xref: /btstack/src/classic/rfcomm.c (revision 4a9eead824c50b40e12b6f72611a74a3f57a47f6)
1 /*
2  * Copyright (C) 2014 BlueKitchen GmbH
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. Neither the name of the copyright holders nor the names of
14  *    contributors may be used to endorse or promote products derived
15  *    from this software without specific prior written permission.
16  * 4. Any redistribution, use, or modification is done solely for
17  *    personal benefit and not for any commercial purpose or for
18  *    monetary gain.
19  *
20  * THIS SOFTWARE IS PROVIDED BY BLUEKITCHEN GMBH AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
23  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL BLUEKITCHEN
24  * GMBH OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
26  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
27  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
28  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
29  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
30  * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * Please inquire about commercial licensing options at
34  * [email protected]
35  *
36  */
37 
38 #define BTSTACK_FILE__ "rfcomm.c"
39 
40 /*
41  *  rfcomm.c
42  */
43 
44 #include <string.h> // memcpy
45 #include <stdint.h>
46 
47 #include "bluetooth_sdp.h"
48 #include "btstack_debug.h"
49 #include "btstack_event.h"
50 #include "btstack_memory.h"
51 #include "btstack_util.h"
52 #include "classic/core.h"
53 #include "classic/rfcomm.h"
54 #include "hci.h"
55 #include "hci_cmd.h"
56 #include "hci_dump.h"
57 #include "l2cap.h"
58 
59 // workaround for missing PRIxPTR on mspgcc (16/20-bit MCU)
60 #ifndef PRIxPTR
61 #if defined(__MSP430X__)  &&  defined(__MSP430X_LARGE__)
62 #define PRIxPTR "lx"
63 #else
64 #define PRIxPTR "x"
65 #endif
66 #endif
67 
68 // ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
69 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM
70 #ifdef ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE
71 #define RFCOMM_USE_OUTGOING_BUFFER
72 #define RFCOMM_USE_ERTM
73 #else
74 #error "ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM requires ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE. "
75 #error "Please disable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE_FOR_RFCOMM, or, "
76 #error "enable ENABLE_L2CAP_ENHANCED_RETRANSMISSION_MODE"
77 #endif
78 #endif
79 
80 #define RFCOMM_MULIPLEXER_TIMEOUT_MS 60000
81 
82 #define RFCOMM_CREDITS 10
83 
84 // FCS calc
85 #define BT_RFCOMM_CODE_WORD         0xE0 // pol = x8+x2+x1+1
86 #define BT_RFCOMM_CRC_CHECK_LEN     3
87 #define BT_RFCOMM_UIHCRC_CHECK_LEN  2
88 
89 // Control field values      bit no.       1 2 3 4 PF 6 7 8
90 #define BT_RFCOMM_SABM       0x3F       // 1 1 1 1  1 1 0 0
91 #define BT_RFCOMM_UA         0x73       // 1 1 0 0  1 1 1 0
92 #define BT_RFCOMM_DM         0x0F       // 1 1 1 1  0 0 0 0
93 #define BT_RFCOMM_DM_PF      0x1F       // 1 1 1 1  1 0 0 0
94 #define BT_RFCOMM_DISC       0x53       // 1 1 0 0  1 0 1 0
95 #define BT_RFCOMM_UIH        0xEF       // 1 1 1 1  0 1 1 1
96 #define BT_RFCOMM_UIH_PF     0xFF       // 1 1 1 1  0 1 1 1
97 
98 // Multiplexer message types
99 #define BT_RFCOMM_CLD_CMD    0xC3
100 #define BT_RFCOMM_FCON_CMD   0xA3
101 #define BT_RFCOMM_FCON_RSP   0xA1
102 #define BT_RFCOMM_FCOFF_CMD  0x63
103 #define BT_RFCOMM_FCOFF_RSP  0x61
104 #define BT_RFCOMM_MSC_CMD    0xE3
105 #define BT_RFCOMM_MSC_RSP    0xE1
106 #define BT_RFCOMM_NSC_RSP    0x11
107 #define BT_RFCOMM_PN_CMD     0x83
108 #define BT_RFCOMM_PN_RSP     0x81
109 #define BT_RFCOMM_RLS_CMD    0x53
110 #define BT_RFCOMM_RLS_RSP    0x51
111 #define BT_RFCOMM_RPN_CMD    0x93
112 #define BT_RFCOMM_RPN_RSP    0x91
113 #define BT_RFCOMM_TEST_CMD   0x23
114 #define BT_RFCOMM_TEST_RSP   0x21
115 
116 typedef enum {
117     CH_EVT_RCVD_SABM = 1,
118     CH_EVT_RCVD_UA,
119     CH_EVT_RCVD_PN,
120     CH_EVT_RCVD_PN_RSP,
121     CH_EVT_RCVD_DISC,
122     CH_EVT_RCVD_DM,
123     CH_EVT_RCVD_MSC_CMD,
124     CH_EVT_RCVD_MSC_RSP,
125     CH_EVT_RCVD_NSC_RSP,
126     CH_EVT_RCVD_RLS_CMD,
127     CH_EVT_RCVD_RLS_RSP,
128     CH_EVT_RCVD_RPN_CMD,
129     CH_EVT_RCVD_RPN_REQ,
130     CH_EVT_RCVD_RPN_RSP,
131     CH_EVT_RCVD_CREDITS,
132     CH_EVT_MULTIPLEXER_READY,
133     CH_EVT_READY_TO_SEND,
134 } RFCOMM_CHANNEL_EVENT;
135 
136 typedef struct rfcomm_channel_event {
137     RFCOMM_CHANNEL_EVENT type;
138     uint16_t dummy; // force rfcomm_channel_event to be 2-byte aligned -> avoid -Wcast-align warning
139 } rfcomm_channel_event_t;
140 
141 typedef struct rfcomm_channel_event_pn {
142     rfcomm_channel_event_t super;
143     uint16_t max_frame_size;
144     uint8_t  priority;
145     uint8_t  credits_outgoing;
146 } rfcomm_channel_event_pn_t;
147 
148 typedef struct rfcomm_channel_event_rpn {
149     rfcomm_channel_event_t super;
150     rfcomm_rpn_data_t data;
151 } rfcomm_channel_event_rpn_t;
152 
153 typedef struct rfcomm_channel_event_rls {
154     rfcomm_channel_event_t super;
155     uint8_t line_status;
156 } rfcomm_channel_event_rls_t;
157 
158 typedef struct rfcomm_channel_event_msc {
159     rfcomm_channel_event_t super;
160     uint8_t modem_status;
161 } rfcomm_channel_event_msc_t;
162 
163 
164 // global rfcomm data
165 static uint16_t      rfcomm_client_cid_generator;  // used for client channel IDs
166 
167 // linked lists for all
168 static btstack_linked_list_t rfcomm_multiplexers;
169 static btstack_linked_list_t rfcomm_channels;
170 static btstack_linked_list_t rfcomm_services;
171 
172 static gap_security_level_t rfcomm_security_level;
173 
174 #ifdef RFCOMM_USE_ERTM
175 static uint16_t rfcomm_ertm_id;
176 void (*rfcomm_ertm_request_callback)(rfcomm_ertm_request_t * request);
177 void (*rfcomm_ertm_released_callback)(uint16_t ertm_id);
178 #endif
179 
180 #ifdef RFCOMM_USE_OUTGOING_BUFFER
181 static uint8_t outgoing_buffer[1030];
182 #endif
183 
184 static bool rfcomm_channel_can_send(rfcomm_channel_t * channel);
185 static int  rfcomm_channel_ready_for_open(rfcomm_channel_t *channel);
186 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel);
187 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid);
188 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event);
189 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel);
190 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer);
191 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event);
192 
193 // MARK: RFCOMM CLIENT EVENTS
194 
195 static rfcomm_channel_t * rfcomm_channel_for_rfcomm_cid(uint16_t rfcomm_cid){
196     btstack_linked_item_t *it;
197     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
198         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
199         if (channel->rfcomm_cid == rfcomm_cid) {
200             return channel;
201         };
202     }
203     return NULL;
204 }
205 
206 static uint16_t rfcomm_next_client_cid(void){
207     do {
208         if (rfcomm_client_cid_generator == 0xffff) {
209             // don't use 0 as channel id
210             rfcomm_client_cid_generator = 1;
211         } else {
212             rfcomm_client_cid_generator++;
213         }
214     } while (rfcomm_channel_for_rfcomm_cid(rfcomm_client_cid_generator) != NULL);
215     return rfcomm_client_cid_generator;
216 }
217 
218 #ifdef RFCOMM_USE_ERTM
219 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_ertm_id(uint16_t ertm_id) {
220     btstack_linked_item_t *it;
221     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
222         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
223         if (multiplexer->ertm_id == ertm_id) {
224             return multiplexer;
225         };
226     }
227     return NULL;
228 }
229 
230 static uint16_t rfcomm_next_ertm_id(void){
231     do {
232         if (rfcomm_ertm_id == 0xffff) {
233             // don't use 0 as channel id
234             rfcomm_ertm_id = 1;
235         } else {
236             rfcomm_ertm_id++;
237         }
238     } while (rfcomm_multiplexer_for_ertm_id(rfcomm_ertm_id) != NULL);
239     return rfcomm_ertm_id;
240 }
241 
242 #endif
243 
244 // data: event (8), len(8), address(48), channel (8), rfcomm_cid (16)
245 static void rfcomm_emit_connection_request(rfcomm_channel_t *channel) {
246     log_info("RFCOMM_EVENT_INCOMING_CONNECTION addr %s channel #%u cid 0x%02x",
247              bd_addr_to_str(channel->multiplexer->remote_addr), channel->dlci>>1, channel->rfcomm_cid);
248     uint8_t event[13];
249     event[0] = RFCOMM_EVENT_INCOMING_CONNECTION;
250     event[1] = sizeof(event) - 2;
251     reverse_bd_addr(channel->multiplexer->remote_addr, &event[2]);
252     event[8] = channel->dlci >> 1;
253     little_endian_store_16(event, 9, channel->rfcomm_cid);
254     little_endian_store_16(event, 11, channel->multiplexer->con_handle);
255     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
256 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
257 }
258 
259 // API Change: BTstack-0.3.50x uses
260 // data: event(8), len(8), status (8), address (48), server channel(8), rfcomm_cid(16), max frame size(16)
261 // next Cydia release will use SVN version of this
262 // data: event(8), len(8), status (8), address (48), handle (16), server channel(8), rfcomm_cid(16), max frame size(16)
263 static void rfcomm_emit_channel_opened(rfcomm_channel_t *channel, uint8_t status) {
264     log_info("RFCOMM_EVENT_CHANNEL_OPENED status 0x%x addr %s handle 0x%x channel #%u cid 0x%02x mtu %u",
265              status, bd_addr_to_str(channel->multiplexer->remote_addr), channel->multiplexer->con_handle,
266              channel->dlci>>1, channel->rfcomm_cid, channel->max_frame_size);
267     uint8_t event[18];
268     uint8_t pos = 0;
269     event[pos++] = RFCOMM_EVENT_CHANNEL_OPENED;  // 0
270     event[pos++] = sizeof(event) - 2;                   // 1
271     event[pos++] = status;                              // 2
272     reverse_bd_addr(channel->multiplexer->remote_addr, &event[pos]); pos += 6; // 3
273     little_endian_store_16(event,  pos, channel->multiplexer->con_handle);   pos += 2; // 9
274 	event[pos++] = channel->dlci >> 1;                                      // 11
275 	little_endian_store_16(event, pos, channel->rfcomm_cid); pos += 2;                 // 12 - channel ID
276 	little_endian_store_16(event, pos, channel->max_frame_size); pos += 2;   // max frame size
277     event[pos++] = channel->service ? 1 : 0;    // linked to service -> incoming
278     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
279 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, pos);
280 
281     // if channel opened successfully, also send can send now if possible
282     if (status) return;
283     if (rfcomm_channel_can_send(channel)){
284         rfcomm_emit_can_send_now(channel);
285     }
286 }
287 
288 // data: event(8), len(8), rfcomm_cid(16)
289 static void rfcomm_emit_channel_closed(rfcomm_channel_t * channel) {
290     log_info("RFCOMM_EVENT_CHANNEL_CLOSED cid 0x%02x", channel->rfcomm_cid);
291     uint8_t event[4];
292     event[0] = RFCOMM_EVENT_CHANNEL_CLOSED;
293     event[1] = sizeof(event) - 2;
294     little_endian_store_16(event, 2, channel->rfcomm_cid);
295     hci_dump_packet(HCI_EVENT_PACKET, 1, event, sizeof(event));
296 	(channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
297 }
298 
299 static void rfcomm_emit_remote_line_status(rfcomm_channel_t *channel, uint8_t line_status){
300     log_info("RFCOMM_EVENT_REMOTE_LINE_STATUS cid 0x%02x c, line status 0x%x", channel->rfcomm_cid, line_status);
301     uint8_t event[5];
302     event[0] = RFCOMM_EVENT_REMOTE_LINE_STATUS;
303     event[1] = sizeof(event) - 2;
304     little_endian_store_16(event, 2, channel->rfcomm_cid);
305     event[4] = line_status;
306     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
307     (channel->packet_handler)(HCI_EVENT_PACKET, 0, event, sizeof(event));
308 }
309 
310 static void rfcomm_emit_port_configuration(rfcomm_channel_t *channel, bool remote) {
311     // notify client about new settings
312     uint8_t event[2+2+1+sizeof(rfcomm_rpn_data_t)];
313     event[0] = RFCOMM_EVENT_PORT_CONFIGURATION;
314     event[1] = sizeof(event) - 2;
315     little_endian_store_16(event, 2, channel->rfcomm_cid);
316     if (remote){
317         event[4] = 1;
318         (void)memcpy(&event[5], (uint8_t *) &channel->remote_rpn_data, sizeof(rfcomm_rpn_data_t));
319     } else {
320         event[4] = 0;
321         (void)memcpy(&event[5], (uint8_t *) &channel->local_rpn_data, sizeof(rfcomm_rpn_data_t));
322     }
323     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
324     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
325 }
326 
327 static void rfcomm_emit_can_send_now(rfcomm_channel_t *channel) {
328     log_debug("RFCOMM_EVENT_CHANNEL_CAN_SEND_NOW local_cid 0x%x", channel->rfcomm_cid);
329     uint8_t event[4];
330     event[0] = RFCOMM_EVENT_CAN_SEND_NOW;
331     event[1] = sizeof(event) - 2;
332     little_endian_store_16(event, 2, channel->rfcomm_cid);
333     hci_dump_packet( HCI_EVENT_PACKET, 1, event, sizeof(event));
334     (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, event, sizeof(event));
335 }
336 
