack_linked_list_empty(&rfcomm_services)){
2532         // bt_send_cmd(&l2cap_unregister_service, BLUETOOTH_PROTOCOL_RFCOMM);
2533         l2cap_unregister_service(BLUETOOTH_PROTOCOL_RFCOMM);
2534     }
2535 }
2536 
2537 void rfcomm_accept_connection(uint16_t rfcomm_cid){
2538     log_info("RFCOMM_ACCEPT_CONNECTION cid 0x%02x", rfcomm_cid);
2539     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2540     if (!channel) return;
2541     switch (channel->state) {
2542         case RFCOMM_CHANNEL_INCOMING_SETUP:
2543             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED);
2544             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_PN){
2545                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2546                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2547             }
2548             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM){
2549                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2550                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2551             }
2552             // at least one of { PN RSP, UA } needs to be sent
2553             // state transistion incoming setup -> dlc setup happens in rfcomm_run after these have been sent
2554             break;
2555         default:
2556             break;
2557     }
2558 
2559 }
2560 
2561 void rfcomm_decline_connection(uint16_t rfcomm_cid){
2562     log_info("RFCOMM_DECLINE_CONNECTION cid 0x%02x", rfcomm_cid);
2563     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2564     if (!channel) return;
2565     switch (channel->state) {
2566         case RFCOMM_CHANNEL_INCOMING_SETUP:
2567             channel->state = RFCOMM_CHANNEL_SEND_DM;
2568             l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2569             break;
2570         default:
2571             break;
2572     }
2573 }
2574 
2575 void rfcomm_grant_credits(uint16_t rfcomm_cid, uint8_t credits){
2576     log_info("RFCOMM_GRANT_CREDITS cid 0x%02x credits %u", rfcomm_cid, credits);
2577     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2578     if (!channel) return;
2579     if (!channel->incoming_flow_control) return;
2580     channel->new_credits_incoming += credits;
2581 
2582     // process
2583     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2584 }
2585 
2586 #ifdef RFCOMM_USE_ERTM
2587 void rfcomm_enable_l2cap_ertm(void request_callback(rfcomm_ertm_request_t * request), void released_callback(uint16_t ertm_id)){
2588     rfcomm_ertm_request_callback  = request_callback;
2589     rfcomm_ertm_released_callback = released_callback;
2590 }
2591 #endif
2592