337 // MARK RFCOMM RPN DATA HELPER
338 static void rfcomm_rpn_data_set_defaults(rfcomm_rpn_data_t * rpn_data){
339         rpn_data->baud_rate = RPN_BAUD_9600;  /* 9600 bps */
340         rpn_data->flags = 0x03;               /* 8-n-1 */
341         rpn_data->flow_control = 0;           /* no flow control */
342         rpn_data->xon  = 0xd1;                /* XON */
343         rpn_data->xoff = 0xd3;                /* XOFF */
344         rpn_data->parameter_mask_0 = 0x7f;    /* parameter mask, all values set */
345         rpn_data->parameter_mask_1 = 0x3f;    /* parameter mask, all values set */
346 }
347 
348 static void rfcomm_rpn_data_update(rfcomm_rpn_data_t * dest, rfcomm_rpn_data_t * src){
349     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_BAUD){
350         dest->baud_rate = src->baud_rate;
351     }
352     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_DATA_BITS){
353         dest->flags = (dest->flags & 0xfc) | (src->flags & 0x03);
354     }
355     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_STOP_BITS){
356         dest->flags = (dest->flags & 0xfb) | (src->flags & 0x04);
357     }
358     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY){
359         dest->flags = (dest->flags & 0xf7) | (src->flags & 0x08);
360     }
361     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_PARITY_TYPE){
362         dest->flags = (dest->flags & 0xcf) | (src->flags & 0x30);
363     }
364     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XON_CHAR){
365         dest->xon = src->xon;
366     }
367     if (src->parameter_mask_0 & RPN_PARAM_MASK_0_XOFF_CHAR){
368         dest->xoff = src->xoff;
369     }
370     uint8_t mask = src->parameter_mask_1 & 0x3f;
371     dest->flow_control = (dest->flow_control & ~mask) | (src->flow_control & mask);
372    // always copy parameter mask, too. informative for client, needed for response
373     dest->parameter_mask_0 = src->parameter_mask_0;
374     dest->parameter_mask_1 = src->parameter_mask_1;
375 }
376 // MARK: RFCOMM MULTIPLEXER HELPER
377 
378 static uint16_t rfcomm_max_frame_size_for_l2cap_mtu(uint16_t l2cap_mtu){
379     // Assume RFCOMM header without credits and 2 byte (14 bit) length field
380     uint16_t max_frame_size = l2cap_mtu - 5;
381     log_info("rfcomm_max_frame_size_for_l2cap_mtu:  %u -> %u", l2cap_mtu, max_frame_size);
382     return max_frame_size;
383 }
384 
385 static void rfcomm_multiplexer_initialize(rfcomm_multiplexer_t *multiplexer){
386     multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
387     multiplexer->fcon = 1;
388     multiplexer->send_dm_for_dlci = 0;
389     multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(l2cap_max_mtu());
390     multiplexer->test_data_len = 0;
391     multiplexer->nsc_command = 0;
392 }
393 
394 static rfcomm_multiplexer_t * rfcomm_multiplexer_create_for_addr(bd_addr_t addr){
395 
396     // alloc structure
397     rfcomm_multiplexer_t * multiplexer = btstack_memory_rfcomm_multiplexer_get();
398     if (!multiplexer) return NULL;
399 
400     // fill in
401     rfcomm_multiplexer_initialize(multiplexer);
402     bd_addr_copy(multiplexer->remote_addr, addr);
403 
404     // add to services list
405     btstack_linked_list_add(&rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
406 
407     return multiplexer;
408 }
409 
410 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_addr(bd_addr_t addr){
411     btstack_linked_item_t *it;
412     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
413         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
414         // ignore multiplexer in shutdown
415         if (multiplexer->state == RFCOMM_MULTIPLEXER_SHUTTING_DOWN) continue;
416         if (bd_addr_cmp(addr, multiplexer->remote_addr) == 0) {
417             return multiplexer;
418         };
419     }
420     return NULL;
421 }
422 
423 static rfcomm_multiplexer_t * rfcomm_multiplexer_for_l2cap_cid(uint16_t l2cap_cid) {
424     btstack_linked_item_t *it;
425     for (it = (btstack_linked_item_t *) rfcomm_multiplexers; it ; it = it->next){
426         rfcomm_multiplexer_t * multiplexer = ((rfcomm_multiplexer_t *) it);
427         if (multiplexer->l2cap_cid == l2cap_cid) {
428             return multiplexer;
429         };
430     }
431     return NULL;
432 }
433 
434 static int rfcomm_multiplexer_has_channels(rfcomm_multiplexer_t * multiplexer){
435     btstack_linked_item_t *it;
436     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
437         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
438         if (channel->multiplexer == multiplexer) {
439             return 1;
440         }
441     }
442     return 0;
443 }
444 
445 // MARK: RFCOMM CHANNEL HELPER
446 
447 static void rfcomm_dump_channels(void){
448 #ifdef ENABLE_LOG_INFO
449     btstack_linked_item_t * it;
450     int channels = 0;
451     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
452         rfcomm_channel_t * channel = (rfcomm_channel_t *) it;
453         log_info("Channel #%u: addr %p, state %u", channels, channel, channel->state);
454         channels++;
455     }
456 #endif
457 }
458 
459 static void rfcomm_channel_initialize(rfcomm_channel_t *channel, rfcomm_multiplexer_t *multiplexer,
460                                rfcomm_service_t *service, uint8_t server_channel){
461 
462     // set defaults for port configuration (even for services)
463     rfcomm_rpn_data_set_defaults(&channel->local_rpn_data);
464     rfcomm_rpn_data_set_defaults(&channel->remote_rpn_data);
465 
466     channel->state            = RFCOMM_CHANNEL_CLOSED;
467     channel->state_var        = RFCOMM_CHANNEL_STATE_VAR_NONE;
468 
469     channel->multiplexer      = multiplexer;
470     channel->rfcomm_cid       = rfcomm_next_client_cid();
471     channel->max_frame_size   = multiplexer->max_frame_size;
472 
473     channel->credits_incoming = 0;
474     channel->credits_outgoing = 0;
475 
476     // incoming flow control not active
477     channel->new_credits_incoming  = RFCOMM_CREDITS;
478     channel->incoming_flow_control = 0;
479 
480     // nothing to send
481     channel->local_line_status  = RFCOMM_RLS_STATUS_INVALID;
482     channel->remote_line_status = RFCOMM_RLS_STATUS_INVALID;
483 
484     // modem status - ea=1,fc=0,rtc=1,rtr=1,ic=0,dv=1
485     channel->local_modem_status  = 0x8d;
486     channel->remote_modem_status = 0x8d;
487 
488     channel->service = service;
489 	if (service) {
490 		// incoming connection
491     	channel->dlci = (server_channel << 1) |  multiplexer->outgoing;
492         if (channel->max_frame_size > service->max_frame_size) {
493             channel->max_frame_size = service->max_frame_size;
494         }
495         channel->incoming_flow_control = service->incoming_flow_control;
496         channel->new_credits_incoming  = service->incoming_initial_credits;
497         channel->packet_handler        = service->packet_handler;
498 	} else {
499 		// outgoing connection
500 		channel->dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
501 	}
502 }
503 
504 // service == NULL -> outgoing channel
505 static rfcomm_channel_t * rfcomm_channel_create(rfcomm_multiplexer_t * multiplexer,
506                                                 rfcomm_service_t * service, uint8_t server_channel){
507 
508     log_info("rfcomm_channel_create for service %p, channel %u --- list of channels:", service, server_channel);
509     rfcomm_dump_channels();
510 
511     // alloc structure
512     rfcomm_channel_t * channel = btstack_memory_rfcomm_channel_get();
513     if (!channel) return NULL;
514 
515     // fill in
516     rfcomm_channel_initialize(channel, multiplexer, service, server_channel);
517 
518     // add to services list
519     btstack_linked_list_add(&rfcomm_channels, (btstack_linked_item_t *) channel);
520 
521     return channel;
522 }
523 
524 static void rfcomm_notify_channel_can_send(void){
525     btstack_linked_list_iterator_t it;
526     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
527     while (btstack_linked_list_iterator_has_next(&it)){
528         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
529         if (!channel->waiting_for_can_send_now) continue; // didn't try to send yet
530         if (!rfcomm_channel_can_send(channel)) continue;  // or cannot yet either
531 
532         channel->waiting_for_can_send_now = 0;
533         rfcomm_emit_can_send_now(channel);
534     }
535 }
536 
537 static rfcomm_channel_t * rfcomm_channel_for_multiplexer_and_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci){
538     btstack_linked_item_t *it;
539     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
540         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
541         if ((channel->dlci == dlci) && (channel->multiplexer == multiplexer)) {
542             return channel;
543         };
544     }
545     return NULL;
546 }
547 
548 static rfcomm_service_t * rfcomm_service_for_channel(uint8_t server_channel){
549     btstack_linked_item_t *it;
550     for (it = (btstack_linked_item_t *) rfcomm_services; it ; it = it->next){
551         rfcomm_service_t * service = ((rfcomm_service_t *) it);
552         if ( service->server_channel == server_channel){
553             return service;
554         };
555     }
556     return NULL;
557 }
558 
559 // MARK: RFCOMM SEND
560 
561 /**
562  * @param credits - only used for RFCOMM flow control in UIH wiht P/F = 1
563  */
564 static int rfcomm_send_packet_for_multiplexer(rfcomm_multiplexer_t *multiplexer, uint8_t address, uint8_t control, uint8_t credits, uint8_t *data, uint16_t len){
565 
566     if (!l2cap_can_send_packet_now(multiplexer->l2cap_cid)) return BTSTACK_ACL_BUFFERS_FULL;
567 
568 #ifdef RFCOMM_USE_OUTGOING_BUFFER
569     uint8_t * rfcomm_out_buffer = outgoing_buffer;
570 #else
571     l2cap_reserve_packet_buffer();
572     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
573 #endif
574 
575 	uint16_t pos = 0;
576 	uint8_t crc_fields = 3;
577 
578 	rfcomm_out_buffer[pos++] = address;
579 	rfcomm_out_buffer[pos++] = control;
580 
581 	// length field can be 1 or 2 octets
582 	if (len < 128){
583 		rfcomm_out_buffer[pos++] = (len << 1)| 1;     // bits 0-6
584 	} else {
585 		rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
586 		rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
587 		crc_fields++;
588 	}
589 
590 	// add credits for UIH frames when PF bit is set
591 	if (control == BT_RFCOMM_UIH_PF){
592 		rfcomm_out_buffer[pos++] = credits;
593 	}
594 
595 	// copy actual data
596 	if (len) {
597 		(void)memcpy(&rfcomm_out_buffer[pos], data, len);
598 		pos += len;
599 	}
600 
601 	// UIH frames only calc FCS over address + control (5.1.1)
602 	if ((control & 0xef) == BT_RFCOMM_UIH){
603 		crc_fields = 2;
604 	}
605 	rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, crc_fields); // calc fcs
606 
607 #ifdef RFCOMM_USE_OUTGOING_BUFFER
608     int err = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
609 #else
610     int err = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
611 #endif
612 
613     return err;
614 }
615 
616 // simplified version of rfcomm_send_packet_for_multiplexer for prepared rfcomm packet (UIH, 2 byte len, no credits)
617 static uint8_t rfcomm_send_uih_prepared(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t len){
618 
619     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);
620     uint8_t control = BT_RFCOMM_UIH;
621 
622 #ifdef RFCOMM_USE_OUTGOING_BUFFER
623     uint8_t * rfcomm_out_buffer = outgoing_buffer;
624 #else
625     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
626 #endif
627 
628     uint16_t pos = 0;
629     rfcomm_out_buffer[pos++] = address;
630     rfcomm_out_buffer[pos++] = control;
631     rfcomm_out_buffer[pos++] = (len & 0x7f) << 1; // bits 0-6
632     rfcomm_out_buffer[pos++] = len >> 7;          // bits 7-14
633 
634     // actual data is already in place
635     pos += len;
636 
637     // UIH frames only calc FCS over address + control (5.1.1)
638     rfcomm_out_buffer[pos++] =  btstack_crc8_calc(rfcomm_out_buffer, 2); // calc fcs
639 
640 #ifdef RFCOMM_USE_OUTGOING_BUFFER
641     uint8_t status = l2cap_send(multiplexer->l2cap_cid, rfcomm_out_buffer, pos);
642 #else
643     uint8_t status = l2cap_send_prepared(multiplexer->l2cap_cid, pos);
644 #endif
645 
646     return status;
647 }
648 
649 // C/R Flag in Address
650 // - terms: initiator = station that creates multiplexer with SABM
651 // - terms: responder = station that responds to multiplexer setup with UA
652 // "For SABM, UA, DM and DISC frames C/R bit is set according to Table 1 in GSM 07.10, section 5.2.1.2"
653 //    - command initiator = 1 /response responder = 1
654 //    - command responder = 0 /response initiator = 0
655 // "For UIH frames, the C/R bit is always set according to section 5.4.3.1 in GSM 07.10.
656 //  This applies independently of what is contained wthin the UIH frames, either data or control messages."
657 //    - c/r = 1 for frames by initiating station, 0 = for frames by responding station
658 
659 // C/R Flag in Message
660 // "In the message level, the C/R bit in the command type field is set as stated in section 5.4.6.2 in GSM 07.10."
661 //   - If the C/R bit is set to 1 the message is a command
662 //   - if it is set to 0 the message is a response.
663 
664 // temp/old messge construction
665 
666 // new object oriented version
667 static int rfcomm_send_sabm(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
668 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);   // command
669     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_SABM, 0, NULL, 0);
670 }
671 
672 static int rfcomm_send_disc(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
673 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) | (dlci << 2);  // command
674     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DISC, 0, NULL, 0);
675 }
676 
677 static int rfcomm_send_ua(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
678 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
679     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UA, 0, NULL, 0);
680 }
681 
682 static int rfcomm_send_dm_pf(rfcomm_multiplexer_t *multiplexer, uint8_t dlci){
683 	uint8_t address = (1 << 0) | ((multiplexer->outgoing ^ 1) << 1) | (dlci << 2); // response
684     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_DM_PF, 0, NULL, 0);
685 }
686 
687 static int rfcomm_send_uih_fc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t fcon) {
688     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
689     uint8_t payload[2];
690     uint8_t pos = 0;
691     payload[pos++] = fcon ? BT_RFCOMM_FCON_RSP : BT_RFCOMM_FCOFF_RSP;
692     payload[pos++] = (0 << 1) | 1;  // len
693     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
694 }
695 
696 // static int rfcomm_send_uih_test_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
697 //     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
698 //     uint8_t payload[2+len];
699 //     uint8_t pos = 0;
700 //     payload[pos++] = BT_RFCOMM_TEST_CMD;
701 //     payload[pos++] = (len + 1) << 1 | 1;  // len
702 //     memcpy(&payload[pos], data, len);
703 //     pos += len;
704 //     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
705 // }
706 
707 static int rfcomm_send_uih_test_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t * data, uint16_t len) {
708     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
709     uint8_t payload[2+RFCOMM_TEST_DATA_MAX_LEN];
710     uint8_t pos = 0;
711     payload[pos++] = BT_RFCOMM_TEST_RSP;
712     if (len > RFCOMM_TEST_DATA_MAX_LEN) {
713         len = RFCOMM_TEST_DATA_MAX_LEN;
714     }
715     payload[pos++] = (len << 1) | 1;  // len
716     (void)memcpy(&payload[pos], data, len);
717     pos += len;
718     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
719 }
720 
721 static int rfcomm_send_uih_msc_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
722 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
723 	uint8_t payload[4];
724 	uint8_t pos = 0;
725 	payload[pos++] = BT_RFCOMM_MSC_CMD;
726 	payload[pos++] = (2 << 1) | 1;  // len
727 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
728 	payload[pos++] = signals;
729 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
730 }
731 
732 static int rfcomm_send_uih_msc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t signals) {
733 	uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
734 	uint8_t payload[4];
735 	uint8_t pos = 0;
736 	payload[pos++] = BT_RFCOMM_MSC_RSP;
737 	payload[pos++] = (2 << 1) | 1;  // len
738 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
739 	payload[pos++] = signals;
740 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
741 }
742 
743 static int rfcomm_send_uih_nsc_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t command) {
744     uint8_t address = (1 << 0) | (multiplexer->outgoing<< 1);
745     uint8_t payload[3];
746     uint8_t pos = 0;
747     payload[pos++] = BT_RFCOMM_NSC_RSP;
748     payload[pos++] = (1 << 1) | 1;  // len
749     payload[pos++] = command;
750     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
751 }
752 
753 static int rfcomm_send_uih_pn_command(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint16_t max_frame_size){
754 	uint8_t payload[10];
755 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
756 	uint8_t pos = 0;
757 	payload[pos++] = BT_RFCOMM_PN_CMD;
758 	payload[pos++] = (8 << 1) | 1;  // len
759 	payload[pos++] = dlci;
760 	payload[pos++] = 0xf0; // pre-defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
761 	payload[pos++] = 0; // priority
762 	payload[pos++] = 0; // max 60 seconds ack
763 	payload[pos++] = max_frame_size & 0xff; // max framesize low
764 	payload[pos++] = max_frame_size >> 8;   // max framesize high
765 	payload[pos++] = 0x00; // number of retransmissions
766 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
767 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
768 }
769 
770 // "The response may not change the DLCI, the priority, the convergence layer, or the timer value." rfcomm_tutorial.pdf
771 static int rfcomm_send_uih_pn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,
772                                        uint8_t priority, uint16_t max_frame_size){
773 	uint8_t payload[10];
774 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
775 	uint8_t pos = 0;
776 	payload[pos++] = BT_RFCOMM_PN_RSP;
777 	payload[pos++] = (8 << 1) | 1;  // len
778 	payload[pos++] = dlci;
779 	payload[pos++] = 0xe0; // pre defined for Bluetooth, see 5.5.3 of TS 07.10 Adaption for RFCOMM
780 	payload[pos++] = priority; // priority
781 	payload[pos++] = 0; // max 60 seconds ack
782 	payload[pos++] = max_frame_size & 0xff; // max framesize low
783 	payload[pos++] = max_frame_size >> 8;   // max framesize high
784 	payload[pos++] = 0x00; // number of retransmissions
785 	payload[pos++] = 0x00; // (unused error recovery window) initial number of credits
786 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
787 }
788 
789 static int rfcomm_send_uih_rls_cmd(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
790     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
791     uint8_t payload[4];
792     uint8_t pos = 0;
793     payload[pos++] = BT_RFCOMM_RLS_CMD;
794     payload[pos++] = (2 << 1) | 1;  // len
795     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
796     payload[pos++] = line_status;
797     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
798 }
799 
800 static int rfcomm_send_uih_rls_rsp(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, uint8_t line_status) {
801     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
802     uint8_t payload[4];
803     uint8_t pos = 0;
804     payload[pos++] = BT_RFCOMM_RLS_RSP;
805     payload[pos++] = (2 << 1) | 1;  // len
806     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
807     payload[pos++] = line_status;
808     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
809 }
810 
811 static int rfcomm_send_uih_rpn_config(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
812     uint8_t payload[10];
813     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
814     uint8_t pos = 0;
815     payload[pos++] = BT_RFCOMM_RPN_CMD;
816     payload[pos++] = (8 << 1) | 1;  // len
817     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
818     payload[pos++] = rpn_data->baud_rate;
819     payload[pos++] = rpn_data->flags;
820     payload[pos++] = rpn_data->flow_control;
821     payload[pos++] = rpn_data->xon;
822     payload[pos++] = rpn_data->xoff;
823     payload[pos++] = rpn_data->parameter_mask_0;
824     payload[pos++] = rpn_data->parameter_mask_1;
825     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
826 }
827 
828 static int rfcomm_send_uih_rpn_query(rfcomm_multiplexer_t *multiplexer, uint8_t dlci) {
829     uint8_t payload[3];
830     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
831     uint8_t pos = 0;
832     payload[pos++] = BT_RFCOMM_RPN_CMD;
833     payload[pos++] = (1 << 1) | 1;  // len
834     payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
835     return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
836 }
837 
838 static int rfcomm_send_uih_rpn_response(rfcomm_multiplexer_t *multiplexer, uint8_t dlci, rfcomm_rpn_data_t *rpn_data) {
839 	uint8_t payload[10];
840 	uint8_t address = (1 << 0) | (multiplexer->outgoing << 1);
841 	uint8_t pos = 0;
842 	payload[pos++] = BT_RFCOMM_RPN_RSP;
843 	payload[pos++] = (8 << 1) | 1;  // len
844 	payload[pos++] = (1 << 0) | (1 << 1) | (dlci << 2); // CMD => C/R = 1
845 	payload[pos++] = rpn_data->baud_rate;
846 	payload[pos++] = rpn_data->flags;
847 	payload[pos++] = rpn_data->flow_control;
848 	payload[pos++] = rpn_data->xon;
849 	payload[pos++] = rpn_data->xoff;
850 	payload[pos++] = rpn_data->parameter_mask_0;
851 	payload[pos++] = rpn_data->parameter_mask_1;
852 	return rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH, 0, (uint8_t *) payload, pos);
853 }
854 
855 static void rfcomm_send_uih_credits(rfcomm_multiplexer_t *multiplexer, uint8_t dlci,  uint8_t credits){
856     uint8_t address = (1 << 0) | (multiplexer->outgoing << 1) |  (dlci << 2);
857     rfcomm_send_packet_for_multiplexer(multiplexer, address, BT_RFCOMM_UIH_PF, credits, NULL, 0);
858 }
859 
860 // depending on channel state emit channel opened with status or channel closed
861 static void rfcomm_channel_emit_final_event(rfcomm_channel_t * channel, uint8_t status){
862     // emit appropriate events
863     switch(channel->state){
864         case RFCOMM_CHANNEL_OPEN:
865         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
866             rfcomm_emit_channel_closed(channel);
867             break;
868         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
869             // remote didn't wait until we send the UA disc
870             // close event already emitted
871             break;
872         default:
873             rfcomm_emit_channel_opened(channel, status);
874             break;
875     }
876 }
877 
878 // MARK: RFCOMM MULTIPLEXER
879 static void rfcomm_multiplexer_stop_timer(rfcomm_multiplexer_t * multiplexer){
880     if (multiplexer->timer_active) {
881         btstack_run_loop_remove_timer(&multiplexer->timer);
882         multiplexer->timer_active = 0;
883     }
884 }
885 static void rfcomm_multiplexer_free(rfcomm_multiplexer_t * multiplexer){
886     btstack_linked_list_remove( &rfcomm_multiplexers, (btstack_linked_item_t *) multiplexer);
887     btstack_memory_rfcomm_multiplexer_free(multiplexer);
888 }
889 
890 static void rfcomm_multiplexer_finalize(rfcomm_multiplexer_t * multiplexer){
891     // remove (potential) timer
892     rfcomm_multiplexer_stop_timer(multiplexer);
893 
894     // close and remove all channels
895     btstack_linked_item_t *it = (btstack_linked_item_t *) &rfcomm_channels;
896     while (it->next){
897         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
898         if (channel->multiplexer == multiplexer) {
899             // emit open with status or closed
900             rfcomm_channel_emit_final_event(channel, RFCOMM_MULTIPLEXER_STOPPED);
901             // remove from list
902             it->next = it->next->next;
903             // free channel struct
904             btstack_memory_rfcomm_channel_free(channel);
905         } else {
906             it = it->next;
907         }
908     }
909 
910     // remove mutliplexer
911     rfcomm_multiplexer_free(multiplexer);
912 }
913 
914 static void rfcomm_multiplexer_timer_handler(btstack_timer_source_t *timer){
915     rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t*) btstack_run_loop_get_timer_context(timer);
916     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
917 
918     log_info("handler timeout: shutting down multiplexer! (no channels)");
919     uint16_t l2cap_cid = multiplexer->l2cap_cid;
920     rfcomm_multiplexer_finalize(multiplexer);
921     l2cap_disconnect(l2cap_cid);
922 }
923 
924 static void rfcomm_multiplexer_prepare_idle_timer(rfcomm_multiplexer_t * multiplexer){
925     if (multiplexer->timer_active) {
926         btstack_run_loop_remove_timer(&multiplexer->timer);
927         multiplexer->timer_active = 0;
928     }
929     if (rfcomm_multiplexer_has_channels(multiplexer)) return;
930 
931     // start idle timer for multiplexer timeout check as there are no rfcomm channels yet
932     btstack_run_loop_set_timer(&multiplexer->timer, RFCOMM_MULIPLEXER_TIMEOUT_MS);
933     btstack_run_loop_set_timer_handler(&multiplexer->timer, rfcomm_multiplexer_timer_handler);
934     btstack_run_loop_set_timer_context(&multiplexer->timer, multiplexer);
935     btstack_run_loop_add_timer(&multiplexer->timer);
936     multiplexer->timer_active = 1;
937 }
938 
939 static void rfcomm_multiplexer_opened(rfcomm_multiplexer_t *multiplexer){
940     log_info("Multiplexer up and running");
941     multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
942 
943     const rfcomm_channel_event_t event = { CH_EVT_MULTIPLEXER_READY, 0};
944 
945     // transition of channels that wait for multiplexer
946     btstack_linked_item_t *it;
947     for (it = (btstack_linked_item_t *) rfcomm_channels; it ; it = it->next){
948         rfcomm_channel_t * channel = ((rfcomm_channel_t *) it);
949         if (channel->multiplexer != multiplexer) continue;
950         int rfcomm_channel_valid = 1;
951         rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
952         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
953             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
954         }
955     }
956     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
957 
958     // request can send now for multiplexer if ready
959     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
960         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
961     }
962 }
963 
964 static void rfcomm_handle_can_send_now(uint16_t l2cap_cid){
965 
966     log_debug("can_send_now enter: %u", l2cap_cid);
967 
968     btstack_linked_list_iterator_t it;
969     int token_consumed = 0;
970 
971     // forward token to multiplexer
972     btstack_linked_list_iterator_init(&it, &rfcomm_multiplexers);
973     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
974         rfcomm_multiplexer_t * multiplexer = (rfcomm_multiplexer_t *) btstack_linked_list_iterator_next(&it);
975         if (multiplexer->l2cap_cid != l2cap_cid) continue;
976         if (rfcomm_multiplexer_ready_to_send(multiplexer)){
977             log_debug("can_send_now enter: multiplexer token");
978             token_consumed = 1;
979             rfcomm_multiplexer_state_machine(multiplexer, MULT_EV_READY_TO_SEND);
980         }
981     }
982 
983     // forward token to channel state machine
984     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
985     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
986         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
987         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
988         // channel state machine
989         if (rfcomm_channel_ready_to_send(channel)){
990             log_debug("can_send_now enter: channel token");
991             token_consumed = 1;
992             const rfcomm_channel_event_t event = { CH_EVT_READY_TO_SEND, 0 };
993             int rfcomm_channel_valid = 1;
994             rfcomm_channel_state_machine_with_channel(channel, &event, &rfcomm_channel_valid);
995         }
996     }
997 
998     // forward token to client
999     btstack_linked_list_iterator_init(&it, &rfcomm_channels);
1000     while (!token_consumed && btstack_linked_list_iterator_has_next(&it)){
1001         rfcomm_channel_t * channel = (rfcomm_channel_t *) btstack_linked_list_iterator_next(&it);
1002         if (channel->multiplexer->l2cap_cid != l2cap_cid) continue;
1003         // client waiting for can send now
1004         if (!channel->waiting_for_can_send_now)    continue;
1005         if ((channel->multiplexer->fcon & 1) == 0) continue;
1006         if (!channel->credits_outgoing){
1007             log_debug("can_send_now waiting to send but no credits (ignore)");
1008             continue;
1009         }
1010 
1011         log_debug("can_send_now enter: client token");
1012         token_consumed = 1;
1013         channel->waiting_for_can_send_now = 0;
1014         rfcomm_emit_can_send_now(channel);
1015     }
1016 
1017     // if token was consumed, request another one
1018     if (token_consumed) {
1019         l2cap_request_can_send_now_event(l2cap_cid);
1020     }
1021 
1022     log_debug("can_send_now exit");
1023 }
1024 
1025 static void rfcomm_multiplexer_set_state_and_request_can_send_now_event(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_STATE state){
1026     multiplexer->state = state;
1027     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1028 }
1029 
1030 /**
1031  * @return handled packet
1032  */
1033 static int rfcomm_hci_event_handler(uint8_t *packet, uint16_t size){
1034 
1035     UNUSED(size);   // ok: handling own l2cap events
1036 
1037     bd_addr_t event_addr;
1038     uint16_t l2cap_cid;
1039     hci_con_handle_t con_handle;
1040     rfcomm_multiplexer_t *multiplexer = NULL;
1041     uint8_t status;
1042 
1043     switch (hci_event_packet_get_type(packet)) {
1044 
1045         // accept incoming rfcomm connection if no multiplexer exists yet
1046         case L2CAP_EVENT_INCOMING_CONNECTION:
1047             l2cap_event_incoming_connection_get_address(packet, event_addr);
1048             con_handle = l2cap_event_incoming_connection_get_handle(packet);
1049             l2cap_cid  = l2cap_event_incoming_connection_get_local_cid(packet);
1050 
1051             btstack_assert(l2cap_event_incoming_connection_get_psm(packet) == BLUETOOTH_PROTOCOL_RFCOMM);
1052 
1053             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1054 
1055             if (multiplexer) {
1056                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - multiplexer already exists", l2cap_cid);
1057                 l2cap_decline_connection(l2cap_cid);
1058                 return 1;
1059             }
1060 
1061             // create and inititialize new multiplexer instance (incoming)
1062             multiplexer = rfcomm_multiplexer_create_for_addr(event_addr);
1063             if (!multiplexer){
1064                 log_info("RFCOMM incoming (l2cap_cid 0x%02x) => decline - no memory left", l2cap_cid);
1065                 l2cap_decline_connection(l2cap_cid);
1066                 return 1;
1067             }
1068 
1069             multiplexer->con_handle = con_handle;
1070             multiplexer->l2cap_cid = l2cap_cid;
1071             //
1072             multiplexer->state = RFCOMM_MULTIPLEXER_W4_SABM_0;
1073             log_info("RFCOMM incoming (l2cap_cid 0x%02x) => accept", l2cap_cid);
1074 
1075 #ifdef RFCOMM_USE_ERTM
1076             // request
1077             rfcomm_ertm_request_t request;
1078             memset(&request, 0, sizeof(rfcomm_ertm_request_t));
1079             (void)memcpy(request.addr, event_addr, 6);
1080             request.ertm_id = rfcomm_next_ertm_id();
1081             if (rfcomm_ertm_request_callback){
1082                 (*rfcomm_ertm_request_callback)(&request);
1083             }
1084             if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
1085                 multiplexer->ertm_id = request.ertm_id;
1086                 l2cap_ertm_accept_connection(l2cap_cid, request.ertm_config, request.ertm_buffer, request.ertm_buffer_size);
1087                 return 1;
1088             }
1089 #endif
1090 
1091             l2cap_accept_connection(l2cap_cid);
1092             return 1;
1093 
1094         // l2cap connection opened -> store l2cap_cid, remote_addr
1095         case L2CAP_EVENT_CHANNEL_OPENED:
1096 
1097             btstack_assert(l2cap_event_channel_opened_get_psm(packet) == BLUETOOTH_PROTOCOL_RFCOMM);
1098 
1099             status = l2cap_event_channel_opened_get_status(packet);
1100             log_info("channel opened, status %u", status);
1101 
1102             // get multiplexer for remote addr
1103             con_handle = l2cap_event_channel_opened_get_handle(packet);
1104             l2cap_cid = l2cap_event_channel_opened_get_local_cid(packet);
1105             l2cap_event_channel_opened_get_address(packet, event_addr);
1106             multiplexer = rfcomm_multiplexer_for_addr(event_addr);
1107             if (!multiplexer) {
1108                 log_error("channel opened but no multiplexer prepared");
1109                 return 1;
1110             }
1111 
1112             // set con handle for outgoing (already set for incoming)
1113             multiplexer->con_handle = con_handle;
1114 
1115             // on l2cap open error discard everything
1116             if (status){
1117 
1118                 // remove (potential) timer
1119                 rfcomm_multiplexer_stop_timer(multiplexer);
1120 
1121                 // mark multiplexer as shutting down
1122                 multiplexer->state = RFCOMM_MULTIPLEXER_SHUTTING_DOWN;
1123 
1124                 // emit rfcomm_channel_opened with status and free channel
1125                 // note: repeatedly go over list until full iteration causes no further change
1126                 int done;
1127                 do {
1128                     done = 1;
1129                     btstack_linked_item_t * it = (btstack_linked_item_t *) &rfcomm_channels;
1130                     while (it->next) {
1131                         rfcomm_channel_t * channel = (rfcomm_channel_t *) it->next;
1132                         if (channel->multiplexer == multiplexer){
1133                             done = 0;
1134                             rfcomm_emit_channel_opened(channel, status);
1135                             btstack_linked_list_remove(&rfcomm_channels, (btstack_linked_item_t *) channel);
1136                             btstack_memory_rfcomm_channel_free(channel);
1137                             break;
1138                         } else {
1139                             it = it->next;
1140                         }
1141                     }
1142                 } while (!done);
1143 
1144                 // free multiplexer
1145                 rfcomm_multiplexer_free(multiplexer);
1146                 return 1;
1147             }
1148 
1149             // following could be: rfcomm_multiplexer_state_machine(..., EVENT_L2CAP_OPENED)
1150 
1151             // set max frame size based on l2cap MTU
1152             multiplexer->max_frame_size = rfcomm_max_frame_size_for_l2cap_mtu(little_endian_read_16(packet, 17));
1153 
1154             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_CONNECT) {
1155                 log_info("channel opened: outgoing connection");
1156                 multiplexer->l2cap_cid = l2cap_cid;
1157                 // send SABM #0
1158                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_SABM_0);
1159             }
1160             return 1;
1161 
1162             // l2cap disconnect -> state = RFCOMM_MULTIPLEXER_CLOSED;
1163 
1164         // Notify channel packet handler if they can send now
1165         case L2CAP_EVENT_CAN_SEND_NOW:
1166             l2cap_cid = l2cap_event_can_send_now_get_local_cid(packet);
1167             rfcomm_handle_can_send_now(l2cap_cid);
1168             return 1;
1169 
1170         case L2CAP_EVENT_CHANNEL_CLOSED:
1171             l2cap_cid = l2cap_event_channel_closed_get_local_cid(packet);
1172             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1173             log_info("channel closed cid 0x%0x, mult %p", l2cap_cid, multiplexer);
1174             if (!multiplexer) break;
1175             log_info("channel closed state %u", multiplexer->state);
1176             // no need to call l2cap_disconnect here, as it's already closed
1177             rfcomm_multiplexer_finalize(multiplexer);
1178             return 1;
1179 
1180 #ifdef RFCOMM_USE_ERTM
1181         case L2CAP_EVENT_ERTM_BUFFER_RELEASED:
1182             l2cap_cid = l2cap_event_ertm_buffer_released_get_local_cid(packet);
1183             multiplexer = rfcomm_multiplexer_for_l2cap_cid(l2cap_cid);
1184             if (multiplexer) {
1185                 log_info("buffer for ertm id %u released", multiplexer->ertm_id);
1186                 if (rfcomm_ertm_released_callback){
1187                     (*rfcomm_ertm_released_callback)(multiplexer->ertm_id);
1188                 }
1189             }
1190             break;
1191 #endif
1192 
1193         default:
1194             break;
1195     }
1196     return 0;
1197 }
1198 
1199 static int rfcomm_multiplexer_l2cap_packet_handler(uint16_t channel, uint8_t *packet, uint16_t size){
1200     // get or create a multiplexer for a certain device
1201     rfcomm_multiplexer_t *multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1202     if (!multiplexer) return 0;
1203 
1204     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1205 
1206     if (size < 3) return 0;
1207 
1208 	// but only care for multiplexer control channel
1209     uint8_t frame_dlci = packet[0] >> 2;
1210     if (frame_dlci) return 0;
1211     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1212     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1213     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1214     switch (packet[1]){
1215 
1216         case BT_RFCOMM_SABM:
1217             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_SABM_0){
1218                 log_info("Received SABM #0");
1219                 multiplexer->outgoing = 0;
1220                 rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0);
1221                 return 1;
1222             }
1223             break;
1224 
1225         case BT_RFCOMM_UA:
1226             if (multiplexer->state == RFCOMM_MULTIPLEXER_W4_UA_0) {
1227                 // UA #0 -> send UA #0, state = RFCOMM_MULTIPLEXER_OPEN
1228                 log_info("Received UA #0 ");
1229                 rfcomm_multiplexer_opened(multiplexer);
1230                 return 1;
1231             }
1232             break;
1233 
1234         case BT_RFCOMM_DISC:
1235             // DISC #0 -> send UA #0, close multiplexer
1236             log_info("Received DISC #0, (ougoing = %u)", multiplexer->outgoing);
1237             rfcomm_multiplexer_set_state_and_request_can_send_now_event(multiplexer, RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC);
1238             return 1;
1239 
1240         case BT_RFCOMM_DM:
1241             // DM #0 - we shouldn't get this, just give up
1242             log_info("Received DM #0");
1243             log_info("-> Closing down multiplexer");
1244             rfcomm_multiplexer_finalize(multiplexer);
1245             l2cap_disconnect(l2cap_cid);
1246             return 1;
1247 
1248         case BT_RFCOMM_UIH:
1249             if (payload_offset >= size) return 0;
1250 
1251             if (packet[payload_offset] == BT_RFCOMM_CLD_CMD){
1252                 // Multiplexer close down (CLD) -> close mutliplexer
1253                 log_info("Received Multiplexer close down command");
1254                 log_info("-> Closing down multiplexer");
1255                 rfcomm_multiplexer_finalize(multiplexer);
1256                 l2cap_disconnect(l2cap_cid);
1257                 return 1;
1258             }
1259             switch (packet[payload_offset]){
1260                 case BT_RFCOMM_CLD_CMD:
1261                      // Multiplexer close down (CLD) -> close mutliplexer
1262                     log_info("Received Multiplexer close down command");
1263                     log_info("-> Closing down multiplexer");
1264                     rfcomm_multiplexer_finalize(multiplexer);
1265                     l2cap_disconnect(l2cap_cid);
1266                     return 1;
1267 
1268                 case BT_RFCOMM_FCON_CMD:
1269                     multiplexer->fcon = 0x81;
1270                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1271                     return 1;
1272 
1273                 case BT_RFCOMM_FCOFF_CMD:
1274                     multiplexer->fcon = 0x80;
1275                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1276                     return 1;
1277 
1278                 case BT_RFCOMM_TEST_CMD: {
1279                     if ((payload_offset + 1) >= size) return 0; // (1)
1280                     log_info("Received test command");
1281                     int len = packet[payload_offset+1] >> 1; // length < 125
1282                     if (len > RFCOMM_TEST_DATA_MAX_LEN){
1283                         len = RFCOMM_TEST_DATA_MAX_LEN;
1284                     }
1285                     // from (1) => (size - 1 - payload_offset) > 0
1286                     len = btstack_min(len, size - 1 - payload_offset);  // avoid information leak
1287                     multiplexer->test_data_len = len;
1288                     (void)memcpy(multiplexer->test_data,
1289                                  &packet[payload_offset + 2], len);
1290                     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1291                     return 1;
1292                 }
1293                 default:
1294                     break;
1295             }
1296             break;
1297 
1298         default:
1299             break;
1300 
1301     }
1302     return 0;
1303 }
1304 
1305 static int rfcomm_multiplexer_ready_to_send(rfcomm_multiplexer_t * multiplexer){
1306     if (multiplexer->send_dm_for_dlci) return 1;
1307     if (multiplexer->nsc_command) return 1;
1308     if (multiplexer->fcon & 0x80) return 1;
1309     switch (multiplexer->state){
1310         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1311         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1312         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1313             return 1;
1314         case RFCOMM_MULTIPLEXER_OPEN:
1315             if (multiplexer->test_data_len) {
1316                 return 1;
1317             }
1318             break;
1319         default:
1320             break;
1321     }
1322     return 0;
1323 }
1324 
1325 static void rfcomm_multiplexer_state_machine(rfcomm_multiplexer_t * multiplexer, RFCOMM_MULTIPLEXER_EVENT event){
1326 
1327     if (event != MULT_EV_READY_TO_SEND) return;
1328 
1329     uint16_t l2cap_cid = multiplexer->l2cap_cid;
1330 
1331     // process stored DM responses
1332     if (multiplexer->send_dm_for_dlci){
1333         uint8_t dlci = multiplexer->send_dm_for_dlci;
1334         multiplexer->send_dm_for_dlci = 0;
1335         rfcomm_send_dm_pf(multiplexer, dlci);
1336         return;
1337     }
1338 
1339     if (multiplexer->nsc_command){
1340         uint8_t command = multiplexer->nsc_command;
1341         multiplexer->nsc_command = 0;
1342         rfcomm_send_uih_nsc_rsp(multiplexer, command);
1343         return;
1344     }
1345 
1346     if (multiplexer->fcon & 0x80){
1347         multiplexer->fcon &= 0x01;
1348         rfcomm_send_uih_fc_rsp(multiplexer, multiplexer->fcon);
1349 
1350         if (multiplexer->fcon == 0) return;
1351         // trigger client to send again after sending FCon Response
1352         rfcomm_notify_channel_can_send();
1353         return;
1354     }
1355 
1356     switch (multiplexer->state) {
1357         case RFCOMM_MULTIPLEXER_SEND_SABM_0:
1358             log_info("Sending SABM #0 - (multi 0x%p)", multiplexer);
1359             multiplexer->state = RFCOMM_MULTIPLEXER_W4_UA_0;
1360             rfcomm_send_sabm(multiplexer, 0);
1361             break;
1362         case RFCOMM_MULTIPLEXER_SEND_UA_0:
1363             log_info("Sending UA #0");
1364             multiplexer->state = RFCOMM_MULTIPLEXER_OPEN;
1365             rfcomm_send_ua(multiplexer, 0);
1366 
1367             rfcomm_multiplexer_opened(multiplexer);
1368             break;
1369         case RFCOMM_MULTIPLEXER_SEND_UA_0_AND_DISC:
1370             log_info("Sending UA #0");
1371             log_info("Closing down multiplexer");
1372             multiplexer->state = RFCOMM_MULTIPLEXER_CLOSED;
1373             rfcomm_send_ua(multiplexer, 0);
1374 
1375             rfcomm_multiplexer_finalize(multiplexer);
1376             l2cap_disconnect(l2cap_cid);
1377             break;
1378         case RFCOMM_MULTIPLEXER_OPEN:
1379             // respond to test command
1380             if (multiplexer->test_data_len){
1381                 int len = multiplexer->test_data_len;
1382                 log_info("Sending TEST Response with %u bytes", len);
1383                 multiplexer->test_data_len = 0;
1384                 rfcomm_send_uih_test_rsp(multiplexer, multiplexer->test_data, len);
1385                 return;
1386             }
1387             break;
1388         default:
1389             break;
1390     }
1391 }
1392 
1393 // MARK: RFCOMM CHANNEL
1394 
1395 static void rfcomm_channel_send_credits(rfcomm_channel_t *channel, uint8_t credits){
1396     channel->credits_incoming += credits;
1397     rfcomm_send_uih_credits(channel->multiplexer, channel->dlci, credits);
1398 }
1399 
1400 static bool rfcomm_channel_can_send(rfcomm_channel_t * channel){
1401     if (!channel->credits_outgoing) return false;
1402     if ((channel->multiplexer->fcon & 1) == 0) return false;
1403     return l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid) != 0;
1404 }
1405 
1406 static void rfcomm_channel_opened(rfcomm_channel_t *rfChannel){
1407 
1408     log_info("opened");
1409 
1410     rfChannel->state = RFCOMM_CHANNEL_OPEN;
1411     rfcomm_emit_channel_opened(rfChannel, 0);
1412     rfcomm_emit_port_configuration(rfChannel, false);
1413 
1414     // remove (potential) timer
1415     rfcomm_multiplexer_t *multiplexer = rfChannel->multiplexer;
1416     if (multiplexer->timer_active) {
1417         btstack_run_loop_remove_timer(&multiplexer->timer);
1418         multiplexer->timer_active = 0;
1419     }
1420     // hack for problem detecting authentication failure
1421     multiplexer->at_least_one_connection = 1;
1422 
1423     // request can send now if channel ready
1424     if (rfcomm_channel_ready_to_send(rfChannel)){
1425         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1426     }
1427 }
1428 
1429 static void rfcomm_channel_packet_handler_uih(rfcomm_multiplexer_t *multiplexer, uint8_t * packet, uint16_t size){
1430     const uint8_t frame_dlci = packet[0] >> 2;
1431     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1432     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1433     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1434     int request_can_send_now = 0;
1435 
1436     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, frame_dlci);
1437     if (!channel) return;
1438 
1439     // handle new outgoing credits
1440     if (packet[1] == BT_RFCOMM_UIH_PF) {
1441 
1442         // add them
1443         uint16_t new_credits = packet[3+length_offset];
1444         channel->credits_outgoing += new_credits;
1445         log_info( "RFCOMM data UIH_PF, new credits channel 0x%02x: %u, now %u", channel->rfcomm_cid, new_credits, channel->credits_outgoing);
1446 
1447         // notify channel statemachine
1448         rfcomm_channel_event_t channel_event = { CH_EVT_RCVD_CREDITS, 0 };
1449         log_debug("state machine, waiting_for_can_send_now %u", channel->waiting_for_can_send_now);
1450         int rfcomm_channel_valid = 1;
1451         rfcomm_channel_state_machine_with_channel(channel, &channel_event, &rfcomm_channel_valid);
1452         if (rfcomm_channel_valid){
1453             if (rfcomm_channel_ready_to_send(channel) || channel->waiting_for_can_send_now){
1454                 request_can_send_now = 1;
1455             }
1456         }
1457     }
1458 
1459     // contains payload?
1460     if ((size - 1) > payload_offset){
1461 
1462         // log_info( "RFCOMM data UIH_PF, size %u, channel %p", size-payload_offset-1, rfChannel->connection);
1463 
1464         // decrease incoming credit counter
1465         if (channel->credits_incoming > 0){
1466             channel->credits_incoming--;
1467         }
1468 
1469         // deliver payload
1470         (channel->packet_handler)(RFCOMM_DATA_PACKET, channel->rfcomm_cid,
1471                               &packet[payload_offset], size-payload_offset-1);
1472     }
1473 
1474     // automatically provide new credits to remote device, if no incoming flow control
1475     if (!channel->incoming_flow_control && (channel->credits_incoming < 5)){
1476         channel->new_credits_incoming = RFCOMM_CREDITS;
1477         request_can_send_now = 1;
1478     }
1479 
1480     if (request_can_send_now){
1481         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1482     }
1483 }
1484 
1485 static void rfcomm_channel_accept_pn(rfcomm_channel_t *channel, rfcomm_channel_event_pn_t *event){
1486     // priority of client request
1487     channel->pn_priority = event->priority;
1488 
1489     // new credits
1490     channel->credits_outgoing = event->credits_outgoing;
1491 
1492     // negotiate max frame size
1493     if (channel->max_frame_size > channel->multiplexer->max_frame_size) {
1494         channel->max_frame_size = channel->multiplexer->max_frame_size;
1495     }
1496     if (channel->max_frame_size > event->max_frame_size) {
1497         channel->max_frame_size = event->max_frame_size;
1498     }
1499 
1500 }
1501 
1502 static void rfcomm_channel_finalize(rfcomm_channel_t *channel){
1503 
1504     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1505 
1506     // remove from list
1507     btstack_linked_list_remove( &rfcomm_channels, (btstack_linked_item_t *) channel);
1508 
1509     // free channel
1510     btstack_memory_rfcomm_channel_free(channel);
1511 
1512     // update multiplexer timeout after channel was removed from list
1513     rfcomm_multiplexer_prepare_idle_timer(multiplexer);
1514 }
1515 
1516 static void rfcomm_channel_state_machine_with_dlci(rfcomm_multiplexer_t * multiplexer, uint8_t dlci, const rfcomm_channel_event_t *event){
1517 
1518     // TODO: if client max frame size is smaller than RFCOMM_DEFAULT_SIZE, send PN
1519 
1520 
1521     // lookup existing channel
1522     rfcomm_channel_t * channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
1523 
1524     // log_info("rfcomm_channel_state_machine_with_dlci lookup dlci #%u = 0x%08x - event %u", dlci, (int) channel, event->type);
1525 
1526     if (channel) {
1527         int rfcomm_channel_valid = 1;
1528         rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1529         if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1530             l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1531         }
1532         return;
1533     }
1534 
1535     // service registered?
1536     rfcomm_service_t * service = rfcomm_service_for_channel(dlci >> 1);
1537     // log_info("rfcomm_channel_state_machine_with_dlci service dlci #%u = 0x%08x", dlci, (int) service);
1538     if (!service) {
1539         // discard request by sending disconnected mode
1540         multiplexer->send_dm_for_dlci = dlci;
1541         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1542         return;
1543     }
1544 
1545     // create channel for some events
1546     switch (event->type) {
1547         case CH_EVT_RCVD_SABM:
1548         case CH_EVT_RCVD_PN:
1549         case CH_EVT_RCVD_RPN_REQ:
1550         case CH_EVT_RCVD_RPN_CMD:
1551             // setup incoming channel
1552             channel = rfcomm_channel_create(multiplexer, service, dlci >> 1);
1553             if (!channel){
1554                 // discard request by sending disconnected mode
1555                 multiplexer->send_dm_for_dlci = dlci;
1556                 l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1557             }
1558             break;
1559         default:
1560             break;
1561     }
1562 
1563     if (!channel) {
1564         // discard request by sending disconnected mode
1565         multiplexer->send_dm_for_dlci = dlci;
1566         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1567         return;
1568     }
1569 
1570     int rfcomm_channel_valid = 1;
1571     rfcomm_channel_state_machine_with_channel(channel, event, &rfcomm_channel_valid);
1572     if (rfcomm_channel_valid && rfcomm_channel_ready_to_send(channel)){
1573         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1574     }
1575 }
1576 
1577 static void rfcomm_channel_packet_handler(rfcomm_multiplexer_t * multiplexer,  uint8_t *packet, uint16_t size){
1578 
1579     UNUSED(size);   // ok: fixed format messages
1580 
1581     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1582     const uint8_t frame_dlci = packet[0] >> 2;
1583     uint8_t message_dlci; // used by commands in UIH(_PF) packets
1584 	uint8_t message_len;  //   "
1585 
1586     // rfcomm: (1) command/control
1587     // -- credits_offset = 1 if command == BT_RFCOMM_UIH_PF
1588     const uint8_t credit_offset = ((packet[1] & BT_RFCOMM_UIH_PF) == BT_RFCOMM_UIH_PF) ? 1 : 0;   // credits for uih_pf frames
1589     // rfcomm: (2) length. if bit 0 is cleared, 2 byte length is used. (little endian)
1590     const uint8_t length_offset = (packet[2] & 1) ^ 1;  // to be used for pos >= 3
1591     // rfcomm: (3+length_offset) credits if credits_offset == 1
1592     // rfcomm: (3+length_offest+credits_offset)
1593     const uint8_t payload_offset = 3 + length_offset + credit_offset;
1594 
1595     rfcomm_channel_event_t event;
1596     rfcomm_channel_event_pn_t event_pn;
1597     rfcomm_channel_event_rpn_t event_rpn;
1598     rfcomm_channel_event_msc_t event_msc;
1599 
1600     // switch by rfcomm message type
1601     switch(packet[1]) {
1602 
1603         case BT_RFCOMM_SABM:
1604             event.type = CH_EVT_RCVD_SABM;
1605             log_info("Received SABM #%u", frame_dlci);
1606             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1607             break;
1608 
1609         case BT_RFCOMM_UA:
1610             event.type = CH_EVT_RCVD_UA;
1611             log_info("Received UA #%u",frame_dlci);
1612             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1613             break;
1614 
1615         case BT_RFCOMM_DISC:
1616             event.type = CH_EVT_RCVD_DISC;
1617             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1618             break;
1619 
1620         case BT_RFCOMM_DM:
1621         case BT_RFCOMM_DM_PF:
1622             event.type = CH_EVT_RCVD_DM;
1623             rfcomm_channel_state_machine_with_dlci(multiplexer, frame_dlci, &event);
1624             break;
1625 
1626         case BT_RFCOMM_UIH_PF:
1627         case BT_RFCOMM_UIH:
1628 
1629             message_len  = packet[payload_offset+1] >> 1;
1630 
1631             switch (packet[payload_offset]) {
1632                 case BT_RFCOMM_PN_CMD:
1633                     message_dlci = packet[payload_offset+2];
1634                     event_pn.super.type = CH_EVT_RCVD_PN;
1635                     event_pn.priority = packet[payload_offset+4];
1636                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1637                     event_pn.credits_outgoing = packet[payload_offset+9];
1638                     log_info("Received UIH Parameter Negotiation Command for #%u, credits %u",
1639                         message_dlci, event_pn.credits_outgoing);
1640                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1641                     break;
1642 
1643                 case BT_RFCOMM_PN_RSP:
1644                     message_dlci = packet[payload_offset+2];
1645                     event_pn.super.type = CH_EVT_RCVD_PN_RSP;
1646                     event_pn.priority = packet[payload_offset+4];
1647                     event_pn.max_frame_size = little_endian_read_16(packet, payload_offset+6);
1648                     event_pn.credits_outgoing = packet[payload_offset+9];
1649                     log_info("Received UIH Parameter Negotiation Response max frame %u, credits %u",
1650                             event_pn.max_frame_size, event_pn.credits_outgoing);
1651                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_pn);
1652                     break;
1653 
1654                 case BT_RFCOMM_MSC_CMD:
1655                     message_dlci = packet[payload_offset+2] >> 2;
1656                     event_msc.super.type = CH_EVT_RCVD_MSC_CMD;
1657                     event_msc.modem_status = packet[payload_offset+3];
1658                     log_info("Received MSC CMD for #%u, ", message_dlci);
1659                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_msc);
1660                     break;
1661 
1662                 case BT_RFCOMM_MSC_RSP:
1663                     message_dlci = packet[payload_offset+2] >> 2;
1664                     event.type = CH_EVT_RCVD_MSC_RSP;
1665                     log_info("Received MSC RSP for #%u", message_dlci);
1666                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1667                     break;
1668 
1669                 case BT_RFCOMM_RPN_CMD:
1670                     message_dlci = packet[payload_offset+2] >> 2;
1671                     switch (message_len){
1672                         case 1:
1673                             log_info("Received Remote Port Negotiation Request for #%u", message_dlci);
1674                             event.type = CH_EVT_RCVD_RPN_REQ;
1675                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, &event);
1676                             break;
1677                         case 8:
1678                             log_info("Received Remote Port Negotiation Update for #%u", message_dlci);
1679                             event_rpn.super.type = CH_EVT_RCVD_RPN_CMD;
1680                             event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1681                             rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1682                             break;
1683                         default:
1684                             break;
1685                     }
1686                     break;
1687 
1688                 case BT_RFCOMM_RPN_RSP:
1689                     message_dlci = packet[payload_offset+2] >> 2;
1690                     if (message_len != 8) break;
1691                     event_rpn.super.type = CH_EVT_RCVD_RPN_RSP;
1692                     event_rpn.data = *(rfcomm_rpn_data_t*) &packet[payload_offset+3];
1693                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rpn);
1694                     break;
1695 
1696                 case BT_RFCOMM_RLS_CMD: {
1697                     log_info("Received RLS command");
1698                     message_dlci = packet[payload_offset+2] >> 2;
1699                     rfcomm_channel_event_rls_t event_rls;
1700                     event_rls.super.type = CH_EVT_RCVD_RLS_CMD;
1701                     event_rls.line_status = packet[payload_offset+3];
1702                     rfcomm_channel_state_machine_with_dlci(multiplexer, message_dlci, (rfcomm_channel_event_t*) &event_rls);
1703                     break;
1704                 }
1705 
1706                 case BT_RFCOMM_RLS_RSP:
1707                     log_info("Received RLS response");
1708                     break;
1709 
1710                 // Following commands are handled by rfcomm_multiplexer_l2cap_packet_handler
1711                 // case BT_RFCOMM_TEST_CMD:
1712                 // case BT_RFCOMM_FCOFF_CMD:
1713                 // case BT_RFCOMM_FCON_CMD:
1714                 // everything else is an not supported command
1715                 default: {
1716                     log_error("Received unknown UIH command packet - 0x%02x", packet[payload_offset]);
1717                     multiplexer->nsc_command = packet[payload_offset];
1718                     break;
1719                 }
1720             }
1721             break;
1722 
1723         default:
1724             log_error("Received unknown RFCOMM message type %x", packet[1]);
1725             break;
1726     }
1727 
1728     // trigger next action - example W4_PN_RSP: transition to SEND_SABM which only depends on "can send"
1729     if (rfcomm_multiplexer_ready_to_send(multiplexer)){
1730         l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
1731     }
1732 }
1733 
1734 static void rfcomm_packet_handler(uint8_t packet_type, uint16_t channel, uint8_t *packet, uint16_t size){
1735 
1736     if (packet_type == HCI_EVENT_PACKET){
1737         rfcomm_hci_event_handler(packet, size);
1738         return;
1739     }
1740 
1741     // we only handle l2cap packets for:
1742     if (packet_type != L2CAP_DATA_PACKET) return;
1743 
1744     //  - multiplexer itself
1745     int handled = rfcomm_multiplexer_l2cap_packet_handler(channel, packet, size);
1746 
1747     if (handled) return;
1748 
1749     // - channel over open multiplexer
1750     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_l2cap_cid(channel);
1751     if ( (multiplexer == NULL) || (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN)) return;
1752 
1753     // channel data ?
1754     // rfcomm: (0) addr [76543 server channel] [2 direction: initiator uses 1] [1 C/R: CMD by initiator = 1] [0 EA=1]
1755     const uint8_t frame_dlci = packet[0] >> 2;
1756 
1757     if (frame_dlci && ((packet[1] == BT_RFCOMM_UIH) || (packet[1] == BT_RFCOMM_UIH_PF))) {
1758         rfcomm_channel_packet_handler_uih(multiplexer, packet, size);
1759         return;
1760     }
1761 
1762     rfcomm_channel_packet_handler(multiplexer, packet, size);
1763 }
1764 
1765 static int rfcomm_channel_ready_for_open(rfcomm_channel_t *channel){
1766     // note: exchanging MSC isn't neccessary to consider channel open
1767     // note: having outgoing credits is also not necessary to consider channel open
1768     // log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u, l2cap credits %u ", channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP|RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS, channel->state_var, channel->credits_outgoing, channel->multiplexer->l2cap_credits);
1769     // if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP) == 0) return 0;
1770     // if (channel->credits_outgoing == 0) return 0;
1771     log_info("rfcomm_channel_ready_for_open state %u, flags needed %04x, current %04x, rf credits %u",
1772          channel->state, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP, channel->state_var, channel->credits_outgoing);
1773     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP) == 0) return 0;
1774     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS) == 0) return 0;
1775 
1776     return 1;
1777 }
1778 
1779 static int rfcomm_channel_ready_for_incoming_dlc_setup(rfcomm_channel_t * channel){
1780     log_info("rfcomm_channel_ready_for_incoming_dlc_setup state var %04x", channel->state_var);
1781     // Client accept and SABM/UA is required, PN RSP is needed if PN was received
1782     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) == 0) return 0;
1783     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM      ) == 0) return 0;
1784     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA        ) != 0) return 0;
1785     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP    ) != 0) return 0;
1786     return 1;
1787 }
1788 
1789 inline static void rfcomm_channel_state_add(rfcomm_channel_t *channel, uint32_t flag){
1790     channel->state_var |= flag;
1791 }
1792 inline static void rfcomm_channel_state_remove(rfcomm_channel_t *channel, uint32_t flag){
1793     channel->state_var &= ~flag;
1794 }
1795 
1796 static int rfcomm_channel_ready_to_send(rfcomm_channel_t * channel){
1797     switch (channel->state){
1798         case RFCOMM_CHANNEL_SEND_UIH_PN:
1799             log_debug("ch-ready: state %u", channel->state);
1800             return 1;
1801         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
1802             log_debug("ch-ready: state %u", channel->state);
1803             return 1;
1804         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
1805             log_debug("ch-ready: state %u", channel->state);
1806             return 1;
1807         case RFCOMM_CHANNEL_SEND_DISC:
1808             log_debug("ch-ready: state %u", channel->state);
1809             return 1;
1810         case RFCOMM_CHANNEL_SEND_DM:
1811             log_debug("ch-ready: state %u", channel->state);
1812             return 1;
1813         case RFCOMM_CHANNEL_OPEN:
1814             if (channel->new_credits_incoming) {
1815                 log_debug("ch-ready: channel open & new_credits_incoming") ;
1816                 return 1;
1817             }
1818             break;
1819         case RFCOMM_CHANNEL_DLC_SETUP:
1820             if (channel->state_var & (
1821                 RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD  |
1822                 RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS
1823              )) {
1824                 log_debug("ch-ready: channel dlc setup & send msc cmd or send credits") ;
1825                 return 1;
1826             }
1827             break;
1828 
1829         default:
1830             break;
1831     }
1832 
1833     if (channel->state_var & (
1834         RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP       |
1835         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY    |
1836         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG   |
1837         RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE |
1838         RFCOMM_CHANNEL_STATE_VAR_SEND_UA           |
1839         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD      |
1840         RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP
1841                              )){
1842         log_debug("ch-ready: state %x, state var %x", channel->state, channel->state_var);
1843         return 1;
1844     }
1845 
1846     if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID) {
1847         log_debug("ch-ready: rls_line_status");
1848         return 1;
1849     }
1850 
1851     if (channel->remote_line_status != RFCOMM_RLS_STATUS_INVALID) {
1852         log_debug("ch-ready: rls_line_status");
1853         return 1;
1854     }
1855 
1856     return 0;
1857 }
1858 
1859 
1860 static void rfcomm_channel_state_machine_with_channel(rfcomm_channel_t *channel, const rfcomm_channel_event_t *event, int * out_channel_valid){
1861 
1862     // channel != NULL -> channel valid
1863     *out_channel_valid = 1;
1864 
1865     rfcomm_multiplexer_t *multiplexer = channel->multiplexer;
1866 
1867     // TODO: integrate in common switch
1868     if (event->type == CH_EVT_RCVD_DISC){
1869         rfcomm_emit_channel_closed(channel);
1870         channel->state = RFCOMM_CHANNEL_SEND_UA_AFTER_DISC;
1871         return;
1872     }
1873 
1874     // TODO: integrate in common switch
1875     if (event->type == CH_EVT_RCVD_DM){
1876         log_info("Received DM message for #%u", channel->dlci);
1877         log_info("-> Closing channel locally for #%u", channel->dlci);
1878         rfcomm_channel_emit_final_event(channel, ERROR_CODE_CONNECTION_REJECTED_DUE_TO_LIMITED_RESOURCES);
1879         rfcomm_channel_finalize(channel);
1880         *out_channel_valid = 0;
1881         return;
1882     }
1883 
1884     // remote port negotiation command - just accept everything for now
1885     //
1886     // "The RPN command can be used before a new DLC is opened and should be used whenever the port settings change."
1887     // "The RPN command is specified as optional in TS 07.10, but it is mandatory to recognize and respond to it in RFCOMM.
1888     //   (Although the handling of individual settings are implementation-dependent.)"
1889     //
1890 
1891     // TODO: integrate in common switch
1892     if (event->type == CH_EVT_RCVD_RPN_CMD){
1893         // control port parameters
1894         rfcomm_channel_event_rpn_t *event_rpn = (rfcomm_channel_event_rpn_t*) event;
1895         rfcomm_rpn_data_update(&channel->local_rpn_data, &event_rpn->data);
1896         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1897         // notify client about new settings
1898         rfcomm_emit_port_configuration(channel, false);
1899         return;
1900     }
1901 
1902     // TODO: integrate in common switch
1903     if (event->type == CH_EVT_RCVD_RPN_REQ){
1904         // no values got accepted (no values have beens sent)
1905         channel->local_rpn_data.parameter_mask_0 = 0x00;
1906         channel->local_rpn_data.parameter_mask_1 = 0x00;
1907         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1908         return;
1909     }
1910 
1911     if (event->type == CH_EVT_RCVD_RLS_CMD){
1912         rfcomm_channel_event_rls_t * event_rls = (rfcomm_channel_event_rls_t*) event;
1913         channel->remote_line_status = event_rls->line_status & 0x0f;
1914         log_info("CH_EVT_RCVD_RLS_CMD remote line status 0x%0x", channel->remote_line_status);
1915         rfcomm_emit_remote_line_status(channel, channel->remote_line_status);
1916         return;
1917     }
1918 
1919     // TODO: integrate in common switch
1920     if (event->type == CH_EVT_READY_TO_SEND){
1921         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY){
1922             log_info("Sending Remote Port Configuration Query for #%u", channel->dlci);
1923             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY);
1924             rfcomm_send_uih_rpn_query(channel->multiplexer, channel->dlci);
1925             return;
1926         }
1927         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG){
1928             log_info("Sending Remote Port Configuration for #%u", channel->dlci);
1929             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG);
1930             rfcomm_send_uih_rpn_config(channel->multiplexer, channel->dlci, &channel->remote_rpn_data);
1931             return;
1932         }
1933         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE){
1934             log_info("Sending Remote Port Negotiation RSP for #%u", channel->dlci);
1935             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_RESPONSE);
1936             rfcomm_send_uih_rpn_response(multiplexer, channel->dlci, &channel->local_rpn_data);
1937             return;
1938         }
1939         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD){
1940             log_info("Sending MSC CMD for #%u", channel->dlci);
1941             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
1942             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_CMD);
1943             rfcomm_send_uih_msc_cmd(multiplexer, channel->dlci , channel->local_modem_status);
1944             return;
1945         }
1946         if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP){
1947             log_info("Sending MSC RSP for #%u", channel->dlci);
1948             rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
1949             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_MSC_RSP);
1950             rfcomm_send_uih_msc_rsp(multiplexer, channel->dlci, channel->remote_modem_status);
1951             return;
1952         }
1953         if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID){
1954             log_info("Sending RLS CMD 0x%0x", channel->local_line_status);
1955             uint8_t line_status = channel->local_line_status;
1956             channel->local_line_status = RFCOMM_RLS_STATUS_INVALID;
1957             rfcomm_send_uih_rls_cmd(multiplexer, channel->dlci, line_status);
1958             return;
1959         }
1960         if (channel->remote_line_status != RFCOMM_RLS_STATUS_INVALID){
1961             log_info("Sending RLS RSP 0x%0x", channel->remote_line_status);
1962             uint8_t line_status = channel->remote_line_status;
1963             channel->remote_line_status = RFCOMM_RLS_STATUS_INVALID;
1964             rfcomm_send_uih_rls_rsp(multiplexer, channel->dlci, line_status);
1965             return;
1966         }
1967     }
1968 
1969     // emit MSC status to app
1970     if (event->type == CH_EVT_RCVD_MSC_CMD){
1971         // notify client about new settings
1972         rfcomm_channel_event_msc_t *event_msc = (rfcomm_channel_event_msc_t*) event;
1973         uint8_t modem_status_event[5];
1974         modem_status_event[0] = RFCOMM_EVENT_REMOTE_MODEM_STATUS;
1975         modem_status_event[1] = sizeof(event) - 2;
1976         little_endian_store_16(modem_status_event, 2, channel->rfcomm_cid);
1977         modem_status_event[4] = event_msc->modem_status;
1978         (channel->packet_handler)(HCI_EVENT_PACKET, channel->rfcomm_cid, (uint8_t*)&modem_status_event, sizeof(modem_status_event));
1979         // no return, MSC_CMD will be handled by state machine below
1980     }
1981 
1982     rfcomm_channel_event_pn_t * event_pn = (rfcomm_channel_event_pn_t*) event;
1983 
1984     switch (channel->state) {
1985         case RFCOMM_CHANNEL_CLOSED:
1986             switch (event->type){
1987                 case CH_EVT_RCVD_SABM:
1988                     log_info("-> Inform app");
1989                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
1990                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1991                     rfcomm_emit_connection_request(channel);
1992                     break;
1993                 case CH_EVT_RCVD_PN:
1994                     rfcomm_channel_accept_pn(channel, event_pn);
1995                     log_info("-> Inform app");
1996                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
1997                     channel->state = RFCOMM_CHANNEL_INCOMING_SETUP;
1998                     rfcomm_emit_connection_request(channel);
1999                     break;
2000                 default:
2001                     break;
2002             }
2003             break;
2004 
2005         case RFCOMM_CHANNEL_INCOMING_SETUP:
2006             switch (event->type){
2007                 case CH_EVT_RCVD_SABM:
2008                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM);
2009                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
2010                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2011                     }
2012                     break;
2013                 case CH_EVT_RCVD_PN:
2014                     rfcomm_channel_accept_pn(channel, event_pn);
2015                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_PN);
2016                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED) {
2017                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2018                     }
2019                     break;
2020                 case CH_EVT_READY_TO_SEND:
2021                     // if / else if is used to check for state transition after sending
2022                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP){
2023                         log_info("Sending UIH Parameter Negotiation Respond for #%u", channel->dlci);
2024                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2025                         rfcomm_send_uih_pn_response(multiplexer, channel->dlci, channel->pn_priority, channel->max_frame_size);
2026                     } else if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_UA){
2027                         log_info("Sending UA #%u", channel->dlci);
2028                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2029                         rfcomm_send_ua(multiplexer, channel->dlci);
2030                     }
2031                     if (rfcomm_channel_ready_for_incoming_dlc_setup(channel)){
2032                         log_info("Incomping setup done, requesting send MSC CMD and send Credits");
2033                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2034                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2035                         channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2036                      }
2037                     break;
2038                 default:
2039                     break;
2040             }
2041             break;
2042 
2043         case RFCOMM_CHANNEL_W4_MULTIPLEXER:
2044             switch (event->type) {
2045                 case CH_EVT_MULTIPLEXER_READY:
2046                     log_info("Muliplexer opened, sending UIH PN next");
2047                     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2048                     break;
2049                 default:
2050                     break;
2051             }
2052             break;
2053 
2054         case RFCOMM_CHANNEL_SEND_UIH_PN:
2055             switch (event->type) {
2056                 case CH_EVT_READY_TO_SEND:
2057                     // update mtu
2058                     channel->max_frame_size = btstack_min(multiplexer->max_frame_size, channel->max_frame_size);
2059                     log_info("Sending UIH Parameter Negotiation Command for #%u (channel 0x%p) mtu %u", channel->dlci, channel, channel->max_frame_size );
2060                     channel->state = RFCOMM_CHANNEL_W4_PN_RSP;
2061                     rfcomm_send_uih_pn_command(multiplexer, channel->dlci, channel->max_frame_size);
2062                     break;
2063                 default:
2064                     break;
2065             }
2066             break;
2067 
2068         case RFCOMM_CHANNEL_W4_PN_RSP:
2069             switch (event->type){
2070                 case CH_EVT_RCVD_PN_RSP:
2071                     // update max frame size
2072                     if (channel->max_frame_size > event_pn->max_frame_size) {
2073                         channel->max_frame_size = event_pn->max_frame_size;
2074                     }
2075                     // new credits
2076                     channel->credits_outgoing = event_pn->credits_outgoing;
2077                     channel->state = RFCOMM_CHANNEL_SEND_SABM_W4_UA;
2078                     break;
2079                 default:
2080                     break;
2081             }
2082             break;
2083 
2084         case RFCOMM_CHANNEL_SEND_SABM_W4_UA:
2085             switch (event->type) {
2086                 case CH_EVT_READY_TO_SEND:
2087                     log_info("Sending SABM #%u", channel->dlci);
2088                     channel->state = RFCOMM_CHANNEL_W4_UA;
2089                     rfcomm_send_sabm(multiplexer, channel->dlci);
2090                     break;
2091                 default:
2092                     break;
2093             }
2094             break;
2095 
2096         case RFCOMM_CHANNEL_W4_UA:
2097             switch (event->type){
2098                 case CH_EVT_RCVD_UA:
2099                     channel->state = RFCOMM_CHANNEL_DLC_SETUP;
2100                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2101                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2102                     break;
2103                 default:
2104                     break;
2105             }
2106             break;
2107 
2108         case RFCOMM_CHANNEL_DLC_SETUP:
2109             switch (event->type){
2110                 case CH_EVT_RCVD_MSC_CMD:
2111                     channel->remote_modem_status = ((rfcomm_channel_event_msc_t*) event)->modem_status;
2112                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_CMD);
2113                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2114                     break;
2115                 case CH_EVT_RCVD_MSC_RSP:
2116                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_RCVD_MSC_RSP);
2117                     break;
2118 
2119                 case CH_EVT_READY_TO_SEND:
2120                     if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS){
2121                         log_info("Providing credits for #%u", channel->dlci);
2122                         rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_CREDITS);
2123                         rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SENT_CREDITS);
2124                         if (channel->new_credits_incoming) {
2125                             uint8_t new_credits = channel->new_credits_incoming;
2126                             channel->new_credits_incoming = 0;
2127                             rfcomm_channel_send_credits(channel, new_credits);
2128                         }
2129                         break;
2130                     }
2131                     break;
2132                 default:
2133                     break;
2134             }
2135             // finally done?
2136             if (rfcomm_channel_ready_for_open(channel)){
2137                 channel->state = RFCOMM_CHANNEL_OPEN;
2138                 rfcomm_channel_opened(channel);
2139             }
2140             break;
2141 
2142         case RFCOMM_CHANNEL_OPEN:
2143             switch (event->type){
2144                 case CH_EVT_RCVD_MSC_CMD:
2145                     channel->remote_modem_status = ((rfcomm_channel_event_msc_t*) event)->modem_status;
2146                     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_RSP);
2147                     break;
2148                 case CH_EVT_RCVD_RPN_RSP:
2149                     if ((channel->state_var & RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE) == 0) break;
2150                     rfcomm_channel_state_remove(channel, RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE);
2151                     memcpy(&channel->remote_rpn_data, &((rfcomm_channel_event_rpn_t*) event)->data, sizeof(rfcomm_rpn_data_t));
2152                     rfcomm_emit_port_configuration(channel, true);
2153                     break;
2154                 case CH_EVT_READY_TO_SEND:
2155                     if (channel->new_credits_incoming) {
2156                         uint8_t new_credits = channel->new_credits_incoming;
2157                         channel->new_credits_incoming = 0;
2158                         rfcomm_channel_send_credits(channel, new_credits);
2159                         break;
2160                     }
2161                     break;
2162                 case CH_EVT_RCVD_CREDITS:
2163                     rfcomm_notify_channel_can_send();
2164                     break;
2165                 default:
2166                     break;
2167             }
2168             break;
2169 
2170         case RFCOMM_CHANNEL_SEND_DM:
2171             switch (event->type) {
2172                 case CH_EVT_READY_TO_SEND:
2173                     log_info("Sending DM_PF for #%u", channel->dlci);
2174                     // don't emit channel closed - channel was never open
2175                     channel->state = RFCOMM_CHANNEL_CLOSED;
2176                     rfcomm_send_dm_pf(multiplexer, channel->dlci);
2177                     rfcomm_channel_finalize(channel);
2178                     *out_channel_valid = 0;
2179                     break;
2180                 default:
2181                     break;
2182             }
2183             break;
2184 
2185         case RFCOMM_CHANNEL_SEND_DISC:
2186             switch (event->type) {
2187                 case CH_EVT_READY_TO_SEND:
2188                     channel->state = RFCOMM_CHANNEL_W4_UA_AFTER_DISC;
2189                     rfcomm_send_disc(multiplexer, channel->dlci);
2190                     break;
2191                 default:
2192                     break;
2193             }
2194             break;
2195 
2196         case RFCOMM_CHANNEL_W4_UA_AFTER_DISC:
2197             switch (event->type){
2198                 case CH_EVT_RCVD_UA:
2199                     channel->state = RFCOMM_CHANNEL_CLOSED;
2200                     rfcomm_emit_channel_closed(channel);
2201                     rfcomm_channel_finalize(channel);
2202                     *out_channel_valid = 0;
2203                     break;
2204                 default:
2205                     break;
2206             }
2207             break;
2208 
2209         case RFCOMM_CHANNEL_SEND_UA_AFTER_DISC:
2210             switch (event->type) {
2211                 case CH_EVT_READY_TO_SEND:
2212                     log_info("Sending UA after DISC for #%u", channel->dlci);
2213                     channel->state = RFCOMM_CHANNEL_CLOSED;
2214                     rfcomm_send_ua(multiplexer, channel->dlci);
2215                     rfcomm_channel_finalize(channel);
2216                     *out_channel_valid = 0;
2217                     break;
2218                 default:
2219                     break;
2220             }
2221             break;
2222 
2223         default:
2224             break;
2225     }
2226 }
2227 
2228 // MARK: RFCOMM BTstack API
2229 
2230 void rfcomm_init(void){
2231     rfcomm_security_level = gap_get_security_level();
2232 #ifdef RFCOMM_USE_ERTM
2233     rfcomm_ertm_id = 0;
2234 #endif
2235 }
2236 
2237 void rfcomm_deinit(void){
2238     rfcomm_client_cid_generator = 0;
2239     rfcomm_multiplexers = NULL;
2240     rfcomm_services     = NULL;
2241     rfcomm_channels     = NULL;
2242 #ifdef RFCOMM_USE_ERTM
2243     rfcomm_ertm_request_callback  = NULL;
2244     rfcomm_ertm_released_callback = NULL;
2245 #endif
2246 }
2247 
2248 void rfcomm_set_required_security_level(gap_security_level_t security_level){
2249     rfcomm_security_level = security_level;
2250 }
2251 
2252 bool rfcomm_can_send_packet_now(uint16_t rfcomm_cid){
2253     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2254     if (!channel){
2255         log_error("send cid 0x%02x doesn't exist!", rfcomm_cid);
2256         return false;
2257     }
2258     return rfcomm_channel_can_send(channel);
2259 }
2260 
2261 uint8_t rfcomm_request_can_send_now_event(uint16_t rfcomm_cid){
2262     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2263     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2264     channel->waiting_for_can_send_now = 1;
2265     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2266     return ERROR_CODE_SUCCESS;
2267 }
2268 
2269 static uint8_t rfcomm_assert_send_valid(rfcomm_channel_t * channel , uint16_t len){
2270     if (len > channel->max_frame_size){
2271         log_error("send cid 0x%02x, rfcomm data lenght exceeds MTU!", channel->rfcomm_cid);
2272         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2273     }
2274 
2275 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2276     if (len > rfcomm_max_frame_size_for_l2cap_mtu(sizeof(outgoing_buffer))){
2277         log_error("send cid 0x%02x, length exceeds outgoing rfcomm_out_buffer", channel->rfcomm_cid);
2278         return RFCOMM_DATA_LEN_EXCEEDS_MTU;
2279     }
2280 #endif
2281 
2282     if (!channel->credits_outgoing){
2283         log_info("send cid 0x%02x, no rfcomm outgoing credits!", channel->rfcomm_cid);
2284         return RFCOMM_NO_OUTGOING_CREDITS;
2285     }
2286 
2287     if ((channel->multiplexer->fcon & 1) == 0){
2288         log_info("send cid 0x%02x, aggregate flow off!", channel->rfcomm_cid);
2289         return RFCOMM_AGGREGATE_FLOW_OFF;
2290     }
2291     return ERROR_CODE_SUCCESS;
2292 }
2293 
2294 uint16_t rfcomm_get_max_frame_size(uint16_t rfcomm_cid){
2295     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2296     if (!channel){
2297         return 0;
2298     }
2299     return channel->max_frame_size;
2300 }
2301 
2302 // pre: rfcomm_can_send_packet_now(rfcomm_cid) == true
2303 bool rfcomm_reserve_packet_buffer(void){
2304 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2305     log_error("rfcomm_reserve_packet_buffer should not get called with ERTM");
2306     return false;
2307 #else
2308     return l2cap_reserve_packet_buffer();
2309 #endif
2310 }
2311 
2312 void rfcomm_release_packet_buffer(void){
2313 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2314     log_error("rfcomm_release_packet_buffer should not get called with ERTM");
2315 #else
2316     l2cap_release_packet_buffer();
2317 #endif
2318 }
2319 
2320 uint8_t * rfcomm_get_outgoing_buffer(void){
2321 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2322     uint8_t * rfcomm_out_buffer = outgoing_buffer;
2323 #else
2324     uint8_t * rfcomm_out_buffer = l2cap_get_outgoing_buffer();
2325 #endif
2326     // address + control + length (16) + no credit field
2327     return &rfcomm_out_buffer[4];
2328 }
2329 
2330 uint8_t rfcomm_send_prepared(uint16_t rfcomm_cid, uint16_t len){
2331     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2332     if (!channel){
2333         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2334         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2335     }
2336 
2337     uint8_t status = rfcomm_assert_send_valid(channel, len);
2338     if (status != ERROR_CODE_SUCCESS) return status;
2339 
2340 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2341     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2342         log_error("l2cap cannot send now");
2343         return BTSTACK_ACL_BUFFERS_FULL;
2344     }
2345 #else
2346     if (!l2cap_can_send_prepared_packet_now(channel->multiplexer->l2cap_cid)){
2347         log_error("l2cap cannot send now");
2348         return BTSTACK_ACL_BUFFERS_FULL;
2349     }
2350 #endif
2351 
2352     // send might cause l2cap to emit new credits, update counters first
2353     if (len){
2354         channel->credits_outgoing--;
2355     } else {
2356         log_info("sending empty RFCOMM packet for cid %02x", rfcomm_cid);
2357     }
2358 
2359     status = rfcomm_send_uih_prepared(channel->multiplexer, channel->dlci, len);
2360 
2361     if (status != 0) {
2362         log_error("error %d", status);
2363         if (len) {
2364             channel->credits_outgoing++;
2365         }
2366     }
2367 
2368     return status;
2369 }
2370 
2371 uint8_t rfcomm_send(uint16_t rfcomm_cid, uint8_t *data, uint16_t len){
2372     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2373     if (!channel){
2374         log_error("cid 0x%02x doesn't exist!", rfcomm_cid);
2375         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2376     }
2377 
2378     uint8_t status = rfcomm_assert_send_valid(channel, len);
2379     if (status != ERROR_CODE_SUCCESS) return status;
2380     if (!l2cap_can_send_packet_now(channel->multiplexer->l2cap_cid)){
2381         log_error("rfcomm_send_internal: l2cap cannot send now");
2382         return BTSTACK_ACL_BUFFERS_FULL;
2383     }
2384 
2385 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2386 #else
2387     rfcomm_reserve_packet_buffer();
2388 #endif
2389     uint8_t * rfcomm_payload = rfcomm_get_outgoing_buffer();
2390 
2391     (void)memcpy(rfcomm_payload, data, len);
2392     status = rfcomm_send_prepared(rfcomm_cid, len);
2393 
2394 #ifdef RFCOMM_USE_OUTGOING_BUFFER
2395 #else
2396     if (status != ERROR_CODE_SUCCESS){
2397         rfcomm_release_packet_buffer();
2398     }
2399 #endif
2400 
2401     return ERROR_CODE_SUCCESS;
2402 }
2403 
2404 // Sends Local Line Status, see LINE_STATUS_..
2405 uint8_t rfcomm_send_local_line_status(uint16_t rfcomm_cid, uint8_t line_status){
2406     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2407     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2408     if (channel->local_line_status != RFCOMM_RLS_STATUS_INVALID) return ERROR_CODE_COMMAND_DISALLOWED;
2409     channel->local_line_status = line_status;
2410     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2411     return ERROR_CODE_SUCCESS;
2412 }
2413 
2414 // Sned local modem status. see MODEM_STAUS_..
2415 uint8_t rfcomm_send_modem_status(uint16_t rfcomm_cid, uint8_t modem_status){
2416     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2417     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2418     channel->local_modem_status = modem_status;
2419     // trigger send
2420     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_MSC_CMD);
2421     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2422     return ERROR_CODE_SUCCESS;
2423 }
2424 
2425 // Configure remote port
2426 uint8_t rfcomm_send_port_configuration(uint16_t rfcomm_cid, rpn_baud_t baud_rate, rpn_data_bits_t data_bits, rpn_stop_bits_t stop_bits, rpn_parity_t parity, uint8_t flow_control){
2427     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2428     if (!channel){
2429         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2430     }
2431 
2432     // store remote config
2433     channel->remote_rpn_data.baud_rate = baud_rate;
2434     channel->remote_rpn_data.flags = data_bits | (stop_bits << 2) | (parity << 3);
2435     channel->remote_rpn_data.flow_control = flow_control;
2436     channel->remote_rpn_data.xon = 0;
2437     channel->remote_rpn_data.xoff = 0;
2438     channel->remote_rpn_data.parameter_mask_0 = 0x1f;   // all but xon/xoff
2439     channel->remote_rpn_data.parameter_mask_1 = 0x3f;   // all flow control options
2440 
2441     // trigger send
2442     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_CONFIG);
2443     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2444     return ERROR_CODE_SUCCESS;
2445 }
2446 
2447 // Query remote port
2448 uint8_t rfcomm_query_port_configuration(uint16_t rfcomm_cid){
2449     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2450     if (!channel){
2451         return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2452     }
2453     // trigger send
2454     rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_RPN_QUERY | RFCOMM_CHANNEL_STATE_VAR_EMIT_RPN_RESPONSE);
2455     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2456     return ERROR_CODE_SUCCESS;
2457 }
2458 
2459 
2460 static uint8_t rfcomm_channel_create_internal(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t incoming_flow_control, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2461     log_info("create addr %s channel #%u init credits %u",  bd_addr_to_str(addr), server_channel, initial_credits);
2462 
2463     // create new multiplexer if necessary
2464     uint8_t status = 0;
2465     uint8_t dlci = 0;
2466     int new_multiplexer = 0;
2467     rfcomm_channel_t * channel = NULL;
2468     rfcomm_multiplexer_t * multiplexer = rfcomm_multiplexer_for_addr(addr);
2469     if (!multiplexer) {
2470         multiplexer = rfcomm_multiplexer_create_for_addr(addr);
2471         if (!multiplexer) return BTSTACK_MEMORY_ALLOC_FAILED;
2472 
2473         multiplexer->outgoing = 1;
2474         multiplexer->state = RFCOMM_MULTIPLEXER_W4_CONNECT;
2475         new_multiplexer = 1;
2476     }
2477 
2478     // check if channel for this remote service already exists
2479     dlci = (server_channel << 1) | (multiplexer->outgoing ^ 1);
2480     channel = rfcomm_channel_for_multiplexer_and_dlci(multiplexer, dlci);
2481     if (channel){
2482         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2483         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2484     }
2485 
2486     // prepare channel
2487     channel = rfcomm_channel_create(multiplexer, NULL, server_channel);
2488     if (!channel){
2489         if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2490         return BTSTACK_MEMORY_ALLOC_FAILED;
2491     }
2492 
2493     // rfcomm_cid is already assigned by rfcomm_channel_create
2494     channel->incoming_flow_control = incoming_flow_control;
2495     channel->new_credits_incoming  = initial_credits;
2496     channel->packet_handler = packet_handler;
2497 
2498     // return rfcomm_cid
2499     if (out_rfcomm_cid){
2500         *out_rfcomm_cid = channel->rfcomm_cid;
2501     }
2502 
2503     // start multiplexer setup
2504     if (multiplexer->state != RFCOMM_MULTIPLEXER_OPEN) {
2505         channel->state = RFCOMM_CHANNEL_W4_MULTIPLEXER;
2506         uint16_t l2cap_cid = 0;
2507 #ifdef RFCOMM_USE_ERTM
2508         // request
2509         rfcomm_ertm_request_t request;
2510         memset(&request, 0, sizeof(rfcomm_ertm_request_t));
2511         (void)memcpy(request.addr, addr, 6);
2512         request.ertm_id = rfcomm_next_ertm_id();
2513         if (rfcomm_ertm_request_callback){
2514             (*rfcomm_ertm_request_callback)(&request);
2515         }
2516         if (request.ertm_config && request.ertm_buffer && request.ertm_buffer_size){
2517             multiplexer->ertm_id = request.ertm_id;
2518             status = l2cap_ertm_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM,
2519                         request.ertm_config, request.ertm_buffer, request.ertm_buffer_size, &l2cap_cid);
2520         }
2521         else
2522 #endif
2523         {
2524             status = l2cap_create_channel(rfcomm_packet_handler, addr, BLUETOOTH_PROTOCOL_RFCOMM, l2cap_max_mtu(), &l2cap_cid);
2525         }
2526         if (status) {
2527             if (new_multiplexer) btstack_memory_rfcomm_multiplexer_free(multiplexer);
2528             btstack_memory_rfcomm_channel_free(channel);
2529             return status;
2530         }
2531         multiplexer->l2cap_cid = l2cap_cid;
2532         return ERROR_CODE_SUCCESS;
2533     }
2534 
2535     channel->state = RFCOMM_CHANNEL_SEND_UIH_PN;
2536 
2537     // start connecting, if multiplexer is already up and running
2538     l2cap_request_can_send_now_event(multiplexer->l2cap_cid);
2539     return ERROR_CODE_SUCCESS;
2540 }
2541 
2542 uint8_t rfcomm_create_channel_with_initial_credits(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint8_t initial_credits, uint16_t * out_rfcomm_cid){
2543     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 1, initial_credits, out_rfcomm_cid);
2544 }
2545 
2546 uint8_t rfcomm_create_channel(btstack_packet_handler_t packet_handler, bd_addr_t addr, uint8_t server_channel, uint16_t * out_rfcomm_cid){
2547     return rfcomm_channel_create_internal(packet_handler, addr, server_channel, 0, RFCOMM_CREDITS, out_rfcomm_cid);
2548 }
2549 
2550 uint8_t rfcomm_disconnect(uint16_t rfcomm_cid){
2551     log_info("disconnect cid 0x%02x", rfcomm_cid);
2552     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2553     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2554 
2555     channel->state = RFCOMM_CHANNEL_SEND_DISC;
2556     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2557     return ERROR_CODE_SUCCESS;
2558 }
2559 
2560 static uint8_t rfcomm_register_service_internal(btstack_packet_handler_t packet_handler,
2561     uint8_t channel, uint16_t max_frame_size, uint8_t incoming_flow_control, uint8_t initial_credits){
2562 
2563     log_info("register channel #%u mtu %u flow_control %u credits %u",
2564              channel, max_frame_size, incoming_flow_control, initial_credits);
2565 
2566     // check if already registered
2567     rfcomm_service_t * service = rfcomm_service_for_channel(channel);
2568     if (service){
2569         return RFCOMM_CHANNEL_ALREADY_REGISTERED;
2570     }
2571 
2572     // alloc structure
2573     service = btstack_memory_rfcomm_service_get();
2574     if (!service) {
2575         return BTSTACK_MEMORY_ALLOC_FAILED;
2576     }
2577 
2578     // register with l2cap if not registered before, max MTU
2579     if (btstack_linked_list_empty(&rfcomm_services)){
2580         uint8_t status = l2cap_register_service(rfcomm_packet_handler, BLUETOOTH_PROTOCOL_RFCOMM, 0xffff, rfcomm_security_level);
2581         if (status != ERROR_CODE_SUCCESS){
2582             btstack_memory_rfcomm_service_free(service);
2583             return status;
2584         }
2585     }
2586 
2587     // fill in
2588     service->packet_handler = packet_handler;
2589     service->server_channel = channel;
2590     service->max_frame_size = max_frame_size;
2591     service->incoming_flow_control = incoming_flow_control;
2592     service->incoming_initial_credits = initial_credits;
2593 
2594     // add to services list
2595     btstack_linked_list_add(&rfcomm_services, (btstack_linked_item_t *) service);
2596 
2597     return ERROR_CODE_SUCCESS;
2598 }
2599 
2600 uint8_t rfcomm_register_service_with_initial_credits(btstack_packet_handler_t packet_handler,
2601     uint8_t channel, uint16_t max_frame_size, uint8_t initial_credits){
2602 
2603     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 1, initial_credits);
2604 }
2605 
2606 uint8_t rfcomm_register_service(btstack_packet_handler_t packet_handler, uint8_t channel,
2607     uint16_t max_frame_size){
2608 
2609     return rfcomm_register_service_internal(packet_handler, channel, max_frame_size, 0,RFCOMM_CREDITS);
2610 }
2611 
2612 void rfcomm_unregister_service(uint8_t service_channel){
2613     rfcomm_service_t *service = rfcomm_service_for_channel(service_channel);
2614     if (!service) return;
2615     btstack_linked_list_remove(&rfcomm_services, (btstack_linked_item_t *) service);
2616     btstack_memory_rfcomm_service_free(service);
2617 
2618     // unregister if no services active
2619     if (btstack_linked_list_empty(&rfcomm_services)){
2620         // bt_send_cmd(&l2cap_unregister_service, BLUETOOTH_PROTOCOL_RFCOMM);
2621         l2cap_unregister_service(BLUETOOTH_PROTOCOL_RFCOMM);
2622     }
2623 }
2624 
2625 uint8_t rfcomm_accept_connection(uint16_t rfcomm_cid){
2626     log_info("accept cid 0x%02x", rfcomm_cid);
2627     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2628     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2629 
2630     switch (channel->state) {
2631         case RFCOMM_CHANNEL_INCOMING_SETUP:
2632             rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_CLIENT_ACCEPTED);
2633             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_PN){
2634                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_PN_RSP);
2635                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2636             }
2637             if (channel->state_var & RFCOMM_CHANNEL_STATE_VAR_RCVD_SABM){
2638                 rfcomm_channel_state_add(channel, RFCOMM_CHANNEL_STATE_VAR_SEND_UA);
2639                 l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2640             }
2641             // at least one of { PN RSP, UA } needs to be sent
2642             // state transistion incoming setup -> dlc setup happens in rfcomm_run after these have been sent
2643             return ERROR_CODE_SUCCESS;
2644         default:
2645            return ERROR_CODE_COMMAND_DISALLOWED;
2646     }
2647 }
2648 
2649 uint8_t rfcomm_decline_connection(uint16_t rfcomm_cid){
2650     log_info("decline cid 0x%02x", rfcomm_cid);
2651     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2652     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2653 
2654     switch (channel->state) {
2655         case RFCOMM_CHANNEL_INCOMING_SETUP:
2656             channel->state = RFCOMM_CHANNEL_SEND_DM;
2657             l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2658             return ERROR_CODE_SUCCESS;
2659         default:
2660             return ERROR_CODE_COMMAND_DISALLOWED;
2661     }
2662 }
2663 
2664 uint8_t rfcomm_grant_credits(uint16_t rfcomm_cid, uint8_t credits){
2665     log_info("grant cid 0x%02x credits %u", rfcomm_cid, credits);
2666     rfcomm_channel_t * channel = rfcomm_channel_for_rfcomm_cid(rfcomm_cid);
2667     if (!channel) return ERROR_CODE_UNKNOWN_CONNECTION_IDENTIFIER;
2668     if (!channel->incoming_flow_control) return ERROR_CODE_COMMAND_DISALLOWED;
2669     channel->new_credits_incoming += credits;
2670 
2671     // process
2672     l2cap_request_can_send_now_event(channel->multiplexer->l2cap_cid);
2673     return ERROR_CODE_SUCCESS;
2674 }
2675 
2676 #ifdef RFCOMM_USE_ERTM
2677 void rfcomm_enable_l2cap_ertm(void request_callback(rfcomm_ertm_request_t * request), void released_callback(uint16_t ertm_id)){
2678     rfcomm_ertm_request_callback  = request_callback;
2679     rfcomm_ertm_released_callback = released_callback;
2680 }
2681 #endif
2682